@plurnk/plurnk-service 1.17.0 → 1.18.0

package/.env.defaults

@@ -23,6 +23,9 @@ PLURNK_PORT=1066
 # PLURNK_SERVICE_SQLITE_MMAP_SIZE=268435456
 # Database size ceiling, pages; writes beyond it fail. Unset = SQLite default.
 # PLURNK_SERVICE_SQLITE_MAX_PAGE_COUNT=524288
+# Read-only database Workers beside the one writer Worker (database Workers = 1 + readers);
+# 0 = every read shares the writer. Non-negative integer. Blank = sqlrite's own default.
+PLURNK_SERVICE_SQLITE_READERS=0
 
 # --- Permissions and membership ---
 # CapabilityPolicy JSON: deny removes matching demands; only admits only matches.
@@ -32,7 +35,7 @@ PLURNK_SERVICE_CAPABILITIES={}
 PLURNK_SERVICE_FILE_CREATE_SCOPE=root
 # Model-added membership: none | root | namespace. Workspaces may narrow it.
 # Operator definitions use PLURNK_MEMBERS_<alias>=<glob> and PLURNK_MEMBERS_ENABLED=["alias"].
-PLURNK_SERVICE_MEMBERS_MODEL_SCOPE=none
+PLURNK_SERVICE_MEMBERS_MODEL_SCOPE=namespace
 # Git membership, status, and branch integration: 1 = permitted; 0 = denied service-wide.
 PLURNK_SERVICE_GIT_ALLOWED=1
 # Include the repository containing project_root as members: 1 = yes; 0 = explicit members only.
@@ -96,6 +99,16 @@ PLURNK_SERVICE_OPTIMISTIC_WAIT_MS=5000
 PLURNK_SERVICE_EXEC_POLL_SEC=60
 # Backoff steps: delay doubles to BASE * 2^(TURNS-1), then stays capped.
 PLURNK_SERVICE_EXEC_POLL_TURNS=8
+# Ambient environment an EXEC subprocess may inherit from the host: exact names, or one
+# trailing-* prefix glob. This is a CEILING — a worker or a heading modifier narrows it,
+# nothing widens it. plurnk's own secrets (PLURNK_* and every provider credential name) are
+# stripped beneath it unconditionally and are not governed by this knob.
+# The shipped list is what a shell, git, node and python need to run at all. An operator
+# who wants a tool's credential reachable by model-written commands adds it by name.
+PLURNK_SERVICE_EXEC_ENV_INHERIT=PATH,HOME,USER,LOGNAME,SHELL,PWD,TMPDIR,TERM,TZ,LANG,LC_*,PAGER,GIT_PAGER,NO_COLOR,CI
+# Names removed after INHERIT, same shapes; narrows without rewriting the list above.
+PLURNK_SERVICE_EXEC_ENV_EXCLUDE=
+
 # Grace after a termination signal, ms; then SIGKILL the surviving process group.
 PLURNK_SERVICE_EXEC_KILL_GRACE_MS=2000
 
@@ -154,6 +167,11 @@ PLURNK_SERVICE_REQUIEM_RETRY_MAX_TOKENS=32768
 PLURNK_SERVICE_RETAIN_PACKET_TURNS=-1
 # Packet compositions kept by age, ms since the turn completed; -1 = no age limit.
 PLURNK_SERVICE_RETAIN_PACKET_MS=-1
+# Model response bodies kept per loop, newest first; -1 = every body, forever. The call's
+# evidence, admission and accounting always stay.
+PLURNK_SERVICE_RETAIN_RESPONSE_TURNS=-1
+# Model response bodies kept by age, ms since the turn completed; -1 = no age limit.
+PLURNK_SERVICE_RETAIN_RESPONSE_MS=-1
 # Collect packet items no turn's composition references (1), or keep them (0).
 PLURNK_SERVICE_COLLECT_PACKET_ITEMS=1
 # Collect derivations no channel, turn source, or log row cites (1), or keep them (0).

package/README.md

@@ -73,7 +73,7 @@ The daemon can emit OpenTelemetry traces and low-cardinality metrics through the
 
 ## The file sandbox
 
-Plurnk sees what Git tracks or a `members` definition includes. The AGENTS.md policy path is injected separately as privileged policy, not as a file entry. A path admitted by neither source does not exist to the model and cannot be overwritten. Accepted creation is exclusive and never orphaned: it is Git-added or receives an inspectable exact pick. Creation defaults to `project_root`, can be disabled or expanded to the canonical namespace by operator policy, and only an explicit pick overrides Git ignore. Member edits remain proposal-gated; an outside-root member is read-only unless a pick grants it. `EXEC` deliberately reaches beyond this file sandbox, so its proposal policy is the machine perimeter. Details: SPEC {§scheme-address} ({§fs-namespace} through {§fs-world-state}).
+Plurnk sees what Git tracks or a `members` definition includes. The AGENTS.md policy path is injected separately as privileged policy, not as a file entry. A path admitted by neither source does not exist to the model and cannot be overwritten. Accepted creation is exclusive and never orphaned: it is Git-added or receives an inspectable exact pick. Creation defaults to `project_root`, can be disabled or expanded to the canonical namespace by operator policy, and only an explicit pick overrides Git ignore. Member edits remain proposal-gated; an outside-root member is read-only unless a pick grants it. An execution deliberately reaches beyond this file sandbox, so its proposal policy is the machine perimeter. Details: SPEC {§scheme-address} ({§fs-namespace} through {§fs-world-state}).
 
 ## Tests