mtech-ai-local-runner 0.1.52 → 0.1.53

package/README.md

@@ -1,3 +1,19 @@
+## 0.1.53: separate candidate change, file and payload limits
+
+New `gateway_publish_v1` scopes may explicitly opt into `candidate_limits.version: 2` with
+`max_changed_files`, `max_change_bytes`, `max_file_bytes` and `max_payload_bytes`.
+Change bytes are the exact minimum byte insertions plus deletions from the frozen base;
+file bytes are each resulting decoded file; payload bytes are compact UTF-8 JSON for
+`{files, validation_report?}`, including base64, paths, hashes and the report. HTTP/MCP
+framing and provider multipart overhead remain separate infrastructure limits.
+
+The Runner and Gateway compute these independently. Unknown measurement or unsupported
+modes fail closed. The Gateway bounds frozen-base response streaming and rechecks
+scope/authority before staging. Legacy unversioned `max_diff_bytes` keeps its existing
+meaning. Existing candidates/contracts/Jobs/Loops are not upgraded or published by this
+release. Match new package runtime receipts on both sides and approve a new v2 scope
+before use; a publication-only recovery protocol for retained candidates is separate.
+
 ## 0.1.52: publication diagnostics and candidate cleanup
 
 Publication failures report fixed `publication_step` and `LOCAL_FIX_*` codes;
@@ -15,6 +31,8 @@ model run. Pre-existing forensic candidates are not swept automatically.
 
 ## 0.1.51: open a session for an ask no session can show
 
+0.1.51 was not published to npm; install 0.1.52 or later to get these changes.
+
 Sometimes no live session can show an AI Gateway ask or answer soon: there is no live session, no human prompt for 30
 minutes, an idle Codex session, or an idle Claude session that cannot be woken. The runner then opens a session in the
 person's own AI app instead of only showing a notification (Work Item e1c08b33, Work Decision 3ea5c197).
@@ -118,7 +136,10 @@ npx mtech-ai-local-runner integrations remove claude
 
 Claude Code gets the skills-directory plugin `~/.claude/skills/mtec-ai-gateway-asks/`, which loads as
 `mtec-ai-gateway-asks@skills-dir` in a new session or after `/reload-plugins`; `settings.json` is not touched. Codex gets
-four handlers appended to `~/.codex/hooks.json` after a backup of that file; trust them once with `/hooks`. A
+four handlers appended to `~/.codex/hooks.json` after a backup of that file. Codex runs them only after you trust them
+once. In the Codex app, trust them under Settings → Hooks or with the Review hooks button. In the Codex CLI in a
+terminal, trust them with `/hooks`; the Codex app has no such command and sends `/hooks` to the model as text. Until
+then the Slack message covers each ask. A
 `hooks.json` that is not valid JSON, or whose hooks do not have the shape Codex reads, is left as it is and the install
 reports `CODEX_HOOKS_JSON_INVALID`. `uninstall` removes both integrations, the shim, `asks.json` and any temporary
 `asks.json.*.tmp` file a crash left behind, and it also works on a setup that never finished.

package/dist/src/asks/commands.js

@@ -5,7 +5,9 @@ import { installIntegration, integrationStatus, removeIntegration, removeShimIfU
 import { APPS, isApp } from "./types.js";
 const NEXT_STEP = {
     claude: "Start a new Claude Code session, or run /reload-plugins in an open one, to load mtec-ai-gateway-asks@skills-dir.",
-    codex: "Open Codex and trust the four AI Gateway hooks once with /hooks. Until then Codex skips them and the Slack message covers the gap.",
+    // /hooks is a command of the Codex CLI in a terminal only: the Codex app sends it to the model as text.
+    codex: "Codex runs the four AI Gateway hooks only after you trust them once. In the Codex app, trust them under Settings → Hooks "
+        + "or with the Review hooks button. In the Codex CLI in a terminal, trust them with /hooks. Until then the Slack message covers each ask.",
 };
 function errorCode(error) {
     const code = error?.code;

package/dist/src/asks/doctor.js

@@ -10,7 +10,9 @@ const CLAUDE_NOT_LOADED = `Claude Code does not load ${PLUGIN_ID}. Managed setti
     + "(strictPluginOnlyCustomization, a strictKnownMarketplaces list without the skills-dir source, or blockedMarketplaces): "
     + "ask your administrator, or install the plugin from a directory marketplace your organization allows (claude plugin marketplace add <dir>). "
     + "A Claude Code release without skills-directory plugins does not load it either.";
-const CODEX_TRUST = "Codex runs these hooks only after you trust them once with /hooks; until then the Slack message covers each ask.";
+// /hooks is a command of the Codex CLI in a terminal only: the Codex app sends it to the model as text.
+const CODEX_TRUST = "Codex runs these hooks only after you trust them once. In the Codex app, trust them under Settings → Hooks "
+    + "or with the Review hooks button. In the Codex CLI in a terminal, trust them with /hooks. Until then the Slack message covers each ask.";
 /** Runs the Claude CLI with the environment doctor was given on top of the process's own (CLAUDE_CONFIG_DIR, for one). */
 const defaultRun = (env) => (file, args) => new Promise((resolve, reject) => {
     execFile(file, args, { encoding: "utf8", timeout: 10_000, maxBuffer: 1024 * 1024, env: { ...process.env, ...env } }, (error, stdout) => (error ? reject(error) : resolve({ stdout })));

package/dist/src/publication/candidate-limits.js

@@ -0,0 +1,89 @@
+import { createHash } from 'node:crypto';
+const issued = new WeakMap();
+const reject = (code) => { const error = Error('CANDIDATE_LIMIT_REJECTED'); issued.set(error, code); throw error; };
+export function trustedCandidateLimitCode(error) { return error && typeof error === 'object' ? issued.get(error) : undefined; }
+export function candidateLimits(value, publish) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return reject('LIMIT_SCHEMA_REJECTED');
+    const l = value;
+    if (l.version !== undefined) {
+        const keys = ['version', 'max_changed_files', 'max_change_bytes', 'max_file_bytes', 'max_payload_bytes'];
+        if (!publish || l.version !== 2 || Object.keys(l).sort().join() !== keys.sort().join() || keys.slice(0).filter(k => k !== 'version').some(k => !Number.isSafeInteger(l[k]) || Number(l[k]) < 1 || Number(l[k]) > (k === 'max_changed_files' ? 50 : 1000000)))
+            return reject('LIMIT_SCHEMA_REJECTED');
+        return { ...l };
+    }
+    if ('max_change_bytes' in l || 'max_payload_bytes' in l || ['max_changed_files', 'max_diff_bytes', 'max_file_bytes'].some(k => !Number.isSafeInteger(l[k]) || Number(l[k]) < 1))
+        return reject('LIMIT_SCHEMA_REJECTED');
+    return { ...l };
+}
+/** Exact byte insertion/deletion distance. Fixed work exhaustion never becomes a guessed count. */
+export function changedBytes(before, after) {
+    if (before.length > 1000000 || after.length > 1000000)
+        return reject('CHANGE_MEASUREMENT_REJECTED');
+    let start = 0, n = before.length, m = after.length, work = 0;
+    const tick = () => { if (++work > 2000000)
+        reject('CHANGE_MEASUREMENT_REJECTED'); };
+    while (start < n && start < m && before[start] === after[start]) {
+        tick();
+        start++;
+    }
+    while (n > start && m > start && before[n - 1] === after[m - 1]) {
+        tick();
+        n--;
+        m--;
+    }
+    n -= start;
+    m -= start;
+    if (!n || !m)
+        return n + m;
+    let frontier = new Map([[1, 0]]);
+    for (let d = 0; d <= n + m; d++) {
+        const next = new Map();
+        for (let k = -d; k <= d; k += 2) {
+            tick();
+            const left = frontier.get(k - 1) ?? -1, down = frontier.get(k + 1) ?? -1;
+            let x = k === -d || (k !== d && left < down) ? down : left + 1;
+            if (x < 0)
+                continue;
+            let y = x - k;
+            while (x < n && y < m && y >= 0 && before[start + x] === after[start + y]) {
+                tick();
+                x++;
+                y++;
+            }
+            if (x >= n && y >= m)
+                return d;
+            next.set(k, x);
+        }
+        frontier = next;
+    }
+    return reject('CHANGE_MEASUREMENT_REJECTED');
+}
+export function candidatePayloadBytes(files, report) { return Buffer.byteLength(JSON.stringify({ files, ...(report === undefined ? {} : { validation_report: report }) }), 'utf8'); }
+export function measureSplitDelta(diff, limits, report) {
+    const delta = JSON.parse(diff);
+    if (delta?.format !== 'local-candidate-binary-diff-v1' || !Array.isArray(delta.changes) || !delta.changes.length || delta.changes.length > limits.max_changed_files)
+        reject('FILE_COUNT_REJECTED');
+    let changes = 0, maxFile = 0;
+    const decode = (v) => { if (typeof v !== 'string')
+        return reject('CHANGE_MEASUREMENT_REJECTED'); const b = Buffer.from(v, 'base64'); if (b.toString('base64') !== v || b.length > 1000000 || b.includes(0) || !Buffer.from(b.toString('utf8')).equals(b))
+        return reject('CHANGE_MEASUREMENT_REJECTED'); return b; };
+    const files = delta.changes.map((c) => {
+        if (!c || typeof c.path !== 'string' || !['added', 'modified', 'deleted'].includes(c.status) || c.status === 'added' && c.before !== null || c.status === 'deleted' && c.after !== null)
+            reject('CHANGE_MEASUREMENT_REJECTED');
+        const before = c.status === 'added' ? Buffer.alloc(0) : decode(c.before), after = c.status === 'deleted' ? Buffer.alloc(0) : decode(c.after);
+        maxFile = Math.max(maxFile, after.length);
+        if (maxFile > limits.max_file_bytes)
+            reject('FILE_LIMIT_REJECTED');
+        changes += changedBytes(before, after);
+        if (changes > limits.max_change_bytes)
+            reject('CHANGE_LIMIT_REJECTED');
+        return { path: c.path, status: c.status, content_base64: c.status === 'deleted' ? null : after.toString('base64'), content_sha256: c.status === 'deleted' ? null : createHash('sha256').update(after).digest('hex') };
+    });
+    if (!changes)
+        reject('CHANGE_MEASUREMENT_REJECTED');
+    const payload = candidatePayloadBytes(files, report);
+    if (payload > limits.max_payload_bytes)
+        reject('PAYLOAD_LIMIT_REJECTED');
+    return { metrics: { version: 2, change_bytes: changes, max_file_bytes: maxFile, payload_bytes: payload }, files };
+}

package/dist/src/publication/failure.js

@@ -1,6 +1,6 @@
 import { PublicationOutcomeUnknownError } from './publisher.js';
 export const PUBLICATION_STEPS = ['validation_report', 'current_fence', 'snapshot_observe', 'snapshot_materialize', 'candidate_limits', 'delta_format', 'delta_modes', 'delta_scope', 'candidate_files', 'journal', 'security_receipt', 'stage', 'advance', 'result', 'cleanup'];
-export const PUBLICATION_CODES = ['LOCAL_FIX_CHECK_REJECTED', 'LOCAL_FIX_REPORT_REJECTED', 'LOCAL_FIX_DIFF_LIMIT_REJECTED', 'LOCAL_FIX_FILE_COUNT_REJECTED', 'LOCAL_FIX_FILE_LIMIT_REJECTED', 'LOCAL_FIX_FILE_ENCODING_REJECTED', 'LOCAL_FIX_PUBLICATION_OUTCOME_UNKNOWN', 'LOCAL_FIX_CLEANUP_FAILED'];
+export const PUBLICATION_CODES = ['LOCAL_FIX_CHANGE_LIMIT_REJECTED', 'LOCAL_FIX_PAYLOAD_LIMIT_REJECTED', 'LOCAL_FIX_CHANGE_MEASUREMENT_REJECTED', 'LOCAL_FIX_CHECK_REJECTED', 'LOCAL_FIX_REPORT_REJECTED', 'LOCAL_FIX_DIFF_LIMIT_REJECTED', 'LOCAL_FIX_FILE_COUNT_REJECTED', 'LOCAL_FIX_FILE_LIMIT_REJECTED', 'LOCAL_FIX_FILE_ENCODING_REJECTED', 'LOCAL_FIX_PUBLICATION_OUTCOME_UNKNOWN', 'LOCAL_FIX_CLEANUP_FAILED'];
 const issued = new WeakMap();
 const cleanupFailures = new WeakSet();
 /** Host vocabulary only; serialized fields/messages never carry diagnostic authority. */

package/dist/src/publication/production-host.js

@@ -55,6 +55,8 @@ export function createProductionLocalFixHost(options) {
             } };
             const frozenCurrent = async () => lifecycle.isFrozen() && await current();
             const limits = scope.candidate_limits;
+            if (['version', 'max_change_bytes', 'max_payload_bytes'].some(k => k in limits))
+                throw denied();
             const snapshots = new GitSnapshotHost({ root: input.checkoutPath, privateRoot: root, git: options.git, baseCommitSha: binding.base_commit_sha, workingBranch: binding.working_branch, maxFileBytes: SNAPSHOT_TREE_MAX_BYTES, maxTotalBytes: SNAPSHOT_TREE_MAX_BYTES });
             const isolated = createSealedIsolatedVerifier({ host: snapshots, allowedPaths: verificationPaths, blockedPaths: ['.env', '.env.*', '.git/**', '.ssh/**', '.aws/**'], commands, current: frozenCurrent });
             const verifier = new CandidateVerifier({ binding, root: input.checkoutPath, allowedPaths: allowed, blockedPaths: ['.env', '.env.*', '.git/**', '.ssh/**', '.aws/**'], maxFiles: limits.max_changed_files, maxDiffBytes: limits.max_diff_bytes, maxFileBytes: limits.max_file_bytes, commands, current: frozenCurrent, assertRetainedSeal: async () => { const seal = isolated.materialized(); if (!seal)

package/dist/src/publication/server-ci-host.js

@@ -1,3 +1,4 @@
+import { candidateLimits, measureSplitDelta, trustedCandidateLimitCode } from './candidate-limits.js';
 import { publicationError, publicationCleanupFailure, trustedPublicationFailure } from './failure.js';
 import { ServerCiPublicationError } from './server-ci-error.js';
 export { ServerCiPublicationError } from './server-ci-error.js';
@@ -67,10 +68,11 @@ export function createServerCiLocalFixHost(options) {
             const lifecycle = input.lifecycle;
             if (!lifecycle)
                 throw denied();
-            const { job } = input, pkg = job.taskPackage, scope = pkg.local_fix_scope, repo = pkg.repository, limits = scope?.candidate_limits, allowed = scope?.allowed_paths;
+            const { job } = input, pkg = job.taskPackage, scope = pkg.local_fix_scope, repo = pkg.repository, rawLimits = scope?.candidate_limits, allowed = scope?.allowed_paths;
             const root = await realpath(options.privateRoot), st = await lstat(root);
-            if (!lifecycle.isCurrent() || pkg.runtime_adapter !== 'codex_cli' || !scope || scope.verification_mode !== mode || scope.ci_profile_fingerprint !== registration.ci_profile_fingerprint || protocolHash(scope.ci_profile) !== protocolHash(registration.ci_profile) || !Array.isArray(scope.required_commands) || scope.required_commands.length || !scope.registered_tests || typeof scope.registered_tests !== 'object' || Object.keys(scope.registered_tests).length || !Array.isArray(allowed) || !allowed.length || allowed.some(p => typeof p !== 'string' || !(safePath(p) || p.endsWith('/**') && safePath(p.slice(0, -3)))) || protocolHash(allowed) !== protocolHash(pkg.allowed_paths) || repo.key !== registration.project || job.gatewayTaskPackageFingerprint !== protocolHash(pkg) || Object.entries(registration.receipt).some(([k, v]) => scope[k] !== v) || !limits || ['max_changed_files', 'max_diff_bytes', 'max_file_bytes'].some(k => !Number.isSafeInteger(limits[k]) || limits[k] < 1) || root !== options.privateRoot || !st.isDirectory() || st.isSymbolicLink() || (st.mode & 0o077) !== 0 || (process.getuid && st.uid !== process.getuid()) || root === input.checkoutPath || root.startsWith(input.checkoutPath + path.sep))
+            if (!lifecycle.isCurrent() || pkg.runtime_adapter !== 'codex_cli' || !scope || scope.verification_mode !== mode || scope.ci_profile_fingerprint !== registration.ci_profile_fingerprint || protocolHash(scope.ci_profile) !== protocolHash(registration.ci_profile) || !Array.isArray(scope.required_commands) || scope.required_commands.length || !scope.registered_tests || typeof scope.registered_tests !== 'object' || Object.keys(scope.registered_tests).length || !Array.isArray(allowed) || !allowed.length || allowed.some(p => typeof p !== 'string' || !(safePath(p) || p.endsWith('/**') && safePath(p.slice(0, -3)))) || protocolHash(allowed) !== protocolHash(pkg.allowed_paths) || repo.key !== registration.project || job.gatewayTaskPackageFingerprint !== protocolHash(pkg) || Object.entries(registration.receipt).some(([k, v]) => scope[k] !== v) || root !== options.privateRoot || !st.isDirectory() || st.isSymbolicLink() || (st.mode & 0o077) !== 0 || (process.getuid && st.uid !== process.getuid()) || root === input.checkoutPath || root.startsWith(input.checkoutPath + path.sep))
                 throw denied();
+            const limits = candidateLimits(rawLimits, mode === 'gateway_publish_v1');
             const fence = { jobId: job.id, generation: job.generation, leaseToken: job.leaseToken, launchGrant: job.launchGrant, bindingId: input.bindingId };
             const binding = bindingProof((await options.gateway.localPublicationContext(fence)).context);
             if (binding.runner_id !== options.runnerId || binding.binding_id !== input.bindingId || binding.job_id !== job.id || binding.generation !== job.generation || binding.work_loop_id !== job.workLoopId || binding.repository_key !== repo.key || binding.base_commit_sha !== repo.base_commit_sha || binding.working_branch !== repo.working_branch || binding.working_branch !== `ai-work/local/${binding.attempt_id}` || binding.attempt_id !== scope.attempt_id || binding.contract_fingerprint !== job.gatewayContractFingerprint || binding.task_package_fingerprint !== job.gatewayTaskPackageFingerprint || binding.launch_fingerprint !== job.launchFingerprint)
@@ -99,7 +101,17 @@ export function createServerCiLocalFixHost(options) {
                         phase = 'snapshot_observe';
                         const observed = await host.observe();
                         phase = 'candidate_limits';
-                        if (Buffer.byteLength(observed.diff) > limits.max_diff_bytes)
+                        let split;
+                        if (limits.version === 2) {
+                            try {
+                                split = measureSplitDelta(observed.diff, limits, report);
+                            }
+                            catch (error) {
+                                const code = trustedCandidateLimitCode(error);
+                                throw publicationError(phase, code === 'CHANGE_LIMIT_REJECTED' ? 'LOCAL_FIX_CHANGE_LIMIT_REJECTED' : code === 'PAYLOAD_LIMIT_REJECTED' ? 'LOCAL_FIX_PAYLOAD_LIMIT_REJECTED' : code === 'FILE_LIMIT_REJECTED' ? 'LOCAL_FIX_FILE_LIMIT_REJECTED' : code === 'FILE_COUNT_REJECTED' ? 'LOCAL_FIX_FILE_COUNT_REJECTED' : 'LOCAL_FIX_CHANGE_MEASUREMENT_REJECTED');
+                            }
+                        }
+                        if (limits.version !== 2 && Buffer.byteLength(observed.diff) > limits.max_diff_bytes)
                             throw publicationError(phase, 'LOCAL_FIX_DIFF_LIMIT_REJECTED');
                         if (!observed.changed_files.length || observed.changed_files.length > limits.max_changed_files)
                             throw publicationError(phase, 'LOCAL_FIX_FILE_COUNT_REJECTED');
@@ -156,7 +168,7 @@ export function createServerCiLocalFixHost(options) {
                                     if (!s.isFile() || s.nlink !== 1n || s.dev !== before.dev || s.ino !== before.ino || s.size !== before.size || s.mtimeNs !== before.mtimeNs || s.ctimeNs !== before.ctimeNs || s.mode !== before.mode)
                                         throw denied();
                                 bytes += content.length;
-                                if (bytes > limits.max_diff_bytes)
+                                if (limits.version !== 2 && bytes > limits.max_diff_bytes)
                                     throw publicationError(phase, 'LOCAL_FIX_DIFF_LIMIT_REJECTED');
                                 if (content.includes(0) || !Buffer.from(content.toString('utf8'), 'utf8').equals(content))
                                     throw publicationError(phase, 'LOCAL_FIX_FILE_ENCODING_REJECTED');
@@ -166,6 +178,8 @@ export function createServerCiLocalFixHost(options) {
                                 await fd.close();
                             }
                         }
+                        if (split && protocolHash(split.files) !== protocolHash(files))
+                            throw publicationError('candidate_files');
                         phase = 'journal';
                         const journal = new FilePublicationJournal(root), key = protocolHash({ mode, binding }), deltaFingerprint = protocolHash({ binding, files, profile: registration.ci_profile_fingerprint, ...(report ? { validation_report: report } : {}) });
                         return journal.exclusive(key, async () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.52",
+  "version": "0.1.53",
   "private": false,
   "license": "UNLICENSED",
   "bin": {