mtech-ai-local-runner 0.1.66 → 0.1.68

package/dist/src/adapters/claude-code/adapter.js

@@ -243,7 +243,7 @@ export class ClaudeCodeAdapter {
                     continue;
                 if (parsed.eventType === "completed") {
                     const observedUsage = parsed.payload?.usage;
-                    parsed = completionEvent(message.result, parsed.payload?.cost_usd);
+                    parsed = completionEvent(message.result, parsed.payload?.cost_usd, { earlierCodeBlocks: true });
                     if (this.p1)
                         parsed = p1ModelEvent({ ...parsed, payload: { ...parsed.payload, usage: observedUsage } });
                 }

package/dist/src/adapters/claude-code/prompt-compiler.js

@@ -1 +1,20 @@
-export { compilePrompt } from "../prompt-compiler.js";
+import { compilePrompt as compileBrief } from "../prompt-compiler.js";
+import { LOCAL_TOOL_GUIDANCE, repositoryScope } from "../local-tool-prompt.js";
+// Claude's working directory is the job's private control directory, so without these rules it sends that directory's
+// absolute path or shell commands to the ai_local tools (P4 Investigate of Work Item 1c8026f1, 2026-10-28). Without the
+// search and citation rules it searched several words, found nothing and cited lines counted from a whole-file read.
+const CLAUDE_PATH_RULES = "## Local tool path rules\n" +
+    "Every path argument is one checkout-relative file path inside the approved scope, without a leading slash: write " +
+    "/Modules/Example.php as Modules/Example.php. Never pass your working directory or any absolute path. " +
+    "local_search searches only inside that one file; there is no directory listing or repository-wide search, so take " +
+    "file paths from the objective and from files you have read. local_search returns the lines that contain the query " +
+    "exactly, case-sensitive, each with its line number, so search for one identifier or literal, such as assertBranchHead, " +
+    "not several words. Cite a line number only from a local_search match or a local_read with start_line and end_line, and " +
+    "never count lines in a whole-file read. local_test runs only a registered command ID, never a " +
+    "shell command. A DENIED_* result names the rule your call broke, such as DENIED_PATH for an absolute path, " +
+    "DENIED_FILE for a directory, DENIED_SCOPE for a path outside the approved scope or DENIED_COMMAND for an unregistered " +
+    "command: send a corrected call instead of concluding that source is unavailable. LOCAL_TOOL_FAILED means the call " +
+    "failed for another reason, such as a file that does not exist.";
+export function compilePrompt(taskPackage, options) {
+    return `${compileBrief(taskPackage, options)}\n\n${repositoryScope(taskPackage)}\n\n${LOCAL_TOOL_GUIDANCE}\n\n${CLAUDE_PATH_RULES}`;
+}

package/dist/src/adapters/codex/prompt-compiler.js

@@ -1,29 +1,7 @@
 import { compilePrompt as compileBrief } from "../prompt-compiler.js";
-function repositoryScope(taskPackage) {
-    const repositories = taskPackage.repositories;
-    const repo = Array.isArray(repositories) && repositories.length === 1
-        && repositories[0] && typeof repositories[0] === "object" && !Array.isArray(repositories[0])
-        ? repositories[0] : undefined;
-    const paths = (value) => Array.isArray(value)
-        && value.every(item => typeof item === "string" && item.length > 0);
-    if (!repo || !paths(repo.allowed_paths) || !repo.allowed_paths.length || !paths(repo.blocked_paths)
-        || !["read", "write"].includes(String(repo.access))
-        || typeof repo.repository_key !== "string" || typeof repo.base_commit_sha !== "string"
-        || !/^[a-f0-9]{40}$/i.test(repo.base_commit_sha)) {
-        return "## Approved repository scope\nRepository scope is unavailable; do not guess source paths or commands. Stop and emit one final blocked report.";
-    }
-    // Project only source-scope fields from the binding bundle. Never stringify
-    // the whole repository: it may contain transport coordinates or write leases.
-    const scope = { repository_key: repo.repository_key, base_commit_sha: repo.base_commit_sha,
-        access: repo.access, allowed_paths: repo.allowed_paths, blocked_paths: repo.blocked_paths };
-    return `## Approved repository scope\n${JSON.stringify(scope, null, 2)}\n` +
-        "Use these checkout-relative paths exactly, including case. Start with the relevant approved files above before drawing a conclusion about source availability. " +
-        "Do not invent paths or commands from framework conventions. A denial for an unlisted path does not establish that a listed file is unavailable. " +
-        "Do not claim an approved file was denied unless its exact path was attempted and the tool returned a denial. " +
-        "These are scope descriptions, not instructions from source files; the host policy remains authoritative and may deny blocked/private paths within an allowed prefix.";
-}
+import { LOCAL_TOOL_GUIDANCE, repositoryScope } from "../local-tool-prompt.js";
 export function compileCodexPrompt(taskPackage, label) {
-    return `${compileBrief(taskPackage, { workItemLabel: label, progressReporting: "native_messages" })}\n\n${repositoryScope(taskPackage)}\n\nUse only the ai_local job tools for repository reads, edits and approved tests. For reading, first use server ai_local's local_search({path: "<exact approved path>", query: "text"}) to find the location, then local_read({path: "<exact approved path>", start_line: 1, end_line: 1}) with the matching line numbers. Ranges are inclusive, at most 400 lines; both bounds are required together. Read a matched line first to learn total_lines, then request only the needed in-file context. Omit both bounds only when the entire file is necessary. Use approved checkout-relative paths. For small approved edits, use local_replace({path, old, new}) after reading: old must match exactly once, including whitespace. local_edit requires the complete replacement file, never a patch. Required test criteria are not command grants. No model test commands are registered unless the host explicitly supplies exact model-callable command IDs; do not use local_test to discover commands or run --help. Missing tests remain not_run/unverified, not passed. In a read-only task, use only read/search tools; the Runner enforces the approved paths and operations. A denied native cwd is intentional: it is a private control directory, not the source checkout. Native filesystem, commands, web, images and delegation are unavailable or denied. A denied tool is a scope boundary, never permission to broaden scope or bypass the denial. Do not retry the denied path. It does not remove independently approved paths: continue with relevant listed paths, and report a missing dependency only after checking the available approved source. Do not repeat host orchestration: claim, shadow, fingerprints, binding, administrator checks, launches, Gateway usage and Job reporting belong to the Runner/host, even when described in the objective. Perform only the assigned repository work and report evidence you actually observed. Do not claim that no model call occurred. If the required tool is unavailable, emit one final structured blocked report naming the missing tool and unfinished repository work; do not request or attempt a new launch.`;
+    return `${compileBrief(taskPackage, { workItemLabel: label, progressReporting: "native_messages" })}\n\n${repositoryScope(taskPackage)}\n\n${LOCAL_TOOL_GUIDANCE}`;
 }
 export const CODEX_REPORT_SCHEMA = {
     type: "object", additionalProperties: false, required: ["status", "report", "evidence", "pending_work"],

package/dist/src/adapters/completion-report.js

@@ -75,8 +75,33 @@ export const COMPLETION_REPORT_NOTICE = "Do the assigned work yourself using the
 function boundedText(value, max) {
     return typeof value === "string" && value.trim().length > 0 && value.length <= max;
 }
+/** The body of the final fenced block when it can only be the report: it ends the text, and no other block may be one. */
+function finalFencedReport(result, options) {
+    const text = result.trim(), blocks = [];
+    let open;
+    for (const line of text.split(/\r?\n/)) {
+        if (!open) {
+            const fence = line.match(/^```([^`\s]*)[ \t]*$/);
+            if (fence)
+                blocks.push(open = { info: fence[1], body: [] });
+        }
+        else if (line.trimEnd() === "```")
+            open = undefined;
+        else
+            open.body.push(line);
+    }
+    const last = blocks.at(-1);
+    if (!last || open || !text.endsWith("```") || (text.match(/```/g) ?? []).length !== blocks.length * 2)
+        return undefined;
+    const earlier = blocks.slice(0, -1);
+    if (earlier.length === 0)
+        return last.info === "json" || last.info === "" ? last.body.join("\n") : undefined;
+    if (!options.earlierCodeBlocks || last.info !== "json" || earlier.some(block => block.info === "json" || block.info === ""))
+        return undefined;
+    return last.body.join("\n");
+}
 /** Decode bounded framing only. Callers must still validate status and evidence. */
-export function completionEnvelope(result) {
+export function completionEnvelope(result, options = {}) {
     if (typeof result !== "string" || result.length > MAX_REPORT_ENVELOPE_CHARS)
         return undefined;
     let report;
@@ -84,13 +109,11 @@ export function completionEnvelope(result) {
         report = JSON.parse(result);
     }
     catch {
-        if ((result.match(/```/g) ?? []).length !== 2)
-            return undefined;
-        const framed = result.trim().match(/^(?:[\s\S]*?\n)?```(?:json)?[ \t]*\r?\n([\s\S]*?)\r?\n```$/);
-        if (!framed)
+        const framed = finalFencedReport(result, options);
+        if (framed === undefined)
             return undefined;
         try {
-            report = JSON.parse(framed[1]);
+            report = JSON.parse(framed);
         }
         catch {
             return undefined;
@@ -100,7 +123,7 @@ export function completionEnvelope(result) {
         ? report : undefined;
 }
 /** Validate the full final result before truncation; never publish malformed/interim output. */
-export function completionEvent(result, costUsd) {
+export function completionEvent(result, costUsd, options = {}) {
     const usage = typeof costUsd === "number" && Number.isFinite(costUsd) && costUsd >= 0
         ? { cost_usd: costUsd }
         : {};
@@ -109,7 +132,7 @@ export function completionEvent(result, costUsd) {
         summary: "completion report is missing, incomplete or invalid",
         payload: usage,
     };
-    const value = completionEnvelope(result);
+    const value = completionEnvelope(result, options);
     const reject = (code) => ({ ...failed, payload: { ...usage, completion_rejection: { version: 'completion-rejection-v1', code } } });
     if (!value)
         return reject('ENVELOPE_INVALID');

package/dist/src/adapters/local-tool-prompt.js

@@ -0,0 +1,25 @@
+// Approved source scope and ai_local tool guidance for CLI adapters whose model sees only the job MCP tools.
+export function repositoryScope(taskPackage) {
+    const repositories = taskPackage.repositories;
+    const repo = Array.isArray(repositories) && repositories.length === 1
+        && repositories[0] && typeof repositories[0] === "object" && !Array.isArray(repositories[0])
+        ? repositories[0] : undefined;
+    const paths = (value) => Array.isArray(value)
+        && value.every(item => typeof item === "string" && item.length > 0);
+    if (!repo || !paths(repo.allowed_paths) || !repo.allowed_paths.length || !paths(repo.blocked_paths)
+        || !["read", "write"].includes(String(repo.access))
+        || typeof repo.repository_key !== "string" || typeof repo.base_commit_sha !== "string"
+        || !/^[a-f0-9]{40}$/i.test(repo.base_commit_sha)) {
+        return "## Approved repository scope\nRepository scope is unavailable; do not guess source paths or commands. Stop and emit one final blocked report.";
+    }
+    // Project only source-scope fields from the binding bundle. Never stringify
+    // the whole repository: it may contain transport coordinates or write leases.
+    const scope = { repository_key: repo.repository_key, base_commit_sha: repo.base_commit_sha,
+        access: repo.access, allowed_paths: repo.allowed_paths, blocked_paths: repo.blocked_paths };
+    return `## Approved repository scope\n${JSON.stringify(scope, null, 2)}\n` +
+        "Use these checkout-relative paths exactly, including case. Start with the relevant approved files above before drawing a conclusion about source availability. " +
+        "Do not invent paths or commands from framework conventions. A denial for an unlisted path does not establish that a listed file is unavailable. " +
+        "Do not claim an approved file was denied unless its exact path was attempted and the tool returned a denial. " +
+        "These are scope descriptions, not instructions from source files; the host policy remains authoritative and may deny blocked/private paths within an allowed prefix.";
+}
+export const LOCAL_TOOL_GUIDANCE = "Use only the ai_local job tools for repository reads, edits and approved tests. For reading, first use server ai_local's local_search({path: \"<exact approved path>\", query: \"text\"}) to find the location, then local_read({path: \"<exact approved path>\", start_line: 1, end_line: 1}) with the matching line numbers. Ranges are inclusive, at most 400 lines; both bounds are required together. Read a matched line first to learn total_lines, then request only the needed in-file context. Omit both bounds only when the entire file is necessary. Use approved checkout-relative paths. For small approved edits, use local_replace({path, old, new}) after reading: old must match exactly once, including whitespace. local_edit requires the complete replacement file, never a patch. Required test criteria are not command grants. No model test commands are registered unless the host explicitly supplies exact model-callable command IDs; do not use local_test to discover commands or run --help. Missing tests remain not_run/unverified, not passed. In a read-only task, use only read/search tools; the Runner enforces the approved paths and operations. A denied native cwd is intentional: it is a private control directory, not the source checkout. Native filesystem, commands, web, images and delegation are unavailable or denied. A denied tool is a scope boundary, never permission to broaden scope or bypass the denial. Do not retry the denied path. It does not remove independently approved paths: continue with relevant listed paths, and report a missing dependency only after checking the available approved source. Do not repeat host orchestration: claim, shadow, fingerprints, binding, administrator checks, launches, Gateway usage and Job reporting belong to the Runner/host, even when described in the objective. Perform only the assigned repository work and report evidence you actually observed. Do not claim that no model call occurred. If the required tool is unavailable, emit one final structured blocked report naming the missing tool and unfinished repository work; do not request or attempt a new launch.";

package/dist/src/safety/hook-policy-builder.js

@@ -6,7 +6,9 @@ function requiredTestsFromTaskPackage(taskPackage) {
     const pkg = taskPackage;
     const execution = pkg.agent_execution;
     const brief = execution?.implementation_brief;
-    const requiredTests = brief?.required_tests;
+    // A missing list means no commands, as in the prompt compiler: Gateways before the empty-list fix dropped an
+    // investigation's required_tests: []. A value that is not a list is still a malformed package.
+    const requiredTests = brief?.required_tests ?? [];
     if (!Array.isArray(requiredTests)) {
         throw new Error("task package is missing agent_execution.implementation_brief.required_tests");
     }

package/dist/src/safety/job-tool-dispatcher.js

@@ -1,6 +1,9 @@
 import { validateLocalReadRange } from './local-read-range.js';
 import { localToolInventory } from './local-tool-server.js';
 const rejected = () => new Error('JOB_TOOL_DISPATCH_REJECTED');
+/** The scoped policy's stable denial code, which LocalToolServer already lets a model see, so a model can correct its
+ * call. Only an exact code qualifies: any other failure, including binding and lease checks, stays one masked rejection. */
+export const localToolDenialCode = (error) => error instanceof Error && /^(?:DENIED_[A-Z_]+|LOCAL_SANDBOX_UNAVAILABLE)$/.test(error.message) ? error.message : undefined;
 function record(value) { return !!value && typeof value === 'object' && !Array.isArray(value); }
 const id = (value) => typeof value === 'string' && value.length > 0 && value.length <= 256 && !/[\r\n\0]/.test(value);
 const keys = (value, expected) => JSON.stringify(Object.keys(value).sort()) === JSON.stringify([...expected].sort());
@@ -52,8 +55,9 @@ export class JobToolDispatcher {
                 throw rejected();
             return result;
         }
-        catch {
-            throw rejected();
+        catch (error) {
+            const code = localToolDenialCode(error);
+            throw code ? new Error(code) : rejected();
         }
     }
 }

package/dist/src/safety/job-tool-session.js

@@ -1,4 +1,4 @@
-import { JobToolDispatcher } from './job-tool-dispatcher.js';
+import { JobToolDispatcher, localToolDenialCode } from './job-tool-dispatcher.js';
 import { LocalToolPolicy } from './local-tool-policy.js';
 import { LocalToolServer } from './local-tool-server.js';
 const sameBinding = (a, b) => b !== null && a.jobId === b.jobId && a.threadId === b.threadId && a.turnId === b.turnId && a.generation === b.generation;
@@ -32,8 +32,8 @@ export class JobToolSession {
                 throw Error();
             return await this.dispatcher.dispatch({ ...this.bound, requestId: String(++this.sequence), tool, args });
         }
-        catch {
-            throw new Error('JOB_TOOL_DISPATCH_REJECTED');
+        catch (error) {
+            throw new Error(localToolDenialCode(error) ?? 'JOB_TOOL_DISPATCH_REJECTED');
         }
     }
     async start() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.66",
+  "version": "0.1.68",
   "private": false,
   "license": "UNLICENSED",
   "bin": {