@amaster.ai/employee-runtime-connector 0.1.1-beta.296 → 0.1.1-beta.298

package/dist/amaster-runtime-daemon.mjs

@@ -34380,7 +34380,7 @@ function assertRequiredTaskAttachmentMaterialized(input, materialized) {
 }
 
 // src/amaster-runtime-daemon.mjs
-var CONNECTOR_VERSION = "0.1.1-beta.296";
+var CONNECTOR_VERSION = "0.1.1-beta.298";
 var CONNECTOR_CONTRACT_VERSION = "2026-06-04.v1";
 var daemonRequire = createRequire(import.meta.url);
 var MAX_CHECKPOINT_BYTES = 20 * 1024 * 1024;
@@ -35076,8 +35076,13 @@ function piIsolatedChildOwnership(config) {
 function handoffPiRunPathsToChild(config, paths) {
   const ownership = piIsolatedChildOwnership(config);
   if (!ownership) return;
+  const allowedRoot = readString(config.runtimeWorkspacesRoot);
   for (const path of paths) {
-    if (typeof path === "string" && path) makePiRunPathWritable(path, ownership.uid, ownership.gid);
+    if (typeof path !== "string" || !path) continue;
+    if (allowedRoot && !pathWithin3(path, allowedRoot)) {
+      throw new Error("pi_executor_access_path_outside_runtime_root");
+    }
+    makePiRunPathWritable(path, ownership.uid, ownership.gid);
   }
 }
 function writeLocalRuntimeStatus(config, runtimeStatus) {
@@ -35783,21 +35788,15 @@ function readJsonFile2(filePath) {
     return {};
   }
 }
-async function syncPiExecutorProviderConfig(config, command, agentDir, providerConfig) {
-  if (!agentDir) return;
+function syncPiExecutorProviderConfig(config, agentDir, providerConfig) {
+  if (!agentDir) return null;
   const { modelsSynced, settingsSynced } = syncAmasterProviderFiles(agentDir, providerConfig);
-  if (modelsSynced || settingsSynced) {
-    handoffPiRunPathsToChild(config, [
-      modelsSynced ? join19(agentDir, "models.json") : null,
-      settingsSynced ? join19(agentDir, "settings.json") : null
-    ]);
-    await ingestLog(config, command, "system", "info", "Synced AMaster provider config for pi executor", {
-      modelsSynced,
-      settingsSynced,
-      credentialSource: "server_command_env",
-      providerBaseUrlConfigured: Boolean(readString(providerConfig.AMASTER_PROVIDER_BASE_URL))
-    });
-  }
+  if (!modelsSynced && !settingsSynced) return null;
+  handoffPiRunPathsToChild(config, [
+    modelsSynced ? join19(agentDir, "models.json") : null,
+    settingsSynced ? join19(agentDir, "settings.json") : null
+  ]);
+  return { modelsSynced, settingsSynced };
 }
 function normalizeWorkspaceContext(workspace) {
   if (typeof workspace === "string") {
@@ -35949,10 +35948,6 @@ async function materializeEffectiveAgentInstructions(config, command, workspace,
       agentInstructionRevisionId: readString(instructionContract.revisionId),
       agentInstructionContentHash: readString(instructionContract.contentHash)
     });
-    await ingestLog(config, command, "system", "info", `Materialized ${materialized.length} agent instruction file(s) into the execution workspace`, {
-      fileCount: materialized.length,
-      files: materialized.map((entry) => entry.path)
-    });
   }
   return materialized;
 }
@@ -38741,14 +38736,6 @@ async function materializeIssueAttachments(config, command, workspace) {
         sha256: attachment.sha256 ?? null
       }))
     });
-    await ingestLog(config, command, "system", "info", `Materialized ${materialized.length} issue attachment(s) into the execution workspace`, {
-      attachmentCount: materialized.length,
-      attachments: materialized.map((attachment) => ({
-        id: attachment.id ?? null,
-        name: attachment.name,
-        path: attachment.relativePath
-      }))
-    });
   }
   return materialized;
 }
@@ -38832,10 +38819,6 @@ async function materializeRequiredArtifactInputs(config, command, workspace) {
   writeFileSync12(manifestPath, JSON.stringify(localManifest, null, 2) + "\n");
   chmodSync8(manifestPath, 292);
   updateWorkspaceManifest(workspaceManifestPath(workspace), { artifactInputManifest: localManifest });
-  await ingestLog(config, command, "system", "info", `Materialized ${materialized.length} required artifact input(s) into the execution workspace`, {
-    artifactInputCount: materialized.length,
-    artifactInputs: localManifest.entries
-  });
   return materialized;
 }
 function issueCheckpointDir(workspace) {
@@ -38896,7 +38879,7 @@ async function materializeIssueCheckpoint(config, command, workspace) {
   const checkpointDir = issueCheckpointDir(workspace);
   const manifestPath = join19(checkpointDir, "manifest.json");
   const expectedContinuation = expectedContinuationCheckpoint(command);
-  const unavailable2 = { files: [], taskSessionRestored: false };
+  const unavailable2 = { files: [], taskSessionRestored: false, checkpointExpiresAt: null };
   if (!existsSync18(manifestPath)) {
     if (expectedContinuation) throw new Error("continuation_checkpoint_unavailable: manifest_missing");
     return unavailable2;
@@ -39003,13 +38986,11 @@ async function materializeIssueCheckpoint(config, command, workspace) {
       }
       materialized.push(relativePath);
     }
-    if (materialized.length > 0) {
-      await ingestLog(config, command, "system", "info", `Materialized ${materialized.length} checkpoint file(s) into the execution workspace`, {
-        checkpointFiles: materialized,
-        checkpointExpiresAt: new Date(expiresAt).toISOString()
-      });
-    }
-    return { files: materialized, taskSessionRestored };
+    return {
+      files: materialized,
+      taskSessionRestored,
+      checkpointExpiresAt: new Date(expiresAt).toISOString()
+    };
   } catch (restoreErr) {
     try {
       await clearIssueCheckpoint(config, command, workspace, "restore_failed");
@@ -39178,6 +39159,10 @@ async function ackCommand(config, command, phase = "preparing") {
 }
 async function executeRunCommand(config, command) {
   const preparationStartedAtMs = Date.now();
+  let preparationLogChain = Promise.resolve();
+  const enqueuePreparationLog = (stream, level, message, payload = {}) => {
+    preparationLogChain = preparationLogChain.then(() => ingestLog(config, command, stream, level, message, payload)).catch(() => void 0);
+  };
   const executor = selectExecutor(config, command);
   const governedMcp = asRecord(commandRuntimeAuth(command).governedMcp);
   if (Array.isArray(command.requiredCapabilities) && command.requiredCapabilities.includes("runtime_actions_v2") && (Object.keys(governedMcp).length === 0 || !MIRRORX_FORMAL_TASK_EXECUTOR_KINDS.includes(executor.kind) || readString(governedMcp.executorKind) !== executor.kind)) {
@@ -39192,6 +39177,12 @@ async function executeRunCommand(config, command) {
     workspace,
     contextContract.instructions
   );
+  if (materializedAgentInstructions.length > 0) {
+    enqueuePreparationLog("system", "info", `Materialized ${materializedAgentInstructions.length} agent instruction file(s) into the execution workspace`, {
+      fileCount: materializedAgentInstructions.length,
+      files: materializedAgentInstructions.map((entry) => entry.path)
+    });
+  }
   const workspaceProjectInstructionReceipt = projectExternalWorkspaceProjectInstructions(
     workspace.sourceWorkspacePath,
     workspace.cwd,
@@ -39214,6 +39205,12 @@ async function executeRunCommand(config, command) {
     workspaceProjectInstructionProjection: workspaceProjectInstructionReceipt
   });
   const restoredCheckpoint = await materializeIssueCheckpoint(config, command, workspace);
+  if (restoredCheckpoint.files.length > 0) {
+    enqueuePreparationLog("system", "info", `Materialized ${restoredCheckpoint.files.length} checkpoint file(s) into the execution workspace`, {
+      checkpointFiles: restoredCheckpoint.files,
+      checkpointExpiresAt: restoredCheckpoint.checkpointExpiresAt
+    });
+  }
   const materializedCheckpointFiles = restoredCheckpoint.files;
   const requestedNativeSession = asRecord(asRecord(command.payload).nativeSession);
   const taskSessionCheckpointUnavailable = Object.keys(governedMcp).length > 0 && requestedNativeSession.mode === "task_session" && !expectedContinuationCheckpoint(command) && !restoredCheckpoint.taskSessionRestored;
@@ -39222,17 +39219,34 @@ async function executeRunCommand(config, command) {
   }
   const executionCommand = taskSessionCheckpointUnavailable ? { ...command, payload: { ...asRecord(command.payload), nativeSession: void 0 } } : command;
   if (taskSessionCheckpointUnavailable) {
-    await ingestLog(config, command, "system", "info", "Starting fresh: no exact task-session workspace checkpoint is available", {
+    enqueuePreparationLog("system", "info", "Starting fresh: no exact task-session workspace checkpoint is available", {
       skippedReason: "native_session_checkpoint_unavailable"
     });
   }
   const requiredArtifactInputs = await materializeRequiredArtifactInputs(config, command, workspace);
+  if (requiredArtifactInputs.length > 0) {
+    enqueuePreparationLog("system", "info", `Materialized ${requiredArtifactInputs.length} required artifact input(s) into the execution workspace`, {
+      artifactInputCount: requiredArtifactInputs.length,
+      artifactInputs: requiredArtifactInputs.map(({ path: _path, relativePath, ...entry }) => ({ ...entry, path: relativePath }))
+    });
+  }
   let materializedAttachments = requiredArtifactInputs;
   try {
-    materializedAttachments = [...requiredArtifactInputs, ...await materializeIssueAttachments(config, command, workspace)];
+    const issueAttachments = await materializeIssueAttachments(config, command, workspace);
+    if (issueAttachments.length > 0) {
+      enqueuePreparationLog("system", "info", `Materialized ${issueAttachments.length} issue attachment(s) into the execution workspace`, {
+        attachmentCount: issueAttachments.length,
+        attachments: issueAttachments.map((attachment) => ({
+          id: attachment.id ?? null,
+          name: attachment.name,
+          path: attachment.relativePath
+        }))
+      });
+    }
+    materializedAttachments = [...requiredArtifactInputs, ...issueAttachments];
   } catch (err) {
     if (issueAttachmentsAreRequired(command, commandTaskResourceInput(command))) throw err;
-    await ingestLog(config, command, "system", "warn", `Failed to materialize issue attachments: ${err instanceof Error ? err.message : String(err)}`, {
+    enqueuePreparationLog("system", "warn", `Failed to materialize issue attachments: ${err instanceof Error ? err.message : String(err)}`, {
       error: err instanceof Error ? err.message : String(err)
     });
   }
@@ -39256,10 +39270,6 @@ async function executeRunCommand(config, command) {
   let completionOwnsManagedMcpProfile = false;
   const trustedPiRuntimeAssertion = commandTrustedPiRuntimeAssertion(command);
   const preparationStages = [];
-  let preparationLogChain = Promise.resolve();
-  const enqueuePreparationLog = (stream, level, message, payload = {}) => {
-    preparationLogChain = preparationLogChain.then(() => ingestLog(config, command, stream, level, message, payload)).catch(() => void 0);
-  };
   const runExecutionStage = (phase, operation) => {
     const startedAtMs = Date.now();
     const recordDuration = () => preparationStages.push({
@@ -39452,12 +39462,19 @@ async function executeRunCommand(config, command) {
         agentDir = null;
       }
       try {
-        await runExecutionStage("provider_config", () => syncPiExecutorProviderConfig(
+        const providerSync = await runExecutionStage("provider_config", () => syncPiExecutorProviderConfig(
           config,
-          command,
           agentDir,
           piResolvedProviderConfig
         ));
+        if (providerSync) {
+          enqueuePreparationLog("system", "info", "Synced AMaster provider config for pi executor", {
+            modelsSynced: providerSync.modelsSynced,
+            settingsSynced: providerSync.settingsSynced,
+            credentialSource: "server_command_env",
+            providerBaseUrlConfigured: Boolean(readString(piResolvedProviderConfig.AMASTER_PROVIDER_BASE_URL))
+          });
+        }
       } catch (error2) {
         if (managedMcpProfile && cleanupManagedMcpProfile) {
           cleanupManagedMcpProfile(managedMcpProfile, {
@@ -39605,7 +39622,6 @@ async function executeRunCommand(config, command) {
         currentRunContractShadow: contextManifest.currentRunContractShadow
       });
     }
-    await preparationLogChain;
     await ackCommand(config, command, "spawned");
     enqueuePreparationLog("system", "info", `Starting ${executor.kind} executor`, {
       executorKind: executor.kind,

package/dist/amaster-runtime.mjs

@@ -7,7 +7,7 @@ import { homedir, hostname } from "node:os";
 import { fileURLToPath } from "node:url";
 import { BUILD_SUPPORTED_CAPABILITIES } from "./amaster-runtime-daemon/capability-registry.mjs";
 
-const CONNECTOR_VERSION = "0.1.1-beta.296";
+const CONNECTOR_VERSION = "0.1.1-beta.298";
 
 const CONFIG_KEY_MAP = new Map([
   ["server_url", "AMASTER_EMPLOYEE_SERVER_URL"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amaster.ai/employee-runtime-connector",
-  "version": "0.1.1-beta.296",
+  "version": "0.1.1-beta.298",
   "description": "MirrorX runtime connector CLI and daemon",
   "license": "MIT",
   "type": "module",