@amaster.ai/employee-runtime-connector 0.1.1-beta.16 → 0.1.1-beta.17

package/dist/amaster-runtime-daemon.mjs

@@ -2481,29 +2481,6 @@ function createManagedPiMcpProfileApi(options = {}) {
   const MINIMUM_MCP_ADAPTER_VERSION = [2, 6, 1];
   const MANAGED_BROWSER_USE_PACKAGE = "@amaster.ai/pi-browser-use";
   const MANAGED_BROWSER_USE_PLUGIN = "browser-use";
-  const MANAGED_WEB_ACCESS_PACKAGE = "@amaster.ai/pi-web-access";
-  const MANAGED_TELEMETRY_PACKAGE = "@amaster.ai/pi-telemetry";
-  const MANAGED_TELEMETRY_ENV_NAMES = [
-    "PI_TELEMETRY_TASK_RUN_ID",
-    "PI_TELEMETRY_SERVICE_NAME",
-    "PI_TELEMETRY_SERVICE_VERSION",
-    "PI_TELEMETRY_INCLUDE_PAYLOADS",
-    "PI_TELEMETRY_LANGFUSE_ENABLED",
-    "PI_TELEMETRY_LANGFUSE_PUBLIC_KEY",
-    "PI_TELEMETRY_LANGFUSE_SECRET_KEY",
-    "PI_TELEMETRY_LANGFUSE_BASE_URL",
-    "PI_TELEMETRY_LANGFUSE_FLUSH_AT",
-    "PI_TELEMETRY_LANGFUSE_FLUSH_INTERVAL_MS",
-    "PI_TELEMETRY_OTEL_ENABLED",
-    "PI_TELEMETRY_OTEL_ENDPOINT",
-    "PI_TELEMETRY_OTEL_HEADERS",
-    "PI_TELEMETRY_OTEL_FLUSH_AT",
-    "PI_TELEMETRY_OTEL_FLUSH_INTERVAL_MS"
-  ];
-  const MANAGED_TELEMETRY_PROTECTED_ENV_NAMES = [
-    "PI_TELEMETRY_LANGFUSE_SECRET_KEY",
-    "PI_TELEMETRY_OTEL_HEADERS"
-  ];
   const MANAGED_BROWSER_USE_BOOLEAN_SETTINGS = [
     "headless",
     "categoryNetwork",
@@ -2530,6 +2507,12 @@ function createManagedPiMcpProfileApi(options = {}) {
     "AMASTER-CLI_CODING_AGENT_SESSION_DIR",
     "PI_AGENT_MCP_SERVERS_FILE"
   ]);
+  const RUN_OWNED_SETTINGS_ENV = /* @__PURE__ */ new Set([
+    ...FORBIDDEN_COMMAND_ENV2,
+    "MCP_DIRECT_TOOLS",
+    "PAPERCLIP_API_KEY",
+    "AMASTER_BOARD_API_KEY"
+  ]);
   const ALLOWED_COMMAND_ENV2 = new Set(MANAGED_PI_PROVIDER_ENV_NAMES);
   const SAFE_INHERITED_ENV2 = /* @__PURE__ */ new Set([
     "PATH",
@@ -2555,8 +2538,7 @@ function createManagedPiMcpProfileApi(options = {}) {
     "PAPERCLIP_TASK_ID",
     "PAPERCLIP_AGENT_ID",
     "PAPERCLIP_COMPANY_ID",
-    "AMASTER_EMPLOYEE_COMPANY_ID",
-    ...MANAGED_TELEMETRY_ENV_NAMES
+    "AMASTER_EMPLOYEE_COMPANY_ID"
   ]);
   const FORBIDDEN_ARGV = /* @__PURE__ */ new Set([
     "--no-tools",
@@ -2877,13 +2859,38 @@ function createManagedPiMcpProfileApi(options = {}) {
     return /^(?:(?:access|refresh|id)_)?token$/.test(normalized) || normalized.includes("api_key") || normalized.includes("secret") || normalized.includes("password") || normalized.includes("credential") || normalized.includes("authorization") || normalized.includes("cookie");
   }
   function collectAuthSecretStrings2(value, output = []) {
-    if (!value || typeof value !== "object" || Array.isArray(value)) return output;
+    if (!value || typeof value !== "object") return output;
+    if (Array.isArray(value)) {
+      for (const entry of value) collectAuthSecretStrings2(entry, output);
+      return output;
+    }
     for (const [key, entry] of Object.entries(value)) {
       if (typeof entry === "string" && entry && isSensitiveAuthKey2(key)) output.push(entry);
-      else if (entry && typeof entry === "object" && !Array.isArray(entry)) collectAuthSecretStrings2(entry, output);
+      else if (entry && typeof entry === "object") collectAuthSecretStrings2(entry, output);
     }
     return output;
   }
+  function referencedSettingsEnvironment(settings, baseEnv) {
+    const names = /* @__PURE__ */ new Set();
+    const visit = (value) => {
+      if (typeof value === "string") {
+        for (const match of value.matchAll(/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)(?::-[^}]*)?\}|([A-Za-z_][A-Za-z0-9_]*))/g)) {
+          names.add(match[1] ?? match[2]);
+        }
+      } else if (Array.isArray(value)) {
+        for (const entry of value) visit(entry);
+      } else if (value && typeof value === "object") {
+        for (const entry of Object.values(value)) visit(entry);
+      }
+    };
+    visit(settings);
+    const env = {};
+    for (const name of names) {
+      if (RUN_OWNED_SETTINGS_ENV.has(name)) continue;
+      if (typeof baseEnv?.[name] === "string" && baseEnv[name]) env[name] = baseEnv[name];
+    }
+    return env;
+  }
   function assertInvocationIsolation2(input) {
     for (const name of Object.keys(record8(input.commandEnv))) {
       if (FORBIDDEN_COMMAND_ENV2.has(name)) throw new Error(`pi_managed_mcp_env_override_blocked: ${name}`);
@@ -2993,49 +3000,7 @@ function createManagedPiMcpProfileApi(options = {}) {
       }
     };
   }
-  function selectManagedWebAccess(sourceSettings, npmSource) {
-    const packageSpec = Array.isArray(sourceSettings.packages) ? sourceSettings.packages.find((entry) => npmPackageName(entry) === MANAGED_WEB_ACCESS_PACKAGE) : null;
-    if (typeof packageSpec !== "string") return null;
-    const packagePath = join4(npmSource, "node_modules", ...MANAGED_WEB_ACCESS_PACKAGE.split("/"), "package.json");
-    if (!existsSync3(packagePath) || lstatSync2(packagePath).isSymbolicLink() || !lstatSync2(packagePath).isFile()) {
-      throw new Error(`pi_managed_mcp_attestation_failed: configured ${MANAGED_WEB_ACCESS_PACKAGE} package is unavailable`);
-    }
-    let packageMetadata;
-    try {
-      packageMetadata = JSON.parse(readFileSync3(packagePath, "utf8"));
-    } catch {
-      throw new Error(`pi_managed_mcp_attestation_failed: configured ${MANAGED_WEB_ACCESS_PACKAGE} package metadata is invalid`);
-    }
-    if (!packageMetadata || packageMetadata.name !== MANAGED_WEB_ACCESS_PACKAGE) {
-      throw new Error(`pi_managed_mcp_attestation_failed: configured ${MANAGED_WEB_ACCESS_PACKAGE} package identity mismatch`);
-    }
-    return {
-      packageSpec,
-      config: record8(sourceSettings["pi-web-access"])
-    };
-  }
-  function selectManagedTelemetry(sourceSettings, npmSource) {
-    const packageSpec = Array.isArray(sourceSettings.packages) ? sourceSettings.packages.find((entry) => npmPackageName(entry) === MANAGED_TELEMETRY_PACKAGE) : null;
-    if (typeof packageSpec !== "string") return null;
-    const packagePath = join4(npmSource, "node_modules", ...MANAGED_TELEMETRY_PACKAGE.split("/"), "package.json");
-    if (!existsSync3(packagePath) || lstatSync2(packagePath).isSymbolicLink() || !lstatSync2(packagePath).isFile()) {
-      throw new Error(`pi_managed_mcp_attestation_failed: configured ${MANAGED_TELEMETRY_PACKAGE} package is unavailable`);
-    }
-    let packageMetadata;
-    try {
-      packageMetadata = JSON.parse(readFileSync3(packagePath, "utf8"));
-    } catch {
-      throw new Error(`pi_managed_mcp_attestation_failed: configured ${MANAGED_TELEMETRY_PACKAGE} package metadata is invalid`);
-    }
-    if (packageMetadata.name !== MANAGED_TELEMETRY_PACKAGE) {
-      throw new Error(`pi_managed_mcp_attestation_failed: configured ${MANAGED_TELEMETRY_PACKAGE} package identity mismatch`);
-    }
-    return {
-      packageSpec,
-      config: record8(sourceSettings["pi-telemetry"])
-    };
-  }
-  function seedPiRuntime(sourceHome, agentDir, sourceAcquisition = null, mcpToolMode = MANAGED_PI_MCP_TOOL_MODE) {
+  function seedPiRuntime(sourceHome, agentDir, sourceAcquisition = null, mcpToolMode = MANAGED_PI_MCP_TOOL_MODE, baseEnv = {}) {
     const source = resolve2(nonEmpty2(sourceHome, "sourcePiHome"));
     const sourceStat = lstatSync2(source);
     if (!sourceStat.isDirectory() || sourceStat.isSymbolicLink()) {
@@ -3063,30 +3028,20 @@ function createManagedPiMcpProfileApi(options = {}) {
         throw new Error("pi_managed_mcp_attestation_failed: source Pi settings are invalid");
       }
     }
-    const browserUse = selectManagedBrowserUse(sourceSettings, npmSource);
-    const webAccess = sourceAcquisition ? null : selectManagedWebAccess(sourceSettings, npmSource);
-    const telemetry = selectManagedTelemetry(sourceSettings, npmSource);
+    const browserUse = sourceAcquisition ? selectManagedBrowserUse(sourceSettings, npmSource) : null;
     if (sourceAcquisition && !browserUse) {
       throw new Error("pi_managed_mcp_source_acquisition_packages_missing");
     }
-    const settings = {
+    const sourcePackages = Array.isArray(sourceSettings.packages) ? [...sourceSettings.packages] : [];
+    const settings = sourceAcquisition ? {
       ...typeof sourceSettings.defaultProvider === "string" ? { defaultProvider: sourceSettings.defaultProvider } : {},
       ...typeof sourceSettings.defaultModel === "string" ? { defaultModel: sourceSettings.defaultModel } : {},
-      packages: [
-        "npm:pi-mcp-adapter",
-        ...telemetry ? [telemetry.packageSpec] : [],
-        ...webAccess ? [webAccess.packageSpec] : [],
-        ...!sourceAcquisition && browserUse ? [browserUse.packageSpec] : []
-      ],
-      ...telemetry ? { "pi-telemetry": telemetry.config } : {},
-      ...webAccess ? { "pi-web-access": webAccess.config } : {},
-      ...!sourceAcquisition && browserUse ? {
-        plugins: {
-          [MANAGED_BROWSER_USE_PLUGIN]: browserUse.plugin
-        },
-        "pi-browser-use": browserUse.config
-      } : {}
+      packages: ["npm:pi-mcp-adapter"]
+    } : {
+      ...sourceSettings,
+      packages: sourcePackages.some((entry) => npmPackageName(entry) === "pi-mcp-adapter") ? sourcePackages : ["npm:pi-mcp-adapter", ...sourcePackages]
     };
+    const settingsEnv = sourceAcquisition ? {} : referencedSettingsEnvironment(settings, baseEnv);
     writePrivateFile2(join4(agentDir, "settings.json"), `${JSON.stringify(settings, null, 2)}
 `);
     const extensionsDir = join4(agentDir, "extensions");
@@ -3112,7 +3067,10 @@ function createManagedPiMcpProfileApi(options = {}) {
     copyPrivateFile(join4(source, "models.json"), join4(agentDir, "models.json"));
     copyPrivateFile(join4(source, "SYSTEM.md"), join4(agentDir, "SYSTEM.md"));
     const authSource = join4(source, "auth.json");
-    const protectedValues = [];
+    const protectedValues = collectAuthSecretStrings2(settings);
+    for (const [name, value] of Object.entries(settingsEnv)) {
+      if (isSensitiveAuthKey2(name)) protectedValues.push(value);
+    }
     if (copyPrivateFile(authSource, join4(agentDir, "auth.json"))) {
       try {
         collectAuthSecretStrings2(JSON.parse(readFileSync3(authSource, "utf8")), protectedValues);
@@ -3123,7 +3081,7 @@ function createManagedPiMcpProfileApi(options = {}) {
     const npmStat = lstatSync2(npmSource);
     if (!npmStat.isDirectory() || npmStat.isSymbolicLink()) throw new Error("pi_managed_mcp_source_config_unsafe: Pi npm root");
     symlinkSync(npmSource, join4(agentDir, "npm"), "dir");
-    return { adapterVersion, protectedValues };
+    return { adapterVersion, protectedValues, settingsEnv };
   }
   function seedDelegatedPiRuntime(sourceHome, agentDir) {
     const source = resolve2(nonEmpty2(sourceHome, "sourcePiHome"));
@@ -3309,7 +3267,13 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         commandId: input.commandId
       });
       const sourcePiHome = nonEmpty2(input.baseEnv?.PI_CODING_AGENT_DIR ?? input.baseEnv?.PI_AGENT_HOME, "sourcePiHome");
-      const seededRuntime = seedPiRuntime(sourcePiHome, piCodingAgentDir, input.sourceAcquisition, mcpToolMode);
+      const seededRuntime = seedPiRuntime(
+        sourcePiHome,
+        piCodingAgentDir,
+        input.sourceAcquisition,
+        mcpToolMode,
+        input.baseEnv
+      );
       const restoredNativeSession = restoreManagedPiSessionRollout(input, sessionsRoot, runDir, executorHome, authority);
       const configPath = join4(piCodingAgentDir, "mcp.json");
       const directToolNames = directCatalog?.tools.map((tool) => tool.exposedName) ?? [];
@@ -3388,6 +3352,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         };
       }
       const env = {
+        ...seededRuntime.settingsEnv,
         ...buildIsolatedEnvironment2(input.baseEnv, input.commandEnv),
         HOME: home,
         PI_AGENT_HOME: piAgentHome,
@@ -3442,7 +3407,6 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         protectedValues: [.../* @__PURE__ */ new Set([
           sessionToken,
           ...seededRuntime.protectedValues,
-          ...MANAGED_TELEMETRY_PROTECTED_ENV_NAMES.map((name) => input.baseEnv?.[name]).filter((value) => typeof value === "string" && value.length > 0),
           ...MANAGED_PI_PROVIDER_PROTECTED_ENV_NAMES.map((name) => input.commandEnv?.[name]).filter((value) => typeof value === "string" && value.length > 0)
         ])],
         attestation: {
@@ -9680,7 +9644,7 @@ function assertSourceAcquisitionRuntimeAuthority({
 }
 
 // src/amaster-runtime-daemon.mjs
-var CONNECTOR_VERSION = "0.1.1-beta.16";
+var CONNECTOR_VERSION = "0.1.1-beta.17";
 var CONNECTOR_CONTRACT_VERSION = "2026-06-04.v1";
 var SOURCE_ACQUISITION_CAPABILITY = "source_acquisition_v1";
 var SOURCE_ACQUISITION_PROFILE_VERSION = "source_acquisition_v1";

package/dist/amaster-runtime.mjs

@@ -6,7 +6,7 @@ import { basename, dirname, join, resolve } from "node:path";
 import { homedir, hostname } from "node:os";
 import { fileURLToPath } from "node:url";
 
-const CONNECTOR_VERSION = "0.1.1-beta.16";
+const CONNECTOR_VERSION = "0.1.1-beta.17";
 
 const CAPABILITIES = [
   "remote_registration",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amaster.ai/employee-runtime-connector",
-  "version": "0.1.1-beta.16",
+  "version": "0.1.1-beta.17",
   "description": "MirrorX runtime connector CLI and daemon",
   "license": "MIT",
   "type": "module",