@noopolis/daimon 0.2.1 → 0.2.3

package/dist/runtime/grokWorkerSkills.js

@@ -0,0 +1,135 @@
+import { createHash } from "node:crypto";
+import { canonicalJson } from "../contracts/canonicalJson.js";
+/**
+ * Where root provisioning renders the agent's declared skills inside the worker
+ * home (`$GROK_HOME/skills`), and what every entry must be: root-owned, no
+ * write bit. Grok discovers that directory as user-scoped skills even in an
+ * untrusted workspace. Absent when the registration declares no `skillsSha256`.
+ *
+ * Deliberately *not* folded into `RUNTIME_CONTRACT_MANIFEST`, as with
+ * `TURN_USAGE_LEDGER`: the manifest's canonical bytes are digest-pinned by
+ * Spawnfile and attested against the selected runtime image, so a new key
+ * there makes every pinned image fail to attest. Only Daimon reads this layout
+ * (the renderer below and the broker's pre-turn attestation); Spawnfile
+ * consumes it through `renderGrokWorkerSkillsTree`.
+ */
+export const GROK_WORKER_SKILLS_LAYOUT = Object.freeze({
+    relativePath: "skills", uid: 0, gid: 0, directoryMode: 0o555, fileMode: 0o444, digestVersion: "noopolis.daimon.grok-worker-skills.v1"
+});
+const LAYOUT = GROK_WORKER_SKILLS_LAYOUT;
+/**
+ * The engine-neutral skills input. It is the compiled workspace tree every
+ * engine is given — Spawnfile lowers declared skills (and Moltnet installs its
+ * own) into `<workspace>/.agents/skills/<name>/SKILL.md`, which Codex reads in
+ * place. A brokered Grok worker cannot read it there: its workspace stays
+ * untrusted, so root provisioning renders the same skills into
+ * `$GROK_HOME/skills` instead.
+ */
+export const AGENT_SKILLS_WORKSPACE_DIRECTORY = ".agents/skills";
+export const GROK_WORKER_SKILLS_VERSION = LAYOUT.digestVersion;
+export const AGENT_SKILLS_BOUNDS = Object.freeze({ skills: 64, filesPerSkill: 64, fileBytes: 262_144, totalBytes: 4_194_304, depth: 8 });
+const COMPONENT = /^[A-Za-z0-9_][A-Za-z0-9._-]{0,127}$/u;
+const invalid = (detail) => new TypeError(`invalid agent skills: ${detail}`);
+const plain = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+const exact = (value, keys) => Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+const byteLength = (content) => Buffer.byteLength(content, "utf8");
+/**
+ * Strict, canonicalizing parser: names and path components are plain
+ * identifiers (no `.`/`..`, no hidden entries, no separators other than `/`),
+ * every skill carries `SKILL.md`, nothing collides, and the sizes are bounded.
+ * Output is sorted by name and path so equal sets digest equally.
+ */
+export function parseAgentSkills(value) {
+    if (!Array.isArray(value) || value.length > AGENT_SKILLS_BOUNDS.skills)
+        throw invalid("expected a bounded array");
+    let total = 0;
+    const names = new Set();
+    const skills = value.map((entry) => {
+        if (!plain(entry) || !exact(entry, ["name", "files"]) || typeof entry.name !== "string" || !COMPONENT.test(entry.name))
+            throw invalid(`skill name ${plain(entry) && typeof entry.name === "string" ? JSON.stringify(entry.name) : "(missing)"}`);
+        if (names.has(entry.name))
+            throw invalid(`duplicate skill ${entry.name}`);
+        names.add(entry.name);
+        if (!Array.isArray(entry.files) || entry.files.length === 0 || entry.files.length > AGENT_SKILLS_BOUNDS.filesPerSkill)
+            throw invalid(`files of ${entry.name}`);
+        const paths = new Set();
+        const files = entry.files.map((file) => {
+            if (!plain(file) || !exact(file, ["path", "content"]) || typeof file.path !== "string" || typeof file.content !== "string")
+                throw invalid(`file ${plain(file) && typeof file.path === "string" ? JSON.stringify(`${entry.name}/${file.path}`) : `of ${entry.name}`}`);
+            const parts = file.path.split("/");
+            if (parts.length > AGENT_SKILLS_BOUNDS.depth || parts.some((part) => !COMPONENT.test(part)))
+                throw invalid(`path ${JSON.stringify(`${entry.name}/${file.path}`)}`);
+            const bytes = byteLength(file.content);
+            if (bytes > AGENT_SKILLS_BOUNDS.fileBytes)
+                throw invalid(`size of ${entry.name}/${file.path}`);
+            total += bytes;
+            if (paths.has(file.path))
+                throw invalid(`duplicate path ${entry.name}/${file.path}`);
+            paths.add(file.path);
+            try {
+                canonicalJson(file.content);
+            }
+            catch {
+                throw invalid(`content of ${entry.name}/${file.path} is not Unicode text`);
+            }
+            return Object.freeze({ path: file.path, content: file.content });
+        });
+        // A file may not also be the directory of another file.
+        for (const candidate of paths)
+            if ([...paths].some((other) => other.startsWith(`${candidate}/`)))
+                throw invalid(`path collision ${entry.name}/${candidate}`);
+        if (!paths.has("SKILL.md"))
+            throw invalid(`${entry.name} has no SKILL.md`);
+        return Object.freeze({ name: entry.name, files: Object.freeze(files.sort((a, b) => compare(a.path, b.path))) });
+    });
+    if (total > AGENT_SKILLS_BOUNDS.totalBytes)
+        throw invalid("total size");
+    return Object.freeze(skills.sort((a, b) => compare(a.name, b.name)));
+}
+const compare = (left, right) => left < right ? -1 : left > right ? 1 : 0;
+/**
+ * sha256 over the canonical description of the rendered tree: every skill's
+ * name and, per file, its path, byte length and content digest. The broker
+ * attests `$GROK_HOME/skills` against it before every turn, and the Grok broker
+ * projection carries it, so the slot preflight receipt and every recomputed
+ * projection bind the exact skills a subject was given.
+ */
+export function grokWorkerSkillsSha256(skills) {
+    const parsed = parseAgentSkills(skills);
+    const description = { version: GROK_WORKER_SKILLS_VERSION, skills: parsed.map((skill) => ({
+            name: skill.name,
+            files: skill.files.map((file) => ({ path: file.path, bytes: byteLength(file.content), sha256: createHash("sha256").update(file.content, "utf8").digest("hex") }))
+        })) };
+    return createHash("sha256").update(canonicalJson(description)).digest("hex");
+}
+/**
+ * Every directory and file root provisioning writes for these skills, parents
+ * before children: `skills/` itself, each `skills/<name>/`, any intermediate
+ * directory, and each file. Directories are `root:root 0555` and files
+ * `root:root 0444` (single link), so a worker-uid process can read them but
+ * neither change nor replace them; `$GROK_HOME` is root-owned and sticky, so the
+ * worker cannot rename `skills/` away either. No skills renders nothing: the
+ * directory must then be absent, exactly as before this layout existed.
+ */
+export function renderGrokWorkerSkillsTree(skills) {
+    const parsed = parseAgentSkills(skills);
+    if (parsed.length === 0)
+        return Object.freeze([]);
+    const directory = (relative) => Object.freeze({ path: relative, kind: "directory", uid: LAYOUT.uid, gid: LAYOUT.gid, mode: LAYOUT.directoryMode });
+    const entries = [directory(LAYOUT.relativePath)];
+    const seen = new Set([LAYOUT.relativePath]);
+    for (const skill of parsed) {
+        for (const file of skill.files) {
+            const parts = [LAYOUT.relativePath, skill.name, ...file.path.split("/")];
+            for (let depth = 2; depth < parts.length; depth += 1) {
+                const relative = parts.slice(0, depth).join("/");
+                if (!seen.has(relative)) {
+                    seen.add(relative);
+                    entries.push(directory(relative));
+                }
+            }
+            entries.push(Object.freeze({ path: parts.join("/"), kind: "file", uid: LAYOUT.uid, gid: LAYOUT.gid, mode: LAYOUT.fileMode, content: file.content }));
+        }
+    }
+    return Object.freeze(entries);
+}

package/dist/runtime/index.d.ts

@@ -18,6 +18,9 @@ export { GROK_INFERENCE_AUTH_STALE_BODY } from "./grokInferenceProxy.js";
 export { assertGrokWorkerDenyPathPlacement, assertGrokWorkerDenyPathShape, assertGrokWorkerDenyPathsPlaceable, GROK_WORKER_BASE_PROFILE_GRANTS, grokWorkerCanSearch, grokWorkerDenyPathChain, GrokWorkerDenyPlacementError, readGrokWorkerDenyPathChain } from "./grokWorkerDenyPlacement.js";
 export type { GrokWorkerDenyPathEntry, GrokWorkerDenyPathStep, GrokWorkerDenyPathWorker } from "./grokWorkerDenyPlacement.js";
 export { grokWorkerSandboxProfileSha256, renderGrokWorkerSandboxProfile } from "./grokWorkerSandboxProfile.js";
+export { AGENT_SKILLS_BOUNDS, AGENT_SKILLS_WORKSPACE_DIRECTORY, GROK_WORKER_SKILLS_LAYOUT, GROK_WORKER_SKILLS_VERSION, grokWorkerSkillsSha256, parseAgentSkills, renderGrokWorkerSkillsTree, type AgentSkill, type AgentSkillFile, type GrokWorkerSkillsEntry } from "./grokWorkerSkills.js";
+export { readAgentSkillsDirectory, type AgentSkillsTreePolicy } from "./agentSkillsDirectory.js";
+export { GROK_WORKER_FOREIGN_SKILL_ROOTS, verifyGrokWorkerForeignSkillRoots, verifyGrokWorkerSkills } from "./grokWorkerHomeAttestation.js";
 export { ENGINE_BROKER_SERVICE_V3, engineBrokerRequestLedgerPathFor, engineBrokerSealLedgerPathFor, parseEngineBrokerServiceConfig, type EngineBrokerServiceConfig, type EngineBrokerServiceRegistration } from "./engineBrokerServiceConfig.js";
 export { TURN_SEAL_LEDGER, TURN_SEAL_LEDGER_VERSION } from "./engineBrokerSealLedger.js";
 export { DEFAULT_GROK_BROKER_TURN_LIMITS, ENGINE_BROKER_LIMIT_REASONS, type EngineBrokerLimitReason, type EngineBrokerTurnAccounting, type EngineBrokerTurnLimits, type EngineBrokerTurnUsage } from "./engineBrokerTurnAccounting.js";

package/dist/runtime/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,mCAAmC,EAAE,gCAAgC,EAAE,KAAK,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAClL,cAAc,0BAA0B,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,KAAK,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAC/F,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpE,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,oCAAoC,EAAE,MAAM,iCAAiC,CAAC;AACvF,OAAO,EAAE,gCAAgC,EAAE,yCAAyC,EAClF,KAAK,kCAAkC,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,8BAA8B,EAAE,0BAA0B,EAAE,gCAAgC,EAAE,uCAAuC,EAC5I,6CAA6C,EAAE,KAAK,gCAAgC,EAAE,KAAK,uCAAuC,EAAE,MAAM,2BAA2B,CAAC;AACxK,OAAO,EAAE,2BAA2B,EAAE,6BAA6B,EAAE,8BAA8B,EAAE,6BAA6B,EAAE,KAAK,0BAA0B,EACjK,8BAA8B,EAAE,KAAK,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACvG,OAAO,EAAE,4BAA4B,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AACzG,OAAO,EAAE,8BAA8B,EAAE,wBAAwB,EAAE,+BAA+B,EAAE,+BAA+B,EAAE,yCAAyC,EAAE,KAAK,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAC5P,OAAO,EAAE,6BAA6B,EAAE,qCAAqC,EAAE,KAAK,gCAAgC,EAAE,MAAM,oCAAoC,CAAC;AACjK,OAAO,EAAE,wBAAwB,EAAE,8BAA8B,EAAE,uBAAuB,EAAE,KAAK,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACzJ,OAAO,EAAE,8BAA8B,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,iCAAiC,EAAE,6BAA6B,EAAE,kCAAkC,EAAE,+BAA+B,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,4BAA4B,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC9R,YAAY,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAC9H,OAAO,EAAE,8BAA8B,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAC/G,OAAO,EAAE,wBAAwB,EAAE,gCAAgC,EAAE,6BAA6B,EAAE,8BAA8B,EAAE,KAAK,yBAAyB,EAAE,KAAK,+BAA+B,EAAE,MAAM,gCAAgC,CAAC;AACjP,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACzF,OAAO,EAAE,+BAA+B,EAAE,2BAA2B,EAAE,KAAK,uBAAuB,EAAE,KAAK,0BAA0B,EAClI,KAAK,sBAAsB,EAAE,KAAK,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACnG,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAC1E,OAAO,EACL,mCAAmC,EACnC,qCAAqC,EACrC,8BAA8B,EAC9B,yCAAyC,EACzC,2CAA2C,EAC3C,2CAA2C,EAC3C,8BAA8B,EAC9B,KAAK,4BAA4B,EACjC,KAAK,mDAAmD,EACxD,KAAK,sCAAsC,EAC3C,KAAK,2CAA2C,EAChD,KAAK,sCAAsC,EAC3C,KAAK,sCAAsC,EAC3C,KAAK,qCAAqC,EAC3C,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,uBAAuB,EACvB,8BAA8B,EAC9B,2BAA2B,EAC3B,0BAA0B,EAC1B,eAAe,EACf,0BAA0B,EAC1B,oBAAoB,EACpB,KAAK,iCAAiC,EACtC,KAAK,wCAAwC,EAC7C,KAAK,uCAAuC,EAC5C,KAAK,oCAAoC,EACzC,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACtB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,8BAA8B,EAAE,iCAAiC,EAAE,MAAM,iCAAiC,CAAC;AACzH,OAAO,EAAE,yBAAyB,EAAE,iCAAiC,EAAE,KAAK,0BAA0B,EAAE,KAAK,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAC7K,YAAY,EAAE,kCAAkC,EAAE,MAAM,8BAA8B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,mCAAmC,EAAE,gCAAgC,EAAE,KAAK,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAClL,cAAc,0BAA0B,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,KAAK,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAC/F,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpE,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,oCAAoC,EAAE,MAAM,iCAAiC,CAAC;AACvF,OAAO,EAAE,gCAAgC,EAAE,yCAAyC,EAClF,KAAK,kCAAkC,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,8BAA8B,EAAE,0BAA0B,EAAE,gCAAgC,EAAE,uCAAuC,EAC5I,6CAA6C,EAAE,KAAK,gCAAgC,EAAE,KAAK,uCAAuC,EAAE,MAAM,2BAA2B,CAAC;AACxK,OAAO,EAAE,2BAA2B,EAAE,6BAA6B,EAAE,8BAA8B,EAAE,6BAA6B,EAAE,KAAK,0BAA0B,EACjK,8BAA8B,EAAE,KAAK,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACvG,OAAO,EAAE,4BAA4B,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AACzG,OAAO,EAAE,8BAA8B,EAAE,wBAAwB,EAAE,+BAA+B,EAAE,+BAA+B,EAAE,yCAAyC,EAAE,KAAK,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAC5P,OAAO,EAAE,6BAA6B,EAAE,qCAAqC,EAAE,KAAK,gCAAgC,EAAE,MAAM,oCAAoC,CAAC;AACjK,OAAO,EAAE,wBAAwB,EAAE,8BAA8B,EAAE,uBAAuB,EAAE,KAAK,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACzJ,OAAO,EAAE,8BAA8B,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,iCAAiC,EAAE,6BAA6B,EAAE,kCAAkC,EAAE,+BAA+B,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,4BAA4B,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC9R,YAAY,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAC9H,OAAO,EAAE,8BAA8B,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAC/G,OAAO,EAAE,mBAAmB,EAAE,gCAAgC,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,KAAK,UAAU,EAAE,KAAK,cAAc,EAAE,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC7R,OAAO,EAAE,wBAAwB,EAAE,KAAK,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACjG,OAAO,EAAE,+BAA+B,EAAE,iCAAiC,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAC5I,OAAO,EAAE,wBAAwB,EAAE,gCAAgC,EAAE,6BAA6B,EAAE,8BAA8B,EAAE,KAAK,yBAAyB,EAAE,KAAK,+BAA+B,EAAE,MAAM,gCAAgC,CAAC;AACjP,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACzF,OAAO,EAAE,+BAA+B,EAAE,2BAA2B,EAAE,KAAK,uBAAuB,EAAE,KAAK,0BAA0B,EAClI,KAAK,sBAAsB,EAAE,KAAK,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACnG,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAC1E,OAAO,EACL,mCAAmC,EACnC,qCAAqC,EACrC,8BAA8B,EAC9B,yCAAyC,EACzC,2CAA2C,EAC3C,2CAA2C,EAC3C,8BAA8B,EAC9B,KAAK,4BAA4B,EACjC,KAAK,mDAAmD,EACxD,KAAK,sCAAsC,EAC3C,KAAK,2CAA2C,EAChD,KAAK,sCAAsC,EAC3C,KAAK,sCAAsC,EAC3C,KAAK,qCAAqC,EAC3C,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,uBAAuB,EACvB,8BAA8B,EAC9B,2BAA2B,EAC3B,0BAA0B,EAC1B,eAAe,EACf,0BAA0B,EAC1B,oBAAoB,EACpB,KAAK,iCAAiC,EACtC,KAAK,wCAAwC,EAC7C,KAAK,uCAAuC,EAC5C,KAAK,oCAAoC,EACzC,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACtB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,8BAA8B,EAAE,iCAAiC,EAAE,MAAM,iCAAiC,CAAC;AACzH,OAAO,EAAE,yBAAyB,EAAE,iCAAiC,EAAE,KAAK,0BAA0B,EAAE,KAAK,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAC7K,YAAY,EAAE,kCAAkC,EAAE,MAAM,8BAA8B,CAAC"}

package/dist/runtime/index.js

@@ -17,6 +17,9 @@ export { dedupeInferenceUsageRows, INFERENCE_USAGE_LEDGER_VERSION, GROK_INFERENC
 export { GROK_INFERENCE_AUTH_STALE_BODY } from "./grokInferenceProxy.js";
 export { assertGrokWorkerDenyPathPlacement, assertGrokWorkerDenyPathShape, assertGrokWorkerDenyPathsPlaceable, GROK_WORKER_BASE_PROFILE_GRANTS, grokWorkerCanSearch, grokWorkerDenyPathChain, GrokWorkerDenyPlacementError, readGrokWorkerDenyPathChain } from "./grokWorkerDenyPlacement.js";
 export { grokWorkerSandboxProfileSha256, renderGrokWorkerSandboxProfile } from "./grokWorkerSandboxProfile.js";
+export { AGENT_SKILLS_BOUNDS, AGENT_SKILLS_WORKSPACE_DIRECTORY, GROK_WORKER_SKILLS_LAYOUT, GROK_WORKER_SKILLS_VERSION, grokWorkerSkillsSha256, parseAgentSkills, renderGrokWorkerSkillsTree } from "./grokWorkerSkills.js";
+export { readAgentSkillsDirectory } from "./agentSkillsDirectory.js";
+export { GROK_WORKER_FOREIGN_SKILL_ROOTS, verifyGrokWorkerForeignSkillRoots, verifyGrokWorkerSkills } from "./grokWorkerHomeAttestation.js";
 export { ENGINE_BROKER_SERVICE_V3, engineBrokerRequestLedgerPathFor, engineBrokerSealLedgerPathFor, parseEngineBrokerServiceConfig } from "./engineBrokerServiceConfig.js";
 export { TURN_SEAL_LEDGER, TURN_SEAL_LEDGER_VERSION } from "./engineBrokerSealLedger.js";
 export { DEFAULT_GROK_BROKER_TURN_LIMITS, ENGINE_BROKER_LIMIT_REASONS } from "./engineBrokerTurnAccounting.js";

package/dist/runtime/productionAgentTools.js

@@ -226,7 +226,7 @@ function moltnetTool(agent, wakeContext) {
 }
 async function connect(agent, server) {
     taskClockChildEnvironment(server.env);
-    const client = new Client({ name: "daimon-production", version: "0.2.1" });
+    const client = new Client({ name: "daimon-production", version: "0.2.3" });
     const headers = server.authSecretEnv === undefined ? {} : { authorization: `Bearer ${requiredSecret(server.authSecretEnv)}` };
     const transport = server.transport === "stdio"
         ? new StdioClientTransport({ command: server.command, args: [...server.args], env: stringEnvironment(readyTaskClockEnvironment({ ...server.env, ...cliChildEnvironment([], agent.runtimeHomePath, { executablePath: server.command }) })) })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noopolis/daimon",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "Noopolis native per-agent runtime harness built on Pi.",
   "license": "MIT",
   "type": "module",