mtech-ai-local-runner 0.1.77 → 0.1.80

package/dist/src/adapters/claude-code/prompt-compiler.js

@@ -1,14 +1,24 @@
 import { renderBundleCorrectionBrief } from '../../verification/continuation-runner-contract.js';
 import { compilePrompt as compileBrief } from "../prompt-compiler.js";
 import { LOCAL_TOOL_GUIDANCE, repositoryScope } from "../local-tool-prompt.js";
+import { localToolNames } from "../../safety/local-tool-policy.js";
 // Claude's working directory is the job's private control directory, so without these rules it sends that directory's
 // absolute path or shell commands to the ai_local tools (P4 Investigate of Work Item 1c8026f1, 2026-10-28). Without the
 // search and citation rules it searched several words, found nothing and cited lines counted from a whole-file read.
-const CLAUDE_PATH_RULES = "## Local tool path rules\n" +
+// local-tools-v1 has no discovery tool; local-tools-v2 adds local_find (Work Decision f43e7aa0). The v1 text is unchanged.
+const CLAUDE_PATH_DISCOVERY = Object.freeze({
+    "local-tools-v1": "local_search searches only inside that one file; there is no directory listing or repository-wide search, so take " +
+        "file paths from the objective and from files you have read. ",
+    "local-tools-v2": "local_search searches only inside that one file. To find a file, use local_find with name for a literal part of " +
+        "its path, such as MigrateChannelLedgerCommand, or text for a literal it contains, such as migrate:channel-ledger, then " +
+        "local_search and local_read on the file found. local_find's path is an optional directory inside the approved scope, not a " +
+        "file; it skips vendor/ and node_modules/ unless that directory is inside them, and truncated: true means it stopped at a " +
+        "bound, so narrow path, name or text. "
+});
+const claudePathRules = (inventory) => "## Local tool path rules\n" +
     "Every path argument is one checkout-relative file path inside the approved scope, without a leading slash: write " +
     "/Modules/Example.php as Modules/Example.php. Never pass your working directory or any absolute path. " +
-    "local_search searches only inside that one file; there is no directory listing or repository-wide search, so take " +
-    "file paths from the objective and from files you have read. local_search returns the lines that contain the query " +
+    CLAUDE_PATH_DISCOVERY[inventory] + "local_search returns the lines that contain the query " +
     "exactly, case-sensitive, each with its line number, so search for one identifier or literal, such as assertBranchHead, " +
     "not several words. Cite a line number only from a local_search match or a local_read with start_line and end_line, and " +
     "never count lines in a whole-file read. local_test runs only a registered command ID, never a " +
@@ -16,7 +26,10 @@ const CLAUDE_PATH_RULES = "## Local tool path rules\n" +
     "DENIED_FILE for a directory, DENIED_SCOPE for a path outside the approved scope or DENIED_COMMAND for an unregistered " +
     "command: send a corrected call instead of concluding that source is unavailable. LOCAL_TOOL_FAILED means the call " +
     "failed for another reason, such as a file that does not exist.";
+/** `toolInventory` is the job's host-picked inventory (absent: local-tools-v1); only the path rules depend on it. */
 export function compilePrompt(taskPackage, options) {
+    const { toolInventory = "local-tools-v1", ...brief } = options;
+    localToolNames(toolInventory);
     const correction = renderBundleCorrectionBrief(taskPackage);
-    return `${compileBrief(taskPackage, options)}\n\n${repositoryScope(taskPackage)}\n\n${LOCAL_TOOL_GUIDANCE}\n\n${CLAUDE_PATH_RULES}${correction}`;
+    return `${compileBrief(taskPackage, brief)}\n\n${repositoryScope(taskPackage)}\n\n${LOCAL_TOOL_GUIDANCE}\n\n${claudePathRules(toolInventory)}${correction}`;
 }

package/dist/src/adapters/claude-code/runtime-options.js

@@ -9,6 +9,7 @@ import { NodeProcessGroupHost } from '../../process/node-process-group-host.js';
 import { JobToolSession } from '../../safety/job-tool-session.js';
 import { jobToolPolicyOptions } from '../../safety/job-tool-policy.js';
 import { requireJobSecurity } from '../../safety/job-security-policy.js';
+import { claudeJobToolInventory } from './adapter.js';
 const inside = (root, file) => file === root || file.startsWith(root + path.sep);
 /** Resolve the existing prefix without creating a path through an account alias. */
 async function canonicalFuture(file) {
@@ -98,7 +99,9 @@ export function createClaudeCodeAdapterOptions(input) {
         createTools: async (ctx, pkg, approved) => {
             if (disposed)
                 throw Error('JOB_SECURITY_SESSION_REJECTED');
-            const policyOptions = jobToolPolicyOptions(checkout, pkg, approved, input.securityHost ? security.commands() : input.commandRegistry ?? [], { runtimeAdapter: 'claude_code_cli', runtimeAdapterVersion: '1' });
+            // The job's tool inventory is the one its security pin names; tools made before any pin serve local-tools-v1.
+            const inventory = securityPolicy ? claudeJobToolInventory(securityPolicy) : 'local-tools-v1';
+            const policyOptions = { ...jobToolPolicyOptions(checkout, pkg, approved, input.securityHost ? security.commands() : input.commandRegistry ?? [], { runtimeAdapter: 'claude_code_cli', runtimeAdapterVersion: '1' }), inventory };
             const canonicalAccount = account ? await canonicalFuture(account) : undefined;
             assertOutsideAccount(await canonicalFuture(state), await canonicalFuture(checkout), canonicalAccount);
             assertOutsideAccount(await canonicalFuture(control), await canonicalFuture(checkout), canonicalAccount);

package/dist/src/adapters/codex/config-builder.js

@@ -1,6 +1,7 @@
 import { isAbsolute } from "node:path";
 import { CODEX_ISOLATION_EXEC_FLAGS, CODEX_ISOLATION_CONFIG_OVERRIDES, CODEX_JOB_MCP_OMIT_SURFACES } from "./compatibility.js";
 import { codexControlDenials } from './scratch.js';
+import { localToolNames } from "../../safety/local-tool-policy.js";
 /** Candidate invocation; execution still requires independent compatibility admission. */
 export function buildCodexInvocation(input) {
     if (!input.modelId.trim() || /[\r\n\0]/.test(input.modelId)
@@ -22,7 +23,7 @@ export function buildCodexInvocation(input) {
         `permissions.local_job.filesystem={":minimal"="read",${deniedFiles}}`,
         "permissions.local_job.network.enabled=false",
         // Only this job server is preauthorized: every operation is checked by Runner policy.
-        `mcp_servers={ai_local={url=${JSON.stringify(endpoint.toString())},bearer_token_env_var="AI_GATEWAY_JOB_MCP_TOKEN",required=true,default_tools_approval_mode="approve",enabled_tools=["local_read","local_search","local_edit","local_replace","local_test"],omit_tools_from=${JSON.stringify(CODEX_JOB_MCP_OMIT_SURFACES)}}}`,
+        `mcp_servers={ai_local={url=${JSON.stringify(endpoint.toString())},bearer_token_env_var="AI_GATEWAY_JOB_MCP_TOKEN",required=true,default_tools_approval_mode="approve",enabled_tools=${JSON.stringify(localToolNames(input.toolInventory))},omit_tools_from=${JSON.stringify(CODEX_JOB_MCP_OMIT_SURFACES)}}}`,
     ];
     const env = { HOME: input.env.HOME, AI_GATEWAY_JOB_MCP_TOKEN: input.endpoint.token };
     for (const key of ["PATH", "USER", "LOGNAME", "LANG", "LC_ALL", "TMPDIR", "CODEX_HOME"]) {

package/dist/src/adapters/codex/exec-invocation.js

@@ -5,6 +5,7 @@ import { CODEX_GLOBAL_INSTRUCTION_WRAPPER, globalInstructionProfile } from './gl
 import { randomBytes } from 'node:crypto';
 import { buildCodexInvocation } from './config-builder.js';
 import { securityRequirementsFingerprint as hash } from '../../safety/security-requirements.js';
+import { localToolInventoryFor } from '../../safety/local-tool-server.js';
 export const EXEC_TRANSPORT = 'official_exec_v1';
 export const EXEC_RELEASE_MODE = 'supported_cli_exec_release_policy_v2';
 export const EXEC_MODE = 'supported_cli_exec_policy_v1';
@@ -39,7 +40,11 @@ export function buildOfficialExecPlan(input) {
         const cwd = path.resolve(inv.worktreeRoot), source = path.resolve(inv.sourceRoot);
         if (cwd === source || cwd.startsWith(source + path.sep) || source.startsWith(cwd + path.sep))
             throw fail();
-        const generated = buildCodexInvocation(inv), accountRoot = path.resolve(inv.env.CODEX_HOME ?? path.join(inv.env.HOME, '.codex'));
+        // The CLI enables exactly the tools of the inventory the identity's tool fingerprint names (Work Decision f43e7aa0).
+        const toolInventory = localToolInventoryFor(i.toolSchemaFingerprint, hash);
+        if (!toolInventory)
+            throw fail();
+        const generated = buildCodexInvocation({ ...inv, toolInventory }), accountRoot = path.resolve(inv.env.CODEX_HOME ?? path.join(inv.env.HOME, '.codex'));
         // Preserve the original backend explicitly; this is not proof of credentials.
         generated.args.splice(generated.args.indexOf('--model'), 0, '-c', `cli_auth_credentials_store=${JSON.stringify(input.credentialBackend)}`);
         const actual = isReleaseExecMode(input.policyMode) ? { binary: CODEX_GLOBAL_INSTRUCTION_WRAPPER, args: ['-p', globalInstructionProfile(accountRoot), input.binary, ...generated.args], env: generated.env } : { binary: input.binary, ...generated };

package/dist/src/adapters/codex/exec-preflight.js

@@ -1,6 +1,7 @@
 import { isDeepStrictEqual } from 'node:util';
 import { SUPPORTED_CLI_GATES } from '../../safety/cli-security-modes.js';
-import { localToolInventory } from '../../safety/local-tool-server.js';
+import { localToolInventory, localToolInventoryFor } from '../../safety/local-tool-server.js';
+import { securityRequirementsFingerprint } from '../../safety/security-requirements.js';
 import { EXEC_TRANSPORT, requireOfficialExecPlan } from './exec-invocation.js';
 export const EXEC_GATES = Object.freeze([...SUPPORTED_CLI_GATES, 'effective_policy_observation', 'managed_policy_observation', 'required_mcp_inference_barrier']);
 const object = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
@@ -36,6 +37,7 @@ export function assessExecPreflight(value, plan) {
     return { ready: reasonCodes.length === 0, reasonCodes };
 }
 export function requireExecHandshake(h, process, plan) {
-    if (!object(h) || h.process !== process || h.executionNonce !== plan.executionNonce || h.endpoint !== plan.endpoint || h.authenticated !== true || h.ready !== true || h.toolSchemaFingerprint !== plan.identity.toolSchemaFingerprint || !isDeepStrictEqual(h.tools, localToolInventory().map(t => t.name)) || typeof h.isCurrent !== 'function' || h.isCurrent() !== true)
+    const inventory = localToolInventoryFor(plan.identity.toolSchemaFingerprint, securityRequirementsFingerprint);
+    if (!inventory || !object(h) || h.process !== process || h.executionNonce !== plan.executionNonce || h.endpoint !== plan.endpoint || h.authenticated !== true || h.ready !== true || h.toolSchemaFingerprint !== plan.identity.toolSchemaFingerprint || !isDeepStrictEqual(h.tools, localToolInventory(inventory).map(t => t.name)) || typeof h.isCurrent !== 'function' || h.isCurrent() !== true)
         throw Error('CODEX_EXEC_MCP_REJECTED');
 }

package/dist/src/adapters/codex/exec-runtime-options.js

@@ -92,14 +92,14 @@ export function buildCodexExecJobOptions(input) {
                     throw reject();
                 const approved = ctx.approvedTaskPackage, requirements = approved.security_requirements;
                 stage = 'codex_tool_policy';
-                policy = new LocalToolPolicy(jobToolPolicyOptions(source, ctx.taskPackage, approved, admitted.release.commands, { runtimeAdapter: 'codex_cli', runtimeAdapterVersion: '1' }));
+                policy = new LocalToolPolicy({ ...jobToolPolicyOptions(source, ctx.taskPackage, approved, admitted.release.commands, { runtimeAdapter: 'codex_cli', runtimeAdapterVersion: '1' }), inventory: admitted.tools });
                 stage = 'codex_tool_server';
-                server = new LocalToolServer({ policy, authorizeCall: () => gate?.allowsCall() === true, onDiscovery: (event, scope) => gate?.discovery(event, scope) });
+                server = new LocalToolServer({ policy, inventory: admitted.tools, authorizeCall: () => gate?.allowsCall() === true, onDiscovery: (event, scope) => gate?.discovery(event, scope) });
                 const endpoint = await server.start();
                 if (closed || signal.aborted)
                     throw reject();
                 stage = 'codex_invocation';
-                const plan = buildOfficialExecPlan({ executionAttempt: ctx.executionAttempt, executionAttemptFingerprint: ctx.executionAttemptFingerprint, ...(ctx.executionAttempt ? { executionBindingId: ctx.bindingId } : {}), policyMode: admitted.release.securityMode, binary: admitted.binary, credentialBackend: admitted.release.credentialBackend, identity: { jobId: input.jobId, generation: ctx.generation, actorId: admitted.actorId, runnerId: admitted.runnerId, sourceSha: String(approved.repository.base_commit_sha), binarySha256: admitted.release.binarySha256, releaseManifestFingerprint: String(requirements.release_manifest_sha256), requirementsFingerprint: String(requirements.fingerprint), contractFingerprint: ctx.securityBinding.contractFingerprint, taskPackageFingerprint: ctx.securityBinding.taskPackageFingerprint, launchFingerprint: ctx.securityBinding.launchFingerprint, commandsFingerprint: commandRegistryFingerprint(admitted.release.commands), toolSchemaFingerprint: fingerprint({ tools: localToolInventory() }), barrierFingerprint: admitted.release.fixturesFingerprint }, invocation: { modelId: ctx.resolvedModelId, worktreeRoot: cwd, sourceRoot: source, schemaPath: schema, endpoint, env, scratch } });
+                const plan = buildOfficialExecPlan({ executionAttempt: ctx.executionAttempt, executionAttemptFingerprint: ctx.executionAttemptFingerprint, ...(ctx.executionAttempt ? { executionBindingId: ctx.bindingId } : {}), policyMode: admitted.release.securityMode, binary: admitted.binary, credentialBackend: admitted.release.credentialBackend, identity: { jobId: input.jobId, generation: ctx.generation, actorId: admitted.actorId, runnerId: admitted.runnerId, sourceSha: String(approved.repository.base_commit_sha), binarySha256: admitted.release.binarySha256, releaseManifestFingerprint: String(requirements.release_manifest_sha256), requirementsFingerprint: String(requirements.fingerprint), contractFingerprint: ctx.securityBinding.contractFingerprint, taskPackageFingerprint: ctx.securityBinding.taskPackageFingerprint, launchFingerprint: ctx.securityBinding.launchFingerprint, commandsFingerprint: commandRegistryFingerprint(admitted.release.commands), toolSchemaFingerprint: fingerprint({ tools: localToolInventory(admitted.tools) }), barrierFingerprint: admitted.release.fixturesFingerprint }, invocation: { modelId: ctx.resolvedModelId, worktreeRoot: cwd, sourceRoot: source, schemaPath: schema, endpoint, env, scratch } });
                 gate = new ExecToolGate(plan);
                 const host = new CodexExecLaunchHost(plan, { processHost, inspectRelease: p => job.inspect(p), execTools: gate, revokeTools: () => { gate?.revoke(); server?.revoke(); policy?.revoke(); job?.revoke(); }, closeTools: dispose });
                 launchHost = host;

package/dist/src/adapters/codex/exec-tool-gate.js

@@ -1,5 +1,5 @@
 import { isReleaseExecMode, requireOfficialExecPlan } from './exec-invocation.js';
-import { localDiscoveryScopeMatches, localToolInventory } from '../../safety/local-tool-server.js';
+import { localDiscoveryScopeMatches, localToolInventory, localToolInventoryFor } from '../../safety/local-tool-server.js';
 import { securityRequirementsFingerprint as hash } from '../../safety/security-requirements.js';
 import { executionError } from '../../safety/execution-failure.js';
 const denied = () => Error('EXEC_TOOL_GATE_REJECTED');
@@ -15,11 +15,15 @@ export class ExecToolGate {
     stage = 0;
     settle;
     reject;
+    tools;
+    /** The plan's tool fingerprint must name one inventory of this Runner (Work Decision f43e7aa0); the handshake reports its tools. */
     constructor(plan) {
         this.plan = plan;
         requireOfficialExecPlan(plan);
-        if (!isReleaseExecMode(plan.mode) || plan.identity.toolSchemaFingerprint !== hash({ tools: localToolInventory() }))
+        const inventory = localToolInventoryFor(plan.identity.toolSchemaFingerprint, hash);
+        if (!isReleaseExecMode(plan.mode) || !inventory)
             throw denied();
+        this.tools = localToolInventory(inventory).map(t => t.name);
     }
     matches(plan) { return this.plan === plan && !this.process && !this.revoked; }
     bind(process, current) { if (this.process || this.revoked)
@@ -75,7 +79,7 @@ export class ExecToolGate {
             });
         if (!this.active() || signal.aborted || this.stage !== 3)
             throw this.readinessError();
-        return { process, executionNonce: this.plan.executionNonce, endpoint: this.plan.endpoint, authenticated: true, ready: true, toolSchemaFingerprint: this.plan.identity.toolSchemaFingerprint, tools: localToolInventory().map(t => t.name), isCurrent: () => this.active() && this.stage === 3 };
+        return { process, executionNonce: this.plan.executionNonce, endpoint: this.plan.endpoint, authenticated: true, ready: true, toolSchemaFingerprint: this.plan.identity.toolSchemaFingerprint, tools: [...this.tools], isCurrent: () => this.active() && this.stage === 3 };
     }
     authorize(process) { if (process !== this.process || !this.active() || this.stage !== 3)
         throw denied(); this.authorized = true; }

package/dist/src/adapters/codex/native-policy.js

@@ -103,7 +103,7 @@ export function validateNativeConfig(value, requirements, pin) {
     if (server.url !== pin.endpoint || server.bearer_token_env_var !== 'AI_GATEWAY_JOB_MCP_TOKEN'
         || server.required !== true || server.enabled !== true || server.default_tools_approval_mode !== 'approve'
         || canonical(server.omit_tools_from) !== canonical(CODEX_JOB_MCP_OMIT_SURFACES)
-        || canonical([...(server.enabled_tools ?? [])].sort()) !== canonical(localToolInventory().map(t => t.name).sort()))
+        || canonical([...(server.enabled_tools ?? [])].sort()) !== canonical(localToolInventory(pin.toolInventory).map(t => t.name).sort()))
         reject();
     for (const k of Object.keys(server))
         if (!['url', 'bearer_token_env_var', 'environment_id', 'enabled', 'required', 'tool_timeout_sec', 'default_tools_approval_mode', 'enabled_tools', 'omit_tools_from'].includes(k))
@@ -119,7 +119,7 @@ export function validateNativeTools(value, pin) {
         || server.httpOrigin !== new URL(pin.endpoint).origin || server.pluginId !== null || server.toolsError !== null
         || canonical(server.resources) !== '[]' || canonical(server.resourceTemplates) !== '[]')
         reject();
-    const tools = record(server.tools), expected = localToolInventory();
+    const tools = record(server.tools), expected = localToolInventory(pin.toolInventory);
     if (Object.keys(tools).length !== expected.length)
         reject();
     for (const tool of expected)

package/dist/src/adapters/codex/native-session.js

@@ -126,7 +126,7 @@ export class CodexNativeSession {
             // Matching snapshots cannot certify policy immutability through turn/start.
             this.snapshot = { model: this.pin.model, provider: 'openai', cwd: this.pin.cwd, approvalPolicy: 'never', permissionProfile: 'local_job',
                 configFingerprint: after, nativeToolsIsolated: false, policyStable: false, rpcBoundary: 'owned_exact_rpc_v1', environments: [], warnings: [], servers: [{ name: 'ai_local', endpoint: this.pin.endpoint, status: 'ready', authenticated: true,
-                        tools: localToolInventory().map(t => t.name), toolSchemaFingerprint: tools }] };
+                        tools: localToolInventory(this.pin.toolInventory).map(t => t.name), toolSchemaFingerprint: tools }] };
             return structuredClone(this.snapshot);
         }
         catch {
@@ -277,7 +277,8 @@ export function buildNativeInvocation(invocation, options) {
     }
     const pin = { ...(options.sourceRoot !== undefined ? { sourceRoot: options.sourceRoot } : {}), model, provider: options.testTransport ? 'offline_fixture' : 'openai', cwd: options.cwd, home: options.home, schemaPath: options.schemaPath, endpoint,
         ...(env.CODEX_HOME ? { codexHome: env.CODEX_HOME } : {}), ...(options.scratch ? { scratch: { ...options.scratch } } : {}),
-        loginMethod: options.testTransport?.loginMethod ?? 'chatgpt', providerConfig: options.testTransport?.providerConfig ?? {} };
+        loginMethod: options.testTransport?.loginMethod ?? 'chatgpt', providerConfig: options.testTransport?.providerConfig ?? {},
+        ...(options.toolInventory ? { toolInventory: options.toolInventory } : {}) };
     return { args, env, pin };
 }
 export async function startNativeCodexSession(options, invocation, prompt, signal, assertAdmission = () => { }) {
@@ -324,7 +325,7 @@ export async function startNativeCodexSession(options, invocation, prompt, signa
         const stopped = new Promise((_, reject) => { rejectStopped = reject; timer = setTimeout(aborted, Math.max(1, preparationDeadline - Date.now())); });
         // Preparation deadline only; no deadline on a retained, admitted model turn.
         const observed = await Promise.race([session.inspect(), stopped]);
-        const expected = { model: native.pin.model, provider: 'openai', cwd: options.cwd, endpoint: native.pin.endpoint, configFingerprint: observed.configFingerprint, toolSchemaFingerprint: fingerprint(localToolInventory()) };
+        const expected = { model: native.pin.model, provider: 'openai', cwd: options.cwd, endpoint: native.pin.endpoint, configFingerprint: observed.configFingerprint, toolSchemaFingerprint: fingerprint(localToolInventory(native.pin.toolInventory)) };
         inspectedExpectation = Object.freeze({ ...expected });
         if (options.prepareSupportedAdmission || options.prepareProductionAdmission) {
             const preparation = (options.prepareProductionAdmission ? options.prepareProductionAdmission(session.proof()) : options.prepareSupportedAdmission(inspectedExpectation)).then(context => {
@@ -341,7 +342,7 @@ export async function startNativeCodexSession(options, invocation, prompt, signa
             clearTimeout(timer);
         rejectStopped = undefined;
         return await startCodexAfterPreflight(session, { model: native.pin.model, provider: 'openai', cwd: options.cwd, endpoint: native.pin.endpoint,
-            configFingerprint: observed.configFingerprint, toolSchemaFingerprint: fingerprint(localToolInventory()) }, prompt, signal, options.onAssessment, supported);
+            configFingerprint: observed.configFingerprint, toolSchemaFingerprint: fingerprint(localToolInventory(native.pin.toolInventory)) }, prompt, signal, options.onAssessment, supported);
     }
     catch {
         supported?.policy.revoke();

package/dist/src/adapters/codex/pre-model-gate.js

@@ -1,8 +1,10 @@
 import { isAbsolute } from 'node:path';
 import { requireSupportedCodexPolicy } from './supported-admission.js';
+import { localToolInventoryFor } from '../../safety/local-tool-server.js';
+import { localToolNames } from '../../safety/local-tool-policy.js';
+import { fingerprint } from './native-policy.js';
 const REJECTED = 'CODEX_PRE_MODEL_REJECTED';
 const usedSessions = new WeakSet();
-const REQUIRED_TOOLS = ['local_edit', 'local_read', 'local_replace', 'local_search', 'local_test'];
 const object = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
 /** Bounded, value-free diagnostics for ALL candidate prerequisites. This is not
  * native release certification: only trusted retained observations may reach it,
@@ -54,8 +56,11 @@ export function assessCodexPreModel(actual, expected, supported) {
         require(server.authenticated === true, 'MCP_AUTHENTICATION_UNVERIFIED');
         require(server.status === 'ready', 'MCP_NOT_READY');
         require(server.toolSchemaFingerprint === expected.toolSchemaFingerprint, 'MCP_SCHEMA_MISMATCH');
-        require(Array.isArray(server.tools) && server.tools.every(tool => typeof tool === 'string')
-            && JSON.stringify([...server.tools].sort()) === JSON.stringify(REQUIRED_TOOLS), 'MCP_TOOLS_MISMATCH');
+        // Exactly the tools of the inventory the expected fingerprint names (Work Decision f43e7aa0), never the other one.
+        // The native session fingerprints the bare tool array (validateNativeTools), not the descriptor's {tools} form.
+        const inventory = localToolInventoryFor(expected.toolSchemaFingerprint, value => fingerprint(value.tools));
+        require(inventory !== undefined && Array.isArray(server.tools) && server.tools.every(tool => typeof tool === 'string')
+            && JSON.stringify([...server.tools].sort()) === JSON.stringify([...localToolNames(inventory)].sort()), 'MCP_TOOLS_MISMATCH');
     }
     return { ready: reasonCodes.length === 0, reasonCodes };
 }

package/dist/src/asks/claude-mod.js

@@ -0,0 +1,163 @@
+import { execFile } from "node:child_process";
+import { constants } from "node:fs";
+import { access, cp, mkdir, readdir, rm, stat } from "node:fs/promises";
+import { basename, delimiter, isAbsolute, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { packageVersion } from "../package-version.js";
+/*
+ * The Work Room pane mod (Work Item 98da2635), shipped in this package under claude-mod/ and installed through the
+ * Claude CLI as a local marketplace, the way Plan A proved on 2026-10-30: `plugin marketplace add <folder>` and
+ * `plugin install <mod>@<marketplace> --scope user`, both without a prompt. Claude reads the mod from that folder, so
+ * it lives under <stateRoot>/claude-mod/<runner version>/ and an older folder is removed only after a newer install.
+ *
+ * Only a CLI that loads `modules` hooks can install it. On 2026-10-30 the terminal `claude` 2.1.212 could not, and the
+ * desktop-bundled 2.1.299 and 2.1.308 could; the desktop app bundles one even when the terminal `claude` is older.
+ * A mod the person disabled stays disabled: setup reinstalls only a missing or older one.
+ */
+export const CLAUDE_MOD_NAME = "ai-gateway-work-room";
+export const CLAUDE_MOD_MARKETPLACE = "mtec-ai-gateway";
+const ID = `${CLAUDE_MOD_NAME}@${CLAUDE_MOD_MARKETPLACE}`;
+const MIN_VERSION = [2, 1, 299];
+const NO_CLI = "no Claude CLI 2.1.299 or newer (run claude update or install the Claude desktop app)";
+const BUNDLED = ["Library", "Application Support", "Claude", "claude-code"];
+const RUN_TIMEOUT_MS = 60_000;
+function parseVersion(text) {
+    const match = /(\d+)\.(\d+)\.(\d+)/.exec(text);
+    return match ? [Number(match[1]), Number(match[2]), Number(match[3])] : null;
+}
+const compare = (a, b) => a[0] - b[0] || a[1] - b[1] || a[2] - b[2];
+async function isExecutable(file) {
+    try {
+        await access(file, constants.X_OK);
+        return (await stat(file)).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+/** `claude` on PATH when it is new enough, else the newest desktop-bundled CLI that is; null when none is. */
+export async function findClaudeCli(deps) {
+    const versionOf = async (file) => {
+        const out = await deps.run(file, ["--version"]);
+        const version = out.code === 0 ? parseVersion(out.stdout) : null;
+        return version && compare(version, MIN_VERSION) >= 0 ? version : null;
+    };
+    // The first executable `claude` on PATH is the one the person's shell runs; a later one is not looked at.
+    for (const dir of (deps.path ?? "").split(delimiter).filter(part => isAbsolute(part))) {
+        const file = join(dir, "claude");
+        if (!await isExecutable(file))
+            continue;
+        if (await versionOf(file))
+            return file;
+        break;
+    }
+    const root = join(deps.home, ...BUNDLED);
+    let best = null;
+    for (const release of await readdir(root).catch(() => [])) {
+        for (const build of await readdir(join(root, release)).catch(() => [])) {
+            const file = join(root, release, build, "claude.app", "Contents", "MacOS", "claude");
+            if (!await isExecutable(file))
+                continue;
+            const version = await versionOf(file);
+            if (version && (best === null || compare(version, best.version) > 0))
+                best = { file, version };
+        }
+    }
+    return best?.file ?? null;
+}
+/** This runner's mod as `plugin list --json` reports it, or null when it is not listed. */
+async function listed(deps, cli) {
+    const out = await deps.run(cli, ["plugin", "list", "--json"]);
+    if (out.code !== 0)
+        return null;
+    try {
+        const rows = JSON.parse(out.stdout);
+        const row = Array.isArray(rows) ? rows.find(entry => entry.id === ID) : undefined;
+        if (!row)
+            return null;
+        return { enabled: row.enabled === true, ...(typeof row.readFromFolder === "string" ? { folder: row.readFromFolder } : {}) };
+    }
+    catch {
+        return null;
+    }
+}
+// The mod's own tests and the types the engine lays while developing are not part of what Claude loads.
+const shipped = (source) => !/\.test\.tsx?$/.test(source) && !(basename(source) === "types" && source.includes(".claude-plugin"));
+/** Installs the mod for the person, or leaves it as it is when this release's copy is installed or the person disabled it. Never throws. */
+export async function installClaudeMod(deps) {
+    const cli = await findClaudeCli(deps);
+    if (cli === null)
+        return { state: "skipped", reason: NO_CLI };
+    const base = join(deps.stateRoot, "claude-mod");
+    const dir = join(base, deps.version);
+    try {
+        const current = await listed(deps, cli);
+        if (current && !current.enabled)
+            return { state: "disabled", cli };
+        const copied = await stat(join(dir, "hooks", "hooks.json")).then(entry => entry.isFile(), () => false);
+        if (current?.folder === dir && copied)
+            return { state: "installed", cli };
+        await rm(dir, { recursive: true, force: true });
+        await mkdir(base, { recursive: true });
+        await cp(deps.sourceDir, dir, { recursive: true, filter: shipped });
+        // Both fail harmlessly when nothing is installed yet.
+        await deps.run(cli, ["plugin", "uninstall", ID, "--scope", "user"]);
+        await deps.run(cli, ["plugin", "marketplace", "remove", CLAUDE_MOD_MARKETPLACE]);
+        if ((await deps.run(cli, ["plugin", "marketplace", "add", dir])).code !== 0)
+            return { state: "failed", cli, reason: "plugin marketplace add failed" };
+        if ((await deps.run(cli, ["plugin", "install", ID, "--scope", "user", "--json"])).code !== 0)
+            return { state: "failed", cli, reason: "plugin install failed" };
+        for (const old of await readdir(base))
+            if (old !== deps.version)
+                await rm(join(base, old), { recursive: true, force: true });
+        return { state: "installed", cli };
+    }
+    catch (error) {
+        return { state: "failed", cli, reason: error.code ?? "install failed" };
+    }
+}
+/** Uninstalls the mod and its marketplace, then deletes the runner's copies. Never throws. */
+export async function removeClaudeMod(deps) {
+    const cli = await findClaudeCli(deps);
+    if (cli !== null) {
+        await deps.run(cli, ["plugin", "uninstall", ID, "--scope", "user"]);
+        await deps.run(cli, ["plugin", "marketplace", "remove", CLAUDE_MOD_MARKETPLACE]);
+    }
+    await rm(join(deps.stateRoot, "claude-mod"), { recursive: true, force: true }).catch(() => undefined);
+    return { state: "removed", ...(cli ? { cli } : {}) };
+}
+/** What `plugin list` says of the mod. Never throws. */
+export async function claudeModStatus(deps) {
+    const cli = await findClaudeCli(deps);
+    if (cli === null)
+        return { state: "skipped", reason: NO_CLI };
+    const current = await listed(deps, cli).catch(() => null);
+    return { state: current === null ? "not_installed" : current.enabled ? "installed" : "disabled", cli };
+}
+/** The package's claude-mod/: two folders up from src/asks/, three from dist/src/asks/. */
+function packagedModDir(moduleUrl = import.meta.url) {
+    return fileURLToPath(new URL(moduleUrl.toString().includes("/dist/src/") ? "../../../claude-mod/" : "../../claude-mod/", moduleUrl));
+}
+/**
+ * The deps setup, integrations and uninstall use. Each CLI call gets a fixed environment, as the Claude login probe
+ * does: the person's HOME, USER and LOGNAME, CLAUDE_CONFIG_DIR only when they set it, and the documented opt-outs
+ * that keep the CLI from updating itself or sending other traffic.
+ */
+export function claudeModDeps(env, stateRoot, home) {
+    const childEnv = { PATH: "/usr/bin:/bin", LANG: "C", LC_ALL: "C", HOME: home,
+        DISABLE_AUTOUPDATER: "1", CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1" };
+    for (const key of ["CLAUDE_CONFIG_DIR", "USER", "LOGNAME"]) {
+        const value = env[key];
+        if (value !== undefined && (key !== "CLAUDE_CONFIG_DIR" || isAbsolute(value)))
+            childEnv[key] = value;
+    }
+    return {
+        home, path: env.PATH, stateRoot, version: packageVersion(), sourceDir: packagedModDir(),
+        run: (file, args) => new Promise(resolve => {
+            execFile(file, args, { encoding: "utf8", timeout: RUN_TIMEOUT_MS, maxBuffer: 1_048_576, env: childEnv }, (error, stdout) => {
+                const code = error ? (typeof error.code === "number" ? error.code : 1) : 0;
+                resolve({ code, stdout: typeof stdout === "string" ? stdout : "" });
+            });
+        }),
+    };
+}

package/dist/src/asks/commands.js

@@ -1,12 +1,13 @@
 import { readdir, rm } from "node:fs/promises";
 import { join } from "node:path";
 import { ASKS_FILE } from "./store.js";
-import { installIntegration, integrationStatus, removeIntegration, removeShimIfUnused } from "./integrations.js";
+import { claudeModDeps, claudeModStatus, installClaudeMod, removeClaudeMod } from "./claude-mod.js";
+import { homeDirectory, installIntegration, integrationStatus, removeIntegration, removeShimIfUnused } from "./integrations.js";
 import { APPS, isApp } from "./types.js";
 import { deleteGuideState } from "../guide/files.js";
 import { guideStatus, installGuide, removeGuide, removeGuideShimIfUnused } from "../guide/integrations.js";
 const NEXT_STEP = {
-    claude: "Start a new Claude Code session, or run /reload-plugins in an open one, to load mtec-ai-gateway-asks@skills-dir.",
+    claude: "Start a new Claude Code session, or run /reload-plugins in an open one, to load mtec-ai-gateway-asks@skills-dir and the Work Room pane (/work-room).",
     // /hooks is a command of the Codex CLI in a terminal only: the Codex app sends it to the model as text.
     codex: "Codex runs the four AI Gateway hooks only after you trust them once. In the Codex app, trust them under Settings → Hooks "
         + "or with the Review hooks button. In the Codex CLI in a terminal, trust them with /hooks. Until then the Slack message covers each ask.",
@@ -79,6 +80,17 @@ export async function statusOf(app, env, stateRoot, error) {
         return { app, state: "unreadable", path: "", error: error ?? errorCode(failure) };
     }
 }
+/** One act on the Work Room mod. It never fails the hooks: a mod that cannot be handled is reported on its own. */
+async function claudeMod(env, stateRoot, act) {
+    try {
+        return await act(claudeModDeps(env, stateRoot, homeDirectory(env)));
+    }
+    catch (error) {
+        return { state: "failed", reason: errorCode(error) };
+    }
+}
+/** The Work Room mod's state, for integrations status and doctor. It runs the Claude CLI, so the daemon never calls it. */
+export const claudeModStatusOf = (env, stateRoot) => claudeMod(env, stateRoot, claudeModStatus);
 async function attempt(app, env, stateRoot, change) {
     try {
         return await change();
@@ -91,10 +103,17 @@ export async function installIntegrations(apps, env, stateRoot) {
     const results = [];
     for (const app of apps) {
         const result = await attempt(app, env, stateRoot, () => installIntegration(app, env, stateRoot));
-        results.push(result.error === undefined ? { ...result, action: NEXT_STEP[app] } : result);
+        const done = result.error === undefined ? { ...result, action: NEXT_STEP[app] } : result;
+        // The hooks first: they work without the mod, and a Claude CLI too old for the mod leaves them in place.
+        results.push(app === "claude" ? { ...done, mod: await claudeMod(env, stateRoot, installClaudeMod) } : done);
     }
     return results;
 }
+/** Removes one app's asks hooks and, for Claude, the Work Room mod. */
+async function removeAsks(app, env, stateRoot) {
+    const result = await attempt(app, env, stateRoot, () => removeIntegration(app, env, stateRoot));
+    return app === "claude" ? { ...result, mod: await claudeMod(env, stateRoot, removeClaudeMod) } : result;
+}
 /** The guide state of one app; a status that cannot be read is reported with its error, never thrown. */
 export async function guideStatusOf(app, env, stateRoot, error) {
     try {
@@ -143,7 +162,7 @@ export async function removeGuideInstall(env, stateRoot) {
 export async function removeAsksInstall(env, stateRoot) {
     const results = [];
     for (const app of APPS)
-        results.push(await attempt(app, env, stateRoot, () => removeIntegration(app, env, stateRoot)));
+        results.push(await removeAsks(app, env, stateRoot));
     // A hook left behind (an unreadable Codex hooks file) keeps its shim, which then prints nothing and exits 0.
     await removeShimIfUnused(env, stateRoot).catch(() => false);
     await rm(join(stateRoot, ASKS_FILE), { force: true });
@@ -167,11 +186,12 @@ export async function runIntegrationsCommand(argv, io) {
         }
         else if (parsed.action === "remove") {
             for (const app of parsed.apps)
-                results.push(await attempt(app, io.env, io.stateRoot, () => removeIntegration(app, io.env, io.stateRoot)));
+                results.push(await removeAsks(app, io.env, io.stateRoot));
             await removeShimIfUnused(io.env, io.stateRoot).catch(() => false);
         }
         else {
-            results = await Promise.all(parsed.apps.map(app => statusOf(app, io.env, io.stateRoot)));
+            results = await Promise.all(parsed.apps.map(async (app) => app === "claude"
+                ? { ...await statusOf(app, io.env, io.stateRoot), mod: await claudeModStatusOf(io.env, io.stateRoot) } : statusOf(app, io.env, io.stateRoot)));
         }
     }
     if (!features.includes("guide")) {

package/dist/src/asks/doctor.js

@@ -1,6 +1,6 @@
 import { execFile } from "node:child_process";
 import { connect } from "node:net";
-import { statusOf } from "./commands.js";
+import { claudeModStatusOf, statusOf } from "./commands.js";
 import { hubSocketPath } from "./hub.js";
 import { MAX_LINE_BYTES, encodeLine } from "./hub-protocol.js";
 import { CLAUDE_PLUGIN_NAME } from "./integrations.js";
@@ -93,8 +93,9 @@ export async function asksDoctorReport(input) {
     const [status, statuses] = await Promise.all([hubStatus(input.stateRoot), Promise.all(APPS.map(app => statusOf(app, input.env, input.stateRoot)))]);
     const integrations = [];
     for (const report of statuses) {
+        const mod = report.app === "claude" ? { mod: await claudeModStatusOf(input.env, input.stateRoot) } : {};
         if (report.state !== "installed") {
-            integrations.push(report);
+            integrations.push({ ...report, ...mod });
             continue;
         }
         if (report.app === "codex") {
@@ -102,7 +103,7 @@ export async function asksDoctorReport(input) {
             continue;
         }
         const loaded = await claudePluginLoaded(input.env, input.run);
-        integrations.push({ ...report, ...(loaded === null ? {} : { loaded }), ...(loaded === false ? { action: CLAUDE_NOT_LOADED } : {}) });
+        integrations.push({ ...report, ...mod, ...(loaded === null ? {} : { loaded }), ...(loaded === false ? { action: CLAUDE_NOT_LOADED } : {}) });
     }
     return { mode: input.mode, hub: status === null ? { status: "not_running" } : { status: "running", ...status }, integrations };
 }

package/dist/src/asks/integrations.js

@@ -30,7 +30,7 @@ const RUNNER_CODEX_COMMAND = /^"[^"]*\/mtec-ai-local-runner\/bin\/gateway-hook"
 export const INTEGRATIONS_FILE = "integrations.json";
 const RECORD_KEYS = { claude: "claude_config_dir", codex: "codex_home" };
 /** The person's home: HOME, else the account's home directory. Never a relative path. */
-function homeDirectory(env) {
+export function homeDirectory(env) {
     let account = "";
     try {
         account = os.homedir();

package/dist/src/cli.js

@@ -38,6 +38,21 @@ import { guideDoctorReport, guideReportShown } from "./guide/doctor.js";
 import { runClaudeReleaseCommand } from "./commands/claude-release.js";
 import { runFixCommand } from "./commands/fix.js";
 import { checkRepositoryAccess, fixRepositoryList } from "./workspace/repository-access.js";
+import { localToolSelfTest } from "./safety/local-tool-self-test.js";
+function localToolsReport(result) {
+    if (result.status === "passed")
+        return { ...result };
+    return { ...result, action: localToolsAction(result) };
+}
+function localToolsAction(result) {
+    const failed = `Local file tools failed on this Mac (${result.tool ?? "setup"}: ${result.detail ?? "unknown"}), so a job here cannot read source.`;
+    // A bare restricted node that also fails cannot start in the sandbox at all. On 2026-10-31 Homebrew's node did this on
+    // an employee Mac: it maps libraries from /opt/homebrew, and the sandbox maps only /usr/lib and /System/Library.
+    if (result.sandbox?.status === "failed") {
+        return `${failed} The Node at ${result.node} cannot start inside the runner's restricted sandbox, which loads libraries only from /usr/lib and /System/Library; a Node built against libraries elsewhere, such as Homebrew's, stops there. Install an official Node.js build from https://nodejs.org, then rerun setup and doctor with its bin directory first on PATH, for example: PATH="<official Node>/bin:$PATH" npx mtech-ai-local-runner@latest setup`;
+    }
+    return `${failed} Send this doctor output to the AI Gateway owner.`;
+}
 function hookAction(result) {
     return result.reason === "invalid_command"
         ? "Run the runner with a Node executable and package path outside the workspace, without quotes, $, backquotes or backslashes, then rerun doctor."
@@ -246,6 +261,15 @@ export async function main(argv, env, io = {}) {
                         stdout(JSON.stringify({ ok: false, configured: false, hook: hookReport(hook), action: hookAction(hook) }));
                         throw new Error(`The PreToolUse hook did not deny the probe call (hook_not_enforcing: ${hook.reason})`);
                     }
+                    // A full runner whose job file tools cannot read here would take jobs and stop executor_blocked on every one
+                    // (Work Item 6f9e64ae), so setup refuses before login, as for the hook.
+                    const tools = await (io.localToolSelfTest ?? localToolSelfTest)(config.workspaceRoot)
+                        .catch(error => ({ status: "failed", detail: error instanceof Error ? error.message : String(error), node: process.execPath }));
+                    if (tools.status !== "passed") {
+                        const report = localToolsReport(tools);
+                        stdout(JSON.stringify({ ok: false, configured: false, local_tools: report, action: report.action }));
+                        throw new Error(`The job file tools failed on this Mac (local_tools_failed: ${tools.tool ?? "setup"}: ${tools.detail ?? "unknown"})`);
+                    }
                 }
                 const loginCode = await handleLogin(config, stdout, stderr, fetchFn, io.browserOpener);
                 if (loginCode !== 0)
@@ -347,6 +371,11 @@ export async function main(argv, env, io = {}) {
                 ]);
                 // A messenger runs no executor, so neither an adapter nor the PreToolUse self-test is required of it.
                 const hookCheck = messenger ? Promise.resolve(null) : hookSelfTest(local.workspaceRoot);
+                // Every file tool call failed in one employee's Fix jobs while a job reports only a policy code
+                // (Work Item 6f9e64ae): run the same tools once here and show the real error on this Mac.
+                const localToolsCheck = messenger ? Promise.resolve(null)
+                    : (io.localToolSelfTest ?? localToolSelfTest)(local.workspaceRoot)
+                        .catch(error => ({ status: "failed", detail: error instanceof Error ? error.message : String(error), node: process.execPath }));
                 const asksCheck = asksDoctorReport({ stateRoot: config.stateRoot, env, mode: runnerMode(local), run: io.claudePluginList });
                 const guideCheck = guideDoctorReport({ stateRoot: config.stateRoot, env });
                 // Refresh rotating credentials once before the Gateway client asks for a token.
@@ -362,15 +391,17 @@ export async function main(argv, env, io = {}) {
                 const repositoryAccessPromise = listed === undefined || consented.length === 0 ? Promise.resolve(undefined) : checkRepositoryAccess(consented, listed, io.probeRepository);
                 const [service, workspace] = await localChecks;
                 const hook = await hookCheck;
+                const localTools = await localToolsCheck;
                 const asks = await asksCheck;
                 const guide = await guideCheck;
                 const repositoryAccess = await repositoryAccessPromise;
                 const readable = repositoryAccess === undefined || repositoryAccess.every(check => check.status === "readable");
                 const checks = [oauth, gateway, service, workspace];
                 const loaded = service.status === "fulfilled" && service.value.loaded;
-                const ok = checks.every(check => check.status === "fulfilled") && loaded && readable && (hook === null || (hasUsableAdapter(adapters) && hook.enforcing));
-                stdout(JSON.stringify({ ok, configured: true, adapters, checks: { runner_registration: true, oauth: oauth.status === "fulfilled", gateway: gateway.status === "fulfilled", workspace: workspace.status === "fulfilled", launchd: loaded, ...(hook === null ? {} : { hook: hook.enforcing }), ...(repositoryAccess === undefined ? {} : { repository_access: readable }) },
-                    hook: hook === null ? { status: "not_required", reason: "messenger_mode" } : hookReport(hook), ...asks, ...(guideReportShown(guide) ? { guide } : {}), ...(repositoryAccess === undefined ? {} : { repository_access: repositoryAccess }), ...(gateway.status === "fulfilled" ? { runner: gateway.value } : {}), ...(service.status === "fulfilled" ? { launchd: service.value } : {}) }));
+                const ok = checks.every(check => check.status === "fulfilled") && loaded && readable && (hook === null || (hasUsableAdapter(adapters) && hook.enforcing))
+                    && (localTools === null || localTools.status === "passed");
+                stdout(JSON.stringify({ ok, configured: true, adapters, checks: { runner_registration: true, oauth: oauth.status === "fulfilled", gateway: gateway.status === "fulfilled", workspace: workspace.status === "fulfilled", launchd: loaded, ...(hook === null ? {} : { hook: hook.enforcing }), ...(repositoryAccess === undefined ? {} : { repository_access: readable }), ...(localTools === null ? {} : { local_tools: localTools.status === "passed" }) },
+                    hook: hook === null ? { status: "not_required", reason: "messenger_mode" } : hookReport(hook), ...asks, ...(guideReportShown(guide) ? { guide } : {}), ...(repositoryAccess === undefined ? {} : { repository_access: repositoryAccess }), ...(localTools === null ? {} : { local_tools: localToolsReport(localTools) }), ...(gateway.status === "fulfilled" ? { runner: gateway.value } : {}), ...(service.status === "fulfilled" ? { launchd: service.value } : {}) }));
                 return ok ? 0 : 1;
             }
             if (config.mode === 'manual-codex') {