mtech-ai-local-runner 0.1.8 → 0.1.9

package/dist/src/adapters/prompt-compiler.js

@@ -0,0 +1,60 @@
+import { COMPLETION_REPORT_NOTICE } from "./completion-report.js";
+const STOP_BEFORE_PUBLICATION_RULE = "Stop before publication. Never run git commit, git push, create a pull request, merge, " +
+    "deploy, access production, send an external message, or write data outside this worktree.";
+const EVENT_SCHEMA_NOTICE = "Report progress only through the normalized event lifecycle (started, progress, file_changed, question, " +
+    "test_started, test_result, budget_warning, checkpoint_ready, blocked, completed, failed). " +
+    "Checkpoint your work with checkpoint_ready before stopping whenever it is safe to do so.";
+function requiredArray(value, label) {
+    if (!Array.isArray(value)) {
+        throw new Error(`task package is missing ${label}`);
+    }
+    return value.map((item) => String(item));
+}
+function record(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+export function compilePrompt(taskPackage, options) {
+    const contract = record(taskPackage.contract);
+    if (!contract) {
+        throw new Error("task package is missing a contract");
+    }
+    const agentExecution = record(taskPackage.agent_execution);
+    if (!agentExecution) {
+        throw new Error("task package is missing the implementation brief (agent_execution section)");
+    }
+    const brief = record(agentExecution.implementation_brief);
+    if (!brief) {
+        throw new Error("task package is missing the implementation brief");
+    }
+    const unresolvedQuestions = requiredArray(brief.unresolved_questions ?? [], "unresolved_questions");
+    if (unresolvedQuestions.length > 0) {
+        throw new Error(`task package has unresolved questions that must be resolved before dispatch: ${unresolvedQuestions.join("; ")}`);
+    }
+    const contractObjective = record(contract.objective);
+    const objective = String(brief.objective ?? contractObjective?.summary ?? "");
+    if (!objective) {
+        throw new Error("task package is missing an objective");
+    }
+    const acceptanceCriteria = requiredArray(brief.acceptance_criteria ?? contractObjective?.acceptance_criteria ?? [], "acceptance_criteria");
+    const prohibitedActions = requiredArray(agentExecution.prohibited_actions ?? [], "prohibited_actions");
+    const requiredChanges = requiredArray(brief.required_changes ?? [], "required_changes");
+    const invariants = requiredArray(brief.invariants ?? [], "invariants");
+    const nonGoals = requiredArray(brief.non_goals ?? [], "non_goals");
+    const requiredTests = requiredArray(brief.required_tests ?? [], "required_tests");
+    const sections = [
+        `# Bounded implementation brief: ${options.workItemLabel}`,
+        `## Objective\n${objective}`,
+        `## Required changes\n${requiredChanges.map((item) => `- ${item}`).join("\n")}`,
+        `## Invariants\n${invariants.map((item) => `- ${item}`).join("\n")}`,
+        `## Non-goals\n${nonGoals.map((item) => `- ${item}`).join("\n")}`,
+        `## Acceptance criteria\n${acceptanceCriteria.map((item) => `- ${item}`).join("\n")}`,
+        `## Required tests\n${requiredTests.map((item) => `- ${item}`).join("\n")}`,
+        `## Prohibited actions\n${prohibitedActions.map((item) => `- ${item}`).join("\n")}`,
+        `## Stop-before-publication rule\n${STOP_BEFORE_PUBLICATION_RULE}`,
+        `## Event and checkpoint obligations\n${EVENT_SCHEMA_NOTICE}`,
+        `## Final completion report\n${COMPLETION_REPORT_NOTICE}`,
+    ];
+    return sections.join("\n\n");
+}

package/dist/src/adapters/registry.js

@@ -9,11 +9,16 @@ export class AdapterRegistry {
         }
     }
     async probeAll() {
-        return Promise.all([...this.plugins.values()].map(async (plugin) => ({
-            id: plugin.id,
-            version: plugin.version,
-            ...await plugin.probe(),
-        })));
+        return Promise.all([...this.plugins.values()].map(async (plugin) => {
+            let probe;
+            try {
+                probe = await plugin.probe();
+            }
+            catch {
+                probe = { available: false, authenticated: false, capabilities: [], reason: "Adapter discovery failed; check the local executable and login" };
+            }
+            return { id: plugin.id, version: plugin.version, ...probe };
+        }));
     }
     async select(id, version, input) {
         const plugin = this.plugins.get(id);

package/dist/src/cli.js

@@ -6,7 +6,7 @@ import { loadConfig, redact, isAuthConfig, isExecutionConfig, isServiceConfig }
 import { McpGatewayClient } from "./gateway-client.js";
 import { Runner } from "./runner.js";
 import { FileRunnerStateStore } from "./state-store.js";
-import { NodeProcessHost } from "./process/node-process-host.js";
+import { createClaudeCodeAdapterOptions } from "./adapters/claude-code/runtime-options.js";
 import { ClaudeCodeAdapter } from "./adapters/claude-code/adapter.js";
 import { verifyCheckout } from "./safety/checkout-guard.js";
 import { buildNodeCheckoutInspectorDeps, realNodeCheckoutInspectorDeps } from "./safety/node-checkout-inspector.js";
@@ -15,15 +15,12 @@ import { FileOAuthCredentialStore } from "./auth/credential-store.js";
 import { OAuthClient } from "./auth/oauth-client.js";
 import { LoopbackLogin } from "./auth/loopback-login.js";
 import { OAuthTokenProvider, LoginRequiredError } from "./auth/token-provider.js";
-import { McpRelay } from "./auth/mcp-relay.js";
-import { McpRelayConfig } from "./auth/mcp-relay-config.js";
 import { createBrowserOpener } from "./auth/browser-opener.js";
 import { FileLocalConfigStore } from "./registration/local-config.js";
 import { LaunchdService } from "./platform/macos/launchd.js";
 import { buildDaemon, runnerDisplayName } from "./daemon/runtime.js";
 import { createHash } from "node:crypto";
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
+import { discoverEmployeeAdapters, hasUsableAdapter, adapterDiagnosticsWithRemedies } from "./adapters/discovery.js";
 import { mkdir, rm } from "node:fs/promises";
 export async function cleanupOnceResources(configPath, closeRelay, unlinkFile = unlinkSync) {
     const errors = [];
@@ -53,45 +50,17 @@ function buildCheckoutPreflight() {
     };
 }
 async function buildOnceAdapter(config, env, tokenProvider, fetchFn) {
-    const relay = new McpRelay({
-        tokenProvider,
-        upstreamMcpUrl: config.gatewayMcpUrl,
-        upstreamFetch: fetchFn,
+    const options = createClaudeCodeAdapterOptions({
+        worktreePath: config.checkoutPath, jobId: config.workLoopId, stateRoot: config.stateRoot, env,
+        binaryPath: config.claudeBinaryPath, hookExecutablePath: config.hookExecutablePath,
+        maxBudgetUsd: Number.MAX_SAFE_INTEGER, workItemLabel: config.workLoopId,
     });
-    const relayServer = await relay.start();
-    const configs = new McpRelayConfig(config.stateRoot, relay, relayServer.url);
-    let adapter;
-    try {
-        adapter = new ClaudeCodeAdapter({
-            processHost: new NodeProcessHost(),
-            worktreeRoot: config.checkoutPath,
-            maxBudgetUsd: Number.MAX_SAFE_INTEGER,
-            workItemLabel: config.workLoopId,
-            env,
-            registeredReadTools: config.registeredReadTools,
-            writeMcpConfig: (cfg) => configs.write(cfg),
-            mcpServerName: "ai_gateway",
-            binaryPath: config.claudeBinaryPath,
-            hookExecutablePath: config.hookExecutablePath,
-        });
-    }
-    catch (err) {
-        // Close relay if adapter construction fails
-        try {
-            await relay.close();
-        }
-        catch {
-            // Suppress relay close error; propagate adapter error
-        }
-        throw err;
-    }
-    // Cleanup function: always attempts both config unlink and relay close
-    const cleanup = async () => cleanupOnceResources(null, async () => { try {
-        configs.clear();
-    }
-    finally {
-        await relay.close();
-    } });
+    // Do not create a Gateway binding through the legacy once path while the
+    // shared native release evidence is absent. Injected test adapters are separate.
+    if (!options.securityPolicy)
+        throw new Error('CLI_SECURITY_ADMISSION_UNAVAILABLE: verified CLI isolation is required');
+    const adapter = new ClaudeCodeAdapter(options);
+    const cleanup = async () => adapter.cancel();
     return { adapter, cleanup };
 }
 async function handleLogin(config, stdout, stderr, fetchFn = fetch, opener) {
@@ -168,6 +137,11 @@ export async function main(argv, env, io = {}) {
             if (config.mode === "setup") {
                 if (process.platform !== "darwin")
                     throw new Error("Local runner daemon setup requires macOS");
+                const detected = await (io.discoverAdapters?.() ?? discoverEmployeeAdapters(env));
+                if (!hasUsableAdapter(detected)) {
+                    stdout(JSON.stringify({ ok: false, configured: false, adapters: adapterDiagnosticsWithRemedies(detected), action: "Resolve adapter diagnostics, then rerun setup." }));
+                    throw new Error("No usable authenticated runtime adapter is available");
+                }
                 const loginCode = await handleLogin(config, stdout, stderr, fetchFn, io.browserOpener);
                 if (loginCode !== 0)
                     return loginCode;
@@ -176,21 +150,29 @@ export async function main(argv, env, io = {}) {
                 const oauthClient = new OAuthClient({ resource: config.gatewayMcpUrl, fetchFn });
                 const tokenProvider = new OAuthTokenProvider({ store: credentialStore, oauthClient, resource: config.gatewayMcpUrl, clock: () => Date.now() });
                 const gateway = new McpGatewayClient({ mcpUrl: config.gatewayMcpUrl, tokenProvider, runnerId: "setup", fetchFn });
-                const runFile = promisify(execFile);
-                const binary = env.AI_GATEWAY_LOCAL_RUNNER_CLAUDE_BINARY ?? "claude";
-                const version = await runFile(binary, ["--version"], { encoding: "utf8" });
-                const authenticated = await runFile(binary, ["auth", "status"], { encoding: "utf8" }).then(() => true).catch(() => false);
+                const adapters = await (io.discoverAdapters?.() ?? discoverEmployeeAdapters(env));
+                if (!hasUsableAdapter(adapters)) {
+                    stdout(JSON.stringify({ ok: false, configured: false, adapters: adapterDiagnosticsWithRemedies(adapters), action: "Resolve adapter diagnostics, then rerun setup." }));
+                    throw new Error("No usable authenticated runtime adapter is available. Run doctor for adapter diagnostics.");
+                }
                 const registered = await gateway.registerLocalRunner({
                     deviceFingerprint: createHash("sha256").update(`${process.getuid?.() ?? 0}|${runnerDisplayName()}|${config.gatewayMcpUrl}`).digest("hex"),
-                    displayName: runnerDisplayName(), packageVersion: "0.1.8",
-                    capabilities: [{ adapter: "claude_code_cli", version: "1", capabilities: ["repository_read", "repository_edit", "shell_test", "git_diff"], authenticated }],
+                    displayName: runnerDisplayName(), packageVersion: "0.1.9",
+                    capabilities: adapters.map(probe => ({ adapter: probe.id, version: probe.version, capabilities: probe.capabilities, authenticated: probe.available && probe.authenticated })),
                 });
                 await localStore.save({ schemaVersion: 1, gatewayMcpUrl: config.gatewayMcpUrl, runnerId: registered.runner.id, workspaceRoot: config.workspaceRoot, concurrency: 1 });
                 await launchd.install(process.argv[1], config.stateRoot);
-                stdout(JSON.stringify({ configured: true, runnerId: registered.runner.id, adapter: "claude_code_cli", adapterVersion: version.stdout.trim(), authenticated }));
-                return authenticated ? 0 : 1;
+                stdout(JSON.stringify({ configured: true, runnerId: registered.runner.id, adapters }));
+                return 0;
             }
+            const doctorAdapters = config.mode === "doctor" ? adapterDiagnosticsWithRemedies(await (io.discoverAdapters?.() ?? discoverEmployeeAdapters(env))) : undefined;
             const local = await localStore.load();
+            if (!local && config.mode === "doctor") {
+                stdout(JSON.stringify({ ok: false, configured: false, adapters: doctorAdapters,
+                    checks: { oauth: false, gateway: false, runner_registration: false, workspace: false, launchd: false },
+                    action: "Resolve adapter diagnostics, then run setup to register this runner." }));
+                return 1;
+            }
             if (!local)
                 throw new Error("Local runner is not configured. Run npx mtech-ai-local-runner setup.");
             if (config.mode === "start") {
@@ -214,13 +196,23 @@ export async function main(argv, env, io = {}) {
             const oauthClient = new OAuthClient({ resource: local.gatewayMcpUrl, fetchFn });
             const tokenProvider = new OAuthTokenProvider({ store: credentialStore, oauthClient, resource: local.gatewayMcpUrl, tokenOverride: env.AI_GATEWAY_LOCAL_RUNNER_TOKEN, clock: () => Date.now() });
             if (config.mode === "doctor") {
-                await tokenProvider.getToken();
-                await mkdir(local.workspaceRoot, { recursive: true, mode: 0o700 });
-                const gateway = new McpGatewayClient({ mcpUrl: local.gatewayMcpUrl, tokenProvider, runnerId: local.runnerId, fetchFn });
-                const status = await gateway.localRunnerStatus();
-                const service = await launchd.status();
-                stdout(JSON.stringify({ ok: service.loaded, runner: status, launchd: service }));
-                return service.loaded ? 0 : 1;
+                const adapters = doctorAdapters;
+                const localChecks = Promise.allSettled([
+                    launchd.status(),
+                    mkdir(local.workspaceRoot, { recursive: true, mode: 0o700 }),
+                ]);
+                // Refresh rotating credentials once before the Gateway client asks for a token.
+                const [oauth] = await Promise.allSettled([tokenProvider.getToken()]);
+                const [gateway] = oauth.status === "fulfilled"
+                    ? await Promise.allSettled([new McpGatewayClient({ mcpUrl: local.gatewayMcpUrl, tokenProvider, runnerId: local.runnerId, fetchFn }).localRunnerStatus()])
+                    : [{ status: "rejected", reason: "Authentication is unavailable" }];
+                const [service, workspace] = await localChecks;
+                const checks = [oauth, gateway, service, workspace];
+                const loaded = service.status === "fulfilled" && service.value.loaded;
+                const ok = checks.every(check => check.status === "fulfilled") && loaded && hasUsableAdapter(adapters);
+                stdout(JSON.stringify({ ok, configured: true, adapters, checks: { runner_registration: true, oauth: oauth.status === "fulfilled", gateway: gateway.status === "fulfilled", workspace: workspace.status === "fulfilled", launchd: loaded },
+                    ...(gateway.status === "fulfilled" ? { runner: gateway.value } : {}), ...(service.status === "fulfilled" ? { launchd: service.value } : {}) }));
+                return ok ? 0 : 1;
             }
             const runtime = await buildDaemon({ gatewayMcpUrl: local.gatewayMcpUrl, runnerId: local.runnerId, workspaceRoot: local.workspaceRoot, stateRoot: config.stateRoot, tokenProvider, fetchFn, env });
             try {

package/dist/src/commands/doctor.js

@@ -1,3 +1,4 @@
+import { hasUsableAdapter } from "../adapters/discovery.js";
 export class Doctor {
     deps;
     constructor(deps) {
@@ -24,6 +25,11 @@ export class Doctor {
                 checks.push({ key, ok: false, detail: error instanceof Error ? error.message : String(error) });
             }
         }
-        return { ok: checks.every((check) => check.ok), checks };
+        const adapters = await this.deps.adapterDiagnostics?.();
+        if (adapters) {
+            const check = checks.find(check => check.key === "adapters");
+            check.ok = hasUsableAdapter(adapters);
+        }
+        return { ok: checks.every((check) => check.ok), checks, ...(adapters ? { adapters } : {}) };
     }
 }

package/dist/src/commands/setup.js

@@ -1,3 +1,4 @@
+import { hasUsableAdapter } from "../adapters/discovery.js";
 export class SetupCommand {
     deps;
     constructor(deps) {
@@ -8,6 +9,8 @@ export class SetupCommand {
             throw new Error("Local runner daemon setup requires macOS");
         await this.deps.login();
         const adapters = await this.deps.probeAdapters();
+        if (!hasUsableAdapter(adapters))
+            throw new Error("No usable authenticated runtime adapter is available");
         const registration = await this.deps.register({ workspaceRoot: input.workspaceRoot, adapters });
         await this.deps.installService();
         const doctor = await this.deps.doctor();

package/dist/src/daemon/execution-coordinator.js

@@ -1,3 +1,4 @@
+import { requireSecurityRequirements } from '../safety/security-requirements.js';
 import { GatewayToolError } from "../gateway-client.js";
 import { createHash } from "node:crypto";
 import { PROTOCOL_VERSION, isTerminalEventType, validateEvent, MAX_EVENT_SUMMARY_CHARS } from "../protocol.js";
@@ -29,6 +30,14 @@ function text(value, label) {
         throw new Error(`task package is missing ${label}`);
     return value;
 }
+function immutable(value) {
+    if (value && typeof value === "object") {
+        for (const child of Object.values(value))
+            immutable(child);
+        Object.freeze(value);
+    }
+    return value;
+}
 class PreparationDeadlineError extends Error {
 }
 export class ExecutionCoordinator {
@@ -37,6 +46,7 @@ export class ExecutionCoordinator {
         this.deps = deps;
     }
     async execute(job) {
+        job = { ...job, taskPackage: immutable(structuredClone(job.taskPackage)) };
         let stage = "package";
         let workspace;
         let adapter;
@@ -63,6 +73,10 @@ export class ExecutionCoordinator {
             const adapterId = text(pkg.runtime_adapter, "runtime adapter");
             const adapterVersion = text(pkg.runtime_adapter_version, "runtime adapter version");
             const expectedContractFingerprint = text(pkg.contract_fingerprint, "contract fingerprint");
+            requireSecurityRequirements(pkg.security_requirements, { adapterId, adapterVersion });
+            if (!/^[a-f0-9]{64}$/.test(job.launchFingerprint ?? '') || job.gatewayContractFingerprint !== expectedContractFingerprint
+                || job.gatewayTaskPackageFingerprint !== fingerprint(pkg))
+                throw new Error("Claimed launch fingerprints differ");
             stage = "workspace";
             workspace = await step(() => this.deps.workspaces.create({
                 jobId: job.id,
@@ -177,7 +191,10 @@ export class ExecutionCoordinator {
             await this.deps.state.save({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken, phase: "running", bindingId: binding.bindingId, eventCursor: sequence, ...(isTerminalEventType(event.eventType) ? { terminalEventType: event.eventType } : {}), workspaceManifest: workspace.manifest });
         };
         try {
-            await adapter.start({ bindingId: binding.bindingId, sessionId: binding.bindingId, taskPackage: binding.taskPackage, resolvedModelId: binding.resolvedModelId });
+            if (!job.taskPackage.resolved_model_id
+                || binding.resolvedModelId !== job.taskPackage.resolved_model_id)
+                throw new Error("Binding model differs from approved launch");
+            await adapter.start({ securityBinding: { launchFingerprint: job.launchFingerprint, contractFingerprint: job.gatewayContractFingerprint, taskPackageFingerprint: job.gatewayTaskPackageFingerprint }, generation: job.generation, approvedTaskPackage: job.taskPackage, bindingId: binding.bindingId, sessionId: binding.bindingId, taskPackage: binding.taskPackage, resolvedModelId: binding.resolvedModelId });
             await readControls();
             if (adapter.events && !requestedTerminal) {
                 for await (const event of adapter.events()) {
@@ -230,7 +247,7 @@ export class ExecutionCoordinator {
                 clearInterval(heartbeatTimer);
         }
         const status = terminal.eventType === "completed" ? "completed" : terminal.eventType === "cancelled" ? "cancelled" : terminal.eventType === "blocked" || terminal.eventType === "scope_conflict" ? "blocked" : "failed";
-        await this.deps.gateway.complete({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken, status, result: { binding_id: binding.bindingId, event_type: terminal.eventType, summary: terminal.summary } });
+        await this.deps.gateway.complete({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken, status, result: { binding_id: binding.bindingId, event_type: terminal.eventType, summary: terminal.summary, ...(adapter.securityReceipt?.() ? { security_receipt: adapter.securityReceipt() } : {}) } });
         await this.deps.state.clear();
     }
 }

package/dist/src/daemon/runtime.js

@@ -1,12 +1,14 @@
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
+import { createCodexProductionHost } from '../safety/codex-production-host.js';
 import { hostname } from "node:os";
 import { createHash } from "node:crypto";
 import { join } from "node:path";
 import { McpGatewayClient } from "../gateway-client.js";
+import { discoverAdapters } from "../adapters/discovery.js";
+import { CodexPlugin } from "../adapters/codex/plugin.js";
+import { buildCodexJobOptions } from "../adapters/codex/runtime-options.js";
 import { AdapterRegistry } from "../adapters/registry.js";
 import { ClaudeCodePlugin } from "../adapters/claude-code/adapter.js";
-import { NodeProcessHost } from "../process/node-process-host.js";
+import { createClaudeCodeAdapterOptions } from "../adapters/claude-code/runtime-options.js";
 import { WorkspaceManager } from "../workspace/workspace-manager.js";
 import { GitClient } from "../workspace/git-client.js";
 import { FileDaemonStateStore } from "../state-store.js";
@@ -15,35 +17,26 @@ import { JobPoller } from "./job-poller.js";
 import { ProcessLock } from "./process-lock.js";
 import { Daemon } from "./daemon.js";
 import { buildTerminalEvidenceCollector } from "../safety/terminal-evidence.js";
-import { McpRelay } from "../auth/mcp-relay.js";
-import { McpRelayConfig } from "../auth/mcp-relay-config.js";
-const execFileAsync = promisify(execFile);
 export async function buildDaemon(input) {
-    const relay = new McpRelay({ tokenProvider: input.tokenProvider, upstreamMcpUrl: input.gatewayMcpUrl, upstreamFetch: input.fetchFn });
-    const relayServer = await relay.start();
-    const configs = new McpRelayConfig(input.stateRoot, relay, relayServer.url);
+    if (input.codexSupportedProbe && !input.codexSecurityHost)
+        throw new Error('CODEX_SUPPORTED_HOST_REQUIRED');
+    const production = !input.codexSecurityHost && !input.codexSupportedProbe ? createCodexProductionHost({ runnerId: input.runnerId, binary: input.env.AI_GATEWAY_LOCAL_RUNNER_CODEX_BINARY ?? 'codex', home: input.env.HOME ?? '', codexHome: input.env.CODEX_HOME, searchPath: input.env.PATH }) : undefined;
+    let pendingCodexClaim;
     const gateway = new McpGatewayClient({ mcpUrl: input.gatewayMcpUrl, tokenProvider: input.tokenProvider, runnerId: input.runnerId, fetchFn: input.fetchFn });
     const hookPath = new URL("../safety/hook-cli.js", import.meta.url).pathname;
     const plugin = new ClaudeCodePlugin({
-        probe: async () => {
-            try {
-                const version = await execFileAsync(input.env.AI_GATEWAY_LOCAL_RUNNER_CLAUDE_BINARY ?? "claude", ["--version"], { encoding: "utf8" });
-                const auth = await execFileAsync(input.env.AI_GATEWAY_LOCAL_RUNNER_CLAUDE_BINARY ?? "claude", ["auth", "status"], { encoding: "utf8" }).then(() => true).catch(() => false);
-                return { available: true, authenticated: auth, executableVersion: version.stdout.trim() };
-            }
-            catch (error) {
-                return { available: false, authenticated: false, reason: error instanceof Error ? error.message : String(error) };
-            }
-        },
-        options: ({ worktreePath, jobId }) => ({
-            processHost: new NodeProcessHost(), worktreeRoot: worktreePath, maxBudgetUsd: Number.MAX_SAFE_INTEGER,
-            workItemLabel: jobId, env: input.env, registeredReadTools: [], hookExecutablePath: hookPath,
+        probe: async () => (await discoverAdapters(input.env, undefined, ['claude_code_cli']))[0],
+        options: ({ worktreePath, jobId }) => createClaudeCodeAdapterOptions({
+            worktreePath, jobId, stateRoot: input.stateRoot, env: input.env,
+            maxBudgetUsd: Number.MAX_SAFE_INTEGER, hookExecutablePath: hookPath,
             binaryPath: input.env.AI_GATEWAY_LOCAL_RUNNER_CLAUDE_BINARY,
-            mcpServerName: "ai_gateway",
-            writeMcpConfig: (config) => configs.write(config),
         }),
     });
-    const registry = new AdapterRegistry([plugin]);
+    const codex = new CodexPlugin({
+        probe: async () => production ? production.probe() : input.codexSupportedProbe ? input.codexSupportedProbe() : (await discoverAdapters(input.env, undefined, ['codex_cli']))[0],
+        options: ({ worktreePath, jobId }) => buildCodexJobOptions({ worktreePath, jobId, stateRoot: input.stateRoot, env: input.env, ...(production ? { productionHostFactory: () => production.job(jobId, worktreePath) } : { securityHost: input.codexSecurityHost }) }),
+    });
+    const registry = new AdapterRegistry([plugin, codex]);
     const probes = await registry.probeAll();
     const versions = Object.fromEntries(probes.filter((probe) => probe.available && probe.authenticated).map((probe) => [probe.id, probe.version]));
     const state = new FileDaemonStateStore(input.stateRoot);
@@ -64,9 +57,16 @@ export async function buildDaemon(input) {
             heartbeat: async (bindingId, job) => {
                 await Promise.all([gateway.heartbeat(bindingId), gateway.heartbeatLocalJob({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken })]);
             },
-            complete: (result) => gateway.completeLocalJob(result),
+            complete: async (result) => { await gateway.completeLocalJob(result); production?.releaseJob(result.jobId); pendingCodexClaim = undefined; },
         },
-        registry,
+        registry: { select: async (id, version, options) => {
+                if (production && id === 'codex_cli') {
+                    if (!pendingCodexClaim || pendingCodexClaim.job?.id !== options.jobId)
+                        throw new Error('CODEX_TRUSTED_CLAIM_REQUIRED');
+                    production.registerClaim(pendingCodexClaim);
+                }
+                return registry.select(id, version, options);
+            } },
         workspaces: new WorkspaceManager({ root: input.workspaceRoot, git: new GitClient() }),
         state,
     });
@@ -74,7 +74,7 @@ export async function buildDaemon(input) {
         reportError: (diagnostic) => { process.stderr.write(`${JSON.stringify({ event: "poller_failed", ...diagnostic })}\n`); },
         heartbeat: () => gateway.heartbeatLocalRunner({
             deviceFingerprint: createHash("sha256").update(`${process.getuid?.() ?? 0}|${runnerDisplayName()}|${input.gatewayMcpUrl}`).digest("hex"),
-            displayName: runnerDisplayName(), packageVersion: "0.1.8",
+            displayName: runnerDisplayName(), packageVersion: "0.1.9",
             capabilities: probes.map((probe) => ({ adapter: probe.id, version: probe.version,
                 capabilities: probe.capabilities, authenticated: probe.available && probe.authenticated })),
         }).then(() => undefined),
@@ -82,22 +82,19 @@ export async function buildDaemon(input) {
             const claim = await gateway.waitForLocalJob(versions, 25);
             if (claim.status !== "claimed" || !claim.job || !claim.task_package || !claim.lease_token || !claim.launch_grant)
                 return { status: "no_job" };
+            if (production && claim.task_package.runtime_adapter === 'codex_cli')
+                pendingCodexClaim = claim;
             const job = {
                 id: claim.job.id, generation: claim.job.generation, leaseToken: claim.lease_token, launchGrant: claim.launch_grant,
                 workLoopId: claim.job.work_loop_id, taskPackage: claim.task_package,
-                gatewayContractFingerprint: claim.contract_fingerprint,
+                launchFingerprint: claim.job.launch_fingerprint, gatewayContractFingerprint: claim.contract_fingerprint,
                 gatewayTaskPackageFingerprint: claim.task_package_fingerprint,
             };
             await state.save({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken, phase: "claimed" });
             return { status: "claimed", job };
         },
         execute: async (job) => {
-            try {
-                await coordinator.execute(job);
-            }
-            finally {
-                configs.clear();
-            }
+            await coordinator.execute(job);
         },
         delay: (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)),
     });
@@ -129,12 +126,8 @@ export async function buildDaemon(input) {
         },
         poller,
     });
-    return { daemon, close: async () => { try {
-            configs.clear();
-        }
-        finally {
-            await relay.close();
-        } } };
+    // Model tools have no Gateway relay. Each adapter owns and closes its job endpoint.
+    return { daemon, close: async () => { poller.stop(); production?.close(); } };
 }
 export function runnerDisplayName() { return `${hostname()} local AI`; }
 /** Unknown mutation outcomes halt polling; known failures replay only their terminal receipt. */

package/dist/src/process/node-process-group-host.js

@@ -0,0 +1,74 @@
+import { spawn } from "node:child_process";
+/** Each invocation owns one new process group; no name-based process sweeping. */
+export class NodeProcessGroupHost {
+    spawn(command, args, options) {
+        if (process.platform !== "darwin")
+            throw new Error("Codex process isolation requires macOS");
+        const child = spawn(command, args, { ...options, shell: false, detached: true, stdio: ["pipe", "pipe", "pipe"] });
+        let failure;
+        let owned = true;
+        const kill = (signal = "SIGKILL") => {
+            if (!owned || !child.pid)
+                return;
+            try {
+                process.kill(-child.pid, signal);
+            }
+            catch (error) {
+                const code = error.code;
+                if (code === "EPERM" && child.exitCode === null && child.signalCode === null) {
+                    // macOS can expose the root PID after stdout EOF while its process
+                    // group is already exiting. Signal only this ChildProcess and retry
+                    // group cleanup from its exit callback after it has been reaped.
+                    child.kill(signal);
+                    return;
+                }
+                if (code !== "ESRCH")
+                    throw new Error("Provider process group cleanup could not be confirmed");
+            }
+            if (signal === "SIGKILL")
+                owned = false;
+        };
+        child.on("error", () => { failure = new Error("Provider process could not start"); });
+        child.stdin.on("error", () => { failure = new Error("Provider process input closed"); });
+        // Provider stderr can contain account details. Consume without publishing it.
+        child.stderr.resume();
+        child.once("exit", () => {
+            try {
+                kill();
+            }
+            catch {
+                failure = new Error("Provider process group cleanup could not be confirmed");
+            }
+        });
+        return {
+            stdin: { write: (text) => { child.stdin.write(text); }, end: () => { child.stdin.end(); } },
+            stdout: { async *[Symbol.asyncIterator]() {
+                    let pending = Buffer.alloc(0);
+                    try {
+                        for await (const chunk of child.stdout) {
+                            pending = Buffer.concat([pending, Buffer.from(chunk)]);
+                            let end;
+                            while ((end = pending.indexOf(10)) !== -1) {
+                                if (end > 256_000)
+                                    throw new Error("Provider event exceeded the allowed size");
+                                const line = pending.subarray(0, end).toString("utf8").replace(/\r$/, "");
+                                pending = pending.subarray(end + 1);
+                                yield line;
+                            }
+                            if (pending.length > 256_000)
+                                throw new Error("Provider event exceeded the allowed size");
+                        }
+                        if (pending.length)
+                            yield pending.toString("utf8");
+                        if (failure)
+                            throw failure;
+                    }
+                    finally {
+                        kill();
+                    }
+                } },
+            kill: (signal) => kill((signal ?? "SIGKILL")),
+            once: (_event, callback) => { child.once("exit", callback); },
+        };
+    }
+}

package/dist/src/safety/cli-host-admission.js

@@ -0,0 +1,74 @@
+import { constants } from 'node:fs';
+import { open, lstat, stat, access } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
+import path from 'node:path';
+// This digest identifies historical offline evidence only. It grants no capability.
+const OFFLINE_OBSERVED_BINARY = '0d5ac7aae20c4eda6242428d5e218c55ba96d8763fda2a271088ff37104b9d28';
+/** A byte measurement, not a spawn certificate. No candidate executable is run.
+ * Reject nonregular/symlink/mutable inputs. Check both descriptor and pathname;
+ * these checks do not purport to make a later path-based spawn atomic. */
+async function measure(file) {
+    const fd = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    try {
+        const before = await fd.stat({ bigint: true });
+        if (!before.isFile() || !(before.mode & 73n) || before.size > 512n * 1024n * 1024n)
+            throw Error('binary');
+        const hash = createHash('sha256');
+        let bytes = 0n;
+        for await (const chunk of fd.createReadStream({ autoClose: false })) {
+            bytes += BigInt(chunk.length);
+            if (bytes > 512n * 1024n * 1024n)
+                throw Error('binary');
+            hash.update(chunk);
+        }
+        const after = await fd.stat({ bigint: true }), named = await lstat(file, { bigint: true });
+        for (const stat of [after, named])
+            if (!stat.isFile() || stat.dev !== before.dev || stat.ino !== before.ino
+                || stat.size !== before.size || stat.mtimeNs !== before.mtimeNs || stat.ctimeNs !== before.ctimeNs)
+                throw Error('binary');
+        if (bytes !== before.size)
+            throw Error('binary');
+        return hash.digest('hex');
+    }
+    finally {
+        await fd.close();
+    }
+}
+/** Reports independent prerequisites together, never converting a version/hash,
+ * fixture result, environment flag or task-package claim into release admission.
+ * No reviewed native policy-binding/outer-isolation verifier exists yet. */
+export async function diagnoseCliHostAdmission(adapterId, binary, env) {
+    const checks = [];
+    let digest;
+    const lookup = (env.PATH ?? '').split(path.delimiter);
+    const candidates = path.isAbsolute(binary) ? [binary] : /^[A-Za-z0-9_-]+$/.test(binary) && lookup.every(part => path.isAbsolute(part))
+        ? lookup.map(part => path.join(part, binary)) : [];
+    for (const candidate of candidates) {
+        try {
+            await access(candidate, constants.X_OK);
+            if (!(await stat(candidate)).isFile())
+                continue;
+        }
+        catch {
+            continue;
+        }
+        // The first executable is what exec lookup selects. Never hash a substitute.
+        try {
+            digest = await measure(candidate);
+        }
+        catch { /* Fixed diagnostic only. */ }
+        break;
+    }
+    checks.push(digest ? { id: 'binary_identity', status: 'observed', code: adapterId === 'codex_cli' && digest === OFFLINE_OBSERVED_BINARY ? 'BINARY_OFFLINE_OBSERVED_ONLY' : 'BINARY_NOT_OFFLINE_REVIEWED' }
+        : { id: 'binary_identity', status: 'blocked', code: 'BINARY_IDENTITY_UNAVAILABLE' });
+    for (const [id, code] of [
+        ['policy_binding', 'NATIVE_POLICY_BINDING_UNAVAILABLE'],
+        ['native_isolation', 'NATIVE_ISOLATION_UNVERIFIED'],
+        ['managed_sources', 'MANAGED_SOURCE_COVERAGE_UNVERIFIED'],
+        ['provider_network', 'PROVIDER_NETWORK_BOUNDARY_UNVERIFIED'],
+        ['release_admission', 'RELEASE_ADMISSION_UNAVAILABLE'],
+    ])
+        checks.push({ id, status: 'blocked', code });
+    return { status: 'unsupported', available: false, executable: false, capabilities: [],
+        ...(digest ? { observedBinarySha256: digest } : {}), checks, reasonCodes: checks.map(check => check.code) };
+}

package/dist/src/safety/cli-security-modes.js

@@ -0,0 +1,4 @@
+/** Explicitly narrower authority; never presented as native isolation. */
+export const SUPPORTED_CLI_MODE = 'supported_cli_policy_v1';
+export const SUPPORTED_CLI_GATES = Object.freeze(['binary_identity', 'supported_permissions', 'managed_policy_compatibility', 'restricted_mcp', 'rpc_anti_reattachment', 'login_preservation', 'owned_lifecycle', 'gateway_launch_binding']);
+export const SUPPORTED_CLI_RISKS = Object.freeze(['vendor_native_runtime', 'shared_account_authentication', 'extensions_and_hosted_services', 'ipc_network_outside_command_sandbox']);