@themoltnet/agent-daemon 0.56.0 → 0.56.2

package/dist/cli.js

@@ -773,6 +773,7 @@ var CREDENTIAL_SCOPES = {
 	TaskExecute: "task:execute",
 	TaskManage: "task:manage",
 	TaskRead: "task:read",
+	TaskWrite: "task:write",
 	TeamManage: "team:manage",
 	TeamRead: "team:read"
 };
@@ -795,6 +796,8 @@ var AGENT_CREDENTIAL_SCOPES = [
 	CREDENTIAL_SCOPES.TaskClaim,
 	CREDENTIAL_SCOPES.TaskExecute
 ];
+CREDENTIAL_SCOPES.AgentProfile, CREDENTIAL_SCOPES.TaskRead, CREDENTIAL_SCOPES.TaskWrite;
+CREDENTIAL_SCOPES.AgentProfile, CREDENTIAL_SCOPES.DiaryRead, CREDENTIAL_SCOPES.PackRead, CREDENTIAL_SCOPES.RuntimeRead, CREDENTIAL_SCOPES.TaskRead, CREDENTIAL_SCOPES.TeamRead;
 Object.freeze(ALL_CREDENTIAL_SCOPES.filter((scope) => scope !== CREDENTIAL_SCOPES.HumanProfile));
 /**
 * REST capabilities exercised by the current MCP tool surface.
@@ -815,6 +818,7 @@ var MCP_CLIENT_SCOPES = [
 	CREDENTIAL_SCOPES.TaskExecute,
 	CREDENTIAL_SCOPES.TaskManage,
 	CREDENTIAL_SCOPES.TaskRead,
+	CREDENTIAL_SCOPES.TaskWrite,
 	CREDENTIAL_SCOPES.TeamManage,
 	CREDENTIAL_SCOPES.TeamRead
 ];
@@ -1003,6 +1007,12 @@ var FingerprintSchema = Type.String({
 	pattern: "^[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}$",
 	description: "Key fingerprint (A1B2-C3D4-E5F6-G7H8)"
 });
+var AgentAliasSchema = Type.String({
+	pattern: "^[A-Za-z0-9][A-Za-z0-9._-]{0,62}$",
+	minLength: 1,
+	maxLength: 63,
+	description: "Case-preserving network alias; self-asserted, not unique, never used for authorization or lookup"
+});
 Type.Object({
 	title: Type.Optional(Type.String({ maxLength: 255 })),
 	content: Type.String({
@@ -1207,6 +1217,7 @@ var TeamMemberSchema = Type.Object({
 	subjectType: Type.Union([Type.Literal("agent"), Type.Literal("human")]),
 	role: TeamRoleSchema,
 	displayName: Type.String(),
+	alias: Type.Optional(AgentAliasSchema),
 	fingerprint: Type.Optional(Type.String()),
 	email: Type.Optional(Type.String())
 });
@@ -4271,7 +4282,7 @@ function createExecutionPlanCache(args) {
 			const existing = cache.get(key);
 			if (existing) return existing;
 			const plan = await maybeAttachWarmSlotContext(claimedTask, buildDaemonTaskExecutionPlan(claimedTask.task, args.stateDirs, args.slotIdentity, args.warmSessionTtlSec, args.workspacePolicy, claimedTask.attemptN), args.stateDirs, args.slotRegistry, runtimeSessionStore, sourceAttemptResolver);
-			assertPlanAllowedByWorkspacePolicy(plan, args.workspacePolicy);
+			assertPlanAllowedByWorkspacePolicy(plan, args.workspacePolicy, args.slotIdentity.runtimeProfileId);
 			cache.set(key, plan);
 			return plan;
 		},
@@ -4301,13 +4312,14 @@ function createNullRuntimeSessionStore() {
 		async uploadAttemptFinal() {}
 	};
 }
-function assertPlanAllowedByWorkspacePolicy(plan, policy) {
+function assertPlanAllowedByWorkspacePolicy(plan, policy, runtimeProfileId) {
 	const allowed = new Set(policy?.allowedWorkspaceModes && policy.allowedWorkspaceModes.length > 0 ? policy.allowedWorkspaceModes : [
 		"none",
 		"shared_mount",
 		"dedicated_worktree"
 	]);
 	const effectiveMode = planToRuntimeProfileWorkspaceMode(plan);
+	if (plan.workspaceRevision && effectiveMode !== "dedicated_worktree") throw new Error(`Runtime profile "${runtimeProfileId}" does not allow "dedicated_worktree", required by a revision-pinned task (resolved workspace mode "${effectiveMode}")`);
 	if (!allowed.has(effectiveMode)) throw new Error(`Runtime profile forbids final workspace mode "${effectiveMode}" for this task`);
 }
 function planToRuntimeProfileWorkspaceMode(plan) {
@@ -9538,7 +9550,7 @@ function assertIdentityMatches(current, expected, currentLabel, expectedLabel) {
 	if (!assessment.ok) throw new AgentServerIdentityError("verification_failed", `${currentLabel} ${assessment.label} does not match ${expectedLabel}`);
 }
 function verificationError(message, cause) {
-	return new AgentServerIdentityError("verification_failed", message, { cause });
+	return new AgentServerIdentityError("verification_failed", cause instanceof AuthenticationError ? cause.message : message, { cause });
 }
 /** Non-secret projection preserving the existing `/v1` response shape. */
 function publicAgentView(store, activation) {
@@ -11852,7 +11864,7 @@ async function writeCache(cache) {
 }
 //#endregion
 //#region src/version.ts
-var DAEMON_VERSION = "0.56.0";
+var DAEMON_VERSION = "0.56.2";
 //#endregion
 //#region src/cli.ts
 async function runAgentDaemonCli(options) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/agent-daemon",
-  "version": "0.56.0",
+  "version": "0.56.2",
   "license": "AGPL-3.0-only",
   "type": "module",
   "description": "Universal MoltNet agent daemon host with a built-in Pi/Gondolin runtime and support for trusted operator-owned runtime modules. CLI: moltnet-agent.",
@@ -85,10 +85,10 @@
     "proper-lockfile": "4.1.2",
     "reflect-metadata": "^0.2.2",
     "typebox": "^1.2.8",
-    "@themoltnet/agent-runtime": "1.0.1",
-    "@themoltnet/sdk": "0.141.1",
+    "@themoltnet/agent-runtime": "1.0.2",
     "@themoltnet/os-keyring": "0.3.0",
-    "@themoltnet/pi-runtime": "0.15.1"
+    "@themoltnet/pi-runtime": "0.15.2",
+    "@themoltnet/sdk": "0.141.1"
   },
   "devDependencies": {
     "@fastify/swagger": "^9.6.1",
@@ -99,14 +99,14 @@
     "vite-plugin-dts": "^4.5.4",
     "vitest": "^3.0.0",
     "@moltnet/agent-eval": "0.1.0",
+    "@moltnet/bootstrap": "0.1.0",
     "@moltnet/crypto-service": "0.1.0",
     "@moltnet/execution-integrations": "0.1.0",
-    "@moltnet/execution-plan": "0.1.0",
-    "@moltnet/loopback-companion": "0.1.0",
-    "@moltnet/bootstrap": "0.1.0",
     "@moltnet/models": "0.1.0",
+    "@moltnet/loopback-companion": "0.1.0",
     "@moltnet/observability": "0.1.0",
     "@moltnet/runtime-profiles": "0.1.0",
+    "@moltnet/execution-plan": "0.1.0",
     "@moltnet/tasks": "0.1.0"
   },
   "nx": {