@amaster.ai/employee-runtime-connector 0.1.1-beta.256 → 0.1.1-beta.257

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -6532,6 +6532,20 @@ var ERROR_PRESENTATIONS = {
6532
6532
  nextAction: "\u5145\u503C\u540E\u7CFB\u7EDF\u4F1A\u5B9A\u65F6\u68C0\u67E5\u5E76\u81EA\u52A8\u6062\u590D\uFF0C\u65E0\u9700\u624B\u52A8\u91CD\u8BD5\u3002",
6533
6533
  tone: "warning"
6534
6534
  },
6535
+ pi_governed_tool_surface_changed: {
6536
+ label: "\u53D7\u7BA1\u5DE5\u5177\u5B9A\u4E49\u5DF2\u53D8\u5316",
6537
+ summary: "\u8FD0\u884C\u671F\u95F4\u7684\u53D7\u7BA1\u5DE5\u5177\u6570\u91CF\u6216\u5B9A\u4E49\u53D1\u751F\u53D8\u5316\uFF0C\u7CFB\u7EDF\u5DF2\u505C\u6B62\u91C7\u4FE1\u672C\u6B21\u8F93\u51FA\u3002",
6538
+ nextAction: "\u68C0\u67E5 Governed MCP \u5DE5\u5177\u76EE\u5F55\u4E0E adapter \u7248\u672C\uFF1B\u7CFB\u7EDF\u4EC5\u4F1A\u5728\u786E\u8BA4\u6CA1\u6709\u672A\u51B3\u526F\u4F5C\u7528\u540E\u8FDB\u884C\u4E00\u6B21\u5B89\u5168\u91CD\u8BD5\u3002",
6539
+ actionTitle: "\u6838\u5BF9\u53D7\u7BA1\u5DE5\u5177\u76EE\u5F55\u540E\u91CD\u8BD5",
6540
+ tone: "danger"
6541
+ },
6542
+ pi_governed_mcp_unavailable: {
6543
+ label: "\u53D7\u7BA1\u5DE5\u5177\u6682\u4E0D\u53EF\u7528",
6544
+ summary: "\u8FD0\u884C\u6240\u9700\u7684\u53D7\u7BA1\u5DE5\u5177\u8FDE\u63A5\u6682\u4E0D\u53EF\u7528\uFF0C\u7CFB\u7EDF\u5DF2\u4FDD\u7559\u672C\u6B21\u8FD0\u884C\u7684\u526F\u4F5C\u7528\u8BC1\u636E\u3002",
6545
+ nextAction: "\u7B49\u5F85\u8FDE\u63A5\u6062\u590D\uFF1B\u53EA\u6709\u5728\u786E\u8BA4\u672C\u6B21\u8FD0\u884C\u6CA1\u6709\u672A\u51B3\u526F\u4F5C\u7528\u65F6\uFF0C\u7CFB\u7EDF\u624D\u4F1A\u8FDB\u884C\u4E00\u6B21\u5B89\u5168\u91CD\u8BD5\u3002",
6546
+ actionTitle: "\u68C0\u67E5\u53D7\u7BA1\u5DE5\u5177\u8FDE\u63A5",
6547
+ tone: "warning"
6548
+ },
6535
6549
  issue_assignee_changed: {
6536
6550
  label: "\u4EFB\u52A1\u5DF2\u6539\u6D3E",
6537
6551
  summary: "\u65E7\u8D1F\u8D23\u4EBA\u7684\u6392\u961F\u8FD0\u884C\u5DF2\u53D6\u6D88\uFF0C\u65B0\u8D1F\u8D23\u4EBA\u4F1A\u81EA\u52A8\u63A5\u624B\u3002",
@@ -18681,6 +18695,12 @@ function requiredInteger(value, name, minimum = 0) {
18681
18695
  if (!Number.isSafeInteger(value) || value < minimum) throw new Error(`pi_final_context_attestor_invalid: ${name}`);
18682
18696
  return value;
18683
18697
  }
18698
+ function optionalSha256(value, name) {
18699
+ if (value === void 0 || value === null) return null;
18700
+ const hash = requiredString(value, name);
18701
+ if (!/^[a-f0-9]{64}$/.test(hash)) throw new Error(`pi_final_context_attestor_invalid: ${name}`);
18702
+ return hash;
18703
+ }
18684
18704
  function managedPiProjectInstructionExtensionSource(input) {
18685
18705
  const projectInstructionPath = resolve3(requiredString(input.projectInstructionPath, "projectInstructionPath"));
18686
18706
  const projectInstructionSha256 = requiredString(input.projectInstructionSha256, "projectInstructionSha256");
@@ -18755,6 +18775,9 @@ function managedPiFinalContextAttestorExtensionSource(input) {
18755
18775
  effectiveToolSchemaBytes: requiredInteger(input.effectiveToolSchemaBytes, "effectiveToolSchemaBytes", 1),
18756
18776
  effectiveToolSetSha256: requiredString(input.effectiveToolSetSha256, "effectiveToolSetSha256"),
18757
18777
  effectiveToolCount: requiredInteger(input.effectiveToolCount, "effectiveToolCount", 1),
18778
+ catalogSetSha256: optionalSha256(input.catalogSetSha256, "catalogSetSha256"),
18779
+ configSha256: optionalSha256(input.configSha256, "configSha256"),
18780
+ cacheSha256: optionalSha256(input.cacheSha256, "cacheSha256"),
18758
18781
  toolSetMode,
18759
18782
  requiredToolEntries,
18760
18783
  skillMetadataBytes: requiredInteger(input.skillMetadataBytes, "skillMetadataBytes"),
@@ -18989,17 +19012,28 @@ export default function amasterFinalModelContextAttestor(pi) {
18989
19012
  requiredToolSet.hash = sha256(stableJson(requiredToolSet.entries));
18990
19013
  if (requiredToolSet.entries.length !== CONTRACT.effectiveToolCount) {
18991
19014
  observe("provider_tool_count_mismatch", {
19015
+ reason: "provider_tool_count_mismatch",
18992
19016
  expectedCount: CONTRACT.effectiveToolCount,
18993
19017
  actualCount: requiredToolSet.entries.length,
18994
- actualEntries: toolSet.entries,
19018
+ providerCallIndex: calls.length + 1,
19019
+ contractToolSetSha256: CONTRACT.effectiveToolSetSha256,
19020
+ ...(CONTRACT.catalogSetSha256 ? { catalogSetSha256: CONTRACT.catalogSetSha256 } : {}),
19021
+ ...(CONTRACT.configSha256 ? { configSha256: CONTRACT.configSha256 } : {}),
19022
+ ...(CONTRACT.cacheSha256 ? { cacheSha256: CONTRACT.cacheSha256 } : {}),
18995
19023
  });
18996
19024
  reject("provider_tool_count_mismatch");
18997
19025
  }
18998
19026
  if (requiredToolSet.hash !== CONTRACT.effectiveToolSetSha256) {
18999
19027
  observe("provider_tool_set_mismatch", {
19000
- expectedToolSetSha256: CONTRACT.effectiveToolSetSha256,
19001
- actualToolSetSha256: toolSet.hash,
19002
- actualEntries: toolSet.entries,
19028
+ reason: "provider_tool_set_mismatch",
19029
+ expectedCount: CONTRACT.effectiveToolCount,
19030
+ actualCount: requiredToolSet.entries.length,
19031
+ providerCallIndex: calls.length + 1,
19032
+ contractToolSetSha256: CONTRACT.effectiveToolSetSha256,
19033
+ actualToolSetSha256: requiredToolSet.hash,
19034
+ ...(CONTRACT.catalogSetSha256 ? { catalogSetSha256: CONTRACT.catalogSetSha256 } : {}),
19035
+ ...(CONTRACT.configSha256 ? { configSha256: CONTRACT.configSha256 } : {}),
19036
+ ...(CONTRACT.cacheSha256 ? { cacheSha256: CONTRACT.cacheSha256 } : {}),
19003
19037
  });
19004
19038
  reject("provider_tool_set_mismatch");
19005
19039
  }
@@ -21770,6 +21804,7 @@ import { spawnSync as spawnSync3 } from "node:child_process";
21770
21804
  // src/amaster-runtime-daemon/pi-mcp-adapter-config.mjs
21771
21805
  var CONFIG_HASH_V2_24_MINIMUM = [2, 24, 0];
21772
21806
  var CONFIG_HASH_V2_26_MINIMUM = [2, 26, 0];
21807
+ var DIRECT_CATALOG_FREEZE_MINIMUM = [2, 32, 1];
21773
21808
  function piMcpAdapterVersionAtLeast(version, minimum) {
21774
21809
  const actual = version.split(/[.-]/, 3).map(Number);
21775
21810
  for (let index = 0; index < minimum.length; index += 1) {
@@ -21778,6 +21813,13 @@ function piMcpAdapterVersionAtLeast(version, minimum) {
21778
21813
  }
21779
21814
  return true;
21780
21815
  }
21816
+ function assertPiMcpAdapterDirectCatalogSupport(version) {
21817
+ if (typeof version !== "string" || !piMcpAdapterVersionAtLeast(version, DIRECT_CATALOG_FREEZE_MINIMUM)) {
21818
+ throw new Error(
21819
+ `pi_managed_mcp_unsupported_adapter_version: direct catalog requires pi-mcp-adapter >=2.32.1; found ${typeof version === "string" ? version : "unknown"}`
21820
+ );
21821
+ }
21822
+ }
21781
21823
  function piMcpAdapterServerConfigIdentity(definition, adapterVersion) {
21782
21824
  const supportsV224Config = piMcpAdapterVersionAtLeast(adapterVersion, CONFIG_HASH_V2_24_MINIMUM);
21783
21825
  return {
@@ -22508,6 +22550,23 @@ function applyManagedPiToolAllowlist(args, profile) {
22508
22550
  ...args.slice(printArgIndex)
22509
22551
  ];
22510
22552
  }
22553
+ function assertManagedPiNonInteractiveInvocation(args, profile) {
22554
+ if (profile?.directCatalogFrozen !== true) return;
22555
+ let effectiveMode = null;
22556
+ for (let index = 0; index < args.length; index += 1) {
22557
+ if (args[index] === "--mode") {
22558
+ effectiveMode = args[index + 1] ?? null;
22559
+ index += 1;
22560
+ } else if (args[index].startsWith("--mode=")) {
22561
+ effectiveMode = args[index].slice("--mode=".length);
22562
+ }
22563
+ }
22564
+ const hasJsonMode = effectiveMode === "json";
22565
+ const hasPrintMode = args.includes("-p") || args.includes("--print");
22566
+ if (!hasJsonMode || !hasPrintMode) {
22567
+ throw new Error("pi_managed_mcp_invocation_invalid: frozen direct catalog requires --mode json and -p/--print");
22568
+ }
22569
+ }
22511
22570
  function applyManagedPiRunExitClosureArgs(args, profile) {
22512
22571
  const narrowedArgs = [...args];
22513
22572
  const toolAllowlist = Array.isArray(profile?.toolAllowlist) ? profile.toolAllowlist.filter((name) => typeof name === "string" && name) : [];
@@ -24265,7 +24324,7 @@ ${result2.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
24265
24324
  settings: {
24266
24325
  toolPrefix: "none",
24267
24326
  scriptMode: false,
24268
- ...directCatalog ? { directToolResultDetails: "bounded" } : {}
24327
+ ...directCatalog ? { directToolResultDetails: "bounded", freezeDirectTools: true } : {}
24269
24328
  },
24270
24329
  mcpServers: {
24271
24330
  [SUPPORTED_SERVER_NAME3]: serverConfig
@@ -24304,6 +24363,7 @@ ${result2.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
24304
24363
  );
24305
24364
  }
24306
24365
  const adapterVersion = piMcpAdapterVersion(sharedRuntime.home);
24366
+ if (directCatalog) assertPiMcpAdapterDirectCatalogSupport(adapterVersion);
24307
24367
  const {
24308
24368
  cachePath,
24309
24369
  directAttestationInput
@@ -24476,6 +24536,7 @@ ${result2.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
24476
24536
  // The attestor verifies the naturally active surface after all extensions
24477
24537
  // load; CLI --tools remains unused so user-level tools stay available.
24478
24538
  toolAllowlist: directAttestationInput?.profileToolAllowlist ?? null,
24539
+ directCatalogFrozen: Boolean(directCatalog),
24479
24540
  protectedValues: [.../* @__PURE__ */ new Set([
24480
24541
  sessionToken,
24481
24542
  ...sharedRuntime.protectedValues,
@@ -24694,7 +24755,7 @@ ${result2.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
24694
24755
  // prefix is local presentation state and must not rename this run's
24695
24756
  // governed tools.
24696
24757
  ...directCatalog ? { toolPrefix: "none" } : {},
24697
- ...directCatalog ? { directToolResultDetails: "bounded" } : {}
24758
+ ...directCatalog ? { directToolResultDetails: "bounded", freezeDirectTools: true } : {}
24698
24759
  },
24699
24760
  mcpServers: {
24700
24761
  ...record9(sourceMcp.mcpServers),
@@ -24746,6 +24807,7 @@ ${result2.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
24746
24807
  }
24747
24808
  const userMcpServerNames = Object.keys(record9(sourceMcp.mcpServers)).filter((serverName) => serverName !== SUPPORTED_SERVER_NAME3);
24748
24809
  const adapterVersion = desktopAttestationReadiness?.ready ? desktopAttestationReadiness.adapterVersion : null;
24810
+ if (directCatalog) assertPiMcpAdapterDirectCatalogSupport(adapterVersion);
24749
24811
  const {
24750
24812
  cachePath,
24751
24813
  directAttestationInput
@@ -24888,6 +24950,7 @@ ${result2.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
24888
24950
  }
24889
24951
  } : {},
24890
24952
  toolAllowlist: directAttestationInput?.profileToolAllowlist ?? null,
24953
+ directCatalogFrozen: Boolean(directCatalog),
24891
24954
  protectedValues: [.../* @__PURE__ */ new Set([sessionToken, ...seededRuntime.protectedValues])],
24892
24955
  attestation: {
24893
24956
  ...attestationFacts,
@@ -27507,6 +27570,17 @@ var PI_PROVIDER_PROTOCOL_RE = /provider[^\n]*finish_reason[^\n]*unexpected_state
27507
27570
  var PI_PROVIDER_RETRY_AFTER_SECONDS_RE = /retry[-\s]?after\s*[:=]?\s*(\d{1,6})\s*(?:seconds?|secs?|s)\b/i;
27508
27571
  var PI_TERMINAL_CLEANUP_PERMISSION_RE = /(?:\bkill\b[^\n]*\bEPERM\b|\bEPERM\b[^\n]*\bkill\b)/i;
27509
27572
  var MAX_PI_PROVIDER_RETRY_AFTER_SECONDS = 7 * 24 * 60 * 60;
27573
+ var PI_GOVERNED_MCP_UNAVAILABLE_REASONS = /* @__PURE__ */ new Set([
27574
+ "server_unavailable",
27575
+ "not_connected",
27576
+ "init_failed"
27577
+ ]);
27578
+ var PI_GOVERNED_TOOL_SURFACE_REASONS = /* @__PURE__ */ new Set([
27579
+ "provider_tool_count_mismatch",
27580
+ "provider_tool_set_mismatch",
27581
+ "provider_tool_invalid",
27582
+ "provider_tools_missing"
27583
+ ]);
27510
27584
  var PI_DURABLE_RUNTIME_ACTION_WRITE_TOOLS = /* @__PURE__ */ new Set([
27511
27585
  "runtime_action.submit",
27512
27586
  "runtime_action.commit"
@@ -27643,9 +27717,80 @@ function classifyPiProviderError(input, now = /* @__PURE__ */ new Date()) {
27643
27717
  ...retryNotBefore ? { retryNotBefore: retryNotBefore.toISOString() } : {}
27644
27718
  };
27645
27719
  }
27720
+ function safeSha256(value) {
27721
+ const hash = readString(value);
27722
+ return /^[a-f0-9]{64}$/.test(hash ?? "") ? hash : null;
27723
+ }
27724
+ function safeNonNegativeInteger(value) {
27725
+ return Number.isSafeInteger(value) && value >= 0 ? value : null;
27726
+ }
27727
+ function classifyPiGovernedToolSurfaceFailure(options) {
27728
+ if (options.exitCode !== 78) return null;
27729
+ const stderr = String(options.stderr ?? "");
27730
+ const rejectedReason = stderr.split(/\r?\n/).map((line) => line.startsWith("pi_final_model_context_attestation_rejected:") ? line.slice("pi_final_model_context_attestation_rejected:".length).trim() : null).find((reason) => reason && PI_GOVERNED_TOOL_SURFACE_REASONS.has(reason));
27731
+ if (!rejectedReason) return null;
27732
+ const observationPrefix = "pi_final_model_context_attestation_observation:";
27733
+ let observation = {};
27734
+ for (const line of stderr.split(/\r?\n/)) {
27735
+ if (!line.startsWith(observationPrefix) || line.length > 4096) continue;
27736
+ try {
27737
+ const candidate = asRecord(JSON.parse(line.slice(observationPrefix.length)));
27738
+ if (readString(candidate.reason) === rejectedReason && readString(candidate.event) === rejectedReason) {
27739
+ observation = candidate;
27740
+ }
27741
+ } catch {
27742
+ }
27743
+ }
27744
+ const expectedCount = safeNonNegativeInteger(observation.expectedCount);
27745
+ const actualCount = safeNonNegativeInteger(observation.actualCount);
27746
+ const providerCallIndex = safeNonNegativeInteger(observation.providerCallIndex);
27747
+ const contractToolSetSha256 = safeSha256(observation.contractToolSetSha256);
27748
+ const actualToolSetSha256 = safeSha256(observation.actualToolSetSha256);
27749
+ const catalogSetSha256 = safeSha256(observation.catalogSetSha256);
27750
+ const configSha256 = safeSha256(observation.configSha256);
27751
+ const cacheSha256 = safeSha256(observation.cacheSha256);
27752
+ return {
27753
+ errorCode: "pi_governed_tool_surface_changed",
27754
+ errorFamily: "governance_invariant",
27755
+ retryable: false,
27756
+ governedToolSurface: {
27757
+ reason: rejectedReason,
27758
+ ...expectedCount !== null ? { expectedCount } : {},
27759
+ ...actualCount !== null ? { actualCount } : {},
27760
+ ...providerCallIndex !== null ? { providerCallIndex } : {},
27761
+ ...contractToolSetSha256 ? { contractToolSetSha256 } : {},
27762
+ ...actualToolSetSha256 ? { actualToolSetSha256 } : {},
27763
+ ...catalogSetSha256 ? { catalogSetSha256 } : {},
27764
+ ...configSha256 ? { configSha256 } : {},
27765
+ ...cacheSha256 ? { cacheSha256 } : {}
27766
+ }
27767
+ };
27768
+ }
27646
27769
  function classifyPiOutputFailure(input, options = {}) {
27770
+ const commandFailed = Number.isInteger(options.exitCode) && options.exitCode !== 0 || Boolean(readString(options.invalidOutputError)) || Boolean(readString(options.finalContextAttestationError));
27771
+ const governedSurfaceFailure = classifyPiGovernedToolSurfaceFailure(options);
27772
+ if (governedSurfaceFailure) return governedSurfaceFailure;
27773
+ if (readString(options.finalContextAttestationError)) {
27774
+ return {
27775
+ errorCode: "pi_final_context_attestation_failed",
27776
+ errorFamily: "governance_invariant",
27777
+ retryable: false
27778
+ };
27779
+ }
27647
27780
  const providerFailure = classifyPiProviderError(input, options.now);
27648
27781
  if (providerFailure) return providerFailure;
27782
+ const governedMcpUnavailable = asRecord(asRecord(input).governedMcpUnavailable);
27783
+ const governedUnavailableReason = readString(governedMcpUnavailable.reason);
27784
+ if (commandFailed && governedUnavailableReason && PI_GOVERNED_MCP_UNAVAILABLE_REASONS.has(governedUnavailableReason)) {
27785
+ return {
27786
+ errorCode: "pi_governed_mcp_unavailable",
27787
+ errorFamily: "transient_infra",
27788
+ governedMcpUnavailable: {
27789
+ reason: governedUnavailableReason,
27790
+ ...readString(governedMcpUnavailable.toolName) ? { toolName: readString(governedMcpUnavailable.toolName) } : {}
27791
+ }
27792
+ };
27793
+ }
27649
27794
  if (!readString(options.invalidOutputError)) return null;
27650
27795
  return {
27651
27796
  errorCode: "pi_executor_invalid_output",
@@ -27847,6 +27992,34 @@ function piMcpToolResults(event) {
27847
27992
  }
27848
27993
  return results;
27849
27994
  }
27995
+ function piGovernedMcpUnavailableEvidence(event) {
27996
+ const messageToolResults = [
27997
+ event?.message,
27998
+ ...Array.isArray(event?.messages) ? event.messages : [],
27999
+ ...Array.isArray(event?.toolResults) ? event.toolResults : []
28000
+ ];
28001
+ const unavailableEvidence = (rawResult, fallbackToolName = null) => {
28002
+ const result2 = asRecord(rawResult);
28003
+ const details = asRecord(result2.details);
28004
+ const reason = readString(details.error);
28005
+ if (readString(details.server) !== "amaster" || !reason || !PI_GOVERNED_MCP_UNAVAILABLE_REASONS.has(reason)) return null;
28006
+ const toolName = readString(result2.toolName) ?? readString(details.toolName) ?? fallbackToolName;
28007
+ return {
28008
+ reason,
28009
+ ...toolName && /^[A-Za-z][A-Za-z0-9_-]{0,127}$/.test(toolName) ? { toolName } : {}
28010
+ };
28011
+ };
28012
+ for (const rawResult of messageToolResults) {
28013
+ const result2 = asRecord(rawResult);
28014
+ if (readString(result2.role) !== "toolResult") continue;
28015
+ const evidence = unavailableEvidence(result2);
28016
+ if (evidence) return evidence;
28017
+ }
28018
+ if (readString(event?.type) === "tool_execution_end") {
28019
+ return unavailableEvidence(event?.result, readString(event?.toolName));
28020
+ }
28021
+ return null;
28022
+ }
27850
28023
  function piRuntimeWebEvidence(event) {
27851
28024
  if (readString(event?.type) === "amaster_web_evidence" && readString(event?.version) === "runtime_web_evidence_v1") {
27852
28025
  try {
@@ -27911,6 +28084,7 @@ function parsePiJsonl(stdout) {
27911
28084
  const mcpToolResults = [];
27912
28085
  const cleanupDiagnostics = [];
27913
28086
  const diagnostics = [];
28087
+ let governedMcpUnavailable = null;
27914
28088
  const errorEvents = [];
27915
28089
  let retry = null;
27916
28090
  let turnStartIndex = -1;
@@ -27921,6 +28095,7 @@ function parsePiJsonl(stdout) {
27921
28095
  if (!event) continue;
27922
28096
  eventIndex += 1;
27923
28097
  mcpToolResults.push(...piMcpToolResults(event));
28098
+ governedMcpUnavailable = piGovernedMcpUnavailableEvidence(event) ?? governedMcpUnavailable;
27924
28099
  if (event.type === "turn_start") turnStartIndex = eventIndex;
27925
28100
  if (event.type === "auto_retry_start") {
27926
28101
  const message = readString(event.errorMessage);
@@ -28058,6 +28233,7 @@ function parsePiJsonl(stdout) {
28058
28233
  ...nonCleanupErrorCount > 0 ? { nonCleanupErrorCount } : {},
28059
28234
  ...cleanupDiagnostics.length > 0 ? { cleanupDiagnostics } : {},
28060
28235
  ...diagnostics.length > 0 ? { diagnostics } : {},
28236
+ ...governedMcpUnavailable ? { governedMcpUnavailable } : {},
28061
28237
  ...uniqueMcpToolResults.length > 0 ? { mcpToolResults: uniqueMcpToolResults } : {}
28062
28238
  };
28063
28239
  }
@@ -33542,7 +33718,7 @@ function assertRequiredTaskAttachmentMaterialized(input, materialized) {
33542
33718
  }
33543
33719
 
33544
33720
  // src/amaster-runtime-daemon.mjs
33545
- var CONNECTOR_VERSION = "0.1.1-beta.256";
33721
+ var CONNECTOR_VERSION = "0.1.1-beta.257";
33546
33722
  var CONNECTOR_CONTRACT_VERSION = "2026-06-04.v1";
33547
33723
  var daemonRequire = createRequire2(import.meta.url);
33548
33724
  var MAX_CHECKPOINT_BYTES = 20 * 1024 * 1024;
@@ -35209,6 +35385,9 @@ function attachPiFinalContextAttestor(profile, input) {
35209
35385
  effectiveToolSchemaBytes: governedToolContract.effectiveToolSchemaBytes,
35210
35386
  effectiveToolSetSha256: governedToolContract.effectiveToolSetSha256,
35211
35387
  effectiveToolCount: governedToolContract.effectiveToolCount,
35388
+ catalogSetSha256: readString(profileAttestation.catalogSetHash),
35389
+ configSha256: readString(asRecord(profile.runExitClosureBaseline).configSha256) ?? readString(profileAttestation.configSha256),
35390
+ cacheSha256: readString(asRecord(profile.runExitClosureBaseline).cacheSha256),
35212
35391
  toolSetMode: "required_subset",
35213
35392
  requiredToolEntries: governedToolContract.entries.map(({ name, schemaHash }) => ({ name, schemaHash })),
35214
35393
  skillMetadataBytes: Number(profile.attestation?.enabledSkillMetadataBytes ?? 0),
@@ -38141,6 +38320,9 @@ async function executeRunCommand(config, command) {
38141
38320
  if (executor.kind === "pi" && Array.isArray(managedMcpProfile.extensionArgs) && managedMcpProfile.extensionArgs.length > 0) {
38142
38321
  invocation.args = [...invocation.args, ...managedMcpProfile.extensionArgs];
38143
38322
  }
38323
+ if (executor.kind === "pi") {
38324
+ assertManagedPiNonInteractiveInvocation(invocation.args, managedMcpProfile);
38325
+ }
38144
38326
  await ingestLog(config, command, "system", "info", desktopDelegatedRunnerEnabled(config) && executor.kind === "pi" ? "Prepared desktop delegated Pi runtime action bridge" : `Attested isolated ${executor.kind} managed MCP profile`, {
38145
38327
  presentationKind: "managed_mcp_attestation",
38146
38328
  ...managedMcpProfile.attestation
@@ -38702,7 +38884,12 @@ async function executeRunCommand(config, command) {
38702
38884
  completionOutputType: execution.completionOutputType,
38703
38885
  completionOutputHasFinalAssistantText: terminalTextRepair?.succeeded === true ? true : execution.completionOutputHasFinalAssistantText
38704
38886
  }) : null;
38705
- const piOutputFailure = executor.kind === "pi" && !cancelled && !hasOutputFlood && !hasArgumentAmplification && !hasMemoryLimit && execution.timedOut !== true && !execution.spawnError ? classifyPiOutputFailure(parsedForValidation, { invalidOutputError: piInvalidOutputError }) : null;
38887
+ const piOutputFailure = executor.kind === "pi" && !cancelled && !hasOutputFlood && !hasArgumentAmplification && !hasMemoryLimit && execution.timedOut !== true && !execution.spawnError ? classifyPiOutputFailure(parsedForValidation, {
38888
+ exitCode: execution.exitCode,
38889
+ stderr: execution.stderr,
38890
+ finalContextAttestationError: finalModelContextAttestationError,
38891
+ invalidOutputError: piInvalidOutputError
38892
+ }) : null;
38706
38893
  const piProviderFailure = piOutputFailure?.errorCode !== "pi_executor_invalid_output" ? piOutputFailure : null;
38707
38894
  const parsedErrorMessage = outputFloodError ?? argumentAmplificationError ?? memoryLimitError ?? finalModelContextAttestationError ?? piTurnLimitFailure?.message ?? piInvalidOutputError ?? nativeSessionRolloutError ?? nativeSessionRolloutCleanupError ?? parsedForValidation.errorMessage;
38708
38895
  const codexTransientFailure = executor.kind === "codex" && (execution.exitCode ?? 0) !== 0 ? classifyCodexTransientUpstreamError({
@@ -7,7 +7,7 @@ import { homedir, hostname } from "node:os";
7
7
  import { fileURLToPath } from "node:url";
8
8
  import { BUILD_SUPPORTED_CAPABILITIES } from "./amaster-runtime-daemon/capability-registry.mjs";
9
9
 
10
- const CONNECTOR_VERSION = "0.1.1-beta.256";
10
+ const CONNECTOR_VERSION = "0.1.1-beta.257";
11
11
 
12
12
  const CONFIG_KEY_MAP = new Map([
13
13
  ["server_url", "AMASTER_EMPLOYEE_SERVER_URL"],
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@amaster.ai/employee-runtime-connector",
3
- "version": "0.1.1-beta.256",
3
+ "version": "0.1.1-beta.257",
4
4
  "description": "MirrorX runtime connector CLI and daemon",
5
5
  "license": "MIT",
6
6
  "type": "module",