@amaster.ai/employee-runtime-connector 0.1.13-beta.2 → 0.1.14

package/dist/amaster-runtime-daemon.mjs

@@ -9719,6 +9719,12 @@ var selectMirrorXInternalDiscoveryTargetSchema = external_exports.object({
   expectedGapContractId: external_exports.string().uuid(),
   expectedGapAuthorityRevision: external_exports.number().int().positive()
 }).strict();
+var mirrorXInternalDiscoveryTargetCandidateSchema = selectMirrorXInternalDiscoveryTargetSchema.extend({
+  routineTitle: external_exports.string().min(1),
+  criterionText: external_exports.string().min(1),
+  gapKey: external_exports.string().min(1),
+  currentSelectionId: external_exports.string().uuid().nullable()
+}).strict();
 var mirrorXInternalDiscoveryTargetSelectionSchema = external_exports.object({
   id: external_exports.string().uuid(),
   companyId: external_exports.string().uuid(),
@@ -17419,11 +17425,15 @@ var companyArtifactKindFilterSchema = external_exports.enum([
   "file"
 ]);
 var companyArtifactGroupBySchema = external_exports.enum(["none", "task", "parent_task"]);
+var companyArtifactDeliveryStatusSchema = external_exports.enum(["recorded", "ready", "accepted"]);
 var companyArtifactsQuerySchema = external_exports.object({
   kind: companyArtifactKindFilterSchema.optional().default("all"),
+  deliveryStatus: companyArtifactDeliveryStatusSchema.optional(),
   projectId: external_exports.string().uuid().optional(),
   createdByAgentId: external_exports.string().uuid().optional(),
   q: external_exports.string().trim().max(COMPANY_ARTIFACTS_MAX_QUERY_LENGTH).optional(),
+  /** Absent keeps the standalone timeline flat; an empty value opens the library folder root. */
+  folder: external_exports.string().max(160).optional(),
   groupBy: companyArtifactGroupBySchema.optional().default("none"),
   groupIssueId: external_exports.string().uuid().optional(),
   limit: external_exports.coerce.number().int().min(1).max(COMPANY_ARTIFACTS_MAX_LIMIT).optional().default(COMPANY_ARTIFACTS_DEFAULT_LIMIT),
@@ -17444,6 +17454,7 @@ var companyArtifactSchema = external_exports.object({
   workProductType: external_exports.string().nullable(),
   provider: external_exports.string().nullable(),
   status: external_exports.string().nullable(),
+  deliveryStatus: companyArtifactDeliveryStatusSchema.optional(),
   externalUrl: companyArtifactHttpUrlSchema.nullable(),
   thumbnailUrl: companyArtifactThumbnailUrlSchema.nullable(),
   platform: external_exports.string().nullable(),
@@ -17499,6 +17510,7 @@ var companyArtifactKindCountsSchema = external_exports.object({
 });
 var companyArtifactsResponseSchema = external_exports.object({
   artifacts: external_exports.array(companyArtifactSchema),
+  folders: external_exports.array(external_exports.object({ path: external_exports.string(), name: external_exports.string() })).optional(),
   groups: external_exports.array(companyArtifactGroupSchema).optional(),
   selectedGroup: companyArtifactGroupSchema.nullable().optional(),
   kindCounts: companyArtifactKindCountsSchema.optional(),
@@ -19206,17 +19218,17 @@ var driveMutationSchema = external_exports.discriminatedUnion("operation", [
   })
 ]);
 var MIRRORX_DRIVE_AGENT_RULES = [
-  "\u641C\u7D22\u3001\u8BFB\u53D6\u5F53\u524D\u516C\u53F8\u6709\u6743\u8BBF\u95EE\u7684\u8D44\u6599\uFF0C\u4F7F\u7528\u5DE5\u5177\u8FD4\u56DE\u7684\u5F15\u7528\u3002",
+  "\u4E0D\u786E\u5B9A\u8D44\u6599\u5728\u54EA\u4E2A\u76EE\u5F55\u65F6\uFF0C\u5148\u7528 library_search(scope=all) \u67E5\u5168\u5E93\uFF0C\u518D\u628A\u7ED3\u679C\u7684 resourceRef \u4EA4\u7ED9 library_read\uFF1B\u4F7F\u7528\u8FD4\u56DE\u7684\u6765\u6E90\u548C\u7248\u672C\u5F15\u7528\u3002",
   "\u6587\u4EF6\u4FDD\u5B58\u5230\u672C\u4EFB\u52A1\u5DE5\u4F5C\u6587\u4EF6\uFF0C\u7EE7\u7EED\u4FEE\u6539\u540C\u4E00\u6587\u4EF6\uFF0C\u4E0D\u9020\u7248\u672C\u540E\u7F00\u3002",
   "\u66F4\u65B0\u5171\u4EAB\u8D44\u6599\u63D0\u4EA4\u5019\u9009\uFF0C\u7B49\u4EBA\u91C7\u7EB3\uFF0C\u4E0D\u76F4\u63A5\u6539\u539F\u4EF6\u6216\u6574\u7406\u76EE\u5F55\u3002",
-  "\u6210\u679C\u8D70\u4EFB\u52A1\u4EA4\u4ED8\u5DE5\u5177\uFF0C\u77E5\u8BC6\u66F4\u65B0\u8D70\u4E13\u7528\u77E5\u8BC6\u7EF4\u62A4\u8BF7\u6C42\u3002",
+  "\u6210\u679C\u7684\u63D0\u4EA4\u4E0E\u9A8C\u6536\u8D70\u4EFB\u52A1\u4EA4\u4ED8\u5DE5\u5177\uFF0C\u77E5\u8BC6\u66F4\u65B0\u8D70\u4E13\u7528\u77E5\u8BC6\u7EF4\u62A4\u8BF7\u6C42\u3002",
   "\u51B2\u7A81\u6309\u63D0\u793A\u8BFB\u53D6\u6700\u65B0\u7248\u5E76\u91CD\u65B0\u6574\u7406\uFF1B\u65E0\u6743\u9650\u505C\u6B62\uFF1B\u5F52\u6863\u6210\u529F\u56DE\u6267\u624D\u4EE3\u8868\u5DF2\u4FDD\u5B58\u3002"
 ].join("\n");
 
 // src/amaster-runtime-daemon.mjs
-import { chmodSync as chmodSync9, copyFileSync as copyFileSync2, existsSync as existsSync18, lstatSync as lstatSync16, mkdirSync as mkdirSync14, mkdtempSync as mkdtempSync5, readFileSync as readFileSync21, readdirSync as readdirSync14, realpathSync as realpathSync12, renameSync as renameSync12, rmSync as rmSync12, statSync as statSync12, symlinkSync as symlinkSync2, unlinkSync as unlinkSync4, writeFileSync as writeFileSync15 } from "node:fs";
+import { chmodSync as chmodSync9, copyFileSync as copyFileSync2, existsSync as existsSync19, lstatSync as lstatSync16, mkdirSync as mkdirSync14, mkdtempSync as mkdtempSync5, readFileSync as readFileSync21, readdirSync as readdirSync14, realpathSync as realpathSync12, renameSync as renameSync12, rmSync as rmSync12, statSync as statSync12, symlinkSync as symlinkSync2, unlinkSync as unlinkSync4, writeFileSync as writeFileSync15 } from "node:fs";
 import { arch as arch4, homedir as homedir7, hostname as hostname2, platform as platform4, tmpdir } from "node:os";
-import { basename as basename8, delimiter as delimiter3, dirname as dirname14, extname as extname3, isAbsolute as isAbsolute13, join as join26, relative as relative9, resolve as resolve20 } from "node:path";
+import { basename as basename8, delimiter as delimiter3, dirname as dirname14, extname as extname3, isAbsolute as isAbsolute14, join as join26, relative as relative9, resolve as resolve20 } from "node:path";
 import { spawn, spawnSync as spawnSync6 } from "node:child_process";
 
 // src/amaster-runtime-daemon/common.mjs
@@ -19478,14 +19490,21 @@ function createPiOutputRetentionCompactor() {
   const emitPendingDelta = ({ finalizeText = false } = {}) => {
     if (!pendingDelta) return [];
     const assistantEvent = pendingDelta.assistantMessageEvent;
+    const combinedDelta = pendingDelta.deltas.join("");
     const retainedEvent = finalizeText && assistantEvent.type === "text_delta" ? {
       type: "message_update",
       assistantMessageEvent: {
         type: "text_end",
         ...Number.isSafeInteger(assistantEvent.contentIndex) ? { contentIndex: assistantEvent.contentIndex } : {},
-        content: assistantEvent.delta ?? ""
+        content: combinedDelta
+      }
+    } : {
+      type: "message_update",
+      assistantMessageEvent: {
+        ...assistantEvent,
+        ...pendingDelta.deltas.length > 0 ? { delta: combinedDelta } : {}
       }
-    } : pendingDelta;
+    };
     const retained = JSON.stringify(retainedEvent);
     pendingDelta = null;
     return [retained];
@@ -19507,11 +19526,14 @@ function createPiOutputRetentionCompactor() {
       const pendingAssistantEvent = pendingDelta?.assistantMessageEvent;
       if (pendingAssistantEvent?.type !== assistantEvent.type || pendingAssistantEvent?.contentIndex !== assistantEvent.contentIndex) {
         const emitted = emitPendingDelta();
-        pendingDelta = compact;
+        pendingDelta = {
+          ...compact,
+          deltas: typeof assistantEvent.delta === "string" ? [assistantEvent.delta] : []
+        };
         return emitted;
       }
       if (typeof assistantEvent.delta === "string") {
-        pendingDelta.assistantMessageEvent.delta = `${pendingDelta.assistantMessageEvent.delta ?? ""}${assistantEvent.delta}`;
+        pendingDelta.deltas.push(assistantEvent.delta);
       }
       if (typeof assistantEvent.content === "string") {
         pendingDelta.assistantMessageEvent.content = assistantEvent.content;
@@ -19520,8 +19542,8 @@ function createPiOutputRetentionCompactor() {
     }
     const matchingDeltaType = `${assistantEvent.type.slice(0, -4)}_delta`;
     if (pendingDelta?.assistantMessageEvent?.type === matchingDeltaType && pendingDelta.assistantMessageEvent.contentIndex === assistantEvent.contentIndex) {
-      if (assistantEvent.type === "text_end" && !assistantEvent.content && pendingDelta.assistantMessageEvent.delta) {
-        assistantEvent.content = pendingDelta.assistantMessageEvent.delta;
+      if (assistantEvent.type === "text_end" && !assistantEvent.content && pendingDelta.deltas.length > 0) {
+        assistantEvent.content = pendingDelta.deltas.join("");
       }
       pendingDelta = null;
     }
@@ -24849,16 +24871,17 @@ function createManagedPiMcpProfileApi(options = {}) {
     }
     return version;
   }
-  function managedPiTelemetryExtension(sharedRuntime) {
+  function managedPiTelemetryExtension(sharedRuntime, packageHome = sharedRuntime.home) {
     const settings = record11(sharedRuntime.settings);
-    const packages = Array.isArray(settings.packages) ? settings.packages : [];
+    const packageSettings = packageHome === sharedRuntime.home ? settings : record11(JSON.parse(readFileSync7(join11(packageHome, "settings.json"), "utf8")));
+    const packages = Array.isArray(packageSettings.packages) ? packageSettings.packages : [];
     const configuredSources = packages.filter((source) => typeof source === "string" && (source === MANAGED_PI_TELEMETRY_PACKAGE_SOURCE || source.startsWith(`${MANAGED_PI_TELEMETRY_PACKAGE_SOURCE}@`)));
     if (configuredSources.length === 0) return null;
     if (configuredSources.length !== 1) {
       throw new Error("pi_managed_mcp_telemetry_package_source_invalid");
     }
     const packageRoot = resolve8(
-      sharedRuntime.home,
+      packageHome,
       "npm",
       "node_modules",
       "@amaster.ai",
@@ -25636,7 +25659,7 @@ ${result2.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         extensionArgs,
         writeProfileExtension
       });
-      const telemetryExtension = managedPiTelemetryExtension(sharedRuntime);
+      const telemetryExtension = managedPiTelemetryExtension(sharedRuntime, input.browserRuntimePackageHome);
       let enabledRoleSkillMetadataBytes = 0;
       const skillProfiles = roleSkillProfilesForRun(input);
       const managedSkillProjection = materializeManagedSkillBundle(profileRoot, input.managedSkillBundle);
@@ -29113,6 +29136,22 @@ function piMessageHasToolCall(message) {
     return block.type === "toolCall" && Boolean(readString(block.name));
   });
 }
+function piReasoningOnlyLengthEvent(event) {
+  const record11 = asRecord(event);
+  if (readString(record11.type) !== "message_end") return null;
+  const message = asRecord(record11.message);
+  if (message.role !== "assistant" || (piMessageStopReason(message) ?? readString(record11.stopReason)) !== "length") return null;
+  const content = Array.isArray(message.content) ? message.content : [];
+  if (!content.some((part) => asRecord(part).type === "thinking")) return null;
+  if (piMessageText(message) || piMessageHasToolCall(message)) return null;
+  const usage = piMessageUsage(message);
+  return {
+    stopReason: "length",
+    outputTokens: usage.outputTokens,
+    inputTokens: usage.inputTokens,
+    contentBlockTypes: [...new Set(content.map((part) => readString(asRecord(part).type)).filter(Boolean))]
+  };
+}
 function appendUniqueText(values, text2) {
   const normalized = typeof text2 === "string" ? text2.trim() : "";
   if (!normalized) return false;
@@ -30407,7 +30446,6 @@ function resolveTaskWikiPolicy(context) {
 }
 
 // src/amaster-runtime-daemon/prompt-compiler.mjs
-var DEADLINE_POSTURE_GUARD = "If a named time window or milestone is missed, skip that window and keep the task moving: never lower quality, bypass approvals, fabricate results, or stop the whole task because of the miss. Record a deadline-posture receipt with targetMilestoneRef, posture, onMiss=skip_this_window_and_continue, taskContinuation, and the next owner/action; the receipt is an execution signal, not Server-side proof.";
 var MIN_PROMPT_BUDGET_CHARS = 8192;
 var MAX_RESOLVED_DEPENDENCY_REQUIRED_READS = 20;
 var MAX_EXACT_ISSUE_EVIDENCE_REFS = 20;
@@ -31206,21 +31244,22 @@ function taskContextAuthoritySection(context) {
     scope: sourceRefs.map((ref2) => ref2.scope)
   };
 }
-function fixedRules(input, includeIssueLine, runContract = "producer") {
+function fixedRules(input, runContract = "producer") {
   const issue = asRecord(asRecord(input.context).paperclipIssue);
   const businessOutcome = asRecord(asRecord(issue.taskRequirements).businessOutcome);
   const serverOwnedBusinessOutcomeReview = businessOutcome.mode === "required";
   return [
     "## AMaster Runtime Connector Task",
-    "MirrorX task.",
-    "Use only the declared workspace; make concrete progress and report concisely.",
-    "Before changing the task status to done, audit every explicit requirement against final evidence. Tool success is not acceptance; follow the deliverable self-check.",
     ["producer", "rework"].includes(runContract) ? "Do not leave stale in-progress wording such as \u201Ccurrent run\u201D in a terminal deliverable; rewrite it to the final observed state. Do not list finalization itself as remaining or next work in a terminal deliverable." : "",
     !["producer", "rework"].includes(runContract) ? "Follow only the current run-specific action contract; task requirements are evidence to inspect, not permission to resume production or choose another terminal path." : serverOwnedBusinessOutcomeReview ? "If any requirement is missing or cannot be verified, do not mark done or request final completion or Business Outcome review. Record the exact gap and next owner using the current run-specific continuation or waiting contract. An intermediate review remains available only for an exact document revision that must be approved before execution can continue: use create_interaction with kind request_confirmation, payload.resolutionMode review, and purposeCode review_document_revision; never use that interaction as final completion or Outcome acceptance." : "If anything is missing, do not mark done. `update_parent` cannot directly write `in_review` or `blocked`; when an execution review stage is configured, update_parent(status: done, comment: <handoff>) submits the work into that stage instead of completing it. Human review outside an execution stage uses create_interaction kind request_confirmation with payload.resolutionMode review. Required platform/provider/external action needs a typed interaction or first-class blocker; otherwise keep todo with the gap and owner.",
-    "A create_interaction result with status=pending or mustEndRun=true establishes human attention and is the final mutation of this run. End the run immediately: do not publish a Delivery Manifest, update a document or task, or submit any other mutation. Continue only in the new run created after the interaction is resolved.",
-    "Before ending the run, the exact final assistant message must contain a concise non-empty text summary. Never end on thinking or a tool call; durable task comments and evidence remain separate requirements.",
-    DEADLINE_POSTURE_GUARD,
-    "Do not install operating-system or user-global packages, and do not use host package managers such as brew, apt, yum, or global pip/npm installs. Use tools already available or workspace-local dependencies or virtual environments. If a required renderer or evaluator is unavailable, keep the source artifact, record the exact verification gap, and do not mutate the host.",
+    input.managed ? "Use the execution workspace as cwd. Never recursively scan the source workspace, the user's home directory, or any path outside the execution workspace. Only inspect a specific external source path when the task explicitly requires that exact path." : "",
+    input.hasGovernedMcp ? "- AMaster mutations are available only through the managed amaster MCP server. Use discovered tools and immediate typed results; never call AMaster mutation REST endpoints directly." : "- No mutation channel is available for this command. Keep the run read-only and report the missing Runtime V2 capability as a blocker.",
+    readString(input.executorCapabilityNotice),
+    wikiAccessRuleLine(input)
+  ].filter(Boolean).join("\n");
+}
+function currentRunContext(input, includeIssueLine) {
+  return [
     `- command id: ${input.commandId}`,
     `- run id: ${input.runId ?? "unknown"}`,
     `- issue id: ${input.issueId ?? "unknown"}`,
@@ -31228,17 +31267,7 @@ function fixedRules(input, includeIssueLine, runContract = "producer") {
     includeIssueLine && input.issueLine ? `- issue: ${input.issueLine}` : "",
     `- workspace: ${input.cwd}`,
     input.managed ? `- source workspace: ${input.sourceWorkspacePath}` : "",
-    input.managed ? "Use the execution workspace as cwd. Never recursively scan the source workspace, the user's home directory, or any path outside the execution workspace. Only inspect a specific external source path when the task explicitly requires that exact path." : "",
-    input.wakeReason ? `- wake reason: ${input.wakeReason}` : "",
-    input.hasGovernedMcp ? "- AMaster mutations are available only through the managed amaster MCP server. Use discovered tools and immediate typed results; never call AMaster mutation REST endpoints directly." : "- No mutation channel is available for this command. Keep the run read-only and report the missing Runtime V2 capability as a blocker.",
-    readString(input.executorCapabilityNotice),
-    wikiAccessRuleLine(input),
-    "- Runtime Artifact lineage fields sourceWorkProductId and sourceWorkProductIds accept only current artifact work product ids returned as result.effectResult.workProductId by a succeeded upload_artifact action. Never pass a documentId or revisionId as artifact lineage.",
-    "- When all inputs are issue documents and there is no source artifact work product, persist the derived result using an available Issue document action and do not call upload_artifact for a derived or review artifact.",
-    "- When this task creates, deploys, publishes, or otherwise delivers a user-openable non-file result, call upsert_work_product before final disposition. Use application for apps/sites/mini programs/dashboards, published_content for posts/videos/articles, external_link for other URL results, and the existing code/runtime types for pull requests, branches, commits, previews, and services.",
-    "- For a Helige application created with the helige-app-builder skill, call upsert_work_product immediately after the preview or deployment is verified and before upsert_document, add_comment, or update_parent. Use provider helige, applicationId as externalId, the actual preview or production URL, and preserve applicationId, appCode, releaseId, releaseVersion, environment, applicationKind, platform, observedAt, and publishedAt metadata when available.",
-    "- upsert_work_product records an agent-reported result for collection; it does not prove provider verification, health, approval, or business Acceptance. Those states remain Server/provider owned.",
-    "- A URL mentioned only in an Issue document, comment, assistant message, or provider tool output is not a collected work product. Persist the typed work product and use its returned workProductId as the durable receipt before marking the task done."
+    input.wakeReason ? `- wake reason: ${input.wakeReason}` : ""
   ].filter(Boolean).join("\n");
 }
 function compileConversationPrompt(input, context, maxChars) {
@@ -31248,7 +31277,6 @@ function compileConversationPrompt(input, context, maxChars) {
     companyId: readString(asRecord(context.paperclipCompany).id),
     issueId: input.issueId ?? null
   };
-  const piGovernedTools = piDirectTypedToolsText(input);
   const runtimeSafety = [
     "Use only the declared execution workspace. Do not recursively scan the source workspace, the user's home directory, or unrelated paths.",
     "Do not install operating-system or user-global packages. Use existing tools or workspace-local dependencies.",
@@ -31263,7 +31291,6 @@ function compileConversationPrompt(input, context, maxChars) {
     { name: "task", title: "Conversation History", priority: 90, sourceRef: "conversation", originalContent: taskText, content: mode === "cold" ? taskText : "", truncationReason: mode === "cold" ? null : "mode_selection" },
     ...readString(input.browserCredentialEnv) ? [{ name: "browser_credential_env", title: "Browser Credential Access", priority: 100, sourceRef: `command:${input.commandId}:browser-credentials`, content: readString(input.browserCredentialEnv) }] : [],
     { name: "runtime_safety", title: "Runtime Safety", priority: 100, sourceRef: `command:${input.commandId}`, content: runtimeSafety },
-    ...piGovernedTools ? [{ name: "pi_governed_tools", title: "Pi Governed Tools", priority: 96, sourceRef: "amaster_governed_mcp_direct_typed_contract", content: piGovernedTools }] : [],
     { name: "agent_instructions", title: "Agent Instructions", priority: 100, sourceRef: "agent_instructions_bundle", content: readString(input.agentInstructions) ?? "" },
     { name: "mention_context", title: "Mentioned Context", priority: 85, sourceRef: "paperclip_mention_context", content: readString(input.mentionContextText) ?? "" },
     { name: "attachments", title: "Materialized Inputs", priority: 80, sourceRef: "materialized_attachments", content: readString(input.attachmentsText) ?? "" },
@@ -31921,18 +31948,6 @@ function taskCommentRefGuidance(input, taskText) {
   }
   return guidance.join(" ");
 }
-function piDirectTypedToolsText(input) {
-  if (!input.hasGovernedMcp || input.executorKind !== "pi" || input.managedMcpToolMode !== "direct_typed") return "";
-  const catalog = asRecord(input.managedMcpToolCatalog);
-  const tools = (Array.isArray(catalog.tools) ? catalog.tools : []).map(asRecord).map((tool) => ({ name: readString(tool.exposedName), description: readString(tool.description) })).filter((tool) => tool.name);
-  if (tools.length === 0) {
-    return "Direct typed tools are unavailable because the run catalog snapshot is empty. Do not guess a proxy or tool name.";
-  }
-  return [
-    "Use only the attested direct typed tools already present in the provider tool definitions. Call their exact names with object arguments; do not call the `mcp` proxy and do not stringify an inner argument envelope.",
-    "A tool absent from the provider tool definitions is unavailable in this run. Do not infer a namespace or fall back to REST/bare MCP."
-  ].join("\n");
-}
 function sectionText(section) {
   if (!section.content) return "";
   return section.title ? `## ${section.title}
@@ -31961,10 +31976,10 @@ var COMPANY_INITIALIZATION_PRE_AUTHORITY_SECTIONS = /* @__PURE__ */ new Set([
 var COMPANY_INITIALIZATION_POST_AUTHORITY_SECTIONS = /* @__PURE__ */ new Set([
   "browser_credential_env",
   "runtime_rules",
+  "current_run_context",
   "runtime_authorization",
   "runtime_decomposition_requirement",
   "task_context_authority",
-  "pi_governed_tools",
   "runtime_template_catalog",
   "agent_instructions",
   "on_demand_refs",
@@ -32129,7 +32144,6 @@ var CONTEXT_AVAILABILITY_SECTION_TITLES = Object.freeze({
   runtime_decomposition_requirement: "Required Task Decomposition",
   task_context_authority: "Task Context Authority",
   verified_company_context: "Verified Company Context",
-  pi_governed_tools: "Pi Governed Tools",
   governed_reads: "Governed External Reads",
   optional_task_wiki_context: "Optional Company Wiki Context",
   agent_instructions: "Agent Instructions",
@@ -32204,10 +32218,10 @@ function buildManifest(mode, maxChars, sections, governedReadProvenance, usedCha
     governedReadProvenance
   };
 }
-var RUNTIME_SYSTEM_SECTIONS = /* @__PURE__ */ new Set(["runtime_rules", "runtime_authorization", "pi_governed_tools", "agent_instructions"]);
+var RUNTIME_SYSTEM_SECTIONS = /* @__PURE__ */ new Set(["agent_instructions"]);
 function deliverCompiledPrompt(prompt, manifest, sections, separateRuntimeRules) {
   if (!separateRuntimeRules) return { prompt, manifest };
-  const inSystem = (section) => RUNTIME_SYSTEM_SECTIONS.has(section.name) && !(section.name === "runtime_authorization" && section.content.includes(EXACT_ORGANIZATION_INTENT_REPLAY_MARKER));
+  const inSystem = (section) => RUNTIME_SYSTEM_SECTIONS.has(section.name);
   const userPrompt = renderPrompt(sections.filter((section) => !inSystem(section)));
   const systemPrompt = renderPrompt(sections.filter(inSystem));
   if (!userPrompt.trim() || !systemPrompt.trim()) return { prompt, manifest };
@@ -32368,7 +32382,6 @@ ${resolvedDependencies.details.content}` : resolvedDependencies.details.content
     content: resolvedDependencyContent,
     mandatoryContent: resolvedDependencies.required.content
   } : null;
-  const piGovernedTools = piDirectTypedToolsText(input);
   const deliveryReadinessContent = runtimeDeliveryReadinessText(context, input);
   const executionReviewContract = ["reviewer", "approver", "invalid_execution_stage"].includes(runContract) ? executionReviewContractSection(context, input) : null;
   const producerExecutionHandoff = producerExecutionHandoffSection(input, runContract, pendingExecutionStages);
@@ -32409,7 +32422,8 @@ ${resolvedDependencies.details.content}` : resolvedDependencies.details.content
     ...deliveryReadinessContent ? [{ name: "runtime_delivery_readiness", title: "Current Delivery Readiness", priority: 99, sourceRef: `issue:${input.issueId ?? "unknown"}:delivery`, content: deliveryReadinessContent }] : [],
     ...companyInitializationAuthority && !includeTask ? [companyInitializationAuthority] : [],
     ...!hasTask && readString(input.issueLine) && options.separateRuntimeRules === true ? [{ name: "issue_line", title: "", priority: 100, sourceRef: `issue:${input.issueId ?? "unknown"}`, content: `- issue: ${input.issueLine}` }] : [],
-    { name: "runtime_rules", title: "", priority: 100, sourceRef: `command:${input.commandId}`, content: fixedRules(input, !hasTask && options.separateRuntimeRules !== true, runContract) },
+    { name: "runtime_rules", title: "", priority: 100, sourceRef: `command:${input.commandId}`, content: fixedRules(input, runContract) },
+    { name: "current_run_context", title: "", priority: 100, sourceRef: `command:${input.commandId}`, content: currentRunContext(input, !hasTask && options.separateRuntimeRules !== true) },
     { name: "runtime_authorization", title: "Runtime Action Contract", priority: 98, sourceRef: `run:${input.runId ?? "unknown"}`, content: runtimeAuthorizationText(context, mode, {
       replayAlreadyInTask: includeTask && taskText.includes(EXACT_ORGANIZATION_INTENT_REPLAY_MARKER),
       runContract,
@@ -32420,13 +32434,6 @@ ${resolvedDependencies.details.content}` : resolvedDependencies.details.content
     { name: "runtime_decomposition_requirement", title: "Required Task Decomposition", priority: 98, sourceRef: `issue:${input.issueId ?? "unknown"}`, content: runtimeDecompositionRequirementText(context) },
     ...taskContextAuthority ? [{ name: "task_context_authority", title: "Task Context Authority", priority: 100, ...taskContextAuthority, mandatoryContent: taskContextAuthority.content }] : [],
     ...verifiedCompanyContext.content ? [{ name: "verified_company_context", title: "Verified Company Context", priority: 96, sourceRef: verifiedCompanyContext.sourceRef, observedAt: verifiedCompanyContext.observedAt, freshness: { kind: "run_snapshot" }, content: verifiedCompanyContext.content }] : [],
-    ...piGovernedTools ? [{
-      name: "pi_governed_tools",
-      title: "Pi Governed Tools",
-      priority: 96,
-      sourceRef: "amaster_governed_mcp_direct_typed_contract",
-      content: piGovernedTools
-    }] : [],
     { name: "governed_reads", title: "Governed External Reads", priority: 88, sourceRef: governedReads.provenance.map((entry) => entry.sourceRef), observedAt: governedReads.provenance.map((entry) => entry.observedAt), freshness: governedReads.provenance.map((entry) => entry.freshness), scope: governedReads.provenance.map((entry) => entry.scope), content: governedReads.content },
     ...optionalTaskWikiContext ? [optionalTaskWikiContext] : [],
     ...runtimeTemplateCatalog ? [{ name: "runtime_template_catalog", title: "Runtime Template Catalog", priority: 100, ...runtimeTemplateCatalog }] : [],
@@ -32933,14 +32940,9 @@ var BUILD_SUPPORTED_CAPABILITIES = Object.freeze([
   "mirrorx_initialization_context_v1",
   "mirrorx_initialization_completion_v1",
   "native_session_checkpoint_v1",
-  "pi_web_public_search_v1",
-  "pi_web_public_fetch_v1"
+  "pi_web_public_search_v1"
 ]);
 var DYNAMIC_READINESS = Object.freeze({
-  pi_web_public_fetch_v1: {
-    reasonCode: "pi_web_fetch_extension_unavailable",
-    ready: (input) => input.executors.some((executor) => executor.kind === "pi") && input.piWebFetchReady === true
-  },
   pi_web_public_search_v1: {
     reasonCode: "pi_web_search_extension_unavailable",
     ready: (input) => input.executors.some((executor) => executor.kind === "pi") && input.piWebSearchReady === true
@@ -32951,10 +32953,7 @@ var DYNAMIC_READINESS = Object.freeze({
   },
   browser_credential_auth_transaction_v1: {
     reasonCode: "browser_credential_auth_runtime_incomplete",
-    ready: (input) => {
-      const readiness = input.browserCredentialAuth;
-      return input.executors.some((executor) => executor.kind === "pi") && readiness?.privateChannel === true && readiness?.executorClient === true && readiness?.sealedGate === true && readiness?.atomicTransaction === true && readiness?.trustedProfileInjection === true;
-    }
+    ready: (input) => input.executors.some((executor) => executor.kind === "pi") && input.browserCredentialAuth?.extension === true
   },
   native_session_checkpoint_v1: {
     reasonCode: "managed_pi_checkpoint_required",
@@ -33584,7 +33583,6 @@ import { existsSync as existsSync12, lstatSync as lstatSync10, readFileSync as r
 import { createHash as createHash14 } from "node:crypto";
 import { homedir as homedir4 } from "node:os";
 import { dirname as dirname11, isAbsolute as isAbsolute7, join as join17, relative as relative5, resolve as resolve11 } from "node:path";
-var CAPABILITY = "browser_credential_auth_transaction_v1";
 var CREDENTIAL_BROWSER_TCB = Object.freeze({
   package: "chrome-devtools-mcp",
   version: "1.6.0",
@@ -33592,13 +33590,17 @@ var CREDENTIAL_BROWSER_TCB = Object.freeze({
   buildTreeSha256: "5bd07cd7ea92141441db12d1e84c4829dd4e2a45ea77f719878be9f4a42925d7"
 });
 var CREDENTIAL_BROWSER_PACKAGE_FILES = Object.freeze({
-  "dist/config.js": "ed61ba70f3c2445db22fac31c432c86df2d9b3674bd36b34cce6f7a981f3926f",
-  "dist/index.js": "e94fdec799848fc45942cc59868dfd12dd27597025f757eded3e1d7e3a8e0fb9"
+  "dist/config.js": "01da4c975a050dc1860a5115b244020be741100bff3c426f601642a6f757f370",
+  "dist/index.js": "9cf0dac303552cbfb7f87c9499dbd8c1d88565e0145825ca222424e1123b70e2"
 });
-var CREDENTIAL_AUTH_EXTENSION_SHA256 = "3ad9c39fc20d35e6486cdccaee832b986108919b678b98134f1386233560277e";
+var CREDENTIAL_BROWSER_DIST_TREE_SHA256 = "fcf1abd578c519b7ab7cec921d1abe36992aab84b4f713e0b89587e6254145a9";
+var CREDENTIAL_AUTH_EXTENSION_SHA256 = "48f36d0c1c5c46f07bd447c2bc2000595d17f109ce6963865870d88f42c60598";
 var CREDENTIAL_BROWSER_PACKAGE_VERSION = "0.1.2-beta.80";
 var IMAGE_PI_HOME = "/opt/pi-cli-runtime/.pi";
+var BROWSER_AUTH_IMAGE_HOME = IMAGE_PI_HOME;
 var IMAGE_AUTH_EXTENSION_PATH = join17(IMAGE_PI_HOME, "extensions", "browser-credential-auth.mjs");
+var MANAGED_BROWSER_EXCLUDED_PACKAGES = /* @__PURE__ */ new Set(["@amaster.ai/pi-browser-use", "pi-mcp-adapter"]);
+var RUNTIME_PACKAGE_SOURCE = /^npm:((?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*)$/u;
 var BROWSER_AUTH_IMAGE_NODE_PATH = join17(IMAGE_PI_HOME, "npm", "node_modules");
 var READINESS_CACHE_TTL_MS = 5e3;
 var readinessCache = /* @__PURE__ */ new Map();
@@ -33618,6 +33620,7 @@ function inspectBrowserCredentialAuthReadiness(env = process.env, expected = {},
   const packageAttestation = candidates.map((manifestPath) => attestedPackageManifest(manifestPath, {
     browserTcb: expected.browserTcb ?? CREDENTIAL_BROWSER_TCB,
     packageFiles: expected.packageFiles ?? CREDENTIAL_BROWSER_PACKAGE_FILES,
+    packageDistTreeSha256: expected.packageDistTreeSha256 ?? CREDENTIAL_BROWSER_DIST_TREE_SHA256,
     authExtensionSha256: expected.authExtensionSha256 ?? CREDENTIAL_AUTH_EXTENSION_SHA256
   }, requireImageOwnership)).find(Boolean) ?? null;
   const packageAttested = Boolean(packageAttestation);
@@ -33626,23 +33629,86 @@ function inspectBrowserCredentialAuthReadiness(env = process.env, expected = {},
     packageAttestation ? expected.authExtensionSha256 ?? CREDENTIAL_AUTH_EXTENSION_SHA256 : null,
     requireImageOwnership
   );
+  let runtimeExtensionsAttested = false;
+  if (packageAttested && authExtensionAttested) {
+    try {
+      managedBrowserRuntimeExtensionArgs(packageHome, requireImageOwnership);
+      runtimeExtensionsAttested = true;
+    } catch {
+      runtimeExtensionsAttested = false;
+    }
+  }
+  const ready = packageAttested && authExtensionAttested && runtimeExtensionsAttested;
   const readiness = {
+    extension: ready,
     privateChannel: true,
-    executorClient: packageAttested,
-    sealedGate: packageAttested && authExtensionAttested,
-    atomicTransaction: packageAttested && authExtensionAttested,
-    trustedProfileInjection: packageAttested
+    executorClient: ready,
+    sealedGate: ready,
+    atomicTransaction: ready,
+    trustedProfileInjection: ready
   };
   readinessCache.set(cacheKey, { readiness, expiresAt: now + READINESS_CACHE_TTL_MS });
   return { ...readiness };
 }
 function browserCredentialAuthExtensionArgs(authority, env = process.env, expected = {}, options = {}) {
-  if (!authority) return [];
+  if (authority && !env.AMASTER_BROWSER_SESSION_USER_DATA_DIR) {
+    throw new Error("browser_credential_authority_profile_required");
+  }
+  if (!env.AMASTER_BROWSER_SESSION_USER_DATA_DIR && !authority) return [];
   const readiness = inspectBrowserCredentialAuthReadiness(env, expected, { ...options, fresh: true });
   if (!readiness.atomicTransaction || !readiness.sealedGate) {
     throw new Error("browser_credential_auth_extension_unavailable");
   }
-  return ["--extension", expected.authExtensionPath ?? IMAGE_AUTH_EXTENSION_PATH];
+  return [
+    "--no-extensions",
+    ...managedBrowserRuntimeExtensionArgs(expected.packageHome ?? IMAGE_PI_HOME, options.requireImageOwnership !== false),
+    "--extension",
+    expected.authExtensionPath ?? IMAGE_AUTH_EXTENSION_PATH
+  ];
+}
+function managedBrowserRuntimeExtensionArgs(packageHome, requireImageOwnership) {
+  const settingsPath = join17(packageHome, "settings.json");
+  if (requireImageOwnership && !immutableImageFile(settingsPath)) {
+    throw new Error("browser_credential_runtime_extensions_unsafe");
+  }
+  let packageSources;
+  try {
+    packageSources = JSON.parse(readFileSync13(settingsPath, "utf8")).packages;
+  } catch {
+    throw new Error("browser_credential_runtime_extensions_invalid");
+  }
+  if (!Array.isArray(packageSources)) throw new Error("browser_credential_runtime_extensions_invalid");
+  const args = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const source of packageSources) {
+    const packageName = typeof source === "string" ? RUNTIME_PACKAGE_SOURCE.exec(source)?.[1] : null;
+    if (!packageName || seen.has(packageName)) throw new Error("browser_credential_runtime_extensions_invalid");
+    seen.add(packageName);
+    if (MANAGED_BROWSER_EXCLUDED_PACKAGES.has(packageName)) continue;
+    const packageDir = join17(packageHome, "npm", "node_modules", packageName);
+    const manifestPath = join17(packageDir, "package.json");
+    if (requireImageOwnership && !immutableImageFile(manifestPath)) {
+      throw new Error("browser_credential_runtime_extensions_unsafe");
+    }
+    let manifest;
+    try {
+      manifest = JSON.parse(readFileSync13(manifestPath, "utf8"));
+    } catch {
+      throw new Error("browser_credential_runtime_extensions_invalid");
+    }
+    if (manifest.name !== packageName || !Array.isArray(manifest.pi?.extensions) || manifest.pi.extensions.length === 0) throw new Error("browser_credential_runtime_extensions_invalid");
+    for (const relativePath of manifest.pi.extensions) {
+      if (typeof relativePath !== "string" || !relativePath.startsWith("./")) {
+        throw new Error("browser_credential_runtime_extensions_invalid");
+      }
+      const path = resolve11(packageDir, relativePath);
+      if (!relative5(packageDir, path) || relative5(packageDir, path).startsWith("..") || isAbsolute7(relative5(packageDir, path)) || !existsSync12(path) || !lstatSync10(path).isFile() || requireImageOwnership && !immutableImageFile(path)) {
+        throw new Error("browser_credential_runtime_extensions_unsafe");
+      }
+      args.push("--extension", path);
+    }
+  }
+  return args;
 }
 function attestedAuthExtension(extensionPath, expectedSha256, requireImageOwnership) {
   try {
@@ -33693,18 +33759,13 @@ function attestedPackageManifest(manifestPath, expected, requireImageOwnership)
     if (requireImageOwnership && !immutableImageFile(manifestPath)) return null;
     const manifest = JSON.parse(readFileSync13(manifestPath, "utf8"));
     if (manifest?.name !== "@amaster.ai/pi-browser-use" || manifest.version !== CREDENTIAL_BROWSER_PACKAGE_VERSION) return null;
-    if (!Array.isArray(manifest.mirrorxCapabilities) || manifest.mirrorxCapabilities.length !== 1 || manifest.mirrorxCapabilities[0] !== CAPABILITY) {
-      return null;
-    }
-    if (!sameCredentialBrowserTcb(manifest.mirrorxCredentialBrowserTcb, expected.browserTcb)) return null;
-    if (manifest.mirrorxCredentialAuthExtensionSha256 !== expected.authExtensionSha256) return null;
-    if (typeof manifest.main !== "string" || !manifest.main.trim()) return null;
+    if (manifest.main !== "./dist/index.js" || !Array.isArray(manifest.pi?.extensions) || manifest.pi.extensions.length !== 1 || manifest.pi.extensions[0] !== "./dist/index.js") return null;
     const packageDir = resolve11(manifestPath, "..");
     if (Object.entries(expected.packageFiles).some(([relativePath, sha2563]) => {
       const path = resolve11(packageDir, relativePath);
       const relativePathFromPackage = relative5(packageDir, path);
       return !relativePathFromPackage || relativePathFromPackage.startsWith("..") || isAbsolute7(relativePathFromPackage) || !statSync6(path).isFile() || requireImageOwnership && !immutableImageFile(path) || fileSha256(path) !== sha2563;
-    })) return null;
+    }) || treeAttestation(join17(packageDir, "dist"), requireImageOwnership) !== expected.packageDistTreeSha256) return null;
     const browserPackageDir = resolve11(packageDir, "..", "..", "chrome-devtools-mcp");
     const browserManifestPath = join17(browserPackageDir, "package.json");
     if (requireImageOwnership && !immutableImageFile(browserManifestPath)) return null;
@@ -33718,9 +33779,6 @@ function attestedPackageManifest(manifestPath, expected, requireImageOwnership)
     return null;
   }
 }
-function sameCredentialBrowserTcb(value, expected) {
-  return value && typeof value === "object" && Object.entries(expected).every(([key, expectedValue]) => value[key] === expectedValue) && Object.keys(value).length === Object.keys(expected).length;
-}
 
 // src/amaster-runtime-daemon/browser-credential-env-readiness.mjs
 import { lstatSync as lstatSync11, readFileSync as readFileSync14 } from "node:fs";
@@ -33787,15 +33845,10 @@ function inspectPiWebSearchReadiness(env = process.env) {
   const providers = settings?.["pi-web-access"]?.providers;
   return Boolean(installed && providers && typeof providers === "object" && !Array.isArray(providers) && Object.keys(providers).length > 0);
 }
-function inspectPiWebFetchReadiness(env = process.env) {
-  const { settings, installed } = installedPiWebAccess(env);
-  const fetch2 = settings?.["pi-web-access"]?.fetch;
-  return Boolean(installed && fetch2?.mode === "direct" && fetch2?.dnsOverHttps === "google");
-}
 
 // src/amaster-runtime-daemon/browser-credential-env.mjs
-import { chmodSync as chmodSync7, mkdtempSync as mkdtempSync3, renameSync as renameSync10, rmSync as rmSync10, writeFileSync as writeFileSync13 } from "node:fs";
-import { join as join20, resolve as resolve12 } from "node:path";
+import { chmodSync as chmodSync7, existsSync as existsSync13, mkdtempSync as mkdtempSync3, renameSync as renameSync10, rmSync as rmSync10, writeFileSync as writeFileSync13 } from "node:fs";
+import { isAbsolute as isAbsolute9, join as join20, resolve as resolve12 } from "node:path";
 var BROWSER_CREDENTIAL_ENV_CAPABILITY = "browser_credential_env_read_v1";
 var BROWSER_CREDENTIAL_PRIVATE_CAPABILITY = "browser_credential_auth_transaction_v1";
 var BROWSER_CREDENTIAL_ENV_FILE = "PI_AGENT_BROWSER_CREDENTIAL_ENV_FILE";
@@ -33890,6 +33943,19 @@ function attachTrustedBrowserExecutorEnv(env, { authority = null, userDataDir =
   if (authority) result2[BROWSER_CREDENTIAL_AUTHORITY_ENV] = JSON.stringify(authority);
   return result2;
 }
+function companyBrowserProfileDir(companyId, root = "/data/companies") {
+  const id = companyId || "shared";
+  if (!isAbsolute9(root) || !/^[A-Za-z0-9_-]+$/u.test(id)) fail3("browser_company_profile_invalid");
+  return join20(root, id, ".pi", "browser-profile");
+}
+function browserCredentialExtensionArgs(presentation, env, { managedBrowserSession = false } = {}) {
+  if (managedBrowserSession) return [];
+  if (presentation !== "private_channel") return [];
+  const home = env.PI_CODING_AGENT_DIR || env.PI_AGENT_HOME;
+  const extension = home && join20(home, "extensions", "browser-credential-auth.mjs");
+  if (!extension || !existsSync13(extension)) fail3("browser_credential_auth_extension_missing");
+  return ["--no-extensions", "--extension", extension];
+}
 function dotenvQuotedValue(value) {
   if (value.includes("\0")) fail3("browser_credential_env_value_invalid");
   return `"${value.replace(/[\\"\n\r\t$`]/gu, (char) => ({
@@ -33947,7 +34013,7 @@ async function materializeBrowserCredentialEnv(plan, options) {
 // src/amaster-runtime-daemon/runtime-artifact-upload.mjs
 import { createHash as createHash15 } from "node:crypto";
 import { closeSync as closeSync4, constants as constants3, fstatSync as fstatSync4, lstatSync as lstatSync13, openSync as openSync4, readFileSync as readFileSync16, realpathSync as realpathSync10 } from "node:fs";
-import { isAbsolute as isAbsolute9, relative as relative6, resolve as resolve13 } from "node:path";
+import { isAbsolute as isAbsolute10, relative as relative6, resolve as resolve13 } from "node:path";
 var SHA256_PATTERN = /^[a-f0-9]{64}$/;
 function requiredString2(value, name) {
   if (typeof value !== "string" || !value.trim()) throw new Error(`Runtime Artifact ${name} is required`);
@@ -33960,7 +34026,7 @@ function ownedRelativePath(value) {
 }
 function pathWithin2(candidate, root) {
   const rel = relative6(root, candidate);
-  return rel === "" || !rel.startsWith("..") && !isAbsolute9(rel);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute10(rel);
 }
 function sameFileSnapshot(left, right) {
   return left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeMs === right.mtimeMs && left.ctimeMs === right.ctimeMs;
@@ -34325,11 +34391,11 @@ function createRuntimeArtifactIngestQueue({ ingest, onError }) {
 
 // src/amaster-runtime-daemon/workspace-guard.mjs
 import { createHash as createHash17 } from "node:crypto";
-import { existsSync as existsSync13, mkdirSync as mkdirSync12, realpathSync as realpathSync11, statSync as statSync7 } from "node:fs";
-import { basename as basename6, join as join21, isAbsolute as isAbsolute10, relative as relative7, resolve as resolve14 } from "node:path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync12, realpathSync as realpathSync11, statSync as statSync7 } from "node:fs";
+import { basename as basename6, join as join21, isAbsolute as isAbsolute11, relative as relative7, resolve as resolve14 } from "node:path";
 function pathWithin3(candidate, root) {
   const rel = relative7(root, candidate);
-  return rel === "" || !rel.startsWith("..") && !isAbsolute10(rel);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute11(rel);
 }
 function resolveWorkspaceCwd(config, command) {
   const payload = asRecord(command.payload);
@@ -34347,7 +34413,7 @@ function resolveWorkspaceCwd(config, command) {
   if (!allowed) {
     throw new Error(`Workspace path is outside AMASTER_WORKSPACE_ALLOWLIST: ${cwd}`);
   }
-  if (!existsSync13(cwd) || !statSync7(cwd).isDirectory()) {
+  if (!existsSync14(cwd) || !statSync7(cwd).isDirectory()) {
     throw new Error(`Workspace path does not exist or is not a directory: ${cwd}`);
   }
   return cwd;
@@ -34421,7 +34487,7 @@ function resolveExecutionWorkspace(config, command, opts = {}) {
 }
 
 // src/amaster-runtime-daemon/workspace-gc.mjs
-import { existsSync as existsSync14, readdirSync as readdirSync10, statSync as statSync8 } from "node:fs";
+import { existsSync as existsSync15, readdirSync as readdirSync10, statSync as statSync8 } from "node:fs";
 import { join as join22, resolve as resolve15 } from "node:path";
 function readIsoTime(value) {
   if (typeof value !== "string" || !value.trim()) return null;
@@ -34446,7 +34512,7 @@ function walkWorkdirs(root) {
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
       const fullPath = join22(current, entry.name);
-      if (entry.name === "workdir" && existsSync14(workspaceManifestPath(fullPath))) {
+      if (entry.name === "workdir" && existsSync15(workspaceManifestPath(fullPath))) {
         workdirs.push(fullPath);
         continue;
       }
@@ -34521,7 +34587,7 @@ function planManagedWorkspaceGcDryRun(input) {
     candidates: [],
     protected: []
   };
-  if (!root || !existsSync14(root)) return result2;
+  if (!root || !existsSync15(root)) return result2;
   for (const workdir of walkWorkdirs(root)) {
     const manifest = readWorkspaceManifest(workspaceManifestPath(workdir));
     if (!manifest || manifest.managed !== true) continue;
@@ -34554,7 +34620,7 @@ import {
   accessSync,
   chmodSync as chmodSync8,
   constants as constants4,
-  existsSync as existsSync15,
+  existsSync as existsSync16,
   lstatSync as lstatSync14,
   mkdirSync as mkdirSync13,
   mkdtempSync as mkdtempSync4,
@@ -34566,7 +34632,7 @@ import {
   unlinkSync as unlinkSync3,
   writeFileSync as writeFileSync14
 } from "node:fs";
-import { dirname as dirname12, extname, isAbsolute as isAbsolute11, join as join23, parse as parse5, resolve as resolve16, sep as sep4 } from "node:path";
+import { dirname as dirname12, extname, isAbsolute as isAbsolute12, join as join23, parse as parse5, resolve as resolve16, sep as sep4 } from "node:path";
 import { fileURLToPath } from "node:url";
 var PRESET_TEMPLATE_MANIFEST_FILE = ".mirrorx-preset-templates.json";
 var MAX_PRESET_TEMPLATE_FILES = 256;
@@ -34622,7 +34688,7 @@ function hasAllowedTemplateExtension(name) {
   return ALLOWED_TEMPLATE_EXTENSIONS.has(extname(name).toLowerCase());
 }
 function validTemplateName(value) {
-  return typeof value === "string" && value.length > 0 && value !== "." && value !== ".." && !value.includes("\0") && !value.includes("/") && !value.includes("\\") && !isAbsolute11(value) && parse5(value).base === value && hasAllowedTemplateExtension(value);
+  return typeof value === "string" && value.length > 0 && value !== "." && value !== ".." && !value.includes("\0") && !value.includes("/") && !value.includes("\\") && !isAbsolute12(value) && parse5(value).base === value && hasAllowedTemplateExtension(value);
 }
 function readManifest(manifestPath, { strict }) {
   try {
@@ -34670,7 +34736,7 @@ function removeRetiredPresetFiles(targetDir, previousManifest, nextNames) {
   for (const entry of previousManifest.files) {
     if (nextNames.has(entry.name)) continue;
     const targetPath = join23(targetDir, entry.name);
-    if (!existsSync15(targetPath)) continue;
+    if (!existsSync16(targetPath)) continue;
     const stat = lstatSync14(targetPath);
     if (stat.isDirectory()) {
       throw new Error(`preset_template_target_conflict: ${entry.name}`);
@@ -34754,7 +34820,7 @@ function materializeRuntimePresetTemplates(input) {
 }
 
 // src/amaster-runtime-daemon/runtime-status-summary.mjs
-import { existsSync as existsSync16, readdirSync as readdirSync12, statSync as statSync10 } from "node:fs";
+import { existsSync as existsSync17, readdirSync as readdirSync12, statSync as statSync10 } from "node:fs";
 import { dirname as dirname13, join as join24, resolve as resolve17 } from "node:path";
 function runtimeStatusDirectoryEntries(path) {
   try {
@@ -34788,7 +34854,7 @@ function runtimeStatusDirectorySizeBytes(path) {
 }
 function walkRuntimeStatusManagedWorkdirs(root) {
   const workdirs = [];
-  if (!root || !existsSync16(root)) return workdirs;
+  if (!root || !existsSync17(root)) return workdirs;
   const stack = [root];
   while (stack.length > 0) {
     const current = stack.pop();
@@ -34796,7 +34862,7 @@ function walkRuntimeStatusManagedWorkdirs(root) {
     for (const entry of runtimeStatusDirectoryEntries(current)) {
       if (!entry.isDirectory()) continue;
       const fullPath = join24(current, entry.name);
-      if (entry.name === "workdir" && existsSync16(workspaceManifestPath(fullPath))) {
+      if (entry.name === "workdir" && existsSync17(workspaceManifestPath(fullPath))) {
         workdirs.push(fullPath);
         continue;
       }
@@ -34850,7 +34916,7 @@ function runtimeStatusRunCompletionDir(config) {
   })), "run-completion-state");
 }
 function countRuntimeStatusJsonEntries(dir) {
-  if (!existsSync16(dir)) return 0;
+  if (!existsSync17(dir)) return 0;
   return runtimeStatusDirectoryEntries(dir).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).length;
 }
 function summarizeRuntimeLocalState(input) {
@@ -35245,8 +35311,8 @@ export default function amasterProjectInstructions(pi) {
 // src/amaster-runtime-daemon/workspace-status.mjs
 import { spawnSync as spawnSync5 } from "node:child_process";
 import { createHash as createHash19 } from "node:crypto";
-import { existsSync as existsSync17, readdirSync as readdirSync13, readFileSync as readFileSync20, statSync as statSync11 } from "node:fs";
-import { basename as basename7, extname as extname2, isAbsolute as isAbsolute12, join as join25, relative as relative8, resolve as resolve19 } from "node:path";
+import { existsSync as existsSync18, readdirSync as readdirSync13, readFileSync as readFileSync20, statSync as statSync11 } from "node:fs";
+import { basename as basename7, extname as extname2, isAbsolute as isAbsolute13, join as join25, relative as relative8, resolve as resolve19 } from "node:path";
 var WORKSPACE_RUNTIME_SERVICES_FILENAME = ".amaster-runtime-services.json";
 var ARTIFACT_EXTENSIONS = /* @__PURE__ */ new Map([
   [".md", "markdown"],
@@ -35292,7 +35358,7 @@ var SAFE_RUNTIME_SERVICE_HEALTH_STATUSES = /* @__PURE__ */ new Set(["unknown", "
 var SAFE_RUNTIME_SERVICE_LIFECYCLES = /* @__PURE__ */ new Set(["shared", "ephemeral"]);
 function statusPathWithin(candidate, root) {
   const rel = relative8(root, candidate);
-  return rel === "" || !rel.startsWith("..") && !isAbsolute12(rel);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute13(rel);
 }
 function normalizeRelativePath(root, filePath) {
   return relative8(root, filePath).split(/[\\/]+/).join("/");
@@ -35443,7 +35509,7 @@ function sanitizeRuntimeService(entry) {
 }
 function readRuntimeServicesSnapshot(cwd) {
   const snapshotPath = join25(resolve19(cwd), WORKSPACE_RUNTIME_SERVICES_FILENAME);
-  if (!existsSync17(snapshotPath)) return [];
+  if (!existsSync18(snapshotPath)) return [];
   try {
     const parsed = JSON.parse(readFileSync20(snapshotPath, "utf8"));
     const rawServices = Array.isArray(parsed) ? parsed : Array.isArray(parsed?.services) ? parsed.services : [];
@@ -35547,7 +35613,7 @@ function assertRequiredTaskAttachmentMaterialized(input, materialized) {
 }
 
 // src/amaster-runtime-daemon.mjs
-var CONNECTOR_VERSION = "0.1.13-beta.2";
+var CONNECTOR_VERSION = "0.1.14";
 var CONNECTOR_CONTRACT_VERSION = "2026-06-04.v1";
 var SUPPORTED_TASK_CONTEXT_VERSIONS = Object.freeze([TASK_CONTEXT_MANIFEST_VERSION, TASK_CONTEXT_V2]);
 var daemonRequire = createRequire(import.meta.url);
@@ -35643,7 +35709,7 @@ function updateActiveRunWorkspaceManifest(commandId, manifestPath, patch = {}) {
 }
 function resultOutboxPendingCount(config) {
   const dir = resultOutboxDir(config);
-  if (!existsSync18(dir)) return 0;
+  if (!existsSync19(dir)) return 0;
   try {
     let pending = 0;
     for (const file of readdirSync14(dir).filter((name) => name.endsWith(".json"))) {
@@ -35721,7 +35787,7 @@ function piCompletionOutputType(event) {
 }
 function resultOutboxActiveRunCommands(config) {
   const dir = resultOutboxDir(config);
-  if (!existsSync18(dir)) return [];
+  if (!existsSync19(dir)) return [];
   const outboxPending = resultOutboxPendingCount(config);
   const entries = [];
   for (const file of readdirSync14(dir).filter((name) => name.endsWith(".json")).sort()) {
@@ -35756,7 +35822,7 @@ function resultOutboxActiveRunCommands(config) {
 }
 function resultOutboxFailedRunCommands(config) {
   const dir = resultOutboxInvalidDir(config);
-  if (!existsSync18(dir)) return [];
+  if (!existsSync19(dir)) return [];
   const entries = [];
   for (const file of readdirSync14(dir).filter((name) => name.endsWith(".json")).sort().slice(-100)) {
     let entry;
@@ -35874,7 +35940,7 @@ function safeSkillRootSummary(kind, source, pathValue) {
         const skillDir = join26(pathValue, name);
         try {
           if (!statSync12(skillDir).isDirectory()) continue;
-          if (!existsSync18(join26(skillDir, "SKILL.md"))) continue;
+          if (!existsSync19(join26(skillDir, "SKILL.md"))) continue;
           skillCount += 1;
           if (skillCount >= MAX_PI_CAPABILITY_SOURCE_ENTRIES) {
             truncated = true;
@@ -36105,8 +36171,7 @@ function runtimeAdvertisedCapabilities(config) {
     executors: config.executors,
     browserCredentialAuth: inspectBrowserCredentialAuthReadiness(),
     browserCredentialEnv: inspectBrowserCredentialEnvReadiness(),
-    piWebSearchReady: inspectPiWebSearchReadiness(),
-    piWebFetchReady: inspectPiWebFetchReadiness()
+    piWebSearchReady: inspectPiWebSearchReadiness()
   });
 }
 function buildRegisterPayload(config) {
@@ -36693,10 +36758,10 @@ function buildActiveRunCommandStatus(config, entry) {
   const base = {
     ...entry,
     phase: readString(entry.phase) ?? "executing",
-    managedWorkdirPresent: entry.workspacePath ? existsSync18(entry.workspacePath) : false,
+    managedWorkdirPresent: entry.workspacePath ? existsSync19(entry.workspacePath) : false,
     outboxPending: resultOutboxPendingCount(config)
   };
-  if (!entry.workspacePath || !existsSync18(entry.workspacePath)) return base;
+  if (!entry.workspacePath || !existsSync19(entry.workspacePath)) return base;
   const manifestPath = entry.manifestPath ?? workspaceManifestPath(entry.workspacePath);
   const status = readWorkspaceStatus(entry.workspacePath, { hashCache: workspaceStatusHashCache });
   const artifactCandidates = status.artifacts.slice(0, 20);
@@ -36924,7 +36989,7 @@ function ensureBrowserSessionProfile(config, session) {
   }
   chmodSync9(userDataDir, 448);
   const markerPath2 = join26(userDataDir, BROWSER_SESSION_PROFILE_OWNER_MARKER);
-  if (existsSync18(markerPath2)) {
+  if (existsSync19(markerPath2)) {
     if (lstatSync16(markerPath2).isSymbolicLink()) {
       throw new Error("browser_session_profile_identity_invalid");
     }
@@ -36959,12 +37024,12 @@ function cleanupBrowserSessionProfile(config, value) {
   if (!pathWithin3(userDataDir, profileRoot)) {
     throw new Error("browser_session_profile_cleanup_invalid");
   }
-  if (!existsSync18(userDataDir)) return { outcome: "absent", identity };
+  if (!existsSync19(userDataDir)) return { outcome: "absent", identity };
   if (lstatSync16(userDataDir).isSymbolicLink() || !lstatSync16(userDataDir).isDirectory()) {
     throw new Error("browser_session_profile_cleanup_invalid");
   }
   const markerPath2 = join26(userDataDir, BROWSER_SESSION_PROFILE_OWNER_MARKER);
-  if (!existsSync18(markerPath2) || lstatSync16(markerPath2).isSymbolicLink()) {
+  if (!existsSync19(markerPath2) || lstatSync16(markerPath2).isSymbolicLink()) {
     throw new Error("browser_session_profile_cleanup_invalid");
   }
   if (JSON.stringify(readJsonFile2(markerPath2)) !== JSON.stringify(identity)) {
@@ -37014,7 +37079,7 @@ function safeAgentInstructionMaterializationTarget(workspace, filePath) {
   const raw = readString(filePath);
   if (!raw || raw.includes("\0")) return null;
   const normalized = raw.replace(/\\/g, "/");
-  if (isAbsolute13(normalized)) return null;
+  if (isAbsolute14(normalized)) return null;
   const segments = normalized.split("/").filter(Boolean);
   if (segments.length === 0 || segments.some((segment) => segment === "." || segment === "..")) return null;
   const relativePath = segments.join("/");
@@ -37152,7 +37217,7 @@ function wikiTreePathForCommand(command, workspaceBindings) {
     }
     for (const candidate of candidates) {
       try {
-        if (existsSync18(candidate)) return candidate;
+        if (existsSync19(candidate)) return candidate;
       } catch {
       }
     }
@@ -37837,6 +37902,12 @@ function createLiveOutputLogger(config, command, executorKind, protectedValues =
   let incrementalEventCount = 0;
   let nonProgressEventCount = 0;
   let unparsedLineCount = 0;
+  const piDeltaCounts = { thinking: 0, text: 0, toolcall: 0 };
+  const piDeltaBytes = { thinking: 0, text: 0, toolcall: 0 };
+  let piAssistantMessageEndCount = 0;
+  let piObservedAssistantOutputTokens = 0;
+  let piMaxAssistantOutputTokens = 0;
+  let piLengthStopCount = 0;
   let lastPiAgentMessage = null;
   let piTerminalOutput = null;
   let executorSessionId = null;
@@ -37922,6 +37993,23 @@ function createLiveOutputLogger(config, command, executorKind, protectedValues =
     jsonlEventCount += 1;
     const eventType = countEventType(event);
     const deltaType = asRecord(asRecord(event).assistantMessageEvent).type;
+    if (executorKind === "pi") {
+      const deltaKind = typeof deltaType === "string" && deltaType.endsWith("_delta") ? deltaType.slice(0, -"_delta".length) : null;
+      if (deltaKind && Object.hasOwn(piDeltaCounts, deltaKind)) {
+        piDeltaCounts[deltaKind] += 1;
+        const delta = asRecord(asRecord(event).assistantMessageEvent).delta;
+        if (typeof delta === "string") piDeltaBytes[deltaKind] += Buffer.byteLength(delta);
+      }
+      if (eventType === "message_end" && asRecord(asRecord(event).message).role === "assistant") {
+        piAssistantMessageEndCount += 1;
+        const message = asRecord(asRecord(event).message);
+        const usage = asRecord(message.usage);
+        const outputTokens = readNumber(usage.output ?? usage.outputTokens ?? usage.output_tokens, 0);
+        piObservedAssistantOutputTokens += outputTokens;
+        piMaxAssistantOutputTokens = Math.max(piMaxAssistantOutputTokens, outputTokens);
+        if (readString(message.stopReason ?? message.stop_reason) === "length") piLengthStopCount += 1;
+      }
+    }
     if (eventType === "message_update" && ["text_delta", "thinking_delta"].includes(deltaType) && !observedTimingEvents.has(deltaType)) {
       observedTimingEvents.add(deltaType);
       timing(deltaType === "text_delta" ? "first_text_delta" : "first_thinking_delta");
@@ -38271,7 +38359,7 @@ function createLiveOutputLogger(config, command, executorKind, protectedValues =
       const rawOutputBytes = rawBytesByStream.stdout + rawBytesByStream.stderr;
       const retainedBytes = retainedBytesByStream.stdout + retainedBytesByStream.stderr;
       const retentionCompactedBytes = Math.max(0, rawOutputBytes - retainedBytes);
-      const maxStreamBytes = Math.max(rawBytesByStream.stdout, rawBytesByStream.stderr);
+      const maxStreamBytes = executorKind === "pi" ? Math.max(retainedBytesByStream.stdout, rawBytesByStream.stderr) : Math.max(rawBytesByStream.stdout, rawBytesByStream.stderr);
       const normalizedFloodLimitBytes = readNumber(floodLimitBytes, 0);
       return {
         liveLogDelivery: {
@@ -38300,14 +38388,28 @@ function createLiveOutputLogger(config, command, executorKind, protectedValues =
         unparsedLineCount,
         ...piToolArgumentTracker && piToolArgumentTracker.snapshot().mode !== "off" ? { toolArgumentAmplification: piToolArgumentTracker.snapshot() } : {},
         eventTypeCounts: Object.fromEntries([...eventTypeCounts.entries()].sort(([left], [right]) => left.localeCompare(right))),
+        ...executorKind === "pi" ? {
+          piGenerationSummary: {
+            assistantMessageEndCount: piAssistantMessageEndCount,
+            observedAssistantOutputTokens: piObservedAssistantOutputTokens,
+            maxAssistantOutputTokens: piMaxAssistantOutputTokens,
+            lengthStopCount: piLengthStopCount,
+            deltaCounts: { ...piDeltaCounts },
+            deltaBytes: { ...piDeltaBytes }
+          }
+        } : {},
         ...outputTokens > 0 ? {
           outputTokens,
           rawBytesPerOutputToken: Math.round(rawOutputBytes / outputTokens)
         } : {},
         ...normalizedFloodLimitBytes > 0 ? {
           floodLimitBytesPerStream: normalizedFloodLimitBytes,
+          floodBasis: executorKind === "pi" ? "retained_stdout_and_raw_stderr" : "raw",
           floodUtilization: Number((maxStreamBytes / normalizedFloodLimitBytes).toFixed(4)),
-          floodHeadroomBytes: Math.max(0, normalizedFloodLimitBytes - maxStreamBytes)
+          floodHeadroomBytes: Math.max(0, normalizedFloodLimitBytes - maxStreamBytes),
+          ...executorKind === "pi" ? {
+            rawStdoutSafetyLimitBytes: Math.min(512 * 1024 * 1024, normalizedFloodLimitBytes * 8)
+          } : {}
         } : {}
       };
     }
@@ -38348,7 +38450,7 @@ function realOrResolvedPath(value) {
     return resolve20(value);
   }
 }
-var LSOF_COMMAND = process.platform === "darwin" && existsSync18("/usr/sbin/lsof") ? "/usr/sbin/lsof" : "lsof";
+var LSOF_COMMAND = process.platform === "darwin" && existsSync19("/usr/sbin/lsof") ? "/usr/sbin/lsof" : "lsof";
 function processCwdForPid(pid) {
   if (process.platform === "linux") {
     try {
@@ -38460,7 +38562,7 @@ function killWorkspaceResidentProcesses(cwd, processGroupId, options = {}) {
 }
 function walkManagedWorkdirs(root) {
   const workdirs = [];
-  if (!root || !existsSync18(root)) return workdirs;
+  if (!root || !existsSync19(root)) return workdirs;
   const stack = [root];
   while (stack.length > 0) {
     const current = stack.pop();
@@ -38474,7 +38576,7 @@ function walkManagedWorkdirs(root) {
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
       const fullPath = join26(current, entry.name);
-      if (entry.name === "workdir" && existsSync18(workspaceManifestPath(fullPath))) {
+      if (entry.name === "workdir" && existsSync19(workspaceManifestPath(fullPath))) {
         workdirs.push(fullPath);
         continue;
       }
@@ -38513,7 +38615,7 @@ function manifestMatchesActiveRuntimeRef(manifest, refs, workdir = null) {
 function buildOrphanReaperSample(root, workdir, manifest, residents) {
   const relativeWorkdir = (() => {
     const value = relative9(root, workdir);
-    return value && !value.startsWith("..") && !isAbsolute13(value) ? value : basename8(workdir);
+    return value && !value.startsWith("..") && !isAbsolute14(value) ? value : basename8(workdir);
   })();
   return {
     workdir: relativeWorkdir,
@@ -38595,6 +38697,8 @@ function runExecutor(command, args, options) {
     let completionOutputType = null;
     let completionOutputHasFinalAssistantText = null;
     let outputFlood = null;
+    let piReasoningExhaustion = null;
+    let piReasoningOnlyLengthCount = 0;
     let argumentAmplification = null;
     let toolExecutionGuard = null;
     let memoryLimit = null;
@@ -38624,6 +38728,7 @@ function runExecutor(command, args, options) {
     const retainedOutputBytes = { stdout: 0, stderr: 0 };
     const piOutputRetentionCompactor = options.executorKind === "pi" ? createPiOutputRetentionCompactor() : null;
     const maxOutputBytes = parsePositiveInteger(options.maxOutputBytes, 50 * 1024 * 1024);
+    const maxRawStdoutBytes = options.executorKind === "pi" ? Math.min(512 * 1024 * 1024, maxOutputBytes * 8) : maxOutputBytes;
     const maxRssMb = parsePositiveInteger(options.maxRssMb, 0);
     const maxRssBytes = maxRssMb * 1024 * 1024;
     const browserCredentialChannel = typeof options.browserCredentialConsumer === "function" ? createBrowserCredentialChannel({
@@ -38660,14 +38765,20 @@ function runExecutor(command, args, options) {
       const retainedText = piOutputRetentionCompactor?.write(text2) ?? text2;
       retainedOutputBytes.stdout += Buffer.byteLength(retainedText);
       stdout = appendBounded(stdout, retainedText);
-      if (outputBytes.stdout > maxOutputBytes) killForOutputFlood("stdout");
+      if (piOutputRetentionCompactor && retainedOutputBytes.stdout > maxOutputBytes) {
+        killForOutputFlood("stdout", "retained", retainedOutputBytes.stdout, maxOutputBytes);
+      } else if (outputBytes.stdout > maxRawStdoutBytes) {
+        killForOutputFlood("stdout", "raw", outputBytes.stdout, maxRawStdoutBytes);
+      }
     };
     const handleStderrText = (text2, rawBytes) => {
       outputBytes.stderr += rawBytes;
       retainedOutputBytes.stderr += rawBytes;
       stderr = appendBounded(stderr, text2);
       options.onOutput?.("stderr", text2, rawBytes);
-      if (outputBytes.stderr > maxOutputBytes) killForOutputFlood("stderr");
+      if (outputBytes.stderr > maxOutputBytes) {
+        killForOutputFlood("stderr", "raw", outputBytes.stderr, maxOutputBytes);
+      }
     };
     const stdoutDecoder = createUtf8StreamDecoder(handleStdoutText);
     const stderrDecoder = createUtf8StreamDecoder(handleStderrText);
@@ -38680,6 +38791,16 @@ function runExecutor(command, args, options) {
         const retainedTail = piOutputRetentionCompactor.flush();
         retainedOutputBytes.stdout += Buffer.byteLength(retainedTail);
         stdout = appendBounded(stdout, retainedTail);
+        if (!outputFlood && retainedOutputBytes.stdout > maxOutputBytes) {
+          outputFlood = {
+            stream: "stdout",
+            basis: "retained",
+            bytes: retainedOutputBytes.stdout,
+            limitBytes: maxOutputBytes,
+            rawBytes: outputBytes.stdout,
+            retainedBytes: retainedOutputBytes.stdout
+          };
+        }
       }
       if (timer) clearTimeout(timer);
       if (rssTimer) clearInterval(rssTimer);
@@ -38697,6 +38818,7 @@ function runExecutor(command, args, options) {
         outputBytes: { ...outputBytes },
         retainedOutputBytes: { ...retainedOutputBytes },
         outputFlood,
+        piReasoningExhaustion,
         argumentAmplification,
         toolExecutionGuard,
         memoryLimit,
@@ -38827,6 +38949,17 @@ function runExecutor(command, args, options) {
         try {
           const event = JSON.parse(trimmed);
           const eventType = readString(asRecord(event).type);
+          const reasoningExhaustion = piReasoningOnlyLengthEvent(event);
+          if (reasoningExhaustion) {
+            piReasoningOnlyLengthCount += 1;
+            piReasoningExhaustion = reasoningExhaustion;
+            if (piReasoningOnlyLengthCount > 1) {
+              requestStop("pi_reasoning_output_exhausted");
+              return;
+            }
+          } else if (eventType === "message_end" && asRecord(event.message).role === "assistant") {
+            piReasoningExhaustion = null;
+          }
           if (eventType === "turn_end") {
             latestPiTurnEndHasFinalAssistantText = piTurnEndHasFinalAssistantText(event);
           }
@@ -38850,12 +38983,15 @@ function runExecutor(command, args, options) {
         }
       }
     };
-    const killForOutputFlood = (stream) => {
+    const killForOutputFlood = (stream, basis, bytes, limitBytes) => {
       if (settled || outputFlood) return;
       outputFlood = {
         stream,
-        bytes: outputBytes[stream],
-        limitBytes: maxOutputBytes
+        basis,
+        bytes,
+        limitBytes,
+        rawBytes: outputBytes[stream],
+        retainedBytes: retainedOutputBytes[stream]
       };
       requestStop("output_flood");
     };
@@ -39252,7 +39388,7 @@ function runCompletionCoordinator(config) {
       persist: (state) => persistPendingRunCompletion(configRef.current, state),
       clear: (commandId) => clearPendingRunCompletion(configRef.current, commandId),
       list: () => runCompletionStateEntries(configRef.current),
-      exists: (filePath) => existsSync18(filePath),
+      exists: (filePath) => existsSync19(filePath),
       read: (filePath) => readValidRunCompletionStateOrQuarantine(configRef.current, filePath),
       snapshot: (state) => pendingRunCompletionSnapshot(configRef.current, state)
     },
@@ -39591,7 +39727,7 @@ function quarantineResultOutboxEntry(config, fullPath, file, entry, reason, err)
 }
 async function flushResultOutbox(config) {
   const dir = resultOutboxDir(config);
-  if (!existsSync18(dir)) return { attempted: 0, completed: 0 };
+  if (!existsSync19(dir)) return { attempted: 0, completed: 0 };
   const files = readdirSync14(dir).filter((name) => name.endsWith(".json")).sort();
   let completed = 0;
   for (const file of files) {
@@ -40062,7 +40198,7 @@ function issueCheckpointDir(workspace) {
 }
 async function clearIssueCheckpoint(config, command, workspace, reason, consumedSource = null) {
   const checkpointDir = issueCheckpointDir(workspace);
-  if (!existsSync18(checkpointDir)) return false;
+  if (!existsSync19(checkpointDir)) return false;
   if (consumedSource !== null) {
     const sourceRunId = readString(consumedSource.sourceRunId);
     if (!sourceRunId) return false;
@@ -40080,7 +40216,7 @@ async function clearIssueCheckpoint(config, command, workspace, reason, consumed
 }
 function safeCheckpointRelativePath(rawPath) {
   const raw = String(rawPath ?? "").trim();
-  if (isAbsolute13(raw) || /^[A-Za-z]:[\\/]/.test(raw)) return null;
+  if (isAbsolute14(raw) || /^[A-Za-z]:[\\/]/.test(raw)) return null;
   const normalized = raw.split(/[\\/]+/).filter(Boolean).join("/");
   if (!normalized || normalized.startsWith("../") || normalized.split("/").some((segment) => segment.startsWith("."))) return null;
   if (normalized.startsWith("input-attachments/") || isRuntimeMetadataArtifactPath(normalized)) return null;
@@ -40137,7 +40273,7 @@ async function materializeIssueCheckpoint(config, command, workspace) {
     });
   }
   const unavailable2 = { files: [], taskSessionRestored: false, checkpointExpiresAt: null };
-  if (!existsSync18(manifestPath)) {
+  if (!existsSync19(manifestPath)) {
     if (expectedContinuation) throw new Error("continuation_checkpoint_unavailable: manifest_missing");
     return unavailable2;
   }
@@ -40187,7 +40323,7 @@ async function materializeIssueCheckpoint(config, command, workspace) {
       if (!pathWithin3(sourceCandidate, filesRoot) || !pathWithin3(target, workspaceRoot)) {
         throw new Error(`issue checkpoint path escapes its workspace: ${relativePath}`);
       }
-      if (!existsSync18(sourceCandidate)) throw new Error(`issue checkpoint file is missing: ${relativePath}`);
+      if (!existsSync19(sourceCandidate)) throw new Error(`issue checkpoint file is missing: ${relativePath}`);
       const source = realpathSync12(sourceCandidate);
       if (!pathWithin3(source, filesRoot) || !statSync12(source).isFile()) {
         throw new Error(`issue checkpoint source escapes its storage root: ${relativePath}`);
@@ -40305,7 +40441,7 @@ async function saveIssueCheckpoint(config, command, workspace, candidates, optio
     for (const candidate of selectedCandidates) {
       const relativePath = safeCheckpointRelativePath(candidate.rawPath);
       const source = readString(candidate.filePath);
-      if (!relativePath || !source || !existsSync18(source) || !statSync12(source).isFile()) {
+      if (!relativePath || !source || !existsSync19(source) || !statSync12(source).isFile()) {
         if (requiredPaths.length > 0 || options.taskSession) throw new Error(`continuation_checkpoint_file_unavailable: ${candidate.rawPath}`);
         continue;
       }
@@ -40358,12 +40494,12 @@ async function saveIssueCheckpoint(config, command, workspace, candidates, optio
     };
     writeFileSync15(join26(stagingDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
 `);
-    const replacingExistingCheckpoint = existsSync18(checkpointDir);
+    const replacingExistingCheckpoint = existsSync19(checkpointDir);
     if (replacingExistingCheckpoint) renameSync12(checkpointDir, backupDir);
     try {
       renameSync12(stagingDir, checkpointDir);
     } catch (err) {
-      if (replacingExistingCheckpoint && existsSync18(backupDir) && !existsSync18(checkpointDir)) {
+      if (replacingExistingCheckpoint && existsSync19(backupDir) && !existsSync19(checkpointDir)) {
         renameSync12(backupDir, checkpointDir);
       }
       throw err;
@@ -40697,6 +40833,7 @@ async function executeRunCommand(config, command) {
           nativeSession: asRecord(asRecord(executionCommand.payload).nativeSession),
           portableNativeSession: restoredCheckpoint.portableNativeSession,
           baseEnv: executorEnv,
+          ...browserSessionUserDataDir ? { browserRuntimePackageHome: BROWSER_AUTH_IMAGE_HOME } : {},
           commandEnv: piProfileCommandEnv,
           extraArgs: splitExtraArgs(process.env.AMASTER_PI_EXTRA_ARGS),
           skillProfiles: readStringArray(asRecord(command.payload).skillProfiles),
@@ -40762,7 +40899,11 @@ async function executeRunCommand(config, command) {
       if (executor.kind === "pi" && Array.isArray(managedMcpProfile.extensionArgs) && managedMcpProfile.extensionArgs.length > 0) {
         invocation.args = [...invocation.args, ...managedMcpProfile.extensionArgs];
       }
-      if (executor.kind === "pi" && browserCredentialAuthority) {
+      executorEnv = attachTrustedBrowserExecutorEnv(executorEnv, {
+        authority: browserCredentialAuthority,
+        userDataDir: browserSessionUserDataDir ?? (config.runnerKind === RUNNER_KIND_CLOUD_MANAGED ? companyBrowserProfileDir(executorEnv.PAPERCLIP_COMPANY_ID, process.env.AMASTER_COMPANY_PI_HOME_ROOT || "/data/companies") : null)
+      });
+      if (executor.kind === "pi" && browserSessionUserDataDir) {
         invocation.args = [...invocation.args, ...browserCredentialAuthExtensionArgs(browserCredentialAuthority, executorEnv)];
         executorEnv = { ...executorEnv, NODE_PATH: BROWSER_AUTH_IMAGE_NODE_PATH };
       }
@@ -40774,10 +40915,15 @@ async function executeRunCommand(config, command) {
         ...managedMcpProfile.attestation
       });
     }
-    executorEnv = attachTrustedBrowserExecutorEnv(executorEnv, {
-      authority: browserCredentialAuthority,
-      userDataDir: browserSessionUserDataDir
-    });
+    if (!managedMcpProfile) {
+      executorEnv = attachTrustedBrowserExecutorEnv(executorEnv, {
+        authority: browserCredentialAuthority,
+        userDataDir: browserSessionUserDataDir ?? (executor.kind === "pi" && config.runnerKind === RUNNER_KIND_CLOUD_MANAGED ? companyBrowserProfileDir(executorEnv.PAPERCLIP_COMPANY_ID, process.env.AMASTER_COMPANY_PI_HOME_ROOT || "/data/companies") : null)
+      });
+    }
+    invocation.args.push(...browserCredentialExtensionArgs(browserCredentialPresentationKind, executorEnv, {
+      managedBrowserSession: executor.kind === "pi" && Boolean(browserSessionUserDataDir)
+    }));
     executorEnv = withAuditCorrelationEnvironment(executorEnv, command);
     if (Object.keys(trustedPiRuntimeAssertion).length > 0) {
       throw new Error("pi_trusted_runtime_unsupported");
@@ -41392,6 +41538,8 @@ async function executeRunCommand(config, command) {
     const argumentAmplificationError = hasArgumentAmplification ? `Pi Agent tool argument stream amplification stopped before execution: ${readNumber(argumentAmplification.transportArgumentBytes, 0)} transported byte(s), ${readNumber(argumentAmplification.materializedArgumentBytes, 0)} materialized byte(s)` : null;
     const memoryLimitError = hasMemoryLimit ? `${executor.kind === "pi" ? "Pi Agent" : "Executor"} memory limit exceeded: RSS ${readNumber(memoryLimit.rssBytes, 0)} bytes exceeded ${readNumber(memoryLimit.limitBytes, config.executorMaxRssMb * 1024 * 1024)} bytes` : null;
     const piUsageDiagnostic = executor.kind === "pi" && !hasOutputFlood && !hasArgumentAmplification && piOutputUsageMetadataMissing(parsed) ? "Pi Agent exited without usage metadata" : null;
+    const piReasoningExhaustion = asRecord(execution.piReasoningExhaustion);
+    const hasPiReasoningExhaustion = piReasoningExhaustion.stopReason === "length" && !cancelled && !hasOutputFlood && !hasArgumentAmplification && !hasMemoryLimit && execution.timedOut !== true && !execution.spawnError;
     const completionOutputStopped = executor.kind === "pi" && piCompletionOutputStopped(execution);
     const cleanupDisposition = executor.kind === "pi" && !cancelled && !hasOutputFlood && !hasArgumentAmplification && !hasMemoryLimit && execution.timedOut !== true && !execution.spawnError && execution.signal === null ? classifyPiTerminalCleanupDisposition(
       { ...parsed, mcpToolResults },
@@ -41412,7 +41560,7 @@ async function executeRunCommand(config, command) {
     }
     const parsedForValidation = parsed;
     const effectiveCompletionOutputHasFinalAssistantText = terminalTextRepair?.succeeded === true ? true : execution.completionOutputHasFinalAssistantText;
-    const piTurnLimitFailure = executor.kind === "pi" && !cancelled && !hasOutputFlood && !hasArgumentAmplification && !hasMemoryLimit && execution.timedOut !== true && !execution.spawnError ? classifyPiTurnLimitResult(parsedForValidation, {
+    const piTurnLimitFailure = executor.kind === "pi" && !cancelled && !hasOutputFlood && !hasArgumentAmplification && !hasMemoryLimit && !hasPiReasoningExhaustion && execution.timedOut !== true && !execution.spawnError ? classifyPiTurnLimitResult(parsedForValidation, {
       authoritativeTerminalDisposition: Boolean(terminalRunDisposition)
     }) : null;
     const piInvalidOutputError = executor.kind === "pi" ? piOutputValidationError(parsedForValidation, {
@@ -41423,13 +41571,13 @@ async function executeRunCommand(config, command) {
       completionOutputType: execution.completionOutputType,
       completionOutputHasFinalAssistantText: effectiveCompletionOutputHasFinalAssistantText
     }) : null;
-    const piOutputFailure = executor.kind === "pi" && !cancelled && !hasOutputFlood && !hasArgumentAmplification && !hasMemoryLimit && execution.timedOut !== true && !execution.spawnError ? classifyPiOutputFailure(parsedForValidation, {
+    const piOutputFailure = executor.kind === "pi" && !cancelled && !hasOutputFlood && !hasArgumentAmplification && !hasMemoryLimit && !hasPiReasoningExhaustion && execution.timedOut !== true && !execution.spawnError ? classifyPiOutputFailure(parsedForValidation, {
       exitCode: execution.exitCode,
       stderr: execution.stderr,
       invalidOutputError: piInvalidOutputError
     }) : null;
     const piProviderFailure = piOutputFailure?.errorCode !== "pi_executor_invalid_output" ? piOutputFailure : null;
-    const parsedErrorMessage = outputFloodError ?? argumentAmplificationError ?? memoryLimitError ?? piTurnLimitFailure?.message ?? piInvalidOutputError ?? nativeSessionRolloutError ?? nativeSessionRolloutCleanupError ?? parsedForValidation.errorMessage;
+    const parsedErrorMessage = outputFloodError ?? argumentAmplificationError ?? memoryLimitError ?? (hasPiReasoningExhaustion ? "Pi model exhausted its output on reasoning without a text answer or tool call" : null) ?? piTurnLimitFailure?.message ?? piInvalidOutputError ?? nativeSessionRolloutError ?? nativeSessionRolloutCleanupError ?? parsedForValidation.errorMessage;
     const codexTransientFailure = executor.kind === "codex" && (execution.exitCode ?? 0) !== 0 ? classifyCodexTransientUpstreamError({
       stdout: execution.stdout,
       stderr: execution.stderr,
@@ -41509,8 +41657,11 @@ async function executeRunCommand(config, command) {
         errorFamily: "validation",
         outputFlood: {
           stream: readString(outputFlood.stream),
+          basis: readString(outputFlood.basis),
           bytes: readNumber(outputFlood.bytes, 0),
-          limitBytes: readNumber(outputFlood.limitBytes, config.executorMaxOutputBytes)
+          limitBytes: readNumber(outputFlood.limitBytes, config.executorMaxOutputBytes),
+          rawBytes: readNumber(outputFlood.rawBytes, 0),
+          retainedBytes: readNumber(outputFlood.retainedBytes, 0)
         }
       } : {},
       ...hasArgumentAmplification ? {
@@ -41528,6 +41679,11 @@ async function executeRunCommand(config, command) {
           limitBytes: readNumber(memoryLimit.limitBytes, config.executorMaxRssMb * 1024 * 1024)
         }
       } : {},
+      ...hasPiReasoningExhaustion ? {
+        errorCode: "pi_reasoning_output_exhausted",
+        errorFamily: "execution_limit",
+        reasoningExhaustion: piReasoningExhaustion
+      } : {},
       ...Array.isArray(execution.killedWorkspaceResidents) && execution.killedWorkspaceResidents.length > 0 ? {
         killedWorkspaceResidents: execution.killedWorkspaceResidents
       } : {},