@amaster.ai/employee-runtime-connector 0.1.2 → 0.1.3

package/README.md

@@ -78,19 +78,38 @@ configure a connector-local capability list. Historical `AMASTER_CAPABILITIES` a
 but are ignored and reported as deprecated. They cannot add, remove, or authorize a
 capability.
 
-`browser_credential_auth_transaction_v1` is the fail-closed browser-password
-capability. It is advertised only when a Pi executor is present and the installed
-`@amaster.ai/pi-browser-use` entrypoint self-attests the sealed gate, private FD
-client, and atomic submit transaction in its package manifest. The connector does
-not infer readiness from a version number. The retired
-`browser_credential_ref_fill_v1` claim is retained only in shared decode vocabulary
-for historical rows and is never advertised or accepted as the new contract.
-
-Credential values travel only over dedicated inherited file descriptors after the
-browser extension validates the exact origin and form semantics. The extension
-atomically fills, submits, scrubs, rotates the document context, and returns
-metadata-only proof. Missing FD/client/gate/transaction/profile readiness fails
-closed; there is no ordinary fill fallback.
+`browser_credential_env_read_v1` is the current managed-sandbox credential capability. It is
+advertised only when a Pi executor runs under a separate non-root UID in a
+`cloud_managed` Runner and the runner-owned
+`browser-credential-env.mjs` extension is a regular file with the expected tool and
+environment contract. For a credential-bearing command, the connector consumes
+the Server-authorized refs after acknowledgement, writes fixed
+`BROWSER_USERNAME` / `BROWSER_PASSWORD` keys to a private command-scoped `.env`
+outside the model workspace, passes only its path to the Pi child, redacts the
+values from connector logs/results, and removes the file at command cleanup.
+
+This approved fallback is intentionally model-visible: `browser_read_credential`
+returns a selected value to the model, which then uses ordinary browser fill/click
+tools. It is not the former sealed transaction design and does not claim that the
+value is hidden from the model. Origin mismatch, ambiguous credential sets,
+missing extension readiness, and materialization failures fail closed. The saved
+Server secret remains reusable by later authorized commands, so the user does not
+need to provide the password again.
+
+The private path and file mode are lifecycle and cross-process hygiene, not a
+confidentiality boundary against the Pi child: the model can intentionally obtain
+each authorized value through `browser_read_credential`. Desktop-delegated,
+same-UID, and non-Pi runners must not advertise or execute this capability.
+
+`browser_credential_auth_transaction_v1` remains build/runtime vocabulary for the
+older private-FD prototype and is advertised only if its complete Pi browser TCB
+is present. New browser-credential dispatches require
+`browser_credential_env_read_v1`; they never treat the older capability as
+equivalent. The retired `browser_credential_ref_fill_v1` claim is decode-only.
+Commands carrying credential refs are routed only by their exact required
+capability: the current capability selects the `.env` path, the legacy capability
+selects the private-FD consumer, both together are rejected, and neither is not
+silently upgraded.
 
 The publish workflow verifies that npm records the publishing commit as the package `gitHead`, then updates the repository deployment pin. Remote deployment accepts that package only when its `gitHead` is an ancestor of the target source commit and the connector package path is unchanged between them. If another workspace source becomes a runtime build input, expand the provenance scope and tests before release. After restart, deployment also verifies the package CLI version inside the container. Do not update the deployment pin manually to bypass either provenance check.
 
@@ -98,7 +117,7 @@ The publish workflow verifies that npm records the publishing commit as the pack
 
 ## Pi plugin ownership boundary
 
-`pi-cli-runtime` owns Pi plugin installation, versions, package resolution, and configuration. The connector must only start Pi, deliver a command, manage its process lifecycle, and return its result. Do not add Pi-plugin version/digest/config admission checks to connector registration, heartbeat, or ordinary command dispatch. The one security-boundary exception is the manifest capability/entrypoint attestation for `browser_credential_auth_transaction_v1`; a half-installed or older browser extension must make that capability absent before dispatch. Other plugin failures remain task execution evidence, not connector admission decisions.
+`pi-cli-runtime` owns Pi plugin installation, versions, package resolution, and configuration. The connector must only start Pi, deliver a command, manage its process lifecycle, and return its result. Do not add Pi-plugin version/digest/config admission checks to connector registration, heartbeat, or ordinary command dispatch. Credential capabilities are the narrow exceptions: the legacy private transaction attests its package manifest and TCB, while `browser_credential_env_read_v1` attests the runner-owned extension entrypoint. An absent or unexpected extension must remove the corresponding capability before dispatch. Other plugin failures remain task execution evidence, not connector admission decisions.
 
 - `dist/amaster-runtime.mjs`: configuration, pairing, workspace, diagnostics, and daemon lifecycle CLI.
 - `dist/amaster-runtime-daemon.mjs`: standalone daemon bundle for connector registration, heartbeat, command execution, and result ingestion.

package/dist/amaster-runtime-daemon/capability-registry.mjs

@@ -18,6 +18,7 @@ export const BUILD_SUPPORTED_CAPABILITIES = Object.freeze([
   "run_terminate",
   "logs_cost_workspace_status",
   "browser_credential_auth_transaction_v1",
+  "browser_credential_env_read_v1",
   "execution_lanes_v1",
   "mirrorx_initialization_context_v1",
   "mirrorx_initialization_completion_v1",
@@ -25,6 +26,18 @@ export const BUILD_SUPPORTED_CAPABILITIES = Object.freeze([
 ]);
 
 const DYNAMIC_READINESS = Object.freeze({
+  browser_credential_env_read_v1: {
+    reasonCode: "browser_credential_env_runtime_incomplete",
+    ready: (input) => input.executors.some((executor) => executor.kind === "pi")
+      && input.browserCredentialEnv?.extension === true
+      && input.runnerKind === "cloud_managed"
+      && Number.isSafeInteger(input.piExecutorUid)
+      && Number.isSafeInteger(input.piExecutorGid)
+      && input.piExecutorUid > 0
+      && input.piExecutorGid > 0
+      && Number.isSafeInteger(input.connectorUid)
+      && input.piExecutorUid !== input.connectorUid,
+  },
   browser_credential_auth_transaction_v1: {
     reasonCode: "browser_credential_auth_runtime_incomplete",
     ready: (input) => {