@themoltnet/agent-daemon 0.43.0 → 0.44.0

package/README.md

@@ -128,6 +128,16 @@ hostname pattern, and port (HTTPS/443 by default). See
 This does not provide diary or Git commit signing; private-key operations remain
 host capabilities.
 
+Host capabilities replace the last reason for `guest-config`: the stock runtime
+declares `agent-signing`, so `git commit -S` and `moltnet entry create-signed`
+work inside the guest while the seed stays on the host (the daemon injects a
+signer bound to the authenticated identity and projects a non-secret gitconfig,
+an `SSH_AUTH_SOCK` service, and `MOLTNET_SIGNER_URL`). Grant
+`capability:agent-signing` (or per-operation `capability:agent-signing:<op>`)
+in the tool policy. `--git-author "Name <email>"` / `MOLTNET_GIT_AUTHOR`
+overrides the projected git identity. See
+[Host capabilities](../../docs/operate/running-agents.md#host-capabilities).
+
 `sync-sessions` does not prepare or attest executors, so it remains independent
 of `MOLTNET_PRIVATE_KEY`.
 

package/dist/cli.js

@@ -8,20 +8,20 @@ import "multiformats/hashes/sha2";
 import "typebox/value";
 import { dirname, join, resolve } from "node:path";
 import { parseArgs, promisify } from "node:util";
-import { AgentRuntime, ApiTaskReporter, ApiTaskSource, PollingApiTaskSource, resolveProfileWarmSessionTtlSec, resolveRuntimeProfile, resolveRuntimeProfiles, validateRuntimeProfilePrerequisites } from "@themoltnet/agent-runtime";
+import { AgentRuntime, ApiTaskReporter, ApiTaskSource, PollingApiTaskSource, createLocalSeedSigner, resolveAgentIdentity, resolveProfileWarmSessionTtlSec, resolveRuntimeProfile, resolveRuntimeProfiles, validateRuntimeProfilePrerequisites } from "@themoltnet/agent-runtime";
 import { GuestEnvironmentBoundaryError, assertGuestEnvironmentBoundary, createPiRetryTriage, findMainWorktree, isResolvedPathInsideRoot, normalizeRetryTriageResult, redactRetryTriageSecrets } from "@themoltnet/pi-runtime";
 import { execFile, execFileSync } from "node:child_process";
 import { createReadStream, createWriteStream, existsSync, mkdirSync, readdirSync, realpathSync, rmSync } from "node:fs";
 import { AuthenticationError, MoltNetError, connect, createExecutorAttestor, readConfig } from "@themoltnet/sdk";
 import { createNodeSecretProviderRegistry } from "@themoltnet/sdk/node";
 import { createHash, randomUUID } from "node:crypto";
+import * as ed from "@noble/ed25519";
+import { createHash as createHash$1, randomBytes } from "crypto";
 import "multiformats/codecs/raw";
 import "multiformats/hashes/digest";
 import "@noble/hashes/sha2";
 import "multiformats/bases/base32";
 import { ed25519 } from "@noble/curves/ed25519.js";
-import * as ed from "@noble/ed25519";
-import { createHash as createHash$1, randomBytes } from "crypto";
 import "@ipld/dag-cbor";
 import "@noble/ciphers/chacha";
 import "@noble/hashes/hkdf";
@@ -690,12 +690,12 @@ var RUNTIME_PROFILE_CONTEXT_CATALOGUE = {
 		},
 		"accountable-delivery-v1": {
 			binding: "prompt_prefix",
-			content: "# Accountable delivery\n\n- Pair every commit made during this task with a task-provenance diary entry created by the `moltnet_create_entry` custom tool. Put the returned id in a `MoltNet-Diary: <id>` commit trailer. The tool does not currently promise a content signature; never describe an entry as signed unless the active runtime exposes and verifies a signing capability.\n- Do not disable commit signing when the active runtime provides it. A host-authenticated guest has no injected signing key, so do not recover one from host configuration or claim an unsigned commit is signed.\n- Push a branch and open or update a pull request only when the task asks for it. Use a host-brokered GitHub placeholder only when the runtime kernel declares one; if no GitHub credential is active, the authenticated operation is unavailable.\n- Keep changes, commits, and any requested pull request coherent enough to review independently.",
+			content: "# Accountable delivery\n\n- Pair every commit made during this task with a task-provenance diary entry created by the `moltnet_create_entry` custom tool. Put the returned id in a `MoltNet-Diary: <id>` commit trailer. The tool does not currently promise a content signature unless you pass `signed: true` while the runtime kernel declares the `agent-signing` host capability; never describe an entry as signed otherwise.\n- When the runtime kernel declares `agent-signing`, sign commits normally with `git commit -S`: the signature is brokered to the trusted host through `SSH_AUTH_SOCK` and no private key exists in the guest. Without that capability commits are unsigned; do not disable signing the runtime provides, and never try to obtain a key from host configuration.\n- Push a branch and open or update a pull request only when the task asks for it. Use a host-brokered GitHub placeholder only when the runtime kernel declares one; if no GitHub credential is active, the authenticated operation is unavailable.\n- Keep changes, commits, and any requested pull request coherent enough to review independently.",
 			slug: "accountable-delivery-v1"
 		},
 		"judgment-diary-v1": {
 			binding: "prompt_prefix",
-			content: "# Judgment diary discipline\n\n- For an `assess_brief`, `judge_pack`, or `pr_review` task, create a diary entry with the `moltnet_create_entry` custom tool before submitting the structured judgment. Capture the rationale and evidence that support the verdict. Do not claim a content signature unless the active runtime exposes and verifies a signing capability.\n- Add the `judgment` tag and the active task type tag (`assess_brief`, `judge_pack`, or `pr_review`). For `judge_pack`, also add `rubric:<rubricId>` from the task facts.\n- Do not use a shell `moltnet entry` command: task provenance is injected only by the custom tool.",
+			content: "# Judgment diary discipline\n\n- For an `assess_brief`, `judge_pack`, or `pr_review` task, create a diary entry with the `moltnet_create_entry` custom tool before submitting the structured judgment. Capture the rationale and evidence that support the verdict. Do not claim a content signature unless you created the entry with `signed: true` under a runtime that declares the `agent-signing` host capability.\n- Add the `judgment` tag and the active task type tag (`assess_brief`, `judge_pack`, or `pr_review`). For `judge_pack`, also add `rubric:<rubricId>` from the task facts.\n- Do not use a shell `moltnet entry` command: task provenance is injected only by the custom tool.",
 			slug: "judgment-diary-v1"
 		},
 		"proactive-memory-v1": {
@@ -710,7 +710,7 @@ var RUNTIME_PROFILE_CONTEXT_CATALOGUE = {
 		},
 		"task-diary-discipline-v1": {
 			binding: "prompt_prefix",
-			content: "# Task diary discipline\n\n- During a daemon task, create diary entries only through the `moltnet_create_entry` custom tool. It binds entries to the current task diary and injects task, type, attempt, and correlation provenance tags.\n- Do not shell out to `moltnet entry create`, `moltnet entry create-signed`, or any other `moltnet entry` subcommand from bash while a task is running. Those paths bypass the custom tool's task-tag injection, so task-filtered diary queries cannot find the entry.\n- You may add useful tags, but do not try to replace task provenance supplied by the runtime.",
+			content: "# Task diary discipline\n\n- During a daemon task, create diary entries only through the `moltnet_create_entry` custom tool. It binds entries to the current task diary and injects task, type, attempt, and correlation provenance tags.\n- Do not shell out to `moltnet entry create`, `moltnet entry create-signed`, or any other `moltnet entry` subcommand from bash while a task is running. For a content-signed entry pass `signed: true` to the custom tool instead; it signs on the trusted host. Those shell paths bypass the custom tool's task-tag injection, so task-filtered diary queries cannot find the entry.\n- You may add useful tags, but do not try to replace task provenance supplied by the runtime.",
 			slug: "task-diary-discipline-v1"
 		},
 		"verification-and-artifacts-v1": {
@@ -1132,7 +1132,11 @@ Type.Object({ name: Type.String({
 	maxLength: 255
 }) });
 Type.Object({
-	role: Type.Optional(Type.Union([Type.Literal("manager"), Type.Literal("member")])),
+	role: Type.Optional(Type.Union([
+		Type.Literal("manager"),
+		Type.Literal("executor"),
+		Type.Literal("member")
+	])),
 	maxUses: Type.Optional(Type.Integer({
 		minimum: 1,
 		default: 1
@@ -1144,10 +1148,15 @@ Type.Object({
 	}))
 });
 Type.Object({ code: Type.String({ minLength: 1 }) });
-Type.Object({ role: Type.Union([Type.Literal("manager"), Type.Literal("member")]) });
+Type.Object({ role: Type.Union([
+	Type.Literal("manager"),
+	Type.Literal("executor"),
+	Type.Literal("member")
+]) });
 var TeamRoleSchema = Type.Union([
 	Type.Literal("owner"),
 	Type.Literal("manager"),
+	Type.Literal("executor"),
 	Type.Literal("member")
 ]);
 Type.Object({
@@ -1158,7 +1167,11 @@ var DateTimeUnsafe = Type.Unsafe(Type.String({ format: "date-time" }));
 Type.Object({
 	id: UuidSchema,
 	code: Type.String(),
-	role: Type.Union([Type.Literal("manager"), Type.Literal("member")]),
+	role: Type.Union([
+		Type.Literal("manager"),
+		Type.Literal("executor"),
+		Type.Literal("member")
+	]),
 	maxUses: Type.Integer(),
 	useCount: Type.Integer(),
 	expiresAt: DateTimeUnsafe,
@@ -1190,11 +1203,19 @@ Type.Object({
 });
 Type.Object({
 	teamId: UuidSchema,
-	role: Type.Union([Type.Literal("manager"), Type.Literal("member")])
+	role: Type.Union([
+		Type.Literal("manager"),
+		Type.Literal("executor"),
+		Type.Literal("member")
+	])
 });
 Type.Object({
 	updated: Type.Boolean(),
-	role: Type.Union([Type.Literal("manager"), Type.Literal("member")])
+	role: Type.Union([
+		Type.Literal("manager"),
+		Type.Literal("executor"),
+		Type.Literal("member")
+	])
 });
 Type.Object({ deleted: Type.Boolean() });
 Type.Object({ removed: Type.Boolean() });
@@ -1204,6 +1225,7 @@ var FoundingMemberSchema = Type.Object({
 	role: Type.Union([
 		Type.Literal("owner"),
 		Type.Literal("manager"),
+		Type.Literal("executor"),
 		Type.Literal("member")
 	])
 });
@@ -3359,6 +3381,12 @@ var COMMON_OPTIONAL_FLAGS = `\
                               sandbox policy.
   --agent-root <path>         Directory that owns .moltnet/<agent>. Default:
                               CWD, with git root fallback when available.
+  --git-author <"Name <email>">
+                              Non-secret git identity projected into the
+                              guest for host-brokered commit signing. Default:
+                              host git config (OAuth2) or
+                              <identityId>+<agent>[bot]@users.noreply.github.com.
+                              Env: MOLTNET_GIT_AUTHOR.
   --guest-credential-mode <mode>
                               Guest trust boundary: host-authenticated or
                               guest-config. Defaults to host-authenticated for
@@ -3714,6 +3742,7 @@ function loadConfig() {
 		piCodingAgentDir: process.env["PI_CODING_AGENT_DIR"] ?? "",
 		authMode: detectAuthMode(process.env),
 		signingPrivateKey: process.env["MOLTNET_PRIVATE_KEY"] ?? "",
+		gitAuthor: process.env["MOLTNET_GIT_AUTHOR"] ?? "",
 		traceIdlePolling: readBoolean("MOLTNET_TRACE_IDLE_POLLING", process.env["MOLTNET_TRACE_IDLE_POLLING"])
 	};
 }
@@ -3738,6 +3767,30 @@ async function abortActiveAttemptOnSignal(opts) {
 	}
 }
 //#endregion
+//#region src/lib/agent-identity.ts
+/**
+* Build the non-secret identity projected into guests. Host git config is a
+* non-secret input and is consulted only on OAuth2 hosts, which already read
+* that configuration for the signing seed; configless agent-key hosts never
+* touch a config directory.
+*/
+async function resolveDaemonAgentIdentity(input) {
+	let hostGit;
+	if (input.gitAuthor === void 0 && input.authMode === "oauth2") {
+		const config = await readConfig(input.agentDir);
+		hostGit = config?.git ? {
+			name: config.git.name,
+			email: config.git.email
+		} : void 0;
+	}
+	return resolveAgentIdentity({
+		agentName: input.agentName,
+		whoami: input.whoami,
+		gitAuthor: input.gitAuthor,
+		hostGit
+	});
+}
+//#endregion
 //#region src/lib/correlation.ts
 var execFileAsync = promisify(execFile);
 var CORRELATION_TRAILER_KEY = "Moltnet-Correlation-Id";
@@ -4256,6 +4309,19 @@ function recoverScratchWorkspacePath(producer, stateDirs) {
 	const fallback = join(stateDirs.rootDir, "task-workspaces", producer.workspace.workspaceId);
 	return existsSync(fallback) ? fallback : null;
 }
+//#endregion
+//#region ../../libs/crypto-service/src/ssh.ts
+/**
+* SSH key format conversion for MoltNet Ed25519 keys
+*
+* Converts MoltNet agent keys (ed25519:<base64>) to OpenSSH format
+* for use with git commit signing and SSH authentication.
+*/
+if (!ed.etc.sha512Sync) ed.etc.sha512Sync = (...m) => {
+	const hash = createHash$1("sha512");
+	m.forEach((msg) => hash.update(msg));
+	return hash.digest();
+};
 new TextEncoder();
 //#endregion
 //#region ../../libs/crypto-service/src/crypto.service.ts
@@ -4408,19 +4474,7 @@ ed.etc.sha512Sync = (...m) => {
 	m.forEach((msg) => hash.update(msg));
 	return hash.digest();
 };
-//#endregion
-//#region ../../libs/crypto-service/src/ssh.ts
-/**
-* SSH key format conversion for MoltNet Ed25519 keys
-*
-* Converts MoltNet agent keys (ed25519:<base64>) to OpenSSH format
-* for use with git commit signing and SSH authentication.
-*/
-if (!ed.etc.sha512Sync) ed.etc.sha512Sync = (...m) => {
-	const hash = createHash$1("sha512");
-	m.forEach((msg) => hash.update(msg));
-	return hash.digest();
-};
+new TextEncoder().encode("SSHSIG");
 //#endregion
 //#region src/lib/executor-attestation.ts
 var DAEMON_REQUIRED_SCOPES = AGENT_CREDENTIAL_SCOPES;
@@ -4942,6 +4996,7 @@ function commonOptionDefs() {
 		},
 		"agent-root": { type: "string" },
 		"guest-credential-mode": { type: "string" },
+		"git-author": { type: "string" },
 		"lease-ttl-sec": { type: "string" },
 		"heartbeat-interval-ms": { type: "string" },
 		"max-batch-size": { type: "string" },
@@ -5652,7 +5707,7 @@ async function runPolling(opts) {
 	if (taskTypes.length === 0) console.error(`[${opts.modeLabel}] --task-types is empty — daemon will accept any registered type. Pass an explicit list to limit scope (e.g. --task-types fulfill_brief).`);
 	const cfg = loadConfig();
 	const agentRootDir = resolve(process.cwd(), values["agent-root"] ?? process.cwd());
-	const { ctx, signingPrivateKey, startupWhoami } = await (async () => {
+	const { ctx, signingPrivateKey, startupWhoami, agentIdentity, hostCapabilitySigner } = await (async () => {
 		let gate = "resolve_agent_context";
 		try {
 			const resolvedContext = await resolveAgentContext(baseCommon.agent, {
@@ -5678,10 +5733,24 @@ async function runPolling(opts) {
 				whoami,
 				signingPrivateKey: privateKey
 			});
+			gate = "resolve_agent_identity";
+			const agentIdentity = await resolveDaemonAgentIdentity({
+				agentName: baseCommon.agent,
+				whoami,
+				authMode: cfg.authMode,
+				agentDir: resolvedContext.agentDir,
+				gitAuthor: values["git-author"] ?? (cfg.gitAuthor || void 0)
+			});
 			return {
 				ctx: resolvedContext,
 				signingPrivateKey: privateKey,
-				startupWhoami: whoami
+				startupWhoami: whoami,
+				agentIdentity,
+				hostCapabilitySigner: createLocalSeedSigner({
+					privateKeySeed: privateKey,
+					agent: resolvedContext.agent,
+					identity: agentIdentity
+				})
 			};
 		} catch (error) {
 			await logDaemonStartupFailure({
@@ -6112,6 +6181,9 @@ async function runPolling(opts) {
 				const rawExecuteTask = selected.preparedRuntime.createTaskExecutor({
 					agentName: common.agent,
 					moltnetAgent: ctx.agent,
+					agentIdentity,
+					hostCapabilitySigner,
+					hostCapabilityLogger: taskLogger,
 					guestCredentialMode: ctx.guestCredentialMode,
 					agentRootDir: ctx.agentRootDir,
 					mountPath: sandbox.rootDir,
@@ -6276,7 +6348,7 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 	const cfg = loadConfig();
 	const initialOpts = opts;
 	const agentRootDir = resolve(process.cwd(), values["agent-root"] ?? process.cwd());
-	const { ctx, signingPrivateKey } = await (async () => {
+	const { ctx, signingPrivateKey, agentIdentity, hostCapabilitySigner } = await (async () => {
 		let gate = "resolve_agent_context";
 		try {
 			const resolvedContext = await resolveAgentContext(initialOpts.agent, {
@@ -6302,9 +6374,23 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 				whoami,
 				signingPrivateKey: privateKey
 			});
+			gate = "resolve_agent_identity";
+			const agentIdentity = await resolveDaemonAgentIdentity({
+				agentName: initialOpts.agent,
+				whoami,
+				authMode: cfg.authMode,
+				agentDir: resolvedContext.agentDir,
+				gitAuthor: values["git-author"] ?? (cfg.gitAuthor || void 0)
+			});
 			return {
 				ctx: resolvedContext,
-				signingPrivateKey: privateKey
+				signingPrivateKey: privateKey,
+				agentIdentity,
+				hostCapabilitySigner: createLocalSeedSigner({
+					privateKeySeed: privateKey,
+					agent: resolvedContext.agent,
+					identity: agentIdentity
+				})
 			};
 		} catch (error) {
 			await logDaemonStartupFailure({
@@ -6479,6 +6565,9 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 		const rawExecuteTask = preparedRuntime.createTaskExecutor({
 			agentName: opts.agent,
 			moltnetAgent: ctx.agent,
+			agentIdentity,
+			hostCapabilitySigner,
+			hostCapabilityLogger: rootLogger,
 			guestCredentialMode: ctx.guestCredentialMode,
 			agentRootDir: ctx.agentRootDir,
 			mountPath: sandbox.rootDir,

package/dist/pi.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pi.d.ts","sourceRoot":"","sources":["../src/pi.ts"],"names":[],"mappings":"AAAA,OAAO,EAQL,KAAK,mBAAmB,EACzB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,KAAK,EAAE,oBAAoB,EAAyB,MAAM,cAAc,CAAC;AAEhF,eAAO,MAAM,oBAAoB,kkBAIvB,CAAC;AAEX,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,mBAAmB,GAC3B,oBAAoB,CA4DtB;AAED,eAAO,MAAM,0BAA0B,qBAQrC,CAAC;AAEH,eAAO,MAAM,sBAAsB,sBAElC,CAAC"}
+{"version":3,"file":"pi.d.ts","sourceRoot":"","sources":["../src/pi.ts"],"names":[],"mappings":"AAAA,OAAO,EASL,KAAK,mBAAmB,EACzB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,KAAK,EAAE,oBAAoB,EAAyB,MAAM,cAAc,CAAC;AAEhF,eAAO,MAAM,oBAAoB,kkBAIvB,CAAC;AAEX,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,mBAAmB,GAC3B,oBAAoB,CA4DtB;AAED,eAAO,MAAM,0BAA0B,qBASrC,CAAC;AAEH,eAAO,MAAM,sBAAsB,sBAElC,CAAC"}

package/dist/pi.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { GONDOLIN_BASE_EXECUTABLES, GONDOLIN_TOOL_NAMES, MOLTNET_TOOL_NAMES, buildPiExecutorManifest, createPiTaskExecutor, defineGondolinTemplate, definePiRuntime } from "@themoltnet/pi-runtime";
+import { GONDOLIN_BASE_EXECUTABLES, GONDOLIN_TOOL_NAMES, MOLTNET_TOOL_NAMES, agentSigningCapability, buildPiExecutorManifest, createPiTaskExecutor, defineGondolinTemplate, definePiRuntime } from "@themoltnet/pi-runtime";
 //#region src/pi.ts
 var PI_KERNEL_TOOL_NAMES = [
 	...GONDOLIN_TOOL_NAMES,
@@ -59,7 +59,8 @@ var defaultPiRuntimeDefinition = definePiRuntime({
 		id: "moltnet-default-gondolin",
 		version: "1",
 		executables: GONDOLIN_BASE_EXECUTABLES
-	})
+	}),
+	hostCapabilities: [agentSigningCapability]
 });
 var defaultPiDaemonAdapter = createPiDaemonAdapter(defaultPiRuntimeDefinition);
 //#endregion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/agent-daemon",
-  "version": "0.43.0",
+  "version": "0.44.0",
   "license": "AGPL-3.0-only",
   "type": "module",
   "description": "Universal MoltNet agent daemon host with a built-in Pi/Gondolin runtime and support for trusted operator-owned runtime modules. CLI: moltnet-agent.",
@@ -78,10 +78,10 @@
     "pino-opentelemetry-transport": "^3.0.0",
     "pino-pretty": "^13.1.3",
     "typebox": "^1.2.8",
-    "@themoltnet/agent-runtime": "0.43.2",
+    "@themoltnet/agent-runtime": "0.44.0",
     "@themoltnet/os-keyring": "0.2.0",
-    "@themoltnet/pi-runtime": "0.11.0",
-    "@themoltnet/sdk": "0.136.0"
+    "@themoltnet/sdk": "0.137.0",
+    "@themoltnet/pi-runtime": "0.12.0"
   },
   "devDependencies": {
     "tsx": "^4.7.0",
@@ -89,12 +89,12 @@
     "vite": "^8.0.0",
     "vite-plugin-dts": "^4.5.4",
     "vitest": "^3.0.0",
-    "@moltnet/bootstrap": "0.1.0",
+    "@moltnet/crypto-service": "0.1.0",
     "@moltnet/models": "0.1.0",
-    "@moltnet/runtime-profiles": "0.1.0",
+    "@moltnet/observability": "0.1.0",
     "@moltnet/tasks": "0.1.0",
-    "@moltnet/crypto-service": "0.1.0",
-    "@moltnet/observability": "0.1.0"
+    "@moltnet/bootstrap": "0.1.0",
+    "@moltnet/runtime-profiles": "0.1.0"
   },
   "nx": {
     "projectType": "application",