mtech-ai-local-runner 0.1.8 → 0.1.11

package/README.md

@@ -10,12 +10,60 @@ The package stores safe runner configuration locally and keeps OAuth refresh cre
 
 Public npm installation requires no npm account or publishing OTP. Setup requires Gateway OAuth login, and local Claude Code must already be authenticated (`claude auth status`).
 
-## 0.1.8 (release candidate)
+## 0.1.10: enforced PreToolUse hook
+
+Earlier releases configured a hook command that the shell could not run, so Claude
+Code ran tool calls without the hook policy. This release runs the hook through
+Node. Unless the packaged hook denies a `git push origin HEAD` probe, `setup` and
+the daemon stop and `doctor` reports `hook_not_enforcing`.
+
+## 0.1.9: gated Codex foundation and shared CLI security
+
+This package includes the production Codex host/probe and common authenticated
+four-tool policy, command/dependency pins, owned cancellation, retained-session
+checks and security receipts. The source-reviewed Codex release registry is empty:
+Codex cannot advertise or execute until an exact binary, model, policy and release
+manifest have been genuinely reviewed. Do not enable a Gateway flag to bypass it.
+
+**Upgrade limitation:** this package also closes the Claude adapter until its
+reviewed native evidence is available. Do not replace a working 0.1.8 daemon as
+part of the Codex-disabled Gateway delivery. Gateway retains the legacy Claude
+prepare/launch and approval payloads unless an explicit Claude security manifest
+is configured; Codex always requires the new security descriptor. Publication is
+separate from an authorized daemon upgrade or actual account/model acceptance.
+
+The Codex probe only reads the original supported file-backend login status and
+never runs vendor login/status, refreshes tokens, writes credentials or switches
+backends. Keychain-only/unknown backends remain unavailable rather than being
+migrated. Native CLI startup can still perform vendor-managed refresh; a no-model
+inspection is not a no-refresh guarantee. Keep the existing login and obtain the
+separate account/activation approval before actual CLI startup.
+
+The supported policy mode acknowledges vendor runtime/authentication/extension/
+IPC/network trust; it does not claim total broker-only isolation. Synthetic test
+receipts never authorize production. The repository report `docs/ai-ops-gateway/codex-production-host-validation.md`
+records the tested scope and remaining rollout gates.
+
+The intended employee request after rollout is: “Use my local Codex for Billing.
+Inspect the payment entry points without editing files, and return the findings
+and verification here.” Gateway OAuth signs the employee into Gateway; a separate
+`codex login` using ChatGPT authorizes Codex. An OpenAI API key is not a fallback.
+If both executors are usable, select one before approval; changing the executor
+or server-resolved model requires a new launch approval.
+
+Source operations use authenticated job-only tools. Registered test programs need
+exact executable/argv and explicit dependency-file read grants; source writes,
+network, ambient credentials and child process creation are denied to those test
+programs. Broad npm/project test runners are not automatically supported. Missing
+grants produce a visible blocked result. Actual employee-local task duration and
+count remain unbounded; preparation retains the 0.1.8 limits.
+
+## 0.1.8
 
 - Report safe preparation stage/tool/error categories and settle known failures instead of silently reclaiming the same job forever.
 - Bound preparation to 15 minutes, retain terminal receipts across connection failures, and halt on unknown binding outcomes until reconciled.
 - Pair with Gateway cancellation propagation and three-delivery preparation bounds. Actual approved unbounded employee-local Claude execution remains unbounded.
-- Prepared locally; npm publication and daemon upgrade are separate actions. Keep a stopped runner stopped until its cancelled job is confirmed terminal on Gateway.
+- npm publication and daemon upgrade are separate actions. Keep a stopped runner stopped until its cancelled job is confirmed terminal on Gateway.
 
 ## 0.1.7
 
@@ -46,8 +94,8 @@ The relay binds only to loopback. Local capabilities are stored in private mode-
 Existing employees can upgrade their installed daemon with:
 
 ```bash
-npx mtech-ai-local-runner@0.1.7 setup
-npx mtech-ai-local-runner@0.1.7 doctor
+npx mtech-ai-local-runner setup
+npx mtech-ai-local-runner doctor
 ```
 
 ### Cancellation and preparation failures
@@ -76,3 +124,7 @@ These preparation controls end at binding and do not impose time, turn, token
 or cost termination limits on an approved unbounded employee-local Claude run.
 Existing generation fencing, scope restrictions, cancellation and audit remain
 in force.
+
+### Manual Codex pilot (0.1.11)
+
+The reviewed manual Codex path preserves the existing CLI and ChatGPT login. It is separate from unattended daemon readiness. After the exact CLI/native reader and Gateway release are installed, an employee-authorized foreground pilot uses `mtec-ai-local-runner manual-codex --job-id=<approved Job UUID>`. It refuses a running daemon, unresolved recovery state, unknown release/account or a different Job. It does not stop services or alter personal settings. A direct administrator policy inventory occurs just before the approved execution; historical inventory is not continuous MDM monitoring. The Gateway OAuth client refuses refresh in this manual command. Actual vendor account startup may still refresh shared credentials and requires disclosure in the exact launch approval.

package/dist/src/adapters/claude-code/adapter.js

@@ -1,17 +1,16 @@
 import path from "node:path";
-import { existsSync } from "node:fs";
+import { requireSecurityRequirements } from '../../safety/security-requirements.js';
+import { createJobSecurityReceipt } from '../../safety/job-security-receipt.js';
 import { isTerminalEventType } from "../../protocol.js";
 import { parseClaudeLine } from "./stream-parser.js";
 import { compilePrompt } from "./prompt-compiler.js";
 import { completionEvent } from "./completion-report.js";
-import { buildHookPolicy, encodeHookPolicy } from "../../safety/hook-policy-builder.js";
-import { HOOK_POLICY_ENV_VAR } from "../../safety/hook-cli.js";
-const ALLOWED_ENV_KEYS = ["PATH", "HOME", "USER", "LOGNAME", "LANG", "LC_ALL", "TMPDIR", "NODE_ENV"];
+import { requireJobSecurity } from "../../safety/job-security-policy.js";
+import { HOOK_POLICY_ENV_VAR, buildHookPolicy, encodeHookPolicy } from "../../safety/hook-policy-builder.js";
+import { formatHookCommand } from "../../safety/hook-command.js";
+const ALLOWED_ENV_KEYS = ["PATH", "HOME", "USER", "LOGNAME", "LANG", "LC_ALL", "TMPDIR", "NODE_ENV", "CLAUDE_CONFIG_DIR"];
 const ALLOWED_SUPERVISOR_COMMANDS = new Set(["continue", "answer_question", "request_revision", "request_checkpoint", "submit_for_review"]);
-const DEFAULT_BUILTIN_TOOL_SURFACE = ["Bash", "Edit", "Write", "MultiEdit", "NotebookEdit", "Read", "Glob", "Grep"];
-function defaultPathExists(p) {
-    return existsSync(p);
-}
+const LOCAL_NAMES = ["local_read", "local_search", "local_edit", "local_test"].map(name => `mcp__ai_local__${name}`);
 function allowlistedEnv(env) {
     const result = {};
     for (const key of ALLOWED_ENV_KEYS) {
@@ -38,18 +37,14 @@ function isUnboundedLocalExecution(taskPackage) {
         && execution?.runtime_adapter === "claude_code_cli"
         && execution?.limits_mode === "unbounded";
 }
-function contractReadTools(taskPackage, registeredReadTools) {
-    const pkg = taskPackage;
-    const contract = pkg.contract;
-    const policy = contract?.policy;
-    const allowed = new Set(Array.isArray(policy?.allowed_gateway_tools)
-        ? policy.allowed_gateway_tools.filter((tool) => typeof tool === "string")
-        : []);
-    return [...new Set(registeredReadTools.filter((tool) => allowed.has(tool)))];
-}
 export class ClaudeCodeAdapter {
     options;
     handle = null;
+    tools;
+    cancelled = false;
+    started = false;
+    receipt;
+    securityReceipt() { return this.receipt ? structuredClone(this.receipt) : undefined; }
     constructor(options) {
         this.options = options;
     }
@@ -58,6 +53,31 @@ export class ClaudeCodeAdapter {
         if (!resolvedModelId) {
             throw new Error("refusing to start: no Gateway-resolved model ID was supplied");
         }
+        if (this.started)
+            throw new Error("adapter has already been started");
+        this.started = true;
+        const generation = ctx.generation;
+        if (!Number.isSafeInteger(generation) || generation === undefined || generation < 1)
+            throw new Error("JOB_SECURITY_REJECTED");
+        const assertAdmission = () => {
+            requireJobSecurity(this.options.securityPolicy, { adapterId: "claude_code_cli", adapterVersion: "1", jobId: this.options.jobId ?? ctx.bindingId, modelId: resolvedModelId, generation });
+            if (ctx.approvedTaskPackage?.resolved_provider !== "anthropic" || ctx.approvedTaskPackage?.resolved_model_id !== resolvedModelId
+                || ctx.approvedTaskPackage?.repository?.base_commit_sha !== this.options.securityPolicy.pin.sourceSha)
+                throw new Error("SECURITY_REQUIREMENTS_REJECTED");
+            requireSecurityRequirements(ctx.approvedTaskPackage?.security_requirements, { adapterId: "claude_code_cli", adapterVersion: "1", requirementsSha256: this.options.securityPolicy.pin.requirementsSha256 });
+        };
+        assertAdmission();
+        if (!ctx.securityBinding)
+            throw new Error('SECURITY_REQUIREMENTS_REJECTED');
+        this.receipt = createJobSecurityReceipt(this.options.securityPolicy, { jobId: this.options.jobId ?? ctx.bindingId, generation, modelId: resolvedModelId, sourceSha: this.options.securityPolicy.pin.sourceSha, ...ctx.securityBinding, requirements: ctx.approvedTaskPackage?.security_requirements });
+        const pkg = ctx.taskPackage;
+        const repos = pkg.repositories;
+        if (!Array.isArray(repos) || repos.length !== 1 || repos[0]?.base_commit_sha !== this.options.securityPolicy.pin.sourceSha)
+            throw new Error("JOB_SECURITY_REJECTED");
+        const cwd = this.options.cwd;
+        const rel = cwd ? path.relative(path.resolve(this.options.worktreeRoot), path.resolve(cwd)) : "";
+        if (!cwd || !path.isAbsolute(cwd) || rel === "" || (!rel.startsWith(".." + path.sep) && rel !== ".." && !path.isAbsolute(rel)))
+            throw new Error("trusted cwd must live outside the assigned worktree");
         const unbounded = isUnboundedLocalExecution(ctx.taskPackage);
         if (!unbounded && (!Number.isFinite(this.options.maxBudgetUsd) || this.options.maxBudgetUsd <= 0)) {
             throw new Error("refusing to start: no positive remaining contract budget was supplied");
@@ -68,66 +88,75 @@ export class ClaudeCodeAdapter {
         if (!ctx.sessionId) {
             throw new Error("refusing to start: no runner-generated session ID was supplied");
         }
-        const hookPath = this.requireTrustedHookPath();
+        const hookCommand = this.requireTrustedHookCommand();
         const prompt = compilePrompt(ctx.taskPackage, { workItemLabel: this.options.workItemLabel });
-        const allowedReadTools = contractReadTools(ctx.taskPackage, this.options.registeredReadTools);
-        const mcpConfigPath = this.options.writeMcpConfig({ tools: { allow: allowedReadTools } });
-        const maxBudgetUsd = unbounded
-            ? null
-            : Math.min(this.options.maxBudgetUsd, contractBudget(ctx.taskPackage));
-        const hookPolicy = buildHookPolicy({
-            taskPackage: ctx.taskPackage,
-            worktreeRoot: this.options.worktreeRoot,
-            registeredReadTools: this.options.registeredReadTools,
-            generatedPaths: [mcpConfigPath],
-        });
-        const settings = {
-            hooks: {
-                PreToolUse: [{ matcher: "*", hooks: [{ type: "command", command: hookPath }] }],
-            },
-        };
-        const builtinToolSurface = this.options.builtinToolSurface ?? DEFAULT_BUILTIN_TOOL_SURFACE;
-        const mcpServerName = this.options.mcpServerName ?? "ai_gateway";
-        const toolSurface = [
-            ...builtinToolSurface,
-            ...allowedReadTools.map((tool) => `mcp__${mcpServerName}__${tool}`),
-        ];
-        const args = [
-            "--print",
-            "--input-format", "stream-json",
-            "--output-format", "stream-json",
-            "--verbose",
-            "--include-partial-messages",
-            "--no-chrome",
-            "--permission-mode", "bypassPermissions",
-            "--dangerously-skip-permissions",
-            "--model", resolvedModelId,
-            ...(maxBudgetUsd === null ? [] : ["--max-budget-usd", String(maxBudgetUsd)]),
-            "--name", this.options.workItemLabel.trim().slice(0, 80) || `work-item-${ctx.bindingId.slice(0, 8)}`,
-            "--strict-mcp-config",
-            "--mcp-config", mcpConfigPath,
-            "--settings", JSON.stringify(settings),
-            "--setting-sources", "user",
-            "--disable-slash-commands",
-            "--tools", builtinToolSurface.join(","),
-            "--allowedTools", toolSurface.join(","),
-        ];
-        if (ctx.resumeSessionId) {
-            args.push("--resume", ctx.resumeSessionId);
+        try {
+            if (!this.options.createTools || !this.options.writeLocalMcpConfig)
+                throw new Error("job-local tool setup is required");
+            this.tools = await this.options.createTools(ctx, pkg, ctx.approvedTaskPackage ?? {});
+            if (this.cancelled)
+                throw new Error("adapter startup cancelled");
+            const endpoint = await this.tools.start();
+            if (this.cancelled)
+                throw new Error("adapter startup cancelled");
+            const mcpConfigPath = this.options.writeLocalMcpConfig(endpoint);
+            const maxBudgetUsd = unbounded
+                ? null
+                : Math.min(this.options.maxBudgetUsd, contractBudget(ctx.taskPackage));
+            const hookPolicy = buildHookPolicy({
+                taskPackage: ctx.taskPackage,
+                worktreeRoot: this.options.worktreeRoot,
+                registeredReadTools: this.options.registeredReadTools,
+                generatedPaths: [mcpConfigPath],
+            });
+            const settings = {
+                hooks: {
+                    PreToolUse: [{ matcher: "*", hooks: [{ type: "command", command: hookCommand }] }],
+                },
+            };
+            const args = [
+                "--print",
+                "--input-format", "stream-json",
+                "--output-format", "stream-json",
+                "--verbose",
+                "--include-partial-messages",
+                "--no-chrome",
+                "--permission-mode", "default",
+                "--model", resolvedModelId,
+                ...(maxBudgetUsd === null ? [] : ["--max-budget-usd", String(maxBudgetUsd)]),
+                "--name", this.options.workItemLabel.trim().slice(0, 80) || `work-item-${ctx.bindingId.slice(0, 8)}`,
+                "--strict-mcp-config",
+                "--mcp-config", mcpConfigPath,
+                "--settings", JSON.stringify(settings),
+                "--setting-sources", "",
+                "--disable-slash-commands",
+                "--tools", "",
+                "--allowedTools", LOCAL_NAMES.join(","),
+            ];
+            if (ctx.resumeSessionId) {
+                args.push("--resume", ctx.resumeSessionId);
+            }
+            else {
+                args.push("--session-id", ctx.sessionId);
+            }
+            const env = {
+                ...allowlistedEnv(this.options.env),
+                [HOOK_POLICY_ENV_VAR]: encodeHookPolicy(hookPolicy),
+            };
+            assertAdmission();
+            const handle = this.options.processHost.spawn(this.options.binaryPath ?? "claude", args, {
+                cwd,
+                env,
+            });
+            this.handle = handle;
+            if (this.cancelled)
+                throw new Error("adapter startup cancelled");
+            handle.stdin.write(`${JSON.stringify({ type: "user", message: { role: "user", content: [{ type: "text", text: prompt }] } })}\n`);
         }
-        else {
-            args.push("--session-id", ctx.sessionId);
+        catch (error) {
+            await this.cleanup();
+            throw error;
         }
-        const env = {
-            ...allowlistedEnv(this.options.env),
-            [HOOK_POLICY_ENV_VAR]: encodeHookPolicy(hookPolicy),
-        };
-        const handle = this.options.processHost.spawn(this.options.binaryPath ?? "claude", args, {
-            cwd: this.options.worktreeRoot,
-            env,
-        });
-        this.handle = handle;
-        handle.stdin.write(`${JSON.stringify({ type: "user", message: { role: "user", content: [{ type: "text", text: prompt }] } })}\n`);
     }
     async *events() {
         const handle = this.requireHandle();
@@ -137,36 +166,41 @@ export class ClaudeCodeAdapter {
             exitInfo.signal = signal;
         });
         let sawTerminal = false;
-        for await (const line of handle.stdout) {
-            let message;
-            try {
-                const value = JSON.parse(line);
-                if (!value || typeof value !== "object" || Array.isArray(value))
+        try {
+            for await (const line of handle.stdout) {
+                let message;
+                try {
+                    const value = JSON.parse(line);
+                    if (!value || typeof value !== "object" || Array.isArray(value))
+                        continue;
+                    message = value;
+                }
+                catch {
                     continue;
-                message = value;
-            }
-            catch {
-                continue;
-            }
-            // A nested agent message is not evidence that the executor has finished.
-            if (message.parent_tool_use_id != null)
-                continue;
-            let parsed = parseClaudeLine(line, this.options.worktreeRoot);
-            if (!parsed)
-                continue;
-            if (parsed.eventType === "completed") {
-                parsed = completionEvent(message.result, parsed.payload?.cost_usd);
+                }
+                // A nested agent message is not evidence that the executor has finished.
+                if (message.parent_tool_use_id != null)
+                    continue;
+                let parsed = parseClaudeLine(line, this.options.worktreeRoot);
+                if (!parsed)
+                    continue;
+                if (parsed.eventType === "completed") {
+                    parsed = completionEvent(message.result, parsed.payload?.cost_usd);
+                }
+                if (isTerminalEventType(parsed.eventType))
+                    sawTerminal = true;
+                yield parsed;
+                if (sawTerminal) {
+                    handle.stdin.end();
+                    return;
+                }
             }
-            if (isTerminalEventType(parsed.eventType))
-                sawTerminal = true;
-            yield parsed;
-            if (sawTerminal) {
-                handle.stdin.end();
-                return;
+            if (!sawTerminal) {
+                yield { eventType: "failed", summary: `claude process exited unexpectedly (code ${exitInfo.code ?? "unknown"})` };
             }
         }
-        if (!sawTerminal) {
-            yield { eventType: "failed", summary: `claude process exited unexpectedly (code ${exitInfo.code ?? "unknown"})` };
+        finally {
+            await this.cleanup();
         }
     }
     async command(command) {
@@ -184,29 +218,37 @@ export class ClaudeCodeAdapter {
         handle.stdin.write(`${JSON.stringify({ type: "user", message: { role: "user", content: [{ type: "text", text: JSON.stringify(payload) }] } })}\n`);
     }
     async cancel() {
-        const handle = this.requireHandle();
-        handle.stdin.end();
-        handle.kill("SIGTERM");
+        this.cancelled = true;
+        await this.cleanup();
     }
-    requireTrustedHookPath() {
-        const hookPath = this.options.hookExecutablePath;
-        if (!hookPath || !path.isAbsolute(hookPath)) {
-            throw new Error("refusing to start: PreToolUse hook executable path must be an absolute path");
-        }
-        if (!/^[A-Za-z0-9._/:\\-]+$/.test(hookPath)) {
-            throw new Error("refusing to start: PreToolUse hook must use a safe executable path without shell metacharacters");
+    async cleanup() {
+        const tools = this.tools;
+        const handle = this.handle;
+        this.tools = undefined;
+        this.handle = null;
+        try {
+            tools?.revoke();
         }
-        const worktreeRoot = path.resolve(this.options.worktreeRoot);
-        const rel = path.relative(worktreeRoot, path.resolve(hookPath));
-        const isInsideWorktree = rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel));
-        if (isInsideWorktree) {
-            throw new Error("refusing to start: PreToolUse hook executable must live outside the assigned worktree");
-        }
-        const exists = this.options.hookExecutableExists ?? defaultPathExists;
-        if (!exists(hookPath)) {
-            throw new Error("refusing to start: PreToolUse hook executable was not found at the trusted path");
+        finally {
+            try {
+                handle?.stdin.end();
+            }
+            finally {
+                try {
+                    handle?.kill("SIGKILL");
+                }
+                finally {
+                    await tools?.close();
+                }
+            }
         }
-        return hookPath;
+    }
+    /** Claude Code treats a hook it cannot run as no objection, so the hook runs through Node. */
+    requireTrustedHookCommand() {
+        return formatHookCommand({
+            nodeExecutablePath: this.options.hookNodeExecutablePath ?? process.execPath,
+            hookScriptPath: this.options.hookExecutablePath,
+        }, { worktreeRoot: this.options.worktreeRoot, exists: this.options.hookExecutableExists });
     }
     requireHandle() {
         if (!this.handle) {

package/dist/src/adapters/claude-code/completion-report.js

@@ -1,64 +1,2 @@
-import { MAX_EVENT_SUMMARY_CHARS } from "../../protocol.js";
-const MAX_EVIDENCE_ITEMS = 20;
-const MAX_EVIDENCE_CHARS = 500;
-const MAX_REPORT_ENVELOPE_CHARS = 16_000;
-export const COMPLETION_REPORT_NOTICE = "Do the assigned work yourself using the available tools; do not delegate or start background work. " +
-    "Do not report completed while waiting for results, tests, or another agent. " +
-    "Your final response must be one JSON object, without Markdown fences: " +
-    '{"status":"completed","report":"actual findings and results","evidence":["file path and observed finding, or command and actual result"],"pending_work":[]}. ' +
-    `The report must be nonempty and at most ${MAX_EVENT_SUMMARY_CHARS} characters. ` +
-    `Include 1-${MAX_EVIDENCE_ITEMS} nonempty evidence strings, each at most ${MAX_EVIDENCE_CHARS} characters. ` +
-    "Address the assigned objective and each applicable acceptance criterion with observed evidence, not a plan or promise. " +
-    "Only attest to executor work you observed; Gateway records transport, completion, and review receipts separately. " +
-    'If the task is unfinished, use "status":"blocked" and list the remaining work in "pending_work". ' +
-    "An incomplete or missing report is a failed execution, never a successful investigation artifact.";
-function boundedText(value, max) {
-    return typeof value === "string" && value.trim().length > 0 && value.length <= max;
-}
-/** Validate the full final result before truncation; never publish malformed/interim output. */
-export function completionEvent(result, costUsd) {
-    const usage = typeof costUsd === "number" && Number.isFinite(costUsd) && costUsd >= 0
-        ? { cost_usd: costUsd }
-        : {};
-    const failed = {
-        eventType: "failed",
-        summary: "completion report is missing, incomplete or invalid",
-        payload: usage,
-    };
-    if (typeof result !== "string" || result.length > MAX_REPORT_ENVELOPE_CHARS)
-        return failed;
-    let report;
-    try {
-        report = JSON.parse(result);
-    }
-    catch {
-        // Claude may wrap the final report in one Markdown fence after a short
-        // explanation. Accept framing only; retain every completion/evidence check.
-        if ((result.match(/```/g) ?? []).length !== 2)
-            return failed;
-        const framed = result.trim().match(/^(?:[\s\S]*?\n)?```(?:json)?[ \t]*\r?\n([\s\S]*?)\r?\n```$/);
-        if (!framed)
-            return failed;
-        try {
-            report = JSON.parse(framed[1]);
-        }
-        catch {
-            return failed;
-        }
-    }
-    if (!report || typeof report !== "object" || Array.isArray(report))
-        return failed;
-    const value = report;
-    if (Object.keys(value).some((key) => !["status", "report", "evidence", "pending_work"].includes(key))
-        || value.status !== "completed"
-        || !boundedText(value.report, MAX_EVENT_SUMMARY_CHARS)
-        || !Array.isArray(value.pending_work) || value.pending_work.length !== 0
-        || !Array.isArray(value.evidence) || value.evidence.length < 1 || value.evidence.length > MAX_EVIDENCE_ITEMS
-        || !value.evidence.every((item) => boundedText(item, MAX_EVIDENCE_CHARS)))
-        return failed;
-    return {
-        eventType: "completed",
-        summary: value.report.trim(),
-        payload: { ...usage, investigation_summary: value.report.trim(), completion_evidence: value.evidence },
-    };
-}
+// Compatibility export: keep the established Claude import path stable.
+export { COMPLETION_REPORT_NOTICE, completionEvent } from "../completion-report.js";

package/dist/src/adapters/claude-code/prompt-compiler.js

@@ -1,60 +1 @@
-import { COMPLETION_REPORT_NOTICE } from "./completion-report.js";
-const STOP_BEFORE_PUBLICATION_RULE = "Stop before publication. Never run git commit, git push, create a pull request, merge, " +
-    "deploy, access production, send an external message, or write data outside this worktree.";
-const EVENT_SCHEMA_NOTICE = "Report progress only through the normalized event lifecycle (started, progress, file_changed, question, " +
-    "test_started, test_result, budget_warning, checkpoint_ready, blocked, completed, failed). " +
-    "Checkpoint your work with checkpoint_ready before stopping whenever it is safe to do so.";
-function requiredArray(value, label) {
-    if (!Array.isArray(value)) {
-        throw new Error(`task package is missing ${label}`);
-    }
-    return value.map((item) => String(item));
-}
-function record(value) {
-    return value !== null && typeof value === "object" && !Array.isArray(value)
-        ? value
-        : undefined;
-}
-export function compilePrompt(taskPackage, options) {
-    const contract = record(taskPackage.contract);
-    if (!contract) {
-        throw new Error("task package is missing a contract");
-    }
-    const agentExecution = record(taskPackage.agent_execution);
-    if (!agentExecution) {
-        throw new Error("task package is missing the implementation brief (agent_execution section)");
-    }
-    const brief = record(agentExecution.implementation_brief);
-    if (!brief) {
-        throw new Error("task package is missing the implementation brief");
-    }
-    const unresolvedQuestions = requiredArray(brief.unresolved_questions ?? [], "unresolved_questions");
-    if (unresolvedQuestions.length > 0) {
-        throw new Error(`task package has unresolved questions that must be resolved before dispatch: ${unresolvedQuestions.join("; ")}`);
-    }
-    const contractObjective = record(contract.objective);
-    const objective = String(brief.objective ?? contractObjective?.summary ?? "");
-    if (!objective) {
-        throw new Error("task package is missing an objective");
-    }
-    const acceptanceCriteria = requiredArray(brief.acceptance_criteria ?? contractObjective?.acceptance_criteria ?? [], "acceptance_criteria");
-    const prohibitedActions = requiredArray(agentExecution.prohibited_actions ?? [], "prohibited_actions");
-    const requiredChanges = requiredArray(brief.required_changes ?? [], "required_changes");
-    const invariants = requiredArray(brief.invariants ?? [], "invariants");
-    const nonGoals = requiredArray(brief.non_goals ?? [], "non_goals");
-    const requiredTests = requiredArray(brief.required_tests ?? [], "required_tests");
-    const sections = [
-        `# Bounded implementation brief: ${options.workItemLabel}`,
-        `## Objective\n${objective}`,
-        `## Required changes\n${requiredChanges.map((item) => `- ${item}`).join("\n")}`,
-        `## Invariants\n${invariants.map((item) => `- ${item}`).join("\n")}`,
-        `## Non-goals\n${nonGoals.map((item) => `- ${item}`).join("\n")}`,
-        `## Acceptance criteria\n${acceptanceCriteria.map((item) => `- ${item}`).join("\n")}`,
-        `## Required tests\n${requiredTests.map((item) => `- ${item}`).join("\n")}`,
-        `## Prohibited actions\n${prohibitedActions.map((item) => `- ${item}`).join("\n")}`,
-        `## Stop-before-publication rule\n${STOP_BEFORE_PUBLICATION_RULE}`,
-        `## Event and checkpoint obligations\n${EVENT_SCHEMA_NOTICE}`,
-        `## Final completion report\n${COMPLETION_REPORT_NOTICE}`,
-    ];
-    return sections.join("\n\n");
-}
+export { compilePrompt } from "../prompt-compiler.js";

package/dist/src/adapters/claude-code/runtime-options.js

@@ -0,0 +1,72 @@
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { mkdir, realpath, rm } from 'node:fs/promises';
+import { writeFileSync } from 'node:fs';
+import { NodeProcessGroupHost } from '../../process/node-process-group-host.js';
+import { JobToolSession } from '../../safety/job-tool-session.js';
+import { jobToolPolicyOptions } from '../../safety/job-tool-policy.js';
+import { requireJobSecurity } from '../../safety/job-security-policy.js';
+const inside = (root, file) => file === root || file.startsWith(root + path.sep);
+/** Wiring only. No release verifier or admission certificate exists here. */
+export function createClaudeCodeAdapterOptions(input) {
+    const checkout = path.resolve(input.worktreePath), state = path.resolve(input.stateRoot);
+    if (inside(checkout, state))
+        throw new Error('Claude job controls must be outside the checkout');
+    const control = path.join(state, 'claude-jobs', randomUUID());
+    const home = path.join(control, 'home'), cwd = path.join(control, 'cwd'), config = path.join(control, 'mcp.json');
+    const env = {};
+    for (const key of ['PATH', 'LANG', 'LC_ALL', 'USER', 'LOGNAME'])
+        if (input.env[key] !== undefined)
+            env[key] = input.env[key];
+    env.HOME = home;
+    env.TMPDIR = path.join(control, 'tmp'); // Claude owns credential access. Preserve the account location by path only;
+    // never read/copy its files or send this environment to scoped workers.
+    // https://code.claude.com/docs/en/authentication#log-in-with-multiple-accounts
+    env.CLAUDE_CONFIG_DIR = input.env.CLAUDE_CONFIG_DIR ?? (input.env.HOME ? path.join(input.env.HOME, '.claude') : undefined);
+    if (env.CLAUDE_CONFIG_DIR && !path.isAbsolute(env.CLAUDE_CONFIG_DIR))
+        throw new Error('Claude account configuration path must be absolute');
+    return {
+        processHost: new NodeProcessGroupHost(), worktreeRoot: checkout, jobId: input.jobId, securityPolicy: input.securityPolicy,
+        cwd, env, binaryPath: input.binaryPath, hookExecutablePath: input.hookExecutablePath, hookNodeExecutablePath: input.hookNodeExecutablePath,
+        maxBudgetUsd: input.maxBudgetUsd ?? 1, workItemLabel: input.workItemLabel ?? input.jobId,
+        registeredReadTools: [], writeMcpConfig: () => { throw new Error('Gateway relay is not a model tool endpoint'); },
+        createTools: async (ctx, pkg, approved) => {
+            await mkdir(state, { recursive: true, mode: 0o700 });
+            const realState = await realpath(state), realCheckout = await realpath(checkout);
+            if (realState !== state || inside(realCheckout, realState))
+                throw new Error('Claude job controls must be outside the checkout');
+            await mkdir(control, { recursive: true, mode: 0o700 });
+            for (const directory of [home, cwd, env.TMPDIR])
+                await mkdir(directory, { mode: 0o700 });
+            let active = true;
+            const tools = new JobToolSession({
+                policyOptions: jobToolPolicyOptions(checkout, pkg, approved, input.commandRegistry ?? [], { runtimeAdapter: 'claude_code_cli', runtimeAdapterVersion: '1' }),
+                binding: () => {
+                    const binding = input.nativeBinding?.();
+                    return binding && binding.jobId === input.jobId && binding.generation === input.securityPolicy?.pin.generation ? binding : null;
+                },
+                active: () => {
+                    if (!active)
+                        return false;
+                    try {
+                        requireJobSecurity(input.securityPolicy, { adapterId: 'claude_code_cli', adapterVersion: '1', jobId: input.jobId, modelId: ctx.resolvedModelId });
+                        return true;
+                    }
+                    catch {
+                        return false;
+                    }
+                },
+            });
+            return { start: () => tools.start(), revoke: () => { active = false; tools.revoke(); }, close: async () => { active = false; try {
+                    await tools.close();
+                }
+                finally {
+                    await rm(control, { recursive: true, force: true });
+                } } };
+        },
+        writeLocalMcpConfig: endpoint => {
+            writeFileSync(config, JSON.stringify({ mcpServers: { ai_local: { type: 'http', url: endpoint.url, headers: { Authorization: `Bearer ${endpoint.token}` } } } }), { mode: 0o600, flag: 'wx' });
+            return config;
+        },
+    };
+}