@themoltnet/pi-runtime 0.11.0 → 0.12.1

package/dist/index.d.ts

@@ -21,8 +21,10 @@ import { FindOperations } from '@earendil-works/pi-coding-agent';
 import { GONDOLIN_BASE_EXECUTABLES } from '@themoltnet/sandbox-gondolin';
 import { GrepToolDetails } from '@earendil-works/pi-coding-agent';
 import { GrepToolInput } from '@earendil-works/pi-coding-agent';
-import { GuestCredentialMode } from '@themoltnet/sandbox-gondolin';
 import { GuestEnvironmentBoundaryError } from '@themoltnet/sandbox-gondolin';
+import { HostCapabilityContribution } from '@themoltnet/agent-runtime';
+import { HostCapabilityEvidenceLogger } from '@themoltnet/agent-runtime';
+import { HostCapabilityManifestEntry } from '@themoltnet/agent-runtime';
 import { isResolvedPathInsideRoot } from '@themoltnet/sandbox-gondolin';
 import { loadCredentials } from '@themoltnet/sandbox-gondolin';
 import { LoadSkillsResult } from '@earendil-works/pi-coding-agent';
@@ -31,7 +33,6 @@ import { ManagedVm } from '@themoltnet/sandbox-gondolin';
 import { Model } from '@earendil-works/pi-ai';
 import { ModelRegistry } from '@earendil-works/pi-coding-agent';
 import { prepareBrokeredHttpSecrets } from '@themoltnet/sandbox-gondolin';
-import { ProviderAuthSource } from '@themoltnet/sandbox-gondolin';
 import { Readable } from 'node:stream';
 import { ReadOperations } from '@earendil-works/pi-coding-agent';
 import { ResumeCommand } from '@themoltnet/sandbox-gondolin';
@@ -55,6 +56,62 @@ import { WriteOperations } from '@earendil-works/pi-coding-agent';
 
 export { activateAgentEnv }
 
+/**
+ * Non-secret identity of the agent a daemon runs as. Everything here may be
+ * projected into a sandbox guest; nothing here can sign.
+ */
+declare interface AgentIdentity {
+    agentName: string;
+    identityId: string;
+    /** `ed25519:<base64>` */
+    publicKey: string;
+    fingerprint: string;
+    gitName: string;
+    gitEmail: string;
+}
+
+/**
+ * The seam between key storage and everything that needs a signature.
+ *
+ * Implementations hold (or proxy to) the Ed25519 identity key; consumers never
+ * see key material. The operations are purpose-bound on purpose: there is no
+ * "sign these bytes" method, so a broker exposing this interface cannot be
+ * turned into a general signing oracle.
+ */
+declare interface AgentSigningCapability {
+    readonly identity: AgentIdentity;
+    /** Sign a pending MoltNet signing request owned by this identity. */
+    signDiaryEntry(input: {
+        signingRequestId: string;
+    }): Promise<{
+        signingRequestId: string;
+    }>;
+    /**
+     * Sign a validated SSHSIG envelope in the `git` namespace. The enforceable
+     * boundary is the namespace, which covers every git object signature
+     * (commits and tags); it is not commit-only.
+     */
+    signGitCommit(input: {
+        sshsig: Uint8Array;
+    }): Promise<{
+        /** Raw 64-byte Ed25519 signature over the envelope. */
+        signature: Uint8Array;
+    }>;
+}
+
+/**
+ * Stock signing capability: the guest keeps `git commit -S` and
+ * `moltnet entry create-signed`; signatures are produced on the host through
+ * the injected `AgentSigningCapability`. The guest receives only the signer
+ * origin, an ssh-agent socket served by the CLI, and a non-secret gitconfig.
+ */
+export declare const agentSigningCapability: HostCapabilityContribution<AgentSigningInjected>;
+
+/** State the daemon injects for this capability. */
+declare interface AgentSigningInjected {
+    signer: AgentSigningCapability;
+}
+
 /** Minimal shape of the SDK method the resolver needs (keeps deps testable). */
 export declare interface AllowedToolsClient {
     runtimeProfiles: {
@@ -213,7 +270,10 @@ declare type ContextRef = {
     content: string;
 };
 
-export declare function createGondolinBashOps(vm: VM, localCwd: string, guestWorkspace: string): BashOperations;
+export declare function createGondolinBashOps(vm: VM, localCwd: string, guestWorkspace: string, config: {
+    lifecycle: GondolinToolLifecycle;
+    retireVm: (retirement: GondolinVmRetirement) => Promise<void>;
+}): BashOperations;
 
 export declare function createGondolinEditOps(vm: VM, localCwd: string, guestWorkspace: string): EditOperations;
 
@@ -227,8 +287,14 @@ export declare function createGondolinToolDefinitions(config: {
     vm: VM;
     cwdPath: string;
     guestWorkspace: string;
+    lifecycle: GondolinToolLifecycle;
+    retireVm: (retirement: GondolinVmRetirement) => Promise<void>;
 }): ToolDefinition[];
 
+export declare function createGondolinToolLifecycle(config?: {
+    onRetired?: (retirement: GondolinVmRetirement) => void;
+}): GondolinToolLifecycle;
+
 export declare function createGondolinWriteOps(vm: VM, localCwd: string, guestWorkspace: string): WriteOperations;
 
 /**
@@ -432,6 +498,7 @@ export declare interface DefinePiRuntimeOptions {
     runtimeKind?: string;
     vm: GondolinTemplateDefinition;
     brokeredHttpSecrets?: readonly PiBrokeredHttpSecretContribution[];
+    hostCapabilities?: readonly HostCapabilityContribution<never>[];
     tools?: readonly PiToolContribution[];
     extensions?: readonly PiExtensionContribution[];
 }
@@ -467,8 +534,6 @@ export declare interface ExecutePiTaskOptions {
     agentName: string;
     /** Already-authenticated host-side Agent. Daemon callers always supply it. */
     moltnetAgent?: Agent;
-    /** Explicit trust boundary for MoltNet credentials inside the guest. */
-    guestCredentialMode?: GuestCredentialMode;
     /**
      * Host root that owns `.moltnet/<agentName>/`.
      *
@@ -652,6 +717,15 @@ export declare interface ExecutePiTaskOptions {
     toolPolicyLogger?: ToolPolicyLogger;
     /** Trusted, statically imported operator runtime contributions. */
     runtimeDefinition?: PiRuntimeDefinition;
+    /**
+     * Host-side signing capability injected by the daemon for host capabilities
+     * (never built from key material inside the runtime).
+     */
+    hostCapabilitySigner?: AgentSigningCapability;
+    /** Non-secret agent identity projected to the guest by host capabilities. */
+    agentIdentity?: AgentIdentity;
+    /** Evidence logger for host capability decisions (defaults to the tool-policy logger). */
+    hostCapabilityLogger?: HostCapabilityEvidenceLogger;
     /**
      * Pre-resolved local VM template. Daemons resolve this before polling so
      * profile requirements and executor attestation can be checked before claim.
@@ -717,7 +791,33 @@ export declare interface GondolinTemplateResolveContext {
     onProgress?: (message: string) => void;
 }
 
-export { GuestCredentialMode }
+export declare interface GondolinToolLifecycle {
+    assertActive(): void;
+    getRetirement(): GondolinVmRetirement | null;
+    markRetired(retirement: GondolinVmRetirement): void;
+}
+
+export declare class GondolinVmRetiredError extends Error {
+    readonly retirement: GondolinVmRetirement;
+    readonly code = "sandbox_retired";
+    constructor(retirement: GondolinVmRetirement, options?: ErrorOptions);
+}
+
+export declare interface GondolinVmRetirement {
+    backendRetired: boolean;
+    reason: 'backend-retired' | 'backend-retirement-failed';
+    trigger: GondolinVmRetirementTrigger;
+}
+
+export declare type GondolinVmRetirementTrigger = 'cancellation' | 'timeout';
+
+export declare function guardGondolinToolDefinitions(tools: readonly ToolDefinition[], lifecycle: GondolinToolLifecycle): ToolDefinition[];
+
+export declare const GUEST_ALLOWED_SIGNERS_PATH = "/home/agent/.config/moltnet/allowed_signers";
+
+export declare const GUEST_GITCONFIG_PATH = "/home/agent/.config/moltnet/gitconfig";
+
+export declare const GUEST_SIGNER_SOCKET = "/run/moltnet/signer.sock";
 
 export { GuestEnvironmentBoundaryError }
 
@@ -897,6 +997,11 @@ export declare interface MoltNetToolsConfig {
      * entry creation behaves as before (env-derived diary, no auto-tags).
      */
     getTaskContext?(): MoltNetTaskContext | null;
+    /**
+     * Host-side signing capability, when the daemon injected one. Enables
+     * `signed: true` on `moltnet_create_entry`; the guest never sees the key.
+     */
+    getSigner?(): AgentSigningCapability | null;
     /** Records recoverable task-provenance failures without ending the task. */
     onTaskProvenanceEvent?(event: 'task.provenance.entry_denied', details: {
         taskId: string;
@@ -909,9 +1014,6 @@ export declare function normalizeRetryTriageResult(value: unknown): PiRetryTriag
 
 export declare const PI_EXECUTOR_MANIFEST_VERSION: "moltnet:executor-manifest:v1";
 
-/** Guest path where Pi expects its auth blob. */
-export declare const PI_GUEST_AUTH_PATH = "/home/agent/.pi/agent/auth.json";
-
 export declare const PI_RUNTIME_DEFINITION_VERSION = "moltnet:pi-runtime:v1";
 
 export declare interface PiBrokeredHttpSecretContribution {
@@ -962,6 +1064,8 @@ export declare interface PiExecutorManifest {
         ports: readonly number[];
         required: boolean;
     }[];
+    /** Optional v1 extension, emitted only when capabilities are declared. */
+    hostCapabilities?: HostCapabilityManifestEntry[];
     tools: {
         name: string;
         descriptorCid: string | null;
@@ -1010,13 +1114,6 @@ export declare interface PiOtelOptions {
     onSessionContextChange?: (context: Context | undefined) => void;
 }
 
-/**
- * Pi's provider authentication as a sandbox `ProviderAuthSource`. CI writes
- * `auth.json` under `PI_CODING_AGENT_DIR`; local runs fall back to the
- * canonical `~/.pi/agent` dir when the override is unset.
- */
-export declare function piProviderAuth(): ProviderAuthSource;
-
 export declare type PiRetryTriage = (input: PiRetryTriageInput) => Promise<PiRetryTriageResult>;
 
 export declare type PiRetryTriageConfidence = RetryTriageConfidence;
@@ -1057,6 +1154,8 @@ export declare interface PiRuntimeDefinition {
     readonly vm: GondolinTemplateDefinition;
     /** Optional v1 extension; absent on independently packaged legacy runtimes. */
     readonly brokeredHttpSecrets?: readonly PiBrokeredHttpSecretContribution[];
+    /** Optional v1 extension: host capabilities served to the guest. */
+    readonly hostCapabilities?: readonly HostCapabilityContribution<never>[];
     readonly tools: readonly PiToolContribution[];
     readonly extensions: readonly PiExtensionContribution[];
 }
@@ -1165,8 +1264,6 @@ declare interface PiWorkspaceSeedPlan {
 
 export { prepareBrokeredHttpSecrets }
 
-export { ProviderAuthSource }
-
 export declare interface ProviderErrorRetryEvent extends Record<string, unknown> {
     event: 'provider_error_retry';
     retry: number;
@@ -1199,7 +1296,7 @@ export declare interface ResolvedGondolinTemplate {
     resumeCommands: readonly ResumeCommand[];
 }
 
-export declare function resolveHostExecBaseEnv(guestCredentialMode: GuestCredentialMode, agentEnv: Readonly<Record<string, string | undefined>>): Set<string>;
+export declare function resolveHostExecBaseEnv(agentEnv: Readonly<Record<string, string | undefined>>): Set<string>;
 
 /**
  * Resolve the session's tool policy at start-up.
@@ -1245,8 +1342,10 @@ export declare function resolveTaskWorktreePath(mainRepo: string, workspaceId: s
 export { ResumeCommand }
 
 /**
- * Resume a Gondolin VM for a Pi session. Identical to the sandbox package's
- * `resumeVm`, with Pi's provider auth supplied unless the caller overrides it.
+ * Resume a Gondolin VM for a Pi session. The Pi coding-agent session and its
+ * model calls run host-side (`createAgentSession` reads the host `~/.pi/agent`
+ * auth), so the guest carries no provider auth — it only executes Gondolin
+ * tools via `vm.exec`. This is a thin pass-through to the sandbox package.
  */
 export declare function resumeVm(config: VmConfig): Promise<ManagedVm>;
 
@@ -1279,6 +1378,12 @@ declare interface RuntimeInstructorSandbox {
     allowedInternalHosts: readonly string[];
     /** Guest names containing host-brokered opaque HTTP placeholders. */
     brokeredSecretEnvNames?: readonly string[];
+    /** Host capabilities served to the guest (attested in the manifest). */
+    hostCapabilities?: readonly {
+        name: string;
+        origin: string;
+        operations: readonly string[];
+    }[];
 }
 
 declare interface RuntimeInstructorToolPolicy {