@themoltnet/agent-daemon 0.31.1 → 0.32.1

package/README.md

@@ -156,8 +156,9 @@ registered task type; unknown task-type names remain invalid.
   provider key referenced by `.pi/models.json`, for example `OLLAMA_API_KEY`.
 - `ssh-keygen` on `PATH`.
 - A runtime profile in the target team. The profile supplies provider, model,
-  sandbox policy, and runtime defaults. The daemon mounts the current working
-  directory as the VM workspace root.
+  sandbox policy, and runtime defaults. The daemon resolves the configured
+  agent root and uses that checkout as the VM workspace root, regardless of
+  the shell directory from which the command was launched.
 
 For `themoltnet`, prefer a profile sandbox equivalent to this minimal policy:
 
@@ -203,6 +204,26 @@ producer context, the judge fails with `producer_context_missing`.
 Repo-specific `resumeCommands` that should not run in scratch mode must still
 be guarded with `when.workspaceMode`.
 
+### Runtime resource lifecycle
+
+Each daemon process creates a unique runtime lane. Two polling processes using
+the same agent, runtime profile, and task correlation therefore write to
+different local Pi session directories and cannot race on the same slot.
+
+`freeform` Pi context remains correlation-scoped, but its checkout is
+attempt-scoped. Every attempt gets a fresh `daemon-task-<id>-attempt-<n>`
+workspace; retries and explicit continuations fork the previous checkpointed
+Pi session into that new workspace. The executor removes attempt workspaces on
+normal completion. At startup, and once per minute while polling, the daemon
+also reaps expired idle slots and terminal crash-orphans. Cleanup is restricted
+to daemon-owned session, scratch, and `.worktrees` roots.
+
+Provider failures are retried in the active Pi session before the daemon spends
+a task attempt. The default is four same-session retries. If those fail,
+deterministic retry classification runs before attempt-budget handling;
+`executor_threw` is always treated as an implementation/setup failure and is
+never promoted to another task attempt.
+
 ### 1. Start the local stack
 
 The e2e Compose file ships everything the daemon needs (Postgres, Ory, REST

package/dist/main.js

@@ -12,8 +12,9 @@ import { parseArgs, promisify } from "node:util";
 import { AgentRuntime, ApiTaskReporter, ApiTaskSource, PollingApiTaskSource } from "@themoltnet/agent-runtime";
 import { createPiRetryTriage, createPiTaskExecutor, findMainWorktree, normalizeRetryTriageResult, redactRetryTriageSecrets } from "@themoltnet/pi-extension";
 import { execFile, execFileSync } from "node:child_process";
-import { accessSync, constants, createReadStream, createWriteStream, existsSync, mkdirSync, readdirSync } from "node:fs";
+import { accessSync, constants, createReadStream, createWriteStream, existsSync, mkdirSync, readdirSync, realpathSync, rmSync } from "node:fs";
 import { AuthenticationError, MoltNetError, connect } from "@themoltnet/sdk";
+import { createHash, randomUUID } from "node:crypto";
 import { once } from "node:events";
 import { pino, transport } from "pino";
 import { OTLPTraceExporter } from "@opentelemetry/exporter-trace-otlp-proto";
@@ -25,7 +26,6 @@ import { AsyncLocalStorage } from "node:async_hooks";
 import { getModel } from "@earendil-works/pi-ai";
 import { mkdir, realpath, stat } from "node:fs/promises";
 import { pipeline } from "node:stream/promises";
-import { createHash } from "node:crypto";
 import { Writable } from "node:stream";
 import { createGzip } from "node:zlib";
 //#region ../../libs/observability/src/instrumentation.ts
@@ -4392,6 +4392,68 @@ _Object_({
 	additionalProperties: false
 });
 //#endregion
+//#region ../../libs/tasks/src/runtime-profile-context-recipes.ts
+var RUNTIME_PROFILE_CONTEXT_CATALOGUE = {
+	version: 1,
+	fragments: {
+		"accountable-delivery-v1": {
+			binding: "prompt_prefix",
+			content: "# Accountable delivery\n\n- Pair every commit made during this task with a signed diary entry created by the `moltnet_create_entry` custom tool. Put the returned id in a `MoltNet-Diary: <id>` commit trailer.\n- Keep commit signing enabled; do not bypass the agent git configuration.\n- Push a branch and open or update a pull request only when the task asks for it. For GitHub mutations, use the credential-bound `GH_TOKEN` command form required by the runtime kernel.\n- Keep changes, commits, and any requested pull request coherent enough to review independently.",
+			slug: "accountable-delivery-v1"
+		},
+		"judgment-diary-v1": {
+			binding: "prompt_prefix",
+			content: "# Judgment diary discipline\n\n- For an `assess_brief`, `judge_pack`, or `pr_review` task, create a signed diary entry with the `moltnet_create_entry` custom tool before submitting the structured judgment. Capture the rationale and evidence that support the verdict.\n- Add the `judgment` tag and the active task type tag (`assess_brief`, `judge_pack`, or `pr_review`). For `judge_pack`, also add `rubric:<rubricId>` from the task facts.\n- Do not use a shell `moltnet entry` command: task provenance is injected only by the custom tool.",
+			slug: "judgment-diary-v1"
+		},
+		"proactive-memory-v1": {
+			binding: "prompt_prefix",
+			content: "# Proactive memory use\n\n- Before non-trivial investigation, debugging, code changes, or review, check the task diary for relevant prior knowledge instead of waiting for a human to ask. Use `moltnet_diary_tags` for cheap reconnaissance, `moltnet_list_entries` when tags or task provenance are known, and `moltnet_search_entries` for semantic similarity. Do not search randomly: pass `taskFilter` for task-local or correlation-local queries, and pass `tags` / `entryTypes` for broader prior-knowledge queries using known tags such as `incident`, `decision`, or `scope:<area>`. Broaden only after constrained searches miss.\n- Before creating an `episodic` incident entry, search for similar incidents using the proposed title, root cause, error text, affected subsystem, and watch-for terms, filtered by `entryTypes: [\"episodic\", \"semantic\"]` and any known `scope:*` or task-provenance tags. If a close prior match exists, do not create an isolated duplicate: reference the prior entry in your response or diary content, update or link it when the new occurrence adds material evidence, or create a new recurrence entry only when the recurrence itself is important signal.\n- When you create a recurrence entry, include the prior matching entry id(s) in the content and explain what is new about this occurrence.",
+			slug: "proactive-memory-v1"
+		},
+		"run-eval-direct-v1": {
+			binding: "prompt_prefix",
+			content: "# Direct evaluation run\n\nThe supplied scenario, typed task facts, injected context, and registered submit-output tool are the complete task contract. Do not search diaries, create diary entries, modify a repository, commit, branch, push, or open a pull request unless a task fact explicitly requires it. Submit the agent-authored payload in the first turn; correction turns exist only to recover a rejected or missing submission.",
+			slug: "run-eval-direct-v1"
+		},
+		"task-diary-discipline-v1": {
+			binding: "prompt_prefix",
+			content: "# Task diary discipline\n\n- During a daemon task, create diary entries only through the `moltnet_create_entry` custom tool. It binds entries to the current task diary and injects task, type, attempt, and correlation provenance tags.\n- Do not shell out to `moltnet entry create`, `moltnet entry create-signed`, or any other `moltnet entry` subcommand from bash while a task is running. Those paths bypass the custom tool's task-tag injection, so task-filtered diary queries cannot find the entry.\n- You may add useful tags, but do not try to replace task provenance supplied by the runtime.",
+			slug: "task-diary-discipline-v1"
+		},
+		"verification-and-artifacts-v1": {
+			binding: "prompt_prefix",
+			content: "# Verification and artifacts\n\n- Run relevant verification before submitting. When task facts include `successCriteria`, assess them honestly in the generated verification contract; a fail or skip with evidence is better than a fabricated pass.\n- The registered submit-output tool owns the exact agent submission schema and validation recovery. Use that schema; do not invent a JSON shape in prose.\n- Upload large files, binary files, logs, reports, screenshots, traces, bundles, or datasets before submitting. Include artifact metadata only where the typed submit contract permits it.\n- If the task depends on prior artifacts, list and download the exact referenced artifact before judging or continuing that work.",
+			slug: "verification-and-artifacts-v1"
+		}
+	},
+	recipes: {
+		"run-eval-direct@v1": {
+			description: "Minimal direct context for a short, isolated evaluation run.",
+			fragments: ["run-eval-direct-v1"]
+		},
+		"standard-engineering@v1": {
+			description: "Full opt-in operating guidance for engineering tasks that need diary research, accountable delivery, and verification discipline.",
+			fragments: [
+				"proactive-memory-v1",
+				"task-diary-discipline-v1",
+				"accountable-delivery-v1",
+				"judgment-diary-v1",
+				"verification-and-artifacts-v1"
+			]
+		}
+	}
+};
+function deepFreeze(value) {
+	if (value && typeof value === "object") {
+		for (const key of Object.keys(value)) deepFreeze(value[key]);
+		Object.freeze(value);
+	}
+	return value;
+}
+deepFreeze(RUNTIME_PROFILE_CONTEXT_CATALOGUE);
+Object.freeze(Object.keys(RUNTIME_PROFILE_CONTEXT_CATALOGUE.recipes));
+//#endregion
 //#region ../../libs/tasks/src/runtime-profiles.ts
 var RuntimeProfileName = String$1({
 	minLength: 1,
@@ -4413,6 +4475,16 @@ var RuntimeProfileWorkspaceMode = Union([
 	Literal("shared_mount"),
 	Literal("dedicated_worktree")
 ]);
+/**
+* Tool-policy enforcement mode for the profile's runtime `tool_call` gate:
+* `off` (inert), `watch` (audit only), `enforce` (block disallowed tools,
+* fail-closed). Read by the daemon via `GET /runtime-profiles/:id/allowed-tools`.
+*/
+var RuntimeProfileToolEnforcement = Union([
+	Literal("off"),
+	Literal("watch"),
+	Literal("enforce")
+]);
 var RuntimeProfileAllowedWorkspaceModes = _Array_(RuntimeProfileWorkspaceMode, {
 	minItems: 1,
 	maxItems: 3,
@@ -4601,6 +4673,7 @@ _Object_({
 	maxBatchSize: RuntimeProfileMaxBatchSize,
 	maxTurns: RuntimeProfileMaxTurns,
 	maxBashTimeouts: RuntimeProfileMaxBashTimeouts,
+	toolEnforcement: RuntimeProfileToolEnforcement,
 	requiredEnv: _Array_(RuntimeProfileEnvName, { maxItems: 100 }),
 	requiredTools: _Array_(RuntimeProfileToolName, { maxItems: 100 }),
 	context: _Array_(RuntimeProfileContext, { maxItems: 5 }),
@@ -6464,7 +6537,7 @@ var BUILT_IN_TASK_TYPES = {
 		outputKind: "artifact",
 		resumable: true,
 		workspaceMode: "shared_mount",
-		workspaceScope: "session",
+		workspaceScope: "attempt",
 		sessionScope: "correlation",
 		acceptsInputWorkspaceOverride: true,
 		requiresReferences: false,
@@ -9191,8 +9264,6 @@ var TaskMessageKind = Union([
 var Uuid = String$1({ format: "uuid" });
 var Cid = String$1({ minLength: 1 });
 var IsoTimestamp = String$1({ format: "date-time" });
-var MAX_CLAIM_CONDITION_BRANCHES = 8;
-var MAX_CLAIM_CONDITION_STATUSES = 8;
 /**
 * Daemon-asserted runtime state stamped onto a `TaskAttemptSummary` at
 * attempt-completion time. The server persists this block verbatim and
@@ -9218,14 +9289,14 @@ Unsafe(Cyclic({ ClaimCondition: Unsafe(Union([
 		op: Literal("all"),
 		conditions: _Array_(Ref$1("ClaimCondition"), {
 			minItems: 1,
-			maxItems: MAX_CLAIM_CONDITION_BRANCHES
+			maxItems: 8
 		})
 	}, { additionalProperties: false }),
 	_Object_({
 		op: Literal("any"),
 		conditions: _Array_(Ref$1("ClaimCondition"), {
 			minItems: 1,
-			maxItems: MAX_CLAIM_CONDITION_BRANCHES
+			maxItems: 8
 		})
 	}, { additionalProperties: false }),
 	_Object_({
@@ -9233,7 +9304,7 @@ Unsafe(Cyclic({ ClaimCondition: Unsafe(Union([
 		taskId: Uuid,
 		statuses: _Array_(Ref$1("TaskStatus"), {
 			minItems: 1,
-			maxItems: MAX_CLAIM_CONDITION_STATUSES
+			maxItems: 8
 		})
 	}, { additionalProperties: false }),
 	_Object_({
@@ -9809,6 +9880,11 @@ function createGhCliClient() {
 	};
 }
 //#endregion
+//#region src/lib/daemon-slot-identity.ts
+function createRuntimeInstanceId() {
+	return randomUUID();
+}
+//#endregion
 //#region src/lib/session-files.ts
 function resolveLatestPiSessionPath(sessionDir) {
 	try {
@@ -9879,10 +9955,10 @@ function slugifySessionComponent(input) {
 }
 //#endregion
 //#region src/lib/task-execution-plan.ts
-function buildDaemonTaskExecutionPlan(task, stateDirs, identity, warmSessionTtlSec, runtimeProfileWorkspacePolicy = {}) {
+function buildDaemonTaskExecutionPlan(task, stateDirs, identity, warmSessionTtlSec, runtimeProfileWorkspacePolicy = {}, attemptN) {
 	const descriptor = deriveTaskSessionDescriptor(task);
 	const workspaceMode = resolveTaskWorkspaceMode(task, descriptor.policy, runtimeProfileWorkspacePolicy);
-	const slotKey = warmSessionTtlSec > 0 ? descriptor.sessionKey : null;
+	const slotKey = warmSessionTtlSec > 0 && descriptor.sessionKey ? buildRuntimeSlotKey(descriptor.sessionKey, identity.runtimeInstanceId) : null;
 	const workspaceScope = slotKey !== null ? descriptor.policy.workspaceScope : "attempt";
 	const slotId = slotKey ? buildDaemonSlotId(identity, slotKey) : null;
 	const sessionDir = slotId ? `${stateDirs.piSessionsDir}/${encodeURIComponent(slotId)}` : null;
@@ -9890,7 +9966,8 @@ function buildDaemonTaskExecutionPlan(task, stateDirs, identity, warmSessionTtlS
 	const workspaceId = workspaceMode !== "shared_mount" ? resolveTaskWorkspaceId(task, {
 		sessionKey: slotId,
 		workspaceScope,
-		sessionPersistence: sessionDir ? { sessionDir } : null
+		sessionPersistence: sessionDir ? { sessionDir } : null,
+		attemptN
 	}) : null;
 	return {
 		descriptor,
@@ -9914,6 +9991,12 @@ function buildDaemonSlotId(identity, slotKey) {
 		slotKey
 	].join(":");
 }
+function buildRuntimeSlotKey(logicalSessionKey, runtimeInstanceId) {
+	return runtimeInstanceId ? `${logicalSessionKey}:worker:${slugSlotIdentityComponent(runtimeInstanceId)}` : logicalSessionKey;
+}
+function runtimeSlotKeyBelongsToInstance(slotKey, runtimeInstanceId) {
+	return slotKey.endsWith(`:worker:${slugSlotIdentityComponent(runtimeInstanceId)}`);
+}
 function slugSlotIdentityComponent(input) {
 	return slugifyAsciiLower(input.trim(), 64, [
 		".",
@@ -9968,7 +10051,7 @@ function toDaemonWorkspaceMode(mode) {
 }
 function resolveTaskWorkspaceId(task, executionPlan) {
 	if (executionPlan.workspaceScope === "session" && executionPlan.sessionKey !== null) return `session-${encodeURIComponent(executionPlan.sessionKey)}`;
-	return `task-${task.id}`;
+	return executionPlan.attemptN ? `daemon-task-${task.id}-attempt-${executionPlan.attemptN}` : `task-${task.id}`;
 }
 //#endregion
 //#region src/lib/execution-plan-cache.ts
@@ -9987,7 +10070,7 @@ function createExecutionPlanCache(args) {
 			const key = buildClaimedTaskKey(claimedTask);
 			const existing = cache.get(key);
 			if (existing) return existing;
-			const plan = await maybeAttachWarmSlotContext(claimedTask, buildDaemonTaskExecutionPlan(claimedTask.task, args.stateDirs, args.slotIdentity, args.warmSessionTtlSec, args.workspacePolicy), args.stateDirs, args.slotRegistry, runtimeSessionStore, sourceAttemptResolver);
+			const plan = await maybeAttachWarmSlotContext(claimedTask, buildDaemonTaskExecutionPlan(claimedTask.task, args.stateDirs, args.slotIdentity, args.warmSessionTtlSec, args.workspacePolicy, claimedTask.attemptN), args.stateDirs, args.slotRegistry, runtimeSessionStore, sourceAttemptResolver);
 			assertPlanAllowedByWorkspacePolicy(plan, args.workspacePolicy);
 			cache.set(key, plan);
 			return plan;
@@ -10054,14 +10137,13 @@ async function resolveWarmSlot(slotRegistry, runtimeSessionStore, teamId, source
 	return {
 		kind: "found",
 		producerSlot: producerContext,
-		sessionPath: sourceSessionPath,
-		workspacePath: resolveProducerWorkspaceCopySource(producerContext, stateDirs)
+		sessionPath: sourceSessionPath
 	};
 }
 async function maybeAttachWarmSlotContext(claimedTask, basePlan, stateDirs, slotRegistry, runtimeSessionStore, sourceAttemptResolver) {
 	if (claimedTask.task.taskType === "freeform") {
 		const continueFrom = claimedTask.task.input.continueFrom;
-		if (!continueFrom) return basePlan;
+		if (!continueFrom) return maybeAttachRetrySession(claimedTask, basePlan, stateDirs, slotRegistry, runtimeSessionStore);
 		const resolution = await resolveWarmSlot(slotRegistry, runtimeSessionStore, claimedTask.task.teamId, continueFrom.taskId, continueFrom.attemptN, stateDirs);
 		if (resolution.kind === "missing") throw new ProducerContextResolutionError(`Continuation source task ${continueFrom.taskId} attempt ${continueFrom.attemptN} has no local runtime slot or durable runtime session — claim affinity filter should have prevented this claim`);
 		if (resolution.kind === "no-session-path") throw new ProducerContextResolutionError(`Continuation source attempt ${continueFrom.taskId}/${continueFrom.attemptN} has no persisted Pi session path`);
@@ -10093,7 +10175,7 @@ async function maybeAttachWarmSlotContext(claimedTask, basePlan, stateDirs, slot
 			return {
 				...basePlan,
 				workspaceMode: "dedicated_worktree",
-				workspaceId: recoveredBranch ? `extend-${continueFrom.taskId}-attempt-${continueFrom.attemptN}` : null,
+				workspaceId: recoveredBranch ? buildAttemptWorkspaceId(claimedTask) : null,
 				worktreeBranch: recoveredBranch,
 				sessionPersistence: {
 					sessionDir,
@@ -10122,7 +10204,7 @@ async function maybeAttachWarmSlotContext(claimedTask, basePlan, stateDirs, slot
 		return {
 			...basePlan,
 			workspaceMode: "dedicated_worktree",
-			workspaceId: resolution.producerSlot.workspace?.workspaceId ?? null,
+			workspaceId: parentBranch ? buildAttemptWorkspaceId(claimedTask) : null,
 			worktreeBranch: parentBranch,
 			sessionPersistence: {
 				sessionDir,
@@ -10144,7 +10226,7 @@ async function maybeAttachWarmSlotContext(claimedTask, basePlan, stateDirs, slot
 		worktreeBranch: null,
 		workspaceKind: "scratch",
 		workspaceSeed: {
-			copyFromPath: resolution.workspacePath,
+			copyFromPath: resolveProducerWorkspaceCopySource(resolution.producerSlot, stateDirs),
 			source: "producer"
 		},
 		sessionPersistence: {
@@ -10153,6 +10235,25 @@ async function maybeAttachWarmSlotContext(claimedTask, basePlan, stateDirs, slot
 		}
 	};
 }
+function buildAttemptWorkspaceId(claimedTask) {
+	return `daemon-task-${claimedTask.task.id}-attempt-${claimedTask.attemptN}`;
+}
+async function maybeAttachRetrySession(claimedTask, basePlan, stateDirs, slotRegistry, runtimeSessionStore) {
+	if (claimedTask.attemptN <= 1 || !basePlan.sessionPersistence?.sessionDir) return basePlan;
+	const resolution = await resolveWarmSlot(slotRegistry, runtimeSessionStore, claimedTask.task.teamId, claimedTask.task.id, claimedTask.attemptN - 1, stateDirs);
+	if (resolution.kind === "missing" || resolution.kind === "no-session-path") return basePlan;
+	const sourceSessionDir = dirname(resolution.sessionPath);
+	const targetSessionDir = basePlan.sessionPersistence.sessionDir;
+	if (sourceSessionDir === targetSessionDir) return basePlan;
+	return {
+		...basePlan,
+		worktreeBranch: basePlan.workspaceMode === "dedicated_worktree" && resolution.kind === "found" ? resolution.producerSlot.workspace?.worktreeBranch ?? basePlan.worktreeBranch : basePlan.worktreeBranch,
+		sessionPersistence: {
+			sessionDir: targetSessionDir,
+			forkFromSessionPath: resolution.sessionPath
+		}
+	};
+}
 function buildForkBranch(parentBranch, childTaskId, childAttemptN) {
 	return `${parentBranch}-fork-${childTaskId.slice(0, 8)}-${childAttemptN}`;
 }
@@ -10196,6 +10297,7 @@ var RETRYABLE_CODES = new Set([
 ]);
 var NON_RETRYABLE_CODES = new Set([
 	"bad_api_key",
+	"executor_threw",
 	"invalid_api_key",
 	"invalid_model",
 	"max_turns_exceeded",
@@ -10238,17 +10340,18 @@ var NON_RETRYABLE_MESSAGE_PATTERNS = [
 	/\bmax (?:turn|bash)/i
 ];
 async function classifyAttemptFailure(input) {
-	if (input.remainingAttempts !== null && input.remainingAttempts !== void 0) {
-		if (input.remainingAttempts <= 0) return {
+	const deterministic = classifyDeterministically(input.error);
+	if (input.remainingAttempts !== null && input.remainingAttempts !== void 0 && input.remainingAttempts <= 0) {
+		const deterministicReason = deterministic === "ambiguous" ? "" : ` Deterministic policy classified the failure as ${deterministic}.`;
+		return {
 			error: withRetryInfo(input.error, {
 				retryable: false,
 				source: "attempts_exhausted",
-				reason: `Attempt budget exhausted at attempt ${input.attemptN}${input.maxAttempts ? ` of ${input.maxAttempts}` : ""}.`
+				reason: `Attempt budget exhausted at attempt ${input.attemptN}${input.maxAttempts ? ` of ${input.maxAttempts}` : ""}.${deterministicReason}`
 			}),
 			source: "attempts_exhausted"
 		};
 	}
-	const deterministic = classifyDeterministically(input.error);
 	if (deterministic !== "ambiguous") {
 		const retryable = deterministic === "retryable";
 		const source = input.error.retryable === retryable ? "explicit" : "deterministic";
@@ -10750,6 +10853,7 @@ async function resolveRuntimeProfile(options) {
 		allowedWorkspaceModes: profile.allowedWorkspaceModes,
 		requiredEnv: profile.requiredEnv,
 		requiredTools: profile.requiredTools,
+		toolEnforcement: profile.toolEnforcement,
 		context: profile.context ?? [],
 		sandboxConfig: profile.sandbox,
 		mountPath: resolve(options.cwd),
@@ -10823,6 +10927,269 @@ function createRuntimeProfileRetryTriage(options) {
 	});
 }
 //#endregion
+//#region src/lib/runtime-resource-reaper.ts
+var RUNTIME_SLOT_PAGE_LIMIT = 200;
+var ATTEMPT_LOOKUP_CONCURRENCY = 8;
+var TERMINAL_ATTEMPT_STATUSES = new Set([
+	"completed",
+	"failed",
+	"cancelled",
+	"aborted",
+	"timed_out"
+]);
+/**
+* Reap daemon-owned local resources whose runtime slot is no longer usable.
+* The destructive path is deliberately conservative: uncertainty about slot
+* ownership, attempt state, listing completeness, or real filesystem
+* containment retains resources rather than risking another daemon's data.
+*/
+async function reapRuntimeSlotResources(deps, input) {
+	const now = input.now ?? Date.now();
+	const [activePage, idlePage] = await Promise.all([listOwnedSlots(deps.runtimeSlotStore, input, "active"), listOwnedSlots(deps.runtimeSlotStore, input, "idle")]);
+	const active = activePage.items;
+	const idle = idlePage.items;
+	const slots = [...active, ...idle];
+	const result = {
+		failed: 0,
+		failures: [],
+		removedSessions: 0,
+		removedWorkspaces: 0,
+		scanned: slots.length,
+		truncated: activePage.truncated || idlePage.truncated,
+		unsafePathDetails: [],
+		unsafePaths: 0
+	};
+	const reaped = new Set(idle.filter((item) => item.slot.expiresAtMs <= now).map((item) => item.slot.id));
+	for (const slotId of await findTerminalActiveSlotIds(deps, active, result)) reaped.add(slotId);
+	const retainedSessionDirs = new Set(slots.filter((item) => !reaped.has(item.slot.id)).flatMap((item) => item.session?.sessionDir ? [resolve(item.session.sessionDir)] : []));
+	const retainedWorkspacePaths = new Set(slots.filter((item) => !reaped.has(item.slot.id)).flatMap((item) => item.workspace?.worktreePath ? [resolve(item.workspace.worktreePath)] : []));
+	const worktrees = input.mainWorktree ? await listRegisteredWorktrees(input.mainWorktree) : {
+		kind: "ready",
+		paths: /* @__PURE__ */ new Set()
+	};
+	for (const item of slots) {
+		if (!reaped.has(item.slot.id)) continue;
+		if (!await slotStillQualifiesForReaping(deps, input, item, now, result)) continue;
+		const sessionDir = item.session?.sessionDir;
+		if (sessionDir && !retainedSessionDirs.has(resolve(sessionDir)) && existsSync(sessionDir)) if (!isRealPathInsideRoot(sessionDir, input.sessionRootDir)) recordUnsafePath(deps, result, item.slot.id, sessionDir, input.sessionRootDir);
+		else try {
+			rmSync(sessionDir, {
+				force: true,
+				recursive: true
+			});
+			result.removedSessions++;
+		} catch (err) {
+			recordFailure(deps, result, item.slot.id, sessionDir, input.sessionRootDir, err);
+		}
+		const workspacePath = item.workspace?.worktreePath;
+		if (!workspacePath || retainedWorkspacePaths.has(resolve(workspacePath))) continue;
+		const workspaceRoot = item.workspace?.kind === "scratch" ? input.scratchRootDir : input.mainWorktree ? resolve(input.mainWorktree, ".worktrees") : null;
+		if (!workspaceRoot) {
+			recordUnsafePath(deps, result, item.slot.id, workspacePath, null);
+			continue;
+		}
+		await removeWorkspace(deps, result, worktrees, input.mainWorktree, item.slot.id, workspacePath, workspaceRoot, item.workspace?.kind === "scratch");
+	}
+	if (!result.truncated) await reapLegacyOrphanWorktrees(deps, input, worktrees, retainedSessionDirs, retainedWorkspacePaths, result);
+	return result;
+}
+async function listOwnedSlots(store, input, state) {
+	const listed = await store.listSlots({
+		agentName: input.agentName,
+		limit: RUNTIME_SLOT_PAGE_LIMIT,
+		runtimeProfileId: input.runtimeProfileId,
+		state,
+		teamId: input.teamId
+	});
+	return {
+		items: listed.filter((item) => runtimeSlotKeyBelongsToInstance(item.slot.slotKey, input.runtimeInstanceId)),
+		truncated: listed.length === RUNTIME_SLOT_PAGE_LIMIT
+	};
+}
+async function findTerminalActiveSlotIds(deps, active, result) {
+	const byTask = /* @__PURE__ */ new Map();
+	for (const item of active) {
+		const taskSlots = byTask.get(item.slot.lastTaskId) ?? [];
+		taskSlots.push(item);
+		byTask.set(item.slot.lastTaskId, taskSlots);
+	}
+	const terminal = /* @__PURE__ */ new Set();
+	await mapWithConcurrency([...byTask.entries()], ATTEMPT_LOOKUP_CONCURRENCY, async ([taskId, taskSlots]) => {
+		let attempts;
+		try {
+			attempts = await deps.taskReader.listAttempts(taskId);
+		} catch (err) {
+			recordFailure(deps, result, null, `task:${taskId}`, null, err);
+			return;
+		}
+		for (const item of taskSlots) {
+			const attempt = attempts.find((candidate) => candidate.attemptN === item.slot.lastAttemptN);
+			if (attempt && TERMINAL_ATTEMPT_STATUSES.has(attempt.status)) terminal.add(item.slot.id);
+		}
+	});
+	return terminal;
+}
+async function slotStillQualifiesForReaping(deps, input, original, now, result) {
+	let page;
+	try {
+		page = await listOwnedSlots(deps.runtimeSlotStore, input, original.slot.state);
+	} catch (err) {
+		recordFailure(deps, result, original.slot.id, `slot:${original.slot.id}`, null, err);
+		return false;
+	}
+	const current = page.items.find((candidate) => candidate.slot.id === original.slot.id);
+	if (!current) return false;
+	if (current.slot.lastTaskId !== original.slot.lastTaskId || current.slot.lastAttemptN !== original.slot.lastAttemptN) return false;
+	return current.slot.state === "active" || current.slot.state === "idle" && current.slot.expiresAtMs <= now;
+}
+async function reapLegacyOrphanWorktrees(deps, input, worktrees, retainedSessionDirs, retainedWorkspacePaths, result) {
+	if (!input.mainWorktree) return;
+	const workspaceRoot = resolve(input.mainWorktree, ".worktrees");
+	if (!existsSync(workspaceRoot)) return;
+	let entries;
+	try {
+		entries = readdirSync(workspaceRoot, { withFileTypes: true });
+	} catch (err) {
+		recordFailure(deps, result, null, workspaceRoot, workspaceRoot, err);
+		return;
+	}
+	for (const entry of entries) {
+		if (!entry.isDirectory() || !entry.name.startsWith("session-agent%3A")) continue;
+		const workspacePath = resolve(workspaceRoot, entry.name);
+		if (retainedWorkspacePaths.has(workspacePath)) continue;
+		const sessionDir = resolve(input.sessionRootDir, entry.name.slice(8));
+		if (retainedSessionDirs.has(sessionDir) || existsSync(sessionDir)) continue;
+		await removeWorkspace(deps, result, worktrees, input.mainWorktree, null, workspacePath, workspaceRoot, false);
+	}
+}
+async function removeWorkspace(deps, result, worktrees, mainWorktree, slotId, workspacePath, workspaceRoot, scratch) {
+	if (!existsSync(workspacePath)) return;
+	if (!isRealPathInsideRoot(workspacePath, workspaceRoot)) {
+		recordUnsafePath(deps, result, slotId, workspacePath, workspaceRoot);
+		return;
+	}
+	if (scratch || !mainWorktree) {
+		try {
+			rmSync(workspacePath, {
+				force: true,
+				recursive: true
+			});
+			result.removedWorkspaces++;
+		} catch (err) {
+			recordFailure(deps, result, slotId, workspacePath, workspaceRoot, err);
+		}
+		return;
+	}
+	if (worktrees.kind === "unavailable") {
+		recordFailure(deps, result, slotId, workspacePath, workspaceRoot, new Error(worktrees.reason));
+		return;
+	}
+	try {
+		const canonical = realpathSync(workspacePath);
+		if (worktrees.paths.has(canonical)) {
+			await execFileText("git", [
+				"-C",
+				mainWorktree,
+				"worktree",
+				"remove",
+				"--force",
+				workspacePath
+			]);
+			worktrees.paths.delete(canonical);
+		} else rmSync(workspacePath, {
+			force: true,
+			recursive: true
+		});
+		result.removedWorkspaces++;
+	} catch (err) {
+		recordFailure(deps, result, slotId, workspacePath, workspaceRoot, err);
+	}
+}
+async function listRegisteredWorktrees(mainWorktree) {
+	try {
+		const list = await execFileText("git", [
+			"-C",
+			mainWorktree,
+			"worktree",
+			"list",
+			"--porcelain"
+		]);
+		return {
+			kind: "ready",
+			paths: new Set(list.split("\n").filter((line) => line.startsWith("worktree ")).map((line) => canonicalPath(line.slice(9))))
+		};
+	} catch (err) {
+		return {
+			kind: "unavailable",
+			reason: errorMessage(err)
+		};
+	}
+}
+function isRealPathInsideRoot(path, root) {
+	try {
+		return isResolvedPathInsideRoot$1(realpathSync(path), realpathSync(root));
+	} catch {
+		return false;
+	}
+}
+function isResolvedPathInsideRoot$1(path, root) {
+	const rel = relative(root, path);
+	return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+}
+function canonicalPath(path) {
+	try {
+		return realpathSync(path);
+	} catch {
+		return resolve(path);
+	}
+}
+function recordUnsafePath(deps, result, slotId, path, root) {
+	const issue = {
+		kind: "unsafe_path",
+		path,
+		reason: root === null ? "No daemon-owned root was available for this workspace." : "Candidate or root could not be resolved inside the daemon-owned root.",
+		root,
+		slotId
+	};
+	result.unsafePaths++;
+	result.unsafePathDetails.push(issue);
+	emitIssue(deps, issue);
+}
+function recordFailure(deps, result, slotId, path, root, err) {
+	const issue = {
+		kind: "failure",
+		path,
+		reason: errorMessage(err),
+		root,
+		slotId
+	};
+	result.failed++;
+	result.failures.push(issue);
+	emitIssue(deps, issue);
+}
+function emitIssue(deps, issue) {
+	try {
+		deps.onIssue?.(issue);
+	} catch {}
+}
+function errorMessage(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+async function execFileText(file, args) {
+	return new Promise((resolvePromise, reject) => {
+		execFile(file, args, {
+			encoding: "utf8",
+			maxBuffer: 10 * 1024 * 1024
+		}, (err, stdout) => {
+			if (err) reject(err instanceof Error ? err : /* @__PURE__ */ new Error("Child process failed without an Error instance."));
+			else resolvePromise(stdout);
+		});
+	});
+}
+async function mapWithConcurrency(items, concurrency, worker) {
+	for (let index = 0; index < items.length; index += concurrency) await Promise.all(items.slice(index, index + concurrency).map(worker));
+}
+//#endregion
 //#region src/lib/runtime-sessions.ts
 function resolveRuntimeSessionKind(claimedTask) {
 	const continueFrom = resolveContinueFrom(claimedTask);
@@ -10959,6 +11326,8 @@ function createApiRuntimeSlotStore(args) {
 					lastAttemptN: resolved.slot.lastAttemptN,
 					lastTaskId: resolved.slot.lastTaskId,
 					runtimeProfileId: resolved.slot.runtimeProfileId,
+					slotKey: resolved.slot.slotKey,
+					state: resolved.slot.state,
 					taskType: resolved.slot.taskType
 				},
 				session: resolved.slot.sessionDir ? {
@@ -11130,12 +11499,13 @@ async function runPolling(opts) {
 		agent: ctx.agent,
 		profiles: profileValues,
 		teamId,
-		cwd: process.cwd()
+		cwd: ctx.agentRootDir
 	});
 	for (const profile of profiles) validateRuntimeProfilePrerequisites(profile, cfg.profilePrerequisiteEnv, cfg.profilePrerequisitePath);
 	const slotRegistry = createApiRuntimeSlotStore({ agent: ctx.agent });
 	const runtimeSessionStore = createApiRuntimeSessionStore({ agent: ctx.agent });
 	const sourceAttemptResolver = createApiSourceAttemptResolver({ agent: ctx.agent });
+	const runtimeInstanceId = createRuntimeInstanceId();
 	const runtimes = /* @__PURE__ */ new Map();
 	for (const profile of profiles) {
 		const common = parseCommonOptions(values, { runtimeDefaults: {
@@ -11155,7 +11525,8 @@ async function runPolling(opts) {
 		const stateDirs = ensureDaemonStateDirs(sandbox.rootDir);
 		const slotIdentity = {
 			agentName: common.agent,
-			runtimeProfileId: profile.id
+			runtimeProfileId: profile.id,
+			runtimeInstanceId
 		};
 		const executionPlans = createExecutionPlanCache({
 			stateDirs,
@@ -11263,6 +11634,47 @@ async function runPolling(opts) {
 		piAgentDir: piAgentDir.path,
 		piAgentDirSource: piAgentDir.source
 	}, "agent-daemon.starting");
+	let reaperRunning = false;
+	const reapRuntimeResources = async () => {
+		if (reaperRunning) return;
+		reaperRunning = true;
+		try {
+			for (const profile of profiles) {
+				const selected = requireRuntime(runtimes, profile.id);
+				const result = await reapRuntimeSlotResources({
+					onIssue: (issue) => {
+						rootLogger.warn({
+							...issue,
+							runtimeProfileId: profile.id
+						}, "agent-daemon.runtime_resource_reap_issue");
+					},
+					runtimeSlotStore: slotRegistry,
+					taskReader: ctx.agent.tasks
+				}, {
+					agentName: selected.common.agent,
+					mainWorktree: resolveMainWorktree$1(selected.sandbox.rootDir),
+					runtimeInstanceId,
+					runtimeProfileId: profile.id,
+					sessionRootDir: selected.stateDirs.piSessionsDir,
+					scratchRootDir: join(selected.stateDirs.rootDir, "task-workspaces"),
+					teamId
+				});
+				if (result.removedSessions > 0 || result.removedWorkspaces > 0 || result.failed > 0 || result.unsafePaths > 0 || result.truncated) rootLogger.info({
+					...result,
+					runtimeProfileId: profile.id
+				}, "agent-daemon.runtime_resources_reaped");
+			}
+		} catch (err) {
+			rootLogger.warn({ err }, "agent-daemon.runtime_resource_reap_failed");
+		} finally {
+			reaperRunning = false;
+		}
+	};
+	await reapRuntimeResources();
+	const reaperTimer = setInterval(() => {
+		reapRuntimeResources();
+	}, 6e4);
+	reaperTimer.unref();
 	const outputs = [];
 	try {
 		runtime = new AgentRuntime({
@@ -11440,7 +11852,7 @@ async function runPolling(opts) {
 					sessionDir: executionPlan.sessionPersistence.sessionDir,
 					sessionPath: resolveLatestPiSessionPath(executionPlan.sessionPersistence.sessionDir),
 					workspaceId: executionPlan.workspaceId,
-					worktreePath: resolveRecordedWorkspacePath$1(stateDirs.rootDir, executionPlan),
+					worktreePath: resolveRecordedWorkspacePath$1(stateDirs.rootDir, sandbox.rootDir, executionPlan),
 					worktreeBranch: executionPlan.worktreeBranch,
 					workspaceKind: executionPlan.workspaceKind,
 					lastTaskId: claimedTask.task.id,
@@ -11460,8 +11872,11 @@ async function runPolling(opts) {
 					sandboxConfig: sandbox.config,
 					forwardEnv: profile.requiredEnv,
 					runtimeProfileContext: profile.context,
+					runtimeProfileId: profile.id,
+					toolEnforcement: profile.toolEnforcement,
 					makeExecutionPlan: (task) => executionPlans.getOrCreate(task),
 					makeOnTurnEvent: makeTurnEventHandlerFactory(taskLogger),
+					toolPolicyLogger: taskLogger,
 					maxTurns: common.maxTurns,
 					maxBashTimeouts: common.maxBashTimeouts
 				});
@@ -11493,15 +11908,23 @@ async function runPolling(opts) {
 		rootLogger.info({ processed: drained.length }, "agent-daemon.drained");
 		return drained.some((o) => o.status !== "completed") ? 1 : 0;
 	} finally {
+		clearInterval(reaperTimer);
 		signalHandlers.dispose();
 		await slotRegistry.close();
 		await otelShutdown();
 		await shutdownLogger();
 	}
 }
-function resolveRecordedWorkspacePath$1(stateRootDir, executionPlan) {
+function resolveRecordedWorkspacePath$1(stateRootDir, mountPath, executionPlan) {
 	if (!executionPlan.workspaceId) return null;
-	return executionPlan.workspaceMode === "scratch_mount" ? join(stateRootDir, "task-workspaces", executionPlan.workspaceId) : join(findMainWorktree(), ".worktrees", executionPlan.workspaceId);
+	return executionPlan.workspaceMode === "scratch_mount" ? join(stateRootDir, "task-workspaces", executionPlan.workspaceId) : join(findMainWorktree(mountPath), ".worktrees", executionPlan.workspaceId);
+}
+function resolveMainWorktree$1(mountPath) {
+	try {
+		return findMainWorktree(mountPath);
+	} catch {
+		return null;
+	}
 }
 function runtimeForClaimedTask(runtimes, claimedTask) {
 	if (!claimedTask.profileId) throw new Error(`Claimed task ${claimedTask.task.id} did not include a selected runtime profile`);
@@ -11593,7 +12016,7 @@ async function runOnce(argv) {
 		agent: ctx.agent,
 		profile: values.profile,
 		teamId: values.team,
-		cwd: process.cwd()
+		cwd: ctx.agentRootDir
 	});
 	validateRuntimeProfilePrerequisites(profile, cfg.profilePrerequisiteEnv, cfg.profilePrerequisitePath);
 	opts = parseCommonOptions(values, { runtimeDefaults: {
@@ -11615,9 +12038,11 @@ async function runOnce(argv) {
 	const slotRegistry = createApiRuntimeSlotStore({ agent: ctx.agent });
 	const runtimeSessionStore = createApiRuntimeSessionStore({ agent: ctx.agent });
 	const sourceAttemptResolver = createApiSourceAttemptResolver({ agent: ctx.agent });
+	const runtimeInstanceId = createRuntimeInstanceId();
 	const slotIdentity = {
 		agentName: opts.agent,
-		runtimeProfileId: profile.id
+		runtimeProfileId: profile.id,
+		runtimeInstanceId
 	};
 	const executionPlans = createExecutionPlanCache({
 		stateDirs,
@@ -11679,6 +12104,26 @@ async function runOnce(argv) {
 		piAgentDir: piAgentDir.path,
 		piAgentDirSource: piAgentDir.source
 	}, "agent-daemon.starting");
+	try {
+		const reaped = await reapRuntimeSlotResources({
+			onIssue: (issue) => {
+				rootLogger.warn(issue, "agent-daemon.runtime_resource_reap_issue");
+			},
+			runtimeSlotStore: slotRegistry,
+			taskReader: ctx.agent.tasks
+		}, {
+			agentName: opts.agent,
+			mainWorktree: resolveMainWorktree(sandbox.rootDir),
+			runtimeInstanceId,
+			runtimeProfileId: profile.id,
+			sessionRootDir: stateDirs.piSessionsDir,
+			scratchRootDir: join(stateDirs.rootDir, "task-workspaces"),
+			teamId: profile.teamId
+		});
+		if (reaped.removedSessions > 0 || reaped.removedWorkspaces > 0 || reaped.failed > 0 || reaped.unsafePaths > 0 || reaped.truncated) rootLogger.info(reaped, "agent-daemon.runtime_resources_reaped");
+	} catch (err) {
+		rootLogger.warn({ err }, "agent-daemon.runtime_resource_reap_failed");
+	}
 	let runtime = null;
 	let activeAttemptN = null;
 	const signalHandlers = installShutdownSignalHandlers({
@@ -11720,8 +12165,11 @@ async function runOnce(argv) {
 			sandboxConfig: sandbox.config,
 			forwardEnv: profile.requiredEnv,
 			runtimeProfileContext: profile.context,
+			runtimeProfileId: profile.id,
+			toolEnforcement: profile.toolEnforcement,
 			makeExecutionPlan: (claimedTask) => executionPlans.getOrCreate(claimedTask),
 			onTurnEvent: makeTurnEventHandler(rootLogger, { taskId }),
+			toolPolicyLogger: rootLogger,
 			maxTurns: opts.maxTurns,
 			maxBashTimeouts: opts.maxBashTimeouts
 		});
@@ -11765,7 +12213,7 @@ async function runOnce(argv) {
 				sessionDir: executionPlan.sessionPersistence.sessionDir,
 				sessionPath: resolveLatestPiSessionPath(executionPlan.sessionPersistence.sessionDir),
 				workspaceId: executionPlan.workspaceId,
-				worktreePath: resolveRecordedWorkspacePath(stateDirs.rootDir, executionPlan),
+				worktreePath: resolveRecordedWorkspacePath(stateDirs.rootDir, sandbox.rootDir, executionPlan),
 				worktreeBranch: executionPlan.worktreeBranch,
 				workspaceKind: executionPlan.workspaceKind,
 				lastTaskId: claimedTask.task.id,
@@ -11861,9 +12309,16 @@ async function runOnce(argv) {
 		await shutdownLogger();
 	}
 }
-function resolveRecordedWorkspacePath(stateRootDir, executionPlan) {
+function resolveRecordedWorkspacePath(stateRootDir, mountPath, executionPlan) {
 	if (!executionPlan.workspaceId) return null;
-	return executionPlan.workspaceMode === "scratch_mount" ? join(stateRootDir, "task-workspaces", executionPlan.workspaceId) : join(findMainWorktree(), ".worktrees", executionPlan.workspaceId);
+	return executionPlan.workspaceMode === "scratch_mount" ? join(stateRootDir, "task-workspaces", executionPlan.workspaceId) : join(findMainWorktree(mountPath), ".worktrees", executionPlan.workspaceId);
+}
+function resolveMainWorktree(mountPath) {
+	try {
+		return findMainWorktree(mountPath);
+	} catch {
+		return null;
+	}
 }
 //#endregion
 //#region src/cli/poll.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/agent-daemon",
-  "version": "0.31.1",
+  "version": "0.32.1",
   "license": "AGPL-3.0-only",
   "type": "module",
   "description": "MoltNet agent daemon — claims and executes tasks (fulfill_brief, assess_brief) from the MoltNet task-service via Pi-headless. CLI: moltnet-agent.",
@@ -51,9 +51,9 @@
     "@opentelemetry/semantic-conventions": "^1.39.0",
     "pino": "^10.3.1",
     "pino-pretty": "^13.1.3",
-    "@themoltnet/agent-runtime": "0.36.5",
-    "@themoltnet/sdk": "0.126.0",
-    "@themoltnet/pi-extension": "0.35.5"
+    "@themoltnet/agent-runtime": "0.36.6",
+    "@themoltnet/sdk": "0.127.0",
+    "@themoltnet/pi-extension": "0.36.1"
   },
   "devDependencies": {
     "tsx": "^4.7.0",
@@ -61,9 +61,9 @@
     "vite": "^8.0.0",
     "vitest": "^3.0.0",
     "@moltnet/bootstrap": "0.1.0",
+    "@moltnet/crypto-service": "0.1.0",
     "@moltnet/tasks": "0.1.0",
-    "@moltnet/observability": "0.1.0",
-    "@moltnet/crypto-service": "0.1.0"
+    "@moltnet/observability": "0.1.0"
   },
   "nx": {
     "projectType": "application",