@themoltnet/agent-daemon 0.55.0 → 0.55.1

package/dist/cli.js

@@ -14,7 +14,7 @@ import { AgentRuntime, ApiTaskReporter, ApiTaskSource, PollingApiTaskSource, cre
 import { GuestEnvironmentBoundaryError, assertGuestEnvironmentBoundary, createPiRetryTriage, findMainWorktree, isResolvedPathInsideRoot, normalizeRetryTriageResult, redactRetryTriageSecrets, resolveRuntimeProfileModel } from "@themoltnet/pi-runtime";
 import { FILE_SECRET_PROVIDER, FileSecretProvider, connect, createNodeSecretProviderRegistry } from "@themoltnet/sdk/node";
 import { constants, createReadStream, createWriteStream, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
-import { AuthenticationError, IDENTITY_ALIAS_PATTERN, MoltNetError, agentKeyKey, assertIdentityAlias, assertTrustedConfigApiUrl, createExecutorAttestor, deriveMcpUrl, formatSecretReferenceString, getConfigDir, getIdentityDir, identitySeedKey, isCanonicalConfig, parseSecretReferenceString, readConfig, register, requireSecureCredentialApiUrl, resolveAgentKey, resolveEnvSecretReference, resolveIdentitySeed, resolveOAuth2ClientSecret } from "@themoltnet/sdk";
+import { AuthenticationError, IDENTITY_ALIAS_PATTERN, MoltNetError, agentKeyKey, assertIdentityAlias, assertTrustedConfigApiUrl, createExecutorAttestor, deriveMcpUrl, formatSecretReferenceString, getConfigDir, getIdentityDir, identitySeedKey, isCanonicalConfig, parseSecretReferenceString, readConfig, register, requireSecureCredentialApiUrl, resolveAgentKey, resolveEnvSecretReference, resolveIdentitySeed } from "@themoltnet/sdk";
 import { execFile, spawn } from "node:child_process";
 import { X509Certificate, createHash, createPrivateKey, createPublicKey, randomBytes, randomUUID, timingSafeEqual, webcrypto } from "node:crypto";
 import { once } from "node:events";
@@ -5292,16 +5292,16 @@ function validateTaskTypes(types) {
 /**
 * OTel SDK bootstrap for the agent daemon.
 *
-*   const shutdown = await initWorkerOtel({ serviceName, agentDir });
+*   const shutdown = await initWorkerOtel({ serviceName, agent });
 *   try { ... } finally { await shutdown(); }
 *
 * No-op when MOLTNET_OTEL_ENDPOINT is unset — `@opentelemetry/api` falls
 * back to no-op tracers and meters, so the runtime + pi extension still
 * call into it but nothing is exported.
 */
-async function initWorkerOtel(options) {
+function initWorkerOtel(options) {
 	const endpoint = options.endpoint;
-	if (!endpoint) return async () => {};
+	if (!endpoint) return Promise.resolve(async () => {});
 	const resource = resourceFromAttributes({
 		[ATTR_SERVICE_NAME]: options.serviceName,
 		...options.serviceVersion && { [ATTR_SERVICE_VERSION]: options.serviceVersion },
@@ -5309,11 +5309,7 @@ async function initWorkerOtel(options) {
 		...options.resourceAttributes
 	});
 	let headersFactory;
-	let agent = options.agent;
-	if (!agent && options.agentDir) agent = await connect({
-		configDir: options.agentDir,
-		secretProviders: createNodeSecretProviderRegistry()
-	});
+	const agent = options.agent;
 	if (agent) headersFactory = async () => {
 		return { Authorization: `Bearer ${await agent.getToken()}` };
 	};
@@ -5338,7 +5334,7 @@ async function initWorkerOtel(options) {
 	});
 	provider.register();
 	metrics.setGlobalMeterProvider(meterProvider);
-	return async () => {
+	return Promise.resolve(async () => {
 		await Promise.all([provider.forceFlush().catch((err) => {
 			process.stderr.write(`[otel-bootstrap] trace forceFlush failed: ${err instanceof Error ? err.message : String(err)}\n`);
 		}), meterProvider.forceFlush().catch((err) => {
@@ -5349,7 +5345,7 @@ async function initWorkerOtel(options) {
 		}), meterProvider.shutdown().catch((err) => {
 			process.stderr.write(`[otel-bootstrap] metric shutdown failed: ${err instanceof Error ? err.message : String(err)}\n`);
 		})]);
-	};
+	});
 }
 //#endregion
 //#region src/lib/pi-agent-dir.ts
@@ -6086,11 +6082,12 @@ async function runPolling(opts) {
 			throw error;
 		}
 	})();
+	const daemonRootDir = explicitAgentRootDir ?? process.cwd();
 	const resolvedProfiles = await resolveRuntimeProfiles({
 		agent: ctx.agent,
 		profiles: profileValues,
 		teamId,
-		cwd: ctx.agentRootDir
+		cwd: daemonRootDir
 	});
 	const runtimeAdapter = opts.runtimeAdapter ?? defaultPiDaemonAdapter;
 	const preparedRuntimes = /* @__PURE__ */ new Map();
@@ -6743,11 +6740,12 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 			throw error;
 		}
 	})();
+	const daemonRootDir = explicitAgentRootDir ?? process.cwd();
 	const profile = await resolveRuntimeProfile({
 		agent: ctx.agent,
 		profile: values.profile,
 		teamId: values.team,
-		cwd: ctx.agentRootDir
+		cwd: daemonRootDir
 	});
 	assertRuntimeAdapterSupportsProfile(runtimeAdapter, profile);
 	const preparedRuntime = attestPreparedRuntime(await runtimeAdapter.prepare({ profile }), signingPrivateKey);
@@ -8395,8 +8393,7 @@ async function attachExternalAgent(store, secretProviders, input, connectAgent =
 		externalAgentLocation(configPath);
 		const config = await readCurrentConfig(configPath);
 		const configApiUrl = requireTrustedConfigApiUrl(config, configPath);
-		const effectiveApiUrl = requireTrustedApiOverride(input.apiUrl, configApiUrl, configPath);
-		const whoami = await authenticateConfig(input.configDir, effectiveApiUrl, secretProviders, connectAgent, input.signal);
+		const whoami = await authenticateConfig(config, configPath, requireTrustedApiOverride(input.apiUrl, configApiUrl, configPath), secretProviders, connectAgent, input.signal);
 		const identity = identityFromConfig(config);
 		assertIdentityMatches(identity, whoami, `external config ${configPath}`, "authenticated whoami");
 		assertSubjectMatches(whoami, config, "authenticated whoami", `external config ${configPath}`);
@@ -8473,7 +8470,7 @@ async function verifyExternalActivation(activation, secretProviders, connectAgen
 	const effectiveApiUrl = requireTrustedApiOverride(activation.apiUrl, activation.configApiUrl, activation.configPath);
 	return {
 		config,
-		whoami: await authenticateConfig(dirname(activation.configPath), effectiveApiUrl, secretProviders, connectAgent, signal)
+		whoami: await authenticateConfig(config, activation.configPath, effectiveApiUrl, secretProviders, connectAgent, signal)
 	};
 }
 /** Never let request or activation metadata redirect persisted credentials. */
@@ -8533,12 +8530,18 @@ function externalAgentLocation(configPath) {
 		agentRoot: dirname(moltnetDir)
 	};
 }
-async function authenticateConfig(configDir, apiUrl, secretProviders, connectAgent, signal) {
+async function authenticateConfig(config, configPath, apiUrl, secretProviders, connectAgent, signal) {
+	let agentKey;
+	try {
+		agentKey = await resolveAgentKey(config, secretProviders);
+	} catch (cause) {
+		throw verificationError(`could not resolve the daemon agent key from ${configPath}`, cause);
+	}
+	if (!agentKey) throw new AgentServerIdentityError("unsupported_credential", `external daemon config at ${configPath} must contain an agent_key_ref`);
 	return callWhoami(connectAgent, {
-		configDir,
-		...apiUrl ? { apiUrl } : {},
-		secretProviders
-	}, configDir, signal);
+		agentKey,
+		...apiUrl ? { apiUrl } : {}
+	}, configPath, signal);
 }
 async function callWhoami(connectAgent, options, source, signal) {
 	try {
@@ -8730,14 +8733,9 @@ var RunManager = class {
 			env["MOLTNET_API_URL"] = activation.apiUrl ?? activation.configApiUrl;
 			try {
 				const agentKey = await resolveAgentKey(config, this.options.externalSecretProviders);
-				if (agentKey) {
-					env["MOLTNET_AGENT_KEY"] = agentKey;
-					env["MOLTNET_PRIVATE_KEY"] = await resolveIdentitySeed(config, this.options.externalSecretProviders);
-				} else if (config.oauth2?.client_secret_ref) {
-					env["MOLTNET_CLIENT_ID"] = config.oauth2.client_id;
-					env["MOLTNET_CLIENT_SECRET"] = await resolveOAuth2ClientSecret(config, this.options.externalSecretProviders);
-				}
-				if (!agentKey && config.keys.private_key_ref) env["MOLTNET_PRIVATE_KEY"] = await resolveIdentitySeed(config, this.options.externalSecretProviders);
+				if (!agentKey) throw new Error("external daemon config has no agent key");
+				env["MOLTNET_AGENT_KEY"] = agentKey;
+				env["MOLTNET_PRIVATE_KEY"] = await resolveIdentitySeed(config, this.options.externalSecretProviders);
 			} catch {
 				throw new AgentServerRunError("invalid_spec", `external credentials for "${activation.alias}" could not be projected`);
 			}
@@ -8947,10 +8945,11 @@ var RunManager = class {
 				apiUrl: activation.apiUrl
 			});
 		}
+		const agentKey = await resolveAgentKey(config, this.options.externalSecretProviders);
+		if (!agentKey) throw new AgentServerRunError("invalid_spec", `external agent "${activation.alias}" has no agent key`);
 		return connect({
-			configDir: dirname(activation.configPath),
-			apiUrl: activation.apiUrl ?? activation.configApiUrl,
-			secretProviders: this.options.externalSecretProviders
+			agentKey,
+			apiUrl: activation.apiUrl ?? activation.configApiUrl
 		});
 	}
 	stop(id) {
@@ -11053,7 +11052,7 @@ async function writeCache(cache) {
 }
 //#endregion
 //#region src/version.ts
-var DAEMON_VERSION = "0.55.0";
+var DAEMON_VERSION = "0.55.1";
 //#endregion
 //#region src/cli.ts
 async function runAgentDaemonCli(options) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/agent-daemon",
-  "version": "0.55.0",
+  "version": "0.55.1",
   "license": "AGPL-3.0-only",
   "type": "module",
   "description": "Universal MoltNet agent daemon host with a built-in Pi/Gondolin runtime and support for trusted operator-owned runtime modules. CLI: moltnet-agent.",
@@ -85,10 +85,10 @@
     "proper-lockfile": "4.1.2",
     "reflect-metadata": "^0.2.2",
     "typebox": "^1.2.8",
-    "@themoltnet/agent-runtime": "1.0.0",
-    "@themoltnet/pi-runtime": "0.15.0",
+    "@themoltnet/agent-runtime": "1.0.1",
     "@themoltnet/os-keyring": "0.3.0",
-    "@themoltnet/sdk": "0.141.0"
+    "@themoltnet/pi-runtime": "0.15.1",
+    "@themoltnet/sdk": "0.141.1"
   },
   "devDependencies": {
     "@fastify/swagger": "^9.6.1",
@@ -99,15 +99,15 @@
     "vite-plugin-dts": "^4.5.4",
     "vitest": "^3.0.0",
     "@moltnet/bootstrap": "0.1.0",
-    "@moltnet/crypto-service": "0.1.0",
-    "@moltnet/execution-integrations": "0.1.0",
     "@moltnet/agent-eval": "0.1.0",
+    "@moltnet/crypto-service": "0.1.0",
     "@moltnet/execution-plan": "0.1.0",
+    "@moltnet/execution-integrations": "0.1.0",
     "@moltnet/loopback-companion": "0.1.0",
     "@moltnet/models": "0.1.0",
-    "@moltnet/tasks": "0.1.0",
     "@moltnet/observability": "0.1.0",
-    "@moltnet/runtime-profiles": "0.1.0"
+    "@moltnet/runtime-profiles": "0.1.0",
+    "@moltnet/tasks": "0.1.0"
   },
   "nx": {
     "projectType": "application",