mtech-ai-local-runner 0.1.65 → 0.1.66

package/README.md

@@ -175,8 +175,9 @@ Only a session that a person is attending is served. A Claude Code session count
 is `1` or, where Claude Code does not export that variable, when `CLAUDE_CODE_ENTRYPOINT` names a terminal, the Claude
 desktop app or the VS Code extension. A headless `claude -p` or Agent SDK run gets nothing and is never counted as
 having seen an ask. Codex exports no such marker, so every Codex hook session counts. The runner's own jobs never
-count: a hook whose `HOME` is under `<stateRoot>/claude-jobs/` (where every Claude job runs) is refused, and Codex jobs
-run with `features.hooks=false`, so they run no hook at all.
+count: a hook that sees the runner's hook policy variable, or a `TMPDIR` under `<stateRoot>/claude-jobs/` (where every
+Claude job keeps its controls), is refused. A Claude job keeps the person's `HOME`, so `HOME` alone does not tell it
+apart. Codex jobs run with `features.hooks=false`, so they run no hook at all.
 
 An ask is shown at a session start, at the next prompt (where it also counts as seen), at a turn end, or by waking an
 idle Claude session through an `asyncRewake` Stop watcher. An ask shown at a session start, at a turn end or by a wake

package/dist/src/adapters/claude-code/runtime-options.js

@@ -54,16 +54,16 @@ export function createClaudeCodeAdapterOptions(input) {
     if (inside(checkout, state))
         throw new Error('Claude job controls must be outside the checkout');
     const control = path.join(state, 'claude-jobs', randomUUID());
-    const home = path.join(control, 'home'), cwd = path.join(control, 'cwd'), config = path.join(control, 'mcp.json');
+    const cwd = path.join(control, 'cwd'), config = path.join(control, 'mcp.json');
     const env = {};
-    for (const key of ['PATH', 'LANG', 'LC_ALL', 'USER', 'LOGNAME'])
+    // Claude owns credential access, so it runs in the employee's own login context: their HOME, USER and LOGNAME, and
+    // CLAUDE_CONFIG_DIR only when they set it. macOS finds the login keychain through HOME, and a set CLAUDE_CONFIG_DIR
+    // moves Claude's Keychain item, so either change would hide the terminal's login (Work Decision b501d68d, design
+    // 2026-10-28-claude-job-login-context). Never read or copy its files or send this environment to scoped workers.
+    for (const key of ['PATH', 'LANG', 'LC_ALL', 'USER', 'LOGNAME', 'HOME', 'CLAUDE_CONFIG_DIR'])
         if (input.env[key] !== undefined)
             env[key] = input.env[key];
-    env.HOME = home;
-    env.TMPDIR = path.join(control, 'tmp'); // Claude owns credential access. Preserve the account location by path only;
-    // never read/copy its files or send this environment to scoped workers.
-    // https://code.claude.com/docs/en/authentication#log-in-with-multiple-accounts
-    env.CLAUDE_CONFIG_DIR = account;
+    env.TMPDIR = path.join(control, 'tmp');
     if (env.CLAUDE_CONFIG_DIR && !path.isAbsolute(env.CLAUDE_CONFIG_DIR))
         throw new Error('Claude account configuration path must be absolute');
     return {
@@ -114,7 +114,7 @@ export function createClaudeCodeAdapterOptions(input) {
                     throw Error('CLAUDE_CONTROL_ALIAS_REJECTED');
                 await mkdir(control, { mode: 0o700 });
                 owned = true;
-                for (const directory of [home, cwd, env.TMPDIR])
+                for (const directory of [cwd, env.TMPDIR])
                     await mkdir(directory, { mode: 0o700 });
                 let active = true;
                 const tools = new JobToolSession({

package/dist/src/asks/hook-client.js

@@ -13,29 +13,32 @@ const STATE_ROOT_FLAG = "--state-root=";
  * Agent SDK, mcp, local-agent, remote and the GitHub action for the rest), so any other value is not a person.
  */
 const INTERACTIVE_ENTRYPOINTS = new Set(["cli", "claude-desktop", "claude-vscode"]);
-/** Where the Claude adapter puts each job's HOME: <stateRoot>/claude-jobs/<id>/home (src/adapters/claude-code/runtime-options.ts). */
+/** Where the Claude adapter puts each job's controls, its TMPDIR among them: <stateRoot>/claude-jobs/<id>/
+ * (src/adapters/claude-code/runtime-options.ts). Runners before 0.1.66 also put the job's HOME there. */
 const CLAUDE_JOBS_DIR = "claude-jobs";
-/** True when HOME resolves inside <stateRoot>/claude-jobs/: a Claude job this runner started, never a person's session. */
-function isRunnerJobHome(env, stateRoot) {
-    const home = env.HOME;
-    if (!home || !isAbsolute(home))
-        return false;
+/** HOOK_POLICY_ENV_VAR of src/safety/hook-policy-builder.ts, named here so this client loads no safety module; a test keeps the two in step. */
+const RUNNER_HOOK_POLICY_ENV = "AI_GATEWAY_RUNNER_HOOK_POLICY_B64";
+/** True when the hook runs in a Claude job this runner started, never a person's session: the environment carries the
+ * runner's hook policy, which every job launch sets and the runner's own hook needs, or its TMPDIR or HOME resolves
+ * inside <stateRoot>/claude-jobs/. A job keeps the person's HOME, so HOME alone no longer tells it apart. */
+function isRunnerJob(env, stateRoot) {
+    if (env[RUNNER_HOOK_POLICY_ENV] !== undefined)
+        return true;
     const roots = new Set([resolve(stateRoot)]);
-    // The adapter builds job homes from the real state root; the shim may name it through a symlink.
+    // The adapter builds job controls from the real state root; the shim may name it through a symlink.
     try {
         roots.add(realpathSync(stateRoot));
     }
     catch { /* A state root that does not exist holds no jobs. */ }
-    const resolved = resolve(home);
-    return [...roots].some(root => resolved.startsWith(join(root, CLAUDE_JOBS_DIR) + sep));
+    return [env.TMPDIR, env.HOME].some(dir => !!dir && isAbsolute(dir) && [...roots].some(root => resolve(dir).startsWith(join(root, CLAUDE_JOBS_DIR) + sep)));
 }
 /**
  * True when a person is attending the session that runs this hook (owner decision 2026-10-23). The one place that
  * decides it, so it can be adjusted after the pilot.
  *
- * The runner's own jobs never count. A Claude job runs with its HOME under <stateRoot>/claude-jobs/, so a hook that
- * sees such a HOME is refused whatever else the environment says. Codex jobs run with features.hooks=false (the Codex
- * adapter's isolation overrides), so they never run a hook at all.
+ * The runner's own jobs never count. A Claude job carries the runner's hook policy and a TMPDIR under
+ * <stateRoot>/claude-jobs/, so a hook that sees either is refused whatever else the environment says. Codex jobs run
+ * with features.hooks=false (the Codex adapter's isolation overrides), so they never run a hook at all.
  *
  * Claude Code: CLAUDE_CODE_SESSION_ATTENDED, where the Claude Code version exports it, is the answer: "1" is a
  * person, any other value is not, whatever the entrypoint says (a scheduled desktop task has the desktop entrypoint
@@ -47,7 +50,7 @@ function isRunnerJobHome(env, stateRoot) {
  * `input` is the parsed hook input, passed for the day Codex exposes such a marker.
  */
 export function isHumanSession(app, env, _input, stateRoot) {
-    if (isRunnerJobHome(env, stateRoot))
+    if (isRunnerJob(env, stateRoot))
         return false;
     if (app !== "claude")
         return true;

package/dist/src/guide/hook-client.js

@@ -16,22 +16,23 @@ const START_SOURCES = new Set(["startup", "clear", "compact"]);
 /** The same values as the asks hook client (src/asks/hook-client.ts): a test keeps the two in step. */
 const INTERACTIVE_ENTRYPOINTS = new Set(["cli", "claude-desktop", "claude-vscode"]);
 const CLAUDE_JOBS_DIR = "claude-jobs";
+/** HOOK_POLICY_ENV_VAR of src/safety/hook-policy-builder.ts, as in the asks hook client; a test keeps them in step. */
+const RUNNER_HOOK_POLICY_ENV = "AI_GATEWAY_RUNNER_HOOK_POLICY_B64";
 const TRUNCATED_SESSION_ID = /"session_id"\s*:\s*"([^"\\]{1,128})"/;
-function isRunnerJobHome(env, stateRoot) {
-    const home = env.HOME;
-    if (!home || !isAbsolute(home))
-        return false;
+/** The same rule as the asks hook client: the runner's hook policy, or a TMPDIR or HOME inside <stateRoot>/claude-jobs/. */
+function isRunnerJob(env, stateRoot) {
+    if (env[RUNNER_HOOK_POLICY_ENV] !== undefined)
+        return true;
     const roots = new Set([resolve(stateRoot)]);
     try {
         roots.add(realpathSync(stateRoot));
     }
     catch { /* A state root that does not exist holds no jobs. */ }
-    const resolved = resolve(home);
-    return [...roots].some(root => resolved.startsWith(join(root, CLAUDE_JOBS_DIR) + sep));
+    return [env.TMPDIR, env.HOME].some(dir => !!dir && isAbsolute(dir) && [...roots].some(root => resolve(dir).startsWith(join(root, CLAUDE_JOBS_DIR) + sep)));
 }
 /** True when a person attends the session: the asks hook client's rule, repeated so this client loads nothing of asks. */
 export function isHumanSession(app, env, stateRoot) {
-    if (isRunnerJobHome(env, stateRoot))
+    if (isRunnerJob(env, stateRoot))
         return false;
     if (app !== "claude")
         return true;

package/dist/src/safety/claude-production-host.js

@@ -47,15 +47,16 @@ const CLAUDE_LOGIN_PROBE_TIMEOUT_MS = 10_000;
 /** Readiness only: after a signature failure, the same release and copy identity is not re-hashed or run through
  * codesign again before this delay; a new identity, a new listing or the delay re-checks at once. */
 export const CLAUDE_SIGNATURE_RECHECK_MS = 5 * 60_000;
-/** `auth status --json` of the pinned copy, never the employee's own install, with a fixed environment and the job's
- * account location. The documented Claude Code opt-outs keep the probe from updating itself or sending other traffic.
+/** `auth status --json` of the pinned copy, never the employee's own install, with a fixed environment in the job's login
+ * context: the employee's HOME, USER and LOGNAME, and CLAUDE_CONFIG_DIR only when they set it (runtime-options.ts).
+ * The documented Claude Code opt-outs keep the probe from updating itself or sending other traffic.
  * `timeoutMs` is a trusted in-process test seam only. */
 export function pinnedClaudeLogin(home, env, timeoutMs = CLAUDE_LOGIN_PROBE_TIMEOUT_MS) {
     return binary => new Promise(resolve => {
-        const account = env.CLAUDE_CONFIG_DIR ?? path.join(home, '.claude');
-        if (!path.isAbsolute(account) || !path.isAbsolute(binary) || !path.isAbsolute(home))
+        const account = env.CLAUDE_CONFIG_DIR;
+        if (account !== undefined && !path.isAbsolute(account) || !path.isAbsolute(binary) || !path.isAbsolute(home))
             return resolve({ authenticated: false, loginStatus: 'unknown' });
-        const childEnv = { PATH: '/usr/bin:/bin', LANG: 'C', LC_ALL: 'C', HOME: home, CLAUDE_CONFIG_DIR: account,
+        const childEnv = { PATH: '/usr/bin:/bin', LANG: 'C', LC_ALL: 'C', HOME: home, ...(account === undefined ? {} : { CLAUDE_CONFIG_DIR: account }),
             DISABLE_AUTOUPDATER: '1', CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: '1' };
         for (const key of ['USER', 'LOGNAME']) {
             const value = env[key];

package/dist/src/safety/claude-review-campaign.js

@@ -14,7 +14,7 @@ import { CLAUDE_LAUNCH_OPT_OUTS, CLAUDE_SIGNING_IDENTIFIER, CLAUDE_TEAM_ID, clau
 import { CLAUDE_CODE_REQUIREMENT, verifyClaudeCodeSignature } from './claude-release-copy.js';
 import { CLAUDE_LAUNCH_CONFIG } from './claude-production-host.js';
 import { CLAUDE_REVIEW_PROFILE_TEMPLATE_SHA256, CLAUDE_REVIEW_PROFILE_VERSION } from './claude-review-sandbox.js';
-import { CLAUDE_REVIEW_KEYCHAIN_READS, CLAUDE_REVIEW_PLANTED_SOURCES, createClaudeReviewLayout } from './claude-review-layout.js';
+import { CLAUDE_REVIEW_KEYCHAIN_READS, CLAUDE_REVIEW_KEYCHAIN_SERVICES, CLAUDE_REVIEW_PLANTED_SOURCES, createClaudeReviewLayout } from './claude-review-layout.js';
 import { CLAUDE_REVIEW_FAKE_KEY, CLAUDE_REVIEW_PROMPT, CLAUDE_REVIEW_RUN_TIMEOUT_MS, CLAUDE_REVIEW_SLASH_PROMPT, CLAUDE_REVIEW_TOOL_IDS, claudeReviewEnv, runClaudeReview, runClaudeVersion } from './claude-review-run.js';
 import { CLAUDE_REVIEW_STAGES, buildClaudeReviewEvidence } from './claude-review-evidence.js';
 const AI_LOCAL = Object.freeze([...CLAUDE_LOCAL_MCP_TOOLS].sort());
@@ -66,7 +66,9 @@ export function evaluateClaudeReview(input) {
         scenario('fake_credentials', { fake_key_only: scripted.length > 0 && runs.every(r => messages(r).every(q => q.apiKey === CLAUDE_REVIEW_FAKE_KEY)),
             no_authorization_header: runs.every(r => messages(r).every(q => !q.authorization)), no_credential_content: hits('credential') === 0,
             fake_key_not_in_body: runs.every(r => r.fakeKeyInBody === 0), environment_exact: every(runs, r => isDeepStrictEqual(r.envKeys, [...input.expectedEnvKeys])),
-            keychain_reads_only: runs.every(r => r.keychainOperations.every(op => CLAUDE_REVIEW_KEYCHAIN_READS.includes(op))) }, { runs_checked: runs.length, environment_keys: [...input.expectedEnvKeys] }),
+            keychain_reads_only: runs.every(r => r.keychainLookups.every(k => CLAUDE_REVIEW_KEYCHAIN_READS.includes(k.operation))),
+            // Each run looks up the Keychain, and only under the terminal login's services: no config-dir hash suffix.
+            keychain_service_default: runs.every(r => r.keychainLookups.length > 0 && r.keychainLookups.every(k => CLAUDE_REVIEW_KEYCHAIN_SERVICES.includes(k.service))) }, { runs_checked: runs.length, environment_keys: [...input.expectedEnvKeys] }),
         scenario('communication_boundary', { sandboxed: every(runs, r => r.sandboxed) && input.version.sandboxed, no_unlisted_destination: runs.every(r => r.decoyConnections === 0) }, { sandboxed_runs: runs.filter(r => r.sandboxed).length + (input.version.sandboxed ? 1 : 0) }),
         scenario('cleanup', { runs_terminal: every(runs, r => r.terminal), owned_exit_confirmed: every(runs, r => r.exitConfirmed) && input.version.exitConfirmed,
             temp_removed: input.tempRemoved }, { owned_exits: runs.length + 1 }),
@@ -119,7 +121,7 @@ export async function runClaudeReviewCampaign(input) {
         ...(input.authObservation ? { authObservation: { sha256: input.authObservation.sha256, decision_id: input.authObservation.observation.decision_id } } : {}),
         observations: { started_at: startedAt, finished_at: now().toISOString(), root: layout.root, runner_package_version: input.runnerVersion ?? packageVersion(),
             runs: runs.map(r => ({ kind: r.kind, model: r.model, duration_ms: r.durationMs, auxiliary_requests: r.requests.filter(q => q.kind === 'auxiliary').length,
-                unknown_requests: r.requests.filter(q => q.kind === 'unknown' || q.kind === 'invalid').length, proxy_attempts: [...r.proxyAttempts], keychain_lookups: r.keychainOperations.length,
+                unknown_requests: r.requests.filter(q => q.kind === 'unknown' || q.kind === 'invalid').length, proxy_attempts: [...r.proxyAttempts], keychain_lookups: r.keychainLookups.length, home_writes: [...r.homeWrites],
                 requests: r.requests.filter(q => q.kind === 'primary' || q.kind === 'auxiliary').map(q => ({ kind: q.kind, step: q.step, model_matches: q.model === r.model, prompt_matched: q.promptMatched, reminders: q.reminders, tools: q.toolNames.length })) })) },
     });
 }

package/dist/src/safety/claude-review-layout.js

@@ -1,12 +1,15 @@
 import os from 'node:os';
 import path from 'node:path';
 import { randomBytes } from 'node:crypto';
-import { chmod, mkdir, mkdtemp, readFile, readdir, realpath, rm, writeFile } from 'node:fs/promises';
+import { chmod, lstat, mkdir, mkdtemp, readFile, readdir, realpath, rm, writeFile } from 'node:fs/promises';
 export const CLAUDE_REVIEW_SOURCE_FILE = 'src/review.txt';
 /** Read-only lookups the absent-item helper may record; anything else is a credential write or export attempt. */
 export const CLAUDE_REVIEW_KEYCHAIN_READS = Object.freeze(['find-generic-password', 'find-internet-password']);
-export const CLAUDE_REVIEW_PLANTED_SOURCES = Object.freeze(['config_settings', 'home_settings', 'cwd_settings', 'cwd_settings_local', 'source_settings',
-    'source_settings_local', 'config_memory', 'home_memory', 'cwd_memory', 'source_memory', 'cwd_mcp', 'source_mcp', 'config_user_config', 'home_user_config',
+/** The Keychain services of the employee's terminal login: Claude Code's OAuth item and its legacy API key item. A service with a
+ * config-dir hash suffix means the CLI would look past that login (design 2026-10-28-claude-job-login-context). */
+export const CLAUDE_REVIEW_KEYCHAIN_SERVICES = Object.freeze(['Claude Code-credentials', 'Claude Code']);
+export const CLAUDE_REVIEW_PLANTED_SOURCES = Object.freeze(['config_settings', 'cwd_settings', 'cwd_settings_local', 'source_settings',
+    'source_settings_local', 'config_memory', 'cwd_memory', 'source_memory', 'cwd_mcp', 'source_mcp', 'config_user_config', 'home_user_config',
     'config_command', 'cwd_command', 'config_skill']);
 const shq = (value) => `'${value.replace(/'/g, `'\\''`)}'`;
 const canary = (label) => `${label}-canary-${randomBytes(16).toString('hex')}`;
@@ -14,7 +17,7 @@ export async function createClaudeReviewLayout(base = os.tmpdir()) {
     const root = await realpath(await mkdtemp(path.join(base, 'claude-release-review-')));
     await chmod(root, 0o700);
     const c = path.join(root, 'cli');
-    const cli = { root: c, bin: path.join(c, 'bin'), home: path.join(c, 'home'), config: path.join(c, 'config'), cwd: path.join(c, 'cwd'), tmp: path.join(c, 'tmp'),
+    const cli = { root: c, bin: path.join(c, 'bin'), home: path.join(c, 'home'), config: path.join(c, 'home', '.claude'), cwd: path.join(c, 'cwd'), tmp: path.join(c, 'tmp'),
         sentinels: path.join(c, 'sentinels'), keychainLog: path.join(c, 'keychain.log') };
     const source = path.join(root, 'source'), outside = path.join(root, 'outside');
     for (const dir of [cli.root, cli.bin, cli.home, cli.config, cli.cwd, cli.tmp, cli.sentinels, path.join(cli.home, '.aws'), source, path.join(source, 'src'), outside])
@@ -28,22 +31,20 @@ export async function createClaudeReviewLayout(base = os.tmpdir()) {
     await write(path.join(cli.config, '.credentials.json'), JSON.stringify({ claudeAiOauth: { accessToken: canaries.credential, refreshToken: canaries.credential, expiresAt: 4102444800000, scopes: ['user:inference'] } }));
     await write(path.join(cli.home, '.aws', 'credentials'), `[default]\naws_access_key_id=${canaries.credential}\naws_secret_access_key=${canaries.credential}\n`);
     await write(path.join(cli.home, '.netrc'), `machine api.anthropic.com login review password ${canaries.credential}\n`);
-    // Absent-item Keychain helper, first on PATH: records the operation name only and answers "item not found" (exit 44),
-    // as the real helper does for a missing item. The review profile denies the real /usr/bin/security and the Keychain services.
-    await write(path.join(cli.bin, 'security'), `#!/bin/sh\nprintf '%s\\n' "$1" >> ${shq(cli.keychainLog)}\necho 'security: SecKeychainSearchCopyNext: The specified item could not be found in the keychain.' >&2\nexit 44\n`, 0o700);
-    return { root, source, outside, cli, canaries, env: { PATH: `${cli.bin}:/usr/bin:/bin`, HOME: cli.home, TMPDIR: cli.tmp, LANG: 'C', LC_ALL: 'C', CLAUDE_CONFIG_DIR: cli.config } };
+    // Absent-item Keychain helper, first on PATH: records the operation and the -s service name only and answers "item not found"
+    // (exit 44), as the real helper does for a missing item. The review profile denies the real /usr/bin/security and the Keychain services.
+    await write(path.join(cli.bin, 'security'), `#!/bin/sh\nservice='';previous=''\nfor argument in "$@";do [ "$previous" = '-s' ] && service="$argument";previous="$argument";done\nprintf '%s\\t%s\\n' "$1" "$service" >> ${shq(cli.keychainLog)}\necho 'security: SecKeychainSearchCopyNext: The specified item could not be found in the keychain.' >&2\nexit 44\n`, 0o700);
+    return { root, source, outside, cli, canaries, env: { PATH: `${cli.bin}:/usr/bin:/bin`, HOME: cli.home, TMPDIR: cli.tmp, LANG: 'C', LC_ALL: 'C' } };
 }
 export function claudeReviewPlantedFiles(layout) {
     const { cli, source } = layout;
     return [
         { id: 'config_settings', kind: 'settings', file: path.join(cli.config, 'settings.json') },
-        { id: 'home_settings', kind: 'settings', file: path.join(cli.home, '.claude', 'settings.json') },
         { id: 'cwd_settings', kind: 'settings', file: path.join(cli.cwd, '.claude', 'settings.json') },
         { id: 'cwd_settings_local', kind: 'settings', file: path.join(cli.cwd, '.claude', 'settings.local.json') },
         { id: 'source_settings', kind: 'settings', file: path.join(source, '.claude', 'settings.json') },
         { id: 'source_settings_local', kind: 'settings', file: path.join(source, '.claude', 'settings.local.json') },
         { id: 'config_memory', kind: 'memory', file: path.join(cli.config, 'CLAUDE.md') },
-        { id: 'home_memory', kind: 'memory', file: path.join(cli.home, '.claude', 'CLAUDE.md') },
         { id: 'cwd_memory', kind: 'memory', file: path.join(cli.cwd, 'CLAUDE.md') },
         { id: 'source_memory', kind: 'memory', file: path.join(source, 'CLAUDE.md') },
         { id: 'cwd_mcp', kind: 'mcp', file: path.join(cli.cwd, '.mcp.json') },
@@ -85,8 +86,32 @@ export async function takeSentinels(layout) {
     return names.map(name => /^[a-z-]{1,40}$/.test(name) ? name : 'unexpected');
 }
 /** Operation names that the absent-item helper recorded; cleared for the next run. */
-export async function takeKeychainOperations(layout) {
+export async function takeKeychainLookups(layout) {
     const text = await readFile(layout.cli.keychainLog, 'utf8').catch(() => '');
     await rm(layout.cli.keychainLog, { force: true });
-    return text.split('\n').filter(Boolean).slice(0, 256).map(op => /^[a-z-]{1,40}$/.test(op) ? op : 'unexpected');
+    return text.split('\n').filter(Boolean).slice(0, 256).map(line => {
+        const [operation = '', service = '', ...rest] = line.split('\t');
+        return { operation: /^[a-z-]{1,40}$/.test(operation) ? operation : 'unexpected', service: rest.length === 0 && /^[A-Za-z0-9 ._-]{0,64}$/.test(service) ? service : 'unexpected' };
+    });
+}
+/** Every regular file under the fake HOME with its size and modification time, so a run can list what the CLI created or changed. */
+export async function snapshotReviewHome(layout) {
+    const files = new Map();
+    const walk = async (dir) => {
+        for (const entry of await readdir(dir, { withFileTypes: true }).catch(() => [])) {
+            const file = path.join(dir, entry.name);
+            if (entry.isDirectory())
+                await walk(file);
+            else if (entry.isFile() && files.size < 4096) {
+                const info = await lstat(file);
+                files.set(path.relative(layout.cli.home, file), `${info.size}:${info.mtimeMs}`);
+            }
+        }
+    };
+    await walk(layout.cli.home);
+    return files;
+}
+/** Paths under the fake HOME, relative to it, that a run created or changed: names only, at most 64. */
+export function reviewHomeWrites(before, after) {
+    return [...after].filter(([file, stamp]) => before.get(file) !== stamp).map(([file]) => file).sort().slice(0, 64);
 }

package/dist/src/safety/claude-review-run.js

@@ -11,7 +11,7 @@ import { jobToolPolicyOptions } from './job-tool-policy.js';
 import { LocalToolServer, localEndpointReadObservations } from './local-tool-server.js';
 import { claudeReviewProfile, claudeReviewSandboxArgs } from './claude-review-sandbox.js';
 import { startClaudeReviewDecoy, startClaudeReviewProvider } from './claude-review-provider.js';
-import { CLAUDE_REVIEW_SOURCE_FILE, plantHostileSources, takeKeychainOperations, takeSentinels } from './claude-review-layout.js';
+import { CLAUDE_REVIEW_SOURCE_FILE, plantHostileSources, reviewHomeWrites, snapshotReviewHome, takeKeychainLookups, takeSentinels } from './claude-review-layout.js';
 export const CLAUDE_REVIEW_FAKE_KEY = 'sk-ant-claude-release-review-fake-key';
 export const CLAUDE_REVIEW_PROMPT = 'Offline Claude release review. Follow the scripted provider. No real project, account or model.';
 export const CLAUDE_REVIEW_SLASH_PROMPT = '/review-planted now';
@@ -87,7 +87,7 @@ export async function runClaudeReview(input) {
     const layout = input.layout, started = performance.now(), discovery = [];
     const prompt = input.kind === 'slash' ? CLAUDE_REVIEW_SLASH_PROMPT : CLAUDE_REVIEW_PROMPT;
     let active = true, terminal = false, exitConfirmed = false, envKeys = [], reads = { successful: 0, failed: 0 };
-    let handle, provider, decoy;
+    let handle, provider, decoy, homeBefore;
     const tools = new JobToolSession({ policyOptions: reviewToolPolicy(layout.source), binding: () => REVIEW_BINDING, active: () => active,
         createServer: policy => new LocalToolServer({ policy, onDiscovery: event => { discovery.push(event); } }) });
     try {
@@ -106,6 +106,7 @@ export async function runClaudeReview(input) {
         envKeys = Object.keys(env).sort();
         const profile = claudeReviewProfile({ root: layout.root, cliRoot: layout.cli.root, ports: [provider.port, Number(new URL(endpoint.url).port)], readRoots: input.readRoots, deniedHome: input.deniedHome });
         const [command, argv] = input.sandbox ? claudeReviewSandboxArgs(profile, input.binary, args) : [input.binary, args];
+        homeBefore = await snapshotReviewHome(layout);
         handle = input.processHost.spawn(command, argv, { cwd: layout.cli.cwd, env });
         terminal = await drive(handle, claudeUserInput(prompt), input.timeoutMs);
         exitConfirmed = await confirmExit(handle);
@@ -122,7 +123,8 @@ export async function runClaudeReview(input) {
     const p = provider;
     return { kind: input.kind, model: input.model, sandboxed: input.sandbox, terminal, exitConfirmed, requests: [...p.requests], toolResults: new Map(p.toolResults),
         canaryHits: { ...p.canaryHits }, fakeKeyInBody: p.fakeKeyInBody, proxyAttempts: [...p.proxyAttempts], decoyConnections: decoy.connections(), discovery, reads, envKeys,
-        keychainOperations: await takeKeychainOperations(layout), sentinels: await takeSentinels(layout), durationMs: Math.round(performance.now() - started) };
+        keychainLookups: await takeKeychainLookups(layout), homeWrites: homeBefore ? reviewHomeWrites(homeBefore, await snapshotReviewHome(layout)) : [],
+        sentinels: await takeSentinels(layout), durationMs: Math.round(performance.now() - started) };
 }
 /** Stage 1: `--version` of the exact copy, under the review profile with no network grant at all. */
 export async function runClaudeVersion(input) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.65",
+  "version": "0.1.66",
   "private": false,
   "license": "UNLICENSED",
   "bin": {