mtech-ai-local-runner 0.1.44 → 0.1.46

package/README.md

@@ -1,3 +1,39 @@
+## 0.1.46: login and execution are separate
+
+A locally logged-in account may still be blocked by security admission. New
+`login_status`, `execution_status` and `execution_reason_codes` show those facts
+separately; the legacy `authenticated` field remains an eligibility conjunction.
+Malformed/unreadable Claude auth output is unknown, not a request to log in again.
+Claude also rechecks task source identity after MCP preparation before spawning.
+This release does not enable Claude execution, update an installed daemon or
+change existing account settings. See the Gateway repository's
+`docs/ai-ops-gateway/claude-execution-admission-remaining.md` for remaining gates.
+
+## 0.1.45: pin official Codex alpha.11 outside the app
+
+Manual and daemon Codex registration now require the reviewed official standalone
+`codex-cli 0.163.0-alpha.11` (SHA256
+`80df47f6ca9d316c732014bc5f6e6514696fafb5593e08e064332a1d3718b466`) at
+`<employee-home>/.local/share/mtec-ai-local-runner/codex/0.163.0-alpha.11/<sha256>/codex`.
+There is no ChatGPT app, PATH or environment fallback. A missing, changed,
+symlinked, foreign-owned or group/world-writable installation blocks Codex.
+Existing login/settings, the Claude path, policy observer and execution limits
+are unchanged. This package does not install the standalone automatically;
+provisioning, exact Gateway runtime pins and daemon transition need their own
+reviewed delivery plan. A package update alone is not a successful transition.
+
+Executable integrity checks still hash every byte on every call, with a bounded
+1 MiB read buffer to reduce repeated filesystem dispatch. Tests separate
+independent scenarios and distinguish completion output from actual target exit.
+No timeout was expanded. The historical MCP startup timeout is not declared fixed.
+
+### Interactive LaunchAgent
+
+`setup` writes the runner LaunchAgent with `ProcessType` `Interactive`. The `Background` class kept the daemon, Codex and
+every verification command at priority 4 on the efficiency cores, so P1 verification took 12.5 minutes on a busy Mac;
+`Standard` was barely faster. An installed agent changes class only when its plist is rewritten and reloaded;
+`launchctl print gui/$(id -u)/com.mtec.ai-local-runner` should then show `spawn type = interactive (4)`.
+
 ## 0.1.44: stop repeating whole-checkout checks in P1 verification
 
 The P1 verifier rereads the whole model checkout for every source check and every candidate check. On the AI
@@ -615,3 +651,13 @@ advertises `local_fix_gateway_publish_v1`. Publishing/installation/DEV activatio
 and an exact approved Fix contract/launch are still required before real use.
 An unresolved canonical PR approval or publication receipt pauses delivery; do
 not rerun the model or delete recovery state to force a PR.
+
+### Login and execution diagnostics
+
+`login_status` reports local account evidence (`authenticated`, `unauthenticated`,
+`unknown`); it does not certify remote token validity. `execution_status` reports
+`ready` or `blocked`, with bounded `execution_reason_codes`. For compatibility,
+the older `authenticated` field still means execution eligibility. A logged-in
+Claude account can remain blocked by unverified security admission. Do not log out
+or change credentials just because that legacy field is false. Unknown status is
+not evidence of logout. These diagnostics do not bypass per-job admission.

package/dist/src/adapters/claude-code/adapter.js

@@ -78,6 +78,9 @@ export class ClaudeCodeAdapter {
         if (!Number.isSafeInteger(generation) || generation === undefined || generation < 1)
             throw new Error("JOB_SECURITY_REJECTED");
         const assertAdmission = () => {
+            const repositories = ctx.taskPackage?.repositories;
+            if (!Array.isArray(repositories) || repositories.length !== 1 || repositories[0]?.base_commit_sha !== this.options.securityPolicy?.pin.sourceSha)
+                throw new Error('JOB_SECURITY_REJECTED');
             requireJobSecurity(this.options.securityPolicy, { adapterId: "claude_code_cli", adapterVersion: "1", jobId: this.options.jobId ?? ctx.bindingId, modelId: resolvedModelId, generation });
             if (ctx.approvedTaskPackage?.resolved_provider !== "anthropic" || ctx.approvedTaskPackage?.resolved_model_id !== resolvedModelId
                 || ctx.approvedTaskPackage?.repository?.base_commit_sha !== this.options.securityPolicy.pin.sourceSha)
@@ -89,9 +92,6 @@ export class ClaudeCodeAdapter {
             throw new Error('SECURITY_REQUIREMENTS_REJECTED');
         this.receipt = createJobSecurityReceipt(this.options.securityPolicy, { jobId: this.options.jobId ?? ctx.bindingId, generation, modelId: resolvedModelId, sourceSha: this.options.securityPolicy.pin.sourceSha, ...ctx.securityBinding, requirements: ctx.approvedTaskPackage?.security_requirements });
         const pkg = ctx.taskPackage;
-        const repos = pkg.repositories;
-        if (!Array.isArray(repos) || repos.length !== 1 || repos[0]?.base_commit_sha !== this.options.securityPolicy.pin.sourceSha)
-            throw new Error("JOB_SECURITY_REJECTED");
         const cwd = this.options.cwd;
         const rel = cwd ? path.relative(path.resolve(this.options.worktreeRoot), path.resolve(cwd)) : "";
         if (!cwd || !path.isAbsolute(cwd) || rel === "" || (!rel.startsWith(".." + path.sep) && rel !== ".." && !path.isAbsolute(rel)))

package/dist/src/adapters/discovery.js

@@ -1,3 +1,4 @@
+import { adapterStatus } from './status.js';
 import { createCodexProductionHost } from '../safety/codex-production-host.js';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
@@ -20,22 +21,51 @@ export async function discoverAdapters(env, command = run, adapterIds = ['claude
             if (!executableVersion)
                 throw new Error('invalid version');
             let authenticated = false;
+            let loginStatus = 'unknown';
+            const parseClaudeStatus = (stdout) => {
+                try {
+                    const value = JSON.parse(stdout);
+                    if (value && typeof value === 'object' && !Array.isArray(value) && typeof value.loggedIn === 'boolean') {
+                        authenticated = value.loggedIn;
+                        loginStatus = authenticated ? 'authenticated' : 'unauthenticated';
+                    }
+                }
+                catch { /* Unknown evidence stays closed; never expose raw output. */ }
+            };
             try {
-                const auth = await command(binary, codex ? ['login', 'status'] : ['auth', 'status']);
-                authenticated = !codex || /^Logged in using ChatGPT\s*$/i.test([auth.stdout, auth.stderr ?? ''].join('\n').trim());
+                const auth = await command(binary, codex ? ['login', 'status'] : ['auth', 'status', '--json']);
+                if (codex) {
+                    authenticated = /^Logged in using ChatGPT\s*$/i.test([auth.stdout, auth.stderr ?? ''].join('\n').trim());
+                    loginStatus = authenticated ? 'authenticated' : 'unauthenticated';
+                }
+                else
+                    parseClaudeStatus(auth.stdout);
+            }
+            catch (error) {
+                // Claude exits 1 for a known logged-out JSON response. Other failures
+                // (including timeout/permission errors) do not prove logout.
+                if (!codex && error && typeof error === 'object' && error.code === 1) {
+                    const stdout = error.stdout;
+                    if (typeof stdout === 'string') {
+                        parseClaudeStatus(stdout);
+                        if (authenticated) {
+                            authenticated = false;
+                            loginStatus = 'unknown';
+                        }
+                    }
+                }
             }
-            catch { /* Missing login is diagnostic, never an API-key fallback. */ }
             if (codex) {
                 const compatibility = inspectCodexCompatibility({ cliVersion: executableVersion });
                 const admission = await diagnoseCliHostAdmission(id, binary, env);
-                return { ...base, available: compatibility.available, authenticated, executableVersion, capabilities: compatibility.capabilities, admission,
+                return { ...base, available: compatibility.available, authenticated, loginStatus, executableVersion, capabilities: compatibility.capabilities, admission,
                     reason: !authenticated ? 'Codex requires a ChatGPT account login; API-key authentication is unsupported.' : compatibility.reason };
             }
             const admission = await diagnoseCliHostAdmission(id, binary, env);
-            return { ...base, available: admission.available, authenticated, executableVersion, capabilities: admission.capabilities, admission, reason: !authenticated ? 'Claude CLI login is required.' : 'Claude CLI security isolation is unverified; execution is unsupported.' };
+            return { ...base, available: admission.available, authenticated, loginStatus, executableVersion, capabilities: admission.capabilities, admission, reason: loginStatus === 'unknown' ? 'Claude CLI login status could not be verified.' : !authenticated ? 'Claude CLI login is required.' : 'Claude CLI security isolation is unverified; execution is unsupported.' };
         }
         catch {
-            return { ...base, available: false, authenticated: false, capabilities: [], reason: codex ? 'Codex CLI is missing or its version could not be verified.' : 'Claude CLI is missing or its version could not be verified.' };
+            return { ...base, available: false, authenticated: false, loginStatus: 'unknown', capabilities: [], reason: codex ? 'Codex CLI is missing or its version could not be verified.' : 'Claude CLI is missing or its version could not be verified.' };
         }
     }));
 }
@@ -56,6 +86,8 @@ export function adapterDiagnosticsWithRemedies(adapters) {
             else
                 action = 'Codex is ready for an explicitly selected approved launch.';
         }
+        else if (adapter.loginStatus === 'unknown')
+            action = 'Claude login status is unknown; inspect the local status diagnostic before changing credentials. Execution remains blocked.';
         else if (!adapter.available && adapter.executableVersion && adapter.authenticated)
             action = 'Claude CLI security isolation is unverified; wait for a reviewed release. Login alone does not grant execution.';
         else if (!adapter.available)
@@ -64,7 +96,7 @@ export function adapterDiagnosticsWithRemedies(adapters) {
             action = 'Run claude auth login, then rerun doctor.';
         else
             action = 'Claude is ready for an explicitly selected approved launch.';
-        return { ...adapter, action };
+        return { ...adapter, ...adapterStatus(adapter), action };
     });
 }
 /** Setup/doctor use the same reviewed Codex probe as daemon; no legacy vendor

package/dist/src/adapters/status.js

@@ -0,0 +1,9 @@
+/** Diagnostics never grant capabilities or replace the host admission gate. */
+export function adapterStatus(probe) {
+    const login_status = probe.loginStatus ?? (probe.authenticated ? 'authenticated' : 'unknown');
+    const ready = probe.available && probe.authenticated && login_status === 'authenticated';
+    const codes = probe.admission?.checks.filter(c => c.status === 'blocked').map(c => c.code).filter(c => /^[A-Z][A-Z0-9_]{0,95}$/.test(c)).slice(0, 20) ?? [];
+    if (!ready && !codes.length)
+        codes.push(!probe.available ? 'EXECUTION_ADMISSION_UNAVAILABLE' : login_status === 'unknown' ? 'LOGIN_STATUS_UNVERIFIED' : 'LOGIN_REQUIRED');
+    return { authenticated: ready, login_status, execution_status: ready ? 'ready' : 'blocked', execution_reason_codes: ready ? [] : [...new Set(codes)] };
+}

package/dist/src/cli.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { adapterStatus } from './adapters/status.js';
 import { recoverLocalFixPublication } from './publication/recovery.js';
 import { loadInstalledLocalFixHost } from './publication/installed-host.js';
 import { FileDaemonStateStore } from './state-store.js';
@@ -194,7 +195,7 @@ export async function main(argv, env, io = {}) {
                 const registered = await gateway.registerLocalRunner({
                     deviceFingerprint: createHash("sha256").update(`${process.getuid?.() ?? 0}|${runnerDisplayName()}|${config.gatewayMcpUrl}`).digest("hex"),
                     displayName: runnerDisplayName(), packageVersion: "0.1.11",
-                    capabilities: adapters.map(probe => ({ adapter: probe.id, version: probe.version, capabilities: probe.capabilities, authenticated: probe.available && probe.authenticated })),
+                    capabilities: adapters.map(probe => ({ adapter: probe.id, version: probe.version, capabilities: probe.capabilities, ...adapterStatus(probe) })),
                 });
                 await localStore.save({ schemaVersion: 1, gatewayMcpUrl: config.gatewayMcpUrl, runnerId: registered.runner.id, workspaceRoot: config.workspaceRoot, concurrency: 1 });
                 await launchd.install(process.argv[1], config.stateRoot);

package/dist/src/daemon/runtime.js

@@ -1,3 +1,4 @@
+import { adapterStatus } from '../adapters/status.js';
 import { loadInstalledLocalFixHost } from '../publication/installed-host.js';
 import { createCodexDaemonHost } from '../safety/codex-daemon-host.js';
 import { reconcileTerminalState } from './terminal-recovery.js';
@@ -64,7 +65,7 @@ export async function buildDaemon(input) {
     });
     const registry = new AdapterRegistry([plugin, codex]);
     const probes = await registry.probeAll();
-    const versions = Object.fromEntries(probes.filter((probe) => probe.available && probe.authenticated).map((probe) => [probe.id, probe.version]));
+    const versions = Object.fromEntries(probes.filter((probe) => adapterStatus(probe).authenticated).map((probe) => [probe.id, probe.version]));
     const state = new FileDaemonStateStore(input.stateRoot);
     const coordinator = new ExecutionCoordinator({
         localFixHost,
@@ -115,10 +116,10 @@ export async function buildDaemon(input) {
             catch {
                 current = { available: false, authenticated: false, capabilities: [] };
             }
-            const ready = current.available && current.authenticated && !!current.executableVersion && codex.capabilities.every(c => current.capabilities.includes(c));
+            const ready = adapterStatus(current).authenticated && !!current.executableVersion && codex.capabilities.every(c => current.capabilities.includes(c));
             const index = probes.findIndex(p => p.id === 'codex_cli');
             if (index >= 0)
-                probes[index] = { id: 'codex_cli', version: '1', ...current, authenticated: ready };
+                probes[index] = { id: 'codex_cli', version: '1', ...current, available: ready };
             if (ready)
                 versions.codex_cli = '1';
             else
@@ -222,7 +223,8 @@ export async function reconcilePreparationState(previous, deps) {
 /** Vendor capability text cannot claim a host-owned publication facility. */
 export function localRunnerCapabilities(probes, trustedLocalFixHost = false, verificationMode) {
     return probes.map(probe => {
-        const authenticated = probe.available && probe.authenticated;
+        const status = adapterStatus(probe);
+        const authenticated = status.authenticated;
         const capabilities = probe.capabilities.filter(value => value !== 'local_fix_publication_v1' && value !== 'local_fix_gateway_ci_v1' && value !== 'local_fix_gateway_publish_v1');
         if (trustedLocalFixHost && authenticated && probe.id === 'codex_cli') {
             capabilities.push('local_fix_publication_v1');
@@ -231,6 +233,6 @@ export function localRunnerCapabilities(probes, trustedLocalFixHost = false, ver
             if (verificationMode === 'gateway_publish_v1')
                 capabilities.push('local_fix_gateway_publish_v1');
         }
-        return { adapter: probe.id, version: probe.version, authenticated, capabilities };
+        return { adapter: probe.id, version: probe.version, ...status, capabilities };
     });
 }

package/dist/src/platform/macos/launchd.js

@@ -26,6 +26,9 @@ export class LaunchdService {
         this.deps = deps;
         this.plistPath = join(deps.home, "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
     }
+    // Interactive, because the employee waits on every job and its verification. Background kept
+    // the daemon on the efficiency cores at priority 4, and Standard (priority 20) was barely faster
+    // on a busy Mac: P1 verification took 553-698 s there against 60-165 s at priority 31.
     render(executablePath, stateRoot) {
         return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
@@ -34,7 +37,7 @@ export class LaunchdService {
 <key>ProgramArguments</key><array><string>${xml(process.execPath)}</string><string>${xml(executablePath)}</string><string>run</string><string>--state-root=${xml(stateRoot)}</string></array>
 <key>EnvironmentVariables</key><dict><key>PATH</key><string>${xml(this.deps.path ?? process.env.PATH ?? "/usr/bin:/bin:/usr/sbin:/sbin")}</string></dict>
 <key>RunAtLoad</key><true/><key>KeepAlive</key><true/>
-<key>ProcessType</key><string>Background</string>
+<key>ProcessType</key><string>Interactive</string>
 </dict></plist>
 `;
     }

package/dist/src/safety/codex-daemon-host.js

@@ -1,5 +1,5 @@
 import { CODEX_DAEMON_EXEC_RELEASES } from './codex-daemon-releases.js';
-import { registeredPrelaunchDependencies, CODEX_MANUAL_BINARY } from './codex-manual-registered.js';
+import { registeredPrelaunchDependencies } from './codex-manual-registered.js';
 import { createPrivilegedDaemonController } from './codex-manual-controller.js';
 import { createPolicyInventoryClient, verifyPolicyObserver } from './policy-inventory-client.js';
 import { PRIVILEGED_MDM_MODE } from '../adapters/codex/prelaunch-policy.js';
@@ -52,7 +52,7 @@ export function createCodexDaemonHost(input, deps) {
                         throw Error('CODEX_DAEMON_PREPARATION_REUSED');
                     const pin = releases[0].policyObserver;
                     const client = createPolicyInventoryClient(pin);
-                    const controller = createPrivilegedDaemonController({ runnerId: input.runnerId, binary: native.binary ?? CODEX_MANUAL_BINARY, home: input.home, codexHome: input.codexHome, claim }, { releases, observer: pin, readLocal: native.readLocal, readNativeAuth: native.readNativeAuth, collectInventory: native.collectInventory ?? client.collectOnce });
+                    const controller = createPrivilegedDaemonController({ runnerId: input.runnerId, binary: native.binary, home: input.home, codexHome: input.codexHome, claim }, { releases, observer: pin, readLocal: native.readLocal, readNativeAuth: native.readNativeAuth, collectInventory: native.collectInventory ?? client.collectOnce });
                     controllers.set(jobId, controller);
                     const host = await controller.prepare();
                     if (closed) {

package/dist/src/safety/codex-daemon-releases.js

@@ -8,11 +8,11 @@ export const CODEX_DAEMON_EXEC_RELEASES = Object.freeze([{
         "policyScope": "unmanaged_personal_only",
         "managedEnforcement": "not_run",
         "executableVersion": "codex-cli 0.163.0-alpha.11",
-        "binarySha256": "8a6dc3938a2f5d30cc19c50b9ccad83a5aa2ca4a2e3411665430bb78a917220a",
+        "binarySha256": "80df47f6ca9d316c732014bc5f6e6514696fafb5593e08e064332a1d3718b466",
         "modelIds": [
             "gpt-5.6-sol"
         ],
-        "decisionId": "16d7057c-b613-45c0-92e0-05262af96d89",
+        "decisionId": "21d710f0-d8f2-4a5f-b8c5-f7412e2a2100",
         "acceptedResidualRisks": [
             "vendor_native_policy_enforcement",
             "managed_policy_not_directly_observed_per_job",
@@ -26,14 +26,14 @@ export const CODEX_DAEMON_EXEC_RELEASES = Object.freeze([{
         "credentialBackend": "auto",
         "mdmVerification": "privileged_prelaunch",
         "fixtureEvidence": {
-            "binary_release": "e392e2e1a577a5fb91f8cbb508ec3ebf287073a3c92389586531d81d4751b14f",
-            "official_permissions": "3c12b20dda72cc638a4109b2f25f5066f64e302a4b465e941a3188f8f51d21c1",
+            "binary_release": "00bfa3a8438d10787c6b18f6d56fde9dc37b1f4ae64c13ac723a5e472e54498a",
+            "official_permissions": "ae0906f5302344f41ae06aee053764ba98511fbd5072af81b5ec857a2d6c42c0",
             "managed_scope_exclusion": "a559199e229e153759f7a7cbd682aae423c0e3d33ef2a692fcccb5eed7c57ed3",
-            "required_mcp_startup": "94f51ddb832948eaeeb51040b4d5eace56f245328c356d3b9042e09080b4173c",
-            "source_exclusion": "36f4e02fee13fe4c1535f26b539cb2f15218e257ebc857c79c6b9e5676218c2b",
+            "required_mcp_startup": "d2f482b5dd5e74684d7c77652b803314b1555354970d67b795dbefcdddcf7bc2",
+            "source_exclusion": "c44cf5ca899e42349c17ea37524984eb8aa6ffe505494ff6a253b159a0cada64",
             "auth_backend_compatibility": "7c42b882a52698fef3e14b4b956ede91ed1e3b29511fbff3176387063b8d74f0"
         },
-        "fixturesFingerprint": "cc9e1586bbed7c4b0548dad6ffb91453d3cadd084504379178e5820687a2c892",
+        "fixturesFingerprint": "51b0e58037712a01d3f9499bcd6ee65ab727334119d3aaf8d9ed56a5c592e366",
         "commands": [],
         "policyObserver": {
             "protocol": "policy-inventory-v1",

package/dist/src/safety/codex-exec-production-host.js

@@ -7,6 +7,7 @@ import path from 'node:path';
 import { lstat, realpath } from 'node:fs/promises';
 import { parse } from 'smol-toml';
 import { CODEX_REPORT_SCHEMA } from '../adapters/codex/prompt-compiler.js';
+import { codexStandaloneBinaryPath, verifyCodexStandaloneBinary, assertCodexStandaloneBinaryLocation } from './codex-standalone-binary.js';
 import { lstatSync } from 'node:fs';
 import { readStableText, regularFileStamp as stamp } from './stable-file-read.js';
 import { observePinnedGitHead } from './pinned-git-head.js';
@@ -43,6 +44,8 @@ export function createCodexExecProductionHost(original) {
             throw reject();
         const paths = path.isAbsolute(input.binary) ? [input.binary] : input.binary === 'codex' && input.searchPath?.split(path.delimiter).every(p => path.isAbsolute(p)) ? input.searchPath.split(path.delimiter).map(p => path.join(p, 'codex')) : [];
         for (const binary of paths) {
+            if (binary === codexStandaloneBinaryPath(input.home))
+                await verifyCodexStandaloneBinary(input.home);
             let stat;
             try {
                 stat = await lstat(binary);
@@ -109,7 +112,7 @@ export function createCodexExecProductionHost(original) {
             const accountDirStamp = (file) => { const s = lstatSync(file, { bigint: true }); if (!s.isDirectory() || s.isSymbolicLink())
                 throw reject(); return [s.dev, s.ino, s.mode, s.uid].join(':'); };
             const current = () => { try {
-                return !revoked && !!selected && !!ctx && headObservation?.isCurrent() === true && (selected.release.securityMode !== UNMANAGED_EXEC_MODE || selected.policyObservation?.isCurrent() === true) && (lease.get(id)?.expires ?? 0) > Date.now() && [...baseline].every(([file, value]) => stamp(file) === value) && [...directories].every(([file, value]) => dirStamp(file) === value) && [...accountDirectories].every(([file, value]) => accountDirStamp(file) === value);
+                return !revoked && !!selected && !!ctx && (selected.binary !== codexStandaloneBinaryPath(input.home) || assertCodexStandaloneBinaryLocation(input.home) === selected.binary) && headObservation?.isCurrent() === true && (selected.release.securityMode !== UNMANAGED_EXEC_MODE || selected.policyObservation?.isCurrent() === true) && (lease.get(id)?.expires ?? 0) > Date.now() && [...baseline].every(([file, value]) => stamp(file) === value) && [...directories].every(([file, value]) => dirStamp(file) === value) && [...accountDirectories].every(([file, value]) => accountDirStamp(file) === value);
             }
             catch {
                 return false;

package/dist/src/safety/codex-manual-registered.js

@@ -9,18 +9,18 @@ import { measureCommandFile } from './registered-command-integrity.js';
 import { readStableText } from './stable-file-read.js';
 import { eligiblePersonalAccount } from '../adapters/codex/unmanaged-scope.js';
 import { CLAUDE_CAPABILITIES } from '../adapters/discovery.js';
-/** Compiled reviewed identity; never selected by task, environment or receipts. */
-export const CODEX_MANUAL_BINARY = '/Applications/ChatGPT.app/Contents/Resources/codex-cli/CodexCLI.app/Contents/MacOS/codex';
+import { codexStandaloneBinaryPath, verifyCodexStandaloneBinary } from './codex-standalone-binary.js';
 export const CODEX_MANUAL_NATIVE_READER = Object.freeze({ "binary": "/Library/PrivilegedHelperTools/com.mtec.ai-gateway.codex-observe.681fb12e0b83ff8fbb612dc71f9a5f5c9be5334bcfead29314ca5b979b1dd986", "sha256": "681fb12e0b83ff8fbb612dc71f9a5f5c9be5334bcfead29314ca5b979b1dd986" });
 export function registeredManualDependencies(home, codexHome) { return registeredPrelaunchDependencies(home, codexHome, 'manual_prelaunch', CODEX_EXEC_RELEASES); }
 /** Trusted compiled registration shared by manual and daemon host composition. */
 export function registeredPrelaunchDependencies(home, codexHome, mode, releases) {
-    const account = path.resolve(codexHome ?? path.join(home, '.codex')), pin = CODEX_MANUAL_NATIVE_READER;
+    const account = path.resolve(codexHome ?? path.join(home, '.codex')), pin = CODEX_MANUAL_NATIVE_READER, binary = codexStandaloneBinaryPath(home);
     if (!path.isAbsolute(home) || !pin)
         throw Error('CODEX_MANUAL_REGISTRATION_UNAVAILABLE');
     const reader = createNativeObservationReader({ accountRoot: account, backend: 'auto', keyringKind: 'direct', process: nativeMetadataProcess(pin.binary, pin.sha256), systemSource: systemPolicySource, mdmInventory: () => { throw Error('MANUAL_INVENTORY_ONLY'); } });
-    return Object.freeze({ binary: CODEX_MANUAL_BINARY, readLocal: reader.readLocal, readNativeAuth: () => reader.readAuth(), async probe() {
-            const digest = await measureCommandFile(CODEX_MANUAL_BINARY), matches = releases.filter(r => reviewedCodexExecRelease(r) && r.binarySha256 === digest && r.mdmVerification === mode && r.credentialBackend === 'auto');
+    return Object.freeze({ binary, readLocal: reader.readLocal, readNativeAuth: () => reader.readAuth(), async probe() {
+            await verifyCodexStandaloneBinary(home);
+            const digest = await measureCommandFile(binary), matches = releases.filter(r => reviewedCodexExecRelease(r) && r.binarySha256 === digest && r.mdmVerification === mode && r.credentialBackend === 'auto');
             const config = parse((await readStableText(path.join(account, 'config.toml'))).text);
             if (matches.length !== 1 || (config.cli_auth_credentials_store ?? 'auto') !== 'auto' || config.features?.secret_auth_storage === true)
                 throw Error('CODEX_MANUAL_REGISTRATION_UNAVAILABLE');

package/dist/src/safety/codex-reviewed-manual-release.js

@@ -7,11 +7,11 @@ export const REVIEWED_MANUAL_CODEX_RELEASE = {
     "policyScope": "unmanaged_personal_only",
     "managedEnforcement": "not_run",
     "executableVersion": "codex-cli 0.163.0-alpha.11",
-    "binarySha256": "8a6dc3938a2f5d30cc19c50b9ccad83a5aa2ca4a2e3411665430bb78a917220a",
+    "binarySha256": "80df47f6ca9d316c732014bc5f6e6514696fafb5593e08e064332a1d3718b466",
     "modelIds": [
         "gpt-5.6-sol"
     ],
-    "decisionId": "16d7057c-b613-45c0-92e0-05262af96d89",
+    "decisionId": "21d710f0-d8f2-4a5f-b8c5-f7412e2a2100",
     "acceptedResidualRisks": [
         "vendor_native_policy_enforcement",
         "managed_policy_not_directly_observed_per_job",
@@ -25,13 +25,13 @@ export const REVIEWED_MANUAL_CODEX_RELEASE = {
     "credentialBackend": "auto",
     "mdmVerification": "manual_prelaunch",
     "fixtureEvidence": {
-        "binary_release": "e392e2e1a577a5fb91f8cbb508ec3ebf287073a3c92389586531d81d4751b14f",
-        "official_permissions": "3c12b20dda72cc638a4109b2f25f5066f64e302a4b465e941a3188f8f51d21c1",
+        "binary_release": "00bfa3a8438d10787c6b18f6d56fde9dc37b1f4ae64c13ac723a5e472e54498a",
+        "official_permissions": "ae0906f5302344f41ae06aee053764ba98511fbd5072af81b5ec857a2d6c42c0",
         "managed_scope_exclusion": "3bb8b2ad50a44cdea5a2a3f388f8009b51d8c60d46230fb3d0b7fed0b9f7452d",
-        "required_mcp_startup": "94f51ddb832948eaeeb51040b4d5eace56f245328c356d3b9042e09080b4173c",
-        "source_exclusion": "36f4e02fee13fe4c1535f26b539cb2f15218e257ebc857c79c6b9e5676218c2b",
+        "required_mcp_startup": "d2f482b5dd5e74684d7c77652b803314b1555354970d67b795dbefcdddcf7bc2",
+        "source_exclusion": "c44cf5ca899e42349c17ea37524984eb8aa6ffe505494ff6a253b159a0cada64",
         "auth_backend_compatibility": "7c42b882a52698fef3e14b4b956ede91ed1e3b29511fbff3176387063b8d74f0"
     },
-    "fixturesFingerprint": "b0f0778c69ffade85ad0694ae39018312dfd93a7c2c1ebfd948d2d15e6d57e2d",
+    "fixturesFingerprint": "4b226b26432f92720f4b5e67156bcffab324cdd5c765d44bccef568db5e14bcc",
     "commands": []
 };

package/dist/src/safety/codex-standalone-binary.js

@@ -0,0 +1,71 @@
+import path from 'node:path';
+import { lstat, realpath } from 'node:fs/promises';
+import { lstatSync, realpathSync } from 'node:fs';
+import { measureCommandFile } from './registered-command-integrity.js';
+/** Trusted compiled artifact, not selected by config, PATH, task or receipts. */
+export const CODEX_STANDALONE_ARTIFACT = Object.freeze({
+    version: '0.163.0-alpha.11',
+    binarySha256: '80df47f6ca9d316c732014bc5f6e6514696fafb5593e08e064332a1d3718b466',
+    archiveSha256: '4ceb37d6b7b5929925e4c36aeae912f1d040a43203696129fc6b3ffe09cb452a',
+});
+const reject = () => new Error('CODEX_STANDALONE_BINARY_REJECTED');
+/** The optional identity is for trusted in-process fixture composition only.
+ * Production registration always uses the compiled default. No authority is
+ * created by resolving or measuring a path. */
+export function codexStandaloneBinaryPath(home, sha = CODEX_STANDALONE_ARTIFACT.binarySha256) {
+    if (!path.isAbsolute(home) || path.resolve(home) !== home || home === '/' || home.length > 4096 || /[\r\n\0]/.test(home) || !(/^[a-f0-9]{64}$/).test(sha))
+        throw reject();
+    return path.join(home, '.local', 'share', 'mtec-ai-local-runner', 'codex', CODEX_STANDALONE_ARTIFACT.version, sha, 'codex');
+}
+/** Rechecked by the retained per-execution current-input fence before spawn. */
+export function assertCodexStandaloneBinaryLocation(home, sha = CODEX_STANDALONE_ARTIFACT.binarySha256) {
+    try {
+        const binary = codexStandaloneBinaryPath(home, sha), uid = process.getuid?.();
+        if (uid === undefined || realpathSync(home) !== home || realpathSync(binary) !== binary)
+            throw reject();
+        let current = home;
+        const parts = ['', ...path.relative(home, binary).split(path.sep)];
+        for (let i = 0; i < parts.length; i++) {
+            current = path.join(current, parts[i]);
+            const s = lstatSync(current), last = i === parts.length - 1;
+            if (s.uid !== uid || (s.mode & 0o022) || s.isSymbolicLink() || (!last && !s.isDirectory()) || (last && (!s.isFile() || s.nlink !== 1 || !(s.mode & 0o111))))
+                throw reject();
+        }
+        return binary;
+    }
+    catch {
+        throw reject();
+    }
+}
+/** Owner-only installation chain plus existing stable no-follow file measure.
+ * This is not atomic exec against the employee owner; per-execution digest,
+ * stamp and OS confinement checks remain mandatory in the existing host. */
+export async function verifyCodexStandaloneBinary(home, sha = CODEX_STANDALONE_ARTIFACT.binarySha256) {
+    try {
+        const binary = codexStandaloneBinaryPath(home, sha), uid = process.getuid?.();
+        if (uid === undefined || await realpath(home) !== home)
+            throw reject();
+        const paths = [home];
+        let current = home;
+        for (const part of path.relative(home, binary).split(path.sep)) {
+            current = path.join(current, part);
+            paths.push(current);
+        }
+        const inspect = async () => Promise.all(paths.map(async (file, index) => {
+            const s = await lstat(file, { bigint: true }), last = index === paths.length - 1;
+            if (s.uid !== BigInt(uid) || (s.mode & 18n) !== 0n || s.isSymbolicLink() || (!last && !s.isDirectory()) || (last && (!s.isFile() || s.nlink !== 1n || (s.mode & 73n) === 0n)))
+                throw reject();
+            return { dev: s.dev, ino: s.ino, uid: s.uid, mode: s.mode };
+        }));
+        const before = await inspect();
+        if (await realpath(binary) !== binary || await measureCommandFile(binary) !== sha)
+            throw reject();
+        const after = await inspect();
+        if (after.some((s, i) => s.dev !== before[i].dev || s.ino !== before[i].ino || s.uid !== before[i].uid || s.mode !== before[i].mode) || await realpath(binary) !== binary)
+            throw reject();
+        return binary;
+    }
+    catch {
+        throw reject();
+    }
+}

package/dist/src/safety/registered-command-integrity.js

@@ -12,7 +12,9 @@ export async function measureCommandFile(file) {
             throw denied();
         const hash = createHash('sha256');
         let size = 0n;
-        for await (const chunk of fd.createReadStream({ autoClose: false })) {
+        // Rehash every byte on every call, but avoid one filesystem dispatch per
+        // 64 KiB when snapshot fences repeatedly inspect multi-megabyte executables.
+        for await (const chunk of fd.createReadStream({ autoClose: false, highWaterMark: 1024 * 1024 })) {
             size += BigInt(chunk.length);
             if (size > 512n * 1024n * 1024n)
                 throw denied();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.44",
+  "version": "0.1.46",
   "private": false,
   "license": "UNLICENSED",
   "bin": {