mtech-ai-local-runner 0.1.5 → 0.1.6

package/README.md

@@ -10,6 +10,12 @@ The package stores safe runner configuration locally and keeps OAuth refresh cre
 
 Public npm installation requires no npm account or publishing OTP. Setup requires Gateway OAuth login, and local Claude Code must already be authenticated (`claude auth status`).
 
+## 0.1.6
+
+- Require a final JSON report with actual findings, nonempty evidence and no pending work before reporting completion. Incomplete or missing reports fail without a successful investigation artifact.
+- Explicitly restrict available built-in tools and ignore child messages as executor completion evidence.
+- Preserve employee-local duration/count policy and Gateway model selection. Structured assertions remain client-reported and require separate semantic review.
+
 ## 0.1.5
 
 - Authenticate local MCP relay callers with a random per-job bearer capability.
@@ -29,6 +35,6 @@ The relay binds only to loopback. Local capabilities are stored in private mode-
 Existing employees can upgrade their installed daemon with:
 
 ```bash
-npx mtech-ai-local-runner@0.1.5 setup
-npx mtech-ai-local-runner@0.1.5 doctor
+npx mtech-ai-local-runner@0.1.6 setup
+npx mtech-ai-local-runner@0.1.6 doctor
 ```

package/dist/src/adapters/claude-code/adapter.js

@@ -3,6 +3,7 @@ import { existsSync } from "node:fs";
 import { isTerminalEventType } from "../../protocol.js";
 import { parseClaudeLine } from "./stream-parser.js";
 import { compilePrompt } from "./prompt-compiler.js";
+import { completionEvent } from "./completion-report.js";
 import { buildHookPolicy, encodeHookPolicy } from "../../safety/hook-policy-builder.js";
 import { HOOK_POLICY_ENV_VAR } from "../../safety/hook-cli.js";
 const ALLOWED_ENV_KEYS = ["PATH", "HOME", "USER", "LOGNAME", "LANG", "LC_ALL", "TMPDIR", "NODE_ENV"];
@@ -108,6 +109,7 @@ export class ClaudeCodeAdapter {
             "--settings", JSON.stringify(settings),
             "--setting-sources", "user",
             "--disable-slash-commands",
+            "--tools", builtinToolSurface.join(","),
             "--allowedTools", toolSurface.join(","),
         ];
         if (ctx.resumeSessionId) {
@@ -136,9 +138,25 @@ export class ClaudeCodeAdapter {
         });
         let sawTerminal = false;
         for await (const line of handle.stdout) {
-            const parsed = parseClaudeLine(line, this.options.worktreeRoot);
+            let message;
+            try {
+                const value = JSON.parse(line);
+                if (!value || typeof value !== "object" || Array.isArray(value))
+                    continue;
+                message = value;
+            }
+            catch {
+                continue;
+            }
+            // A nested agent message is not evidence that the executor has finished.
+            if (message.parent_tool_use_id != null)
+                continue;
+            let parsed = parseClaudeLine(line, this.options.worktreeRoot);
             if (!parsed)
                 continue;
+            if (parsed.eventType === "completed") {
+                parsed = completionEvent(message.result, parsed.payload?.cost_usd);
+            }
             if (isTerminalEventType(parsed.eventType))
                 sawTerminal = true;
             yield parsed;

package/dist/src/adapters/claude-code/completion-report.js

@@ -0,0 +1,52 @@
+import { MAX_EVENT_SUMMARY_CHARS } from "../../protocol.js";
+const MAX_EVIDENCE_ITEMS = 20;
+const MAX_EVIDENCE_CHARS = 500;
+const MAX_REPORT_ENVELOPE_CHARS = 16_000;
+export const COMPLETION_REPORT_NOTICE = "Do the assigned work yourself using the available tools; do not delegate or start background work. " +
+    "Do not report completed while waiting for results, tests, or another agent. " +
+    "Your final response must be one JSON object, without Markdown fences: " +
+    '{"status":"completed","report":"actual findings and results","evidence":["file path and observed finding, or command and actual result"],"pending_work":[]}. ' +
+    `The report must be nonempty and at most ${MAX_EVENT_SUMMARY_CHARS} characters. ` +
+    `Include 1-${MAX_EVIDENCE_ITEMS} nonempty evidence strings, each at most ${MAX_EVIDENCE_CHARS} characters. ` +
+    "Address the assigned objective and each applicable acceptance criterion with observed evidence, not a plan or promise. " +
+    "Only attest to executor work you observed; Gateway records transport, completion, and review receipts separately. " +
+    'If the task is unfinished, use "status":"blocked" and list the remaining work in "pending_work". ' +
+    "An incomplete or missing report is a failed execution, never a successful investigation artifact.";
+function boundedText(value, max) {
+    return typeof value === "string" && value.trim().length > 0 && value.length <= max;
+}
+/** Validate the full final result before truncation; never publish malformed/interim output. */
+export function completionEvent(result, costUsd) {
+    const usage = typeof costUsd === "number" && Number.isFinite(costUsd) && costUsd >= 0
+        ? { cost_usd: costUsd }
+        : {};
+    const failed = {
+        eventType: "failed",
+        summary: "completion report is missing, incomplete or invalid",
+        payload: usage,
+    };
+    if (typeof result !== "string" || result.length > MAX_REPORT_ENVELOPE_CHARS)
+        return failed;
+    let report;
+    try {
+        report = JSON.parse(result);
+    }
+    catch {
+        return failed;
+    }
+    if (!report || typeof report !== "object" || Array.isArray(report))
+        return failed;
+    const value = report;
+    if (Object.keys(value).some((key) => !["status", "report", "evidence", "pending_work"].includes(key))
+        || value.status !== "completed"
+        || !boundedText(value.report, MAX_EVENT_SUMMARY_CHARS)
+        || !Array.isArray(value.pending_work) || value.pending_work.length !== 0
+        || !Array.isArray(value.evidence) || value.evidence.length < 1 || value.evidence.length > MAX_EVIDENCE_ITEMS
+        || !value.evidence.every((item) => boundedText(item, MAX_EVIDENCE_CHARS)))
+        return failed;
+    return {
+        eventType: "completed",
+        summary: value.report.trim(),
+        payload: { ...usage, investigation_summary: value.report.trim(), completion_evidence: value.evidence },
+    };
+}

package/dist/src/adapters/claude-code/prompt-compiler.js

@@ -1,3 +1,4 @@
+import { COMPLETION_REPORT_NOTICE } from "./completion-report.js";
 const STOP_BEFORE_PUBLICATION_RULE = "Stop before publication. Never run git commit, git push, create a pull request, merge, " +
     "deploy, access production, send an external message, or write data outside this worktree.";
 const EVENT_SCHEMA_NOTICE = "Report progress only through the normalized event lifecycle (started, progress, file_changed, question, " +
@@ -53,6 +54,7 @@ export function compilePrompt(taskPackage, options) {
         `## Prohibited actions\n${prohibitedActions.map((item) => `- ${item}`).join("\n")}`,
         `## Stop-before-publication rule\n${STOP_BEFORE_PUBLICATION_RULE}`,
         `## Event and checkpoint obligations\n${EVENT_SCHEMA_NOTICE}`,
+        `## Final completion report\n${COMPLETION_REPORT_NOTICE}`,
     ];
     return sections.join("\n\n");
 }

package/dist/src/cli.js

@@ -182,7 +182,7 @@ export async function main(argv, env, io = {}) {
                 const authenticated = await runFile(binary, ["auth", "status"], { encoding: "utf8" }).then(() => true).catch(() => false);
                 const registered = await gateway.registerLocalRunner({
                     deviceFingerprint: createHash("sha256").update(`${process.getuid?.() ?? 0}|${runnerDisplayName()}|${config.gatewayMcpUrl}`).digest("hex"),
-                    displayName: runnerDisplayName(), packageVersion: "0.1.5",
+                    displayName: runnerDisplayName(), packageVersion: "0.1.6",
                     capabilities: [{ adapter: "claude_code_cli", version: "1", capabilities: ["repository_read", "repository_edit", "shell_test", "git_diff"], authenticated }],
                 });
                 await localStore.save({ schemaVersion: 1, gatewayMcpUrl: config.gatewayMcpUrl, runnerId: registered.runner.id, workspaceRoot: config.workspaceRoot, concurrency: 1 });

package/dist/src/daemon/runtime.js

@@ -72,7 +72,7 @@ export async function buildDaemon(input) {
     const poller = new JobPoller({
         heartbeat: () => gateway.heartbeatLocalRunner({
             deviceFingerprint: createHash("sha256").update(`${process.getuid?.() ?? 0}|${runnerDisplayName()}|${input.gatewayMcpUrl}`).digest("hex"),
-            displayName: runnerDisplayName(), packageVersion: "0.1.5",
+            displayName: runnerDisplayName(), packageVersion: "0.1.6",
             capabilities: probes.map((probe) => ({ adapter: probe.id, version: probe.version,
                 capabilities: probe.capabilities, authenticated: probe.available && probe.authenticated })),
         }).then(() => undefined),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "private": false,
   "license": "UNLICENSED",
   "bin": {