mtech-ai-local-runner 0.1.7 → 0.1.9

package/dist/src/safety/job-security-receipt.js

@@ -0,0 +1,20 @@
+import { requireJobSecurity } from './job-security-policy.js';
+import { requireSecurityRequirements } from './security-requirements.js';
+/** Audit linkage only. Gateway must preserve employee_runner provenance; serialized
+ * JSON never mints host authority or native isolation certification. */
+export function createJobSecurityReceipt(policy, input) {
+    try {
+        requireJobSecurity(policy, { adapterId: policy.pin.adapterId, adapterVersion: policy.pin.adapterVersion, jobId: input.jobId, generation: input.generation, modelId: input.modelId, sourceSha: input.sourceSha });
+        if (!Number.isSafeInteger(input.generation) || input.generation < 1 || [input.launchFingerprint, input.contractFingerprint, input.taskPackageFingerprint].some(v => !/^[a-f0-9]{64}$/.test(v)))
+            throw Error();
+        const r = requireSecurityRequirements(input.requirements, { adapterId: policy.pin.adapterId, adapterVersion: policy.pin.adapterVersion, requirementsSha256: policy.pin.requirementsSha256 });
+        if (policy.pin.securityMode !== r.security_mode)
+            throw Error();
+        const supported = !!policy.pin.securityMode;
+        return Object.freeze({ ...(supported ? { security_mode: r.security_mode, accepted_residual_risks: Object.freeze([...r.accepted_residual_risks]) } : {}), receipt_version: supported ? 'cli-job-security-receipt-v2' : 'cli-job-security-receipt-v1', evidence_origin: 'employee_runner', phase: 'pre_execution', job_id: input.jobId, generation: input.generation,
+            requirements_fingerprint: r.fingerprint, launch_fingerprint: input.launchFingerprint, contract_fingerprint: input.contractFingerprint, task_package_fingerprint: input.taskPackageFingerprint, policy_fingerprint: policy.fingerprint, pin: Object.freeze({ ...policy.pin }) });
+    }
+    catch {
+        throw new Error('JOB_SECURITY_RECEIPT_REJECTED');
+    }
+}

package/dist/src/safety/job-security-session.js

@@ -0,0 +1,133 @@
+import { createHash } from 'node:crypto';
+import { requireSupportedCodexPolicy } from '../adapters/codex/supported-admission.js';
+import { admitJobSecurity, requireJobSecurity } from './job-security-policy.js';
+import { requireSecurityRequirements } from './security-requirements.js';
+const fail = () => new Error('JOB_SECURITY_SESSION_REJECTED');
+function canonical(v) {
+    if (Array.isArray(v))
+        return v.map(canonical);
+    if (v && typeof v === 'object')
+        return Object.fromEntries(Object.keys(v).sort().map(k => [k, canonical(v[k])]));
+    return v;
+}
+export const commandRegistryFingerprint = (commands) => createHash('sha256').update(JSON.stringify(canonical(commands))).digest('hex');
+function freeze(value) {
+    if (value && typeof value === 'object') {
+        for (const item of Object.values(value))
+            freeze(item);
+        Object.freeze(value);
+    }
+    return value;
+}
+/** One issuance per job attempt, revoked on cancellation including async races.
+ * This wires verified authority; it does not establish native isolation itself. */
+export class JobSecuritySession {
+    host;
+    used = false;
+    revoked = false;
+    policy;
+    request;
+    supportedFactory;
+    supportedContext;
+    supportedUsed = false;
+    registry = [];
+    nativeBinding;
+    constructor(host) {
+        this.host = host;
+    }
+    async authorize(input) {
+        if (this.used || this.revoked)
+            throw fail();
+        this.used = true;
+        let issued;
+        try {
+            if (!this.host)
+                throw fail();
+            const request = freeze(structuredClone(input));
+            if (!Number.isSafeInteger(request.generation) || request.generation < 1 || !/^[a-f0-9]{40}$/.test(request.sourceSha)
+                || [request.adapterId, request.adapterVersion, request.jobId, request.modelId].some(v => typeof v !== 'string' || !v || v.length > 256 || /[\r\n\0]/.test(v)))
+                throw fail();
+            const requirements = requireSecurityRequirements(request.requirements, request);
+            if ([request.launchFingerprint, request.contractFingerprint, request.taskPackageFingerprint].some(s => !/^[a-f0-9]{64}$/.test(s)))
+                throw fail();
+            const plan = await this.host(request);
+            if (this.revoked)
+                throw fail();
+            // Snapshot authority before awaiting a verifier; neither commands nor pin may
+            // change underneath it. Keep only the host callback for live native identity.
+            const pin = freeze(structuredClone(plan.pin)), commands = freeze(structuredClone(plan.commandRegistry));
+            for (const key of ['adapterId', 'adapterVersion', 'jobId', 'generation', 'modelId', 'sourceSha'])
+                if (pin[key] !== request[key])
+                    throw fail();
+            if (pin.requirementsSha256 !== requirements.fingerprint || !Array.isArray(commands)
+                || pin.commandsSha256 !== commandRegistryFingerprint(commands) || typeof plan.nativeBinding !== 'function')
+                throw fail();
+            if (pin.securityMode !== requirements.security_mode || pin.securityMode && typeof plan.prepareSupportedAdmission !== 'function')
+                throw fail();
+            const nativeBinding = plan.nativeBinding.bind(plan);
+            issued = await admitJobSecurity(pin, plan.verify.bind(plan));
+            if (this.revoked)
+                throw fail();
+            requireJobSecurity(issued, request);
+            this.policy = issued;
+            this.registry = commands;
+            this.nativeBinding = nativeBinding;
+            this.request = request;
+            this.supportedFactory = pin.securityMode ? plan.prepareSupportedAdmission.bind(plan) : undefined;
+            return issued;
+        }
+        catch {
+            issued?.revoke();
+            this.revoke();
+            throw fail();
+        }
+    }
+    async supportedAdmission(expected) {
+        let context;
+        try {
+            if (this.revoked || this.supportedUsed || !this.policy?.pin.securityMode || !this.request || !this.supportedFactory)
+                throw fail();
+            this.supportedUsed = true;
+            requireJobSecurity(this.policy, this.request);
+            const captured = freeze(structuredClone(expected));
+            context = await this.supportedFactory(captured);
+            // Snapshot callback data before validation; only the capability retains identity.
+            context = { policy: context.policy, binding: freeze(structuredClone(context.binding)) };
+            if (this.revoked)
+                throw fail();
+            const p = this.policy.pin, r = this.request, b = context.binding;
+            if (b.jobId !== p.jobId || b.generation !== p.generation || b.sourceSha !== p.sourceSha || b.binarySha256 !== p.binarySha256
+                || b.requirementsFingerprint !== p.requirementsSha256 || b.managedPolicyFingerprint !== p.managedPolicySha256 || b.commandsFingerprint !== p.commandsSha256
+                || b.launchFingerprint !== r.launchFingerprint || b.contractFingerprint !== r.contractFingerprint || b.taskPackageFingerprint !== r.taskPackageFingerprint
+                || captured.model !== p.modelId || captured.configFingerprint !== p.configSha256 || captured.toolSchemaFingerprint !== p.toolsSha256)
+                throw fail();
+            requireSupportedCodexPolicy(context.policy, captured, b);
+            requireJobSecurity(this.policy, r);
+            this.supportedContext = context;
+            return context;
+        }
+        catch {
+            context?.policy?.revoke();
+            this.revoke();
+            throw fail();
+        }
+    }
+    commands() {
+        return !this.revoked && this.policy ? structuredClone(this.registry) : [];
+    }
+    binding() {
+        try {
+            if (this.revoked || !this.policy)
+                return null;
+            requireJobSecurity(this.policy, this.policy.pin);
+            const b = this.nativeBinding?.(), p = this.policy.pin;
+            if (!b || b.jobId !== p.jobId || b.generation !== p.generation)
+                return null;
+            return { ...b };
+        }
+        catch {
+            return null;
+        }
+    }
+    revoke() { this.revoked = true; this.policy?.revoke(); this.supportedContext?.policy.revoke(); this.supportedFactory = undefined; this.request = undefined; this.registry = []; this.nativeBinding = undefined; }
+}

package/dist/src/safety/job-tool-dispatcher.js

@@ -0,0 +1,52 @@
+import { localToolInventory } from './local-tool-server.js';
+const rejected = () => new Error('JOB_TOOL_DISPATCH_REJECTED');
+function record(value) { return !!value && typeof value === 'object' && !Array.isArray(value); }
+const id = (value) => typeof value === 'string' && value.length > 0 && value.length <= 256 && !/[\r\n\0]/.test(value);
+const keys = (value, expected) => JSON.stringify(Object.keys(value).sort()) === JSON.stringify([...expected].sort());
+/** Host-owned validation before the existing scoped policy. Not a capability
+ * certificate: no production wiring until native authority is actually proven.
+ * Host-assigned decimal request sequence is strictly increasing on its ordered
+ * channel. A high-water mark rejects replay without an execution-count limit
+ * or an ever-growing cache. This sequence is not a model-selected capability. */
+export class JobToolDispatcher {
+    policy;
+    active;
+    #binding;
+    #revoked = false;
+    #lastRequest = 0n;
+    constructor(binding, policy, active) {
+        this.policy = policy;
+        this.active = active;
+        if (![binding.jobId, binding.threadId, binding.turnId].every(id) || !Number.isSafeInteger(binding.generation) || binding.generation < 1)
+            throw rejected();
+        this.#binding = Object.freeze({ ...binding });
+    }
+    revoke() { if (this.#revoked)
+        return; this.#revoked = true; this.policy.revoke?.(); }
+    async dispatch(input) {
+        try {
+            if (this.#revoked || !this.active() || !record(input)
+                || !keys(input, ['jobId', 'threadId', 'turnId', 'generation', 'requestId', 'tool', 'args']))
+                throw rejected();
+            const envelope = structuredClone(input), b = this.#binding;
+            if (envelope.jobId !== b.jobId || envelope.threadId !== b.threadId || envelope.turnId !== b.turnId || envelope.generation !== b.generation
+                || !id(envelope.requestId) || !/^[1-9][0-9]*$/.test(envelope.requestId) || BigInt(envelope.requestId) <= this.#lastRequest
+                || typeof envelope.tool !== 'string' || !record(envelope.args))
+                throw rejected();
+            const tool = localToolInventory().find(t => t.name === envelope.tool);
+            const properties = tool?.inputSchema.properties;
+            if (!record(properties) || !keys(envelope.args, Object.keys(properties))
+                || Object.values(envelope.args).some(value => typeof value !== 'string')
+                || Buffer.byteLength(JSON.stringify(envelope.args)) > 1024 * 1024)
+                throw rejected();
+            this.#lastRequest = BigInt(envelope.requestId);
+            const result = await this.policy.call(envelope.tool, envelope.args);
+            if (this.#revoked || !this.active())
+                throw rejected();
+            return result;
+        }
+        catch {
+            throw rejected();
+        }
+    }
+}

package/dist/src/safety/job-tool-policy.js

@@ -0,0 +1,61 @@
+import path from 'node:path';
+function object(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('Invalid Job policy');
+    return value;
+}
+function strings(value) {
+    if (!Array.isArray(value) || value.some(item => typeof item !== 'string'))
+        throw new Error('Invalid Job policy list');
+    return value;
+}
+function prefix(scope) {
+    if (!scope || path.isAbsolute(scope))
+        throw new Error('Unsupported Job path scope');
+    const relative = scope.replace(/^\.\//, '');
+    if (!relative || path.isAbsolute(relative))
+        throw new Error('Unsupported Job path scope');
+    const value = relative === '**' ? '' : relative.endsWith('/**') ? relative.slice(0, -3) : relative.replace(/\/$/, '');
+    if (path.isAbsolute(value) || /[?*\[\]{}\\\0]/.test(value) || value && value.split('/').some(segment => segment === '..' || segment === '.' || segment === ''))
+        throw new Error('Unsupported Job path scope');
+    return value;
+}
+const contains = (outer, inner) => !outer || outer === inner || inner.startsWith(outer + '/');
+/** Exact host-owned command registry only. npm/git commands have no default registration:
+ * their dependencies and subprocess permissions need separate reviewed integration. */
+export function jobToolPolicyOptions(worktreeRoot, pkg, approved, registry, runtime) {
+    if (!runtime.runtimeAdapter || !runtime.runtimeAdapterVersion || approved.runtime_adapter !== runtime.runtimeAdapter || approved.runtime_adapter_version !== runtime.runtimeAdapterVersion
+        || pkg.execution !== undefined && object(pkg.execution).runtime_adapter !== runtime.runtimeAdapter)
+        throw new Error('Job runtime differs from approval');
+    const source = object(approved.repository);
+    if (!Array.isArray(pkg.repositories) || pkg.repositories.length !== 1)
+        throw new Error('Job requires one approved repository');
+    const repo = object(pkg.repositories[0]);
+    if (repo.repository_key !== source.key || repo.base_commit_sha !== source.base_commit_sha)
+        throw new Error('Job repository differs from approval');
+    if (typeof source.key !== 'string' || !source.key || typeof source.base_commit_sha !== 'string' || !/^[a-f0-9]{40}$/i.test(source.base_commit_sha)
+        || (repo.access !== 'read' && repo.access !== 'write') || (source.access !== 'read' && source.access !== 'write'))
+        throw new Error('Job repository approval is invalid');
+    const allowedPaths = [];
+    for (const launch of strings(approved.allowed_paths))
+        for (const full of strings(repo.allowed_paths)) {
+            const a = prefix(launch), b = prefix(full);
+            if (contains(a, b))
+                allowedPaths.push(full);
+            else if (contains(b, a))
+                allowedPaths.push(launch);
+        }
+    if (allowedPaths.length === 0)
+        throw new Error('Job approved source scope has no intersection');
+    const commands = strings(object(object(pkg.contract).verification).required_commands);
+    const approvedCommands = strings(approved.required_commands);
+    if (commands.length !== approvedCommands.length || JSON.stringify([...commands].sort()) !== JSON.stringify([...approvedCommands].sort()))
+        throw new Error('Job required commands differ from approval');
+    const requiredCommands = commands.map(id => {
+        const entries = registry.filter(command => command.id === id);
+        if (entries.length !== 1)
+            throw new Error('Job required command is not exactly registered');
+        return structuredClone(entries[0]);
+    });
+    return { worktreeRoot, access: repo.access === 'write' && source.access === 'write' ? 'write' : 'read', allowedPaths: [...new Set(allowedPaths)], blockedPaths: strings(repo.blocked_paths), requiredCommands };
+}

package/dist/src/safety/job-tool-session.js

@@ -0,0 +1,82 @@
+import { JobToolDispatcher } from './job-tool-dispatcher.js';
+import { LocalToolPolicy } from './local-tool-policy.js';
+import { LocalToolServer } from './local-tool-server.js';
+const sameBinding = (a, b) => b !== null && a.jobId === b.jobId && a.threadId === b.threadId && a.turnId === b.turnId && a.generation === b.generation;
+/** Per-job endpoint and scoped worker lifecycle. This is not native CLI admission. */
+export class JobToolSession {
+    options;
+    policy;
+    server;
+    dispatcher;
+    bound;
+    sequence = 0n;
+    started = false;
+    revoked = false;
+    closing;
+    constructor(options) {
+        this.options = options;
+        this.policy = new LocalToolPolicy(options.policyOptions);
+    }
+    async call(tool, args) {
+        try {
+            if (this.revoked)
+                throw Error();
+            const binding = this.options.binding();
+            if (!binding)
+                throw Error();
+            if (!this.dispatcher) {
+                this.bound = Object.freeze({ ...binding });
+                this.dispatcher = new JobToolDispatcher(this.bound, this.policy, () => !this.revoked && this.options.active() && sameBinding(this.bound, this.options.binding()));
+            }
+            if (!sameBinding(this.bound, binding))
+                throw Error();
+            return await this.dispatcher.dispatch({ ...this.bound, requestId: String(++this.sequence), tool, args });
+        }
+        catch {
+            throw new Error('JOB_TOOL_DISPATCH_REJECTED');
+        }
+    }
+    async start() {
+        if (this.revoked || this.started)
+            throw new Error('JOB_TOOL_SESSION_START_FAILED');
+        this.started = true;
+        try {
+            const scoped = { call: (tool, args) => this.call(tool, args), revoke: () => this.policy.revoke() };
+            this.server = this.options.createServer?.(scoped) ?? new LocalToolServer({ policy: scoped });
+            const endpoint = await this.server.start();
+            if (this.revoked)
+                throw Error();
+            return endpoint;
+        }
+        catch {
+            await this.close().catch(() => { });
+            throw new Error('JOB_TOOL_SESSION_START_FAILED');
+        }
+    }
+    revoke() {
+        if (this.revoked)
+            return;
+        this.revoked = true;
+        // Clear the endpoint token before cancellation reaches any worker.
+        try {
+            this.server?.revoke();
+        }
+        finally {
+            this.dispatcher?.revoke();
+            this.policy.revoke();
+        }
+    }
+    close() {
+        if (this.closing)
+            return this.closing;
+        this.closing = (async () => {
+            try {
+                this.revoke();
+            }
+            finally {
+                await this.server?.close();
+            }
+        })();
+        return this.closing;
+    }
+}

package/dist/src/safety/local-tool-policy.js

@@ -0,0 +1,101 @@
+import path from 'node:path';
+import { randomBytes } from 'node:crypto';
+import { lstat, realpath } from 'node:fs/promises';
+import { evaluateCommand } from './command-policy.js';
+import { runSandboxed } from './subprocess-sandbox.js';
+import { LOCAL_TOOL_WORKER } from './local-tool-worker.js';
+import { verifyCommandIntegrity } from './registered-command-integrity.js';
+export const LOCAL_TOOL_NAMES = ['local_read', 'local_search', 'local_edit', 'local_test'];
+// Private state/control basenames only: Auth.php, auth/ and mcp.ts are ordinary source.
+const sensitive = (segment) => /^(?:\.git|\.mcp(?:\..*)?|\.npmrc|\.netrc|id_rsa|id_ed25519|\.local-runner|\.runner|\.env(?:\..*)?|\.codex|\.claude|\.ssh|\.aws|\.config|auth\.(?:json|toml|ya?ml)(?:\..*)?|credentials(?:\..*)?|AGENTS\.md|CLAUDE\.md|mcp\.(?:json|toml|ya?ml)(?:\..*)?)$/i.test(segment);
+const contains = (root, file) => file === root || file.startsWith(root + path.sep);
+function scopePath(root, scope) {
+    const directory = scope === '**' ? '.' : scope.endsWith('/**') ? scope.slice(0, -3) || '.' : scope;
+    if (/[?*\[\]{}]/.test(directory))
+        throw new Error('DENIED_UNSUPPORTED_SCOPE');
+    return path.resolve(root, directory);
+}
+export class LocalToolPolicy {
+    options;
+    abort = new AbortController();
+    constructor(options) {
+        this.options = structuredClone(options);
+        if (!path.isAbsolute(options.worktreeRoot))
+            throw new Error('DENIED_ROOT');
+    }
+    revoke() { this.abort.abort(); }
+    async call(tool, args) {
+        if (this.abort.signal.aborted)
+            throw new Error('DENIED_REVOKED');
+        if (!LOCAL_TOOL_NAMES.includes(tool))
+            throw new Error('DENIED_TOOL');
+        if (!args || typeof args !== 'object' || Array.isArray(args))
+            throw new Error('DENIED_ARGUMENTS');
+        const input = args;
+        if (tool === 'local_edit' && this.options.access !== 'write')
+            throw new Error('DENIED_READ_ONLY');
+        if (tool === 'local_test')
+            return this.test(input);
+        const file = await this.authorizedFile(input.path, tool === 'local_edit');
+        if (tool === 'local_edit' && (typeof input.content !== 'string' || Buffer.byteLength(input.content) > 1024 * 1024))
+            throw new Error('DENIED_CONTENT');
+        if (tool === 'local_search' && (typeof input.query !== 'string' || input.query.length > 4096))
+            throw new Error('DENIED_QUERY');
+        const temp = file + '.runner-edit-' + randomBytes(16).toString('hex');
+        const output = await runSandboxed({ executable: process.execPath, argv: ['--no-addons', '--no-global-search-paths', '--eval', LOCAL_TOOL_WORKER, JSON.stringify({ tool, path: file, temp, content: input.content, query: input.query })], readFiles: tool === 'local_edit' ? [file, temp] : [file], writeFiles: tool === 'local_edit' ? [file, temp] : [], timeoutMs: 10000, signal: this.abort.signal });
+        if (this.abort.signal.aborted)
+            throw new Error('DENIED_REVOKED');
+        return JSON.parse(output);
+    }
+    async authorizedFile(value, allowMissing = false) {
+        if (typeof value !== 'string' || !value || value.includes('\0') || path.isAbsolute(value) || value.split(/[\\/]/).some(p => p === '..' || sensitive(p)))
+            throw new Error('DENIED_PATH');
+        const root = path.resolve(this.options.worktreeRoot), file = path.resolve(root, value);
+        if (!contains(root, file) || !this.options.allowedPaths.some(scope => contains(scopePath(root, scope), file)) || this.options.blockedPaths.some(scope => contains(scopePath(root, scope), file)))
+            throw new Error('DENIED_SCOPE');
+        if (await realpath(root) !== root)
+            throw new Error('DENIED_ROOT');
+        let component = root;
+        for (const segment of path.relative(root, file).split(path.sep)) {
+            component = path.join(component, segment);
+            let stat;
+            try {
+                stat = await lstat(component);
+            }
+            catch (error) {
+                if (allowMissing && component === file && error.code === 'ENOENT')
+                    return file;
+                throw error;
+            }
+            if (stat.isSymbolicLink())
+                throw new Error('DENIED_SYMLINK');
+        }
+        const stat = await lstat(file);
+        if (!stat.isFile())
+            throw new Error('DENIED_FILE');
+        if (stat.nlink !== 1)
+            throw new Error('DENIED_HARDLINK');
+        if (stat.size > 1024 * 1024)
+            throw new Error('DENIED_SIZE');
+        return file;
+    }
+    async test(input) {
+        const command = this.options.requiredCommands.find(command => command.id === input.command);
+        if (!command || !path.isAbsolute(command.executable) || command.argv.some(arg => typeof arg !== 'string'))
+            throw new Error('DENIED_COMMAND');
+        const rendered = [path.basename(command.executable), ...command.argv].join(' ');
+        if (!evaluateCommand(rendered, { requiredCommands: [rendered] }).allowed)
+            throw new Error('DENIED_COMMAND');
+        // Every dependency is an explicit registered file intersected with package policy.
+        // Test code has no worktree writes, ambient configuration, network or executable grants.
+        const executable = await realpath(command.executable);
+        const argv = executable === await realpath(process.execPath) ? ['--no-addons', '--no-global-search-paths', ...command.argv] : command.argv;
+        const readFiles = await Promise.all((command.readPaths ?? []).map(file => this.authorizedFile(file)));
+        await verifyCommandIntegrity(command.integrity, executable, command.readPaths ?? [], readFiles);
+        const output = await runSandboxed({ executable, argv, readFiles, signal: this.abort.signal });
+        await verifyCommandIntegrity(command.integrity, executable, command.readPaths ?? [], readFiles);
+        if (this.abort.signal.aborted)
+            throw new Error('DENIED_REVOKED');
+        return { output };
+    }
+}

package/dist/src/safety/local-tool-server.js

@@ -0,0 +1,174 @@
+import { createServer } from 'node:http';
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+import { LOCAL_TOOL_NAMES } from './local-tool-policy.js';
+const MAX_BODY = 1024 * 1024;
+const schemas = {
+    local_read: { type: 'object', properties: { path: { type: 'string' } }, required: ['path'], additionalProperties: false },
+    local_search: { type: 'object', properties: { path: { type: 'string' }, query: { type: 'string' } }, required: ['path', 'query'], additionalProperties: false },
+    local_edit: { type: 'object', properties: { path: { type: 'string' }, content: { type: 'string' } }, required: ['path', 'content'], additionalProperties: false },
+    local_test: { type: 'object', properties: { command: { type: 'string' } }, required: ['command'], additionalProperties: false },
+};
+/** Same immutable-by-copy inventory used by native admission and MCP discovery. */
+export function localToolInventory() {
+    return LOCAL_TOOL_NAMES.map(name => ({ name, description: `Scoped ${name} operation`, inputSchema: structuredClone(schemas[name]) }));
+}
+/** Job-only JSON MCP endpoint; intentionally has no Gateway transport or discovery. */
+export class LocalToolServer {
+    options;
+    server = null;
+    revoked = false;
+    starting = null;
+    token = null;
+    url = null;
+    constructor(options) {
+        this.options = options;
+    }
+    revoke() { this.revoked = true; this.token = null; this.options.policy.revoke?.(); }
+    async start() {
+        if (this.revoked)
+            throw new Error('Local tool server revoked');
+        if (this.server)
+            throw new Error('Local tool server already started');
+        this.token = randomBytes(32).toString('hex');
+        this.server = createServer(async (req, res) => {
+            const reply = (status, body) => {
+                if (res.writableEnded)
+                    return;
+                res.writeHead(status, { 'content-type': 'application/json' });
+                res.end(JSON.stringify(body));
+            };
+            if (req.method !== 'POST') {
+                reply(405, { error: 'Method not allowed' });
+                return;
+            }
+            if (req.url !== '/mcp') {
+                reply(404, { error: 'Not found' });
+                return;
+            }
+            if (req.headers.origin !== undefined || req.headers.host !== new URL(this.url).host) {
+                reply(403, { error: 'Forbidden' });
+                return;
+            }
+            const token = this.token, expected = Buffer.from(token ? `Bearer ${token}` : ''), supplied = Buffer.from(req.headers.authorization ?? '');
+            if (!token || expected.length !== supplied.length || !timingSafeEqual(expected, supplied)) {
+                reply(401, { error: 'Unauthorized' });
+                return;
+            }
+            if (req.headers['content-type']?.split(';')[0] !== 'application/json') {
+                reply(415, { error: 'JSON required' });
+                return;
+            }
+            try {
+                const chunks = [];
+                let size = 0;
+                for await (const chunk of req) {
+                    size += chunk.length;
+                    if (size > MAX_BODY) {
+                        reply(413, { error: 'Payload too large' });
+                        return;
+                    }
+                    chunks.push(chunk);
+                }
+                if (this.token !== token) {
+                    reply(401, { error: 'Authorization revoked' });
+                    return;
+                }
+                let value;
+                try {
+                    value = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+                }
+                catch {
+                    reply(400, { error: 'Invalid JSON' });
+                    return;
+                }
+                if (!value || typeof value !== 'object' || Array.isArray(value)) {
+                    reply(400, { error: 'Invalid RPC' });
+                    return;
+                }
+                const rpc = value;
+                if (rpc.jsonrpc !== '2.0' || typeof rpc.method !== 'string') {
+                    reply(400, { error: 'Invalid RPC' });
+                    return;
+                }
+                if (rpc.method === 'notifications/initialized' && rpc.id === undefined) {
+                    reply(202, {});
+                    return;
+                }
+                if (!(typeof rpc.id === 'string' || typeof rpc.id === 'number' && Number.isFinite(rpc.id))) {
+                    reply(400, { error: 'Invalid RPC id' });
+                    return;
+                }
+                const send = (result) => reply(200, { jsonrpc: '2.0', id: rpc.id, result });
+                if (rpc.method === 'initialize') {
+                    send({ protocolVersion: '2024-11-05', capabilities: { tools: {} }, serverInfo: { name: 'runner-local-tools', version: '1' } });
+                    return;
+                }
+                if (rpc.method === 'ping') {
+                    send({});
+                    return;
+                }
+                if (rpc.method === 'tools/list') {
+                    send({ tools: localToolInventory() });
+                    return;
+                }
+                if (rpc.method !== 'tools/call' || !rpc.params || typeof rpc.params !== 'object' || Array.isArray(rpc.params)) {
+                    reply(403, { error: 'Forbidden MCP request' });
+                    return;
+                }
+                const params = rpc.params;
+                if (!LOCAL_TOOL_NAMES.includes(params.name)) {
+                    reply(403, { error: 'Forbidden tool' });
+                    return;
+                }
+                try {
+                    const result = await this.options.policy.call(params.name, params.arguments);
+                    if (this.token !== token) {
+                        reply(401, { error: 'Authorization revoked' });
+                        return;
+                    }
+                    send({ content: [{ type: 'text', text: JSON.stringify(result) }] });
+                }
+                catch (error) {
+                    if (this.token !== token) {
+                        reply(401, { error: 'Authorization revoked' });
+                        return;
+                    }
+                    // Only stable policy error identifiers cross this boundary, never raw paths/stderr.
+                    const code = error instanceof Error ? error.message.match(/^(DENIED_[A-Z_]+|LOCAL_SANDBOX_UNAVAILABLE)/)?.[0] : undefined;
+                    send({ isError: true, content: [{ type: 'text', text: code ?? 'LOCAL_TOOL_FAILED' }] });
+                }
+            }
+            catch {
+                reply(400, { error: 'Invalid request' });
+            }
+        });
+        this.server.requestTimeout = 15000;
+        this.server.headersTimeout = 10000;
+        this.starting = new Promise((resolve, reject) => { this.server.once('error', reject); this.server.listen(0, '127.0.0.1', () => resolve()); });
+        await this.starting;
+        if (this.revoked) {
+            await this.close();
+            throw new Error('Local tool server revoked');
+        }
+        const address = this.server.address();
+        if (!address || typeof address === 'string')
+            throw new Error('Failed to bind local tool server');
+        this.url = `http://127.0.0.1:${address.port}/mcp`;
+        return { url: this.url, token: this.token };
+    }
+    async close() {
+        this.revoke();
+        const server = this.server;
+        this.server = null;
+        if (!server)
+            return;
+        await this.starting?.catch(() => { });
+        server.closeAllConnections();
+        await new Promise((resolve, reject) => server.close(error => {
+            if (error && error.code !== 'ERR_SERVER_NOT_RUNNING')
+                reject(error);
+            else
+                resolve();
+        }));
+    }
+}