@themoltnet/pi-extension 0.37.2 → 0.38.0

package/dist/index.js

@@ -1,14 +1,14 @@
 import { createRequire } from "node:module";
 import { execFileSync } from "node:child_process";
 import { createReadStream, createWriteStream, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync } from "node:fs";
-import path, { join } from "node:path";
+import path, { isAbsolute, join, relative } from "node:path";
 import { DEFAULT_MAX_BYTES, createBashTool, createEditTool, createFindTool, createGrepTool, createLsTool, createReadTool, createWriteTool, defineTool, formatSize, truncateHead, truncateLine } from "@earendil-works/pi-coding-agent";
-import { readFile, realpath, stat } from "node:fs/promises";
+import { mkdir, readFile, realpath, stat } from "node:fs/promises";
 import { pipeline } from "node:stream/promises";
 import { Type } from "@earendil-works/pi-ai";
-import { homedir } from "node:os";
 import crypto, { createHash } from "crypto";
 import { createHash as createHash$1 } from "node:crypto";
+import { homedir } from "node:os";
 import { Readable } from "node:stream";
 import { MemoryProvider, RealFSProvider, ShadowProvider, VM, VmCheckpoint, createHttpHooks, createShadowPathPredicate, ensureImageSelector, isWriteFlag, loadGuestAssets } from "@earendil-works/gondolin";
 import { parseEnv } from "node:util";
@@ -41,6 +41,20 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __hasOwnProp.call(mod, "module.exports") ? mod["module.exports"] : __copyProps(__defProp$1({}, "__esModule", { value: true }), mod);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 //#endregion
+//#region ../pi-runtime/src/path-containment.ts
+/**
+* Check containment for already-resolved lexical or real paths.
+*
+* Callers that accept untrusted paths must resolve/realpath at their I/O
+* boundary first; keeping the platform-specific relative-path rule here avoids
+* subtly different `..` and absolute-path handling across runtime cleanup,
+* session sync, and artifact staging.
+*/
+function isResolvedPathInsideRoot(path, root) {
+	const rel = relative(root, path);
+	return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+}
+//#endregion
 //#region ../pi-runtime/src/moltnet/render-phase6.ts
 function slugToTitle(value) {
 	return value.split(/[:/_-]+/).filter(Boolean).map((part) => part[0]?.toUpperCase() + part.slice(1)).join(" ");
@@ -232,11 +246,32 @@ async function openWorkspaceArtifactInput(config, cwd, filePath) {
 }
 async function resolveWorkspaceOutputPath(cwd, filePath) {
 	const resolved = path.isAbsolute(filePath) ? path.resolve(filePath) : path.resolve(cwd, filePath);
-	const [realCwd, realParent] = await Promise.all([realpath(cwd), realpath(path.dirname(resolved))]);
-	const rel = path.relative(realCwd, realParent);
-	if (rel.startsWith("..") || path.isAbsolute(rel)) throw new Error(`task artifact output path escapes workspace: ${filePath}`);
+	const workspaceRoot = path.resolve(cwd);
+	const lexicalRel = path.relative(workspaceRoot, resolved);
+	if (lexicalRel === "" || lexicalRel.startsWith("..") || path.isAbsolute(lexicalRel)) throw new Error(`task artifact output path escapes workspace: ${filePath}`);
+	const realCwd = await realpath(cwd);
+	const parent = path.dirname(resolved);
+	assertPathInsideWorkspace(realCwd, await findExistingAncestor(parent), filePath);
+	await mkdir(parent, { recursive: true });
+	assertPathInsideWorkspace(realCwd, await realpath(parent), filePath);
 	return resolved;
 }
+async function findExistingAncestor(candidate) {
+	let current = candidate;
+	for (;;) {
+		try {
+			return await realpath(current);
+		} catch (err) {
+			if (!err || typeof err !== "object" || !("code" in err) || err.code !== "ENOENT") throw err;
+		}
+		const parent = path.dirname(current);
+		if (parent === current) throw new Error(`task artifact output has no existing ancestor: ${candidate}`);
+		current = parent;
+	}
+}
+function assertPathInsideWorkspace(realCwd, realPath, displayPath) {
+	if (!isResolvedPathInsideRoot(realPath, realCwd)) throw new Error(`task artifact output path escapes workspace: ${displayPath}`);
+}
 /**
 * Expand the `taskFilter` shorthand on the diary list/search tools into
 * the matching `task:*` provenance tags emitted by `moltnet_create_entry`
@@ -9948,6 +9983,11 @@ var RuntimeModel = _Object_({
 var RUNTIME_PROFILE_CONTEXT_CATALOGUE = {
 	version: 1,
 	fragments: {
+		"artifact-planner-v1": {
+			binding: "prompt_prefix",
+			content: "# Bounded artifact planner\n\n- The typed task facts, embedded bounded manifest, exact bound artifact references, registered tools, and runtime capability section are the complete contract. Do not search diaries, inspect a mounted repository, enumerate unrelated tasks or artifacts, use shell commands, modify files, commit, branch, push, or contact GitHub.\n- Read only the exact artifact CIDs named by the task, and only when the embedded manifest does not provide enough evidence. Never paginate or discover artifacts speculatively.\n- Perform semantic classification and planning from supplied content and producer/consumer evidence. Do not substitute filename, directory, language, ecosystem, or repository-specific exclusion rules for evidence.\n- Return exactly the requested versioned structured plan through the registered submit-output tool. Do not emit a second prose or JSON representation.",
+			slug: "artifact-planner-v1"
+		},
 		"accountable-delivery-v1": {
 			binding: "prompt_prefix",
 			content: "# Accountable delivery\n\n- Pair every commit made during this task with a signed diary entry created by the `moltnet_create_entry` custom tool. Put the returned id in a `MoltNet-Diary: <id>` commit trailer.\n- Keep commit signing enabled; do not bypass the agent git configuration.\n- Push a branch and open or update a pull request only when the task asks for it. For GitHub mutations, use the credential-bound `GH_TOKEN` command form required by the runtime kernel.\n- Keep changes, commits, and any requested pull request coherent enough to review independently.",
@@ -9980,6 +10020,10 @@ var RUNTIME_PROFILE_CONTEXT_CATALOGUE = {
 		}
 	},
 	recipes: {
+		"artifact-planner@v1": {
+			description: "Minimal artifact-only context for bounded semantic classification and planning.",
+			fragments: ["artifact-planner-v1"]
+		},
 		"run-eval-direct@v1": {
 			description: "Minimal direct context for a short, isolated evaluation run.",
 			fragments: ["run-eval-direct-v1"]
@@ -11467,7 +11511,7 @@ var VerificationResult = _Object_({
 var VerificationRecord = _Object_({
 	inputCid: String$1({ minLength: 1 }),
 	results: _Array_(VerificationResult),
-	passed: Boolean$1()
+	passed: Boolean$1({ description: "True iff every verification result has status \"pass\" or \"skip\"; false when any result has status \"fail\"." })
 }, {
 	$id: "VerificationRecord",
 	additionalProperties: false
@@ -15161,6 +15205,16 @@ function checkVerificationInputCid(value, runtime) {
 	}];
 	return [];
 }
+function checkVerificationPassedConsistency(value) {
+	const verification = value !== null && typeof value === "object" ? value.verification : void 0;
+	if (verification === void 0 || !Array.isArray(verification.results) || typeof verification.passed !== "boolean") return [];
+	const expectedPassed = verification.results.every((result) => result.status !== "fail");
+	if (verification.passed !== expectedPassed) return [{
+		field: "output/verification/passed",
+		message: "must be true iff no verification result has status \"fail\""
+	}];
+	return [];
+}
 function validateTaskResult(taskType, value, input, runtime, submission = false) {
 	const entry = getTaskTypeEntry(taskType);
 	if (!entry) return [{
@@ -15176,7 +15230,7 @@ function validateTaskResult(taskType, value, input, runtime, submission = false)
 			message: validationError
 		}];
 	}
-	return checkVerificationInputCid(value, runtime);
+	return [...checkVerificationInputCid(value, runtime), ...checkVerificationPassedConsistency(value)];
 }
 function validateTaskOutput(taskType, output, input, runtime) {
 	return validateTaskResult(taskType, output, input, runtime);
@@ -17572,7 +17626,7 @@ var require_transport = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var { createRequire: createRequire$1 } = __require("module");
 	var { existsSync: existsSync$1 } = __require("node:fs");
 	var getCallers = require_caller();
-	var { join: join$1, isAbsolute, sep } = __require("node:path");
+	var { join: join$1, isAbsolute: isAbsolute$1, sep } = __require("node:path");
 	var { fileURLToPath } = __require("node:url");
 	var sleep = require_atomic_sleep();
 	var onExit = require_on_exit_leak_free();
@@ -17633,7 +17687,7 @@ var require_transport = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		} catch {
 			return false;
 		}
-		return isAbsolute(path) && !existsSync$1(path);
+		return isAbsolute$1(path) && !existsSync$1(path);
 	}
 	function stripQuotes(value) {
 		const first = value[0];
@@ -17736,7 +17790,7 @@ var require_transport = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		return buildStream(fixTarget(target), options, worker, sync, name);
 		function fixTarget(origin) {
 			origin = bundlerOverrides[origin] || origin;
-			if (isAbsolute(origin) || origin.indexOf("file://") === 0) return origin;
+			if (isAbsolute$1(origin) || origin.indexOf("file://") === 0) return origin;
 			if (origin === "pino/file") return join$1(__dirname, "..", "file.js");
 			let fixTarget;
 			for (const filePath of callers) try {
@@ -28545,6 +28599,12 @@ var WRAPPERS = new Map([
 	["builtin", spec(0)]
 ]);
 //#endregion
+//#region ../pi-runtime/src/config.ts
+/** Resolve Pi's host-side auth/config directory from process configuration. */
+function resolvePiCodingAgentDir() {
+	return process.env["PI_CODING_AGENT_DIR"] ?? path.join(homedir(), ".pi", "agent");
+}
+//#endregion
 //#region ../pi-runtime/src/snapshot.ts
 /**
 * Snapshot builder with auto-build and caching.
@@ -28834,6 +28894,17 @@ async function delay(ms, signal, label) {
 *     investigation and the alternatives we rejected.
 */
 var GUEST_TASK_CONTEXT_MOUNT = "/moltnet-task-context";
+function resolveVfsShadowConfig(config) {
+	const patterns = config?.vfs?.shadow ?? [];
+	if (patterns.length === 0) return {
+		mode: "none",
+		patterns: []
+	};
+	return {
+		mode: config?.vfs?.shadowMode ?? "tmpfs",
+		patterns
+	};
+}
 function shouldRunResumeCommand(entry, ctx) {
 	if (typeof entry === "string") return true;
 	const workspaceModes = entry.when?.workspaceMode;
@@ -28906,7 +28977,7 @@ function resolveVmAgentDir(config) {
 function loadCredentials(agentDir) {
 	const moltnetJson = readFileSync(path.join(agentDir, "moltnet.json"), "utf8");
 	const agentEnvRaw = readFileSync(path.join(agentDir, "env"), "utf8");
-	const piAgentDir = process.env.PI_CODING_AGENT_DIR ?? path.join(process.env.HOME ?? "", ".pi", "agent");
+	const piAgentDir = resolvePiCodingAgentDir();
 	const piAuthPath = path.join(piAgentDir, "auth.json");
 	const piAuthJson = existsSync(piAuthPath) ? readFileSync(piAuthPath, "utf8") : null;
 	const gitconfigPath = path.join(agentDir, "gitconfig");
@@ -29061,7 +29132,7 @@ async function resumeVm(config) {
 		else vmAgentEnv[k] = v;
 	}
 	vmAgentEnv.MOLTNET_CREDENTIALS_PATH = `${vmAgentDir}/moltnet.json`;
-	const vfsConfig = config.sandboxConfig?.vfs;
+	const vfsConfig = resolveVfsShadowConfig(config.sandboxConfig);
 	let workspaceProvider = new RealFSProvider(config.mountPath);
 	workspaceProvider = new ShadowProvider(workspaceProvider, {
 		shouldShadow: ({ path: shadowPath }) => shouldShadowNodeModulesPath(shadowPath),
@@ -29069,11 +29140,11 @@ async function resumeVm(config) {
 		tmpfs: new AutoParentMemoryProvider(),
 		writeMode: "tmpfs"
 	});
-	if (vfsConfig?.shadow?.length) {
-		const predicate = createShadowPathPredicate(vfsConfig.shadow);
+	if (vfsConfig.mode !== "none") {
+		const predicate = createShadowPathPredicate(vfsConfig.patterns);
 		workspaceProvider = new ShadowProvider(workspaceProvider, {
 			shouldShadow: predicate,
-			writeMode: vfsConfig.shadowMode ?? "tmpfs"
+			writeMode: vfsConfig.mode
 		});
 	}
 	const forwardedEnv = {};
@@ -29533,7 +29604,7 @@ async function executeGondolinGrep(vm, localCwd, guestWorkspace, params, signal)
 	const onAbort = () => ac.abort();
 	signal?.addEventListener("abort", onAbort, { once: true });
 	try {
-		const proc = vm.exec(["/bin/rg", ...args], {
+		const proc = vm.exec(["rg", ...args], {
 			signal: ac.signal,
 			stdout: "pipe",
 			stderr: "pipe"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/pi-extension",
-  "version": "0.37.2",
+  "version": "0.38.0",
   "type": "module",
   "description": "MoltNet pi extension — sandboxed tool execution in Gondolin VMs with MoltNet identity and persistent memory",
   "keywords": [
@@ -34,11 +34,11 @@
   },
   "dependencies": {
     "@earendil-works/gondolin": "^0.9.1",
-    "@themoltnet/pi-runtime": "0.4.0",
+    "@themoltnet/pi-runtime": "0.5.0",
     "@themoltnet/sdk": "0.128.0"
   },
   "peerDependencies": {
-    "@earendil-works/pi-ai": "0.74.0",
+    "@earendil-works/pi-ai": "0.79.4",
     "@earendil-works/pi-coding-agent": "0.79.4"
   },
   "peerDependenciesMeta": {
@@ -50,7 +50,7 @@
     }
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "0.74.0",
+    "@earendil-works/pi-ai": "0.79.4",
     "@earendil-works/pi-coding-agent": "0.79.4",
     "@types/node": "^22.19.0",
     "typescript": "~5.9.2",