@amaster.ai/employee-runtime-connector 0.1.0-beta.32 → 0.1.0-beta.34

package/dist/amaster-runtime-daemon.mjs

@@ -3,9 +3,9 @@
 
 // src/amaster-runtime-daemon.mjs
 import { createHash as createHash8 } from "node:crypto";
-import { chmodSync as chmodSync5, copyFileSync as copyFileSync3, existsSync as existsSync10, lstatSync as lstatSync6, mkdirSync as mkdirSync6, readFileSync as readFileSync8, readdirSync as readdirSync8, realpathSync as realpathSync3, renameSync as renameSync3, rmSync as rmSync6, statSync as statSync7, symlinkSync as symlinkSync3, unlinkSync, writeFileSync as writeFileSync6 } from "node:fs";
+import { chmodSync as chmodSync5, copyFileSync as copyFileSync3, existsSync as existsSync11, lstatSync as lstatSync6, mkdirSync as mkdirSync7, readFileSync as readFileSync9, readdirSync as readdirSync8, realpathSync as realpathSync3, renameSync as renameSync4, rmSync as rmSync6, statSync as statSync7, symlinkSync as symlinkSync3, unlinkSync, writeFileSync as writeFileSync7 } from "node:fs";
 import { arch as arch3, homedir as homedir3, hostname as hostname2, platform as platform3 } from "node:os";
-import { basename as basename6, delimiter as delimiter2, dirname as dirname7, extname as extname2, isAbsolute as isAbsolute7, join as join11, relative as relative7, resolve as resolve10 } from "node:path";
+import { basename as basename6, delimiter as delimiter2, dirname as dirname8, extname as extname2, isAbsolute as isAbsolute7, join as join12, relative as relative7, resolve as resolve10 } from "node:path";
 import { spawn, spawnSync as spawnSync5 } from "node:child_process";
 
 // src/amaster-runtime-daemon/common.mjs
@@ -4745,16 +4745,18 @@ function verifyDeclaredFiles(manifest, root, label, ignoredPaths = [], enforceCo
     }
   }
   if (!enforceComplete) return;
-  const ignored = new Set(ignoredPaths);
+  const ignored = ignoredPaths.map((path) => path.split("\\").join("/"));
   const visit = (directory) => {
     for (const entry of readdirSync6(directory)) {
       const filePath = join9(directory, entry);
-      const relativePath = relative5(root, filePath);
-      if (ignored.has(relativePath)) continue;
+      const relativePath = relative5(root, filePath).split("\\").join("/");
       const stat = lstatSync5(filePath);
       if (stat.isSymbolicLink()) {
         throw new Error(`pi_trusted_runtime_source_unsafe:${label}_file`);
       }
+      if (ignored.some((path) => relativePath === path || relativePath.startsWith(`${path}/`))) {
+        continue;
+      }
       if (stat.isDirectory()) {
         visit(filePath);
       } else if (!stat.isFile() || !seen.has(relativePath)) {
@@ -5028,7 +5030,10 @@ function readTrustedPiRuntimeLocalDigests(input) {
   const seedManifest = JSON.parse(readFileSync6(seedManifestFile, "utf8"));
   const overlayManifest = JSON.parse(readFileSync6(overlayManifestFile, "utf8"));
   const policyManifest = JSON.parse(readFileSync6(policyFile, "utf8"));
-  verifyDeclaredFiles(seedManifest, seedRoot, "seed", ["seed-manifest.json"]);
+  verifyDeclaredFiles(seedManifest, seedRoot, "seed", [
+    "seed-manifest.json",
+    "npm/node_modules"
+  ]);
   verifyDeclaredFiles(overlayManifest, overlayRoot, "overlay", ["runtime-overlay-manifest.json"]);
   verifyDeclaredFiles(
     policyManifest,
@@ -5124,11 +5129,204 @@ function verifyTrustedPiRuntimeAssertion(input) {
   };
 }
 
+// src/amaster-runtime-daemon/pi-provider-config.mjs
+import { existsSync as existsSync9, mkdirSync as mkdirSync6, readFileSync as readFileSync7, renameSync as renameSync3, writeFileSync as writeFileSync6 } from "node:fs";
+import { dirname as dirname7, join as join10 } from "node:path";
+var AMASTER_API_KEY_ENV_REFERENCE = "${AMASTER_API_KEY}";
+var AMASTER_BILLING_HEADER_ENV_REFERENCES = Object.freeze({
+  "x-pi-agent-oauth-token": "${AMASTER_PLATFORM_OAUTH_TOKEN}",
+  "x-organization-id": "${AMASTER_PLATFORM_ORGANIZATION_ID}",
+  "x-billing-turn-id": "${AMASTER_BILLING_TURN_ID}"
+});
+function isRecord(value) {
+  return value && typeof value === "object" && !Array.isArray(value);
+}
+function readJsonFile2(filePath) {
+  try {
+    const parsed = JSON.parse(readFileSync7(filePath, "utf8"));
+    return asRecord(parsed);
+  } catch {
+    return {};
+  }
+}
+function writeJsonFileAtomic(filePath, value) {
+  mkdirSync6(dirname7(filePath), { recursive: true });
+  const tmpPath = `${filePath}.tmp.${process.pid}.${Date.now()}`;
+  writeFileSync6(tmpPath, `${JSON.stringify(value, null, 2)}
+`, { mode: 384 });
+  renameSync3(tmpPath, filePath);
+}
+function imageGenBaseUrlFromProviderBaseUrl(value) {
+  const input = readString(value);
+  if (!input) return void 0;
+  try {
+    const url = new URL(input);
+    const pathname = url.pathname.replace(/\/+$/, "");
+    if (pathname.toLowerCase().endsWith("/v1")) {
+      url.pathname = pathname.slice(0, -"/v1".length) || "/";
+    }
+    return url.toString();
+  } catch {
+    return input.replace(/\/v1\/?$/, "");
+  }
+}
+function ensureAmasterProviderModel(models, modelId, flash) {
+  const id = readString(modelId);
+  if (!id) return;
+  const existing = Array.isArray(models) ? models : [];
+  const index = existing.findIndex((entry) => asRecord(entry).id === id);
+  if (index >= 0) {
+    existing[index] = {
+      ...asRecord(existing[index]),
+      id,
+      input: readStringArray(asRecord(existing[index]).input).length > 0 ? asRecord(existing[index]).input : ["text", "image"],
+      reasoning: asRecord(existing[index]).reasoning ?? true,
+      ...flash ? { flash: true } : {}
+    };
+    return;
+  }
+  existing.push({
+    id,
+    input: ["text", "image"],
+    reasoning: true,
+    ...flash ? { flash: true } : {}
+  });
+}
+function withoutManagedBillingHeaders(value) {
+  const headers = { ...asRecord(value) };
+  for (const name of Object.keys(AMASTER_BILLING_HEADER_ENV_REFERENCES)) {
+    delete headers[name];
+  }
+  return headers;
+}
+function syncManagedBillingHeaders(value, executorEnv) {
+  const headers = withoutManagedBillingHeaders(value);
+  if (readString(executorEnv.AMASTER_MODEL_ACCESS_MODE) === "billing_gateway") {
+    Object.assign(headers, AMASTER_BILLING_HEADER_ENV_REFERENCES);
+  }
+  return Object.keys(headers).length > 0 ? headers : void 0;
+}
+function managedApiKeyConfigValue(executorEnv, apiKey) {
+  return readString(executorEnv.AMASTER_MODEL_ACCESS_MODE) === "billing_gateway" ? AMASTER_API_KEY_ENV_REFERENCE : apiKey;
+}
+function syncAmasterProviderModels(agentDir, executorEnv) {
+  const apiKey = readString(executorEnv.AMASTER_API_KEY);
+  if (!apiKey) return false;
+  const modelsPath = join10(agentDir, "models.json");
+  const config = readJsonFile2(modelsPath);
+  const providers = asRecord(config.providers);
+  const amaster = { ...asRecord(providers.amaster) };
+  amaster.apiKey = managedApiKeyConfigValue(executorEnv, apiKey);
+  const baseUrl = readString(executorEnv.AMASTER_PROVIDER_BASE_URL);
+  if (baseUrl) amaster.baseUrl = baseUrl;
+  if (!readString(amaster.api)) amaster.api = "openai-completions";
+  const headers = syncManagedBillingHeaders(amaster.headers, executorEnv);
+  if (headers) amaster.headers = headers;
+  else delete amaster.headers;
+  const models = Array.isArray(amaster.models) ? [...amaster.models] : [];
+  ensureAmasterProviderModel(models, executorEnv.AMASTER_PROVIDER_DEFAULT_MODEL, false);
+  ensureAmasterProviderModel(models, executorEnv.AMASTER_PROVIDER_FLASH_MODEL, true);
+  if (models.length > 0) amaster.models = models;
+  writeJsonFileAtomic(modelsPath, {
+    ...config,
+    providers: {
+      ...providers,
+      amaster
+    }
+  });
+  return true;
+}
+function syncAmasterProviderSettings(agentDir, executorEnv) {
+  const apiKey = readString(executorEnv.AMASTER_API_KEY);
+  if (!apiKey) return false;
+  const settingsPath = join10(agentDir, "settings.json");
+  if (!existsSync9(settingsPath)) return false;
+  const settings = readJsonFile2(settingsPath);
+  const baseUrl = readString(executorEnv.AMASTER_PROVIDER_BASE_URL);
+  const defaultModel = readString(executorEnv.AMASTER_PROVIDER_DEFAULT_MODEL);
+  const imageGenBaseUrl = imageGenBaseUrlFromProviderBaseUrl(baseUrl);
+  let changed = false;
+  if (defaultModel) {
+    if (settings.defaultProvider !== "amaster") {
+      settings.defaultProvider = "amaster";
+      changed = true;
+    }
+    if (settings.defaultModel !== defaultModel) {
+      settings.defaultModel = defaultModel;
+      changed = true;
+    }
+  }
+  const imageGen = settings["pi-image-gen"];
+  if (isRecord(imageGen) && isRecord(imageGen.customProviders) && isRecord(imageGen.customProviders.amaster)) {
+    const customProviders = imageGen.customProviders;
+    const imageGenAmaster = { ...asRecord(customProviders.amaster) };
+    const managedApiKey = managedApiKeyConfigValue(executorEnv, apiKey);
+    if (imageGenAmaster.apiKey !== managedApiKey) {
+      imageGenAmaster.apiKey = managedApiKey;
+      changed = true;
+    }
+    if (imageGenBaseUrl && imageGenAmaster.baseUrl !== imageGenBaseUrl) {
+      imageGenAmaster.baseUrl = imageGenBaseUrl;
+      changed = true;
+    }
+    const imageGenHeaders = syncManagedBillingHeaders(imageGenAmaster.headers, executorEnv);
+    if (JSON.stringify(imageGenHeaders) !== JSON.stringify(imageGenAmaster.headers)) {
+      if (imageGenHeaders) imageGenAmaster.headers = imageGenHeaders;
+      else delete imageGenAmaster.headers;
+      changed = true;
+    }
+    settings["pi-image-gen"] = {
+      ...asRecord(imageGen),
+      customProviders: {
+        ...customProviders,
+        amaster: imageGenAmaster
+      }
+    };
+  }
+  const webAccess = settings["pi-web-access"];
+  if (isRecord(webAccess) && isRecord(webAccess.providers)) {
+    const webProviders = webAccess.providers;
+    const nextWebProviders = { ...webProviders };
+    for (const [name, rawProvider] of Object.entries(webProviders)) {
+      if (!isRecord(rawProvider)) continue;
+      const providerApiKey = readString(rawProvider.apiKey);
+      const providerBaseUrl = readString(rawProvider.baseUrl);
+      const looksAmasterBacked = name === "amaster" || name === "kimi" || providerApiKey === "${AMASTER_API_KEY}" || providerApiKey === "AMASTER_API_KEY" || providerBaseUrl?.includes("credits.helige") || providerBaseUrl?.includes("credits.amaster");
+      if (!looksAmasterBacked) continue;
+      const nextProvider = {
+        ...rawProvider,
+        apiKey: managedApiKeyConfigValue(executorEnv, apiKey),
+        ...baseUrl ? { baseUrl } : {}
+      };
+      const webAccessHeaders = syncManagedBillingHeaders(rawProvider.headers, executorEnv);
+      if (webAccessHeaders) nextProvider.headers = webAccessHeaders;
+      else delete nextProvider.headers;
+      if (JSON.stringify(nextProvider) !== JSON.stringify(rawProvider)) {
+        nextWebProviders[name] = nextProvider;
+        changed = true;
+      }
+    }
+    settings["pi-web-access"] = {
+      ...asRecord(webAccess),
+      providers: nextWebProviders
+    };
+  }
+  if (!changed) return false;
+  writeJsonFileAtomic(settingsPath, settings);
+  return true;
+}
+function syncAmasterProviderFiles(agentDir, executorEnv) {
+  return {
+    modelsSynced: syncAmasterProviderModels(agentDir, executorEnv),
+    settingsSynced: syncAmasterProviderSettings(agentDir, executorEnv)
+  };
+}
+
 // src/amaster-runtime-daemon/workspace-status.mjs
 import { spawnSync as spawnSync4 } from "node:child_process";
 import { createHash as createHash7 } from "node:crypto";
-import { existsSync as existsSync9, readdirSync as readdirSync7, readFileSync as readFileSync7, statSync as statSync6 } from "node:fs";
-import { basename as basename5, extname, isAbsolute as isAbsolute6, join as join10, relative as relative6, resolve as resolve9 } from "node:path";
+import { existsSync as existsSync10, readdirSync as readdirSync7, readFileSync as readFileSync8, statSync as statSync6 } from "node:fs";
+import { basename as basename5, extname, isAbsolute as isAbsolute6, join as join11, relative as relative6, resolve as resolve9 } from "node:path";
 var WORKSPACE_RUNTIME_SERVICES_FILENAME = ".amaster-runtime-services.json";
 var ARTIFACT_EXTENSIONS = /* @__PURE__ */ new Map([
   [".md", "markdown"],
@@ -5197,7 +5395,7 @@ function sanitizeTrackedChange(line) {
   return isSafeRelativePath(path) ? line : null;
 }
 function sha256File2(filePath) {
-  return createHash7("sha256").update(readFileSync7(filePath)).digest("hex");
+  return createHash7("sha256").update(readFileSync8(filePath)).digest("hex");
 }
 function artifactHashCacheKey(relativePath, stat) {
   return `${relativePath}\0${stat.size}\0${stat.mtimeMs}`;
@@ -5246,7 +5444,7 @@ function scanArtifactCandidates(cwd, opts = {}) {
       if (entry.name.startsWith(".") && entry.name !== ".amaster-runtime.json") {
         if (entry.name === ".git") continue;
       }
-      const fullPath = join10(current, entry.name);
+      const fullPath = join11(current, entry.name);
       const relativePath = normalizeRelativePath(root, fullPath);
       if (!isSafeRelativePath(relativePath)) continue;
       if (basename5(relativePath) === ".amaster-runtime.json") continue;
@@ -5325,10 +5523,10 @@ function sanitizeRuntimeService(entry) {
   };
 }
 function readRuntimeServicesSnapshot(cwd) {
-  const snapshotPath = join10(resolve9(cwd), WORKSPACE_RUNTIME_SERVICES_FILENAME);
-  if (!existsSync9(snapshotPath)) return [];
+  const snapshotPath = join11(resolve9(cwd), WORKSPACE_RUNTIME_SERVICES_FILENAME);
+  if (!existsSync10(snapshotPath)) return [];
   try {
-    const parsed = JSON.parse(readFileSync7(snapshotPath, "utf8"));
+    const parsed = JSON.parse(readFileSync8(snapshotPath, "utf8"));
     const rawServices = Array.isArray(parsed) ? parsed : Array.isArray(parsed?.services) ? parsed.services : [];
     return rawServices.map((entry) => sanitizeRuntimeService(entry)).filter((entry) => entry !== null).slice(0, 50);
   } catch {
@@ -5399,7 +5597,7 @@ function readWorkspaceStatus(cwd, opts = {}) {
 }
 
 // src/amaster-runtime-daemon.mjs
-var CONNECTOR_VERSION = "0.1.0-beta.32";
+var CONNECTOR_VERSION = "0.1.0-beta.34";
 var CONNECTOR_CONTRACT_VERSION = "2026-06-04.v1";
 var MAX_CHECKPOINT_BYTES = 20 * 1024 * 1024;
 var CHECKPOINT_TTL_MS = 24 * 60 * 60 * 1e3;
@@ -5423,6 +5621,7 @@ var activeRunManifestOutputFlusher = createManifestOutputFlusher({ updateWorkspa
 var piChildIdentityAllocator = null;
 var piChildIdentityAllocatorKey = null;
 var trustedPiRuntimeProvenanceCache = createTrustedPiRuntimeProvenanceCache();
+var lastPartialTrustedPiRuntimeSourceWarningKey = null;
 function configuredPiChildIdentityAllocator(config) {
   if (!(config.piChildUidBase > 0)) return null;
   const key = `${config.piChildUidBase}:${config.piChildUidSpan}`;
@@ -5446,11 +5645,11 @@ function updateActiveRunWorkspaceManifest(commandId, manifestPath, patch = {}) {
 }
 function resultOutboxPendingCount(config) {
   const dir = resultOutboxDir(config);
-  if (!existsSync10(dir)) return 0;
+  if (!existsSync11(dir)) return 0;
   try {
     let pending = 0;
     for (const file of readdirSync8(dir).filter((name) => name.endsWith(".json"))) {
-      if (readValidResultOutboxEntryOrQuarantine(config, file, join11(dir, file))) {
+      if (readValidResultOutboxEntryOrQuarantine(config, file, join12(dir, file))) {
         pending += 1;
       }
     }
@@ -5466,11 +5665,11 @@ function piCompletionOutputType(event) {
 }
 function resultOutboxActiveRunCommands(config) {
   const dir = resultOutboxDir(config);
-  if (!existsSync10(dir)) return [];
+  if (!existsSync11(dir)) return [];
   const outboxPending = resultOutboxPendingCount(config);
   const entries = [];
   for (const file of readdirSync8(dir).filter((name) => name.endsWith(".json")).sort()) {
-    const entry = readValidResultOutboxEntryOrQuarantine(config, file, join11(dir, file));
+    const entry = readValidResultOutboxEntryOrQuarantine(config, file, join12(dir, file));
     if (!entry) continue;
     const activeRun = asRecord(entry.activeRun);
     const commandId = readString(activeRun.commandId) ?? readString(entry.commandId);
@@ -5500,12 +5699,12 @@ function resultOutboxActiveRunCommands(config) {
 }
 function resultOutboxFailedRunCommands(config) {
   const dir = resultOutboxInvalidDir(config);
-  if (!existsSync10(dir)) return [];
+  if (!existsSync11(dir)) return [];
   const entries = [];
   for (const file of readdirSync8(dir).filter((name) => name.endsWith(".json")).sort().slice(-100)) {
     let entry;
     try {
-      entry = asRecord(JSON.parse(readFileSync8(join11(dir, file), "utf8")));
+      entry = asRecord(JSON.parse(readFileSync9(join12(dir, file), "utf8")));
     } catch {
       continue;
     }
@@ -5569,7 +5768,7 @@ function safeExpandPath(value) {
 }
 function safeJsonObjectFromFile(filePath) {
   try {
-    const parsed = JSON.parse(readFileSync8(filePath, "utf8"));
+    const parsed = JSON.parse(readFileSync9(filePath, "utf8"));
     return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
   } catch {
     return null;
@@ -5612,10 +5811,10 @@ function safeSkillRootSummary(kind, source, pathValue) {
     try {
       for (const name of readdirSync8(pathValue)) {
         if (name.startsWith(".")) continue;
-        const skillDir = join11(pathValue, name);
+        const skillDir = join12(pathValue, name);
         try {
           if (!statSync7(skillDir).isDirectory()) continue;
-          if (!existsSync10(join11(skillDir, "SKILL.md"))) continue;
+          if (!existsSync11(join12(skillDir, "SKILL.md"))) continue;
           skillCount += 1;
           if (skillCount >= MAX_PI_CAPABILITY_SOURCE_ENTRIES) {
             truncated = true;
@@ -5666,7 +5865,7 @@ function objectKeyCount(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? Object.keys(value).length : 0;
 }
 function defaultPiCodingAgentDir() {
-  return join11(homedir3(), ".pi", "agent");
+  return join12(homedir3(), ".pi", "agent");
 }
 function piCapabilitySourcesDiagnostics() {
   const configuredPiCodingAgentDir = safeExpandPath(process.env.PI_CODING_AGENT_DIR);
@@ -5675,11 +5874,11 @@ function piCapabilitySourcesDiagnostics() {
   const configuredPiAgentHome = safeExpandPath(process.env.PI_AGENT_HOME);
   const piAgentHome = configuredPiAgentHome ?? piCodingAgentDir;
   const piAgentHomeSource = configuredPiAgentHome ? "PI_AGENT_HOME" : piCodingAgentDirSource;
-  const userSkillsPath = piAgentHome ? join11(piAgentHome, "skills") : null;
-  const marketplaceSkillsPath = safeExpandPath(process.env.PI_AGENT_MARKETPLACE_SKILLS_DIR) ?? (piAgentHome ? join11(piAgentHome, "marketplace", "skills") : null);
+  const userSkillsPath = piAgentHome ? join12(piAgentHome, "skills") : null;
+  const marketplaceSkillsPath = safeExpandPath(process.env.PI_AGENT_MARKETPLACE_SKILLS_DIR) ?? (piAgentHome ? join12(piAgentHome, "marketplace", "skills") : null);
   const builtinSkillsPath = safeExpandPath(process.env.PI_AGENT_BUILTIN_SKILLS_DIR) ?? safeExpandPath(process.env.AMASTER_BUILTIN_SKILLS);
-  const mcpConfigPath = safeExpandPath(process.env.PI_AGENT_MCP_SERVERS_FILE) ?? (piAgentHome ? join11(piAgentHome, "mcp.json") : null);
-  const settingsConfigPath = piCodingAgentDir ? join11(piCodingAgentDir, "settings.json") : null;
+  const mcpConfigPath = safeExpandPath(process.env.PI_AGENT_MCP_SERVERS_FILE) ?? (piAgentHome ? join12(piAgentHome, "mcp.json") : null);
+  const settingsConfigPath = piCodingAgentDir ? join12(piCodingAgentDir, "settings.json") : null;
   const skillRoots = [
     safeSkillRootSummary("user", `${piAgentHomeSource}/skills`, userSkillsPath),
     safeSkillRootSummary(
@@ -5795,13 +5994,28 @@ function buildExecutorReadiness(config) {
   return config.executors.filter((executor) => executor.kind === "codex" || executor.kind === "pi").map((executor) => executorReadinessFor(config, executor));
 }
 function trustedPiRuntimeProvenancePayload(config) {
-  const configured = [
-    config.piRuntimeSeedRoot,
-    config.piRuntimeOverlayRoot,
-    config.piRuntimeEffectivePolicyFile
-  ].filter(Boolean).length;
-  if (configured === 0) return {};
-  if (configured !== 3) throw new Error("pi_trusted_runtime_source_config_missing");
+  const configuredSources = [
+    Boolean(config.piRuntimeSeedRoot),
+    Boolean(config.piRuntimeOverlayRoot),
+    Boolean(config.piRuntimeEffectivePolicyFile)
+  ];
+  const configured = configuredSources.filter(Boolean).length;
+  if (configured === 0) {
+    lastPartialTrustedPiRuntimeSourceWarningKey = null;
+    return {};
+  }
+  if (configured !== 3) {
+    const warningKey = configuredSources.map((value) => value ? "1" : "0").join("");
+    if (warningKey !== lastPartialTrustedPiRuntimeSourceWarningKey) {
+      process.stderr.write(
+        `AMaster daemon warning pi_trusted_runtime_source_config_partial: configured=${configured} required=3; ordinary heartbeat continues without trusted runtime provenance.
+`
+      );
+      lastPartialTrustedPiRuntimeSourceWarningKey = warningKey;
+    }
+    return {};
+  }
+  lastPartialTrustedPiRuntimeSourceWarningKey = null;
   return trustedPiRuntimeProvenanceCache.read(trustedPiRuntimeSources(config));
 }
 function buildRegisterPayload(config) {
@@ -5898,10 +6112,10 @@ function piAgentSystemDataDir(config) {
   return configured ? resolve10(expandHomePath(configured)) : null;
 }
 function readPiAgentLocalPlatformCredential(credentialsDir) {
-  const pointer = readJsonFile2(join11(credentialsDir, "latest.json"));
+  const pointer = readJsonFile3(join12(credentialsDir, "latest.json"));
   const credentialRef = readString(pointer.credentialRef);
   if (!credentialRef || !/^[a-f0-9]{64}$/i.test(credentialRef)) return null;
-  const credential = readJsonFile2(join11(credentialsDir, `${credentialRef}.json`));
+  const credential = readJsonFile3(join12(credentialsDir, `${credentialRef}.json`));
   const organizationId = readString(credential.organizationId);
   const apiKey = readString(credential.apiKey);
   if (credential.version !== 1 || !organizationId || !apiKey) return null;
@@ -5917,7 +6131,7 @@ function piAgentLocalPlatformCredentials(config) {
   if (!piAgentLocalPlatformRunnerEnabled(config)) return [];
   const systemDataDir = piAgentSystemDataDir(config);
   if (!systemDataDir) return [];
-  const companiesDir = join11(systemDataDir, "companies");
+  const companiesDir = join12(systemDataDir, "companies");
   let entries = [];
   try {
     entries = readdirSync8(companiesDir, { withFileTypes: true });
@@ -5927,7 +6141,7 @@ function piAgentLocalPlatformCredentials(config) {
   const credentialsByOrganizationId = /* @__PURE__ */ new Map();
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    const credential = readPiAgentLocalPlatformCredential(join11(companiesDir, entry.name, "model-credentials"));
+    const credential = readPiAgentLocalPlatformCredential(join12(companiesDir, entry.name, "model-credentials"));
     if (credential) credentialsByOrganizationId.set(credential.organizationId, credential);
   }
   return [...credentialsByOrganizationId.values()];
@@ -6101,7 +6315,7 @@ AMASTER_WORKSPACE_ALLOWLIST=${quoteShell(config.workspaceBindings.join(","))}
 AMASTER_EXECUTORS=${quoteShell(executorEnv)}
 AMASTER_CAPABILITIES=${quoteShell(config.capabilities.join(","))}
 AMASTER_NETWORK_DOMAINS=${quoteShell(config.networkDomains.join(","))}
-AMASTER_DAEMON_STATE_FILE=${quoteShell(join11(homedir3(), ".amaster-employee", "runtime-connector-state.json"))}
+AMASTER_DAEMON_STATE_FILE=${quoteShell(join12(homedir3(), ".amaster-employee", "runtime-connector-state.json"))}
 EOF
 
 set -a
@@ -6289,10 +6503,10 @@ function buildActiveRunCommandStatus(config, entry) {
   const base = {
     ...entry,
     phase: readString(entry.phase) ?? "executing",
-    managedWorkdirPresent: entry.workspacePath ? existsSync10(entry.workspacePath) : false,
+    managedWorkdirPresent: entry.workspacePath ? existsSync11(entry.workspacePath) : false,
     outboxPending: resultOutboxPendingCount(config)
   };
-  if (!entry.workspacePath || !existsSync10(entry.workspacePath)) return base;
+  if (!entry.workspacePath || !existsSync11(entry.workspacePath)) return base;
   const manifestPath = entry.manifestPath ?? workspaceManifestPath(entry.workspacePath);
   const status = readWorkspaceStatus(entry.workspacePath, { hashCache: workspaceStatusHashCache });
   const artifactCandidates = status.artifacts.slice(0, 20);
@@ -6471,151 +6685,14 @@ function trustedPiRuntimeSources(config) {
     policyFile: config.piRuntimeEffectivePolicyFile
   };
 }
-function readJsonFile2(filePath) {
+function readJsonFile3(filePath) {
   try {
-    const parsed = JSON.parse(readFileSync8(filePath, "utf8"));
+    const parsed = JSON.parse(readFileSync9(filePath, "utf8"));
     return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
   } catch {
     return {};
   }
 }
-function writeJsonFileAtomic(filePath, value) {
-  mkdirSync6(dirname7(filePath), { recursive: true });
-  const tmpPath = `${filePath}.tmp.${process.pid}.${Date.now()}`;
-  writeFileSync6(tmpPath, `${JSON.stringify(value, null, 2)}
-`, { mode: 384 });
-  renameSync3(tmpPath, filePath);
-}
-function isPlainRecord(value) {
-  return value && typeof value === "object" && !Array.isArray(value);
-}
-function imageGenBaseUrlFromProviderBaseUrl(value) {
-  const input = readString(value);
-  if (!input) return void 0;
-  try {
-    const url = new URL(input);
-    const pathname = url.pathname.replace(/\/+$/, "");
-    if (pathname.toLowerCase().endsWith("/v1")) {
-      url.pathname = pathname.slice(0, -"/v1".length) || "/";
-    }
-    return url.toString();
-  } catch {
-    return input.replace(/\/v1\/?$/, "");
-  }
-}
-function ensureAmasterProviderModel(models, modelId, flash) {
-  const id = readString(modelId);
-  if (!id) return;
-  const existing = Array.isArray(models) ? models : [];
-  const index = existing.findIndex((entry) => asRecord(entry).id === id);
-  if (index >= 0) {
-    existing[index] = {
-      ...asRecord(existing[index]),
-      id,
-      input: readStringArray(asRecord(existing[index]).input).length > 0 ? asRecord(existing[index]).input : ["text", "image"],
-      reasoning: asRecord(existing[index]).reasoning ?? true,
-      ...flash ? { flash: true } : {}
-    };
-    return;
-  }
-  existing.push({
-    id,
-    input: ["text", "image"],
-    reasoning: true,
-    ...flash ? { flash: true } : {}
-  });
-}
-function syncAmasterProviderModels(agentDir, executorEnv) {
-  const apiKey = readString(executorEnv.AMASTER_API_KEY);
-  if (!apiKey) return false;
-  const modelsPath = join11(agentDir, "models.json");
-  const config = readJsonFile2(modelsPath);
-  const providers = asRecord(config.providers);
-  const amaster = { ...asRecord(providers.amaster) };
-  amaster.apiKey = apiKey;
-  const baseUrl = readString(executorEnv.AMASTER_PROVIDER_BASE_URL);
-  if (baseUrl) amaster.baseUrl = baseUrl;
-  if (!readString(amaster.api)) amaster.api = "openai-completions";
-  const models = Array.isArray(amaster.models) ? [...amaster.models] : [];
-  ensureAmasterProviderModel(models, executorEnv.AMASTER_PROVIDER_DEFAULT_MODEL, false);
-  ensureAmasterProviderModel(models, executorEnv.AMASTER_PROVIDER_FLASH_MODEL, true);
-  if (models.length > 0) amaster.models = models;
-  writeJsonFileAtomic(modelsPath, {
-    ...config,
-    providers: {
-      ...providers,
-      amaster
-    }
-  });
-  return true;
-}
-function syncAmasterProviderSettings(agentDir, executorEnv) {
-  const apiKey = readString(executorEnv.AMASTER_API_KEY);
-  if (!apiKey) return false;
-  const settingsPath = join11(agentDir, "settings.json");
-  if (!existsSync10(settingsPath)) return false;
-  const settings = readJsonFile2(settingsPath);
-  const baseUrl = readString(executorEnv.AMASTER_PROVIDER_BASE_URL);
-  const defaultModel = readString(executorEnv.AMASTER_PROVIDER_DEFAULT_MODEL);
-  const imageGenBaseUrl = imageGenBaseUrlFromProviderBaseUrl(baseUrl);
-  let changed = false;
-  if (defaultModel) {
-    if (settings.defaultProvider !== "amaster") {
-      settings.defaultProvider = "amaster";
-      changed = true;
-    }
-    if (settings.defaultModel !== defaultModel) {
-      settings.defaultModel = defaultModel;
-      changed = true;
-    }
-  }
-  const imageGen = settings["pi-image-gen"];
-  if (isPlainRecord(imageGen) && isPlainRecord(imageGen.customProviders) && isPlainRecord(imageGen.customProviders.amaster)) {
-    const imageGenAmaster = { ...imageGen.customProviders.amaster };
-    if (imageGenAmaster.apiKey !== apiKey) {
-      imageGenAmaster.apiKey = apiKey;
-      changed = true;
-    }
-    if (imageGenBaseUrl && imageGenAmaster.baseUrl !== imageGenBaseUrl) {
-      imageGenAmaster.baseUrl = imageGenBaseUrl;
-      changed = true;
-    }
-    settings["pi-image-gen"] = {
-      ...imageGen,
-      customProviders: {
-        ...imageGen.customProviders,
-        amaster: imageGenAmaster
-      }
-    };
-  }
-  const webAccess = settings["pi-web-access"];
-  if (isPlainRecord(webAccess) && isPlainRecord(webAccess.providers)) {
-    const nextWebProviders = { ...webAccess.providers };
-    for (const [name, rawProvider] of Object.entries(webAccess.providers)) {
-      if (!isPlainRecord(rawProvider)) continue;
-      const providerApiKey = readString(rawProvider.apiKey);
-      const providerBaseUrl = readString(rawProvider.baseUrl);
-      const looksAmasterBacked = name === "amaster" || name === "kimi" || providerApiKey === "${AMASTER_API_KEY}" || providerApiKey === "AMASTER_API_KEY" || providerBaseUrl?.includes("credits.helige") || providerBaseUrl?.includes("credits.amaster");
-      if (!looksAmasterBacked) continue;
-      const nextProvider = {
-        ...rawProvider,
-        apiKey,
-        ...baseUrl ? { baseUrl } : {}
-      };
-      if (JSON.stringify(nextProvider) !== JSON.stringify(rawProvider)) {
-        nextWebProviders[name] = nextProvider;
-        changed = true;
-      }
-    }
-    settings["pi-web-access"] = {
-      ...webAccess,
-      providers: nextWebProviders
-    };
-  }
-  if (!changed) return false;
-  writeJsonFileAtomic(settingsPath, settings);
-  return true;
-}
 function resolvePiExecutorProviderConfig(config, command, executorEnv) {
   const localPlatformCredential = piAgentLocalPlatformCredentialForCommand(config, command);
   if (piAgentLocalPlatformRunnerEnabled(config) && !localPlatformCredential) {
@@ -6629,8 +6706,7 @@ function resolvePiExecutorProviderConfig(config, command, executorEnv) {
 async function syncPiExecutorProviderConfig(config, command, agentDir, resolvedProviderConfig) {
   if (!agentDir) return;
   const { providerConfig, credentialSource } = resolvedProviderConfig;
-  const modelsSynced = syncAmasterProviderModels(agentDir, providerConfig);
-  const settingsSynced = syncAmasterProviderSettings(agentDir, providerConfig);
+  const { modelsSynced, settingsSynced } = syncAmasterProviderFiles(agentDir, providerConfig);
   if (modelsSynced || settingsSynced) {
     await ingestLog(config, command, "system", "info", "Synced AMaster provider config for pi executor", {
       modelsSynced,
@@ -6698,8 +6774,8 @@ async function materializeAgentInstructionsBundle(config, command, workspace) {
     if (!content) continue;
     const target = safeAgentInstructionMaterializationTarget(workspace, filePath);
     if (!target) continue;
-    mkdirSync6(dirname7(target.targetPath), { recursive: true });
-    writeFileSync6(target.targetPath, content, "utf8");
+    mkdirSync7(dirname8(target.targetPath), { recursive: true });
+    writeFileSync7(target.targetPath, content, "utf8");
     materialized.push({
       path: target.relativePath,
       byteSize: Buffer.byteLength(content, "utf8")
@@ -6775,13 +6851,13 @@ function companyPiHomeRoot(baseEnv) {
   const explicitRoot = readString(baseEnv.AMASTER_COMPANY_PI_HOME_ROOT);
   if (explicitRoot) return resolve10(expandHomePath(explicitRoot));
   const configuredPiHome = readString(baseEnv.PI_AGENT_HOME) ?? readString(baseEnv.PI_CODING_AGENT_DIR);
-  if (configuredPiHome) return join11(dirname7(resolve10(expandHomePath(configuredPiHome))), "companies");
-  return join11(homedir3(), ".amaster-employee", "companies");
+  if (configuredPiHome) return join12(dirname8(resolve10(expandHomePath(configuredPiHome))), "companies");
+  return join12(homedir3(), ".amaster-employee", "companies");
 }
 function companyPiAgentHome(baseEnv, companyId) {
   const segment = safeCompanyPiHomeSegment(companyId);
   if (!segment) return null;
-  return join11(companyPiHomeRoot(baseEnv), segment, ".pi");
+  return join12(companyPiHomeRoot(baseEnv), segment, ".pi");
 }
 function commandUsesPiExecutor(command) {
   return readString(asRecord(command.payload).executorKind) === "pi";
@@ -7280,7 +7356,7 @@ function realOrResolvedPath(value) {
     return resolve10(value);
   }
 }
-var LSOF_COMMAND = process.platform === "darwin" && existsSync10("/usr/sbin/lsof") ? "/usr/sbin/lsof" : "lsof";
+var LSOF_COMMAND = process.platform === "darwin" && existsSync11("/usr/sbin/lsof") ? "/usr/sbin/lsof" : "lsof";
 function processCwdForPid(pid) {
   if (process.platform === "linux") {
     try {
@@ -7402,7 +7478,7 @@ function killWorkspaceResidentProcesses(cwd, processGroupId, options = {}) {
 }
 function walkManagedWorkdirs(root) {
   const workdirs = [];
-  if (!root || !existsSync10(root)) return workdirs;
+  if (!root || !existsSync11(root)) return workdirs;
   const stack = [root];
   while (stack.length > 0) {
     const current = stack.pop();
@@ -7415,8 +7491,8 @@ function walkManagedWorkdirs(root) {
     }
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
-      const fullPath = join11(current, entry.name);
-      if (entry.name === "workdir" && existsSync10(workspaceManifestPath(fullPath))) {
+      const fullPath = join12(current, entry.name);
+      if (entry.name === "workdir" && existsSync11(workspaceManifestPath(fullPath))) {
         workdirs.push(fullPath);
         continue;
       }
@@ -7940,14 +8016,14 @@ async function completeCommand(config, command, status, result2, error) {
 function resultOutboxDir(config) {
   const explicit = readString(process.env.AMASTER_RESULT_OUTBOX_DIR);
   if (explicit) return resolve10(expandHomePath(explicit));
-  return join11(dirname7(stateFilePath(process.env)), "result-outbox");
+  return join12(dirname8(stateFilePath(process.env)), "result-outbox");
 }
 function resultOutboxInvalidDir(config) {
-  return join11(resultOutboxDir(config), "invalid");
+  return join12(resultOutboxDir(config), "invalid");
 }
 function writeResultOutboxEntry(config, entry) {
   const dir = resultOutboxDir(config);
-  mkdirSync6(dir, { recursive: true });
+  mkdirSync7(dir, { recursive: true });
   const body = {
     version: 1,
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -7955,16 +8031,16 @@ function writeResultOutboxEntry(config, entry) {
     lastAttemptAt: null,
     ...entry
   };
-  writeFileSync6(join11(dir, resultOutboxFileName(entry.commandId)), `${JSON.stringify(body, null, 2)}
+  writeFileSync7(join12(dir, resultOutboxFileName(entry.commandId)), `${JSON.stringify(body, null, 2)}
 `, { mode: 384 });
 }
 function moveResultOutboxEntryToInvalid(config, file, fullPath, reason, detail, original) {
   const invalidDir = resultOutboxInvalidDir(config);
-  mkdirSync6(invalidDir, { recursive: true });
-  const invalidPath = join11(invalidDir, file);
+  mkdirSync7(invalidDir, { recursive: true });
+  const invalidPath = join12(invalidDir, file);
   if (original === void 0) {
     try {
-      renameSync3(fullPath, invalidPath);
+      renameSync4(fullPath, invalidPath);
     } catch {
       copyFileSync3(fullPath, invalidPath);
       unlinkSync(fullPath);
@@ -7977,14 +8053,14 @@ function moveResultOutboxEntryToInvalid(config, file, fullPath, reason, detail,
     ...detail ? { detail: truncateText(detail, 1e3) } : {},
     original
   };
-  writeFileSync6(invalidPath, `${JSON.stringify(evidence, null, 2)}
+  writeFileSync7(invalidPath, `${JSON.stringify(evidence, null, 2)}
 `, { mode: 384 });
   unlinkSync(fullPath);
 }
 function readValidResultOutboxEntryOrQuarantine(config, file, fullPath) {
   let entry;
   try {
-    entry = JSON.parse(readFileSync8(fullPath, "utf8"));
+    entry = JSON.parse(readFileSync9(fullPath, "utf8"));
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     moveResultOutboxEntryToInvalid(config, file, fullPath, "malformed_result_outbox_json", message);
@@ -8014,13 +8090,13 @@ function updateResultOutboxAttempt(fullPath, entry, err) {
     ...typeof err?.httpStatus === "number" ? { httpStatus: err.httpStatus } : {},
     lastError: truncateText(err instanceof Error ? err.message : String(err), 1e3)
   };
-  writeFileSync6(fullPath, `${JSON.stringify(next, null, 2)}
+  writeFileSync7(fullPath, `${JSON.stringify(next, null, 2)}
 `, { mode: 384 });
   return next;
 }
 function quarantineResultOutboxEntry(config, fullPath, file, entry, reason, err) {
   const invalidDir = resultOutboxInvalidDir(config);
-  mkdirSync6(invalidDir, { recursive: true });
+  mkdirSync7(invalidDir, { recursive: true });
   const body = {
     ...entry,
     invalidReason: reason,
@@ -8028,8 +8104,8 @@ function quarantineResultOutboxEntry(config, fullPath, file, entry, reason, err)
     ...typeof err?.httpStatus === "number" ? { httpStatus: err.httpStatus } : {},
     lastError: truncateText(err instanceof Error ? err.message : String(err), 1e3)
   };
-  const invalidPath = join11(invalidDir, file);
-  writeFileSync6(invalidPath, `${JSON.stringify(body, null, 2)}
+  const invalidPath = join12(invalidDir, file);
+  writeFileSync7(invalidPath, `${JSON.stringify(body, null, 2)}
 `, { mode: 384 });
   try {
     unlinkSync(fullPath);
@@ -8042,11 +8118,11 @@ function quarantineResultOutboxEntry(config, fullPath, file, entry, reason, err)
 }
 async function flushResultOutbox(config) {
   const dir = resultOutboxDir(config);
-  if (!existsSync10(dir)) return { attempted: 0, completed: 0 };
+  if (!existsSync11(dir)) return { attempted: 0, completed: 0 };
   const files = readdirSync8(dir).filter((name) => name.endsWith(".json")).sort();
   let completed = 0;
   for (const file of files) {
-    const fullPath = join11(dir, file);
+    const fullPath = join12(dir, file);
     const entry = readValidResultOutboxEntryOrQuarantine(config, file, fullPath);
     if (!entry) continue;
     try {
@@ -8243,8 +8319,8 @@ async function materializeIssueAttachments(config, command, workspace) {
     runtimeAuth,
     issueId
   );
-  const targetDir = join11(workspace.cwd, "input-attachments");
-  mkdirSync6(targetDir, { recursive: true });
+  const targetDir = join12(workspace.cwd, "input-attachments");
+  mkdirSync7(targetDir, { recursive: true });
   const usedFilenames = /* @__PURE__ */ new Set();
   const materialized = [];
   for (const [index, rawAttachment] of attachments.entries()) {
@@ -8258,9 +8334,9 @@ async function materializeIssueAttachments(config, command, workspace) {
       filename = `${stem}-${index + 1}${ext}`;
     }
     usedFilenames.add(filename);
-    const targetPath = join11(targetDir, filename);
+    const targetPath = join12(targetDir, filename);
     const body = await runtimeApiBuffer(runtimeAuth, contentPath);
-    writeFileSync6(targetPath, body);
+    writeFileSync7(targetPath, body);
     const attachmentId = readString(attachment.id);
     const actualSha256 = createHash8("sha256").update(body).digest("hex");
     const lineageCandidates = lineageCandidatesByAttachmentId.get(attachmentId) ?? [];
@@ -8334,9 +8410,9 @@ async function materializeRequiredArtifactInputs(config, command, workspace) {
   if (manifest.version !== 1 || !Array.isArray(manifest.entries)) {
     throw new Error("artifact_input_manifest_invalid: expected version 1 entries array");
   }
-  const targetRoot = join11(workspace.cwd, "input-artifacts");
+  const targetRoot = join12(workspace.cwd, "input-artifacts");
   rmSync6(targetRoot, { recursive: true, force: true });
-  mkdirSync6(targetRoot, { recursive: true });
+  mkdirSync7(targetRoot, { recursive: true });
   const usedPaths = /* @__PURE__ */ new Set();
   const materialized = [];
   for (const [index, rawEntry] of manifest.entries.entries()) {
@@ -8365,17 +8441,17 @@ async function materializeRequiredArtifactInputs(config, command, workspace) {
       id: attachmentId,
       originalFilename: readString(entry.originalFilename)
     }, index);
-    let relativePath = join11("input-artifacts", sourceDir, filename).split(/[\\/]+/).join("/");
+    let relativePath = join12("input-artifacts", sourceDir, filename).split(/[\\/]+/).join("/");
     if (usedPaths.has(relativePath)) {
       const ext = extname2(filename);
       const stem = ext ? filename.slice(0, -ext.length) : filename;
       filename = `${stem}-${index + 1}${ext}`;
-      relativePath = join11("input-artifacts", sourceDir, filename).split(/[\\/]+/).join("/");
+      relativePath = join12("input-artifacts", sourceDir, filename).split(/[\\/]+/).join("/");
     }
     usedPaths.add(relativePath);
-    const targetPath = join11(workspace.cwd, relativePath);
-    mkdirSync6(dirname7(targetPath), { recursive: true });
-    writeFileSync6(targetPath, body);
+    const targetPath = join12(workspace.cwd, relativePath);
+    mkdirSync7(dirname8(targetPath), { recursive: true });
+    writeFileSync7(targetPath, body);
     chmodSync5(targetPath, 292);
     materialized.push({
       id: attachmentId,
@@ -8395,8 +8471,8 @@ async function materializeRequiredArtifactInputs(config, command, workspace) {
     version: 1,
     entries: materialized.map(({ path: _path, relativePath, ...entry }) => ({ ...entry, path: relativePath }))
   };
-  const manifestPath = join11(targetRoot, "artifact-input-manifest.json");
-  writeFileSync6(manifestPath, JSON.stringify(localManifest, null, 2) + "\n");
+  const manifestPath = join12(targetRoot, "artifact-input-manifest.json");
+  writeFileSync7(manifestPath, JSON.stringify(localManifest, null, 2) + "\n");
   chmodSync5(manifestPath, 292);
   updateWorkspaceManifest(workspaceManifestPath(workspace), { artifactInputManifest: localManifest });
   await ingestLog(config, command, "system", "info", `Materialized ${materialized.length} required artifact input(s) into the execution workspace`, {
@@ -8406,11 +8482,11 @@ async function materializeRequiredArtifactInputs(config, command, workspace) {
   return materialized;
 }
 function issueCheckpointDir(workspace) {
-  return join11(dirname7(workspace.runDir), "checkpoint");
+  return join12(dirname8(workspace.runDir), "checkpoint");
 }
 async function clearIssueCheckpoint(config, command, workspace, reason) {
   const checkpointDir = issueCheckpointDir(workspace);
-  if (!existsSync10(checkpointDir)) return false;
+  if (!existsSync11(checkpointDir)) return false;
   rmSync6(checkpointDir, { recursive: true, force: true });
   await ingestLog(config, command, "system", "info", "Cleared issue continuation checkpoint", { reason });
   return true;
@@ -8424,15 +8500,15 @@ function safeCheckpointRelativePath(rawPath) {
   return normalized;
 }
 function hashFileSha256(filePath) {
-  return createHash8("sha256").update(readFileSync8(filePath)).digest("hex");
+  return createHash8("sha256").update(readFileSync9(filePath)).digest("hex");
 }
 async function materializeIssueCheckpoint(config, command, workspace) {
   const checkpointDir = issueCheckpointDir(workspace);
-  const manifestPath = join11(checkpointDir, "manifest.json");
-  if (!existsSync10(manifestPath)) return [];
+  const manifestPath = join12(checkpointDir, "manifest.json");
+  if (!existsSync11(manifestPath)) return [];
   let manifest;
   try {
-    manifest = asRecord(JSON.parse(readFileSync8(manifestPath, "utf8")));
+    manifest = asRecord(JSON.parse(readFileSync9(manifestPath, "utf8")));
   } catch (err) {
     rmSync6(checkpointDir, { recursive: true, force: true });
     throw new Error(`invalid issue checkpoint manifest: ${err instanceof Error ? err.message : String(err)}`);
@@ -8445,7 +8521,7 @@ async function materializeIssueCheckpoint(config, command, workspace) {
   try {
     const files = Array.isArray(manifest.files) ? manifest.files : [];
     if (files.length > 20) throw new Error("issue checkpoint manifest exceeds the limit of 20 files");
-    const filesRoot = realpathSync3(join11(checkpointDir, "files"));
+    const filesRoot = realpathSync3(join12(checkpointDir, "files"));
     const workspaceRoot = realpathSync3(workspace.cwd);
     const validated = [];
     let totalBytes = 0;
@@ -8458,7 +8534,7 @@ async function materializeIssueCheckpoint(config, command, workspace) {
       if (!pathWithin2(sourceCandidate, filesRoot) || !pathWithin2(target, workspaceRoot)) {
         throw new Error(`issue checkpoint path escapes its workspace: ${relativePath}`);
       }
-      if (!existsSync10(sourceCandidate)) throw new Error(`issue checkpoint file is missing: ${relativePath}`);
+      if (!existsSync11(sourceCandidate)) throw new Error(`issue checkpoint file is missing: ${relativePath}`);
       const source = realpathSync3(sourceCandidate);
       if (!pathWithin2(source, filesRoot) || !statSync7(source).isFile()) {
         throw new Error(`issue checkpoint source escapes its storage root: ${relativePath}`);
@@ -8483,8 +8559,8 @@ async function materializeIssueCheckpoint(config, command, workspace) {
       } catch (err) {
         if (err?.code !== "ENOENT") throw err;
       }
-      mkdirSync6(dirname7(target), { recursive: true });
-      const targetParent = realpathSync3(dirname7(target));
+      mkdirSync7(dirname8(target), { recursive: true });
+      const targetParent = realpathSync3(dirname8(target));
       if (!pathWithin2(targetParent, workspaceRoot)) {
         throw new Error(`issue checkpoint target escapes its workspace: ${relativePath}`);
       }
@@ -8512,16 +8588,16 @@ async function materializeIssueCheckpoint(config, command, workspace) {
 }
 async function saveIssueCheckpoint(config, command, workspace, candidates) {
   const checkpointDir = issueCheckpointDir(workspace);
-  const filesDir = join11(checkpointDir, "files");
+  const filesDir = join12(checkpointDir, "files");
   rmSync6(checkpointDir, { recursive: true, force: true });
-  mkdirSync6(filesDir, { recursive: true });
+  mkdirSync7(filesDir, { recursive: true });
   const files = [];
   let totalBytes = 0;
   const workspaceRoot = realpathSync3(workspace.cwd);
   for (const candidate of candidates.slice(0, 20)) {
     const relativePath = safeCheckpointRelativePath(candidate.rawPath);
     const source = readString(candidate.filePath);
-    if (!relativePath || !source || !existsSync10(source) || !statSync7(source).isFile()) continue;
+    if (!relativePath || !source || !existsSync11(source) || !statSync7(source).isFile()) continue;
     const ownedSource = realpathSync3(source);
     if (!pathWithin2(ownedSource, workspaceRoot)) {
       throw new Error(`issue checkpoint source escapes its execution workspace: ${relativePath}`);
@@ -8530,7 +8606,7 @@ async function saveIssueCheckpoint(config, command, workspace, candidates) {
     if (byteSize <= 0 || totalBytes + byteSize > MAX_CHECKPOINT_BYTES) continue;
     const target = resolve10(filesDir, relativePath);
     if (!pathWithin2(target, filesDir)) continue;
-    mkdirSync6(dirname7(target), { recursive: true });
+    mkdirSync7(dirname8(target), { recursive: true });
     copyFileSync3(ownedSource, target);
     totalBytes += byteSize;
     files.push({ path: relativePath, byteSize, sha256: hashFileSha256(ownedSource) });
@@ -8548,7 +8624,7 @@ async function saveIssueCheckpoint(config, command, workspace, candidates) {
     totalBytes,
     files
   };
-  writeFileSync6(join11(checkpointDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
+  writeFileSync7(join12(checkpointDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
 `);
   await ingestLog(config, command, "system", "warn", `Saved ${files.length} required deliverable(s) for continuation recovery`, manifest);
   return manifest;
@@ -8620,11 +8696,13 @@ async function executeRunCommand(config, command) {
   let managedMcpProfile = null;
   let managedMcpCleanup = null;
   let cleanupManagedMcpProfile = null;
+  const providerProtectedValues = [];
   let piChildIsolation = null;
   let trustedPiRuntime = null;
   let trustedPiRuntimeSourcePaths = null;
   let trustedPiRuntimeProfile = null;
   let trustedPiRuntimeAudit = null;
+  let piResolvedProviderConfig = null;
   if (executor.kind === "codex" && Object.keys(governedMcp).length > 0) {
     managedMcpProfile = prepareManagedCodexMcpProfile({
       commandId: command.commandId,
@@ -8649,7 +8727,13 @@ async function executeRunCommand(config, command) {
       delete executorEnv.AMASTER_PROVIDER_DEFAULT_MODEL;
       delete executorEnv.AMASTER_PROVIDER_FLASH_MODEL;
     }
-    const resolvedProviderConfig = resolvePiExecutorProviderConfig(config, command, executorEnv);
+    piResolvedProviderConfig = resolvePiExecutorProviderConfig(config, command, executorEnv);
+    for (const envName of ["AMASTER_API_KEY", "AMASTER_PLATFORM_OAUTH_TOKEN"]) {
+      const protectedValue = readString(piResolvedProviderConfig.providerConfig[envName]);
+      if (protectedValue && !providerProtectedValues.includes(protectedValue)) {
+        providerProtectedValues.push(protectedValue);
+      }
+    }
     if (Object.keys(governedMcp).length > 0) {
       managedMcpProfile = prepareManagedPiMcpProfile({
         commandId: command.commandId,
@@ -8666,28 +8750,11 @@ async function executeRunCommand(config, command) {
         extraArgs: splitExtraArgs(process.env.AMASTER_PI_EXTRA_ARGS)
       });
       cleanupManagedMcpProfile = cleanupManagedPiMcpProfile;
-      try {
-        await syncPiExecutorProviderConfig(
-          config,
-          command,
-          readString(managedMcpProfile.env.PI_CODING_AGENT_DIR) ?? readString(managedMcpProfile.env.PI_AGENT_HOME) ?? null,
-          resolvedProviderConfig
-        );
-        const providerCredential = readString(resolvedProviderConfig.providerConfig.AMASTER_API_KEY);
-        if (providerCredential && !managedMcpProfile.protectedValues.includes(providerCredential)) {
-          managedMcpProfile.protectedValues.push(providerCredential);
+      for (const protectedValue of providerProtectedValues) {
+        if (!managedMcpProfile.protectedValues.includes(protectedValue)) {
+          managedMcpProfile.protectedValues.push(protectedValue);
         }
-      } catch (error) {
-        cleanupManagedMcpProfile(managedMcpProfile, {
-          commandId: command.commandId,
-          runId: commandRunId(command)
-        });
-        managedMcpProfile = null;
-        throw error;
       }
-    } else {
-      const agentDir = piAgentLocalPlatformRunnerEnabled(config) ? readString(executorEnv.PI_AGENT_HOME) ?? readString(executorEnv.PI_CODING_AGENT_DIR) ?? null : readString(executorEnv.PI_CODING_AGENT_DIR) ?? readString(executorEnv.PI_AGENT_HOME) ?? null;
-      await syncPiExecutorProviderConfig(config, command, agentDir, resolvedProviderConfig);
     }
   }
   if (managedMcpProfile) {
@@ -8729,7 +8796,7 @@ async function executeRunCommand(config, command) {
       executorEnv = {
         ...executorEnv,
         AMASTER_MANAGED_RUNTIME_ASSERTION_FD: "3",
-        AMASTER_MANAGED_RUNTIME_AUDIT_FILE: join11(
+        AMASTER_MANAGED_RUNTIME_AUDIT_FILE: join12(
           managedMcpProfile.env.HOME,
           ".amaster-managed-runtime-audit.jsonl"
         ),
@@ -8754,6 +8821,26 @@ async function executeRunCommand(config, command) {
       inheritedEntries: trustedPiRuntimeProfile.facts.inheritedEntries
     });
   }
+  if (executor.kind === "pi" && piResolvedProviderConfig) {
+    const agentDir = managedMcpProfile ? readString(managedMcpProfile.env.PI_CODING_AGENT_DIR) ?? readString(managedMcpProfile.env.PI_AGENT_HOME) ?? null : piAgentLocalPlatformRunnerEnabled(config) ? readString(executorEnv.PI_AGENT_HOME) ?? readString(executorEnv.PI_CODING_AGENT_DIR) ?? null : readString(executorEnv.PI_CODING_AGENT_DIR) ?? readString(executorEnv.PI_AGENT_HOME) ?? null;
+    try {
+      await syncPiExecutorProviderConfig(
+        config,
+        command,
+        agentDir,
+        piResolvedProviderConfig
+      );
+    } catch (error) {
+      if (managedMcpProfile && cleanupManagedMcpProfile) {
+        cleanupManagedMcpProfile(managedMcpProfile, {
+          commandId: command.commandId,
+          runId: commandRunId(command)
+        });
+        managedMcpProfile = null;
+      }
+      throw error;
+    }
+  }
   if (piChildAllocator) {
     try {
       const profileRoot = piChildIsolationProfileRoot({
@@ -8804,7 +8891,7 @@ async function executeRunCommand(config, command) {
   });
   const abortController = new AbortController();
   const stopActiveRunHeartbeats = startActiveRunHeartbeats(config, command, abortController);
-  const protectedExecutorValues = managedMcpProfile?.protectedValues ?? (managedMcpProfile ? [governedMcp.sessionToken] : []);
+  const protectedExecutorValues = managedMcpProfile?.protectedValues ?? providerProtectedValues;
   const runtimeArtifacts = [];
   const runtimeArtifactIngest = createRuntimeArtifactIngestQueue({
     ingest: (results) => ingestRuntimeArtifacts(config, command, cwd, results),

package/dist/amaster-runtime.mjs

@@ -5,7 +5,7 @@ import { dirname, join, resolve } from "node:path";
 import { homedir, hostname } from "node:os";
 import { fileURLToPath } from "node:url";
 
-const CONNECTOR_VERSION = "0.1.0-beta.32";
+const CONNECTOR_VERSION = "0.1.0-beta.34";
 
 const CAPABILITIES = [
   "remote_registration",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amaster.ai/employee-runtime-connector",
-  "version": "0.1.0-beta.32",
+  "version": "0.1.0-beta.34",
   "description": "MirrorX runtime connector CLI and daemon",
   "license": "MIT",
   "type": "module",