@themoltnet/agent-daemon 0.38.1 → 0.39.1

package/dist/cli.js

@@ -2,7 +2,7 @@
 import { defaultPiDaemonAdapter } from "./pi.js";
 import { assertRuntimeAdapterSupportsProfile } from "./runtime.js";
 import { Type } from "typebox";
-import crypto from "crypto";
+import crypto, { createHash } from "crypto";
 import { Value } from "typebox/value";
 import { dirname, join, resolve } from "node:path";
 import { parseArgs, promisify } from "node:util";
@@ -11,7 +11,9 @@ import { createPiRetryTriage, findMainWorktree, isResolvedPathInsideRoot, normal
 import { execFile, execFileSync } from "node:child_process";
 import { createReadStream, createWriteStream, existsSync, mkdirSync, readdirSync, realpathSync, rmSync } from "node:fs";
 import { AuthenticationError, MoltNetError, connect } from "@themoltnet/sdk";
-import { createHash, randomUUID } from "node:crypto";
+import { createHash as createHash$1, randomUUID } from "node:crypto";
+import { Writable } from "node:stream";
+import { mkdir, realpath, stat } from "node:fs/promises";
 import { once } from "node:events";
 import { pino, transport } from "pino";
 import { metrics } from "@opentelemetry/api";
@@ -24,9 +26,7 @@ import { NodeTracerProvider } from "@opentelemetry/sdk-trace-node";
 import { ATTR_SERVICE_NAME, ATTR_SERVICE_VERSION } from "@opentelemetry/semantic-conventions";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { getModel } from "@earendil-works/pi-ai";
-import { mkdir, realpath, stat } from "node:fs/promises";
 import { pipeline } from "node:stream/promises";
-import { Writable } from "node:stream";
 import { createGzip } from "node:zlib";
 //#region ../../libs/tasks/src/context.ts
 /**
@@ -4004,6 +4004,1076 @@ function isHelpFlag(args) {
 	return args.includes("--help") || args.includes("-h");
 }
 //#endregion
+//#region ../../libs/api-client/src/generated/core/bodySerializer.gen.ts
+var jsonBodySerializer = { bodySerializer: (body) => JSON.stringify(body, (_key, value) => typeof value === "bigint" ? value.toString() : value) };
+Object.entries({
+	$body_: "body",
+	$headers_: "headers",
+	$path_: "path",
+	$query_: "query"
+});
+//#endregion
+//#region ../../libs/api-client/src/generated/core/serverSentEvents.gen.ts
+var createSseClient = ({ onRequest, onSseError, onSseEvent, responseTransformer, responseValidator, sseDefaultRetryDelay, sseMaxRetryAttempts, sseMaxRetryDelay, sseSleepFn, url, ...options }) => {
+	let lastEventId;
+	const sleep = sseSleepFn ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+	const createStream = async function* () {
+		let retryDelay = sseDefaultRetryDelay ?? 3e3;
+		let attempt = 0;
+		const signal = options.signal ?? new AbortController().signal;
+		while (true) {
+			if (signal.aborted) break;
+			attempt++;
+			const headers = options.headers instanceof Headers ? options.headers : new Headers(options.headers);
+			if (lastEventId !== void 0) headers.set("Last-Event-ID", lastEventId);
+			try {
+				const requestInit = {
+					redirect: "follow",
+					...options,
+					body: options.serializedBody,
+					headers,
+					signal
+				};
+				let request = new Request(url, requestInit);
+				if (onRequest) request = await onRequest(url, requestInit);
+				const response = await (options.fetch ?? globalThis.fetch)(request);
+				if (!response.ok) throw new Error(`SSE failed: ${response.status} ${response.statusText}`);
+				if (!response.body) throw new Error("No body in SSE response");
+				const reader = response.body.pipeThrough(new TextDecoderStream()).getReader();
+				let buffer = "";
+				const abortHandler = () => {
+					try {
+						reader.cancel();
+					} catch {}
+				};
+				signal.addEventListener("abort", abortHandler);
+				try {
+					while (true) {
+						const { done, value } = await reader.read();
+						if (done) break;
+						buffer += value;
+						buffer = buffer.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
+						const chunks = buffer.split("\n\n");
+						buffer = chunks.pop() ?? "";
+						for (const chunk of chunks) {
+							const lines = chunk.split("\n");
+							const dataLines = [];
+							let eventName;
+							for (const line of lines) if (line.startsWith("data:")) dataLines.push(line.replace(/^data:\s*/, ""));
+							else if (line.startsWith("event:")) eventName = line.replace(/^event:\s*/, "");
+							else if (line.startsWith("id:")) lastEventId = line.replace(/^id:\s*/, "");
+							else if (line.startsWith("retry:")) {
+								const parsed = Number.parseInt(line.replace(/^retry:\s*/, ""), 10);
+								if (!Number.isNaN(parsed)) retryDelay = parsed;
+							}
+							let data;
+							let parsedJson = false;
+							if (dataLines.length) {
+								const rawData = dataLines.join("\n");
+								try {
+									data = JSON.parse(rawData);
+									parsedJson = true;
+								} catch {
+									data = rawData;
+								}
+							}
+							if (parsedJson) {
+								if (responseValidator) await responseValidator(data);
+								if (responseTransformer) data = await responseTransformer(data);
+							}
+							onSseEvent?.({
+								data,
+								event: eventName,
+								id: lastEventId,
+								retry: retryDelay
+							});
+							if (dataLines.length) yield data;
+						}
+					}
+				} finally {
+					signal.removeEventListener("abort", abortHandler);
+					reader.releaseLock();
+				}
+				break;
+			} catch (error) {
+				onSseError?.(error);
+				if (sseMaxRetryAttempts !== void 0 && attempt >= sseMaxRetryAttempts) break;
+				await sleep(Math.min(retryDelay * 2 ** (attempt - 1), sseMaxRetryDelay ?? 3e4));
+			}
+		}
+	};
+	return { stream: createStream() };
+};
+//#endregion
+//#region ../../libs/api-client/src/generated/core/pathSerializer.gen.ts
+var separatorArrayExplode = (style) => {
+	switch (style) {
+		case "label": return ".";
+		case "matrix": return ";";
+		case "simple": return ",";
+		default: return "&";
+	}
+};
+var separatorArrayNoExplode = (style) => {
+	switch (style) {
+		case "form": return ",";
+		case "pipeDelimited": return "|";
+		case "spaceDelimited": return "%20";
+		default: return ",";
+	}
+};
+var separatorObjectExplode = (style) => {
+	switch (style) {
+		case "label": return ".";
+		case "matrix": return ";";
+		case "simple": return ",";
+		default: return "&";
+	}
+};
+var serializeArrayParam = ({ allowReserved, explode, name, style, value }) => {
+	if (!explode) {
+		const joinedValues = (allowReserved ? value : value.map((v) => encodeURIComponent(v))).join(separatorArrayNoExplode(style));
+		switch (style) {
+			case "label": return `.${joinedValues}`;
+			case "matrix": return `;${name}=${joinedValues}`;
+			case "simple": return joinedValues;
+			default: return `${name}=${joinedValues}`;
+		}
+	}
+	const separator = separatorArrayExplode(style);
+	const joinedValues = value.map((v) => {
+		if (style === "label" || style === "simple") return allowReserved ? v : encodeURIComponent(v);
+		return serializePrimitiveParam({
+			allowReserved,
+			name,
+			value: v
+		});
+	}).join(separator);
+	return style === "label" || style === "matrix" ? separator + joinedValues : joinedValues;
+};
+var serializePrimitiveParam = ({ allowReserved, name, value }) => {
+	if (value === void 0 || value === null) return "";
+	if (typeof value === "object") throw new Error("Deeply-nested arrays/objects aren’t supported. Provide your own `querySerializer()` to handle these.");
+	return `${name}=${allowReserved ? value : encodeURIComponent(value)}`;
+};
+var serializeObjectParam = ({ allowReserved, explode, name, style, value, valueOnly }) => {
+	if (value instanceof Date) return valueOnly ? value.toISOString() : `${name}=${value.toISOString()}`;
+	if (style !== "deepObject" && !explode) {
+		let values = [];
+		Object.entries(value).forEach(([key, v]) => {
+			values = [
+				...values,
+				key,
+				allowReserved ? v : encodeURIComponent(v)
+			];
+		});
+		const joinedValues = values.join(",");
+		switch (style) {
+			case "form": return `${name}=${joinedValues}`;
+			case "label": return `.${joinedValues}`;
+			case "matrix": return `;${name}=${joinedValues}`;
+			default: return joinedValues;
+		}
+	}
+	const separator = separatorObjectExplode(style);
+	const joinedValues = Object.entries(value).map(([key, v]) => serializePrimitiveParam({
+		allowReserved,
+		name: style === "deepObject" ? `${name}[${key}]` : key,
+		value: v
+	})).join(separator);
+	return style === "label" || style === "matrix" ? separator + joinedValues : joinedValues;
+};
+//#endregion
+//#region ../../libs/api-client/src/generated/core/utils.gen.ts
+var PATH_PARAM_RE = /\{[^{}]+\}/g;
+var defaultPathSerializer = ({ path, url: _url }) => {
+	let url = _url;
+	const matches = _url.match(PATH_PARAM_RE);
+	if (matches) for (const match of matches) {
+		let explode = false;
+		let name = match.substring(1, match.length - 1);
+		let style = "simple";
+		if (name.endsWith("*")) {
+			explode = true;
+			name = name.substring(0, name.length - 1);
+		}
+		if (name.startsWith(".")) {
+			name = name.substring(1);
+			style = "label";
+		} else if (name.startsWith(";")) {
+			name = name.substring(1);
+			style = "matrix";
+		}
+		const value = path[name];
+		if (value === void 0 || value === null) continue;
+		if (Array.isArray(value)) {
+			url = url.replace(match, serializeArrayParam({
+				explode,
+				name,
+				style,
+				value
+			}));
+			continue;
+		}
+		if (typeof value === "object") {
+			url = url.replace(match, serializeObjectParam({
+				explode,
+				name,
+				style,
+				value,
+				valueOnly: true
+			}));
+			continue;
+		}
+		if (style === "matrix") {
+			url = url.replace(match, `;${serializePrimitiveParam({
+				name,
+				value
+			})}`);
+			continue;
+		}
+		const replaceValue = encodeURIComponent(style === "label" ? `.${value}` : value);
+		url = url.replace(match, replaceValue);
+	}
+	return url;
+};
+var getUrl = ({ baseUrl, path, query, querySerializer, url: _url }) => {
+	const pathUrl = _url.startsWith("/") ? _url : `/${_url}`;
+	let url = (baseUrl ?? "") + pathUrl;
+	if (path) url = defaultPathSerializer({
+		path,
+		url
+	});
+	let search = query ? querySerializer(query) : "";
+	if (search.startsWith("?")) search = search.substring(1);
+	if (search) url += `?${search}`;
+	return url;
+};
+function getValidRequestBody(options) {
+	const hasBody = options.body !== void 0;
+	if (hasBody && options.bodySerializer) {
+		if ("serializedBody" in options) return options.serializedBody !== void 0 && options.serializedBody !== "" ? options.serializedBody : null;
+		return options.body !== "" ? options.body : null;
+	}
+	if (hasBody) return options.body;
+}
+//#endregion
+//#region ../../libs/api-client/src/generated/core/auth.gen.ts
+var getAuthToken = async (auth, callback) => {
+	const token = typeof callback === "function" ? await callback(auth) : callback;
+	if (!token) return;
+	if (auth.scheme === "bearer") return `Bearer ${token}`;
+	if (auth.scheme === "basic") return `Basic ${btoa(token)}`;
+	return token;
+};
+//#endregion
+//#region ../../libs/api-client/src/generated/client/utils.gen.ts
+var createQuerySerializer = ({ parameters = {}, ...args } = {}) => {
+	const querySerializer = (queryParams) => {
+		const search = [];
+		if (queryParams && typeof queryParams === "object") for (const name in queryParams) {
+			const value = queryParams[name];
+			if (value === void 0 || value === null) continue;
+			const options = parameters[name] || args;
+			if (Array.isArray(value)) {
+				const serializedArray = serializeArrayParam({
+					allowReserved: options.allowReserved,
+					explode: true,
+					name,
+					style: "form",
+					value,
+					...options.array
+				});
+				if (serializedArray) search.push(serializedArray);
+			} else if (typeof value === "object") {
+				const serializedObject = serializeObjectParam({
+					allowReserved: options.allowReserved,
+					explode: true,
+					name,
+					style: "deepObject",
+					value,
+					...options.object
+				});
+				if (serializedObject) search.push(serializedObject);
+			} else {
+				const serializedPrimitive = serializePrimitiveParam({
+					allowReserved: options.allowReserved,
+					name,
+					value
+				});
+				if (serializedPrimitive) search.push(serializedPrimitive);
+			}
+		}
+		return search.join("&");
+	};
+	return querySerializer;
+};
+/**
+* Infers parseAs value from provided Content-Type header.
+*/
+var getParseAs = (contentType) => {
+	if (!contentType) return "stream";
+	const cleanContent = contentType.split(";")[0]?.trim();
+	if (!cleanContent) return;
+	if (cleanContent.startsWith("application/json") || cleanContent.endsWith("+json")) return "json";
+	if (cleanContent === "multipart/form-data") return "formData";
+	if ([
+		"application/",
+		"audio/",
+		"image/",
+		"video/"
+	].some((type) => cleanContent.startsWith(type))) return "blob";
+	if (cleanContent.startsWith("text/")) return "text";
+};
+var checkForExistence = (options, name) => {
+	if (!name) return false;
+	if (options.headers.has(name) || options.query?.[name] || options.headers.get("Cookie")?.includes(`${name}=`)) return true;
+	return false;
+};
+var setAuthParams = async ({ security, ...options }) => {
+	for (const auth of security) {
+		if (checkForExistence(options, auth.name)) continue;
+		const token = await getAuthToken(auth, options.auth);
+		if (!token) continue;
+		const name = auth.name ?? "Authorization";
+		switch (auth.in) {
+			case "query":
+				if (!options.query) options.query = {};
+				options.query[name] = token;
+				break;
+			case "cookie":
+				options.headers.append("Cookie", `${name}=${token}`);
+				break;
+			default:
+				options.headers.set(name, token);
+				break;
+		}
+	}
+};
+var buildUrl = (options) => getUrl({
+	baseUrl: options.baseUrl,
+	path: options.path,
+	query: options.query,
+	querySerializer: typeof options.querySerializer === "function" ? options.querySerializer : createQuerySerializer(options.querySerializer),
+	url: options.url
+});
+var mergeConfigs = (a, b) => {
+	const config = {
+		...a,
+		...b
+	};
+	if (config.baseUrl?.endsWith("/")) config.baseUrl = config.baseUrl.substring(0, config.baseUrl.length - 1);
+	config.headers = mergeHeaders(a.headers, b.headers);
+	return config;
+};
+var headersEntries = (headers) => {
+	const entries = [];
+	headers.forEach((value, key) => {
+		entries.push([key, value]);
+	});
+	return entries;
+};
+var mergeHeaders = (...headers) => {
+	const mergedHeaders = new Headers();
+	for (const header of headers) {
+		if (!header) continue;
+		const iterator = header instanceof Headers ? headersEntries(header) : Object.entries(header);
+		for (const [key, value] of iterator) if (value === null) mergedHeaders.delete(key);
+		else if (Array.isArray(value)) for (const v of value) mergedHeaders.append(key, v);
+		else if (value !== void 0) mergedHeaders.set(key, typeof value === "object" ? JSON.stringify(value) : value);
+	}
+	return mergedHeaders;
+};
+var Interceptors = class {
+	fns = [];
+	clear() {
+		this.fns = [];
+	}
+	eject(id) {
+		const index = this.getInterceptorIndex(id);
+		if (this.fns[index]) this.fns[index] = null;
+	}
+	exists(id) {
+		const index = this.getInterceptorIndex(id);
+		return Boolean(this.fns[index]);
+	}
+	getInterceptorIndex(id) {
+		if (typeof id === "number") return this.fns[id] ? id : -1;
+		return this.fns.indexOf(id);
+	}
+	update(id, fn) {
+		const index = this.getInterceptorIndex(id);
+		if (this.fns[index]) {
+			this.fns[index] = fn;
+			return id;
+		}
+		return false;
+	}
+	use(fn) {
+		this.fns.push(fn);
+		return this.fns.length - 1;
+	}
+};
+var createInterceptors = () => ({
+	error: new Interceptors(),
+	request: new Interceptors(),
+	response: new Interceptors()
+});
+var defaultQuerySerializer = createQuerySerializer({
+	allowReserved: false,
+	array: {
+		explode: true,
+		style: "form"
+	},
+	object: {
+		explode: true,
+		style: "deepObject"
+	}
+});
+var defaultHeaders = { "Content-Type": "application/json" };
+var createConfig = (override = {}) => ({
+	...jsonBodySerializer,
+	headers: defaultHeaders,
+	parseAs: "auto",
+	querySerializer: defaultQuerySerializer,
+	...override
+});
+//#endregion
+//#region ../../libs/api-client/src/generated/client/client.gen.ts
+var createClient = (config = {}) => {
+	let _config = mergeConfigs(createConfig(), config);
+	const getConfig = () => ({ ..._config });
+	const setConfig = (config) => {
+		_config = mergeConfigs(_config, config);
+		return getConfig();
+	};
+	const interceptors = createInterceptors();
+	const beforeRequest = async (options) => {
+		const opts = {
+			..._config,
+			...options,
+			fetch: options.fetch ?? _config.fetch ?? globalThis.fetch,
+			headers: mergeHeaders(_config.headers, options.headers),
+			serializedBody: void 0
+		};
+		if (opts.security) await setAuthParams({
+			...opts,
+			security: opts.security
+		});
+		if (opts.requestValidator) await opts.requestValidator(opts);
+		if (opts.body !== void 0 && opts.bodySerializer) opts.serializedBody = opts.bodySerializer(opts.body);
+		if (opts.body === void 0 || opts.serializedBody === "") opts.headers.delete("Content-Type");
+		return {
+			opts,
+			url: buildUrl(opts)
+		};
+	};
+	const request = async (options) => {
+		const { opts, url } = await beforeRequest(options);
+		const requestInit = {
+			redirect: "follow",
+			...opts,
+			body: getValidRequestBody(opts)
+		};
+		let request = new Request(url, requestInit);
+		for (const fn of interceptors.request.fns) if (fn) request = await fn(request, opts);
+		const _fetch = opts.fetch;
+		let response;
+		try {
+			response = await _fetch(request);
+		} catch (error) {
+			let finalError = error;
+			for (const fn of interceptors.error.fns) if (fn) finalError = await fn(error, void 0, request, opts);
+			finalError = finalError || {};
+			if (opts.throwOnError) throw finalError;
+			return opts.responseStyle === "data" ? void 0 : {
+				error: finalError,
+				request,
+				response: void 0
+			};
+		}
+		for (const fn of interceptors.response.fns) if (fn) response = await fn(response, request, opts);
+		const result = {
+			request,
+			response
+		};
+		if (response.ok) {
+			const parseAs = (opts.parseAs === "auto" ? getParseAs(response.headers.get("Content-Type")) : opts.parseAs) ?? "json";
+			if (response.status === 204 || response.headers.get("Content-Length") === "0") {
+				let emptyData;
+				switch (parseAs) {
+					case "arrayBuffer":
+					case "blob":
+					case "text":
+						emptyData = await response[parseAs]();
+						break;
+					case "formData":
+						emptyData = new FormData();
+						break;
+					case "stream":
+						emptyData = response.body;
+						break;
+					default:
+						emptyData = {};
+						break;
+				}
+				return opts.responseStyle === "data" ? emptyData : {
+					data: emptyData,
+					...result
+				};
+			}
+			let data;
+			switch (parseAs) {
+				case "arrayBuffer":
+				case "blob":
+				case "formData":
+				case "json":
+				case "text":
+					data = await response[parseAs]();
+					break;
+				case "stream": return opts.responseStyle === "data" ? response.body : {
+					data: response.body,
+					...result
+				};
+			}
+			if (parseAs === "json") {
+				if (opts.responseValidator) await opts.responseValidator(data);
+				if (opts.responseTransformer) data = await opts.responseTransformer(data);
+			}
+			return opts.responseStyle === "data" ? data : {
+				data,
+				...result
+			};
+		}
+		const textError = await response.text();
+		let jsonError;
+		try {
+			jsonError = JSON.parse(textError);
+		} catch {}
+		const error = jsonError ?? textError;
+		let finalError = error;
+		for (const fn of interceptors.error.fns) if (fn) finalError = await fn(error, response, request, opts);
+		finalError = finalError || {};
+		if (opts.throwOnError) throw finalError;
+		return opts.responseStyle === "data" ? void 0 : {
+			error: finalError,
+			...result
+		};
+	};
+	const makeMethodFn = (method) => (options) => request({
+		...options,
+		method
+	});
+	const makeSseFn = (method) => async (options) => {
+		const { opts, url } = await beforeRequest(options);
+		return createSseClient({
+			...opts,
+			body: opts.body,
+			headers: opts.headers,
+			method,
+			onRequest: async (url, init) => {
+				let request = new Request(url, init);
+				for (const fn of interceptors.request.fns) if (fn) request = await fn(request, opts);
+				return request;
+			},
+			url
+		});
+	};
+	return {
+		buildUrl,
+		connect: makeMethodFn("CONNECT"),
+		delete: makeMethodFn("DELETE"),
+		get: makeMethodFn("GET"),
+		getConfig,
+		head: makeMethodFn("HEAD"),
+		interceptors,
+		options: makeMethodFn("OPTIONS"),
+		patch: makeMethodFn("PATCH"),
+		post: makeMethodFn("POST"),
+		put: makeMethodFn("PUT"),
+		request,
+		setConfig,
+		sse: {
+			connect: makeSseFn("CONNECT"),
+			delete: makeSseFn("DELETE"),
+			get: makeSseFn("GET"),
+			head: makeSseFn("HEAD"),
+			options: makeSseFn("OPTIONS"),
+			patch: makeSseFn("PATCH"),
+			post: makeSseFn("POST"),
+			put: makeSseFn("PUT"),
+			trace: makeSseFn("TRACE")
+		},
+		trace: makeMethodFn("TRACE")
+	};
+};
+createClient(createConfig({ baseUrl: "https://api.themolt.net" }));
+var { p: P, n: N, Gx, Gy, a: _a, d: _d } = {
+	p: 57896044618658097711785492504343953926634992332820282019728792003956564819949n,
+	n: 7237005577332262213973186563042994240857116359379907606001950938285454250989n,
+	h: 8n,
+	a: 57896044618658097711785492504343953926634992332820282019728792003956564819948n,
+	d: 37095705934669439343138083508754565189542113879843219016388785533085940283555n,
+	Gx: 15112221349535400772501151409588531511454012693041857206046113283949847762202n,
+	Gy: 46316835694926478169428394003475163141307993866256225615783033603165251855960n
+};
+var h = 8n;
+var L = 32;
+var L2 = 64;
+var err = (m = "") => {
+	throw new Error(m);
+};
+var isBig = (n) => typeof n === "bigint";
+var isStr = (s) => typeof s === "string";
+var isBytes = (a) => a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array";
+/** assert is Uint8Array (of specific length) */
+var abytes = (a, l) => !isBytes(a) || typeof l === "number" && l > 0 && a.length !== l ? err("Uint8Array expected") : a;
+/** create Uint8Array */
+var u8n = (len) => new Uint8Array(len);
+var u8fr = (buf) => Uint8Array.from(buf);
+var padh = (n, pad) => n.toString(16).padStart(pad, "0");
+var bytesToHex = (b) => Array.from(abytes(b)).map((e) => padh(e, 2)).join("");
+var C = {
+	_0: 48,
+	_9: 57,
+	A: 65,
+	F: 70,
+	a: 97,
+	f: 102
+};
+var _ch = (ch) => {
+	if (ch >= C._0 && ch <= C._9) return ch - C._0;
+	if (ch >= C.A && ch <= C.F) return ch - (C.A - 10);
+	if (ch >= C.a && ch <= C.f) return ch - (C.a - 10);
+};
+var hexToBytes = (hex) => {
+	const e = "hex invalid";
+	if (!isStr(hex)) return err(e);
+	const hl = hex.length;
+	const al = hl / 2;
+	if (hl % 2) return err(e);
+	const array = u8n(al);
+	for (let ai = 0, hi = 0; ai < al; ai++, hi += 2) {
+		const n1 = _ch(hex.charCodeAt(hi));
+		const n2 = _ch(hex.charCodeAt(hi + 1));
+		if (n1 === void 0 || n2 === void 0) return err(e);
+		array[ai] = n1 * 16 + n2;
+	}
+	return array;
+};
+/** normalize hex or ui8a to ui8a */
+var toU8 = (a, len) => abytes(isStr(a) ? hexToBytes(a) : u8fr(abytes(a)), len);
+var cr = () => globalThis?.crypto;
+var subtle = () => cr()?.subtle ?? err("crypto.subtle must be defined");
+var concatBytes = (...arrs) => {
+	const r = u8n(arrs.reduce((sum, a) => sum + abytes(a).length, 0));
+	let pad = 0;
+	arrs.forEach((a) => {
+		r.set(a, pad);
+		pad += a.length;
+	});
+	return r;
+};
+/** WebCrypto OS-level CSPRNG (random number generator). Will throw when not available. */
+var randomBytes = (len = L) => {
+	return cr().getRandomValues(u8n(len));
+};
+var big = BigInt;
+var arange = (n, min, max, msg = "bad number: out of range") => isBig(n) && min <= n && n < max ? n : err(msg);
+/** modular division */
+var M = (a, b = P) => {
+	const r = a % b;
+	return r >= 0n ? r : b + r;
+};
+/** Modular inversion using eucledian GCD (non-CT). No negative exponent for now. */
+var invert = (num, md) => {
+	if (num === 0n || md <= 0n) err("no inverse n=" + num + " mod=" + md);
+	let a = M(num, md), b = md, x = 0n, y = 1n, u = 1n, v = 0n;
+	while (a !== 0n) {
+		const q = b / a, r = b % a;
+		const m = x - u * q, n = y - v * q;
+		b = a, a = r, x = u, y = v, u = m, v = n;
+	}
+	return b === 1n ? M(x, md) : err("no inverse");
+};
+var apoint = (p) => p instanceof Point ? p : err("Point expected");
+var B256 = 2n ** 256n;
+/** Point in XYZT extended coordinates. */
+var Point = class Point {
+	static BASE;
+	static ZERO;
+	ex;
+	ey;
+	ez;
+	et;
+	constructor(ex, ey, ez, et) {
+		const max = B256;
+		this.ex = arange(ex, 0n, max);
+		this.ey = arange(ey, 0n, max);
+		this.ez = arange(ez, 1n, max);
+		this.et = arange(et, 0n, max);
+		Object.freeze(this);
+	}
+	static fromAffine(p) {
+		return new Point(p.x, p.y, 1n, M(p.x * p.y));
+	}
+	/** RFC8032 5.1.3: Uint8Array to Point. */
+	static fromBytes(hex, zip215 = false) {
+		const d = _d;
+		const normed = u8fr(abytes(hex, L));
+		const lastByte = hex[31];
+		normed[31] = lastByte & -129;
+		const y = bytesToNumLE(normed);
+		arange(y, 0n, zip215 ? B256 : P);
+		const y2 = M(y * y);
+		let { isValid, value: x } = uvRatio(M(y2 - 1n), M(d * y2 + 1n));
+		if (!isValid) err("bad point: y not sqrt");
+		const isXOdd = (x & 1n) === 1n;
+		const isLastByteOdd = (lastByte & 128) !== 0;
+		if (!zip215 && x === 0n && isLastByteOdd) err("bad point: x==0, isLastByteOdd");
+		if (isLastByteOdd !== isXOdd) x = M(-x);
+		return new Point(x, y, 1n, M(x * y));
+	}
+	/** Checks if the point is valid and on-curve. */
+	assertValidity() {
+		const a = _a;
+		const d = _d;
+		const p = this;
+		if (p.is0()) throw new Error("bad point: ZERO");
+		const { ex: X, ey: Y, ez: Z, et: T } = p;
+		const X2 = M(X * X);
+		const Y2 = M(Y * Y);
+		const Z2 = M(Z * Z);
+		const Z4 = M(Z2 * Z2);
+		if (M(Z2 * M(M(X2 * a) + Y2)) !== M(Z4 + M(d * M(X2 * Y2)))) throw new Error("bad point: equation left != right (1)");
+		if (M(X * Y) !== M(Z * T)) throw new Error("bad point: equation left != right (2)");
+		return this;
+	}
+	/** Equality check: compare points P&Q. */
+	equals(other) {
+		const { ex: X1, ey: Y1, ez: Z1 } = this;
+		const { ex: X2, ey: Y2, ez: Z2 } = apoint(other);
+		const X1Z2 = M(X1 * Z2);
+		const X2Z1 = M(X2 * Z1);
+		const Y1Z2 = M(Y1 * Z2);
+		const Y2Z1 = M(Y2 * Z1);
+		return X1Z2 === X2Z1 && Y1Z2 === Y2Z1;
+	}
+	is0() {
+		return this.equals(I);
+	}
+	/** Flip point over y coordinate. */
+	negate() {
+		return new Point(M(-this.ex), this.ey, this.ez, M(-this.et));
+	}
+	/** Point doubling. Complete formula. Cost: `4M + 4S + 1*a + 6add + 1*2`. */
+	double() {
+		const { ex: X1, ey: Y1, ez: Z1 } = this;
+		const a = _a;
+		const A = M(X1 * X1);
+		const B = M(Y1 * Y1);
+		const C = M(2n * M(Z1 * Z1));
+		const D = M(a * A);
+		const x1y1 = X1 + Y1;
+		const E = M(M(x1y1 * x1y1) - A - B);
+		const G = D + B;
+		const F = G - C;
+		const H = D - B;
+		const X3 = M(E * F);
+		const Y3 = M(G * H);
+		const T3 = M(E * H);
+		return new Point(X3, Y3, M(F * G), T3);
+	}
+	/** Point addition. Complete formula. Cost: `8M + 1*k + 8add + 1*2`. */
+	add(other) {
+		const { ex: X1, ey: Y1, ez: Z1, et: T1 } = this;
+		const { ex: X2, ey: Y2, ez: Z2, et: T2 } = apoint(other);
+		const a = _a;
+		const d = _d;
+		const A = M(X1 * X2);
+		const B = M(Y1 * Y2);
+		const C = M(T1 * d * T2);
+		const D = M(Z1 * Z2);
+		const E = M((X1 + Y1) * (X2 + Y2) - A - B);
+		const F = M(D - C);
+		const G = M(D + C);
+		const H = M(B - a * A);
+		const X3 = M(E * F);
+		const Y3 = M(G * H);
+		const T3 = M(E * H);
+		return new Point(X3, Y3, M(F * G), T3);
+	}
+	/**
+	* Point-by-scalar multiplication. Scalar must be in range 1 <= n < CURVE.n.
+	* Uses {@link wNAF} for base point.
+	* Uses fake point to mitigate side-channel leakage.
+	* @param n scalar by which point is multiplied
+	* @param safe safe mode guards against timing attacks; unsafe mode is faster
+	*/
+	multiply(n, safe = true) {
+		if (!safe && (n === 0n || this.is0())) return I;
+		arange(n, 1n, N);
+		if (n === 1n) return this;
+		if (this.equals(G)) return wNAF(n).p;
+		let p = I;
+		let f = G;
+		for (let d = this; n > 0n; d = d.double(), n >>= 1n) if (n & 1n) p = p.add(d);
+		else if (safe) f = f.add(d);
+		return p;
+	}
+	/** Convert point to 2d xy affine point. (X, Y, Z) ∋ (x=X/Z, y=Y/Z) */
+	toAffine() {
+		const { ex: x, ey: y, ez: z } = this;
+		if (this.equals(I)) return {
+			x: 0n,
+			y: 1n
+		};
+		const iz = invert(z, P);
+		if (M(z * iz) !== 1n) err("invalid inverse");
+		return {
+			x: M(x * iz),
+			y: M(y * iz)
+		};
+	}
+	toBytes() {
+		const { x, y } = this.assertValidity().toAffine();
+		const b = numTo32bLE(y);
+		b[31] |= x & 1n ? 128 : 0;
+		return b;
+	}
+	toHex() {
+		return bytesToHex(this.toBytes());
+	}
+	clearCofactor() {
+		return this.multiply(big(h), false);
+	}
+	isSmallOrder() {
+		return this.clearCofactor().is0();
+	}
+	isTorsionFree() {
+		let p = this.multiply(N / 2n, false).double();
+		if (N % 2n) p = p.add(this);
+		return p.is0();
+	}
+	static fromHex(hex, zip215) {
+		return Point.fromBytes(toU8(hex), zip215);
+	}
+	get x() {
+		return this.toAffine().x;
+	}
+	get y() {
+		return this.toAffine().y;
+	}
+	toRawBytes() {
+		return this.toBytes();
+	}
+};
+/** Generator / base point */
+var G = new Point(Gx, Gy, 1n, M(Gx * Gy));
+/** Identity / zero point */
+var I = new Point(0n, 1n, 1n, 0n);
+Point.BASE = G;
+Point.ZERO = I;
+var numTo32bLE = (num) => hexToBytes(padh(arange(num, 0n, B256), L2)).reverse();
+var bytesToNumLE = (b) => big("0x" + bytesToHex(u8fr(abytes(b)).reverse()));
+var pow2 = (x, power) => {
+	let r = x;
+	while (power-- > 0n) {
+		r *= r;
+		r %= P;
+	}
+	return r;
+};
+var pow_2_252_3 = (x) => {
+	const b2 = x * x % P * x % P;
+	const b5 = pow2(pow2(b2, 2n) * b2 % P, 1n) * x % P;
+	const b10 = pow2(b5, 5n) * b5 % P;
+	const b20 = pow2(b10, 10n) * b10 % P;
+	const b40 = pow2(b20, 20n) * b20 % P;
+	const b80 = pow2(b40, 40n) * b40 % P;
+	return {
+		pow_p_5_8: pow2(pow2(pow2(pow2(b80, 80n) * b80 % P, 80n) * b80 % P, 10n) * b10 % P, 2n) * x % P,
+		b2
+	};
+};
+var RM1 = 19681161376707505956807079304988542015446066515923890162744021073123829784752n;
+var uvRatio = (u, v) => {
+	const v3 = M(v * v * v);
+	const pow = pow_2_252_3(u * M(v3 * v3 * v)).pow_p_5_8;
+	let x = M(u * v3 * pow);
+	const vx2 = M(v * x * x);
+	const root1 = x;
+	const root2 = M(x * RM1);
+	const useRoot1 = vx2 === u;
+	const useRoot2 = vx2 === M(-u);
+	const noRoot = vx2 === M(-u * RM1);
+	if (useRoot1) x = root1;
+	if (useRoot2 || noRoot) x = root2;
+	if ((M(x) & 1n) === 1n) x = M(-x);
+	return {
+		isValid: useRoot1 || useRoot2,
+		value: x
+	};
+};
+/** Math, hex, byte helpers. Not in `utils` because utils share API with noble-curves. */
+var etc = {
+	sha512Async: async (...messages) => {
+		const s = subtle();
+		const m = concatBytes(...messages);
+		return u8n(await s.digest("SHA-512", m.buffer));
+	},
+	sha512Sync: void 0,
+	bytesToHex,
+	hexToBytes,
+	concatBytes,
+	mod: M,
+	invert,
+	randomBytes
+};
+var W = 8;
+var pwindows = Math.ceil(256 / W) + 1;
+var pwindowSize = 2 ** (W - 1);
+var precompute = () => {
+	const points = [];
+	let p = G;
+	let b = p;
+	for (let w = 0; w < pwindows; w++) {
+		b = p;
+		points.push(b);
+		for (let i = 1; i < pwindowSize; i++) {
+			b = b.add(p);
+			points.push(b);
+		}
+		p = b.double();
+	}
+	return points;
+};
+var Gpows = void 0;
+var ctneg = (cnd, p) => {
+	const n = p.negate();
+	return cnd ? n : p;
+};
+/**
+* Precomputes give 12x faster getPublicKey(), 10x sign(), 2x verify() by
+* caching multiples of G (base point). Cache is stored in 32MB of RAM.
+* Any time `G.multiply` is done, precomputes are used.
+* Not used for getSharedSecret, which instead multiplies random pubkey `P.multiply`.
+*
+* w-ary non-adjacent form (wNAF) precomputation method is 10% slower than windowed method,
+* but takes 2x less RAM. RAM reduction is possible by utilizing `.subtract`.
+*
+* !! Precomputes can be disabled by commenting-out call of the wNAF() inside Point#multiply().
+*/
+var wNAF = (n) => {
+	const comp = Gpows || (Gpows = precompute());
+	let p = I;
+	let f = G;
+	const pow_2_w = 2 ** W;
+	const maxNum = pow_2_w;
+	const mask = big(pow_2_w - 1);
+	const shiftBy = big(W);
+	for (let w = 0; w < pwindows; w++) {
+		let wbits = Number(n & mask);
+		n >>= shiftBy;
+		if (wbits > pwindowSize) {
+			wbits -= maxNum;
+			n += 1n;
+		}
+		const off = w * pwindowSize;
+		const offF = off;
+		const offP = off + Math.abs(wbits) - 1;
+		const isEven = w % 2 !== 0;
+		const isNeg = wbits < 0;
+		if (wbits === 0) f = f.add(ctneg(isEven, comp[offF]));
+		else p = p.add(ctneg(isNeg, comp[offP]));
+	}
+	return {
+		p,
+		f
+	};
+};
+//#endregion
+//#region ../../libs/sdk/src/config.ts
+/** Read one environment value behind the SDK's config boundary. */
+function readEnvironmentVariable(name) {
+	return globalThis.process?.env?.[name];
+}
+//#endregion
+//#region ../../libs/crypto-service/src/ssh.ts
+/**
+* SSH key format conversion for MoltNet Ed25519 keys
+*
+* Converts MoltNet agent keys (ed25519:<base64>) to OpenSSH format
+* for use with git commit signing and SSH authentication.
+*/
+if (!etc.sha512Sync) etc.sha512Sync = (...m) => {
+	const hash = createHash("sha512");
+	m.forEach((msg) => hash.update(msg));
+	return hash.digest();
+};
+var OS_KEYRING_SECRET_PROVIDER = "os-keyring";
+var SecretProviderRegistry = class {
+	#providers = /* @__PURE__ */ new Map();
+	register(provider) {
+		const name = provider.name.trim();
+		if (!name) throw new Error("Secret provider name must not be empty");
+		this.#providers.set(name, provider);
+		return this;
+	}
+	get(name) {
+		return this.#providers.get(name);
+	}
+	async resolve(reference) {
+		const providerName = reference.provider.trim();
+		const key = reference.key.trim();
+		if (!providerName || !key) throw new Error("Secret reference requires provider and key");
+		const provider = this.get(providerName);
+		if (!provider) throw new Error(`Secret provider ${JSON.stringify(providerName)} is not registered`);
+		const value = await provider.read(key);
+		if (!value) throw new Error(`Secret provider ${JSON.stringify(providerName)} has no value for the requested key`);
+		return value;
+	}
+};
+var EnvironmentSecretProvider = class {
+	name = "env";
+	constructor(readValue = readEnvironmentVariable) {
+		this.readValue = readValue;
+	}
+	read(key) {
+		if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) return Promise.reject(/* @__PURE__ */ new Error("Environment secret key must be a variable name"));
+		return Promise.resolve(this.readValue(key) || null);
+	}
+};
+function createDefaultSecretProviderRegistry() {
+	return new SecretProviderRegistry().register(new EnvironmentSecretProvider());
+}
+//#endregion
+//#region ../../libs/sdk/src/node.ts
+/**
+* Lazy Node adapter. Browser SDK installs never pull in native keyring
+* packages, and Node consumers only load the adapter when an os-keyring
+* reference is actually resolved.
+*/
+var OSKeyringSecretProvider = class {
+	name = OS_KEYRING_SECRET_PROVIDER;
+	providerPromise;
+	constructor(platform = process.platform) {
+		this.platform = platform;
+	}
+	async read(key) {
+		return (await this.provider()).read(key);
+	}
+	provider() {
+		this.providerPromise ??= import("./assets/src-BRybnxdG.js").then(({ OSKeyringSecretProvider: Provider }) => new Provider(this.platform)).catch((error) => {
+			throw new Error("OS keyring support requires @themoltnet/os-keyring; install it in this Node application", { cause: error });
+		});
+		return this.providerPromise;
+	}
+};
+function createNodeSecretProviderRegistry(platform = process.platform) {
+	return createDefaultSecretProviderRegistry().register(new OSKeyringSecretProvider(platform));
+}
+//#endregion
 //#region src/lib/agent-context.ts
 /**
 * Report which auth mode `connect()` will use, without ever reading the secret
@@ -4077,7 +5147,10 @@ async function resolveAgentContext(agentName, options = {}) {
 		if (existsSync(join(agentDir, "moltnet.json"))) return {
 			agentDir,
 			agentRootDir: rootDir,
-			agent: await connect({ configDir: agentDir })
+			agent: await connect({
+				configDir: agentDir,
+				secretProviders: createNodeSecretProviderRegistry()
+			})
 		};
 	}
 	if (options.allowMissingConfig) {
@@ -4086,7 +5159,10 @@ async function resolveAgentContext(agentName, options = {}) {
 		return {
 			agentDir,
 			agentRootDir: rootDir,
-			agent: await connect({ configDir: agentDir })
+			agent: await connect({
+				configDir: agentDir,
+				secretProviders: createNodeSecretProviderRegistry()
+			})
 		};
 	}
 	const tried = roots.map((root) => join(root, ".moltnet", agentName));
@@ -4405,7 +5481,7 @@ function toDaemonWorkspaceMode(mode) {
 function boundedKeyDirComponent(key) {
 	const encoded = encodeURIComponent(key);
 	if (encoded.length <= 200) return encoded;
-	const hash = createHash("sha256").update(key).digest("hex").slice(0, 16);
+	const hash = createHash$1("sha256").update(key).digest("hex").slice(0, 16);
 	return `${encoded.slice(0, 180)}-${hash}`;
 }
 function resolveTaskWorkspaceId(task, executionPlan) {
@@ -5152,7 +6228,10 @@ async function initWorkerOtel(options) {
 	});
 	let headersFactory;
 	if (options.agentDir) {
-		const agent = await connect({ configDir: options.agentDir });
+		const agent = await connect({
+			configDir: options.agentDir,
+			secretProviders: createNodeSecretProviderRegistry()
+		});
 		headersFactory = async () => {
 			return { Authorization: `Bearer ${await agent.getToken()}` };
 		};
@@ -6908,7 +7987,7 @@ async function isPathInsideRoot(path, root) {
 	return isResolvedPathInsideRoot(realResolvedPath, realResolvedRoot);
 }
 async function computeCompressedSessionFingerprint(path) {
-	const hash = createHash("sha256");
+	const hash = createHash$1("sha256");
 	let bytes = 0;
 	const sink = new Writable({ write(chunk, _encoding, callback) {
 		bytes += chunk.byteLength;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/agent-daemon",
-  "version": "0.38.1",
+  "version": "0.39.1",
   "license": "AGPL-3.0-only",
   "type": "module",
   "description": "Universal MoltNet agent daemon host with a built-in Pi/Gondolin runtime and support for trusted operator-owned runtime modules. CLI: moltnet-agent.",
@@ -44,7 +44,7 @@
     "dist/runtime.d.ts.map"
   ],
   "engines": {
-    "node": ">=22"
+    "node": ">=24"
   },
   "dependencies": {
     "@earendil-works/gondolin": "^0.9.1",
@@ -68,9 +68,10 @@
     "pino": "^10.3.1",
     "pino-pretty": "^13.1.3",
     "typebox": "^1.2.8",
-    "@themoltnet/pi-runtime": "0.7.1",
-    "@themoltnet/agent-runtime": "0.41.1",
-    "@themoltnet/sdk": "0.130.0"
+    "@themoltnet/os-keyring": "0.2.0",
+    "@themoltnet/pi-runtime": "0.7.3",
+    "@themoltnet/sdk": "0.131.0",
+    "@themoltnet/agent-runtime": "0.41.2"
   },
   "devDependencies": {
     "tsx": "^4.7.0",
@@ -79,8 +80,8 @@
     "vite-plugin-dts": "^4.5.4",
     "vitest": "^3.0.0",
     "@moltnet/bootstrap": "0.1.0",
-    "@moltnet/observability": "0.1.0",
     "@moltnet/crypto-service": "0.1.0",
+    "@moltnet/observability": "0.1.0",
     "@moltnet/tasks": "0.1.0"
   },
   "nx": {
@@ -98,6 +99,6 @@
     "start": "node dist/main.js",
     "build": "vite build",
     "check:pack": "tsx ../../tools/src/check-pack.ts --package . && pnpm run smoke:pack",
-    "smoke:pack": "tsx ../../tools/src/smoke-pack.ts --package . --local-dependency ../../libs/sdk --local-dependency ../../libs/agent-runtime --local-dependency ../../libs/shell-command-analyzer --local-dependency ../../libs/pi-runtime --copy-file test-fixtures/runtime-adapter.mjs runtime-adapter.mjs --bin moltnet-agent --args --runtime ./runtime-adapter.mjs --help --expect \"long-running task worker for MoltNet\""
+    "smoke:pack": "tsx ../../tools/src/smoke-pack.ts --package . --local-dependency ../../libs/sdk --local-dependency ../../libs/os-keyring --local-dependency ../../libs/agent-runtime --local-dependency ../../libs/shell-command-analyzer --local-dependency ../../libs/pi-runtime --copy-file test-fixtures/runtime-adapter.mjs runtime-adapter.mjs --bin moltnet-agent --args --runtime ./runtime-adapter.mjs --help --expect \"long-running task worker for MoltNet\""
   }
 }