mtech-ai-local-runner 0.1.8 → 0.1.9

package/dist/src/safety/job-tool-policy.js

@@ -0,0 +1,61 @@
+import path from 'node:path';
+function object(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('Invalid Job policy');
+    return value;
+}
+function strings(value) {
+    if (!Array.isArray(value) || value.some(item => typeof item !== 'string'))
+        throw new Error('Invalid Job policy list');
+    return value;
+}
+function prefix(scope) {
+    if (!scope || path.isAbsolute(scope))
+        throw new Error('Unsupported Job path scope');
+    const relative = scope.replace(/^\.\//, '');
+    if (!relative || path.isAbsolute(relative))
+        throw new Error('Unsupported Job path scope');
+    const value = relative === '**' ? '' : relative.endsWith('/**') ? relative.slice(0, -3) : relative.replace(/\/$/, '');
+    if (path.isAbsolute(value) || /[?*\[\]{}\\\0]/.test(value) || value && value.split('/').some(segment => segment === '..' || segment === '.' || segment === ''))
+        throw new Error('Unsupported Job path scope');
+    return value;
+}
+const contains = (outer, inner) => !outer || outer === inner || inner.startsWith(outer + '/');
+/** Exact host-owned command registry only. npm/git commands have no default registration:
+ * their dependencies and subprocess permissions need separate reviewed integration. */
+export function jobToolPolicyOptions(worktreeRoot, pkg, approved, registry, runtime) {
+    if (!runtime.runtimeAdapter || !runtime.runtimeAdapterVersion || approved.runtime_adapter !== runtime.runtimeAdapter || approved.runtime_adapter_version !== runtime.runtimeAdapterVersion
+        || pkg.execution !== undefined && object(pkg.execution).runtime_adapter !== runtime.runtimeAdapter)
+        throw new Error('Job runtime differs from approval');
+    const source = object(approved.repository);
+    if (!Array.isArray(pkg.repositories) || pkg.repositories.length !== 1)
+        throw new Error('Job requires one approved repository');
+    const repo = object(pkg.repositories[0]);
+    if (repo.repository_key !== source.key || repo.base_commit_sha !== source.base_commit_sha)
+        throw new Error('Job repository differs from approval');
+    if (typeof source.key !== 'string' || !source.key || typeof source.base_commit_sha !== 'string' || !/^[a-f0-9]{40}$/i.test(source.base_commit_sha)
+        || (repo.access !== 'read' && repo.access !== 'write') || (source.access !== 'read' && source.access !== 'write'))
+        throw new Error('Job repository approval is invalid');
+    const allowedPaths = [];
+    for (const launch of strings(approved.allowed_paths))
+        for (const full of strings(repo.allowed_paths)) {
+            const a = prefix(launch), b = prefix(full);
+            if (contains(a, b))
+                allowedPaths.push(full);
+            else if (contains(b, a))
+                allowedPaths.push(launch);
+        }
+    if (allowedPaths.length === 0)
+        throw new Error('Job approved source scope has no intersection');
+    const commands = strings(object(object(pkg.contract).verification).required_commands);
+    const approvedCommands = strings(approved.required_commands);
+    if (commands.length !== approvedCommands.length || JSON.stringify([...commands].sort()) !== JSON.stringify([...approvedCommands].sort()))
+        throw new Error('Job required commands differ from approval');
+    const requiredCommands = commands.map(id => {
+        const entries = registry.filter(command => command.id === id);
+        if (entries.length !== 1)
+            throw new Error('Job required command is not exactly registered');
+        return structuredClone(entries[0]);
+    });
+    return { worktreeRoot, access: repo.access === 'write' && source.access === 'write' ? 'write' : 'read', allowedPaths: [...new Set(allowedPaths)], blockedPaths: strings(repo.blocked_paths), requiredCommands };
+}

package/dist/src/safety/job-tool-session.js

@@ -0,0 +1,82 @@
+import { JobToolDispatcher } from './job-tool-dispatcher.js';
+import { LocalToolPolicy } from './local-tool-policy.js';
+import { LocalToolServer } from './local-tool-server.js';
+const sameBinding = (a, b) => b !== null && a.jobId === b.jobId && a.threadId === b.threadId && a.turnId === b.turnId && a.generation === b.generation;
+/** Per-job endpoint and scoped worker lifecycle. This is not native CLI admission. */
+export class JobToolSession {
+    options;
+    policy;
+    server;
+    dispatcher;
+    bound;
+    sequence = 0n;
+    started = false;
+    revoked = false;
+    closing;
+    constructor(options) {
+        this.options = options;
+        this.policy = new LocalToolPolicy(options.policyOptions);
+    }
+    async call(tool, args) {
+        try {
+            if (this.revoked)
+                throw Error();
+            const binding = this.options.binding();
+            if (!binding)
+                throw Error();
+            if (!this.dispatcher) {
+                this.bound = Object.freeze({ ...binding });
+                this.dispatcher = new JobToolDispatcher(this.bound, this.policy, () => !this.revoked && this.options.active() && sameBinding(this.bound, this.options.binding()));
+            }
+            if (!sameBinding(this.bound, binding))
+                throw Error();
+            return await this.dispatcher.dispatch({ ...this.bound, requestId: String(++this.sequence), tool, args });
+        }
+        catch {
+            throw new Error('JOB_TOOL_DISPATCH_REJECTED');
+        }
+    }
+    async start() {
+        if (this.revoked || this.started)
+            throw new Error('JOB_TOOL_SESSION_START_FAILED');
+        this.started = true;
+        try {
+            const scoped = { call: (tool, args) => this.call(tool, args), revoke: () => this.policy.revoke() };
+            this.server = this.options.createServer?.(scoped) ?? new LocalToolServer({ policy: scoped });
+            const endpoint = await this.server.start();
+            if (this.revoked)
+                throw Error();
+            return endpoint;
+        }
+        catch {
+            await this.close().catch(() => { });
+            throw new Error('JOB_TOOL_SESSION_START_FAILED');
+        }
+    }
+    revoke() {
+        if (this.revoked)
+            return;
+        this.revoked = true;
+        // Clear the endpoint token before cancellation reaches any worker.
+        try {
+            this.server?.revoke();
+        }
+        finally {
+            this.dispatcher?.revoke();
+            this.policy.revoke();
+        }
+    }
+    close() {
+        if (this.closing)
+            return this.closing;
+        this.closing = (async () => {
+            try {
+                this.revoke();
+            }
+            finally {
+                await this.server?.close();
+            }
+        })();
+        return this.closing;
+    }
+}

package/dist/src/safety/local-tool-policy.js

@@ -0,0 +1,101 @@
+import path from 'node:path';
+import { randomBytes } from 'node:crypto';
+import { lstat, realpath } from 'node:fs/promises';
+import { evaluateCommand } from './command-policy.js';
+import { runSandboxed } from './subprocess-sandbox.js';
+import { LOCAL_TOOL_WORKER } from './local-tool-worker.js';
+import { verifyCommandIntegrity } from './registered-command-integrity.js';
+export const LOCAL_TOOL_NAMES = ['local_read', 'local_search', 'local_edit', 'local_test'];
+// Private state/control basenames only: Auth.php, auth/ and mcp.ts are ordinary source.
+const sensitive = (segment) => /^(?:\.git|\.mcp(?:\..*)?|\.npmrc|\.netrc|id_rsa|id_ed25519|\.local-runner|\.runner|\.env(?:\..*)?|\.codex|\.claude|\.ssh|\.aws|\.config|auth\.(?:json|toml|ya?ml)(?:\..*)?|credentials(?:\..*)?|AGENTS\.md|CLAUDE\.md|mcp\.(?:json|toml|ya?ml)(?:\..*)?)$/i.test(segment);
+const contains = (root, file) => file === root || file.startsWith(root + path.sep);
+function scopePath(root, scope) {
+    const directory = scope === '**' ? '.' : scope.endsWith('/**') ? scope.slice(0, -3) || '.' : scope;
+    if (/[?*\[\]{}]/.test(directory))
+        throw new Error('DENIED_UNSUPPORTED_SCOPE');
+    return path.resolve(root, directory);
+}
+export class LocalToolPolicy {
+    options;
+    abort = new AbortController();
+    constructor(options) {
+        this.options = structuredClone(options);
+        if (!path.isAbsolute(options.worktreeRoot))
+            throw new Error('DENIED_ROOT');
+    }
+    revoke() { this.abort.abort(); }
+    async call(tool, args) {
+        if (this.abort.signal.aborted)
+            throw new Error('DENIED_REVOKED');
+        if (!LOCAL_TOOL_NAMES.includes(tool))
+            throw new Error('DENIED_TOOL');
+        if (!args || typeof args !== 'object' || Array.isArray(args))
+            throw new Error('DENIED_ARGUMENTS');
+        const input = args;
+        if (tool === 'local_edit' && this.options.access !== 'write')
+            throw new Error('DENIED_READ_ONLY');
+        if (tool === 'local_test')
+            return this.test(input);
+        const file = await this.authorizedFile(input.path, tool === 'local_edit');
+        if (tool === 'local_edit' && (typeof input.content !== 'string' || Buffer.byteLength(input.content) > 1024 * 1024))
+            throw new Error('DENIED_CONTENT');
+        if (tool === 'local_search' && (typeof input.query !== 'string' || input.query.length > 4096))
+            throw new Error('DENIED_QUERY');
+        const temp = file + '.runner-edit-' + randomBytes(16).toString('hex');
+        const output = await runSandboxed({ executable: process.execPath, argv: ['--no-addons', '--no-global-search-paths', '--eval', LOCAL_TOOL_WORKER, JSON.stringify({ tool, path: file, temp, content: input.content, query: input.query })], readFiles: tool === 'local_edit' ? [file, temp] : [file], writeFiles: tool === 'local_edit' ? [file, temp] : [], timeoutMs: 10000, signal: this.abort.signal });
+        if (this.abort.signal.aborted)
+            throw new Error('DENIED_REVOKED');
+        return JSON.parse(output);
+    }
+    async authorizedFile(value, allowMissing = false) {
+        if (typeof value !== 'string' || !value || value.includes('\0') || path.isAbsolute(value) || value.split(/[\\/]/).some(p => p === '..' || sensitive(p)))
+            throw new Error('DENIED_PATH');
+        const root = path.resolve(this.options.worktreeRoot), file = path.resolve(root, value);
+        if (!contains(root, file) || !this.options.allowedPaths.some(scope => contains(scopePath(root, scope), file)) || this.options.blockedPaths.some(scope => contains(scopePath(root, scope), file)))
+            throw new Error('DENIED_SCOPE');
+        if (await realpath(root) !== root)
+            throw new Error('DENIED_ROOT');
+        let component = root;
+        for (const segment of path.relative(root, file).split(path.sep)) {
+            component = path.join(component, segment);
+            let stat;
+            try {
+                stat = await lstat(component);
+            }
+            catch (error) {
+                if (allowMissing && component === file && error.code === 'ENOENT')
+                    return file;
+                throw error;
+            }
+            if (stat.isSymbolicLink())
+                throw new Error('DENIED_SYMLINK');
+        }
+        const stat = await lstat(file);
+        if (!stat.isFile())
+            throw new Error('DENIED_FILE');
+        if (stat.nlink !== 1)
+            throw new Error('DENIED_HARDLINK');
+        if (stat.size > 1024 * 1024)
+            throw new Error('DENIED_SIZE');
+        return file;
+    }
+    async test(input) {
+        const command = this.options.requiredCommands.find(command => command.id === input.command);
+        if (!command || !path.isAbsolute(command.executable) || command.argv.some(arg => typeof arg !== 'string'))
+            throw new Error('DENIED_COMMAND');
+        const rendered = [path.basename(command.executable), ...command.argv].join(' ');
+        if (!evaluateCommand(rendered, { requiredCommands: [rendered] }).allowed)
+            throw new Error('DENIED_COMMAND');
+        // Every dependency is an explicit registered file intersected with package policy.
+        // Test code has no worktree writes, ambient configuration, network or executable grants.
+        const executable = await realpath(command.executable);
+        const argv = executable === await realpath(process.execPath) ? ['--no-addons', '--no-global-search-paths', ...command.argv] : command.argv;
+        const readFiles = await Promise.all((command.readPaths ?? []).map(file => this.authorizedFile(file)));
+        await verifyCommandIntegrity(command.integrity, executable, command.readPaths ?? [], readFiles);
+        const output = await runSandboxed({ executable, argv, readFiles, signal: this.abort.signal });
+        await verifyCommandIntegrity(command.integrity, executable, command.readPaths ?? [], readFiles);
+        if (this.abort.signal.aborted)
+            throw new Error('DENIED_REVOKED');
+        return { output };
+    }
+}

package/dist/src/safety/local-tool-server.js

@@ -0,0 +1,174 @@
+import { createServer } from 'node:http';
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+import { LOCAL_TOOL_NAMES } from './local-tool-policy.js';
+const MAX_BODY = 1024 * 1024;
+const schemas = {
+    local_read: { type: 'object', properties: { path: { type: 'string' } }, required: ['path'], additionalProperties: false },
+    local_search: { type: 'object', properties: { path: { type: 'string' }, query: { type: 'string' } }, required: ['path', 'query'], additionalProperties: false },
+    local_edit: { type: 'object', properties: { path: { type: 'string' }, content: { type: 'string' } }, required: ['path', 'content'], additionalProperties: false },
+    local_test: { type: 'object', properties: { command: { type: 'string' } }, required: ['command'], additionalProperties: false },
+};
+/** Same immutable-by-copy inventory used by native admission and MCP discovery. */
+export function localToolInventory() {
+    return LOCAL_TOOL_NAMES.map(name => ({ name, description: `Scoped ${name} operation`, inputSchema: structuredClone(schemas[name]) }));
+}
+/** Job-only JSON MCP endpoint; intentionally has no Gateway transport or discovery. */
+export class LocalToolServer {
+    options;
+    server = null;
+    revoked = false;
+    starting = null;
+    token = null;
+    url = null;
+    constructor(options) {
+        this.options = options;
+    }
+    revoke() { this.revoked = true; this.token = null; this.options.policy.revoke?.(); }
+    async start() {
+        if (this.revoked)
+            throw new Error('Local tool server revoked');
+        if (this.server)
+            throw new Error('Local tool server already started');
+        this.token = randomBytes(32).toString('hex');
+        this.server = createServer(async (req, res) => {
+            const reply = (status, body) => {
+                if (res.writableEnded)
+                    return;
+                res.writeHead(status, { 'content-type': 'application/json' });
+                res.end(JSON.stringify(body));
+            };
+            if (req.method !== 'POST') {
+                reply(405, { error: 'Method not allowed' });
+                return;
+            }
+            if (req.url !== '/mcp') {
+                reply(404, { error: 'Not found' });
+                return;
+            }
+            if (req.headers.origin !== undefined || req.headers.host !== new URL(this.url).host) {
+                reply(403, { error: 'Forbidden' });
+                return;
+            }
+            const token = this.token, expected = Buffer.from(token ? `Bearer ${token}` : ''), supplied = Buffer.from(req.headers.authorization ?? '');
+            if (!token || expected.length !== supplied.length || !timingSafeEqual(expected, supplied)) {
+                reply(401, { error: 'Unauthorized' });
+                return;
+            }
+            if (req.headers['content-type']?.split(';')[0] !== 'application/json') {
+                reply(415, { error: 'JSON required' });
+                return;
+            }
+            try {
+                const chunks = [];
+                let size = 0;
+                for await (const chunk of req) {
+                    size += chunk.length;
+                    if (size > MAX_BODY) {
+                        reply(413, { error: 'Payload too large' });
+                        return;
+                    }
+                    chunks.push(chunk);
+                }
+                if (this.token !== token) {
+                    reply(401, { error: 'Authorization revoked' });
+                    return;
+                }
+                let value;
+                try {
+                    value = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+                }
+                catch {
+                    reply(400, { error: 'Invalid JSON' });
+                    return;
+                }
+                if (!value || typeof value !== 'object' || Array.isArray(value)) {
+                    reply(400, { error: 'Invalid RPC' });
+                    return;
+                }
+                const rpc = value;
+                if (rpc.jsonrpc !== '2.0' || typeof rpc.method !== 'string') {
+                    reply(400, { error: 'Invalid RPC' });
+                    return;
+                }
+                if (rpc.method === 'notifications/initialized' && rpc.id === undefined) {
+                    reply(202, {});
+                    return;
+                }
+                if (!(typeof rpc.id === 'string' || typeof rpc.id === 'number' && Number.isFinite(rpc.id))) {
+                    reply(400, { error: 'Invalid RPC id' });
+                    return;
+                }
+                const send = (result) => reply(200, { jsonrpc: '2.0', id: rpc.id, result });
+                if (rpc.method === 'initialize') {
+                    send({ protocolVersion: '2024-11-05', capabilities: { tools: {} }, serverInfo: { name: 'runner-local-tools', version: '1' } });
+                    return;
+                }
+                if (rpc.method === 'ping') {
+                    send({});
+                    return;
+                }
+                if (rpc.method === 'tools/list') {
+                    send({ tools: localToolInventory() });
+                    return;
+                }
+                if (rpc.method !== 'tools/call' || !rpc.params || typeof rpc.params !== 'object' || Array.isArray(rpc.params)) {
+                    reply(403, { error: 'Forbidden MCP request' });
+                    return;
+                }
+                const params = rpc.params;
+                if (!LOCAL_TOOL_NAMES.includes(params.name)) {
+                    reply(403, { error: 'Forbidden tool' });
+                    return;
+                }
+                try {
+                    const result = await this.options.policy.call(params.name, params.arguments);
+                    if (this.token !== token) {
+                        reply(401, { error: 'Authorization revoked' });
+                        return;
+                    }
+                    send({ content: [{ type: 'text', text: JSON.stringify(result) }] });
+                }
+                catch (error) {
+                    if (this.token !== token) {
+                        reply(401, { error: 'Authorization revoked' });
+                        return;
+                    }
+                    // Only stable policy error identifiers cross this boundary, never raw paths/stderr.
+                    const code = error instanceof Error ? error.message.match(/^(DENIED_[A-Z_]+|LOCAL_SANDBOX_UNAVAILABLE)/)?.[0] : undefined;
+                    send({ isError: true, content: [{ type: 'text', text: code ?? 'LOCAL_TOOL_FAILED' }] });
+                }
+            }
+            catch {
+                reply(400, { error: 'Invalid request' });
+            }
+        });
+        this.server.requestTimeout = 15000;
+        this.server.headersTimeout = 10000;
+        this.starting = new Promise((resolve, reject) => { this.server.once('error', reject); this.server.listen(0, '127.0.0.1', () => resolve()); });
+        await this.starting;
+        if (this.revoked) {
+            await this.close();
+            throw new Error('Local tool server revoked');
+        }
+        const address = this.server.address();
+        if (!address || typeof address === 'string')
+            throw new Error('Failed to bind local tool server');
+        this.url = `http://127.0.0.1:${address.port}/mcp`;
+        return { url: this.url, token: this.token };
+    }
+    async close() {
+        this.revoke();
+        const server = this.server;
+        this.server = null;
+        if (!server)
+            return;
+        await this.starting?.catch(() => { });
+        server.closeAllConnections();
+        await new Promise((resolve, reject) => server.close(error => {
+            if (error && error.code !== 'ERR_SERVER_NOT_RUNNING')
+                reject(error);
+            else
+                resolve();
+        }));
+    }
+}

package/dist/src/safety/local-tool-worker.js

@@ -0,0 +1,57 @@
+/** Standalone worker: --eval avoids ambient module/config lookup. All paths are host-supplied. */
+export const LOCAL_TOOL_WORKER = String.raw `
+const fs = require('node:fs');
+const input = JSON.parse(process.argv[1]);
+let current = '';
+for (const part of input.path.split('/').filter(Boolean)) {
+  current += '/' + part;
+  try {
+    if (fs.lstatSync(current).isSymbolicLink()) throw Error('DENIED_SYMLINK');
+  } catch (error) {
+    if (!(error.code === 'ENOENT' && current === input.path && input.tool === 'local_edit')) throw error;
+  }
+}
+let before;
+try { before = fs.lstatSync(input.path); } catch (error) {
+  if (!(error.code === 'ENOENT' && input.tool === 'local_edit')) throw error;
+}
+if (before && (!before.isFile() || before.nlink !== 1 || before.size > 1048576)) throw Error('DENIED_FILE');
+const fd = before ? fs.openSync(input.path, fs.constants.O_NOFOLLOW | fs.constants.O_RDONLY) : null;
+try {
+  const actual = fd === null ? null : fs.fstatSync(fd);
+  if (actual) {
+    const final = fs.lstatSync(input.path);
+    if (actual.ino !== before.ino || actual.dev !== before.dev || actual.ino !== final.ino || actual.dev !== final.dev || actual.nlink !== 1) throw Error('DENIED_RACE');
+  }
+  let result;
+  if (input.tool === 'local_edit') {
+    const data = Buffer.from(input.content, 'utf8');
+    const temp = fs.openSync(input.temp, fs.constants.O_NOFOLLOW | fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_WRONLY, before ? before.mode & 0o777 : 0o600);
+    try {
+      fs.writeFileSync(temp, data);
+      fs.fsyncSync(temp);
+      const tempStat = fs.fstatSync(temp), tempFinal = fs.lstatSync(input.temp);
+      if (tempStat.nlink !== 1 || tempStat.ino !== tempFinal.ino || tempStat.dev !== tempFinal.dev) throw Error('DENIED_RACE');
+      if (actual) {
+        const still = fs.lstatSync(input.path);
+        if (still.isSymbolicLink() || still.ino !== actual.ino || still.dev !== actual.dev || still.nlink !== 1) throw Error('DENIED_RACE');
+        fs.renameSync(input.temp, input.path);
+      } else {
+        // Exclusive creation: a concurrent target cannot be overwritten.
+        fs.linkSync(input.temp, input.path);
+      }
+      result = {written: data.length};
+    } finally {
+      fs.closeSync(temp);
+      try { fs.unlinkSync(input.temp); } catch {}
+    }
+  } else {
+    const buffer = Buffer.alloc(1048577);
+    const count = fs.readSync(fd, buffer, 0, buffer.length, 0);
+    if (count > 1048576) throw Error('DENIED_SIZE');
+    const content = buffer.subarray(0, count).toString('utf8');
+    result = input.tool === 'local_search' ? {matches: content.split('\n').flatMap((line, index) => line.includes(input.query) ? [{line: index + 1, text: line}] : [])} : {content};
+  }
+  process.stdout.write(JSON.stringify(result));
+} finally { if (fd !== null) fs.closeSync(fd); }
+`;

package/dist/src/safety/pre-tool-use-hook.js

@@ -1,6 +1,4 @@
-import { evaluateCommand, evaluatePathAction } from "./command-policy.js";
-const PATH_EDIT_TOOLS = new Set(["Edit", "Write", "MultiEdit", "NotebookEdit"]);
-const READ_PATH_TOOLS = new Set(["Read", "Glob", "Grep"]);
+export const CLAUDE_LOCAL_MCP_TOOLS = Object.freeze(["local_read", "local_search", "local_edit", "local_test"].map(name => `mcp__ai_local__${name}`));
 function allow(reasonCode) {
     return {
         hookSpecificOutput: {
@@ -19,16 +17,6 @@ function deny(reasonCode) {
         },
     };
 }
-function pathFromToolInput(toolInput, keys) {
-    if (!toolInput)
-        return undefined;
-    for (const key of keys) {
-        const value = toolInput[key];
-        if (typeof value === "string" && value.length > 0)
-            return value;
-    }
-    return undefined;
-}
 /**
  * Pure PreToolUse decision function: deterministic, side-effect free, and
  * never echoes raw commands/paths/tool output/secrets back in a decision
@@ -42,30 +30,6 @@ export function evaluateHookEvent(input, policy) {
     if (typeof toolName !== "string" || toolName.length === 0) {
         return deny("DENIED_MALFORMED_INPUT");
     }
-    if (toolName === "Bash") {
-        const command = input.tool_input?.command;
-        if (typeof command !== "string" || command.length === 0) {
-            return deny("DENIED_MALFORMED_INPUT");
-        }
-        const decision = evaluateCommand(command, { requiredCommands: policy.requiredCommands });
-        return decision.allowed ? allow(decision.reasonCode) : deny(decision.reasonCode);
-    }
-    if (PATH_EDIT_TOOLS.has(toolName) || READ_PATH_TOOLS.has(toolName)) {
-        const relativePath = pathFromToolInput(input.tool_input, ["file_path", "path", "notebook_path", "pattern"]);
-        if (!relativePath) {
-            return deny("DENIED_MALFORMED_INPUT");
-        }
-        const decision = evaluatePathAction(relativePath, {
-            worktreeRoot: policy.worktreeRoot,
-            blockedPaths: policy.blockedPaths,
-        });
-        return decision.allowed ? allow(decision.reasonCode) : deny(decision.reasonCode);
-    }
-    if (toolName.startsWith("mcp__")) {
-        const contractToolName = toolName.includes("__") ? toolName.slice(toolName.lastIndexOf("__") + 2) : toolName;
-        return policy.allowedMcpTools.includes(toolName) || policy.allowedMcpTools.includes(contractToolName)
-            ? allow("ALLOWED_MCP_READ_TOOL")
-            : deny("DENIED_MCP_TOOL_NOT_ALLOWED");
-    }
-    return deny("DENIED_UNKNOWN_TOOL");
+    return CLAUDE_LOCAL_MCP_TOOLS.includes(toolName) && policy.allowedMcpTools.includes(toolName)
+        ? allow("ALLOWED_LOCAL_TOOL") : deny("DENIED_TOOL_NOT_ALLOWED");
 }

package/dist/src/safety/registered-command-integrity.js

@@ -0,0 +1,52 @@
+import { constants } from 'node:fs';
+import { open, lstat } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
+const denied = () => new Error('DENIED_COMMAND_INTEGRITY');
+/** Measures one no-follow regular file. This does not claim atomic path-based
+ * exec: OS confinement must contain a racing/hostile script independently. */
+export async function measureCommandFile(file) {
+    const fd = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    try {
+        const before = await fd.stat({ bigint: true });
+        if (!before.isFile() || before.nlink !== 1n || before.size > 512n * 1024n * 1024n)
+            throw denied();
+        const hash = createHash('sha256');
+        let size = 0n;
+        for await (const chunk of fd.createReadStream({ autoClose: false })) {
+            size += BigInt(chunk.length);
+            if (size > 512n * 1024n * 1024n)
+                throw denied();
+            hash.update(chunk);
+        }
+        const after = await fd.stat({ bigint: true }), named = await lstat(file, { bigint: true });
+        for (const stat of [after, named])
+            if (!stat.isFile() || stat.dev !== before.dev || stat.ino !== before.ino
+                || stat.nlink !== 1n || stat.size !== before.size || stat.mtimeNs !== before.mtimeNs || stat.ctimeNs !== before.ctimeNs)
+                throw denied();
+        if (size !== before.size)
+            throw denied();
+        return hash.digest('hex');
+    }
+    finally {
+        await fd.close();
+    }
+}
+export async function verifyCommandIntegrity(integrity, executable, paths, files) {
+    try {
+        const hex = (v) => typeof v === 'string' && /^[a-f0-9]{64}$/.test(v);
+        if (!integrity || !hex(integrity.executableSha256) || !integrity.readFiles || Array.isArray(integrity.readFiles)
+            || new Set(paths).size !== paths.length || files.length !== paths.length
+            || JSON.stringify(Object.keys(integrity.readFiles).sort()) !== JSON.stringify([...paths].sort()))
+            throw denied();
+        if (await measureCommandFile(executable) !== integrity.executableSha256)
+            throw denied();
+        for (let i = 0; i < paths.length; i++) {
+            const expected = integrity.readFiles[paths[i]];
+            if (!hex(expected) || await measureCommandFile(files[i]) !== expected)
+                throw denied();
+        }
+    }
+    catch {
+        throw denied();
+    }
+}

package/dist/src/safety/security-requirements.js

@@ -0,0 +1,38 @@
+import { createHash } from 'node:crypto';
+import { SUPPORTED_CLI_MODE, SUPPORTED_CLI_GATES, SUPPORTED_CLI_RISKS } from './cli-security-modes.js';
+import { JOB_SECURITY_GATES } from './job-security-policy.js';
+const rejected = () => new Error('SECURITY_REQUIREMENTS_REJECTED');
+function canonical(v) { if (Array.isArray(v))
+    return v.map(canonical); if (v && typeof v === 'object')
+    return Object.fromEntries(Object.keys(v).sort().map(k => [k, canonical(v[k])])); return v; }
+/** Same canonical domain as Gateway JSON_UNESCAPED_SLASHES packages. */
+export function securityRequirementsFingerprint(value) {
+    const unsigned = { ...value };
+    delete unsigned.fingerprint;
+    return createHash('sha256').update(JSON.stringify(canonical(unsigned)).replace(/[\u007f-\uffff]/g, c => '\\u' + c.charCodeAt(0).toString(16).padStart(4, '0'))).digest('hex');
+}
+export function requireSecurityRequirements(value, expected) {
+    try {
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            throw rejected();
+        const r = value;
+        const supported = r.version === 'cli-security-requirements-v2';
+        const fields = ['version', 'adapter_id', 'adapter_version', 'mandatory_gates', 'status', 'evidence_class', 'release_manifest_sha256', 'fingerprint', ...(supported ? ['security_mode', 'accepted_residual_risks'] : [])];
+        if (JSON.stringify(Object.keys(r).sort()) !== JSON.stringify(fields.sort())
+            || (!supported && r.version !== 'cli-security-requirements-v1') || r.adapter_id !== expected.adapterId || r.adapter_version !== expected.adapterVersion
+            || JSON.stringify(r.mandatory_gates) !== JSON.stringify(supported ? SUPPORTED_CLI_GATES : JOB_SECURITY_GATES) || r.status !== 'verified' || r.evidence_class !== (supported ? 'supported_policy_release' : 'native_release')
+            || supported && (r.adapter_id !== 'codex_cli' || r.security_mode !== SUPPORTED_CLI_MODE || JSON.stringify(r.accepted_residual_risks) !== JSON.stringify(SUPPORTED_CLI_RISKS))
+            || typeof r.release_manifest_sha256 !== 'string' || typeof r.fingerprint !== 'string'
+            || !/^[a-f0-9]{64}$/.test(r.release_manifest_sha256) || !/^[a-f0-9]{64}$/.test(r.fingerprint)
+            || securityRequirementsFingerprint(r) !== r.fingerprint || expected.requirementsSha256 !== undefined && expected.requirementsSha256 !== r.fingerprint)
+            throw rejected();
+        const copy = structuredClone(r);
+        Object.freeze(copy.mandatory_gates);
+        if (copy.accepted_residual_risks)
+            Object.freeze(copy.accepted_residual_risks);
+        return Object.freeze(copy);
+    }
+    catch {
+        throw rejected();
+    }
+}