From fa9bb672e0b67100453a792670c2cce9b6485ba8 Mon Sep 17 00:00:00 2001
From: pdparchitect <pdp@gnucitizen.org>
Date: Fri, 31 Jul 2026 11:36:45 +0000
Subject: [PATCH] - feat: update to version 0.5.6, enhance runtime
 configuration handling for fixed-ownership mounts

---
 CHANGELOG.md                                    |  8 ++++++++
 VERSION                                         |  2 +-
 .../desktop/startup.d/05-agent-runtime-trust    | 17 ++++++++++++-----
 tests/test-agent-runtime-login.sh               | 11 +++++++++++
 4 files changed, 32 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 651027b..c9df4f6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,14 @@ All notable changes to Buzznode are documented here, following
 
 ## [Unreleased]
 
+## [0.5.6] - 2026-07-31
+
+### Fixed
+
+- Write Codex and Claude runtime configuration without requesting ownership
+  changes when Apple `container` has selected the VM root account for
+  fixed-ownership mounts.
+
 ## [0.5.5] - 2026-07-31
 
 ### Fixed
diff --git a/VERSION b/VERSION
index d1d899f..b49b253 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-0.5.5
+0.5.6
diff --git a/overlay/etc/desktop/startup.d/05-agent-runtime-trust b/overlay/etc/desktop/startup.d/05-agent-runtime-trust
index 5f7b71f..1cf73f2 100755
--- a/overlay/etc/desktop/startup.d/05-agent-runtime-trust
+++ b/overlay/etc/desktop/startup.d/05-agent-runtime-trust
@@ -21,8 +21,13 @@ home_dir="/home/agent"
 harness_workdir="${BUZZNODE_HARNESS_WORKDIR:-/workspace}"
 codex_config="$home_dir/.codex/config.toml"
 
-install_as_runtime_user() {
-    install -m 0600 -o "$runtime_user" -g "$runtime_user" "$1" "$2"
+write_runtime_config() {
+    # Fixed-ownership VirtioFS rejects install's implicit chmod and chown.
+    if [ "$runtime_user" = root ]; then
+        cp "$1" "$2"
+    else
+        install -m 0600 -o "$runtime_user" -g "$runtime_user" "$1" "$2"
+    fi
 }
 
 # Codex sandboxes the commands it runs with bubblewrap, and warns when it has to
@@ -46,7 +51,7 @@ if [ -n "$codex_sandbox_mode" ] &&
         printf 'sandbox_mode = "%s"\n\n' "$codex_sandbox_mode"
         [ -s "$codex_config" ] && cat "$codex_config"
     } > "$codex_sandbox_tmp"
-    install_as_runtime_user "$codex_sandbox_tmp" "$codex_config"
+    write_runtime_config "$codex_sandbox_tmp" "$codex_config"
     rm -f "$codex_sandbox_tmp"
     echo "[buzznode] set Codex sandbox_mode=$codex_sandbox_mode" \
         "(no usable bubblewrap in a container)"
@@ -59,7 +64,9 @@ fi
 if ! grep -Fq "[projects.\"$harness_workdir\"]" "$codex_config" 2>/dev/null; then
     printf '\n[projects."%s"]\ntrust_level = "trusted"\n' \
         "$harness_workdir" >> "$codex_config"
-    chown "$runtime_user:$runtime_user" "$codex_config"
+    if [ "$runtime_user" != root ]; then
+        chown "$runtime_user:$runtime_user" "$codex_config"
+    fi
     echo "[buzznode] recorded $harness_workdir as trusted for Codex"
 fi
 
@@ -74,7 +81,7 @@ if ! jq -e --arg dir "$harness_workdir" \
     if jq --arg dir "$harness_workdir" \
         '.projects[$dir].hasTrustDialogAccepted = true' \
         "$claude_config" > "$claude_trust_tmp" 2>/dev/null; then
-        install_as_runtime_user "$claude_trust_tmp" "$claude_config"
+        write_runtime_config "$claude_trust_tmp" "$claude_config"
         echo "[buzznode] recorded $harness_workdir as trusted for Claude Code"
     fi
     rm -f "$claude_trust_tmp"
diff --git a/tests/test-agent-runtime-login.sh b/tests/test-agent-runtime-login.sh
index 22ee327..43aeb3b 100755
--- a/tests/test-agent-runtime-login.sh
+++ b/tests/test-agent-runtime-login.sh
@@ -83,5 +83,16 @@ grep -Fq 'hasTrustDialogAccepted' "$project_dir/overlay/etc/desktop/startup.d/05
 # The directory trusted at boot must be the one the harness is launched in.
 grep -Fq 'BUZZNODE_HARNESS_WORKDIR:-/workspace' "$project_dir/overlay/etc/desktop/startup.d/05-agent-runtime-trust"
 grep -Fq 'cd /workspace' "$project_dir/overlay/usr/local/bin/buzznode"
+# Apple `container` runs the desktop as root after detecting fixed-ownership
+# mounts. That path must copy configuration without requesting an ownership
+# change which VirtioFS will reject.
+grep -Fq 'if [ "$runtime_user" = root ]; then' \
+    "$project_dir/overlay/etc/desktop/startup.d/05-agent-runtime-trust"
+grep -Fq 'if [ "$runtime_user" != root ]; then' \
+    "$project_dir/overlay/etc/desktop/startup.d/05-agent-runtime-trust"
+grep -Fq 'write_runtime_config()' \
+    "$project_dir/overlay/etc/desktop/startup.d/05-agent-runtime-trust"
+! grep -Fq 'install_as_runtime_user' \
+    "$project_dir/overlay/etc/desktop/startup.d/05-agent-runtime-trust"
 
 echo "Agent runtime login tests passed."