@amaster.ai/employee-runtime-connector 0.1.1-beta.140 → 0.1.1-beta.141

package/dist/amaster-runtime-daemon.mjs

@@ -15741,7 +15741,7 @@ var completeCompanyCreationReviewSchema = external_exports.object({
 // src/amaster-runtime-daemon.mjs
 import { chmodSync as chmodSync7, copyFileSync as copyFileSync2, existsSync as existsSync15, lstatSync as lstatSync9, mkdirSync as mkdirSync10, mkdtempSync as mkdtempSync2, readFileSync as readFileSync17, readdirSync as readdirSync11, realpathSync as realpathSync7, renameSync as renameSync9, rmSync as rmSync9, statSync as statSync10, symlinkSync as symlinkSync2, unlinkSync as unlinkSync3, writeFileSync as writeFileSync11 } from "node:fs";
 import { arch as arch3, homedir as homedir3, hostname as hostname2, platform as platform3, tmpdir } from "node:os";
-import { basename as basename6, delimiter as delimiter3, dirname as dirname11, extname as extname3, isAbsolute as isAbsolute9, join as join16, relative as relative8, resolve as resolve14 } from "node:path";
+import { basename as basename6, delimiter as delimiter3, dirname as dirname11, extname as extname3, isAbsolute as isAbsolute10, join as join16, relative as relative8, resolve as resolve14 } from "node:path";
 import { spawn, spawnSync as spawnSync5 } from "node:child_process";
 
 // src/amaster-runtime-daemon/common.mjs
@@ -22294,6 +22294,7 @@ function inspectSourceAcquisitionProfile(profile, expectedRunId) {
 
 // src/amaster-runtime-daemon/prompt-compiler.mjs
 import { createHash as createHash7 } from "node:crypto";
+import { isAbsolute as isAbsolute4 } from "node:path";
 
 // src/amaster-runtime-daemon/current-run-contract.mjs
 import { createHash as createHash6 } from "node:crypto";
@@ -22531,6 +22532,30 @@ function jsonCharLength(value) {
     return String(value).length;
   }
 }
+function runtimeTemplateCatalogSection(input) {
+  const catalog = asRecord(input.runtimeTemplateCatalog);
+  if (Object.keys(catalog).length === 0) return null;
+  const targetDir = readString(catalog.targetDir);
+  const manifestSha256 = readString(catalog.manifestSha256);
+  if (catalog.status !== "ready" || !targetDir || !isAbsolute4(targetDir) || targetDir.length > 4096 || /[\0\r\n`]/u.test(targetDir) || !Number.isSafeInteger(catalog.fileCount) || catalog.fileCount < 1 || !manifestSha256 || !/^[a-f0-9]{64}$/u.test(manifestSha256)) {
+    throw promptBudgetError(
+      "runtime_template_catalog_projection_invalid",
+      "Runtime Template Catalog projection requires one attested ready catalog"
+    );
+  }
+  return {
+    sourceRef: "runtime_template_catalog_attestation",
+    content: [
+      "The runtime connector attested and materialized the artifact template catalog before this command was leased.",
+      `- exact catalog path: \`${targetDir}\``,
+      `- file count: ${catalog.fileCount}`,
+      `- manifest SHA-256: ${manifestSha256}`,
+      "This exact catalog is the run's only authorized read-only path outside the execution workspace for template matching. Copy a selected template into the workspace before editing it.",
+      "Use this exact path directly when listing or reading templates. Do not rely on `AMASTER_RUNTIME_TEMPLATES_ROOT` being inherited by out-of-process tools; the path above is the model-facing authority for this run.",
+      "If this exact path is missing or unreadable, report a runtime gap. Do not silently fall back to another directory or treat the failure as a verified template miss."
+    ].join("\n")
+  };
+}
 function estimatedTokens(chars) {
   return Math.ceil(chars / 4);
 }
@@ -24172,6 +24197,7 @@ ${resolvedDependencies.details.content}` : resolvedDependencies.details.content
   const taskContextAuthority = taskContextAuthoritySection(context);
   const continuationPostconditionGap = continuationPostconditionGapSection(context, input);
   const companyInitializationAuthority = companyInitializationAuthoritySection(context);
+  const runtimeTemplateCatalog = runtimeTemplateCatalogSection(input);
   const rawSections = [
     { name: "recovery_instruction", title: "Recovery Instruction", priority: 100, sourceRef: `run:${input.runId ?? "unknown"}`, content: completeRecoveryInstruction, truncationReason: completeRecoveryInstruction ? null : "mode_selection" },
     { name: "approval_continuation", title: "Approved Runtime Action Continuation", priority: 99, sourceRef: `run:${input.runId ?? "unknown"}`, content: approvalContinuationText(input), truncationReason: mode === "continuation" ? null : "mode_selection" },
@@ -24207,6 +24233,7 @@ ${resolvedDependencies.details.content}` : resolvedDependencies.details.content
     }] : [],
     { name: "governed_reads", title: "Governed External Reads", priority: 88, sourceRef: governedReads.provenance.map((entry) => entry.sourceRef), observedAt: governedReads.provenance.map((entry) => entry.observedAt), freshness: governedReads.provenance.map((entry) => entry.freshness), scope: governedReads.provenance.map((entry) => entry.scope), content: governedReads.content },
     ...optionalTaskWikiContext ? [optionalTaskWikiContext] : [],
+    ...runtimeTemplateCatalog ? [{ name: "runtime_template_catalog", title: "Runtime Template Catalog", priority: 100, ...runtimeTemplateCatalog }] : [],
     { name: "agent_instructions", title: "Agent Instructions", priority: 100, sourceRef: "agent_instructions_bundle", content: readString(input.agentInstructions) ?? "" },
     { name: "attachments", title: "Materialized Inputs", priority: 80, sourceRef: "materialized_attachments", content: readString(input.attachmentsText) ?? "" },
     {
@@ -24239,7 +24266,7 @@ ${resolvedDependencies.details.content}` : resolvedDependencies.details.content
 // src/amaster-runtime-daemon/agent-instruction-delivery.mjs
 import { createHash as createHash8, randomBytes as randomBytes2 } from "node:crypto";
 import { existsSync as existsSync7, lstatSync as lstatSync4, mkdirSync as mkdirSync5, readFileSync as readFileSync9, readdirSync as readdirSync6, realpathSync as realpathSync4, renameSync as renameSync6, rmSync as rmSync5, writeFileSync as writeFileSync7 } from "node:fs";
-import { dirname as dirname6, isAbsolute as isAbsolute4, join as join8, relative as relative3, resolve as resolve4 } from "node:path";
+import { dirname as dirname6, isAbsolute as isAbsolute5, join as join8, relative as relative3, resolve as resolve4 } from "node:path";
 
 // src/amaster-runtime-daemon/workspace-manifest.mjs
 import { chownSync as chownSync3, existsSync as existsSync6, readFileSync as readFileSync8, renameSync as renameSync5, rmSync as rmSync4, statSync as statSync3, writeFileSync as writeFileSync6 } from "node:fs";
@@ -24354,7 +24381,7 @@ function instructionTopologyError(code, message, details = {}) {
 }
 function pathWithin(candidate, root) {
   const rel = relative3(root, candidate);
-  return rel === "" || !rel.startsWith("..") && !isAbsolute4(rel);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute5(rel);
 }
 function lstatIfPresent(path) {
   try {
@@ -24384,7 +24411,7 @@ function isManagedExecutionDirectory(directory, managedWorkspacesRoot) {
     if (!manifest || typeof manifest !== "object" || Array.isArray(manifest) || manifest.managed !== true) {
       return false;
     }
-    return [manifest.managedCwd, manifest.executionWorkdir].some((value) => typeof value === "string" && isAbsolute4(value) && canonicalExistingPath(value) === candidate);
+    return [manifest.managedCwd, manifest.executionWorkdir].some((value) => typeof value === "string" && isAbsolute5(value) && canonicalExistingPath(value) === candidate);
   } catch {
     return false;
   }
@@ -26711,7 +26738,7 @@ var bestEffortPostJson = bestEffortPostRuntimeConnectorJson;
 // src/amaster-runtime-daemon/runtime-artifact-upload.mjs
 import { createHash as createHash9 } from "node:crypto";
 import { closeSync as closeSync2, constants, fstatSync, lstatSync as lstatSync5, openSync as openSync2, readFileSync as readFileSync11, realpathSync as realpathSync5 } from "node:fs";
-import { isAbsolute as isAbsolute5, relative as relative4, resolve as resolve6 } from "node:path";
+import { isAbsolute as isAbsolute6, relative as relative4, resolve as resolve6 } from "node:path";
 var SHA256_PATTERN3 = /^[a-f0-9]{64}$/;
 function requiredString(value, name) {
   if (typeof value !== "string" || !value.trim()) throw new Error(`Runtime Artifact ${name} is required`);
@@ -26724,7 +26751,7 @@ function ownedRelativePath(value) {
 }
 function pathWithin2(candidate, root) {
   const rel = relative4(root, candidate);
-  return rel === "" || !rel.startsWith("..") && !isAbsolute5(rel);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute6(rel);
 }
 function sameFileSnapshot(left, right) {
   return left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeMs === right.mtimeMs && left.ctimeMs === right.ctimeMs;
@@ -27048,10 +27075,10 @@ function createRuntimeArtifactIngestQueue({ ingest, onError }) {
 // src/amaster-runtime-daemon/workspace-guard.mjs
 import { createHash as createHash11 } from "node:crypto";
 import { existsSync as existsSync9, mkdirSync as mkdirSync7, realpathSync as realpathSync6, statSync as statSync4 } from "node:fs";
-import { basename as basename4, join as join10, isAbsolute as isAbsolute6, relative as relative5, resolve as resolve7 } from "node:path";
+import { basename as basename4, join as join10, isAbsolute as isAbsolute7, relative as relative5, resolve as resolve7 } from "node:path";
 function pathWithin3(candidate, root) {
   const rel = relative5(root, candidate);
-  return rel === "" || !rel.startsWith("..") && !isAbsolute6(rel);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute7(rel);
 }
 function resolveWorkspaceCwd(config, command) {
   const payload = asRecord(command.payload);
@@ -27288,7 +27315,7 @@ import {
   unlinkSync as unlinkSync2,
   writeFileSync as writeFileSync9
 } from "node:fs";
-import { dirname as dirname8, extname, isAbsolute as isAbsolute7, join as join12, parse as parse3, resolve as resolve9, sep as sep3 } from "node:path";
+import { dirname as dirname8, extname, isAbsolute as isAbsolute8, join as join12, parse as parse3, resolve as resolve9, sep as sep3 } from "node:path";
 import { fileURLToPath } from "node:url";
 var PRESET_TEMPLATE_MANIFEST_FILE = ".mirrorx-preset-templates.json";
 var MAX_PRESET_TEMPLATE_FILES = 256;
@@ -27340,7 +27367,7 @@ function assertCatalogReadableByExecutor(targetDir, fileNames, identity2) {
   }
 }
 function validTemplateName(value) {
-  return typeof value === "string" && value.length > 0 && value !== "." && value !== ".." && !value.includes("\0") && !value.includes("/") && !value.includes("\\") && !isAbsolute7(value) && parse3(value).base === value && extname(value).toLowerCase() === ".md";
+  return typeof value === "string" && value.length > 0 && value !== "." && value !== ".." && !value.includes("\0") && !value.includes("/") && !value.includes("\\") && !isAbsolute8(value) && parse3(value).base === value && extname(value).toLowerCase() === ".md";
 }
 function readManifest(manifestPath, { strict }) {
   try {
@@ -28215,7 +28242,7 @@ function readPiFinalContextAttestation(input) {
 import { spawnSync as spawnSync4 } from "node:child_process";
 import { createHash as createHash14 } from "node:crypto";
 import { existsSync as existsSync13, readdirSync as readdirSync10, readFileSync as readFileSync15, statSync as statSync8 } from "node:fs";
-import { basename as basename5, extname as extname2, isAbsolute as isAbsolute8, join as join14, relative as relative6, resolve as resolve12 } from "node:path";
+import { basename as basename5, extname as extname2, isAbsolute as isAbsolute9, join as join14, relative as relative6, resolve as resolve12 } from "node:path";
 var WORKSPACE_RUNTIME_SERVICES_FILENAME = ".amaster-runtime-services.json";
 var ARTIFACT_EXTENSIONS = /* @__PURE__ */ new Map([
   [".md", "markdown"],
@@ -28261,7 +28288,7 @@ var SAFE_RUNTIME_SERVICE_HEALTH_STATUSES = /* @__PURE__ */ new Set(["unknown", "
 var SAFE_RUNTIME_SERVICE_LIFECYCLES = /* @__PURE__ */ new Set(["shared", "ephemeral"]);
 function statusPathWithin(candidate, root) {
   const rel = relative6(root, candidate);
-  return rel === "" || !rel.startsWith("..") && !isAbsolute8(rel);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute9(rel);
 }
 function normalizeRelativePath(root, filePath) {
   return relative6(root, filePath).split(/[\\/]+/).join("/");
@@ -29375,7 +29402,7 @@ function createSourceCompletionStopPolicy({
 }
 
 // src/amaster-runtime-daemon.mjs
-var CONNECTOR_VERSION = "0.1.1-beta.140";
+var CONNECTOR_VERSION = "0.1.1-beta.141";
 var CONNECTOR_CONTRACT_VERSION = "2026-06-04.v1";
 var SOURCE_ACQUISITION_CAPABILITY2 = source_acquisition_compatibility_default.profileVersion;
 var daemonRequire = createRequire(import.meta.url);
@@ -29850,7 +29877,7 @@ function sourceAcquisitionPackageMetadata(packageName, location = "pi-config") {
 }
 function sourceAcquisitionBrowserExecutableReady() {
   const executable = readString(process.env.AMASTER_BROWSER_EXECUTABLE_PATH);
-  if (!executable || !isAbsolute9(executable)) return false;
+  if (!executable || !isAbsolute10(executable)) return false;
   try {
     const stat = statSync10(executable);
     return stat.isFile() && (stat.mode & 73) !== 0;
@@ -30807,7 +30834,7 @@ function safeAgentInstructionMaterializationTarget(workspace, filePath) {
   const raw = readString(filePath);
   if (!raw || raw.includes("\0")) return null;
   const normalized = raw.replace(/\\/g, "/");
-  if (isAbsolute9(normalized)) return null;
+  if (isAbsolute10(normalized)) return null;
   const segments = normalized.split("/").filter(Boolean);
   if (segments.length === 0 || segments.some((segment) => segment === "." || segment === "..")) return null;
   const relativePath = segments.join("/");
@@ -31036,7 +31063,8 @@ function buildCommandPrompt(command, workspace, materializedAttachments = [], op
     wikiAccess: {
       tools: context.wikiToolsAvailable === true,
       treePath: wikiTreePathForCommand(command, options.workspaceBindings)
-    }
+    },
+    runtimeTemplateCatalog: options.runtimeTemplateCatalog
   }, { maxChars: options.maxChars });
   const auditedCompilation = attachCurrentRunContractShadowAudit(
     compilation,
@@ -32060,7 +32088,7 @@ function manifestMatchesActiveRuntimeRef(manifest, refs, workdir = null) {
 function buildOrphanReaperSample(root, workdir, manifest, residents) {
   const relativeWorkdir = (() => {
     const value = relative8(root, workdir);
-    return value && !value.startsWith("..") && !isAbsolute9(value) ? value : basename6(workdir);
+    return value && !value.startsWith("..") && !isAbsolute10(value) ? value : basename6(workdir);
   })();
   return {
     workdir: relativeWorkdir,
@@ -34257,7 +34285,7 @@ async function clearIssueCheckpoint(config, command, workspace, reason) {
 }
 function safeCheckpointRelativePath(rawPath) {
   const raw = String(rawPath ?? "").trim();
-  if (isAbsolute9(raw) || /^[A-Za-z]:[\\/]/.test(raw)) return null;
+  if (isAbsolute10(raw) || /^[A-Za-z]:[\\/]/.test(raw)) return null;
   const normalized = raw.split(/[\\/]+/).filter(Boolean).join("/");
   if (!normalized || normalized.startsWith("../") || normalized.split("/").some((segment) => segment.startsWith("."))) return null;
   if (normalized.startsWith("input-attachments/") || isRuntimeMetadataArtifactPath(normalized)) return null;
@@ -34728,6 +34756,7 @@ async function executeRunCommand(config, command) {
       workspaceProjectInstructionReceipt,
       effectiveToolSchemaAttestation,
       modelContextBudget,
+      runtimeTemplateCatalog: config.templateCatalog,
       runtimeInstructionInjectionEnabled: strictContextGovernance,
       maxChars: modelContextBudget.dynamicPromptMaxChars
     }));
@@ -35549,7 +35578,9 @@ async function runOnce(config) {
   return commands.length;
 }
 async function dispatchAvailableCommands(config, options = {}) {
+  const templateCatalog = config.templateCatalog;
   config = await ensureRegistered(config);
+  config = { ...config, templateCatalog };
   try {
     await heartbeat(
       config,
@@ -35559,7 +35590,7 @@ async function dispatchAvailableCommands(config, options = {}) {
     if (!hasConnectorAuth(config) && isConnectorAuthFailure(err)) {
       process.stderr.write("AMaster daemon heartbeat was rejected without connector auth; re-registering once.\n");
       await register(config, { quiet: true });
-      config = buildConfig(process.env, {});
+      config = { ...buildConfig(process.env, {}), templateCatalog };
       await heartbeat(config, { logMode: "compact" });
     } else {
       throw err;

package/dist/amaster-runtime.mjs

@@ -7,7 +7,7 @@ import { homedir, hostname } from "node:os";
 import { fileURLToPath } from "node:url";
 import { BUILD_SUPPORTED_CAPABILITIES } from "./amaster-runtime-daemon/capability-registry.mjs";
 
-const CONNECTOR_VERSION = "0.1.1-beta.140";
+const CONNECTOR_VERSION = "0.1.1-beta.141";
 
 const CONFIG_KEY_MAP = new Map([
   ["server_url", "AMASTER_EMPLOYEE_SERVER_URL"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amaster.ai/employee-runtime-connector",
-  "version": "0.1.1-beta.140",
+  "version": "0.1.1-beta.141",
   "description": "MirrorX runtime connector CLI and daemon",
   "license": "MIT",
   "type": "module",