mtech-ai-local-runner 0.1.47 → 0.1.49

package/dist/src/daemon/job-runner.js

@@ -0,0 +1,99 @@
+export class JobRunner {
+    deps;
+    armed = false;
+    busy = false;
+    pending = false;
+    stopped = false;
+    inFlight;
+    release;
+    done = new Promise(resolve => { this.release = resolve; });
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /** True while a claim or a job is in progress. */
+    get running() {
+        return this.busy;
+    }
+    /**
+     * True while this runner may claim: after run() started and before stop(). A runner that does not accept jobs
+     * (still reconciling, or suspended after an unknown outcome) must not look ready to the Gateway.
+     */
+    get accepting() {
+        return this.armed && !this.stopped;
+    }
+    notify() {
+        if (this.stopped)
+            return;
+        if (!this.armed || this.busy) {
+            this.pending = true;
+            return;
+        }
+        this.start();
+    }
+    async run() {
+        // A pending promise alone does not keep Node alive; this referenced timer does until stop().
+        const keepAlive = setInterval(() => undefined, 60_000);
+        try {
+            this.armed = true;
+            if (!this.stopped) {
+                try {
+                    this.deps.onArmed?.();
+                }
+                catch { /* Telling the Gateway is best effort; claims still start. */ }
+            }
+            if (this.pending && !this.stopped) {
+                this.pending = false;
+                this.start();
+            }
+            await this.done;
+            // Like the old poll loop, run() ends only after the claim or job in progress has finished.
+            await this.inFlight;
+        }
+        finally {
+            clearInterval(keepAlive);
+        }
+    }
+    stop() {
+        if (this.stopped)
+            return;
+        this.stopped = true;
+        this.release();
+    }
+    start() {
+        const cycle = this.cycle();
+        this.inFlight = cycle;
+        void cycle.finally(() => { if (this.inFlight === cycle)
+            this.inFlight = undefined; });
+    }
+    async cycle() {
+        this.busy = true;
+        let stage = "claim";
+        try {
+            const claim = await this.deps.claim();
+            if (claim.status === "claimed" && claim.job !== undefined && !this.stopped) {
+                stage = "execute";
+                await this.deps.execute(claim.job);
+                this.deps.requestSync("after_job");
+            }
+        }
+        catch {
+            try {
+                this.deps.reportError?.({ stage, code: stage === "execute" ? "EXECUTION_UNACKNOWLEDGED" : "GATEWAY_UNAVAILABLE" });
+            }
+            catch { /* Observational logging cannot bypass the stop below or discard recovery state. */ }
+            // Unknown execution or terminal outcomes must reconcile before any new claim.
+            if (stage === "execute") {
+                this.busy = false;
+                this.stop();
+                return;
+            }
+        }
+        finally {
+            this.busy = false;
+        }
+        if (this.pending && !this.stopped) {
+            this.pending = false;
+            this.start();
+        }
+    }
+}

package/dist/src/daemon/runtime.js

@@ -17,14 +17,20 @@ import { WorkspaceManager } from "../workspace/workspace-manager.js";
 import { GitClient } from "../workspace/git-client.js";
 import { FileDaemonStateStore } from "../state-store.js";
 import { ExecutionCoordinator } from "./execution-coordinator.js";
-import { JobPoller } from "./job-poller.js";
+import { JobRunner } from "./job-runner.js";
+import { HeartbeatScheduler } from "./heartbeat-scheduler.js";
 import { ProcessLock } from "./process-lock.js";
 import { Daemon } from "./daemon.js";
 import { SessionOpener, sessionOpenAdvertisement } from "./session-opener.js";
-import { SessionOpenPoller, abortableDelay } from "./session-open-poller.js";
+import { RunnerTransport } from "../transport/runner-transport.js";
+import { ReverbSocket } from "../transport/reverb-socket.js";
+import { PendingClosureAcks, createSyncDispatcher } from "../transport/sync-dispatch.js";
+import { abortableDelay } from "../transport/abortable-delay.js";
+import { sideLoops } from "../transport/side-loops.js";
 import { buildTerminalEvidenceCollector } from "../safety/terminal-evidence.js";
 import { packagedHookCommandParts } from "../safety/hook-command.js";
 import { composeReviewedP1Host } from '../verification/p1-host-composition.js';
+import { AskRuntime, withAsks } from '../asks/runtime.js';
 export async function buildDaemon(input) {
     const claudeParts = [input.claudeSecurityHost, input.claudeSupportedProbe, input.claudeBinaryIdentity].filter(Boolean).length;
     if (claudeParts !== 0 && claudeParts !== 3)
@@ -44,6 +50,10 @@ export async function buildDaemon(input) {
         pendingCodexClaim.job.lease_expires_at = expiresAt;
     };
     const gateway = new McpGatewayClient({ mcpUrl: input.gatewayMcpUrl, tokenProvider: input.tokenProvider, runnerId: input.runnerId, fetchFn: input.fetchFn });
+    // AI-first ask delivery (Work Item e1c08b33) rides on the session-open loop below; it starts no executor.
+    const asks = new AskRuntime({ stateRoot: input.stateRoot, env: input.env,
+        report: (deliveryId, report, signal) => gateway.reportAskDelivery({ deliveryId, ...report }, signal),
+        log: event => { process.stderr.write(`${JSON.stringify(event)}\n`); } });
     const localFixHost = input.localFixHost ?? await loadInstalledLocalFixHost({ stateRoot: input.stateRoot, runnerId: input.runnerId, gateway });
     // A test-injected host wins; otherwise only the bundled reviewed registration can enable P1.
     let p1Host = input.p1Host;
@@ -110,58 +120,15 @@ export async function buildDaemon(input) {
         workspaces: new WorkspaceManager({ root: input.workspaceRoot, git: new GitClient() }),
         state,
     });
-    const poller = new JobPoller({
+    let transport;
+    /** The adapter probe in progress, if any: a claim waits for it, so versions never change under a claim. */
+    let probing = Promise.resolve();
+    const poller = new JobRunner({
         reportError: (diagnostic) => { process.stderr.write(`${JSON.stringify({ event: "poller_failed", ...diagnostic })}\n`); },
-        heartbeat: async () => {
-            if (input.claudeSupportedProbe) {
-                let current;
-                try {
-                    current = await plugin.probe();
-                }
-                catch {
-                    current = { available: false, authenticated: false, capabilities: [] };
-                }
-                const ready = adapterStatus(current).authenticated && !!current.executableVersion && plugin.capabilities.every(c => current.capabilities.includes(c));
-                const index = probes.findIndex(p => p.id === 'claude_code_cli');
-                if (index >= 0)
-                    probes[index] = { id: 'claude_code_cli', version: '1', ...current, available: ready };
-                if (ready)
-                    versions.claude_code_cli = '1';
-                else
-                    delete versions.claude_code_cli;
-            }
-            let current;
-            try {
-                current = await codex.probe();
-            }
-            catch {
-                current = { available: false, authenticated: false, capabilities: [] };
-            }
-            const ready = adapterStatus(current).authenticated && !!current.executableVersion && codex.capabilities.every(c => current.capabilities.includes(c));
-            const index = probes.findIndex(p => p.id === 'codex_cli');
-            if (index >= 0)
-                probes[index] = { id: 'codex_cli', version: '1', ...current, available: ready };
-            if (ready)
-                versions.codex_cli = '1';
-            else
-                delete versions.codex_cli;
-            let sessionOpen;
-            // A detection error must not stop job claims: the heartbeat simply omits the field.
-            try {
-                sessionOpen = await sessionOpenAdvertisement({ home: input.env.HOME ?? "" });
-            }
-            catch {
-                sessionOpen = undefined;
-            }
-            await gateway.heartbeatLocalRunner({
-                deviceFingerprint: createHash("sha256").update(`${process.getuid?.() ?? 0}|${runnerDisplayName()}|${input.gatewayMcpUrl}`).digest("hex"),
-                displayName: runnerDisplayName(), packageVersion: packageVersion(),
-                capabilities: localRunnerCapabilities(probes, !!localFixHost, localFixHost?.verificationMode),
-                ...(sessionOpen ? { sessionOpen } : {}),
-            });
-        },
-        wait: async () => {
-            const claim = await gateway.waitForLocalJob(versions, 25);
+        // Push transport (Work Item 25d8ea74): claimed only when a sync says a job is claimable, with no wait.
+        claim: async () => {
+            await probing;
+            const claim = await gateway.waitForLocalJob(versions, 0);
             if (claim.status !== "claimed" || !claim.job || !claim.task_package || !claim.lease_token || !claim.launch_grant)
                 return { status: "no_job" };
             if (production && claim.task_package.runtime_adapter === 'codex_cli')
@@ -179,19 +146,107 @@ export async function buildDaemon(input) {
         execute: async (job) => {
             await coordinator.execute(job);
         },
-        delay: (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)),
+        requestSync: reason => { transport?.requestSync(reason); },
+        // Until now the heartbeat said this runner takes no jobs; tell the Gateway at once, and ask whether one waits.
+        onArmed: () => { void heartbeats.tick(); transport?.requestSync("start"); },
+    });
+    const heartbeats = new HeartbeatScheduler({
+        intervalMs: 30_000,
+        snapshot: async () => {
+            // Adapter probes run only between jobs, as they did when the job loop sent the heartbeat.
+            if (!poller.running) {
+                const probe = (async () => {
+                    if (input.claudeSupportedProbe) {
+                        let current;
+                        try {
+                            current = await plugin.probe();
+                        }
+                        catch {
+                            current = { available: false, authenticated: false, capabilities: [] };
+                        }
+                        const ready = adapterStatus(current).authenticated && !!current.executableVersion && plugin.capabilities.every(c => current.capabilities.includes(c));
+                        const index = probes.findIndex(p => p.id === 'claude_code_cli');
+                        if (index >= 0)
+                            probes[index] = { id: 'claude_code_cli', version: '1', ...current, available: ready };
+                        if (ready)
+                            versions.claude_code_cli = '1';
+                        else
+                            delete versions.claude_code_cli;
+                    }
+                    let current;
+                    try {
+                        current = await codex.probe();
+                    }
+                    catch {
+                        current = { available: false, authenticated: false, capabilities: [] };
+                    }
+                    const ready = adapterStatus(current).authenticated && !!current.executableVersion && codex.capabilities.every(c => current.capabilities.includes(c));
+                    const index = probes.findIndex(p => p.id === 'codex_cli');
+                    if (index >= 0)
+                        probes[index] = { id: 'codex_cli', version: '1', ...current, available: ready };
+                    if (ready)
+                        versions.codex_cli = '1';
+                    else
+                        delete versions.codex_cli;
+                })();
+                probing = probe.catch(() => undefined);
+                await probe;
+            }
+            let sessionOpen;
+            // A detection error must not stop job claims: the heartbeat simply omits the field.
+            try {
+                sessionOpen = await sessionOpenAdvertisement({ home: input.env.HOME ?? "" });
+            }
+            catch {
+                sessionOpen = undefined;
+            }
+            const askInbox = await asks.advertisement();
+            return {
+                deviceFingerprint: createHash("sha256").update(`${process.getuid?.() ?? 0}|${runnerDisplayName()}|${input.gatewayMcpUrl}`).digest("hex"),
+                displayName: runnerDisplayName(), packageVersion: packageVersion(),
+                capabilities: acceptingJobs(localRunnerCapabilities(probes, !!localFixHost, localFixHost?.verificationMode), poller.accepting),
+                mode: "full",
+                ...(sessionOpen ? { sessionOpen: { ...sessionOpen, ...(askInbox ? { ask_inbox: askInbox } : {}) } } : {}),
+            };
+        },
+        send: async (payload) => { await gateway.heartbeatLocalRunner(payload); },
+        reportError: code => { process.stderr.write(`${JSON.stringify({ event: "heartbeat_failed", code })}\n`); },
     });
+    const stopping = new AbortController();
+    const closureAcks = new PendingClosureAcks();
     const opener = new SessionOpener({ home: input.env.HOME ?? "" });
-    const sessionOpens = new SessionOpenPoller({
-        wait: signal => gateway.waitForSessionOpens(25, signal),
+    const dispatch = createSyncDispatcher({
         open: request => opener.open(request),
         report: async (openId, result, signal) => {
             await gateway.reportSessionOpen({ openId, status: result.status, surface: result.surface,
                 failureCode: result.status === "failed" ? result.failureCode : undefined }, signal);
         },
+        asks,
+        closureAcks,
+        jobs: poller,
         delay: abortableDelay,
+        signal: stopping.signal,
         reportError: diagnostic => { process.stderr.write(`${JSON.stringify({ event: "session_open_poller_failed", ...diagnostic })}\n`); },
     });
+    const pushTransport = new RunnerTransport({
+        sync: async (reason, signal) => {
+            const acknowledged = closureAcks.take();
+            // A runner that takes no jobs right now (reconciling, or suspended for recovery) names no adapter.
+            try {
+                return await gateway.syncRunner({ adapterVersions: poller.accepting ? versions : {}, reason, acknowledgedClosureIds: acknowledged }, signal);
+            }
+            catch (error) {
+                closureAcks.restore(acknowledged);
+                throw error;
+            }
+        },
+        authorize: (socketId, signal) => gateway.authorizeRunnerChannel(socketId, signal),
+        dispatch,
+        openSocket: (target, events) => new ReverbSocket(target, events, { packageVersion: packageVersion() }),
+        report: event => { process.stderr.write(`${JSON.stringify(event)}\n`); },
+    });
+    transport = pushTransport;
+    const sessionOpens = sideLoops({ heartbeat: heartbeats, transport: pushTransport, onStop: () => stopping.abort() });
     const daemon = new Daemon({
         lock: new ProcessLock(join(input.stateRoot, "daemon.lock")), state,
         reconcile: async (stored) => {
@@ -204,13 +259,27 @@ export async function buildDaemon(input) {
                 return;
             throw new Error('Runner state requires authoritative reconciliation');
         },
-        poller, sessionOpens,
+        poller, sessionOpens: withAsks(asks, sessionOpens),
         reportRecoveryRequired: reason => { process.stderr.write(`${JSON.stringify({ event: 'runner_recovery_required', reason })}\n`); },
     });
     // Model tools have no Gateway relay. Each adapter owns and closes its job endpoint.
     return { daemon, close: async () => { daemon.stop(); await production?.close(); } };
 }
 export function runnerDisplayName() { return `${hostname()} local AI`; }
+/** The execution blocker a full runner reports for every adapter while it takes no jobs. */
+export const RUNNER_NOT_ACCEPTING_JOBS = "RUNNER_NOT_ACCEPTING_JOBS";
+/*
+ * Work Item 25d8ea74: sync keeps presence fresh even while the daemon reconciles or is suspended for recovery, which
+ * the old job loop's heartbeat never did. So the heartbeat itself must say the runner takes no jobs, or the Gateway
+ * would route a job to a runner that never claims it. The Gateway requires at least one capability from a full
+ * runner, so each adapter is reported blocked, with this code, instead of being left out.
+ */
+export function acceptingJobs(capabilities, accepting) {
+    if (accepting)
+        return capabilities;
+    return capabilities.map(capability => ({ ...capability, authenticated: false, execution_status: "blocked",
+        execution_reason_codes: [...new Set([RUNNER_NOT_ACCEPTING_JOBS, ...capability.execution_reason_codes])].slice(0, 20) }));
+}
 /** Unknown mutation outcomes halt polling; known failures replay only their terminal receipt. */
 export async function reconcilePreparationState(previous, deps) {
     if (["publication_pending", "publication_terminal_pending"].includes(previous.phase ?? ""))

package/dist/src/gateway-client.js

@@ -12,6 +12,51 @@ export class GatewayToolError extends Error {
         this.code = code;
     }
 }
+const PUSH_CHANNEL = /^private-ai-gateway\.[a-z0-9_-]{1,32}\.runner\.[a-z0-9:_-]{1,128}$/;
+const PUSH_APP_KEY = /^[A-Za-z0-9_-]{1,128}$/;
+const CHANNEL_AUTH = /^[^:\s]{1,128}:[a-f0-9]{64}$/;
+/*
+ * A sync result without the ask keys ends every stored delivery (the e1c08b33 kill switch), so a result that is not
+ * clearly a sync answer is refused instead of being read as "asks off": the transport retries it with backoff.
+ */
+export function parseRunnerSync(result, runnerId) {
+    const body = result && typeof result === "object" && !Array.isArray(result) ? result : undefined;
+    const malformed = (key) => body !== undefined && body[key] !== undefined && !Array.isArray(body[key]);
+    if (body === undefined || !Array.isArray(body.opens) || malformed("ask_deliveries") || malformed("closed_delivery_ids")) {
+        throw new GatewayToolError("Gateway returned an invalid runner sync result", "local_agent_runner_sync", "GATEWAY_INVALID_TOOL_RESULT");
+    }
+    return {
+        opens: body.opens,
+        ...(Array.isArray(body.ask_deliveries) ? { askDeliveries: body.ask_deliveries } : {}),
+        ...(Array.isArray(body.closed_delivery_ids) ? { closedDeliveryIds: body.closed_delivery_ids } : {}),
+        jobAvailable: body.job_available === true,
+        push: parsePush(body.push, runnerId),
+        syncSeconds: clampSeconds(body.sync_seconds, 15, 120, 30),
+        fallbackSyncSeconds: clampSeconds(body.fallback_sync_seconds, 5, 30, 8),
+    };
+}
+function clampSeconds(value, min, max, fallback) {
+    return typeof value === "number" && Number.isInteger(value) ? Math.min(max, Math.max(min, value)) : fallback;
+}
+function parsePush(value, runnerId) {
+    if (!value || typeof value !== "object")
+        return null;
+    const { url, app_key: appKey, channel, event } = value;
+    if (typeof url !== "string" || typeof appKey !== "string" || typeof channel !== "string" || event !== "runner.sync")
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.protocol !== "wss:" || !PUSH_APP_KEY.test(appKey) || !PUSH_CHANNEL.test(channel))
+        return null;
+    if (!channel.endsWith(`.runner.${runnerId.toLowerCase()}`))
+        return null;
+    return { url, appKey, channel, event };
+}
 function nested(value, path) {
     return path.split(".").reduce((current, key) => {
         if (!current || typeof current !== "object")
@@ -431,9 +476,10 @@ export class McpGatewayClient {
             display_name: input.displayName,
             package_version: input.packageVersion,
             capabilities: input.capabilities,
+            ...(input.mode ? { mode: input.mode } : {}),
         });
     }
-    async heartbeatLocalRunner(input) {
+    async heartbeatLocalRunner(input, signal) {
         return this.callTool("local_agent_runner_heartbeat", {
             runner_id: this.runnerId,
             runner: {
@@ -441,9 +487,10 @@ export class McpGatewayClient {
                 display_name: input.displayName,
                 package_version: input.packageVersion,
                 capabilities: input.capabilities,
+                ...(input.mode ? { mode: input.mode } : {}),
                 ...(input.sessionOpen ? { session_open: input.sessionOpen } : {}),
             },
-        });
+        }, signal);
     }
     async waitForSessionOpens(waitSeconds = 25, signal) {
         const result = await this.callTool("local_agent_session_opens_wait", {
@@ -453,7 +500,20 @@ export class McpGatewayClient {
         // The Gateway asks for a longer pause while session open is off. Only a sane whole number of seconds is honoured.
         const retryAfter = result?.retry_after_seconds;
         const retryAfterSeconds = typeof retryAfter === "number" && Number.isInteger(retryAfter) && retryAfter >= 1 && retryAfter <= 3600 ? retryAfter : undefined;
-        return { opens: Array.isArray(result?.opens) ? result.opens : [], retryAfterSeconds };
+        return { opens: Array.isArray(result?.opens) ? result.opens : [], retryAfterSeconds,
+            // AI-first ask delivery (Work Item e1c08b33): ids only, present while the Gateway's switch is on.
+            ...(Array.isArray(result?.ask_deliveries) ? { askDeliveries: result.ask_deliveries } : {}),
+            ...(Array.isArray(result?.closed_delivery_ids) ? { closedDeliveryIds: result.closed_delivery_ids } : {}) };
+    }
+    /** Reports one delivery's progress. No session id, cwd, prompt or other text is ever sent. */
+    async reportAskDelivery(input, signal) {
+        return this.callTool("local_agent_ask_delivery_report", {
+            runner_id: this.runnerId,
+            delivery_id: input.deliveryId,
+            event: input.event,
+            ...(input.via ? { via: input.via } : {}),
+            ...(input.app ? { app: input.app } : {}),
+        }, signal);
     }
     async reportSessionOpen(input, signal) {
         return this.callTool("local_agent_session_open_report", {
@@ -464,6 +524,27 @@ export class McpGatewayClient {
             ...(input.failureCode ? { failure_code: input.failureCode } : {}),
         }, signal);
     }
+    /** acknowledgedClosureIds: closures handled since the last sync; the Gateway lists each again until acknowledged. */
+    async syncRunner(input, signal) {
+        const acknowledged = (input.acknowledgedClosureIds ?? []).slice(0, 50);
+        const result = await this.callTool("local_agent_runner_sync", {
+            runner_id: this.runnerId,
+            adapter_versions: input.adapterVersions,
+            reason: input.reason,
+            ...(acknowledged.length > 0 ? { acknowledged_closure_ids: acknowledged } : {}),
+        }, signal);
+        return parseRunnerSync(result, this.runnerId);
+    }
+    async authorizeRunnerChannel(socketId, signal) {
+        const result = await this.callTool("local_agent_runner_channel_auth", {
+            runner_id: this.runnerId,
+            socket_id: socketId,
+        }, signal);
+        if (typeof result?.channel !== "string" || typeof result.auth !== "string" || !CHANNEL_AUTH.test(result.auth)) {
+            throw new GatewayToolError("Gateway returned an invalid channel authorization", "local_agent_runner_channel_auth", "GATEWAY_INVALID_TOOL_RESULT");
+        }
+        return { channel: result.channel, auth: result.auth };
+    }
     async localRunnerStatus() {
         return this.callTool("local_agent_runner_status", { runner_id: this.runnerId });
     }

package/dist/src/registration/local-config.js

@@ -1,6 +1,10 @@
 import { chmod, mkdir, open, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { isAbsolute, join } from "node:path";
 import { randomBytes } from "node:crypto";
+/** The mode a stored configuration runs in (Work Item e1c08b33): a missing mode is a full runner. */
+export function runnerMode(config) {
+    return config.mode ?? "full";
+}
 export class FileLocalConfigStore {
     stateRoot;
     filePath;
@@ -49,8 +53,9 @@ export class FileLocalConfigStore {
             || typeof candidate.workspaceRoot !== "string"
             || !isAbsolute(candidate.workspaceRoot)
             || candidate.concurrency !== 1
+            || (candidate.mode !== undefined && candidate.mode !== "full" && candidate.mode !== "messenger")
             || Object.keys(candidate).some((key) => ![
-                "schemaVersion", "gatewayMcpUrl", "runnerId", "workspaceRoot", "concurrency",
+                "schemaVersion", "gatewayMcpUrl", "runnerId", "workspaceRoot", "concurrency", "mode",
             ].includes(key))) {
             return null;
         }
@@ -60,6 +65,7 @@ export class FileLocalConfigStore {
             runnerId: candidate.runnerId,
             workspaceRoot: candidate.workspaceRoot,
             concurrency: 1,
+            ...(candidate.mode === undefined ? {} : { mode: candidate.mode }),
         };
     }
 }

package/dist/src/safety/local-edit-content.js

@@ -0,0 +1,14 @@
+/** local_edit accepts the complete replacement file, never an edit script.
+ * Pure function: the identical predicate is embedded in the isolated worker.
+ * Ordinary source strings and YAML separators are not patch headers. */
+export function isPatchContent(content) {
+    const lines = content.replace(/^\uFEFF/, '').split(/\r?\n/);
+    return lines.some((line, index) => {
+        const value = line.trimStart();
+        return /^\*\*\* (?:Begin Patch|End Patch|End of File|(?:Update|Add|Delete) File:|Move to:)(?:\s|$)/.test(value)
+            || /^@@(?:\s|$)/.test(value)
+            || /^diff --git\s/.test(value)
+            || /^(?:--- (?:a\/|\/dev\/null)|\+\+\+ (?:b\/|\/dev\/null))/.test(value)
+            || /^---[ \t]+\S/.test(value) && /^\+\+\+[ \t]+\S/.test(lines[index + 1]?.trimStart() ?? '');
+    });
+}

package/dist/src/safety/local-tool-policy.js

@@ -1,3 +1,4 @@
+import { isPatchContent } from './local-edit-content.js';
 import path from 'node:path';
 import { randomBytes } from 'node:crypto';
 import { lstat, realpath } from 'node:fs/promises';
@@ -46,6 +47,8 @@ export class LocalToolPolicy {
         const file = await this.authorizedFile(input.path, tool === 'local_edit');
         if (tool === 'local_edit' && (typeof input.content !== 'string' || Buffer.byteLength(input.content) > 1024 * 1024))
             throw new Error('DENIED_CONTENT');
+        if (tool === 'local_edit' && isPatchContent(input.content))
+            throw new Error('DENIED_PATCH_CONTENT');
         if (tool === 'local_search' && (typeof input.query !== 'string' || input.query.length > 4096))
             throw new Error('DENIED_QUERY');
         const temp = file + '.runner-edit-' + randomBytes(16).toString('hex');

package/dist/src/safety/local-tool-server.js

@@ -23,12 +23,12 @@ const MAX_BODY = 1024 * 1024;
 const schemas = {
     local_read: { type: 'object', properties: { path: { type: 'string' } }, required: ['path'], additionalProperties: false },
     local_search: { type: 'object', properties: { path: { type: 'string' }, query: { type: 'string' } }, required: ['path', 'query'], additionalProperties: false },
-    local_edit: { type: 'object', properties: { path: { type: 'string' }, content: { type: 'string' } }, required: ['path', 'content'], additionalProperties: false },
+    local_edit: { type: 'object', properties: { path: { type: 'string' }, content: { type: 'string', description: 'The complete new contents of the entire file. Do not send a diff, patch, hunk, or edit instructions.' } }, required: ['path', 'content'], additionalProperties: false },
     local_test: { type: 'object', properties: { command: { type: 'string' } }, required: ['command'], additionalProperties: false },
 };
 /** Same immutable-by-copy inventory used by native admission and MCP discovery. */
 export function localToolInventory() {
-    return LOCAL_TOOL_NAMES.map(name => ({ name, description: `Scoped ${name} operation`, inputSchema: structuredClone(schemas[name]) }));
+    return LOCAL_TOOL_NAMES.map(name => ({ name, description: name === 'local_edit' ? 'Replace the entire file at path with content (or create it). Read the current file first and include all unchanged text in content. This is not a diff or patch tool; patch headers and hunks are rejected.' : `Scoped ${name} operation`, inputSchema: structuredClone(schemas[name]) }));
 }
 /** Job-only JSON MCP endpoint; intentionally has no Gateway transport or discovery. */
 export class LocalToolServer {

package/dist/src/safety/local-tool-worker.js

@@ -1,7 +1,10 @@
+import { isPatchContent } from './local-edit-content.js';
 /** Standalone worker: --eval avoids ambient module/config lookup. All paths are host-supplied. */
 export const LOCAL_TOOL_WORKER = String.raw `
 const fs = require('node:fs');
 const input = JSON.parse(process.argv[1]);
+const isPatchContent = ${isPatchContent.toString()};
+if (input.tool === 'local_edit' && isPatchContent(input.content)) throw Error('DENIED_PATCH_CONTENT');
 let current = '';
 for (const part of input.path.split('/').filter(Boolean)) {
   current += '/' + part;

package/dist/src/transport/abortable-delay.js

@@ -0,0 +1,12 @@
+/** Resolves after the delay or at once on abort, and never leaves a listener on a long-lived signal. */
+export function abortableDelay(milliseconds, signal) {
+    return new Promise(resolve => {
+        if (signal.aborted) {
+            resolve();
+            return;
+        }
+        const onAbort = () => { clearTimeout(timer); resolve(); };
+        const timer = setTimeout(() => { signal.removeEventListener("abort", onAbort); resolve(); }, milliseconds);
+        signal.addEventListener("abort", onAbort, { once: true });
+    });
+}

package/dist/src/transport/pusher-protocol.js

@@ -0,0 +1,66 @@
+const SOCKET_ID = /^\d{1,20}\.\d{1,20}$/;
+const DEFAULT_ACTIVITY_TIMEOUT_SECONDS = 30;
+export function subscribeFrame(channel, auth) {
+    return JSON.stringify({ event: "pusher:subscribe", data: { channel, auth } });
+}
+export function pingFrame() {
+    return JSON.stringify({ event: "pusher:ping", data: {} });
+}
+export function pongFrame() {
+    return JSON.stringify({ event: "pusher:pong", data: {} });
+}
+export function decodeFrame(raw, expected) {
+    let frame;
+    try {
+        frame = JSON.parse(raw);
+    }
+    catch {
+        return { kind: "ignored" };
+    }
+    if (!frame || typeof frame !== "object" || Array.isArray(frame))
+        return { kind: "ignored" };
+    const { event, channel, data } = frame;
+    if (typeof event !== "string")
+        return { kind: "ignored" };
+    switch (event) {
+        case "pusher:connection_established": {
+            const payload = parseData(data);
+            const socketId = payload?.socket_id;
+            if (typeof socketId !== "string" || !SOCKET_ID.test(socketId))
+                return { kind: "error" };
+            const timeout = payload?.activity_timeout;
+            const activityTimeoutSeconds = typeof timeout === "number" && Number.isInteger(timeout) && timeout >= 5 && timeout <= 600
+                ? timeout : DEFAULT_ACTIVITY_TIMEOUT_SECONDS;
+            return { kind: "connected", socketId, activityTimeoutSeconds };
+        }
+        case "pusher_internal:subscription_succeeded":
+            return channel === expected.channel ? { kind: "subscribed" } : { kind: "ignored" };
+        case "pusher:ping":
+            return { kind: "ping" };
+        case "pusher:pong":
+            return { kind: "pong" };
+        case "pusher:error": {
+            const code = parseData(data)?.code;
+            return typeof code === "number" ? { kind: "error", code } : { kind: "error" };
+        }
+        case "pusher:subscription_error":
+            return { kind: "error" };
+        default:
+            break;
+    }
+    if (event.startsWith("client-") || event.startsWith("pusher"))
+        return { kind: "ignored" };
+    return channel === expected.channel && event === expected.event ? { kind: "signal" } : { kind: "ignored" };
+}
+function parseData(data) {
+    if (typeof data === "string") {
+        try {
+            const parsed = JSON.parse(data);
+            return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return data && typeof data === "object" && !Array.isArray(data) ? data : undefined;
+}