@themoltnet/pi-extension 0.24.0 → 0.25.0

package/dist/index.d.ts

@@ -505,6 +505,12 @@ export declare interface PiTaskExecutionPlan {
      * worktree is required.
      */
     worktreeBranch: string | null;
+    /**
+     * Base ref a NEW `worktreeBranch` is cut from. Used by `fork` continuations
+     * to branch from the parent's tip instead of the default (main/HEAD). Ignored
+     * when `worktreeBranch` already exists.
+     */
+    worktreeBaseRef?: string | null;
     /**
      * Lifetime of the task workspace from the daemon's point of view.
      * `attempt` = disposable; `session` = keep stable for the reuse key.

package/dist/index.js

@@ -8824,8 +8824,7 @@ async function resumeVm(config) {
 			signal: config.signal
 		});
 		if (creds.gitconfig) {
-			const vmSigningKey = `${vmSshDir}/id_ed25519`;
-			const vmGitconfig = creds.gitconfig.replace(/signingKey\s*=\s*.+/g, `signingKey = ${vmSigningKey}`);
+			const vmGitconfig = rewriteGitconfigPaths(creds.gitconfig, vmSshDir, vmAgentDir);
 			await vm.fs.writeFile(`${vmAgentDir}/gitconfig`, vmGitconfig, {
 				mode: 420,
 				signal: config.signal
@@ -8848,17 +8847,6 @@ async function resumeVm(config) {
 			signal: config.signal
 		});
 		await vm.exec("chown -R agent:agent /home/agent/.pi /home/agent/.moltnet", { signal: config.signal });
-		const gitCredHelperPath = `${vmSshDir}/git-credential-moltnet`;
-		const credHelperScript = `#!/bin/sh
-echo "username=x-access-token"
-echo "password=$(moltnet github token --credentials ${vmSshDir}/moltnet.json)"
-`;
-		await vm.fs.writeFile(gitCredHelperPath, credHelperScript, {
-			mode: 493,
-			signal: config.signal
-		});
-		await vmRun(vm, "git credential helper", `git config --global credential.helper ${gitCredHelperPath} && \
-       git config --global url."https://github.com/".insteadOf "git@github.com:"`, config.signal);
 		return {
 			vm,
 			credentials: creds,
@@ -8877,6 +8865,30 @@ echo "password=$(moltnet github token --credentials ${vmSshDir}/moltnet.json)"
 	}
 }
 /**
+* Rewrite host-absolute paths inside an agent gitconfig to VM-local
+* equivalents before injecting it into the guest.
+*
+* Two rewrites:
+*   - `signingKey = <host path>`  → `<vmSshDir>/id_ed25519`
+*   - `... credential-helper --credentials <host moltnet.json>`
+*                                 → `<vmAgentDir>/moltnet.json`
+*
+* The credential-helper line is generated host-side by `moltnet github setup`
+* with a host-absolute `--credentials` path; inside the guest that path is
+* invalid, so it must point at the VM-side moltnet.json. The `insteadOf`
+* rewrite rule and every other line are workspace-independent and pass through
+* unchanged. A gitconfig without a credential helper is rewritten only for
+* `signingKey`.
+*
+* This is the single source of truth for git push auth in the guest: the
+* injected gitconfig carries the tokenless mint-on-demand helper, so the VM
+* no longer hand-rolls a credential-helper script or runs an imperative
+* `git config --global ... insteadOf` against the guest $HOME.
+*/
+function rewriteGitconfigPaths(gitconfig, vmSshDir, vmAgentDir) {
+	return gitconfig.replace(/signingKey\s*=\s*.+/g, `signingKey = ${vmSshDir}/id_ed25519`).replace(/(moltnet github credential-helper --credentials )\S+/g, `$1${vmAgentDir}/moltnet.json`);
+}
+/**
 * Rewrite host-absolute paths inside moltnet.json to VM-local equivalents.
 *
 * Fields rewritten:
@@ -13470,6 +13482,54 @@ function validateRubricWeights(rubric) {
 	return null;
 }
 //#endregion
+//#region ../tasks/src/runtime-models.ts
+/**
+* Runtime model catalog: a list of supported provider/model couples that
+* MoltNet daemons can target. Backed by the `runtime_models` table.
+*
+* Scope is intrinsic to the row:
+*   - `teamId == null`  => global entry (MoltNet-seeded, read-only to most callers)
+*   - `teamId != null`  => team-owned custom entry
+*
+* The REST API exposes a single shape regardless of scope; the team header
+* gates which rows are returned.
+*/
+var RuntimeModelProvider = String$1({
+	minLength: 1,
+	maxLength: 100,
+	pattern: "^[a-zA-Z0-9][a-zA-Z0-9._-]{0,99}$"
+});
+var RuntimeModelName = String$1({
+	minLength: 1,
+	maxLength: 200,
+	pattern: "^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,199}$"
+});
+var RuntimeModelCapabilities = Record(String$1({
+	minLength: 1,
+	maxLength: 64
+}), Union([
+	Boolean$1(),
+	Number$1(),
+	String$1({ maxLength: 256 })
+]));
+_Object_({
+	id: String$1({ format: "uuid" }),
+	teamId: Union([String$1({ format: "uuid" }), Null()]),
+	provider: RuntimeModelProvider,
+	model: RuntimeModelName,
+	displayName: Union([String$1({ maxLength: 200 }), Null()]),
+	description: Union([String$1({ maxLength: 4096 }), Null()]),
+	capabilities: RuntimeModelCapabilities,
+	isActive: Boolean$1(),
+	createdByAgentId: Union([String$1({ format: "uuid" }), Null()]),
+	createdByHumanId: Union([String$1({ format: "uuid" }), Null()]),
+	createdAt: String$1({ format: "date-time" }),
+	updatedAt: String$1({ format: "date-time" })
+}, {
+	$id: "RuntimeModel",
+	additionalProperties: false
+});
+//#endregion
 //#region ../tasks/src/runtime-profiles.ts
 var RuntimeProfileName = String$1({
 	minLength: 1,
@@ -14010,20 +14070,17 @@ var FreeformOutput = _Object_({
 *  3. `freeform.sourceAttemptNotCompleted` — named attempt is missing
 *     or not in `completed` state; warm continuation only makes sense
 *     once the parent has produced a terminal output.
-*  4. `freeform.forkModeNotImplemented` — `mode: 'fork'` is the wire
-*     surface for copy-on-write continuation tracked in #1293; v1
-*     rejects it server-side so daemons never have to branch.
-*  5. `freeform.executionWorkspaceNotInheritable` — caller set
+*  4. `freeform.executionWorkspaceNotInheritable` — caller set
 *     `execution.workspace` together with `continueFrom`. Workspace
 *     mode for a continuation is inherited from the parent slot
 *     (`maybeAttachWarmSlotContext` forces `dedicated_worktree` +
 *     the parent's worktreeBranch), so any caller-supplied override
 *     is silently dropped at the daemon plan stage. Reject explicitly
 *     so misconfiguration surfaces at create time.
-*  6. `freeform.sourceNotResumeEligible` — `daemonState` is null or
+*  5. `freeform.sourceNotResumeEligible` — `daemonState` is null or
 *     `slotResumableUntil` is null. Older completions (pre-#1287) and
 *     daemons that opt out fall here.
-*  7. `freeform.sourceResumeExpired` — `slotResumableUntil` is in the
+*  6. `freeform.sourceResumeExpired` — `slotResumableUntil` is in the
 *     past; the warm slot's TTL has elapsed and no daemon is
 *     guaranteed to still hold it.
 *
@@ -14044,11 +14101,6 @@ async function validateFreeformInputAsync(input, ctx) {
 		message: `Source task type '${source.taskType}' is not continuable; only freeform → freeform is supported in v1`,
 		code: "freeform.sourceTaskTypeNotSupported"
 	}];
-	if (cf.mode === "fork") return [{
-		field: "input/continueFrom/mode",
-		message: "fork mode not yet implemented; see https://github.com/getlarge/themoltnet/issues/1293",
-		code: "freeform.forkModeNotImplemented"
-	}];
 	if (input.execution?.workspace) return [{
 		field: "input/execution/workspace",
 		message: "execution.workspace is inherited from the parent slot when continueFrom is set; omit it",
@@ -23203,10 +23255,11 @@ function prepareTaskWorkspace(task, requestedMountPath, executionPlan) {
 	const relMount = relative(mainRepo, requestedMountPath);
 	const cwdPath = relMount === "" || relMount.startsWith("..") ? worktreeDir : join(worktreeDir, relMount);
 	const keepWorkspace = executionPlan?.workspaceScope === "session" && executionPlan.sessionKey !== null;
-	if (keepWorkspace) ensureReusableTaskWorktree(mainRepo, worktreeDir, branch);
+	const baseRefOverride = executionPlan?.worktreeBaseRef ?? null;
+	if (keepWorkspace) ensureReusableTaskWorktree(mainRepo, worktreeDir, branch, baseRefOverride);
 	else {
 		removeExistingTaskWorktree(mainRepo, worktreeDir);
-		addTaskWorktree(mainRepo, worktreeDir, branch);
+		addTaskWorktree(mainRepo, worktreeDir, branch, baseRefOverride);
 	}
 	return {
 		mountPath: mainRepo,
@@ -23231,14 +23284,15 @@ function resolveTaskWorktreePath(mainRepo, workspaceId) {
 function resolveTaskScratchPath(mainRepo, workspaceId) {
 	return join(mainRepo, ".moltnet", "d", "task-workspaces", workspaceId);
 }
-function ensureReusableTaskWorktree(mainRepo, worktreeDir, branch) {
+function ensureReusableTaskWorktree(mainRepo, worktreeDir, branch, baseRefOverride = null) {
 	if (isRegisteredWorktree(mainRepo, worktreeDir)) return;
 	if (existsSync(worktreeDir)) throw new Error(`Expected reusable worktree ${worktreeDir} to be git-managed, but it exists outside git worktree metadata.`);
-	addTaskWorktree(mainRepo, worktreeDir, branch);
+	addTaskWorktree(mainRepo, worktreeDir, branch, baseRefOverride);
 }
-function addTaskWorktree(mainRepo, worktreeDir, branch) {
-	const baseRef = resolveWorktreeBaseRef(mainRepo);
-	execFileSync("git", gitRefExists(mainRepo, `refs/heads/${branch}`) ? [
+function addTaskWorktree(mainRepo, worktreeDir, branch, baseRefOverride = null) {
+	const branchExists = gitRefExists(mainRepo, `refs/heads/${branch}`);
+	const baseRef = baseRefOverride ?? resolveWorktreeBaseRef(mainRepo);
+	execFileSync("git", branchExists ? [
 		"-C",
 		mainRepo,
 		"worktree",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/pi-extension",
-  "version": "0.24.0",
+  "version": "0.25.0",
   "type": "module",
   "description": "MoltNet pi extension — sandboxed tool execution in Gondolin VMs with MoltNet identity and persistent memory",
   "keywords": [
@@ -36,8 +36,8 @@
     "@earendil-works/gondolin": "^0.9.1",
     "@opentelemetry/api": "^1.9.0",
     "typebox": "^1.2.8",
-    "@themoltnet/agent-runtime": "0.25.0",
-    "@themoltnet/sdk": "0.108.0"
+    "@themoltnet/sdk": "0.108.0",
+    "@themoltnet/agent-runtime": "0.25.0"
   },
   "peerDependencies": {
     "@earendil-works/pi-coding-agent": ">=0.74.0",
@@ -53,7 +53,7 @@
   },
   "devDependencies": {
     "@earendil-works/pi-ai": "^0.74.0",
-    "@earendil-works/pi-coding-agent": "^0.74.0",
+    "@earendil-works/pi-coding-agent": "^0.79.4",
     "@opentelemetry/sdk-metrics": "^2.5.1",
     "@opentelemetry/sdk-trace-base": "^2.5.1",
     "@types/node": "^22.19.0",
@@ -61,8 +61,8 @@
     "vite": "^8.0.0",
     "vite-plugin-dts": "^4.5.4",
     "vitest": "^3.0.0",
-    "@moltnet/crypto-service": "0.1.0",
-    "@moltnet/tasks": "0.1.0"
+    "@moltnet/tasks": "0.1.0",
+    "@moltnet/crypto-service": "0.1.0"
   },
   "engines": {
     "node": ">=22"