mtech-ai-local-runner 0.1.8 → 0.1.11

package/dist/src/adapters/codex/exec-launch-host.js

@@ -0,0 +1,209 @@
+import { UNMANAGED_EXEC_MODE } from './unmanaged-scope.js';
+import { fingerprint as taskFingerprint } from '../../daemon/execution-coordinator.js';
+import { securityRequirementsFingerprint as hash } from '../../safety/security-requirements.js';
+import { ExecToolGate } from './exec-tool-gate.js';
+import { assessReleaseExec, requireReleaseDescriptor, releaseGates, EXEC_INPUT_GATES } from './exec-release-policy.js';
+import { officialExecObservationLimits } from './exec-observer.js';
+import { EXEC_GATES, assessExecPreflight, requireExecHandshake } from './exec-preflight.js';
+import { EXEC_MODE, isReleaseExecMode, EXEC_TRANSPORT, assertOfficialExecPlanAvailable, claimOfficialExecPlan, requireOfficialExecPlan } from './exec-invocation.js';
+const fail = () => new Error('CODEX_EXEC_PREFLIGHT_REJECTED');
+/** No default native inspector, handshake observer or OS process host is created.
+ * Missing per-execution evidence blocks before spawn. Synthetic callbacks grant
+ * only the fake host used by tests, never a compiled production release entry. */
+export class CodexExecLaunchHost {
+    plan;
+    deps;
+    used = false;
+    ownsAttempt = false;
+    stopped = false;
+    handle;
+    inspection;
+    exitAudit;
+    inspectionFingerprint;
+    handshake;
+    receiptValue;
+    abort = new AbortController();
+    closePromise;
+    constructor(plan, deps) {
+        this.plan = plan;
+        this.deps = deps;
+        requireOfficialExecPlan(plan);
+        this.deps = Object.freeze({ ...deps, processHost: Object.freeze({ spawn: deps.processHost.spawn.bind(deps.processHost) }) });
+    }
+    current() { if (this.stopped || this.abort.signal.aborted || this.inspection?.isCurrent() !== true || !(isReleaseExecMode(this.plan.mode) ? assessReleaseExec(this.inspection.snapshot, this.plan) : assessExecPreflight(this.inspection.snapshot, this.plan)).ready || hash(this.inspection.snapshot) !== this.inspectionFingerprint) {
+        if (this.plan.mode === UNMANAGED_EXEC_MODE)
+            void this.cancel().catch(() => { });
+        throw fail();
+    } }
+    assertContext(ctx, jobId) {
+        const a = ctx.approvedTaskPackage, r = a?.security_requirements, b = ctx.taskPackage, execution = b?.execution;
+        if (isReleaseExecMode(this.plan.mode)) {
+            if (!r)
+                throw fail();
+            requireReleaseDescriptor(r);
+            if (r.binary_sha256 !== this.plan.identity.binarySha256 || r.fixtures_sha256 !== this.plan.identity.barrierFingerprint || r.commands_sha256 !== this.plan.identity.commandsFingerprint || r.tools_sha256 !== this.plan.identity.toolSchemaFingerprint || !r.model_ids.includes(this.plan.modelId))
+                throw fail();
+        }
+        if (!a || !r || jobId !== this.plan.identity.jobId || ctx.generation !== this.plan.identity.generation || ctx.resumeSessionId || ctx.resolvedModelId !== this.plan.modelId || a.runtime_adapter !== 'codex_cli' || a.runtime_adapter_version !== '1' || a.runtime_transport !== EXEC_TRANSPORT || a.resolved_provider !== 'openai' || a.resolved_model_id !== this.plan.modelId || a.repository?.base_commit_sha !== this.plan.identity.sourceSha || a.contract_fingerprint !== this.plan.identity.contractFingerprint
+            || taskFingerprint(a) !== this.plan.identity.taskPackageFingerprint || ctx.securityBinding?.taskPackageFingerprint !== this.plan.identity.taskPackageFingerprint || ctx.securityBinding.contractFingerprint !== this.plan.identity.contractFingerprint || ctx.securityBinding.launchFingerprint !== this.plan.identity.launchFingerprint
+            || b?.repositories?.length !== 1 || b.repositories[0]?.base_commit_sha !== this.plan.identity.sourceSha
+            || execution?.runtime_transport !== EXEC_TRANSPORT || execution?.mode !== 'employee_ai_work_session' || execution.runtime_adapter !== 'codex_cli' || execution.limits_mode !== 'unbounded'
+            || r.version !== (this.plan.mode === UNMANAGED_EXEC_MODE ? 'cli-exec-security-requirements-v3' : isReleaseExecMode(this.plan.mode) ? 'cli-exec-security-requirements-v2' : 'cli-exec-security-requirements-v1') || r.security_mode !== this.plan.mode || r.transport !== EXEC_TRANSPORT || r.status !== 'verified' || r.adapter_id !== 'codex_cli' || r.adapter_version !== '1' || JSON.stringify(r.mandatory_gates) !== JSON.stringify(isReleaseExecMode(this.plan.mode) ? [...releaseGates(this.plan.mode), ...EXEC_INPUT_GATES, 'authenticated_mcp_discovery'] : EXEC_GATES) || r.release_manifest_sha256 !== this.plan.identity.releaseManifestFingerprint || r.fingerprint !== this.plan.identity.requirementsFingerprint || hash(r) !== r.fingerprint)
+            throw fail();
+    }
+    assertAvailableContext(ctx, jobId) { if (this.used || this.stopped)
+        throw fail(); this.assertContext(ctx, jobId); assertOfficialExecPlanAvailable(this.plan); if (isReleaseExecMode(this.plan.mode) && (!(this.deps.execTools instanceof ExecToolGate) || !this.deps.execTools.matches(this.plan)))
+        throw fail(); }
+    async start(ctx, jobId, prompt, signal) {
+        if (this.used || this.stopped)
+            throw fail();
+        this.assertAvailableContext(ctx, jobId);
+        claimOfficialExecPlan(this.plan);
+        this.ownsAttempt = true;
+        this.used = true;
+        let timer, external;
+        try {
+            this.assertContext(ctx, jobId);
+            requireOfficialExecPlan(this.plan);
+            if (typeof prompt !== 'string' || !prompt || prompt.length > 1_000_000 || signal?.aborted)
+                throw fail();
+            const stopped = new Promise((_, reject) => { external = () => { void this.cancel().catch(() => { }); reject(fail()); }; this.abort.signal.addEventListener('abort', () => reject(fail()), { once: true }); signal?.addEventListener('abort', external, { once: true }); timer = setTimeout(external, 30_000); });
+            const preparation = (async () => {
+                const supported = isReleaseExecMode(this.plan.mode);
+                this.inspection = await (supported ? this.deps.inspectRelease?.(this.plan, this.abort.signal) : this.deps.inspect?.(this.plan, this.abort.signal));
+                const assessment = supported ? assessReleaseExec(this.inspection?.snapshot, this.plan) : assessExecPreflight(this.inspection?.snapshot, this.plan);
+                if (!supported && !this.deps.inspect)
+                    assessment.reasonCodes.push(...officialExecObservationLimits());
+                this.deps.onAssessment?.(structuredClone(assessment));
+                if (!assessment.ready || !supported && typeof this.deps.handshake !== 'function')
+                    throw fail();
+                this.inspectionFingerprint = hash(this.inspection.snapshot);
+                this.current();
+                const invocation = requireOfficialExecPlan(this.plan);
+                const manual = ctx.approvedTaskPackage?.security_requirements?.mdm_verification === 'manual_prelaunch';
+                if (manual && typeof this.inspection.beforeSpawn !== 'function')
+                    throw fail();
+                this.inspection.beforeSpawn?.();
+                const h = this.deps.processHost.spawn(invocation.binary, invocation.args, { cwd: this.plan.cwd, env: invocation.env });
+                this.handle = h;
+                if (this.stopped) {
+                    h.kill('SIGKILL');
+                    throw fail();
+                }
+                h.once('exit', (code, signal) => {
+                    // Preserve audit only for a clean owned exit that was still authorized.
+                    // This immutable record never restores tool or spawn authority.
+                    if (code === 0 && signal === null && !this.stopped && this.receiptValue) {
+                        try {
+                            this.current();
+                            this.exitAudit = structuredClone(this.receiptValue);
+                        }
+                        catch { }
+                    }
+                    void this.cancel().catch(() => { });
+                });
+                this.current();
+                if (supported) {
+                    const gate = this.deps.execTools;
+                    gate.bind(h, () => { try {
+                        this.current();
+                        return true;
+                    }
+                    catch {
+                        return false;
+                    } });
+                    // Vendor exec consumes stdin before it can initialize its required MCP.
+                    // Prompt submission may cause provider/account effects; do not call this no-model.
+                    h.stdin.write(prompt);
+                    this.current();
+                    h.stdin.end();
+                    this.current();
+                    gate.promptSubmitted(h);
+                    const observed = await gate.wait(h, this.abort.signal);
+                    this.current();
+                    requireExecHandshake(observed, h, this.plan);
+                    gate.authorize(h);
+                    this.current();
+                    requireExecHandshake(observed, h, this.plan);
+                    this.receiptValue = Object.freeze({ receipt_version: this.plan.mode === UNMANAGED_EXEC_MODE ? 'cli-exec-job-security-receipt-v3' : 'cli-exec-job-security-receipt-v2', evidence_origin: 'employee_runner', transport: EXEC_TRANSPORT, security_mode: this.plan.mode, ...(this.plan.mode === UNMANAGED_EXEC_MODE ? { policy_scope: this.inspection.snapshot.policyScope } : {}), phase: 'post_prompt_mcp_authorized', policy_evidence: 'reviewed_release_and_current_inputs', mcp_evidence: 'authenticated_server_discovery', native_policy_observed: false, first_inference_observed: false, execution_nonce: this.plan.executionNonce, invocation_fingerprint: this.plan.invocationFingerprint, ...this.plan.identity });
+                    return h;
+                }
+                const handshake = await this.deps.handshake?.(h, this.plan, this.abort.signal);
+                this.current();
+                requireExecHandshake(handshake, h, this.plan);
+                this.handshake = handshake;
+                // An input hash is not a native effective-config certificate. Preserve the
+                // evidence origin in the audit receipt and never reuse AppServer authority.
+                const receipt = Object.freeze({ receipt_version: 'cli-exec-job-security-receipt-v1', evidence_origin: 'employee_runner', transport: EXEC_TRANSPORT, security_mode: EXEC_MODE, phase: 'exec_pre_prompt', execution_nonce: this.plan.executionNonce, invocation_fingerprint: this.plan.invocationFingerprint, ...this.plan.identity });
+                this.current();
+                requireExecHandshake(handshake, h, this.plan);
+                h.stdin.write(prompt);
+                this.current();
+                h.stdin.end();
+                this.current();
+                requireExecHandshake(handshake, h, this.plan);
+                this.receiptValue = receipt;
+                return h;
+            })();
+            return await Promise.race([preparation, stopped]);
+        }
+        catch {
+            await this.cancel().catch(() => { });
+            throw fail();
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+            if (external)
+                signal?.removeEventListener('abort', external);
+        }
+    }
+    receipt() { if (this.exitAudit)
+        return structuredClone(this.exitAudit); if (!this.receiptValue)
+        return undefined; try {
+        if (this.plan.mode === UNMANAGED_EXEC_MODE)
+            this.current();
+        return this.receiptValue ? structuredClone(this.receiptValue) : undefined;
+    }
+    catch {
+        return undefined;
+    } }
+    cancel() {
+        if (this.closePromise)
+            return this.closePromise;
+        this.stopped = true;
+        this.receiptValue = undefined;
+        if (!this.ownsAttempt) {
+            this.closePromise = Promise.resolve();
+            return this.closePromise;
+        }
+        let finish, reject;
+        this.closePromise = new Promise((resolve, rejectPromise) => { finish = resolve; reject = rejectPromise; });
+        let cleanupError = false;
+        // Publish closePromise first: synchronous exit/cancel cannot recurse or skip cleanup.
+        try {
+            this.deps.execTools?.revoke();
+        }
+        catch {
+            cleanupError = true;
+        }
+        try {
+            this.deps.revokeTools();
+        }
+        catch {
+            cleanupError = true;
+        }
+        this.abort.abort();
+        try {
+            this.handle?.kill('SIGKILL');
+        }
+        catch {
+            cleanupError = true;
+        }
+        Promise.resolve().then(() => this.deps.closeTools()).then(() => { if (cleanupError)
+            reject(new Error('CODEX_EXEC_CLEANUP_UNCONFIRMED'));
+        else
+            finish(); }, () => reject(new Error('CODEX_EXEC_CLEANUP_UNCONFIRMED')));
+        return this.closePromise;
+    }
+}

package/dist/src/adapters/codex/exec-observer.js

@@ -0,0 +1,83 @@
+/** Official exec JSONL exposes no native same-execution effective/managed policy
+ * inspection. stdin is consumed before startup; waiting for child discovery
+ * before submitting stdin cannot be used as an inference authorization barrier.
+ * Fixed limits, not user/task-provided release claims. */
+export function officialExecObservationLimits() {
+    return [
+        'EXEC_EFFECTIVE_POLICY_OBSERVATION_UNAVAILABLE',
+        'EXEC_MANAGED_POLICY_OBSERVATION_UNAVAILABLE',
+        'EXEC_REQUIRED_MCP_INFERENCE_BARRIER_UNVERIFIED',
+        'EXEC_STDIN_REQUIRED_BEFORE_STARTUP',
+    ];
+}
+/** Raw wire diagnostics. Attach discovery only to this launch's authenticated
+ * server; do not call from task JSON/stdout. Possession of the endpoint token is
+ * not OS process identity or proof of when native inference begins.
+ * No permit, LiveExecInspection or ExecHandshake is produced by this observer. */
+export class ExecWireObserver {
+    stage = 'unobserved';
+    thread = false;
+    reasons = new Set();
+    discovery = (event) => {
+        if (this.stage === 'revoked')
+            return;
+        if (event === 'revoked') {
+            this.stage = 'revoked';
+            return;
+        }
+        if (event === 'initialize_response' && this.stage === 'unobserved') {
+            this.stage = 'initialized';
+            return;
+        }
+        if (event === 'initialized_notification' && this.stage === 'initialized') {
+            this.stage = 'notified';
+            return;
+        }
+        if (event === 'inventory_response' && (this.stage === 'notified' || this.stage === 'observed')) {
+            this.stage = 'observed';
+            return;
+        }
+        this.stage = 'invalid';
+        this.reasons.add('EXEC_MCP_DISCOVERY_SEQUENCE_INVALID');
+    };
+    line(line) {
+        // Deliberately keep no raw payload, thread ID, path, stderr or provider usage.
+        try {
+            if (typeof line !== 'string' || Buffer.byteLength(line) > 256_000)
+                throw Error();
+            const e = JSON.parse(line);
+            if (!e || typeof e !== 'object' || Array.isArray(e) || typeof e.type !== 'string')
+                throw Error();
+            const event = e;
+            if (event.type === 'thread.started') {
+                if (Object.keys(event).length !== 2 || typeof event.thread_id !== 'string' || !event.thread_id || event.thread_id.length > 256)
+                    throw Error();
+                this.thread = true;
+                return;
+            }
+            if (event.type === 'error' || event.type === 'turn.failed') {
+                this.reasons.add('EXEC_CHILD_FAILURE');
+                return;
+            }
+            if (['turn.started', 'turn.completed', 'item.started', 'item.updated', 'item.completed'].includes(event.type)) {
+                // These events occur after prompt submission; never elevate them to proof.
+                this.reasons.add('EXEC_POST_PROMPT_EVENT_OBSERVED');
+                return;
+            }
+            this.reasons.add('EXEC_UNSUPPORTED_WIRE_EVENT');
+        }
+        catch {
+            this.reasons.add('EXEC_INVALID_WIRE_EVENT');
+        }
+    }
+    report() {
+        return {
+            executionReady: false,
+            effectivePolicy: 'unverified', managedPolicy: 'unverified',
+            requiredMcpInferenceBarrier: 'unverified',
+            mcpDiscovery: this.stage === 'observed' ? 'observed' : this.stage === 'revoked' ? 'revoked' : 'unobserved',
+            threadObserved: this.thread,
+            reasonCodes: [...officialExecObservationLimits(), ...this.reasons],
+        };
+    }
+}

package/dist/src/adapters/codex/exec-preflight.js

@@ -0,0 +1,41 @@
+import { isDeepStrictEqual } from 'node:util';
+import { SUPPORTED_CLI_GATES } from '../../safety/cli-security-modes.js';
+import { localToolInventory } from '../../safety/local-tool-server.js';
+import { EXEC_TRANSPORT, requireOfficialExecPlan } from './exec-invocation.js';
+export const EXEC_GATES = Object.freeze([...SUPPORTED_CLI_GATES, 'effective_policy_observation', 'managed_policy_observation', 'required_mcp_inference_barrier']);
+const object = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
+const exact = (v, keys) => isDeepStrictEqual(Reflect.ownKeys(v).sort(), keys.sort());
+const sha = (v) => typeof v === 'string' && /^[a-f0-9]{64}$/.test(v);
+/** Diagnostics only. Even a ready assessment is not a policy or spawn permit. */
+export function assessExecPreflight(value, plan) {
+    const reasonCodes = [];
+    const need = (ok, code) => { if (!ok)
+        reasonCodes.push(code); };
+    try {
+        requireOfficialExecPlan(plan);
+        if (!object(value))
+            return { ready: false, reasonCodes: ['EXEC_OBSERVATION_UNAVAILABLE', ...EXEC_GATES.map(g => 'EXEC_' + g.toUpperCase() + '_UNVERIFIED'), 'EXEC_EFFECTIVE_POLICY_UNVERIFIED', 'EXEC_MANAGED_POLICY_UNVERIFIED', 'EXEC_MCP_BARRIER_UNVERIFIED'] };
+        need(exact(value, ['version', 'transport', 'executionNonce', 'identity', 'invocationFingerprint', 'checks', 'effectivePolicy', 'managedPolicy', 'mcpPolicy', 'warnings']), 'EXEC_EVIDENCE_SHAPE');
+        need(value.version === 'cli-exec-security-evidence-v1' && value.transport === EXEC_TRANSPORT, 'EXEC_EVIDENCE_VERSION');
+        need(value.executionNonce === plan.executionNonce && value.invocationFingerprint === plan.invocationFingerprint && isDeepStrictEqual(value.identity, plan.identity), 'EXEC_IDENTITY_MISMATCH');
+        need(Array.isArray(value.warnings) && value.warnings.length === 0, 'EXEC_WARNING');
+        const checks = Array.isArray(value.checks) ? value.checks : [];
+        need(checks.length === EXEC_GATES.length && new Set(checks.map(c => object(c) ? c.gate : null)).size === EXEC_GATES.length && checks.every(c => object(c) && exact(c, ['gate', 'status', 'basis']) && EXEC_GATES.includes(c.gate)), 'EXEC_CHECK_SET');
+        for (const gate of EXEC_GATES)
+            need(checks.filter(c => object(c) && c.gate === gate && c.status === 'verified' && c.basis === 'current_execution').length === 1, 'EXEC_' + gate.toUpperCase() + '_UNVERIFIED');
+        const p = object(value.effectivePolicy) ? value.effectivePolicy : {};
+        need(exact(p, ['source', 'executionNonce', 'modelId', 'provider', 'cwd', 'approvalPolicy', 'permissionProfile', 'nativeNetwork', 'fingerprint']) && p.source === 'owned_exec_pre_model_observation' && p.executionNonce === plan.executionNonce && p.modelId === plan.modelId && p.provider === 'openai' && p.cwd === plan.cwd && p.approvalPolicy === 'never' && p.permissionProfile === 'local_job' && p.nativeNetwork === false && sha(p.fingerprint), 'EXEC_EFFECTIVE_POLICY_UNVERIFIED');
+        const m = object(value.managedPolicy) ? value.managedPolicy : {};
+        need(exact(m, ['source', 'executionNonce', 'decision', 'fingerprint', 'sourcesFingerprint']) && m.source === 'owned_exec_pre_model_observation' && m.executionNonce === plan.executionNonce && m.decision === 'compatible' && sha(m.fingerprint) && sha(m.sourcesFingerprint), 'EXEC_MANAGED_POLICY_UNVERIFIED');
+        const b = object(value.mcpPolicy) ? value.mcpPolicy : {};
+        need(exact(b, ['source', 'executionNonce', 'endpoint', 'toolSchemaFingerprint', 'required', 'startupFailurePreventsInference', 'barrierFingerprint']) && b.source === 'owned_exec_native_barrier' && b.executionNonce === plan.executionNonce && b.endpoint === plan.endpoint && b.toolSchemaFingerprint === plan.identity.toolSchemaFingerprint && b.required === true && b.startupFailurePreventsInference === true && b.barrierFingerprint === plan.identity.barrierFingerprint, 'EXEC_MCP_BARRIER_UNVERIFIED');
+    }
+    catch {
+        reasonCodes.push('EXEC_OBSERVATION_UNAVAILABLE');
+    }
+    return { ready: reasonCodes.length === 0, reasonCodes };
+}
+export function requireExecHandshake(h, process, plan) {
+    if (!object(h) || h.process !== process || h.executionNonce !== plan.executionNonce || h.endpoint !== plan.endpoint || h.authenticated !== true || h.ready !== true || h.toolSchemaFingerprint !== plan.identity.toolSchemaFingerprint || !isDeepStrictEqual(h.tools, localToolInventory().map(t => t.name)) || typeof h.isCurrent !== 'function' || h.isCurrent() !== true)
+        throw Error('CODEX_EXEC_MCP_REJECTED');
+}

package/dist/src/adapters/codex/exec-release-policy.js

@@ -0,0 +1,44 @@
+import { MANUAL_MDM_RISK } from './manual-policy-scope.js';
+import { UNMANAGED_EXEC_MODE, UNMANAGED_SCOPE, requirePolicyScope } from './unmanaged-scope.js';
+import { isDeepStrictEqual } from 'node:util';
+import { isReleaseExecMode, EXEC_TRANSPORT, requireOfficialExecPlan } from './exec-invocation.js';
+export const EXEC_RELEASE_GATES = Object.freeze(['binary_release', 'official_permissions', 'managed_policy_enforcement', 'required_mcp_startup', 'source_exclusion', 'auth_backend_compatibility']);
+export const EXEC_INPUT_GATES = Object.freeze(['exact_inputs', 'launch_binding', 'repository_scope', 'private_paths_environment', 'owned_lifecycle']);
+export const EXEC_RELEASE_RISKS = Object.freeze(['vendor_native_policy_enforcement', 'managed_policy_not_directly_observed_per_job', 'first_inference_order_not_observed_per_job', 'job_mcp_token_possession_not_os_identity', 'account_startup_may_refresh_shared_credentials']);
+export const releaseGates = (mode) => mode === UNMANAGED_EXEC_MODE ? EXEC_RELEASE_GATES.map(g => g === 'managed_policy_enforcement' ? 'managed_scope_exclusion' : g) : EXEC_RELEASE_GATES;
+export const releaseRisks = (mode, mdmVerification) => mode === UNMANAGED_EXEC_MODE ? [...EXEC_RELEASE_RISKS, 'concurrent_policy_change_not_atomic', 'local_account_metadata_not_remote_entitlement', ...(mdmVerification === 'manual_prelaunch' ? [MANUAL_MDM_RISK] : [])] : EXEC_RELEASE_RISKS;
+const record = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
+const exact = (v, keys) => isDeepStrictEqual(Object.keys(v).sort(), keys.sort());
+const checks = (v, gates, basis) => Array.isArray(v) && v.length === gates.length && gates.every(g => v.filter(c => record(c) && exact(c, ['gate', 'status', 'basis']) && c.gate === g && c.status === 'verified' && c.basis === basis).length === 1);
+export function requireReleaseDescriptor(r) {
+    const v3 = r.security_mode === UNMANAGED_EXEC_MODE;
+    if (!['release_manifest_sha256', 'binary_sha256', 'fixtures_sha256', 'commands_sha256', 'tools_sha256', 'fingerprint'].every(k => typeof r[k] === 'string' && /^[a-f0-9]{64}$/.test(r[k])) || !Array.isArray(r.model_ids) || !r.model_ids.length || new Set(r.model_ids).size !== r.model_ids.length || r.model_ids.some(m => typeof m !== 'string' || !m || m.length > 255 || /[\r\n\0]/.test(m)) || !exact(r, ['version', 'security_mode', 'transport', 'status', 'adapter_id', 'adapter_version', 'mandatory_gates', 'accepted_residual_risks', 'evidence_class', 'release_manifest_sha256', 'binary_sha256', 'fixtures_sha256', 'commands_sha256', 'tools_sha256', 'model_ids', 'fingerprint', ...(v3 ? ['policy_scope', 'managed_enforcement', ...(r.mdm_verification === undefined ? [] : ['mdm_verification'])] : [])]) || r.version !== (v3 ? 'cli-exec-security-requirements-v3' : 'cli-exec-security-requirements-v2') || !isReleaseExecMode(r.security_mode) || v3 && (r.policy_scope !== UNMANAGED_SCOPE || r.managed_enforcement !== 'not_run' || r.mdm_verification !== undefined && r.mdm_verification !== 'manual_prelaunch') || r.evidence_class !== 'reviewed_release_and_current_inputs' || !isDeepStrictEqual(r.mandatory_gates, [...releaseGates(r.security_mode), ...EXEC_INPUT_GATES, 'authenticated_mcp_discovery']) || !isDeepStrictEqual(r.accepted_residual_risks, releaseRisks(r.security_mode, r.mdm_verification)))
+        throw Error('EXEC_RELEASE_DESCRIPTOR_REJECTED');
+}
+/** Diagnostic validator only; live currentness and trusted dependency origin
+ * are checked by the host. Release checks never become direct native proof. */
+export function assessReleaseExec(value, plan) {
+    const reasonCodes = [];
+    const need = (ok, code) => { if (!ok)
+        reasonCodes.push(code); };
+    try {
+        requireOfficialExecPlan(plan);
+        const v3 = plan.mode === UNMANAGED_EXEC_MODE;
+        if (!record(value))
+            return { ready: false, reasonCodes: ['EXEC_RELEASE_EVIDENCE_UNAVAILABLE', ...EXEC_RELEASE_GATES.map(g => 'EXEC_RELEASE_' + g.toUpperCase() + '_UNVERIFIED'), ...EXEC_INPUT_GATES.map(g => 'EXEC_INPUT_' + g.toUpperCase() + '_UNVERIFIED')] };
+        need(isReleaseExecMode(plan.mode) && exact(value, ['version', 'securityMode', 'transport', 'executionNonce', 'identity', 'invocationFingerprint', 'acceptedResidualRisks', 'release', 'inputs', 'warnings', ...(v3 ? ['policyScope'] : [])]) && value.version === (v3 ? 'cli-exec-release-evidence-v3' : 'cli-exec-release-evidence-v2') && value.securityMode === plan.mode && value.transport === EXEC_TRANSPORT, 'EXEC_RELEASE_EVIDENCE_SHAPE');
+        need(value.executionNonce === plan.executionNonce && value.invocationFingerprint === plan.invocationFingerprint && isDeepStrictEqual(value.identity, plan.identity), 'EXEC_RELEASE_IDENTITY_MISMATCH');
+        need(isDeepStrictEqual(value.acceptedResidualRisks, releaseRisks(plan.mode, record(value.policyScope) && record(value.policyScope.manual_verification) ? value.policyScope.manual_verification.mode : undefined)), 'EXEC_RELEASE_RISK_MISMATCH');
+        need(Array.isArray(value.warnings) && value.warnings.length === 0, 'EXEC_RELEASE_WARNING');
+        const r = record(value.release) ? value.release : {};
+        need(exact(r, ['source', 'binarySha256', 'manifestFingerprint', 'fixturesFingerprint', 'checks']) && r.source === 'reviewed_compiled_release' && r.binarySha256 === plan.identity.binarySha256 && r.manifestFingerprint === plan.identity.releaseManifestFingerprint && r.fixturesFingerprint === plan.identity.barrierFingerprint, 'EXEC_RELEASE_PIN_MISMATCH');
+        need(checks(r.checks, releaseGates(plan.mode), 'pinned_release_fixture'), 'EXEC_RELEASE_CHECKS_UNVERIFIED');
+        if (v3)
+            requirePolicyScope(value.policyScope, plan);
+        need(checks(value.inputs, EXEC_INPUT_GATES, 'current_execution'), 'EXEC_INPUT_CHECKS_UNVERIFIED');
+    }
+    catch {
+        reasonCodes.push('EXEC_RELEASE_EVIDENCE_UNAVAILABLE');
+    }
+    return { ready: reasonCodes.length === 0, reasonCodes };
+}

package/dist/src/adapters/codex/exec-runtime-options.js

@@ -0,0 +1,113 @@
+import path from 'node:path';
+import { mkdtemp, mkdir, realpath, writeFile, rm, lstat } from 'node:fs/promises';
+import { NodeProcessGroupHost } from '../../process/node-process-group-host.js';
+import { LocalToolPolicy } from '../../safety/local-tool-policy.js';
+import { jobToolPolicyOptions } from '../../safety/job-tool-policy.js';
+import { LocalToolServer, localToolInventory } from '../../safety/local-tool-server.js';
+import { commandRegistryFingerprint } from '../../safety/job-security-session.js';
+import { fingerprint } from '../../daemon/execution-coordinator.js';
+import { buildOfficialExecPlan } from './exec-invocation.js';
+import { ExecToolGate } from './exec-tool-gate.js';
+import { CodexExecLaunchHost } from './exec-launch-host.js';
+import { CODEX_REPORT_SCHEMA } from './prompt-compiler.js';
+const inside = (a, b) => a === b || b.startsWith(a + path.sep);
+const reject = () => Error('CODEX_EXEC_COMPOSITION_REJECTED');
+/** The caller supplies a trusted claimed job, not a task-selected host factory. */
+export function buildCodexExecJobOptions(input) {
+    let job, server, gate, policy, control, closed = false, used = false, closing;
+    let launchHost;
+    const dispose = () => closing ??= Promise.resolve().then(async () => { closed = true; gate?.revoke(); job?.revoke(); try {
+        server?.revoke();
+    }
+    finally {
+        policy?.revoke();
+        try {
+            await server?.close();
+        }
+        finally {
+            if (control)
+                await rm(control, { recursive: true, force: true });
+        }
+    } });
+    const close = async () => { try {
+        await launchHost?.cancel();
+    }
+    finally {
+        await dispose();
+    } };
+    const processHost = input.processHost ?? new NodeProcessGroupHost();
+    const env = Object.fromEntries(['HOME', 'CODEX_HOME', 'PATH', 'USER', 'LOGNAME', 'LANG', 'LC_ALL', 'TMPDIR'].filter(k => input.env[k] !== undefined).map(k => [k, input.env[k]]));
+    return { worktreeRoot: input.worktreePath, jobId: input.jobId, env: input.env, processHost,
+        closeOfficialExec: close, revokeSecurity: () => { closed = true; gate?.revoke(); job?.revoke(); server?.revoke(); policy?.revoke(); },
+        createTools: () => { throw reject(); }, writeSchema: async () => { throw reject(); },
+        createOfficialExec: async (ctx, signal) => {
+            if (used || closed || signal.aborted)
+                throw reject();
+            used = true;
+            const abort = () => { void close().catch(() => { }); };
+            signal.addEventListener('abort', abort, { once: true });
+            try {
+                job = input.productionJob();
+                job.attachCleanup(close);
+                const admitted = await job.prepare(ctx);
+                if (closed || signal.aborted)
+                    throw reject();
+                if (!input.env.HOME || !path.isAbsolute(input.stateRoot))
+                    throw reject();
+                const account = path.resolve(input.env.CODEX_HOME ?? path.join(input.env.HOME, '.codex'));
+                await mkdir(input.stateRoot, { recursive: true, mode: 0o700 });
+                const state = await realpath(input.stateRoot), source = await realpath(input.worktreePath), home = await realpath(account);
+                if (inside(source, state) || inside(state, source) || inside(home, state) || inside(state, home))
+                    throw reject();
+                control = await mkdtemp(path.join(state, 'codex-exec-'));
+                const cwd = path.join(control, 'cwd'), scratch = { tmpDir: path.join(control, 'tmp'), logDir: path.join(control, 'log'), sqliteHome: path.join(control, 'sqlite') };
+                await Promise.all([cwd, ...Object.values(scratch)].map(p => mkdir(p, { mode: 0o700 })));
+                if (closed || signal.aborted)
+                    throw reject();
+                for (let dir = cwd;; dir = path.dirname(dir)) {
+                    for (const base of ['.codex/config.toml']) {
+                        const f = path.join(dir, base);
+                        if (f !== path.join(account, 'config.toml')) {
+                            try {
+                                await lstat(f);
+                                throw reject();
+                            }
+                            catch (e) {
+                                if (e.code !== 'ENOENT')
+                                    throw e;
+                            }
+                        }
+                    }
+                    if (dir === path.dirname(dir))
+                        break;
+                }
+                const schema = path.join(control, 'report-schema.json');
+                await writeFile(schema, JSON.stringify(CODEX_REPORT_SCHEMA), { mode: 0o600, flag: 'wx' });
+                if (closed || signal.aborted)
+                    throw reject();
+                const approved = ctx.approvedTaskPackage, requirements = approved.security_requirements;
+                policy = new LocalToolPolicy(jobToolPolicyOptions(source, ctx.taskPackage, approved, admitted.release.commands, { runtimeAdapter: 'codex_cli', runtimeAdapterVersion: '1' }));
+                server = new LocalToolServer({ policy, authorizeCall: () => gate?.allowsCall() === true, onDiscovery: (event, scope) => gate?.discovery(event, scope) });
+                const endpoint = await server.start();
+                if (closed || signal.aborted)
+                    throw reject();
+                const plan = buildOfficialExecPlan({ policyMode: admitted.release.securityMode, binary: admitted.binary, credentialBackend: admitted.release.credentialBackend, identity: { jobId: input.jobId, generation: ctx.generation, actorId: admitted.actorId, runnerId: admitted.runnerId, sourceSha: String(approved.repository.base_commit_sha), binarySha256: admitted.release.binarySha256, releaseManifestFingerprint: String(requirements.release_manifest_sha256), requirementsFingerprint: String(requirements.fingerprint), contractFingerprint: ctx.securityBinding.contractFingerprint, taskPackageFingerprint: ctx.securityBinding.taskPackageFingerprint, launchFingerprint: ctx.securityBinding.launchFingerprint, commandsFingerprint: commandRegistryFingerprint(admitted.release.commands), toolSchemaFingerprint: fingerprint({ tools: localToolInventory() }), barrierFingerprint: admitted.release.fixturesFingerprint }, invocation: { modelId: ctx.resolvedModelId, worktreeRoot: cwd, sourceRoot: source, schemaPath: schema, endpoint, env, scratch } });
+                gate = new ExecToolGate(plan);
+                const host = new CodexExecLaunchHost(plan, { processHost, inspectRelease: p => job.inspect(p), execTools: gate, revokeTools: () => { gate?.revoke(); server?.revoke(); policy?.revoke(); job?.revoke(); }, closeTools: dispose });
+                launchHost = host;
+                if (closed || signal.aborted)
+                    throw reject();
+                return host;
+            }
+            catch {
+                await close().catch(() => { });
+                if (control)
+                    await rm(control, { recursive: true, force: true }).catch(() => { });
+                throw reject();
+            }
+            finally {
+                signal.removeEventListener('abort', abort);
+            }
+        },
+    };
+}

package/dist/src/adapters/codex/exec-tool-gate.js

@@ -0,0 +1,81 @@
+import { isReleaseExecMode, requireOfficialExecPlan } from './exec-invocation.js';
+import { localDiscoveryScopeMatches, localToolInventory } from '../../safety/local-tool-server.js';
+import { securityRequirementsFingerprint as hash } from '../../safety/security-requirements.js';
+const denied = () => Error('EXEC_TOOL_GATE_REJECTED');
+/** Host-owned capability, never populated from stdout/task data. Authenticated
+ * discovery is server-side evidence; it does not attest OS client identity. */
+export class ExecToolGate {
+    plan;
+    process;
+    current;
+    submitted = false;
+    revoked = false;
+    authorized = false;
+    stage = 0;
+    settle;
+    reject;
+    constructor(plan) {
+        this.plan = plan;
+        requireOfficialExecPlan(plan);
+        if (!isReleaseExecMode(plan.mode) || plan.identity.toolSchemaFingerprint !== hash({ tools: localToolInventory() }))
+            throw denied();
+    }
+    matches(plan) { return this.plan === plan && !this.process && !this.revoked; }
+    bind(process, current) { if (this.process || this.revoked)
+        throw denied(); this.process = process; this.current = current; }
+    active() { try {
+        return !this.revoked && !!this.process && this.current?.() === true;
+    }
+    catch {
+        return false;
+    } }
+    promptSubmitted(process) { if (this.process !== process || this.submitted || !this.active())
+        throw denied(); this.submitted = true; }
+    discovery = (event, scope) => {
+        const token = requireOfficialExecPlan(this.plan).env.AI_GATEWAY_JOB_MCP_TOKEN;
+        if (!localDiscoveryScopeMatches(scope, this.plan.endpoint, token)) {
+            this.revoke();
+            return;
+        }
+        if (event === 'revoked') {
+            this.revoke();
+            return;
+        }
+        if (this.revoked)
+            return;
+        if (!this.active() || !this.submitted) {
+            this.revoke();
+            return;
+        }
+        const expected = ['initialize_response', 'initialized_notification', 'inventory_response'];
+        if (this.stage === 3 && event === 'inventory_response')
+            return;
+        if (event !== expected[this.stage]) {
+            this.revoke();
+            return;
+        }
+        this.stage++;
+        if (this.stage === 3)
+            this.settle?.();
+    };
+    async wait(process, signal) {
+        if (this.process !== process || !this.submitted || !this.active() || signal.aborted)
+            throw denied();
+        if (this.stage !== 3)
+            await new Promise((resolve, reject) => {
+                const abort = () => { clear(); reject(denied()); };
+                const clear = () => { signal.removeEventListener('abort', abort); this.settle = undefined; this.reject = undefined; };
+                this.reject = abort;
+                this.settle = () => { clear(); resolve(); };
+                signal.addEventListener('abort', abort, { once: true });
+            });
+        if (!this.active() || signal.aborted || this.stage !== 3)
+            throw denied();
+        return { process, executionNonce: this.plan.executionNonce, endpoint: this.plan.endpoint, authenticated: true, ready: true, toolSchemaFingerprint: this.plan.identity.toolSchemaFingerprint, tools: localToolInventory().map(t => t.name), isCurrent: () => this.active() && this.stage === 3 };
+    }
+    authorize(process) { if (process !== this.process || !this.active() || this.stage !== 3)
+        throw denied(); this.authorized = true; }
+    allowsCall() { return this.authorized && this.submitted && this.stage === 3 && this.active(); }
+    revoke() { if (this.revoked)
+        return; this.revoked = true; this.authorized = false; this.reject?.(); }
+}

package/dist/src/adapters/codex/global-instructions.js

@@ -0,0 +1,32 @@
+import path from 'node:path';
+export const CODEX_GLOBAL_INSTRUCTION_WRAPPER = '/usr/bin/sandbox-exec';
+const reject = () => new Error('CODEX_GLOBAL_INSTRUCTION_BOUNDARY_REJECTED');
+export function accountAncestorPaths(account) {
+    if (!path.isAbsolute(account) || path.resolve(account) !== account || account === '/' || account.length > 4096 || /[\r\n\0]/.test(account))
+        throw reject();
+    const parents = [];
+    for (let dir = account;; dir = path.dirname(dir)) {
+        parents.push(dir);
+        if (parents.length > 64)
+            throw reject();
+        if (dir === path.dirname(dir))
+            break;
+    }
+    return Object.freeze(parents);
+}
+/** Additional per-process denial, not a grant of authority or global policy edit.
+ * file-read* is intentional: data-only denial permits a final symlink alias.
+ * Ancestor symlink denials prevent a later account-directory redirect. */
+export function globalInstructionProfile(account) {
+    const ancestors = accountAncestorPaths(account), literal = (p) => `(literal ${JSON.stringify(p)})`;
+    const profile = '(version 1)(allow default)'
+        + '(deny file-read* ' + ['AGENTS.md', 'AGENTS.override.md'].map(name => literal(path.join(account, name))).join(' ') + ')'
+        + '(deny file-read* (require-all (vnode-type SYMLINK) (require-any ' + ancestors.map(literal).join(' ') + ')))';
+    if (profile.length > 64000)
+        throw reject();
+    return profile;
+}
+export function requireGlobalInstructionInvocation(nativeBinary, account, invocation) {
+    if (invocation.binary !== CODEX_GLOBAL_INSTRUCTION_WRAPPER || invocation.args[0] !== '-p' || invocation.args[1] !== globalInstructionProfile(account) || invocation.args[2] !== nativeBinary)
+        throw reject();
+}

package/dist/src/adapters/codex/host-admission.js

@@ -0,0 +1,3 @@
+import { diagnoseCliHostAdmission } from '../../safety/cli-host-admission.js';
+/** Compatibility wrapper; all CLIs share the same closed release admission. */
+export const diagnoseCodexHostAdmission = (binary, env) => diagnoseCliHostAdmission('codex_cli', binary, env);