@amaster.ai/employee-runtime-connector 0.1.1-beta.102 → 0.1.1-beta.103

package/dist/amaster-runtime-daemon.mjs

@@ -3490,7 +3490,7 @@ function createManagedPiMcpProfileApi(options = {}) {
   const PI_ATTESTATION_RECENT_LIVE_TTL_MS = Number.isFinite(options.recentLiveTtlMs) && options.recentLiveTtlMs > 0 ? options.recentLiveTtlMs : 30 * 60 * 1e3;
   const recentLivePiVersionProbes = /* @__PURE__ */ new Map();
   const effectiveToolsProbeCircuits = /* @__PURE__ */ new Map();
-  function record7(value) {
+  function record6(value) {
     return value && typeof value === "object" && !Array.isArray(value) ? value : {};
   }
   function readJsonObjectFile(filePath) {
@@ -3552,7 +3552,7 @@ function createManagedPiMcpProfileApi(options = {}) {
     return matches[0];
   }
   function restoreManagedPiSessionRollout(input, sessionsRoot, runDir, executorHome, authority) {
-    const session = record7(input.nativeSession);
+    const session = record6(input.nativeSession);
     if (session.mode !== "governed_action_approval" || session.required !== true) return null;
     const sessionId = nonEmpty2(session.sessionId, "nativeSession.sessionId");
     const sourceRunId = nonEmpty2(session.sourceRunId, "nativeSession.sourceRunId");
@@ -3838,11 +3838,11 @@ function createManagedPiMcpProfileApi(options = {}) {
     return sha2563(stablePiJson(identity2));
   }
   function validateDirectCatalog(gateway, mcpToolMode) {
-    const catalog = record7(gateway.toolCatalog);
+    const catalog = record6(gateway.toolCatalog);
     if (catalog.schemaVersion !== DIRECT_CATALOG_SCHEMA_VERSION) {
       throw new Error("pi_managed_mcp_invalid: direct tool catalog schema mismatch");
     }
-    const tools = Array.isArray(catalog.tools) ? catalog.tools.map(record7) : [];
+    const tools = Array.isArray(catalog.tools) ? catalog.tools.map(record6) : [];
     const declaredToolNames = new Set(tools.map((tool) => tool.name).filter((name) => typeof name === "string"));
     const covers = (set) => [...set].every((name) => declaredToolNames.has(name));
     const countIn = (set) => tools.filter((tool) => set.has(tool.name)).length;
@@ -3873,7 +3873,7 @@ function createManagedPiMcpProfileApi(options = {}) {
         throw new Error(`pi_managed_mcp_invalid: direct tool exposed name collision for ${exposedName}`);
       }
       exposedNames.add(exposedName);
-      const inputSchema = record7(tool.inputSchema);
+      const inputSchema = record6(tool.inputSchema);
       if (inputSchema.type !== "object" || inputSchema.additionalProperties !== false) {
         throw new Error(`pi_managed_mcp_invalid: direct tool schema is not strict for ${name}`);
       }
@@ -3960,8 +3960,8 @@ function createManagedPiMcpProfileApi(options = {}) {
     }
   }
   function validateAuthority2(input) {
-    const runtimeAuth = record7(input.runtimeAuth);
-    const gateway = record7(runtimeAuth.governedMcp);
+    const runtimeAuth = record6(input.runtimeAuth);
+    const gateway = record6(runtimeAuth.governedMcp);
     const runId = nonEmpty2(input.runId, "runId");
     if (runtimeAuth.runId !== runId) throw new Error("pi_managed_mcp_owner_mismatch: command runId does not match runtime authority");
     if (gateway.schemaVersion !== SUPPORTED_SCHEMA_VERSION2) throw new Error("pi_managed_mcp_invalid: unsupported schema version");
@@ -3977,7 +3977,7 @@ function createManagedPiMcpProfileApi(options = {}) {
     if (!Number.isFinite(expiresAt) || expiresAt <= Date.now() + 3e4) {
       throw new Error("pi_managed_mcp_session_expired: Gateway session must remain valid through spawn preflight");
     }
-    const headers = record7(gateway.headers);
+    const headers = record6(gateway.headers);
     for (const name of REQUIRED_AUTHORITY_HEADERS2) nonEmpty2(headers[name], `headers.${name}`);
     const allowedHeaderNames = /* @__PURE__ */ new Set([...REQUIRED_AUTHORITY_HEADERS2, ...runtimeAuth.issueId ? ["x-amaster-issue-id"] : []]);
     if (Object.keys(headers).some((name) => !allowedHeaderNames.has(name)) || Object.keys(headers).length !== allowedHeaderNames.size) {
@@ -4039,7 +4039,7 @@ function createManagedPiMcpProfileApi(options = {}) {
     return env;
   }
   function assertInvocationIsolation2(input) {
-    for (const name of Object.keys(record7(input.commandEnv))) {
+    for (const name of Object.keys(record6(input.commandEnv))) {
       if (FORBIDDEN_COMMAND_ENV2.has(name)) throw new Error(`pi_managed_mcp_env_override_blocked: ${name}`);
       if (!ALLOWED_COMMAND_ENV2.has(name)) throw new Error(`pi_managed_mcp_env_injection_blocked: ${name}`);
     }
@@ -4071,7 +4071,7 @@ function createManagedPiMcpProfileApi(options = {}) {
       const value = safeProxyValue2(baseEnv?.[name], name);
       if (value) env[name] = value;
     }
-    return { ...env, ...record7(commandEnv) };
+    return { ...env, ...record6(commandEnv) };
   }
   function sourceAcquisitionBrowserEnvironment(sourceAcquisition, baseEnv) {
     const env = {
@@ -4116,8 +4116,8 @@ function createManagedPiMcpProfileApi(options = {}) {
     } catch {
       return true;
     }
-    const config = record7(parsed);
-    return Object.keys(record7(config.mcpServers)).length > 0 || Object.keys(record7(config.servers)).length > 0 || Array.isArray(config.imports) && config.imports.length > 0;
+    const config = record6(parsed);
+    return Object.keys(record6(config.mcpServers)).length > 0 || Object.keys(record6(config.servers)).length > 0 || Array.isArray(config.imports) && config.imports.length > 0;
   }
   function walkProjectMcpConfigs(cwd, runDir, visit) {
     const start = resolve3(cwd);
@@ -4191,7 +4191,7 @@ function createManagedPiMcpProfileApi(options = {}) {
     let settings = {};
     if (existsSync4(settingsPath)) {
       try {
-        settings = record7(JSON.parse(readFileSync4(settingsPath, "utf8")));
+        settings = record6(JSON.parse(readFileSync4(settingsPath, "utf8")));
       } catch {
         throw new Error("pi_managed_mcp_attestation_failed: source Pi settings are invalid");
       }
@@ -4582,7 +4582,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         workspaceMcpConfigPath
       })}
 `);
-      const runtimeAuth = record7(input.runtimeAuth);
+      const runtimeAuth = record6(input.runtimeAuth);
       const authority = Object.freeze({
         companyId: nonEmpty2(runtimeAuth.companyId, "runtimeAuth.companyId"),
         agentId: nonEmpty2(runtimeAuth.agentId, "runtimeAuth.agentId"),
@@ -4924,11 +4924,11 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
   }
   function restoreManagedPiRunExitClosureBaseline2(input, expectedOwner2) {
     if (!input) return { status: "not_required" };
-    const baseline = record7(input);
+    const baseline = record6(input);
     if (!["amaster.pi-run-exit-closure-baseline.v1", "amaster.pi-run-exit-closure-baseline.v2"].includes(baseline.schemaVersion)) {
       throw new Error("pi_run_exit_closure_baseline_invalid: unsupported schema version");
     }
-    const owner = record7(baseline.owner);
+    const owner = record6(baseline.owner);
     if (owner.commandId !== expectedOwner2?.commandId || owner.runId !== expectedOwner2?.runId) {
       throw new Error("pi_run_exit_closure_baseline_owner_mismatch");
     }
@@ -4957,12 +4957,12 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
     if (sha2563(cacheContents) !== cacheSha256) {
       throw new Error("pi_run_exit_closure_baseline_cache_digest_mismatch");
     }
-    const baselineCacheOwnership = record7(baseline.cacheOwnership);
+    const baselineCacheOwnership = record6(baseline.cacheOwnership);
     const cacheOwnership = Number.isSafeInteger(baselineCacheOwnership.uid) && baselineCacheOwnership.uid >= 0 && Number.isSafeInteger(baselineCacheOwnership.gid) && baselineCacheOwnership.gid >= 0 ? { uid: baselineCacheOwnership.uid, gid: baselineCacheOwnership.gid } : existsSync4(cachePath) ? ownershipStatSyncImpl(cachePath) : null;
     if (!cacheOwnership) {
       throw new Error("pi_run_exit_closure_baseline_cache_owner_missing");
     }
-    const closureProfile = baseline.schemaVersion === "amaster.pi-run-exit-closure-baseline.v2" ? record7(baseline.closureProfile) : null;
+    const closureProfile = baseline.schemaVersion === "amaster.pi-run-exit-closure-baseline.v2" ? record6(baseline.closureProfile) : null;
     const closureToolAllowlist = closureProfile ? Array.isArray(closureProfile.toolAllowlist) ? closureProfile.toolAllowlist.filter((name) => typeof name === "string") : [] : null;
     if (closureToolAllowlist && (closureToolAllowlist.length !== RUN_EXIT_CLOSURE_DIRECT_TYPED_TOOL_NAMES.size || new Set(closureToolAllowlist).size !== RUN_EXIT_CLOSURE_DIRECT_TYPED_TOOL_NAMES.size || closureToolAllowlist.some((name) => !PROVIDER_SAFE_TOOL_NAME.test(name)))) {
       throw new Error("pi_run_exit_closure_baseline_tool_allowlist_invalid");
@@ -4988,7 +4988,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         path: configPath,
         bytes: Buffer.from(nonEmpty2(closureProfile.configContentsBase64, "closureProfile.configContentsBase64"), "base64"),
         expectedSha256: nonEmpty2(closureProfile.configSha256, "closureProfile.configSha256"),
-        ownership: record7(closureProfile.configOwnership),
+        ownership: record6(closureProfile.configOwnership),
         label: "config"
       },
       {
@@ -5002,7 +5002,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         path: manifestPath,
         bytes: Buffer.from(nonEmpty2(closureProfile.manifestContentsBase64, "closureProfile.manifestContentsBase64"), "base64"),
         expectedSha256: nonEmpty2(closureProfile.manifestSha256, "closureProfile.manifestSha256"),
-        ownership: record7(closureProfile.manifestOwnership),
+        ownership: record6(closureProfile.manifestOwnership),
         label: "manifest"
       }
     ] : [{
@@ -5039,8 +5039,8 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
   }
   function inspectManagedPiRunExitClosureAttestation2(input, expectedOwner2) {
     if (!input) return { status: "not_required" };
-    const baseline = record7(input);
-    const owner = record7(baseline.owner);
+    const baseline = record6(input);
+    const owner = record6(baseline.owner);
     if (owner.commandId !== expectedOwner2?.commandId || owner.runId !== expectedOwner2?.runId) {
       throw new Error("pi_run_exit_closure_baseline_owner_mismatch");
     }
@@ -5053,7 +5053,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
       throw new Error(`pi_run_exit_closure_baseline_unsafe: ${receiptPath}`);
     }
     try {
-      const receipt = record7(JSON.parse(readFileSync4(receiptPath, "utf8")));
+      const receipt = record6(JSON.parse(readFileSync4(receiptPath, "utf8")));
       return {
         status: nonEmpty2(receipt.status, "effectiveToolsReceipt.status"),
         ...typeof receipt.mode === "string" ? { mode: receipt.mode } : {},
@@ -5087,7 +5087,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
       const owner = Object.freeze({ commandId: input.commandId, runId });
       writePrivateFile2(markerPath, `${JSON.stringify({ version: 1, ...owner, profileRoot, piCodingAgentDir })}
 `);
-      const runtimeAuth = record7(input.runtimeAuth);
+      const runtimeAuth = record6(input.runtimeAuth);
       const authority = Object.freeze({
         companyId: nonEmpty2(runtimeAuth.companyId, "runtimeAuth.companyId"),
         agentId: nonEmpty2(runtimeAuth.agentId, "runtimeAuth.agentId"),
@@ -5114,11 +5114,11 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
       const config = {
         ...sourceMcp,
         settings: {
-          ...record7(sourceMcp.settings),
+          ...record6(sourceMcp.settings),
           ...mcpToolMode === MANAGED_PI_DIRECT_TYPED_MCP_TOOL_MODE ? { disableProxyTool: true } : {}
         },
         mcpServers: {
-          ...record7(sourceMcp.mcpServers),
+          ...record6(sourceMcp.mcpServers),
           [SUPPORTED_SERVER_NAME2]: serverConfig
         }
       };
@@ -5141,7 +5141,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
       }
       const env = {
         ...input.baseEnv,
-        ...record7(input.commandEnv),
+        ...record6(input.commandEnv),
         PI_AGENT_HOME: sourcePiHome,
         PI_CODING_AGENT_DIR: piCodingAgentDir,
         "AMASTER-CLI_CODING_AGENT_DIR": piCodingAgentDir,
@@ -5497,8 +5497,8 @@ function resultOutboxFileName(commandId, now = Date.now()) {
   return `${now}-${safeCommandId}.json`;
 }
 function isValidResultOutboxEntry(entry) {
-  const record7 = asRecord(entry);
-  return record7.version === 1 && Boolean(readString(record7.path)) && Object.keys(asRecord(record7.payload)).length > 0;
+  const record6 = asRecord(entry);
+  return record6.version === 1 && Boolean(readString(record6.path)) && Object.keys(asRecord(record6.payload)).length > 0;
 }
 function resultOutboxEntryAgeMs(entry, nowMs) {
   const createdAt = Date.parse(readString(entry.createdAt) ?? "");
@@ -5805,60 +5805,6 @@ function retainedSourceExecutorEntry(entry, executorKind) {
   };
 }
 
-// src/amaster-runtime-daemon/source-acquisition-profile.mjs
-var HEADLESS_ADAPTER = "pi_browser_use_headless_v1";
-var DESKTOP_ADAPTER = "browser_skill_desktop_v1";
-function invalid() {
-  return Object.assign(new Error("source_acquisition_profile_invalid"), {
-    code: "source_acquisition_profile_invalid"
-  });
-}
-function exactSourceLocator(value) {
-  if (typeof value !== "string" || value.length === 0) throw invalid();
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    throw invalid();
-  }
-  if (!["http:", "https:"].includes(url.protocol) || url.username || url.password) throw invalid();
-  return url;
-}
-function exactAuthenticationOrigin(value) {
-  const url = exactSourceLocator(value);
-  if (url.protocol !== "https:" || value !== url.origin) throw invalid();
-  return url.origin;
-}
-function exactSourceOrigin(value) {
-  const url = exactSourceLocator(value);
-  if (value !== url.origin) throw invalid();
-  return url.origin;
-}
-function inspectSourceAcquisitionProfile(profile, expectedRunId) {
-  const access = profile?.access;
-  const transport = profile?.transport;
-  const tools = profile?.tools;
-  const connectorAdmission = profile?.connectorAdmission;
-  if (!profile || typeof profile !== "object" || profile.retention !== "source_summary_only_v1" || profile.runId !== expectedRunId || !Array.isArray(tools?.exactAllowlist) || tools.exactAllowlist.length === 0 || !["public", "authenticated"].includes(access?.mode) || !["isolated", "existing"].includes(transport?.browserMode) || ![HEADLESS_ADAPTER, DESKTOP_ADAPTER].includes(transport?.adapter) || connectorAdmission?.adapter !== transport?.adapter) throw invalid();
-  if (access.mode === "public" && (transport.browserMode !== "isolated" || transport.adapter !== HEADLESS_ADAPTER) || access.mode === "authenticated" && (transport.browserMode !== "existing" || transport.adapter !== DESKTOP_ADAPTER)) throw invalid();
-  if (profile.purpose === "source_acquisition_v1") {
-    if (connectorAdmission.capability !== "source_acquisition_v1" || connectorAdmission.profileVersion !== "source_acquisition_v1") throw invalid();
-    const locators = [access.exactLocator, ...Array.isArray(access.declaredPageLocators) ? access.declaredPageLocators : []];
-    const sourceOrigins2 = [...new Set(locators.map((locator) => exactSourceLocator(locator).origin))];
-    return { version: profile.purpose, mode: access.mode, sourceOrigins: sourceOrigins2 };
-  }
-  if (profile.purpose !== "source_acquisition_v2" || connectorAdmission.capability !== "source_authentication_origin_discovery_v1" || connectorAdmission.profileVersion !== "source_acquisition_v2" || !Array.isArray(access.exactSourceLocators) || access.exactSourceLocators.length === 0 || !Array.isArray(access.sourceOrigins) || access.sourceOrigins.length === 0 || !Array.isArray(access.authorizedAuthenticationOrigins) || access.authenticationOriginDiscovery?.enabled !== true) throw invalid();
-  const derivedSourceOrigins = [...new Set(
-    access.exactSourceLocators.map((locator) => exactSourceLocator(locator).origin)
-  )];
-  const sourceOrigins = access.sourceOrigins.map(exactSourceOrigin);
-  const sourceOriginSet = new Set(sourceOrigins);
-  if (sourceOriginSet.size !== sourceOrigins.length || derivedSourceOrigins.length !== sourceOrigins.length || derivedSourceOrigins.some((origin) => !sourceOriginSet.has(origin))) throw invalid();
-  const authenticationOrigins = access.authorizedAuthenticationOrigins.map(exactAuthenticationOrigin);
-  if (authenticationOrigins.some((origin) => sourceOriginSet.has(origin))) throw invalid();
-  return { version: profile.purpose, mode: access.mode, sourceOrigins };
-}
-
 // src/amaster-runtime-daemon/prompt-compiler.mjs
 import { createHash as createHash6 } from "node:crypto";
 
@@ -6100,18 +6046,7 @@ function sourceAcquisitionPiInvocationArgs(profile) {
 }
 function serializeSourceAcquisitionProfile(profile) {
   if (!profile || typeof profile !== "object" || Array.isArray(profile)) return null;
-  const canonicalize = (value) => {
-    if (value === null || typeof value === "boolean" || typeof value === "string") {
-      return JSON.stringify(value);
-    }
-    if (typeof value === "number" && Number.isFinite(value)) return JSON.stringify(value);
-    if (Array.isArray(value)) return `[${value.map(canonicalize).join(",")}]`;
-    if (value && typeof value === "object") {
-      return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalize(value[key])}`).join(",")}}`;
-    }
-    throw new Error("source_acquisition_profile_canonicalization_failed");
-  };
-  const input = Buffer.from(canonicalize(profile), "utf8");
+  const input = Buffer.from(JSON.stringify(profile), "utf8");
   return {
     input,
     sha256: createHash5("sha256").update(input).digest("hex")
@@ -6202,19 +6137,19 @@ function promptContextMode(input) {
 }
 function filterDuplicatedTaskComments(context, mode) {
   if (mode !== "cold") return context;
-  const record7 = asRecord(context);
+  const record6 = asRecord(context);
   const included = new Set(
-    (Array.isArray(record7.paperclipTaskMarkdownCommentIds) ? record7.paperclipTaskMarkdownCommentIds : []).map((entry) => readString(entry)).filter(Boolean)
+    (Array.isArray(record6.paperclipTaskMarkdownCommentIds) ? record6.paperclipTaskMarkdownCommentIds : []).map((entry) => readString(entry)).filter(Boolean)
   );
   if (included.size === 0) return context;
-  const wake = asRecord(record7.paperclipWake);
+  const wake = asRecord(record6.paperclipWake);
   const comments = Array.isArray(wake.comments) ? wake.comments : [];
   const kept = comments.filter((entry) => {
     const id = readString(asRecord(entry).id);
     return !id || !included.has(id);
   });
   if (kept.length === comments.length) return context;
-  return { ...record7, paperclipWake: { ...wake, comments: kept } };
+  return { ...record6, paperclipWake: { ...wake, comments: kept } };
 }
 function commentRefs(context) {
   const comments = Array.isArray(asRecord(context.paperclipWake).comments) ? asRecord(context.paperclipWake).comments : [];
@@ -6348,8 +6283,8 @@ function governedReadSection(context) {
   const reads = Array.isArray(context.governedReadResults) ? context.governedReadResults : [];
   if (reads.length === 0) return { content: "", provenance: [] };
   const normalized = reads.map((entry, index) => {
-    const record7 = asRecord(entry);
-    const receipt = asRecord(record7.receipt);
+    const record6 = asRecord(entry);
+    const receipt = asRecord(record6.receipt);
     const provider = readString(receipt.provider) ?? readString(receipt.transport);
     const operation = readString(receipt.operation);
     const observedAt = readString(receipt.retrievedAt) ?? readString(receipt.observedAt);
@@ -6359,7 +6294,7 @@ function governedReadSection(context) {
       throw new Error(`governed_read_context_provenance_invalid: entry ${index} requires provider, operation, observedAt, and source`);
     }
     return {
-      content: record7.content,
+      content: record6.content,
       receipt: {
         provider,
         operation,
@@ -6405,11 +6340,11 @@ function governedBusinessDetailRead(input, issueId) {
   return { mode: "canonical", tool: canonicalTool, arguments: argumentsValue };
 }
 function governedBusinessDecisionProjection(state, detailRead) {
-  const record7 = asRecord(state);
-  const snapshot = asRecord(record7.governed_state_snapshot);
-  const authoritativeObjectRefs = Array.isArray(record7.authoritative_object_refs) ? record7.authoritative_object_refs : [];
-  const capabilities = Array.isArray(record7.capabilities) ? record7.capabilities : [];
-  const availability = asRecord(record7.availability);
+  const record6 = asRecord(state);
+  const snapshot = asRecord(record6.governed_state_snapshot);
+  const authoritativeObjectRefs = Array.isArray(record6.authoritative_object_refs) ? record6.authoritative_object_refs : [];
+  const capabilities = Array.isArray(record6.capabilities) ? record6.capabilities : [];
+  const availability = asRecord(record6.availability);
   const projection = {
     status: readString(availability.status) ?? null,
     objects: authoritativeObjectRefs.map((entry) => {
@@ -6424,7 +6359,7 @@ function governedBusinessDecisionProjection(state, detailRead) {
       }
       return compact;
     }),
-    missing: (Array.isArray(record7.missing_objects) ? record7.missing_objects : []).map((entry) => {
+    missing: (Array.isArray(record6.missing_objects) ? record6.missing_objects : []).map((entry) => {
       const missing = asRecord(entry);
       return {
         kind: readString(missing.object_kind) ?? null,
@@ -6444,22 +6379,22 @@ function governedBusinessDecisionProjection(state, detailRead) {
   if (unavailableReads.length > 0) {
     projection.unavailable_reads = unavailableReads;
   }
-  const continuationId = readString(record7.continuation_id);
+  const continuationId = readString(record6.continuation_id);
   if (continuationId) projection.continuation_id = continuationId;
-  if (Number.isInteger(record7.outcome_revision)) projection.outcome_revision = record7.outcome_revision;
-  const freeTextReason = readString(record7.free_text_reason);
+  if (Number.isInteger(record6.outcome_revision)) projection.outcome_revision = record6.outcome_revision;
+  const freeTextReason = readString(record6.free_text_reason);
   if (freeTextReason) projection.free_text_reason = freeTextReason;
   return projection;
 }
 function governedBusinessModelView(state, input) {
-  const record7 = asRecord(state);
-  const snapshot = asRecord(record7.governed_state_snapshot);
+  const record6 = asRecord(state);
+  const snapshot = asRecord(record6.governed_state_snapshot);
   const detailRead = governedBusinessDetailRead(
     input,
     readString(snapshot.issue_id) ?? readString(input.issueId)
   );
   if (detailRead.mode === "unavailable") {
-    const { task_acceptance_contract: _TaskAcceptanceContract, ...stateWithoutAcceptanceContract } = record7;
+    const { task_acceptance_contract: _TaskAcceptanceContract, ...stateWithoutAcceptanceContract } = record6;
     return {
       mode: "full_snapshot",
       content: stateWithoutAcceptanceContract,
@@ -6468,7 +6403,7 @@ function governedBusinessModelView(state, input) {
   }
   return {
     mode: "decision_projection",
-    content: governedBusinessDecisionProjection(record7, detailRead),
+    content: governedBusinessDecisionProjection(record6, detailRead),
     unavailableReason: null
   };
 }
@@ -6534,10 +6469,10 @@ ${bodies}`,
 }
 function canonicalJsonValue(value) {
   if (Array.isArray(value)) return value.map(canonicalJsonValue);
-  const record7 = asRecord(value);
-  if (Object.keys(record7).length === 0) return value;
+  const record6 = asRecord(value);
+  if (Object.keys(record6).length === 0) return value;
   return Object.fromEntries(
-    Object.keys(record7).sort().map((key) => [key, canonicalJsonValue(record7[key])])
+    Object.keys(record6).sort().map((key) => [key, canonicalJsonValue(record6[key])])
   );
 }
 function resolvedDependencySections(context, input, contextScope, snapshotFreshness) {
@@ -8608,10 +8543,10 @@ function compactExecutorJsonlForTranscript(event) {
     const text = JSON.stringify(compactExecutorJsonValue(event, stringMaxChars));
     if (text.length <= 15e3) return text;
   }
-  const record7 = tcAsRecord(event);
-  const item = tcAsRecord(record7.item);
+  const record6 = tcAsRecord(event);
+  const item = tcAsRecord(record6.item);
   return JSON.stringify({
-    type: tcReadString(record7.type) ?? "executor.event",
+    type: tcReadString(record6.type) ?? "executor.event",
     item: item.type ? {
       id: tcReadString(item.id),
       type: tcReadString(item.type),
@@ -8624,10 +8559,10 @@ function compactExecutorJsonlForTranscript(event) {
   });
 }
 function summarizeTokenUsage(usage) {
-  const record7 = tcAsRecord(usage);
-  const inputTokens = tcReadNumber(record7.input_tokens ?? record7.inputTokens, 0);
-  const cachedInputTokens = tcReadNumber(record7.cached_input_tokens ?? record7.cachedInputTokens, 0);
-  const outputTokens = tcReadNumber(record7.output_tokens ?? record7.outputTokens, 0);
+  const record6 = tcAsRecord(usage);
+  const inputTokens = tcReadNumber(record6.input_tokens ?? record6.inputTokens, 0);
+  const cachedInputTokens = tcReadNumber(record6.cached_input_tokens ?? record6.cachedInputTokens, 0);
+  const outputTokens = tcReadNumber(record6.output_tokens ?? record6.outputTokens, 0);
   const parts = [];
   if (inputTokens > 0) parts.push(`\u8F93\u5165 ${inputTokens}`);
   if (cachedInputTokens > 0) parts.push(`\u7F13\u5B58 ${cachedInputTokens}`);
@@ -8882,8 +8817,8 @@ function summarizeClaudeEvent(event) {
   return null;
 }
 function tcPiMessageText(message) {
-  const record7 = tcAsRecord(message);
-  const content = record7.content;
+  const record6 = tcAsRecord(message);
+  const content = record6.content;
   if (typeof content === "string" && content.trim().length > 0) return content.trim();
   if (!Array.isArray(content)) return "";
   return content.map((entry) => {
@@ -8897,14 +8832,14 @@ function tcPiAssistantMessageEventText(assistantMessageEvent) {
   return tcReadString(event.content) ?? "";
 }
 function tcPiMessageStopReason(message) {
-  const record7 = tcAsRecord(message);
-  return tcReadString(record7.stopReason ?? record7.stop_reason);
+  const record6 = tcAsRecord(message);
+  return tcReadString(record6.stopReason ?? record6.stop_reason);
 }
 function tcPiMessageErrorText(message) {
-  const record7 = tcAsRecord(message);
-  const explicitError = tcReadString(record7.errorMessage ?? record7.error_message)?.trim();
+  const record6 = tcAsRecord(message);
+  const explicitError = tcReadString(record6.errorMessage ?? record6.error_message)?.trim();
   if (explicitError) return explicitError;
-  const stopReason = tcPiMessageStopReason(record7);
+  const stopReason = tcPiMessageStopReason(record6);
   if (stopReason === "error" || stopReason === "failed" || stopReason === "exception") {
     return `Pi Agent message ended with stopReason=${stopReason}`;
   }
@@ -9559,13 +9494,13 @@ function parseClaudeStreamJson(stdout) {
 }
 function openCodeErrorText(value) {
   if (typeof value === "string") return value;
-  const record7 = asRecord(value);
-  const message = readString(record7.message);
+  const record6 = asRecord(value);
+  const message = readString(record6.message);
   if (message) return message;
-  const data = asRecord(record7.data);
+  const data = asRecord(record6.data);
   const nestedMessage = readString(data.message);
   if (nestedMessage) return nestedMessage;
-  return readString(record7.name) ?? readString(record7.code) ?? "";
+  return readString(record6.name) ?? readString(record6.code) ?? "";
 }
 function parseOpenCodeJsonl(stdout) {
   let sessionId = null;
@@ -9603,8 +9538,8 @@ function parseOpenCodeJsonl(stdout) {
   return { sessionId, summary, usage, errorMessage };
 }
 function piMessageText(message) {
-  const record7 = asRecord(message);
-  const content = record7.content;
+  const record6 = asRecord(message);
+  const content = record6.content;
   if (typeof content === "string") return content.trim();
   if (!Array.isArray(content)) return "";
   return content.map((entry) => {
@@ -9613,10 +9548,10 @@ function piMessageText(message) {
   }).filter(Boolean).join("\n").trim();
 }
 function piAgentEndHasFinalAssistantText(event) {
-  const record7 = asRecord(event);
-  if (record7.type !== "agent_end") return false;
-  const messages = Array.isArray(record7.messages) ? [...record7.messages] : [];
-  if (Object.keys(asRecord(record7.message)).length > 0) messages.push(record7.message);
+  const record6 = asRecord(event);
+  if (record6.type !== "agent_end") return false;
+  const messages = Array.isArray(record6.messages) ? [...record6.messages] : [];
+  if (Object.keys(asRecord(record6.message)).length > 0) messages.push(record6.message);
   for (let index = messages.length - 1; index >= 0; index -= 1) {
     const message = asRecord(messages[index]);
     if (message.role !== "assistant") continue;
@@ -9649,10 +9584,10 @@ function piTextValue(value) {
   return typeof value === "string" && value.length > 0 ? value : "";
 }
 function piAssistantEventText(assistantEvent) {
-  const record7 = asRecord(assistantEvent);
-  const type = readString(record7.type);
-  if (type === "text_delta") return piTextValue(record7.delta);
-  if (type === "text_end") return piTextValue(record7.content);
+  const record6 = asRecord(assistantEvent);
+  const type = readString(record6.type);
+  if (type === "text_delta") return piTextValue(record6.delta);
+  if (type === "text_end") return piTextValue(record6.content);
   return "";
 }
 function piMessageUsage(message) {
@@ -9673,14 +9608,14 @@ function assignPiUsage(target, source) {
   if (source.costUsd > 0) target.costUsd = source.costUsd;
 }
 function piMessageStopReason(message) {
-  const record7 = asRecord(message);
-  return readString(record7.stopReason ?? record7.stop_reason);
+  const record6 = asRecord(message);
+  return readString(record6.stopReason ?? record6.stop_reason);
 }
 function piMessageErrorText(message) {
-  const record7 = asRecord(message);
-  const explicitError = readString(record7.errorMessage ?? record7.error_message)?.trim();
+  const record6 = asRecord(message);
+  const explicitError = readString(record6.errorMessage ?? record6.error_message)?.trim();
   if (explicitError) return explicitError;
-  const stopReason = piMessageStopReason(record7);
+  const stopReason = piMessageStopReason(record6);
   if (stopReason === "error" || stopReason === "failed" || stopReason === "exception") {
     return `Pi Agent message ended with stopReason=${stopReason}`;
   }
@@ -9844,79 +9779,6 @@ function piSourceObservationReceipts(event) {
   }
   return receipts;
 }
-function hasExactKeys(value, expected) {
-  const keys = Object.keys(asRecord(value)).sort();
-  return keys.length === expected.length && expected.slice().sort().every((key, index) => key === keys[index]);
-}
-function canonicalOrigin(value, protocol) {
-  const raw = readString(value);
-  if (!raw) return null;
-  try {
-    const url = new URL(raw);
-    if ((protocol ? url.protocol !== protocol : !["http:", "https:"].includes(url.protocol)) || url.username || url.password || url.pathname !== "/" || url.search || url.hash || url.origin !== raw || url.hostname === "localhost" || url.hostname.endsWith(".localhost") || /^\[.*\]$|^\d{1,3}(?:\.\d{1,3}){3}$/.test(url.hostname)) return null;
-    return url.origin;
-  } catch {
-    return null;
-  }
-}
-function piSourceAuthenticationOriginDiscoveries(event) {
-  if (readString(event?.type) !== "amaster_source_authentication_discovery" || readString(event?.version) !== "authentication_origin_discovery_v1" || !hasExactKeys(event, ["type", "version", "authenticationOriginDiscovery"])) return [];
-  const discovery = asRecord(event.authenticationOriginDiscovery);
-  const context = asRecord(discovery.context);
-  const receipt = asRecord(discovery.receipt);
-  const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-  if (!hasExactKeys(discovery, ["context", "receipt", "receiptDigest"]) || !hasExactKeys(context, [
-    "companyId",
-    "sourceId",
-    "sourceRevisionId",
-    "attemptId",
-    "epoch",
-    "connectorId",
-    "connectionEpoch"
-  ]) || !hasExactKeys(receipt, [
-    "version",
-    "discoveryId",
-    "runId",
-    "sourceOrigin",
-    "targetOrigin",
-    "navigationKind",
-    "redirectStatus",
-    "capturedAt",
-    "profileDigest"
-  ]) || ![
-    context.companyId,
-    context.sourceId,
-    context.sourceRevisionId,
-    context.attemptId,
-    context.connectorId,
-    context.connectionEpoch,
-    receipt.discoveryId,
-    receipt.runId
-  ].every((value) => uuid.test(readString(value) ?? "")) || !Number.isSafeInteger(context.epoch) || context.epoch < 1 || receipt.version !== "authentication_origin_discovery_v1" || !canonicalOrigin(receipt.sourceOrigin) || !canonicalOrigin(receipt.targetOrigin, "https:") || receipt.sourceOrigin === receipt.targetOrigin || !["http_redirect", "top_frame_navigation"].includes(receipt.navigationKind) || (receipt.navigationKind === "http_redirect" ? !Number.isInteger(receipt.redirectStatus) || receipt.redirectStatus < 300 || receipt.redirectStatus > 399 : receipt.redirectStatus !== null) || !Number.isFinite(Date.parse(readString(receipt.capturedAt) ?? "")) || !/^sha256:[a-f0-9]{64}$/.test(readString(receipt.profileDigest) ?? "") || !/^sha256:[a-f0-9]{64}$/.test(readString(discovery.receiptDigest) ?? "")) return [];
-  return [{
-    context: {
-      companyId: context.companyId,
-      sourceId: context.sourceId,
-      sourceRevisionId: context.sourceRevisionId,
-      attemptId: context.attemptId,
-      epoch: context.epoch,
-      connectorId: context.connectorId,
-      connectionEpoch: context.connectionEpoch
-    },
-    receipt: {
-      version: receipt.version,
-      discoveryId: receipt.discoveryId,
-      runId: receipt.runId,
-      sourceOrigin: receipt.sourceOrigin,
-      targetOrigin: receipt.targetOrigin,
-      navigationKind: receipt.navigationKind,
-      redirectStatus: receipt.redirectStatus,
-      capturedAt: receipt.capturedAt,
-      profileDigest: receipt.profileDigest
-    },
-    receiptDigest: discovery.receiptDigest
-  }];
-}
 function parsePiJsonl(stdout) {
   let sessionId = null;
   let errorMessage = null;
@@ -11719,8 +11581,7 @@ async function executeBrowserSessionCommand(command, dependencies = {}) {
 }
 
 // src/amaster-runtime-daemon/browser-session-broker.mjs
-import { createHash as createHash13, randomUUID } from "node:crypto";
-import { lookup as dnsLookup } from "node:dns/promises";
+import { createHash as createHash13 } from "node:crypto";
 import {
   chmodSync as chmodSync6,
   existsSync as existsSync13,
@@ -11731,213 +11592,12 @@ import {
   statSync as statSync8,
   writeFileSync as writeFileSync9
 } from "node:fs";
-import { createServer as createHttpServer } from "node:http";
-import { connect as connectTcp, isIP } from "node:net";
 import { dirname as dirname9, join as join14, relative as relative6, resolve as resolve10 } from "node:path";
 var MARKER_NAME = ".amaster-browser-session.json";
-var HUMAN_LEASE_INACTIVITY_MS = 30 * 60 * 1e3;
 var HUMAN_LEASE_HARD_CAP_MS = 2 * 60 * 60 * 1e3;
-var TERMINATED_LEASE_HISTORY_LIMIT = 100;
 function brokerError(code) {
   return Object.assign(new Error(code), { code });
 }
-function parseIpv4(value) {
-  const parts = value.split(".").map(Number);
-  if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) {
-    return null;
-  }
-  return parts;
-}
-function parseIpv6(value) {
-  const withoutZone = value.split("%")[0].toLowerCase();
-  const halves = withoutZone.split("::");
-  if (halves.length > 2) return null;
-  const parseSide = (side) => {
-    if (!side) return [];
-    const groups2 = [];
-    for (const part of side.split(":")) {
-      if (part.includes(".")) {
-        const ipv4 = parseIpv4(part);
-        if (!ipv4) return null;
-        groups2.push(ipv4[0] << 8 | ipv4[1], ipv4[2] << 8 | ipv4[3]);
-      } else {
-        if (!/^[a-f0-9]{1,4}$/.test(part)) return null;
-        groups2.push(Number.parseInt(part, 16));
-      }
-    }
-    return groups2;
-  };
-  const left = parseSide(halves[0]);
-  const right = parseSide(halves[1] ?? "");
-  if (!left || !right) return null;
-  const missing = 8 - left.length - right.length;
-  if (halves.length === 1 && missing !== 0 || halves.length === 2 && missing < 1) return null;
-  const groups = [...left, ...Array(Math.max(0, missing)).fill(0), ...right];
-  if (groups.length !== 8) return null;
-  return groups.flatMap((group) => [group >> 8, group & 255]);
-}
-function prefixMatches(bytes, prefix, bits) {
-  const whole = Math.floor(bits / 8);
-  const rest = bits % 8;
-  for (let index = 0; index < whole; index += 1) {
-    if (bytes[index] !== prefix[index]) return false;
-  }
-  if (!rest) return true;
-  const mask = 255 << 8 - rest;
-  return (bytes[whole] & mask) === (prefix[whole] & mask);
-}
-function ipv4IsPublic(address) {
-  const bytes = parseIpv4(address);
-  if (!bytes) return false;
-  const [a, b, c] = bytes;
-  if (a === 0 || a === 10 || a === 127 || a >= 224) return false;
-  if (a === 100 && b >= 64 && b <= 127) return false;
-  if (a === 169 && b === 254) return false;
-  if (a === 172 && b >= 16 && b <= 31) return false;
-  if (a === 192 && (b === 0 || b === 168)) return false;
-  if (a === 192 && b === 88 && c === 99) return false;
-  if (a === 198 && (b === 18 || b === 19 || b === 51 && c === 100)) return false;
-  if (a === 203 && b === 0 && c === 113) return false;
-  return true;
-}
-function ipv6IsPublic(address) {
-  const bytes = parseIpv6(address);
-  if (!bytes) return false;
-  const allZero = bytes.every((byte) => byte === 0);
-  if (allZero || bytes.slice(0, 15).every((byte) => byte === 0) && bytes[15] === 1) return false;
-  if ((bytes[0] & 254) === 252 || bytes[0] === 254 && (bytes[1] & 192) === 128 || bytes[0] === 255) {
-    return false;
-  }
-  if (bytes.slice(0, 12).every((byte) => byte === 0)) return false;
-  if (prefixMatches(bytes, [32, 1, 0, 0], 32)) return false;
-  if (prefixMatches(bytes, [32, 1, 0, 2, 0, 0], 48)) return false;
-  if (prefixMatches(bytes, [32, 1, 13, 184], 32)) return false;
-  if (prefixMatches(bytes, [32, 1, 0, 16], 28)) return false;
-  if (prefixMatches(bytes, [0, 100, 255, 155, 0, 1], 48)) return false;
-  if (prefixMatches(bytes, Array(10).fill(0).concat([255, 255]), 96)) {
-    return ipv4IsPublic(bytes.slice(12).join("."));
-  }
-  if (prefixMatches(bytes, [0, 100, 255, 155].concat(Array(8).fill(0)), 96)) {
-    return ipv4IsPublic(bytes.slice(12).join("."));
-  }
-  if (prefixMatches(bytes, [32, 2], 16)) {
-    return ipv4IsPublic(bytes.slice(2, 6).join("."));
-  }
-  return true;
-}
-function isPublicNetworkAddress(address) {
-  const family = isIP(address);
-  return family === 4 ? ipv4IsPublic(address) : family === 6 ? ipv6IsPublic(address) : false;
-}
-async function defaultResolveAddresses(hostname3) {
-  const family = isIP(hostname3);
-  if (family) return [{ address: hostname3, family }];
-  return dnsLookup(hostname3, { all: true, verbatim: true });
-}
-function parseProxyAuthority(authority) {
-  let target;
-  try {
-    target = new URL(`http://${authority}`);
-  } catch {
-    throw brokerError("browser_session_proxy_target_invalid");
-  }
-  const port = Number(target.port || 443);
-  if (!target.hostname || target.username || target.password || !Number.isInteger(port) || port < 1 || port > 65535) {
-    throw brokerError("browser_session_proxy_target_invalid");
-  }
-  return { hostname: target.hostname, port };
-}
-async function resolvePublicAddress(hostname3, resolveAddresses) {
-  if (isIP(hostname3) && !isPublicNetworkAddress(hostname3)) {
-    throw brokerError("browser_session_private_network_request_blocked");
-  }
-  let answers;
-  try {
-    answers = await resolveAddresses(hostname3);
-  } catch {
-    throw brokerError("browser_session_dns_failed");
-  }
-  if (!Array.isArray(answers) || answers.length === 0 || answers.some((answer) => !isPublicNetworkAddress(answer?.address))) {
-    throw brokerError("browser_session_private_network_request_blocked");
-  }
-  return answers[0];
-}
-async function startPublicNetworkProxy(resolveAddresses) {
-  const sockets = /* @__PURE__ */ new Set();
-  const trackSocket = (socket) => {
-    sockets.add(socket);
-    socket.once("close", () => sockets.delete(socket));
-    socket.on("error", () => socket.destroy());
-  };
-  const server = createHttpServer((_request, response) => {
-    response.writeHead(403, { "content-type": "text/plain" });
-    response.end("browser_session_non_https_request_blocked");
-  });
-  server.on("connection", trackSocket);
-  server.on("connect", async (request, clientSocket, head) => {
-    try {
-      const target = parseProxyAuthority(request.url ?? "");
-      const resolved = await resolvePublicAddress(target.hostname, resolveAddresses);
-      const upstream = connectTcp({
-        host: resolved.address,
-        family: resolved.family,
-        port: target.port
-      });
-      trackSocket(upstream);
-      upstream.once("connect", () => {
-        clientSocket.write("HTTP/1.1 200 Connection Established\r\n\r\n");
-        if (head.length) upstream.write(head);
-        upstream.pipe(clientSocket);
-        clientSocket.pipe(upstream);
-      });
-      upstream.once("error", () => clientSocket.destroy());
-    } catch {
-      clientSocket.end("HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n");
-    }
-  });
-  await new Promise((resolveListen, reject) => {
-    server.once("error", reject);
-    server.listen(0, "127.0.0.1", () => {
-      server.off("error", reject);
-      resolveListen();
-    });
-  });
-  const address = server.address();
-  if (!address || typeof address === "string") {
-    server.close();
-    throw brokerError("browser_session_proxy_start_failed");
-  }
-  return {
-    url: `http://127.0.0.1:${address.port}`,
-    close: () => new Promise((resolveClose) => {
-      for (const socket of sockets) socket.destroy();
-      server.close(() => resolveClose());
-    })
-  };
-}
-async function installPublicHttpsPolicy(context, resolveAddresses) {
-  if (typeof context.route !== "function") {
-    throw brokerError("browser_session_public_https_policy_unavailable");
-  }
-  await context.route("**/*", async (route) => {
-    try {
-      const requestUrl = new URL(route.request().url());
-      if (requestUrl.protocol !== "https:" || requestUrl.username || requestUrl.password) {
-        throw brokerError("browser_session_non_https_request_blocked");
-      }
-      if (isIP(requestUrl.hostname) && !isPublicNetworkAddress(requestUrl.hostname)) {
-        throw brokerError("browser_session_private_network_request_blocked");
-      }
-      const addresses = await resolveAddresses(requestUrl.hostname);
-      if (!Array.isArray(addresses) || addresses.length === 0 || addresses.some((answer) => !isPublicNetworkAddress(answer?.address))) {
-        throw brokerError("browser_session_private_network_request_blocked");
-      }
-      await route.continue();
-    } catch {
-      await route.abort("blockedbyclient");
-    }
-  });
-}
 function pathWithin3(candidate, root) {
   const value = relative6(root, candidate);
   return value === "" || !value.startsWith("..") && !value.startsWith("/");
@@ -12079,57 +11739,10 @@ function createBrowserSessionBroker({
   stateRoot,
   browserExecutable,
   chromium,
-  resolveAddresses = defaultResolveAddresses,
-  startNetworkProxy = () => startPublicNetworkProxy(resolveAddresses),
-  scheduleTimeout = setTimeout,
-  cancelTimeout = clearTimeout,
   now = () => /* @__PURE__ */ new Date()
 }) {
   const active = /* @__PURE__ */ new Map();
   const readers = /* @__PURE__ */ new Map();
-  const terminated = [];
-  function rememberTermination(lease, reason) {
-    terminated.push({
-      companyId: lease.owner.companyId,
-      bindingId: lease.owner.bindingId,
-      leaseId: lease.leaseId,
-      reason,
-      terminatedAt: now().toISOString()
-    });
-    if (terminated.length > TERMINATED_LEASE_HISTORY_LIMIT) terminated.shift();
-  }
-  async function closeHumanLease(localOpaqueRef, lease, reason = null) {
-    if (lease.closePromise) return lease.closePromise;
-    lease.closePromise = (async () => {
-      if (lease.inactivityTimer) cancelTimeout(lease.inactivityTimer);
-      if (lease.hardCapTimer) cancelTimeout(lease.hardCapTimer);
-      if (active.get(localOpaqueRef) === lease) active.delete(localOpaqueRef);
-      if (reason) rememberTermination(lease, reason);
-      await Promise.allSettled([
-        lease.context.close(),
-        lease.networkProxy.close()
-      ]);
-    })();
-    return lease.closePromise;
-  }
-  function scheduleLeaseTimer(localOpaqueRef, lease, kind, delay, reason) {
-    if (lease[kind]) cancelTimeout(lease[kind]);
-    lease[kind] = scheduleTimeout(() => {
-      if (active.get(localOpaqueRef) !== lease) return;
-      void closeHumanLease(localOpaqueRef, lease, reason);
-    }, Math.max(0, delay));
-    lease[kind]?.unref?.();
-  }
-  function scheduleInactivity(localOpaqueRef, lease) {
-    const lastActivityMs = Date.parse(lease.lastActivityAt);
-    scheduleLeaseTimer(
-      localOpaqueRef,
-      lease,
-      "inactivityTimer",
-      lastActivityMs + HUMAN_LEASE_INACTIVITY_MS - now().getTime(),
-      "browser_auth_human_lease_inactive"
-    );
-  }
   async function open(payload, { replace = false } = {}) {
     validateHttpsLocator(payload);
     validateHumanLease(payload, now);
@@ -12149,97 +11762,38 @@ function createBrowserSessionBroker({
           state: "human_ready"
         };
       }
-      await closeHumanLease(payload.localOpaqueRef, existing);
+      await existing.context.close();
+      active.delete(payload.localOpaqueRef);
     }
     if (!chromium || typeof chromium.launchPersistentContext !== "function") {
       throw brokerError("browser_session_runtime_unavailable");
     }
-    const networkProxy = await startNetworkProxy();
-    let context;
-    try {
-      context = await chromium.launchPersistentContext(profilePath, {
-        executablePath: browserExecutable,
-        headless: false,
-        acceptDownloads: false,
-        proxy: { server: networkProxy.url }
-      });
-    } catch (error) {
-      await networkProxy.close();
-      throw error;
-    }
-    try {
-      await installPublicHttpsPolicy(context, resolveAddresses);
-    } catch (error) {
-      await context.close();
-      await networkProxy.close();
-      throw error;
-    }
+    const context = await chromium.launchPersistentContext(profilePath, {
+      executablePath: browserExecutable,
+      headless: false,
+      acceptDownloads: false
+    });
     const leaseState = {
       context,
-      networkProxy,
       leaseId: payload.leaseId,
       owner: expectedOwner(payload),
-      startedAt: now().toISOString(),
-      lastActivityAt: now().toISOString(),
-      activityToken: randomUUID(),
-      inactivityTimer: null,
-      hardCapTimer: null,
-      closePromise: null
+      lastActivityAt: now().toISOString()
     };
-    try {
-      if (typeof context.exposeBinding === "function" && typeof context.addInitScript === "function") {
-        await context.exposeBinding("__mirrorxBrowserAuthActivity", (_source, activityToken) => {
-          if (activityToken !== leaseState.activityToken) return;
-          leaseState.lastActivityAt = now().toISOString();
-          scheduleInactivity(payload.localOpaqueRef, leaseState);
-        });
-        await context.addInitScript(({ activityToken }) => {
-          const reportActivity = globalThis.__mirrorxBrowserAuthActivity;
-          try {
-            delete globalThis.__mirrorxBrowserAuthActivity;
-          } catch {
-          }
-          const report = (event) => {
-            if (event.isTrusted !== true) return;
-            reportActivity?.(activityToken).catch?.(() => {
-            });
-          };
-          globalThis.addEventListener("pointerdown", report, { capture: true, passive: true });
-          globalThis.addEventListener("keydown", report, { capture: true, passive: true });
-          globalThis.addEventListener("touchstart", report, { capture: true, passive: true });
-        }, { activityToken: leaseState.activityToken });
-      }
-      const page = context.pages()[0] ?? await context.newPage();
-      if (typeof context.on !== "function" || typeof page.on !== "function") {
-        throw brokerError("browser_session_lifecycle_monitor_unavailable");
-      }
-      const terminateFromBrowser = (reason) => {
-        if (active.get(payload.localOpaqueRef) !== leaseState) return;
-        void closeHumanLease(payload.localOpaqueRef, leaseState, reason);
-      };
-      context.on("close", () => terminateFromBrowser("browser_auth_human_session_closed"));
-      context.on("page", (openedPage) => {
-        if (openedPage !== page) void openedPage.close();
+    if (typeof context.exposeBinding === "function" && typeof context.addInitScript === "function") {
+      await context.exposeBinding("__mirrorxBrowserAuthActivity", () => {
+        leaseState.lastActivityAt = now().toISOString();
       });
-      page.on("close", () => terminateFromBrowser("browser_auth_human_session_closed"));
-      page.on("crash", () => terminateFromBrowser("browser_auth_human_session_crashed"));
-      page.on("download", (download) => {
-        void download.cancel();
+      await context.addInitScript(() => {
+        const report = () => globalThis.__mirrorxBrowserAuthActivity?.().catch?.(() => {
+        });
+        globalThis.addEventListener("pointerdown", report, { capture: true, passive: true });
+        globalThis.addEventListener("keydown", report, { capture: true, passive: true });
+        globalThis.addEventListener("touchstart", report, { capture: true, passive: true });
       });
-      active.set(payload.localOpaqueRef, leaseState);
-      await page.goto(payload.locator);
-    } catch (error) {
-      await closeHumanLease(payload.localOpaqueRef, leaseState);
-      throw error;
     }
-    scheduleInactivity(payload.localOpaqueRef, leaseState);
-    scheduleLeaseTimer(
-      payload.localOpaqueRef,
-      leaseState,
-      "hardCapTimer",
-      Date.parse(leaseState.startedAt) + HUMAN_LEASE_HARD_CAP_MS - now().getTime(),
-      "browser_auth_human_lease_hard_expired"
-    );
+    const page = context.pages()[0] ?? await context.newPage();
+    await page.goto(payload.locator);
+    active.set(payload.localOpaqueRef, leaseState);
     return {
       bindingId: payload.bindingId,
       localOpaqueRef: payload.localOpaqueRef,
@@ -12255,7 +11809,8 @@ function createBrowserSessionBroker({
     }
     const profilePath = exactProfile(stateRoot, payload);
     if (existing) {
-      await closeHumanLease(payload.localOpaqueRef, existing);
+      await existing.context.close();
+      active.delete(payload.localOpaqueRef);
     }
     rmSync7(profilePath, { recursive: true, force: false });
     return {
@@ -12299,7 +11854,8 @@ function createBrowserSessionBroker({
         if (human.owner.companyId !== payload.companyId || human.owner.bindingId !== payload.bindingId) {
           throw brokerError("browser_session_profile_owner_mismatch");
         }
-        await closeHumanLease(payload.localOpaqueRef, human);
+        await human.context.close();
+        active.delete(payload.localOpaqueRef);
       }
       readers.set(payload.localOpaqueRef, payload.leaseId);
       return () => {
@@ -12314,154 +11870,15 @@ function createBrowserSessionBroker({
         bindingId: entry.owner.bindingId,
         leaseId: entry.leaseId,
         lastActivityAt: entry.lastActivityAt
-      })),
-      terminatedHumanLeases: terminated.map((entry) => ({ ...entry }))
+      }))
     })
   };
 }
 
-// src/amaster-runtime-daemon/source-authentication-origin-discovery-ingest.mjs
-function asRecord2(value) {
-  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
-}
-function readString2(value) {
-  return typeof value === "string" && value.length > 0 ? value : null;
-}
-async function submitSourceAuthenticationOriginDiscovery({
-  config,
-  command,
-  connectorId,
-  profile,
-  discoveries,
-  postJsonWithRetry: postJsonWithRetry2,
-  ingestLog: ingestLog2
-}) {
-  if (profile.purpose !== "source_acquisition_v2" || discoveries.length !== 1) {
-    throw new Error("source_authentication_origin_discovery_profile_inactive");
-  }
-  const discovery = asRecord2(discoveries[0]);
-  const context = asRecord2(discovery.context);
-  const receipt = asRecord2(discovery.receipt);
-  if (context.companyId !== profile.companyId || context.sourceId !== profile.sourceId || context.sourceRevisionId !== profile.sourceRevisionId || context.attemptId !== profile.attemptId || context.epoch !== profile.epoch || context.connectorId !== connectorId || context.connectionEpoch !== profile.connectorAdmission.connectionEpoch || receipt.runId !== profile.runId) {
-    throw new Error("source_authentication_origin_discovery_authority_invalid");
-  }
-  const accepted = asRecord2(await postJsonWithRetry2(
-    config,
-    `/api/amaster/runtime-connectors/${connectorId}/commands/${command.commandId}/source-acquisition/authentication-origin-discoveries`,
-    {
-      profileVersion: profile.purpose,
-      attemptId: profile.attemptId,
-      epoch: profile.epoch,
-      receipt,
-      receiptDigest: discovery.receiptDigest
-    },
-    { maxAttempts: 3, timeoutMs: 5e3, delayMs: 100 }
-  ));
-  if (accepted.status !== "auth_required" || accepted.attemptId !== profile.attemptId || !readString2(accepted.interactionId)) {
-    throw new Error("source_authentication_origin_discovery_ingest_rejected");
-  }
-  await ingestLog2(
-    config,
-    command,
-    "system",
-    "info",
-    "Source Authentication origin discovery recorded",
-    {
-      presentationKind: "source_authentication_origin_discovery",
-      attemptId: profile.attemptId,
-      interactionId: accepted.interactionId,
-      discoveryId: receipt.discoveryId,
-      sourceOrigin: receipt.sourceOrigin,
-      targetOrigin: receipt.targetOrigin,
-      replayed: accepted.replayed === true
-    }
-  );
-}
-
-// src/amaster-runtime-daemon/source-completion-policy.mjs
-var SOURCE_COMPLETION_REPAIR_HARD_CAP_MS = 12e4;
-function record6(value) {
-  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
-}
-function sourceCompletionActionAccepted(results) {
-  return (Array.isArray(results) ? results : []).some((value) => {
-    const result3 = record6(value);
-    const runtimeAction = record6(result3.runtimeAction);
-    return result3.status === "succeeded" && result3.providerStatus === "accepted" && runtimeAction.toolName === "runtime_action.submit" && typeof runtimeAction.callId === "string" && runtimeAction.callId.length > 0 && runtimeAction.resultStatus === "succeeded";
-  });
-}
-function sourceCompletionTerminalFailure(stderr, profile) {
-  if (!profile || profile.purpose !== "source_acquisition_v2") return null;
-  for (const line of String(stderr ?? "").split(/\r?\n/u)) {
-    const trimmed = line.trim();
-    if (!trimmed.startsWith("{")) continue;
-    try {
-      const event = record6(JSON.parse(trimmed));
-      if (event.type === "amaster_source_acquisition_terminal" && event.code === "source_acquisition_terminal_action_missing" && event.companyId === profile.companyId && event.sourceId === profile.sourceId && event.sourceRevisionId === profile.sourceRevisionId && event.attemptId === profile.attemptId && event.epoch === profile.epoch && event.runId === profile.runId) {
-        return "source_acquisition_terminal_action_missing";
-      }
-    } catch {
-    }
-  }
-  return null;
-}
-function createSourceCompletionStopPolicy({
-  enabled,
-  onStop,
-  scheduleTimeout = setTimeout,
-  cancelTimeout = clearTimeout,
-  hardCapMs = SOURCE_COMPLETION_REPAIR_HARD_CAP_MS
-}) {
-  let timer = null;
-  let hardCapExceeded = false;
-  let settled = false;
-  function clear() {
-    if (timer) cancelTimeout(timer);
-    timer = null;
-  }
-  return {
-    observe(eventType) {
-      if (!enabled || settled) return { handled: false };
-      if (eventType === "agent_end") {
-        if (!timer) {
-          timer = scheduleTimeout(() => {
-            if (settled) return;
-            hardCapExceeded = true;
-            onStop("source_completion_hard_cap");
-          }, hardCapMs);
-          timer?.unref?.();
-        }
-        return { handled: true, completionOutputType: null };
-      }
-      if (eventType === "agent_settled") {
-        settled = true;
-        clear();
-        onStop("completion_output");
-        return { handled: true, completionOutputType: "agent_settled" };
-      }
-      return { handled: false };
-    },
-    close: clear,
-    get hardCapExceeded() {
-      return hardCapExceeded;
-    }
-  };
-}
-
 // ../shared/src/source-acquisition-compatibility.json
 var source_acquisition_compatibility_default = {
   schemaVersion: "mirrorx.source-acquisition-compatibility.v1",
   profileVersion: "source_acquisition_v1",
-  supportedProfileVersions: [
-    "source_acquisition_v1",
-    "source_acquisition_v2"
-  ],
-  v2Activation: {
-    profileVersion: "source_acquisition_v2",
-    capability: "source_authentication_origin_discovery_v1",
-    piCodingAgentVersion: "0.80.10",
-    completionGuard: "source_completion_same_session_v1"
-  },
   retentionVersion: "source_summary_only_v1",
   actionVersion: "complete_source_acquisition_v1",
   policyVersion: "browser_read_policy_v1",
@@ -12474,7 +11891,7 @@ var source_acquisition_compatibility_default = {
 };
 
 // src/amaster-runtime-daemon.mjs
-var CONNECTOR_VERSION = "0.1.1-beta.102";
+var CONNECTOR_VERSION = "0.1.1-beta.103";
 var CONNECTOR_CONTRACT_VERSION = "2026-06-04.v1";
 var SOURCE_ACQUISITION_CAPABILITY = source_acquisition_compatibility_default.profileVersion;
 var daemonRequire = createRequire(import.meta.url);
@@ -12484,10 +11901,6 @@ var SOURCE_ACQUISITION_ACTION_VERSION = source_acquisition_compatibility_default
 var SOURCE_ACQUISITION_BROWSER_POLICY_VERSION = source_acquisition_compatibility_default.policyVersion;
 var SOURCE_ACQUISITION_HEADLESS_ADAPTER = source_acquisition_compatibility_default.adapters[0];
 var SOURCE_ACQUISITION_DESKTOP_ADAPTER = "browser_skill_desktop_v1";
-var SOURCE_ACQUISITION_PROFILE_VERSION_V2 = source_acquisition_compatibility_default.v2Activation.profileVersion;
-var SOURCE_AUTHENTICATION_ORIGIN_DISCOVERY_CAPABILITY = source_acquisition_compatibility_default.v2Activation.capability;
-var SOURCE_ACQUISITION_V2_PI_VERSION = source_acquisition_compatibility_default.v2Activation.piCodingAgentVersion;
-var SOURCE_ACQUISITION_V2_COMPLETION_GUARD = source_acquisition_compatibility_default.v2Activation.completionGuard;
 var SOURCE_ACQUISITION_PACKAGE_VERSIONS = Object.freeze(
   source_acquisition_compatibility_default.requiredPackages
 );
@@ -12957,70 +12370,6 @@ function sourceAcquisitionBrowserExecutableReady() {
     return false;
   }
 }
-function sourceAcquisitionV2Cohort(extensionDigest) {
-  const names = [
-    "AMASTER_SOURCE_ACQUISITION_SUPPORTED_PROFILE_VERSIONS",
-    "AMASTER_SOURCE_ACQUISITION_AUTHENTICATION_ORIGIN_DISCOVERY_CAPABILITY",
-    "AMASTER_SOURCE_ACQUISITION_COMPLETION_GUARD",
-    "AMASTER_SOURCE_ACQUISITION_CAPABILITY_DIGEST",
-    "AMASTER_SOURCE_ACQUISITION_RUNTIME_BUILD_COMMIT",
-    "AMASTER_SOURCE_ACQUISITION_SOURCE_EXTENSION_DIGEST",
-    "AMASTER_SOURCE_ACQUISITION_PI_CODING_AGENT_VERSION",
-    "AMASTER_SOURCE_ACQUISITION_PI_CODING_AGENT_DIGEST"
-  ];
-  if (names.every((name) => !readString(process.env[name]))) return null;
-  const incompatible = (reason) => ({ state: "incompatible", reason });
-  const piMetadata = sourceAcquisitionPackageMetadata("@earendil-works/pi-coding-agent");
-  const piVersion = readString(process.env.AMASTER_SOURCE_ACQUISITION_PI_CODING_AGENT_VERSION);
-  const piDigest = readString(process.env.AMASTER_SOURCE_ACQUISITION_PI_CODING_AGENT_DIGEST);
-  const sourceExtensionDigest = readString(process.env.AMASTER_SOURCE_ACQUISITION_SOURCE_EXTENSION_DIGEST);
-  const runtimeBuildCommit = readString(process.env.AMASTER_SOURCE_ACQUISITION_RUNTIME_BUILD_COMMIT);
-  const deploymentImageDigest = readString(process.env.AMASTER_DEPLOYMENT_IMAGE_DIGEST);
-  const capabilityDigest = readString(process.env.AMASTER_SOURCE_ACQUISITION_CAPABILITY_DIGEST);
-  if (readString(process.env.AMASTER_SOURCE_ACQUISITION_SUPPORTED_PROFILE_VERSIONS) !== source_acquisition_compatibility_default.supportedProfileVersions.join(",") || readString(process.env.AMASTER_SOURCE_ACQUISITION_AUTHENTICATION_ORIGIN_DISCOVERY_CAPABILITY) !== SOURCE_AUTHENTICATION_ORIGIN_DISCOVERY_CAPABILITY || readString(process.env.AMASTER_SOURCE_ACQUISITION_COMPLETION_GUARD) !== SOURCE_ACQUISITION_V2_COMPLETION_GUARD) return incompatible("source_acquisition_v2_capability_mismatch");
-  if (piVersion !== SOURCE_ACQUISITION_V2_PI_VERSION || readString(piMetadata?.version) !== piVersion) {
-    return incompatible("source_acquisition_v2_pi_version_mismatch");
-  }
-  if (!piDigest || !/^[a-f0-9]{64}$/u.test(piDigest)) {
-    return incompatible("source_acquisition_v2_pi_digest_invalid");
-  }
-  if (sourceExtensionDigest !== `sha256:${extensionDigest}`) {
-    return incompatible("source_acquisition_v2_extension_digest_mismatch");
-  }
-  if (!runtimeBuildCommit || !/^[a-f0-9]{40}$/u.test(runtimeBuildCommit)) {
-    return incompatible("source_acquisition_v2_build_commit_invalid");
-  }
-  if (!deploymentImageDigest || !/^sha256:[a-f0-9]{64}$/u.test(deploymentImageDigest)) {
-    return incompatible("source_acquisition_v2_image_digest_invalid");
-  }
-  const runtimeIdentity = {
-    sourceProfileVersion: SOURCE_ACQUISITION_PROFILE_VERSION_V2,
-    piCodingAgentVersion: SOURCE_ACQUISITION_V2_PI_VERSION,
-    supportsAgentSettled: true,
-    supportsSameSessionFollowUp: true,
-    completionRepairHardCapSeconds: 120,
-    sourceExtensionDigest,
-    runtimeBuildCommit
-  };
-  const expectedCapabilityDigest = `sha256:${serializeSourceAcquisitionProfile(runtimeIdentity).sha256}`;
-  if (capabilityDigest !== expectedCapabilityDigest) {
-    return incompatible("source_acquisition_v2_capability_digest_mismatch");
-  }
-  return {
-    state: "ready",
-    proof: {
-      supportedProfileVersions: [...source_acquisition_compatibility_default.supportedProfileVersions],
-      profileVersion: SOURCE_ACQUISITION_PROFILE_VERSION_V2,
-      capability: SOURCE_AUTHENTICATION_ORIGIN_DISCOVERY_CAPABILITY,
-      piCodingAgent: { version: piVersion, digest: piDigest },
-      sourceExtensionDigest,
-      runtimeBuildCommit,
-      deploymentImageDigest,
-      completionGuard: SOURCE_ACQUISITION_V2_COMPLETION_GUARD,
-      capabilityDigest
-    }
-  };
-}
 function sourceAcquisitionRuntimeReadiness(config) {
   const unavailable = (reason) => ({ ready: false, reason });
   const piExecutor = config.executors.find((executor) => executor.kind === "pi");
@@ -13043,22 +12392,13 @@ function sourceAcquisitionRuntimeReadiness(config) {
   }
   let browserSkill;
   if (adapters.includes(SOURCE_ACQUISITION_DESKTOP_ADAPTER)) {
-    const authenticationOriginDiscoveryCapability = readString(
-      process.env.AMASTER_SOURCE_ACQUISITION_BROWSER_SKILL_AUTHENTICATION_ORIGIN_DISCOVERY_CAPABILITY
-    );
-    if (authenticationOriginDiscoveryCapability && authenticationOriginDiscoveryCapability !== SOURCE_AUTHENTICATION_ORIGIN_DISCOVERY_CAPABILITY) {
-      return unavailable("source_acquisition_browser_skill_discovery_attestation_invalid");
-    }
     browserSkill = {
       runtimeVersion: readString(process.env.AMASTER_SOURCE_ACQUISITION_BROWSER_SKILL_RUNTIME_VERSION),
       runtimeDigest: readString(process.env.AMASTER_SOURCE_ACQUISITION_BROWSER_SKILL_RUNTIME_DIGEST),
       assetVersion: readString(process.env.AMASTER_SOURCE_ACQUISITION_BROWSER_SKILL_ASSET_VERSION),
       assetDigest: readString(process.env.AMASTER_SOURCE_ACQUISITION_BROWSER_SKILL_ASSET_DIGEST),
       policyVersion: SOURCE_ACQUISITION_BROWSER_POLICY_VERSION,
-      policyDigest: readString(process.env.AMASTER_SOURCE_ACQUISITION_BROWSER_SKILL_POLICY_DIGEST),
-      ...authenticationOriginDiscoveryCapability ? {
-        authenticationOriginDiscoveryCapability
-      } : {}
+      policyDigest: readString(process.env.AMASTER_SOURCE_ACQUISITION_BROWSER_SKILL_POLICY_DIGEST)
     };
     if (!browserSkill.runtimeVersion || !browserSkill.assetVersion || !/^[a-f0-9]{64}$/u.test(browserSkill.runtimeDigest ?? "") || !/^[a-f0-9]{64}$/u.test(browserSkill.assetDigest ?? "") || !/^[a-f0-9]{64}$/u.test(browserSkill.policyDigest ?? "")) {
       return unavailable("source_acquisition_browser_skill_attestation_invalid");
@@ -13083,7 +12423,6 @@ function sourceAcquisitionRuntimeReadiness(config) {
     }
     packages.push({ name, version, digest });
   }
-  const v2Cohort = sourceAcquisitionV2Cohort(extensionDigest);
   return {
     ready: true,
     profileVersion: SOURCE_ACQUISITION_PROFILE_VERSION,
@@ -13096,8 +12435,7 @@ function sourceAcquisitionRuntimeReadiness(config) {
       version: CONNECTOR_VERSION,
       digest: connectorDigest
     },
-    packages,
-    ...v2Cohort ? { v2Cohort } : {}
+    packages
   };
 }
 function browserSessionRuntimeReadiness(config) {
@@ -13804,14 +13142,41 @@ function commandTrustedPiRuntimeAssertion(command) {
 function commandSourceAcquisitionProfile(command) {
   return asRecord(asRecord(asRecord(command.payload).sourceAcquisition).profile);
 }
+function sourceAcquisitionExactOrigin(value) {
+  const locator = readString(value);
+  let url;
+  try {
+    url = new URL(locator ?? "");
+  } catch {
+    throw Object.assign(new Error("source_acquisition_profile_invalid"), {
+      code: "source_acquisition_profile_invalid"
+    });
+  }
+  if (url.protocol !== "https:" || url.username || url.password) {
+    throw Object.assign(new Error("source_acquisition_profile_invalid"), {
+      code: "source_acquisition_profile_invalid"
+    });
+  }
+  return url.origin;
+}
 async function sourceAcquisitionRuntimeProfile(config, command) {
   const profile = commandSourceAcquisitionProfile(command);
   if (Object.keys(profile).length === 0) return null;
   const access = asRecord(profile.access);
-  const inspection = inspectSourceAcquisitionProfile(profile, commandRunId(command));
+  const transport = asRecord(profile.transport);
+  const tools = asRecord(profile.tools);
+  if (profile.purpose !== "source_acquisition_v1" || profile.retention !== "source_summary_only_v1" || readString(profile.runId) !== commandRunId(command) || !Array.isArray(tools.exactAllowlist) || tools.exactAllowlist.length === 0 || !["public", "authenticated"].includes(access.mode) || !["isolated", "existing"].includes(transport.browserMode) || ![SOURCE_ACQUISITION_HEADLESS_ADAPTER, SOURCE_ACQUISITION_DESKTOP_ADAPTER].includes(transport.adapter)) {
+    throw new Error("source_acquisition_profile_invalid");
+  }
   if (access.mode === "public") {
+    if (transport.browserMode !== "isolated" || transport.adapter !== SOURCE_ACQUISITION_HEADLESS_ADAPTER) {
+      throw new Error("source_acquisition_profile_invalid");
+    }
     return { profile };
   }
+  if (transport.browserMode !== "existing" || transport.adapter !== SOURCE_ACQUISITION_DESKTOP_ADAPTER) {
+    throw new Error("source_acquisition_profile_invalid");
+  }
   const companyId = readString(profile.companyId);
   const bindingId = readString(access.browserBindingId);
   const localOpaqueRef = readString(access.localOpaqueRef);
@@ -13820,6 +13185,7 @@ async function sourceAcquisitionRuntimeProfile(config, command) {
   if (!companyId || !bindingId || !/^profile_[a-z0-9]{16,64}$/i.test(localOpaqueRef ?? "") || !browserLeaseId || !browserLeaseExpiresAt || Date.parse(browserLeaseExpiresAt) <= Date.now()) {
     throw new Error("source_acquisition_profile_invalid");
   }
+  const exactOrigin = sourceAcquisitionExactOrigin(access.exactLocator);
   const profileName2 = createHash14("sha256").update(`${companyId}\0${bindingId}\0${localOpaqueRef}`).digest("hex");
   const stateRoot = resolve11(config.browserSessionStateRoot);
   const userDataDir = resolve11(stateRoot, profileName2);
@@ -13827,7 +13193,7 @@ async function sourceAcquisitionRuntimeProfile(config, command) {
   const markerPath = join15(userDataDir, ".amaster-browser-session.json");
   if (!existsSync14(userDataDir) || lstatSync7(userDataDir).isSymbolicLink() || !lstatSync7(userDataDir).isDirectory() || !existsSync14(markerPath) || lstatSync7(markerPath).isSymbolicLink()) throw new Error("source_acquisition_browser_profile_invalid");
   const marker = readJsonFile2(markerPath);
-  if (marker.version !== 1 || marker.companyId !== companyId || marker.bindingId !== bindingId || marker.localOpaqueRef !== localOpaqueRef || !readString(marker.provider) || !inspection.sourceOrigins.includes(marker.origin) || Object.keys(marker).length !== 6) {
+  if (marker.version !== 1 || marker.companyId !== companyId || marker.bindingId !== bindingId || marker.localOpaqueRef !== localOpaqueRef || !readString(marker.provider) || marker.origin !== exactOrigin || Object.keys(marker).length !== 6) {
     throw new Error("source_acquisition_browser_profile_invalid");
   }
   const releaseBrowserLease = await browserSessionBrokerFor(config).acquireAgentRead({
@@ -14456,11 +13822,9 @@ function createLiveOutputLogger(config, command, executorKind, protectedValues =
   const liveMcpToolResults = [];
   const sourceRetention = options.sourceRetention === true;
   const onSourceObservations = typeof options.onSourceObservations === "function" ? options.onSourceObservations : null;
-  const onSourceAuthenticationOriginDiscoveries = typeof options.onSourceAuthenticationOriginDiscoveries === "function" ? options.onSourceAuthenticationOriginDiscoveries : null;
   let queue = Promise.resolve();
   let observationQueue = Promise.resolve();
   let observationError = null;
-  let authenticationDiscoverySeen = false;
   const piToolArgumentTracker = executorKind === "pi" ? createPiToolArgumentAmplificationTracker(options.piToolArgumentGuard) : null;
   const maxEntriesPerStream = parsePositiveInteger(process.env.AMASTER_RUNTIME_LIVE_LOG_MAX_ENTRIES_PER_STREAM, 200);
   const countEventType = (event) => {
@@ -14542,7 +13906,6 @@ function createLiveOutputLogger(config, command, executorKind, protectedValues =
     const text = redactProtectedText(line, protectedValues).trim();
     if (!text) return;
     const event = stream === "stdout" ? parseJsonLine(text) : null;
-    const sourceControlEvent = parseJsonLine(text);
     const argumentAmplificationStop = stream === "stdout" ? piToolArgumentTracker?.record(event) ?? null : null;
     const eventType = readString(asRecord(event).type);
     if (executorKind === "pi" && eventType === "session") {
@@ -14576,24 +13939,6 @@ function createLiveOutputLogger(config, command, executorKind, protectedValues =
         });
       }
     }
-    if (sourceRetention && executorKind === "pi" && sourceControlEvent && onSourceAuthenticationOriginDiscoveries) {
-      const discoveries = piSourceAuthenticationOriginDiscoveries(sourceControlEvent);
-      if (discoveries.length > 0) {
-        if (authenticationDiscoverySeen) {
-          observationError ??= new Error("source_authentication_origin_discovery_duplicate");
-        } else {
-          authenticationDiscoverySeen = true;
-          observationQueue = observationQueue.then(async () => {
-            if (observationError) return;
-            try {
-              await onSourceAuthenticationOriginDiscoveries(discoveries);
-            } catch (error) {
-              observationError = error;
-            }
-          });
-        }
-      }
-    }
     let entry = null;
     if (event && shouldPreserveExecutorJsonlForTranscript(executorKind, event)) {
       entry = {
@@ -15069,7 +14414,6 @@ function runExecutor(command, args, options) {
       if (quiescenceTimer) clearTimeout(quiescenceTimer);
       if (stoppedResidentTimer) clearTimeout(stoppedResidentTimer);
       if (completionOutputDrainTimer) clearTimeout(completionOutputDrainTimer);
-      sourceCompletionStopPolicy.close();
       options.signal?.removeEventListener?.("abort", abort);
       resolveRun({
         stdout,
@@ -15082,7 +14426,6 @@ function runExecutor(command, args, options) {
         memoryLimit,
         completionOutputType,
         completionOutputHasFinalAssistantText,
-        sourceCompletionHardCapExceeded: sourceCompletionStopPolicy.hardCapExceeded,
         killedWorkspaceResidents,
         ...outputDrainForcedClosed ? { outputDrainForcedClosed: true } : {},
         ...result3
@@ -15098,10 +14441,6 @@ function runExecutor(command, args, options) {
       signalExecutorProcess(child, "SIGTERM", processGroupId);
       scheduleStopKill();
     };
-    const sourceCompletionStopPolicy = createSourceCompletionStopPolicy({
-      enabled: options.sourceCompletionGuard === true,
-      onStop: requestStop
-    });
     deliverSourceAcquisitionManagedInputs(child, managedInputs, (code, error) => {
       spawnError = `${code}_delivery_failed: ${error.message}`;
       requestStop(`${code}_delivery_failed`);
@@ -15183,15 +14522,6 @@ function runExecutor(command, args, options) {
         if (!trimmed.startsWith("{")) continue;
         try {
           const event = JSON.parse(trimmed);
-          const eventType = readString(asRecord(event).type);
-          const sourceStop = sourceCompletionStopPolicy.observe(eventType);
-          if (sourceStop.handled) {
-            if (sourceStop.completionOutputType) {
-              completionOutputType = sourceStop.completionOutputType;
-              return;
-            }
-            continue;
-          }
           const stopType = piCompletionOutputType(event);
           if (stopType) {
             completionOutputType = stopType;
@@ -15375,17 +14705,6 @@ async function ingestSourceAcquisitionObservations(config, command, profile, rec
     );
   }
 }
-async function ingestSourceAuthenticationOriginDiscoveries(config, command, profile, discoveries) {
-  await submitSourceAuthenticationOriginDiscovery({
-    config,
-    command,
-    connectorId: requireConnectorId(config),
-    profile,
-    discoveries,
-    postJsonWithRetry,
-    ingestLog
-  });
-}
 function parsedUsageCostCents(usage) {
   const costUsd = readNumber(asRecord(usage).costUsd, 0);
   if (!Number.isFinite(costUsd) || costUsd <= 0) return 0;
@@ -17517,7 +16836,6 @@ async function executeRunCommand(config, command) {
     const protectedExecutorValues = managedMcpProfile?.protectedValues ?? providerProtectedValues;
     const runtimeArtifacts = [];
     const runtimeDocuments = [];
-    let sourceAuthenticationDiscoveryAccepted = false;
     const runtimeArtifactIngest = createRuntimeArtifactIngestQueue({
       ingest: (results) => ingestRuntimeArtifacts(config, command, cwd, results)
     });
@@ -17542,15 +16860,7 @@ async function executeRunCommand(config, command) {
             command,
             sourceAcquisition.profile,
             receipts
-          ),
-          onSourceAuthenticationOriginDiscoveries: (discoveries) => ingestSourceAuthenticationOriginDiscoveries(
-            config,
-            command,
-            sourceAcquisition.profile,
-            discoveries
-          ).then(() => {
-            sourceAuthenticationDiscoveryAccepted = true;
-          })
+          )
         } : {}
       }
     );
@@ -17565,7 +16875,6 @@ async function executeRunCommand(config, command) {
         maxRssMb: config.executorMaxRssMb,
         signal: abortController.signal,
         executorKind: executor.kind,
-        sourceCompletionGuard: executor.kind === "pi" && sourceAcquisition?.profile?.purpose === SOURCE_ACQUISITION_PROFILE_VERSION_V2,
         ...piExecutorIdentity ? { spawnIdentity: piExecutorIdentity } : {},
         ...sourceProfile ? { sourceProfileInput: sourceProfile.input } : {},
         onOutput: (stream, chunk, rawBytes) => {
@@ -17791,14 +17100,11 @@ async function executeRunCommand(config, command) {
       }
     }
     const cancelled = execution.cancelled === true;
-    const sourceCompletionGuard = executor.kind === "pi" && sourceAcquisition?.profile?.purpose === SOURCE_ACQUISITION_PROFILE_VERSION_V2;
-    const sourceCompletionOutputStopped = sourceCompletionGuard && execution.completionOutputType === "agent_settled" && piCompletionCleanupStopped(execution);
-    const sourceCompletionFailure = sourceCompletionGuard && !sourceAuthenticationDiscoveryAccepted && (execution.sourceCompletionHardCapExceeded === true || sourceCompletionTerminalFailure(execution.stderr, sourceAcquisition.profile) || !sourceCompletionActionAccepted(mcpToolResults)) ? "source_acquisition_terminal_action_missing" : null;
     const outputFloodError = hasOutputFlood ? `${executor.kind === "pi" ? "Pi Agent" : "Executor"} output flood: ${outputFlood.stream} exceeded ${readNumber(outputFlood.limitBytes, 0)} bytes` : null;
     const argumentAmplificationError = hasArgumentAmplification ? `Pi Agent tool argument stream amplification stopped before execution: ${readNumber(argumentAmplification.transportArgumentBytes, 0)} transported byte(s), ${readNumber(argumentAmplification.materializedArgumentBytes, 0)} materialized byte(s)` : null;
     const memoryLimitError = hasMemoryLimit ? `${executor.kind === "pi" ? "Pi Agent" : "Executor"} memory limit exceeded: RSS ${readNumber(memoryLimit.rssBytes, 0)} bytes exceeded ${readNumber(memoryLimit.limitBytes, config.executorMaxRssMb * 1024 * 1024)} bytes` : null;
     const piUsageDiagnostic = executor.kind === "pi" && !hasOutputFlood && !hasArgumentAmplification && piOutputUsageMetadataMissing(parsed) ? "Pi Agent exited without usage metadata" : null;
-    const completionOutputStopped = executor.kind === "pi" && (piCompletionOutputStopped(execution) || sourceCompletionOutputStopped);
+    const completionOutputStopped = executor.kind === "pi" && piCompletionOutputStopped(execution);
     const cleanupDisposition = executor.kind === "pi" && !cancelled && !hasOutputFlood && !hasArgumentAmplification && !hasMemoryLimit && execution.timedOut !== true && !execution.spawnError && execution.signal === null ? classifyPiTerminalCleanupDisposition(
       { ...parsed, mcpToolResults },
       runtimeArtifacts
@@ -17820,13 +17126,13 @@ async function executeRunCommand(config, command) {
     const piTurnLimitFailure = executor.kind === "pi" && !cancelled && !hasOutputFlood && !hasArgumentAmplification && !hasMemoryLimit && execution.timedOut !== true && !execution.spawnError ? classifyPiTurnLimitResult(parsedForValidation) : null;
     const piInvalidOutputError = executor.kind === "pi" ? piOutputValidationError(parsedForValidation, {
       allowMissingTurnEnd: completionOutputStopped,
-      allowMissingAssistantOutput: execution.completionOutputType === "approval_required" || sourceCompletionGuard,
+      allowMissingAssistantOutput: execution.completionOutputType === "approval_required",
       completionOutputType: execution.completionOutputType,
       completionOutputHasFinalAssistantText: terminalTextRepair?.succeeded === true ? true : execution.completionOutputHasFinalAssistantText
     }) : null;
     const piOutputFailure = executor.kind === "pi" && !cancelled && !hasOutputFlood && !hasArgumentAmplification && !hasMemoryLimit && execution.timedOut !== true && !execution.spawnError ? classifyPiOutputFailure(parsedForValidation, { invalidOutputError: piInvalidOutputError }) : null;
     const piProviderFailure = piOutputFailure?.errorCode !== "pi_executor_invalid_output" ? piOutputFailure : null;
-    const parsedErrorMessage = outputFloodError ?? argumentAmplificationError ?? memoryLimitError ?? sourceCompletionFailure ?? piTurnLimitFailure?.message ?? piInvalidOutputError ?? nativeSessionRolloutError ?? nativeSessionRolloutCleanupError ?? parsedForValidation.errorMessage;
+    const parsedErrorMessage = outputFloodError ?? argumentAmplificationError ?? memoryLimitError ?? piTurnLimitFailure?.message ?? piInvalidOutputError ?? nativeSessionRolloutError ?? nativeSessionRolloutCleanupError ?? parsedForValidation.errorMessage;
     const codexTransientFailure = executor.kind === "codex" && (execution.exitCode ?? 0) !== 0 ? classifyCodexTransientUpstreamError({
       stdout: execution.stdout,
       stderr: execution.stderr,
@@ -17853,15 +17159,15 @@ async function executeRunCommand(config, command) {
       receipt: sourceExecutionReceiptPath ? readSourceAcquisitionExecutionReceipt(sourceExecutionReceiptPath, sourceExecutionIdentity) : null,
       exitCode: execution.exitCode
     }) : null;
-    const sourceErrorCode = sourceAcquisition ? sourceCompletionFailure ?? (execution.timedOut ? "source_acquisition_timeout" : cancelled ? "source_acquisition_cancelled" : hasOutputFlood ? "source_acquisition_output_flood" : hasMemoryLimit ? "source_acquisition_memory_limit" : execution.spawnError ? "source_acquisition_executor_unavailable" : succeeded ? null : sourceExecutionFailure?.failureCode ?? "source_acquisition_executor_failed") : null;
+    const sourceErrorCode = sourceAcquisition ? execution.timedOut ? "source_acquisition_timeout" : cancelled ? "source_acquisition_cancelled" : hasOutputFlood ? "source_acquisition_output_flood" : hasMemoryLimit ? "source_acquisition_memory_limit" : execution.spawnError ? "source_acquisition_executor_unavailable" : succeeded ? null : sourceExecutionFailure?.failureCode ?? "source_acquisition_executor_failed" : null;
     const error = sourceAcquisition ? sourceErrorCode : unsafeError;
     const costUsage = parsedCostUsage(parsed.usage);
-    const cleanPiTerminalOutputStop = succeeded && (completionOutputStopped || repairedPiTerminalOutputStop) && (sourceCompletionOutputStopped || execution.completionOutputType === "agent_end" && parsed.terminalEventType === "agent_end" && Number.isInteger(parsed.terminalEventIndex));
+    const cleanPiTerminalOutputStop = succeeded && (completionOutputStopped || repairedPiTerminalOutputStop) && execution.completionOutputType === "agent_end" && parsed.terminalEventType === "agent_end" && Number.isInteger(parsed.terminalEventIndex);
     const executorOutcome = {
       status: cancelled ? "cancelled" : execution.timedOut ? "timed_out" : cleanPiTerminalOutputStop || execution.exitCode === 0 && execution.signal === null ? "completed" : "failed",
       exitCode: cleanPiTerminalOutputStop ? 0 : execution.exitCode,
       signal: cleanPiTerminalOutputStop ? null : execution.signal,
-      terminalEvent: sourceCompletionOutputStopped ? "agent_settled" : ["agent_end", "turn_end"].includes(readString(parsed.terminalEventType) ?? "") ? readString(parsed.terminalEventType) : null,
+      terminalEvent: ["agent_end", "turn_end"].includes(readString(parsed.terminalEventType) ?? "") ? readString(parsed.terminalEventType) : null,
       terminalEventIndex: Number.isInteger(parsed.terminalEventIndex) ? parsed.terminalEventIndex : null
     };
     let result3 = {