mtech-ai-local-runner 0.1.93 → 0.1.95

package/README.md

@@ -1,3 +1,35 @@
+## Unreleased: bounded report drafting and offline preflight
+
+The final writing guidance targets 1,200 UTF-16 code units in `report`, below
+the unchanged 2,000-unit acceptance limit. Findings and uncertainty belong in
+the short report; detailed citations belong in `evidence`. No automatic
+truncation, content repair, model retry, new tool or launch permission is added.
+Prompt guidance alone cannot guarantee model compliance: an oversized final
+response still fails closed. These changes are source-only, not part of the
+installed/reviewed 0.1.93 package.
+
+From the `runners/local-agent` source checkout, before another live validation,
+replay saved **final response text**, not a transcript or stream-JSON wrapper,
+through the production completion validator (the script is a repository-only
+rehearsal utility, not an installed Runner command):
+
+```sh
+npm run build
+node scripts/check-completion-report.mjs /absolute/path/to/final-response.txt
+```
+
+This offline script reads a bounded UTF-8 file, emits only counts and fixed
+diagnostics, and never rewrites the input, calls a model, accesses Gateway or
+starts work. Exit 0 means valid transport (including a truthful `blocked`
+report), 1 means rejected transport, and 2 means usage/read/encoding/input-size
+failure. A reported `completed` status does not verify the investigation,
+citations or Work Item completion. The exact 2026-11-05 failure is preserved as
+an untrusted technical test fixture; its claims are not accepted as true.
+
+No package publication, Gateway registration, Runner replacement or new live
+execution has been performed for this source change. Those require separate
+release review, exact hashes and execution approval.
+
 ## 0.1.93: strict investigation JSON completion guidance
 
 Claude uses native-stream progress guidance and receives scoped tool/correction

package/dist/src/adapters/completion-report-preflight.js

@@ -0,0 +1,20 @@
+import { completionEnvelope, completionEvent, COMPLETION_REPORT_LIMITS } from './completion-report.js';
+/** Offline diagnostics only: never rewrites output, creates evidence, or authorizes execution. */
+export function completionReportPreflight(raw) {
+    const options = { earlierCodeBlocks: true };
+    const envelope = completionEnvelope(raw, options);
+    const event = completionEvent(raw, undefined, options);
+    const rejection = event.payload?.completion_rejection;
+    const valid = event.eventType === 'completed' || event.payload?.reason === 'executor_blocked';
+    return {
+        valid_transport: valid,
+        // This is transport status only, not independent review or Work Item completion.
+        completed: event.eventType === 'completed',
+        status: valid ? (event.eventType === 'completed' ? 'completed' : 'blocked') : 'rejected',
+        rejection_code: rejection?.code ?? null,
+        report_code_units: typeof envelope?.report === 'string' ? envelope.report.length : null,
+        report_limit: COMPLETION_REPORT_LIMITS.reportCodeUnits,
+        evidence_count: Array.isArray(envelope?.evidence) ? envelope.evidence.length : null,
+        pending_work_count: Array.isArray(envelope?.pending_work) ? envelope.pending_work.length : null,
+    };
+}

package/dist/src/adapters/completion-report.js

@@ -22,6 +22,14 @@ export function reportRejectionCounts(value, total) {
 const MAX_EVIDENCE_ITEMS = 20;
 const MAX_EVIDENCE_CHARS = 500;
 const MAX_REPORT_ENVELOPE_CHARS = 16_000;
+/** Construction/rehearsal hints; acceptance always goes through completionEvent. */
+export const COMPLETION_REPORT_LIMITS = Object.freeze({
+    reportCodeUnits: MAX_EVENT_SUMMARY_CHARS,
+    targetReportCodeUnits: Math.min(1200, MAX_EVENT_SUMMARY_CHARS),
+    listItems: MAX_EVIDENCE_ITEMS,
+    itemCodeUnits: MAX_EVIDENCE_CHARS,
+    envelopeCodeUnits: MAX_REPORT_ENVELOPE_CHARS,
+});
 const REPORT_FAILURE_CODES = ["CODEX_COMPLETION_REPORT_MISSING", "CODEX_COMPLETION_REPORT_INVALID", "CODEX_COMPLETION_REPORT_MULTIPLE", "CODEX_COMPLETION_REPORT_NOT_FINAL", "CODEX_TURN_INCOMPLETE"];
 const REPORT_DIAGNOSTIC_CODES = [...REPORT_FAILURE_CODES, "CODEX_COMPLETION_REPORT_BLOCKED"];
 /** Pair counts only; no item IDs, text, stable digests or arbitrary keys. */
@@ -68,6 +76,11 @@ export const COMPLETION_REPORT_NOTICE = "Do the assigned work yourself using the
     "Your final response must be one JSON object, without Markdown fences: " +
     '{"status":"completed","report":"actual findings and results","evidence":["file path and observed finding, or command and actual result"],"pending_work":[]}. ' +
     `The report must be nonempty and at most ${MAX_EVENT_SUMMARY_CHARS} characters. ` +
+    `Aim for at most ${COMPLETION_REPORT_LIMITS.targetReportCodeUnits} UTF-16 code units in the decoded report string; the hard limit remains ${MAX_EVENT_SUMMARY_CHARS}. ` +
+    "Count decoded string length, not tokens, words, UTF-8 bytes or JSON escape characters; an emoji can count as two units. " +
+    "Use short findings for the requested topics, then uncertainty and verification limits. Put detailed source citations in evidence instead of repeating them in report. " +
+    "Do not fill the available limit or duplicate a narrative before the JSON. Before sending your single final response, shorten your own draft to the target and recheck all fields. " +
+    "Never drop uncertainty or pending work to fit the report; use blocked and accurate pending_work when work is incomplete. " +
     `Include 1-${MAX_EVIDENCE_ITEMS} nonempty evidence strings, each at most ${MAX_EVIDENCE_CHARS} characters. ` +
     "Address the assigned objective and each applicable acceptance criterion with observed evidence, not a plan or promise. " +
     "Only attest to executor work you observed; Gateway records transport, completion, and review receipts separately. " +

package/dist/src/publication/git-snapshot.js

@@ -1,7 +1,7 @@
 import { execFile, spawn } from 'node:child_process';
 import { promisify } from 'node:util';
 import { constants } from 'node:fs';
-import { lstat, mkdir, mkdtemp, open, realpath, readdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { lstat, mkdir, mkdtemp, open, realpath, readdir, readFile, readlink, rm, writeFile } from 'node:fs/promises';
 import { createHash } from 'node:crypto';
 import path from 'node:path';
 import { measureCommandFile } from '../safety/registered-command-integrity.js';
@@ -11,6 +11,7 @@ const execute = promisify(execFile), denied = () => Error('SNAPSHOT_REJECTED');
 const digest = (data) => createHash('sha256').update(data).digest('hex');
 const structural = (p) => p.length > 0 && !path.isAbsolute(p) && !p.includes('\\') && !p.includes('\0') && p.split('/').every(s => s !== '' && s !== '.' && s !== '..' && !/^\.git$/i.test(s));
 const safe = (p) => structural(p) && p.split('/').every(s => !/^(?:\.ssh|\.aws|\.codex|\.claude|\.env|\.netrc|\.npmrc|credentials(?:\..*)?)$/i.test(s));
+const TRACKED_SYMLINK = /^120000 blob ([a-f0-9]{40})\t(.+)$/s;
 /** P1 branch shape only. Authority still requires exact frozen-fence equality. */
 /** Whole-checkout memory bound for a snapshot, per file and in total. A snapshot reads every
  * file of the checkout, so callers bound candidate size on the changed files instead. */
@@ -136,6 +137,19 @@ export class GitSnapshotHost {
             await fd.close();
         }
     }
+    /** A tracked symlink must stay the exact base link. Its target is read with readlink and never followed. */
+    async assertTrackedSymlink(relative, target) {
+        let component = this.options.root;
+        const parts = relative.split('/');
+        for (let i = 0; i < parts.length; i++) {
+            component = path.join(component, parts[i]);
+            const stat = await lstat(component);
+            if (i < parts.length - 1 ? stat.isSymbolicLink() || !stat.isDirectory() : !stat.isSymbolicLink())
+                throw denied();
+        }
+        if (!(await readlink(component, { encoding: 'buffer' })).equals(target))
+            throw denied();
+    }
     /** Checks the options every read relies on, then that HEAD is the base commit on the working branch. */
     async head() {
         const o = this.options, branchAllowed = o.p1WorkingBranch === undefined ? /^ai-work\/local\/[A-Za-z0-9-]+$/.test(o.workingBranch) : o.p1WorkingBranch === o.workingBranch && isP1WorkingBranch(o.workingBranch);
@@ -149,7 +163,7 @@ export class GitSnapshotHost {
         const o = this.options;
         await this.head();
         const head = o.baseCommitSha, branch = o.workingBranch;
-        const base = new Map(), gitlinks = new Map(), protectedNames = new Set(), baseListing = await this.git(['ls-tree', '-r', '-z', '--full-tree', o.baseCommitSha]);
+        const base = new Map(), gitlinks = new Map(), symlinks = new Map(), protectedNames = new Set(), baseListing = await this.git(['ls-tree', '-r', '-z', '--full-tree', o.baseCommitSha]);
         for (const line of baseListing.toString().split('\0').filter(Boolean)) {
             const link = /^160000 commit ([a-f0-9]{40})\t(.+)$/s.exec(line);
             if (link) {
@@ -158,6 +172,13 @@ export class GitSnapshotHost {
                 gitlinks.set(link[2], link[1]);
                 continue;
             }
+            const symlink = TRACKED_SYMLINK.exec(line);
+            if (symlink) {
+                if (!safe(symlink[2]))
+                    throw denied();
+                symlinks.set(symlink[2], symlink[1]);
+                continue;
+            }
             const match = /^(100644|100755) blob ([a-f0-9]{40})\t(.+)$/s.exec(line);
             if (!match || !structural(match[3]))
                 throw denied();
@@ -166,11 +187,11 @@ export class GitSnapshotHost {
                 protectedNames.add(match[3]);
         }
         // Protected names the base commit already tracks stay as exact base content; only a change to one is refused.
-        // Gitlinks remain exact base-tree references. Never traverse or copy their source.
+        // Gitlinks and tracked symlinks remain exact base-tree references. Never traverse or copy their source.
         // Staged replacement/deletion is refused rather than publishing hidden changes.
         const staged = new Map(), stagedListing = await this.git(['ls-files', '--stage', '-z']);
         for (const line of stagedListing.toString().split('\0').filter(Boolean)) {
-            const entry = /^(100644|100755|160000) ([a-f0-9]{40}) 0\t(.+)$/s.exec(line);
+            const entry = /^(100644|100755|120000|160000) ([a-f0-9]{40}) 0\t(.+)$/s.exec(line);
             if (!entry || !structural(entry[3]))
                 throw denied();
             staged.set(entry[3], entry[1] + ' ' + entry[2]);
@@ -178,15 +199,26 @@ export class GitSnapshotHost {
         const expected = new Map([...base.entries()].map(([name, value]) => [name, value.mode.toString(8) + ' ' + value.blob]));
         for (const [name, oid] of gitlinks)
             expected.set(name, '160000 ' + oid);
+        for (const [name, oid] of symlinks)
+            expected.set(name, '120000 ' + oid);
         if (protocolHash([...expected].sort()) !== protocolHash([...staged].sort()))
             throw denied();
         const untrackedListing = await this.git(['ls-files', '--others', '--exclude-standard', '-z', '--']);
         const names = [...new Set([...base.keys(), ...untrackedListing.toString().split('\0').filter(Boolean)])].sort();
-        const blobs = await this.batchObjects([...base.values()].map(v => v.blob));
+        const blobs = await this.batchObjects([...[...base.values()].map(v => v.blob), ...symlinks.values()]);
+        const symlinkTargets = new Map();
+        for (const [name, oid] of symlinks) {
+            const blob = blobs.get(oid);
+            if (!blob || blob.type !== 'blob')
+                throw denied();
+            symlinkTargets.set(name, blob.bytes);
+            await this.assertTrackedSymlink(name, blob.bytes);
+        }
+        const kept = [...gitlinks.keys(), ...symlinks.keys()];
         const files = [], changes = [];
         let total = 0;
         for (const name of names) {
-            if ([...gitlinks.keys()].some(p => name === p || name.startsWith(p + '/') || p.startsWith(name + '/')))
+            if (kept.some(p => name === p || name.startsWith(p + '/') || p.startsWith(name + '/')))
                 throw denied();
             const current = await this.currentFile(name, protectedNames.has(name)), prior = base.get(name);
             let before = null;
@@ -211,7 +243,7 @@ export class GitSnapshotHost {
                 changes.push({ path: name, status: !prior ? 'added' : !current ? 'deleted' : 'modified', before: before?.toString('base64') ?? null, after: current?.bytes.toString('base64') ?? null, before_mode: prior?.mode ?? null, after_mode: current?.mode ?? null });
         }
         const observation = { base_commit_sha: o.baseCommitSha, head_commit_sha: head, working_branch: branch, diff: JSON.stringify({ format: 'local-candidate-binary-diff-v1', changes }), changed_files: changes.map(({ path, status }) => ({ path, status })) };
-        const listing = { base: digest(baseListing), staged: digest(stagedListing), untracked: digest(untrackedListing), names, protectedNames };
+        const listing = { base: digest(baseListing), staged: digest(stagedListing), untracked: digest(untrackedListing), names, protectedNames, symlinks: symlinkTargets };
         return { observation, files, listing, fingerprint: protocolHash({ observation, files: files.map(f => ({ path: f.path, mode: f.mode, sha256: digest(f.bytes) })) }) };
     }
     /** The checkout still equals a capture when HEAD, the branch, the three Git listings and every
@@ -222,6 +254,8 @@ export class GitSnapshotHost {
         await this.head();
         if (digest(await this.git(['ls-tree', '-r', '-z', '--full-tree', o.baseCommitSha])) !== listing.base || digest(await this.git(['ls-files', '--stage', '-z'])) !== listing.staged || digest(await this.git(['ls-files', '--others', '--exclude-standard', '-z', '--'])) !== listing.untracked)
             throw denied();
+        for (const [name, target] of listing.symlinks)
+            await this.assertTrackedSymlink(name, target);
         const files = [];
         let total = 0;
         for (const name of listing.names) {
@@ -264,7 +298,7 @@ export class GitSnapshotHost {
             for (const entry of (await this.git(['ls-tree', '-r', '-t', '-z', o.baseCommitSha])).toString().split('\0').filter(Boolean)) {
                 if (/^160000 commit [a-f0-9]{40}\t/.test(entry))
                     continue;
-                const match = /^(?:100644|100755|040000) (blob|tree) ([a-f0-9]{40})\t/.exec(entry);
+                const match = /^(?:100644|100755|120000|040000) (blob|tree) ([a-f0-9]{40})\t/.exec(entry);
                 if (!match)
                     throw denied();
                 objects.set(match[2], match[1]);
@@ -344,6 +378,9 @@ export class GitSnapshotHost {
                 const link = /^160000 commit ([a-f0-9]{40})\t(.+)$/s.exec(line);
                 if (link)
                     entries.push({ path: link[2], mode: 0o160000, bytes: Buffer.alloc(0), gitlink: link[1] });
+                const symlink = TRACKED_SYMLINK.exec(line);
+                if (symlink)
+                    entries.push({ path: symlink[2], mode: 0o120000, bytes: Buffer.alloc(0), baseBlob: symlink[1] });
             }
             const objects = new RawGitObjects(root), tree = await objects.tree(entries, true), commitSha = await objects.object('commit', Buffer.from(`tree ${tree}\nparent ${this.options.baseCommitSha}\nauthor Local Runner Verification <runner-verification@invalid> 1 +0000\ncommitter Local Runner Verification <runner-verification@invalid> 1 +0000\n\nLocal runner verification candidate v1\n`), true);
             await writeFile(path.join(root, '.git', 'HEAD'), commitSha + '\n', { mode: 0o600 });

package/dist/src/publication/git-transport.js

@@ -67,13 +67,13 @@ export class GitPublicationTransport {
         if (protocolHash(entries.map(e => ({ path: e.path, mode: e.mode, sha256: createHash('sha256').update(e.bytes).digest('hex') }))) !== o.sealedTreeFingerprint)
             throw denied();
         for (const line of (await this.git(['ls-tree', '-r', '-z', request.base_commit_sha])).split('\0').filter(Boolean)) {
-            const gitlink = /^160000 commit ([a-f0-9]{40})\t(.+)$/.exec(line);
-            if (!gitlink)
+            const gitlink = /^160000 commit ([a-f0-9]{40})\t(.+)$/.exec(line), symlink = /^120000 blob ([a-f0-9]{40})\t(.+)$/.exec(line), kept = gitlink ?? symlink;
+            if (!kept)
                 continue;
-            const name = gitlink[2];
+            const name = kept[2];
             if (!name || name.split('/').some(p => !p || p === '.' || p === '..' || p === '.git') || name.includes('\\') || entries.some(e => e.path === name || e.path.startsWith(name + '/') || name.startsWith(e.path + '/')))
                 throw denied();
-            entries.push({ path: name, mode: 0o160000, bytes: Buffer.alloc(0), gitlink: gitlink[1] });
+            entries.push(gitlink ? { path: name, mode: 0o160000, bytes: Buffer.alloc(0), gitlink: gitlink[1] } : { path: name, mode: 0o120000, bytes: Buffer.alloc(0), baseBlob: symlink[1] });
         }
         if (!await o.current())
             throw denied();

package/dist/src/publication/raw-git-objects.js

@@ -42,7 +42,7 @@ export class RawGitObjects {
             if (slash >= 0)
                 children.add(rest.slice(0, slash));
             else
-                names.set(rest, { mode: entry.mode.toString(8), oid: entry.gitlink ?? await this.object('blob', entry.bytes, write) });
+                names.set(rest, { mode: entry.mode.toString(8), oid: entry.gitlink ?? entry.baseBlob ?? await this.object('blob', entry.bytes, write) });
         }
         for (const child of children)
             names.set(child, { mode: '40000', oid: await this.tree(entries, write, prefix + child + '/') });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.93",
+  "version": "0.1.95",
   "private": false,
   "license": "UNLICENSED",
   "bin": {