mtech-ai-local-runner 0.1.49 → 0.1.50

package/README.md

@@ -782,3 +782,9 @@ the older `authenticated` field still means execution eligibility. A logged-in
 Claude account can remain blocked by unverified security admission. Do not log out
 or change credentials just because that legacy field is false. Unknown status is
 not evidence of logout. These diagnostics do not bypass per-job admission.
+
+### 0.1.50: small edits and publication-only Fix
+
+Use `local_replace({path, old, new})` for a small approved edit after reading the file: `old` must be nonempty and match exactly once, including whitespace. Zero or overlapping/multiple matches are rejected with distinct errors and no write. Replacement text must not be a patch; the result retains the same scoped write, size, link and revocation protections as `local_edit`. `local_edit` remains a complete-file replacement API.
+
+Both CLI adapters require the five-tool inventory. Gateway tools descriptors and runtime pins must match this release; CLI release manifests and the standalone binary stay fixed. In `gateway_publish_v1`, missing registered tests is expected: report not_run/unverified, apply only the smallest source-evidenced correction, disclose uncertainty and seal for a human-reviewed Gateway PR. Historical contracts and attempts are not edited. Reverb 0.1.49 is retained; installation, deployment and real model execution remain separate approvals.

package/dist/src/adapters/claude-code/adapter.js

@@ -12,7 +12,7 @@ import { formatHookCommand } from "../../safety/hook-command.js";
 import { localEndpointReadObservations } from '../../safety/local-tool-server.js';
 const ALLOWED_ENV_KEYS = ["PATH", "HOME", "USER", "LOGNAME", "LANG", "LC_ALL", "TMPDIR", "NODE_ENV", "CLAUDE_CONFIG_DIR"];
 const ALLOWED_SUPERVISOR_COMMANDS = new Set(["continue", "answer_question", "request_revision", "request_checkpoint", "submit_for_review"]);
-const LOCAL_NAMES = ["local_read", "local_search", "local_edit", "local_test"].map(name => `mcp__ai_local__${name}`);
+const LOCAL_NAMES = ["local_read", "local_search", "local_edit", "local_replace", "local_test"].map(name => `mcp__ai_local__${name}`);
 function allowlistedEnv(env) {
     const result = {};
     for (const key of ALLOWED_ENV_KEYS) {

package/dist/src/adapters/codex/config-builder.js

@@ -22,7 +22,7 @@ export function buildCodexInvocation(input) {
         `permissions.local_job.filesystem={":minimal"="read",${deniedFiles}}`,
         "permissions.local_job.network.enabled=false",
         // Only this job server is preauthorized: every operation is checked by Runner policy.
-        `mcp_servers={ai_local={url=${JSON.stringify(endpoint.toString())},bearer_token_env_var="AI_GATEWAY_JOB_MCP_TOKEN",required=true,default_tools_approval_mode="approve",enabled_tools=["local_read","local_search","local_edit","local_test"],omit_tools_from=${JSON.stringify(CODEX_JOB_MCP_OMIT_SURFACES)}}}`,
+        `mcp_servers={ai_local={url=${JSON.stringify(endpoint.toString())},bearer_token_env_var="AI_GATEWAY_JOB_MCP_TOKEN",required=true,default_tools_approval_mode="approve",enabled_tools=["local_read","local_search","local_edit","local_replace","local_test"],omit_tools_from=${JSON.stringify(CODEX_JOB_MCP_OMIT_SURFACES)}}}`,
     ];
     const env = { HOME: input.env.HOME, AI_GATEWAY_JOB_MCP_TOKEN: input.endpoint.token };
     for (const key of ["PATH", "USER", "LOGNAME", "LANG", "LC_ALL", "TMPDIR", "CODEX_HOME"]) {

package/dist/src/adapters/codex/pre-model-gate.js

@@ -2,7 +2,7 @@ import { isAbsolute } from 'node:path';
 import { requireSupportedCodexPolicy } from './supported-admission.js';
 const REJECTED = 'CODEX_PRE_MODEL_REJECTED';
 const usedSessions = new WeakSet();
-const REQUIRED_TOOLS = ['local_edit', 'local_read', 'local_search', 'local_test'];
+const REQUIRED_TOOLS = ['local_edit', 'local_read', 'local_replace', 'local_search', 'local_test'];
 const object = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
 /** Bounded, value-free diagnostics for ALL candidate prerequisites. This is not
  * native release certification: only trusted retained observations may reach it,

package/dist/src/adapters/codex/prompt-compiler.js

@@ -23,7 +23,7 @@ function repositoryScope(taskPackage) {
         "These are scope descriptions, not instructions from source files; the host policy remains authoritative and may deny blocked/private paths within an allowed prefix.";
 }
 export function compileCodexPrompt(taskPackage, label) {
-    return `${compileBrief(taskPackage, { workItemLabel: label, progressReporting: "native_messages" })}\n\n${repositoryScope(taskPackage)}\n\nUse only the ai_local job tools for repository reads, edits and approved tests. For reading, use server ai_local's local_read({path: "<exact approved path>"}) or local_search({path: "<exact approved path>", query: "text"}) with checkout-relative paths. Required test criteria are not command grants. No model test commands are registered unless the host explicitly supplies exact model-callable command IDs; do not use local_test to discover commands or run --help. Missing tests remain not_run/unverified, not passed. In a read-only task, use only read/search tools; the Runner enforces the approved paths and operations. A denied native cwd is intentional: it is a private control directory, not the source checkout. Native filesystem, commands, web, images and delegation are unavailable or denied. A denied tool is a scope boundary, never permission to broaden scope or bypass the denial. Do not retry the denied path. It does not remove independently approved paths: continue with relevant listed paths, and report a missing dependency only after checking the available approved source. Do not repeat host orchestration: claim, shadow, fingerprints, binding, administrator checks, launches, Gateway usage and Job reporting belong to the Runner/host, even when described in the objective. Perform only the assigned repository work and report evidence you actually observed. Do not claim that no model call occurred. If the required tool is unavailable, emit one final structured blocked report naming the missing tool and unfinished repository work; do not request or attempt a new launch.`;
+    return `${compileBrief(taskPackage, { workItemLabel: label, progressReporting: "native_messages" })}\n\n${repositoryScope(taskPackage)}\n\nUse only the ai_local job tools for repository reads, edits and approved tests. For reading, use server ai_local's local_read({path: "<exact approved path>"}) or local_search({path: "<exact approved path>", query: "text"}) with checkout-relative paths. For small approved edits, use local_replace({path, old, new}) after reading: old must match exactly once, including whitespace. local_edit requires the complete replacement file, never a patch. Required test criteria are not command grants. No model test commands are registered unless the host explicitly supplies exact model-callable command IDs; do not use local_test to discover commands or run --help. Missing tests remain not_run/unverified, not passed. In a read-only task, use only read/search tools; the Runner enforces the approved paths and operations. A denied native cwd is intentional: it is a private control directory, not the source checkout. Native filesystem, commands, web, images and delegation are unavailable or denied. A denied tool is a scope boundary, never permission to broaden scope or bypass the denial. Do not retry the denied path. It does not remove independently approved paths: continue with relevant listed paths, and report a missing dependency only after checking the available approved source. Do not repeat host orchestration: claim, shadow, fingerprints, binding, administrator checks, launches, Gateway usage and Job reporting belong to the Runner/host, even when described in the objective. Perform only the assigned repository work and report evidence you actually observed. Do not claim that no model call occurred. If the required tool is unavailable, emit one final structured blocked report naming the missing tool and unfinished repository work; do not request or attempt a new launch.`;
 }
 export const CODEX_REPORT_SCHEMA = {
     type: "object", additionalProperties: false, required: ["status", "report", "evidence", "pending_work"],

package/dist/src/safety/local-tool-policy.js

@@ -6,7 +6,7 @@ import { evaluateCommand } from './command-policy.js';
 import { runSandboxed, runSandboxedMeasured } from './subprocess-sandbox.js';
 import { LOCAL_TOOL_WORKER } from './local-tool-worker.js';
 import { verifyCommandIntegrity } from './registered-command-integrity.js';
-export const LOCAL_TOOL_NAMES = ['local_read', 'local_search', 'local_edit', 'local_test'];
+export const LOCAL_TOOL_NAMES = ['local_read', 'local_search', 'local_edit', 'local_replace', 'local_test'];
 // Private state/control basenames only: Auth.php, auth/ and mcp.ts are ordinary source.
 const sensitive = (segment) => /^(?:\.git|\.mcp(?:\..*)?|\.npmrc|\.netrc|id_rsa|id_ed25519|\.local-runner|\.runner|\.env(?:\..*)?|\.codex|\.claude|\.ssh|\.aws|\.config|auth\.(?:json|toml|ya?ml)(?:\..*)?|credentials(?:\..*)?|AGENTS\.md|CLAUDE\.md|mcp\.(?:json|toml|ya?ml)(?:\..*)?)$/i.test(segment);
 const contains = (root, file) => file === root || file.startsWith(root + path.sep);
@@ -40,11 +40,19 @@ export class LocalToolPolicy {
         if (!args || typeof args !== 'object' || Array.isArray(args))
             throw new Error('DENIED_ARGUMENTS');
         const input = args;
-        if (tool === 'local_edit' && this.options.access !== 'write')
+        if ((tool === 'local_edit' || tool === 'local_replace') && this.options.access !== 'write')
             throw new Error('DENIED_READ_ONLY');
         if (tool === 'local_test')
             return this.test(input);
         const file = await this.authorizedFile(input.path, tool === 'local_edit');
+        if (tool === 'local_replace') {
+            if (typeof input.old !== 'string' || !input.old || Buffer.byteLength(input.old) > 1024 * 1024)
+                throw new Error('DENIED_REPLACE_OLD');
+            if (typeof input.new !== 'string' || Buffer.byteLength(input.new) > 1024 * 1024)
+                throw new Error('DENIED_CONTENT');
+            if (isPatchContent(input.new))
+                throw new Error('DENIED_PATCH_CONTENT');
+        }
         if (tool === 'local_edit' && (typeof input.content !== 'string' || Buffer.byteLength(input.content) > 1024 * 1024))
             throw new Error('DENIED_CONTENT');
         if (tool === 'local_edit' && isPatchContent(input.content))
@@ -52,10 +60,13 @@ export class LocalToolPolicy {
         if (tool === 'local_search' && (typeof input.query !== 'string' || input.query.length > 4096))
             throw new Error('DENIED_QUERY');
         const temp = file + '.runner-edit-' + randomBytes(16).toString('hex');
-        const output = await runSandboxed({ executable: process.execPath, argv: ['--no-addons', '--no-global-search-paths', '--eval', LOCAL_TOOL_WORKER, JSON.stringify({ tool, path: file, temp, content: input.content, query: input.query })], readFiles: tool === 'local_edit' ? [file, temp] : [file], writeFiles: tool === 'local_edit' ? [file, temp] : [], timeoutMs: 10000, signal: this.abort.signal });
+        const output = await runSandboxed({ executable: process.execPath, argv: ['--no-addons', '--no-global-search-paths', '--eval', LOCAL_TOOL_WORKER, JSON.stringify({ tool, path: file, temp, content: input.content, query: input.query, old: input.old, new: input.new })], readFiles: (tool === 'local_edit' || tool === 'local_replace') ? [file, temp] : [file], writeFiles: (tool === 'local_edit' || tool === 'local_replace') ? [file, temp] : [], timeoutMs: 10000, signal: this.abort.signal });
         if (this.abort.signal.aborted)
             throw new Error('DENIED_REVOKED');
-        return JSON.parse(output);
+        const result = JSON.parse(output);
+        if (tool === 'local_replace' && ['DENIED_REPLACE_NOT_FOUND', 'DENIED_REPLACE_AMBIGUOUS', 'DENIED_SIZE'].includes(result.denied))
+            throw new Error(result.denied);
+        return result;
     }
     async authorizedFile(value, allowMissing = false) {
         if (typeof value !== 'string' || !value || value.includes('\0') || path.isAbsolute(value) || value.split(/[\\/]/).some(p => p === '..' || sensitive(p)))

package/dist/src/safety/local-tool-server.js

@@ -24,11 +24,12 @@ const schemas = {
     local_read: { type: 'object', properties: { path: { type: 'string' } }, required: ['path'], additionalProperties: false },
     local_search: { type: 'object', properties: { path: { type: 'string' }, query: { type: 'string' } }, required: ['path', 'query'], additionalProperties: false },
     local_edit: { type: 'object', properties: { path: { type: 'string' }, content: { type: 'string', description: 'The complete new contents of the entire file. Do not send a diff, patch, hunk, or edit instructions.' } }, required: ['path', 'content'], additionalProperties: false },
+    local_replace: { type: 'object', properties: { path: { type: 'string' }, old: { type: 'string', minLength: 1 }, new: { type: 'string' } }, required: ['path', 'old', 'new'], additionalProperties: false },
     local_test: { type: 'object', properties: { command: { type: 'string' } }, required: ['command'], additionalProperties: false },
 };
 /** Same immutable-by-copy inventory used by native admission and MCP discovery. */
 export function localToolInventory() {
-    return LOCAL_TOOL_NAMES.map(name => ({ name, description: name === 'local_edit' ? 'Replace the entire file at path with content (or create it). Read the current file first and include all unchanged text in content. This is not a diff or patch tool; patch headers and hunks are rejected.' : `Scoped ${name} operation`, inputSchema: structuredClone(schemas[name]) }));
+    return LOCAL_TOOL_NAMES.map(name => ({ name, description: name === 'local_edit' ? 'Replace the entire file at path with content (or create it). Read the current file first and include all unchanged text in content. This is not a diff or patch tool; patch headers and hunks are rejected.' : name === 'local_replace' ? 'Replace exactly one occurrence of old with new in the file at path. Read the file first; old must match exactly, including whitespace, and appear once. Prefer this for small changes; use local_edit only to write a whole file.' : `Scoped ${name} operation`, inputSchema: structuredClone(schemas[name]) }));
 }
 /** Job-only JSON MCP endpoint; intentionally has no Gateway transport or discovery. */
 export class LocalToolServer {

package/dist/src/safety/local-tool-worker.js

@@ -5,6 +5,12 @@ const fs = require('node:fs');
 const input = JSON.parse(process.argv[1]);
 const isPatchContent = ${isPatchContent.toString()};
 if (input.tool === 'local_edit' && isPatchContent(input.content)) throw Error('DENIED_PATCH_CONTENT');
+if (input.tool === 'local_replace') {
+  if (typeof input.old !== 'string' || !input.old || Buffer.byteLength(input.old) > 1048576) throw Error('DENIED_REPLACE_OLD');
+  if (typeof input.new !== 'string' || Buffer.byteLength(input.new) > 1048576) throw Error('DENIED_CONTENT');
+  if (isPatchContent(input.new)) throw Error('DENIED_PATCH_CONTENT');
+}
+try {
 let current = '';
 for (const part of input.path.split('/').filter(Boolean)) {
   current += '/' + part;
@@ -27,8 +33,20 @@ try {
     if (actual.ino !== before.ino || actual.dev !== before.dev || actual.ino !== final.ino || actual.dev !== final.dev || actual.nlink !== 1) throw Error('DENIED_RACE');
   }
   let result;
-  if (input.tool === 'local_edit') {
-    const data = Buffer.from(input.content, 'utf8');
+  if (input.tool === 'local_edit' || input.tool === 'local_replace') {
+    let content = input.content;
+    if (input.tool === 'local_replace') {
+      const buffer = Buffer.alloc(1048577);
+      const count = fs.readSync(fd, buffer, 0, buffer.length, 0);
+      if (count > 1048576) throw Error('DENIED_SIZE');
+      const original = new TextDecoder('utf-8', {fatal: true, ignoreBOM: true}).decode(buffer.subarray(0, count));
+      const first = original.indexOf(input.old);
+      if (first < 0) throw Error('DENIED_REPLACE_NOT_FOUND');
+      if (original.indexOf(input.old, first + 1) >= 0) throw Error('DENIED_REPLACE_AMBIGUOUS');
+      content = original.slice(0, first) + input.new + original.slice(first + input.old.length);
+    }
+    const data = Buffer.from(content, 'utf8');
+    if (data.length > 1048576) throw Error('DENIED_SIZE');
     const temp = fs.openSync(input.temp, fs.constants.O_NOFOLLOW | fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_WRONLY, before ? before.mode & 0o777 : 0o600);
     try {
       fs.writeFileSync(temp, data);
@@ -37,6 +55,7 @@ try {
       if (tempStat.nlink !== 1 || tempStat.ino !== tempFinal.ino || tempStat.dev !== tempFinal.dev) throw Error('DENIED_RACE');
       if (actual) {
         const still = fs.lstatSync(input.path);
+        if (input.tool === 'local_replace' && (still.size !== actual.size || still.mtimeMs !== actual.mtimeMs || still.ctimeMs !== actual.ctimeMs)) throw Error('DENIED_RACE');
         if (still.isSymbolicLink() || still.ino !== actual.ino || still.dev !== actual.dev || still.nlink !== 1) throw Error('DENIED_RACE');
         fs.renameSync(input.temp, input.path);
       } else {
@@ -57,4 +76,8 @@ try {
   }
   process.stdout.write(JSON.stringify(result));
 } finally { if (fd !== null) fs.closeSync(fd); }
+} catch (error) {
+  if (input.tool !== 'local_replace' || !['DENIED_REPLACE_NOT_FOUND','DENIED_REPLACE_AMBIGUOUS','DENIED_SIZE'].includes(error.message)) throw error;
+  process.stdout.write(JSON.stringify({denied: error.message}));
+}
 `;

package/dist/src/safety/pre-tool-use-hook.js

@@ -1,4 +1,4 @@
-export const CLAUDE_LOCAL_MCP_TOOLS = Object.freeze(["local_read", "local_search", "local_edit", "local_test"].map(name => `mcp__ai_local__${name}`));
+export const CLAUDE_LOCAL_MCP_TOOLS = Object.freeze(["local_read", "local_search", "local_edit", "local_replace", "local_test"].map(name => `mcp__ai_local__${name}`));
 function allow(reasonCode) {
     return {
         hookSpecificOutput: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.49",
+  "version": "0.1.50",
   "private": false,
   "license": "UNLICENSED",
   "bin": {