@amaster.ai/employee-runtime-connector 0.1.1-beta.14 → 0.1.1-beta.15

package/README.md

@@ -51,6 +51,14 @@ An enforced stop returns `pi_tool_argument_stream_amplification` with
 byte counts, ratios, event/tool identity, thresholds, and near-miss distances;
 it omits the inline argument body.
 
+Pi JSON mode can also repeat a cumulative `message` snapshot beside each
+incremental `message_update`. The daemon compacts only that redundant snapshot
+from its retained parse/result buffer while preserving the delta, terminal
+events, live logs, and tool-argument guard input. Output telemetry reports both
+`rawOutputBytes` and `retainedOutputBytes` plus `retentionCompactedBytes`; flood
+limits continue to use raw bytes, so retention compaction never hides transport
+pressure or weakens the 50 MiB safety boundary.
+
 ## Pi terminal cleanup outcome
 
 Pi execution uses three separate evidence layers:

package/dist/amaster-runtime-daemon.mjs

@@ -244,6 +244,49 @@ function createPiToolArgumentAmplificationTracker(options = {}) {
   };
 }
 
+// src/amaster-runtime-daemon/pi-output-retention.mjs
+function record2(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function compactIncrementalEvent(event) {
+  if (event.type !== "message_update") return null;
+  const assistantEvent = record2(event.assistantMessageEvent);
+  const type = typeof assistantEvent.type === "string" ? assistantEvent.type : "";
+  if (!type.endsWith("_delta") && type !== "text_end") return null;
+  const compact = { type: "message_update", assistantMessageEvent: { type } };
+  if (typeof assistantEvent.delta === "string") compact.assistantMessageEvent.delta = assistantEvent.delta;
+  if (typeof assistantEvent.content === "string") compact.assistantMessageEvent.content = assistantEvent.content;
+  return compact;
+}
+function compactPiOutputRetentionLine(line) {
+  const text = String(line ?? "");
+  const trimmed = text.trim();
+  if (!trimmed.startsWith("{")) return text;
+  try {
+    const compact = compactIncrementalEvent(JSON.parse(trimmed));
+    return compact ? JSON.stringify(compact) : text;
+  } catch {
+    return text;
+  }
+}
+function createPiOutputRetentionCompactor() {
+  let buffer = "";
+  return {
+    write(chunk) {
+      const combined = `${buffer}${String(chunk ?? "")}`;
+      const lines = combined.split(/\r?\n/);
+      buffer = lines.pop() ?? "";
+      return lines.map(compactPiOutputRetentionLine).join("\n") + (lines.length > 0 ? "\n" : "");
+    },
+    flush() {
+      if (!buffer) return "";
+      const retained = compactPiOutputRetentionLine(buffer);
+      buffer = "";
+      return retained;
+    }
+  };
+}
+
 // src/amaster-runtime-daemon/codex-managed-mcp-profile.mjs
 import { createHash } from "node:crypto";
 import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
@@ -1129,7 +1172,7 @@ var SAFE_SHARED_PROVIDER_INTEGER_KEYS = /* @__PURE__ */ new Set([
   "websocket_connect_timeout_ms"
 ]);
 var BUILT_IN_MODEL_PROVIDERS = /* @__PURE__ */ new Set(["openai", "amazon-bedrock", "ollama", "lmstudio"]);
-function record2(value) {
+function record3(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
 function nonEmpty(value, label) {
@@ -1176,7 +1219,7 @@ function findSessionRollout(sessionsRoot, sessionId) {
   return matches[0];
 }
 function restoreManagedCodexSessionRollout(input, codexHome, runDir, executorHome, authority) {
-  const session = record2(input.nativeSession);
+  const session = record3(input.nativeSession);
   if (session.mode !== "governed_action_approval" || session.required !== true) return null;
   const sessionId = nonEmpty(session.sessionId, "nativeSession.sessionId");
   const sourceRunId = nonEmpty(session.sourceRunId, "nativeSession.sourceRunId");
@@ -1245,14 +1288,14 @@ function sharedCodexModelRoute(sourceHome) {
   }
   const providerId = config.model_provider;
   if (!providerId) return { root, table: [], mode: config.model ? "shared_model" : "default", protectedValues: [] };
-  const selectedProvider = record2(config.model_providers)[providerId];
+  const selectedProvider = record3(config.model_providers)[providerId];
   if (selectedProvider == null) {
     if (!BUILT_IN_MODEL_PROVIDERS.has(providerId)) {
       throw new Error(`codex_managed_mcp_source_provider_missing: ${providerId}`);
     }
     return { root, table: [], mode: "shared_builtin_provider", protectedValues: [] };
   }
-  if (Object.keys(record2(selectedProvider)).length === 0) {
+  if (Object.keys(record3(selectedProvider)).length === 0) {
     throw new Error(`codex_managed_mcp_provider_config_invalid: model_providers.${providerId} must be a non-empty table`);
   }
   const projectedProvider = {};
@@ -1283,7 +1326,7 @@ function sharedCodexModelRoute(sourceHome) {
       continue;
     }
     if (key === "http_headers") {
-      const headers = record2(value);
+      const headers = record3(value);
       if (Object.keys(headers).length === 0 || Object.values(headers).some((entry) => typeof entry !== "string")) {
         throw new Error("codex_managed_mcp_provider_config_invalid: http_headers must be a non-empty string table");
       }
@@ -1327,18 +1370,18 @@ function runAttestation(executorCommand, env, cwd, gatewayUrl, expectedHeaders)
   if (!Array.isArray(servers) || servers.length !== 1) {
     throw new Error(`codex_managed_mcp_attestation_failed: expected one MCP server, received ${Array.isArray(servers) ? servers.length : "non_array"}`);
   }
-  const server = record2(servers[0]);
-  const transport = record2(server.transport);
-  const effectiveHeaders = record2(transport.http_headers);
+  const server = record3(servers[0]);
+  const transport = record3(server.transport);
+  const effectiveHeaders = record3(transport.http_headers);
   const headersMatch = Object.keys(effectiveHeaders).length === Object.keys(expectedHeaders).length && Object.entries(expectedHeaders).every(([name, value]) => effectiveHeaders[name] === value);
-  if (server.name !== SUPPORTED_SERVER_NAME || server.enabled !== true || transport.type !== "streamable_http" || transport.url !== gatewayUrl || !headersMatch || Object.keys(record2(transport.env_http_headers)).length !== 0 || transport.bearer_token_env_var != null) {
+  if (server.name !== SUPPORTED_SERVER_NAME || server.enabled !== true || transport.type !== "streamable_http" || transport.url !== gatewayUrl || !headersMatch || Object.keys(record3(transport.env_http_headers)).length !== 0 || transport.bearer_token_env_var != null) {
     throw new Error("codex_managed_mcp_attestation_failed: effective MCP config does not match managed amaster Gateway");
   }
   return executorVersion;
 }
 function validateAuthority(input) {
-  const runtimeAuth = record2(input.runtimeAuth);
-  const gateway = record2(runtimeAuth.governedMcp);
+  const runtimeAuth = record3(input.runtimeAuth);
+  const gateway = record3(runtimeAuth.governedMcp);
   const runId = nonEmpty(input.runId, "runId");
   if (runtimeAuth.runId !== runId) throw new Error("codex_managed_mcp_owner_mismatch: command runId does not match runtime authority");
   if (gateway.schemaVersion !== SUPPORTED_SCHEMA_VERSION) throw new Error("codex_managed_mcp_invalid: unsupported schema version");
@@ -1354,7 +1397,7 @@ function validateAuthority(input) {
   if (!Number.isFinite(expiresAt) || expiresAt <= Date.now() + 3e4) {
     throw new Error("codex_managed_mcp_session_expired: Gateway session must remain valid through spawn preflight");
   }
-  const headers = record2(gateway.headers);
+  const headers = record3(gateway.headers);
   for (const name of REQUIRED_AUTHORITY_HEADERS) nonEmpty(headers[name], `headers.${name}`);
   const allowedHeaderNames = /* @__PURE__ */ new Set([...REQUIRED_AUTHORITY_HEADERS, ...runtimeAuth.issueId ? ["x-amaster-issue-id"] : []]);
   if (Object.keys(headers).some((name) => !allowedHeaderNames.has(name)) || Object.keys(headers).length !== allowedHeaderNames.size) {
@@ -1371,7 +1414,7 @@ function validateAuthority(input) {
   return { gateway, gatewayUrl, sessionToken, headers, runId };
 }
 function assertInvocationIsolation(input) {
-  for (const name of Object.keys(record2(input.commandEnv))) {
+  for (const name of Object.keys(record3(input.commandEnv))) {
     if (FORBIDDEN_COMMAND_ENV.has(name)) throw new Error(`codex_managed_mcp_env_override_blocked: ${name}`);
     if (!ALLOWED_COMMAND_ENV.has(name)) throw new Error(`codex_managed_mcp_env_injection_blocked: ${name}`);
   }
@@ -1438,7 +1481,7 @@ function buildIsolatedEnvironment(baseEnv, commandEnv) {
     const value = safeProxyValue(baseEnv?.[name], name);
     if (value) env[name] = value;
   }
-  return { ...env, ...record2(commandEnv) };
+  return { ...env, ...record3(commandEnv) };
 }
 function assertNoProjectAmasterOverride(cwd, runDir) {
   let cursor = resolve(cwd);
@@ -1520,7 +1563,7 @@ function prepareManagedCodexMcpProfile(input) {
     const owner = Object.freeze({ commandId: input.commandId, runId });
     writePrivateFile(markerPath, `${JSON.stringify({ version: 1, ...owner, profileRoot })}
 `);
-    const runtimeAuth = record2(input.runtimeAuth);
+    const runtimeAuth = record3(input.runtimeAuth);
     const authority = Object.freeze({
       companyId: nonEmpty(runtimeAuth.companyId, "runtimeAuth.companyId"),
       agentId: nonEmpty(runtimeAuth.agentId, "runtimeAuth.agentId"),
@@ -2502,7 +2545,7 @@ function createManagedPiMcpProfileApi(options = {}) {
   const PI_ATTESTATION_MAX_ATTEMPTS = 2;
   const PI_ATTESTATION_RECENT_LIVE_TTL_MS = Number.isFinite(options.recentLiveTtlMs) && options.recentLiveTtlMs > 0 ? options.recentLiveTtlMs : 30 * 60 * 1e3;
   const recentLivePiVersionProbes = /* @__PURE__ */ new Map();
-  function record7(value) {
+  function record8(value) {
     return value && typeof value === "object" && !Array.isArray(value) ? value : {};
   }
   function readJsonObjectFile(filePath) {
@@ -2570,7 +2613,7 @@ function createManagedPiMcpProfileApi(options = {}) {
     return matches[0];
   }
   function restoreManagedPiSessionRollout(input, sessionsRoot, runDir, executorHome, authority) {
-    const session = record7(input.nativeSession);
+    const session = record8(input.nativeSession);
     if (session.mode !== "governed_action_approval" || session.required !== true) return null;
     const sessionId = nonEmpty2(session.sessionId, "nativeSession.sessionId");
     const sourceRunId = nonEmpty2(session.sourceRunId, "nativeSession.sourceRunId");
@@ -2643,11 +2686,11 @@ function createManagedPiMcpProfileApi(options = {}) {
     }));
   }
   function validateDirectCatalog(gateway) {
-    const catalog = record7(gateway.toolCatalog);
+    const catalog = record8(gateway.toolCatalog);
     if (catalog.schemaVersion !== DIRECT_CATALOG_SCHEMA_VERSION) {
       throw new Error("pi_managed_mcp_invalid: direct tool catalog schema mismatch");
     }
-    const tools = Array.isArray(catalog.tools) ? catalog.tools.map(record7) : [];
+    const tools = Array.isArray(catalog.tools) ? catalog.tools.map(record8) : [];
     if (tools.length !== DIRECT_TYPED_V1_TOOL_NAMES.size) {
       throw new Error("pi_managed_mcp_invalid: direct tool catalog size mismatch");
     }
@@ -2667,7 +2710,7 @@ function createManagedPiMcpProfileApi(options = {}) {
         throw new Error(`pi_managed_mcp_invalid: direct tool exposed name collision for ${exposedName}`);
       }
       exposedNames.add(exposedName);
-      const inputSchema = record7(tool.inputSchema);
+      const inputSchema = record8(tool.inputSchema);
       if (inputSchema.type !== "object" || inputSchema.additionalProperties !== false) {
         throw new Error(`pi_managed_mcp_invalid: direct tool schema is not strict for ${name}`);
       }
@@ -2743,8 +2786,8 @@ function createManagedPiMcpProfileApi(options = {}) {
     }
   }
   function validateAuthority2(input) {
-    const runtimeAuth = record7(input.runtimeAuth);
-    const gateway = record7(runtimeAuth.governedMcp);
+    const runtimeAuth = record8(input.runtimeAuth);
+    const gateway = record8(runtimeAuth.governedMcp);
     const runId = nonEmpty2(input.runId, "runId");
     if (runtimeAuth.runId !== runId) throw new Error("pi_managed_mcp_owner_mismatch: command runId does not match runtime authority");
     if (gateway.schemaVersion !== SUPPORTED_SCHEMA_VERSION2) throw new Error("pi_managed_mcp_invalid: unsupported schema version");
@@ -2760,7 +2803,7 @@ function createManagedPiMcpProfileApi(options = {}) {
     if (!Number.isFinite(expiresAt) || expiresAt <= Date.now() + 3e4) {
       throw new Error("pi_managed_mcp_session_expired: Gateway session must remain valid through spawn preflight");
     }
-    const headers = record7(gateway.headers);
+    const headers = record8(gateway.headers);
     for (const name of REQUIRED_AUTHORITY_HEADERS2) nonEmpty2(headers[name], `headers.${name}`);
     const allowedHeaderNames = /* @__PURE__ */ new Set([...REQUIRED_AUTHORITY_HEADERS2, ...runtimeAuth.issueId ? ["x-amaster-issue-id"] : []]);
     if (Object.keys(headers).some((name) => !allowedHeaderNames.has(name)) || Object.keys(headers).length !== allowedHeaderNames.size) {
@@ -2797,7 +2840,7 @@ function createManagedPiMcpProfileApi(options = {}) {
     return output;
   }
   function assertInvocationIsolation2(input) {
-    for (const name of Object.keys(record7(input.commandEnv))) {
+    for (const name of Object.keys(record8(input.commandEnv))) {
       if (FORBIDDEN_COMMAND_ENV2.has(name)) throw new Error(`pi_managed_mcp_env_override_blocked: ${name}`);
       if (!ALLOWED_COMMAND_ENV2.has(name)) throw new Error(`pi_managed_mcp_env_injection_blocked: ${name}`);
     }
@@ -2829,7 +2872,7 @@ function createManagedPiMcpProfileApi(options = {}) {
       const value = safeProxyValue2(baseEnv?.[name], name);
       if (value) env[name] = value;
     }
-    return { ...env, ...record7(commandEnv) };
+    return { ...env, ...record8(commandEnv) };
   }
   function projectMcpConfigHasContent(filePath) {
     if (!existsSync3(filePath)) return false;
@@ -2839,8 +2882,8 @@ function createManagedPiMcpProfileApi(options = {}) {
     } catch {
       return true;
     }
-    const config = record7(parsed);
-    return Object.keys(record7(config.mcpServers)).length > 0 || Object.keys(record7(config.servers)).length > 0 || Array.isArray(config.imports) && config.imports.length > 0;
+    const config = record8(parsed);
+    return Object.keys(record8(config.mcpServers)).length > 0 || Object.keys(record8(config.servers)).length > 0 || Array.isArray(config.imports) && config.imports.length > 0;
   }
   function assertNoProjectMcpOverride(cwd, runDir) {
     let cursor = resolve2(cwd);
@@ -2856,7 +2899,7 @@ function createManagedPiMcpProfileApi(options = {}) {
     }
   }
   function selectManagedBrowserUse(sourceSettings, npmSource) {
-    const plugin = record7(record7(sourceSettings.plugins)[MANAGED_BROWSER_USE_PLUGIN]);
+    const plugin = record8(record8(sourceSettings.plugins)[MANAGED_BROWSER_USE_PLUGIN]);
     if (plugin.enabled !== true || plugin.package !== MANAGED_BROWSER_USE_PACKAGE) return null;
     const packageSpec = Array.isArray(sourceSettings.packages) ? sourceSettings.packages.find((entry) => npmPackageName(entry) === MANAGED_BROWSER_USE_PACKAGE) : null;
     if (typeof packageSpec !== "string") return null;
@@ -2873,7 +2916,7 @@ function createManagedPiMcpProfileApi(options = {}) {
     if (packageMetadata.name !== MANAGED_BROWSER_USE_PACKAGE) {
       throw new Error(`pi_managed_mcp_attestation_failed: enabled ${MANAGED_BROWSER_USE_PACKAGE} package identity mismatch`);
     }
-    const sourceConfig = record7(sourceSettings["pi-browser-use"]);
+    const sourceConfig = record8(sourceSettings["pi-browser-use"]);
     const config = {};
     for (const key of MANAGED_BROWSER_USE_BOOLEAN_SETTINGS) {
       if (typeof sourceConfig[key] === "boolean") config[key] = sourceConfig[key];
@@ -2923,7 +2966,7 @@ function createManagedPiMcpProfileApi(options = {}) {
     }
     return {
       packageSpec,
-      config: record7(sourceSettings["pi-web-access"])
+      config: record8(sourceSettings["pi-web-access"])
     };
   }
   function selectManagedTelemetry(sourceSettings, npmSource) {
@@ -2944,7 +2987,7 @@ function createManagedPiMcpProfileApi(options = {}) {
     }
     return {
       packageSpec,
-      config: record7(sourceSettings["pi-telemetry"])
+      config: record8(sourceSettings["pi-telemetry"])
     };
   }
   function seedPiRuntime(sourceHome, agentDir, sourceAcquisition = null, mcpToolMode = MANAGED_PI_MCP_TOOL_MODE) {
@@ -2970,7 +3013,7 @@ function createManagedPiMcpProfileApi(options = {}) {
     let sourceSettings = {};
     if (existsSync3(settingsSource)) {
       try {
-        sourceSettings = record7(JSON.parse(readFileSync3(settingsSource, "utf8")));
+        sourceSettings = record8(JSON.parse(readFileSync3(settingsSource, "utf8")));
       } catch {
         throw new Error("pi_managed_mcp_attestation_failed: source Pi settings are invalid");
       }
@@ -3208,7 +3251,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
       const owner = Object.freeze({ commandId: input.commandId, runId });
       writePrivateFile2(markerPath, `${JSON.stringify({ version: 1, ...owner, profileRoot })}
 `);
-      const runtimeAuth = record7(input.runtimeAuth);
+      const runtimeAuth = record8(input.runtimeAuth);
       const authority = Object.freeze({
         companyId: nonEmpty2(runtimeAuth.companyId, "runtimeAuth.companyId"),
         agentId: nonEmpty2(runtimeAuth.agentId, "runtimeAuth.agentId"),
@@ -3382,7 +3425,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
       const owner = Object.freeze({ commandId: input.commandId, runId });
       writePrivateFile2(markerPath, `${JSON.stringify({ version: 1, ...owner, profileRoot, piCodingAgentDir })}
 `);
-      const runtimeAuth = record7(input.runtimeAuth);
+      const runtimeAuth = record8(input.runtimeAuth);
       const authority = Object.freeze({
         companyId: nonEmpty2(runtimeAuth.companyId, "runtimeAuth.companyId"),
         agentId: nonEmpty2(runtimeAuth.agentId, "runtimeAuth.agentId"),
@@ -3409,11 +3452,11 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
       const config = {
         ...sourceMcp,
         settings: {
-          ...record7(sourceMcp.settings),
+          ...record8(sourceMcp.settings),
           ...directCatalog ? { disableProxyTool: true } : {}
         },
         mcpServers: {
-          ...record7(sourceMcp.mcpServers),
+          ...record8(sourceMcp.mcpServers),
           [SUPPORTED_SERVER_NAME2]: serverConfig
         }
       };
@@ -3421,7 +3464,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
 `);
       const env = {
         ...input.baseEnv,
-        ...record7(input.commandEnv),
+        ...record8(input.commandEnv),
         PI_AGENT_HOME: sourcePiHome,
         PI_CODING_AGENT_DIR: piCodingAgentDir,
         "AMASTER-CLI_CODING_AGENT_DIR": piCodingAgentDir,
@@ -3692,11 +3735,11 @@ function signalExecutorProcess(child, signal, processGroupId = processGroupIdFor
 }
 
 // src/amaster-runtime-daemon/executor-spawn.mjs
-function record3(value) {
+function record4(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
 function managedChildSpawnInvocation(command, args, requestedIdentity) {
-  const identity2 = record3(requestedIdentity);
+  const identity2 = record4(requestedIdentity);
   const childUmask = identity2.umask;
   if (childUmask !== void 0 && (!Number.isInteger(childUmask) || childUmask < 0 || childUmask > 511)) {
     throw new Error("executor_spawn_umask_invalid");
@@ -3725,8 +3768,8 @@ function resultOutboxFileName(commandId, now = Date.now()) {
   return `${now}-${safeCommandId}.json`;
 }
 function isValidResultOutboxEntry(entry) {
-  const record7 = asRecord(entry);
-  return record7.version === 1 && Boolean(readString(record7.path)) && Object.keys(asRecord(record7.payload)).length > 0;
+  const record8 = asRecord(entry);
+  return record8.version === 1 && Boolean(readString(record8.path)) && Object.keys(asRecord(record8.payload)).length > 0;
 }
 function resultOutboxEntryAgeMs(entry, nowMs) {
   const createdAt = Date.parse(readString(entry.createdAt) ?? "");
@@ -3780,7 +3823,7 @@ var PHASE_TRANSITIONS = /* @__PURE__ */ new Map([
   ["profile_cleanup:profile_cleanup_abandoned", "result_post_pending"],
   ["result_post_pending:result_post_delivered", "terminal"]
 ]);
-function record4(value) {
+function record5(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
 function nonEmptyString(value, label) {
@@ -3805,8 +3848,8 @@ function runCompletionStateFileName(commandId) {
   return `${safeCommandId}.json`;
 }
 function normalizeRunTurnUsage(turn) {
-  const source = record4(turn);
-  const nestedUsage = record4(source.usage);
+  const source = record5(turn);
+  const nestedUsage = record5(source.usage);
   const usage = Object.keys(nestedUsage).length > 0 ? nestedUsage : source;
   return {
     turn: source.turn === "closure" ? "closure" : "primary",
@@ -3839,11 +3882,11 @@ function aggregateRunTurnUsage(turns) {
   };
 }
 function createRunCompletionState(input) {
-  const command = record4(input.command);
+  const command = record5(input.command);
   const commandId = nonEmptyString(command.commandId ?? command.id, "command.commandId");
   const connectorId = nonEmptyString(input.connectorId ?? command.connectorId, "connectorId");
   const now = typeof input.now === "string" && input.now ? input.now : (/* @__PURE__ */ new Date()).toISOString();
-  const firstTurn = normalizeRunTurnUsage({ ...record4(input.turn), turn: "primary", recordedAt: now });
+  const firstTurn = normalizeRunTurnUsage({ ...record5(input.turn), turn: "primary", recordedAt: now });
   return {
     version: RUN_COMPLETION_STATE_VERSION,
     commandId,
@@ -3851,10 +3894,10 @@ function createRunCompletionState(input) {
     phase: "usage_snapshot_persisted",
     closureAttempt: 0,
     command,
-    executor: record4(input.executor),
-    completionRequest: record4(input.completionRequest),
+    executor: record5(input.executor),
+    completionRequest: record5(input.completionRequest),
     candidateStatus: nonEmptyString(input.candidateStatus, "candidateStatus"),
-    candidateResult: record4(input.candidateResult),
+    candidateResult: record5(input.candidateResult),
     ...typeof input.candidateError === "string" && input.candidateError ? { candidateError: input.candidateError } : {},
     usageRecord: {
       schemaVersion: RUN_COMPLETION_USAGE_SCHEMA_VERSION,
@@ -3894,7 +3937,7 @@ function transitionRunCompletionState(state, event, patch = {}, now = (/* @__PUR
   }
   return assertValidRunCompletionState({
     ...current,
-    ...record4(patch),
+    ...record5(patch),
     phase: nextPhase,
     updatedAt: now
   });
@@ -3907,24 +3950,24 @@ function markRunCompletionCostDelivered(state, receipt, now = (/* @__PURE__ */ n
       ...current.usageRecord,
       ingestStatus: "delivered",
       deliveredAt: now,
-      receipt: record4(receipt)
+      receipt: record5(receipt)
     }
   }, "cost_ingest_delivered", {}, now);
 }
 function assertValidRunCompletionState(value) {
-  const state = record4(value);
+  const state = record5(value);
   if (state.version !== RUN_COMPLETION_STATE_VERSION) throw new Error("run_completion_state_invalid:version");
   const commandId = nonEmptyString(state.commandId, "commandId");
   const connectorId = nonEmptyString(state.connectorId, "connectorId");
   if (!RUN_COMPLETION_PHASES.has(state.phase)) throw new Error("run_completion_state_invalid:phase");
-  const command = record4(state.command);
+  const command = record5(state.command);
   if (nonEmptyString(command.commandId ?? command.id, "command.commandId") !== commandId) {
     throw new Error("run_completion_state_invalid:command_binding");
   }
   if (nonEmptyString(command.connectorId, "command.connectorId") !== connectorId) {
     throw new Error("run_completion_state_invalid:connector_binding");
   }
-  const usageRecord = record4(state.usageRecord);
+  const usageRecord = record5(state.usageRecord);
   if (usageRecord.schemaVersion !== RUN_COMPLETION_USAGE_SCHEMA_VERSION) {
     throw new Error("run_completion_state_invalid:usage_schema");
   }
@@ -3944,9 +3987,9 @@ function assertValidRunCompletionState(value) {
     commandId,
     connectorId,
     command,
-    executor: record4(state.executor),
-    completionRequest: record4(state.completionRequest),
-    candidateResult: record4(state.candidateResult),
+    executor: record5(state.executor),
+    completionRequest: record5(state.completionRequest),
+    candidateResult: record5(state.candidateResult),
     usageRecord: {
       ...usageRecord,
       turns,
@@ -3978,7 +4021,7 @@ function removeRunCompletionState(directory, commandId) {
 }
 
 // src/amaster-runtime-daemon/source-output-retention.mjs
-function record5(value) {
+function record6(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
 function string(value) {
@@ -3986,7 +4029,7 @@ function string(value) {
 }
 function retainedSourceExecutorEntry(entry, executorKind) {
   if (!entry) return null;
-  const payload = record5(entry.payload);
+  const payload = record6(entry.payload);
   if (string(payload.presentationKind) !== "error") return null;
   return {
     stream: "system",
@@ -4049,19 +4092,19 @@ function promptContextMode(input) {
 }
 function filterDuplicatedTaskComments(context, mode) {
   if (mode !== "cold") return context;
-  const record7 = asRecord(context);
+  const record8 = asRecord(context);
   const included = new Set(
-    (Array.isArray(record7.paperclipTaskMarkdownCommentIds) ? record7.paperclipTaskMarkdownCommentIds : []).map((entry) => readString(entry)).filter(Boolean)
+    (Array.isArray(record8.paperclipTaskMarkdownCommentIds) ? record8.paperclipTaskMarkdownCommentIds : []).map((entry) => readString(entry)).filter(Boolean)
   );
   if (included.size === 0) return context;
-  const wake = asRecord(record7.paperclipWake);
+  const wake = asRecord(record8.paperclipWake);
   const comments = Array.isArray(wake.comments) ? wake.comments : [];
   const kept = comments.filter((entry) => {
     const id = readString(asRecord(entry).id);
     return !id || !included.has(id);
   });
   if (kept.length === comments.length) return context;
-  return { ...record7, paperclipWake: { ...wake, comments: kept } };
+  return { ...record8, paperclipWake: { ...wake, comments: kept } };
 }
 function commentRefs(context) {
   const comments = Array.isArray(asRecord(context.paperclipWake).comments) ? asRecord(context.paperclipWake).comments : [];
@@ -4099,8 +4142,8 @@ function governedReadSection(context) {
   const reads = Array.isArray(context.governedReadResults) ? context.governedReadResults : [];
   if (reads.length === 0) return { content: "", provenance: [] };
   const normalized = reads.map((entry, index) => {
-    const record7 = asRecord(entry);
-    const receipt = asRecord(record7.receipt);
+    const record8 = asRecord(entry);
+    const receipt = asRecord(record8.receipt);
     const provider = readString(receipt.provider) ?? readString(receipt.transport);
     const operation = readString(receipt.operation);
     const observedAt = readString(receipt.retrievedAt) ?? readString(receipt.observedAt);
@@ -4110,7 +4153,7 @@ function governedReadSection(context) {
       throw new Error(`governed_read_context_provenance_invalid: entry ${index} requires provider, operation, observedAt, and source`);
     }
     return {
-      content: record7.content,
+      content: record8.content,
       receipt: {
         provider,
         operation,
@@ -4135,10 +4178,10 @@ function governedReadSection(context) {
 }
 function canonicalJsonValue(value) {
   if (Array.isArray(value)) return value.map(canonicalJsonValue);
-  const record7 = asRecord(value);
-  if (Object.keys(record7).length === 0) return value;
+  const record8 = asRecord(value);
+  if (Object.keys(record8).length === 0) return value;
   return Object.fromEntries(
-    Object.keys(record7).sort().map((key) => [key, canonicalJsonValue(record7[key])])
+    Object.keys(record8).sort().map((key) => [key, canonicalJsonValue(record8[key])])
   );
 }
 function resolvedDependencySections(context, input, contextScope, snapshotFreshness) {
@@ -5408,10 +5451,10 @@ function compactExecutorJsonlForTranscript(event) {
     const text = JSON.stringify(compactExecutorJsonValue(event, stringMaxChars));
     if (text.length <= 15e3) return text;
   }
-  const record7 = tcAsRecord(event);
-  const item = tcAsRecord(record7.item);
+  const record8 = tcAsRecord(event);
+  const item = tcAsRecord(record8.item);
   return JSON.stringify({
-    type: tcReadString(record7.type) ?? "executor.event",
+    type: tcReadString(record8.type) ?? "executor.event",
     item: item.type ? {
       id: tcReadString(item.id),
       type: tcReadString(item.type),
@@ -5424,10 +5467,10 @@ function compactExecutorJsonlForTranscript(event) {
   });
 }
 function summarizeTokenUsage(usage) {
-  const record7 = tcAsRecord(usage);
-  const inputTokens = tcReadNumber(record7.input_tokens ?? record7.inputTokens, 0);
-  const cachedInputTokens = tcReadNumber(record7.cached_input_tokens ?? record7.cachedInputTokens, 0);
-  const outputTokens = tcReadNumber(record7.output_tokens ?? record7.outputTokens, 0);
+  const record8 = tcAsRecord(usage);
+  const inputTokens = tcReadNumber(record8.input_tokens ?? record8.inputTokens, 0);
+  const cachedInputTokens = tcReadNumber(record8.cached_input_tokens ?? record8.cachedInputTokens, 0);
+  const outputTokens = tcReadNumber(record8.output_tokens ?? record8.outputTokens, 0);
   const parts = [];
   if (inputTokens > 0) parts.push(`\u8F93\u5165 ${inputTokens}`);
   if (cachedInputTokens > 0) parts.push(`\u7F13\u5B58 ${cachedInputTokens}`);
@@ -5682,8 +5725,8 @@ function summarizeClaudeEvent(event) {
   return null;
 }
 function tcPiMessageText(message) {
-  const record7 = tcAsRecord(message);
-  const content = record7.content;
+  const record8 = tcAsRecord(message);
+  const content = record8.content;
   if (typeof content === "string" && content.trim().length > 0) return content.trim();
   if (!Array.isArray(content)) return "";
   return content.map((entry) => {
@@ -5697,14 +5740,14 @@ function tcPiAssistantMessageEventText(assistantMessageEvent) {
   return tcReadString(event.content) ?? "";
 }
 function tcPiMessageStopReason(message) {
-  const record7 = tcAsRecord(message);
-  return tcReadString(record7.stopReason ?? record7.stop_reason);
+  const record8 = tcAsRecord(message);
+  return tcReadString(record8.stopReason ?? record8.stop_reason);
 }
 function tcPiMessageErrorText(message) {
-  const record7 = tcAsRecord(message);
-  const explicitError = tcReadString(record7.errorMessage ?? record7.error_message)?.trim();
+  const record8 = tcAsRecord(message);
+  const explicitError = tcReadString(record8.errorMessage ?? record8.error_message)?.trim();
   if (explicitError) return explicitError;
-  const stopReason = tcPiMessageStopReason(record7);
+  const stopReason = tcPiMessageStopReason(record8);
   if (stopReason === "error" || stopReason === "failed" || stopReason === "exception") {
     return `Pi Agent message ended with stopReason=${stopReason}`;
   }
@@ -6327,13 +6370,13 @@ function parseClaudeStreamJson(stdout) {
 }
 function openCodeErrorText(value) {
   if (typeof value === "string") return value;
-  const record7 = asRecord(value);
-  const message = readString(record7.message);
+  const record8 = asRecord(value);
+  const message = readString(record8.message);
   if (message) return message;
-  const data = asRecord(record7.data);
+  const data = asRecord(record8.data);
   const nestedMessage = readString(data.message);
   if (nestedMessage) return nestedMessage;
-  return readString(record7.name) ?? readString(record7.code) ?? "";
+  return readString(record8.name) ?? readString(record8.code) ?? "";
 }
 function parseOpenCodeJsonl(stdout) {
   let sessionId = null;
@@ -6371,8 +6414,8 @@ function parseOpenCodeJsonl(stdout) {
   return { sessionId, summary, usage, errorMessage };
 }
 function piMessageText(message) {
-  const record7 = asRecord(message);
-  const content = record7.content;
+  const record8 = asRecord(message);
+  const content = record8.content;
   if (typeof content === "string") return content.trim();
   if (!Array.isArray(content)) return "";
   return content.map((entry) => {
@@ -6405,10 +6448,10 @@ function piTextValue(value) {
   return typeof value === "string" && value.length > 0 ? value : "";
 }
 function piAssistantEventText(assistantEvent) {
-  const record7 = asRecord(assistantEvent);
-  const type = readString(record7.type);
-  if (type === "text_delta") return piTextValue(record7.delta);
-  if (type === "text_end") return piTextValue(record7.content);
+  const record8 = asRecord(assistantEvent);
+  const type = readString(record8.type);
+  if (type === "text_delta") return piTextValue(record8.delta);
+  if (type === "text_end") return piTextValue(record8.content);
   return "";
 }
 function piMessageUsage(message) {
@@ -6429,14 +6472,14 @@ function assignPiUsage(target, source) {
   if (source.costUsd > 0) target.costUsd = source.costUsd;
 }
 function piMessageStopReason(message) {
-  const record7 = asRecord(message);
-  return readString(record7.stopReason ?? record7.stop_reason);
+  const record8 = asRecord(message);
+  return readString(record8.stopReason ?? record8.stop_reason);
 }
 function piMessageErrorText(message) {
-  const record7 = asRecord(message);
-  const explicitError = readString(record7.errorMessage ?? record7.error_message)?.trim();
+  const record8 = asRecord(message);
+  const explicitError = readString(record8.errorMessage ?? record8.error_message)?.trim();
   if (explicitError) return explicitError;
-  const stopReason = piMessageStopReason(record7);
+  const stopReason = piMessageStopReason(record8);
   if (stopReason === "error" || stopReason === "failed" || stopReason === "exception") {
     return `Pi Agent message ended with stopReason=${stopReason}`;
   }
@@ -8179,7 +8222,7 @@ function verifyDeclaredFiles(manifest, root, label, ignoredPaths = [], enforceCo
   };
   visit(root);
 }
-function record6(value) {
+function record7(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
 function within3(candidate, root) {
@@ -8284,16 +8327,16 @@ function materializeRoleSkills(seedRoot, agentDir, skillProfile) {
   return enabled;
 }
 function mergeMcp(seedRoot, overlayRoot, governedConfig) {
-  const seed = record6(readJsonFile2(join12(seedRoot, "mcp.json"), "seed_mcp", { mcpServers: {} }));
-  const overlay = record6(readJsonFile2(join12(overlayRoot, "mcp.json"), "overlay_mcp", { mcpServers: {} }));
+  const seed = record7(readJsonFile2(join12(seedRoot, "mcp.json"), "seed_mcp", { mcpServers: {} }));
+  const overlay = record7(readJsonFile2(join12(overlayRoot, "mcp.json"), "overlay_mcp", { mcpServers: {} }));
   assertNoPersistentSecrets(seed, ["seed", "mcp.json"]);
   assertNoPersistentSecrets(overlay, ["overlay", "mcp.json"]);
-  const seedServers = record6(seed.mcpServers);
-  const overlayServers = record6(overlay.mcpServers);
+  const seedServers = record7(seed.mcpServers);
+  const overlayServers = record7(overlay.mcpServers);
   if ("amaster" in seedServers || "amaster" in overlayServers) {
     throw new Error("pi_trusted_runtime_reserved_mcp_override:amaster");
   }
-  const governed = record6(record6(governedConfig).mcpServers).amaster;
+  const governed = record7(record7(governedConfig).mcpServers).amaster;
   if (!governed) throw new Error("pi_trusted_runtime_governed_mcp_missing");
   return {
     ...deepMerge(seed, overlay),
@@ -8313,8 +8356,8 @@ function assertEnabledPackagesAvailable(settings, npmRoot) {
   const requiredNames = new Set(
     (Array.isArray(settings.packages) ? settings.packages : []).map(packageName).filter(Boolean)
   );
-  for (const plugin of Object.values(record6(settings.plugins))) {
-    const config = record6(plugin);
+  for (const plugin of Object.values(record7(settings.plugins))) {
+    const config = record7(plugin);
     if (config.enabled === true && typeof config.package === "string") {
       requiredNames.add(config.package);
     }
@@ -8356,10 +8399,10 @@ function materializeTrustedPiRuntimeProfile(input) {
     const merged = deepMerge(seed, overlay);
     if (entry === "settings.json") {
       merged["pi-security"] = {
-        ...record6(merged["pi-security"]),
+        ...record7(merged["pi-security"]),
         enabled: true,
         approvals: {
-          ...record6(record6(merged["pi-security"]).approvals),
+          ...record7(record7(merged["pi-security"]).approvals),
           allowSessionGrants: false
         }
       };
@@ -8596,8 +8639,8 @@ function verifyTrustedPiRuntimeAssertion(input) {
   if (assertion.unknownToolMode === "allow_audited_bounded" && maxCalls < 1) {
     throw new Error("pi_trusted_runtime_assertion_invalid:directToolBudget.maxCalls");
   }
-  const sourceAssertion = record6(assertion.sourceAcquisition);
-  const sourceProfile = record6(input.sourceAcquisitionProfile);
+  const sourceAssertion = record7(assertion.sourceAcquisition);
+  const sourceProfile = record7(input.sourceAcquisitionProfile);
   const hasSourceAssertion = Object.keys(sourceAssertion).length > 0;
   const hasSourceProfile = Object.keys(sourceProfile).length > 0;
   if (hasSourceAssertion !== hasSourceProfile) {
@@ -8605,8 +8648,8 @@ function verifyTrustedPiRuntimeAssertion(input) {
   }
   let sourceAcquisition = null;
   if (hasSourceAssertion) {
-    const exactTools = Array.isArray(record6(sourceProfile.tools).exactAllowlist) ? record6(sourceProfile.tools).exactAllowlist : [];
-    const exactActions = Array.isArray(record6(sourceProfile.actions).exactAllowlist) ? record6(sourceProfile.actions).exactAllowlist : [];
+    const exactTools = Array.isArray(record7(sourceProfile.tools).exactAllowlist) ? record7(sourceProfile.tools).exactAllowlist : [];
+    const exactActions = Array.isArray(record7(sourceProfile.actions).exactAllowlist) ? record7(sourceProfile.actions).exactAllowlist : [];
     const profileHash = createHash9("sha256").update(JSON.stringify(sourceProfile)).digest("hex");
     if (assertion.unknownToolMode !== "deny" || maxCalls !== 0 || sourceAssertion.profileVersion !== sourceProfile.purpose || sourceAssertion.profileHash !== profileHash || sourceAssertion.retentionVersion !== sourceProfile.retention || JSON.stringify(sourceAssertion.exactTools) !== JSON.stringify(exactTools) || JSON.stringify(sourceAssertion.exactActions) !== JSON.stringify(exactActions) || sourceAssertion.sourceId !== sourceProfile.sourceId || sourceAssertion.sourceRevisionId !== sourceProfile.sourceRevisionId || sourceAssertion.sourceRevision !== sourceProfile.sourceRevision || sourceAssertion.attemptId !== sourceProfile.attemptId || sourceAssertion.epoch !== sourceProfile.epoch) {
       throw new Error("pi_trusted_runtime_assertion_binding_mismatch:sourceAcquisition");
@@ -9503,7 +9546,7 @@ function assertSourceAcquisitionRuntimeAuthority({
 }
 
 // src/amaster-runtime-daemon.mjs
-var CONNECTOR_VERSION = "0.1.1-beta.14";
+var CONNECTOR_VERSION = "0.1.1-beta.15";
 var CONNECTOR_CONTRACT_VERSION = "2026-06-04.v1";
 var SOURCE_ACQUISITION_CAPABILITY = "source_acquisition_v1";
 var SOURCE_ACQUISITION_PROFILE_VERSION = "source_acquisition_v1";
@@ -11620,17 +11663,27 @@ function createLiveOutputLogger(config, command, executorKind, protectedValues =
     hasSourceStream(stream) {
       return sourceCounts[stream] > 0;
     },
-    snapshot({ outputBytes, floodLimitBytes, outputTokens }) {
+    snapshot({ outputBytes, retainedOutputBytes, floodLimitBytes, outputTokens }) {
       const rawBytesByStream = {
         stdout: readNumber(outputBytes?.stdout, 0),
         stderr: readNumber(outputBytes?.stderr, 0)
       };
+      const retainedBytesByStream = {
+        stdout: readNumber(retainedOutputBytes?.stdout, rawBytesByStream.stdout),
+        stderr: readNumber(retainedOutputBytes?.stderr, rawBytesByStream.stderr)
+      };
       const rawOutputBytes = rawBytesByStream.stdout + rawBytesByStream.stderr;
+      const retainedBytes = retainedBytesByStream.stdout + retainedBytesByStream.stderr;
+      const retentionCompactedBytes = Math.max(0, rawOutputBytes - retainedBytes);
       const maxStreamBytes = Math.max(rawBytesByStream.stdout, rawBytesByStream.stderr);
       const normalizedFloodLimitBytes = readNumber(floodLimitBytes, 0);
       return {
         rawBytesByStream,
         rawOutputBytes,
+        retainedBytesByStream,
+        retainedOutputBytes: retainedBytes,
+        retentionCompactedBytes,
+        retentionRatio: Number((retainedBytes / Math.max(1, rawOutputBytes)).toFixed(4)),
         jsonlEventCount,
         meaningfulProgressEventCount,
         incrementalEventCount,
@@ -11962,6 +12015,8 @@ function runExecutor(command, args, options) {
     const residentSignalledAt = /* @__PURE__ */ new Map();
     let piCompletionOutputLineBuffer = "";
     const outputBytes = { stdout: 0, stderr: 0 };
+    const retainedOutputBytes = { stdout: 0, stderr: 0 };
+    const piOutputRetentionCompactor = options.executorKind === "pi" ? createPiOutputRetentionCompactor() : null;
     const maxOutputBytes = parsePositiveInteger(options.maxOutputBytes, 50 * 1024 * 1024);
     const maxRssMb = parsePositiveInteger(options.maxRssMb, 0);
     const maxRssBytes = maxRssMb * 1024 * 1024;
@@ -11978,6 +12033,11 @@ function runExecutor(command, args, options) {
     const finish = (result3) => {
       if (settled) return;
       settled = true;
+      if (piOutputRetentionCompactor) {
+        const retainedTail = piOutputRetentionCompactor.flush();
+        retainedOutputBytes.stdout += Buffer.byteLength(retainedTail);
+        stdout = appendBounded(stdout, retainedTail);
+      }
       if (timer) clearTimeout(timer);
       if (rssTimer) clearInterval(rssTimer);
       if (stopKillTimer) clearTimeout(stopKillTimer);
@@ -11989,6 +12049,7 @@ function runExecutor(command, args, options) {
         stdout,
         stderr,
         outputBytes: { ...outputBytes },
+        retainedOutputBytes: { ...retainedOutputBytes },
         outputFlood,
         argumentAmplification,
         memoryLimit,
@@ -12146,15 +12207,18 @@ function runExecutor(command, args, options) {
     child.stdout.on("data", (chunk) => {
       const text = chunk.toString("utf8");
       outputBytes.stdout += chunk.length;
-      stdout = appendBounded(stdout, text);
       const outputControl = options.onOutput?.("stdout", text, chunk.length);
       if (outputControl?.enforced === true) killForArgumentAmplification(outputControl);
       maybeSchedulePiCompletionDrain(text);
+      const retainedText = piOutputRetentionCompactor?.write(text) ?? text;
+      retainedOutputBytes.stdout += Buffer.byteLength(retainedText);
+      stdout = appendBounded(stdout, retainedText);
       if (outputBytes.stdout > maxOutputBytes) killForOutputFlood("stdout");
     });
     child.stderr.on("data", (chunk) => {
       const text = chunk.toString("utf8");
       outputBytes.stderr += chunk.length;
+      retainedOutputBytes.stderr += chunk.length;
       stderr = appendBounded(stderr, text);
       options.onOutput?.("stderr", text, chunk.length);
       if (outputBytes.stderr > maxOutputBytes) killForOutputFlood("stderr");
@@ -12643,6 +12707,7 @@ async function executeRunExitClosureTurn(config, inputState, options = {}) {
     ]);
     const outputTelemetry = liveOutputLogger.snapshot({
       outputBytes: execution.outputBytes,
+      retainedOutputBytes: execution.retainedOutputBytes,
       floodLimitBytes: Math.max(1, readNumber(executionConfig.maxOutputBytes, config.executorMaxOutputBytes)),
       outputTokens: readNumber(parsed.usage?.outputTokens, 0)
     });
@@ -14368,6 +14433,7 @@ async function executeRunCommand(config, command) {
     }
     const outputTelemetry = liveOutputLogger.snapshot({
       outputBytes: execution.outputBytes,
+      retainedOutputBytes: execution.retainedOutputBytes,
       floodLimitBytes: config.executorMaxOutputBytes,
       outputTokens: readNumber(parsed.usage?.outputTokens, 0)
     });

package/dist/amaster-runtime.mjs

@@ -6,7 +6,7 @@ import { basename, dirname, join, resolve } from "node:path";
 import { homedir, hostname } from "node:os";
 import { fileURLToPath } from "node:url";
 
-const CONNECTOR_VERSION = "0.1.1-beta.14";
+const CONNECTOR_VERSION = "0.1.1-beta.15";
 
 const CAPABILITIES = [
   "remote_registration",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amaster.ai/employee-runtime-connector",
-  "version": "0.1.1-beta.14",
+  "version": "0.1.1-beta.15",
   "description": "MirrorX runtime connector CLI and daemon",
   "license": "MIT",
   "type": "module",