@themoltnet/agent-daemon 0.52.0 → 0.53.0

package/README.md

@@ -135,14 +135,22 @@ of `MOLTNET_PRIVATE_KEY`.
 An agent key used by the daemon needs this least-privilege scope set:
 
 ```text
-agent:profile runtime:read task:read task:claim task:execute
+agent:profile crypto:sign runtime:read task:read task:claim task:execute
 ```
 
-The Console selects these five scopes by default. Knowledge-enabled workers
-must add `diary:read`, `diary:write`, `pack:read`, and `pack:write` when the key
-is issued. Runtime policy can narrow key authority but cannot add missing
-scopes, and existing keys are never widened automatically; issue a replacement
-credential when broader authority is required.
+The Console selects these scopes by default. Knowledge-enabled workers must add
+`diary:read`, `diary:write`, `pack:read`, and `pack:write` when the key is
+issued.
+
+`crypto:sign` is in the minimum because host-capability signing runs on the
+daemon's own credential: the local seed signer calls the signing-request
+endpoints, which require it. Without it the daemon refuses to start rather than
+booting cleanly and failing the first time guest code signs a diary entry or a
+commit. Keys issued with the older five-scope set must be reissued.
+
+Runtime policy can narrow key authority but cannot add missing scopes, and
+existing keys are never widened automatically; issue a replacement credential
+when broader authority is required.
 
 ### Pi provider auth
 

package/dist/cli.js

@@ -779,9 +779,16 @@ var ALL_CREDENTIAL_SCOPES = Object.freeze(Object.values(CREDENTIAL_SCOPES));
 /**
 * Minimum grant for the agent daemon. Task credentials attenuate this further
 * to `task:execute` alone.
+*
+* `crypto:sign` is part of the minimum because host-capability signing runs on
+* the daemon's own credential: the local seed signer calls the signing-request
+* endpoints, which require it. A grant without it produces a daemon that boots
+* cleanly and then fails the first time guest code signs a diary entry or a
+* commit.
 */
 var AGENT_CREDENTIAL_SCOPES = [
 	CREDENTIAL_SCOPES.AgentProfile,
+	CREDENTIAL_SCOPES.CryptoSign,
 	CREDENTIAL_SCOPES.RuntimeRead,
 	CREDENTIAL_SCOPES.TaskRead,
 	CREDENTIAL_SCOPES.TaskClaim,
@@ -10812,7 +10819,7 @@ async function writeCache(cache) {
 }
 //#endregion
 //#region src/version.ts
-var DAEMON_VERSION = "0.52.0";
+var DAEMON_VERSION = "0.53.0";
 //#endregion
 //#region src/cli.ts
 async function runAgentDaemonCli(options) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/agent-daemon",
-  "version": "0.52.0",
+  "version": "0.53.0",
   "license": "AGPL-3.0-only",
   "type": "module",
   "description": "Universal MoltNet agent daemon host with a built-in Pi/Gondolin runtime and support for trusted operator-owned runtime modules. CLI: moltnet-agent.",
@@ -85,10 +85,10 @@
     "proper-lockfile": "4.1.2",
     "reflect-metadata": "^0.2.2",
     "typebox": "^1.2.8",
-    "@themoltnet/pi-runtime": "0.14.1",
-    "@themoltnet/agent-runtime": "0.45.2",
+    "@themoltnet/agent-runtime": "0.45.3",
     "@themoltnet/os-keyring": "0.3.0",
-    "@themoltnet/sdk": "0.140.0"
+    "@themoltnet/pi-runtime": "0.14.2",
+    "@themoltnet/sdk": "0.140.1"
   },
   "devDependencies": {
     "@fastify/swagger": "^9.6.1",
@@ -98,15 +98,15 @@
     "vite": "^8.0.0",
     "vite-plugin-dts": "^4.5.4",
     "vitest": "^3.0.0",
-    "@moltnet/bootstrap": "0.1.0",
     "@moltnet/agent-eval": "0.1.0",
     "@moltnet/crypto-service": "0.1.0",
     "@moltnet/execution-integrations": "0.1.0",
+    "@moltnet/bootstrap": "0.1.0",
     "@moltnet/execution-plan": "0.1.0",
-    "@moltnet/loopback-companion": "0.1.0",
+    "@moltnet/models": "0.1.0",
     "@moltnet/observability": "0.1.0",
+    "@moltnet/loopback-companion": "0.1.0",
     "@moltnet/runtime-profiles": "0.1.0",
-    "@moltnet/models": "0.1.0",
     "@moltnet/tasks": "0.1.0"
   },
   "nx": {