mtech-ai-local-runner 0.1.9 → 0.1.12

package/dist/src/adapters/codex/exec-observer.js

@@ -0,0 +1,83 @@
+/** Official exec JSONL exposes no native same-execution effective/managed policy
+ * inspection. stdin is consumed before startup; waiting for child discovery
+ * before submitting stdin cannot be used as an inference authorization barrier.
+ * Fixed limits, not user/task-provided release claims. */
+export function officialExecObservationLimits() {
+    return [
+        'EXEC_EFFECTIVE_POLICY_OBSERVATION_UNAVAILABLE',
+        'EXEC_MANAGED_POLICY_OBSERVATION_UNAVAILABLE',
+        'EXEC_REQUIRED_MCP_INFERENCE_BARRIER_UNVERIFIED',
+        'EXEC_STDIN_REQUIRED_BEFORE_STARTUP',
+    ];
+}
+/** Raw wire diagnostics. Attach discovery only to this launch's authenticated
+ * server; do not call from task JSON/stdout. Possession of the endpoint token is
+ * not OS process identity or proof of when native inference begins.
+ * No permit, LiveExecInspection or ExecHandshake is produced by this observer. */
+export class ExecWireObserver {
+    stage = 'unobserved';
+    thread = false;
+    reasons = new Set();
+    discovery = (event) => {
+        if (this.stage === 'revoked')
+            return;
+        if (event === 'revoked') {
+            this.stage = 'revoked';
+            return;
+        }
+        if (event === 'initialize_response' && this.stage === 'unobserved') {
+            this.stage = 'initialized';
+            return;
+        }
+        if (event === 'initialized_notification' && this.stage === 'initialized') {
+            this.stage = 'notified';
+            return;
+        }
+        if (event === 'inventory_response' && (this.stage === 'notified' || this.stage === 'observed')) {
+            this.stage = 'observed';
+            return;
+        }
+        this.stage = 'invalid';
+        this.reasons.add('EXEC_MCP_DISCOVERY_SEQUENCE_INVALID');
+    };
+    line(line) {
+        // Deliberately keep no raw payload, thread ID, path, stderr or provider usage.
+        try {
+            if (typeof line !== 'string' || Buffer.byteLength(line) > 256_000)
+                throw Error();
+            const e = JSON.parse(line);
+            if (!e || typeof e !== 'object' || Array.isArray(e) || typeof e.type !== 'string')
+                throw Error();
+            const event = e;
+            if (event.type === 'thread.started') {
+                if (Object.keys(event).length !== 2 || typeof event.thread_id !== 'string' || !event.thread_id || event.thread_id.length > 256)
+                    throw Error();
+                this.thread = true;
+                return;
+            }
+            if (event.type === 'error' || event.type === 'turn.failed') {
+                this.reasons.add('EXEC_CHILD_FAILURE');
+                return;
+            }
+            if (['turn.started', 'turn.completed', 'item.started', 'item.updated', 'item.completed'].includes(event.type)) {
+                // These events occur after prompt submission; never elevate them to proof.
+                this.reasons.add('EXEC_POST_PROMPT_EVENT_OBSERVED');
+                return;
+            }
+            this.reasons.add('EXEC_UNSUPPORTED_WIRE_EVENT');
+        }
+        catch {
+            this.reasons.add('EXEC_INVALID_WIRE_EVENT');
+        }
+    }
+    report() {
+        return {
+            executionReady: false,
+            effectivePolicy: 'unverified', managedPolicy: 'unverified',
+            requiredMcpInferenceBarrier: 'unverified',
+            mcpDiscovery: this.stage === 'observed' ? 'observed' : this.stage === 'revoked' ? 'revoked' : 'unobserved',
+            threadObserved: this.thread,
+            reasonCodes: [...officialExecObservationLimits(), ...this.reasons],
+        };
+    }
+}

package/dist/src/adapters/codex/exec-preflight.js

@@ -0,0 +1,41 @@
+import { isDeepStrictEqual } from 'node:util';
+import { SUPPORTED_CLI_GATES } from '../../safety/cli-security-modes.js';
+import { localToolInventory } from '../../safety/local-tool-server.js';
+import { EXEC_TRANSPORT, requireOfficialExecPlan } from './exec-invocation.js';
+export const EXEC_GATES = Object.freeze([...SUPPORTED_CLI_GATES, 'effective_policy_observation', 'managed_policy_observation', 'required_mcp_inference_barrier']);
+const object = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
+const exact = (v, keys) => isDeepStrictEqual(Reflect.ownKeys(v).sort(), keys.sort());
+const sha = (v) => typeof v === 'string' && /^[a-f0-9]{64}$/.test(v);
+/** Diagnostics only. Even a ready assessment is not a policy or spawn permit. */
+export function assessExecPreflight(value, plan) {
+    const reasonCodes = [];
+    const need = (ok, code) => { if (!ok)
+        reasonCodes.push(code); };
+    try {
+        requireOfficialExecPlan(plan);
+        if (!object(value))
+            return { ready: false, reasonCodes: ['EXEC_OBSERVATION_UNAVAILABLE', ...EXEC_GATES.map(g => 'EXEC_' + g.toUpperCase() + '_UNVERIFIED'), 'EXEC_EFFECTIVE_POLICY_UNVERIFIED', 'EXEC_MANAGED_POLICY_UNVERIFIED', 'EXEC_MCP_BARRIER_UNVERIFIED'] };
+        need(exact(value, ['version', 'transport', 'executionNonce', 'identity', 'invocationFingerprint', 'checks', 'effectivePolicy', 'managedPolicy', 'mcpPolicy', 'warnings']), 'EXEC_EVIDENCE_SHAPE');
+        need(value.version === 'cli-exec-security-evidence-v1' && value.transport === EXEC_TRANSPORT, 'EXEC_EVIDENCE_VERSION');
+        need(value.executionNonce === plan.executionNonce && value.invocationFingerprint === plan.invocationFingerprint && isDeepStrictEqual(value.identity, plan.identity), 'EXEC_IDENTITY_MISMATCH');
+        need(Array.isArray(value.warnings) && value.warnings.length === 0, 'EXEC_WARNING');
+        const checks = Array.isArray(value.checks) ? value.checks : [];
+        need(checks.length === EXEC_GATES.length && new Set(checks.map(c => object(c) ? c.gate : null)).size === EXEC_GATES.length && checks.every(c => object(c) && exact(c, ['gate', 'status', 'basis']) && EXEC_GATES.includes(c.gate)), 'EXEC_CHECK_SET');
+        for (const gate of EXEC_GATES)
+            need(checks.filter(c => object(c) && c.gate === gate && c.status === 'verified' && c.basis === 'current_execution').length === 1, 'EXEC_' + gate.toUpperCase() + '_UNVERIFIED');
+        const p = object(value.effectivePolicy) ? value.effectivePolicy : {};
+        need(exact(p, ['source', 'executionNonce', 'modelId', 'provider', 'cwd', 'approvalPolicy', 'permissionProfile', 'nativeNetwork', 'fingerprint']) && p.source === 'owned_exec_pre_model_observation' && p.executionNonce === plan.executionNonce && p.modelId === plan.modelId && p.provider === 'openai' && p.cwd === plan.cwd && p.approvalPolicy === 'never' && p.permissionProfile === 'local_job' && p.nativeNetwork === false && sha(p.fingerprint), 'EXEC_EFFECTIVE_POLICY_UNVERIFIED');
+        const m = object(value.managedPolicy) ? value.managedPolicy : {};
+        need(exact(m, ['source', 'executionNonce', 'decision', 'fingerprint', 'sourcesFingerprint']) && m.source === 'owned_exec_pre_model_observation' && m.executionNonce === plan.executionNonce && m.decision === 'compatible' && sha(m.fingerprint) && sha(m.sourcesFingerprint), 'EXEC_MANAGED_POLICY_UNVERIFIED');
+        const b = object(value.mcpPolicy) ? value.mcpPolicy : {};
+        need(exact(b, ['source', 'executionNonce', 'endpoint', 'toolSchemaFingerprint', 'required', 'startupFailurePreventsInference', 'barrierFingerprint']) && b.source === 'owned_exec_native_barrier' && b.executionNonce === plan.executionNonce && b.endpoint === plan.endpoint && b.toolSchemaFingerprint === plan.identity.toolSchemaFingerprint && b.required === true && b.startupFailurePreventsInference === true && b.barrierFingerprint === plan.identity.barrierFingerprint, 'EXEC_MCP_BARRIER_UNVERIFIED');
+    }
+    catch {
+        reasonCodes.push('EXEC_OBSERVATION_UNAVAILABLE');
+    }
+    return { ready: reasonCodes.length === 0, reasonCodes };
+}
+export function requireExecHandshake(h, process, plan) {
+    if (!object(h) || h.process !== process || h.executionNonce !== plan.executionNonce || h.endpoint !== plan.endpoint || h.authenticated !== true || h.ready !== true || h.toolSchemaFingerprint !== plan.identity.toolSchemaFingerprint || !isDeepStrictEqual(h.tools, localToolInventory().map(t => t.name)) || typeof h.isCurrent !== 'function' || h.isCurrent() !== true)
+        throw Error('CODEX_EXEC_MCP_REJECTED');
+}

package/dist/src/adapters/codex/exec-release-policy.js

@@ -0,0 +1,44 @@
+import { MANUAL_MDM_RISK } from './manual-policy-scope.js';
+import { UNMANAGED_EXEC_MODE, UNMANAGED_SCOPE, requirePolicyScope } from './unmanaged-scope.js';
+import { isDeepStrictEqual } from 'node:util';
+import { isReleaseExecMode, EXEC_TRANSPORT, requireOfficialExecPlan } from './exec-invocation.js';
+export const EXEC_RELEASE_GATES = Object.freeze(['binary_release', 'official_permissions', 'managed_policy_enforcement', 'required_mcp_startup', 'source_exclusion', 'auth_backend_compatibility']);
+export const EXEC_INPUT_GATES = Object.freeze(['exact_inputs', 'launch_binding', 'repository_scope', 'private_paths_environment', 'owned_lifecycle']);
+export const EXEC_RELEASE_RISKS = Object.freeze(['vendor_native_policy_enforcement', 'managed_policy_not_directly_observed_per_job', 'first_inference_order_not_observed_per_job', 'job_mcp_token_possession_not_os_identity', 'account_startup_may_refresh_shared_credentials']);
+export const releaseGates = (mode) => mode === UNMANAGED_EXEC_MODE ? EXEC_RELEASE_GATES.map(g => g === 'managed_policy_enforcement' ? 'managed_scope_exclusion' : g) : EXEC_RELEASE_GATES;
+export const releaseRisks = (mode, mdmVerification) => mode === UNMANAGED_EXEC_MODE ? [...EXEC_RELEASE_RISKS, 'concurrent_policy_change_not_atomic', 'local_account_metadata_not_remote_entitlement', ...(mdmVerification === 'manual_prelaunch' ? [MANUAL_MDM_RISK] : [])] : EXEC_RELEASE_RISKS;
+const record = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
+const exact = (v, keys) => isDeepStrictEqual(Object.keys(v).sort(), keys.sort());
+const checks = (v, gates, basis) => Array.isArray(v) && v.length === gates.length && gates.every(g => v.filter(c => record(c) && exact(c, ['gate', 'status', 'basis']) && c.gate === g && c.status === 'verified' && c.basis === basis).length === 1);
+export function requireReleaseDescriptor(r) {
+    const v3 = r.security_mode === UNMANAGED_EXEC_MODE;
+    if (!['release_manifest_sha256', 'binary_sha256', 'fixtures_sha256', 'commands_sha256', 'tools_sha256', 'fingerprint'].every(k => typeof r[k] === 'string' && /^[a-f0-9]{64}$/.test(r[k])) || !Array.isArray(r.model_ids) || !r.model_ids.length || new Set(r.model_ids).size !== r.model_ids.length || r.model_ids.some(m => typeof m !== 'string' || !m || m.length > 255 || /[\r\n\0]/.test(m)) || !exact(r, ['version', 'security_mode', 'transport', 'status', 'adapter_id', 'adapter_version', 'mandatory_gates', 'accepted_residual_risks', 'evidence_class', 'release_manifest_sha256', 'binary_sha256', 'fixtures_sha256', 'commands_sha256', 'tools_sha256', 'model_ids', 'fingerprint', ...(v3 ? ['policy_scope', 'managed_enforcement', ...(r.mdm_verification === undefined ? [] : ['mdm_verification'])] : [])]) || r.version !== (v3 ? 'cli-exec-security-requirements-v3' : 'cli-exec-security-requirements-v2') || !isReleaseExecMode(r.security_mode) || v3 && (r.policy_scope !== UNMANAGED_SCOPE || r.managed_enforcement !== 'not_run' || r.mdm_verification !== undefined && r.mdm_verification !== 'manual_prelaunch') || r.evidence_class !== 'reviewed_release_and_current_inputs' || !isDeepStrictEqual(r.mandatory_gates, [...releaseGates(r.security_mode), ...EXEC_INPUT_GATES, 'authenticated_mcp_discovery']) || !isDeepStrictEqual(r.accepted_residual_risks, releaseRisks(r.security_mode, r.mdm_verification)))
+        throw Error('EXEC_RELEASE_DESCRIPTOR_REJECTED');
+}
+/** Diagnostic validator only; live currentness and trusted dependency origin
+ * are checked by the host. Release checks never become direct native proof. */
+export function assessReleaseExec(value, plan) {
+    const reasonCodes = [];
+    const need = (ok, code) => { if (!ok)
+        reasonCodes.push(code); };
+    try {
+        requireOfficialExecPlan(plan);
+        const v3 = plan.mode === UNMANAGED_EXEC_MODE;
+        if (!record(value))
+            return { ready: false, reasonCodes: ['EXEC_RELEASE_EVIDENCE_UNAVAILABLE', ...EXEC_RELEASE_GATES.map(g => 'EXEC_RELEASE_' + g.toUpperCase() + '_UNVERIFIED'), ...EXEC_INPUT_GATES.map(g => 'EXEC_INPUT_' + g.toUpperCase() + '_UNVERIFIED')] };
+        need(isReleaseExecMode(plan.mode) && exact(value, ['version', 'securityMode', 'transport', 'executionNonce', 'identity', 'invocationFingerprint', 'acceptedResidualRisks', 'release', 'inputs', 'warnings', ...(v3 ? ['policyScope'] : [])]) && value.version === (v3 ? 'cli-exec-release-evidence-v3' : 'cli-exec-release-evidence-v2') && value.securityMode === plan.mode && value.transport === EXEC_TRANSPORT, 'EXEC_RELEASE_EVIDENCE_SHAPE');
+        need(value.executionNonce === plan.executionNonce && value.invocationFingerprint === plan.invocationFingerprint && isDeepStrictEqual(value.identity, plan.identity), 'EXEC_RELEASE_IDENTITY_MISMATCH');
+        need(isDeepStrictEqual(value.acceptedResidualRisks, releaseRisks(plan.mode, record(value.policyScope) && record(value.policyScope.manual_verification) ? value.policyScope.manual_verification.mode : undefined)), 'EXEC_RELEASE_RISK_MISMATCH');
+        need(Array.isArray(value.warnings) && value.warnings.length === 0, 'EXEC_RELEASE_WARNING');
+        const r = record(value.release) ? value.release : {};
+        need(exact(r, ['source', 'binarySha256', 'manifestFingerprint', 'fixturesFingerprint', 'checks']) && r.source === 'reviewed_compiled_release' && r.binarySha256 === plan.identity.binarySha256 && r.manifestFingerprint === plan.identity.releaseManifestFingerprint && r.fixturesFingerprint === plan.identity.barrierFingerprint, 'EXEC_RELEASE_PIN_MISMATCH');
+        need(checks(r.checks, releaseGates(plan.mode), 'pinned_release_fixture'), 'EXEC_RELEASE_CHECKS_UNVERIFIED');
+        if (v3)
+            requirePolicyScope(value.policyScope, plan);
+        need(checks(value.inputs, EXEC_INPUT_GATES, 'current_execution'), 'EXEC_INPUT_CHECKS_UNVERIFIED');
+    }
+    catch {
+        reasonCodes.push('EXEC_RELEASE_EVIDENCE_UNAVAILABLE');
+    }
+    return { ready: reasonCodes.length === 0, reasonCodes };
+}

package/dist/src/adapters/codex/exec-runtime-options.js

@@ -0,0 +1,122 @@
+import { executionError } from '../../safety/execution-failure.js';
+import path from 'node:path';
+import { mkdtemp, mkdir, realpath, writeFile, rm, lstat } from 'node:fs/promises';
+import { NodeProcessGroupHost } from '../../process/node-process-group-host.js';
+import { LocalToolPolicy } from '../../safety/local-tool-policy.js';
+import { jobToolPolicyOptions } from '../../safety/job-tool-policy.js';
+import { LocalToolServer, localToolInventory } from '../../safety/local-tool-server.js';
+import { commandRegistryFingerprint } from '../../safety/job-security-session.js';
+import { fingerprint } from '../../daemon/execution-coordinator.js';
+import { buildOfficialExecPlan } from './exec-invocation.js';
+import { ExecToolGate } from './exec-tool-gate.js';
+import { CodexExecLaunchHost } from './exec-launch-host.js';
+import { CODEX_REPORT_SCHEMA } from './prompt-compiler.js';
+const inside = (a, b) => a === b || b.startsWith(a + path.sep);
+const reject = () => Error('CODEX_EXEC_COMPOSITION_REJECTED');
+/** The caller supplies a trusted claimed job, not a task-selected host factory. */
+export function buildCodexExecJobOptions(input) {
+    let job, server, gate, policy, control, closed = false, used = false, closing;
+    let launchHost;
+    const dispose = () => closing ??= Promise.resolve().then(async () => { closed = true; gate?.revoke(); job?.revoke(); try {
+        server?.revoke();
+    }
+    finally {
+        policy?.revoke();
+        try {
+            await server?.close();
+        }
+        finally {
+            if (control)
+                await rm(control, { recursive: true, force: true });
+        }
+    } });
+    const close = async () => { try {
+        await launchHost?.cancel();
+    }
+    finally {
+        await dispose();
+    } };
+    const processHost = input.processHost ?? new NodeProcessGroupHost();
+    const env = Object.fromEntries(['HOME', 'CODEX_HOME', 'PATH', 'USER', 'LOGNAME', 'LANG', 'LC_ALL', 'TMPDIR'].filter(k => input.env[k] !== undefined).map(k => [k, input.env[k]]));
+    return { worktreeRoot: input.worktreePath, jobId: input.jobId, env: input.env, processHost,
+        closeOfficialExec: close, revokeSecurity: () => { closed = true; gate?.revoke(); job?.revoke(); server?.revoke(); policy?.revoke(); },
+        createTools: () => { throw reject(); }, writeSchema: async () => { throw reject(); },
+        createOfficialExec: async (ctx, signal) => {
+            if (used || closed || signal.aborted)
+                throw reject();
+            used = true;
+            const abort = () => { void close().catch(() => { }); };
+            signal.addEventListener('abort', abort, { once: true });
+            let stage = 'codex_prepare';
+            try {
+                job = input.productionJob();
+                job.attachCleanup(close);
+                const admitted = await job.prepare(ctx);
+                if (closed || signal.aborted)
+                    throw reject();
+                stage = 'codex_storage';
+                if (!input.env.HOME || !path.isAbsolute(input.stateRoot))
+                    throw reject();
+                const account = path.resolve(input.env.CODEX_HOME ?? path.join(input.env.HOME, '.codex'));
+                await mkdir(input.stateRoot, { recursive: true, mode: 0o700 });
+                const state = await realpath(input.stateRoot), source = await realpath(input.worktreePath), home = await realpath(account);
+                if (inside(source, state) || inside(state, source) || inside(home, state) || inside(state, home))
+                    throw reject();
+                control = await mkdtemp(path.join(state, 'codex-exec-'));
+                const cwd = path.join(control, 'cwd'), scratch = { tmpDir: path.join(control, 'tmp'), logDir: path.join(control, 'log'), sqliteHome: path.join(control, 'sqlite') };
+                await Promise.all([cwd, ...Object.values(scratch)].map(p => mkdir(p, { mode: 0o700 })));
+                if (closed || signal.aborted)
+                    throw reject();
+                stage = 'codex_config_ancestry';
+                for (let dir = cwd;; dir = path.dirname(dir)) {
+                    for (const base of ['.codex/config.toml']) {
+                        const f = path.join(dir, base);
+                        if (f !== path.join(account, 'config.toml')) {
+                            try {
+                                await lstat(f);
+                                throw reject();
+                            }
+                            catch (e) {
+                                if (e.code !== 'ENOENT')
+                                    throw e;
+                            }
+                        }
+                    }
+                    if (dir === path.dirname(dir))
+                        break;
+                }
+                stage = 'codex_storage';
+                const schema = path.join(control, 'report-schema.json');
+                await writeFile(schema, JSON.stringify(CODEX_REPORT_SCHEMA), { mode: 0o600, flag: 'wx' });
+                if (closed || signal.aborted)
+                    throw reject();
+                const approved = ctx.approvedTaskPackage, requirements = approved.security_requirements;
+                stage = 'codex_tool_policy';
+                policy = new LocalToolPolicy(jobToolPolicyOptions(source, ctx.taskPackage, approved, admitted.release.commands, { runtimeAdapter: 'codex_cli', runtimeAdapterVersion: '1' }));
+                stage = 'codex_tool_server';
+                server = new LocalToolServer({ policy, authorizeCall: () => gate?.allowsCall() === true, onDiscovery: (event, scope) => gate?.discovery(event, scope) });
+                const endpoint = await server.start();
+                if (closed || signal.aborted)
+                    throw reject();
+                stage = 'codex_invocation';
+                const plan = buildOfficialExecPlan({ policyMode: admitted.release.securityMode, binary: admitted.binary, credentialBackend: admitted.release.credentialBackend, identity: { jobId: input.jobId, generation: ctx.generation, actorId: admitted.actorId, runnerId: admitted.runnerId, sourceSha: String(approved.repository.base_commit_sha), binarySha256: admitted.release.binarySha256, releaseManifestFingerprint: String(requirements.release_manifest_sha256), requirementsFingerprint: String(requirements.fingerprint), contractFingerprint: ctx.securityBinding.contractFingerprint, taskPackageFingerprint: ctx.securityBinding.taskPackageFingerprint, launchFingerprint: ctx.securityBinding.launchFingerprint, commandsFingerprint: commandRegistryFingerprint(admitted.release.commands), toolSchemaFingerprint: fingerprint({ tools: localToolInventory() }), barrierFingerprint: admitted.release.fixturesFingerprint }, invocation: { modelId: ctx.resolvedModelId, worktreeRoot: cwd, sourceRoot: source, schemaPath: schema, endpoint, env, scratch } });
+                gate = new ExecToolGate(plan);
+                const host = new CodexExecLaunchHost(plan, { processHost, inspectRelease: p => job.inspect(p), execTools: gate, revokeTools: () => { gate?.revoke(); server?.revoke(); policy?.revoke(); job?.revoke(); }, closeTools: dispose });
+                launchHost = host;
+                if (closed || signal.aborted)
+                    throw reject();
+                return host;
+            }
+            catch (error) {
+                const safe = executionError(error, stage, 'CODEX_EXEC_COMPOSITION_REJECTED');
+                await close().catch(() => { });
+                if (control)
+                    await rm(control, { recursive: true, force: true }).catch(() => { });
+                throw safe;
+            }
+            finally {
+                signal.removeEventListener('abort', abort);
+            }
+        },
+    };
+}

package/dist/src/adapters/codex/exec-tool-gate.js

@@ -0,0 +1,81 @@
+import { isReleaseExecMode, requireOfficialExecPlan } from './exec-invocation.js';
+import { localDiscoveryScopeMatches, localToolInventory } from '../../safety/local-tool-server.js';
+import { securityRequirementsFingerprint as hash } from '../../safety/security-requirements.js';
+const denied = () => Error('EXEC_TOOL_GATE_REJECTED');
+/** Host-owned capability, never populated from stdout/task data. Authenticated
+ * discovery is server-side evidence; it does not attest OS client identity. */
+export class ExecToolGate {
+    plan;
+    process;
+    current;
+    submitted = false;
+    revoked = false;
+    authorized = false;
+    stage = 0;
+    settle;
+    reject;
+    constructor(plan) {
+        this.plan = plan;
+        requireOfficialExecPlan(plan);
+        if (!isReleaseExecMode(plan.mode) || plan.identity.toolSchemaFingerprint !== hash({ tools: localToolInventory() }))
+            throw denied();
+    }
+    matches(plan) { return this.plan === plan && !this.process && !this.revoked; }
+    bind(process, current) { if (this.process || this.revoked)
+        throw denied(); this.process = process; this.current = current; }
+    active() { try {
+        return !this.revoked && !!this.process && this.current?.() === true;
+    }
+    catch {
+        return false;
+    } }
+    promptSubmitted(process) { if (this.process !== process || this.submitted || !this.active())
+        throw denied(); this.submitted = true; }
+    discovery = (event, scope) => {
+        const token = requireOfficialExecPlan(this.plan).env.AI_GATEWAY_JOB_MCP_TOKEN;
+        if (!localDiscoveryScopeMatches(scope, this.plan.endpoint, token)) {
+            this.revoke();
+            return;
+        }
+        if (event === 'revoked') {
+            this.revoke();
+            return;
+        }
+        if (this.revoked)
+            return;
+        if (!this.active() || !this.submitted) {
+            this.revoke();
+            return;
+        }
+        const expected = ['initialize_response', 'initialized_notification', 'inventory_response'];
+        if (this.stage === 3 && event === 'inventory_response')
+            return;
+        if (event !== expected[this.stage]) {
+            this.revoke();
+            return;
+        }
+        this.stage++;
+        if (this.stage === 3)
+            this.settle?.();
+    };
+    async wait(process, signal) {
+        if (this.process !== process || !this.submitted || !this.active() || signal.aborted)
+            throw denied();
+        if (this.stage !== 3)
+            await new Promise((resolve, reject) => {
+                const abort = () => { clear(); reject(denied()); };
+                const clear = () => { signal.removeEventListener('abort', abort); this.settle = undefined; this.reject = undefined; };
+                this.reject = abort;
+                this.settle = () => { clear(); resolve(); };
+                signal.addEventListener('abort', abort, { once: true });
+            });
+        if (!this.active() || signal.aborted || this.stage !== 3)
+            throw denied();
+        return { process, executionNonce: this.plan.executionNonce, endpoint: this.plan.endpoint, authenticated: true, ready: true, toolSchemaFingerprint: this.plan.identity.toolSchemaFingerprint, tools: localToolInventory().map(t => t.name), isCurrent: () => this.active() && this.stage === 3 };
+    }
+    authorize(process) { if (process !== this.process || !this.active() || this.stage !== 3)
+        throw denied(); this.authorized = true; }
+    allowsCall() { return this.authorized && this.submitted && this.stage === 3 && this.active(); }
+    revoke() { if (this.revoked)
+        return; this.revoked = true; this.authorized = false; this.reject?.(); }
+}

package/dist/src/adapters/codex/global-instructions.js

@@ -0,0 +1,32 @@
+import path from 'node:path';
+export const CODEX_GLOBAL_INSTRUCTION_WRAPPER = '/usr/bin/sandbox-exec';
+const reject = () => new Error('CODEX_GLOBAL_INSTRUCTION_BOUNDARY_REJECTED');
+export function accountAncestorPaths(account) {
+    if (!path.isAbsolute(account) || path.resolve(account) !== account || account === '/' || account.length > 4096 || /[\r\n\0]/.test(account))
+        throw reject();
+    const parents = [];
+    for (let dir = account;; dir = path.dirname(dir)) {
+        parents.push(dir);
+        if (parents.length > 64)
+            throw reject();
+        if (dir === path.dirname(dir))
+            break;
+    }
+    return Object.freeze(parents);
+}
+/** Additional per-process denial, not a grant of authority or global policy edit.
+ * file-read* is intentional: data-only denial permits a final symlink alias.
+ * Ancestor symlink denials prevent a later account-directory redirect. */
+export function globalInstructionProfile(account) {
+    const ancestors = accountAncestorPaths(account), literal = (p) => `(literal ${JSON.stringify(p)})`;
+    const profile = '(version 1)(allow default)'
+        + '(deny file-read* ' + ['AGENTS.md', 'AGENTS.override.md'].map(name => literal(path.join(account, name))).join(' ') + ')'
+        + '(deny file-read* (require-all (vnode-type SYMLINK) (require-any ' + ancestors.map(literal).join(' ') + ')))';
+    if (profile.length > 64000)
+        throw reject();
+    return profile;
+}
+export function requireGlobalInstructionInvocation(nativeBinary, account, invocation) {
+    if (invocation.binary !== CODEX_GLOBAL_INSTRUCTION_WRAPPER || invocation.args[0] !== '-p' || invocation.args[1] !== globalInstructionProfile(account) || invocation.args[2] !== nativeBinary)
+        throw reject();
+}

package/dist/src/adapters/codex/manual-policy-scope.js

@@ -0,0 +1,67 @@
+import { isDeepStrictEqual } from 'node:util';
+import { assessMdmInventory } from '../../safety/codex-native-observation.js';
+import { securityRequirementsFingerprint as hash } from '../../safety/security-requirements.js';
+import { classifyUnmanagedEnvironment } from './unmanaged-scope.js';
+const denied = () => Error('CODEX_MANUAL_POLICY_REJECTED');
+export const MANUAL_MDM_RISK = 'manual_prelaunch_mdm_snapshot_not_continuously_reobserved';
+/** Trusted in-process controller only, never a task/env/receipt deserializer.
+ * Administrator provenance belongs to that controller. Arbitrary JSON is not
+ * OS attestation. This module cannot query profiles or create elevated code. */
+export function createManualPolicyScopeVerifier(input) {
+    const binding = structuredClone(input.binding), inventory = structuredClone(input.inventory), lease = input.leaseDigest, read = input.readLocal, now = input.now ?? Date.now;
+    const identityKeys = ['jobId', 'generation', 'actorId', 'runnerId', 'sourceSha', 'binarySha256', 'releaseManifestFingerprint', 'requirementsFingerprint', 'contractFingerprint', 'taskPackageFingerprint', 'launchFingerprint', 'commandsFingerprint', 'toolSchemaFingerprint', 'barrierFingerprint'];
+    if (!isDeepStrictEqual(Object.keys(binding).sort(), identityKeys.sort()) || !Number.isSafeInteger(binding.generation) || binding.generation < 1 || !['jobId', 'actorId', 'runnerId'].every(k => typeof binding[k] === 'string' && binding[k].length > 0 && binding[k].length <= 256 && !/[\r\n\0]/.test(binding[k])) || !/^[a-f0-9]{40}$/.test(binding.sourceSha) || !['binarySha256', 'releaseManifestFingerprint', 'requirementsFingerprint', 'contractFingerprint', 'taskPackageFingerprint', 'launchFingerprint', 'commandsFingerprint', 'toolSchemaFingerprint', 'barrierFingerprint'].every(k => /^[a-f0-9]{64}$/.test(binding[k])) || !/^[a-f0-9]{64}$/.test(lease))
+        throw denied();
+    let revoked = false, spent = false;
+    return Object.freeze({ revoke() { revoked = true; }, observe() {
+            if (revoked || spent)
+                throw denied();
+            const evaluate = (started) => {
+                const before = now(), local = read(), time = now();
+                if (!Number.isSafeInteger(before) || time < before)
+                    throw denied();
+                if (!Number.isSafeInteger(time) || time < inventory.observedAt)
+                    throw denied();
+                // A started manual run retains its original inventory timestamp. Only the
+                // current forced preferences/nonprivileged sources/account are re-read.
+                const mdm = assessMdmInventory(inventory, local.forced, started ? inventory.observedAt : time);
+                const classified = classifyUnmanagedEnvironment({ version: 'codex-policy-observation-v1', observedAt: time, validUntil: time + 60_000, sources: { ...local.sources, mdm_config: mdm, mdm_requirements: mdm }, account: local.account }, time);
+                if (!classified.eligible)
+                    throw denied();
+                return classified;
+            };
+            let first;
+            try {
+                first = evaluate(false);
+            }
+            catch {
+                throw denied();
+            }
+            let dead = false, started = false;
+            const current = () => { if (dead || revoked)
+                return false; try {
+                const c = evaluate(started);
+                if (c.sourcesFingerprint !== first.sourcesFingerprint || c.accountFingerprint !== first.accountFingerprint)
+                    dead = true;
+            }
+            catch {
+                dead = true;
+            } return !dead; };
+            const verification = Object.freeze({ mode: 'manual_prelaunch', observedAt: inventory.observedAt, inventoryFingerprint: inventory.inventoryFingerprint, continuousMdmMonitoring: false, bindingFingerprint: hash({ ...binding, leaseDigest: lease }) });
+            return Object.freeze({ sourcesFingerprint: first.sourcesFingerprint, accountFingerprint: first.accountFingerprint, accountRootFingerprint: first.accountRootFingerprint, observedAt: inventory.observedAt, manualVerification: verification, isCurrent: current,
+                beforeSpawn(identity, leaseDigest) {
+                    if (started || spent || !isDeepStrictEqual(identity, binding) || leaseDigest !== lease || !current()) {
+                        dead = true;
+                        throw denied();
+                    }
+                    const atSpawn = now();
+                    if (!Number.isSafeInteger(atSpawn) || atSpawn < inventory.observedAt || atSpawn - inventory.observedAt > 60_000) {
+                        dead = true;
+                        throw denied();
+                    }
+                    spent = true;
+                    started = true;
+                },
+            });
+        } });
+}

package/dist/src/adapters/codex/native-policy.js

@@ -25,17 +25,33 @@ export function validateNativeConfig(value, requirements, pin) {
         reject();
     if (!Array.isArray(result.layers) || !result.layers.length)
         reject();
-    let flags = 0;
+    let flags = 0, users = 0;
     for (const layerValue of result.layers) {
         const layer = record(layerValue), name = record(layer.name);
         if (!['sessionFlags', 'user', 'system', 'project', 'mdm'].includes(String(name.type)))
             reject();
         if (name.type === 'sessionFlags')
             flags++;
-        if (name.type !== 'sessionFlags' && Object.keys(record(layer.config)).length > 0)
+        if (name.type === 'user') {
+            if (++users > 1)
+                reject();
+            if (pin.accountSources) {
+                if (canonical(record(layer.config)) !== canonical(pin.accountSources.userConfig))
+                    reject();
+                if (Object.keys(pin.accountSources.userConfig).length > 0 && name.file !== pin.accountSources.configPath)
+                    reject();
+                if (name.file !== undefined && name.file !== pin.accountSources.configPath)
+                    reject();
+                if (name.profile !== undefined && name.profile !== null)
+                    reject();
+            }
+            else if (Object.keys(record(layer.config)).length > 0)
+                reject();
+        }
+        else if (name.type !== 'sessionFlags' && Object.keys(record(layer.config)).length > 0)
             reject();
     }
-    if (flags !== 1)
+    if (flags !== 1 || pin.accountSources && Object.keys(pin.accountSources.userConfig).length > 0 && users !== 1)
         reject();
     const req = record(requirements).requirements;
     if (req !== null) {
@@ -91,7 +107,7 @@ export function validateNativeConfig(value, requirements, pin) {
     for (const k of Object.keys(server))
         if (!['url', 'bearer_token_env_var', 'environment_id', 'enabled', 'required', 'tool_timeout_sec', 'default_tools_approval_mode', 'enabled_tools'].includes(k))
             reject();
-    return fingerprint({ config: c, requirements: req });
+    return fingerprint({ config: c, requirements: req, ...(pin.accountSources ? { accountSources: pin.accountSources.fingerprint } : {}) });
 }
 export function validateNativeTools(value, pin) {
     const response = record(value);

package/dist/src/adapters/codex/native-session.js

@@ -1,5 +1,5 @@
 import { issueCodexNativeProof } from './native-proof.js';
-import { lstat } from 'node:fs/promises';
+import { inspectCodexAccountSources, codexAccountSourceGuard } from './account-sources.js';
 import path from 'node:path';
 import { CodexStdioRpc, record } from './stdio-rpc.js';
 import { CodexAppServerEvents, CodexEventQueue } from './app-server-events.js';
@@ -11,27 +11,7 @@ import { localToolInventory } from '../../safety/local-tool-server.js';
 import { CODEX_REPORT_SCHEMA } from './prompt-compiler.js';
 import { codexControlDenials } from './scratch.js';
 export async function assertCodexSourceIsolation(home, cwd, codexHome = path.join(home, '.codex')) {
-    const denied = ['/etc/codex/rules', path.join(codexHome, 'config.toml'), path.join(codexHome, 'rules'), path.join(codexHome, 'AGENTS.md')];
-    let parent = cwd;
-    while (true) {
-        const candidate = path.join(parent, '.codex');
-        if (path.resolve(candidate) !== path.resolve(codexHome))
-            denied.push(candidate);
-        const next = path.dirname(parent);
-        if (next === parent)
-            break;
-        parent = next;
-    }
-    for (const entry of denied) {
-        try {
-            await lstat(entry);
-            reject();
-        }
-        catch (error) {
-            if (error.code !== 'ENOENT')
-                throw error;
-        }
-    }
+    await inspectCodexAccountSources(home, cwd, codexHome);
 }
 /** Dedicated thread; the model is never given this RPC client. */
 export class CodexNativeSession {
@@ -306,7 +286,8 @@ export async function startNativeCodexSession(options, invocation, prompt, signa
     const preparationDeadline = Date.now() + 30_000;
     let supported = options.supportedAdmission ? { policy: options.supportedAdmission.policy, binding: Object.freeze(structuredClone(options.supportedAdmission.binding)) } : undefined;
     const native = buildNativeInvocation(invocation, options);
-    const sourceCheck = () => assertCodexSourceIsolation(options.home, options.cwd, native.env.CODEX_HOME || undefined);
+    const guard = codexAccountSourceGuard(options.home, options.cwd, native.env.CODEX_HOME || undefined);
+    const sourceCheck = async () => { native.pin.accountSources = await guard(); };
     let earlyTimer;
     let earlyAbort;
     let earlyStopped = false;