@themoltnet/pi-extension 0.33.0 → 0.34.0

package/README.md

@@ -163,6 +163,10 @@ the base snapshot is used (Alpine + git + gh + MoltNet CLI + agent user).
       { "argsPrefix": ["pr", "create"], "executable": "gh" }
     ]
   },
+  "network": {
+    "allowedHosts": ["api.example.com", "*.services.example.com"],
+    "allowedInternalHosts": ["onboard-api.internal"]
+  },
   "resources": {
     "cpus": 2,
     "memory": "6G"
@@ -201,6 +205,38 @@ Controls what's installed on top of the base layer during snapshot build.
 | `allowedHosts`  | Extra hosts allowed during build (base hosts always included) |
 | `overlaySize`   | qcow2 overlay disk size (default `"3G"`)                      |
 
+### `network`
+
+Controls HTTP(S) egress while a VM is running. Both arrays accept exact
+hostnames such as `api.example.com` and leading wildcard patterns such as
+`*.example.com`. Do not include a URL scheme, port, or path.
+
+- `allowedHosts` grants ordinary hostname egress. Gondolin still rejects a
+  matching hostname if DNS resolves it to loopback, link-local, or a private IP
+  range. This protects public allowlist entries from DNS rebinding and SSRF.
+- `allowedInternalHosts` explicitly permits matching hostnames to resolve to
+  internal/private IP ranges. Gondolin automatically includes these entries in
+  its effective hostname allowlist, so they do not need to appear in both
+  arrays. Treat this as the stronger, security-sensitive permission.
+
+The base runtime hosts, MoltNet API host, and legacy `extraAllowedHosts` remain
+external-only. They are not implicitly allowed to resolve internally, and VM
+resume rejects an `allowedInternalHosts` pattern that overlaps one of those
+protected patterns. Use a distinct internal service hostname when private
+resolution is required.
+
+Runtime hosts are deliberately separate from `snapshot.allowedHosts`: build
+dependencies do not become task-time egress grants, and runtime services do not
+become snapshot build dependencies. Private destinations require an explicit
+`allowedInternalHosts` grant; unlisted internal and external hosts remain
+blocked.
+
+Profiles and repo-local `sandbox.json` use the same field. For profiles, treat
+this as a team-editable security boundary: forwarded environment values and
+other VM-accessible secrets can be sent to any granted host. An internal grant
+can additionally expose localhost services, cloud metadata, and private network
+infrastructure if the hostname is attacker-controlled.
+
 ### `resources`
 
 VM resource limits applied at runtime.

package/dist/index.d.ts

@@ -308,6 +308,12 @@ export declare interface ExecutePiTaskOptions {
     sandboxConfig?: SandboxConfig;
     /** Host environment variable names to forward into the Pi VM. */
     forwardEnv?: string[];
+    /**
+     * Runtime profile context defaults. Merged with task.input.context at
+     * execution time because the selected runtime profile is known only after
+     * claim. Task entries override profile entries with the same slug.
+     */
+    runtimeProfileContext?: readonly ContextRef[];
     /**
      * Forwarded to `buildTaskUserPrompt` for per-type builders. Static
      * across tasks. Today no built-in builder needs per-task `extras` —
@@ -480,14 +486,14 @@ export declare interface InjectedTaskContext {
 }
 
 /**
- * Resolve a task's `input.context[]` and inject the side effects pi
+ * Resolve effective runtime context and inject the side effects Pi
  * needs. Safe to call with an empty array — returns an inert result.
  */
 export declare function injectTaskContext(args: InjectTaskContextArgs): Promise<InjectedTaskContext>;
 
 export declare interface InjectTaskContextArgs {
     /** Empty array (the default for any non-eval task) is a no-op. */
-    context: TaskContext;
+    context: readonly ContextRef[];
     /** Guest filesystem handle. In production this is `managed.vm.fs`. */
     fs: VmFsForContext;
     /** Guest path where the active host workspace is mounted. */
@@ -760,6 +766,14 @@ export declare interface SandboxConfig {
         /** Overlay disk size (default '3G'). */
         overlaySize?: string;
     };
+    /** Runtime network egress policy. Separate from snapshot build access. */
+    network?: {
+        /** Additional host patterns allowed while the VM is running.
+         * Internal and private address resolution remains blocked. */
+        allowedHosts?: string[];
+        /** Host patterns explicitly allowed to resolve to internal/private IPs. */
+        allowedInternalHosts?: string[];
+    };
     /** Shell commands to run every VM resume, after platform setup
      *  (TLS, DNS, git safe.directory, tmpfs node_modules) and before
      *  the agent session starts. Use for per-session bootstrap that
@@ -881,7 +895,7 @@ declare const Task: Type.TObject<{
     inputCid: Type.TString;
     references: Type.TArray<Type.TObject<{
         taskId: Type.TUnion<[Type.TString, Type.TNull]>;
-        outputCid: Type.TString;
+        outputCid: Type.TOptional<Type.TString>;
         role: Type.TUnion<[Type.TLiteral<"judged_work">, Type.TLiteral<"reviewed_diff">, Type.TLiteral<"target_source">, Type.TLiteral<"context">]>;
         external: Type.TOptional<Type.TObject<{
             kind: Type.TUnion<[Type.TLiteral<"github_pr">, Type.TLiteral<"github_issue">, Type.TLiteral<"http_url">]>;
@@ -893,7 +907,7 @@ declare const Task: Type.TObject<{
         }>>;
         artifact: Type.TOptional<Type.TObject<{
             cid: Type.TString;
-            attemptN: Type.TInteger;
+            attemptN: Type.TOptional<Type.TInteger>;
             kind: Type.TOptional<Type.TString>;
             title: Type.TOptional<Type.TString>;
             contentType: Type.TOptional<Type.TString>;
@@ -922,15 +936,6 @@ declare const Task: Type.TObject<{
 
 declare type Task = Static<typeof Task>;
 
-/** Reusable input fragment for any task type. Soft cap at 5 items. */
-declare const TaskContext: Type.TArray<Type.TObject<{
-    slug: Type.TString;
-    binding: Type.TUnion<[Type.TLiteral<"skill">, Type.TLiteral<"context_inline">, Type.TLiteral<"prompt_prefix">, Type.TLiteral<"user_inline">]>;
-    content: Type.TString;
-}>>;
-
-declare type TaskContext = Static<typeof TaskContext>;
-
 declare const TaskMessage: Type.TObject<{
     taskId: Type.TString;
     attemptN: Type.TNumber;

package/dist/index.js

@@ -1965,7 +1965,34 @@ var findLatestRuntimeSlotForAttempt = (options) => (options.client ?? client).ge
 	...options
 });
 /**
-* Queue asynchronous deletion of terminal tasks in bulk. By default, live, unauthorized, missing, and protected tasks are skipped. Set force: true with a reason to delete protected terminal tasks.
+* Stage immutable content-addressed artifact bytes for later binding as task input artifacts via task creation references. Creates no metadata row; staged bytes are not downloadable until bound to a task, and unbound objects are garbage-collected after a grace window.
+*/
+var stageTaskArtifact = (options) => (options.client ?? client).put({
+	bodySerializer: null,
+	security: [
+		{
+			scheme: "bearer",
+			type: "http"
+		},
+		{
+			name: "X-Moltnet-Session-Token",
+			type: "apiKey"
+		},
+		{
+			in: "cookie",
+			name: "ory_kratos_session",
+			type: "apiKey"
+		}
+	],
+	url: "/task-artifacts/staged",
+	...options,
+	headers: {
+		"Content-Type": "application/octet-stream",
+		...options.headers
+	}
+});
+/**
+* Queue asynchronous deletion of waiting, queued, and terminal tasks in bulk. By default, dispatched, running, unauthorized, missing, and protected tasks are skipped. Set force: true with a reason to delete protected terminal tasks.
 */
 var batchDeleteTasks = (options) => (options.client ?? client).delete({
 	security: [
@@ -9671,6 +9698,11 @@ var RuntimeProfileSandboxResumeCommand = Union([String$1({
 		maximum: 6e4
 	}))
 }, { additionalProperties: false })]);
+var RuntimeProfileAllowedHost = String$1({
+	minLength: 1,
+	maxLength: 255,
+	pattern: "^(?:\\*\\.)?(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)(?:\\.(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?))*$"
+});
 var RuntimeProfileSandbox = _Object_({
 	snapshot: Optional(_Object_({
 		setupCommands: Optional(_Array_(String$1({
@@ -9687,6 +9719,10 @@ var RuntimeProfileSandbox = _Object_({
 			pattern: "^[0-9]+[KMGTP]?$"
 		}))
 	}, { additionalProperties: false })),
+	network: Optional(_Object_({
+		allowedHosts: Optional(_Array_(RuntimeProfileAllowedHost, { maxItems: 50 })),
+		allowedInternalHosts: Optional(_Array_(RuntimeProfileAllowedHost, { maxItems: 50 }))
+	}, { additionalProperties: false })),
 	resumeCommands: Optional(_Array_(RuntimeProfileSandboxResumeCommand, { maxItems: 30 })),
 	vfs: Optional(_Object_({
 		shadow: Optional(_Array_(String$1({
@@ -10030,7 +10066,7 @@ _Object_({
 * (server-side schema check). Self-assessment is a truthful self-rating,
 * NOT enforcement — `verification.passed=false` does not block /complete
 * and does not affect `acceptedAttemptN`. See
-* `docs/understand/agent-runtime.md` for the full producer/judge flow.
+* `docs/use/tasks-and-runtime.md` for the full producer/judge flow.
 *
 * **Binding evaluation** (judgment tasks: `assess_brief`, `judge_pack`).
 * A separate task whose IS the application of `successCriteria` to
@@ -10146,7 +10182,7 @@ _Object_({
 		id: String$1({ format: "uuid" }),
 		teamId: String$1({ format: "uuid" }),
 		taskId: String$1({ format: "uuid" }),
-		attemptN: Integer({ minimum: 1 }),
+		attemptN: Union([Integer({ minimum: 1 }), Null()]),
 		kind: String$1({
 			minLength: 1,
 			maxLength: 100
@@ -10168,7 +10204,7 @@ _Object_({
 			minLength: 1,
 			maxLength: 100
 		}),
-		createdByAgentId: String$1({ format: "uuid" }),
+		createdByAgentId: Union([String$1({ format: "uuid" }), Null()]),
 		expiresAt: Union([String$1({ format: "date-time" }), Null()]),
 		createdAt: String$1({ format: "date-time" })
 	}, { $id: "TaskArtifact" })),
@@ -10184,6 +10220,16 @@ _Object_({
 	$id: "ListTaskArtifactsQuery",
 	additionalProperties: false
 });
+var HeaderSafeContentType = String$1({
+	minLength: 1,
+	maxLength: 200,
+	pattern: "^[\\x21-\\x7e][\\x20-\\x7e]*$"
+});
+var HeaderSafeContentEncoding = String$1({
+	minLength: 1,
+	maxLength: 100,
+	pattern: "^[\\x21-\\x7e][\\x20-\\x7e]*$"
+});
 _Object_({
 	kind: String$1({
 		minLength: 1,
@@ -10193,14 +10239,8 @@ _Object_({
 		minLength: 1,
 		maxLength: 255
 	}),
-	contentType: Optional(String$1({
-		minLength: 1,
-		maxLength: 200
-	})),
-	contentEncoding: Optional(String$1({
-		minLength: 1,
-		maxLength: 100
-	}))
+	contentType: Optional(HeaderSafeContentType),
+	contentEncoding: Optional(HeaderSafeContentEncoding)
 }, {
 	$id: "UploadTaskArtifactQuery",
 	additionalProperties: false
@@ -10232,6 +10272,34 @@ _Object_({
 	$id: "TaskArtifactContentParams",
 	additionalProperties: false
 });
+_Object_({
+	contentType: Optional(HeaderSafeContentType),
+	contentEncoding: Optional(HeaderSafeContentEncoding)
+}, {
+	$id: "StageTaskArtifactQuery",
+	additionalProperties: false
+});
+_Object_({
+	cid: String$1({
+		minLength: 1,
+		maxLength: 100
+	}),
+	sizeBytes: Integer({ minimum: 0 }),
+	contentType: String$1({
+		minLength: 1,
+		maxLength: 200
+	})
+}, { $id: "StagedTaskArtifact" });
+_Object_({
+	taskId: String$1({ format: "uuid" }),
+	cid: String$1({
+		minLength: 1,
+		maxLength: 100
+	})
+}, {
+	$id: "TaskArtifactTaskContentParams",
+	additionalProperties: false
+});
 //#endregion
 //#region ../../node_modules/.pnpm/multiformats@13.4.2/node_modules/multiformats/dist/src/codecs/json.js
 var textEncoder$2 = new TextEncoder();
@@ -13847,6 +13915,42 @@ function validateTaskCreateRequest(args) {
 		field: "references",
 		message: `At least one reference is required for task type: ${args.taskType}`
 	});
+	errors.push(...validateTaskReferences(args.references));
+	return errors;
+}
+/**
+* Cross-field rules for the reference shapes the schema alone cannot
+* express. Every reference must be exactly one of:
+*
+* - **task output ref**: taskId set, outputCid required; an optional
+*   artifact must name its producing attempt (attemptN).
+* - **input artifact ref**: taskId null, artifact without attemptN;
+*   outputCid omitted (or equal to artifact.cid when sent) -- the bytes
+*   were staged before any task existed, so there is no output to name.
+* - **external ref**: taskId null, external present, no artifact.
+*
+* Anything else used to be silently persisted into taskRefs and never
+* materialized; now it fails fast with a field error.
+*/
+function validateTaskReferences(references) {
+	const errors = [];
+	(references ?? []).forEach((ref, index) => {
+		const invalid = (message) => errors.push({
+			field: `references[${index}]`,
+			message
+		});
+		if (ref.taskId !== null) {
+			if (ref.outputCid === void 0) invalid("outputCid is required when referencing a task output");
+			if (ref.artifact && ref.artifact.attemptN === void 0) invalid("artifact references to another task must include attemptN; input artifacts are referenced with taskId null");
+			return;
+		}
+		if (ref.artifact) {
+			if (ref.artifact.attemptN !== void 0) invalid("input artifact references (taskId null) must not include attemptN; reference the producing task by id instead");
+			if (ref.outputCid !== void 0 && ref.outputCid !== ref.artifact.cid) invalid("outputCid on an input artifact reference must be omitted or equal artifact.cid");
+			return;
+		}
+		if (!ref.external) invalid("references with taskId null must carry either an artifact (input artifact) or an external descriptor");
+	});
 	return errors;
 }
 //#endregion
@@ -13963,7 +14067,7 @@ Unsafe(Cyclic({ ClaimCondition: Unsafe(Union([
 */
 var TaskRef = _Object_({
 	taskId: Union([Uuid, Null()]),
-	outputCid: Cid,
+	outputCid: Optional(Cid),
 	role: Union([
 		Literal("judged_work"),
 		Literal("reviewed_diff"),
@@ -13984,7 +14088,7 @@ var TaskRef = _Object_({
 	})),
 	artifact: Optional(_Object_({
 		cid: Cid,
-		attemptN: Integer({ minimum: 1 }),
+		attemptN: Optional(Integer({ minimum: 1 })),
 		kind: Optional(String$1({
 			minLength: 1,
 			maxLength: 100
@@ -14454,30 +14558,53 @@ var TaskBuilder = class {
 		return this;
 	}
 	/**
-	* Add a reference to a persistent task artifact while retaining the accepted
-	* output CID as the provenance anchor.
+	* Add either a staged input artifact or a persistent attempt artifact.
+	* Staged metadata returned by `tasks.artifacts.stage()` carries
+	* `artifactSource: 'staged'` and produces a reference with `taskId: null`, no
+	* `outputCid`, and no `attemptN`. Persistent artifacts require the producing
+	* task, accepted output CID, artifact CID, and positive attempt number so
+	* their provenance remains explicit.
 	*
-	* @param source - A result reader, raw artifact reference, or `TaskRef`.
+	* @param source - Staged SDK metadata, a result reader, raw artifact reference, or `TaskRef`.
 	* @param role - The role the referenced artifact plays.
 	* @returns This builder, for chaining.
-	* @throws {TaskBuildError} when output or artifact CID is missing.
+	* @throws {TaskBuildError} when the source is ambiguous or required provenance is missing.
 	*/
 	artifactReference(source, role) {
 		let ref;
 		if ("artifactRef" in source && typeof source.artifactRef === "function") ref = source.artifactRef(role);
-		else if ("artifact" in source && source.artifact?.cid) {
-			if (typeof source.artifact.attemptN !== "number" || !Number.isInteger(source.artifact.attemptN) || source.artifact.attemptN < 1) throw new TaskBuildError([{
-				field: "references/artifact/attemptN",
-				message: "artifact reference is missing required attemptN"
-			}]);
-			ref = {
-				...source,
-				role
-			};
-		} else {
+		else if ("artifactSource" in source && source.artifactSource === "staged" && source.cid) ref = {
+			taskId: null,
+			role,
+			artifact: {
+				cid: source.cid,
+				...source.kind ? { kind: source.kind } : {},
+				...source.title ? { title: source.title } : {},
+				...source.contentType ? { contentType: source.contentType } : {}
+			}
+		};
+		else if ("cid" in source) throw new TaskBuildError([{
+			field: "references/artifactSource",
+			message: "top-level artifact CID is ambiguous; use metadata returned by tasks.artifacts.stage()"
+		}]);
+		else if ("artifact" in source && source.artifact?.cid) if (source.taskId === null && source.artifact.attemptN === void 0) ref = {
+			taskId: null,
+			role,
+			artifact: { ...source.artifact }
+		};
+		else if (typeof source.artifact.attemptN !== "number" || !Number.isInteger(source.artifact.attemptN) || source.artifact.attemptN < 1) throw new TaskBuildError([{
+			field: "references/artifact/attemptN",
+			message: "artifact reference is missing required attemptN"
+		}]);
+		else ref = {
+			...source,
+			role
+		};
+		else {
 			const s = source;
 			const errors = [];
-			if (!s.outputCid) errors.push({
+			const inputArtifact = s.taskId === null && s.attemptN === void 0;
+			if (!inputArtifact && !s.outputCid) errors.push({
 				field: "references/outputCid",
 				message: "reference is missing required outputCid"
 			});
@@ -14485,19 +14612,18 @@ var TaskBuilder = class {
 				field: "references/artifact/cid",
 				message: "artifact reference is missing required cid"
 			});
-			if (typeof s.attemptN !== "number" || !Number.isInteger(s.attemptN) || s.attemptN < 1) errors.push({
+			if (!inputArtifact && (typeof s.attemptN !== "number" || !Number.isInteger(s.attemptN) || s.attemptN < 1)) errors.push({
 				field: "references/artifact/attemptN",
 				message: "artifact reference is missing required attemptN"
 			});
 			if (errors.length > 0) throw new TaskBuildError(errors);
-			const attemptN = s.attemptN;
 			ref = {
 				taskId: s.taskId ?? null,
-				outputCid: s.outputCid,
+				...!inputArtifact && s.outputCid ? { outputCid: s.outputCid } : {},
 				role,
 				artifact: {
 					cid: s.artifactCid,
-					attemptN,
+					...s.attemptN !== void 0 ? { attemptN: s.attemptN } : {},
 					...s.kind ? { kind: s.kind } : {},
 					...s.title ? { title: s.title } : {},
 					...s.contentType ? { contentType: s.contentType } : {}
@@ -14967,6 +15093,22 @@ function createTasksNamespace(context) {
 			}));
 		},
 		artifacts: {
+			async stage(body, query, options) {
+				return {
+					...unwrapResult(await stageTaskArtifact({
+						auth,
+						body,
+						client,
+						duplex: "half",
+						headers: {
+							...requiredTeamHeaders(options),
+							"content-type": "application/octet-stream"
+						},
+						query
+					})),
+					artifactSource: "staged"
+				};
+			},
 			async upload(path, body, query, options) {
 				return unwrapResult(await uploadTaskArtifact({
 					auth,
@@ -15000,17 +15142,24 @@ function createTasksNamespace(context) {
 				}));
 			},
 			async download(path, options) {
-				const result = await client.request({
+				const request = {
 					auth,
 					headers: requiredTeamHeaders(options),
 					method: "GET",
 					parseAs: "stream",
-					path,
 					security: [{
 						scheme: "bearer",
 						type: "http"
-					}],
+					}]
+				};
+				const result = "attemptN" in path ? await client.request({
+					...request,
+					path,
 					url: "/tasks/{taskId}/attempts/{attemptN}/artifacts/{cid}/content"
+				}) : await client.request({
+					...request,
+					path,
+					url: "/tasks/{taskId}/artifacts/{cid}/content"
 				});
 				const normalizedStream = normalizeDownloadStream(unwrapResult(result));
 				if (normalizedStream) return {
@@ -19010,6 +19159,39 @@ var BASE_ALLOWED_HOSTS = [
 	"*.googlesource.com"
 ];
 /**
+* Return whether two Gondolin hostname globs can match at least one common
+* string. Each `*` is an arbitrary substring, so this walks the product of the
+* two small glob automata instead of relying on exact-string comparisons.
+*/
+function hostnamePatternsOverlap(left, right) {
+	const a = left.trim().toLowerCase();
+	const b = right.trim().toLowerCase();
+	if (!a || !b) return false;
+	const pending = [[0, 0]];
+	const visited = /* @__PURE__ */ new Set();
+	while (pending.length > 0) {
+		const next = pending.pop();
+		if (!next) continue;
+		const [aIndex, bIndex] = next;
+		const state = `${aIndex}:${bIndex}`;
+		if (visited.has(state)) continue;
+		visited.add(state);
+		if (aIndex === a.length && bIndex === b.length) return true;
+		const aChar = a[aIndex];
+		const bChar = b[bIndex];
+		if (aChar === "*") pending.push([aIndex + 1, bIndex]);
+		if (bChar === "*") pending.push([aIndex, bIndex + 1]);
+		if (aChar !== void 0 && bChar !== void 0 && (aChar === "*" || bChar === "*" || aChar === bChar)) pending.push([aChar === "*" ? aIndex : aIndex + 1, bChar === "*" ? bIndex : bIndex + 1]);
+	}
+	return false;
+}
+function assertInternalHostsDoNotOverlapProtectedHosts(internalHosts, protectedHosts) {
+	for (const internalHost of internalHosts) {
+		const protectedHost = protectedHosts.find((candidate) => hostnamePatternsOverlap(internalHost, candidate));
+		if (protectedHost) throw new Error(`sandbox.network.allowedInternalHosts pattern "${internalHost}" overlaps external-only host pattern "${protectedHost}"`);
+	}
+}
+/**
 * Run a shell command in the guest and throw if it fails. Mirror of
 * `run()` in `snapshot.ts` for the resume-side hook chain — every
 * setup step is essential to a healthy session, so a silent non-zero
@@ -19051,11 +19233,18 @@ async function resumeVm(config) {
 	const creds = loadCredentials(agentDir);
 	const moltnetConfig = JSON.parse(creds.moltnetJson);
 	const apiHost = new URL(moltnetConfig.endpoints.api).hostname;
-	const { httpHooks, env: secretEnv } = createHttpHooks({ allowedHosts: [
+	const runtimeAllowedHosts = config.sandboxConfig?.network?.allowedHosts ?? [];
+	const runtimeAllowedInternalHosts = config.sandboxConfig?.network?.allowedInternalHosts ?? [];
+	const protectedExternalHosts = [...new Set([
 		...BASE_ALLOWED_HOSTS,
 		apiHost,
 		...config.extraAllowedHosts ?? []
-	] });
+	])];
+	assertInternalHostsDoNotOverlapProtectedHosts(runtimeAllowedInternalHosts, protectedExternalHosts);
+	const { httpHooks, env: secretEnv } = createHttpHooks({
+		allowedHosts: [...new Set([...protectedExternalHosts, ...runtimeAllowedHosts])],
+		allowedInternalHosts: runtimeAllowedInternalHosts
+	});
 	const vmAgentDir = `/home/agent/.moltnet/${config.agentName}`;
 	const vmAgentEnv = {};
 	for (const [k, v] of Object.entries(creds.agentEnv)) {
@@ -19937,8 +20126,19 @@ async function resolvePersistentSessionManager(args) {
 //#endregion
 //#region ../agent-runtime/src/context-bindings.ts
 var PROMPT_SEPARATOR = "\n\n---\n\n";
+var MAX_MERGED_RUNTIME_CONTEXT_ENTRIES = 10;
+/**
+* Merge runtime-profile context defaults with task-scoped context. Profile
+* entries are defaults; task entries with the same slug override them.
+*/
+function mergeRuntimeProfileContext(profileContext, taskContext) {
+	const taskSlugs = new Set(taskContext.map((ref) => ref.slug));
+	const merged = [...profileContext.filter((ref) => !taskSlugs.has(ref.slug)), ...taskContext];
+	if (merged.length > MAX_MERGED_RUNTIME_CONTEXT_ENTRIES) throw new Error(`merged runtime context has ${merged.length} entries; maximum is ${MAX_MERGED_RUNTIME_CONTEXT_ENTRIES}`);
+	return merged;
+}
 /**
-* Resolve `task.input.context[]` into delivered side-effects (skills
+* Resolve runtime context entries into delivered side-effects (skills
 * persisted via `deliver.skill`) and prompt fragments
 * (`systemPromptPrefix`, `userInlineSuffix`) the caller weaves into the
 * built prompt.
@@ -19958,9 +20158,10 @@ var PROMPT_SEPARATOR = "\n\n---\n\n";
 *   - `user_inline`   → content appended to `userInlineSuffix` in
 *                       declared order, same separator.
 *
-* No fetching, no hashing — bytes are inlined in `ContextRef.content`,
-* and the task's `inputCid` already pins the entire input. The proposer
-* chose these bytes; the resolver just dispatches them.
+* No fetching, no hashing — bytes are inlined in `ContextRef.content`.
+* Task-scoped entries are pinned by the task's `inputCid`; profile-scoped
+* entries are pinned by the runtime profile revision/source the daemon
+* resolved. The resolver just dispatches already-selected bytes.
 *
 * The function is pure with respect to its arguments: file writes are
 * confined to the injected `deliver` callback, which makes the
@@ -20006,12 +20207,13 @@ function formatInlineContextBlock(slug, content) {
 		"### Injected Task Context",
 		"",
 		`Context id: \`${slug}\``,
-		"The following raw context was supplied by the task creator. Treat it",
-		"as task-relevant background that may override generic coding instincts",
-		"when it contains repo- or workflow-specific constraints.",
+		"The following raw context was selected for this task by its task input",
+		"or runtime profile. Treat it as task-relevant background that may",
+		"override generic coding instincts when it contains repo- or",
+		"workflow-specific constraints.",
 		"The same content may also be materialized by the runtime under",
 		"`/moltnet-task-context/context` for tool-based inspection. Do not",
-		"create or rely on workspace mirror files for this task context.",
+		"create or rely on workspace mirror files for this runtime context.",
 		"",
 		"<context>",
 		content,
@@ -21334,11 +21536,11 @@ function buildRenderPackUserPrompt(input, ctx) {
 * `judge_eval_attempt` task(s) grade against their own hidden rubric.
 *
 * Context delivery is handled by `resolveTaskContext` (see
-* libs/agent-runtime/src/context-bindings.ts) and runs BEFORE this
-* prompt is rendered: `prompt_prefix` items are concatenated ahead of
-* the body, `skill` items are persisted at the runtime's skill path,
-* and `user_inline` items are appended to the first user message. This
-* builder does NOT inline `input.context[]` itself.
+* libs/agent-runtime/src/context-bindings.ts) and is selected BEFORE this
+* prompt is rendered. Task-scoped context lives in `input.context`; runtime
+* profile defaults arrive as `ctx.effectiveRuntimeContext` after the runtime
+* merges them with task context. This builder only renders context
+* discipline; it does NOT inline context bytes itself.
 *
 * Prompt-shape notes (issue #1175, area 1):
 * - No `Correlation` section: the agent never acts on it. The id is
@@ -21356,12 +21558,13 @@ function buildRenderPackUserPrompt(input, ctx) {
 */
 function buildRunEvalUserPrompt(input, ctx) {
 	const { scenario, variantLabel, successCriteria } = input;
-	const hasContext = input.context.length > 0;
-	const hasInlineContext = input.context.some((entry) => entry.binding === "context_inline");
+	const effectiveRuntimeContext = ctx.effectiveRuntimeContext ?? input.context;
+	const hasContext = effectiveRuntimeContext.length > 0;
+	const hasInlineContext = effectiveRuntimeContext.some((entry) => entry.binding === "context_inline");
 	const header = `# Run Eval Agent\n\nYou are running an evaluation scenario as variant \`${variantLabel}\`.\nTask id: \`${ctx.taskId}\``;
 	const contextDiscipline = hasContext ? [
 		"This task includes Injected Task Context supplied by the task",
-		"creator. You MUST inspect it BEFORE you write solution files or",
+		"input or runtime profile. You MUST inspect it BEFORE you write solution files or",
 		"draft your final answer — not after.",
 		"",
 		"Reconcile every constraint from that context **into the code path",
@@ -21534,7 +21737,8 @@ function buildTaskUserPrompt(task, ctx) {
 			return buildRunEvalUserPrompt(task.input, {
 				diaryId: ctx.diaryId,
 				taskId: ctx.taskId,
-				correlationId: task.correlationId
+				correlationId: task.correlationId,
+				effectiveRuntimeContext: ctx.effectiveRuntimeContext
 			});
 		default: throw new Error(`No prompt builder registered for taskType="${task.taskType}"`);
 	}
@@ -25007,119 +25211,6 @@ var require_multistream = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports.pino = pino;
 })))();
 //#endregion
-//#region src/runtime/inject-task-context.ts
-/**
-* Slice 1.5 of #943 — wire the agent-runtime resolver into the
-* pi-extension execution path.
-*
-* `resolveTaskContext` is a pure dispatcher; this module provides the
-* Gondolin-aware deliverer and the post-resolution shape the
-* `execute-pi-task` caller needs to splice into pi's setup:
-*
-*   - `systemPromptPrefix` → fed into `appendSystemPrompt` alongside
-*      the runtime instructor (it IS a system-prompt fragment).
-*   - `userInlineSuffix`   → appended to the `buildTaskUserPrompt`
-*      output BEFORE `session.prompt(text)`.
-*   - `skills`             → spliced into the `skillsOverride` callback's
-*      return value. pi includes them in `<available_skills>` in the
-*      system prompt; the agent fetches the body on demand via the
-*      Read tool.
-*
-* Task-context files are written into a memory-backed VM mount. pi only reads
-* `<available_skills>` metadata (name, description, location), never the skill
-* body, so we construct synthetic `Skill` objects pointing at the in-VM path
-* without ever materialising the file on the host.
-*/
-/**
-* Where in the VM we write task-context bodies — the memory-backed mount
-* declared in `vm-manager.ts`. See the comment on
-* `GUEST_TASK_CONTEXT_MOUNT` there for the full rationale (ephemeral by
-* intent + the worktree symlink interaction with Gondolin's sandbox-escape
-* protection). The agent's Gondolin Read tool accepts paths under this mount
-* via `toGuestPath` in `tool-operations.ts`.
-*/
-var SKILL_ROOT_IN_VM = `${GUEST_TASK_CONTEXT_MOUNT}/skills`;
-var INLINE_CONTEXT_ROOT_IN_VM = `${GUEST_TASK_CONTEXT_MOUNT}/context`;
-/** Bounds borrowed from pi's skill validation; conservative caps so a
-*  malformed SKILL.md doesn't bloat the system prompt. */
-var MAX_SKILL_NAME = 64;
-var MAX_SKILL_DESCRIPTION = 1024;
-/**
-* Resolve a task's `input.context[]` and inject the side effects pi
-* needs. Safe to call with an empty array — returns an inert result.
-*/
-async function injectTaskContext(args) {
-	const skills = [];
-	args.guestWorkspace;
-	const resolved = await resolveTaskContext({
-		context: args.context,
-		deliver: {
-			skill: async ({ slug, content }) => {
-				const dir = `${SKILL_ROOT_IN_VM}/${slug}`;
-				const filePath = `${dir}/SKILL.md`;
-				await args.fs.mkdir(dir, { recursive: true });
-				await args.fs.writeFile(filePath, content, { mode: 420 });
-				skills.push(buildSyntheticSkill({
-					slug,
-					content,
-					filePath,
-					dir
-				}));
-			},
-			contextFile: async ({ suggestedFileName, content }) => {
-				await args.fs.mkdir(INLINE_CONTEXT_ROOT_IN_VM, { recursive: true });
-				const filePath = `${INLINE_CONTEXT_ROOT_IN_VM}/${suggestedFileName}`;
-				await args.fs.writeFile(filePath, content, { mode: 420 });
-			}
-		}
-	});
-	return {
-		injected: resolved.injected,
-		skills,
-		systemPromptPrefix: resolved.systemPromptPrefix,
-		userInlineSuffix: resolved.userInlineSuffix
-	};
-}
-/**
-* Build a `Skill` object pi will faithfully render in
-* `<available_skills>`. We extract `name` and `description` from the
-* skill content's YAML frontmatter using pi's own `parseFrontmatter`
-* helper (proper YAML, not a regex hack) and fall back to the slug +
-* a generic description so a SKILL.md without frontmatter still
-* renders something meaningful.
-*
-* Frontmatter parsing is best-effort: a malformed YAML block is
-* optional metadata, not a reason to fail the task. We swallow parser
-* errors and fall back to the slug-derived metadata; the skill body
-* is unaffected.
-*
-* pi's `formatSkillsForPrompt` only reads `name`, `description`, and
-* `filePath` — `sourceInfo`/`baseDir` exist on the type but never
-* surface in the prompt, so a synthetic `SourceInfo` is enough.
-*/
-function buildSyntheticSkill(args) {
-	let fm = {};
-	try {
-		fm = parseFrontmatter(args.content).frontmatter;
-	} catch {}
-	return {
-		name: clip(typeof fm.name === "string" && fm.name.trim().length > 0 ? fm.name.trim() : args.slug, MAX_SKILL_NAME),
-		description: clip(typeof fm.description === "string" && fm.description.trim().length > 0 ? fm.description.trim() : `Task-injected context skill (${args.slug})`, MAX_SKILL_DESCRIPTION),
-		filePath: args.filePath,
-		baseDir: args.dir,
-		sourceInfo: createSyntheticSourceInfo(args.filePath, {
-			source: "moltnet:task-context",
-			scope: "temporary",
-			origin: "top-level",
-			baseDir: args.dir
-		}),
-		disableModelInvocation: fm["disable-model-invocation"] === true
-	};
-}
-function clip(s, max) {
-	return s.length > max ? s.slice(0, max) : s;
-}
-//#endregion
 //#region src/runtime/resolve-prior-context.ts
 /**
 * Fetch the named attempt's output and project it into the prompt's
@@ -25306,6 +25397,113 @@ async function withTimeout(promise, timeoutMs, onTimeout) {
 	}
 }
 //#endregion
+//#region src/runtime/runtime-context.ts
+/**
+* Pi-specific runtime context handling.
+*
+* `@themoltnet/agent-runtime` owns generic context semantics: merge profile
+* defaults with task context, resolve bindings, and produce prompt fragments.
+* This module owns the Pi/Gondolin boundary: validate effective context for an
+* attempt, write skill/context files into the VM, and build synthetic Pi Skill
+* metadata for injected skill bindings.
+*/
+/**
+* Where in the VM we write runtime-context bodies — the memory-backed mount
+* declared in `vm-manager.ts`. See the comment on
+* `GUEST_TASK_CONTEXT_MOUNT` there for the full rationale (ephemeral by
+* intent + the worktree symlink interaction with Gondolin's sandbox-escape
+* protection). The agent's Gondolin Read tool accepts paths under this mount
+* via `toGuestPath` in `tool-operations.ts`.
+*/
+var SKILL_ROOT_IN_VM = `${GUEST_TASK_CONTEXT_MOUNT}/skills`;
+var INLINE_CONTEXT_ROOT_IN_VM = `${GUEST_TASK_CONTEXT_MOUNT}/context`;
+/** Bounds borrowed from pi's skill validation; conservative caps so a
+*  malformed SKILL.md doesn't bloat the system prompt. */
+var MAX_SKILL_NAME = 64;
+var MAX_SKILL_DESCRIPTION = 1024;
+function resolveEffectiveRuntimeContext(args) {
+	const taskContext = args.rawTaskContext === void 0 ? [] : args.rawTaskContext;
+	if (!Check(TaskContext, taskContext)) throw new Error(`task.input.context failed TaskContext validation: ${JSON.stringify([...Errors(TaskContext, taskContext)].slice(0, 3))}`);
+	const profileContext = args.runtimeProfileContext ?? [];
+	if (!Check(TaskContext, profileContext)) throw new Error(`runtime profile context failed TaskContext validation: ${JSON.stringify([...Errors(TaskContext, profileContext)].slice(0, 3))}`);
+	return mergeRuntimeProfileContext(profileContext, taskContext);
+}
+/**
+* Resolve effective runtime context and inject the side effects Pi
+* needs. Safe to call with an empty array — returns an inert result.
+*/
+async function injectRuntimeContext(args) {
+	const skills = [];
+	args.guestWorkspace;
+	const resolved = await resolveTaskContext({
+		context: args.context,
+		deliver: {
+			skill: async ({ slug, content }) => {
+				const dir = `${SKILL_ROOT_IN_VM}/${slug}`;
+				const filePath = `${dir}/SKILL.md`;
+				await args.fs.mkdir(dir, { recursive: true });
+				await args.fs.writeFile(filePath, content, { mode: 420 });
+				skills.push(buildSyntheticSkill({
+					slug,
+					content,
+					filePath,
+					dir
+				}));
+			},
+			contextFile: async ({ suggestedFileName, content }) => {
+				await args.fs.mkdir(INLINE_CONTEXT_ROOT_IN_VM, { recursive: true });
+				const filePath = `${INLINE_CONTEXT_ROOT_IN_VM}/${suggestedFileName}`;
+				await args.fs.writeFile(filePath, content, { mode: 420 });
+			}
+		}
+	});
+	return {
+		injected: resolved.injected,
+		skills,
+		systemPromptPrefix: resolved.systemPromptPrefix,
+		userInlineSuffix: resolved.userInlineSuffix
+	};
+}
+/**
+* Build a `Skill` object pi will faithfully render in
+* `<available_skills>`. We extract `name` and `description` from the
+* skill content's YAML frontmatter using pi's own `parseFrontmatter`
+* helper (proper YAML, not a regex hack) and fall back to the slug +
+* a generic description so a SKILL.md without frontmatter still
+* renders something meaningful.
+*
+* Frontmatter parsing is best-effort: a malformed YAML block is
+* optional metadata, not a reason to fail the task. We swallow parser
+* errors and fall back to the slug-derived metadata; the skill body
+* is unaffected.
+*
+* pi's `formatSkillsForPrompt` only reads `name`, `description`, and
+* `filePath` — `sourceInfo`/`baseDir` exist on the type but never
+* surface in the prompt, so a synthetic `SourceInfo` is enough.
+*/
+function buildSyntheticSkill(args) {
+	let fm = {};
+	try {
+		fm = parseFrontmatter(args.content).frontmatter;
+	} catch {}
+	return {
+		name: clip(typeof fm.name === "string" && fm.name.trim().length > 0 ? fm.name.trim() : args.slug, MAX_SKILL_NAME),
+		description: clip(typeof fm.description === "string" && fm.description.trim().length > 0 ? fm.description.trim() : `Runtime-injected context skill (${args.slug})`, MAX_SKILL_DESCRIPTION),
+		filePath: args.filePath,
+		baseDir: args.dir,
+		sourceInfo: createSyntheticSourceInfo(args.filePath, {
+			source: "moltnet:runtime-context",
+			scope: "temporary",
+			origin: "top-level",
+			baseDir: args.dir
+		}),
+		disableModelInvocation: fm["disable-model-invocation"] === true
+	};
+}
+function clip(s, max) {
+	return s.length > max ? s.slice(0, max) : s;
+}
+//#endregion
 //#region src/runtime/subagent-tool.ts
 var SUBAGENT_SUBMIT_TOOL_NAME = "submit_subagent_output";
 var DEFAULT_SUBAGENT_SUBMIT_VALIDATION_RETRIES = 2;
@@ -25841,6 +26039,46 @@ function resolveSubmitTools(taskType, opts = {}) {
 	};
 }
 //#endregion
+//#region src/runtime/task-event-emitter.ts
+var LOG_TRUNCATE_LIMIT = 4 * 1024;
+async function emitTaskEvent(input) {
+	try {
+		input.onTurnEvent(input.kind, summarizePayloadForLog(input.kind, input.payload));
+	} catch (err) {
+		process.stderr.write(`[emit] onTurnEvent threw for kind="${input.kind}": ${err instanceof Error ? err.message : String(err)}\n`);
+	}
+	try {
+		await input.reporter.record({
+			kind: input.kind,
+			payload: input.payload
+		});
+	} catch (err) {
+		const detail = err instanceof Error ? err.message : String(err);
+		input.log(`executePiTask: reporter.record() failed for task ${input.taskId} attempt ${input.attemptN} kind="${input.kind}": ${detail}`);
+	}
+}
+function summarizePayloadForLog(kind, payload) {
+	switch (kind) {
+		case "text_delta": {
+			const delta = payload.delta;
+			return { chars: typeof delta === "string" ? delta.length : 0 };
+		}
+		case "tool_call_start": return { tool: payload.tool_name };
+		case "tool_call_end": return {
+			tool: payload.tool_name,
+			is_error: payload.is_error === true,
+			...payload.is_error === true && payload.result !== void 0 ? { result: payload.result } : {}
+		};
+		case "turn_end": return { stop_reason: payload.stop_reason };
+		case "error": return {
+			phase: payload.phase,
+			message: typeof payload.message === "string" ? payload.message.slice(0, LOG_TRUNCATE_LIMIT) : payload.message
+		};
+		case "info": return Object.fromEntries(Object.entries(payload).map(([k, v]) => [k, typeof v === "string" ? v.slice(0, LOG_TRUNCATE_LIMIT) : v]));
+		default: return payload;
+	}
+}
+//#endregion
 //#region src/runtime/task-workspace.ts
 function prepareTaskWorkspace(task, requestedMountPath, executionPlan) {
 	const branch = executionPlan?.worktreeBranch ?? null;
@@ -26209,15 +26447,17 @@ async function executePiTask(claimedTask, reporter, opts) {
 		onTurnEvent = noopTurnEventHandler;
 	}
 	else onTurnEvent = opts.onTurnEvent ?? noopTurnEventHandler;
-	const emit = (kind, payload) => {
-		try {
-			onTurnEvent(kind, summarizePayloadForLog(kind, payload));
-		} catch (err) {
-			process.stderr.write(`[emit] onTurnEvent threw for kind="${kind}": ${err instanceof Error ? err.message : String(err)}\n`);
-		}
-		return reporter.record({
+	const emit = async (kind, payload) => {
+		await emitTaskEvent({
 			kind,
-			payload
+			payload,
+			onTurnEvent,
+			reporter,
+			taskId: task.id,
+			attemptN,
+			log: (message) => {
+				process.stderr.write(`${message}\n`);
+			}
 		});
 	};
 	const emitError = async (phase, message, extra = {}) => {
@@ -26321,6 +26561,21 @@ async function executePiTask(claimedTask, reporter, opts) {
 				message
 			});
 		}
+		const rawContext = task.input.context;
+		let effectiveRuntimeContext;
+		try {
+			effectiveRuntimeContext = resolveEffectiveRuntimeContext({
+				rawTaskContext: rawContext,
+				runtimeProfileContext: opts.runtimeProfileContext
+			});
+		} catch (err) {
+			const message = err instanceof Error ? err.message : String(err);
+			await emit("error", {
+				message,
+				phase: "context_resolution"
+			});
+			return makeFailedOutput("context_resolution_failed", message);
+		}
 		let taskPrompt;
 		try {
 			const assembled = buildTaskUserPrompt(task, {
@@ -26333,7 +26588,8 @@ async function executePiTask(claimedTask, reporter, opts) {
 					source: executionPlan?.workspaceSeed?.source === "producer" ? "producer_copy" : executionPlan?.workspaceAttachment !== void 0 ? "producer_attachment" : void 0
 				},
 				extras: opts.promptExtras,
-				priorContext: resolvedPriorContext
+				priorContext: resolvedPriorContext,
+				effectiveRuntimeContext
 			});
 			taskPrompt = assembled.text;
 			await emit("info", {
@@ -26350,13 +26606,10 @@ async function executePiTask(claimedTask, reporter, opts) {
 			});
 			return makeFailedOutput("prompt_build_failed", message);
 		}
-		const rawContext = task.input.context;
 		let injectedContext;
 		try {
-			const contextArray = rawContext === void 0 ? [] : rawContext;
-			if (!Check(TaskContext, contextArray)) throw new Error(`task.input.context failed TaskContext validation: ${JSON.stringify([...Errors(TaskContext, contextArray)].slice(0, 3))}`);
-			injectedContext = await injectTaskContext({
-				context: contextArray,
+			injectedContext = await injectRuntimeContext({
+				context: effectiveRuntimeContext,
 				fs: managed.vm.fs,
 				guestWorkspace: managed.guestWorkspace
 			});
@@ -26948,27 +27201,6 @@ function wireSessionAbort(cancelSignal, session) {
 * `task_messages.payload` row. Bodies above 4 KiB are replaced with a
 * `{ truncated, original_size }` marker so the JSONL/DB size stays bounded.
 */
-function summarizePayloadForLog(kind, payload) {
-	switch (kind) {
-		case "text_delta": {
-			const delta = payload.delta;
-			return { chars: typeof delta === "string" ? delta.length : 0 };
-		}
-		case "tool_call_start": return { tool: payload.tool_name };
-		case "tool_call_end": return {
-			tool: payload.tool_name,
-			is_error: payload.is_error === true,
-			...payload.is_error === true && payload.result !== void 0 ? { result: payload.result } : {}
-		};
-		case "turn_end": return { stop_reason: payload.stop_reason };
-		case "error": return {
-			phase: payload.phase,
-			message: typeof payload.message === "string" ? payload.message.slice(0, TRUNCATE_LIMIT) : payload.message
-		};
-		case "info": return Object.fromEntries(Object.entries(payload).map(([k, v]) => [k, typeof v === "string" ? v.slice(0, TRUNCATE_LIMIT) : v]));
-		default: return payload;
-	}
-}
 /**
 * Classify a `tool_execution_end` event for telemetry purposes.
 *
@@ -27565,4 +27797,4 @@ function moltnetExtension(pi) {
 	registerMoltnetReflectCommand(pi, state);
 }
 //#endregion
-export { HOST_EXEC_DEFAULT_BASE_ENV, activateAgentEnv, buildAgentSession, createGondolinBashOps, createGondolinEditOps, createGondolinReadOps, createGondolinWriteOps, createMoltNetTools, createPiOtelExtension, createPiProviderErrorRetryUi, createPiRetryTriage, createPiTaskExecutor, createSubagentTool, moltnetExtension as default, ensureSnapshot, executePiTask, findMainWorktree, injectTaskContext, loadCredentials, normalizeRetryTriageResult, redactRetryTriageSecrets, resolveTaskWorktreePath, resumeVm, toGuestPath };
+export { HOST_EXEC_DEFAULT_BASE_ENV, activateAgentEnv, buildAgentSession, createGondolinBashOps, createGondolinEditOps, createGondolinReadOps, createGondolinWriteOps, createMoltNetTools, createPiOtelExtension, createPiProviderErrorRetryUi, createPiRetryTriage, createPiTaskExecutor, createSubagentTool, moltnetExtension as default, ensureSnapshot, executePiTask, findMainWorktree, injectRuntimeContext as injectTaskContext, loadCredentials, normalizeRetryTriageResult, redactRetryTriageSecrets, resolveTaskWorktreePath, resumeVm, toGuestPath };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/pi-extension",
-  "version": "0.33.0",
+  "version": "0.34.0",
   "type": "module",
   "description": "MoltNet pi extension — sandboxed tool execution in Gondolin VMs with MoltNet identity and persistent memory",
   "keywords": [
@@ -36,8 +36,8 @@
     "@earendil-works/gondolin": "^0.9.1",
     "@opentelemetry/api": "^1.9.0",
     "typebox": "^1.2.8",
-    "@themoltnet/agent-runtime": "0.35.0",
-    "@themoltnet/sdk": "0.119.0"
+    "@themoltnet/agent-runtime": "0.35.2",
+    "@themoltnet/sdk": "0.120.0"
   },
   "peerDependencies": {
     "@earendil-works/pi-coding-agent": ">=0.74.0",