mtech-ai-local-runner 0.1.4 → 0.1.6

package/README.md

@@ -10,6 +10,21 @@ The package stores safe runner configuration locally and keeps OAuth refresh cre
 
 Public npm installation requires no npm account or publishing OTP. Setup requires Gateway OAuth login, and local Claude Code must already be authenticated (`claude auth status`).
 
+## 0.1.6
+
+- Require a final JSON report with actual findings, nonempty evidence and no pending work before reporting completion. Incomplete or missing reports fail without a successful investigation artifact.
+- Explicitly restrict available built-in tools and ignore child messages as executor completion evidence.
+- Preserve employee-local duration/count policy and Gateway model selection. Structured assertions remain client-reported and require separate semantic review.
+
+## 0.1.5
+
+- Authenticate local MCP relay callers with a random per-job bearer capability.
+- Forward only the job-selected Gateway tools; filter tool discovery and reject other MCP methods, batches, browser origins and foreign Host headers.
+- Revoke capabilities and remove private MCP configs when jobs settle or the runtime closes normally.
+- Update uuid to patched version 11.1.1.
+
+The relay binds only to loopback. Local capabilities are stored in private mode-0600 config files, never URLs or command arguments. Gateway OAuth tokens stay in the runner. Abrupt process termination may leave a private config file; its capability is inert after the relay dies and is never reused by a new process. These controls do not sandbox malicious programs already running as the same macOS user.
+
 ## 0.1.4
 
 - Independently verify the approved contract payload and task-package fingerprints before creating a runtime binding.
@@ -20,6 +35,6 @@ Public npm installation requires no npm account or publishing OTP. Setup require
 Existing employees can upgrade their installed daemon with:
 
 ```bash
-npx mtech-ai-local-runner@0.1.4 setup
-npx mtech-ai-local-runner@0.1.4 doctor
+npx mtech-ai-local-runner@0.1.6 setup
+npx mtech-ai-local-runner@0.1.6 doctor
 ```

package/dist/src/adapters/claude-code/adapter.js

@@ -3,6 +3,7 @@ import { existsSync } from "node:fs";
 import { isTerminalEventType } from "../../protocol.js";
 import { parseClaudeLine } from "./stream-parser.js";
 import { compilePrompt } from "./prompt-compiler.js";
+import { completionEvent } from "./completion-report.js";
 import { buildHookPolicy, encodeHookPolicy } from "../../safety/hook-policy-builder.js";
 import { HOOK_POLICY_ENV_VAR } from "../../safety/hook-cli.js";
 const ALLOWED_ENV_KEYS = ["PATH", "HOME", "USER", "LOGNAME", "LANG", "LC_ALL", "TMPDIR", "NODE_ENV"];
@@ -108,6 +109,7 @@ export class ClaudeCodeAdapter {
             "--settings", JSON.stringify(settings),
             "--setting-sources", "user",
             "--disable-slash-commands",
+            "--tools", builtinToolSurface.join(","),
             "--allowedTools", toolSurface.join(","),
         ];
         if (ctx.resumeSessionId) {
@@ -136,9 +138,25 @@ export class ClaudeCodeAdapter {
         });
         let sawTerminal = false;
         for await (const line of handle.stdout) {
-            const parsed = parseClaudeLine(line, this.options.worktreeRoot);
+            let message;
+            try {
+                const value = JSON.parse(line);
+                if (!value || typeof value !== "object" || Array.isArray(value))
+                    continue;
+                message = value;
+            }
+            catch {
+                continue;
+            }
+            // A nested agent message is not evidence that the executor has finished.
+            if (message.parent_tool_use_id != null)
+                continue;
+            let parsed = parseClaudeLine(line, this.options.worktreeRoot);
             if (!parsed)
                 continue;
+            if (parsed.eventType === "completed") {
+                parsed = completionEvent(message.result, parsed.payload?.cost_usd);
+            }
             if (isTerminalEventType(parsed.eventType))
                 sawTerminal = true;
             yield parsed;

package/dist/src/adapters/claude-code/completion-report.js

@@ -0,0 +1,52 @@
+import { MAX_EVENT_SUMMARY_CHARS } from "../../protocol.js";
+const MAX_EVIDENCE_ITEMS = 20;
+const MAX_EVIDENCE_CHARS = 500;
+const MAX_REPORT_ENVELOPE_CHARS = 16_000;
+export const COMPLETION_REPORT_NOTICE = "Do the assigned work yourself using the available tools; do not delegate or start background work. " +
+    "Do not report completed while waiting for results, tests, or another agent. " +
+    "Your final response must be one JSON object, without Markdown fences: " +
+    '{"status":"completed","report":"actual findings and results","evidence":["file path and observed finding, or command and actual result"],"pending_work":[]}. ' +
+    `The report must be nonempty and at most ${MAX_EVENT_SUMMARY_CHARS} characters. ` +
+    `Include 1-${MAX_EVIDENCE_ITEMS} nonempty evidence strings, each at most ${MAX_EVIDENCE_CHARS} characters. ` +
+    "Address the assigned objective and each applicable acceptance criterion with observed evidence, not a plan or promise. " +
+    "Only attest to executor work you observed; Gateway records transport, completion, and review receipts separately. " +
+    'If the task is unfinished, use "status":"blocked" and list the remaining work in "pending_work". ' +
+    "An incomplete or missing report is a failed execution, never a successful investigation artifact.";
+function boundedText(value, max) {
+    return typeof value === "string" && value.trim().length > 0 && value.length <= max;
+}
+/** Validate the full final result before truncation; never publish malformed/interim output. */
+export function completionEvent(result, costUsd) {
+    const usage = typeof costUsd === "number" && Number.isFinite(costUsd) && costUsd >= 0
+        ? { cost_usd: costUsd }
+        : {};
+    const failed = {
+        eventType: "failed",
+        summary: "completion report is missing, incomplete or invalid",
+        payload: usage,
+    };
+    if (typeof result !== "string" || result.length > MAX_REPORT_ENVELOPE_CHARS)
+        return failed;
+    let report;
+    try {
+        report = JSON.parse(result);
+    }
+    catch {
+        return failed;
+    }
+    if (!report || typeof report !== "object" || Array.isArray(report))
+        return failed;
+    const value = report;
+    if (Object.keys(value).some((key) => !["status", "report", "evidence", "pending_work"].includes(key))
+        || value.status !== "completed"
+        || !boundedText(value.report, MAX_EVENT_SUMMARY_CHARS)
+        || !Array.isArray(value.pending_work) || value.pending_work.length !== 0
+        || !Array.isArray(value.evidence) || value.evidence.length < 1 || value.evidence.length > MAX_EVIDENCE_ITEMS
+        || !value.evidence.every((item) => boundedText(item, MAX_EVIDENCE_CHARS)))
+        return failed;
+    return {
+        eventType: "completed",
+        summary: value.report.trim(),
+        payload: { ...usage, investigation_summary: value.report.trim(), completion_evidence: value.evidence },
+    };
+}

package/dist/src/adapters/claude-code/prompt-compiler.js

@@ -1,3 +1,4 @@
+import { COMPLETION_REPORT_NOTICE } from "./completion-report.js";
 const STOP_BEFORE_PUBLICATION_RULE = "Stop before publication. Never run git commit, git push, create a pull request, merge, " +
     "deploy, access production, send an external message, or write data outside this worktree.";
 const EVENT_SCHEMA_NOTICE = "Report progress only through the normalized event lifecycle (started, progress, file_changed, question, " +
@@ -53,6 +54,7 @@ export function compilePrompt(taskPackage, options) {
         `## Prohibited actions\n${prohibitedActions.map((item) => `- ${item}`).join("\n")}`,
         `## Stop-before-publication rule\n${STOP_BEFORE_PUBLICATION_RULE}`,
         `## Event and checkpoint obligations\n${EVENT_SCHEMA_NOTICE}`,
+        `## Final completion report\n${COMPLETION_REPORT_NOTICE}`,
     ];
     return sections.join("\n\n");
 }

package/dist/src/auth/mcp-relay-config.js

@@ -0,0 +1,47 @@
+import { mkdirSync, writeFileSync, chmodSync, unlinkSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { join } from "node:path";
+/** Private local capabilities only. Gateway OAuth credentials never enter this file. */
+export class McpRelayConfig {
+    stateRoot;
+    relay;
+    url;
+    path = null;
+    constructor(stateRoot, relay, url) {
+        this.stateRoot = stateRoot;
+        this.relay = relay;
+        this.url = url;
+    }
+    write(config) {
+        this.clear();
+        const directory = join(this.stateRoot, "mcp-config");
+        mkdirSync(directory, { recursive: true, mode: 0o700 });
+        chmodSync(directory, 0o700);
+        const path = join(directory, `mcp-${randomUUID()}.json`);
+        const mcpServers = config.tools.allow.length ? {
+            ai_gateway: { type: "http", url: this.url, headers: this.relay.authorizeTools(config.tools.allow) },
+        } : {};
+        try {
+            writeFileSync(path, JSON.stringify({ mcpServers }), { mode: 0o600, flag: "wx" });
+            this.path = path;
+            return path;
+        }
+        catch (error) {
+            this.relay.revokeAuthorization();
+            throw error;
+        }
+    }
+    clear() {
+        this.relay.revokeAuthorization();
+        if (this.path) {
+            try {
+                unlinkSync(this.path);
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    throw error;
+            }
+            this.path = null;
+        }
+    }
+}

package/dist/src/auth/mcp-relay.js

@@ -1,9 +1,16 @@
 import { createServer } from "node:http";
+import { randomBytes, timingSafeEqual } from "node:crypto";
 const MAX_BODY_SIZE = 1024 * 1024; // 1 MiB
 export class McpRelay {
     opts;
     server = null;
     url = null;
+    authorization = null;
+    authorizeTools(tools) {
+        this.authorization = { secret: randomBytes(32).toString("hex"), tools: new Set(tools) };
+        return { Authorization: `Bearer ${this.authorization.secret}` };
+    }
+    revokeAuthorization() { this.authorization = null; }
     constructor(opts) {
         this.opts = opts;
         // Validate upstreamMcpUrl is HTTPS and a valid URL
@@ -27,8 +34,21 @@ export class McpRelay {
                         res.end("Not found");
                         return;
                     }
+                    if (req.headers.origin !== undefined || req.headers.host !== new URL(this.url).host) {
+                        res.writeHead(403);
+                        res.end("Forbidden");
+                        return;
+                    }
+                    const authorization = this.authorization;
+                    const supplied = Buffer.from(req.headers.authorization ?? "");
+                    const expected = Buffer.from(authorization ? `Bearer ${authorization.secret}` : "");
+                    if (!authorization || supplied.length !== expected.length || !timingSafeEqual(supplied, expected)) {
+                        res.writeHead(401);
+                        res.end("Unauthorized");
+                        return;
+                    }
                     // Collect body with size limit
-                    let body = "";
+                    const chunks = [];
                     let size = 0;
                     let tooLarge = false;
                     let aborted = false;
@@ -43,7 +63,7 @@ export class McpRelay {
                             req.destroy();
                             return;
                         }
-                        body += chunk.toString();
+                        chunks.push(chunk);
                     });
                     req.on("end", async () => {
                         if (tooLarge || aborted)
@@ -52,18 +72,33 @@ export class McpRelay {
                             // Validate JSON
                             let payload;
                             try {
-                                payload = JSON.parse(body);
+                                payload = JSON.parse(Buffer.concat(chunks).toString("utf8"));
                             }
                             catch {
                                 res.writeHead(400, { "content-type": "application/json" });
                                 res.end(JSON.stringify({ error: "Invalid JSON" }));
                                 return;
                             }
+                            if (!this.allowedRequest(payload, authorization.tools)) {
+                                res.writeHead(403);
+                                res.end("Forbidden MCP request");
+                                return;
+                            }
                             // Check one more time that we can respond (guard against race)
                             if (tooLarge || aborted)
                                 return;
+                            if (this.authorization !== authorization) {
+                                res.writeHead(401);
+                                res.end("Authorization revoked");
+                                return;
+                            }
                             // Get current token
                             const token = await this.opts.tokenProvider.getToken();
+                            if (this.authorization !== authorization) {
+                                res.writeHead(401);
+                                res.end("Authorization revoked");
+                                return;
+                            }
                             // Forward to upstream with token injection
                             // Ensure exact URL match to prevent redirection to unintended endpoints
                             const upstreamUrl = new URL(this.opts.upstreamMcpUrl);
@@ -72,12 +107,20 @@ export class McpRelay {
                                 headers: {
                                     Authorization: `Bearer ${token}`,
                                     "content-type": "application/json",
+                                    Accept: "application/json",
                                 },
-                                body,
+                                body: JSON.stringify(payload),
                                 redirect: "error",
                             });
                             // Read upstream response
-                            const upstreamText = await upstreamResponse.text();
+                            let upstreamText = await upstreamResponse.text();
+                            if (payload.method === "tools/list" && upstreamResponse.ok) {
+                                const listed = JSON.parse(upstreamText);
+                                if (!Array.isArray(listed.result?.tools))
+                                    throw new Error("Invalid upstream tool list");
+                                listed.result.tools = listed.result.tools.filter((tool) => typeof tool?.name === "string" && authorization.tools.has(tool.name));
+                                upstreamText = JSON.stringify(listed);
+                            }
                             // Redact tokens from upstream errors
                             const redactedText = this.redactSecrets(upstreamText);
                             // Forward response to client
@@ -117,6 +160,7 @@ export class McpRelay {
         });
     }
     async close() {
+        this.revokeAuthorization();
         return new Promise((resolve, reject) => {
             if (!this.server) {
                 resolve();
@@ -130,9 +174,26 @@ export class McpRelay {
             });
         });
     }
+    allowedRequest(value, tools) {
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            return false;
+        const rpc = value;
+        if (rpc.jsonrpc !== "2.0" || typeof rpc.method !== "string")
+            return false;
+        if (rpc.method === "notifications/initialized")
+            return rpc.id === undefined;
+        if (!(typeof rpc.id === "string" || typeof rpc.id === "number"))
+            return false;
+        if (["initialize", "ping", "tools/list"].includes(rpc.method))
+            return true;
+        if (rpc.method !== "tools/call" || !rpc.params || typeof rpc.params !== "object" || Array.isArray(rpc.params))
+            return false;
+        const name = rpc.params.name;
+        return typeof name === "string" && tools.has(name);
+    }
     redactSecrets(text) {
         let sanitized = text;
-        for (const secret of this.opts.tokenProvider.secrets()) {
+        for (const secret of [...this.opts.tokenProvider.secrets(), this.authorization?.secret ?? ""].filter(Boolean)) {
             sanitized = sanitized.split(secret).join("[redacted]");
         }
         return sanitized;

package/dist/src/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { mkdirSync, writeFileSync, chmodSync, unlinkSync, realpathSync } from "node:fs";
+import { unlinkSync, realpathSync } from "node:fs";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { loadConfig, redact, isAuthConfig, isExecutionConfig, isServiceConfig } from "./config.js";
@@ -16,6 +16,7 @@ import { OAuthClient } from "./auth/oauth-client.js";
 import { LoopbackLogin } from "./auth/loopback-login.js";
 import { OAuthTokenProvider, LoginRequiredError } from "./auth/token-provider.js";
 import { McpRelay } from "./auth/mcp-relay.js";
+import { McpRelayConfig } from "./auth/mcp-relay-config.js";
 import { createBrowserOpener } from "./auth/browser-opener.js";
 import { FileLocalConfigStore } from "./registration/local-config.js";
 import { LaunchdService } from "./platform/macos/launchd.js";
@@ -51,26 +52,6 @@ function buildCheckoutPreflight() {
         },
     };
 }
-function buildMcpConfigWriter(stateRoot, relayUrl) {
-    return (config) => {
-        const dir = join(stateRoot, "mcp-config");
-        mkdirSync(dir, { recursive: true, mode: 0o700 });
-        const filePath = join(dir, `mcp-${process.pid}-${Date.now()}.json`);
-        // Write token-free config pointing to relay; relay injects auth
-        const mcpServers = config.tools.allow.length === 0
-            ? {}
-            : {
-                ai_gateway: {
-                    type: "http",
-                    url: relayUrl,
-                },
-            };
-        const contents = JSON.stringify({ mcpServers });
-        writeFileSync(filePath, contents, { mode: 0o600 });
-        chmodSync(filePath, 0o600);
-        return filePath;
-    };
-}
 async function buildOnceAdapter(config, env, tokenProvider, fetchFn) {
     const relay = new McpRelay({
         tokenProvider,
@@ -78,14 +59,7 @@ async function buildOnceAdapter(config, env, tokenProvider, fetchFn) {
         upstreamFetch: fetchFn,
     });
     const relayServer = await relay.start();
-    let configPath = null;
-    const configWriter = buildMcpConfigWriter(config.stateRoot, relayServer.url);
-    const originalWriteConfig = configWriter;
-    const wrappingConfigWriter = (cfg) => {
-        const path = originalWriteConfig(cfg);
-        configPath = path;
-        return path;
-    };
+    const configs = new McpRelayConfig(config.stateRoot, relay, relayServer.url);
     let adapter;
     try {
         adapter = new ClaudeCodeAdapter({
@@ -95,7 +69,7 @@ async function buildOnceAdapter(config, env, tokenProvider, fetchFn) {
             workItemLabel: config.workLoopId,
             env,
             registeredReadTools: config.registeredReadTools,
-            writeMcpConfig: wrappingConfigWriter,
+            writeMcpConfig: (cfg) => configs.write(cfg),
             mcpServerName: "ai_gateway",
             binaryPath: config.claudeBinaryPath,
             hookExecutablePath: config.hookExecutablePath,
@@ -112,7 +86,12 @@ async function buildOnceAdapter(config, env, tokenProvider, fetchFn) {
         throw err;
     }
     // Cleanup function: always attempts both config unlink and relay close
-    const cleanup = async () => cleanupOnceResources(configPath, () => relay.close());
+    const cleanup = async () => cleanupOnceResources(null, async () => { try {
+        configs.clear();
+    }
+    finally {
+        await relay.close();
+    } });
     return { adapter, cleanup };
 }
 async function handleLogin(config, stdout, stderr, fetchFn = fetch, opener) {
@@ -203,7 +182,7 @@ export async function main(argv, env, io = {}) {
                 const authenticated = await runFile(binary, ["auth", "status"], { encoding: "utf8" }).then(() => true).catch(() => false);
                 const registered = await gateway.registerLocalRunner({
                     deviceFingerprint: createHash("sha256").update(`${process.getuid?.() ?? 0}|${runnerDisplayName()}|${config.gatewayMcpUrl}`).digest("hex"),
-                    displayName: runnerDisplayName(), packageVersion: "0.1.4",
+                    displayName: runnerDisplayName(), packageVersion: "0.1.6",
                     capabilities: [{ adapter: "claude_code_cli", version: "1", capabilities: ["repository_read", "repository_edit", "shell_test", "git_diff"], authenticated }],
                 });
                 await localStore.save({ schemaVersion: 1, gatewayMcpUrl: config.gatewayMcpUrl, runnerId: registered.runner.id, workspaceRoot: config.workspaceRoot, concurrency: 1 });

package/dist/src/daemon/runtime.js

@@ -3,7 +3,6 @@ import { promisify } from "node:util";
 import { hostname } from "node:os";
 import { createHash } from "node:crypto";
 import { join } from "node:path";
-import { mkdirSync, writeFileSync, chmodSync } from "node:fs";
 import { McpGatewayClient } from "../gateway-client.js";
 import { AdapterRegistry } from "../adapters/registry.js";
 import { ClaudeCodePlugin } from "../adapters/claude-code/adapter.js";
@@ -17,10 +16,12 @@ import { ProcessLock } from "./process-lock.js";
 import { Daemon } from "./daemon.js";
 import { buildTerminalEvidenceCollector } from "../safety/terminal-evidence.js";
 import { McpRelay } from "../auth/mcp-relay.js";
+import { McpRelayConfig } from "../auth/mcp-relay-config.js";
 const execFileAsync = promisify(execFile);
 export async function buildDaemon(input) {
     const relay = new McpRelay({ tokenProvider: input.tokenProvider, upstreamMcpUrl: input.gatewayMcpUrl, upstreamFetch: input.fetchFn });
     const relayServer = await relay.start();
+    const configs = new McpRelayConfig(input.stateRoot, relay, relayServer.url);
     const gateway = new McpGatewayClient({ mcpUrl: input.gatewayMcpUrl, tokenProvider: input.tokenProvider, runnerId: input.runnerId, fetchFn: input.fetchFn });
     const hookPath = new URL("../safety/hook-cli.js", import.meta.url).pathname;
     const plugin = new ClaudeCodePlugin({
@@ -39,14 +40,7 @@ export async function buildDaemon(input) {
             workItemLabel: jobId, env: input.env, registeredReadTools: [], hookExecutablePath: hookPath,
             binaryPath: input.env.AI_GATEWAY_LOCAL_RUNNER_CLAUDE_BINARY,
             mcpServerName: "ai_gateway",
-            writeMcpConfig: (config) => {
-                const root = join(input.stateRoot, "mcp-config");
-                mkdirSync(root, { recursive: true, mode: 0o700 });
-                const path = join(root, `daemon-${process.pid}-${Date.now()}.json`);
-                writeFileSync(path, JSON.stringify({ mcpServers: config.tools.allow.length ? { ai_gateway: { type: "http", url: relayServer.url } } : {} }), { mode: 0o600 });
-                chmodSync(path, 0o600);
-                return path;
-            },
+            writeMcpConfig: (config) => configs.write(config),
         }),
     });
     const registry = new AdapterRegistry([plugin]);
@@ -78,7 +72,7 @@ export async function buildDaemon(input) {
     const poller = new JobPoller({
         heartbeat: () => gateway.heartbeatLocalRunner({
             deviceFingerprint: createHash("sha256").update(`${process.getuid?.() ?? 0}|${runnerDisplayName()}|${input.gatewayMcpUrl}`).digest("hex"),
-            displayName: runnerDisplayName(), packageVersion: "0.1.4",
+            displayName: runnerDisplayName(), packageVersion: "0.1.6",
             capabilities: probes.map((probe) => ({ adapter: probe.id, version: probe.version,
                 capabilities: probe.capabilities, authenticated: probe.available && probe.authenticated })),
         }).then(() => undefined),
@@ -95,7 +89,14 @@ export async function buildDaemon(input) {
             await state.save({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken, phase: "claimed" });
             return { status: "claimed", job };
         },
-        execute: (job) => coordinator.execute(job),
+        execute: async (job) => {
+            try {
+                await coordinator.execute(job);
+            }
+            finally {
+                configs.clear();
+            }
+        },
         delay: (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)),
     });
     const daemon = new Daemon({
@@ -122,6 +123,11 @@ export async function buildDaemon(input) {
         },
         poller,
     });
-    return { daemon, close: () => relay.close() };
+    return { daemon, close: async () => { try {
+            configs.clear();
+        }
+        finally {
+            await relay.close();
+        } } };
 }
 export function runnerDisplayName() { return `${hostname()} local AI`; }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "private": false,
   "license": "UNLICENSED",
   "bin": {
@@ -29,7 +29,7 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "uuid": "11.1.0"
+    "uuid": "11.1.1"
   },
   "devDependencies": {
     "@types/node": "22.19.11",