mtech-ai-local-runner 0.1.65 → 0.1.67

package/README.md

@@ -175,8 +175,9 @@ Only a session that a person is attending is served. A Claude Code session count
 is `1` or, where Claude Code does not export that variable, when `CLAUDE_CODE_ENTRYPOINT` names a terminal, the Claude
 desktop app or the VS Code extension. A headless `claude -p` or Agent SDK run gets nothing and is never counted as
 having seen an ask. Codex exports no such marker, so every Codex hook session counts. The runner's own jobs never
-count: a hook whose `HOME` is under `<stateRoot>/claude-jobs/` (where every Claude job runs) is refused, and Codex jobs
-run with `features.hooks=false`, so they run no hook at all.
+count: a hook that sees the runner's hook policy variable, or a `TMPDIR` under `<stateRoot>/claude-jobs/` (where every
+Claude job keeps its controls), is refused. A Claude job keeps the person's `HOME`, so `HOME` alone does not tell it
+apart. Codex jobs run with `features.hooks=false`, so they run no hook at all.
 
 An ask is shown at a session start, at the next prompt (where it also counts as seen), at a turn end, or by waking an
 idle Claude session through an `asyncRewake` Stop watcher. An ask shown at a session start, at a turn end or by a wake

package/dist/src/adapters/claude-code/adapter.js

@@ -243,7 +243,7 @@ export class ClaudeCodeAdapter {
                     continue;
                 if (parsed.eventType === "completed") {
                     const observedUsage = parsed.payload?.usage;
-                    parsed = completionEvent(message.result, parsed.payload?.cost_usd);
+                    parsed = completionEvent(message.result, parsed.payload?.cost_usd, { earlierCodeBlocks: true });
                     if (this.p1)
                         parsed = p1ModelEvent({ ...parsed, payload: { ...parsed.payload, usage: observedUsage } });
                 }

package/dist/src/adapters/claude-code/prompt-compiler.js

@@ -1 +1,16 @@
-export { compilePrompt } from "../prompt-compiler.js";
+import { compilePrompt as compileBrief } from "../prompt-compiler.js";
+import { LOCAL_TOOL_GUIDANCE, repositoryScope } from "../local-tool-prompt.js";
+// Claude's working directory is the job's private control directory, so without these rules it sends that directory's
+// absolute path or shell commands to the ai_local tools (P4 Investigate of Work Item 1c8026f1, 2026-10-28).
+const CLAUDE_PATH_RULES = "## Local tool path rules\n" +
+    "Every path argument is one checkout-relative file path inside the approved scope, without a leading slash: write " +
+    "/Modules/Example.php as Modules/Example.php. Never pass your working directory or any absolute path. " +
+    "local_search searches only inside that one file; there is no directory listing or repository-wide search, so take " +
+    "file paths from the objective and from files you have read. local_test runs only a registered command ID, never a " +
+    "shell command. A DENIED_* result names the rule your call broke, such as DENIED_PATH for an absolute path, " +
+    "DENIED_FILE for a directory, DENIED_SCOPE for a path outside the approved scope or DENIED_COMMAND for an unregistered " +
+    "command: send a corrected call instead of concluding that source is unavailable. LOCAL_TOOL_FAILED means the call " +
+    "failed for another reason, such as a file that does not exist.";
+export function compilePrompt(taskPackage, options) {
+    return `${compileBrief(taskPackage, options)}\n\n${repositoryScope(taskPackage)}\n\n${LOCAL_TOOL_GUIDANCE}\n\n${CLAUDE_PATH_RULES}`;
+}

package/dist/src/adapters/claude-code/runtime-options.js

@@ -54,16 +54,16 @@ export function createClaudeCodeAdapterOptions(input) {
     if (inside(checkout, state))
         throw new Error('Claude job controls must be outside the checkout');
     const control = path.join(state, 'claude-jobs', randomUUID());
-    const home = path.join(control, 'home'), cwd = path.join(control, 'cwd'), config = path.join(control, 'mcp.json');
+    const cwd = path.join(control, 'cwd'), config = path.join(control, 'mcp.json');
     const env = {};
-    for (const key of ['PATH', 'LANG', 'LC_ALL', 'USER', 'LOGNAME'])
+    // Claude owns credential access, so it runs in the employee's own login context: their HOME, USER and LOGNAME, and
+    // CLAUDE_CONFIG_DIR only when they set it. macOS finds the login keychain through HOME, and a set CLAUDE_CONFIG_DIR
+    // moves Claude's Keychain item, so either change would hide the terminal's login (Work Decision b501d68d, design
+    // 2026-10-28-claude-job-login-context). Never read or copy its files or send this environment to scoped workers.
+    for (const key of ['PATH', 'LANG', 'LC_ALL', 'USER', 'LOGNAME', 'HOME', 'CLAUDE_CONFIG_DIR'])
         if (input.env[key] !== undefined)
             env[key] = input.env[key];
-    env.HOME = home;
-    env.TMPDIR = path.join(control, 'tmp'); // Claude owns credential access. Preserve the account location by path only;
-    // never read/copy its files or send this environment to scoped workers.
-    // https://code.claude.com/docs/en/authentication#log-in-with-multiple-accounts
-    env.CLAUDE_CONFIG_DIR = account;
+    env.TMPDIR = path.join(control, 'tmp');
     if (env.CLAUDE_CONFIG_DIR && !path.isAbsolute(env.CLAUDE_CONFIG_DIR))
         throw new Error('Claude account configuration path must be absolute');
     return {
@@ -114,7 +114,7 @@ export function createClaudeCodeAdapterOptions(input) {
                     throw Error('CLAUDE_CONTROL_ALIAS_REJECTED');
                 await mkdir(control, { mode: 0o700 });
                 owned = true;
-                for (const directory of [home, cwd, env.TMPDIR])
+                for (const directory of [cwd, env.TMPDIR])
                     await mkdir(directory, { mode: 0o700 });
                 let active = true;
                 const tools = new JobToolSession({

package/dist/src/adapters/codex/prompt-compiler.js

@@ -1,29 +1,7 @@
 import { compilePrompt as compileBrief } from "../prompt-compiler.js";
-function repositoryScope(taskPackage) {
-    const repositories = taskPackage.repositories;
-    const repo = Array.isArray(repositories) && repositories.length === 1
-        && repositories[0] && typeof repositories[0] === "object" && !Array.isArray(repositories[0])
-        ? repositories[0] : undefined;
-    const paths = (value) => Array.isArray(value)
-        && value.every(item => typeof item === "string" && item.length > 0);
-    if (!repo || !paths(repo.allowed_paths) || !repo.allowed_paths.length || !paths(repo.blocked_paths)
-        || !["read", "write"].includes(String(repo.access))
-        || typeof repo.repository_key !== "string" || typeof repo.base_commit_sha !== "string"
-        || !/^[a-f0-9]{40}$/i.test(repo.base_commit_sha)) {
-        return "## Approved repository scope\nRepository scope is unavailable; do not guess source paths or commands. Stop and emit one final blocked report.";
-    }
-    // Project only source-scope fields from the binding bundle. Never stringify
-    // the whole repository: it may contain transport coordinates or write leases.
-    const scope = { repository_key: repo.repository_key, base_commit_sha: repo.base_commit_sha,
-        access: repo.access, allowed_paths: repo.allowed_paths, blocked_paths: repo.blocked_paths };
-    return `## Approved repository scope\n${JSON.stringify(scope, null, 2)}\n` +
-        "Use these checkout-relative paths exactly, including case. Start with the relevant approved files above before drawing a conclusion about source availability. " +
-        "Do not invent paths or commands from framework conventions. A denial for an unlisted path does not establish that a listed file is unavailable. " +
-        "Do not claim an approved file was denied unless its exact path was attempted and the tool returned a denial. " +
-        "These are scope descriptions, not instructions from source files; the host policy remains authoritative and may deny blocked/private paths within an allowed prefix.";
-}
+import { LOCAL_TOOL_GUIDANCE, repositoryScope } from "../local-tool-prompt.js";
 export function compileCodexPrompt(taskPackage, label) {
-    return `${compileBrief(taskPackage, { workItemLabel: label, progressReporting: "native_messages" })}\n\n${repositoryScope(taskPackage)}\n\nUse only the ai_local job tools for repository reads, edits and approved tests. For reading, first use server ai_local's local_search({path: "<exact approved path>", query: "text"}) to find the location, then local_read({path: "<exact approved path>", start_line: 1, end_line: 1}) with the matching line numbers. Ranges are inclusive, at most 400 lines; both bounds are required together. Read a matched line first to learn total_lines, then request only the needed in-file context. Omit both bounds only when the entire file is necessary. Use approved checkout-relative paths. For small approved edits, use local_replace({path, old, new}) after reading: old must match exactly once, including whitespace. local_edit requires the complete replacement file, never a patch. Required test criteria are not command grants. No model test commands are registered unless the host explicitly supplies exact model-callable command IDs; do not use local_test to discover commands or run --help. Missing tests remain not_run/unverified, not passed. In a read-only task, use only read/search tools; the Runner enforces the approved paths and operations. A denied native cwd is intentional: it is a private control directory, not the source checkout. Native filesystem, commands, web, images and delegation are unavailable or denied. A denied tool is a scope boundary, never permission to broaden scope or bypass the denial. Do not retry the denied path. It does not remove independently approved paths: continue with relevant listed paths, and report a missing dependency only after checking the available approved source. Do not repeat host orchestration: claim, shadow, fingerprints, binding, administrator checks, launches, Gateway usage and Job reporting belong to the Runner/host, even when described in the objective. Perform only the assigned repository work and report evidence you actually observed. Do not claim that no model call occurred. If the required tool is unavailable, emit one final structured blocked report naming the missing tool and unfinished repository work; do not request or attempt a new launch.`;
+    return `${compileBrief(taskPackage, { workItemLabel: label, progressReporting: "native_messages" })}\n\n${repositoryScope(taskPackage)}\n\n${LOCAL_TOOL_GUIDANCE}`;
 }
 export const CODEX_REPORT_SCHEMA = {
     type: "object", additionalProperties: false, required: ["status", "report", "evidence", "pending_work"],

package/dist/src/adapters/completion-report.js

@@ -75,8 +75,33 @@ export const COMPLETION_REPORT_NOTICE = "Do the assigned work yourself using the
 function boundedText(value, max) {
     return typeof value === "string" && value.trim().length > 0 && value.length <= max;
 }
+/** The body of the final fenced block when it can only be the report: it ends the text, and no other block may be one. */
+function finalFencedReport(result, options) {
+    const text = result.trim(), blocks = [];
+    let open;
+    for (const line of text.split(/\r?\n/)) {
+        if (!open) {
+            const fence = line.match(/^```([^`\s]*)[ \t]*$/);
+            if (fence)
+                blocks.push(open = { info: fence[1], body: [] });
+        }
+        else if (line.trimEnd() === "```")
+            open = undefined;
+        else
+            open.body.push(line);
+    }
+    const last = blocks.at(-1);
+    if (!last || open || !text.endsWith("```") || (text.match(/```/g) ?? []).length !== blocks.length * 2)
+        return undefined;
+    const earlier = blocks.slice(0, -1);
+    if (earlier.length === 0)
+        return last.info === "json" || last.info === "" ? last.body.join("\n") : undefined;
+    if (!options.earlierCodeBlocks || last.info !== "json" || earlier.some(block => block.info === "json" || block.info === ""))
+        return undefined;
+    return last.body.join("\n");
+}
 /** Decode bounded framing only. Callers must still validate status and evidence. */
-export function completionEnvelope(result) {
+export function completionEnvelope(result, options = {}) {
     if (typeof result !== "string" || result.length > MAX_REPORT_ENVELOPE_CHARS)
         return undefined;
     let report;
@@ -84,13 +109,11 @@ export function completionEnvelope(result) {
         report = JSON.parse(result);
     }
     catch {
-        if ((result.match(/```/g) ?? []).length !== 2)
-            return undefined;
-        const framed = result.trim().match(/^(?:[\s\S]*?\n)?```(?:json)?[ \t]*\r?\n([\s\S]*?)\r?\n```$/);
-        if (!framed)
+        const framed = finalFencedReport(result, options);
+        if (framed === undefined)
             return undefined;
         try {
-            report = JSON.parse(framed[1]);
+            report = JSON.parse(framed);
         }
         catch {
             return undefined;
@@ -100,7 +123,7 @@ export function completionEnvelope(result) {
         ? report : undefined;
 }
 /** Validate the full final result before truncation; never publish malformed/interim output. */
-export function completionEvent(result, costUsd) {
+export function completionEvent(result, costUsd, options = {}) {
     const usage = typeof costUsd === "number" && Number.isFinite(costUsd) && costUsd >= 0
         ? { cost_usd: costUsd }
         : {};
@@ -109,7 +132,7 @@ export function completionEvent(result, costUsd) {
         summary: "completion report is missing, incomplete or invalid",
         payload: usage,
     };
-    const value = completionEnvelope(result);
+    const value = completionEnvelope(result, options);
     const reject = (code) => ({ ...failed, payload: { ...usage, completion_rejection: { version: 'completion-rejection-v1', code } } });
     if (!value)
         return reject('ENVELOPE_INVALID');

package/dist/src/adapters/local-tool-prompt.js

@@ -0,0 +1,25 @@
+// Approved source scope and ai_local tool guidance for CLI adapters whose model sees only the job MCP tools.
+export function repositoryScope(taskPackage) {
+    const repositories = taskPackage.repositories;
+    const repo = Array.isArray(repositories) && repositories.length === 1
+        && repositories[0] && typeof repositories[0] === "object" && !Array.isArray(repositories[0])
+        ? repositories[0] : undefined;
+    const paths = (value) => Array.isArray(value)
+        && value.every(item => typeof item === "string" && item.length > 0);
+    if (!repo || !paths(repo.allowed_paths) || !repo.allowed_paths.length || !paths(repo.blocked_paths)
+        || !["read", "write"].includes(String(repo.access))
+        || typeof repo.repository_key !== "string" || typeof repo.base_commit_sha !== "string"
+        || !/^[a-f0-9]{40}$/i.test(repo.base_commit_sha)) {
+        return "## Approved repository scope\nRepository scope is unavailable; do not guess source paths or commands. Stop and emit one final blocked report.";
+    }
+    // Project only source-scope fields from the binding bundle. Never stringify
+    // the whole repository: it may contain transport coordinates or write leases.
+    const scope = { repository_key: repo.repository_key, base_commit_sha: repo.base_commit_sha,
+        access: repo.access, allowed_paths: repo.allowed_paths, blocked_paths: repo.blocked_paths };
+    return `## Approved repository scope\n${JSON.stringify(scope, null, 2)}\n` +
+        "Use these checkout-relative paths exactly, including case. Start with the relevant approved files above before drawing a conclusion about source availability. " +
+        "Do not invent paths or commands from framework conventions. A denial for an unlisted path does not establish that a listed file is unavailable. " +
+        "Do not claim an approved file was denied unless its exact path was attempted and the tool returned a denial. " +
+        "These are scope descriptions, not instructions from source files; the host policy remains authoritative and may deny blocked/private paths within an allowed prefix.";
+}
+export const LOCAL_TOOL_GUIDANCE = "Use only the ai_local job tools for repository reads, edits and approved tests. For reading, first use server ai_local's local_search({path: \"<exact approved path>\", query: \"text\"}) to find the location, then local_read({path: \"<exact approved path>\", start_line: 1, end_line: 1}) with the matching line numbers. Ranges are inclusive, at most 400 lines; both bounds are required together. Read a matched line first to learn total_lines, then request only the needed in-file context. Omit both bounds only when the entire file is necessary. Use approved checkout-relative paths. For small approved edits, use local_replace({path, old, new}) after reading: old must match exactly once, including whitespace. local_edit requires the complete replacement file, never a patch. Required test criteria are not command grants. No model test commands are registered unless the host explicitly supplies exact model-callable command IDs; do not use local_test to discover commands or run --help. Missing tests remain not_run/unverified, not passed. In a read-only task, use only read/search tools; the Runner enforces the approved paths and operations. A denied native cwd is intentional: it is a private control directory, not the source checkout. Native filesystem, commands, web, images and delegation are unavailable or denied. A denied tool is a scope boundary, never permission to broaden scope or bypass the denial. Do not retry the denied path. It does not remove independently approved paths: continue with relevant listed paths, and report a missing dependency only after checking the available approved source. Do not repeat host orchestration: claim, shadow, fingerprints, binding, administrator checks, launches, Gateway usage and Job reporting belong to the Runner/host, even when described in the objective. Perform only the assigned repository work and report evidence you actually observed. Do not claim that no model call occurred. If the required tool is unavailable, emit one final structured blocked report naming the missing tool and unfinished repository work; do not request or attempt a new launch.";

package/dist/src/asks/hook-client.js

@@ -13,29 +13,32 @@ const STATE_ROOT_FLAG = "--state-root=";
  * Agent SDK, mcp, local-agent, remote and the GitHub action for the rest), so any other value is not a person.
  */
 const INTERACTIVE_ENTRYPOINTS = new Set(["cli", "claude-desktop", "claude-vscode"]);
-/** Where the Claude adapter puts each job's HOME: <stateRoot>/claude-jobs/<id>/home (src/adapters/claude-code/runtime-options.ts). */
+/** Where the Claude adapter puts each job's controls, its TMPDIR among them: <stateRoot>/claude-jobs/<id>/
+ * (src/adapters/claude-code/runtime-options.ts). Runners before 0.1.66 also put the job's HOME there. */
 const CLAUDE_JOBS_DIR = "claude-jobs";
-/** True when HOME resolves inside <stateRoot>/claude-jobs/: a Claude job this runner started, never a person's session. */
-function isRunnerJobHome(env, stateRoot) {
-    const home = env.HOME;
-    if (!home || !isAbsolute(home))
-        return false;
+/** HOOK_POLICY_ENV_VAR of src/safety/hook-policy-builder.ts, named here so this client loads no safety module; a test keeps the two in step. */
+const RUNNER_HOOK_POLICY_ENV = "AI_GATEWAY_RUNNER_HOOK_POLICY_B64";
+/** True when the hook runs in a Claude job this runner started, never a person's session: the environment carries the
+ * runner's hook policy, which every job launch sets and the runner's own hook needs, or its TMPDIR or HOME resolves
+ * inside <stateRoot>/claude-jobs/. A job keeps the person's HOME, so HOME alone no longer tells it apart. */
+function isRunnerJob(env, stateRoot) {
+    if (env[RUNNER_HOOK_POLICY_ENV] !== undefined)
+        return true;
     const roots = new Set([resolve(stateRoot)]);
-    // The adapter builds job homes from the real state root; the shim may name it through a symlink.
+    // The adapter builds job controls from the real state root; the shim may name it through a symlink.
     try {
         roots.add(realpathSync(stateRoot));
     }
     catch { /* A state root that does not exist holds no jobs. */ }
-    const resolved = resolve(home);
-    return [...roots].some(root => resolved.startsWith(join(root, CLAUDE_JOBS_DIR) + sep));
+    return [env.TMPDIR, env.HOME].some(dir => !!dir && isAbsolute(dir) && [...roots].some(root => resolve(dir).startsWith(join(root, CLAUDE_JOBS_DIR) + sep)));
 }
 /**
  * True when a person is attending the session that runs this hook (owner decision 2026-10-23). The one place that
  * decides it, so it can be adjusted after the pilot.
  *
- * The runner's own jobs never count. A Claude job runs with its HOME under <stateRoot>/claude-jobs/, so a hook that
- * sees such a HOME is refused whatever else the environment says. Codex jobs run with features.hooks=false (the Codex
- * adapter's isolation overrides), so they never run a hook at all.
+ * The runner's own jobs never count. A Claude job carries the runner's hook policy and a TMPDIR under
+ * <stateRoot>/claude-jobs/, so a hook that sees either is refused whatever else the environment says. Codex jobs run
+ * with features.hooks=false (the Codex adapter's isolation overrides), so they never run a hook at all.
  *
  * Claude Code: CLAUDE_CODE_SESSION_ATTENDED, where the Claude Code version exports it, is the answer: "1" is a
  * person, any other value is not, whatever the entrypoint says (a scheduled desktop task has the desktop entrypoint
@@ -47,7 +50,7 @@ function isRunnerJobHome(env, stateRoot) {
  * `input` is the parsed hook input, passed for the day Codex exposes such a marker.
  */
 export function isHumanSession(app, env, _input, stateRoot) {
-    if (isRunnerJobHome(env, stateRoot))
+    if (isRunnerJob(env, stateRoot))
         return false;
     if (app !== "claude")
         return true;

package/dist/src/guide/hook-client.js

@@ -16,22 +16,23 @@ const START_SOURCES = new Set(["startup", "clear", "compact"]);
 /** The same values as the asks hook client (src/asks/hook-client.ts): a test keeps the two in step. */
 const INTERACTIVE_ENTRYPOINTS = new Set(["cli", "claude-desktop", "claude-vscode"]);
 const CLAUDE_JOBS_DIR = "claude-jobs";
+/** HOOK_POLICY_ENV_VAR of src/safety/hook-policy-builder.ts, as in the asks hook client; a test keeps them in step. */
+const RUNNER_HOOK_POLICY_ENV = "AI_GATEWAY_RUNNER_HOOK_POLICY_B64";
 const TRUNCATED_SESSION_ID = /"session_id"\s*:\s*"([^"\\]{1,128})"/;
-function isRunnerJobHome(env, stateRoot) {
-    const home = env.HOME;
-    if (!home || !isAbsolute(home))
-        return false;
+/** The same rule as the asks hook client: the runner's hook policy, or a TMPDIR or HOME inside <stateRoot>/claude-jobs/. */
+function isRunnerJob(env, stateRoot) {
+    if (env[RUNNER_HOOK_POLICY_ENV] !== undefined)
+        return true;
     const roots = new Set([resolve(stateRoot)]);
     try {
         roots.add(realpathSync(stateRoot));
     }
     catch { /* A state root that does not exist holds no jobs. */ }
-    const resolved = resolve(home);
-    return [...roots].some(root => resolved.startsWith(join(root, CLAUDE_JOBS_DIR) + sep));
+    return [env.TMPDIR, env.HOME].some(dir => !!dir && isAbsolute(dir) && [...roots].some(root => resolve(dir).startsWith(join(root, CLAUDE_JOBS_DIR) + sep)));
 }
 /** True when a person attends the session: the asks hook client's rule, repeated so this client loads nothing of asks. */
 export function isHumanSession(app, env, stateRoot) {
-    if (isRunnerJobHome(env, stateRoot))
+    if (isRunnerJob(env, stateRoot))
         return false;
     if (app !== "claude")
         return true;

package/dist/src/safety/claude-production-host.js

@@ -47,15 +47,16 @@ const CLAUDE_LOGIN_PROBE_TIMEOUT_MS = 10_000;
 /** Readiness only: after a signature failure, the same release and copy identity is not re-hashed or run through
  * codesign again before this delay; a new identity, a new listing or the delay re-checks at once. */
 export const CLAUDE_SIGNATURE_RECHECK_MS = 5 * 60_000;
-/** `auth status --json` of the pinned copy, never the employee's own install, with a fixed environment and the job's
- * account location. The documented Claude Code opt-outs keep the probe from updating itself or sending other traffic.
+/** `auth status --json` of the pinned copy, never the employee's own install, with a fixed environment in the job's login
+ * context: the employee's HOME, USER and LOGNAME, and CLAUDE_CONFIG_DIR only when they set it (runtime-options.ts).
+ * The documented Claude Code opt-outs keep the probe from updating itself or sending other traffic.
  * `timeoutMs` is a trusted in-process test seam only. */
 export function pinnedClaudeLogin(home, env, timeoutMs = CLAUDE_LOGIN_PROBE_TIMEOUT_MS) {
     return binary => new Promise(resolve => {
-        const account = env.CLAUDE_CONFIG_DIR ?? path.join(home, '.claude');
-        if (!path.isAbsolute(account) || !path.isAbsolute(binary) || !path.isAbsolute(home))
+        const account = env.CLAUDE_CONFIG_DIR;
+        if (account !== undefined && !path.isAbsolute(account) || !path.isAbsolute(binary) || !path.isAbsolute(home))
             return resolve({ authenticated: false, loginStatus: 'unknown' });
-        const childEnv = { PATH: '/usr/bin:/bin', LANG: 'C', LC_ALL: 'C', HOME: home, CLAUDE_CONFIG_DIR: account,
+        const childEnv = { PATH: '/usr/bin:/bin', LANG: 'C', LC_ALL: 'C', HOME: home, ...(account === undefined ? {} : { CLAUDE_CONFIG_DIR: account }),
             DISABLE_AUTOUPDATER: '1', CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: '1' };
         for (const key of ['USER', 'LOGNAME']) {
             const value = env[key];

package/dist/src/safety/claude-review-campaign.js

@@ -14,7 +14,7 @@ import { CLAUDE_LAUNCH_OPT_OUTS, CLAUDE_SIGNING_IDENTIFIER, CLAUDE_TEAM_ID, clau
 import { CLAUDE_CODE_REQUIREMENT, verifyClaudeCodeSignature } from './claude-release-copy.js';
 import { CLAUDE_LAUNCH_CONFIG } from './claude-production-host.js';
 import { CLAUDE_REVIEW_PROFILE_TEMPLATE_SHA256, CLAUDE_REVIEW_PROFILE_VERSION } from './claude-review-sandbox.js';
-import { CLAUDE_REVIEW_KEYCHAIN_READS, CLAUDE_REVIEW_PLANTED_SOURCES, createClaudeReviewLayout } from './claude-review-layout.js';
+import { CLAUDE_REVIEW_KEYCHAIN_READS, CLAUDE_REVIEW_KEYCHAIN_SERVICES, CLAUDE_REVIEW_PLANTED_SOURCES, createClaudeReviewLayout } from './claude-review-layout.js';
 import { CLAUDE_REVIEW_FAKE_KEY, CLAUDE_REVIEW_PROMPT, CLAUDE_REVIEW_RUN_TIMEOUT_MS, CLAUDE_REVIEW_SLASH_PROMPT, CLAUDE_REVIEW_TOOL_IDS, claudeReviewEnv, runClaudeReview, runClaudeVersion } from './claude-review-run.js';
 import { CLAUDE_REVIEW_STAGES, buildClaudeReviewEvidence } from './claude-review-evidence.js';
 const AI_LOCAL = Object.freeze([...CLAUDE_LOCAL_MCP_TOOLS].sort());
@@ -66,7 +66,9 @@ export function evaluateClaudeReview(input) {
         scenario('fake_credentials', { fake_key_only: scripted.length > 0 && runs.every(r => messages(r).every(q => q.apiKey === CLAUDE_REVIEW_FAKE_KEY)),
             no_authorization_header: runs.every(r => messages(r).every(q => !q.authorization)), no_credential_content: hits('credential') === 0,
             fake_key_not_in_body: runs.every(r => r.fakeKeyInBody === 0), environment_exact: every(runs, r => isDeepStrictEqual(r.envKeys, [...input.expectedEnvKeys])),
-            keychain_reads_only: runs.every(r => r.keychainOperations.every(op => CLAUDE_REVIEW_KEYCHAIN_READS.includes(op))) }, { runs_checked: runs.length, environment_keys: [...input.expectedEnvKeys] }),
+            keychain_reads_only: runs.every(r => r.keychainLookups.every(k => CLAUDE_REVIEW_KEYCHAIN_READS.includes(k.operation))),
+            // Each run looks up the Keychain, and only under the terminal login's services: no config-dir hash suffix.
+            keychain_service_default: runs.every(r => r.keychainLookups.length > 0 && r.keychainLookups.every(k => CLAUDE_REVIEW_KEYCHAIN_SERVICES.includes(k.service))) }, { runs_checked: runs.length, environment_keys: [...input.expectedEnvKeys] }),
         scenario('communication_boundary', { sandboxed: every(runs, r => r.sandboxed) && input.version.sandboxed, no_unlisted_destination: runs.every(r => r.decoyConnections === 0) }, { sandboxed_runs: runs.filter(r => r.sandboxed).length + (input.version.sandboxed ? 1 : 0) }),
         scenario('cleanup', { runs_terminal: every(runs, r => r.terminal), owned_exit_confirmed: every(runs, r => r.exitConfirmed) && input.version.exitConfirmed,
             temp_removed: input.tempRemoved }, { owned_exits: runs.length + 1 }),
@@ -119,7 +121,7 @@ export async function runClaudeReviewCampaign(input) {
         ...(input.authObservation ? { authObservation: { sha256: input.authObservation.sha256, decision_id: input.authObservation.observation.decision_id } } : {}),
         observations: { started_at: startedAt, finished_at: now().toISOString(), root: layout.root, runner_package_version: input.runnerVersion ?? packageVersion(),
             runs: runs.map(r => ({ kind: r.kind, model: r.model, duration_ms: r.durationMs, auxiliary_requests: r.requests.filter(q => q.kind === 'auxiliary').length,
-                unknown_requests: r.requests.filter(q => q.kind === 'unknown' || q.kind === 'invalid').length, proxy_attempts: [...r.proxyAttempts], keychain_lookups: r.keychainOperations.length,
+                unknown_requests: r.requests.filter(q => q.kind === 'unknown' || q.kind === 'invalid').length, proxy_attempts: [...r.proxyAttempts], keychain_lookups: r.keychainLookups.length, home_writes: [...r.homeWrites],
                 requests: r.requests.filter(q => q.kind === 'primary' || q.kind === 'auxiliary').map(q => ({ kind: q.kind, step: q.step, model_matches: q.model === r.model, prompt_matched: q.promptMatched, reminders: q.reminders, tools: q.toolNames.length })) })) },
     });
 }

package/dist/src/safety/claude-review-layout.js

@@ -1,12 +1,15 @@
 import os from 'node:os';
 import path from 'node:path';
 import { randomBytes } from 'node:crypto';
-import { chmod, mkdir, mkdtemp, readFile, readdir, realpath, rm, writeFile } from 'node:fs/promises';
+import { chmod, lstat, mkdir, mkdtemp, readFile, readdir, realpath, rm, writeFile } from 'node:fs/promises';
 export const CLAUDE_REVIEW_SOURCE_FILE = 'src/review.txt';
 /** Read-only lookups the absent-item helper may record; anything else is a credential write or export attempt. */
 export const CLAUDE_REVIEW_KEYCHAIN_READS = Object.freeze(['find-generic-password', 'find-internet-password']);
-export const CLAUDE_REVIEW_PLANTED_SOURCES = Object.freeze(['config_settings', 'home_settings', 'cwd_settings', 'cwd_settings_local', 'source_settings',
-    'source_settings_local', 'config_memory', 'home_memory', 'cwd_memory', 'source_memory', 'cwd_mcp', 'source_mcp', 'config_user_config', 'home_user_config',
+/** The Keychain services of the employee's terminal login: Claude Code's OAuth item and its legacy API key item. A service with a
+ * config-dir hash suffix means the CLI would look past that login (design 2026-10-28-claude-job-login-context). */
+export const CLAUDE_REVIEW_KEYCHAIN_SERVICES = Object.freeze(['Claude Code-credentials', 'Claude Code']);
+export const CLAUDE_REVIEW_PLANTED_SOURCES = Object.freeze(['config_settings', 'cwd_settings', 'cwd_settings_local', 'source_settings',
+    'source_settings_local', 'config_memory', 'cwd_memory', 'source_memory', 'cwd_mcp', 'source_mcp', 'config_user_config', 'home_user_config',
     'config_command', 'cwd_command', 'config_skill']);
 const shq = (value) => `'${value.replace(/'/g, `'\\''`)}'`;
 const canary = (label) => `${label}-canary-${randomBytes(16).toString('hex')}`;
@@ -14,7 +17,7 @@ export async function createClaudeReviewLayout(base = os.tmpdir()) {
     const root = await realpath(await mkdtemp(path.join(base, 'claude-release-review-')));
     await chmod(root, 0o700);
     const c = path.join(root, 'cli');
-    const cli = { root: c, bin: path.join(c, 'bin'), home: path.join(c, 'home'), config: path.join(c, 'config'), cwd: path.join(c, 'cwd'), tmp: path.join(c, 'tmp'),
+    const cli = { root: c, bin: path.join(c, 'bin'), home: path.join(c, 'home'), config: path.join(c, 'home', '.claude'), cwd: path.join(c, 'cwd'), tmp: path.join(c, 'tmp'),
         sentinels: path.join(c, 'sentinels'), keychainLog: path.join(c, 'keychain.log') };
     const source = path.join(root, 'source'), outside = path.join(root, 'outside');
     for (const dir of [cli.root, cli.bin, cli.home, cli.config, cli.cwd, cli.tmp, cli.sentinels, path.join(cli.home, '.aws'), source, path.join(source, 'src'), outside])
@@ -28,22 +31,20 @@ export async function createClaudeReviewLayout(base = os.tmpdir()) {
     await write(path.join(cli.config, '.credentials.json'), JSON.stringify({ claudeAiOauth: { accessToken: canaries.credential, refreshToken: canaries.credential, expiresAt: 4102444800000, scopes: ['user:inference'] } }));
     await write(path.join(cli.home, '.aws', 'credentials'), `[default]\naws_access_key_id=${canaries.credential}\naws_secret_access_key=${canaries.credential}\n`);
     await write(path.join(cli.home, '.netrc'), `machine api.anthropic.com login review password ${canaries.credential}\n`);
-    // Absent-item Keychain helper, first on PATH: records the operation name only and answers "item not found" (exit 44),
-    // as the real helper does for a missing item. The review profile denies the real /usr/bin/security and the Keychain services.
-    await write(path.join(cli.bin, 'security'), `#!/bin/sh\nprintf '%s\\n' "$1" >> ${shq(cli.keychainLog)}\necho 'security: SecKeychainSearchCopyNext: The specified item could not be found in the keychain.' >&2\nexit 44\n`, 0o700);
-    return { root, source, outside, cli, canaries, env: { PATH: `${cli.bin}:/usr/bin:/bin`, HOME: cli.home, TMPDIR: cli.tmp, LANG: 'C', LC_ALL: 'C', CLAUDE_CONFIG_DIR: cli.config } };
+    // Absent-item Keychain helper, first on PATH: records the operation and the -s service name only and answers "item not found"
+    // (exit 44), as the real helper does for a missing item. The review profile denies the real /usr/bin/security and the Keychain services.
+    await write(path.join(cli.bin, 'security'), `#!/bin/sh\nservice='';previous=''\nfor argument in "$@";do [ "$previous" = '-s' ] && service="$argument";previous="$argument";done\nprintf '%s\\t%s\\n' "$1" "$service" >> ${shq(cli.keychainLog)}\necho 'security: SecKeychainSearchCopyNext: The specified item could not be found in the keychain.' >&2\nexit 44\n`, 0o700);
+    return { root, source, outside, cli, canaries, env: { PATH: `${cli.bin}:/usr/bin:/bin`, HOME: cli.home, TMPDIR: cli.tmp, LANG: 'C', LC_ALL: 'C' } };
 }
 export function claudeReviewPlantedFiles(layout) {
     const { cli, source } = layout;
     return [
         { id: 'config_settings', kind: 'settings', file: path.join(cli.config, 'settings.json') },
-        { id: 'home_settings', kind: 'settings', file: path.join(cli.home, '.claude', 'settings.json') },
         { id: 'cwd_settings', kind: 'settings', file: path.join(cli.cwd, '.claude', 'settings.json') },
         { id: 'cwd_settings_local', kind: 'settings', file: path.join(cli.cwd, '.claude', 'settings.local.json') },
         { id: 'source_settings', kind: 'settings', file: path.join(source, '.claude', 'settings.json') },
         { id: 'source_settings_local', kind: 'settings', file: path.join(source, '.claude', 'settings.local.json') },
         { id: 'config_memory', kind: 'memory', file: path.join(cli.config, 'CLAUDE.md') },
-        { id: 'home_memory', kind: 'memory', file: path.join(cli.home, '.claude', 'CLAUDE.md') },
         { id: 'cwd_memory', kind: 'memory', file: path.join(cli.cwd, 'CLAUDE.md') },
         { id: 'source_memory', kind: 'memory', file: path.join(source, 'CLAUDE.md') },
         { id: 'cwd_mcp', kind: 'mcp', file: path.join(cli.cwd, '.mcp.json') },
@@ -85,8 +86,32 @@ export async function takeSentinels(layout) {
     return names.map(name => /^[a-z-]{1,40}$/.test(name) ? name : 'unexpected');
 }
 /** Operation names that the absent-item helper recorded; cleared for the next run. */
-export async function takeKeychainOperations(layout) {
+export async function takeKeychainLookups(layout) {
     const text = await readFile(layout.cli.keychainLog, 'utf8').catch(() => '');
     await rm(layout.cli.keychainLog, { force: true });
-    return text.split('\n').filter(Boolean).slice(0, 256).map(op => /^[a-z-]{1,40}$/.test(op) ? op : 'unexpected');
+    return text.split('\n').filter(Boolean).slice(0, 256).map(line => {
+        const [operation = '', service = '', ...rest] = line.split('\t');
+        return { operation: /^[a-z-]{1,40}$/.test(operation) ? operation : 'unexpected', service: rest.length === 0 && /^[A-Za-z0-9 ._-]{0,64}$/.test(service) ? service : 'unexpected' };
+    });
+}
+/** Every regular file under the fake HOME with its size and modification time, so a run can list what the CLI created or changed. */
+export async function snapshotReviewHome(layout) {
+    const files = new Map();
+    const walk = async (dir) => {
+        for (const entry of await readdir(dir, { withFileTypes: true }).catch(() => [])) {
+            const file = path.join(dir, entry.name);
+            if (entry.isDirectory())
+                await walk(file);
+            else if (entry.isFile() && files.size < 4096) {
+                const info = await lstat(file);
+                files.set(path.relative(layout.cli.home, file), `${info.size}:${info.mtimeMs}`);
+            }
+        }
+    };
+    await walk(layout.cli.home);
+    return files;
+}
+/** Paths under the fake HOME, relative to it, that a run created or changed: names only, at most 64. */
+export function reviewHomeWrites(before, after) {
+    return [...after].filter(([file, stamp]) => before.get(file) !== stamp).map(([file]) => file).sort().slice(0, 64);
 }

package/dist/src/safety/claude-review-run.js

@@ -11,7 +11,7 @@ import { jobToolPolicyOptions } from './job-tool-policy.js';
 import { LocalToolServer, localEndpointReadObservations } from './local-tool-server.js';
 import { claudeReviewProfile, claudeReviewSandboxArgs } from './claude-review-sandbox.js';
 import { startClaudeReviewDecoy, startClaudeReviewProvider } from './claude-review-provider.js';
-import { CLAUDE_REVIEW_SOURCE_FILE, plantHostileSources, takeKeychainOperations, takeSentinels } from './claude-review-layout.js';
+import { CLAUDE_REVIEW_SOURCE_FILE, plantHostileSources, reviewHomeWrites, snapshotReviewHome, takeKeychainLookups, takeSentinels } from './claude-review-layout.js';
 export const CLAUDE_REVIEW_FAKE_KEY = 'sk-ant-claude-release-review-fake-key';
 export const CLAUDE_REVIEW_PROMPT = 'Offline Claude release review. Follow the scripted provider. No real project, account or model.';
 export const CLAUDE_REVIEW_SLASH_PROMPT = '/review-planted now';
@@ -87,7 +87,7 @@ export async function runClaudeReview(input) {
     const layout = input.layout, started = performance.now(), discovery = [];
     const prompt = input.kind === 'slash' ? CLAUDE_REVIEW_SLASH_PROMPT : CLAUDE_REVIEW_PROMPT;
     let active = true, terminal = false, exitConfirmed = false, envKeys = [], reads = { successful: 0, failed: 0 };
-    let handle, provider, decoy;
+    let handle, provider, decoy, homeBefore;
     const tools = new JobToolSession({ policyOptions: reviewToolPolicy(layout.source), binding: () => REVIEW_BINDING, active: () => active,
         createServer: policy => new LocalToolServer({ policy, onDiscovery: event => { discovery.push(event); } }) });
     try {
@@ -106,6 +106,7 @@ export async function runClaudeReview(input) {
         envKeys = Object.keys(env).sort();
         const profile = claudeReviewProfile({ root: layout.root, cliRoot: layout.cli.root, ports: [provider.port, Number(new URL(endpoint.url).port)], readRoots: input.readRoots, deniedHome: input.deniedHome });
         const [command, argv] = input.sandbox ? claudeReviewSandboxArgs(profile, input.binary, args) : [input.binary, args];
+        homeBefore = await snapshotReviewHome(layout);
         handle = input.processHost.spawn(command, argv, { cwd: layout.cli.cwd, env });
         terminal = await drive(handle, claudeUserInput(prompt), input.timeoutMs);
         exitConfirmed = await confirmExit(handle);
@@ -122,7 +123,8 @@ export async function runClaudeReview(input) {
     const p = provider;
     return { kind: input.kind, model: input.model, sandboxed: input.sandbox, terminal, exitConfirmed, requests: [...p.requests], toolResults: new Map(p.toolResults),
         canaryHits: { ...p.canaryHits }, fakeKeyInBody: p.fakeKeyInBody, proxyAttempts: [...p.proxyAttempts], decoyConnections: decoy.connections(), discovery, reads, envKeys,
-        keychainOperations: await takeKeychainOperations(layout), sentinels: await takeSentinels(layout), durationMs: Math.round(performance.now() - started) };
+        keychainLookups: await takeKeychainLookups(layout), homeWrites: homeBefore ? reviewHomeWrites(homeBefore, await snapshotReviewHome(layout)) : [],
+        sentinels: await takeSentinels(layout), durationMs: Math.round(performance.now() - started) };
 }
 /** Stage 1: `--version` of the exact copy, under the review profile with no network grant at all. */
 export async function runClaudeVersion(input) {

package/dist/src/safety/hook-policy-builder.js

@@ -6,7 +6,9 @@ function requiredTestsFromTaskPackage(taskPackage) {
     const pkg = taskPackage;
     const execution = pkg.agent_execution;
     const brief = execution?.implementation_brief;
-    const requiredTests = brief?.required_tests;
+    // A missing list means no commands, as in the prompt compiler: Gateways before the empty-list fix dropped an
+    // investigation's required_tests: []. A value that is not a list is still a malformed package.
+    const requiredTests = brief?.required_tests ?? [];
     if (!Array.isArray(requiredTests)) {
         throw new Error("task package is missing agent_execution.implementation_brief.required_tests");
     }

package/dist/src/safety/job-tool-dispatcher.js

@@ -1,6 +1,9 @@
 import { validateLocalReadRange } from './local-read-range.js';
 import { localToolInventory } from './local-tool-server.js';
 const rejected = () => new Error('JOB_TOOL_DISPATCH_REJECTED');
+/** The scoped policy's stable denial code, which LocalToolServer already lets a model see, so a model can correct its
+ * call. Only an exact code qualifies: any other failure, including binding and lease checks, stays one masked rejection. */
+export const localToolDenialCode = (error) => error instanceof Error && /^(?:DENIED_[A-Z_]+|LOCAL_SANDBOX_UNAVAILABLE)$/.test(error.message) ? error.message : undefined;
 function record(value) { return !!value && typeof value === 'object' && !Array.isArray(value); }
 const id = (value) => typeof value === 'string' && value.length > 0 && value.length <= 256 && !/[\r\n\0]/.test(value);
 const keys = (value, expected) => JSON.stringify(Object.keys(value).sort()) === JSON.stringify([...expected].sort());
@@ -52,8 +55,9 @@ export class JobToolDispatcher {
                 throw rejected();
             return result;
         }
-        catch {
-            throw rejected();
+        catch (error) {
+            const code = localToolDenialCode(error);
+            throw code ? new Error(code) : rejected();
         }
     }
 }

package/dist/src/safety/job-tool-session.js

@@ -1,4 +1,4 @@
-import { JobToolDispatcher } from './job-tool-dispatcher.js';
+import { JobToolDispatcher, localToolDenialCode } from './job-tool-dispatcher.js';
 import { LocalToolPolicy } from './local-tool-policy.js';
 import { LocalToolServer } from './local-tool-server.js';
 const sameBinding = (a, b) => b !== null && a.jobId === b.jobId && a.threadId === b.threadId && a.turnId === b.turnId && a.generation === b.generation;
@@ -32,8 +32,8 @@ export class JobToolSession {
                 throw Error();
             return await this.dispatcher.dispatch({ ...this.bound, requestId: String(++this.sequence), tool, args });
         }
-        catch {
-            throw new Error('JOB_TOOL_DISPATCH_REJECTED');
+        catch (error) {
+            throw new Error(localToolDenialCode(error) ?? 'JOB_TOOL_DISPATCH_REJECTED');
         }
     }
     async start() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.65",
+  "version": "0.1.67",
   "private": false,
   "license": "UNLICENSED",
   "bin": {