@amaster.ai/employee-runtime-connector 0.1.0-beta.36 → 0.1.0-beta.38

package/dist/amaster-runtime-daemon.mjs

@@ -1554,19 +1554,230 @@ import { createHash as createHash2 } from "node:crypto";
 import {
   chmodSync as chmodSync2,
   copyFileSync,
-  existsSync as existsSync2,
+  existsSync as existsSync3,
   lstatSync as lstatSync2,
-  mkdirSync as mkdirSync2,
-  readFileSync as readFileSync2,
+  mkdirSync as mkdirSync3,
+  readFileSync as readFileSync3,
   readdirSync as readdirSync2,
   rmSync as rmSync2,
   statSync as statSync2,
   symlinkSync,
-  writeFileSync as writeFileSync2
+  writeFileSync as writeFileSync3
 } from "node:fs";
 import { arch as arch2, platform as platform2 } from "node:os";
-import { basename as basename2, dirname as dirname2, isAbsolute as isAbsolute2, join as join3, relative as relative2, resolve as resolve2 } from "node:path";
+import { basename as basename2, dirname as dirname3, isAbsolute as isAbsolute2, join as join4, relative as relative2, resolve as resolve2 } from "node:path";
 import { spawnSync as spawnSync2 } from "node:child_process";
+
+// src/amaster-runtime-daemon/pi-provider-config.mjs
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname2, join as join3 } from "node:path";
+var AMASTER_API_KEY_ENV_REFERENCE = "${AMASTER_API_KEY}";
+var AMASTER_BILLING_HEADER_ENV_REFERENCES = Object.freeze({
+  "x-pi-agent-oauth-token": "${AMASTER_PLATFORM_OAUTH_TOKEN}",
+  "x-organization-id": "${AMASTER_PLATFORM_ORGANIZATION_ID}",
+  "x-billing-turn-id": "${AMASTER_BILLING_TURN_ID}"
+});
+var MANAGED_PI_PROVIDER_ENV_NAMES = Object.freeze([
+  "AMASTER_MODEL_ACCESS_MODE",
+  "AMASTER_MODEL_CREDENTIAL_REF",
+  "AMASTER_API_KEY",
+  "AMASTER_PROVIDER_BASE_URL",
+  "AMASTER_PROVIDER_DEFAULT_MODEL",
+  "AMASTER_PROVIDER_FLASH_MODEL",
+  "AMASTER_PLATFORM_OAUTH_TOKEN",
+  "AMASTER_PLATFORM_ORGANIZATION_ID",
+  "AMASTER_BILLING_TURN_ID"
+]);
+var MANAGED_PI_PROVIDER_PROTECTED_ENV_NAMES = Object.freeze([
+  "AMASTER_MODEL_CREDENTIAL_REF",
+  "AMASTER_API_KEY",
+  "AMASTER_PLATFORM_OAUTH_TOKEN"
+]);
+function isRecord(value) {
+  return value && typeof value === "object" && !Array.isArray(value);
+}
+function readJsonFile(filePath) {
+  try {
+    const parsed = JSON.parse(readFileSync2(filePath, "utf8"));
+    return asRecord(parsed);
+  } catch {
+    return {};
+  }
+}
+function writeJsonFileAtomic(filePath, value) {
+  mkdirSync2(dirname2(filePath), { recursive: true });
+  const tmpPath = `${filePath}.tmp.${process.pid}.${Date.now()}`;
+  writeFileSync2(tmpPath, `${JSON.stringify(value, null, 2)}
+`, { mode: 384 });
+  renameSync(tmpPath, filePath);
+}
+function imageGenBaseUrlFromProviderBaseUrl(value) {
+  const input = readString(value);
+  if (!input) return void 0;
+  try {
+    const url = new URL(input);
+    const pathname = url.pathname.replace(/\/+$/, "");
+    if (pathname.toLowerCase().endsWith("/v1")) {
+      url.pathname = pathname.slice(0, -"/v1".length) || "/";
+    }
+    return url.toString();
+  } catch {
+    return input.replace(/\/v1\/?$/, "");
+  }
+}
+function ensureAmasterProviderModel(models, modelId, flash) {
+  const id = readString(modelId);
+  if (!id) return;
+  const existing = Array.isArray(models) ? models : [];
+  const index = existing.findIndex((entry) => asRecord(entry).id === id);
+  if (index >= 0) {
+    existing[index] = {
+      ...asRecord(existing[index]),
+      id,
+      input: readStringArray(asRecord(existing[index]).input).length > 0 ? asRecord(existing[index]).input : ["text", "image"],
+      reasoning: asRecord(existing[index]).reasoning ?? true,
+      ...flash ? { flash: true } : {}
+    };
+    return;
+  }
+  existing.push({
+    id,
+    input: ["text", "image"],
+    reasoning: true,
+    ...flash ? { flash: true } : {}
+  });
+}
+function withoutManagedBillingHeaders(value) {
+  const headers = { ...asRecord(value) };
+  for (const name of Object.keys(AMASTER_BILLING_HEADER_ENV_REFERENCES)) {
+    delete headers[name];
+  }
+  return headers;
+}
+function syncManagedBillingHeaders(value, executorEnv) {
+  const headers = withoutManagedBillingHeaders(value);
+  if (readString(executorEnv.AMASTER_MODEL_ACCESS_MODE) === "billing_gateway") {
+    Object.assign(headers, AMASTER_BILLING_HEADER_ENV_REFERENCES);
+  }
+  return Object.keys(headers).length > 0 ? headers : void 0;
+}
+function managedApiKeyConfigValue(executorEnv, apiKey) {
+  return readString(executorEnv.AMASTER_MODEL_ACCESS_MODE) === "billing_gateway" ? AMASTER_API_KEY_ENV_REFERENCE : apiKey;
+}
+function syncAmasterProviderModels(agentDir, executorEnv) {
+  const apiKey = readString(executorEnv.AMASTER_API_KEY);
+  if (!apiKey) return false;
+  const modelsPath = join3(agentDir, "models.json");
+  const config = readJsonFile(modelsPath);
+  const providers = asRecord(config.providers);
+  const amaster = { ...asRecord(providers.amaster) };
+  amaster.apiKey = managedApiKeyConfigValue(executorEnv, apiKey);
+  const baseUrl = readString(executorEnv.AMASTER_PROVIDER_BASE_URL);
+  if (baseUrl) amaster.baseUrl = baseUrl;
+  if (!readString(amaster.api)) amaster.api = "openai-completions";
+  const headers = syncManagedBillingHeaders(amaster.headers, executorEnv);
+  if (headers) amaster.headers = headers;
+  else delete amaster.headers;
+  const models = Array.isArray(amaster.models) ? [...amaster.models] : [];
+  ensureAmasterProviderModel(models, executorEnv.AMASTER_PROVIDER_DEFAULT_MODEL, false);
+  ensureAmasterProviderModel(models, executorEnv.AMASTER_PROVIDER_FLASH_MODEL, true);
+  if (models.length > 0) amaster.models = models;
+  writeJsonFileAtomic(modelsPath, {
+    ...config,
+    providers: {
+      ...providers,
+      amaster
+    }
+  });
+  return true;
+}
+function syncAmasterProviderSettings(agentDir, executorEnv) {
+  const apiKey = readString(executorEnv.AMASTER_API_KEY);
+  if (!apiKey) return false;
+  const settingsPath = join3(agentDir, "settings.json");
+  if (!existsSync2(settingsPath)) return false;
+  const settings = readJsonFile(settingsPath);
+  const baseUrl = readString(executorEnv.AMASTER_PROVIDER_BASE_URL);
+  const defaultModel = readString(executorEnv.AMASTER_PROVIDER_DEFAULT_MODEL);
+  const imageGenBaseUrl = imageGenBaseUrlFromProviderBaseUrl(baseUrl);
+  let changed = false;
+  if (defaultModel) {
+    if (settings.defaultProvider !== "amaster") {
+      settings.defaultProvider = "amaster";
+      changed = true;
+    }
+    if (settings.defaultModel !== defaultModel) {
+      settings.defaultModel = defaultModel;
+      changed = true;
+    }
+  }
+  const imageGen = settings["pi-image-gen"];
+  if (isRecord(imageGen) && isRecord(imageGen.customProviders) && isRecord(imageGen.customProviders.amaster)) {
+    const customProviders = imageGen.customProviders;
+    const imageGenAmaster = { ...asRecord(customProviders.amaster) };
+    const managedApiKey = managedApiKeyConfigValue(executorEnv, apiKey);
+    if (imageGenAmaster.apiKey !== managedApiKey) {
+      imageGenAmaster.apiKey = managedApiKey;
+      changed = true;
+    }
+    if (imageGenBaseUrl && imageGenAmaster.baseUrl !== imageGenBaseUrl) {
+      imageGenAmaster.baseUrl = imageGenBaseUrl;
+      changed = true;
+    }
+    const imageGenHeaders = syncManagedBillingHeaders(imageGenAmaster.headers, executorEnv);
+    if (JSON.stringify(imageGenHeaders) !== JSON.stringify(imageGenAmaster.headers)) {
+      if (imageGenHeaders) imageGenAmaster.headers = imageGenHeaders;
+      else delete imageGenAmaster.headers;
+      changed = true;
+    }
+    settings["pi-image-gen"] = {
+      ...asRecord(imageGen),
+      customProviders: {
+        ...customProviders,
+        amaster: imageGenAmaster
+      }
+    };
+  }
+  const webAccess = settings["pi-web-access"];
+  if (isRecord(webAccess) && isRecord(webAccess.providers)) {
+    const webProviders = webAccess.providers;
+    const nextWebProviders = { ...webProviders };
+    for (const [name, rawProvider] of Object.entries(webProviders)) {
+      if (!isRecord(rawProvider)) continue;
+      const providerApiKey = readString(rawProvider.apiKey);
+      const providerBaseUrl = readString(rawProvider.baseUrl);
+      const looksAmasterBacked = name === "amaster" || name === "kimi" || providerApiKey === "${AMASTER_API_KEY}" || providerApiKey === "AMASTER_API_KEY" || providerBaseUrl?.includes("credits.helige") || providerBaseUrl?.includes("credits.amaster");
+      if (!looksAmasterBacked) continue;
+      const nextProvider = {
+        ...rawProvider,
+        apiKey: managedApiKeyConfigValue(executorEnv, apiKey),
+        ...baseUrl ? { baseUrl } : {}
+      };
+      const webAccessHeaders = syncManagedBillingHeaders(rawProvider.headers, executorEnv);
+      if (webAccessHeaders) nextProvider.headers = webAccessHeaders;
+      else delete nextProvider.headers;
+      if (JSON.stringify(nextProvider) !== JSON.stringify(rawProvider)) {
+        nextWebProviders[name] = nextProvider;
+        changed = true;
+      }
+    }
+    settings["pi-web-access"] = {
+      ...asRecord(webAccess),
+      providers: nextWebProviders
+    };
+  }
+  if (!changed) return false;
+  writeJsonFileAtomic(settingsPath, settings);
+  return true;
+}
+function syncAmasterProviderFiles(agentDir, executorEnv) {
+  return {
+    modelsSynced: syncAmasterProviderModels(agentDir, executorEnv),
+    settingsSynced: syncAmasterProviderSettings(agentDir, executorEnv)
+  };
+}
+
+// src/amaster-runtime-daemon/pi-managed-mcp-profile.mjs
 var piManagedMcpProfileApi = (() => {
   const SUPPORTED_SCHEMA_VERSION2 = "amaster.governed-mcp.v1";
   const SUPPORTED_SERVER_NAME2 = "amaster";
@@ -1600,12 +1811,7 @@ var piManagedMcpProfileApi = (() => {
     "AMASTER-CLI_CODING_AGENT_SESSION_DIR",
     "PI_AGENT_MCP_SERVERS_FILE"
   ]);
-  const ALLOWED_COMMAND_ENV2 = /* @__PURE__ */ new Set([
-    "AMASTER_API_KEY",
-    "AMASTER_PROVIDER_BASE_URL",
-    "AMASTER_PROVIDER_DEFAULT_MODEL",
-    "AMASTER_PROVIDER_FLASH_MODEL"
-  ]);
+  const ALLOWED_COMMAND_ENV2 = new Set(MANAGED_PI_PROVIDER_ENV_NAMES);
   const SAFE_INHERITED_ENV2 = /* @__PURE__ */ new Set([
     "PATH",
     "LANG",
@@ -1666,13 +1872,13 @@ var piManagedMcpProfileApi = (() => {
     return rel === "" || !rel.startsWith("..") && !isAbsolute2(rel);
   }
   function writePrivateFile2(filePath, contents) {
-    writeFileSync2(filePath, contents, { mode: 384, flag: "wx" });
+    writeFileSync3(filePath, contents, { mode: 384, flag: "wx" });
     chmodSync2(filePath, 384);
     const mode = statSync2(filePath).mode & 511;
     if (mode !== 384) throw new Error(`pi_managed_mcp_permissions_failed: ${filePath} mode=${mode.toString(8)}`);
   }
   function copyPrivateFile(source, target) {
-    if (!existsSync2(source)) return false;
+    if (!existsSync3(source)) return false;
     const sourceStat = lstatSync2(source);
     if (!sourceStat.isFile() || sourceStat.isSymbolicLink()) {
       throw new Error(`pi_managed_mcp_source_config_unsafe: ${source}`);
@@ -1682,7 +1888,7 @@ var piManagedMcpProfileApi = (() => {
     return true;
   }
   function findPiSessionRollout(sessionsRoot, sessionId) {
-    if (!existsSync2(sessionsRoot)) return null;
+    if (!existsSync3(sessionsRoot)) return null;
     const matches = [];
     const pending = [sessionsRoot];
     while (pending.length > 0) {
@@ -1692,7 +1898,7 @@ var piManagedMcpProfileApi = (() => {
         throw new Error("pi_managed_mcp_session_rollout_unsafe: sessions path is not a private directory");
       }
       for (const entry of readdirSync2(current, { withFileTypes: true })) {
-        const candidate = join3(current, entry.name);
+        const candidate = join4(current, entry.name);
         if (entry.isSymbolicLink()) throw new Error("pi_managed_mcp_session_rollout_unsafe: symlinks are forbidden");
         if (entry.isDirectory()) pending.push(candidate);
         else if (entry.isFile() && entry.name.endsWith(`_${sessionId}.jsonl`)) matches.push(candidate);
@@ -1712,18 +1918,18 @@ var piManagedMcpProfileApi = (() => {
     nonEmpty2(session.actionRequestId, "nativeSession.actionRequestId");
     nonEmpty2(session.invocationId, "nativeSession.invocationId");
     const sourceWorkspacePath = nonEmpty2(session.cwd, "nativeSession.cwd");
-    const issueRoot = dirname2(runDir);
+    const issueRoot = dirname3(runDir);
     const managedSourceRunDirName = `${sourceRunId}-${createHash2("sha256").update(sourceRunId).digest("hex").slice(0, 8)}`;
-    const sourceRunDirs = readdirSync2(issueRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.isSymbolicLink() && (entry.name === sourceRunId || entry.name === managedSourceRunDirName)).map((entry) => join3(issueRoot, entry.name));
+    const sourceRunDirs = readdirSync2(issueRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.isSymbolicLink() && (entry.name === sourceRunId || entry.name === managedSourceRunDirName)).map((entry) => join4(issueRoot, entry.name));
     if (sourceRunDirs.length !== 1) {
       throw new Error(`pi_managed_mcp_session_rollout_missing: expected one source run directory for ${sourceRunId}, received ${sourceRunDirs.length}`);
     }
-    const cacheRoot = join3(sourceRunDirs[0], relative2(runDir, executorHome), "session-rollout");
-    const markerPath = join3(cacheRoot, SESSION_ROLLOUT_MARKER2);
-    if (!existsSync2(markerPath) || lstatSync2(markerPath).isSymbolicLink() || !lstatSync2(markerPath).isFile()) {
+    const cacheRoot = join4(sourceRunDirs[0], relative2(runDir, executorHome), "session-rollout");
+    const markerPath = join4(cacheRoot, SESSION_ROLLOUT_MARKER2);
+    if (!existsSync3(markerPath) || lstatSync2(markerPath).isSymbolicLink() || !lstatSync2(markerPath).isFile()) {
       throw new Error("pi_managed_mcp_session_rollout_missing: source rollout marker is unavailable");
     }
-    const marker = JSON.parse(readFileSync2(markerPath, "utf8"));
+    const marker = JSON.parse(readFileSync3(markerPath, "utf8"));
     if (marker?.version !== 1 || marker?.companyId !== authority.companyId || marker?.agentId !== authority.agentId || marker?.issueId !== authority.issueId || marker?.sourceRunId !== sourceRunId || marker?.sourceCommandId !== sourceCommandId || marker?.sessionId !== sessionId || marker?.sourceWorkspacePath !== sourceWorkspacePath) {
       throw new Error("pi_managed_mcp_session_rollout_authority_mismatch: source rollout does not match the approved continuation");
     }
@@ -1735,8 +1941,8 @@ var piManagedMcpProfileApi = (() => {
     if (!within3(targetRollout, sessionsRoot)) {
       throw new Error("pi_managed_mcp_session_rollout_unsafe: target rollout path is invalid");
     }
-    mkdirSync2(dirname2(targetRollout), { recursive: true, mode: 448 });
-    writePrivateFile2(targetRollout, readFileSync2(sourceRollout));
+    mkdirSync3(dirname3(targetRollout), { recursive: true, mode: 448 });
+    writePrivateFile2(targetRollout, readFileSync3(sourceRollout));
     return { sessionId, sourceRunId, sourceCommandId, rolloutPath: targetRollout, cacheRoot };
   }
   function parseVersion(stdout, label, minimum) {
@@ -1835,10 +2041,10 @@ var piManagedMcpProfileApi = (() => {
     return { ...env, ...record3(commandEnv) };
   }
   function projectMcpConfigHasContent(filePath) {
-    if (!existsSync2(filePath)) return false;
+    if (!existsSync3(filePath)) return false;
     let parsed;
     try {
-      parsed = JSON.parse(readFileSync2(filePath, "utf8"));
+      parsed = JSON.parse(readFileSync3(filePath, "utf8"));
     } catch {
       return true;
     }
@@ -1850,12 +2056,12 @@ var piManagedMcpProfileApi = (() => {
     const boundary = resolve2(runDir);
     if (!within3(cursor, boundary)) throw new Error("pi_managed_mcp_owner_mismatch: cwd is outside the managed run");
     while (within3(cursor, boundary)) {
-      for (const relativePath of [".mcp.json", join3(".pi", "mcp.json")]) {
-        const configPath = join3(cursor, relativePath);
+      for (const relativePath of [".mcp.json", join4(".pi", "mcp.json")]) {
+        const configPath = join4(cursor, relativePath);
         if (projectMcpConfigHasContent(configPath)) throw new Error(`pi_managed_mcp_project_override_blocked: ${configPath}`);
       }
       if (cursor === boundary) break;
-      cursor = dirname2(cursor);
+      cursor = dirname3(cursor);
     }
   }
   function selectManagedBrowserUse(sourceSettings, npmSource) {
@@ -1863,13 +2069,13 @@ var piManagedMcpProfileApi = (() => {
     if (plugin.enabled !== true || plugin.package !== MANAGED_BROWSER_USE_PACKAGE) return null;
     const packageSpec = Array.isArray(sourceSettings.packages) ? sourceSettings.packages.find((entry) => npmPackageName(entry) === MANAGED_BROWSER_USE_PACKAGE) : null;
     if (typeof packageSpec !== "string") return null;
-    const packagePath = join3(npmSource, "node_modules", ...MANAGED_BROWSER_USE_PACKAGE.split("/"), "package.json");
-    if (!existsSync2(packagePath) || lstatSync2(packagePath).isSymbolicLink() || !lstatSync2(packagePath).isFile()) {
+    const packagePath = join4(npmSource, "node_modules", ...MANAGED_BROWSER_USE_PACKAGE.split("/"), "package.json");
+    if (!existsSync3(packagePath) || lstatSync2(packagePath).isSymbolicLink() || !lstatSync2(packagePath).isFile()) {
       throw new Error(`pi_managed_mcp_attestation_failed: enabled ${MANAGED_BROWSER_USE_PACKAGE} package is unavailable`);
     }
     let packageMetadata;
     try {
-      packageMetadata = JSON.parse(readFileSync2(packagePath, "utf8"));
+      packageMetadata = JSON.parse(readFileSync3(packagePath, "utf8"));
     } catch {
       throw new Error(`pi_managed_mcp_attestation_failed: enabled ${MANAGED_BROWSER_USE_PACKAGE} package metadata is invalid`);
     }
@@ -1904,23 +2110,23 @@ var piManagedMcpProfileApi = (() => {
   }
   function seedPiRuntime(sourceHome, agentDir) {
     const source = resolve2(nonEmpty2(sourceHome, "sourcePiHome"));
-    const npmSource = join3(source, "npm");
-    const adapterPackagePath = join3(npmSource, "node_modules", "pi-mcp-adapter", "package.json");
-    if (!existsSync2(adapterPackagePath) || lstatSync2(adapterPackagePath).isSymbolicLink()) {
+    const npmSource = join4(source, "npm");
+    const adapterPackagePath = join4(npmSource, "node_modules", "pi-mcp-adapter", "package.json");
+    if (!existsSync3(adapterPackagePath) || lstatSync2(adapterPackagePath).isSymbolicLink()) {
       throw new Error("pi_managed_mcp_attestation_failed: pi-mcp-adapter package is unavailable");
     }
     let adapterPackage;
     try {
-      adapterPackage = JSON.parse(readFileSync2(adapterPackagePath, "utf8"));
+      adapterPackage = JSON.parse(readFileSync3(adapterPackagePath, "utf8"));
     } catch {
       throw new Error("pi_managed_mcp_attestation_failed: pi-mcp-adapter package metadata is invalid");
     }
     const adapterVersion = parseVersion(adapterPackage.version, "pi-mcp-adapter", MINIMUM_MCP_ADAPTER_VERSION);
-    const settingsSource = join3(source, "settings.json");
+    const settingsSource = join4(source, "settings.json");
     let sourceSettings = {};
-    if (existsSync2(settingsSource)) {
+    if (existsSync3(settingsSource)) {
       try {
-        sourceSettings = record3(JSON.parse(readFileSync2(settingsSource, "utf8")));
+        sourceSettings = record3(JSON.parse(readFileSync3(settingsSource, "utf8")));
       } catch {
         throw new Error("pi_managed_mcp_attestation_failed: source Pi settings are invalid");
       }
@@ -1937,21 +2143,21 @@ var piManagedMcpProfileApi = (() => {
         "pi-browser-use": browserUse.config
       } : {}
     };
-    writePrivateFile2(join3(agentDir, "settings.json"), `${JSON.stringify(settings, null, 2)}
+    writePrivateFile2(join4(agentDir, "settings.json"), `${JSON.stringify(settings, null, 2)}
 `);
-    copyPrivateFile(join3(source, "models.json"), join3(agentDir, "models.json"));
-    const authSource = join3(source, "auth.json");
+    copyPrivateFile(join4(source, "models.json"), join4(agentDir, "models.json"));
+    const authSource = join4(source, "auth.json");
     const protectedValues = [];
-    if (copyPrivateFile(authSource, join3(agentDir, "auth.json"))) {
+    if (copyPrivateFile(authSource, join4(agentDir, "auth.json"))) {
       try {
-        collectAuthSecretStrings2(JSON.parse(readFileSync2(authSource, "utf8")), protectedValues);
+        collectAuthSecretStrings2(JSON.parse(readFileSync3(authSource, "utf8")), protectedValues);
       } catch {
         throw new Error("pi_managed_mcp_attestation_failed: source Pi auth is invalid");
       }
     }
     const npmStat = lstatSync2(npmSource);
     if (!npmStat.isDirectory() || npmStat.isSymbolicLink()) throw new Error("pi_managed_mcp_source_config_unsafe: Pi npm root");
-    symlinkSync(npmSource, join3(agentDir, "npm"), "dir");
+    symlinkSync(npmSource, join4(agentDir, "npm"), "dir");
     return { adapterVersion, protectedValues };
   }
   function attestPi(executorCommand, env, configPath, expectedConfig) {
@@ -1969,7 +2175,7 @@ var piManagedMcpProfileApi = (() => {
 ${result2.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
     let effectiveConfig;
     try {
-      effectiveConfig = JSON.parse(readFileSync2(configPath, "utf8"));
+      effectiveConfig = JSON.parse(readFileSync3(configPath, "utf8"));
     } catch {
       throw new Error("pi_managed_mcp_attestation_failed: managed MCP config is invalid JSON");
     }
@@ -1983,18 +2189,18 @@ ${result2.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
     const { gateway, gatewayUrl, sessionToken, headers, runId } = validateAuthority2(input);
     const runDir = resolve2(nonEmpty2(input.runDir, "runDir"));
     const executorHome = resolve2(nonEmpty2(input.executorHome, "executorHome"));
-    if (!within3(executorHome, join3(runDir, "executors"))) throw new Error("pi_managed_mcp_owner_mismatch: executorHome is outside the managed run");
+    if (!within3(executorHome, join4(runDir, "executors"))) throw new Error("pi_managed_mcp_owner_mismatch: executorHome is outside the managed run");
     assertNoProjectMcpOverride(nonEmpty2(input.cwd, "cwd"), runDir);
-    const profileRoot = join3(executorHome, "managed-mcp");
-    if (existsSync2(profileRoot)) throw new Error(`pi_managed_mcp_profile_exists: ${profileRoot}`);
-    const home = join3(profileRoot, "home");
-    const piAgentHome = join3(profileRoot, "pi-agent-home");
-    const piCodingAgentDir = join3(profileRoot, "pi-coding-agent-dir");
-    const sessionsRoot = join3(piCodingAgentDir, "sessions");
-    const tmp = join3(profileRoot, "tmp");
-    for (const directory of [home, piAgentHome, piCodingAgentDir, sessionsRoot, tmp]) mkdirSync2(directory, { recursive: true, mode: 448 });
+    const profileRoot = join4(executorHome, "managed-mcp");
+    if (existsSync3(profileRoot)) throw new Error(`pi_managed_mcp_profile_exists: ${profileRoot}`);
+    const home = join4(profileRoot, "home");
+    const piAgentHome = join4(profileRoot, "pi-agent-home");
+    const piCodingAgentDir = join4(profileRoot, "pi-coding-agent-dir");
+    const sessionsRoot = join4(piCodingAgentDir, "sessions");
+    const tmp = join4(profileRoot, "tmp");
+    for (const directory of [home, piAgentHome, piCodingAgentDir, sessionsRoot, tmp]) mkdirSync3(directory, { recursive: true, mode: 448 });
     try {
-      const markerPath = join3(profileRoot, PROFILE_MARKER2);
+      const markerPath = join4(profileRoot, PROFILE_MARKER2);
       const owner = Object.freeze({ commandId: input.commandId, runId });
       writePrivateFile2(markerPath, `${JSON.stringify({ version: 1, ...owner, profileRoot })}
 `);
@@ -2009,7 +2215,7 @@ ${result2.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
       const sourcePiHome = nonEmpty2(input.baseEnv?.PI_CODING_AGENT_DIR ?? input.baseEnv?.PI_AGENT_HOME, "sourcePiHome");
       const seededRuntime = seedPiRuntime(sourcePiHome, piCodingAgentDir);
       const restoredNativeSession = restoreManagedPiSessionRollout(input, sessionsRoot, runDir, executorHome, authority);
-      const configPath = join3(piCodingAgentDir, "mcp.json");
+      const configPath = join4(piCodingAgentDir, "mcp.json");
       const config = {
         mcpServers: {
           [SUPPORTED_SERVER_NAME2]: {
@@ -2059,7 +2265,7 @@ ${result2.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         protectedValues: [.../* @__PURE__ */ new Set([
           sessionToken,
           ...seededRuntime.protectedValues,
-          ...typeof input.commandEnv?.AMASTER_API_KEY === "string" ? [input.commandEnv.AMASTER_API_KEY] : []
+          ...MANAGED_PI_PROVIDER_PROTECTED_ENV_NAMES.map((name) => input.commandEnv?.[name]).filter((value) => typeof value === "string" && value.length > 0)
         ])],
         attestation: {
           ...attestationFacts,
@@ -2081,13 +2287,13 @@ ${result2.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
     if (!rolloutRelativePath || rolloutRelativePath.startsWith("..") || isAbsolute2(rolloutRelativePath)) {
       throw new Error("pi_managed_mcp_session_rollout_unsafe: rollout escaped the managed Pi home");
     }
-    const cacheRoot = join3(dirname2(resolve2(profile.profileRoot)), "session-rollout");
-    if (existsSync2(cacheRoot)) rmSync2(cacheRoot, { recursive: true, force: false });
-    mkdirSync2(cacheRoot, { recursive: true, mode: 448 });
-    const targetRollout = join3(cacheRoot, rolloutRelativePath);
-    mkdirSync2(dirname2(targetRollout), { recursive: true, mode: 448 });
-    writePrivateFile2(targetRollout, readFileSync2(sourceRollout));
-    writePrivateFile2(join3(cacheRoot, SESSION_ROLLOUT_MARKER2), `${JSON.stringify({
+    const cacheRoot = join4(dirname3(resolve2(profile.profileRoot)), "session-rollout");
+    if (existsSync3(cacheRoot)) rmSync2(cacheRoot, { recursive: true, force: false });
+    mkdirSync3(cacheRoot, { recursive: true, mode: 448 });
+    const targetRollout = join4(cacheRoot, rolloutRelativePath);
+    mkdirSync3(dirname3(targetRollout), { recursive: true, mode: 448 });
+    writePrivateFile2(targetRollout, readFileSync3(sourceRollout));
+    writePrivateFile2(join4(cacheRoot, SESSION_ROLLOUT_MARKER2), `${JSON.stringify({
       version: 1,
       cacheRoot,
       preservedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -2105,19 +2311,19 @@ ${result2.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
   }
   function cleanupManagedPiMcpProfile2(profile, owner) {
     const profileRoot = resolve2(nonEmpty2(profile?.profileRoot, "profileRoot"));
-    if (!existsSync2(profileRoot)) return { status: "already_removed", profileRoot };
+    if (!existsSync3(profileRoot)) return { status: "already_removed", profileRoot };
     const rootStat = lstatSync2(profileRoot);
     if (!rootStat.isDirectory() || rootStat.isSymbolicLink()) {
       throw new Error("pi_managed_mcp_cleanup_owner_mismatch: profile root is not an owned directory");
     }
-    const markerPath = join3(profileRoot, PROFILE_MARKER2);
-    const markerStat = existsSync2(markerPath) ? lstatSync2(markerPath) : null;
+    const markerPath = join4(profileRoot, PROFILE_MARKER2);
+    const markerStat = existsSync3(markerPath) ? lstatSync2(markerPath) : null;
     if (!markerStat?.isFile() || markerStat.isSymbolicLink()) {
       throw new Error("pi_managed_mcp_cleanup_owner_mismatch: ownership marker is missing or unsafe");
     }
     let marker;
     try {
-      marker = JSON.parse(readFileSync2(markerPath, "utf8"));
+      marker = JSON.parse(readFileSync3(markerPath, "utf8"));
     } catch {
       throw new Error("pi_managed_mcp_cleanup_owner_mismatch: ownership marker is invalid");
     }
@@ -2125,12 +2331,12 @@ ${result2.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
       throw new Error("pi_managed_mcp_cleanup_owner_mismatch: ownership marker does not match command/run");
     }
     rmSync2(profileRoot, { recursive: true, force: false });
-    if (existsSync2(profileRoot)) throw new Error("pi_managed_mcp_cleanup_failed: profile root still exists");
+    if (existsSync3(profileRoot)) throw new Error("pi_managed_mcp_cleanup_failed: profile root still exists");
     return { status: "removed", profileRoot };
   }
   function reconcileManagedPiMcpProfiles2(rootPath, options = {}) {
     const root = resolve2(rootPath);
-    if (!existsSync2(root)) return { scanned: 0, removed: 0, removedProfiles: 0, removedRollouts: 0, failed: 0, failures: [] };
+    if (!existsSync3(root)) return { scanned: 0, removed: 0, removedProfiles: 0, removedRollouts: 0, failed: 0, failures: [] };
     const profileMarkers = [];
     const rolloutMarkers = [];
     const pending = [root];
@@ -2139,7 +2345,7 @@ ${result2.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
       const currentStat = lstatSync2(current);
       if (!currentStat.isDirectory() || currentStat.isSymbolicLink()) continue;
       for (const entry of readdirSync2(current, { withFileTypes: true })) {
-        const fullPath = join3(current, entry.name);
+        const fullPath = join4(current, entry.name);
         if (entry.isDirectory() && !entry.isSymbolicLink()) pending.push(fullPath);
         else if (entry.isFile() && entry.name === PROFILE_MARKER2) profileMarkers.push(fullPath);
         else if (entry.isFile() && entry.name === SESSION_ROLLOUT_MARKER2) rolloutMarkers.push(fullPath);
@@ -2149,9 +2355,9 @@ ${result2.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
     let removedRollouts = 0;
     const failures = [];
     for (const markerPath of profileMarkers) {
-      const profileRoot = dirname2(markerPath);
+      const profileRoot = dirname3(markerPath);
       try {
-        const marker = JSON.parse(readFileSync2(markerPath, "utf8"));
+        const marker = JSON.parse(readFileSync3(markerPath, "utf8"));
         if (!within3(profileRoot, root) || marker?.profileRoot !== profileRoot) throw new Error("ownership marker root mismatch");
         cleanupManagedPiMcpProfile2({ profileRoot }, { commandId: marker.commandId, runId: marker.runId });
         removedProfiles += 1;
@@ -2162,17 +2368,17 @@ ${result2.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
     const nowMs = Number.isFinite(options.nowMs) ? options.nowMs : Date.now();
     const rolloutTtlMs = Number.isFinite(options.sessionRolloutTtlMs) && options.sessionRolloutTtlMs > 0 ? options.sessionRolloutTtlMs : DEFAULT_SESSION_ROLLOUT_TTL_MS2;
     for (const markerPath of rolloutMarkers) {
-      const cacheRoot = dirname2(markerPath);
+      const cacheRoot = dirname3(markerPath);
       try {
         const markerStat = lstatSync2(markerPath);
         const cacheStat = lstatSync2(cacheRoot);
-        const marker = JSON.parse(readFileSync2(markerPath, "utf8"));
+        const marker = JSON.parse(readFileSync3(markerPath, "utf8"));
         if (!within3(cacheRoot, root) || basename2(cacheRoot) !== "session-rollout" || markerStat.isSymbolicLink() || !markerStat.isFile() || cacheStat.isSymbolicLink() || !cacheStat.isDirectory() || marker?.version !== 1 || typeof marker?.companyId !== "string" || typeof marker?.agentId !== "string" || typeof marker?.sourceRunId !== "string" || typeof marker?.sourceCommandId !== "string" || typeof marker?.sessionId !== "string" || marker?.cacheRoot !== cacheRoot) throw new Error("session rollout ownership marker mismatch");
         const preservedAtMs = typeof marker.preservedAt === "string" ? Date.parse(marker.preservedAt) : Number.NaN;
         const markerAgeMs = nowMs - (Number.isFinite(preservedAtMs) ? preservedAtMs : markerStat.mtimeMs);
         if (markerAgeMs < rolloutTtlMs) continue;
         rmSync2(cacheRoot, { recursive: true, force: false });
-        if (existsSync2(cacheRoot)) throw new Error("session rollout cache still exists");
+        if (existsSync3(cacheRoot)) throw new Error("session rollout cache still exists");
         removedRollouts += 1;
       } catch (error) {
         failures.push({ profileRoot: cacheRoot, error: error instanceof Error ? error.message : String(error) });
@@ -2575,9 +2781,9 @@ function compileCommandPromptWithManifest(input, options = {}) {
 }
 
 // src/amaster-runtime-daemon/config-state.mjs
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync3, renameSync, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync4, renameSync as renameSync2, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "node:fs";
 import { homedir as homedir2, hostname } from "node:os";
-import { dirname as dirname3, join as join4 } from "node:path";
+import { dirname as dirname4, join as join5 } from "node:path";
 
 // src/amaster-runtime-daemon/executor-discovery.mjs
 import { spawnSync as spawnSync3 } from "node:child_process";
@@ -2693,26 +2899,26 @@ function defaultMachineId() {
 }
 function runtimeHome(env) {
   return expandHomePath(String(
-    env.AMASTER_RUNTIME_STATE_HOME || env.AMASTER_RUNTIME_HOME || join4(homedir2(), ".amaster-employee")
+    env.AMASTER_RUNTIME_STATE_HOME || env.AMASTER_RUNTIME_HOME || join5(homedir2(), ".amaster-employee")
   ));
 }
 function stateFilePath(env) {
-  return env.AMASTER_DAEMON_STATE_FILE ? expandHomePath(String(env.AMASTER_DAEMON_STATE_FILE)) : join4(runtimeHome(env), "runtime-connector-state.json");
+  return env.AMASTER_DAEMON_STATE_FILE ? expandHomePath(String(env.AMASTER_DAEMON_STATE_FILE)) : join5(runtimeHome(env), "runtime-connector-state.json");
 }
 function corruptStatePath(path) {
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/\D/g, "").slice(0, 14);
   const base = `${path}.corrupt-${timestamp}Z`;
   let candidate = base;
-  for (let suffix = 1; existsSync3(candidate); suffix += 1) {
+  for (let suffix = 1; existsSync4(candidate); suffix += 1) {
     candidate = `${base}.${suffix}`;
   }
   return candidate;
 }
 function readState(env) {
   const path = stateFilePath(env);
-  if (!existsSync3(path)) return {};
+  if (!existsSync4(path)) return {};
   try {
-    const state = JSON.parse(readFileSync3(path, "utf8"));
+    const state = JSON.parse(readFileSync4(path, "utf8"));
     if (!state || typeof state !== "object" || Array.isArray(state)) {
       throw new TypeError("runtime connector state must be a JSON object");
     }
@@ -2720,7 +2926,7 @@ function readState(env) {
   } catch {
     const quarantinePath = corruptStatePath(path);
     try {
-      renameSync(path, quarantinePath);
+      renameSync2(path, quarantinePath);
       process.stderr.write(`AMaster runtime state was invalid and quarantined at ${quarantinePath}
 `);
     } catch (error) {
@@ -2734,15 +2940,15 @@ function readState(env) {
 }
 function writeState(env, state) {
   const path = stateFilePath(env);
-  mkdirSync3(dirname3(path), { recursive: true });
+  mkdirSync4(dirname4(path), { recursive: true });
   const temporaryPath = `${path}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`;
   try {
-    writeFileSync3(temporaryPath, `${JSON.stringify(state, null, 2)}
+    writeFileSync4(temporaryPath, `${JSON.stringify(state, null, 2)}
 `, {
       flag: "wx",
       mode: 384
     });
-    renameSync(temporaryPath, path);
+    renameSync2(temporaryPath, path);
   } finally {
     rmSync3(temporaryPath, { force: true });
   }
@@ -2756,9 +2962,9 @@ function buildConfig(env = process.env, flags = {}) {
   const authHeader = String(flags.authHeader ?? env.AMASTER_CONNECTOR_AUTH_HEADER ?? "");
   const home = runtimeHome(env);
   const runtimeWorkspacesRoot = expandHomePath(
-    String(flags.runtimeWorkspacesRoot ?? env.AMASTER_RUNTIME_WORKSPACES_ROOT ?? join4(home, "workspaces"))
+    String(flags.runtimeWorkspacesRoot ?? env.AMASTER_RUNTIME_WORKSPACES_ROOT ?? join5(home, "workspaces"))
   );
-  mkdirSync3(runtimeWorkspacesRoot, { recursive: true });
+  mkdirSync4(runtimeWorkspacesRoot, { recursive: true });
   const workspaceBindings = splitList(
     flags.workspaceAllowlist ?? env.AMASTER_WORKSPACE_ALLOWLIST ?? env.AMASTER_WORKSPACE_BINDINGS ?? runtimeWorkspacesRoot
   ).map(expandHomePath);
@@ -4000,7 +4206,7 @@ var bestEffortPostJson = bestEffortPostRuntimeConnectorJson;
 
 // src/amaster-runtime-daemon/runtime-artifact-upload.mjs
 import { createHash as createHash3 } from "node:crypto";
-import { lstatSync as lstatSync3, readFileSync as readFileSync4, realpathSync } from "node:fs";
+import { lstatSync as lstatSync3, readFileSync as readFileSync5, realpathSync } from "node:fs";
 import { isAbsolute as isAbsolute3, relative as relative3, resolve as resolve3 } from "node:path";
 var SHA256_PATTERN = /^[a-f0-9]{64}$/;
 function requiredString(value, name) {
@@ -4041,7 +4247,7 @@ function prepareRuntimeArtifactUploads(cwd, mcpToolResults) {
     if (!stat.isFile() || stat.isSymbolicLink() || !pathWithin(realpathSync(sourcePath), root)) {
       throw new Error(`Runtime Artifact ${intentId} source is not an owned regular file`);
     }
-    const body = readFileSync4(sourcePath);
+    const body = readFileSync5(sourcePath);
     const actualSha256 = createHash3("sha256").update(body).digest("hex");
     if (body.length !== expectedByteSize || actualSha256 !== expectedSha256) {
       throw new Error(`Runtime Artifact ${intentId} bytes do not match the governed ownership manifest`);
@@ -4092,40 +4298,40 @@ function createRuntimeArtifactIngestQueue({ ingest, onError }) {
 
 // src/amaster-runtime-daemon/workspace-guard.mjs
 import { createHash as createHash4 } from "node:crypto";
-import { existsSync as existsSync5, mkdirSync as mkdirSync4, realpathSync as realpathSync2, statSync as statSync3 } from "node:fs";
-import { basename as basename4, join as join6, isAbsolute as isAbsolute4, relative as relative4, resolve as resolve4 } from "node:path";
+import { existsSync as existsSync6, mkdirSync as mkdirSync5, realpathSync as realpathSync2, statSync as statSync3 } from "node:fs";
+import { basename as basename4, join as join7, isAbsolute as isAbsolute4, relative as relative4, resolve as resolve4 } from "node:path";
 
 // src/amaster-runtime-daemon/workspace-manifest.mjs
-import { existsSync as existsSync4, readFileSync as readFileSync5, renameSync as renameSync2, rmSync as rmSync4, writeFileSync as writeFileSync4 } from "node:fs";
-import { basename as basename3, dirname as dirname4, join as join5 } from "node:path";
+import { existsSync as existsSync5, readFileSync as readFileSync6, renameSync as renameSync3, rmSync as rmSync4, writeFileSync as writeFileSync5 } from "node:fs";
+import { basename as basename3, dirname as dirname5, join as join6 } from "node:path";
 var WORKSPACE_MANIFEST_FILENAME = ".amaster-runtime.json";
 function nowIso() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
 function workspaceManifestPath(workspaceOrCwd) {
   if (!workspaceOrCwd) return null;
-  if (typeof workspaceOrCwd === "string") return join5(workspaceOrCwd, WORKSPACE_MANIFEST_FILENAME);
-  if (typeof workspaceOrCwd.cwd === "string") return join5(workspaceOrCwd.cwd, WORKSPACE_MANIFEST_FILENAME);
+  if (typeof workspaceOrCwd === "string") return join6(workspaceOrCwd, WORKSPACE_MANIFEST_FILENAME);
+  if (typeof workspaceOrCwd.cwd === "string") return join6(workspaceOrCwd.cwd, WORKSPACE_MANIFEST_FILENAME);
   return null;
 }
 function readWorkspaceManifest(manifestPath) {
-  if (!manifestPath || !existsSync4(manifestPath)) return null;
+  if (!manifestPath || !existsSync5(manifestPath)) return null;
   try {
-    const parsed = JSON.parse(readFileSync5(manifestPath, "utf8"));
+    const parsed = JSON.parse(readFileSync6(manifestPath, "utf8"));
     return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
   } catch {
     return null;
   }
 }
 function writeWorkspaceManifest(manifestPath, manifest) {
-  const tempPath = join5(
-    dirname4(manifestPath),
+  const tempPath = join6(
+    dirname5(manifestPath),
     `.${basename3(manifestPath)}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`
   );
   try {
-    writeFileSync4(tempPath, `${JSON.stringify(manifest, null, 2)}
+    writeFileSync5(tempPath, `${JSON.stringify(manifest, null, 2)}
 `, { mode: 384 });
-    renameSync2(tempPath, manifestPath);
+    renameSync3(tempPath, manifestPath);
   } catch (err) {
     rmSync4(tempPath, { force: true });
     throw err;
@@ -4196,7 +4402,7 @@ function resolveWorkspaceCwd(config, command) {
   if (!allowed) {
     throw new Error(`Workspace path is outside AMASTER_WORKSPACE_ALLOWLIST: ${cwd}`);
   }
-  if (!existsSync5(cwd) || !statSync3(cwd).isDirectory()) {
+  if (!existsSync6(cwd) || !statSync3(cwd).isDirectory()) {
     throw new Error(`Workspace path does not exist or is not a directory: ${cwd}`);
   }
   return cwd;
@@ -4227,7 +4433,7 @@ function workspaceLabel(sourceWorkspacePath, payload) {
 }
 function workspacesRoot(config) {
   const root = resolve4(expandHomePath(config.runtimeWorkspacesRoot ?? "~/.amaster-employee/workspaces"));
-  mkdirSync4(root, { recursive: true });
+  mkdirSync5(root, { recursive: true });
   return realpathSync2(root);
 }
 function resolveExecutionWorkspace(config, command, opts = {}) {
@@ -4240,11 +4446,11 @@ function resolveExecutionWorkspace(config, command, opts = {}) {
   const workspaceKey = `${safeSegment(workspaceLabel(sourceWorkspacePath, payload), "workspace")}-${shortHash(sourceWorkspacePath)}`;
   const issueKey = `${safeSegment(issueLabel(command, payload), "issue")}-${shortHash(issueId, 8)}`;
   const runKey = `${safeSegment(runId, "run")}-${shortHash(runId, 8)}`;
-  const runDir = join6(root, workspaceKey, issueKey, runKey);
-  const cwd = join6(runDir, "workdir");
-  const executorHome = join6(runDir, "executors", safeSegment(executorKind, "executor"));
-  mkdirSync4(cwd, { recursive: true });
-  mkdirSync4(executorHome, { recursive: true });
+  const runDir = join7(root, workspaceKey, issueKey, runKey);
+  const cwd = join7(runDir, "workdir");
+  const executorHome = join7(runDir, "executors", safeSegment(executorKind, "executor"));
+  mkdirSync5(cwd, { recursive: true });
+  mkdirSync5(executorHome, { recursive: true });
   const workspace = {
     managed: true,
     cwd,
@@ -4266,8 +4472,8 @@ function resolveExecutionWorkspace(config, command, opts = {}) {
 }
 
 // src/amaster-runtime-daemon/workspace-gc.mjs
-import { existsSync as existsSync6, readdirSync as readdirSync3, statSync as statSync4 } from "node:fs";
-import { join as join7, resolve as resolve5 } from "node:path";
+import { existsSync as existsSync7, readdirSync as readdirSync3, statSync as statSync4 } from "node:fs";
+import { join as join8, resolve as resolve5 } from "node:path";
 function readIsoTime(value) {
   if (typeof value !== "string" || !value.trim()) return null;
   const time = new Date(value).getTime();
@@ -4290,8 +4496,8 @@ function walkWorkdirs(root) {
     }
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
-      const fullPath = join7(current, entry.name);
-      if (entry.name === "workdir" && existsSync6(workspaceManifestPath(fullPath))) {
+      const fullPath = join8(current, entry.name);
+      if (entry.name === "workdir" && existsSync7(workspaceManifestPath(fullPath))) {
         workdirs.push(fullPath);
         continue;
       }
@@ -4322,7 +4528,7 @@ function directorySizeBytes(path) {
         continue;
       }
       for (const entry of entries) {
-        stack.push(join7(current, entry.name));
+        stack.push(join8(current, entry.name));
       }
       continue;
     }
@@ -4366,7 +4572,7 @@ function planManagedWorkspaceGcDryRun(input) {
     candidates: [],
     protected: []
   };
-  if (!root || !existsSync6(root)) return result2;
+  if (!root || !existsSync7(root)) return result2;
   for (const workdir of walkWorkdirs(root)) {
     const manifest = readWorkspaceManifest(workspaceManifestPath(workdir));
     if (!manifest || manifest.managed !== true) continue;
@@ -4394,8 +4600,8 @@ function planManagedWorkspaceGcDryRun(input) {
 }
 
 // src/amaster-runtime-daemon/runtime-status-summary.mjs
-import { existsSync as existsSync7, readdirSync as readdirSync4, statSync as statSync5 } from "node:fs";
-import { dirname as dirname5, join as join8, resolve as resolve6 } from "node:path";
+import { existsSync as existsSync8, readdirSync as readdirSync4, statSync as statSync5 } from "node:fs";
+import { dirname as dirname6, join as join9, resolve as resolve6 } from "node:path";
 function runtimeStatusDirectoryEntries(path) {
   try {
     return readdirSync4(path, { withFileTypes: true });
@@ -4418,7 +4624,7 @@ function runtimeStatusDirectorySizeBytes(path) {
     if (!stat || stat.isSymbolicLink()) continue;
     if (stat.isDirectory()) {
       for (const entry of runtimeStatusDirectoryEntries(current)) {
-        stack.push(join8(current, entry.name));
+        stack.push(join9(current, entry.name));
       }
       continue;
     }
@@ -4428,15 +4634,15 @@ function runtimeStatusDirectorySizeBytes(path) {
 }
 function walkRuntimeStatusManagedWorkdirs(root) {
   const workdirs = [];
-  if (!root || !existsSync7(root)) return workdirs;
+  if (!root || !existsSync8(root)) return workdirs;
   const stack = [root];
   while (stack.length > 0) {
     const current = stack.pop();
     if (!current) continue;
     for (const entry of runtimeStatusDirectoryEntries(current)) {
       if (!entry.isDirectory()) continue;
-      const fullPath = join8(current, entry.name);
-      if (entry.name === "workdir" && existsSync7(workspaceManifestPath(fullPath))) {
+      const fullPath = join9(current, entry.name);
+      if (entry.name === "workdir" && existsSync8(workspaceManifestPath(fullPath))) {
         workdirs.push(fullPath);
         continue;
       }
@@ -4477,12 +4683,12 @@ function summarizeRuntimeStatusRecentRun(workdir, manifest) {
 }
 function runtimeStatusOutboxDir(config) {
   const statePath = config.AMASTER_DAEMON_STATE_FILE ?? config.daemonStateFile;
-  return join8(dirname5(stateFilePath({
+  return join9(dirname6(stateFilePath({
     AMASTER_DAEMON_STATE_FILE: statePath
   })), "result-outbox");
 }
 function countRuntimeStatusJsonEntries(dir) {
-  if (!existsSync7(dir)) return 0;
+  if (!existsSync8(dir)) return 0;
   return runtimeStatusDirectoryEntries(dir).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).length;
 }
 function summarizeRuntimeLocalState(input) {
@@ -4514,7 +4720,7 @@ function summarizeRuntimeLocalState(input) {
     }
   }
   const pendingOutboxDir = runtimeStatusOutboxDir(config);
-  const invalidOutboxDir = join8(pendingOutboxDir, "invalid");
+  const invalidOutboxDir = join9(pendingOutboxDir, "invalid");
   return {
     managedWorkspacesRoot: root,
     managedWorkdirCount: workdirs.length,
@@ -4691,16 +4897,16 @@ import { createHash as createHash6 } from "node:crypto";
 import {
   chmodSync as chmodSync4,
   copyFileSync as copyFileSync2,
-  existsSync as existsSync8,
+  existsSync as existsSync9,
   lstatSync as lstatSync5,
-  mkdirSync as mkdirSync5,
-  readFileSync as readFileSync6,
+  mkdirSync as mkdirSync6,
+  readFileSync as readFileSync7,
   readdirSync as readdirSync6,
   rmSync as rmSync5,
   symlinkSync as symlinkSync2,
-  writeFileSync as writeFileSync5
+  writeFileSync as writeFileSync6
 } from "node:fs";
-import { dirname as dirname6, isAbsolute as isAbsolute5, join as join9, relative as relative5, resolve as resolve8 } from "node:path";
+import { dirname as dirname7, isAbsolute as isAbsolute5, join as join10, relative as relative5, resolve as resolve8 } from "node:path";
 var ASSERTION_VERSION = "2026-07-25.v1";
 var SHA256 = /^[a-f0-9]{64}$/;
 var COPY_ENTRIES = ["SYSTEM.md", "policy", "skills", "agents", "bundles", "extensions"];
@@ -4725,7 +4931,7 @@ function sha256File(path, label) {
   if (!stat.isFile() || stat.isSymbolicLink()) {
     throw new Error(`pi_trusted_runtime_source_unsafe:${label}`);
   }
-  return createHash6("sha256").update(readFileSync6(path)).digest("hex");
+  return createHash6("sha256").update(readFileSync7(path)).digest("hex");
 }
 function verifyDeclaredFiles(manifest, root, label, ignoredPaths = [], enforceComplete = true) {
   if (!Array.isArray(manifest.files) || manifest.files.length === 0) {
@@ -4748,7 +4954,7 @@ function verifyDeclaredFiles(manifest, root, label, ignoredPaths = [], enforceCo
   const ignored = ignoredPaths.map((path) => path.split("\\").join("/"));
   const visit = (directory) => {
     for (const entry of readdirSync6(directory)) {
-      const filePath = join9(directory, entry);
+      const filePath = join10(directory, entry);
       const relativePath = relative5(root, filePath).split("\\").join("/");
       const stat = lstatSync5(filePath);
       if (stat.isSymbolicLink()) {
@@ -4773,14 +4979,14 @@ function within2(candidate, root) {
   const rel = relative5(root, candidate);
   return rel === "" || !rel.startsWith("..") && !isAbsolute5(rel);
 }
-function readJsonFile(path, label, fallback = {}) {
-  if (!existsSync8(path)) return fallback;
+function readJsonFile2(path, label, fallback = {}) {
+  if (!existsSync9(path)) return fallback;
   const stat = lstatSync5(path);
   if (!stat.isFile() || stat.isSymbolicLink()) {
     throw new Error(`pi_trusted_runtime_source_unsafe:${label}`);
   }
   try {
-    return JSON.parse(readFileSync6(path, "utf8"));
+    return JSON.parse(readFileSync7(path, "utf8"));
   } catch {
     throw new Error(`pi_trusted_runtime_source_invalid:${label}`);
   }
@@ -4811,21 +5017,21 @@ function copyTreeNoLinks(source, target) {
   const stat = lstatSync5(source);
   if (stat.isSymbolicLink()) throw new Error("pi_trusted_runtime_source_symlink_blocked");
   if (stat.isDirectory()) {
-    mkdirSync5(target, { recursive: true, mode: 448 });
+    mkdirSync6(target, { recursive: true, mode: 448 });
     chmodSync4(target, 448);
     for (const entry of readdirSync6(source)) {
-      copyTreeNoLinks(join9(source, entry), join9(target, entry));
+      copyTreeNoLinks(join10(source, entry), join10(target, entry));
     }
     return;
   }
   if (!stat.isFile()) throw new Error("pi_trusted_runtime_source_type_blocked");
-  mkdirSync5(dirname6(target), { recursive: true, mode: 448 });
+  mkdirSync6(dirname7(target), { recursive: true, mode: 448 });
   copyFileSync2(source, target);
   chmodSync4(target, 384 | stat.mode & 73);
 }
 function mergeMcp(seedRoot, overlayRoot, governedConfig) {
-  const seed = record2(readJsonFile(join9(seedRoot, "mcp.json"), "seed_mcp", { mcpServers: {} }));
-  const overlay = record2(readJsonFile(join9(overlayRoot, "mcp.json"), "overlay_mcp", { mcpServers: {} }));
+  const seed = record2(readJsonFile2(join10(seedRoot, "mcp.json"), "seed_mcp", { mcpServers: {} }));
+  const overlay = record2(readJsonFile2(join10(overlayRoot, "mcp.json"), "overlay_mcp", { mcpServers: {} }));
   assertNoPersistentSecrets(seed, ["seed", "mcp.json"]);
   assertNoPersistentSecrets(overlay, ["overlay", "mcp.json"]);
   const seedServers = record2(seed.mcpServers);
@@ -4860,8 +5066,8 @@ function assertEnabledPackagesAvailable(settings, npmRoot) {
     }
   }
   for (const name of requiredNames) {
-    const metadataPath = join9(npmRoot, "node_modules", ...name.split("/"), "package.json");
-    const metadata = readJsonFile(metadataPath, `package:${name}`, null);
+    const metadataPath = join10(npmRoot, "node_modules", ...name.split("/"), "package.json");
+    const metadata = readJsonFile2(metadataPath, `package:${name}`, null);
     if (!metadata || metadata.name !== name) {
       throw new Error(`pi_trusted_runtime_package_unavailable:${name}`);
     }
@@ -4880,17 +5086,17 @@ function materializeTrustedPiRuntimeProfile(input) {
     }
   }
   for (const entry of COPY_ENTRIES) {
-    const target = join9(agentDir, entry);
+    const target = join10(agentDir, entry);
     rmSync5(target, { recursive: true, force: true });
     for (const sourceRoot of [seedRoot, overlayRoot]) {
-      const source = join9(sourceRoot, entry);
-      if (existsSync8(source)) copyTreeNoLinks(source, target);
+      const source = join10(sourceRoot, entry);
+      if (existsSync9(source)) copyTreeNoLinks(source, target);
     }
   }
   const mergedJson = {};
   for (const entry of JSON_ENTRIES) {
-    const seed = readJsonFile(join9(seedRoot, entry), `seed_${entry}`, {});
-    const overlay = readJsonFile(join9(overlayRoot, entry), `overlay_${entry}`, {});
+    const seed = readJsonFile2(join10(seedRoot, entry), `seed_${entry}`, {});
+    const overlay = readJsonFile2(join10(overlayRoot, entry), `overlay_${entry}`, {});
     const merged = deepMerge(seed, overlay);
     if (entry === "settings.json") {
       merged["pi-security"] = {
@@ -4903,21 +5109,21 @@ function materializeTrustedPiRuntimeProfile(input) {
       };
     }
     assertNoPersistentSecrets(merged, [entry]);
-    writeFileSync5(join9(agentDir, entry), `${JSON.stringify(merged, null, 2)}
+    writeFileSync6(join10(agentDir, entry), `${JSON.stringify(merged, null, 2)}
 `, {
       mode: 384
     });
-    chmodSync4(join9(agentDir, entry), 384);
+    chmodSync4(join10(agentDir, entry), 384);
     mergedJson[entry] = merged;
   }
-  const governedConfig = readJsonFile(input.governedMcpConfigPath, "governed_mcp");
+  const governedConfig = readJsonFile2(input.governedMcpConfigPath, "governed_mcp");
   const mcp = mergeMcp(seedRoot, overlayRoot, governedConfig);
-  writeFileSync5(input.governedMcpConfigPath, `${JSON.stringify(mcp, null, 2)}
+  writeFileSync6(input.governedMcpConfigPath, `${JSON.stringify(mcp, null, 2)}
 `, { mode: 384 });
   chmodSync4(input.governedMcpConfigPath, 384);
-  const npmRoot = join9(seedRoot, "npm");
+  const npmRoot = join10(seedRoot, "npm");
   assertEnabledPackagesAvailable(mergedJson["settings.json"], npmRoot);
-  const npmTarget = join9(agentDir, "npm");
+  const npmTarget = join10(agentDir, "npm");
   rmSync5(npmTarget, { recursive: true, force: true });
   const npmStat = lstatSync5(npmRoot);
   if (!npmStat.isDirectory() || npmStat.isSymbolicLink()) {
@@ -4962,13 +5168,13 @@ function readTrustedPiRuntimeAudit(input) {
   const profileRoot = resolve8(requiredString2(input.profileRoot, "profileRoot"));
   const auditFile = resolve8(requiredString2(input.auditFile, "auditFile"));
   if (!within2(auditFile, profileRoot)) throw new Error("pi_trusted_runtime_audit_path_escape");
-  if (!existsSync8(auditFile)) throw new Error("pi_trusted_runtime_audit_startup_missing");
+  if (!existsSync9(auditFile)) throw new Error("pi_trusted_runtime_audit_startup_missing");
   const stat = lstatSync5(auditFile);
   if (!stat.isFile() || stat.isSymbolicLink()) {
     throw new Error("pi_trusted_runtime_audit_unsafe");
   }
   if (stat.size > MAX_AUDIT_BYTES) throw new Error("pi_trusted_runtime_audit_too_large");
-  const lines = readFileSync6(auditFile, "utf8").split("\n").filter(Boolean);
+  const lines = readFileSync7(auditFile, "utf8").split("\n").filter(Boolean);
   if (lines.length === 0 || lines.length > MAX_AUDIT_EVENTS) {
     throw new Error("pi_trusted_runtime_audit_event_count_invalid");
   }
@@ -5025,11 +5231,11 @@ function readTrustedPiRuntimeLocalDigests(input) {
       throw new Error(`pi_trusted_runtime_source_unsafe:${label}`);
     }
   }
-  const seedManifestFile = join9(seedRoot, "seed-manifest.json");
-  const overlayManifestFile = join9(overlayRoot, "runtime-overlay-manifest.json");
-  const seedManifest = JSON.parse(readFileSync6(seedManifestFile, "utf8"));
-  const overlayManifest = JSON.parse(readFileSync6(overlayManifestFile, "utf8"));
-  const policyManifest = JSON.parse(readFileSync6(policyFile, "utf8"));
+  const seedManifestFile = join10(seedRoot, "seed-manifest.json");
+  const overlayManifestFile = join10(overlayRoot, "runtime-overlay-manifest.json");
+  const seedManifest = JSON.parse(readFileSync7(seedManifestFile, "utf8"));
+  const overlayManifest = JSON.parse(readFileSync7(overlayManifestFile, "utf8"));
+  const policyManifest = JSON.parse(readFileSync7(policyFile, "utf8"));
   verifyDeclaredFiles(seedManifest, seedRoot, "seed", [
     "seed-manifest.json",
     "npm/package-lock.json",
@@ -5038,9 +5244,9 @@ function readTrustedPiRuntimeLocalDigests(input) {
   verifyDeclaredFiles(overlayManifest, overlayRoot, "overlay", ["runtime-overlay-manifest.json"]);
   verifyDeclaredFiles(
     policyManifest,
-    dirname6(policyFile),
+    dirname7(policyFile),
     "policy",
-    [relative5(dirname6(policyFile), policyFile)],
+    [relative5(dirname7(policyFile), policyFile)],
     false
   );
   return {
@@ -5130,199 +5336,6 @@ function verifyTrustedPiRuntimeAssertion(input) {
   };
 }
 
-// src/amaster-runtime-daemon/pi-provider-config.mjs
-import { existsSync as existsSync9, mkdirSync as mkdirSync6, readFileSync as readFileSync7, renameSync as renameSync3, writeFileSync as writeFileSync6 } from "node:fs";
-import { dirname as dirname7, join as join10 } from "node:path";
-var AMASTER_API_KEY_ENV_REFERENCE = "${AMASTER_API_KEY}";
-var AMASTER_BILLING_HEADER_ENV_REFERENCES = Object.freeze({
-  "x-pi-agent-oauth-token": "${AMASTER_PLATFORM_OAUTH_TOKEN}",
-  "x-organization-id": "${AMASTER_PLATFORM_ORGANIZATION_ID}",
-  "x-billing-turn-id": "${AMASTER_BILLING_TURN_ID}"
-});
-function isRecord(value) {
-  return value && typeof value === "object" && !Array.isArray(value);
-}
-function readJsonFile2(filePath) {
-  try {
-    const parsed = JSON.parse(readFileSync7(filePath, "utf8"));
-    return asRecord(parsed);
-  } catch {
-    return {};
-  }
-}
-function writeJsonFileAtomic(filePath, value) {
-  mkdirSync6(dirname7(filePath), { recursive: true });
-  const tmpPath = `${filePath}.tmp.${process.pid}.${Date.now()}`;
-  writeFileSync6(tmpPath, `${JSON.stringify(value, null, 2)}
-`, { mode: 384 });
-  renameSync3(tmpPath, filePath);
-}
-function imageGenBaseUrlFromProviderBaseUrl(value) {
-  const input = readString(value);
-  if (!input) return void 0;
-  try {
-    const url = new URL(input);
-    const pathname = url.pathname.replace(/\/+$/, "");
-    if (pathname.toLowerCase().endsWith("/v1")) {
-      url.pathname = pathname.slice(0, -"/v1".length) || "/";
-    }
-    return url.toString();
-  } catch {
-    return input.replace(/\/v1\/?$/, "");
-  }
-}
-function ensureAmasterProviderModel(models, modelId, flash) {
-  const id = readString(modelId);
-  if (!id) return;
-  const existing = Array.isArray(models) ? models : [];
-  const index = existing.findIndex((entry) => asRecord(entry).id === id);
-  if (index >= 0) {
-    existing[index] = {
-      ...asRecord(existing[index]),
-      id,
-      input: readStringArray(asRecord(existing[index]).input).length > 0 ? asRecord(existing[index]).input : ["text", "image"],
-      reasoning: asRecord(existing[index]).reasoning ?? true,
-      ...flash ? { flash: true } : {}
-    };
-    return;
-  }
-  existing.push({
-    id,
-    input: ["text", "image"],
-    reasoning: true,
-    ...flash ? { flash: true } : {}
-  });
-}
-function withoutManagedBillingHeaders(value) {
-  const headers = { ...asRecord(value) };
-  for (const name of Object.keys(AMASTER_BILLING_HEADER_ENV_REFERENCES)) {
-    delete headers[name];
-  }
-  return headers;
-}
-function syncManagedBillingHeaders(value, executorEnv) {
-  const headers = withoutManagedBillingHeaders(value);
-  if (readString(executorEnv.AMASTER_MODEL_ACCESS_MODE) === "billing_gateway") {
-    Object.assign(headers, AMASTER_BILLING_HEADER_ENV_REFERENCES);
-  }
-  return Object.keys(headers).length > 0 ? headers : void 0;
-}
-function managedApiKeyConfigValue(executorEnv, apiKey) {
-  return readString(executorEnv.AMASTER_MODEL_ACCESS_MODE) === "billing_gateway" ? AMASTER_API_KEY_ENV_REFERENCE : apiKey;
-}
-function syncAmasterProviderModels(agentDir, executorEnv) {
-  const apiKey = readString(executorEnv.AMASTER_API_KEY);
-  if (!apiKey) return false;
-  const modelsPath = join10(agentDir, "models.json");
-  const config = readJsonFile2(modelsPath);
-  const providers = asRecord(config.providers);
-  const amaster = { ...asRecord(providers.amaster) };
-  amaster.apiKey = managedApiKeyConfigValue(executorEnv, apiKey);
-  const baseUrl = readString(executorEnv.AMASTER_PROVIDER_BASE_URL);
-  if (baseUrl) amaster.baseUrl = baseUrl;
-  if (!readString(amaster.api)) amaster.api = "openai-completions";
-  const headers = syncManagedBillingHeaders(amaster.headers, executorEnv);
-  if (headers) amaster.headers = headers;
-  else delete amaster.headers;
-  const models = Array.isArray(amaster.models) ? [...amaster.models] : [];
-  ensureAmasterProviderModel(models, executorEnv.AMASTER_PROVIDER_DEFAULT_MODEL, false);
-  ensureAmasterProviderModel(models, executorEnv.AMASTER_PROVIDER_FLASH_MODEL, true);
-  if (models.length > 0) amaster.models = models;
-  writeJsonFileAtomic(modelsPath, {
-    ...config,
-    providers: {
-      ...providers,
-      amaster
-    }
-  });
-  return true;
-}
-function syncAmasterProviderSettings(agentDir, executorEnv) {
-  const apiKey = readString(executorEnv.AMASTER_API_KEY);
-  if (!apiKey) return false;
-  const settingsPath = join10(agentDir, "settings.json");
-  if (!existsSync9(settingsPath)) return false;
-  const settings = readJsonFile2(settingsPath);
-  const baseUrl = readString(executorEnv.AMASTER_PROVIDER_BASE_URL);
-  const defaultModel = readString(executorEnv.AMASTER_PROVIDER_DEFAULT_MODEL);
-  const imageGenBaseUrl = imageGenBaseUrlFromProviderBaseUrl(baseUrl);
-  let changed = false;
-  if (defaultModel) {
-    if (settings.defaultProvider !== "amaster") {
-      settings.defaultProvider = "amaster";
-      changed = true;
-    }
-    if (settings.defaultModel !== defaultModel) {
-      settings.defaultModel = defaultModel;
-      changed = true;
-    }
-  }
-  const imageGen = settings["pi-image-gen"];
-  if (isRecord(imageGen) && isRecord(imageGen.customProviders) && isRecord(imageGen.customProviders.amaster)) {
-    const customProviders = imageGen.customProviders;
-    const imageGenAmaster = { ...asRecord(customProviders.amaster) };
-    const managedApiKey = managedApiKeyConfigValue(executorEnv, apiKey);
-    if (imageGenAmaster.apiKey !== managedApiKey) {
-      imageGenAmaster.apiKey = managedApiKey;
-      changed = true;
-    }
-    if (imageGenBaseUrl && imageGenAmaster.baseUrl !== imageGenBaseUrl) {
-      imageGenAmaster.baseUrl = imageGenBaseUrl;
-      changed = true;
-    }
-    const imageGenHeaders = syncManagedBillingHeaders(imageGenAmaster.headers, executorEnv);
-    if (JSON.stringify(imageGenHeaders) !== JSON.stringify(imageGenAmaster.headers)) {
-      if (imageGenHeaders) imageGenAmaster.headers = imageGenHeaders;
-      else delete imageGenAmaster.headers;
-      changed = true;
-    }
-    settings["pi-image-gen"] = {
-      ...asRecord(imageGen),
-      customProviders: {
-        ...customProviders,
-        amaster: imageGenAmaster
-      }
-    };
-  }
-  const webAccess = settings["pi-web-access"];
-  if (isRecord(webAccess) && isRecord(webAccess.providers)) {
-    const webProviders = webAccess.providers;
-    const nextWebProviders = { ...webProviders };
-    for (const [name, rawProvider] of Object.entries(webProviders)) {
-      if (!isRecord(rawProvider)) continue;
-      const providerApiKey = readString(rawProvider.apiKey);
-      const providerBaseUrl = readString(rawProvider.baseUrl);
-      const looksAmasterBacked = name === "amaster" || name === "kimi" || providerApiKey === "${AMASTER_API_KEY}" || providerApiKey === "AMASTER_API_KEY" || providerBaseUrl?.includes("credits.helige") || providerBaseUrl?.includes("credits.amaster");
-      if (!looksAmasterBacked) continue;
-      const nextProvider = {
-        ...rawProvider,
-        apiKey: managedApiKeyConfigValue(executorEnv, apiKey),
-        ...baseUrl ? { baseUrl } : {}
-      };
-      const webAccessHeaders = syncManagedBillingHeaders(rawProvider.headers, executorEnv);
-      if (webAccessHeaders) nextProvider.headers = webAccessHeaders;
-      else delete nextProvider.headers;
-      if (JSON.stringify(nextProvider) !== JSON.stringify(rawProvider)) {
-        nextWebProviders[name] = nextProvider;
-        changed = true;
-      }
-    }
-    settings["pi-web-access"] = {
-      ...asRecord(webAccess),
-      providers: nextWebProviders
-    };
-  }
-  if (!changed) return false;
-  writeJsonFileAtomic(settingsPath, settings);
-  return true;
-}
-function syncAmasterProviderFiles(agentDir, executorEnv) {
-  return {
-    modelsSynced: syncAmasterProviderModels(agentDir, executorEnv),
-    settingsSynced: syncAmasterProviderSettings(agentDir, executorEnv)
-  };
-}
-
 // src/amaster-runtime-daemon/workspace-status.mjs
 import { spawnSync as spawnSync4 } from "node:child_process";
 import { createHash as createHash7 } from "node:crypto";
@@ -5598,7 +5611,7 @@ function readWorkspaceStatus(cwd, opts = {}) {
 }
 
 // src/amaster-runtime-daemon.mjs
-var CONNECTOR_VERSION = "0.1.0-beta.36";
+var CONNECTOR_VERSION = "0.1.0-beta.38";
 var CONNECTOR_CONTRACT_VERSION = "2026-06-04.v1";
 var MAX_CHECKPOINT_BYTES = 20 * 1024 * 1024;
 var CHECKPOINT_TTL_MS = 24 * 60 * 60 * 1e3;

package/dist/amaster-runtime.mjs

@@ -5,7 +5,7 @@ import { dirname, join, resolve } from "node:path";
 import { homedir, hostname } from "node:os";
 import { fileURLToPath } from "node:url";
 
-const CONNECTOR_VERSION = "0.1.0-beta.36";
+const CONNECTOR_VERSION = "0.1.0-beta.38";
 
 const CAPABILITIES = [
   "remote_registration",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amaster.ai/employee-runtime-connector",
-  "version": "0.1.0-beta.36",
+  "version": "0.1.0-beta.38",
   "description": "MirrorX runtime connector CLI and daemon",
   "license": "MIT",
   "type": "module",