mtech-ai-local-runner 0.1.76 → 0.1.77

package/README.md

@@ -937,6 +937,26 @@ recorded job/generation and deterministic binding reference before restart.
 It neither repeats the binding request nor assumes the server did not create it.
 Do not delete that state to force another execution.
 
+The workspace stage clones the registered https URL with the employee's own
+`git` and `GIT_TERMINAL_PROMPT=0`. A clone or fetch that Git refuses for a
+missing, wrong or unauthorized login is reported as `REPOSITORY_ACCESS_DENIED`,
+and one that cannot reach the host as `REPOSITORY_UNREACHABLE`; any other
+failure keeps `PREPARATION_FAILED`. Only the code leaves the Mac, never Git's
+output. The Gateway's Fix result message turns these codes into setup advice
+with the `git ls-remote <url> HEAD` check. A Mac that reaches Bitbucket only
+over SSH may map the https URL with `url.<ssh>.insteadOf`: a cached mirror is
+matched by the URL it stores (`git config --get remote.origin.url`), which stays
+the registered https URL, so later jobs reuse it (Work Decision 2ae1acc1).
+
+`doctor` and `fix enable` run that check before a job needs it: `git ls-remote
+-- <url> HEAD` for each consented repository, with the same environment as the
+clone, in its own session so neither Git nor ssh can prompt, and ended after 30
+seconds. The clone URLs come from `local_agent_runner_status`
+(`fix_repositories`); an older Gateway without that list skips the check. Both
+report `repository_access` with an action for each repository that is not
+readable. `doctor` exits 1 when one is not readable; `fix enable` still writes
+the consent.
+
 These preparation controls end at binding and do not impose time, turn, token
 or cost termination limits on an approved unbounded employee-local Claude run.
 Existing generation fencing, scope restrictions, cancellation and audit remain

package/dist/src/cli.js

@@ -37,6 +37,7 @@ import { asksDoctorReport } from "./asks/doctor.js";
 import { guideDoctorReport, guideReportShown } from "./guide/doctor.js";
 import { runClaudeReleaseCommand } from "./commands/claude-release.js";
 import { runFixCommand } from "./commands/fix.js";
+import { checkRepositoryAccess, fixRepositoryList } from "./workspace/repository-access.js";
 function hookAction(result) {
     return result.reason === "invalid_command"
         ? "Run the runner with a Node executable and package path outside the workspace, without quotes, $, backquotes or backslashes, then rerun doctor."
@@ -184,12 +185,24 @@ export async function main(argv, env, io = {}) {
     // Offline Claude release review (Work Item 1c8026f1, P2c): no runner config, daemon or Gateway call.
     if (argv[0] === "claude-release")
         return runClaudeReleaseCommand(argv.slice(1), { stdout, stderr, fetchFn: io.fetchFn ?? fetch, ...io.claudeRelease });
-    // Fix consent (Gateway decision c5ed3a14): no Gateway call; it restarts the runner only when idle.
+    // Fix consent (Gateway decision c5ed3a14) is written on this Mac alone; it restarts the runner only when idle. Afterwards
+    // one Gateway read names the repositories' clone URLs, so this Mac's git can be checked against them (Work Item 6f9e64ae).
     if (argv[0] === "fix") {
         const stateRoot = defaultStateRootFromEnv(env);
         const launchd = io.launchdService ?? new LaunchdService({ home: env.HOME ?? "", uid: process.getuid?.() ?? 0, path: env.PATH });
+        const fetchFn = io.fetchFn ?? fetch;
         return runFixCommand(argv.slice(1), { stdout, stderr, stateRoot, loadLocalConfig: () => new FileLocalConfigStore(stateRoot).load(),
-            restartService: () => launchd.start(), serviceLoaded: async () => (await launchd.status()).loaded });
+            restartService: () => launchd.start(), serviceLoaded: async () => (await launchd.status()).loaded,
+            fixRepositories: async () => {
+                const local = await new FileLocalConfigStore(stateRoot).load();
+                if (!local)
+                    return undefined;
+                const tokenProvider = new OAuthTokenProvider({ store: new FileOAuthCredentialStore(stateRoot), oauthClient: new OAuthClient({ resource: local.gatewayMcpUrl, fetchFn }),
+                    resource: local.gatewayMcpUrl, tokenOverride: env.AI_GATEWAY_LOCAL_RUNNER_TOKEN, clock: () => Date.now() });
+                const status = await new McpGatewayClient({ mcpUrl: local.gatewayMcpUrl, tokenProvider, runnerId: local.runnerId, fetchFn }).localRunnerStatus();
+                return fixRepositoryList(status.runner);
+            },
+            ...(io.probeRepository ? { probeRepository: io.probeRepository } : {}) });
     }
     let config;
     try {
@@ -341,15 +354,23 @@ export async function main(argv, env, io = {}) {
                 const [gateway] = oauth.status === "fulfilled"
                     ? await Promise.allSettled([new McpGatewayClient({ mcpUrl: local.gatewayMcpUrl, tokenProvider, runnerId: local.runnerId, fetchFn }).localRunnerStatus()])
                     : [{ status: "rejected", reason: "Authentication is unavailable" }];
+                // A Fix job checks out with this Mac's own git and no prompts: read each consented repository the same way now
+                // (Work Item 6f9e64ae). Only for a Fix host, and only when the Gateway lists the clone URLs; an older one leaves it out.
+                const runnerStatus = gateway.status === "fulfilled" ? gateway.value.runner : undefined;
+                const listed = fixRepositoryList(runnerStatus);
+                const consented = Array.isArray(runnerStatus?.local_fix?.repository_keys) ? runnerStatus.local_fix.repository_keys.filter((key) => typeof key === "string") : [];
+                const repositoryAccessPromise = listed === undefined || consented.length === 0 ? Promise.resolve(undefined) : checkRepositoryAccess(consented, listed, io.probeRepository);
                 const [service, workspace] = await localChecks;
                 const hook = await hookCheck;
                 const asks = await asksCheck;
                 const guide = await guideCheck;
+                const repositoryAccess = await repositoryAccessPromise;
+                const readable = repositoryAccess === undefined || repositoryAccess.every(check => check.status === "readable");
                 const checks = [oauth, gateway, service, workspace];
                 const loaded = service.status === "fulfilled" && service.value.loaded;
-                const ok = checks.every(check => check.status === "fulfilled") && loaded && (hook === null || (hasUsableAdapter(adapters) && hook.enforcing));
-                stdout(JSON.stringify({ ok, configured: true, adapters, checks: { runner_registration: true, oauth: oauth.status === "fulfilled", gateway: gateway.status === "fulfilled", workspace: workspace.status === "fulfilled", launchd: loaded, ...(hook === null ? {} : { hook: hook.enforcing }) },
-                    hook: hook === null ? { status: "not_required", reason: "messenger_mode" } : hookReport(hook), ...asks, ...(guideReportShown(guide) ? { guide } : {}), ...(gateway.status === "fulfilled" ? { runner: gateway.value } : {}), ...(service.status === "fulfilled" ? { launchd: service.value } : {}) }));
+                const ok = checks.every(check => check.status === "fulfilled") && loaded && readable && (hook === null || (hasUsableAdapter(adapters) && hook.enforcing));
+                stdout(JSON.stringify({ ok, configured: true, adapters, checks: { runner_registration: true, oauth: oauth.status === "fulfilled", gateway: gateway.status === "fulfilled", workspace: workspace.status === "fulfilled", launchd: loaded, ...(hook === null ? {} : { hook: hook.enforcing }), ...(repositoryAccess === undefined ? {} : { repository_access: readable }) },
+                    hook: hook === null ? { status: "not_required", reason: "messenger_mode" } : hookReport(hook), ...asks, ...(guideReportShown(guide) ? { guide } : {}), ...(repositoryAccess === undefined ? {} : { repository_access: repositoryAccess }), ...(gateway.status === "fulfilled" ? { runner: gateway.value } : {}), ...(service.status === "fulfilled" ? { launchd: service.value } : {}) }));
                 return ok ? 0 : 1;
             }
             if (config.mode === 'manual-codex') {

package/dist/src/commands/fix.js

@@ -7,6 +7,7 @@ import { measureCommandFile } from '../safety/registered-command-integrity.js';
 import { assertPinnedGit } from '../publication/git-credential-broker.js';
 import { assertLocalFixConsent } from '../publication/installed-host.js';
 import { runnerMode } from '../registration/local-config.js';
+import { checkRepositoryAccess } from '../workspace/repository-access.js';
 export const FIX_USAGE = 'Usage: mtec-ai-local-runner fix enable --projects <key[,key...]> [--modes gateway_publish_v1[,gateway_ci_v1]] [--git <path>]\n'
     + '       mtec-ai-local-runner fix disable\n'
     + '       mtec-ai-local-runner fix status';
@@ -202,5 +203,9 @@ export async function runFixCommand(argv, io) {
             io.stderr('FIX_CONSENT_INVALID: give registered repository keys (lowercase, comma separated, no repeats) and modes gateway_publish_v1 or gateway_ci_v1.');
         return 1;
     }
-    return restart(io, { ok: true, repository_keys: applied.consent.repository_keys, verification_modes: applied.consent.verification_modes });
+    // A job checks out with this Mac's own git and no prompts: say now when it cannot read a repository (Work Item 6f9e64ae).
+    // The consent stands either way; the employee may set the login up afterwards.
+    const listed = await io.fixRepositories?.().catch(() => undefined);
+    const access = listed === undefined ? undefined : await checkRepositoryAccess(applied.consent.repository_keys, listed, io.probeRepository);
+    return restart(io, { ok: true, repository_keys: applied.consent.repository_keys, verification_modes: applied.consent.verification_modes, ...(access ? { repository_access: access } : {}) });
 }

package/dist/src/daemon/execution-coordinator.js

@@ -13,6 +13,7 @@ import { completionReportDiagnostic } from "../adapters/completion-report.js";
 import { PROTOCOL_VERSION, isTerminalEventType, validateEvent, validateAttemptEvidence, validateAttemptHandoff, MAX_EVENT_SUMMARY_CHARS } from "../protocol.js";
 import { DAEMON_BLOCKED_REASONS, DAEMON_CANCELLED_REASONS } from "../state-store.js";
 import { PreparationDeadlineError, PreparationLease, validateJobLease } from './preparation-lease.js';
+import { RepositoryAccessError } from '../workspace/repository-access.js';
 function canonical(value) {
     if (Array.isArray(value))
         return value.map(canonical);
@@ -196,6 +197,8 @@ export class ExecutionCoordinator {
                 diagnostic.code = "LOCAL_FIX_HOST_REQUIRED";
             if (error instanceof PreparationDeadlineError)
                 diagnostic.code = "PREPARATION_DEADLINE_EXCEEDED";
+            if (error instanceof RepositoryAccessError)
+                diagnostic.code = error.code;
             if (error instanceof GatewayToolError) {
                 diagnostic.tool = error.toolName;
                 diagnostic.code = error.code;

package/dist/src/workspace/git-client.js

@@ -1,13 +1,17 @@
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 const execFileAsync = promisify(execFile);
+/** The employee's own Git environment with prompts off: a job's Git never waits for a person. */
+export function gitEnvironment() {
+    return { ...process.env, GIT_TERMINAL_PROMPT: "0" };
+}
 export class GitClient {
     async run(args, options = {}) {
         const result = await execFileAsync("git", args, {
             cwd: options.cwd,
             encoding: "utf8",
             maxBuffer: 10 * 1024 * 1024,
-            env: { ...process.env, GIT_TERMINAL_PROMPT: "0" },
+            env: gitEnvironment(),
         });
         return { stdout: result.stdout, stderr: result.stderr };
     }

package/dist/src/workspace/repository-access.js

@@ -0,0 +1,95 @@
+import { spawn } from "node:child_process";
+import { gitEnvironment } from "./git-client.js";
+export class RepositoryAccessError extends Error {
+    code;
+    constructor(code) {
+        super(code === "REPOSITORY_ACCESS_DENIED" ? "Git could not read the registered repository without a credential prompt" : "Git could not reach the registered repository");
+        this.code = code;
+    }
+}
+// No credential (GIT_TERMINAL_PROMPT=0 refused to ask), a refused one, or an account without access to the repository.
+const DENIED = [
+    /terminal prompts disabled/i, /could not read (?:username|password)/i, /authentication failed/i, /invalid credentials/i,
+    /permission denied \(publickey/i, /host key verification failed/i, /returned error: 40[13]\b/i,
+    /you may not have access to this repository/i, /repository '[^'\n]*' not found/i, /repository not found/i,
+];
+// Name resolution, routing or a connection that never completed; ssh and https word these differently.
+const UNREACHABLE = [
+    /could not resolve host/i, /failed to connect to/i, /couldn't connect to server/i, /connection timed out/i,
+    /operation timed out/i, /connection refused/i, /network is unreachable/i,
+];
+/** The access code a failed Git command's stderr shows, or undefined for any other failure. */
+export function repositoryAccessFailure(error) {
+    const stderr = typeof error === "object" && error !== null ? error.stderr : undefined;
+    if (typeof stderr !== "string" || stderr === "")
+        return undefined;
+    if (DENIED.some(pattern => pattern.test(stderr)))
+        return "REPOSITORY_ACCESS_DENIED";
+    if (UNREACHABLE.some(pattern => pattern.test(stderr)))
+        return "REPOSITORY_UNREACHABLE";
+    return undefined;
+}
+/**
+ * `git ls-remote <url> HEAD` with the environment a job's clone uses, so a missing credential shows before a job runs.
+ * It runs in its own session, so neither Git nor ssh can open the terminal to ask, and the whole group ends at the
+ * deadline. It reads refs only and writes nothing.
+ */
+export function probeRepositoryAccess(providerUrl, options = {}) {
+    return new Promise(resolve => {
+        // "--" keeps a URL from ever reading as an option such as --upload-pack.
+        const child = spawn("git", ["ls-remote", "--exit-code", "--", providerUrl, "HEAD"], { detached: true, stdio: ["ignore", "ignore", "pipe"], env: gitEnvironment() });
+        let stderr = "", settled = false;
+        const finish = (result) => { if (settled)
+            return; settled = true; clearTimeout(deadline); resolve(result); };
+        const deadline = setTimeout(() => {
+            try {
+                process.kill(-child.pid, "SIGKILL");
+            }
+            catch { /* The group already ended. */ }
+            finish({ status: "unreachable", code: "REPOSITORY_UNREACHABLE" });
+        }, options.timeoutMs ?? 30_000);
+        child.stderr.setEncoding("utf8").on("data", (chunk) => { if (stderr.length < 64 * 1024)
+            stderr += chunk; });
+        child.on("error", () => finish({ status: "failed" }));
+        child.on("close", code => {
+            // Exit 2 is --exit-code's "no HEAD": the credential worked.
+            if (code === 0 || code === 2)
+                return finish({ status: "readable" });
+            const access = repositoryAccessFailure({ stderr });
+            finish(access === "REPOSITORY_ACCESS_DENIED" ? { status: "denied", code: access } : access === "REPOSITORY_UNREACHABLE" ? { status: "unreachable", code: access } : { status: "failed" });
+        });
+    });
+}
+const KEY = /^[a-z0-9][a-z0-9._-]{0,99}$/;
+// The Gateway's registered clone URLs: https, no account in the URL, nothing a shell or Git option parser could read.
+const URL_PATTERN = /^https:\/\/[A-Za-z0-9.-]+\/[A-Za-z0-9._\/-]+$/;
+/** The Gateway's list of Fix repositories from local_agent_runner_status, or undefined when this Gateway has none. */
+export function fixRepositoryList(runner) {
+    const list = typeof runner === "object" && runner !== null ? runner.fix_repositories : undefined;
+    if (!Array.isArray(list))
+        return undefined;
+    return list.slice(0, 100).filter((entry) => typeof entry === "object" && entry !== null
+        && typeof entry.repository_key === "string" && KEY.test(entry.repository_key)
+        && typeof entry.provider_url === "string" && URL_PATTERN.test(entry.provider_url))
+        .map(entry => ({ repository_key: entry.repository_key, provider_url: entry.provider_url }));
+}
+/** Probe each asked repository the Gateway lists, at most four at a time, and say what to do about each failure. */
+export async function checkRepositoryAccess(keys, listed, probe = probeRepositoryAccess) {
+    const checks = [];
+    for (let start = 0; start < keys.length; start += 4) {
+        checks.push(...await Promise.all(keys.slice(start, start + 4).map(async (key) => {
+            const url = listed.find(entry => entry.repository_key === key)?.provider_url;
+            if (url === undefined)
+                return { repository_key: key, status: "not_registered", action: `${key} has no reviewed Fix profile on the Gateway; check the repository key.` };
+            const result = await probe(url);
+            const check = `git ls-remote ${url} HEAD`;
+            switch (result.status) {
+                case "readable": return { repository_key: key, status: "readable" };
+                case "denied": return { repository_key: key, status: "denied", action: `Set up a Bitbucket login for git on this Mac so that this prints a commit without a prompt: ${check}` };
+                case "unreachable": return { repository_key: key, status: "unreachable", action: `Check the network or VPN, then run: ${check}` };
+                default: return { repository_key: key, status: "failed", action: `Run ${check} to see why git cannot read it.` };
+            }
+        })));
+    }
+    return checks;
+}

package/dist/src/workspace/workspace-manager.js

@@ -5,6 +5,7 @@ import { createHash, randomUUID } from "node:crypto";
 import { resolve, join, sep, dirname } from "node:path";
 import { assertOwnedGitObjectStorage, RegisteredSubmoduleMaterializer } from './registered-submodules.js';
 import { isP1WorkingBranch } from '../publication/git-snapshot.js';
+import { repositoryAccessFailure, RepositoryAccessError } from './repository-access.js';
 export class WorkspaceManager {
     deps;
     submodules;
@@ -84,19 +85,26 @@ export class WorkspaceManager {
             return this.deps.git.run([...(attempt ? ['--no-replace-objects'] : []), ...args]);
         };
         if (await this.exists(mirrorPath)) {
-            const remote = (await managedGit(["--git-dir", mirrorPath, "remote", "get-url", "origin"])).stdout.trim();
+            // The stored URL, not `remote get-url`: that expands the employee's url.<x>.insteadOf, so a Mac that reaches the
+            // registered https URL over SSH would fail every job after its first clone (Work Decision 2ae1acc1).
+            const remote = (await managedGit(["--git-dir", mirrorPath, "config", "--get", "remote.origin.url"])).stdout.trim();
             if (remote !== input.providerUrl)
                 throw new Error("Managed repository remote does not match the registered provider");
         }
         else {
-            await managedGit(["clone", "--mirror", input.providerUrl, mirrorPath]);
+            try {
+                await managedGit(["clone", "--mirror", input.providerUrl, mirrorPath]);
+            }
+            catch (error) {
+                throw this.accessError(error) ?? error;
+            }
         }
         try {
             await managedGit(["--git-dir", mirrorPath, "fetch", "--prune", "origin", input.baseCommitSha]);
             await managedGit(["--git-dir", mirrorPath, "cat-file", "-e", `${input.baseCommitSha}^{commit}`]);
         }
-        catch {
-            throw new Error(`Repository revision ${input.baseCommitSha} is unavailable`);
+        catch (error) {
+            throw this.accessError(error) ?? new Error(`Repository revision ${input.baseCommitSha} is unavailable`);
         }
         if (!await this.exists(workspacePath)) {
             await managedGit(["--git-dir", mirrorPath, "worktree", "add", "--detach", workspacePath, input.baseCommitSha]);
@@ -190,6 +198,11 @@ export class WorkspaceManager {
             await handle.close();
         }
     }
+    /** A credential or network failure keeps its code (Work Item 6f9e64ae); anything else stays the caller's error. */
+    accessError(error) {
+        const code = repositoryAccessFailure(error);
+        return code === undefined ? undefined : new RepositoryAccessError(code);
+    }
     assertContained(root, candidate) {
         const resolved = resolve(candidate);
         if (resolved !== root && !resolved.startsWith(`${root}${sep}`))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.76",
+  "version": "0.1.77",
   "private": false,
   "license": "UNLICENSED",
   "bin": {