@themoltnet/pi-runtime 0.10.1 → 0.12.0

package/dist/index.d.ts

@@ -1,25 +1,47 @@
+import { activateAgentEnv } from '@themoltnet/sandbox-gondolin';
 import { Agent } from '@themoltnet/sdk';
 import { AgentSession } from '@earendil-works/pi-coding-agent';
 import { Api } from '@earendil-works/pi-ai';
+import { assertGuestEnvironmentBoundary } from '@themoltnet/sandbox-gondolin';
+import { assertHostAuthenticatedGuestEnvironment } from '@themoltnet/sandbox-gondolin';
 import { BashOperations } from '@earendil-works/pi-coding-agent';
+import { BrokeredHttpSecretBinding } from '@themoltnet/sandbox-gondolin';
+import { BrokeredHttpSecretBoundaryError } from '@themoltnet/sandbox-gondolin';
+import { BrokeredHttpSecretDescriptor } from '@themoltnet/sandbox-gondolin';
 import { ClaimedTask } from '@themoltnet/agent-runtime';
 import { CommandAnalysis } from '@themoltnet/shell-command-analyzer';
 import { connect } from '@themoltnet/sdk';
 import { Context } from '@opentelemetry/api';
-import { ContextRef } from '@themoltnet/agent-runtime';
 import { EditOperations } from '@earendil-works/pi-coding-agent';
+import { ensureSnapshot } from '@themoltnet/sandbox-gondolin';
+import { EnsureSnapshotOptions } from '@themoltnet/sandbox-gondolin';
 import { ExtensionAPI } from '@earendil-works/pi-coding-agent';
+import { findMainWorktree } from '@themoltnet/sandbox-gondolin';
 import { FindOperations } from '@earendil-works/pi-coding-agent';
+import { GONDOLIN_BASE_EXECUTABLES } from '@themoltnet/sandbox-gondolin';
 import { GrepToolDetails } from '@earendil-works/pi-coding-agent';
 import { GrepToolInput } from '@earendil-works/pi-coding-agent';
+import { GuestCredentialMode } from '@themoltnet/sandbox-gondolin';
+import { GuestEnvironmentBoundaryError } from '@themoltnet/sandbox-gondolin';
+import { HostCapabilityContribution } from '@themoltnet/agent-runtime';
+import { HostCapabilityEvidenceLogger } from '@themoltnet/agent-runtime';
+import { HostCapabilityManifestEntry } from '@themoltnet/agent-runtime';
+import { isResolvedPathInsideRoot } from '@themoltnet/sandbox-gondolin';
+import { loadCredentials } from '@themoltnet/sandbox-gondolin';
 import { LoadSkillsResult } from '@earendil-works/pi-coding-agent';
 import { LsOperations } from '@earendil-works/pi-coding-agent';
+import { ManagedVm } from '@themoltnet/sandbox-gondolin';
 import { Model } from '@earendil-works/pi-ai';
 import { ModelRegistry } from '@earendil-works/pi-coding-agent';
+import { prepareBrokeredHttpSecrets } from '@themoltnet/sandbox-gondolin';
+import { ProviderAuthSource } from '@themoltnet/sandbox-gondolin';
 import { Readable } from 'node:stream';
 import { ReadOperations } from '@earendil-works/pi-coding-agent';
+import { ResumeCommand } from '@themoltnet/sandbox-gondolin';
+import { SandboxConfig } from '@themoltnet/sandbox-gondolin';
 import { ShellCommandAnalyzer } from '@themoltnet/shell-command-analyzer';
 import { Skill } from '@earendil-works/pi-coding-agent';
+import { SnapshotConfig } from '@themoltnet/sandbox-gondolin';
 import { Static } from 'typebox';
 import { SubagentContractRegistry } from '@themoltnet/agent-runtime';
 import { TaskOutput } from '@themoltnet/agent-runtime';
@@ -29,13 +51,68 @@ import { ToolCallEvent } from '@earendil-works/pi-coding-agent';
 import { ToolDefinition } from '@earendil-works/pi-coding-agent';
 import { Type } from 'typebox';
 import { VM } from '@earendil-works/gondolin';
+import { VmConfig } from '@themoltnet/sandbox-gondolin';
+import { VmCredentials } from '@themoltnet/sandbox-gondolin';
+import { VmDiagnostic } from '@themoltnet/sandbox-gondolin';
 import { WriteOperations } from '@earendil-works/pi-coding-agent';
 
+export { activateAgentEnv }
+
+/**
+ * Non-secret identity of the agent a daemon runs as. Everything here may be
+ * projected into a sandbox guest; nothing here can sign.
+ */
+declare interface AgentIdentity {
+    agentName: string;
+    identityId: string;
+    /** `ed25519:<base64>` */
+    publicKey: string;
+    fingerprint: string;
+    gitName: string;
+    gitEmail: string;
+}
+
+/**
+ * The seam between key storage and everything that needs a signature.
+ *
+ * Implementations hold (or proxy to) the Ed25519 identity key; consumers never
+ * see key material. The operations are purpose-bound on purpose: there is no
+ * "sign these bytes" method, so a broker exposing this interface cannot be
+ * turned into a general signing oracle.
+ */
+declare interface AgentSigningCapability {
+    readonly identity: AgentIdentity;
+    /** Sign a pending MoltNet signing request owned by this identity. */
+    signDiaryEntry(input: {
+        signingRequestId: string;
+    }): Promise<{
+        signingRequestId: string;
+    }>;
+    /**
+     * Sign a validated SSHSIG envelope in the `git` namespace. The enforceable
+     * boundary is the namespace, which covers every git object signature
+     * (commits and tags); it is not commit-only.
+     */
+    signGitCommit(input: {
+        sshsig: Uint8Array;
+    }): Promise<{
+        /** Raw 64-byte Ed25519 signature over the envelope. */
+        signature: Uint8Array;
+    }>;
+}
+
 /**
- * Apply agent env vars to the host process, mirroring `moltnet start`.
- * Resolves relative paths (e.g. GIT_CONFIG_GLOBAL) against the repo root.
+ * Stock signing capability: the guest keeps `git commit -S` and
+ * `moltnet entry create-signed`; signatures are produced on the host through
+ * the injected `AgentSigningCapability`. The guest receives only the signer
+ * origin, an ssh-agent socket served by the CLI, and a non-secret gitconfig.
  */
-export declare function activateAgentEnv(agentEnv: Record<string, string | undefined>, repoRoot: string): void;
+export declare const agentSigningCapability: HostCapabilityContribution<AgentSigningInjected>;
+
+/** State the daemon injects for this capability. */
+declare interface AgentSigningInjected {
+    signer: AgentSigningCapability;
+}
 
 /** Minimal shape of the SDK method the resolver needs (keeps deps testable). */
 export declare interface AllowedToolsClient {
@@ -55,17 +132,15 @@ export declare interface AllowedToolsClient {
     };
 }
 
-export declare function assertGuestEnvironmentBoundary(options: {
-    guestCredentialMode: GuestCredentialMode;
-    forwardEnv?: readonly string[];
-    sandboxEnv?: Readonly<Record<string, string>>;
-}): void;
+export { assertGuestEnvironmentBoundary }
+
+export { assertHostAuthenticatedGuestEnvironment }
+
+export { BrokeredHttpSecretBinding }
 
-/** @deprecated Prefer assertGuestEnvironmentBoundary for mode-aware checks. */
-export declare function assertHostAuthenticatedGuestEnvironment(options: {
-    forwardEnv?: readonly string[];
-    sandboxEnv?: Readonly<Record<string, string>>;
-}): void;
+export { BrokeredHttpSecretBoundaryError }
+
+export { BrokeredHttpSecretDescriptor }
 
 /**
  * Construct an `AgentSession`. By default it is in-memory; callers may opt
@@ -157,6 +232,46 @@ export declare function buildRuntimeKernel(ctx: RuntimeInstructorContext): strin
 
 export declare function buildWorkspaceMountInstructions(guestWorkspace: string): string;
 
+declare const CONTEXT_BINDINGS: readonly ["skill", "context_inline", "prompt_prefix", "user_inline"];
+
+declare type ContextBinding = (typeof CONTEXT_BINDINGS)[number];
+
+declare const ContextBinding: Type.TUnsafe<"skill" | "context_inline" | "prompt_prefix" | "user_inline">;
+
+/**
+ * One context entry. Bytes are inlined: the proposer chose them, and the
+ * task's `inputCid` already pins the entire input — including
+ * `context[]` — so we don't need a separate per-entry hash, fetcher, or
+ * flagged-content gate. Tasks reference rendered packs (or any other
+ * external content) by copying their bytes into `content` at task
+ * creation time.
+ *
+ * - `slug` — short identifier the daemon uses to disambiguate
+ *            entries. For `skill` binding it becomes the directory
+ *            name under the runtime's skill discovery path. Must be
+ *            kebab-case-safe (alphanumeric + dashes/underscores).
+ * - `binding` — how the bytes are delivered to the LLM (see above).
+ * - `content` — UTF-8 text. Capped at 65,536 UTF-16 code units per
+ *               entry; total per-task context bytes are bounded by the
+ *               soft `maxItems` cap and per-binding daemon limits.
+ *               Raised from 32 KiB in 2026-05 — protocol-heavy operator
+ *               skills (e.g. `.claude/skills/legreffier/SKILL.md`) ship
+ *               at ~35 KiB inline, and the original cap was sized for
+ *               short example skills, not the kind of skill the eval
+ *               substrate is dogfooded on (#943, #823).
+ */
+declare const ContextRef: Type.TObject<{
+    slug: Type.TString;
+    binding: Type.TUnsafe<"skill" | "context_inline" | "prompt_prefix" | "user_inline">;
+    content: Type.TString;
+}>;
+
+declare type ContextRef = {
+    slug: string;
+    binding: ContextBinding;
+    content: string;
+};
+
 export declare function createGondolinBashOps(vm: VM, localCwd: string, guestWorkspace: string): BashOperations;
 
 export declare function createGondolinEditOps(vm: VM, localCwd: string, guestWorkspace: string): EditOperations;
@@ -340,6 +455,8 @@ export declare function decideForEvent(event: ToolCallEvent, policy: SessionTool
  */
 export declare function decideToolCall(input: GateInput): GateDecision;
 
+export declare const DEFAULT_BROKERED_HTTP_SECRET_RESOLUTION_TIMEOUT_MS = 30000;
+
 export declare function defineGondolinTemplate(options: DefineGondolinTemplateOptions): GondolinTemplateDefinition;
 
 export declare interface DefineGondolinTemplateOptions {
@@ -353,6 +470,17 @@ export declare interface DefineGondolinTemplateOptions {
     resumeCommands?: readonly ResumeCommand[];
 }
 
+/**
+ * Declare a value-free HTTP credential requirement in trusted runtime code.
+ * The resolver runs per attempt on the daemon host; its return value is never
+ * added to the runtime definition or executor manifest.
+ */
+export declare function definePiBrokeredHttpSecret(options: DefinePiBrokeredHttpSecretOptions): PiBrokeredHttpSecretContribution;
+
+export declare interface DefinePiBrokeredHttpSecretOptions extends BrokeredHttpSecretDescriptor {
+    resolve: (context: PiBrokeredHttpSecretResolveContext) => string | undefined | Promise<string | undefined>;
+}
+
 export declare function definePiExtension(options: PiExtensionOptions): PiExtensionContribution;
 
 export declare function definePiRuntime(options: DefinePiRuntimeOptions): PiRuntimeDefinition;
@@ -362,6 +490,8 @@ export declare interface DefinePiRuntimeOptions {
     version: string;
     runtimeKind?: string;
     vm: GondolinTemplateDefinition;
+    brokeredHttpSecrets?: readonly PiBrokeredHttpSecretContribution[];
+    hostCapabilities?: readonly HostCapabilityContribution<never>[];
     tools?: readonly PiToolContribution[];
     extensions?: readonly PiExtensionContribution[];
 }
@@ -378,18 +508,9 @@ export declare function enabledPiToolNames(input: {
     policy?: ModelVisibleToolPolicy;
 }): string[] | undefined;
 
-/**
- * Ensure a cached snapshot exists, building one if needed.
- * Returns the absolute path to the qcow2 checkpoint file.
- */
-export declare function ensureSnapshot(options?: EnsureSnapshotOptions): Promise<string>;
+export { ensureSnapshot }
 
-export declare interface EnsureSnapshotOptions {
-    config?: SnapshotConfig;
-    onProgress?: (message: string) => void;
-    /** Max number of old snapshots to keep (default 1). */
-    maxCached?: number;
-}
+export { EnsureSnapshotOptions }
 
 export declare function executeGondolinGrep(vm: VM, localCwd: string, guestWorkspace: string, params: GrepToolInput, signal?: AbortSignal): Promise<TextToolResult<GrepToolDetails>>;
 
@@ -467,6 +588,8 @@ export declare interface ExecutePiTaskOptions {
     onSnapshotProgress?: (message: string) => void;
     /** Structured VM credential-boundary diagnostics. */
     onVmDiagnostic?: (diagnostic: VmDiagnostic) => void;
+    /** Internal VM-resume seam for executor integration tests. */
+    resumeVm?: typeof resumeVm;
     /**
      * Optional pre-resolved checkpoint path. If omitted, `ensureSnapshot` is
      * invoked. Useful for batch execution where the caller wants to cache
@@ -589,6 +712,15 @@ export declare interface ExecutePiTaskOptions {
     toolPolicyLogger?: ToolPolicyLogger;
     /** Trusted, statically imported operator runtime contributions. */
     runtimeDefinition?: PiRuntimeDefinition;
+    /**
+     * Host-side signing capability injected by the daemon for host capabilities
+     * (never built from key material inside the runtime).
+     */
+    hostCapabilitySigner?: AgentSigningCapability;
+    /** Non-secret agent identity projected to the guest by host capabilities. */
+    agentIdentity?: AgentIdentity;
+    /** Evidence logger for host capability decisions (defaults to the tool-policy logger). */
+    hostCapabilityLogger?: HostCapabilityEvidenceLogger;
     /**
      * Pre-resolved local VM template. Daemons resolve this before polling so
      * profile requirements and executor attestation can be checked before claim.
@@ -600,11 +732,7 @@ export declare interface ExecutePiTaskOptions {
 
 export declare function filterModelVisibleTools(tools: readonly ToolDefinition[], policy?: ModelVisibleToolPolicy): ToolDefinition[];
 
-/**
- * Resolve the main worktree root (where .moltnet/ lives — it's untracked,
- * only exists in the main worktree, not in git worktrees).
- */
-export declare function findMainWorktree(startPath?: string): string;
+export { findMainWorktree }
 
 export declare type GateDecision = {
     allow: true;
@@ -641,8 +769,7 @@ export declare interface GateInput {
     analyze: (command: string) => CommandAnalysis;
 }
 
-/** Commands guaranteed by the base Gondolin snapshot. */
-export declare const GONDOLIN_BASE_EXECUTABLES: readonly string[];
+export { GONDOLIN_BASE_EXECUTABLES }
 
 export declare const GONDOLIN_TOOL_NAMES: readonly ["read", "write", "edit", "bash", "ls", "find", "grep"];
 
@@ -659,12 +786,15 @@ export declare interface GondolinTemplateResolveContext {
     onProgress?: (message: string) => void;
 }
 
-export declare type GuestCredentialMode = 'guest-config' | 'host-authenticated';
+export declare const GUEST_ALLOWED_SIGNERS_PATH = "/home/agent/.config/moltnet/allowed_signers";
 
-export declare class GuestEnvironmentBoundaryError extends Error {
-    readonly refusedNames: readonly string[];
-    constructor(refusedNames: readonly string[]);
-}
+export declare const GUEST_GITCONFIG_PATH = "/home/agent/.config/moltnet/gitconfig";
+
+export declare const GUEST_SIGNER_SOCKET = "/run/moltnet/signer.sock";
+
+export { GuestCredentialMode }
+
+export { GuestEnvironmentBoundaryError }
 
 /**
  * Baseline env keys forwarded to host-exec child processes.
@@ -715,27 +845,13 @@ export declare interface InjectTaskContextArgs {
 
 export declare function isKernelTool(name: string): boolean;
 
-/**
- * Check containment for already-resolved lexical or real paths.
- *
- * Callers that accept untrusted paths must resolve/realpath at their I/O
- * boundary first; keeping the platform-specific relative-path rule here avoids
- * subtly different `..` and absolute-path handling across runtime cleanup,
- * session sync, and artifact staging.
- */
-export declare function isResolvedPathInsideRoot(path: string, root: string): boolean;
+export { isResolvedPathInsideRoot }
 
 export declare function isToolVisible(name: string, policy?: ModelVisibleToolPolicy): boolean;
 
-export declare function loadCredentials(agentDir: string, mode?: GuestCredentialMode, onDiagnostic?: (diagnostic: VmDiagnostic) => void): VmCredentials;
+export { loadCredentials }
 
-export declare interface ManagedVm {
-    vm: VM;
-    credentials: VmCredentials;
-    mountPath: string;
-    guestWorkspace: string;
-    agentDir: string;
-}
+export { ManagedVm }
 
 declare interface MatchedShellCommand {
     executable: string;
@@ -743,6 +859,13 @@ declare interface MatchedShellCommand {
     argvPrefixLength: number;
 }
 
+export declare function materializePiBrokeredHttpSecrets(input: {
+    runtime: PiRuntimeDefinition;
+    context: Omit<PiBrokeredHttpSecretResolveContext, 'signal'>;
+    signal?: AbortSignal;
+    timeoutMs?: number;
+}): Promise<BrokeredHttpSecretBinding[]>;
+
 export declare function materializePiExtensions(input: {
     runtime: PiRuntimeDefinition;
     context: PiToolContext;
@@ -849,6 +972,11 @@ export declare interface MoltNetToolsConfig {
      * entry creation behaves as before (env-derived diary, no auto-tags).
      */
     getTaskContext?(): MoltNetTaskContext | null;
+    /**
+     * Host-side signing capability, when the daemon injected one. Enables
+     * `signed: true` on `moltnet_create_entry`; the guest never sees the key.
+     */
+    getSigner?(): AgentSigningCapability | null;
     /** Records recoverable task-provenance failures without ending the task. */
     onTaskProvenanceEvent?(event: 'task.provenance.entry_denied', details: {
         taskId: string;
@@ -861,8 +989,31 @@ export declare function normalizeRetryTriageResult(value: unknown): PiRetryTriag
 
 export declare const PI_EXECUTOR_MANIFEST_VERSION: "moltnet:executor-manifest:v1";
 
+/** Guest path where Pi expects its auth blob. */
+export declare const PI_GUEST_AUTH_PATH = "/home/agent/.pi/agent/auth.json";
+
 export declare const PI_RUNTIME_DEFINITION_VERSION = "moltnet:pi-runtime:v1";
 
+export declare interface PiBrokeredHttpSecretContribution {
+    readonly kind: 'brokered_http_secret';
+    readonly descriptor: BrokeredHttpSecretDescriptor;
+    readonly resolve: (context: PiBrokeredHttpSecretResolveContext) => string | undefined | Promise<string | undefined>;
+}
+
+export declare class PiBrokeredHttpSecretResolutionError extends Error {
+    readonly requirementId: string;
+    readonly retryable: boolean;
+    constructor(requirementId: string, message: string, retryable: boolean);
+}
+
+export declare interface PiBrokeredHttpSecretResolveContext {
+    agentName: string;
+    claimedTask: ClaimedTask;
+    cwdPath: string;
+    /** Cancelled when the attempt stops or the resolver exceeds its deadline. */
+    signal: AbortSignal;
+}
+
 export declare interface PiExecutorManifest {
     schemaVersion: typeof PI_EXECUTOR_MANIFEST_VERSION;
     runtime: {
@@ -882,6 +1033,17 @@ export declare interface PiExecutorManifest {
         templateFingerprint: string;
         guestAssetBuildId: string;
     };
+    /** Optional v1 extension, emitted only when requirements are declared. */
+    brokeredHttpSecrets?: {
+        id: string;
+        guestEnv: string;
+        hosts: readonly string[];
+        protocol: 'https' | 'http';
+        ports: readonly number[];
+        required: boolean;
+    }[];
+    /** Optional v1 extension, emitted only when capabilities are declared. */
+    hostCapabilities?: HostCapabilityManifestEntry[];
     tools: {
         name: string;
         descriptorCid: string | null;
@@ -930,6 +1092,13 @@ export declare interface PiOtelOptions {
     onSessionContextChange?: (context: Context | undefined) => void;
 }
 
+/**
+ * Pi's provider authentication as a sandbox `ProviderAuthSource`. CI writes
+ * `auth.json` under `PI_CODING_AGENT_DIR`; local runs fall back to the
+ * canonical `~/.pi/agent` dir when the override is unset.
+ */
+export declare function piProviderAuth(): ProviderAuthSource;
+
 export declare type PiRetryTriage = (input: PiRetryTriageInput) => Promise<PiRetryTriageResult>;
 
 export declare type PiRetryTriageConfidence = RetryTriageConfidence;
@@ -968,6 +1137,10 @@ export declare interface PiRuntimeDefinition {
     readonly version: string;
     readonly runtimeKind: string;
     readonly vm: GondolinTemplateDefinition;
+    /** Optional v1 extension; absent on independently packaged legacy runtimes. */
+    readonly brokeredHttpSecrets?: readonly PiBrokeredHttpSecretContribution[];
+    /** Optional v1 extension: host capabilities served to the guest. */
+    readonly hostCapabilities?: readonly HostCapabilityContribution<never>[];
     readonly tools: readonly PiToolContribution[];
     readonly extensions: readonly PiExtensionContribution[];
 }
@@ -1074,6 +1247,10 @@ declare interface PiWorkspaceSeedPlan {
     source: 'producer';
 }
 
+export { prepareBrokeredHttpSecrets }
+
+export { ProviderAuthSource }
+
 export declare interface ProviderErrorRetryEvent extends Record<string, unknown> {
     event: 'provider_error_retry';
     retry: number;
@@ -1149,31 +1326,11 @@ declare interface ResolveSessionToolPolicyInput {
 
 export declare function resolveTaskWorktreePath(mainRepo: string, workspaceId: string): string;
 
-export declare interface ResumeCommand {
-    /** Shell command, same semantics as the string form. */
-    run: string;
-    /** Optional generic runtime predicate for whether this step should run. */
-    when?: ResumeCommandWhen;
-    /** Additional attempts on non-zero exit. Default 0. */
-    retries?: number;
-    /** Linear backoff between attempts in ms. Delay before attempt N+1 is
-     *  `(N + 1) * retryBackoffMs` (so 2s, 4s, … with the default). */
-    retryBackoffMs?: number;
-}
-
-/** Structured form of a resume command with optional retry policy. */
-declare interface ResumeCommandWhen {
-    /**
-     * Effective workspace mode(s) that should run this command.
-     * Evaluated by the runtime from the mounted workspace shape rather than
-     * from task type semantics.
-     */
-    workspaceMode?: ('shared_mount' | 'dedicated_worktree' | 'scratch_mount')[];
-}
+export { ResumeCommand }
 
 /**
- * Resume a VM from a checkpoint, inject credentials, configure egress +
- * TLS. Returns the managed VM handle.
+ * Resume a Gondolin VM for a Pi session. Identical to the sandbox package's
+ * `resumeVm`, with Pi's provider auth supplied unless the caller overrides it.
  */
 export declare function resumeVm(config: VmConfig): Promise<ManagedVm>;
 
@@ -1204,6 +1361,20 @@ declare interface RuntimeInstructorSandbox {
     verifiedExecutables: readonly string[];
     allowedHosts: readonly string[];
     allowedInternalHosts: readonly string[];
+    /** Guest names containing host-brokered opaque HTTP placeholders. */
+    brokeredSecretEnvNames?: readonly string[];
+    /** Host capabilities served to the guest (attested in the manifest). */
+    hostCapabilities?: readonly {
+        name: string;
+        origin: string;
+        operations: readonly string[];
+    }[];
+    /**
+     * Guest credential mode. In `host-authenticated` the guest CLI carries no
+     * identity credentials, so REST-backed CLI paths (e.g. `moltnet entry
+     * create-signed`) cannot authenticate; host-side SDK tools must be used.
+     */
+    guestCredentialMode?: 'guest-config' | 'host-authenticated';
 }
 
 declare interface RuntimeInstructorToolPolicy {
@@ -1219,78 +1390,7 @@ declare interface RuntimeInstructorToolPolicy {
     degraded: boolean;
 }
 
-export declare interface SandboxConfig {
-    /**
-     * Operator-owned snapshot build settings. Runtime profiles must never
-     * populate this field.
-     */
-    snapshot?: {
-        /** Shell commands to run after the base setup. */
-        setupCommands?: string[];
-        /** Additional hosts to allow network access during build. */
-        allowedHosts?: string[];
-        /** Overlay disk size (default '3G'). */
-        overlaySize?: string;
-    };
-    /** Runtime network egress policy. Separate from snapshot build access. */
-    network?: {
-        /** Additional host patterns allowed while the VM is running.
-         * Internal and private address resolution remains blocked. */
-        allowedHosts?: string[];
-        /** Host patterns explicitly allowed to resolve to internal/private IPs. */
-        allowedInternalHosts?: string[];
-    };
-    /** Operator-owned shell commands to run every VM resume, after platform setup
-     *  (TLS, DNS, git safe.directory, tmpfs node_modules) and before
-     *  the agent session starts. Use for per-session bootstrap that
-     *  doesn't belong baked into the snapshot.
-     *
-     *  Not included in the snapshot cache key — changes here apply on
-     *  every resume without triggering a snapshot rebuild. Each command
-     *  runs in a fresh shell with `set -eu` and `set -o pipefail`; a
-     *  non-zero exit (including from any segment of a pipeline) aborts
-     *  resume with the failing command's stderr/stdout tail.
-     *
-     *  Each entry is either a raw string (no retries) or an object
-     *  `{ run, when?, retries?, retryBackoffMs? }`. `when` gates the
-     *  command on generic runtime properties such as effective
-     *  `workspaceMode`; this keeps sandbox policy decoupled from task
-     *  types. `retries` is the number of ADDITIONAL attempts after the
-     *  first failure (default 0 = no retry). Use for steps that hit the
-     *  network and may legitimately race DHCP/registry availability on a
-     *  fresh resume (e.g. `pnpm install`). The wrapped command must be
-     *  idempotent. */
-    resumeCommands?: (string | ResumeCommand)[];
-    /** VFS shadow settings — hide host paths from the guest. */
-    vfs?: {
-        /** Paths (relative to workspace root) to shadow from the host mount. */
-        shadow?: string[];
-        /** What to do with writes to shadowed paths: 'deny' or 'tmpfs' (default 'tmpfs'). */
-        shadowMode?: 'deny' | 'tmpfs';
-    };
-    /** Environment variable overrides for the guest VM (applied on top of defaults). */
-    env?: Record<string, string>;
-    /** Host-side escape hatch policy. Applies only to `moltnet_host_exec`. */
-    hostExec?: {
-        /**
-         * `true` auto-approves every allowed executable. An array auto-approves
-         * only commands matching one of the executable/argument rules.
-         */
-        autoApprove?: boolean | {
-            executable: string;
-            argsPrefix?: string[];
-            argsContains?: string[];
-            argsExcludes?: string[];
-        }[];
-    };
-    /** VM resource allocation. */
-    resources?: {
-        /** Memory size in qemu syntax (default '1G'). */
-        memory?: string;
-        /** CPU count (default 2). */
-        cpus?: number;
-    };
-}
+export { SandboxConfig }
 
 /** The resolved allow-set + enforcement mode for a runtime session. */
 export declare interface SessionToolPolicy {
@@ -1317,8 +1417,7 @@ declare interface ShellCommandRule {
     argvPrefix: readonly [string, string, ...string[]];
 }
 
-/** Extract snapshot-specific config for backwards compat with ensureSnapshot. */
-export declare type SnapshotConfig = NonNullable<SandboxConfig['snapshot']>;
+export { SnapshotConfig }
 
 export declare interface SubagentToolHandle {
     /** ToolDefinition to register via `customTools` on the parent session. */
@@ -1423,76 +1522,11 @@ export declare type TurnEventHandlerFactory = (claimedTask: ClaimedTask) => Turn
 
 export declare type TurnEventKind = Parameters<TaskReporter['record']>[0]['kind'];
 
-export declare interface VmConfig {
-    /** Absolute path to the qcow2 checkpoint. */
-    checkpointPath: string;
-    /** MoltNet agent name (used to resolve credentials). */
-    agentName: string;
-    /**
-     * Trust boundary for guest credentials. `guest-config` injects the complete
-     * legacy agent directory. `host-authenticated` never reads or injects it and
-     * relies exclusively on the supplied host-side Agent for MoltNet operations.
-     */
-    guestCredentialMode?: GuestCredentialMode;
-    /**
-     * Host root that owns `.moltnet/<agentName>/`.
-     *
-     * Defaults to the main git worktree for backwards compatibility. Daemon
-     * callers pass the sandbox root so non-git scratch/shared tasks can boot.
-     */
-    agentRootDir?: string;
-    /** Host directory to mount into the VM. */
-    mountPath: string;
-    /** Effective workspace shape selected by the caller. */
-    workspaceMode?: 'shared_mount' | 'dedicated_worktree' | 'scratch_mount';
-    /** Additional hosts to allow in egress policy. */
-    extraAllowedHosts?: string[];
-    /** Full sandbox config (vfs shadows, env overrides). */
-    sandboxConfig?: SandboxConfig;
-    /**
-     * Host environment variable names to copy into the VM process.
-     *
-     * Runtime profiles use this for provider API keys: `requiredEnv` proves the
-     * daemon host has the secret, and this allowlist forwards only those names
-     * into the guest without storing secret values in the profile.
-     */
-    forwardEnv?: string[];
-    /** Structured credential-boundary diagnostics for daemon loggers. */
-    onDiagnostic?: (diagnostic: VmDiagnostic) => void;
-    /** Abort resume/setup work, closing any live VM owned by resumeVm. */
-    signal?: AbortSignal;
-}
+export { VmConfig }
 
-export declare interface VmCredentials {
-    /** Empty in host-authenticated mode; retained as strings for API stability. */
-    moltnetJson: string;
-    /** Empty in host-authenticated mode; retained as strings for API stability. */
-    agentEnvRaw: string;
-    /**
-     * Pi OAuth/API-key auth blob. Null when neither `~/.pi/agent/auth.json`
-     * (resolved via `PI_CODING_AGENT_DIR` when set) is present — in that
-     * case the daemon relies on Pi's env-var providers (`ANTHROPIC_API_KEY`,
-     * etc.) carried via `agentEnv` and the host environment instead. CI uses
-     * this path.
-     */
-    piAuthJson: string | null;
-    agentEnv: Record<string, string | undefined>;
-    gitconfig: string | null;
-    sshPrivateKey: string | null;
-    sshPublicKey: string | null;
-    allowedSigners: string | null;
-    /** Raw PEM content of the GitHub App private key, or null if not configured. */
-    githubAppPem: string | null;
-    /** VM-local filename for the GitHub App PEM (basename of host path), or null. */
-    githubAppPemFilename: string | null;
-}
+export { VmCredentials }
 
-export declare interface VmDiagnostic {
-    event: 'vm.credentials.mode' | 'vm.credentials.github_key_missing';
-    level: 'info' | 'warning';
-    message: string;
-    credentialMode: GuestCredentialMode;
-}
+export { VmDiagnostic }
 
 /**
  * Subset of `@earendil-works/gondolin`'s `VmFs` we actually use. We