mtech-ai-local-runner 0.1.9 → 0.1.12

package/README.md

@@ -10,6 +10,13 @@ The package stores safe runner configuration locally and keeps OAuth refresh cre
 
 Public npm installation requires no npm account or publishing OTP. Setup requires Gateway OAuth login, and local Claude Code must already be authenticated (`claude auth status`).
 
+## 0.1.10: enforced PreToolUse hook
+
+Earlier releases configured a hook command that the shell could not run, so Claude
+Code ran tool calls without the hook policy. This release runs the hook through
+Node. Unless the packaged hook denies a `git push origin HEAD` probe, `setup` and
+the daemon stop and `doctor` reports `hook_not_enforcing`.
+
 ## 0.1.9: gated Codex foundation and shared CLI security
 
 This package includes the production Codex host/probe and common authenticated
@@ -117,3 +124,19 @@ These preparation controls end at binding and do not impose time, turn, token
 or cost termination limits on an approved unbounded employee-local Claude run.
 Existing generation fencing, scope restrictions, cancellation and audit remain
 in force.
+
+### Post-binding execution diagnostics (0.1.12)
+
+The manual command and daemon log an `execution_failed` diagnostic (the manual
+command uses `manual_execution_failed`) before attempting Gateway failure
+reporting. Failed events and completion results carry `execution_failure` with
+a fixed `stage` and `code`. Inner host-issued diagnostics survive outer catches;
+unknown errors use a generic code. Credential values, raw exceptions, causes,
+stacks, filesystem paths and provider stderr are not included. These diagnostics
+do not prove whether provider inference occurred. A Gateway reporting outage
+retains the local diagnostic and does not turn an unacknowledged terminal event
+into a completed job. Existing reconciliation rules still apply.
+
+### Manual Codex pilot (0.1.11)
+
+The reviewed manual Codex path preserves the existing CLI and ChatGPT login. It is separate from unattended daemon readiness. After the exact CLI/native reader and Gateway release are installed, an employee-authorized foreground pilot uses `mtec-ai-local-runner manual-codex --job-id=<approved Job UUID>`. It refuses a running daemon, unresolved recovery state, unknown release/account or a different Job. It does not stop services or alter personal settings. A direct administrator policy inventory occurs just before the approved execution; historical inventory is not continuous MDM monitoring. The Gateway OAuth client refuses refresh in this manual command. Actual vendor account startup may still refresh shared credentials and requires disclosure in the exact launch approval.

package/dist/src/adapters/claude-code/adapter.js

@@ -1,20 +1,16 @@
 import path from "node:path";
 import { requireSecurityRequirements } from '../../safety/security-requirements.js';
 import { createJobSecurityReceipt } from '../../safety/job-security-receipt.js';
-import { existsSync } from "node:fs";
 import { isTerminalEventType } from "../../protocol.js";
 import { parseClaudeLine } from "./stream-parser.js";
 import { compilePrompt } from "./prompt-compiler.js";
 import { completionEvent } from "./completion-report.js";
 import { requireJobSecurity } from "../../safety/job-security-policy.js";
-import { buildHookPolicy, encodeHookPolicy } from "../../safety/hook-policy-builder.js";
-import { HOOK_POLICY_ENV_VAR } from "../../safety/hook-cli.js";
+import { HOOK_POLICY_ENV_VAR, buildHookPolicy, encodeHookPolicy } from "../../safety/hook-policy-builder.js";
+import { formatHookCommand } from "../../safety/hook-command.js";
 const ALLOWED_ENV_KEYS = ["PATH", "HOME", "USER", "LOGNAME", "LANG", "LC_ALL", "TMPDIR", "NODE_ENV", "CLAUDE_CONFIG_DIR"];
 const ALLOWED_SUPERVISOR_COMMANDS = new Set(["continue", "answer_question", "request_revision", "request_checkpoint", "submit_for_review"]);
 const LOCAL_NAMES = ["local_read", "local_search", "local_edit", "local_test"].map(name => `mcp__ai_local__${name}`);
-function defaultPathExists(p) {
-    return existsSync(p);
-}
 function allowlistedEnv(env) {
     const result = {};
     for (const key of ALLOWED_ENV_KEYS) {
@@ -92,7 +88,7 @@ export class ClaudeCodeAdapter {
         if (!ctx.sessionId) {
             throw new Error("refusing to start: no runner-generated session ID was supplied");
         }
-        const hookPath = this.requireTrustedHookPath();
+        const hookCommand = this.requireTrustedHookCommand();
         const prompt = compilePrompt(ctx.taskPackage, { workItemLabel: this.options.workItemLabel });
         try {
             if (!this.options.createTools || !this.options.writeLocalMcpConfig)
@@ -115,7 +111,7 @@ export class ClaudeCodeAdapter {
             });
             const settings = {
                 hooks: {
-                    PreToolUse: [{ matcher: "*", hooks: [{ type: "command", command: hookPath, onFailure: "block" }] }],
+                    PreToolUse: [{ matcher: "*", hooks: [{ type: "command", command: hookCommand }] }],
                 },
             };
             const args = [
@@ -247,25 +243,12 @@ export class ClaudeCodeAdapter {
             }
         }
     }
-    requireTrustedHookPath() {
-        const hookPath = this.options.hookExecutablePath;
-        if (!hookPath || !path.isAbsolute(hookPath)) {
-            throw new Error("refusing to start: PreToolUse hook executable path must be an absolute path");
-        }
-        if (!/^[A-Za-z0-9._/:\\-]+$/.test(hookPath)) {
-            throw new Error("refusing to start: PreToolUse hook must use a safe executable path without shell metacharacters");
-        }
-        const worktreeRoot = path.resolve(this.options.worktreeRoot);
-        const rel = path.relative(worktreeRoot, path.resolve(hookPath));
-        const isInsideWorktree = rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel));
-        if (isInsideWorktree) {
-            throw new Error("refusing to start: PreToolUse hook executable must live outside the assigned worktree");
-        }
-        const exists = this.options.hookExecutableExists ?? defaultPathExists;
-        if (!exists(hookPath)) {
-            throw new Error("refusing to start: PreToolUse hook executable was not found at the trusted path");
-        }
-        return hookPath;
+    /** Claude Code treats a hook it cannot run as no objection, so the hook runs through Node. */
+    requireTrustedHookCommand() {
+        return formatHookCommand({
+            nodeExecutablePath: this.options.hookNodeExecutablePath ?? process.execPath,
+            hookScriptPath: this.options.hookExecutablePath,
+        }, { worktreeRoot: this.options.worktreeRoot, exists: this.options.hookExecutableExists });
     }
     requireHandle() {
         if (!this.handle) {

package/dist/src/adapters/claude-code/runtime-options.js

@@ -27,7 +27,7 @@ export function createClaudeCodeAdapterOptions(input) {
         throw new Error('Claude account configuration path must be absolute');
     return {
         processHost: new NodeProcessGroupHost(), worktreeRoot: checkout, jobId: input.jobId, securityPolicy: input.securityPolicy,
-        cwd, env, binaryPath: input.binaryPath, hookExecutablePath: input.hookExecutablePath,
+        cwd, env, binaryPath: input.binaryPath, hookExecutablePath: input.hookExecutablePath, hookNodeExecutablePath: input.hookNodeExecutablePath,
         maxBudgetUsd: input.maxBudgetUsd ?? 1, workItemLabel: input.workItemLabel ?? input.jobId,
         registeredReadTools: [], writeMcpConfig: () => { throw new Error('Gateway relay is not a model tool endpoint'); },
         createTools: async (ctx, pkg, approved) => {

package/dist/src/adapters/codex/account-sources.js

@@ -0,0 +1,113 @@
+import path from 'node:path';
+import { constants } from 'node:fs';
+import { lstat, open, readdir, realpath } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
+import { parse } from 'smol-toml';
+function denied() { throw new Error('CODEX_ACCOUNT_SOURCE_REJECTED'); }
+const digest = (value) => createHash('sha256').update(value).digest('hex');
+async function stat(file) { try {
+    return await lstat(file);
+}
+catch (e) {
+    if (e.code === 'ENOENT')
+        return null;
+    throw e;
+} }
+async function file(file) {
+    const s = await stat(file);
+    if (!s)
+        return null;
+    if (!s.isFile() || s.isSymbolicLink() || s.nlink !== 1 || s.size > 65_536)
+        denied();
+    const fd = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    try {
+        const actual = await fd.stat();
+        if (!actual.isFile() || actual.nlink !== 1 || actual.dev !== s.dev || actual.ino !== s.ino || actual.size > 65_536)
+            denied();
+        const bytes = Buffer.alloc(65_537);
+        let total = 0;
+        while (total < bytes.length) {
+            const { bytesRead } = await fd.read(bytes, total, bytes.length - total, total);
+            if (!bytesRead)
+                break;
+            total += bytesRead;
+        }
+        const after = await fd.stat(), named = await stat(file);
+        if (!named || !named.isFile() || named.isSymbolicLink() || named.nlink !== 1 || named.dev !== actual.dev || named.ino !== actual.ino
+            || after.nlink !== 1 || total > 65_536 || total !== actual.size || after.size !== actual.size || after.mtimeMs !== actual.mtimeMs || after.ctimeMs !== actual.ctimeMs)
+            denied();
+        return new TextDecoder('utf-8', { fatal: true }).decode(bytes.subarray(0, total));
+    }
+    finally {
+        await fd.close();
+    }
+}
+function preferences(text) {
+    const v = text === null ? {} : parse(text), result = {};
+    for (const [key, value] of Object.entries(v)) {
+        // Every accepted leaf is replaced by the trusted generated -c overrides.
+        // Tables (hooks/features/MCP/providers/profiles), unknown fields and backend
+        // selection are deliberately not ambient inputs, even when disabled/empty.
+        if (key === 'project_doc_max_bytes') {
+            if (typeof value !== 'number' || !Number.isSafeInteger(value) || value < 0)
+                denied();
+            result[key] = value;
+            continue;
+        }
+        if (!['model', 'model_provider', 'approval_policy', 'default_permissions', 'forced_login_method', 'web_search'].includes(key)
+            || typeof value !== 'string' || !value || value.length > 256 || /[\r\n\0]/.test(value))
+            denied();
+        if (key === 'model_provider' && value !== 'openai' || key === 'forced_login_method' && value !== 'chatgpt')
+            denied();
+        if (key === 'approval_policy' && !['never', 'on-request', 'untrusted', 'on-failure'].includes(value))
+            denied();
+        if (key === 'web_search' && !['disabled', 'cached', 'live'].includes(value))
+            denied();
+        result[key] = value;
+    }
+    return Object.freeze(Object.fromEntries(Object.entries(result).sort(([a], [b]) => a.localeCompare(b))));
+}
+export async function inspectCodexAccountSources(home, cwd, account = path.join(home, '.codex')) {
+    try {
+        if (![home, cwd, account].every(p => path.isAbsolute(p) && path.resolve(p) === p && !/[\r\n\0]/.test(p)))
+            denied();
+        const root = await stat(account);
+        if (root && (!root.isDirectory() || root.isSymbolicLink() || await realpath(account) !== account))
+            denied();
+        const blocked = ['/etc/codex/rules'];
+        let parent = cwd;
+        while (true) {
+            const candidate = path.join(parent, '.codex');
+            if (candidate !== account)
+                blocked.push(candidate);
+            const next = path.dirname(parent);
+            if (next === parent)
+                break;
+            parent = next;
+        }
+        for (const entry of blocked)
+            if (await stat(entry))
+                denied();
+        const configPath = path.join(account, 'config.toml'), raw = await file(configPath), userConfig = preferences(raw);
+        const instructions = await file(path.join(account, 'AGENTS.md'));
+        if (instructions !== null && instructions.trim() !== '')
+            denied();
+        const rulesPath = path.join(account, 'rules'), rules = await stat(rulesPath);
+        if (rules && (!rules.isDirectory() || rules.isSymbolicLink() || (await readdir(rulesPath)).length !== 0))
+            denied();
+        return Object.freeze({ version: 1, configPath, userConfig, fingerprint: digest(JSON.stringify({ account, config: raw === null ? null : digest(raw), instructions: instructions === null ? null : digest(instructions), rules: rules ? 'empty-directory' : null })) });
+    }
+    catch {
+        denied();
+    }
+}
+/** Retain one source snapshot; any later drift revokes preparation/turn startup. */
+export function codexAccountSourceGuard(home, cwd, account) {
+    let snapshot;
+    return async () => {
+        const current = await inspectCodexAccountSources(home, cwd, account);
+        if (snapshot && snapshot.fingerprint !== current.fingerprint)
+            denied();
+        return snapshot ??= (current);
+    };
+}

package/dist/src/adapters/codex/adapter.js

@@ -1,3 +1,5 @@
+import { executionError } from '../../safety/execution-failure.js';
+import { CodexExecLaunchHost } from './exec-launch-host.js';
 import { requireSecurityRequirements } from '../../safety/security-requirements.js';
 import { createJobSecurityReceipt } from '../../safety/job-security-receipt.js';
 import { requireJobSecurity } from '../../safety/job-security-policy.js';
@@ -16,8 +18,11 @@ export class CodexAdapter {
     tools;
     started = false;
     receipt;
-    securityReceipt() { return this.receipt ? structuredClone(this.receipt) : undefined; }
+    terminalAudit;
+    securityReceipt() { return this.terminalAudit ? structuredClone(this.terminalAudit) : this.usingOfficialExec ? this.ownedExec?.receipt() : this.receipt ? structuredClone(this.receipt) : undefined; }
     cancelled = false;
+    usingOfficialExec = false;
+    ownedExec;
     parser = new CodexStreamParser();
     startupAbort = new AbortController();
     securityPolicy;
@@ -31,9 +36,43 @@ export class CodexAdapter {
         if (!await this.options.verifyCompatibility())
             throw new Error(CODEX_UNSUPPORTED_DIAGNOSTIC);
         this.assertNotCancelled();
+        const approved = object(ctx.approvedTaskPackage);
+        const transport = approved.runtime_transport;
+        if (transport !== undefined && transport !== 'retained_app_server') {
+            if (transport !== 'official_exec_v1')
+                throw new Error('CODEX_EXEC_TRANSPORT_UNAVAILABLE');
+            const host = this.options.officialExec ?? await this.options.createOfficialExec?.(ctx, this.startupAbort.signal);
+            if (!(host instanceof CodexExecLaunchHost))
+                throw new Error('CODEX_EXEC_TRANSPORT_UNAVAILABLE');
+            if (this.cancelled) {
+                await this.options.closeOfficialExec?.();
+                throw new Error('CODEX_EXEC_PREFLIGHT_REJECTED');
+            }
+            try {
+                host.assertAvailableContext(ctx, this.options.jobId);
+            }
+            catch (error) {
+                throw executionError(error, 'codex_context', 'CODEX_EXEC_PREFLIGHT_REJECTED');
+            }
+            this.ownedExec = host;
+            this.usingOfficialExec = true;
+            let stage = 'codex_prompt';
+            try {
+                const prompt = compileCodexPrompt(object(ctx.taskPackage), this.options.jobId);
+                stage = 'codex_launch';
+                this.handle = await this.ownedExec.start(ctx, this.options.jobId, prompt, this.startupAbort.signal);
+                this.receipt = this.ownedExec.receipt();
+                this.assertNotCancelled();
+                return;
+            }
+            catch (error) {
+                const safe = executionError(error, stage, 'CODEX_EXEC_PREFLIGHT_REJECTED');
+                await this.cancel().catch(() => { });
+                throw safe;
+            }
+        }
         if (!this.options.startVerifiedSession)
             throw new Error("CODEX_PRE_MODEL_UNAVAILABLE");
-        const approved = object(ctx.approvedTaskPackage);
         const pkg = object(ctx.taskPackage);
         const execution = object(pkg.execution);
         const source = object(approved.repository);
@@ -122,6 +161,15 @@ export class CodexAdapter {
                 const events = this.parser.parse(line);
                 for (const event of events) {
                     if (["completed", "failed", "scope_conflict", "blocked"].includes(event.eventType)) {
+                        if (event.eventType === 'completed' && this.usingOfficialExec) {
+                            const audit = this.ownedExec?.receipt();
+                            if (!audit) {
+                                await this.cancel();
+                                yield { eventType: 'failed', summary: 'Codex completion lacked its validated security audit' };
+                                return;
+                            }
+                            this.terminalAudit = structuredClone(audit);
+                        }
                         await this.cancel();
                         yield event;
                         return;
@@ -139,6 +187,8 @@ export class CodexAdapter {
     async cancel() {
         this.cancelled = true;
         try {
+            if (this.usingOfficialExec)
+                await this.ownedExec?.cancel();
             this.options.revokeSecurity?.();
         }
         finally {
@@ -148,10 +198,16 @@ export class CodexAdapter {
             finally {
                 this.startupAbort.abort();
                 try {
-                    this.handle?.kill("SIGKILL");
+                    if (!this.usingOfficialExec)
+                        this.handle?.kill("SIGKILL");
                 }
                 finally {
-                    await this.tools?.close();
+                    try {
+                        await this.tools?.close();
+                    }
+                    finally {
+                        await this.options.closeOfficialExec?.();
+                    }
                 }
             }
         }

package/dist/src/adapters/codex/config-builder.js

@@ -32,7 +32,10 @@ export function buildCodexInvocation(input) {
     if (input.scratch)
         env.TMPDIR = input.scratch.tmpDir;
     return {
+        // The owned control cwd is deliberately outside Git. Runner separately verifies
+        // the approved source SHA and scope; this flag does not change permissions.
         args: ["--no-daemon", "exec", ...CODEX_ISOLATION_EXEC_FLAGS,
+            ...(input.sourceRoot && input.sourceRoot !== input.worktreeRoot ? ["--skip-git-repo-check"] : []),
             ...overrides.flatMap((setting) => ["-c", setting]),
             "--model", input.modelId, "-C", input.worktreeRoot, "--output-schema", input.schemaPath, "-"],
         env,

package/dist/src/adapters/codex/exec-invocation.js

@@ -0,0 +1,62 @@
+import { UNMANAGED_EXEC_MODE } from './unmanaged-scope.js';
+import path from 'node:path';
+import { CODEX_GLOBAL_INSTRUCTION_WRAPPER, globalInstructionProfile } from './global-instructions.js';
+import { randomBytes } from 'node:crypto';
+import { buildCodexInvocation } from './config-builder.js';
+import { securityRequirementsFingerprint as hash } from '../../safety/security-requirements.js';
+export const EXEC_TRANSPORT = 'official_exec_v1';
+export const EXEC_RELEASE_MODE = 'supported_cli_exec_release_policy_v2';
+export const EXEC_MODE = 'supported_cli_exec_policy_v1';
+export const isReleaseExecMode = (mode) => mode === EXEC_RELEASE_MODE || mode === UNMANAGED_EXEC_MODE;
+const plans = new WeakMap();
+const consumed = new WeakSet();
+const fail = () => new Error('CODEX_EXEC_PLAN_REJECTED');
+export function buildOfficialExecPlan(input) {
+    try {
+        const i = structuredClone(input.identity), inv = structuredClone(input.invocation);
+        if (input.policyMode !== undefined && !isReleaseExecMode(input.policyMode))
+            throw fail();
+        const keys = ['jobId', 'generation', 'actorId', 'runnerId', 'sourceSha', 'binarySha256', 'releaseManifestFingerprint', 'requirementsFingerprint', 'contractFingerprint', 'taskPackageFingerprint', 'launchFingerprint', 'commandsFingerprint', 'toolSchemaFingerprint', 'barrierFingerprint'];
+        if (JSON.stringify(Object.keys(i).sort()) !== JSON.stringify(keys.sort()) || !Number.isSafeInteger(i.generation) || i.generation < 1 || !/^[a-f0-9]{40}$/.test(i.sourceSha))
+            throw fail();
+        for (const [key, value] of Object.entries(i))
+            if (key !== 'generation' && (typeof value !== 'string' || !value || value.length > 256 || /[\r\n\0]/.test(value) || !['jobId', 'actorId', 'runnerId', 'sourceSha'].includes(key) && !/^[a-f0-9]{64}$/.test(value)))
+                throw fail();
+        if (!path.isAbsolute(input.binary) || /[\r\n\0]/.test(input.binary) || !['file', 'keyring', 'auto'].includes(input.credentialBackend) || !inv.scratch || !inv.sourceRoot)
+            throw fail();
+        const allowed = ['HOME', 'CODEX_HOME', 'PATH', 'USER', 'LOGNAME', 'LANG', 'LC_ALL', 'TMPDIR'];
+        if (Object.keys(inv.env).some(k => inv.env[k] !== undefined && (!allowed.includes(k) || typeof inv.env[k] !== 'string' || /[\r\n\0]/.test(inv.env[k]) || inv.env[k].length > 32768)) || inv.env.PATH?.split(path.delimiter).some(p => !path.isAbsolute(p)))
+            throw fail();
+        const cwd = path.resolve(inv.worktreeRoot), source = path.resolve(inv.sourceRoot);
+        if (cwd === source || cwd.startsWith(source + path.sep) || source.startsWith(cwd + path.sep))
+            throw fail();
+        const generated = buildCodexInvocation(inv), accountRoot = path.resolve(inv.env.CODEX_HOME ?? path.join(inv.env.HOME, '.codex'));
+        // Preserve the original backend explicitly; this is not proof of credentials.
+        generated.args.splice(generated.args.indexOf('--model'), 0, '-c', `cli_auth_credentials_store=${JSON.stringify(input.credentialBackend)}`);
+        const actual = isReleaseExecMode(input.policyMode) ? { binary: CODEX_GLOBAL_INSTRUCTION_WRAPPER, args: ['-p', globalInstructionProfile(accountRoot), input.binary, ...generated.args], env: generated.env } : { binary: input.binary, ...generated };
+        const executionNonce = randomBytes(32).toString('hex');
+        const plan = Object.freeze({ transport: EXEC_TRANSPORT, mode: input.policyMode ?? EXEC_MODE, executionNonce, identity: Object.freeze(i), modelId: inv.modelId, home: inv.env.HOME, accountRoot, credentialBackend: input.credentialBackend, binary: input.binary, cwd, endpoint: inv.endpoint.url, invocationFingerprint: hash({ ...actual }) });
+        plans.set(plan, structuredClone(actual));
+        return plan;
+    }
+    catch {
+        throw fail();
+    }
+}
+/** Opaque process-local plan; serializing a plan cannot recreate invocation authority. */
+export function requireOfficialExecPlan(plan) {
+    const p = plans.get(plan);
+    if (!p)
+        throw fail();
+    return structuredClone(p);
+}
+/** A plan authorizes one attempt across all host instances, including failed attempts. */
+export function claimOfficialExecPlan(plan) {
+    assertOfficialExecPlanAvailable(plan);
+    consumed.add(plan);
+}
+export function assertOfficialExecPlanAvailable(plan) {
+    requireOfficialExecPlan(plan);
+    if (consumed.has(plan))
+        throw fail();
+}

package/dist/src/adapters/codex/exec-launch-host.js

@@ -0,0 +1,215 @@
+import { executionError } from '../../safety/execution-failure.js';
+import { UNMANAGED_EXEC_MODE } from './unmanaged-scope.js';
+import { fingerprint as taskFingerprint } from '../../daemon/execution-coordinator.js';
+import { securityRequirementsFingerprint as hash } from '../../safety/security-requirements.js';
+import { ExecToolGate } from './exec-tool-gate.js';
+import { assessReleaseExec, requireReleaseDescriptor, releaseGates, EXEC_INPUT_GATES } from './exec-release-policy.js';
+import { officialExecObservationLimits } from './exec-observer.js';
+import { EXEC_GATES, assessExecPreflight, requireExecHandshake } from './exec-preflight.js';
+import { EXEC_MODE, isReleaseExecMode, EXEC_TRANSPORT, assertOfficialExecPlanAvailable, claimOfficialExecPlan, requireOfficialExecPlan } from './exec-invocation.js';
+const fail = () => new Error('CODEX_EXEC_PREFLIGHT_REJECTED');
+/** No default native inspector, handshake observer or OS process host is created.
+ * Missing per-execution evidence blocks before spawn. Synthetic callbacks grant
+ * only the fake host used by tests, never a compiled production release entry. */
+export class CodexExecLaunchHost {
+    plan;
+    deps;
+    used = false;
+    ownsAttempt = false;
+    stopped = false;
+    handle;
+    inspection;
+    exitAudit;
+    inspectionFingerprint;
+    handshake;
+    receiptValue;
+    abort = new AbortController();
+    closePromise;
+    constructor(plan, deps) {
+        this.plan = plan;
+        this.deps = deps;
+        requireOfficialExecPlan(plan);
+        this.deps = Object.freeze({ ...deps, processHost: Object.freeze({ spawn: deps.processHost.spawn.bind(deps.processHost) }) });
+    }
+    current() { if (this.stopped || this.abort.signal.aborted || this.inspection?.isCurrent() !== true || !(isReleaseExecMode(this.plan.mode) ? assessReleaseExec(this.inspection.snapshot, this.plan) : assessExecPreflight(this.inspection.snapshot, this.plan)).ready || hash(this.inspection.snapshot) !== this.inspectionFingerprint) {
+        if (this.plan.mode === UNMANAGED_EXEC_MODE)
+            void this.cancel().catch(() => { });
+        throw fail();
+    } }
+    assertContext(ctx, jobId) {
+        const a = ctx.approvedTaskPackage, r = a?.security_requirements, b = ctx.taskPackage, execution = b?.execution;
+        if (isReleaseExecMode(this.plan.mode)) {
+            if (!r)
+                throw fail();
+            requireReleaseDescriptor(r);
+            if (r.binary_sha256 !== this.plan.identity.binarySha256 || r.fixtures_sha256 !== this.plan.identity.barrierFingerprint || r.commands_sha256 !== this.plan.identity.commandsFingerprint || r.tools_sha256 !== this.plan.identity.toolSchemaFingerprint || !r.model_ids.includes(this.plan.modelId))
+                throw fail();
+        }
+        if (!a || !r || jobId !== this.plan.identity.jobId || ctx.generation !== this.plan.identity.generation || ctx.resumeSessionId || ctx.resolvedModelId !== this.plan.modelId || a.runtime_adapter !== 'codex_cli' || a.runtime_adapter_version !== '1' || a.runtime_transport !== EXEC_TRANSPORT || a.resolved_provider !== 'openai' || a.resolved_model_id !== this.plan.modelId || a.repository?.base_commit_sha !== this.plan.identity.sourceSha || a.contract_fingerprint !== this.plan.identity.contractFingerprint
+            || taskFingerprint(a) !== this.plan.identity.taskPackageFingerprint || ctx.securityBinding?.taskPackageFingerprint !== this.plan.identity.taskPackageFingerprint || ctx.securityBinding.contractFingerprint !== this.plan.identity.contractFingerprint || ctx.securityBinding.launchFingerprint !== this.plan.identity.launchFingerprint
+            || b?.repositories?.length !== 1 || b.repositories[0]?.base_commit_sha !== this.plan.identity.sourceSha
+            || execution?.runtime_transport !== EXEC_TRANSPORT || execution?.mode !== 'employee_ai_work_session' || execution.runtime_adapter !== 'codex_cli' || execution.limits_mode !== 'unbounded'
+            || r.version !== (this.plan.mode === UNMANAGED_EXEC_MODE ? 'cli-exec-security-requirements-v3' : isReleaseExecMode(this.plan.mode) ? 'cli-exec-security-requirements-v2' : 'cli-exec-security-requirements-v1') || r.security_mode !== this.plan.mode || r.transport !== EXEC_TRANSPORT || r.status !== 'verified' || r.adapter_id !== 'codex_cli' || r.adapter_version !== '1' || JSON.stringify(r.mandatory_gates) !== JSON.stringify(isReleaseExecMode(this.plan.mode) ? [...releaseGates(this.plan.mode), ...EXEC_INPUT_GATES, 'authenticated_mcp_discovery'] : EXEC_GATES) || r.release_manifest_sha256 !== this.plan.identity.releaseManifestFingerprint || r.fingerprint !== this.plan.identity.requirementsFingerprint || hash(r) !== r.fingerprint)
+            throw fail();
+    }
+    assertAvailableContext(ctx, jobId) { if (this.used || this.stopped)
+        throw fail(); this.assertContext(ctx, jobId); assertOfficialExecPlanAvailable(this.plan); if (isReleaseExecMode(this.plan.mode) && (!(this.deps.execTools instanceof ExecToolGate) || !this.deps.execTools.matches(this.plan)))
+        throw fail(); }
+    async start(ctx, jobId, prompt, signal) {
+        if (this.used || this.stopped)
+            throw fail();
+        this.assertAvailableContext(ctx, jobId);
+        claimOfficialExecPlan(this.plan);
+        this.ownsAttempt = true;
+        this.used = true;
+        let stage = 'codex_context';
+        let timer, external;
+        try {
+            this.assertContext(ctx, jobId);
+            requireOfficialExecPlan(this.plan);
+            if (typeof prompt !== 'string' || !prompt || prompt.length > 1_000_000 || signal?.aborted)
+                throw fail();
+            const stopped = new Promise((_, reject) => { external = () => { void this.cancel().catch(() => { }); reject(fail()); }; this.abort.signal.addEventListener('abort', () => reject(fail()), { once: true }); signal?.addEventListener('abort', external, { once: true }); timer = setTimeout(external, 30_000); });
+            const preparation = (async () => {
+                const supported = isReleaseExecMode(this.plan.mode);
+                stage = 'codex_inspection';
+                this.inspection = await (supported ? this.deps.inspectRelease?.(this.plan, this.abort.signal) : this.deps.inspect?.(this.plan, this.abort.signal));
+                const assessment = supported ? assessReleaseExec(this.inspection?.snapshot, this.plan) : assessExecPreflight(this.inspection?.snapshot, this.plan);
+                if (!supported && !this.deps.inspect)
+                    assessment.reasonCodes.push(...officialExecObservationLimits());
+                this.deps.onAssessment?.(structuredClone(assessment));
+                if (!assessment.ready || !supported && typeof this.deps.handshake !== 'function')
+                    throw fail();
+                this.inspectionFingerprint = hash(this.inspection.snapshot);
+                this.current();
+                const invocation = requireOfficialExecPlan(this.plan);
+                const manual = ctx.approvedTaskPackage?.security_requirements?.mdm_verification === 'manual_prelaunch';
+                if (manual && typeof this.inspection.beforeSpawn !== 'function')
+                    throw fail();
+                this.inspection.beforeSpawn?.();
+                stage = 'codex_spawn';
+                const h = this.deps.processHost.spawn(invocation.binary, invocation.args, { cwd: this.plan.cwd, env: invocation.env });
+                this.handle = h;
+                if (this.stopped) {
+                    h.kill('SIGKILL');
+                    throw fail();
+                }
+                h.once('exit', (code, signal) => {
+                    // Preserve audit only for a clean owned exit that was still authorized.
+                    // This immutable record never restores tool or spawn authority.
+                    if (code === 0 && signal === null && !this.stopped && this.receiptValue) {
+                        try {
+                            this.current();
+                            this.exitAudit = structuredClone(this.receiptValue);
+                        }
+                        catch { }
+                    }
+                    void this.cancel().catch(() => { });
+                });
+                this.current();
+                if (supported) {
+                    const gate = this.deps.execTools;
+                    gate.bind(h, () => { try {
+                        this.current();
+                        return true;
+                    }
+                    catch {
+                        return false;
+                    } });
+                    // Vendor exec consumes stdin before it can initialize its required MCP.
+                    // Prompt submission may cause provider/account effects; do not call this no-model.
+                    h.stdin.write(prompt);
+                    this.current();
+                    h.stdin.end();
+                    this.current();
+                    gate.promptSubmitted(h);
+                    stage = 'codex_mcp';
+                    const observed = await gate.wait(h, this.abort.signal);
+                    this.current();
+                    requireExecHandshake(observed, h, this.plan);
+                    gate.authorize(h);
+                    this.current();
+                    requireExecHandshake(observed, h, this.plan);
+                    this.receiptValue = Object.freeze({ receipt_version: this.plan.mode === UNMANAGED_EXEC_MODE ? 'cli-exec-job-security-receipt-v3' : 'cli-exec-job-security-receipt-v2', evidence_origin: 'employee_runner', transport: EXEC_TRANSPORT, security_mode: this.plan.mode, ...(this.plan.mode === UNMANAGED_EXEC_MODE ? { policy_scope: this.inspection.snapshot.policyScope } : {}), phase: 'post_prompt_mcp_authorized', policy_evidence: 'reviewed_release_and_current_inputs', mcp_evidence: 'authenticated_server_discovery', native_policy_observed: false, first_inference_observed: false, execution_nonce: this.plan.executionNonce, invocation_fingerprint: this.plan.invocationFingerprint, ...this.plan.identity });
+                    return h;
+                }
+                const handshake = await this.deps.handshake?.(h, this.plan, this.abort.signal);
+                this.current();
+                requireExecHandshake(handshake, h, this.plan);
+                this.handshake = handshake;
+                // An input hash is not a native effective-config certificate. Preserve the
+                // evidence origin in the audit receipt and never reuse AppServer authority.
+                const receipt = Object.freeze({ receipt_version: 'cli-exec-job-security-receipt-v1', evidence_origin: 'employee_runner', transport: EXEC_TRANSPORT, security_mode: EXEC_MODE, phase: 'exec_pre_prompt', execution_nonce: this.plan.executionNonce, invocation_fingerprint: this.plan.invocationFingerprint, ...this.plan.identity });
+                this.current();
+                requireExecHandshake(handshake, h, this.plan);
+                h.stdin.write(prompt);
+                this.current();
+                h.stdin.end();
+                this.current();
+                requireExecHandshake(handshake, h, this.plan);
+                this.receiptValue = receipt;
+                return h;
+            })();
+            return await Promise.race([preparation, stopped]);
+        }
+        catch (error) {
+            const safe = executionError(error, stage, 'CODEX_EXEC_PREFLIGHT_REJECTED');
+            await this.cancel().catch(() => { });
+            throw safe;
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+            if (external)
+                signal?.removeEventListener('abort', external);
+        }
+    }
+    receipt() { if (this.exitAudit)
+        return structuredClone(this.exitAudit); if (!this.receiptValue)
+        return undefined; try {
+        if (this.plan.mode === UNMANAGED_EXEC_MODE)
+            this.current();
+        return this.receiptValue ? structuredClone(this.receiptValue) : undefined;
+    }
+    catch {
+        return undefined;
+    } }
+    cancel() {
+        if (this.closePromise)
+            return this.closePromise;
+        this.stopped = true;
+        this.receiptValue = undefined;
+        if (!this.ownsAttempt) {
+            this.closePromise = Promise.resolve();
+            return this.closePromise;
+        }
+        let finish, reject;
+        this.closePromise = new Promise((resolve, rejectPromise) => { finish = resolve; reject = rejectPromise; });
+        let cleanupError = false;
+        // Publish closePromise first: synchronous exit/cancel cannot recurse or skip cleanup.
+        try {
+            this.deps.execTools?.revoke();
+        }
+        catch {
+            cleanupError = true;
+        }
+        try {
+            this.deps.revokeTools();
+        }
+        catch {
+            cleanupError = true;
+        }
+        this.abort.abort();
+        try {
+            this.handle?.kill('SIGKILL');
+        }
+        catch {
+            cleanupError = true;
+        }
+        Promise.resolve().then(() => this.deps.closeTools()).then(() => { if (cleanupError)
+            reject(new Error('CODEX_EXEC_CLEANUP_UNCONFIRMED'));
+        else
+            finish(); }, () => reject(new Error('CODEX_EXEC_CLEANUP_UNCONFIRMED')));
+        return this.closePromise;
+    }
+}