@themoltnet/agent-daemon 0.10.1 → 0.10.3

package/README.md

@@ -158,9 +158,14 @@ This matters for evals in particular. `run_eval` tasks declare their intended
 workspace shape in `input.execution.workspace`: `none` becomes a
 `scratch_mount`, `shared_mount` uses the daemon mount, and
 `dedicated_worktree` uses an isolated checkout. Downstream
-`judge_eval_attempt` tasks can attach to that exact producer workspace, so any
-repo-specific `resumeCommands` that should not run in scratch mode must be
-guarded with `when.workspaceMode`.
+`judge_eval_attempt` tasks only resolve against a still-live producer
+session/workspace slot. If the producer slot has already expired and been
+reaped, the judge fails with `producer_context_missing`. When the judge does
+claim in time, it immediately forks the producer session and copies the
+producer workspace into judge-owned scratch state so the running judge no
+longer depends on the producer slot after claim time. Repo-specific
+`resumeCommands` that should not run in scratch mode must still be guarded
+with `when.workspaceMode`.
 
 ### 1. Start the local stack
 
@@ -243,9 +248,32 @@ Leave it running. It idles until a task lands in its queue.
 
 ### 4. Create a task
 
-In another terminal, with `.moltnet/local-dev/env` sourced:
+In another terminal, with `.moltnet/local-dev/env` sourced. Pick the CLI
+form (recommended — schema-validates locally, no Node dependency in the
+imposer path) or the template-driven TS form (legacy path that supports
+`{{placeholder}}` substitution via `--set`).
+
+::: code-group
+
+```bash [CLI (recommended)]
+BRIEF="Create a feature branch named feat/smoke-hello, write \
+/workspace/demo/out/hello.txt with the single line 'hi from local-dev', \
+commit the file with a signed diary entry per the runtime instructor, \
+and report the branch name and commit sha in the final \
+FulfillBriefOutput JSON. There is no remote to push to — leave \
+pullRequestUrl null."
+
+jq -n --arg brief "$BRIEF" \
+   --arg title "Smoke: hello file in a feature branch" \
+   '{brief: $brief, title: $title, scopeHint: "feature"}' \
+  | moltnet task create \
+      --task-type fulfill_brief \
+      --team-id "$MOLTNET_TEAM_ID" \
+      --diary-id "$MOLTNET_DIARY_ID" \
+      --credentials "$PWD/.moltnet/local-dev/moltnet.json"
+```
 
-```bash
+```bash [tsx (legacy)]
 pnpm exec tsx tools/src/tasks/create-task.ts \
   --agent local-dev \
   --task-file examples/tasks/api/fulfill-brief.create.template.json \
@@ -255,6 +283,8 @@ pnpm exec tsx tools/src/tasks/create-task.ts \
   --set brief="Create a feature branch named feat/smoke-hello, write /workspace/demo/out/hello.txt with the single line 'hi from local-dev', commit the file with a signed diary entry per the runtime instructor, and report the branch name and commit sha in the final FulfillBriefOutput JSON. There is no remote to push to — leave pullRequestUrl null."
 ```
 
+:::
+
 > **Why a real coding brief**: `fulfill_brief` requires the agent to emit a
 > structured `FulfillBriefOutput` JSON
 > (`{ branch, commits, pullRequestUrl, diaryEntryIds, summary }`) as its

package/dist/main.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import crypto, { createHash } from "crypto";
-import path, { dirname, isAbsolute, join, relative, resolve } from "node:path";
+import path, { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { parseArgs, parseEnv, promisify } from "node:util";
-import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync } from "node:fs";
+import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, statSync } from "node:fs";
 import { ROOT_CONTEXT, SpanStatusCode, context, metrics, propagation, trace } from "@opentelemetry/api";
 import { pino, transport } from "pino";
 import { readFile } from "node:fs/promises";
@@ -4510,7 +4510,8 @@ var PrReviewSubject = Type$2.Object({
 var PrReviewInput = Type$2.Object({
 	subject: PrReviewSubject,
 	taskPrompt: Type$2.Optional(Type$2.String({ minLength: 1 })),
-	successCriteria: SuccessCriteria
+	successCriteria: SuccessCriteria,
+	context: Type$2.Optional(TaskContext)
 }, {
 	$id: "PrReviewInput",
 	additionalProperties: false
@@ -6794,7 +6795,7 @@ function buildJudgeEvalAttemptUserPrompt(input, ctx) {
 		"If the accepted attempt output lists `artifacts[].path`, treat those",
 		"paths as relative to the current workspace root unless the output",
 		"explicitly says otherwise.",
-		ctx.workspace.mode === "dedicated_worktree" ? `This attachment is a dedicated producer worktree${ctx.workspace.branch ? ` on branch \`${ctx.workspace.branch}\`` : ""}.` : ctx.workspace.mode === "scratch_mount" ? "This attachment is the producer scratch workspace mounted with shadow writes for safe inspection." : "This attachment is the producer shared workspace mounted with shadow writes for safe inspection.",
+		ctx.workspace.mode === "dedicated_worktree" ? `This attachment is a dedicated producer worktree${ctx.workspace.branch ? ` on branch \`${ctx.workspace.branch}\`` : ""}.` : ctx.workspace.mode === "scratch_mount" ? "This workspace is a fresh judge-owned scratch copy of the producer workspace." : "This attachment is the producer shared workspace mounted with shadow writes for safe inspection.",
 		""
 	].join("\n") : "";
 	return [
@@ -9482,6 +9483,32 @@ var removeTeamMember = (options) => (options.client ?? client).delete({
 	...options
 });
 /**
+* Update a member role between member and manager. Requires manage_members permission.
+*/
+var updateTeamMemberRole = (options) => (options.client ?? client).patch({
+	security: [
+		{
+			scheme: "bearer",
+			type: "http"
+		},
+		{
+			name: "X-Moltnet-Session-Token",
+			type: "apiKey"
+		},
+		{
+			in: "cookie",
+			name: "ory_kratos_session",
+			type: "apiKey"
+		}
+	],
+	url: "/teams/{id}/members/{subjectId}",
+	...options,
+	headers: {
+		"Content-Type": "application/json",
+		...options.headers
+	}
+});
+/**
 * List invite codes. Requires manage_members permission.
 */
 var listTeamInvites = (options) => (options.client ?? client).get({
@@ -11770,6 +11797,17 @@ function createTeamsNamespace(context) {
 				}
 			}));
 		},
+		async updateMemberRole(teamId, subjectId, role) {
+			return unwrapResult(await updateTeamMemberRole({
+				client,
+				auth,
+				path: {
+					id: teamId,
+					subjectId
+				},
+				body: { role }
+			}));
+		},
 		invites: {
 			async create(teamId, body) {
 				return unwrapResult(await createTeamInvite({
@@ -16293,6 +16331,8 @@ function prepareTaskWorkspace(task, requestedMountPath, executionPlan) {
 			});
 			mkdirSync(scratchDir, { recursive: true });
 		}
+		const workspaceSeed = executionPlan?.workspaceSeed ?? null;
+		if (workspaceSeed) copyDirectoryContents(workspaceSeed.copyFromPath, scratchDir);
 		return {
 			mountPath: scratchDir,
 			cwdPath: scratchDir,
@@ -16414,6 +16454,68 @@ function gitRefExists(mainRepo, ref) {
 		return false;
 	}
 }
+function copyDirectoryContents(sourceDir, targetDir) {
+	if (!existsSync(sourceDir)) throw new Error(`Workspace seed source is missing: ${sourceDir}`);
+	if (existsSync(join(sourceDir, ".git"))) initializeScratchGitRepo(sourceDir, targetDir);
+	const resolvedTargetDir = realpathSync(targetDir);
+	for (const entry of readdirSync(sourceDir)) {
+		const sourceEntry = join(sourceDir, entry);
+		if (shouldSkipSeedEntry(sourceEntry, entry, resolvedTargetDir)) continue;
+		cpSync(sourceEntry, join(targetDir, entry), { recursive: true });
+	}
+}
+function initializeScratchGitRepo(sourceDir, targetDir) {
+	execFileSync("git", [
+		"-C",
+		targetDir,
+		"init"
+	], { stdio: "pipe" });
+	let headCommit = null;
+	try {
+		headCommit = execFileSync("git", [
+			"-C",
+			sourceDir,
+			"rev-parse",
+			"HEAD"
+		], {
+			encoding: "utf8",
+			stdio: "pipe"
+		}).trim();
+	} catch {
+		headCommit = null;
+	}
+	if (!headCommit) return;
+	execFileSync("git", [
+		"-C",
+		targetDir,
+		"remote",
+		"add",
+		"origin",
+		sourceDir
+	], { stdio: "pipe" });
+	execFileSync("git", [
+		"-C",
+		targetDir,
+		"fetch",
+		"--quiet",
+		"--depth=1",
+		"origin",
+		headCommit
+	], { stdio: "pipe" });
+	execFileSync("git", [
+		"-C",
+		targetDir,
+		"checkout",
+		"--quiet",
+		"--detach",
+		"FETCH_HEAD"
+	], { stdio: "pipe" });
+}
+function shouldSkipSeedEntry(sourceEntry, entryName, resolvedTargetDir) {
+	if (entryName === ".git") return true;
+	const resolvedSourceEntry = realpathSync(sourceEntry);
+	return resolvedTargetDir === resolvedSourceEntry || resolvedTargetDir.startsWith(`${resolvedSourceEntry}${sep}`);
+}
 //#endregion
 //#region ../../libs/pi-extension/src/runtime/execute-pi-task.ts
 /**
@@ -16619,7 +16721,8 @@ async function executePiTask(claimedTask, reporter, opts) {
 				workspace: {
 					mode: activeWorkspace.mode,
 					branch: activeWorkspace.branch,
-					attached: executionPlan?.workspaceAttachment !== void 0
+					attached: executionPlan?.workspaceAttachment !== void 0 || executionPlan?.workspaceSeed?.source === "producer",
+					source: executionPlan?.workspaceSeed?.source === "producer" ? "producer_copy" : executionPlan?.workspaceAttachment !== void 0 ? "producer_attachment" : void 0
 				},
 				extras: opts.promptExtras
 			});
@@ -17690,19 +17793,18 @@ function maybeAttachProducerContext(claimedTask, basePlan, stateDirs, slotRegist
 	const targetTaskId = typeof claimedTask.task.input.targetTaskId === "string" ? claimedTask.task.input.targetTaskId : null;
 	const targetAttemptN = typeof claimedTask.task.input.targetAttemptN === "number" ? claimedTask.task.input.targetAttemptN : null;
 	if (!targetTaskId || !targetAttemptN) throw new ProducerContextResolutionError("judge_eval_attempt is missing targetTaskId/targetAttemptN");
-	const producer = slotRegistry.findLatestProducerSlotByTaskAttempt(targetTaskId, targetAttemptN);
-	if (!producer) throw new ProducerContextResolutionError(`No persisted producer daemon slot found for task ${targetTaskId} attempt ${targetAttemptN}`);
-	const sourceSessionPath = resolveProducerSessionPath(producer);
+	const producerContext = slotRegistry.findLatestProducerSlotByTaskAttempt(targetTaskId, targetAttemptN);
+	if (!producerContext) throw new ProducerContextResolutionError(`No live producer daemon slot found for task ${targetTaskId} attempt ${targetAttemptN}`);
+	const sourceSessionPath = resolveProducerSessionPath(producerContext);
 	if (!sourceSessionPath) throw new ProducerContextResolutionError(`Producer task ${targetTaskId} attempt ${targetAttemptN} has no persisted Pi session path`);
-	const attachedWorkspace = resolveProducerWorkspaceAttachment(producer, stateDirs);
+	const copiedWorkspaceSource = resolveProducerWorkspaceCopySource(producerContext, stateDirs);
 	return {
 		...basePlan,
-		workspaceMode: attachedWorkspace.mode,
-		worktreeBranch: attachedWorkspace.branch,
-		workspaceAttachment: {
-			mountPath: attachedWorkspace.mountPath,
-			cwdPath: attachedWorkspace.cwdPath,
-			shadowWrites: "tmpfs"
+		workspaceMode: "scratch_mount",
+		worktreeBranch: null,
+		workspaceSeed: {
+			copyFromPath: copiedWorkspaceSource,
+			source: "producer"
 		},
 		sessionPersistence: {
 			sessionDir: `${stateDirs.piSessionsDir}/judge-${claimedTask.task.id}-attempt-${claimedTask.attemptN}`,
@@ -17718,32 +17820,17 @@ function resolveProducerSessionPath(producer) {
 	const latest = resolveLatestPiSessionPath(sessionDir);
 	return latest && existsSync(latest) ? latest : null;
 }
-function resolveProducerWorkspaceAttachment(producer, stateDirs) {
+function resolveProducerWorkspaceCopySource(producer, stateDirs) {
 	const workspacePath = producer.workspace?.worktreePath ?? null;
 	if (workspacePath) {
-		if (existsSync(workspacePath)) return {
-			mountPath: workspacePath,
-			cwdPath: workspacePath,
-			mode: producer.workspace?.worktreeBranch ? "dedicated_worktree" : "scratch_mount",
-			branch: producer.workspace?.worktreeBranch ?? null
-		};
+		if (existsSync(workspacePath)) return workspacePath;
 		const recoveredPath = recoverScratchWorkspacePath(producer, stateDirs);
-		if (recoveredPath) return {
-			mountPath: recoveredPath,
-			cwdPath: recoveredPath,
-			mode: "scratch_mount",
-			branch: null
-		};
+		if (recoveredPath) return recoveredPath;
 		throw new ProducerContextResolutionError(`Producer workspace path is missing on disk: ${workspacePath}`);
 	}
 	const sharedMountRoot = dirname(dirname(stateDirs.rootDir));
 	if (!existsSync(sharedMountRoot)) throw new ProducerContextResolutionError(`Shared producer mount root is missing on disk: ${sharedMountRoot}`);
-	return {
-		mountPath: sharedMountRoot,
-		cwdPath: sharedMountRoot,
-		mode: "shared_mount",
-		branch: null
-	};
+	return sharedMountRoot;
 }
 function recoverScratchWorkspacePath(producer, stateDirs) {
 	if (producer.workspace?.worktreeBranch) return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/agent-daemon",
-  "version": "0.10.1",
+  "version": "0.10.3",
   "license": "AGPL-3.0-only",
   "type": "module",
   "description": "MoltNet agent daemon — claims and executes tasks (fulfill_brief, assess_brief) from the MoltNet task-service via Pi-headless. CLI: moltnet-agent.",
@@ -33,19 +33,19 @@
     "@opentelemetry/semantic-conventions": "^1.39.0",
     "pino": "^10.3.1",
     "pino-pretty": "^13.1.3",
-    "@themoltnet/agent-runtime": "0.18.0",
-    "@themoltnet/pi-extension": "0.19.1",
-    "@themoltnet/sdk": "0.103.0"
+    "@themoltnet/agent-runtime": "0.18.2",
+    "@themoltnet/pi-extension": "0.19.3",
+    "@themoltnet/sdk": "0.104.0"
   },
   "devDependencies": {
     "tsx": "^4.7.0",
     "typescript": "^5.3.3",
     "vite": "^8.0.0",
     "vitest": "^3.0.0",
-    "@moltnet/database": "0.1.0",
-    "@moltnet/tasks": "0.1.0",
     "@moltnet/bootstrap": "0.1.0",
-    "@moltnet/crypto-service": "0.1.0"
+    "@moltnet/crypto-service": "0.1.0",
+    "@moltnet/database": "0.1.0",
+    "@moltnet/tasks": "0.1.0"
   },
   "nx": {
     "tags": [