@amaster.ai/employee-runtime-connector 0.1.1-beta.292 → 0.1.1-beta.294

package/dist/amaster-runtime-daemon.mjs

@@ -17764,20 +17764,22 @@ function isWithin(path, root) {
 function makePiRunPathWritable(path, uid, gid, fs = defaultFs) {
   const visit = (entryPath) => {
     const stat = fs.lstatSync(entryPath);
+    const ownedByTarget = stat.uid === uid && stat.gid === gid;
     if (stat.isSymbolicLink()) {
-      fs.lchownSync(entryPath, uid, gid);
+      if (!ownedByTarget) fs.lchownSync(entryPath, uid, gid);
       return;
     }
     if (stat.isDirectory()) {
-      fs.chmodSync(entryPath, 448);
+      if ((stat.mode & 511) !== 448) fs.chmodSync(entryPath, 448);
       for (const entry of fs.readdirSync(entryPath)) {
         visit(resolve(entryPath, entry));
       }
-      fs.chownSync(entryPath, uid, gid);
+      if (!ownedByTarget) fs.chownSync(entryPath, uid, gid);
       return;
     }
-    fs.chmodSync(entryPath, 384 | stat.mode & 73);
-    fs.chownSync(entryPath, uid, gid);
+    const desiredMode = 384 | stat.mode & 73;
+    if ((stat.mode & 511) !== desiredMode) fs.chmodSync(entryPath, desiredMode);
+    if (!ownedByTarget) fs.chownSync(entryPath, uid, gid);
   };
   visit(resolve(path));
 }
@@ -34342,7 +34344,7 @@ function assertRequiredTaskAttachmentMaterialized(input, materialized) {
 }
 
 // src/amaster-runtime-daemon.mjs
-var CONNECTOR_VERSION = "0.1.1-beta.292";
+var CONNECTOR_VERSION = "0.1.1-beta.294";
 var CONNECTOR_CONTRACT_VERSION = "2026-06-04.v1";
 var daemonRequire = createRequire(import.meta.url);
 var MAX_CHECKPOINT_BYTES = 20 * 1024 * 1024;
@@ -35027,6 +35029,21 @@ function buildHeartbeatPayload(config, options = {}) {
 function desktopDelegatedRunnerEnabled(config) {
   return config.runnerKind === RUNNER_KIND_DESKTOP_DELEGATED;
 }
+function piIsolatedChildOwnership(config) {
+  const uid = Number(config.piExecutorUid ?? 0);
+  const gid = Number(config.piExecutorGid ?? uid);
+  if (!Number.isSafeInteger(uid) || uid <= 0 || !Number.isSafeInteger(gid) || gid <= 0) return null;
+  if (desktopDelegatedRunnerEnabled(config)) return null;
+  if (typeof process.getuid !== "function" || process.getuid() !== 0) return null;
+  return { uid, gid };
+}
+function handoffPiRunPathsToChild(config, paths) {
+  const ownership = piIsolatedChildOwnership(config);
+  if (!ownership) return;
+  for (const path of paths) {
+    if (typeof path === "string" && path) makePiRunPathWritable(path, ownership.uid, ownership.gid);
+  }
+}
 function writeLocalRuntimeStatus(config, runtimeStatus) {
   const currentState = readState(process.env);
   writeState(process.env, {
@@ -35734,6 +35751,10 @@ async function syncPiExecutorProviderConfig(config, command, agentDir, providerC
   if (!agentDir) return;
   const { modelsSynced, settingsSynced } = syncAmasterProviderFiles(agentDir, providerConfig);
   if (modelsSynced || settingsSynced) {
+    handoffPiRunPathsToChild(config, [
+      modelsSynced ? join19(agentDir, "models.json") : null,
+      settingsSynced ? join19(agentDir, "settings.json") : null
+    ]);
     await ingestLog(config, command, "system", "info", "Synced AMaster provider config for pi executor", {
       modelsSynced,
       settingsSynced,
@@ -39199,6 +39220,10 @@ async function executeRunCommand(config, command) {
   let completionOwnsManagedMcpProfile = false;
   const trustedPiRuntimeAssertion = commandTrustedPiRuntimeAssertion(command);
   const preparationStages = [];
+  let preparationLogChain = Promise.resolve();
+  const enqueuePreparationLog = (stream, level, message, payload = {}) => {
+    preparationLogChain = preparationLogChain.then(() => ingestLog(config, command, stream, level, message, payload)).catch(() => void 0);
+  };
   const runExecutionStage = (phase, operation) => {
     const startedAtMs = Date.now();
     const recordDuration = () => preparationStages.push({
@@ -39375,7 +39400,7 @@ async function executeRunCommand(config, command) {
       if (executor.kind === "pi") {
         assertManagedPiNonInteractiveInvocation(invocation.args, managedMcpProfile);
       }
-      await ingestLog(config, command, "system", "info", desktopDelegatedRunnerEnabled(config) && executor.kind === "pi" ? "Prepared desktop delegated Pi runtime action bridge" : executor.kind === "pi" ? "Prepared isolated Pi managed MCP profile" : `Attested isolated ${executor.kind} managed MCP profile`, {
+      enqueuePreparationLog("system", "info", desktopDelegatedRunnerEnabled(config) && executor.kind === "pi" ? "Prepared desktop delegated Pi runtime action bridge" : executor.kind === "pi" ? "Prepared isolated Pi managed MCP profile" : `Attested isolated ${executor.kind} managed MCP profile`, {
         presentationKind: "managed_mcp_attestation",
         ...managedMcpProfile.attestation
       });
@@ -39500,6 +39525,7 @@ async function executeRunCommand(config, command) {
       mkdirSync10(promptDir, { recursive: true, mode: 448 });
       const promptPath = join19(promptDir, "conversation-system.md");
       writeFileSync12(promptPath, appendedSystemPrompt, { encoding: "utf8", mode: 384, flag: "wx" });
+      handoffPiRunPathsToChild(config, [promptPath]);
       const printIndex = invocation.args.lastIndexOf("-p");
       invocation.args.splice(printIndex < 0 ? invocation.args.length : printIndex, 0, "--append-system-prompt", promptPath);
     }
@@ -39518,24 +39544,18 @@ async function executeRunCommand(config, command) {
         cwd,
         expectedSha256: finalAgentInstructionFiles.get("AGENTS.md")?.sha256
       });
-      if (config.piExecutorUid > 0 && !desktopDelegatedRunnerEnabled(config)) {
-        piExecutorIdentity = await runExecutionStage("context_attestation", () => preparePiExecutorAccess({
-          uid: config.piExecutorUid,
-          gid: config.piExecutorGid,
-          effectiveUid: typeof process.getuid === "function" ? process.getuid() : null,
-          profileRoot: managedMcpProfile.profileRoot,
-          workspaceRoot: cwd,
-          allowedRoot: config.runtimeWorkspacesRoot
-        }));
-      }
+      handoffPiRunPathsToChild(config, [
+        ...finalContextExtensions,
+        readString(asRecord(managedMcpProfile.runExitFinalContextAttestation).extensionPath)
+      ]);
     }
     const promptBudgetSummary = contextManifest.budget.totalChars === null ? `${contextManifest.budget.usedChars} characters (unbounded)` : `${contextManifest.budget.usedChars}/${contextManifest.budget.totalChars} characters`;
-    await ingestLog(config, command, "system", "info", `Compiled ${contextManifest.mode} prompt using ${promptBudgetSummary}`, {
+    enqueuePreparationLog("system", "info", `Compiled ${contextManifest.mode} prompt using ${promptBudgetSummary}`, {
       presentationKind: "context_manifest",
       contextManifest
     });
     if (contextManifest.continuationPromptContract) {
-      await ingestLog(config, command, "system", "info", "Compiled Runtime Action continuation prompt contract", {
+      enqueuePreparationLog("system", "info", "Compiled Runtime Action continuation prompt contract", {
         presentationKind: "runtime_action_continuation_prompt_contract",
         metricName: "mirrorx_runtime_continuation_prompt_generated_total",
         metricValue: 1,
@@ -39544,19 +39564,21 @@ async function executeRunCommand(config, command) {
       });
     }
     if (contextManifest.currentRunContractShadow.status !== "match") {
-      await ingestLog(config, command, "system", "warn", "Current Run Contract shadow comparison did not match the legacy runtime inference", {
+      enqueuePreparationLog("system", "warn", "Current Run Contract shadow comparison did not match the legacy runtime inference", {
         presentationKind: "current_run_contract_shadow_audit",
         currentRunContractShadow: contextManifest.currentRunContractShadow
       });
     }
+    await preparationLogChain;
     await ackCommand(config, command, "spawned");
-    await ingestLog(config, command, "system", "info", `Starting ${executor.kind} executor`, {
+    enqueuePreparationLog("system", "info", `Starting ${executor.kind} executor`, {
       executorKind: executor.kind,
       cwd,
       args: invocation.args,
       preparationElapsedMs: Math.max(0, Date.now() - preparationStartedAtMs),
       preparationStages
     });
+    await preparationLogChain;
     forgetActiveRunCommand = rememberActiveRunCommand(command, {
       executorKind: executor.kind,
       workspacePath: cwd,
@@ -40214,6 +40236,7 @@ async function executeRunCommand(config, command) {
     }
     return { resultDelivered: Boolean(completion) };
   } finally {
+    await preparationLogChain;
     if (managedMcpProfile && !managedMcpCleanup && !completionOwnsManagedMcpProfile) {
       managedMcpCleanup = cleanupManagedMcpProfile(managedMcpProfile, {
         commandId: command.commandId,

package/dist/amaster-runtime.mjs

@@ -7,7 +7,7 @@ import { homedir, hostname } from "node:os";
 import { fileURLToPath } from "node:url";
 import { BUILD_SUPPORTED_CAPABILITIES } from "./amaster-runtime-daemon/capability-registry.mjs";
 
-const CONNECTOR_VERSION = "0.1.1-beta.292";
+const CONNECTOR_VERSION = "0.1.1-beta.294";
 
 const CONFIG_KEY_MAP = new Map([
   ["server_url", "AMASTER_EMPLOYEE_SERVER_URL"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amaster.ai/employee-runtime-connector",
-  "version": "0.1.1-beta.292",
+  "version": "0.1.1-beta.294",
   "description": "MirrorX runtime connector CLI and daemon",
   "license": "MIT",
   "type": "module",