mtech-ai-local-runner 0.1.33 → 0.1.35

package/dist/src/publication/isolated-verifier.js

@@ -6,25 +6,29 @@ import { protocolHash } from './candidate.js';
 /** Reuses the exact registered-command sandbox: no ambient credentials, network,
  * subprocess permissions, repository writes, or additional dependency grants.
  * Unsupported PHP/Node project commands remain denied by existing confinement. */
-function buildIsolatedVerifier(input, allowCandidateReads = false) {
+export async function createIsolatedCommandPolicy(input, allowCandidateReads = false) {
     const options = { ...input, commands: structuredClone(input.commands), allowedPaths: [...input.allowedPaths], blockedPaths: [...input.blockedPaths] };
-    return async (snapshot) => {
-        const executionCommands = [];
-        for (const command of options.commands) {
-            const derived = structuredClone(command), names = command.candidateReadPaths ?? [];
-            if (!Array.isArray(names) || new Set(names).size !== names.length || (!allowCandidateReads && names.length))
+    const executionCommands = [];
+    for (const command of options.commands) {
+        const derived = structuredClone(command), names = command.candidateReadPaths ?? [];
+        if (!Array.isArray(names) || new Set(names).size !== names.length || (!allowCandidateReads && names.length))
+            throw Error('ISOLATED_VERIFICATION_REJECTED');
+        for (const name of names) {
+            if (typeof name !== 'string' || !name || path.isAbsolute(name) || name.includes('\\') || name.split('/').some(p => !p || p === '.' || p === '..' || /^(?:\.git|\.env(?:\..*)?|\.ssh|\.aws|\.codex|\.claude|\.npmrc|\.netrc|credentials(?:\..*)?|auth\.(?:json|toml|ya?ml)|AGENTS\.md|CLAUDE\.md)$/i.test(p)) || !options.allowedPaths.includes(name) || Object.hasOwn(command.integrity.readFiles, name) || options.blockedPaths.some(p => name === p || name.startsWith(p.replace(/\/\*\*$/, '') + '/')))
                 throw Error('ISOLATED_VERIFICATION_REJECTED');
-            for (const name of names) {
-                if (typeof name !== 'string' || !name || path.isAbsolute(name) || name.includes('\\') || name.split('/').some(p => !p || p === '.' || p === '..' || /^(?:\.git|\.env(?:\..*)?|\.ssh|\.aws|\.codex|\.claude|\.npmrc|\.netrc|credentials(?:\..*)?|auth\.(?:json|toml|ya?ml)|AGENTS\.md|CLAUDE\.md)$/i.test(p)) || !options.allowedPaths.includes(name) || Object.hasOwn(command.integrity.readFiles, name) || options.blockedPaths.some(p => name === p || name.startsWith(p.replace(/\/\*\*$/, '') + '/')))
-                    throw Error('ISOLATED_VERIFICATION_REJECTED');
-                const file = path.join(options.root, name);
-                if (await realpath(file) !== file)
-                    throw Error('ISOLATED_VERIFICATION_REJECTED');
-                derived.integrity.readFiles[name] = await measureCommandFile(file);
-            }
-            executionCommands.push(derived);
+            const file = path.join(options.root, name);
+            if (await realpath(file) !== file)
+                throw Error('ISOLATED_VERIFICATION_REJECTED');
+            derived.integrity.readFiles[name] = await measureCommandFile(file);
         }
-        const policy = new LocalToolPolicy({ worktreeRoot: options.root, access: 'read', allowedPaths: options.allowedPaths, blockedPaths: options.blockedPaths, requiredCommands: executionCommands.map(c => ({ ...c, readPaths: Object.keys(c.integrity.readFiles) })) });
+        executionCommands.push(derived);
+    }
+    return new LocalToolPolicy({ worktreeRoot: options.root, access: 'read', allowedPaths: options.allowedPaths, blockedPaths: options.blockedPaths, requiredCommands: executionCommands.map(c => ({ ...c, readPaths: Object.keys(c.integrity.readFiles) })) });
+}
+function buildIsolatedVerifier(input, allowCandidateReads = false) {
+    const options = { ...input, commands: structuredClone(input.commands), allowedPaths: [...input.allowedPaths], blockedPaths: [...input.blockedPaths] };
+    return async (snapshot) => {
+        const policy = await createIsolatedCommandPolicy(options, allowCandidateReads);
         try {
             if (snapshot.commands.length !== options.commands.length)
                 throw Error('ISOLATED_VERIFICATION_REJECTED');

package/dist/src/publication/project-registration.js

@@ -5,7 +5,7 @@ import { evaluateCommand } from '../safety/command-policy.js';
 import { protocolHash } from './candidate.js';
 const denied = () => new Error('PROJECT_REGISTRATION_REJECTED');
 const privateSegment = /^(?:\.git|\.mcp(?:\..*)?|\.env(?:\..*)?|\.ssh|\.aws|\.config|\.codex|\.claude|\.runner|\.local-runner|\.npmrc|\.netrc|id_rsa|id_ed25519|credentials(?:\..*)?|auth\.(?:json|toml|ya?ml)(?:\..*)?|mcp\.(?:json|toml|ya?ml)(?:\..*)?|AGENTS\.md|CLAUDE\.md|vendor|node_modules)$/i;
-function exactName(name) { return typeof name === 'string' && !!name && !path.isAbsolute(name) && !/[\\\0*?\[\]{}]/.test(name) && name.split('/').every(s => !!s && s !== '.' && s !== '..' && !privateSegment.test(s)); }
+function exactName(name) { return typeof name === 'string' && !!name && !name.startsWith('-') && !path.isAbsolute(name) && !/[\\\0*?\[\]{}]/.test(name) && name.split('/').every(s => !!s && s !== '.' && s !== '..' && !privateSegment.test(s)); }
 function blocked(name, scopes) { return scopes.some(scope => scope === '.env.*' ? name.startsWith('.env.') : name === scope || name.startsWith(scope.replace(/\/\*\*$/, '') + '/')); }
 /** Validates reviewed exact registrations against the current host and scope.
  * Receipt authenticity/ownership belongs to host release attestation; this API

package/dist/src/publication/raw-git-objects.js

@@ -0,0 +1,42 @@
+import { createHash } from 'node:crypto';
+import { deflateSync, inflateSync } from 'node:zlib';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+/** Local raw objects only: no filters, hooks, Git identity/config or transport. */
+export class RawGitObjects {
+    checkout;
+    constructor(checkout) {
+        this.checkout = checkout;
+    }
+    async object(type, bytes, write) {
+        const raw = Buffer.concat([Buffer.from(`${type} ${bytes.length}\0`), bytes]), oid = createHash('sha1').update(raw).digest('hex');
+        if (write) {
+            const dir = path.join(this.checkout, '.git', 'objects', oid.slice(0, 2)), file = path.join(dir, oid.slice(2));
+            await mkdir(dir, { recursive: true, mode: 0o700 });
+            try {
+                await writeFile(file, deflateSync(raw), { flag: 'wx', mode: 0o400 });
+            }
+            catch (e) {
+                if (e.code !== 'EEXIST' || !inflateSync(await readFile(file)).equals(raw))
+                    throw Error('GIT_OBJECT_REJECTED');
+            }
+        }
+        return oid;
+    }
+    async tree(entries, write, prefix = '') {
+        const names = new Map(), children = new Set();
+        for (const entry of entries) {
+            if (!entry.path.startsWith(prefix))
+                continue;
+            const rest = entry.path.slice(prefix.length), slash = rest.indexOf('/');
+            if (slash >= 0)
+                children.add(rest.slice(0, slash));
+            else
+                names.set(rest, { mode: entry.mode.toString(8), oid: entry.gitlink ?? await this.object('blob', entry.bytes, write) });
+        }
+        for (const child of children)
+            names.set(child, { mode: '40000', oid: await this.tree(entries, write, prefix + child + '/') });
+        const chunks = [...names].sort(([a, av], [b, bv]) => Buffer.compare(Buffer.from(a + (av.mode === '40000' ? '/' : '')), Buffer.from(b + (bv.mode === '40000' ? '/' : '')))).map(([name, v]) => Buffer.concat([Buffer.from(`${v.mode} ${name}\0`), Buffer.from(v.oid, 'hex')]));
+        return this.object('tree', Buffer.concat(chunks), write);
+    }
+}

package/dist/src/safety/codex-exec-production-host.js

@@ -9,6 +9,8 @@ import { parse } from 'smol-toml';
 import { CODEX_REPORT_SCHEMA } from '../adapters/codex/prompt-compiler.js';
 import { lstatSync } from 'node:fs';
 import { readStableText, regularFileStamp as stamp } from './stable-file-read.js';
+import { observePinnedGitHead } from './pinned-git-head.js';
+import { executionError } from './execution-failure.js';
 import { readCodexCredentialStatus, registeredCommandValid } from './codex-production-host.js';
 import { securityRequirementsFingerprint as hash, requireSecurityRequirements } from './security-requirements.js';
 import { fingerprint } from '../daemon/execution-coordinator.js';
@@ -101,13 +103,13 @@ export function createCodexExecProductionHost(original) {
             const close = () => { revoked = true; return closing ??= (Promise.resolve().then(() => cleanup?.())); };
             let revoked = false, prepared = false, selected, ctx;
             const baseline = new Map(), directories = new Map(), accountDirectories = new Map();
-            let boundPlan;
+            let boundPlan, headObservation;
             const dirStamp = (file) => { const s = lstatSync(file, { bigint: true }); if (!s.isDirectory() || (s.mode & 63n) !== 0n || process.getuid && s.uid !== BigInt(process.getuid()))
                 throw reject(); return [s.dev, s.ino, s.mode, s.uid].join(':'); };
             const accountDirStamp = (file) => { const s = lstatSync(file, { bigint: true }); if (!s.isDirectory() || s.isSymbolicLink())
                 throw reject(); return [s.dev, s.ino, s.mode, s.uid].join(':'); };
             const current = () => { try {
-                return !revoked && !!selected && !!ctx && (selected.release.securityMode !== UNMANAGED_EXEC_MODE || selected.policyObservation?.isCurrent() === true) && (lease.get(id)?.expires ?? 0) > Date.now() && [...baseline].every(([file, value]) => stamp(file) === value) && [...directories].every(([file, value]) => dirStamp(file) === value) && [...accountDirectories].every(([file, value]) => accountDirStamp(file) === value);
+                return !revoked && !!selected && !!ctx && headObservation?.isCurrent() === true && (selected.release.securityMode !== UNMANAGED_EXEC_MODE || selected.policyObservation?.isCurrent() === true) && (lease.get(id)?.expires ?? 0) > Date.now() && [...baseline].every(([file, value]) => stamp(file) === value) && [...directories].every(([file, value]) => dirStamp(file) === value) && [...accountDirectories].every(([file, value]) => accountDirStamp(file) === value);
             }
             catch {
                 return false;
@@ -118,34 +120,19 @@ export function createCodexExecProductionHost(original) {
                         throw reject();
                     prepared = true;
                     ctx = structuredClone(value);
+                    let stage = 'codex_prepare_release';
                     try {
                         selected = await inspect();
+                        stage = 'codex_prepare_binding';
                         const r = requireSecurityRequirements(p.security_requirements, { adapterId: 'codex_cli', adapterVersion: '1' }), release = selected.release;
                         if (r.mdm_verification !== release.mdmVerification || !isDeepStrictEqual(r.policy_observer, release.policyObserver) || r.security_mode !== release.securityMode || value.generation !== j.generation || value.resolvedModelId !== p.resolved_model_id || !release.modelIds.includes(value.resolvedModelId) || fingerprint(value.approvedTaskPackage) !== c.task_package_fingerprint || value.securityBinding?.contractFingerprint !== c.contract_fingerprint || value.securityBinding?.taskPackageFingerprint !== c.task_package_fingerprint || value.securityBinding?.launchFingerprint !== j.launch_fingerprint || r.release_manifest_sha256 !== execReleaseFingerprint(release) || r.binary_sha256 !== release.binarySha256 || r.fixtures_sha256 !== release.fixturesFingerprint || r.commands_sha256 !== commandRegistryFingerprint(release.commands) || r.tools_sha256 !== fingerprint({ tools: localToolInventory() }) || JSON.stringify(r.model_ids) !== JSON.stringify(release.modelIds))
                             throw reject();
+                        stage = 'codex_prepare_source';
                         const source = await realpath(sourceRoot), home = await realpath(account);
                         if (inside(source, home) || inside(home, source))
                             throw reject();
-                        const dot = path.join(source, '.git');
-                        const ds = await lstat(dot);
-                        let head;
-                        if (ds.isFile()) {
-                            const gitData = await readStableText(dot, 4096), git = gitData.text;
-                            if (!git.startsWith('gitdir: '))
-                                throw reject();
-                            const dir = path.resolve(source, git.slice(8).trim());
-                            if (inside(home, dir))
-                                throw reject();
-                            head = path.join(dir, 'HEAD');
-                            baseline.set(dot, gitData.stamp);
-                        }
-                        else if (ds.isDirectory() && !ds.isSymbolicLink())
-                            head = path.join(dot, 'HEAD');
-                        else
-                            throw reject();
-                        const headData = await readStableText(head, 4096);
-                        if (headData.text.trim() !== p.repository?.base_commit_sha)
-                            throw reject();
+                        headObservation = await observePinnedGitHead(source, p.repository, home);
+                        stage = 'codex_prepare_instructions';
                         const wrapper = CODEX_GLOBAL_INSTRUCTION_WRAPPER, ws = await lstat(wrapper);
                         if (!ws.isFile() || ws.isSymbolicLink() || ws.uid !== 0 || (ws.mode & 0o022) || await realpath(wrapper) !== wrapper)
                             throw reject();
@@ -156,9 +143,9 @@ export function createCodexExecProductionHost(original) {
                                 throw reject();
                             accountDirectories.set(ancestor, accountDirStamp(ancestor));
                         }
-                        baseline.set(head, headData.stamp);
                         baseline.set(selected.binary, selected.binaryStamp);
                         baseline.set(selected.config, selected.configStamp);
+                        stage = 'codex_prepare_commands';
                         for (const command of release.commands) {
                             const paths = command.readPaths ?? [], files = paths.map(v => path.join(source, v));
                             const measured = [command.executable, ...files].map(f => [f, stamp(f)]);
@@ -169,13 +156,14 @@ export function createCodexExecProductionHost(original) {
                                 baseline.set(f, s);
                             }
                         }
+                        stage = 'codex_prepare_current';
                         if (!current())
                             throw reject();
                         return { binary: selected.binary, release: structuredClone(release), actorId: c.security_context.actor_id, runnerId: input.runnerId };
                     }
-                    catch {
+                    catch (error) {
                         revoked = true;
-                        throw reject();
+                        throw executionError(error, stage, 'CODEX_EXEC_PREFLIGHT_REJECTED');
                     }
                 },
                 async inspect(plan) {

package/dist/src/safety/job-tool-policy.js

@@ -1,4 +1,5 @@
 import path from 'node:path';
+import { protocolHash } from '../publication/candidate.js';
 function object(value) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
         throw new Error('Invalid Job policy');
@@ -51,6 +52,14 @@ export function jobToolPolicyOptions(worktreeRoot, pkg, approved, registry, runt
     const approvedCommands = strings(approved.required_commands);
     if (commands.length !== approvedCommands.length || JSON.stringify([...commands].sort()) !== JSON.stringify([...approvedCommands].sort()))
         throw new Error('Job required commands differ from approval');
+    if (approved.verification !== undefined) {
+        const verification = object(approved.verification);
+        if (runtime.runtimeAdapter !== 'codex_cli' || runtime.runtimeAdapterVersion !== '1' || approved.runtime_transport !== 'official_exec_v1' || verification.runtime_adapter !== runtime.runtimeAdapter || verification.runtime_transport !== approved.runtime_transport || verification.policy_key !== 'local-runner-verified-v1' || protocolHash(repo.blocked_paths) !== protocolHash(source.blocked_paths))
+            throw new Error('P1 Job runtime or scope differs from approval');
+        if (approved.local_fix_scope !== undefined || verification.mode !== 'runner_observed_v1' || verification.schema_version !== 'local-runner-verification-v1' || pkg.verification !== undefined && protocolHash(verification) !== protocolHash(pkg.verification) || protocolHash(verification) !== protocolHash(object(pkg.contract).verification) || protocolHash(repo.allowed_paths) !== protocolHash(approved.allowed_paths) || protocolHash(verification.allowed_paths) !== protocolHash(approved.allowed_paths))
+            throw new Error('P1 Job verification differs from approval');
+        return { worktreeRoot, access: repo.access === 'write' && source.access === 'write' ? 'write' : 'read', allowedPaths: strings(approved.allowed_paths), blockedPaths: strings(repo.blocked_paths), requiredCommands: [] };
+    }
     // Writable local Fix checks run only after the owned model/tool endpoint is
     // closed, in the reviewed host verifier. They are not model command grants.
     const localFix = approved.local_fix_scope;

package/dist/src/safety/local-tool-policy.js

@@ -2,7 +2,7 @@ import path from 'node:path';
 import { randomBytes } from 'node:crypto';
 import { lstat, realpath } from 'node:fs/promises';
 import { evaluateCommand } from './command-policy.js';
-import { runSandboxed } from './subprocess-sandbox.js';
+import { runSandboxed, runSandboxedMeasured } from './subprocess-sandbox.js';
 import { LOCAL_TOOL_WORKER } from './local-tool-worker.js';
 import { verifyCommandIntegrity } from './registered-command-integrity.js';
 export const LOCAL_TOOL_NAMES = ['local_read', 'local_search', 'local_edit', 'local_test'];
@@ -86,7 +86,9 @@ export class LocalToolPolicy {
             throw new Error('DENIED_SIZE');
         return file;
     }
-    async test(input) {
+    async prepareTest(input) {
+        if (this.abort.signal.aborted)
+            throw new Error('DENIED_REVOKED');
         const command = this.options.requiredCommands.find(command => command.id === input.command);
         if (!command || !path.isAbsolute(command.executable) || command.argv.some(arg => typeof arg !== 'string'))
             throw new Error('DENIED_COMMAND');
@@ -99,7 +101,19 @@ export class LocalToolPolicy {
         const argv = executable === await realpath(process.execPath) ? ['--no-addons', '--no-global-search-paths', ...command.argv] : command.argv;
         const readFiles = await Promise.all((command.readPaths ?? []).map(file => this.authorizedFile(file)));
         await verifyCommandIntegrity(command.integrity, executable, command.readPaths ?? [], readFiles);
-        const output = await runSandboxed({ executable, argv, readFiles, cwd: this.options.worktreeRoot, signal: this.abort.signal });
+        return { command, executable, readFiles, request: { executable, argv, readFiles, cwd: this.options.worktreeRoot, signal: this.abort.signal } };
+    }
+    /** Same scope/integrity preparation and sandbox as legacy local_test, with
+     * no raw output retained. Only host verification calls this API. */
+    async measureTest(commandId, bounds, signal) {
+        const { command, executable, readFiles, request } = await this.prepareTest({ command: commandId });
+        const measurement = await runSandboxedMeasured({ ...request, ...bounds, signal: signal ? AbortSignal.any([this.abort.signal, signal]) : this.abort.signal });
+        await verifyCommandIntegrity(command.integrity, executable, command.readPaths ?? [], readFiles);
+        return measurement;
+    }
+    async test(input) {
+        const { command, executable, readFiles, request } = await this.prepareTest(input);
+        const output = await runSandboxed(request);
         await verifyCommandIntegrity(command.integrity, executable, command.readPaths ?? [], readFiles);
         if (this.abort.signal.aborted)
             throw new Error('DENIED_REVOKED');

package/dist/src/safety/pinned-git-head.js

@@ -0,0 +1,113 @@
+import path from 'node:path';
+import { lstat, realpath } from 'node:fs/promises';
+import { lstatSync, realpathSync } from 'node:fs';
+import { readStableText, regularFileStamp } from './stable-file-read.js';
+const denied = () => Error('PINNED_GIT_HEAD_REJECTED');
+const inside = (root, file) => file === root || file.startsWith(root + path.sep);
+const branchValid = (value) => typeof value === 'string' && value.length <= 255
+    && /^ai-work\/[A-Za-z0-9][A-Za-z0-9._-]*\/[A-Za-z0-9][A-Za-z0-9._-]*$/.test(value)
+    && value.split('/').every(p => !p.includes('..') && !p.endsWith('.') && !p.endsWith('.lock'));
+// Packed refs may have no loose-ref parent yet. Check the nearest existing
+// ancestor too, so a symlink to an empty directory cannot evade absence checks.
+function canonicalParent(file) {
+    let parent = path.dirname(file);
+    for (;;) {
+        try {
+            return lstatSync(parent).isDirectory() && realpathSync(parent) === parent;
+        }
+        catch (e) {
+            if (e.code !== 'ENOENT' || parent === path.dirname(parent))
+                return false;
+            parent = path.dirname(parent);
+        }
+    }
+}
+/** Observe Git metadata only: no Git process, filters, hooks, account or config reads.
+ * A symbolic HEAD is permitted only for the exact approved writable branch. */
+export async function observePinnedGitHead(source, repository, excludedRoot) {
+    const files = new Map(), absent = new Set();
+    const directory = async (file) => { if (inside(excludedRoot, file) || inside(file, excludedRoot) || await realpath(file) !== file || !(await lstat(file)).isDirectory())
+        throw denied(); return file; };
+    const read = async (file, max = 4096) => { if (await realpath(file) !== file)
+        throw denied(); const value = await readStableText(file, max); files.set(file, value.stamp); return value.text; };
+    const optional = async (file, max = 4096) => { try {
+        return await read(file, max);
+    }
+    catch (e) {
+        if (e.code !== 'ENOENT')
+            throw e;
+        if (!canonicalParent(file))
+            throw denied();
+        absent.add(file);
+        return undefined;
+    } };
+    const expected = repository.base_commit_sha;
+    if (typeof expected !== 'string' || !/^[a-f0-9]{40}$/.test(expected))
+        throw denied();
+    const dot = path.join(source, '.git'), entry = await lstat(dot);
+    let gitdir;
+    if (entry.isFile()) {
+        const value = await read(dot), match = /^gitdir: ([^\r\n\0]+)\n?$/.exec(value);
+        if (!match)
+            throw denied();
+        gitdir = await directory(path.resolve(source, match[1]));
+    }
+    else if (entry.isDirectory() && !entry.isSymbolicLink())
+        gitdir = await directory(dot);
+    else
+        throw denied();
+    const head = (await read(path.join(gitdir, 'HEAD'))).trim();
+    if (/^[a-f0-9]{40}$/.test(head)) {
+        if (head !== expected)
+            throw denied();
+    }
+    else {
+        const branch = repository.working_branch;
+        if (repository.access !== 'write' || !branchValid(branch) || head !== `ref: refs/heads/${branch}`)
+            throw denied();
+        const commonText = await optional(path.join(gitdir, 'commondir'));
+        if (commonText !== undefined && !/^[^\r\n\0]+\n?$/.test(commonText))
+            throw denied();
+        const common = commonText === undefined ? gitdir : await directory(path.resolve(gitdir, commonText.trim()));
+        const ref = `refs/heads/${branch}`, loose = await optional(path.join(common, ref));
+        let commit;
+        if (loose !== undefined) {
+            if (!/^[a-f0-9]{40}\n?$/.test(loose))
+                throw denied();
+            commit = loose.trim();
+        }
+        else {
+            const packed = await read(path.join(common, 'packed-refs'), 1_048_576);
+            for (const line of packed.split('\n')) {
+                if (!line || line.startsWith('#') || /^\^[a-f0-9]{40}$/.test(line))
+                    continue;
+                const match = /^([a-f0-9]{40}) (refs\/[^\s\0]+)$/.exec(line);
+                if (!match)
+                    throw denied();
+                if (match[2] === ref) {
+                    if (commit !== undefined)
+                        throw denied();
+                    commit = match[1];
+                }
+            }
+        }
+        if (commit !== expected)
+            throw denied();
+    }
+    const isCurrent = () => { try {
+        return [...files].every(([file, stamp]) => realpathSync(file) === file && regularFileStamp(file) === stamp) && [...absent].every(file => { if (!canonicalParent(file))
+            return false; try {
+            lstatSync(file);
+            return false;
+        }
+        catch (e) {
+            return e.code === 'ENOENT';
+        } });
+    }
+    catch {
+        return false;
+    } };
+    if (!isCurrent())
+        throw denied();
+    return { isCurrent };
+}

package/dist/src/safety/subprocess-sandbox.js

@@ -1,6 +1,7 @@
 import { spawn } from 'node:child_process';
 import { realpathSync } from 'node:fs';
 import path from 'node:path';
+import { createHash } from 'node:crypto';
 const quote = (value) => JSON.stringify(value);
 /** Deny-default Seatbelt profile. No inherited profile, environment or shell. */
 export function sandboxProfile(request) {
@@ -17,46 +18,79 @@ export function sandboxProfile(request) {
     const write = (request.writeFiles ?? []).map(file => `(literal ${quote(file)})`).join(' ');
     return `(version 1)(deny default)(allow process-exec (literal ${quote(executable)}))(allow sysctl-read)(allow file-read-metadata)(allow file-map-executable (subpath "/System/Library") (subpath "/usr/lib") (literal ${quote(executable)}))(allow file-read-data (subpath "/System/Library") (subpath "/usr/lib") (subpath "/usr/share") ${read})${write ? `(allow file-write* ${write})` : ''}`;
 }
-export async function runSandboxed(request) {
+/** One restricted execution primitive. P1 retains no output; only legacy callers
+ * opt into bounded stdout retention. Completion waits for close (stream drain),
+ * never exit or a timeout callback. No grants differ from sandboxProfile. */
+async function executeSandboxed(request, retainStdout) {
+    const start = performance.now();
+    const empty = (status, reason) => ({ measurement: { status, reason, exit_code: null, duration_ms: Math.max(0, Math.floor(performance.now() - start)), stdout_sha256: null, stderr_sha256: null, stdout_bytes: 0, stderr_bytes: 0 }, output: '' });
+    if (request.signal?.aborted)
+        return empty('cancelled', 'aborted');
     if (process.platform !== 'darwin')
-        throw new Error('LOCAL_SANDBOX_UNAVAILABLE: macOS Seatbelt required');
-    const profile = sandboxProfile(request);
-    return new Promise((resolve, reject) => {
-        const chunks = [];
-        let size = 0, settled = false;
-        const child = spawn('/usr/bin/sandbox-exec', ['-p', profile, realpathSync(request.executable), ...request.argv], {
-            cwd: request.cwd ?? '/', env: { PATH: '/usr/bin:/bin', LANG: 'C', HOME: '/nonexistent', TMPDIR: '/nonexistent' }, stdio: ['ignore', 'pipe', 'pipe'], detached: true, signal: request.signal,
-        });
-        const finish = (error) => {
-            if (settled)
-                return;
-            settled = true;
+        return empty('blocked', 'sandbox_unavailable');
+    const limit = request.maxOutputBytes ?? 1024 * 1024;
+    if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1024 * 1024 || (request.timeoutMs !== undefined && (!Number.isSafeInteger(request.timeoutMs) || request.timeoutMs < 1)))
+        return empty('blocked', 'invalid_bounds');
+    let profile, executable;
+    try {
+        profile = sandboxProfile(request);
+        executable = realpathSync(request.executable);
+    }
+    catch {
+        return empty('blocked', 'spawn_failed');
+    }
+    return new Promise(resolve => {
+        const stdout = createHash('sha256'), stderr = createHash('sha256'), chunks = [];
+        let outBytes = 0, errBytes = 0, reason, timer;
+        let child;
+        try {
+            child = spawn('/usr/bin/sandbox-exec', ['-p', profile, executable, ...request.argv], {
+                cwd: request.cwd ?? '/', env: { PATH: '/usr/bin:/bin', LANG: 'C', HOME: '/nonexistent', TMPDIR: '/nonexistent' }, stdio: ['ignore', 'pipe', 'pipe'], detached: true,
+            });
+        }
+        catch {
+            resolve(empty('blocked', 'spawn_failed'));
+            return;
+        }
+        const kill = () => { try {
+            if (child.pid)
+                process.kill(-child.pid, 'SIGKILL');
+        }
+        catch { /* own group already exited */ } };
+        const stop = (why) => { reason ??= why; kill(); };
+        const abort = () => stop('aborted');
+        request.signal?.addEventListener('abort', abort, { once: true });
+        if (request.signal?.aborted)
+            abort();
+        if (request.timeoutMs !== undefined)
+            timer = setTimeout(() => stop('timeout'), request.timeoutMs);
+        child.stdout.on('data', (chunk) => { outBytes += chunk.length; stdout.update(chunk); if (outBytes + (retainStdout ? 0 : errBytes) > limit)
+            stop('output_limit');
+        else if (retainStdout)
+            chunks.push(chunk); });
+        // Legacy callers bounded stdout only and drained arbitrary stderr.
+        // P1 bounds both streams together, without retaining either stream.
+        child.stderr.on('data', (chunk) => { errBytes += chunk.length; stderr.update(chunk); if (!retainStdout && outBytes + errBytes > limit)
+            stop('output_limit'); });
+        child.stdout.on('error', () => stop('spawn_failed'));
+        child.stderr.on('error', () => stop('spawn_failed'));
+        child.on('error', () => stop('spawn_failed'));
+        child.on('close', (code, signal) => {
             clearTimeout(timer);
-            if (error)
-                reject(error);
-            else
-                resolve(Buffer.concat(chunks).toString('utf8'));
-        };
-        const kill = () => {
-            try {
-                if (child.pid)
-                    process.kill(-child.pid, 'SIGKILL');
-            }
-            catch { /* already exited */ }
-        };
-        const timer = request.timeoutMs === undefined ? undefined : setTimeout(() => { kill(); finish(new Error('LOCAL_SANDBOX_UNAVAILABLE: command timed out')); }, request.timeoutMs);
-        child.stdout.on('data', (chunk) => {
-            size += chunk.length;
-            if (size > 1024 * 1024) {
-                kill();
-                finish(new Error('LOCAL_SANDBOX_UNAVAILABLE: output limit'));
-            }
-            else
-                chunks.push(chunk);
+            request.signal?.removeEventListener('abort', abort);
+            kill();
+            if (request.signal?.aborted)
+                reason = 'aborted';
+            reason ??= signal ? 'signal' : code === 0 ? undefined : 'nonzero_exit';
+            const status = reason === 'aborted' ? 'cancelled' : reason === 'timeout' ? 'timed_out' : reason === 'output_limit' || reason === 'spawn_failed' ? 'blocked' : reason ? 'failed' : 'passed';
+            resolve({ measurement: { status, exit_code: code, duration_ms: Math.max(0, Math.floor(performance.now() - start)), stdout_sha256: reason === 'spawn_failed' ? null : stdout.digest('hex'), stderr_sha256: reason === 'spawn_failed' ? null : stderr.digest('hex'), stdout_bytes: outBytes, stderr_bytes: errBytes, ...(reason ? { reason } : {}) }, output: retainStdout && status === 'passed' ? Buffer.concat(chunks).toString('utf8') : '' });
         });
-        // Do not disclose arbitrary subprocess stderr or paths to the model.
-        child.stderr.resume();
-        child.on('error', () => { kill(); finish(new Error('LOCAL_SANDBOX_UNAVAILABLE: could not start restricted process')); });
-        child.on('close', (code) => { kill(); finish(code === 0 ? undefined : new Error('LOCAL_SANDBOX_UNAVAILABLE: restricted process failed')); });
     });
 }
+export async function runSandboxedMeasured(request) { return (await executeSandboxed(request, false)).measurement; }
+export async function runSandboxed(request) {
+    const result = await executeSandboxed(request, true);
+    if (result.measurement.status !== 'passed')
+        throw new Error('LOCAL_SANDBOX_UNAVAILABLE: restricted process failed');
+    return result.output;
+}

package/dist/src/verification/p1-execution-host.js

@@ -0,0 +1,78 @@
+import { RunnerObservedVerifier } from './runner-observed-verifier.js';
+import { isP1WorkingBranch } from '../publication/git-snapshot.js';
+import { protocolHash } from '../publication/candidate.js';
+export class RunnerObservedExecutionHost {
+    privateRoot;
+    registration;
+    constructor(privateRoot, registration) {
+        this.privateRoot = privateRoot;
+        this.registration = structuredClone(registration);
+    }
+    options(input) {
+        const p = input.job.taskPackage, r = p.repository;
+        return { root: input.checkoutPath, privateRoot: this.privateRoot, registration: this.registration, verification: p.verification,
+            fence: { binding_id: input.bindingId, job_id: input.job.id, generation: input.job.generation, contract_fingerprint: p.contract_fingerprint, base_commit_sha: r.base_commit_sha, working_branch: r.working_branch },
+            allowedPaths: p.allowed_paths, blockedPaths: r.blocked_paths, candidateLimits: p.candidate_limits,
+            current: input.current, freezeOwnedModel: input.freezeOwnedModel, assertModelFrozen: input.assertModelFrozen, signal: input.signal };
+    }
+    assertEligible(job) {
+        const r = this.registration;
+        if (r.manifest.schema !== 'local-project-verification-v1' || !r.review.receiptId?.trim() || !r.review.reviewer?.trim() || r.review.manifestFingerprint !== protocolHash(r.manifest))
+            throw Error('P1_REGISTRATION_REJECTED');
+        new RunnerObservedVerifier(this.options({ job, checkoutPath: '', bindingId: 'preflight', signal: new AbortController().signal, current: async () => false, freezeOwnedModel: async () => { throw Error('P1_NOT_FROZEN'); }, assertModelFrozen: async () => { throw Error('P1_NOT_FROZEN'); } })).assertContract();
+    }
+    verify(input) { return new RunnerObservedVerifier(this.options(input)).verify(); }
+}
+const record = (v) => { if (!v || typeof v !== 'object' || Array.isArray(v))
+    throw Error('P1_CONTRACT_REJECTED'); return v; };
+const equal = (a, b) => a !== undefined && b !== undefined && protocolHash(a) === protocolHash(b);
+export const hasP1 = (p) => {
+    const v = p.verification, policy = p.policy;
+    return policy?.policy_key === 'local-runner-verified-v1' || !!v && (v.schema_version !== undefined || v.mode !== undefined);
+};
+/** Compare host launch claims to authoritative WEC/bundle fields before start. */
+export function assertP1Bindings(p, canonical, bundle = false) {
+    const v = record(p.verification), r = record(p.repository), limits = record(p.candidate_limits);
+    if (p.local_fix_scope !== undefined || p.verification_mode === 'gateway_ci_v1' || p.runtime_adapter !== 'codex_cli' || p.runtime_adapter_version !== '1' || p.runtime_transport !== 'official_exec_v1' || v.schema_version !== 'local-runner-verification-v1' || v.policy_key !== 'local-runner-verified-v1' || v.mode !== 'runner_observed_v1' || v.runtime_adapter !== p.runtime_adapter || v.runtime_transport !== p.runtime_transport || r.access !== 'write' || !isP1WorkingBranch(r.working_branch) || !equal(p.allowed_paths, v.allowed_paths) || !equal(r.allowed_paths, v.allowed_paths) || !Array.isArray(r.blocked_paths))
+        throw Error('P1_CONTRACT_REJECTED');
+    if (Object.keys(limits).sort().join(',') !== 'max_changed_files,max_diff_bytes,max_file_bytes' || Object.values(limits).some(n => !Number.isSafeInteger(n) || Number(n) < 1))
+        throw Error('P1_CONTRACT_REJECTED');
+    if (!canonical)
+        return;
+    const execution = canonical.agent_execution;
+    if (canonical.local_fix_scope !== undefined || execution?.local_fix_scope !== undefined || execution?.publication_mode === 'gateway_ci_v1')
+        throw Error('P1_CONTRACT_REJECTED');
+    if (!bundle) {
+        const policy = record(canonical.policy);
+        if (policy.policy_key !== 'local-runner-verified-v1' || policy.loop_type !== 'agent_runtime_implementation')
+            throw Error('P1_CONTRACT_REJECTED');
+    }
+    const repos = canonical.repositories;
+    if (!Array.isArray(repos) || repos.length !== 1)
+        throw Error('P1_CONTRACT_REJECTED');
+    const repo = record(repos[0]);
+    const bound = bundle ? record(canonical.contract) : canonical;
+    if (!equal(v, bound.verification) || !equal(limits, record(bound.policy).candidate_limits) || repo.repository_key !== r.key || repo.access !== r.access || repo.base_commit_sha !== r.base_commit_sha || repo.working_branch !== r.working_branch || !equal(repo.allowed_paths, r.allowed_paths) || !equal(repo.blocked_paths, r.blocked_paths))
+        throw Error('P1_CONTRACT_REJECTED');
+    if (bundle && (bound.content_fingerprint !== p.contract_fingerprint || canonical.verification !== undefined && !equal(v, canonical.verification) || canonical.candidate_limits !== undefined && !equal(limits, canonical.candidate_limits)))
+        throw Error('P1_CONTRACT_REJECTED');
+}
+/** P1 model events carry narrative/progress only. Proof is injected afterwards. */
+export function p1ModelEvent(event) {
+    if (event.eventType === 'test_started' || event.eventType === 'test_result')
+        return { eventType: 'progress', summary: 'model tool activity', payload: { kind: 'tool_activity' } };
+    const payload = {};
+    for (const key of ['reason', 'investigation_summary', 'question']) {
+        const value = event.payload?.[key];
+        if (typeof value === 'string')
+            payload[key] = value.slice(0, 6000);
+    }
+    // Only parsers can attach these provider observations; never completion text.
+    const usage = event.payload?.usage;
+    if (usage && typeof usage === 'object' && !Array.isArray(usage)) {
+        const u = usage, provider = ['openai', 'anthropic'].includes(String(u.provider)) ? u.provider : null;
+        const source = ['codex_cli.turn.completed', 'codex_app_server.thread/tokenUsage/updated', 'claude_code_cli.result'].includes(String(u.source)) ? u.source : null;
+        payload.usage = { provider, source, ...Object.fromEntries(['input_tokens', 'cached_input_tokens', 'output_tokens', 'duration_ms'].map(k => [k, typeof u[k] === 'number' && Number.isSafeInteger(u[k]) && Number(u[k]) >= 0 && Number(u[k]) <= 2147483647 ? u[k] : null])) };
+    }
+    return { ...event, payload };
+}