@amaster.ai/employee-runtime-connector 0.1.1-beta.59 → 0.1.1-beta.60

package/dist/amaster-runtime-daemon.mjs

@@ -1895,6 +1895,7 @@ function reconcileManagedCodexMcpProfiles(rootPath, options = {}) {
 import { createHash as createHash3 } from "node:crypto";
 import {
   chmodSync as chmodSync3,
+  chownSync as chownSync2,
   copyFileSync,
   existsSync as existsSync3,
   lstatSync as lstatSync3,
@@ -2505,6 +2506,25 @@ function stablePiDirectCatalogSetHash(entries) {
   const normalized = entries.map((entry) => ({ name: entry.name, exposedName: entry.exposedName, schemaHash: entry.schemaHash, riskLevel: entry.riskLevel })).sort((left, right) => left.name.localeCompare(right.name));
   return createHash2("sha256").update(stablePiJson(normalized)).digest("hex");
 }
+function normalizePiManagedMcpCacheForSemanticHash(value) {
+  const parsed = Buffer.isBuffer(value) || typeof value === "string" ? JSON.parse(value.toString("utf8")) : JSON.parse(JSON.stringify(value));
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("managed MCP cache root is invalid");
+  }
+  if (!parsed.servers || typeof parsed.servers !== "object" || Array.isArray(parsed.servers)) {
+    throw new Error("managed MCP cache servers are invalid");
+  }
+  for (const entry of Object.values(parsed.servers)) {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) continue;
+    delete entry.cachedAt;
+    if (Array.isArray(entry.prompts) && entry.prompts.length === 0) delete entry.prompts;
+  }
+  return parsed;
+}
+function stablePiManagedMcpCacheSemanticHash(value) {
+  const parsed = normalizePiManagedMcpCacheForSemanticHash(value);
+  return createHash2("sha256").update(stablePiJson(parsed)).digest("hex");
+}
 function managedPiEffectiveToolsAttestorExtensionSource() {
   return String.raw`import { createHash } from "node:crypto";
 import { readFileSync, writeFileSync } from "node:fs";
@@ -2531,10 +2551,17 @@ function sha256(value) {
   return createHash("sha256").update(value).digest("hex");
 }
 
+${normalizePiManagedMcpCacheForSemanticHash.toString()}
+
 function schemaHash(value) {
   return sha256(stableJson(record(value)));
 }
 
+function cacheSemanticHash(value) {
+  const parsed = normalizePiManagedMcpCacheForSemanticHash(value);
+  return sha256(stableJson(parsed));
+}
+
 function toolSetHash(entries) {
   return sha256(stableJson(entries
     .map((entry) => ({ name: entry.name, schemaHash: entry.schemaHash }))
@@ -2591,8 +2618,22 @@ export default function amasterEffectiveToolsAttestor(pi) {
       if (sourceDigest !== manifest.attestorSourceSha256) throw new Error("attestor source digest mismatch");
       const configDigest = sha256(readFileSync(configPath));
       if (configDigest !== manifest.configSha256) throw new Error("managed MCP config digest mismatch");
-      const cacheDigest = sha256(readFileSync(cachePath));
-      if (cacheDigest !== manifest.cacheSha256) throw new Error("managed MCP cache digest mismatch");
+      const cacheBytes = readFileSync(cachePath);
+      const cacheDigest = sha256(cacheBytes);
+      let cacheSemanticMatches = false;
+      if (cacheDigest !== manifest.cacheSha256) {
+        try {
+          cacheSemanticMatches = cacheSemanticHash(cacheBytes) === manifest.cacheSemanticHash;
+        } catch {
+          cacheSemanticMatches = false;
+        }
+      }
+      const cacheAttestation = cacheDigest === manifest.cacheSha256
+        ? "exact"
+        : cacheSemanticMatches
+          ? "semantic"
+          : null;
+      if (!cacheAttestation) throw new Error("managed MCP cache digest mismatch");
 
       const expectedEntries = Array.isArray(manifest.entries) ? manifest.entries : [];
       if (expectedEntries.length === 0) throw new Error("effective tool manifest is empty");
@@ -2659,6 +2700,7 @@ export default function amasterEffectiveToolsAttestor(pi) {
         attestorSourceSha256: sourceDigest,
         configSha256: configDigest,
         cacheSha256: cacheDigest,
+        cacheAttestation,
         strictInputValidatorSelfTest: true,
         modelInvocationStarted: false,
         attestedAt: new Date().toISOString(),
@@ -2713,6 +2755,8 @@ function applyManagedPiToolAllowlist(args, profile) {
 }
 function createManagedPiMcpProfileApi(options = {}) {
   const spawnSyncImpl = typeof options.spawnSync === "function" ? options.spawnSync : spawnSync2;
+  const chownSyncImpl = typeof options.chownSync === "function" ? options.chownSync : chownSync2;
+  const ownershipStatSyncImpl = typeof options.ownershipStatSync === "function" ? options.ownershipStatSync : statSync2;
   const nowImpl = typeof options.now === "function" ? options.now : Date.now;
   const SUPPORTED_SCHEMA_VERSION2 = "amaster.governed-mcp.v1";
   const SUPPORTED_SERVER_NAME2 = "amaster";
@@ -3562,9 +3606,11 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
     if (result3.error) {
       const code = typeof result3.error.code === "string" ? result3.error.code : "UNKNOWN";
       const receiptDiagnostic = inspectEffectiveToolsProbeReceipt(input.receiptPath);
-      throw new Error(
+      const error = new Error(
         `pi_managed_mcp_effective_tools_failed: probe error=${code} elapsedMs=${elapsedMs} timeoutMs=${PI_EFFECTIVE_TOOLS_ATTESTATION_TIMEOUT_MS} receiptPhase=${receiptDiagnostic.phase}`
       );
+      if (code === "ETIMEDOUT") error.code = "pi_managed_mcp_probe_timeout";
+      throw error;
     }
     if (result3.status !== 0) {
       const receiptDiagnostic = inspectEffectiveToolsProbeReceipt(input.receiptPath);
@@ -3734,7 +3780,8 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
           proxyMode: "forbidden",
           attestorSourceSha256,
           configSha256: sha2562(readFileSync3(configPath)),
-          cacheSha256
+          cacheSha256,
+          cacheSemanticHash: stablePiManagedMcpCacheSemanticHash(readFileSync3(cachePath))
         };
         writePrivateFile2(manifestPath, `${JSON.stringify(manifest, null, 2)}
 `);
@@ -3743,6 +3790,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
           manifestPath,
           receiptPath,
           cacheSha256,
+          cacheContentsBase64: Buffer.from(readFileSync3(cachePath)).toString("base64"),
           configPath,
           configSha256: sha2562(readFileSync3(configPath)),
           attestorSourceSha256,
@@ -3796,6 +3844,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         directAttestationInput,
         spawnIdentity
       ) : {};
+      const runExitClosureCacheOwnership = directAttestationInput ? ownershipStatSyncImpl(directAttestationInput.cachePath) : null;
       const attestationFacts = {
         connectorVersion: nonEmpty2(input.connectorVersion, "connectorVersion"),
         executorKind: "pi",
@@ -3829,6 +3878,22 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         skillArgs,
         spawnIdentity,
         workspaceMcpConfigPath,
+        ...directAttestationInput ? {
+          runExitClosureBaseline: {
+            schemaVersion: "amaster.pi-run-exit-closure-baseline.v1",
+            owner,
+            profileRoot,
+            cachePath: directAttestationInput.cachePath,
+            cacheSha256: directAttestationInput.cacheSha256,
+            cacheContentsBase64: directAttestationInput.cacheContentsBase64,
+            cacheOwnership: runExitClosureCacheOwnership ? { uid: runExitClosureCacheOwnership.uid, gid: runExitClosureCacheOwnership.gid } : null,
+            manifestPath: directAttestationInput.manifestPath,
+            manifestSha256: sha2562(readFileSync3(directAttestationInput.manifestPath)),
+            configPath: directAttestationInput.configPath,
+            configSha256: directAttestationInput.configSha256,
+            receiptPath: directAttestationInput.receiptPath
+          }
+        } : {},
         // Only narrowed specialized catalogs (diagnosis/source-acquisition) pin
         // the run to the governed tool set. The full catalog is additive: an
         // ordinary run keeps Pi's native tools plus the direct governed tools.
@@ -3853,6 +3918,97 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
       throw error;
     }
   }
+  function restoreManagedPiRunExitClosureBaseline2(input, expectedOwner) {
+    if (!input) return { status: "not_required" };
+    const baseline = record6(input);
+    if (baseline.schemaVersion !== "amaster.pi-run-exit-closure-baseline.v1") {
+      throw new Error("pi_run_exit_closure_baseline_invalid: unsupported schema version");
+    }
+    const owner = record6(baseline.owner);
+    if (owner.commandId !== expectedOwner?.commandId || owner.runId !== expectedOwner?.runId) {
+      throw new Error("pi_run_exit_closure_baseline_owner_mismatch");
+    }
+    const profileRoot = resolve3(nonEmpty2(baseline.profileRoot, "runExitClosureBaseline.profileRoot"));
+    const cachePath = resolve3(nonEmpty2(baseline.cachePath, "runExitClosureBaseline.cachePath"));
+    const manifestPath = resolve3(nonEmpty2(baseline.manifestPath, "runExitClosureBaseline.manifestPath"));
+    const configPath = resolve3(nonEmpty2(baseline.configPath, "runExitClosureBaseline.configPath"));
+    const receiptPath = resolve3(nonEmpty2(baseline.receiptPath, "runExitClosureBaseline.receiptPath"));
+    for (const path of [cachePath, manifestPath, receiptPath]) {
+      if (!within2(path, profileRoot)) throw new Error("pi_run_exit_closure_baseline_path_mismatch");
+    }
+    for (const path of [cachePath, manifestPath, configPath, receiptPath]) {
+      if (existsSync3(path)) {
+        const stat = lstatSync3(path);
+        if (!stat.isFile() || stat.isSymbolicLink()) {
+          throw new Error(`pi_run_exit_closure_baseline_unsafe: ${path}`);
+        }
+      }
+    }
+    const cacheContentsBase64 = nonEmpty2(
+      baseline.cacheContentsBase64,
+      "runExitClosureBaseline.cacheContentsBase64"
+    );
+    const cacheContents = Buffer.from(cacheContentsBase64, "base64");
+    const cacheSha256 = nonEmpty2(baseline.cacheSha256, "runExitClosureBaseline.cacheSha256");
+    if (sha2562(cacheContents) !== cacheSha256) {
+      throw new Error("pi_run_exit_closure_baseline_cache_digest_mismatch");
+    }
+    const baselineCacheOwnership = record6(baseline.cacheOwnership);
+    const cacheOwnership = Number.isSafeInteger(baselineCacheOwnership.uid) && baselineCacheOwnership.uid >= 0 && Number.isSafeInteger(baselineCacheOwnership.gid) && baselineCacheOwnership.gid >= 0 ? { uid: baselineCacheOwnership.uid, gid: baselineCacheOwnership.gid } : existsSync3(cachePath) ? ownershipStatSyncImpl(cachePath) : null;
+    if (!cacheOwnership) {
+      throw new Error("pi_run_exit_closure_baseline_cache_owner_missing");
+    }
+    if (sha2562(readFileSync3(manifestPath)) !== nonEmpty2(baseline.manifestSha256, "runExitClosureBaseline.manifestSha256")) {
+      throw new Error("pi_run_exit_closure_baseline_manifest_drift");
+    }
+    if (sha2562(readFileSync3(configPath)) !== nonEmpty2(baseline.configSha256, "runExitClosureBaseline.configSha256")) {
+      throw new Error("pi_run_exit_closure_baseline_config_drift");
+    }
+    if (existsSync3(receiptPath)) rmSync2(receiptPath);
+    writeOwnedFileAtomic(cachePath, cacheContents);
+    const replacedCacheStat = ownershipStatSyncImpl(cachePath);
+    if (replacedCacheStat.uid !== cacheOwnership.uid || replacedCacheStat.gid !== cacheOwnership.gid) {
+      chownSyncImpl(cachePath, cacheOwnership.uid, cacheOwnership.gid);
+    }
+    if (sha2562(readFileSync3(cachePath)) !== cacheSha256) {
+      throw new Error("pi_run_exit_closure_baseline_restore_failed");
+    }
+    const restoredCacheStat = ownershipStatSyncImpl(cachePath);
+    if (restoredCacheStat.uid !== cacheOwnership.uid || restoredCacheStat.gid !== cacheOwnership.gid) {
+      throw new Error("pi_run_exit_closure_baseline_owner_restore_failed");
+    }
+    return { status: "restored", cacheSha256 };
+  }
+  function inspectManagedPiRunExitClosureAttestation2(input, expectedOwner) {
+    if (!input) return { status: "not_required" };
+    const baseline = record6(input);
+    const owner = record6(baseline.owner);
+    if (owner.commandId !== expectedOwner?.commandId || owner.runId !== expectedOwner?.runId) {
+      throw new Error("pi_run_exit_closure_baseline_owner_mismatch");
+    }
+    const profileRoot = resolve3(nonEmpty2(baseline.profileRoot, "runExitClosureBaseline.profileRoot"));
+    const receiptPath = resolve3(nonEmpty2(baseline.receiptPath, "runExitClosureBaseline.receiptPath"));
+    if (!within2(receiptPath, profileRoot)) throw new Error("pi_run_exit_closure_baseline_path_mismatch");
+    if (!existsSync3(receiptPath)) return { status: "missing" };
+    const stat = lstatSync3(receiptPath);
+    if (!stat.isFile() || stat.isSymbolicLink()) {
+      throw new Error(`pi_run_exit_closure_baseline_unsafe: ${receiptPath}`);
+    }
+    try {
+      const receipt = record6(JSON.parse(readFileSync3(receiptPath, "utf8")));
+      return {
+        status: nonEmpty2(receipt.status, "effectiveToolsReceipt.status"),
+        ...typeof receipt.mode === "string" ? { mode: receipt.mode } : {},
+        ...typeof receipt.error === "string" ? { error: receipt.error.slice(0, 1e3) } : {},
+        ...typeof receipt.cacheSha256 === "string" ? { cacheSha256: receipt.cacheSha256 } : {}
+      };
+    } catch (error) {
+      return {
+        status: "invalid",
+        error: (error instanceof Error ? error.message : String(error)).slice(0, 1e3)
+      };
+    }
+  }
   function prepareDelegatedPiMcpProfile2(input) {
     assertInvocationIsolation2(input);
     const { gateway, gatewayUrl, sessionToken, headers, runId, mcpToolMode, directCatalog } = validateAuthority2(input);
@@ -4157,11 +4313,13 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
       failures
     };
   }
-  return { prepareManagedPiMcpProfile: prepareManagedPiMcpProfile2, prepareDelegatedPiMcpProfile: prepareDelegatedPiMcpProfile2, preserveManagedPiSessionRollout: preserveManagedPiSessionRollout2, cleanupManagedPiMcpProfile: cleanupManagedPiMcpProfile2, cleanupDelegatedPiMcpProfile: cleanupDelegatedPiMcpProfile2, reconcileManagedPiMcpProfiles: reconcileManagedPiMcpProfiles2 };
+  return { prepareManagedPiMcpProfile: prepareManagedPiMcpProfile2, prepareDelegatedPiMcpProfile: prepareDelegatedPiMcpProfile2, inspectManagedPiRunExitClosureAttestation: inspectManagedPiRunExitClosureAttestation2, restoreManagedPiRunExitClosureBaseline: restoreManagedPiRunExitClosureBaseline2, preserveManagedPiSessionRollout: preserveManagedPiSessionRollout2, cleanupManagedPiMcpProfile: cleanupManagedPiMcpProfile2, cleanupDelegatedPiMcpProfile: cleanupDelegatedPiMcpProfile2, reconcileManagedPiMcpProfiles: reconcileManagedPiMcpProfiles2 };
 }
 var piManagedMcpProfileApi = createManagedPiMcpProfileApi();
 var prepareManagedPiMcpProfile = piManagedMcpProfileApi.prepareManagedPiMcpProfile;
 var prepareDelegatedPiMcpProfile = piManagedMcpProfileApi.prepareDelegatedPiMcpProfile;
+var inspectManagedPiRunExitClosureAttestation = piManagedMcpProfileApi.inspectManagedPiRunExitClosureAttestation;
+var restoreManagedPiRunExitClosureBaseline = piManagedMcpProfileApi.restoreManagedPiRunExitClosureBaseline;
 var preserveManagedPiSessionRollout = piManagedMcpProfileApi.preserveManagedPiSessionRollout;
 var cleanupManagedPiMcpProfile = piManagedMcpProfileApi.cleanupManagedPiMcpProfile;
 var cleanupDelegatedPiMcpProfile = piManagedMcpProfileApi.cleanupDelegatedPiMcpProfile;
@@ -5818,6 +5976,7 @@ function runtimeAuthorizationText(context, mode, { suppressOrdinaryCompletionCon
   ].join(" ") : "";
   const businessOutcomeTerminalContract = !suppressOrdinaryCompletionContract && businessOutcome.mode === "required" ? [
     delivery.mode === "required" ? "When every acceptance criterion is satisfied and the exact current Delivery Manifest is ready, record the final execution disposition with update_parent status in_progress and a concise evidence summary, then end the run successfully without creating a final review interaction." : "When every acceptance criterion is satisfied, record the final execution disposition with update_parent status in_progress and a concise evidence summary, then end the run successfully without creating a final review interaction.",
+    "The exact runtime_action_in_progress_server_owned rejection is the expected fail-before-effect receipt for this Server-owned handoff. After receiving it, do not retry update_parent with done or another status; end the run successfully so the Server terminal reconciler can take over.",
     evidenceAutoAcceptance ? delivery.mode === "required" ? "Only after the run and command succeed does the Server validate the exact current Delivery Manifest and terminal Outcome evidence, auto-accept the Outcome, and finalize the issue as done atomically. This evidence-auto path does not create a Board review; report the actual Server-owned terminal disposition without implying a handoff." : "Only after the run and command succeed does the Server validate the terminal Outcome evidence, auto-accept the Outcome, and finalize the issue as done atomically. This evidence-auto path does not create a Board review; report the actual Server-owned terminal disposition without implying a handoff." : delivery.mode === "required" ? "Only after the run and command succeed does the Server bind the exact current Delivery Manifest and terminal Outcome evidence, create the formal Board review before generic continuation handoff is evaluated, and move the issue to in_review. Board acceptance then finalizes the issue as done atomically." : "Only after the run and command succeed does the Server bind the terminal Outcome evidence, create the formal Board review before generic continuation handoff is evaluated, and move the issue to in_review. Board acceptance then finalizes the issue as done atomically."
   ].join(" ") : "";
   const organizationCapabilityAllowed = asRecord(envelope.organizationCapability).allowed === true;
@@ -9226,12 +9385,12 @@ import { existsSync as existsSync7, mkdirSync as mkdirSync6, realpathSync as rea
 import { basename as basename4, join as join8, isAbsolute as isAbsolute4, relative as relative4, resolve as resolve5 } from "node:path";
 
 // src/amaster-runtime-daemon/workspace-manifest.mjs
-import { chownSync as chownSync2, existsSync as existsSync6, readFileSync as readFileSync8, renameSync as renameSync5, rmSync as rmSync4, statSync as statSync3, writeFileSync as writeFileSync6 } from "node:fs";
+import { chownSync as chownSync3, existsSync as existsSync6, readFileSync as readFileSync8, renameSync as renameSync5, rmSync as rmSync4, statSync as statSync3, writeFileSync as writeFileSync6 } from "node:fs";
 import { basename as basename3, dirname as dirname5, join as join7 } from "node:path";
 var WORKSPACE_MANIFEST_FILENAME = ".amaster-runtime.json";
 function syncManifestDirOwnership(manifestPath, deps = {}) {
   const stat = deps.statSync ?? statSync3;
-  const chown = deps.chownSync ?? chownSync2;
+  const chown = deps.chownSync ?? chownSync3;
   const geteuid = deps.geteuid ?? (typeof process.geteuid === "function" ? process.geteuid.bind(process) : () => null);
   try {
     if (geteuid() !== 0) return false;
@@ -10238,7 +10397,7 @@ var source_acquisition_compatibility_default = {
 };
 
 // src/amaster-runtime-daemon.mjs
-var CONNECTOR_VERSION = "0.1.1-beta.59";
+var CONNECTOR_VERSION = "0.1.1-beta.60";
 var CONNECTOR_CONTRACT_VERSION = "2026-06-04.v1";
 var SOURCE_ACQUISITION_CAPABILITY = source_acquisition_compatibility_default.profileVersion;
 var SOURCE_ACQUISITION_PROFILE_VERSION = source_acquisition_compatibility_default.profileVersion;
@@ -13422,10 +13581,15 @@ async function executeRunExitClosureTurn(config, inputState, options = {}) {
     protectedValues
   );
   try {
+    const managedMcpClosureBaseline = executorKind === "pi" ? restoreManagedPiRunExitClosureBaseline(
+      executionConfig.runExitClosureBaseline,
+      { commandId: state.commandId, runId: commandRunId(command) }
+    ) : { status: "not_required" };
     await ingestLog(config, command, "system", "info", "Starting bounded run-exit disposition closure turn", {
       presentationKind: "run_exit_disposition_closure",
       commandId: state.commandId,
-      closureAttempt: 1
+      closureAttempt: 1,
+      managedMcpClosureBaselineStatus: managedMcpClosureBaseline.status
     });
     let execution;
     try {
@@ -13473,8 +13637,14 @@ async function executeRunExitClosureTurn(config, inputState, options = {}) {
       allowMissingAssistantOutput: false
     }) : null;
     const parsedError = hasOutputFlood ? "Run-exit closure output exceeded the configured limit" : hasMemoryLimit ? "Run-exit closure exceeded the configured memory limit" : execution.timedOut ? "Run-exit closure timed out" : execution.spawnError ?? piInvalidOutputError ?? parsedForValidation.errorMessage ?? ((execution.exitCode ?? 0) === 0 || cleanupDisposition ? null : `Run-exit closure exited with code ${execution.exitCode ?? "unknown"}`);
-    const succeeded = execution.cancelled !== true && !hasOutputFlood && !hasMemoryLimit && (execution.exitCode === 0 || completionOutputStopped || Boolean(cleanupDisposition)) && !execution.timedOut && !execution.spawnError && !parsedError;
-    await ingestLog(config, command, "system", succeeded ? "info" : "error", succeeded ? "Run-exit disposition closure turn completed" : `Run-exit disposition closure turn failed: ${parsedError}`, {
+    const effectiveToolsAttestation = executorKind === "pi" ? inspectManagedPiRunExitClosureAttestation(
+      executionConfig.runExitClosureBaseline,
+      { commandId: state.commandId, runId: commandRunId(command) }
+    ) : { status: "not_required" };
+    const effectiveToolsError = executorKind === "pi" && executionConfig.runExitClosureBaseline && effectiveToolsAttestation.status !== "attested" ? `Run-exit closure effective-tools attestation ${effectiveToolsAttestation.status}` : null;
+    const closureError = parsedError ?? effectiveToolsError;
+    const succeeded = execution.cancelled !== true && !hasOutputFlood && !hasMemoryLimit && (execution.exitCode === 0 || completionOutputStopped || Boolean(cleanupDisposition)) && !execution.timedOut && !execution.spawnError && !closureError;
+    await ingestLog(config, command, "system", succeeded ? "info" : "error", succeeded ? "Run-exit disposition closure turn completed" : `Run-exit disposition closure turn failed: ${closureError}`, {
       presentationKind: "run_exit_disposition_closure",
       closureAttempt: 1,
       succeeded,
@@ -13483,7 +13653,7 @@ async function executeRunExitClosureTurn(config, inputState, options = {}) {
     });
     return {
       succeeded,
-      error: parsedError,
+      error: closureError,
       usage: asRecord(parsed.usage),
       audit: {
         schemaVersion: "run-exit-disposition-closure-v1",
@@ -13495,12 +13665,13 @@ async function executeRunExitClosureTurn(config, inputState, options = {}) {
         summary: truncateText(readString(parsed.summary) ?? "", 2e3),
         outputTelemetry,
         cleanupDisposition,
+        effectiveToolsAttestation,
         toolResults: mcpToolResults.slice(0, 10).map((result3) => ({
           status: readString(result3.status),
           toolName: readString(result3.toolName) ?? readString(result3.name) ?? readString(asRecord(result3.runtimeAction).toolName),
           invocationId: readString(result3.invocationId)
         })),
-        ...parsedError ? { error: truncateText(parsedError, 1e3) } : {}
+        ...closureError ? { error: truncateText(closureError, 1e3) } : {}
       }
     };
   } finally {
@@ -15481,7 +15652,8 @@ async function executeRunCommand(config, command) {
             maxOutputBytes: config.executorMaxOutputBytes,
             maxRssMb: config.executorMaxRssMb,
             ...piExecutorIdentity ? { spawnIdentity: piExecutorIdentity } : {},
-            ...sourceProfile ? { sourceProfileInput: sourceProfile.input } : {}
+            ...sourceProfile ? { sourceProfileInput: sourceProfile.input } : {},
+            ...managedMcpProfile?.runExitClosureBaseline ? { runExitClosureBaseline: managedMcpProfile.runExitClosureBaseline } : {}
           }
         },
         completionRequest: {

package/dist/amaster-runtime.mjs

@@ -6,7 +6,7 @@ import { basename, dirname, join, resolve } from "node:path";
 import { homedir, hostname } from "node:os";
 import { fileURLToPath } from "node:url";
 
-const CONNECTOR_VERSION = "0.1.1-beta.59";
+const CONNECTOR_VERSION = "0.1.1-beta.60";
 
 const CAPABILITIES = [
   "remote_registration",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amaster.ai/employee-runtime-connector",
-  "version": "0.1.1-beta.59",
+  "version": "0.1.1-beta.60",
   "description": "MirrorX runtime connector CLI and daemon",
   "license": "MIT",
   "type": "module",