@themoltnet/agent-daemon 0.35.0 → 0.37.0

package/README.md

@@ -94,6 +94,16 @@ fails fast if the key is rejected, is not an agent, or is bound to a different
 team. See
 [Run the daemon with an agent key](../../docs/operate/running-agents.md#run-the-daemon-with-an-agent-key).
 
+An agent key used by the daemon needs this least-privilege scope set:
+
+```text
+agent:profile runtime:read task:read task:claim task:execute
+```
+
+The Console selects these five scopes by default. Broader key, diary, pack,
+team-management, and runtime-management scopes are not required for normal
+daemon operation.
+
 ### Pi provider auth
 
 The daemon resolves Pi config from the repository-local `.pi` directory by

package/dist/cli.js

@@ -253,7 +253,7 @@ var RUNTIME_PROFILE_CONTEXT_CATALOGUE = {
 	fragments: {
 		"artifact-planner-v1": {
 			binding: "prompt_prefix",
-			content: "# Bounded artifact planner\n\n- The typed task facts, embedded bounded manifest, exact bound artifact references, registered tools, and runtime capability section are the complete contract. Do not search diaries, inspect a mounted repository, enumerate unrelated tasks or artifacts, use shell commands, modify files, commit, branch, push, or contact GitHub.\n- Read only the exact artifact CIDs named by the task, and only when the embedded manifest does not provide enough evidence. Never paginate or discover artifacts speculatively.\n- Perform semantic classification and planning from supplied content and producer/consumer evidence. Do not substitute filename, directory, language, ecosystem, or repository-specific exclusion rules for evidence.\n- Return exactly the requested versioned structured plan through the registered submit-output tool. Do not emit a second prose or JSON representation.",
+			content: "# Bounded artifact planner\n\n- The typed task facts, embedded bounded manifest, exact bound artifact references, registered tools, and runtime capability section are the complete contract. Do not search diaries, inspect a mounted repository, enumerate unrelated tasks or artifacts, modify a checkout, commit, branch, push, or contact GitHub.\n- Read only the exact artifact CIDs named by the task, and only when the embedded manifest does not provide enough evidence. Use the registered task-artifact tools for artifact access; never use shell or CLI wrappers to fetch artifacts, paginate, or discover them speculatively.\n- If the effective runtime exposes a local calculator or shell, use it only inside scratch for coverage accounting, budget arithmetic, and JSON validation. The runtime capability section and policy are authoritative; do not assume a static executable list.\n- Perform semantic classification and planning from supplied content and producer/consumer evidence. Do not substitute filename, directory, language, ecosystem, or repository-specific exclusion rules for evidence.\n- Write and upload exactly the requested versioned plan artifact, then reference its returned metadata through the registered submit-output tool. Do not emit a second prose or JSON representation.",
 			slug: "artifact-planner-v1"
 		},
 		"accountable-delivery-v1": {
@@ -283,7 +283,7 @@ var RUNTIME_PROFILE_CONTEXT_CATALOGUE = {
 		},
 		"verification-and-artifacts-v1": {
 			binding: "prompt_prefix",
-			content: "# Verification and artifacts\n\n- Run relevant verification before submitting. When task facts include `successCriteria`, assess them honestly in the generated verification contract; a fail or skip with evidence is better than a fabricated pass.\n- The registered submit-output tool owns the exact agent submission schema and validation recovery. Use that schema; do not invent a JSON shape in prose.\n- Upload large files, binary files, logs, reports, screenshots, traces, bundles, or datasets before submitting. Include artifact metadata only where the typed submit contract permits it.\n- If the task depends on prior artifacts, list and download the exact referenced artifact before judging or continuing that work.",
+			content: "# Verification and artifacts\n\n- Run relevant verification before submitting. When task facts include `successCriteria`, assess them honestly in the generated verification contract; a fail or skip with evidence is better than a fabricated pass.\n- The registered submit-output tool owns the exact agent submission schema and validation recovery. Use that schema; do not invent a JSON shape in prose.\n- Upload only task-relevant artifacts, and inspect each before uploading. Never upload secrets, credentials, API keys, auth tokens or headers, .env files, or personal or customer data; redact sensitive values, and prefer minimal, sanitized excerpts over whole logs, bundles, or datasets. Include artifact metadata only where the typed submit contract permits it.\n- If the task depends on prior artifacts, list and download the exact referenced artifact before judging or continuing that work.",
 			slug: "verification-and-artifacts-v1"
 		}
 	},
@@ -318,6 +318,46 @@ function deepFreeze(value) {
 deepFreeze(RUNTIME_PROFILE_CONTEXT_CATALOGUE);
 Object.freeze(Object.keys(RUNTIME_PROFILE_CONTEXT_CATALOGUE.recipes));
 //#endregion
+//#region ../../libs/models/src/credential-scopes.ts
+var CREDENTIAL_SCOPES = {
+	AgentProfile: "agent:profile",
+	ConnectorInvoke: "connector:invoke",
+	CryptoSign: "crypto:sign",
+	DiaryManage: "diary:manage",
+	DiaryRead: "diary:read",
+	DiaryWrite: "diary:write",
+	HumanProfile: "human:profile",
+	KeyManage: "key:manage",
+	PackRead: "pack:read",
+	PackWrite: "pack:write",
+	RuntimeManage: "runtime:manage",
+	RuntimeRead: "runtime:read",
+	TaskClaim: "task:claim",
+	TaskExecute: "task:execute",
+	TaskManage: "task:manage",
+	TaskRead: "task:read",
+	TeamManage: "team:manage",
+	TeamRead: "team:read"
+};
+var ALL_CREDENTIAL_SCOPES = Object.freeze(Object.values(CREDENTIAL_SCOPES));
+CREDENTIAL_SCOPES.AgentProfile, CREDENTIAL_SCOPES.RuntimeRead, CREDENTIAL_SCOPES.TaskRead, CREDENTIAL_SCOPES.TaskClaim, CREDENTIAL_SCOPES.TaskExecute;
+Object.freeze(ALL_CREDENTIAL_SCOPES.filter((scope) => scope !== CREDENTIAL_SCOPES.HumanProfile));
+[
+	CREDENTIAL_SCOPES.AgentProfile,
+	CREDENTIAL_SCOPES.CryptoSign,
+	CREDENTIAL_SCOPES.DiaryManage,
+	CREDENTIAL_SCOPES.DiaryRead,
+	CREDENTIAL_SCOPES.DiaryWrite,
+	CREDENTIAL_SCOPES.HumanProfile,
+	CREDENTIAL_SCOPES.PackRead,
+	CREDENTIAL_SCOPES.PackWrite,
+	CREDENTIAL_SCOPES.TaskExecute,
+	CREDENTIAL_SCOPES.TaskManage,
+	CREDENTIAL_SCOPES.TaskRead,
+	CREDENTIAL_SCOPES.TeamManage,
+	CREDENTIAL_SCOPES.TeamRead
+].filter((scope) => scope !== CREDENTIAL_SCOPES.HumanProfile);
+//#endregion
 //#region ../../libs/models/src/preview-sign.ts
 function schemaRef$1(schema, id) {
 	return Type.Unsafe(Type.Ref(id));
@@ -2538,11 +2578,14 @@ var CuratePackOutput = Type.Object({
 //#endregion
 //#region ../../libs/tasks/src/task-types/freeform.ts
 var FREEFORM_TYPE = "freeform";
-var FreeformExecutionOptions = Type.Object({ workspace: Type.Optional(Type.Union([
-	Type.Literal("none"),
-	Type.Literal("shared_mount"),
-	Type.Literal("dedicated_worktree")
-])) }, {
+var FreeformExecutionOptions = Type.Object({
+	workspace: Type.Optional(Type.Union([
+		Type.Literal("none"),
+		Type.Literal("shared_mount"),
+		Type.Literal("dedicated_worktree")
+	])),
+	revision: Type.Optional(Type.String({ pattern: "^[0-9a-fA-F]{40}$" }))
+}, {
 	$id: "FreeformExecutionOptions",
 	additionalProperties: false
 });
@@ -2628,6 +2671,12 @@ var FreeformOutput = Type.Object({
 * are sequential preconditions, later ones presume earlier ones hold.
 */
 async function validateFreeformInputAsync(input, ctx) {
+	const execution = input.execution;
+	if (execution?.revision && execution.workspace === "none") return [{
+		field: "input/execution/revision",
+		message: "execution.revision requires a repository workspace; use shared_mount or dedicated_worktree",
+		code: "freeform.executionRevisionRequiresRepository"
+	}];
 	const cf = input.continueFrom;
 	if (!cf) return [];
 	const source = await ctx.resolveTask(cf.taskId);
@@ -2641,11 +2690,16 @@ async function validateFreeformInputAsync(input, ctx) {
 		message: `Source task type '${source.taskType}' is not continuable; only freeform → freeform is supported in v1`,
 		code: "freeform.sourceTaskTypeNotSupported"
 	}];
-	if (input.execution?.workspace) return [{
+	if (execution?.workspace) return [{
 		field: "input/execution/workspace",
 		message: "execution.workspace is derived from parent runtime context when continueFrom is set; omit it",
 		code: "freeform.executionWorkspaceNotInheritable"
 	}];
+	if (execution?.revision) return [{
+		field: "input/execution/revision",
+		message: "execution.revision is derived from parent runtime context when continueFrom is set; omit it",
+		code: "freeform.executionRevisionNotInheritable"
+	}];
 	if (ctx.deferReadinessChecks) return [];
 	const attempt = (await ctx.listAttempts(cf.taskId)).find((a) => a.attemptN === cf.attemptN);
 	if (!attempt || attempt.status !== "completed") return [{
@@ -4246,6 +4300,7 @@ function buildDaemonTaskExecutionPlan(task, stateDirs, identity, warmSessionTtlS
 	const slotId = slotKey ? buildDaemonSlotId(identity, slotKey) : null;
 	const sessionDir = slotId ? `${stateDirs.piSessionsDir}/${boundedKeyDirComponent(slotId)}` : null;
 	const worktreeBranch = resolveTaskWorktreeBranch(task, workspaceMode);
+	const workspaceRevision = resolveTaskWorkspaceRevision(task.input);
 	const workspaceId = workspaceMode !== "shared_mount" ? resolveTaskWorkspaceId(task, {
 		sessionKey: slotId,
 		workspaceScope,
@@ -4261,9 +4316,14 @@ function buildDaemonTaskExecutionPlan(task, stateDirs, identity, warmSessionTtlS
 		workspaceScope,
 		sessionPersistence: sessionDir ? { sessionDir } : null,
 		workspaceId,
-		worktreeBranch
+		worktreeBranch,
+		workspaceRevision
 	};
 }
+function resolveTaskWorkspaceRevision(input) {
+	const value = input?.execution?.revision;
+	return typeof value === "string" && /^[0-9a-fA-F]{40}$/.test(value) ? value.toLowerCase() : null;
+}
 function buildDaemonSlotId(identity, slotKey) {
 	return [
 		"agent",
@@ -4289,6 +4349,7 @@ function slugSlotIdentityComponent(input) {
 }
 function resolveTaskWorktreeBranch(task, workspaceMode) {
 	if (workspaceMode !== "dedicated_worktree") return null;
+	if (typeof task.input.execution?.revision === "string") return null;
 	if (task.taskType === "fulfill_brief") {
 		const input = task.input;
 		const slug = slugifyAsciiLower(typeof task.title === "string" && task.title.trim().length > 0 ? task.title : typeof input.brief === "string" && input.brief.trim().length > 0 ? input.brief : task.taskType, 60) || "task";
@@ -4383,9 +4444,14 @@ function createExecutionPlanCache(args) {
 	};
 }
 function createNullSourceAttemptResolver() {
-	return { findOutputBranch() {
-		return Promise.resolve(null);
-	} };
+	return {
+		findOutputBranch() {
+			return Promise.resolve(null);
+		},
+		findInputRevision() {
+			return Promise.resolve(null);
+		}
+	};
 }
 function createNullRuntimeSessionStore() {
 	return {
@@ -4409,7 +4475,7 @@ function assertPlanAllowedByWorkspacePolicy(plan, policy) {
 }
 function planToRuntimeProfileWorkspaceMode(plan) {
 	if (plan.workspaceMode === "scratch_mount") return "none";
-	if (plan.workspaceMode === "dedicated_worktree" && !plan.worktreeBranch) return "shared_mount";
+	if (plan.workspaceMode === "dedicated_worktree" && !plan.worktreeBranch && !plan.workspaceRevision) return "shared_mount";
 	return plan.workspaceMode;
 }
 function buildClaimedTaskKey(task) {
@@ -4455,16 +4521,20 @@ async function maybeAttachWarmSlotContext(claimedTask, basePlan, stateDirs, slot
 				attemptN: continueFrom.attemptN,
 				taskId: continueFrom.taskId
 			});
+			const recoveredRevision = recoveredBranch ? null : await sourceAttemptResolver.findInputRevision({
+				attemptN: continueFrom.attemptN,
+				taskId: continueFrom.taskId
+			});
 			if (continueFrom.mode === "fork") {
-				if (recoveredBranch) {
+				if (recoveredBranch || recoveredRevision) {
 					const forkWorkspaceId = `fork-${claimedTask.task.id}-attempt-${claimedTask.attemptN}`;
-					const forkBranch = buildForkBranch(recoveredBranch, claimedTask.task.id, claimedTask.attemptN);
+					const forkBranch = buildForkBranch(recoveredBranch ?? `detached-${continueFrom.taskId.slice(0, 8)}`, claimedTask.task.id, claimedTask.attemptN);
 					return {
 						...basePlan,
 						workspaceMode: "dedicated_worktree",
 						workspaceId: forkWorkspaceId,
 						worktreeBranch: forkBranch,
-						worktreeBaseRef: recoveredBranch,
+						worktreeBaseRef: recoveredBranch ?? recoveredRevision,
 						workspaceKind: "fork",
 						sessionPersistence: {
 							sessionDir,
@@ -4474,11 +4544,13 @@ async function maybeAttachWarmSlotContext(claimedTask, basePlan, stateDirs, slot
 				}
 				throw new ProducerContextResolutionError(`Cannot fork continuation of ${continueFrom.taskId}/${continueFrom.attemptN}: durable runtime session is available but the source attempt output did not report a branch`);
 			}
+			const hasDedicatedWorkspace = Boolean(recoveredBranch || recoveredRevision);
 			return {
 				...basePlan,
-				workspaceMode: "dedicated_worktree",
-				workspaceId: recoveredBranch ? buildAttemptWorkspaceId(claimedTask) : null,
+				workspaceMode: hasDedicatedWorkspace ? "dedicated_worktree" : "shared_mount",
+				workspaceId: hasDedicatedWorkspace ? buildAttemptWorkspaceId(claimedTask) : null,
 				worktreeBranch: recoveredBranch,
+				workspaceRevision: recoveredRevision,
 				sessionPersistence: {
 					sessionDir,
 					forkFromSessionPath: resolution.sessionPath
@@ -4486,16 +4558,20 @@ async function maybeAttachWarmSlotContext(claimedTask, basePlan, stateDirs, slot
 			};
 		}
 		const parentBranch = resolution.producerSlot.workspace?.worktreeBranch ?? null;
+		const parentRevision = parentBranch ? null : await sourceAttemptResolver.findInputRevision({
+			attemptN: continueFrom.attemptN,
+			taskId: continueFrom.taskId
+		});
 		if (continueFrom.mode === "fork") {
-			if (!parentBranch) throw new ProducerContextResolutionError(`Cannot fork continuation of ${continueFrom.taskId}/${continueFrom.attemptN}: producer slot has no worktree branch to fork from`);
+			if (!parentBranch && !parentRevision) throw new ProducerContextResolutionError(`Cannot fork continuation of ${continueFrom.taskId}/${continueFrom.attemptN}: producer slot has no worktree branch or immutable revision to fork from`);
 			const forkWorkspaceId = `fork-${claimedTask.task.id}-attempt-${claimedTask.attemptN}`;
-			const forkBranch = buildForkBranch(parentBranch, claimedTask.task.id, claimedTask.attemptN);
+			const forkBranch = buildForkBranch(parentBranch ?? `detached-${continueFrom.taskId.slice(0, 8)}`, claimedTask.task.id, claimedTask.attemptN);
 			return {
 				...basePlan,
 				workspaceMode: "dedicated_worktree",
 				workspaceId: forkWorkspaceId,
 				worktreeBranch: forkBranch,
-				worktreeBaseRef: parentBranch,
+				worktreeBaseRef: parentBranch ?? parentRevision,
 				workspaceKind: "fork",
 				sessionPersistence: {
 					sessionDir,
@@ -4503,11 +4579,13 @@ async function maybeAttachWarmSlotContext(claimedTask, basePlan, stateDirs, slot
 				}
 			};
 		}
+		const hasDedicatedWorkspace = Boolean(parentBranch || parentRevision);
 		return {
 			...basePlan,
-			workspaceMode: "dedicated_worktree",
-			workspaceId: parentBranch ? buildAttemptWorkspaceId(claimedTask) : null,
+			workspaceMode: hasDedicatedWorkspace ? "dedicated_worktree" : "shared_mount",
+			workspaceId: hasDedicatedWorkspace ? buildAttemptWorkspaceId(claimedTask) : null,
 			worktreeBranch: parentBranch,
+			workspaceRevision: parentRevision,
 			sessionPersistence: {
 				sessionDir,
 				forkFromSessionPath: resolution.sessionPath
@@ -5702,11 +5780,18 @@ function signalExitCode(signal) {
 //#region src/lib/source-attempts.ts
 function createApiSourceAttemptResolver(args) {
 	const { agent } = args;
-	return { async findOutputBranch(input) {
-		const attempt = (await agent.tasks.listAttempts(input.taskId)).find((candidate) => candidate.attemptN === input.attemptN);
-		if (!attempt || attempt.status !== "completed") return null;
-		return resolveOutputBranch(attempt.output);
-	} };
+	return {
+		async findOutputBranch(input) {
+			const attempt = (await agent.tasks.listAttempts(input.taskId)).find((candidate) => candidate.attemptN === input.attemptN);
+			if (!attempt || attempt.status !== "completed") return null;
+			return resolveOutputBranch(attempt.output);
+		},
+		async findInputRevision(input) {
+			const task = await agent.tasks.get(input.taskId);
+			if (task.status !== "completed" || task.acceptedAttemptN !== input.attemptN) return null;
+			return resolveTaskWorkspaceRevision(task.input);
+		}
+	};
 }
 function resolveOutputBranch(output) {
 	if (!output || typeof output !== "object") return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/agent-daemon",
-  "version": "0.35.0",
+  "version": "0.37.0",
   "license": "AGPL-3.0-only",
   "type": "module",
   "description": "Universal MoltNet agent daemon host with a built-in Pi/Gondolin runtime and support for trusted operator-owned runtime modules. CLI: moltnet-agent.",
@@ -62,9 +62,9 @@
     "pino": "^10.3.1",
     "pino-pretty": "^13.1.3",
     "typebox": "^1.2.8",
-    "@themoltnet/agent-runtime": "0.39.1",
-    "@themoltnet/pi-runtime": "0.5.0",
-    "@themoltnet/sdk": "0.128.0"
+    "@themoltnet/agent-runtime": "0.40.1",
+    "@themoltnet/sdk": "0.129.0",
+    "@themoltnet/pi-runtime": "0.6.1"
   },
   "devDependencies": {
     "tsx": "^4.7.0",