@themoltnet/pi-extension 0.5.0 → 0.6.0

package/dist/index.d.ts

@@ -33,6 +33,8 @@ declare interface ClaimedTask {
     task: Task;
     /** Attempt number assigned by the source/queue. */
     attemptN: number;
+    /** W3C trace headers from the claim response for OTel context propagation. */
+    traceHeaders: Record<string, string>;
 }
 
 export declare function computePiJudgeRecipeCid(inputs: PiJudgeRecipeInputs): PiJudgeRecipeCid;
@@ -132,6 +134,7 @@ export default moltnetExtension;
 declare interface MoltNetToolsConfig {
     getAgent(): MoltNetAgent | null;
     getDiaryId(): string | null;
+    getTeamId(): string | null;
     getSessionErrors(): readonly TrackedError[];
     clearSessionErrors(): void;
     /** Host working directory for host-exec commands (worktree path or cwd). */

package/dist/index.js

@@ -3,14 +3,14 @@ import { execFileSync } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync } from "node:fs";
 import path, { join } from "node:path";
 import { DefaultResourceLoader, SessionManager, createAgentSession, createBashTool, createBashToolDefinition, createEditTool, createEditToolDefinition, createReadTool, createReadToolDefinition, createWriteTool, createWriteToolDefinition, defineTool } from "@mariozechner/pi-coding-agent";
-import { createHash, randomUUID } from "node:crypto";
+import { createHash } from "node:crypto";
 import crypto, { createHash as createHash$1 } from "crypto";
 import { readFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { Type, complete, getModel } from "@mariozechner/pi-ai";
-import { fileURLToPath } from "node:url";
 import { RealFSProvider, ShadowProvider, VM, VmCheckpoint, createHttpHooks, createShadowPathPredicate, ensureImageSelector, loadGuestAssets } from "@earendil-works/gondolin";
 import { parseEnv } from "node:util";
+import { fileURLToPath } from "node:url";
 import { FormatRegistry, Type as Type$1 } from "@sinclair/typebox";
 import { Value } from "@sinclair/typebox/value";
 //#region ../api-client/src/generated/core/bodySerializer.gen.ts
@@ -1415,80 +1415,6 @@ var updateRenderedPack = (options) => (options.client ?? client).patch({
 	}
 });
 /**
-* Trigger fidelity verification for an agent-rendered pack.
-*/
-var verifyRenderedPack = (options) => (options.client ?? client).post({
-	security: [
-		{
-			scheme: "bearer",
-			type: "http"
-		},
-		{
-			name: "X-Moltnet-Session-Token",
-			type: "apiKey"
-		},
-		{
-			in: "cookie",
-			name: "ory_kratos_session",
-			type: "apiKey"
-		}
-	],
-	url: "/rendered-packs/{id}/verify",
-	...options,
-	headers: {
-		"Content-Type": "application/json",
-		...options.headers
-	}
-});
-/**
-* Judge claims verification payload (source entries, rendered content, and rubric).
-*/
-var claimVerification = (options) => (options.client ?? client).post({
-	security: [
-		{
-			scheme: "bearer",
-			type: "http"
-		},
-		{
-			name: "X-Moltnet-Session-Token",
-			type: "apiKey"
-		},
-		{
-			in: "cookie",
-			name: "ory_kratos_session",
-			type: "apiKey"
-		}
-	],
-	url: "/rendered-packs/{id}/verify/claim",
-	...options
-});
-/**
-* Judge submits fidelity scores and transcript.
-*/
-var submitVerification = (options) => (options.client ?? client).post({
-	security: [
-		{
-			scheme: "bearer",
-			type: "http"
-		},
-		{
-			name: "X-Moltnet-Session-Token",
-			type: "apiKey"
-		},
-		{
-			in: "cookie",
-			name: "ory_kratos_session",
-			type: "apiKey"
-		}
-	],
-	url: "/rendered-packs/{id}/verify/submit",
-	...options,
-	headers: {
-		"Content-Type": "application/json",
-		...options.headers
-	}
-});
-/**
 * Get an agent's public profile by key fingerprint (A1B2-C3D4-E5F6-G7H8).
 */
 var getAgentProfile = (options) => (options.client ?? client).get({
@@ -6445,29 +6371,6 @@ function createPacksNamespace(context) {
 				body
 			}));
 		},
-		async verifyRendered(id, body) {
-			return unwrapResult(await verifyRenderedPack({
-				client,
-				auth,
-				path: { id },
-				body
-			}));
-		},
-		async claimVerification(id) {
-			return unwrapResult(await claimVerification({
-				client,
-				auth,
-				path: { id }
-			}));
-		},
-		async submitVerification(id, body) {
-			return unwrapResult(await submitVerification({
-				client,
-				auth,
-				path: { id },
-				body
-			}));
-		},
 		async create(diaryId, body) {
 			return unwrapResult(await createDiaryCustomPack({
 				client,
@@ -6618,12 +6521,24 @@ function createTasksNamespace(context) {
 			}));
 		},
 		async claim(id, body) {
-			return unwrapResult(await claimTask({
+			const result = await claimTask({
 				client,
 				auth,
 				path: { id },
 				body
-			}));
+			});
+			const data = unwrapResult(result);
+			const traceHeaders = {};
+			const traceparent = result.response.headers.get("traceparent");
+			if (traceparent) {
+				traceHeaders["traceparent"] = traceparent;
+				const tracestate = result.response.headers.get("tracestate");
+				if (tracestate) traceHeaders["tracestate"] = tracestate;
+			}
+			return {
+				...data,
+				traceHeaders
+			};
 		},
 		async heartbeat(id, n, body) {
 			return unwrapResult(await taskHeartbeat({
@@ -7155,21 +7070,6 @@ var registerSandboxCommand = (pi, state) => {
 };
 //#endregion
 //#region src/moltnet/judge/assets.ts
-/**
-* Judge assets — single source of truth.
-*
-* `DEFAULT_RUBRIC` and `JUDGE_SYSTEM_PROMPT` below ARE the assets. There are
-* no companion `.md` files; tsc does not copy non-TS files into `dist/`, and
-* keeping a parallel markdown copy invited drift between source-of-truth
-* versions, which is what previously happened.
-*
-* The asset path constants are opaque identifiers used in the judge-recipe
-* CID manifest so verifiers can trace which asset set a given Pi extension
-* version emitted. They are NOT filesystem paths and are never read.
-* Bump the version suffix when you change the corresponding constant.
-*/
-var RUBRIC_ASSET_PATH = "pi-extension/judge/rubric@v1";
-var JUDGE_PROMPT_ASSET_PATH = "pi-extension/judge/system-prompt@v1";
 /** Default fidelity rubric — kept verbatim from the Go judge. */
 var DEFAULT_RUBRIC = `Evaluate the rendered content against the source entries on three axes:
 
@@ -7322,135 +7222,6 @@ function buildSourceEntriesMarkdown(entries) {
 	return parts.join("\n");
 }
 //#endregion
-//#region src/moltnet/judge-recipe-cid.ts
-var require = createRequire(import.meta.url);
-var SELF_PACKAGE_NAME = "@themoltnet/pi-extension";
-var PI_PACKAGE_NAME = "@mariozechner/pi-coding-agent";
-var SDK_PACKAGE_NAME = "@themoltnet/sdk";
-var CID_VERSION = 1;
-var RAW_CODEC = 85;
-var SHA2_256_CODE = 18;
-var BASE32_ALPHABET = "abcdefghijklmnopqrstuvwxyz234567";
-function findSelfPackageDir() {
-	const start = path.dirname(fileURLToPath(import.meta.url));
-	let dir = start;
-	while (true) {
-		const candidate = path.join(dir, "package.json");
-		if (existsSync(candidate)) {
-			if (JSON.parse(readFileSync(candidate, "utf8")).name === SELF_PACKAGE_NAME) return dir;
-		}
-		const parent = path.dirname(dir);
-		if (parent === dir) return start;
-		dir = parent;
-	}
-}
-var PACKAGE_DIR = findSelfPackageDir();
-function sha256Hex(value) {
-	return createHash("sha256").update(value, "utf8").digest("hex");
-}
-function encodeVarint(value) {
-	const bytes = [];
-	let current = value >>> 0;
-	while (current >= 128) {
-		bytes.push(current & 127 | 128);
-		current >>>= 7;
-	}
-	bytes.push(current);
-	return bytes;
-}
-function base32Lower(bytes) {
-	let bits = 0;
-	let value = 0;
-	let output = "";
-	for (const byte of bytes) {
-		value = value << 8 | byte;
-		bits += 8;
-		while (bits >= 5) {
-			output += BASE32_ALPHABET[value >>> bits - 5 & 31];
-			bits -= 5;
-		}
-	}
-	if (bits > 0) output += BASE32_ALPHABET[value << 5 - bits & 31];
-	return `b${output}`;
-}
-function stableStringify(value) {
-	if (value === null || typeof value !== "object") return JSON.stringify(value);
-	if (Array.isArray(value)) return `[${value.map((item) => stableStringify(item)).join(",")}]`;
-	return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${stableStringify(item)}`).join(",")}}`;
-}
-function readPackageVersion(pkgPath, expectedName) {
-	if (!existsSync(pkgPath)) return null;
-	const parsed = JSON.parse(readFileSync(pkgPath, "utf8"));
-	if (expectedName && parsed.name !== expectedName) return null;
-	return typeof parsed.version === "string" ? parsed.version : null;
-}
-function resolveInstalledPackageVersion(packageName) {
-	const candidates = [];
-	try {
-		candidates.push(path.dirname(require.resolve(packageName)));
-	} catch {}
-	let dir = PACKAGE_DIR;
-	while (true) {
-		candidates.push(path.join(dir, "node_modules", packageName));
-		const parent = path.dirname(dir);
-		if (parent === dir) break;
-		dir = parent;
-	}
-	for (const start of candidates) {
-		let current = start;
-		while (true) {
-			const version = readPackageVersion(path.join(current, "package.json"), packageName);
-			if (version) return version;
-			const parent = path.dirname(current);
-			if (parent === current) break;
-			current = parent;
-		}
-	}
-	return null;
-}
-function resolvePiJudgeRecipeVersions() {
-	return {
-		pi: resolveInstalledPackageVersion(PI_PACKAGE_NAME),
-		piExtension: readPackageVersion(path.join(PACKAGE_DIR, "package.json"), SELF_PACKAGE_NAME),
-		sdk: resolveInstalledPackageVersion(SDK_PACKAGE_NAME)
-	};
-}
-function buildPiJudgeRecipeManifest(inputs) {
-	return {
-		kind: "pi-judge-recipe/v1",
-		versions: {
-			...resolvePiJudgeRecipeVersions(),
-			...inputs.overrides
-		},
-		assets: {
-			promptAsset: inputs.promptAsset ?? null,
-			rubricAsset: inputs.rubricAsset ?? null,
-			skillSourcePath: inputs.skillSourcePath ?? null
-		},
-		hashes: {
-			judgePromptSha256: sha256Hex(inputs.judgePrompt),
-			rubricSha256: sha256Hex(inputs.rubric),
-			skillFragmentSha256: inputs.skillFragment ? sha256Hex(inputs.skillFragment) : null,
-			implementationSha256: inputs.implementationSource ? sha256Hex(inputs.implementationSource) : null
-		}
-	};
-}
-function computePiJudgeRecipeCid(inputs) {
-	const manifest = buildPiJudgeRecipeManifest(inputs);
-	const manifestBytes = Buffer.from(stableStringify(manifest), "utf8");
-	const digestBytes = createHash("sha256").update(manifestBytes).digest();
-	return {
-		cid: base32Lower(Uint8Array.from([
-			...encodeVarint(CID_VERSION),
-			...encodeVarint(RAW_CODEC),
-			...encodeVarint(SHA2_256_CODE),
-			...encodeVarint(digestBytes.length),
-			...digestBytes
-		])),
-		manifest
-	};
-}
-//#endregion
 //#region src/moltnet/render-phase6.ts
 function slugToTitle(value) {
 	return value.split(/[:/_-]+/).filter(Boolean).map((part) => part[0]?.toUpperCase() + part.slice(1)).join(" ");
@@ -7592,7 +7363,8 @@ function ensureConnected(config) {
 	if (!agent || !diaryId) throw new Error("MoltNet not connected");
 	return {
 		agent,
-		diaryId
+		diaryId,
+		teamId: config.getTeamId() ?? ""
 	};
 }
 /**
@@ -7758,24 +7530,34 @@ function createMoltNetTools(config) {
 			};
 		}
 	});
-	const verifyRenderedPack = defineTool({
-		name: "moltnet_rendered_pack_verify",
-		label: "Verify MoltNet Rendered Pack",
-		description: "Create a verification workflow for a rendered pack and return the verification ID and nonce.",
+	const createJudgePackTask = defineTool({
+		name: "moltnet_judge_pack_task_create",
+		label: "Create Judge Pack Task",
+		description: "Create a judge_pack task for a rendered pack. Returns a taskId that moltnet_rendered_pack_judge can claim and execute. The rubric is required — pass the structured rubric JSON from @moltnet/tasks Rubric schema.",
 		parameters: Type.Object({
-			renderedPackId: Type.String({ description: "Rendered pack ID" }),
-			nonce: Type.Optional(Type.String({ description: "Caller-supplied idempotency nonce. Generated automatically if omitted." }))
+			renderedPackId: Type.String({ description: "Rendered pack ID to judge" }),
+			sourcePackId: Type.String({ description: "Source pack ID. Fetch it from the rendered pack if unknown." }),
+			rubric: Type.Any({ description: "Structured rubric object (Rubric schema from @moltnet/tasks). Must have rubricId, version, criteria[]." }),
+			diaryId: Type.Optional(Type.String({ description: "Diary ID to impose the task on. Defaults to the connected diary." }))
 		}),
 		async execute(_id, params) {
-			const { agent } = ensureConnected(config);
-			const nonce = params.nonce ?? randomUUID();
-			const verification = await agent.packs.verifyRendered(params.renderedPackId, { nonce });
+			const { agent, diaryId: connectedDiaryId, teamId: connectedTeamId } = ensureConnected(config);
+			const task = await agent.tasks.create({
+				taskType: "judge_pack",
+				input: {
+					renderedPackId: params.renderedPackId,
+					sourcePackId: params.sourcePackId,
+					rubric: params.rubric
+				},
+				diaryId: params.diaryId ?? connectedDiaryId,
+				teamId: connectedTeamId
+			});
 			return {
 				content: [{
 					type: "text",
 					text: JSON.stringify({
-						...verification,
-						nonce
+						taskId: task.id,
+						task
 					}, null, 2)
 				}],
 				details: {}
@@ -7785,87 +7567,79 @@ function createMoltNetTools(config) {
 	const judgeRenderedPack = defineTool({
 		name: "moltnet_rendered_pack_judge",
 		label: "Judge MoltNet Rendered Pack",
-		description: "Run the fidelity judge against a rendered pack. Local mode (no nonce): fetch the rendered pack + its source pack with entries, judge locally, return scores. Proctored mode (nonce): claim the verification payload from the API, judge, and submit scores with a Pi judge-recipe CID.",
+		description: "Claim a judge_pack task, run the fidelity judge locally, complete the task with structured scores, and set verifiedTaskId on the rendered pack. Create the task first with moltnet_judge_pack_task_create.",
 		parameters: Type.Object({
-			renderedPackId: Type.String({ description: "Rendered pack ID" }),
-			nonce: Type.Optional(Type.String({ description: "Verification nonce from moltnet_rendered_pack_verify. If set, runs proctored mode and submits scores. If omitted, runs local mode and does not submit." })),
-			rubric: Type.Optional(Type.String({ description: "Custom rubric override (local mode only). Defaults to the built-in rubric when omitted." }))
+			taskId: Type.String({ description: "judge_pack task ID from moltnet_judge_pack_task_create" }),
+			rubricOverride: Type.Optional(Type.String({ description: "Freeform rubric string override for the LLM judge prompt. When omitted the task rubric preamble (or built-in default) is used." }))
 		}),
 		async execute(_id, params, _signal, _onUpdate, ctx) {
 			const { agent } = ensureConnected(config);
 			const model = ctx?.model;
 			if (!model) throw new Error("No active model in pi session — cannot run the fidelity judge.");
-			let sourceEntriesMd;
-			let renderedContent;
-			let rubric;
-			if (params.nonce) {
-				if (params.rubric) throw new Error("`rubric` is only supported in local mode (omit `nonce`).");
-				const claim = await agent.packs.claimVerification(params.renderedPackId);
-				sourceEntriesMd = buildSourceEntriesMarkdown(claim.sourceEntries);
-				renderedContent = claim.renderedContent;
-				rubric = claim.rubric?.trim() ? claim.rubric : DEFAULT_RUBRIC;
-			} else {
-				const rendered = await agent.packs.getRendered(params.renderedPackId);
-				if (!rendered.content?.trim()) throw new Error(`rendered pack ${params.renderedPackId} has empty content`);
-				const sourcePack = await agent.packs.get(rendered.sourcePackId, { expand: "entries" });
-				if (!sourcePack.entries || sourcePack.entries.length === 0) throw new Error(`source pack ${rendered.sourcePackId} has no entries`);
-				sourceEntriesMd = buildSourceEntriesMarkdown(sourcePack.entries.map((entry) => ({
-					title: entry.entry.title,
-					content: entry.entry.content
-				})));
-				renderedContent = rendered.content;
-				rubric = params.rubric?.trim() ? params.rubric : DEFAULT_RUBRIC;
-			}
+			const claimed = await agent.tasks.claim(params.taskId);
+			const input = claimed.task.input;
+			const rendered = await agent.packs.getRendered(input.renderedPackId);
+			if (!rendered.content?.trim()) throw new Error(`rendered pack ${input.renderedPackId} has empty content`);
+			const sourcePack = await agent.packs.get(input.sourcePackId, { expand: "entries" });
+			if (!sourcePack.entries || sourcePack.entries.length === 0) throw new Error(`source pack ${input.sourcePackId} has no entries`);
+			const sourceEntriesMd = buildSourceEntriesMarkdown(sourcePack.entries.map((entry) => ({
+				title: entry.entry.title,
+				content: entry.entry.content
+			})));
+			const rubric = params.rubricOverride?.trim() || input.rubric?.preamble?.trim() || DEFAULT_RUBRIC;
 			let scores;
 			try {
 				scores = await runFidelityJudge({
 					model,
 					sourceEntries: sourceEntriesMd,
-					renderedContent,
+					renderedContent: rendered.content,
 					rubric
 				});
 			} catch (err) {
+				await agent.tasks.fail(params.taskId, claimed.attempt.attemptN, { error: {
+					code: "judge_failed",
+					message: err.message ?? String(err)
+				} }).catch(() => {});
 				throw new Error(`judge failed: ${err.message ?? String(err)}`);
 			}
-			if (!params.nonce) return {
-				content: [{
-					type: "text",
-					text: JSON.stringify({
-						mode: "local",
-						renderedPackId: params.renderedPackId,
-						scores
-					}, null, 2)
-				}],
-				details: {}
+			const modelId = model.provider && model.id ? `${model.provider}:${model.id}` : model.id ?? "pi:unknown";
+			const output = {
+				scores: [
+					{
+						criterionId: "coverage",
+						score: scores.coverage
+					},
+					{
+						criterionId: "grounding",
+						score: scores.grounding
+					},
+					{
+						criterionId: "faithfulness",
+						score: scores.faithfulness
+					}
+				],
+				composite: scores.composite,
+				verdict: scores.reasoning,
+				judgeModel: modelId
 			};
-			const recipe = computePiJudgeRecipeCid({
-				judgePrompt: JUDGE_SYSTEM_PROMPT,
-				rubric,
-				promptAsset: JUDGE_PROMPT_ASSET_PATH,
-				rubricAsset: RUBRIC_ASSET_PATH
-			});
-			const providerName = model.provider ?? "pi";
-			const modelId = model.id ?? "unknown";
-			const submit = await agent.packs.submitVerification(params.renderedPackId, {
-				nonce: params.nonce,
-				coverage: scores.coverage,
-				grounding: scores.grounding,
-				faithfulness: scores.faithfulness,
-				transcript: scores.reasoning,
-				judgeModel: modelId,
-				judgeProvider: providerName,
-				judgeBinaryCid: recipe.cid
+			const outputCid = await computeJsonCid(output);
+			const completed = await agent.tasks.complete(params.taskId, claimed.attempt.attemptN, {
+				output,
+				outputCid,
+				usage: {
+					inputTokens: 0,
+					outputTokens: 0
+				}
 			});
+			await agent.packs.updateRendered(input.renderedPackId, { verifiedTaskId: params.taskId });
 			return {
 				content: [{
 					type: "text",
 					text: JSON.stringify({
-						mode: "proctored",
-						renderedPackId: params.renderedPackId,
+						renderedPackId: input.renderedPackId,
+						taskId: params.taskId,
 						scores,
-						submission: submit,
-						judgeRecipeCid: recipe.cid,
-						judgeRecipeManifest: recipe.manifest
+						task: completed
 					}, null, 2)
 				}],
 				details: {}
@@ -8081,7 +7855,7 @@ function createMoltNetTools(config) {
 		renderPack,
 		listRenderedPacks,
 		getRenderedPack,
-		verifyRenderedPack,
+		createJudgePackTask,
 		judgeRenderedPack,
 		diaryTags,
 		listEntries,
@@ -8697,6 +8471,135 @@ function ensureRelativeWorktreePaths(gitconfig) {
 	return `${gitconfig}${gitconfig.endsWith("\n") ? "" : "\n"}[worktree]\n\tuseRelativePaths = true\n`;
 }
 //#endregion
+//#region src/moltnet/judge-recipe-cid.ts
+var require = createRequire(import.meta.url);
+var SELF_PACKAGE_NAME = "@themoltnet/pi-extension";
+var PI_PACKAGE_NAME = "@mariozechner/pi-coding-agent";
+var SDK_PACKAGE_NAME = "@themoltnet/sdk";
+var CID_VERSION = 1;
+var RAW_CODEC = 85;
+var SHA2_256_CODE = 18;
+var BASE32_ALPHABET = "abcdefghijklmnopqrstuvwxyz234567";
+function findSelfPackageDir() {
+	const start = path.dirname(fileURLToPath(import.meta.url));
+	let dir = start;
+	while (true) {
+		const candidate = path.join(dir, "package.json");
+		if (existsSync(candidate)) {
+			if (JSON.parse(readFileSync(candidate, "utf8")).name === SELF_PACKAGE_NAME) return dir;
+		}
+		const parent = path.dirname(dir);
+		if (parent === dir) return start;
+		dir = parent;
+	}
+}
+var PACKAGE_DIR = findSelfPackageDir();
+function sha256Hex(value) {
+	return createHash("sha256").update(value, "utf8").digest("hex");
+}
+function encodeVarint(value) {
+	const bytes = [];
+	let current = value >>> 0;
+	while (current >= 128) {
+		bytes.push(current & 127 | 128);
+		current >>>= 7;
+	}
+	bytes.push(current);
+	return bytes;
+}
+function base32Lower(bytes) {
+	let bits = 0;
+	let value = 0;
+	let output = "";
+	for (const byte of bytes) {
+		value = value << 8 | byte;
+		bits += 8;
+		while (bits >= 5) {
+			output += BASE32_ALPHABET[value >>> bits - 5 & 31];
+			bits -= 5;
+		}
+	}
+	if (bits > 0) output += BASE32_ALPHABET[value << 5 - bits & 31];
+	return `b${output}`;
+}
+function stableStringify(value) {
+	if (value === null || typeof value !== "object") return JSON.stringify(value);
+	if (Array.isArray(value)) return `[${value.map((item) => stableStringify(item)).join(",")}]`;
+	return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${stableStringify(item)}`).join(",")}}`;
+}
+function readPackageVersion(pkgPath, expectedName) {
+	if (!existsSync(pkgPath)) return null;
+	const parsed = JSON.parse(readFileSync(pkgPath, "utf8"));
+	if (expectedName && parsed.name !== expectedName) return null;
+	return typeof parsed.version === "string" ? parsed.version : null;
+}
+function resolveInstalledPackageVersion(packageName) {
+	const candidates = [];
+	try {
+		candidates.push(path.dirname(require.resolve(packageName)));
+	} catch {}
+	let dir = PACKAGE_DIR;
+	while (true) {
+		candidates.push(path.join(dir, "node_modules", packageName));
+		const parent = path.dirname(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+	for (const start of candidates) {
+		let current = start;
+		while (true) {
+			const version = readPackageVersion(path.join(current, "package.json"), packageName);
+			if (version) return version;
+			const parent = path.dirname(current);
+			if (parent === current) break;
+			current = parent;
+		}
+	}
+	return null;
+}
+function resolvePiJudgeRecipeVersions() {
+	return {
+		pi: resolveInstalledPackageVersion(PI_PACKAGE_NAME),
+		piExtension: readPackageVersion(path.join(PACKAGE_DIR, "package.json"), SELF_PACKAGE_NAME),
+		sdk: resolveInstalledPackageVersion(SDK_PACKAGE_NAME)
+	};
+}
+function buildPiJudgeRecipeManifest(inputs) {
+	return {
+		kind: "pi-judge-recipe/v1",
+		versions: {
+			...resolvePiJudgeRecipeVersions(),
+			...inputs.overrides
+		},
+		assets: {
+			promptAsset: inputs.promptAsset ?? null,
+			rubricAsset: inputs.rubricAsset ?? null,
+			skillSourcePath: inputs.skillSourcePath ?? null
+		},
+		hashes: {
+			judgePromptSha256: sha256Hex(inputs.judgePrompt),
+			rubricSha256: sha256Hex(inputs.rubric),
+			skillFragmentSha256: inputs.skillFragment ? sha256Hex(inputs.skillFragment) : null,
+			implementationSha256: inputs.implementationSource ? sha256Hex(inputs.implementationSource) : null
+		}
+	};
+}
+function computePiJudgeRecipeCid(inputs) {
+	const manifest = buildPiJudgeRecipeManifest(inputs);
+	const manifestBytes = Buffer.from(stableStringify(manifest), "utf8");
+	const digestBytes = createHash("sha256").update(manifestBytes).digest();
+	return {
+		cid: base32Lower(Uint8Array.from([
+			...encodeVarint(CID_VERSION),
+			...encodeVarint(RAW_CODEC),
+			...encodeVarint(SHA2_256_CODE),
+			...encodeVarint(digestBytes.length),
+			...digestBytes
+		])),
+		manifest
+	};
+}
+//#endregion
 //#region ../tasks/src/formats.ts
 /**
 * Register TypeBox string formats used across Task / TaskOutput / task-type
@@ -10001,6 +9904,7 @@ async function executePiTask(claimedTask, reporter, opts) {
 		sandboxConfig: opts.sandboxConfig
 	});
 	const diaryId = task.diaryId ?? "";
+	const taskTeamId = task.teamId ?? "";
 	let reporterOpen = false;
 	let session = null;
 	const finalUsage = emptyUsage(opts.provider, opts.model);
@@ -10063,6 +9967,7 @@ async function executePiTask(claimedTask, reporter, opts) {
 			const moltnetTools = createMoltNetTools({
 				getAgent: () => moltnetAgent,
 				getDiaryId: () => diaryId,
+				getTeamId: () => taskTeamId,
 				getSessionErrors: () => [],
 				clearSessionErrors: () => {},
 				getHostCwd: () => mountPath,
@@ -10281,6 +10186,7 @@ function moltnetExtension(pi) {
 	let worktreePath = null;
 	let moltnetAgent = null;
 	let diaryId = null;
+	let teamId = null;
 	let hostExecBaseEnv = HOST_EXEC_DEFAULT_BASE_ENV;
 	async function ensureVm(ctx) {
 		if (vm) return vm;
@@ -10335,6 +10241,7 @@ function moltnetExtension(pi) {
 			activateAgentEnv(managed.credentials.agentEnv, mainRepo);
 			moltnetAgent = await connect({ configDir: managed.agentDir });
 			diaryId = managed.credentials.agentEnv.MOLTNET_DIARY_ID ?? null;
+			teamId = managed.credentials.agentEnv.MOLTNET_TEAM_ID ?? null;
 			hostExecBaseEnv = new Set([...HOST_EXEC_DEFAULT_BASE_ENV, ...Object.keys(managed.credentials.agentEnv)]);
 			vm = managed.vm;
 			const label = worktreePath ? `${mountPath} → ${GUEST_WORKSPACE}` : `${localCwd} → ${GUEST_WORKSPACE}`;
@@ -10356,6 +10263,7 @@ function moltnetExtension(pi) {
 			vm = null;
 			vmStarting = null;
 			moltnetAgent = null;
+			teamId = null;
 		}
 	});
 	pi.on("before_agent_start", async (event, ctx) => {
@@ -10395,6 +10303,7 @@ function moltnetExtension(pi) {
 	const moltnetTools = createMoltNetTools({
 		getAgent: () => moltnetAgent,
 		getDiaryId: () => diaryId,
+		getTeamId: () => teamId,
 		getSessionErrors: () => sessionErrors,
 		clearSessionErrors: () => {
 			sessionErrors.length = 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/pi-extension",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "type": "module",
   "description": "MoltNet pi extension — sandboxed tool execution in Gondolin VMs with MoltNet identity and persistent memory",
   "license": "MIT",
@@ -30,8 +30,8 @@
   "dependencies": {
     "@earendil-works/gondolin": "^0.7.0",
     "@sinclair/typebox": "^0.34.0",
-    "@themoltnet/sdk": "0.94.0",
-    "@themoltnet/agent-runtime": "0.2.0"
+    "@themoltnet/agent-runtime": "0.2.1",
+    "@themoltnet/sdk": "0.95.0"
   },
   "peerDependencies": {
     "@mariozechner/pi-coding-agent": ">=0.67.0",