mtech-ai-local-runner 0.1.8 → 0.1.9

package/dist/src/adapters/codex/runtime-options.js

@@ -0,0 +1,163 @@
+import path from 'node:path';
+import { writeFile, rm, mkdir, realpath } from 'node:fs/promises';
+import { randomUUID } from 'node:crypto';
+import { NodeProcessGroupHost } from '../../process/node-process-group-host.js';
+import { jobToolPolicyOptions } from '../../safety/job-tool-policy.js';
+import { JobToolSession } from '../../safety/job-tool-session.js';
+import { requireJobSecurity } from '../../safety/job-security-policy.js';
+import { JobSecuritySession } from '../../safety/job-security-session.js';
+import { startNativeCodexSession } from './native-session.js';
+/** Codex compatibility wrapper with its exact approved runtime identity. */
+export function codexToolPolicyOptions(worktreeRoot, pkg, approved, registry) {
+    return jobToolPolicyOptions(worktreeRoot, pkg, approved, registry, { runtimeAdapter: 'codex_cli', runtimeAdapterVersion: '1' });
+}
+const inside = (root, file) => file === root || file.startsWith(root + path.sep);
+export function buildCodexJobOptions(input) {
+    if ((input.productionHost || input.productionHostFactory) && (input.securityHost || input.securityPolicy || input.nativeBinding || input.commandRegistry) || input.productionHost && input.productionHostFactory)
+        throw new Error('CODEX_SECURITY_AUTHORITY_CONFLICT');
+    if (input.securityHost && (input.securityPolicy || input.nativeBinding || input.commandRegistry))
+        throw new Error('CODEX_SECURITY_AUTHORITY_CONFLICT');
+    const security = new JobSecuritySession(input.securityHost);
+    let securityPolicy = input.securityPolicy, production = input.productionHost;
+    const staged = !!(input.productionHost || input.productionHostFactory);
+    const checkout = path.resolve(input.worktreePath), state = path.resolve(input.stateRoot);
+    if (inside(checkout, state))
+        throw new Error('Codex job controls must be outside checkout');
+    const account = input.env.HOME ? path.resolve(input.env.CODEX_HOME || path.join(input.env.HOME, '.codex')) : undefined;
+    const assertAccountOutside = (root, home = account) => {
+        if (home && (inside(home, root) || inside(root, home)))
+            throw new Error('Codex job controls must be outside account storage');
+    };
+    assertAccountOutside(state);
+    const directoryName = 'codex-job-' + randomUUID();
+    let control = path.join(state, directoryName), cwd = path.join(control, 'cwd');
+    const scratch = () => ({ tmpDir: path.join(control, 'tmp'), logDir: path.join(control, 'log'), sqliteHome: path.join(control, 'sqlite') });
+    let schemaFile, preparing;
+    let disposed = false, created = false;
+    const processHost = new NodeProcessGroupHost();
+    const prepare = () => preparing ??= (async () => {
+        if (disposed)
+            throw new Error('CODEX_JOB_REVOKED');
+        await mkdir(state, { recursive: true, mode: 0o700 });
+        const root = await realpath(state), source = await realpath(checkout).catch(() => checkout);
+        if (inside(source, root))
+            throw new Error('Codex job controls must be outside checkout');
+        assertAccountOutside(root, account ? await realpath(account).catch(() => account) : undefined);
+        control = path.join(root, directoryName);
+        cwd = path.join(control, 'cwd');
+        try {
+            await mkdir(control, { mode: 0o700 });
+            await mkdir(cwd, { mode: 0o700 });
+            for (const directory of Object.values(scratch()))
+                await mkdir(directory, { mode: 0o700 });
+            if (disposed)
+                throw new Error('CODEX_JOB_REVOKED');
+        }
+        catch (error) {
+            await rm(control, { recursive: true, force: true });
+            throw error;
+        }
+    })();
+    return {
+        processHost, worktreeRoot: checkout, get cwd() { return cwd; }, get scratch() { return scratch(); }, jobId: input.jobId, get securityPolicy() { return production?.policy() ?? securityPolicy; }, env: input.env, get binaryPath() { return production?.binaryPath() ?? input.env.AI_GATEWAY_LOCAL_RUNNER_CODEX_BINARY; },
+        deferSupportedSecurity: staged,
+        prepareSecurity: async (context) => {
+            if (disposed || !context.securityBinding)
+                throw new Error('JOB_SECURITY_SESSION_REJECTED');
+            const approved = context.approvedTaskPackage, repo = approved?.repository;
+            const request = { adapterId: 'codex_cli', adapterVersion: '1', jobId: input.jobId,
+                generation: context.generation, modelId: context.resolvedModelId, sourceSha: String(repo?.base_commit_sha ?? ''),
+                requirements: approved?.security_requirements, ...context.securityBinding };
+            if (staged) {
+                try {
+                    production ??= input.productionHostFactory();
+                    await production.prepare(request);
+                    return undefined;
+                }
+                catch {
+                    throw new Error('JOB_SECURITY_SESSION_REJECTED');
+                }
+            }
+            securityPolicy = await security.authorize(request);
+            return securityPolicy;
+        },
+        revokeSecurity: () => { disposed = true; security.revoke(); production?.revoke(); },
+        createTools: (pkg, approved) => {
+            if (created || disposed)
+                throw new Error('CODEX_JOB_TOOLS_UNAVAILABLE');
+            const policyOptions = codexToolPolicyOptions(checkout, pkg, approved, production ? production.commands() : input.securityHost ? security.commands() : input.commandRegistry ?? []);
+            created = true;
+            let active = true;
+            const tools = new JobToolSession({ policyOptions,
+                binding: () => {
+                    const binding = production ? production.binding() : input.securityHost ? security.binding() : input.nativeBinding?.();
+                    if (production)
+                        securityPolicy = production.policy();
+                    return binding && binding.jobId === input.jobId && binding.generation === securityPolicy?.pin.generation ? binding : null;
+                },
+                active: () => {
+                    if (!active || disposed)
+                        return false;
+                    try {
+                        if (production)
+                            securityPolicy = production.policy();
+                        requireJobSecurity(securityPolicy, { adapterId: 'codex_cli', adapterVersion: '1', jobId: input.jobId, modelId: String(approved.resolved_model_id ?? ''), sourceSha: String(approved.repository.base_commit_sha) });
+                        return true;
+                    }
+                    catch {
+                        return false;
+                    }
+                },
+            });
+            let closing;
+            const close = () => closing ??= (async () => {
+                active = false;
+                disposed = true;
+                security.revoke();
+                production?.revoke();
+                try {
+                    await tools.close();
+                }
+                finally {
+                    await preparing?.catch(() => { });
+                    await rm(control, { recursive: true, force: true });
+                }
+            })();
+            return { start: async () => { try {
+                    await prepare();
+                    if (!active || disposed)
+                        throw Error();
+                    return await tools.start();
+                }
+                catch {
+                    await close();
+                    throw new Error('CODEX_JOB_TOOLS_START_FAILED');
+                } },
+                revoke: () => { active = false; tools.revoke(); }, close };
+        },
+        startVerifiedSession: async (invocation, prompt, signal, assertAdmission) => {
+            if (disposed || !schemaFile || !input.env.HOME)
+                throw new Error('CODEX_NATIVE_SCHEMA_UNAVAILABLE');
+            return startNativeCodexSession({ processHost, binary: production?.binaryPath() ?? input.env.AI_GATEWAY_LOCAL_RUNNER_CODEX_BINARY ?? 'codex',
+                cwd, sourceRoot: checkout, home: input.env.HOME, schemaPath: schemaFile, scratch: scratch(),
+                ...(production ? { beforeSpawn: () => production.assertPrepared(), prepareProductionAdmission: proof => production.admit(proof) } : securityPolicy?.pin.securityMode ? { prepareSupportedAdmission: expected => security.supportedAdmission(expected) } : {}),
+                onAssessment: assessment => { process.stderr.write(JSON.stringify({ event: 'codex_pre_model_assessment', jobId: input.jobId, ...assessment }) + '\n'); } }, invocation, prompt, signal, assertAdmission);
+        },
+        writeSchema: async (schema) => {
+            await prepare();
+            if (disposed)
+                throw new Error('CODEX_JOB_REVOKED');
+            const file = path.join(control, 'report-schema.json');
+            try {
+                await writeFile(file, JSON.stringify(schema), { mode: 0o600, flag: 'wx' });
+                schemaFile = file;
+                return file;
+            }
+            catch (error) {
+                disposed = true;
+                await rm(control, { recursive: true, force: true });
+                throw error;
+            }
+        },
+    };
+}

package/dist/src/adapters/codex/scratch.js

@@ -0,0 +1,28 @@
+import path from 'node:path';
+const inside = (root, file) => file === root || file.startsWith(root + path.sep);
+const absolute = (value) => path.isAbsolute(value) && path.resolve(value) === value && !/[\r\n\0]/.test(value);
+/** Trusted per-job controls only. Never relocate the account home for scratch. */
+export function codexControlDenials(input) {
+    if (input.codexHome !== undefined && input.codexHome !== '' && !absolute(input.codexHome))
+        throw new Error('CODEX_ACCOUNT_PATH_INVALID');
+    const denied = [input.home, input.cwd, input.sourceRoot ?? input.cwd, input.schemaPath];
+    if (input.codexHome)
+        denied.push(input.codexHome);
+    if (input.scratch) {
+        const directories = Object.values(input.scratch), account = input.codexHome || path.join(input.home, '.codex');
+        for (const directory of directories) {
+            if (!absolute(directory) || directory === path.parse(directory).root
+                || inside(account, directory) || inside(directory, account)
+                || inside(input.sourceRoot ?? input.cwd, directory) || inside(directory, input.sourceRoot ?? input.cwd)
+                || inside(directory, input.home) || inside(directory, input.cwd) || inside(directory, input.schemaPath))
+                throw new Error('CODEX_SCRATCH_PATH_INVALID');
+        }
+        for (let i = 0; i < directories.length; i++)
+            for (let j = i + 1; j < directories.length; j++) {
+                if (inside(directories[i], directories[j]) || inside(directories[j], directories[i]))
+                    throw new Error('CODEX_SCRATCH_OVERLAP');
+            }
+        denied.push(...directories);
+    }
+    return [...new Set(denied)];
+}

package/dist/src/adapters/codex/stdio-rpc.js

@@ -0,0 +1,113 @@
+export const record = (value) => {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('CODEX_NATIVE_INVALID');
+    return value;
+};
+/** One owner/reader; no shared daemon, shell, raw diagnostics or server approvals. */
+export class CodexStdioRpc {
+    handle;
+    id = 0;
+    closed = false;
+    cleanupFailed = false;
+    pending = new Map();
+    listeners = new Set();
+    constructor(handle) {
+        this.handle = handle;
+        void this.read();
+    }
+    request(method, params, timeoutMs = 30_000) {
+        if (this.closed)
+            return Promise.reject(new Error('CODEX_RPC_CLOSED'));
+        const id = ++this.id;
+        return new Promise((resolve, reject) => {
+            const entry = { resolve, reject };
+            if (timeoutMs !== null)
+                entry.timer = setTimeout(() => this.close(), timeoutMs);
+            this.pending.set(id, entry);
+            try {
+                this.handle.stdin.write(JSON.stringify({ id, method, params }) + '\n');
+            }
+            catch {
+                this.close();
+            }
+        });
+    }
+    notify(method, params) {
+        if (this.closed)
+            throw new Error('CODEX_RPC_CLOSED');
+        try {
+            this.handle.stdin.write(JSON.stringify({ method, ...(params ? { params } : {}) }) + '\n');
+        }
+        catch {
+            this.close();
+            throw new Error('CODEX_RPC_CLOSED');
+        }
+    }
+    onNotification(listener) { this.listeners.add(listener); return () => this.listeners.delete(listener); }
+    close() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        try {
+            this.handle.kill('SIGKILL');
+        }
+        catch {
+            this.cleanupFailed = true;
+        }
+        finally {
+            for (const p of this.pending.values()) {
+                if (p.timer)
+                    clearTimeout(p.timer);
+                p.reject(new Error('CODEX_RPC_CLOSED'));
+            }
+            this.pending.clear();
+            for (const listener of this.listeners) {
+                try {
+                    listener({ method: 'error', params: { code: this.cleanupFailed ? 'CODEX_CLEANUP_UNCONFIRMED' : 'CODEX_RPC_CLOSED' } });
+                }
+                catch { /* No raw errors. */ }
+            }
+            this.listeners.clear();
+        }
+    }
+    cleanupConfirmed() { return !this.cleanupFailed; }
+    async read() {
+        try {
+            for await (const line of this.handle.stdout) {
+                if (this.closed)
+                    return;
+                if (Buffer.byteLength(line) > 256_000)
+                    throw new Error('frame');
+                const message = record(JSON.parse(line));
+                if (typeof message.method === 'string') {
+                    if (message.id !== undefined) {
+                        this.handle.stdin.write(JSON.stringify({ id: message.id, error: { code: -32601, message: 'Unsupported server request' } }) + '\n');
+                        throw new Error('server_request');
+                    }
+                    for (const listener of this.listeners)
+                        listener(message);
+                }
+                else {
+                    if (typeof message.id !== 'number' || !this.pending.has(message.id))
+                        throw new Error('response_id');
+                    const p = this.pending.get(message.id);
+                    this.pending.delete(message.id);
+                    if (p.timer)
+                        clearTimeout(p.timer);
+                    if (message.error !== undefined)
+                        p.reject(new Error('CODEX_RPC_REJECTED'));
+                    else if (Object.hasOwn(message, 'result'))
+                        p.resolve(message.result);
+                    else {
+                        p.reject(new Error('CODEX_RPC_REJECTED'));
+                        throw new Error('response_shape');
+                    }
+                }
+            }
+        }
+        catch { /* Fixed boundary errors only. */ }
+        finally {
+            this.close();
+        }
+    }
+}

package/dist/src/adapters/codex/stream-parser.js

@@ -0,0 +1,85 @@
+import { completionEvent } from "../completion-report.js";
+function record(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value)
+        ? value : undefined;
+}
+function finalReport(text) {
+    const complete = completionEvent(text);
+    if (complete.eventType === "completed" || typeof text !== "string" || text.length > 16_000)
+        return complete;
+    let value;
+    try {
+        value = record(JSON.parse(text));
+    }
+    catch {
+        return complete;
+    }
+    const bounded = (v, size) => typeof v === "string" && v.trim().length > 0 && v.length <= size;
+    const entries = (v, min) => Array.isArray(v) && v.length >= min && v.length <= 20 && v.every(item => bounded(item, 500));
+    if (!value || Object.keys(value).some(key => !["status", "report", "evidence", "pending_work"].includes(key))
+        || value.status !== "blocked" || !bounded(value.report, 2000)
+        || !entries(value.evidence, 0) || !entries(value.pending_work, 1))
+        return complete;
+    return { eventType: "blocked", summary: value.report.trim(), payload: { pending_work: value.pending_work, completion_evidence: value.evidence } };
+}
+/** Codex wire parsing is independent of Claude. Never forward reasoning or raw errors. */
+export class CodexStreamParser {
+    stopped = false;
+    report;
+    candidates = 0;
+    parse(line) {
+        if (this.stopped)
+            return [];
+        if (line.length > 256_000)
+            return this.finish({ eventType: "failed", summary: "Codex output exceeded the allowed event size" });
+        let event;
+        try {
+            event = record(JSON.parse(line));
+        }
+        catch {
+            return [];
+        }
+        if (!event)
+            return [];
+        if (event.type === "thread.started")
+            return [{ eventType: "started", summary: "Codex session started" }];
+        if (event.type === "turn.failed" || event.type === "error") {
+            return this.finish({ eventType: "failed", summary: "Codex execution failed; provider output was withheld" });
+        }
+        const item = record(event.item);
+        if (["item.started", "item.updated", "item.completed"].includes(String(event.type)) && item) {
+            // Defense in depth only: post-event detection is not the authorization boundary.
+            if (["command_execution", "file_change", "web_search"].includes(String(item.type))) {
+                return this.finish({ eventType: "scope_conflict", summary: "Codex emitted a native tool operation outside the job bridge" });
+            }
+            if (event.type === "item.completed" && item.type === "agent_message") {
+                this.report = item.text;
+                if (["completed", "blocked"].includes(finalReport(item.text).eventType))
+                    this.candidates += 1;
+            }
+        }
+        if (event.type !== "turn.completed")
+            return [];
+        const terminal = this.candidates === 1 ? finalReport(this.report)
+            : { eventType: "failed", summary: "Codex did not return one unambiguous completion report" };
+        const usage = record(event.usage);
+        const observed = {};
+        for (const field of ["input_tokens", "cached_input_tokens", "output_tokens"]) {
+            const value = usage?.[field];
+            if (typeof value === "number" && Number.isSafeInteger(value) && value >= 0)
+                observed[field] = value;
+        }
+        if (Object.keys(observed).length > 0)
+            terminal.payload = { ...terminal.payload,
+                usage: { provider: "openai", source: event.usage_source === "codex_app_server.thread/tokenUsage/updated" ? event.usage_source : "codex_cli.turn.completed", ...observed } };
+        return this.finish(terminal);
+    }
+    end() {
+        return this.stopped ? [] : this.finish({ eventType: "failed", summary: "Codex ended without a validated completion report" });
+    }
+    finish(event) {
+        this.stopped = true;
+        this.report = undefined;
+        return [event];
+    }
+}

package/dist/src/adapters/codex/supported-admission.js

@@ -0,0 +1,97 @@
+import { isAbsolute } from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
+import { SUPPORTED_CLI_GATES as SUPPORTED_CODEX_GATES, SUPPORTED_CLI_RISKS as SUPPORTED_CODEX_RISKS } from '../../safety/cli-security-modes.js';
+export { SUPPORTED_CODEX_GATES, SUPPORTED_CODEX_RISKS };
+const expectedKeys = ['model', 'provider', 'cwd', 'configFingerprint', 'toolSchemaFingerprint', 'endpoint'];
+const bindingKeys = ['jobId', 'generation', 'actorId', 'runnerId', 'repositoryKey', 'sourceSha', 'launchFingerprint', 'contractFingerprint', 'taskPackageFingerprint', 'binarySha256', 'requirementsFingerprint', 'managedPolicyFingerprint', 'commandsFingerprint', 'decisionId'];
+const pinKeys = [...expectedKeys, ...bindingKeys, 'mode'];
+const issued = new WeakMap();
+const object = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
+const exact = (v, keys) => isDeepStrictEqual(Reflect.ownKeys(v).sort(), [...keys].sort());
+const fail = () => new Error('CODEX_SUPPORTED_POLICY_REJECTED');
+function validPin(v) {
+    try {
+        if (!object(v) || !exact(v, pinKeys) || v.mode !== 'supported_cli_policy_v1' || v.provider !== 'openai'
+            || !Number.isSafeInteger(v.generation) || Number(v.generation) < 1)
+            return false;
+        for (const k of pinKeys.filter(k => k !== 'generation'))
+            if (typeof v[k] !== 'string' || !v[k] || String(v[k]).length > 4096 || /[\r\n\0]/.test(String(v[k])))
+                return false;
+        if (!isAbsolute(String(v.cwd)) || !/^[a-f0-9]{40}$/.test(String(v.sourceSha))
+            || !/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(String(v.decisionId)))
+            return false;
+        for (const k of pinKeys.filter(k => k.endsWith('Fingerprint') || k === 'binarySha256'))
+            if (!/^[a-f0-9]{64}$/.test(String(v[k])))
+                return false;
+        const u = new URL(String(v.endpoint));
+        return u.protocol === 'http:' && u.hostname === '127.0.0.1' && !!u.port && u.pathname === '/mcp' && !u.username && !u.password && !u.search && !u.hash;
+    }
+    catch {
+        return false;
+    }
+}
+/** Bounded diagnostics only; even a passing result is not a capability. */
+export function assessSupportedCodexEvidence(value, pin) {
+    const reasons = [];
+    if (!validPin(pin))
+        return { ready: false, reasonCodes: ['SUPPORTED_PIN_INVALID'] };
+    try {
+        if (!object(value) || !exact(value, ['version', 'mode', 'pin', 'acceptedResidualRisks', 'checks'])
+            || value.version !== 'codex-supported-policy-evidence-v1' || value.mode !== 'supported_cli_policy_v1')
+            reasons.push('SUPPORTED_EVIDENCE_MODE_INVALID');
+        if (!object(value) || !validPin(value.pin) || !isDeepStrictEqual(value.pin, pin))
+            reasons.push('SUPPORTED_PIN_MISMATCH');
+        if (!object(value) || !isDeepStrictEqual(value.acceptedResidualRisks, [...SUPPORTED_CODEX_RISKS]))
+            reasons.push('SUPPORTED_RISK_ACKNOWLEDGEMENT_MISSING');
+        const checks = object(value) && Array.isArray(value.checks) ? value.checks : [];
+        if (checks.length !== SUPPORTED_CODEX_GATES.length || checks.some(c => !object(c) || !exact(c, ['gate', 'status'])
+            || !SUPPORTED_CODEX_GATES.includes(c.gate)) || new Set(checks.map(c => object(c) ? c.gate : null)).size !== checks.length)
+            reasons.push('SUPPORTED_CHECK_SET_INVALID');
+        for (const gate of SUPPORTED_CODEX_GATES)
+            if (checks.filter(c => object(c) && c.gate === gate && c.status === 'passed').length !== 1)
+                reasons.push('SUPPORTED_' + gate.toUpperCase() + '_UNVERIFIED');
+    }
+    catch {
+        return { ready: false, reasonCodes: ['SUPPORTED_EVIDENCE_MALFORMED'] };
+    }
+    return { ready: reasons.length === 0, reasonCodes: reasons };
+}
+/** Trusted host dependency, never an env/task/JSON factory. Fake verifiers live
+ * in tests. No production verifier or release manifest is supplied here. */
+export async function admitSupportedCodexPolicy(expected, verify) {
+    try {
+        if (!validPin(expected))
+            throw fail();
+        const pin = Object.freeze(structuredClone(expected));
+        const evidence = await verify(pin);
+        if (!assessSupportedCodexEvidence(evidence, pin).ready)
+            throw fail();
+        const state = { active: true };
+        const policy = Object.freeze({ pin, revoke: () => { state.active = false; } });
+        issued.set(policy, state);
+        return policy;
+    }
+    catch {
+        throw fail();
+    }
+}
+export function requireSupportedCodexPolicy(policy, expected, binding, session) {
+    try {
+        if (!object(policy))
+            throw fail();
+        const state = issued.get(policy);
+        if (!state?.active || !object(expected) || !exact(expected, expectedKeys) || !object(binding) || !exact(binding, bindingKeys))
+            throw fail();
+        const pin = { ...expected, ...binding, mode: 'supported_cli_policy_v1' };
+        if (!validPin(pin) || !isDeepStrictEqual(policy.pin, pin))
+            throw fail();
+        if (session) {
+            if (state.session && state.session !== session)
+                throw fail();
+            state.session = session;
+        }
+    }
+    catch {
+        throw fail();
+    }
+}

package/dist/src/adapters/codex/tool-dispatcher.js

@@ -0,0 +1,20 @@
+import { JobToolDispatcher } from '../../safety/job-tool-dispatcher.js';
+/** Compatibility wrapper; the common dispatcher owns all authority checks. */
+export class CodexToolDispatcher extends JobToolDispatcher {
+    constructor(...args) {
+        try {
+            super(...args);
+        }
+        catch {
+            throw new Error('CODEX_TOOL_DISPATCH_REJECTED');
+        }
+    }
+    async dispatch(input) {
+        try {
+            return await super.dispatch(input);
+        }
+        catch {
+            throw new Error('CODEX_TOOL_DISPATCH_REJECTED');
+        }
+    }
+}

package/dist/src/adapters/completion-report.js

@@ -0,0 +1,64 @@
+import { MAX_EVENT_SUMMARY_CHARS } from "../protocol.js";
+const MAX_EVIDENCE_ITEMS = 20;
+const MAX_EVIDENCE_CHARS = 500;
+const MAX_REPORT_ENVELOPE_CHARS = 16_000;
+export const COMPLETION_REPORT_NOTICE = "Do the assigned work yourself using the available tools; do not delegate or start background work. " +
+    "Do not report completed while waiting for results, tests, or another agent. " +
+    "Your final response must be one JSON object, without Markdown fences: " +
+    '{"status":"completed","report":"actual findings and results","evidence":["file path and observed finding, or command and actual result"],"pending_work":[]}. ' +
+    `The report must be nonempty and at most ${MAX_EVENT_SUMMARY_CHARS} characters. ` +
+    `Include 1-${MAX_EVIDENCE_ITEMS} nonempty evidence strings, each at most ${MAX_EVIDENCE_CHARS} characters. ` +
+    "Address the assigned objective and each applicable acceptance criterion with observed evidence, not a plan or promise. " +
+    "Only attest to executor work you observed; Gateway records transport, completion, and review receipts separately. " +
+    'If the task is unfinished, use "status":"blocked" and list the remaining work in "pending_work". ' +
+    "An incomplete or missing report is a failed execution, never a successful investigation artifact.";
+function boundedText(value, max) {
+    return typeof value === "string" && value.trim().length > 0 && value.length <= max;
+}
+/** Validate the full final result before truncation; never publish malformed/interim output. */
+export function completionEvent(result, costUsd) {
+    const usage = typeof costUsd === "number" && Number.isFinite(costUsd) && costUsd >= 0
+        ? { cost_usd: costUsd }
+        : {};
+    const failed = {
+        eventType: "failed",
+        summary: "completion report is missing, incomplete or invalid",
+        payload: usage,
+    };
+    if (typeof result !== "string" || result.length > MAX_REPORT_ENVELOPE_CHARS)
+        return failed;
+    let report;
+    try {
+        report = JSON.parse(result);
+    }
+    catch {
+        // Claude may wrap the final report in one Markdown fence after a short
+        // explanation. Accept framing only; retain every completion/evidence check.
+        if ((result.match(/```/g) ?? []).length !== 2)
+            return failed;
+        const framed = result.trim().match(/^(?:[\s\S]*?\n)?```(?:json)?[ \t]*\r?\n([\s\S]*?)\r?\n```$/);
+        if (!framed)
+            return failed;
+        try {
+            report = JSON.parse(framed[1]);
+        }
+        catch {
+            return failed;
+        }
+    }
+    if (!report || typeof report !== "object" || Array.isArray(report))
+        return failed;
+    const value = report;
+    if (Object.keys(value).some((key) => !["status", "report", "evidence", "pending_work"].includes(key))
+        || value.status !== "completed"
+        || !boundedText(value.report, MAX_EVENT_SUMMARY_CHARS)
+        || !Array.isArray(value.pending_work) || value.pending_work.length !== 0
+        || !Array.isArray(value.evidence) || value.evidence.length < 1 || value.evidence.length > MAX_EVIDENCE_ITEMS
+        || !value.evidence.every((item) => boundedText(item, MAX_EVIDENCE_CHARS)))
+        return failed;
+    return {
+        eventType: "completed",
+        summary: value.report.trim(),
+        payload: { ...usage, investigation_summary: value.report.trim(), completion_evidence: value.evidence },
+    };
+}

package/dist/src/adapters/discovery.js

@@ -0,0 +1,76 @@
+import { createCodexProductionHost } from '../safety/codex-production-host.js';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { diagnoseCliHostAdmission } from '../safety/cli-host-admission.js';
+import { inspectCodexCompatibility } from './codex/compatibility.js';
+const exec = promisify(execFile);
+const run = (binary, args) => exec(binary, args, { encoding: 'utf8', timeout: 10000, maxBuffer: 65536 });
+export const CLAUDE_CAPABILITIES = ['repository_read', 'repository_edit', 'shell_test', 'git_diff'];
+/** Never return raw CLI output, stderr, user identifiers or credentials. */
+export async function discoverAdapters(env, command = run, adapterIds = ['claude_code_cli', 'codex_cli']) {
+    if (adapterIds.some(id => !['claude_code_cli', 'codex_cli'].includes(id)) || new Set(adapterIds).size !== adapterIds.length)
+        throw new Error('ADAPTER_DISCOVERY_SCOPE_REJECTED');
+    return Promise.all(adapterIds.map(async (id) => {
+        const codex = id === 'codex_cli';
+        const binary = codex ? env.AI_GATEWAY_LOCAL_RUNNER_CODEX_BINARY ?? 'codex' : env.AI_GATEWAY_LOCAL_RUNNER_CLAUDE_BINARY ?? 'claude';
+        const base = { id, version: '1' };
+        try {
+            const output = await command(binary, ['--version']);
+            const executableVersion = output.stdout.match(/\b\d+\.\d+\.\d+(?:[-+][\w.-]+)?\b/)?.[0];
+            if (!executableVersion)
+                throw new Error('invalid version');
+            let authenticated = false;
+            try {
+                const auth = await command(binary, codex ? ['login', 'status'] : ['auth', 'status']);
+                authenticated = !codex || /^Logged in using ChatGPT\s*$/i.test([auth.stdout, auth.stderr ?? ''].join('\n').trim());
+            }
+            catch { /* Missing login is diagnostic, never an API-key fallback. */ }
+            if (codex) {
+                const compatibility = inspectCodexCompatibility({ cliVersion: executableVersion });
+                const admission = await diagnoseCliHostAdmission(id, binary, env);
+                return { ...base, available: compatibility.available, authenticated, executableVersion, capabilities: compatibility.capabilities, admission,
+                    reason: !authenticated ? 'Codex requires a ChatGPT account login; API-key authentication is unsupported.' : compatibility.reason };
+            }
+            const admission = await diagnoseCliHostAdmission(id, binary, env);
+            return { ...base, available: admission.available, authenticated, executableVersion, capabilities: admission.capabilities, admission, reason: !authenticated ? 'Claude CLI login is required.' : 'Claude CLI security isolation is unverified; execution is unsupported.' };
+        }
+        catch {
+            return { ...base, available: false, authenticated: false, capabilities: [], reason: codex ? 'Codex CLI is missing or its version could not be verified.' : 'Claude CLI is missing or its version could not be verified.' };
+        }
+    }));
+}
+export function hasUsableAdapter(adapters) {
+    return adapters.some(adapter => adapter.available !== false && adapter.authenticated);
+}
+/** Stable local remedies, never a CLI stderr or account-output echo. */
+export function adapterDiagnosticsWithRemedies(adapters) {
+    return adapters.map(adapter => {
+        let action;
+        if (adapter.id === 'codex_cli') {
+            if (adapter.authenticated && !adapter.available)
+                action = 'Codex execution is unsupported until CLI isolation is verified. Login does not grant security admission; wait for a reviewed CLI release.';
+            else if (!adapter.executableVersion)
+                action = 'Install Codex CLI, then run codex login using your ChatGPT account. Recheck doctor; execution also requires verified CLI isolation.';
+            else if (!adapter.authenticated)
+                action = 'Run codex login using your ChatGPT account; API-key login is unsupported. Recheck doctor; execution also requires verified CLI isolation.';
+            else
+                action = 'Codex is ready for an explicitly selected approved launch.';
+        }
+        else if (!adapter.available && adapter.executableVersion && adapter.authenticated)
+            action = 'Claude CLI security isolation is unverified; wait for a reviewed release. Login alone does not grant execution.';
+        else if (!adapter.available)
+            action = 'Install Claude Code CLI and sign in, then rerun doctor; security admission is also required.';
+        else if (!adapter.authenticated)
+            action = 'Run claude auth login, then rerun doctor.';
+        else
+            action = 'Claude is ready for an explicitly selected approved launch.';
+        return { ...adapter, action };
+    });
+}
+/** Setup/doctor use the same reviewed Codex probe as daemon; no legacy vendor
+ * login-status process is spawned by these employee entrypoints for Codex. */
+export async function discoverEmployeeAdapters(env, command) {
+    const host = createCodexProductionHost({ runnerId: 'discovery-only', binary: env.AI_GATEWAY_LOCAL_RUNNER_CODEX_BINARY ?? 'codex', home: env.HOME ?? '', codexHome: env.CODEX_HOME, searchPath: env.PATH });
+    const [claude, codex] = await Promise.all([discoverAdapters(env, command, ['claude_code_cli']), host.probe()]);
+    return [...claude, { id: 'codex_cli', version: '1', ...codex }];
+}