@themoltnet/agent-daemon 0.50.0 → 0.51.0

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEzD,wBAAsB,iBAAiB,CAAC,OAAO,EAAE;IAC/C,OAAO,EAAE,oBAAoB,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB,GAAG,OAAO,CAAC,MAAM,CAAC,CAwBlB"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAGzD,wBAAsB,iBAAiB,CAAC,OAAO,EAAE;IAC/C,OAAO,EAAE,oBAAoB,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB,GAAG,OAAO,CAAC,MAAM,CAAC,CA2ClB"}

package/dist/cli.js

@@ -1,6 +1,8 @@
 #!/usr/bin/env node
 import { a as cryptoService, defaultPiDaemonAdapter, i as compileExecutionPlan, n as createExecutionPlanSnapshot, r as parseCredentialRequirements, t as runtimeExecutionOffer } from "./pi.js";
 import { assertRuntimeAdapterSupportsProfile } from "./runtime.js";
+import { createRequire } from "node:module";
+import { pino, transport } from "pino";
 import { Type } from "typebox";
 import "multiformats/cid";
 import "multiformats/codecs/json";
@@ -16,7 +18,6 @@ import { constants, createReadStream, createWriteStream, existsSync, lstatSync,
 import { AuthenticationError, MoltNetError, agentKeyKey, assertTrustedConfigApiUrl, createExecutorAttestor, deriveMcpUrl, formatSecretReferenceString, identitySeedKey, parseSecretReferenceString, readConfig, register, requireSecureCredentialApiUrl, resolveAgentKey, resolveEnvSecretReference, resolveIdentitySeed, resolveOAuth2ClientSecret } from "@themoltnet/sdk";
 import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { once } from "node:events";
-import { pino, transport } from "pino";
 import { metrics } from "@opentelemetry/api";
 import { OTLPMetricExporter } from "@opentelemetry/exporter-metrics-otlp-proto";
 import { OTLPTraceExporter } from "@opentelemetry/exporter-trace-otlp-proto";
@@ -26,7 +27,7 @@ import { BatchSpanProcessor } from "@opentelemetry/sdk-trace-base";
 import { NodeTracerProvider } from "@opentelemetry/sdk-trace-node";
 import { ATTR_SERVICE_NAME, ATTR_SERVICE_VERSION } from "@opentelemetry/semantic-conventions";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { mkdir, open, realpath, stat } from "node:fs/promises";
+import { mkdir, open, readFile, realpath, stat, writeFile } from "node:fs/promises";
 import { pipeline } from "node:stream/promises";
 import cors from "@fastify/cors";
 import helmet from "@fastify/helmet";
@@ -34,7 +35,8 @@ import { lock, lockSync } from "proper-lockfile";
 import { ModelRuntime, readStoredCredential } from "@earendil-works/pi-coding-agent";
 import { Transform, Writable } from "node:stream";
 import { writePiConfig } from "@themoltnet/pi-runtime/pi-config";
-import { homedir } from "node:os";
+import { homedir, platform } from "node:os";
+import { pathToFileURL } from "node:url";
 import { StringDecoder } from "node:string_decoder";
 import rateLimit from "@fastify/rate-limit";
 import Fastify from "fastify";
@@ -3431,6 +3433,8 @@ Commands:
             child processes. Binds 127.0.0.1 only.
   sync-sessions
             Repair durable runtime-session checkpoints from local slot files.
+  update check
+            Check the stable MoltNet agent release without reading credentials.
 
 Run \`agent-daemon <command> --help\` for command-specific flags.
 
@@ -3798,6 +3802,12 @@ function loadAgentServerEnvConfig() {
 function processEnvSnapshot() {
 	return process.env;
 }
+function loadUpdateEnvConfig() {
+	return {
+		xdgCacheHome: process.env["XDG_CACHE_HOME"] ?? "",
+		localAppData: process.env["LOCALAPPDATA"] ?? ""
+	};
+}
 //#endregion
 //#region src/lib/abort-active-attempt.ts
 /** Best-effort signal cleanup; lease expiry remains the final backstop. */
@@ -8475,7 +8485,7 @@ var RunManager = class {
 		};
 	}
 	/** Assemble child env + args for a run. Exposed for tests. */
-	async prepare(spec, agent, piDir, providers = this.store.readProviders()) {
+	async prepare(spec, agent, piDir, providers = this.store.readProviders(), runtimeModule) {
 		const { activation, config } = agent;
 		const homeDir = join(dirname(piDir), "home");
 		const env = {
@@ -8499,6 +8509,7 @@ var RunManager = class {
 			};
 		})();
 		const args = [
+			...runtimeModule ? ["--runtime", runtimeModule] : [],
 			spec.mode,
 			"--agent",
 			target.agentName,
@@ -8569,7 +8580,8 @@ var RunManager = class {
 		const runDir = this.store.runDir(id);
 		const piDir = join(runDir, "pi");
 		const providers = this.store.readProviders();
-		const { args, env, cwd } = await this.prepare(spec, agent, piDir, providers);
+		const runtimeModule = this.options.resolveRuntimeModule ? await this.options.resolveRuntimeModule(spec, agent, dirname(piDir)) : this.options.runtimeRegistry ? await this.resolveRuntimeModule(spec, agent, dirname(piDir)) : void 0;
+		const { args, env, cwd } = await this.prepare(spec, agent, piDir, providers, runtimeModule);
 		this.assertStartOpen(signal);
 		let child;
 		let logStream;
@@ -8700,6 +8712,46 @@ var RunManager = class {
 			throw cause;
 		}
 	}
+	async resolveRuntimeModule(spec, activated, cwd) {
+		const profiles = await resolveRuntimeProfiles({
+			agent: await this.connectActivatedAgent(activated),
+			profiles: spec.profiles,
+			teamId: spec.teamId,
+			cwd
+		});
+		const kinds = [...new Set(profiles.map((profile) => profile.runtimeKind))];
+		if (kinds.length !== 1) throw new AgentServerRunError("invalid_spec", "All profiles in a server-managed run must use the same runtime kind.");
+		const kind = kinds[0];
+		let registration;
+		try {
+			registration = this.options.runtimeRegistry?.resolve(kind);
+		} catch (cause) {
+			this.log("warn", "registered runtime unavailable locally", {
+				runtimeKind: kind,
+				...runtimeRegistryFailure(cause)
+			});
+			throw new AgentServerRunError("invalid_spec", `Registered runtime "${kind}" is unavailable locally; re-register it before starting a run.`);
+		}
+		if (registration) return registration.moduleUrl;
+		if (kind === "gondolin_pi") return void 0;
+		throw new AgentServerRunError("invalid_spec", `No local runtime is registered for profile kind "${kind}".`);
+	}
+	async connectActivatedAgent(activated) {
+		const { activation, config } = activated;
+		if (activation.source === "managed") {
+			const agentKey = await resolveAgentKey(config, this.options.secretProviders);
+			if (!agentKey) throw new AgentServerRunError("invalid_spec", `managed agent "${activation.alias}" has no agent key`);
+			return connect({
+				agentKey,
+				apiUrl: activation.apiUrl
+			});
+		}
+		return connect({
+			configDir: dirname(activation.configPath),
+			apiUrl: activation.apiUrl ?? activation.configApiUrl,
+			secretProviders: this.options.externalSecretProviders
+		});
+	}
 	stop(id) {
 		const record = this.store.readRun(id);
 		if (!record) throw new AgentServerRunError("run_not_found", `run "${id}" was not found`);
@@ -8882,6 +8934,14 @@ function safeRunError(error) {
 		...typeof code === "string" ? { errorCode: code } : {}
 	};
 }
+function runtimeRegistryFailure(error) {
+	const code = error?.code;
+	return {
+		errorType: error instanceof Error ? error.name : typeof error,
+		...typeof code === "string" ? { errorCode: code } : {},
+		...error instanceof Error ? { errorMessage: error.message.slice(0, 512) } : {}
+	};
+}
 function sanitizeChildBaseEnv(baseEnv) {
 	return Object.fromEntries(Object.entries(baseEnv).filter(([name]) => INHERITED_ENV_NAMES.has(name) || INHERITED_MOLTNET_ENV_NAMES.has(name)));
 }
@@ -8897,6 +8957,168 @@ async function terminateChild(child) {
 		child.kill("SIGKILL");
 	});
 }
+//#endregion
+//#region src/runtime-loader.ts
+function extractRuntimeModule(argv) {
+	const remaining = [];
+	let specifier;
+	let parsingOptions = true;
+	for (let index = 0; index < argv.length; index += 1) {
+		const argument = argv[index];
+		if (argument === "--") {
+			parsingOptions = false;
+			remaining.push(argument);
+			continue;
+		}
+		if (!parsingOptions) {
+			remaining.push(argument);
+			continue;
+		}
+		let candidate;
+		if (argument === "--runtime") {
+			candidate = argv[index + 1];
+			if (!candidate) throw new Error("Missing value for --runtime");
+			index += 1;
+		} else if (argument.startsWith("--runtime=")) {
+			candidate = argument.slice(10);
+			if (!candidate) throw new Error("Missing value for --runtime");
+		} else {
+			remaining.push(argument);
+			continue;
+		}
+		if (specifier) throw new Error("--runtime may be specified only once");
+		specifier = candidate;
+	}
+	return {
+		argv: remaining,
+		specifier
+	};
+}
+function resolveRuntimeModuleUrl(specifier, cwd = process.cwd()) {
+	if (specifier.startsWith("file:")) return new URL(specifier).href;
+	if (isAbsolute(specifier) || specifier.startsWith("./") || specifier.startsWith("../")) return pathToFileURL(resolve(cwd, specifier)).href;
+	return pathToFileURL(createRequire(resolve(cwd, "package.json")).resolve(specifier)).href;
+}
+async function loadDaemonRuntimeAdapter(specifier, options = {}) {
+	let moduleUrl;
+	try {
+		moduleUrl = resolveRuntimeModuleUrl(specifier, options.cwd);
+	} catch (cause) {
+		throw new Error(`Unable to resolve runtime module "${specifier}" from ${options.cwd ?? process.cwd()}`, { cause });
+	}
+	let namespace;
+	try {
+		namespace = await import(moduleUrl);
+	} catch (cause) {
+		throw new Error(`Unable to load runtime module "${specifier}"`, { cause });
+	}
+	const adapter = namespace.default;
+	if (!isDaemonRuntimeAdapter(adapter)) throw new Error(`Runtime module "${specifier}" must default-export a DaemonRuntimeAdapter`);
+	return adapter;
+}
+function isDaemonRuntimeAdapter(value) {
+	if (!value || typeof value !== "object") return false;
+	const candidate = value;
+	return typeof candidate.runtimeKind === "string" && candidate.runtimeKind.length > 0 && typeof candidate.prepare === "function";
+}
+//#endregion
+//#region src/lib/agent-server/runtime-registry.ts
+var LOCKFILE_NAMES = [
+	"pnpm-lock.yaml",
+	"package-lock.json",
+	"yarn.lock",
+	"bun.lockb"
+];
+/** Local, operator-owned allowlist for executable daemon runtime modules. */
+var RuntimeRegistry = class {
+	constructor(root) {
+		this.root = root;
+	}
+	get path() {
+		return join(this.root, "runtime-registry.json");
+	}
+	list() {
+		if (!existsSync(this.path)) return [];
+		const value = JSON.parse(readFileSync(this.path, "utf8"));
+		if (!Array.isArray(value) || !value.every(isRegistration)) throw new AgentServerStoreError("invalid_state", "runtime registry contains an invalid registration");
+		return value;
+	}
+	async register(kind, specifier, cwd = process.cwd()) {
+		kind = assertStoreName("runtime kind", kind);
+		mkdirSync(this.root, {
+			recursive: true,
+			mode: 448
+		});
+		const moduleUrl = resolveRuntimeModuleUrl(specifier, cwd);
+		const adapter = await loadDaemonRuntimeAdapter(specifier, { cwd });
+		if (adapter.runtimeKind !== kind) throw new Error(`Runtime module provides "${adapter.runtimeKind}", not registered kind "${kind}".`);
+		if (!moduleUrl.startsWith("file:")) throw new Error("Runtime registration must resolve to a local file URL.");
+		const entryHash = hashFile(new URL(moduleUrl));
+		const lockfilePath = isPackageSpecifier(specifier) ? findLockfile(cwd) : void 0;
+		if (isPackageSpecifier(specifier) && !lockfilePath) throw new Error("Package runtime registration requires a pnpm, npm, Yarn, or Bun lockfile in the current project or a parent directory.");
+		const entry = {
+			kind,
+			moduleUrl,
+			entryHash,
+			...lockfilePath ? {
+				lockfilePath,
+				lockfileHash: hashPath(lockfilePath)
+			} : {},
+			registeredAt: (/* @__PURE__ */ new Date()).toISOString()
+		};
+		const entries = this.list().filter((candidate) => candidate.kind !== kind);
+		entries.push(entry);
+		writeRegistry(this.path, entries);
+		return entry;
+	}
+	unregister(kind) {
+		kind = assertStoreName("runtime kind", kind);
+		const entries = this.list();
+		const next = entries.filter((entry) => entry.kind !== kind);
+		if (next.length === entries.length) return false;
+		writeRegistry(this.path, next);
+		return true;
+	}
+	resolve(kind) {
+		kind = assertStoreName("runtime kind", kind);
+		const entry = this.list().find((candidate) => candidate.kind === kind);
+		if (!entry) return void 0;
+		if (hashFile(new URL(entry.moduleUrl)) !== entry.entryHash) throw new Error(`Registered runtime "${kind}" has changed; re-register it before starting a run.`);
+		if (entry.lockfilePath && (!existsSync(entry.lockfilePath) || hashPath(entry.lockfilePath) !== entry.lockfileHash)) throw new Error(`Registered runtime "${kind}" lockfile has changed; re-register it before starting a run.`);
+		return entry;
+	}
+};
+function hashFile(url) {
+	return createHash("sha256").update(readFileSync(url)).digest("hex");
+}
+function hashPath(path) {
+	return createHash("sha256").update(readFileSync(path)).digest("hex");
+}
+function isPackageSpecifier(specifier) {
+	return !specifier.startsWith("file:") && !specifier.startsWith(".") && !specifier.startsWith("/");
+}
+function findLockfile(cwd) {
+	let current = resolve(cwd);
+	for (;;) {
+		for (const name of LOCKFILE_NAMES) {
+			const candidate = join(current, name);
+			if (existsSync(candidate)) return candidate;
+		}
+		const parent = dirname(current);
+		if (parent === current) return void 0;
+		current = parent;
+	}
+}
+function isRegistration(value) {
+	if (!value || typeof value !== "object") return false;
+	const entry = value;
+	return typeof entry.kind === "string" && typeof entry.moduleUrl === "string" && entry.moduleUrl.startsWith("file:") && typeof entry.entryHash === "string" && typeof entry.registeredAt === "string" && (entry.lockfilePath === void 0 || typeof entry.lockfilePath === "string") && (entry.lockfileHash === void 0 || typeof entry.lockfileHash === "string") && entry.lockfilePath === void 0 === (entry.lockfileHash === void 0);
+}
+function writeRegistry(path, entries) {
+	const temp = `${path}.${process.pid}.tmp`;
+	writeFileSync(temp, `${JSON.stringify(entries, null, 2)}\n`, { mode: 384 });
+	renameSync(temp, path);
+}
 var AgentServerModelDiscoveryError = class extends Error {
 	name = "AgentServerModelDiscoveryError";
 	constructor(code, message, statusCode, options) {
@@ -9968,7 +10190,8 @@ async function runAgentServer(argv) {
 					secretProviders,
 					externalSecretProviders,
 					baseEnv: processEnvSnapshot(),
-					logger
+					logger,
+					runtimeRegistry: new RuntimeRegistry(store.root)
 				});
 				const app = buildAgentServer({
 					store,
@@ -10233,15 +10456,128 @@ function parseLimit(raw) {
 	return value;
 }
 //#endregion
+//#region src/lib/update.ts
+var UPDATE_MANIFEST_URL = "https://themolt.net/download/manifest.json";
+var UPDATE_CACHE_TTL_MS = 1440 * 60 * 1e3;
+var UPDATE_ERROR_CACHE_TTL_MS = 300 * 1e3;
+function detectDaemonInstallMethod(executable = process.argv[1] ?? "") {
+	const path = executable.replaceAll("\\", "/");
+	if (path.includes("/node_modules/@themoltnet/agent-daemon/")) return "npm";
+	if (path.includes("/.local/share/moltnet/") || path.includes("/opt/moltnet/")) return "bundle";
+	return "direct";
+}
+function daemonUpdateCommand(method) {
+	if (method === "npm") return "npm install -g @themoltnet/agent-daemon@latest";
+	return "curl -fsSL https://themolt.net/install/agent | sh";
+}
+async function checkDaemonUpdate(input) {
+	const installMethod = detectDaemonInstallMethod(input.executable ?? process.argv[1] ?? "moltnet-agent");
+	const result = {
+		currentVersion: normalizeVersion(input.currentVersion),
+		updateAvailable: false,
+		installMethod,
+		releaseUrl: "https://themolt.net/download",
+		command: daemonUpdateCommand(installMethod)
+	};
+	const now = input.now ?? /* @__PURE__ */ new Date();
+	if (!input.force) {
+		const cached = await readCache();
+		const ttl = cached?.latest ? UPDATE_CACHE_TTL_MS : UPDATE_ERROR_CACHE_TTL_MS;
+		if (cached && now.getTime() - Date.parse(cached.checkedAt) < ttl) {
+			result.latestVersion = cached.latest;
+			result.updateAvailable = compareVersions(cached.latest, result.currentVersion) > 0;
+			return result;
+		}
+	}
+	try {
+		const response = await (input.fetchFn ?? fetch)(UPDATE_MANIFEST_URL, { signal: AbortSignal.timeout(5e3) });
+		if (!response.ok) throw new Error(`manifest returned HTTP ${response.status}`);
+		const latest = manifestVersion(await response.json());
+		if (!latest) throw new Error("manifest has no valid agent version");
+		await writeCache({
+			checkedAt: now.toISOString(),
+			latest
+		}).catch(() => void 0);
+		result.latestVersion = latest;
+		result.updateAvailable = compareVersions(latest, result.currentVersion) > 0;
+		return result;
+	} catch (error) {
+		await writeCache({
+			checkedAt: now.toISOString(),
+			error: error instanceof Error ? error.message : String(error)
+		}).catch(() => void 0);
+		throw new Error(`could not check for MoltNet agent updates: ${error instanceof Error ? error.message : String(error)}`);
+	}
+}
+function manifestVersion(value) {
+	if (!value || typeof value !== "object") return void 0;
+	const agent = value.agent;
+	if (!agent || typeof agent !== "object") return void 0;
+	const version = agent.version;
+	return typeof version === "string" && validVersion(version) ? normalizeVersion(version) : void 0;
+}
+function normalizeVersion(value) {
+	return value.trim().replace(/^v/, "");
+}
+function validVersion(value) {
+	return /^v?\d+\.\d+\.\d+$/.test(value);
+}
+function compareVersions(a, b) {
+	if (!a || !validVersion(a) || !validVersion(b)) return 0;
+	const left = normalizeVersion(a).split(".").map(Number);
+	const right = normalizeVersion(b).split(".").map(Number);
+	for (let i = 0; i < 3; i += 1) {
+		const leftPart = left[i] ?? 0;
+		const rightPart = right[i] ?? 0;
+		if (leftPart > rightPart) return 1;
+		if (leftPart < rightPart) return -1;
+	}
+	return 0;
+}
+function cachePath() {
+	const env = loadUpdateEnvConfig();
+	return join(env.xdgCacheHome || (platform() === "win32" ? env.localAppData || join(homedir(), "AppData", "Local") : join(homedir(), ".cache")), "moltnet", "updates", "agent.json");
+}
+async function readCache() {
+	try {
+		return JSON.parse(await readFile(cachePath(), "utf8"));
+	} catch {
+		return;
+	}
+}
+async function writeCache(cache) {
+	const path = cachePath();
+	await mkdir(dirname(path), {
+		recursive: true,
+		mode: 448
+	});
+	await writeFile(path, JSON.stringify(cache), { mode: 384 });
+}
+//#endregion
+//#region src/version.ts
+var DAEMON_VERSION = "0.51.0";
+//#endregion
 //#region src/cli.ts
 async function runAgentDaemonCli(options) {
 	const [subcommand, ...rest] = options.argv ?? process.argv.slice(2);
+	if ([
+		"poll",
+		"drain",
+		"serve"
+	].includes(subcommand ?? "") && !isWorkspaceInvocation()) checkDaemonUpdate({ currentVersion: DAEMON_VERSION }).then((update) => {
+		if (update.updateAvailable) pino({ name: "moltnet.agent-daemon" }).info({
+			event: "agent-daemon.update_available",
+			update
+		}, "A MoltNet agent update is available");
+	}).catch(() => void 0);
 	switch (subcommand) {
 		case "poll": return runPoll(rest, options.runtime);
 		case "once": return runOnce(rest, options.runtime);
 		case "drain": return runDrain(rest, options.runtime);
 		case "server": return runAgentServer(rest);
 		case "sync-sessions": return runSyncSessions(rest);
+		case "update": return runUpdate(rest);
+		case "runtime": return runRuntime(rest);
 		case "-h":
 		case "--help":
 			console.log(ROOT_USAGE);
@@ -10254,5 +10590,49 @@ async function runAgentDaemonCli(options) {
 			return 1;
 	}
 }
+function isWorkspaceInvocation() {
+	return (process.argv[1] ?? "").replaceAll("\\", "/").includes("/apps/agent-daemon/src/");
+}
+async function runUpdate(argv) {
+	if (argv[0] !== "check" || argv.slice(1).some((arg) => arg !== "--json")) {
+		console.error("Usage: moltnet-agent update check [--json]");
+		return 1;
+	}
+	try {
+		const update = await checkDaemonUpdate({
+			currentVersion: DAEMON_VERSION,
+			force: true
+		});
+		if (argv.includes("--json")) console.log(JSON.stringify(update));
+		else if (update.updateAvailable) console.log(`MoltNet agent ${update.latestVersion} is available (you have ${update.currentVersion}). Run: ${update.command}`);
+		else console.log(`MoltNet agent ${update.currentVersion} is up to date.`);
+		return 0;
+	} catch (error) {
+		console.error(error instanceof Error ? error.message : String(error));
+		return 1;
+	}
+}
+async function runRuntime(argv) {
+	const config = loadAgentServerEnvConfig();
+	const registry = new RuntimeRegistry(resolveAgentServerRoot({
+		root: config.root,
+		xdgConfigHome: config.xdgConfigHome
+	}));
+	const [command, ...rest] = argv;
+	if (command === "list") {
+		console.log(JSON.stringify(registry.list(), null, 2));
+		return 0;
+	}
+	if (command === "unregister" && rest.length === 1) {
+		if (!registry.unregister(rest[0])) throw new Error(`No runtime registered for "${rest[0]}".`);
+		return 0;
+	}
+	if (command === "register" && rest.length === 2) {
+		console.log(JSON.stringify(await registry.register(rest[0], rest[1]), null, 2));
+		return 0;
+	}
+	console.error("Usage: moltnet-agent runtime <list|register <kind> <module>|unregister <kind>>");
+	return 1;
+}
 //#endregion
-export { runAgentDaemonCli };
+export { loadDaemonRuntimeAdapter as n, runAgentDaemonCli, extractRuntimeModule as t };

package/dist/main.js

@@ -1,7 +1,6 @@
 #!/usr/bin/env node
 import { defaultPiDaemonAdapter } from "./pi.js";
-import { runAgentDaemonCli } from "./cli.js";
-import { createRequire } from "node:module";
+import { n as loadDaemonRuntimeAdapter, runAgentDaemonCli, t as extractRuntimeModule } from "./cli.js";
 import { registerInstrumentations } from "@opentelemetry/instrumentation";
 import { DnsInstrumentation } from "@opentelemetry/instrumentation-dns";
 import { HttpInstrumentation } from "@opentelemetry/instrumentation-http";
@@ -9,8 +8,6 @@ import { NetInstrumentation } from "@opentelemetry/instrumentation-net";
 import { PgInstrumentation } from "@opentelemetry/instrumentation-pg";
 import { PinoInstrumentation } from "@opentelemetry/instrumentation-pino";
 import { UndiciInstrumentation } from "@opentelemetry/instrumentation-undici";
-import { isAbsolute, resolve } from "node:path";
-import { pathToFileURL } from "node:url";
 //#region ../../libs/observability/src/instrumentation.ts
 /**
 * Register OTel auto-instrumentation for common Node.js modules.
@@ -101,70 +98,6 @@ function installSupervisorParentGuard(proc = process) {
 	return true;
 }
 //#endregion
-//#region src/runtime-loader.ts
-function extractRuntimeModule(argv) {
-	const remaining = [];
-	let specifier;
-	let parsingOptions = true;
-	for (let index = 0; index < argv.length; index += 1) {
-		const argument = argv[index];
-		if (argument === "--") {
-			parsingOptions = false;
-			remaining.push(argument);
-			continue;
-		}
-		if (!parsingOptions) {
-			remaining.push(argument);
-			continue;
-		}
-		let candidate;
-		if (argument === "--runtime") {
-			candidate = argv[index + 1];
-			if (!candidate) throw new Error("Missing value for --runtime");
-			index += 1;
-		} else if (argument.startsWith("--runtime=")) {
-			candidate = argument.slice(10);
-			if (!candidate) throw new Error("Missing value for --runtime");
-		} else {
-			remaining.push(argument);
-			continue;
-		}
-		if (specifier) throw new Error("--runtime may be specified only once");
-		specifier = candidate;
-	}
-	return {
-		argv: remaining,
-		specifier
-	};
-}
-function resolveRuntimeModuleUrl(specifier, cwd = process.cwd()) {
-	if (specifier.startsWith("file:")) return new URL(specifier).href;
-	if (isAbsolute(specifier) || specifier.startsWith("./") || specifier.startsWith("../")) return pathToFileURL(resolve(cwd, specifier)).href;
-	return pathToFileURL(createRequire(resolve(cwd, "package.json")).resolve(specifier)).href;
-}
-async function loadDaemonRuntimeAdapter(specifier, options = {}) {
-	let moduleUrl;
-	try {
-		moduleUrl = resolveRuntimeModuleUrl(specifier, options.cwd);
-	} catch (cause) {
-		throw new Error(`Unable to resolve runtime module "${specifier}" from ${options.cwd ?? process.cwd()}`, { cause });
-	}
-	let namespace;
-	try {
-		namespace = await import(moduleUrl);
-	} catch (cause) {
-		throw new Error(`Unable to load runtime module "${specifier}"`, { cause });
-	}
-	const adapter = namespace.default;
-	if (!isDaemonRuntimeAdapter(adapter)) throw new Error(`Runtime module "${specifier}" must default-export a DaemonRuntimeAdapter`);
-	return adapter;
-}
-function isDaemonRuntimeAdapter(value) {
-	if (!value || typeof value !== "object") return false;
-	const candidate = value;
-	return typeof candidate.runtimeKind === "string" && candidate.runtimeKind.length > 0 && typeof candidate.prepare === "function";
-}
-//#endregion
 //#region src/main.ts
 installSupervisorParentGuard();
 async function main() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/agent-daemon",
-  "version": "0.50.0",
+  "version": "0.51.0",
   "license": "AGPL-3.0-only",
   "type": "module",
   "description": "Universal MoltNet agent daemon host with a built-in Pi/Gondolin runtime and support for trusted operator-owned runtime modules. CLI: moltnet-agent.",
@@ -84,9 +84,9 @@
     "proper-lockfile": "4.1.2",
     "typebox": "^1.2.8",
     "@themoltnet/agent-runtime": "0.45.2",
+    "@themoltnet/pi-runtime": "0.14.1",
     "@themoltnet/os-keyring": "0.3.0",
-    "@themoltnet/sdk": "0.140.0",
-    "@themoltnet/pi-runtime": "0.14.1"
+    "@themoltnet/sdk": "0.140.0"
   },
   "devDependencies": {
     "@fastify/swagger": "^9.6.1",
@@ -97,15 +97,15 @@
     "vite-plugin-dts": "^4.5.4",
     "vitest": "^3.0.0",
     "@moltnet/agent-eval": "0.1.0",
-    "@moltnet/crypto-service": "0.1.0",
     "@moltnet/bootstrap": "0.1.0",
+    "@moltnet/crypto-service": "0.1.0",
+    "@moltnet/execution-plan": "0.1.0",
     "@moltnet/execution-integrations": "0.1.0",
+    "@moltnet/models": "0.1.0",
     "@moltnet/loopback-companion": "0.1.0",
-    "@moltnet/execution-plan": "0.1.0",
+    "@moltnet/tasks": "0.1.0",
     "@moltnet/observability": "0.1.0",
-    "@moltnet/models": "0.1.0",
-    "@moltnet/runtime-profiles": "0.1.0",
-    "@moltnet/tasks": "0.1.0"
+    "@moltnet/runtime-profiles": "0.1.0"
   },
   "nx": {
     "projectType": "application",