mtech-ai-local-runner 0.1.46 → 0.1.48

package/dist/src/daemon/runtime.js

@@ -25,7 +25,11 @@ import { SessionOpenPoller, abortableDelay } from "./session-open-poller.js";
 import { buildTerminalEvidenceCollector } from "../safety/terminal-evidence.js";
 import { packagedHookCommandParts } from "../safety/hook-command.js";
 import { composeReviewedP1Host } from '../verification/p1-host-composition.js';
+import { AskRuntime, withAsks } from '../asks/runtime.js';
 export async function buildDaemon(input) {
+    const claudeParts = [input.claudeSecurityHost, input.claudeSupportedProbe, input.claudeBinaryIdentity].filter(Boolean).length;
+    if (claudeParts !== 0 && claudeParts !== 3)
+        throw new Error('CLAUDE_SUPPORTED_HOST_REQUIRED');
     if (input.codexSupportedProbe && !input.codexSecurityHost)
         throw new Error('CODEX_SUPPORTED_HOST_REQUIRED');
     const production = !input.codexSecurityHost && !input.codexSupportedProbe ? createCodexDaemonHost({ runnerId: input.runnerId, binary: input.env.AI_GATEWAY_LOCAL_RUNNER_CODEX_BINARY ?? 'codex', home: input.env.HOME ?? '', codexHome: input.env.CODEX_HOME, searchPath: input.env.PATH }) : undefined;
@@ -41,6 +45,10 @@ export async function buildDaemon(input) {
         pendingCodexClaim.job.lease_expires_at = expiresAt;
     };
     const gateway = new McpGatewayClient({ mcpUrl: input.gatewayMcpUrl, tokenProvider: input.tokenProvider, runnerId: input.runnerId, fetchFn: input.fetchFn });
+    // AI-first ask delivery (Work Item e1c08b33) rides on the session-open loop below; it starts no executor.
+    const asks = new AskRuntime({ stateRoot: input.stateRoot, env: input.env,
+        report: (deliveryId, report, signal) => gateway.reportAskDelivery({ deliveryId, ...report }, signal),
+        log: event => { process.stderr.write(`${JSON.stringify(event)}\n`); } });
     const localFixHost = input.localFixHost ?? await loadInstalledLocalFixHost({ stateRoot: input.stateRoot, runnerId: input.runnerId, gateway });
     // A test-injected host wins; otherwise only the bundled reviewed registration can enable P1.
     let p1Host = input.p1Host;
@@ -52,11 +60,12 @@ export async function buildDaemon(input) {
     // The same parts the CLI self-test ran before starting this daemon (verifyPackagedHook).
     const hook = packagedHookCommandParts();
     const plugin = new ClaudeCodePlugin({
-        probe: async () => (await discoverAdapters(input.env, undefined, ['claude_code_cli']))[0],
+        probe: async () => input.claudeSupportedProbe ? input.claudeSupportedProbe() : (await discoverAdapters(input.env, undefined, ['claude_code_cli']))[0],
         options: ({ worktreePath, jobId }) => createClaudeCodeAdapterOptions({
             worktreePath, jobId, stateRoot: input.stateRoot, env: input.env,
             maxBudgetUsd: Number.MAX_SAFE_INTEGER, hookExecutablePath: hook.hookScriptPath, hookNodeExecutablePath: hook.nodeExecutablePath,
             binaryPath: input.env.AI_GATEWAY_LOCAL_RUNNER_CLAUDE_BINARY,
+            securityHost: input.claudeSecurityHost, binaryIdentity: input.claudeBinaryIdentity,
         }),
     });
     const codex = new CodexPlugin({
@@ -109,6 +118,23 @@ export async function buildDaemon(input) {
     const poller = new JobPoller({
         reportError: (diagnostic) => { process.stderr.write(`${JSON.stringify({ event: "poller_failed", ...diagnostic })}\n`); },
         heartbeat: async () => {
+            if (input.claudeSupportedProbe) {
+                let current;
+                try {
+                    current = await plugin.probe();
+                }
+                catch {
+                    current = { available: false, authenticated: false, capabilities: [] };
+                }
+                const ready = adapterStatus(current).authenticated && !!current.executableVersion && plugin.capabilities.every(c => current.capabilities.includes(c));
+                const index = probes.findIndex(p => p.id === 'claude_code_cli');
+                if (index >= 0)
+                    probes[index] = { id: 'claude_code_cli', version: '1', ...current, available: ready };
+                if (ready)
+                    versions.claude_code_cli = '1';
+                else
+                    delete versions.claude_code_cli;
+            }
             let current;
             try {
                 current = await codex.probe();
@@ -132,11 +158,13 @@ export async function buildDaemon(input) {
             catch {
                 sessionOpen = undefined;
             }
+            const askInbox = await asks.advertisement();
             await gateway.heartbeatLocalRunner({
                 deviceFingerprint: createHash("sha256").update(`${process.getuid?.() ?? 0}|${runnerDisplayName()}|${input.gatewayMcpUrl}`).digest("hex"),
                 displayName: runnerDisplayName(), packageVersion: packageVersion(),
                 capabilities: localRunnerCapabilities(probes, !!localFixHost, localFixHost?.verificationMode),
-                ...(sessionOpen ? { sessionOpen } : {}),
+                mode: "full",
+                ...(sessionOpen ? { sessionOpen: { ...sessionOpen, ...(askInbox ? { ask_inbox: askInbox } : {}) } } : {}),
             });
         },
         wait: async () => {
@@ -162,7 +190,11 @@ export async function buildDaemon(input) {
     });
     const opener = new SessionOpener({ home: input.env.HOME ?? "" });
     const sessionOpens = new SessionOpenPoller({
-        wait: signal => gateway.waitForSessionOpens(25, signal),
+        wait: async (signal) => {
+            const result = await gateway.waitForSessionOpens(25, signal);
+            await asks.handleWait(result);
+            return result;
+        },
         open: request => opener.open(request),
         report: async (openId, result, signal) => {
             await gateway.reportSessionOpen({ openId, status: result.status, surface: result.surface,
@@ -183,7 +215,7 @@ export async function buildDaemon(input) {
                 return;
             throw new Error('Runner state requires authoritative reconciliation');
         },
-        poller, sessionOpens,
+        poller, sessionOpens: withAsks(asks, sessionOpens),
         reportRecoveryRequired: reason => { process.stderr.write(`${JSON.stringify({ event: 'runner_recovery_required', reason })}\n`); },
     });
     // Model tools have no Gateway relay. Each adapter owns and closes its job endpoint.

package/dist/src/gateway-client.js

@@ -431,9 +431,10 @@ export class McpGatewayClient {
             display_name: input.displayName,
             package_version: input.packageVersion,
             capabilities: input.capabilities,
+            ...(input.mode ? { mode: input.mode } : {}),
         });
     }
-    async heartbeatLocalRunner(input) {
+    async heartbeatLocalRunner(input, signal) {
         return this.callTool("local_agent_runner_heartbeat", {
             runner_id: this.runnerId,
             runner: {
@@ -441,9 +442,10 @@ export class McpGatewayClient {
                 display_name: input.displayName,
                 package_version: input.packageVersion,
                 capabilities: input.capabilities,
+                ...(input.mode ? { mode: input.mode } : {}),
                 ...(input.sessionOpen ? { session_open: input.sessionOpen } : {}),
             },
-        });
+        }, signal);
     }
     async waitForSessionOpens(waitSeconds = 25, signal) {
         const result = await this.callTool("local_agent_session_opens_wait", {
@@ -453,7 +455,20 @@ export class McpGatewayClient {
         // The Gateway asks for a longer pause while session open is off. Only a sane whole number of seconds is honoured.
         const retryAfter = result?.retry_after_seconds;
         const retryAfterSeconds = typeof retryAfter === "number" && Number.isInteger(retryAfter) && retryAfter >= 1 && retryAfter <= 3600 ? retryAfter : undefined;
-        return { opens: Array.isArray(result?.opens) ? result.opens : [], retryAfterSeconds };
+        return { opens: Array.isArray(result?.opens) ? result.opens : [], retryAfterSeconds,
+            // AI-first ask delivery (Work Item e1c08b33): ids only, present while the Gateway's switch is on.
+            ...(Array.isArray(result?.ask_deliveries) ? { askDeliveries: result.ask_deliveries } : {}),
+            ...(Array.isArray(result?.closed_delivery_ids) ? { closedDeliveryIds: result.closed_delivery_ids } : {}) };
+    }
+    /** Reports one delivery's progress. No session id, cwd, prompt or other text is ever sent. */
+    async reportAskDelivery(input, signal) {
+        return this.callTool("local_agent_ask_delivery_report", {
+            runner_id: this.runnerId,
+            delivery_id: input.deliveryId,
+            event: input.event,
+            ...(input.via ? { via: input.via } : {}),
+            ...(input.app ? { app: input.app } : {}),
+        }, signal);
     }
     async reportSessionOpen(input, signal) {
         return this.callTool("local_agent_session_open_report", {

package/dist/src/registration/local-config.js

@@ -1,6 +1,10 @@
 import { chmod, mkdir, open, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { isAbsolute, join } from "node:path";
 import { randomBytes } from "node:crypto";
+/** The mode a stored configuration runs in (Work Item e1c08b33): a missing mode is a full runner. */
+export function runnerMode(config) {
+    return config.mode ?? "full";
+}
 export class FileLocalConfigStore {
     stateRoot;
     filePath;
@@ -49,8 +53,9 @@ export class FileLocalConfigStore {
             || typeof candidate.workspaceRoot !== "string"
             || !isAbsolute(candidate.workspaceRoot)
             || candidate.concurrency !== 1
+            || (candidate.mode !== undefined && candidate.mode !== "full" && candidate.mode !== "messenger")
             || Object.keys(candidate).some((key) => ![
-                "schemaVersion", "gatewayMcpUrl", "runnerId", "workspaceRoot", "concurrency",
+                "schemaVersion", "gatewayMcpUrl", "runnerId", "workspaceRoot", "concurrency", "mode",
             ].includes(key))) {
             return null;
         }
@@ -60,6 +65,7 @@ export class FileLocalConfigStore {
             runnerId: candidate.runnerId,
             workspaceRoot: candidate.workspaceRoot,
             concurrency: 1,
+            ...(candidate.mode === undefined ? {} : { mode: candidate.mode }),
         };
     }
 }

package/dist/src/safety/claude-binary-identity.js

@@ -0,0 +1,81 @@
+import path from 'node:path';
+import { lstat, realpath, readlink } from 'node:fs/promises';
+import { measureCommandFile } from './registered-command-integrity.js';
+const live = new WeakMap();
+const rejected = () => Error('CLAUDE_BINARY_IDENTITY_REJECTED');
+const inside = (root, file) => file === root || file.startsWith(root + path.sep);
+const validPath = (value) => typeof value === 'string' && path.isAbsolute(value) && path.resolve(value) === value && value !== '/' && value.length <= 4096 && !/[\r\n\0]/.test(value);
+/** Measurement only, never a release certificate or atomic path-based exec.
+ * Explicit roots are supplied by the trusted host, not task/config JSON. */
+async function measure(input) {
+    if (!validPath(input.launchPath) || !Array.isArray(input.allowedRoots) || !input.allowedRoots.length || input.allowedRoots.length > 8 || !input.allowedRoots.every(validPath))
+        throw rejected();
+    const roots = [...new Set(input.allowedRoots)], uid = process.getuid?.();
+    if (uid === undefined)
+        throw rejected();
+    for (const root of roots) {
+        const s = await lstat(root, { bigint: true });
+        if (await realpath(root) !== root || !s.isDirectory() || (s.mode & 18n) !== 0n || (s.uid !== BigInt(uid) && s.uid !== 0n))
+            throw rejected();
+    }
+    const allowed = (file) => roots.some(root => inside(root, file));
+    const target = await realpath(input.launchPath);
+    if (!allowed(input.launchPath) || !allowed(target))
+        throw rejected();
+    const inspect = async () => {
+        const stamps = [];
+        for (const file of [...new Set([input.launchPath, target])]) {
+            const root = roots.filter(r => inside(r, file)).sort((a, b) => b.length - a.length)[0];
+            const parts = [root];
+            let current = root;
+            for (const part of path.relative(root, file).split(path.sep).filter(Boolean)) {
+                current = path.join(current, part);
+                parts.push(current);
+            }
+            for (let i = 0; i < parts.length; i++) {
+                const name = parts[i], s = await lstat(name, { bigint: true }), link = s.isSymbolicLink(), last = i === parts.length - 1;
+                if ((s.uid !== BigInt(uid) && s.uid !== 0n) || (!link && (s.mode & 18n) !== 0n) || !allowed(await realpath(name))
+                    || (!last && !s.isDirectory() && !link) || (last && !link && (!s.isFile() || s.nlink !== 1n || (s.mode & 73n) === 0n)))
+                    throw rejected();
+                stamps.push([name, s.dev.toString(), s.ino.toString(), s.uid.toString(), s.mode.toString(), link ? await readlink(name) : null,
+                    last || link ? s.mtimeNs.toString() : null, last || link ? s.ctimeNs.toString() : null, last ? s.nlink.toString() : null]);
+            }
+        }
+        if (await realpath(input.launchPath) !== target)
+            throw rejected();
+        return JSON.stringify(stamps);
+    };
+    const before = await inspect(), sha256 = await measureCommandFile(target), after = await inspect();
+    if (before !== after)
+        throw rejected();
+    return { sha256, stamp: after };
+}
+export async function captureClaudeBinaryIdentity(input) {
+    try {
+        const copy = structuredClone(input), measured = await measure(copy), identity = Object.freeze({ sha256: measured.sha256 });
+        live.set(identity, { input: copy, measured });
+        return identity;
+    }
+    catch {
+        throw rejected();
+    }
+}
+export function claudeBinaryLaunchPath(identity) {
+    const value = live.get(identity);
+    if (!value)
+        throw rejected();
+    return value.input.launchPath;
+}
+export async function assertCurrentClaudeBinary(identity, launchPath, sha256) {
+    try {
+        const value = live.get(identity);
+        if (!value || launchPath !== value.input.launchPath || sha256 !== value.measured.sha256)
+            throw rejected();
+        const current = await measure(value.input);
+        if (current.sha256 !== sha256 || current.stamp !== value.measured.stamp)
+            throw rejected();
+    }
+    catch {
+        throw rejected();
+    }
+}

package/dist/src/safety/local-edit-content.js

@@ -0,0 +1,14 @@
+/** local_edit accepts the complete replacement file, never an edit script.
+ * Pure function: the identical predicate is embedded in the isolated worker.
+ * Ordinary source strings and YAML separators are not patch headers. */
+export function isPatchContent(content) {
+    const lines = content.replace(/^\uFEFF/, '').split(/\r?\n/);
+    return lines.some((line, index) => {
+        const value = line.trimStart();
+        return /^\*\*\* (?:Begin Patch|End Patch|End of File|(?:Update|Add|Delete) File:|Move to:)(?:\s|$)/.test(value)
+            || /^@@(?:\s|$)/.test(value)
+            || /^diff --git\s/.test(value)
+            || /^(?:--- (?:a\/|\/dev\/null)|\+\+\+ (?:b\/|\/dev\/null))/.test(value)
+            || /^---[ \t]+\S/.test(value) && /^\+\+\+[ \t]+\S/.test(lines[index + 1]?.trimStart() ?? '');
+    });
+}

package/dist/src/safety/local-tool-policy.js

@@ -1,3 +1,4 @@
+import { isPatchContent } from './local-edit-content.js';
 import path from 'node:path';
 import { randomBytes } from 'node:crypto';
 import { lstat, realpath } from 'node:fs/promises';
@@ -46,6 +47,8 @@ export class LocalToolPolicy {
         const file = await this.authorizedFile(input.path, tool === 'local_edit');
         if (tool === 'local_edit' && (typeof input.content !== 'string' || Buffer.byteLength(input.content) > 1024 * 1024))
             throw new Error('DENIED_CONTENT');
+        if (tool === 'local_edit' && isPatchContent(input.content))
+            throw new Error('DENIED_PATCH_CONTENT');
         if (tool === 'local_search' && (typeof input.query !== 'string' || input.query.length > 4096))
             throw new Error('DENIED_QUERY');
         const temp = file + '.runner-edit-' + randomBytes(16).toString('hex');

package/dist/src/safety/local-tool-server.js

@@ -23,12 +23,12 @@ const MAX_BODY = 1024 * 1024;
 const schemas = {
     local_read: { type: 'object', properties: { path: { type: 'string' } }, required: ['path'], additionalProperties: false },
     local_search: { type: 'object', properties: { path: { type: 'string' }, query: { type: 'string' } }, required: ['path', 'query'], additionalProperties: false },
-    local_edit: { type: 'object', properties: { path: { type: 'string' }, content: { type: 'string' } }, required: ['path', 'content'], additionalProperties: false },
+    local_edit: { type: 'object', properties: { path: { type: 'string' }, content: { type: 'string', description: 'The complete new contents of the entire file. Do not send a diff, patch, hunk, or edit instructions.' } }, required: ['path', 'content'], additionalProperties: false },
     local_test: { type: 'object', properties: { command: { type: 'string' } }, required: ['command'], additionalProperties: false },
 };
 /** Same immutable-by-copy inventory used by native admission and MCP discovery. */
 export function localToolInventory() {
-    return LOCAL_TOOL_NAMES.map(name => ({ name, description: `Scoped ${name} operation`, inputSchema: structuredClone(schemas[name]) }));
+    return LOCAL_TOOL_NAMES.map(name => ({ name, description: name === 'local_edit' ? 'Replace the entire file at path with content (or create it). Read the current file first and include all unchanged text in content. This is not a diff or patch tool; patch headers and hunks are rejected.' : `Scoped ${name} operation`, inputSchema: structuredClone(schemas[name]) }));
 }
 /** Job-only JSON MCP endpoint; intentionally has no Gateway transport or discovery. */
 export class LocalToolServer {

package/dist/src/safety/local-tool-worker.js

@@ -1,7 +1,10 @@
+import { isPatchContent } from './local-edit-content.js';
 /** Standalone worker: --eval avoids ambient module/config lookup. All paths are host-supplied. */
 export const LOCAL_TOOL_WORKER = String.raw `
 const fs = require('node:fs');
 const input = JSON.parse(process.argv[1]);
+const isPatchContent = ${isPatchContent.toString()};
+if (input.tool === 'local_edit' && isPatchContent(input.content)) throw Error('DENIED_PATCH_CONTENT');
 let current = '';
 for (const part of input.path.split('/').filter(Boolean)) {
   current += '/' + part;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.46",
+  "version": "0.1.48",
   "private": false,
   "license": "UNLICENSED",
   "bin": {