@amaster.ai/employee-runtime-connector 0.1.1-beta.122 → 0.1.1-beta.124

package/README.md

@@ -37,7 +37,7 @@ Runtime code belongs in the container image. Persist only connector state, the r
 
 The Server requires `final_model_context_attestation_v1` for governed Pi runs because that path disables ambient context discovery and injects a run-owned compiled instruction bundle. This is a Pi delivery contract, not a connector-wide requirement: an explicitly selected self-hosted Codex runtime continues through its own Runtime Actions V2 and native-session contracts and cannot borrow the Pi attestation claim. Adding the same final-context guarantee to another executor requires executor-specific proof for scoped project-instruction semantics, the normalized final active tool schemas, the selected model's context/output limits, automatically visible skill metadata, resumed-session history, and the enforced output reserve.
 
-For admitted Pi runs, the daemon compiles source-repository `AGENTS.md` and `AGENTS.override.md` topology into one root `AGENTS.md` with explicit relative scopes, same-scope override semantics, and a higher-authority MirrorX platform block. Governed Pi disables ambient extension, skill, and context-file discovery and injects that exact compiled file through a run-owned final-system-prompt extension. A last-ordered `before_provider_request` hook then validates every provider call, including later calls after tool results: exactly one system message contains the compiled instructions, visible role-skill metadata and the normalized active tool set match their prior attestations, the provider model/output ceiling match the run contract, and the complete serialized payload plus output reserve fits the context window. Each call appends metadata-only hashes and sizes to a bounded chained receipt; a missing, broken, or oversized chain fails the run.
+For admitted Pi runs, the daemon compiles source-repository `AGENTS.md` and `AGENTS.override.md` topology into one root `AGENTS.md` with explicit relative scopes, same-scope override semantics, and a higher-authority MirrorX platform block. Governed Pi disables ambient extension, skill, and context-file discovery and injects that exact compiled file through a run-owned final-system-prompt extension. When the operator-owned Pi settings declare `@amaster.ai/pi-telemetry`, the daemon resolves only that package-owned entry, requires the runtime npm manifest to pin its exact installed version, verifies its name, path, and tree digest, passes it as an explicit extension, and preserves the authoritative runtime run id for trace correlation; every other ambient package extension remains disabled. A last-ordered `before_provider_request` hook then validates every provider call, including later calls after tool results: exactly one system message contains the compiled instructions, visible role-skill metadata and the normalized active tool set match their prior attestations, the provider model/output ceiling match the run contract, and the complete serialized payload plus output reserve fits the context window. Each call appends metadata-only hashes and sizes to a bounded chained receipt; a missing, broken, or oversized chain fails the run.
 
 Pi 0.80.10's internal compaction summarizer calls the provider outside `before_provider_request`. The Enabled profile therefore records and cancels every `session_before_compact` attempt and fails immediately if `session_compact` is nevertheless observed. No model-generated compaction summary is accepted until that provider path has equivalent final-context attestation. The Server also enumerates Pi and Codex as the only supported governed executors at configuration and heartbeat dispatch boundaries; missing or unknown executor kinds fail closed.
 

package/dist/amaster-runtime-daemon.mjs

@@ -5116,10 +5116,13 @@ var amasterRuntimeConnectorCompletionCheckResponseSchema = external_exports.unio
   amasterRuntimeConnectorCompletionCheckV1ResponseSchema,
   amasterRuntimeConnectorCompletionCheckV2ResponseSchema
 ]);
+var amasterRuntimeConnectorCommandResultSchema = external_exports.object({
+  sessionId: external_exports.string().max(2048).optional()
+}).catchall(external_exports.unknown());
 var amasterRuntimeConnectorCompleteCommandSchema = external_exports.object({
   leaseId: external_exports.string().trim().min(1).optional(),
   status: external_exports.enum(["succeeded", "failed", "cancelled"]),
-  result: external_exports.record(external_exports.unknown()).optional(),
+  result: amasterRuntimeConnectorCommandResultSchema.optional(),
   error: external_exports.string().trim().max(4e3).optional()
 });
 var amasterRuntimeConnectorLogIngestSchema = external_exports.object({
@@ -16791,12 +16794,16 @@ function findSessionRollout(sessionsRoot, sessionId) {
 }
 function restoreManagedCodexSessionRollout(input, codexHome, runDir, executorHome, authority) {
   const session = record3(input.nativeSession);
-  if (session.mode !== "governed_action_approval" || session.required !== true) return null;
+  const governedApprovalContinuation = session.mode === "governed_action_approval" && session.required === true;
+  const governedTaskSessionContinuation = session.mode === "task_session" && session.required === false;
+  if (!governedApprovalContinuation && !governedTaskSessionContinuation) return null;
   const sessionId = nonEmpty(session.sessionId, "nativeSession.sessionId");
   const sourceRunId = nonEmpty(session.sourceRunId, "nativeSession.sourceRunId");
   const sourceCommandId = nonEmpty(session.sourceCommandId, "nativeSession.sourceCommandId");
-  nonEmpty(session.actionRequestId, "nativeSession.actionRequestId");
-  nonEmpty(session.invocationId, "nativeSession.invocationId");
+  if (governedApprovalContinuation) {
+    nonEmpty(session.actionRequestId, "nativeSession.actionRequestId");
+    nonEmpty(session.invocationId, "nativeSession.invocationId");
+  }
   const sourceWorkspacePath = nonEmpty(session.cwd, "nativeSession.cwd");
   const issueRoot = dirname(runDir);
   const managedSourceRunDirName = `${sourceRunId}-${createHash("sha256").update(sourceRunId).digest("hex").slice(0, 8)}`;
@@ -16812,7 +16819,7 @@ function restoreManagedCodexSessionRollout(input, codexHome, runDir, executorHom
   }
   const marker = JSON.parse(readFileSync(markerPath, "utf8"));
   if (marker?.version !== 1 || marker?.companyId !== authority.companyId || marker?.agentId !== authority.agentId || marker?.issueId !== authority.issueId || marker?.sourceRunId !== sourceRunId || marker?.sourceCommandId !== sourceCommandId || marker?.sessionId !== sessionId || marker?.sourceWorkspacePath !== sourceWorkspacePath) {
-    throw new Error("codex_managed_mcp_session_rollout_authority_mismatch: source rollout does not match the approved continuation");
+    throw new Error("codex_managed_mcp_session_rollout_authority_mismatch: source rollout does not match the governed continuation");
   }
   const sourceRollout = resolve2(cacheRoot, nonEmpty(marker.rolloutRelativePath, "rolloutRelativePath"));
   if (!within(sourceRollout, cacheRoot) || lstatSync2(sourceRollout).isSymbolicLink() || !lstatSync2(sourceRollout).isFile()) {
@@ -16827,6 +16834,28 @@ function restoreManagedCodexSessionRollout(input, codexHome, runDir, executorHom
   writePrivateFile(targetRollout, readFileSync(sourceRollout));
   return { sessionId, sourceRunId, sourceCommandId, rolloutPath: targetRollout, cacheRoot };
 }
+function resolveManagedCodexSessionRollout(input, codexHome, runDir, executorHome, authority) {
+  try {
+    return {
+      restoredNativeSession: restoreManagedCodexSessionRollout(
+        input,
+        codexHome,
+        runDir,
+        executorHome,
+        authority
+      ),
+      nativeSessionRestoreSkippedReason: null
+    };
+  } catch (error) {
+    if (record3(input.nativeSession).mode === "task_session" && error instanceof Error && error.message.startsWith("codex_managed_mcp_session_rollout_missing:")) {
+      return {
+        restoredNativeSession: null,
+        nativeSessionRestoreSkippedReason: "native_session_rollout_missing"
+      };
+    }
+    throw error;
+  }
+}
 function isSensitiveAuthKey(key) {
   const normalized = String(key).trim().toLowerCase().replaceAll("-", "_");
   return /^(?:(?:access|refresh|id)_)?token$/.test(normalized) || normalized.includes("api_key") || normalized.includes("secret") || normalized.includes("password") || normalized.includes("credential") || normalized.includes("authorization") || normalized.includes("cookie");
@@ -17144,7 +17173,10 @@ function prepareManagedCodexMcpProfile(input) {
       runId,
       commandId: input.commandId
     });
-    const restoredNativeSession = restoreManagedCodexSessionRollout(input, codexHome, runDir, executorHome, authority);
+    const {
+      restoredNativeSession,
+      nativeSessionRestoreSkippedReason
+    } = resolveManagedCodexSessionRollout(input, codexHome, runDir, executorHome, authority);
     const auth = seedCodexAuth(input, codexHome);
     const configPath = join2(codexHome, "config.toml");
     const allHeaders = { Authorization: `Bearer ${sessionToken}`, ...headers };
@@ -17199,6 +17231,7 @@ function prepareManagedCodexMcpProfile(input) {
       owner,
       authority,
       restoredNativeSession,
+      nativeSessionRestoreSkippedReason,
       protectedValues: [.../* @__PURE__ */ new Set([sessionToken, ...auth.protectedValues])],
       attestation: {
         ...attestationFacts,
@@ -18837,6 +18870,8 @@ var MANAGED_PI_DIRECT_TYPED_MCP_TOOL_MODE = "direct_typed";
 var MANAGED_PI_MCP_ARGS_NORMALIZATION = "json_string_control_characters_v1";
 var MANAGED_PI_MCP_ARGS_NORMALIZER_FILENAME = "amaster-mcp-args-normalizer.js";
 var MANAGED_PI_CONFIG_MODE_SHARED = "shared_agent_dir_workspace_mcp_file";
+var MANAGED_PI_TELEMETRY_PACKAGE = "@amaster.ai/pi-telemetry";
+var MANAGED_PI_TELEMETRY_PACKAGE_SOURCE = "npm:@amaster.ai/pi-telemetry";
 function applyManagedPiToolAllowlist(args, profile) {
   const toolAllowlist = Array.isArray(profile?.toolAllowlist) ? profile.toolAllowlist.filter((name) => typeof name === "string" && name) : [];
   if (toolAllowlist.length === 0) return [...args];
@@ -18998,6 +19033,10 @@ function createManagedPiMcpProfileApi(options = {}) {
     "PAPERCLIP_AGENT_ID",
     "PAPERCLIP_COMPANY_ID",
     "AMASTER_EMPLOYEE_COMPANY_ID",
+    // Runtime telemetry is a governed audit channel. The daemon assigns this
+    // correlation id from the authoritative run and the managed profile must
+    // preserve it when rebuilding the child environment.
+    "PI_TELEMETRY_TASK_RUN_ID",
     // The agent dir is operator-owned configuration: governed runs inherit the
     // daemon's single value verbatim. commandEnv cannot inject it
     // (FORBIDDEN_COMMAND_ENV).
@@ -19102,12 +19141,16 @@ function createManagedPiMcpProfileApi(options = {}) {
   }
   function restoreManagedPiSessionRollout(input, sessionsRoot, runDir, executorHome, authority) {
     const session = record8(input.nativeSession);
-    if (session.mode !== "governed_action_approval" || session.required !== true) return null;
+    const governedApprovalContinuation = session.mode === "governed_action_approval" && session.required === true;
+    const governedTaskSessionContinuation = session.mode === "task_session" && session.required === false;
+    if (!governedApprovalContinuation && !governedTaskSessionContinuation) return null;
     const sessionId = nonEmpty2(session.sessionId, "nativeSession.sessionId");
     const sourceRunId = nonEmpty2(session.sourceRunId, "nativeSession.sourceRunId");
     const sourceCommandId = nonEmpty2(session.sourceCommandId, "nativeSession.sourceCommandId");
-    nonEmpty2(session.actionRequestId, "nativeSession.actionRequestId");
-    nonEmpty2(session.invocationId, "nativeSession.invocationId");
+    if (governedApprovalContinuation) {
+      nonEmpty2(session.actionRequestId, "nativeSession.actionRequestId");
+      nonEmpty2(session.invocationId, "nativeSession.invocationId");
+    }
     const sourceWorkspacePath = nonEmpty2(session.cwd, "nativeSession.cwd");
     const issueRoot = dirname4(runDir);
     const managedSourceRunDirName = `${sourceRunId}-${createHash5("sha256").update(sourceRunId).digest("hex").slice(0, 8)}`;
@@ -19122,7 +19165,7 @@ function createManagedPiMcpProfileApi(options = {}) {
     }
     const marker = JSON.parse(readFileSync5(markerPath, "utf8"));
     if (marker?.version !== 1 || marker?.companyId !== authority.companyId || marker?.agentId !== authority.agentId || marker?.issueId !== authority.issueId || marker?.sourceRunId !== sourceRunId || marker?.sourceCommandId !== sourceCommandId || marker?.sessionId !== sessionId || marker?.sourceWorkspacePath !== sourceWorkspacePath) {
-      throw new Error("pi_managed_mcp_session_rollout_authority_mismatch: source rollout does not match the approved continuation");
+      throw new Error("pi_managed_mcp_session_rollout_authority_mismatch: source rollout does not match the governed continuation");
     }
     const sourceRollout = resolve3(cacheRoot, nonEmpty2(marker.rolloutRelativePath, "rolloutRelativePath"));
     if (!within2(sourceRollout, cacheRoot) || lstatSync3(sourceRollout).isSymbolicLink() || !lstatSync3(sourceRollout).isFile()) {
@@ -19136,6 +19179,28 @@ function createManagedPiMcpProfileApi(options = {}) {
     writePrivateFile2(targetRollout, readFileSync5(sourceRollout));
     return { sessionId, sourceRunId, sourceCommandId, rolloutPath: targetRollout, cacheRoot };
   }
+  function resolveManagedPiSessionRollout(input, sessionsRoot, runDir, executorHome, authority) {
+    try {
+      return {
+        restoredNativeSession: restoreManagedPiSessionRollout(
+          input,
+          sessionsRoot,
+          runDir,
+          executorHome,
+          authority
+        ),
+        nativeSessionRestoreSkippedReason: null
+      };
+    } catch (error) {
+      if (record8(input.nativeSession).mode === "task_session" && error instanceof Error && error.message.startsWith("pi_managed_mcp_session_rollout_missing:")) {
+        return {
+          restoredNativeSession: null,
+          nativeSessionRestoreSkippedReason: "native_session_rollout_missing"
+        };
+      }
+      throw error;
+    }
+  }
   function parseVersion(stdout, label, minimum) {
     const pattern = label === "Pi" ? /^\s*(?:pi(?: coding agent)?\s+)?(\d+)\.(\d+)\.(\d+)(?:\s|$)/im : /^\s*(\d+)\.(\d+)\.(\d+)(?:\s|$)/;
     const match = String(stdout).match(pattern);
@@ -19382,6 +19447,98 @@ function createManagedPiMcpProfileApi(options = {}) {
     }
     return version;
   }
+  function managedPiTelemetryExtension(sharedRuntime) {
+    const settings = record8(sharedRuntime.settings);
+    const packages = Array.isArray(settings.packages) ? settings.packages : [];
+    const configuredSources = packages.filter((source) => typeof source === "string" && (source === MANAGED_PI_TELEMETRY_PACKAGE_SOURCE || source.startsWith(`${MANAGED_PI_TELEMETRY_PACKAGE_SOURCE}@`)));
+    if (configuredSources.length === 0) return null;
+    if (configuredSources.length !== 1) {
+      throw new Error("pi_managed_mcp_telemetry_package_source_invalid");
+    }
+    const configuredSource = configuredSources[0];
+    const settingsVersion = configuredSource.startsWith(`${MANAGED_PI_TELEMETRY_PACKAGE_SOURCE}@`) ? configuredSource.slice(MANAGED_PI_TELEMETRY_PACKAGE_SOURCE.length + 1) : null;
+    if (settingsVersion !== null && !/^\d+\.\d+\.\d+(?:[-+].+)?$/.test(settingsVersion)) {
+      throw new Error("pi_managed_mcp_telemetry_package_source_unpinned");
+    }
+    const runtimeManifestPath = join5(sharedRuntime.home, "npm", "package.json");
+    let runtimeManifest;
+    try {
+      const runtimeManifestStat = lstatSync3(runtimeManifestPath);
+      if (!runtimeManifestStat.isFile() || runtimeManifestStat.isSymbolicLink()) {
+        throw new Error("unsafe runtime package manifest");
+      }
+      runtimeManifest = record8(JSON.parse(readFileSync5(runtimeManifestPath, "utf8")));
+    } catch {
+      throw new Error("pi_managed_mcp_telemetry_runtime_manifest_unavailable");
+    }
+    const pinnedVersion = typeof record8(runtimeManifest.dependencies)[MANAGED_PI_TELEMETRY_PACKAGE] === "string" ? record8(runtimeManifest.dependencies)[MANAGED_PI_TELEMETRY_PACKAGE].trim() : "";
+    if (!/^\d+\.\d+\.\d+(?:[-+].+)?$/.test(pinnedVersion)) {
+      throw new Error("pi_managed_mcp_telemetry_runtime_manifest_unpinned");
+    }
+    if (settingsVersion !== null && settingsVersion !== pinnedVersion) {
+      throw new Error("pi_managed_mcp_telemetry_package_source_version_mismatch");
+    }
+    const packageRoot = resolve3(
+      sharedRuntime.home,
+      "npm",
+      "node_modules",
+      "@amaster.ai",
+      "pi-telemetry"
+    );
+    const packageJsonPath = join5(packageRoot, "package.json");
+    let packageJson;
+    try {
+      const packageStat = lstatSync3(packageRoot);
+      if (!packageStat.isDirectory() || packageStat.isSymbolicLink()) throw new Error("unsafe package root");
+      const packageJsonStat = lstatSync3(packageJsonPath);
+      if (!packageJsonStat.isFile() || packageJsonStat.isSymbolicLink()) throw new Error("unsafe package manifest");
+      packageJson = record8(JSON.parse(readFileSync5(packageJsonPath, "utf8")));
+    } catch {
+      throw new Error("pi_managed_mcp_telemetry_package_unavailable");
+    }
+    if (packageJson.name !== MANAGED_PI_TELEMETRY_PACKAGE) {
+      throw new Error("pi_managed_mcp_telemetry_package_invalid");
+    }
+    const version = typeof packageJson.version === "string" ? packageJson.version.trim() : "";
+    if (!/^\d+\.\d+\.\d+(?:[-+].+)?$/.test(version)) {
+      throw new Error("pi_managed_mcp_telemetry_package_version_invalid");
+    }
+    if (version !== pinnedVersion) {
+      throw new Error("pi_managed_mcp_telemetry_package_version_mismatch");
+    }
+    const declaredExtensions = Array.isArray(record8(packageJson.pi).extensions) ? record8(packageJson.pi).extensions : [];
+    if (declaredExtensions.length !== 1 || typeof declaredExtensions[0] !== "string") {
+      throw new Error("pi_managed_mcp_telemetry_extension_invalid");
+    }
+    const extensionPath = resolve3(packageRoot, declaredExtensions[0]);
+    if (!within2(extensionPath, packageRoot)) {
+      throw new Error("pi_managed_mcp_telemetry_extension_unsafe");
+    }
+    try {
+      const extensionStat = lstatSync3(extensionPath);
+      if (!extensionStat.isFile() || extensionStat.isSymbolicLink()) throw new Error("unsafe extension entry");
+      const realPackageRoot = realpathSync3(packageRoot);
+      const realExtensionPath = realpathSync3(extensionPath);
+      if (!within2(realExtensionPath, realPackageRoot)) throw new Error("extension escaped package root");
+    } catch {
+      throw new Error("pi_managed_mcp_telemetry_extension_unsafe");
+    }
+    let packageTreeSha256;
+    try {
+      packageTreeSha256 = trustedTreeDigest(packageRoot, { ignoredRootEntries: ["node_modules"] });
+    } catch {
+      throw new Error("pi_managed_mcp_telemetry_package_unsafe");
+    }
+    return {
+      packageName: MANAGED_PI_TELEMETRY_PACKAGE,
+      packageVersion: version,
+      packageVersionSource: "runtime_npm_manifest",
+      extensionPath,
+      extensionSha256: sha2563(readFileSync5(extensionPath)),
+      packageTreeSha256,
+      langfuseEnabled: record8(record8(settings["pi-telemetry"]).langfuse).enabled === true
+    };
+  }
   function adapterServerConfigHash(definition, adapterVersion) {
     const identity2 = piMcpAdapterServerConfigIdentity(definition, adapterVersion);
     return sha2563(stablePiJson(identity2));
@@ -19750,7 +19907,7 @@ function createManagedPiMcpProfileApi(options = {}) {
     for (const [name, value] of Object.entries(settingsEnv)) {
       if (isSensitiveAuthKey2(name)) protectedValues.push(value);
     }
-    return { home, settingsEnv, protectedValues };
+    return { home, settings, settingsEnv, protectedValues };
   }
   const SKILL_PROFILE_NAME = /^[a-z0-9-]+$/;
   function readSkillProfile(piHome, skillProfile) {
@@ -20009,6 +20166,11 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
           "--no-approve",
           "--no-skills",
           "--no-context-files",
+          "--no-builtin-tools",
+          // The probe attests only the governed adapter and run-owned attestor.
+          // Ambient Pi extensions may fail independently and must not change this
+          // measured tool surface; explicitly supplied extensions still load.
+          "--no-extensions",
           // The enforcement extensions live in the run profile, not an agent dir,
           // so the probe must load them explicitly to measure the real run surface.
           ...Array.isArray(input.extensionArgs) ? input.extensionArgs : [],
@@ -20166,7 +20328,10 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         commandId: input.commandId
       });
       const sharedRuntime = sharedPiHomeSettingsEnv(input.baseEnv);
-      const restoredNativeSession = restoreManagedPiSessionRollout(input, sessionsRoot, runDir, executorHome, authority);
+      const {
+        restoredNativeSession,
+        nativeSessionRestoreSkippedReason
+      } = resolveManagedPiSessionRollout(input, sessionsRoot, runDir, executorHome, authority);
       const directToolNames = directCatalog?.tools.map((tool) => tool.exposedName) ?? [];
       const serverConfig = {
         type: "http",
@@ -20364,6 +20529,10 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
           ...sourceAttestationProfilePath ? { sourceProfilePath: sourceAttestationProfilePath } : {}
         };
       }
+      const telemetryExtension = managedPiTelemetryExtension(sharedRuntime);
+      if (telemetryExtension) {
+        extensionArgs.push("--extension", telemetryExtension.extensionPath);
+      }
       let enabledRoleSkills = null;
       let enabledRoleSkillMetadataBytes = 0;
       let enabledRoleSkillMetadataSha256 = null;
@@ -20381,6 +20550,9 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
       const env = {
         ...sharedRuntime.settingsEnv,
         ...buildIsolatedEnvironment2(input.baseEnv, input.commandEnv),
+        // The profile owns the final child environment. Never rely on a caller
+        // supplied correlation value when governed telemetry is active.
+        ...telemetryExtension ? { PI_TELEMETRY_TASK_RUN_ID: runId } : {},
         HOME: home,
         PI_AGENT_HOME: piAgentHome,
         PI_CODING_AGENT_SESSION_DIR: sessionsRoot,
@@ -20464,13 +20636,25 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
           enabledRoleSkills,
           enabledRoleSkillMetadataBytes,
           enabledRoleSkillMetadataSha256
-        )
+        ),
+        telemetryExtensionStatus: telemetryExtension ? "attested" : "not_configured",
+        ...telemetryExtension ? {
+          telemetryPackageName: telemetryExtension.packageName,
+          telemetryPackageVersion: telemetryExtension.packageVersion,
+          telemetryPackageVersionSource: telemetryExtension.packageVersionSource,
+          telemetryExtensionPath: telemetryExtension.extensionPath,
+          telemetryExtensionSha256: telemetryExtension.extensionSha256,
+          telemetryPackageTreeSha256: telemetryExtension.packageTreeSha256,
+          telemetryLangfuseEnabled: telemetryExtension.langfuseEnabled,
+          telemetryRunCorrelationStatus: "authoritative"
+        } : {}
       };
       return {
         profileRoot,
         owner,
         authority,
         restoredNativeSession,
+        nativeSessionRestoreSkippedReason,
         configPath,
         markerPath,
         env,
@@ -20836,6 +21020,27 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
 `);
     return { status: "preserved", sessionId, rolloutPath: targetRollout, cacheRoot };
   }
+  function cleanupRestoredManagedPiSessionRollout2(profile) {
+    const restored = profile?.restoredNativeSession;
+    if (!restored?.cacheRoot) return { status: "not_restored" };
+    const cacheRoot = resolve3(restored.cacheRoot);
+    if (!existsSync4(cacheRoot)) return { status: "already_removed" };
+    const cacheStat = lstatSync3(cacheRoot);
+    if (!cacheStat.isDirectory() || cacheStat.isSymbolicLink()) {
+      throw new Error("pi_managed_mcp_session_rollout_cleanup_unsafe: cache root is not a private directory");
+    }
+    const markerPath = join5(cacheRoot, SESSION_ROLLOUT_MARKER2);
+    if (!existsSync4(markerPath) || lstatSync3(markerPath).isSymbolicLink() || !lstatSync3(markerPath).isFile()) {
+      throw new Error("pi_managed_mcp_session_rollout_cleanup_unsafe: ownership marker is unavailable");
+    }
+    const marker = JSON.parse(readFileSync5(markerPath, "utf8"));
+    if (marker?.companyId !== profile.authority.companyId || marker?.agentId !== profile.authority.agentId || marker?.issueId !== profile.authority.issueId || marker?.sourceRunId !== restored.sourceRunId || marker?.sourceCommandId !== restored.sourceCommandId || marker?.sessionId !== restored.sessionId) {
+      throw new Error("pi_managed_mcp_session_rollout_cleanup_unsafe: ownership marker does not match restored authority");
+    }
+    rmSync3(cacheRoot, { recursive: true, force: false });
+    if (existsSync4(cacheRoot)) throw new Error("pi_managed_mcp_session_rollout_cleanup_failed: cache root still exists");
+    return { status: "removed" };
+  }
   function removeWorkspaceMcpConfig(configPath, profileRoot) {
     const target = resolve3(configPath);
     if (!workspaceMcpConfigBelongsToProfile(target, profileRoot)) {
@@ -20987,7 +21192,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
       failures
     };
   }
-  return { prepareManagedPiMcpProfile: prepareManagedPiMcpProfile2, prepareDelegatedPiMcpProfile: prepareDelegatedPiMcpProfile2, inspectManagedPiRunExitClosureAttestation: inspectManagedPiRunExitClosureAttestation2, restoreManagedPiRunExitClosureBaseline: restoreManagedPiRunExitClosureBaseline2, preserveManagedPiSessionRollout: preserveManagedPiSessionRollout2, cleanupManagedPiMcpProfile: cleanupManagedPiMcpProfile2, cleanupDelegatedPiMcpProfile: cleanupDelegatedPiMcpProfile2, reconcileManagedPiMcpProfiles: reconcileManagedPiMcpProfiles2 };
+  return { prepareManagedPiMcpProfile: prepareManagedPiMcpProfile2, prepareDelegatedPiMcpProfile: prepareDelegatedPiMcpProfile2, inspectManagedPiRunExitClosureAttestation: inspectManagedPiRunExitClosureAttestation2, restoreManagedPiRunExitClosureBaseline: restoreManagedPiRunExitClosureBaseline2, preserveManagedPiSessionRollout: preserveManagedPiSessionRollout2, cleanupRestoredManagedPiSessionRollout: cleanupRestoredManagedPiSessionRollout2, cleanupManagedPiMcpProfile: cleanupManagedPiMcpProfile2, cleanupDelegatedPiMcpProfile: cleanupDelegatedPiMcpProfile2, reconcileManagedPiMcpProfiles: reconcileManagedPiMcpProfiles2 };
 }
 var piManagedMcpProfileApi = createManagedPiMcpProfileApi();
 var prepareManagedPiMcpProfile = piManagedMcpProfileApi.prepareManagedPiMcpProfile;
@@ -20995,6 +21200,7 @@ var prepareDelegatedPiMcpProfile = piManagedMcpProfileApi.prepareDelegatedPiMcpP
 var inspectManagedPiRunExitClosureAttestation = piManagedMcpProfileApi.inspectManagedPiRunExitClosureAttestation;
 var restoreManagedPiRunExitClosureBaseline = piManagedMcpProfileApi.restoreManagedPiRunExitClosureBaseline;
 var preserveManagedPiSessionRollout = piManagedMcpProfileApi.preserveManagedPiSessionRollout;
+var cleanupRestoredManagedPiSessionRollout = piManagedMcpProfileApi.cleanupRestoredManagedPiSessionRollout;
 var cleanupManagedPiMcpProfile = piManagedMcpProfileApi.cleanupManagedPiMcpProfile;
 var cleanupDelegatedPiMcpProfile = piManagedMcpProfileApi.cleanupDelegatedPiMcpProfile;
 var reconcileManagedPiMcpProfiles = piManagedMcpProfileApi.reconcileManagedPiMcpProfiles;
@@ -28407,7 +28613,7 @@ function createSourceCompletionStopPolicy({
 }
 
 // src/amaster-runtime-daemon.mjs
-var CONNECTOR_VERSION = "0.1.1-beta.122";
+var CONNECTOR_VERSION = "0.1.1-beta.124";
 var CONNECTOR_CONTRACT_VERSION = "2026-06-04.v1";
 var SOURCE_ACQUISITION_CAPABILITY2 = source_acquisition_compatibility_default.profileVersion;
 var daemonRequire = createRequire(import.meta.url);
@@ -30260,7 +30466,7 @@ function sanitizePiExtraArgs(value) {
   return splitExtraArgs(value).filter((entry) => !AMASTER_PI_PROHIBITED_EXTRA_ARGS.has(entry));
 }
 function nativeSessionResumeEnabled(session) {
-  return process.env.AMASTER_RUNTIME_ENABLE_NATIVE_SESSION_RESUME === "true" || readString(session.mode) === "governed_action_approval" && session.required === true;
+  return process.env.AMASTER_RUNTIME_ENABLE_NATIVE_SESSION_RESUME === "true" || readString(session.mode) === "task_session" || readString(session.mode) === "governed_action_approval" && session.required === true;
 }
 function modelCallResponseContract(payload) {
   if (payload.responseContract === void 0) return null;
@@ -30377,8 +30583,8 @@ function buildExecutorInvocation(executor, command = {}, workspace = null, optio
     const args = ["--mode", "json"];
     const governedRun = Object.keys(asRecord(commandRuntimeAuth(command).governedMcp)).length > 0;
     const nativeSessionRequest = asRecord(asRecord(command.payload).nativeSession);
-    if (governedRun && nativeSession.used && (nativeSessionRequest.mode !== "governed_action_approval" || nativeSessionRequest.required !== true)) {
-      throw new Error("pi_managed_mcp_native_session_resume_blocked: governed Pi runs require exact approval continuation authority");
+    if (governedRun && nativeSession.used && !(nativeSessionRequest.mode === "governed_action_approval" && nativeSessionRequest.required === true || nativeSessionRequest.mode === "task_session" && nativeSessionRequest.required === false)) {
+      throw new Error("pi_managed_mcp_native_session_resume_blocked: governed Pi runs require exact continuation authority");
     }
     const provider = readString(process.env.AMASTER_PI_PROVIDER);
     const model = readString(process.env.AMASTER_PI_MODEL);
@@ -33556,6 +33762,23 @@ async function executeRunCommand(config, command) {
       }
     }
     if (managedMcpProfile) {
+      if (nativeSessionRequest.mode === "task_session" && asRecord(invocation.nativeSession).used === true && !managedMcpProfile.restoredNativeSession) {
+        const freshPayload = { ...asRecord(command.payload) };
+        delete freshPayload.nativeSession;
+        const freshInvocation = buildExecutorInvocation(
+          executor,
+          { ...command, payload: freshPayload },
+          workspace
+        );
+        invocation.args = freshInvocation.args;
+        invocation.stdin = freshInvocation.stdin;
+        invocation.nativeSession = {
+          ...asRecord(invocation.nativeSession),
+          mode: "fresh",
+          used: false,
+          skippedReason: readString(managedMcpProfile.nativeSessionRestoreSkippedReason) ?? "native_session_rollout_missing"
+        };
+      }
       executorEnv = managedMcpProfile.env;
       if (executor.kind === "pi" && managedMcpProfile.spawnIdentity) {
         piExecutorIdentity = managedMcpProfile.spawnIdentity;
@@ -33963,7 +34186,11 @@ async function executeRunCommand(config, command) {
         parsed.hasAssistantOutput = true;
       }
     }
-    const shouldPreserveNativeSession = managedMcpProfile && parsed.sessionId && (execution.exitCode === 0 || execution.completionOutputType === "approval_required") && !execution.timedOut && execution.cancelled !== true && !execution.spawnError && ["codex", "pi"].includes(executor.kind) && mcpToolResults.some((result4) => readString(result4.status) === "approval_required");
+    const approvalRequiredSession = mcpToolResults.some(
+      (result4) => readString(result4.status) === "approval_required"
+    );
+    const piTerminalSessionCandidate = executor.kind === "pi" && parsed.hasAssistantOutput === true && ["agent_end", "turn_end"].includes(readString(parsed.terminalEventType) ?? "");
+    const shouldPreserveNativeSession = managedMcpProfile && parsed.sessionId && (execution.exitCode === 0 || execution.completionOutputType === "approval_required" || piTerminalSessionCandidate) && !execution.timedOut && execution.cancelled !== true && !execution.spawnError && ["codex", "pi"].includes(executor.kind) && (execution.exitCode === 0 || approvalRequiredSession || piTerminalSessionCandidate);
     if (shouldPreserveNativeSession) {
       try {
         const preserveSessionRollout = executor.kind === "pi" ? preserveManagedPiSessionRollout : preserveManagedCodexSessionRollout;
@@ -33971,7 +34198,7 @@ async function executeRunCommand(config, command) {
           sessionId: parsed.sessionId,
           sourceWorkspacePath: workspace.sourceWorkspacePath
         });
-        const checkpoint = await saveIssueCheckpoint(
+        const checkpoint = approvalRequiredSession ? await saveIssueCheckpoint(
           config,
           command,
           workspace,
@@ -33979,23 +34206,30 @@ async function executeRunCommand(config, command) {
             rawPath: artifact.relativePath,
             filePath: resolve13(cwd, artifact.relativePath)
           }))
-        );
+        ) : null;
         nativeSessionRollout = {
           status: preservedRollout.status,
           sessionId: preservedRollout.sessionId,
           ...checkpoint ? { checkpoint: { fileCount: checkpoint.files.length, totalBytes: checkpoint.totalBytes } } : {}
         };
-        await ingestLog(config, command, "system", "info", `Preserved ${executor.kind} session rollout for an approved action continuation`, {
+        await ingestLog(config, command, "system", "info", `Preserved ${executor.kind} session rollout for a governed continuation`, {
           presentationKind: "managed_mcp_session_rollout",
           status: nativeSessionRollout.status,
           sessionId: parsed.sessionId
         });
       } catch (err) {
-        nativeSessionRolloutError = `${executor.kind}_managed_mcp_session_rollout_failed: ${err instanceof Error ? err.message : String(err)}`;
-        await ingestLog(config, command, "system", "error", nativeSessionRolloutError, {
+        const rolloutError = `${executor.kind}_managed_mcp_session_rollout_failed: ${err instanceof Error ? err.message : String(err)}`;
+        if (approvalRequiredSession) {
+          nativeSessionRolloutError = rolloutError;
+        } else {
+          nativeSessionRollout = {
+            status: "unavailable",
+            skippedReason: "native_session_rollout_unavailable"
+          };
+        }
+        await ingestLog(config, command, "system", approvalRequiredSession ? "error" : "warn", approvalRequiredSession ? rolloutError : `Could not preserve the optional ${executor.kind} task-session rollout`, {
           presentationKind: "managed_mcp_session_rollout",
-          status: "failed",
-          sessionId: parsed.sessionId
+          status: approvalRequiredSession ? "failed" : "unavailable"
         });
       }
     }
@@ -34003,20 +34237,29 @@ async function executeRunCommand(config, command) {
     if (approvedContinuationSucceeded) {
       await clearIssueCheckpoint(config, command, workspace, "approved_action_succeeded");
     }
-    if (managedMcpProfile && executor.kind === "codex" && approvedContinuationSucceeded) {
+    const taskSessionContinuationSucceeded = nativeSessionRequest.mode === "task_session" && asRecord(invocation.nativeSession).used === true && shouldPreserveNativeSession && nativeSessionRollout?.status === "preserved";
+    if (managedMcpProfile && (approvedContinuationSucceeded || taskSessionContinuationSucceeded)) {
       try {
-        nativeSessionRolloutCleanup = cleanupRestoredManagedCodexSessionRollout(managedMcpProfile);
-        await ingestLog(config, command, "system", "info", "Removed the consumed Codex session rollout", {
+        const cleanupRestoredSessionRollout = executor.kind === "pi" ? cleanupRestoredManagedPiSessionRollout : cleanupRestoredManagedCodexSessionRollout;
+        nativeSessionRolloutCleanup = cleanupRestoredSessionRollout(managedMcpProfile);
+        await ingestLog(config, command, "system", "info", `Removed the consumed ${executor.kind} session rollout`, {
           presentationKind: "managed_mcp_session_rollout_cleanup",
           status: nativeSessionRolloutCleanup.status,
           sessionId: readString(nativeSessionRequest.sessionId)
         });
       } catch (err) {
-        nativeSessionRolloutCleanupError = `codex_managed_mcp_session_rollout_cleanup_failed: ${err instanceof Error ? err.message : String(err)}`;
-        await ingestLog(config, command, "system", "error", nativeSessionRolloutCleanupError, {
+        const cleanupError = `${executor.kind}_managed_mcp_session_rollout_cleanup_failed: ${err instanceof Error ? err.message : String(err)}`;
+        if (approvedContinuationSucceeded) {
+          nativeSessionRolloutCleanupError = cleanupError;
+        } else {
+          nativeSessionRolloutCleanup = {
+            status: "failed",
+            skippedReason: "native_session_rollout_cleanup_failed"
+          };
+        }
+        await ingestLog(config, command, "system", approvedContinuationSucceeded ? "error" : "warn", approvedContinuationSucceeded ? cleanupError : `Could not clean the consumed optional ${executor.kind} task-session rollout`, {
           presentationKind: "managed_mcp_session_rollout_cleanup",
-          status: "failed",
-          sessionId: readString(nativeSessionRequest.sessionId)
+          status: "failed"
         });
       }
     }

package/dist/amaster-runtime.mjs

@@ -6,7 +6,7 @@ import { basename, dirname, join, resolve } from "node:path";
 import { homedir, hostname } from "node:os";
 import { fileURLToPath } from "node:url";
 
-const CONNECTOR_VERSION = "0.1.1-beta.122";
+const CONNECTOR_VERSION = "0.1.1-beta.124";
 
 const CAPABILITIES = [
   "remote_registration",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amaster.ai/employee-runtime-connector",
-  "version": "0.1.1-beta.122",
+  "version": "0.1.1-beta.124",
   "description": "MirrorX runtime connector CLI and daemon",
   "license": "MIT",
   "type": "module",