mtech-ai-local-runner 0.1.7 → 0.1.9

package/dist/src/gateway-client.js

@@ -2,6 +2,16 @@ import { createHash } from "node:crypto";
 import { v5 as uuidv5 } from "uuid";
 import { bindingApprovalIdFromEnv, redact } from "./config.js";
 import { isTerminalEventType } from "./protocol.js";
+/** Safe diagnostic metadata: never includes arguments, response bodies or credentials. */
+export class GatewayToolError extends Error {
+    toolName;
+    code;
+    constructor(message, toolName, code) {
+        super(message);
+        this.toolName = toolName;
+        this.code = code;
+    }
+}
 function nested(value, path) {
     return path.split(".").reduce((current, key) => {
         if (!current || typeof current !== "object")
@@ -113,6 +123,7 @@ export class McpGatewayClient {
         throw new Error("No token provider or static token configured");
     }
     async callTool(name, args) {
+        let failureCode = "GATEWAY_TRANSPORT_ERROR";
         try {
             const token = await this.resolveToken();
             const response = await this.fetchFn(this.mcpUrl, {
@@ -122,14 +133,17 @@ export class McpGatewayClient {
             });
             const body = (await response.json());
             if (!response.ok || body.error) {
+                failureCode = !response.ok ? `GATEWAY_HTTP_${response.status}` : "GATEWAY_RPC_ERROR";
                 throw new Error(`Gateway MCP ${name} failed with status ${response.status}: ${JSON.stringify(body.error ?? body)}`);
             }
             const text = nested(body, "result.content.0.text");
-            if (nested(body, "result.isError") || typeof text !== "string") {
+            if (typeof text !== "string") {
+                failureCode = "GATEWAY_INVALID_TOOL_RESULT";
                 throw new Error(`Gateway MCP ${name} returned an invalid tool result`);
             }
             const envelope = JSON.parse(text);
-            if (envelope.status !== "completed") {
+            if (envelope.status !== "completed" || nested(body, "result.isError")) {
+                failureCode = envelope.status === "failed" ? "GATEWAY_TOOL_REJECTED" : "GATEWAY_INVALID_TOOL_RESULT";
                 throw new Error(`Gateway MCP ${name} did not complete: ${JSON.stringify(envelope)}`);
             }
             return nested(envelope, "result.data");
@@ -148,7 +162,7 @@ export class McpGatewayClient {
             }
             const leaseToken = this.context?.leaseToken ?? this.initialLeaseToken ?? "";
             sanitized = redact(sanitized, leaseToken);
-            throw new Error(redact(sanitized, this.bindingApprovalId ?? ""));
+            throw new GatewayToolError(redact(sanitized, this.bindingApprovalId ?? ""), name, failureCode);
         }
     }
     async resolveCompatibility(input) {
@@ -421,6 +435,8 @@ export class McpGatewayClient {
         const shown = await this.callTool("work_loop_show", { work_loop_id: input.workLoopId });
         if (shown.loop.environment !== "development")
             throw new Error("local agent runtime is development-only");
+        if (shown.loop.status === "cancelled")
+            throw new GatewayToolError("Work Loop is cancelled", "work_loop_show", "WORK_LOOP_CANCELLED");
         const result = await this.callTool("work_execution_contract_show", {
             contract_id: requiredString(shown.loop.work_execution_contract_id, "execution contract ID"),
         });

package/dist/src/process/node-process-group-host.js

@@ -0,0 +1,74 @@
+import { spawn } from "node:child_process";
+/** Each invocation owns one new process group; no name-based process sweeping. */
+export class NodeProcessGroupHost {
+    spawn(command, args, options) {
+        if (process.platform !== "darwin")
+            throw new Error("Codex process isolation requires macOS");
+        const child = spawn(command, args, { ...options, shell: false, detached: true, stdio: ["pipe", "pipe", "pipe"] });
+        let failure;
+        let owned = true;
+        const kill = (signal = "SIGKILL") => {
+            if (!owned || !child.pid)
+                return;
+            try {
+                process.kill(-child.pid, signal);
+            }
+            catch (error) {
+                const code = error.code;
+                if (code === "EPERM" && child.exitCode === null && child.signalCode === null) {
+                    // macOS can expose the root PID after stdout EOF while its process
+                    // group is already exiting. Signal only this ChildProcess and retry
+                    // group cleanup from its exit callback after it has been reaped.
+                    child.kill(signal);
+                    return;
+                }
+                if (code !== "ESRCH")
+                    throw new Error("Provider process group cleanup could not be confirmed");
+            }
+            if (signal === "SIGKILL")
+                owned = false;
+        };
+        child.on("error", () => { failure = new Error("Provider process could not start"); });
+        child.stdin.on("error", () => { failure = new Error("Provider process input closed"); });
+        // Provider stderr can contain account details. Consume without publishing it.
+        child.stderr.resume();
+        child.once("exit", () => {
+            try {
+                kill();
+            }
+            catch {
+                failure = new Error("Provider process group cleanup could not be confirmed");
+            }
+        });
+        return {
+            stdin: { write: (text) => { child.stdin.write(text); }, end: () => { child.stdin.end(); } },
+            stdout: { async *[Symbol.asyncIterator]() {
+                    let pending = Buffer.alloc(0);
+                    try {
+                        for await (const chunk of child.stdout) {
+                            pending = Buffer.concat([pending, Buffer.from(chunk)]);
+                            let end;
+                            while ((end = pending.indexOf(10)) !== -1) {
+                                if (end > 256_000)
+                                    throw new Error("Provider event exceeded the allowed size");
+                                const line = pending.subarray(0, end).toString("utf8").replace(/\r$/, "");
+                                pending = pending.subarray(end + 1);
+                                yield line;
+                            }
+                            if (pending.length > 256_000)
+                                throw new Error("Provider event exceeded the allowed size");
+                        }
+                        if (pending.length)
+                            yield pending.toString("utf8");
+                        if (failure)
+                            throw failure;
+                    }
+                    finally {
+                        kill();
+                    }
+                } },
+            kill: (signal) => kill((signal ?? "SIGKILL")),
+            once: (_event, callback) => { child.once("exit", callback); },
+        };
+    }
+}

package/dist/src/safety/cli-host-admission.js

@@ -0,0 +1,74 @@
+import { constants } from 'node:fs';
+import { open, lstat, stat, access } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
+import path from 'node:path';
+// This digest identifies historical offline evidence only. It grants no capability.
+const OFFLINE_OBSERVED_BINARY = '0d5ac7aae20c4eda6242428d5e218c55ba96d8763fda2a271088ff37104b9d28';
+/** A byte measurement, not a spawn certificate. No candidate executable is run.
+ * Reject nonregular/symlink/mutable inputs. Check both descriptor and pathname;
+ * these checks do not purport to make a later path-based spawn atomic. */
+async function measure(file) {
+    const fd = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    try {
+        const before = await fd.stat({ bigint: true });
+        if (!before.isFile() || !(before.mode & 73n) || before.size > 512n * 1024n * 1024n)
+            throw Error('binary');
+        const hash = createHash('sha256');
+        let bytes = 0n;
+        for await (const chunk of fd.createReadStream({ autoClose: false })) {
+            bytes += BigInt(chunk.length);
+            if (bytes > 512n * 1024n * 1024n)
+                throw Error('binary');
+            hash.update(chunk);
+        }
+        const after = await fd.stat({ bigint: true }), named = await lstat(file, { bigint: true });
+        for (const stat of [after, named])
+            if (!stat.isFile() || stat.dev !== before.dev || stat.ino !== before.ino
+                || stat.size !== before.size || stat.mtimeNs !== before.mtimeNs || stat.ctimeNs !== before.ctimeNs)
+                throw Error('binary');
+        if (bytes !== before.size)
+            throw Error('binary');
+        return hash.digest('hex');
+    }
+    finally {
+        await fd.close();
+    }
+}
+/** Reports independent prerequisites together, never converting a version/hash,
+ * fixture result, environment flag or task-package claim into release admission.
+ * No reviewed native policy-binding/outer-isolation verifier exists yet. */
+export async function diagnoseCliHostAdmission(adapterId, binary, env) {
+    const checks = [];
+    let digest;
+    const lookup = (env.PATH ?? '').split(path.delimiter);
+    const candidates = path.isAbsolute(binary) ? [binary] : /^[A-Za-z0-9_-]+$/.test(binary) && lookup.every(part => path.isAbsolute(part))
+        ? lookup.map(part => path.join(part, binary)) : [];
+    for (const candidate of candidates) {
+        try {
+            await access(candidate, constants.X_OK);
+            if (!(await stat(candidate)).isFile())
+                continue;
+        }
+        catch {
+            continue;
+        }
+        // The first executable is what exec lookup selects. Never hash a substitute.
+        try {
+            digest = await measure(candidate);
+        }
+        catch { /* Fixed diagnostic only. */ }
+        break;
+    }
+    checks.push(digest ? { id: 'binary_identity', status: 'observed', code: adapterId === 'codex_cli' && digest === OFFLINE_OBSERVED_BINARY ? 'BINARY_OFFLINE_OBSERVED_ONLY' : 'BINARY_NOT_OFFLINE_REVIEWED' }
+        : { id: 'binary_identity', status: 'blocked', code: 'BINARY_IDENTITY_UNAVAILABLE' });
+    for (const [id, code] of [
+        ['policy_binding', 'NATIVE_POLICY_BINDING_UNAVAILABLE'],
+        ['native_isolation', 'NATIVE_ISOLATION_UNVERIFIED'],
+        ['managed_sources', 'MANAGED_SOURCE_COVERAGE_UNVERIFIED'],
+        ['provider_network', 'PROVIDER_NETWORK_BOUNDARY_UNVERIFIED'],
+        ['release_admission', 'RELEASE_ADMISSION_UNAVAILABLE'],
+    ])
+        checks.push({ id, status: 'blocked', code });
+    return { status: 'unsupported', available: false, executable: false, capabilities: [],
+        ...(digest ? { observedBinarySha256: digest } : {}), checks, reasonCodes: checks.map(check => check.code) };
+}

package/dist/src/safety/cli-security-modes.js

@@ -0,0 +1,4 @@
+/** Explicitly narrower authority; never presented as native isolation. */
+export const SUPPORTED_CLI_MODE = 'supported_cli_policy_v1';
+export const SUPPORTED_CLI_GATES = Object.freeze(['binary_identity', 'supported_permissions', 'managed_policy_compatibility', 'restricted_mcp', 'rpc_anti_reattachment', 'login_preservation', 'owned_lifecycle', 'gateway_launch_binding']);
+export const SUPPORTED_CLI_RISKS = Object.freeze(['vendor_native_runtime', 'shared_account_authentication', 'extensions_and_hosted_services', 'ipc_network_outside_command_sandbox']);

package/dist/src/safety/codex-production-host.js

@@ -0,0 +1,267 @@
+import path from 'node:path';
+import { constants } from 'node:fs';
+import { open, lstat } from 'node:fs/promises';
+import { requireCodexNativeProof } from '../adapters/codex/native-proof.js';
+import { admitSupportedCodexPolicy } from '../adapters/codex/supported-admission.js';
+import { admitJobSecurity } from './job-security-policy.js';
+import { commandRegistryFingerprint } from './job-security-session.js';
+import { fingerprint } from '../daemon/execution-coordinator.js';
+import { requireSecurityRequirements } from './security-requirements.js';
+import { SUPPORTED_CLI_GATES } from './cli-security-modes.js';
+import { verifyCommandIntegrity, measureCommandFile } from './registered-command-integrity.js';
+import { SUPPORTED_CLI_RISKS } from './cli-security-modes.js';
+import { CODEX_SUPPORTED_RELEASES } from './codex-supported-releases.js';
+import { securityRequirementsFingerprint } from './security-requirements.js';
+const reject = () => new Error('CODEX_PRODUCTION_HOST_REJECTED');
+/** Read original file backend only. No CLI, Keychain, HTTP, refresh or persistence.
+ * This is local credential availability, not remote entitlement/validity proof. */
+export async function readCodexCredentialStatus(accountRoot) {
+    const fd = await open(path.join(accountRoot, 'auth.json'), constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    try {
+        const stat = await fd.stat();
+        if (!stat.isFile() || stat.size > 1_048_576)
+            throw reject();
+        const chunks = [];
+        let size = 0;
+        for await (const chunk of fd.createReadStream({ autoClose: false })) {
+            size += chunk.length;
+            if (size > 1_048_576)
+                throw reject();
+            chunks.push(chunk);
+        }
+        const raw = Buffer.concat(chunks).toString('utf8');
+        const a = JSON.parse(raw), token = a?.tokens?.access_token;
+        if (a.auth_mode !== 'chatgpt' || typeof token !== 'string' || token.length > 32768)
+            throw reject();
+        const parts = token.split('.');
+        if (parts.length !== 3)
+            throw reject();
+        const exp = JSON.parse(Buffer.from(parts[1], 'base64url').toString()).exp;
+        if (!Number.isSafeInteger(exp) || exp <= 0)
+            throw reject();
+        return { backend: 'file', available: true, expiresAt: exp * 1000 };
+    }
+    catch {
+        throw reject();
+    }
+    finally {
+        await fd.close();
+    }
+}
+export const codexReleaseFingerprint = (release) => securityRequirementsFingerprint(release);
+function registeredCommandValid(c) {
+    try {
+        const fields = ['id', 'executable', 'argv', 'integrity', ...(c.readPaths === undefined ? [] : ['readPaths'])];
+        if (JSON.stringify(Object.keys(c).sort()) !== JSON.stringify(fields.sort()) || typeof c.id !== 'string' || !c.id || c.id.length > 256 || /[\r\n\0]/.test(c.id)
+            || typeof c.executable !== 'string' || !path.isAbsolute(c.executable) || !Array.isArray(c.argv) || c.argv.some(a => typeof a !== 'string' || /[\r\n\0]/.test(a)))
+            return false;
+        const paths = c.readPaths ?? [], integrity = c.integrity;
+        return Array.isArray(paths) && new Set(paths).size === paths.length && paths.every(p => typeof p === 'string' && !!p && !path.isAbsolute(p) && !p.split(/[\\/]/).some(s => !s || s === '.' || s === '..') && !/[\0*?\[\]{}]/.test(p))
+            && !!integrity && JSON.stringify(Object.keys(integrity).sort()) === JSON.stringify(['executableSha256', 'readFiles'])
+            && /^[a-f0-9]{64}$/.test(integrity.executableSha256) && !!integrity.readFiles && !Array.isArray(integrity.readFiles)
+            && JSON.stringify(Object.keys(integrity.readFiles).sort()) === JSON.stringify([...paths].sort())
+            && Object.values(integrity.readFiles).every(s => typeof s === 'string' && /^[a-f0-9]{64}$/.test(s));
+    }
+    catch {
+        return false;
+    }
+}
+function reviewed(value) {
+    try {
+        return JSON.stringify(Object.keys(value).sort()) === JSON.stringify(['version', 'adapterVersion', 'executableVersion', 'binarySha256', 'modelIds', 'decisionId', 'acceptedResidualRisks', 'commands'].sort())
+            && value.version === 'codex-supported-release-v1' && value.adapterVersion === '1' && /^[a-f0-9]{64}$/.test(value.binarySha256)
+            && typeof value.executableVersion === 'string' && !!value.executableVersion && !/[\r\n\0]/.test(value.executableVersion)
+            && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(value.decisionId)
+            && Array.isArray(value.modelIds) && value.modelIds.length > 0 && new Set(value.modelIds).size === value.modelIds.length
+            && value.modelIds.every(v => typeof v === 'string' && v.length > 0 && v.length < 256 && !/[\r\n\0]/.test(v))
+            && JSON.stringify(value.acceptedResidualRisks) === JSON.stringify(SUPPORTED_CLI_RISKS) && Array.isArray(value.commands) && new Set(value.commands.map(c => c.id)).size === value.commands.length && value.commands.every(registeredCommandValid);
+    }
+    catch {
+        return false;
+    }
+}
+const capabilities = ['repository_read', 'repository_edit', 'shell_test', 'git_diff'];
+export function createCodexProductionHost(input) {
+    input = { ...input };
+    const releases = structuredClone(input.releases ?? CODEX_SUPPORTED_RELEASES);
+    const claims = new Map();
+    const scopes = new Map();
+    const account = path.resolve(input.codexHome ?? path.join(input.home, '.codex'));
+    async function inspect() {
+        if (!path.isAbsolute(input.home) || !input.runnerId || !releases.length)
+            throw reject();
+        const paths = path.isAbsolute(input.binary) ? [input.binary] : input.binary === 'codex' && input.searchPath?.split(path.delimiter).every(p => path.isAbsolute(p)) ? input.searchPath.split(path.delimiter).map(p => path.join(p, 'codex')) : [];
+        for (const binary of paths) {
+            let stat;
+            try {
+                stat = await lstat(binary);
+            }
+            catch (e) {
+                if (e.code === 'ENOENT')
+                    continue;
+                throw reject();
+            }
+            // Preserve PATH precedence: never skip a present unreviewed first executable.
+            if (!stat.isFile() || !(stat.mode & 0o111) || (stat.mode & 0o022))
+                throw reject();
+            const sha = await measureCommandFile(binary), matches = releases.filter(r => reviewed(r) && r.binarySha256 === sha);
+            if (matches.length !== 1)
+                throw reject();
+            const credential = await (input.readCredentialStatus ?? readCodexCredentialStatus)(account);
+            if (credential.backend !== 'file' || !credential.available || !Number.isFinite(credential.expiresAt) || credential.expiresAt <= Date.now())
+                throw reject();
+            return { binary, release: matches[0] };
+        }
+        throw reject();
+    }
+    return {
+        async probe() {
+            try {
+                const { release } = await inspect();
+                return { available: true, authenticated: true, executableVersion: release.executableVersion, capabilities: [...capabilities] };
+            }
+            catch {
+                return { available: false, authenticated: false, capabilities: [], reason: 'CODEX_REVIEWED_RELEASE_OR_LOCAL_CREDENTIALS_UNAVAILABLE' };
+            }
+        },
+        registerClaim(value) {
+            const claim = structuredClone(value), job = claim.job, pkg = claim.task_package, context = claim.security_context;
+            if (claim.status !== 'claimed' || !job || !pkg || !context || context.runner_id !== input.runnerId
+                || typeof context.actor_id !== 'string' || !context.actor_id || /[\r\n\0]/.test(context.actor_id)
+                || !job.id || !Number.isSafeInteger(job.generation) || job.generation < 1 || !['claimed', 'shadowing'].includes(job.status)
+                || !/^[a-f0-9]{64}$/.test(job.launch_fingerprint) || !/^[a-f0-9]{64}$/.test(claim.contract_fingerprint ?? '')
+                || pkg.contract_fingerprint !== claim.contract_fingerprint || fingerprint(pkg) !== claim.task_package_fingerprint
+                || pkg.runtime_adapter !== 'codex_cli' || pkg.runtime_adapter_version !== '1' || pkg.resolved_provider !== 'openai'
+                || claims.size > 0 || scopes.size > 0)
+                throw reject();
+            requireSecurityRequirements(pkg.security_requirements, { adapterId: 'codex_cli', adapterVersion: '1' });
+            claims.set(job.id, claim);
+        },
+        job(id, sourceRoot) {
+            const claim = claims.get(id);
+            if (!claim || !path.isAbsolute(sourceRoot) || scopes.has(id))
+                throw reject();
+            const pkg = claim.task_package, job = claim.job, context = claim.security_context;
+            let prepared = false, revoked = false, used = false;
+            let selected;
+            let policy, supported, native;
+            let request;
+            const revoke = () => { revoked = true; policy?.revoke(); supported?.policy.revoke(); native?.close(); };
+            const assertPrepared = async () => {
+                if (revoked || !prepared || !selected || !request)
+                    throw reject();
+                const current = await inspect();
+                if (revoked || current.binary !== selected.binary || codexReleaseFingerprint(current.release) !== codexReleaseFingerprint(selected.release))
+                    throw reject();
+                for (const c of selected.release.commands) {
+                    const paths = c.readPaths ?? [];
+                    if (paths.some(p => path.isAbsolute(p) || p.split(/[\\/]/).includes('..')))
+                        throw reject();
+                    await verifyCommandIntegrity(c.integrity, c.executable, paths, paths.map(p => path.join(sourceRoot, p)));
+                }
+                if (revoked)
+                    throw reject();
+            };
+            const scope = {
+                async prepare(value) {
+                    if (prepared || revoked)
+                        throw reject();
+                    prepared = true;
+                    try {
+                        const r = Object.freeze(structuredClone(value));
+                        selected = await inspect();
+                        const requirements = requireSecurityRequirements(r.requirements, { adapterId: 'codex_cli', adapterVersion: '1' });
+                        if (revoked || requirements.security_mode !== 'supported_cli_policy_v1'
+                            || requirements.release_manifest_sha256 !== codexReleaseFingerprint(selected.release)
+                            || r.adapterId !== 'codex_cli' || r.adapterVersion !== '1' || r.jobId !== job.id || r.generation !== job.generation
+                            || r.modelId !== pkg.resolved_model_id || !selected.release.modelIds.includes(r.modelId)
+                            || r.sourceSha !== pkg.repository?.base_commit_sha
+                            || fingerprint(r.requirements) !== fingerprint(pkg.security_requirements)
+                            || r.launchFingerprint !== job.launch_fingerprint || r.contractFingerprint !== claim.contract_fingerprint
+                            || r.taskPackageFingerprint !== claim.task_package_fingerprint)
+                            throw reject();
+                        request = r;
+                        await assertPrepared();
+                    }
+                    catch {
+                        revoke();
+                        throw reject();
+                    }
+                },
+                async assertPrepared() { try {
+                    await assertPrepared();
+                }
+                catch {
+                    revoke();
+                    throw reject();
+                } },
+                commands() { if (revoked || !selected || !request)
+                    throw reject(); return structuredClone(selected.release.commands); },
+                binaryPath() { if (revoked || !selected || !request)
+                    throw reject(); return selected.binary; },
+                policy: () => policy,
+                binding() {
+                    try {
+                        if (revoked || !native || !policy)
+                            return null;
+                        const b = native.binding();
+                        return b ? { jobId: job.id, generation: job.generation, ...b } : null;
+                    }
+                    catch {
+                        return null;
+                    }
+                },
+                async admit(proof) {
+                    if (used || revoked)
+                        throw reject();
+                    used = true;
+                    try {
+                        await assertPrepared();
+                        const n = requireCodexNativeProof(proof), r = request, release = selected.release;
+                        if (n.binaryPath !== selected.binary || n.sourceRoot !== sourceRoot || n.home !== input.home || n.codexHome !== account
+                            || n.expected.model !== r.modelId || n.expected.provider !== 'openai')
+                            throw reject();
+                        const pin = { adapterId: r.adapterId, adapterVersion: r.adapterVersion, jobId: r.jobId, generation: r.generation, modelId: r.modelId, sourceSha: r.sourceSha,
+                            securityMode: 'supported_cli_policy_v1', requirementsSha256: r.requirements.fingerprint,
+                            binarySha256: release.binarySha256, configSha256: n.expected.configFingerprint, managedPolicySha256: n.managedPolicySha256,
+                            toolsSha256: n.expected.toolSchemaFingerprint, commandsSha256: commandRegistryFingerprint(release.commands),
+                            osProfileSha256: fingerprint({ mode: 'supported_cli_policy_v1', config: n.expected.configFingerprint, sourceRoot }) };
+                        const binding = { jobId: r.jobId, generation: r.generation, actorId: context.actor_id, runnerId: context.runner_id,
+                            repositoryKey: String(pkg.repository.key), sourceSha: r.sourceSha,
+                            launchFingerprint: r.launchFingerprint, contractFingerprint: r.contractFingerprint, taskPackageFingerprint: r.taskPackageFingerprint,
+                            binarySha256: release.binarySha256, requirementsFingerprint: pin.requirementsSha256, managedPolicyFingerprint: n.managedPolicySha256,
+                            commandsFingerprint: pin.commandsSha256, decisionId: release.decisionId };
+                        // All checks originate in this host and the retained transport validators.
+                        // No caller-supplied passed/check array is consumed.
+                        policy = await admitJobSecurity(pin, async (frozen) => {
+                            requireCodexNativeProof(proof);
+                            if (revoked)
+                                throw reject();
+                            return { version: 2, pin: frozen, checks: SUPPORTED_CLI_GATES.map(gate => ({ gate, status: 'passed' })) };
+                        });
+                        supported = { binding, policy: await admitSupportedCodexPolicy({ ...n.expected, ...binding, mode: 'supported_cli_policy_v1' }, async (frozen) => {
+                                requireCodexNativeProof(proof);
+                                if (revoked)
+                                    throw reject();
+                                return { version: 'codex-supported-policy-evidence-v1', mode: 'supported_cli_policy_v1', pin: frozen, acceptedResidualRisks: release.acceptedResidualRisks, checks: SUPPORTED_CLI_GATES.map(gate => ({ gate, status: 'passed' })) };
+                            }) };
+                        requireCodexNativeProof(proof);
+                        if (revoked)
+                            throw reject();
+                        native = n;
+                        return supported;
+                    }
+                    catch {
+                        revoke();
+                        throw reject();
+                    }
+                }, revoke,
+            };
+            scopes.set(id, scope);
+            return scope;
+        },
+        close() { for (const scope of scopes.values())
+            scope.revoke(); scopes.clear(); claims.clear(); },
+        releaseJob(id) { scopes.get(id)?.revoke(); scopes.delete(id); claims.delete(id); },
+    };
+}

package/dist/src/safety/codex-supported-releases.js

@@ -0,0 +1 @@
+export const CODEX_SUPPORTED_RELEASES = Object.freeze([]);

package/dist/src/safety/hook-cli.js

@@ -1,5 +1,6 @@
 import { evaluateHookEvent } from "./pre-tool-use-hook.js";
 import path from "node:path";
+export const MAX_HOOK_INPUT_BYTES = 262144;
 export const HOOK_POLICY_ENV_VAR = "AI_GATEWAY_RUNNER_HOOK_POLICY_B64";
 function denyMalformed() {
     return {
@@ -23,7 +24,7 @@ function isStringArray(value) {
     return Array.isArray(value) && value.every((item) => typeof item === "string");
 }
 export function parsePolicy(encoded) {
-    if (!encoded)
+    if (!encoded || encoded.length > MAX_HOOK_INPUT_BYTES)
         return null;
     try {
         if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(encoded)) {
@@ -55,9 +56,11 @@ export function parsePolicy(encoded) {
     }
 }
 export function parseHookInput(raw) {
+    if (Buffer.byteLength(raw, "utf8") > MAX_HOOK_INPUT_BYTES)
+        return null;
     try {
         const parsed = JSON.parse(raw);
-        if (typeof parsed !== "object" || parsed === null)
+        if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
             return null;
         return parsed;
     }
@@ -75,15 +78,26 @@ export function decideFromRaw(rawInput, policyEnvValue) {
     return evaluateHookEvent(input, policy);
 }
 export async function runHookCli(readStdin, env, writeStdout) {
-    const rawInput = await readStdin();
-    const decision = decideFromRaw(rawInput, env[HOOK_POLICY_ENV_VAR]);
-    writeStdout(JSON.stringify(decision));
-    return 0;
+    try {
+        const rawInput = await readStdin();
+        const decision = decideFromRaw(rawInput, env[HOOK_POLICY_ENV_VAR]);
+        writeStdout(JSON.stringify(decision));
+        return 0;
+    }
+    catch {
+        writeStdout(JSON.stringify(denyMalformed()));
+        return 2;
+    }
 }
 async function readAllStdin() {
     const chunks = [];
+    let size = 0;
     for await (const chunk of process.stdin) {
-        chunks.push(Buffer.from(chunk));
+        const bytes = Buffer.from(chunk);
+        size += bytes.length;
+        if (size > MAX_HOOK_INPUT_BYTES)
+            throw new Error("HOOK_INPUT_TOO_LARGE");
+        chunks.push(bytes);
     }
     return Buffer.concat(chunks).toString("utf8");
 }

package/dist/src/safety/hook-policy-builder.js

@@ -1,3 +1,4 @@
+import { CLAUDE_LOCAL_MCP_TOOLS } from "./pre-tool-use-hook.js";
 const DEFAULT_BLOCKED_PATHS = [".git", ".env", ".aws", ".ssh"];
 function requiredTestsFromTaskPackage(taskPackage) {
     const pkg = taskPackage;
@@ -9,21 +10,13 @@ function requiredTestsFromTaskPackage(taskPackage) {
     }
     return requiredTests.map((item) => String(item));
 }
-function allowedGatewayToolsFromTaskPackage(taskPackage) {
-    const pkg = taskPackage;
-    const contract = pkg.contract;
-    const policy = contract?.policy;
-    const allowed = policy?.allowed_gateway_tools;
-    return new Set(Array.isArray(allowed) ? allowed.filter((tool) => typeof tool === "string") : []);
-}
 /**
- * The hook policy is derived only from the canonical task package and the
- * runner's own generated paths — never from anything Claude writes.
+ * Only the four job-local MCP names may pass the hook. Source and command
+ * authorization is enforced by the scoped worker, never by native Claude tools.
  */
 export function buildHookPolicy(options) {
     const requiredCommands = requiredTestsFromTaskPackage(options.taskPackage);
-    const allowedGatewayTools = allowedGatewayToolsFromTaskPackage(options.taskPackage);
-    const allowedMcpTools = [...new Set(options.registeredReadTools.filter((tool) => allowedGatewayTools.has(tool)))];
+    const allowedMcpTools = [...CLAUDE_LOCAL_MCP_TOOLS];
     const blockedPaths = [...new Set([...DEFAULT_BLOCKED_PATHS, ...(options.additionalBlockedPaths ?? []), ...options.generatedPaths])];
     return {
         requiredCommands,

package/dist/src/safety/job-security-policy.js

@@ -0,0 +1,62 @@
+import { createHash } from 'node:crypto';
+import { SUPPORTED_CLI_MODE, SUPPORTED_CLI_GATES } from './cli-security-modes.js';
+/** Mandatory for every CLI. New adapter IDs do not alter this gate set. */
+export const JOB_SECURITY_GATES = Object.freeze(['binary_binding', 'native_tools', 'managed_policy', 'credential_boundary', 'source_command_scope', 'request_binding', 'provider_egress', 'owned_lifecycle']);
+const issued = new WeakMap();
+const rejected = () => new Error('JOB_SECURITY_REJECTED');
+const keys = ['adapterId', 'adapterVersion', 'jobId', 'generation', 'modelId', 'sourceSha', 'binarySha256', 'configSha256', 'managedPolicySha256', 'toolsSha256', 'commandsSha256', 'osProfileSha256', 'requirementsSha256'];
+const object = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
+const exact = (v, names) => JSON.stringify(Object.keys(v).sort()) === JSON.stringify([...names].sort());
+function validPin(value) {
+    if (!object(value) || !exact(value, value.securityMode === undefined ? keys : [...keys, 'securityMode'])
+        || value.securityMode !== undefined && (value.securityMode !== SUPPORTED_CLI_MODE || value.adapterId !== 'codex_cli') || !Number.isSafeInteger(value.generation) || Number(value.generation) < 1)
+        return false;
+    for (const name of keys.filter(k => k !== 'generation')) {
+        const v = value[name];
+        if (typeof v !== 'string' || !v || v.length > 256 || /[\r\n\0]/.test(v))
+            return false;
+    }
+    if (!/^[a-f0-9]{40}$/.test(String(value.sourceSha)))
+        return false;
+    return keys.filter(k => k.endsWith('Sha256')).every(k => /^[a-f0-9]{64}$/.test(String(value[k])));
+}
+export const jobSecurityPinKeys = (pin) => pin.securityMode ? [...keys, 'securityMode'] : [...keys];
+const encoded = (pin) => JSON.stringify(Object.fromEntries(jobSecurityPinKeys(pin).map(key => [key, pin[key]])));
+export async function admitJobSecurity(expected, verify) {
+    try {
+        if (!validPin(expected))
+            throw rejected();
+        const pin = Object.freeze(structuredClone(expected));
+        const receipt = await verify(pin);
+        const gates = pin.securityMode === SUPPORTED_CLI_MODE ? SUPPORTED_CLI_GATES : JOB_SECURITY_GATES;
+        if (!object(receipt) || !exact(receipt, ['version', 'pin', 'checks']) || receipt.version !== (pin.securityMode ? 2 : 1)
+            || !validPin(receipt.pin) || encoded(receipt.pin) !== encoded(pin) || !Array.isArray(receipt.checks)
+            || receipt.checks.length !== gates.length)
+            throw rejected();
+        const seen = new Set();
+        for (const check of receipt.checks) {
+            if (!object(check) || !exact(check, ['gate', 'status']) || check.status !== 'passed' || typeof check.gate !== 'string'
+                || !gates.includes(check.gate) || seen.has(check.gate))
+                throw rejected();
+            seen.add(check.gate);
+        }
+        let revoked = false;
+        const policy = Object.freeze({ pin, fingerprint: createHash('sha256').update(encoded(pin)).digest('hex'), revoke: () => { revoked = true; } });
+        issued.set(policy, () => !revoked);
+        return policy;
+    }
+    catch {
+        throw rejected();
+    }
+}
+export function requireJobSecurity(value, expected) {
+    if (!object(value) || !issued.get(value)?.())
+        throw rejected();
+    const pin = value.pin;
+    for (const key of ['adapterId', 'adapterVersion', 'jobId', 'modelId'])
+        if (pin[key] !== expected[key])
+            throw rejected();
+    for (const key of ['sourceSha', 'generation'])
+        if (expected[key] !== undefined && pin[key] !== expected[key])
+            throw rejected();
+}