@themoltnet/pi-runtime 0.11.0 → 0.12.0

package/dist/index.d.ts

@@ -23,6 +23,9 @@ import { GrepToolDetails } from '@earendil-works/pi-coding-agent';
 import { GrepToolInput } from '@earendil-works/pi-coding-agent';
 import { GuestCredentialMode } from '@themoltnet/sandbox-gondolin';
 import { GuestEnvironmentBoundaryError } from '@themoltnet/sandbox-gondolin';
+import { HostCapabilityContribution } from '@themoltnet/agent-runtime';
+import { HostCapabilityEvidenceLogger } from '@themoltnet/agent-runtime';
+import { HostCapabilityManifestEntry } from '@themoltnet/agent-runtime';
 import { isResolvedPathInsideRoot } from '@themoltnet/sandbox-gondolin';
 import { loadCredentials } from '@themoltnet/sandbox-gondolin';
 import { LoadSkillsResult } from '@earendil-works/pi-coding-agent';
@@ -55,6 +58,62 @@ import { WriteOperations } from '@earendil-works/pi-coding-agent';
 
 export { activateAgentEnv }
 
+/**
+ * Non-secret identity of the agent a daemon runs as. Everything here may be
+ * projected into a sandbox guest; nothing here can sign.
+ */
+declare interface AgentIdentity {
+    agentName: string;
+    identityId: string;
+    /** `ed25519:<base64>` */
+    publicKey: string;
+    fingerprint: string;
+    gitName: string;
+    gitEmail: string;
+}
+
+/**
+ * The seam between key storage and everything that needs a signature.
+ *
+ * Implementations hold (or proxy to) the Ed25519 identity key; consumers never
+ * see key material. The operations are purpose-bound on purpose: there is no
+ * "sign these bytes" method, so a broker exposing this interface cannot be
+ * turned into a general signing oracle.
+ */
+declare interface AgentSigningCapability {
+    readonly identity: AgentIdentity;
+    /** Sign a pending MoltNet signing request owned by this identity. */
+    signDiaryEntry(input: {
+        signingRequestId: string;
+    }): Promise<{
+        signingRequestId: string;
+    }>;
+    /**
+     * Sign a validated SSHSIG envelope in the `git` namespace. The enforceable
+     * boundary is the namespace, which covers every git object signature
+     * (commits and tags); it is not commit-only.
+     */
+    signGitCommit(input: {
+        sshsig: Uint8Array;
+    }): Promise<{
+        /** Raw 64-byte Ed25519 signature over the envelope. */
+        signature: Uint8Array;
+    }>;
+}
+
+/**
+ * Stock signing capability: the guest keeps `git commit -S` and
+ * `moltnet entry create-signed`; signatures are produced on the host through
+ * the injected `AgentSigningCapability`. The guest receives only the signer
+ * origin, an ssh-agent socket served by the CLI, and a non-secret gitconfig.
+ */
+export declare const agentSigningCapability: HostCapabilityContribution<AgentSigningInjected>;
+
+/** State the daemon injects for this capability. */
+declare interface AgentSigningInjected {
+    signer: AgentSigningCapability;
+}
+
 /** Minimal shape of the SDK method the resolver needs (keeps deps testable). */
 export declare interface AllowedToolsClient {
     runtimeProfiles: {
@@ -432,6 +491,7 @@ export declare interface DefinePiRuntimeOptions {
     runtimeKind?: string;
     vm: GondolinTemplateDefinition;
     brokeredHttpSecrets?: readonly PiBrokeredHttpSecretContribution[];
+    hostCapabilities?: readonly HostCapabilityContribution<never>[];
     tools?: readonly PiToolContribution[];
     extensions?: readonly PiExtensionContribution[];
 }
@@ -652,6 +712,15 @@ export declare interface ExecutePiTaskOptions {
     toolPolicyLogger?: ToolPolicyLogger;
     /** Trusted, statically imported operator runtime contributions. */
     runtimeDefinition?: PiRuntimeDefinition;
+    /**
+     * Host-side signing capability injected by the daemon for host capabilities
+     * (never built from key material inside the runtime).
+     */
+    hostCapabilitySigner?: AgentSigningCapability;
+    /** Non-secret agent identity projected to the guest by host capabilities. */
+    agentIdentity?: AgentIdentity;
+    /** Evidence logger for host capability decisions (defaults to the tool-policy logger). */
+    hostCapabilityLogger?: HostCapabilityEvidenceLogger;
     /**
      * Pre-resolved local VM template. Daemons resolve this before polling so
      * profile requirements and executor attestation can be checked before claim.
@@ -717,6 +786,12 @@ export declare interface GondolinTemplateResolveContext {
     onProgress?: (message: string) => void;
 }
 
+export declare const GUEST_ALLOWED_SIGNERS_PATH = "/home/agent/.config/moltnet/allowed_signers";
+
+export declare const GUEST_GITCONFIG_PATH = "/home/agent/.config/moltnet/gitconfig";
+
+export declare const GUEST_SIGNER_SOCKET = "/run/moltnet/signer.sock";
+
 export { GuestCredentialMode }
 
 export { GuestEnvironmentBoundaryError }
@@ -897,6 +972,11 @@ export declare interface MoltNetToolsConfig {
      * entry creation behaves as before (env-derived diary, no auto-tags).
      */
     getTaskContext?(): MoltNetTaskContext | null;
+    /**
+     * Host-side signing capability, when the daemon injected one. Enables
+     * `signed: true` on `moltnet_create_entry`; the guest never sees the key.
+     */
+    getSigner?(): AgentSigningCapability | null;
     /** Records recoverable task-provenance failures without ending the task. */
     onTaskProvenanceEvent?(event: 'task.provenance.entry_denied', details: {
         taskId: string;
@@ -962,6 +1042,8 @@ export declare interface PiExecutorManifest {
         ports: readonly number[];
         required: boolean;
     }[];
+    /** Optional v1 extension, emitted only when capabilities are declared. */
+    hostCapabilities?: HostCapabilityManifestEntry[];
     tools: {
         name: string;
         descriptorCid: string | null;
@@ -1057,6 +1139,8 @@ export declare interface PiRuntimeDefinition {
     readonly vm: GondolinTemplateDefinition;
     /** Optional v1 extension; absent on independently packaged legacy runtimes. */
     readonly brokeredHttpSecrets?: readonly PiBrokeredHttpSecretContribution[];
+    /** Optional v1 extension: host capabilities served to the guest. */
+    readonly hostCapabilities?: readonly HostCapabilityContribution<never>[];
     readonly tools: readonly PiToolContribution[];
     readonly extensions: readonly PiExtensionContribution[];
 }
@@ -1279,6 +1363,18 @@ declare interface RuntimeInstructorSandbox {
     allowedInternalHosts: readonly string[];
     /** Guest names containing host-brokered opaque HTTP placeholders. */
     brokeredSecretEnvNames?: readonly string[];
+    /** Host capabilities served to the guest (attested in the manifest). */
+    hostCapabilities?: readonly {
+        name: string;
+        origin: string;
+        operations: readonly string[];
+    }[];
+    /**
+     * Guest credential mode. In `host-authenticated` the guest CLI carries no
+     * identity credentials, so REST-backed CLI paths (e.g. `moltnet entry
+     * create-signed`) cannot authenticate; host-side SDK tools must be used.
+     */
+    guestCredentialMode?: 'guest-config' | 'host-authenticated';
 }
 
 declare interface RuntimeInstructorToolPolicy {