@amaster.ai/employee-runtime-connector 0.1.1-beta.271 → 0.1.1-beta.273

package/README.md

@@ -89,12 +89,14 @@ Pi 0.80.10's internal compaction summarizer calls the provider outside `before_p
 
 ## WorkBuddy Host (CodeBuddy engine)
 
-The optional `codebuddy` executor exposes the same common governed task contract as
-Codex, while remaining deliberately narrower than the WorkBuddy desktop product.
+The optional `codebuddy` executor participates in the same governed task lifecycle
+as Codex, while its local execution surface remains deliberately narrower than both
+Codex and the WorkBuddy desktop product.
 It does not expose WorkBuddy experts, projects, Office integrations, marketplace
 connectors, or Pi's `final_model_context_attestation_v1`. The connector creates a
 private per-run CodeBuddy home, supplies one strict MirrorX MCP definition, uses an
-exact native-tool allowlist, and preserves only an authority-bound native session
+exact tool allowlist, exposes the governed namespace directly with
+`NoDefer(mcp__amaster__*)`, and preserves only an authority-bound native session
 rollout. It never inherits the user's ordinary `.codebuddy` settings, memory,
 projects, MCP servers, workflows, or marketplace state. When no dedicated provider
 credential is configured, it reuses only the current OS user's WorkBuddy desktop
@@ -106,10 +108,27 @@ than authentication inputs and are not copied; any logout-marker directory entry
 including a dangling symlink, makes the desktop session unavailable. CodeBuddy can
 mutate only the private snapshot.
 
+Managed CodeBuddy runs expose the native file tools plus `mcp__amaster__*`; they do
+not expose Bash, WebFetch, or WebSearch. CodeBuddy 2.137.1's Bash sandbox cannot
+prevent a command from connecting to an existing loopback service, so allowing Bash
+would leave a path around Governed MCP even with unsandboxed execution disabled.
+Consequently these runs can inspect and edit a workspace and perform governed
+MirrorX actions, but they cannot run tests, builds, package managers, or arbitrary
+shell commands. This is an explicit capability gap rather than claimed Pi/Codex
+parity. Governed result authority remains correlated until a structured receipt is
+actually parsed; an outer transport `status` cannot shadow a nested
+`structuredContent` receipt, and more than 256 unresolved governed calls fails the
+run instead of evicting an unmatched call id. The managed profile also resolves the
+workspace once and uses that same canonical directory for CodeBuddy trust and child
+process execution; an unavailable cwd fails with a stable managed-profile error.
+
 This executor is off by default. Enable discovery with
 `AMASTER_ENABLE_CODEBUDDY_EXECUTOR=true`. `AMASTER_CODEBUDDY_COMMAND` can select an
 explicit CLI; on macOS the gated discovery path can also find the CLI bundled in
-`/Applications/WorkBuddy.app`. The Server task-session snapshot owns the model for
+`/Applications/WorkBuddy.app`. CodeBuddy `2.137.1` is the minimum supported version
+because that is the oldest release on which the native `NoDefer(mcp__amaster__*)`
+tool surface has been verified end to end; older versions fail readiness. The
+Server task-session snapshot owns the model for
 current commands; `AMASTER_CODEBUDDY_MODEL` is only a compatibility fallback for
 older commands without that snapshot. Authentication resolves in two fail-closed
 modes: exactly one explicitly configured `CODEBUDDY_API_KEY` or

package/dist/amaster-runtime-daemon.mjs

@@ -5033,6 +5033,7 @@ var companyColdStartObligationReadSchema = external_exports.object({
     kind: external_exports.enum(["agent", "board", "external"]),
     id: external_exports.string().trim().min(1).max(200)
   }).strict().nullable(),
+  ownerDisplayName: external_exports.string().trim().min(1).max(200).nullable(),
   reviewAt: external_exports.string().datetime({ offset: true }).nullable(),
   noProgressReviewCount: external_exports.number().int().nonnegative(),
   dueState: external_exports.enum(["scheduled", "due", "overdue", "attention", "stalled"])
@@ -5076,13 +5077,25 @@ var companyColdStartReadModelBaseSchema = external_exports.object({
     workset: companyColdStartWorksetReadModelSchema.nullable(),
     tasks: external_exports.array(companyColdStartTaskReadSchema),
     factCoverage: companyColdStartFactCoverageReadSchema,
+    factOwnerDisplayNames: external_exports.record(
+      companyColdStartFactSlotSchema,
+      external_exports.string().trim().min(1).max(200)
+    ),
     missingFactSlots: external_exports.array(companyColdStartFactSlotSchema),
     taskLocalAttentionIds: external_exports.array(external_exports.string().uuid()),
     wikiProjectionAttentionCount: external_exports.number().int().nonnegative()
   }).strict(),
   operations: external_exports.object({
     currentObligationCount: external_exports.number().int().nonnegative(),
+    currentObligationCountByGoal: external_exports.record(
+      external_exports.string().uuid(),
+      external_exports.number().int().nonnegative()
+    ).optional(),
     actionRequiredCount: external_exports.number().int().nonnegative(),
+    actionRequiredCountByGoal: external_exports.record(
+      external_exports.string().uuid(),
+      external_exports.number().int().nonnegative()
+    ).optional(),
     goalGapRefs: external_exports.array(external_exports.string().trim().min(1).max(200)),
     obligations: external_exports.array(companyColdStartObligationReadSchema)
   }).strict()
@@ -8973,6 +8986,7 @@ var recordGoalGapReadinessSchema = external_exports.object({
 }).strict();
 var boardScheduleGoalGapFollowUpSchema = external_exports.object({
   expectedRevision: external_exports.number().int().positive(),
+  ownerAgentId: external_exports.string().uuid(),
   reviewAt: external_exports.string().datetime({ offset: true })
 }).strict();
 var goalGapReadinessStateSchema = external_exports.object({
@@ -17744,6 +17758,7 @@ function managedPiProviderToolContract(tools) {
   }
   const entries = definitions.map(({ name, schemaHash }) => ({ name, schemaHash }));
   return {
+    definitions,
     entries,
     effectiveToolSchemaBytes: definitions.reduce((total, entry) => total + entry.schemaBytes, 0),
     effectiveToolSetSha256: sha256(stableJson(entries)),
@@ -18339,8 +18354,8 @@ function observedPiFinalContextToolContract(input) {
   const expectedNames = Array.isArray(input?.toolNames) ? [...input.toolNames] : [];
   if (expectedNames.length === 0 || expectedNames.some((name) => typeof name !== "string" || !name) || new Set(expectedNames).size !== expectedNames.length) fail2("observed_tool_contract_invalid");
   expectedNames.sort();
-  const finalEffectiveTools = input?.profileAttestation?.finalEffectiveTools;
-  const observed = Array.isArray(finalEffectiveTools) ? finalEffectiveTools.filter((entry) => expectedNames.includes(entry?.name)).map((entry) => ({
+  const finalRequiredTools = input?.profileAttestation?.finalRequiredTools;
+  const observed = Array.isArray(finalRequiredTools) ? finalRequiredTools.filter((entry) => expectedNames.includes(entry?.name)).map((entry) => ({
     name: entry.name,
     schemaHash: entry.schemaHash,
     schemaBytes: entry.schemaBytes
@@ -19361,7 +19376,7 @@ var KNOWN_EXECUTORS = [
   ["openclaw", "openclaw"]
 ];
 var MACOS_WORKBUDDY_CODEBUDDY_COMMAND = "/Applications/WorkBuddy.app/Contents/Resources/app.asar.unpacked/cli/bin/codebuddy";
-var MINIMUM_CODEBUDDY_VERSION = "2.115.0";
+var MINIMUM_CODEBUDDY_VERSION = "2.137.1";
 var MINIMUM_CODEBUDDY_VERSION_TUPLE = MINIMUM_CODEBUDDY_VERSION.split(".").map(Number);
 var REQUIRED_CODEBUDDY_FLAGS = [
   "--output-format",
@@ -20338,21 +20353,22 @@ var CODEBUDDY_DESKTOP_AUTH_SOURCE = "workbuddy_desktop_session";
 var CODEBUDDY_WORKBUDDY_AUTH_FILE = "workbuddy-desktop.info";
 var MAX_CODEBUDDY_DESKTOP_AUTH_BYTES = 4 * 1024 * 1024;
 var CODEBUDDY_NATIVE_TOOLS = [
-  "Bash",
   "Edit",
   "Read",
   "Write",
   "Glob",
   "Grep",
-  "LS",
-  "WebFetch",
-  "WebSearch"
+  "LS"
 ];
-var CODEBUDDY_ALLOWED_TOOLS = [
+var CODEBUDDY_MCP_TOOL_GLOB = `mcp__${SUPPORTED_SERVER_NAME2}__*`;
+var CODEBUDDY_TOOL_SURFACE = [
   ...CODEBUDDY_NATIVE_TOOLS,
-  "DeferExecuteTool",
-  `mcp__${SUPPORTED_SERVER_NAME2}__*`
+  `NoDefer(${CODEBUDDY_MCP_TOOL_GLOB})`
+];
+var CODEBUDDY_ALLOWED_TOOLS = [
+  CODEBUDDY_MCP_TOOL_GLOB
 ];
+var CODEBUDDY_DENIED_TOOLS = ["WebFetch", "WebSearch"];
 var REQUIRED_AUTHORITY_HEADERS2 = [
   "x-amaster-company-id",
   "x-amaster-agent-id",
@@ -20811,10 +20827,27 @@ function validateAuthority2(input) {
 function attestCli(executorCommand, env, cwd) {
   return attestCodebuddyCommand(executorCommand, env, cwd).executorVersion;
 }
+function canonicalCodebuddyCwd(value) {
+  const requestedCwd = resolve6(nonEmpty2(value, "cwd"));
+  try {
+    const canonicalCwd = realpathSync3(requestedCwd);
+    if (!statSync5(canonicalCwd).isDirectory()) {
+      throw new Error("cwd is not a directory");
+    }
+    return canonicalCwd;
+  } catch (cause) {
+    throw new Error(
+      "codebuddy_managed_mcp_cwd_invalid: cwd must resolve to an existing directory",
+      { cause }
+    );
+  }
+}
 function prepareManagedCodebuddyMcpProfile(input) {
   const authority = validateAuthority2(input);
   const runDir = resolve6(nonEmpty2(input.runDir, "runDir"));
   const executorHome = resolve6(nonEmpty2(input.executorHome, "executorHome"));
+  const cwd = canonicalCodebuddyCwd(input.cwd);
+  const bashSandboxEnabled = ["darwin", "linux"].includes(platform2());
   if (!within3(executorHome, join6(runDir, "executors"))) {
     throw new Error("codebuddy_managed_mcp_owner_mismatch: executorHome is outside the managed run");
   }
@@ -20856,9 +20889,25 @@ function prepareManagedCodebuddyMcpProfile(input) {
     }, null, 2)}
 `);
     privateFile(settingsPath, `${JSON.stringify({
+      trustedDirectories: [cwd],
+      sandbox: {
+        enabled: bashSandboxEnabled,
+        autoAllowBashIfSandboxed: false,
+        network: {
+          allowedDomains: [],
+          deniedDomains: [],
+          allowLocalBinding: false,
+          allowUnixSockets: [],
+          allowAllUnixSockets: false
+        },
+        excludedCommands: [],
+        allowUnsandboxedCommands: false
+      },
       permissions: {
         allow: CODEBUDDY_ALLOWED_TOOLS,
-        deny: []
+        deny: CODEBUDDY_DENIED_TOOLS,
+        defaultMode: "acceptEdits",
+        disableBypassPermissionsMode: "disable"
       }
     }, null, 2)}
 `);
@@ -20883,7 +20932,7 @@ function prepareManagedCodebuddyMcpProfile(input) {
       restoredNativeSession,
       nativeSessionRestoreSkippedReason
     } = resolveManagedCodebuddySessionRollout(input, configDir, runDir, executorHome, profileAuthority);
-    const executorVersion = attestCli(nonEmpty2(input.executorCommand, "executorCommand"), env, nonEmpty2(input.cwd, "cwd"));
+    const executorVersion = attestCli(nonEmpty2(input.executorCommand, "executorCommand"), env, cwd);
     const cliArgs = [
       "--setting-sources",
       "",
@@ -20893,17 +20942,20 @@ function prepareManagedCodebuddyMcpProfile(input) {
       "--mcp-config",
       mcpConfigPath,
       "--tools",
-      CODEBUDDY_NATIVE_TOOLS.join(","),
+      CODEBUDDY_TOOL_SURFACE.join(","),
       "--allowedTools",
       CODEBUDDY_ALLOWED_TOOLS.join(","),
       "--permission-mode",
-      "dontAsk"
+      "acceptEdits"
     ];
     const attestationFacts = {
       connectorVersion: nonEmpty2(input.connectorVersion, "connectorVersion"),
       executorKind: "codebuddy",
       executorVersion,
       configMode: "isolated_config_strict_http_headers",
+      mcpExposureMode: "native_nodefer",
+      bashIsolation: "not_exposed",
+      networkAccessMode: "governed_mcp_only",
       namespace: SUPPORTED_SERVER_NAME2,
       schemaVersion: SUPPORTED_SCHEMA_VERSION2,
       platform: platform2(),
@@ -20914,6 +20966,7 @@ function prepareManagedCodebuddyMcpProfile(input) {
     };
     return {
       profileRoot,
+      cwd,
       markerPath,
       mcpConfigPath,
       settingsPath,
@@ -21815,7 +21868,7 @@ function piMcpAdapterServerConfigIdentity(definition, adapterVersion) {
 import { createHash as createHash6 } from "node:crypto";
 var MANAGED_PI_EFFECTIVE_TOOLS_ATTESTOR_FILENAME = "amaster-effective-tools-attestor.js";
 var MANAGED_PI_EFFECTIVE_TOOLS_SCHEMA_VERSION = "amaster.pi-effective-tools.v1";
-function normalizedSchema(value, adapterNormalized) {
+function normalizedPiToolSchema(value, adapterNormalized) {
   const schema = value && typeof value === "object" && !Array.isArray(value) ? value : {};
   if (!adapterNormalized) return schema;
   const { $schema: _schema, additionalProperties: _additionalProperties, ...normalized } = schema;
@@ -21831,7 +21884,7 @@ function stablePiJson(value) {
   return `{${keys.map((key) => `${JSON.stringify(key)}:${stablePiJson(value[key])}`).join(",")}}`;
 }
 function stablePiToolSchemaHash(schema, options = {}) {
-  return createHash6("sha256").update(stablePiJson(normalizedSchema(schema, options.adapterNormalized === true))).digest("hex");
+  return createHash6("sha256").update(stablePiJson(normalizedPiToolSchema(schema, options.adapterNormalized === true))).digest("hex");
 }
 function stablePiEffectiveToolSetHash(entries) {
   const normalized = entries.map((entry) => ({ name: entry.name, schemaHash: entry.schemaHash ?? entry.effectiveSchemaHash })).sort((left, right) => left.name.localeCompare(right.name));
@@ -22697,17 +22750,9 @@ function createManagedPiMcpProfileApi(options = {}) {
   const SESSION_ROLLOUT_MARKER3 = ".amaster-pi-session-rollout.json";
   const DEFAULT_SESSION_ROLLOUT_TTL_MS3 = 24 * 60 * 60 * 1e3;
   const PI_VERSION_ATTESTATION_TIMEOUT_MS = 3e4;
-  const PI_EFFECTIVE_TOOLS_ATTESTATION_TIMEOUT_MS = 6e4;
-  const PI_EFFECTIVE_TOOLS_RETRY_TIMEOUT_MS = 3e4;
-  const PI_EFFECTIVE_TOOLS_TOTAL_TIMEOUT_MS = PI_EFFECTIVE_TOOLS_ATTESTATION_TIMEOUT_MS + PI_EFFECTIVE_TOOLS_RETRY_TIMEOUT_MS;
-  const PI_EFFECTIVE_TOOLS_SOFT_SLOW_MS = 3e4;
-  const PI_EFFECTIVE_TOOLS_BOOTSTRAP_SCHEMA_VERSION = 1;
-  const PI_EFFECTIVE_TOOLS_CIRCUIT_FAILURE_THRESHOLD = Number.isInteger(options.probeCircuitFailureThreshold) && options.probeCircuitFailureThreshold > 0 ? options.probeCircuitFailureThreshold : 3;
-  const PI_EFFECTIVE_TOOLS_CIRCUIT_COOLDOWN_MS = Number.isFinite(options.probeCircuitCooldownMs) && options.probeCircuitCooldownMs > 0 ? Math.floor(options.probeCircuitCooldownMs) : 6e4;
   const PI_ATTESTATION_MAX_ATTEMPTS = 2;
   const PI_ATTESTATION_RECENT_LIVE_TTL_MS = Number.isFinite(options.recentLiveTtlMs) && options.recentLiveTtlMs > 0 ? options.recentLiveTtlMs : 30 * 60 * 1e3;
   const recentLivePiVersionProbes = /* @__PURE__ */ new Map();
-  const effectiveToolsProbeCircuits = /* @__PURE__ */ new Map();
   function record8(value) {
     return value && typeof value === "object" && !Array.isArray(value) ? value : {};
   }
@@ -22879,165 +22924,7 @@ function createManagedPiMcpProfileApi(options = {}) {
     }
     return hash.digest("hex");
   }
-  function copyTrustedTree(sourcePath, targetPath) {
-    const source = resolve8(sourcePath);
-    const sourceStat = lstatSync8(source);
-    if (!sourceStat.isDirectory() || sourceStat.isSymbolicLink()) {
-      throw new Error(`pi_managed_mcp_bootstrap_cache_unsafe: ${source}`);
-    }
-    mkdirSync4(targetPath, { recursive: true, mode: 448 });
-    chmodSync6(targetPath, 448);
-    for (const entry of readdirSync4(source, { withFileTypes: true })) {
-      const from = join9(source, entry.name);
-      const to = join9(targetPath, entry.name);
-      if (entry.isSymbolicLink()) throw new Error(`pi_managed_mcp_bootstrap_cache_unsafe: ${from}`);
-      if (entry.isDirectory()) {
-        copyTrustedTree(from, to);
-        continue;
-      }
-      if (!entry.isFile()) throw new Error(`pi_managed_mcp_bootstrap_cache_unsafe: ${from}`);
-      copyFileSync(from, to, 0);
-      chmodSync6(to, 384 | lstatSync8(from).mode & 73);
-    }
-  }
-  function makeTrustedTreeReadOnly(rootPath) {
-    const root = resolve8(rootPath);
-    const pending = [root];
-    const directories = [];
-    while (pending.length > 0) {
-      const current = pending.pop();
-      const currentStat = lstatSync8(current);
-      if (currentStat.isSymbolicLink()) throw new Error(`pi_managed_mcp_bootstrap_cache_unsafe: ${current}`);
-      if (currentStat.isDirectory()) {
-        directories.push(current);
-        for (const entry of readdirSync4(current)) pending.push(join9(current, entry));
-        continue;
-      }
-      if (!currentStat.isFile()) throw new Error(`pi_managed_mcp_bootstrap_cache_unsafe: ${current}`);
-      chmodSync6(current, 256 | currentStat.mode & 73);
-    }
-    for (const directory of directories.reverse()) chmodSync6(directory, 320);
-  }
-  function makeTrustedTreeWritable(rootPath) {
-    const pending = [resolve8(rootPath)];
-    while (pending.length > 0) {
-      const current = pending.pop();
-      const currentStat = lstatSync8(current);
-      if (currentStat.isSymbolicLink()) throw new Error(`pi_managed_mcp_bootstrap_cache_unsafe: ${current}`);
-      if (currentStat.isDirectory()) {
-        chmodSync6(current, 448);
-        for (const entry of readdirSync4(current)) pending.push(join9(current, entry));
-        continue;
-      }
-      if (!currentStat.isFile()) throw new Error(`pi_managed_mcp_bootstrap_cache_unsafe: ${current}`);
-      chmodSync6(current, 384 | currentStat.mode & 73);
-    }
-  }
-  function piLoaderIdentity(executorPath) {
-    let cursor = dirname6(realpathSync6(executorPath));
-    for (let depth = 0; depth < 4; depth += 1) {
-      const packagePath = join9(cursor, "package.json");
-      const loaderPath = join9(cursor, "dist", "core", "extensions", "loader.js");
-      if (existsSync8(packagePath) && existsSync8(loaderPath)) {
-        const packageJson = JSON.parse(readFileSync9(packagePath, "utf8"));
-        return sha2565(stablePiJson({
-          name: packageJson.name,
-          version: packageJson.version,
-          loaderSha256: sha2565(readFileSync9(loaderPath))
-        }));
-      }
-      cursor = dirname6(cursor);
-    }
-    return sha2565(readFileSync9(realpathSync6(executorPath)));
-  }
-  function effectiveToolsBootstrapKey(input, sharedRuntime, executorCommand) {
-    const adapterRoot = sharedRuntime.adapterRoot ? resolve8(nonEmpty3(sharedRuntime.adapterRoot, "sharedRuntime.adapterRoot")) : join9(sharedRuntime.home, "npm", "node_modules", "pi-mcp-adapter");
-    const resolvedExecutorCommand = resolvePiExecutablePath(executorCommand, input.baseEnv);
-    return sha2565(stablePiJson({
-      schemaVersion: PI_EFFECTIVE_TOOLS_BOOTSTRAP_SCHEMA_VERSION,
-      connectorVersion: nonEmpty3(input.connectorVersion, "connectorVersion"),
-      executorIdentity: piExecutableIdentity(resolvedExecutorCommand),
-      loaderIdentity: piLoaderIdentity(resolvedExecutorCommand),
-      nodeVersion: process.version,
-      nodeModulesAbi: process.versions.modules,
-      platform: platform3(),
-      arch: arch3(),
-      // npm may install dependency symlinks under the adapter's nested
-      // node_modules. They resolve at runtime and are not Jiti-owned compiled
-      // source; hash every package-owned adapter file while excluding that
-      // dependency graph so ordinary npm links do not make the cache unusable.
-      adapterTreeSha256: trustedTreeDigest(adapterRoot, { ignoredRootEntries: ["node_modules"] }),
-      attestorSourceSha256: sha2565(managedPiEffectiveToolsAttestorExtensionSource())
-    }));
-  }
-  function prepareEffectiveToolsBootstrapCache(input, sharedRuntime, executorCommand, tmpPath) {
-    const cacheRoot = resolve8(nonEmpty3(input.runtimeCacheRoot ?? join9(dirname6(input.runDir), ".runtime-cache"), "runtimeCacheRoot"));
-    const bootstrapRoot = join9(cacheRoot, "pi-effective-tools-jiti-v1");
-    mkdirSync4(bootstrapRoot, { recursive: true, mode: 448 });
-    const bootstrapRootStat = lstatSync8(bootstrapRoot);
-    if (!bootstrapRootStat.isDirectory() || bootstrapRootStat.isSymbolicLink()) {
-      throw new Error("pi_managed_mcp_bootstrap_cache_unsafe: root");
-    }
-    const key = effectiveToolsBootstrapKey(input, sharedRuntime, executorCommand);
-    const entryPath = join9(bootstrapRoot, key);
-    const markerPath = join9(entryPath, "manifest.json");
-    const sourceCachePath = join9(entryPath, "jiti");
-    const runCachePath = join9(tmpPath, "jiti");
-    let status = "miss";
-    if (existsSync8(entryPath)) {
-      try {
-        const entryStat = lstatSync8(entryPath);
-        const markerStat = lstatSync8(markerPath);
-        const marker = JSON.parse(readFileSync9(markerPath, "utf8"));
-        if (!entryStat.isDirectory() || entryStat.isSymbolicLink() || !markerStat.isFile() || markerStat.isSymbolicLink() || marker.schemaVersion !== PI_EFFECTIVE_TOOLS_BOOTSTRAP_SCHEMA_VERSION || marker.key !== key || marker.treeSha256 !== trustedTreeDigest(sourceCachePath)) throw new Error("bootstrap marker mismatch");
-        copyTrustedTree(sourceCachePath, runCachePath);
-        status = "hit";
-      } catch {
-        const resolvedEntry = resolve8(entryPath);
-        if (!within4(resolvedEntry, bootstrapRoot) || resolvedEntry === bootstrapRoot) {
-          throw new Error("pi_managed_mcp_bootstrap_cache_unsafe: entry");
-        }
-        makeTrustedTreeWritable(resolvedEntry);
-        rmSync5(resolvedEntry, { recursive: true, force: true });
-        status = "invalidated";
-      }
-    }
-    return { bootstrapRoot, entryPath, key, runCachePath, status };
-  }
-  function publishEffectiveToolsBootstrapCache(cache) {
-    if (cache.status === "hit") return "hit";
-    if (!existsSync8(cache.runCachePath)) return `${cache.status}_unavailable`;
-    const runCacheStat = lstatSync8(cache.runCachePath);
-    if (!runCacheStat.isDirectory() || runCacheStat.isSymbolicLink()) {
-      throw new Error("pi_managed_mcp_bootstrap_cache_unsafe: run cache");
-    }
-    if (existsSync8(cache.entryPath)) return "hit_raced";
-    const stagingPath = `${cache.entryPath}.tmp-${process.pid}-${currentTimeMs()}`;
-    try {
-      mkdirSync4(stagingPath, { mode: 448 });
-      const stagingCachePath = join9(stagingPath, "jiti");
-      copyTrustedTree(cache.runCachePath, stagingCachePath);
-      writePrivateFile2(join9(stagingPath, "manifest.json"), `${JSON.stringify({
-        schemaVersion: PI_EFFECTIVE_TOOLS_BOOTSTRAP_SCHEMA_VERSION,
-        key: cache.key,
-        treeSha256: trustedTreeDigest(stagingCachePath)
-      })}
-`);
-      try {
-        renameSync4(stagingPath, cache.entryPath);
-        makeTrustedTreeReadOnly(cache.entryPath);
-      } catch (error) {
-        if (error?.code !== "EEXIST" && error?.code !== "ENOTEMPTY") throw error;
-      }
-    } finally {
-      if (existsSync8(stagingPath)) {
-        makeTrustedTreeWritable(stagingPath);
-        rmSync5(stagingPath, { recursive: true, force: true });
-      }
-    }
-    return existsSync8(cache.entryPath) ? `${cache.status}_published` : `${cache.status}_unavailable`;
-  }
-  function writeEffectiveToolsProbePhase(phasePath, phase, attempt) {
+  function writeEffectiveToolsPhase(phasePath, phase, attempt) {
     let history = [];
     if (existsSync8(phasePath)) {
       try {
@@ -23919,189 +23806,6 @@ ${result2.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
       liveProbeAgeMs
     };
   }
-  function inspectEffectiveToolsProbeReceipt(receiptPath, phasePath) {
-    let phase = "missing";
-    let history = [];
-    if (existsSync8(phasePath)) {
-      try {
-        const phaseState = JSON.parse(readFileSync9(phasePath, "utf8"));
-        phase = typeof phaseState.phase === "string" ? phaseState.phase : "present";
-        history = Array.isArray(phaseState.history) ? phaseState.history : [];
-      } catch {
-        phase = "invalid";
-      }
-    }
-    if (!existsSync8(receiptPath)) return { phase, history, receipt: null };
-    try {
-      const receipt = JSON.parse(readFileSync9(receiptPath, "utf8"));
-      const receiptPhase = receipt?.status === "attested" || receipt?.status === "rejected" ? receipt.status : phase === "missing" ? "present" : phase;
-      return { phase: receiptPhase, history, receipt };
-    } catch {
-      return { phase: "invalid", history, receipt: null };
-    }
-  }
-  function effectiveToolsProbePhaseDurations(history, attempt) {
-    const entries = history.filter((entry) => entry?.attempt === attempt && typeof entry.phase === "string" && Number.isFinite(entry.atMs)).sort((left, right) => left.atMs - right.atMs);
-    const at = (phase) => entries.find((entry) => entry.phase === phase)?.atMs;
-    const terminalAt = at("attested") ?? at("rejected");
-    const spawnedAt = at("spawned");
-    const loaderReadyAt = at("loader_ready");
-    const sessionStartAt = at("session_start");
-    return {
-      ...Number.isFinite(spawnedAt) && Number.isFinite(loaderReadyAt) ? { spawnedToLoaderReadyMs: Math.max(0, loaderReadyAt - spawnedAt) } : {},
-      ...Number.isFinite(loaderReadyAt) && Number.isFinite(sessionStartAt) ? { loaderReadyToSessionStartMs: Math.max(0, sessionStartAt - loaderReadyAt) } : {},
-      ...Number.isFinite(sessionStartAt) && Number.isFinite(terminalAt) ? { sessionStartToTerminalMs: Math.max(0, terminalAt - sessionStartAt) } : {}
-    };
-  }
-  function attestDirectPiTools(executorCommand, env, input, spawnIdentity = null, circuitKey = null) {
-    const circuit = circuitKey ? effectiveToolsProbeCircuits.get(circuitKey) : null;
-    if (circuit?.open === true) {
-      const retryAfterMs = Math.max(0, circuit.retryAtMs - currentTimeMs());
-      if (retryAfterMs > 0) {
-        const error = new Error(
-          `pi_managed_mcp_probe_circuit_open: connector generation probe circuit is open failures=${circuit.failures} lastPhase=${circuit.lastPhase} retryAfterMs=${retryAfterMs}`
-        );
-        error.code = "pi_managed_mcp_probe_circuit_open";
-        error.retryAfterMs = retryAfterMs;
-        throw error;
-      }
-      effectiveToolsProbeCircuits.set(circuitKey, { ...circuit, open: false, halfOpen: true });
-    }
-    const startedAtMs = currentTimeMs();
-    const attempts = [PI_EFFECTIVE_TOOLS_ATTESTATION_TIMEOUT_MS, PI_EFFECTIVE_TOOLS_RETRY_TIMEOUT_MS];
-    let result2;
-    let completedAttempts = 0;
-    for (let index = 0; index < attempts.length; index += 1) {
-      const attempt = index + 1;
-      const timeout = attempts[index];
-      completedAttempts = attempt;
-      writeEffectiveToolsProbePhase(input.phasePath, "spawned", attempt);
-      const resolvedExecutorCommand = resolveExecutorCommand(executorCommand, env) ?? executorCommand;
-      result2 = spawnSyncImpl(resolvedExecutorCommand, [
-        "--no-session",
-        "--no-approve",
-        "--no-skills",
-        "--no-context-files",
-        // The enforcement extensions live in the run profile, not an agent dir,
-        // so the probe must load them explicitly alongside the user's normal Pi
-        // extensions and tools to measure the real run surface.
-        ...Array.isArray(input.extensionArgs) ? input.extensionArgs : [],
-        "--print",
-        "probe effective tools"
-      ], {
-        cwd: env.AMASTER_RUNTIME_EXECUTION_WORKDIR,
-        env: {
-          ...env,
-          AMASTER_PI_EFFECTIVE_TOOLS_MODE: "probe",
-          AMASTER_PI_EFFECTIVE_TOOLS_ATTEMPT: String(attempt)
-        },
-        encoding: "utf8",
-        timeout,
-        killSignal: "SIGKILL",
-        maxBuffer: 1024 * 1024,
-        ...isWindowsCommandShim(resolvedExecutorCommand) ? { shell: true } : {},
-        ...spawnIdentity ?? {}
-      });
-      if (result2.error?.code === "ETIMEDOUT" && attempt < attempts.length) continue;
-      break;
-    }
-    const elapsedMs = Math.max(0, currentTimeMs() - startedAtMs);
-    if (result2.error) {
-      const code = typeof result2.error.code === "string" ? result2.error.code : "UNKNOWN";
-      const receiptDiagnostic = inspectEffectiveToolsProbeReceipt(input.receiptPath, input.phasePath);
-      if (code === "ETIMEDOUT" && circuitKey) {
-        if (receiptDiagnostic.phase === "missing" || receiptDiagnostic.phase === "spawned") {
-          const previous = effectiveToolsProbeCircuits.get(circuitKey);
-          const failures = (previous?.failures ?? 0) + 1;
-          const shouldOpen = previous?.halfOpen === true || failures >= PI_EFFECTIVE_TOOLS_CIRCUIT_FAILURE_THRESHOLD;
-          const observedAtMs = currentTimeMs();
-          effectiveToolsProbeCircuits.set(circuitKey, {
-            failures,
-            lastPhase: receiptDiagnostic.phase,
-            open: shouldOpen,
-            halfOpen: false,
-            retryAtMs: shouldOpen ? observedAtMs + PI_EFFECTIVE_TOOLS_CIRCUIT_COOLDOWN_MS : null
-          });
-        } else {
-          effectiveToolsProbeCircuits.delete(circuitKey);
-        }
-      } else if (circuitKey) {
-        effectiveToolsProbeCircuits.delete(circuitKey);
-      }
-      const error = new Error(
-        `pi_managed_mcp_effective_tools_failed: probe error=${code} elapsedMs=${elapsedMs} timeoutMs=${PI_EFFECTIVE_TOOLS_ATTESTATION_TIMEOUT_MS} retryTimeoutMs=${PI_EFFECTIVE_TOOLS_RETRY_TIMEOUT_MS} totalBudgetMs=${PI_EFFECTIVE_TOOLS_TOTAL_TIMEOUT_MS} attempts=${completedAttempts} receiptPhase=${receiptDiagnostic.phase}`
-      );
-      if (code === "ETIMEDOUT") error.code = "pi_managed_mcp_probe_timeout";
-      throw error;
-    }
-    if (result2.status !== 0) {
-      if (circuitKey) effectiveToolsProbeCircuits.delete(circuitKey);
-      const receiptDiagnostic = inspectEffectiveToolsProbeReceipt(input.receiptPath, input.phasePath);
-      let receiptError = "receipt unavailable";
-      if (typeof receiptDiagnostic.receipt?.error === "string" && receiptDiagnostic.receipt.error.length > 0) {
-        receiptError = receiptDiagnostic.receipt.error.slice(0, 512);
-      }
-      throw new Error(
-        `pi_managed_mcp_effective_tools_failed: probe exit=${result2.status ?? "unknown"} elapsedMs=${elapsedMs} timeoutMs=${PI_EFFECTIVE_TOOLS_ATTESTATION_TIMEOUT_MS} retryTimeoutMs=${PI_EFFECTIVE_TOOLS_RETRY_TIMEOUT_MS} totalBudgetMs=${PI_EFFECTIVE_TOOLS_TOTAL_TIMEOUT_MS} attempts=${completedAttempts} receiptPhase=${receiptDiagnostic.phase} reason=${receiptError}`
-      );
-    }
-    if (circuitKey) effectiveToolsProbeCircuits.delete(circuitKey);
-    let receipt;
-    try {
-      receipt = JSON.parse(readFileSync9(input.receiptPath, "utf8"));
-    } catch {
-      throw new Error("pi_managed_mcp_effective_tools_failed: probe receipt missing");
-    }
-    const proxyPresenceMismatch = input.proxyMode === "required" ? receipt.proxyPresent !== true : input.proxyMode === "forbidden" && receipt.proxyPresent !== false;
-    if (receipt.status !== "attested" || receipt.mode !== "probe" || receipt.proxyMode !== input.proxyMode || proxyPresenceMismatch || receipt.effectiveSetHash !== input.effectiveSetHash || receipt.attestorSourceSha256 !== input.attestorSourceSha256 || receipt.configSha256 !== input.configSha256) {
-      throw new Error("pi_managed_mcp_effective_tools_failed: probe receipt mismatch");
-    }
-    const finalEffectiveTools = Array.isArray(receipt.finalEffectiveTools) ? receipt.finalEffectiveTools : [];
-    const finalEffectiveToolNames = finalEffectiveTools.map((tool) => tool?.name).filter((name) => typeof name === "string").sort();
-    const expectedFinalActiveToolNames = Array.isArray(input.finalActiveToolNames) ? input.finalActiveToolNames.slice().sort() : [];
-    const finalEffectiveSchemaBytes = finalEffectiveTools.reduce((total, tool) => total + (Number.isSafeInteger(tool?.schemaBytes) && tool.schemaBytes >= 0 ? tool.schemaBytes : Number.NaN), 0);
-    const finalEffectiveToolNameSet = new Set(finalEffectiveToolNames);
-    if (finalEffectiveTools.length === 0 || !/^[a-f0-9]{64}$/.test(receipt.finalEffectiveSetHash ?? "") || stablePiEffectiveToolSetHash(finalEffectiveTools) !== receipt.finalEffectiveSetHash || expectedFinalActiveToolNames.some((name) => !finalEffectiveToolNameSet.has(name)) || !Number.isSafeInteger(receipt.finalEffectiveSchemaBytes) || receipt.finalEffectiveSchemaBytes !== finalEffectiveSchemaBytes) {
-      throw new Error("pi_managed_mcp_effective_tools_failed: final tool schema receipt mismatch");
-    }
-    if (sha2565(readFileSync9(input.configPath)) !== input.configSha256) {
-      throw new Error("pi_managed_mcp_effective_tools_failed: config drifted during probe");
-    }
-    const finalCacheBytes = readFileSync9(input.cachePath);
-    if (receipt.cacheSha256 !== sha2565(finalCacheBytes) || stablePiManagedMcpCacheSemanticHash(finalCacheBytes, { ignoredServers: input.userMcpServerNames }) !== input.cacheSemanticHash) {
-      throw new Error("pi_managed_mcp_effective_tools_failed: cache drifted during probe");
-    }
-    if (circuitKey) effectiveToolsProbeCircuits.delete(circuitKey);
-    const phaseDiagnostic = inspectEffectiveToolsProbeReceipt(input.receiptPath, input.phasePath);
-    return {
-      effectiveToolProxyMode: receipt.proxyMode,
-      effectiveToolProxyPresent: receipt.proxyPresent,
-      effectiveToolSetHash: receipt.effectiveSetHash,
-      finalEffectiveToolSetHash: receipt.finalEffectiveSetHash,
-      finalEffectiveToolSchemaBytes: receipt.finalEffectiveSchemaBytes,
-      finalEffectiveToolCount: finalEffectiveTools.length,
-      finalEffectiveTools: finalEffectiveTools.map((tool) => ({
-        name: tool.name,
-        schemaHash: tool.schemaHash,
-        schemaBytes: tool.schemaBytes
-      })),
-      effectiveToolProbeDigest: sha2565(stablePiJson(receipt)),
-      effectiveToolProbeAt: receipt.attestedAt,
-      effectiveToolProbeElapsedMs: elapsedMs,
-      effectiveToolProbeTimeoutMs: PI_EFFECTIVE_TOOLS_ATTESTATION_TIMEOUT_MS,
-      effectiveToolProbeTotalBudgetMs: PI_EFFECTIVE_TOOLS_TOTAL_TIMEOUT_MS,
-      effectiveToolProbeCircuitCooldownMs: PI_EFFECTIVE_TOOLS_CIRCUIT_COOLDOWN_MS,
-      effectiveToolProbeAttempts: completedAttempts,
-      effectiveToolProbeSoftSlow: elapsedMs >= PI_EFFECTIVE_TOOLS_SOFT_SLOW_MS,
-      effectiveToolProbePhase: phaseDiagnostic.phase,
-      effectiveToolProbePhaseHistory: phaseDiagnostic.history,
-      effectiveToolProbePhaseDurationsMs: effectiveToolsProbePhaseDurations(
-        phaseDiagnostic.history,
-        completedAttempts
-      ),
-      effectiveToolBindings: receipt.effectiveToolBindings
-    };
-  }
   function prepareDirectPiToolAttestation(input) {
     const cachePath = join9(input.profileRoot, "mcp-cache.json");
     if (!input.directCatalog) {
@@ -24164,6 +23868,26 @@ ${result2.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
     };
     writePrivateFile2(manifestPath, `${JSON.stringify(manifest, null, 2)}
 `);
+    const providerToolContract = managedPiProviderToolContract(input.directCatalog.tools.map((tool) => ({
+      name: tool.exposedName,
+      description: tool.description,
+      parameters: normalizedPiToolSchema(tool.inputSchema, true)
+    })));
+    const declaredToolContract = {
+      effectiveToolContractSource: "governed_catalog",
+      effectiveToolValidationMode: "same_run_session_start_and_provider_request",
+      effectiveToolProxyMode: manifest.proxyMode,
+      effectiveToolSetHash: manifest.effectiveSetHash,
+      finalRequiredToolSetHash: providerToolContract.effectiveToolSetSha256,
+      finalRequiredToolSchemaBytes: providerToolContract.effectiveToolSchemaBytes,
+      finalRequiredToolCount: providerToolContract.effectiveToolCount,
+      finalRequiredTools: providerToolContract.definitions,
+      effectiveToolBindings: input.directCatalog.tools.map((tool) => ({
+        canonicalName: tool.name,
+        exposedName: tool.exposedName,
+        effectiveSchemaHash: tool.effectiveSchemaHash
+      })).sort((left, right) => left.canonicalName.localeCompare(right.canonicalName))
+    };
     const closureTools = input.directCatalog.tools.filter((tool) => RUN_EXIT_CLOSURE_DIRECT_TYPED_TOOL_NAMES.has(tool.name));
     const closureProfile = closureTools.length === RUN_EXIT_CLOSURE_DIRECT_TYPED_TOOL_NAMES.size ? (() => {
       const closureToolNames = closureTools.map((tool) => tool.exposedName);
@@ -24220,7 +23944,7 @@ ${result2.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         finalContextToolContract: managedPiProviderToolContract(closureTools.map((tool) => ({
           name: tool.exposedName,
           description: tool.description,
-          parameters: tool.inputSchema
+          parameters: normalizedPiToolSchema(tool.inputSchema, true)
         }))),
         cacheContentsBase64: closureCacheBytes.toString("base64"),
         cacheSha256: sha2565(closureCacheBytes),
@@ -24250,6 +23974,7 @@ ${result2.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         finalActiveToolNames: effectiveRunToolAllowlist,
         userMcpServerNames: input.userMcpServerNames,
         profileToolAllowlist: null,
+        declaredToolContract,
         closureProfile
       }
     };
@@ -24335,6 +24060,10 @@ ${result2.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         if (!existsSync8(adapterExtensionPath)) {
           throw new Error("pi_managed_mcp_adapter_extension_missing");
         }
+        const adapterRootStat = lstatSync8(dirname6(adapterExtensionPath));
+        if (!adapterRootStat.isDirectory() || adapterRootStat.isSymbolicLink()) {
+          throw new Error("pi_managed_mcp_adapter_extension_unsafe");
+        }
         const adapterExtensionStat = lstatSync8(adapterExtensionPath);
         if (!adapterExtensionStat.isFile() || adapterExtensionStat.isSymbolicLink()) {
           throw new Error("pi_managed_mcp_adapter_extension_unsafe");
@@ -24417,14 +24146,8 @@ ${result2.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         } : {}
       };
       if (directAttestationInput) {
-        writeEffectiveToolsProbePhase(directAttestationInput.phasePath, "prepared", 0);
+        writeEffectiveToolsPhase(directAttestationInput.phasePath, "prepared", 0);
       }
-      const effectiveToolsBootstrapCache = directAttestationInput ? prepareEffectiveToolsBootstrapCache(
-        input,
-        sharedRuntime,
-        nonEmpty3(input.executorCommand, "executorCommand"),
-        tmp
-      ) : null;
       const spawnIdentity = typeof input.prepareExecutorAccess === "function" ? input.prepareExecutorAccess({ profileRoot, workspaceRoot: cwd }) : null;
       const executorAttestation = attestPi(
         nonEmpty3(input.executorCommand, "executorCommand"),
@@ -24433,14 +24156,6 @@ ${result2.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         config,
         spawnIdentity
       );
-      const effectiveToolsAttestation = directAttestationInput ? attestDirectPiTools(
-        nonEmpty3(input.executorCommand, "executorCommand"),
-        env,
-        directAttestationInput,
-        spawnIdentity,
-        effectiveToolsBootstrapCache?.key ?? null
-      ) : {};
-      const effectiveToolProbeBootstrapCache = effectiveToolsBootstrapCache ? publishEffectiveToolsBootstrapCache(effectiveToolsBootstrapCache) : null;
       const runExitClosureOwnership = directAttestationInput ? {
         cache: ownershipStatSyncImpl(directAttestationInput.cachePath),
         manifest: ownershipStatSyncImpl(directAttestationInput.manifestPath),
@@ -24455,9 +24170,7 @@ ${result2.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         mcpArgsNormalization: "none",
         ...directCatalog ? {
           catalogSetHash: directCatalog.setHash,
-          ...effectiveToolsAttestation,
-          effectiveToolProbeBootstrapKey: effectiveToolsBootstrapCache?.key ?? null,
-          effectiveToolProbeBootstrapCache
+          ...directAttestationInput.declaredToolContract
         } : {},
         configMode: MANAGED_PI_CONFIG_MODE_SHARED,
         namespace: SUPPORTED_SERVER_NAME3,
@@ -24839,18 +24552,8 @@ ${result2.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         } : {}
       };
       if (directAttestationInput) {
-        writeEffectiveToolsProbePhase(directAttestationInput.phasePath, "prepared", 0);
+        writeEffectiveToolsPhase(directAttestationInput.phasePath, "prepared", 0);
       }
-      const sharedRuntime = {
-        home: sourcePiHome,
-        ...desktopAttestationReadiness?.ready ? { adapterRoot: desktopAttestationReadiness.adapterRoot } : {}
-      };
-      const effectiveToolsBootstrapCache = directAttestationInput ? prepareEffectiveToolsBootstrapCache(
-        input,
-        sharedRuntime,
-        nonEmpty3(input.executorCommand, "executorCommand"),
-        tmp
-      ) : null;
       const spawnIdentity = typeof input.prepareExecutorAccess === "function" ? input.prepareExecutorAccess({ profileRoot, workspaceRoot: cwd }) : null;
       const executorAttestation = directAttestationInput ? attestPi(
         nonEmpty3(input.executorCommand, "executorCommand"),
@@ -24859,14 +24562,6 @@ ${result2.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         config,
         spawnIdentity
       ) : {};
-      const effectiveToolsAttestation = directAttestationInput ? attestDirectPiTools(
-        nonEmpty3(input.executorCommand, "executorCommand"),
-        env,
-        directAttestationInput,
-        spawnIdentity,
-        effectiveToolsBootstrapCache?.key ?? null
-      ) : {};
-      const effectiveToolProbeBootstrapCache = effectiveToolsBootstrapCache ? publishEffectiveToolsBootstrapCache(effectiveToolsBootstrapCache) : null;
       const runExitClosureOwnership = directAttestationInput ? {
         cache: ownershipStatSyncImpl(directAttestationInput.cachePath),
         manifest: ownershipStatSyncImpl(directAttestationInput.manifestPath),
@@ -24881,9 +24576,7 @@ ${result2.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         mcpArgsNormalization: "none",
         ...directCatalog ? {
           catalogSetHash: directCatalog.setHash,
-          ...effectiveToolsAttestation,
-          effectiveToolProbeBootstrapKey: effectiveToolsBootstrapCache?.key ?? null,
-          effectiveToolProbeBootstrapCache
+          ...directAttestationInput.declaredToolContract
         } : {},
         configMode: "desktop_delegated_runtime_action_bridge",
         namespace: SUPPORTED_SERVER_NAME3,
@@ -27392,43 +27085,105 @@ function classifyCodexTransientUpstreamError(input, now = /* @__PURE__ */ new Da
 }
 
 // src/amaster-runtime-daemon/executor-protocol/codebuddy.mjs
-function structuredToolResult(value) {
-  const record8 = asRecord(value);
-  const direct = asRecord(record8.structuredContent);
-  if (Object.keys(direct).length > 0) return direct;
-  const text2 = readString(record8.text) ?? (typeof value === "string" ? value : null);
-  if (text2) {
+var AMASTER_MCP_TOOL_PREFIX = "mcp__amaster__";
+var MAX_STRUCTURED_RESULT_DEPTH = 8;
+var MAX_TRACKED_TOOL_USES = 256;
+function structuredToolResults(value, depth = 0) {
+  if (depth > MAX_STRUCTURED_RESULT_DEPTH || value === null || value === void 0) return [];
+  if (Array.isArray(value)) {
+    return value.flatMap((part) => structuredToolResults(part, depth + 1));
+  }
+  if (typeof value === "string") {
     try {
-      return asRecord(JSON.parse(text2));
+      return structuredToolResults(JSON.parse(value), depth + 1);
     } catch {
-      return {};
+      return [];
     }
   }
-  for (const part of Array.isArray(record8.content) ? record8.content : []) {
-    const parsed = structuredToolResult(part);
-    if (Object.keys(parsed).length > 0) return parsed;
-  }
-  return {};
-}
-function codebuddyMcpToolResults(event) {
-  const record8 = asRecord(event);
+  const record8 = asRecord(value);
+  const structuredContent = structuredToolResults(record8.structuredContent, depth + 1);
+  if (structuredContent.length > 0) return structuredContent;
+  if (readString(record8.status)) return [record8];
   const candidates = [];
-  if (record8.type === "function_call_result" && ["DeferExecuteTool", "mcp__amaster"].some((prefix) => (readString(record8.name) ?? "").startsWith(prefix))) {
-    candidates.push(record8.output ?? record8.result);
+  for (const nested of [
+    record8.content,
+    record8.text,
+    record8.result,
+    record8.output
+  ]) {
+    candidates.push(...structuredToolResults(nested, depth + 1));
   }
-  if (record8.type === "user") {
-    const message = asRecord(record8.message);
-    for (const rawBlock of Array.isArray(message.content) ? message.content : []) {
-      const block = asRecord(rawBlock);
-      if (block.type === "tool_result" || block.type === "toolResult") {
-        candidates.push(block.content ?? block.result);
+  return candidates;
+}
+function governedResults(candidates) {
+  return candidates.flatMap((candidate) => structuredToolResults(candidate).flatMap((structured) => {
+    const parsed = governedMcpToolResult(structured);
+    return parsed ? [parsed] : [];
+  }));
+}
+function createCodebuddyMcpToolResultTracker() {
+  const toolNamesById = /* @__PURE__ */ new Map();
+  let trackingFailure = null;
+  const rememberToolUse = (id, name) => {
+    if (trackingFailure) return;
+    const toolUseId = readString(id);
+    if (!toolUseId) return;
+    const toolName = readString(name);
+    if (!toolName?.startsWith(AMASTER_MCP_TOOL_PREFIX)) {
+      toolNamesById.delete(toolUseId);
+      return;
+    }
+    if (!toolNamesById.has(toolUseId) && toolNamesById.size >= MAX_TRACKED_TOOL_USES) {
+      trackingFailure = `codebuddy_mcp_tool_tracking_overflow: more than ${MAX_TRACKED_TOOL_USES} unresolved governed tool calls`;
+      return;
+    }
+    toolNamesById.set(toolUseId, toolName);
+  };
+  return {
+    failure() {
+      return trackingFailure;
+    },
+    record(event) {
+      if (trackingFailure) return [];
+      const record8 = asRecord(event);
+      const eventType = readString(record8.type);
+      if (eventType === "assistant") {
+        const message2 = asRecord(record8.message);
+        for (const rawBlock of Array.isArray(message2.content) ? message2.content : []) {
+          const block = asRecord(rawBlock);
+          if (["tool_use", "toolUse"].includes(readString(block.type) ?? "")) {
+            rememberToolUse(block.id ?? block.tool_use_id ?? block.toolUseId, block.name ?? block.tool_name);
+          }
+        }
+        return [];
+      }
+      if (eventType === "function_call") {
+        rememberToolUse(record8.call_id ?? record8.tool_use_id ?? record8.id, record8.name);
+        return [];
+      }
+      if (eventType === "function_call_result") {
+        const callId = readString(record8.call_id ?? record8.tool_use_id ?? record8.id);
+        if (!callId || !toolNamesById.has(callId)) return [];
+        const results2 = governedResults([record8.output ?? record8.result]);
+        if (results2.length > 0) toolNamesById.delete(callId);
+        return results2;
+      }
+      if (eventType !== "user") return [];
+      const message = asRecord(record8.message);
+      const results = [];
+      for (const rawBlock of Array.isArray(message.content) ? message.content : []) {
+        const block = asRecord(rawBlock);
+        if (!["tool_result", "toolResult"].includes(readString(block.type) ?? "")) continue;
+        const toolUseId = readString(block.tool_use_id ?? block.toolUseId ?? block.id);
+        if (!toolUseId || !toolNamesById.has(toolUseId)) continue;
+        const blockResults = governedResults([block.content ?? block.result]);
+        if (blockResults.length === 0) continue;
+        toolNamesById.delete(toolUseId);
+        results.push(...blockResults);
       }
+      return results;
     }
-  }
-  return candidates.flatMap((candidate) => {
-    const parsed = governedMcpToolResult(structuredToolResult(candidate));
-    return parsed ? [parsed] : [];
-  });
+  };
 }
 function parseCodebuddyStreamJson(stdout) {
   let sessionId = null;
@@ -27437,12 +27192,13 @@ function parseCodebuddyStreamJson(stdout) {
   let sawSuccessfulResult = false;
   const assistantTexts = [];
   const mcpToolResults = [];
+  const mcpToolResultTracker = createCodebuddyMcpToolResultTracker();
   const usage = { inputTokens: 0, cachedInputTokens: 0, outputTokens: 0 };
   for (const rawLine of String(stdout ?? "").split(/\r?\n/)) {
     const event = parseJsonLine(rawLine.trim());
     if (!event) continue;
     sessionId = readString(event.session_id) ?? readString(event.sessionId) ?? sessionId;
-    mcpToolResults.push(...codebuddyMcpToolResults(event));
+    mcpToolResults.push(...mcpToolResultTracker.record(event));
     if (event.type === "assistant") {
       const message = asRecord(event.message);
       for (const rawBlock of Array.isArray(message.content) ? message.content : []) {
@@ -27480,6 +27236,11 @@ function parseCodebuddyStreamJson(stdout) {
       errorMessage = readString(event.message) ?? errorMessage;
     }
   }
+  const trackingFailure = mcpToolResultTracker.failure();
+  if (trackingFailure) {
+    sawSuccessfulResult = false;
+    errorMessage = trackingFailure;
+  }
   const uniqueMcpToolResults = dedupeGovernedMcpToolResults(mcpToolResults);
   return {
     sessionId,
@@ -33583,11 +33344,11 @@ function resolvePiModelContextBudget({
 }) {
   const instructionBytes = [...finalAgentInstructionFiles.values()].reduce((total, entry) => total + Number(entry.byteSize ?? 0), 0);
   const profileAttestation = record7(managedMcpProfile?.attestation);
-  const toolSchemaBytes = Number(profileAttestation.finalEffectiveToolSchemaBytes);
+  const toolSchemaBytes = Number(profileAttestation.finalRequiredToolSchemaBytes);
   if (!Number.isSafeInteger(toolSchemaBytes) || toolSchemaBytes < 1) {
     throw stableContextError(
       "model_context_attestation_unavailable",
-      "final tool schema size is missing"
+      "required governed tool schema size is missing"
     );
   }
   const skillMetadataBytes = Number(profileAttestation.enabledSkillMetadataBytes ?? 0);
@@ -33616,7 +33377,7 @@ function resolvePiModelContextBudget({
     knownFixedInputTokens,
     fixedInputBreakdown: {
       projectInstructionBytes: instructionBytes,
-      effectiveToolSchemaBytes: toolSchemaBytes,
+      requiredGovernedToolSchemaBytes: toolSchemaBytes,
       skillMetadataBytes
     },
     dynamicInputTokens,
@@ -33931,7 +33692,7 @@ function assertRequiredTaskAttachmentMaterialized(input, materialized) {
 }
 
 // src/amaster-runtime-daemon.mjs
-var CONNECTOR_VERSION = "0.1.1-beta.271";
+var CONNECTOR_VERSION = "0.1.1-beta.273";
 var CONNECTOR_CONTRACT_VERSION = "2026-06-04.v1";
 var daemonRequire = createRequire(import.meta.url);
 var MAX_CHECKPOINT_BYTES = 20 * 1024 * 1024;
@@ -35584,11 +35345,12 @@ function requireEffectiveToolSchemaAttestation(contextContract, executorKind, go
   const attestation = asRecord(managedMcpProfile?.attestation);
   const catalogSetHash = readString(attestation.catalogSetHash);
   const effectiveToolSetHash = readString(attestation.effectiveToolSetHash);
-  const finalEffectiveToolSetHash = readString(attestation.finalEffectiveToolSetHash);
-  if (!/^[a-f0-9]{64}$/.test(declaredSetHash ?? "") || catalogSetHash !== declaredSetHash || !/^[a-f0-9]{64}$/.test(effectiveToolSetHash ?? "") || !/^[a-f0-9]{64}$/.test(finalEffectiveToolSetHash ?? "") || !Number.isSafeInteger(attestation.finalEffectiveToolSchemaBytes) || attestation.finalEffectiveToolSchemaBytes < 1 || !/^[a-f0-9]{64}$/.test(readString(attestation.effectiveToolProbeDigest) ?? "")) {
+  const finalRequiredToolSetHash = readString(attestation.finalRequiredToolSetHash);
+  const catalogToolCount = Array.isArray(catalog.tools) ? catalog.tools.length : 0;
+  if (!/^[a-f0-9]{64}$/.test(declaredSetHash ?? "") || catalogSetHash !== declaredSetHash || readString(attestation.effectiveToolContractSource) !== "governed_catalog" || readString(attestation.effectiveToolValidationMode) !== "same_run_session_start_and_provider_request" || !/^[a-f0-9]{64}$/.test(effectiveToolSetHash ?? "") || !/^[a-f0-9]{64}$/.test(finalRequiredToolSetHash ?? "") || !Number.isSafeInteger(attestation.finalRequiredToolSchemaBytes) || attestation.finalRequiredToolSchemaBytes < 1 || !Number.isSafeInteger(attestation.finalRequiredToolCount) || attestation.finalRequiredToolCount !== catalogToolCount) {
     throw stableContextError(
       "context_effective_tool_schema_attestation_mismatch",
-      "final effective Pi tool schema proof is missing or does not match the governed catalog"
+      "the governed Pi tool schema contract is missing or does not match the catalog"
     );
   }
   return {
@@ -35596,10 +35358,10 @@ function requireEffectiveToolSchemaAttestation(contextContract, executorKind, go
     executorKind,
     declaredCatalogSetHash: declaredSetHash,
     effectiveToolSetHash,
-    finalEffectiveToolSetHash,
-    finalEffectiveToolSchemaBytes: attestation.finalEffectiveToolSchemaBytes,
-    finalEffectiveToolCount: attestation.finalEffectiveToolCount,
-    effectiveToolProbeDigest: attestation.effectiveToolProbeDigest,
+    finalRequiredToolSetHash,
+    finalRequiredToolSchemaBytes: attestation.finalRequiredToolSchemaBytes,
+    finalRequiredToolCount: attestation.finalRequiredToolCount,
+    validationMode: attestation.effectiveToolValidationMode,
     attestationId: readString(attestation.attestationId)
   };
 }
@@ -36138,6 +35900,7 @@ function createLiveOutputLogger(config, command, executorKind, protectedValues =
   let piTerminalOutput = null;
   let executorSessionId = null;
   const liveMcpToolResults = [];
+  const codebuddyMcpToolResultTracker = executorKind === "codebuddy" ? createCodebuddyMcpToolResultTracker() : null;
   const onWebEvidence = typeof options.onWebEvidence === "function" ? options.onWebEvidence : null;
   let queue = Promise.resolve();
   let observationQueue = Promise.resolve();
@@ -36330,7 +36093,7 @@ function createLiveOutputLogger(config, command, executorKind, protectedValues =
       }
     }
     if (MIRRORX_FORMAL_TASK_EXECUTOR_KINDS.includes(executorKind) && event) {
-      const results = executorKind === "codex" ? codexMcpToolResults(event) : executorKind === "codebuddy" ? codebuddyMcpToolResults(event) : piMcpToolResults(event, { runId: commandRunId(command), commandId: command.commandId, issueId: commandIssueId(command) });
+      const results = executorKind === "codex" ? codexMcpToolResults(event) : executorKind === "codebuddy" ? codebuddyMcpToolResultTracker.record(event) : piMcpToolResults(event, { runId: commandRunId(command), commandId: command.commandId, issueId: commandIssueId(command) });
       liveMcpToolResults.push(...results);
       if (results.length > 0) onMcpToolResults?.(results);
     }
@@ -36419,6 +36182,7 @@ function createLiveOutputLogger(config, command, executorKind, protectedValues =
         processLine(stream, buffers[stream]);
         buffers[stream] = "";
       }
+      const codebuddyTrackingFailure = codebuddyMcpToolResultTracker?.failure();
       await observationQueue;
       if (observationError) throw observationError;
       flushPendingBatch();
@@ -36441,6 +36205,7 @@ function createLiveOutputLogger(config, command, executorKind, protectedValues =
           }
         }], { terminalSummary: true });
       }
+      if (codebuddyTrackingFailure) throw new Error(codebuddyTrackingFailure);
     },
     hasStream(stream) {
       return displayCounts[stream] > 0;
@@ -38607,7 +38372,7 @@ async function executeRunCommand(config, command) {
       if (executor.kind === "pi") {
         assertManagedPiNonInteractiveInvocation(invocation.args, managedMcpProfile);
       }
-      await ingestLog(config, command, "system", "info", desktopDelegatedRunnerEnabled(config) && executor.kind === "pi" ? "Prepared desktop delegated Pi runtime action bridge" : `Attested isolated ${executor.kind} managed MCP profile`, {
+      await ingestLog(config, command, "system", "info", desktopDelegatedRunnerEnabled(config) && executor.kind === "pi" ? "Prepared desktop delegated Pi runtime action bridge" : executor.kind === "pi" ? "Prepared isolated Pi managed MCP profile" : `Attested isolated ${executor.kind} managed MCP profile`, {
         presentationKind: "managed_mcp_attestation",
         ...managedMcpProfile.attestation
       });
@@ -38840,7 +38605,7 @@ async function executeRunCommand(config, command) {
     } : null;
     try {
       execution = await runExecutor(invocation.command, invocation.args, {
-        cwd,
+        cwd: executor.kind === "codebuddy" ? managedMcpProfile?.cwd ?? cwd : cwd,
         env: executorEnv,
         stdin: invocation.stdin === "prompt" ? prompt : "",
         timeoutSeconds: config.executorTimeoutSeconds,
@@ -39170,16 +38935,15 @@ async function executeRunCommand(config, command) {
       );
     }
     const parsedForValidation = parsed;
-    const completionOutputHasFinalAssistantText = terminalTextRepair?.succeeded === true ? true : execution.completionOutputHasFinalAssistantText;
     const piTurnLimitFailure = executor.kind === "pi" && !cancelled && !hasOutputFlood && !hasArgumentAmplification && !hasMemoryLimit && execution.timedOut !== true && !execution.spawnError ? classifyPiTurnLimitResult(parsedForValidation, {
       authoritativeTerminalDisposition: Boolean(terminalRunDisposition)
     }) : null;
     const piInvalidOutputError = executor.kind === "pi" ? piOutputValidationError(parsedForValidation, {
-      allowMissingTurnEnd: completionOutputStopped || execution.completionOutputType === "agent_settled" && completionOutputHasFinalAssistantText === true,
+      allowMissingTurnEnd: completionOutputStopped,
       allowMissingAssistantOutput: execution.completionOutputType === "approval_required" || Boolean(terminalRunDisposition),
       allowMissingFinalAssistantText: Boolean(terminalRunDisposition),
       completionOutputType: execution.completionOutputType,
-      completionOutputHasFinalAssistantText
+      completionOutputHasFinalAssistantText: terminalTextRepair?.succeeded === true ? true : execution.completionOutputHasFinalAssistantText
     }) : null;
     const piOutputFailure = executor.kind === "pi" && !cancelled && !hasOutputFlood && !hasArgumentAmplification && !hasMemoryLimit && execution.timedOut !== true && !execution.spawnError ? classifyPiOutputFailure(parsedForValidation, {
       exitCode: execution.exitCode,

package/dist/amaster-runtime.mjs

@@ -7,7 +7,7 @@ import { homedir, hostname } from "node:os";
 import { fileURLToPath } from "node:url";
 import { BUILD_SUPPORTED_CAPABILITIES } from "./amaster-runtime-daemon/capability-registry.mjs";
 
-const CONNECTOR_VERSION = "0.1.1-beta.271";
+const CONNECTOR_VERSION = "0.1.1-beta.273";
 
 const CONFIG_KEY_MAP = new Map([
   ["server_url", "AMASTER_EMPLOYEE_SERVER_URL"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amaster.ai/employee-runtime-connector",
-  "version": "0.1.1-beta.271",
+  "version": "0.1.1-beta.273",
   "description": "MirrorX runtime connector CLI and daemon",
   "license": "MIT",
   "type": "module",