@amaster.ai/employee-runtime-connector 0.1.14 → 0.1.16

package/dist/amaster-runtime-daemon.mjs

@@ -83,7 +83,7 @@ function withAuditCorrelationEnvironment(environment, command) {
 }
 
 // src/amaster-runtime-daemon.mjs
-import { createHash as createHash20, randomUUID as randomUUID3 } from "node:crypto";
+import { createHash as createHash21, randomUUID as randomUUID3 } from "node:crypto";
 import { createRequire } from "node:module";
 
 // ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js
@@ -5069,7 +5069,8 @@ var AMASTER_RUNTIME_CONNECTOR_COMMAND_TYPES = [
   "wakeup",
   "model_call",
   "cancel",
-  "terminate"
+  "terminate",
+  "browser_session_revoke"
 ];
 var AMASTER_RUNTIME_CONNECTOR_COMMAND_STATUSES = [
   "queued",
@@ -9627,7 +9628,7 @@ var taskResourceInputSchema = external_exports.discriminatedUnion("kind", [
     });
   }
 });
-var browserCredentialRefAuthoritySchema = external_exports.object({
+var browserCredentialRefV1Schema = external_exports.object({
   version: external_exports.literal(1),
   companyId: external_exports.string().uuid(),
   issueId: external_exports.string().uuid(),
@@ -9642,9 +9643,39 @@ var browserCredentialRefAuthoritySchema = external_exports.object({
   bindingId: external_exports.string().uuid(),
   browserLeaseId: external_exports.string().regex(/^browser-credential-(?:auth-write|agent-read)-[0-9a-f-]{36}$/iu)
 }).strict();
-var browserCredentialRefConsumeSchema = browserCredentialRefAuthoritySchema.extend({
-  controlSemantic: external_exports.enum(["username", "email", "password"])
+var browserCredentialRefV2BaseSchema = external_exports.object({
+  version: external_exports.literal(2),
+  companyId: external_exports.string().uuid(),
+  issueId: external_exports.string().uuid(),
+  runId: external_exports.string().uuid(),
+  commandId: external_exports.string().uuid(),
+  grantId: external_exports.string().uuid(),
+  grantRevision: external_exports.number().int().positive(),
+  commandAuthId: external_exports.string().uuid(),
+  credentialKey: external_exports.string().trim().min(1).max(255),
+  credentialVersion: external_exports.number().int().positive(),
+  credentialRole: external_exports.enum(BROWSER_CREDENTIAL_ROLES),
+  targetOrigin: exactOriginSchema,
+  authenticationOrigin: exactOriginSchema
+});
+var browserCredentialRefV2InteractionSchema = browserCredentialRefV2BaseSchema.extend({
+  grantKind: external_exports.literal("interaction"),
+  interactionId: external_exports.string().uuid()
 }).strict();
+var browserCredentialRefV2StoredSchema = browserCredentialRefV2BaseSchema.extend({
+  grantKind: external_exports.literal("stored_grant")
+}).strict();
+var browserCredentialRefAuthoritySchema = external_exports.union([
+  browserCredentialRefV1Schema,
+  browserCredentialRefV2InteractionSchema,
+  browserCredentialRefV2StoredSchema
+]);
+var controlSemanticSchema = external_exports.enum(["username", "email", "password"]);
+var browserCredentialRefConsumeSchema = external_exports.union([
+  browserCredentialRefV1Schema.extend({ controlSemantic: controlSemanticSchema }),
+  browserCredentialRefV2InteractionSchema.extend({ controlSemantic: controlSemanticSchema }),
+  browserCredentialRefV2StoredSchema.extend({ controlSemantic: controlSemanticSchema })
+]);
 var runtimeWebEvidenceReceiptSchema = external_exports.object({
   issueId: external_exports.string().uuid(),
   runId: external_exports.string().uuid(),
@@ -13746,7 +13777,7 @@ var ceoExecutionAffordanceSchema = external_exports.object({
   status: external_exports.enum(["available", "confirmation_required", "unavailable"]),
   effectKinds: external_exports.array(external_exports.enum(["read", "download", "upload", "external_write", "readback"])).min(1).max(5),
   source: external_exports.object({
-    kind: external_exports.enum(["pi_runtime", "browser_session", "helige", "governed_mcp"]),
+    kind: external_exports.enum(["pi_runtime", "browser_session", "browser_grant", "helige", "governed_mcp"]),
     ref: external_exports.string().trim().min(1).max(240),
     revision: external_exports.string().trim().min(1).max(240)
   }).strict(),
@@ -19173,6 +19204,10 @@ var wikiMentionPageSchema = external_exports.object({
   contentHash: external_exports.string().regex(/^[a-f0-9]{64}$/),
   byteSize: external_exports.number().int().nonnegative()
 });
+var wikiTrashPageSchema = wikiMentionPageSchema.extend({
+  archivedAt: external_exports.string(),
+  archiveReason: external_exports.string().nullable()
+});
 var wikiMentionListSchema = external_exports.object({
   pages: external_exports.array(wikiMentionPageSchema),
   nextCursor: external_exports.string().nullable()
@@ -20129,7 +20164,7 @@ function preparePiExecutorAccess(input) {
 }
 
 // src/amaster-runtime-daemon/browser-session-profile.mjs
-import { randomUUID as randomUUID2 } from "node:crypto";
+import { createHash as createHash5, randomUUID as randomUUID2 } from "node:crypto";
 import {
   chmodSync as chmodSync2,
   chownSync as chownSync2,
@@ -20145,6 +20180,22 @@ import {
 import { parse, resolve as resolve4, join as join5, dirname as dirname2 } from "node:path";
 import { spawnSync } from "node:child_process";
 var MARKERS = ".owners";
+function browserGrantProfileIdentity(companyId, origin) {
+  let parsedOrigin;
+  try {
+    parsedOrigin = new URL(origin);
+  } catch {
+  }
+  if (typeof companyId !== "string" || !/^[0-9a-f-]{36}$/iu.test(companyId) || !parsedOrigin || parsedOrigin.protocol !== "https:" || parsedOrigin.origin !== origin || parsedOrigin.username || parsedOrigin.password) {
+    throw new Error("browser_session_profile_identity_invalid");
+  }
+  return {
+    version: 2,
+    companyId,
+    origin,
+    localOpaqueRef: `profile_${createHash5("sha256").update(`mirrorx-company-origin-browser\0${companyId}\0${origin}`).digest("hex").slice(0, 32)}`
+  };
+}
 function statOrNull(path) {
   try {
     return lstatSync4(path);
@@ -20284,7 +20335,7 @@ function cleanupUnprivilegedBrowserSessionProfile(input) {
 }
 
 // src/amaster-runtime-daemon/codex-managed-mcp-profile.mjs
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash6 } from "node:crypto";
 import { chmodSync as chmodSync3, existsSync as existsSync3, lstatSync as lstatSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync2, realpathSync as realpathSync4, readdirSync as readdirSync3, rmSync as rmSync3, statSync as statSync2, writeFileSync as writeFileSync4 } from "node:fs";
 import { arch, platform } from "node:os";
 import { basename, dirname as dirname3, isAbsolute as isAbsolute2, join as join7, relative, resolve as resolve5 } from "node:path";
@@ -21518,7 +21569,7 @@ function restoreManagedCodexSessionRollout(input, codexHome, runDir, executorHom
   }
   const sourceWorkspacePath = nonEmpty(session.cwd, "nativeSession.cwd");
   const issueRoot = dirname3(runDir);
-  const managedSourceRunDirName = `${sourceRunId}-${createHash5("sha256").update(sourceRunId).digest("hex").slice(0, 8)}`;
+  const managedSourceRunDirName = `${sourceRunId}-${createHash6("sha256").update(sourceRunId).digest("hex").slice(0, 8)}`;
   const sourceRunDirs = readdirSync3(issueRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.isSymbolicLink() && (entry.name === sourceRunId || entry.name === managedSourceRunDirName)).map((entry) => join7(issueRoot, entry.name));
   if (sourceRunDirs.length !== 1) {
     throw new Error(`codex_managed_mcp_session_rollout_missing: expected one source run directory for ${sourceRunId}, received ${sourceRunDirs.length}`);
@@ -21947,7 +21998,7 @@ function prepareManagedCodexMcpProfile(input) {
       protectedValues: [.../* @__PURE__ */ new Set([sessionToken, ...auth.protectedValues])],
       attestation: {
         ...attestationFacts,
-        attestationId: createHash5("sha256").update(JSON.stringify(attestationFacts)).digest("hex"),
+        attestationId: createHash6("sha256").update(JSON.stringify(attestationFacts)).digest("hex"),
         attestedAt: (/* @__PURE__ */ new Date()).toISOString(),
         authMode: auth.authMode
       }
@@ -22109,7 +22160,7 @@ function reconcileManagedCodexMcpProfiles(rootPath, options = {}) {
 }
 
 // src/amaster-runtime-daemon/codebuddy-managed-mcp-profile.mjs
-import { createHash as createHash8 } from "node:crypto";
+import { createHash as createHash9 } from "node:crypto";
 import {
   chmodSync as chmodSync4,
   closeSync as closeSync3,
@@ -22130,11 +22181,11 @@ import { arch as arch2, homedir as homedir2, platform as platform2 } from "node:
 import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute3, join as join8, parse as parse3, relative as relative2, resolve as resolve6, sep as sep2 } from "node:path";
 
 // src/amaster-runtime-daemon/codebuddy-profile-policy.mjs
-import { createHash as createHash7 } from "node:crypto";
+import { createHash as createHash8 } from "node:crypto";
 import { platform as hostPlatform } from "node:os";
 
 // src/amaster-runtime-daemon/pi-governed-tool-contract.mjs
-import { createHash as createHash6 } from "node:crypto";
+import { createHash as createHash7 } from "node:crypto";
 var MANAGED_PI_TOOL_INPUT_GUARD_FILENAME = "amaster-governed-tool-input-guard.js";
 function stablePiJson(value) {
   if (value === null || value === void 0 || typeof value !== "object") {
@@ -22146,7 +22197,7 @@ function stablePiJson(value) {
   return `{${keys.map((key) => `${JSON.stringify(key)}:${stablePiJson(value[key])}`).join(",")}}`;
 }
 function stablePiSha256(value) {
-  return createHash6("sha256").update(value).digest("hex");
+  return createHash7("sha256").update(value).digest("hex");
 }
 function stablePiToolSchemaHash(schema, options = {}) {
   const value = schema && typeof schema === "object" && !Array.isArray(schema) ? schema : {};
@@ -22485,7 +22536,7 @@ function fail2(detail) {
   throw new Error(`codebuddy_managed_mcp_invalid: ${detail}`);
 }
 function sha256(value) {
-  return createHash7("sha256").update(value).digest("hex");
+  return createHash8("sha256").update(value).digest("hex");
 }
 function codebuddyMcpName(exposedName) {
   return `mcp__${CODEBUDDY_MCP_NAMESPACE}__${exposedName.replaceAll(".", "_")}`;
@@ -23066,7 +23117,7 @@ function restoreManagedCodebuddySessionRollout(input, configDir, runDir, executo
   }
   const sourceWorkspacePath = nonEmpty2(session.cwd, "nativeSession.cwd");
   const issueRoot = dirname4(runDir);
-  const managedSourceRunName = `${sourceRunId}-${createHash8("sha256").update(sourceRunId).digest("hex").slice(0, 8)}`;
+  const managedSourceRunName = `${sourceRunId}-${createHash9("sha256").update(sourceRunId).digest("hex").slice(0, 8)}`;
   const sourceRuns = readdirSync4(issueRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.isSymbolicLink() && [sourceRunId, managedSourceRunName].includes(entry.name)).map((entry) => join8(issueRoot, entry.name));
   if (sourceRuns.length !== 1) {
     throw new Error(`codebuddy_managed_mcp_session_rollout_missing: expected one source run directory for ${sourceRunId}, received ${sourceRuns.length}`);
@@ -23379,7 +23430,7 @@ function prepareManagedCodebuddyMcpProfile(input, options = {}) {
       protectedValues: [authority.sessionToken, ...provider.protectedValues],
       attestation: {
         ...attestationFacts,
-        attestationId: createHash8("sha256").update(JSON.stringify(attestationFacts)).digest("hex"),
+        attestationId: createHash9("sha256").update(JSON.stringify(attestationFacts)).digest("hex"),
         attestedAt: (/* @__PURE__ */ new Date()).toISOString(),
         authMode: provider.authMode ?? desktopAuthSnapshot.authMode,
         authScope: provider.authScope ?? "desktop_os_user",
@@ -23609,8 +23660,8 @@ async function runInitializationCompletion({ plan, authority, call, sleep, now,
       fail4("initialization_completion_invalid_plan");
     }
     const prefix = "initialization-complete:" + plan.planId;
-    const { createHash: createHash21 } = await import("node:crypto");
-    const uploadKey = prefix + ":upload:" + createHash21("sha256").update(materialized.path).digest("hex");
+    const { createHash: createHash22 } = await import("node:crypto");
+    const uploadKey = prefix + ":upload:" + createHash22("sha256").update(materialized.path).digest("hex");
     const upload = await settleCall(await invoke("runtime_action_submit", {
       idempotencyKey: uploadKey,
       action: {
@@ -23898,7 +23949,7 @@ export default function(pi) {
 }
 
 // src/amaster-runtime-daemon/pi-managed-mcp-profile.mjs
-import { createHash as createHash9 } from "node:crypto";
+import { createHash as createHash10 } from "node:crypto";
 import {
   chmodSync as chmodSync5,
   chownSync as chownSync3,
@@ -24761,7 +24812,7 @@ function createManagedPiMcpProfileApi(options = {}) {
       return { ...installed, sourceRunId, sourceCommandId, cacheRoot: null };
     }
     const issueRoot = dirname6(runDir);
-    const managedSourceRunDirName = `${sourceRunId}-${createHash9("sha256").update(sourceRunId).digest("hex").slice(0, 8)}`;
+    const managedSourceRunDirName = `${sourceRunId}-${createHash10("sha256").update(sourceRunId).digest("hex").slice(0, 8)}`;
     const sourceRunDirs = readdirSync5(issueRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.isSymbolicLink() && (entry.name === sourceRunId || entry.name === managedSourceRunDirName)).map((entry) => join11(issueRoot, entry.name));
     if (sourceRunDirs.length !== 1) {
       throw new Error(`pi_managed_mcp_session_rollout_missing: expected one source run directory for ${sourceRunId}, received ${sourceRunDirs.length}`);
@@ -24829,12 +24880,12 @@ function createManagedPiMcpProfileApi(options = {}) {
     return value;
   }
   function sha2563(value) {
-    return createHash9("sha256").update(value).digest("hex");
+    return createHash10("sha256").update(value).digest("hex");
   }
   function trustedTreeDigest(rootPath, options2 = {}) {
     const root = resolve8(rootPath);
     const ignoredRootEntries = new Set(Array.isArray(options2.ignoredRootEntries) ? options2.ignoredRootEntries : []);
-    const hash3 = createHash9("sha256");
+    const hash3 = createHash10("sha256");
     hash3.update(`ignored-root:${[...ignoredRootEntries].sort().join(",")}
 `);
     const pending = [root];
@@ -24979,7 +25030,7 @@ function createManagedPiMcpProfileApi(options = {}) {
       if (!executableStat.isFile() || executableStat.isSymbolicLink()) {
         throw Object.assign(new Error("Pi executable is not a regular file"), { code: "EUNSAFE" });
       }
-      const contentSha256 = createHash9("sha256").update(readFileSync7(realPath)).digest("hex");
+      const contentSha256 = createHash10("sha256").update(readFileSync7(realPath)).digest("hex");
       let packageManifestSha256 = null;
       for (let directory = dirname6(realPath); dirname6(directory) !== directory; directory = dirname6(directory)) {
         const packagePath = join11(directory, "package.json");
@@ -24987,7 +25038,7 @@ function createManagedPiMcpProfileApi(options = {}) {
         packageManifestSha256 = sha2563(readFileSync7(packagePath));
         break;
       }
-      return `sha256:${createHash9("sha256").update(JSON.stringify({ realPath, contentSha256, packageManifestSha256 })).digest("hex")}`;
+      return `sha256:${createHash10("sha256").update(JSON.stringify({ realPath, contentSha256, packageManifestSha256 })).digest("hex")}`;
     } catch (error) {
       const errorCode = typeof error?.code === "string" ? error.code : "UNKNOWN";
       throw new Error(`pi_managed_mcp_attestation_failed: --version error=${errorCode}`);
@@ -25776,7 +25827,7 @@ ${result2.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         ])],
         attestation: {
           ...attestationFacts,
-          attestationId: createHash9("sha256").update(JSON.stringify(attestationFacts)).digest("hex"),
+          attestationId: createHash10("sha256").update(JSON.stringify(attestationFacts)).digest("hex"),
           attestedAt: (/* @__PURE__ */ new Date()).toISOString()
         }
       };
@@ -26052,7 +26103,7 @@ ${result2.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         protectedValues: [.../* @__PURE__ */ new Set([sessionToken, ...seededRuntime.protectedValues])],
         attestation: {
           ...attestationFacts,
-          attestationId: createHash9("sha256").update(JSON.stringify(attestationFacts)).digest("hex"),
+          attestationId: createHash10("sha256").update(JSON.stringify(attestationFacts)).digest("hex"),
           attestedAt: (/* @__PURE__ */ new Date()).toISOString()
         }
       };
@@ -26291,7 +26342,7 @@ function selectExecutor(config, command) {
 }
 
 // src/amaster-runtime-daemon/web-evidence.mjs
-import { createHash as createHash10 } from "node:crypto";
+import { createHash as createHash11 } from "node:crypto";
 var SENSITIVE_QUERY_KEY_FRAGMENTS = [
   "apikey",
   "accesskey",
@@ -26346,7 +26397,7 @@ function sanitizeRuntimeWebEvidence(input) {
     mediaType: typeof input.mediaType === "string" && input.mediaType.trim() ? input.mediaType.trim() : "text/plain",
     normalizedText,
     truncated: input.truncated === true || cleanedText.length > 2e5,
-    contentSha256: createHash10("sha256").update(bytes).digest("hex"),
+    contentSha256: createHash11("sha256").update(bytes).digest("hex"),
     observedChars: normalizedText.length,
     observedBytes: bytes.byteLength
   };
@@ -26375,7 +26426,7 @@ function runtimeExactTaskResourceBinding(payload) {
   } catch {
     return null;
   }
-  if (createHash10("sha256").update(locator).digest("hex") !== binding.locatorFingerprint) return null;
+  if (createHash11("sha256").update(locator).digest("hex") !== binding.locatorFingerprint) return null;
   return {
     locator,
     locatorFingerprint: binding.locatorFingerprint
@@ -30240,11 +30291,11 @@ function selectRuntimeCommandsWithinLaneLimits(input) {
 }
 
 // src/amaster-runtime-daemon/prompt-compiler.mjs
-import { createHash as createHash12 } from "node:crypto";
+import { createHash as createHash13 } from "node:crypto";
 import { isAbsolute as isAbsolute5 } from "node:path";
 
 // src/amaster-runtime-daemon/current-run-contract.mjs
-import { createHash as createHash11 } from "node:crypto";
+import { createHash as createHash12 } from "node:crypto";
 var CONTRACT_VERSION = "mirrorx.current-run-contract.v1";
 var REQUIRED_ACTIONS = [
   "mirrorx.read_issue_delivery",
@@ -30276,7 +30327,7 @@ function canonicalJson(value) {
 }
 function semanticHash(contract) {
   const { contractHash: _contractHash, compiledAt: _compiledAt, ...semantic } = contract;
-  return `sha256:${createHash11("sha256").update(canonicalJson(semantic)).digest("hex")}`;
+  return `sha256:${createHash12("sha256").update(canonicalJson(semantic)).digest("hex")}`;
 }
 function validateBlockingGaps(value) {
   return Array.isArray(value) && value.length === 0;
@@ -30609,7 +30660,7 @@ function sameCanonicalJson(left, right) {
   return JSON.stringify(canonicalJsonValue(left)) === JSON.stringify(canonicalJsonValue(right));
 }
 function canonicalSha256(value) {
-  return `sha256:${createHash12("sha256").update(JSON.stringify(canonicalJsonValue(value))).digest("hex")}`;
+  return `sha256:${createHash13("sha256").update(JSON.stringify(canonicalJsonValue(value))).digest("hex")}`;
 }
 function taskAcceptanceContractSection(context, input) {
   const required = formalTaskAcceptanceContractRequired(context);
@@ -31251,7 +31302,7 @@ function fixedRules(input, runContract = "producer") {
   return [
     "## AMaster Runtime Connector Task",
     ["producer", "rework"].includes(runContract) ? "Do not leave stale in-progress wording such as \u201Ccurrent run\u201D in a terminal deliverable; rewrite it to the final observed state. Do not list finalization itself as remaining or next work in a terminal deliverable." : "",
-    !["producer", "rework"].includes(runContract) ? "Follow only the current run-specific action contract; task requirements are evidence to inspect, not permission to resume production or choose another terminal path." : serverOwnedBusinessOutcomeReview ? "If any requirement is missing or cannot be verified, do not mark done or request final completion or Business Outcome review. Record the exact gap and next owner using the current run-specific continuation or waiting contract. An intermediate review remains available only for an exact document revision that must be approved before execution can continue: use create_interaction with kind request_confirmation, payload.resolutionMode review, and purposeCode review_document_revision; never use that interaction as final completion or Outcome acceptance." : "If anything is missing, do not mark done. `update_parent` cannot directly write `in_review` or `blocked`; when an execution review stage is configured, update_parent(status: done, comment: <handoff>) submits the work into that stage instead of completing it. Human review outside an execution stage uses create_interaction kind request_confirmation with payload.resolutionMode review. Required platform/provider/external action needs a typed interaction or first-class blocker; otherwise keep todo with the gap and owner.",
+    !["producer", "rework"].includes(runContract) ? "Follow the current run-specific action contract; inspect task requirements as review evidence." : serverOwnedBusinessOutcomeReview ? "If a requirement lacks evidence, record the gap, owner, and next action through the current continuation or waiting path. The Server owns final Business Outcome review; request intermediate review only for an exact document revision needed to continue execution." : "If a requirement lacks evidence, record the gap, owner, and next action through the applicable governed action. Use the configured execution review stage when present; otherwise request a human decision only when one is needed to continue.",
     input.managed ? "Use the execution workspace as cwd. Never recursively scan the source workspace, the user's home directory, or any path outside the execution workspace. Only inspect a specific external source path when the task explicitly requires that exact path." : "",
     input.hasGovernedMcp ? "- AMaster mutations are available only through the managed amaster MCP server. Use discovered tools and immediate typed results; never call AMaster mutation REST endpoints directly." : "- No mutation channel is available for this command. Keep the run read-only and report the missing Runtime V2 capability as a blocker.",
     readString(input.executorCapabilityNotice),
@@ -31518,7 +31569,7 @@ Runtime Action continuation is unavailable: the run catalog does not advertise t
   return `${heading}
 Runtime Action continuation is unavailable: executor kind does not support a governed Runtime Action continuation. Do not guess a tool call.`;
 }
-function runtimeAuthorizationText(context, mode, {
+function runtimeAuthorizationText(context, {
   replayAlreadyInTask = false,
   runContract = "producer",
   pendingExecutionStages = [],
@@ -31548,10 +31599,10 @@ function runtimeAuthorizationText(context, mode, {
   const delegatedAggregationEvidence = asRecord(context.paperclipDelegatedAggregationEvidence);
   const delegatedDelivery = readString(delegatedAggregationEvidence.schemaVersion) === "delegated-aggregation-evidence-v1" && readString(delegatedAggregationEvidence.finalAggregationIssueId) && readString(delegatedAggregationEvidence.manifestId) && readString(delegatedAggregationEvidence.packageReviewInteractionId);
   const manifestRefreshOnly = legacyManifestRefreshOnly(context);
-  const firstDocumentCheckpoint = completionDeliverable === "document_or_artifact" && !delegatedDelivery ? manifestRefreshOnly ? "The current deliverable content already exists and this run is limited to refreshing stale immutable Manifest refs. Do not create or revise a document unless a fresh Delivery readiness read proves a content or acceptance gap beyond stale refs." : mode === "cold" ? continueTaskEnabled ? "Before the first external browse, search, or research action, call upsert_document with a stable key. Create a checkpoint skeleton containing the acceptance criteria, a source table, and known unknowns; update the same document with each piece of verified evidence instead of waiting until broad research is complete." : "Before the first external browse, search, or research action, call upsert_document with a stable key. Create a checkpoint skeleton containing the acceptance criteria, a source table, and known unknowns; update the same document with each piece of verified evidence instead of waiting until broad research is complete. Immediately after upsert_document, call update_parent with status: in_progress and a concrete next action; complete both control-plane writes before the first external browse, search, or research action." : continueTaskEnabled ? "Before the first external browse, search, or research action, read the existing stable-key document. Preserve all still-valid verified rows, source URLs, conclusions, and known unknowns; do not replace a populated document with a blank skeleton or less-informative fallback. Only when the document does not exist may you create a checkpoint skeleton. Update the same document with each piece of verified evidence." : "Before the first external browse, search, or research action, read the existing stable-key document. Preserve all still-valid verified rows, source URLs, conclusions, and known unknowns; do not replace a populated document with a blank skeleton or less-informative fallback. Only when the document does not exist may you create a checkpoint skeleton. Then call update_parent with status: in_progress and a concrete next action before the first external browse, search, or research action. Update the same document with each piece of verified evidence." : "";
+  const documentProgress = completionDeliverable === "document_or_artifact" && !delegatedDelivery ? manifestRefreshOnly ? "The current deliverable content already exists and this run is limited to refreshing stale immutable Manifest refs. Do not create or revise a document unless a fresh Delivery readiness read proves a content or acceptance gap beyond stale refs." : "Research and inspect evidence as needed. Persist useful findings to a stable-key Issue document before ending or yielding this run; on continuation, preserve existing verified content and add to it rather than replacing it with a blank draft." : "";
   const completionContract = !suppressOrdinaryCompletionContract && completionRole && completionDeliverable ? [
-    workDisposition.mode === "required" ? "Before the first business mutation, ensure the current required work disposition is recorded. Read-only governed checks may precede it. If no current valid receipt exists, call runtime_action_describe for record_work_disposition and persist exactly one truthful disposition before upsert_document, update_parent, add_comment, create_interaction, publish_delivery_manifest, or any other business mutation. Before ending this run, persist durable progress through Runtime Actions; browser and tool history alone are not durable progress." : "Before ending this run, persist durable progress through Runtime Actions and record one explicit task disposition. Browser and tool history alone are not durable progress.",
-    firstDocumentCheckpoint,
+    workDisposition.mode === "required" ? "A required work disposition must be recorded before business mutations. Read-only checks and research may proceed. Before ending this run, persist durable progress; browser and tool history alone are not durable progress." : "Before ending this run, persist durable progress through Runtime Actions and record one explicit task disposition. Browser and tool history alone are not durable progress.",
+    documentProgress,
     continueTaskEnabled ? "Treat one Run as one bounded, durable checkpoint. Once that checkpoint is persisted and another independent research, build, or revision phase remains, call continue_task immediately with a concrete nextAction and stable idempotencyKey instead of keeping the current Run open, then end the run. If the nextAction depends on files created in this run, include their exact workspace-relative POSIX paths in checkpointPaths; only those files are integrity-checked and carried into the successor workspace. A run-local file omitted from checkpointPaths is not durable continuation state. Do not split an unfinished atomic mutation or claim progress that is not durable. For a future time recheck use schedule_monitor; for an external person or system action use upsert_external_wait. These are mutually exclusive final live paths. Do not call update_parent with status: in_progress." : "If work remains in an ordinary productive run, call update_parent with status: in_progress and a concrete next action so bounded continuation recovery can preserve a live path. Status: todo does not queue a normal continuation from an ordinary productive run. Only a server-issued successful-run handoff recovery may use status: todo, and only according to its exact Recovery Instruction. Otherwise use a supported terminal or waiting disposition."
   ].filter(Boolean).join(" ") : "";
   const businessOutcomeOwnershipContract = businessOutcome.mode === "required" ? runContract === "rework" ? "Business Outcome acceptance remains Server-owned. The producer may use status done only as the configured changes-requested resubmission described in Producer Execution Handoff; it is not acceptance or a terminal completion claim." : evidenceAutoAcceptance ? [
@@ -31625,30 +31676,11 @@ function runtimeDecompositionRequirementText(context) {
   }
   return [
     "This issue has a server-enforced typed decomposition requirement.",
-    "Create the complete real direct child graph before doing any substantial source work.",
-    "Before browsing, searching, commenting, or doing any source work, call runtime_action_describe for record_work_disposition with dispositionKind create_children and for every child action type you need.",
-    "Persist one immutable runtime_action_plan whose first action is record_work_disposition kind create_children and whose remaining actions are exactly the complete child graph referenced by that disposition. Do not append update_parent, add_comment, upsert_document, or any other action after the child graph.",
-    "For each record_work_disposition structure child, copy scopeSummary exactly into the bound create_child_issue description. The Server compares those normalized strings and rejects a missing or different description with work_disposition_child_scope_mismatch; delegation.objective does not satisfy that binding. Also copy ownerAgentId exactly into the bound create_child_issue assigneeAgentId; mentioning an owner in delegation prose or title does not assign the child, and a missing or different explicit assignee is rejected with work_disposition_child_owner_binding_mismatch.",
-    "Execute that exact plan with runtime_action_commit.",
-    "Once runtime_action_commit succeeds, the committed required child graph is this parent run's durable delegated live disposition.",
-    "After runtime_action_commit succeeds, yield and end the parent run immediately. Do not browse, search, research, or execute any delegated child acceptance scope, and do not poll child runs. Child assignment runs are the sole execution path for delegated child scope.",
-    "Each executable child must have an owner, dependencies where needed, and acceptance criteria. Do not create probe or test children.",
-    "Preserve every parent safety and approval boundary in each child title, description, and acceptance criteria. If the parent prohibits registration, payment, booking, or external contact without later explicit authorization, create preparation or approval only children and do not assign the prohibited action.",
+    "Inspect the task and source evidence needed to scope real child outcomes. Before business mutations, create the complete required child graph with owners, dependencies, acceptance criteria, and inherited safety and approval boundaries. Use the action descriptions for exact plan bindings and submission. Once committed, the child graph is this parent's durable delegation; end the parent run and let assigned children execute their scopes.",
     `Requirement source: ${sourceType}:${sourceId}@${sourceRevision}`
   ].join("\n");
 }
-function deliveryReadCallText(input) {
-  const args = { issueId: input.issueId };
-  const directToolName = managedDirectToolName(input, "mirrorx.read_issue_delivery");
-  if (directToolName) {
-    return `call \`${directToolName}\` with these exact object arguments: ${JSON.stringify(args)}`;
-  }
-  if (input.managedMcpToolMode === "direct_typed") {
-    return "the Delivery readiness read is unavailable because mirrorx_read_issue_delivery is absent from the attested direct tool catalog; do not guess a tool name";
-  }
-  return `call mirrorx.read_issue_delivery with these exact arguments: ${JSON.stringify(args)}`;
-}
-function runtimeDeliveryReadinessText(context, input) {
+function runtimeDeliveryReadinessText(context) {
   const readiness = asRecord(context.paperclipDeliveryReadiness);
   if (readString(readiness.mode) !== "required") return "";
   const currentManifest = asRecord(readiness.currentManifest);
@@ -31696,12 +31728,10 @@ function runtimeDeliveryReadinessText(context, input) {
     "The Server computed this authoritative Delivery snapshot immediately before dispatching the current run.",
     `Expected requirement revision: ${requirementRevision ?? "missing"}`,
     `Expected current Manifest revision: ${currentRevision === null ? "null" : currentRevision}`,
-    `Immediately before publish_delivery_manifest, ${deliveryReadCallText(input)}. Copy expectedRequirementRevision from result.content.readiness.requirementRevision and expectedRevision from result.content.readiness.currentManifest.revision (or null when currentManifest is null); never copy them from an interaction, comment, continuation summary, or prior failed action.`,
-    "If a publication conflicts, or any action changes the Task, a document, or the Manifest, read Delivery readiness again before retrying. Preserve the conflict and current values; do not guess CAS inputs.",
+    "Use the current Delivery readiness when preparing a Manifest; the publication action describes how to refresh its exact revision fields.",
     ...manifestRefreshOnly ? [
       "This is a manifest-refresh-only continuation: the requirement and coverage are current, while immutable deliverable refs are stale.",
-      "Do not call upsert_document or upsert_document_revision merely to refresh the Manifest. Use mirrorx_read_issue to map each stale documentId to its key, then mirrorx_read_issue_document to obtain the exact latest immutable revision and publish one new ready Manifest against the fresh Delivery readiness CAS values.",
-      "Do not create an interaction asking the Board to refresh the Manifest. The executor owns Manifest publication; the Board independently reviews only after a ready Manifest and clean Outcome exist."
+      "Refresh the stale immutable deliverable references from current governed reads; the executor owns Manifest publication."
     ] : [],
     "```json",
     jsonText(snapshot),
@@ -31758,7 +31788,7 @@ function producerExecutionHandoffSection(input, runContract, stages) {
   const content = [
     `Remaining configured execution stages: ${JSON.stringify(stages)}`,
     "You are the producer. Finish and self-check the deliverable requirements; independent reviewer approval is a subsequent Server-owned stage, not missing producer work. Do not fabricate that approval or wait for it inside this run.",
-    runContract === "rework" ? "This task was returned for changes. Address the review findings and publish current governed delivery evidence. Resubmit through runtime_action_describe and runtime_action_submit for update_parent with status done and a non-empty handoff comment. This re-enters the configured stage; it does not declare Business Outcome acceptance. Do not use executionDecision as the producer or wait for the first-delivery automatic handoff." : "Ensure the exact governed Delivery Manifest is ready when required (for delegated delivery, preserve the final-child Manifest and package review; do not publish a duplicate root package), record the final production evidence with update_parent status in_progress, and end the run successfully. The runtime_action_in_progress_server_owned receipt is the expected handoff receipt, not permission to retry with done.",
+    runContract === "rework" ? "This task was returned for changes. Address the review findings, publish current governed delivery evidence, and resubmit through the available governed action. This re-enters the configured stage; it does not declare Business Outcome acceptance. The action description gives the exact resubmission fields." : "Ensure the exact governed Delivery Manifest is ready when required (for delegated delivery, preserve the final-child Manifest and package review; do not publish a duplicate root package), record the final production evidence with update_parent status in_progress, and end the run successfully. The runtime_action_in_progress_server_owned receipt is the expected handoff receipt, not permission to retry with done.",
     "The Server verifies terminal Outcome evidence, Manifest readiness, and blocking work before starting the configured stages in order. Agent participants receive a fresh independent run (even if the same employee produced the work); user participants follow the configured human stage. Business Outcome acceptance remains a later gate.",
     "Do not create a request_confirmation / review_document_revision interaction as a substitute for these configured final review or approval stages. Preserve genuine intermediate questions, user decisions, and authorization needs; an existing pending interaction must still follow its authoritative continuation policy.",
     "Report delivery submitted and configured review pending until a Server receipt proves otherwise; do not claim the task is accepted or done."
@@ -31793,7 +31823,7 @@ function executionReviewContractSection(context, input) {
       "You are the active Approver in a fresh execution run. Do not execute or continue the producer's task.",
       "Review the current Task, its Acceptance criteria, the completed reviewer findings, and the exact governed delivery references before deciding.",
       "Approve only when the reviewed result is suitable for final acceptance. Otherwise request concrete, scoped changes; the workflow routes them to the stored return assignee.",
-      "Record the decision only through runtime_action_describe and runtime_action_submit for update_parent, with executionDecision approved or changes_requested and a non-empty comment. Do not use status and do not embed the decision in an action plan."
+      "Record the decision through the available governed action; its description gives the exact fields and submission mode."
     ].join("\n");
     return {
       sourceRef: `issue:${input.issueId ?? "unknown"}:execution-approval:${readString(executionStage.stageId) ?? "unknown"}`,
@@ -31862,7 +31892,6 @@ function executionReviewContractSection(context, input) {
       "The Server-owned review target below is authoritative. Review is valid only while Delivery readiness is ready and the exact Manifest identity remains current.",
       "Inspect every listed refId and evaluate every listed acceptanceRef. Submit reviewEvidence with the decision; the Server rejects missing refs, missing Acceptance findings, mismatched Manifest identity, or a Manifest that changed before commit.",
       "For approval, every Acceptance finding must be passed. For changes_requested, include at least one failed finding with a concrete explanation tied to its acceptanceRef and inspected artifact.",
-      'Use this exact reviewEvidence shape in the Issue update that records the decision: {"schemaVersion":"mirrorx.execution-review-evidence.v1","manifest":<copy exact target manifest>,"inspectedRefIds":<every target refId>,"acceptanceFindings":[{"acceptanceRef":<target acceptanceRef>,"outcome":"passed"|"failed","finding":<concrete observed evidence>}]}. Copy manifest and refIds exactly from the target; every passed or failed finding must state what was actually observed in the inspected artifact.',
       "Authoritative review target:",
       "```json",
       jsonText(reviewTarget),
@@ -31870,7 +31899,7 @@ function executionReviewContractSection(context, input) {
     ] : [
       "No Server-managed Delivery Manifest is required for this Task. Use only governed exact work-product, document, artifact, or commit references, and identify each inspected reference in the decision comment."
     ],
-    "Record the decision only through runtime_action_describe and runtime_action_submit for update_parent, with executionDecision approved or changes_requested and a non-empty comment. Include reviewEvidence in that same update_parent action whenever the authoritative target above is present. Do not use status for an execution-stage decision.",
+    "Record the decision through the available governed action; its description gives the exact evidence fields and submission mode.",
     "Approve only when every Acceptance criterion is satisfied by inspected deliverables. Otherwise request changes with concrete, scoped findings. The workflow routes requested changes to the stored return assignee."
   ].filter(Boolean).join("\n");
   return {
@@ -32382,7 +32411,7 @@ ${resolvedDependencies.details.content}` : resolvedDependencies.details.content
     content: resolvedDependencyContent,
     mandatoryContent: resolvedDependencies.required.content
   } : null;
-  const deliveryReadinessContent = runtimeDeliveryReadinessText(context, input);
+  const deliveryReadinessContent = runtimeDeliveryReadinessText(context);
   const executionReviewContract = ["reviewer", "approver", "invalid_execution_stage"].includes(runContract) ? executionReviewContractSection(context, input) : null;
   const producerExecutionHandoff = producerExecutionHandoffSection(input, runContract, pendingExecutionStages);
   const optionalTaskWikiContext = optionalTaskWikiContextSection(context);
@@ -32424,7 +32453,7 @@ ${resolvedDependencies.details.content}` : resolvedDependencies.details.content
     ...!hasTask && readString(input.issueLine) && options.separateRuntimeRules === true ? [{ name: "issue_line", title: "", priority: 100, sourceRef: `issue:${input.issueId ?? "unknown"}`, content: `- issue: ${input.issueLine}` }] : [],
     { name: "runtime_rules", title: "", priority: 100, sourceRef: `command:${input.commandId}`, content: fixedRules(input, runContract) },
     { name: "current_run_context", title: "", priority: 100, sourceRef: `command:${input.commandId}`, content: currentRunContext(input, !hasTask && options.separateRuntimeRules !== true) },
-    { name: "runtime_authorization", title: "Runtime Action Contract", priority: 98, sourceRef: `run:${input.runId ?? "unknown"}`, content: runtimeAuthorizationText(context, mode, {
+    { name: "runtime_authorization", title: "Runtime Action Contract", priority: 98, sourceRef: `run:${input.runId ?? "unknown"}`, content: runtimeAuthorizationText(context, {
       replayAlreadyInTask: includeTask && taskText.includes(EXACT_ORGANIZATION_INTENT_REPLAY_MARKER),
       runContract,
       pendingExecutionStages,
@@ -32484,7 +32513,7 @@ ${resolvedDependencies.details.content}` : resolvedDependencies.details.content
 }
 
 // src/amaster-runtime-daemon/agent-instruction-delivery.mjs
-import { createHash as createHash13, randomBytes } from "node:crypto";
+import { createHash as createHash14, randomBytes } from "node:crypto";
 import { existsSync as existsSync10, lstatSync as lstatSync9, mkdirSync as mkdirSync10, readFileSync as readFileSync11, readdirSync as readdirSync8, realpathSync as realpathSync9, renameSync as renameSync8, rmSync as rmSync8, writeFileSync as writeFileSync11 } from "node:fs";
 import { dirname as dirname9, isAbsolute as isAbsolute6, join as join15, relative as relative4, resolve as resolve9 } from "node:path";
 
@@ -32696,7 +32725,7 @@ function inspectExternalWorkspaceProjectInstructions(sourceWorkspacePath, option
         path: relativePath,
         scope: relativePath.includes("/") ? relativePath.slice(0, relativePath.lastIndexOf("/")) : ".",
         bytes: content.byteLength,
-        sha256: createHash13("sha256").update(content).digest("hex")
+        sha256: createHash14("sha256").update(content).digest("hex")
       });
     }
   }
@@ -32707,9 +32736,9 @@ function inspectExternalWorkspaceProjectInstructions(sourceWorkspacePath, option
     status: sources.length === 0 ? "absent_verified" : "present_verified",
     visitedDirectories,
     sources,
-    topologySha256: createHash13("sha256").update(JSON.stringify(sources)).digest("hex"),
+    topologySha256: createHash14("sha256").update(JSON.stringify(sources)).digest("hex"),
     ignoredManagedExecutionDirectoryCount: ignoredManagedExecutionDirectories.length,
-    ignoredManagedExecutionDirectoriesSha256: createHash13("sha256").update(JSON.stringify(ignoredManagedExecutionDirectories)).digest("hex")
+    ignoredManagedExecutionDirectoriesSha256: createHash14("sha256").update(JSON.stringify(ignoredManagedExecutionDirectories)).digest("hex")
   };
 }
 function composeProjectedInstruction(sources, platformInstructions) {
@@ -32798,7 +32827,7 @@ function projectExternalWorkspaceProjectInstructions(sourceWorkspacePath, execut
       );
     }
     const sourceContent = readFileSync11(sourcePath, "utf8");
-    const sourceSha256 = createHash13("sha256").update(sourceContent, "utf8").digest("hex");
+    const sourceSha256 = createHash14("sha256").update(sourceContent, "utf8").digest("hex");
     if (sourceSha256 !== source.sha256) {
       throw instructionTopologyError(
         "workspace_project_instruction_source_changed",
@@ -32843,7 +32872,7 @@ function projectExternalWorkspaceProjectInstructions(sourceWorkspacePath, execut
     }
     modelFacingFile = "AGENTS.md";
     modelFacingBytes = Buffer.byteLength(projectedContent, "utf8");
-    modelFacingSha256 = createHash13("sha256").update(projectedContent, "utf8").digest("hex");
+    modelFacingSha256 = createHash14("sha256").update(projectedContent, "utf8").digest("hex");
   }
   const receiptSources = projected.map(({ content: _content, ...entry }) => entry);
   return {
@@ -32856,7 +32885,7 @@ function projectExternalWorkspaceProjectInstructions(sourceWorkspacePath, execut
     modelFacingFile,
     modelFacingBytes,
     modelFacingSha256,
-    projectionSha256: createHash13("sha256").update(JSON.stringify(receiptSources)).digest("hex")
+    projectionSha256: createHash14("sha256").update(JSON.stringify(receiptSources)).digest("hex")
   };
 }
 function resolveAgentInstructionDelivery(executorKind, options = {}) {
@@ -33361,6 +33390,23 @@ var AUTHORITY_FIELDS = /* @__PURE__ */ new Set([
   "bindingId",
   "browserLeaseId"
 ]);
+var AUTHORITY_V2_FIELDS = /* @__PURE__ */ new Set([
+  "version",
+  "companyId",
+  "issueId",
+  "runId",
+  "commandId",
+  "grantKind",
+  "grantId",
+  "grantRevision",
+  "commandAuthId",
+  "interactionId",
+  "credentialKey",
+  "credentialVersion",
+  "credentialRole",
+  "targetOrigin",
+  "authenticationOrigin"
+]);
 function encodeBrowserCredentialFrame(type, payload) {
   if (!/^[ACREV]$/u.test(type) || !Buffer.isBuffer(payload)) throw new Error("browser_credential_frame_invalid");
   if (payload.length > MAX_BYTES3) throw new Error("browser_credential_frame_too_large");
@@ -33403,7 +33449,13 @@ function semanticMatches(role, semantic) {
 }
 function browserCredentialRefForRequest(command, request) {
   const refs = Array.isArray(command?.payload?.browserCredentialRefs) ? command.payload.browserCredentialRefs : [];
-  const matches = refs.filter((ref2) => ref2 && typeof ref2 === "object" && !Array.isArray(ref2) && !Object.keys(ref2).some((key) => !AUTHORITY_FIELDS.has(key)) && ref2.version === 1 && ref2.commandId === command?.commandId && ref2.runId === request.runId && ref2.commandId === request.commandId && ref2.interactionId === request.interactionId && ref2.credentialKey === request.credentialKey && ref2.credentialVersion === request.credentialVersion && ref2.credentialRole === request.credentialRole && ref2.targetOrigin === request.targetOrigin && ref2.authenticationOrigin === request.authenticationOrigin && ref2.bindingId === request.bindingId && [ref2.companyId, ref2.issueId, ref2.runId, ref2.commandId, ref2.interactionId, ref2.bindingId].every((id) => typeof id === "string" && UUID.test(id)) && typeof ref2.credentialKey === "string" && ref2.credentialKey.length > 0 && Number.isSafeInteger(ref2.credentialVersion) && ref2.credentialVersion > 0 && ["username", "password"].includes(ref2.credentialRole) && exactOrigin(ref2.targetOrigin) === ref2.targetOrigin && exactOrigin(ref2.authenticationOrigin) === ref2.authenticationOrigin && typeof ref2.browserLeaseId === "string" && /^browser-credential-(?:auth-write|agent-read)-[0-9a-f-]{36}$/u.test(ref2.browserLeaseId));
+  const matches = refs.filter((ref2) => ref2 && typeof ref2 === "object" && !Array.isArray(ref2) && [1, 2].includes(ref2.version) && ref2.version === request.version && !Object.keys(ref2).some((key) => !(ref2.version === 1 ? AUTHORITY_FIELDS : AUTHORITY_V2_FIELDS).has(key)) && ref2.commandId === command?.commandId && ref2.runId === request.runId && ref2.commandId === request.commandId && (ref2.version === 1 ? ref2.interactionId === request.interactionId && ref2.bindingId === request.bindingId : ref2.grantKind === request.grantKind && ref2.grantId === request.grantId && ref2.grantRevision === request.grantRevision && ref2.commandAuthId === request.commandAuthId && ref2.interactionId === request.interactionId) && ref2.credentialKey === request.credentialKey && ref2.credentialVersion === request.credentialVersion && ref2.credentialRole === request.credentialRole && ref2.targetOrigin === request.targetOrigin && ref2.authenticationOrigin === request.authenticationOrigin && [
+    ref2.companyId,
+    ref2.issueId,
+    ref2.runId,
+    ref2.commandId,
+    ...ref2.version === 1 ? [ref2.interactionId, ref2.bindingId] : [ref2.grantId, ref2.commandAuthId]
+  ].every((id) => typeof id === "string" && UUID.test(id)) && (ref2.version === 1 || ["interaction", "stored_grant"].includes(ref2.grantKind) && Number.isSafeInteger(ref2.grantRevision) && ref2.grantRevision > 0 && ref2.grantKind === "interaction" === (typeof ref2.interactionId === "string" && UUID.test(ref2.interactionId))) && typeof ref2.credentialKey === "string" && ref2.credentialKey.length > 0 && Number.isSafeInteger(ref2.credentialVersion) && ref2.credentialVersion > 0 && ["username", "password"].includes(ref2.credentialRole) && exactOrigin(ref2.targetOrigin) === ref2.targetOrigin && exactOrigin(ref2.authenticationOrigin) === ref2.authenticationOrigin && (ref2.version === 2 || typeof ref2.browserLeaseId === "string" && /^browser-credential-(?:auth-write|agent-read)-[0-9a-f-]{36}$/u.test(ref2.browserLeaseId)));
   if (matches.length !== 1 || !semanticMatches(matches[0].credentialRole, request.controlSemantic)) {
     throw new Error("browser_credential_semantic_mismatch");
   }
@@ -33411,7 +33463,23 @@ function browserCredentialRefForRequest(command, request) {
 }
 function exactRequest(value, challenge) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return null;
-  const allowed = /* @__PURE__ */ new Set([
+  const allowed = new Set(value.version === 2 ? [
+    "version",
+    "challenge",
+    "grantKind",
+    "grantId",
+    "grantRevision",
+    "commandAuthId",
+    "interactionId",
+    "credentialKey",
+    "credentialVersion",
+    "credentialRole",
+    "runId",
+    "commandId",
+    "targetOrigin",
+    "authenticationOrigin",
+    "controlSemantic"
+  ] : [
     "version",
     "challenge",
     "interactionId",
@@ -33425,11 +33493,16 @@ function exactRequest(value, challenge) {
     "authenticationOrigin",
     "controlSemantic"
   ]);
-  if (Object.keys(value).some((key) => !allowed.has(key)) || value.version !== 1 || typeof value.challenge !== "string") return null;
+  if (Object.keys(value).some((key) => !allowed.has(key)) || ![1, 2].includes(value.version) || typeof value.challenge !== "string") return null;
   const expected = Buffer.from(challenge, "utf8");
   const actual = Buffer.from(value.challenge, "utf8");
   if (actual.length !== expected.length || !timingSafeEqual(actual, expected)) return null;
-  if (![value.interactionId, value.runId, value.commandId, value.bindingId].every((id) => typeof id === "string" && UUID.test(id))) return null;
+  if (![
+    value.runId,
+    value.commandId,
+    ...value.version === 1 ? [value.interactionId, value.bindingId] : [value.grantId, value.commandAuthId]
+  ].every((id) => typeof id === "string" && UUID.test(id))) return null;
+  if (value.version === 2 && (!["interaction", "stored_grant"].includes(value.grantKind) || !Number.isSafeInteger(value.grantRevision) || value.grantRevision < 1 || value.grantKind === "interaction" !== (typeof value.interactionId === "string" && UUID.test(value.interactionId)))) return null;
   const targetOrigin = exactOrigin(value.targetOrigin);
   const authenticationOrigin = exactOrigin(value.authenticationOrigin);
   const semantic = typeof value.controlSemantic === "string" ? value.controlSemantic.trim().toLowerCase() : "";
@@ -33438,8 +33511,9 @@ function exactRequest(value, challenge) {
   if (!["username", "password"].includes(value.credentialRole) || !semanticMatches(value.credentialRole, semantic)) return null;
   return { ...value, credentialKey: value.credentialKey.trim(), targetOrigin, authenticationOrigin, controlSemantic: semantic };
 }
-function createBrowserCredentialChannel({ consume, onFailure }) {
+function createBrowserCredentialChannel({ consume, onFailure, authorizedRefs = [] }) {
   if (typeof consume !== "function") throw new Error("browser_credential_consumer_required");
+  if (!Array.isArray(authorizedRefs)) throw new Error("browser_credential_authority_invalid");
   const challenge = randomBytes2(32).toString("base64url");
   const consumedRefs = /* @__PURE__ */ new Set();
   const consumedRequests = [];
@@ -33474,7 +33548,21 @@ function createBrowserCredentialChannel({ consume, onFailure }) {
       return;
     }
     if (!receipt || typeof receipt !== "object" || Array.isArray(receipt)) return;
-    const allowed = /* @__PURE__ */ new Set([
+    const allowed = new Set(receipt.version === 2 ? [
+      "version",
+      "status",
+      "runId",
+      "commandId",
+      "grantKind",
+      "grantId",
+      "grantRevision",
+      "commandAuthId",
+      "interactionId",
+      "origin",
+      "pageGeneration",
+      "contextRotated",
+      "credentialRoles"
+    ] : [
       "version",
       "status",
       "runId",
@@ -33487,7 +33575,25 @@ function createBrowserCredentialChannel({ consume, onFailure }) {
       "credentialRoles"
     ]);
     if (Object.keys(receipt).some((key) => !allowed.has(key))) return;
-    if (receipt.version !== 1 || receipt.status !== "authenticated" || receipt.contextRotated !== true) return;
+    if (![1, 2].includes(receipt.version)) return;
+    if (receipt.version === 2) {
+      if (!["authenticated", "session_authenticated"].includes(receipt.status) || !["interaction", "stored_grant"].includes(receipt.grantKind) || typeof receipt.pageGeneration !== "string" || !UUID.test(receipt.pageGeneration) || !Number.isSafeInteger(receipt.grantRevision) || receipt.grantRevision < 1 || ![receipt.grantId, receipt.commandAuthId, receipt.runId, receipt.commandId].every((id) => typeof id === "string" && UUID.test(id)) || receipt.grantKind === "interaction" !== (typeof receipt.interactionId === "string" && UUID.test(receipt.interactionId))) return;
+      const matches = authorizedRefs.filter((ref2) => ref2?.version === 2 && ref2.runId === receipt.runId && ref2.commandId === receipt.commandId && ref2.grantKind === receipt.grantKind && ref2.grantId === receipt.grantId && ref2.grantRevision === receipt.grantRevision && ref2.commandAuthId === receipt.commandAuthId && ref2.interactionId === receipt.interactionId && ref2.authenticationOrigin === receipt.origin);
+      if (!matches.some((ref2) => ref2.credentialRole === "password")) return;
+      if (receipt.status === "session_authenticated") {
+        if (receipt.contextRotated !== false || !Array.isArray(receipt.credentialRoles) || receipt.credentialRoles.length !== 0 || consumedRequests.length !== 0) return;
+        if (authReceipts.length === 0) authReceipts.push(Object.freeze({ ...receipt, credentialRoles: [] }));
+        return;
+      }
+      if (receipt.contextRotated !== true) return;
+      const consumed = consumedRequests.filter((request) => request.version === 2 && request.runId === receipt.runId && request.commandId === receipt.commandId && request.grantId === receipt.grantId && request.grantRevision === receipt.grantRevision && request.commandAuthId === receipt.commandAuthId && request.authenticationOrigin === receipt.origin);
+      if (!consumed.some((request) => request.credentialRole === "password")) return;
+      const roles = new Set(consumed.map((request) => request.credentialRole));
+      if (!Array.isArray(receipt.credentialRoles) || !receipt.credentialRoles.includes("password") || receipt.credentialRoles.some((role) => !roles.has(role))) return;
+      if (authReceipts.length === 0) authReceipts.push(Object.freeze({ ...receipt, credentialRoles: [...new Set(receipt.credentialRoles)].sort() }));
+      return;
+    }
+    if (receipt.status !== "authenticated" || receipt.contextRotated !== true) return;
     if (typeof receipt.pageGeneration !== "string" || !UUID.test(receipt.pageGeneration)) return;
     if (!Array.isArray(receipt.credentialRoles) || receipt.credentialRoles.length < 1 || receipt.credentialRoles.some((role) => !["username", "password"].includes(role))) return;
     const matching = consumedRequests.filter((request) => request.runId === receipt.runId && request.commandId === receipt.commandId && request.interactionId === receipt.interactionId && request.bindingId === receipt.bindingId && request.authenticationOrigin === receipt.origin);
@@ -33580,22 +33686,11 @@ function createBrowserCredentialChannel({ consume, onFailure }) {
 
 // src/amaster-runtime-daemon/browser-credential-readiness.mjs
 import { existsSync as existsSync12, lstatSync as lstatSync10, readFileSync as readFileSync13, readdirSync as readdirSync9, statSync as statSync6 } from "node:fs";
-import { createHash as createHash14 } from "node:crypto";
+import { createHash as createHash15 } from "node:crypto";
 import { homedir as homedir4 } from "node:os";
 import { dirname as dirname11, isAbsolute as isAbsolute7, join as join17, relative as relative5, resolve as resolve11 } from "node:path";
-var CREDENTIAL_BROWSER_TCB = Object.freeze({
-  package: "chrome-devtools-mcp",
-  version: "1.6.0",
-  mode: "puppeteer_pipe",
-  buildTreeSha256: "5bd07cd7ea92141441db12d1e84c4829dd4e2a45ea77f719878be9f4a42925d7"
-});
-var CREDENTIAL_BROWSER_PACKAGE_FILES = Object.freeze({
-  "dist/config.js": "01da4c975a050dc1860a5115b244020be741100bff3c426f601642a6f757f370",
-  "dist/index.js": "9cf0dac303552cbfb7f87c9499dbd8c1d88565e0145825ca222424e1123b70e2"
-});
-var CREDENTIAL_BROWSER_DIST_TREE_SHA256 = "fcf1abd578c519b7ab7cec921d1abe36992aab84b4f713e0b89587e6254145a9";
-var CREDENTIAL_AUTH_EXTENSION_SHA256 = "48f36d0c1c5c46f07bd447c2bc2000595d17f109ce6963865870d88f42c60598";
-var CREDENTIAL_BROWSER_PACKAGE_VERSION = "0.1.2-beta.80";
+var TCB_DIGEST = /^[a-f0-9]{64}$/u;
+var TCB_INTEGRITY = /^sha512-[A-Za-z0-9+/]+={0,2}$/u;
 var IMAGE_PI_HOME = "/opt/pi-cli-runtime/.pi";
 var BROWSER_AUTH_IMAGE_HOME = IMAGE_PI_HOME;
 var IMAGE_AUTH_EXTENSION_PATH = join17(IMAGE_PI_HOME, "extensions", "browser-credential-auth.mjs");
@@ -33608,8 +33703,9 @@ function inspectBrowserCredentialAuthReadiness(env = process.env, expected = {},
   const home = String(env.PI_CODING_AGENT_DIR ?? env.PI_AGENT_HOME ?? join17(homedir4(), ".pi", "agent")).trim();
   const packageHome = expected.packageHome ?? IMAGE_PI_HOME;
   const extensionPath = expected.authExtensionPath ?? IMAGE_AUTH_EXTENSION_PATH;
+  const tcbManifestPath = expected.tcbManifestPath ?? join17(packageHome, "browser-credential-tcb.json");
   const requireImageOwnership = options.requireImageOwnership !== false;
-  const cacheKey = JSON.stringify([home, packageHome, extensionPath, requireImageOwnership]);
+  const cacheKey = JSON.stringify([home, packageHome, extensionPath, tcbManifestPath, requireImageOwnership]);
   const now = Date.now();
   const cached = readinessCache.get(cacheKey);
   if (!options.fresh && cached && cached.expiresAt > now) return { ...cached.readiness };
@@ -33617,16 +33713,12 @@ function inspectBrowserCredentialAuthReadiness(env = process.env, expected = {},
     join17(packageHome, "npm", "node_modules", "@amaster.ai", "pi-browser-use", "package.json"),
     join17(packageHome, "node_modules", "@amaster.ai", "pi-browser-use", "package.json")
   ];
-  const packageAttestation = candidates.map((manifestPath) => attestedPackageManifest(manifestPath, {
-    browserTcb: expected.browserTcb ?? CREDENTIAL_BROWSER_TCB,
-    packageFiles: expected.packageFiles ?? CREDENTIAL_BROWSER_PACKAGE_FILES,
-    packageDistTreeSha256: expected.packageDistTreeSha256 ?? CREDENTIAL_BROWSER_DIST_TREE_SHA256,
-    authExtensionSha256: expected.authExtensionSha256 ?? CREDENTIAL_AUTH_EXTENSION_SHA256
-  }, requireImageOwnership)).find(Boolean) ?? null;
+  const tcb = imageTcbManifest(tcbManifestPath, requireImageOwnership);
+  const packageAttestation = tcb ? candidates.map((manifestPath) => attestedPackageManifest(manifestPath, tcb, requireImageOwnership)).find(Boolean) ?? null : null;
   const packageAttested = Boolean(packageAttestation);
   const authExtensionAttested = attestedAuthExtension(
     extensionPath,
-    packageAttestation ? expected.authExtensionSha256 ?? CREDENTIAL_AUTH_EXTENSION_SHA256 : null,
+    packageAttestation ? tcb.authExtension.sha256 : null,
     requireImageOwnership
   );
   let runtimeExtensionsAttested = false;
@@ -33717,7 +33809,7 @@ function attestedAuthExtension(extensionPath, expectedSha256, requireImageOwners
     if (!extensionStat.isFile() || extensionStat.isSymbolicLink()) return false;
     if (requireImageOwnership && !immutableImageFile(extensionPath)) return false;
     const source = readFileSync13(extensionPath, "utf8");
-    return createHash14("sha256").update(source, "utf8").digest("hex") === expectedSha256 && source.includes("BrowserCredentialAuthBroker") && source.includes("browser_authenticate") && source.includes("AMASTER_BROWSER_CREDENTIAL_PRIVATE_CHANNEL");
+    return createHash15("sha256").update(source, "utf8").digest("hex") === expectedSha256 && source.includes("BrowserCredentialAuthBroker") && source.includes("browser_authenticate") && source.includes("AMASTER_BROWSER_CREDENTIAL_PRIVATE_CHANNEL");
   } catch {
     return false;
   }
@@ -33731,9 +33823,6 @@ function immutableImageFile(filePath) {
   }
   return true;
 }
-function fileSha256(path) {
-  return createHash14("sha256").update(readFileSync13(path)).digest("hex");
-}
 function treeAttestation(root, requireImageOwnership) {
   const files = [];
   const visit = (directory) => {
@@ -33746,7 +33835,7 @@ function treeAttestation(root, requireImageOwnership) {
   };
   visit(root);
   files.sort();
-  const digest2 = createHash14("sha256");
+  const digest2 = createHash15("sha256");
   for (const path of files) {
     digest2.update(relative5(root, path).replaceAll("\\", "/"));
     digest2.update("\0");
@@ -33754,23 +33843,38 @@ function treeAttestation(root, requireImageOwnership) {
   }
   return digest2.digest("hex");
 }
+function imageTcbManifest(manifestPath, requireImageOwnership) {
+  try {
+    if (requireImageOwnership && !immutableImageFile(manifestPath)) return null;
+    const manifest = JSON.parse(readFileSync13(manifestPath, "utf8"));
+    if (manifest?.schemaVersion !== 1 || manifest.browserPackage?.name !== "@amaster.ai/pi-browser-use" || !/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u.test(manifest.browserPackage.version) || !TCB_INTEGRITY.test(manifest.browserPackage.integrity) || manifest.browserPackage.main !== "./dist/index.js" || !TCB_DIGEST.test(manifest.browserPackage.distTreeSha256) || manifest.browserTcb?.name !== "chrome-devtools-mcp" || !/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u.test(manifest.browserTcb.version) || !TCB_INTEGRITY.test(manifest.browserTcb.integrity) || !TCB_DIGEST.test(manifest.browserTcb.buildTreeSha256) || !TCB_DIGEST.test(manifest.authExtension?.sha256)) return null;
+    return manifest;
+  } catch {
+    return null;
+  }
+}
 function attestedPackageManifest(manifestPath, expected, requireImageOwnership) {
   try {
     if (requireImageOwnership && !immutableImageFile(manifestPath)) return null;
     const manifest = JSON.parse(readFileSync13(manifestPath, "utf8"));
-    if (manifest?.name !== "@amaster.ai/pi-browser-use" || manifest.version !== CREDENTIAL_BROWSER_PACKAGE_VERSION) return null;
+    if (manifest?.name !== "@amaster.ai/pi-browser-use" || manifest.version !== expected.browserPackage.version) return null;
     if (manifest.main !== "./dist/index.js" || !Array.isArray(manifest.pi?.extensions) || manifest.pi.extensions.length !== 1 || manifest.pi.extensions[0] !== "./dist/index.js") return null;
     const packageDir = resolve11(manifestPath, "..");
-    if (Object.entries(expected.packageFiles).some(([relativePath, sha2563]) => {
-      const path = resolve11(packageDir, relativePath);
-      const relativePathFromPackage = relative5(packageDir, path);
-      return !relativePathFromPackage || relativePathFromPackage.startsWith("..") || isAbsolute7(relativePathFromPackage) || !statSync6(path).isFile() || requireImageOwnership && !immutableImageFile(path) || fileSha256(path) !== sha2563;
-    }) || treeAttestation(join17(packageDir, "dist"), requireImageOwnership) !== expected.packageDistTreeSha256) return null;
+    const npmLockPath = join17(packageDir, "..", "..", "..", "package-lock.json");
+    if (requireImageOwnership && !immutableImageFile(npmLockPath)) return null;
+    const npmLock = JSON.parse(readFileSync13(npmLockPath, "utf8"));
+    if (npmLock.packages?.["node_modules/@amaster.ai/pi-browser-use"]?.version !== expected.browserPackage.version || npmLock.packages?.["node_modules/@amaster.ai/pi-browser-use"]?.integrity !== expected.browserPackage.integrity || npmLock.packages?.["node_modules/chrome-devtools-mcp"]?.version !== expected.browserTcb.version || npmLock.packages?.["node_modules/chrome-devtools-mcp"]?.integrity !== expected.browserTcb.integrity || treeAttestation(join17(packageDir, "dist"), requireImageOwnership) !== expected.browserPackage.distTreeSha256) return null;
     const browserPackageDir = resolve11(packageDir, "..", "..", "chrome-devtools-mcp");
     const browserManifestPath = join17(browserPackageDir, "package.json");
     if (requireImageOwnership && !immutableImageFile(browserManifestPath)) return null;
     const browserPackage = JSON.parse(readFileSync13(browserManifestPath, "utf8"));
-    if (browserPackage.name !== expected.browserTcb.package || browserPackage.version !== expected.browserTcb.version || treeAttestation(join17(browserPackageDir, "build"), requireImageOwnership) !== expected.browserTcb.buildTreeSha256) return null;
+    if (browserPackage.name !== expected.browserTcb.name || browserPackage.version !== expected.browserTcb.version || treeAttestation(join17(browserPackageDir, "build"), requireImageOwnership) !== expected.browserTcb.buildTreeSha256) return null;
+    for (const entry of [browserPackage.main, browserPackage.bin?.["chrome-devtools-mcp"]]) {
+      if (typeof entry !== "string" || !/^(?:\.\/)?build\//u.test(entry)) return null;
+      const path = resolve11(browserPackageDir, entry);
+      const fromBuild = relative5(join17(browserPackageDir, "build"), path);
+      if (!fromBuild || fromBuild.startsWith("..") || isAbsolute7(fromBuild) || !lstatSync10(path).isFile() || lstatSync10(path).isSymbolicLink() || requireImageOwnership && !immutableImageFile(path)) return null;
+    }
     const entrypoint = resolve11(packageDir, manifest.main);
     const relativeEntrypoint = relative5(packageDir, entrypoint);
     if (!relativeEntrypoint || relativeEntrypoint.startsWith("..") || isAbsolute7(relativeEntrypoint) || !existsSync12(entrypoint) || requireImageOwnership && !immutableImageFile(entrypoint)) return null;
@@ -33924,11 +34028,12 @@ function browserCredentialPrivateAuthority(command, presentation = browserCreden
   const origin = parsedTarget.protocol === "https:" && !parsedTarget.username && !parsedTarget.password ? parsedTarget.origin : null;
   const passwordRefs = refs.filter((ref2) => ref2?.credentialRole === "password");
   const usernameRefs = refs.filter((ref2) => ref2?.credentialRole === "username");
-  if (!origin || refs.length < 1 || refs.length > 2 || passwordRefs.length !== 1 || usernameRefs.length > 1 || !predicate || predicate.version !== 1 || predicate.type !== "snapshot_text_v1" || typeof predicate.requiredText !== "string" || predicate.requiredText !== predicate.requiredText.trim() || predicate.requiredText.length < 8 || predicate.requiredText.length > 256 || /[\u0000-\u001f\u007f]/u.test(predicate.requiredText) || refs.some((ref2) => ref2?.commandId !== command?.commandId || ref2?.bindingId !== session?.bindingId || ref2?.browserLeaseId !== session?.browserLeaseId || ref2?.targetOrigin !== origin || ref2?.authenticationOrigin !== origin)) {
+  const version = session?.version === 2 ? 2 : 1;
+  if (!origin || refs.length < 1 || refs.length > 2 || passwordRefs.length !== 1 || usernameRefs.length > 1 || !predicate || predicate.version !== 1 || predicate.type !== "snapshot_text_v1" || typeof predicate.requiredText !== "string" || predicate.requiredText !== predicate.requiredText.trim() || predicate.requiredText.length < 8 || predicate.requiredText.length > 256 || /[\u0000-\u001f\u007f]/u.test(predicate.requiredText) || refs.some((ref2) => (version === 2 ? ref2?.version !== 2 : ref2?.version !== void 0 && ref2?.version !== 1) || ref2?.commandId !== command?.commandId || (version === 1 ? ref2?.bindingId !== session?.bindingId || ref2?.browserLeaseId !== session?.browserLeaseId : ref2?.grantId !== session?.grantId || ref2?.grantRevision !== session?.grantRevision || ref2?.commandAuthId !== session?.commandAuthId || ref2?.grantKind !== session?.grantKind || ref2?.interactionId !== session?.interactionId || ref2?.companyId !== session?.companyId) || ref2?.targetOrigin !== origin || ref2?.authenticationOrigin !== origin)) {
     fail3("browser_credential_authority_invalid");
   }
   return Object.freeze({
-    version: 1,
+    version,
     targetUrl: parsedTarget.href,
     authenticatedPredicate: Object.freeze({ ...predicate }),
     refs: Object.freeze(refs.map((ref2) => Object.freeze({ ...ref2 })))
@@ -34011,7 +34116,7 @@ async function materializeBrowserCredentialEnv(plan, options) {
 }
 
 // src/amaster-runtime-daemon/runtime-artifact-upload.mjs
-import { createHash as createHash15 } from "node:crypto";
+import { createHash as createHash16 } from "node:crypto";
 import { closeSync as closeSync4, constants as constants3, fstatSync as fstatSync4, lstatSync as lstatSync13, openSync as openSync4, readFileSync as readFileSync16, realpathSync as realpathSync10 } from "node:fs";
 import { isAbsolute as isAbsolute10, relative as relative6, resolve as resolve13 } from "node:path";
 var SHA256_PATTERN = /^[a-f0-9]{64}$/;
@@ -34101,7 +34206,7 @@ function prepareRuntimeArtifactUploads(cwd, mcpToolResults) {
       `Runtime Artifact ${intentId}`,
       { expectedByteSize }
     );
-    const actualSha256 = createHash15("sha256").update(body).digest("hex");
+    const actualSha256 = createHash16("sha256").update(body).digest("hex");
     if (body.length !== expectedByteSize || actualSha256 !== expectedSha256) {
       throw new Error(`Runtime Artifact ${intentId} bytes do not match the governed ownership manifest`);
     }
@@ -34118,7 +34223,7 @@ function prepareRuntimeArtifactUploads(cwd, mcpToolResults) {
 }
 
 // src/amaster-runtime-daemon/runtime-document-upload.mjs
-import { createHash as createHash16 } from "node:crypto";
+import { createHash as createHash17 } from "node:crypto";
 
 // src/amaster-runtime-daemon/workspace-sensitive-path.mjs
 var SENSITIVE_PATH_SEGMENTS = /* @__PURE__ */ new Set([
@@ -34193,7 +34298,7 @@ function prepareRuntimeDocumentUploads(cwd, mcpToolResults) {
         maxByteSize: MAX_WORKSPACE_DOCUMENT_BYTES
       }
     );
-    const actualSha256 = createHash16("sha256").update(body).digest("hex");
+    const actualSha256 = createHash17("sha256").update(body).digest("hex");
     if (body.length !== expectedByteSize || actualSha256 !== expectedSha256) {
       throw new Error(`Runtime Document ${callId} bytes do not match the governed ownership manifest`);
     }
@@ -34390,7 +34495,7 @@ function createRuntimeArtifactIngestQueue({ ingest, onError }) {
 }
 
 // src/amaster-runtime-daemon/workspace-guard.mjs
-import { createHash as createHash17 } from "node:crypto";
+import { createHash as createHash18 } from "node:crypto";
 import { existsSync as existsSync14, mkdirSync as mkdirSync12, realpathSync as realpathSync11, statSync as statSync7 } from "node:fs";
 import { basename as basename6, join as join21, isAbsolute as isAbsolute11, relative as relative7, resolve as resolve14 } from "node:path";
 function pathWithin3(candidate, root) {
@@ -34419,7 +34524,7 @@ function resolveWorkspaceCwd(config, command) {
   return cwd;
 }
 function shortHash(value, length = 12) {
-  return createHash17("sha256").update(String(value)).digest("hex").slice(0, length);
+  return createHash18("sha256").update(String(value)).digest("hex").slice(0, length);
 }
 function safeSegment(value, fallback) {
   const raw = String(value ?? "").trim();
@@ -34615,7 +34720,7 @@ function planManagedWorkspaceGcDryRun(input) {
 }
 
 // src/amaster-runtime-daemon/preset-templates.mjs
-import { createHash as createHash18 } from "node:crypto";
+import { createHash as createHash19 } from "node:crypto";
 import {
   accessSync,
   chmodSync as chmodSync8,
@@ -34639,7 +34744,7 @@ var MAX_PRESET_TEMPLATE_FILES = 256;
 var MAX_PRESET_TEMPLATE_FILE_BYTES = 20 * 1024 * 1024;
 var MAX_PRESET_TEMPLATE_TOTAL_BYTES = 50 * 1024 * 1024;
 function sha2562(value) {
-  return createHash18("sha256").update(value).digest("hex");
+  return createHash19("sha256").update(value).digest("hex");
 }
 function lstatIfExists(path) {
   try {
@@ -35310,7 +35415,7 @@ export default function amasterProjectInstructions(pi) {
 
 // src/amaster-runtime-daemon/workspace-status.mjs
 import { spawnSync as spawnSync5 } from "node:child_process";
-import { createHash as createHash19 } from "node:crypto";
+import { createHash as createHash20 } from "node:crypto";
 import { existsSync as existsSync18, readdirSync as readdirSync13, readFileSync as readFileSync20, statSync as statSync11 } from "node:fs";
 import { basename as basename7, extname as extname2, isAbsolute as isAbsolute13, join as join25, relative as relative8, resolve as resolve19 } from "node:path";
 var WORKSPACE_RUNTIME_SERVICES_FILENAME = ".amaster-runtime-services.json";
@@ -35381,7 +35486,7 @@ function sanitizeTrackedChange(line) {
   return isSafeRelativePath(path) ? line : null;
 }
 function sha256File(filePath) {
-  return createHash19("sha256").update(readFileSync20(filePath)).digest("hex");
+  return createHash20("sha256").update(readFileSync20(filePath)).digest("hex");
 }
 function artifactHashCacheKey(relativePath, stat) {
   return `${relativePath}\0${stat.size}\0${stat.mtimeMs}`;
@@ -35613,7 +35718,7 @@ function assertRequiredTaskAttachmentMaterialized(input, materialized) {
 }
 
 // src/amaster-runtime-daemon.mjs
-var CONNECTOR_VERSION = "0.1.14";
+var CONNECTOR_VERSION = "0.1.16";
 var CONNECTOR_CONTRACT_VERSION = "2026-06-04.v1";
 var SUPPORTED_TASK_CONTEXT_VERSIONS = Object.freeze([TASK_CONTEXT_MANIFEST_VERSION, TASK_CONTEXT_V2]);
 var daemonRequire = createRequire(import.meta.url);
@@ -35627,6 +35732,27 @@ var PI_COMPLETION_OUTPUT_TYPES = /* @__PURE__ */ new Set(["agent_settled", "appr
 var PI_MODEL_CALL_PROTOCOL_AMPLIFICATION_LIMIT = 8;
 var PROCESS_GROUP_RSS_SAMPLE_MIN_INTERVAL_MS = 5e3;
 var activeRunCommands = /* @__PURE__ */ new Map();
+var companyBrowserProfileTails = /* @__PURE__ */ new Map();
+async function acquireCompanyBrowserProfileLock(companyId) {
+  if (typeof companyId !== "string" || !/^[0-9a-f-]{36}$/iu.test(companyId)) {
+    throw new Error("browser_company_profile_invalid");
+  }
+  const preceding = companyBrowserProfileTails.get(companyId) ?? Promise.resolve();
+  let resolveCurrent;
+  const current = new Promise((resolve21) => {
+    resolveCurrent = resolve21;
+  });
+  const tail = preceding.then(() => current);
+  companyBrowserProfileTails.set(companyId, tail);
+  await preceding;
+  let released = false;
+  return () => {
+    if (released) return;
+    released = true;
+    resolveCurrent();
+    if (companyBrowserProfileTails.get(companyId) === tail) companyBrowserProfileTails.delete(companyId);
+  };
+}
 var pendingResultOutboxRunCommands = /* @__PURE__ */ new Map();
 var pendingRunCompletionCommands = /* @__PURE__ */ new Map();
 var runCompletionCoordinators = /* @__PURE__ */ new Map();
@@ -36303,7 +36429,7 @@ function handoffPiRunPathsToChild(config, paths) {
 function materializePiRuntimeSystemPrompt(config, promptRoot, commandId, contents) {
   const normalizedCommandId = readString(commandId);
   if (!normalizedCommandId) throw new Error("pi_runtime_system_prompt_command_id_missing");
-  const promptIdentity = createHash20("sha256").update(normalizedCommandId).digest("hex");
+  const promptIdentity = createHash21("sha256").update(normalizedCommandId).digest("hex");
   const promptDir = join26(promptRoot, "tmp");
   mkdirSync14(promptDir, { recursive: true, mode: 448 });
   const promptDirStat = lstatSync16(promptDir);
@@ -36951,6 +37077,9 @@ function commandTaskResourceInput(command) {
 }
 var BROWSER_SESSION_PROFILE_OWNER_MARKER = ".mirrorx-browser-session-owner.json";
 function browserSessionProfileIdentity(config, session) {
+  if (session.version === 2) {
+    return browserGrantProfileIdentity(readString(session.companyId), readString(session.origin));
+  }
   const identity = {
     version: 1,
     companyId: readString(session.companyId),
@@ -37000,7 +37129,7 @@ function ensureBrowserSessionProfile(config, session) {
   } else {
     const temporaryPath = join26(
       userDataDir,
-      `.${BROWSER_SESSION_PROFILE_OWNER_MARKER}.${process.pid}.${createHash20("sha256").update(randomUUID3()).digest("hex")}`
+      `.${BROWSER_SESSION_PROFILE_OWNER_MARKER}.${process.pid}.${createHash21("sha256").update(randomUUID3()).digest("hex")}`
     );
     writeFileSync15(temporaryPath, `${JSON.stringify(identity)}
 `, { mode: 384, flag: "wx" });
@@ -37089,7 +37218,7 @@ function safeAgentInstructionMaterializationTarget(workspace, filePath) {
 }
 function stableInstructionFilesHash(files) {
   const canonical = Object.entries(files).filter(([filePath, content]) => typeof filePath === "string" && typeof content === "string").sort(([left], [right]) => left.localeCompare(right)).map(([filePath, content]) => `${filePath.length}:${filePath}${content.length}:${content}`).join("");
-  return createHash20("sha256").update(canonical, "utf8").digest("hex");
+  return createHash21("sha256").update(canonical, "utf8").digest("hex");
 }
 function requireCommandContextEnvelope(command) {
   const payload = asRecord(command.payload);
@@ -37133,7 +37262,7 @@ function requireCommandContextEnvelope(command) {
   if (instructions.effectiveChars !== files["AGENTS.md"].length) {
     throw new Error("context_envelope_instruction_size_mismatch");
   }
-  const entrySha256 = createHash20("sha256").update(files["AGENTS.md"], "utf8").digest("hex");
+  const entrySha256 = createHash21("sha256").update(files["AGENTS.md"], "utf8").digest("hex");
   if (entrySha256 !== readString(instructions.contentSha256)) {
     throw new Error("context_envelope_instruction_content_hash_mismatch");
   }
@@ -37143,7 +37272,7 @@ function requireCommandContextEnvelope(command) {
   }
   const runDecisionContext = asRecord(envelope.runDecisionContext);
   const dynamicContext2 = asRecord(runDecisionContext.content);
-  const runDecisionHash = createHash20("sha256").update(canonicalGoalOutcomeValue(dynamicContext2), "utf8").digest("hex");
+  const runDecisionHash = createHash21("sha256").update(canonicalGoalOutcomeValue(dynamicContext2), "utf8").digest("hex");
   if (!readString(runDecisionContext.revision) || !Number.isInteger(runDecisionContext.authorizationEpoch) || runDecisionContext.authorizationEpoch < 0 || runDecisionHash !== readString(runDecisionContext.contentSha256)) throw new Error("context_envelope_run_decision_invalid");
   if (!Array.isArray(envelope.selectedProcedures)) throw new Error("context_envelope_procedures_invalid");
   const toolProfile = asRecord(envelope.toolProfile);
@@ -37153,7 +37282,7 @@ function requireCommandContextEnvelope(command) {
     throw new Error("context_envelope_session_binding_invalid");
   }
   const envelopeHashInput = Object.fromEntries(Object.entries(envelope).filter(([key]) => key !== "envelopeSha256"));
-  const envelopeHash = createHash20("sha256").update(canonicalGoalOutcomeValue(envelopeHashInput), "utf8").digest("hex");
+  const envelopeHash = createHash21("sha256").update(canonicalGoalOutcomeValue(envelopeHashInput), "utf8").digest("hex");
   if (envelopeHash !== readString(envelope.envelopeSha256)) {
     throw new Error("context_envelope_hash_mismatch");
   }
@@ -37184,7 +37313,7 @@ async function materializeEffectiveAgentInstructions(config, command, workspace,
     materialized.push({
       path: target.relativePath,
       byteSize: Buffer.byteLength(content, "utf8"),
-      sha256: createHash20("sha256").update(content, "utf8").digest("hex")
+      sha256: createHash21("sha256").update(content, "utf8").digest("hex")
     });
   }
   const readBackFiles = Object.fromEntries(materialized.map((entry) => [
@@ -38733,6 +38862,7 @@ function runExecutor(command, args, options) {
     const maxRssBytes = maxRssMb * 1024 * 1024;
     const browserCredentialChannel = typeof options.browserCredentialConsumer === "function" ? createBrowserCredentialChannel({
       consume: options.browserCredentialConsumer,
+      authorizedRefs: options.browserCredentialRefs,
       onFailure: (reason) => {
         spawnError = reason;
         spawnErrorCode = reason;
@@ -39986,12 +40116,12 @@ async function materializeIssueAttachments(config, command, workspace) {
     usedFilenames.add(filename);
     const targetPath = join26(targetDir, filename);
     const body = await runtimeApiBuffer(runtimeAuth, contentPath);
-    if (attachment.initializationInput === true && (body.byteLength !== attachment.byteSize || createHash20("sha256").update(body).digest("hex") !== attachment.sha256)) {
+    if (attachment.initializationInput === true && (body.byteLength !== attachment.byteSize || createHash21("sha256").update(body).digest("hex") !== attachment.sha256)) {
       throw new Error("Initialization input content does not match its preparation receipt");
     }
     writeFileSync15(targetPath, body);
     const attachmentId = readString(attachment.id);
-    const actualSha256 = createHash20("sha256").update(body).digest("hex");
+    const actualSha256 = createHash21("sha256").update(body).digest("hex");
     const lineageCandidates = lineageCandidatesByAttachmentId.get(attachmentId) ?? [];
     const lineage = selectAttachmentLineage(lineageCandidates, actualSha256);
     if (lineageCandidates.length > 0 && !lineage) {
@@ -40076,7 +40206,7 @@ async function materializeRequiredArtifactInputs(config, command, workspace) {
       throw new Error(`artifact_input_manifest_invalid: entry ${index} contentPath does not match attachmentId`);
     }
     const body = await runtimeApiBuffer(runtimeAuth, contentPath);
-    const actualSha256 = createHash20("sha256").update(body).digest("hex");
+    const actualSha256 = createHash21("sha256").update(body).digest("hex");
     if (body.byteLength !== byteSize || actualSha256 !== sha2563) {
       throw new Error(
         `artifact_input_integrity_mismatch: workProductId=${workProductId} expectedBytes=${byteSize} actualBytes=${body.byteLength} expectedSha256=${sha2563} actualSha256=${actualSha256}`
@@ -40155,7 +40285,7 @@ async function materializeMentionedArtifactFiles(config, command, workspace) {
       });
       continue;
     }
-    const actualSha256 = createHash20("sha256").update(body).digest("hex");
+    const actualSha256 = createHash21("sha256").update(body).digest("hex");
     const expectedSha256 = readString(entry.sha256)?.toLowerCase() ?? null;
     const expectedByteSize = readNumber(entry.byteSize, null);
     if (expectedByteSize !== null && body.byteLength !== expectedByteSize || expectedSha256 && actualSha256 !== expectedSha256) {
@@ -40223,7 +40353,7 @@ function safeCheckpointRelativePath(rawPath) {
   return normalized;
 }
 function hashFileSha256(filePath) {
-  return createHash20("sha256").update(readFileSync21(filePath)).digest("hex");
+  return createHash21("sha256").update(readFileSync21(filePath)).digest("hex");
 }
 function expectedContinuationCheckpoint(command) {
   const payload = asRecord(command.payload);
@@ -40711,6 +40841,7 @@ async function executeRunCommand(config, command) {
   let invocation = null;
   let executorEnv = buildExecutorEnv(config, command, workspace);
   let browserSessionUserDataDir = null;
+  let releaseBrowserProfileLock = null;
   let managedMcpProfile = null;
   let managedMcpCleanup = null;
   let cleanupManagedMcpProfile = null;
@@ -40756,7 +40887,11 @@ async function executeRunCommand(config, command) {
   };
   try {
     await runExecutionStage("browser_session", async () => {
-      if (Object.keys(browserSession).length > 0) {
+      if (browserSession.version === 2 && (executor.kind !== "pi" || config.runnerKind !== RUNNER_KIND_CLOUD_MANAGED || Object.keys(governedMcp).length === 0)) throw new Error("browser_session_governed_pi_required");
+      if (executor.kind === "pi" && config.runnerKind === RUNNER_KIND_CLOUD_MANAGED && browserSession.version === 2) {
+        releaseBrowserProfileLock = await acquireCompanyBrowserProfileLock(executorEnv.PAPERCLIP_COMPANY_ID);
+      }
+      if (Object.keys(browserSession).length > 0 && browserSession.version !== 2) {
         if (executor.kind !== "pi" || Object.keys(governedMcp).length === 0) {
           throw new Error("browser_session_governed_pi_required");
         }
@@ -40765,6 +40900,15 @@ async function executeRunCommand(config, command) {
         }
         const ownedProfile = ensureBrowserSessionProfile(config, browserSession);
         browserSessionUserDataDir = ownedProfile.userDataDir;
+      } else if (browserSession.version === 2) {
+        if (browserSession.companyId !== executorEnv.PAPERCLIP_COMPANY_ID) {
+          throw new Error("browser_session_company_mismatch");
+        }
+        const companyProfile = { version: 2, companyId: executorEnv.PAPERCLIP_COMPANY_ID, origin: browserSession.origin };
+        if (browserSession.resetProfile === true) {
+          cleanupBrowserSessionProfile(config, companyProfile);
+        }
+        browserSessionUserDataDir = ensureBrowserSessionProfile(config, companyProfile).userDataDir;
       }
       invocation = buildExecutorInvocation(executor, executionCommand, workspace);
       if (taskSessionCheckpointUnavailable) {
@@ -41232,7 +41376,10 @@ async function executeRunCommand(config, command) {
         signal: abortController.signal,
         executorKind: executor.kind,
         ...piExecutorIdentity ? { spawnIdentity: piExecutorIdentity } : {},
-        ...browserCredentialConsumer ? { browserCredentialConsumer } : {},
+        ...browserCredentialConsumer ? {
+          browserCredentialConsumer,
+          browserCredentialRefs: asRecord(command.payload).browserCredentialRefs
+        } : {},
         onOutput: (stream, chunk, rawBytes) => {
           if (!firstOutput) {
             firstOutput = true;
@@ -41824,6 +41971,7 @@ async function executeRunCommand(config, command) {
     }
     return { resultDelivered: Boolean(completion) };
   } finally {
+    releaseBrowserProfileLock?.();
     await preparationLogChain;
     if (piRuntimeSystemPromptCleanupPath) {
       rmSync12(piRuntimeSystemPromptCleanupPath, { force: true });
@@ -41852,15 +42000,23 @@ async function processCommand(config, command) {
     }
     if (command.commandType === "browser_session_revoke" && Object.keys(commandBrowserSession(command)).length > 0) {
       await ackCommand(config, command, "spawned");
-      const cleanup = cleanupBrowserSessionProfile(
-        config,
-        commandBrowserSession(command)
-      );
+      const session = commandBrowserSession(command);
+      if (session.version === 2 && session.companyId !== asRecord(command.payload).companyId) {
+        throw new Error("browser_session_company_mismatch");
+      }
+      const release = session.version === 2 ? await acquireCompanyBrowserProfileLock(session.companyId) : null;
+      let cleanup;
+      try {
+        cleanup = cleanupBrowserSessionProfile(config, session);
+      } finally {
+        release?.();
+      }
       await completeCommand(config, command, "succeeded", {
         browserSessionCleanup: {
-          version: 1,
+          version: cleanup.identity.version,
           companyId: cleanup.identity.companyId,
-          bindingId: cleanup.identity.bindingId,
+          ...cleanup.identity.origin ? { origin: cleanup.identity.origin } : {},
+          ...cleanup.identity.bindingId ? { bindingId: cleanup.identity.bindingId } : {},
           outcome: cleanup.outcome
         }
       });

package/dist/amaster-runtime.mjs

@@ -7,7 +7,7 @@ import { homedir, hostname } from "node:os";
 import { fileURLToPath } from "node:url";
 import { BUILD_SUPPORTED_CAPABILITIES } from "./amaster-runtime-daemon/capability-registry.mjs";
 
-const CONNECTOR_VERSION = "0.1.14";
+const CONNECTOR_VERSION = "0.1.16";
 
 const CONFIG_KEY_MAP = new Map([
   ["server_url", "AMASTER_EMPLOYEE_SERVER_URL"],

package/dist/templates/.mirrorx-preset-templates.json

@@ -3,8 +3,8 @@
   "files": [
     {
       "name": "CEO经营简报模板.md",
-      "bytes": 8066,
-      "sha256": "07aa5e73e5e5c2dfe2bf5eee9633b5f0a8a8333e0899f0c73cb37cc59dbca3a4"
+      "bytes": 8866,
+      "sha256": "2bc380b76941530cf70f4320aa6f770037608752283ef0784718711172c818b3"
     },
     {
       "name": "产品缺陷清单模板.md",

package/dist/templates/CEO/347/273/217/350/220/245/347/256/200/346/212/245/346/250/241/346/235/277.md

@@ -4,6 +4,7 @@
   <purpose>这是供 CEO 判断方向、取舍与资源配置的经营简报，不是数据汇总。先回答公司是否仍在向已确认战略目标前进、哪些经营结果真正改变了局面、哪些偏差需要管理决策，再用必要数据支撑判断。</purpose>
   <strategy_baseline>以当前 active primary Goal 及其绑定的已确认公司战略文档为唯一战略基线；从中提取战略主题、目标、指标、重大举措、里程碑、关键假设和风险护栏。不用原始战略规划模板代替公司已确认战略。找不到可验证基线时，明确标记“战略基线缺失”及补齐责任人，不自行构造目标。</strategy_baseline>
   <period_focus>日报聚焦当日战略异常、关键结果、阻塞和次日动作；周报增加目标计分卡、周环比、重大举措与资源偏差；月报完整检查目标达成、战略假设、业务组合、预算资源和风险阈值，并判断是否需要启动战略修订。各类简报均保留任务要求的业务主题；无变化时注明核实范围与当前状态，缺数据时列出缺口及影响，不能以压缩篇幅为由省略关键风险、经营判断或必要图表。</period_focus>
+  <time_cutoff>报告周期与数据截止时间分别填写，并统一用报告时区比较期限。提前生成的周报或月报只报告截至数据截止时间已发生、已核实的事实；周期尚未结束时写“截至 YYYY-MM-DD HH:mm”或“本期至今”，不能写“全周”“全月”“周末”“月末”来暗示已覆盖完整周期。逐项核对任务或决策的截止日期与数据截止时间：未来期限写“尚未到期”，只有期限确已过去且事项仍未完成时才能写“逾期”或“已到期未决”；缺少期限时不推断逾期。若只有日期而没有具体时刻，以报告时区该日结束作为期限。提交文档前复查摘要、表格、图表说明和风险措辞，修正与截止时间冲突的表述。</time_cutoff>
   <judgement>每个重要结论使用“事实与来源 → 对战略目标的影响 → CEO 判断或动作”。任务完成、运行成功、报告或系统上线只是内部产出，除非有可验证经营变化和验收证据，不得写成业务结果。对无法映射到当前战略目标或重大举措的持续工作，显式标记为战略外资源占用并给出停止、降级或保留的建议。</judgement>
   <metrics>只保留会改变管理判断的战略衡量与经营信号。可量化的衡量项写明定义和口径、基线、目标或阈值、当前值、趋势、截止时间和来源；客户、市场、竞品或风险信号写明事实、时间和对管理判断的影响。缺失值写明影响、补齐动作、责任人和审定节点，不得以 0 或估算值代替。图表只使用可追溯真实数字；有适合比较的数据时必须制图，并说明结论、单位、期间与来源。数据不足时以证据或缺口表替代，不虚构图表。</metrics>
   <visual_delivery>首页依次展示总体判断、重点变化和待决策事项，使用清楚的标题和选择性加粗帮助人快速定位。保留战略衡量与经营信号表；多项指标、资源投入和行动使用表格对照，战略取舍与根因用段落解释。状态与风险标记须有已确认目标、阈值或期限作为依据，并附文字说明，不把所有经营判断归为红黄绿。图表能更清楚地揭示关键趋势、差异或结构时采用：时间趋势使用 Mermaid xychart-beta，类别比较使用柱状图，互斥且覆盖同一总体的非负占比才使用 pie；只有单点或不可比数字时用文字或证据表说明。每幅图紧邻一句经营解读，数字与明细一致；增长不一定有利，按指标业务含义解释变化。避免重复展示同一结论。报告无需限定篇幅，完整判断、可读性和证据优先。</visual_delivery>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amaster.ai/employee-runtime-connector",
-  "version": "0.1.14",
+  "version": "0.1.16",
   "description": "MirrorX runtime connector CLI and daemon",
   "license": "MIT",
   "type": "module",