@amaster.ai/employee-runtime-connector 0.1.1-beta.293 → 0.1.1-beta.295

package/dist/amaster-runtime-daemon.mjs

@@ -9141,8 +9141,27 @@ var goalCriterionProgressReadModelSchema = external_exports.object({
   expectedDecisionToken: sha256Schema5.nullable(),
   snoozedUntil: external_exports.string().datetime().nullable()
 }).strict();
+var goalCompletionSummaryBaseSchema = external_exports.object({
+  basis: external_exports.literal("acceptance_criteria"),
+  satisfiedCount: external_exports.number().int().nonnegative(),
+  applicableCount: external_exports.number().int().nonnegative()
+});
+var goalCompletionSummarySchema = external_exports.discriminatedUnion("state", [
+  goalCompletionSummaryBaseSchema.extend({
+    state: external_exports.literal("ready"),
+    applicableCount: external_exports.number().int().positive(),
+    percent: external_exports.number().int().min(0).max(100),
+    authorityRevision: external_exports.number().int().positive()
+  }).strict(),
+  goalCompletionSummaryBaseSchema.extend({
+    state: external_exports.literal("unavailable"),
+    percent: external_exports.null(),
+    authorityRevision: external_exports.number().int().positive().nullable()
+  }).strict()
+]);
 var goalCriteriaProgressReadModelSchema = external_exports.object({
-  items: external_exports.array(goalCriterionProgressReadModelSchema)
+  items: external_exports.array(goalCriterionProgressReadModelSchema),
+  completion: goalCompletionSummarySchema
 }).strict();
 var DEFAULT_CONTINUE_PROGRESS_RATIONALE = "Board \u786E\u8BA4\u5F53\u524D\u4E1A\u52A1\u7ED3\u679C\u5C1A\u672A\u8FBE\u5230\uFF0C\u7EE7\u7EED\u63A8\u8FDB\u3002";
 var DEFAULT_KEEP_IN_GOAL_RATIONALE = "\u516C\u53F8\u8D1F\u8D23\u4EBA\u786E\u8BA4\u8FD9\u6761\u8FBE\u6210\u6807\u51C6\u4ECD\u9002\u7528\u4E8E\u5F53\u524D\u76EE\u6807\u3002";
@@ -12949,6 +12968,21 @@ var boardReactivateBusinessDemandAutomationRuleSchema = external_exports.object(
   rationale: external_exports.string().trim().min(1).max(2e3)
 }).strict();
 
+// ../shared/src/goal-action-semantics.ts
+var GOAL_ACTION_INTERACTION_PURPOSE_CODES = [
+  "goal_gap_authority_exception",
+  "goal_gap_observed_effect",
+  "goal_gap_fact_correction",
+  "goal_gap_legacy_outcome_attribution",
+  "goal_gap_work_purpose_catalog_candidate"
+];
+var GOAL_ACTION_KINDS = [
+  "criterion_decision",
+  "legacy_outcome_attribution",
+  "business_demand_decision"
+];
+var PURPOSE_CODES = new Set(GOAL_ACTION_INTERACTION_PURPOSE_CODES);
+
 // ../shared/src/types/governed-mcp.ts
 var GOVERNED_MCP_GATEWAY_ROUTE_PATH = "/tool-gateway/mcp";
 var GOVERNED_MCP_GATEWAY_API_PATH = `/api${GOVERNED_MCP_GATEWAY_ROUTE_PATH}`;
@@ -13599,7 +13633,7 @@ var mirrorXIssueHandlingListResponseSchema = external_exports.object({
 }).strict();
 
 // ../shared/src/types/inbox-action-items.ts
-var INBOX_ACTION_ITEMS_SCHEMA_VERSION = "mirrorx_inbox_action_items/v1";
+var INBOX_ACTION_ITEMS_SCHEMA_VERSION = "mirrorx_inbox_action_items/v2";
 var INBOX_ACTION_ITEM_KINDS = [
   "issue",
   "approval",
@@ -13654,6 +13688,8 @@ var inboxActionItemSchema = external_exports.object({
     label: external_exports.string().min(1)
   }).strict(),
   resourceId: external_exports.string().min(1),
+  attentionScope: external_exports.enum(["task", "goal", "company"]),
+  goalActionKind: external_exports.enum(GOAL_ACTION_KINDS).nullable(),
   goalId: external_exports.string().uuid().nullable().optional(),
   issueId: external_exports.string().uuid().nullable(),
   issueIdentifier: external_exports.string().nullable(),
@@ -17764,20 +17800,22 @@ function isWithin(path, root) {
 function makePiRunPathWritable(path, uid, gid, fs = defaultFs) {
   const visit = (entryPath) => {
     const stat = fs.lstatSync(entryPath);
+    const ownedByTarget = stat.uid === uid && stat.gid === gid;
     if (stat.isSymbolicLink()) {
-      fs.lchownSync(entryPath, uid, gid);
+      if (!ownedByTarget) fs.lchownSync(entryPath, uid, gid);
       return;
     }
     if (stat.isDirectory()) {
-      fs.chmodSync(entryPath, 448);
+      if ((stat.mode & 511) !== 448) fs.chmodSync(entryPath, 448);
       for (const entry of fs.readdirSync(entryPath)) {
         visit(resolve(entryPath, entry));
       }
-      fs.chownSync(entryPath, uid, gid);
+      if (!ownedByTarget) fs.chownSync(entryPath, uid, gid);
       return;
     }
-    fs.chmodSync(entryPath, 384 | stat.mode & 73);
-    fs.chownSync(entryPath, uid, gid);
+    const desiredMode = 384 | stat.mode & 73;
+    if ((stat.mode & 511) !== desiredMode) fs.chmodSync(entryPath, desiredMode);
+    if (!ownedByTarget) fs.chownSync(entryPath, uid, gid);
   };
   visit(resolve(path));
 }
@@ -34342,7 +34380,7 @@ function assertRequiredTaskAttachmentMaterialized(input, materialized) {
 }
 
 // src/amaster-runtime-daemon.mjs
-var CONNECTOR_VERSION = "0.1.1-beta.293";
+var CONNECTOR_VERSION = "0.1.1-beta.295";
 var CONNECTOR_CONTRACT_VERSION = "2026-06-04.v1";
 var daemonRequire = createRequire(import.meta.url);
 var MAX_CHECKPOINT_BYTES = 20 * 1024 * 1024;
@@ -35027,6 +35065,21 @@ function buildHeartbeatPayload(config, options = {}) {
 function desktopDelegatedRunnerEnabled(config) {
   return config.runnerKind === RUNNER_KIND_DESKTOP_DELEGATED;
 }
+function piIsolatedChildOwnership(config) {
+  const uid = Number(config.piExecutorUid ?? 0);
+  const gid = Number(config.piExecutorGid ?? uid);
+  if (!Number.isSafeInteger(uid) || uid <= 0 || !Number.isSafeInteger(gid) || gid <= 0) return null;
+  if (desktopDelegatedRunnerEnabled(config)) return null;
+  if (typeof process.getuid !== "function" || process.getuid() !== 0) return null;
+  return { uid, gid };
+}
+function handoffPiRunPathsToChild(config, paths) {
+  const ownership = piIsolatedChildOwnership(config);
+  if (!ownership) return;
+  for (const path of paths) {
+    if (typeof path === "string" && path) makePiRunPathWritable(path, ownership.uid, ownership.gid);
+  }
+}
 function writeLocalRuntimeStatus(config, runtimeStatus) {
   const currentState = readState(process.env);
   writeState(process.env, {
@@ -35734,6 +35787,10 @@ async function syncPiExecutorProviderConfig(config, command, agentDir, providerC
   if (!agentDir) return;
   const { modelsSynced, settingsSynced } = syncAmasterProviderFiles(agentDir, providerConfig);
   if (modelsSynced || settingsSynced) {
+    handoffPiRunPathsToChild(config, [
+      modelsSynced ? join19(agentDir, "models.json") : null,
+      settingsSynced ? join19(agentDir, "settings.json") : null
+    ]);
     await ingestLog(config, command, "system", "info", "Synced AMaster provider config for pi executor", {
       modelsSynced,
       settingsSynced,
@@ -39199,6 +39256,10 @@ async function executeRunCommand(config, command) {
   let completionOwnsManagedMcpProfile = false;
   const trustedPiRuntimeAssertion = commandTrustedPiRuntimeAssertion(command);
   const preparationStages = [];
+  let preparationLogChain = Promise.resolve();
+  const enqueuePreparationLog = (stream, level, message, payload = {}) => {
+    preparationLogChain = preparationLogChain.then(() => ingestLog(config, command, stream, level, message, payload)).catch(() => void 0);
+  };
   const runExecutionStage = (phase, operation) => {
     const startedAtMs = Date.now();
     const recordDuration = () => preparationStages.push({
@@ -39375,7 +39436,7 @@ async function executeRunCommand(config, command) {
       if (executor.kind === "pi") {
         assertManagedPiNonInteractiveInvocation(invocation.args, managedMcpProfile);
       }
-      await ingestLog(config, command, "system", "info", desktopDelegatedRunnerEnabled(config) && executor.kind === "pi" ? "Prepared desktop delegated Pi runtime action bridge" : executor.kind === "pi" ? "Prepared isolated Pi managed MCP profile" : `Attested isolated ${executor.kind} managed MCP profile`, {
+      enqueuePreparationLog("system", "info", desktopDelegatedRunnerEnabled(config) && executor.kind === "pi" ? "Prepared desktop delegated Pi runtime action bridge" : executor.kind === "pi" ? "Prepared isolated Pi managed MCP profile" : `Attested isolated ${executor.kind} managed MCP profile`, {
         presentationKind: "managed_mcp_attestation",
         ...managedMcpProfile.attestation
       });
@@ -39500,6 +39561,7 @@ async function executeRunCommand(config, command) {
       mkdirSync10(promptDir, { recursive: true, mode: 448 });
       const promptPath = join19(promptDir, "conversation-system.md");
       writeFileSync12(promptPath, appendedSystemPrompt, { encoding: "utf8", mode: 384, flag: "wx" });
+      handoffPiRunPathsToChild(config, [promptDir, promptPath]);
       const printIndex = invocation.args.lastIndexOf("-p");
       invocation.args.splice(printIndex < 0 ? invocation.args.length : printIndex, 0, "--append-system-prompt", promptPath);
     }
@@ -39518,24 +39580,18 @@ async function executeRunCommand(config, command) {
         cwd,
         expectedSha256: finalAgentInstructionFiles.get("AGENTS.md")?.sha256
       });
-      if (config.piExecutorUid > 0 && !desktopDelegatedRunnerEnabled(config)) {
-        piExecutorIdentity = await runExecutionStage("context_attestation", () => preparePiExecutorAccess({
-          uid: config.piExecutorUid,
-          gid: config.piExecutorGid,
-          effectiveUid: typeof process.getuid === "function" ? process.getuid() : null,
-          profileRoot: managedMcpProfile.profileRoot,
-          workspaceRoot: cwd,
-          allowedRoot: config.runtimeWorkspacesRoot
-        }));
-      }
+      handoffPiRunPathsToChild(config, [
+        ...finalContextExtensions,
+        readString(asRecord(managedMcpProfile.runExitFinalContextAttestation).extensionPath)
+      ]);
     }
     const promptBudgetSummary = contextManifest.budget.totalChars === null ? `${contextManifest.budget.usedChars} characters (unbounded)` : `${contextManifest.budget.usedChars}/${contextManifest.budget.totalChars} characters`;
-    await ingestLog(config, command, "system", "info", `Compiled ${contextManifest.mode} prompt using ${promptBudgetSummary}`, {
+    enqueuePreparationLog("system", "info", `Compiled ${contextManifest.mode} prompt using ${promptBudgetSummary}`, {
       presentationKind: "context_manifest",
       contextManifest
     });
     if (contextManifest.continuationPromptContract) {
-      await ingestLog(config, command, "system", "info", "Compiled Runtime Action continuation prompt contract", {
+      enqueuePreparationLog("system", "info", "Compiled Runtime Action continuation prompt contract", {
         presentationKind: "runtime_action_continuation_prompt_contract",
         metricName: "mirrorx_runtime_continuation_prompt_generated_total",
         metricValue: 1,
@@ -39544,19 +39600,21 @@ async function executeRunCommand(config, command) {
       });
     }
     if (contextManifest.currentRunContractShadow.status !== "match") {
-      await ingestLog(config, command, "system", "warn", "Current Run Contract shadow comparison did not match the legacy runtime inference", {
+      enqueuePreparationLog("system", "warn", "Current Run Contract shadow comparison did not match the legacy runtime inference", {
         presentationKind: "current_run_contract_shadow_audit",
         currentRunContractShadow: contextManifest.currentRunContractShadow
       });
     }
+    await preparationLogChain;
     await ackCommand(config, command, "spawned");
-    await ingestLog(config, command, "system", "info", `Starting ${executor.kind} executor`, {
+    enqueuePreparationLog("system", "info", `Starting ${executor.kind} executor`, {
       executorKind: executor.kind,
       cwd,
       args: invocation.args,
       preparationElapsedMs: Math.max(0, Date.now() - preparationStartedAtMs),
       preparationStages
     });
+    await preparationLogChain;
     forgetActiveRunCommand = rememberActiveRunCommand(command, {
       executorKind: executor.kind,
       workspacePath: cwd,
@@ -40214,6 +40272,7 @@ async function executeRunCommand(config, command) {
     }
     return { resultDelivered: Boolean(completion) };
   } finally {
+    await preparationLogChain;
     if (managedMcpProfile && !managedMcpCleanup && !completionOwnsManagedMcpProfile) {
       managedMcpCleanup = cleanupManagedMcpProfile(managedMcpProfile, {
         commandId: command.commandId,

package/dist/amaster-runtime.mjs

@@ -7,7 +7,7 @@ import { homedir, hostname } from "node:os";
 import { fileURLToPath } from "node:url";
 import { BUILD_SUPPORTED_CAPABILITIES } from "./amaster-runtime-daemon/capability-registry.mjs";
 
-const CONNECTOR_VERSION = "0.1.1-beta.293";
+const CONNECTOR_VERSION = "0.1.1-beta.295";
 
 const CONFIG_KEY_MAP = new Map([
   ["server_url", "AMASTER_EMPLOYEE_SERVER_URL"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amaster.ai/employee-runtime-connector",
-  "version": "0.1.1-beta.293",
+  "version": "0.1.1-beta.295",
   "description": "MirrorX runtime connector CLI and daemon",
   "license": "MIT",
   "type": "module",