@themoltnet/pi-extension 0.1.0

package/dist/vm-manager.d.ts

@@ -0,0 +1,48 @@
+import type { VM } from '@earendil-works/gondolin';
+import type { SandboxConfig } from './snapshot.js';
+export interface VmConfig {
+    /** Absolute path to the qcow2 checkpoint. */
+    checkpointPath: string;
+    /** MoltNet agent name (used to resolve credentials). */
+    agentName: string;
+    /** Host directory to mount at /workspace in the VM. */
+    mountPath: string;
+    /** Additional hosts to allow in egress policy. */
+    extraAllowedHosts?: string[];
+    /** Full sandbox config (vfs shadows, env overrides). */
+    sandboxConfig?: SandboxConfig;
+}
+export interface VmCredentials {
+    moltnetJson: string;
+    agentEnvRaw: string;
+    piAuthJson: string;
+    agentEnv: Record<string, string | undefined>;
+    gitconfig: string | null;
+    sshPrivateKey: string | null;
+    sshPublicKey: string | null;
+    allowedSigners: string | null;
+}
+export interface ManagedVm {
+    vm: VM;
+    credentials: VmCredentials;
+    mountPath: string;
+    guestWorkspace: string;
+    agentDir: string;
+}
+/**
+ * Resolve the main worktree root (where .moltnet/ lives — it's untracked,
+ * only exists in the main worktree, not in git worktrees).
+ */
+export declare function findMainWorktree(): string;
+export declare function loadCredentials(agentDir: string): VmCredentials;
+/**
+ * Apply agent env vars to the host process, mirroring `moltnet start`.
+ * Resolves relative paths (e.g. GIT_CONFIG_GLOBAL) against the repo root.
+ */
+export declare function activateAgentEnv(agentEnv: Record<string, string | undefined>, repoRoot: string): void;
+/**
+ * Resume a VM from a checkpoint, inject credentials, configure egress +
+ * TLS. Returns the managed VM handle.
+ */
+export declare function resumeVm(config: VmConfig): Promise<ManagedVm>;
+//# sourceMappingURL=vm-manager.d.ts.map

package/dist/vm-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vm-manager.d.ts","sourceRoot":"","sources":["../src/vm-manager.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,0BAA0B,CAAC;AAWnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD,MAAM,WAAW,QAAQ;IACvB,6CAA6C;IAC7C,cAAc,EAAE,MAAM,CAAC;IACvB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,wDAAwD;IACxD,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,EAAE,CAAC;IACP,WAAW,EAAE,aAAa,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAWzC;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,aAAa,CA4C/D;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EAC5C,QAAQ,EAAE,MAAM,GACf,IAAI,CAYN;AAoBD;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,CA8InE"}

package/dist/vm-manager.js

@@ -0,0 +1,222 @@
+/**
+ * VM lifecycle manager: resume checkpoint, inject credentials, configure
+ * egress, fix TLS, and provide clean shutdown.
+ */
+import { execFileSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import path from 'node:path';
+import { parseEnv } from 'node:util';
+import { createHttpHooks, createShadowPathPredicate, RealFSProvider, ShadowProvider, VmCheckpoint, } from '@earendil-works/gondolin';
+const GUEST_WORKSPACE = '/workspace';
+/**
+ * Resolve the main worktree root (where .moltnet/ lives — it's untracked,
+ * only exists in the main worktree, not in git worktrees).
+ */
+export function findMainWorktree() {
+    const output = execFileSync('git', ['worktree', 'list', '--porcelain'], {
+        encoding: 'utf8',
+    });
+    for (const block of output.split('\n\n')) {
+        const lines = block.split('\n');
+        const wt = lines.find((l) => l.startsWith('worktree '));
+        if (wt && !lines.some((l) => l === 'bare'))
+            return wt.replace('worktree ', '');
+    }
+    throw new Error('Could not find main git worktree');
+}
+export function loadCredentials(agentDir) {
+    const moltnetJson = readFileSync(path.join(agentDir, 'moltnet.json'), 'utf8');
+    const agentEnvRaw = readFileSync(path.join(agentDir, 'env'), 'utf8');
+    const piAuthPath = path.join(process.env.HOME ?? '', '.pi', 'agent', 'auth.json');
+    if (!existsSync(piAuthPath)) {
+        throw new Error(`Pi OAuth credentials not found at ${piAuthPath}. Run: pi login`);
+    }
+    const piAuthJson = readFileSync(piAuthPath, 'utf8');
+    // Read gitconfig + SSH keys for VM-side git signing
+    const gitconfigPath = path.join(agentDir, 'gitconfig');
+    const gitconfig = existsSync(gitconfigPath)
+        ? readFileSync(gitconfigPath, 'utf8')
+        : null;
+    const sshDir = path.join(agentDir, 'ssh');
+    const sshPrivateKey = existsSync(path.join(sshDir, 'id_ed25519'))
+        ? readFileSync(path.join(sshDir, 'id_ed25519'), 'utf8')
+        : null;
+    const sshPublicKey = existsSync(path.join(sshDir, 'id_ed25519.pub'))
+        ? readFileSync(path.join(sshDir, 'id_ed25519.pub'), 'utf8')
+        : null;
+    const allowedSigners = existsSync(path.join(sshDir, 'allowed_signers'))
+        ? readFileSync(path.join(sshDir, 'allowed_signers'), 'utf8')
+        : null;
+    return {
+        moltnetJson,
+        agentEnvRaw,
+        piAuthJson,
+        agentEnv: parseEnv(agentEnvRaw),
+        gitconfig,
+        sshPrivateKey,
+        sshPublicKey,
+        allowedSigners,
+    };
+}
+/**
+ * Apply agent env vars to the host process, mirroring `moltnet start`.
+ * Resolves relative paths (e.g. GIT_CONFIG_GLOBAL) against the repo root.
+ */
+export function activateAgentEnv(agentEnv, repoRoot) {
+    for (const [k, v] of Object.entries(agentEnv)) {
+        if (v === undefined || v === null || v === '')
+            continue;
+        let resolved = v;
+        // Resolve relative GIT_CONFIG_GLOBAL against repo root (same as Go CLI)
+        if (k === 'GIT_CONFIG_GLOBAL' && !path.isAbsolute(v)) {
+            resolved = path.join(repoRoot, v);
+        }
+        process.env[k] = resolved;
+    }
+}
+const BASE_ALLOWED_HOSTS = [
+    'api.openai.com',
+    '*.openai.com',
+    'chat.openai.com',
+    'chatgpt.com',
+    '*.chatgpt.com',
+    'registry.npmjs.org',
+    'github.com',
+    '*.github.com',
+    '*.githubusercontent.com',
+    // Go module proxy + storage backend
+    'proxy.golang.org',
+    'sum.golang.org',
+    'golang.org',
+    'storage.googleapis.com',
+    '*.googlesource.com',
+];
+/**
+ * Resume a VM from a checkpoint, inject credentials, configure egress +
+ * TLS. Returns the managed VM handle.
+ */
+export async function resumeVm(config) {
+    const mainRepo = findMainWorktree();
+    const agentDir = path.join(mainRepo, '.moltnet', config.agentName);
+    if (!existsSync(agentDir)) {
+        throw new Error(`Agent directory not found: ${agentDir}. Run: moltnet register --name ${config.agentName}`);
+    }
+    const creds = loadCredentials(agentDir);
+    const moltnetConfig = JSON.parse(creds.moltnetJson);
+    const apiHost = new URL(moltnetConfig.endpoints.api).hostname;
+    const allowedHosts = [
+        ...BASE_ALLOWED_HOSTS,
+        apiHost,
+        ...(config.extraAllowedHosts ?? []),
+    ];
+    const { httpHooks, env: secretEnv } = createHttpHooks({ allowedHosts });
+    // Build VM-side agent env vars from credentials.
+    // GIT_CONFIG_GLOBAL must point to the VM-side path, not host-side.
+    const vmAgentEnv = {};
+    for (const [k, v] of Object.entries(creds.agentEnv)) {
+        if (v === undefined || v === '')
+            continue;
+        if (k === 'GIT_CONFIG_GLOBAL') {
+            // Remap to VM-side credentials path
+            vmAgentEnv[k] = `/home/agent/.moltnet/${config.agentName}/gitconfig`;
+        }
+        else if (k.endsWith('_PRIVATE_KEY_PATH')) {
+            // Remap key paths to VM-side
+            vmAgentEnv[k] =
+                `/home/agent/.moltnet/${config.agentName}/${path.basename(v)}`;
+        }
+        else {
+            vmAgentEnv[k] = v;
+        }
+    }
+    // Build workspace VFS provider (with optional shadows)
+    const vfsConfig = config.sandboxConfig?.vfs;
+    let workspaceProvider = new RealFSProvider(config.mountPath);
+    if (vfsConfig?.shadow?.length) {
+        const predicate = createShadowPathPredicate(vfsConfig.shadow);
+        workspaceProvider = new ShadowProvider(workspaceProvider, {
+            shouldShadow: predicate,
+            writeMode: vfsConfig.shadowMode ?? 'tmpfs',
+        });
+    }
+    // Merge env: defaults < sandbox config overrides
+    const envOverrides = config.sandboxConfig?.env ?? {};
+    const vmEnv = {
+        ...secretEnv,
+        ...vmAgentEnv,
+        PATH: '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/lib/go/bin',
+        HOME: '/home/agent',
+        NODE_NO_WARNINGS: '1',
+        NODE_EXTRA_CA_CERTS: '/etc/ssl/certs/ca-certificates.crt',
+        ...envOverrides,
+    };
+    const resources = config.sandboxConfig?.resources;
+    const cp = VmCheckpoint.load(config.checkpointPath);
+    const vm = await cp.resume({
+        httpHooks,
+        env: vmEnv,
+        ...(resources?.memory && { memory: resources.memory }),
+        ...(resources?.cpus && { cpus: resources.cpus }),
+        vfs: {
+            mounts: {
+                [GUEST_WORKSPACE]: workspaceProvider,
+            },
+        },
+    });
+    // Fix TLS: append Gondolin MITM CA to system trust store.
+    // Unofficial-builds Node ships its own OpenSSL which can't load
+    // NODE_EXTRA_CA_CERTS from /etc/gondolin/mitm/ca.crt (error 8000000D).
+    await vm.exec(`sh -c '
+    cp /etc/gondolin/mitm/ca.crt /usr/local/share/ca-certificates/gondolin-mitm.crt
+    update-ca-certificates 2>/dev/null
+    cat /etc/gondolin/mitm/ca.crt >> /etc/ssl/certs/ca-certificates.crt
+  '`);
+    // Inject credentials into VM-side agent directory structure:
+    //   /home/agent/.moltnet/<agentName>/{moltnet.json,env,gitconfig,ssh/}
+    // Mirrors host layout so legreffier skill and CLI work identically.
+    const vmAgentDir = `/home/agent/.moltnet/${config.agentName}`;
+    const vmSshDir = `${vmAgentDir}/ssh`;
+    await vm.exec(`mkdir -p ${vmAgentDir}/ssh /home/agent/.pi/agent`);
+    await vm.fs.writeFile('/home/agent/.pi/agent/auth.json', creds.piAuthJson, {
+        mode: 0o600,
+    });
+    await vm.fs.writeFile(`${vmAgentDir}/moltnet.json`, creds.moltnetJson, {
+        mode: 0o600,
+    });
+    await vm.fs.writeFile(`${vmAgentDir}/env`, creds.agentEnvRaw, {
+        mode: 0o600,
+    });
+    // Inject gitconfig with VM-side signing key path
+    if (creds.gitconfig) {
+        const vmSigningKey = `${vmSshDir}/id_ed25519`;
+        const vmGitconfig = creds.gitconfig.replace(/signingKey\s*=\s*.+/g, `signingKey = ${vmSigningKey}`);
+        await vm.fs.writeFile(`${vmAgentDir}/gitconfig`, vmGitconfig, {
+            mode: 0o644,
+        });
+    }
+    // Inject SSH keys for commit signing
+    if (creds.sshPrivateKey) {
+        await vm.fs.writeFile(`${vmSshDir}/id_ed25519`, creds.sshPrivateKey, {
+            mode: 0o600,
+        });
+    }
+    if (creds.sshPublicKey) {
+        await vm.fs.writeFile(`${vmSshDir}/id_ed25519.pub`, creds.sshPublicKey, {
+            mode: 0o644,
+        });
+    }
+    if (creds.allowedSigners) {
+        await vm.fs.writeFile(`${vmSshDir}/allowed_signers`, creds.allowedSigners, {
+            mode: 0o644,
+        });
+    }
+    await vm.exec('chown -R agent:agent /home/agent/.pi /home/agent/.moltnet');
+    return {
+        vm,
+        credentials: creds,
+        mountPath: config.mountPath,
+        guestWorkspace: GUEST_WORKSPACE,
+        agentDir,
+    };
+}
+//# sourceMappingURL=vm-manager.js.map

package/dist/vm-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vm-manager.js","sourceRoot":"","sources":["../src/vm-manager.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAGrC,OAAO,EACL,eAAe,EACf,yBAAyB,EACzB,cAAc,EACd,cAAc,EACd,YAAY,GACb,MAAM,0BAA0B,CAAC;AAElC,MAAM,eAAe,GAAG,YAAY,CAAC;AAoCrC;;;GAGG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE;QACtE,QAAQ,EAAE,MAAM;KACjB,CAAC,CAAC;IACH,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;QACxD,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC;YACxC,OAAO,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9E,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;IAErE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAC1B,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EACtB,KAAK,EACL,OAAO,EACP,WAAW,CACZ,CAAC;IACF,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,qCAAqC,UAAU,iBAAiB,CACjE,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAEpD,oDAAoD;IACpD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,UAAU,CAAC,aAAa,CAAC;QACzC,CAAC,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC;QACrC,CAAC,CAAC,IAAI,CAAC;IAET,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC1C,MAAM,aAAa,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAC/D,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QACvD,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAClE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC3D,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;QACrE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC5D,CAAC,CAAC,IAAI,CAAC;IAET,OAAO;QACL,WAAW;QACX,WAAW;QACX,UAAU;QACV,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC;QAC/B,SAAS;QACT,aAAa;QACb,YAAY;QACZ,cAAc;KACf,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAA4C,EAC5C,QAAgB;IAEhB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9C,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE;YAAE,SAAS;QAExD,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,wEAAwE;QACxE,IAAI,CAAC,KAAK,mBAAmB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACpC,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,MAAM,kBAAkB,GAAG;IACzB,gBAAgB;IAChB,cAAc;IACd,iBAAiB;IACjB,aAAa;IACb,eAAe;IACf,oBAAoB;IACpB,YAAY;IACZ,cAAc;IACd,yBAAyB;IACzB,oCAAoC;IACpC,kBAAkB;IAClB,gBAAgB;IAChB,YAAY;IACZ,wBAAwB;IACxB,oBAAoB;CACrB,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,MAAgB;IAC7C,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAEnE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,8BAA8B,QAAQ,kCAAkC,MAAM,CAAC,SAAS,EAAE,CAC3F,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IAE9D,MAAM,YAAY,GAAG;QACnB,GAAG,kBAAkB;QACrB,OAAO;QACP,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC;KACpC,CAAC;IAEF,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;IAExE,iDAAiD;IACjD,mEAAmE;IACnE,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE;YAAE,SAAS;QAC1C,IAAI,CAAC,KAAK,mBAAmB,EAAE,CAAC;YAC9B,oCAAoC;YACpC,UAAU,CAAC,CAAC,CAAC,GAAG,wBAAwB,MAAM,CAAC,SAAS,YAAY,CAAC;QACvE,CAAC;aAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC3C,6BAA6B;YAC7B,UAAU,CAAC,CAAC,CAAC;gBACX,wBAAwB,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAED,uDAAuD;IACvD,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC;IAC5C,IAAI,iBAAiB,GAAoC,IAAI,cAAc,CACzE,MAAM,CAAC,SAAS,CACjB,CAAC;IACF,IAAI,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,yBAAyB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC9D,iBAAiB,GAAG,IAAI,cAAc,CAAC,iBAAiB,EAAE;YACxD,YAAY,EAAE,SAAS;YACvB,SAAS,EAAE,SAAS,CAAC,UAAU,IAAI,OAAO;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,iDAAiD;IACjD,MAAM,YAAY,GAAG,MAAM,CAAC,aAAa,EAAE,GAAG,IAAI,EAAE,CAAC;IACrD,MAAM,KAAK,GAAG;QACZ,GAAG,SAAS;QACZ,GAAG,UAAU;QACb,IAAI,EAAE,8EAA8E;QACpF,IAAI,EAAE,aAAa;QACnB,gBAAgB,EAAE,GAAG;QACrB,mBAAmB,EAAE,oCAAoC;QACzD,GAAG,YAAY;KAChB,CAAC;IAEF,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC;IAClD,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACpD,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC;QACzB,SAAS;QACT,GAAG,EAAE,KAAK;QACV,GAAG,CAAC,SAAS,EAAE,MAAM,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;QACtD,GAAG,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC;QAChD,GAAG,EAAE;YACH,MAAM,EAAE;gBACN,CAAC,eAAe,CAAC,EAAE,iBAAiB;aACrC;SACF;KACF,CAAC,CAAC;IAEH,0DAA0D;IAC1D,gEAAgE;IAChE,uEAAuE;IACvE,MAAM,EAAE,CAAC,IAAI,CAAC;;;;IAIZ,CAAC,CAAC;IAEJ,6DAA6D;IAC7D,uEAAuE;IACvE,oEAAoE;IACpE,MAAM,UAAU,GAAG,wBAAwB,MAAM,CAAC,SAAS,EAAE,CAAC;IAC9D,MAAM,QAAQ,GAAG,GAAG,UAAU,MAAM,CAAC;IACrC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,UAAU,4BAA4B,CAAC,CAAC;IAElE,MAAM,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,iCAAiC,EAAE,KAAK,CAAC,UAAU,EAAE;QACzE,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IACH,MAAM,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,UAAU,eAAe,EAAE,KAAK,CAAC,WAAW,EAAE;QACrE,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IACH,MAAM,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,UAAU,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE;QAC5D,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IAEH,iDAAiD;IACjD,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,YAAY,GAAG,GAAG,QAAQ,aAAa,CAAC;QAC9C,MAAM,WAAW,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,CACzC,sBAAsB,EACtB,gBAAgB,YAAY,EAAE,CAC/B,CAAC;QACF,MAAM,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,UAAU,YAAY,EAAE,WAAW,EAAE;YAC5D,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;IACL,CAAC;IAED,qCAAqC;IACrC,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QACxB,MAAM,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,QAAQ,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE;YACnE,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,QAAQ,iBAAiB,EAAE,KAAK,CAAC,YAAY,EAAE;YACtE,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACzB,MAAM,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,QAAQ,kBAAkB,EAAE,KAAK,CAAC,cAAc,EAAE;YACzE,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;IACL,CAAC;IAED,MAAM,EAAE,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;IAE3E,OAAO;QACL,EAAE;QACF,WAAW,EAAE,KAAK;QAClB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,cAAc,EAAE,eAAe;QAC/B,QAAQ;KACT,CAAC;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,62 @@
+{
+  "name": "@themoltnet/pi-extension",
+  "version": "0.1.0",
+  "type": "module",
+  "description": "MoltNet pi extension — sandboxed tool execution in Gondolin VMs with MoltNet identity and persistent memory",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/getlarge/themoltnet.git",
+    "directory": "libs/pi-extension"
+  },
+  "homepage": "https://themolt.net",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "pi": {
+    "extensions": [
+      "./dist/index.js"
+    ]
+  },
+  "dependencies": {
+    "@earendil-works/gondolin": "^0.7.0",
+    "@themoltnet/sdk": "0.91.0"
+  },
+  "peerDependencies": {
+    "@mariozechner/pi-coding-agent": ">=0.67.0",
+    "@mariozechner/pi-ai": ">=0.67.0"
+  },
+  "peerDependenciesMeta": {
+    "@mariozechner/pi-coding-agent": {
+      "optional": false
+    },
+    "@mariozechner/pi-ai": {
+      "optional": false
+    }
+  },
+  "devDependencies": {
+    "@mariozechner/pi-coding-agent": "^0.67.68",
+    "@mariozechner/pi-ai": "^0.67.68",
+    "@types/node": "^20.11.0",
+    "typescript": "^5.3.3",
+    "vitest": "^3.0.0"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "build": "tsc -b",
+    "typecheck": "tsc -b --emitDeclarationOnly",
+    "test": "vitest run --passWithNoTests",
+    "lint": "eslint src/",
+    "check:pack": "tsx ../../tools/src/check-pack.ts --package ."
+  }
+}