mtech-ai-local-runner 0.1.80 → 0.1.81

package/README.md

@@ -269,7 +269,7 @@ covers it. A stored delivery is forgotten an hour after it arrived, by which tim
 long run.
 
 Integrations are installed only on request, with `setup --integrations` or `integrations install`; setup never asks
-about them. An app already installed in the directory the environment names is skipped and reported installed, without
+about them. The Work Room pane, below, is the one exception: every setup installs it. An app already installed in the directory the environment names is skipped and reported installed, without
 rewriting its files:
 
 ```bash
@@ -298,10 +298,16 @@ your own AI Gateway connector in Claude, and it never starts a model turn: its O
 conversation. Without the connector the pane says so. The Claude mobile app draws no input field, so there the pane
 reads, shares and marks read only.
 
-The pane refreshes with no model turn, so a Claude session in auto mode would refuse those calls. The mod therefore
-ships a PreToolUse hook that allows exactly the two reads, `work_room_read` and `work_inbox`, on any AI Gateway
-connector. That hook allows them for every caller in the session, the model included. Every other call the pane makes
-carries the press that raised it: Open for a Room and its presented receipt, and the confirm press for each write.
+The pane calls the connector with no model turn, so a Claude session in auto mode would refuse every one of those
+calls. The mod therefore ships PreToolUse hooks that match any AI Gateway connector and apply to every caller in the
+session, the model included:
+
+- They allow the two reads, `work_room_read` and `work_inbox`.
+- They allow `work_room_receipt_report` only when its `state` is `presented`, the record that the pane showed you a
+  message.
+- They ask you in Claude's own permission dialog before every write: `work_room_write`, `work_request_answer`, and
+  `work_room_receipt_report` for marking messages read. A write from the pane therefore needs its confirm press and
+  then your answer in that dialog.
 
 The runner copies the mod to `claude-mod/<version>/` in the state root, without its tests, and installs it with the
 Claude CLI as a local marketplace (`plugin marketplace add` and `plugin install --scope user`). This needs a Claude CLI
@@ -310,6 +316,12 @@ bundles. Without one, the hooks are installed as before and the result reports t
 only a missing or older copy, and it never turns on a mod you turned off. `integrations status` and `doctor` report the
 mod's state under `mod`; `integrations remove claude` and `uninstall` remove it. The daemon never runs the Claude CLI.
 
+Every `setup` installs or updates the mod, with or without `--integrations`, and reports it as `workRoomPane`. So
+rerunning `npx mtech-ai-local-runner@<version> setup` is enough to get the newest pane. With `--integrations claude`
+the Claude integration installs it and reports it under its own `mod` instead. After `integrations remove claude`,
+setup leaves the mod out, and its result says so. `integrations install claude` adds the mod again, and from then
+setup keeps it up to date once more. `uninstall` forgets the removal, so a later setup starts fresh.
+
 `CLAUDE_CONFIG_DIR` and `CODEX_HOME` are honoured. The LaunchAgent that runs the daemon gets only `PATH`, so every
 install adds the directory it used to a list per app in `integrations.json` in the state root, and the daemon,
 `doctor`, `integrations remove` and `uninstall` look in every recorded directory as well as in the environment. A

package/claude-mod/.claude-plugin/plugin.json

@@ -1 +1 @@
-{ "name": "ai-gateway-work-room", "version": "1.1.0", "description": "Work Room shares and requests from colleagues beside the conversation, installed by mtech-ai-local-runner (Work Item 98da2635).", "types": "./types/index.d.ts" }
+{ "name": "ai-gateway-work-room", "version": "1.2.0", "description": "Work Room shares and requests from colleagues beside the conversation, installed by mtech-ai-local-runner (Work Item 98da2635).", "types": "./types/index.d.ts" }

package/claude-mod/hooks/hooks.json

@@ -10,6 +10,24 @@
             "command": "printf '%s' '{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"allow\",\"permissionDecisionReason\":\"Work Room pane: reading your own AI Gateway Rooms and requests is allowed.\"}}'"
           }
         ]
+      },
+      {
+        "matcher": "^mcp__.+__work_room_receipt_report$",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "if grep -Eq '\"state\"[[:space:]]*:[[:space:]]*\"presented\"'; then printf '%s' '{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"allow\",\"permissionDecisionReason\":\"Work Room pane: recording that it showed you these Room messages is allowed.\"}}'; else printf '%s' '{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"ask\",\"permissionDecisionReason\":\"Work Room: marking Room messages read tells the AI Gateway you read them. Allow it?\"}}'; fi"
+          }
+        ]
+      },
+      {
+        "matcher": "^mcp__.+__(work_room_write|work_request_answer)$",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "printf '%s' '{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"ask\",\"permissionDecisionReason\":\"Work Room: this sends what you wrote to colleagues through the AI Gateway. Allow it?\"}}'"
+          }
+        ]
       }
     ]
   }

package/claude-mod/hooks/register.tsx

@@ -10,9 +10,11 @@ import { bandText, chatPrompt, findPayload, parseActivity, parseInbox, parseMess
  * conversation, read and answered through the person's own AI Gateway connector with no model turn. The band above
  * the prompt says what waits; the pane opens only from the band or /work-room, never at session start.
  *
- * The refresh runs with no request of the person's behind it, which auto mode refuses, and a mod's own module hooks
- * cannot approve its own calls. So hooks/hooks.json carries a PreToolUse hook that allows the two reads, work_room_read
- * and work_inbox, for every caller (owner decision 2026-10-31). Every other call carries the press that raised it.
+ * Auto mode refuses every call the pane makes, since none comes from a request of the person's in the conversation, and
+ * a mod's own module hooks cannot approve its own calls. So hooks/hooks.json carries PreToolUse hooks for every caller
+ * (owner decisions 2026-10-31): they allow the reads (work_room_read, work_inbox) and the presented receipt, and they
+ * put each write (answer, post, share, mark read) to the person in Claude's own permission dialog, after the pane's
+ * confirm press.
  */
 
 export const PANE = 'work-room'

package/dist/src/adapters/claude-code/prompt-compiler.js

@@ -1,6 +1,6 @@
 import { renderBundleCorrectionBrief } from '../../verification/continuation-runner-contract.js';
 import { compilePrompt as compileBrief } from "../prompt-compiler.js";
-import { LOCAL_TOOL_GUIDANCE, repositoryScope } from "../local-tool-prompt.js";
+import { LOCAL_FIND_DISCOVERY, LOCAL_TOOL_GUIDANCE, repositoryScope } from "../local-tool-prompt.js";
 import { localToolNames } from "../../safety/local-tool-policy.js";
 // Claude's working directory is the job's private control directory, so without these rules it sends that directory's
 // absolute path or shell commands to the ai_local tools (P4 Investigate of Work Item 1c8026f1, 2026-10-28). Without the
@@ -9,11 +9,7 @@ import { localToolNames } from "../../safety/local-tool-policy.js";
 const CLAUDE_PATH_DISCOVERY = Object.freeze({
     "local-tools-v1": "local_search searches only inside that one file; there is no directory listing or repository-wide search, so take " +
         "file paths from the objective and from files you have read. ",
-    "local-tools-v2": "local_search searches only inside that one file. To find a file, use local_find with name for a literal part of " +
-        "its path, such as MigrateChannelLedgerCommand, or text for a literal it contains, such as migrate:channel-ledger, then " +
-        "local_search and local_read on the file found. local_find's path is an optional directory inside the approved scope, not a " +
-        "file; it skips vendor/ and node_modules/ unless that directory is inside them, and truncated: true means it stopped at a " +
-        "bound, so narrow path, name or text. "
+    "local-tools-v2": LOCAL_FIND_DISCOVERY
 });
 const claudePathRules = (inventory) => "## Local tool path rules\n" +
     "Every path argument is one checkout-relative file path inside the approved scope, without a leading slash: write " +

package/dist/src/adapters/codex/adapter.js

@@ -6,7 +6,7 @@ import { createJobSecurityReceipt } from '../../safety/job-security-receipt.js';
 import { requireJobSecurity } from '../../safety/job-security-policy.js';
 import { CODEX_UNSUPPORTED_DIAGNOSTIC } from "./compatibility.js";
 import { buildCodexInvocation } from "./config-builder.js";
-import { compileCodexPrompt, CODEX_REPORT_SCHEMA } from "./prompt-compiler.js";
+import { codexPromptToolInventory, compileCodexPrompt, CODEX_REPORT_SCHEMA } from "./prompt-compiler.js";
 import { CodexStreamParser } from "./stream-parser.js";
 function object(value) {
     if (!value || typeof value !== "object" || Array.isArray(value))
@@ -62,7 +62,7 @@ export class CodexAdapter {
             this.usingOfficialExec = true;
             let stage = 'codex_prompt';
             try {
-                const prompt = compileCodexPrompt(object(ctx.taskPackage), this.options.jobId);
+                const prompt = compileCodexPrompt(object(ctx.taskPackage), this.options.jobId, codexPromptToolInventory(approved.security_requirements));
                 stage = 'codex_launch';
                 this.handle = await this.ownedExec.start(ctx, this.options.jobId, prompt, this.startupAbort.signal);
                 this.receipt = this.ownedExec.receipt();
@@ -144,7 +144,7 @@ export class CodexAdapter {
             }
         };
         try {
-            const prompt = compileCodexPrompt(pkg, this.options.jobId);
+            const prompt = compileCodexPrompt(pkg, this.options.jobId, codexPromptToolInventory(approved.security_requirements));
             this.tools = this.options.createTools(pkg, approved);
             const endpoint = await this.tools.start();
             this.assertNotCancelled();

package/dist/src/adapters/codex/prompt-compiler.js

@@ -1,9 +1,26 @@
 import { renderBundleCorrectionBrief } from '../../verification/continuation-runner-contract.js';
 import { compilePrompt as compileBrief } from "../prompt-compiler.js";
-import { LOCAL_TOOL_GUIDANCE, repositoryScope } from "../local-tool-prompt.js";
-export function compileCodexPrompt(taskPackage, label) {
+import { LOCAL_FIND_DISCOVERY, LOCAL_TOOL_GUIDANCE, repositoryScope } from "../local-tool-prompt.js";
+import { localToolNames } from "../../safety/local-tool-policy.js";
+import { localToolInventoryFor } from "../../safety/local-tool-server.js";
+import { securityRequirementsFingerprint } from "../../safety/security-requirements.js";
+// local-tools-v1 has no discovery tool and its prompt is unchanged. With local-tools-v2 Codex must be told about local_find:
+// without it, the CHANNEL-4K Investigate of 2026-10-31 (job 4cec57c0) searched directories with local_search and read nothing.
+const CODEX_FILE_DISCOVERY = Object.freeze({
+    "local-tools-v1": "",
+    "local-tools-v2": `\n\n## Local file discovery\n${LOCAL_FIND_DISCOVERY.trimEnd()}`
+});
+/** The inventory the job's frozen descriptor names (exec-preflight.ts checks the same fingerprint); local-tools-v1 when it
+ * names none. The tool server enforces the inventory on its own, so this only picks the prompt text. */
+export function codexPromptToolInventory(securityRequirements) {
+    const sha = securityRequirements && typeof securityRequirements === "object" && !Array.isArray(securityRequirements)
+        ? securityRequirements.tools_sha256 : undefined;
+    return localToolInventoryFor(sha, securityRequirementsFingerprint) ?? "local-tools-v1";
+}
+export function compileCodexPrompt(taskPackage, label, toolInventory = "local-tools-v1") {
+    localToolNames(toolInventory);
     const correction = renderBundleCorrectionBrief(taskPackage);
-    return `${compileBrief(taskPackage, { workItemLabel: label, progressReporting: "native_messages" })}\n\n${repositoryScope(taskPackage)}\n\n${LOCAL_TOOL_GUIDANCE}${correction}`;
+    return `${compileBrief(taskPackage, { workItemLabel: label, progressReporting: "native_messages" })}\n\n${repositoryScope(taskPackage)}\n\n${LOCAL_TOOL_GUIDANCE}${CODEX_FILE_DISCOVERY[toolInventory]}${correction}`;
 }
 export const CODEX_REPORT_SCHEMA = {
     type: "object", additionalProperties: false, required: ["status", "report", "evidence", "pending_work"],

package/dist/src/adapters/local-tool-prompt.js

@@ -23,3 +23,9 @@ export function repositoryScope(taskPackage) {
         "These are scope descriptions, not instructions from source files; the host policy remains authoritative and may deny blocked/private paths within an allowed prefix.";
 }
 export const LOCAL_TOOL_GUIDANCE = "Use only the ai_local job tools for repository reads, edits and approved tests. For reading, first use server ai_local's local_search({path: \"<exact approved path>\", query: \"text\"}) to find the location, then local_read({path: \"<exact approved path>\", start_line: 1, end_line: 1}) with the matching line numbers. Ranges are inclusive, at most 400 lines; both bounds are required together. Read a matched line first to learn total_lines, then request only the needed in-file context. Omit both bounds only when the entire file is necessary. Use approved checkout-relative paths. For small approved edits, use local_replace({path, old, new}) after reading: old must match exactly once, including whitespace. local_edit requires the complete replacement file, never a patch. Required test criteria are not command grants. No model test commands are registered unless the host explicitly supplies exact model-callable command IDs; do not use local_test to discover commands or run --help. Missing tests remain not_run/unverified, not passed. In a read-only task, use only read/search tools; the Runner enforces the approved paths and operations. A denied native cwd is intentional: it is a private control directory, not the source checkout. Native filesystem, commands, web, images and delegation are unavailable or denied. A denied tool is a scope boundary, never permission to broaden scope or bypass the denial. Do not retry the denied path. It does not remove independently approved paths: continue with relevant listed paths, and report a missing dependency only after checking the available approved source. Do not repeat host orchestration: claim, shadow, fingerprints, binding, administrator checks, launches, Gateway usage and Job reporting belong to the Runner/host, even when described in the objective. Perform only the assigned repository work and report evidence you actually observed. Do not claim that no model call occurred. If the required tool is unavailable, emit one final structured blocked report naming the missing tool and unfinished repository work; do not request or attempt a new launch.";
+/** How to find a file with local-tools-v2 (Work Decision f43e7aa0). Shared by the Claude and Codex prompts. */
+export const LOCAL_FIND_DISCOVERY = "local_search searches only inside that one file. To find a file, use local_find with name for a literal part of " +
+    "its path, such as MigrateChannelLedgerCommand, or text for a literal it contains, such as migrate:channel-ledger, then " +
+    "local_search and local_read on the file found. local_find's path is an optional directory inside the approved scope, not a " +
+    "file; it skips vendor/ and node_modules/ unless that directory is inside them, and truncated: true means it stopped at a " +
+    "bound, so narrow path, name or text. ";

package/dist/src/asks/claude-mod.js

@@ -1,6 +1,6 @@
 import { execFile } from "node:child_process";
 import { constants } from "node:fs";
-import { access, cp, mkdir, readdir, rm, stat } from "node:fs/promises";
+import { access, cp, mkdir, readdir, rm, stat, writeFile } from "node:fs/promises";
 import { basename, delimiter, isAbsolute, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { packageVersion } from "../package-version.js";
@@ -13,8 +13,14 @@ import { packageVersion } from "../package-version.js";
  * Only a CLI that loads `modules` hooks can install it. On 2026-10-30 the terminal `claude` 2.1.212 could not, and the
  * desktop-bundled 2.1.299 and 2.1.308 could; the desktop app bundles one even when the terminal `claude` is older.
  * A mod the person disabled stays disabled: setup reinstalls only a missing or older one.
+ *
+ * Every setup installs the mod, with or without --integrations (owner decision 2026-10-31), unless the person removed
+ * it with `integrations remove claude`. That removal leaves <stateRoot>/claude-mod-removed, which
+ * `integrations install claude` and uninstall delete again.
  */
 export const CLAUDE_MOD_NAME = "ai-gateway-work-room";
+/** <stateRoot>/claude-mod-removed: the person removed the mod, so setup leaves it out until they install it again. */
+export const CLAUDE_MOD_REMOVED_FILE = "claude-mod-removed";
 export const CLAUDE_MOD_MARKETPLACE = "mtec-ai-gateway";
 const ID = `${CLAUDE_MOD_NAME}@${CLAUDE_MOD_MARKETPLACE}`;
 const MIN_VERSION = [2, 1, 299];
@@ -126,6 +132,20 @@ export async function removeClaudeMod(deps) {
     await rm(join(deps.stateRoot, "claude-mod"), { recursive: true, force: true }).catch(() => undefined);
     return { state: "removed", ...(cli ? { cli } : {}) };
 }
+/** Whether the person removed the mod with `integrations remove claude` since it was last installed on request. */
+export async function claudeModRemovedByPerson(stateRoot) {
+    return stat(join(stateRoot, CLAUDE_MOD_REMOVED_FILE)).then(entry => entry.isFile(), () => false);
+}
+/** Records or clears the person's removal. */
+export async function setClaudeModRemovedByPerson(stateRoot, removed) {
+    const file = join(stateRoot, CLAUDE_MOD_REMOVED_FILE);
+    if (!removed) {
+        await rm(file, { force: true });
+        return;
+    }
+    await mkdir(stateRoot, { recursive: true });
+    await writeFile(file, "Removed with integrations remove claude. Run integrations install claude to add the Work Room pane again.\n", { mode: 0o600 });
+}
 /** What `plugin list` says of the mod. Never throws. */
 export async function claudeModStatus(deps) {
     const cli = await findClaudeCli(deps);

package/dist/src/asks/commands.js

@@ -1,7 +1,7 @@
 import { readdir, rm } from "node:fs/promises";
 import { join } from "node:path";
 import { ASKS_FILE } from "./store.js";
-import { claudeModDeps, claudeModStatus, installClaudeMod, removeClaudeMod } from "./claude-mod.js";
+import { claudeModDeps, claudeModRemovedByPerson, claudeModStatus, installClaudeMod, removeClaudeMod, setClaudeModRemovedByPerson } from "./claude-mod.js";
 import { homeDirectory, installIntegration, integrationStatus, removeIntegration, removeShimIfUnused } from "./integrations.js";
 import { APPS, isApp } from "./types.js";
 import { deleteGuideState } from "../guide/files.js";
@@ -89,6 +89,16 @@ async function claudeMod(env, stateRoot, act) {
         return { state: "failed", reason: errorCode(error) };
     }
 }
+/**
+ * setup's Work Room mod: installed on every setup, with or without --integrations (owner decision 2026-10-31), unless
+ * the person removed it with `integrations remove claude`. Never throws.
+ */
+export async function setupClaudeMod(env, stateRoot) {
+    if (await claudeModRemovedByPerson(stateRoot)) {
+        return { state: "skipped", reason: "removed with integrations remove claude; run integrations install claude to add it again" };
+    }
+    return claudeMod(env, stateRoot, installClaudeMod);
+}
 /** The Work Room mod's state, for integrations status and doctor. It runs the Claude CLI, so the daemon never calls it. */
 export const claudeModStatusOf = (env, stateRoot) => claudeMod(env, stateRoot, claudeModStatus);
 async function attempt(app, env, stateRoot, change) {
@@ -104,7 +114,10 @@ export async function installIntegrations(apps, env, stateRoot) {
     for (const app of apps) {
         const result = await attempt(app, env, stateRoot, () => installIntegration(app, env, stateRoot));
         const done = result.error === undefined ? { ...result, action: NEXT_STEP[app] } : result;
-        // The hooks first: they work without the mod, and a Claude CLI too old for the mod leaves them in place.
+        // The hooks first: they work without the mod, and a Claude CLI too old for the mod leaves them in place. Installing
+        // on request undoes an earlier removal, so setup keeps the mod again.
+        if (app === "claude")
+            await setClaudeModRemovedByPerson(stateRoot, false).catch(() => undefined);
         results.push(app === "claude" ? { ...done, mod: await claudeMod(env, stateRoot, installClaudeMod) } : done);
     }
     return results;
@@ -163,6 +176,8 @@ export async function removeAsksInstall(env, stateRoot) {
     const results = [];
     for (const app of APPS)
         results.push(await removeAsks(app, env, stateRoot));
+    // Uninstall removes everything, so a later setup starts fresh and installs the Work Room mod again.
+    await setClaudeModRemovedByPerson(stateRoot, false).catch(() => undefined);
     // A hook left behind (an unreadable Codex hooks file) keeps its shim, which then prints nothing and exits 0.
     await removeShimIfUnused(env, stateRoot).catch(() => false);
     await rm(join(stateRoot, ASKS_FILE), { force: true });
@@ -187,6 +202,9 @@ export async function runIntegrationsCommand(argv, io) {
         else if (parsed.action === "remove") {
             for (const app of parsed.apps)
                 results.push(await removeAsks(app, io.env, io.stateRoot));
+            // The person removed the Work Room mod: setup leaves it out until integrations install claude.
+            if (parsed.apps.includes("claude"))
+                await setClaudeModRemovedByPerson(io.stateRoot, true).catch(() => undefined);
             await removeShimIfUnused(io.env, io.stateRoot).catch(() => false);
         }
         else {

package/dist/src/cli.js

@@ -32,7 +32,7 @@ import { verifyPackagedHook } from "./safety/hook-command.js";
 import { access, mkdir, rm } from "node:fs/promises";
 import { buildMessengerDaemon } from "./asks/messenger.js";
 import { runHookClient } from "./asks/hook-client.js";
-import { installGuideIntegrations, installIntegrations, parseFeatures, parseSetupIntegrations, removeAsksInstall, removeGuideInstall, runIntegrationsCommand } from "./asks/commands.js";
+import { installGuideIntegrations, installIntegrations, parseFeatures, parseSetupIntegrations, removeAsksInstall, removeGuideInstall, runIntegrationsCommand, setupClaudeMod } from "./asks/commands.js";
 import { asksDoctorReport } from "./asks/doctor.js";
 import { guideDoctorReport, guideReportShown } from "./guide/doctor.js";
 import { runClaudeReleaseCommand } from "./commands/claude-release.js";
@@ -296,12 +296,14 @@ export async function main(argv, env, io = {}) {
                 const features = requestedFeatures ?? ["asks"];
                 const integrations = features.includes("asks") ? await installIntegrations(requestedIntegrations ?? [], env, config.stateRoot) : [];
                 const guide = features.includes("guide") ? await installGuideIntegrations(requestedIntegrations ?? [], env, config.stateRoot) : undefined;
+                // The Work Room pane goes with every setup (owner decision 2026-10-31); --integrations claude has just installed it.
+                const workRoomPane = integrations.some(report => report.app === "claude" && report.mod !== undefined) ? undefined : await setupClaudeMod(env, config.stateRoot);
                 // The LaunchAgent runs a copy under releases/<version>, never the npx cache that may have run setup.
                 const daemonExecutable = await (io.installRelease ?? installStableRelease)({ entry: process.argv[1], stateRoot: config.stateRoot });
                 await launchd.install(daemonExecutable, config.stateRoot);
                 stdout(JSON.stringify(mode === "full"
-                    ? { configured: true, mode, runnerId: registered.runner.id, adapters, integrations, ...(guide ? { guide } : {}), daemonExecutable }
-                    : { configured: true, mode, runnerId: registered.runner.id, adapters: adapterDiagnosticsWithRemedies(detected), integrations, ...(guide ? { guide } : {}), daemonExecutable,
+                    ? { configured: true, mode, runnerId: registered.runner.id, adapters, integrations, ...(guide ? { guide } : {}), ...(workRoomPane ? { workRoomPane } : {}), daemonExecutable }
+                    : { configured: true, mode, runnerId: registered.runner.id, adapters: adapterDiagnosticsWithRemedies(detected), integrations, ...(guide ? { guide } : {}), ...(workRoomPane ? { workRoomPane } : {}), daemonExecutable,
                         action: "No executor is admitted on this Mac, so the runner is set up as a messenger: it delivers AI Gateway asks and opens sessions, and runs no jobs. Resolve the adapter diagnostics, then rerun setup to run jobs." }));
                 return 0;
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.80",
+  "version": "0.1.81",
   "private": false,
   "license": "UNLICENSED",
   "bin": {