@amaster.ai/employee-runtime-connector 0.1.1-beta.63 → 0.1.1-beta.64

package/dist/amaster-runtime-daemon.mjs

@@ -2776,6 +2776,90 @@ export default function amasterEffectiveToolsAttestor(pi) {
 `;
 }
 
+// src/amaster-runtime-daemon/pi-role-skills-visibility.mjs
+var MANAGED_PI_ROLE_SKILLS_VISIBILITY_FILENAME = "amaster-role-skills-visibility.js";
+function managedPiRoleSkillsVisibilityExtensionSource(expectedSkills) {
+  return String.raw`import { realpathSync } from "node:fs";
+
+const EXPECTED_SKILLS = ${JSON.stringify(expectedSkills)};
+
+function escapeXml(value) {
+  return String(value)
+    .replace(/&/g, "&")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/\"/g, "&quot;")
+    .replace(/'/g, "&apos;");
+}
+
+function skillXml(skill) {
+  return [
+    "  <skill>",
+    "    <name>" + escapeXml(skill.name) + "</name>",
+    "    <description>" + escapeXml(skill.description) + "</description>",
+    "    <location>" + escapeXml(skill.filePath) + "</location>",
+    "  </skill>",
+  ].join("\n");
+}
+
+function appendPromotedSkills(systemPrompt, skills) {
+  if (skills.length === 0) return systemPrompt;
+  const entries = skills.map(skillXml).join("\n");
+  const closingTag = "</available_skills>";
+  const closingIndex = systemPrompt.lastIndexOf(closingTag);
+  if (closingIndex >= 0) {
+    return systemPrompt.slice(0, closingIndex) + entries + "\n" + systemPrompt.slice(closingIndex);
+  }
+  return systemPrompt + [
+    "",
+    "",
+    "The following skills provide specialized instructions for specific tasks.",
+    "Use the read tool to load a skill's file when the task matches its description.",
+    "When a skill file references a relative path, resolve it against the skill directory (parent of SKILL.md / dirname of the path) and use that absolute path in tool commands.",
+    "",
+    "<available_skills>",
+    entries,
+    closingTag,
+  ].join("\n");
+}
+
+export default function amasterRoleSkillsVisibility(pi) {
+  pi.on("before_agent_start", (event) => {
+    try {
+      if (!Array.isArray(event.systemPromptOptions?.selectedTools)
+        || !event.systemPromptOptions.selectedTools.includes("read")) {
+        throw new Error("role skills require the read tool");
+      }
+      const loadedSkills = Array.isArray(event.systemPromptOptions?.skills)
+        ? event.systemPromptOptions.skills
+        : [];
+      const promotedSkills = [];
+      for (const expected of EXPECTED_SKILLS) {
+        const expectedPath = realpathSync(expected.filePath);
+        const matches = loadedSkills.filter((skill) => {
+          if (skill?.name !== expected.name || typeof skill.filePath !== "string") return false;
+          try {
+            return realpathSync(skill.filePath) === expectedPath;
+          } catch {
+            return false;
+          }
+        });
+        if (matches.length !== 1) {
+          throw new Error("role skill binding mismatch: " + expected.name);
+        }
+        if (matches[0].disableModelInvocation === true) promotedSkills.push(matches[0]);
+      }
+      const systemPrompt = appendPromotedSkills(event.systemPrompt, promotedSkills);
+      return systemPrompt === event.systemPrompt ? undefined : { systemPrompt };
+    } catch {
+      process.stderr.write("pi_role_skills_visibility_rejected\n");
+      process.exit(78);
+    }
+  });
+}
+`;
+}
+
 // src/amaster-runtime-daemon/pi-managed-mcp-profile.mjs
 var MANAGED_PI_MCP_TOOL_MODE = "proxy_only";
 var MANAGED_PI_DIRECT_TYPED_MCP_TOOL_MODE = "direct_typed";
@@ -3425,23 +3509,6 @@ function createManagedPiMcpProfileApi(options = {}) {
     return { home, settingsEnv, protectedValues };
   }
   const SKILL_PROFILE_NAME = /^[a-z0-9-]+$/;
-  const DISABLE_MODEL_INVOCATION_LINE = /^[ \t]*disable-model-invocation:[ \t]*true[ \t]*\r?$/m;
-  function copyTreeNoLinks(source, target) {
-    const stat = lstatSync3(source);
-    if (stat.isSymbolicLink()) throw new Error("pi_managed_mcp_source_symlink_blocked");
-    if (stat.isDirectory()) {
-      mkdirSync3(target, { recursive: true, mode: 448 });
-      chmodSync3(target, 448);
-      for (const entry of readdirSync3(source)) {
-        copyTreeNoLinks(join4(source, entry), join4(target, entry));
-      }
-      return;
-    }
-    if (!stat.isFile()) throw new Error("pi_managed_mcp_source_type_blocked");
-    mkdirSync3(dirname3(target), { recursive: true, mode: 448 });
-    copyFileSync(source, target);
-    chmodSync3(target, 384 | stat.mode & 73);
-  }
   function readSkillProfile(piHome, skillProfile) {
     const agentsRoot = resolve3(piHome, "agents");
     const agentFile = resolve3(agentsRoot, `${skillProfile}.md`);
@@ -3472,9 +3539,7 @@ function createManagedPiMcpProfileApi(options = {}) {
     }
     return profile;
   }
-  function materializeManagedRoleSkills(piHome, skillsDir, skillProfiles) {
-    if (existsSync3(skillsDir)) throw new Error("pi_managed_mcp_role_skills_exists");
-    const enabled = [];
+  function resolveManagedRoleSkills(piHome, skillProfiles) {
     const entriesByName = /* @__PURE__ */ new Map();
     for (const skillProfile of skillProfiles) {
       for (const entry of readSkillProfile(piHome, skillProfile)) {
@@ -3488,16 +3553,14 @@ function createManagedPiMcpProfileApi(options = {}) {
         entriesByName.set(entry.name, entry);
       }
     }
-    for (const entry of entriesByName.values()) {
-      const target = join4(skillsDir, entry.name);
-      copyTreeNoLinks(entry.source, target);
-      const skillFile = join4(target, "SKILL.md");
-      writeFileSync3(skillFile, readFileSync3(skillFile, "utf8").replace(DISABLE_MODEL_INVOCATION_LINE, ""), {
-        mode: 384
-      });
-      enabled.push(entry.name);
-    }
-    return { skillsDir, enabled };
+    const entries = [...entriesByName.values()].map((entry) => ({
+      name: entry.name,
+      filePath: realpathSync2(join4(entry.source, "SKILL.md"))
+    }));
+    return {
+      enabled: entries.map((entry) => entry.name),
+      entries
+    };
   }
   function requestedSkillProfiles(input) {
     return [...new Set(
@@ -3840,16 +3903,14 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
           extensionArgs: [...extensionArgs]
         };
       }
-      const skillArgs = ["--no-approve"];
       let enabledRoleSkills = null;
       const skillProfiles = requestedSkillProfiles(input);
       if (skillProfiles.length > 0) {
-        const roleSkills = materializeManagedRoleSkills(
-          sharedRuntime.home,
-          join4(profileRoot, "role-skills"),
-          skillProfiles
+        const roleSkills = resolveManagedRoleSkills(sharedRuntime.home, skillProfiles);
+        writeProfileExtension(
+          MANAGED_PI_ROLE_SKILLS_VISIBILITY_FILENAME,
+          managedPiRoleSkillsVisibilityExtensionSource(roleSkills.entries)
         );
-        skillArgs.push("--skill", roleSkills.skillsDir);
         enabledRoleSkills = roleSkills.enabled;
       }
       const env = {
@@ -3916,7 +3977,6 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         markerPath,
         env,
         extensionArgs,
-        skillArgs,
         spawnIdentity,
         workspaceMcpConfigPath,
         ...directAttestationInput ? {
@@ -4107,16 +4167,19 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
       };
       writePrivateFile2(configPath, `${JSON.stringify(config, null, 2)}
 `);
+      const extensionArgs = [];
       const skillProfiles = requestedSkillProfiles(input);
-      const skillArgs = ["--no-approve"];
       let enabledRoleSkills = null;
       if (skillProfiles.length > 0) {
-        const roleSkills = materializeManagedRoleSkills(
-          sourcePiHome,
-          join4(profileRoot, "role-skills"),
-          skillProfiles
+        const roleSkills = resolveManagedRoleSkills(sourcePiHome, skillProfiles);
+        const extensionsDir = join4(profileRoot, "extensions");
+        const extensionPath = join4(extensionsDir, MANAGED_PI_ROLE_SKILLS_VISIBILITY_FILENAME);
+        mkdirSync3(extensionsDir, { recursive: true, mode: 448 });
+        writePrivateFile2(
+          extensionPath,
+          managedPiRoleSkillsVisibilityExtensionSource(roleSkills.entries)
         );
-        skillArgs.push("--skill", roleSkills.skillsDir);
+        extensionArgs.push("--extension", extensionPath);
         enabledRoleSkills = roleSkills.enabled;
       }
       const env = {
@@ -4158,7 +4221,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         configPath,
         markerPath,
         env,
-        skillArgs,
+        extensionArgs,
         toolAllowlist: null,
         protectedValues: [.../* @__PURE__ */ new Set([sessionToken, ...seededRuntime.protectedValues])],
         attestation: {
@@ -10438,7 +10501,7 @@ var source_acquisition_compatibility_default = {
 };
 
 // src/amaster-runtime-daemon.mjs
-var CONNECTOR_VERSION = "0.1.1-beta.63";
+var CONNECTOR_VERSION = "0.1.1-beta.64";
 var CONNECTOR_CONTRACT_VERSION = "2026-06-04.v1";
 var SOURCE_ACQUISITION_CAPABILITY = source_acquisition_compatibility_default.profileVersion;
 var SOURCE_ACQUISITION_PROFILE_VERSION = source_acquisition_compatibility_default.profileVersion;
@@ -15181,8 +15244,8 @@ async function executeRunCommand(config, command) {
       if (executor.kind === "pi" && Array.isArray(managedMcpProfile.extensionArgs) && managedMcpProfile.extensionArgs.length > 0) {
         invocation.args = [...invocation.args, ...managedMcpProfile.extensionArgs];
       }
-      if (executor.kind === "pi" && Array.isArray(managedMcpProfile.skillArgs) && managedMcpProfile.skillArgs.length > 0) {
-        invocation.args = [...invocation.args, ...managedMcpProfile.skillArgs];
+      if (executor.kind === "pi") {
+        invocation.args = [...invocation.args, "--no-approve"];
       }
       await ingestLog(config, command, "system", "info", desktopDelegatedRunnerEnabled(config) && executor.kind === "pi" ? "Prepared desktop delegated Pi runtime action bridge" : `Attested isolated ${executor.kind} managed MCP profile`, {
         presentationKind: "managed_mcp_attestation",

package/dist/amaster-runtime.mjs

@@ -6,7 +6,7 @@ import { basename, dirname, join, resolve } from "node:path";
 import { homedir, hostname } from "node:os";
 import { fileURLToPath } from "node:url";
 
-const CONNECTOR_VERSION = "0.1.1-beta.63";
+const CONNECTOR_VERSION = "0.1.1-beta.64";
 
 const CAPABILITIES = [
   "remote_registration",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amaster.ai/employee-runtime-connector",
-  "version": "0.1.1-beta.63",
+  "version": "0.1.1-beta.64",
   "description": "MirrorX runtime connector CLI and daemon",
   "license": "MIT",
   "type": "module",