mtech-ai-local-runner 0.1.44 → 0.1.45

package/README.md

@@ -1,3 +1,28 @@
+## 0.1.45: pin official Codex alpha.11 outside the app
+
+Manual and daemon Codex registration now require the reviewed official standalone
+`codex-cli 0.163.0-alpha.11` (SHA256
+`80df47f6ca9d316c732014bc5f6e6514696fafb5593e08e064332a1d3718b466`) at
+`<employee-home>/.local/share/mtec-ai-local-runner/codex/0.163.0-alpha.11/<sha256>/codex`.
+There is no ChatGPT app, PATH or environment fallback. A missing, changed,
+symlinked, foreign-owned or group/world-writable installation blocks Codex.
+Existing login/settings, the Claude path, policy observer and execution limits
+are unchanged. This package does not install the standalone automatically;
+provisioning, exact Gateway runtime pins and daemon transition need their own
+reviewed delivery plan. A package update alone is not a successful transition.
+
+Executable integrity checks still hash every byte on every call, with a bounded
+1 MiB read buffer to reduce repeated filesystem dispatch. Tests separate
+independent scenarios and distinguish completion output from actual target exit.
+No timeout was expanded. The historical MCP startup timeout is not declared fixed.
+
+### Interactive LaunchAgent
+
+`setup` writes the runner LaunchAgent with `ProcessType` `Interactive`. The `Background` class kept the daemon, Codex and
+every verification command at priority 4 on the efficiency cores, so P1 verification took 12.5 minutes on a busy Mac;
+`Standard` was barely faster. An installed agent changes class only when its plist is rewritten and reloaded;
+`launchctl print gui/$(id -u)/com.mtec.ai-local-runner` should then show `spawn type = interactive (4)`.
+
 ## 0.1.44: stop repeating whole-checkout checks in P1 verification
 
 The P1 verifier rereads the whole model checkout for every source check and every candidate check. On the AI

package/dist/src/platform/macos/launchd.js

@@ -26,6 +26,9 @@ export class LaunchdService {
         this.deps = deps;
         this.plistPath = join(deps.home, "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
     }
+    // Interactive, because the employee waits on every job and its verification. Background kept
+    // the daemon on the efficiency cores at priority 4, and Standard (priority 20) was barely faster
+    // on a busy Mac: P1 verification took 553-698 s there against 60-165 s at priority 31.
     render(executablePath, stateRoot) {
         return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
@@ -34,7 +37,7 @@ export class LaunchdService {
 <key>ProgramArguments</key><array><string>${xml(process.execPath)}</string><string>${xml(executablePath)}</string><string>run</string><string>--state-root=${xml(stateRoot)}</string></array>
 <key>EnvironmentVariables</key><dict><key>PATH</key><string>${xml(this.deps.path ?? process.env.PATH ?? "/usr/bin:/bin:/usr/sbin:/sbin")}</string></dict>
 <key>RunAtLoad</key><true/><key>KeepAlive</key><true/>
-<key>ProcessType</key><string>Background</string>
+<key>ProcessType</key><string>Interactive</string>
 </dict></plist>
 `;
     }

package/dist/src/safety/codex-daemon-host.js

@@ -1,5 +1,5 @@
 import { CODEX_DAEMON_EXEC_RELEASES } from './codex-daemon-releases.js';
-import { registeredPrelaunchDependencies, CODEX_MANUAL_BINARY } from './codex-manual-registered.js';
+import { registeredPrelaunchDependencies } from './codex-manual-registered.js';
 import { createPrivilegedDaemonController } from './codex-manual-controller.js';
 import { createPolicyInventoryClient, verifyPolicyObserver } from './policy-inventory-client.js';
 import { PRIVILEGED_MDM_MODE } from '../adapters/codex/prelaunch-policy.js';
@@ -52,7 +52,7 @@ export function createCodexDaemonHost(input, deps) {
                         throw Error('CODEX_DAEMON_PREPARATION_REUSED');
                     const pin = releases[0].policyObserver;
                     const client = createPolicyInventoryClient(pin);
-                    const controller = createPrivilegedDaemonController({ runnerId: input.runnerId, binary: native.binary ?? CODEX_MANUAL_BINARY, home: input.home, codexHome: input.codexHome, claim }, { releases, observer: pin, readLocal: native.readLocal, readNativeAuth: native.readNativeAuth, collectInventory: native.collectInventory ?? client.collectOnce });
+                    const controller = createPrivilegedDaemonController({ runnerId: input.runnerId, binary: native.binary, home: input.home, codexHome: input.codexHome, claim }, { releases, observer: pin, readLocal: native.readLocal, readNativeAuth: native.readNativeAuth, collectInventory: native.collectInventory ?? client.collectOnce });
                     controllers.set(jobId, controller);
                     const host = await controller.prepare();
                     if (closed) {

package/dist/src/safety/codex-daemon-releases.js

@@ -8,11 +8,11 @@ export const CODEX_DAEMON_EXEC_RELEASES = Object.freeze([{
         "policyScope": "unmanaged_personal_only",
         "managedEnforcement": "not_run",
         "executableVersion": "codex-cli 0.163.0-alpha.11",
-        "binarySha256": "8a6dc3938a2f5d30cc19c50b9ccad83a5aa2ca4a2e3411665430bb78a917220a",
+        "binarySha256": "80df47f6ca9d316c732014bc5f6e6514696fafb5593e08e064332a1d3718b466",
         "modelIds": [
             "gpt-5.6-sol"
         ],
-        "decisionId": "16d7057c-b613-45c0-92e0-05262af96d89",
+        "decisionId": "21d710f0-d8f2-4a5f-b8c5-f7412e2a2100",
         "acceptedResidualRisks": [
             "vendor_native_policy_enforcement",
             "managed_policy_not_directly_observed_per_job",
@@ -26,14 +26,14 @@ export const CODEX_DAEMON_EXEC_RELEASES = Object.freeze([{
         "credentialBackend": "auto",
         "mdmVerification": "privileged_prelaunch",
         "fixtureEvidence": {
-            "binary_release": "e392e2e1a577a5fb91f8cbb508ec3ebf287073a3c92389586531d81d4751b14f",
-            "official_permissions": "3c12b20dda72cc638a4109b2f25f5066f64e302a4b465e941a3188f8f51d21c1",
+            "binary_release": "00bfa3a8438d10787c6b18f6d56fde9dc37b1f4ae64c13ac723a5e472e54498a",
+            "official_permissions": "ae0906f5302344f41ae06aee053764ba98511fbd5072af81b5ec857a2d6c42c0",
             "managed_scope_exclusion": "a559199e229e153759f7a7cbd682aae423c0e3d33ef2a692fcccb5eed7c57ed3",
-            "required_mcp_startup": "94f51ddb832948eaeeb51040b4d5eace56f245328c356d3b9042e09080b4173c",
-            "source_exclusion": "36f4e02fee13fe4c1535f26b539cb2f15218e257ebc857c79c6b9e5676218c2b",
+            "required_mcp_startup": "d2f482b5dd5e74684d7c77652b803314b1555354970d67b795dbefcdddcf7bc2",
+            "source_exclusion": "c44cf5ca899e42349c17ea37524984eb8aa6ffe505494ff6a253b159a0cada64",
             "auth_backend_compatibility": "7c42b882a52698fef3e14b4b956ede91ed1e3b29511fbff3176387063b8d74f0"
         },
-        "fixturesFingerprint": "cc9e1586bbed7c4b0548dad6ffb91453d3cadd084504379178e5820687a2c892",
+        "fixturesFingerprint": "51b0e58037712a01d3f9499bcd6ee65ab727334119d3aaf8d9ed56a5c592e366",
         "commands": [],
         "policyObserver": {
             "protocol": "policy-inventory-v1",

package/dist/src/safety/codex-exec-production-host.js

@@ -7,6 +7,7 @@ import path from 'node:path';
 import { lstat, realpath } from 'node:fs/promises';
 import { parse } from 'smol-toml';
 import { CODEX_REPORT_SCHEMA } from '../adapters/codex/prompt-compiler.js';
+import { codexStandaloneBinaryPath, verifyCodexStandaloneBinary, assertCodexStandaloneBinaryLocation } from './codex-standalone-binary.js';
 import { lstatSync } from 'node:fs';
 import { readStableText, regularFileStamp as stamp } from './stable-file-read.js';
 import { observePinnedGitHead } from './pinned-git-head.js';
@@ -43,6 +44,8 @@ export function createCodexExecProductionHost(original) {
             throw reject();
         const paths = path.isAbsolute(input.binary) ? [input.binary] : input.binary === 'codex' && input.searchPath?.split(path.delimiter).every(p => path.isAbsolute(p)) ? input.searchPath.split(path.delimiter).map(p => path.join(p, 'codex')) : [];
         for (const binary of paths) {
+            if (binary === codexStandaloneBinaryPath(input.home))
+                await verifyCodexStandaloneBinary(input.home);
             let stat;
             try {
                 stat = await lstat(binary);
@@ -109,7 +112,7 @@ export function createCodexExecProductionHost(original) {
             const accountDirStamp = (file) => { const s = lstatSync(file, { bigint: true }); if (!s.isDirectory() || s.isSymbolicLink())
                 throw reject(); return [s.dev, s.ino, s.mode, s.uid].join(':'); };
             const current = () => { try {
-                return !revoked && !!selected && !!ctx && headObservation?.isCurrent() === true && (selected.release.securityMode !== UNMANAGED_EXEC_MODE || selected.policyObservation?.isCurrent() === true) && (lease.get(id)?.expires ?? 0) > Date.now() && [...baseline].every(([file, value]) => stamp(file) === value) && [...directories].every(([file, value]) => dirStamp(file) === value) && [...accountDirectories].every(([file, value]) => accountDirStamp(file) === value);
+                return !revoked && !!selected && !!ctx && (selected.binary !== codexStandaloneBinaryPath(input.home) || assertCodexStandaloneBinaryLocation(input.home) === selected.binary) && headObservation?.isCurrent() === true && (selected.release.securityMode !== UNMANAGED_EXEC_MODE || selected.policyObservation?.isCurrent() === true) && (lease.get(id)?.expires ?? 0) > Date.now() && [...baseline].every(([file, value]) => stamp(file) === value) && [...directories].every(([file, value]) => dirStamp(file) === value) && [...accountDirectories].every(([file, value]) => accountDirStamp(file) === value);
             }
             catch {
                 return false;

package/dist/src/safety/codex-manual-registered.js

@@ -9,18 +9,18 @@ import { measureCommandFile } from './registered-command-integrity.js';
 import { readStableText } from './stable-file-read.js';
 import { eligiblePersonalAccount } from '../adapters/codex/unmanaged-scope.js';
 import { CLAUDE_CAPABILITIES } from '../adapters/discovery.js';
-/** Compiled reviewed identity; never selected by task, environment or receipts. */
-export const CODEX_MANUAL_BINARY = '/Applications/ChatGPT.app/Contents/Resources/codex-cli/CodexCLI.app/Contents/MacOS/codex';
+import { codexStandaloneBinaryPath, verifyCodexStandaloneBinary } from './codex-standalone-binary.js';
 export const CODEX_MANUAL_NATIVE_READER = Object.freeze({ "binary": "/Library/PrivilegedHelperTools/com.mtec.ai-gateway.codex-observe.681fb12e0b83ff8fbb612dc71f9a5f5c9be5334bcfead29314ca5b979b1dd986", "sha256": "681fb12e0b83ff8fbb612dc71f9a5f5c9be5334bcfead29314ca5b979b1dd986" });
 export function registeredManualDependencies(home, codexHome) { return registeredPrelaunchDependencies(home, codexHome, 'manual_prelaunch', CODEX_EXEC_RELEASES); }
 /** Trusted compiled registration shared by manual and daemon host composition. */
 export function registeredPrelaunchDependencies(home, codexHome, mode, releases) {
-    const account = path.resolve(codexHome ?? path.join(home, '.codex')), pin = CODEX_MANUAL_NATIVE_READER;
+    const account = path.resolve(codexHome ?? path.join(home, '.codex')), pin = CODEX_MANUAL_NATIVE_READER, binary = codexStandaloneBinaryPath(home);
     if (!path.isAbsolute(home) || !pin)
         throw Error('CODEX_MANUAL_REGISTRATION_UNAVAILABLE');
     const reader = createNativeObservationReader({ accountRoot: account, backend: 'auto', keyringKind: 'direct', process: nativeMetadataProcess(pin.binary, pin.sha256), systemSource: systemPolicySource, mdmInventory: () => { throw Error('MANUAL_INVENTORY_ONLY'); } });
-    return Object.freeze({ binary: CODEX_MANUAL_BINARY, readLocal: reader.readLocal, readNativeAuth: () => reader.readAuth(), async probe() {
-            const digest = await measureCommandFile(CODEX_MANUAL_BINARY), matches = releases.filter(r => reviewedCodexExecRelease(r) && r.binarySha256 === digest && r.mdmVerification === mode && r.credentialBackend === 'auto');
+    return Object.freeze({ binary, readLocal: reader.readLocal, readNativeAuth: () => reader.readAuth(), async probe() {
+            await verifyCodexStandaloneBinary(home);
+            const digest = await measureCommandFile(binary), matches = releases.filter(r => reviewedCodexExecRelease(r) && r.binarySha256 === digest && r.mdmVerification === mode && r.credentialBackend === 'auto');
             const config = parse((await readStableText(path.join(account, 'config.toml'))).text);
             if (matches.length !== 1 || (config.cli_auth_credentials_store ?? 'auto') !== 'auto' || config.features?.secret_auth_storage === true)
                 throw Error('CODEX_MANUAL_REGISTRATION_UNAVAILABLE');

package/dist/src/safety/codex-reviewed-manual-release.js

@@ -7,11 +7,11 @@ export const REVIEWED_MANUAL_CODEX_RELEASE = {
     "policyScope": "unmanaged_personal_only",
     "managedEnforcement": "not_run",
     "executableVersion": "codex-cli 0.163.0-alpha.11",
-    "binarySha256": "8a6dc3938a2f5d30cc19c50b9ccad83a5aa2ca4a2e3411665430bb78a917220a",
+    "binarySha256": "80df47f6ca9d316c732014bc5f6e6514696fafb5593e08e064332a1d3718b466",
     "modelIds": [
         "gpt-5.6-sol"
     ],
-    "decisionId": "16d7057c-b613-45c0-92e0-05262af96d89",
+    "decisionId": "21d710f0-d8f2-4a5f-b8c5-f7412e2a2100",
     "acceptedResidualRisks": [
         "vendor_native_policy_enforcement",
         "managed_policy_not_directly_observed_per_job",
@@ -25,13 +25,13 @@ export const REVIEWED_MANUAL_CODEX_RELEASE = {
     "credentialBackend": "auto",
     "mdmVerification": "manual_prelaunch",
     "fixtureEvidence": {
-        "binary_release": "e392e2e1a577a5fb91f8cbb508ec3ebf287073a3c92389586531d81d4751b14f",
-        "official_permissions": "3c12b20dda72cc638a4109b2f25f5066f64e302a4b465e941a3188f8f51d21c1",
+        "binary_release": "00bfa3a8438d10787c6b18f6d56fde9dc37b1f4ae64c13ac723a5e472e54498a",
+        "official_permissions": "ae0906f5302344f41ae06aee053764ba98511fbd5072af81b5ec857a2d6c42c0",
         "managed_scope_exclusion": "3bb8b2ad50a44cdea5a2a3f388f8009b51d8c60d46230fb3d0b7fed0b9f7452d",
-        "required_mcp_startup": "94f51ddb832948eaeeb51040b4d5eace56f245328c356d3b9042e09080b4173c",
-        "source_exclusion": "36f4e02fee13fe4c1535f26b539cb2f15218e257ebc857c79c6b9e5676218c2b",
+        "required_mcp_startup": "d2f482b5dd5e74684d7c77652b803314b1555354970d67b795dbefcdddcf7bc2",
+        "source_exclusion": "c44cf5ca899e42349c17ea37524984eb8aa6ffe505494ff6a253b159a0cada64",
         "auth_backend_compatibility": "7c42b882a52698fef3e14b4b956ede91ed1e3b29511fbff3176387063b8d74f0"
     },
-    "fixturesFingerprint": "b0f0778c69ffade85ad0694ae39018312dfd93a7c2c1ebfd948d2d15e6d57e2d",
+    "fixturesFingerprint": "4b226b26432f92720f4b5e67156bcffab324cdd5c765d44bccef568db5e14bcc",
     "commands": []
 };

package/dist/src/safety/codex-standalone-binary.js

@@ -0,0 +1,71 @@
+import path from 'node:path';
+import { lstat, realpath } from 'node:fs/promises';
+import { lstatSync, realpathSync } from 'node:fs';
+import { measureCommandFile } from './registered-command-integrity.js';
+/** Trusted compiled artifact, not selected by config, PATH, task or receipts. */
+export const CODEX_STANDALONE_ARTIFACT = Object.freeze({
+    version: '0.163.0-alpha.11',
+    binarySha256: '80df47f6ca9d316c732014bc5f6e6514696fafb5593e08e064332a1d3718b466',
+    archiveSha256: '4ceb37d6b7b5929925e4c36aeae912f1d040a43203696129fc6b3ffe09cb452a',
+});
+const reject = () => new Error('CODEX_STANDALONE_BINARY_REJECTED');
+/** The optional identity is for trusted in-process fixture composition only.
+ * Production registration always uses the compiled default. No authority is
+ * created by resolving or measuring a path. */
+export function codexStandaloneBinaryPath(home, sha = CODEX_STANDALONE_ARTIFACT.binarySha256) {
+    if (!path.isAbsolute(home) || path.resolve(home) !== home || home === '/' || home.length > 4096 || /[\r\n\0]/.test(home) || !(/^[a-f0-9]{64}$/).test(sha))
+        throw reject();
+    return path.join(home, '.local', 'share', 'mtec-ai-local-runner', 'codex', CODEX_STANDALONE_ARTIFACT.version, sha, 'codex');
+}
+/** Rechecked by the retained per-execution current-input fence before spawn. */
+export function assertCodexStandaloneBinaryLocation(home, sha = CODEX_STANDALONE_ARTIFACT.binarySha256) {
+    try {
+        const binary = codexStandaloneBinaryPath(home, sha), uid = process.getuid?.();
+        if (uid === undefined || realpathSync(home) !== home || realpathSync(binary) !== binary)
+            throw reject();
+        let current = home;
+        const parts = ['', ...path.relative(home, binary).split(path.sep)];
+        for (let i = 0; i < parts.length; i++) {
+            current = path.join(current, parts[i]);
+            const s = lstatSync(current), last = i === parts.length - 1;
+            if (s.uid !== uid || (s.mode & 0o022) || s.isSymbolicLink() || (!last && !s.isDirectory()) || (last && (!s.isFile() || s.nlink !== 1 || !(s.mode & 0o111))))
+                throw reject();
+        }
+        return binary;
+    }
+    catch {
+        throw reject();
+    }
+}
+/** Owner-only installation chain plus existing stable no-follow file measure.
+ * This is not atomic exec against the employee owner; per-execution digest,
+ * stamp and OS confinement checks remain mandatory in the existing host. */
+export async function verifyCodexStandaloneBinary(home, sha = CODEX_STANDALONE_ARTIFACT.binarySha256) {
+    try {
+        const binary = codexStandaloneBinaryPath(home, sha), uid = process.getuid?.();
+        if (uid === undefined || await realpath(home) !== home)
+            throw reject();
+        const paths = [home];
+        let current = home;
+        for (const part of path.relative(home, binary).split(path.sep)) {
+            current = path.join(current, part);
+            paths.push(current);
+        }
+        const inspect = async () => Promise.all(paths.map(async (file, index) => {
+            const s = await lstat(file, { bigint: true }), last = index === paths.length - 1;
+            if (s.uid !== BigInt(uid) || (s.mode & 18n) !== 0n || s.isSymbolicLink() || (!last && !s.isDirectory()) || (last && (!s.isFile() || s.nlink !== 1n || (s.mode & 73n) === 0n)))
+                throw reject();
+            return { dev: s.dev, ino: s.ino, uid: s.uid, mode: s.mode };
+        }));
+        const before = await inspect();
+        if (await realpath(binary) !== binary || await measureCommandFile(binary) !== sha)
+            throw reject();
+        const after = await inspect();
+        if (after.some((s, i) => s.dev !== before[i].dev || s.ino !== before[i].ino || s.uid !== before[i].uid || s.mode !== before[i].mode) || await realpath(binary) !== binary)
+            throw reject();
+        return binary;
+    }
+    catch {
+        throw reject();
+    }
+}

package/dist/src/safety/registered-command-integrity.js

@@ -12,7 +12,9 @@ export async function measureCommandFile(file) {
             throw denied();
         const hash = createHash('sha256');
         let size = 0n;
-        for await (const chunk of fd.createReadStream({ autoClose: false })) {
+        // Rehash every byte on every call, but avoid one filesystem dispatch per
+        // 64 KiB when snapshot fences repeatedly inspect multi-megabyte executables.
+        for await (const chunk of fd.createReadStream({ autoClose: false, highWaterMark: 1024 * 1024 })) {
             size += BigInt(chunk.length);
             if (size > 512n * 1024n * 1024n)
                 throw denied();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.44",
+  "version": "0.1.45",
   "private": false,
   "license": "UNLICENSED",
   "bin": {