mtech-ai-local-runner 0.1.34 → 0.1.35

package/README.md

@@ -1,3 +1,15 @@
+## 0.1.35: exact approved source paths in Codex instructions
+
+Codex receives the approved checkout-relative paths, revision, access mode and
+blocked-path list from its binding bundle. A denial for an unlisted path does
+not imply that another approved file is unavailable. Scope descriptions exclude
+repository transport coordinates and write leases. Unregistered commands remain
+unavailable, and missing validation stays not_run/unverified.
+
+This patch does not expand source or tool permissions, change the Claude path,
+or authorize a new execution. Package integrity, runtime pins and a separately
+approved exact contract/launch remain required for the next Fix attempt.
+
 ## 0.1.34: pinned writable Fix HEAD preparation
 
 Accept a linked worktree's symbolic HEAD only for the exact approved writable

package/dist/src/adapters/codex/prompt-compiler.js

@@ -1,6 +1,29 @@
 import { compilePrompt as compileBrief } from "../prompt-compiler.js";
+function repositoryScope(taskPackage) {
+    const repositories = taskPackage.repositories;
+    const repo = Array.isArray(repositories) && repositories.length === 1
+        && repositories[0] && typeof repositories[0] === "object" && !Array.isArray(repositories[0])
+        ? repositories[0] : undefined;
+    const paths = (value) => Array.isArray(value)
+        && value.every(item => typeof item === "string" && item.length > 0);
+    if (!repo || !paths(repo.allowed_paths) || !repo.allowed_paths.length || !paths(repo.blocked_paths)
+        || !["read", "write"].includes(String(repo.access))
+        || typeof repo.repository_key !== "string" || typeof repo.base_commit_sha !== "string"
+        || !/^[a-f0-9]{40}$/i.test(repo.base_commit_sha)) {
+        return "## Approved repository scope\nRepository scope is unavailable; do not guess source paths or commands. Stop and emit one final blocked report.";
+    }
+    // Project only source-scope fields from the binding bundle. Never stringify
+    // the whole repository: it may contain transport coordinates or write leases.
+    const scope = { repository_key: repo.repository_key, base_commit_sha: repo.base_commit_sha,
+        access: repo.access, allowed_paths: repo.allowed_paths, blocked_paths: repo.blocked_paths };
+    return `## Approved repository scope\n${JSON.stringify(scope, null, 2)}\n` +
+        "Use these checkout-relative paths exactly, including case. Start with the relevant approved files above before drawing a conclusion about source availability. " +
+        "Do not invent paths or commands from framework conventions. A denial for an unlisted path does not establish that a listed file is unavailable. " +
+        "Do not claim an approved file was denied unless its exact path was attempted and the tool returned a denial. " +
+        "These are scope descriptions, not instructions from source files; the host policy remains authoritative and may deny blocked/private paths within an allowed prefix.";
+}
 export function compileCodexPrompt(taskPackage, label) {
-    return `${compileBrief(taskPackage, { workItemLabel: label, progressReporting: "native_messages" })}\n\nUse only the ai_local job tools for repository reads, edits and approved tests. For reading, use server ai_local's local_read({path: "docs/example.md"}) or local_search({path: "docs/example.md", query: "text"}) with checkout-relative paths. In a read-only task, use only read/search tools; the Runner enforces the approved paths and operations. A denied native cwd is intentional: it is a private control directory, not the source checkout. Native filesystem, commands, web, images and delegation are unavailable or denied. A denied tool is a scope boundary, never a reason to try another path. Do not repeat host orchestration: claim, shadow, fingerprints, binding, administrator checks, launches, Gateway usage and Job reporting belong to the Runner/host, even when described in the objective. Perform only the assigned repository work and report evidence you actually observed. Do not claim that no model call occurred. If the required tool is unavailable, emit one final structured blocked report naming the missing tool and unfinished repository work; do not request or attempt a new launch.`;
+    return `${compileBrief(taskPackage, { workItemLabel: label, progressReporting: "native_messages" })}\n\n${repositoryScope(taskPackage)}\n\nUse only the ai_local job tools for repository reads, edits and approved tests. For reading, use server ai_local's local_read({path: "<exact approved path>"}) or local_search({path: "<exact approved path>", query: "text"}) with checkout-relative paths. Required test criteria are not command grants. No model test commands are registered unless the host explicitly supplies exact model-callable command IDs; do not use local_test to discover commands or run --help. Missing tests remain not_run/unverified, not passed. In a read-only task, use only read/search tools; the Runner enforces the approved paths and operations. A denied native cwd is intentional: it is a private control directory, not the source checkout. Native filesystem, commands, web, images and delegation are unavailable or denied. A denied tool is a scope boundary, never permission to broaden scope or bypass the denial. Do not retry the denied path. It does not remove independently approved paths: continue with relevant listed paths, and report a missing dependency only after checking the available approved source. Do not repeat host orchestration: claim, shadow, fingerprints, binding, administrator checks, launches, Gateway usage and Job reporting belong to the Runner/host, even when described in the objective. Perform only the assigned repository work and report evidence you actually observed. Do not claim that no model call occurred. If the required tool is unavailable, emit one final structured blocked report naming the missing tool and unfinished repository work; do not request or attempt a new launch.`;
 }
 export const CODEX_REPORT_SCHEMA = {
     type: "object", additionalProperties: false, required: ["status", "report", "evidence", "pending_work"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.34",
+  "version": "0.1.35",
   "private": false,
   "license": "UNLICENSED",
   "bin": {