mtech-ai-local-runner 0.1.77 → 0.1.80

package/dist/src/daemon/repository-access-monitor.js

@@ -0,0 +1,66 @@
+import { checkRepositoryAccess, probeRepositoryAccess } from "../workspace/repository-access.js";
+export const READABLE_RECHECK_MS = 30 * 60_000;
+export const FAILED_RECHECK_MS = 2 * 60_000;
+export class RepositoryAccessMonitor {
+    deps;
+    /** The latest sync's list, or undefined when that sync had none. */
+    listed;
+    results = new Map();
+    round;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /** Starts a check of the repositories that are due, unless one runs; the promise ends with that check. */
+    handleSync(listed) {
+        this.listed = listed;
+        if (this.round)
+            return this.round;
+        const due = this.due();
+        if (due.length === 0)
+            return Promise.resolve();
+        this.round = this.check(due).finally(() => { this.round = undefined; });
+        return this.round;
+    }
+    /** What the heartbeat's local_fix reports, or undefined while the Gateway lists no repositories. */
+    report() {
+        const listed = this.listed;
+        if (listed === undefined)
+            return undefined;
+        return this.deps.keys().slice(0, 50).flatMap(key => {
+            const result = this.results.get(key);
+            // A result for a URL the Gateway no longer lists says nothing about the registered repository.
+            if (!result || result.providerUrl !== listed.find(entry => entry.repository_key === key)?.provider_url)
+                return [];
+            return [{ repository_key: key, status: result.status, checked_at: Math.floor(result.checkedAt / 1000) }];
+        });
+    }
+    now() { return (this.deps.now ?? Date.now)(); }
+    due() {
+        const now = this.now();
+        return this.deps.keys().slice(0, 50).flatMap(key => {
+            const entry = this.listed?.find(candidate => candidate.repository_key === key);
+            if (!entry)
+                return [];
+            const result = this.results.get(key);
+            const wait = result?.status === "readable" ? READABLE_RECHECK_MS : FAILED_RECHECK_MS;
+            return !result || result.providerUrl !== entry.provider_url || now - result.checkedAt >= wait ? [entry] : [];
+        });
+    }
+    async check(due) {
+        const probe = this.deps.probe ?? probeRepositoryAccess;
+        const checks = await checkRepositoryAccess(due.map(entry => entry.repository_key), due, url => probe(url).catch(() => ({ status: "failed" })));
+        const checkedAt = this.now();
+        let changed = false;
+        for (const check of checks) {
+            if (check.status === "not_registered")
+                continue;
+            const providerUrl = due.find(entry => entry.repository_key === check.repository_key).provider_url;
+            const previous = this.results.get(check.repository_key);
+            if (previous?.status !== check.status || previous.providerUrl !== providerUrl)
+                changed = true;
+            this.results.set(check.repository_key, { providerUrl, status: check.status, checkedAt });
+        }
+        if (changed)
+            this.deps.changed?.();
+    }
+}

package/dist/src/daemon/runtime.js

@@ -35,6 +35,7 @@ import { composeReviewedP1Host } from '../verification/p1-host-composition.js';
 import { AskRuntime, withAsks } from '../asks/runtime.js';
 import { GuideRuntime, withGuide } from '../guide/runtime.js';
 import { FixConsentRuntime } from './fix-consent.js';
+import { RepositoryAccessMonitor } from './repository-access-monitor.js';
 import { SuspendedPublication } from './suspended-publication.js';
 import { RoomActivityRuntime } from '../rooms/activity.js';
 import { notifyRoomActivity } from '../rooms/notifier.js';
@@ -154,6 +155,16 @@ export async function buildDaemon(input) {
         workspaces: new WorkspaceManager({ root: input.workspaceRoot, git: new GitClient(), registeredSubmodules: p1Host?.registeredSubmodules }),
         state,
     });
+    // Work Item 6f9e64ae: git read checks of the consented repositories, sent at once when a status changes.
+    const repositoryAccess = new RepositoryAccessMonitor({ keys: () => localFixHost?.report?.repository_keys ?? [],
+        changed: () => { void heartbeats.tick(); } });
+    const localFixReport = () => {
+        const report = localFixHost?.report;
+        if (!report)
+            return null;
+        const access = repositoryAccess.report();
+        return access ? { ...report, repository_access: access } : report;
+    };
     let transport;
     /** The adapter probe in progress, if any: a claim waits for it, so versions never change under a claim. */
     let probing = Promise.resolve();
@@ -254,7 +265,7 @@ export async function buildDaemon(input) {
                 mode: "full",
                 ...(sessionOpen ? { sessionOpen: { ...sessionOpen, ...(askInbox ? { ask_inbox: askInbox } : {}) } } : {}),
                 ...(guidance ? { guidance } : {}),
-                localFix: localFixHost?.report ?? null,
+                localFix: localFixReport(),
             };
         },
         send: async (payload) => { await gateway.heartbeatLocalRunner(payload); },
@@ -308,6 +319,10 @@ export async function buildDaemon(input) {
             void roomActivity.handleSync(result.roomActivityEnabled === true).catch(() => {
                 process.stderr.write(`${JSON.stringify({ event: 'room_activity_scan_failed' })}\n`);
             });
+            // git can take up to 30 s per repository, so the check never holds the sync.
+            void repositoryAccess.handleSync(result.fixRepositories).catch(() => {
+                process.stderr.write(`${JSON.stringify({ event: 'repository_access_check_failed' })}\n`);
+            });
             try {
                 await dispatch(result);
             }

package/dist/src/gateway-client.js

@@ -1,5 +1,6 @@
 import { assertClaimedExecutionAttempt, assertBoundExecutionAttempt, CONTINUATION_SCHEMA, CONTINUATION_POLICY } from './verification/continuation-runner-contract.js';
 import { publicationError } from './publication/failure.js';
+import { fixRepositoryList } from './workspace/repository-access.js';
 import { issueTransportDiagnostic } from './safety/transport-diagnostic.js';
 import { hasP1 } from './verification/p1-execution-host.js';
 import { resolveRunnerVerification, REVIEWED_POLICY, REVIEWED_LOOP_TYPE } from './verification/reviewed-runner-contract.js';
@@ -76,6 +77,7 @@ export function parseRunnerSync(result, runnerId) {
         ...(body.ask_alert === true ? { askAlert: true } : {}),
         ...(body.room_activity_enabled === true ? { roomActivityEnabled: true } : {}),
         ...(Array.isArray(body.fix_consent_grants) ? { fixConsentGrants: parseFixConsentGrants(body.fix_consent_grants) } : {}),
+        ...(Array.isArray(body.fix_repositories) ? { fixRepositories: fixRepositoryList(body) } : {}),
         ...(suspendedJob ? { suspendedJob } : {}),
         jobAvailable: body.job_available === true,
         push: parsePush(body.push, runnerId),

package/dist/src/safety/claude-production-host.js

@@ -6,7 +6,7 @@ import { CLAUDE_CAPABILITIES } from '../adapters/discovery.js';
 import { claudeLoginFromStatus } from '../adapters/claude-code/login-status.js';
 import { captureClaudeBinaryIdentity } from './claude-binary-identity.js';
 import { commandRegistryFingerprint } from './job-security-session.js';
-import { localToolInventory } from './local-tool-server.js';
+import { localToolInventory, localToolInventoryFor } from './local-tool-server.js';
 import { CLAUDE_LAUNCH_OPT_OUTS, CLAUDE_MANDATORY_GATES, CLAUDE_RELEASE_MODE, CLAUDE_TRANSPORT, claudeCanonicalSha256, hostClaudePlatform, requireClaudeRequirements } from './claude-release.js';
 import { claudeReleaseCopyPath, claudeReleaseRoot, createClaudeReleaseProvisioner, verifyClaudeCodeSignature, verifyClaudeReleaseCopy } from './claude-release-copy.js';
 import { claudeManagedScopeDeps, claudeManagedScopeReady, collectClaudeManagedScope } from './claude-managed-scope.js';
@@ -39,6 +39,23 @@ export const CLAUDE_LAUNCH_CONFIG = Object.freeze({ transport: CLAUDE_TRANSPORT,
         '--no-chrome', '--output-format', '--permission-mode', '--print', '--setting-sources', '--settings', '--strict-mcp-config', '--tools', '--verbose']),
     conditional_flags: Object.freeze(['--max-budget-usd', '--resume', '--session-id']),
     settings_keys: Object.freeze(['hooks.PreToolUse']), env_opt_outs: CLAUDE_LAUNCH_OPT_OUTS });
+/** The tool inventory a listed release was reviewed with (Work Decision f43e7aa0): the one its tools_sha256 names, or
+ * local-tools-v1 for an entry without it, so every job keeps the original tools until the Gateway lists another. */
+export function claudeReleaseToolInventory(release) {
+    if (release.tools_sha256 === undefined)
+        return 'local-tools-v1';
+    const id = localToolInventoryFor(release.tools_sha256, claudeCanonicalSha256);
+    if (!id)
+        throw Error('CLAUDE_RELEASE_BINDING_REJECTED');
+    return id;
+}
+/** The inventory a Claude job pin names; the adapter and the job tools serve exactly this one. */
+export function claudePinToolInventory(pin) {
+    const id = localToolInventoryFor(pin.toolsSha256, claudeCanonicalSha256);
+    if (!id)
+        throw Error('JOB_SECURITY_REJECTED');
+    return id;
+}
 const CHECK_IDS = { CLAUDE_RELEASE_NOT_LISTED: 'release_list', CLAUDE_RELEASE_PLATFORM_MISMATCH: 'release_platform',
     CLAUDE_RELEASE_COPY_UNAVAILABLE: 'release_copy', CLAUDE_CODE_SIGNATURE_REJECTED: 'release_copy', CLAUDE_MANAGED_SCOPE_UNVERIFIED: 'managed_scope' };
 /** A login probe answer (any status) is reused this long for the same release and copy identity. */
@@ -193,11 +210,12 @@ export function createClaudeProductionHost(input) {
         if (release.version !== synced.version || release.platform !== synced.platform || release.binary_sha256 !== synced.binary_sha256
             || !isDeepStrictEqual([...release.model_ids], [...synced.model_ids]) || release.platform !== platform || !release.model_ids.includes(request.modelId))
             throw Error('CLAUDE_RELEASE_BINDING_REJECTED');
+        const tools = claudeReleaseToolInventory(release);
         await verifyClaudeCodeSignature(binary, input.codesign);
         const scope = await collectClaudeManagedScope(managed), commandRegistry = [];
         const pin = { adapterId: 'claude_code_cli', adapterVersion: '1', jobId: request.jobId, generation: request.generation, modelId: request.modelId, sourceSha: request.sourceSha,
             binarySha256: release.binary_sha256, configSha256: claudeCanonicalSha256(CLAUDE_LAUNCH_CONFIG), managedPolicySha256: scope.fingerprint,
-            toolsSha256: claudeCanonicalSha256({ tools: localToolInventory() }), commandsSha256: commandRegistryFingerprint(commandRegistry),
+            toolsSha256: claudeCanonicalSha256({ tools: localToolInventory(tools) }), commandsSha256: commandRegistryFingerprint(commandRegistry),
             osProfileSha256: claudeCanonicalSha256({ platform }), requirementsSha256: requirements.fingerprint, securityMode: CLAUDE_RELEASE_MODE };
         return { pin, commandRegistry,
             // The job MCP token is the session identity (accepted risk job_mcp_token_possession_not_os_identity).

package/dist/src/safety/claude-release.js

@@ -50,8 +50,11 @@ export function parseClaudeSyncRelease(value) {
         return null;
     return freeze({ version: value.version, platform: value.platform, binary_sha256: value.binary_sha256, model_ids: [...value.model_ids] });
 }
+/** One listed release entry: its seven keys, and optionally tools_sha256 (Work Decision f43e7aa0; runners up to 0.1.76
+ * refuse an entry that carries it). Which inventory the value names is the job host's check, not this parser's. */
 export function requireClaudeRelease(value) {
-    if (!record(value) || !isDeepStrictEqual(keys(value), ['binary_sha256', 'decision_id', 'evidence_sha256', 'model_ids', 'platform', 'review_status', 'version']) || !common(value)
+    if (!record(value) || !isDeepStrictEqual(keys(value).filter(k => k !== 'tools_sha256'), ['binary_sha256', 'decision_id', 'evidence_sha256', 'model_ids', 'platform', 'review_status', 'version']) || !common(value)
+        || Object.hasOwn(value, 'tools_sha256') && !digest(value.tools_sha256)
         || !digest(value.evidence_sha256) || typeof value.decision_id !== 'string' || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(value.decision_id)
         || value.review_status !== 'reviewed')
         throw Error('CLAUDE_REQUIREMENTS_REJECTED');

package/dist/src/safety/claude-review-campaign.js

@@ -7,7 +7,7 @@ import { isDeepStrictEqual } from 'node:util';
 import { NodeProcessGroupHost } from '../process/node-process-group-host.js';
 import { packageVersion } from '../package-version.js';
 import { HOOK_POLICY_ENV_VAR } from './hook-policy-builder.js';
-import { CLAUDE_LOCAL_MCP_TOOLS } from './pre-tool-use-hook.js';
+import { claudeLocalMcpTools } from './pre-tool-use-hook.js';
 import { localToolInventory } from './local-tool-server.js';
 import { measureCommandFile } from './registered-command-integrity.js';
 import { CLAUDE_LAUNCH_OPT_OUTS, CLAUDE_SIGNING_IDENTIFIER, CLAUDE_TEAM_ID, claudeCanonicalSha256, parseClaudeSyncRelease } from './claude-release.js';
@@ -15,9 +15,9 @@ import { CLAUDE_CODE_REQUIREMENT, verifyClaudeCodeSignature } from './claude-rel
 import { CLAUDE_LAUNCH_CONFIG } from './claude-production-host.js';
 import { CLAUDE_REVIEW_PROFILE_TEMPLATE_SHA256, CLAUDE_REVIEW_PROFILE_VERSION } from './claude-review-sandbox.js';
 import { CLAUDE_REVIEW_KEYCHAIN_READS, CLAUDE_REVIEW_KEYCHAIN_SERVICES, CLAUDE_REVIEW_PLANTED_SOURCES, createClaudeReviewLayout } from './claude-review-layout.js';
-import { CLAUDE_REVIEW_FAKE_KEY, CLAUDE_REVIEW_PROMPT, CLAUDE_REVIEW_RUN_TIMEOUT_MS, CLAUDE_REVIEW_SLASH_PROMPT, CLAUDE_REVIEW_TOOL_IDS, claudeReviewEnv, runClaudeReview, runClaudeVersion } from './claude-review-run.js';
+import { CLAUDE_REVIEW_FAKE_KEY, CLAUDE_REVIEW_PROMPT, CLAUDE_REVIEW_RUN_TIMEOUT_MS, CLAUDE_REVIEW_SLASH_PROMPT, CLAUDE_REVIEW_TOOL_IDS, CLAUDE_REVIEW_TOOL_INVENTORY, claudeReviewEnv, runClaudeReview, runClaudeVersion } from './claude-review-run.js';
 import { CLAUDE_REVIEW_STAGES, buildClaudeReviewEvidence } from './claude-review-evidence.js';
-const AI_LOCAL = Object.freeze([...CLAUDE_LOCAL_MCP_TOOLS].sort());
+const AI_LOCAL = Object.freeze([...claudeLocalMcpTools(CLAUDE_REVIEW_TOOL_INVENTORY)].sort());
 const DISCOVERY = Object.freeze(['initialize_response', 'initialized_notification', 'inventory_response']);
 const PLANTED_SENTINELS = Object.freeze(['api-key-helper', 'pre-tool-use', 'session-start', 'user-prompt-submit']);
 const sha = (text) => createHash('sha256').update(text).digest('hex');
@@ -112,7 +112,7 @@ export async function runClaudeReviewCampaign(input) {
         expectedEnvKeys: [...launchEnvKeys, ...reviewEnvKeys].sort(), tempRemoved });
     return buildClaudeReviewEvidence({
         release: { ...input.release, model_ids: models },
-        protocol: { launch_config_sha256: claudeCanonicalSha256(CLAUDE_LAUNCH_CONFIG), tools_sha256: claudeCanonicalSha256({ tools: localToolInventory() }),
+        protocol: { launch_config_sha256: claudeCanonicalSha256(CLAUDE_LAUNCH_CONFIG), tools_sha256: claudeCanonicalSha256({ tools: localToolInventory(CLAUDE_REVIEW_TOOL_INVENTORY) }),
             sandbox_profile: CLAUDE_REVIEW_PROFILE_VERSION, sandbox_profile_template_sha256: CLAUDE_REVIEW_PROFILE_TEMPLATE_SHA256, launch_env_keys: launchEnvKeys,
             review_env_keys: reviewEnvKeys, prompt_sha256: sha(CLAUDE_REVIEW_PROMPT), slash_prompt_sha256: sha(CLAUDE_REVIEW_SLASH_PROMPT), scripted_tool_ids: Object.values(CLAUDE_REVIEW_TOOL_IDS) },
         inventory: { binary_sha256: sha256, size_bytes: size, team_id: CLAUDE_TEAM_ID, signing_identifier: CLAUDE_SIGNING_IDENTIFIER,

package/dist/src/safety/claude-review-run.js

@@ -27,10 +27,13 @@ export function claudeReviewEnv(providerUrl) {
 const REVIEW_KEY = 'claude-release-review', REVIEW_SHA = '0'.repeat(40);
 const REVIEW_BINDING = Object.freeze({ jobId: REVIEW_KEY, threadId: `${REVIEW_KEY}-thread`, turnId: `${REVIEW_KEY}-turn`, generation: 1 });
 const REVIEW_TASK = Object.freeze({ agent_execution: { implementation_brief: { required_tests: [] } } });
+/** The tool inventory a release is reviewed with (Work Decision f43e7aa0): the newest, so a listing that names it in
+ * tools_sha256 is backed by evidence of exactly that surface. The job MCP server, the hook and the argv all serve it. */
+export const CLAUDE_REVIEW_TOOL_INVENTORY = 'local-tools-v2';
 /** A read-only review job over the fake source: src/** allowed, .env blocked, no commands. Same derivation as a real job. */
 function reviewToolPolicy(source) {
     const blocked = ['.env', '.env.*'];
-    return jobToolPolicyOptions(source, { repositories: [{ repository_key: REVIEW_KEY, base_commit_sha: REVIEW_SHA, access: 'read', allowed_paths: ['src/**'], blocked_paths: blocked }], contract: { verification: { required_commands: [] } } }, { runtime_adapter: 'claude_code_cli', runtime_adapter_version: '1', repository: { key: REVIEW_KEY, base_commit_sha: REVIEW_SHA, access: 'read', blocked_paths: blocked }, allowed_paths: ['src/**'], required_commands: [] }, [], { runtimeAdapter: 'claude_code_cli', runtimeAdapterVersion: '1' });
+    return { inventory: CLAUDE_REVIEW_TOOL_INVENTORY, ...jobToolPolicyOptions(source, { repositories: [{ repository_key: REVIEW_KEY, base_commit_sha: REVIEW_SHA, access: 'read', allowed_paths: ['src/**'], blocked_paths: blocked }], contract: { verification: { required_commands: [] } } }, { runtime_adapter: 'claude_code_cli', runtime_adapter_version: '1', repository: { key: REVIEW_KEY, base_commit_sha: REVIEW_SHA, access: 'read', blocked_paths: blocked }, allowed_paths: ['src/**'], required_commands: [] }, [], { runtimeAdapter: 'claude_code_cli', runtimeAdapterVersion: '1' }) };
 }
 /** The scripted primary turn: one allowed read, a native tool, an unregistered MCP tool, a read outside the root, a planted secret. */
 export function claudeReviewSteps(layout) {
@@ -89,7 +92,7 @@ export async function runClaudeReview(input) {
     let active = true, terminal = false, exitConfirmed = false, envKeys = [], reads = { successful: 0, failed: 0 };
     let handle, provider, decoy, homeBefore;
     const tools = new JobToolSession({ policyOptions: reviewToolPolicy(layout.source), binding: () => REVIEW_BINDING, active: () => active,
-        createServer: policy => new LocalToolServer({ policy, onDiscovery: event => { discovery.push(event); } }) });
+        createServer: policy => new LocalToolServer({ policy, inventory: CLAUDE_REVIEW_TOOL_INVENTORY, onDiscovery: event => { discovery.push(event); } }) });
     try {
         provider = await startClaudeReviewProvider({ prompt, model: input.model, steps: input.kind === 'slash' ? [] : claudeReviewSteps(layout), canaries: { ...layout.canaries }, fakeKey: CLAUDE_REVIEW_FAKE_KEY });
         decoy = await startClaudeReviewDecoy();
@@ -98,10 +101,10 @@ export async function runClaudeReview(input) {
             await plantHostileSources(layout, { decoyUrl: decoy.url, plantedMcpUrl: `${provider.url}/planted-mcp/${layout.canaries.planted}` });
         const mcpConfigPath = path.join(layout.cli.root, `mcp-${randomUUID()}.json`);
         await writeFile(mcpConfigPath, JSON.stringify(claudeJobMcpConfig(endpoint)), { mode: 0o600, flag: 'wx' });
-        const policy = buildHookPolicy({ taskPackage: REVIEW_TASK, worktreeRoot: layout.source, registeredReadTools: [], generatedPaths: [mcpConfigPath] });
+        const policy = buildHookPolicy({ taskPackage: REVIEW_TASK, worktreeRoot: layout.source, registeredReadTools: [], generatedPaths: [mcpConfigPath], toolInventory: CLAUDE_REVIEW_TOOL_INVENTORY });
         // Exactly the adapter's release-mode argv (unbounded employee shape: no budget flag), environment and hook settings.
         const args = claudeLaunchArgs({ modelId: input.model, maxBudgetUsd: null, name: REVIEW_KEY, mcpConfigPath,
-            settings: claudeLaunchSettings(formatHookCommand(input.hook, { worktreeRoot: layout.source })), sessionId: randomUUID() });
+            settings: claudeLaunchSettings(formatHookCommand(input.hook, { worktreeRoot: layout.source })), sessionId: randomUUID(), toolInventory: CLAUDE_REVIEW_TOOL_INVENTORY });
         const env = { ...claudeLaunchEnv(layout.env, policy), ...claudeReviewEnv(provider.url) };
         envKeys = Object.keys(env).sort();
         const profile = claudeReviewProfile({ root: layout.root, cliRoot: layout.cli.root, ports: [provider.port, Number(new URL(endpoint.url).port)], readRoots: input.readRoots, deniedHome: input.deniedHome });

package/dist/src/safety/codex-exec-production-host.js

@@ -21,7 +21,7 @@ import { isReleaseExecMode, requireOfficialExecPlan, assertOfficialExecAttempt }
 import { EXEC_INPUT_GATES, releaseGates, releaseRisks } from '../adapters/codex/exec-release-policy.js';
 import { measureCommandFile, verifyCommandIntegrity } from './registered-command-integrity.js';
 import { commandRegistryFingerprint } from './job-security-session.js';
-import { localToolInventory } from './local-tool-server.js';
+import { localToolInventory, localToolInventoryFor } from './local-tool-server.js';
 const reject = () => Error('CODEX_EXEC_PRODUCTION_REJECTED');
 const hex = (v) => typeof v === 'string' && /^[a-f0-9]{64}$/.test(v);
 const exact = (v, keys) => JSON.stringify(Object.keys(v).sort()) === JSON.stringify(keys.sort());
@@ -108,7 +108,7 @@ export function createCodexExecProductionHost(original) {
             const attempt = assertClaimedExecutionAttempt(claimed);
             let cleanup, closing;
             const close = () => { revoked = true; return closing ??= (Promise.resolve().then(() => cleanup?.())); };
-            let revoked = false, prepared = false, selected, ctx;
+            let revoked = false, prepared = false, selected, ctx, tools;
             const baseline = new Map(), directories = new Map(), accountDirectories = new Map();
             let boundPlan, headObservation;
             const dirStamp = (file) => { const s = lstatSync(file, { bigint: true }); if (!s.isDirectory() || (s.mode & 63n) !== 0n || process.getuid && s.uid !== BigInt(process.getuid()))
@@ -133,7 +133,9 @@ export function createCodexExecProductionHost(original) {
                         selected = await inspect();
                         stage = 'codex_prepare_binding';
                         const r = requireSecurityRequirements(p.security_requirements, { adapterId: 'codex_cli', adapterVersion: '1' }), release = selected.release;
-                        if (r.mdm_verification !== release.mdmVerification || !isDeepStrictEqual(r.policy_observer, release.policyObserver) || r.security_mode !== release.securityMode || value.generation !== j.generation || value.resolvedModelId !== p.resolved_model_id || !release.modelIds.includes(value.resolvedModelId) || fingerprint(value.approvedTaskPackage) !== c.task_package_fingerprint || value.securityBinding?.contractFingerprint !== c.contract_fingerprint || value.securityBinding?.taskPackageFingerprint !== c.task_package_fingerprint || value.securityBinding?.launchFingerprint !== j.launch_fingerprint || r.release_manifest_sha256 !== execReleaseFingerprint(release) || r.binary_sha256 !== release.binarySha256 || r.fixtures_sha256 !== release.fixturesFingerprint || r.commands_sha256 !== commandRegistryFingerprint(release.commands) || r.tools_sha256 !== fingerprint({ tools: localToolInventory() }) || JSON.stringify(r.model_ids) !== JSON.stringify(release.modelIds))
+                        // The one inventory whose fingerprint the frozen descriptor names; any other tools_sha256 is refused as before.
+                        tools = localToolInventoryFor(r.tools_sha256, fingerprint);
+                        if (r.mdm_verification !== release.mdmVerification || !isDeepStrictEqual(r.policy_observer, release.policyObserver) || r.security_mode !== release.securityMode || value.generation !== j.generation || value.resolvedModelId !== p.resolved_model_id || !release.modelIds.includes(value.resolvedModelId) || fingerprint(value.approvedTaskPackage) !== c.task_package_fingerprint || value.securityBinding?.contractFingerprint !== c.contract_fingerprint || value.securityBinding?.taskPackageFingerprint !== c.task_package_fingerprint || value.securityBinding?.launchFingerprint !== j.launch_fingerprint || r.release_manifest_sha256 !== execReleaseFingerprint(release) || r.binary_sha256 !== release.binarySha256 || r.fixtures_sha256 !== release.fixturesFingerprint || r.commands_sha256 !== commandRegistryFingerprint(release.commands) || !tools || JSON.stringify(r.model_ids) !== JSON.stringify(release.modelIds))
                             throw reject();
                         if (attempt) {
                             assertBoundExecutionAttempt(claimed, value.taskPackage);
@@ -174,7 +176,7 @@ export function createCodexExecProductionHost(original) {
                         stage = 'codex_prepare_current';
                         if (!current())
                             throw reject();
-                        return { binary: selected.binary, release: structuredClone(release), actorId: c.security_context.actor_id, runnerId: input.runnerId };
+                        return { binary: selected.binary, release: structuredClone(release), actorId: c.security_context.actor_id, runnerId: input.runnerId, tools };
                     }
                     catch (error) {
                         revoked = true;
@@ -182,7 +184,7 @@ export function createCodexExecProductionHost(original) {
                     }
                 },
                 async inspect(plan) {
-                    if (!current() || !selected || !ctx || plan.mode !== selected.release.securityMode || plan.credentialBackend !== selected.release.credentialBackend || plan.home !== input.home || plan.accountRoot !== account || plan.binary !== selected.binary || plan.modelId !== ctx.resolvedModelId || plan.identity.actorId !== c.security_context.actor_id || plan.identity.runnerId !== input.runnerId || plan.identity.jobId !== id || plan.identity.generation !== j.generation || plan.identity.sourceSha !== p.repository?.base_commit_sha || plan.identity.launchFingerprint !== j.launch_fingerprint || plan.identity.taskPackageFingerprint !== c.task_package_fingerprint || plan.identity.contractFingerprint !== c.contract_fingerprint || plan.identity.releaseManifestFingerprint !== execReleaseFingerprint(selected.release) || plan.identity.binarySha256 !== selected.release.binarySha256 || plan.identity.commandsFingerprint !== commandRegistryFingerprint(selected.release.commands) || plan.identity.toolSchemaFingerprint !== fingerprint({ tools: localToolInventory() }) || plan.identity.barrierFingerprint !== selected.release.fixturesFingerprint || plan.identity.requirementsFingerprint !== p.security_requirements.fingerprint)
+                    if (!current() || !selected || !ctx || !tools || plan.mode !== selected.release.securityMode || plan.credentialBackend !== selected.release.credentialBackend || plan.home !== input.home || plan.accountRoot !== account || plan.binary !== selected.binary || plan.modelId !== ctx.resolvedModelId || plan.identity.actorId !== c.security_context.actor_id || plan.identity.runnerId !== input.runnerId || plan.identity.jobId !== id || plan.identity.generation !== j.generation || plan.identity.sourceSha !== p.repository?.base_commit_sha || plan.identity.launchFingerprint !== j.launch_fingerprint || plan.identity.taskPackageFingerprint !== c.task_package_fingerprint || plan.identity.contractFingerprint !== c.contract_fingerprint || plan.identity.releaseManifestFingerprint !== execReleaseFingerprint(selected.release) || plan.identity.binarySha256 !== selected.release.binarySha256 || plan.identity.commandsFingerprint !== commandRegistryFingerprint(selected.release.commands) || plan.identity.toolSchemaFingerprint !== fingerprint({ tools: localToolInventory(tools) }) || plan.identity.barrierFingerprint !== selected.release.fixturesFingerprint || plan.identity.requirementsFingerprint !== p.security_requirements.fingerprint)
                         throw reject();
                     assertOfficialExecAttempt(plan, ctx.executionAttempt, ctx.executionAttemptFingerprint, ctx.bindingId, sourceRoot);
                     if (boundPlan && boundPlan !== plan)

package/dist/src/safety/codex-manual-controller.js

@@ -4,7 +4,7 @@ import { eligiblePersonalAccount } from '../adapters/codex/unmanaged-scope.js';
 import { securityRequirementsFingerprint as hash } from './security-requirements.js';
 import { commandRegistryFingerprint } from './job-security-session.js';
 import { fingerprint } from '../daemon/execution-coordinator.js';
-import { localToolInventory } from './local-tool-server.js';
+import { localToolInventoryFor } from './local-tool-server.js';
 import { isDeepStrictEqual } from 'node:util';
 import { readCodexCredentialStatus } from './codex-production-host.js';
 import path from 'node:path';
@@ -59,7 +59,7 @@ function createPrelaunchController(input, deps, mode) {
                     throw rejected();
                 stage = 'codex_manual_requirements';
                 const job = claim.job, p = claim.task_package, r = requirements;
-                if (r.security_mode !== release.securityMode || r.binary_sha256 !== release.binarySha256 || r.fixtures_sha256 !== release.fixturesFingerprint || r.commands_sha256 !== commandRegistryFingerprint(release.commands) || r.tools_sha256 !== fingerprint({ tools: localToolInventory() }) || !isDeepStrictEqual(r.model_ids, release.modelIds) || !release.modelIds.includes(String(p.resolved_model_id)))
+                if (r.security_mode !== release.securityMode || r.binary_sha256 !== release.binarySha256 || r.fixtures_sha256 !== release.fixturesFingerprint || r.commands_sha256 !== commandRegistryFingerprint(release.commands) || !localToolInventoryFor(r.tools_sha256, fingerprint) || !isDeepStrictEqual(r.model_ids, release.modelIds) || !release.modelIds.includes(String(p.resolved_model_id)))
                     throw rejected();
                 stage = 'codex_manual_local_policy';
                 const local = readLocal();

package/dist/src/safety/hook-policy-builder.js

@@ -1,4 +1,4 @@
-import { CLAUDE_LOCAL_MCP_TOOLS } from "./pre-tool-use-hook.js";
+import { claudeLocalMcpTools } from "./pre-tool-use-hook.js";
 const DEFAULT_BLOCKED_PATHS = [".git", ".env", ".aws", ".ssh"];
 /** Defined here, not in hook-cli.ts, so the runner never has to load the hook script itself. */
 export const HOOK_POLICY_ENV_VAR = "AI_GATEWAY_RUNNER_HOOK_POLICY_B64";
@@ -15,12 +15,12 @@ function requiredTestsFromTaskPackage(taskPackage) {
     return requiredTests.map((item) => String(item));
 }
 /**
- * Only the four job-local MCP names may pass the hook. Source and command
+ * Only the job-local MCP names of the job's tool inventory may pass the hook. Source and command
  * authorization is enforced by the scoped worker, never by native Claude tools.
  */
 export function buildHookPolicy(options) {
     const requiredCommands = requiredTestsFromTaskPackage(options.taskPackage);
-    const allowedMcpTools = [...CLAUDE_LOCAL_MCP_TOOLS];
+    const allowedMcpTools = [...claudeLocalMcpTools(options.toolInventory)];
     const blockedPaths = [...new Set([...DEFAULT_BLOCKED_PATHS, ...(options.additionalBlockedPaths ?? []), ...options.generatedPaths])];
     return {
         requiredCommands,

package/dist/src/safety/job-tool-dispatcher.js

@@ -1,5 +1,6 @@
 import { validateLocalReadRange } from './local-read-range.js';
 import { localToolInventory } from './local-tool-server.js';
+import { localToolNames } from './local-tool-policy.js';
 const rejected = () => new Error('JOB_TOOL_DISPATCH_REJECTED');
 /** The scoped policy's stable denial code, which LocalToolServer already lets a model see, so a model can correct its
  * call. Only an exact code qualifies: any other failure, including binding and lease checks, stays one masked rejection. */
@@ -15,14 +16,23 @@ const keys = (value, expected) => JSON.stringify(Object.keys(value).sort()) ===
 export class JobToolDispatcher {
     policy;
     active;
+    inventory;
     #binding;
     #revoked = false;
     #lastRequest = 0n;
-    constructor(binding, policy, active) {
+    /** `inventory` is the job's host-picked tool inventory (absent: local-tools-v1); only its tools and schemas pass. */
+    constructor(binding, policy, active, inventory) {
         this.policy = policy;
         this.active = active;
+        this.inventory = inventory;
         if (![binding.jobId, binding.threadId, binding.turnId].every(id) || !Number.isSafeInteger(binding.generation) || binding.generation < 1)
             throw rejected();
+        try {
+            localToolNames(inventory);
+        }
+        catch {
+            throw rejected();
+        }
         this.#binding = Object.freeze({ ...binding });
     }
     revoke() { if (this.#revoked)
@@ -37,9 +47,10 @@ export class JobToolDispatcher {
                 || !id(envelope.requestId) || !/^[1-9][0-9]*$/.test(envelope.requestId) || BigInt(envelope.requestId) <= this.#lastRequest
                 || typeof envelope.tool !== 'string' || !record(envelope.args))
                 throw rejected();
-            const tool = localToolInventory().find(t => t.name === envelope.tool);
+            const tool = localToolInventory(this.inventory).find(t => t.name === envelope.tool);
             const properties = tool?.inputSchema.properties;
-            const required = tool?.inputSchema.required;
+            // A schema whose properties are all optional (local_find) has no `required`.
+            const required = tool?.inputSchema.required ?? [];
             if (!record(properties) || !Array.isArray(required) || required.some(key => typeof key !== 'string' || !Object.hasOwn(envelope.args, key))
                 || Object.entries(envelope.args).some(([key, value]) => {
                     const schema = properties[key];

package/dist/src/safety/job-tool-session.js

@@ -26,7 +26,7 @@ export class JobToolSession {
                 throw Error();
             if (!this.dispatcher) {
                 this.bound = Object.freeze({ ...binding });
-                this.dispatcher = new JobToolDispatcher(this.bound, this.policy, () => !this.revoked && this.options.active() && sameBinding(this.bound, this.options.binding()));
+                this.dispatcher = new JobToolDispatcher(this.bound, this.policy, () => !this.revoked && this.options.active() && sameBinding(this.bound, this.options.binding()), this.options.policyOptions.inventory);
             }
             if (!sameBinding(this.bound, binding))
                 throw Error();
@@ -42,7 +42,7 @@ export class JobToolSession {
         this.started = true;
         try {
             const scoped = { call: (tool, args) => this.call(tool, args), revoke: () => this.policy.revoke() };
-            this.server = this.options.createServer?.(scoped) ?? new LocalToolServer({ policy: scoped });
+            this.server = this.options.createServer?.(scoped) ?? new LocalToolServer({ policy: scoped, inventory: this.options.policyOptions.inventory });
             const endpoint = await this.server.start();
             if (this.revoked)
                 throw Error();