mtech-ai-local-runner 0.1.42 → 0.1.43

package/README.md

@@ -1,3 +1,15 @@
+## 0.1.43: give whole-checkout snapshots whole-checkout bounds
+
+The P1 verifier snapshots the whole model checkout before it runs the reviewed commands. It passed the candidate limits
+(`max_file_bytes` and `max_diff_bytes`, 16 KiB in the pilot contract) as the snapshot's own per-file and whole-tree
+bounds, so any real project failed with `SNAPSHOT_REJECTED`: the AI Gateway checkout has 3,781 files, 48.5 MB and 588
+files above 16 KiB. The snapshot now takes the same 128 MiB whole-tree memory bound as the publication hosts. The
+candidate limits still apply to the changed files: their count, the diff size and, newly explicit, each changed file's
+before and after size. Local Fix had the same defect, and Local Fix → PR could not publish on the AI Gateway repository because
+an unchanged 1.09 MB file exceeds the 1 MiB `max_file_bytes` cap. Its production and server-CI snapshots and its Git
+publication transport now use the same shared `SNAPSHOT_TREE_MAX_BYTES`. Changed files are still bounded by
+`max_file_bytes`.
+
 ## 0.1.42: keep the guardian's reports when a late terminate fails
 
 The owned guardian now reports to the host on its own pipe (fd3) and takes the host's commands on another (fd5);

package/dist/src/publication/git-snapshot.js

@@ -12,6 +12,9 @@ const execute = promisify(execFile), denied = () => Error('SNAPSHOT_REJECTED');
 const digest = (data) => createHash('sha256').update(data).digest('hex');
 const safe = (p) => p.length > 0 && !path.isAbsolute(p) && !p.includes('\\') && !p.includes('\0') && p.split('/').every(s => s !== '' && s !== '.' && s !== '..' && !/^(?:\.git|\.ssh|\.aws|\.codex|\.claude|\.env|\.netrc|\.npmrc|credentials(?:\..*)?)$/i.test(s));
 /** P1 branch shape only. Authority still requires exact frozen-fence equality. */
+/** Whole-checkout memory bound for a snapshot, per file and in total. A snapshot reads every
+ * file of the checkout, so callers bound candidate size on the changed files instead. */
+export const SNAPSHOT_TREE_MAX_BYTES = 128 * 1024 * 1024;
 export const isP1WorkingBranch = (branch) => typeof branch === 'string' && branch.length <= 255 && /^ai-work\/[A-Za-z0-9][A-Za-z0-9._-]*\/[A-Za-z0-9][A-Za-z0-9._-]*$/.test(branch) && branch.split('/').every(p => !p.includes('..') && !p.endsWith('.') && !p.endsWith('.lock'));
 /** Reads only immutable Git objects and metadata. Never runs diff against worktree
  * content, where malicious clean filters can execute even with --no-ext-diff. */

package/dist/src/publication/production-host.js

@@ -4,7 +4,7 @@ import { lstat, realpath, open, rename, unlink } from 'node:fs/promises';
 import path from 'node:path';
 import { CandidateVerifier, protocolHash } from './candidate.js';
 import { createLocalFixExecutionHost } from './execution-host.js';
-import { GitSnapshotHost } from './git-snapshot.js';
+import { GitSnapshotHost, SNAPSHOT_TREE_MAX_BYTES } from './git-snapshot.js';
 import { createSealedIsolatedVerifier } from './isolated-verifier.js';
 import { FilePublicationJournal } from './journal.js';
 import { DeterministicPublisher, PublicationOutcomeUnknownError } from './publisher.js';
@@ -55,7 +55,7 @@ export function createProductionLocalFixHost(options) {
             } };
             const frozenCurrent = async () => lifecycle.isFrozen() && await current();
             const limits = scope.candidate_limits;
-            const snapshots = new GitSnapshotHost({ root: input.checkoutPath, privateRoot: root, git: options.git, baseCommitSha: binding.base_commit_sha, workingBranch: binding.working_branch, maxFileBytes: limits.max_file_bytes, maxTotalBytes: 128 * 1024 * 1024 });
+            const snapshots = new GitSnapshotHost({ root: input.checkoutPath, privateRoot: root, git: options.git, baseCommitSha: binding.base_commit_sha, workingBranch: binding.working_branch, maxFileBytes: SNAPSHOT_TREE_MAX_BYTES, maxTotalBytes: SNAPSHOT_TREE_MAX_BYTES });
             const isolated = createSealedIsolatedVerifier({ host: snapshots, allowedPaths: verificationPaths, blockedPaths: ['.env', '.env.*', '.git/**', '.ssh/**', '.aws/**'], commands, current: frozenCurrent });
             const verifier = new CandidateVerifier({ binding, root: input.checkoutPath, allowedPaths: allowed, blockedPaths: ['.env', '.env.*', '.git/**', '.ssh/**', '.aws/**'], maxFiles: limits.max_changed_files, maxDiffBytes: limits.max_diff_bytes, maxFileBytes: limits.max_file_bytes, commands, current: frozenCurrent, assertRetainedSeal: async () => { const seal = isolated.materialized(); if (!seal)
                     throw denied(); await seal.assertUnchanged(); }, observe: () => snapshots.observe(), verify: isolated.verify });
@@ -140,7 +140,7 @@ export function createProductionLocalFixHost(options) {
                     }
                     if (!await frozenCurrent())
                         throw denied();
-                    git = new GitPublicationTransport({ checkout, privateRoot: root, git: options.git, sealedTreeFingerprint: seal.treeFingerprint, evidence: candidate.evidence, origin: options.origin, current: frozenCurrent, broker: typeof options.broker === 'function' ? options.broker({ branch: binding.working_branch, current: frozenCurrent }) : options.broker, maxFileBytes: limits.max_file_bytes });
+                    git = new GitPublicationTransport({ checkout, privateRoot: root, git: options.git, sealedTreeFingerprint: seal.treeFingerprint, evidence: candidate.evidence, origin: options.origin, current: frozenCurrent, broker: typeof options.broker === 'function' ? options.broker({ branch: binding.working_branch, current: frozenCurrent }) : options.broker, maxFileBytes: SNAPSHOT_TREE_MAX_BYTES, maxTotalBytes: SNAPSHOT_TREE_MAX_BYTES });
                 }
                 return git;
             };

package/dist/src/publication/server-ci-host.js

@@ -8,7 +8,7 @@ import { setTimeout as delay } from 'node:timers/promises';
 import { MAX_EVENT_SUMMARY_CHARS } from '../protocol.js';
 import { protocolHash } from './candidate.js';
 import { FilePublicationJournal } from './journal.js';
-import { GitSnapshotHost } from './git-snapshot.js';
+import { GitSnapshotHost, SNAPSHOT_TREE_MAX_BYTES } from './git-snapshot.js';
 import { PublicationOutcomeUnknownError } from './publisher.js';
 const denied = () => Error('LOCAL_FIX_SERVER_CI_REJECTED');
 const safePath = (p) => typeof p === 'string' && p.length > 0 && !p.includes('\\') && !p.includes('\0') && !path.isAbsolute(p) && p.split('/').every(s => s !== '' && s !== '.' && s !== '..' && !/^(?:\.git|\.mcp(?:\..*)?|\.npmrc|\.netrc|id_rsa|id_ed25519|\.local-runner|\.runner|\.env(?:\..*)?|\.codex|\.claude|\.ssh|\.aws|\.config|auth\.(?:json|toml|ya?ml)(?:\..*)?|credentials(?:\..*)?|AGENTS\.md|CLAUDE\.md|mcp\.(?:json|toml|ya?ml)(?:\..*)?)$/i.test(s));
@@ -82,7 +82,7 @@ export function createServerCiLocalFixHost(options) {
                     return finalization ??= (async () => {
                         const report = mode === 'gateway_publish_v1' ? validationReport(completedEvent) : undefined;
                         await current();
-                        const host = new GitSnapshotHost({ root: input.checkoutPath, privateRoot: root, git: options.git, baseCommitSha: binding.base_commit_sha, workingBranch: binding.working_branch, maxFileBytes: limits.max_file_bytes, maxTotalBytes: 128 * 1024 * 1024 });
+                        const host = new GitSnapshotHost({ root: input.checkoutPath, privateRoot: root, git: options.git, baseCommitSha: binding.base_commit_sha, workingBranch: binding.working_branch, maxFileBytes: SNAPSHOT_TREE_MAX_BYTES, maxTotalBytes: SNAPSHOT_TREE_MAX_BYTES });
                         const observed = await host.observe();
                         seal = await host.materialize();
                         if (protocolHash(observed) !== protocolHash(seal.observation) || Buffer.byteLength(observed.diff) > limits.max_diff_bytes || !observed.changed_files.length || observed.changed_files.length > limits.max_changed_files)

package/dist/src/verification/runner-observed-verifier.js

@@ -2,12 +2,21 @@ import { createHash } from 'node:crypto';
 import { realpath } from 'node:fs/promises';
 import path from 'node:path';
 import { protocolHash, protocolJson } from '../publication/candidate.js';
-import { GitSnapshotHost, isP1WorkingBranch } from '../publication/git-snapshot.js';
+import { GitSnapshotHost, isP1WorkingBranch, SNAPSHOT_TREE_MAX_BYTES } from '../publication/git-snapshot.js';
 import { createIsolatedCommandPolicy } from '../publication/isolated-verifier.js';
 import { buildReviewedProjectRegistration } from '../publication/project-registration.js';
 const denied = () => Error('RUNNER_VERIFICATION_REJECTED');
 const hex = (v, n) => typeof v === 'string' && new RegExp(`^[a-f0-9]{${n}}$`).test(v);
 const same = (a, b) => protocolHash(a) === protocolHash(b);
+/** Byte length of each changed file's before and after content in the sealed binary diff.
+ * The snapshot itself takes the whole-checkout bound; candidate limits apply to these files. */
+function changedFileBytes(diff) {
+    const parsed = JSON.parse(diff);
+    if (parsed.format !== 'local-candidate-binary-diff-v1' || !Array.isArray(parsed.changes))
+        throw denied();
+    return parsed.changes.flatMap((change) => [change.before, change.after].filter(v => v !== null).map(v => { if (typeof v !== 'string')
+        throw denied(); return Buffer.from(v, 'base64').length; }));
+}
 const ceilings = { max_commands: 8, max_command_runtime_ms: 120000, max_output_bytes: 1048576, max_manifest_entries: 100, max_manifest_bytes: 32768, max_contract_bytes: 65536 };
 const privatePart = /^(?:\.git|\.mcp(?:\..*)?|\.env(?:\..*)?|\.ssh|\.aws|\.config|\.codex|\.claude|\.runner|\.local-runner|\.npmrc|\.netrc|id_rsa|id_ed25519|credentials(?:\..*)?|auth\.(?:json|toml|ya?ml)(?:\..*)?|mcp\.(?:json|toml|ya?ml)(?:\..*)?|AGENTS\.md|CLAUDE\.md|vendor|node_modules)$/i;
 const exactPath = (name) => typeof name === 'string' && /^[A-Za-z0-9_][A-Za-z0-9_.-]*(?:\/[A-Za-z0-9_.-]+)*$/.test(name) && name.split('/').every(p => p !== '.' && p !== '..' && !privatePart.test(p));
@@ -94,9 +103,9 @@ export class RunnerObservedVerifier {
             await this.active();
             if (!path.isAbsolute(o.root) || await realpath(o.root) !== o.root || !path.isAbsolute(o.privateRoot) || await realpath(o.privateRoot) !== o.privateRoot || o.privateRoot === o.root || o.privateRoot.startsWith(o.root + '/'))
                 throw denied();
-            host = o.host ?? new GitSnapshotHost({ root: o.root, privateRoot: o.privateRoot, git: o.registration.git, baseCommitSha: f.base_commit_sha, workingBranch: f.working_branch, p1WorkingBranch: f.working_branch, maxFileBytes: o.candidateLimits.max_file_bytes, maxTotalBytes: Math.max(o.candidateLimits.max_file_bytes, o.candidateLimits.max_diff_bytes) });
+            host = o.host ?? new GitSnapshotHost({ root: o.root, privateRoot: o.privateRoot, git: o.registration.git, baseCommitSha: f.base_commit_sha, workingBranch: f.working_branch, p1WorkingBranch: f.working_branch, maxFileBytes: SNAPSHOT_TREE_MAX_BYTES, maxTotalBytes: SNAPSHOT_TREE_MAX_BYTES });
             const sealed = await host.materialize(), observation = structuredClone(sealed.observation);
-            if (observation.base_commit_sha !== f.base_commit_sha || observation.head_commit_sha !== f.base_commit_sha || observation.working_branch !== f.working_branch || !observation.changed_files.length || observation.changed_files.length > o.candidateLimits.max_changed_files || Buffer.byteLength(observation.diff) > o.candidateLimits.max_diff_bytes || observation.changed_files.some(e => !o.allowedPaths.includes(e.path) || !exactPath(e.path) || isBlocked(e.path, o.blockedPaths)))
+            if (observation.base_commit_sha !== f.base_commit_sha || observation.head_commit_sha !== f.base_commit_sha || observation.working_branch !== f.working_branch || !observation.changed_files.length || observation.changed_files.length > o.candidateLimits.max_changed_files || Buffer.byteLength(observation.diff) > o.candidateLimits.max_diff_bytes || observation.changed_files.some(e => !o.allowedPaths.includes(e.path) || !exactPath(e.path) || isBlocked(e.path, o.blockedPaths)) || changedFileBytes(observation.diff).some(n => n > o.candidateLimits.max_file_bytes))
                 throw denied();
             await this.active();
             await sealed.assertUnchanged();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.42",
+  "version": "0.1.43",
   "private": false,
   "license": "UNLICENSED",
   "bin": {