@amaster.ai/employee-runtime-connector 0.1.1-beta.25 → 0.1.1-beta.26

package/dist/amaster-runtime-daemon.mjs

@@ -1871,10 +1871,11 @@ import { spawnSync as spawnSync2 } from "node:child_process";
 import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname as dirname2, join as join3 } from "node:path";
 var AMASTER_API_KEY_ENV_REFERENCE = "${AMASTER_API_KEY}";
+var AMASTER_BILLING_TURN_HEADER_ENV_REFERENCE = "${AMASTER_BILLING_TURN_ID}";
 var AMASTER_BILLING_HEADER_ENV_REFERENCES = Object.freeze({
   "x-pi-agent-oauth-token": "${AMASTER_PLATFORM_OAUTH_TOKEN}",
   "x-organization-id": "${AMASTER_PLATFORM_ORGANIZATION_ID}",
-  "x-billing-turn-id": "${AMASTER_BILLING_TURN_ID}"
+  "x-billing-turn-id": AMASTER_BILLING_TURN_HEADER_ENV_REFERENCE
 });
 var MANAGED_PI_PROVIDER_ENV_NAMES = Object.freeze([
   "AMASTER_MODEL_ACCESS_MODE",
@@ -1933,6 +1934,8 @@ function syncManagedBillingHeaders(value, executorEnv) {
   const headers = withoutManagedBillingHeaders(value);
   if (readString(executorEnv.AMASTER_MODEL_ACCESS_MODE) === "billing_gateway") {
     Object.assign(headers, AMASTER_BILLING_HEADER_ENV_REFERENCES);
+  } else if (readString(executorEnv.AMASTER_BILLING_TURN_ID)) {
+    headers["x-billing-turn-id"] = AMASTER_BILLING_TURN_HEADER_ENV_REFERENCE;
   }
   return Object.keys(headers).length > 0 ? headers : void 0;
 }
@@ -3232,11 +3235,23 @@ function createManagedPiMcpProfileApi(options = {}) {
     }
     return profile;
   }
-  function materializeManagedRoleSkills(piHome, skillsDir, skillProfile) {
-    const profile = readSkillProfile(piHome, skillProfile);
+  function materializeManagedRoleSkills(piHome, skillsDir, skillProfiles) {
     if (existsSync3(skillsDir)) throw new Error("pi_managed_mcp_role_skills_exists");
     const enabled = [];
-    for (const entry of profile) {
+    const entriesByName = /* @__PURE__ */ new Map();
+    for (const skillProfile of skillProfiles) {
+      for (const entry of readSkillProfile(piHome, skillProfile)) {
+        const existing = entriesByName.get(entry.name);
+        if (existing) {
+          if (realpathSync2(existing.source) !== realpathSync2(entry.source)) {
+            throw new Error(`pi_managed_mcp_skill_profile_conflict:${entry.name}`);
+          }
+          continue;
+        }
+        entriesByName.set(entry.name, entry);
+      }
+    }
+    for (const entry of entriesByName.values()) {
       const target = join4(skillsDir, entry.name);
       copyTreeNoLinks(entry.source, target);
       const skillFile = join4(target, "SKILL.md");
@@ -3247,6 +3262,19 @@ function createManagedPiMcpProfileApi(options = {}) {
     }
     return { skillsDir, enabled };
   }
+  function requestedSkillProfiles(input) {
+    return [...new Set([
+      ...Array.isArray(input.skillProfiles) ? input.skillProfiles : [],
+      input.skillProfile
+    ].filter((value) => typeof value === "string" && value.trim()).map((value) => value.trim()))];
+  }
+  function skillProfileAttestation(skillProfiles, enabledSkills) {
+    if (skillProfiles.length === 0) return {};
+    return {
+      ...skillProfiles.length === 1 ? { skillProfile: skillProfiles[0] } : { skillProfiles },
+      enabledSkillsDigest: createHash3("sha256").update(JSON.stringify(enabledSkills)).digest("hex")
+    };
+  }
   function seedDelegatedPiRuntime(sourceHome, agentDir) {
     const source = resolve3(nonEmpty2(sourceHome, "sourcePiHome"));
     const sourceStat = lstatSync3(source);
@@ -3556,27 +3584,19 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
       }
       const skillArgs = [];
       let enabledRoleSkills = null;
-      const skillProfile = typeof input.skillProfile === "string" && input.skillProfile.trim() ? input.skillProfile.trim() : null;
-      if (skillProfile) {
+      const skillProfiles = requestedSkillProfiles(input);
+      if (skillProfiles.length > 0) {
         const roleSkills = materializeManagedRoleSkills(
           sharedRuntime.home,
           join4(profileRoot, "role-skills"),
-          skillProfile
+          skillProfiles
         );
         skillArgs.push("--no-approve", "--skill", roleSkills.skillsDir);
         enabledRoleSkills = roleSkills.enabled;
       }
-      const providerEnv = {};
-      for (const name of MANAGED_PI_PROVIDER_ENV_NAMES) {
-        const commandValue = input.commandEnv?.[name];
-        if (typeof commandValue === "string" && commandValue) continue;
-        const value = input.baseEnv?.[name];
-        if (typeof value === "string" && value) providerEnv[name] = value;
-      }
       const env = {
         ...sharedRuntime.settingsEnv,
         ...buildIsolatedEnvironment2(input.baseEnv, input.commandEnv),
-        ...providerEnv,
         HOME: home,
         PI_AGENT_HOME: piAgentHome,
         PI_CODING_AGENT_SESSION_DIR: sessionsRoot,
@@ -3627,10 +3647,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         commandId: input.commandId,
         runId,
         sessionId: gateway.sessionId,
-        ...skillProfile ? {
-          skillProfile,
-          enabledSkillsDigest: createHash3("sha256").update(JSON.stringify(enabledRoleSkills)).digest("hex")
-        } : {}
+        ...skillProfileAttestation(skillProfiles, enabledRoleSkills)
       };
       return {
         profileRoot,
@@ -3648,7 +3665,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         protectedValues: [.../* @__PURE__ */ new Set([
           sessionToken,
           ...sharedRuntime.protectedValues,
-          ...MANAGED_PI_PROVIDER_PROTECTED_ENV_NAMES.map((name) => input.commandEnv?.[name] ?? providerEnv[name]).filter((value) => typeof value === "string" && value.length > 0)
+          ...MANAGED_PI_PROVIDER_PROTECTED_ENV_NAMES.map((name) => input.commandEnv?.[name]).filter((value) => typeof value === "string" && value.length > 0)
         ])],
         attestation: {
           ...attestationFacts,
@@ -3722,6 +3739,18 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
       };
       writePrivateFile2(configPath, `${JSON.stringify(config, null, 2)}
 `);
+      const skillProfiles = requestedSkillProfiles(input);
+      const skillArgs = [];
+      let enabledRoleSkills = null;
+      if (skillProfiles.length > 0) {
+        const roleSkills = materializeManagedRoleSkills(
+          sourcePiHome,
+          join4(profileRoot, "role-skills"),
+          skillProfiles
+        );
+        skillArgs.push("--no-approve", "--skill", roleSkills.skillsDir);
+        enabledRoleSkills = roleSkills.enabled;
+      }
       const env = {
         ...input.baseEnv,
         ...record6(input.commandEnv),
@@ -3750,7 +3779,8 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         sessionId: gateway.sessionId,
         sourcePiHome,
         piCodingAgentDir,
-        configSha256: sha2562(readFileSync3(configPath))
+        configSha256: sha2562(readFileSync3(configPath)),
+        ...skillProfileAttestation(skillProfiles, enabledRoleSkills)
       };
       return {
         profileRoot,
@@ -3760,6 +3790,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         configPath,
         markerPath,
         env,
+        skillArgs,
         toolAllowlist: null,
         protectedValues: [.../* @__PURE__ */ new Set([sessionToken, ...seededRuntime.protectedValues])],
         attestation: {
@@ -6097,11 +6128,6 @@ var CAPABILITIES = [
 ];
 var RUNNER_KIND_CLOUD_MANAGED = "cloud_managed";
 var RUNNER_KIND_DESKTOP_DELEGATED = "desktop_delegated";
-var CREDENTIAL_SOURCE_EMPLOYEE_COMMAND_ENV = "employee_command_env";
-var CREDENTIAL_SOURCE_DESKTOP_PLATFORM_AUTH = "desktop_platform_auth";
-function credentialSourceForRunnerKind(runnerKind) {
-  return runnerKind === RUNNER_KIND_DESKTOP_DELEGATED ? CREDENTIAL_SOURCE_DESKTOP_PLATFORM_AUTH : CREDENTIAL_SOURCE_EMPLOYEE_COMMAND_ENV;
-}
 function readEnum(value, allowed, fallback, label) {
   const text = String(value ?? "").trim();
   if (!text) return fallback;
@@ -6247,7 +6273,6 @@ function buildConfig(env = process.env, flags = {}) {
     RUNNER_KIND_CLOUD_MANAGED,
     "AMASTER_RUNTIME_RUNNER_KIND"
   );
-  const credentialSource = credentialSourceForRunnerKind(runnerKind);
   const agentInstructionSystemKernelMode = readEnum(
     flags.agentInstructionSystemKernelMode ?? env.AMASTER_AGENT_INSTRUCTION_SYSTEM_KERNEL_MODE,
     ["shadow", "canary"],
@@ -6288,7 +6313,6 @@ function buildConfig(env = process.env, flags = {}) {
     piExecutorUid,
     piExecutorGid,
     runnerKind,
-    credentialSource,
     agentInstructionSystemKernel: {
       mode: agentInstructionSystemKernelMode,
       agentIds: splitList(
@@ -6301,9 +6325,6 @@ function buildConfig(env = process.env, flags = {}) {
         flags.agentInstructionSystemKernelSourceSha256Allowlist ?? env.AMASTER_AGENT_INSTRUCTION_SYSTEM_KERNEL_SOURCE_SHA256_ALLOWLIST ?? ""
       ).map((value) => value.toLowerCase())
     },
-    desktopPlatformSystemDataDir: String(
-      flags.desktopPlatformSystemDataDir ?? env.AMASTER_RUNTIME_DESKTOP_PLATFORM_SYSTEM_DATA_DIR ?? ""
-    ).trim(),
     capabilities: splitList(flags.capabilities ?? env.AMASTER_CAPABILITIES ?? CAPABILITIES.join(",")),
     pollIntervalSeconds: Number(flags.pollIntervalSeconds ?? env.AMASTER_POLL_INTERVAL_SECONDS ?? 10),
     maxConcurrentCommands: Math.min(
@@ -9284,7 +9305,7 @@ function assertSourceAcquisitionRuntimeAuthority({
 }
 
 // src/amaster-runtime-daemon.mjs
-var CONNECTOR_VERSION = "0.1.1-beta.25";
+var CONNECTOR_VERSION = "0.1.1-beta.26";
 var CONNECTOR_CONTRACT_VERSION = "2026-06-04.v1";
 var SOURCE_ACQUISITION_CAPABILITY = "source_acquisition_v1";
 var SOURCE_ACQUISITION_PROFILE_VERSION = "source_acquisition_v1";
@@ -9858,7 +9879,6 @@ function buildHeartbeatPayload(config, options = {}) {
   const activeRunCommandList = Array.from(activeRunCommandById.values()).map((entry) => buildActiveRunCommandStatus(config, entry));
   const activeRunCount = activeRunCommandList.filter(activeRunCommandCountsAsActive).length;
   const executorReadiness = buildExecutorReadiness(config);
-  const desktopPlatformCredential = desktopPlatformCredentialStatus(config);
   const sourceAcquisition = sourceAcquisitionRuntimeReadiness(config);
   const status = options.status === "offline" ? "offline" : "online";
   const daemonStatus = status === "offline" ? "stopping" : "running";
@@ -9888,8 +9908,6 @@ function buildHeartbeatPayload(config, options = {}) {
       stateFile: stateFilePath(process.env),
       ...executorReadiness.length > 0 ? { executorReadiness } : {},
       runnerKind: config.runnerKind,
-      credentialSource: config.credentialSource,
-      ...desktopPlatformCredential ? { desktopPlatformCredential } : {},
       sourceAcquisition,
       ...versionDrift.versionDrift || versionDrift.bundleDrift ? versionDrift : {}
     },
@@ -9901,52 +9919,6 @@ function buildHeartbeatPayload(config, options = {}) {
 function desktopDelegatedRunnerEnabled(config) {
   return config.runnerKind === RUNNER_KIND_DESKTOP_DELEGATED;
 }
-function desktopPlatformCredentialEnabled(config) {
-  return desktopDelegatedRunnerEnabled(config);
-}
-function desktopPlatformSystemDataDir(config) {
-  const configured = readString(config.desktopPlatformSystemDataDir ?? process.env.AMASTER_RUNTIME_DESKTOP_PLATFORM_SYSTEM_DATA_DIR);
-  return configured ? resolve9(expandHomePath(configured)) : null;
-}
-function readDesktopPlatformCredential(credentialsDir) {
-  const pointer = readJsonFile2(join12(credentialsDir, "latest.json"));
-  const credentialRef = readString(pointer.credentialRef);
-  if (!credentialRef || !/^[a-f0-9]{64}$/i.test(credentialRef)) return null;
-  const credential = readJsonFile2(join12(credentialsDir, `${credentialRef}.json`));
-  const organizationId = readString(credential.organizationId);
-  const apiKey = readString(credential.apiKey);
-  if (credential.version !== 1 || !organizationId || !apiKey) return null;
-  return {
-    organizationId,
-    apiKey,
-    ...readString(credential.baseUrl) ? { baseUrl: readString(credential.baseUrl) } : {}
-  };
-}
-function desktopPlatformCredentials(config) {
-  if (!desktopPlatformCredentialEnabled(config)) return [];
-  const systemDataDir = desktopPlatformSystemDataDir(config);
-  if (!systemDataDir) return [];
-  const companiesDir = join12(systemDataDir, "companies");
-  let entries = [];
-  try {
-    entries = readdirSync8(companiesDir, { withFileTypes: true });
-  } catch {
-    return [];
-  }
-  const credentialsByOrganizationId = /* @__PURE__ */ new Map();
-  for (const entry of entries) {
-    if (!entry.isDirectory()) continue;
-    const credential = readDesktopPlatformCredential(join12(companiesDir, entry.name, "model-credentials"));
-    if (credential) credentialsByOrganizationId.set(credential.organizationId, credential);
-  }
-  return [...credentialsByOrganizationId.values()];
-}
-function desktopPlatformCredentialStatus(config) {
-  if (!desktopPlatformCredentialEnabled(config)) return null;
-  return {
-    readyOrganizationIds: desktopPlatformCredentials(config).map((credential) => credential.organizationId).sort()
-  };
-}
 function writeLocalRuntimeStatus(config, runtimeStatus) {
   const currentState = readState(process.env);
   writeState(process.env, {
@@ -10537,42 +10509,18 @@ function readJsonFile2(filePath) {
     return {};
   }
 }
-function resolvePiExecutorProviderConfig(config, command, executorEnv) {
-  const desktopPlatformCredential = desktopPlatformCredentialForCommand(config, command);
-  if (desktopPlatformCredentialEnabled(config) && !desktopPlatformCredential) {
-    throw new Error("Desktop Platform credential is unavailable for this command organization");
-  }
-  return {
-    providerConfig: desktopPlatformCredential ?? executorEnv,
-    credentialSource: desktopPlatformCredential ? CREDENTIAL_SOURCE_DESKTOP_PLATFORM_AUTH : CREDENTIAL_SOURCE_EMPLOYEE_COMMAND_ENV
-  };
-}
-async function syncPiExecutorProviderConfig(config, command, agentDir, resolvedProviderConfig) {
+async function syncPiExecutorProviderConfig(config, command, agentDir, providerConfig) {
   if (!agentDir) return;
-  const { providerConfig, credentialSource } = resolvedProviderConfig;
   const { modelsSynced, settingsSynced } = syncAmasterProviderFiles(agentDir, providerConfig);
   if (modelsSynced || settingsSynced) {
     await ingestLog(config, command, "system", "info", "Synced AMaster provider config for pi executor", {
       modelsSynced,
       settingsSynced,
-      credentialSource,
+      credentialSource: "server_command_env",
       providerBaseUrlConfigured: Boolean(readString(providerConfig.AMASTER_PROVIDER_BASE_URL))
     });
   }
 }
-function desktopPlatformCredentialForCommand(config, command) {
-  if (!desktopPlatformCredentialEnabled(config)) return null;
-  const executionContext = asRecord(command.executionContext);
-  const runtimeExecutionContext = asRecord(asRecord(command.runtimeAuth).executionContext);
-  const organizationId = readString(executionContext.platformOrganizationId) ?? readString(runtimeExecutionContext.platformOrganizationId);
-  if (!organizationId) return null;
-  const credential = desktopPlatformCredentials(config).find((entry) => entry.organizationId === organizationId);
-  if (!credential) return null;
-  return {
-    AMASTER_API_KEY: credential.apiKey,
-    ...credential.baseUrl ? { AMASTER_PROVIDER_BASE_URL: credential.baseUrl } : {}
-  };
-}
 function normalizeWorkspaceContext(workspace) {
   if (typeof workspace === "string") {
     return {
@@ -10757,6 +10705,7 @@ function buildExecutorEnv(config, command, workspace) {
   const issueId = commandIssueId(command) ?? "";
   const companyId = readString(runtimeAuth.companyId) ?? readString(asRecord(command.payload).companyId) ?? "";
   const baseEnv = { ...process.env };
+  for (const name of MANAGED_PI_PROVIDER_ENV_NAMES) delete baseEnv[name];
   const executorPaths = readStringArray(config.executorPaths);
   if (executorPaths.length > 0) {
     baseEnv.PATH = [...executorPaths, baseEnv.PATH ?? ""].filter(Boolean).join(delimiter3);
@@ -13806,21 +13755,16 @@ async function executeRunCommand(config, command) {
       cleanupManagedMcpProfile = cleanupManagedCodexMcpProfile;
     }
     if (executor.kind === "pi") {
-      if (desktopPlatformCredentialEnabled(config)) {
-        for (const envName of MANAGED_PI_PROVIDER_ENV_NAMES) {
-          delete executorEnv[envName];
-        }
-      }
-      piResolvedProviderConfig = resolvePiExecutorProviderConfig(config, command, executorEnv);
+      piResolvedProviderConfig = executorEnv;
       for (const envName of ["AMASTER_API_KEY", "AMASTER_PLATFORM_OAUTH_TOKEN"]) {
-        const protectedValue = readString(piResolvedProviderConfig.providerConfig[envName]);
+        const protectedValue = readString(piResolvedProviderConfig[envName]);
         if (protectedValue && !providerProtectedValues.includes(protectedValue)) {
           providerProtectedValues.push(protectedValue);
         }
       }
       if (Object.keys(governedMcp).length > 0) {
         const preparePiMcpProfile = desktopDelegatedRunnerEnabled(config) ? prepareDelegatedPiMcpProfile : prepareManagedPiMcpProfile;
-        const piProfileCommandEnv = desktopDelegatedRunnerEnabled(config) ? {} : commandExecutorEnv(command);
+        const piProfileCommandEnv = commandExecutorEnv(command);
         managedMcpProfile = preparePiMcpProfile({
           commandId: command.commandId,
           runId: commandRunId(command),
@@ -13836,6 +13780,7 @@ async function executeRunCommand(config, command) {
           extraArgs: sourceAcquisition ? [] : splitExtraArgs(process.env.AMASTER_PI_EXTRA_ARGS),
           sourceAcquisition,
           skillProfile: readString(asRecord(command.payload).skillProfile),
+          skillProfiles: readStringArray(asRecord(command.payload).skillProfiles),
           ...config.piExecutorUid > 0 && !desktopDelegatedRunnerEnabled(config) ? {
             prepareExecutorAccess: ({ profileRoot, workspaceRoot }) => preparePiExecutorAccess({
               uid: config.piExecutorUid,
@@ -13886,7 +13831,7 @@ async function executeRunCommand(config, command) {
     }
     if (executor.kind === "pi" && piResolvedProviderConfig) {
       const sharedPiHome = readString(process.env.PI_CODING_AGENT_DIR) ?? readString(process.env.PI_AGENT_HOME) ?? null;
-      let agentDir = managedMcpProfile ? readString(managedMcpProfile.env.PI_CODING_AGENT_DIR) ?? readString(managedMcpProfile.env.PI_AGENT_HOME) ?? null : desktopPlatformCredentialEnabled(config) ? readString(executorEnv.PI_AGENT_HOME) ?? readString(executorEnv.PI_CODING_AGENT_DIR) ?? null : readString(executorEnv.PI_CODING_AGENT_DIR) ?? readString(executorEnv.PI_AGENT_HOME) ?? null;
+      let agentDir = managedMcpProfile ? readString(managedMcpProfile.env.PI_CODING_AGENT_DIR) ?? readString(managedMcpProfile.env.PI_AGENT_HOME) ?? null : desktopDelegatedRunnerEnabled(config) ? readString(executorEnv.PI_AGENT_HOME) ?? readString(executorEnv.PI_CODING_AGENT_DIR) ?? null : readString(executorEnv.PI_CODING_AGENT_DIR) ?? readString(executorEnv.PI_AGENT_HOME) ?? null;
       if (agentDir && sharedPiHome && resolve9(agentDir) === resolve9(sharedPiHome)) {
         agentDir = null;
       }

package/dist/amaster-runtime.mjs

@@ -6,7 +6,7 @@ import { basename, dirname, join, resolve } from "node:path";
 import { homedir, hostname } from "node:os";
 import { fileURLToPath } from "node:url";
 
-const CONNECTOR_VERSION = "0.1.1-beta.25";
+const CONNECTOR_VERSION = "0.1.1-beta.26";
 
 const CAPABILITIES = [
   "remote_registration",
@@ -55,7 +55,6 @@ const CONFIG_KEY_MAP = new Map([
   ["pi_agent_home", "PI_AGENT_HOME"],
   ["pi_agent_node", "PI_AGENT_NODE"],
   ["runner_kind", "AMASTER_RUNTIME_RUNNER_KIND"],
-  ["desktop_platform_system_data_dir", "AMASTER_RUNTIME_DESKTOP_PLATFORM_SYSTEM_DATA_DIR"],
   ["heartbeat_log_mode", "AMASTER_HEARTBEAT_LOG_MODE"],
 ]);
 
@@ -84,7 +83,6 @@ const ENV_ORDER = [
   "PI_AGENT_HOME",
   "PI_AGENT_NODE",
   "AMASTER_RUNTIME_RUNNER_KIND",
-  "AMASTER_RUNTIME_DESKTOP_PLATFORM_SYSTEM_DATA_DIR",
   "AMASTER_HEARTBEAT_LOG_MODE",
 ];
 
@@ -459,7 +457,6 @@ function printConfig(config) {
     ["pi_agent_home", merged.PI_AGENT_HOME || "(default)"],
     ["pi_agent_node", merged.PI_AGENT_NODE || "(default)"],
     ["runner_kind", merged.AMASTER_RUNTIME_RUNNER_KIND || "cloud_managed"],
-    ["desktop_platform_system_data_dir", merged.AMASTER_RUNTIME_DESKTOP_PLATFORM_SYSTEM_DATA_DIR ? "(configured)" : "(not configured)"],
     ["heartbeat_log_mode", merged.AMASTER_HEARTBEAT_LOG_MODE || "(compact)"],
     ["network_domains", merged.AMASTER_NETWORK_DOMAINS],
     ["capabilities", merged.AMASTER_CAPABILITIES],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amaster.ai/employee-runtime-connector",
-  "version": "0.1.1-beta.25",
+  "version": "0.1.1-beta.26",
   "description": "MirrorX runtime connector CLI and daemon",
   "license": "MIT",
   "type": "module",