mtech-ai-local-runner 0.1.41 → 0.1.43

package/README.md

@@ -1,3 +1,25 @@
+## 0.1.43: give whole-checkout snapshots whole-checkout bounds
+
+The P1 verifier snapshots the whole model checkout before it runs the reviewed commands. It passed the candidate limits
+(`max_file_bytes` and `max_diff_bytes`, 16 KiB in the pilot contract) as the snapshot's own per-file and whole-tree
+bounds, so any real project failed with `SNAPSHOT_REJECTED`: the AI Gateway checkout has 3,781 files, 48.5 MB and 588
+files above 16 KiB. The snapshot now takes the same 128 MiB whole-tree memory bound as the publication hosts. The
+candidate limits still apply to the changed files: their count, the diff size and, newly explicit, each changed file's
+before and after size. Local Fix had the same defect, and Local Fix → PR could not publish on the AI Gateway repository because
+an unchanged 1.09 MB file exceeds the 1 MiB `max_file_bytes` cap. Its production and server-CI snapshots and its Git
+publication transport now use the same shared `SNAPSHOT_TREE_MAX_BYTES`. Changed files are still bounded by
+`max_file_bytes`.
+
+## 0.1.42: keep the guardian's reports when a late terminate fails
+
+The owned guardian now reports to the host on its own pipe (fd3) and takes the host's commands on another (fd5);
+fd4 stays parent liveness, and none of them reaches the executor. Before, one control socket carried both. When
+Codex exited by itself and the guardian confirmed and exited while the daemon was busy, the daemon's late terminate
+write failed on that socket, Node destroyed it, and the unread `root_exit` and `cleaned` reports were lost. 0.1.41
+recovered the cleanup confirmation from the exit code, but the lost root exit outcome still failed the P1 publication
+freeze with `OWNED_PROCESS_EXIT_UNCONFIRMED`. A failed command write now leaves the report pipe intact, so the host reads
+every report to its end. Cleanup is again confirmed only by `cleaned`; the exit-code fallback is removed.
+
 ## 0.1.41: confirm a cleanup the guardian finished before a late terminate
 
 When Codex exits by itself, the owned guardian confirms the cleanup and exits. A busy daemon could then write its

package/dist/src/process/owned-process-guardian.js

@@ -1,15 +1,18 @@
 import { spawn } from 'node:child_process';
 // Trusted, packaged JavaScript, deliberately independent of TypeScript loaders.
-// Only this helper creates and signals the new executor group. fd3 is private
-// control, fd4 parent liveness; neither is passed to the executor.
+// Only this helper creates and signals the new executor group. fd3 carries its
+// private reports to the host, fd4 parent liveness and fd5 the host's commands;
+// none is passed to the executor. Commands have their own pipe: a host write
+// that fails after the guardian exited cannot discard reports not yet read.
 const GUARDIAN_SOURCE = String.raw `
 const {spawn}=require('node:child_process');
 const {Socket}=require('node:net');
-const control=new Socket({fd:3,readable:true,writable:true});
-control.setEncoding('utf8');
+const reports=new Socket({fd:3,readable:false,writable:true});
 const liveness=new Socket({fd:4,readable:true,writable:false});
+const commands=new Socket({fd:5,readable:true,writable:false});
+commands.setEncoding('utf8');
 let child, ownedPid, ownedGone=false, cleaning, ready=Promise.resolve(), rootExited=false, closed=false, input='', configured=false, orphaned=false;
-const send=value=>{if(!control.destroyed)control.write(JSON.stringify(value)+'\n');};
+const send=value=>{if(!reports.destroyed)reports.write(JSON.stringify(value)+'\n');};
 const delay=ms=>new Promise(resolve=>setTimeout(resolve,ms));
 const alive=()=>{if(!ownedPid||ownedGone)return false;try{process.kill(-ownedPid,0);return true;}catch(e){if(e.code==='ESRCH'){ownedGone=true;return false;}if(e.code==='EPERM')return true;throw Error('cleanup');}};
 const signal=s=>{if(!ownedPid)throw Error('ownership');if(ownedGone)return 'esrch';try{process.kill(-ownedPid,s);return 'sent';}catch(e){if(e.code==='ESRCH'){ownedGone=true;return 'esrch';}if(e.code==='EPERM'){if(!rootExited)child.kill(s);return 'eperm';}throw Error('cleanup');}};
@@ -39,11 +42,11 @@ function cleanup(immediate=false,trigger='terminate'){
  })();
  return cleaning;
 }
-function finish(code){process.exitCode=code;process.stdin.destroy();liveness.destroy();control.end(()=>control.destroy());process.stdout.end();process.stderr.end();}
+function finish(code){process.exitCode=code;process.stdin.destroy();liveness.destroy();commands.destroy();reports.end(()=>reports.destroy());process.stdout.end();process.stderr.end();}
 function lost(){orphaned=true;if(configured)void cleanup(false,'lost');else finish(1);}
 liveness.on('data',()=>{});liveness.once('end',lost);liveness.once('error',lost);
-control.on('error',lost);control.on('end',lost);
-control.on('data',chunk=>{
+reports.on('error',lost);commands.on('error',lost);commands.on('end',lost);
+commands.on('data',chunk=>{
  input+=chunk.toString('utf8');if(input.length>2000000){lost();return;}
  let end;while((end=input.indexOf('\n'))>=0){
   let message;try{message=JSON.parse(input.slice(0,end));}catch{lost();return;}input=input.slice(end+1);
@@ -68,29 +71,31 @@ process.stderr.on('error',()=>{child?.stderr.resume();void cleanup(true,'output_
 `;
 export function spawnOwnedGuardian(command, args, options) {
     const child = spawn(process.execPath, ['--input-type=commonjs', '-e', GUARDIAN_SOURCE], {
-        cwd: options.cwd, env: {}, shell: false, detached: true, stdio: ['pipe', 'pipe', 'pipe', 'pipe', 'pipe'],
+        cwd: options.cwd, env: {}, shell: false, detached: true, stdio: ['pipe', 'pipe', 'pipe', 'pipe', 'pipe', 'pipe'],
     });
-    const control = child.stdio[3], liveness = child.stdio[4];
-    control.setEncoding('utf8');
+    // Node types only the first five stdio entries; fd5 is the sixth 'pipe' above.
+    const stdio = child.stdio;
+    const reports = stdio[3], liveness = stdio[4], commands = stdio[5];
+    reports.setEncoding('utf8');
     liveness.resume();
     let resolveStarted, rejectStarted;
     const started = new Promise((resolve, reject) => { resolveStarted = resolve; rejectStarted = reject; });
     // Hosts can attach observers after spawn returns without unhandled rejection.
     void started.catch(() => { });
     let confirmed = false, spawnFailed = false, protocolFailed = false, buffer = '';
-    let terminateWritten = false, hostTimeout = false, controlFailed = false, detail;
+    let terminateWritten = false, hostTimeout = false, commandFailed = false, detail;
     let outcome;
     let closePromise;
     const closed = new Promise(resolve => child.once('close', () => { liveness.destroy(); resolve(); }));
-    // A guardian that has confirmed and exited closes its control socket; a terminate written late by a
-    // busy host then fails, possibly before "cleaned" is read. That write error alone is not a protocol
-    // failure: the guardian exits 0 only after it sent "cleaned" (or after a spawn failure owned nothing).
-    control.on('error', () => { if (!confirmed && !spawnFailed)
-        controlFailed = true; });
+    // A guardian that has exited no longer reads commands, so a terminate written late by a busy host
+    // fails. That failure stays on the command pipe: the host still reads every report to its end.
+    commands.on('error', () => { if (!confirmed && !spawnFailed)
+        commandFailed = true; });
+    reports.on('error', () => { if (!confirmed && !spawnFailed)
+        protocolFailed = true; });
     liveness.on('error', () => { if (!confirmed && !spawnFailed)
         protocolFailed = true; });
-    const cleanedByExit = () => controlFailed && !protocolFailed && child.exitCode === 0 && child.signalCode === null;
-    control.on('data', (chunk) => {
+    reports.on('data', (chunk) => {
         buffer += chunk;
         if (buffer.length > 8192) {
             protocolFailed = true;
@@ -132,10 +137,10 @@ export function spawnOwnedGuardian(command, args, options) {
     });
     child.once('error', () => { spawnFailed = true; rejectStarted(new Error('Provider process could not start')); });
     child.once('close', () => { rejectStarted(new Error('Provider process could not start')); });
-    control.write(JSON.stringify({ type: 'launch', command, args, ...options }) + '\n');
+    commands.write(JSON.stringify({ type: 'launch', command, args, ...options }) + '\n');
     return { child, started, closed, outcome: () => outcome, spawnFailed: () => spawnFailed,
-        signal(immediate) { if (child.exitCode === null && child.signalCode === null && !confirmed && !spawnFailed && !control.destroyed) {
-            control.write(JSON.stringify({ type: 'terminate', immediate }) + '\n');
+        signal(immediate) { if (child.exitCode === null && child.signalCode === null && !confirmed && !spawnFailed && !commands.destroyed) {
+            commands.write(JSON.stringify({ type: 'terminate', immediate }) + '\n');
             terminateWritten = true;
         } },
         terminate(immediate = false) {
@@ -144,7 +149,7 @@ export function spawnOwnedGuardian(command, args, options) {
             this.signal(immediate);
             closePromise = new Promise((resolve, reject) => {
                 const timer = setTimeout(() => { protocolFailed = true; hostTimeout = true; liveness.destroy(); reject(new Error('Provider process group cleanup could not be confirmed')); }, 5500);
-                void closed.then(() => { clearTimeout(timer); if (protocolFailed || !(confirmed || cleanedByExit()))
+                void closed.then(() => { clearTimeout(timer); if (protocolFailed || !confirmed)
                     reject(new Error('Provider process group cleanup could not be confirmed'));
                 else
                     resolve(); });
@@ -153,14 +158,14 @@ export function spawnOwnedGuardian(command, args, options) {
         },
         /** Fixed cleanup observations after an unconfirmed cleanup; empty once cleanup is confirmed. */
         cleanupObservations() {
-            if ((confirmed || cleanedByExit()) && !protocolFailed)
+            if (confirmed && !protocolFailed)
                 return [];
-            if (!protocolFailed && !hostTimeout && !controlFailed)
+            if (!protocolFailed && !hostTimeout && !commandFailed)
                 return [];
             const observed = [terminateWritten ? 'cleanup_guardian_terminate_written' : 'cleanup_guardian_terminate_not_written'];
             if (hostTimeout)
                 observed.push('cleanup_guardian_host_timeout');
-            if (controlFailed)
+            if (commandFailed)
                 observed.push('cleanup_guardian_control_failed');
             if (!detail) {
                 if (!hostTimeout && protocolFailed)

package/dist/src/publication/git-snapshot.js

@@ -12,6 +12,9 @@ const execute = promisify(execFile), denied = () => Error('SNAPSHOT_REJECTED');
 const digest = (data) => createHash('sha256').update(data).digest('hex');
 const safe = (p) => p.length > 0 && !path.isAbsolute(p) && !p.includes('\\') && !p.includes('\0') && p.split('/').every(s => s !== '' && s !== '.' && s !== '..' && !/^(?:\.git|\.ssh|\.aws|\.codex|\.claude|\.env|\.netrc|\.npmrc|credentials(?:\..*)?)$/i.test(s));
 /** P1 branch shape only. Authority still requires exact frozen-fence equality. */
+/** Whole-checkout memory bound for a snapshot, per file and in total. A snapshot reads every
+ * file of the checkout, so callers bound candidate size on the changed files instead. */
+export const SNAPSHOT_TREE_MAX_BYTES = 128 * 1024 * 1024;
 export const isP1WorkingBranch = (branch) => typeof branch === 'string' && branch.length <= 255 && /^ai-work\/[A-Za-z0-9][A-Za-z0-9._-]*\/[A-Za-z0-9][A-Za-z0-9._-]*$/.test(branch) && branch.split('/').every(p => !p.includes('..') && !p.endsWith('.') && !p.endsWith('.lock'));
 /** Reads only immutable Git objects and metadata. Never runs diff against worktree
  * content, where malicious clean filters can execute even with --no-ext-diff. */

package/dist/src/publication/production-host.js

@@ -4,7 +4,7 @@ import { lstat, realpath, open, rename, unlink } from 'node:fs/promises';
 import path from 'node:path';
 import { CandidateVerifier, protocolHash } from './candidate.js';
 import { createLocalFixExecutionHost } from './execution-host.js';
-import { GitSnapshotHost } from './git-snapshot.js';
+import { GitSnapshotHost, SNAPSHOT_TREE_MAX_BYTES } from './git-snapshot.js';
 import { createSealedIsolatedVerifier } from './isolated-verifier.js';
 import { FilePublicationJournal } from './journal.js';
 import { DeterministicPublisher, PublicationOutcomeUnknownError } from './publisher.js';
@@ -55,7 +55,7 @@ export function createProductionLocalFixHost(options) {
             } };
             const frozenCurrent = async () => lifecycle.isFrozen() && await current();
             const limits = scope.candidate_limits;
-            const snapshots = new GitSnapshotHost({ root: input.checkoutPath, privateRoot: root, git: options.git, baseCommitSha: binding.base_commit_sha, workingBranch: binding.working_branch, maxFileBytes: limits.max_file_bytes, maxTotalBytes: 128 * 1024 * 1024 });
+            const snapshots = new GitSnapshotHost({ root: input.checkoutPath, privateRoot: root, git: options.git, baseCommitSha: binding.base_commit_sha, workingBranch: binding.working_branch, maxFileBytes: SNAPSHOT_TREE_MAX_BYTES, maxTotalBytes: SNAPSHOT_TREE_MAX_BYTES });
             const isolated = createSealedIsolatedVerifier({ host: snapshots, allowedPaths: verificationPaths, blockedPaths: ['.env', '.env.*', '.git/**', '.ssh/**', '.aws/**'], commands, current: frozenCurrent });
             const verifier = new CandidateVerifier({ binding, root: input.checkoutPath, allowedPaths: allowed, blockedPaths: ['.env', '.env.*', '.git/**', '.ssh/**', '.aws/**'], maxFiles: limits.max_changed_files, maxDiffBytes: limits.max_diff_bytes, maxFileBytes: limits.max_file_bytes, commands, current: frozenCurrent, assertRetainedSeal: async () => { const seal = isolated.materialized(); if (!seal)
                     throw denied(); await seal.assertUnchanged(); }, observe: () => snapshots.observe(), verify: isolated.verify });
@@ -140,7 +140,7 @@ export function createProductionLocalFixHost(options) {
                     }
                     if (!await frozenCurrent())
                         throw denied();
-                    git = new GitPublicationTransport({ checkout, privateRoot: root, git: options.git, sealedTreeFingerprint: seal.treeFingerprint, evidence: candidate.evidence, origin: options.origin, current: frozenCurrent, broker: typeof options.broker === 'function' ? options.broker({ branch: binding.working_branch, current: frozenCurrent }) : options.broker, maxFileBytes: limits.max_file_bytes });
+                    git = new GitPublicationTransport({ checkout, privateRoot: root, git: options.git, sealedTreeFingerprint: seal.treeFingerprint, evidence: candidate.evidence, origin: options.origin, current: frozenCurrent, broker: typeof options.broker === 'function' ? options.broker({ branch: binding.working_branch, current: frozenCurrent }) : options.broker, maxFileBytes: SNAPSHOT_TREE_MAX_BYTES, maxTotalBytes: SNAPSHOT_TREE_MAX_BYTES });
                 }
                 return git;
             };

package/dist/src/publication/server-ci-host.js

@@ -8,7 +8,7 @@ import { setTimeout as delay } from 'node:timers/promises';
 import { MAX_EVENT_SUMMARY_CHARS } from '../protocol.js';
 import { protocolHash } from './candidate.js';
 import { FilePublicationJournal } from './journal.js';
-import { GitSnapshotHost } from './git-snapshot.js';
+import { GitSnapshotHost, SNAPSHOT_TREE_MAX_BYTES } from './git-snapshot.js';
 import { PublicationOutcomeUnknownError } from './publisher.js';
 const denied = () => Error('LOCAL_FIX_SERVER_CI_REJECTED');
 const safePath = (p) => typeof p === 'string' && p.length > 0 && !p.includes('\\') && !p.includes('\0') && !path.isAbsolute(p) && p.split('/').every(s => s !== '' && s !== '.' && s !== '..' && !/^(?:\.git|\.mcp(?:\..*)?|\.npmrc|\.netrc|id_rsa|id_ed25519|\.local-runner|\.runner|\.env(?:\..*)?|\.codex|\.claude|\.ssh|\.aws|\.config|auth\.(?:json|toml|ya?ml)(?:\..*)?|credentials(?:\..*)?|AGENTS\.md|CLAUDE\.md|mcp\.(?:json|toml|ya?ml)(?:\..*)?)$/i.test(s));
@@ -82,7 +82,7 @@ export function createServerCiLocalFixHost(options) {
                     return finalization ??= (async () => {
                         const report = mode === 'gateway_publish_v1' ? validationReport(completedEvent) : undefined;
                         await current();
-                        const host = new GitSnapshotHost({ root: input.checkoutPath, privateRoot: root, git: options.git, baseCommitSha: binding.base_commit_sha, workingBranch: binding.working_branch, maxFileBytes: limits.max_file_bytes, maxTotalBytes: 128 * 1024 * 1024 });
+                        const host = new GitSnapshotHost({ root: input.checkoutPath, privateRoot: root, git: options.git, baseCommitSha: binding.base_commit_sha, workingBranch: binding.working_branch, maxFileBytes: SNAPSHOT_TREE_MAX_BYTES, maxTotalBytes: SNAPSHOT_TREE_MAX_BYTES });
                         const observed = await host.observe();
                         seal = await host.materialize();
                         if (protocolHash(observed) !== protocolHash(seal.observation) || Buffer.byteLength(observed.diff) > limits.max_diff_bytes || !observed.changed_files.length || observed.changed_files.length > limits.max_changed_files)

package/dist/src/verification/runner-observed-verifier.js

@@ -2,12 +2,21 @@ import { createHash } from 'node:crypto';
 import { realpath } from 'node:fs/promises';
 import path from 'node:path';
 import { protocolHash, protocolJson } from '../publication/candidate.js';
-import { GitSnapshotHost, isP1WorkingBranch } from '../publication/git-snapshot.js';
+import { GitSnapshotHost, isP1WorkingBranch, SNAPSHOT_TREE_MAX_BYTES } from '../publication/git-snapshot.js';
 import { createIsolatedCommandPolicy } from '../publication/isolated-verifier.js';
 import { buildReviewedProjectRegistration } from '../publication/project-registration.js';
 const denied = () => Error('RUNNER_VERIFICATION_REJECTED');
 const hex = (v, n) => typeof v === 'string' && new RegExp(`^[a-f0-9]{${n}}$`).test(v);
 const same = (a, b) => protocolHash(a) === protocolHash(b);
+/** Byte length of each changed file's before and after content in the sealed binary diff.
+ * The snapshot itself takes the whole-checkout bound; candidate limits apply to these files. */
+function changedFileBytes(diff) {
+    const parsed = JSON.parse(diff);
+    if (parsed.format !== 'local-candidate-binary-diff-v1' || !Array.isArray(parsed.changes))
+        throw denied();
+    return parsed.changes.flatMap((change) => [change.before, change.after].filter(v => v !== null).map(v => { if (typeof v !== 'string')
+        throw denied(); return Buffer.from(v, 'base64').length; }));
+}
 const ceilings = { max_commands: 8, max_command_runtime_ms: 120000, max_output_bytes: 1048576, max_manifest_entries: 100, max_manifest_bytes: 32768, max_contract_bytes: 65536 };
 const privatePart = /^(?:\.git|\.mcp(?:\..*)?|\.env(?:\..*)?|\.ssh|\.aws|\.config|\.codex|\.claude|\.runner|\.local-runner|\.npmrc|\.netrc|id_rsa|id_ed25519|credentials(?:\..*)?|auth\.(?:json|toml|ya?ml)(?:\..*)?|mcp\.(?:json|toml|ya?ml)(?:\..*)?|AGENTS\.md|CLAUDE\.md|vendor|node_modules)$/i;
 const exactPath = (name) => typeof name === 'string' && /^[A-Za-z0-9_][A-Za-z0-9_.-]*(?:\/[A-Za-z0-9_.-]+)*$/.test(name) && name.split('/').every(p => p !== '.' && p !== '..' && !privatePart.test(p));
@@ -94,9 +103,9 @@ export class RunnerObservedVerifier {
             await this.active();
             if (!path.isAbsolute(o.root) || await realpath(o.root) !== o.root || !path.isAbsolute(o.privateRoot) || await realpath(o.privateRoot) !== o.privateRoot || o.privateRoot === o.root || o.privateRoot.startsWith(o.root + '/'))
                 throw denied();
-            host = o.host ?? new GitSnapshotHost({ root: o.root, privateRoot: o.privateRoot, git: o.registration.git, baseCommitSha: f.base_commit_sha, workingBranch: f.working_branch, p1WorkingBranch: f.working_branch, maxFileBytes: o.candidateLimits.max_file_bytes, maxTotalBytes: Math.max(o.candidateLimits.max_file_bytes, o.candidateLimits.max_diff_bytes) });
+            host = o.host ?? new GitSnapshotHost({ root: o.root, privateRoot: o.privateRoot, git: o.registration.git, baseCommitSha: f.base_commit_sha, workingBranch: f.working_branch, p1WorkingBranch: f.working_branch, maxFileBytes: SNAPSHOT_TREE_MAX_BYTES, maxTotalBytes: SNAPSHOT_TREE_MAX_BYTES });
             const sealed = await host.materialize(), observation = structuredClone(sealed.observation);
-            if (observation.base_commit_sha !== f.base_commit_sha || observation.head_commit_sha !== f.base_commit_sha || observation.working_branch !== f.working_branch || !observation.changed_files.length || observation.changed_files.length > o.candidateLimits.max_changed_files || Buffer.byteLength(observation.diff) > o.candidateLimits.max_diff_bytes || observation.changed_files.some(e => !o.allowedPaths.includes(e.path) || !exactPath(e.path) || isBlocked(e.path, o.blockedPaths)))
+            if (observation.base_commit_sha !== f.base_commit_sha || observation.head_commit_sha !== f.base_commit_sha || observation.working_branch !== f.working_branch || !observation.changed_files.length || observation.changed_files.length > o.candidateLimits.max_changed_files || Buffer.byteLength(observation.diff) > o.candidateLimits.max_diff_bytes || observation.changed_files.some(e => !o.allowedPaths.includes(e.path) || !exactPath(e.path) || isBlocked(e.path, o.blockedPaths)) || changedFileBytes(observation.diff).some(n => n > o.candidateLimits.max_file_bytes))
                 throw denied();
             await this.active();
             await sealed.assertUnchanged();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.41",
+  "version": "0.1.43",
   "private": false,
   "license": "UNLICENSED",
   "bin": {