@amaster.ai/employee-runtime-connector 0.1.1-beta.3 → 0.1.1-beta.5

package/dist/amaster-runtime-daemon.mjs

@@ -2,7 +2,7 @@
 // MirrorX runtime connector daemon bundle.
 
 // src/amaster-runtime-daemon.mjs
-import { createHash as createHash11 } from "node:crypto";
+import { createHash as createHash12 } from "node:crypto";
 import { chmodSync as chmodSync6, copyFileSync as copyFileSync3, existsSync as existsSync14, lstatSync as lstatSync7, mkdirSync as mkdirSync9, mkdtempSync, readFileSync as readFileSync11, readdirSync as readdirSync9, realpathSync as realpathSync5, renameSync as renameSync6, rmSync as rmSync7, statSync as statSync7, symlinkSync as symlinkSync4, unlinkSync as unlinkSync2, writeFileSync as writeFileSync9 } from "node:fs";
 import { arch as arch3, homedir as homedir3, hostname as hostname2, platform as platform3, tmpdir } from "node:os";
 import { basename as basename6, delimiter as delimiter2, dirname as dirname9, extname as extname2, isAbsolute as isAbsolute8, join as join15, relative as relative9, resolve as resolve12 } from "node:path";
@@ -1560,7 +1560,7 @@ function reconcileManagedCodexMcpProfiles(rootPath, options = {}) {
 }
 
 // src/amaster-runtime-daemon/pi-managed-mcp-profile.mjs
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 import {
   chmodSync as chmodSync2,
   copyFileSync,
@@ -1965,15 +1965,247 @@ function managedPiMcpArgsNormalizerExtensionSource() {
   ].join("\n\n");
 }
 
+// src/amaster-runtime-daemon/pi-effective-tools-attestor.mjs
+import { createHash as createHash2 } from "node:crypto";
+var MANAGED_PI_EFFECTIVE_TOOLS_ATTESTOR_FILENAME = "amaster-effective-tools-attestor.js";
+var MANAGED_PI_EFFECTIVE_TOOLS_SCHEMA_VERSION = "amaster.pi-effective-tools.v1";
+function normalizedSchema(value, adapterNormalized) {
+  const schema = value && typeof value === "object" && !Array.isArray(value) ? value : {};
+  if (!adapterNormalized) return schema;
+  const { $schema: _schema, additionalProperties: _additionalProperties, ...normalized } = schema;
+  return normalized;
+}
+function stablePiJson(value) {
+  if (value === null || value === void 0 || typeof value !== "object") {
+    const serialized = JSON.stringify(value);
+    return serialized === void 0 ? "undefined" : serialized;
+  }
+  if (Array.isArray(value)) return `[${value.map(stablePiJson).join(",")}]`;
+  const keys = Object.keys(value).sort();
+  return `{${keys.map((key) => `${JSON.stringify(key)}:${stablePiJson(value[key])}`).join(",")}}`;
+}
+function stablePiToolSchemaHash(schema, options = {}) {
+  return createHash2("sha256").update(stablePiJson(normalizedSchema(schema, options.adapterNormalized === true))).digest("hex");
+}
+function stablePiEffectiveToolSetHash(entries) {
+  const normalized = entries.map((entry) => ({ name: entry.name, schemaHash: entry.schemaHash ?? entry.effectiveSchemaHash })).sort((left, right) => left.name.localeCompare(right.name));
+  return createHash2("sha256").update(stablePiJson(normalized)).digest("hex");
+}
+function stablePiDirectCatalogSetHash(entries) {
+  const normalized = entries.map((entry) => ({ name: entry.name, exposedName: entry.exposedName, schemaHash: entry.schemaHash, riskLevel: entry.riskLevel })).sort((left, right) => left.name.localeCompare(right.name));
+  return createHash2("sha256").update(stablePiJson(normalized)).digest("hex");
+}
+function managedPiEffectiveToolsAttestorExtensionSource() {
+  return String.raw`import { createHash } from "node:crypto";
+import { readFileSync, writeFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { Value } from "typebox/value";
+
+const SCHEMA_VERSION = ${JSON.stringify(MANAGED_PI_EFFECTIVE_TOOLS_SCHEMA_VERSION)};
+
+function record(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+
+function stableJson(value) {
+  if (value === null || value === undefined || typeof value !== "object") {
+    const serialized = JSON.stringify(value);
+    return serialized === undefined ? "undefined" : serialized;
+  }
+  if (Array.isArray(value)) return "[" + value.map(stableJson).join(",") + "]";
+  const keys = Object.keys(value).sort();
+  return "{" + keys.map((key) => JSON.stringify(key) + ":" + stableJson(value[key])).join(",") + "}";
+}
+
+function sha256(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+
+function schemaHash(value) {
+  return sha256(stableJson(record(value)));
+}
+
+function toolSetHash(entries) {
+  return sha256(stableJson(entries
+    .map((entry) => ({ name: entry.name, schemaHash: entry.schemaHash }))
+    .sort((left, right) => left.name.localeCompare(right.name))));
+}
+
+function requiredPath(name) {
+  const value = process.env[name];
+  if (typeof value !== "string" || value.trim() === "") throw new Error(name + " is required");
+  return value;
+}
+
+function sourceIsMcpAdapter(sourceInfo) {
+  return stableJson(sourceInfo).includes("pi-mcp-adapter");
+}
+
+function safeWriteReceipt(receiptPath, receipt) {
+  writeFileSync(receiptPath, JSON.stringify(receipt) + "\n", { encoding: "utf8", mode: 0o600 });
+}
+
+function validationErrorPath(error) {
+  if (typeof error.path === "string" && error.path) return error.path;
+  const base = typeof error.instancePath === "string" ? error.instancePath : "";
+  const params = record(error.params);
+  const additional = Array.isArray(params.additionalProperties) ? params.additionalProperties[0] : null;
+  if (typeof additional === "string" && additional) return base + "/" + additional;
+  const required = Array.isArray(params.requiredProperties) ? params.requiredProperties[0] : null;
+  if (typeof required === "string" && required) return base + "/" + required;
+  return base || "/";
+}
+
+function inputErrorReason(schema, input) {
+  const errors = [...Value.Errors(schema, input)];
+  if (errors.length === 0) return null;
+  return errors.slice(0, 8).map((error) => validationErrorPath(error) + ": " + error.message).join("; ");
+}
+
+export default function amasterEffectiveToolsAttestor(pi) {
+  const mode = process.env.AMASTER_PI_EFFECTIVE_TOOLS_MODE;
+  if (mode !== "probe" && mode !== "enforce") return;
+  const manifestPath = requiredPath("AMASTER_PI_EFFECTIVE_TOOLS_MANIFEST");
+  const receiptPath = requiredPath("AMASTER_PI_EFFECTIVE_TOOLS_RECEIPT");
+  const cachePath = requiredPath("AMASTER_PI_EFFECTIVE_TOOLS_CACHE");
+  const configPath = requiredPath("AMASTER_PI_EFFECTIVE_TOOLS_CONFIG");
+
+  pi.on("session_start", async () => {
+    let receipt;
+    try {
+      const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+      if (manifest.schemaVersion !== SCHEMA_VERSION || manifest.serverName !== "amaster") {
+        throw new Error("effective tool manifest identity mismatch");
+      }
+      const sourceDigest = sha256(readFileSync(fileURLToPath(import.meta.url)));
+      if (sourceDigest !== manifest.attestorSourceSha256) throw new Error("attestor source digest mismatch");
+      const configDigest = sha256(readFileSync(configPath));
+      if (configDigest !== manifest.configSha256) throw new Error("managed MCP config digest mismatch");
+      const cacheDigest = sha256(readFileSync(cachePath));
+      if (cacheDigest !== manifest.cacheSha256) throw new Error("managed MCP cache digest mismatch");
+
+      const expectedEntries = Array.isArray(manifest.entries) ? manifest.entries : [];
+      if (expectedEntries.length === 0) throw new Error("effective tool manifest is empty");
+      const expectedByName = new Map(expectedEntries.map((entry) => [entry.name, entry]));
+      if (expectedByName.size !== expectedEntries.length) throw new Error("effective tool manifest has duplicate names");
+      for (const entry of expectedEntries) {
+        const validatorSelfTest = inputErrorReason(entry.schema, { __amasterUnexpected: true });
+        if (!validatorSelfTest || !validatorSelfTest.includes("/__amasterUnexpected")) {
+          throw new Error("strict input validator self-test failed for " + entry.name);
+        }
+      }
+
+      const allTools = pi.getAllTools();
+      if (allTools.some((tool) => typeof tool.name !== "string" || !tool.name)) {
+        throw new Error("registered tool identity mismatch");
+      }
+      const activeToolNames = pi.getActiveTools();
+      if (activeToolNames.some((name) => typeof name !== "string" || !name)) {
+        throw new Error("active tool identity mismatch");
+      }
+      activeToolNames.sort();
+      const activeToolNameSet = new Set(activeToolNames);
+      const proxyPresent = allTools.some((tool) => tool.name === "mcp");
+      const nonCatalogTools = activeToolNames.filter((name) => !expectedByName.has(name));
+      const adapterTools = allTools.filter((tool) => sourceIsMcpAdapter(tool.sourceInfo));
+      const directTools = adapterTools.filter((tool) => tool.name !== "mcp" && activeToolNameSet.has(tool.name)).map((tool) => ({
+        name: tool.name,
+        schemaHash: schemaHash(tool.parameters),
+      }));
+      const actualByName = new Map(directTools.map((entry) => [entry.name, entry]));
+      const missing = [...expectedByName.keys()].filter((name) => !actualByName.has(name) || !activeToolNameSet.has(name)).sort();
+      const unexpected = adapterTools
+        .map((tool) => tool.name)
+        .filter((name) => name !== "mcp" && !expectedByName.has(name))
+        .sort();
+      const schemaMismatches = [...expectedByName.entries()].flatMap(([name, expected]) => {
+        const actual = actualByName.get(name);
+        return actual && actual.schemaHash !== expected.effectiveSchemaHash
+          ? [{ name, expected: expected.effectiveSchemaHash, actual: actual.schemaHash }]
+          : [];
+      });
+      const effectiveSetHash = toolSetHash(directTools);
+      if (proxyPresent || nonCatalogTools.length > 0 || missing.length > 0 || unexpected.length > 0 || schemaMismatches.length > 0) {
+        throw new Error("effective tool surface mismatch: proxy=" + proxyPresent + " nonCatalog=" + nonCatalogTools.join(",") + " missing=" + missing.join(",") + " unexpected=" + unexpected.join(",") + " schemas=" + schemaMismatches.map((entry) => entry.name).join(","));
+      }
+      if (effectiveSetHash !== manifest.effectiveSetHash) throw new Error("effective tool set hash mismatch");
+      receipt = {
+        schemaVersion: SCHEMA_VERSION,
+        status: "attested",
+        mode,
+        proxyPresent,
+        effectiveSetHash,
+        effectiveTools: directTools.sort((left, right) => left.name.localeCompare(right.name)),
+        effectiveToolBindings: expectedEntries
+          .map((entry) => ({ canonicalName: entry.canonicalName, exposedName: entry.name, effectiveSchemaHash: entry.effectiveSchemaHash }))
+          .sort((left, right) => left.canonicalName.localeCompare(right.canonicalName)),
+        attestorSourceSha256: sourceDigest,
+        configSha256: configDigest,
+        cacheSha256: cacheDigest,
+        strictInputValidatorSelfTest: true,
+        modelInvocationStarted: false,
+        attestedAt: new Date().toISOString(),
+      };
+      safeWriteReceipt(receiptPath, receipt);
+      if (mode === "probe") process.exit(0);
+    } catch (error) {
+      receipt = {
+        schemaVersion: SCHEMA_VERSION,
+        status: "rejected",
+        mode,
+        error: error instanceof Error ? error.message : String(error),
+        modelInvocationStarted: false,
+        attestedAt: new Date().toISOString(),
+      };
+      safeWriteReceipt(receiptPath, receipt);
+      process.exit(78);
+    }
+  });
+
+  pi.on("tool_call", (event) => {
+    const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+    const entry = Array.isArray(manifest.entries)
+      ? manifest.entries.find((candidate) => candidate.name === event.toolName)
+      : null;
+    if (!entry) return;
+    const reason = inputErrorReason(entry.schema, event.input);
+    if (!reason) return;
+    return { block: true, reason: "Governed tool input rejected: " + reason };
+  });
+}
+`;
+}
+
 // src/amaster-runtime-daemon/pi-managed-mcp-profile.mjs
 var MANAGED_PI_MCP_TOOL_MODE = "proxy_only";
+var MANAGED_PI_DIRECT_TYPED_MCP_TOOL_MODE = "direct_typed";
 var MANAGED_PI_MCP_ARGS_NORMALIZATION = "json_string_control_characters_v1";
 var MANAGED_PI_MCP_ARGS_NORMALIZER_FILENAME = "amaster-mcp-args-normalizer.js";
+function applyManagedPiToolAllowlist(args, profile) {
+  const toolAllowlist = Array.isArray(profile?.toolAllowlist) ? profile.toolAllowlist.filter((name) => typeof name === "string" && name) : [];
+  if (toolAllowlist.length === 0) return [...args];
+  const printArgIndex = Math.max(args.lastIndexOf("-p"), args.lastIndexOf("--print"));
+  if (printArgIndex < 0) throw new Error("pi_managed_mcp_invocation_invalid: print mode argument missing");
+  return [
+    ...args.slice(0, printArgIndex),
+    "--tools",
+    toolAllowlist.join(","),
+    ...args.slice(printArgIndex)
+  ];
+}
 function createManagedPiMcpProfileApi(options = {}) {
   const spawnSyncImpl = typeof options.spawnSync === "function" ? options.spawnSync : spawnSync2;
   const nowImpl = typeof options.now === "function" ? options.now : Date.now;
   const SUPPORTED_SCHEMA_VERSION2 = "amaster.governed-mcp.v1";
   const SUPPORTED_SERVER_NAME2 = "amaster";
+  const DIRECT_CATALOG_SCHEMA_VERSION = "amaster.governed-mcp-direct-catalog.v1";
+  const DIRECT_TYPED_V1_TOOL_NAMES = /* @__PURE__ */ new Set([
+    "runtime_action.submit",
+    "amaster.read_company_diagnosis",
+    "amaster.publish_company_diagnosis_brief"
+  ]);
+  const PROVIDER_SAFE_TOOL_NAME = /^[A-Za-z][A-Za-z0-9_-]*$/;
+  const PI_BUILTIN_TOOL_NAMES = /* @__PURE__ */ new Set(["read", "bash", "edit", "write", "grep", "find", "ls", "mcp"]);
   const MINIMUM_PI_VERSION = [0, 73, 1];
   const MINIMUM_MCP_ADAPTER_VERSION = [2, 6, 1];
   const MANAGED_BROWSER_USE_PACKAGE = "@amaster.ai/pi-browser-use";
@@ -2057,6 +2289,12 @@ function createManagedPiMcpProfileApi(options = {}) {
   ]);
   const FORBIDDEN_ARGV = /* @__PURE__ */ new Set([
     "--no-tools",
+    "--no-builtin-tools",
+    "-nbt",
+    "--tools",
+    "-t",
+    "--exclude-tools",
+    "-xt",
     "--no-extensions",
     "--no-skills",
     "--no-session",
@@ -2140,7 +2378,7 @@ function createManagedPiMcpProfileApi(options = {}) {
     nonEmpty2(session.invocationId, "nativeSession.invocationId");
     const sourceWorkspacePath = nonEmpty2(session.cwd, "nativeSession.cwd");
     const issueRoot = dirname3(runDir);
-    const managedSourceRunDirName = `${sourceRunId}-${createHash2("sha256").update(sourceRunId).digest("hex").slice(0, 8)}`;
+    const managedSourceRunDirName = `${sourceRunId}-${createHash3("sha256").update(sourceRunId).digest("hex").slice(0, 8)}`;
     const sourceRunDirs = readdirSync2(issueRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.isSymbolicLink() && (entry.name === sourceRunId || entry.name === managedSourceRunDirName)).map((entry) => join4(issueRoot, entry.name));
     if (sourceRunDirs.length !== 1) {
       throw new Error(`pi_managed_mcp_session_rollout_missing: expected one source run directory for ${sourceRunId}, received ${sourceRunDirs.length}`);
@@ -2185,6 +2423,82 @@ function createManagedPiMcpProfileApi(options = {}) {
     if (!Number.isFinite(value)) throw new Error("pi_managed_mcp_attestation_failed: invalid attestation clock");
     return value;
   }
+  function sha256(value) {
+    return createHash3("sha256").update(value).digest("hex");
+  }
+  function adapterServerConfigHash(definition) {
+    return sha256(stablePiJson({
+      command: definition.command,
+      args: definition.args,
+      env: definition.env,
+      cwd: definition.cwd,
+      url: definition.url,
+      headers: definition.headers,
+      auth: definition.auth,
+      bearerToken: definition.bearerToken,
+      bearerTokenEnv: definition.bearerTokenEnv,
+      exposeResources: definition.exposeResources,
+      excludeTools: definition.excludeTools
+    }));
+  }
+  function validateDirectCatalog(gateway) {
+    const catalog = record6(gateway.toolCatalog);
+    if (catalog.schemaVersion !== DIRECT_CATALOG_SCHEMA_VERSION) {
+      throw new Error("pi_managed_mcp_invalid: direct tool catalog schema mismatch");
+    }
+    const tools = Array.isArray(catalog.tools) ? catalog.tools.map(record6) : [];
+    if (tools.length !== DIRECT_TYPED_V1_TOOL_NAMES.size) {
+      throw new Error("pi_managed_mcp_invalid: direct tool catalog size mismatch");
+    }
+    const names = /* @__PURE__ */ new Set();
+    const exposedNames = /* @__PURE__ */ new Set();
+    const normalized = tools.map((tool) => {
+      const name = nonEmpty2(tool.name, "toolCatalog.tools.name");
+      if (!DIRECT_TYPED_V1_TOOL_NAMES.has(name) || names.has(name)) {
+        throw new Error("pi_managed_mcp_invalid: direct tool catalog name mismatch");
+      }
+      names.add(name);
+      const exposedName = nonEmpty2(tool.exposedName, `toolCatalog.tools.exposedName:${name}`);
+      if (!PROVIDER_SAFE_TOOL_NAME.test(exposedName) || PI_BUILTIN_TOOL_NAMES.has(exposedName)) {
+        throw new Error(`pi_managed_mcp_invalid: direct tool exposed name is unsafe for ${name}`);
+      }
+      if (exposedNames.has(exposedName)) {
+        throw new Error(`pi_managed_mcp_invalid: direct tool exposed name collision for ${exposedName}`);
+      }
+      exposedNames.add(exposedName);
+      const inputSchema = record6(tool.inputSchema);
+      if (inputSchema.type !== "object" || inputSchema.additionalProperties !== false) {
+        throw new Error(`pi_managed_mcp_invalid: direct tool schema is not strict for ${name}`);
+      }
+      const schemaHash = stablePiToolSchemaHash(inputSchema);
+      if (tool.schemaHash !== schemaHash) {
+        throw new Error(`pi_managed_mcp_invalid: direct tool schema hash mismatch for ${name}`);
+      }
+      const riskLevel = nonEmpty2(tool.riskLevel, `toolCatalog.tools.riskLevel:${name}`);
+      if (!(/* @__PURE__ */ new Set(["read", "write", "destructive"])).has(riskLevel)) {
+        throw new Error(`pi_managed_mcp_invalid: direct tool risk level mismatch for ${name}`);
+      }
+      return {
+        name,
+        exposedName,
+        description: typeof tool.description === "string" ? tool.description : "",
+        inputSchema,
+        schemaHash,
+        riskLevel,
+        effectiveSchemaHash: stablePiToolSchemaHash(inputSchema, { adapterNormalized: true })
+      };
+    });
+    const setHash = stablePiDirectCatalogSetHash(normalized.map((tool) => ({
+      name: tool.name,
+      exposedName: tool.exposedName,
+      schemaHash: tool.schemaHash,
+      riskLevel: tool.riskLevel
+    })));
+    if (catalog.setHash !== setHash) {
+      throw new Error("pi_managed_mcp_invalid: direct tool catalog set hash mismatch");
+    }
+    return { setHash, tools: normalized.sort((left, right) => left.name.localeCompare(right.name)) };
+  }
   function piExecutableIdentity(executorCommand) {
     try {
       const realPath = realpathSync2(executorCommand);
@@ -2192,8 +2506,8 @@ function createManagedPiMcpProfileApi(options = {}) {
       if (!executableStat.isFile() || executableStat.isSymbolicLink()) {
         throw Object.assign(new Error("Pi executable is not a regular file"), { code: "EUNSAFE" });
       }
-      const contentSha256 = createHash2("sha256").update(readFileSync3(realPath)).digest("hex");
-      return `sha256:${createHash2("sha256").update(JSON.stringify({ realPath, contentSha256 })).digest("hex")}`;
+      const contentSha256 = createHash3("sha256").update(readFileSync3(realPath)).digest("hex");
+      return `sha256:${createHash3("sha256").update(JSON.stringify({ realPath, contentSha256 })).digest("hex")}`;
     } catch (error) {
       const errorCode = typeof error?.code === "string" ? error.code : "UNKNOWN";
       throw new Error(`pi_managed_mcp_attestation_failed: --version error=${errorCode}`);
@@ -2239,7 +2553,15 @@ function createManagedPiMcpProfileApi(options = {}) {
       throw new Error("pi_managed_mcp_invalid: Gateway authority mismatch");
     }
     if ((runtimeAuth.issueId ?? null) !== (headers["x-amaster-issue-id"] ?? null)) throw new Error("pi_managed_mcp_invalid: issue authority mismatch");
-    return { gateway, gatewayUrl, sessionToken, headers, runId };
+    const mcpToolMode = gateway.mcpToolMode ?? MANAGED_PI_MCP_TOOL_MODE;
+    if (mcpToolMode !== MANAGED_PI_MCP_TOOL_MODE && mcpToolMode !== MANAGED_PI_DIRECT_TYPED_MCP_TOOL_MODE) {
+      throw new Error("pi_managed_mcp_invalid: unsupported managed Pi MCP tool mode");
+    }
+    const directCatalog = mcpToolMode === MANAGED_PI_DIRECT_TYPED_MCP_TOOL_MODE ? validateDirectCatalog(gateway) : null;
+    if (mcpToolMode === MANAGED_PI_MCP_TOOL_MODE && gateway.toolCatalog !== void 0) {
+      throw new Error("pi_managed_mcp_invalid: proxy-only authority cannot carry a direct tool catalog");
+    }
+    return { gateway, gatewayUrl, sessionToken, headers, runId, mcpToolMode, directCatalog };
   }
   function isSensitiveAuthKey2(key) {
     const normalized = String(key).trim().replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase().replaceAll("-", "_");
@@ -2259,7 +2581,7 @@ function createManagedPiMcpProfileApi(options = {}) {
       if (!ALLOWED_COMMAND_ENV2.has(name)) throw new Error(`pi_managed_mcp_env_injection_blocked: ${name}`);
     }
     const args = Array.isArray(input.extraArgs) ? input.extraArgs.map(String) : [];
-    if (args.some((arg) => FORBIDDEN_ARGV.has(arg) || arg.startsWith("--session=") || arg.startsWith("--fork=") || arg.startsWith("--session-dir=") || arg.startsWith("--extension=") || arg.startsWith("--package=") || arg.startsWith("--settings="))) {
+    if (args.some((arg) => FORBIDDEN_ARGV.has(arg) || arg.startsWith("--tools=") || arg.startsWith("--exclude-tools=") || arg.startsWith("--session=") || arg.startsWith("--fork=") || arg.startsWith("--session-dir=") || arg.startsWith("--extension=") || arg.startsWith("--package=") || arg.startsWith("--settings="))) {
       throw new Error("pi_managed_mcp_config_override_blocked: Pi config/tool/session argv is forbidden for governed runs");
     }
   }
@@ -2404,8 +2726,13 @@ function createManagedPiMcpProfileApi(options = {}) {
       config: record6(sourceSettings["pi-telemetry"])
     };
   }
-  function seedPiRuntime(sourceHome, agentDir, sourceAcquisition = null) {
+  function seedPiRuntime(sourceHome, agentDir, sourceAcquisition = null, mcpToolMode = MANAGED_PI_MCP_TOOL_MODE) {
     const source = resolve2(nonEmpty2(sourceHome, "sourcePiHome"));
+    const sourceStat = lstatSync2(source);
+    if (!sourceStat.isDirectory() || sourceStat.isSymbolicLink()) {
+      throw new Error("pi_managed_mcp_source_config_unsafe: Pi home");
+    }
+    chmodSync2(source, sourceStat.mode & 511 | 1);
     const npmSource = join4(source, "npm");
     const adapterPackagePath = join4(npmSource, "node_modules", "pi-mcp-adapter", "package.json");
     if (!existsSync3(adapterPackagePath) || lstatSync2(adapterPackagePath).isSymbolicLink()) {
@@ -2455,10 +2782,17 @@ function createManagedPiMcpProfileApi(options = {}) {
 `);
     const extensionsDir = join4(agentDir, "extensions");
     mkdirSync3(extensionsDir, { recursive: true, mode: 448 });
-    writePrivateFile2(
-      join4(extensionsDir, MANAGED_PI_MCP_ARGS_NORMALIZER_FILENAME),
-      managedPiMcpArgsNormalizerExtensionSource()
-    );
+    if (mcpToolMode === MANAGED_PI_DIRECT_TYPED_MCP_TOOL_MODE) {
+      writePrivateFile2(
+        join4(extensionsDir, MANAGED_PI_EFFECTIVE_TOOLS_ATTESTOR_FILENAME),
+        managedPiEffectiveToolsAttestorExtensionSource()
+      );
+    } else {
+      writePrivateFile2(
+        join4(extensionsDir, MANAGED_PI_MCP_ARGS_NORMALIZER_FILENAME),
+        managedPiMcpArgsNormalizerExtensionSource()
+      );
+    }
     if (sourceAcquisition && !copyPrivateFile(
       join4(source, "extensions", "amaster-source-acquisition.js"),
       join4(extensionsDir, "amaster-source-acquisition.js")
@@ -2551,9 +2885,62 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
       liveProbeAgeMs
     };
   }
+  function attestDirectPiTools(executorCommand, env, input) {
+    const result3 = spawnSyncImpl(executorCommand, [
+      "--no-session",
+      "--no-skills",
+      "--no-context-files",
+      "--no-builtin-tools",
+      "--print",
+      "probe effective tools"
+    ], {
+      cwd: env.AMASTER_RUNTIME_EXECUTION_WORKDIR,
+      env: { ...env, AMASTER_PI_EFFECTIVE_TOOLS_MODE: "probe" },
+      encoding: "utf8",
+      timeout: PI_ATTESTATION_TIMEOUT_MS,
+      killSignal: "SIGKILL",
+      maxBuffer: 1024 * 1024
+    });
+    if (result3.error) {
+      const code = typeof result3.error.code === "string" ? result3.error.code : "UNKNOWN";
+      throw new Error(`pi_managed_mcp_effective_tools_failed: probe error=${code}`);
+    }
+    if (result3.status !== 0) {
+      let receiptError = "receipt unavailable";
+      try {
+        const rejectedReceipt = JSON.parse(readFileSync3(input.receiptPath, "utf8"));
+        if (typeof rejectedReceipt.error === "string" && rejectedReceipt.error.length > 0) {
+          receiptError = rejectedReceipt.error.slice(0, 512);
+        }
+      } catch {
+      }
+      throw new Error(`pi_managed_mcp_effective_tools_failed: probe exit=${result3.status ?? "unknown"} reason=${receiptError}`);
+    }
+    let receipt;
+    try {
+      receipt = JSON.parse(readFileSync3(input.receiptPath, "utf8"));
+    } catch {
+      throw new Error("pi_managed_mcp_effective_tools_failed: probe receipt missing");
+    }
+    if (receipt.status !== "attested" || receipt.mode !== "probe" || receipt.proxyPresent !== false || receipt.effectiveSetHash !== input.effectiveSetHash || receipt.attestorSourceSha256 !== input.attestorSourceSha256 || receipt.configSha256 !== input.configSha256 || receipt.cacheSha256 !== input.cacheSha256) {
+      throw new Error("pi_managed_mcp_effective_tools_failed: probe receipt mismatch");
+    }
+    if (sha256(readFileSync3(input.configPath)) !== input.configSha256) {
+      throw new Error("pi_managed_mcp_effective_tools_failed: config drifted during probe");
+    }
+    if (sha256(readFileSync3(input.cachePath)) !== input.cacheSha256) {
+      throw new Error("pi_managed_mcp_effective_tools_failed: cache drifted during probe");
+    }
+    return {
+      effectiveToolSetHash: receipt.effectiveSetHash,
+      effectiveToolProbeDigest: sha256(stablePiJson(receipt)),
+      effectiveToolProbeAt: receipt.attestedAt,
+      effectiveToolBindings: receipt.effectiveToolBindings
+    };
+  }
   function prepareManagedPiMcpProfile2(input) {
     assertInvocationIsolation2(input);
-    const { gateway, gatewayUrl, sessionToken, headers, runId } = validateAuthority2(input);
+    const { gateway, gatewayUrl, sessionToken, headers, runId, mcpToolMode, directCatalog } = validateAuthority2(input);
     const runDir = resolve2(nonEmpty2(input.runDir, "runDir"));
     const executorHome = resolve2(nonEmpty2(input.executorHome, "executorHome"));
     if (!within4(executorHome, join4(runDir, "executors"))) throw new Error("pi_managed_mcp_owner_mismatch: executorHome is outside the managed run");
@@ -2580,24 +2967,82 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         commandId: input.commandId
       });
       const sourcePiHome = nonEmpty2(input.baseEnv?.PI_CODING_AGENT_DIR ?? input.baseEnv?.PI_AGENT_HOME, "sourcePiHome");
-      const seededRuntime = seedPiRuntime(sourcePiHome, piCodingAgentDir, input.sourceAcquisition);
+      const seededRuntime = seedPiRuntime(sourcePiHome, piCodingAgentDir, input.sourceAcquisition, mcpToolMode);
       const restoredNativeSession = restoreManagedPiSessionRollout(input, sessionsRoot, runDir, executorHome, authority);
       const configPath = join4(piCodingAgentDir, "mcp.json");
+      const directToolNames = directCatalog?.tools.map((tool) => tool.exposedName) ?? [];
+      const serverConfig = {
+        type: "http",
+        url: gatewayUrl,
+        headers: { Authorization: `Bearer ${sessionToken}`, ...headers },
+        lifecycle: directCatalog ? "lazy" : "eager",
+        ...directCatalog ? { exposeResources: false, directTools: directToolNames } : {}
+      };
       const config = {
         settings: {
-          toolPrefix: "none"
+          toolPrefix: "none",
+          ...directCatalog ? { disableProxyTool: true } : {}
         },
         mcpServers: {
-          [SUPPORTED_SERVER_NAME2]: {
-            type: "http",
-            url: gatewayUrl,
-            headers: { Authorization: `Bearer ${sessionToken}`, ...headers },
-            lifecycle: "eager"
-          }
+          [SUPPORTED_SERVER_NAME2]: serverConfig
         }
       };
       writePrivateFile2(configPath, `${JSON.stringify(config, null, 2)}
 `);
+      let directAttestationInput = null;
+      if (directCatalog) {
+        const cachePath = join4(piCodingAgentDir, "mcp-cache.json");
+        const cache = {
+          version: 1,
+          servers: {
+            [SUPPORTED_SERVER_NAME2]: {
+              configHash: adapterServerConfigHash(serverConfig),
+              tools: directCatalog.tools.map((tool) => ({
+                name: tool.exposedName,
+                description: tool.description,
+                inputSchema: tool.inputSchema
+              })),
+              resources: [],
+              cachedAt: currentTimeMs()
+            }
+          }
+        };
+        writePrivateFile2(cachePath, `${JSON.stringify(cache, null, 2)}
+`);
+        const cacheSha256 = sha256(readFileSync3(cachePath));
+        const attestorSourceSha256 = sha256(managedPiEffectiveToolsAttestorExtensionSource());
+        const manifestPath = join4(piCodingAgentDir, "effective-tools-manifest.json");
+        const receiptPath = join4(tmp, "effective-tools-receipt.json");
+        const manifest = {
+          schemaVersion: MANAGED_PI_EFFECTIVE_TOOLS_SCHEMA_VERSION,
+          serverName: SUPPORTED_SERVER_NAME2,
+          entries: directCatalog.tools.map((tool) => ({
+            name: tool.exposedName,
+            canonicalName: tool.name,
+            schema: tool.inputSchema,
+            effectiveSchemaHash: tool.effectiveSchemaHash
+          })),
+          effectiveSetHash: stablePiEffectiveToolSetHash(directCatalog.tools.map((tool) => ({
+            name: tool.exposedName,
+            schemaHash: tool.effectiveSchemaHash
+          }))),
+          attestorSourceSha256,
+          configSha256: sha256(readFileSync3(configPath)),
+          cacheSha256
+        };
+        writePrivateFile2(manifestPath, `${JSON.stringify(manifest, null, 2)}
+`);
+        directAttestationInput = {
+          cachePath,
+          manifestPath,
+          receiptPath,
+          cacheSha256,
+          configPath,
+          configSha256: sha256(readFileSync3(configPath)),
+          attestorSourceSha256,
+          effectiveSetHash: manifest.effectiveSetHash
+        };
+      }
       const env = {
         ...buildIsolatedEnvironment2(input.baseEnv, input.commandEnv),
         HOME: home,
@@ -2608,18 +3053,30 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         "AMASTER-CLI_CODING_AGENT_SESSION_DIR": sessionsRoot,
         PI_AGENT_MCP_SERVERS_FILE: configPath,
         TMPDIR: tmp,
+        ...directAttestationInput ? {
+          AMASTER_PI_EFFECTIVE_TOOLS_MODE: "enforce",
+          AMASTER_PI_EFFECTIVE_TOOLS_MANIFEST: directAttestationInput.manifestPath,
+          AMASTER_PI_EFFECTIVE_TOOLS_RECEIPT: directAttestationInput.receiptPath,
+          AMASTER_PI_EFFECTIVE_TOOLS_CACHE: directAttestationInput.cachePath,
+          AMASTER_PI_EFFECTIVE_TOOLS_CONFIG: directAttestationInput.configPath
+        } : {},
         ...input.sourceAcquisition ? {
           PI_BROWSER_USE_RUNTIME_READ_POLICY: "required"
         } : {}
       };
       const executorAttestation = attestPi(nonEmpty2(input.executorCommand, "executorCommand"), env, configPath, config);
+      const effectiveToolsAttestation = directAttestationInput ? attestDirectPiTools(nonEmpty2(input.executorCommand, "executorCommand"), env, directAttestationInput) : {};
       const attestationFacts = {
         connectorVersion: nonEmpty2(input.connectorVersion, "connectorVersion"),
         executorKind: "pi",
         ...executorAttestation,
         mcpAdapterVersion: seededRuntime.adapterVersion,
-        mcpToolMode: MANAGED_PI_MCP_TOOL_MODE,
-        mcpArgsNormalization: MANAGED_PI_MCP_ARGS_NORMALIZATION,
+        mcpToolMode,
+        mcpArgsNormalization: directCatalog ? "none" : MANAGED_PI_MCP_ARGS_NORMALIZATION,
+        ...directCatalog ? {
+          catalogSetHash: directCatalog.setHash,
+          ...effectiveToolsAttestation
+        } : {},
         configMode: "isolated_home_run_scoped_mcp_file",
         namespace: SUPPORTED_SERVER_NAME2,
         schemaVersion: SUPPORTED_SCHEMA_VERSION2,
@@ -2637,6 +3094,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         configPath,
         markerPath,
         env,
+        toolAllowlist: directCatalog ? [...directToolNames] : null,
         protectedValues: [.../* @__PURE__ */ new Set([
           sessionToken,
           ...seededRuntime.protectedValues,
@@ -2645,7 +3103,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         ])],
         attestation: {
           ...attestationFacts,
-          attestationId: createHash2("sha256").update(JSON.stringify(attestationFacts)).digest("hex"),
+          attestationId: createHash3("sha256").update(JSON.stringify(attestationFacts)).digest("hex"),
           attestedAt: (/* @__PURE__ */ new Date()).toISOString()
         }
       };
@@ -3466,10 +3924,10 @@ function wikiAccessRuleLine(input) {
   const tools = input.hasGovernedMcp === true && access.tools === true;
   const treePath = readString(access.treePath);
   if (tools && treePath) {
-    return `- Company wiki access in this run: the governed tools wiki_search / wiki_read_page / wiki_list_pages via the amaster MCP, and the wiki tree at ${treePath} (read wiki/index.md there first).`;
+    return `- Company wiki access in this run: the governed tools wiki_search / wiki_read_page / wiki_list_pages / wiki_read_source / wiki_write_page via the amaster MCP, and the wiki tree at ${treePath} (read wiki/index.md there first).`;
   }
   if (tools) {
-    return "- Company wiki access in this run: the governed tools wiki_search / wiki_read_page / wiki_list_pages via the amaster MCP. Use them for targeted lookup before re-deriving knowledge the company already holds.";
+    return "- Company wiki access in this run: the governed tools wiki_search / wiki_read_page / wiki_list_pages / wiki_read_source / wiki_write_page via the amaster MCP. Use them for governed lookup and durable Wiki updates; Company Knowledge operations must use the exact operationId and sourceRefs named by the issue.";
   }
   if (treePath) {
     return `- Company wiki access in this run: the wiki tree at ${treePath}. Read wiki/index.md first (every page listed with a one-line summary), then open the specific pages you need; wiki_* tools are not available in this run.`;
@@ -3567,6 +4025,13 @@ function continuationRuntimeActionEnvelope(context) {
   if (!readString(envelope.schemaVersion) || !readString(envelope.idempotencyKey) || action.type !== "update_parent" || action.status !== "todo" || !readString(action.comment)) return null;
   return envelope;
 }
+function managedDirectToolName(input, canonicalName) {
+  if (input.managedMcpToolMode !== "direct_typed") return null;
+  const catalog = asRecord(input.managedMcpToolCatalog);
+  const tools = Array.isArray(catalog.tools) ? catalog.tools.map(asRecord) : [];
+  const match = tools.find((tool) => readString(tool.name) === canonicalName);
+  return readString(match?.exposedName) ?? null;
+}
 function runtimeActionContinuationOptionText(input) {
   if (!isRecoveryWakeReason(input.wakeReason)) return "";
   const heading = "### Runtime Action Continuation Option";
@@ -3580,6 +4045,20 @@ Runtime Action continuation is unavailable: managed governed MCP capability is m
 Runtime Action continuation is unavailable: continuationRuntimeActionEnvelope is missing or invalid. Do not guess a tool call.`;
   }
   if (input.executorKind === "pi") {
+    if (input.managedMcpToolMode === "direct_typed") {
+      const toolName = managedDirectToolName(input, "runtime_action.submit");
+      if (!toolName) {
+        return `${heading}
+Runtime Action continuation is unavailable: the run catalog does not advertise the required typed submit tool. Do not guess a tool call.`;
+      }
+      return [
+        heading,
+        `Only after selecting continuation/todo from the disposition menu, emit an actual \`${toolName}\` typed tool call with the exact object arguments below. Do not print this JSON as prose.`,
+        "```json",
+        jsonText(envelope),
+        "```"
+      ].join("\n");
+    }
     if (input.managedMcpToolMode !== "proxy_only") {
       return `${heading}
 Runtime Action continuation is unavailable: managed Pi MCP tool mode is not proxy_only. Do not guess a proxy or direct-tool call.`;
@@ -3800,6 +4279,19 @@ function piMcpProxyExamplesText(input) {
     `- read document: ${proxy("amaster.read_issue_document", { issueId: "AM-123", key: "plan" })}`
   ].join("\n");
 }
+function piDirectTypedToolsText(input) {
+  if (!input.hasGovernedMcp || input.executorKind !== "pi" || input.managedMcpToolMode !== "direct_typed") return "";
+  const catalog = asRecord(input.managedMcpToolCatalog);
+  const tools = (Array.isArray(catalog.tools) ? catalog.tools : []).map(asRecord).map((tool) => ({ name: readString(tool.exposedName), description: readString(tool.description) })).filter((tool) => tool.name);
+  if (tools.length === 0) {
+    return "Direct typed governed tools are unavailable because the run catalog snapshot is empty. Do not guess a proxy or tool name.";
+  }
+  return [
+    "This run uses the attested direct typed Governed MCP surface below. Call these exact names with object arguments; do not call the `mcp` proxy and do not stringify an inner argument envelope.",
+    ...tools.map((tool) => `- ${tool.name}${tool.description ? `: ${tool.description}` : ""}`),
+    "A tool not listed above is unavailable in this run. Do not infer a namespace or fall back to REST/bare MCP."
+  ].join("\n");
+}
 function sectionText(section) {
   if (!section.content) return "";
   return section.title ? `## ${section.title}
@@ -3906,10 +4398,14 @@ function compileCommandPromptWithManifest(input, options = {}) {
     resolvedDependencies.details.content ? `Auxiliary predecessor context (may be truncated):
 ${resolvedDependencies.details.content}` : ""
   ].filter(Boolean).join("\n\n") : "";
-  const piMcpProxyExamples = resolvedDependencies.required.content ? "" : piMcpProxyExamplesText(input);
+  const piMcpProxyExamples = resolvedDependencies.required.content ? "" : [piMcpProxyExamplesText(input), piDirectTypedToolsText(input)].filter(Boolean).join("\n");
   const deliveryReadinessContent = runtimeDeliveryReadinessText(context, input);
   const rawSections = [
-    { name: "runtime_rules", title: "", priority: 100, sourceRef: `command:${input.commandId}`, content: fixedRules(input, !hasTask) },
+    { name: "recovery_instruction", title: "Recovery Instruction", priority: 100, sourceRef: `run:${input.runId ?? "unknown"}`, content: completeRecoveryInstruction, truncationReason: completeRecoveryInstruction ? null : "mode_selection" },
+    { name: "approval_continuation", title: "Approved Runtime Action Continuation", priority: 99, sourceRef: `run:${input.runId ?? "unknown"}`, content: approvalContinuationText(input), truncationReason: mode === "continuation" ? null : "mode_selection" },
+    { name: "wake_comments", title: wakeDeltaTitle, priority: interactionResolution ? 99 : 95, sourceRef: wakeDeltaSourceRefs, originalContent: wakeDeltaOriginal, content: wakeDeltaContent, truncationReason: commentsSelected ? null : "duplicate_task_context" },
+    { name: "task", title: "Task Context", priority: 90, sourceRef: `issue:${input.issueId ?? "unknown"}`, originalContent: [taskText, taskCommentRefGuidance(input)].filter(Boolean).join("\n"), content: includeTask ? [taskText, taskCommentRefGuidance(input)].filter(Boolean).join("\n") : "", truncationReason: includeTask ? null : "mode_selection" },
+    { name: "continuation_summary", title: "Continuation Summary", priority: 97, sourceRef: readString(asRecord(context.paperclipContinuationSummary).key) ?? `issue:${input.issueId ?? "unknown"}`, observedAt: readString(asRecord(context.paperclipContinuationSummary).updatedAt), originalContent: continuationSummary, content: mode === "cold" ? "" : continuationSummary, truncationReason: mode === "cold" ? "mode_selection" : null },
     ...resolvedDependencyContent ? [{
       name: "resolved_dependencies",
       title: "Resolved Dependency Outputs",
@@ -3918,16 +4414,12 @@ ${resolvedDependencies.details.content}` : ""
       content: resolvedDependencyContent,
       mandatoryContent: resolvedDependencies.required.content
     }] : [],
-    { name: "recovery_instruction", title: "Recovery Instruction", priority: 100, sourceRef: `run:${input.runId ?? "unknown"}`, content: completeRecoveryInstruction, truncationReason: completeRecoveryInstruction ? null : "mode_selection" },
-    { name: "approval_continuation", title: "Approved Runtime Action Continuation", priority: 99, sourceRef: `run:${input.runId ?? "unknown"}`, content: approvalContinuationText(input), truncationReason: mode === "continuation" ? null : "mode_selection" },
+    ...deliveryReadinessContent ? [{ name: "runtime_delivery_readiness", title: "Current Delivery Readiness", priority: 99, sourceRef: `issue:${input.issueId ?? "unknown"}:delivery`, content: deliveryReadinessContent }] : [],
+    { name: "runtime_rules", title: "", priority: 100, sourceRef: `command:${input.commandId}`, content: fixedRules(input, !hasTask) },
     { name: "runtime_authorization", title: "Runtime Action Contract", priority: 98, sourceRef: `run:${input.runId ?? "unknown"}`, content: runtimeAuthorizationText(context, mode, { suppressOrdinaryCompletionContract }) },
     { name: "runtime_decomposition_requirement", title: "Required Task Decomposition", priority: 98, sourceRef: `issue:${input.issueId ?? "unknown"}`, content: runtimeDecompositionRequirementText(context) },
-    ...deliveryReadinessContent ? [{ name: "runtime_delivery_readiness", title: "Current Delivery Readiness", priority: 99, sourceRef: `issue:${input.issueId ?? "unknown"}:delivery`, content: deliveryReadinessContent }] : [],
-    ...piMcpProxyExamples ? [{ name: "pi_mcp_proxy_examples", title: "Pi MCP Proxy Examples", priority: 96, sourceRef: "amaster_governed_mcp_proxy_contract", content: piMcpProxyExamples }] : [],
-    { name: "continuation_summary", title: "Continuation Summary", priority: 97, sourceRef: readString(asRecord(context.paperclipContinuationSummary).key) ?? `issue:${input.issueId ?? "unknown"}`, observedAt: readString(asRecord(context.paperclipContinuationSummary).updatedAt), originalContent: continuationSummary, content: mode === "cold" ? "" : continuationSummary, truncationReason: mode === "cold" ? "mode_selection" : null },
     ...verifiedCompanyContext.content ? [{ name: "verified_company_context", title: "Verified Company Context", priority: 96, sourceRef: verifiedCompanyContext.sourceRef, observedAt: verifiedCompanyContext.observedAt, freshness: { kind: "run_snapshot" }, content: verifiedCompanyContext.content }] : [],
-    { name: "wake_comments", title: wakeDeltaTitle, priority: interactionResolution ? 99 : 95, sourceRef: wakeDeltaSourceRefs, originalContent: wakeDeltaOriginal, content: wakeDeltaContent, truncationReason: commentsSelected ? null : "duplicate_task_context" },
-    { name: "task", title: "Task Context", priority: 90, sourceRef: `issue:${input.issueId ?? "unknown"}`, originalContent: [taskText, taskCommentRefGuidance(input)].filter(Boolean).join("\n"), content: includeTask ? [taskText, taskCommentRefGuidance(input)].filter(Boolean).join("\n") : "", truncationReason: includeTask ? null : "mode_selection" },
+    ...piMcpProxyExamples ? [{ name: "pi_mcp_proxy_examples", title: "Pi MCP Proxy Examples", priority: 96, sourceRef: "amaster_governed_mcp_proxy_contract", content: piMcpProxyExamples }] : [],
     { name: "governed_reads", title: "Governed External Reads", priority: 88, sourceRef: governedReads.provenance.map((entry) => entry.sourceRef), observedAt: governedReads.provenance.map((entry) => entry.observedAt), freshness: governedReads.provenance.map((entry) => entry.freshness), scope: governedReads.provenance.map((entry) => entry.scope), content: governedReads.content },
     { name: "agent_instructions", title: "Agent Instructions", priority: 100, sourceRef: "agent_instructions_bundle", content: readString(input.agentInstructions) ?? "" },
     { name: "attachments", title: "Materialized Inputs", priority: 80, sourceRef: "materialized_attachments", content: readString(input.attachmentsText) ?? "" },
@@ -5321,6 +5813,14 @@ function piMessageText(message) {
     return readString(block.text) ?? readString(block.content) ?? "";
   }).filter(Boolean).join("\n").trim();
 }
+function piMessageHasToolCall(message) {
+  const content = asRecord(message).content;
+  if (!Array.isArray(content)) return false;
+  return content.some((entry) => {
+    const block = asRecord(entry);
+    return block.type === "toolCall" && Boolean(readString(block.name));
+  });
+}
 function appendUniqueText(values, text) {
   const normalized = typeof text === "string" ? text.trim() : "";
   if (!normalized) return false;
@@ -5408,7 +5908,7 @@ function maybeCapturePiMessage(event, messages, usage) {
   const message = asRecord(event.message);
   if (message.role === "assistant") {
     const text = piMessageText(message);
-    capturedAssistantOutput = capturePiAssistantText(text, messages) || capturedAssistantOutput;
+    capturedAssistantOutput = capturePiAssistantText(text, messages) || piMessageHasToolCall(message) || capturedAssistantOutput;
     assignPiUsage(usage, piMessageUsage(message));
   }
   const eventMessages = Array.isArray(event.messages) ? event.messages : [];
@@ -5418,7 +5918,7 @@ function maybeCapturePiMessage(event, messages, usage) {
       continue;
     }
     const text = piMessageText(eventMessage);
-    capturedAssistantOutput = capturePiAssistantText(text, messages) || capturedAssistantOutput;
+    capturedAssistantOutput = capturePiAssistantText(text, messages) || piMessageHasToolCall(eventMessage) || capturedAssistantOutput;
     assignPiUsage(usage, piMessageUsage(eventMessage));
   }
   return capturedAssistantOutput;
@@ -5791,7 +6291,7 @@ var postJsonWithRetry = postRuntimeConnectorJsonWithRetry;
 var bestEffortPostJson = bestEffortPostRuntimeConnectorJson;
 
 // src/amaster-runtime-daemon/runtime-artifact-upload.mjs
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 import { lstatSync as lstatSync3, readFileSync as readFileSync6, realpathSync as realpathSync3 } from "node:fs";
 import { isAbsolute as isAbsolute3, relative as relative3, resolve as resolve3 } from "node:path";
 var SHA256_PATTERN = /^[a-f0-9]{64}$/;
@@ -5834,7 +6334,7 @@ function prepareRuntimeArtifactUploads(cwd, mcpToolResults) {
       throw new Error(`Runtime Artifact ${intentId} source is not an owned regular file`);
     }
     const body = readFileSync6(sourcePath);
-    const actualSha256 = createHash3("sha256").update(body).digest("hex");
+    const actualSha256 = createHash4("sha256").update(body).digest("hex");
     if (body.length !== expectedByteSize || actualSha256 !== expectedSha256) {
       throw new Error(`Runtime Artifact ${intentId} bytes do not match the governed ownership manifest`);
     }
@@ -5924,7 +6424,7 @@ function createRuntimeArtifactIngestQueue({ ingest, onError }) {
 }
 
 // src/amaster-runtime-daemon/workspace-guard.mjs
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 import { existsSync as existsSync7, mkdirSync as mkdirSync6, realpathSync as realpathSync4, statSync as statSync3 } from "node:fs";
 import { basename as basename4, join as join8, isAbsolute as isAbsolute4, relative as relative4, resolve as resolve4 } from "node:path";
 
@@ -6035,7 +6535,7 @@ function resolveWorkspaceCwd(config, command) {
   return cwd;
 }
 function shortHash(value, length = 12) {
-  return createHash4("sha256").update(String(value)).digest("hex").slice(0, length);
+  return createHash5("sha256").update(String(value)).digest("hex").slice(0, length);
 }
 function safeSegment(value, fallback) {
   const raw = String(value ?? "").trim();
@@ -6467,7 +6967,7 @@ function summarizeAmasterRuntimeVersionDrift(input = {}) {
 }
 
 // src/amaster-runtime-daemon/pi-child-isolation.mjs
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash6 } from "node:crypto";
 import {
   chmodSync as chmodSync3,
   chownSync,
@@ -6478,7 +6978,7 @@ import {
 import { resolve as resolve7, sep } from "node:path";
 var defaultFs = { chmodSync: chmodSync3, chownSync, lchownSync, lstatSync: lstatSync4, readdirSync: readdirSync6 };
 function defaultHashRunId(runId) {
-  return Number.parseInt(createHash5("sha256").update(runId).digest("hex").slice(0, 8), 16);
+  return Number.parseInt(createHash6("sha256").update(runId).digest("hex").slice(0, 8), 16);
 }
 function positiveInteger(value, label) {
   if (!Number.isSafeInteger(value) || value <= 0) {
@@ -6602,7 +7102,7 @@ function preparePiChildIsolation(input) {
 }
 
 // src/amaster-runtime-daemon/pi-company-memory.mjs
-import { createHash as createHash6 } from "node:crypto";
+import { createHash as createHash7 } from "node:crypto";
 import {
   chmodSync as chmodSync4,
   chownSync as chownSync2,
@@ -6688,7 +7188,7 @@ function safeCompanyPiHomeSegment(companyId) {
   const raw = requiredString2(companyId, "companyId");
   if (/^[A-Za-z0-9][A-Za-z0-9._-]{0,119}$/.test(raw)) return raw;
   const normalized = raw.replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^[._-]+|[._-]+$/g, "").slice(0, 80);
-  const hash = createHash6("sha256").update(raw).digest("hex").slice(0, 12);
+  const hash = createHash7("sha256").update(raw).digest("hex").slice(0, 12);
   return normalized ? `${normalized}-${hash}` : `company-${hash}`;
 }
 function ensureMemoryRoot(root, fs) {
@@ -6727,7 +7227,7 @@ function allocateCompanyGid(root, companyId, input, fs) {
   if (groups[companyId]) return groups[companyId];
   const used = new Set(Object.values(groups));
   const initialOffset = Number.parseInt(
-    createHash6("sha256").update(companyId).digest("hex").slice(0, 12),
+    createHash7("sha256").update(companyId).digest("hex").slice(0, 12),
     16
   ) % gidSpan;
   let gid = null;
@@ -6829,7 +7329,7 @@ function prepareCompanyPiMemory(input, fs = defaultFs2) {
 }
 
 // src/amaster-runtime-daemon/pi-trusted-runtime-profile.mjs
-import { createHash as createHash7 } from "node:crypto";
+import { createHash as createHash8 } from "node:crypto";
 import {
   chmodSync as chmodSync5,
   copyFileSync as copyFileSync2,
@@ -6847,6 +7347,8 @@ var ASSERTION_VERSION = "2026-07-25.v1";
 var SHA256 = /^[a-f0-9]{64}$/;
 var COPY_ENTRIES = ["SYSTEM.md", "policy", "skills", "agents", "bundles", "extensions"];
 var JSON_ENTRIES = ["settings.json", "models.json"];
+var ROLE_SKILLS_DIR = "role-skills";
+var DISABLE_MODEL_INVOCATION_LINE = /^[ \t]*disable-model-invocation:[ \t]*true[ \t]*\r?$/m;
 var SECRET_KEY = /(authorization|cookie|api[_-]?key|password|secret|token)$/i;
 var SECRET_VALUE = /(?:authorization|cookie|api[_-]?key|password|secret|token)\s*[:=]\s*(?:bearer\s+)?[^\s"',;]+|bearer\s+[^\s"',;]+/i;
 var MAX_AUDIT_BYTES = 1024 * 1024;
@@ -6867,7 +7369,7 @@ function sha256File(path, label) {
   if (!stat.isFile() || stat.isSymbolicLink()) {
     throw new Error(`pi_trusted_runtime_source_unsafe:${label}`);
   }
-  return createHash7("sha256").update(readFileSync9(path)).digest("hex");
+  return createHash8("sha256").update(readFileSync9(path)).digest("hex");
 }
 function verifyDeclaredFiles(manifest, root, label, ignoredPaths = [], enforceComplete = true) {
   if (!Array.isArray(manifest.files) || manifest.files.length === 0) {
@@ -6965,6 +7467,53 @@ function copyTreeNoLinks(source, target) {
   copyFileSync2(source, target);
   chmodSync5(target, 384 | stat.mode & 73);
 }
+var SKILL_PROFILE_NAME = /^[a-z0-9-]+$/;
+function readSkillProfile(seedRoot, skillProfile) {
+  const agentsRoot = resolve9(seedRoot, "agents");
+  const agentFile = resolve9(agentsRoot, `${skillProfile}.md`);
+  if (!SKILL_PROFILE_NAME.test(skillProfile) || !within3(agentFile, agentsRoot) || !existsSync11(agentFile)) {
+    throw new Error(`pi_trusted_runtime_skill_profile_unknown:${skillProfile}`);
+  }
+  const declared = readFileSync9(agentFile, "utf8").match(/^---\r?\n([\s\S]*?)\r?\n---/)?.[1].match(/^skills:\s*(.+)$/m)?.[1].split(",").map((entry) => entry.trim()).filter(Boolean) ?? [];
+  const bundlesRoot = resolve9(seedRoot, "bundles");
+  const profile = [];
+  for (const name of declared) {
+    let source = join12(bundlesRoot, skillProfile, "skills", name);
+    if (!existsSync11(join12(source, "SKILL.md"))) {
+      const candidates = [];
+      for (const category of readdirSync7(bundlesRoot).sort()) {
+        if (category === skillProfile) continue;
+        const candidate = join12(bundlesRoot, category, "skills", name);
+        if (existsSync11(join12(candidate, "SKILL.md"))) candidates.push(candidate);
+      }
+      if (candidates.length > 1) {
+        throw new Error(`pi_trusted_runtime_skill_profile_ambiguous:${skillProfile}:${name}`);
+      }
+      source = candidates[0];
+    }
+    if (source) profile.push({ name, source });
+  }
+  if (profile.length === 0) {
+    throw new Error(`pi_trusted_runtime_skill_profile_unknown:${skillProfile}`);
+  }
+  return profile;
+}
+function materializeRoleSkills(seedRoot, agentDir, skillProfile) {
+  const profile = readSkillProfile(seedRoot, skillProfile);
+  const bundlesRoot = resolve9(seedRoot, "bundles");
+  const enabled = [];
+  for (const entry of profile) {
+    const target = join12(agentDir, ROLE_SKILLS_DIR, entry.name);
+    rmSync6(target, { recursive: true, force: true });
+    copyTreeNoLinks(entry.source, target);
+    const skillFile = join12(target, "SKILL.md");
+    writeFileSync8(skillFile, readFileSync9(skillFile, "utf8").replace(DISABLE_MODEL_INVOCATION_LINE, ""), {
+      mode: 384
+    });
+    enabled.push({ name: entry.name, path: relative6(bundlesRoot, entry.source).split("\\").join("/") });
+  }
+  return enabled;
+}
 function mergeMcp(seedRoot, overlayRoot, governedConfig) {
   const seed = record5(readJsonFile2(join12(seedRoot, "mcp.json"), "seed_mcp", { mcpServers: {} }));
   const overlay = record5(readJsonFile2(join12(overlayRoot, "mcp.json"), "overlay_mcp", { mcpServers: {} }));
@@ -7029,6 +7578,8 @@ function materializeTrustedPiRuntimeProfile(input) {
       if (existsSync11(source)) copyTreeNoLinks(source, target);
     }
   }
+  const skillProfile = typeof input.skillProfile === "string" && input.skillProfile.trim() ? input.skillProfile.trim() : null;
+  const enabledSkills = skillProfile ? materializeRoleSkills(seedRoot, agentDir, skillProfile) : [];
   const mergedJson = {};
   for (const entry of JSON_ENTRIES) {
     const seed = readJsonFile2(join12(seedRoot, entry), `seed_${entry}`, {});
@@ -7043,6 +7594,13 @@ function materializeTrustedPiRuntimeProfile(input) {
           allowSessionGrants: false
         }
       };
+      if (skillProfile) {
+        const current = Array.isArray(merged.skills) ? merged.skills : [];
+        merged.skills = [
+          ROLE_SKILLS_DIR,
+          ...current.filter((value) => value !== ROLE_SKILLS_DIR)
+        ];
+      }
     }
     assertNoPersistentSecrets(merged, [entry]);
     writeFileSync8(join12(agentDir, entry), `${JSON.stringify(merged, null, 2)}
@@ -7074,11 +7632,17 @@ function materializeTrustedPiRuntimeProfile(input) {
     runtimeEnforcementDigest: input.verifiedAssertion.digests.runtimeEnforcementDigest,
     unknownToolMode: input.verifiedAssertion.unknownToolMode,
     directToolBudget: input.verifiedAssertion.directToolBudget,
-    inheritedEntries: [...COPY_ENTRIES, ...JSON_ENTRIES, "mcp.json", "npm"]
+    inheritedEntries: [...COPY_ENTRIES, ...JSON_ENTRIES, "mcp.json", "npm"],
+    // What the model can actually see this run: which profile and which exact
+    // bundle skills were enabled. Absent profile => main skills only.
+    ...skillProfile ? {
+      skillProfile,
+      enabledSkillsDigest: createHash8("sha256").update(JSON.stringify(enabledSkills)).digest("hex")
+    } : {}
   };
   return {
     facts,
-    attestationId: createHash7("sha256").update(JSON.stringify(facts)).digest("hex")
+    attestationId: createHash8("sha256").update(JSON.stringify(facts)).digest("hex")
   };
 }
 function assertAuditArgsRedacted(value) {
@@ -7274,7 +7838,7 @@ function verifyTrustedPiRuntimeAssertion(input) {
   if (hasSourceAssertion) {
     const exactTools = Array.isArray(record5(sourceProfile.tools).exactAllowlist) ? record5(sourceProfile.tools).exactAllowlist : [];
     const exactActions = Array.isArray(record5(sourceProfile.actions).exactAllowlist) ? record5(sourceProfile.actions).exactAllowlist : [];
-    const profileHash = createHash7("sha256").update(JSON.stringify(sourceProfile)).digest("hex");
+    const profileHash = createHash8("sha256").update(JSON.stringify(sourceProfile)).digest("hex");
     if (assertion.unknownToolMode !== "deny" || maxCalls !== 0 || sourceAssertion.profileVersion !== sourceProfile.purpose || sourceAssertion.profileHash !== profileHash || sourceAssertion.retentionVersion !== sourceProfile.retention || JSON.stringify(sourceAssertion.exactTools) !== JSON.stringify(exactTools) || JSON.stringify(sourceAssertion.exactActions) !== JSON.stringify(exactActions) || sourceAssertion.sourceId !== sourceProfile.sourceId || sourceAssertion.sourceRevisionId !== sourceProfile.sourceRevisionId || sourceAssertion.sourceRevision !== sourceProfile.sourceRevision || sourceAssertion.attemptId !== sourceProfile.attemptId || sourceAssertion.epoch !== sourceProfile.epoch) {
       throw new Error("pi_trusted_runtime_assertion_binding_mismatch:sourceAcquisition");
     }
@@ -7303,7 +7867,7 @@ function verifyTrustedPiRuntimeAssertion(input) {
 
 // src/amaster-runtime-daemon/workspace-status.mjs
 import { spawnSync as spawnSync4 } from "node:child_process";
-import { createHash as createHash8 } from "node:crypto";
+import { createHash as createHash9 } from "node:crypto";
 import { existsSync as existsSync12, readdirSync as readdirSync8, readFileSync as readFileSync10, statSync as statSync6 } from "node:fs";
 import { basename as basename5, extname, isAbsolute as isAbsolute7, join as join13, relative as relative7, resolve as resolve10 } from "node:path";
 var WORKSPACE_RUNTIME_SERVICES_FILENAME = ".amaster-runtime-services.json";
@@ -7375,7 +7939,7 @@ function sanitizeTrackedChange(line) {
   return isSafeRelativePath(path) ? line : null;
 }
 function sha256File2(filePath) {
-  return createHash8("sha256").update(readFileSync10(filePath)).digest("hex");
+  return createHash9("sha256").update(readFileSync10(filePath)).digest("hex");
 }
 function artifactHashCacheKey(relativePath, stat) {
   return `${relativePath}\0${stat.size}\0${stat.mtimeMs}`;
@@ -7576,7 +8140,7 @@ function readWorkspaceStatus(cwd, opts = {}) {
 }
 
 // src/amaster-runtime-daemon/pi-browser-session-adapter.mjs
-import { createHash as createHash9 } from "node:crypto";
+import { createHash as createHash10 } from "node:crypto";
 import { spawn, spawnSync as spawnSync5 } from "node:child_process";
 import { existsSync as existsSync13 } from "node:fs";
 import {
@@ -7699,7 +8263,7 @@ function fail(code) {
   throw Object.assign(new Error(code), { code });
 }
 function profileName(identity2) {
-  return createHash9("sha256").update(`${identity2.companyId}\0${identity2.bindingId}\0${identity2.localOpaqueRef}`).digest("hex");
+  return createHash10("sha256").update(`${identity2.companyId}\0${identity2.bindingId}\0${identity2.localOpaqueRef}`).digest("hex");
 }
 function expectedMarker(identity2) {
   return {
@@ -8098,7 +8662,7 @@ async function executeBrowserSessionCommand(command, dependencies = {}) {
 }
 
 // src/amaster-runtime-daemon/source-acquisition-invocation.mjs
-import { createHash as createHash10 } from "node:crypto";
+import { createHash as createHash11 } from "node:crypto";
 var SOURCE_ACQUISITION_PUBLIC_TOOLS = Object.freeze([
   "source_open",
   "source_snapshot",
@@ -8135,7 +8699,7 @@ function serializeSourceAcquisitionProfile(profile) {
   const input = Buffer.from(JSON.stringify(profile), "utf8");
   return {
     input,
-    sha256: createHash10("sha256").update(input).digest("hex")
+    sha256: createHash11("sha256").update(input).digest("hex")
   };
 }
 function sourceAcquisitionManagedInputs(options) {
@@ -8171,7 +8735,7 @@ function assertSourceAcquisitionRuntimeAuthority({
 }
 
 // src/amaster-runtime-daemon.mjs
-var CONNECTOR_VERSION = "0.1.1-beta.3";
+var CONNECTOR_VERSION = "0.1.1-beta.5";
 var CONNECTOR_CONTRACT_VERSION = "2026-06-04.v1";
 var SOURCE_ACQUISITION_CAPABILITY = "source_acquisition_v1";
 var SOURCE_ACQUISITION_PROFILE_VERSION = "source_acquisition_v1";
@@ -9468,7 +10032,7 @@ function sourceAcquisitionRuntimeProfile(config, command) {
   if (!companyId || !bindingId || !/^profile_[a-z0-9]{16,64}$/i.test(localOpaqueRef ?? "")) {
     throw new Error("source_acquisition_profile_invalid");
   }
-  const profileName2 = createHash11("sha256").update(`${companyId}\0${bindingId}\0${localOpaqueRef}`).digest("hex");
+  const profileName2 = createHash12("sha256").update(`${companyId}\0${bindingId}\0${localOpaqueRef}`).digest("hex");
   const stateRoot = resolve12(config.browserSessionStateRoot);
   const userDataDir = resolve12(stateRoot, profileName2);
   if (!pathWithin2(userDataDir, stateRoot)) throw new Error("source_acquisition_browser_profile_invalid");
@@ -9665,6 +10229,7 @@ function buildCommandPrompt(command, workspace, materializedAttachments = [], op
     hasGovernedMcp,
     executorKind: options.executorKind,
     managedMcpToolMode: options.managedMcpToolMode,
+    managedMcpToolCatalog: options.managedMcpToolCatalog,
     agentInstructions,
     taskMarkdown,
     attachmentsText,
@@ -9953,6 +10518,14 @@ async function executeModelCallCommand(config, command, signal) {
       sourceWorkspacePath: process.cwd()
     });
     piModelCallProfile = executor.kind === "pi" ? preparePiModelCallProfile(command.commandId, baseEnv) : null;
+    if (piModelCallProfile) {
+      await syncPiExecutorProviderConfig(
+        config,
+        command,
+        piModelCallProfile.env.PI_CODING_AGENT_DIR,
+        resolvePiExecutorProviderConfig(config, command, baseEnv)
+      );
+    }
     execution = await runExecutor(invocation.command, invocation.args, {
       cwd: process.cwd(),
       env: piModelCallProfile?.env ?? baseEnv,
@@ -12197,7 +12770,7 @@ async function materializeIssueAttachments(config, command, workspace) {
     const body = await runtimeApiBuffer(runtimeAuth, contentPath);
     writeFileSync9(targetPath, body);
     const attachmentId = readString(attachment.id);
-    const actualSha256 = createHash11("sha256").update(body).digest("hex");
+    const actualSha256 = createHash12("sha256").update(body).digest("hex");
     const lineageCandidates = lineageCandidatesByAttachmentId.get(attachmentId) ?? [];
     const lineage = selectAttachmentLineage(lineageCandidates, actualSha256);
     if (lineageCandidates.length > 0 && !lineage) {
@@ -12289,7 +12862,7 @@ async function materializeRequiredArtifactInputs(config, command, workspace) {
       throw new Error(`artifact_input_manifest_invalid: entry ${index} contentPath does not match attachmentId`);
     }
     const body = await runtimeApiBuffer(runtimeAuth, contentPath);
-    const actualSha256 = createHash11("sha256").update(body).digest("hex");
+    const actualSha256 = createHash12("sha256").update(body).digest("hex");
     if (body.byteLength !== byteSize || actualSha256 !== sha256) {
       throw new Error(
         `artifact_input_integrity_mismatch: workProductId=${workProductId} expectedBytes=${byteSize} actualBytes=${body.byteLength} expectedSha256=${sha256} actualSha256=${actualSha256}`
@@ -12359,7 +12932,7 @@ function safeCheckpointRelativePath(rawPath) {
   return normalized;
 }
 function hashFileSha256(filePath) {
-  return createHash11("sha256").update(readFileSync11(filePath)).digest("hex");
+  return createHash12("sha256").update(readFileSync11(filePath)).digest("hex");
 }
 async function materializeIssueCheckpoint(config, command, workspace) {
   const checkpointDir = issueCheckpointDir(workspace);
@@ -12545,7 +13118,8 @@ async function executeRunCommand(config, command) {
   await ingestWorkspaceStatus(config, command, cwd);
   const promptCompilation = buildCommandPrompt(command, workspace, materializedAttachments, {
     executorKind: executor.kind,
-    managedMcpToolMode: executor.kind === "pi" && Object.keys(governedMcp).length > 0 ? MANAGED_PI_MCP_TOOL_MODE : null,
+    managedMcpToolMode: executor.kind === "pi" && Object.keys(governedMcp).length > 0 ? readString(governedMcp.mcpToolMode) ?? MANAGED_PI_MCP_TOOL_MODE : null,
+    managedMcpToolCatalog: asRecord(governedMcp.toolCatalog),
     artifactVerifierCommands: config.artifactVerifierCommands,
     workspaceBindings: config.workspaceBindings
   });
@@ -12636,6 +13210,7 @@ async function executeRunCommand(config, command) {
     }
     if (managedMcpProfile) {
       executorEnv = managedMcpProfile.env;
+      if (executor.kind === "pi") invocation.args = applyManagedPiToolAllowlist(invocation.args, managedMcpProfile);
       await ingestLog(config, command, "system", "info", `Attested isolated ${executor.kind} managed MCP profile`, {
         presentationKind: "managed_mcp_attestation",
         ...managedMcpProfile.attestation
@@ -12668,7 +13243,8 @@ async function executeRunCommand(config, command) {
           profileRoot: managedMcpProfile.profileRoot,
           agentDir: managedMcpProfile.env.PI_CODING_AGENT_DIR,
           governedMcpConfigPath: managedMcpProfile.configPath,
-          verifiedAssertion: trustedPiRuntime
+          verifiedAssertion: trustedPiRuntime,
+          skillProfile: readString(asRecord(command.payload).skillProfile)
         });
         executorEnv = {
           ...executorEnv,

package/dist/amaster-runtime.mjs

@@ -5,7 +5,7 @@ import { dirname, join, resolve } from "node:path";
 import { homedir, hostname } from "node:os";
 import { fileURLToPath } from "node:url";
 
-const CONNECTOR_VERSION = "0.1.1-beta.3";
+const CONNECTOR_VERSION = "0.1.1-beta.5";
 
 const CAPABILITIES = [
   "remote_registration",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amaster.ai/employee-runtime-connector",
-  "version": "0.1.1-beta.3",
+  "version": "0.1.1-beta.5",
   "description": "MirrorX runtime connector CLI and daemon",
   "license": "MIT",
   "type": "module",