@themoltnet/agent-daemon 0.44.0 → 0.44.1

package/README.md

@@ -102,33 +102,24 @@ any team where the agent is authorized. It fails fast if the key is rejected,
 is not an agent, or a team binding mismatches. See
 [Run the daemon with an agent key](../../docs/operate/running-agents.md#run-the-daemon-with-an-agent-key).
 
-Daemon authentication and guest credential projection are two separate
-boundaries. How the daemon authenticates (an agent key, or OAuth2 resolved
-from `.moltnet/<agent>/moltnet.json` through the host secret provider) decides
-how the host-side SDK `Agent` is built. `--guest-credential-mode` decides
-whether the local agent credential tree is copied into Gondolin. Pi guests
-default to the `host-authenticated` boundary in **both** auth modes, regardless
-of local files: no `.moltnet` file, gitconfig, SSH signing key, GitHub App PEM,
-or MoltNet environment credential is injected into Gondolin, and mounted
-`.moltnet` paths are hidden. Structured MoltNet tools execute through the
-host-side `Agent`. Operators may explicitly opt into the legacy
-credential-bearing boundary with `--guest-credential-mode guest-config`; that
-mode requires a complete local `moltnet.json` + `env` pair and copies the
-complete agent configuration and signing credentials into the guest. Reserve it
-for local or otherwise operator-trusted tasks that genuinely need guest-shell
-MoltNet CLI, Git signing, or GitHub authentication. OAuth2 daemons that relied
-on the previous `guest-config` default for such tasks must now pass the flag
-explicitly.
-
-Trusted custom runtimes can deliver destination-bound HTTP credentials without
-switching to `guest-config`: the guest receives an opaque placeholder and the
-Gondolin host proxy substitutes the value only for the attested protocol,
-hostname pattern, and port (HTTPS/443 by default). See
+Daemon authentication and the guest boundary are two separate concerns. How the
+daemon authenticates (an agent key, or OAuth2 resolved from
+`.moltnet/<agent>/moltnet.json` through the host secret provider) decides how the
+host-side SDK `Agent` is built. The guest boundary is fixed: **the guest never
+receives MoltNet credential material.** No `.moltnet` file, gitconfig, SSH
+signing key, GitHub App PEM, or MoltNet environment credential is injected into
+Gondolin, and mounted `.moltnet` paths are hidden. Structured MoltNet tools
+execute through the host-side `Agent`.
+
+Trusted custom runtimes can deliver destination-bound HTTP credentials to the
+guest: it receives an opaque placeholder and the Gondolin host proxy substitutes
+the value only for the attested protocol, hostname pattern, and port (HTTPS/443
+by default). See
 [Host-brokered HTTP credentials](../../docs/operate/running-agents.md#host-brokered-http-credentials).
 This does not provide diary or Git commit signing; private-key operations remain
 host capabilities.
 
-Host capabilities replace the last reason for `guest-config`: the stock runtime
+Host capabilities carry in-guest signing: the stock runtime
 declares `agent-signing`, so `git commit -S` and `moltnet entry create-signed`
 work inside the guest while the seed stays on the host (the daemon injects a
 signer bound to the authenticated identity and projects a non-secret gitconfig,

package/dist/cli.js

@@ -3387,12 +3387,6 @@ var COMMON_OPTIONAL_FLAGS = `\
                               host git config (OAuth2) or
                               <identityId>+<agent>[bot]@users.noreply.github.com.
                               Env: MOLTNET_GIT_AUTHOR.
-  --guest-credential-mode <mode>
-                              Guest trust boundary: host-authenticated or
-                              guest-config. Defaults to host-authenticated for
-                              both agent-key and OAuth2 authentication.
-                              Explicit guest-config exposes the complete local
-                              agent credential tree to the VM.
   --lease-ttl-sec <n>         Sliding liveness window. Silence longer than
                               this ends the attempt with lease_expired.
                               Default: 300.
@@ -3567,21 +3561,6 @@ function isHelpFlag(args) {
 //#endregion
 //#region src/lib/agent-context.ts
 /**
-* Guest credentials are an explicit trust decision, never an incidental
-* consequence of files found on disk. The guest boundary is independent of
-* how the daemon itself authenticates: both agent-key and OAuth2 default to
-* the host-authenticated boundary, where structured MoltNet operations reuse
-* the trusted host-side Agent and the guest receives no credential material.
-* OAuth2 still resolves that Agent from the local config and secret provider
-* on the host — reading `moltnet.json` on the host does not imply projecting
-* it into the guest. `guest-config` remains an explicit compatibility opt-in
-* for tasks that need credential-bearing guest-shell operations.
-*/
-function resolveDaemonGuestCredentialMode(requested) {
-	if (requested !== void 0 && requested !== "guest-config" && requested !== "host-authenticated") throw new Error(`Invalid --guest-credential-mode "${requested}": expected guest-config or host-authenticated.`);
-	return requested ?? "host-authenticated";
-}
-/**
 * Report which auth mode `connect()` will use, without ever reading the secret
 * value into anything logged. Agent-key mode is selected when
 * `MOLTNET_AGENT_KEY` holds a non-blank value — mirroring the SDK precedence
@@ -3653,20 +3632,15 @@ async function validateStartupBinding(options) {
 async function resolveAgentContext(agentName, options = {}) {
 	if (!/^[a-zA-Z0-9_-]+$/.test(agentName)) throw new Error(`Invalid agent name "${agentName}": must match /^[a-zA-Z0-9_-]+$/`);
 	const roots = resolveCredentialRoots(options.agentRootDir);
-	const guestCredentialMode = resolveDaemonGuestCredentialMode(options.guestCredentialMode);
 	if (options.authMode === "agent-key") {
-		const { rootDir, agentDir } = guestCredentialMode === "guest-config" ? resolveCompleteGuestCredentials(roots, agentName) : {
-			rootDir: roots[0] ?? process.cwd(),
-			agentDir: join(roots[0] ?? process.cwd(), ".moltnet", agentName)
-		};
+		const rootDir = roots[0] ?? process.cwd();
 		return {
-			agentDir,
+			agentDir: join(rootDir, ".moltnet", agentName),
 			agentRootDir: rootDir,
-			agent: await connect(),
-			guestCredentialMode
+			agent: await connect()
 		};
 	}
-	const located = guestCredentialMode === "guest-config" ? resolveCompleteGuestCredentials(roots, agentName) : locateAgentConfig(roots, agentName);
+	const located = locateAgentConfig(roots, agentName);
 	if (located) {
 		const agent = await connect({
 			configDir: located.agentDir,
@@ -3675,8 +3649,7 @@ async function resolveAgentContext(agentName, options = {}) {
 		return {
 			agentDir: located.agentDir,
 			agentRootDir: located.rootDir,
-			agent,
-			guestCredentialMode
+			agent
 		};
 	}
 	const tried = roots.map((root) => join(root, ".moltnet", agentName));
@@ -3697,22 +3670,6 @@ function locateAgentConfig(roots, agentName) {
 		};
 	}
 }
-function resolveCompleteGuestCredentials(roots, agentName) {
-	const partial = [];
-	for (const rootDir of roots) {
-		const agentDir = join(rootDir, ".moltnet", agentName);
-		const hasConfig = existsSync(join(agentDir, "moltnet.json"));
-		const hasEnv = existsSync(join(agentDir, "env"));
-		if (hasConfig && hasEnv) return {
-			rootDir,
-			agentDir
-		};
-		if (hasConfig || hasEnv) partial.push(agentDir);
-	}
-	if (partial.length > 0) throw new Error(`Incomplete guest credentials in ${partial.join(", ")}: moltnet.json and env must both exist for --guest-credential-mode guest-config.`);
-	const tried = roots.map((root) => join(root, ".moltnet", agentName));
-	throw new Error(`--guest-credential-mode guest-config requires an explicitly provisioned moltnet.json and env. Checked ${tried.join(", ")}.`);
-}
 function resolveCredentialRoots(agentRootDir) {
 	const roots = agentRootDir ? [agentRootDir] : [];
 	try {
@@ -4995,7 +4952,6 @@ function commonOptionDefs() {
 			short: "a"
 		},
 		"agent-root": { type: "string" },
-		"guest-credential-mode": { type: "string" },
 		"git-author": { type: "string" },
 		"lease-ttl-sec": { type: "string" },
 		"heartbeat-interval-ms": { type: "string" },
@@ -5712,8 +5668,7 @@ async function runPolling(opts) {
 		try {
 			const resolvedContext = await resolveAgentContext(baseCommon.agent, {
 				agentRootDir,
-				authMode: cfg.authMode,
-				guestCredentialMode: values["guest-credential-mode"]
+				authMode: cfg.authMode
 			});
 			gate = "authenticate_and_bind";
 			const whoami = await validateStartupBinding({
@@ -5782,7 +5737,6 @@ async function runPolling(opts) {
 			executables: prepared.executables
 		});
 		assertGuestEnvironmentBoundary({
-			guestCredentialMode: ctx.guestCredentialMode,
 			forwardEnv: profile.requiredEnv,
 			sandboxEnv: profile.sandboxConfig.env
 		});
@@ -5913,7 +5867,6 @@ async function runPolling(opts) {
 		bindingScope: startupWhoami.credentialBinding?.bindingScope ?? null,
 		credentialKeyId: startupWhoami.credentialBinding?.keyId ?? null,
 		boundTeamId: startupWhoami.credentialBinding?.bindingScope === "team" ? startupWhoami.credentialBinding.boundTeamId : null,
-		guestCredentialMode: ctx.guestCredentialMode,
 		taskTypes: taskTypes.length > 0 ? taskTypes : ["*"],
 		correlationId: values["correlation-id"] ?? null,
 		diaryIds: diaryIds.length > 0 ? diaryIds : ["*"],
@@ -6184,7 +6137,6 @@ async function runPolling(opts) {
 					agentIdentity,
 					hostCapabilitySigner,
 					hostCapabilityLogger: taskLogger,
-					guestCredentialMode: ctx.guestCredentialMode,
 					agentRootDir: ctx.agentRootDir,
 					mountPath: sandbox.rootDir,
 					provider: profile.provider,
@@ -6199,7 +6151,6 @@ async function runPolling(opts) {
 					onVmDiagnostic: (diagnostic) => {
 						const fields = {
 							event: diagnostic.event,
-							credentialMode: diagnostic.credentialMode,
 							...diagnostic.brokeredSecretCount !== void 0 && { brokeredSecretCount: diagnostic.brokeredSecretCount }
 						};
 						if (diagnostic.level === "warning") taskLogger.warn(fields, diagnostic.message);
@@ -6353,8 +6304,7 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 		try {
 			const resolvedContext = await resolveAgentContext(initialOpts.agent, {
 				agentRootDir,
-				authMode: cfg.authMode,
-				guestCredentialMode: values["guest-credential-mode"]
+				authMode: cfg.authMode
 			});
 			gate = "authenticate_and_bind";
 			const whoami = await validateStartupBinding({
@@ -6417,7 +6367,6 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 		executables: preparedRuntime.executables
 	});
 	assertGuestEnvironmentBoundary({
-		guestCredentialMode: ctx.guestCredentialMode,
 		forwardEnv: profile.requiredEnv,
 		sandboxEnv: profile.sandboxConfig.env
 	});
@@ -6505,7 +6454,6 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 		profileId: profile.id,
 		profileSessionTtlSec: profile.sessionTtlSec,
 		profileWorkspaceTtlSec: profile.workspaceTtlSec,
-		guestCredentialMode: ctx.guestCredentialMode,
 		piAgentDir: piAgentDir.path,
 		piAgentDirSource: piAgentDir.source
 	}, "agent-daemon.starting");
@@ -6568,7 +6516,6 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 			agentIdentity,
 			hostCapabilitySigner,
 			hostCapabilityLogger: rootLogger,
-			guestCredentialMode: ctx.guestCredentialMode,
 			agentRootDir: ctx.agentRootDir,
 			mountPath: sandbox.rootDir,
 			provider: profile.provider,
@@ -6583,7 +6530,6 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 			onVmDiagnostic: (diagnostic) => {
 				const fields = {
 					event: diagnostic.event,
-					credentialMode: diagnostic.credentialMode,
 					...diagnostic.brokeredSecretCount !== void 0 && { brokeredSecretCount: diagnostic.brokeredSecretCount }
 				};
 				if (diagnostic.level === "warning") rootLogger.warn(fields, diagnostic.message);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/agent-daemon",
-  "version": "0.44.0",
+  "version": "0.44.1",
   "license": "AGPL-3.0-only",
   "type": "module",
   "description": "Universal MoltNet agent daemon host with a built-in Pi/Gondolin runtime and support for trusted operator-owned runtime modules. CLI: moltnet-agent.",
@@ -47,7 +47,7 @@
     "node": ">=24"
   },
   "dependencies": {
-    "@earendil-works/gondolin": "^0.9.1",
+    "@earendil-works/gondolin": "^0.12.0",
     "@earendil-works/pi-ai": "0.79.4",
     "@earendil-works/pi-coding-agent": "0.79.4",
     "@fastify/otel": "^0.18.0",
@@ -80,8 +80,8 @@
     "typebox": "^1.2.8",
     "@themoltnet/agent-runtime": "0.44.0",
     "@themoltnet/os-keyring": "0.2.0",
-    "@themoltnet/sdk": "0.137.0",
-    "@themoltnet/pi-runtime": "0.12.0"
+    "@themoltnet/pi-runtime": "0.12.1",
+    "@themoltnet/sdk": "0.137.0"
   },
   "devDependencies": {
     "tsx": "^4.7.0",
@@ -89,12 +89,12 @@
     "vite": "^8.0.0",
     "vite-plugin-dts": "^4.5.4",
     "vitest": "^3.0.0",
+    "@moltnet/bootstrap": "0.1.0",
     "@moltnet/crypto-service": "0.1.0",
     "@moltnet/models": "0.1.0",
     "@moltnet/observability": "0.1.0",
-    "@moltnet/tasks": "0.1.0",
-    "@moltnet/bootstrap": "0.1.0",
-    "@moltnet/runtime-profiles": "0.1.0"
+    "@moltnet/runtime-profiles": "0.1.0",
+    "@moltnet/tasks": "0.1.0"
   },
   "nx": {
     "projectType": "application",