@amaster.ai/employee-runtime-connector 0.1.1-beta.124 → 0.1.1-beta.125

package/dist/amaster-runtime-daemon.mjs

@@ -15332,9 +15332,9 @@ var completeCompanyCreationReviewSchema = external_exports.object({
 }).strict();
 
 // src/amaster-runtime-daemon.mjs
-import { chmodSync as chmodSync7, copyFileSync as copyFileSync2, existsSync as existsSync15, lstatSync as lstatSync9, mkdirSync as mkdirSync10, mkdtempSync as mkdtempSync2, readFileSync as readFileSync17, readdirSync as readdirSync11, realpathSync as realpathSync6, renameSync as renameSync9, rmSync as rmSync9, statSync as statSync9, symlinkSync as symlinkSync2, unlinkSync as unlinkSync3, writeFileSync as writeFileSync11 } from "node:fs";
+import { chmodSync as chmodSync7, copyFileSync as copyFileSync2, existsSync as existsSync15, lstatSync as lstatSync9, mkdirSync as mkdirSync10, mkdtempSync as mkdtempSync2, readFileSync as readFileSync17, readdirSync as readdirSync11, realpathSync as realpathSync7, renameSync as renameSync9, rmSync as rmSync9, statSync as statSync9, symlinkSync as symlinkSync2, unlinkSync as unlinkSync3, writeFileSync as writeFileSync11 } from "node:fs";
 import { arch as arch3, homedir as homedir3, hostname as hostname2, platform as platform3, tmpdir } from "node:os";
-import { basename as basename6, delimiter as delimiter3, dirname as dirname11, extname as extname3, isAbsolute as isAbsolute9, join as join15, relative as relative8, resolve as resolve13 } from "node:path";
+import { basename as basename6, delimiter as delimiter3, dirname as dirname11, extname as extname3, isAbsolute as isAbsolute9, join as join16, relative as relative8, resolve as resolve13 } from "node:path";
 import { spawn, spawnSync as spawnSync5 } from "node:child_process";
 
 // src/amaster-runtime-daemon/common.mjs
@@ -23628,8 +23628,105 @@ ${resolvedDependencies.details.content}` : ""
 
 // src/amaster-runtime-daemon/agent-instruction-delivery.mjs
 import { createHash as createHash8, randomBytes as randomBytes2 } from "node:crypto";
-import { existsSync as existsSync6, lstatSync as lstatSync4, mkdirSync as mkdirSync5, readFileSync as readFileSync8, readdirSync as readdirSync6, renameSync as renameSync5, rmSync as rmSync4, writeFileSync as writeFileSync6 } from "node:fs";
-import { dirname as dirname5, isAbsolute as isAbsolute4, relative as relative3, resolve as resolve4 } from "node:path";
+import { existsSync as existsSync7, lstatSync as lstatSync4, mkdirSync as mkdirSync5, readFileSync as readFileSync9, readdirSync as readdirSync6, realpathSync as realpathSync4, renameSync as renameSync6, rmSync as rmSync5, writeFileSync as writeFileSync7 } from "node:fs";
+import { dirname as dirname6, isAbsolute as isAbsolute4, join as join8, relative as relative3, resolve as resolve4 } from "node:path";
+
+// src/amaster-runtime-daemon/workspace-manifest.mjs
+import { chownSync as chownSync3, existsSync as existsSync6, readFileSync as readFileSync8, renameSync as renameSync5, rmSync as rmSync4, statSync as statSync3, writeFileSync as writeFileSync6 } from "node:fs";
+import { basename as basename3, dirname as dirname5, join as join7 } from "node:path";
+var WORKSPACE_MANIFEST_FILENAME = ".amaster-runtime.json";
+function syncManifestDirOwnership(manifestPath, deps = {}) {
+  const stat = deps.statSync ?? statSync3;
+  const chown = deps.chownSync ?? chownSync3;
+  const geteuid = deps.geteuid ?? (typeof process.geteuid === "function" ? process.geteuid.bind(process) : () => null);
+  try {
+    if (geteuid() !== 0) return false;
+    const dirStat = stat(dirname5(manifestPath));
+    if (dirStat.uid === 0 && dirStat.gid === 0) return false;
+    chown(manifestPath, dirStat.uid, dirStat.gid);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function nowIso() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+function workspaceManifestPath(workspaceOrCwd) {
+  if (!workspaceOrCwd) return null;
+  if (typeof workspaceOrCwd === "string") return join7(workspaceOrCwd, WORKSPACE_MANIFEST_FILENAME);
+  if (typeof workspaceOrCwd.cwd === "string") return join7(workspaceOrCwd.cwd, WORKSPACE_MANIFEST_FILENAME);
+  return null;
+}
+function readWorkspaceManifest(manifestPath) {
+  if (!manifestPath || !existsSync6(manifestPath)) return null;
+  try {
+    const parsed = JSON.parse(readFileSync8(manifestPath, "utf8"));
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function writeWorkspaceManifest(manifestPath, manifest, deps) {
+  const tempPath = join7(
+    dirname5(manifestPath),
+    `.${basename3(manifestPath)}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`
+  );
+  try {
+    writeFileSync6(tempPath, `${JSON.stringify(manifest, null, 2)}
+`, { mode: 384 });
+    renameSync5(tempPath, manifestPath);
+    syncManifestDirOwnership(manifestPath, deps);
+  } catch (err) {
+    rmSync4(tempPath, { force: true });
+    throw err;
+  }
+  return manifest;
+}
+function createWorkspaceManifest(workspace, input = {}) {
+  const manifestPath = workspaceManifestPath(workspace);
+  const createdAt = nowIso();
+  const manifest = {
+    version: 2,
+    managed: true,
+    sourceWorkspacePath: workspace.sourceWorkspacePath,
+    managedCwd: workspace.cwd,
+    executionWorkdir: workspace.cwd,
+    executorKind: input.executorKind ?? null,
+    executorHome: workspace.executorHome ?? null,
+    commandId: input.commandId ?? null,
+    generation: input.generation ?? null,
+    runId: input.runId ?? null,
+    issueId: input.issueId ?? null,
+    workspaceKey: workspace.workspaceKey ?? null,
+    issueKey: workspace.issueKey ?? null,
+    runKey: workspace.runKey ?? null,
+    createdAt,
+    lastTouchedAt: createdAt,
+    lastWorkspaceScanAt: null,
+    artifactCandidateCount: 0,
+    artifactCandidates: [],
+    outboxPending: 0
+  };
+  return writeWorkspaceManifest(manifestPath, manifest);
+}
+function updateWorkspaceManifest(workspaceOrManifestPath, patch = {}) {
+  const manifestPath = typeof workspaceOrManifestPath === "string" ? workspaceOrManifestPath : workspaceManifestPath(workspaceOrManifestPath);
+  if (!manifestPath) return null;
+  const current = readWorkspaceManifest(manifestPath) ?? {
+    version: 2,
+    managed: true,
+    createdAt: nowIso()
+  };
+  const next = {
+    ...current,
+    ...patch,
+    lastTouchedAt: nowIso()
+  };
+  return writeWorkspaceManifest(manifestPath, next);
+}
+
+// src/amaster-runtime-daemon/agent-instruction-delivery.mjs
 var PROJECT_INSTRUCTION_NAMES = /* @__PURE__ */ new Set(["AGENTS.md", "AGENTS.override.md"]);
 var PROJECT_INSTRUCTION_SCAN_IGNORED_DIRECTORIES = /* @__PURE__ */ new Set([
   ".git",
@@ -23645,13 +23742,55 @@ var PROJECT_INSTRUCTION_SCAN_MAX_DIRECTORIES = 5e4;
 function instructionTopologyError(code, message, details = {}) {
   return Object.assign(new Error(`${code}: ${message}`), { code, details });
 }
-function inspectExternalWorkspaceProjectInstructions(sourceWorkspacePath) {
+function pathWithin(candidate, root) {
+  const rel = relative3(root, candidate);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute4(rel);
+}
+function lstatIfPresent(path) {
+  try {
+    return lstatSync4(path);
+  } catch (error) {
+    if (error?.code === "ENOENT") return null;
+    throw error;
+  }
+}
+function canonicalExistingPath(path) {
+  try {
+    return realpathSync4(resolve4(path));
+  } catch {
+    return resolve4(path);
+  }
+}
+function isManagedExecutionDirectory(directory, managedWorkspacesRoot) {
+  if (typeof managedWorkspacesRoot !== "string" || !managedWorkspacesRoot.trim()) return false;
+  const managedRoot = canonicalExistingPath(managedWorkspacesRoot);
+  const candidate = canonicalExistingPath(directory);
+  if (!pathWithin(candidate, managedRoot)) return false;
+  const manifestPath = join8(candidate, WORKSPACE_MANIFEST_FILENAME);
+  const manifestStat = lstatIfPresent(manifestPath);
+  if (!manifestStat?.isFile() || manifestStat.isSymbolicLink()) return false;
+  try {
+    const manifest = JSON.parse(readFileSync9(manifestPath, "utf8"));
+    if (!manifest || typeof manifest !== "object" || Array.isArray(manifest) || manifest.managed !== true) {
+      return false;
+    }
+    return [manifest.managedCwd, manifest.executionWorkdir].some((value) => typeof value === "string" && isAbsolute4(value) && canonicalExistingPath(value) === candidate);
+  } catch {
+    return false;
+  }
+}
+function inspectExternalWorkspaceProjectInstructions(sourceWorkspacePath, options = {}) {
   const root = resolve4(sourceWorkspacePath);
   const pending = [root];
   const sources = [];
+  const ignoredManagedExecutionDirectories = [];
   let visitedDirectories = 0;
   while (pending.length > 0) {
     const directory = pending.pop();
+    if (isManagedExecutionDirectory(directory, options.managedWorkspacesRoot)) {
+      ignoredManagedExecutionDirectories.push(relative3(root, directory).replaceAll("\\", "/") || ".");
+      continue;
+    }
     visitedDirectories += 1;
     if (visitedDirectories > PROJECT_INSTRUCTION_SCAN_MAX_DIRECTORIES) {
       throw instructionTopologyError(
@@ -23695,7 +23834,7 @@ function inspectExternalWorkspaceProjectInstructions(sourceWorkspacePath) {
           `project instruction source is not a regular file: ${relativePath}`
         );
       }
-      const content = readFileSync8(absolutePath);
+      const content = readFileSync9(absolutePath);
       sources.push({
         path: relativePath,
         scope: relativePath.includes("/") ? relativePath.slice(0, relativePath.lastIndexOf("/")) : ".",
@@ -23705,26 +23844,17 @@ function inspectExternalWorkspaceProjectInstructions(sourceWorkspacePath) {
     }
   }
   sources.sort((left, right) => left.path.localeCompare(right.path));
+  ignoredManagedExecutionDirectories.sort((left, right) => left.localeCompare(right));
   return {
     schemaVersion: "mirrorx.workspace-project-instruction-scan.v1",
     status: sources.length === 0 ? "absent_verified" : "present_verified",
     visitedDirectories,
     sources,
-    topologySha256: createHash8("sha256").update(JSON.stringify(sources)).digest("hex")
+    topologySha256: createHash8("sha256").update(JSON.stringify(sources)).digest("hex"),
+    ignoredManagedExecutionDirectoryCount: ignoredManagedExecutionDirectories.length,
+    ignoredManagedExecutionDirectoriesSha256: createHash8("sha256").update(JSON.stringify(ignoredManagedExecutionDirectories)).digest("hex")
   };
 }
-function pathWithin(candidate, root) {
-  const rel = relative3(root, candidate);
-  return rel === "" || !rel.startsWith("..") && !isAbsolute4(rel);
-}
-function lstatIfPresent(path) {
-  try {
-    return lstatSync4(path);
-  } catch (error) {
-    if (error?.code === "ENOENT") return null;
-    throw error;
-  }
-}
 function composeProjectedInstruction(sources, platformInstructions) {
   const platformBlock = [
     '<mirrorx-platform-instructions priority="platform">',
@@ -23752,7 +23882,7 @@ ${repositoryBlock}
 }
 function assertProjectionTargetAncestors(targetPath, targetRoot) {
   const pending = [];
-  let current = dirname5(targetPath);
+  let current = dirname6(targetPath);
   while (current !== targetRoot) {
     if (!pathWithin(current, targetRoot)) {
       throw instructionTopologyError(
@@ -23761,11 +23891,11 @@ function assertProjectionTargetAncestors(targetPath, targetRoot) {
       );
     }
     pending.push(current);
-    current = dirname5(current);
+    current = dirname6(current);
   }
   pending.push(targetRoot);
   for (const directory of pending.reverse()) {
-    if (!existsSync6(directory)) {
+    if (!existsSync7(directory)) {
       mkdirSync5(directory, { mode: 448 });
       continue;
     }
@@ -23778,7 +23908,7 @@ function assertProjectionTargetAncestors(targetPath, targetRoot) {
     }
   }
 }
-function projectExternalWorkspaceProjectInstructions(sourceWorkspacePath, executionWorkspacePath, platformInstructions) {
+function projectExternalWorkspaceProjectInstructions(sourceWorkspacePath, executionWorkspacePath, platformInstructions, options = {}) {
   const sourceRoot = resolve4(sourceWorkspacePath);
   const targetRoot = resolve4(executionWorkspacePath);
   if (sourceRoot === targetRoot || !platformInstructions?.trim()) {
@@ -23787,7 +23917,7 @@ function projectExternalWorkspaceProjectInstructions(sourceWorkspacePath, execut
       sourceRoot === targetRoot ? "source and isolated execution workspaces must differ" : "MirrorX platform instructions are missing"
     );
   }
-  const inspection = inspectExternalWorkspaceProjectInstructions(sourceRoot);
+  const inspection = inspectExternalWorkspaceProjectInstructions(sourceRoot, options);
   const sourcesByScope = /* @__PURE__ */ new Map();
   for (const source of inspection.sources) {
     const entries = sourcesByScope.get(source.scope) ?? [];
@@ -23810,7 +23940,7 @@ function projectExternalWorkspaceProjectInstructions(sourceWorkspacePath, execut
         `project instruction source changed during projection: ${source.path}`
       );
     }
-    const sourceContent = readFileSync8(sourcePath, "utf8");
+    const sourceContent = readFileSync9(sourcePath, "utf8");
     const sourceSha256 = createHash8("sha256").update(sourceContent, "utf8").digest("hex");
     if (sourceSha256 !== source.sha256) {
       throw instructionTopologyError(
@@ -23849,10 +23979,10 @@ function projectExternalWorkspaceProjectInstructions(sourceWorkspacePath, execut
     assertProjectionTargetAncestors(targetPath, targetRoot);
     const temporaryPath = `${targetPath}.mirrorx-${randomBytes2(12).toString("hex")}.tmp`;
     try {
-      writeFileSync6(temporaryPath, projectedContent, { encoding: "utf8", flag: "wx", mode: 384 });
-      renameSync5(temporaryPath, targetPath);
+      writeFileSync7(temporaryPath, projectedContent, { encoding: "utf8", flag: "wx", mode: 384 });
+      renameSync6(temporaryPath, targetPath);
     } finally {
-      rmSync4(temporaryPath, { force: true });
+      rmSync5(temporaryPath, { force: true });
     }
     modelFacingFile = "AGENTS.md";
     modelFacingBytes = Buffer.byteLength(projectedContent, "utf8");
@@ -23923,9 +24053,9 @@ function agentInstructionDeliveryAudit(bundle, delivery) {
 }
 
 // src/amaster-runtime-daemon/config-state.mjs
-import { existsSync as existsSync7, mkdirSync as mkdirSync6, readFileSync as readFileSync9, renameSync as renameSync6, rmSync as rmSync5, writeFileSync as writeFileSync7 } from "node:fs";
+import { existsSync as existsSync8, mkdirSync as mkdirSync6, readFileSync as readFileSync10, renameSync as renameSync7, rmSync as rmSync6, writeFileSync as writeFileSync8 } from "node:fs";
 import { homedir as homedir2, hostname } from "node:os";
-import { dirname as dirname6, join as join7 } from "node:path";
+import { dirname as dirname7, join as join9 } from "node:path";
 var CAPABILITIES = [
   "remote_registration",
   "heartbeat",
@@ -23988,26 +24118,26 @@ function defaultMachineId() {
 }
 function runtimeHome(env) {
   return expandHomePath(String(
-    env.AMASTER_RUNTIME_STATE_HOME || env.AMASTER_RUNTIME_HOME || join7(homedir2(), ".amaster-employee")
+    env.AMASTER_RUNTIME_STATE_HOME || env.AMASTER_RUNTIME_HOME || join9(homedir2(), ".amaster-employee")
   ));
 }
 function stateFilePath(env) {
-  return env.AMASTER_DAEMON_STATE_FILE ? expandHomePath(String(env.AMASTER_DAEMON_STATE_FILE)) : join7(runtimeHome(env), "runtime-connector-state.json");
+  return env.AMASTER_DAEMON_STATE_FILE ? expandHomePath(String(env.AMASTER_DAEMON_STATE_FILE)) : join9(runtimeHome(env), "runtime-connector-state.json");
 }
 function corruptStatePath(path) {
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/\D/g, "").slice(0, 14);
   const base = `${path}.corrupt-${timestamp}Z`;
   let candidate = base;
-  for (let suffix = 1; existsSync7(candidate); suffix += 1) {
+  for (let suffix = 1; existsSync8(candidate); suffix += 1) {
     candidate = `${base}.${suffix}`;
   }
   return candidate;
 }
 function readState(env) {
   const path = stateFilePath(env);
-  if (!existsSync7(path)) return {};
+  if (!existsSync8(path)) return {};
   try {
-    const state = JSON.parse(readFileSync9(path, "utf8"));
+    const state = JSON.parse(readFileSync10(path, "utf8"));
     if (!state || typeof state !== "object" || Array.isArray(state)) {
       throw new TypeError("runtime connector state must be a JSON object");
     }
@@ -24015,7 +24145,7 @@ function readState(env) {
   } catch {
     const quarantinePath = corruptStatePath(path);
     try {
-      renameSync6(path, quarantinePath);
+      renameSync7(path, quarantinePath);
       process.stderr.write(`AMaster runtime state was invalid and quarantined at ${quarantinePath}
 `);
     } catch (error) {
@@ -24029,17 +24159,17 @@ function readState(env) {
 }
 function writeState(env, state) {
   const path = stateFilePath(env);
-  mkdirSync6(dirname6(path), { recursive: true });
+  mkdirSync6(dirname7(path), { recursive: true });
   const temporaryPath = `${path}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`;
   try {
-    writeFileSync7(temporaryPath, `${JSON.stringify(state, null, 2)}
+    writeFileSync8(temporaryPath, `${JSON.stringify(state, null, 2)}
 `, {
       flag: "wx",
       mode: 384
     });
-    renameSync6(temporaryPath, path);
+    renameSync7(temporaryPath, path);
   } finally {
-    rmSync5(temporaryPath, { force: true });
+    rmSync6(temporaryPath, { force: true });
   }
 }
 function buildConfig(env = process.env, flags = {}) {
@@ -24051,10 +24181,10 @@ function buildConfig(env = process.env, flags = {}) {
   const authHeader = String(flags.authHeader ?? env.AMASTER_CONNECTOR_AUTH_HEADER ?? "");
   const home = runtimeHome(env);
   const runtimeWorkspacesRoot = expandHomePath(
-    String(flags.runtimeWorkspacesRoot ?? env.AMASTER_RUNTIME_WORKSPACES_ROOT ?? join7(home, "workspaces"))
+    String(flags.runtimeWorkspacesRoot ?? env.AMASTER_RUNTIME_WORKSPACES_ROOT ?? join9(home, "workspaces"))
   );
   const browserSessionStateRoot = expandHomePath(String(
-    flags.browserSessionStateRoot ?? env.AMASTER_BROWSER_SESSION_STATE_ROOT ?? join7(home, "browser-auth")
+    flags.browserSessionStateRoot ?? env.AMASTER_BROWSER_SESSION_STATE_ROOT ?? join9(home, "browser-auth")
   ));
   const piToolArgumentGuardModeValue = String(
     flags.piToolArgumentGuardMode ?? env.AMASTER_PI_TOOL_ARGUMENT_GUARD_MODE ?? "shadow"
@@ -25906,7 +26036,7 @@ var bestEffortPostJson = bestEffortPostRuntimeConnectorJson;
 
 // src/amaster-runtime-daemon/runtime-artifact-upload.mjs
 import { createHash as createHash9 } from "node:crypto";
-import { closeSync as closeSync2, constants, fstatSync, lstatSync as lstatSync5, openSync as openSync2, readFileSync as readFileSync10, realpathSync as realpathSync4 } from "node:fs";
+import { closeSync as closeSync2, constants, fstatSync, lstatSync as lstatSync5, openSync as openSync2, readFileSync as readFileSync11, realpathSync as realpathSync5 } from "node:fs";
 import { isAbsolute as isAbsolute5, relative as relative4, resolve as resolve5 } from "node:path";
 var SHA256_PATTERN3 = /^[a-f0-9]{64}$/;
 function requiredString(value, name) {
@@ -25926,11 +26056,11 @@ function sameFileSnapshot(left, right) {
   return left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeMs === right.mtimeMs && left.ctimeMs === right.ctimeMs;
 }
 function readOwnedWorkspaceFile(rootPath, sourceRelativePath, label = "Runtime workspace file", options = {}) {
-  const root = realpathSync4(resolve5(rootPath));
+  const root = realpathSync5(resolve5(rootPath));
   const relativePath = ownedRelativePath(sourceRelativePath);
   const sourcePath = resolve5(root, relativePath);
   const pathStat = lstatSync5(sourcePath);
-  if (!pathStat.isFile() || pathStat.isSymbolicLink() || !pathWithin2(realpathSync4(sourcePath), root)) {
+  if (!pathStat.isFile() || pathStat.isSymbolicLink() || !pathWithin2(realpathSync5(sourcePath), root)) {
     throw new Error(`${label} source is not an owned regular file`);
   }
   const noFollow = typeof constants.O_NOFOLLOW === "number" ? constants.O_NOFOLLOW : 0;
@@ -25958,11 +26088,11 @@ function readOwnedWorkspaceFile(rootPath, sourceRelativePath, label = "Runtime w
         );
       }
     }
-    const body = readFileSync10(descriptor);
+    const body = readFileSync11(descriptor);
     options.afterRead?.({ sourcePath, descriptor });
     const after = fstatSync(descriptor);
     const pathAfter = lstatSync5(sourcePath);
-    if (!sameFileSnapshot(before, after) || !sameFileSnapshot(pathAfter, after) || !pathAfter.isFile() || pathAfter.isSymbolicLink() || !pathWithin2(realpathSync4(sourcePath), root) || body.length !== after.size) {
+    if (!sameFileSnapshot(before, after) || !sameFileSnapshot(pathAfter, after) || !pathAfter.isFile() || pathAfter.isSymbolicLink() || !pathWithin2(realpathSync5(sourcePath), root) || body.length !== after.size) {
       throw new Error(`${label} source changed during the governed read`);
     }
     return { body, relativePath, stat: after };
@@ -26243,105 +26373,8 @@ function createRuntimeArtifactIngestQueue({ ingest, onError }) {
 
 // src/amaster-runtime-daemon/workspace-guard.mjs
 import { createHash as createHash11 } from "node:crypto";
-import { existsSync as existsSync9, mkdirSync as mkdirSync7, realpathSync as realpathSync5, statSync as statSync4 } from "node:fs";
-import { basename as basename4, join as join9, isAbsolute as isAbsolute6, relative as relative5, resolve as resolve6 } from "node:path";
-
-// src/amaster-runtime-daemon/workspace-manifest.mjs
-import { chownSync as chownSync3, existsSync as existsSync8, readFileSync as readFileSync11, renameSync as renameSync7, rmSync as rmSync6, statSync as statSync3, writeFileSync as writeFileSync8 } from "node:fs";
-import { basename as basename3, dirname as dirname7, join as join8 } from "node:path";
-var WORKSPACE_MANIFEST_FILENAME = ".amaster-runtime.json";
-function syncManifestDirOwnership(manifestPath, deps = {}) {
-  const stat = deps.statSync ?? statSync3;
-  const chown = deps.chownSync ?? chownSync3;
-  const geteuid = deps.geteuid ?? (typeof process.geteuid === "function" ? process.geteuid.bind(process) : () => null);
-  try {
-    if (geteuid() !== 0) return false;
-    const dirStat = stat(dirname7(manifestPath));
-    if (dirStat.uid === 0 && dirStat.gid === 0) return false;
-    chown(manifestPath, dirStat.uid, dirStat.gid);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function nowIso() {
-  return (/* @__PURE__ */ new Date()).toISOString();
-}
-function workspaceManifestPath(workspaceOrCwd) {
-  if (!workspaceOrCwd) return null;
-  if (typeof workspaceOrCwd === "string") return join8(workspaceOrCwd, WORKSPACE_MANIFEST_FILENAME);
-  if (typeof workspaceOrCwd.cwd === "string") return join8(workspaceOrCwd.cwd, WORKSPACE_MANIFEST_FILENAME);
-  return null;
-}
-function readWorkspaceManifest(manifestPath) {
-  if (!manifestPath || !existsSync8(manifestPath)) return null;
-  try {
-    const parsed = JSON.parse(readFileSync11(manifestPath, "utf8"));
-    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
-  } catch {
-    return null;
-  }
-}
-function writeWorkspaceManifest(manifestPath, manifest, deps) {
-  const tempPath = join8(
-    dirname7(manifestPath),
-    `.${basename3(manifestPath)}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`
-  );
-  try {
-    writeFileSync8(tempPath, `${JSON.stringify(manifest, null, 2)}
-`, { mode: 384 });
-    renameSync7(tempPath, manifestPath);
-    syncManifestDirOwnership(manifestPath, deps);
-  } catch (err) {
-    rmSync6(tempPath, { force: true });
-    throw err;
-  }
-  return manifest;
-}
-function createWorkspaceManifest(workspace, input = {}) {
-  const manifestPath = workspaceManifestPath(workspace);
-  const createdAt = nowIso();
-  const manifest = {
-    version: 2,
-    managed: true,
-    sourceWorkspacePath: workspace.sourceWorkspacePath,
-    managedCwd: workspace.cwd,
-    executionWorkdir: workspace.cwd,
-    executorKind: input.executorKind ?? null,
-    executorHome: workspace.executorHome ?? null,
-    commandId: input.commandId ?? null,
-    generation: input.generation ?? null,
-    runId: input.runId ?? null,
-    issueId: input.issueId ?? null,
-    workspaceKey: workspace.workspaceKey ?? null,
-    issueKey: workspace.issueKey ?? null,
-    runKey: workspace.runKey ?? null,
-    createdAt,
-    lastTouchedAt: createdAt,
-    lastWorkspaceScanAt: null,
-    artifactCandidateCount: 0,
-    artifactCandidates: [],
-    outboxPending: 0
-  };
-  return writeWorkspaceManifest(manifestPath, manifest);
-}
-function updateWorkspaceManifest(workspaceOrManifestPath, patch = {}) {
-  const manifestPath = typeof workspaceOrManifestPath === "string" ? workspaceOrManifestPath : workspaceManifestPath(workspaceOrManifestPath);
-  if (!manifestPath) return null;
-  const current = readWorkspaceManifest(manifestPath) ?? {
-    version: 2,
-    managed: true,
-    createdAt: nowIso()
-  };
-  const next = {
-    ...current,
-    ...patch,
-    lastTouchedAt: nowIso()
-  };
-  return writeWorkspaceManifest(manifestPath, next);
-}
-
-// src/amaster-runtime-daemon/workspace-guard.mjs
+import { existsSync as existsSync9, mkdirSync as mkdirSync7, realpathSync as realpathSync6, statSync as statSync4 } from "node:fs";
+import { basename as basename4, join as join10, isAbsolute as isAbsolute6, relative as relative5, resolve as resolve6 } from "node:path";
 function pathWithin3(candidate, root) {
   const rel = relative5(root, candidate);
   return rel === "" || !rel.startsWith("..") && !isAbsolute6(rel);
@@ -26350,10 +26383,10 @@ function resolveWorkspaceCwd(config, command) {
   const payload = asRecord(command.payload);
   const requested = readString(payload.workspacePath);
   const fallback = config.workspaceBindings[0] ?? process.cwd();
-  const cwd = realpathSync5(resolve6(expandHomePath(requested ?? fallback)));
+  const cwd = realpathSync6(resolve6(expandHomePath(requested ?? fallback)));
   const allowlist = config.workspaceBindings.flatMap((entry) => {
     try {
-      return [realpathSync5(resolve6(expandHomePath(entry)))];
+      return [realpathSync6(resolve6(expandHomePath(entry)))];
     } catch {
       return [];
     }
@@ -26398,7 +26431,7 @@ function workspaceLabel(sourceWorkspacePath, payload) {
 function workspacesRoot(config) {
   const root = resolve6(expandHomePath(config.runtimeWorkspacesRoot ?? "~/.amaster-employee/workspaces"));
   mkdirSync7(root, { recursive: true });
-  return realpathSync5(root);
+  return realpathSync6(root);
 }
 function resolveExecutionWorkspace(config, command, opts = {}) {
   const sourceWorkspacePath = resolveWorkspaceCwd(config, command);
@@ -26410,9 +26443,9 @@ function resolveExecutionWorkspace(config, command, opts = {}) {
   const workspaceKey = `${safeSegment(workspaceLabel(sourceWorkspacePath, payload), "workspace")}-${shortHash(sourceWorkspacePath)}`;
   const issueKey = `${safeSegment(issueLabel(command, payload), "issue")}-${shortHash(issueId, 8)}`;
   const runKey = `${safeSegment(runId, "run")}-${shortHash(runId, 8)}`;
-  const runDir = join9(root, workspaceKey, issueKey, runKey);
-  const cwd = join9(runDir, "workdir");
-  const executorHome = join9(runDir, "executors", safeSegment(executorKind, "executor"));
+  const runDir = join10(root, workspaceKey, issueKey, runKey);
+  const cwd = join10(runDir, "workdir");
+  const executorHome = join10(runDir, "executors", safeSegment(executorKind, "executor"));
   mkdirSync7(cwd, { recursive: true });
   mkdirSync7(executorHome, { recursive: true });
   const workspace = {
@@ -26437,7 +26470,7 @@ function resolveExecutionWorkspace(config, command, opts = {}) {
 
 // src/amaster-runtime-daemon/workspace-gc.mjs
 import { existsSync as existsSync10, readdirSync as readdirSync7, statSync as statSync5 } from "node:fs";
-import { join as join10, resolve as resolve7 } from "node:path";
+import { join as join11, resolve as resolve7 } from "node:path";
 function readIsoTime(value) {
   if (typeof value !== "string" || !value.trim()) return null;
   const time = new Date(value).getTime();
@@ -26460,7 +26493,7 @@ function walkWorkdirs(root) {
     }
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
-      const fullPath = join10(current, entry.name);
+      const fullPath = join11(current, entry.name);
       if (entry.name === "workdir" && existsSync10(workspaceManifestPath(fullPath))) {
         workdirs.push(fullPath);
         continue;
@@ -26492,7 +26525,7 @@ function directorySizeBytes(path) {
         continue;
       }
       for (const entry of entries) {
-        stack.push(join10(current, entry.name));
+        stack.push(join11(current, entry.name));
       }
       continue;
     }
@@ -26578,7 +26611,7 @@ import {
   unlinkSync as unlinkSync2,
   writeFileSync as writeFileSync9
 } from "node:fs";
-import { dirname as dirname8, extname, isAbsolute as isAbsolute7, join as join11, parse as parse2, resolve as resolve8, sep as sep3 } from "node:path";
+import { dirname as dirname8, extname, isAbsolute as isAbsolute7, join as join12, parse as parse2, resolve as resolve8, sep as sep3 } from "node:path";
 import { fileURLToPath } from "node:url";
 var PRESET_TEMPLATE_MANIFEST_FILE = ".mirrorx-preset-templates.json";
 var MAX_PRESET_TEMPLATE_FILES = 256;
@@ -26628,7 +26661,7 @@ function readManifest(manifestPath, { strict }) {
 }
 function verifiedBundleFiles(sourceDir, manifest) {
   return manifest.files.map((entry) => {
-    const sourcePath = join11(sourceDir, entry.name);
+    const sourcePath = join12(sourceDir, entry.name);
     const stat = lstatSync6(sourcePath);
     if (!stat.isFile() || stat.isSymbolicLink()) {
       throw new Error(`preset_template_bundle_file_unsafe: ${entry.name}`);
@@ -26643,7 +26676,7 @@ function verifiedBundleFiles(sourceDir, manifest) {
 function removeRetiredPresetFiles(targetDir, previousManifest, nextNames) {
   for (const entry of previousManifest.files) {
     if (nextNames.has(entry.name)) continue;
-    const targetPath = join11(targetDir, entry.name);
+    const targetPath = join12(targetDir, entry.name);
     if (!existsSync11(targetPath)) continue;
     const stat = lstatSync6(targetPath);
     if (stat.isDirectory()) {
@@ -26658,7 +26691,7 @@ function materializeBundledPresetTemplates(input) {
   if (sourceDir === targetDir || sourceDir.startsWith(`${targetDir}${sep3}`) || targetDir.startsWith(`${sourceDir}${sep3}`)) {
     throw new Error("preset_template_source_target_overlap");
   }
-  const manifest = readManifest(join11(sourceDir, PRESET_TEMPLATE_MANIFEST_FILE), { strict: true });
+  const manifest = readManifest(join12(sourceDir, PRESET_TEMPLATE_MANIFEST_FILE), { strict: true });
   const verifiedFiles = verifiedBundleFiles(sourceDir, manifest);
   mkdirSync8(dirname8(targetDir), { recursive: true, mode: 493 });
   const targetStat = lstatIfExists(targetDir);
@@ -26666,24 +26699,24 @@ function materializeBundledPresetTemplates(input) {
     throw new Error("preset_template_target_root_unsafe");
   }
   mkdirSync8(targetDir, { recursive: true, mode: 493 });
-  const previousManifest = readManifest(join11(targetDir, PRESET_TEMPLATE_MANIFEST_FILE), { strict: false });
-  const stageDir = mkdtempSync(join11(dirname8(targetDir), ".mirrorx-preset-templates-"));
+  const previousManifest = readManifest(join12(targetDir, PRESET_TEMPLATE_MANIFEST_FILE), { strict: false });
+  const stageDir = mkdtempSync(join12(dirname8(targetDir), ".mirrorx-preset-templates-"));
   try {
     for (const file of verifiedFiles) {
-      const stagedPath = join11(stageDir, file.name);
+      const stagedPath = join12(stageDir, file.name);
       writeFileSync9(stagedPath, file.body, { mode: 292 });
       chmodSync5(stagedPath, 292);
-      renameSync8(stagedPath, join11(targetDir, file.name));
+      renameSync8(stagedPath, join12(targetDir, file.name));
     }
     removeRetiredPresetFiles(targetDir, previousManifest, new Set(manifest.files.map((file) => file.name)));
-    const stagedManifest = join11(stageDir, PRESET_TEMPLATE_MANIFEST_FILE);
+    const stagedManifest = join12(stageDir, PRESET_TEMPLATE_MANIFEST_FILE);
     writeFileSync9(stagedManifest, `${JSON.stringify({
       schemaVersion: manifest.schemaVersion,
       files: manifest.files
     }, null, 2)}
 `, { mode: 292 });
     chmodSync5(stagedManifest, 292);
-    renameSync8(stagedManifest, join11(targetDir, PRESET_TEMPLATE_MANIFEST_FILE));
+    renameSync8(stagedManifest, join12(targetDir, PRESET_TEMPLATE_MANIFEST_FILE));
   } finally {
     rmSync7(stageDir, { recursive: true, force: true });
   }
@@ -26712,7 +26745,7 @@ function materializeRuntimePresetTemplates(env = process.env, options = {}) {
 
 // src/amaster-runtime-daemon/runtime-status-summary.mjs
 import { existsSync as existsSync12, readdirSync as readdirSync9, statSync as statSync6 } from "node:fs";
-import { dirname as dirname9, join as join12, resolve as resolve9 } from "node:path";
+import { dirname as dirname9, join as join13, resolve as resolve9 } from "node:path";
 function runtimeStatusDirectoryEntries(path) {
   try {
     return readdirSync9(path, { withFileTypes: true });
@@ -26735,7 +26768,7 @@ function runtimeStatusDirectorySizeBytes(path) {
     if (!stat || stat.isSymbolicLink()) continue;
     if (stat.isDirectory()) {
       for (const entry of runtimeStatusDirectoryEntries(current)) {
-        stack.push(join12(current, entry.name));
+        stack.push(join13(current, entry.name));
       }
       continue;
     }
@@ -26752,7 +26785,7 @@ function walkRuntimeStatusManagedWorkdirs(root) {
     if (!current) continue;
     for (const entry of runtimeStatusDirectoryEntries(current)) {
       if (!entry.isDirectory()) continue;
-      const fullPath = join12(current, entry.name);
+      const fullPath = join13(current, entry.name);
       if (entry.name === "workdir" && existsSync12(workspaceManifestPath(fullPath))) {
         workdirs.push(fullPath);
         continue;
@@ -26794,7 +26827,7 @@ function summarizeRuntimeStatusRecentRun(workdir, manifest) {
 }
 function runtimeStatusOutboxDir(config) {
   const statePath = config.AMASTER_DAEMON_STATE_FILE ?? config.daemonStateFile;
-  return join12(dirname9(stateFilePath({
+  return join13(dirname9(stateFilePath({
     AMASTER_DAEMON_STATE_FILE: statePath
   })), "result-outbox");
 }
@@ -26802,7 +26835,7 @@ function runtimeStatusRunCompletionDir(config) {
   const explicit = config.AMASTER_RUN_COMPLETION_STATE_DIR ?? config.runCompletionStateDir;
   if (typeof explicit === "string" && explicit.trim()) return resolve9(explicit);
   const statePath = config.AMASTER_DAEMON_STATE_FILE ?? config.daemonStateFile;
-  return join12(dirname9(stateFilePath({
+  return join13(dirname9(stateFilePath({
     AMASTER_DAEMON_STATE_FILE: statePath
   })), "run-completion-state");
 }
@@ -26839,9 +26872,9 @@ function summarizeRuntimeLocalState(input) {
     }
   }
   const pendingOutboxDir = runtimeStatusOutboxDir(config);
-  const invalidOutboxDir = join12(pendingOutboxDir, "invalid");
+  const invalidOutboxDir = join13(pendingOutboxDir, "invalid");
   const pendingRunCompletionDir = runtimeStatusRunCompletionDir(config);
-  const invalidRunCompletionDir = join12(pendingRunCompletionDir, "invalid");
+  const invalidRunCompletionDir = join13(pendingRunCompletionDir, "invalid");
   return {
     managedWorkspacesRoot: root,
     managedWorkdirCount: workdirs.length,
@@ -27454,7 +27487,7 @@ function readPiFinalContextAttestation(input) {
 import { spawnSync as spawnSync4 } from "node:child_process";
 import { createHash as createHash14 } from "node:crypto";
 import { existsSync as existsSync13, readdirSync as readdirSync10, readFileSync as readFileSync15, statSync as statSync7 } from "node:fs";
-import { basename as basename5, extname as extname2, isAbsolute as isAbsolute8, join as join13, relative as relative6, resolve as resolve11 } from "node:path";
+import { basename as basename5, extname as extname2, isAbsolute as isAbsolute8, join as join14, relative as relative6, resolve as resolve11 } from "node:path";
 var WORKSPACE_RUNTIME_SERVICES_FILENAME = ".amaster-runtime-services.json";
 var ARTIFACT_EXTENSIONS = /* @__PURE__ */ new Map([
   [".md", "markdown"],
@@ -27572,7 +27605,7 @@ function scanArtifactCandidates(cwd, opts = {}) {
       if (entry.name.startsWith(".") && entry.name !== ".amaster-runtime.json") {
         if (entry.name === ".git") continue;
       }
-      const fullPath = join13(current, entry.name);
+      const fullPath = join14(current, entry.name);
       const relativePath = normalizeRelativePath(root, fullPath);
       if (!isSafeRelativePath(relativePath)) continue;
       if (basename5(relativePath) === ".amaster-runtime.json") continue;
@@ -27650,7 +27683,7 @@ function sanitizeRuntimeService(entry) {
   };
 }
 function readRuntimeServicesSnapshot(cwd) {
-  const snapshotPath = join13(resolve11(cwd), WORKSPACE_RUNTIME_SERVICES_FILENAME);
+  const snapshotPath = join14(resolve11(cwd), WORKSPACE_RUNTIME_SERVICES_FILENAME);
   if (!existsSync13(snapshotPath)) return [];
   try {
     const parsed = JSON.parse(readFileSync15(snapshotPath, "utf8"));
@@ -27897,7 +27930,7 @@ import {
 } from "node:fs";
 import { createServer as createHttpServer } from "node:http";
 import { connect as connectTcp, isIP } from "node:net";
-import { dirname as dirname10, join as join14, relative as relative7, resolve as resolve12 } from "node:path";
+import { dirname as dirname10, join as join15, relative as relative7, resolve as resolve12 } from "node:path";
 var MARKER_NAME = ".amaster-browser-session.json";
 var HUMAN_LEASE_INACTIVITY_MS = 30 * 60 * 1e3;
 var HUMAN_LEASE_HARD_CAP_MS = 2 * 60 * 60 * 1e3;
@@ -28154,7 +28187,7 @@ function exactProfile(stateRoot, payload, { create = false } = {}) {
     mkdirSync9(profilePath, { mode: 448 });
     chmodSync6(profilePath, 448);
     writeFileSync10(
-      join14(profilePath, MARKER_NAME),
+      join15(profilePath, MARKER_NAME),
       `${JSON.stringify(expectedOwner(payload))}
 `,
       { encoding: "utf8", mode: 384, flag: "wx" }
@@ -28165,7 +28198,7 @@ function exactProfile(stateRoot, payload, { create = false } = {}) {
   }
   let owner;
   try {
-    owner = JSON.parse(readFileSync16(join14(profilePath, MARKER_NAME), "utf8"));
+    owner = JSON.parse(readFileSync16(join15(profilePath, MARKER_NAME), "utf8"));
   } catch {
     throw brokerError("browser_session_profile_owner_invalid");
   }
@@ -28450,7 +28483,7 @@ function createBrowserSessionBroker({
       if (resolve12(payload.userDataDir) !== expectedPath) {
         throw brokerError("browser_session_profile_path_invalid");
       }
-      const marker = JSON.parse(readFileSync16(join14(expectedPath, MARKER_NAME), "utf8"));
+      const marker = JSON.parse(readFileSync16(join15(expectedPath, MARKER_NAME), "utf8"));
       if (marker.version !== 1 || typeof marker.provider !== "string" || !marker.provider.trim() || marker.companyId !== payload.companyId || marker.bindingId !== payload.bindingId || marker.localOpaqueRef !== payload.localOpaqueRef || marker.origin !== payload.origin) {
         throw brokerError("browser_session_profile_owner_mismatch");
       }
@@ -28613,7 +28646,7 @@ function createSourceCompletionStopPolicy({
 }
 
 // src/amaster-runtime-daemon.mjs
-var CONNECTOR_VERSION = "0.1.1-beta.124";
+var CONNECTOR_VERSION = "0.1.1-beta.125";
 var CONNECTOR_CONTRACT_VERSION = "2026-06-04.v1";
 var SOURCE_ACQUISITION_CAPABILITY2 = source_acquisition_compatibility_default.profileVersion;
 var daemonRequire = createRequire(import.meta.url);
@@ -28661,7 +28694,7 @@ function resultOutboxPendingCount(config) {
   try {
     let pending = 0;
     for (const file of readdirSync11(dir).filter((name) => name.endsWith(".json"))) {
-      if (readValidResultOutboxEntryOrQuarantine(config, file, join15(dir, file))) {
+      if (readValidResultOutboxEntryOrQuarantine(config, file, join16(dir, file))) {
         pending += 1;
       }
     }
@@ -28673,15 +28706,15 @@ function resultOutboxPendingCount(config) {
 function runCompletionStateDir(config) {
   const explicit = readString(process.env.AMASTER_RUN_COMPLETION_STATE_DIR);
   if (explicit) return resolve13(expandHomePath(explicit));
-  return join15(dirname11(stateFilePath(process.env)), "run-completion-state");
+  return join16(dirname11(stateFilePath(process.env)), "run-completion-state");
 }
 function runCompletionStateInvalidDir(config) {
-  return join15(runCompletionStateDir(config), "invalid");
+  return join16(runCompletionStateDir(config), "invalid");
 }
 function quarantineInvalidRunCompletionState(config, filePath, reason) {
   const invalidDir = runCompletionStateInvalidDir(config);
   mkdirSync10(invalidDir, { recursive: true, mode: 448 });
-  const destination = join15(invalidDir, basename6(filePath));
+  const destination = join16(invalidDir, basename6(filePath));
   try {
     renameSync9(filePath, destination);
   } catch {
@@ -28738,7 +28771,7 @@ function resultOutboxActiveRunCommands(config) {
   const outboxPending = resultOutboxPendingCount(config);
   const entries = [];
   for (const file of readdirSync11(dir).filter((name) => name.endsWith(".json")).sort()) {
-    const entry = readValidResultOutboxEntryOrQuarantine(config, file, join15(dir, file));
+    const entry = readValidResultOutboxEntryOrQuarantine(config, file, join16(dir, file));
     if (!entry) continue;
     const activeRun = asRecord(entry.activeRun);
     const commandId = readString(activeRun.commandId) ?? readString(entry.commandId);
@@ -28773,7 +28806,7 @@ function resultOutboxFailedRunCommands(config) {
   for (const file of readdirSync11(dir).filter((name) => name.endsWith(".json")).sort().slice(-100)) {
     let entry;
     try {
-      entry = asRecord(JSON.parse(readFileSync17(join15(dir, file), "utf8")));
+      entry = asRecord(JSON.parse(readFileSync17(join16(dir, file), "utf8")));
     } catch {
       continue;
     }
@@ -28883,10 +28916,10 @@ function safeSkillRootSummary(kind, source, pathValue) {
     try {
       for (const name of readdirSync11(pathValue)) {
         if (name.startsWith(".")) continue;
-        const skillDir = join15(pathValue, name);
+        const skillDir = join16(pathValue, name);
         try {
           if (!statSync9(skillDir).isDirectory()) continue;
-          if (!existsSync15(join15(skillDir, "SKILL.md"))) continue;
+          if (!existsSync15(join16(skillDir, "SKILL.md"))) continue;
           skillCount += 1;
           if (skillCount >= MAX_PI_CAPABILITY_SOURCE_ENTRIES) {
             truncated = true;
@@ -28937,7 +28970,7 @@ function objectKeyCount(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? Object.keys(value).length : 0;
 }
 function defaultPiCodingAgentDir() {
-  return join15(homedir3(), ".pi", "agent");
+  return join16(homedir3(), ".pi", "agent");
 }
 function piCapabilitySourcesDiagnostics() {
   const configuredPiCodingAgentDir = safeExpandPath(process.env.PI_CODING_AGENT_DIR);
@@ -28946,14 +28979,14 @@ function piCapabilitySourcesDiagnostics() {
   const configuredPiAgentHome = safeExpandPath(process.env.PI_AGENT_HOME);
   const piAgentHome = configuredPiAgentHome ?? piCodingAgentDir;
   const piAgentHomeSource = configuredPiAgentHome ? "PI_AGENT_HOME" : piCodingAgentDirSource;
-  const userSkillsPath = piAgentHome ? join15(piAgentHome, "skills") : null;
+  const userSkillsPath = piAgentHome ? join16(piAgentHome, "skills") : null;
   const configuredMarketplaceSkillsPath = safeExpandPath(
     process.env.PI_AGENT_MARKETPLACE_SKILLS_DIR
   );
-  const marketplaceSkillsPath = configuredMarketplaceSkillsPath ?? (piAgentHome ? join15(piAgentHome, "marketplace", "skills") : null);
+  const marketplaceSkillsPath = configuredMarketplaceSkillsPath ?? (piAgentHome ? join16(piAgentHome, "marketplace", "skills") : null);
   const builtinSkillsPath = safeExpandPath(process.env.PI_AGENT_BUILTIN_SKILLS_DIR) ?? safeExpandPath(process.env.AMASTER_BUILTIN_SKILLS);
-  const mcpConfigPath = safeExpandPath(process.env.PI_AGENT_MCP_SERVERS_FILE) ?? (piAgentHome ? join15(piAgentHome, "mcp.json") : null);
-  const settingsConfigPath = piCodingAgentDir ? join15(piCodingAgentDir, "settings.json") : null;
+  const mcpConfigPath = safeExpandPath(process.env.PI_AGENT_MCP_SERVERS_FILE) ?? (piAgentHome ? join16(piAgentHome, "mcp.json") : null);
+  const settingsConfigPath = piCodingAgentDir ? join16(piCodingAgentDir, "settings.json") : null;
   const skillRoots = [
     safeSkillRootSummary("user", `${piAgentHomeSource}/skills`, userSkillsPath),
     safeSkillRootSummary(
@@ -29073,7 +29106,7 @@ function buildExecutorReadiness(config) {
 function sourceAcquisitionPackageMetadata(packageName, location = "pi-config") {
   const packageBase = location === "runtime" ? readString(process.env.PI_RUNTIME_ROOT) : readString(process.env.PI_CODING_AGENT_DIR ?? process.env.PI_AGENT_HOME);
   if (!packageBase) return null;
-  const packagePath = join15(
+  const packagePath = join16(
     resolve13(expandHomePath(packageBase)),
     ...location === "runtime" ? [] : ["npm"],
     "node_modules",
@@ -29538,7 +29571,7 @@ AMASTER_WORKSPACE_ALLOWLIST=${quoteShell(config.workspaceBindings.join(","))}
 AMASTER_EXECUTORS=${quoteShell(executorEnv)}
 AMASTER_CAPABILITIES=${quoteShell(config.capabilities.join(","))}
 AMASTER_NETWORK_DOMAINS=${quoteShell(config.networkDomains.join(","))}
-AMASTER_DAEMON_STATE_FILE=${quoteShell(join15(homedir3(), ".amaster-employee", "runtime-connector-state.json"))}
+AMASTER_DAEMON_STATE_FILE=${quoteShell(join16(homedir3(), ".amaster-employee", "runtime-connector-state.json"))}
 EOF
 
 set -a
@@ -29966,7 +29999,7 @@ async function sourceAcquisitionRuntimeProfile(config, command) {
   const stateRoot = resolve13(config.browserSessionStateRoot);
   const userDataDir = resolve13(stateRoot, profileName2);
   if (!pathWithin3(userDataDir, stateRoot)) throw new Error("source_acquisition_browser_profile_invalid");
-  const markerPath = join15(userDataDir, ".amaster-browser-session.json");
+  const markerPath = join16(userDataDir, ".amaster-browser-session.json");
   if (!existsSync15(userDataDir) || lstatSync9(userDataDir).isSymbolicLink() || !lstatSync9(userDataDir).isDirectory() || !existsSync15(markerPath) || lstatSync9(markerPath).isSymbolicLink()) throw new Error("source_acquisition_browser_profile_invalid");
   const marker = readJsonFile2(markerPath);
   if (marker.version !== 1 || marker.companyId !== companyId || marker.bindingId !== bindingId || marker.localOpaqueRef !== localOpaqueRef || !readString(marker.provider) || !inspection.sourceOrigins.includes(marker.origin) || Object.keys(marker).length !== 6) {
@@ -30172,7 +30205,7 @@ function wikiTreePathForCommand(command, workspaceBindings) {
     const candidates = [];
     if (root.endsWith("paperclipai.plugin-llm-wiki")) candidates.push(root);
     if (basename6(root) === "plugin-data" && companyId) {
-      candidates.push(join15(root, companyId, "paperclipai.plugin-llm-wiki"));
+      candidates.push(join16(root, companyId, "paperclipai.plugin-llm-wiki"));
     }
     for (const candidate of candidates) {
       try {
@@ -30324,7 +30357,7 @@ function attachPiOutputReserve(profile, outputReserveTokens) {
   if (!profile?.profileRoot || !Number.isSafeInteger(outputReserveTokens) || outputReserveTokens < 1) {
     throw new Error("context_envelope_output_reserve_invalid");
   }
-  const extensionPath = join15(profile.profileRoot, "context-output-reserve.js");
+  const extensionPath = join16(profile.profileRoot, "context-output-reserve.js");
   writeFileSync11(
     extensionPath,
     modelCallOutputContractExtensionSource(outputReserveTokens),
@@ -30351,13 +30384,13 @@ function attachPiFinalContextAttestor(profile, input) {
   if (!projectInstruction || !/^[a-f0-9]{64}$/.test(readString(projectInstruction.sha256) ?? "")) {
     throw new Error("model_context_attestation_unavailable: final AGENTS.md receipt is missing");
   }
-  const extensionPath = join15(profile.profileRoot, "extensions", MANAGED_PI_FINAL_CONTEXT_ATTESTOR_FILENAME);
-  const projectInstructionExtensionPath = join15(
+  const extensionPath = join16(profile.profileRoot, "extensions", MANAGED_PI_FINAL_CONTEXT_ATTESTOR_FILENAME);
+  const projectInstructionExtensionPath = join16(
     profile.profileRoot,
     "extensions",
     MANAGED_PI_PROJECT_INSTRUCTION_FILENAME
   );
-  const receiptPath = join15(profile.profileRoot, "tmp", "final-model-context-receipt.json");
+  const receiptPath = join16(profile.profileRoot, "tmp", "final-model-context-receipt.json");
   const contract = {
     receiptPath,
     projectInstructionPath: resolve13(input.cwd, "AGENTS.md"),
@@ -30417,17 +30450,17 @@ function buildExecutorEnv(config, command, workspace) {
   };
 }
 function preparePiModelCallProfile(commandId, baseEnv, options = {}) {
-  const profileRoot = mkdtempSync2(join15(tmpdir(), "amaster-pi-model-call-"));
-  const home = join15(profileRoot, "home");
-  const sessionsDir = join15(profileRoot, "sessions");
-  const tempDir = join15(profileRoot, "tmp");
+  const profileRoot = mkdtempSync2(join16(tmpdir(), "amaster-pi-model-call-"));
+  const home = join16(profileRoot, "home");
+  const sessionsDir = join16(profileRoot, "sessions");
+  const tempDir = join16(profileRoot, "tmp");
   for (const directory of [home, sessionsDir, tempDir]) {
     mkdirSync10(directory, { recursive: true, mode: 448 });
   }
   try {
     const extensionArgs = [];
     if (options.responseContract) {
-      const extensionPath = join15(profileRoot, "model-call-output-contract.js");
+      const extensionPath = join16(profileRoot, "model-call-output-contract.js");
       writeFileSync11(
         extensionPath,
         modelCallOutputContractExtensionSource(options.responseContract.maxOutputTokens),
@@ -30491,7 +30524,7 @@ function resolveNativeSessionRequest(command, workspace) {
   let cwdMatched = false;
   if (requestedCwd && sourceWorkspacePath) {
     try {
-      cwdMatched = realpathSync6(requestedCwd) === realpathSync6(sourceWorkspacePath);
+      cwdMatched = realpathSync7(requestedCwd) === realpathSync7(sourceWorkspacePath);
     } catch {
       cwdMatched = resolve13(requestedCwd) === resolve13(sourceWorkspacePath);
     }
@@ -31097,7 +31130,7 @@ function sampleProcessGroupRssBytes(processGroupId) {
 }
 function realOrResolvedPath(value) {
   try {
-    return realpathSync6(value);
+    return realpathSync7(value);
   } catch {
     return resolve13(value);
   }
@@ -31106,7 +31139,7 @@ var LSOF_COMMAND = process.platform === "darwin" && existsSync15("/usr/sbin/lsof
 function processCwdForPid(pid) {
   if (process.platform === "linux") {
     try {
-      return realpathSync6(`/proc/${pid}/cwd`);
+      return realpathSync7(`/proc/${pid}/cwd`);
     } catch {
       return null;
     }
@@ -31237,7 +31270,7 @@ function walkManagedWorkdirs(root) {
     }
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
-      const fullPath = join15(current, entry.name);
+      const fullPath = join16(current, entry.name);
       if (entry.name === "workdir" && existsSync15(workspaceManifestPath(fullPath))) {
         workdirs.push(fullPath);
         continue;
@@ -32970,10 +33003,10 @@ async function completeCommand(config, command, status, result3, error) {
 function resultOutboxDir(config) {
   const explicit = readString(process.env.AMASTER_RESULT_OUTBOX_DIR);
   if (explicit) return resolve13(expandHomePath(explicit));
-  return join15(dirname11(stateFilePath(process.env)), "result-outbox");
+  return join16(dirname11(stateFilePath(process.env)), "result-outbox");
 }
 function resultOutboxInvalidDir(config) {
-  return join15(resultOutboxDir(config), "invalid");
+  return join16(resultOutboxDir(config), "invalid");
 }
 function writeResultOutboxEntry(config, entry) {
   const dir = resultOutboxDir(config);
@@ -32985,13 +33018,13 @@ function writeResultOutboxEntry(config, entry) {
     lastAttemptAt: null,
     ...entry
   };
-  writeFileSync11(join15(dir, resultOutboxFileName(entry.commandId)), `${JSON.stringify(body, null, 2)}
+  writeFileSync11(join16(dir, resultOutboxFileName(entry.commandId)), `${JSON.stringify(body, null, 2)}
 `, { mode: 384 });
 }
 function moveResultOutboxEntryToInvalid(config, file, fullPath, reason, detail, original) {
   const invalidDir = resultOutboxInvalidDir(config);
   mkdirSync10(invalidDir, { recursive: true });
-  const invalidPath = join15(invalidDir, file);
+  const invalidPath = join16(invalidDir, file);
   if (original === void 0) {
     try {
       renameSync9(fullPath, invalidPath);
@@ -33058,7 +33091,7 @@ function quarantineResultOutboxEntry(config, fullPath, file, entry, reason, err)
     ...typeof err?.httpStatus === "number" ? { httpStatus: err.httpStatus } : {},
     lastError: truncateText(err instanceof Error ? err.message : String(err), 1e3)
   };
-  const invalidPath = join15(invalidDir, file);
+  const invalidPath = join16(invalidDir, file);
   writeFileSync11(invalidPath, `${JSON.stringify(body, null, 2)}
 `, { mode: 384 });
   try {
@@ -33077,7 +33110,7 @@ async function flushResultOutbox(config) {
   const files = readdirSync11(dir).filter((name) => name.endsWith(".json")).sort();
   let completed = 0;
   for (const file of files) {
-    const fullPath = join15(dir, file);
+    const fullPath = join16(dir, file);
     const entry = readValidResultOutboxEntryOrQuarantine(config, file, fullPath);
     if (!entry) continue;
     try {
@@ -33274,7 +33307,7 @@ async function materializeIssueAttachments(config, command, workspace) {
     runtimeAuth,
     issueId
   );
-  const targetDir = join15(workspace.cwd, "input-attachments");
+  const targetDir = join16(workspace.cwd, "input-attachments");
   mkdirSync10(targetDir, { recursive: true });
   const usedFilenames = /* @__PURE__ */ new Set();
   const materialized = [];
@@ -33289,7 +33322,7 @@ async function materializeIssueAttachments(config, command, workspace) {
       filename = `${stem}-${index + 1}${ext}`;
     }
     usedFilenames.add(filename);
-    const targetPath = join15(targetDir, filename);
+    const targetPath = join16(targetDir, filename);
     const body = await runtimeApiBuffer(runtimeAuth, contentPath);
     writeFileSync11(targetPath, body);
     const attachmentId = readString(attachment.id);
@@ -33365,7 +33398,7 @@ async function materializeRequiredArtifactInputs(config, command, workspace) {
   if (manifest.version !== 1 || !Array.isArray(manifest.entries)) {
     throw new Error("artifact_input_manifest_invalid: expected version 1 entries array");
   }
-  const targetRoot = join15(workspace.cwd, "input-artifacts");
+  const targetRoot = join16(workspace.cwd, "input-artifacts");
   rmSync9(targetRoot, { recursive: true, force: true });
   mkdirSync10(targetRoot, { recursive: true });
   const usedPaths = /* @__PURE__ */ new Set();
@@ -33396,15 +33429,15 @@ async function materializeRequiredArtifactInputs(config, command, workspace) {
       id: attachmentId,
       originalFilename: readString(entry.originalFilename)
     }, index);
-    let relativePath = join15("input-artifacts", sourceDir, filename).split(/[\\/]+/).join("/");
+    let relativePath = join16("input-artifacts", sourceDir, filename).split(/[\\/]+/).join("/");
     if (usedPaths.has(relativePath)) {
       const ext = extname3(filename);
       const stem = ext ? filename.slice(0, -ext.length) : filename;
       filename = `${stem}-${index + 1}${ext}`;
-      relativePath = join15("input-artifacts", sourceDir, filename).split(/[\\/]+/).join("/");
+      relativePath = join16("input-artifacts", sourceDir, filename).split(/[\\/]+/).join("/");
     }
     usedPaths.add(relativePath);
-    const targetPath = join15(workspace.cwd, relativePath);
+    const targetPath = join16(workspace.cwd, relativePath);
     mkdirSync10(dirname11(targetPath), { recursive: true });
     writeFileSync11(targetPath, body);
     chmodSync7(targetPath, 292);
@@ -33426,7 +33459,7 @@ async function materializeRequiredArtifactInputs(config, command, workspace) {
     version: 1,
     entries: materialized.map(({ path: _path, relativePath, ...entry }) => ({ ...entry, path: relativePath }))
   };
-  const manifestPath = join15(targetRoot, "artifact-input-manifest.json");
+  const manifestPath = join16(targetRoot, "artifact-input-manifest.json");
   writeFileSync11(manifestPath, JSON.stringify(localManifest, null, 2) + "\n");
   chmodSync7(manifestPath, 292);
   updateWorkspaceManifest(workspaceManifestPath(workspace), { artifactInputManifest: localManifest });
@@ -33437,7 +33470,7 @@ async function materializeRequiredArtifactInputs(config, command, workspace) {
   return materialized;
 }
 function issueCheckpointDir(workspace) {
-  return join15(dirname11(workspace.runDir), "checkpoint");
+  return join16(dirname11(workspace.runDir), "checkpoint");
 }
 async function clearIssueCheckpoint(config, command, workspace, reason) {
   const checkpointDir = issueCheckpointDir(workspace);
@@ -33459,7 +33492,7 @@ function hashFileSha256(filePath) {
 }
 async function materializeIssueCheckpoint(config, command, workspace) {
   const checkpointDir = issueCheckpointDir(workspace);
-  const manifestPath = join15(checkpointDir, "manifest.json");
+  const manifestPath = join16(checkpointDir, "manifest.json");
   if (!existsSync15(manifestPath)) return [];
   let manifest;
   try {
@@ -33476,8 +33509,8 @@ async function materializeIssueCheckpoint(config, command, workspace) {
   try {
     const files = Array.isArray(manifest.files) ? manifest.files : [];
     if (files.length > 20) throw new Error("issue checkpoint manifest exceeds the limit of 20 files");
-    const filesRoot = realpathSync6(join15(checkpointDir, "files"));
-    const workspaceRoot = realpathSync6(workspace.cwd);
+    const filesRoot = realpathSync7(join16(checkpointDir, "files"));
+    const workspaceRoot = realpathSync7(workspace.cwd);
     const validated = [];
     let totalBytes = 0;
     for (const rawFile of files) {
@@ -33490,7 +33523,7 @@ async function materializeIssueCheckpoint(config, command, workspace) {
         throw new Error(`issue checkpoint path escapes its workspace: ${relativePath}`);
       }
       if (!existsSync15(sourceCandidate)) throw new Error(`issue checkpoint file is missing: ${relativePath}`);
-      const source = realpathSync6(sourceCandidate);
+      const source = realpathSync7(sourceCandidate);
       if (!pathWithin3(source, filesRoot) || !statSync9(source).isFile()) {
         throw new Error(`issue checkpoint source escapes its storage root: ${relativePath}`);
       }
@@ -33515,7 +33548,7 @@ async function materializeIssueCheckpoint(config, command, workspace) {
         if (err?.code !== "ENOENT") throw err;
       }
       mkdirSync10(dirname11(target), { recursive: true });
-      const targetParent = realpathSync6(dirname11(target));
+      const targetParent = realpathSync7(dirname11(target));
       if (!pathWithin3(targetParent, workspaceRoot)) {
         throw new Error(`issue checkpoint target escapes its workspace: ${relativePath}`);
       }
@@ -33543,17 +33576,17 @@ async function materializeIssueCheckpoint(config, command, workspace) {
 }
 async function saveIssueCheckpoint(config, command, workspace, candidates) {
   const checkpointDir = issueCheckpointDir(workspace);
-  const filesDir = join15(checkpointDir, "files");
+  const filesDir = join16(checkpointDir, "files");
   rmSync9(checkpointDir, { recursive: true, force: true });
   mkdirSync10(filesDir, { recursive: true });
   const files = [];
   let totalBytes = 0;
-  const workspaceRoot = realpathSync6(workspace.cwd);
+  const workspaceRoot = realpathSync7(workspace.cwd);
   for (const candidate of candidates.slice(0, 20)) {
     const relativePath = safeCheckpointRelativePath(candidate.rawPath);
     const source = readString(candidate.filePath);
     if (!relativePath || !source || !existsSync15(source) || !statSync9(source).isFile()) continue;
-    const ownedSource = realpathSync6(source);
+    const ownedSource = realpathSync7(source);
     if (!pathWithin3(ownedSource, workspaceRoot)) {
       throw new Error(`issue checkpoint source escapes its execution workspace: ${relativePath}`);
     }
@@ -33579,7 +33612,7 @@ async function saveIssueCheckpoint(config, command, workspace, candidates) {
     totalBytes,
     files
   };
-  writeFileSync11(join15(checkpointDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
+  writeFileSync11(join16(checkpointDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
 `);
   await ingestLog(config, command, "system", "warn", `Saved ${files.length} required deliverable(s) for continuation recovery`, manifest);
   return manifest;
@@ -33637,7 +33670,8 @@ async function executeRunCommand(config, command) {
   const workspaceProjectInstructionReceipt = projectExternalWorkspaceProjectInstructions(
     workspace.sourceWorkspacePath,
     workspace.cwd,
-    readString(asRecord(contextContract.instructions.files)["AGENTS.md"])
+    readString(asRecord(contextContract.instructions.files)["AGENTS.md"]),
+    { managedWorkspacesRoot: config.runtimeWorkspacesRoot }
   );
   const finalAgentInstructionFiles = new Map(
     materializedAgentInstructions.map((entry) => [entry.path, entry])
@@ -33729,7 +33763,7 @@ async function executeRunCommand(config, command) {
           executorCommand: invocation.command,
           executorHome: workspace.executorHome,
           runDir: workspace.runDir,
-          runtimeCacheRoot: join15(dirname11(config.daemonStateFile), "cache"),
+          runtimeCacheRoot: join16(dirname11(config.daemonStateFile), "cache"),
           cwd,
           runtimeAuth: commandRuntimeAuth(command),
           nativeSession: asRecord(asRecord(command.payload).nativeSession),

package/dist/amaster-runtime.mjs

@@ -6,7 +6,7 @@ import { basename, dirname, join, resolve } from "node:path";
 import { homedir, hostname } from "node:os";
 import { fileURLToPath } from "node:url";
 
-const CONNECTOR_VERSION = "0.1.1-beta.124";
+const CONNECTOR_VERSION = "0.1.1-beta.125";
 
 const CAPABILITIES = [
   "remote_registration",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amaster.ai/employee-runtime-connector",
-  "version": "0.1.1-beta.124",
+  "version": "0.1.1-beta.125",
   "description": "MirrorX runtime connector CLI and daemon",
   "license": "MIT",
   "type": "module",