mtech-ai-local-runner 0.1.79 → 0.1.80

package/README.md

@@ -298,6 +298,11 @@ your own AI Gateway connector in Claude, and it never starts a model turn: its O
 conversation. Without the connector the pane says so. The Claude mobile app draws no input field, so there the pane
 reads, shares and marks read only.
 
+The pane refreshes with no model turn, so a Claude session in auto mode would refuse those calls. The mod therefore
+ships a PreToolUse hook that allows exactly the two reads, `work_room_read` and `work_inbox`, on any AI Gateway
+connector. That hook allows them for every caller in the session, the model included. Every other call the pane makes
+carries the press that raised it: Open for a Room and its presented receipt, and the confirm press for each write.
+
 The runner copies the mod to `claude-mod/<version>/` in the state root, without its tests, and installs it with the
 Claude CLI as a local marketplace (`plugin marketplace add` and `plugin install --scope user`). This needs a Claude CLI
 2.1.299 or newer: the first `claude` on `PATH` when it is new enough, else the newest one the Claude desktop app

package/claude-mod/.claude-plugin/plugin.json

@@ -1 +1 @@
-{ "name": "ai-gateway-work-room", "version": "1.0.0", "description": "Work Room shares and requests from colleagues beside the conversation, installed by mtech-ai-local-runner (Work Item 98da2635).", "types": "./types/index.d.ts" }
+{ "name": "ai-gateway-work-room", "version": "1.1.0", "description": "Work Room shares and requests from colleagues beside the conversation, installed by mtech-ai-local-runner (Work Item 98da2635).", "types": "./types/index.d.ts" }

package/claude-mod/hooks/gateway.ts

@@ -33,15 +33,15 @@ export async function callGateway($: EngineInterface, name: GatewayTool, input:
       text?: string
       isError?: boolean
     }
-    if (answer.deny !== undefined) return { ok: false, state: 'refused', detail: clean(answer.deny, 160) }
+    if (answer.deny !== undefined) return { ok: false, state: 'refused', detail: clean(answer.deny, 400) }
     if (answer.isError) {
-      const detail = clean(typeof answer.result === 'string' ? answer.result : answer.text, 160)
+      const detail = clean(typeof answer.result === 'string' ? answer.result : answer.text, 400)
 
       return { ok: false, state: 'error', detail: detail || 'Gateway error' }
     }
 
     return { ok: true, payload: { result: answer.result, text: answer.text } }
   } catch (error) {
-    return { ok: false, state: 'error', detail: clean(error instanceof Error ? error.message : 'Gateway call failed', 160) }
+    return { ok: false, state: 'error', detail: clean(error instanceof Error ? error.message : 'Gateway call failed', 400) }
   }
 }

package/claude-mod/hooks/hooks.json

@@ -1 +1,16 @@
-{ "modules": ["./register.tsx"] }
+{
+  "modules": ["./register.tsx"],
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "^mcp__.+__(work_room_read|work_inbox)$",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "printf '%s' '{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"allow\",\"permissionDecisionReason\":\"Work Room pane: reading your own AI Gateway Rooms and requests is allowed.\"}}'"
+          }
+        ]
+      }
+    ]
+  }
+}

package/claude-mod/hooks/register.tsx

@@ -9,12 +9,16 @@ import { bandText, chatPrompt, findPayload, parseActivity, parseInbox, parseMess
  * The Work Room pane (Work Item 98da2635, spec 2026-10-30): Room shares and requests from colleagues beside the
  * conversation, read and answered through the person's own AI Gateway connector with no model turn. The band above
  * the prompt says what waits; the pane opens only from the band or /work-room, never at session start.
+ *
+ * The refresh runs with no request of the person's behind it, which auto mode refuses, and a mod's own module hooks
+ * cannot approve its own calls. So hooks/hooks.json carries a PreToolUse hook that allows the two reads, work_room_read
+ * and work_inbox, for every caller (owner decision 2026-10-31). Every other call carries the press that raised it.
  */
 
 export const PANE = 'work-room'
 const TITLE = 'Work Room'
 const REFRESH_MS = 60_000
-const NO_CONNECTOR = 'Connect AI Gateway in Claude to use Work Room.'
+const NO_CONNECTOR = 'This session has no AI Gateway Work Room tools. Connect AI Gateway in Claude, reconnect it with /mcp, or start a new session.'
 
 const counts = atom({ plugin: 'ai-gateway-work-room', key: 'counts' } as const, { shares: 0, requests: 0 } as Counts)
 const activity = atom({ plugin: 'ai-gateway-work-room', key: 'activity' } as const, [] as RoomActivity[])
@@ -35,19 +39,19 @@ async function fail($: EngineInterface, answer: { state: Status['state']; detail
   await update($, status, () => ({ state: answer.state, detail: answer.state === 'no-connector' ? NO_CONNECTOR : answer.detail }))
 }
 
-/** Counts only: Room activity and open inbox items, never message bodies. */
+/** Counts only: Room activity and open inbox items, never message bodies. Each half shows even when the other fails. */
 export async function refreshCounts($: EngineInterface): Promise<void> {
   const [roomAnswer, inboxAnswer] = await Promise.all([
     callGateway($, 'work_room_read', { operation: 'activity', limit: 100 }),
     callGateway($, 'work_inbox', { direction: 'to_me' }),
   ])
+  if (roomAnswer.ok) await update($, activity, () => parseActivity(findPayload(roomAnswer.payload, v => Array.isArray(v.rooms))) ?? [])
+  if (inboxAnswer.ok) await update($, inbox, () => parseInbox(findPayload(inboxAnswer.payload, v => Array.isArray(v.items))) ?? [])
+  const rows = await read($, activity)
+  const items = await read($, inbox)
+  await update($, counts, () => ({ shares: rows.reduce((sum, row) => sum + row.unread, 0), requests: items.length }))
   if (!roomAnswer.ok) return fail($, roomAnswer)
   if (!inboxAnswer.ok) return fail($, inboxAnswer)
-  const rows = parseActivity(findPayload(roomAnswer.payload, v => Array.isArray(v.rooms))) ?? []
-  const items = parseInbox(findPayload(inboxAnswer.payload, v => Array.isArray(v.items))) ?? []
-  await update($, activity, () => rows)
-  await update($, inbox, () => items)
-  await update($, counts, () => ({ shares: rows.reduce((sum, row) => sum + row.unread, 0), requests: items.length }))
   await update($, status, () => ({ state: 'ok', detail: '' }))
 }
 
@@ -76,7 +80,10 @@ export async function reportPresented($: EngineInterface, roomId: string, ids: s
   const fresh = ids.filter(id => !presentedSent.has(id)).slice(0, 100)
   if (fresh.length === 0) return
   for (const id of fresh) presentedSent.add(id)
-  const sent = await callGateway($, 'work_room_receipt_report', { room_id: roomId, message_ids: fresh, state: 'presented' })
+  const name = (await read($, rooms))[roomId]?.info.name ?? 'a Room'
+  // The person's press on Open is what showed these messages, so the receipt carries it as consent.
+  const consent = `The user opened Room ${name} in the Work Room pane, which showed them ${fresh.length} message${fresh.length === 1 ? '' : 's'}.`
+  const sent = await callGateway($, 'work_room_receipt_report', { room_id: roomId, message_ids: fresh, state: 'presented' }, consent)
   if (!sent.ok) {
     for (const id of fresh) presentedSent.delete(id)
     return fail($, sent)

package/dist/src/adapters/codex/pre-model-gate.js

@@ -57,7 +57,8 @@ export function assessCodexPreModel(actual, expected, supported) {
         require(server.status === 'ready', 'MCP_NOT_READY');
         require(server.toolSchemaFingerprint === expected.toolSchemaFingerprint, 'MCP_SCHEMA_MISMATCH');
         // Exactly the tools of the inventory the expected fingerprint names (Work Decision f43e7aa0), never the other one.
-        const inventory = localToolInventoryFor(expected.toolSchemaFingerprint, fingerprint);
+        // The native session fingerprints the bare tool array (validateNativeTools), not the descriptor's {tools} form.
+        const inventory = localToolInventoryFor(expected.toolSchemaFingerprint, value => fingerprint(value.tools));
         require(inventory !== undefined && Array.isArray(server.tools) && server.tools.every(tool => typeof tool === 'string')
             && JSON.stringify([...server.tools].sort()) === JSON.stringify([...localToolNames(inventory)].sort()), 'MCP_TOOLS_MISMATCH');
     }

package/dist/src/cli.js

@@ -42,7 +42,16 @@ import { localToolSelfTest } from "./safety/local-tool-self-test.js";
 function localToolsReport(result) {
     if (result.status === "passed")
         return { ...result };
-    return { ...result, action: `Local file tools failed on this Mac (${result.tool ?? "setup"}: ${result.detail ?? "unknown"}), so a job here cannot read source. Send this doctor output to the AI Gateway owner.` };
+    return { ...result, action: localToolsAction(result) };
+}
+function localToolsAction(result) {
+    const failed = `Local file tools failed on this Mac (${result.tool ?? "setup"}: ${result.detail ?? "unknown"}), so a job here cannot read source.`;
+    // A bare restricted node that also fails cannot start in the sandbox at all. On 2026-10-31 Homebrew's node did this on
+    // an employee Mac: it maps libraries from /opt/homebrew, and the sandbox maps only /usr/lib and /System/Library.
+    if (result.sandbox?.status === "failed") {
+        return `${failed} The Node at ${result.node} cannot start inside the runner's restricted sandbox, which loads libraries only from /usr/lib and /System/Library; a Node built against libraries elsewhere, such as Homebrew's, stops there. Install an official Node.js build from https://nodejs.org, then rerun setup and doctor with its bin directory first on PATH, for example: PATH="<official Node>/bin:$PATH" npx mtech-ai-local-runner@latest setup`;
+    }
+    return `${failed} Send this doctor output to the AI Gateway owner.`;
 }
 function hookAction(result) {
     return result.reason === "invalid_command"
@@ -252,6 +261,15 @@ export async function main(argv, env, io = {}) {
                         stdout(JSON.stringify({ ok: false, configured: false, hook: hookReport(hook), action: hookAction(hook) }));
                         throw new Error(`The PreToolUse hook did not deny the probe call (hook_not_enforcing: ${hook.reason})`);
                     }
+                    // A full runner whose job file tools cannot read here would take jobs and stop executor_blocked on every one
+                    // (Work Item 6f9e64ae), so setup refuses before login, as for the hook.
+                    const tools = await (io.localToolSelfTest ?? localToolSelfTest)(config.workspaceRoot)
+                        .catch(error => ({ status: "failed", detail: error instanceof Error ? error.message : String(error), node: process.execPath }));
+                    if (tools.status !== "passed") {
+                        const report = localToolsReport(tools);
+                        stdout(JSON.stringify({ ok: false, configured: false, local_tools: report, action: report.action }));
+                        throw new Error(`The job file tools failed on this Mac (local_tools_failed: ${tools.tool ?? "setup"}: ${tools.detail ?? "unknown"})`);
+                    }
                 }
                 const loginCode = await handleLogin(config, stdout, stderr, fetchFn, io.browserOpener);
                 if (loginCode !== 0)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.79",
+  "version": "0.1.80",
   "private": false,
   "license": "UNLICENSED",
   "bin": {