mtech-ai-local-runner 0.1.86 → 0.1.88

package/dist/src/adapters/prompt-compiler.js

@@ -20,6 +20,75 @@ function record(value) {
         ? value
         : undefined;
 }
+/** References only: never project approval payloads, lease tokens or arbitrary authored instructions. */
+function continuationContext(taskPackage) {
+    let projectionTruncated = false;
+    const contract = record(taskPackage.contract) ?? {};
+    const workflow = record(contract.workflow_contract) ?? {};
+    const policy = record(contract.policy) ?? {};
+    const scalar = (value) => (typeof value === "string" && value.length <= 512)
+        || (typeof value === "number" && Number.isFinite(value)) || typeof value === "boolean";
+    const pick = (value, fields) => {
+        const source = record(value) ?? {};
+        return Object.fromEntries(fields.filter(key => scalar(source[key])).map(key => [key, source[key]]));
+    };
+    const items = (value) => {
+        if (!Array.isArray(value)) {
+            if (value !== undefined)
+                projectionTruncated = true;
+            return undefined;
+        }
+        if (value.length > 64)
+            projectionTruncated = true;
+        return value.slice(0, 64);
+    };
+    const strings = (value) => {
+        const source = items(value);
+        const result = source?.filter((item) => typeof item === "string" && item.length <= 512);
+        if (source && result?.length !== source.length)
+            projectionTruncated = true;
+        return result;
+    };
+    const execution = record(taskPackage.execution);
+    const coverage = record(taskPackage.coverage);
+    const limitKeys = ["max_turns", "max_runtime_seconds", "max_estimated_cost_usd", "max_correction_rounds",
+        "max_iterations", "max_model_input_tokens", "max_model_output_tokens", "max_total_tokens"];
+    const context = {
+        ...pick(contract.identity, ["work_item_id", "execution_actor_id", "environment"]),
+        contract: pick(contract, ["id", "content_fingerprint", "status"]),
+        delegation: pick(workflow, ["delegation_contract_id", "delegation_fingerprint", "delegation_revision", "acknowledgement_required"]),
+        selected_execution_units: strings(workflow.selected_execution_units),
+        allowed_execution_units: strings(workflow.allowed_execution_units),
+        blocked_execution_units: strings(workflow.blocked_execution_units),
+        policy: {
+            ...pick(policy, ["environment", "policy_key", ...limitKeys]),
+            limits: pick(policy.limits, limitKeys),
+            allowed_local_actions: strings(policy.allowed_local_actions),
+            approval_required_actions: strings(policy.approval_required_actions),
+            prohibited_actions: strings(policy.prohibited_actions),
+        },
+        agent_limits: pick(record(taskPackage.agent_execution)?.limits, limitKeys),
+        iteration: pick(taskPackage.iteration, ["id", "number", "lease_expires_at"]),
+        decision_references: (items(taskPackage.decisions) ?? []).map(decision => pick(decision, ["id", "decision_key", "revision_number", "content_fingerprint"])),
+        ...(execution ? { execution: pick(execution, ["mode", "runtime_adapter", "runtime_transport", "limits_mode"]) } : {}),
+        coverage: { ...pick(coverage, ["serialized_bytes", "max_bytes"]),
+            included_sections: strings(coverage?.included_sections),
+            omitted_sections: strings(coverage?.omitted_sections),
+            truncated_sections: strings(coverage?.truncated_sections) },
+        ...(projectionTruncated ? { reference_projection_truncated: true } : {}),
+    };
+    return "## Continuation references (snapshot, not new authority)\n" + JSON.stringify(context) + "\n"
+        + (projectionTruncated ? "Reference projection was truncated; absence is not permission. Stop affected work until the host resolves missing context. " : "")
+        + (execution?.limits_mode === "unbounded" ? "The host's effective limits mode remains authoritative; historical numeric caps do not override an explicitly admitted unbounded employee session. " : "")
+        + "Reuse valid same-scope authorization for bounded implementation, tests and corrections; do not ask again solely because an AI, session or skill changed. "
+        + "The host revalidates current authority; these decision references and contract snapshots are not approvals or proof of current validity. "
+        + "Missing or omitted decision context does not prove that there are no decisions. Do not fetch Gateway context or manage leases yourself; the Runner owns that work. "
+        + "Stop on changed, expired, revoked, consumed or actor-mismatched authority and server/app permission denial. "
+        + "Stop blocked execution units and units that depend on them; continue only independently allowed work inside the assigned scope. "
+        + "A new paid execution or correction attempt requires existing host admission, current contract, remaining attempts/budget and a valid lease; ordinary local retesting grants none of these. "
+        + "Do not replay a completed side effect. Never answer a human-only question or approve on another actor's behalf. "
+        + "Required review, completion and publication gates remain separate; report only observed work and evidence, not delivery or operational success inferred from a local result.";
+}
 export function compilePrompt(taskPackage, options) {
     const contract = record(taskPackage.contract);
     if (!contract) {
@@ -50,6 +119,7 @@ export function compilePrompt(taskPackage, options) {
     const requiredTests = requiredArray(brief.required_tests ?? [], "required_tests");
     const sections = [
         `# Bounded implementation brief: ${options.workItemLabel}`,
+        continuationContext(taskPackage),
         `## Objective\n${objective}`,
         `## Required changes\n${requiredChanges.map((item) => `- ${item}`).join("\n")}`,
         `## Invariants\n${invariants.map((item) => `- ${item}`).join("\n")}`,

package/dist/src/publication/candidate-limits.js

@@ -60,7 +60,8 @@ export function changedBytes(before, after) {
     return reject('CHANGE_MEASUREMENT_REJECTED');
 }
 export function candidatePayloadBytes(files, report) { return Buffer.byteLength(JSON.stringify({ files, ...(report === undefined ? {} : { validation_report: report }) }), 'utf8'); }
-export function measureSplitDelta(diff, limits, report) {
+/** withModes: the frozen scope lists file modes (design 2026-11-02), so each file carries the mode it keeps; delta_modes checks it. */
+export function measureSplitDelta(diff, limits, report, withModes = false) {
     const delta = JSON.parse(diff);
     if (delta?.format !== 'local-candidate-binary-diff-v1' || !Array.isArray(delta.changes) || !delta.changes.length || delta.changes.length > limits.max_changed_files)
         reject('FILE_COUNT_REJECTED');
@@ -78,7 +79,7 @@ export function measureSplitDelta(diff, limits, report) {
         changes += changedBytes(before, after);
         if (changes > limits.max_change_bytes)
             reject('CHANGE_LIMIT_REJECTED');
-        return { path: c.path, status: c.status, content_base64: c.status === 'deleted' ? null : after.toString('base64'), content_sha256: c.status === 'deleted' ? null : createHash('sha256').update(after).digest('hex') };
+        return { path: c.path, status: c.status, content_base64: c.status === 'deleted' ? null : after.toString('base64'), content_sha256: c.status === 'deleted' ? null : createHash('sha256').update(after).digest('hex'), ...(withModes ? { mode: c.status === 'deleted' ? null : c.after_mode === 0o100755 ? '100755' : '100644' } : {}) };
     });
     if (!changes)
         reject('CHANGE_MEASUREMENT_REJECTED');

package/dist/src/publication/server-ci-host.js

@@ -13,6 +13,8 @@ import { FilePublicationJournal } from './journal.js';
 import { GitSnapshotHost, SNAPSHOT_TREE_MAX_BYTES } from './git-snapshot.js';
 import { PublicationOutcomeUnknownError } from './publisher.js';
 import { isLocalFixAdapter } from './local-fix-adapters.js';
+/** Design 2026-11-02: a frozen scope listing exactly these lets an unchanged 100755 regular file keep its mode. */
+export const FILE_MODES = ['100644', '100755'];
 const denied = () => Error('LOCAL_FIX_SERVER_CI_REJECTED');
 /** Work Decision b3d7eb22: a failed Gateway publication call is repeated for at most this long; the coordinator heartbeat keeps the lease. */
 export const PUBLICATION_RETRY_WINDOW_MS = 900_000;
@@ -83,6 +85,10 @@ export function createServerCiLocalFixHost(options) {
             if (!lifecycle.isCurrent() || !isLocalFixAdapter(pkg.runtime_adapter) || !scope || scope.verification_mode !== mode || scope.ci_profile_fingerprint !== registration.ci_profile_fingerprint || protocolHash(scope.ci_profile) !== protocolHash(registration.ci_profile) || !Array.isArray(scope.required_commands) || scope.required_commands.length || !scope.registered_tests || typeof scope.registered_tests !== 'object' || Object.keys(scope.registered_tests).length || !Array.isArray(allowed) || !allowed.length || allowed.some(p => typeof p !== 'string' || !(safePath(p) || p.endsWith('/**') && safePath(p.slice(0, -3)))) || protocolHash(allowed) !== protocolHash(pkg.allowed_paths) || repo.key !== registration.project || job.gatewayTaskPackageFingerprint !== protocolHash(pkg) || Object.entries(registration.receipt).some(([k, v]) => scope[k] !== v) || root !== options.privateRoot || !st.isDirectory() || st.isSymbolicLink() || (st.mode & 0o077) !== 0 || (process.getuid && st.uid !== process.getuid()) || root === input.checkoutPath || root.startsWith(input.checkoutPath + path.sep))
                 throw denied();
             const limits = candidateLimits(rawLimits, mode === 'gateway_publish_v1');
+            // Without file_modes (an older Gateway or contract) only 100644 is published and no file carries a mode; any other list is refused.
+            const fileModes = scope.file_modes !== undefined;
+            if (fileModes && protocolHash(scope.file_modes) !== protocolHash(FILE_MODES))
+                throw denied();
             const fence = { jobId: job.id, generation: job.generation, leaseToken: job.leaseToken, launchGrant: job.launchGrant, bindingId: input.bindingId };
             const binding = bindingProof((await options.gateway.localPublicationContext(fence)).context);
             if (binding.runner_id !== options.runnerId || binding.binding_id !== input.bindingId || binding.job_id !== job.id || binding.generation !== job.generation || binding.work_loop_id !== job.workLoopId || binding.repository_key !== repo.key || binding.base_commit_sha !== repo.base_commit_sha || binding.working_branch !== repo.working_branch || binding.working_branch !== `ai-work/local/${binding.attempt_id}` || binding.attempt_id !== scope.attempt_id || binding.contract_fingerprint !== job.gatewayContractFingerprint || binding.task_package_fingerprint !== job.gatewayTaskPackageFingerprint || binding.launch_fingerprint !== job.launchFingerprint)
@@ -131,7 +137,7 @@ export function createServerCiLocalFixHost(options) {
                         let split;
                         if (limits.version === 2) {
                             try {
-                                split = measureSplitDelta(observed.diff, limits, report);
+                                split = measureSplitDelta(observed.diff, limits, report, fileModes);
                             }
                             catch (error) {
                                 const code = trustedCandidateLimitCode(error);
@@ -143,7 +149,10 @@ export function createServerCiLocalFixHost(options) {
                         if (!observed.changed_files.length || observed.changed_files.length > limits.max_changed_files)
                             throw publicationError(phase, 'LOCAL_FIX_FILE_COUNT_REJECTED');
                         // The v1 wire represents ordinary text bytes only. Refuse any change whose
-                        // executable/type metadata would be lost by the provider's regular-file write.
+                        // executable/type metadata would be lost by the provider's regular-file write:
+                        // a mode change, an executable added file, and every type but a regular file.
+                        // Under file_modes an unchanged 100755 file keeps its mode; the Gateway checks
+                        // that mode at the frozen base and reads it back before any PR.
                         phase = 'delta_format';
                         let delta;
                         try {
@@ -155,14 +164,16 @@ export function createServerCiLocalFixHost(options) {
                         if (!delta || delta.format !== 'local-candidate-binary-diff-v1' || !Array.isArray(delta.changes) || delta.changes.length !== observed.changed_files.length)
                             throw denied();
                         phase = 'delta_modes';
-                        const represented = [];
+                        const represented = [], modes = new Map();
+                        const kept = (m) => m === 0o100644 || fileModes && m === 0o100755;
                         for (const value of delta.changes) {
                             if (!value || typeof value !== 'object' || Array.isArray(value))
                                 throw denied();
                             const c = value;
-                            if (typeof c.path !== 'string' || !['added', 'modified', 'deleted'].includes(String(c.status)) || c.before_mode !== (c.status === 'added' ? null : 0o100644) || c.after_mode !== (c.status === 'deleted' ? null : 0o100644))
+                            if (typeof c.path !== 'string' || !['added', 'modified', 'deleted'].includes(String(c.status)) || (c.status === 'added' ? c.before_mode !== null || c.after_mode !== 0o100644 : c.status === 'deleted' ? !kept(c.before_mode) || c.after_mode !== null : !kept(c.before_mode) || c.after_mode !== c.before_mode))
                                 throw denied();
                             represented.push({ path: c.path, status: c.status });
+                            modes.set(c.path, c.status === 'deleted' ? null : c.after_mode === 0o100755 ? '100755' : '100644');
                         }
                         if (protocolHash(represented) !== protocolHash(observed.changed_files))
                             throw denied();
@@ -173,8 +184,9 @@ export function createServerCiLocalFixHost(options) {
                             phase = 'delta_scope';
                             if (!safePath(f.path) || testInfrastructure(f.path) || !allowed.some(s => matches(f.path, s)))
                                 throw denied();
+                            const modeField = fileModes ? { mode: modes.get(f.path) } : {};
                             if (f.status === 'deleted') {
-                                files.push({ ...f, content_base64: null, content_sha256: null });
+                                files.push({ ...f, content_base64: null, content_sha256: null, ...modeField });
                                 continue;
                             }
                             phase = 'candidate_files';
@@ -190,12 +202,14 @@ export function createServerCiLocalFixHost(options) {
                                 for (const s of [after, named])
                                     if (!s.isFile() || s.nlink !== 1n || s.dev !== before.dev || s.ino !== before.ino || s.size !== before.size || s.mtimeNs !== before.mtimeNs || s.ctimeNs !== before.ctimeNs || s.mode !== before.mode)
                                         throw denied();
+                                if (fileModes && ((before.mode & 73n) !== 0n) !== (modeField.mode === '100755'))
+                                    throw denied();
                                 bytes += content.length;
                                 if (limits.version !== 2 && bytes > limits.max_diff_bytes)
                                     throw publicationError(phase, 'LOCAL_FIX_DIFF_LIMIT_REJECTED');
                                 if (content.includes(0) || !Buffer.from(content.toString('utf8'), 'utf8').equals(content))
                                     throw publicationError(phase, 'LOCAL_FIX_FILE_ENCODING_REJECTED');
-                                files.push({ ...f, content_base64: content.toString('base64'), content_sha256: createHash('sha256').update(content).digest('hex') });
+                                files.push({ ...f, content_base64: content.toString('base64'), content_sha256: createHash('sha256').update(content).digest('hex'), ...modeField });
                             }
                             finally {
                                 await fd.close();

package/dist/src/safety/local-tool-policy.js

@@ -26,11 +26,48 @@ function scopePath(root, scope) {
         throw new Error('DENIED_UNSUPPORTED_SCOPE');
     return path.resolve(root, directory);
 }
+// A blocked pattern as an anchored matcher on the root-relative path: a leading "**/" is any leading folders, a
+// trailing "/**" everything below, "*" and "?" stay within one segment. Brackets and braces stay unsupported and
+// refuse every access.
+function blockedGlob(scope) {
+    if (/[\[\]{}]/.test(scope))
+        throw new Error('DENIED_UNSUPPORTED_SCOPE');
+    let pattern = '';
+    for (let i = 0; i < scope.length; i++) {
+        const rest = scope.slice(i);
+        if (rest.startsWith('**/')) {
+            pattern += '(?:.*/)?';
+            i += 2;
+        }
+        else if (rest === '/**') {
+            pattern += '(?:/.*)?';
+            i += 2;
+        }
+        else if (rest.startsWith('**')) {
+            pattern += '.*';
+            i += 1;
+        }
+        else if (scope[i] === '*')
+            pattern += '[^/]*';
+        else if (scope[i] === '?')
+            pattern += '[^/]';
+        else
+            pattern += scope[i].replace(/[.+^$()|\\]/g, '\\$&');
+    }
+    return new RegExp(`^${pattern}$`);
+}
 function exactBlockedScopeContains(root, scope, file) {
     // The compiled repository policy includes this private-file family. Handle
     // it only as a denial, never as a wildcard grant or an ignored block.
     if (scope === '.env.*')
         return file.startsWith(path.join(root, '.env.'));
+    // Registered blocks also use patterns such as **/*.keystore or **/.env*. Read only as a denial: a pattern can
+    // refuse more paths, never grant one, and allowed scopes keep the plain directory form of scopePath.
+    if (/[?*\[\]{}]/.test(scope.endsWith('/**') ? scope.slice(0, -3) : scope)) {
+        if (!contains(root, file))
+            return false;
+        return blockedGlob(scope).test(path.relative(root, file).split(path.sep).join('/'));
+    }
     return contains(scopePath(root, scope), file);
 }
 // APFS and HFS+ resolve names regardless of case and Unicode normalization, so app/secrets reaches a blocked

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.86",
+  "version": "0.1.88",
   "private": false,
   "license": "UNLICENSED",
   "bin": {