@themoltnet/agent-daemon 0.17.0 → 0.18.1

package/README.md

@@ -50,8 +50,17 @@ The agent's `moltnet.json` and gitconfig live next to each other in
 
 ### Pi provider auth
 
-Pi resolves provider credentials in this order: `~/.pi/agent/auth.json` (if
-present) wins, else environment variables. For CI prefer env vars:
+The daemon resolves Pi config from the repository-local `.pi` directory by
+default. On startup, if `PI_CODING_AGENT_DIR` is not already set, the daemon
+sets it to `<repo-root>/.pi` before creating Pi sessions. This keeps daemon
+runs deterministic and avoids inheriting user-level `~/.pi/agent` state.
+
+Repo-local `.pi/settings.json` and `.pi/models.json` are intended to be
+committed. `models.json` should reference provider keys by environment-variable
+name, for example `"apiKey": "OLLAMA_API_KEY"`, not contain secret values.
+Repo-local `.pi/auth.json` may exist for local subscription auth, but is
+gitignored. Without `.pi/auth.json`, Pi falls back to environment-variable
+provider keys:
 
 ```bash
 export ANTHROPIC_API_KEY=sk-ant-...
@@ -59,7 +68,8 @@ export ANTHROPIC_API_KEY=sk-ant-...
 # https://github.com/badlogic/pi-mono/blob/main/packages/ai/src/env-api-keys.ts
 ```
 
-To use a non-default auth directory: `PI_CODING_AGENT_DIR=/abs/path/to/.pi/agent`.
+To force a non-repo Pi directory, set
+`PI_CODING_AGENT_DIR=/abs/path/to/.pi-or-agent-dir` before starting the daemon.
 
 ### Observability
 
@@ -126,11 +136,12 @@ registered task type; unknown task-type names remain invalid.
 ### Prerequisites
 
 - Docker running.
-- pi authenticated for the model provider you'll drive the daemon with
-  (`~/.pi/agent/auth.json` should already contain entries for `anthropic`
-  and/or `openai-codex` — set up via the normal pi/legreffier onboarding). The
-  daemon does **not** read `ANTHROPIC_API_KEY` from env at the smoke-test path
-  (CI is the exception — see [Pi provider auth](#pi-provider-auth) above).
+- Pi config for the model provider you'll drive the daemon with. Local daemon
+  runs default `PI_CODING_AGENT_DIR` to repo-local `.pi`, so committed
+  `.pi/settings.json` and `.pi/models.json` must list the provider/model. For
+  subscription auth, put your local token blob in `.pi/auth.json`; it is
+  gitignored. For API-key auth, keep `.pi/auth.json` absent and export the
+  provider key referenced by `.pi/models.json`, for example `OLLAMA_API_KEY`.
 - `ssh-keygen` on `PATH`.
 - A `sandbox.json` at the repo root, or an explicit `--sandbox <path>` when
   starting the daemon. The daemon searches up for this file and uses its

package/dist/main.js

@@ -31258,12 +31258,21 @@ if (!etc.sha512Sync) etc.sha512Sync = (...m) => {
 */
 async function isContinuationClaimableByThisDaemon(task, slotRegistry) {
 	const cf = task.input?.continueFrom;
-	if (!cf) return true;
+	if (!cf) return { claimable: true };
 	const slot = await slotRegistry.findLatestProducerSlotByTaskAttempt(cf.taskId, cf.attemptN);
-	if (!slot) return false;
+	if (!slot) return {
+		claimable: false,
+		reason: "missing_producer_slot",
+		continueFrom: cf
+	};
 	const sessionDir = slot.session?.sessionDir;
-	if (!sessionDir || !existsSync(sessionDir)) return false;
-	return true;
+	if (!sessionDir || !existsSync(sessionDir)) return {
+		claimable: false,
+		reason: "missing_session_dir",
+		continueFrom: cf,
+		sessionDir
+	};
+	return { claimable: true };
 }
 var DEFAULT_LIST_LIMIT = 10;
 var DEFAULT_POLL_INTERVAL_MS = 2e3;
@@ -31351,7 +31360,19 @@ var PollingApiTaskSource = class {
 				if (seen.has(item.id)) continue;
 				if (this.opts.taskTypes && this.opts.taskTypes.length > 0 && !this.opts.taskTypes.includes(item.taskType)) continue;
 				if (this.opts.diaryIds && this.opts.diaryIds.length > 0 && (item.diaryId === null || !this.opts.diaryIds.includes(item.diaryId))) continue;
-				if (this.opts.slotRegistry && !await isContinuationClaimableByThisDaemon(item, this.opts.slotRegistry)) continue;
+				if (this.opts.slotRegistry) {
+					const affinity = await isContinuationClaimableByThisDaemon(item, this.opts.slotRegistry);
+					if (!affinity.claimable) {
+						this.logger.debug({
+							taskId: item.id,
+							taskType: item.taskType,
+							reason: affinity.reason,
+							continueFrom: affinity.continueFrom,
+							sessionDir: affinity.sessionDir
+						}, "polling-api.continuation_skipped");
+						continue;
+					}
+				}
 				if (this.opts.profileId) {
 					const allowed = item.allowedProfiles ?? [];
 					if (allowed.length > 0 && !allowed.some((p) => p.profileId === this.opts.profileId)) continue;
@@ -32824,8 +32845,7 @@ async function resumeVm(config) {
 			signal: config.signal
 		});
 		if (creds.gitconfig) {
-			const vmSigningKey = `${vmSshDir}/id_ed25519`;
-			const vmGitconfig = creds.gitconfig.replace(/signingKey\s*=\s*.+/g, `signingKey = ${vmSigningKey}`);
+			const vmGitconfig = rewriteGitconfigPaths(creds.gitconfig, vmSshDir, vmAgentDir);
 			await vm.fs.writeFile(`${vmAgentDir}/gitconfig`, vmGitconfig, {
 				mode: 420,
 				signal: config.signal
@@ -32848,17 +32868,6 @@ async function resumeVm(config) {
 			signal: config.signal
 		});
 		await vm.exec("chown -R agent:agent /home/agent/.pi /home/agent/.moltnet", { signal: config.signal });
-		const gitCredHelperPath = `${vmSshDir}/git-credential-moltnet`;
-		const credHelperScript = `#!/bin/sh
-echo "username=x-access-token"
-echo "password=$(moltnet github token --credentials ${vmSshDir}/moltnet.json)"
-`;
-		await vm.fs.writeFile(gitCredHelperPath, credHelperScript, {
-			mode: 493,
-			signal: config.signal
-		});
-		await vmRun(vm, "git credential helper", `git config --global credential.helper ${gitCredHelperPath} && \
-       git config --global url."https://github.com/".insteadOf "git@github.com:"`, config.signal);
 		return {
 			vm,
 			credentials: creds,
@@ -32877,6 +32886,30 @@ echo "password=$(moltnet github token --credentials ${vmSshDir}/moltnet.json)"
 	}
 }
 /**
+* Rewrite host-absolute paths inside an agent gitconfig to VM-local
+* equivalents before injecting it into the guest.
+*
+* Two rewrites:
+*   - `signingKey = <host path>`  → `<vmSshDir>/id_ed25519`
+*   - `... credential-helper --credentials <host moltnet.json>`
+*                                 → `<vmAgentDir>/moltnet.json`
+*
+* The credential-helper line is generated host-side by `moltnet github setup`
+* with a host-absolute `--credentials` path; inside the guest that path is
+* invalid, so it must point at the VM-side moltnet.json. The `insteadOf`
+* rewrite rule and every other line are workspace-independent and pass through
+* unchanged. A gitconfig without a credential helper is rewritten only for
+* `signingKey`.
+*
+* This is the single source of truth for git push auth in the guest: the
+* injected gitconfig carries the tokenless mint-on-demand helper, so the VM
+* no longer hand-rolls a credential-helper script or runs an imperative
+* `git config --global ... insteadOf` against the guest $HOME.
+*/
+function rewriteGitconfigPaths(gitconfig, vmSshDir, vmAgentDir) {
+	return gitconfig.replace(/signingKey\s*=\s*.+/g, `signingKey = ${vmSshDir}/id_ed25519`).replace(/(moltnet github credential-helper --credentials )\S+/g, `$1${vmAgentDir}/moltnet.json`);
+}
+/**
 * Rewrite host-absolute paths inside moltnet.json to VM-local equivalents.
 *
 * Fields rewritten:
@@ -34785,9 +34818,13 @@ function loadConfig() {
 		otelEndpoint: process.env["MOLTNET_OTEL_ENDPOINT"] ?? "",
 		logLevel: process.env["LOG_LEVEL"] ?? "",
 		profilePrerequisiteEnv: process.env,
-		profilePrerequisitePath: process.env.PATH ?? ""
+		profilePrerequisitePath: process.env.PATH ?? "",
+		piCodingAgentDir: process.env["PI_CODING_AGENT_DIR"] ?? ""
 	};
 }
+function activatePiCodingAgentDir(path) {
+	process.env["PI_CODING_AGENT_DIR"] = path;
+}
 //#endregion
 //#region src/lib/agent-context.ts
 /**
@@ -35052,6 +35089,7 @@ async function maybeAttachWarmSlotContext(claimedTask, basePlan, stateDirs, slot
 		return {
 			...basePlan,
 			workspaceMode: "dedicated_worktree",
+			workspaceId: resolution.producerSlot.workspace?.workspaceId ?? null,
 			worktreeBranch: resolution.producerSlot.workspace?.worktreeBranch ?? null,
 			sessionPersistence: {
 				sessionDir: `${stateDirs.piSessionsDir}/continue-${claimedTask.task.id}-attempt-${claimedTask.attemptN}`,
@@ -35374,6 +35412,23 @@ async function initWorkerOtel(options) {
 	};
 }
 //#endregion
+//#region src/lib/pi-agent-dir.ts
+function ensurePiAgentDir(repoRoot, explicitPath) {
+	if (explicitPath) {
+		mkdirSync(explicitPath, { recursive: true });
+		return {
+			path: explicitPath,
+			source: "env"
+		};
+	}
+	const path = join(repoRoot, ".pi");
+	mkdirSync(path, { recursive: true });
+	return {
+		path,
+		source: "repo"
+	};
+}
+//#endregion
 //#region src/lib/runtime-profile.ts
 var RuntimeProfilePrerequisiteError = class extends Error {
 	constructor(profileName, missingEnv, missingTools) {
@@ -35614,6 +35669,8 @@ async function runPolling(opts) {
 		rootDir: profile.mountPath,
 		path: profile.source
 	} : resolveSandbox(process.cwd(), values.sandbox);
+	const piAgentDir = ensurePiAgentDir(sandbox.rootDir, cfg.piCodingAgentDir);
+	activatePiCodingAgentDir(piAgentDir.path);
 	const stateDirs = ensureDaemonStateDirs(sandbox.rootDir);
 	const slotRegistry = new DaemonSlotRegistry(resolveDaemonStateStorageConfig(stateDirs.registryDbPath, cfg.agentDaemonStateDatabaseUrl));
 	const slotIdentity = {
@@ -35691,7 +35748,9 @@ async function runPolling(opts) {
 			profileId: profile.id,
 			profileSessionTtlSec: profile.sessionTtlSec,
 			profileWorkspaceTtlSec: profile.workspaceTtlSec
-		} : {}
+		} : {},
+		piAgentDir: piAgentDir.path,
+		piAgentDirSource: piAgentDir.source
 	}, "agent-daemon.starting");
 	const outputs = [];
 	try {
@@ -35967,6 +36026,8 @@ async function runOnce(argv) {
 		rootDir: profile.mountPath,
 		path: profile.source
 	} : resolveSandbox(process.cwd(), values.sandbox);
+	const piAgentDir = ensurePiAgentDir(sandbox.rootDir, cfg.piCodingAgentDir);
+	activatePiCodingAgentDir(piAgentDir.path);
 	const stateDirs = ensureDaemonStateDirs(sandbox.rootDir);
 	const slotRegistry = new DaemonSlotRegistry(resolveDaemonStateStorageConfig(stateDirs.registryDbPath, cfg.agentDaemonStateDatabaseUrl));
 	const slotIdentity = {
@@ -36017,7 +36078,9 @@ async function runOnce(argv) {
 			profileId: profile.id,
 			profileSessionTtlSec: profile.sessionTtlSec,
 			profileWorkspaceTtlSec: profile.workspaceTtlSec
-		} : {}
+		} : {},
+		piAgentDir: piAgentDir.path,
+		piAgentDirSource: piAgentDir.source
 	}, "agent-daemon.starting");
 	let runtime = null;
 	let activeAttemptN = null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/agent-daemon",
-  "version": "0.17.0",
+  "version": "0.18.1",
   "license": "AGPL-3.0-only",
   "type": "module",
   "description": "MoltNet agent daemon — claims and executes tasks (fulfill_brief, assess_brief) from the MoltNet task-service via Pi-headless. CLI: moltnet-agent.",
@@ -45,10 +45,10 @@
     "@opentelemetry/semantic-conventions": "^1.39.0",
     "pino": "^10.3.1",
     "pino-pretty": "^13.1.3",
-    "@themoltnet/agent-daemon-state": "0.2.0",
+    "@themoltnet/agent-runtime": "0.25.0",
     "@themoltnet/sdk": "0.108.0",
-    "@themoltnet/agent-runtime": "0.24.0",
-    "@themoltnet/pi-extension": "0.23.1"
+    "@themoltnet/pi-extension": "0.24.1",
+    "@themoltnet/agent-daemon-state": "0.2.0"
   },
   "devDependencies": {
     "tsx": "^4.7.0",
@@ -57,8 +57,8 @@
     "vitest": "^3.0.0",
     "@moltnet/bootstrap": "0.1.0",
     "@moltnet/crypto-service": "0.1.0",
-    "@moltnet/observability": "0.1.0",
-    "@moltnet/tasks": "0.1.0"
+    "@moltnet/tasks": "0.1.0",
+    "@moltnet/observability": "0.1.0"
   },
   "nx": {
     "tags": [