mtech-ai-local-runner 0.1.79 → 0.1.81

package/README.md

@@ -269,7 +269,7 @@ covers it. A stored delivery is forgotten an hour after it arrived, by which tim
 long run.
 
 Integrations are installed only on request, with `setup --integrations` or `integrations install`; setup never asks
-about them. An app already installed in the directory the environment names is skipped and reported installed, without
+about them. The Work Room pane, below, is the one exception: every setup installs it. An app already installed in the directory the environment names is skipped and reported installed, without
 rewriting its files:
 
 ```bash
@@ -298,6 +298,17 @@ your own AI Gateway connector in Claude, and it never starts a model turn: its O
 conversation. Without the connector the pane says so. The Claude mobile app draws no input field, so there the pane
 reads, shares and marks read only.
 
+The pane calls the connector with no model turn, so a Claude session in auto mode would refuse every one of those
+calls. The mod therefore ships PreToolUse hooks that match any AI Gateway connector and apply to every caller in the
+session, the model included:
+
+- They allow the two reads, `work_room_read` and `work_inbox`.
+- They allow `work_room_receipt_report` only when its `state` is `presented`, the record that the pane showed you a
+  message.
+- They ask you in Claude's own permission dialog before every write: `work_room_write`, `work_request_answer`, and
+  `work_room_receipt_report` for marking messages read. A write from the pane therefore needs its confirm press and
+  then your answer in that dialog.
+
 The runner copies the mod to `claude-mod/<version>/` in the state root, without its tests, and installs it with the
 Claude CLI as a local marketplace (`plugin marketplace add` and `plugin install --scope user`). This needs a Claude CLI
 2.1.299 or newer: the first `claude` on `PATH` when it is new enough, else the newest one the Claude desktop app
@@ -305,6 +316,12 @@ bundles. Without one, the hooks are installed as before and the result reports t
 only a missing or older copy, and it never turns on a mod you turned off. `integrations status` and `doctor` report the
 mod's state under `mod`; `integrations remove claude` and `uninstall` remove it. The daemon never runs the Claude CLI.
 
+Every `setup` installs or updates the mod, with or without `--integrations`, and reports it as `workRoomPane`. So
+rerunning `npx mtech-ai-local-runner@<version> setup` is enough to get the newest pane. With `--integrations claude`
+the Claude integration installs it and reports it under its own `mod` instead. After `integrations remove claude`,
+setup leaves the mod out, and its result says so. `integrations install claude` adds the mod again, and from then
+setup keeps it up to date once more. `uninstall` forgets the removal, so a later setup starts fresh.
+
 `CLAUDE_CONFIG_DIR` and `CODEX_HOME` are honoured. The LaunchAgent that runs the daemon gets only `PATH`, so every
 install adds the directory it used to a list per app in `integrations.json` in the state root, and the daemon,
 `doctor`, `integrations remove` and `uninstall` look in every recorded directory as well as in the environment. A

package/claude-mod/.claude-plugin/plugin.json

@@ -1 +1 @@
-{ "name": "ai-gateway-work-room", "version": "1.0.0", "description": "Work Room shares and requests from colleagues beside the conversation, installed by mtech-ai-local-runner (Work Item 98da2635).", "types": "./types/index.d.ts" }
+{ "name": "ai-gateway-work-room", "version": "1.2.0", "description": "Work Room shares and requests from colleagues beside the conversation, installed by mtech-ai-local-runner (Work Item 98da2635).", "types": "./types/index.d.ts" }

package/claude-mod/hooks/gateway.ts

@@ -33,15 +33,15 @@ export async function callGateway($: EngineInterface, name: GatewayTool, input:
       text?: string
       isError?: boolean
     }
-    if (answer.deny !== undefined) return { ok: false, state: 'refused', detail: clean(answer.deny, 160) }
+    if (answer.deny !== undefined) return { ok: false, state: 'refused', detail: clean(answer.deny, 400) }
     if (answer.isError) {
-      const detail = clean(typeof answer.result === 'string' ? answer.result : answer.text, 160)
+      const detail = clean(typeof answer.result === 'string' ? answer.result : answer.text, 400)
 
       return { ok: false, state: 'error', detail: detail || 'Gateway error' }
     }
 
     return { ok: true, payload: { result: answer.result, text: answer.text } }
   } catch (error) {
-    return { ok: false, state: 'error', detail: clean(error instanceof Error ? error.message : 'Gateway call failed', 160) }
+    return { ok: false, state: 'error', detail: clean(error instanceof Error ? error.message : 'Gateway call failed', 400) }
   }
 }

package/claude-mod/hooks/hooks.json

@@ -1 +1,34 @@
-{ "modules": ["./register.tsx"] }
+{
+  "modules": ["./register.tsx"],
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "^mcp__.+__(work_room_read|work_inbox)$",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "printf '%s' '{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"allow\",\"permissionDecisionReason\":\"Work Room pane: reading your own AI Gateway Rooms and requests is allowed.\"}}'"
+          }
+        ]
+      },
+      {
+        "matcher": "^mcp__.+__work_room_receipt_report$",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "if grep -Eq '\"state\"[[:space:]]*:[[:space:]]*\"presented\"'; then printf '%s' '{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"allow\",\"permissionDecisionReason\":\"Work Room pane: recording that it showed you these Room messages is allowed.\"}}'; else printf '%s' '{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"ask\",\"permissionDecisionReason\":\"Work Room: marking Room messages read tells the AI Gateway you read them. Allow it?\"}}'; fi"
+          }
+        ]
+      },
+      {
+        "matcher": "^mcp__.+__(work_room_write|work_request_answer)$",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "printf '%s' '{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"ask\",\"permissionDecisionReason\":\"Work Room: this sends what you wrote to colleagues through the AI Gateway. Allow it?\"}}'"
+          }
+        ]
+      }
+    ]
+  }
+}

package/claude-mod/hooks/register.tsx

@@ -9,12 +9,18 @@ import { bandText, chatPrompt, findPayload, parseActivity, parseInbox, parseMess
  * The Work Room pane (Work Item 98da2635, spec 2026-10-30): Room shares and requests from colleagues beside the
  * conversation, read and answered through the person's own AI Gateway connector with no model turn. The band above
  * the prompt says what waits; the pane opens only from the band or /work-room, never at session start.
+ *
+ * Auto mode refuses every call the pane makes, since none comes from a request of the person's in the conversation, and
+ * a mod's own module hooks cannot approve its own calls. So hooks/hooks.json carries PreToolUse hooks for every caller
+ * (owner decisions 2026-10-31): they allow the reads (work_room_read, work_inbox) and the presented receipt, and they
+ * put each write (answer, post, share, mark read) to the person in Claude's own permission dialog, after the pane's
+ * confirm press.
  */
 
 export const PANE = 'work-room'
 const TITLE = 'Work Room'
 const REFRESH_MS = 60_000
-const NO_CONNECTOR = 'Connect AI Gateway in Claude to use Work Room.'
+const NO_CONNECTOR = 'This session has no AI Gateway Work Room tools. Connect AI Gateway in Claude, reconnect it with /mcp, or start a new session.'
 
 const counts = atom({ plugin: 'ai-gateway-work-room', key: 'counts' } as const, { shares: 0, requests: 0 } as Counts)
 const activity = atom({ plugin: 'ai-gateway-work-room', key: 'activity' } as const, [] as RoomActivity[])
@@ -35,19 +41,19 @@ async function fail($: EngineInterface, answer: { state: Status['state']; detail
   await update($, status, () => ({ state: answer.state, detail: answer.state === 'no-connector' ? NO_CONNECTOR : answer.detail }))
 }
 
-/** Counts only: Room activity and open inbox items, never message bodies. */
+/** Counts only: Room activity and open inbox items, never message bodies. Each half shows even when the other fails. */
 export async function refreshCounts($: EngineInterface): Promise<void> {
   const [roomAnswer, inboxAnswer] = await Promise.all([
     callGateway($, 'work_room_read', { operation: 'activity', limit: 100 }),
     callGateway($, 'work_inbox', { direction: 'to_me' }),
   ])
+  if (roomAnswer.ok) await update($, activity, () => parseActivity(findPayload(roomAnswer.payload, v => Array.isArray(v.rooms))) ?? [])
+  if (inboxAnswer.ok) await update($, inbox, () => parseInbox(findPayload(inboxAnswer.payload, v => Array.isArray(v.items))) ?? [])
+  const rows = await read($, activity)
+  const items = await read($, inbox)
+  await update($, counts, () => ({ shares: rows.reduce((sum, row) => sum + row.unread, 0), requests: items.length }))
   if (!roomAnswer.ok) return fail($, roomAnswer)
   if (!inboxAnswer.ok) return fail($, inboxAnswer)
-  const rows = parseActivity(findPayload(roomAnswer.payload, v => Array.isArray(v.rooms))) ?? []
-  const items = parseInbox(findPayload(inboxAnswer.payload, v => Array.isArray(v.items))) ?? []
-  await update($, activity, () => rows)
-  await update($, inbox, () => items)
-  await update($, counts, () => ({ shares: rows.reduce((sum, row) => sum + row.unread, 0), requests: items.length }))
   await update($, status, () => ({ state: 'ok', detail: '' }))
 }
 
@@ -76,7 +82,10 @@ export async function reportPresented($: EngineInterface, roomId: string, ids: s
   const fresh = ids.filter(id => !presentedSent.has(id)).slice(0, 100)
   if (fresh.length === 0) return
   for (const id of fresh) presentedSent.add(id)
-  const sent = await callGateway($, 'work_room_receipt_report', { room_id: roomId, message_ids: fresh, state: 'presented' })
+  const name = (await read($, rooms))[roomId]?.info.name ?? 'a Room'
+  // The person's press on Open is what showed these messages, so the receipt carries it as consent.
+  const consent = `The user opened Room ${name} in the Work Room pane, which showed them ${fresh.length} message${fresh.length === 1 ? '' : 's'}.`
+  const sent = await callGateway($, 'work_room_receipt_report', { room_id: roomId, message_ids: fresh, state: 'presented' }, consent)
   if (!sent.ok) {
     for (const id of fresh) presentedSent.delete(id)
     return fail($, sent)

package/dist/src/adapters/claude-code/prompt-compiler.js

@@ -1,6 +1,6 @@
 import { renderBundleCorrectionBrief } from '../../verification/continuation-runner-contract.js';
 import { compilePrompt as compileBrief } from "../prompt-compiler.js";
-import { LOCAL_TOOL_GUIDANCE, repositoryScope } from "../local-tool-prompt.js";
+import { LOCAL_FIND_DISCOVERY, LOCAL_TOOL_GUIDANCE, repositoryScope } from "../local-tool-prompt.js";
 import { localToolNames } from "../../safety/local-tool-policy.js";
 // Claude's working directory is the job's private control directory, so without these rules it sends that directory's
 // absolute path or shell commands to the ai_local tools (P4 Investigate of Work Item 1c8026f1, 2026-10-28). Without the
@@ -9,11 +9,7 @@ import { localToolNames } from "../../safety/local-tool-policy.js";
 const CLAUDE_PATH_DISCOVERY = Object.freeze({
     "local-tools-v1": "local_search searches only inside that one file; there is no directory listing or repository-wide search, so take " +
         "file paths from the objective and from files you have read. ",
-    "local-tools-v2": "local_search searches only inside that one file. To find a file, use local_find with name for a literal part of " +
-        "its path, such as MigrateChannelLedgerCommand, or text for a literal it contains, such as migrate:channel-ledger, then " +
-        "local_search and local_read on the file found. local_find's path is an optional directory inside the approved scope, not a " +
-        "file; it skips vendor/ and node_modules/ unless that directory is inside them, and truncated: true means it stopped at a " +
-        "bound, so narrow path, name or text. "
+    "local-tools-v2": LOCAL_FIND_DISCOVERY
 });
 const claudePathRules = (inventory) => "## Local tool path rules\n" +
     "Every path argument is one checkout-relative file path inside the approved scope, without a leading slash: write " +

package/dist/src/adapters/codex/adapter.js

@@ -6,7 +6,7 @@ import { createJobSecurityReceipt } from '../../safety/job-security-receipt.js';
 import { requireJobSecurity } from '../../safety/job-security-policy.js';
 import { CODEX_UNSUPPORTED_DIAGNOSTIC } from "./compatibility.js";
 import { buildCodexInvocation } from "./config-builder.js";
-import { compileCodexPrompt, CODEX_REPORT_SCHEMA } from "./prompt-compiler.js";
+import { codexPromptToolInventory, compileCodexPrompt, CODEX_REPORT_SCHEMA } from "./prompt-compiler.js";
 import { CodexStreamParser } from "./stream-parser.js";
 function object(value) {
     if (!value || typeof value !== "object" || Array.isArray(value))
@@ -62,7 +62,7 @@ export class CodexAdapter {
             this.usingOfficialExec = true;
             let stage = 'codex_prompt';
             try {
-                const prompt = compileCodexPrompt(object(ctx.taskPackage), this.options.jobId);
+                const prompt = compileCodexPrompt(object(ctx.taskPackage), this.options.jobId, codexPromptToolInventory(approved.security_requirements));
                 stage = 'codex_launch';
                 this.handle = await this.ownedExec.start(ctx, this.options.jobId, prompt, this.startupAbort.signal);
                 this.receipt = this.ownedExec.receipt();
@@ -144,7 +144,7 @@ export class CodexAdapter {
             }
         };
         try {
-            const prompt = compileCodexPrompt(pkg, this.options.jobId);
+            const prompt = compileCodexPrompt(pkg, this.options.jobId, codexPromptToolInventory(approved.security_requirements));
             this.tools = this.options.createTools(pkg, approved);
             const endpoint = await this.tools.start();
             this.assertNotCancelled();

package/dist/src/adapters/codex/pre-model-gate.js

@@ -57,7 +57,8 @@ export function assessCodexPreModel(actual, expected, supported) {
         require(server.status === 'ready', 'MCP_NOT_READY');
         require(server.toolSchemaFingerprint === expected.toolSchemaFingerprint, 'MCP_SCHEMA_MISMATCH');
         // Exactly the tools of the inventory the expected fingerprint names (Work Decision f43e7aa0), never the other one.
-        const inventory = localToolInventoryFor(expected.toolSchemaFingerprint, fingerprint);
+        // The native session fingerprints the bare tool array (validateNativeTools), not the descriptor's {tools} form.
+        const inventory = localToolInventoryFor(expected.toolSchemaFingerprint, value => fingerprint(value.tools));
         require(inventory !== undefined && Array.isArray(server.tools) && server.tools.every(tool => typeof tool === 'string')
             && JSON.stringify([...server.tools].sort()) === JSON.stringify([...localToolNames(inventory)].sort()), 'MCP_TOOLS_MISMATCH');
     }

package/dist/src/adapters/codex/prompt-compiler.js

@@ -1,9 +1,26 @@
 import { renderBundleCorrectionBrief } from '../../verification/continuation-runner-contract.js';
 import { compilePrompt as compileBrief } from "../prompt-compiler.js";
-import { LOCAL_TOOL_GUIDANCE, repositoryScope } from "../local-tool-prompt.js";
-export function compileCodexPrompt(taskPackage, label) {
+import { LOCAL_FIND_DISCOVERY, LOCAL_TOOL_GUIDANCE, repositoryScope } from "../local-tool-prompt.js";
+import { localToolNames } from "../../safety/local-tool-policy.js";
+import { localToolInventoryFor } from "../../safety/local-tool-server.js";
+import { securityRequirementsFingerprint } from "../../safety/security-requirements.js";
+// local-tools-v1 has no discovery tool and its prompt is unchanged. With local-tools-v2 Codex must be told about local_find:
+// without it, the CHANNEL-4K Investigate of 2026-10-31 (job 4cec57c0) searched directories with local_search and read nothing.
+const CODEX_FILE_DISCOVERY = Object.freeze({
+    "local-tools-v1": "",
+    "local-tools-v2": `\n\n## Local file discovery\n${LOCAL_FIND_DISCOVERY.trimEnd()}`
+});
+/** The inventory the job's frozen descriptor names (exec-preflight.ts checks the same fingerprint); local-tools-v1 when it
+ * names none. The tool server enforces the inventory on its own, so this only picks the prompt text. */
+export function codexPromptToolInventory(securityRequirements) {
+    const sha = securityRequirements && typeof securityRequirements === "object" && !Array.isArray(securityRequirements)
+        ? securityRequirements.tools_sha256 : undefined;
+    return localToolInventoryFor(sha, securityRequirementsFingerprint) ?? "local-tools-v1";
+}
+export function compileCodexPrompt(taskPackage, label, toolInventory = "local-tools-v1") {
+    localToolNames(toolInventory);
     const correction = renderBundleCorrectionBrief(taskPackage);
-    return `${compileBrief(taskPackage, { workItemLabel: label, progressReporting: "native_messages" })}\n\n${repositoryScope(taskPackage)}\n\n${LOCAL_TOOL_GUIDANCE}${correction}`;
+    return `${compileBrief(taskPackage, { workItemLabel: label, progressReporting: "native_messages" })}\n\n${repositoryScope(taskPackage)}\n\n${LOCAL_TOOL_GUIDANCE}${CODEX_FILE_DISCOVERY[toolInventory]}${correction}`;
 }
 export const CODEX_REPORT_SCHEMA = {
     type: "object", additionalProperties: false, required: ["status", "report", "evidence", "pending_work"],

package/dist/src/adapters/local-tool-prompt.js

@@ -23,3 +23,9 @@ export function repositoryScope(taskPackage) {
         "These are scope descriptions, not instructions from source files; the host policy remains authoritative and may deny blocked/private paths within an allowed prefix.";
 }
 export const LOCAL_TOOL_GUIDANCE = "Use only the ai_local job tools for repository reads, edits and approved tests. For reading, first use server ai_local's local_search({path: \"<exact approved path>\", query: \"text\"}) to find the location, then local_read({path: \"<exact approved path>\", start_line: 1, end_line: 1}) with the matching line numbers. Ranges are inclusive, at most 400 lines; both bounds are required together. Read a matched line first to learn total_lines, then request only the needed in-file context. Omit both bounds only when the entire file is necessary. Use approved checkout-relative paths. For small approved edits, use local_replace({path, old, new}) after reading: old must match exactly once, including whitespace. local_edit requires the complete replacement file, never a patch. Required test criteria are not command grants. No model test commands are registered unless the host explicitly supplies exact model-callable command IDs; do not use local_test to discover commands or run --help. Missing tests remain not_run/unverified, not passed. In a read-only task, use only read/search tools; the Runner enforces the approved paths and operations. A denied native cwd is intentional: it is a private control directory, not the source checkout. Native filesystem, commands, web, images and delegation are unavailable or denied. A denied tool is a scope boundary, never permission to broaden scope or bypass the denial. Do not retry the denied path. It does not remove independently approved paths: continue with relevant listed paths, and report a missing dependency only after checking the available approved source. Do not repeat host orchestration: claim, shadow, fingerprints, binding, administrator checks, launches, Gateway usage and Job reporting belong to the Runner/host, even when described in the objective. Perform only the assigned repository work and report evidence you actually observed. Do not claim that no model call occurred. If the required tool is unavailable, emit one final structured blocked report naming the missing tool and unfinished repository work; do not request or attempt a new launch.";
+/** How to find a file with local-tools-v2 (Work Decision f43e7aa0). Shared by the Claude and Codex prompts. */
+export const LOCAL_FIND_DISCOVERY = "local_search searches only inside that one file. To find a file, use local_find with name for a literal part of " +
+    "its path, such as MigrateChannelLedgerCommand, or text for a literal it contains, such as migrate:channel-ledger, then " +
+    "local_search and local_read on the file found. local_find's path is an optional directory inside the approved scope, not a " +
+    "file; it skips vendor/ and node_modules/ unless that directory is inside them, and truncated: true means it stopped at a " +
+    "bound, so narrow path, name or text. ";

package/dist/src/asks/claude-mod.js

@@ -1,6 +1,6 @@
 import { execFile } from "node:child_process";
 import { constants } from "node:fs";
-import { access, cp, mkdir, readdir, rm, stat } from "node:fs/promises";
+import { access, cp, mkdir, readdir, rm, stat, writeFile } from "node:fs/promises";
 import { basename, delimiter, isAbsolute, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { packageVersion } from "../package-version.js";
@@ -13,8 +13,14 @@ import { packageVersion } from "../package-version.js";
  * Only a CLI that loads `modules` hooks can install it. On 2026-10-30 the terminal `claude` 2.1.212 could not, and the
  * desktop-bundled 2.1.299 and 2.1.308 could; the desktop app bundles one even when the terminal `claude` is older.
  * A mod the person disabled stays disabled: setup reinstalls only a missing or older one.
+ *
+ * Every setup installs the mod, with or without --integrations (owner decision 2026-10-31), unless the person removed
+ * it with `integrations remove claude`. That removal leaves <stateRoot>/claude-mod-removed, which
+ * `integrations install claude` and uninstall delete again.
  */
 export const CLAUDE_MOD_NAME = "ai-gateway-work-room";
+/** <stateRoot>/claude-mod-removed: the person removed the mod, so setup leaves it out until they install it again. */
+export const CLAUDE_MOD_REMOVED_FILE = "claude-mod-removed";
 export const CLAUDE_MOD_MARKETPLACE = "mtec-ai-gateway";
 const ID = `${CLAUDE_MOD_NAME}@${CLAUDE_MOD_MARKETPLACE}`;
 const MIN_VERSION = [2, 1, 299];
@@ -126,6 +132,20 @@ export async function removeClaudeMod(deps) {
     await rm(join(deps.stateRoot, "claude-mod"), { recursive: true, force: true }).catch(() => undefined);
     return { state: "removed", ...(cli ? { cli } : {}) };
 }
+/** Whether the person removed the mod with `integrations remove claude` since it was last installed on request. */
+export async function claudeModRemovedByPerson(stateRoot) {
+    return stat(join(stateRoot, CLAUDE_MOD_REMOVED_FILE)).then(entry => entry.isFile(), () => false);
+}
+/** Records or clears the person's removal. */
+export async function setClaudeModRemovedByPerson(stateRoot, removed) {
+    const file = join(stateRoot, CLAUDE_MOD_REMOVED_FILE);
+    if (!removed) {
+        await rm(file, { force: true });
+        return;
+    }
+    await mkdir(stateRoot, { recursive: true });
+    await writeFile(file, "Removed with integrations remove claude. Run integrations install claude to add the Work Room pane again.\n", { mode: 0o600 });
+}
 /** What `plugin list` says of the mod. Never throws. */
 export async function claudeModStatus(deps) {
     const cli = await findClaudeCli(deps);

package/dist/src/asks/commands.js

@@ -1,7 +1,7 @@
 import { readdir, rm } from "node:fs/promises";
 import { join } from "node:path";
 import { ASKS_FILE } from "./store.js";
-import { claudeModDeps, claudeModStatus, installClaudeMod, removeClaudeMod } from "./claude-mod.js";
+import { claudeModDeps, claudeModRemovedByPerson, claudeModStatus, installClaudeMod, removeClaudeMod, setClaudeModRemovedByPerson } from "./claude-mod.js";
 import { homeDirectory, installIntegration, integrationStatus, removeIntegration, removeShimIfUnused } from "./integrations.js";
 import { APPS, isApp } from "./types.js";
 import { deleteGuideState } from "../guide/files.js";
@@ -89,6 +89,16 @@ async function claudeMod(env, stateRoot, act) {
         return { state: "failed", reason: errorCode(error) };
     }
 }
+/**
+ * setup's Work Room mod: installed on every setup, with or without --integrations (owner decision 2026-10-31), unless
+ * the person removed it with `integrations remove claude`. Never throws.
+ */
+export async function setupClaudeMod(env, stateRoot) {
+    if (await claudeModRemovedByPerson(stateRoot)) {
+        return { state: "skipped", reason: "removed with integrations remove claude; run integrations install claude to add it again" };
+    }
+    return claudeMod(env, stateRoot, installClaudeMod);
+}
 /** The Work Room mod's state, for integrations status and doctor. It runs the Claude CLI, so the daemon never calls it. */
 export const claudeModStatusOf = (env, stateRoot) => claudeMod(env, stateRoot, claudeModStatus);
 async function attempt(app, env, stateRoot, change) {
@@ -104,7 +114,10 @@ export async function installIntegrations(apps, env, stateRoot) {
     for (const app of apps) {
         const result = await attempt(app, env, stateRoot, () => installIntegration(app, env, stateRoot));
         const done = result.error === undefined ? { ...result, action: NEXT_STEP[app] } : result;
-        // The hooks first: they work without the mod, and a Claude CLI too old for the mod leaves them in place.
+        // The hooks first: they work without the mod, and a Claude CLI too old for the mod leaves them in place. Installing
+        // on request undoes an earlier removal, so setup keeps the mod again.
+        if (app === "claude")
+            await setClaudeModRemovedByPerson(stateRoot, false).catch(() => undefined);
         results.push(app === "claude" ? { ...done, mod: await claudeMod(env, stateRoot, installClaudeMod) } : done);
     }
     return results;
@@ -163,6 +176,8 @@ export async function removeAsksInstall(env, stateRoot) {
     const results = [];
     for (const app of APPS)
         results.push(await removeAsks(app, env, stateRoot));
+    // Uninstall removes everything, so a later setup starts fresh and installs the Work Room mod again.
+    await setClaudeModRemovedByPerson(stateRoot, false).catch(() => undefined);
     // A hook left behind (an unreadable Codex hooks file) keeps its shim, which then prints nothing and exits 0.
     await removeShimIfUnused(env, stateRoot).catch(() => false);
     await rm(join(stateRoot, ASKS_FILE), { force: true });
@@ -187,6 +202,9 @@ export async function runIntegrationsCommand(argv, io) {
         else if (parsed.action === "remove") {
             for (const app of parsed.apps)
                 results.push(await removeAsks(app, io.env, io.stateRoot));
+            // The person removed the Work Room mod: setup leaves it out until integrations install claude.
+            if (parsed.apps.includes("claude"))
+                await setClaudeModRemovedByPerson(io.stateRoot, true).catch(() => undefined);
             await removeShimIfUnused(io.env, io.stateRoot).catch(() => false);
         }
         else {

package/dist/src/cli.js

@@ -32,7 +32,7 @@ import { verifyPackagedHook } from "./safety/hook-command.js";
 import { access, mkdir, rm } from "node:fs/promises";
 import { buildMessengerDaemon } from "./asks/messenger.js";
 import { runHookClient } from "./asks/hook-client.js";
-import { installGuideIntegrations, installIntegrations, parseFeatures, parseSetupIntegrations, removeAsksInstall, removeGuideInstall, runIntegrationsCommand } from "./asks/commands.js";
+import { installGuideIntegrations, installIntegrations, parseFeatures, parseSetupIntegrations, removeAsksInstall, removeGuideInstall, runIntegrationsCommand, setupClaudeMod } from "./asks/commands.js";
 import { asksDoctorReport } from "./asks/doctor.js";
 import { guideDoctorReport, guideReportShown } from "./guide/doctor.js";
 import { runClaudeReleaseCommand } from "./commands/claude-release.js";
@@ -42,7 +42,16 @@ import { localToolSelfTest } from "./safety/local-tool-self-test.js";
 function localToolsReport(result) {
     if (result.status === "passed")
         return { ...result };
-    return { ...result, action: `Local file tools failed on this Mac (${result.tool ?? "setup"}: ${result.detail ?? "unknown"}), so a job here cannot read source. Send this doctor output to the AI Gateway owner.` };
+    return { ...result, action: localToolsAction(result) };
+}
+function localToolsAction(result) {
+    const failed = `Local file tools failed on this Mac (${result.tool ?? "setup"}: ${result.detail ?? "unknown"}), so a job here cannot read source.`;
+    // A bare restricted node that also fails cannot start in the sandbox at all. On 2026-10-31 Homebrew's node did this on
+    // an employee Mac: it maps libraries from /opt/homebrew, and the sandbox maps only /usr/lib and /System/Library.
+    if (result.sandbox?.status === "failed") {
+        return `${failed} The Node at ${result.node} cannot start inside the runner's restricted sandbox, which loads libraries only from /usr/lib and /System/Library; a Node built against libraries elsewhere, such as Homebrew's, stops there. Install an official Node.js build from https://nodejs.org, then rerun setup and doctor with its bin directory first on PATH, for example: PATH="<official Node>/bin:$PATH" npx mtech-ai-local-runner@latest setup`;
+    }
+    return `${failed} Send this doctor output to the AI Gateway owner.`;
 }
 function hookAction(result) {
     return result.reason === "invalid_command"
@@ -252,6 +261,15 @@ export async function main(argv, env, io = {}) {
                         stdout(JSON.stringify({ ok: false, configured: false, hook: hookReport(hook), action: hookAction(hook) }));
                         throw new Error(`The PreToolUse hook did not deny the probe call (hook_not_enforcing: ${hook.reason})`);
                     }
+                    // A full runner whose job file tools cannot read here would take jobs and stop executor_blocked on every one
+                    // (Work Item 6f9e64ae), so setup refuses before login, as for the hook.
+                    const tools = await (io.localToolSelfTest ?? localToolSelfTest)(config.workspaceRoot)
+                        .catch(error => ({ status: "failed", detail: error instanceof Error ? error.message : String(error), node: process.execPath }));
+                    if (tools.status !== "passed") {
+                        const report = localToolsReport(tools);
+                        stdout(JSON.stringify({ ok: false, configured: false, local_tools: report, action: report.action }));
+                        throw new Error(`The job file tools failed on this Mac (local_tools_failed: ${tools.tool ?? "setup"}: ${tools.detail ?? "unknown"})`);
+                    }
                 }
                 const loginCode = await handleLogin(config, stdout, stderr, fetchFn, io.browserOpener);
                 if (loginCode !== 0)
@@ -278,12 +296,14 @@ export async function main(argv, env, io = {}) {
                 const features = requestedFeatures ?? ["asks"];
                 const integrations = features.includes("asks") ? await installIntegrations(requestedIntegrations ?? [], env, config.stateRoot) : [];
                 const guide = features.includes("guide") ? await installGuideIntegrations(requestedIntegrations ?? [], env, config.stateRoot) : undefined;
+                // The Work Room pane goes with every setup (owner decision 2026-10-31); --integrations claude has just installed it.
+                const workRoomPane = integrations.some(report => report.app === "claude" && report.mod !== undefined) ? undefined : await setupClaudeMod(env, config.stateRoot);
                 // The LaunchAgent runs a copy under releases/<version>, never the npx cache that may have run setup.
                 const daemonExecutable = await (io.installRelease ?? installStableRelease)({ entry: process.argv[1], stateRoot: config.stateRoot });
                 await launchd.install(daemonExecutable, config.stateRoot);
                 stdout(JSON.stringify(mode === "full"
-                    ? { configured: true, mode, runnerId: registered.runner.id, adapters, integrations, ...(guide ? { guide } : {}), daemonExecutable }
-                    : { configured: true, mode, runnerId: registered.runner.id, adapters: adapterDiagnosticsWithRemedies(detected), integrations, ...(guide ? { guide } : {}), daemonExecutable,
+                    ? { configured: true, mode, runnerId: registered.runner.id, adapters, integrations, ...(guide ? { guide } : {}), ...(workRoomPane ? { workRoomPane } : {}), daemonExecutable }
+                    : { configured: true, mode, runnerId: registered.runner.id, adapters: adapterDiagnosticsWithRemedies(detected), integrations, ...(guide ? { guide } : {}), ...(workRoomPane ? { workRoomPane } : {}), daemonExecutable,
                         action: "No executor is admitted on this Mac, so the runner is set up as a messenger: it delivers AI Gateway asks and opens sessions, and runs no jobs. Resolve the adapter diagnostics, then rerun setup to run jobs." }));
                 return 0;
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.79",
+  "version": "0.1.81",
   "private": false,
   "license": "UNLICENSED",
   "bin": {