@themoltnet/agent-daemon 0.44.0 → 0.45.0

package/README.md

@@ -91,7 +91,7 @@ All config flows from environment variables. The daemon reads them in
 
 For OAuth2/local mode, the agent's `moltnet.json` and gitconfig live next to
 each other in `.moltnet/<agent>/`. Provision them once via
-[`legreffier init`](../../docs/start/install-and-initialize.md).
+[`moltnet agents init`](../../docs/start/install-and-initialize.md#initialize-an-autonomous-agent).
 
 **Auth mode.** When `MOLTNET_AGENT_KEY` is set the daemon authenticates with
 that key as an opaque bearer token (no OAuth2 exchange); otherwise it uses the
@@ -102,33 +102,24 @@ any team where the agent is authorized. It fails fast if the key is rejected,
 is not an agent, or a team binding mismatches. See
 [Run the daemon with an agent key](../../docs/operate/running-agents.md#run-the-daemon-with-an-agent-key).
 
-Daemon authentication and guest credential projection are two separate
-boundaries. How the daemon authenticates (an agent key, or OAuth2 resolved
-from `.moltnet/<agent>/moltnet.json` through the host secret provider) decides
-how the host-side SDK `Agent` is built. `--guest-credential-mode` decides
-whether the local agent credential tree is copied into Gondolin. Pi guests
-default to the `host-authenticated` boundary in **both** auth modes, regardless
-of local files: no `.moltnet` file, gitconfig, SSH signing key, GitHub App PEM,
-or MoltNet environment credential is injected into Gondolin, and mounted
-`.moltnet` paths are hidden. Structured MoltNet tools execute through the
-host-side `Agent`. Operators may explicitly opt into the legacy
-credential-bearing boundary with `--guest-credential-mode guest-config`; that
-mode requires a complete local `moltnet.json` + `env` pair and copies the
-complete agent configuration and signing credentials into the guest. Reserve it
-for local or otherwise operator-trusted tasks that genuinely need guest-shell
-MoltNet CLI, Git signing, or GitHub authentication. OAuth2 daemons that relied
-on the previous `guest-config` default for such tasks must now pass the flag
-explicitly.
-
-Trusted custom runtimes can deliver destination-bound HTTP credentials without
-switching to `guest-config`: the guest receives an opaque placeholder and the
-Gondolin host proxy substitutes the value only for the attested protocol,
-hostname pattern, and port (HTTPS/443 by default). See
+Daemon authentication and the guest boundary are two separate concerns. How the
+daemon authenticates (an agent key, or OAuth2 resolved from
+`.moltnet/<agent>/moltnet.json` through the host secret provider) decides how the
+host-side SDK `Agent` is built. The guest boundary is fixed: **the guest never
+receives MoltNet credential material.** No `.moltnet` file, gitconfig, SSH
+signing key, GitHub App PEM, or MoltNet environment credential is injected into
+Gondolin, and mounted `.moltnet` paths are hidden. Structured MoltNet tools
+execute through the host-side `Agent`.
+
+Trusted custom runtimes can deliver destination-bound HTTP credentials to the
+guest: it receives an opaque placeholder and the Gondolin host proxy substitutes
+the value only for the attested protocol, hostname pattern, and port (HTTPS/443
+by default). See
 [Host-brokered HTTP credentials](../../docs/operate/running-agents.md#host-brokered-http-credentials).
 This does not provide diary or Git commit signing; private-key operations remain
 host capabilities.
 
-Host capabilities replace the last reason for `guest-config`: the stock runtime
+Host capabilities carry in-guest signing: the stock runtime
 declares `agent-signing`, so `git commit -S` and `moltnet entry create-signed`
 work inside the guest while the seed stays on the host (the daemon injects a
 signer bound to the authenticated identity and projects a non-secret gitconfig,

package/dist/cli.js

@@ -12,7 +12,7 @@ import { AgentRuntime, ApiTaskReporter, ApiTaskSource, PollingApiTaskSource, cre
 import { GuestEnvironmentBoundaryError, assertGuestEnvironmentBoundary, createPiRetryTriage, findMainWorktree, isResolvedPathInsideRoot, normalizeRetryTriageResult, redactRetryTriageSecrets } from "@themoltnet/pi-runtime";
 import { execFile, execFileSync } from "node:child_process";
 import { createReadStream, createWriteStream, existsSync, mkdirSync, readdirSync, realpathSync, rmSync } from "node:fs";
-import { AuthenticationError, MoltNetError, connect, createExecutorAttestor, readConfig } from "@themoltnet/sdk";
+import { AuthenticationError, MoltNetError, connect, createExecutorAttestor, readConfig, resolveEnvSecretReference, resolveIdentitySeed } from "@themoltnet/sdk";
 import { createNodeSecretProviderRegistry } from "@themoltnet/sdk/node";
 import { createHash, randomUUID } from "node:crypto";
 import * as ed from "@noble/ed25519";
@@ -2405,8 +2405,8 @@ async function validateJudgePackInputAsync(input, ctx) {
 //#endregion
 //#region ../../libs/tasks/src/task-types/judge-eval-attempt.ts
 /**
-* `judge_eval_attempt` — score one completed `run_eval` attempt against a
-* hidden judge rubric.
+* `judge_eval_attempt` — score one completed artifact-producing attempt
+* against a hidden judge rubric.
 *
 * output_kind: judgment
 * criteria: required (`successCriteria.rubric`)
@@ -2510,9 +2510,9 @@ async function validateJudgeEvalAttemptInputAsync(input, ctx) {
 		field: "targetTaskId",
 		message: `targetTaskId=${inp.targetTaskId} does not resolve to a task you can read`
 	}];
-	if (target.taskType !== "run_eval") errors.push({
+	if (target.outputKind !== "artifact") errors.push({
 		field: "targetTaskId",
-		message: `targetTaskId=${inp.targetTaskId} is a ${target.taskType}, not a run_eval`
+		message: `targetTaskId=${inp.targetTaskId} has outputKind=${target.outputKind}; only artifact-producing tasks can be judged`
 	});
 	if (!ctx.deferReadinessChecks && (target.status !== "completed" || target.acceptedAttemptN === null)) errors.push({
 		field: "targetTaskId",
@@ -2524,7 +2524,7 @@ async function validateJudgeEvalAttemptInputAsync(input, ctx) {
 	});
 	if (!target.correlationId) errors.push({
 		field: "targetTaskId",
-		message: "target run_eval has no correlation_id; cannot enforce duplicate-judge protection"
+		message: "target producer has no correlation_id; cannot enforce duplicate-judge protection"
 	});
 	if (errors.length > 0 || !target.correlationId) return errors;
 	const rubric = inp.successCriteria.rubric;
@@ -3387,12 +3387,6 @@ var COMMON_OPTIONAL_FLAGS = `\
                               host git config (OAuth2) or
                               <identityId>+<agent>[bot]@users.noreply.github.com.
                               Env: MOLTNET_GIT_AUTHOR.
-  --guest-credential-mode <mode>
-                              Guest trust boundary: host-authenticated or
-                              guest-config. Defaults to host-authenticated for
-                              both agent-key and OAuth2 authentication.
-                              Explicit guest-config exposes the complete local
-                              agent credential tree to the VM.
   --lease-ttl-sec <n>         Sliding liveness window. Silence longer than
                               this ends the attempt with lease_expired.
                               Default: 300.
@@ -3439,7 +3433,8 @@ Commands:
 Run \`agent-daemon <command> --help\` for command-specific flags.
 
 Prerequisites:
-  - agent-key mode: MOLTNET_AGENT_KEY and MOLTNET_PRIVATE_KEY; no agent files
+  - agent-key mode: MOLTNET_AGENT_KEY (or MOLTNET_AGENT_KEY_REF) and
+    MOLTNET_PRIVATE_KEY (or MOLTNET_PRIVATE_KEY_REF); no agent files
   - OAuth2 and sync-sessions: <agent-root>/.moltnet/<agent>/moltnet.json
   - --profile — remote runtime profile supplies provider/model/sandbox
     policy and CWD is used as the VM mountPath.
@@ -3567,24 +3562,10 @@ function isHelpFlag(args) {
 //#endregion
 //#region src/lib/agent-context.ts
 /**
-* Guest credentials are an explicit trust decision, never an incidental
-* consequence of files found on disk. The guest boundary is independent of
-* how the daemon itself authenticates: both agent-key and OAuth2 default to
-* the host-authenticated boundary, where structured MoltNet operations reuse
-* the trusted host-side Agent and the guest receives no credential material.
-* OAuth2 still resolves that Agent from the local config and secret provider
-* on the host — reading `moltnet.json` on the host does not imply projecting
-* it into the guest. `guest-config` remains an explicit compatibility opt-in
-* for tasks that need credential-bearing guest-shell operations.
-*/
-function resolveDaemonGuestCredentialMode(requested) {
-	if (requested !== void 0 && requested !== "guest-config" && requested !== "host-authenticated") throw new Error(`Invalid --guest-credential-mode "${requested}": expected guest-config or host-authenticated.`);
-	return requested ?? "host-authenticated";
-}
-/**
 * Report which auth mode `connect()` will use, without ever reading the secret
 * value into anything logged. Agent-key mode is selected when
-* `MOLTNET_AGENT_KEY` holds a non-blank value — mirroring the SDK precedence
+* `MOLTNET_AGENT_KEY` or `MOLTNET_AGENT_KEY_REF` holds a non-blank value —
+* mirroring the SDK precedence
 * where an environment key opts into key mode ahead of the config-file OAuth2
 * credentials. The daemon never passes explicit in-code credentials to
 * `connect()`, so this env-only check matches what `connect()` actually does.
@@ -3592,7 +3573,7 @@ function resolveDaemonGuestCredentialMode(requested) {
 * Pure: `env` is passed in (the config module owns the `process.env` read).
 */
 function detectAuthMode(env) {
-	return env.MOLTNET_AGENT_KEY?.trim() ? "agent-key" : "oauth2";
+	return env.MOLTNET_AGENT_KEY?.trim() || env.MOLTNET_AGENT_KEY_REF?.trim() ? "agent-key" : "oauth2";
 }
 /**
 * Pure check: may the identity described by `whoami` operate the daemon as
@@ -3653,30 +3634,29 @@ async function validateStartupBinding(options) {
 async function resolveAgentContext(agentName, options = {}) {
 	if (!/^[a-zA-Z0-9_-]+$/.test(agentName)) throw new Error(`Invalid agent name "${agentName}": must match /^[a-zA-Z0-9_-]+$/`);
 	const roots = resolveCredentialRoots(options.agentRootDir);
-	const guestCredentialMode = resolveDaemonGuestCredentialMode(options.guestCredentialMode);
 	if (options.authMode === "agent-key") {
-		const { rootDir, agentDir } = guestCredentialMode === "guest-config" ? resolveCompleteGuestCredentials(roots, agentName) : {
-			rootDir: roots[0] ?? process.cwd(),
-			agentDir: join(roots[0] ?? process.cwd(), ".moltnet", agentName)
-		};
+		const rootDir = roots[0] ?? process.cwd();
 		return {
-			agentDir,
+			agentDir: join(rootDir, ".moltnet", agentName),
 			agentRootDir: rootDir,
-			agent: await connect(),
-			guestCredentialMode
+			agent: await connect({ secretProviders: createNodeSecretProviderRegistry() }),
+			credentialSource: "environment",
+			authMechanism: "agent-key"
 		};
 	}
-	const located = guestCredentialMode === "guest-config" ? resolveCompleteGuestCredentials(roots, agentName) : locateAgentConfig(roots, agentName);
+	const located = locateAgentConfig(roots, agentName);
 	if (located) {
 		const agent = await connect({
 			configDir: located.agentDir,
 			secretProviders: createNodeSecretProviderRegistry()
 		});
+		const config = await readConfig(located.agentDir);
 		return {
 			agentDir: located.agentDir,
 			agentRootDir: located.rootDir,
 			agent,
-			guestCredentialMode
+			credentialSource: "config",
+			authMechanism: config?.agent_key_ref ? "agent-key" : "oauth2"
 		};
 	}
 	const tried = roots.map((root) => join(root, ".moltnet", agentName));
@@ -3697,22 +3677,6 @@ function locateAgentConfig(roots, agentName) {
 		};
 	}
 }
-function resolveCompleteGuestCredentials(roots, agentName) {
-	const partial = [];
-	for (const rootDir of roots) {
-		const agentDir = join(rootDir, ".moltnet", agentName);
-		const hasConfig = existsSync(join(agentDir, "moltnet.json"));
-		const hasEnv = existsSync(join(agentDir, "env"));
-		if (hasConfig && hasEnv) return {
-			rootDir,
-			agentDir
-		};
-		if (hasConfig || hasEnv) partial.push(agentDir);
-	}
-	if (partial.length > 0) throw new Error(`Incomplete guest credentials in ${partial.join(", ")}: moltnet.json and env must both exist for --guest-credential-mode guest-config.`);
-	const tried = roots.map((root) => join(root, ".moltnet", agentName));
-	throw new Error(`--guest-credential-mode guest-config requires an explicitly provisioned moltnet.json and env. Checked ${tried.join(", ")}.`);
-}
 function resolveCredentialRoots(agentRootDir) {
 	const roots = agentRootDir ? [agentRootDir] : [];
 	try {
@@ -3734,6 +3698,8 @@ function resolveCredentialRoots(agentRootDir) {
 * sprinkling string lookups across the codebase.
 */
 function loadConfig() {
+	assertSingleCredentialForm("MOLTNET_AGENT_KEY", "MOLTNET_AGENT_KEY_REF");
+	assertSingleCredentialForm("MOLTNET_PRIVATE_KEY", "MOLTNET_PRIVATE_KEY_REF");
 	return {
 		otelEndpoint: process.env["MOLTNET_OTEL_ENDPOINT"] ?? "",
 		logLevel: process.env["LOG_LEVEL"] ?? "",
@@ -3742,10 +3708,14 @@ function loadConfig() {
 		piCodingAgentDir: process.env["PI_CODING_AGENT_DIR"] ?? "",
 		authMode: detectAuthMode(process.env),
 		signingPrivateKey: process.env["MOLTNET_PRIVATE_KEY"] ?? "",
+		signingPrivateKeyRef: process.env["MOLTNET_PRIVATE_KEY_REF"] ?? "",
 		gitAuthor: process.env["MOLTNET_GIT_AUTHOR"] ?? "",
 		traceIdlePolling: readBoolean("MOLTNET_TRACE_IDLE_POLLING", process.env["MOLTNET_TRACE_IDLE_POLLING"])
 	};
 }
+function assertSingleCredentialForm(valueName, refName) {
+	if (process.env[valueName]?.trim() && process.env[refName]?.trim()) throw new Error(`Set only one of ${valueName} or ${refName}`);
+}
 function readBoolean(name, value) {
 	if (value === void 0 || value === "") return false;
 	if (value === "true") return true;
@@ -3953,6 +3923,7 @@ function buildDaemonTaskExecutionPlan(task, stateDirs, identity, warmSessionTtlS
 	return {
 		descriptor,
 		workspaceMode,
+		workspaceKind: workspaceMode === "scratch_mount" ? "scratch" : void 0,
 		sessionKey: slotId,
 		slotKey,
 		slotId,
@@ -4246,15 +4217,16 @@ async function maybeAttachWarmSlotContext(claimedTask, basePlan, stateDirs, slot
 	if (resolution.kind === "missing") throw new ProducerContextResolutionError(`No live producer runtime slot found for task ${targetTaskId} attempt ${targetAttemptN}`);
 	if (resolution.kind === "no-session-path") throw new ProducerContextResolutionError(`Producer task ${targetTaskId} attempt ${targetAttemptN} has no persisted Pi session path`);
 	if (resolution.kind === "remote-session") throw new ProducerContextResolutionError(`Producer task ${targetTaskId} attempt ${targetAttemptN} has a durable runtime session but no workspace metadata to copy`);
+	const producerWorkspaceCopySource = resolveProducerWorkspaceCopySource(resolution.producerSlot, stateDirs);
 	return {
 		...basePlan,
 		workspaceMode: "scratch_mount",
 		worktreeBranch: null,
 		workspaceKind: "scratch",
-		workspaceSeed: {
-			copyFromPath: resolveProducerWorkspaceCopySource(resolution.producerSlot, stateDirs),
+		workspaceSeed: producerWorkspaceCopySource ? {
+			copyFromPath: producerWorkspaceCopySource,
 			source: "producer"
-		},
+		} : null,
 		sessionPersistence: {
 			sessionDir: `${stateDirs.piSessionsDir}/judge-${claimedTask.task.id}-attempt-${claimedTask.attemptN}`,
 			forkFromSessionPath: resolution.sessionPath
@@ -4297,12 +4269,18 @@ function resolveProducerWorkspaceCopySource(producer, stateDirs) {
 		if (existsSync(workspacePath)) return workspacePath;
 		const recoveredPath = recoverScratchWorkspacePath(producer, stateDirs);
 		if (recoveredPath) return recoveredPath;
+		if (isDisposableScratchWorkspace(producer, stateDirs)) return null;
 		throw new ProducerContextResolutionError(`Producer workspace path is missing on disk: ${workspacePath}`);
 	}
 	const sharedMountRoot = dirname(dirname(stateDirs.rootDir));
 	if (!existsSync(sharedMountRoot)) throw new ProducerContextResolutionError(`Shared producer mount root is missing on disk: ${sharedMountRoot}`);
 	return sharedMountRoot;
 }
+function isDisposableScratchWorkspace(producer, stateDirs) {
+	if (producer.workspace?.kind === "scratch") return true;
+	if (!producer.workspace?.workspaceId) return false;
+	return producer.workspace.worktreePath === join(stateDirs.rootDir, "task-workspaces", producer.workspace.workspaceId);
+}
 function recoverScratchWorkspacePath(producer, stateDirs) {
 	if (producer.workspace?.worktreeBranch) return null;
 	if (!producer.workspace?.workspaceId) return null;
@@ -4481,12 +4459,25 @@ var DAEMON_REQUIRED_SCOPES = AGENT_CREDENTIAL_SCOPES;
 async function resolveExecutorSigningPrivateKey(input) {
 	if (input.authMode === "agent-key") {
 		const privateKey = input.configuredPrivateKey.trim();
-		if (!privateKey) throw new Error("Agent-key daemon startup requires MOLTNET_PRIVATE_KEY containing the base64-encoded Ed25519 private key seed.");
-		return privateKey;
+		if (privateKey) return privateKey;
+		const reference = input.configuredPrivateKeyRef?.trim();
+		if (!reference) throw new Error("Agent-key daemon startup requires MOLTNET_PRIVATE_KEY (or MOLTNET_PRIVATE_KEY_REF) containing the base64-encoded Ed25519 private key seed.");
+		let resolved;
+		try {
+			resolved = await resolveEnvSecretReference(reference, createNodeSecretProviderRegistry());
+		} catch (cause) {
+			throw new Error(`Agent-key daemon startup could not resolve MOLTNET_PRIVATE_KEY_REF: ${cause.message}`, { cause });
+		}
+		if (Buffer.from(resolved, "base64").length !== 32) throw new Error("MOLTNET_PRIVATE_KEY_REF must resolve to a base64-encoded 32-byte Ed25519 seed.");
+		return resolved;
+	}
+	const config = await readConfig(input.agentDir);
+	if (!config) throw new Error(`OAuth2 daemon startup requires ${input.agentDir}/moltnet.json.`);
+	try {
+		return await resolveIdentitySeed(config, createNodeSecretProviderRegistry());
+	} catch (cause) {
+		throw new Error(`OAuth2 daemon startup could not resolve the signing seed from ${input.agentDir}/moltnet.json (keys.private_key or keys.private_key_ref): ${cause.message}`, { cause });
 	}
-	const privateKey = (await readConfig(input.agentDir))?.keys?.private_key?.trim();
-	if (!privateKey) throw new Error(`OAuth2 daemon startup requires keys.private_key in ${input.agentDir}/moltnet.json.`);
-	return privateKey;
 }
 function validateDaemonScopes(whoami) {
 	const available = new Set(whoami.scopes ?? []);
@@ -4995,7 +4986,6 @@ function commonOptionDefs() {
 			short: "a"
 		},
 		"agent-root": { type: "string" },
-		"guest-credential-mode": { type: "string" },
 		"git-author": { type: "string" },
 		"lease-ttl-sec": { type: "string" },
 		"heartbeat-interval-ms": { type: "string" },
@@ -5712,8 +5702,7 @@ async function runPolling(opts) {
 		try {
 			const resolvedContext = await resolveAgentContext(baseCommon.agent, {
 				agentRootDir,
-				authMode: cfg.authMode,
-				guestCredentialMode: values["guest-credential-mode"]
+				authMode: cfg.authMode
 			});
 			gate = "authenticate_and_bind";
 			const whoami = await validateStartupBinding({
@@ -5724,7 +5713,8 @@ async function runPolling(opts) {
 			const privateKey = await resolveExecutorSigningPrivateKey({
 				authMode: cfg.authMode,
 				agentDir: resolvedContext.agentDir,
-				configuredPrivateKey: cfg.signingPrivateKey
+				configuredPrivateKey: cfg.signingPrivateKey,
+				configuredPrivateKeyRef: cfg.signingPrivateKeyRef
 			});
 			gate = "validate_scopes";
 			validateDaemonScopes(whoami);
@@ -5782,7 +5772,6 @@ async function runPolling(opts) {
 			executables: prepared.executables
 		});
 		assertGuestEnvironmentBoundary({
-			guestCredentialMode: ctx.guestCredentialMode,
 			forwardEnv: profile.requiredEnv,
 			sandboxEnv: profile.sandboxConfig.env
 		});
@@ -5860,7 +5849,7 @@ async function runPolling(opts) {
 		resourceAttributes: {
 			"moltnet.team.id": teamId,
 			"moltnet.agent.name": baseCommon.agent,
-			"moltnet.auth.mode": cfg.authMode,
+			"moltnet.auth.mode": ctx.authMechanism,
 			"moltnet.runtime_profile.count": String(profiles.length),
 			"moltnet.runtime_profile.ids": profiles.map((p) => p.id).join(",")
 		}
@@ -5913,7 +5902,6 @@ async function runPolling(opts) {
 		bindingScope: startupWhoami.credentialBinding?.bindingScope ?? null,
 		credentialKeyId: startupWhoami.credentialBinding?.keyId ?? null,
 		boundTeamId: startupWhoami.credentialBinding?.bindingScope === "team" ? startupWhoami.credentialBinding.boundTeamId : null,
-		guestCredentialMode: ctx.guestCredentialMode,
 		taskTypes: taskTypes.length > 0 ? taskTypes : ["*"],
 		correlationId: values["correlation-id"] ?? null,
 		diaryIds: diaryIds.length > 0 ? diaryIds : ["*"],
@@ -6184,7 +6172,6 @@ async function runPolling(opts) {
 					agentIdentity,
 					hostCapabilitySigner,
 					hostCapabilityLogger: taskLogger,
-					guestCredentialMode: ctx.guestCredentialMode,
 					agentRootDir: ctx.agentRootDir,
 					mountPath: sandbox.rootDir,
 					provider: profile.provider,
@@ -6199,7 +6186,6 @@ async function runPolling(opts) {
 					onVmDiagnostic: (diagnostic) => {
 						const fields = {
 							event: diagnostic.event,
-							credentialMode: diagnostic.credentialMode,
 							...diagnostic.brokeredSecretCount !== void 0 && { brokeredSecretCount: diagnostic.brokeredSecretCount }
 						};
 						if (diagnostic.level === "warning") taskLogger.warn(fields, diagnostic.message);
@@ -6353,8 +6339,7 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 		try {
 			const resolvedContext = await resolveAgentContext(initialOpts.agent, {
 				agentRootDir,
-				authMode: cfg.authMode,
-				guestCredentialMode: values["guest-credential-mode"]
+				authMode: cfg.authMode
 			});
 			gate = "authenticate_and_bind";
 			const whoami = await validateStartupBinding({
@@ -6365,7 +6350,8 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 			const privateKey = await resolveExecutorSigningPrivateKey({
 				authMode: cfg.authMode,
 				agentDir: resolvedContext.agentDir,
-				configuredPrivateKey: cfg.signingPrivateKey
+				configuredPrivateKey: cfg.signingPrivateKey,
+				configuredPrivateKeyRef: cfg.signingPrivateKeyRef
 			});
 			gate = "validate_scopes";
 			validateDaemonScopes(whoami);
@@ -6417,7 +6403,6 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 		executables: preparedRuntime.executables
 	});
 	assertGuestEnvironmentBoundary({
-		guestCredentialMode: ctx.guestCredentialMode,
 		forwardEnv: profile.requiredEnv,
 		sandboxEnv: profile.sandboxConfig.env
 	});
@@ -6466,7 +6451,7 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 		resourceAttributes: {
 			"moltnet.task.id": taskId,
 			"moltnet.agent.name": opts.agent,
-			"moltnet.auth.mode": cfg.authMode,
+			"moltnet.auth.mode": ctx.authMechanism,
 			"moltnet.llm.provider": profile.provider,
 			"moltnet.llm.model": profile.model,
 			...profile.thinkingLevel ? { "moltnet.llm.thinking_level": profile.thinkingLevel } : {},
@@ -6505,7 +6490,6 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 		profileId: profile.id,
 		profileSessionTtlSec: profile.sessionTtlSec,
 		profileWorkspaceTtlSec: profile.workspaceTtlSec,
-		guestCredentialMode: ctx.guestCredentialMode,
 		piAgentDir: piAgentDir.path,
 		piAgentDirSource: piAgentDir.source
 	}, "agent-daemon.starting");
@@ -6568,7 +6552,6 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 			agentIdentity,
 			hostCapabilitySigner,
 			hostCapabilityLogger: rootLogger,
-			guestCredentialMode: ctx.guestCredentialMode,
 			agentRootDir: ctx.agentRootDir,
 			mountPath: sandbox.rootDir,
 			provider: profile.provider,
@@ -6583,7 +6566,6 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 			onVmDiagnostic: (diagnostic) => {
 				const fields = {
 					event: diagnostic.event,
-					credentialMode: diagnostic.credentialMode,
 					...diagnostic.brokeredSecretCount !== void 0 && { brokeredSecretCount: diagnostic.brokeredSecretCount }
 				};
 				if (diagnostic.level === "warning") rootLogger.warn(fields, diagnostic.message);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/agent-daemon",
-  "version": "0.44.0",
+  "version": "0.45.0",
   "license": "AGPL-3.0-only",
   "type": "module",
   "description": "Universal MoltNet agent daemon host with a built-in Pi/Gondolin runtime and support for trusted operator-owned runtime modules. CLI: moltnet-agent.",
@@ -47,7 +47,7 @@
     "node": ">=24"
   },
   "dependencies": {
-    "@earendil-works/gondolin": "^0.9.1",
+    "@earendil-works/gondolin": "^0.12.0",
     "@earendil-works/pi-ai": "0.79.4",
     "@earendil-works/pi-coding-agent": "0.79.4",
     "@fastify/otel": "^0.18.0",
@@ -78,10 +78,10 @@
     "pino-opentelemetry-transport": "^3.0.0",
     "pino-pretty": "^13.1.3",
     "typebox": "^1.2.8",
-    "@themoltnet/agent-runtime": "0.44.0",
-    "@themoltnet/os-keyring": "0.2.0",
-    "@themoltnet/sdk": "0.137.0",
-    "@themoltnet/pi-runtime": "0.12.0"
+    "@themoltnet/os-keyring": "0.3.0",
+    "@themoltnet/agent-runtime": "0.45.0",
+    "@themoltnet/pi-runtime": "0.12.2",
+    "@themoltnet/sdk": "0.138.0"
   },
   "devDependencies": {
     "tsx": "^4.7.0",
@@ -89,12 +89,12 @@
     "vite": "^8.0.0",
     "vite-plugin-dts": "^4.5.4",
     "vitest": "^3.0.0",
+    "@moltnet/bootstrap": "0.1.0",
     "@moltnet/crypto-service": "0.1.0",
     "@moltnet/models": "0.1.0",
     "@moltnet/observability": "0.1.0",
-    "@moltnet/tasks": "0.1.0",
-    "@moltnet/bootstrap": "0.1.0",
-    "@moltnet/runtime-profiles": "0.1.0"
+    "@moltnet/runtime-profiles": "0.1.0",
+    "@moltnet/tasks": "0.1.0"
   },
   "nx": {
     "projectType": "application",