@themoltnet/agent-daemon 0.35.0 → 0.36.0

package/dist/cli.js

@@ -253,7 +253,7 @@ var RUNTIME_PROFILE_CONTEXT_CATALOGUE = {
 	fragments: {
 		"artifact-planner-v1": {
 			binding: "prompt_prefix",
-			content: "# Bounded artifact planner\n\n- The typed task facts, embedded bounded manifest, exact bound artifact references, registered tools, and runtime capability section are the complete contract. Do not search diaries, inspect a mounted repository, enumerate unrelated tasks or artifacts, use shell commands, modify files, commit, branch, push, or contact GitHub.\n- Read only the exact artifact CIDs named by the task, and only when the embedded manifest does not provide enough evidence. Never paginate or discover artifacts speculatively.\n- Perform semantic classification and planning from supplied content and producer/consumer evidence. Do not substitute filename, directory, language, ecosystem, or repository-specific exclusion rules for evidence.\n- Return exactly the requested versioned structured plan through the registered submit-output tool. Do not emit a second prose or JSON representation.",
+			content: "# Bounded artifact planner\n\n- The typed task facts, embedded bounded manifest, exact bound artifact references, registered tools, and runtime capability section are the complete contract. Do not search diaries, inspect a mounted repository, enumerate unrelated tasks or artifacts, modify a checkout, commit, branch, push, or contact GitHub.\n- Read only the exact artifact CIDs named by the task, and only when the embedded manifest does not provide enough evidence. Use the registered task-artifact tools for artifact access; never use shell or CLI wrappers to fetch artifacts, paginate, or discover them speculatively.\n- If the effective runtime exposes a local calculator or shell, use it only inside scratch for coverage accounting, budget arithmetic, and JSON validation. The runtime capability section and policy are authoritative; do not assume a static executable list.\n- Perform semantic classification and planning from supplied content and producer/consumer evidence. Do not substitute filename, directory, language, ecosystem, or repository-specific exclusion rules for evidence.\n- Write and upload exactly the requested versioned plan artifact, then reference its returned metadata through the registered submit-output tool. Do not emit a second prose or JSON representation.",
 			slug: "artifact-planner-v1"
 		},
 		"accountable-delivery-v1": {
@@ -283,7 +283,7 @@ var RUNTIME_PROFILE_CONTEXT_CATALOGUE = {
 		},
 		"verification-and-artifacts-v1": {
 			binding: "prompt_prefix",
-			content: "# Verification and artifacts\n\n- Run relevant verification before submitting. When task facts include `successCriteria`, assess them honestly in the generated verification contract; a fail or skip with evidence is better than a fabricated pass.\n- The registered submit-output tool owns the exact agent submission schema and validation recovery. Use that schema; do not invent a JSON shape in prose.\n- Upload large files, binary files, logs, reports, screenshots, traces, bundles, or datasets before submitting. Include artifact metadata only where the typed submit contract permits it.\n- If the task depends on prior artifacts, list and download the exact referenced artifact before judging or continuing that work.",
+			content: "# Verification and artifacts\n\n- Run relevant verification before submitting. When task facts include `successCriteria`, assess them honestly in the generated verification contract; a fail or skip with evidence is better than a fabricated pass.\n- The registered submit-output tool owns the exact agent submission schema and validation recovery. Use that schema; do not invent a JSON shape in prose.\n- Upload only task-relevant artifacts, and inspect each before uploading. Never upload secrets, credentials, API keys, auth tokens or headers, .env files, or personal or customer data; redact sensitive values, and prefer minimal, sanitized excerpts over whole logs, bundles, or datasets. Include artifact metadata only where the typed submit contract permits it.\n- If the task depends on prior artifacts, list and download the exact referenced artifact before judging or continuing that work.",
 			slug: "verification-and-artifacts-v1"
 		}
 	},
@@ -2538,11 +2538,14 @@ var CuratePackOutput = Type.Object({
 //#endregion
 //#region ../../libs/tasks/src/task-types/freeform.ts
 var FREEFORM_TYPE = "freeform";
-var FreeformExecutionOptions = Type.Object({ workspace: Type.Optional(Type.Union([
-	Type.Literal("none"),
-	Type.Literal("shared_mount"),
-	Type.Literal("dedicated_worktree")
-])) }, {
+var FreeformExecutionOptions = Type.Object({
+	workspace: Type.Optional(Type.Union([
+		Type.Literal("none"),
+		Type.Literal("shared_mount"),
+		Type.Literal("dedicated_worktree")
+	])),
+	revision: Type.Optional(Type.String({ pattern: "^[0-9a-fA-F]{40}$" }))
+}, {
 	$id: "FreeformExecutionOptions",
 	additionalProperties: false
 });
@@ -2628,6 +2631,12 @@ var FreeformOutput = Type.Object({
 * are sequential preconditions, later ones presume earlier ones hold.
 */
 async function validateFreeformInputAsync(input, ctx) {
+	const execution = input.execution;
+	if (execution?.revision && execution.workspace === "none") return [{
+		field: "input/execution/revision",
+		message: "execution.revision requires a repository workspace; use shared_mount or dedicated_worktree",
+		code: "freeform.executionRevisionRequiresRepository"
+	}];
 	const cf = input.continueFrom;
 	if (!cf) return [];
 	const source = await ctx.resolveTask(cf.taskId);
@@ -2641,11 +2650,16 @@ async function validateFreeformInputAsync(input, ctx) {
 		message: `Source task type '${source.taskType}' is not continuable; only freeform → freeform is supported in v1`,
 		code: "freeform.sourceTaskTypeNotSupported"
 	}];
-	if (input.execution?.workspace) return [{
+	if (execution?.workspace) return [{
 		field: "input/execution/workspace",
 		message: "execution.workspace is derived from parent runtime context when continueFrom is set; omit it",
 		code: "freeform.executionWorkspaceNotInheritable"
 	}];
+	if (execution?.revision) return [{
+		field: "input/execution/revision",
+		message: "execution.revision is derived from parent runtime context when continueFrom is set; omit it",
+		code: "freeform.executionRevisionNotInheritable"
+	}];
 	if (ctx.deferReadinessChecks) return [];
 	const attempt = (await ctx.listAttempts(cf.taskId)).find((a) => a.attemptN === cf.attemptN);
 	if (!attempt || attempt.status !== "completed") return [{
@@ -4246,6 +4260,7 @@ function buildDaemonTaskExecutionPlan(task, stateDirs, identity, warmSessionTtlS
 	const slotId = slotKey ? buildDaemonSlotId(identity, slotKey) : null;
 	const sessionDir = slotId ? `${stateDirs.piSessionsDir}/${boundedKeyDirComponent(slotId)}` : null;
 	const worktreeBranch = resolveTaskWorktreeBranch(task, workspaceMode);
+	const workspaceRevision = resolveTaskWorkspaceRevision(task.input);
 	const workspaceId = workspaceMode !== "shared_mount" ? resolveTaskWorkspaceId(task, {
 		sessionKey: slotId,
 		workspaceScope,
@@ -4261,9 +4276,14 @@ function buildDaemonTaskExecutionPlan(task, stateDirs, identity, warmSessionTtlS
 		workspaceScope,
 		sessionPersistence: sessionDir ? { sessionDir } : null,
 		workspaceId,
-		worktreeBranch
+		worktreeBranch,
+		workspaceRevision
 	};
 }
+function resolveTaskWorkspaceRevision(input) {
+	const value = input?.execution?.revision;
+	return typeof value === "string" && /^[0-9a-fA-F]{40}$/.test(value) ? value.toLowerCase() : null;
+}
 function buildDaemonSlotId(identity, slotKey) {
 	return [
 		"agent",
@@ -4289,6 +4309,7 @@ function slugSlotIdentityComponent(input) {
 }
 function resolveTaskWorktreeBranch(task, workspaceMode) {
 	if (workspaceMode !== "dedicated_worktree") return null;
+	if (typeof task.input.execution?.revision === "string") return null;
 	if (task.taskType === "fulfill_brief") {
 		const input = task.input;
 		const slug = slugifyAsciiLower(typeof task.title === "string" && task.title.trim().length > 0 ? task.title : typeof input.brief === "string" && input.brief.trim().length > 0 ? input.brief : task.taskType, 60) || "task";
@@ -4383,9 +4404,14 @@ function createExecutionPlanCache(args) {
 	};
 }
 function createNullSourceAttemptResolver() {
-	return { findOutputBranch() {
-		return Promise.resolve(null);
-	} };
+	return {
+		findOutputBranch() {
+			return Promise.resolve(null);
+		},
+		findInputRevision() {
+			return Promise.resolve(null);
+		}
+	};
 }
 function createNullRuntimeSessionStore() {
 	return {
@@ -4409,7 +4435,7 @@ function assertPlanAllowedByWorkspacePolicy(plan, policy) {
 }
 function planToRuntimeProfileWorkspaceMode(plan) {
 	if (plan.workspaceMode === "scratch_mount") return "none";
-	if (plan.workspaceMode === "dedicated_worktree" && !plan.worktreeBranch) return "shared_mount";
+	if (plan.workspaceMode === "dedicated_worktree" && !plan.worktreeBranch && !plan.workspaceRevision) return "shared_mount";
 	return plan.workspaceMode;
 }
 function buildClaimedTaskKey(task) {
@@ -4455,16 +4481,20 @@ async function maybeAttachWarmSlotContext(claimedTask, basePlan, stateDirs, slot
 				attemptN: continueFrom.attemptN,
 				taskId: continueFrom.taskId
 			});
+			const recoveredRevision = recoveredBranch ? null : await sourceAttemptResolver.findInputRevision({
+				attemptN: continueFrom.attemptN,
+				taskId: continueFrom.taskId
+			});
 			if (continueFrom.mode === "fork") {
-				if (recoveredBranch) {
+				if (recoveredBranch || recoveredRevision) {
 					const forkWorkspaceId = `fork-${claimedTask.task.id}-attempt-${claimedTask.attemptN}`;
-					const forkBranch = buildForkBranch(recoveredBranch, claimedTask.task.id, claimedTask.attemptN);
+					const forkBranch = buildForkBranch(recoveredBranch ?? `detached-${continueFrom.taskId.slice(0, 8)}`, claimedTask.task.id, claimedTask.attemptN);
 					return {
 						...basePlan,
 						workspaceMode: "dedicated_worktree",
 						workspaceId: forkWorkspaceId,
 						worktreeBranch: forkBranch,
-						worktreeBaseRef: recoveredBranch,
+						worktreeBaseRef: recoveredBranch ?? recoveredRevision,
 						workspaceKind: "fork",
 						sessionPersistence: {
 							sessionDir,
@@ -4474,11 +4504,13 @@ async function maybeAttachWarmSlotContext(claimedTask, basePlan, stateDirs, slot
 				}
 				throw new ProducerContextResolutionError(`Cannot fork continuation of ${continueFrom.taskId}/${continueFrom.attemptN}: durable runtime session is available but the source attempt output did not report a branch`);
 			}
+			const hasDedicatedWorkspace = Boolean(recoveredBranch || recoveredRevision);
 			return {
 				...basePlan,
-				workspaceMode: "dedicated_worktree",
-				workspaceId: recoveredBranch ? buildAttemptWorkspaceId(claimedTask) : null,
+				workspaceMode: hasDedicatedWorkspace ? "dedicated_worktree" : "shared_mount",
+				workspaceId: hasDedicatedWorkspace ? buildAttemptWorkspaceId(claimedTask) : null,
 				worktreeBranch: recoveredBranch,
+				workspaceRevision: recoveredRevision,
 				sessionPersistence: {
 					sessionDir,
 					forkFromSessionPath: resolution.sessionPath
@@ -4486,16 +4518,20 @@ async function maybeAttachWarmSlotContext(claimedTask, basePlan, stateDirs, slot
 			};
 		}
 		const parentBranch = resolution.producerSlot.workspace?.worktreeBranch ?? null;
+		const parentRevision = parentBranch ? null : await sourceAttemptResolver.findInputRevision({
+			attemptN: continueFrom.attemptN,
+			taskId: continueFrom.taskId
+		});
 		if (continueFrom.mode === "fork") {
-			if (!parentBranch) throw new ProducerContextResolutionError(`Cannot fork continuation of ${continueFrom.taskId}/${continueFrom.attemptN}: producer slot has no worktree branch to fork from`);
+			if (!parentBranch && !parentRevision) throw new ProducerContextResolutionError(`Cannot fork continuation of ${continueFrom.taskId}/${continueFrom.attemptN}: producer slot has no worktree branch or immutable revision to fork from`);
 			const forkWorkspaceId = `fork-${claimedTask.task.id}-attempt-${claimedTask.attemptN}`;
-			const forkBranch = buildForkBranch(parentBranch, claimedTask.task.id, claimedTask.attemptN);
+			const forkBranch = buildForkBranch(parentBranch ?? `detached-${continueFrom.taskId.slice(0, 8)}`, claimedTask.task.id, claimedTask.attemptN);
 			return {
 				...basePlan,
 				workspaceMode: "dedicated_worktree",
 				workspaceId: forkWorkspaceId,
 				worktreeBranch: forkBranch,
-				worktreeBaseRef: parentBranch,
+				worktreeBaseRef: parentBranch ?? parentRevision,
 				workspaceKind: "fork",
 				sessionPersistence: {
 					sessionDir,
@@ -4503,11 +4539,13 @@ async function maybeAttachWarmSlotContext(claimedTask, basePlan, stateDirs, slot
 				}
 			};
 		}
+		const hasDedicatedWorkspace = Boolean(parentBranch || parentRevision);
 		return {
 			...basePlan,
-			workspaceMode: "dedicated_worktree",
-			workspaceId: parentBranch ? buildAttemptWorkspaceId(claimedTask) : null,
+			workspaceMode: hasDedicatedWorkspace ? "dedicated_worktree" : "shared_mount",
+			workspaceId: hasDedicatedWorkspace ? buildAttemptWorkspaceId(claimedTask) : null,
 			worktreeBranch: parentBranch,
+			workspaceRevision: parentRevision,
 			sessionPersistence: {
 				sessionDir,
 				forkFromSessionPath: resolution.sessionPath
@@ -5702,11 +5740,18 @@ function signalExitCode(signal) {
 //#region src/lib/source-attempts.ts
 function createApiSourceAttemptResolver(args) {
 	const { agent } = args;
-	return { async findOutputBranch(input) {
-		const attempt = (await agent.tasks.listAttempts(input.taskId)).find((candidate) => candidate.attemptN === input.attemptN);
-		if (!attempt || attempt.status !== "completed") return null;
-		return resolveOutputBranch(attempt.output);
-	} };
+	return {
+		async findOutputBranch(input) {
+			const attempt = (await agent.tasks.listAttempts(input.taskId)).find((candidate) => candidate.attemptN === input.attemptN);
+			if (!attempt || attempt.status !== "completed") return null;
+			return resolveOutputBranch(attempt.output);
+		},
+		async findInputRevision(input) {
+			const task = await agent.tasks.get(input.taskId);
+			if (task.status !== "completed" || task.acceptedAttemptN !== input.attemptN) return null;
+			return resolveTaskWorkspaceRevision(task.input);
+		}
+	};
 }
 function resolveOutputBranch(output) {
 	if (!output || typeof output !== "object") return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/agent-daemon",
-  "version": "0.35.0",
+  "version": "0.36.0",
   "license": "AGPL-3.0-only",
   "type": "module",
   "description": "Universal MoltNet agent daemon host with a built-in Pi/Gondolin runtime and support for trusted operator-owned runtime modules. CLI: moltnet-agent.",
@@ -62,8 +62,8 @@
     "pino": "^10.3.1",
     "pino-pretty": "^13.1.3",
     "typebox": "^1.2.8",
-    "@themoltnet/agent-runtime": "0.39.1",
-    "@themoltnet/pi-runtime": "0.5.0",
+    "@themoltnet/pi-runtime": "0.6.0",
+    "@themoltnet/agent-runtime": "0.40.0",
     "@themoltnet/sdk": "0.128.0"
   },
   "devDependencies": {
@@ -74,8 +74,8 @@
     "vitest": "^3.0.0",
     "@moltnet/bootstrap": "0.1.0",
     "@moltnet/crypto-service": "0.1.0",
-    "@moltnet/observability": "0.1.0",
-    "@moltnet/tasks": "0.1.0"
+    "@moltnet/tasks": "0.1.0",
+    "@moltnet/observability": "0.1.0"
   },
   "nx": {
     "projectType": "application",