mtech-ai-local-runner 0.1.86 → 0.1.87

package/dist/src/adapters/prompt-compiler.js

@@ -20,6 +20,75 @@ function record(value) {
         ? value
         : undefined;
 }
+/** References only: never project approval payloads, lease tokens or arbitrary authored instructions. */
+function continuationContext(taskPackage) {
+    let projectionTruncated = false;
+    const contract = record(taskPackage.contract) ?? {};
+    const workflow = record(contract.workflow_contract) ?? {};
+    const policy = record(contract.policy) ?? {};
+    const scalar = (value) => (typeof value === "string" && value.length <= 512)
+        || (typeof value === "number" && Number.isFinite(value)) || typeof value === "boolean";
+    const pick = (value, fields) => {
+        const source = record(value) ?? {};
+        return Object.fromEntries(fields.filter(key => scalar(source[key])).map(key => [key, source[key]]));
+    };
+    const items = (value) => {
+        if (!Array.isArray(value)) {
+            if (value !== undefined)
+                projectionTruncated = true;
+            return undefined;
+        }
+        if (value.length > 64)
+            projectionTruncated = true;
+        return value.slice(0, 64);
+    };
+    const strings = (value) => {
+        const source = items(value);
+        const result = source?.filter((item) => typeof item === "string" && item.length <= 512);
+        if (source && result?.length !== source.length)
+            projectionTruncated = true;
+        return result;
+    };
+    const execution = record(taskPackage.execution);
+    const coverage = record(taskPackage.coverage);
+    const limitKeys = ["max_turns", "max_runtime_seconds", "max_estimated_cost_usd", "max_correction_rounds",
+        "max_iterations", "max_model_input_tokens", "max_model_output_tokens", "max_total_tokens"];
+    const context = {
+        ...pick(contract.identity, ["work_item_id", "execution_actor_id", "environment"]),
+        contract: pick(contract, ["id", "content_fingerprint", "status"]),
+        delegation: pick(workflow, ["delegation_contract_id", "delegation_fingerprint", "delegation_revision", "acknowledgement_required"]),
+        selected_execution_units: strings(workflow.selected_execution_units),
+        allowed_execution_units: strings(workflow.allowed_execution_units),
+        blocked_execution_units: strings(workflow.blocked_execution_units),
+        policy: {
+            ...pick(policy, ["environment", "policy_key", ...limitKeys]),
+            limits: pick(policy.limits, limitKeys),
+            allowed_local_actions: strings(policy.allowed_local_actions),
+            approval_required_actions: strings(policy.approval_required_actions),
+            prohibited_actions: strings(policy.prohibited_actions),
+        },
+        agent_limits: pick(record(taskPackage.agent_execution)?.limits, limitKeys),
+        iteration: pick(taskPackage.iteration, ["id", "number", "lease_expires_at"]),
+        decision_references: (items(taskPackage.decisions) ?? []).map(decision => pick(decision, ["id", "decision_key", "revision_number", "content_fingerprint"])),
+        ...(execution ? { execution: pick(execution, ["mode", "runtime_adapter", "runtime_transport", "limits_mode"]) } : {}),
+        coverage: { ...pick(coverage, ["serialized_bytes", "max_bytes"]),
+            included_sections: strings(coverage?.included_sections),
+            omitted_sections: strings(coverage?.omitted_sections),
+            truncated_sections: strings(coverage?.truncated_sections) },
+        ...(projectionTruncated ? { reference_projection_truncated: true } : {}),
+    };
+    return "## Continuation references (snapshot, not new authority)\n" + JSON.stringify(context) + "\n"
+        + (projectionTruncated ? "Reference projection was truncated; absence is not permission. Stop affected work until the host resolves missing context. " : "")
+        + (execution?.limits_mode === "unbounded" ? "The host's effective limits mode remains authoritative; historical numeric caps do not override an explicitly admitted unbounded employee session. " : "")
+        + "Reuse valid same-scope authorization for bounded implementation, tests and corrections; do not ask again solely because an AI, session or skill changed. "
+        + "The host revalidates current authority; these decision references and contract snapshots are not approvals or proof of current validity. "
+        + "Missing or omitted decision context does not prove that there are no decisions. Do not fetch Gateway context or manage leases yourself; the Runner owns that work. "
+        + "Stop on changed, expired, revoked, consumed or actor-mismatched authority and server/app permission denial. "
+        + "Stop blocked execution units and units that depend on them; continue only independently allowed work inside the assigned scope. "
+        + "A new paid execution or correction attempt requires existing host admission, current contract, remaining attempts/budget and a valid lease; ordinary local retesting grants none of these. "
+        + "Do not replay a completed side effect. Never answer a human-only question or approve on another actor's behalf. "
+        + "Required review, completion and publication gates remain separate; report only observed work and evidence, not delivery or operational success inferred from a local result.";
+}
 export function compilePrompt(taskPackage, options) {
     const contract = record(taskPackage.contract);
     if (!contract) {
@@ -50,6 +119,7 @@ export function compilePrompt(taskPackage, options) {
     const requiredTests = requiredArray(brief.required_tests ?? [], "required_tests");
     const sections = [
         `# Bounded implementation brief: ${options.workItemLabel}`,
+        continuationContext(taskPackage),
         `## Objective\n${objective}`,
         `## Required changes\n${requiredChanges.map((item) => `- ${item}`).join("\n")}`,
         `## Invariants\n${invariants.map((item) => `- ${item}`).join("\n")}`,

package/dist/src/safety/local-tool-policy.js

@@ -26,11 +26,48 @@ function scopePath(root, scope) {
         throw new Error('DENIED_UNSUPPORTED_SCOPE');
     return path.resolve(root, directory);
 }
+// A blocked pattern as an anchored matcher on the root-relative path: a leading "**/" is any leading folders, a
+// trailing "/**" everything below, "*" and "?" stay within one segment. Brackets and braces stay unsupported and
+// refuse every access.
+function blockedGlob(scope) {
+    if (/[\[\]{}]/.test(scope))
+        throw new Error('DENIED_UNSUPPORTED_SCOPE');
+    let pattern = '';
+    for (let i = 0; i < scope.length; i++) {
+        const rest = scope.slice(i);
+        if (rest.startsWith('**/')) {
+            pattern += '(?:.*/)?';
+            i += 2;
+        }
+        else if (rest === '/**') {
+            pattern += '(?:/.*)?';
+            i += 2;
+        }
+        else if (rest.startsWith('**')) {
+            pattern += '.*';
+            i += 1;
+        }
+        else if (scope[i] === '*')
+            pattern += '[^/]*';
+        else if (scope[i] === '?')
+            pattern += '[^/]';
+        else
+            pattern += scope[i].replace(/[.+^$()|\\]/g, '\\$&');
+    }
+    return new RegExp(`^${pattern}$`);
+}
 function exactBlockedScopeContains(root, scope, file) {
     // The compiled repository policy includes this private-file family. Handle
     // it only as a denial, never as a wildcard grant or an ignored block.
     if (scope === '.env.*')
         return file.startsWith(path.join(root, '.env.'));
+    // Registered blocks also use patterns such as **/*.keystore or **/.env*. Read only as a denial: a pattern can
+    // refuse more paths, never grant one, and allowed scopes keep the plain directory form of scopePath.
+    if (/[?*\[\]{}]/.test(scope.endsWith('/**') ? scope.slice(0, -3) : scope)) {
+        if (!contains(root, file))
+            return false;
+        return blockedGlob(scope).test(path.relative(root, file).split(path.sep).join('/'));
+    }
     return contains(scopePath(root, scope), file);
 }
 // APFS and HFS+ resolve names regardless of case and Unicode normalization, so app/secrets reaches a blocked

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.86",
+  "version": "0.1.87",
   "private": false,
   "license": "UNLICENSED",
   "bin": {