mtech-ai-local-runner 0.1.61 → 0.1.62

package/README.md

@@ -889,10 +889,12 @@ The reviewed manual Codex path preserves the existing CLI and ChatGPT login. It
 ### Local Fix with disclosed validation
 
 The existing daemon can use a reviewed `gateway_publish_v1` installation for
-approved local Codex fixes. It freezes the owned model and sends only sealed,
-bounded changed text files to Gateway's existing publication service. Server
-credentials create the generated branch and canonical development PR; no local
-Git token, ECR, new CI installation or native PHP verifier is required.
+approved local Codex fixes, and Claude fixes once the Gateway lists a reviewed
+Claude release and the runner reports Claude ready. It freezes the owned model
+and sends only sealed, bounded changed text files to Gateway's existing
+publication service. Server credentials create the generated branch and
+canonical development PR; no local Git token, ECR, new CI installation or native
+PHP verifier is required.
 
 Validation is explicitly **UNVERIFIED** in this mode, with CI **not run**.
 Executor-reported checks, failures and checks not run stay attributed to the
@@ -915,6 +917,10 @@ the older `authenticated` field still means execution eligibility. A logged-in
 Claude account can remain blocked by unverified security admission. Do not log out
 or change credentials just because that legacy field is false. Unknown status is
 not evidence of logout. These diagnostics do not bypass per-job admission.
+Claude reports `CLAUDE_RELEASE_NOT_LISTED` while the Gateway lists no reviewed
+Claude release. Claude readiness may lag a Claude login or logout by up to 5
+minutes, because the runner asks the pinned copy for the login state at most that
+often.
 
 ### 0.1.50: small edits and publication-only Fix
 

package/dist/src/adapters/claude-code/adapter.js

@@ -1,5 +1,6 @@
 import path from "node:path";
 import { requireSecurityRequirements } from '../../safety/security-requirements.js';
+import { CLAUDE_RELEASE_MODE, CLAUDE_TRANSPORT } from '../../safety/claude-release.js';
 import { createJobSecurityReceipt } from '../../safety/job-security-receipt.js';
 import { isTerminalEventType } from "../../protocol.js";
 import { parseClaudeLine } from "./stream-parser.js";
@@ -92,7 +93,11 @@ export class ClaudeCodeAdapter {
                 if (ctx.approvedTaskPackage?.resolved_provider !== "anthropic" || ctx.approvedTaskPackage?.resolved_model_id !== resolvedModelId
                     || ctx.approvedTaskPackage?.repository?.base_commit_sha !== this.options.securityPolicy.pin.sourceSha)
                     throw new Error("SECURITY_REQUIREMENTS_REJECTED");
-                requireSecurityRequirements(ctx.approvedTaskPackage?.security_requirements, { adapterId: "claude_code_cli", adapterVersion: "1", requirementsSha256: this.options.securityPolicy.pin.requirementsSha256 });
+                const requirements = requireSecurityRequirements(ctx.approvedTaskPackage?.security_requirements, { adapterId: "claude_code_cli", adapterVersion: "1", requirementsSha256: this.options.securityPolicy.pin.requirementsSha256 });
+                // Release mode (decision 9095c7a8): the approved package carries the fixed stream-json transport and a model of its release.
+                if (requirements.security_mode === CLAUDE_RELEASE_MODE && (ctx.approvedTaskPackage?.runtime_transport !== CLAUDE_TRANSPORT
+                    || !requirements.model_ids.includes(resolvedModelId)))
+                    throw new Error("SECURITY_REQUIREMENTS_REJECTED");
             };
             assertAdmission();
             if (!ctx.securityBinding)
@@ -277,6 +282,23 @@ export class ClaudeCodeAdapter {
         });
         return this.cancelPromise;
     }
+    /** Owned exit before credential-bearing publication, with Codex semantics (decision 9095c7a8). It revokes the job
+     * security session and the MCP endpoint, stops the owned process group and confirms it within 10 seconds. */
+    async freezeForPublication() {
+        if (!this.started || !this.handle?.terminateOwned)
+            throw new Error('CLAUDE_PUBLICATION_FREEZE_UNCONFIRMED');
+        let timer;
+        try {
+            await Promise.race([this.cancel(), new Promise((_, reject) => { timer = setTimeout(() => reject(new Error('CLAUDE_PUBLICATION_FREEZE_UNCONFIRMED')), 10_000); })]);
+        }
+        catch {
+            throw new Error('CLAUDE_PUBLICATION_FREEZE_UNCONFIRMED');
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
+    }
     securityRevoked = false;
     revokeSecurity() {
         if (this.securityRevoked)
@@ -369,6 +391,6 @@ export class ClaudeCodePlugin {
         return { ...result, capabilities: result.capabilities ?? this.capabilities };
     }
     async create(input) {
-        return new ClaudeCodeAdapter(this.pluginOptions.options(input));
+        return new ClaudeCodeAdapter(await this.pluginOptions.options(input));
     }
 }

package/dist/src/adapters/claude-code/login-status.js

@@ -0,0 +1,15 @@
+/** Reads `claude auth status --json` stdout without returning raw output. `loggedOutExit` marks Claude's exit 1,
+ * which never proves a login. Anything unparsable stays unknown. */
+export function claudeLoginFromStatus(stdout, loggedOutExit = false) {
+    try {
+        const value = JSON.parse(stdout);
+        if (value && typeof value === 'object' && !Array.isArray(value) && typeof value.loggedIn === 'boolean') {
+            const loggedIn = value.loggedIn;
+            if (loggedOutExit && loggedIn)
+                return { authenticated: false, loginStatus: 'unknown' };
+            return { authenticated: loggedIn, loginStatus: loggedIn ? 'authenticated' : 'unauthenticated' };
+        }
+    }
+    catch { /* Unknown evidence stays closed; never expose raw output. */ }
+    return { authenticated: false, loginStatus: 'unknown' };
+}

package/dist/src/adapters/discovery.js

@@ -1,4 +1,5 @@
 import { adapterStatus } from './status.js';
+import { claudeLoginFromStatus } from './claude-code/login-status.js';
 import { createCodexProductionHost } from '../safety/codex-production-host.js';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
@@ -22,16 +23,6 @@ export async function discoverAdapters(env, command = run, adapterIds = ['claude
                 throw new Error('invalid version');
             let authenticated = false;
             let loginStatus = 'unknown';
-            const parseClaudeStatus = (stdout) => {
-                try {
-                    const value = JSON.parse(stdout);
-                    if (value && typeof value === 'object' && !Array.isArray(value) && typeof value.loggedIn === 'boolean') {
-                        authenticated = value.loggedIn;
-                        loginStatus = authenticated ? 'authenticated' : 'unauthenticated';
-                    }
-                }
-                catch { /* Unknown evidence stays closed; never expose raw output. */ }
-            };
             try {
                 const auth = await command(binary, codex ? ['login', 'status'] : ['auth', 'status', '--json']);
                 if (codex) {
@@ -39,20 +30,15 @@ export async function discoverAdapters(env, command = run, adapterIds = ['claude
                     loginStatus = authenticated ? 'authenticated' : 'unauthenticated';
                 }
                 else
-                    parseClaudeStatus(auth.stdout);
+                    ({ authenticated, loginStatus } = claudeLoginFromStatus(auth.stdout));
             }
             catch (error) {
                 // Claude exits 1 for a known logged-out JSON response. Other failures
                 // (including timeout/permission errors) do not prove logout.
                 if (!codex && error && typeof error === 'object' && error.code === 1) {
                     const stdout = error.stdout;
-                    if (typeof stdout === 'string') {
-                        parseClaudeStatus(stdout);
-                        if (authenticated) {
-                            authenticated = false;
-                            loginStatus = 'unknown';
-                        }
-                    }
+                    if (typeof stdout === 'string')
+                        ({ authenticated, loginStatus } = claudeLoginFromStatus(stdout, true));
                 }
             }
             if (codex) {

package/dist/src/daemon/runtime.js

@@ -1,5 +1,7 @@
+import { createClaudeProductionHost } from '../safety/claude-production-host.js';
 import { adapterStatus } from '../adapters/status.js';
 import { loadInstalledLocalFixHost } from '../publication/installed-host.js';
+import { isLocalFixAdapter } from '../publication/local-fix-adapters.js';
 import { createCodexDaemonHost } from '../safety/codex-daemon-host.js';
 import { reconcileTerminalState } from './terminal-recovery.js';
 import { packageVersion } from '../package-version.js';
@@ -36,6 +38,15 @@ export async function buildDaemon(input) {
     const claudeParts = [input.claudeSecurityHost, input.claudeSupportedProbe, input.claudeBinaryIdentity].filter(Boolean).length;
     if (claudeParts !== 0 && claudeParts !== 3)
         throw new Error('CLAUDE_SUPPORTED_HOST_REQUIRED');
+    // Claude admission (decision 9095c7a8): the compiled release host, unless a test injects the whole trusted tuple.
+    const claudeProduction = claudeParts === 0 ? createClaudeProductionHost({ home: input.env.HOME ?? '', env: input.env, fetchFn: input.fetchFn,
+        report: event => { process.stderr.write(`${JSON.stringify(event)}\n`); } }) : undefined;
+    const claude = {
+        probe: input.claudeSupportedProbe ?? (() => claudeProduction.probe()),
+        securityHost: input.claudeSecurityHost ?? claudeProduction.securityHost,
+        // Per job: a release change moves the pinned launch path, so the identity is captured at adapter creation.
+        binaryIdentity: async () => input.claudeBinaryIdentity ?? claudeProduction.binaryIdentity(),
+    };
     if (input.codexSupportedProbe && !input.codexSecurityHost)
         throw new Error('CODEX_SUPPORTED_HOST_REQUIRED');
     const production = !input.codexSecurityHost && !input.codexSupportedProbe ? createCodexDaemonHost({ runnerId: input.runnerId, binary: input.env.AI_GATEWAY_LOCAL_RUNNER_CODEX_BINARY ?? 'codex', home: input.env.HOME ?? '', codexHome: input.env.CODEX_HOME, searchPath: input.env.PATH }) : undefined;
@@ -70,12 +81,11 @@ export async function buildDaemon(input) {
     // The same parts the CLI self-test ran before starting this daemon (verifyPackagedHook).
     const hook = packagedHookCommandParts();
     const plugin = new ClaudeCodePlugin({
-        probe: async () => input.claudeSupportedProbe ? input.claudeSupportedProbe() : (await discoverAdapters(input.env, undefined, ['claude_code_cli']))[0],
-        options: ({ worktreePath, jobId }) => createClaudeCodeAdapterOptions({
+        probe: () => claude.probe(),
+        options: async ({ worktreePath, jobId }) => createClaudeCodeAdapterOptions({
             worktreePath, jobId, stateRoot: input.stateRoot, env: input.env,
             maxBudgetUsd: Number.MAX_SAFE_INTEGER, hookExecutablePath: hook.hookScriptPath, hookNodeExecutablePath: hook.nodeExecutablePath,
-            binaryPath: input.env.AI_GATEWAY_LOCAL_RUNNER_CLAUDE_BINARY,
-            securityHost: input.claudeSecurityHost, binaryIdentity: input.claudeBinaryIdentity,
+            securityHost: claude.securityHost, binaryIdentity: await claude.binaryIdentity(),
         }),
     });
     const codex = new CodexPlugin({
@@ -162,24 +172,26 @@ export async function buildDaemon(input) {
         snapshot: async () => {
             // Adapter probes run only between jobs, as they did when the job loop sent the heartbeat.
             if (!poller.running) {
-                const probe = (async () => {
-                    if (input.claudeSupportedProbe) {
-                        let current;
-                        try {
-                            current = await plugin.probe();
-                        }
-                        catch {
-                            current = { available: false, authenticated: false, capabilities: [] };
-                        }
-                        const ready = adapterStatus(current).authenticated && !!current.executableVersion && plugin.capabilities.every(c => current.capabilities.includes(c));
-                        const index = probes.findIndex(p => p.id === 'claude_code_cli');
-                        if (index >= 0)
-                            probes[index] = { id: 'claude_code_cli', version: '1', ...current, available: ready };
-                        if (ready)
-                            versions.claude_code_cli = '1';
-                        else
-                            delete versions.claude_code_cli;
+                // Claude readiness follows the synced release list, so it is refreshed like Codex. The two refreshes run
+                // concurrently and each keeps its own failure handling, so Claude neither delays nor changes the Codex result.
+                const refreshClaude = async () => {
+                    let current;
+                    try {
+                        current = await plugin.probe();
                     }
+                    catch {
+                        current = { available: false, authenticated: false, capabilities: [] };
+                    }
+                    const ready = adapterStatus(current).authenticated && !!current.executableVersion && plugin.capabilities.every(c => current.capabilities.includes(c));
+                    const index = probes.findIndex(p => p.id === 'claude_code_cli');
+                    if (index >= 0)
+                        probes[index] = { id: 'claude_code_cli', version: '1', ...current, available: ready };
+                    if (ready)
+                        versions.claude_code_cli = '1';
+                    else
+                        delete versions.claude_code_cli;
+                };
+                const refreshCodex = async () => {
                     let current;
                     try {
                         current = await codex.probe();
@@ -195,6 +207,14 @@ export async function buildDaemon(input) {
                         versions.codex_cli = '1';
                     else
                         delete versions.codex_cli;
+                };
+                // Both refreshes always run to the end, so a failure outside one never leaves the other writing under a claim;
+                // the first failure then surfaces as it did before.
+                const probe = (async () => {
+                    const settled = await Promise.allSettled([refreshClaude(), refreshCodex()]);
+                    const failed = settled.find((result) => result.status === "rejected");
+                    if (failed)
+                        throw failed.reason;
                 })();
                 probing = probe.catch(() => undefined);
                 await probe;
@@ -231,6 +251,7 @@ export async function buildDaemon(input) {
                 failureCode: result.status === "failed" ? result.failureCode : undefined }, signal);
         },
         guide,
+        ...(claudeProduction ? { claude: claudeProduction } : {}),
         asks,
         closureAcks,
         jobs: poller,
@@ -273,7 +294,18 @@ export async function buildDaemon(input) {
         reportRecoveryRequired: reason => { process.stderr.write(`${JSON.stringify({ event: 'runner_recovery_required', reason })}\n`); },
     });
     // Model tools have no Gateway relay. Each adapter owns and closes its job endpoint.
-    return { daemon, close: async () => { daemon.stop(); await production?.close(); } };
+    // The Claude host always closes; a failing Claude close never masks a Codex close failure.
+    return { daemon, close: async () => {
+            daemon.stop();
+            try {
+                await production?.close();
+            }
+            catch (error) {
+                await claudeProduction?.close().catch(() => undefined);
+                throw error;
+            }
+            await claudeProduction?.close();
+        } };
 }
 export function runnerDisplayName() { return `${hostname()} local AI`; }
 /** The execution blocker a full runner reports for every adapter while it takes no jobs. */
@@ -326,7 +358,7 @@ export function localRunnerCapabilities(probes, trustedLocalFixHost = false, ver
         const status = adapterStatus(probe);
         const authenticated = status.authenticated;
         const capabilities = probe.capabilities.filter(value => value !== 'local_fix_publication_v1' && value !== 'local_fix_gateway_ci_v1' && value !== 'local_fix_gateway_publish_v1');
-        if (trustedLocalFixHost && authenticated && probe.id === 'codex_cli') {
+        if (trustedLocalFixHost && authenticated && isLocalFixAdapter(probe.id)) {
             capabilities.push('local_fix_publication_v1');
             if (verificationMode === 'gateway_ci_v1')
                 capabilities.push('local_fix_gateway_ci_v1');

package/dist/src/gateway-client.js

@@ -1,5 +1,6 @@
 import { publicationError } from './publication/failure.js';
 import { issueTransportDiagnostic } from './safety/transport-diagnostic.js';
+import { parseClaudeSyncRelease } from "./safety/claude-release.js";
 import { createHash } from "node:crypto";
 import { v5 as uuidv5 } from "uuid";
 import { bindingApprovalIdFromEnv, redact } from "./config.js";
@@ -33,6 +34,7 @@ export function parseRunnerSync(result, runnerId) {
         ...(Array.isArray(body.closed_delivery_ids) ? { closedDeliveryIds: body.closed_delivery_ids } : {}),
         ...("guidance_policy" in body ? { guidancePolicy: body.guidance_policy } : {}),
         ...(typeof body.guidance_policy_version === "string" ? { guidancePolicyVersion: body.guidance_policy_version } : {}),
+        ...("claude_release" in body ? { claudeRelease: parseClaudeSyncRelease(body.claude_release) } : {}),
         jobAvailable: body.job_available === true,
         push: parsePush(body.push, runnerId),
         syncSeconds: clampSeconds(body.sync_seconds, 15, 120, 30),

package/dist/src/publication/local-fix-adapters.js

@@ -0,0 +1,4 @@
+/** Runtime adapters whose admitted jobs may use employee-local Fix publication (decision 9095c7a8 adds Claude).
+ * Membership grants nothing alone: each job still needs its adapter's host admission and the Gateway's Fix policy. */
+export const LOCAL_FIX_ADAPTERS = Object.freeze(['codex_cli', 'claude_code_cli']);
+export function isLocalFixAdapter(value) { return typeof value === 'string' && LOCAL_FIX_ADAPTERS.includes(value); }

package/dist/src/publication/production-host.js

@@ -4,6 +4,7 @@ import { lstat, realpath, open, rename, unlink } from 'node:fs/promises';
 import path from 'node:path';
 import { CandidateVerifier, protocolHash } from './candidate.js';
 import { createLocalFixExecutionHost } from './execution-host.js';
+import { isLocalFixAdapter } from './local-fix-adapters.js';
 import { GitSnapshotHost, SNAPSHOT_TREE_MAX_BYTES } from './git-snapshot.js';
 import { createSealedIsolatedVerifier } from './isolated-verifier.js';
 import { FilePublicationJournal } from './journal.js';
@@ -29,7 +30,7 @@ export function createProductionLocalFixHost(options) {
             if (!lifecycle)
                 throw Error('LOCAL_FIX_OWNED_LIFECYCLE_REQUIRED');
             const { job, bindingId } = input, pkg = job.taskPackage, repo = pkg.repository, scope = pkg.local_fix_scope;
-            if (!lifecycle.isCurrent() || repo.provider_url !== options.origin || repo.key !== registration.manifest.project || job.gatewayTaskPackageFingerprint !== protocolHash(pkg) || pkg.runtime_adapter !== 'codex_cli')
+            if (!lifecycle.isCurrent() || repo.provider_url !== options.origin || repo.key !== registration.manifest.project || job.gatewayTaskPackageFingerprint !== protocolHash(pkg) || !isLocalFixAdapter(pkg.runtime_adapter))
                 throw denied();
             const root = await realpath(options.privateRoot), stat = await lstat(root);
             if (root !== options.privateRoot || !stat.isDirectory() || stat.isSymbolicLink() || (stat.mode & 0o077) !== 0 || (process.getuid && stat.uid !== process.getuid()) || root === input.checkoutPath || root.startsWith(input.checkoutPath + path.sep))

package/dist/src/publication/server-ci-host.js

@@ -12,6 +12,7 @@ import { protocolHash } from './candidate.js';
 import { FilePublicationJournal } from './journal.js';
 import { GitSnapshotHost, SNAPSHOT_TREE_MAX_BYTES } from './git-snapshot.js';
 import { PublicationOutcomeUnknownError } from './publisher.js';
+import { isLocalFixAdapter } from './local-fix-adapters.js';
 const denied = () => Error('LOCAL_FIX_SERVER_CI_REJECTED');
 const safePath = (p) => typeof p === 'string' && p.length > 0 && !p.includes('\\') && !p.includes('\0') && !path.isAbsolute(p) && p.split('/').every(s => s !== '' && s !== '.' && s !== '..' && !/^(?:\.git|\.mcp(?:\..*)?|\.npmrc|\.netrc|id_rsa|id_ed25519|\.local-runner|\.runner|\.env(?:\..*)?|\.codex|\.claude|\.ssh|\.aws|\.config|auth\.(?:json|toml|ya?ml)(?:\..*)?|credentials(?:\..*)?|AGENTS\.md|CLAUDE\.md|mcp\.(?:json|toml|ya?ml)(?:\..*)?)$/i.test(s));
 const matches = (p, s) => s.endsWith('/**') ? safePath(s.slice(0, -3)) && (p === s.slice(0, -3) || p.startsWith(s.slice(0, -2))) : safePath(s) && p === s;
@@ -70,7 +71,7 @@ export function createServerCiLocalFixHost(options) {
                 throw denied();
             const { job } = input, pkg = job.taskPackage, scope = pkg.local_fix_scope, repo = pkg.repository, rawLimits = scope?.candidate_limits, allowed = scope?.allowed_paths;
             const root = await realpath(options.privateRoot), st = await lstat(root);
-            if (!lifecycle.isCurrent() || pkg.runtime_adapter !== 'codex_cli' || !scope || scope.verification_mode !== mode || scope.ci_profile_fingerprint !== registration.ci_profile_fingerprint || protocolHash(scope.ci_profile) !== protocolHash(registration.ci_profile) || !Array.isArray(scope.required_commands) || scope.required_commands.length || !scope.registered_tests || typeof scope.registered_tests !== 'object' || Object.keys(scope.registered_tests).length || !Array.isArray(allowed) || !allowed.length || allowed.some(p => typeof p !== 'string' || !(safePath(p) || p.endsWith('/**') && safePath(p.slice(0, -3)))) || protocolHash(allowed) !== protocolHash(pkg.allowed_paths) || repo.key !== registration.project || job.gatewayTaskPackageFingerprint !== protocolHash(pkg) || Object.entries(registration.receipt).some(([k, v]) => scope[k] !== v) || root !== options.privateRoot || !st.isDirectory() || st.isSymbolicLink() || (st.mode & 0o077) !== 0 || (process.getuid && st.uid !== process.getuid()) || root === input.checkoutPath || root.startsWith(input.checkoutPath + path.sep))
+            if (!lifecycle.isCurrent() || !isLocalFixAdapter(pkg.runtime_adapter) || !scope || scope.verification_mode !== mode || scope.ci_profile_fingerprint !== registration.ci_profile_fingerprint || protocolHash(scope.ci_profile) !== protocolHash(registration.ci_profile) || !Array.isArray(scope.required_commands) || scope.required_commands.length || !scope.registered_tests || typeof scope.registered_tests !== 'object' || Object.keys(scope.registered_tests).length || !Array.isArray(allowed) || !allowed.length || allowed.some(p => typeof p !== 'string' || !(safePath(p) || p.endsWith('/**') && safePath(p.slice(0, -3)))) || protocolHash(allowed) !== protocolHash(pkg.allowed_paths) || repo.key !== registration.project || job.gatewayTaskPackageFingerprint !== protocolHash(pkg) || Object.entries(registration.receipt).some(([k, v]) => scope[k] !== v) || root !== options.privateRoot || !st.isDirectory() || st.isSymbolicLink() || (st.mode & 0o077) !== 0 || (process.getuid && st.uid !== process.getuid()) || root === input.checkoutPath || root.startsWith(input.checkoutPath + path.sep))
                 throw denied();
             const limits = candidateLimits(rawLimits, mode === 'gateway_publish_v1');
             const fence = { jobId: job.id, generation: job.generation, leaseToken: job.leaseToken, launchGrant: job.launchGrant, bindingId: input.bindingId };

package/dist/src/safety/claude-managed-scope.js

@@ -0,0 +1,87 @@
+import os from 'node:os';
+import path from 'node:path';
+import { lstat, readdir } from 'node:fs/promises';
+import { createPolicyInventoryClient, verifyPolicyObserver } from './policy-inventory-client.js';
+import { CLAUDE_MANAGED_PREFERENCE_DOMAIN, CLAUDE_MANAGED_SETTINGS_DIRECTORY, CLAUDE_MANAGED_SETTINGS_FILES, CLAUDE_POLICY_OBSERVER, claudeCanonicalSha256 } from './claude-release.js';
+const unverified = () => Error('CLAUDE_MANAGED_SCOPE_UNVERIFIED');
+/** Claude managed sources the Runner checks on macOS (gate managed_scope_exclusion, scope unmanaged_personal_only). */
+export function claudeManagedPaths(user, root = '/') {
+    if (!/^[A-Za-z0-9._-]{1,255}$/.test(user) || user.startsWith('.') || !path.isAbsolute(root))
+        throw unverified();
+    const at = (file) => path.join(root, file);
+    return { directory: at(CLAUDE_MANAGED_SETTINGS_DIRECTORY), files: [...CLAUDE_MANAGED_SETTINGS_FILES.map(at),
+            at(`/Library/Managed Preferences/${CLAUDE_MANAGED_PREFERENCE_DOMAIN}.plist`), at(`/Library/Managed Preferences/${user}/${CLAUDE_MANAGED_PREFERENCE_DOMAIN}.plist`)] };
+}
+async function absent(file) {
+    try {
+        await lstat(file);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return;
+        throw unverified();
+    }
+    throw unverified();
+}
+/** Each managed file must be absent. The settings directory must be absent or an empty real directory,
+ * so drop-in or unknown sources also block. Unreadable means unknown, and unknown blocks. */
+export async function assertClaudeManagedPathsAbsent(user, root = '/') {
+    const { directory, files } = claudeManagedPaths(user, root);
+    for (const file of files)
+        await absent(file);
+    let s;
+    try {
+        s = await lstat(directory);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return;
+        throw unverified();
+    }
+    if (!s.isDirectory() || s.isSymbolicLink())
+        throw unverified();
+    let entries;
+    try {
+        entries = await readdir(directory);
+    }
+    catch {
+        throw unverified();
+    }
+    if (entries.length !== 0)
+        throw unverified();
+}
+/** Compiled defaults: the pinned installed observer (single-use clients) and the real managed locations. */
+export function claudeManagedScopeDeps(root = '/') {
+    return {
+        checkReady: async () => { verifyPolicyObserver(CLAUDE_POLICY_OBSERVER); await createPolicyInventoryClient(CLAUDE_POLICY_OBSERVER).checkReady(); },
+        collect: () => createPolicyInventoryClient(CLAUDE_POLICY_OBSERVER).collectOnce(),
+        managedPathsAbsent: () => assertClaudeManagedPathsAbsent(os.userInfo().username, root),
+    };
+}
+export async function claudeManagedScopeReady(deps) {
+    try {
+        await deps.checkReady();
+        await deps.managedPathsAbsent();
+    }
+    catch {
+        throw unverified();
+    }
+}
+/** Per-job managed scope: no configuration profile at all for machine and user (complete, empty, at most 60 s old),
+ * plus absent Claude managed files. Managed, partial, unknown or stale input blocks. */
+export async function collectClaudeManagedScope(deps) {
+    try {
+        const value = await deps.collect(), now = (deps.now ?? Date.now)();
+        const r = value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+        const observedAt = r.observedAt;
+        if (r.complete !== true || r.empty !== true || r.scope !== 'machine_and_current_user' || typeof observedAt !== 'number' || !Number.isSafeInteger(observedAt)
+            || observedAt > now || now - observedAt > 60_000 || typeof r.inventoryFingerprint !== 'string' || !/^[a-f0-9]{64}$/.test(r.inventoryFingerprint))
+            throw unverified();
+        await deps.managedPathsAbsent();
+        const bound = { observer_sha256: CLAUDE_POLICY_OBSERVER.sha256, inventory_fingerprint: r.inventoryFingerprint, managed_paths: 'absent' };
+        return Object.freeze({ observerSha256: CLAUDE_POLICY_OBSERVER.sha256, inventoryFingerprint: r.inventoryFingerprint, fingerprint: claudeCanonicalSha256(bound) });
+    }
+    catch {
+        throw unverified();
+    }
+}