@noopolis/daimon 0.1.1 → 0.2.0

package/dist/runtime/portableCredentialAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"portableCredentialAuth.d.ts","sourceRoot":"","sources":["../../src/runtime/portableCredentialAuth.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,MAAM,CAAC;AAEtD,2EAA2E;AAC3E,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,sBAAsB,EAC9B,KAAK,EAAE,UAAU,GAChB,OAAO,CAYT;AAED,qFAAqF;AACrF,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,sBAAsB,EAC9B,KAAK,EAAE,UAAU,GAChB,SAAS,MAAM,EAAE,CASnB"}

package/dist/runtime/portableCredentialAuth.js

@@ -0,0 +1,70 @@
+/** Validates only the bounded provider-native shape needed for refresh. */
+export function hasRefreshablePortableCredential(engine, bytes) {
+    let value;
+    try {
+        value = JSON.parse(Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength).toString("utf8"));
+    }
+    catch {
+        return false;
+    }
+    const pair = engine === "grok" ? grokTokenPair(value) : tokenPair(value);
+    if (pair.access === undefined || pair.refresh === undefined)
+        return false;
+    if (engine !== "grok")
+        return true;
+    const candidate = firstString(grokTokenEntry(value), ["expires_at"]);
+    return candidate !== undefined && Number.isFinite(Date.parse(candidate));
+}
+/** Returns only the provider-native bearer values for exact in-process redaction. */
+export function portableCredentialSecretValues(engine, bytes) {
+    let value;
+    try {
+        value = JSON.parse(Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength).toString("utf8"));
+    }
+    catch {
+        return [];
+    }
+    const pair = engine === "grok" ? grokTokenPair(value) : tokenPair(value);
+    return [...new Set([pair.access, pair.refresh].filter((entry) => entry !== undefined))];
+}
+function tokenPair(value) {
+    const source = object(value);
+    const nested = object(source?.tokens) ?? source;
+    return {
+        access: firstNonBlankString(nested, ["access_token", "accessToken", "token"]),
+        refresh: firstNonBlankString(nested, ["refresh_token", "refreshToken"])
+    };
+}
+function grokTokenEntry(value) {
+    const source = object(value);
+    if (source === undefined)
+        return undefined;
+    for (const [key, entry] of Object.entries(source)) {
+        if (/^https:\/\/auth\.x\.ai::/u.test(key))
+            return object(entry);
+    }
+    return undefined;
+}
+function grokTokenPair(value) {
+    const entry = grokTokenEntry(value);
+    return {
+        access: firstNonBlankString(entry, ["key"]),
+        refresh: firstNonBlankString(entry, ["refresh_token"])
+    };
+}
+function object(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+function firstString(value, names) {
+    for (const name of names) {
+        if (typeof value?.[name] === "string" && value[name].length > 0)
+            return value[name];
+    }
+    return undefined;
+}
+function firstNonBlankString(value, names) {
+    const candidate = firstString(value, names);
+    return candidate !== undefined && candidate.trim().length > 0 ? candidate : undefined;
+}

package/dist/runtime/portableCredentialMaterial.d.ts

@@ -0,0 +1,8 @@
+import type { OrganizationRuntimeAgentConfig } from "./organizationRuntime.js";
+/**
+ * Seeds a runtime-writable CLI credential from Daimon's read-only ingress.
+ * A newer runtime copy wins so a CLI refresh survives process/container
+ * restarts; a later operator refresh of the ingress is imported on restart.
+ */
+export declare function materializePortableCredential(configuredAgent: OrganizationRuntimeAgentConfig, runtimeHomePath: string): Promise<"created" | "preserved" | "refreshed">;
+//# sourceMappingURL=portableCredentialMaterial.d.ts.map

package/dist/runtime/portableCredentialMaterial.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"portableCredentialMaterial.d.ts","sourceRoot":"","sources":["../../src/runtime/portableCredentialMaterial.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAc/E;;;;GAIG;AACH,wBAAsB,6BAA6B,CACjD,eAAe,EAAE,8BAA8B,EAC/C,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,SAAS,GAAG,WAAW,GAAG,WAAW,CAAC,CAsChD"}

package/dist/runtime/portableCredentialMaterial.js

@@ -0,0 +1,169 @@
+import { constants } from "node:fs";
+import { chmod, lstat, mkdir, open, rename, unlink } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import path from "node:path";
+import { ENGINE_CREDENTIAL_MATERIAL } from "./contractManifest.js";
+const MAX_CREDENTIAL_BYTES = 64 * 1024;
+/**
+ * Seeds a runtime-writable CLI credential from Daimon's read-only ingress.
+ * A newer runtime copy wins so a CLI refresh survives process/container
+ * restarts; a later operator refresh of the ingress is imported on restart.
+ */
+export async function materializePortableCredential(configuredAgent, runtimeHomePath) {
+    if (configuredAgent.engine.kind !== "codex") {
+        throw new Error(`agent ${configuredAgent.id} ${configuredAgent.engine.kind} has no portable credential material`);
+    }
+    const agent = configuredAgent;
+    const rule = ENGINE_CREDENTIAL_MATERIAL[agent.engine.kind];
+    const sourcePath = contained(runtimeHomePath, rule.sourceRelativePath);
+    const destinationPath = contained(runtimeHomePath, rule.destinationRelativePath);
+    const destinationDirectory = path.dirname(destinationPath);
+    await assertPrivateDirectory(path.dirname(sourcePath), rule.directoryMode, agent, false);
+    const source = await readCredential(sourcePath, rule.fileMode, agent);
+    await prepareDestinationDirectory(destinationDirectory, rule.directoryMode, agent);
+    const existing = await existingCredential(destinationPath, rule.fileMode, agent);
+    if (existing !== undefined && existing.mtimeMs >= source.identity.mtimeMs)
+        return "preserved";
+    const temporaryPath = path.join(destinationDirectory, `.${path.basename(destinationPath)}.${randomUUID()}.tmp`);
+    let temporary;
+    try {
+        temporary = await open(temporaryPath, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | noFollow(), rule.fileMode);
+        await temporary.writeFile(source.bytes);
+        await temporary.chmod(rule.fileMode);
+        await temporary.sync();
+        await temporary.close();
+        temporary = undefined;
+        await rename(temporaryPath, destinationPath);
+        await assertCredential(destinationPath, rule.fileMode, agent);
+        return existing === undefined ? "created" : "refreshed";
+    }
+    catch (error) {
+        throw unavailable(agent, error);
+    }
+    finally {
+        await temporary?.close().catch(() => undefined);
+        await unlink(temporaryPath).catch(() => undefined);
+    }
+}
+async function readCredential(filePath, mode, agent) {
+    let handle;
+    try {
+        // Opening a read-only bind can refresh its metadata. Validate the actual
+        // descriptor before consulting the refreshed path or reading any bytes.
+        // Nonblocking open lets us reject a FIFO by type instead of hanging here.
+        handle = await open(filePath, constants.O_RDONLY | noFollow() | constants.O_NONBLOCK);
+        const before = assertCredentialEntry(await handle.stat(), mode, agent);
+        if (!sameIdentity(before, await assertCredential(filePath, mode, agent)))
+            throw new Error("credential changed during import");
+        // One extra byte detects growth without allowing a changing file to drive
+        // an unbounded read/allocation. Partial reads advance within this buffer.
+        const buffer = Buffer.alloc(before.size + 1);
+        let length = 0;
+        while (length < buffer.length) {
+            const result = await handle.read(buffer, length, buffer.length - length, length);
+            if (result.bytesRead === 0)
+                break;
+            length += result.bytesRead;
+        }
+        const bytes = buffer.subarray(0, length);
+        const after = assertCredentialEntry(await handle.stat(), mode, agent);
+        const afterPath = await assertCredential(filePath, mode, agent);
+        if (!sameIdentity(before, after) || !sameIdentity(before, afterPath) || bytes.length !== before.size) {
+            throw new Error("credential changed during import");
+        }
+        return { bytes, identity: before };
+    }
+    catch (error) {
+        throw unavailable(agent, error);
+    }
+    finally {
+        await handle?.close().catch(() => undefined);
+    }
+}
+async function prepareDestinationDirectory(directoryPath, mode, agent) {
+    try {
+        await mkdir(directoryPath, { mode });
+    }
+    catch (error) {
+        if (error.code !== "EEXIST")
+            throw unavailable(agent, error);
+    }
+    await assertPrivateDirectory(directoryPath, mode, agent, true);
+}
+async function assertPrivateDirectory(directoryPath, mode, agent, repairMode) {
+    try {
+        const entry = await lstat(directoryPath);
+        if (!entry.isDirectory() || entry.isSymbolicLink() || entry.uid !== process.getuid?.()) {
+            throw new Error("unsafe credential directory");
+        }
+        if (repairMode && (entry.mode & 0o777) !== mode)
+            await chmod(directoryPath, mode);
+        const secured = await lstat(directoryPath);
+        if (!secured.isDirectory() || secured.isSymbolicLink() || secured.uid !== process.getuid?.()
+            || (secured.mode & 0o777) !== mode)
+            throw new Error("unsafe credential directory");
+    }
+    catch (error) {
+        throw unavailable(agent, error);
+    }
+}
+async function existingCredential(filePath, mode, agent) {
+    try {
+        return await assertCredential(filePath, mode, agent);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw error;
+    }
+}
+async function assertCredential(filePath, mode, agent) {
+    let entry;
+    try {
+        entry = await lstat(filePath);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            throw error;
+        throw unavailable(agent, error);
+    }
+    return assertCredentialEntry(entry, mode, agent);
+}
+function assertCredentialEntry(entry, mode, agent) {
+    if (!entry.isFile() || entry.isSymbolicLink() || entry.uid !== process.getuid?.()
+        || entry.nlink !== 1 || (entry.mode & 0o777) !== mode
+        || entry.size === 0 || entry.size > MAX_CREDENTIAL_BYTES) {
+        throw unavailable(agent, new Error("unsafe credential artifact"));
+    }
+    return identity(entry);
+}
+function contained(root, relative) {
+    const candidate = path.resolve(root, relative);
+    const relation = path.relative(path.resolve(root), candidate);
+    if (!relation || relation === ".." || relation.startsWith(`..${path.sep}`) || path.isAbsolute(relation)) {
+        throw new Error("Daimon credential contract escapes the runtime home");
+    }
+    return candidate;
+}
+function identity(value) {
+    const numeric = value;
+    return {
+        dev: numeric.dev,
+        ino: numeric.ino,
+        mode: numeric.mode & 0o7777,
+        mtimeMs: numeric.mtimeMs,
+        size: numeric.size,
+        uid: numeric.uid,
+        nlink: numeric.nlink
+    };
+}
+function sameIdentity(left, right) {
+    return left.dev === right.dev && left.ino === right.ino && left.mode === right.mode
+        && left.mtimeMs === right.mtimeMs && left.size === right.size && left.uid === right.uid && left.nlink === right.nlink;
+}
+function noFollow() {
+    return constants.O_NOFOLLOW ?? 0;
+}
+function unavailable(agent, _cause) {
+    return new Error(`agent ${agent.id} ${agent.engine.kind} credential materialization failed`);
+}

package/dist/runtime/productionAgentTools.d.ts

@@ -0,0 +1,5 @@
+import type { ToolDefinition } from "@earendil-works/pi-coding-agent";
+import type { OrganizationRuntimeAgentConfig } from "./organizationRuntime.js";
+import type { PiWakeEnvironmentContextRef } from "../pi/piAgentWakeSupport.js";
+export declare function createProductionAgentTools(agent: OrganizationRuntimeAgentConfig, wakeContext?: PiWakeEnvironmentContextRef): Promise<ToolDefinition[]>;
+//# sourceMappingURL=productionAgentTools.d.ts.map

package/dist/runtime/productionAgentTools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"productionAgentTools.d.ts","sourceRoot":"","sources":["../../src/runtime/productionAgentTools.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAMtE,OAAO,KAAK,EAAE,8BAA8B,EAAgC,MAAM,0BAA0B,CAAC;AAM7G,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAe/E,wBAAsB,0BAA0B,CAAC,KAAK,EAAE,8BAA8B,EAAE,WAAW,GAAE,2BAAgC,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAUhK"}

package/dist/runtime/productionAgentTools.js

@@ -0,0 +1,328 @@
+import { spawn } from "node:child_process";
+import { createHash } from "node:crypto";
+import { constants } from "node:fs";
+import { lstat, open, readdir, rename, unlink } from "node:fs/promises";
+import path from "node:path";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
+import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { moltnetOperationResult, readMoltnetPages } from "./moltnetMachineRead.js";
+import { McpToolCallError, MCP_TOOL_RESULT_MAX_BYTES, renderMcpToolResult, replayMcpReceipt } from "./mcpToolResult.js";
+import { ensureRuntimeHomeDirectory } from "./runtimeHomeLayout.js";
+import { capToolResult, resolveExemptToolNames, resolveToolResultMaxBytes, TOOL_OUTPUT_DIRECTORY_NAME } from "./toolResultSpill.js";
+import { cliChildEnvironment } from "../pi/cliEnvironment.js";
+const MAX_RESULT = 65_536;
+const TIMEOUT = 10_000;
+/**
+ * Action and delivery identifiers are prefixed with a hyphen, never a colon.
+ *
+ * Moltnet's machine protocol rejects any identifier that parses as a scoped
+ * agent id, and `ParseScopedAgentID` treats *every* `left:right` string as one
+ * (`moltnet/pkg/protocol/identity.go`). A `daimon:<digest>` delivery id
+ * therefore failed `delivery_id must be a local id`, and the CLI answered
+ * `error: invalid request` for every send an agent ever attempted.
+ */
+const DAIMON_ACTION_ID_PREFIX = "daimon-";
+export async function createProductionAgentTools(agent, wakeContext = {}) {
+    await ensureRuntimeHomeDirectory(agent.runtimeHomePath, "tool-state");
+    // Resolved once, at agent start: a malformed bound is a configuration error
+    // that should refuse the agent, not a surprise thrown from the middle of a
+    // tool call the model is waiting on.
+    const cap = { maxBytes: resolveToolResultMaxBytes(), exempt: resolveExemptToolNames() };
+    const tools = [...await Promise.all((agent.mcp ?? []).map((server) => mcpTools(agent, server, wakeContext, cap)))].flat();
+    if (agent.moltnet !== undefined)
+        tools.push(moltnetTool(agent, wakeContext), moltnetReadTool(agent));
+    if (new Set(tools.map((tool) => tool.name)).size !== tools.length)
+        throw new Error("compiled cognition tool names collide");
+    return tools;
+}
+async function mcpTools(agent, server, wakeContext, cap) {
+    const { client, close } = await connect(agent, server);
+    const listed = await client.listTools(undefined, { timeout: TIMEOUT });
+    if (Buffer.byteLength(JSON.stringify(listed)) > MAX_RESULT) {
+        await close();
+        throw new Error(`MCP server ${server.name} tool list exceeds bound`);
+    }
+    const available = new Map(listed.tools.map((tool) => [tool.name, tool]));
+    const undeclared = [...available.keys()].filter((name) => !server.tools.includes(name));
+    if (undeclared.length > 0) {
+        await close();
+        throw new Error(`MCP server ${server.name} exposed undeclared tools`);
+    }
+    const missing = server.tools.filter((name) => !available.has(name));
+    if (missing.length > 0) {
+        await close();
+        throw new Error(`MCP server ${server.name} omitted declared tools`);
+    }
+    await close();
+    return server.tools.map((name) => {
+        const declared = available.get(name);
+        return {
+            name: mcpToolName(server.name, name),
+            label: `${server.name}: ${name}`,
+            description: declared.description ?? `Call declared MCP tool ${server.name}/${name}`,
+            parameters: declared.inputSchema,
+            async execute(_id, params) {
+                if (!wakeContext.current)
+                    throw new Error("MCP call requires an active wake");
+                const actionId = `${DAIMON_ACTION_ID_PREFIX}${createHash("sha256").update(JSON.stringify([wakeContext.current, agent.id, server.name, name, params])).digest("hex")}`;
+                const prior = await priorReceipt(agent, actionId);
+                if (prior !== undefined) {
+                    const replayed = replayMcpReceipt(server.name, name, prior);
+                    return { content: replayed.content, details: replayed.details };
+                }
+                const active = await connect(agent, server);
+                try {
+                    const result = await active.client.callTool({ name, arguments: params }, undefined, { timeout: TIMEOUT });
+                    const bytes = JSON.stringify(result);
+                    const envelope = { kind: "mcp", agent_id: agent.id, engine: agent.engine.kind, delivery_id: actionId, server: server.name, tool: name, digest: digest(bytes) };
+                    let rendered;
+                    try {
+                        // The SDK types this as a union with the pre-schema compatibility shape;
+                        // only the three fields `McpUpstreamResult` names are ever read.
+                        rendered = renderMcpToolResult({ server: server.name, tool: name, result: result, maxBytes: MCP_TOOL_RESULT_MAX_BYTES });
+                        // Every tool result stays in the transcript for every *subsequent*
+                        // model request of the wake, so one oversized answer is re-billed
+                        // once per remaining request. Above the bound the full payload goes
+                        // to disk and the model gets head+tail plus the path
+                        // (`toolResultSpill.ts`); at or below it, this returns `rendered`
+                        // itself and the passthrough contract is untouched.
+                        rendered = await capToolResult({
+                            toolName: mcpToolName(server.name, name),
+                            rendered,
+                            result: result,
+                            maxBytes: cap.maxBytes,
+                            exempt: cap.exempt,
+                            spillDirectory: path.join(agent.runtimeHomePath, TOOL_OUTPUT_DIRECTORY_NAME),
+                            spillId: actionId
+                        });
+                    }
+                    catch (error) {
+                        // The server's own reason is the receipt's payload as much as the
+                        // model's: a replayed failure has to fail for the same stated cause.
+                        if (error instanceof McpToolCallError)
+                            await receipt(agent, { ...envelope, is_error: true, error: error.reason });
+                        throw error;
+                    }
+                    await receipt(agent, { ...envelope, is_error: false, result: { content: rendered.content, details: rendered.details }, ...(rendered.truncated ? { truncated: true } : {}) });
+                    return { content: rendered.content, details: rendered.details };
+                }
+                finally {
+                    await active.close();
+                }
+            }
+        };
+    });
+}
+/**
+ * Reading a declared room is a native Moltnet machine operation. Without it an agent can
+ * only learn what a wake pushed at it, so any role that weighs several peers' messages
+ * has to be woken once per message instead of reading the room once.
+ *
+ * The whole payload goes in `details` as well as `content`, matching every other
+ * Daimon tool (`memoryTools.ts`, `worldTools.ts`). This tool was written by
+ * copying `moltnet_send`, whose useful payload genuinely *is* its details
+ * (`{"accepted":true}`) — but the MCP mount lowers `details` to
+ * `structuredContent` (`src/mcp/toolServer.ts`) and the engines render that in
+ * preference to `content`, so a read that put its messages only in `content`
+ * handed the model a bare `{"messages":5}` and dropped every message and the
+ * page cursor. It looked like a confused agent for a night; it was an empty tool.
+ */
+function moltnetReadTool(agent) {
+    return {
+        name: "moltnet_read", label: "Read a scoped Moltnet room or DM", description: "Read recent messages from one room or DM declared for this agent.",
+        parameters: { type: "object", additionalProperties: false, required: ["network", "target"], properties: { network: { type: "string" }, target: { type: "string" }, limit: { type: "integer", minimum: 1, maximum: 100 }, before: { type: "string" }, after: { type: "string" } } },
+        async execute(_id, params) {
+            const input = params;
+            const network = agent.moltnet.networks.find((entry) => entry.id === input.network);
+            if (network === undefined)
+                throw new Error("Moltnet action exceeds declared scope");
+            const [kind, target] = input.target.split(":", 2);
+            if ((kind === "room" && !network.rooms.includes(target ?? "")) || (kind === "dm" && !network.dms) || !target || !["room", "dm"].includes(kind ?? ""))
+                throw new Error("Moltnet target is not declared");
+            const read = await readMoltnetPages({
+                requested: input.limit ?? 20, maxBytes: MAX_RESULT,
+                ...(input.before === undefined ? {} : { before: input.before }),
+                ...(input.after === undefined ? {} : { after: input.after }),
+                fetch: (request) => moltnetReadPage(agent, input.network, kind, target, request)
+            });
+            const payload = {
+                target: read.target ?? { kind, id: target },
+                messages: read.messages,
+                message_count: read.messages.length,
+                page: {
+                    has_more: read.hasMore,
+                    ...(read.nextBefore === undefined ? {} : { next_before: read.nextBefore }),
+                    ...(read.nextAfter === undefined ? {} : { next_after: read.nextAfter })
+                },
+                ...(read.truncated === undefined ? {} : { truncated: read.truncated })
+            };
+            const bytes = JSON.stringify(payload);
+            if (Buffer.byteLength(bytes) > MAX_RESULT)
+                throw new Error("Moltnet read result exceeds bound");
+            return { content: [{ type: "text", text: bytes }], details: payload };
+        }
+    };
+}
+/** One `machine` read request, unwrapped onto the shape the pager consumes. */
+async function moltnetReadPage(agent, networkId, kind, target, request) {
+    const correlationId = `${DAIMON_ACTION_ID_PREFIX}${createHash("sha256").update(JSON.stringify([agent.id, networkId, kind, target, request.limit, request.before ?? "", request.after ?? ""])).digest("hex")}`;
+    const response = await machine(agent.moltnet.cliPath, agent.moltnet.configPath, networkId, {
+        version: "moltnet.machine.v1", correlation_id: correlationId, operation: "read",
+        read: { target: { kind, id: target }, limit: request.limit, ...(request.before === undefined ? {} : { before: request.before }), ...(request.after === undefined ? {} : { after: request.after }) }
+    });
+    const result = moltnetOperationResult(response, "read", "read");
+    if (result?.page?.messages === undefined)
+        throw new Error("Moltnet read was not accepted");
+    const info = result.page.page ?? {};
+    return {
+        ...(result.target === undefined ? {} : { target: result.target }),
+        messages: result.page.messages,
+        hasMore: info.has_more === true,
+        ...(typeof info.next_before === "string" ? { nextBefore: info.next_before } : {}),
+        ...(typeof info.next_after === "string" ? { nextAfter: info.next_after } : {})
+    };
+}
+function moltnetTool(agent, wakeContext) {
+    return {
+        name: "moltnet_send", label: "Send a scoped Moltnet message", description: "Send to one room or DM declared for this agent.",
+        parameters: { type: "object", additionalProperties: false, required: ["network", "target", "text"], properties: { network: { type: "string" }, target: { type: "string" }, text: { type: "string", minLength: 1, maxLength: 2048 } } },
+        async execute(_id, params) {
+            const input = params;
+            const network = agent.moltnet.networks.find((entry) => entry.id === input.network);
+            if (network === undefined || Buffer.byteLength(input.text) > 2_048)
+                throw new Error("Moltnet action exceeds declared scope");
+            const [kind, target] = input.target.split(":", 2);
+            if ((kind === "room" && !network.rooms.includes(target ?? "")) || (kind === "dm" && !network.dms) || !target || !["room", "dm"].includes(kind ?? ""))
+                throw new Error("Moltnet target is not declared");
+            if (!wakeContext.current)
+                throw new Error("Moltnet send requires an active wake");
+            const deliveryId = `${DAIMON_ACTION_ID_PREFIX}${createHash("sha256").update(JSON.stringify([wakeContext.current, agent.id, input.network, input.target, input.text])).digest("hex")}`;
+            const prior = await priorReceipt(agent, deliveryId);
+            if (prior !== undefined) {
+                wakeContext.spokeFor = wakeContext.current;
+                return { content: [{ type: "text", text: JSON.stringify(prior) }], details: prior };
+            }
+            const response = await machine(agent.moltnet.cliPath, agent.moltnet.configPath, input.network, { version: "moltnet.machine.v1", correlation_id: deliveryId, operation: "send_nudge", send_nudge: { delivery_id: deliveryId, target: { kind, id: target }, body: input.text } });
+            const result = moltnetOperationResult(response, "send_nudge", "send");
+            if (result?.accepted !== true || typeof result.message_id !== "string")
+                throw new Error("Moltnet send was not accepted");
+            await receipt(agent, { kind: "moltnet", agent_id: agent.id, engine: agent.engine.kind, delivery_id: deliveryId, network: input.network, target: input.target, message_id: result.message_id });
+            // An explicit send and the bridge's terminal-text fallback share one
+            // publication slot (moltnet AGENTS.md); recording that this wake spoke
+            // lets the wake-completion path blank the terminal text so it is not
+            // echoed as a second message.
+            wakeContext.spokeFor = wakeContext.current;
+            return { content: [{ type: "text", text: JSON.stringify({ accepted: true, message_id: result.message_id }) }], details: { accepted: true } };
+        }
+    };
+}
+async function connect(agent, server) {
+    const client = new Client({ name: "daimon-production", version: "0.2.0" });
+    const headers = server.authSecretEnv === undefined ? {} : { authorization: `Bearer ${requiredSecret(server.authSecretEnv)}` };
+    const transport = server.transport === "stdio"
+        ? new StdioClientTransport({ command: server.command, args: [...server.args], env: stringEnvironment({ ...server.env, ...cliChildEnvironment([], agent.runtimeHomePath, { executablePath: server.command }) }) })
+        : server.transport === "sse" ? new SSEClientTransport(new URL(server.url), { requestInit: { headers } })
+            : new StreamableHTTPClientTransport(new URL(server.url), { requestInit: { headers } });
+    await client.connect(transport);
+    return { client, close: () => client.close() };
+}
+function requiredSecret(name) { const value = process.env[name]; if (!value)
+    throw new Error(`required MCP secret ${name} is missing`); return value; }
+function receiptPath(agent, deliveryId) { return path.join(agent.runtimeHomePath, "tool-state", `${digest(deliveryId).slice(7)}.json`); }
+async function receipt(agent, value) { const deliveryId = String(value.delivery_id); const file = receiptPath(agent, deliveryId); const temporary = `${file}.${process.pid}.${Date.now()}.tmp`; const bytes = `${JSON.stringify({ ...value, at: new Date().toISOString() })}\n`; if (Buffer.byteLength(bytes) > MAX_RESULT)
+    throw new Error("tool receipt exceeds bound"); const handle = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600); try {
+    await handle.writeFile(bytes);
+    await handle.sync();
+}
+finally {
+    await handle.close();
+} try {
+    await rename(temporary, file);
+    await pruneReceipts(path.dirname(file));
+    const directory = await open(path.dirname(file), constants.O_RDONLY);
+    try {
+        await directory.sync();
+    }
+    finally {
+        await directory.close();
+    }
+}
+catch (error) {
+    await unlink(temporary).catch(() => undefined);
+    throw error;
+} }
+async function pruneReceipts(directory) { const candidates = await Promise.all((await readdir(directory)).filter((name) => /^[a-f0-9]{64}\.json$/u.test(name)).map(async (name) => ({ name, info: await lstat(path.join(directory, name)) }))); if (candidates.some(({ info }) => !info.isFile() || info.nlink !== 1))
+    throw new Error("tool receipt directory contains an unsafe entry"); for (const candidate of candidates.sort((left, right) => right.info.mtimeMs - left.info.mtimeMs || right.name.localeCompare(left.name)).slice(2048))
+    await unlink(path.join(directory, candidate.name)); }
+async function priorReceipt(agent, deliveryId) { const file = receiptPath(agent, deliveryId); let handle; try {
+    handle = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+}
+catch (error) {
+    if (error.code === "ENOENT")
+        return undefined;
+    throw error;
+} try {
+    const entry = await handle.stat();
+    if (!entry.isFile() || entry.size > MAX_RESULT)
+        throw new Error("tool receipt is unsafe or exceeds bound");
+    const value = JSON.parse(await handle.readFile("utf8"));
+    if (value.delivery_id !== deliveryId || value.agent_id !== agent.id || value.engine !== agent.engine.kind)
+        throw new Error("tool receipt identity mismatch");
+    return value;
+}
+finally {
+    await handle.close();
+} }
+/**
+ * One request/response exchange with `moltnet machine`.
+ *
+ * Stdin is held open until the response line arrives. `moltnet machine` treats
+ * end-of-input as cancellation of everything still in flight, so ending stdin
+ * with the request — as this did — raced the send and lost: the CLI answered
+ * `{"error":{"code":"canceled"}}` and no message was ever delivered. The
+ * operation is complete once its line is on stdout, so closing stdin there can
+ * no longer cancel it.
+ */
+async function machine(cli, config, network, request) {
+    return await new Promise((resolve, reject) => {
+        const child = spawn(cli, ["machine", "--config", config, "--network", network], { stdio: ["pipe", "pipe", "pipe"] });
+        let output = "", error = "", settled = false;
+        const settle = (action) => { if (settled)
+            return; settled = true; clearTimeout(timer); action(); };
+        const timer = setTimeout(() => { child.kill("SIGKILL"); settle(() => reject(new Error("Moltnet machine timed out"))); }, TIMEOUT);
+        child.stdin.on("error", () => undefined);
+        child.stdout.on("data", (chunk) => {
+            output += chunk;
+            if (Buffer.byteLength(output) > MAX_RESULT) {
+                child.kill("SIGKILL");
+                settle(() => reject(new Error("Moltnet machine response exceeds bound")));
+                return;
+            }
+            const newline = output.indexOf("\n");
+            if (newline < 0)
+                return;
+            const line = output.slice(0, newline).trim();
+            if (line.length === 0)
+                return;
+            child.stdin.end();
+            settle(() => { try {
+                resolve(JSON.parse(line));
+            }
+            catch (cause) {
+                reject(cause);
+            } });
+            child.kill("SIGTERM");
+        });
+        child.stderr.on("data", (chunk) => { error += chunk; });
+        child.once("error", (cause) => settle(() => reject(cause)));
+        child.once("exit", () => settle(() => reject(new Error(`Moltnet machine failed: ${(error.slice(0, 1024) || "no response").trim()}`))));
+        child.stdin.write(`${JSON.stringify(request)}\n`);
+    });
+}
+function digest(value) { return `sha256:${createHash("sha256").update(value).digest("hex")}`; }
+/** The mounted name of one declared MCP tool: the one place it is spelled. */
+function mcpToolName(server, tool) { return `mcp_${safe(server)}_${safe(tool)}`; }
+function safe(value) { return value.replace(/[^A-Za-z0-9_]/gu, "_").slice(0, 48); }
+function stringEnvironment(value) { return Object.fromEntries(Object.entries(value).filter((entry) => entry[1] !== undefined)); }

package/dist/runtime/runtimeHomeLayout.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Mode for every directory Daimon creates inside an agent's runtime home.
+ *
+ * A brokered Grok agent's runtime home is `0710`
+ * (`GROK_ENGINE_BROKER.worker.home.organizationRuntimeHome`) so its sandboxed
+ * worker can traverse into the setgid `tool-output/` spill directory. Traverse
+ * is all it may have: anything Daimon creates in that home — telemetry traces
+ * (prompts, replies, world trajectories), tool state, receipts, the engine's
+ * XDG directories and the private `.tmp` — stays `0700`, so a default
+ * `mkdir` (0755 under the usual umask) never turns a traversable home into a
+ * readable one.
+ */
+export declare const RUNTIME_HOME_SUBDIRECTORY_MODE = 448;
+/**
+ * The home itself, created if it is absent and otherwise left exactly as it is.
+ *
+ * Create-only is the whole contract here. A brokered Grok agent's home is
+ * deliberately `0710` and an organization's may be `0700`; which of the two is
+ * correct is `physicalReadiness.ts`'s judgement, made against the agent's
+ * declared engine, and a layout helper that "corrected" a traversable home to
+ * `0700` would break the worker's only route to its own spills.
+ */
+export declare const ensureRuntimeHome: (runtimeHomePath: string) => Promise<string>;
+/**
+ * One directory Daimon owns *below* a runtime home, private on every install.
+ *
+ * `mkdir(..., { mode })` decides nothing for a directory that already exists,
+ * and that is the common case rather than the exotic one: a `telemetry/` left
+ * at `0755` by a pre-branch Daimon, or pre-created by a deployment, stayed
+ * `0755` forever. Under a Grok agent's traversable `0710` home that is the
+ * worker reading its own agent's prompts, replies and causal history — the
+ * home is traverse-only precisely so that nothing but `tool-output/` is
+ * readable. `assertRuntimeDirectory` checks the home, and nothing checked what
+ * Daimon created inside it.
+ *
+ * So every level below the home is asserted and corrected on the way down,
+ * through a handle rather than a path: `O_DIRECTORY|O_NOFOLLOW` refuses a
+ * symlink planted where a directory belongs, and the `fchmod` that follows
+ * lands on the directory that was stat'd. A directory owned by anyone but the
+ * runtime user is **refused**, never widened and never silently accepted — the
+ * runtime cannot make someone else's directory private, and proceeding would
+ * write an agent's telemetry into it anyway.
+ *
+ * `owner` is a seam so both refusals are testable unprivileged, exactly as
+ * `physicalReadiness.ts`'s `RuntimeIdentity` is.
+ */
+export declare function ensureRuntimeHomeDirectory(runtimeHomePath: string, relative: string, owner?: number): Promise<string>;
+//# sourceMappingURL=runtimeHomeLayout.d.ts.map

package/dist/runtime/runtimeHomeLayout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimeHomeLayout.d.ts","sourceRoot":"","sources":["../../src/runtime/runtimeHomeLayout.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,8BAA8B,MAAQ,CAAC;AAEpD;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,GAAU,iBAAiB,MAAM,KAAG,OAAO,CAAC,MAAM,CAG/E,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,0BAA0B,CAAC,eAAe,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,GAAE,MAAiC,GAAG,OAAO,CAAC,MAAM,CAAC,CAcrJ"}