Release pdparchitect-buzznode

CHANGELOG.md

@@ -6,6 +6,14 @@ All notable changes to Buzznode are documented here, following
 
 ## [Unreleased]
 
+## [0.5.6] - 2026-07-31
+
+### Fixed
+
+- Write Codex and Claude runtime configuration without requesting ownership
+  changes when Apple `container` has selected the VM root account for
+  fixed-ownership mounts.
+
 ## [0.5.5] - 2026-07-31
 
 ### Fixed

VERSION

@@ -1 +1 @@
-0.5.5
+0.5.6

overlay/etc/desktop/startup.d/05-agent-runtime-trust

@@ -21,8 +21,13 @@ home_dir="/home/agent"
 harness_workdir="${BUZZNODE_HARNESS_WORKDIR:-/workspace}"
 codex_config="$home_dir/.codex/config.toml"
 
-install_as_runtime_user() {
-    install -m 0600 -o "$runtime_user" -g "$runtime_user" "$1" "$2"
+write_runtime_config() {
+    # Fixed-ownership VirtioFS rejects install's implicit chmod and chown.
+    if [ "$runtime_user" = root ]; then
+        cp "$1" "$2"
+    else
+        install -m 0600 -o "$runtime_user" -g "$runtime_user" "$1" "$2"
+    fi
 }
 
 # Codex sandboxes the commands it runs with bubblewrap, and warns when it has to
@@ -46,7 +51,7 @@ if [ -n "$codex_sandbox_mode" ] &&
         printf 'sandbox_mode = "%s"\n\n' "$codex_sandbox_mode"
         [ -s "$codex_config" ] && cat "$codex_config"
     } > "$codex_sandbox_tmp"
-    install_as_runtime_user "$codex_sandbox_tmp" "$codex_config"
+    write_runtime_config "$codex_sandbox_tmp" "$codex_config"
     rm -f "$codex_sandbox_tmp"
     echo "[buzznode] set Codex sandbox_mode=$codex_sandbox_mode" \
         "(no usable bubblewrap in a container)"
@@ -59,7 +64,9 @@ fi
 if ! grep -Fq "[projects.\"$harness_workdir\"]" "$codex_config" 2>/dev/null; then
     printf '\n[projects."%s"]\ntrust_level = "trusted"\n' \
         "$harness_workdir" >> "$codex_config"
-    chown "$runtime_user:$runtime_user" "$codex_config"
+    if [ "$runtime_user" != root ]; then
+        chown "$runtime_user:$runtime_user" "$codex_config"
+    fi
     echo "[buzznode] recorded $harness_workdir as trusted for Codex"
 fi
 
@@ -74,7 +81,7 @@ if ! jq -e --arg dir "$harness_workdir" \
     if jq --arg dir "$harness_workdir" \
         '.projects[$dir].hasTrustDialogAccepted = true' \
         "$claude_config" > "$claude_trust_tmp" 2>/dev/null; then
-        install_as_runtime_user "$claude_trust_tmp" "$claude_config"
+        write_runtime_config "$claude_trust_tmp" "$claude_config"
         echo "[buzznode] recorded $harness_workdir as trusted for Claude Code"
     fi
     rm -f "$claude_trust_tmp"

tests/test-agent-runtime-login.sh

@@ -83,5 +83,16 @@ grep -Fq 'hasTrustDialogAccepted' "$project_dir/overlay/etc/desktop/startup.d/05
 # The directory trusted at boot must be the one the harness is launched in.
 grep -Fq 'BUZZNODE_HARNESS_WORKDIR:-/workspace' "$project_dir/overlay/etc/desktop/startup.d/05-agent-runtime-trust"
 grep -Fq 'cd /workspace' "$project_dir/overlay/usr/local/bin/buzznode"
+# Apple `container` runs the desktop as root after detecting fixed-ownership
+# mounts. That path must copy configuration without requesting an ownership
+# change which VirtioFS will reject.
+grep -Fq 'if [ "$runtime_user" = root ]; then' \
+    "$project_dir/overlay/etc/desktop/startup.d/05-agent-runtime-trust"
+grep -Fq 'if [ "$runtime_user" != root ]; then' \
+    "$project_dir/overlay/etc/desktop/startup.d/05-agent-runtime-trust"
+grep -Fq 'write_runtime_config()' \
+    "$project_dir/overlay/etc/desktop/startup.d/05-agent-runtime-trust"
+! grep -Fq 'install_as_runtime_user' \
+    "$project_dir/overlay/etc/desktop/startup.d/05-agent-runtime-trust"
 
 echo "Agent runtime login tests passed."