@amaster.ai/employee-runtime-connector 0.1.1-beta.67 → 0.1.1-beta.69

package/dist/amaster-runtime-daemon.mjs

@@ -2,10 +2,11 @@
 // MirrorX runtime connector daemon bundle.
 
 // src/amaster-runtime-daemon.mjs
-import { createHash as createHash12 } from "node:crypto";
-import { chmodSync as chmodSync4, copyFileSync as copyFileSync2, existsSync as existsSync11, lstatSync as lstatSync5, mkdirSync as mkdirSync7, mkdtempSync, readFileSync as readFileSync10, readdirSync as readdirSync9, realpathSync as realpathSync5, renameSync as renameSync6, rmSync as rmSync5, statSync as statSync8, symlinkSync as symlinkSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync7 } from "node:fs";
+import { createHash as createHash13 } from "node:crypto";
+import { createRequire } from "node:module";
+import { chmodSync as chmodSync5, copyFileSync as copyFileSync2, existsSync as existsSync12, lstatSync as lstatSync6, mkdirSync as mkdirSync8, mkdtempSync, readFileSync as readFileSync11, readdirSync as readdirSync9, realpathSync as realpathSync5, renameSync as renameSync6, rmSync as rmSync6, statSync as statSync9, symlinkSync as symlinkSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync8 } from "node:fs";
 import { arch as arch3, homedir as homedir3, hostname as hostname2, platform as platform3, tmpdir } from "node:os";
-import { basename as basename6, delimiter as delimiter3, dirname as dirname7, extname as extname2, isAbsolute as isAbsolute6, join as join12, relative as relative6, resolve as resolve9 } from "node:path";
+import { basename as basename6, delimiter as delimiter3, dirname as dirname8, extname as extname2, isAbsolute as isAbsolute6, join as join13, relative as relative7, resolve as resolve10 } from "node:path";
 import { spawn, spawnSync as spawnSync5 } from "node:child_process";
 
 // src/amaster-runtime-daemon/common.mjs
@@ -3671,6 +3672,18 @@ function createManagedPiMcpProfileApi(options = {}) {
     const env = {
       PI_BROWSER_USE_RUNTIME_READ_POLICY: "required"
     };
+    if (sourceAcquisition?.profile?.transport?.browserMode === "existing") {
+      const userDataDir = sourceAcquisition.userDataDir;
+      const leaseId = sourceAcquisition.profile?.access?.browserLeaseId;
+      if (!isAbsolute2(userDataDir ?? "") || typeof leaseId !== "string" || !leaseId) {
+        throw new Error("source_acquisition_browser_profile_invalid");
+      }
+      return {
+        ...env,
+        PI_BROWSER_USE_EXISTING_PROFILE_DIR: userDataDir,
+        PI_BROWSER_USE_EXISTING_PROFILE_LEASE_ID: leaseId
+      };
+    }
     if (sourceAcquisition?.profile?.transport?.browserMode !== "isolated") return env;
     const executable = typeof baseEnv?.AMASTER_BROWSER_EXECUTABLE_PATH === "string" ? baseEnv.AMASTER_BROWSER_EXECUTABLE_PATH.trim() : "";
     if (!executable || !isAbsolute2(executable)) {
@@ -4397,14 +4410,14 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
       throw error;
     }
   }
-  function restoreManagedPiRunExitClosureBaseline2(input, expectedOwner) {
+  function restoreManagedPiRunExitClosureBaseline2(input, expectedOwner2) {
     if (!input) return { status: "not_required" };
     const baseline = record6(input);
     if (baseline.schemaVersion !== "amaster.pi-run-exit-closure-baseline.v1") {
       throw new Error("pi_run_exit_closure_baseline_invalid: unsupported schema version");
     }
     const owner = record6(baseline.owner);
-    if (owner.commandId !== expectedOwner?.commandId || owner.runId !== expectedOwner?.runId) {
+    if (owner.commandId !== expectedOwner2?.commandId || owner.runId !== expectedOwner2?.runId) {
       throw new Error("pi_run_exit_closure_baseline_owner_mismatch");
     }
     const profileRoot = resolve3(nonEmpty2(baseline.profileRoot, "runExitClosureBaseline.profileRoot"));
@@ -4458,11 +4471,11 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
     }
     return { status: "restored", cacheSha256 };
   }
-  function inspectManagedPiRunExitClosureAttestation2(input, expectedOwner) {
+  function inspectManagedPiRunExitClosureAttestation2(input, expectedOwner2) {
     if (!input) return { status: "not_required" };
     const baseline = record6(input);
     const owner = record6(baseline.owner);
-    if (owner.commandId !== expectedOwner?.commandId || owner.runId !== expectedOwner?.runId) {
+    if (owner.commandId !== expectedOwner2?.commandId || owner.runId !== expectedOwner2?.runId) {
       throw new Error("pi_run_exit_closure_baseline_owner_mismatch");
     }
     const profileRoot = resolve3(nonEmpty2(baseline.profileRoot, "runExitClosureBaseline.profileRoot"));
@@ -4570,9 +4583,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         PI_CODING_AGENT_SESSION_DIR: sessionsRoot,
         "AMASTER-CLI_CODING_AGENT_SESSION_DIR": sessionsRoot,
         TMPDIR: tmp,
-        ...input.sourceAcquisition ? {
-          PI_BROWSER_USE_RUNTIME_READ_POLICY: "required"
-        } : {}
+        ...input.sourceAcquisition ? sourceAcquisitionBrowserEnvironment(input.sourceAcquisition, input.baseEnv) : {}
       };
       const attestationFacts = {
         connectorVersion: nonEmpty2(input.connectorVersion, "connectorVersion"),
@@ -9501,7 +9512,7 @@ async function postRuntimeConnectorJsonWithRetry(config, path, payload, options
     } catch (error) {
       lastError = error;
       if (attempt >= maxAttempts || !retryableRuntimeConnectorPost(error)) throw error;
-      if (delayMs > 0) await new Promise((resolve10) => setTimeout(resolve10, delayMs));
+      if (delayMs > 0) await new Promise((resolve11) => setTimeout(resolve11, delayMs));
     }
   }
   throw lastError;
@@ -10757,7 +10768,7 @@ function parseLocator(value, exactOrigin = false) {
   } catch {
     return null;
   }
-  if (url.protocol !== "https:" && url.protocol !== "http:" || url.username || url.password) return null;
+  if (url.protocol !== "https:" || url.username || url.password) return null;
   if (exactOrigin && (value !== url.origin || url.pathname !== "/" || url.search || url.hash)) {
     return null;
   }
@@ -10863,6 +10874,301 @@ async function executeBrowserSessionCommand(command, dependencies = {}) {
   }
 }
 
+// src/amaster-runtime-daemon/browser-session-broker.mjs
+import { createHash as createHash12 } from "node:crypto";
+import {
+  chmodSync as chmodSync4,
+  existsSync as existsSync11,
+  lstatSync as lstatSync5,
+  mkdirSync as mkdirSync7,
+  readFileSync as readFileSync10,
+  rmSync as rmSync5,
+  statSync as statSync8,
+  writeFileSync as writeFileSync7
+} from "node:fs";
+import { dirname as dirname7, join as join12, relative as relative6, resolve as resolve9 } from "node:path";
+var MARKER_NAME = ".amaster-browser-session.json";
+var HUMAN_LEASE_HARD_CAP_MS = 2 * 60 * 60 * 1e3;
+function brokerError(code) {
+  return Object.assign(new Error(code), { code });
+}
+function pathWithin3(candidate, root) {
+  const value = relative6(root, candidate);
+  return value === "" || !value.startsWith("..") && !value.startsWith("/");
+}
+function ensureExecutable(path) {
+  if (!path) return false;
+  try {
+    const stat = statSync8(path);
+    return stat.isFile() && (stat.mode & 73) !== 0;
+  } catch {
+    return false;
+  }
+}
+function ensurePrivateRoot(stateRoot) {
+  const root = resolve9(stateRoot);
+  if (existsSync11(root) && lstatSync5(root).isSymbolicLink()) {
+    throw brokerError("browser_session_profile_root_symlink");
+  }
+  mkdirSync7(root, { recursive: true, mode: 448 });
+  chmodSync4(root, 448);
+  if (lstatSync5(root).isSymbolicLink()) {
+    throw brokerError("browser_session_profile_root_symlink");
+  }
+  return root;
+}
+function profileName(payload) {
+  return createHash12("sha256").update(`${payload.companyId}\0${payload.bindingId}\0${payload.localOpaqueRef}`).digest("hex");
+}
+function expectedOwner(payload) {
+  return {
+    version: 1,
+    companyId: payload.companyId,
+    bindingId: payload.bindingId,
+    localOpaqueRef: payload.localOpaqueRef,
+    provider: payload.provider,
+    origin: payload.origin
+  };
+}
+function exactProfile(stateRoot, payload, { create = false } = {}) {
+  const root = ensurePrivateRoot(stateRoot);
+  const profilePath = resolve9(root, profileName(payload));
+  if (!pathWithin3(profilePath, root) || dirname7(profilePath) !== root) {
+    throw brokerError("browser_session_profile_path_invalid");
+  }
+  if (existsSync11(profilePath) && lstatSync5(profilePath).isSymbolicLink()) {
+    throw brokerError("browser_session_profile_symlink");
+  }
+  if (!existsSync11(profilePath)) {
+    if (!create) throw brokerError("browser_session_profile_not_found");
+    mkdirSync7(profilePath, { mode: 448 });
+    chmodSync4(profilePath, 448);
+    writeFileSync7(
+      join12(profilePath, MARKER_NAME),
+      `${JSON.stringify(expectedOwner(payload))}
+`,
+      { encoding: "utf8", mode: 384, flag: "wx" }
+    );
+  }
+  if (!lstatSync5(profilePath).isDirectory() || lstatSync5(profilePath).isSymbolicLink()) {
+    throw brokerError("browser_session_profile_path_invalid");
+  }
+  let owner;
+  try {
+    owner = JSON.parse(readFileSync10(join12(profilePath, MARKER_NAME), "utf8"));
+  } catch {
+    throw brokerError("browser_session_profile_owner_invalid");
+  }
+  if (JSON.stringify(owner) !== JSON.stringify(expectedOwner(payload))) {
+    throw brokerError("browser_session_profile_owner_mismatch");
+  }
+  return profilePath;
+}
+function validateHumanLease(payload, now) {
+  const expiry = Date.parse(payload.leaseExpiresAt);
+  const nowMs = now().getTime();
+  if (!Number.isFinite(expiry) || expiry <= nowMs) {
+    throw brokerError("browser_session_lease_expired");
+  }
+  if (expiry > nowMs + HUMAN_LEASE_HARD_CAP_MS) {
+    throw brokerError("browser_session_lease_hard_cap_exceeded");
+  }
+}
+function validateHttpsLocator(payload) {
+  let locator;
+  let origin;
+  try {
+    locator = new URL(payload.locator);
+    origin = new URL(payload.origin);
+  } catch {
+    throw brokerError("browser_session_locator_invalid");
+  }
+  if (locator.protocol !== "https:" || origin.protocol !== "https:" || locator.username || locator.password || origin.username || origin.password || payload.origin !== origin.origin || locator.origin !== origin.origin) {
+    throw brokerError("browser_session_locator_invalid");
+  }
+}
+function browserSessionBrokerReadiness({
+  stateRoot,
+  browserExecutable,
+  runtimeAvailable = true,
+  displayAvailable = process.platform !== "linux" || Boolean(process.env.DISPLAY || process.env.WAYLAND_DISPLAY)
+}) {
+  if (!runtimeAvailable) {
+    return {
+      capability: "headed_browser_auth",
+      advertised: false,
+      ready: false,
+      reason: "browser_session_runtime_unavailable"
+    };
+  }
+  if (!ensureExecutable(browserExecutable)) {
+    return {
+      capability: "headed_browser_auth",
+      advertised: false,
+      ready: false,
+      reason: "browser_session_browser_executable_unavailable"
+    };
+  }
+  if (!displayAvailable) {
+    return {
+      capability: "headed_browser_auth",
+      advertised: false,
+      ready: false,
+      reason: "browser_session_display_unavailable"
+    };
+  }
+  try {
+    ensurePrivateRoot(stateRoot);
+  } catch (error) {
+    return {
+      capability: "headed_browser_auth",
+      advertised: false,
+      ready: false,
+      reason: typeof error?.code === "string" ? error.code : "browser_session_profile_root_unavailable"
+    };
+  }
+  return { capability: "headed_browser_auth", advertised: true, ready: true };
+}
+function createBrowserSessionBroker({
+  stateRoot,
+  browserExecutable,
+  chromium,
+  now = () => /* @__PURE__ */ new Date()
+}) {
+  const active = /* @__PURE__ */ new Map();
+  const readers = /* @__PURE__ */ new Map();
+  async function open(payload, { replace = false } = {}) {
+    validateHttpsLocator(payload);
+    validateHumanLease(payload, now);
+    const profilePath = exactProfile(stateRoot, payload, { create: true });
+    const existing = active.get(payload.localOpaqueRef);
+    if (existing) {
+      if (existing.owner.companyId !== payload.companyId || existing.owner.bindingId !== payload.bindingId) {
+        throw brokerError("browser_session_profile_owner_mismatch");
+      }
+      if (existing.leaseId !== payload.leaseId && !replace) {
+        throw brokerError("browser_session_lease_conflict");
+      }
+      if (existing.leaseId === payload.leaseId && !replace) {
+        return {
+          bindingId: payload.bindingId,
+          localOpaqueRef: payload.localOpaqueRef,
+          state: "human_ready"
+        };
+      }
+      await existing.context.close();
+      active.delete(payload.localOpaqueRef);
+    }
+    if (!chromium || typeof chromium.launchPersistentContext !== "function") {
+      throw brokerError("browser_session_runtime_unavailable");
+    }
+    const context = await chromium.launchPersistentContext(profilePath, {
+      executablePath: browserExecutable,
+      headless: false,
+      acceptDownloads: false
+    });
+    const leaseState = {
+      context,
+      leaseId: payload.leaseId,
+      owner: expectedOwner(payload),
+      lastActivityAt: now().toISOString()
+    };
+    if (typeof context.exposeBinding === "function" && typeof context.addInitScript === "function") {
+      await context.exposeBinding("__mirrorxBrowserAuthActivity", () => {
+        leaseState.lastActivityAt = now().toISOString();
+      });
+      await context.addInitScript(() => {
+        const report = () => globalThis.__mirrorxBrowserAuthActivity?.().catch?.(() => {
+        });
+        globalThis.addEventListener("pointerdown", report, { capture: true, passive: true });
+        globalThis.addEventListener("keydown", report, { capture: true, passive: true });
+        globalThis.addEventListener("touchstart", report, { capture: true, passive: true });
+      });
+    }
+    const page = context.pages()[0] ?? await context.newPage();
+    await page.goto(payload.locator);
+    active.set(payload.localOpaqueRef, leaseState);
+    return {
+      bindingId: payload.bindingId,
+      localOpaqueRef: payload.localOpaqueRef,
+      state: "human_ready"
+    };
+  }
+  async function revokeExact(payload) {
+    const existing = active.get(payload.localOpaqueRef);
+    if (existing) {
+      if (existing.owner.companyId !== payload.companyId || existing.owner.bindingId !== payload.bindingId) {
+        throw brokerError("browser_session_profile_owner_mismatch");
+      }
+    }
+    const profilePath = exactProfile(stateRoot, payload);
+    if (existing) {
+      await existing.context.close();
+      active.delete(payload.localOpaqueRef);
+    }
+    rmSync5(profilePath, { recursive: true, force: false });
+    return {
+      bindingId: payload.bindingId,
+      localOpaqueRef: payload.localOpaqueRef,
+      state: "revoked"
+    };
+  }
+  return {
+    openHumanSession: (payload) => open(payload),
+    reopenHumanSession: (payload) => open(payload, { replace: true }),
+    switchAccount: async (payload) => {
+      await revokeExact({
+        ...payload,
+        bindingId: payload.previousBinding.bindingId,
+        localOpaqueRef: payload.previousBinding.localOpaqueRef
+      });
+      return open(payload);
+    },
+    revokeBinding: revokeExact,
+    acquireAgentRead: async (payload) => {
+      const expiry = Date.parse(payload.leaseExpiresAt);
+      if (!Number.isFinite(expiry) || expiry <= now().getTime()) {
+        throw brokerError("browser_session_agent_lease_expired");
+      }
+      const root = ensurePrivateRoot(stateRoot);
+      const expectedPath = resolve9(root, profileName(payload));
+      if (resolve9(payload.userDataDir) !== expectedPath) {
+        throw brokerError("browser_session_profile_path_invalid");
+      }
+      const marker = JSON.parse(readFileSync10(join12(expectedPath, MARKER_NAME), "utf8"));
+      if (marker.version !== 1 || typeof marker.provider !== "string" || !marker.provider.trim() || marker.companyId !== payload.companyId || marker.bindingId !== payload.bindingId || marker.localOpaqueRef !== payload.localOpaqueRef || marker.origin !== payload.origin) {
+        throw brokerError("browser_session_profile_owner_mismatch");
+      }
+      const existingReader = readers.get(payload.localOpaqueRef);
+      if (existingReader && existingReader !== payload.leaseId) {
+        throw brokerError("browser_session_lease_conflict");
+      }
+      const human = active.get(payload.localOpaqueRef);
+      if (human) {
+        if (human.owner.companyId !== payload.companyId || human.owner.bindingId !== payload.bindingId) {
+          throw brokerError("browser_session_profile_owner_mismatch");
+        }
+        await human.context.close();
+        active.delete(payload.localOpaqueRef);
+      }
+      readers.set(payload.localOpaqueRef, payload.leaseId);
+      return () => {
+        if (readers.get(payload.localOpaqueRef) === payload.leaseId) {
+          readers.delete(payload.localOpaqueRef);
+        }
+      };
+    },
+    status: () => ({
+      activeHumanLeases: [...active.values()].map((entry) => ({
+        companyId: entry.owner.companyId,
+        bindingId: entry.owner.bindingId,
+        leaseId: entry.leaseId,
+        lastActivityAt: entry.lastActivityAt
+      }))
+    })
+  };
+}
+
 // ../shared/src/source-acquisition-compatibility.json
 var source_acquisition_compatibility_default = {
   schemaVersion: "mirrorx.source-acquisition-compatibility.v1",
@@ -10879,12 +11185,14 @@ var source_acquisition_compatibility_default = {
 };
 
 // src/amaster-runtime-daemon.mjs
-var CONNECTOR_VERSION = "0.1.1-beta.67";
+var CONNECTOR_VERSION = "0.1.1-beta.69";
 var CONNECTOR_CONTRACT_VERSION = "2026-06-04.v1";
 var SOURCE_ACQUISITION_CAPABILITY = source_acquisition_compatibility_default.profileVersion;
+var daemonRequire = createRequire(import.meta.url);
 var SOURCE_ACQUISITION_PROFILE_VERSION = source_acquisition_compatibility_default.profileVersion;
 var SOURCE_ACQUISITION_RETENTION_VERSION = source_acquisition_compatibility_default.retentionVersion;
 var SOURCE_ACQUISITION_ACTION_VERSION = source_acquisition_compatibility_default.actionVersion;
+var SOURCE_ACQUISITION_BROWSER_POLICY_VERSION = source_acquisition_compatibility_default.policyVersion;
 var SOURCE_ACQUISITION_HEADLESS_ADAPTER = source_acquisition_compatibility_default.adapters[0];
 var SOURCE_ACQUISITION_DESKTOP_ADAPTER = "browser_skill_desktop_v1";
 var SOURCE_ACQUISITION_PACKAGE_VERSIONS = Object.freeze(
@@ -10917,11 +11225,11 @@ function updateActiveRunWorkspaceManifest(commandId, manifestPath, patch = {}) {
 }
 function resultOutboxPendingCount(config) {
   const dir = resultOutboxDir(config);
-  if (!existsSync11(dir)) return 0;
+  if (!existsSync12(dir)) return 0;
   try {
     let pending = 0;
     for (const file of readdirSync9(dir).filter((name) => name.endsWith(".json"))) {
-      if (readValidResultOutboxEntryOrQuarantine(config, file, join12(dir, file))) {
+      if (readValidResultOutboxEntryOrQuarantine(config, file, join13(dir, file))) {
         pending += 1;
       }
     }
@@ -10932,16 +11240,16 @@ function resultOutboxPendingCount(config) {
 }
 function runCompletionStateDir(config) {
   const explicit = readString(process.env.AMASTER_RUN_COMPLETION_STATE_DIR);
-  if (explicit) return resolve9(expandHomePath(explicit));
-  return join12(dirname7(stateFilePath(process.env)), "run-completion-state");
+  if (explicit) return resolve10(expandHomePath(explicit));
+  return join13(dirname8(stateFilePath(process.env)), "run-completion-state");
 }
 function runCompletionStateInvalidDir(config) {
-  return join12(runCompletionStateDir(config), "invalid");
+  return join13(runCompletionStateDir(config), "invalid");
 }
 function quarantineInvalidRunCompletionState(config, filePath, reason) {
   const invalidDir = runCompletionStateInvalidDir(config);
-  mkdirSync7(invalidDir, { recursive: true, mode: 448 });
-  const destination = join12(invalidDir, basename6(filePath));
+  mkdirSync8(invalidDir, { recursive: true, mode: 448 });
+  const destination = join13(invalidDir, basename6(filePath));
   try {
     renameSync6(filePath, destination);
   } catch {
@@ -10994,11 +11302,11 @@ function piCompletionOutputType(event) {
 }
 function resultOutboxActiveRunCommands(config) {
   const dir = resultOutboxDir(config);
-  if (!existsSync11(dir)) return [];
+  if (!existsSync12(dir)) return [];
   const outboxPending = resultOutboxPendingCount(config);
   const entries = [];
   for (const file of readdirSync9(dir).filter((name) => name.endsWith(".json")).sort()) {
-    const entry = readValidResultOutboxEntryOrQuarantine(config, file, join12(dir, file));
+    const entry = readValidResultOutboxEntryOrQuarantine(config, file, join13(dir, file));
     if (!entry) continue;
     const activeRun = asRecord(entry.activeRun);
     const commandId = readString(activeRun.commandId) ?? readString(entry.commandId);
@@ -11028,12 +11336,12 @@ function resultOutboxActiveRunCommands(config) {
 }
 function resultOutboxFailedRunCommands(config) {
   const dir = resultOutboxInvalidDir(config);
-  if (!existsSync11(dir)) return [];
+  if (!existsSync12(dir)) return [];
   const entries = [];
   for (const file of readdirSync9(dir).filter((name) => name.endsWith(".json")).sort().slice(-100)) {
     let entry;
     try {
-      entry = asRecord(JSON.parse(readFileSync10(join12(dir, file), "utf8")));
+      entry = asRecord(JSON.parse(readFileSync11(join13(dir, file), "utf8")));
     } catch {
       continue;
     }
@@ -11096,11 +11404,11 @@ function piExtraArgsDiagnostics(value) {
 }
 function safeExpandPath(value) {
   const text = readString(value);
-  return text ? resolve9(expandHomePath(text)) : null;
+  return text ? resolve10(expandHomePath(text)) : null;
 }
 function safeJsonObjectFromFile(filePath) {
   try {
-    const parsed = JSON.parse(readFileSync10(filePath, "utf8"));
+    const parsed = JSON.parse(readFileSync11(filePath, "utf8"));
     return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
   } catch {
     return null;
@@ -11111,7 +11419,7 @@ function safeDirectorySummary(pathValue) {
     return { configured: false, available: false, entryCount: 0 };
   }
   try {
-    const stat = statSync8(pathValue);
+    const stat = statSync9(pathValue);
     if (!stat.isDirectory()) {
       return { configured: true, available: false, entryCount: 0, reason: "not_directory" };
     }
@@ -11143,10 +11451,10 @@ function safeSkillRootSummary(kind, source, pathValue) {
     try {
       for (const name of readdirSync9(pathValue)) {
         if (name.startsWith(".")) continue;
-        const skillDir = join12(pathValue, name);
+        const skillDir = join13(pathValue, name);
         try {
-          if (!statSync8(skillDir).isDirectory()) continue;
-          if (!existsSync11(join12(skillDir, "SKILL.md"))) continue;
+          if (!statSync9(skillDir).isDirectory()) continue;
+          if (!existsSync12(join13(skillDir, "SKILL.md"))) continue;
           skillCount += 1;
           if (skillCount >= MAX_PI_CAPABILITY_SOURCE_ENTRIES) {
             truncated = true;
@@ -11174,7 +11482,7 @@ function safeJsonConfigSummary(source, pathValue, counter) {
     return { source, configured: false, available: false, parseable: false };
   }
   try {
-    const stat = statSync8(pathValue);
+    const stat = statSync9(pathValue);
     if (!stat.isFile()) {
       return { source, configured: true, available: false, parseable: false, reason: "not_file" };
     }
@@ -11197,7 +11505,7 @@ function objectKeyCount(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? Object.keys(value).length : 0;
 }
 function defaultPiCodingAgentDir() {
-  return join12(homedir3(), ".pi", "agent");
+  return join13(homedir3(), ".pi", "agent");
 }
 function piCapabilitySourcesDiagnostics() {
   const configuredPiCodingAgentDir = safeExpandPath(process.env.PI_CODING_AGENT_DIR);
@@ -11206,14 +11514,14 @@ function piCapabilitySourcesDiagnostics() {
   const configuredPiAgentHome = safeExpandPath(process.env.PI_AGENT_HOME);
   const piAgentHome = configuredPiAgentHome ?? piCodingAgentDir;
   const piAgentHomeSource = configuredPiAgentHome ? "PI_AGENT_HOME" : piCodingAgentDirSource;
-  const userSkillsPath = piAgentHome ? join12(piAgentHome, "skills") : null;
+  const userSkillsPath = piAgentHome ? join13(piAgentHome, "skills") : null;
   const configuredMarketplaceSkillsPath = safeExpandPath(
     process.env.PI_AGENT_MARKETPLACE_SKILLS_DIR
   );
-  const marketplaceSkillsPath = configuredMarketplaceSkillsPath ?? (piAgentHome ? join12(piAgentHome, "marketplace", "skills") : null);
+  const marketplaceSkillsPath = configuredMarketplaceSkillsPath ?? (piAgentHome ? join13(piAgentHome, "marketplace", "skills") : null);
   const builtinSkillsPath = safeExpandPath(process.env.PI_AGENT_BUILTIN_SKILLS_DIR) ?? safeExpandPath(process.env.AMASTER_BUILTIN_SKILLS);
-  const mcpConfigPath = safeExpandPath(process.env.PI_AGENT_MCP_SERVERS_FILE) ?? (piAgentHome ? join12(piAgentHome, "mcp.json") : null);
-  const settingsConfigPath = piCodingAgentDir ? join12(piCodingAgentDir, "settings.json") : null;
+  const mcpConfigPath = safeExpandPath(process.env.PI_AGENT_MCP_SERVERS_FILE) ?? (piAgentHome ? join13(piAgentHome, "mcp.json") : null);
+  const settingsConfigPath = piCodingAgentDir ? join13(piCodingAgentDir, "settings.json") : null;
   const skillRoots = [
     safeSkillRootSummary("user", `${piAgentHomeSource}/skills`, userSkillsPath),
     safeSkillRootSummary(
@@ -11333,15 +11641,15 @@ function buildExecutorReadiness(config) {
 function sourceAcquisitionPackageMetadata(packageName) {
   const agentDir = readString(process.env.PI_CODING_AGENT_DIR ?? process.env.PI_AGENT_HOME);
   if (!agentDir) return null;
-  const packagePath = join12(
-    resolve9(expandHomePath(agentDir)),
+  const packagePath = join13(
+    resolve10(expandHomePath(agentDir)),
     "npm",
     "node_modules",
     ...packageName.split("/"),
     "package.json"
   );
-  if (!existsSync11(packagePath)) return null;
-  const stat = lstatSync5(packagePath);
+  if (!existsSync12(packagePath)) return null;
+  const stat = lstatSync6(packagePath);
   if (!stat.isFile() || stat.isSymbolicLink()) return null;
   const metadata = readJsonFile2(packagePath);
   return metadata.name === packageName && readString(metadata.version) ? metadata : null;
@@ -11350,7 +11658,7 @@ function sourceAcquisitionBrowserExecutableReady() {
   const executable = readString(process.env.AMASTER_BROWSER_EXECUTABLE_PATH);
   if (!executable || !isAbsolute6(executable)) return false;
   try {
-    const stat = statSync8(executable);
+    const stat = statSync9(executable);
     return stat.isFile() && (stat.mode & 73) !== 0;
   } catch {
     return false;
@@ -11376,6 +11684,20 @@ function sourceAcquisitionRuntimeReadiness(config) {
   if (adapters.length === 0 || adapters.some((adapter) => ![SOURCE_ACQUISITION_HEADLESS_ADAPTER, SOURCE_ACQUISITION_DESKTOP_ADAPTER].includes(adapter))) {
     return unavailable("source_acquisition_adapter_attestation_invalid");
   }
+  let browserSkill;
+  if (adapters.includes(SOURCE_ACQUISITION_DESKTOP_ADAPTER)) {
+    browserSkill = {
+      runtimeVersion: readString(process.env.AMASTER_SOURCE_ACQUISITION_BROWSER_SKILL_RUNTIME_VERSION),
+      runtimeDigest: readString(process.env.AMASTER_SOURCE_ACQUISITION_BROWSER_SKILL_RUNTIME_DIGEST),
+      assetVersion: readString(process.env.AMASTER_SOURCE_ACQUISITION_BROWSER_SKILL_ASSET_VERSION),
+      assetDigest: readString(process.env.AMASTER_SOURCE_ACQUISITION_BROWSER_SKILL_ASSET_DIGEST),
+      policyVersion: SOURCE_ACQUISITION_BROWSER_POLICY_VERSION,
+      policyDigest: readString(process.env.AMASTER_SOURCE_ACQUISITION_BROWSER_SKILL_POLICY_DIGEST)
+    };
+    if (!browserSkill.runtimeVersion || !browserSkill.assetVersion || !/^[a-f0-9]{64}$/u.test(browserSkill.runtimeDigest ?? "") || !/^[a-f0-9]{64}$/u.test(browserSkill.assetDigest ?? "") || !/^[a-f0-9]{64}$/u.test(browserSkill.policyDigest ?? "")) {
+      return unavailable("source_acquisition_browser_skill_attestation_invalid");
+    }
+  }
   if (adapters.includes(SOURCE_ACQUISITION_HEADLESS_ADAPTER) && !sourceAcquisitionBrowserExecutableReady()) {
     return unavailable("source_acquisition_browser_executable_unavailable");
   }
@@ -11402,6 +11724,7 @@ function sourceAcquisitionRuntimeReadiness(config) {
     actionVersion: SOURCE_ACQUISITION_ACTION_VERSION,
     extension: { digest: extensionDigest },
     adapters,
+    ...browserSkill ? { browserSkill } : {},
     connector: {
       version: CONNECTOR_VERSION,
       digest: connectorDigest
@@ -11409,12 +11732,46 @@ function sourceAcquisitionRuntimeReadiness(config) {
     packages
   };
 }
-function runtimeAdvertisedCapabilities(config, sourceAcquisition) {
-  return config.capabilities.filter((capability) => capability !== "headed_browser_auth" && (capability !== SOURCE_ACQUISITION_CAPABILITY || sourceAcquisition.ready === true));
+function browserSessionRuntimeReadiness(config) {
+  let runtimeAvailable = false;
+  try {
+    daemonRequire.resolve("playwright-core");
+    runtimeAvailable = true;
+  } catch {
+  }
+  return browserSessionBrokerReadiness({
+    stateRoot: config.browserSessionStateRoot,
+    browserExecutable: readString(process.env.AMASTER_BROWSER_EXECUTABLE_PATH),
+    runtimeAvailable
+  });
+}
+var browserSessionBrokers = /* @__PURE__ */ new Map();
+function browserSessionBrokerFor(config) {
+  const key = resolve10(config.browserSessionStateRoot);
+  let broker = browserSessionBrokers.get(key);
+  if (!broker) {
+    const { chromium } = daemonRequire("playwright-core");
+    broker = createBrowserSessionBroker({
+      stateRoot: key,
+      browserExecutable: readString(process.env.AMASTER_BROWSER_EXECUTABLE_PATH),
+      chromium
+    });
+    browserSessionBrokers.set(key, broker);
+  }
+  return broker;
+}
+function browserSessionRuntimeStatus(config) {
+  const readiness = browserSessionRuntimeReadiness(config);
+  const broker = browserSessionBrokers.get(resolve10(config.browserSessionStateRoot));
+  return broker ? { ...readiness, ...broker.status() } : readiness;
+}
+function runtimeAdvertisedCapabilities(config, sourceAcquisition, browserSessionBroker) {
+  return config.capabilities.filter((capability) => (capability !== "headed_browser_auth" || browserSessionBroker.ready === true) && (capability !== SOURCE_ACQUISITION_CAPABILITY || sourceAcquisition.ready === true));
 }
 function buildRegisterPayload(config) {
   const buildCommit = readString(process.env.AMASTER_RUNTIME_BUILD_COMMIT ?? process.env.AMASTER_SOURCE_COMMIT);
   const sourceAcquisition = sourceAcquisitionRuntimeReadiness(config);
+  const browserSessionBroker = browserSessionRuntimeReadiness(config);
   return {
     ...config.companyId ? { companyId: config.companyId } : {},
     connectorName: config.connectorName,
@@ -11422,7 +11779,7 @@ function buildRegisterPayload(config) {
     workspaceBindings: config.workspaceBindings,
     networkDomains: config.networkDomains,
     executors: config.executors,
-    capabilities: runtimeAdvertisedCapabilities(config, sourceAcquisition),
+    capabilities: runtimeAdvertisedCapabilities(config, sourceAcquisition, browserSessionBroker),
     contractVersion: CONNECTOR_CONTRACT_VERSION,
     connectorVersion: CONNECTOR_VERSION,
     ...buildCommit ? { buildCommit } : {},
@@ -11468,6 +11825,7 @@ function buildHeartbeatPayload(config, options = {}) {
   const activeRunCount = activeRunCommandList.filter(activeRunCommandCountsAsActive).length;
   const executorReadiness = buildExecutorReadiness(config);
   const sourceAcquisition = sourceAcquisitionRuntimeReadiness(config);
+  const browserSessionBroker = browserSessionRuntimeStatus(config);
   const status = options.status === "offline" ? "offline" : "online";
   const daemonStatus = status === "offline" ? "stopping" : "running";
   return {
@@ -11475,7 +11833,7 @@ function buildHeartbeatPayload(config, options = {}) {
     workspaceBindings: config.workspaceBindings,
     networkDomains: config.networkDomains,
     executors: config.executors,
-    capabilities: runtimeAdvertisedCapabilities(config, sourceAcquisition),
+    capabilities: runtimeAdvertisedCapabilities(config, sourceAcquisition, browserSessionBroker),
     connectorVersion: CONNECTOR_VERSION,
     ...buildCommit ? { buildCommit } : {},
     contractVersion: CONNECTOR_CONTRACT_VERSION,
@@ -11496,6 +11854,7 @@ function buildHeartbeatPayload(config, options = {}) {
       stateFile: stateFilePath(process.env),
       ...executorReadiness.length > 0 ? { executorReadiness } : {},
       runnerKind: config.runnerKind,
+      browserSessionBroker,
       sourceAcquisition,
       ...versionDrift.versionDrift || versionDrift.bundleDrift ? versionDrift : {}
     },
@@ -11669,7 +12028,7 @@ AMASTER_WORKSPACE_ALLOWLIST=${quoteShell(config.workspaceBindings.join(","))}
 AMASTER_EXECUTORS=${quoteShell(executorEnv)}
 AMASTER_CAPABILITIES=${quoteShell(config.capabilities.join(","))}
 AMASTER_NETWORK_DOMAINS=${quoteShell(config.networkDomains.join(","))}
-AMASTER_DAEMON_STATE_FILE=${quoteShell(join12(homedir3(), ".amaster-employee", "runtime-connector-state.json"))}
+AMASTER_DAEMON_STATE_FILE=${quoteShell(join13(homedir3(), ".amaster-employee", "runtime-connector-state.json"))}
 EOF
 
 set -a
@@ -11895,10 +12254,10 @@ function buildActiveRunCommandStatus(config, entry) {
   const base = {
     ...entry,
     phase: readString(entry.phase) ?? "executing",
-    managedWorkdirPresent: entry.workspacePath ? existsSync11(entry.workspacePath) : false,
+    managedWorkdirPresent: entry.workspacePath ? existsSync12(entry.workspacePath) : false,
     outboxPending: resultOutboxPendingCount(config)
   };
-  if (!entry.workspacePath || !existsSync11(entry.workspacePath)) return base;
+  if (!entry.workspacePath || !existsSync12(entry.workspacePath)) return base;
   const manifestPath = entry.manifestPath ?? workspaceManifestPath(entry.workspacePath);
   const status = readWorkspaceStatus(entry.workspacePath, { hashCache: workspaceStatusHashCache });
   const artifactCandidates = status.artifacts.slice(0, 20);
@@ -12077,7 +12436,24 @@ function commandTrustedPiRuntimeAssertion(command) {
 function commandSourceAcquisitionProfile(command) {
   return asRecord(asRecord(asRecord(command.payload).sourceAcquisition).profile);
 }
-function sourceAcquisitionRuntimeProfile(config, command) {
+function sourceAcquisitionExactOrigin(value) {
+  const locator = readString(value);
+  let url;
+  try {
+    url = new URL(locator ?? "");
+  } catch {
+    throw Object.assign(new Error("source_acquisition_profile_invalid"), {
+      code: "source_acquisition_profile_invalid"
+    });
+  }
+  if (url.protocol !== "https:" || url.username || url.password) {
+    throw Object.assign(new Error("source_acquisition_profile_invalid"), {
+      code: "source_acquisition_profile_invalid"
+    });
+  }
+  return url.origin;
+}
+async function sourceAcquisitionRuntimeProfile(config, command) {
   const profile = commandSourceAcquisitionProfile(command);
   if (Object.keys(profile).length === 0) return null;
   const access = asRecord(profile.access);
@@ -12098,23 +12474,36 @@ function sourceAcquisitionRuntimeProfile(config, command) {
   const companyId = readString(profile.companyId);
   const bindingId = readString(access.browserBindingId);
   const localOpaqueRef = readString(access.localOpaqueRef);
-  if (!companyId || !bindingId || !/^profile_[a-z0-9]{16,64}$/i.test(localOpaqueRef ?? "")) {
+  const browserLeaseId = readString(access.browserLeaseId);
+  const browserLeaseExpiresAt = readString(access.browserLeaseExpiresAt);
+  if (!companyId || !bindingId || !/^profile_[a-z0-9]{16,64}$/i.test(localOpaqueRef ?? "") || !browserLeaseId || !browserLeaseExpiresAt || Date.parse(browserLeaseExpiresAt) <= Date.now()) {
     throw new Error("source_acquisition_profile_invalid");
   }
-  const profileName = createHash12("sha256").update(`${companyId}\0${bindingId}\0${localOpaqueRef}`).digest("hex");
-  const stateRoot = resolve9(config.browserSessionStateRoot);
-  const userDataDir = resolve9(stateRoot, profileName);
+  const exactOrigin = sourceAcquisitionExactOrigin(access.exactLocator);
+  const profileName2 = createHash13("sha256").update(`${companyId}\0${bindingId}\0${localOpaqueRef}`).digest("hex");
+  const stateRoot = resolve10(config.browserSessionStateRoot);
+  const userDataDir = resolve10(stateRoot, profileName2);
   if (!pathWithin2(userDataDir, stateRoot)) throw new Error("source_acquisition_browser_profile_invalid");
-  const markerPath = join12(userDataDir, ".amaster-browser-session.json");
+  const markerPath = join13(userDataDir, ".amaster-browser-session.json");
+  if (!existsSync12(userDataDir) || lstatSync6(userDataDir).isSymbolicLink() || !lstatSync6(userDataDir).isDirectory() || !existsSync12(markerPath) || lstatSync6(markerPath).isSymbolicLink()) throw new Error("source_acquisition_browser_profile_invalid");
   const marker = readJsonFile2(markerPath);
-  if (marker.version !== 1 || marker.companyId !== companyId || marker.bindingId !== bindingId || marker.localOpaqueRef !== localOpaqueRef || Object.keys(marker).length !== 4) {
+  if (marker.version !== 1 || marker.companyId !== companyId || marker.bindingId !== bindingId || marker.localOpaqueRef !== localOpaqueRef || !readString(marker.provider) || marker.origin !== exactOrigin || Object.keys(marker).length !== 6) {
     throw new Error("source_acquisition_browser_profile_invalid");
   }
-  return { profile, userDataDir };
+  const releaseBrowserLease = await browserSessionBrokerFor(config).acquireAgentRead({
+    companyId,
+    bindingId,
+    localOpaqueRef,
+    origin: marker.origin,
+    leaseId: browserLeaseId,
+    leaseExpiresAt: browserLeaseExpiresAt,
+    userDataDir
+  });
+  return { profile, userDataDir, releaseBrowserLease };
 }
 function readJsonFile2(filePath) {
   try {
-    const parsed = JSON.parse(readFileSync10(filePath, "utf8"));
+    const parsed = JSON.parse(readFileSync11(filePath, "utf8"));
     return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
   } catch {
     return {};
@@ -12159,7 +12548,7 @@ function safeAgentInstructionMaterializationTarget(workspace, filePath) {
   const segments = normalized.split("/").filter(Boolean);
   if (segments.length === 0 || segments.some((segment) => segment === "." || segment === "..")) return null;
   const relativePath = segments.join("/");
-  const targetPath = resolve9(workspace.cwd, relativePath);
+  const targetPath = resolve10(workspace.cwd, relativePath);
   if (!pathWithin2(targetPath, workspace.cwd)) return null;
   return { relativePath, targetPath };
 }
@@ -12173,8 +12562,8 @@ async function materializeAgentInstructionsBundle(config, command, workspace, bu
     if (!content) continue;
     const target = safeAgentInstructionMaterializationTarget(workspace, filePath);
     if (!target) continue;
-    mkdirSync7(dirname7(target.targetPath), { recursive: true });
-    writeFileSync7(target.targetPath, content, "utf8");
+    mkdirSync8(dirname8(target.targetPath), { recursive: true });
+    writeFileSync8(target.targetPath, content, "utf8");
     materialized.push({
       path: target.relativePath,
       byteSize: Buffer.byteLength(content, "utf8")
@@ -12201,11 +12590,11 @@ function wikiTreePathForCommand(command, workspaceBindings) {
     const candidates = [];
     if (root.endsWith("paperclipai.plugin-llm-wiki")) candidates.push(root);
     if (basename6(root) === "plugin-data" && companyId) {
-      candidates.push(join12(root, companyId, "paperclipai.plugin-llm-wiki"));
+      candidates.push(join13(root, companyId, "paperclipai.plugin-llm-wiki"));
     }
     for (const candidate of candidates) {
       try {
-        if (existsSync11(candidate)) return candidate;
+        if (existsSync12(candidate)) return candidate;
       } catch {
       }
     }
@@ -12345,18 +12734,18 @@ function buildExecutorEnv(config, command, workspace) {
   };
 }
 function preparePiModelCallProfile(commandId, baseEnv, options = {}) {
-  const profileRoot = mkdtempSync(join12(tmpdir(), "amaster-pi-model-call-"));
-  const home = join12(profileRoot, "home");
-  const sessionsDir = join12(profileRoot, "sessions");
-  const tempDir = join12(profileRoot, "tmp");
+  const profileRoot = mkdtempSync(join13(tmpdir(), "amaster-pi-model-call-"));
+  const home = join13(profileRoot, "home");
+  const sessionsDir = join13(profileRoot, "sessions");
+  const tempDir = join13(profileRoot, "tmp");
   for (const directory of [home, sessionsDir, tempDir]) {
-    mkdirSync7(directory, { recursive: true, mode: 448 });
+    mkdirSync8(directory, { recursive: true, mode: 448 });
   }
   try {
     const extensionArgs = [];
     if (options.responseContract) {
-      const extensionPath = join12(profileRoot, "model-call-output-contract.js");
-      writeFileSync7(
+      const extensionPath = join13(profileRoot, "model-call-output-contract.js");
+      writeFileSync8(
         extensionPath,
         modelCallOutputContractExtensionSource(options.responseContract.maxOutputTokens),
         { mode: 384 }
@@ -12376,12 +12765,12 @@ function preparePiModelCallProfile(commandId, baseEnv, options = {}) {
       }
     };
   } catch (error) {
-    rmSync5(profileRoot, { recursive: true, force: true });
+    rmSync6(profileRoot, { recursive: true, force: true });
     throw error;
   }
 }
 function cleanupPiModelCallProfile(profile) {
-  if (profile?.profileRoot) rmSync5(profile.profileRoot, { recursive: true, force: true });
+  if (profile?.profileRoot) rmSync6(profile.profileRoot, { recursive: true, force: true });
 }
 function splitExtraArgs(value) {
   return splitList(value).flatMap((entry) => entry.split(/\s+/).filter(Boolean));
@@ -12421,7 +12810,7 @@ function resolveNativeSessionRequest(command, workspace) {
     try {
       cwdMatched = realpathSync5(requestedCwd) === realpathSync5(sourceWorkspacePath);
     } catch {
-      cwdMatched = resolve9(requestedCwd) === resolve9(sourceWorkspacePath);
+      cwdMatched = resolve10(requestedCwd) === resolve10(sourceWorkspacePath);
     }
   }
   const used = Boolean(enabled && requested && sessionId && requestedCwd && cwdMatched);
@@ -13006,10 +13395,10 @@ function realOrResolvedPath(value) {
   try {
     return realpathSync5(value);
   } catch {
-    return resolve9(value);
+    return resolve10(value);
   }
 }
-var LSOF_COMMAND = process.platform === "darwin" && existsSync11("/usr/sbin/lsof") ? "/usr/sbin/lsof" : "lsof";
+var LSOF_COMMAND = process.platform === "darwin" && existsSync12("/usr/sbin/lsof") ? "/usr/sbin/lsof" : "lsof";
 function processCwdForPid(pid) {
   if (process.platform === "linux") {
     try {
@@ -13131,7 +13520,7 @@ function killWorkspaceResidentProcesses(cwd, processGroupId, options = {}) {
 }
 function walkManagedWorkdirs(root) {
   const workdirs = [];
-  if (!root || !existsSync11(root)) return workdirs;
+  if (!root || !existsSync12(root)) return workdirs;
   const stack = [root];
   while (stack.length > 0) {
     const current = stack.pop();
@@ -13144,8 +13533,8 @@ function walkManagedWorkdirs(root) {
     }
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
-      const fullPath = join12(current, entry.name);
-      if (entry.name === "workdir" && existsSync11(workspaceManifestPath(fullPath))) {
+      const fullPath = join13(current, entry.name);
+      if (entry.name === "workdir" && existsSync12(workspaceManifestPath(fullPath))) {
         workdirs.push(fullPath);
         continue;
       }
@@ -13183,7 +13572,7 @@ function manifestMatchesActiveRuntimeRef(manifest, refs, workdir = null) {
 }
 function buildOrphanReaperSample(root, workdir, manifest, residents) {
   const relativeWorkdir = (() => {
-    const value = relative6(root, workdir);
+    const value = relative7(root, workdir);
     return value && !value.startsWith("..") && !isAbsolute6(value) ? value : basename6(workdir);
   })();
   return {
@@ -14616,7 +15005,7 @@ async function flushRunCompletionStates(config) {
   for (const { filePath, state: listedState } of runCompletionStateEntries(config)) {
     try {
       if (runCompletionFlights.has(listedState.commandId)) continue;
-      if (!existsSync11(filePath)) continue;
+      if (!existsSync12(filePath)) continue;
       const state = readValidRunCompletionStateOrQuarantine(config, filePath);
       if (!state) continue;
       const outcome = await coordinateRunCompletionSingleFlight(config, state);
@@ -14803,15 +15192,15 @@ async function completeCommand(config, command, status, result3, error) {
 }
 function resultOutboxDir(config) {
   const explicit = readString(process.env.AMASTER_RESULT_OUTBOX_DIR);
-  if (explicit) return resolve9(expandHomePath(explicit));
-  return join12(dirname7(stateFilePath(process.env)), "result-outbox");
+  if (explicit) return resolve10(expandHomePath(explicit));
+  return join13(dirname8(stateFilePath(process.env)), "result-outbox");
 }
 function resultOutboxInvalidDir(config) {
-  return join12(resultOutboxDir(config), "invalid");
+  return join13(resultOutboxDir(config), "invalid");
 }
 function writeResultOutboxEntry(config, entry) {
   const dir = resultOutboxDir(config);
-  mkdirSync7(dir, { recursive: true });
+  mkdirSync8(dir, { recursive: true });
   const body = {
     version: 1,
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -14819,13 +15208,13 @@ function writeResultOutboxEntry(config, entry) {
     lastAttemptAt: null,
     ...entry
   };
-  writeFileSync7(join12(dir, resultOutboxFileName(entry.commandId)), `${JSON.stringify(body, null, 2)}
+  writeFileSync8(join13(dir, resultOutboxFileName(entry.commandId)), `${JSON.stringify(body, null, 2)}
 `, { mode: 384 });
 }
 function moveResultOutboxEntryToInvalid(config, file, fullPath, reason, detail, original) {
   const invalidDir = resultOutboxInvalidDir(config);
-  mkdirSync7(invalidDir, { recursive: true });
-  const invalidPath = join12(invalidDir, file);
+  mkdirSync8(invalidDir, { recursive: true });
+  const invalidPath = join13(invalidDir, file);
   if (original === void 0) {
     try {
       renameSync6(fullPath, invalidPath);
@@ -14841,14 +15230,14 @@ function moveResultOutboxEntryToInvalid(config, file, fullPath, reason, detail,
     ...detail ? { detail: truncateText(detail, 1e3) } : {},
     original
   };
-  writeFileSync7(invalidPath, `${JSON.stringify(evidence, null, 2)}
+  writeFileSync8(invalidPath, `${JSON.stringify(evidence, null, 2)}
 `, { mode: 384 });
   unlinkSync2(fullPath);
 }
 function readValidResultOutboxEntryOrQuarantine(config, file, fullPath) {
   let entry;
   try {
-    entry = JSON.parse(readFileSync10(fullPath, "utf8"));
+    entry = JSON.parse(readFileSync11(fullPath, "utf8"));
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     moveResultOutboxEntryToInvalid(config, file, fullPath, "malformed_result_outbox_json", message);
@@ -14878,13 +15267,13 @@ function updateResultOutboxAttempt(fullPath, entry, err) {
     ...typeof err?.httpStatus === "number" ? { httpStatus: err.httpStatus } : {},
     lastError: truncateText(err instanceof Error ? err.message : String(err), 1e3)
   };
-  writeFileSync7(fullPath, `${JSON.stringify(next, null, 2)}
+  writeFileSync8(fullPath, `${JSON.stringify(next, null, 2)}
 `, { mode: 384 });
   return next;
 }
 function quarantineResultOutboxEntry(config, fullPath, file, entry, reason, err) {
   const invalidDir = resultOutboxInvalidDir(config);
-  mkdirSync7(invalidDir, { recursive: true });
+  mkdirSync8(invalidDir, { recursive: true });
   const body = {
     ...entry,
     invalidReason: reason,
@@ -14892,8 +15281,8 @@ function quarantineResultOutboxEntry(config, fullPath, file, entry, reason, err)
     ...typeof err?.httpStatus === "number" ? { httpStatus: err.httpStatus } : {},
     lastError: truncateText(err instanceof Error ? err.message : String(err), 1e3)
   };
-  const invalidPath = join12(invalidDir, file);
-  writeFileSync7(invalidPath, `${JSON.stringify(body, null, 2)}
+  const invalidPath = join13(invalidDir, file);
+  writeFileSync8(invalidPath, `${JSON.stringify(body, null, 2)}
 `, { mode: 384 });
   try {
     unlinkSync2(fullPath);
@@ -14907,11 +15296,11 @@ function quarantineResultOutboxEntry(config, fullPath, file, entry, reason, err)
 }
 async function flushResultOutbox(config) {
   const dir = resultOutboxDir(config);
-  if (!existsSync11(dir)) return { attempted: 0, completed: 0 };
+  if (!existsSync12(dir)) return { attempted: 0, completed: 0 };
   const files = readdirSync9(dir).filter((name) => name.endsWith(".json")).sort();
   let completed = 0;
   for (const file of files) {
-    const fullPath = join12(dir, file);
+    const fullPath = join13(dir, file);
     const entry = readValidResultOutboxEntryOrQuarantine(config, file, fullPath);
     if (!entry) continue;
     try {
@@ -15108,8 +15497,8 @@ async function materializeIssueAttachments(config, command, workspace) {
     runtimeAuth,
     issueId
   );
-  const targetDir = join12(workspace.cwd, "input-attachments");
-  mkdirSync7(targetDir, { recursive: true });
+  const targetDir = join13(workspace.cwd, "input-attachments");
+  mkdirSync8(targetDir, { recursive: true });
   const usedFilenames = /* @__PURE__ */ new Set();
   const materialized = [];
   for (const [index, rawAttachment] of attachments.entries()) {
@@ -15123,11 +15512,11 @@ async function materializeIssueAttachments(config, command, workspace) {
       filename = `${stem}-${index + 1}${ext}`;
     }
     usedFilenames.add(filename);
-    const targetPath = join12(targetDir, filename);
+    const targetPath = join13(targetDir, filename);
     const body = await runtimeApiBuffer(runtimeAuth, contentPath);
-    writeFileSync7(targetPath, body);
+    writeFileSync8(targetPath, body);
     const attachmentId = readString(attachment.id);
-    const actualSha256 = createHash12("sha256").update(body).digest("hex");
+    const actualSha256 = createHash13("sha256").update(body).digest("hex");
     const lineageCandidates = lineageCandidatesByAttachmentId.get(attachmentId) ?? [];
     const lineage = selectAttachmentLineage(lineageCandidates, actualSha256);
     if (lineageCandidates.length > 0 && !lineage) {
@@ -15150,7 +15539,7 @@ async function materializeIssueAttachments(config, command, workspace) {
       id: attachmentId,
       name: readString(attachment.originalFilename) ?? filename,
       path: targetPath,
-      relativePath: relative6(workspace.cwd, targetPath),
+      relativePath: relative7(workspace.cwd, targetPath),
       contentType: readString(attachment.contentType),
       byteSize: body.byteLength,
       contentPath,
@@ -15199,9 +15588,9 @@ async function materializeRequiredArtifactInputs(config, command, workspace) {
   if (manifest.version !== 1 || !Array.isArray(manifest.entries)) {
     throw new Error("artifact_input_manifest_invalid: expected version 1 entries array");
   }
-  const targetRoot = join12(workspace.cwd, "input-artifacts");
-  rmSync5(targetRoot, { recursive: true, force: true });
-  mkdirSync7(targetRoot, { recursive: true });
+  const targetRoot = join13(workspace.cwd, "input-artifacts");
+  rmSync6(targetRoot, { recursive: true, force: true });
+  mkdirSync8(targetRoot, { recursive: true });
   const usedPaths = /* @__PURE__ */ new Set();
   const materialized = [];
   for (const [index, rawEntry] of manifest.entries.entries()) {
@@ -15219,7 +15608,7 @@ async function materializeRequiredArtifactInputs(config, command, workspace) {
       throw new Error(`artifact_input_manifest_invalid: entry ${index} contentPath does not match attachmentId`);
     }
     const body = await runtimeApiBuffer(runtimeAuth, contentPath);
-    const actualSha256 = createHash12("sha256").update(body).digest("hex");
+    const actualSha256 = createHash13("sha256").update(body).digest("hex");
     if (body.byteLength !== byteSize || actualSha256 !== sha2562) {
       throw new Error(
         `artifact_input_integrity_mismatch: workProductId=${workProductId} expectedBytes=${byteSize} actualBytes=${body.byteLength} expectedSha256=${sha2562} actualSha256=${actualSha256}`
@@ -15230,18 +15619,18 @@ async function materializeRequiredArtifactInputs(config, command, workspace) {
       id: attachmentId,
       originalFilename: readString(entry.originalFilename)
     }, index);
-    let relativePath = join12("input-artifacts", sourceDir, filename).split(/[\\/]+/).join("/");
+    let relativePath = join13("input-artifacts", sourceDir, filename).split(/[\\/]+/).join("/");
     if (usedPaths.has(relativePath)) {
       const ext = extname2(filename);
       const stem = ext ? filename.slice(0, -ext.length) : filename;
       filename = `${stem}-${index + 1}${ext}`;
-      relativePath = join12("input-artifacts", sourceDir, filename).split(/[\\/]+/).join("/");
+      relativePath = join13("input-artifacts", sourceDir, filename).split(/[\\/]+/).join("/");
     }
     usedPaths.add(relativePath);
-    const targetPath = join12(workspace.cwd, relativePath);
-    mkdirSync7(dirname7(targetPath), { recursive: true });
-    writeFileSync7(targetPath, body);
-    chmodSync4(targetPath, 292);
+    const targetPath = join13(workspace.cwd, relativePath);
+    mkdirSync8(dirname8(targetPath), { recursive: true });
+    writeFileSync8(targetPath, body);
+    chmodSync5(targetPath, 292);
     materialized.push({
       id: attachmentId,
       workProductId,
@@ -15260,9 +15649,9 @@ async function materializeRequiredArtifactInputs(config, command, workspace) {
     version: 1,
     entries: materialized.map(({ path: _path, relativePath, ...entry }) => ({ ...entry, path: relativePath }))
   };
-  const manifestPath = join12(targetRoot, "artifact-input-manifest.json");
-  writeFileSync7(manifestPath, JSON.stringify(localManifest, null, 2) + "\n");
-  chmodSync4(manifestPath, 292);
+  const manifestPath = join13(targetRoot, "artifact-input-manifest.json");
+  writeFileSync8(manifestPath, JSON.stringify(localManifest, null, 2) + "\n");
+  chmodSync5(manifestPath, 292);
   updateWorkspaceManifest(workspaceManifestPath(workspace), { artifactInputManifest: localManifest });
   await ingestLog(config, command, "system", "info", `Materialized ${materialized.length} required artifact input(s) into the execution workspace`, {
     artifactInputCount: materialized.length,
@@ -15271,12 +15660,12 @@ async function materializeRequiredArtifactInputs(config, command, workspace) {
   return materialized;
 }
 function issueCheckpointDir(workspace) {
-  return join12(dirname7(workspace.runDir), "checkpoint");
+  return join13(dirname8(workspace.runDir), "checkpoint");
 }
 async function clearIssueCheckpoint(config, command, workspace, reason) {
   const checkpointDir = issueCheckpointDir(workspace);
-  if (!existsSync11(checkpointDir)) return false;
-  rmSync5(checkpointDir, { recursive: true, force: true });
+  if (!existsSync12(checkpointDir)) return false;
+  rmSync6(checkpointDir, { recursive: true, force: true });
   await ingestLog(config, command, "system", "info", "Cleared issue continuation checkpoint", { reason });
   return true;
 }
@@ -15289,28 +15678,28 @@ function safeCheckpointRelativePath(rawPath) {
   return normalized;
 }
 function hashFileSha256(filePath) {
-  return createHash12("sha256").update(readFileSync10(filePath)).digest("hex");
+  return createHash13("sha256").update(readFileSync11(filePath)).digest("hex");
 }
 async function materializeIssueCheckpoint(config, command, workspace) {
   const checkpointDir = issueCheckpointDir(workspace);
-  const manifestPath = join12(checkpointDir, "manifest.json");
-  if (!existsSync11(manifestPath)) return [];
+  const manifestPath = join13(checkpointDir, "manifest.json");
+  if (!existsSync12(manifestPath)) return [];
   let manifest;
   try {
-    manifest = asRecord(JSON.parse(readFileSync10(manifestPath, "utf8")));
+    manifest = asRecord(JSON.parse(readFileSync11(manifestPath, "utf8")));
   } catch (err) {
-    rmSync5(checkpointDir, { recursive: true, force: true });
+    rmSync6(checkpointDir, { recursive: true, force: true });
     throw new Error(`invalid issue checkpoint manifest: ${err instanceof Error ? err.message : String(err)}`);
   }
   const expiresAt = Date.parse(readString(manifest.expiresAt) ?? "");
   if (!Number.isFinite(expiresAt) || expiresAt <= Date.now() || readString(manifest.issueId) !== commandIssueId(command)) {
-    rmSync5(checkpointDir, { recursive: true, force: true });
+    rmSync6(checkpointDir, { recursive: true, force: true });
     return [];
   }
   try {
     const files = Array.isArray(manifest.files) ? manifest.files : [];
     if (files.length > 20) throw new Error("issue checkpoint manifest exceeds the limit of 20 files");
-    const filesRoot = realpathSync5(join12(checkpointDir, "files"));
+    const filesRoot = realpathSync5(join13(checkpointDir, "files"));
     const workspaceRoot = realpathSync5(workspace.cwd);
     const validated = [];
     let totalBytes = 0;
@@ -15318,14 +15707,14 @@ async function materializeIssueCheckpoint(config, command, workspace) {
       const file = asRecord(rawFile);
       const relativePath = safeCheckpointRelativePath(readString(file.path));
       if (!relativePath) throw new Error("issue checkpoint manifest contains an invalid file path");
-      const sourceCandidate = resolve9(filesRoot, relativePath);
-      const target = resolve9(workspaceRoot, relativePath);
+      const sourceCandidate = resolve10(filesRoot, relativePath);
+      const target = resolve10(workspaceRoot, relativePath);
       if (!pathWithin2(sourceCandidate, filesRoot) || !pathWithin2(target, workspaceRoot)) {
         throw new Error(`issue checkpoint path escapes its workspace: ${relativePath}`);
       }
-      if (!existsSync11(sourceCandidate)) throw new Error(`issue checkpoint file is missing: ${relativePath}`);
+      if (!existsSync12(sourceCandidate)) throw new Error(`issue checkpoint file is missing: ${relativePath}`);
       const source = realpathSync5(sourceCandidate);
-      if (!pathWithin2(source, filesRoot) || !statSync8(source).isFile()) {
+      if (!pathWithin2(source, filesRoot) || !statSync9(source).isFile()) {
         throw new Error(`issue checkpoint source escapes its storage root: ${relativePath}`);
       }
       const expectedSha256 = readString(file.sha256);
@@ -15333,7 +15722,7 @@ async function materializeIssueCheckpoint(config, command, workspace) {
       if (!expectedSha256 || expectedByteSize === null || expectedByteSize <= 0) {
         throw new Error(`issue checkpoint evidence is incomplete: ${relativePath}`);
       }
-      if (hashFileSha256(source) !== expectedSha256 || statSync8(source).size !== expectedByteSize) {
+      if (hashFileSha256(source) !== expectedSha256 || statSync9(source).size !== expectedByteSize) {
         throw new Error(`issue checkpoint integrity mismatch: ${relativePath}`);
       }
       totalBytes += expectedByteSize;
@@ -15343,13 +15732,13 @@ async function materializeIssueCheckpoint(config, command, workspace) {
     const materialized = [];
     for (const { relativePath, source, target } of validated) {
       try {
-        lstatSync5(target);
+        lstatSync6(target);
         continue;
       } catch (err) {
         if (err?.code !== "ENOENT") throw err;
       }
-      mkdirSync7(dirname7(target), { recursive: true });
-      const targetParent = realpathSync5(dirname7(target));
+      mkdirSync8(dirname8(target), { recursive: true });
+      const targetParent = realpathSync5(dirname8(target));
       if (!pathWithin2(targetParent, workspaceRoot)) {
         throw new Error(`issue checkpoint target escapes its workspace: ${relativePath}`);
       }
@@ -15377,31 +15766,31 @@ async function materializeIssueCheckpoint(config, command, workspace) {
 }
 async function saveIssueCheckpoint(config, command, workspace, candidates) {
   const checkpointDir = issueCheckpointDir(workspace);
-  const filesDir = join12(checkpointDir, "files");
-  rmSync5(checkpointDir, { recursive: true, force: true });
-  mkdirSync7(filesDir, { recursive: true });
+  const filesDir = join13(checkpointDir, "files");
+  rmSync6(checkpointDir, { recursive: true, force: true });
+  mkdirSync8(filesDir, { recursive: true });
   const files = [];
   let totalBytes = 0;
   const workspaceRoot = realpathSync5(workspace.cwd);
   for (const candidate of candidates.slice(0, 20)) {
     const relativePath = safeCheckpointRelativePath(candidate.rawPath);
     const source = readString(candidate.filePath);
-    if (!relativePath || !source || !existsSync11(source) || !statSync8(source).isFile()) continue;
+    if (!relativePath || !source || !existsSync12(source) || !statSync9(source).isFile()) continue;
     const ownedSource = realpathSync5(source);
     if (!pathWithin2(ownedSource, workspaceRoot)) {
       throw new Error(`issue checkpoint source escapes its execution workspace: ${relativePath}`);
     }
-    const byteSize = statSync8(ownedSource).size;
+    const byteSize = statSync9(ownedSource).size;
     if (byteSize <= 0 || totalBytes + byteSize > MAX_CHECKPOINT_BYTES) continue;
-    const target = resolve9(filesDir, relativePath);
+    const target = resolve10(filesDir, relativePath);
     if (!pathWithin2(target, filesDir)) continue;
-    mkdirSync7(dirname7(target), { recursive: true });
+    mkdirSync8(dirname8(target), { recursive: true });
     copyFileSync2(ownedSource, target);
     totalBytes += byteSize;
     files.push({ path: relativePath, byteSize, sha256: hashFileSha256(ownedSource) });
   }
   if (files.length === 0) {
-    rmSync5(checkpointDir, { recursive: true, force: true });
+    rmSync6(checkpointDir, { recursive: true, force: true });
     return null;
   }
   const manifest = {
@@ -15413,7 +15802,7 @@ async function saveIssueCheckpoint(config, command, workspace, candidates) {
     totalBytes,
     files
   };
-  writeFileSync7(join12(checkpointDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
+  writeFileSync8(join13(checkpointDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
 `);
   await ingestLog(config, command, "system", "warn", `Saved ${files.length} required deliverable(s) for continuation recovery`, manifest);
   return manifest;
@@ -15507,7 +15896,7 @@ async function executeRunCommand(config, command) {
     });
   }
   await ingestWorkspaceStatus(config, command, cwd);
-  const sourceAcquisition = sourceAcquisitionRuntimeProfile(config, command);
+  const sourceAcquisition = await sourceAcquisitionRuntimeProfile(config, command);
   const promptCompilation = buildCommandPrompt(command, workspace, materializedAttachments, {
     runnerKind: config.runnerKind,
     executorKind: executor.kind,
@@ -15584,7 +15973,7 @@ async function executeRunCommand(config, command) {
           executorCommand: invocation.command,
           executorHome: workspace.executorHome,
           runDir: workspace.runDir,
-          runtimeCacheRoot: join12(dirname7(config.daemonStateFile), "cache"),
+          runtimeCacheRoot: join13(dirname8(config.daemonStateFile), "cache"),
           cwd,
           runtimeAuth: commandRuntimeAuth(command),
           nativeSession: asRecord(asRecord(command.payload).nativeSession),
@@ -15644,7 +16033,7 @@ async function executeRunCommand(config, command) {
     if (executor.kind === "pi" && piResolvedProviderConfig) {
       const sharedPiHome = readString(process.env.PI_CODING_AGENT_DIR) ?? readString(process.env.PI_AGENT_HOME) ?? null;
       let agentDir = managedMcpProfile ? readString(managedMcpProfile.env.PI_CODING_AGENT_DIR) ?? readString(managedMcpProfile.env.PI_AGENT_HOME) ?? null : desktopDelegatedRunnerEnabled(config) ? readString(executorEnv.PI_AGENT_HOME) ?? readString(executorEnv.PI_CODING_AGENT_DIR) ?? null : readString(executorEnv.PI_CODING_AGENT_DIR) ?? readString(executorEnv.PI_AGENT_HOME) ?? null;
-      if (agentDir && sharedPiHome && resolve9(agentDir) === resolve9(sharedPiHome)) {
+      if (agentDir && sharedPiHome && resolve10(agentDir) === resolve10(sharedPiHome)) {
         agentDir = null;
       }
       try {
@@ -15926,7 +16315,7 @@ async function executeRunCommand(config, command) {
           workspace,
           workspaceStatus.artifacts.map((artifact) => ({
             rawPath: artifact.relativePath,
-            filePath: resolve9(cwd, artifact.relativePath)
+            filePath: resolve10(cwd, artifact.relativePath)
           }))
         );
         nativeSessionRollout = {
@@ -16237,6 +16626,7 @@ async function executeRunCommand(config, command) {
     }
     return { resultDelivered: Boolean(completion) };
   } finally {
+    sourceAcquisition?.releaseBrowserLease?.();
     if (managedMcpProfile && !managedMcpCleanup && !completionOwnsManagedMcpProfile) {
       managedMcpCleanup = cleanupManagedMcpProfile(managedMcpProfile, {
         commandId: command.commandId,
@@ -16267,7 +16657,9 @@ async function processCommand(config, command) {
     }
     if (command.commandType === "browser_session") {
       await ackCommand(config, command, "spawned");
-      const result3 = await executeBrowserSessionCommand(command, {});
+      const result3 = await executeBrowserSessionCommand(command, {
+        broker: browserSessionBrokerFor(config)
+      });
       const failed = result3.outcome === "failed";
       await completeCommand(
         config,
@@ -16472,7 +16864,7 @@ async function runLoop(config) {
 ${message}
 `);
     }
-    await new Promise((resolve10) => setTimeout(resolve10, config.pollIntervalSeconds * 1e3));
+    await new Promise((resolve11) => setTimeout(resolve11, config.pollIntervalSeconds * 1e3));
   }
 }
 function help() {

package/dist/amaster-runtime.mjs

@@ -6,7 +6,7 @@ import { basename, dirname, join, resolve } from "node:path";
 import { homedir, hostname } from "node:os";
 import { fileURLToPath } from "node:url";
 
-const CONNECTOR_VERSION = "0.1.1-beta.67";
+const CONNECTOR_VERSION = "0.1.1-beta.69";
 
 const CAPABILITIES = [
   "remote_registration",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amaster.ai/employee-runtime-connector",
-  "version": "0.1.1-beta.67",
+  "version": "0.1.1-beta.69",
   "description": "MirrorX runtime connector CLI and daemon",
   "license": "MIT",
   "type": "module",
@@ -31,5 +31,7 @@
     "esbuild": "^0.27.3",
     "smol-toml": "1.7.0"
   },
-  "dependencies": {}
+  "dependencies": {
+    "playwright-core": "^1.58.2"
+  }
 }