@amaster.ai/employee-runtime-connector 0.1.1-beta.296 → 0.1.1-beta.297

package/dist/amaster-runtime-daemon.mjs

@@ -34380,7 +34380,7 @@ function assertRequiredTaskAttachmentMaterialized(input, materialized) {
 }
 
 // src/amaster-runtime-daemon.mjs
-var CONNECTOR_VERSION = "0.1.1-beta.296";
+var CONNECTOR_VERSION = "0.1.1-beta.297";
 var CONNECTOR_CONTRACT_VERSION = "2026-06-04.v1";
 var daemonRequire = createRequire(import.meta.url);
 var MAX_CHECKPOINT_BYTES = 20 * 1024 * 1024;
@@ -35076,8 +35076,13 @@ function piIsolatedChildOwnership(config) {
 function handoffPiRunPathsToChild(config, paths) {
   const ownership = piIsolatedChildOwnership(config);
   if (!ownership) return;
+  const allowedRoot = readString(config.runtimeWorkspacesRoot);
   for (const path of paths) {
-    if (typeof path === "string" && path) makePiRunPathWritable(path, ownership.uid, ownership.gid);
+    if (typeof path !== "string" || !path) continue;
+    if (allowedRoot && !pathWithin3(path, allowedRoot)) {
+      throw new Error("pi_executor_access_path_outside_runtime_root");
+    }
+    makePiRunPathWritable(path, ownership.uid, ownership.gid);
   }
 }
 function writeLocalRuntimeStatus(config, runtimeStatus) {
@@ -35783,21 +35788,16 @@ function readJsonFile2(filePath) {
     return {};
   }
 }
-async function syncPiExecutorProviderConfig(config, command, agentDir, providerConfig) {
-  if (!agentDir) return;
+function syncPiExecutorProviderConfig(config, agentDir, providerConfig) {
+  if (!agentDir) return null;
   const { modelsSynced, settingsSynced } = syncAmasterProviderFiles(agentDir, providerConfig);
   if (modelsSynced || settingsSynced) {
     handoffPiRunPathsToChild(config, [
       modelsSynced ? join19(agentDir, "models.json") : null,
       settingsSynced ? join19(agentDir, "settings.json") : null
     ]);
-    await ingestLog(config, command, "system", "info", "Synced AMaster provider config for pi executor", {
-      modelsSynced,
-      settingsSynced,
-      credentialSource: "server_command_env",
-      providerBaseUrlConfigured: Boolean(readString(providerConfig.AMASTER_PROVIDER_BASE_URL))
-    });
   }
+  return { modelsSynced, settingsSynced };
 }
 function normalizeWorkspaceContext(workspace) {
   if (typeof workspace === "string") {
@@ -39178,6 +39178,10 @@ async function ackCommand(config, command, phase = "preparing") {
 }
 async function executeRunCommand(config, command) {
   const preparationStartedAtMs = Date.now();
+  let preparationLogChain = Promise.resolve();
+  const enqueuePreparationLog = (stream, level, message, payload = {}) => {
+    preparationLogChain = preparationLogChain.then(() => ingestLog(config, command, stream, level, message, payload)).catch(() => void 0);
+  };
   const executor = selectExecutor(config, command);
   const governedMcp = asRecord(commandRuntimeAuth(command).governedMcp);
   if (Array.isArray(command.requiredCapabilities) && command.requiredCapabilities.includes("runtime_actions_v2") && (Object.keys(governedMcp).length === 0 || !MIRRORX_FORMAL_TASK_EXECUTOR_KINDS.includes(executor.kind) || readString(governedMcp.executorKind) !== executor.kind)) {
@@ -39222,7 +39226,7 @@ async function executeRunCommand(config, command) {
   }
   const executionCommand = taskSessionCheckpointUnavailable ? { ...command, payload: { ...asRecord(command.payload), nativeSession: void 0 } } : command;
   if (taskSessionCheckpointUnavailable) {
-    await ingestLog(config, command, "system", "info", "Starting fresh: no exact task-session workspace checkpoint is available", {
+    enqueuePreparationLog("system", "info", "Starting fresh: no exact task-session workspace checkpoint is available", {
       skippedReason: "native_session_checkpoint_unavailable"
     });
   }
@@ -39232,7 +39236,7 @@ async function executeRunCommand(config, command) {
     materializedAttachments = [...requiredArtifactInputs, ...await materializeIssueAttachments(config, command, workspace)];
   } catch (err) {
     if (issueAttachmentsAreRequired(command, commandTaskResourceInput(command))) throw err;
-    await ingestLog(config, command, "system", "warn", `Failed to materialize issue attachments: ${err instanceof Error ? err.message : String(err)}`, {
+    enqueuePreparationLog("system", "warn", `Failed to materialize issue attachments: ${err instanceof Error ? err.message : String(err)}`, {
       error: err instanceof Error ? err.message : String(err)
     });
   }
@@ -39256,10 +39260,6 @@ async function executeRunCommand(config, command) {
   let completionOwnsManagedMcpProfile = false;
   const trustedPiRuntimeAssertion = commandTrustedPiRuntimeAssertion(command);
   const preparationStages = [];
-  let preparationLogChain = Promise.resolve();
-  const enqueuePreparationLog = (stream, level, message, payload = {}) => {
-    preparationLogChain = preparationLogChain.then(() => ingestLog(config, command, stream, level, message, payload)).catch(() => void 0);
-  };
   const runExecutionStage = (phase, operation) => {
     const startedAtMs = Date.now();
     const recordDuration = () => preparationStages.push({
@@ -39452,12 +39452,19 @@ async function executeRunCommand(config, command) {
         agentDir = null;
       }
       try {
-        await runExecutionStage("provider_config", () => syncPiExecutorProviderConfig(
+        const providerSync = await runExecutionStage("provider_config", () => syncPiExecutorProviderConfig(
           config,
-          command,
           agentDir,
           piResolvedProviderConfig
         ));
+        if (providerSync && (providerSync.modelsSynced || providerSync.settingsSynced)) {
+          enqueuePreparationLog("system", "info", "Synced AMaster provider config for pi executor", {
+            modelsSynced: providerSync.modelsSynced,
+            settingsSynced: providerSync.settingsSynced,
+            credentialSource: "server_command_env",
+            providerBaseUrlConfigured: Boolean(readString(piResolvedProviderConfig.AMASTER_PROVIDER_BASE_URL))
+          });
+        }
       } catch (error2) {
         if (managedMcpProfile && cleanupManagedMcpProfile) {
           cleanupManagedMcpProfile(managedMcpProfile, {
@@ -39605,7 +39612,6 @@ async function executeRunCommand(config, command) {
         currentRunContractShadow: contextManifest.currentRunContractShadow
       });
     }
-    await preparationLogChain;
     await ackCommand(config, command, "spawned");
     enqueuePreparationLog("system", "info", `Starting ${executor.kind} executor`, {
       executorKind: executor.kind,

package/dist/amaster-runtime.mjs

@@ -7,7 +7,7 @@ import { homedir, hostname } from "node:os";
 import { fileURLToPath } from "node:url";
 import { BUILD_SUPPORTED_CAPABILITIES } from "./amaster-runtime-daemon/capability-registry.mjs";
 
-const CONNECTOR_VERSION = "0.1.1-beta.296";
+const CONNECTOR_VERSION = "0.1.1-beta.297";
 
 const CONFIG_KEY_MAP = new Map([
   ["server_url", "AMASTER_EMPLOYEE_SERVER_URL"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amaster.ai/employee-runtime-connector",
-  "version": "0.1.1-beta.296",
+  "version": "0.1.1-beta.297",
   "description": "MirrorX runtime connector CLI and daemon",
   "license": "MIT",
   "type": "module",