mtech-ai-local-runner 0.1.30 → 0.1.32

package/README.md

@@ -1,3 +1,65 @@
+## Unreleased: P0 terminal safety baseline (local verification only)
+
+The upstream source package is `0.1.31`; P0 does not bump or publish a version.
+Deploy a compatible Gateway receiver before upgrading any runner. Publication,
+installation, restart, flag activation and live acceptance require their own
+delivery gates; this local change authorizes none of them. See the repository
+runbook at `docs/ai-ops-gateway/runbooks/local-agent-daemon-rollout.md`.
+
+Pause/replan now report Runtime `cancelled` and Job `cancelled`. Blocked reports,
+required questions and scope conflicts report Runtime `failed` and Job `blocked`,
+with bounded useful diagnostics. Gateway retains compatibility with historical
+blocked pause/replan receipts. Claude revision messages preserve actual
+`acceptance_criteria` and `required_changes`. Unsupported active Codex controls
+stop the owned launch and acknowledge transport; that ACK does not mean the
+requested revision was performed. No automatic relaunch or grant reuse occurs.
+
+Terminal receipts are retained and replayed exactly. On restart, claimed/shadow
+attempts report failed `runner_restarted`; binding/binding_uncertain attempts
+report blocked `binding_outcome_unknown`. Running/reconciling attempts stay
+manually suspended because previous OS cleanup is unknown. Server expiry closure
+records failed provenance; it does not kill a process, complete a Loop or attest
+client evidence. Minimal fsynced recovery markers and invalid state (including
+JSON null) are preserved. Do not delete dirty workspaces, recovery or audit state
+to resume claims. State-store mutations are serialized and save/suspend/clear
+snapshot their input before queuing; a hung filesystem can leave durable recovery
+pending, without a false acknowledgement or new claims.
+
+A model-free guardian owns each newly created executor group and observes a
+private parent-liveness pipe. Parent EOF invokes TERM, a 2-second grace, then
+KILL for surviving owned processes. The 6-second cleanup-confirmation bound is
+not a model-runtime budget. Guardian death or descendants escaping the group
+remain an unconfirmed-cleanup/manual-reconciliation gap; local tests do not
+establish Task 7/P0 operational acceptance.
+
+Tracked diff hashing streams UTF-8-compatible input and retains only hashes and
+manifest metadata; collection is abort-fenced. Preparation immediately renews the
+Job lease with a single-flight heartbeat, checking exact job ID, generation,
+status and expiry. The existing 900000 ms deadline bounds preparation only.
+Transient retries use 1/2/4-second backoff, at most three, only within the last
+confirmed lease and deadline. Authentication (401/403), fingerprint and fence
+failures are fatal. Git workspace preparation has no abort API: late audit
+workspaces are retained, but late completion cannot launch a downstream model.
+OAuth policy, admission and manual pause behavior remain unchanged.
+
+Running execution has an independent watchdog for the last server-confirmed Job
+lease. Hung startup, control, heartbeat, stream, evidence or event-response waits
+cannot defer cancellation past that lease. Late responses cannot renew host
+authority, acknowledge a command or advance reporting/state after fence loss;
+an unknown remote append remains uncertain for reconciliation. Healthy validated
+renewals extend execution without a fixed model-runtime limit.
+
+Local-fix preparation, owned freeze, publication finalization and server cursor
+synchronization share that fence. A stopped or expired attempt cannot regain
+publication authority through a late response. Once publication may have taken
+effect, retain `publication_pending` recovery instead of falsely completing,
+failing or restarting the attempt. Canonical publication approval remains required.
+
+Component, shadow admission, installed-package and live-provider evidence are
+separate. Historical 0.1.10 hook behavior below is not current Claude admission;
+Claude parity requires the actual current isolation/admission gate to pass.
+No live push/hook probe or real CLI/model run is part of this verification.
+
 ## 0.1.30: governed local alert investigation evidence
 
 The Gateway candidate offers explicit Local Codex Runner or Local Claude Runner
@@ -337,7 +399,8 @@ npx mtech-ai-local-runner doctor
 Cancelling a Work Loop also cancels its non-terminal local jobs. Repeating the
 cancellation repairs jobs left by an earlier Gateway version; terminal results
 are preserved. Claim/reclaim and lease-gated launch checks reject cancelled
-Loops. An active adapter stops when the next lease heartbeat fails; cancellation
+Loops. An active adapter stops on a failed heartbeat or expiry of its last
+confirmed Job lease, even when the current request never responds. Cancellation
 is not an immediate process-kill acknowledgement.
 
 Before binding, the Gateway permits at most three queue deliveries and a

package/dist/src/adapters/claude-code/adapter.js

@@ -44,6 +44,9 @@ export class ClaudeCodeAdapter {
     tools;
     cancelled = false;
     started = false;
+    startupAcquisition;
+    revokedTools;
+    revokeFailed = false;
     receipt;
     toolEndpoint;
     readSnapshot;
@@ -59,6 +62,8 @@ export class ClaudeCodeAdapter {
         this.options = options;
     }
     async start(ctx) {
+        if (this.cancelled)
+            throw new Error('adapter startup cancelled');
         const resolvedModelId = ctx.resolvedModelId;
         if (!resolvedModelId) {
             throw new Error("refusing to start: no Gateway-resolved model ID was supplied");
@@ -100,6 +105,10 @@ export class ClaudeCodeAdapter {
         }
         const hookCommand = this.requireTrustedHookCommand();
         const prompt = compilePrompt(ctx.taskPackage, { workItemLabel: this.options.workItemLabel });
+        if (this.cancelled)
+            throw new Error('adapter startup cancelled');
+        let acquired;
+        this.startupAcquisition = new Promise(resolve => { acquired = resolve; });
         try {
             if (!this.options.createTools || !this.options.writeLocalMcpConfig)
                 throw new Error("job-local tool setup is required");
@@ -165,9 +174,15 @@ export class ClaudeCodeAdapter {
             handle.stdin.write(`${JSON.stringify({ type: "user", message: { role: "user", content: [{ type: "text", text: prompt }] } })}\n`);
         }
         catch (error) {
+            // Settle only the ownership-acquisition fence before cleanup. Waiting for
+            // all of start() here would deadlock cancellation against this catch.
+            acquired();
             await this.cleanup();
             throw error;
         }
+        finally {
+            acquired();
+        }
     }
     async *events() {
         const handle = this.requireHandle();
@@ -223,38 +238,82 @@ export class ClaudeCodeAdapter {
         if (command.command === "answer_question" && typeof command.arguments?.answer === "string") {
             payload.answer = command.arguments.answer;
         }
-        if (command.command === "request_revision" && Array.isArray(command.arguments?.acceptance_criterion_ids)) {
-            payload.acceptance_criterion_ids = command.arguments?.acceptance_criterion_ids;
+        if (command.command === "request_revision") {
+            // The Gateway validates these exact string lists against the approved brief.
+            for (const key of ["acceptance_criteria", "required_changes"]) {
+                if (Array.isArray(command.arguments?.[key]))
+                    payload[key] = command.arguments[key];
+            }
         }
         handle.stdin.write(`${JSON.stringify({ type: "user", message: { role: "user", content: [{ type: "text", text: JSON.stringify(payload) }] } })}\n`);
     }
-    async cancel() {
+    cancelPromise;
+    cancel() {
         this.cancelled = true;
-        await this.cleanup();
+        if (this.cancelPromise)
+            return this.cancelPromise;
+        this.localReadObservations();
+        this.revokeTools(this.tools);
+        const cleanup = (async () => { await this.startupAcquisition; await this.cleanup(); })();
+        // This bounds cleanup confirmation, never admitted model runtime. Unknown
+        // acquisition stays unconfirmed; any late owner is still disposed by start.
+        this.cancelPromise = new Promise((resolve, reject) => {
+            const timer = setTimeout(() => reject(new Error('Provider process group cleanup could not be confirmed')), 6000);
+            void cleanup.then(() => { clearTimeout(timer); resolve(); }, () => { clearTimeout(timer); reject(new Error('Provider process group cleanup could not be confirmed')); });
+        });
+        return this.cancelPromise;
+    }
+    revokeTools(tools) {
+        if (!tools || this.revokedTools === tools)
+            return;
+        this.revokedTools = tools;
+        try {
+            tools.revoke();
+        }
+        catch {
+            this.revokeFailed = true;
+        }
     }
-    async cleanup() {
+    cleanupPromise;
+    cleanup() {
+        if (this.cleanupPromise)
+            return this.cleanupPromise;
         this.localReadObservations();
         this.toolEndpoint = undefined;
         const tools = this.tools;
         const handle = this.handle;
         this.tools = undefined;
         this.handle = null;
-        try {
-            tools?.revoke();
-        }
-        finally {
+        const operation = Promise.resolve().then(async () => {
+            this.revokeTools(tools);
+            let failed = this.revokeFailed;
             try {
                 handle?.stdin.end();
             }
-            finally {
-                try {
-                    handle?.kill("SIGKILL");
-                }
-                finally {
-                    await tools?.close();
-                }
+            catch {
+                failed = true;
             }
-        }
+            try {
+                if (handle?.terminateOwned)
+                    await handle.terminateOwned();
+                else
+                    handle?.kill('SIGKILL');
+            }
+            catch {
+                failed = true;
+            }
+            try {
+                await tools?.close();
+            }
+            catch {
+                failed = true;
+            }
+            if (failed)
+                throw new Error('Provider process group cleanup could not be confirmed');
+        });
+        if (tools || handle)
+            this.cleanupPromise = operation;
+        return operation;
     }
     /** Claude Code treats a hook it cannot run as no objection, so the hook runs through Node. */
     requireTrustedHookCommand() {

package/dist/src/adapters/codex/adapter.js

@@ -1,4 +1,5 @@
 import { executionError } from '../../safety/execution-failure.js';
+import { UnsupportedSupervisorCommandError } from '../../safety/unsupported-supervisor-command.js';
 import { CodexExecLaunchHost } from './exec-launch-host.js';
 import { requireSecurityRequirements } from '../../safety/security-requirements.js';
 import { createJobSecurityReceipt } from '../../safety/job-security-receipt.js';
@@ -27,6 +28,8 @@ export class CodexAdapter {
     parser = new CodexStreamParser();
     startupAbort = new AbortController();
     securityPolicy;
+    /** Only the retained transport's pending owned-handle acquisition. */
+    pendingHandle;
     constructor(options) {
         this.options = options;
     }
@@ -117,6 +120,29 @@ export class CodexAdapter {
             await this.cancel();
             throw error;
         }
+        let lateCleanupFailed = false;
+        const stopReturnedHandle = async (handle) => {
+            let failed = false;
+            try {
+                handle.stdin.end();
+            }
+            catch {
+                failed = true;
+            }
+            try {
+                if (handle.terminateOwned)
+                    await handle.terminateOwned();
+                else
+                    handle.kill('SIGKILL');
+            }
+            catch {
+                failed = true;
+            }
+            if (failed) {
+                lateCleanupFailed = true;
+                throw new Error('Provider process group cleanup could not be confirmed');
+            }
+        };
         try {
             const prompt = compileCodexPrompt(pkg, this.options.jobId);
             this.tools = this.options.createTools(pkg, approved);
@@ -128,27 +154,46 @@ export class CodexAdapter {
                 worktreeRoot: this.options.cwd ?? this.options.worktreeRoot, sourceRoot: this.options.worktreeRoot, schemaPath, endpoint, env: this.options.env, scratch: this.options.scratch });
             if (!deferred)
                 assertAdmission();
-            const handle = await this.options.startVerifiedSession(invocation, prompt, this.startupAbort.signal, assertAdmission);
+            this.assertNotCancelled();
+            let settleHandle;
+            this.pendingHandle = new Promise((resolve, reject) => { settleHandle = error => { if (error)
+                reject(error);
+            else
+                resolve(); }; });
+            void this.pendingHandle.catch(() => { });
             try {
-                assertAdmission();
-            }
-            catch (error) {
-                this.tools.revoke();
-                handle.kill('SIGKILL');
-                throw error;
+                const handle = await this.options.startVerifiedSession(invocation, prompt, this.startupAbort.signal, assertAdmission);
+                try {
+                    assertAdmission();
+                }
+                catch (error) {
+                    try {
+                        this.tools.revoke();
+                    }
+                    finally {
+                        await stopReturnedHandle(handle);
+                    }
+                    throw error;
+                }
+                // Publish either the adopted handle or its exact disposal outcome before
+                // releasing cancellation. The outer catch may then await shared cancel.
+                if (this.cancelled) {
+                    await stopReturnedHandle(handle);
+                    this.assertNotCancelled();
+                }
+                this.handle = handle;
             }
-            // Cancellation may race with a transport returning its newly created handle.
-            if (this.cancelled) {
-                handle.kill("SIGKILL");
-                this.assertNotCancelled();
+            finally {
+                settleHandle(lateCleanupFailed ? new Error('Provider process group cleanup could not be confirmed') : undefined);
             }
-            this.handle = handle;
             if (deferred)
                 this.receipt = createJobSecurityReceipt(this.securityPolicy, { jobId: this.options.jobId, generation: ctx.generation, modelId: ctx.resolvedModelId, sourceSha: String(source.base_commit_sha), ...ctx.securityBinding, requirements: ctx.approvedTaskPackage?.security_requirements });
         }
         catch {
             const wasCancelled = this.cancelled;
             await this.cancel();
+            if (lateCleanupFailed)
+                throw new Error('Provider process group cleanup could not be confirmed');
             throw new Error(wasCancelled ? "Codex launch cancelled during startup" : "Codex job setup failed before execution could be confirmed");
         }
     }
@@ -185,33 +230,104 @@ export class CodexAdapter {
             await this.cancel();
         }
     }
-    async cancel() {
-        this.cancelled = true;
+    async freezeForPublication() {
+        if (!this.usingOfficialExec || !this.ownedExec)
+            throw Error('CODEX_PUBLICATION_FREEZE_UNCONFIRMED');
+        let timer;
         try {
-            if (this.usingOfficialExec)
-                await this.ownedExec?.cancel();
-            this.options.revokeSecurity?.();
+            await Promise.race([Promise.all([this.ownedExec.freezeForPublication(), this.cancel()]), new Promise((_, reject) => { timer = setTimeout(() => reject(Error('CODEX_PUBLICATION_FREEZE_UNCONFIRMED')), 10000); })]);
+        }
+        catch {
+            throw Error('CODEX_PUBLICATION_FREEZE_UNCONFIRMED');
         }
         finally {
+            if (timer)
+                clearTimeout(timer);
+        }
+    }
+    cancelPromise;
+    cancel() {
+        if (this.cancelPromise)
+            return this.cancelPromise;
+        this.cancelled = true;
+        let finish, reject, failed = false;
+        this.cancelPromise = new Promise((resolve, rejectPromise) => { finish = resolve; reject = rejectPromise; });
+        const timer = setTimeout(() => reject(new Error('Provider process group cleanup could not be confirmed')), 6000);
+        // Let the official owner freeze its observations before external revocation.
+        // Known owner cleanup and endpoint closure start without waiting for a late
+        // retained handle; only confirmation waits for its acquisition/disposal.
+        let officialStop;
+        if (this.usingOfficialExec) {
             try {
-                this.tools?.revoke();
+                officialStop = this.ownedExec?.cancel();
             }
-            finally {
-                this.startupAbort.abort();
+            catch {
+                failed = true;
+            }
+        }
+        try {
+            this.options.revokeSecurity?.();
+        }
+        catch {
+            failed = true;
+        }
+        try {
+            this.tools?.revoke();
+        }
+        catch {
+            failed = true;
+        }
+        this.startupAbort.abort();
+        const ownerStop = (async () => {
+            if (this.usingOfficialExec) {
                 try {
-                    if (!this.usingOfficialExec)
-                        this.handle?.kill("SIGKILL");
+                    await officialStop;
                 }
-                finally {
-                    try {
-                        await this.tools?.close();
-                    }
-                    finally {
-                        await this.options.closeOfficialExec?.();
-                    }
+                catch {
+                    failed = true;
+                }
+            }
+            else {
+                try {
+                    this.handle?.stdin.end();
+                }
+                catch {
+                    failed = true;
+                }
+                try {
+                    if (this.handle?.terminateOwned)
+                        await this.handle.terminateOwned();
+                    else
+                        this.handle?.kill('SIGKILL');
+                }
+                catch {
+                    failed = true;
                 }
             }
+        })();
+        const toolsClose = (async () => { try {
+            await this.tools?.close();
         }
+        catch {
+            failed = true;
+        } })();
+        void (async () => {
+            const outcomes = await Promise.allSettled([ownerStop, toolsClose, this.pendingHandle]);
+            if (outcomes.some(outcome => outcome.status === 'rejected'))
+                failed = true;
+            try {
+                await this.options.closeOfficialExec?.();
+            }
+            catch {
+                failed = true;
+            }
+            clearTimeout(timer);
+            if (failed)
+                reject(new Error('Provider process group cleanup could not be confirmed'));
+            else
+                finish();
+        })();
+        return this.cancelPromise;
     }
     assertNotCancelled() {
         if (this.cancelled)
@@ -222,6 +338,6 @@ export class CodexAdapter {
             return this.cancel();
         if (command.command === "request_checkpoint")
             return;
-        throw new Error("Codex cannot resume or change an active approved launch");
+        throw new UnsupportedSupervisorCommandError();
     }
 }

package/dist/src/adapters/codex/exec-launch-host.js

@@ -120,7 +120,7 @@ export class CodexExecLaunchHost {
                 this.handle = h;
                 timing.mark('spawn_returned');
                 if (this.stopped) {
-                    h.kill('SIGKILL');
+                    await this.cancel();
                     throw fail();
                 }
                 h.once('exit', (code, signal) => {
@@ -246,6 +246,28 @@ export class CodexExecLaunchHost {
         }
         return this.readAudit ? structuredClone(this.readAudit) : undefined;
     }
+    /** A kill request is not an exit proof. Publication alone requires the trusted
+     * process-group host to observe real exit, closed pipes and group disappearance.
+     * This deadline bounds teardown only, never model execution duration. */
+    async freezeForPublication() {
+        let timer;
+        try {
+            if (!this.ownsAttempt || !this.handle?.waitForOwnedExit)
+                throw fail();
+            const handle = this.handle;
+            await Promise.race([
+                Promise.all([this.cancel(), handle.waitForOwnedExit(10000)]),
+                new Promise((_, reject) => { timer = setTimeout(() => reject(fail()), 10000); }),
+            ]);
+        }
+        catch {
+            throw Error('CODEX_PUBLICATION_FREEZE_UNCONFIRMED');
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
+    }
     cancel() {
         if (this.closePromise)
             return this.closePromise;
@@ -273,16 +295,33 @@ export class CodexExecLaunchHost {
             cleanupError = true;
         }
         this.abort.abort();
-        try {
-            this.handle?.kill('SIGKILL');
-        }
-        catch {
-            cleanupError = true;
-        }
-        Promise.resolve().then(() => this.deps.closeTools()).then(() => { if (cleanupError)
-            reject(new Error('CODEX_EXEC_CLEANUP_UNCONFIRMED'));
-        else
-            finish(); }, () => reject(new Error('CODEX_EXEC_CLEANUP_UNCONFIRMED')));
+        Promise.resolve().then(async () => {
+            try {
+                this.handle?.stdin.end();
+            }
+            catch {
+                cleanupError = true;
+            }
+            try {
+                if (this.handle?.terminateOwned)
+                    await this.handle.terminateOwned();
+                else
+                    this.handle?.kill('SIGKILL');
+            }
+            catch {
+                cleanupError = true;
+            }
+            try {
+                await this.deps.closeTools();
+            }
+            catch {
+                cleanupError = true;
+            }
+            if (cleanupError)
+                reject(new Error('CODEX_EXEC_CLEANUP_UNCONFIRMED'));
+            else
+                finish();
+        });
         return this.closePromise;
     }
 }

package/dist/src/adapters/codex/stream-parser.js

@@ -1,21 +1,12 @@
 import { createHmac, randomBytes } from "node:crypto";
-import { completionEnvelope, completionEvent } from "../completion-report.js";
+import { completionEvent } from "../completion-report.js";
 function record(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value)
         ? value : undefined;
 }
-function finalReport(text) {
-    const complete = completionEvent(text);
-    if (complete.eventType === "completed")
-        return complete;
-    const value = completionEnvelope(text);
-    const bounded = (v, size) => typeof v === "string" && v.trim().length > 0 && v.length <= size;
-    const entries = (v, min) => Array.isArray(v) && v.length >= min && v.length <= 20 && v.every(item => bounded(item, 500));
-    if (!value || Object.keys(value).some(key => !["status", "report", "evidence", "pending_work"].includes(key))
-        || value.status !== "blocked" || !bounded(value.report, 2000)
-        || !entries(value.evidence, 0) || !entries(value.pending_work, 1))
-        return complete;
-    return { eventType: "blocked", summary: value.report.trim(), payload: { pending_work: value.pending_work, completion_evidence: value.evidence } };
+/** Valid blocked reports are terminal failures, but still count for uniqueness. */
+function acceptedReport(event) {
+    return event.eventType === "completed" || event.eventType === "failed" && event.payload?.reason === "executor_blocked";
 }
 /** Codex wire parsing is independent of Claude. Never forward reasoning or raw errors. */
 export class CodexStreamParser {
@@ -52,8 +43,8 @@ export class CodexStreamParser {
             }
             if (event.type === "item.completed" && item.type === "agent_message") {
                 this.messages += 1;
-                this.report = finalReport(item.text);
-                if (["completed", "blocked"].includes(this.report.eventType)) {
+                this.report = completionEvent(item.text);
+                if (acceptedReport(this.report)) {
                     this.candidates += 1;
                     // Bounded diagnostic sample only. Neither raw IDs nor text digests
                     // leave this parser, and sampling never changes report acceptance.
@@ -73,9 +64,9 @@ export class CodexStreamParser {
         const terminal = this.candidates === 0
             ? this.reportFailure(this.messages === 0 ? "CODEX_COMPLETION_REPORT_MISSING" : "CODEX_COMPLETION_REPORT_INVALID")
             : this.candidates > 1 ? this.reportFailure("CODEX_COMPLETION_REPORT_MULTIPLE")
-                : this.report && ["completed", "blocked"].includes(this.report.eventType) ? this.report
+                : this.report && acceptedReport(this.report) ? this.report
                     : this.reportFailure("CODEX_COMPLETION_REPORT_NOT_FINAL");
-        if (terminal.eventType === "blocked")
+        if (terminal.eventType === "failed" && terminal.payload?.reason === "executor_blocked")
             terminal.payload = { ...terminal.payload, completion_report: {
                     version: "codex-completion-report-v1", code: "CODEX_COMPLETION_REPORT_BLOCKED", agent_message_count: this.messages,
                     valid_report_count: this.candidates, invalid_message_count: this.messages - this.candidates, identity: this.reportIdentity(),

package/dist/src/adapters/completion-report.js

@@ -93,15 +93,18 @@ export function completionEvent(result, costUsd) {
     if (!value)
         return failed;
     if (Object.keys(value).some((key) => !["status", "report", "evidence", "pending_work"].includes(key))
-        || value.status !== "completed"
+        || value.status !== "completed" && value.status !== "blocked"
         || !boundedText(value.report, MAX_EVENT_SUMMARY_CHARS)
-        || !Array.isArray(value.pending_work) || value.pending_work.length !== 0
-        || !Array.isArray(value.evidence) || value.evidence.length < 1 || value.evidence.length > MAX_EVIDENCE_ITEMS
+        || !Array.isArray(value.pending_work) || value.pending_work.length > MAX_EVIDENCE_ITEMS
+        || (value.status === "completed" ? value.pending_work.length !== 0 : value.pending_work.length < 1)
+        || !value.pending_work.every((item) => boundedText(item, MAX_EVIDENCE_CHARS))
+        || !Array.isArray(value.evidence) || value.evidence.length < (value.status === "completed" ? 1 : 0) || value.evidence.length > MAX_EVIDENCE_ITEMS
         || !value.evidence.every((item) => boundedText(item, MAX_EVIDENCE_CHARS)))
         return failed;
     return {
-        eventType: "completed",
+        eventType: value.status === "completed" ? "completed" : "failed",
         summary: value.report.trim(),
-        payload: { ...usage, investigation_summary: value.report.trim(), completion_evidence: value.evidence },
+        payload: { ...usage, investigation_summary: value.report.trim(), completion_evidence: value.evidence,
+            ...(value.status === "blocked" ? { reason: "executor_blocked", pending_work: value.pending_work } : {}) },
     };
 }

package/dist/src/cli.js

@@ -1,4 +1,8 @@
 #!/usr/bin/env node
+import { recoverLocalFixPublication } from './publication/recovery.js';
+import { loadInstalledLocalFixHost } from './publication/installed-host.js';
+import { FileDaemonStateStore } from './state-store.js';
+import { ProcessLock } from './daemon/process-lock.js';
 import { runManualCodexJob } from './daemon/manual-codex.js';
 import { unlinkSync, realpathSync } from "node:fs";
 import { join } from "node:path";
@@ -228,6 +232,25 @@ export async function main(argv, env, io = {}) {
             const credentialStore = new FileOAuthCredentialStore(config.stateRoot);
             const oauthClient = new OAuthClient({ resource: local.gatewayMcpUrl, fetchFn });
             const tokenProvider = new OAuthTokenProvider({ store: credentialStore, oauthClient, resource: local.gatewayMcpUrl, tokenOverride: env.AI_GATEWAY_LOCAL_RUNNER_TOKEN, allowRefresh: config.mode !== 'manual-codex', clock: () => Date.now() });
+            if (config.mode === 'publication-recover') {
+                const lock = new ProcessLock(join(config.stateRoot, 'daemon.lock'));
+                await lock.acquire();
+                try {
+                    const gateway = new McpGatewayClient({ mcpUrl: local.gatewayMcpUrl, runnerId: local.runnerId, tokenProvider, fetchFn });
+                    const host = await loadInstalledLocalFixHost({ stateRoot: config.stateRoot, runnerId: local.runnerId, gateway });
+                    if (!host)
+                        throw new Error('LOCAL_FIX_INSTALLATION_REQUIRED');
+                    const state = new FileDaemonStateStore(config.stateRoot), stored = await state.load();
+                    if (!stored)
+                        throw new Error('LOCAL_PUBLICATION_RECOVERY_STATE_REQUIRED');
+                    await recoverLocalFixPublication({ jobId: config.manualJobId, stored: stored, host, gateway, state });
+                    stdout(JSON.stringify({ status: 'completed', jobId: config.manualJobId, modelStarted: false }));
+                    return 0;
+                }
+                finally {
+                    await lock.release();
+                }
+            }
             if (config.mode === "doctor") {
                 const adapters = doctorAdapters;
                 const localChecks = Promise.allSettled([