@amaster.ai/employee-runtime-connector 0.1.1-beta.131 → 0.1.1-beta.132

package/README.md

@@ -12,8 +12,7 @@ For production images, install an exact version and invoke the package bin:
 
 ```sh
 npm install --omit=dev --prefix /opt/pi-cli-runtime @amaster.ai/employee-runtime-connector@0.1.0
-/opt/pi-cli-runtime/node_modules/.bin/amaster-runtime setup https://employee.example.com \
-  --capabilities remote_registration,heartbeat,executor_discovery,workspace_binding,run_wakeup,context_envelope_v1,managed_project_instructions_v1,final_model_context_attestation_v1,runtime_actions_v2,run_exit_live_path_closure_v1,model_call,model_call_output_contract_v1,run_cancel,run_terminate,logs_cost_workspace_status
+/opt/pi-cli-runtime/node_modules/.bin/amaster-runtime setup https://employee.example.com
 /opt/pi-cli-runtime/node_modules/.bin/amaster-runtime daemon start --foreground
 ```
 
@@ -21,6 +20,15 @@ Do not use `latest`, `^`, or `~` in a runtime image. The image tag and connector
 
 Immutable images should pin an exact package version as their baseline. The current connector does not download or replace runtime code while running; package upgrades and rollbacks belong to the image build and rollout.
 
+Connector capability declaration is automatic. The exact package build declares
+what it implements, and runtime readiness removes dynamic capabilities when their
+executor or supporting runtime is unavailable. Operators restrict what the Server
+accepts with `AMASTER_RUNTIME_CONNECTOR_CAPABILITY_ALLOWLIST`; users do not need to
+configure a connector-local capability list. Historical `AMASTER_CAPABILITIES` and
+`--capabilities` inputs remain accepted for rollback compatibility in this release,
+but are ignored and reported as deprecated. They cannot add, remove, or authorize a
+capability.
+
 The publish workflow verifies that npm records the publishing commit as the package `gitHead`, then updates the repository deployment pin. Remote deployment accepts that package only when its `gitHead` is an ancestor of the target source commit and the connector runtime build inputs are unchanged between them. Those inputs are the package path plus `packages/shared/src/source-acquisition-compatibility.json`, which is copied into the published package and bundled into the daemon. If another workspace source becomes a runtime build input, expand the provenance scope and tests before release. After restart, deployment also verifies the package CLI version inside the container. Do not update the deployment pin manually to bypass either provenance check.
 
 ## Package Contents

package/dist/amaster-runtime-daemon/capability-registry.mjs

@@ -0,0 +1,66 @@
+export const BUILD_SUPPORTED_CAPABILITIES = Object.freeze([
+  "remote_registration",
+  "heartbeat",
+  "executor_discovery",
+  "workspace_binding",
+  "run_wakeup",
+  "context_envelope_v1",
+  "managed_project_instructions_v1",
+  "final_model_context_attestation_v1",
+  "runtime_actions_v2",
+  "run_exit_live_path_closure_v1",
+  "model_call",
+  "model_call_output_contract_v1",
+  "run_cancel",
+  "run_terminate",
+  "logs_cost_workspace_status",
+  "source_acquisition_v1",
+  "headed_browser_auth",
+]);
+
+const DYNAMIC_READINESS = Object.freeze({
+  final_model_context_attestation_v1: {
+    reasonCode: "managed_pi_executor_required",
+    ready: (input) => input.runnerKind === "cloud_managed"
+      && input.executors.some((executor) => executor.kind === "pi"),
+  },
+  source_acquisition_v1: {
+    reasonCode: "source_acquisition_not_ready",
+    ready: (input) => input.sourceAcquisition?.ready === true,
+  },
+  headed_browser_auth: {
+    reasonCode: "headed_browser_runtime_not_ready",
+    ready: (input) => input.browserSessionBroker?.ready === true,
+  },
+});
+
+function uniqueStrings(values) {
+  return Array.from(new Set((Array.isArray(values) ? values : [])
+    .map((value) => String(value ?? "").trim())
+    .filter(Boolean)));
+}
+
+export function buildRuntimeCapabilityReport(input) {
+  const legacyConfiguredCapabilities = uniqueStrings(input.legacyConfiguredCapabilities);
+  const runtimeUnavailable = [];
+  const advertised = BUILD_SUPPORTED_CAPABILITIES.filter((capability) => {
+    const readiness = DYNAMIC_READINESS[capability];
+    if (!readiness || readiness.ready(input)) return true;
+    runtimeUnavailable.push({ capability, reasonCode: readiness.reasonCode });
+    return false;
+  });
+  const buildSet = new Set(BUILD_SUPPORTED_CAPABILITIES);
+  const legacySet = new Set(legacyConfiguredCapabilities);
+  return {
+    schemaVersion: "mirrorx.connector-capability-report/v1",
+    source: "build_attested",
+    buildSupported: [...BUILD_SUPPORTED_CAPABILITIES],
+    runtimeUnavailable,
+    advertised,
+    deprecatedCapabilityOverridePresent: legacyConfiguredCapabilities.length > 0,
+    legacyMissingFromBuildTruth: legacyConfiguredCapabilities.length > 0
+      ? BUILD_SUPPORTED_CAPABILITIES.filter((capability) => !legacySet.has(capability))
+      : [],
+    legacyUnsupportedClaims: legacyConfiguredCapabilities.filter((capability) => !buildSet.has(capability)),
+  };
+}

package/dist/amaster-runtime-daemon.mjs

@@ -4666,6 +4666,52 @@ var AMASTER_RUNTIME_CONNECTOR_CAPABILITIES = [
   "headed_browser_auth",
   "browser_auth_relay_outbound_e0"
 ];
+var TERMINAL_BUSINESS_RECONCILIATION_VERSION = "mirrorx.terminal-business-reconciliation/v1";
+var terminalBusinessReconciliationAuthoritySnapshotSchema = external_exports.object({
+  outcomeId: external_exports.string().uuid().nullable(),
+  outcomeRevision: external_exports.number().int().positive().nullable(),
+  businessRevision: external_exports.number().int().positive().nullable(),
+  manifestId: external_exports.string().uuid().nullable(),
+  manifestRevision: external_exports.number().int().positive().nullable()
+}).strict();
+var terminalBusinessReconciliationSchema = external_exports.discriminatedUnion("outcome", [
+  external_exports.object({
+    outcome: external_exports.literal("finalized"),
+    issueStatus: external_exports.literal("done"),
+    acceptanceId: external_exports.string().uuid()
+  }).strict(),
+  external_exports.object({
+    outcome: external_exports.literal("review_pending"),
+    interactionId: external_exports.string().uuid()
+  }).strict(),
+  external_exports.object({
+    outcome: external_exports.literal("live_path_owned"),
+    owner: external_exports.string().trim().min(1),
+    reasonCode: external_exports.string().trim().min(1)
+  }).strict(),
+  external_exports.object({
+    outcome: external_exports.literal("recoverable_missing_disposition"),
+    reasonCode: external_exports.string().trim().min(1)
+  }).strict(),
+  external_exports.object({
+    outcome: external_exports.literal("blocked_by_gate"),
+    owner: external_exports.string().trim().min(1),
+    reasonCode: external_exports.string().trim().min(1)
+  }).strict(),
+  external_exports.object({
+    outcome: external_exports.literal("missing_authority"),
+    reasonCode: external_exports.string().trim().min(1)
+  }).strict()
+]);
+var terminalBusinessReconciliationEnvelopeSchema = external_exports.object({
+  schemaVersion: external_exports.literal(TERMINAL_BUSINESS_RECONCILIATION_VERSION),
+  decisionKey: external_exports.string().regex(/^sha256:[a-f0-9]{64}$/),
+  commandId: external_exports.string().uuid(),
+  runId: external_exports.string().uuid(),
+  executionEpoch: external_exports.number().int().positive(),
+  authoritySnapshot: terminalBusinessReconciliationAuthoritySnapshotSchema,
+  decision: terminalBusinessReconciliationSchema
+}).strict();
 var MIRRORX_RUNTIME_CONTEXT_ENVELOPE_VERSION = "mirrorx.context-envelope.v1";
 var mirrorxEffectiveInstructionsSchema = external_exports.object({
   schemaVersion: external_exports.literal("mirrorx.project-instructions.v1"),
@@ -24080,7 +24126,9 @@ function agentInstructionDeliveryAudit(bundle, delivery) {
 import { existsSync as existsSync8, mkdirSync as mkdirSync6, readFileSync as readFileSync10, renameSync as renameSync7, rmSync as rmSync6, writeFileSync as writeFileSync8 } from "node:fs";
 import { homedir as homedir2, hostname } from "node:os";
 import { dirname as dirname7, join as join9 } from "node:path";
-var CAPABILITIES = [
+
+// src/amaster-runtime-daemon/capability-registry.mjs
+var BUILD_SUPPORTED_CAPABILITIES = Object.freeze([
   "remote_registration",
   "heartbeat",
   "executor_discovery",
@@ -24096,8 +24144,50 @@ var CAPABILITIES = [
   "run_cancel",
   "run_terminate",
   "logs_cost_workspace_status",
-  "source_acquisition_v1"
-];
+  "source_acquisition_v1",
+  "headed_browser_auth"
+]);
+var DYNAMIC_READINESS = Object.freeze({
+  final_model_context_attestation_v1: {
+    reasonCode: "managed_pi_executor_required",
+    ready: (input) => input.runnerKind === "cloud_managed" && input.executors.some((executor) => executor.kind === "pi")
+  },
+  source_acquisition_v1: {
+    reasonCode: "source_acquisition_not_ready",
+    ready: (input) => input.sourceAcquisition?.ready === true
+  },
+  headed_browser_auth: {
+    reasonCode: "headed_browser_runtime_not_ready",
+    ready: (input) => input.browserSessionBroker?.ready === true
+  }
+});
+function uniqueStrings2(values) {
+  return Array.from(new Set((Array.isArray(values) ? values : []).map((value) => String(value ?? "").trim()).filter(Boolean)));
+}
+function buildRuntimeCapabilityReport(input) {
+  const legacyConfiguredCapabilities = uniqueStrings2(input.legacyConfiguredCapabilities);
+  const runtimeUnavailable = [];
+  const advertised = BUILD_SUPPORTED_CAPABILITIES.filter((capability) => {
+    const readiness = DYNAMIC_READINESS[capability];
+    if (!readiness || readiness.ready(input)) return true;
+    runtimeUnavailable.push({ capability, reasonCode: readiness.reasonCode });
+    return false;
+  });
+  const buildSet = new Set(BUILD_SUPPORTED_CAPABILITIES);
+  const legacySet = new Set(legacyConfiguredCapabilities);
+  return {
+    schemaVersion: "mirrorx.connector-capability-report/v1",
+    source: "build_attested",
+    buildSupported: [...BUILD_SUPPORTED_CAPABILITIES],
+    runtimeUnavailable,
+    advertised,
+    deprecatedCapabilityOverridePresent: legacyConfiguredCapabilities.length > 0,
+    legacyMissingFromBuildTruth: legacyConfiguredCapabilities.length > 0 ? BUILD_SUPPORTED_CAPABILITIES.filter((capability) => !legacySet.has(capability)) : [],
+    legacyUnsupportedClaims: legacyConfiguredCapabilities.filter((capability) => !buildSet.has(capability))
+  };
+}
+
+// src/amaster-runtime-daemon/config-state.mjs
 var RUNNER_KIND_CLOUD_MANAGED = "cloud_managed";
 var RUNNER_KIND_DESKTOP_DELEGATED = "desktop_delegated";
 function readEnum(value, allowed, fallback, label) {
@@ -24279,7 +24369,8 @@ function buildConfig(env = process.env, flags = {}) {
     piExecutorUid,
     piExecutorGid,
     runnerKind,
-    capabilities: splitList(flags.capabilities ?? env.AMASTER_CAPABILITIES ?? CAPABILITIES.join(",")),
+    capabilities: [...BUILD_SUPPORTED_CAPABILITIES],
+    legacyConfiguredCapabilities: splitList(flags.capabilities ?? env.AMASTER_CAPABILITIES ?? ""),
     pollIntervalSeconds: Number(flags.pollIntervalSeconds ?? env.AMASTER_POLL_INTERVAL_SECONDS ?? 10),
     maxConcurrentCommands: Math.min(
       parsePositiveInteger(flags.maxConcurrentCommands ?? env.AMASTER_MAX_CONCURRENT_COMMANDS, 1),
@@ -28670,7 +28761,7 @@ function createSourceCompletionStopPolicy({
 }
 
 // src/amaster-runtime-daemon.mjs
-var CONNECTOR_VERSION = "0.1.1-beta.131";
+var CONNECTOR_VERSION = "0.1.1-beta.132";
 var CONNECTOR_CONTRACT_VERSION = "2026-06-04.v1";
 var SOURCE_ACQUISITION_CAPABILITY2 = source_acquisition_compatibility_default.profileVersion;
 var daemonRequire = createRequire(import.meta.url);
@@ -29333,12 +29424,19 @@ function browserSessionRuntimeStatus(config) {
   return broker ? { ...readiness, ...broker.status() } : readiness;
 }
 function runtimeAdvertisedCapabilities(config, sourceAcquisition, browserSessionBroker) {
-  return config.capabilities.filter((capability) => (capability !== "headed_browser_auth" || browserSessionBroker.ready === true) && (capability !== SOURCE_ACQUISITION_CAPABILITY2 || sourceAcquisition.ready === true) && (capability !== "final_model_context_attestation_v1" || config.runnerKind === RUNNER_KIND_CLOUD_MANAGED && config.executors.some((executor) => executor.kind === "pi")));
+  return buildRuntimeCapabilityReport({
+    legacyConfiguredCapabilities: config.legacyConfiguredCapabilities,
+    sourceAcquisition,
+    browserSessionBroker,
+    runnerKind: config.runnerKind,
+    executors: config.executors
+  });
 }
 function buildRegisterPayload(config) {
   const buildCommit = readString(process.env.AMASTER_RUNTIME_BUILD_COMMIT ?? process.env.AMASTER_SOURCE_COMMIT);
   const sourceAcquisition = sourceAcquisitionRuntimeReadiness(config);
   const browserSessionBroker = browserSessionRuntimeReadiness(config);
+  const capabilityReport = runtimeAdvertisedCapabilities(config, sourceAcquisition, browserSessionBroker);
   return {
     ...config.companyId ? { companyId: config.companyId } : {},
     connectorName: config.connectorName,
@@ -29346,7 +29444,7 @@ function buildRegisterPayload(config) {
     workspaceBindings: config.workspaceBindings,
     networkDomains: config.networkDomains,
     executors: config.executors,
-    capabilities: runtimeAdvertisedCapabilities(config, sourceAcquisition, browserSessionBroker),
+    capabilities: capabilityReport.advertised,
     contractVersion: CONNECTOR_CONTRACT_VERSION,
     connectorVersion: CONNECTOR_VERSION,
     ...buildCommit ? { buildCommit } : {},
@@ -29359,7 +29457,12 @@ function buildRegisterPayload(config) {
       authMode: config.token ? "bearer_token" : config.authHeader ? "custom_header" : "none",
       platform: process.platform,
       arch: process.arch,
-      node: process.version
+      node: process.version,
+      capabilityReport: {
+        ...capabilityReport,
+        connectorVersion: CONNECTOR_VERSION,
+        ...buildCommit ? { connectorDigest: `build:${buildCommit}` } : {}
+      }
     }
   };
 }
@@ -29393,6 +29496,7 @@ function buildHeartbeatPayload(config, options = {}) {
   const executorReadiness = buildExecutorReadiness(config);
   const sourceAcquisition = sourceAcquisitionRuntimeReadiness(config);
   const browserSessionBroker = browserSessionRuntimeStatus(config);
+  const capabilityReport = runtimeAdvertisedCapabilities(config, sourceAcquisition, browserSessionBroker);
   const status = options.status === "offline" ? "offline" : "online";
   const daemonStatus = status === "offline" ? "stopping" : "running";
   return {
@@ -29400,7 +29504,7 @@ function buildHeartbeatPayload(config, options = {}) {
     workspaceBindings: config.workspaceBindings,
     networkDomains: config.networkDomains,
     executors: config.executors,
-    capabilities: runtimeAdvertisedCapabilities(config, sourceAcquisition, browserSessionBroker),
+    capabilities: capabilityReport.advertised,
     connectorVersion: CONNECTOR_VERSION,
     ...buildCommit ? { buildCommit } : {},
     contractVersion: CONNECTOR_CONTRACT_VERSION,
@@ -29426,7 +29530,12 @@ function buildHeartbeatPayload(config, options = {}) {
       ...versionDrift.versionDrift || versionDrift.bundleDrift ? versionDrift : {}
     },
     metadata: {
-      authMode: config.token ? "bearer_token" : config.authHeader ? "custom_header" : "none"
+      authMode: config.token ? "bearer_token" : config.authHeader ? "custom_header" : "none",
+      capabilityReport: {
+        ...capabilityReport,
+        connectorVersion: CONNECTOR_VERSION,
+        ...buildCommit ? { connectorDigest: `build:${buildCommit}` } : {}
+      }
     }
   };
 }
@@ -29593,7 +29702,6 @@ AMASTER_CONNECTOR_NAME=${quoteShell(config.connectorName)}
 AMASTER_MACHINE_ID=${quoteShell(config.machineId)}
 AMASTER_WORKSPACE_ALLOWLIST=${quoteShell(config.workspaceBindings.join(","))}
 AMASTER_EXECUTORS=${quoteShell(executorEnv)}
-AMASTER_CAPABILITIES=${quoteShell(config.capabilities.join(","))}
 AMASTER_NETWORK_DOMAINS=${quoteShell(config.networkDomains.join(","))}
 AMASTER_DAEMON_STATE_FILE=${quoteShell(join16(homedir3(), ".amaster-employee", "runtime-connector-state.json"))}
 EOF
@@ -34508,6 +34616,7 @@ async function executeRunCommand(config, command) {
       parsed.errorMessage = null;
     }
     if (succeeded && managedMcpProfile && Array.isArray(command.requiredCapabilities) && command.requiredCapabilities.includes("runtime_actions_v2")) {
+      const usesLivePathClosureContract = command.requiredCapabilities.includes("run_exit_live_path_closure_v1");
       const productiveSuccessfulRun = outputTelemetry.meaningfulProgressEventCount > 0 || runtimeArtifacts.length > 0 || mcpToolResults.some((toolResult) => ["succeeded", "approval_required"].includes(readString(toolResult.status)));
       let completionState = createRunCompletionState({
         connectorId: requireConnectorId(config),
@@ -34540,13 +34649,13 @@ async function executeRunCommand(config, command) {
           }
         },
         completionRequest: {
-          contractVersion: config.capabilities.includes("run_exit_live_path_closure_v1") ? "amaster.runtime-connector.completion-check.v2" : "amaster.runtime-connector.completion-check.v1",
+          contractVersion: usesLivePathClosureContract ? "amaster.runtime-connector.completion-check.v2" : "amaster.runtime-connector.completion-check.v1",
           leaseId: command.leaseId,
           proposedStatus: "succeeded",
           resultSignals: {
             productiveSuccessfulRun,
             executorTurnCount: terminalTextRepairUsageBreakdown ? 2 : 1,
-            ...config.capabilities.includes("run_exit_live_path_closure_v1") ? {
+            ...usesLivePathClosureContract ? {
               closureAttempts: {
                 workDisposition: 0,
                 livePath: 0,
@@ -34893,7 +35002,7 @@ Commands:
 
 Key env:
   AMASTER_EMPLOYEE_SERVER_URL, AMASTER_CONNECTOR_TOKEN or AMASTER_CONNECTOR_AUTH_HEADER,
-  AMASTER_WORKSPACE_ALLOWLIST, AMASTER_EXECUTORS, AMASTER_CAPABILITIES,
+  AMASTER_WORKSPACE_ALLOWLIST, AMASTER_EXECUTORS,
   AMASTER_NETWORK_DOMAINS, AMASTER_CONNECTOR_ID, AMASTER_DAEMON_STATE_FILE,
   AMASTER_MAX_CONCURRENT_COMMANDS, AMASTER_EXECUTOR_MAX_RSS_MB (default 0, disabled),
   AMASTER_RUNTIME_ORPHAN_REAPER_INTERVAL_SECONDS (default 300, set 0 to disable),
@@ -34903,6 +35012,11 @@ Key env:
 async function main() {
   const { command, flags } = parseArgs(process.argv.slice(2));
   const config = buildConfig(process.env, flags);
+  if (config.legacyConfiguredCapabilities.length > 0) {
+    process.stderr.write(
+      "Warning: AMASTER_CAPABILITIES/--capabilities is deprecated and ignored; use the Server capability allowlist for operator restrictions.\n"
+    );
+  }
   switch (command) {
     case "config-template":
       printInstall(config);

package/dist/amaster-runtime.mjs

@@ -5,26 +5,9 @@ import { randomUUID } from "node:crypto";
 import { basename, dirname, join, resolve } from "node:path";
 import { homedir, hostname } from "node:os";
 import { fileURLToPath } from "node:url";
+import { BUILD_SUPPORTED_CAPABILITIES } from "./amaster-runtime-daemon/capability-registry.mjs";
 
-const CONNECTOR_VERSION = "0.1.1-beta.131";
-
-const CAPABILITIES = [
-  "remote_registration",
-  "heartbeat",
-  "executor_discovery",
-  "workspace_binding",
-  "run_wakeup",
-  "context_envelope_v1", "managed_project_instructions_v1",
-  "final_model_context_attestation_v1",
-  "runtime_actions_v2",
-  "run_exit_live_path_closure_v1",
-  "model_call",
-  "model_call_output_contract_v1",
-  "run_cancel",
-  "run_terminate",
-  "logs_cost_workspace_status",
-  "source_acquisition_v1",
-];
+const CONNECTOR_VERSION = "0.1.1-beta.132";
 
 const CONFIG_KEY_MAP = new Map([
   ["server_url", "AMASTER_EMPLOYEE_SERVER_URL"],
@@ -257,7 +240,6 @@ function withDefaults(config) {
     AMASTER_CONNECTOR_NAME: `${hostname()}-amaster`,
     AMASTER_MACHINE_ID: defaultMachineId(),
     AMASTER_WORKSPACE_ALLOWLIST: runtimeWorkspacesRoot,
-    AMASTER_CAPABILITIES: CAPABILITIES.join(","),
     AMASTER_NETWORK_DOMAINS: "self-host",
     AMASTER_DAEMON_STATE_FILE: join(configDir, "runtime-connector-state.json"),
     AMASTER_RUNTIME_WORKSPACES_ROOT: runtimeWorkspacesRoot,
@@ -463,7 +445,8 @@ function printConfig(config) {
     ["runner_kind", merged.AMASTER_RUNTIME_RUNNER_KIND || "cloud_managed"],
     ["heartbeat_log_mode", merged.AMASTER_HEARTBEAT_LOG_MODE || "(compact)"],
     ["network_domains", merged.AMASTER_NETWORK_DOMAINS],
-    ["capabilities", merged.AMASTER_CAPABILITIES],
+    ["capability_source", `connector build (${BUILD_SUPPORTED_CAPABILITIES.length}) + runtime readiness`],
+    ["legacy_capabilities", merged.AMASTER_CAPABILITIES ? "(deprecated; ignored)" : "(none)"],
     ["state_file", merged.AMASTER_DAEMON_STATE_FILE],
     ["env_file", envFile],
   ];
@@ -498,7 +481,12 @@ function commandSetup(argv) {
   config.AMASTER_MACHINE_ID = flags.machine_id || defaultConfig.AMASTER_MACHINE_ID;
   config.AMASTER_RUNTIME_WORKSPACES_ROOT = flags.runtime_workspaces_root || defaultConfig.AMASTER_RUNTIME_WORKSPACES_ROOT;
   config.AMASTER_WORKSPACE_ALLOWLIST = flags.workspace_allowlist || flags.workspace || defaultConfig.AMASTER_WORKSPACE_ALLOWLIST;
-  config.AMASTER_CAPABILITIES = flags.capabilities || defaultConfig.AMASTER_CAPABILITIES;
+  if (flags.capabilities) {
+    config.AMASTER_CAPABILITIES = flags.capabilities;
+    process.stderr.write(
+      "Warning: --capabilities is deprecated and ignored; restrict accepted capabilities with the Server allowlist.\n",
+    );
+  }
   config.AMASTER_NETWORK_DOMAINS = flags.network_domains || defaultConfig.AMASTER_NETWORK_DOMAINS;
   config.AMASTER_DAEMON_STATE_FILE = flags.state_file || defaultConfig.AMASTER_DAEMON_STATE_FILE;
   if (flags.executors) config.AMASTER_EXECUTORS = flags.executors;
@@ -528,6 +516,11 @@ function commandConfig(argv) {
   const envKey = envKeyFor(key);
   const value = valueParts.join(" ").trim();
   config[envKey] = envKey === "AMASTER_EMPLOYEE_SERVER_URL" ? normalizeServerUrl(value) : value;
+  if (envKey === "AMASTER_CAPABILITIES") {
+    process.stderr.write(
+      "Warning: connector-local capabilities are deprecated and ignored; restrict accepted capabilities with the Server allowlist.\n",
+    );
+  }
   writeConfig(config);
   process.stdout.write(`${normalizeKey(key)} updated\n`);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amaster.ai/employee-runtime-connector",
-  "version": "0.1.1-beta.131",
+  "version": "0.1.1-beta.132",
   "description": "MirrorX runtime connector CLI and daemon",
   "license": "MIT",
   "type": "module",