mtech-ai-local-runner 0.1.29 → 0.1.30

package/README.md

@@ -1,4 +1,17 @@
-## 0.1.29 candidate: reviewed daemon Codex admission
+## 0.1.30: governed local alert investigation evidence
+
+The Gateway candidate offers explicit Local Codex Runner or Local Claude Runner
+selection for read-only Sentry investigation. It binds the chosen adapter/model
+and employee device to the exact approved launch; it never falls back to another
+adapter. Each adapter retains authenticated host-owned bounded read observations
+through completion and cleanup. These counts are employee-runner evidence, not
+independent root-cause verification.
+
+This release does not remove Claude's current unsupported host-admission gate.
+An installed or authenticated CLI alone is not execution permission. Gateway
+deployment, feature activation and actual execution approvals remain separate.
+
+## 0.1.29: reviewed daemon Codex admission
 
 This candidate connects the installed, hash-pinned root policy observer to the
 existing employee-privileged Codex CLI adapter. The observer accepts only its
@@ -35,7 +48,15 @@ npx mtech-ai-local-runner setup
 
 The package stores safe runner configuration locally and keeps OAuth refresh credentials in macOS Keychain when available.
 
-Public npm installation requires no npm account or publishing OTP. Setup requires Gateway OAuth login, and local Claude Code must already be authenticated (`claude auth status`).
+Public npm installation requires no npm account or publishing OTP. Setup requires
+the employee's own Gateway OAuth login and a supported, authenticated selected
+CLI. Codex uses the employee's ChatGPT account. Claude requires its own login
+and a separately verified host admission; it is currently not admitted.
+
+For the current unattended Codex pilot, an administrator must separately install
+the reviewed, employee-UID-bound policy observer on that Mac. The npm setup
+command does not install that privileged service. A fresh employee computer is
+not ready merely because npm installation succeeds.
 
 ## 0.1.28: completion receipt wire compatibility
 

package/dist/src/adapters/claude-code/adapter.js

@@ -8,6 +8,7 @@ import { completionEvent } from "./completion-report.js";
 import { requireJobSecurity } from "../../safety/job-security-policy.js";
 import { HOOK_POLICY_ENV_VAR, buildHookPolicy, encodeHookPolicy } from "../../safety/hook-policy-builder.js";
 import { formatHookCommand } from "../../safety/hook-command.js";
+import { localEndpointReadObservations } from '../../safety/local-tool-server.js';
 const ALLOWED_ENV_KEYS = ["PATH", "HOME", "USER", "LOGNAME", "LANG", "LC_ALL", "TMPDIR", "NODE_ENV", "CLAUDE_CONFIG_DIR"];
 const ALLOWED_SUPERVISOR_COMMANDS = new Set(["continue", "answer_question", "request_revision", "request_checkpoint", "submit_for_review"]);
 const LOCAL_NAMES = ["local_read", "local_search", "local_edit", "local_test"].map(name => `mcp__ai_local__${name}`);
@@ -44,7 +45,16 @@ export class ClaudeCodeAdapter {
     cancelled = false;
     started = false;
     receipt;
+    toolEndpoint;
+    readSnapshot;
     securityReceipt() { return this.receipt ? structuredClone(this.receipt) : undefined; }
+    localReadObservations() {
+        const endpoint = this.toolEndpoint;
+        const observed = endpoint ? localEndpointReadObservations(endpoint.url, endpoint.token) : undefined;
+        if (observed)
+            this.readSnapshot = observed;
+        return this.readSnapshot ? structuredClone(this.readSnapshot) : undefined;
+    }
     constructor(options) {
         this.options = options;
     }
@@ -97,6 +107,7 @@ export class ClaudeCodeAdapter {
             if (this.cancelled)
                 throw new Error("adapter startup cancelled");
             const endpoint = await this.tools.start();
+            this.toolEndpoint = endpoint;
             if (this.cancelled)
                 throw new Error("adapter startup cancelled");
             const mcpConfigPath = this.options.writeLocalMcpConfig(endpoint);
@@ -222,6 +233,8 @@ export class ClaudeCodeAdapter {
         await this.cleanup();
     }
     async cleanup() {
+        this.localReadObservations();
+        this.toolEndpoint = undefined;
         const tools = this.tools;
         const handle = this.handle;
         this.tools = undefined;

package/dist/src/adapters/codex/adapter.js

@@ -19,6 +19,7 @@ export class CodexAdapter {
     started = false;
     receipt;
     terminalAudit;
+    localReadObservations() { return this.usingOfficialExec ? this.ownedExec?.localReadObservations() : undefined; }
     securityReceipt() { return this.terminalAudit ? structuredClone(this.terminalAudit) : this.usingOfficialExec ? this.ownedExec?.receipt() : this.receipt ? structuredClone(this.receipt) : undefined; }
     cancelled = false;
     usingOfficialExec = false;

package/dist/src/adapters/codex/exec-launch-host.js

@@ -1,6 +1,6 @@
 import { performance } from 'node:perf_hooks';
 import { PreparationClock, CODEX_PREPARATION_BUDGET_MS } from '../../safety/preparation-timing.js';
-import { localEndpointObservations } from '../../safety/local-tool-server.js';
+import { localEndpointObservations, localEndpointReadObservations } from '../../safety/local-tool-server.js';
 import { processStartupObservations, freezeProcessLaunchObservation } from '../../process/node-process-group-host.js';
 import { executionError } from '../../safety/execution-failure.js';
 import { UNMANAGED_EXEC_MODE } from './unmanaged-scope.js';
@@ -24,6 +24,7 @@ export class CodexExecLaunchHost {
     handle;
     inspection;
     exitAudit;
+    readAudit;
     inspectionFingerprint;
     handshake;
     receiptValue;
@@ -233,9 +234,22 @@ export class CodexExecLaunchHost {
     catch {
         return undefined;
     } }
+    localReadObservations() {
+        if (!this.stopped) {
+            try {
+                const token = requireOfficialExecPlan(this.plan).env.AI_GATEWAY_JOB_MCP_TOKEN;
+                const current = token ? localEndpointReadObservations(this.plan.endpoint, token) : undefined;
+                if (current)
+                    this.readAudit = current;
+            }
+            catch { /* Absent observation is never interpreted as successful reads. */ }
+        }
+        return this.readAudit ? structuredClone(this.readAudit) : undefined;
+    }
     cancel() {
         if (this.closePromise)
             return this.closePromise;
+        this.localReadObservations();
         this.stopped = true;
         this.receiptValue = undefined;
         if (!this.ownsAttempt) {

package/dist/src/daemon/execution-coordinator.js

@@ -184,6 +184,16 @@ export class ExecutionCoordinator {
                 const evidence = this.deps.terminalEvidenceCollector.collect({ checkoutPath: workspace.path, baseSha: workspace.baseCommitSha });
                 payload = { ...payload, diff_hash: evidence.diffHash, changed_file_manifest_hash: evidence.changedFileManifestHash };
             }
+            // A vendor report cannot supply host observations, even when its shape looks valid.
+            if (payload) {
+                payload = { ...payload };
+                delete payload.local_read_observations;
+            }
+            if (isTerminalEventType(event.eventType) || event.eventType === 'blocked' || event.eventType === 'scope_conflict') {
+                const reads = safeLocalReadObservations(adapter.localReadObservations?.());
+                if (reads)
+                    payload = { ...payload, local_read_observations: reads };
+            }
             const normalized = {
                 protocolVersion: PROTOCOL_VERSION, bindingId: binding.bindingId,
                 sequence: sequence + 1, eventType: event.eventType,
@@ -274,7 +284,8 @@ export class ExecutionCoordinator {
         const reportDiagnostic = diagnostic && (terminal.eventType === "blocked"
             ? diagnostic.code === "CODEX_COMPLETION_REPORT_BLOCKED" : diagnostic.code !== "CODEX_COMPLETION_REPORT_BLOCKED") ? diagnostic : undefined;
         const securityReceipt = adapter.securityReceipt?.();
-        const completionRequest = structuredClone({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken, status, result: { binding_id: binding.bindingId, event_type: terminal.eventType, summary: terminal.summary, ...(failureDiagnostic ? { execution_failure: { ...failureDiagnostic } } : {}), ...(reportDiagnostic ? { completion_report: reportDiagnostic } : {}), ...(securityReceipt ? { security_receipt: securityReceipt } : {}) } });
+        const reads = safeLocalReadObservations(adapter.localReadObservations?.());
+        const completionRequest = structuredClone({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken, status, result: { binding_id: binding.bindingId, event_type: terminal.eventType, summary: terminal.summary, ...(reads ? { local_read_observations: reads } : {}), ...(failureDiagnostic ? { execution_failure: { ...failureDiagnostic } } : {}), ...(reportDiagnostic ? { completion_report: reportDiagnostic } : {}), ...(securityReceipt ? { security_receipt: securityReceipt } : {}) } });
         await this.deps.state.save({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken,
             phase: "terminal_pending", bindingId: binding.bindingId, terminalEventType: terminal.eventType,
             completionRequest: structuredClone(completionRequest) });
@@ -282,3 +293,4 @@ export class ExecutionCoordinator {
         await this.deps.state.clear();
     }
 }
+import { safeLocalReadObservations } from '../safety/local-read-observations.js';

package/dist/src/safety/local-read-observations.js

@@ -0,0 +1,17 @@
+export function safeLocalReadObservations(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return;
+    const v = value, c = v.classification_counts;
+    if (Object.keys(v).sort().join() !== ['version', 'successful_read_calls', 'unique_successful_paths', 'failed_read_calls', 'classification_counts', 'truncated'].sort().join()
+        || v.version !== 'local-read-observations-v1' || typeof v.truncated !== 'boolean' || !c || typeof c !== 'object' || Array.isArray(c))
+        return;
+    const counts = c;
+    if (Object.keys(counts).sort().join() !== 'documentation,source')
+        return;
+    const numbers = [v.successful_read_calls, v.unique_successful_paths, v.failed_read_calls, counts.documentation, counts.source];
+    if (numbers.some(n => !Number.isSafeInteger(n) || Number(n) < 0 || Number(n) > 1_000_000)
+        || Number(v.unique_successful_paths) > 1024 || Number(v.unique_successful_paths) > Number(v.successful_read_calls)
+        || Number(counts.documentation) + Number(counts.source) !== v.successful_read_calls)
+        return;
+    return structuredClone(value);
+}

package/dist/src/safety/local-tool-server.js

@@ -1,5 +1,6 @@
 import { createServer } from 'node:http';
 import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+import path from 'node:path';
 import { LOCAL_TOOL_NAMES } from './local-tool-policy.js';
 const discoveryScopes = new WeakMap();
 export function localDiscoveryScopeMatches(scope, endpoint, token) {
@@ -10,6 +11,10 @@ export function localDiscoveryScopeMatches(scope, endpoint, token) {
 }
 // Bounded diagnostic metadata; possession grants neither discovery nor tool authority.
 const endpointObservations = new Map();
+export function localEndpointReadObservations(url, token) {
+    const record = endpointObservations.get(url);
+    return record?.credentialHash === createHash('sha256').update(token).digest('hex') ? record.reads() : undefined;
+}
 export function localEndpointObservations(url, token) {
     const record = endpointObservations.get(url);
     return record?.credentialHash === createHash('sha256').update(token).digest('hex') ? [...record.values] : [];
@@ -28,6 +33,32 @@ export function localToolInventory() {
 /** Job-only JSON MCP endpoint; intentionally has no Gateway transport or discovery. */
 export class LocalToolServer {
     options;
+    readCounts = { version: 'local-read-observations-v1', successful_read_calls: 0, unique_successful_paths: 0, failed_read_calls: 0, classification_counts: { documentation: 0, source: 0 }, truncated: false };
+    readPathDigests = new Set();
+    /** Counts are server-authored observations, not model evidence or a policy attestation. */
+    readObservations() { return structuredClone(this.readCounts); }
+    recordRead(success, args) {
+        const count = success ? 'successful_read_calls' : 'failed_read_calls';
+        if (this.readCounts[count] >= 1_000_000) {
+            this.readCounts.truncated = true;
+            return;
+        }
+        this.readCounts[count]++;
+        if (!success)
+            return;
+        const value = (args && typeof args === 'object' && !Array.isArray(args) ? args.path : undefined);
+        const file = path.posix.normalize(typeof value === 'string' ? value : '');
+        const category = file.startsWith('docs/') ? 'documentation' : 'source';
+        this.readCounts.classification_counts[category]++;
+        const digest = createHash('sha256').update(file).digest('hex');
+        if (!this.readPathDigests.has(digest)) {
+            if (this.readPathDigests.size < 1024)
+                this.readPathDigests.add(digest);
+            else
+                this.readCounts.truncated = true;
+        }
+        this.readCounts.unique_successful_paths = this.readPathDigests.size;
+    }
     observations = new Set();
     server = null;
     revoked = false;
@@ -174,6 +205,8 @@ export class LocalToolServer {
                         return;
                     }
                     send({ content: [{ type: 'text', text: JSON.stringify(result) }] });
+                    if (params.name === 'local_read')
+                        this.recordRead(true, params.arguments);
                 }
                 catch (error) {
                     if (this.token !== token || !this.allowed()) {
@@ -182,6 +215,8 @@ export class LocalToolServer {
                     }
                     // Only stable policy error identifiers cross this boundary, never raw paths/stderr.
                     const code = error instanceof Error ? error.message.match(/^(DENIED_[A-Z_]+|LOCAL_SANDBOX_UNAVAILABLE)/)?.[0] : undefined;
+                    if (params.name === 'local_read')
+                        this.recordRead(false, params.arguments);
                     send({ isError: true, content: [{ type: 'text', text: code ?? 'LOCAL_TOOL_FAILED' }] });
                 }
             }
@@ -203,7 +238,7 @@ export class LocalToolServer {
         if (!address || typeof address === 'string')
             throw new Error('Failed to bind local tool server');
         this.url = `http://127.0.0.1:${address.port}/mcp`;
-        endpointObservations.set(this.url, { credentialHash: createHash('sha256').update(this.token).digest('hex'), values: this.observations });
+        endpointObservations.set(this.url, { credentialHash: createHash('sha256').update(this.token).digest('hex'), values: this.observations, reads: () => this.readObservations() });
         discoveryScopes.set(this.discoveryScope, { endpoint: this.url, credentialHash: createHash('sha256').update(this.token).digest('hex') });
         return { url: this.url, token: this.token };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.29",
+  "version": "0.1.30",
   "private": false,
   "license": "UNLICENSED",
   "bin": {