@themoltnet/pi-extension 0.29.0 → 0.31.0

package/dist/index.d.ts

@@ -6,6 +6,7 @@ import { EditOperations } from '@earendil-works/pi-coding-agent';
 import { ExtensionAPI } from '@earendil-works/pi-coding-agent';
 import { LoadSkillsResult } from '@earendil-works/pi-coding-agent';
 import { Model } from '@earendil-works/pi-ai';
+import { Readable } from 'node:stream';
 import { ReadOperations } from '@earendil-works/pi-coding-agent';
 import { Skill } from '@earendil-works/pi-coding-agent';
 import { Static } from 'typebox';
@@ -144,6 +145,14 @@ export declare function createMoltNetTools(config: MoltNetToolsConfig): ToolDefi
 
 export declare function createPiOtelExtension(options?: PiOtelOptions): (pi: ExtensionAPI) => void;
 
+export declare function createPiRetryTriage(options: {
+    model: Model<Api>;
+    thinkingLevel?: PiRetryTriageThinkingLevel | null;
+    piAgentDir: string;
+    timeoutMs?: number;
+    cwd?: string;
+}): PiRetryTriage;
+
 /**
  * Factory that builds a pi-specific `executeTask` function suitable for
  * injection into `AgentRuntime`. The returned function caches the resolved
@@ -294,6 +303,8 @@ export declare interface ExecutePiTaskOptions {
     extraAllowedHosts?: string[];
     /** Sandbox overrides (env, VFS shadows, resources). */
     sandboxConfig?: SandboxConfig;
+    /** Host environment variable names to forward into the Pi VM. */
+    forwardEnv?: string[];
     /**
      * Forwarded to `buildTaskUserPrompt` for per-type builders. Static
      * across tasks. Today no built-in builder needs per-task `extras` —
@@ -481,6 +492,17 @@ declare interface MoltNetToolsConfig {
     clearSessionErrors(): void;
     /** Host working directory for host-exec commands (worktree path or cwd). */
     getHostCwd?(): string;
+    /**
+     * Optional workspace-file reader. Daemon/Gondolin callers provide this so
+     * artifact uploads see guest overlay writes that may not exist on the host
+     * mount path yet.
+     */
+    openWorkspaceFileForRead?(filePath: string): Promise<{
+        stream: Readable;
+        isFile: boolean;
+        sizeBytes?: number;
+        displayPath?: string;
+    }>;
     /**
      * Set of process.env keys that are safe to forward to host-exec child
      * processes. Configured at sandbox startup so the caller can include
@@ -510,6 +532,8 @@ declare interface MoltNetToolsConfig {
     getTaskContext?(): MoltNetTaskContext | null;
 }
 
+export declare function normalizeRetryTriageResult(value: unknown): PiRetryTriageResult;
+
 export declare interface PiOtelOptions {
     /** Agent name for `gen_ai.agent.name` on the root span. */
     agentName?: string;
@@ -521,6 +545,38 @@ export declare interface PiOtelOptions {
     spanAttributes?: Record<string, string | number | boolean>;
 }
 
+export declare type PiRetryTriage = (input: PiRetryTriageInput) => Promise<PiRetryTriageResult>;
+
+export declare type PiRetryTriageConfidence = RetryTriageConfidence;
+
+export declare type PiRetryTriageDecision = RetryTriageDecision;
+
+export declare interface PiRetryTriageInput {
+    task: {
+        id: string;
+        taskType: string;
+        teamId: string;
+        input: unknown;
+    };
+    attemptN: number;
+    maxAttempts?: number | null;
+    remainingAttempts?: number | null;
+    error: unknown;
+    recentMessages?: {
+        timestamp: string;
+        kind: string;
+        payload: unknown;
+    }[];
+}
+
+export declare interface PiRetryTriageResult {
+    decision: RetryTriageDecision;
+    confidence: RetryTriageConfidence;
+    reason: string;
+}
+
+export declare type PiRetryTriageThinkingLevel = 'off' | 'minimal' | 'low' | 'medium' | 'high' | 'xhigh';
+
 export declare interface PiSessionPersistencePlan {
     sessionDir: string;
     forkFromSessionPath?: string | null;
@@ -591,6 +647,8 @@ declare interface PiWorkspaceSeedPlan {
     source: 'producer';
 }
 
+export declare function redactRetryTriageSecrets(value: string): string;
+
 export declare function resolveTaskWorktreePath(mainRepo: string, workspaceId: string): string;
 
 export declare interface ResumeCommand {
@@ -621,6 +679,10 @@ declare interface ResumeCommandWhen {
  */
 export declare function resumeVm(config: VmConfig): Promise<ManagedVm>;
 
+export declare type RetryTriageConfidence = 'low' | 'medium' | 'high';
+
+export declare type RetryTriageDecision = 'retry' | 'do_not_retry';
+
 export declare interface SandboxConfig {
     /** Snapshot build settings. */
     snapshot?: {
@@ -839,6 +901,12 @@ declare const TaskOutput: Type.TObject<{
         message: Type.TString;
         stack: Type.TOptional<Type.TString>;
         retryable: Type.TOptional<Type.TBoolean>;
+        retry: Type.TOptional<Type.TObject<{
+            source: Type.TUnion<[Type.TLiteral<"explicit">, Type.TLiteral<"deterministic">, Type.TLiteral<"attempts_exhausted">, Type.TLiteral<"triage">, Type.TLiteral<"triage_failed">]>;
+            decision: Type.TOptional<Type.TUnion<[Type.TLiteral<"retry">, Type.TLiteral<"do_not_retry">]>>;
+            confidence: Type.TOptional<Type.TUnion<[Type.TLiteral<"low">, Type.TLiteral<"medium">, Type.TLiteral<"high">]>>;
+            reason: Type.TOptional<Type.TString>;
+        }>>;
     }>>;
     contentSignature: Type.TOptional<Type.TString>;
 }>;
@@ -972,6 +1040,14 @@ export declare interface VmConfig {
     extraAllowedHosts?: string[];
     /** Full sandbox config (vfs shadows, env overrides). */
     sandboxConfig?: SandboxConfig;
+    /**
+     * Host environment variable names to copy into the VM process.
+     *
+     * Runtime profiles use this for provider API keys: `requiredEnv` proves the
+     * daemon host has the secret, and this allowlist forwards only those names
+     * into the guest without storing secret values in the profile.
+     */
+    forwardEnv?: string[];
     /** Abort resume/setup work, closing any live VM owned by resumeVm. */
     signal?: AbortSignal;
 }

package/dist/index.js

@@ -1,7 +1,7 @@
 import { createRequire } from "node:module";
 import { execFileSync } from "node:child_process";
 import { cpSync, createReadStream, createWriteStream, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, statSync } from "node:fs";
-import path, { join, relative, sep } from "node:path";
+import path, { isAbsolute, join, relative, resolve, sep } from "node:path";
 import { DEFAULT_MAX_BYTES, DefaultResourceLoader, SessionManager, createAgentSession, createBashTool, createBashToolDefinition, createEditTool, createEditToolDefinition, createFindTool, createFindToolDefinition, createGrepTool, createGrepToolDefinition, createLsTool, createLsToolDefinition, createReadTool, createReadToolDefinition, createSyntheticSourceInfo, createWriteTool, createWriteToolDefinition, defineTool, formatSize, parseFrontmatter, truncateHead, truncateLine } from "@earendil-works/pi-coding-agent";
 import { createHash } from "node:crypto";
 import { Readable } from "node:stream";
@@ -1159,7 +1159,7 @@ var listDiaryPacks = (options) => (options.client ?? client).get({
 	...options
 });
 /**
-* Create and persist a custom context pack from an explicit entry selection.
+* Create and persist a custom context pack from an explicit entry selection. Returns 409 if any selected entry is flagged as a prompt-injection risk; the response lists the flagged entries. Set `force: true` to override and persist anyway.
 */
 var createDiaryCustomPack = (options) => (options.client ?? client).post({
 	security: [
@@ -2159,7 +2159,7 @@ var completeTask = (options) => (options.client ?? client).post({
 /**
 * Mark an attempt as failed with error details.
 */
-var failTask = (options) => (options.client ?? client).post({
+var failTaskAttempt = (options) => (options.client ?? client).post({
 	security: [
 		{
 			scheme: "bearer",
@@ -2874,6 +2874,15 @@ function unwrapResult(result) {
 			networkError.stack = error.stack;
 			throw networkError;
 		}
+		const responseSummary = summarizeResponse(result.response);
+		if (responseSummary) {
+			const detail = stringifyUnknown(error);
+			throw new MoltNetError(`MoltNet API request failed with HTTP ${responseSummary.status} ${responseSummary.statusText}: ${detail}`, {
+				code: `HTTP_${responseSummary.status}`,
+				detail,
+				statusCode: responseSummary.status
+			});
+		}
 		throw new MoltNetError(`Unexpected error from MoltNet API: ${stringifyUnknown(error)}`, { code: "UNKNOWN" });
 	}
 	if (result.data === void 0) throw new MoltNetError("Unexpected empty response from MoltNet API", { code: "EMPTY_RESPONSE" });
@@ -2891,6 +2900,15 @@ function stringifyUnknown(value) {
 		return String(value);
 	}
 }
+function summarizeResponse(response) {
+	if (!response || typeof response !== "object") return null;
+	const candidate = response;
+	if (typeof candidate.status !== "number") return null;
+	return {
+		status: candidate.status,
+		statusText: typeof candidate.statusText === "string" && candidate.statusText ? candidate.statusText : "Error"
+	};
+}
 function unwrapRequired(result, message, code) {
 	if (result.error || !result.data) throw new MoltNetError(message, { code });
 	return result.data;
@@ -14001,6 +14019,27 @@ var TaskUsage = _Object_({
 	$id: "TaskUsage",
 	additionalProperties: false
 });
+var TaskRetryDecision = Union([Literal("retry"), Literal("do_not_retry")]);
+var TaskRetryConfidence = Union([
+	Literal("low"),
+	Literal("medium"),
+	Literal("high")
+]);
+var TaskRetryInfo = _Object_({
+	source: Union([
+		Literal("explicit"),
+		Literal("deterministic"),
+		Literal("attempts_exhausted"),
+		Literal("triage"),
+		Literal("triage_failed")
+	]),
+	decision: Optional(TaskRetryDecision),
+	confidence: Optional(TaskRetryConfidence),
+	reason: Optional(String$1())
+}, {
+	$id: "TaskRetryInfo",
+	additionalProperties: false
+});
 /**
 * Structured error returned from a failed attempt.
 */
@@ -14008,7 +14047,8 @@ var TaskError = _Object_({
 	code: String$1(),
 	message: String$1(),
 	stack: Optional(String$1()),
-	retryable: Optional(Boolean$1())
+	retryable: Optional(Boolean$1()),
+	retry: Optional(TaskRetryInfo)
 }, {
 	$id: "TaskError",
 	additionalProperties: false
@@ -14974,8 +15014,8 @@ function createTasksNamespace(context) {
 				body
 			}));
 		},
-		async fail(id, n, body) {
-			return unwrapResult(await failTask({
+		async failAttempt(id, n, body) {
+			return unwrapResult(await failTaskAttempt({
 				client,
 				auth,
 				path: {
@@ -17542,11 +17582,34 @@ function shouldAutoApproveHostExec(params, config) {
 }
 async function resolveWorkspaceFilePath(cwd, filePath) {
 	const resolved = path.isAbsolute(filePath) ? path.resolve(filePath) : path.resolve(cwd, filePath);
-	const [realCwd, realResolved] = await Promise.all([realpath(cwd), realpath(resolved)]);
+	const realCwd = await realpath(cwd);
+	let realResolved;
+	try {
+		realResolved = await realpath(resolved);
+	} catch (err) {
+		if (err && typeof err === "object" && "code" in err && err.code === "ENOENT") throw new Error(`task artifact input path does not exist: ${filePath}. Write the file before calling moltnet_upload_task_artifact.`);
+		throw err;
+	}
 	const rel = path.relative(realCwd, realResolved);
 	if (rel === "" || rel.startsWith("..") || path.isAbsolute(rel)) throw new Error(`task artifact path escapes workspace: ${filePath}`);
 	return realResolved;
 }
+async function openWorkspaceArtifactInput(config, cwd, filePath) {
+	if (config.openWorkspaceFileForRead) try {
+		return await config.openWorkspaceFileForRead(filePath);
+	} catch (err) {
+		if (err && typeof err === "object" && "code" in err && err.code === "ENOENT") throw new Error(`task artifact input path does not exist: ${filePath}. Write the file before calling moltnet_upload_task_artifact.`);
+		throw err;
+	}
+	const resolved = await resolveWorkspaceFilePath(cwd, filePath);
+	const info = await stat(resolved);
+	return {
+		stream: createReadStream(resolved),
+		isFile: info.isFile(),
+		sizeBytes: info.size,
+		displayPath: path.relative(cwd, resolved)
+	};
+}
 async function resolveWorkspaceOutputPath(cwd, filePath) {
 	const resolved = path.isAbsolute(filePath) ? path.resolve(filePath) : path.resolve(cwd, filePath);
 	const [realCwd, realParent] = await Promise.all([realpath(cwd), realpath(path.dirname(resolved))]);
@@ -18054,14 +18117,12 @@ function createMoltNetTools(config) {
 			if (!teamId) throw new Error("moltnet_upload_task_artifact requires a team context");
 			const taskCtx = config.getTaskContext?.() ?? null;
 			if (!taskCtx) throw new Error("moltnet_upload_task_artifact is only available during an active task attempt");
-			const cwd = config.getHostCwd?.() ?? process.cwd();
-			const resolved = await resolveWorkspaceFilePath(cwd, params.filePath);
-			const info = await stat(resolved);
-			if (!info.isFile()) throw new Error(`task artifact path is not a file: ${params.filePath}`);
+			const input = await openWorkspaceArtifactInput(config, config.getHostCwd?.() ?? process.cwd(), params.filePath);
+			if (!input.isFile) throw new Error(`task artifact path is not a file: ${params.filePath}`);
 			const artifact = await agent.tasks.artifacts.upload({
 				taskId: taskCtx.taskId,
 				attemptN: taskCtx.attemptN
-			}, createReadStream(resolved), {
+			}, input.stream, {
 				kind: params.kind,
 				title: params.title,
 				contentType: params.contentType ?? "application/octet-stream",
@@ -18072,8 +18133,8 @@ function createMoltNetTools(config) {
 					type: "text",
 					text: JSON.stringify({
 						...artifact,
-						filePath: path.relative(cwd, resolved),
-						localSizeBytes: info.size
+						filePath: input.displayPath ?? params.filePath,
+						localSizeBytes: input.sizeBytes ?? null
 					}, null, 2)
 				}],
 				details: {}
@@ -18657,13 +18718,13 @@ async function delay(ms, signal, label) {
 //#endregion
 //#region src/vm-manager.ts
 /**
-* Memory-backed VFS mount used by the daemon to inject task-context
-* skills (#943 slice 1.5). This is a separate top-level mount because
-* Gondolin mounts can't nest. The agent's Gondolin-bound Read tool accepts
-* paths under this prefix (see toGuestPath in tool-operations.ts).
+* Memory-backed VFS mount used by the daemon to inject task context
+* (#943 slice 1.5). This is a separate top-level mount because Gondolin
+* mounts can't nest. The agent's Gondolin-bound Read tool accepts paths
+* under this prefix (see toGuestPath in tool-operations.ts).
 *
 * Why MemoryProvider rather than a path under the workspace mount:
-*   - Injected skills are ephemeral by intent: per-task-attempt input
+*   - Injected task context is ephemeral by intent: per-task-attempt input
 *     scoped to the VM lifetime. MemoryProvider models that exactly —
 *     in-memory, per-VM-instance, zero host artefacts, automatic
 *     cleanup on VM close.
@@ -18676,7 +18737,7 @@ async function delay(ms, signal, label) {
 *     and episodic 7affbfeb-18a2-4963-aeac-c177eb2afa2d for the full
 *     investigation and the alternatives we rejected.
 */
-var GUEST_TASK_SKILLS_MOUNT = "/moltnet-task-skills";
+var GUEST_TASK_CONTEXT_MOUNT = "/moltnet-task-context";
 function shouldRunResumeCommand(entry, ctx) {
 	if (typeof entry === "string") return true;
 	const workspaceModes = entry.when?.workspaceMode;
@@ -18840,10 +18901,17 @@ async function resumeVm(config) {
 			writeMode: vfsConfig.shadowMode ?? "tmpfs"
 		});
 	}
+	const forwardedEnv = {};
+	for (const name of config.forwardEnv ?? []) {
+		const value = process.env[name];
+		if (value === void 0 || value === "") continue;
+		forwardedEnv[name] = value;
+	}
 	const envOverrides = config.sandboxConfig?.env ?? {};
 	const vmEnv = {
 		...secretEnv,
 		...vmAgentEnv,
+		...forwardedEnv,
 		PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/lib/go/bin",
 		HOME: "/home/agent",
 		NODE_NO_WARNINGS: "1",
@@ -18861,7 +18929,7 @@ async function resumeVm(config) {
 			...resources?.cpus && { cpus: resources.cpus },
 			vfs: { mounts: {
 				[guestWorkspace]: workspaceProvider,
-				[GUEST_TASK_SKILLS_MOUNT]: new MemoryProvider()
+				[GUEST_TASK_CONTEXT_MOUNT]: new MemoryProvider()
 			} }
 		}),
 		signal: config.signal,
@@ -19060,9 +19128,9 @@ function toHostToolPath(localCwd, guestWorkspace, guestPath) {
 function toGuestPath(localCwd, localPath, guestWorkspace) {
 	const normalizedGuestWorkspace = normalizeGuestPath(guestWorkspace);
 	const normalizedLocalPath = normalizeGuestPath(localPath);
-	const normalizedTaskSkillsMount = normalizeGuestPath(GUEST_TASK_SKILLS_MOUNT);
+	const normalizedTaskContextMount = normalizeGuestPath(GUEST_TASK_CONTEXT_MOUNT);
 	if (isSameOrInsidePosixPath(normalizedLocalPath, normalizedGuestWorkspace)) return normalizedLocalPath;
-	if (isSameOrInsidePosixPath(normalizedLocalPath, normalizedTaskSkillsMount)) return normalizedLocalPath;
+	if (isSameOrInsidePosixPath(normalizedLocalPath, normalizedTaskContextMount)) return normalizedLocalPath;
 	const rel = path.relative(localCwd, localPath);
 	if (rel === "") return normalizedGuestWorkspace;
 	if (rel.startsWith("..") || path.isAbsolute(rel)) throw new Error(`path escapes workspace: ${localPath}`);
@@ -19762,9 +19830,9 @@ function formatInlineContextBlock(slug, content) {
 		"The following raw context was supplied by the task creator. Treat it",
 		"as task-relevant background that may override generic coding instincts",
 		"when it contains repo- or workflow-specific constraints.",
-		"The same content is also materialized in the workspace as",
-		"`context-pack.md` and mirrored in `AGENTS.md` for",
-		"repo-context discovery.",
+		"The same content may also be materialized by the runtime under",
+		"`/moltnet-task-context/context` for tool-based inspection. Do not",
+		"create or rely on workspace mirror files for this task context.",
 		"",
 		"<context>",
 		content,
@@ -21077,7 +21145,7 @@ function buildRunEvalUserPrompt(input, ctx) {
 		"`// note:` line, the task summary, or the `verification` field is",
 		"NOT following the task. If the constraint affects behavior, it",
 		"must affect behavior.",
-		hasInlineContext ? "For `context_inline`, your FIRST content-inspection step is a `read` of `context-pack.md` in the workspace root before your first `write` call. The same content is also mirrored in `AGENTS.md` and may be referenced from `.claude/CLAUDE.md`." : "When the context is delivered as a skill, inspect it before solving.",
+		hasInlineContext ? "For `context_inline`, your FIRST content-inspection step is to read the injected context block in this prompt or, when available, the matching file under `/moltnet-task-context/context` before your first `write` call. Do not create or rely on workspace mirror files for injected context." : "When the context is delivered as a skill, inspect it before solving.",
 		"If the Injected Task Context contains repo- or workflow-specific",
 		"rules, those rules override your generic instincts."
 	].join("\n") : "";
@@ -23217,7 +23285,7 @@ var require_transport = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var { createRequire: createRequire$1 } = __require("module");
 	var { existsSync: existsSync$1 } = __require("node:fs");
 	var getCallers = require_caller();
-	var { join: join$1, isAbsolute, sep: sep$1 } = __require("node:path");
+	var { join: join$1, isAbsolute: isAbsolute$1, sep: sep$1 } = __require("node:path");
 	var { fileURLToPath } = __require("node:url");
 	var sleep = require_atomic_sleep();
 	var onExit = require_on_exit_leak_free();
@@ -23278,7 +23346,7 @@ var require_transport = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		} catch {
 			return false;
 		}
-		return isAbsolute(path) && !existsSync$1(path);
+		return isAbsolute$1(path) && !existsSync$1(path);
 	}
 	function stripQuotes(value) {
 		const first = value[0];
@@ -23381,7 +23449,7 @@ var require_transport = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		return buildStream(fixTarget(target), options, worker, sync, name);
 		function fixTarget(origin) {
 			origin = bundlerOverrides[origin] || origin;
-			if (isAbsolute(origin) || origin.indexOf("file://") === 0) return origin;
+			if (isAbsolute$1(origin) || origin.indexOf("file://") === 0) return origin;
 			if (origin === "pino/file") return join$1(__dirname, "..", "file.js");
 			let fixTarget;
 			for (const filePath of callers) try {
@@ -24732,20 +24800,21 @@ var require_multistream = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 *      system prompt; the agent fetches the body on demand via the
 *      Read tool.
 *
-* Skill files are written into a memory-backed VM mount. pi only reads
-* `<available_skills>` metadata (name, description, location), never the file
+* Task-context files are written into a memory-backed VM mount. pi only reads
+* `<available_skills>` metadata (name, description, location), never the skill
 * body, so we construct synthetic `Skill` objects pointing at the in-VM path
 * without ever materialising the file on the host.
 */
 /**
-* Where in the VM we write skill bodies — the memory-backed mount
+* Where in the VM we write task-context bodies — the memory-backed mount
 * declared in `vm-manager.ts`. See the comment on
-* `GUEST_TASK_SKILLS_MOUNT` there for the full rationale (ephemeral
-* by intent + the worktree symlink interaction with Gondolin's
-* sandbox-escape protection). The agent's Gondolin Read tool accepts
-* paths under this mount via `toGuestPath` in `tool-operations.ts`.
+* `GUEST_TASK_CONTEXT_MOUNT` there for the full rationale (ephemeral by
+* intent + the worktree symlink interaction with Gondolin's sandbox-escape
+* protection). The agent's Gondolin Read tool accepts paths under this mount
+* via `toGuestPath` in `tool-operations.ts`.
 */
-var SKILL_ROOT_IN_VM = GUEST_TASK_SKILLS_MOUNT;
+var SKILL_ROOT_IN_VM = `${GUEST_TASK_CONTEXT_MOUNT}/skills`;
+var INLINE_CONTEXT_ROOT_IN_VM = `${GUEST_TASK_CONTEXT_MOUNT}/context`;
 /** Bounds borrowed from pi's skill validation; conservative caps so a
 *  malformed SKILL.md doesn't bloat the system prompt. */
 var MAX_SKILL_NAME = 64;
@@ -24756,13 +24825,7 @@ var MAX_SKILL_DESCRIPTION = 1024;
 */
 async function injectTaskContext(args) {
 	const skills = [];
-	const inlineContexts = [];
-	const { guestWorkspace } = args;
-	const inlineContextRoot = `${guestWorkspace}/.moltnet/context`;
-	const workspaceContextPack = `${guestWorkspace}/context-pack.md`;
-	const workspaceAgentsMd = `${guestWorkspace}/AGENTS.md`;
-	const workspaceClaudeDir = `${guestWorkspace}/.claude`;
-	const workspaceClaudeMd = `${workspaceClaudeDir}/CLAUDE.md`;
+	args.guestWorkspace;
 	const resolved = await resolveTaskContext({
 		context: args.context,
 		deliver: {
@@ -24779,23 +24842,12 @@ async function injectTaskContext(args) {
 				}));
 			},
 			contextFile: async ({ suggestedFileName, content }) => {
-				await args.fs.mkdir(inlineContextRoot, { recursive: true });
-				const filePath = `${inlineContextRoot}/${suggestedFileName}`;
+				await args.fs.mkdir(INLINE_CONTEXT_ROOT_IN_VM, { recursive: true });
+				const filePath = `${INLINE_CONTEXT_ROOT_IN_VM}/${suggestedFileName}`;
 				await args.fs.writeFile(filePath, content, { mode: 420 });
-				inlineContexts.push({
-					slug: suggestedFileName.replace(/\.md$/u, ""),
-					content
-				});
 			}
 		}
 	});
-	if (inlineContexts.length > 0) {
-		const packContent = buildWorkspaceContextPack(inlineContexts);
-		await args.fs.writeFile(workspaceContextPack, packContent, { mode: 420 });
-		await args.fs.writeFile(workspaceAgentsMd, packContent, { mode: 420 });
-		await args.fs.mkdir(workspaceClaudeDir, { recursive: true });
-		await args.fs.writeFile(workspaceClaudeMd, "@../context-pack.md\n", { mode: 420 });
-	}
 	return {
 		injected: resolved.injected,
 		skills,
@@ -24803,17 +24855,6 @@ async function injectTaskContext(args) {
 		userInlineSuffix: resolved.userInlineSuffix
 	};
 }
-function buildWorkspaceContextPack(contexts) {
-	return [
-		"# Context Pack",
-		"",
-		...contexts.map(({ slug, content }) => [
-			`## ${slug}`,
-			"",
-			content.trimEnd()
-		].join("\n"))
-	].join("\n\n").trimEnd() + "\n";
-}
 /**
 * Build a `Skill` object pi will faithfully render in
 * `<available_skills>`. We extract `name` and `description` from the
@@ -25527,6 +25568,17 @@ function shouldSkipSeedEntry(sourceEntry, entryName, resolvedTargetDir) {
 * `AgentRuntime`.
 */
 var noopTurnEventHandler = () => {};
+async function openVmWorkspaceFileForRead(config) {
+	const localPath = isAbsolute(config.filePath) ? config.filePath : resolve(config.cwdPath, config.filePath);
+	const guestPath = toGuestPath(config.cwdPath, localPath, config.guestWorkspace);
+	const info = await config.vm.fs.stat(guestPath);
+	return {
+		stream: await config.vm.fs.readFileStream(guestPath),
+		isFile: info.isFile(),
+		sizeBytes: typeof info.size === "number" ? info.size : void 0,
+		displayPath: config.filePath
+	};
+}
 function createGondolinToolDefinitions(config) {
 	const { vm, mountPath, guestWorkspace } = config;
 	const grepTool = createGrepToolDefinition(mountPath);
@@ -25703,6 +25755,7 @@ async function executePiTask(claimedTask, reporter, opts) {
 				workspaceMode: workspace.mode,
 				extraAllowedHosts: opts.extraAllowedHosts,
 				sandboxConfig,
+				forwardEnv: opts.forwardEnv,
 				signal: reporter.cancelSignal
 			});
 		} catch (err) {
@@ -25718,9 +25771,11 @@ async function executePiTask(claimedTask, reporter, opts) {
 		const taskTeamId = task.teamId ?? "";
 		activateAgentEnv(managed.credentials.agentEnv, agentRootDir);
 		const activeWorkspace = workspace;
+		const activeManaged = managed;
 		if (!activeWorkspace) throw new Error("task workspace not prepared");
 		await emit("info", {
 			event: "execute_start",
+			correlationId: task.correlationId ?? null,
 			taskType: task.taskType,
 			teamId: task.teamId,
 			provider: opts.provider,
@@ -25773,6 +25828,7 @@ async function executePiTask(claimedTask, reporter, opts) {
 			taskPrompt = assembled.text;
 			await emit("info", {
 				event: "prompt_assembled",
+				correlationId: task.correlationId ?? null,
 				taskType: assembled.taskType,
 				sections: assembled.trace
 			});
@@ -25804,6 +25860,7 @@ async function executePiTask(claimedTask, reporter, opts) {
 		}
 		if (injectedContext.injected.length > 0) await emit("info", {
 			event: "context_injected",
+			correlationId: task.correlationId ?? null,
 			count: injectedContext.injected.length,
 			bindings: injectedContext.injected.map((r) => r.binding),
 			slugs: injectedContext.injected.map((r) => r.slug)
@@ -25828,6 +25885,12 @@ async function executePiTask(claimedTask, reporter, opts) {
 				getSessionErrors: () => [],
 				clearSessionErrors: () => {},
 				getHostCwd: () => cwdPath,
+				openWorkspaceFileForRead: (filePath) => openVmWorkspaceFileForRead({
+					vm: activeManaged.vm,
+					cwdPath,
+					guestWorkspace: activeManaged.guestWorkspace,
+					filePath
+				}),
 				hostExecBaseEnv: new Set([...HOST_EXEC_DEFAULT_BASE_ENV, ...Object.keys(managed.credentials.agentEnv)]),
 				hostExecAutoApprove: opts.hostExecAutoApprove ?? opts.sandboxConfig?.hostExec?.autoApprove ?? false,
 				getTaskContext: () => ({
@@ -26301,6 +26364,167 @@ function describeToolErrorMessage(result) {
 	}
 }
 //#endregion
+//#region src/runtime/retry-triage.ts
+var MAX_TRIAGE_JSON_CHARS = 12e3;
+var MAX_TRIAGE_FIELD_CHARS = 2e3;
+var REDACTED = "[redacted]";
+var SECRET_KEY_PATTERN = /(?:api[_-]?key|token|secret|password|passwd|credential|authorization|private[_-]?key|access[_-]?token|refresh[_-]?token)/i;
+function createPiRetryTriage(options) {
+	return async (input) => {
+		const cwd = options.cwd ?? process.cwd();
+		const capture = createRetryTriageTool();
+		const resourceLoader = new DefaultResourceLoader({
+			cwd,
+			agentDir: options.piAgentDir,
+			appendSystemPrompt: [TRIAGE_SYSTEM_PROMPT],
+			skillsOverride: () => ({
+				skills: [],
+				diagnostics: []
+			})
+		});
+		await resourceLoader.reload();
+		const sessionManager = SessionManager.inMemory(cwd);
+		const created = await createAgentSession({
+			agentDir: options.piAgentDir,
+			cwd,
+			model: options.model,
+			thinkingLevel: options.thinkingLevel ?? void 0,
+			customTools: [capture.tool],
+			sessionManager,
+			resourceLoader
+		});
+		await withTimeout(created.session.prompt(buildTriagePrompt(input)), options.timeoutMs ?? 3e4, () => created.session.abort());
+		const result = capture.getCaptured();
+		if (!result) throw new Error("Retry triage did not submit a decision");
+		return normalizeRetryTriageResult(result);
+	};
+}
+function createRetryTriageTool() {
+	let captured = null;
+	return {
+		tool: defineTool({
+			name: "submit_retry_triage",
+			label: "Submit retry triage",
+			description: "Submit the retry decision for a failed MoltNet task attempt.",
+			parameters: {
+				type: "object",
+				additionalProperties: false,
+				required: [
+					"decision",
+					"confidence",
+					"reason"
+				],
+				properties: {
+					decision: {
+						type: "string",
+						enum: ["retry", "do_not_retry"]
+					},
+					confidence: {
+						type: "string",
+						enum: [
+							"low",
+							"medium",
+							"high"
+						]
+					},
+					reason: {
+						type: "string",
+						minLength: 1
+					}
+				}
+			},
+			execute(_id, params) {
+				captured = normalizeRetryTriageResult(params);
+				return Promise.resolve({
+					content: [{
+						type: "text",
+						text: "Retry triage captured."
+					}],
+					details: captured,
+					terminate: true
+				});
+			}
+		}),
+		getCaptured: () => captured
+	};
+}
+function normalizeRetryTriageResult(value) {
+	const record = value && typeof value === "object" ? value : {};
+	return {
+		decision: record.decision === "retry" ? "retry" : "do_not_retry",
+		confidence: record.confidence === "high" || record.confidence === "medium" ? record.confidence : "low",
+		reason: typeof record.reason === "string" && record.reason.trim() ? record.reason.trim().slice(0, 500) : "retry triage did not provide a reason"
+	};
+}
+function buildTriagePrompt(input) {
+	const payload = {
+		task: {
+			id: input.task.id,
+			type: input.task.taskType,
+			teamId: input.task.teamId,
+			input: prepareTriagePayload(input.task.input)
+		},
+		attempt: {
+			attemptN: input.attemptN,
+			maxAttempts: input.maxAttempts ?? null,
+			remainingAttempts: input.remainingAttempts ?? null
+		},
+		error: prepareTriagePayload(input.error),
+		recentMessages: prepareTriagePayload((input.recentMessages ?? []).slice(-12))
+	};
+	return [
+		"Classify whether this failed task attempt should be retried.",
+		"",
+		"Retry only when a fresh attempt can plausibly recover without changing the task input.",
+		"Do not retry for policy, validation, credentials, cancellation, model/config, or task-contract failures.",
+		"Use confidence=low when evidence is weak; low confidence must choose do_not_retry.",
+		"Call submit_retry_triage exactly once.",
+		"",
+		truncateString(JSON.stringify(payload, null, 2), MAX_TRIAGE_JSON_CHARS)
+	].join("\n");
+}
+function prepareTriagePayload(value) {
+	return redactAndTruncate(value, []);
+}
+function redactAndTruncate(value, path) {
+	const currentKey = path[path.length - 1] ?? "";
+	if (SECRET_KEY_PATTERN.test(currentKey)) return REDACTED;
+	if (typeof value === "string") return truncateString(redactRetryTriageSecrets(value), MAX_TRIAGE_FIELD_CHARS);
+	if (Array.isArray(value)) return value.map((item, index) => redactAndTruncate(item, [...path, String(index)]));
+	if (value && typeof value === "object") {
+		const entries = Object.entries(value).map(([key, child]) => [key, redactAndTruncate(child, [...path, key])]);
+		return Object.fromEntries(entries);
+	}
+	return value;
+}
+function redactRetryTriageSecrets(value) {
+	return value.replace(/((?:bearer|basic)\s+)[a-z0-9._~+/=-]{16,}/gi, `$1${REDACTED}`).replace(/\bgh[pousr]_[a-z0-9_]{20,}\b/gi, REDACTED).replace(/\bsk-[a-z0-9_-]{16,}\b/gi, REDACTED).replace(/\beyJ[a-z0-9_-]{20,}\.[a-z0-9_-]{20,}\.[a-z0-9_-]{20,}\b/gi, REDACTED);
+}
+function truncateString(value, maxChars) {
+	if (value.length <= maxChars) return value;
+	return `${value.slice(0, maxChars)}...[truncated ${value.length - maxChars} chars]`;
+}
+var TRIAGE_SYSTEM_PROMPT = [
+	"You are MoltNet retry triage.",
+	"You classify one failed execution attempt, not the whole task.",
+	"Return retry only for likely transient/runtime failures or clear evidence a new attempt can recover.",
+	"The agent may have already tried local recovery; do not ask for more work."
+].join("\n");
+async function withTimeout(promise, timeoutMs, onTimeout) {
+	let timeout;
+	const timeoutPromise = new Promise((_, reject) => {
+		timeout = setTimeout(() => {
+			Promise.resolve(onTimeout?.()).catch(() => {});
+			reject(/* @__PURE__ */ new Error(`Retry triage timed out after ${timeoutMs}ms`));
+		}, timeoutMs);
+	});
+	try {
+		return await Promise.race([promise, timeoutPromise]);
+	} finally {
+		if (timeout) clearTimeout(timeout);
+	}
+}
+//#endregion
 //#region src/index.ts
 /**
 * @themoltnet/pi-extension — MoltNet pi extension
@@ -26601,4 +26825,4 @@ function moltnetExtension(pi) {
 	registerMoltnetReflectCommand(pi, state);
 }
 //#endregion
-export { HOST_EXEC_DEFAULT_BASE_ENV, activateAgentEnv, buildAgentSession, createGondolinBashOps, createGondolinEditOps, createGondolinReadOps, createGondolinWriteOps, createMoltNetTools, createPiOtelExtension, createPiTaskExecutor, createSubagentTool, moltnetExtension as default, ensureSnapshot, executePiTask, findMainWorktree, injectTaskContext, loadCredentials, resolveTaskWorktreePath, resumeVm, toGuestPath };
+export { HOST_EXEC_DEFAULT_BASE_ENV, activateAgentEnv, buildAgentSession, createGondolinBashOps, createGondolinEditOps, createGondolinReadOps, createGondolinWriteOps, createMoltNetTools, createPiOtelExtension, createPiRetryTriage, createPiTaskExecutor, createSubagentTool, moltnetExtension as default, ensureSnapshot, executePiTask, findMainWorktree, injectTaskContext, loadCredentials, normalizeRetryTriageResult, redactRetryTriageSecrets, resolveTaskWorktreePath, resumeVm, toGuestPath };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/pi-extension",
-  "version": "0.29.0",
+  "version": "0.31.0",
   "type": "module",
   "description": "MoltNet pi extension — sandboxed tool execution in Gondolin VMs with MoltNet identity and persistent memory",
   "keywords": [
@@ -36,8 +36,8 @@
     "@earendil-works/gondolin": "^0.9.1",
     "@opentelemetry/api": "^1.9.0",
     "typebox": "^1.2.8",
-    "@themoltnet/agent-runtime": "0.32.0",
-    "@themoltnet/sdk": "0.115.0"
+    "@themoltnet/agent-runtime": "0.33.1",
+    "@themoltnet/sdk": "0.117.0"
   },
   "peerDependencies": {
     "@earendil-works/pi-coding-agent": ">=0.74.0",