@themoltnet/pi-extension 0.33.1 → 0.34.0

package/README.md

@@ -163,6 +163,10 @@ the base snapshot is used (Alpine + git + gh + MoltNet CLI + agent user).
       { "argsPrefix": ["pr", "create"], "executable": "gh" }
     ]
   },
+  "network": {
+    "allowedHosts": ["api.example.com", "*.services.example.com"],
+    "allowedInternalHosts": ["onboard-api.internal"]
+  },
   "resources": {
     "cpus": 2,
     "memory": "6G"
@@ -201,6 +205,38 @@ Controls what's installed on top of the base layer during snapshot build.
 | `allowedHosts`  | Extra hosts allowed during build (base hosts always included) |
 | `overlaySize`   | qcow2 overlay disk size (default `"3G"`)                      |
 
+### `network`
+
+Controls HTTP(S) egress while a VM is running. Both arrays accept exact
+hostnames such as `api.example.com` and leading wildcard patterns such as
+`*.example.com`. Do not include a URL scheme, port, or path.
+
+- `allowedHosts` grants ordinary hostname egress. Gondolin still rejects a
+  matching hostname if DNS resolves it to loopback, link-local, or a private IP
+  range. This protects public allowlist entries from DNS rebinding and SSRF.
+- `allowedInternalHosts` explicitly permits matching hostnames to resolve to
+  internal/private IP ranges. Gondolin automatically includes these entries in
+  its effective hostname allowlist, so they do not need to appear in both
+  arrays. Treat this as the stronger, security-sensitive permission.
+
+The base runtime hosts, MoltNet API host, and legacy `extraAllowedHosts` remain
+external-only. They are not implicitly allowed to resolve internally, and VM
+resume rejects an `allowedInternalHosts` pattern that overlaps one of those
+protected patterns. Use a distinct internal service hostname when private
+resolution is required.
+
+Runtime hosts are deliberately separate from `snapshot.allowedHosts`: build
+dependencies do not become task-time egress grants, and runtime services do not
+become snapshot build dependencies. Private destinations require an explicit
+`allowedInternalHosts` grant; unlisted internal and external hosts remain
+blocked.
+
+Profiles and repo-local `sandbox.json` use the same field. For profiles, treat
+this as a team-editable security boundary: forwarded environment values and
+other VM-accessible secrets can be sent to any granted host. An internal grant
+can additionally expose localhost services, cloud metadata, and private network
+infrastructure if the hostname is attacker-controlled.
+
 ### `resources`
 
 VM resource limits applied at runtime.

package/dist/index.d.ts

@@ -766,6 +766,14 @@ export declare interface SandboxConfig {
         /** Overlay disk size (default '3G'). */
         overlaySize?: string;
     };
+    /** Runtime network egress policy. Separate from snapshot build access. */
+    network?: {
+        /** Additional host patterns allowed while the VM is running.
+         * Internal and private address resolution remains blocked. */
+        allowedHosts?: string[];
+        /** Host patterns explicitly allowed to resolve to internal/private IPs. */
+        allowedInternalHosts?: string[];
+    };
     /** Shell commands to run every VM resume, after platform setup
      *  (TLS, DNS, git safe.directory, tmpfs node_modules) and before
      *  the agent session starts. Use for per-session bootstrap that
@@ -887,7 +895,7 @@ declare const Task: Type.TObject<{
     inputCid: Type.TString;
     references: Type.TArray<Type.TObject<{
         taskId: Type.TUnion<[Type.TString, Type.TNull]>;
-        outputCid: Type.TString;
+        outputCid: Type.TOptional<Type.TString>;
         role: Type.TUnion<[Type.TLiteral<"judged_work">, Type.TLiteral<"reviewed_diff">, Type.TLiteral<"target_source">, Type.TLiteral<"context">]>;
         external: Type.TOptional<Type.TObject<{
             kind: Type.TUnion<[Type.TLiteral<"github_pr">, Type.TLiteral<"github_issue">, Type.TLiteral<"http_url">]>;
@@ -899,7 +907,7 @@ declare const Task: Type.TObject<{
         }>>;
         artifact: Type.TOptional<Type.TObject<{
             cid: Type.TString;
-            attemptN: Type.TInteger;
+            attemptN: Type.TOptional<Type.TInteger>;
             kind: Type.TOptional<Type.TString>;
             title: Type.TOptional<Type.TString>;
             contentType: Type.TOptional<Type.TString>;

package/dist/index.js

@@ -1965,6 +1965,33 @@ var findLatestRuntimeSlotForAttempt = (options) => (options.client ?? client).ge
 	...options
 });
 /**
+* Stage immutable content-addressed artifact bytes for later binding as task input artifacts via task creation references. Creates no metadata row; staged bytes are not downloadable until bound to a task, and unbound objects are garbage-collected after a grace window.
+*/
+var stageTaskArtifact = (options) => (options.client ?? client).put({
+	bodySerializer: null,
+	security: [
+		{
+			scheme: "bearer",
+			type: "http"
+		},
+		{
+			name: "X-Moltnet-Session-Token",
+			type: "apiKey"
+		},
+		{
+			in: "cookie",
+			name: "ory_kratos_session",
+			type: "apiKey"
+		}
+	],
+	url: "/task-artifacts/staged",
+	...options,
+	headers: {
+		"Content-Type": "application/octet-stream",
+		...options.headers
+	}
+});
+/**
 * Queue asynchronous deletion of waiting, queued, and terminal tasks in bulk. By default, dispatched, running, unauthorized, missing, and protected tasks are skipped. Set force: true with a reason to delete protected terminal tasks.
 */
 var batchDeleteTasks = (options) => (options.client ?? client).delete({
@@ -9671,6 +9698,11 @@ var RuntimeProfileSandboxResumeCommand = Union([String$1({
 		maximum: 6e4
 	}))
 }, { additionalProperties: false })]);
+var RuntimeProfileAllowedHost = String$1({
+	minLength: 1,
+	maxLength: 255,
+	pattern: "^(?:\\*\\.)?(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)(?:\\.(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?))*$"
+});
 var RuntimeProfileSandbox = _Object_({
 	snapshot: Optional(_Object_({
 		setupCommands: Optional(_Array_(String$1({
@@ -9687,6 +9719,10 @@ var RuntimeProfileSandbox = _Object_({
 			pattern: "^[0-9]+[KMGTP]?$"
 		}))
 	}, { additionalProperties: false })),
+	network: Optional(_Object_({
+		allowedHosts: Optional(_Array_(RuntimeProfileAllowedHost, { maxItems: 50 })),
+		allowedInternalHosts: Optional(_Array_(RuntimeProfileAllowedHost, { maxItems: 50 }))
+	}, { additionalProperties: false })),
 	resumeCommands: Optional(_Array_(RuntimeProfileSandboxResumeCommand, { maxItems: 30 })),
 	vfs: Optional(_Object_({
 		shadow: Optional(_Array_(String$1({
@@ -10146,7 +10182,7 @@ _Object_({
 		id: String$1({ format: "uuid" }),
 		teamId: String$1({ format: "uuid" }),
 		taskId: String$1({ format: "uuid" }),
-		attemptN: Integer({ minimum: 1 }),
+		attemptN: Union([Integer({ minimum: 1 }), Null()]),
 		kind: String$1({
 			minLength: 1,
 			maxLength: 100
@@ -10168,7 +10204,7 @@ _Object_({
 			minLength: 1,
 			maxLength: 100
 		}),
-		createdByAgentId: String$1({ format: "uuid" }),
+		createdByAgentId: Union([String$1({ format: "uuid" }), Null()]),
 		expiresAt: Union([String$1({ format: "date-time" }), Null()]),
 		createdAt: String$1({ format: "date-time" })
 	}, { $id: "TaskArtifact" })),
@@ -10184,6 +10220,16 @@ _Object_({
 	$id: "ListTaskArtifactsQuery",
 	additionalProperties: false
 });
+var HeaderSafeContentType = String$1({
+	minLength: 1,
+	maxLength: 200,
+	pattern: "^[\\x21-\\x7e][\\x20-\\x7e]*$"
+});
+var HeaderSafeContentEncoding = String$1({
+	minLength: 1,
+	maxLength: 100,
+	pattern: "^[\\x21-\\x7e][\\x20-\\x7e]*$"
+});
 _Object_({
 	kind: String$1({
 		minLength: 1,
@@ -10193,14 +10239,8 @@ _Object_({
 		minLength: 1,
 		maxLength: 255
 	}),
-	contentType: Optional(String$1({
-		minLength: 1,
-		maxLength: 200
-	})),
-	contentEncoding: Optional(String$1({
-		minLength: 1,
-		maxLength: 100
-	}))
+	contentType: Optional(HeaderSafeContentType),
+	contentEncoding: Optional(HeaderSafeContentEncoding)
 }, {
 	$id: "UploadTaskArtifactQuery",
 	additionalProperties: false
@@ -10232,6 +10272,34 @@ _Object_({
 	$id: "TaskArtifactContentParams",
 	additionalProperties: false
 });
+_Object_({
+	contentType: Optional(HeaderSafeContentType),
+	contentEncoding: Optional(HeaderSafeContentEncoding)
+}, {
+	$id: "StageTaskArtifactQuery",
+	additionalProperties: false
+});
+_Object_({
+	cid: String$1({
+		minLength: 1,
+		maxLength: 100
+	}),
+	sizeBytes: Integer({ minimum: 0 }),
+	contentType: String$1({
+		minLength: 1,
+		maxLength: 200
+	})
+}, { $id: "StagedTaskArtifact" });
+_Object_({
+	taskId: String$1({ format: "uuid" }),
+	cid: String$1({
+		minLength: 1,
+		maxLength: 100
+	})
+}, {
+	$id: "TaskArtifactTaskContentParams",
+	additionalProperties: false
+});
 //#endregion
 //#region ../../node_modules/.pnpm/multiformats@13.4.2/node_modules/multiformats/dist/src/codecs/json.js
 var textEncoder$2 = new TextEncoder();
@@ -13847,6 +13915,42 @@ function validateTaskCreateRequest(args) {
 		field: "references",
 		message: `At least one reference is required for task type: ${args.taskType}`
 	});
+	errors.push(...validateTaskReferences(args.references));
+	return errors;
+}
+/**
+* Cross-field rules for the reference shapes the schema alone cannot
+* express. Every reference must be exactly one of:
+*
+* - **task output ref**: taskId set, outputCid required; an optional
+*   artifact must name its producing attempt (attemptN).
+* - **input artifact ref**: taskId null, artifact without attemptN;
+*   outputCid omitted (or equal to artifact.cid when sent) -- the bytes
+*   were staged before any task existed, so there is no output to name.
+* - **external ref**: taskId null, external present, no artifact.
+*
+* Anything else used to be silently persisted into taskRefs and never
+* materialized; now it fails fast with a field error.
+*/
+function validateTaskReferences(references) {
+	const errors = [];
+	(references ?? []).forEach((ref, index) => {
+		const invalid = (message) => errors.push({
+			field: `references[${index}]`,
+			message
+		});
+		if (ref.taskId !== null) {
+			if (ref.outputCid === void 0) invalid("outputCid is required when referencing a task output");
+			if (ref.artifact && ref.artifact.attemptN === void 0) invalid("artifact references to another task must include attemptN; input artifacts are referenced with taskId null");
+			return;
+		}
+		if (ref.artifact) {
+			if (ref.artifact.attemptN !== void 0) invalid("input artifact references (taskId null) must not include attemptN; reference the producing task by id instead");
+			if (ref.outputCid !== void 0 && ref.outputCid !== ref.artifact.cid) invalid("outputCid on an input artifact reference must be omitted or equal artifact.cid");
+			return;
+		}
+		if (!ref.external) invalid("references with taskId null must carry either an artifact (input artifact) or an external descriptor");
+	});
 	return errors;
 }
 //#endregion
@@ -13963,7 +14067,7 @@ Unsafe(Cyclic({ ClaimCondition: Unsafe(Union([
 */
 var TaskRef = _Object_({
 	taskId: Union([Uuid, Null()]),
-	outputCid: Cid,
+	outputCid: Optional(Cid),
 	role: Union([
 		Literal("judged_work"),
 		Literal("reviewed_diff"),
@@ -13984,7 +14088,7 @@ var TaskRef = _Object_({
 	})),
 	artifact: Optional(_Object_({
 		cid: Cid,
-		attemptN: Integer({ minimum: 1 }),
+		attemptN: Optional(Integer({ minimum: 1 })),
 		kind: Optional(String$1({
 			minLength: 1,
 			maxLength: 100
@@ -14454,30 +14558,53 @@ var TaskBuilder = class {
 		return this;
 	}
 	/**
-	* Add a reference to a persistent task artifact while retaining the accepted
-	* output CID as the provenance anchor.
+	* Add either a staged input artifact or a persistent attempt artifact.
+	* Staged metadata returned by `tasks.artifacts.stage()` carries
+	* `artifactSource: 'staged'` and produces a reference with `taskId: null`, no
+	* `outputCid`, and no `attemptN`. Persistent artifacts require the producing
+	* task, accepted output CID, artifact CID, and positive attempt number so
+	* their provenance remains explicit.
 	*
-	* @param source - A result reader, raw artifact reference, or `TaskRef`.
+	* @param source - Staged SDK metadata, a result reader, raw artifact reference, or `TaskRef`.
 	* @param role - The role the referenced artifact plays.
 	* @returns This builder, for chaining.
-	* @throws {TaskBuildError} when output or artifact CID is missing.
+	* @throws {TaskBuildError} when the source is ambiguous or required provenance is missing.
 	*/
 	artifactReference(source, role) {
 		let ref;
 		if ("artifactRef" in source && typeof source.artifactRef === "function") ref = source.artifactRef(role);
-		else if ("artifact" in source && source.artifact?.cid) {
-			if (typeof source.artifact.attemptN !== "number" || !Number.isInteger(source.artifact.attemptN) || source.artifact.attemptN < 1) throw new TaskBuildError([{
-				field: "references/artifact/attemptN",
-				message: "artifact reference is missing required attemptN"
-			}]);
-			ref = {
-				...source,
-				role
-			};
-		} else {
+		else if ("artifactSource" in source && source.artifactSource === "staged" && source.cid) ref = {
+			taskId: null,
+			role,
+			artifact: {
+				cid: source.cid,
+				...source.kind ? { kind: source.kind } : {},
+				...source.title ? { title: source.title } : {},
+				...source.contentType ? { contentType: source.contentType } : {}
+			}
+		};
+		else if ("cid" in source) throw new TaskBuildError([{
+			field: "references/artifactSource",
+			message: "top-level artifact CID is ambiguous; use metadata returned by tasks.artifacts.stage()"
+		}]);
+		else if ("artifact" in source && source.artifact?.cid) if (source.taskId === null && source.artifact.attemptN === void 0) ref = {
+			taskId: null,
+			role,
+			artifact: { ...source.artifact }
+		};
+		else if (typeof source.artifact.attemptN !== "number" || !Number.isInteger(source.artifact.attemptN) || source.artifact.attemptN < 1) throw new TaskBuildError([{
+			field: "references/artifact/attemptN",
+			message: "artifact reference is missing required attemptN"
+		}]);
+		else ref = {
+			...source,
+			role
+		};
+		else {
 			const s = source;
 			const errors = [];
-			if (!s.outputCid) errors.push({
+			const inputArtifact = s.taskId === null && s.attemptN === void 0;
+			if (!inputArtifact && !s.outputCid) errors.push({
 				field: "references/outputCid",
 				message: "reference is missing required outputCid"
 			});
@@ -14485,19 +14612,18 @@ var TaskBuilder = class {
 				field: "references/artifact/cid",
 				message: "artifact reference is missing required cid"
 			});
-			if (typeof s.attemptN !== "number" || !Number.isInteger(s.attemptN) || s.attemptN < 1) errors.push({
+			if (!inputArtifact && (typeof s.attemptN !== "number" || !Number.isInteger(s.attemptN) || s.attemptN < 1)) errors.push({
 				field: "references/artifact/attemptN",
 				message: "artifact reference is missing required attemptN"
 			});
 			if (errors.length > 0) throw new TaskBuildError(errors);
-			const attemptN = s.attemptN;
 			ref = {
 				taskId: s.taskId ?? null,
-				outputCid: s.outputCid,
+				...!inputArtifact && s.outputCid ? { outputCid: s.outputCid } : {},
 				role,
 				artifact: {
 					cid: s.artifactCid,
-					attemptN,
+					...s.attemptN !== void 0 ? { attemptN: s.attemptN } : {},
 					...s.kind ? { kind: s.kind } : {},
 					...s.title ? { title: s.title } : {},
 					...s.contentType ? { contentType: s.contentType } : {}
@@ -14967,6 +15093,22 @@ function createTasksNamespace(context) {
 			}));
 		},
 		artifacts: {
+			async stage(body, query, options) {
+				return {
+					...unwrapResult(await stageTaskArtifact({
+						auth,
+						body,
+						client,
+						duplex: "half",
+						headers: {
+							...requiredTeamHeaders(options),
+							"content-type": "application/octet-stream"
+						},
+						query
+					})),
+					artifactSource: "staged"
+				};
+			},
 			async upload(path, body, query, options) {
 				return unwrapResult(await uploadTaskArtifact({
 					auth,
@@ -15000,17 +15142,24 @@ function createTasksNamespace(context) {
 				}));
 			},
 			async download(path, options) {
-				const result = await client.request({
+				const request = {
 					auth,
 					headers: requiredTeamHeaders(options),
 					method: "GET",
 					parseAs: "stream",
-					path,
 					security: [{
 						scheme: "bearer",
 						type: "http"
-					}],
+					}]
+				};
+				const result = "attemptN" in path ? await client.request({
+					...request,
+					path,
 					url: "/tasks/{taskId}/attempts/{attemptN}/artifacts/{cid}/content"
+				}) : await client.request({
+					...request,
+					path,
+					url: "/tasks/{taskId}/artifacts/{cid}/content"
 				});
 				const normalizedStream = normalizeDownloadStream(unwrapResult(result));
 				if (normalizedStream) return {
@@ -19010,6 +19159,39 @@ var BASE_ALLOWED_HOSTS = [
 	"*.googlesource.com"
 ];
 /**
+* Return whether two Gondolin hostname globs can match at least one common
+* string. Each `*` is an arbitrary substring, so this walks the product of the
+* two small glob automata instead of relying on exact-string comparisons.
+*/
+function hostnamePatternsOverlap(left, right) {
+	const a = left.trim().toLowerCase();
+	const b = right.trim().toLowerCase();
+	if (!a || !b) return false;
+	const pending = [[0, 0]];
+	const visited = /* @__PURE__ */ new Set();
+	while (pending.length > 0) {
+		const next = pending.pop();
+		if (!next) continue;
+		const [aIndex, bIndex] = next;
+		const state = `${aIndex}:${bIndex}`;
+		if (visited.has(state)) continue;
+		visited.add(state);
+		if (aIndex === a.length && bIndex === b.length) return true;
+		const aChar = a[aIndex];
+		const bChar = b[bIndex];
+		if (aChar === "*") pending.push([aIndex + 1, bIndex]);
+		if (bChar === "*") pending.push([aIndex, bIndex + 1]);
+		if (aChar !== void 0 && bChar !== void 0 && (aChar === "*" || bChar === "*" || aChar === bChar)) pending.push([aChar === "*" ? aIndex : aIndex + 1, bChar === "*" ? bIndex : bIndex + 1]);
+	}
+	return false;
+}
+function assertInternalHostsDoNotOverlapProtectedHosts(internalHosts, protectedHosts) {
+	for (const internalHost of internalHosts) {
+		const protectedHost = protectedHosts.find((candidate) => hostnamePatternsOverlap(internalHost, candidate));
+		if (protectedHost) throw new Error(`sandbox.network.allowedInternalHosts pattern "${internalHost}" overlaps external-only host pattern "${protectedHost}"`);
+	}
+}
+/**
 * Run a shell command in the guest and throw if it fails. Mirror of
 * `run()` in `snapshot.ts` for the resume-side hook chain — every
 * setup step is essential to a healthy session, so a silent non-zero
@@ -19051,11 +19233,18 @@ async function resumeVm(config) {
 	const creds = loadCredentials(agentDir);
 	const moltnetConfig = JSON.parse(creds.moltnetJson);
 	const apiHost = new URL(moltnetConfig.endpoints.api).hostname;
-	const { httpHooks, env: secretEnv } = createHttpHooks({ allowedHosts: [
+	const runtimeAllowedHosts = config.sandboxConfig?.network?.allowedHosts ?? [];
+	const runtimeAllowedInternalHosts = config.sandboxConfig?.network?.allowedInternalHosts ?? [];
+	const protectedExternalHosts = [...new Set([
 		...BASE_ALLOWED_HOSTS,
 		apiHost,
 		...config.extraAllowedHosts ?? []
-	] });
+	])];
+	assertInternalHostsDoNotOverlapProtectedHosts(runtimeAllowedInternalHosts, protectedExternalHosts);
+	const { httpHooks, env: secretEnv } = createHttpHooks({
+		allowedHosts: [...new Set([...protectedExternalHosts, ...runtimeAllowedHosts])],
+		allowedInternalHosts: runtimeAllowedInternalHosts
+	});
 	const vmAgentDir = `/home/agent/.moltnet/${config.agentName}`;
 	const vmAgentEnv = {};
 	for (const [k, v] of Object.entries(creds.agentEnv)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/pi-extension",
-  "version": "0.33.1",
+  "version": "0.34.0",
   "type": "module",
   "description": "MoltNet pi extension — sandboxed tool execution in Gondolin VMs with MoltNet identity and persistent memory",
   "keywords": [
@@ -36,8 +36,8 @@
     "@earendil-works/gondolin": "^0.9.1",
     "@opentelemetry/api": "^1.9.0",
     "typebox": "^1.2.8",
-    "@themoltnet/agent-runtime": "0.35.1",
-    "@themoltnet/sdk": "0.119.0"
+    "@themoltnet/agent-runtime": "0.35.2",
+    "@themoltnet/sdk": "0.120.0"
   },
   "peerDependencies": {
     "@earendil-works/pi-coding-agent": ">=0.74.0",