mtech-ai-local-runner 0.1.30 → 0.1.32

package/dist/src/publication/git-transport.js

@@ -0,0 +1,156 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { createHash } from 'node:crypto';
+import { deflateSync, inflateSync } from 'node:zlib';
+import { lstat, readdir, readFile, writeFile, mkdir } from 'node:fs/promises';
+import path from 'node:path';
+import { protocolHash } from './candidate.js';
+import { assertPinnedGit, assertPrivateCheckout, publicationGitEnvironment, publicationGitArgs, strictPublicationOrigin } from './git-credential-broker.js';
+const execute = promisify(execFile), denied = () => Error('GIT_PUBLICATION_REJECTED');
+/** Only DeterministicPublisher may dispatch validated signed requests. This
+ * adapter independently binds all evidence and the current host fence. */
+export class GitPublicationTransport {
+    options;
+    constructor(options) { this.options = { ...options, evidence: structuredClone(options.evidence), git: { ...options.git } }; }
+    async git(args) { const o = this.options; await assertPinnedGit(o.git); const r = await execute(o.git.executable, [...publicationGitArgs, ...args], { cwd: o.checkout, env: publicationGitEnvironment(), maxBuffer: 1024 * 1024 }); await assertPinnedGit(o.git); return r.stdout.trim(); }
+    async validate(request) {
+        const o = this.options;
+        strictPublicationOrigin(o.origin);
+        if (!await o.current() || request.protocol_version !== 'deterministic-publication-v1' || !['git.commit', 'git.push'].includes(request.action) || !/^[A-Za-z0-9-]{1,128}$/.test(request.publication_id) || !Number.isFinite(request.expires_at) || request.expires_at <= Date.now() / 1000 || !/^[a-f0-9]{64}$/.test(request.request_fingerprint) || !/^[a-f0-9]{40}$/.test(request.base_commit_sha) || request.working_branch !== `ai-work/local/${request.attempt_id}` || !/^[A-Za-z0-9-]+$/.test(request.attempt_id))
+            throw denied();
+        for (const key of Object.keys(o.evidence))
+            if (protocolHash(request[key]) !== protocolHash(o.evidence[key]))
+                throw denied();
+        if (!request.receipts.some(r => r.action_key === request.action && /^[a-f0-9]{64}$/.test(r.action_fingerprint)))
+            throw denied();
+        await assertPrivateCheckout(o.checkout, o.privateRoot);
+        // Reject linked/shared object stores, worktrees, alternate config and symlinks.
+        const metadata = async (dir) => { for (const name of await readdir(dir)) {
+            const file = path.join(dir, name), s = await lstat(file);
+            if (s.isSymbolicLink() || (!s.isDirectory() && (!s.isFile() || s.nlink !== 1)) || (process.getuid && s.uid !== process.getuid()))
+                throw denied();
+            if (s.isDirectory())
+                await metadata(file);
+        } };
+        await metadata(path.join(o.checkout, '.git'));
+        const allowed = new Set(['HEAD', 'config', 'objects', 'refs', 'shallow']);
+        if ((await readdir(path.join(o.checkout, '.git'))).some(n => !allowed.has(n)))
+            throw denied();
+        try {
+            if ((await readdir(path.join(o.checkout, '.git', 'objects'))).some(n => !/^[a-f0-9]{2}$/.test(n)))
+                throw denied();
+        }
+        catch {
+            throw denied();
+        }
+        if (await readFile(path.join(o.checkout, '.git', 'HEAD'), 'utf8') !== `ref: refs/heads/${request.working_branch}\n`)
+            throw denied();
+        const entries = [];
+        let total = 0;
+        const walk = async (dir, prefix = '') => { for (const name of (await readdir(dir)).sort()) {
+            if (!prefix && name === '.git')
+                continue;
+            const rel = prefix ? prefix + '/' + name : name, file = path.join(dir, name), s = await lstat(file);
+            if (s.isSymbolicLink() || name.includes('\n') || name.includes('\0') || (!s.isDirectory() && (!s.isFile() || s.nlink !== 1)))
+                throw denied();
+            if (s.isDirectory())
+                await walk(file, rel);
+            else {
+                total += s.size;
+                if (s.size > (o.maxFileBytes ?? 16 * 1024 * 1024) || total > (o.maxTotalBytes ?? 64 * 1024 * 1024))
+                    throw denied();
+                entries.push({ path: rel, mode: (s.mode & 0o111) ? 0o100755 : 0o100644, bytes: await readFile(file) });
+            }
+        } };
+        await walk(o.checkout);
+        entries.sort((a, b) => a.path < b.path ? -1 : 1);
+        if (protocolHash(entries.map(e => ({ path: e.path, mode: e.mode, sha256: createHash('sha256').update(e.bytes).digest('hex') }))) !== o.sealedTreeFingerprint)
+            throw denied();
+        for (const line of (await this.git(['ls-tree', '-r', '-z', request.base_commit_sha])).split('\0').filter(Boolean)) {
+            const gitlink = /^160000 commit ([a-f0-9]{40})\t(.+)$/.exec(line);
+            if (!gitlink)
+                continue;
+            const name = gitlink[2];
+            if (!name || name.split('/').some(p => !p || p === '.' || p === '..' || p === '.git') || name.includes('\\') || entries.some(e => e.path === name || e.path.startsWith(name + '/') || name.startsWith(e.path + '/')))
+                throw denied();
+            entries.push({ path: name, mode: 0o160000, bytes: Buffer.alloc(0), gitlink: gitlink[1] });
+        }
+        if (!await o.current())
+            throw denied();
+        return entries;
+    }
+    async object(type, bytes, write) { const raw = Buffer.concat([Buffer.from(`${type} ${bytes.length}\0`), bytes]), oid = createHash('sha1').update(raw).digest('hex'); if (write) {
+        const dir = path.join(this.options.checkout, '.git', 'objects', oid.slice(0, 2)), file = path.join(dir, oid.slice(2));
+        await mkdir(dir, { recursive: true, mode: 0o700 });
+        try {
+            await writeFile(file, deflateSync(raw), { flag: 'wx', mode: 0o400 });
+        }
+        catch (e) {
+            if (e.code !== 'EEXIST' || !inflateSync(await readFile(file)).equals(raw))
+                throw denied();
+        }
+    } return oid; }
+    async tree(entries, write, prefix = '') {
+        const names = new Map();
+        const children = new Set();
+        for (const entry of entries) {
+            if (!entry.path.startsWith(prefix))
+                continue;
+            const rest = entry.path.slice(prefix.length), slash = rest.indexOf('/');
+            if (slash >= 0)
+                children.add(rest.slice(0, slash));
+            else
+                names.set(rest, { mode: entry.mode.toString(8), oid: entry.gitlink ?? await this.object('blob', entry.bytes, write) });
+        }
+        for (const child of children)
+            names.set(child, { mode: '40000', oid: await this.tree(entries, write, prefix + child + '/') });
+        const chunks = [...names].sort(([a, av], [b, bv]) => Buffer.compare(Buffer.from(a + (av.mode === '40000' ? '/' : '')), Buffer.from(b + (bv.mode === '40000' ? '/' : '')))).map(([name, v]) => Buffer.concat([Buffer.from(`${v.mode} ${name}\0`), Buffer.from(v.oid, 'hex')]));
+        return this.object('tree', Buffer.concat(chunks), write);
+    }
+    marker(r) { return `Local Fix ${r.attempt_id}\n\nLocal-Fix-Publication: ${r.publication_id}\nLocal-Fix-Candidate: ${r.candidate_fingerprint}\n`; }
+    async commit(r, entries, write) { const tree = await this.tree(entries, write); return this.object('commit', Buffer.from(`tree ${tree}\nparent ${r.base_commit_sha}\nauthor Local Fix <local-fix@invalid> 1 +0000\ncommitter Local Fix <local-fix@invalid> 1 +0000\n\n${this.marker(r)}Local-Fix-Request: ${r.request_fingerprint}\n`), write); }
+    scope(r) { return { origin: this.options.origin, checkout: this.options.checkout, ref: `refs/heads/${r.working_branch}`, sha: r.accepted_results.committed_sha }; }
+    async acceptedCommit(r, entries) { const sha = r.accepted_results.committed_sha; if (!sha || !/^[a-f0-9]{40}$/.test(sha) || await this.git(['rev-parse', '--verify', 'HEAD']) !== sha)
+        throw denied(); const raw = await this.git(['cat-file', 'commit', sha]); if (!raw.includes(`\nparent ${r.base_commit_sha}\n`) || !raw.includes('\n' + this.marker(r)) || !/^Local-Fix-Request: [a-f0-9]{64}$/m.test(raw) || !raw.startsWith(`tree ${await this.tree(entries, false)}\n`))
+        throw denied(); return sha; }
+    async execute(request) {
+        try {
+            const r = structuredClone(request), entries = await this.validate(r);
+            if (r.action === 'git.push') {
+                const sha = await this.acceptedCommit(r, entries);
+                await this.validate(r);
+                await this.options.broker.push(this.scope(r));
+                if (!await this.options.current())
+                    throw denied();
+                return { pushed_branch_head: sha };
+            }
+            const sha = await this.commit(r, entries, false), head = await this.git(['rev-parse', '--verify', 'HEAD']);
+            if (head === sha)
+                return { committed_sha: sha };
+            if (head !== r.base_commit_sha)
+                throw denied();
+            await this.commit(r, entries, true);
+            await this.validate(r);
+            await writeFile(path.join(this.options.checkout, '.git', 'shallow'), r.base_commit_sha + '\n', { mode: 0o600 });
+            await this.git(['update-ref', `refs/heads/${r.working_branch}`, sha, r.base_commit_sha]);
+            if (!await this.options.current())
+                throw denied();
+            return { committed_sha: sha };
+        }
+        catch {
+            throw denied();
+        }
+    }
+    async reconcile(request) { try {
+        const r = structuredClone(request), entries = await this.validate(r);
+        if (r.action === 'git.commit') {
+            const sha = await this.commit(r, entries, false);
+            return await this.git(['rev-parse', '--verify', 'HEAD']) === sha ? { committed_sha: sha } : null;
+        }
+        const sha = await this.acceptedCommit(r, entries);
+        return await this.options.broker.head(this.scope(r)) === sha ? { pushed_branch_head: sha } : null;
+    }
+    catch {
+        throw denied();
+    } }
+}

package/dist/src/publication/installed-host.js

@@ -0,0 +1,120 @@
+import { constants } from 'node:fs';
+import { lstat, open, realpath } from 'node:fs/promises';
+import { createPublicKey } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+import { createProductionLocalFixHost } from './production-host.js';
+import { ScopedGitCredentialBroker, assertPinnedGit, strictPublicationOrigin } from './git-credential-broker.js';
+import { protocolHash } from './candidate.js';
+import { createServerCiLocalFixHost, assertServerCiRegistration } from './server-ci-host.js';
+import { verifyLocalFixRuntime } from './runtime-release.js';
+const denied = () => Error('LOCAL_FIX_INSTALLATION_REJECTED');
+async function privateFile(file) { const s = await lstat(file); if (!s.isFile() || s.isSymbolicLink() || s.nlink !== 1 || (s.mode & 0o077) !== 0 || s.size > 128 * 1024 || (process.getuid && s.uid !== process.getuid()) || await realpath(file) !== file)
+    throw denied(); return s; }
+async function readPrivateJson(file) {
+    const initial = await privateFile(file), f = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+        const before = await f.stat();
+        if (before.ino !== initial.ino || before.dev !== initial.dev || !before.isFile() || before.nlink !== 1 || (before.mode & 0o077) !== 0 || (process.getuid && before.uid !== process.getuid()) || before.size > 128 * 1024)
+            throw denied();
+        const value = JSON.parse(await f.readFile('utf8')), after = await f.stat(), named = await privateFile(file);
+        for (const st of [after, named])
+            if (st.ino !== before.ino || st.dev !== before.dev || st.size !== before.size || st.mtimeMs !== before.mtimeMs || st.ctimeMs !== before.ctimeMs || st.mode !== before.mode || st.uid !== before.uid || st.nlink !== 1)
+                throw denied();
+        if (!value || Array.isArray(value) || typeof value !== 'object')
+            throw denied();
+        return value;
+    }
+    finally {
+        await f.close();
+    }
+}
+/** No installation file is created here. A missing file preserves investigation
+ * behavior. Explicit approved installation is owner-only; credentials are read
+ * only for an exact post-freeze Git operation, never during daemon discovery. */
+export async function loadInstalledLocalFixHost(input) {
+    try {
+        const file = path.join(input.stateRoot, 'local-fix-host.json');
+        try {
+            await lstat(file);
+        }
+        catch (e) {
+            if (e.code === 'ENOENT')
+                return undefined;
+            throw e;
+        }
+        const stateStat = await lstat(input.stateRoot);
+        if (!stateStat.isDirectory() || stateStat.isSymbolicLink() || (stateStat.mode & 0o077) !== 0 || (process.getuid && stateStat.uid !== process.getuid()) || await realpath(input.stateRoot) !== input.stateRoot)
+            throw denied();
+        const raw = await readPrivateJson(file);
+        if (raw.schema === 'local-fix-host-installation-v2') {
+            const config = raw;
+            if (config.enabled !== true || config.verification_mode !== 'gateway_ci_v1' || config.runnerId !== input.runnerId)
+                throw denied();
+            assertServerCiRegistration(config.registration);
+            const packageRoot = await realpath(fileURLToPath(new URL('../../../', import.meta.url)));
+            const assertReleaseCurrent = () => verifyLocalFixRuntime(packageRoot, config.runtimeFiles, config.registration.receipt);
+            await assertReleaseCurrent();
+            await assertPinnedGit(config.git);
+            const privateRoot = path.join(input.stateRoot, 'local-fix-publication'), s = await lstat(privateRoot);
+            if (!s.isDirectory() || s.isSymbolicLink() || (s.mode & 0o077) !== 0 || (process.getuid && s.uid !== process.getuid()) || await realpath(privateRoot) !== privateRoot)
+                throw denied();
+            return createServerCiLocalFixHost({ runnerId: input.runnerId, privateRoot, git: config.git, registration: config.registration, gateway: input.gateway, assertReleaseCurrent, canonicalApprovalId: async (publicationId) => {
+                    let approvals;
+                    try {
+                        approvals = await readPrivateJson(path.join(input.stateRoot, 'local-fix-pr-approvals.json'));
+                    }
+                    catch (e) {
+                        if (e.code === 'ENOENT')
+                            return undefined;
+                        throw e;
+                    }
+                    const id = approvals[publicationId];
+                    if (id !== undefined && (typeof id !== 'string' || !/^[a-zA-Z0-9-]{1,191}$/.test(id)))
+                        throw denied();
+                    return id;
+                } });
+        }
+        const config = raw;
+        if (config.schema !== 'local-fix-host-installation-v1' || config.enabled !== true || config.runnerId !== input.runnerId || !config.registration || config.registration.review.manifestFingerprint !== protocolHash(config.registration.manifest))
+            throw denied();
+        const packageRoot = await realpath(fileURLToPath(new URL('../../../', import.meta.url)));
+        const assertReleaseCurrent = () => verifyLocalFixRuntime(packageRoot, config.runtimeFiles, config.registration.receipt);
+        await assertReleaseCurrent();
+        strictPublicationOrigin(config.origin);
+        const key = createPublicKey(config.publicKeyPem);
+        if (key.asymmetricKeyType !== 'ed25519')
+            throw denied();
+        if (config.node.executable !== await realpath(process.execPath) || config.credentialHelper.executable !== await realpath(fileURLToPath(new URL('./git-credential-helper.js', import.meta.url))))
+            throw denied();
+        await Promise.all([config.git, config.remoteHelper, config.node, config.credentialHelper].map(assertPinnedGit));
+        const privateRoot = path.join(input.stateRoot, 'local-fix-publication');
+        const s = await lstat(privateRoot);
+        if (!s.isDirectory() || s.isSymbolicLink() || (s.mode & 0o077) !== 0 || (process.getuid && s.uid !== process.getuid()) || await realpath(privateRoot) !== privateRoot)
+            throw denied();
+        const credentials = path.join(input.stateRoot, 'local-fix-git-credentials.json');
+        await privateFile(credentials); // metadata only
+        return createProductionLocalFixHost({ runnerId: input.runnerId, privateRoot, git: config.git, origin: config.origin, publicKeyPem: config.publicKeyPem, registration: config.registration, gateway: input.gateway, assertReleaseCurrent,
+            broker: ({ branch, current }) => new ScopedGitCredentialBroker({ git: config.git, remoteHelper: config.remoteHelper, node: config.node, credentialHelper: config.credentialHelper, origin: config.origin, branch, current, privateRoot, authorization: async (scope) => {
+                    if (scope.origin !== config.origin || !await current())
+                        throw denied();
+                    const value = await readPrivateJson(credentials);
+                    if (value.origin !== scope.origin || typeof value.username !== 'string' || typeof value.password !== 'string' || !value.username || !value.password)
+                        throw denied();
+                    return { username: value.username, password: value.password };
+                } }),
+            canonicalApprovalId: async (publicationId) => { const approvalsFile = path.join(input.stateRoot, 'local-fix-pr-approvals.json'); let approvals; try {
+                approvals = await readPrivateJson(approvalsFile);
+            }
+            catch (e) {
+                if (e.code === 'ENOENT')
+                    return undefined;
+                throw e;
+            } const id = approvals[publicationId]; if (id !== undefined && (typeof id !== 'string' || !/^[a-zA-Z0-9-]{1,191}$/.test(id)))
+                throw denied(); return id; },
+        });
+    }
+    catch {
+        throw denied();
+    }
+}

package/dist/src/publication/isolated-verifier.js

@@ -0,0 +1,67 @@
+import path from 'node:path';
+import { realpath } from 'node:fs/promises';
+import { measureCommandFile } from '../safety/registered-command-integrity.js';
+import { LocalToolPolicy } from '../safety/local-tool-policy.js';
+import { protocolHash } from './candidate.js';
+/** Reuses the exact registered-command sandbox: no ambient credentials, network,
+ * subprocess permissions, repository writes, or additional dependency grants.
+ * Unsupported PHP/Node project commands remain denied by existing confinement. */
+function buildIsolatedVerifier(input, allowCandidateReads = false) {
+    const options = { ...input, commands: structuredClone(input.commands), allowedPaths: [...input.allowedPaths], blockedPaths: [...input.blockedPaths] };
+    return async (snapshot) => {
+        const executionCommands = [];
+        for (const command of options.commands) {
+            const derived = structuredClone(command), names = command.candidateReadPaths ?? [];
+            if (!Array.isArray(names) || new Set(names).size !== names.length || (!allowCandidateReads && names.length))
+                throw Error('ISOLATED_VERIFICATION_REJECTED');
+            for (const name of names) {
+                if (typeof name !== 'string' || !name || path.isAbsolute(name) || name.includes('\\') || name.split('/').some(p => !p || p === '.' || p === '..' || /^(?:\.git|\.env(?:\..*)?|\.ssh|\.aws|\.codex|\.claude|\.npmrc|\.netrc|credentials(?:\..*)?|auth\.(?:json|toml|ya?ml)|AGENTS\.md|CLAUDE\.md)$/i.test(p)) || !options.allowedPaths.includes(name) || Object.hasOwn(command.integrity.readFiles, name) || options.blockedPaths.some(p => name === p || name.startsWith(p.replace(/\/\*\*$/, '') + '/')))
+                    throw Error('ISOLATED_VERIFICATION_REJECTED');
+                const file = path.join(options.root, name);
+                if (await realpath(file) !== file)
+                    throw Error('ISOLATED_VERIFICATION_REJECTED');
+                derived.integrity.readFiles[name] = await measureCommandFile(file);
+            }
+            executionCommands.push(derived);
+        }
+        const policy = new LocalToolPolicy({ worktreeRoot: options.root, access: 'read', allowedPaths: options.allowedPaths, blockedPaths: options.blockedPaths, requiredCommands: executionCommands.map(c => ({ ...c, readPaths: Object.keys(c.integrity.readFiles) })) });
+        try {
+            if (snapshot.commands.length !== options.commands.length)
+                throw Error('ISOLATED_VERIFICATION_REJECTED');
+            const results = [];
+            for (const command of options.commands) {
+                const fingerprint = protocolHash(command);
+                if (!await options.current() || !snapshot.commands.some(c => c.id === command.id && c.fingerprint === fingerprint))
+                    throw Error('ISOLATED_VERIFICATION_REJECTED');
+                await policy.call('local_test', { command: command.id });
+                if (!await options.current())
+                    throw Error('ISOLATED_VERIFICATION_REJECTED');
+                results.push({ command_id: command.id, command_fingerprint: fingerprint, snapshot_fingerprint: snapshot.snapshot_fingerprint, status: 'passed' });
+            }
+            return results;
+        }
+        finally {
+            policy.revoke();
+        }
+    };
+}
+export function createIsolatedVerifier(input) { return buildIsolatedVerifier(input); }
+/** Materializes the exact observed candidate outside model access and verifies
+ * that copy. Registered argv must be relative to its root; no argv rewriting or
+ * wider file grants are introduced. Caller can then construct a separate
+ * publication checkout from the retained sealed snapshot. */
+export function createSealedIsolatedVerifier(options) {
+    let sealed = null;
+    return { materialized: () => sealed, verify: async (snapshot) => {
+            const { createHash } = await import('node:crypto');
+            const copy = await options.host.materialize();
+            const manifest = [...copy.observation.changed_files].sort((a, b) => a.path < b.path ? -1 : 1);
+            if (createHash('sha256').update(copy.observation.diff).digest('hex') !== snapshot.diff_hash || protocolHash(manifest) !== snapshot.changed_file_manifest_hash)
+                throw Error('ISOLATED_VERIFICATION_REJECTED');
+            await copy.assertUnchanged();
+            const receipts = await buildIsolatedVerifier({ ...options, root: copy.root }, true)(snapshot);
+            await copy.assertUnchanged();
+            sealed = copy;
+            return receipts;
+        } };
+}

package/dist/src/publication/journal.js

@@ -0,0 +1,87 @@
+import { constants } from 'node:fs';
+import { lstat, mkdir, open, realpath, rename, rmdir, unlink } from 'node:fs/promises';
+import { randomUUID } from 'node:crypto';
+import path from 'node:path';
+/** Private host-owned directory outside model/test access. No credentials stored.
+ * fsync+rename gives durable intent; lock directories survive crashes and require
+ * explicit owner recovery. Never steal stale locks or replay uncertain effects. */
+export class FilePublicationJournal {
+    root;
+    held = new Set();
+    constructor(root) {
+        this.root = root;
+    }
+    async file(key) {
+        if (!/^[a-f0-9]{64}$/.test(key) || !path.isAbsolute(this.root) || await realpath(this.root) !== this.root)
+            throw Error('PUBLICATION_JOURNAL_REJECTED');
+        const stat = await lstat(this.root);
+        if (!stat.isDirectory() || stat.isSymbolicLink() || (stat.mode & 0o077) !== 0 || (process.getuid && stat.uid !== process.getuid()))
+            throw Error('PUBLICATION_JOURNAL_REJECTED');
+        return path.join(this.root, key + '.json');
+    }
+    async exclusive(key, operation) {
+        const lock = (await this.file(key)) + '.lock';
+        try {
+            await mkdir(lock, { mode: 0o700 });
+        }
+        catch {
+            throw Error('PUBLICATION_BUSY');
+        }
+        this.held.add(key);
+        try {
+            return await operation();
+        }
+        finally {
+            this.held.delete(key);
+            await rmdir(lock);
+        }
+    }
+    async load(key) {
+        const file = await this.file(key);
+        let fd;
+        try {
+            fd = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        }
+        catch (e) {
+            if (e.code === 'ENOENT')
+                return;
+            throw Error('PUBLICATION_JOURNAL_REJECTED');
+        }
+        try {
+            const stat = await fd.stat();
+            if (!stat.isFile() || stat.nlink !== 1 || stat.size > 1024 * 1024 || (stat.mode & 0o077) !== 0)
+                throw Error('PUBLICATION_JOURNAL_REJECTED');
+            return JSON.parse(await fd.readFile('utf8'));
+        }
+        finally {
+            await fd.close();
+        }
+    }
+    async save(key, record) {
+        const file = await this.file(key);
+        if (!this.held.has(key))
+            throw Error('PUBLICATION_JOURNAL_REJECTED');
+        const temporary = file + '.' + randomUUID() + '.tmp';
+        const fd = await open(temporary, 'wx', 0o600);
+        try {
+            await fd.writeFile(JSON.stringify(record));
+            await fd.sync();
+        }
+        finally {
+            await fd.close();
+        }
+        try {
+            await rename(temporary, file);
+            const directory = await open(this.root, constants.O_RDONLY);
+            try {
+                await directory.sync();
+            }
+            finally {
+                await directory.close();
+            }
+        }
+        finally {
+            await unlink(temporary).catch(() => { });
+        }
+    }
+}

package/dist/src/publication/production-host.js

@@ -0,0 +1,155 @@
+import { createPublicKey, randomUUID } from 'node:crypto';
+import { constants } from 'node:fs';
+import { lstat, realpath, open, rename, unlink } from 'node:fs/promises';
+import path from 'node:path';
+import { CandidateVerifier, protocolHash } from './candidate.js';
+import { createLocalFixExecutionHost } from './execution-host.js';
+import { GitSnapshotHost } from './git-snapshot.js';
+import { createSealedIsolatedVerifier } from './isolated-verifier.js';
+import { FilePublicationJournal } from './journal.js';
+import { DeterministicPublisher, PublicationOutcomeUnknownError } from './publisher.js';
+import { GitPublicationTransport } from './git-transport.js';
+import { assertPrivateCheckout } from './git-credential-broker.js';
+import { buildReviewedProjectRegistration } from './project-registration.js';
+const denied = () => Error('LOCAL_FIX_PRODUCTION_HOST_REJECTED');
+const fields = ['binding_id', 'actor_id', 'runner_id', 'job_id', 'generation', 'attempt_id', 'execution_contract_id', 'work_loop_id', 'repository_lease_id', 'repository_key', 'base_commit_sha', 'working_branch', 'contract_fingerprint', 'task_package_fingerprint', 'launch_fingerprint'];
+function proof(value) {
+    const output = Object.fromEntries(fields.map(k => [k, value[k]]));
+    if (!Number.isSafeInteger(output.generation) || output.generation < 1 || fields.some(k => k !== 'generation' && (typeof output[k] !== 'string' || !output[k])))
+        throw denied();
+    return output;
+}
+/** Reviewed composition: no model callback, ambient Git identity/helper, source
+ * upload or account credential is used. Installation/activation is separate. */
+export function createProductionLocalFixHost(options) {
+    const registration = structuredClone(options.registration);
+    const host = createLocalFixExecutionHost({ registration: { receipt: registration.receipt, commands: registration.manifest.commands }, prepare: async (input) => {
+            await options.assertReleaseCurrent?.();
+            const lifecycle = input.lifecycle;
+            if (!lifecycle)
+                throw Error('LOCAL_FIX_OWNED_LIFECYCLE_REQUIRED');
+            const { job, bindingId } = input, pkg = job.taskPackage, repo = pkg.repository, scope = pkg.local_fix_scope;
+            if (!lifecycle.isCurrent() || repo.provider_url !== options.origin || repo.key !== registration.manifest.project || job.gatewayTaskPackageFingerprint !== protocolHash(pkg) || pkg.runtime_adapter !== 'codex_cli')
+                throw denied();
+            const root = await realpath(options.privateRoot), stat = await lstat(root);
+            if (root !== options.privateRoot || !stat.isDirectory() || stat.isSymbolicLink() || (stat.mode & 0o077) !== 0 || (process.getuid && stat.uid !== process.getuid()) || root === input.checkoutPath || root.startsWith(input.checkoutPath + path.sep))
+                throw denied();
+            const allowed = pkg.allowed_paths, commands = registration.manifest.commands;
+            const verificationPaths = [...new Set([...allowed, ...commands.flatMap(c => Object.keys(c.integrity.readFiles))])];
+            await buildReviewedProjectRegistration({ root: input.checkoutPath, manifest: registration.manifest, review: registration.review, allowedPaths: verificationPaths, blockedPaths: ['.env', '.env.*', '.git/**', '.ssh/**', '.aws/**'] });
+            const fence = { jobId: job.id, generation: job.generation, leaseToken: job.leaseToken, launchGrant: job.launchGrant, bindingId };
+            const binding = proof((await options.gateway.localPublicationContext(fence)).context);
+            if (!lifecycle.isCurrent() || binding.runner_id !== options.runnerId || binding.job_id !== job.id || binding.generation !== job.generation || binding.binding_id !== bindingId || binding.work_loop_id !== job.workLoopId || binding.repository_key !== repo.key || binding.base_commit_sha !== repo.base_commit_sha || binding.working_branch !== repo.working_branch || binding.attempt_id !== scope.attempt_id || binding.contract_fingerprint !== job.gatewayContractFingerprint || binding.task_package_fingerprint !== job.gatewayTaskPackageFingerprint || binding.launch_fingerprint !== job.launchFingerprint)
+                throw denied();
+            let closed = false;
+            const current = async () => { if (closed || !lifecycle.isCurrent())
+                return false; try {
+                await options.assertReleaseCurrent?.();
+                if (closed || !lifecycle.isCurrent())
+                    return false;
+                const context = proof((await options.gateway.localPublicationContext(fence)).context);
+                return !closed && lifecycle.isCurrent() && protocolHash(context) === protocolHash(binding);
+            }
+            catch {
+                return false;
+            } };
+            const frozenCurrent = async () => lifecycle.isFrozen() && await current();
+            const limits = scope.candidate_limits;
+            const snapshots = new GitSnapshotHost({ root: input.checkoutPath, privateRoot: root, git: options.git, baseCommitSha: binding.base_commit_sha, workingBranch: binding.working_branch, maxFileBytes: limits.max_file_bytes, maxTotalBytes: 128 * 1024 * 1024 });
+            const isolated = createSealedIsolatedVerifier({ host: snapshots, allowedPaths: verificationPaths, blockedPaths: ['.env', '.env.*', '.git/**', '.ssh/**', '.aws/**'], commands, current: frozenCurrent });
+            const verifier = new CandidateVerifier({ binding, root: input.checkoutPath, allowedPaths: allowed, blockedPaths: ['.env', '.env.*', '.git/**', '.ssh/**', '.aws/**'], maxFiles: limits.max_changed_files, maxDiffBytes: limits.max_diff_bytes, maxFileBytes: limits.max_file_bytes, commands, current: frozenCurrent, assertRetainedSeal: async () => { const seal = isolated.materialized(); if (!seal)
+                    throw denied(); await seal.assertUnchanged(); }, observe: () => snapshots.observe(), verify: isolated.verify });
+            let git;
+            const publisher = new DeterministicPublisher({ publicKey: createPublicKey(options.publicKeyPem), journal: new FilePublicationJournal(root), assertCurrent: c => verifier.assertCurrent(c), gateway: {
+                    authorize: async (candidate) => { const securityReceipt = lifecycle.securityReceipt(); if (!securityReceipt || !await frozenCurrent())
+                        throw denied(); const value = await options.gateway.authorizeLocalPublication({ ...fence, candidate: candidate, testReceipts: (await verified()).testReceipts, securityReceipt: { ...securityReceipt }, hostReceipt: registration.receipt }); return { publication_id: value.publication.id }; },
+                    issue: async (publicationId, action) => { if (!await frozenCurrent())
+                        throw denied(); return (await options.gateway.issueLocalPublicationAction({ ...fence, publicationId, action, commitMessage: `Fix approved local attempt ${binding.attempt_id}`, pullRequestTitle: `Fix approved local attempt ${binding.attempt_id}`, pullRequestBody: `Verified isolated local fix for attempt ${binding.attempt_id}.` })).publication_request; },
+                    accept: async (publicationId, action, result) => { if (!await frozenCurrent())
+                        throw new PublicationOutcomeUnknownError(); await options.gateway.acceptLocalPublicationResult({ ...fence, publicationId, action, result: result }); },
+                }, provider: { execute: async (request) => {
+                        if (request.action === 'bitbucket.pull_request_create')
+                            return remotePr(request);
+                        return (await gitTransport()).execute(request);
+                    }, reconcile: async (request) => request.action === 'bitbucket.pull_request_create' ? remotePr(request) : (await gitTransport()).reconcile(request) } });
+            // Exactly one verified capability per session; no serialized model object can mint it.
+            let candidate;
+            const verified = async () => candidate ??= await verifier.verify();
+            const gitTransport = async () => {
+                if (!git) {
+                    const seal = isolated.materialized();
+                    if (!seal || !candidate || !await frozenCurrent())
+                        throw denied();
+                    const expected = { schema: 'local-publication-checkout-v1', binding_fingerprint: protocolHash(binding), candidate_fingerprint: candidate.evidence.candidate_fingerprint, tree_fingerprint: seal.treeFingerprint, origin: options.origin, git: options.git, manifest_fingerprint: registration.review.manifestFingerprint };
+                    // Publisher journal lock serializes this reference with action intents.
+                    // Persist before any Git effect; recovery must reopen the same checkout.
+                    const file = path.join(root, 'checkout-' + protocolHash({ binding: binding, candidate: candidate.evidence.candidate_fingerprint }) + '.json');
+                    let checkout;
+                    let fd;
+                    try {
+                        fd = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+                    }
+                    catch (error) {
+                        if (error.code !== 'ENOENT')
+                            throw denied();
+                    }
+                    if (fd) {
+                        try {
+                            const before = await fd.stat();
+                            if (!before.isFile() || before.nlink !== 1 || before.size > 16384 || (before.mode & 0o777) !== 0o600 || (process.getuid && before.uid !== process.getuid()))
+                                throw denied();
+                            const saved = JSON.parse(await fd.readFile('utf8'));
+                            const after = await fd.stat(), named = await lstat(file);
+                            for (const st of [after, named])
+                                if (!st.isFile() || st.dev !== before.dev || st.ino !== before.ino || st.size !== before.size || st.nlink !== 1 || st.mtimeMs !== before.mtimeMs || st.ctimeMs !== before.ctimeMs)
+                                    throw denied();
+                            const { checkout_name, ...bound } = saved;
+                            if (protocolHash(bound) !== protocolHash(expected) || typeof checkout_name !== 'string' || !/^publisher-[A-Za-z0-9]+$/.test(checkout_name))
+                                throw denied();
+                            checkout = path.join(root, checkout_name);
+                            await assertPrivateCheckout(checkout, root);
+                        }
+                        finally {
+                            await fd.close();
+                        }
+                    }
+                    else {
+                        checkout = await snapshots.publicationCheckout(seal);
+                        await assertPrivateCheckout(checkout, root);
+                        const temporary = file + '.' + randomUUID() + '.tmp', metadata = await open(temporary, 'wx', 0o600);
+                        try {
+                            await metadata.writeFile(JSON.stringify({ ...expected, checkout_name: path.basename(checkout) }));
+                            await metadata.sync();
+                        }
+                        finally {
+                            await metadata.close();
+                        }
+                        try {
+                            await rename(temporary, file);
+                            const directory = await open(root, constants.O_RDONLY);
+                            try {
+                                await directory.sync();
+                            }
+                            finally {
+                                await directory.close();
+                            }
+                        }
+                        finally {
+                            await unlink(temporary).catch(() => { });
+                        }
+                    }
+                    if (!await frozenCurrent())
+                        throw denied();
+                    git = new GitPublicationTransport({ checkout, privateRoot: root, git: options.git, sealedTreeFingerprint: seal.treeFingerprint, evidence: candidate.evidence, origin: options.origin, current: frozenCurrent, broker: typeof options.broker === 'function' ? options.broker({ branch: binding.working_branch, current: frozenCurrent }) : options.broker, maxFileBytes: limits.max_file_bytes });
+                }
+                return git;
+            };
+            const remotePr = async (request) => { if (!await frozenCurrent())
+                throw new PublicationOutcomeUnknownError(); const canonicalApprovalId = await options.canonicalApprovalId?.(request.publication_id); if (!await frozenCurrent())
+                throw new PublicationOutcomeUnknownError(); const response = await options.gateway.executeLocalPublicationPr({ ...fence, publicationId: request.publication_id, signedRequest: request, canonicalApprovalId }); if (response.result.status !== 'completed')
+                throw new PublicationOutcomeUnknownError(); return response.result; };
+            return { verifier: { verify: verified }, publisher, close: async () => { closed = true; } };
+        } });
+    return { requiresOwnedFreeze: true, prepare: async (input) => { if (!input.lifecycle)
+            throw Error('LOCAL_FIX_OWNED_LIFECYCLE_REQUIRED'); return host.prepare(input); } };
+}

package/dist/src/publication/project-registration.js

@@ -0,0 +1,49 @@
+import path from 'node:path';
+import { realpath } from 'node:fs/promises';
+import { verifyCommandIntegrity } from '../safety/registered-command-integrity.js';
+import { evaluateCommand } from '../safety/command-policy.js';
+import { protocolHash } from './candidate.js';
+const denied = () => new Error('PROJECT_REGISTRATION_REJECTED');
+const privateSegment = /^(?:\.git|\.mcp(?:\..*)?|\.env(?:\..*)?|\.ssh|\.aws|\.config|\.codex|\.claude|\.runner|\.local-runner|\.npmrc|\.netrc|id_rsa|id_ed25519|credentials(?:\..*)?|auth\.(?:json|toml|ya?ml)(?:\..*)?|mcp\.(?:json|toml|ya?ml)(?:\..*)?|AGENTS\.md|CLAUDE\.md|vendor|node_modules)$/i;
+function exactName(name) { return typeof name === 'string' && !!name && !path.isAbsolute(name) && !/[\\\0*?\[\]{}]/.test(name) && name.split('/').every(s => !!s && s !== '.' && s !== '..' && !privateSegment.test(s)); }
+function blocked(name, scopes) { return scopes.some(scope => scope === '.env.*' ? name.startsWith('.env.') : name === scope || name.startsWith(scope.replace(/\/\*\*$/, '') + '/')); }
+/** Validates reviewed exact registrations against the current host and scope.
+ * Receipt authenticity/ownership belongs to host release attestation; this API
+ * does not approve a manifest or imply project/incident acceptance. Only the
+ * existing bundled Node runtime is supported; no new sandbox grants are added. */
+export async function buildReviewedProjectRegistration(input) {
+    try {
+        const options = structuredClone(input), { manifest, review } = options;
+        if (!path.isAbsolute(options.root) || await realpath(options.root) !== options.root || manifest.schema !== 'local-project-verification-v1' || !/^[a-zA-Z0-9._-]+$/.test(manifest.project) || !Array.isArray(manifest.commands) || !manifest.commands.length || !review || !review.receiptId?.trim() || !review.reviewer?.trim() || review.manifestFingerprint !== protocolHash(manifest))
+            throw denied();
+        const runtime = await realpath(process.execPath), ids = new Set();
+        for (const command of manifest.commands) {
+            if (!/^[a-zA-Z0-9._-]+$/.test(command.id) || ids.has(command.id) || command.executable !== runtime || !Array.isArray(command.argv) || !command.argv.length || !command.integrity?.readFiles)
+                throw denied();
+            ids.add(command.id);
+            const pins = Object.keys(command.integrity.readFiles), dynamic = command.candidateReadPaths ?? [], all = [...pins, ...dynamic];
+            if (!Array.isArray(dynamic) || !pins.length || new Set(all).size !== all.length || all.some(name => !exactName(name) || !options.allowedPaths.includes(name) || blocked(name, options.blockedPaths)))
+                throw denied();
+            // First argv names an immutable harness; remaining file arguments name
+            // explicit reviewed immutable or candidate dependencies.
+            // No eval/preload/runtime flags, absolute argv, shell or ambient module loading.
+            if (!pins.includes(command.argv[0]) || command.argv.some(arg => typeof arg !== 'string' || !all.includes(arg)))
+                throw denied();
+            const rendered = [path.basename(runtime), ...command.argv].join(' ');
+            if (!evaluateCommand(rendered, { requiredCommands: [rendered] }).allowed)
+                throw denied();
+            const files = [];
+            for (const name of pins) {
+                const file = path.join(options.root, name);
+                if (await realpath(file) !== file)
+                    throw denied();
+                files.push(file);
+            }
+            await verifyCommandIntegrity(command.integrity, runtime, pins, files);
+        }
+        return { commands: manifest.commands, manifestFingerprint: review.manifestFingerprint, reviewReceiptId: review.receiptId };
+    }
+    catch {
+        throw denied();
+    }
+}