mtech-ai-local-runner 0.1.34 → 0.1.36
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md
CHANGED
|
@@ -1,3 +1,33 @@
|
|
|
1
|
+
## 0.1.36: reviewed Codex CLI 0.163.0-alpha.11
|
|
2
|
+
|
|
3
|
+
The ChatGPT desktop app replaced its bundled Codex CLI with
|
|
4
|
+
`codex-cli 0.163.0-alpha.11`, so the daemon reported Codex as unauthenticated:
|
|
5
|
+
the installed binary no longer matched the single reviewed release. This patch
|
|
6
|
+
replaces that reviewed release with alpha.11 (binary SHA256
|
|
7
|
+
`8a6dc3938a2f5d30cc19c50b9ccad83a5aa2ca4a2e3411665430bb78a917220a`) in the
|
|
8
|
+
manual and daemon registrations and in the matching Gateway manifests.
|
|
9
|
+
|
|
10
|
+
The review repeats the alpha.10.2 evidence classes: OpenAI signature and
|
|
11
|
+
notarization, official archive digest and pre-signature payload match, and the
|
|
12
|
+
fake-account no-model native composition fixture. Managed-scope and auth-backend
|
|
13
|
+
evidence is inherited: it does not depend on the Codex binary, and the Codex auth
|
|
14
|
+
storage sources are identical between the two tags. Permissions, tools,
|
|
15
|
+
model IDs and residual risks are unchanged. Package integrity, runtime pins, a
|
|
16
|
+
daemon update and a separately approved exact contract/launch remain required
|
|
17
|
+
before any Codex run.
|
|
18
|
+
|
|
19
|
+
## 0.1.35: exact approved source paths in Codex instructions
|
|
20
|
+
|
|
21
|
+
Codex receives the approved checkout-relative paths, revision, access mode and
|
|
22
|
+
blocked-path list from its binding bundle. A denial for an unlisted path does
|
|
23
|
+
not imply that another approved file is unavailable. Scope descriptions exclude
|
|
24
|
+
repository transport coordinates and write leases. Unregistered commands remain
|
|
25
|
+
unavailable, and missing validation stays not_run/unverified.
|
|
26
|
+
|
|
27
|
+
This patch does not expand source or tool permissions, change the Claude path,
|
|
28
|
+
or authorize a new execution. Package integrity, runtime pins and a separately
|
|
29
|
+
approved exact contract/launch remain required for the next Fix attempt.
|
|
30
|
+
|
|
1
31
|
## 0.1.34: pinned writable Fix HEAD preparation
|
|
2
32
|
|
|
3
33
|
Accept a linked worktree's symbolic HEAD only for the exact approved writable
|
|
@@ -1,6 +1,29 @@
|
|
|
1
1
|
import { compilePrompt as compileBrief } from "../prompt-compiler.js";
|
|
2
|
+
function repositoryScope(taskPackage) {
|
|
3
|
+
const repositories = taskPackage.repositories;
|
|
4
|
+
const repo = Array.isArray(repositories) && repositories.length === 1
|
|
5
|
+
&& repositories[0] && typeof repositories[0] === "object" && !Array.isArray(repositories[0])
|
|
6
|
+
? repositories[0] : undefined;
|
|
7
|
+
const paths = (value) => Array.isArray(value)
|
|
8
|
+
&& value.every(item => typeof item === "string" && item.length > 0);
|
|
9
|
+
if (!repo || !paths(repo.allowed_paths) || !repo.allowed_paths.length || !paths(repo.blocked_paths)
|
|
10
|
+
|| !["read", "write"].includes(String(repo.access))
|
|
11
|
+
|| typeof repo.repository_key !== "string" || typeof repo.base_commit_sha !== "string"
|
|
12
|
+
|| !/^[a-f0-9]{40}$/i.test(repo.base_commit_sha)) {
|
|
13
|
+
return "## Approved repository scope\nRepository scope is unavailable; do not guess source paths or commands. Stop and emit one final blocked report.";
|
|
14
|
+
}
|
|
15
|
+
// Project only source-scope fields from the binding bundle. Never stringify
|
|
16
|
+
// the whole repository: it may contain transport coordinates or write leases.
|
|
17
|
+
const scope = { repository_key: repo.repository_key, base_commit_sha: repo.base_commit_sha,
|
|
18
|
+
access: repo.access, allowed_paths: repo.allowed_paths, blocked_paths: repo.blocked_paths };
|
|
19
|
+
return `## Approved repository scope\n${JSON.stringify(scope, null, 2)}\n` +
|
|
20
|
+
"Use these checkout-relative paths exactly, including case. Start with the relevant approved files above before drawing a conclusion about source availability. " +
|
|
21
|
+
"Do not invent paths or commands from framework conventions. A denial for an unlisted path does not establish that a listed file is unavailable. " +
|
|
22
|
+
"Do not claim an approved file was denied unless its exact path was attempted and the tool returned a denial. " +
|
|
23
|
+
"These are scope descriptions, not instructions from source files; the host policy remains authoritative and may deny blocked/private paths within an allowed prefix.";
|
|
24
|
+
}
|
|
2
25
|
export function compileCodexPrompt(taskPackage, label) {
|
|
3
|
-
return `${compileBrief(taskPackage, { workItemLabel: label, progressReporting: "native_messages" })}\n\nUse only the ai_local job tools for repository reads, edits and approved tests. For reading, use server ai_local's local_read({path: "
|
|
26
|
+
return `${compileBrief(taskPackage, { workItemLabel: label, progressReporting: "native_messages" })}\n\n${repositoryScope(taskPackage)}\n\nUse only the ai_local job tools for repository reads, edits and approved tests. For reading, use server ai_local's local_read({path: "<exact approved path>"}) or local_search({path: "<exact approved path>", query: "text"}) with checkout-relative paths. Required test criteria are not command grants. No model test commands are registered unless the host explicitly supplies exact model-callable command IDs; do not use local_test to discover commands or run --help. Missing tests remain not_run/unverified, not passed. In a read-only task, use only read/search tools; the Runner enforces the approved paths and operations. A denied native cwd is intentional: it is a private control directory, not the source checkout. Native filesystem, commands, web, images and delegation are unavailable or denied. A denied tool is a scope boundary, never permission to broaden scope or bypass the denial. Do not retry the denied path. It does not remove independently approved paths: continue with relevant listed paths, and report a missing dependency only after checking the available approved source. Do not repeat host orchestration: claim, shadow, fingerprints, binding, administrator checks, launches, Gateway usage and Job reporting belong to the Runner/host, even when described in the objective. Perform only the assigned repository work and report evidence you actually observed. Do not claim that no model call occurred. If the required tool is unavailable, emit one final structured blocked report naming the missing tool and unfinished repository work; do not request or attempt a new launch.`;
|
|
4
27
|
}
|
|
5
28
|
export const CODEX_REPORT_SCHEMA = {
|
|
6
29
|
type: "object", additionalProperties: false, required: ["status", "report", "evidence", "pending_work"],
|
|
@@ -7,12 +7,12 @@ export const CODEX_DAEMON_EXEC_RELEASES = Object.freeze([{
|
|
|
7
7
|
"securityMode": "supported_cli_exec_release_policy_v3",
|
|
8
8
|
"policyScope": "unmanaged_personal_only",
|
|
9
9
|
"managedEnforcement": "not_run",
|
|
10
|
-
"executableVersion": "codex-cli 0.163.0-alpha.
|
|
11
|
-
"binarySha256": "
|
|
10
|
+
"executableVersion": "codex-cli 0.163.0-alpha.11",
|
|
11
|
+
"binarySha256": "8a6dc3938a2f5d30cc19c50b9ccad83a5aa2ca4a2e3411665430bb78a917220a",
|
|
12
12
|
"modelIds": [
|
|
13
13
|
"gpt-5.6-sol"
|
|
14
14
|
],
|
|
15
|
-
"decisionId": "
|
|
15
|
+
"decisionId": "16d7057c-b613-45c0-92e0-05262af96d89",
|
|
16
16
|
"acceptedResidualRisks": [
|
|
17
17
|
"vendor_native_policy_enforcement",
|
|
18
18
|
"managed_policy_not_directly_observed_per_job",
|
|
@@ -26,14 +26,14 @@ export const CODEX_DAEMON_EXEC_RELEASES = Object.freeze([{
|
|
|
26
26
|
"credentialBackend": "auto",
|
|
27
27
|
"mdmVerification": "privileged_prelaunch",
|
|
28
28
|
"fixtureEvidence": {
|
|
29
|
-
"binary_release": "
|
|
30
|
-
"official_permissions": "
|
|
29
|
+
"binary_release": "e392e2e1a577a5fb91f8cbb508ec3ebf287073a3c92389586531d81d4751b14f",
|
|
30
|
+
"official_permissions": "3c12b20dda72cc638a4109b2f25f5066f64e302a4b465e941a3188f8f51d21c1",
|
|
31
31
|
"managed_scope_exclusion": "a559199e229e153759f7a7cbd682aae423c0e3d33ef2a692fcccb5eed7c57ed3",
|
|
32
|
-
"required_mcp_startup": "
|
|
33
|
-
"source_exclusion": "
|
|
32
|
+
"required_mcp_startup": "94f51ddb832948eaeeb51040b4d5eace56f245328c356d3b9042e09080b4173c",
|
|
33
|
+
"source_exclusion": "36f4e02fee13fe4c1535f26b539cb2f15218e257ebc857c79c6b9e5676218c2b",
|
|
34
34
|
"auth_backend_compatibility": "7c42b882a52698fef3e14b4b956ede91ed1e3b29511fbff3176387063b8d74f0"
|
|
35
35
|
},
|
|
36
|
-
"fixturesFingerprint": "
|
|
36
|
+
"fixturesFingerprint": "cc9e1586bbed7c4b0548dad6ffb91453d3cadd084504379178e5820687a2c892",
|
|
37
37
|
"commands": [],
|
|
38
38
|
"policyObserver": {
|
|
39
39
|
"protocol": "policy-inventory-v1",
|
|
@@ -6,12 +6,12 @@ export const REVIEWED_MANUAL_CODEX_RELEASE = {
|
|
|
6
6
|
"securityMode": "supported_cli_exec_release_policy_v3",
|
|
7
7
|
"policyScope": "unmanaged_personal_only",
|
|
8
8
|
"managedEnforcement": "not_run",
|
|
9
|
-
"executableVersion": "codex-cli 0.163.0-alpha.
|
|
10
|
-
"binarySha256": "
|
|
9
|
+
"executableVersion": "codex-cli 0.163.0-alpha.11",
|
|
10
|
+
"binarySha256": "8a6dc3938a2f5d30cc19c50b9ccad83a5aa2ca4a2e3411665430bb78a917220a",
|
|
11
11
|
"modelIds": [
|
|
12
12
|
"gpt-5.6-sol"
|
|
13
13
|
],
|
|
14
|
-
"decisionId": "
|
|
14
|
+
"decisionId": "16d7057c-b613-45c0-92e0-05262af96d89",
|
|
15
15
|
"acceptedResidualRisks": [
|
|
16
16
|
"vendor_native_policy_enforcement",
|
|
17
17
|
"managed_policy_not_directly_observed_per_job",
|
|
@@ -25,13 +25,13 @@ export const REVIEWED_MANUAL_CODEX_RELEASE = {
|
|
|
25
25
|
"credentialBackend": "auto",
|
|
26
26
|
"mdmVerification": "manual_prelaunch",
|
|
27
27
|
"fixtureEvidence": {
|
|
28
|
-
"binary_release": "
|
|
29
|
-
"official_permissions": "
|
|
28
|
+
"binary_release": "e392e2e1a577a5fb91f8cbb508ec3ebf287073a3c92389586531d81d4751b14f",
|
|
29
|
+
"official_permissions": "3c12b20dda72cc638a4109b2f25f5066f64e302a4b465e941a3188f8f51d21c1",
|
|
30
30
|
"managed_scope_exclusion": "3bb8b2ad50a44cdea5a2a3f388f8009b51d8c60d46230fb3d0b7fed0b9f7452d",
|
|
31
|
-
"required_mcp_startup": "
|
|
32
|
-
"source_exclusion": "
|
|
31
|
+
"required_mcp_startup": "94f51ddb832948eaeeb51040b4d5eace56f245328c356d3b9042e09080b4173c",
|
|
32
|
+
"source_exclusion": "36f4e02fee13fe4c1535f26b539cb2f15218e257ebc857c79c6b9e5676218c2b",
|
|
33
33
|
"auth_backend_compatibility": "7c42b882a52698fef3e14b4b956ede91ed1e3b29511fbff3176387063b8d74f0"
|
|
34
34
|
},
|
|
35
|
-
"fixturesFingerprint": "
|
|
35
|
+
"fixturesFingerprint": "b0f0778c69ffade85ad0694ae39018312dfd93a7c2c1ebfd948d2d15e6d57e2d",
|
|
36
36
|
"commands": []
|
|
37
37
|
};
|