mtech-ai-local-runner 0.1.3 → 0.1.5

package/README.md

@@ -7,3 +7,28 @@ npx mtech-ai-local-runner setup
 ```
 
 The package stores safe runner configuration locally and keeps OAuth refresh credentials in macOS Keychain when available.
+
+Public npm installation requires no npm account or publishing OTP. Setup requires Gateway OAuth login, and local Claude Code must already be authenticated (`claude auth status`).
+
+## 0.1.5
+
+- Authenticate local MCP relay callers with a random per-job bearer capability.
+- Forward only the job-selected Gateway tools; filter tool discovery and reject other MCP methods, batches, browser origins and foreign Host headers.
+- Revoke capabilities and remove private MCP configs when jobs settle or the runtime closes normally.
+- Update uuid to patched version 11.1.1.
+
+The relay binds only to loopback. Local capabilities are stored in private mode-0600 config files, never URLs or command arguments. Gateway OAuth tokens stay in the runner. Abrupt process termination may leave a private config file; its capability is inert after the relay dies and is never reused by a new process. These controls do not sandbox malicious programs already running as the same macOS user.
+
+## 0.1.4
+
+- Independently verify the approved contract payload and task-package fingerprints before creating a runtime binding.
+- Include actual diff and changed-file manifest hashes in terminal events, with a final checkpoint before completion.
+- Fail closed on missing terminal events, failed launches, unavailable evidence, or rejected event reports.
+- Read and acknowledge supervisor controls; preserve the terminal status when reconciling a daemon restart.
+
+Existing employees can upgrade their installed daemon with:
+
+```bash
+npx mtech-ai-local-runner@0.1.5 setup
+npx mtech-ai-local-runner@0.1.5 doctor
+```

package/dist/src/auth/mcp-relay-config.js

@@ -0,0 +1,47 @@
+import { mkdirSync, writeFileSync, chmodSync, unlinkSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { join } from "node:path";
+/** Private local capabilities only. Gateway OAuth credentials never enter this file. */
+export class McpRelayConfig {
+    stateRoot;
+    relay;
+    url;
+    path = null;
+    constructor(stateRoot, relay, url) {
+        this.stateRoot = stateRoot;
+        this.relay = relay;
+        this.url = url;
+    }
+    write(config) {
+        this.clear();
+        const directory = join(this.stateRoot, "mcp-config");
+        mkdirSync(directory, { recursive: true, mode: 0o700 });
+        chmodSync(directory, 0o700);
+        const path = join(directory, `mcp-${randomUUID()}.json`);
+        const mcpServers = config.tools.allow.length ? {
+            ai_gateway: { type: "http", url: this.url, headers: this.relay.authorizeTools(config.tools.allow) },
+        } : {};
+        try {
+            writeFileSync(path, JSON.stringify({ mcpServers }), { mode: 0o600, flag: "wx" });
+            this.path = path;
+            return path;
+        }
+        catch (error) {
+            this.relay.revokeAuthorization();
+            throw error;
+        }
+    }
+    clear() {
+        this.relay.revokeAuthorization();
+        if (this.path) {
+            try {
+                unlinkSync(this.path);
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    throw error;
+            }
+            this.path = null;
+        }
+    }
+}

package/dist/src/auth/mcp-relay.js

@@ -1,9 +1,16 @@
 import { createServer } from "node:http";
+import { randomBytes, timingSafeEqual } from "node:crypto";
 const MAX_BODY_SIZE = 1024 * 1024; // 1 MiB
 export class McpRelay {
     opts;
     server = null;
     url = null;
+    authorization = null;
+    authorizeTools(tools) {
+        this.authorization = { secret: randomBytes(32).toString("hex"), tools: new Set(tools) };
+        return { Authorization: `Bearer ${this.authorization.secret}` };
+    }
+    revokeAuthorization() { this.authorization = null; }
     constructor(opts) {
         this.opts = opts;
         // Validate upstreamMcpUrl is HTTPS and a valid URL
@@ -27,8 +34,21 @@ export class McpRelay {
                         res.end("Not found");
                         return;
                     }
+                    if (req.headers.origin !== undefined || req.headers.host !== new URL(this.url).host) {
+                        res.writeHead(403);
+                        res.end("Forbidden");
+                        return;
+                    }
+                    const authorization = this.authorization;
+                    const supplied = Buffer.from(req.headers.authorization ?? "");
+                    const expected = Buffer.from(authorization ? `Bearer ${authorization.secret}` : "");
+                    if (!authorization || supplied.length !== expected.length || !timingSafeEqual(supplied, expected)) {
+                        res.writeHead(401);
+                        res.end("Unauthorized");
+                        return;
+                    }
                     // Collect body with size limit
-                    let body = "";
+                    const chunks = [];
                     let size = 0;
                     let tooLarge = false;
                     let aborted = false;
@@ -43,7 +63,7 @@ export class McpRelay {
                             req.destroy();
                             return;
                         }
-                        body += chunk.toString();
+                        chunks.push(chunk);
                     });
                     req.on("end", async () => {
                         if (tooLarge || aborted)
@@ -52,18 +72,33 @@ export class McpRelay {
                             // Validate JSON
                             let payload;
                             try {
-                                payload = JSON.parse(body);
+                                payload = JSON.parse(Buffer.concat(chunks).toString("utf8"));
                             }
                             catch {
                                 res.writeHead(400, { "content-type": "application/json" });
                                 res.end(JSON.stringify({ error: "Invalid JSON" }));
                                 return;
                             }
+                            if (!this.allowedRequest(payload, authorization.tools)) {
+                                res.writeHead(403);
+                                res.end("Forbidden MCP request");
+                                return;
+                            }
                             // Check one more time that we can respond (guard against race)
                             if (tooLarge || aborted)
                                 return;
+                            if (this.authorization !== authorization) {
+                                res.writeHead(401);
+                                res.end("Authorization revoked");
+                                return;
+                            }
                             // Get current token
                             const token = await this.opts.tokenProvider.getToken();
+                            if (this.authorization !== authorization) {
+                                res.writeHead(401);
+                                res.end("Authorization revoked");
+                                return;
+                            }
                             // Forward to upstream with token injection
                             // Ensure exact URL match to prevent redirection to unintended endpoints
                             const upstreamUrl = new URL(this.opts.upstreamMcpUrl);
@@ -72,12 +107,20 @@ export class McpRelay {
                                 headers: {
                                     Authorization: `Bearer ${token}`,
                                     "content-type": "application/json",
+                                    Accept: "application/json",
                                 },
-                                body,
+                                body: JSON.stringify(payload),
                                 redirect: "error",
                             });
                             // Read upstream response
-                            const upstreamText = await upstreamResponse.text();
+                            let upstreamText = await upstreamResponse.text();
+                            if (payload.method === "tools/list" && upstreamResponse.ok) {
+                                const listed = JSON.parse(upstreamText);
+                                if (!Array.isArray(listed.result?.tools))
+                                    throw new Error("Invalid upstream tool list");
+                                listed.result.tools = listed.result.tools.filter((tool) => typeof tool?.name === "string" && authorization.tools.has(tool.name));
+                                upstreamText = JSON.stringify(listed);
+                            }
                             // Redact tokens from upstream errors
                             const redactedText = this.redactSecrets(upstreamText);
                             // Forward response to client
@@ -117,6 +160,7 @@ export class McpRelay {
         });
     }
     async close() {
+        this.revokeAuthorization();
         return new Promise((resolve, reject) => {
             if (!this.server) {
                 resolve();
@@ -130,9 +174,26 @@ export class McpRelay {
             });
         });
     }
+    allowedRequest(value, tools) {
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            return false;
+        const rpc = value;
+        if (rpc.jsonrpc !== "2.0" || typeof rpc.method !== "string")
+            return false;
+        if (rpc.method === "notifications/initialized")
+            return rpc.id === undefined;
+        if (!(typeof rpc.id === "string" || typeof rpc.id === "number"))
+            return false;
+        if (["initialize", "ping", "tools/list"].includes(rpc.method))
+            return true;
+        if (rpc.method !== "tools/call" || !rpc.params || typeof rpc.params !== "object" || Array.isArray(rpc.params))
+            return false;
+        const name = rpc.params.name;
+        return typeof name === "string" && tools.has(name);
+    }
     redactSecrets(text) {
         let sanitized = text;
-        for (const secret of this.opts.tokenProvider.secrets()) {
+        for (const secret of [...this.opts.tokenProvider.secrets(), this.authorization?.secret ?? ""].filter(Boolean)) {
             sanitized = sanitized.split(secret).join("[redacted]");
         }
         return sanitized;

package/dist/src/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { mkdirSync, writeFileSync, chmodSync, unlinkSync, realpathSync } from "node:fs";
+import { unlinkSync, realpathSync } from "node:fs";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { loadConfig, redact, isAuthConfig, isExecutionConfig, isServiceConfig } from "./config.js";
@@ -16,6 +16,7 @@ import { OAuthClient } from "./auth/oauth-client.js";
 import { LoopbackLogin } from "./auth/loopback-login.js";
 import { OAuthTokenProvider, LoginRequiredError } from "./auth/token-provider.js";
 import { McpRelay } from "./auth/mcp-relay.js";
+import { McpRelayConfig } from "./auth/mcp-relay-config.js";
 import { createBrowserOpener } from "./auth/browser-opener.js";
 import { FileLocalConfigStore } from "./registration/local-config.js";
 import { LaunchdService } from "./platform/macos/launchd.js";
@@ -51,26 +52,6 @@ function buildCheckoutPreflight() {
         },
     };
 }
-function buildMcpConfigWriter(stateRoot, relayUrl) {
-    return (config) => {
-        const dir = join(stateRoot, "mcp-config");
-        mkdirSync(dir, { recursive: true, mode: 0o700 });
-        const filePath = join(dir, `mcp-${process.pid}-${Date.now()}.json`);
-        // Write token-free config pointing to relay; relay injects auth
-        const mcpServers = config.tools.allow.length === 0
-            ? {}
-            : {
-                ai_gateway: {
-                    type: "http",
-                    url: relayUrl,
-                },
-            };
-        const contents = JSON.stringify({ mcpServers });
-        writeFileSync(filePath, contents, { mode: 0o600 });
-        chmodSync(filePath, 0o600);
-        return filePath;
-    };
-}
 async function buildOnceAdapter(config, env, tokenProvider, fetchFn) {
     const relay = new McpRelay({
         tokenProvider,
@@ -78,14 +59,7 @@ async function buildOnceAdapter(config, env, tokenProvider, fetchFn) {
         upstreamFetch: fetchFn,
     });
     const relayServer = await relay.start();
-    let configPath = null;
-    const configWriter = buildMcpConfigWriter(config.stateRoot, relayServer.url);
-    const originalWriteConfig = configWriter;
-    const wrappingConfigWriter = (cfg) => {
-        const path = originalWriteConfig(cfg);
-        configPath = path;
-        return path;
-    };
+    const configs = new McpRelayConfig(config.stateRoot, relay, relayServer.url);
     let adapter;
     try {
         adapter = new ClaudeCodeAdapter({
@@ -95,7 +69,7 @@ async function buildOnceAdapter(config, env, tokenProvider, fetchFn) {
             workItemLabel: config.workLoopId,
             env,
             registeredReadTools: config.registeredReadTools,
-            writeMcpConfig: wrappingConfigWriter,
+            writeMcpConfig: (cfg) => configs.write(cfg),
             mcpServerName: "ai_gateway",
             binaryPath: config.claudeBinaryPath,
             hookExecutablePath: config.hookExecutablePath,
@@ -112,7 +86,12 @@ async function buildOnceAdapter(config, env, tokenProvider, fetchFn) {
         throw err;
     }
     // Cleanup function: always attempts both config unlink and relay close
-    const cleanup = async () => cleanupOnceResources(configPath, () => relay.close());
+    const cleanup = async () => cleanupOnceResources(null, async () => { try {
+        configs.clear();
+    }
+    finally {
+        await relay.close();
+    } });
     return { adapter, cleanup };
 }
 async function handleLogin(config, stdout, stderr, fetchFn = fetch, opener) {
@@ -203,7 +182,7 @@ export async function main(argv, env, io = {}) {
                 const authenticated = await runFile(binary, ["auth", "status"], { encoding: "utf8" }).then(() => true).catch(() => false);
                 const registered = await gateway.registerLocalRunner({
                     deviceFingerprint: createHash("sha256").update(`${process.getuid?.() ?? 0}|${runnerDisplayName()}|${config.gatewayMcpUrl}`).digest("hex"),
-                    displayName: runnerDisplayName(), packageVersion: "0.1.3",
+                    displayName: runnerDisplayName(), packageVersion: "0.1.5",
                     capabilities: [{ adapter: "claude_code_cli", version: "1", capabilities: ["repository_read", "repository_edit", "shell_test", "git_diff"], authenticated }],
                 });
                 await localStore.save({ schemaVersion: 1, gatewayMcpUrl: config.gatewayMcpUrl, runnerId: registered.runner.id, workspaceRoot: config.workspaceRoot, concurrency: 1 });

package/dist/src/daemon/execution-coordinator.js

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { PROTOCOL_VERSION } from "../protocol.js";
+import { PROTOCOL_VERSION, isTerminalEventType, validateEvent, MAX_EVENT_SUMMARY_CHARS } from "../protocol.js";
 function canonical(value) {
     if (Array.isArray(value))
         return value.map(canonical);
@@ -12,6 +12,17 @@ export function fingerprint(value) {
         .replace(/[\u007f-\uffff]/g, (character) => `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`);
     return createHash("sha256").update(json).digest("hex");
 }
+export function contractFingerprint(payload) {
+    const unsigned = structuredClone(payload);
+    if (unsigned.provenance && typeof unsigned.provenance === "object") {
+        delete unsigned.provenance.compiled_at;
+    }
+    // Contract compiler uses PHP JSON's default escaped slashes. Job packages
+    // use JSON_UNESCAPED_SLASHES; the two hashing domains must stay distinct.
+    const json = JSON.stringify(canonical(unsigned)).replace(/\//g, "\\/")
+        .replace(/[\u007f-\uffff]/g, (character) => `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`);
+    return createHash("sha256").update(json).digest("hex");
+}
 function text(value, label) {
     if (typeof value !== "string" || value.length === 0)
         throw new Error(`task package is missing ${label}`);
@@ -27,7 +38,7 @@ export class ExecutionCoordinator {
         const repository = pkg.repository;
         const adapterId = text(pkg.runtime_adapter, "runtime adapter");
         const adapterVersion = text(pkg.runtime_adapter_version, "runtime adapter version");
-        const contractFingerprint = text(pkg.contract_fingerprint, "contract fingerprint");
+        const expectedContractFingerprint = text(pkg.contract_fingerprint, "contract fingerprint");
         const workspace = await this.deps.workspaces.create({
             jobId: job.id,
             repositoryKey: text(repository?.key, "repository key"),
@@ -37,45 +48,129 @@ export class ExecutionCoordinator {
         const adapter = await this.deps.registry.select(adapterId, adapterVersion, { worktreePath: workspace.path, jobId: job.id });
         await this.deps.state.save({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken, phase: "shadow", workspaceManifest: workspace.manifest });
         const gatewayShadow = await this.deps.gateway.shadow(job);
-        if (gatewayShadow.contractFingerprint !== contractFingerprint || gatewayShadow.taskPackageFingerprint !== fingerprint(pkg)) {
+        if (contractFingerprint(gatewayShadow.contractPayload) !== expectedContractFingerprint || gatewayShadow.contractFingerprint !== expectedContractFingerprint || gatewayShadow.taskPackageFingerprint !== fingerprint(pkg)) {
             throw new Error("contract or task-package fingerprint mismatch before binding");
         }
         const binding = await this.deps.gateway.createBinding({ ...job, checkoutPath: workspace.path });
         await this.deps.state.save({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken, phase: "running", bindingId: binding.bindingId, workspaceManifest: workspace.manifest });
-        await adapter.start({ bindingId: binding.bindingId, sessionId: binding.bindingId, taskPackage: binding.taskPackage, resolvedModelId: binding.resolvedModelId });
         let heartbeatFailure = null;
-        const heartbeatTimer = this.deps.gateway.heartbeat ? setInterval(() => {
-            void this.deps.gateway.heartbeat?.(binding.bindingId, job).catch(async (error) => {
+        let requestedTerminal;
+        let commandCursor = 0;
+        let controlsStopped = false;
+        let controlsInFlight;
+        const readControls = async () => {
+            if (!this.deps.gateway.readCommands || controlsStopped || requestedTerminal)
+                return;
+            if (controlsInFlight)
+                return controlsInFlight;
+            controlsInFlight = (async () => {
+                for (const command of await this.deps.gateway.readCommands(binding.bindingId, commandCursor)) {
+                    if (controlsStopped)
+                        return;
+                    if (["cancel", "pause", "request_replan"].includes(command.command)) {
+                        requestedTerminal = { eventType: command.command === "cancel" ? "cancelled" : "blocked", summary: `supervisor ${command.command} acknowledged` };
+                        await adapter.cancel();
+                    }
+                    else {
+                        await adapter.command(command);
+                    }
+                    if (!this.deps.gateway.acknowledgeCommand)
+                        throw new Error("daemon command acknowledgement is unavailable");
+                    await this.deps.gateway.acknowledgeCommand(binding.bindingId, command.sequence);
+                    commandCursor = command.sequence;
+                    if (requestedTerminal)
+                        break;
+                }
+            })();
+            try {
+                await controlsInFlight;
+            }
+            finally {
+                controlsInFlight = undefined;
+            }
+        };
+        const heartbeatTimer = this.deps.gateway.heartbeat || this.deps.gateway.readCommands ? setInterval(() => {
+            void (async () => { await this.deps.gateway.heartbeat?.(binding.bindingId, job); await readControls(); })().catch(async (error) => {
                 heartbeatFailure = error instanceof Error ? error : new Error(String(error));
                 await adapter.cancel().catch(() => undefined);
             });
         }, 30_000) : undefined;
         heartbeatTimer?.unref();
-        let terminal = { eventType: "completed", summary: "adapter completed" };
+        let terminal;
         let sequence = 0;
+        let checkpointSeen = false;
+        const append = async (event) => {
+            let payload = event.payload;
+            if (isTerminalEventType(event.eventType)) {
+                const evidence = this.deps.terminalEvidenceCollector.collect({ checkoutPath: workspace.path, baseSha: workspace.baseCommitSha });
+                payload = { ...payload, diff_hash: evidence.diffHash, changed_file_manifest_hash: evidence.changedFileManifestHash };
+            }
+            const normalized = {
+                protocolVersion: PROTOCOL_VERSION, bindingId: binding.bindingId,
+                sequence: sequence + 1, eventType: event.eventType,
+                summary: event.summary.slice(0, MAX_EVENT_SUMMARY_CHARS),
+                ...(payload ? { payload } : {}),
+                idempotencyKey: `${binding.bindingId}:${sequence + 1}`, occurredAt: new Date().toISOString(),
+            };
+            validateEvent(normalized);
+            if (!this.deps.gateway.appendEvent)
+                throw new Error("daemon event reporting is unavailable");
+            await this.deps.gateway.appendEvent(binding.bindingId, normalized);
+            sequence = normalized.sequence;
+            if (event.eventType === "checkpoint_ready")
+                checkpointSeen = true;
+            await this.deps.state.save({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken, phase: "running", bindingId: binding.bindingId, eventCursor: sequence, ...(isTerminalEventType(event.eventType) ? { terminalEventType: event.eventType } : {}), workspaceManifest: workspace.manifest });
+        };
         try {
-            if (adapter.events) {
+            await adapter.start({ bindingId: binding.bindingId, sessionId: binding.bindingId, taskPackage: binding.taskPackage, resolvedModelId: binding.resolvedModelId });
+            await readControls();
+            if (adapter.events && !requestedTerminal) {
                 for await (const event of adapter.events()) {
                     if (heartbeatFailure)
                         throw heartbeatFailure;
-                    terminal = event;
-                    sequence += 1;
-                    await this.deps.gateway.appendEvent?.(binding.bindingId, {
-                        protocolVersion: PROTOCOL_VERSION,
-                        bindingId: binding.bindingId,
-                        sequence,
-                        eventType: event.eventType,
-                        summary: event.summary,
-                        ...(event.payload ? { payload: event.payload } : {}),
-                        idempotencyKey: `${binding.bindingId}:${sequence}`,
-                        occurredAt: new Date().toISOString(),
-                    });
-                    if (["completed", "failed", "cancelled", "blocked", "scope_conflict"].includes(event.eventType))
+                    if (requestedTerminal)
+                        break;
+                    if (event.eventType === "completed" && !checkpointSeen) {
+                        await append({ eventType: "checkpoint_ready", summary: "final checkpoint ready" });
+                    }
+                    if (isTerminalEventType(event.eventType)) {
+                        if (controlsInFlight)
+                            await controlsInFlight;
+                        if (requestedTerminal)
+                            break;
+                        controlsStopped = true;
+                    }
+                    await append(event);
+                    if (isTerminalEventType(event.eventType) || ["blocked", "scope_conflict"].includes(event.eventType)) {
+                        controlsStopped = true;
+                        terminal = event;
                         break;
+                    }
+                    await readControls();
                 }
             }
+            if (controlsInFlight)
+                await controlsInFlight;
+            if (requestedTerminal) {
+                terminal = requestedTerminal;
+                await append(terminal);
+            }
+            if (heartbeatFailure)
+                throw heartbeatFailure;
+            if (!terminal) {
+                terminal = { eventType: "failed", summary: "adapter ended without a terminal event" };
+                await append(terminal);
+            }
+        }
+        catch (error) {
+            await adapter.cancel().catch(() => undefined);
+            // Do not complete a job whose terminal evidence was not acknowledged.
+            // A safe bounded reason prevents raw adapter/transport errors leaking.
+            terminal = { eventType: "failed", summary: "daemon execution or event reporting failed" };
+            await append(terminal);
         }
         finally {
+            controlsStopped = true;
             if (heartbeatTimer)
                 clearInterval(heartbeatTimer);
         }

package/dist/src/daemon/runtime.js

@@ -3,7 +3,6 @@ import { promisify } from "node:util";
 import { hostname } from "node:os";
 import { createHash } from "node:crypto";
 import { join } from "node:path";
-import { mkdirSync, writeFileSync, chmodSync } from "node:fs";
 import { McpGatewayClient } from "../gateway-client.js";
 import { AdapterRegistry } from "../adapters/registry.js";
 import { ClaudeCodePlugin } from "../adapters/claude-code/adapter.js";
@@ -15,11 +14,14 @@ import { ExecutionCoordinator } from "./execution-coordinator.js";
 import { JobPoller } from "./job-poller.js";
 import { ProcessLock } from "./process-lock.js";
 import { Daemon } from "./daemon.js";
+import { buildTerminalEvidenceCollector } from "../safety/terminal-evidence.js";
 import { McpRelay } from "../auth/mcp-relay.js";
+import { McpRelayConfig } from "../auth/mcp-relay-config.js";
 const execFileAsync = promisify(execFile);
 export async function buildDaemon(input) {
     const relay = new McpRelay({ tokenProvider: input.tokenProvider, upstreamMcpUrl: input.gatewayMcpUrl, upstreamFetch: input.fetchFn });
     const relayServer = await relay.start();
+    const configs = new McpRelayConfig(input.stateRoot, relay, relayServer.url);
     const gateway = new McpGatewayClient({ mcpUrl: input.gatewayMcpUrl, tokenProvider: input.tokenProvider, runnerId: input.runnerId, fetchFn: input.fetchFn });
     const hookPath = new URL("../safety/hook-cli.js", import.meta.url).pathname;
     const plugin = new ClaudeCodePlugin({
@@ -38,14 +40,7 @@ export async function buildDaemon(input) {
             workItemLabel: jobId, env: input.env, registeredReadTools: [], hookExecutablePath: hookPath,
             binaryPath: input.env.AI_GATEWAY_LOCAL_RUNNER_CLAUDE_BINARY,
             mcpServerName: "ai_gateway",
-            writeMcpConfig: (config) => {
-                const root = join(input.stateRoot, "mcp-config");
-                mkdirSync(root, { recursive: true, mode: 0o700 });
-                const path = join(root, `daemon-${process.pid}-${Date.now()}.json`);
-                writeFileSync(path, JSON.stringify({ mcpServers: config.tools.allow.length ? { ai_gateway: { type: "http", url: relayServer.url } } : {} }), { mode: 0o600 });
-                chmodSync(path, 0o600);
-                return path;
-            },
+            writeMcpConfig: (config) => configs.write(config),
         }),
     });
     const registry = new AdapterRegistry([plugin]);
@@ -53,15 +48,17 @@ export async function buildDaemon(input) {
     const versions = Object.fromEntries(probes.filter((probe) => probe.available && probe.authenticated).map((probe) => [probe.id, probe.version]));
     const state = new FileDaemonStateStore(input.stateRoot);
     const coordinator = new ExecutionCoordinator({
+        terminalEvidenceCollector: buildTerminalEvidenceCollector(),
         gateway: {
-            shadow: async (job) => ({
+            shadow: (job) => gateway.localJobShadow({ workLoopId: job.workLoopId,
                 contractFingerprint: job.gatewayContractFingerprint ?? "",
-                taskPackageFingerprint: job.gatewayTaskPackageFingerprint ?? "",
-            }),
+                taskPackageFingerprint: job.gatewayTaskPackageFingerprint ?? "" }),
             createBinding: async (job) => gateway.createLocalJobBinding({
                 jobId: job.id, generation: job.generation, jobLeaseToken: job.leaseToken,
                 launchGrant: job.launchGrant, workLoopId: job.workLoopId, checkoutPath: job.checkoutPath,
             }),
+            readCommands: (bindingId, cursor) => gateway.readCommands(bindingId, cursor),
+            acknowledgeCommand: (bindingId, sequence) => gateway.acknowledgeCommand(bindingId, sequence),
             appendEvent: (bindingId, event) => gateway.appendEvent(bindingId, event),
             heartbeat: async (bindingId, job) => {
                 await Promise.all([gateway.heartbeat(bindingId), gateway.heartbeatLocalJob({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken })]);
@@ -75,7 +72,7 @@ export async function buildDaemon(input) {
     const poller = new JobPoller({
         heartbeat: () => gateway.heartbeatLocalRunner({
             deviceFingerprint: createHash("sha256").update(`${process.getuid?.() ?? 0}|${runnerDisplayName()}|${input.gatewayMcpUrl}`).digest("hex"),
-            displayName: runnerDisplayName(), packageVersion: "0.1.3",
+            displayName: runnerDisplayName(), packageVersion: "0.1.5",
             capabilities: probes.map((probe) => ({ adapter: probe.id, version: probe.version,
                 capabilities: probe.capabilities, authenticated: probe.available && probe.authenticated })),
         }).then(() => undefined),
@@ -92,7 +89,14 @@ export async function buildDaemon(input) {
             await state.save({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken, phase: "claimed" });
             return { status: "claimed", job };
         },
-        execute: (job) => coordinator.execute(job),
+        execute: async (job) => {
+            try {
+                await coordinator.execute(job);
+            }
+            finally {
+                configs.clear();
+            }
+        },
         delay: (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)),
     });
     const daemon = new Daemon({
@@ -103,8 +107,8 @@ export async function buildDaemon(input) {
                 try {
                     const receipt = await gateway.readBindingEvents(previous.bindingId, previous.eventCursor ?? 0);
                     const status = receipt.terminal
-                        ? receipt.terminalEventType === "completed" ? "completed"
-                            : receipt.terminalEventType === "cancelled" ? "cancelled" : "failed"
+                        ? (receipt.terminalEventType ?? previous.terminalEventType) === "completed" ? "completed"
+                            : (receipt.terminalEventType ?? previous.terminalEventType) === "cancelled" ? "cancelled" : "failed"
                         : "failed";
                     await gateway.completeLocalJob({
                         jobId: previous.jobId, generation: previous.generation, leaseToken: previous.leaseToken, status,
@@ -119,6 +123,11 @@ export async function buildDaemon(input) {
         },
         poller,
     });
-    return { daemon, close: () => relay.close() };
+    return { daemon, close: async () => { try {
+            configs.clear();
+        }
+        finally {
+            await relay.close();
+        } } };
 }
 export function runnerDisplayName() { return `${hostname()} local AI`; }

package/dist/src/gateway-client.js

@@ -417,6 +417,23 @@ export class McpGatewayClient {
     async localRunnerStatus() {
         return this.callTool("local_agent_runner_status", { runner_id: this.runnerId });
     }
+    async localJobShadow(input) {
+        const shown = await this.callTool("work_loop_show", { work_loop_id: input.workLoopId });
+        if (shown.loop.environment !== "development")
+            throw new Error("local agent runtime is development-only");
+        const result = await this.callTool("work_execution_contract_show", {
+            contract_id: requiredString(shown.loop.work_execution_contract_id, "execution contract ID"),
+        });
+        if (result.contract.status !== "approved")
+            throw new Error("execution contract is not approved");
+        const payload = result.contract.contract_payload;
+        if (!payload || typeof payload !== "object" || Array.isArray(payload))
+            throw new Error("Gateway response is missing contract payload");
+        const storedFingerprint = requiredString(result.contract.content_fingerprint, "contract fingerprint");
+        if (storedFingerprint !== input.contractFingerprint)
+            throw new Error("claimed contract fingerprint differs from approved contract");
+        return { contractFingerprint: storedFingerprint, taskPackageFingerprint: input.taskPackageFingerprint, contractPayload: payload };
+    }
     async createLocalJobBinding(input) {
         const clientSessionReference = uuidv5(`local-agent-job:${input.jobId}:${input.generation}`, uuidv5.URL);
         const result = await this.callTool("local_agent_job_binding_create", {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "private": false,
   "license": "UNLICENSED",
   "bin": {
@@ -29,7 +29,7 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "uuid": "11.1.0"
+    "uuid": "11.1.1"
   },
   "devDependencies": {
     "@types/node": "22.19.11",