@themoltnet/agent-daemon 0.41.1 → 0.42.1

package/dist/cli.js

@@ -23,6 +23,8 @@ import { ed25519 } from "@noble/curves/ed25519.js";
 import * as ed from "@noble/ed25519";
 import { createHash as createHash$1, randomBytes } from "crypto";
 import "@ipld/dag-cbor";
+import "@noble/ciphers/chacha";
+import "@noble/hashes/hkdf";
 import { once } from "node:events";
 import { pino, transport } from "pino";
 import { metrics } from "@opentelemetry/api";
@@ -672,10 +674,10 @@ Type.Object({
 		Type.Literal("completed"),
 		Type.Literal("failed")
 	]),
-	githubCode: Type.Optional(Type.String()),
+	githubCode: Type.Optional(Type.String({ description: "GitHub manifest code sealed to the onboarding agent public key." })),
 	identityId: Type.Optional(Type.String()),
 	clientId: Type.Optional(Type.String()),
-	clientSecret: Type.Optional(Type.String()),
+	clientSecret: Type.Optional(Type.String({ description: "OAuth2 client secret sealed to the onboarding agent public key." })),
 	installationId: Type.Optional(Type.String())
 });
 Type.Object({
@@ -858,6 +860,23 @@ var DiaryGrantResponseSchema = Type.Object({
 });
 Type.Object({ grants: Type.Array(DiaryGrantResponseSchema) });
 Type.Object({ revoked: Type.Boolean() });
+var TaskGrantRoleSchema = Type.Union([Type.Literal("writer"), Type.Literal("manager")]);
+Type.Object({
+	subjectId: UuidSchema,
+	subjectNs: GrantSubjectNsSchema,
+	role: TaskGrantRoleSchema
+});
+Type.Object({
+	subjectId: UuidSchema,
+	subjectNs: GrantSubjectNsSchema,
+	role: TaskGrantRoleSchema
+});
+var TaskGrantResponseSchema = Type.Object({
+	subjectId: UuidSchema,
+	subjectNs: GrantSubjectNsSchema,
+	role: TaskGrantRoleSchema
+});
+Type.Object({ grants: Type.Array(TaskGrantResponseSchema) });
 Type.Object({ "x-moltnet-team-id": Type.String({
 	format: "uuid",
 	description: "Team ID (UUID) that will own the resource. Required."
@@ -3233,7 +3252,7 @@ Type.Object({
 	allowedProfiles: Type.Array(RuntimeProfileRef, { maxItems: 16 }),
 	status: TaskStatus,
 	queuedAt: IsoTimestamp,
-	completedAt: Type.Union([IsoTimestamp, Type.Null()]),
+	completedAt: Type.Union([IsoTimestamp, Type.Null()], { description: "First time the task entered completed, failed, cancelled, or expired; null until terminal." }),
 	expiresAt: Type.Union([IsoTimestamp, Type.Null()]),
 	cancelledByAgentId: Type.Union([Uuid, Type.Null()]),
 	cancelledByHumanId: Type.Union([Uuid, Type.Null()]),
@@ -4079,11 +4098,13 @@ async function maybeAttachWarmSlotContext(claimedTask, basePlan, stateDirs, slot
 		if (resolution.kind === "remote-session") {
 			const recoveredBranch = await sourceAttemptResolver.findOutputBranch({
 				attemptN: continueFrom.attemptN,
-				taskId: continueFrom.taskId
+				taskId: continueFrom.taskId,
+				teamId: claimedTask.task.teamId
 			});
 			const recoveredRevision = recoveredBranch ? null : await sourceAttemptResolver.findInputRevision({
 				attemptN: continueFrom.attemptN,
-				taskId: continueFrom.taskId
+				taskId: continueFrom.taskId,
+				teamId: claimedTask.task.teamId
 			});
 			if (continueFrom.mode === "fork") {
 				if (recoveredBranch || recoveredRevision) {
@@ -4120,7 +4141,8 @@ async function maybeAttachWarmSlotContext(claimedTask, basePlan, stateDirs, slot
 		const parentBranch = resolution.producerSlot.workspace?.worktreeBranch ?? null;
 		const parentRevision = parentBranch ? null : await sourceAttemptResolver.findInputRevision({
 			attemptN: continueFrom.attemptN,
-			taskId: continueFrom.taskId
+			taskId: continueFrom.taskId,
+			teamId: claimedTask.task.teamId
 		});
 		if (continueFrom.mode === "fork") {
 			if (!parentBranch && !parentRevision) throw new ProducerContextResolutionError(`Cannot fork continuation of ${continueFrom.taskId}/${continueFrom.attemptN}: producer slot has no worktree branch or immutable revision to fork from`);
@@ -5592,12 +5614,12 @@ function createApiSourceAttemptResolver(args) {
 	const { agent } = args;
 	return {
 		async findOutputBranch(input) {
-			const attempt = (await agent.tasks.listAttempts(input.taskId)).find((candidate) => candidate.attemptN === input.attemptN);
+			const attempt = (await agent.tasks.listAttempts(input.taskId, { teamId: input.teamId })).find((candidate) => candidate.attemptN === input.attemptN);
 			if (!attempt || attempt.status !== "completed") return null;
 			return resolveOutputBranch(attempt.output);
 		},
 		async findInputRevision(input) {
-			const task = await agent.tasks.get(input.taskId);
+			const task = await agent.tasks.get(input.taskId, { teamId: input.teamId });
 			if (task.status !== "completed" || task.acceptedAttemptN !== input.attemptN) return null;
 			return resolveTaskWorkspaceRevision(task.input);
 		}
@@ -6013,6 +6035,7 @@ async function runPolling(opts) {
 				const selected = runtimeForClaimedTask(runtimes, claimedTask);
 				return new ApiTaskReporter({
 					tasks: ctx.agent.tasks,
+					teamId: claimedTask.task.teamId,
 					leaseTtlSec: selected.common.leaseTtlSec,
 					heartbeatIntervalMs: selected.common.heartbeatIntervalMs,
 					maxBatchSize: selected.common.maxBatchSize,
@@ -6641,12 +6664,14 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 			source: new ApiTaskSource({
 				agent: ctx.agent,
 				taskId,
+				teamId: profile.teamId,
 				leaseTtlSec: opts.leaseTtlSec,
 				profileId: profile.id,
 				executorFingerprint: preparedRuntime.attestor.fingerprint
 			}),
 			makeReporter: () => new ApiTaskReporter({
 				tasks: ctx.agent.tasks,
+				teamId: profile.teamId,
 				leaseTtlSec: opts.leaseTtlSec,
 				heartbeatIntervalMs: opts.heartbeatIntervalMs,
 				maxBatchSize: opts.maxBatchSize,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/agent-daemon",
-  "version": "0.41.1",
+  "version": "0.42.1",
   "license": "AGPL-3.0-only",
   "type": "module",
   "description": "Universal MoltNet agent daemon host with a built-in Pi/Gondolin runtime and support for trusted operator-owned runtime modules. CLI: moltnet-agent.",
@@ -52,6 +52,7 @@
     "@earendil-works/pi-coding-agent": "0.79.4",
     "@fastify/otel": "^0.18.0",
     "@ipld/dag-cbor": "^9.2.5",
+    "@noble/ciphers": "^1.2.0",
     "@noble/curves": "^2.0.0",
     "@noble/ed25519": "^2.0.0",
     "@noble/hashes": "^1.7.0",
@@ -77,9 +78,9 @@
     "pino-opentelemetry-transport": "^3.0.0",
     "pino-pretty": "^13.1.3",
     "typebox": "^1.2.8",
-    "@themoltnet/pi-runtime": "0.9.0",
-    "@themoltnet/agent-runtime": "0.42.0",
-    "@themoltnet/sdk": "0.133.0",
+    "@themoltnet/agent-runtime": "0.43.1",
+    "@themoltnet/pi-runtime": "0.10.1",
+    "@themoltnet/sdk": "0.135.0",
     "@themoltnet/os-keyring": "0.2.0"
   },
   "devDependencies": {
@@ -88,10 +89,10 @@
     "vite": "^8.0.0",
     "vite-plugin-dts": "^4.5.4",
     "vitest": "^3.0.0",
-    "@moltnet/bootstrap": "0.1.0",
     "@moltnet/crypto-service": "0.1.0",
-    "@moltnet/models": "0.1.0",
+    "@moltnet/bootstrap": "0.1.0",
     "@moltnet/observability": "0.1.0",
+    "@moltnet/models": "0.1.0",
     "@moltnet/tasks": "0.1.0"
   },
   "nx": {