mtech-ai-local-runner 0.1.8 → 0.1.9

package/dist/src/safety/codex-production-host.js

@@ -0,0 +1,267 @@
+import path from 'node:path';
+import { constants } from 'node:fs';
+import { open, lstat } from 'node:fs/promises';
+import { requireCodexNativeProof } from '../adapters/codex/native-proof.js';
+import { admitSupportedCodexPolicy } from '../adapters/codex/supported-admission.js';
+import { admitJobSecurity } from './job-security-policy.js';
+import { commandRegistryFingerprint } from './job-security-session.js';
+import { fingerprint } from '../daemon/execution-coordinator.js';
+import { requireSecurityRequirements } from './security-requirements.js';
+import { SUPPORTED_CLI_GATES } from './cli-security-modes.js';
+import { verifyCommandIntegrity, measureCommandFile } from './registered-command-integrity.js';
+import { SUPPORTED_CLI_RISKS } from './cli-security-modes.js';
+import { CODEX_SUPPORTED_RELEASES } from './codex-supported-releases.js';
+import { securityRequirementsFingerprint } from './security-requirements.js';
+const reject = () => new Error('CODEX_PRODUCTION_HOST_REJECTED');
+/** Read original file backend only. No CLI, Keychain, HTTP, refresh or persistence.
+ * This is local credential availability, not remote entitlement/validity proof. */
+export async function readCodexCredentialStatus(accountRoot) {
+    const fd = await open(path.join(accountRoot, 'auth.json'), constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    try {
+        const stat = await fd.stat();
+        if (!stat.isFile() || stat.size > 1_048_576)
+            throw reject();
+        const chunks = [];
+        let size = 0;
+        for await (const chunk of fd.createReadStream({ autoClose: false })) {
+            size += chunk.length;
+            if (size > 1_048_576)
+                throw reject();
+            chunks.push(chunk);
+        }
+        const raw = Buffer.concat(chunks).toString('utf8');
+        const a = JSON.parse(raw), token = a?.tokens?.access_token;
+        if (a.auth_mode !== 'chatgpt' || typeof token !== 'string' || token.length > 32768)
+            throw reject();
+        const parts = token.split('.');
+        if (parts.length !== 3)
+            throw reject();
+        const exp = JSON.parse(Buffer.from(parts[1], 'base64url').toString()).exp;
+        if (!Number.isSafeInteger(exp) || exp <= 0)
+            throw reject();
+        return { backend: 'file', available: true, expiresAt: exp * 1000 };
+    }
+    catch {
+        throw reject();
+    }
+    finally {
+        await fd.close();
+    }
+}
+export const codexReleaseFingerprint = (release) => securityRequirementsFingerprint(release);
+function registeredCommandValid(c) {
+    try {
+        const fields = ['id', 'executable', 'argv', 'integrity', ...(c.readPaths === undefined ? [] : ['readPaths'])];
+        if (JSON.stringify(Object.keys(c).sort()) !== JSON.stringify(fields.sort()) || typeof c.id !== 'string' || !c.id || c.id.length > 256 || /[\r\n\0]/.test(c.id)
+            || typeof c.executable !== 'string' || !path.isAbsolute(c.executable) || !Array.isArray(c.argv) || c.argv.some(a => typeof a !== 'string' || /[\r\n\0]/.test(a)))
+            return false;
+        const paths = c.readPaths ?? [], integrity = c.integrity;
+        return Array.isArray(paths) && new Set(paths).size === paths.length && paths.every(p => typeof p === 'string' && !!p && !path.isAbsolute(p) && !p.split(/[\\/]/).some(s => !s || s === '.' || s === '..') && !/[\0*?\[\]{}]/.test(p))
+            && !!integrity && JSON.stringify(Object.keys(integrity).sort()) === JSON.stringify(['executableSha256', 'readFiles'])
+            && /^[a-f0-9]{64}$/.test(integrity.executableSha256) && !!integrity.readFiles && !Array.isArray(integrity.readFiles)
+            && JSON.stringify(Object.keys(integrity.readFiles).sort()) === JSON.stringify([...paths].sort())
+            && Object.values(integrity.readFiles).every(s => typeof s === 'string' && /^[a-f0-9]{64}$/.test(s));
+    }
+    catch {
+        return false;
+    }
+}
+function reviewed(value) {
+    try {
+        return JSON.stringify(Object.keys(value).sort()) === JSON.stringify(['version', 'adapterVersion', 'executableVersion', 'binarySha256', 'modelIds', 'decisionId', 'acceptedResidualRisks', 'commands'].sort())
+            && value.version === 'codex-supported-release-v1' && value.adapterVersion === '1' && /^[a-f0-9]{64}$/.test(value.binarySha256)
+            && typeof value.executableVersion === 'string' && !!value.executableVersion && !/[\r\n\0]/.test(value.executableVersion)
+            && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(value.decisionId)
+            && Array.isArray(value.modelIds) && value.modelIds.length > 0 && new Set(value.modelIds).size === value.modelIds.length
+            && value.modelIds.every(v => typeof v === 'string' && v.length > 0 && v.length < 256 && !/[\r\n\0]/.test(v))
+            && JSON.stringify(value.acceptedResidualRisks) === JSON.stringify(SUPPORTED_CLI_RISKS) && Array.isArray(value.commands) && new Set(value.commands.map(c => c.id)).size === value.commands.length && value.commands.every(registeredCommandValid);
+    }
+    catch {
+        return false;
+    }
+}
+const capabilities = ['repository_read', 'repository_edit', 'shell_test', 'git_diff'];
+export function createCodexProductionHost(input) {
+    input = { ...input };
+    const releases = structuredClone(input.releases ?? CODEX_SUPPORTED_RELEASES);
+    const claims = new Map();
+    const scopes = new Map();
+    const account = path.resolve(input.codexHome ?? path.join(input.home, '.codex'));
+    async function inspect() {
+        if (!path.isAbsolute(input.home) || !input.runnerId || !releases.length)
+            throw reject();
+        const paths = path.isAbsolute(input.binary) ? [input.binary] : input.binary === 'codex' && input.searchPath?.split(path.delimiter).every(p => path.isAbsolute(p)) ? input.searchPath.split(path.delimiter).map(p => path.join(p, 'codex')) : [];
+        for (const binary of paths) {
+            let stat;
+            try {
+                stat = await lstat(binary);
+            }
+            catch (e) {
+                if (e.code === 'ENOENT')
+                    continue;
+                throw reject();
+            }
+            // Preserve PATH precedence: never skip a present unreviewed first executable.
+            if (!stat.isFile() || !(stat.mode & 0o111) || (stat.mode & 0o022))
+                throw reject();
+            const sha = await measureCommandFile(binary), matches = releases.filter(r => reviewed(r) && r.binarySha256 === sha);
+            if (matches.length !== 1)
+                throw reject();
+            const credential = await (input.readCredentialStatus ?? readCodexCredentialStatus)(account);
+            if (credential.backend !== 'file' || !credential.available || !Number.isFinite(credential.expiresAt) || credential.expiresAt <= Date.now())
+                throw reject();
+            return { binary, release: matches[0] };
+        }
+        throw reject();
+    }
+    return {
+        async probe() {
+            try {
+                const { release } = await inspect();
+                return { available: true, authenticated: true, executableVersion: release.executableVersion, capabilities: [...capabilities] };
+            }
+            catch {
+                return { available: false, authenticated: false, capabilities: [], reason: 'CODEX_REVIEWED_RELEASE_OR_LOCAL_CREDENTIALS_UNAVAILABLE' };
+            }
+        },
+        registerClaim(value) {
+            const claim = structuredClone(value), job = claim.job, pkg = claim.task_package, context = claim.security_context;
+            if (claim.status !== 'claimed' || !job || !pkg || !context || context.runner_id !== input.runnerId
+                || typeof context.actor_id !== 'string' || !context.actor_id || /[\r\n\0]/.test(context.actor_id)
+                || !job.id || !Number.isSafeInteger(job.generation) || job.generation < 1 || !['claimed', 'shadowing'].includes(job.status)
+                || !/^[a-f0-9]{64}$/.test(job.launch_fingerprint) || !/^[a-f0-9]{64}$/.test(claim.contract_fingerprint ?? '')
+                || pkg.contract_fingerprint !== claim.contract_fingerprint || fingerprint(pkg) !== claim.task_package_fingerprint
+                || pkg.runtime_adapter !== 'codex_cli' || pkg.runtime_adapter_version !== '1' || pkg.resolved_provider !== 'openai'
+                || claims.size > 0 || scopes.size > 0)
+                throw reject();
+            requireSecurityRequirements(pkg.security_requirements, { adapterId: 'codex_cli', adapterVersion: '1' });
+            claims.set(job.id, claim);
+        },
+        job(id, sourceRoot) {
+            const claim = claims.get(id);
+            if (!claim || !path.isAbsolute(sourceRoot) || scopes.has(id))
+                throw reject();
+            const pkg = claim.task_package, job = claim.job, context = claim.security_context;
+            let prepared = false, revoked = false, used = false;
+            let selected;
+            let policy, supported, native;
+            let request;
+            const revoke = () => { revoked = true; policy?.revoke(); supported?.policy.revoke(); native?.close(); };
+            const assertPrepared = async () => {
+                if (revoked || !prepared || !selected || !request)
+                    throw reject();
+                const current = await inspect();
+                if (revoked || current.binary !== selected.binary || codexReleaseFingerprint(current.release) !== codexReleaseFingerprint(selected.release))
+                    throw reject();
+                for (const c of selected.release.commands) {
+                    const paths = c.readPaths ?? [];
+                    if (paths.some(p => path.isAbsolute(p) || p.split(/[\\/]/).includes('..')))
+                        throw reject();
+                    await verifyCommandIntegrity(c.integrity, c.executable, paths, paths.map(p => path.join(sourceRoot, p)));
+                }
+                if (revoked)
+                    throw reject();
+            };
+            const scope = {
+                async prepare(value) {
+                    if (prepared || revoked)
+                        throw reject();
+                    prepared = true;
+                    try {
+                        const r = Object.freeze(structuredClone(value));
+                        selected = await inspect();
+                        const requirements = requireSecurityRequirements(r.requirements, { adapterId: 'codex_cli', adapterVersion: '1' });
+                        if (revoked || requirements.security_mode !== 'supported_cli_policy_v1'
+                            || requirements.release_manifest_sha256 !== codexReleaseFingerprint(selected.release)
+                            || r.adapterId !== 'codex_cli' || r.adapterVersion !== '1' || r.jobId !== job.id || r.generation !== job.generation
+                            || r.modelId !== pkg.resolved_model_id || !selected.release.modelIds.includes(r.modelId)
+                            || r.sourceSha !== pkg.repository?.base_commit_sha
+                            || fingerprint(r.requirements) !== fingerprint(pkg.security_requirements)
+                            || r.launchFingerprint !== job.launch_fingerprint || r.contractFingerprint !== claim.contract_fingerprint
+                            || r.taskPackageFingerprint !== claim.task_package_fingerprint)
+                            throw reject();
+                        request = r;
+                        await assertPrepared();
+                    }
+                    catch {
+                        revoke();
+                        throw reject();
+                    }
+                },
+                async assertPrepared() { try {
+                    await assertPrepared();
+                }
+                catch {
+                    revoke();
+                    throw reject();
+                } },
+                commands() { if (revoked || !selected || !request)
+                    throw reject(); return structuredClone(selected.release.commands); },
+                binaryPath() { if (revoked || !selected || !request)
+                    throw reject(); return selected.binary; },
+                policy: () => policy,
+                binding() {
+                    try {
+                        if (revoked || !native || !policy)
+                            return null;
+                        const b = native.binding();
+                        return b ? { jobId: job.id, generation: job.generation, ...b } : null;
+                    }
+                    catch {
+                        return null;
+                    }
+                },
+                async admit(proof) {
+                    if (used || revoked)
+                        throw reject();
+                    used = true;
+                    try {
+                        await assertPrepared();
+                        const n = requireCodexNativeProof(proof), r = request, release = selected.release;
+                        if (n.binaryPath !== selected.binary || n.sourceRoot !== sourceRoot || n.home !== input.home || n.codexHome !== account
+                            || n.expected.model !== r.modelId || n.expected.provider !== 'openai')
+                            throw reject();
+                        const pin = { adapterId: r.adapterId, adapterVersion: r.adapterVersion, jobId: r.jobId, generation: r.generation, modelId: r.modelId, sourceSha: r.sourceSha,
+                            securityMode: 'supported_cli_policy_v1', requirementsSha256: r.requirements.fingerprint,
+                            binarySha256: release.binarySha256, configSha256: n.expected.configFingerprint, managedPolicySha256: n.managedPolicySha256,
+                            toolsSha256: n.expected.toolSchemaFingerprint, commandsSha256: commandRegistryFingerprint(release.commands),
+                            osProfileSha256: fingerprint({ mode: 'supported_cli_policy_v1', config: n.expected.configFingerprint, sourceRoot }) };
+                        const binding = { jobId: r.jobId, generation: r.generation, actorId: context.actor_id, runnerId: context.runner_id,
+                            repositoryKey: String(pkg.repository.key), sourceSha: r.sourceSha,
+                            launchFingerprint: r.launchFingerprint, contractFingerprint: r.contractFingerprint, taskPackageFingerprint: r.taskPackageFingerprint,
+                            binarySha256: release.binarySha256, requirementsFingerprint: pin.requirementsSha256, managedPolicyFingerprint: n.managedPolicySha256,
+                            commandsFingerprint: pin.commandsSha256, decisionId: release.decisionId };
+                        // All checks originate in this host and the retained transport validators.
+                        // No caller-supplied passed/check array is consumed.
+                        policy = await admitJobSecurity(pin, async (frozen) => {
+                            requireCodexNativeProof(proof);
+                            if (revoked)
+                                throw reject();
+                            return { version: 2, pin: frozen, checks: SUPPORTED_CLI_GATES.map(gate => ({ gate, status: 'passed' })) };
+                        });
+                        supported = { binding, policy: await admitSupportedCodexPolicy({ ...n.expected, ...binding, mode: 'supported_cli_policy_v1' }, async (frozen) => {
+                                requireCodexNativeProof(proof);
+                                if (revoked)
+                                    throw reject();
+                                return { version: 'codex-supported-policy-evidence-v1', mode: 'supported_cli_policy_v1', pin: frozen, acceptedResidualRisks: release.acceptedResidualRisks, checks: SUPPORTED_CLI_GATES.map(gate => ({ gate, status: 'passed' })) };
+                            }) };
+                        requireCodexNativeProof(proof);
+                        if (revoked)
+                            throw reject();
+                        native = n;
+                        return supported;
+                    }
+                    catch {
+                        revoke();
+                        throw reject();
+                    }
+                }, revoke,
+            };
+            scopes.set(id, scope);
+            return scope;
+        },
+        close() { for (const scope of scopes.values())
+            scope.revoke(); scopes.clear(); claims.clear(); },
+        releaseJob(id) { scopes.get(id)?.revoke(); scopes.delete(id); claims.delete(id); },
+    };
+}

package/dist/src/safety/codex-supported-releases.js

@@ -0,0 +1 @@
+export const CODEX_SUPPORTED_RELEASES = Object.freeze([]);

package/dist/src/safety/hook-cli.js

@@ -1,5 +1,6 @@
 import { evaluateHookEvent } from "./pre-tool-use-hook.js";
 import path from "node:path";
+export const MAX_HOOK_INPUT_BYTES = 262144;
 export const HOOK_POLICY_ENV_VAR = "AI_GATEWAY_RUNNER_HOOK_POLICY_B64";
 function denyMalformed() {
     return {
@@ -23,7 +24,7 @@ function isStringArray(value) {
     return Array.isArray(value) && value.every((item) => typeof item === "string");
 }
 export function parsePolicy(encoded) {
-    if (!encoded)
+    if (!encoded || encoded.length > MAX_HOOK_INPUT_BYTES)
         return null;
     try {
         if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(encoded)) {
@@ -55,9 +56,11 @@ export function parsePolicy(encoded) {
     }
 }
 export function parseHookInput(raw) {
+    if (Buffer.byteLength(raw, "utf8") > MAX_HOOK_INPUT_BYTES)
+        return null;
     try {
         const parsed = JSON.parse(raw);
-        if (typeof parsed !== "object" || parsed === null)
+        if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
             return null;
         return parsed;
     }
@@ -75,15 +78,26 @@ export function decideFromRaw(rawInput, policyEnvValue) {
     return evaluateHookEvent(input, policy);
 }
 export async function runHookCli(readStdin, env, writeStdout) {
-    const rawInput = await readStdin();
-    const decision = decideFromRaw(rawInput, env[HOOK_POLICY_ENV_VAR]);
-    writeStdout(JSON.stringify(decision));
-    return 0;
+    try {
+        const rawInput = await readStdin();
+        const decision = decideFromRaw(rawInput, env[HOOK_POLICY_ENV_VAR]);
+        writeStdout(JSON.stringify(decision));
+        return 0;
+    }
+    catch {
+        writeStdout(JSON.stringify(denyMalformed()));
+        return 2;
+    }
 }
 async function readAllStdin() {
     const chunks = [];
+    let size = 0;
     for await (const chunk of process.stdin) {
-        chunks.push(Buffer.from(chunk));
+        const bytes = Buffer.from(chunk);
+        size += bytes.length;
+        if (size > MAX_HOOK_INPUT_BYTES)
+            throw new Error("HOOK_INPUT_TOO_LARGE");
+        chunks.push(bytes);
     }
     return Buffer.concat(chunks).toString("utf8");
 }

package/dist/src/safety/hook-policy-builder.js

@@ -1,3 +1,4 @@
+import { CLAUDE_LOCAL_MCP_TOOLS } from "./pre-tool-use-hook.js";
 const DEFAULT_BLOCKED_PATHS = [".git", ".env", ".aws", ".ssh"];
 function requiredTestsFromTaskPackage(taskPackage) {
     const pkg = taskPackage;
@@ -9,21 +10,13 @@ function requiredTestsFromTaskPackage(taskPackage) {
     }
     return requiredTests.map((item) => String(item));
 }
-function allowedGatewayToolsFromTaskPackage(taskPackage) {
-    const pkg = taskPackage;
-    const contract = pkg.contract;
-    const policy = contract?.policy;
-    const allowed = policy?.allowed_gateway_tools;
-    return new Set(Array.isArray(allowed) ? allowed.filter((tool) => typeof tool === "string") : []);
-}
 /**
- * The hook policy is derived only from the canonical task package and the
- * runner's own generated paths — never from anything Claude writes.
+ * Only the four job-local MCP names may pass the hook. Source and command
+ * authorization is enforced by the scoped worker, never by native Claude tools.
  */
 export function buildHookPolicy(options) {
     const requiredCommands = requiredTestsFromTaskPackage(options.taskPackage);
-    const allowedGatewayTools = allowedGatewayToolsFromTaskPackage(options.taskPackage);
-    const allowedMcpTools = [...new Set(options.registeredReadTools.filter((tool) => allowedGatewayTools.has(tool)))];
+    const allowedMcpTools = [...CLAUDE_LOCAL_MCP_TOOLS];
     const blockedPaths = [...new Set([...DEFAULT_BLOCKED_PATHS, ...(options.additionalBlockedPaths ?? []), ...options.generatedPaths])];
     return {
         requiredCommands,

package/dist/src/safety/job-security-policy.js

@@ -0,0 +1,62 @@
+import { createHash } from 'node:crypto';
+import { SUPPORTED_CLI_MODE, SUPPORTED_CLI_GATES } from './cli-security-modes.js';
+/** Mandatory for every CLI. New adapter IDs do not alter this gate set. */
+export const JOB_SECURITY_GATES = Object.freeze(['binary_binding', 'native_tools', 'managed_policy', 'credential_boundary', 'source_command_scope', 'request_binding', 'provider_egress', 'owned_lifecycle']);
+const issued = new WeakMap();
+const rejected = () => new Error('JOB_SECURITY_REJECTED');
+const keys = ['adapterId', 'adapterVersion', 'jobId', 'generation', 'modelId', 'sourceSha', 'binarySha256', 'configSha256', 'managedPolicySha256', 'toolsSha256', 'commandsSha256', 'osProfileSha256', 'requirementsSha256'];
+const object = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
+const exact = (v, names) => JSON.stringify(Object.keys(v).sort()) === JSON.stringify([...names].sort());
+function validPin(value) {
+    if (!object(value) || !exact(value, value.securityMode === undefined ? keys : [...keys, 'securityMode'])
+        || value.securityMode !== undefined && (value.securityMode !== SUPPORTED_CLI_MODE || value.adapterId !== 'codex_cli') || !Number.isSafeInteger(value.generation) || Number(value.generation) < 1)
+        return false;
+    for (const name of keys.filter(k => k !== 'generation')) {
+        const v = value[name];
+        if (typeof v !== 'string' || !v || v.length > 256 || /[\r\n\0]/.test(v))
+            return false;
+    }
+    if (!/^[a-f0-9]{40}$/.test(String(value.sourceSha)))
+        return false;
+    return keys.filter(k => k.endsWith('Sha256')).every(k => /^[a-f0-9]{64}$/.test(String(value[k])));
+}
+export const jobSecurityPinKeys = (pin) => pin.securityMode ? [...keys, 'securityMode'] : [...keys];
+const encoded = (pin) => JSON.stringify(Object.fromEntries(jobSecurityPinKeys(pin).map(key => [key, pin[key]])));
+export async function admitJobSecurity(expected, verify) {
+    try {
+        if (!validPin(expected))
+            throw rejected();
+        const pin = Object.freeze(structuredClone(expected));
+        const receipt = await verify(pin);
+        const gates = pin.securityMode === SUPPORTED_CLI_MODE ? SUPPORTED_CLI_GATES : JOB_SECURITY_GATES;
+        if (!object(receipt) || !exact(receipt, ['version', 'pin', 'checks']) || receipt.version !== (pin.securityMode ? 2 : 1)
+            || !validPin(receipt.pin) || encoded(receipt.pin) !== encoded(pin) || !Array.isArray(receipt.checks)
+            || receipt.checks.length !== gates.length)
+            throw rejected();
+        const seen = new Set();
+        for (const check of receipt.checks) {
+            if (!object(check) || !exact(check, ['gate', 'status']) || check.status !== 'passed' || typeof check.gate !== 'string'
+                || !gates.includes(check.gate) || seen.has(check.gate))
+                throw rejected();
+            seen.add(check.gate);
+        }
+        let revoked = false;
+        const policy = Object.freeze({ pin, fingerprint: createHash('sha256').update(encoded(pin)).digest('hex'), revoke: () => { revoked = true; } });
+        issued.set(policy, () => !revoked);
+        return policy;
+    }
+    catch {
+        throw rejected();
+    }
+}
+export function requireJobSecurity(value, expected) {
+    if (!object(value) || !issued.get(value)?.())
+        throw rejected();
+    const pin = value.pin;
+    for (const key of ['adapterId', 'adapterVersion', 'jobId', 'modelId'])
+        if (pin[key] !== expected[key])
+            throw rejected();
+    for (const key of ['sourceSha', 'generation'])
+        if (expected[key] !== undefined && pin[key] !== expected[key])
+            throw rejected();
+}

package/dist/src/safety/job-security-receipt.js

@@ -0,0 +1,20 @@
+import { requireJobSecurity } from './job-security-policy.js';
+import { requireSecurityRequirements } from './security-requirements.js';
+/** Audit linkage only. Gateway must preserve employee_runner provenance; serialized
+ * JSON never mints host authority or native isolation certification. */
+export function createJobSecurityReceipt(policy, input) {
+    try {
+        requireJobSecurity(policy, { adapterId: policy.pin.adapterId, adapterVersion: policy.pin.adapterVersion, jobId: input.jobId, generation: input.generation, modelId: input.modelId, sourceSha: input.sourceSha });
+        if (!Number.isSafeInteger(input.generation) || input.generation < 1 || [input.launchFingerprint, input.contractFingerprint, input.taskPackageFingerprint].some(v => !/^[a-f0-9]{64}$/.test(v)))
+            throw Error();
+        const r = requireSecurityRequirements(input.requirements, { adapterId: policy.pin.adapterId, adapterVersion: policy.pin.adapterVersion, requirementsSha256: policy.pin.requirementsSha256 });
+        if (policy.pin.securityMode !== r.security_mode)
+            throw Error();
+        const supported = !!policy.pin.securityMode;
+        return Object.freeze({ ...(supported ? { security_mode: r.security_mode, accepted_residual_risks: Object.freeze([...r.accepted_residual_risks]) } : {}), receipt_version: supported ? 'cli-job-security-receipt-v2' : 'cli-job-security-receipt-v1', evidence_origin: 'employee_runner', phase: 'pre_execution', job_id: input.jobId, generation: input.generation,
+            requirements_fingerprint: r.fingerprint, launch_fingerprint: input.launchFingerprint, contract_fingerprint: input.contractFingerprint, task_package_fingerprint: input.taskPackageFingerprint, policy_fingerprint: policy.fingerprint, pin: Object.freeze({ ...policy.pin }) });
+    }
+    catch {
+        throw new Error('JOB_SECURITY_RECEIPT_REJECTED');
+    }
+}

package/dist/src/safety/job-security-session.js

@@ -0,0 +1,133 @@
+import { createHash } from 'node:crypto';
+import { requireSupportedCodexPolicy } from '../adapters/codex/supported-admission.js';
+import { admitJobSecurity, requireJobSecurity } from './job-security-policy.js';
+import { requireSecurityRequirements } from './security-requirements.js';
+const fail = () => new Error('JOB_SECURITY_SESSION_REJECTED');
+function canonical(v) {
+    if (Array.isArray(v))
+        return v.map(canonical);
+    if (v && typeof v === 'object')
+        return Object.fromEntries(Object.keys(v).sort().map(k => [k, canonical(v[k])]));
+    return v;
+}
+export const commandRegistryFingerprint = (commands) => createHash('sha256').update(JSON.stringify(canonical(commands))).digest('hex');
+function freeze(value) {
+    if (value && typeof value === 'object') {
+        for (const item of Object.values(value))
+            freeze(item);
+        Object.freeze(value);
+    }
+    return value;
+}
+/** One issuance per job attempt, revoked on cancellation including async races.
+ * This wires verified authority; it does not establish native isolation itself. */
+export class JobSecuritySession {
+    host;
+    used = false;
+    revoked = false;
+    policy;
+    request;
+    supportedFactory;
+    supportedContext;
+    supportedUsed = false;
+    registry = [];
+    nativeBinding;
+    constructor(host) {
+        this.host = host;
+    }
+    async authorize(input) {
+        if (this.used || this.revoked)
+            throw fail();
+        this.used = true;
+        let issued;
+        try {
+            if (!this.host)
+                throw fail();
+            const request = freeze(structuredClone(input));
+            if (!Number.isSafeInteger(request.generation) || request.generation < 1 || !/^[a-f0-9]{40}$/.test(request.sourceSha)
+                || [request.adapterId, request.adapterVersion, request.jobId, request.modelId].some(v => typeof v !== 'string' || !v || v.length > 256 || /[\r\n\0]/.test(v)))
+                throw fail();
+            const requirements = requireSecurityRequirements(request.requirements, request);
+            if ([request.launchFingerprint, request.contractFingerprint, request.taskPackageFingerprint].some(s => !/^[a-f0-9]{64}$/.test(s)))
+                throw fail();
+            const plan = await this.host(request);
+            if (this.revoked)
+                throw fail();
+            // Snapshot authority before awaiting a verifier; neither commands nor pin may
+            // change underneath it. Keep only the host callback for live native identity.
+            const pin = freeze(structuredClone(plan.pin)), commands = freeze(structuredClone(plan.commandRegistry));
+            for (const key of ['adapterId', 'adapterVersion', 'jobId', 'generation', 'modelId', 'sourceSha'])
+                if (pin[key] !== request[key])
+                    throw fail();
+            if (pin.requirementsSha256 !== requirements.fingerprint || !Array.isArray(commands)
+                || pin.commandsSha256 !== commandRegistryFingerprint(commands) || typeof plan.nativeBinding !== 'function')
+                throw fail();
+            if (pin.securityMode !== requirements.security_mode || pin.securityMode && typeof plan.prepareSupportedAdmission !== 'function')
+                throw fail();
+            const nativeBinding = plan.nativeBinding.bind(plan);
+            issued = await admitJobSecurity(pin, plan.verify.bind(plan));
+            if (this.revoked)
+                throw fail();
+            requireJobSecurity(issued, request);
+            this.policy = issued;
+            this.registry = commands;
+            this.nativeBinding = nativeBinding;
+            this.request = request;
+            this.supportedFactory = pin.securityMode ? plan.prepareSupportedAdmission.bind(plan) : undefined;
+            return issued;
+        }
+        catch {
+            issued?.revoke();
+            this.revoke();
+            throw fail();
+        }
+    }
+    async supportedAdmission(expected) {
+        let context;
+        try {
+            if (this.revoked || this.supportedUsed || !this.policy?.pin.securityMode || !this.request || !this.supportedFactory)
+                throw fail();
+            this.supportedUsed = true;
+            requireJobSecurity(this.policy, this.request);
+            const captured = freeze(structuredClone(expected));
+            context = await this.supportedFactory(captured);
+            // Snapshot callback data before validation; only the capability retains identity.
+            context = { policy: context.policy, binding: freeze(structuredClone(context.binding)) };
+            if (this.revoked)
+                throw fail();
+            const p = this.policy.pin, r = this.request, b = context.binding;
+            if (b.jobId !== p.jobId || b.generation !== p.generation || b.sourceSha !== p.sourceSha || b.binarySha256 !== p.binarySha256
+                || b.requirementsFingerprint !== p.requirementsSha256 || b.managedPolicyFingerprint !== p.managedPolicySha256 || b.commandsFingerprint !== p.commandsSha256
+                || b.launchFingerprint !== r.launchFingerprint || b.contractFingerprint !== r.contractFingerprint || b.taskPackageFingerprint !== r.taskPackageFingerprint
+                || captured.model !== p.modelId || captured.configFingerprint !== p.configSha256 || captured.toolSchemaFingerprint !== p.toolsSha256)
+                throw fail();
+            requireSupportedCodexPolicy(context.policy, captured, b);
+            requireJobSecurity(this.policy, r);
+            this.supportedContext = context;
+            return context;
+        }
+        catch {
+            context?.policy?.revoke();
+            this.revoke();
+            throw fail();
+        }
+    }
+    commands() {
+        return !this.revoked && this.policy ? structuredClone(this.registry) : [];
+    }
+    binding() {
+        try {
+            if (this.revoked || !this.policy)
+                return null;
+            requireJobSecurity(this.policy, this.policy.pin);
+            const b = this.nativeBinding?.(), p = this.policy.pin;
+            if (!b || b.jobId !== p.jobId || b.generation !== p.generation)
+                return null;
+            return { ...b };
+        }
+        catch {
+            return null;
+        }
+    }
+    revoke() { this.revoked = true; this.policy?.revoke(); this.supportedContext?.policy.revoke(); this.supportedFactory = undefined; this.request = undefined; this.registry = []; this.nativeBinding = undefined; }
+}

package/dist/src/safety/job-tool-dispatcher.js

@@ -0,0 +1,52 @@
+import { localToolInventory } from './local-tool-server.js';
+const rejected = () => new Error('JOB_TOOL_DISPATCH_REJECTED');
+function record(value) { return !!value && typeof value === 'object' && !Array.isArray(value); }
+const id = (value) => typeof value === 'string' && value.length > 0 && value.length <= 256 && !/[\r\n\0]/.test(value);
+const keys = (value, expected) => JSON.stringify(Object.keys(value).sort()) === JSON.stringify([...expected].sort());
+/** Host-owned validation before the existing scoped policy. Not a capability
+ * certificate: no production wiring until native authority is actually proven.
+ * Host-assigned decimal request sequence is strictly increasing on its ordered
+ * channel. A high-water mark rejects replay without an execution-count limit
+ * or an ever-growing cache. This sequence is not a model-selected capability. */
+export class JobToolDispatcher {
+    policy;
+    active;
+    #binding;
+    #revoked = false;
+    #lastRequest = 0n;
+    constructor(binding, policy, active) {
+        this.policy = policy;
+        this.active = active;
+        if (![binding.jobId, binding.threadId, binding.turnId].every(id) || !Number.isSafeInteger(binding.generation) || binding.generation < 1)
+            throw rejected();
+        this.#binding = Object.freeze({ ...binding });
+    }
+    revoke() { if (this.#revoked)
+        return; this.#revoked = true; this.policy.revoke?.(); }
+    async dispatch(input) {
+        try {
+            if (this.#revoked || !this.active() || !record(input)
+                || !keys(input, ['jobId', 'threadId', 'turnId', 'generation', 'requestId', 'tool', 'args']))
+                throw rejected();
+            const envelope = structuredClone(input), b = this.#binding;
+            if (envelope.jobId !== b.jobId || envelope.threadId !== b.threadId || envelope.turnId !== b.turnId || envelope.generation !== b.generation
+                || !id(envelope.requestId) || !/^[1-9][0-9]*$/.test(envelope.requestId) || BigInt(envelope.requestId) <= this.#lastRequest
+                || typeof envelope.tool !== 'string' || !record(envelope.args))
+                throw rejected();
+            const tool = localToolInventory().find(t => t.name === envelope.tool);
+            const properties = tool?.inputSchema.properties;
+            if (!record(properties) || !keys(envelope.args, Object.keys(properties))
+                || Object.values(envelope.args).some(value => typeof value !== 'string')
+                || Buffer.byteLength(JSON.stringify(envelope.args)) > 1024 * 1024)
+                throw rejected();
+            this.#lastRequest = BigInt(envelope.requestId);
+            const result = await this.policy.call(envelope.tool, envelope.args);
+            if (this.#revoked || !this.active())
+                throw rejected();
+            return result;
+        }
+        catch {
+            throw rejected();
+        }
+    }
+}