@themoltnet/agent-daemon 0.5.3 → 0.6.1

package/README.md

@@ -66,6 +66,25 @@ To use an alternate auth-file path: `PI_AUTH_PATH=/abs/path/to/auth.json`.
 | `MOLTNET_OTEL_ENDPOINT` | unset   | OTLP traces endpoint. Empty = disabled. |
 | `LOG_LEVEL`             | `info`  | Pino log level override.                |
 
+### Host command auto-approval
+
+The daemon reads `sandbox.json` through `--sandbox` or by searching up from the
+current directory. Configure host-side auto-approval there, not in task data:
+
+```json
+{
+  "hostExec": {
+    "autoApprove": [
+      { "argsPrefix": ["push"], "executable": "git" },
+      { "argsPrefix": ["pr", "create"], "executable": "gh" }
+    ]
+  }
+}
+```
+
+Set `"autoApprove": true` only for isolated hosts where every built-in
+host-exec command is safe to run without a dialog.
+
 ## Correlation anchors
 
 When a `fulfill_brief` task carries a non-null `correlationId`, the daemon

package/dist/main.js

@@ -3,7 +3,7 @@ import crypto, { createHash } from "crypto";
 import { parseArgs, parseEnv, promisify } from "node:util";
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync } from "node:fs";
 import { ROOT_CONTEXT, SpanStatusCode, context, metrics, propagation, trace } from "@opentelemetry/api";
-import { pino } from "pino";
+import { pino, transport } from "pino";
 import { readFile } from "node:fs/promises";
 import { createHash as createHash$1 } from "node:crypto";
 import path, { dirname, isAbsolute, join, resolve } from "node:path";
@@ -12,6 +12,7 @@ import { execFile, execFileSync } from "node:child_process";
 import { DefaultResourceLoader, SessionManager, createAgentSession, createBashToolDefinition, createEditToolDefinition, createReadToolDefinition, createSyntheticSourceInfo, createWriteToolDefinition, defineTool, parseFrontmatter } from "@earendil-works/pi-coding-agent";
 import { Type, getModel } from "@earendil-works/pi-ai";
 import { MemoryProvider, RealFSProvider, ShadowProvider, VM, VmCheckpoint, createHttpHooks, createShadowPathPredicate, ensureImageSelector, loadGuestAssets } from "@earendil-works/gondolin";
+import { once } from "node:events";
 import { OTLPTraceExporter } from "@opentelemetry/exporter-trace-otlp-proto";
 import { resourceFromAttributes } from "@opentelemetry/resources";
 import { BatchSpanProcessor } from "@opentelemetry/sdk-trace-base";
@@ -5990,6 +5991,14 @@ var COMMON_OPTIONAL_FLAGS = `\
   --heartbeat-interval-ms <n> Reporter heartbeat cadence. Default: 60000.
   --max-batch-size <n>        Reporter message batch size. Default: 50.
   --flush-interval-ms <n>     Reporter flush window. Default: 200.
+  --max-turns <n>             Cap on tool-use turns per attempt; over this,
+                              the pi session aborts and the attempt fails
+                              with code 'max_turns_exceeded'. 0 = disabled.
+                              Default: 0. Recommended ~30 for fulfill_brief.
+  --max-bash-timeouts <n>     Cap on bash-tool timeouts per attempt; over
+                              this, the pi session aborts and the attempt
+                              fails with code 'max_bash_timeouts_exceeded'.
+                              0 = disabled. Default: 3.
   --debug                     Verbose logging: also log successful list/claim
                               outcomes (candidate counts, claim attempts).`;
 var REGISTERED_TASK_TYPES = Object.keys(BUILT_IN_TASK_TYPES).sort();
@@ -13945,6 +13954,7 @@ function renderPhase6Markdown(pack) {
 * These tools run on the host (not in the VM) via the MoltNet SDK,
 * so agent credentials never touch the VM filesystem.
 */
+var DIARY_TAG_MAX_LENGTH = 128;
 /**
 * Baseline env keys forwarded to host-exec child processes.
 * Callers can extend this set at sandbox startup via `MoltNetToolsConfig.hostExecBaseEnv`.
@@ -13973,6 +13983,19 @@ function ensureConnected(config) {
 		teamId: config.getTeamId() ?? ""
 	};
 }
+function hostExecMatchesAutoApproveRule(params, rule) {
+	if (params.executable !== rule.executable) return false;
+	if (rule.argsExcludes?.some((arg) => params.args.includes(arg))) return false;
+	if (rule.argsPrefix && !rule.argsPrefix.every((arg, index) => params.args[index] === arg)) return false;
+	if (rule.argsContains && !rule.argsContains.every((arg) => params.args.includes(arg))) return false;
+	return true;
+}
+function shouldAutoApproveHostExec(params, config) {
+	const policy = config.autoApproveHostExec === true ? true : config.hostExecAutoApprove ?? false;
+	if (policy === true) return true;
+	if (!Array.isArray(policy)) return false;
+	return policy.some((rule) => hostExecMatchesAutoApproveRule(params, rule));
+}
 /**
 * Expand the `taskFilter` shorthand on the diary list/search tools into
 * the matching `task:*` provenance tags emitted by `moltnet_create_entry`
@@ -14191,14 +14214,14 @@ function createMoltNetTools(config) {
 			limit: Type.Optional(Type.Number({ description: "Max entries to return (default 10)" })),
 			tags: Type.Optional(Type.Array(Type.String({
 				minLength: 1,
-				maxLength: 50
+				maxLength: DIARY_TAG_MAX_LENGTH
 			}), {
 				description: "Tags filter — entry must have ALL listed tags (AND). Max 20.",
 				maxItems: 20
 			})),
 			excludeTags: Type.Optional(Type.Array(Type.String({
 				minLength: 1,
-				maxLength: 50
+				maxLength: DIARY_TAG_MAX_LENGTH
 			}), {
 				description: "Tags to exclude — entry must have NONE of these. Max 20.",
 				maxItems: 20
@@ -14291,14 +14314,14 @@ function createMoltNetTools(config) {
 			limit: Type.Optional(Type.Number({ description: "Max results (default 5)" })),
 			tags: Type.Optional(Type.Array(Type.String({
 				minLength: 1,
-				maxLength: 50
+				maxLength: DIARY_TAG_MAX_LENGTH
 			}), {
 				description: "Entry must have ALL listed tags (AND). Max 20.",
 				maxItems: 20
 			})),
 			excludeTags: Type.Optional(Type.Array(Type.String({
 				minLength: 1,
-				maxLength: 50
+				maxLength: DIARY_TAG_MAX_LENGTH
 			}), {
 				description: "Entry must have NONE of these tags. Max 20.",
 				maxItems: 20
@@ -14344,7 +14367,7 @@ function createMoltNetTools(config) {
 	const createEntry = defineTool({
 		name: "moltnet_create_entry",
 		label: "Create MoltNet Diary Entry",
-		description: "Create a new diary entry to record decisions, findings, incidents, or reflections. During an active task, the entry is forced into the task diary and tagged with the task:* provenance namespace (task:id:<id>, task:type:<type>, task:attempt:<n>, plus task:correlation:<id> when set); an explicit diaryId mismatching the task diary is rejected.",
+		description: "Create a new diary entry to record decisions, findings, incidents, or reflections. During an active task, the entry is forced into the task diary and tagged with the task:* provenance namespace (task:id:<id>, task:type:<type>, task:attempt:<n>, plus task:correlation:<id> when set); an explicit diaryId mismatching the task diary is rejected. Use this tool — NOT `moltnet entry create` / `moltnet entry create-signed` via bash. The CLI path bypasses task-tag auto-injection and leaves entries invisible to taskFilter queries.",
 		parameters: Type.Object({
 			title: Type.String({ description: "Entry title (concise, descriptive)" }),
 			content: Type.String({ description: "Entry content (markdown)" }),
@@ -14484,7 +14507,7 @@ function createMoltNetTools(config) {
 			}),
 			async execute(_id, params, _signal, _onUpdate, ctx) {
 				if (!HOST_EXEC_ALLOWED.has(params.executable)) throw new Error(`host_exec: '${params.executable}' is not in the allowed list (${[...HOST_EXEC_ALLOWED].join(", ")}). Extend HOST_EXEC_ALLOWED only after explicit security review.`);
-				if (ctx?.ui) {
+				if (ctx?.ui && !shouldAutoApproveHostExec(params, config)) {
 					const cmdDisplay = [params.executable, ...params.args].join(" ");
 					if (!await ctx.ui.confirm("Allow host command?", `The agent wants to run on your machine:\n\n  ${cmdDisplay}\n\nAllow?`)) throw new Error(`host_exec: user declined approval for: ${cmdDisplay}`);
 				}
@@ -14924,38 +14947,48 @@ async function resumeVm(config) {
 			[GUEST_TASK_SKILLS_MOUNT]: new MemoryProvider()
 		} }
 	});
-	await vm.exec(`sh -c '
+	try {
+		await vm.exec(`sh -c '
     cp /etc/gondolin/mitm/ca.crt /usr/local/share/ca-certificates/gondolin-mitm.crt
     update-ca-certificates 2>/dev/null
     cat /etc/gondolin/mitm/ca.crt >> /etc/ssl/certs/ca-certificates.crt
   '`);
-	await vmRun(vm, "DNS resolvers", `printf 'nameserver 8.8.8.8\\nnameserver 1.1.1.1\\n' > /etc/resolv.conf`);
-	await vmRun(vm, "git safe.directory", `git config --system --add safe.directory '*'`);
-	for (const [i, cmd] of (config.sandboxConfig?.resumeCommands ?? []).entries()) await vmRun(vm, `resumeCommands[${i}]`, cmd);
-	const vmSshDir = `${vmAgentDir}/ssh`;
-	await vm.exec(`mkdir -p ${vmAgentDir}/ssh /home/agent/.pi/agent`);
-	if (creds.piAuthJson !== null) await vm.fs.writeFile("/home/agent/.pi/agent/auth.json", creds.piAuthJson, { mode: 384 });
-	const vmMoltnetJson = rewriteMoltnetJsonPaths(creds.moltnetJson, vmAgentDir, vmSshDir, creds.githubAppPemFilename);
-	await vm.fs.writeFile(`${vmAgentDir}/moltnet.json`, vmMoltnetJson, { mode: 384 });
-	await vm.fs.writeFile(`${vmAgentDir}/env`, creds.agentEnvRaw, { mode: 384 });
-	if (creds.gitconfig) {
-		const vmSigningKey = `${vmSshDir}/id_ed25519`;
-		let vmGitconfig = creds.gitconfig.replace(/signingKey\s*=\s*.+/g, `signingKey = ${vmSigningKey}`);
-		vmGitconfig = ensureRelativeWorktreePaths(vmGitconfig);
-		await vm.fs.writeFile(`${vmAgentDir}/gitconfig`, vmGitconfig, { mode: 420 });
-	}
-	if (creds.sshPrivateKey) await vm.fs.writeFile(`${vmSshDir}/id_ed25519`, creds.sshPrivateKey, { mode: 384 });
-	if (creds.sshPublicKey) await vm.fs.writeFile(`${vmSshDir}/id_ed25519.pub`, creds.sshPublicKey, { mode: 420 });
-	if (creds.allowedSigners) await vm.fs.writeFile(`${vmSshDir}/allowed_signers`, creds.allowedSigners, { mode: 420 });
-	if (creds.githubAppPem && creds.githubAppPemFilename) await vm.fs.writeFile(`${vmAgentDir}/${creds.githubAppPemFilename}`, creds.githubAppPem, { mode: 384 });
-	await vm.exec("chown -R agent:agent /home/agent/.pi /home/agent/.moltnet");
-	return {
-		vm,
-		credentials: creds,
-		mountPath: config.mountPath,
-		guestWorkspace: GUEST_WORKSPACE$1,
-		agentDir
-	};
+		await vmRun(vm, "DNS resolvers", `printf 'nameserver 8.8.8.8\\nnameserver 1.1.1.1\\n' > /etc/resolv.conf`);
+		await vmRun(vm, "git safe.directory", `git config --system --add safe.directory '*'`);
+		for (const [i, cmd] of (config.sandboxConfig?.resumeCommands ?? []).entries()) await vmRun(vm, `resumeCommands[${i}]`, cmd);
+		const vmSshDir = `${vmAgentDir}/ssh`;
+		await vm.exec(`mkdir -p ${vmAgentDir}/ssh /home/agent/.pi/agent`);
+		if (creds.piAuthJson !== null) await vm.fs.writeFile("/home/agent/.pi/agent/auth.json", creds.piAuthJson, { mode: 384 });
+		const vmMoltnetJson = rewriteMoltnetJsonPaths(creds.moltnetJson, vmAgentDir, vmSshDir, creds.githubAppPemFilename);
+		await vm.fs.writeFile(`${vmAgentDir}/moltnet.json`, vmMoltnetJson, { mode: 384 });
+		await vm.fs.writeFile(`${vmAgentDir}/env`, creds.agentEnvRaw, { mode: 384 });
+		if (creds.gitconfig) {
+			const vmSigningKey = `${vmSshDir}/id_ed25519`;
+			let vmGitconfig = creds.gitconfig.replace(/signingKey\s*=\s*.+/g, `signingKey = ${vmSigningKey}`);
+			vmGitconfig = ensureRelativeWorktreePaths(vmGitconfig);
+			await vm.fs.writeFile(`${vmAgentDir}/gitconfig`, vmGitconfig, { mode: 420 });
+		}
+		if (creds.sshPrivateKey) await vm.fs.writeFile(`${vmSshDir}/id_ed25519`, creds.sshPrivateKey, { mode: 384 });
+		if (creds.sshPublicKey) await vm.fs.writeFile(`${vmSshDir}/id_ed25519.pub`, creds.sshPublicKey, { mode: 420 });
+		if (creds.allowedSigners) await vm.fs.writeFile(`${vmSshDir}/allowed_signers`, creds.allowedSigners, { mode: 420 });
+		if (creds.githubAppPem && creds.githubAppPemFilename) await vm.fs.writeFile(`${vmAgentDir}/${creds.githubAppPemFilename}`, creds.githubAppPem, { mode: 384 });
+		await vm.exec("chown -R agent:agent /home/agent/.pi /home/agent/.moltnet");
+		return {
+			vm,
+			credentials: creds,
+			mountPath: config.mountPath,
+			guestWorkspace: GUEST_WORKSPACE$1,
+			agentDir
+		};
+	} catch (err) {
+		try {
+			await vm.close();
+		} catch (closeErr) {
+			const m = closeErr instanceof Error ? closeErr.message : String(closeErr);
+			process.stderr.write(`[vm] post-throw vm.close() failed: ${m}\n`);
+		}
+		throw err;
+	}
 }
 /**
 * Rewrite host-absolute paths inside moltnet.json to VM-local equivalents.
@@ -15464,8 +15497,8 @@ function buildRuntimeInstructor(ctx) {
 		"## Diary discipline",
 		"",
 		`- During this task, every diary entry MUST land in \`${ctx.diaryId}\``,
-		"  (the task diary). The MCP `moltnet_create_entry` tool enforces this",
-		"  and rejects mismatched explicit `diaryId` parameters.",
+		"  (the task diary). The `moltnet_create_entry` custom tool enforces",
+		"  this and rejects mismatched explicit `diaryId` parameters.",
 		`- Provenance tags \`task:id:${ctx.taskId}\`, \`task:type:${ctx.taskType}\`,`,
 		`  and \`task:attempt:${ctx.attemptN}\`${ctx.correlationId ? `, plus \`task:correlation:${ctx.correlationId}\`` : ""} are auto-injected on every entry.`,
 		"  These share the `task:` namespace so `moltnet_diary_tags` with",
@@ -15473,12 +15506,23 @@ function buildRuntimeInstructor(ctx) {
 		"  `taskFilter` shorthand on `moltnet_list_entries` /",
 		"  `moltnet_search_entries` expands into them. You may add additional",
 		"  tags but you cannot remove the auto-injected ones.",
+		"- **DO NOT shell out to `moltnet entry create` / `moltnet entry",
+		"  create-signed` / any other `moltnet entry` subcommand via bash.**",
+		"  Those CLI paths hit the REST API directly and bypass the",
+		"  custom tool's task-tag auto-injection, leaving you with",
+		"  untagged entries that `moltnet_list_entries` with a",
+		"  `taskFilter: { taskId: ... }` cannot find. The legreffier skill",
+		"  recommends `moltnet entry *` for normal interactive sessions —",
+		"  inside a running task that advice does not apply. Use the",
+		"  `moltnet_create_entry` custom tool only.",
 		"",
 		"## Accountable commits",
 		"",
 		"- Every commit you make during this task MUST be paired with a signed",
-		"  diary entry created via `moltnet_create_entry`. Embed the returned",
-		"  entry id in the commit trailer `MoltNet-Diary: <id>`.",
+		"  diary entry created via the `moltnet_create_entry` custom tool",
+		"  (NOT via `moltnet entry create-signed` from bash — see Diary",
+		"  discipline above). Embed the returned entry id in the commit",
+		"  trailer `MoltNet-Diary: <id>`.",
 		"- Commits must be signed with the agent credentials (gitconfig is",
 		"  pre-configured). Do not bypass signing.",
 		"",
@@ -16103,6 +16147,7 @@ async function executePiTask(claimedTask, reporter, opts) {
 				clearSessionErrors: () => {},
 				getHostCwd: () => mountPath,
 				hostExecBaseEnv: new Set([...HOST_EXEC_DEFAULT_BASE_ENV, ...Object.keys(managed.credentials.agentEnv)]),
+				hostExecAutoApprove: opts.hostExecAutoApprove ?? opts.sandboxConfig?.hostExec?.autoApprove ?? false,
 				getTaskContext: () => ({
 					taskId: task.id,
 					taskType: task.taskType,
@@ -16175,6 +16220,11 @@ async function executePiTask(claimedTask, reporter, opts) {
 		let assistantText = "";
 		let reporterError = null;
 		const usage = finalUsage;
+		let capAbort = null;
+		let toolUseTurnCount = 0;
+		let bashTimeoutCount = 0;
+		const maxTurns = opts.maxTurns ?? 0;
+		const maxBashTimeouts = opts.maxBashTimeouts ?? 3;
 		cancelListener = wireSessionAbort(reporter.cancelSignal, session);
 		const recordingPromise = [];
 		const track = (p) => {
@@ -16189,6 +16239,23 @@ async function executePiTask(claimedTask, reporter, opts) {
 				}
 			}));
 		};
+		const liveSession = session;
+		const triggerCapAbort = (code, message) => {
+			if (capAbort) return;
+			capAbort = {
+				code,
+				message
+			};
+			liveSession.abort().catch((err) => {
+				const m = err instanceof Error ? err.message : String(err);
+				process.stderr.write(`[cap] session.abort() failed: ${m}\n`);
+			});
+			track(emit("info", {
+				event: "cap_abort",
+				code,
+				message
+			}));
+		};
 		session.subscribe((event) => {
 			if (event.type === "message_update") {
 				const ae = event.assistantMessageEvent;
@@ -16197,12 +16264,17 @@ async function executePiTask(claimedTask, reporter, opts) {
 					track(emit("text_delta", { delta: ae.delta }));
 				}
 			} else if (event.type === "tool_execution_start") track(emit("tool_call_start", { tool_name: event.toolName }));
-			else if (event.type === "tool_execution_end") track(emit("tool_call_end", {
-				tool_name: event.toolName,
-				is_error: event.isError,
-				result: event.isError ? truncateForWire(event.result) : void 0
-			}));
-			else if (event.type === "turn_end") {
+			else if (event.type === "tool_execution_end") {
+				track(emit("tool_call_end", {
+					tool_name: event.toolName,
+					is_error: event.isError,
+					result: event.isError ? truncateForWire(event.result) : void 0
+				}));
+				if (maxBashTimeouts > 0 && event.toolName === "bash" && event.isError && isBashTimeoutResult(event.result)) {
+					bashTimeoutCount += 1;
+					if (bashTimeoutCount >= maxBashTimeouts) triggerCapAbort("max_bash_timeouts_exceeded", `Aborted after ${bashTimeoutCount} bash timeouts in this attempt (cap ${maxBashTimeouts}).`);
+				}
+			} else if (event.type === "turn_end") {
 				const msg = event.message;
 				if (msg?.role === "assistant" && msg.usage) {
 					usage.inputTokens += Math.max(0, msg.usage.input ?? 0);
@@ -16212,7 +16284,12 @@ async function executePiTask(claimedTask, reporter, opts) {
 					if (cr) usage.cacheReadTokens = (usage.cacheReadTokens ?? 0) + cr;
 					if (cw) usage.cacheWriteTokens = (usage.cacheWriteTokens ?? 0) + cw;
 				}
-				track(emit("turn_end", { stop_reason: msg?.stopReason ?? "end_turn" }));
+				const stopReason = msg?.stopReason ?? "end_turn";
+				track(emit("turn_end", { stop_reason: stopReason }));
+				if (maxTurns > 0 && stopReason !== "end_turn" && stopReason !== "aborted" && stopReason !== "error") {
+					toolUseTurnCount += 1;
+					if (toolUseTurnCount >= maxTurns) triggerCapAbort("max_turns_exceeded", `Aborted after ${toolUseTurnCount} tool-use turns (cap ${maxTurns}).`);
+				}
 				llmAbort = msg?.stopReason === "error";
 				if (msg?.stopReason === "error") llmErrorMessage = typeof msg.errorMessage === "string" && msg.errorMessage.length > 0 ? msg.errorMessage : null;
 				else llmErrorMessage = null;
@@ -16241,7 +16318,7 @@ async function executePiTask(claimedTask, reporter, opts) {
 		let parsedOutput = null;
 		let parsedOutputCid = null;
 		let parseError = null;
-		if (!runError && !llmAbort && !cancelled) {
+		if (!runError && !llmAbort && !cancelled && !capAbort) {
 			const captured = submitToolHandle?.getCaptured() ?? null;
 			if (captured) try {
 				parsedOutput = captured;
@@ -16294,6 +16371,21 @@ async function executePiTask(claimedTask, reporter, opts) {
 				retryable: false
 			}
 		};
+		const capAbortSnapshot = capAbort;
+		if (capAbortSnapshot) return {
+			taskId: task.id,
+			attemptN,
+			status: "failed",
+			output: null,
+			outputCid: null,
+			usage,
+			durationMs: Date.now() - startTime,
+			error: {
+				code: capAbortSnapshot.code,
+				message: capAbortSnapshot.message,
+				retryable: false
+			}
+		};
 		const status = runError || llmAbort || parseError || reporterError ? "failed" : "completed";
 		const errorCode = runError?.code ?? parseError?.code ?? reporterError?.code ?? (llmAbort ? "llm_api_error" : void 0);
 		const errorMessage = runError?.message ?? parseError?.message ?? reporterError?.message ?? (llmAbort ? llmErrorMessage ?? "LLM API error during turn" : void 0);
@@ -16395,6 +16487,25 @@ function summarizePayloadForLog(kind, payload) {
 		default: return payload;
 	}
 }
+/**
+* Detect pi's bash-timeout error wrapper in a `tool_execution_end`
+* result. The bash tool surfaces a timeout as a structured tool result
+* `{ content: [{ type: 'text', text: '… Command timed out after N
+* seconds' }] }` (see `@earendil-works/pi-coding-agent`'s bash.js).
+* Substring-match against the stable wrapper string is the only
+* mechanism short of patching pi; the string is part of pi's external
+* tool-error API and changing it would break agents that read tool
+* errors.
+*/
+function isBashTimeoutResult(result) {
+	if (result === null || result === void 0) return false;
+	if (typeof result === "string") return result.includes("Command timed out after");
+	if (typeof result !== "object") return false;
+	const content = result.content;
+	if (!Array.isArray(content)) return false;
+	for (const part of content) if (typeof part === "object" && part !== null && typeof part.text === "string" && part.text.includes("Command timed out after")) return true;
+	return false;
+}
 var TRUNCATE_LIMIT = 4 * 1024;
 function truncateForWire(value) {
 	if (value === null || value === void 0) return value;
@@ -16533,6 +16644,7 @@ async function finalizeTask(agent, output, ctx = {}) {
 		message: "Task execution failed before producing a valid output.",
 		retryable: false
 	};
+	if ((await agent.tasks.heartbeat(output.taskId, output.attemptN, {})).cancelled) return;
 	await agent.tasks.fail(output.taskId, output.attemptN, { error });
 }
 async function maybeWriteAnchors(output, ctx) {
@@ -16552,12 +16664,53 @@ async function maybeWriteAnchors(output, ctx) {
 	}
 }
 //#endregion
+//#region src/lib/logger.ts
+/**
+* Logger setup + teardown for the agent-daemon CLI commands.
+*
+* Why this helper exists: pino with `pino-pretty` transport spawns a
+* Node Worker thread for human-readable output. The Worker holds the
+* parent's TTYWrap handles ref'd; without an explicit `.end()` the
+* daemon never exits after the task completes — symptom: `once`
+* prints `[done] TaskOutput: …` then hangs until Ctrl-C
+* (see issue #1107). This module owns both creation and shutdown
+* so every CLI command gets the same cleanup contract without
+* duplicating the dance.
+*
+* Non-TTY mode (CI, file redirect) skips the transport entirely:
+* pino writes raw NDJSON directly to stderr, no worker thread,
+* nothing extra to clean up.
+*/
+function createRootLogger(options) {
+	const prettyTransport = process.stderr.isTTY ? transport({
+		target: "pino-pretty",
+		options: { colorize: true }
+	}) : null;
+	const logger = pino(options, prettyTransport ?? void 0);
+	const shutdown = async () => {
+		if (!prettyTransport) return;
+		logger.flush();
+		try {
+			prettyTransport.end();
+			await once(prettyTransport, "close");
+		} catch (err) {
+			process.stderr.write(`[pino] transport teardown failed: ` + (err instanceof Error ? err.message : String(err)) + "\n");
+		}
+	};
+	return {
+		logger,
+		shutdown
+	};
+}
+//#endregion
 //#region src/lib/options.ts
 var DEFAULTS = {
 	leaseTtlSec: 300,
 	heartbeatIntervalMs: 6e4,
 	maxBatchSize: 50,
-	flushIntervalMs: 200
+	flushIntervalMs: 200,
+	maxTurns: 0,
+	maxBashTimeouts: 3
 };
 var MissingRequiredOptionError = class extends Error {
 	constructor(flag) {
@@ -16579,6 +16732,8 @@ function parseCommonOptions(args) {
 		heartbeatIntervalMs: parseNonNegativeInt(args["heartbeat-interval-ms"], "heartbeat-interval-ms", DEFAULTS.heartbeatIntervalMs),
 		maxBatchSize: parsePositiveInt(args["max-batch-size"], "max-batch-size", DEFAULTS.maxBatchSize),
 		flushIntervalMs: parseNonNegativeInt(args["flush-interval-ms"], "flush-interval-ms", DEFAULTS.flushIntervalMs),
+		maxTurns: parseNonNegativeInt(args["max-turns"], "max-turns", DEFAULTS.maxTurns),
+		maxBashTimeouts: parseNonNegativeInt(args["max-bash-timeouts"], "max-bash-timeouts", DEFAULTS.maxBashTimeouts),
 		debug: args.debug === true
 	};
 }
@@ -16612,6 +16767,8 @@ function commonOptionDefs() {
 		"heartbeat-interval-ms": { type: "string" },
 		"max-batch-size": { type: "string" },
 		"flush-interval-ms": { type: "string" },
+		"max-turns": { type: "string" },
+		"max-bash-timeouts": { type: "string" },
 		debug: { type: "boolean" }
 	};
 }
@@ -16778,14 +16935,11 @@ async function runPolling(opts) {
 			"moltnet.llm.model": common.model
 		}
 	});
-	const rootLogger = pino({
+	const { logger, shutdown: shutdownLogger } = createRootLogger({
 		name: `agent-daemon.${opts.modeLabel}`,
-		level: cfg.logLevel || (common.debug ? "debug" : "info"),
-		...process.stderr.isTTY ? { transport: {
-			target: "pino-pretty",
-			options: { colorize: true }
-		} } : {}
-	}).child({
+		level: cfg.logLevel || (common.debug ? "debug" : "info")
+	});
+	const rootLogger = logger.child({
 		mode: opts.modeLabel,
 		agent: common.agent,
 		teamId,
@@ -16818,7 +16972,9 @@ async function runPolling(opts) {
 			provider: common.provider,
 			model: common.model,
 			sandboxConfig: sandbox.config,
-			makeOnTurnEvent: makeTurnEventHandlerFactory(rootLogger)
+			makeOnTurnEvent: makeTurnEventHandlerFactory(rootLogger),
+			maxTurns: common.maxTurns,
+			maxBashTimeouts: common.maxBashTimeouts
 		});
 		runtime = new AgentRuntime({
 			logger: rootLogger,
@@ -16897,6 +17053,7 @@ async function runPolling(opts) {
 		return drained.some((o) => o.status !== "completed") ? 1 : 0;
 	} finally {
 		await otelShutdown();
+		await shutdownLogger();
 	}
 }
 function parseCsv(raw) {
@@ -16968,14 +17125,11 @@ async function runOnce(argv) {
 			"moltnet.llm.model": opts.model
 		}
 	});
-	const rootLogger = pino({
+	const { logger, shutdown: shutdownLogger } = createRootLogger({
 		name: "agent-daemon.once",
-		level: cfg.logLevel || (opts.debug ? "debug" : "info"),
-		...process.stderr.isTTY ? { transport: {
-			target: "pino-pretty",
-			options: { colorize: true }
-		} } : {}
-	}).child({
+		level: cfg.logLevel || (opts.debug ? "debug" : "info")
+	});
+	const rootLogger = logger.child({
 		mode: "once",
 		agent: opts.agent,
 		provider: opts.provider,
@@ -17012,7 +17166,9 @@ async function runOnce(argv) {
 			provider: opts.provider,
 			model: opts.model,
 			sandboxConfig: sandbox.config,
-			onTurnEvent: makeTurnEventHandler(rootLogger, { taskId })
+			onTurnEvent: makeTurnEventHandler(rootLogger, { taskId }),
+			maxTurns: opts.maxTurns,
+			maxBashTimeouts: opts.maxBashTimeouts
 		});
 		const writeCorrelationAnchors = makePrBodyAnchorWriter({
 			gh: createGhCliClient(),
@@ -17049,6 +17205,7 @@ async function runOnce(argv) {
 		return output.status === "completed" ? 0 : 1;
 	} finally {
 		await otelShutdown();
+		await shutdownLogger();
 	}
 }
 //#endregion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/agent-daemon",
-  "version": "0.5.3",
+  "version": "0.6.1",
   "license": "AGPL-3.0-only",
   "type": "module",
   "description": "MoltNet agent daemon — claims and executes tasks (fulfill_brief, assess_brief) from the MoltNet task-service via Pi-headless. CLI: moltnet-agent.",
@@ -33,9 +33,9 @@
     "@opentelemetry/semantic-conventions": "^1.39.0",
     "pino": "^10.3.1",
     "pino-pretty": "^13.1.3",
-    "@themoltnet/agent-runtime": "0.15.0",
     "@themoltnet/sdk": "0.102.0",
-    "@themoltnet/pi-extension": "0.15.2"
+    "@themoltnet/pi-extension": "0.16.1",
+    "@themoltnet/agent-runtime": "0.15.0"
   },
   "devDependencies": {
     "tsx": "^4.7.0",
@@ -43,9 +43,9 @@
     "vite": "^8.0.0",
     "vitest": "^3.0.0",
     "@moltnet/crypto-service": "0.1.0",
+    "@moltnet/tasks": "0.1.0",
     "@moltnet/database": "0.1.0",
-    "@moltnet/bootstrap": "0.1.0",
-    "@moltnet/tasks": "0.1.0"
+    "@moltnet/bootstrap": "0.1.0"
   },
   "nx": {
     "tags": [