mtech-ai-local-runner 0.1.75 → 0.1.77

package/README.md

@@ -1,3 +1,34 @@
+## Unreleased: Gateway-managed verification budget (P3E)
+
+D6 owner revision `fbc30fbe-cac9-45d1-9eff-bccec6ee6a54` selects a separate
+Gateway-initiated P2 verification budget: at most 1,500 weighted minutes per UTC
+calendar month and one active verification per workspace. This does not cap or
+certify the entire Bitbucket bill or unrelated jobs.
+
+New `gateway-verification-scope-v2` contracts freeze the managed accounting
+policy, reviewed weight and D6 identity. Legacy scope-v1 contracts retain their
+strict provider-billed usage condition and are never upgraded by a flag. The
+Runner validates the explicit new scope through both reviewed and continuation
+envelopes before execution. Existing provider validation limits (including its
+reviewed cloud-1x pipeline restriction) are unchanged; this feature does not
+approve another CI location or an unreviewed isolation profile.
+
+The Gateway's `AI_OPS_GATEWAY_WORK_VERIFICATION_MANAGED_BUDGET_ENABLED` switch
+is false by default. New launch/admission and stage/start writes need it; already
+admitted CI may still be polled and settled when that switch is off. Ambiguous
+POST results retain their reservation and never automatically retry a paid run.
+Scoped monthly rows preserve the legacy ledger and share its workspace guard;
+known settlement releases ownership without refunding conservative debits.
+
+This is unreleased source support. No profile, reviewer or host is
+registered by the change. A coordinated additive ledger migration and compatible
+readers are required before activation. The earlier source-version0.1.73 review
+archive predates this implementation and cannot authorize these new bytes; an
+unused final version, committed source and fresh package/runtime manifest must
+be reviewed together. No package is published or installed. See the
+[P3E design](../../docs/superpowers/specs/2026-10-30-p3e-managed-ci-budget-design.md)
+and [implementation plan](../../docs/superpowers/plans/2026-10-30-p3e-managed-ci-budget-implementation.md).
+
 ## 0.1.74: exact-parent reviewed correction attempts (P3D)
 
 This local source supports newly approved executable V3 launches behind the
@@ -870,10 +901,19 @@ The relay binds only to loopback. Local capabilities are stored in private mode-
 Existing employees can upgrade their installed daemon with:
 
 ```bash
-npx mtech-ai-local-runner setup
-npx mtech-ai-local-runner doctor
+npx mtech-ai-local-runner@<version> setup
+npx mtech-ai-local-runner@<version> doctor
 ```
 
+Since 0.1.76, setup copies the install that ran it into
+`<state root>/releases/<version>` and points the LaunchAgent at that copy, so
+the daemon never runs from the npx cache. The copy is byte-identical: it keeps
+the measured Fix receipt. A newer dependency from a fresh install could change
+that receipt. An existing release directory with other bytes is refused, and the
+LaunchAgent is left as it was. Before 0.1.76, setup pinned whatever CLI ran it.
+Under npx that was the cache (seen with 0.1.75 on 2026-10-30). Run 0.1.75 setup
+from an installed copy instead.
+
 ### Cancellation and preparation failures
 
 Cancelling a Work Loop also cancels its non-terminal local jobs. Repeating the
@@ -897,6 +937,26 @@ recorded job/generation and deterministic binding reference before restart.
 It neither repeats the binding request nor assumes the server did not create it.
 Do not delete that state to force another execution.
 
+The workspace stage clones the registered https URL with the employee's own
+`git` and `GIT_TERMINAL_PROMPT=0`. A clone or fetch that Git refuses for a
+missing, wrong or unauthorized login is reported as `REPOSITORY_ACCESS_DENIED`,
+and one that cannot reach the host as `REPOSITORY_UNREACHABLE`; any other
+failure keeps `PREPARATION_FAILED`. Only the code leaves the Mac, never Git's
+output. The Gateway's Fix result message turns these codes into setup advice
+with the `git ls-remote <url> HEAD` check. A Mac that reaches Bitbucket only
+over SSH may map the https URL with `url.<ssh>.insteadOf`: a cached mirror is
+matched by the URL it stores (`git config --get remote.origin.url`), which stays
+the registered https URL, so later jobs reuse it (Work Decision 2ae1acc1).
+
+`doctor` and `fix enable` run that check before a job needs it: `git ls-remote
+-- <url> HEAD` for each consented repository, with the same environment as the
+clone, in its own session so neither Git nor ssh can prompt, and ended after 30
+seconds. The clone URLs come from `local_agent_runner_status`
+(`fix_repositories`); an older Gateway without that list skips the check. Both
+report `repository_access` with an action for each repository that is not
+readable. `doctor` exits 1 when one is not readable; `fix enable` still writes
+the consent.
+
 These preparation controls end at binding and do not impose time, turn, token
 or cost termination limits on an approved unbounded employee-local Claude run.
 Existing generation fencing, scope restrictions, cancellation and audit remain

package/dist/src/cli.js

@@ -24,6 +24,7 @@ import { OAuthTokenProvider, LoginRequiredError } from "./auth/token-provider.js
 import { createBrowserOpener } from "./auth/browser-opener.js";
 import { FileLocalConfigStore, runnerMode } from "./registration/local-config.js";
 import { LaunchdService } from "./platform/macos/launchd.js";
+import { installStableRelease } from "./platform/macos/stable-release.js";
 import { buildDaemon, runnerDisplayName } from "./daemon/runtime.js";
 import { createHash } from "node:crypto";
 import { discoverEmployeeAdapters, hasUsableAdapter, adapterDiagnosticsWithRemedies } from "./adapters/discovery.js";
@@ -36,6 +37,7 @@ import { asksDoctorReport } from "./asks/doctor.js";
 import { guideDoctorReport, guideReportShown } from "./guide/doctor.js";
 import { runClaudeReleaseCommand } from "./commands/claude-release.js";
 import { runFixCommand } from "./commands/fix.js";
+import { checkRepositoryAccess, fixRepositoryList } from "./workspace/repository-access.js";
 function hookAction(result) {
     return result.reason === "invalid_command"
         ? "Run the runner with a Node executable and package path outside the workspace, without quotes, $, backquotes or backslashes, then rerun doctor."
@@ -183,12 +185,24 @@ export async function main(argv, env, io = {}) {
     // Offline Claude release review (Work Item 1c8026f1, P2c): no runner config, daemon or Gateway call.
     if (argv[0] === "claude-release")
         return runClaudeReleaseCommand(argv.slice(1), { stdout, stderr, fetchFn: io.fetchFn ?? fetch, ...io.claudeRelease });
-    // Fix consent (Gateway decision c5ed3a14): no Gateway call; it restarts the runner only when idle.
+    // Fix consent (Gateway decision c5ed3a14) is written on this Mac alone; it restarts the runner only when idle. Afterwards
+    // one Gateway read names the repositories' clone URLs, so this Mac's git can be checked against them (Work Item 6f9e64ae).
     if (argv[0] === "fix") {
         const stateRoot = defaultStateRootFromEnv(env);
         const launchd = io.launchdService ?? new LaunchdService({ home: env.HOME ?? "", uid: process.getuid?.() ?? 0, path: env.PATH });
+        const fetchFn = io.fetchFn ?? fetch;
         return runFixCommand(argv.slice(1), { stdout, stderr, stateRoot, loadLocalConfig: () => new FileLocalConfigStore(stateRoot).load(),
-            restartService: () => launchd.start(), serviceLoaded: async () => (await launchd.status()).loaded });
+            restartService: () => launchd.start(), serviceLoaded: async () => (await launchd.status()).loaded,
+            fixRepositories: async () => {
+                const local = await new FileLocalConfigStore(stateRoot).load();
+                if (!local)
+                    return undefined;
+                const tokenProvider = new OAuthTokenProvider({ store: new FileOAuthCredentialStore(stateRoot), oauthClient: new OAuthClient({ resource: local.gatewayMcpUrl, fetchFn }),
+                    resource: local.gatewayMcpUrl, tokenOverride: env.AI_GATEWAY_LOCAL_RUNNER_TOKEN, clock: () => Date.now() });
+                const status = await new McpGatewayClient({ mcpUrl: local.gatewayMcpUrl, tokenProvider, runnerId: local.runnerId, fetchFn }).localRunnerStatus();
+                return fixRepositoryList(status.runner);
+            },
+            ...(io.probeRepository ? { probeRepository: io.probeRepository } : {}) });
     }
     let config;
     try {
@@ -258,10 +272,12 @@ export async function main(argv, env, io = {}) {
                 const features = requestedFeatures ?? ["asks"];
                 const integrations = features.includes("asks") ? await installIntegrations(requestedIntegrations ?? [], env, config.stateRoot) : [];
                 const guide = features.includes("guide") ? await installGuideIntegrations(requestedIntegrations ?? [], env, config.stateRoot) : undefined;
-                await launchd.install(process.argv[1], config.stateRoot);
+                // The LaunchAgent runs a copy under releases/<version>, never the npx cache that may have run setup.
+                const daemonExecutable = await (io.installRelease ?? installStableRelease)({ entry: process.argv[1], stateRoot: config.stateRoot });
+                await launchd.install(daemonExecutable, config.stateRoot);
                 stdout(JSON.stringify(mode === "full"
-                    ? { configured: true, mode, runnerId: registered.runner.id, adapters, integrations, ...(guide ? { guide } : {}) }
-                    : { configured: true, mode, runnerId: registered.runner.id, adapters: adapterDiagnosticsWithRemedies(detected), integrations, ...(guide ? { guide } : {}),
+                    ? { configured: true, mode, runnerId: registered.runner.id, adapters, integrations, ...(guide ? { guide } : {}), daemonExecutable }
+                    : { configured: true, mode, runnerId: registered.runner.id, adapters: adapterDiagnosticsWithRemedies(detected), integrations, ...(guide ? { guide } : {}), daemonExecutable,
                         action: "No executor is admitted on this Mac, so the runner is set up as a messenger: it delivers AI Gateway asks and opens sessions, and runs no jobs. Resolve the adapter diagnostics, then rerun setup to run jobs." }));
                 return 0;
             }
@@ -338,15 +354,23 @@ export async function main(argv, env, io = {}) {
                 const [gateway] = oauth.status === "fulfilled"
                     ? await Promise.allSettled([new McpGatewayClient({ mcpUrl: local.gatewayMcpUrl, tokenProvider, runnerId: local.runnerId, fetchFn }).localRunnerStatus()])
                     : [{ status: "rejected", reason: "Authentication is unavailable" }];
+                // A Fix job checks out with this Mac's own git and no prompts: read each consented repository the same way now
+                // (Work Item 6f9e64ae). Only for a Fix host, and only when the Gateway lists the clone URLs; an older one leaves it out.
+                const runnerStatus = gateway.status === "fulfilled" ? gateway.value.runner : undefined;
+                const listed = fixRepositoryList(runnerStatus);
+                const consented = Array.isArray(runnerStatus?.local_fix?.repository_keys) ? runnerStatus.local_fix.repository_keys.filter((key) => typeof key === "string") : [];
+                const repositoryAccessPromise = listed === undefined || consented.length === 0 ? Promise.resolve(undefined) : checkRepositoryAccess(consented, listed, io.probeRepository);
                 const [service, workspace] = await localChecks;
                 const hook = await hookCheck;
                 const asks = await asksCheck;
                 const guide = await guideCheck;
+                const repositoryAccess = await repositoryAccessPromise;
+                const readable = repositoryAccess === undefined || repositoryAccess.every(check => check.status === "readable");
                 const checks = [oauth, gateway, service, workspace];
                 const loaded = service.status === "fulfilled" && service.value.loaded;
-                const ok = checks.every(check => check.status === "fulfilled") && loaded && (hook === null || (hasUsableAdapter(adapters) && hook.enforcing));
-                stdout(JSON.stringify({ ok, configured: true, adapters, checks: { runner_registration: true, oauth: oauth.status === "fulfilled", gateway: gateway.status === "fulfilled", workspace: workspace.status === "fulfilled", launchd: loaded, ...(hook === null ? {} : { hook: hook.enforcing }) },
-                    hook: hook === null ? { status: "not_required", reason: "messenger_mode" } : hookReport(hook), ...asks, ...(guideReportShown(guide) ? { guide } : {}), ...(gateway.status === "fulfilled" ? { runner: gateway.value } : {}), ...(service.status === "fulfilled" ? { launchd: service.value } : {}) }));
+                const ok = checks.every(check => check.status === "fulfilled") && loaded && readable && (hook === null || (hasUsableAdapter(adapters) && hook.enforcing));
+                stdout(JSON.stringify({ ok, configured: true, adapters, checks: { runner_registration: true, oauth: oauth.status === "fulfilled", gateway: gateway.status === "fulfilled", workspace: workspace.status === "fulfilled", launchd: loaded, ...(hook === null ? {} : { hook: hook.enforcing }), ...(repositoryAccess === undefined ? {} : { repository_access: readable }) },
+                    hook: hook === null ? { status: "not_required", reason: "messenger_mode" } : hookReport(hook), ...asks, ...(guideReportShown(guide) ? { guide } : {}), ...(repositoryAccess === undefined ? {} : { repository_access: repositoryAccess }), ...(gateway.status === "fulfilled" ? { runner: gateway.value } : {}), ...(service.status === "fulfilled" ? { launchd: service.value } : {}) }));
                 return ok ? 0 : 1;
             }
             if (config.mode === 'manual-codex') {

package/dist/src/commands/fix.js

@@ -7,6 +7,7 @@ import { measureCommandFile } from '../safety/registered-command-integrity.js';
 import { assertPinnedGit } from '../publication/git-credential-broker.js';
 import { assertLocalFixConsent } from '../publication/installed-host.js';
 import { runnerMode } from '../registration/local-config.js';
+import { checkRepositoryAccess } from '../workspace/repository-access.js';
 export const FIX_USAGE = 'Usage: mtec-ai-local-runner fix enable --projects <key[,key...]> [--modes gateway_publish_v1[,gateway_ci_v1]] [--git <path>]\n'
     + '       mtec-ai-local-runner fix disable\n'
     + '       mtec-ai-local-runner fix status';
@@ -202,5 +203,9 @@ export async function runFixCommand(argv, io) {
             io.stderr('FIX_CONSENT_INVALID: give registered repository keys (lowercase, comma separated, no repeats) and modes gateway_publish_v1 or gateway_ci_v1.');
         return 1;
     }
-    return restart(io, { ok: true, repository_keys: applied.consent.repository_keys, verification_modes: applied.consent.verification_modes });
+    // A job checks out with this Mac's own git and no prompts: say now when it cannot read a repository (Work Item 6f9e64ae).
+    // The consent stands either way; the employee may set the login up afterwards.
+    const listed = await io.fixRepositories?.().catch(() => undefined);
+    const access = listed === undefined ? undefined : await checkRepositoryAccess(applied.consent.repository_keys, listed, io.probeRepository);
+    return restart(io, { ok: true, repository_keys: applied.consent.repository_keys, verification_modes: applied.consent.verification_modes, ...(access ? { repository_access: access } : {}) });
 }

package/dist/src/daemon/execution-coordinator.js

@@ -13,6 +13,7 @@ import { completionReportDiagnostic } from "../adapters/completion-report.js";
 import { PROTOCOL_VERSION, isTerminalEventType, validateEvent, validateAttemptEvidence, validateAttemptHandoff, MAX_EVENT_SUMMARY_CHARS } from "../protocol.js";
 import { DAEMON_BLOCKED_REASONS, DAEMON_CANCELLED_REASONS } from "../state-store.js";
 import { PreparationDeadlineError, PreparationLease, validateJobLease } from './preparation-lease.js';
+import { RepositoryAccessError } from '../workspace/repository-access.js';
 function canonical(value) {
     if (Array.isArray(value))
         return value.map(canonical);
@@ -196,6 +197,8 @@ export class ExecutionCoordinator {
                 diagnostic.code = "LOCAL_FIX_HOST_REQUIRED";
             if (error instanceof PreparationDeadlineError)
                 diagnostic.code = "PREPARATION_DEADLINE_EXCEEDED";
+            if (error instanceof RepositoryAccessError)
+                diagnostic.code = error.code;
             if (error instanceof GatewayToolError) {
                 diagnostic.tool = error.toolName;
                 diagnostic.code = error.code;

package/dist/src/platform/macos/stable-release.js

@@ -0,0 +1,90 @@
+import { createHash } from "node:crypto";
+import { cp, lstat, mkdir, readFile, readdir, readlink, realpath, rename, rm } from "node:fs/promises";
+import { basename, dirname, join, relative, sep } from "node:path";
+/*
+ * The LaunchAgent runs the CLI that ran setup. Under npx that is the npx cache (2026-10-30, 0.1.75), which npm may
+ * prune or reuse, so the next daemon start would fail or run other bytes. Setup therefore copies the running install
+ * (the node_modules holding this package and its dependencies) into <state root>/releases/<version> and the
+ * LaunchAgent runs that copy. The copy is the same bytes that ran setup, so the measured Fix receipt does not change;
+ * a fresh npm install could resolve newer dependencies and change it.
+ */
+const PACKAGE = "mtech-ai-local-runner";
+const VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.]+)?$/;
+/** Every name, link target, file mode and content hash under a directory, in sorted order. */
+async function treeDigest(root) {
+    const hash = createHash("sha256");
+    const walk = async (dir) => {
+        for (const name of (await readdir(dir)).sort()) {
+            const path = join(dir, name), rel = relative(root, path), st = await lstat(path);
+            if (st.isSymbolicLink())
+                hash.update(`L ${rel} ${await readlink(path)}\n`);
+            else if (st.isDirectory()) {
+                hash.update(`D ${rel}\n`);
+                await walk(path);
+            }
+            else if (st.isFile())
+                hash.update(`F ${rel} ${(st.mode & 0o777).toString(8)} ${createHash("sha256").update(await readFile(path)).digest("hex")}\n`);
+            else
+                throw new Error("RUNNER_RELEASE_FILE_UNSUPPORTED");
+        }
+    };
+    await walk(root);
+    return hash.digest("hex");
+}
+/** The installed package that holds the entry, or undefined when the entry is not inside an installed package. */
+async function installedPackage(entry) {
+    let dir = dirname(entry);
+    for (let depth = 0; depth < 6; depth++) {
+        try {
+            const manifest = JSON.parse(await readFile(join(dir, "package.json"), "utf8"));
+            if (manifest.name === PACKAGE) {
+                if (typeof manifest.version !== "string" || !VERSION.test(manifest.version))
+                    throw new Error("RUNNER_RELEASE_VERSION_INVALID");
+                return basename(dirname(dir)) === "node_modules" ? { root: dir, version: manifest.version } : undefined;
+            }
+        }
+        catch (error) {
+            if (error instanceof Error && error.message === "RUNNER_RELEASE_VERSION_INVALID")
+                throw error;
+        }
+        const parent = dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return undefined;
+}
+/** The path the LaunchAgent should run: the entry's copy under <state root>/releases/<version>. */
+export async function installStableRelease(input) {
+    const entry = await realpath(input.entry);
+    const pkg = await installedPackage(entry);
+    if (!pkg)
+        return input.entry;
+    const releases = join(input.stateRoot, "releases");
+    await mkdir(releases, { recursive: true, mode: 0o700 });
+    if (entry.startsWith((await realpath(releases)) + sep))
+        return entry;
+    const modules = dirname(pkg.root), target = join(releases, pkg.version);
+    const targetEntry = join(target, "node_modules", PACKAGE, relative(pkg.root, entry));
+    const expected = await treeDigest(modules);
+    const existing = await lstat(target).catch(() => undefined);
+    if (existing) {
+        if (!existing.isDirectory() || await treeDigest(join(target, "node_modules")).catch(() => "") !== expected) {
+            throw new Error("RUNNER_RELEASE_DIRECTORY_DIFFERS");
+        }
+        return targetEntry;
+    }
+    const partial = `${target}.partial-${process.pid}`;
+    await rm(partial, { recursive: true, force: true });
+    try {
+        await mkdir(partial, { mode: 0o700 });
+        await cp(modules, join(partial, "node_modules"), { recursive: true, verbatimSymlinks: true, errorOnExist: true, force: false });
+        if (await treeDigest(join(partial, "node_modules")) !== expected)
+            throw new Error("RUNNER_RELEASE_COPY_MISMATCH");
+        await rename(partial, target);
+    }
+    finally {
+        await rm(partial, { recursive: true, force: true });
+    }
+    return targetEntry;
+}

package/dist/src/verification/continuation-runner-contract.js

@@ -2,6 +2,7 @@ import path from 'node:path';
 import { realpath } from 'node:fs/promises';
 import { measureCommandFile } from '../safety/registered-command-integrity.js';
 import { protocolHash, protocolJson } from '../publication/candidate.js';
+import { assertGatewayVerificationScope } from './runner-observed-verifier.js';
 export const CONTINUATION_SCHEMA = 'local-runner-verification-v3';
 export const CONTINUATION_POLICY = 'local-runner-reviewed-corrections-v1';
 export const ATTEMPT_CONTEXT_SCHEMA = 'local-runner-attempt-context-v1';
@@ -57,10 +58,12 @@ export function resolveContinuationVerification(value) {
     const inner = object(e.runner_binding), c = object(e.completion_binding);
     if (inner.schema_version !== 'local-runner-verification-v1' || inner.mode !== 'runner_observed_v1' || inner.policy_key !== 'local-runner-verified-v1')
         reject();
-    const gateway = object(inner.gateway_verification), definition = object(gateway.profile_definition);
-    exact(gateway, ['schema_version', 'intent', 'mode', 'profile_id', 'repository_key', 'profile_definition', 'profile_fingerprint']);
-    if (gateway.schema_version !== 'gateway-verification-scope-v1' || gateway.intent !== 'verification_only' || gateway.mode !== 'shadow' || !same(gateway.profile_fingerprint, protocolHash(definition)) || definition.reviewed !== true || definition.ref_prefix !== 'ai-verify/' || definition.max_concurrent_runs !== 1 || typeof gateway.profile_id !== 'string' || !gateway.profile_id || typeof gateway.repository_key !== 'string' || !Array.isArray(definition.repository_keys) || !definition.repository_keys.includes(gateway.repository_key))
+    try {
+        assertGatewayVerificationScope(inner.gateway_verification);
+    }
+    catch {
         reject();
+    }
     exact(c, ['schema_version', 'frozen_loop_contract', 'completion_criteria_fingerprint', 'runner_criteria_fingerprint', 'review_subject_schema', 'review_requirement', 'execute_attempt_limit', 'max_correction_rounds', 'd3_reference']);
     if (!integer(c.max_correction_rounds, 0, 2) || c.execute_attempt_limit !== Math.min(3, 1 + Number(c.max_correction_rounds)))
         reject();

package/dist/src/verification/runner-observed-verifier.js

@@ -30,13 +30,57 @@ export function assertGatewayVerificationScope(value, repositoryKey) {
         throw denied();
     const g = value;
     keys(g, ['schema_version', 'intent', 'mode', 'profile_id', 'repository_key', 'profile_definition', 'profile_fingerprint']);
-    if (g.schema_version !== 'gateway-verification-scope-v1' || g.intent !== 'verification_only' || g.mode !== 'shadow'
+    if (!['gateway-verification-scope-v1', 'gateway-verification-scope-v2'].includes(g.schema_version) || g.intent !== 'verification_only' || g.mode !== 'shadow'
         || typeof g.profile_id !== 'string' || !g.profile_id || typeof g.repository_key !== 'string' || !g.repository_key
         || repositoryKey !== undefined && g.repository_key !== repositoryKey || !g.profile_definition || typeof g.profile_definition !== 'object'
         || protocolHash(g.profile_definition) !== g.profile_fingerprint || g.profile_definition.reviewed !== true
         || g.profile_definition.ref_prefix !== 'ai-verify/' || g.profile_definition.max_concurrent_runs !== 1
         || !Array.isArray(g.profile_definition.repository_keys) || !g.profile_definition.repository_keys.includes(g.repository_key))
         throw denied();
+    const p = g.profile_definition, managed = g.schema_version === 'gateway-verification-scope-v2';
+    const fields = ['reviewed', 'repository_keys', 'ref_prefix', 'ci', 'protected_paths', 'monthly_minutes_budget', 'max_pipeline_minutes', 'weighted_minutes_reservation', 'max_concurrent_runs', 'grant_ttl_seconds'];
+    // Legacy bytes remain legacy; accounting can only arrive in an explicit V2 scope.
+    keys(p, managed ? [...fields, 'accounting'] : fields);
+    if (!managed)
+        return;
+    const exact = (value, fields) => {
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            throw denied();
+        keys(value, fields);
+        if (fields.some(k => !Object.hasOwn(value, k)))
+            throw denied();
+        return value;
+    };
+    exact(p, [...fields, 'accounting']);
+    const a = exact(p.accounting, ['mode', 'budget_scope', 'period_kind', 'decision_revision_id', 'weight_multiplier']);
+    if (a.mode !== 'gateway_managed_reservations_v1' || a.budget_scope !== 'p2_gateway_verification' || a.period_kind !== 'utc_calendar_month'
+        || a.decision_revision_id !== 'fbc30fbe-cac9-45d1-9eff-bccec6ee6a54' || !Number.isSafeInteger(a.weight_multiplier) || Number(a.weight_multiplier) < 1)
+        throw denied();
+    for (const key of ['monthly_minutes_budget', 'max_pipeline_minutes', 'weighted_minutes_reservation', 'grant_ttl_seconds'])
+        if (!Number.isSafeInteger(p[key]) || Number(p[key]) < 1)
+            throw denied();
+    if (Number(p.monthly_minutes_budget) > 1500 || Number(p.max_pipeline_minutes) > 60 || Number(p.grant_ttl_seconds) > 86400
+        || Number(p.grant_ttl_seconds) < Number(p.max_pipeline_minutes) * 60 + 600
+        || p.weighted_minutes_reservation !== Number(p.max_pipeline_minutes) * Number(a.weight_multiplier)
+        || Number(p.weighted_minutes_reservation) > Number(p.monthly_minutes_budget))
+        throw denied();
+    if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,95}$/.test(g.profile_id) || !Array.isArray(p.protected_paths) || p.protected_paths.length > 100 || p.protected_paths.some(n => typeof n !== 'string' || !n || n.length > 400))
+        throw denied();
+    const ci = exact(p.ci, ['validation_only', 'secret_isolation', 'automatic_deployment', 'selector', 'required_steps', 'trusted_files']);
+    if (ci.validation_only !== true || ci.secret_isolation !== true || ci.automatic_deployment !== false || typeof ci.selector !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9_-]{0,100}$/.test(ci.selector)
+        || !Array.isArray(ci.required_steps) || !ci.required_steps.length || ci.required_steps.length > 50 || new Set(ci.required_steps).size !== ci.required_steps.length
+        || ci.required_steps.some(n => typeof n !== 'string' || !n || n.trim() !== n || n.length > 255)
+        || !Array.isArray(ci.trusted_files) || !ci.trusted_files.length || ci.trusted_files.length > 100)
+        throw denied();
+    const paths = new Set();
+    for (const file of ci.trusted_files) {
+        const f = exact(file, ['path', 'sha256']);
+        if (typeof f.path !== 'string' || !/^[A-Za-z0-9_][A-Za-z0-9_.-]*(?:\/[A-Za-z0-9_.-]+)*$/.test(f.path) || f.path.split('/').includes('..') || paths.has(f.path) || !hex(f.sha256, 64))
+            throw denied();
+        paths.add(f.path);
+    }
+    if (!paths.has('bitbucket-pipelines.yml'))
+        throw denied();
 }
 /** Canonical P1 domain. Never uses legacy terminal T/U bytes or diff hashing. */
 export function buildP1ChangedPaths(input, bounds) {

package/dist/src/workspace/git-client.js

@@ -1,13 +1,17 @@
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 const execFileAsync = promisify(execFile);
+/** The employee's own Git environment with prompts off: a job's Git never waits for a person. */
+export function gitEnvironment() {
+    return { ...process.env, GIT_TERMINAL_PROMPT: "0" };
+}
 export class GitClient {
     async run(args, options = {}) {
         const result = await execFileAsync("git", args, {
             cwd: options.cwd,
             encoding: "utf8",
             maxBuffer: 10 * 1024 * 1024,
-            env: { ...process.env, GIT_TERMINAL_PROMPT: "0" },
+            env: gitEnvironment(),
         });
         return { stdout: result.stdout, stderr: result.stderr };
     }

package/dist/src/workspace/repository-access.js

@@ -0,0 +1,95 @@
+import { spawn } from "node:child_process";
+import { gitEnvironment } from "./git-client.js";
+export class RepositoryAccessError extends Error {
+    code;
+    constructor(code) {
+        super(code === "REPOSITORY_ACCESS_DENIED" ? "Git could not read the registered repository without a credential prompt" : "Git could not reach the registered repository");
+        this.code = code;
+    }
+}
+// No credential (GIT_TERMINAL_PROMPT=0 refused to ask), a refused one, or an account without access to the repository.
+const DENIED = [
+    /terminal prompts disabled/i, /could not read (?:username|password)/i, /authentication failed/i, /invalid credentials/i,
+    /permission denied \(publickey/i, /host key verification failed/i, /returned error: 40[13]\b/i,
+    /you may not have access to this repository/i, /repository '[^'\n]*' not found/i, /repository not found/i,
+];
+// Name resolution, routing or a connection that never completed; ssh and https word these differently.
+const UNREACHABLE = [
+    /could not resolve host/i, /failed to connect to/i, /couldn't connect to server/i, /connection timed out/i,
+    /operation timed out/i, /connection refused/i, /network is unreachable/i,
+];
+/** The access code a failed Git command's stderr shows, or undefined for any other failure. */
+export function repositoryAccessFailure(error) {
+    const stderr = typeof error === "object" && error !== null ? error.stderr : undefined;
+    if (typeof stderr !== "string" || stderr === "")
+        return undefined;
+    if (DENIED.some(pattern => pattern.test(stderr)))
+        return "REPOSITORY_ACCESS_DENIED";
+    if (UNREACHABLE.some(pattern => pattern.test(stderr)))
+        return "REPOSITORY_UNREACHABLE";
+    return undefined;
+}
+/**
+ * `git ls-remote <url> HEAD` with the environment a job's clone uses, so a missing credential shows before a job runs.
+ * It runs in its own session, so neither Git nor ssh can open the terminal to ask, and the whole group ends at the
+ * deadline. It reads refs only and writes nothing.
+ */
+export function probeRepositoryAccess(providerUrl, options = {}) {
+    return new Promise(resolve => {
+        // "--" keeps a URL from ever reading as an option such as --upload-pack.
+        const child = spawn("git", ["ls-remote", "--exit-code", "--", providerUrl, "HEAD"], { detached: true, stdio: ["ignore", "ignore", "pipe"], env: gitEnvironment() });
+        let stderr = "", settled = false;
+        const finish = (result) => { if (settled)
+            return; settled = true; clearTimeout(deadline); resolve(result); };
+        const deadline = setTimeout(() => {
+            try {
+                process.kill(-child.pid, "SIGKILL");
+            }
+            catch { /* The group already ended. */ }
+            finish({ status: "unreachable", code: "REPOSITORY_UNREACHABLE" });
+        }, options.timeoutMs ?? 30_000);
+        child.stderr.setEncoding("utf8").on("data", (chunk) => { if (stderr.length < 64 * 1024)
+            stderr += chunk; });
+        child.on("error", () => finish({ status: "failed" }));
+        child.on("close", code => {
+            // Exit 2 is --exit-code's "no HEAD": the credential worked.
+            if (code === 0 || code === 2)
+                return finish({ status: "readable" });
+            const access = repositoryAccessFailure({ stderr });
+            finish(access === "REPOSITORY_ACCESS_DENIED" ? { status: "denied", code: access } : access === "REPOSITORY_UNREACHABLE" ? { status: "unreachable", code: access } : { status: "failed" });
+        });
+    });
+}
+const KEY = /^[a-z0-9][a-z0-9._-]{0,99}$/;
+// The Gateway's registered clone URLs: https, no account in the URL, nothing a shell or Git option parser could read.
+const URL_PATTERN = /^https:\/\/[A-Za-z0-9.-]+\/[A-Za-z0-9._\/-]+$/;
+/** The Gateway's list of Fix repositories from local_agent_runner_status, or undefined when this Gateway has none. */
+export function fixRepositoryList(runner) {
+    const list = typeof runner === "object" && runner !== null ? runner.fix_repositories : undefined;
+    if (!Array.isArray(list))
+        return undefined;
+    return list.slice(0, 100).filter((entry) => typeof entry === "object" && entry !== null
+        && typeof entry.repository_key === "string" && KEY.test(entry.repository_key)
+        && typeof entry.provider_url === "string" && URL_PATTERN.test(entry.provider_url))
+        .map(entry => ({ repository_key: entry.repository_key, provider_url: entry.provider_url }));
+}
+/** Probe each asked repository the Gateway lists, at most four at a time, and say what to do about each failure. */
+export async function checkRepositoryAccess(keys, listed, probe = probeRepositoryAccess) {
+    const checks = [];
+    for (let start = 0; start < keys.length; start += 4) {
+        checks.push(...await Promise.all(keys.slice(start, start + 4).map(async (key) => {
+            const url = listed.find(entry => entry.repository_key === key)?.provider_url;
+            if (url === undefined)
+                return { repository_key: key, status: "not_registered", action: `${key} has no reviewed Fix profile on the Gateway; check the repository key.` };
+            const result = await probe(url);
+            const check = `git ls-remote ${url} HEAD`;
+            switch (result.status) {
+                case "readable": return { repository_key: key, status: "readable" };
+                case "denied": return { repository_key: key, status: "denied", action: `Set up a Bitbucket login for git on this Mac so that this prints a commit without a prompt: ${check}` };
+                case "unreachable": return { repository_key: key, status: "unreachable", action: `Check the network or VPN, then run: ${check}` };
+                default: return { repository_key: key, status: "failed", action: `Run ${check} to see why git cannot read it.` };
+            }
+        })));
+    }
+    return checks;
+}

package/dist/src/workspace/workspace-manager.js

@@ -5,6 +5,7 @@ import { createHash, randomUUID } from "node:crypto";
 import { resolve, join, sep, dirname } from "node:path";
 import { assertOwnedGitObjectStorage, RegisteredSubmoduleMaterializer } from './registered-submodules.js';
 import { isP1WorkingBranch } from '../publication/git-snapshot.js';
+import { repositoryAccessFailure, RepositoryAccessError } from './repository-access.js';
 export class WorkspaceManager {
     deps;
     submodules;
@@ -84,19 +85,26 @@ export class WorkspaceManager {
             return this.deps.git.run([...(attempt ? ['--no-replace-objects'] : []), ...args]);
         };
         if (await this.exists(mirrorPath)) {
-            const remote = (await managedGit(["--git-dir", mirrorPath, "remote", "get-url", "origin"])).stdout.trim();
+            // The stored URL, not `remote get-url`: that expands the employee's url.<x>.insteadOf, so a Mac that reaches the
+            // registered https URL over SSH would fail every job after its first clone (Work Decision 2ae1acc1).
+            const remote = (await managedGit(["--git-dir", mirrorPath, "config", "--get", "remote.origin.url"])).stdout.trim();
             if (remote !== input.providerUrl)
                 throw new Error("Managed repository remote does not match the registered provider");
         }
         else {
-            await managedGit(["clone", "--mirror", input.providerUrl, mirrorPath]);
+            try {
+                await managedGit(["clone", "--mirror", input.providerUrl, mirrorPath]);
+            }
+            catch (error) {
+                throw this.accessError(error) ?? error;
+            }
         }
         try {
             await managedGit(["--git-dir", mirrorPath, "fetch", "--prune", "origin", input.baseCommitSha]);
             await managedGit(["--git-dir", mirrorPath, "cat-file", "-e", `${input.baseCommitSha}^{commit}`]);
         }
-        catch {
-            throw new Error(`Repository revision ${input.baseCommitSha} is unavailable`);
+        catch (error) {
+            throw this.accessError(error) ?? new Error(`Repository revision ${input.baseCommitSha} is unavailable`);
         }
         if (!await this.exists(workspacePath)) {
             await managedGit(["--git-dir", mirrorPath, "worktree", "add", "--detach", workspacePath, input.baseCommitSha]);
@@ -190,6 +198,11 @@ export class WorkspaceManager {
             await handle.close();
         }
     }
+    /** A credential or network failure keeps its code (Work Item 6f9e64ae); anything else stays the caller's error. */
+    accessError(error) {
+        const code = repositoryAccessFailure(error);
+        return code === undefined ? undefined : new RepositoryAccessError(code);
+    }
     assertContained(root, candidate) {
         const resolved = resolve(candidate);
         if (resolved !== root && !resolved.startsWith(`${root}${sep}`))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.75",
+  "version": "0.1.77",
   "private": false,
   "license": "UNLICENSED",
   "bin": {