@amaster.ai/employee-runtime-connector 0.1.1-beta.85 → 0.1.1-beta.87

package/dist/amaster-runtime-daemon.mjs

@@ -2,11 +2,11 @@
 // MirrorX runtime connector daemon bundle.
 
 // src/amaster-runtime-daemon.mjs
-import { createHash as createHash13 } from "node:crypto";
+import { createHash as createHash14 } from "node:crypto";
 import { createRequire } from "node:module";
-import { chmodSync as chmodSync6, copyFileSync as copyFileSync2, existsSync as existsSync12, lstatSync as lstatSync6, mkdirSync as mkdirSync8, mkdtempSync, readFileSync as readFileSync12, readdirSync as readdirSync9, realpathSync as realpathSync5, renameSync as renameSync7, rmSync as rmSync7, statSync as statSync9, symlinkSync as symlinkSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync9 } from "node:fs";
+import { chmodSync as chmodSync7, copyFileSync as copyFileSync2, existsSync as existsSync13, lstatSync as lstatSync7, mkdirSync as mkdirSync9, mkdtempSync as mkdtempSync2, readFileSync as readFileSync13, readdirSync as readdirSync10, realpathSync as realpathSync5, renameSync as renameSync8, rmSync as rmSync8, statSync as statSync9, symlinkSync as symlinkSync2, unlinkSync as unlinkSync3, writeFileSync as writeFileSync10 } from "node:fs";
 import { arch as arch3, homedir as homedir3, hostname as hostname2, platform as platform3, tmpdir } from "node:os";
-import { basename as basename6, delimiter as delimiter3, dirname as dirname9, extname as extname2, isAbsolute as isAbsolute6, join as join14, relative as relative7, resolve as resolve10 } from "node:path";
+import { basename as basename6, delimiter as delimiter3, dirname as dirname10, extname as extname3, isAbsolute as isAbsolute7, join as join15, relative as relative7, resolve as resolve11 } from "node:path";
 import { spawn, spawnSync as spawnSync5 } from "node:child_process";
 
 // src/amaster-runtime-daemon/common.mjs
@@ -762,7 +762,7 @@ function skipVoid(str, ptr, banNewLines, banComments) {
   }
   return ptr;
 }
-function skipUntil(str, ptr, sep3, end, banNewLines = false) {
+function skipUntil(str, ptr, sep4, end, banNewLines = false) {
   if (!end) {
     ptr = indexOfNewline(str, ptr);
     return ptr < 0 ? str.length : ptr;
@@ -771,7 +771,7 @@ function skipUntil(str, ptr, sep3, end, banNewLines = false) {
     let c = str[i];
     if (c === "#") {
       i = indexOfNewline(str, i);
-    } else if (c === sep3) {
+    } else if (c === sep4) {
       return i + 1;
     } else if (c === end || banNewLines && (c === "\n" || c === "\r" && str[i + 1] === "\n")) {
       return i;
@@ -3500,7 +3500,7 @@ function createManagedPiMcpProfileApi(options = {}) {
     if (!Number.isFinite(value)) throw new Error("pi_managed_mcp_attestation_failed: invalid attestation clock");
     return value;
   }
-  function sha2562(value) {
+  function sha2563(value) {
     return createHash3("sha256").update(value).digest("hex");
   }
   function trustedTreeDigest(rootPath, options2 = {}) {
@@ -3590,20 +3590,20 @@ function createManagedPiMcpProfileApi(options = {}) {
       const loaderPath = join5(cursor, "dist", "core", "extensions", "loader.js");
       if (existsSync3(packagePath) && existsSync3(loaderPath)) {
         const packageJson = JSON.parse(readFileSync4(packagePath, "utf8"));
-        return sha2562(stablePiJson({
+        return sha2563(stablePiJson({
           name: packageJson.name,
           version: packageJson.version,
-          loaderSha256: sha2562(readFileSync4(loaderPath))
+          loaderSha256: sha2563(readFileSync4(loaderPath))
         }));
       }
       cursor = dirname4(cursor);
     }
-    return sha2562(readFileSync4(realpathSync2(executorPath)));
+    return sha2563(readFileSync4(realpathSync2(executorPath)));
   }
   function effectiveToolsBootstrapKey(input, sharedRuntime, executorCommand) {
     const adapterRoot = join5(sharedRuntime.home, "npm", "node_modules", "pi-mcp-adapter");
     const resolvedExecutorCommand = resolvePiExecutablePath(executorCommand, input.baseEnv);
-    return sha2562(stablePiJson({
+    return sha2563(stablePiJson({
       schemaVersion: PI_EFFECTIVE_TOOLS_BOOTSTRAP_SCHEMA_VERSION,
       connectorVersion: nonEmpty2(input.connectorVersion, "connectorVersion"),
       executorIdentity: piExecutableIdentity(resolvedExecutorCommand),
@@ -3617,8 +3617,8 @@ function createManagedPiMcpProfileApi(options = {}) {
       // source; hash every package-owned adapter file while excluding that
       // dependency graph so ordinary npm links do not make the cache unusable.
       adapterTreeSha256: trustedTreeDigest(adapterRoot, { ignoredRootEntries: ["node_modules"] }),
-      attestorSourceSha256: sha2562(managedPiEffectiveToolsAttestorExtensionSource()),
-      argsNormalizerSourceSha256: sha2562(managedPiMcpArgsNormalizerExtensionSource())
+      attestorSourceSha256: sha2563(managedPiEffectiveToolsAttestorExtensionSource()),
+      argsNormalizerSourceSha256: sha2563(managedPiMcpArgsNormalizerExtensionSource())
     }));
   }
   function prepareEffectiveToolsBootstrapCache(input, sharedRuntime, executorCommand, tmpPath) {
@@ -3729,7 +3729,7 @@ function createManagedPiMcpProfileApi(options = {}) {
   }
   function adapterServerConfigHash(definition, adapterVersion) {
     const identity2 = piMcpAdapterServerConfigIdentity(definition, adapterVersion);
-    return sha2562(stablePiJson(identity2));
+    return sha2563(stablePiJson(identity2));
   }
   function validateDirectCatalog(gateway, mcpToolMode) {
     const catalog = record6(gateway.toolCatalog);
@@ -4399,10 +4399,10 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
     if (receipt.status !== "attested" || receipt.mode !== "probe" || receipt.proxyMode !== input.proxyMode || receipt.proxyPresent !== expectedProxyPresent || receipt.effectiveSetHash !== input.effectiveSetHash || receipt.attestorSourceSha256 !== input.attestorSourceSha256 || receipt.configSha256 !== input.configSha256 || receipt.cacheSha256 !== input.cacheSha256) {
       throw new Error("pi_managed_mcp_effective_tools_failed: probe receipt mismatch");
     }
-    if (sha2562(readFileSync4(input.configPath)) !== input.configSha256) {
+    if (sha2563(readFileSync4(input.configPath)) !== input.configSha256) {
       throw new Error("pi_managed_mcp_effective_tools_failed: config drifted during probe");
     }
-    if (sha2562(readFileSync4(input.cachePath)) !== input.cacheSha256) {
+    if (sha2563(readFileSync4(input.cachePath)) !== input.cacheSha256) {
       throw new Error("pi_managed_mcp_effective_tools_failed: cache drifted during probe");
     }
     if (circuitKey) effectiveToolsProbeCircuits.delete(circuitKey);
@@ -4411,7 +4411,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
       effectiveToolProxyMode: receipt.proxyMode,
       effectiveToolProxyPresent: receipt.proxyPresent,
       effectiveToolSetHash: receipt.effectiveSetHash,
-      effectiveToolProbeDigest: sha2562(stablePiJson(receipt)),
+      effectiveToolProbeDigest: sha2563(stablePiJson(receipt)),
       effectiveToolProbeAt: receipt.attestedAt,
       effectiveToolProbeElapsedMs: elapsedMs,
       effectiveToolProbeTimeoutMs: PI_EFFECTIVE_TOOLS_ATTESTATION_TIMEOUT_MS,
@@ -4548,8 +4548,8 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         };
         writeOwnedFileAtomic(cachePath, `${JSON.stringify(cache, null, 2)}
 `);
-        const cacheSha256 = sha2562(readFileSync4(cachePath));
-        const attestorSourceSha256 = sha2562(managedPiEffectiveToolsAttestorExtensionSource());
+        const cacheSha256 = sha2563(readFileSync4(cachePath));
+        const attestorSourceSha256 = sha2563(managedPiEffectiveToolsAttestorExtensionSource());
         const manifestPath = join5(profileRoot, "effective-tools-manifest.json");
         const receiptPath = join5(tmp, "effective-tools-receipt.json");
         const phasePath = join5(tmp, "effective-tools-phase.json");
@@ -4568,7 +4568,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
           }))),
           proxyMode: "forbidden",
           attestorSourceSha256,
-          configSha256: sha2562(readFileSync4(configPath)),
+          configSha256: sha2563(readFileSync4(configPath)),
           cacheSha256,
           cacheSemanticHash: stablePiManagedMcpCacheSemanticHash(readFileSync4(cachePath))
         };
@@ -4616,19 +4616,19 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
               name: tool.exposedName,
               schemaHash: tool.effectiveSchemaHash
             }))),
-            configSha256: sha2562(closureConfigBytes),
-            cacheSha256: sha2562(closureCacheBytes),
+            configSha256: sha2563(closureConfigBytes),
+            cacheSha256: sha2563(closureCacheBytes),
             cacheSemanticHash: stablePiManagedMcpCacheSemanticHash(closureCacheBytes)
           }, null, 2)}
 `;
           return {
             toolAllowlist: closureToolNames,
             cacheContentsBase64: closureCacheBytes.toString("base64"),
-            cacheSha256: sha2562(closureCacheBytes),
+            cacheSha256: sha2563(closureCacheBytes),
             manifestContentsBase64: Buffer.from(closureManifestContents).toString("base64"),
-            manifestSha256: sha2562(Buffer.from(closureManifestContents)),
+            manifestSha256: sha2563(Buffer.from(closureManifestContents)),
             configContentsBase64: closureConfigBytes.toString("base64"),
-            configSha256: sha2562(closureConfigBytes)
+            configSha256: sha2563(closureConfigBytes)
           };
         })() : null;
         directAttestationInput = {
@@ -4639,7 +4639,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
           cacheSha256,
           cacheContentsBase64: Buffer.from(readFileSync4(cachePath)).toString("base64"),
           configPath,
-          configSha256: sha2562(readFileSync4(configPath)),
+          configSha256: sha2563(readFileSync4(configPath)),
           attestorSourceSha256,
           effectiveSetHash: manifest.effectiveSetHash,
           proxyMode: manifest.proxyMode,
@@ -4758,7 +4758,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
             cacheContentsBase64: directAttestationInput.cacheContentsBase64,
             cacheOwnership: runExitClosureOwnership ? { uid: runExitClosureOwnership.cache.uid, gid: runExitClosureOwnership.cache.gid } : null,
             manifestPath: directAttestationInput.manifestPath,
-            manifestSha256: sha2562(readFileSync4(directAttestationInput.manifestPath)),
+            manifestSha256: sha2563(readFileSync4(directAttestationInput.manifestPath)),
             configPath: directAttestationInput.configPath,
             configSha256: directAttestationInput.configSha256,
             receiptPath: directAttestationInput.receiptPath,
@@ -4827,7 +4827,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
     );
     const cacheContents = Buffer.from(cacheContentsBase64, "base64");
     const cacheSha256 = nonEmpty2(baseline.cacheSha256, "runExitClosureBaseline.cacheSha256");
-    if (sha2562(cacheContents) !== cacheSha256) {
+    if (sha2563(cacheContents) !== cacheSha256) {
       throw new Error("pi_run_exit_closure_baseline_cache_digest_mismatch");
     }
     const baselineCacheOwnership = record6(baseline.cacheOwnership);
@@ -4840,7 +4840,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
     if (closureToolAllowlist && (closureToolAllowlist.length !== RUN_EXIT_CLOSURE_DIRECT_TYPED_TOOL_NAMES.size || new Set(closureToolAllowlist).size !== RUN_EXIT_CLOSURE_DIRECT_TYPED_TOOL_NAMES.size || closureToolAllowlist.some((name) => !PROVIDER_SAFE_TOOL_NAME.test(name)))) {
       throw new Error("pi_run_exit_closure_baseline_tool_allowlist_invalid");
     }
-    const currentManifestSha256 = sha2562(readFileSync4(manifestPath));
+    const currentManifestSha256 = sha2563(readFileSync4(manifestPath));
     const acceptedManifestDigests = /* @__PURE__ */ new Set([
       nonEmpty2(baseline.manifestSha256, "runExitClosureBaseline.manifestSha256"),
       ...closureProfile ? [nonEmpty2(closureProfile.manifestSha256, "closureProfile.manifestSha256")] : []
@@ -4848,7 +4848,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
     if (!acceptedManifestDigests.has(currentManifestSha256)) {
       throw new Error("pi_run_exit_closure_baseline_manifest_drift");
     }
-    const currentConfigSha256 = sha2562(readFileSync4(configPath));
+    const currentConfigSha256 = sha2563(readFileSync4(configPath));
     const acceptedConfigDigests = /* @__PURE__ */ new Set([
       nonEmpty2(baseline.configSha256, "runExitClosureBaseline.configSha256"),
       ...closureProfile ? [nonEmpty2(closureProfile.configSha256, "closureProfile.configSha256")] : []
@@ -4887,7 +4887,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
     }];
     if (existsSync3(receiptPath)) rmSync3(receiptPath);
     for (const entry of phaseContents) {
-      if (sha2562(entry.bytes) !== entry.expectedSha256) {
+      if (sha2563(entry.bytes) !== entry.expectedSha256) {
         throw new Error(`pi_run_exit_closure_${entry.label}_digest_mismatch`);
       }
       const recordedOwnership = Number.isSafeInteger(entry.ownership.uid) && entry.ownership.uid >= 0 && Number.isSafeInteger(entry.ownership.gid) && entry.ownership.gid >= 0 ? { uid: entry.ownership.uid, gid: entry.ownership.gid } : entry.path === cachePath ? cacheOwnership : ownershipStatSyncImpl(entry.path);
@@ -4896,7 +4896,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
       if (replacedStat.uid !== recordedOwnership.uid || replacedStat.gid !== recordedOwnership.gid) {
         chownSyncImpl(entry.path, recordedOwnership.uid, recordedOwnership.gid);
       }
-      if (sha2562(readFileSync4(entry.path)) !== entry.expectedSha256) {
+      if (sha2563(readFileSync4(entry.path)) !== entry.expectedSha256) {
         throw new Error(`pi_run_exit_closure_${entry.label}_restore_failed`);
       }
       const restoredStat = ownershipStatSyncImpl(entry.path);
@@ -5038,7 +5038,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         sessionId: gateway.sessionId,
         sourcePiHome,
         piCodingAgentDir,
-        configSha256: sha2562(readFileSync4(configPath)),
+        configSha256: sha2563(readFileSync4(configPath)),
         ...skillProfilesAttestation(skillProfiles, enabledRoleSkills)
       };
       return {
@@ -8978,9 +8978,9 @@ function governedMcpToolResult(structuredContent) {
   const intentId = readString(effectResult.artifactIntentId);
   const manifestId = readString(effectResult.manifestId);
   const sourceRelativePath = readString(effectResult.sourceRelativePath);
-  const sha2562 = readString(effectResult.sha256);
+  const sha2563 = readString(effectResult.sha256);
   const byteSize = readNumber(effectResult.byteSize, 0);
-  const artifactIntent = providerStatus === "pending_reconcile" && intentId && manifestId && sourceRelativePath && /^[a-f0-9]{64}$/.test(sha2562 ?? "") && Number.isSafeInteger(byteSize) && byteSize > 0 ? { intentId, manifestId, sourceRelativePath, sha256: sha2562, byteSize } : null;
+  const artifactIntent = providerStatus === "pending_reconcile" && intentId && manifestId && sourceRelativePath && /^[a-f0-9]{64}$/.test(sha2563 ?? "") && Number.isSafeInteger(byteSize) && byteSize > 0 ? { intentId, manifestId, sourceRelativePath, sha256: sha2563, byteSize } : null;
   const workspaceDocumentEffect = asRecord(effectResult.workspaceDocumentIntent);
   const workspaceDocumentCallId = readString(workspaceDocumentEffect.callId);
   const workspaceDocumentManifestId = readString(workspaceDocumentEffect.manifestId);
@@ -10013,7 +10013,7 @@ async function postRuntimeConnectorJsonWithRetry(config, path, payload, options
     } catch (error) {
       lastError = error;
       if (attempt >= maxAttempts || !retryableRuntimeConnectorPost(error)) throw error;
-      if (delayMs > 0) await new Promise((resolve11) => setTimeout(resolve11, delayMs));
+      if (delayMs > 0) await new Promise((resolve12) => setTimeout(resolve12, delayMs));
     }
   }
   throw lastError;
@@ -10245,9 +10245,9 @@ function createRuntimeDocumentIngestQueue({ ingest }) {
   let queue = Promise.resolve();
   const documentIdentity = (intent) => {
     const sourceRelativePath = readString(asRecord(intent).sourceRelativePath);
-    const sha2562 = readString(asRecord(intent).sha256);
+    const sha2563 = readString(asRecord(intent).sha256);
     const byteSize = asRecord(intent).byteSize;
-    return sourceRelativePath && sha2562 && Number.isSafeInteger(byteSize) && byteSize > 0 ? `document:${sourceRelativePath}\0${sha2562}\0${byteSize}` : null;
+    return sourceRelativePath && sha2563 && Number.isSafeInteger(byteSize) && byteSize > 0 ? `document:${sourceRelativePath}\0${sha2563}\0${byteSize}` : null;
   };
   const retainReceipts = (nextReceipts) => {
     receipts.push(...nextReceipts);
@@ -10322,9 +10322,9 @@ function createRuntimeArtifactIngestQueue({ ingest, onError }) {
   let queue = Promise.resolve();
   const artifactIdentity = (intent) => {
     const sourceRelativePath = readString(asRecord(intent).sourceRelativePath);
-    const sha2562 = readString(asRecord(intent).sha256);
+    const sha2563 = readString(asRecord(intent).sha256);
     const byteSize = asRecord(intent).byteSize;
-    return sourceRelativePath && sha2562 && Number.isSafeInteger(byteSize) && byteSize > 0 ? `${sourceRelativePath}\0${sha2562}\0${byteSize}` : null;
+    return sourceRelativePath && sha2563 && Number.isSafeInteger(byteSize) && byteSize > 0 ? `${sourceRelativePath}\0${sha2563}\0${byteSize}` : null;
   };
   const retainReceipts = (receipts) => {
     artifacts.push(...receipts);
@@ -10691,12 +10691,159 @@ function planManagedWorkspaceGcDryRun(input) {
   return result3;
 }
 
+// src/amaster-runtime-daemon/preset-templates.mjs
+import { createHash as createHash11 } from "node:crypto";
+import {
+  chmodSync as chmodSync5,
+  existsSync as existsSync9,
+  lstatSync as lstatSync5,
+  mkdirSync as mkdirSync7,
+  mkdtempSync,
+  readFileSync as readFileSync10,
+  readdirSync as readdirSync7,
+  renameSync as renameSync7,
+  rmSync as rmSync6,
+  unlinkSync as unlinkSync2,
+  writeFileSync as writeFileSync8
+} from "node:fs";
+import { dirname as dirname7, extname, isAbsolute as isAbsolute5, join as join11, parse as parse2, resolve as resolve7, sep as sep3 } from "node:path";
+import { fileURLToPath } from "node:url";
+var PRESET_TEMPLATE_MANIFEST_FILE = ".mirrorx-preset-templates.json";
+var MAX_PRESET_TEMPLATE_FILES = 256;
+var MAX_PRESET_TEMPLATE_FILE_BYTES = 20 * 1024 * 1024;
+var MAX_PRESET_TEMPLATE_TOTAL_BYTES = 50 * 1024 * 1024;
+function sha2562(value) {
+  return createHash11("sha256").update(value).digest("hex");
+}
+function lstatIfExists(path) {
+  try {
+    return lstatSync5(path);
+  } catch (error) {
+    if (error?.code === "ENOENT") return null;
+    throw error;
+  }
+}
+function validTemplateName(value) {
+  return typeof value === "string" && value.length > 0 && value !== "." && value !== ".." && !value.includes("\0") && !value.includes("/") && !value.includes("\\") && !isAbsolute5(value) && parse2(value).base === value && extname(value).toLowerCase() === ".md";
+}
+function readManifest(manifestPath, { strict }) {
+  try {
+    const parsed = JSON.parse(readFileSync10(manifestPath, "utf8"));
+    if (parsed?.schemaVersion !== 1 || !Array.isArray(parsed.files)) {
+      throw new Error("preset_template_bundle_manifest_invalid");
+    }
+    if (parsed.files.length > MAX_PRESET_TEMPLATE_FILES) {
+      throw new Error("preset_template_bundle_file_limit_exceeded");
+    }
+    const seen = /* @__PURE__ */ new Set();
+    let totalBytes = 0;
+    const files = parsed.files.map((file) => {
+      if (!validTemplateName(file?.name) || !Number.isSafeInteger(file?.bytes) || file.bytes < 0 || file.bytes > MAX_PRESET_TEMPLATE_FILE_BYTES || typeof file?.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(file.sha256) || seen.has(file.name)) {
+        throw new Error("preset_template_bundle_manifest_invalid");
+      }
+      seen.add(file.name);
+      totalBytes += file.bytes;
+      if (totalBytes > MAX_PRESET_TEMPLATE_TOTAL_BYTES) {
+        throw new Error("preset_template_bundle_size_limit_exceeded");
+      }
+      return { name: file.name, bytes: file.bytes, sha256: file.sha256 };
+    });
+    return { schemaVersion: 1, files, totalBytes };
+  } catch (error) {
+    if (strict) throw error;
+    return { schemaVersion: 1, files: [], totalBytes: 0 };
+  }
+}
+function verifiedBundleFiles(sourceDir, manifest) {
+  return manifest.files.map((entry) => {
+    const sourcePath = join11(sourceDir, entry.name);
+    const stat = lstatSync5(sourcePath);
+    if (!stat.isFile() || stat.isSymbolicLink()) {
+      throw new Error(`preset_template_bundle_file_unsafe: ${entry.name}`);
+    }
+    const body = readFileSync10(sourcePath);
+    if (body.byteLength !== entry.bytes || sha2562(body) !== entry.sha256) {
+      throw new Error(`preset_template_bundle_digest_mismatch: ${entry.name}`);
+    }
+    return { ...entry, body };
+  });
+}
+function removeRetiredPresetFiles(targetDir, previousManifest, nextNames) {
+  for (const entry of previousManifest.files) {
+    if (nextNames.has(entry.name)) continue;
+    const targetPath = join11(targetDir, entry.name);
+    if (!existsSync9(targetPath)) continue;
+    const stat = lstatSync5(targetPath);
+    if (stat.isDirectory()) {
+      throw new Error(`preset_template_target_conflict: ${entry.name}`);
+    }
+    unlinkSync2(targetPath);
+  }
+}
+function materializeBundledPresetTemplates(input) {
+  const sourceDir = resolve7(input.sourceDir);
+  const targetDir = resolve7(input.targetDir);
+  if (sourceDir === targetDir || sourceDir.startsWith(`${targetDir}${sep3}`) || targetDir.startsWith(`${sourceDir}${sep3}`)) {
+    throw new Error("preset_template_source_target_overlap");
+  }
+  const manifest = readManifest(join11(sourceDir, PRESET_TEMPLATE_MANIFEST_FILE), { strict: true });
+  const verifiedFiles = verifiedBundleFiles(sourceDir, manifest);
+  mkdirSync7(dirname7(targetDir), { recursive: true, mode: 493 });
+  const targetStat = lstatIfExists(targetDir);
+  if (targetStat && (!targetStat.isDirectory() || targetStat.isSymbolicLink())) {
+    throw new Error("preset_template_target_root_unsafe");
+  }
+  mkdirSync7(targetDir, { recursive: true, mode: 493 });
+  const previousManifest = readManifest(join11(targetDir, PRESET_TEMPLATE_MANIFEST_FILE), { strict: false });
+  const stageDir = mkdtempSync(join11(dirname7(targetDir), ".mirrorx-preset-templates-"));
+  try {
+    for (const file of verifiedFiles) {
+      const stagedPath = join11(stageDir, file.name);
+      writeFileSync8(stagedPath, file.body, { mode: 292 });
+      chmodSync5(stagedPath, 292);
+      renameSync7(stagedPath, join11(targetDir, file.name));
+    }
+    removeRetiredPresetFiles(targetDir, previousManifest, new Set(manifest.files.map((file) => file.name)));
+    const stagedManifest = join11(stageDir, PRESET_TEMPLATE_MANIFEST_FILE);
+    writeFileSync8(stagedManifest, `${JSON.stringify({
+      schemaVersion: manifest.schemaVersion,
+      files: manifest.files
+    }, null, 2)}
+`, { mode: 292 });
+    chmodSync5(stagedManifest, 292);
+    renameSync7(stagedManifest, join11(targetDir, PRESET_TEMPLATE_MANIFEST_FILE));
+  } finally {
+    rmSync6(stageDir, { recursive: true, force: true });
+  }
+  chmodSync5(targetDir, 493);
+  return {
+    fileCount: manifest.files.length,
+    totalBytes: manifest.totalBytes,
+    targetDir
+  };
+}
+function runtimePresetTemplateTarget(env = process.env) {
+  const configured = typeof env.AMASTER_RUNTIME_TEMPLATES_ROOT === "string" ? env.AMASTER_RUNTIME_TEMPLATES_ROOT.trim() : "";
+  if (configured) return resolve7(configured);
+  const piHome = typeof env.PI_CODING_AGENT_DIR === "string" ? resolve7(env.PI_CODING_AGENT_DIR) : null;
+  return piHome === "/data/.pi" ? "/data/templates" : null;
+}
+function materializeRuntimePresetTemplates(env = process.env, options = {}) {
+  const targetDir = options.targetDir ?? runtimePresetTemplateTarget(env);
+  if (!targetDir) return { status: "skipped", reason: "not_pi_cli_runtime" };
+  const sourceDir = options.sourceDir ?? fileURLToPath(new URL("./templates/", import.meta.url));
+  return {
+    status: "ready",
+    ...materializeBundledPresetTemplates({ sourceDir, targetDir })
+  };
+}
+
 // src/amaster-runtime-daemon/runtime-status-summary.mjs
-import { existsSync as existsSync9, readdirSync as readdirSync7, statSync as statSync6 } from "node:fs";
-import { dirname as dirname7, join as join11, resolve as resolve7 } from "node:path";
+import { existsSync as existsSync10, readdirSync as readdirSync8, statSync as statSync6 } from "node:fs";
+import { dirname as dirname8, join as join12, resolve as resolve8 } from "node:path";
 function runtimeStatusDirectoryEntries(path) {
   try {
-    return readdirSync7(path, { withFileTypes: true });
+    return readdirSync8(path, { withFileTypes: true });
   } catch {
     return [];
   }
@@ -10716,7 +10863,7 @@ function runtimeStatusDirectorySizeBytes(path) {
     if (!stat || stat.isSymbolicLink()) continue;
     if (stat.isDirectory()) {
       for (const entry of runtimeStatusDirectoryEntries(current)) {
-        stack.push(join11(current, entry.name));
+        stack.push(join12(current, entry.name));
       }
       continue;
     }
@@ -10726,15 +10873,15 @@ function runtimeStatusDirectorySizeBytes(path) {
 }
 function walkRuntimeStatusManagedWorkdirs(root) {
   const workdirs = [];
-  if (!root || !existsSync9(root)) return workdirs;
+  if (!root || !existsSync10(root)) return workdirs;
   const stack = [root];
   while (stack.length > 0) {
     const current = stack.pop();
     if (!current) continue;
     for (const entry of runtimeStatusDirectoryEntries(current)) {
       if (!entry.isDirectory()) continue;
-      const fullPath = join11(current, entry.name);
-      if (entry.name === "workdir" && existsSync9(workspaceManifestPath(fullPath))) {
+      const fullPath = join12(current, entry.name);
+      if (entry.name === "workdir" && existsSync10(workspaceManifestPath(fullPath))) {
         workdirs.push(fullPath);
         continue;
       }
@@ -10775,25 +10922,25 @@ function summarizeRuntimeStatusRecentRun(workdir, manifest) {
 }
 function runtimeStatusOutboxDir(config) {
   const statePath = config.AMASTER_DAEMON_STATE_FILE ?? config.daemonStateFile;
-  return join11(dirname7(stateFilePath({
+  return join12(dirname8(stateFilePath({
     AMASTER_DAEMON_STATE_FILE: statePath
   })), "result-outbox");
 }
 function runtimeStatusRunCompletionDir(config) {
   const explicit = config.AMASTER_RUN_COMPLETION_STATE_DIR ?? config.runCompletionStateDir;
-  if (typeof explicit === "string" && explicit.trim()) return resolve7(explicit);
+  if (typeof explicit === "string" && explicit.trim()) return resolve8(explicit);
   const statePath = config.AMASTER_DAEMON_STATE_FILE ?? config.daemonStateFile;
-  return join11(dirname7(stateFilePath({
+  return join12(dirname8(stateFilePath({
     AMASTER_DAEMON_STATE_FILE: statePath
   })), "run-completion-state");
 }
 function countRuntimeStatusJsonEntries(dir) {
-  if (!existsSync9(dir)) return 0;
+  if (!existsSync10(dir)) return 0;
   return runtimeStatusDirectoryEntries(dir).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).length;
 }
 function summarizeRuntimeLocalState(input) {
   const config = input.config ?? {};
-  const root = resolve7(String(config.AMASTER_RUNTIME_WORKSPACES_ROOT ?? config.runtimeWorkspacesRoot ?? input.runtimeWorkspacesRoot ?? ""));
+  const root = resolve8(String(config.AMASTER_RUNTIME_WORKSPACES_ROOT ?? config.runtimeWorkspacesRoot ?? input.runtimeWorkspacesRoot ?? ""));
   const now = input.now instanceof Date ? input.now : /* @__PURE__ */ new Date();
   const workdirs = walkRuntimeStatusManagedWorkdirs(root);
   let managedWorkdirBytes = 0;
@@ -10820,9 +10967,9 @@ function summarizeRuntimeLocalState(input) {
     }
   }
   const pendingOutboxDir = runtimeStatusOutboxDir(config);
-  const invalidOutboxDir = join11(pendingOutboxDir, "invalid");
+  const invalidOutboxDir = join12(pendingOutboxDir, "invalid");
   const pendingRunCompletionDir = runtimeStatusRunCompletionDir(config);
-  const invalidRunCompletionDir = join11(pendingRunCompletionDir, "invalid");
+  const invalidRunCompletionDir = join12(pendingRunCompletionDir, "invalid");
   return {
     managedWorkspacesRoot: root,
     managedWorkdirCount: workdirs.length,
@@ -10945,9 +11092,9 @@ function summarizeAmasterRuntimeVersionDrift(input = {}) {
 
 // src/amaster-runtime-daemon/workspace-status.mjs
 import { spawnSync as spawnSync4 } from "node:child_process";
-import { createHash as createHash11 } from "node:crypto";
-import { existsSync as existsSync10, readdirSync as readdirSync8, readFileSync as readFileSync10, statSync as statSync7 } from "node:fs";
-import { basename as basename5, extname, isAbsolute as isAbsolute5, join as join12, relative as relative5, resolve as resolve8 } from "node:path";
+import { createHash as createHash12 } from "node:crypto";
+import { existsSync as existsSync11, readdirSync as readdirSync9, readFileSync as readFileSync11, statSync as statSync7 } from "node:fs";
+import { basename as basename5, extname as extname2, isAbsolute as isAbsolute6, join as join13, relative as relative5, resolve as resolve9 } from "node:path";
 var WORKSPACE_RUNTIME_SERVICES_FILENAME = ".amaster-runtime-services.json";
 var ARTIFACT_EXTENSIONS = /* @__PURE__ */ new Map([
   [".md", "markdown"],
@@ -10993,7 +11140,7 @@ var SAFE_RUNTIME_SERVICE_HEALTH_STATUSES = /* @__PURE__ */ new Set(["unknown", "
 var SAFE_RUNTIME_SERVICE_LIFECYCLES = /* @__PURE__ */ new Set(["shared", "ephemeral"]);
 function statusPathWithin(candidate, root) {
   const rel = relative5(root, candidate);
-  return rel === "" || !rel.startsWith("..") && !isAbsolute5(rel);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute6(rel);
 }
 function normalizeRelativePath(root, filePath) {
   return relative5(root, filePath).split(/[\\/]+/).join("/");
@@ -11016,7 +11163,7 @@ function sanitizeTrackedChange(line) {
   return isSafeRelativePath(path) ? line : null;
 }
 function sha256File(filePath) {
-  return createHash11("sha256").update(readFileSync10(filePath)).digest("hex");
+  return createHash12("sha256").update(readFileSync11(filePath)).digest("hex");
 }
 function artifactHashCacheKey(relativePath, stat) {
   return `${relativePath}\0${stat.size}\0${stat.mtimeMs}`;
@@ -11044,7 +11191,7 @@ function artifactSha256(filePath, relativePath, stat, opts = {}) {
   return hash;
 }
 function scanArtifactCandidates(cwd, opts = {}) {
-  const root = resolve8(cwd);
+  const root = resolve9(cwd);
   const maxCandidates = opts.maxCandidates ?? MAX_CANDIDATES;
   const maxEntries = opts.maxEntries ?? MAX_SCAN_ENTRIES;
   const candidates = [];
@@ -11054,7 +11201,7 @@ function scanArtifactCandidates(cwd, opts = {}) {
     const current = stack.pop();
     let entries;
     try {
-      entries = readdirSync8(current, { withFileTypes: true });
+      entries = readdirSync9(current, { withFileTypes: true });
     } catch {
       continue;
     }
@@ -11065,7 +11212,7 @@ function scanArtifactCandidates(cwd, opts = {}) {
       if (entry.name.startsWith(".") && entry.name !== ".amaster-runtime.json") {
         if (entry.name === ".git") continue;
       }
-      const fullPath = join12(current, entry.name);
+      const fullPath = join13(current, entry.name);
       const relativePath = normalizeRelativePath(root, fullPath);
       if (!isSafeRelativePath(relativePath)) continue;
       if (basename5(relativePath) === ".amaster-runtime.json") continue;
@@ -11075,7 +11222,7 @@ function scanArtifactCandidates(cwd, opts = {}) {
         continue;
       }
       if (!entry.isFile()) continue;
-      const ext = extname(entry.name).toLowerCase();
+      const ext = extname2(entry.name).toLowerCase();
       const type = ARTIFACT_EXTENSIONS.get(ext) ?? "file";
       let stat;
       try {
@@ -11083,7 +11230,7 @@ function scanArtifactCandidates(cwd, opts = {}) {
       } catch {
         continue;
       }
-      if (!statusPathWithin(resolve8(fullPath), root) || stat.size > MAX_HASH_BYTES) continue;
+      if (!statusPathWithin(resolve9(fullPath), root) || stat.size > MAX_HASH_BYTES) continue;
       candidates.push({
         relativePath,
         name: basename5(fullPath),
@@ -11143,10 +11290,10 @@ function sanitizeRuntimeService(entry) {
   };
 }
 function readRuntimeServicesSnapshot(cwd) {
-  const snapshotPath = join12(resolve8(cwd), WORKSPACE_RUNTIME_SERVICES_FILENAME);
-  if (!existsSync10(snapshotPath)) return [];
+  const snapshotPath = join13(resolve9(cwd), WORKSPACE_RUNTIME_SERVICES_FILENAME);
+  if (!existsSync11(snapshotPath)) return [];
   try {
-    const parsed = JSON.parse(readFileSync10(snapshotPath, "utf8"));
+    const parsed = JSON.parse(readFileSync11(snapshotPath, "utf8"));
     const rawServices = Array.isArray(parsed) ? parsed : Array.isArray(parsed?.services) ? parsed.services : [];
     return rawServices.map((entry) => sanitizeRuntimeService(entry)).filter((entry) => entry !== null).slice(0, 50);
   } catch {
@@ -11376,18 +11523,18 @@ async function executeBrowserSessionCommand(command, dependencies = {}) {
 }
 
 // src/amaster-runtime-daemon/browser-session-broker.mjs
-import { createHash as createHash12 } from "node:crypto";
+import { createHash as createHash13 } from "node:crypto";
 import {
-  chmodSync as chmodSync5,
-  existsSync as existsSync11,
-  lstatSync as lstatSync5,
-  mkdirSync as mkdirSync7,
-  readFileSync as readFileSync11,
-  rmSync as rmSync6,
+  chmodSync as chmodSync6,
+  existsSync as existsSync12,
+  lstatSync as lstatSync6,
+  mkdirSync as mkdirSync8,
+  readFileSync as readFileSync12,
+  rmSync as rmSync7,
   statSync as statSync8,
-  writeFileSync as writeFileSync8
+  writeFileSync as writeFileSync9
 } from "node:fs";
-import { dirname as dirname8, join as join13, relative as relative6, resolve as resolve9 } from "node:path";
+import { dirname as dirname9, join as join14, relative as relative6, resolve as resolve10 } from "node:path";
 var MARKER_NAME = ".amaster-browser-session.json";
 var HUMAN_LEASE_HARD_CAP_MS = 2 * 60 * 60 * 1e3;
 function brokerError(code) {
@@ -11407,19 +11554,19 @@ function ensureExecutable(path) {
   }
 }
 function ensurePrivateRoot(stateRoot) {
-  const root = resolve9(stateRoot);
-  if (existsSync11(root) && lstatSync5(root).isSymbolicLink()) {
+  const root = resolve10(stateRoot);
+  if (existsSync12(root) && lstatSync6(root).isSymbolicLink()) {
     throw brokerError("browser_session_profile_root_symlink");
   }
-  mkdirSync7(root, { recursive: true, mode: 448 });
-  chmodSync5(root, 448);
-  if (lstatSync5(root).isSymbolicLink()) {
+  mkdirSync8(root, { recursive: true, mode: 448 });
+  chmodSync6(root, 448);
+  if (lstatSync6(root).isSymbolicLink()) {
     throw brokerError("browser_session_profile_root_symlink");
   }
   return root;
 }
 function profileName(payload) {
-  return createHash12("sha256").update(`${payload.companyId}\0${payload.bindingId}\0${payload.localOpaqueRef}`).digest("hex");
+  return createHash13("sha256").update(`${payload.companyId}\0${payload.bindingId}\0${payload.localOpaqueRef}`).digest("hex");
 }
 function expectedOwner(payload) {
   return {
@@ -11433,30 +11580,30 @@ function expectedOwner(payload) {
 }
 function exactProfile(stateRoot, payload, { create = false } = {}) {
   const root = ensurePrivateRoot(stateRoot);
-  const profilePath = resolve9(root, profileName(payload));
-  if (!pathWithin3(profilePath, root) || dirname8(profilePath) !== root) {
+  const profilePath = resolve10(root, profileName(payload));
+  if (!pathWithin3(profilePath, root) || dirname9(profilePath) !== root) {
     throw brokerError("browser_session_profile_path_invalid");
   }
-  if (existsSync11(profilePath) && lstatSync5(profilePath).isSymbolicLink()) {
+  if (existsSync12(profilePath) && lstatSync6(profilePath).isSymbolicLink()) {
     throw brokerError("browser_session_profile_symlink");
   }
-  if (!existsSync11(profilePath)) {
+  if (!existsSync12(profilePath)) {
     if (!create) throw brokerError("browser_session_profile_not_found");
-    mkdirSync7(profilePath, { mode: 448 });
-    chmodSync5(profilePath, 448);
-    writeFileSync8(
-      join13(profilePath, MARKER_NAME),
+    mkdirSync8(profilePath, { mode: 448 });
+    chmodSync6(profilePath, 448);
+    writeFileSync9(
+      join14(profilePath, MARKER_NAME),
       `${JSON.stringify(expectedOwner(payload))}
 `,
       { encoding: "utf8", mode: 384, flag: "wx" }
     );
   }
-  if (!lstatSync5(profilePath).isDirectory() || lstatSync5(profilePath).isSymbolicLink()) {
+  if (!lstatSync6(profilePath).isDirectory() || lstatSync6(profilePath).isSymbolicLink()) {
     throw brokerError("browser_session_profile_path_invalid");
   }
   let owner;
   try {
-    owner = JSON.parse(readFileSync11(join13(profilePath, MARKER_NAME), "utf8"));
+    owner = JSON.parse(readFileSync12(join14(profilePath, MARKER_NAME), "utf8"));
   } catch {
     throw brokerError("browser_session_profile_owner_invalid");
   }
@@ -11607,7 +11754,7 @@ function createBrowserSessionBroker({
       await existing.context.close();
       active.delete(payload.localOpaqueRef);
     }
-    rmSync6(profilePath, { recursive: true, force: false });
+    rmSync7(profilePath, { recursive: true, force: false });
     return {
       bindingId: payload.bindingId,
       localOpaqueRef: payload.localOpaqueRef,
@@ -11632,11 +11779,11 @@ function createBrowserSessionBroker({
         throw brokerError("browser_session_agent_lease_expired");
       }
       const root = ensurePrivateRoot(stateRoot);
-      const expectedPath = resolve9(root, profileName(payload));
-      if (resolve9(payload.userDataDir) !== expectedPath) {
+      const expectedPath = resolve10(root, profileName(payload));
+      if (resolve10(payload.userDataDir) !== expectedPath) {
         throw brokerError("browser_session_profile_path_invalid");
       }
-      const marker = JSON.parse(readFileSync11(join13(expectedPath, MARKER_NAME), "utf8"));
+      const marker = JSON.parse(readFileSync12(join14(expectedPath, MARKER_NAME), "utf8"));
       if (marker.version !== 1 || typeof marker.provider !== "string" || !marker.provider.trim() || marker.companyId !== payload.companyId || marker.bindingId !== payload.bindingId || marker.localOpaqueRef !== payload.localOpaqueRef || marker.origin !== payload.origin) {
         throw brokerError("browser_session_profile_owner_mismatch");
       }
@@ -11686,7 +11833,7 @@ var source_acquisition_compatibility_default = {
 };
 
 // src/amaster-runtime-daemon.mjs
-var CONNECTOR_VERSION = "0.1.1-beta.85";
+var CONNECTOR_VERSION = "0.1.1-beta.87";
 var CONNECTOR_CONTRACT_VERSION = "2026-06-04.v1";
 var SOURCE_ACQUISITION_CAPABILITY = source_acquisition_compatibility_default.profileVersion;
 var daemonRequire = createRequire(import.meta.url);
@@ -11726,11 +11873,11 @@ function updateActiveRunWorkspaceManifest(commandId, manifestPath, patch = {}) {
 }
 function resultOutboxPendingCount(config) {
   const dir = resultOutboxDir(config);
-  if (!existsSync12(dir)) return 0;
+  if (!existsSync13(dir)) return 0;
   try {
     let pending = 0;
-    for (const file of readdirSync9(dir).filter((name) => name.endsWith(".json"))) {
-      if (readValidResultOutboxEntryOrQuarantine(config, file, join14(dir, file))) {
+    for (const file of readdirSync10(dir).filter((name) => name.endsWith(".json"))) {
+      if (readValidResultOutboxEntryOrQuarantine(config, file, join15(dir, file))) {
         pending += 1;
       }
     }
@@ -11741,21 +11888,21 @@ function resultOutboxPendingCount(config) {
 }
 function runCompletionStateDir(config) {
   const explicit = readString(process.env.AMASTER_RUN_COMPLETION_STATE_DIR);
-  if (explicit) return resolve10(expandHomePath(explicit));
-  return join14(dirname9(stateFilePath(process.env)), "run-completion-state");
+  if (explicit) return resolve11(expandHomePath(explicit));
+  return join15(dirname10(stateFilePath(process.env)), "run-completion-state");
 }
 function runCompletionStateInvalidDir(config) {
-  return join14(runCompletionStateDir(config), "invalid");
+  return join15(runCompletionStateDir(config), "invalid");
 }
 function quarantineInvalidRunCompletionState(config, filePath, reason) {
   const invalidDir = runCompletionStateInvalidDir(config);
-  mkdirSync8(invalidDir, { recursive: true, mode: 448 });
-  const destination = join14(invalidDir, basename6(filePath));
+  mkdirSync9(invalidDir, { recursive: true, mode: 448 });
+  const destination = join15(invalidDir, basename6(filePath));
   try {
-    renameSync7(filePath, destination);
+    renameSync8(filePath, destination);
   } catch {
     copyFileSync2(filePath, destination);
-    unlinkSync2(filePath);
+    unlinkSync3(filePath);
   }
   process.stderr.write(`AMaster daemon quarantined invalid run completion state ${basename6(filePath)}: ${reason}
 `);
@@ -11803,11 +11950,11 @@ function piCompletionOutputType(event) {
 }
 function resultOutboxActiveRunCommands(config) {
   const dir = resultOutboxDir(config);
-  if (!existsSync12(dir)) return [];
+  if (!existsSync13(dir)) return [];
   const outboxPending = resultOutboxPendingCount(config);
   const entries = [];
-  for (const file of readdirSync9(dir).filter((name) => name.endsWith(".json")).sort()) {
-    const entry = readValidResultOutboxEntryOrQuarantine(config, file, join14(dir, file));
+  for (const file of readdirSync10(dir).filter((name) => name.endsWith(".json")).sort()) {
+    const entry = readValidResultOutboxEntryOrQuarantine(config, file, join15(dir, file));
     if (!entry) continue;
     const activeRun = asRecord(entry.activeRun);
     const commandId = readString(activeRun.commandId) ?? readString(entry.commandId);
@@ -11837,12 +11984,12 @@ function resultOutboxActiveRunCommands(config) {
 }
 function resultOutboxFailedRunCommands(config) {
   const dir = resultOutboxInvalidDir(config);
-  if (!existsSync12(dir)) return [];
+  if (!existsSync13(dir)) return [];
   const entries = [];
-  for (const file of readdirSync9(dir).filter((name) => name.endsWith(".json")).sort().slice(-100)) {
+  for (const file of readdirSync10(dir).filter((name) => name.endsWith(".json")).sort().slice(-100)) {
     let entry;
     try {
-      entry = asRecord(JSON.parse(readFileSync12(join14(dir, file), "utf8")));
+      entry = asRecord(JSON.parse(readFileSync13(join15(dir, file), "utf8")));
     } catch {
       continue;
     }
@@ -11905,11 +12052,11 @@ function piExtraArgsDiagnostics(value) {
 }
 function safeExpandPath(value) {
   const text = readString(value);
-  return text ? resolve10(expandHomePath(text)) : null;
+  return text ? resolve11(expandHomePath(text)) : null;
 }
 function safeJsonObjectFromFile(filePath) {
   try {
-    const parsed = JSON.parse(readFileSync12(filePath, "utf8"));
+    const parsed = JSON.parse(readFileSync13(filePath, "utf8"));
     return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
   } catch {
     return null;
@@ -11926,7 +12073,7 @@ function safeDirectorySummary(pathValue) {
     }
     let entryCount = 0;
     let truncated = false;
-    for (const name of readdirSync9(pathValue)) {
+    for (const name of readdirSync10(pathValue)) {
       if (name.startsWith(".")) continue;
       entryCount += 1;
       if (entryCount >= MAX_PI_CAPABILITY_SOURCE_ENTRIES) {
@@ -11950,12 +12097,12 @@ function safeSkillRootSummary(kind, source, pathValue) {
   let truncated = false;
   if (directory.available && pathValue) {
     try {
-      for (const name of readdirSync9(pathValue)) {
+      for (const name of readdirSync10(pathValue)) {
         if (name.startsWith(".")) continue;
-        const skillDir = join14(pathValue, name);
+        const skillDir = join15(pathValue, name);
         try {
           if (!statSync9(skillDir).isDirectory()) continue;
-          if (!existsSync12(join14(skillDir, "SKILL.md"))) continue;
+          if (!existsSync13(join15(skillDir, "SKILL.md"))) continue;
           skillCount += 1;
           if (skillCount >= MAX_PI_CAPABILITY_SOURCE_ENTRIES) {
             truncated = true;
@@ -12006,7 +12153,7 @@ function objectKeyCount(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? Object.keys(value).length : 0;
 }
 function defaultPiCodingAgentDir() {
-  return join14(homedir3(), ".pi", "agent");
+  return join15(homedir3(), ".pi", "agent");
 }
 function piCapabilitySourcesDiagnostics() {
   const configuredPiCodingAgentDir = safeExpandPath(process.env.PI_CODING_AGENT_DIR);
@@ -12015,14 +12162,14 @@ function piCapabilitySourcesDiagnostics() {
   const configuredPiAgentHome = safeExpandPath(process.env.PI_AGENT_HOME);
   const piAgentHome = configuredPiAgentHome ?? piCodingAgentDir;
   const piAgentHomeSource = configuredPiAgentHome ? "PI_AGENT_HOME" : piCodingAgentDirSource;
-  const userSkillsPath = piAgentHome ? join14(piAgentHome, "skills") : null;
+  const userSkillsPath = piAgentHome ? join15(piAgentHome, "skills") : null;
   const configuredMarketplaceSkillsPath = safeExpandPath(
     process.env.PI_AGENT_MARKETPLACE_SKILLS_DIR
   );
-  const marketplaceSkillsPath = configuredMarketplaceSkillsPath ?? (piAgentHome ? join14(piAgentHome, "marketplace", "skills") : null);
+  const marketplaceSkillsPath = configuredMarketplaceSkillsPath ?? (piAgentHome ? join15(piAgentHome, "marketplace", "skills") : null);
   const builtinSkillsPath = safeExpandPath(process.env.PI_AGENT_BUILTIN_SKILLS_DIR) ?? safeExpandPath(process.env.AMASTER_BUILTIN_SKILLS);
-  const mcpConfigPath = safeExpandPath(process.env.PI_AGENT_MCP_SERVERS_FILE) ?? (piAgentHome ? join14(piAgentHome, "mcp.json") : null);
-  const settingsConfigPath = piCodingAgentDir ? join14(piCodingAgentDir, "settings.json") : null;
+  const mcpConfigPath = safeExpandPath(process.env.PI_AGENT_MCP_SERVERS_FILE) ?? (piAgentHome ? join15(piAgentHome, "mcp.json") : null);
+  const settingsConfigPath = piCodingAgentDir ? join15(piCodingAgentDir, "settings.json") : null;
   const skillRoots = [
     safeSkillRootSummary("user", `${piAgentHomeSource}/skills`, userSkillsPath),
     safeSkillRootSummary(
@@ -12142,22 +12289,22 @@ function buildExecutorReadiness(config) {
 function sourceAcquisitionPackageMetadata(packageName) {
   const agentDir = readString(process.env.PI_CODING_AGENT_DIR ?? process.env.PI_AGENT_HOME);
   if (!agentDir) return null;
-  const packagePath = join14(
-    resolve10(expandHomePath(agentDir)),
+  const packagePath = join15(
+    resolve11(expandHomePath(agentDir)),
     "npm",
     "node_modules",
     ...packageName.split("/"),
     "package.json"
   );
-  if (!existsSync12(packagePath)) return null;
-  const stat = lstatSync6(packagePath);
+  if (!existsSync13(packagePath)) return null;
+  const stat = lstatSync7(packagePath);
   if (!stat.isFile() || stat.isSymbolicLink()) return null;
   const metadata = readJsonFile2(packagePath);
   return metadata.name === packageName && readString(metadata.version) ? metadata : null;
 }
 function sourceAcquisitionBrowserExecutableReady() {
   const executable = readString(process.env.AMASTER_BROWSER_EXECUTABLE_PATH);
-  if (!executable || !isAbsolute6(executable)) return false;
+  if (!executable || !isAbsolute7(executable)) return false;
   try {
     const stat = statSync9(executable);
     return stat.isFile() && (stat.mode & 73) !== 0;
@@ -12248,7 +12395,7 @@ function browserSessionRuntimeReadiness(config) {
 }
 var browserSessionBrokers = /* @__PURE__ */ new Map();
 function browserSessionBrokerFor(config) {
-  const key = resolve10(config.browserSessionStateRoot);
+  const key = resolve11(config.browserSessionStateRoot);
   let broker = browserSessionBrokers.get(key);
   if (!broker) {
     const { chromium } = daemonRequire("playwright-core");
@@ -12263,7 +12410,7 @@ function browserSessionBrokerFor(config) {
 }
 function browserSessionRuntimeStatus(config) {
   const readiness = browserSessionRuntimeReadiness(config);
-  const broker = browserSessionBrokers.get(resolve10(config.browserSessionStateRoot));
+  const broker = browserSessionBrokers.get(resolve11(config.browserSessionStateRoot));
   return broker ? { ...readiness, ...broker.status() } : readiness;
 }
 function runtimeAdvertisedCapabilities(config, sourceAcquisition, browserSessionBroker) {
@@ -12529,7 +12676,7 @@ AMASTER_WORKSPACE_ALLOWLIST=${quoteShell(config.workspaceBindings.join(","))}
 AMASTER_EXECUTORS=${quoteShell(executorEnv)}
 AMASTER_CAPABILITIES=${quoteShell(config.capabilities.join(","))}
 AMASTER_NETWORK_DOMAINS=${quoteShell(config.networkDomains.join(","))}
-AMASTER_DAEMON_STATE_FILE=${quoteShell(join14(homedir3(), ".amaster-employee", "runtime-connector-state.json"))}
+AMASTER_DAEMON_STATE_FILE=${quoteShell(join15(homedir3(), ".amaster-employee", "runtime-connector-state.json"))}
 EOF
 
 set -a
@@ -12755,10 +12902,10 @@ function buildActiveRunCommandStatus(config, entry) {
   const base = {
     ...entry,
     phase: readString(entry.phase) ?? "executing",
-    managedWorkdirPresent: entry.workspacePath ? existsSync12(entry.workspacePath) : false,
+    managedWorkdirPresent: entry.workspacePath ? existsSync13(entry.workspacePath) : false,
     outboxPending: resultOutboxPendingCount(config)
   };
-  if (!entry.workspacePath || !existsSync12(entry.workspacePath)) return base;
+  if (!entry.workspacePath || !existsSync13(entry.workspacePath)) return base;
   const manifestPath = entry.manifestPath ?? workspaceManifestPath(entry.workspacePath);
   const status = readWorkspaceStatus(entry.workspacePath, { hashCache: workspaceStatusHashCache });
   const artifactCandidates = status.artifacts.slice(0, 20);
@@ -12981,12 +13128,12 @@ async function sourceAcquisitionRuntimeProfile(config, command) {
     throw new Error("source_acquisition_profile_invalid");
   }
   const exactOrigin = sourceAcquisitionExactOrigin(access.exactLocator);
-  const profileName2 = createHash13("sha256").update(`${companyId}\0${bindingId}\0${localOpaqueRef}`).digest("hex");
-  const stateRoot = resolve10(config.browserSessionStateRoot);
-  const userDataDir = resolve10(stateRoot, profileName2);
+  const profileName2 = createHash14("sha256").update(`${companyId}\0${bindingId}\0${localOpaqueRef}`).digest("hex");
+  const stateRoot = resolve11(config.browserSessionStateRoot);
+  const userDataDir = resolve11(stateRoot, profileName2);
   if (!pathWithin2(userDataDir, stateRoot)) throw new Error("source_acquisition_browser_profile_invalid");
-  const markerPath = join14(userDataDir, ".amaster-browser-session.json");
-  if (!existsSync12(userDataDir) || lstatSync6(userDataDir).isSymbolicLink() || !lstatSync6(userDataDir).isDirectory() || !existsSync12(markerPath) || lstatSync6(markerPath).isSymbolicLink()) throw new Error("source_acquisition_browser_profile_invalid");
+  const markerPath = join15(userDataDir, ".amaster-browser-session.json");
+  if (!existsSync13(userDataDir) || lstatSync7(userDataDir).isSymbolicLink() || !lstatSync7(userDataDir).isDirectory() || !existsSync13(markerPath) || lstatSync7(markerPath).isSymbolicLink()) throw new Error("source_acquisition_browser_profile_invalid");
   const marker = readJsonFile2(markerPath);
   if (marker.version !== 1 || marker.companyId !== companyId || marker.bindingId !== bindingId || marker.localOpaqueRef !== localOpaqueRef || !readString(marker.provider) || marker.origin !== exactOrigin || Object.keys(marker).length !== 6) {
     throw new Error("source_acquisition_browser_profile_invalid");
@@ -13004,7 +13151,7 @@ async function sourceAcquisitionRuntimeProfile(config, command) {
 }
 function readJsonFile2(filePath) {
   try {
-    const parsed = JSON.parse(readFileSync12(filePath, "utf8"));
+    const parsed = JSON.parse(readFileSync13(filePath, "utf8"));
     return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
   } catch {
     return {};
@@ -13045,11 +13192,11 @@ function safeAgentInstructionMaterializationTarget(workspace, filePath) {
   const raw = readString(filePath);
   if (!raw || raw.includes("\0")) return null;
   const normalized = raw.replace(/\\/g, "/");
-  if (isAbsolute6(normalized)) return null;
+  if (isAbsolute7(normalized)) return null;
   const segments = normalized.split("/").filter(Boolean);
   if (segments.length === 0 || segments.some((segment) => segment === "." || segment === "..")) return null;
   const relativePath = segments.join("/");
-  const targetPath = resolve10(workspace.cwd, relativePath);
+  const targetPath = resolve11(workspace.cwd, relativePath);
   if (!pathWithin2(targetPath, workspace.cwd)) return null;
   return { relativePath, targetPath };
 }
@@ -13063,8 +13210,8 @@ async function materializeAgentInstructionsBundle(config, command, workspace, bu
     if (!content) continue;
     const target = safeAgentInstructionMaterializationTarget(workspace, filePath);
     if (!target) continue;
-    mkdirSync8(dirname9(target.targetPath), { recursive: true });
-    writeFileSync9(target.targetPath, content, "utf8");
+    mkdirSync9(dirname10(target.targetPath), { recursive: true });
+    writeFileSync10(target.targetPath, content, "utf8");
     materialized.push({
       path: target.relativePath,
       byteSize: Buffer.byteLength(content, "utf8")
@@ -13091,11 +13238,11 @@ function wikiTreePathForCommand(command, workspaceBindings) {
     const candidates = [];
     if (root.endsWith("paperclipai.plugin-llm-wiki")) candidates.push(root);
     if (basename6(root) === "plugin-data" && companyId) {
-      candidates.push(join14(root, companyId, "paperclipai.plugin-llm-wiki"));
+      candidates.push(join15(root, companyId, "paperclipai.plugin-llm-wiki"));
     }
     for (const candidate of candidates) {
       try {
-        if (existsSync12(candidate)) return candidate;
+        if (existsSync13(candidate)) return candidate;
       } catch {
       }
     }
@@ -13235,18 +13382,18 @@ function buildExecutorEnv(config, command, workspace) {
   };
 }
 function preparePiModelCallProfile(commandId, baseEnv, options = {}) {
-  const profileRoot = mkdtempSync(join14(tmpdir(), "amaster-pi-model-call-"));
-  const home = join14(profileRoot, "home");
-  const sessionsDir = join14(profileRoot, "sessions");
-  const tempDir = join14(profileRoot, "tmp");
+  const profileRoot = mkdtempSync2(join15(tmpdir(), "amaster-pi-model-call-"));
+  const home = join15(profileRoot, "home");
+  const sessionsDir = join15(profileRoot, "sessions");
+  const tempDir = join15(profileRoot, "tmp");
   for (const directory of [home, sessionsDir, tempDir]) {
-    mkdirSync8(directory, { recursive: true, mode: 448 });
+    mkdirSync9(directory, { recursive: true, mode: 448 });
   }
   try {
     const extensionArgs = [];
     if (options.responseContract) {
-      const extensionPath = join14(profileRoot, "model-call-output-contract.js");
-      writeFileSync9(
+      const extensionPath = join15(profileRoot, "model-call-output-contract.js");
+      writeFileSync10(
         extensionPath,
         modelCallOutputContractExtensionSource(options.responseContract.maxOutputTokens),
         { mode: 384 }
@@ -13266,12 +13413,12 @@ function preparePiModelCallProfile(commandId, baseEnv, options = {}) {
       }
     };
   } catch (error) {
-    rmSync7(profileRoot, { recursive: true, force: true });
+    rmSync8(profileRoot, { recursive: true, force: true });
     throw error;
   }
 }
 function cleanupPiModelCallProfile(profile) {
-  if (profile?.profileRoot) rmSync7(profile.profileRoot, { recursive: true, force: true });
+  if (profile?.profileRoot) rmSync8(profile.profileRoot, { recursive: true, force: true });
 }
 function splitExtraArgs(value) {
   return splitList(value).flatMap((entry) => entry.split(/\s+/).filter(Boolean));
@@ -13311,7 +13458,7 @@ function resolveNativeSessionRequest(command, workspace) {
     try {
       cwdMatched = realpathSync5(requestedCwd) === realpathSync5(sourceWorkspacePath);
     } catch {
-      cwdMatched = resolve10(requestedCwd) === resolve10(sourceWorkspacePath);
+      cwdMatched = resolve11(requestedCwd) === resolve11(sourceWorkspacePath);
     }
   }
   const used = Boolean(enabled && requested && sessionId && requestedCwd && cwdMatched);
@@ -13896,10 +14043,10 @@ function realOrResolvedPath(value) {
   try {
     return realpathSync5(value);
   } catch {
-    return resolve10(value);
+    return resolve11(value);
   }
 }
-var LSOF_COMMAND = process.platform === "darwin" && existsSync12("/usr/sbin/lsof") ? "/usr/sbin/lsof" : "lsof";
+var LSOF_COMMAND = process.platform === "darwin" && existsSync13("/usr/sbin/lsof") ? "/usr/sbin/lsof" : "lsof";
 function processCwdForPid(pid) {
   if (process.platform === "linux") {
     try {
@@ -13925,7 +14072,7 @@ function allProcessCwdsByPid() {
   if (process.platform === "linux") {
     const procEntries = (() => {
       try {
-        return readdirSync9("/proc", { withFileTypes: true });
+        return readdirSync10("/proc", { withFileTypes: true });
       } catch {
         return [];
       }
@@ -14021,21 +14168,21 @@ function killWorkspaceResidentProcesses(cwd, processGroupId, options = {}) {
 }
 function walkManagedWorkdirs(root) {
   const workdirs = [];
-  if (!root || !existsSync12(root)) return workdirs;
+  if (!root || !existsSync13(root)) return workdirs;
   const stack = [root];
   while (stack.length > 0) {
     const current = stack.pop();
     if (!current) continue;
     let entries = [];
     try {
-      entries = readdirSync9(current, { withFileTypes: true });
+      entries = readdirSync10(current, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
-      const fullPath = join14(current, entry.name);
-      if (entry.name === "workdir" && existsSync12(workspaceManifestPath(fullPath))) {
+      const fullPath = join15(current, entry.name);
+      if (entry.name === "workdir" && existsSync13(workspaceManifestPath(fullPath))) {
         workdirs.push(fullPath);
         continue;
       }
@@ -14074,7 +14221,7 @@ function manifestMatchesActiveRuntimeRef(manifest, refs, workdir = null) {
 function buildOrphanReaperSample(root, workdir, manifest, residents) {
   const relativeWorkdir = (() => {
     const value = relative7(root, workdir);
-    return value && !value.startsWith("..") && !isAbsolute6(value) ? value : basename6(workdir);
+    return value && !value.startsWith("..") && !isAbsolute7(value) ? value : basename6(workdir);
   })();
   return {
     workdir: relativeWorkdir,
@@ -15539,7 +15686,7 @@ async function flushRunCompletionStates(config) {
   for (const { filePath, state: listedState } of runCompletionStateEntries(config)) {
     try {
       if (runCompletionFlights.has(listedState.commandId)) continue;
-      if (!existsSync12(filePath)) continue;
+      if (!existsSync13(filePath)) continue;
       const state = readValidRunCompletionStateOrQuarantine(config, filePath);
       if (!state) continue;
       const outcome = await coordinateRunCompletionSingleFlight(config, state);
@@ -15726,15 +15873,15 @@ async function completeCommand(config, command, status, result3, error) {
 }
 function resultOutboxDir(config) {
   const explicit = readString(process.env.AMASTER_RESULT_OUTBOX_DIR);
-  if (explicit) return resolve10(expandHomePath(explicit));
-  return join14(dirname9(stateFilePath(process.env)), "result-outbox");
+  if (explicit) return resolve11(expandHomePath(explicit));
+  return join15(dirname10(stateFilePath(process.env)), "result-outbox");
 }
 function resultOutboxInvalidDir(config) {
-  return join14(resultOutboxDir(config), "invalid");
+  return join15(resultOutboxDir(config), "invalid");
 }
 function writeResultOutboxEntry(config, entry) {
   const dir = resultOutboxDir(config);
-  mkdirSync8(dir, { recursive: true });
+  mkdirSync9(dir, { recursive: true });
   const body = {
     version: 1,
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -15742,19 +15889,19 @@ function writeResultOutboxEntry(config, entry) {
     lastAttemptAt: null,
     ...entry
   };
-  writeFileSync9(join14(dir, resultOutboxFileName(entry.commandId)), `${JSON.stringify(body, null, 2)}
+  writeFileSync10(join15(dir, resultOutboxFileName(entry.commandId)), `${JSON.stringify(body, null, 2)}
 `, { mode: 384 });
 }
 function moveResultOutboxEntryToInvalid(config, file, fullPath, reason, detail, original) {
   const invalidDir = resultOutboxInvalidDir(config);
-  mkdirSync8(invalidDir, { recursive: true });
-  const invalidPath = join14(invalidDir, file);
+  mkdirSync9(invalidDir, { recursive: true });
+  const invalidPath = join15(invalidDir, file);
   if (original === void 0) {
     try {
-      renameSync7(fullPath, invalidPath);
+      renameSync8(fullPath, invalidPath);
     } catch {
       copyFileSync2(fullPath, invalidPath);
-      unlinkSync2(fullPath);
+      unlinkSync3(fullPath);
     }
     return;
   }
@@ -15764,14 +15911,14 @@ function moveResultOutboxEntryToInvalid(config, file, fullPath, reason, detail,
     ...detail ? { detail: truncateText(detail, 1e3) } : {},
     original
   };
-  writeFileSync9(invalidPath, `${JSON.stringify(evidence, null, 2)}
+  writeFileSync10(invalidPath, `${JSON.stringify(evidence, null, 2)}
 `, { mode: 384 });
-  unlinkSync2(fullPath);
+  unlinkSync3(fullPath);
 }
 function readValidResultOutboxEntryOrQuarantine(config, file, fullPath) {
   let entry;
   try {
-    entry = JSON.parse(readFileSync12(fullPath, "utf8"));
+    entry = JSON.parse(readFileSync13(fullPath, "utf8"));
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     moveResultOutboxEntryToInvalid(config, file, fullPath, "malformed_result_outbox_json", message);
@@ -15801,13 +15948,13 @@ function updateResultOutboxAttempt(fullPath, entry, err) {
     ...typeof err?.httpStatus === "number" ? { httpStatus: err.httpStatus } : {},
     lastError: truncateText(err instanceof Error ? err.message : String(err), 1e3)
   };
-  writeFileSync9(fullPath, `${JSON.stringify(next, null, 2)}
+  writeFileSync10(fullPath, `${JSON.stringify(next, null, 2)}
 `, { mode: 384 });
   return next;
 }
 function quarantineResultOutboxEntry(config, fullPath, file, entry, reason, err) {
   const invalidDir = resultOutboxInvalidDir(config);
-  mkdirSync8(invalidDir, { recursive: true });
+  mkdirSync9(invalidDir, { recursive: true });
   const body = {
     ...entry,
     invalidReason: reason,
@@ -15815,11 +15962,11 @@ function quarantineResultOutboxEntry(config, fullPath, file, entry, reason, err)
     ...typeof err?.httpStatus === "number" ? { httpStatus: err.httpStatus } : {},
     lastError: truncateText(err instanceof Error ? err.message : String(err), 1e3)
   };
-  const invalidPath = join14(invalidDir, file);
-  writeFileSync9(invalidPath, `${JSON.stringify(body, null, 2)}
+  const invalidPath = join15(invalidDir, file);
+  writeFileSync10(invalidPath, `${JSON.stringify(body, null, 2)}
 `, { mode: 384 });
   try {
-    unlinkSync2(fullPath);
+    unlinkSync3(fullPath);
   } catch (unlinkErr) {
     const message = unlinkErr instanceof Error ? unlinkErr.message : String(unlinkErr);
     process.stderr.write(`AMaster daemon could not remove quarantined result outbox entry ${file}: ${message}
@@ -15830,16 +15977,16 @@ function quarantineResultOutboxEntry(config, fullPath, file, entry, reason, err)
 }
 async function flushResultOutbox(config) {
   const dir = resultOutboxDir(config);
-  if (!existsSync12(dir)) return { attempted: 0, completed: 0 };
-  const files = readdirSync9(dir).filter((name) => name.endsWith(".json")).sort();
+  if (!existsSync13(dir)) return { attempted: 0, completed: 0 };
+  const files = readdirSync10(dir).filter((name) => name.endsWith(".json")).sort();
   let completed = 0;
   for (const file of files) {
-    const fullPath = join14(dir, file);
+    const fullPath = join15(dir, file);
     const entry = readValidResultOutboxEntryOrQuarantine(config, file, fullPath);
     if (!entry) continue;
     try {
       await postJson(config, String(entry.path), entry.payload);
-      unlinkSync2(fullPath);
+      unlinkSync3(fullPath);
       clearDeliveredResultOutboxCommand(config, entry);
       completed += 1;
     } catch (err) {
@@ -16031,8 +16178,8 @@ async function materializeIssueAttachments(config, command, workspace) {
     runtimeAuth,
     issueId
   );
-  const targetDir = join14(workspace.cwd, "input-attachments");
-  mkdirSync8(targetDir, { recursive: true });
+  const targetDir = join15(workspace.cwd, "input-attachments");
+  mkdirSync9(targetDir, { recursive: true });
   const usedFilenames = /* @__PURE__ */ new Set();
   const materialized = [];
   for (const [index, rawAttachment] of attachments.entries()) {
@@ -16041,16 +16188,16 @@ async function materializeIssueAttachments(config, command, workspace) {
     if (!contentPath) continue;
     let filename = safeMaterializedAttachmentFilename(attachment, index);
     if (usedFilenames.has(filename)) {
-      const ext = extname2(filename);
+      const ext = extname3(filename);
       const stem = ext ? filename.slice(0, -ext.length) : filename;
       filename = `${stem}-${index + 1}${ext}`;
     }
     usedFilenames.add(filename);
-    const targetPath = join14(targetDir, filename);
+    const targetPath = join15(targetDir, filename);
     const body = await runtimeApiBuffer(runtimeAuth, contentPath);
-    writeFileSync9(targetPath, body);
+    writeFileSync10(targetPath, body);
     const attachmentId = readString(attachment.id);
-    const actualSha256 = createHash13("sha256").update(body).digest("hex");
+    const actualSha256 = createHash14("sha256").update(body).digest("hex");
     const lineageCandidates = lineageCandidatesByAttachmentId.get(attachmentId) ?? [];
     const lineage = selectAttachmentLineage(lineageCandidates, actualSha256);
     if (lineageCandidates.length > 0 && !lineage) {
@@ -16122,19 +16269,19 @@ async function materializeRequiredArtifactInputs(config, command, workspace) {
   if (manifest.version !== 1 || !Array.isArray(manifest.entries)) {
     throw new Error("artifact_input_manifest_invalid: expected version 1 entries array");
   }
-  const targetRoot = join14(workspace.cwd, "input-artifacts");
-  rmSync7(targetRoot, { recursive: true, force: true });
-  mkdirSync8(targetRoot, { recursive: true });
+  const targetRoot = join15(workspace.cwd, "input-artifacts");
+  rmSync8(targetRoot, { recursive: true, force: true });
+  mkdirSync9(targetRoot, { recursive: true });
   const usedPaths = /* @__PURE__ */ new Set();
   const materialized = [];
   for (const [index, rawEntry] of manifest.entries.entries()) {
     const entry = asRecord(rawEntry);
     const workProductId = readString(entry.workProductId);
     const attachmentId = readString(entry.attachmentId);
-    const sha2562 = readString(entry.sha256);
+    const sha2563 = readString(entry.sha256);
     const contentPath = readString(entry.contentPath);
     const byteSize = readNumber(entry.byteSize, null);
-    if (!workProductId || !attachmentId || !/^[a-f0-9]{64}$/i.test(sha2562 ?? "") || !contentPath || byteSize === null) {
+    if (!workProductId || !attachmentId || !/^[a-f0-9]{64}$/i.test(sha2563 ?? "") || !contentPath || byteSize === null) {
       throw new Error(`artifact_input_manifest_invalid: entry ${index} is incomplete`);
     }
     const expectedContentPath = `/api/attachments/${attachmentId}/content`;
@@ -16142,10 +16289,10 @@ async function materializeRequiredArtifactInputs(config, command, workspace) {
       throw new Error(`artifact_input_manifest_invalid: entry ${index} contentPath does not match attachmentId`);
     }
     const body = await runtimeApiBuffer(runtimeAuth, contentPath);
-    const actualSha256 = createHash13("sha256").update(body).digest("hex");
-    if (body.byteLength !== byteSize || actualSha256 !== sha2562) {
+    const actualSha256 = createHash14("sha256").update(body).digest("hex");
+    if (body.byteLength !== byteSize || actualSha256 !== sha2563) {
       throw new Error(
-        `artifact_input_integrity_mismatch: workProductId=${workProductId} expectedBytes=${byteSize} actualBytes=${body.byteLength} expectedSha256=${sha2562} actualSha256=${actualSha256}`
+        `artifact_input_integrity_mismatch: workProductId=${workProductId} expectedBytes=${byteSize} actualBytes=${body.byteLength} expectedSha256=${sha2563} actualSha256=${actualSha256}`
       );
     }
     const sourceDir = safeArtifactInputSourceDir(entry, index);
@@ -16153,18 +16300,18 @@ async function materializeRequiredArtifactInputs(config, command, workspace) {
       id: attachmentId,
       originalFilename: readString(entry.originalFilename)
     }, index);
-    let relativePath = join14("input-artifacts", sourceDir, filename).split(/[\\/]+/).join("/");
+    let relativePath = join15("input-artifacts", sourceDir, filename).split(/[\\/]+/).join("/");
     if (usedPaths.has(relativePath)) {
-      const ext = extname2(filename);
+      const ext = extname3(filename);
       const stem = ext ? filename.slice(0, -ext.length) : filename;
       filename = `${stem}-${index + 1}${ext}`;
-      relativePath = join14("input-artifacts", sourceDir, filename).split(/[\\/]+/).join("/");
+      relativePath = join15("input-artifacts", sourceDir, filename).split(/[\\/]+/).join("/");
     }
     usedPaths.add(relativePath);
-    const targetPath = join14(workspace.cwd, relativePath);
-    mkdirSync8(dirname9(targetPath), { recursive: true });
-    writeFileSync9(targetPath, body);
-    chmodSync6(targetPath, 292);
+    const targetPath = join15(workspace.cwd, relativePath);
+    mkdirSync9(dirname10(targetPath), { recursive: true });
+    writeFileSync10(targetPath, body);
+    chmodSync7(targetPath, 292);
     materialized.push({
       id: attachmentId,
       workProductId,
@@ -16175,7 +16322,7 @@ async function materializeRequiredArtifactInputs(config, command, workspace) {
       relativePath,
       contentType: readString(entry.contentType),
       byteSize: body.byteLength,
-      sha256: sha2562,
+      sha256: sha2563,
       contentPath
     });
   }
@@ -16183,9 +16330,9 @@ async function materializeRequiredArtifactInputs(config, command, workspace) {
     version: 1,
     entries: materialized.map(({ path: _path, relativePath, ...entry }) => ({ ...entry, path: relativePath }))
   };
-  const manifestPath = join14(targetRoot, "artifact-input-manifest.json");
-  writeFileSync9(manifestPath, JSON.stringify(localManifest, null, 2) + "\n");
-  chmodSync6(manifestPath, 292);
+  const manifestPath = join15(targetRoot, "artifact-input-manifest.json");
+  writeFileSync10(manifestPath, JSON.stringify(localManifest, null, 2) + "\n");
+  chmodSync7(manifestPath, 292);
   updateWorkspaceManifest(workspaceManifestPath(workspace), { artifactInputManifest: localManifest });
   await ingestLog(config, command, "system", "info", `Materialized ${materialized.length} required artifact input(s) into the execution workspace`, {
     artifactInputCount: materialized.length,
@@ -16194,46 +16341,46 @@ async function materializeRequiredArtifactInputs(config, command, workspace) {
   return materialized;
 }
 function issueCheckpointDir(workspace) {
-  return join14(dirname9(workspace.runDir), "checkpoint");
+  return join15(dirname10(workspace.runDir), "checkpoint");
 }
 async function clearIssueCheckpoint(config, command, workspace, reason) {
   const checkpointDir = issueCheckpointDir(workspace);
-  if (!existsSync12(checkpointDir)) return false;
-  rmSync7(checkpointDir, { recursive: true, force: true });
+  if (!existsSync13(checkpointDir)) return false;
+  rmSync8(checkpointDir, { recursive: true, force: true });
   await ingestLog(config, command, "system", "info", "Cleared issue continuation checkpoint", { reason });
   return true;
 }
 function safeCheckpointRelativePath(rawPath) {
   const raw = String(rawPath ?? "").trim();
-  if (isAbsolute6(raw) || /^[A-Za-z]:[\\/]/.test(raw)) return null;
+  if (isAbsolute7(raw) || /^[A-Za-z]:[\\/]/.test(raw)) return null;
   const normalized = raw.split(/[\\/]+/).filter(Boolean).join("/");
   if (!normalized || normalized.startsWith("../") || normalized.split("/").some((segment) => segment.startsWith("."))) return null;
   if (normalized.startsWith("input-attachments/") || isRuntimeMetadataArtifactPath(normalized)) return null;
   return normalized;
 }
 function hashFileSha256(filePath) {
-  return createHash13("sha256").update(readFileSync12(filePath)).digest("hex");
+  return createHash14("sha256").update(readFileSync13(filePath)).digest("hex");
 }
 async function materializeIssueCheckpoint(config, command, workspace) {
   const checkpointDir = issueCheckpointDir(workspace);
-  const manifestPath = join14(checkpointDir, "manifest.json");
-  if (!existsSync12(manifestPath)) return [];
+  const manifestPath = join15(checkpointDir, "manifest.json");
+  if (!existsSync13(manifestPath)) return [];
   let manifest;
   try {
-    manifest = asRecord(JSON.parse(readFileSync12(manifestPath, "utf8")));
+    manifest = asRecord(JSON.parse(readFileSync13(manifestPath, "utf8")));
   } catch (err) {
-    rmSync7(checkpointDir, { recursive: true, force: true });
+    rmSync8(checkpointDir, { recursive: true, force: true });
     throw new Error(`invalid issue checkpoint manifest: ${err instanceof Error ? err.message : String(err)}`);
   }
   const expiresAt = Date.parse(readString(manifest.expiresAt) ?? "");
   if (!Number.isFinite(expiresAt) || expiresAt <= Date.now() || readString(manifest.issueId) !== commandIssueId(command)) {
-    rmSync7(checkpointDir, { recursive: true, force: true });
+    rmSync8(checkpointDir, { recursive: true, force: true });
     return [];
   }
   try {
     const files = Array.isArray(manifest.files) ? manifest.files : [];
     if (files.length > 20) throw new Error("issue checkpoint manifest exceeds the limit of 20 files");
-    const filesRoot = realpathSync5(join14(checkpointDir, "files"));
+    const filesRoot = realpathSync5(join15(checkpointDir, "files"));
     const workspaceRoot = realpathSync5(workspace.cwd);
     const validated = [];
     let totalBytes = 0;
@@ -16241,12 +16388,12 @@ async function materializeIssueCheckpoint(config, command, workspace) {
       const file = asRecord(rawFile);
       const relativePath = safeCheckpointRelativePath(readString(file.path));
       if (!relativePath) throw new Error("issue checkpoint manifest contains an invalid file path");
-      const sourceCandidate = resolve10(filesRoot, relativePath);
-      const target = resolve10(workspaceRoot, relativePath);
+      const sourceCandidate = resolve11(filesRoot, relativePath);
+      const target = resolve11(workspaceRoot, relativePath);
       if (!pathWithin2(sourceCandidate, filesRoot) || !pathWithin2(target, workspaceRoot)) {
         throw new Error(`issue checkpoint path escapes its workspace: ${relativePath}`);
       }
-      if (!existsSync12(sourceCandidate)) throw new Error(`issue checkpoint file is missing: ${relativePath}`);
+      if (!existsSync13(sourceCandidate)) throw new Error(`issue checkpoint file is missing: ${relativePath}`);
       const source = realpathSync5(sourceCandidate);
       if (!pathWithin2(source, filesRoot) || !statSync9(source).isFile()) {
         throw new Error(`issue checkpoint source escapes its storage root: ${relativePath}`);
@@ -16266,13 +16413,13 @@ async function materializeIssueCheckpoint(config, command, workspace) {
     const materialized = [];
     for (const { relativePath, source, target } of validated) {
       try {
-        lstatSync6(target);
+        lstatSync7(target);
         continue;
       } catch (err) {
         if (err?.code !== "ENOENT") throw err;
       }
-      mkdirSync8(dirname9(target), { recursive: true });
-      const targetParent = realpathSync5(dirname9(target));
+      mkdirSync9(dirname10(target), { recursive: true });
+      const targetParent = realpathSync5(dirname10(target));
       if (!pathWithin2(targetParent, workspaceRoot)) {
         throw new Error(`issue checkpoint target escapes its workspace: ${relativePath}`);
       }
@@ -16300,31 +16447,31 @@ async function materializeIssueCheckpoint(config, command, workspace) {
 }
 async function saveIssueCheckpoint(config, command, workspace, candidates) {
   const checkpointDir = issueCheckpointDir(workspace);
-  const filesDir = join14(checkpointDir, "files");
-  rmSync7(checkpointDir, { recursive: true, force: true });
-  mkdirSync8(filesDir, { recursive: true });
+  const filesDir = join15(checkpointDir, "files");
+  rmSync8(checkpointDir, { recursive: true, force: true });
+  mkdirSync9(filesDir, { recursive: true });
   const files = [];
   let totalBytes = 0;
   const workspaceRoot = realpathSync5(workspace.cwd);
   for (const candidate of candidates.slice(0, 20)) {
     const relativePath = safeCheckpointRelativePath(candidate.rawPath);
     const source = readString(candidate.filePath);
-    if (!relativePath || !source || !existsSync12(source) || !statSync9(source).isFile()) continue;
+    if (!relativePath || !source || !existsSync13(source) || !statSync9(source).isFile()) continue;
     const ownedSource = realpathSync5(source);
     if (!pathWithin2(ownedSource, workspaceRoot)) {
       throw new Error(`issue checkpoint source escapes its execution workspace: ${relativePath}`);
     }
     const byteSize = statSync9(ownedSource).size;
     if (byteSize <= 0 || totalBytes + byteSize > MAX_CHECKPOINT_BYTES) continue;
-    const target = resolve10(filesDir, relativePath);
+    const target = resolve11(filesDir, relativePath);
     if (!pathWithin2(target, filesDir)) continue;
-    mkdirSync8(dirname9(target), { recursive: true });
+    mkdirSync9(dirname10(target), { recursive: true });
     copyFileSync2(ownedSource, target);
     totalBytes += byteSize;
     files.push({ path: relativePath, byteSize, sha256: hashFileSha256(ownedSource) });
   }
   if (files.length === 0) {
-    rmSync7(checkpointDir, { recursive: true, force: true });
+    rmSync8(checkpointDir, { recursive: true, force: true });
     return null;
   }
   const manifest = {
@@ -16336,7 +16483,7 @@ async function saveIssueCheckpoint(config, command, workspace, candidates) {
     totalBytes,
     files
   };
-  writeFileSync9(join14(checkpointDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
+  writeFileSync10(join15(checkpointDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
 `);
   await ingestLog(config, command, "system", "warn", `Saved ${files.length} required deliverable(s) for continuation recovery`, manifest);
   return manifest;
@@ -16507,7 +16654,7 @@ async function executeRunCommand(config, command) {
           executorCommand: invocation.command,
           executorHome: workspace.executorHome,
           runDir: workspace.runDir,
-          runtimeCacheRoot: join14(dirname9(config.daemonStateFile), "cache"),
+          runtimeCacheRoot: join15(dirname10(config.daemonStateFile), "cache"),
           cwd,
           runtimeAuth: commandRuntimeAuth(command),
           nativeSession: asRecord(asRecord(command.payload).nativeSession),
@@ -16567,7 +16714,7 @@ async function executeRunCommand(config, command) {
     if (executor.kind === "pi" && piResolvedProviderConfig) {
       const sharedPiHome = readString(process.env.PI_CODING_AGENT_DIR) ?? readString(process.env.PI_AGENT_HOME) ?? null;
       let agentDir = managedMcpProfile ? readString(managedMcpProfile.env.PI_CODING_AGENT_DIR) ?? readString(managedMcpProfile.env.PI_AGENT_HOME) ?? null : desktopDelegatedRunnerEnabled(config) ? readString(executorEnv.PI_AGENT_HOME) ?? readString(executorEnv.PI_CODING_AGENT_DIR) ?? null : readString(executorEnv.PI_CODING_AGENT_DIR) ?? readString(executorEnv.PI_AGENT_HOME) ?? null;
-      if (agentDir && sharedPiHome && resolve10(agentDir) === resolve10(sharedPiHome)) {
+      if (agentDir && sharedPiHome && resolve11(agentDir) === resolve11(sharedPiHome)) {
         agentDir = null;
       }
       try {
@@ -16849,7 +16996,7 @@ async function executeRunCommand(config, command) {
           workspace,
           workspaceStatus.artifacts.map((artifact) => ({
             rawPath: artifact.relativePath,
-            filePath: resolve10(cwd, artifact.relativePath)
+            filePath: resolve11(cwd, artifact.relativePath)
           }))
         );
         nativeSessionRollout = {
@@ -17283,6 +17430,11 @@ function reconcileStaleManagedMcpProfiles(config) {
   }
 }
 async function runOnce(config) {
+  const templates = materializeRuntimePresetTemplates(process.env);
+  if (templates.status === "ready") {
+    process.stderr.write(`MirrorX preset templates ready: files=${templates.fileCount} target=${templates.targetDir}
+`);
+  }
   reconcileStaleManagedMcpProfiles(config);
   config = await ensureRegistered(config);
   try {
@@ -17408,6 +17560,11 @@ function statusSummary(config) {
 `);
 }
 async function runLoop(config) {
+  const templates = materializeRuntimePresetTemplates(process.env);
+  if (templates.status === "ready") {
+    process.stderr.write(`MirrorX preset templates ready: files=${templates.fileCount} target=${templates.targetDir}
+`);
+  }
   process.stderr.write(
     `AMaster daemon runtime safety controls resolved: pi_guard_mode=${config.piToolArgumentGuard.mode}
 `
@@ -17427,7 +17584,7 @@ async function runLoop(config) {
 ${message}
 `);
     }
-    await new Promise((resolve11) => setTimeout(resolve11, config.pollIntervalSeconds * 1e3));
+    await new Promise((resolve12) => setTimeout(resolve12, config.pollIntervalSeconds * 1e3));
   }
 }
 function help() {
@@ -17454,6 +17611,7 @@ Key env:
   AMASTER_NETWORK_DOMAINS, AMASTER_CONNECTOR_ID, AMASTER_DAEMON_STATE_FILE,
   AMASTER_MAX_CONCURRENT_COMMANDS, AMASTER_EXECUTOR_MAX_RSS_MB (default 0, disabled),
   AMASTER_RUNTIME_ORPHAN_REAPER_INTERVAL_SECONDS (default 300, set 0 to disable),
+  AMASTER_RUNTIME_TEMPLATES_ROOT (optional; defaults to /data/templates in pi-cli-runtime),
   AMASTER_AGENT_INSTRUCTION_SYSTEM_KERNEL_MODE (shadow|canary; default shadow),
   AMASTER_AGENT_INSTRUCTION_SYSTEM_KERNEL_CANARY_AGENT_IDS / _RUN_IDS,
   AMASTER_AGENT_INSTRUCTION_SYSTEM_KERNEL_SOURCE_SHA256_ALLOWLIST