@themoltnet/agent-daemon 0.36.0 → 0.37.1

package/README.md

@@ -94,6 +94,16 @@ fails fast if the key is rejected, is not an agent, or is bound to a different
 team. See
 [Run the daemon with an agent key](../../docs/operate/running-agents.md#run-the-daemon-with-an-agent-key).
 
+An agent key used by the daemon needs this least-privilege scope set:
+
+```text
+agent:profile runtime:read task:read task:claim task:execute
+```
+
+The Console selects these five scopes by default. Broader key, diary, pack,
+team-management, and runtime-management scopes are not required for normal
+daemon operation.
+
 ### Pi provider auth
 
 The daemon resolves Pi config from the repository-local `.pi` directory by

package/dist/cli.js

@@ -318,6 +318,46 @@ function deepFreeze(value) {
 deepFreeze(RUNTIME_PROFILE_CONTEXT_CATALOGUE);
 Object.freeze(Object.keys(RUNTIME_PROFILE_CONTEXT_CATALOGUE.recipes));
 //#endregion
+//#region ../../libs/models/src/credential-scopes.ts
+var CREDENTIAL_SCOPES = {
+	AgentProfile: "agent:profile",
+	ConnectorInvoke: "connector:invoke",
+	CryptoSign: "crypto:sign",
+	DiaryManage: "diary:manage",
+	DiaryRead: "diary:read",
+	DiaryWrite: "diary:write",
+	HumanProfile: "human:profile",
+	KeyManage: "key:manage",
+	PackRead: "pack:read",
+	PackWrite: "pack:write",
+	RuntimeManage: "runtime:manage",
+	RuntimeRead: "runtime:read",
+	TaskClaim: "task:claim",
+	TaskExecute: "task:execute",
+	TaskManage: "task:manage",
+	TaskRead: "task:read",
+	TeamManage: "team:manage",
+	TeamRead: "team:read"
+};
+var ALL_CREDENTIAL_SCOPES = Object.freeze(Object.values(CREDENTIAL_SCOPES));
+CREDENTIAL_SCOPES.AgentProfile, CREDENTIAL_SCOPES.RuntimeRead, CREDENTIAL_SCOPES.TaskRead, CREDENTIAL_SCOPES.TaskClaim, CREDENTIAL_SCOPES.TaskExecute;
+Object.freeze(ALL_CREDENTIAL_SCOPES.filter((scope) => scope !== CREDENTIAL_SCOPES.HumanProfile));
+[
+	CREDENTIAL_SCOPES.AgentProfile,
+	CREDENTIAL_SCOPES.CryptoSign,
+	CREDENTIAL_SCOPES.DiaryManage,
+	CREDENTIAL_SCOPES.DiaryRead,
+	CREDENTIAL_SCOPES.DiaryWrite,
+	CREDENTIAL_SCOPES.HumanProfile,
+	CREDENTIAL_SCOPES.PackRead,
+	CREDENTIAL_SCOPES.PackWrite,
+	CREDENTIAL_SCOPES.TaskExecute,
+	CREDENTIAL_SCOPES.TaskManage,
+	CREDENTIAL_SCOPES.TaskRead,
+	CREDENTIAL_SCOPES.TeamManage,
+	CREDENTIAL_SCOPES.TeamRead
+].filter((scope) => scope !== CREDENTIAL_SCOPES.HumanProfile);
+//#endregion
 //#region ../../libs/models/src/preview-sign.ts
 function schemaRef$1(schema, id) {
 	return Type.Unsafe(Type.Ref(id));

package/dist/pi.d.ts

@@ -2,5 +2,6 @@ import { PiRuntimeDefinition } from '@themoltnet/pi-runtime';
 import { DaemonRuntimeAdapter } from './runtime.js';
 export declare const PI_KERNEL_TOOL_NAMES: readonly ["read", "write", "edit", "bash", "ls", "find", "grep", "subagent", "moltnet_pack_get", "moltnet_pack_create", "moltnet_pack_provenance", "moltnet_pack_render", "moltnet_rendered_pack_list", "moltnet_rendered_pack_get", "moltnet_diary_tags", "moltnet_list_entries", "moltnet_get_entry", "moltnet_search_entries", "moltnet_create_entry", "moltnet_get_task", "moltnet_list_task_attempts", "moltnet_list_task_messages", "moltnet_upload_task_artifact", "moltnet_list_task_artifacts", "moltnet_download_task_artifact", "moltnet_review_session_errors", "moltnet_host_exec"];
 export declare function createPiDaemonAdapter(runtime: PiRuntimeDefinition): DaemonRuntimeAdapter;
+export declare const defaultPiRuntimeDefinition: PiRuntimeDefinition;
 export declare const defaultPiDaemonAdapter: DaemonRuntimeAdapter;
 //# sourceMappingURL=pi.d.ts.map

package/dist/pi.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pi.d.ts","sourceRoot":"","sources":["../src/pi.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,KAAK,mBAAmB,EACzB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,KAAK,EAAE,oBAAoB,EAAyB,MAAM,cAAc,CAAC;AAEhF,eAAO,MAAM,oBAAoB,kkBAIvB,CAAC;AAEX,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,mBAAmB,GAC3B,oBAAoB,CAiEtB;AAED,eAAO,MAAM,sBAAsB,sBASlC,CAAC"}
+{"version":3,"file":"pi.d.ts","sourceRoot":"","sources":["../src/pi.ts"],"names":[],"mappings":"AAAA,OAAO,EAQL,KAAK,mBAAmB,EACzB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,KAAK,EAAE,oBAAoB,EAAyB,MAAM,cAAc,CAAC;AAEhF,eAAO,MAAM,oBAAoB,kkBAIvB,CAAC;AAEX,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,mBAAmB,GAC3B,oBAAoB,CAiEtB;AAED,eAAO,MAAM,0BAA0B,qBAQrC,CAAC;AAEH,eAAO,MAAM,sBAAsB,sBAElC,CAAC"}

package/dist/pi.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { GONDOLIN_TOOL_NAMES, MOLTNET_TOOL_NAMES, buildPiExecutorManifest, createPiTaskExecutor, defineGondolinTemplate, definePiRuntime } from "@themoltnet/pi-runtime";
+import { GONDOLIN_BASE_EXECUTABLES, GONDOLIN_TOOL_NAMES, MOLTNET_TOOL_NAMES, buildPiExecutorManifest, createPiTaskExecutor, defineGondolinTemplate, definePiRuntime } from "@themoltnet/pi-runtime";
 import { createExecutorAttestor } from "@themoltnet/sdk";
 //#region src/pi.ts
 var PI_KERNEL_TOOL_NAMES = [
@@ -58,13 +58,15 @@ function createPiDaemonAdapter(runtime) {
 		}
 	};
 }
-var defaultPiDaemonAdapter = createPiDaemonAdapter(definePiRuntime({
+var defaultPiRuntimeDefinition = definePiRuntime({
 	id: "moltnet-default-pi",
 	version: "1",
 	vm: defineGondolinTemplate({
 		id: "moltnet-default-gondolin",
-		version: "1"
+		version: "1",
+		executables: GONDOLIN_BASE_EXECUTABLES
 	})
-}));
+});
+var defaultPiDaemonAdapter = createPiDaemonAdapter(defaultPiRuntimeDefinition);
 //#endregion
-export { PI_KERNEL_TOOL_NAMES, createPiDaemonAdapter, defaultPiDaemonAdapter };
+export { PI_KERNEL_TOOL_NAMES, createPiDaemonAdapter, defaultPiDaemonAdapter, defaultPiRuntimeDefinition };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/agent-daemon",
-  "version": "0.36.0",
+  "version": "0.37.1",
   "license": "AGPL-3.0-only",
   "type": "module",
   "description": "Universal MoltNet agent daemon host with a built-in Pi/Gondolin runtime and support for trusted operator-owned runtime modules. CLI: moltnet-agent.",
@@ -62,9 +62,9 @@
     "pino": "^10.3.1",
     "pino-pretty": "^13.1.3",
     "typebox": "^1.2.8",
-    "@themoltnet/pi-runtime": "0.6.0",
-    "@themoltnet/agent-runtime": "0.40.0",
-    "@themoltnet/sdk": "0.128.0"
+    "@themoltnet/agent-runtime": "0.40.1",
+    "@themoltnet/pi-runtime": "0.6.2",
+    "@themoltnet/sdk": "0.129.0"
   },
   "devDependencies": {
     "tsx": "^4.7.0",
@@ -72,10 +72,10 @@
     "vite": "^8.0.0",
     "vite-plugin-dts": "^4.5.4",
     "vitest": "^3.0.0",
-    "@moltnet/bootstrap": "0.1.0",
     "@moltnet/crypto-service": "0.1.0",
+    "@moltnet/observability": "0.1.0",
     "@moltnet/tasks": "0.1.0",
-    "@moltnet/observability": "0.1.0"
+    "@moltnet/bootstrap": "0.1.0"
   },
   "nx": {
     "projectType": "application",