@amaster.ai/employee-runtime-connector 0.1.1-beta.121 → 0.1.1-beta.123

package/dist/amaster-runtime-daemon.mjs

@@ -5116,10 +5116,13 @@ var amasterRuntimeConnectorCompletionCheckResponseSchema = external_exports.unio
   amasterRuntimeConnectorCompletionCheckV1ResponseSchema,
   amasterRuntimeConnectorCompletionCheckV2ResponseSchema
 ]);
+var amasterRuntimeConnectorCommandResultSchema = external_exports.object({
+  sessionId: external_exports.string().max(2048).optional()
+}).catchall(external_exports.unknown());
 var amasterRuntimeConnectorCompleteCommandSchema = external_exports.object({
   leaseId: external_exports.string().trim().min(1).optional(),
   status: external_exports.enum(["succeeded", "failed", "cancelled"]),
-  result: external_exports.record(external_exports.unknown()).optional(),
+  result: amasterRuntimeConnectorCommandResultSchema.optional(),
   error: external_exports.string().trim().max(4e3).optional()
 });
 var amasterRuntimeConnectorLogIngestSchema = external_exports.object({
@@ -9056,6 +9059,8 @@ var issueExecutionStageSchema = external_exports.object({
   participants: external_exports.array(issueExecutionStageParticipantSchema).default([])
 });
 var issueExecutionMonitorPolicySchema = external_exports.object({
+  effectId: external_exports.string().uuid().optional().nullable().default(null),
+  executionEpoch: external_exports.number().int().positive().optional().nullable().default(null),
   nextCheckAt: external_exports.string().datetime(),
   notes: external_exports.string().max(500).optional().nullable().default(null),
   scheduledBy: external_exports.enum(ISSUE_MONITOR_SCHEDULED_BY).optional().default("assignee"),
@@ -9322,7 +9327,8 @@ var externalWaitSnoozeSchema = external_exports.object({
 var upsertIssueExternalWaitSchema = external_exports.object({
   ownerType: external_exports.enum(["external", "user"]),
   actionKind: external_exports.enum(["approval", "input", "dependency", "other"]),
-  reasonCode: external_exports.string().trim().min(1).max(120)
+  reasonCode: external_exports.string().trim().min(1).max(120),
+  reviewAt: external_exports.string().datetime().nullable().optional()
 }).strict();
 var resolveIssueExternalWaitSchema = external_exports.object({
   outcome: external_exports.enum(["completed", "cannot_complete", "external_input_change"]),
@@ -9705,7 +9711,8 @@ var chooseTaskDispositionOptionSchema = external_exports.object({
     ownerType: external_exports.enum(["external", "user"]),
     actionKind: external_exports.enum(["approval", "input", "dependency", "other"]),
     reasonCode: external_exports.string().trim().min(1).max(120).regex(/^[a-z][a-z0-9_]*$/),
-    resolutionCondition: external_exports.string().trim().min(1).max(1e3)
+    resolutionCondition: external_exports.string().trim().min(1).max(1e3),
+    reviewAt: external_exports.string().datetime({ offset: true }).optional()
   }).strict().optional(),
   monitor: external_exports.object({
     checkAfterMinutes: external_exports.number().int().min(5).max(90 * 24 * 60),
@@ -9751,6 +9758,8 @@ var chooseTaskDispositionResultSchema = external_exports.object({
     issueId: external_exports.string().uuid(),
     effectId: external_exports.string().uuid(),
     materializedAt: external_exports.string().datetime({ offset: true }),
+    executionEpoch: external_exports.number().int().positive(),
+    reviewAt: external_exports.string().datetime({ offset: true }).nullable().optional(),
     nextCheckAt: external_exports.string().datetime({ offset: true }).nullable().optional()
   }).strict()
 }).strict();
@@ -16785,12 +16794,16 @@ function findSessionRollout(sessionsRoot, sessionId) {
 }
 function restoreManagedCodexSessionRollout(input, codexHome, runDir, executorHome, authority) {
   const session = record3(input.nativeSession);
-  if (session.mode !== "governed_action_approval" || session.required !== true) return null;
+  const governedApprovalContinuation = session.mode === "governed_action_approval" && session.required === true;
+  const governedTaskSessionContinuation = session.mode === "task_session" && session.required === false;
+  if (!governedApprovalContinuation && !governedTaskSessionContinuation) return null;
   const sessionId = nonEmpty(session.sessionId, "nativeSession.sessionId");
   const sourceRunId = nonEmpty(session.sourceRunId, "nativeSession.sourceRunId");
   const sourceCommandId = nonEmpty(session.sourceCommandId, "nativeSession.sourceCommandId");
-  nonEmpty(session.actionRequestId, "nativeSession.actionRequestId");
-  nonEmpty(session.invocationId, "nativeSession.invocationId");
+  if (governedApprovalContinuation) {
+    nonEmpty(session.actionRequestId, "nativeSession.actionRequestId");
+    nonEmpty(session.invocationId, "nativeSession.invocationId");
+  }
   const sourceWorkspacePath = nonEmpty(session.cwd, "nativeSession.cwd");
   const issueRoot = dirname(runDir);
   const managedSourceRunDirName = `${sourceRunId}-${createHash("sha256").update(sourceRunId).digest("hex").slice(0, 8)}`;
@@ -16806,7 +16819,7 @@ function restoreManagedCodexSessionRollout(input, codexHome, runDir, executorHom
   }
   const marker = JSON.parse(readFileSync(markerPath, "utf8"));
   if (marker?.version !== 1 || marker?.companyId !== authority.companyId || marker?.agentId !== authority.agentId || marker?.issueId !== authority.issueId || marker?.sourceRunId !== sourceRunId || marker?.sourceCommandId !== sourceCommandId || marker?.sessionId !== sessionId || marker?.sourceWorkspacePath !== sourceWorkspacePath) {
-    throw new Error("codex_managed_mcp_session_rollout_authority_mismatch: source rollout does not match the approved continuation");
+    throw new Error("codex_managed_mcp_session_rollout_authority_mismatch: source rollout does not match the governed continuation");
   }
   const sourceRollout = resolve2(cacheRoot, nonEmpty(marker.rolloutRelativePath, "rolloutRelativePath"));
   if (!within(sourceRollout, cacheRoot) || lstatSync2(sourceRollout).isSymbolicLink() || !lstatSync2(sourceRollout).isFile()) {
@@ -16821,6 +16834,28 @@ function restoreManagedCodexSessionRollout(input, codexHome, runDir, executorHom
   writePrivateFile(targetRollout, readFileSync(sourceRollout));
   return { sessionId, sourceRunId, sourceCommandId, rolloutPath: targetRollout, cacheRoot };
 }
+function resolveManagedCodexSessionRollout(input, codexHome, runDir, executorHome, authority) {
+  try {
+    return {
+      restoredNativeSession: restoreManagedCodexSessionRollout(
+        input,
+        codexHome,
+        runDir,
+        executorHome,
+        authority
+      ),
+      nativeSessionRestoreSkippedReason: null
+    };
+  } catch (error) {
+    if (record3(input.nativeSession).mode === "task_session" && error instanceof Error && error.message.startsWith("codex_managed_mcp_session_rollout_missing:")) {
+      return {
+        restoredNativeSession: null,
+        nativeSessionRestoreSkippedReason: "native_session_rollout_missing"
+      };
+    }
+    throw error;
+  }
+}
 function isSensitiveAuthKey(key) {
   const normalized = String(key).trim().toLowerCase().replaceAll("-", "_");
   return /^(?:(?:access|refresh|id)_)?token$/.test(normalized) || normalized.includes("api_key") || normalized.includes("secret") || normalized.includes("password") || normalized.includes("credential") || normalized.includes("authorization") || normalized.includes("cookie");
@@ -17138,7 +17173,10 @@ function prepareManagedCodexMcpProfile(input) {
       runId,
       commandId: input.commandId
     });
-    const restoredNativeSession = restoreManagedCodexSessionRollout(input, codexHome, runDir, executorHome, authority);
+    const {
+      restoredNativeSession,
+      nativeSessionRestoreSkippedReason
+    } = resolveManagedCodexSessionRollout(input, codexHome, runDir, executorHome, authority);
     const auth = seedCodexAuth(input, codexHome);
     const configPath = join2(codexHome, "config.toml");
     const allHeaders = { Authorization: `Bearer ${sessionToken}`, ...headers };
@@ -17193,6 +17231,7 @@ function prepareManagedCodexMcpProfile(input) {
       owner,
       authority,
       restoredNativeSession,
+      nativeSessionRestoreSkippedReason,
       protectedValues: [.../* @__PURE__ */ new Set([sessionToken, ...auth.protectedValues])],
       attestation: {
         ...attestationFacts,
@@ -19096,12 +19135,16 @@ function createManagedPiMcpProfileApi(options = {}) {
   }
   function restoreManagedPiSessionRollout(input, sessionsRoot, runDir, executorHome, authority) {
     const session = record8(input.nativeSession);
-    if (session.mode !== "governed_action_approval" || session.required !== true) return null;
+    const governedApprovalContinuation = session.mode === "governed_action_approval" && session.required === true;
+    const governedTaskSessionContinuation = session.mode === "task_session" && session.required === false;
+    if (!governedApprovalContinuation && !governedTaskSessionContinuation) return null;
     const sessionId = nonEmpty2(session.sessionId, "nativeSession.sessionId");
     const sourceRunId = nonEmpty2(session.sourceRunId, "nativeSession.sourceRunId");
     const sourceCommandId = nonEmpty2(session.sourceCommandId, "nativeSession.sourceCommandId");
-    nonEmpty2(session.actionRequestId, "nativeSession.actionRequestId");
-    nonEmpty2(session.invocationId, "nativeSession.invocationId");
+    if (governedApprovalContinuation) {
+      nonEmpty2(session.actionRequestId, "nativeSession.actionRequestId");
+      nonEmpty2(session.invocationId, "nativeSession.invocationId");
+    }
     const sourceWorkspacePath = nonEmpty2(session.cwd, "nativeSession.cwd");
     const issueRoot = dirname4(runDir);
     const managedSourceRunDirName = `${sourceRunId}-${createHash5("sha256").update(sourceRunId).digest("hex").slice(0, 8)}`;
@@ -19116,7 +19159,7 @@ function createManagedPiMcpProfileApi(options = {}) {
     }
     const marker = JSON.parse(readFileSync5(markerPath, "utf8"));
     if (marker?.version !== 1 || marker?.companyId !== authority.companyId || marker?.agentId !== authority.agentId || marker?.issueId !== authority.issueId || marker?.sourceRunId !== sourceRunId || marker?.sourceCommandId !== sourceCommandId || marker?.sessionId !== sessionId || marker?.sourceWorkspacePath !== sourceWorkspacePath) {
-      throw new Error("pi_managed_mcp_session_rollout_authority_mismatch: source rollout does not match the approved continuation");
+      throw new Error("pi_managed_mcp_session_rollout_authority_mismatch: source rollout does not match the governed continuation");
     }
     const sourceRollout = resolve3(cacheRoot, nonEmpty2(marker.rolloutRelativePath, "rolloutRelativePath"));
     if (!within2(sourceRollout, cacheRoot) || lstatSync3(sourceRollout).isSymbolicLink() || !lstatSync3(sourceRollout).isFile()) {
@@ -19130,6 +19173,28 @@ function createManagedPiMcpProfileApi(options = {}) {
     writePrivateFile2(targetRollout, readFileSync5(sourceRollout));
     return { sessionId, sourceRunId, sourceCommandId, rolloutPath: targetRollout, cacheRoot };
   }
+  function resolveManagedPiSessionRollout(input, sessionsRoot, runDir, executorHome, authority) {
+    try {
+      return {
+        restoredNativeSession: restoreManagedPiSessionRollout(
+          input,
+          sessionsRoot,
+          runDir,
+          executorHome,
+          authority
+        ),
+        nativeSessionRestoreSkippedReason: null
+      };
+    } catch (error) {
+      if (record8(input.nativeSession).mode === "task_session" && error instanceof Error && error.message.startsWith("pi_managed_mcp_session_rollout_missing:")) {
+        return {
+          restoredNativeSession: null,
+          nativeSessionRestoreSkippedReason: "native_session_rollout_missing"
+        };
+      }
+      throw error;
+    }
+  }
   function parseVersion(stdout, label, minimum) {
     const pattern = label === "Pi" ? /^\s*(?:pi(?: coding agent)?\s+)?(\d+)\.(\d+)\.(\d+)(?:\s|$)/im : /^\s*(\d+)\.(\d+)\.(\d+)(?:\s|$)/;
     const match = String(stdout).match(pattern);
@@ -20003,6 +20068,11 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
           "--no-approve",
           "--no-skills",
           "--no-context-files",
+          "--no-builtin-tools",
+          // The probe attests only the governed adapter and run-owned attestor.
+          // Ambient Pi extensions may fail independently and must not change this
+          // measured tool surface; explicitly supplied extensions still load.
+          "--no-extensions",
           // The enforcement extensions live in the run profile, not an agent dir,
           // so the probe must load them explicitly to measure the real run surface.
           ...Array.isArray(input.extensionArgs) ? input.extensionArgs : [],
@@ -20160,7 +20230,10 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         commandId: input.commandId
       });
       const sharedRuntime = sharedPiHomeSettingsEnv(input.baseEnv);
-      const restoredNativeSession = restoreManagedPiSessionRollout(input, sessionsRoot, runDir, executorHome, authority);
+      const {
+        restoredNativeSession,
+        nativeSessionRestoreSkippedReason
+      } = resolveManagedPiSessionRollout(input, sessionsRoot, runDir, executorHome, authority);
       const directToolNames = directCatalog?.tools.map((tool) => tool.exposedName) ?? [];
       const serverConfig = {
         type: "http",
@@ -20465,6 +20538,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         owner,
         authority,
         restoredNativeSession,
+        nativeSessionRestoreSkippedReason,
         configPath,
         markerPath,
         env,
@@ -20830,6 +20904,27 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
 `);
     return { status: "preserved", sessionId, rolloutPath: targetRollout, cacheRoot };
   }
+  function cleanupRestoredManagedPiSessionRollout2(profile) {
+    const restored = profile?.restoredNativeSession;
+    if (!restored?.cacheRoot) return { status: "not_restored" };
+    const cacheRoot = resolve3(restored.cacheRoot);
+    if (!existsSync4(cacheRoot)) return { status: "already_removed" };
+    const cacheStat = lstatSync3(cacheRoot);
+    if (!cacheStat.isDirectory() || cacheStat.isSymbolicLink()) {
+      throw new Error("pi_managed_mcp_session_rollout_cleanup_unsafe: cache root is not a private directory");
+    }
+    const markerPath = join5(cacheRoot, SESSION_ROLLOUT_MARKER2);
+    if (!existsSync4(markerPath) || lstatSync3(markerPath).isSymbolicLink() || !lstatSync3(markerPath).isFile()) {
+      throw new Error("pi_managed_mcp_session_rollout_cleanup_unsafe: ownership marker is unavailable");
+    }
+    const marker = JSON.parse(readFileSync5(markerPath, "utf8"));
+    if (marker?.companyId !== profile.authority.companyId || marker?.agentId !== profile.authority.agentId || marker?.issueId !== profile.authority.issueId || marker?.sourceRunId !== restored.sourceRunId || marker?.sourceCommandId !== restored.sourceCommandId || marker?.sessionId !== restored.sessionId) {
+      throw new Error("pi_managed_mcp_session_rollout_cleanup_unsafe: ownership marker does not match restored authority");
+    }
+    rmSync3(cacheRoot, { recursive: true, force: false });
+    if (existsSync4(cacheRoot)) throw new Error("pi_managed_mcp_session_rollout_cleanup_failed: cache root still exists");
+    return { status: "removed" };
+  }
   function removeWorkspaceMcpConfig(configPath, profileRoot) {
     const target = resolve3(configPath);
     if (!workspaceMcpConfigBelongsToProfile(target, profileRoot)) {
@@ -20981,7 +21076,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
       failures
     };
   }
-  return { prepareManagedPiMcpProfile: prepareManagedPiMcpProfile2, prepareDelegatedPiMcpProfile: prepareDelegatedPiMcpProfile2, inspectManagedPiRunExitClosureAttestation: inspectManagedPiRunExitClosureAttestation2, restoreManagedPiRunExitClosureBaseline: restoreManagedPiRunExitClosureBaseline2, preserveManagedPiSessionRollout: preserveManagedPiSessionRollout2, cleanupManagedPiMcpProfile: cleanupManagedPiMcpProfile2, cleanupDelegatedPiMcpProfile: cleanupDelegatedPiMcpProfile2, reconcileManagedPiMcpProfiles: reconcileManagedPiMcpProfiles2 };
+  return { prepareManagedPiMcpProfile: prepareManagedPiMcpProfile2, prepareDelegatedPiMcpProfile: prepareDelegatedPiMcpProfile2, inspectManagedPiRunExitClosureAttestation: inspectManagedPiRunExitClosureAttestation2, restoreManagedPiRunExitClosureBaseline: restoreManagedPiRunExitClosureBaseline2, preserveManagedPiSessionRollout: preserveManagedPiSessionRollout2, cleanupRestoredManagedPiSessionRollout: cleanupRestoredManagedPiSessionRollout2, cleanupManagedPiMcpProfile: cleanupManagedPiMcpProfile2, cleanupDelegatedPiMcpProfile: cleanupDelegatedPiMcpProfile2, reconcileManagedPiMcpProfiles: reconcileManagedPiMcpProfiles2 };
 }
 var piManagedMcpProfileApi = createManagedPiMcpProfileApi();
 var prepareManagedPiMcpProfile = piManagedMcpProfileApi.prepareManagedPiMcpProfile;
@@ -20989,6 +21084,7 @@ var prepareDelegatedPiMcpProfile = piManagedMcpProfileApi.prepareDelegatedPiMcpP
 var inspectManagedPiRunExitClosureAttestation = piManagedMcpProfileApi.inspectManagedPiRunExitClosureAttestation;
 var restoreManagedPiRunExitClosureBaseline = piManagedMcpProfileApi.restoreManagedPiRunExitClosureBaseline;
 var preserveManagedPiSessionRollout = piManagedMcpProfileApi.preserveManagedPiSessionRollout;
+var cleanupRestoredManagedPiSessionRollout = piManagedMcpProfileApi.cleanupRestoredManagedPiSessionRollout;
 var cleanupManagedPiMcpProfile = piManagedMcpProfileApi.cleanupManagedPiMcpProfile;
 var cleanupDelegatedPiMcpProfile = piManagedMcpProfileApi.cleanupDelegatedPiMcpProfile;
 var reconcileManagedPiMcpProfiles = piManagedMcpProfileApi.reconcileManagedPiMcpProfiles;
@@ -28401,7 +28497,7 @@ function createSourceCompletionStopPolicy({
 }
 
 // src/amaster-runtime-daemon.mjs
-var CONNECTOR_VERSION = "0.1.1-beta.121";
+var CONNECTOR_VERSION = "0.1.1-beta.123";
 var CONNECTOR_CONTRACT_VERSION = "2026-06-04.v1";
 var SOURCE_ACQUISITION_CAPABILITY2 = source_acquisition_compatibility_default.profileVersion;
 var daemonRequire = createRequire(import.meta.url);
@@ -30254,7 +30350,7 @@ function sanitizePiExtraArgs(value) {
   return splitExtraArgs(value).filter((entry) => !AMASTER_PI_PROHIBITED_EXTRA_ARGS.has(entry));
 }
 function nativeSessionResumeEnabled(session) {
-  return process.env.AMASTER_RUNTIME_ENABLE_NATIVE_SESSION_RESUME === "true" || readString(session.mode) === "governed_action_approval" && session.required === true;
+  return process.env.AMASTER_RUNTIME_ENABLE_NATIVE_SESSION_RESUME === "true" || readString(session.mode) === "task_session" || readString(session.mode) === "governed_action_approval" && session.required === true;
 }
 function modelCallResponseContract(payload) {
   if (payload.responseContract === void 0) return null;
@@ -30371,8 +30467,8 @@ function buildExecutorInvocation(executor, command = {}, workspace = null, optio
     const args = ["--mode", "json"];
     const governedRun = Object.keys(asRecord(commandRuntimeAuth(command).governedMcp)).length > 0;
     const nativeSessionRequest = asRecord(asRecord(command.payload).nativeSession);
-    if (governedRun && nativeSession.used && (nativeSessionRequest.mode !== "governed_action_approval" || nativeSessionRequest.required !== true)) {
-      throw new Error("pi_managed_mcp_native_session_resume_blocked: governed Pi runs require exact approval continuation authority");
+    if (governedRun && nativeSession.used && !(nativeSessionRequest.mode === "governed_action_approval" && nativeSessionRequest.required === true || nativeSessionRequest.mode === "task_session" && nativeSessionRequest.required === false)) {
+      throw new Error("pi_managed_mcp_native_session_resume_blocked: governed Pi runs require exact continuation authority");
     }
     const provider = readString(process.env.AMASTER_PI_PROVIDER);
     const model = readString(process.env.AMASTER_PI_MODEL);
@@ -33550,6 +33646,23 @@ async function executeRunCommand(config, command) {
       }
     }
     if (managedMcpProfile) {
+      if (nativeSessionRequest.mode === "task_session" && asRecord(invocation.nativeSession).used === true && !managedMcpProfile.restoredNativeSession) {
+        const freshPayload = { ...asRecord(command.payload) };
+        delete freshPayload.nativeSession;
+        const freshInvocation = buildExecutorInvocation(
+          executor,
+          { ...command, payload: freshPayload },
+          workspace
+        );
+        invocation.args = freshInvocation.args;
+        invocation.stdin = freshInvocation.stdin;
+        invocation.nativeSession = {
+          ...asRecord(invocation.nativeSession),
+          mode: "fresh",
+          used: false,
+          skippedReason: readString(managedMcpProfile.nativeSessionRestoreSkippedReason) ?? "native_session_rollout_missing"
+        };
+      }
       executorEnv = managedMcpProfile.env;
       if (executor.kind === "pi" && managedMcpProfile.spawnIdentity) {
         piExecutorIdentity = managedMcpProfile.spawnIdentity;
@@ -33957,7 +34070,11 @@ async function executeRunCommand(config, command) {
         parsed.hasAssistantOutput = true;
       }
     }
-    const shouldPreserveNativeSession = managedMcpProfile && parsed.sessionId && (execution.exitCode === 0 || execution.completionOutputType === "approval_required") && !execution.timedOut && execution.cancelled !== true && !execution.spawnError && ["codex", "pi"].includes(executor.kind) && mcpToolResults.some((result4) => readString(result4.status) === "approval_required");
+    const approvalRequiredSession = mcpToolResults.some(
+      (result4) => readString(result4.status) === "approval_required"
+    );
+    const piTerminalSessionCandidate = executor.kind === "pi" && parsed.hasAssistantOutput === true && ["agent_end", "turn_end"].includes(readString(parsed.terminalEventType) ?? "");
+    const shouldPreserveNativeSession = managedMcpProfile && parsed.sessionId && (execution.exitCode === 0 || execution.completionOutputType === "approval_required" || piTerminalSessionCandidate) && !execution.timedOut && execution.cancelled !== true && !execution.spawnError && ["codex", "pi"].includes(executor.kind) && (execution.exitCode === 0 || approvalRequiredSession || piTerminalSessionCandidate);
     if (shouldPreserveNativeSession) {
       try {
         const preserveSessionRollout = executor.kind === "pi" ? preserveManagedPiSessionRollout : preserveManagedCodexSessionRollout;
@@ -33965,7 +34082,7 @@ async function executeRunCommand(config, command) {
           sessionId: parsed.sessionId,
           sourceWorkspacePath: workspace.sourceWorkspacePath
         });
-        const checkpoint = await saveIssueCheckpoint(
+        const checkpoint = approvalRequiredSession ? await saveIssueCheckpoint(
           config,
           command,
           workspace,
@@ -33973,23 +34090,30 @@ async function executeRunCommand(config, command) {
             rawPath: artifact.relativePath,
             filePath: resolve13(cwd, artifact.relativePath)
           }))
-        );
+        ) : null;
         nativeSessionRollout = {
           status: preservedRollout.status,
           sessionId: preservedRollout.sessionId,
           ...checkpoint ? { checkpoint: { fileCount: checkpoint.files.length, totalBytes: checkpoint.totalBytes } } : {}
         };
-        await ingestLog(config, command, "system", "info", `Preserved ${executor.kind} session rollout for an approved action continuation`, {
+        await ingestLog(config, command, "system", "info", `Preserved ${executor.kind} session rollout for a governed continuation`, {
           presentationKind: "managed_mcp_session_rollout",
           status: nativeSessionRollout.status,
           sessionId: parsed.sessionId
         });
       } catch (err) {
-        nativeSessionRolloutError = `${executor.kind}_managed_mcp_session_rollout_failed: ${err instanceof Error ? err.message : String(err)}`;
-        await ingestLog(config, command, "system", "error", nativeSessionRolloutError, {
+        const rolloutError = `${executor.kind}_managed_mcp_session_rollout_failed: ${err instanceof Error ? err.message : String(err)}`;
+        if (approvalRequiredSession) {
+          nativeSessionRolloutError = rolloutError;
+        } else {
+          nativeSessionRollout = {
+            status: "unavailable",
+            skippedReason: "native_session_rollout_unavailable"
+          };
+        }
+        await ingestLog(config, command, "system", approvalRequiredSession ? "error" : "warn", approvalRequiredSession ? rolloutError : `Could not preserve the optional ${executor.kind} task-session rollout`, {
           presentationKind: "managed_mcp_session_rollout",
-          status: "failed",
-          sessionId: parsed.sessionId
+          status: approvalRequiredSession ? "failed" : "unavailable"
         });
       }
     }
@@ -33997,20 +34121,29 @@ async function executeRunCommand(config, command) {
     if (approvedContinuationSucceeded) {
       await clearIssueCheckpoint(config, command, workspace, "approved_action_succeeded");
     }
-    if (managedMcpProfile && executor.kind === "codex" && approvedContinuationSucceeded) {
+    const taskSessionContinuationSucceeded = nativeSessionRequest.mode === "task_session" && asRecord(invocation.nativeSession).used === true && shouldPreserveNativeSession && nativeSessionRollout?.status === "preserved";
+    if (managedMcpProfile && (approvedContinuationSucceeded || taskSessionContinuationSucceeded)) {
       try {
-        nativeSessionRolloutCleanup = cleanupRestoredManagedCodexSessionRollout(managedMcpProfile);
-        await ingestLog(config, command, "system", "info", "Removed the consumed Codex session rollout", {
+        const cleanupRestoredSessionRollout = executor.kind === "pi" ? cleanupRestoredManagedPiSessionRollout : cleanupRestoredManagedCodexSessionRollout;
+        nativeSessionRolloutCleanup = cleanupRestoredSessionRollout(managedMcpProfile);
+        await ingestLog(config, command, "system", "info", `Removed the consumed ${executor.kind} session rollout`, {
           presentationKind: "managed_mcp_session_rollout_cleanup",
           status: nativeSessionRolloutCleanup.status,
           sessionId: readString(nativeSessionRequest.sessionId)
         });
       } catch (err) {
-        nativeSessionRolloutCleanupError = `codex_managed_mcp_session_rollout_cleanup_failed: ${err instanceof Error ? err.message : String(err)}`;
-        await ingestLog(config, command, "system", "error", nativeSessionRolloutCleanupError, {
+        const cleanupError = `${executor.kind}_managed_mcp_session_rollout_cleanup_failed: ${err instanceof Error ? err.message : String(err)}`;
+        if (approvedContinuationSucceeded) {
+          nativeSessionRolloutCleanupError = cleanupError;
+        } else {
+          nativeSessionRolloutCleanup = {
+            status: "failed",
+            skippedReason: "native_session_rollout_cleanup_failed"
+          };
+        }
+        await ingestLog(config, command, "system", approvedContinuationSucceeded ? "error" : "warn", approvedContinuationSucceeded ? cleanupError : `Could not clean the consumed optional ${executor.kind} task-session rollout`, {
           presentationKind: "managed_mcp_session_rollout_cleanup",
-          status: "failed",
-          sessionId: readString(nativeSessionRequest.sessionId)
+          status: "failed"
         });
       }
     }

package/dist/amaster-runtime.mjs

@@ -6,7 +6,7 @@ import { basename, dirname, join, resolve } from "node:path";
 import { homedir, hostname } from "node:os";
 import { fileURLToPath } from "node:url";
 
-const CONNECTOR_VERSION = "0.1.1-beta.121";
+const CONNECTOR_VERSION = "0.1.1-beta.123";
 
 const CAPABILITIES = [
   "remote_registration",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amaster.ai/employee-runtime-connector",
-  "version": "0.1.1-beta.121",
+  "version": "0.1.1-beta.123",
   "description": "MirrorX runtime connector CLI and daemon",
   "license": "MIT",
   "type": "module",