@themoltnet/pi-runtime 0.12.0 → 0.12.1

package/dist/index.d.ts

@@ -21,7 +21,6 @@ import { FindOperations } from '@earendil-works/pi-coding-agent';
 import { GONDOLIN_BASE_EXECUTABLES } from '@themoltnet/sandbox-gondolin';
 import { GrepToolDetails } from '@earendil-works/pi-coding-agent';
 import { GrepToolInput } from '@earendil-works/pi-coding-agent';
-import { GuestCredentialMode } from '@themoltnet/sandbox-gondolin';
 import { GuestEnvironmentBoundaryError } from '@themoltnet/sandbox-gondolin';
 import { HostCapabilityContribution } from '@themoltnet/agent-runtime';
 import { HostCapabilityEvidenceLogger } from '@themoltnet/agent-runtime';
@@ -34,7 +33,6 @@ import { ManagedVm } from '@themoltnet/sandbox-gondolin';
 import { Model } from '@earendil-works/pi-ai';
 import { ModelRegistry } from '@earendil-works/pi-coding-agent';
 import { prepareBrokeredHttpSecrets } from '@themoltnet/sandbox-gondolin';
-import { ProviderAuthSource } from '@themoltnet/sandbox-gondolin';
 import { Readable } from 'node:stream';
 import { ReadOperations } from '@earendil-works/pi-coding-agent';
 import { ResumeCommand } from '@themoltnet/sandbox-gondolin';
@@ -272,7 +270,10 @@ declare type ContextRef = {
     content: string;
 };
 
-export declare function createGondolinBashOps(vm: VM, localCwd: string, guestWorkspace: string): BashOperations;
+export declare function createGondolinBashOps(vm: VM, localCwd: string, guestWorkspace: string, config: {
+    lifecycle: GondolinToolLifecycle;
+    retireVm: (retirement: GondolinVmRetirement) => Promise<void>;
+}): BashOperations;
 
 export declare function createGondolinEditOps(vm: VM, localCwd: string, guestWorkspace: string): EditOperations;
 
@@ -286,8 +287,14 @@ export declare function createGondolinToolDefinitions(config: {
     vm: VM;
     cwdPath: string;
     guestWorkspace: string;
+    lifecycle: GondolinToolLifecycle;
+    retireVm: (retirement: GondolinVmRetirement) => Promise<void>;
 }): ToolDefinition[];
 
+export declare function createGondolinToolLifecycle(config?: {
+    onRetired?: (retirement: GondolinVmRetirement) => void;
+}): GondolinToolLifecycle;
+
 export declare function createGondolinWriteOps(vm: VM, localCwd: string, guestWorkspace: string): WriteOperations;
 
 /**
@@ -527,8 +534,6 @@ export declare interface ExecutePiTaskOptions {
     agentName: string;
     /** Already-authenticated host-side Agent. Daemon callers always supply it. */
     moltnetAgent?: Agent;
-    /** Explicit trust boundary for MoltNet credentials inside the guest. */
-    guestCredentialMode?: GuestCredentialMode;
     /**
      * Host root that owns `.moltnet/<agentName>/`.
      *
@@ -786,14 +791,34 @@ export declare interface GondolinTemplateResolveContext {
     onProgress?: (message: string) => void;
 }
 
+export declare interface GondolinToolLifecycle {
+    assertActive(): void;
+    getRetirement(): GondolinVmRetirement | null;
+    markRetired(retirement: GondolinVmRetirement): void;
+}
+
+export declare class GondolinVmRetiredError extends Error {
+    readonly retirement: GondolinVmRetirement;
+    readonly code = "sandbox_retired";
+    constructor(retirement: GondolinVmRetirement, options?: ErrorOptions);
+}
+
+export declare interface GondolinVmRetirement {
+    backendRetired: boolean;
+    reason: 'backend-retired' | 'backend-retirement-failed';
+    trigger: GondolinVmRetirementTrigger;
+}
+
+export declare type GondolinVmRetirementTrigger = 'cancellation' | 'timeout';
+
+export declare function guardGondolinToolDefinitions(tools: readonly ToolDefinition[], lifecycle: GondolinToolLifecycle): ToolDefinition[];
+
 export declare const GUEST_ALLOWED_SIGNERS_PATH = "/home/agent/.config/moltnet/allowed_signers";
 
 export declare const GUEST_GITCONFIG_PATH = "/home/agent/.config/moltnet/gitconfig";
 
 export declare const GUEST_SIGNER_SOCKET = "/run/moltnet/signer.sock";
 
-export { GuestCredentialMode }
-
 export { GuestEnvironmentBoundaryError }
 
 /**
@@ -989,9 +1014,6 @@ export declare function normalizeRetryTriageResult(value: unknown): PiRetryTriag
 
 export declare const PI_EXECUTOR_MANIFEST_VERSION: "moltnet:executor-manifest:v1";
 
-/** Guest path where Pi expects its auth blob. */
-export declare const PI_GUEST_AUTH_PATH = "/home/agent/.pi/agent/auth.json";
-
 export declare const PI_RUNTIME_DEFINITION_VERSION = "moltnet:pi-runtime:v1";
 
 export declare interface PiBrokeredHttpSecretContribution {
@@ -1092,13 +1114,6 @@ export declare interface PiOtelOptions {
     onSessionContextChange?: (context: Context | undefined) => void;
 }
 
-/**
- * Pi's provider authentication as a sandbox `ProviderAuthSource`. CI writes
- * `auth.json` under `PI_CODING_AGENT_DIR`; local runs fall back to the
- * canonical `~/.pi/agent` dir when the override is unset.
- */
-export declare function piProviderAuth(): ProviderAuthSource;
-
 export declare type PiRetryTriage = (input: PiRetryTriageInput) => Promise<PiRetryTriageResult>;
 
 export declare type PiRetryTriageConfidence = RetryTriageConfidence;
@@ -1249,8 +1264,6 @@ declare interface PiWorkspaceSeedPlan {
 
 export { prepareBrokeredHttpSecrets }
 
-export { ProviderAuthSource }
-
 export declare interface ProviderErrorRetryEvent extends Record<string, unknown> {
     event: 'provider_error_retry';
     retry: number;
@@ -1283,7 +1296,7 @@ export declare interface ResolvedGondolinTemplate {
     resumeCommands: readonly ResumeCommand[];
 }
 
-export declare function resolveHostExecBaseEnv(guestCredentialMode: GuestCredentialMode, agentEnv: Readonly<Record<string, string | undefined>>): Set<string>;
+export declare function resolveHostExecBaseEnv(agentEnv: Readonly<Record<string, string | undefined>>): Set<string>;
 
 /**
  * Resolve the session's tool policy at start-up.
@@ -1329,8 +1342,10 @@ export declare function resolveTaskWorktreePath(mainRepo: string, workspaceId: s
 export { ResumeCommand }
 
 /**
- * Resume a Gondolin VM for a Pi session. Identical to the sandbox package's
- * `resumeVm`, with Pi's provider auth supplied unless the caller overrides it.
+ * Resume a Gondolin VM for a Pi session. The Pi coding-agent session and its
+ * model calls run host-side (`createAgentSession` reads the host `~/.pi/agent`
+ * auth), so the guest carries no provider auth — it only executes Gondolin
+ * tools via `vm.exec`. This is a thin pass-through to the sandbox package.
  */
 export declare function resumeVm(config: VmConfig): Promise<ManagedVm>;
 
@@ -1369,12 +1384,6 @@ declare interface RuntimeInstructorSandbox {
         origin: string;
         operations: readonly string[];
     }[];
-    /**
-     * Guest credential mode. In `host-authenticated` the guest CLI carries no
-     * identity credentials, so REST-backed CLI paths (e.g. `moltnet entry
-     * create-signed`) cannot authenticate; host-side SDK tools must be used.
-     */
-    guestCredentialMode?: 'guest-config' | 'host-authenticated';
 }
 
 declare interface RuntimeInstructorToolPolicy {

package/dist/index.js

@@ -4,7 +4,7 @@ import { createHash as createHash$1 } from "crypto";
 import { FREEFORM_TYPE, SUBMIT_OUTPUT_GATE_ID, buildTaskUserPrompt, createHostCapabilityRouter, defineHostCapability, getSubmitOutputContract, materializeTaskOutput, mergeRuntimeProfileContext, resolveTaskContext, taskTypeUsesSubagents, traceRuntimePhase, validateTaskOutput, validateTaskSubmission } from "@themoltnet/agent-runtime";
 import { Type } from "typebox";
 import { execFileSync } from "node:child_process";
-import { cpSync, createReadStream, createWriteStream, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync } from "node:fs";
+import { cpSync, createReadStream, createWriteStream, existsSync, mkdirSync, readdirSync, realpathSync, rmSync } from "node:fs";
 import { mkdir, realpath, stat } from "node:fs/promises";
 import path, { isAbsolute, join, relative, resolve, sep } from "node:path";
 import { pipeline } from "node:stream/promises";
@@ -15,7 +15,7 @@ import { base32 } from "multiformats/bases/base32";
 import { CID } from "multiformats/cid";
 import * as raw from "multiformats/codecs/raw";
 import { create } from "multiformats/hashes/digest";
-import { BrokeredHttpSecretBoundaryError, GONDOLIN_BASE_EXECUTABLES, GUEST_TASK_CONTEXT_MOUNT, GuestEnvironmentBoundaryError, activateAgentEnv, activateAgentEnv as activateAgentEnv$1, assertGuestEnvironmentBoundary, assertHostAuthenticatedGuestEnvironment, canonicalizeBrokeredHttpSecretDescriptor, ensureSnapshot, ensureSnapshot as ensureSnapshot$1, findMainWorktree, findMainWorktree as findMainWorktree$1, isResolvedPathInsideRoot, isResolvedPathInsideRoot as isResolvedPathInsideRoot$1, loadCredentials, prepareBrokeredHttpSecrets, resolveVfsShadowConfig, resumeVm as resumeVm$1 } from "@themoltnet/sandbox-gondolin";
+import { BrokeredHttpSecretBoundaryError, GONDOLIN_BASE_EXECUTABLES, GUEST_TASK_CONTEXT_MOUNT, GuestEnvironmentBoundaryError, activateAgentEnv, activateAgentEnv as activateAgentEnv$1, assertGuestEnvironmentBoundary, assertHostAuthenticatedGuestEnvironment, canonicalizeBrokeredHttpSecretDescriptor, ensureSnapshot, ensureSnapshot as ensureSnapshot$1, execManagedCommand, findMainWorktree, findMainWorktree as findMainWorktree$1, isResolvedPathInsideRoot, isResolvedPathInsideRoot as isResolvedPathInsideRoot$1, loadCredentials, prepareBrokeredHttpSecrets, resolveVfsShadowConfig, resumeVm as resumeVm$1 } from "@themoltnet/sandbox-gondolin";
 import { SpanStatusCode, context, metrics, trace } from "@opentelemetry/api";
 import * as json from "multiformats/codecs/json";
 import { sha256 as sha256$1 } from "multiformats/hashes/sha2";
@@ -3458,6 +3458,37 @@ function assertRuntimeKind(value) {
 */
 var DEFAULT_GREP_LIMIT = 100;
 var GREP_MAX_FILE_SIZE = "2M";
+var GondolinVmRetiredError = class extends Error {
+	code = "sandbox_retired";
+	constructor(retirement, options) {
+		super(`Sandbox VM retired after ${retirement.trigger}: ${retirement.reason}`, options);
+		this.retirement = retirement;
+		this.name = "GondolinVmRetiredError";
+	}
+};
+function createGondolinToolLifecycle(config = {}) {
+	let retirement = null;
+	return {
+		assertActive() {
+			if (retirement) throw new GondolinVmRetiredError(retirement);
+		},
+		getRetirement: () => retirement,
+		markRetired(next) {
+			if (retirement) return;
+			retirement = next;
+			config.onRetired?.(next);
+		}
+	};
+}
+function guardGondolinToolDefinitions(tools, lifecycle) {
+	return tools.map((tool) => ({
+		...tool,
+		execute(...args) {
+			lifecycle.assertActive();
+			return tool.execute(...args);
+		}
+	}));
+}
 function shQuote(s) {
 	return "'" + s.replace(/'/g, "'\\''") + "'";
 }
@@ -3806,38 +3837,45 @@ async function executeGondolinGrep(vm, localCwd, guestWorkspace, params, signal)
 		details: Object.keys(details).length > 0 ? details : void 0
 	};
 }
-function createGondolinBashOps(vm, localCwd, guestWorkspace) {
+function createGondolinBashOps(vm, localCwd, guestWorkspace, config) {
 	return { exec: async (command, cwd, { onData, signal, timeout, env }) => {
-		const guestCwd = toGuestPath(localCwd, cwd, guestWorkspace);
-		const ac = new AbortController();
-		const onAbort = () => ac.abort();
-		signal?.addEventListener("abort", onAbort, { once: true });
-		let timedOut = false;
-		const timer = timeout && timeout > 0 ? setTimeout(() => {
-			timedOut = true;
-			ac.abort();
-		}, timeout * 1e3) : void 0;
-		try {
-			const proc = vm.exec([
-				"/bin/sh",
-				"-lc",
-				command
-			], {
-				cwd: guestCwd,
-				signal: ac.signal,
-				stdout: "pipe",
-				stderr: "pipe"
-			});
-			for await (const chunk of proc.output()) onData(typeof chunk.data === "string" ? Buffer.from(chunk.data, "utf8") : chunk.data);
-			return { exitCode: (await proc).exitCode };
-		} catch (err) {
-			if (signal?.aborted) throw new Error("aborted");
-			if (timedOut) throw new Error(`timeout:${timeout}`);
-			throw err;
-		} finally {
-			if (timer) clearTimeout(timer);
-			signal?.removeEventListener("abort", onAbort);
+		config.lifecycle.assertActive();
+		const result = await execManagedCommand(vm, command, {
+			cwd: toGuestPath(localCwd, cwd, guestWorkspace),
+			signal,
+			timeoutMs: timeout && timeout > 0 ? timeout * 1e3 : void 0,
+			onData
+		});
+		if (result.termination.status === "backend-retired") {
+			const retirement = {
+				backendRetired: true,
+				reason: "backend-retired",
+				trigger: result.timedOut ? "timeout" : "cancellation"
+			};
+			config.lifecycle.markRetired(retirement);
+			try {
+				await config.retireVm(retirement);
+			} catch (error) {
+				throw new GondolinVmRetiredError(retirement, { cause: error });
+			}
+		}
+		if (result.termination.status === "recovery-required") {
+			const retirement = {
+				backendRetired: false,
+				reason: result.termination.reason,
+				trigger: result.timedOut ? "timeout" : "cancellation"
+			};
+			config.lifecycle.markRetired(retirement);
+			try {
+				await config.retireVm(retirement);
+			} catch (error) {
+				throw new GondolinVmRetiredError(retirement, { cause: error });
+			}
+			throw new GondolinVmRetiredError(retirement);
 		}
+		if (result.timedOut) throw new Error(`timeout:${timeout}`);
+		if (result.cancelled) throw new Error("aborted");
+		return { exitCode: result.exitCode };
 	} };
 }
 //#endregion
@@ -4151,31 +4189,14 @@ function decisionContext(deps) {
 }
 //#endregion
 //#region src/vm.ts
-/** Guest path where Pi expects its auth blob. */
-var PI_GUEST_AUTH_PATH = "/home/agent/.pi/agent/auth.json";
 /**
-* Pi's provider authentication as a sandbox `ProviderAuthSource`. CI writes
-* `auth.json` under `PI_CODING_AGENT_DIR`; local runs fall back to the
-* canonical `~/.pi/agent` dir when the override is unset.
-*/
-function piProviderAuth() {
-	return {
-		guestPath: PI_GUEST_AUTH_PATH,
-		load: () => {
-			const authPath = path.join(resolvePiCodingAgentDir(), "auth.json");
-			return existsSync(authPath) ? readFileSync(authPath, "utf8") : null;
-		}
-	};
-}
-/**
-* Resume a Gondolin VM for a Pi session. Identical to the sandbox package's
-* `resumeVm`, with Pi's provider auth supplied unless the caller overrides it.
+* Resume a Gondolin VM for a Pi session. The Pi coding-agent session and its
+* model calls run host-side (`createAgentSession` reads the host `~/.pi/agent`
+* auth), so the guest carries no provider auth — it only executes Gondolin
+* tools via `vm.exec`. This is a thin pass-through to the sandbox package.
 */
 function resumeVm(config) {
-	return resumeVm$1({
-		providerAuth: piProviderAuth(),
-		...config
-	});
+	return resumeVm$1(config);
 }
 //#endregion
 //#region src/runtime/capability-discovery.ts
@@ -4702,20 +4723,9 @@ function buildCredentialInstructions(policy, sandbox) {
 	}
 	if (gitAvailable) {
 		const signing = (sandbox?.hostCapabilities ?? []).find((capability) => capability.name === "agent-signing");
-		const signingGranted = !!signing && (!policy || policy.enforcement === "off" || policy.allowedTools.some((name) => name === "capability:agent-signing" || name.startsWith("capability:agent-signing:")));
-		const hostAuthenticated = sandbox?.guestCredentialMode === "host-authenticated";
-		if (signingGranted) {
+		if (!!signing && (!policy || policy.enforcement === "off" || policy.allowedTools.some((name) => name === "capability:agent-signing" || name.startsWith("capability:agent-signing:")))) {
 			lines.push("- Commit signing is brokered: `git commit -S` works normally through", "  `SSH_AUTH_SOCK`; the signing key stays on the host. Do not look for,", "  export, or recreate a private key in the guest.");
-			lines.push(...hostAuthenticated ? [
-				"- For a signed diary entry use the `moltnet_create_entry` tool with",
-				"  `signed: true` (it signs on the trusted host). Do not use the",
-				"  guest `moltnet entry create-signed` CLI: it has no guest identity",
-				"  credentials and its REST calls will fail."
-			] : [
-				"- For a signed diary entry use `moltnet_create_entry` with",
-				"  `signed: true`, or the guest `moltnet entry create-signed` CLI",
-				"  (brokered through `MOLTNET_SIGNER_URL`)."
-			]);
+			lines.push("- For a signed diary entry use the `moltnet_create_entry` tool with", "  `signed: true` (it signs on the trusted host). Do not use the", "  guest `moltnet entry create-signed` CLI: it has no guest identity", "  credentials and its REST calls will fail.");
 		} else if (signing) lines.push("- An `agent-signing` capability is declared but the active policy does", "  not grant it. `git commit -S` and signed diary entries will be denied;", "  create unsigned commits/entries unless the capability is granted.");
 		else lines.push("- Local Git commands run inside the guest. No signing key or Git", "  credential helper is injected; signing and authenticated push", "  require an explicitly provided capability.");
 	}
@@ -5781,12 +5791,10 @@ function createPolicyCheckedSigner(router, identity) {
 		}
 	};
 }
-function resolveHostExecBaseEnv(guestCredentialMode, agentEnv) {
+function resolveHostExecBaseEnv(agentEnv) {
 	const names = new Set([...HOST_EXEC_DEFAULT_BASE_ENV, ...Object.keys(agentEnv)]);
-	if (guestCredentialMode === "host-authenticated") {
-		for (const name of HOST_AUTHENTICATED_HOST_EXEC_REFUSED_ENV) names.delete(name);
-		for (const name of names) if (name.startsWith("MOLTNET_")) names.delete(name);
-	}
+	for (const name of HOST_AUTHENTICATED_HOST_EXEC_REFUSED_ENV) names.delete(name);
+	for (const name of names) if (name.startsWith("MOLTNET_")) names.delete(name);
 	return names;
 }
 var noopTurnEventHandler = () => {};
@@ -5802,13 +5810,16 @@ async function openVmWorkspaceFileForRead(config) {
 	};
 }
 function createGondolinToolDefinitions(config) {
-	const { vm, cwdPath, guestWorkspace } = config;
+	const { vm, cwdPath, guestWorkspace, lifecycle, retireVm } = config;
 	const grepTool = createGrepToolDefinition(cwdPath);
-	return [
+	return guardGondolinToolDefinitions([
 		createReadToolDefinition(cwdPath, { operations: createGondolinReadOps(vm, cwdPath, guestWorkspace) }),
 		createWriteToolDefinition(cwdPath, { operations: createGondolinWriteOps(vm, cwdPath, guestWorkspace) }),
 		createEditToolDefinition(cwdPath, { operations: createGondolinEditOps(vm, cwdPath, guestWorkspace) }),
-		createBashToolDefinition(cwdPath, { operations: createGondolinBashOps(vm, cwdPath, guestWorkspace) }),
+		createBashToolDefinition(cwdPath, { operations: createGondolinBashOps(vm, cwdPath, guestWorkspace, {
+			lifecycle,
+			retireVm
+		}) }),
 		createLsToolDefinition(cwdPath, { operations: createGondolinLsOps(vm, cwdPath, guestWorkspace) }),
 		createFindToolDefinition(cwdPath, { operations: createGondolinFindOps(vm, cwdPath, guestWorkspace) }),
 		{
@@ -5818,7 +5829,52 @@ function createGondolinToolDefinitions(config) {
 				return executeGondolinGrep(vm, cwdPath, guestWorkspace, params, signal);
 			}
 		}
-	];
+	], lifecycle);
+}
+async function retireManagedGondolinVm(config) {
+	const { managed, retirement, secretEnvNames, release } = config;
+	const recoveryErrors = [];
+	for (const guestEnv of secretEnvNames) try {
+		managed.secretManager.revokeSecret(guestEnv);
+	} catch (error) {
+		recoveryErrors.push(error);
+	}
+	try {
+		if (!retirement.backendRetired) await managed.vm.close();
+	} catch (error) {
+		recoveryErrors.push(error);
+	} finally {
+		release();
+	}
+	if (recoveryErrors.length > 0) throw new AggregateError(recoveryErrors, "Sandbox VM retirement recovery failed");
+}
+function createGondolinRetirementCoordinator(config = {}) {
+	let retirement = null;
+	let abortHandler = null;
+	return {
+		lifecycle: createGondolinToolLifecycle({ onRetired(next) {
+			retirement = next;
+			config.onRetired?.(next);
+			abortHandler?.(next);
+		} }),
+		bindAbortHandler(handler) {
+			abortHandler = handler;
+			if (retirement) handler(retirement);
+		},
+		getRetirement: () => retirement
+	};
+}
+function guardGondolinExtensionFactories(factories, lifecycle) {
+	return factories.map((factory) => (pi) => {
+		factory(new Proxy(pi, { get(target, property, receiver) {
+			if (property === "registerTool") return (tool) => {
+				const [guardedTool] = guardGondolinToolDefinitions([tool], lifecycle);
+				if (guardedTool) target.registerTool(guardedTool);
+			};
+			const value = Reflect.get(target, property, receiver);
+			return typeof value === "function" ? value.bind(target) : value;
+		} }));
+	});
 }
 /** Resolve one attempt's host-only HTTP credentials before VM resume. */
 async function resolveAttemptBrokeredHttpSecrets(input) {
@@ -6079,7 +6135,6 @@ async function executePiTask(claimedTask, reporter, opts) {
 				checkpointPath,
 				agentName: opts.agentName,
 				agentRootDir,
-				guestCredentialMode: opts.guestCredentialMode,
 				mountPath,
 				workspaceMode: preparedWorkspace.mode,
 				extraAllowedHosts: opts.extraAllowedHosts,
@@ -6107,6 +6162,23 @@ async function executePiTask(claimedTask, reporter, opts) {
 		activateAgentEnv$1(managed.credentials.agentEnv, agentRootDir);
 		const activeWorkspace = preparedWorkspace;
 		const activeManaged = managed;
+		const sandboxRetirementEvents = [];
+		const sandboxRetirementCoordinator = createGondolinRetirementCoordinator({ onRetired(retirement) {
+			const details = {
+				event: "sandbox_vm_retired",
+				taskId: task.id,
+				attemptN,
+				vmId: activeManaged.vm.id,
+				outcome: retirement.backendRetired ? "retired" : "retirement_failed",
+				...retirement
+			};
+			process.stderr.write(`${JSON.stringify(details)}\n`);
+			sandboxRetirementEvents.push(emitError("sandbox_retirement", `Sandbox VM retired after ${retirement.trigger}`, details).catch((error) => {
+				const message = error instanceof Error ? error.message : String(error);
+				process.stderr.write(`[sandbox] failed to emit retirement event: ${message}\n`);
+			}));
+		} });
+		const gondolinLifecycle = sandboxRetirementCoordinator.lifecycle;
 		const getMoltNetAgent = createMoltNetAgentResolver({
 			moltnetAgent: opts.moltnetAgent,
 			configDir: managed.agentDir
@@ -6222,7 +6294,20 @@ async function executePiTask(claimedTask, reporter, opts) {
 		const gondolinCustomTools = createGondolinToolDefinitions({
 			vm: managed.vm,
 			cwdPath,
-			guestWorkspace: managed.guestWorkspace
+			guestWorkspace: managed.guestWorkspace,
+			lifecycle: gondolinLifecycle,
+			retireVm: async (retirement) => {
+				const recoveringManaged = managed;
+				if (!recoveringManaged) return;
+				await retireManagedGondolinVm({
+					managed: recoveringManaged,
+					retirement,
+					secretEnvNames: brokeredSecretEnvNames,
+					release: () => {
+						if (managed === recoveringManaged) managed = null;
+					}
+				});
+			}
 		});
 		const submitCompletion = createSubmitCompletionCoordinator({
 			onDrained: () => session?.abort(),
@@ -6249,13 +6334,16 @@ async function executePiTask(claimedTask, reporter, opts) {
 				getSessionErrors: () => [],
 				clearSessionErrors: () => {},
 				getHostCwd: () => cwdPath,
-				openWorkspaceFileForRead: (filePath) => openVmWorkspaceFileForRead({
-					vm: activeManaged.vm,
-					cwdPath,
-					guestWorkspace: activeManaged.guestWorkspace,
-					filePath
-				}),
-				hostExecBaseEnv: resolveHostExecBaseEnv(opts.guestCredentialMode ?? "guest-config", managed.credentials.agentEnv),
+				openWorkspaceFileForRead: (filePath) => {
+					gondolinLifecycle.assertActive();
+					return openVmWorkspaceFileForRead({
+						vm: activeManaged.vm,
+						cwdPath,
+						guestWorkspace: activeManaged.guestWorkspace,
+						filePath
+					});
+				},
+				hostExecBaseEnv: resolveHostExecBaseEnv(managed.credentials.agentEnv),
 				hostExecAutoApprove: opts.hostExecAutoApprove ?? opts.sandboxConfig?.hostExec?.autoApprove ?? false,
 				getTaskContext: () => ({
 					taskId: task.id,
@@ -6334,30 +6422,30 @@ async function executePiTask(claimedTask, reporter, opts) {
 				cwdPath,
 				guestWorkspace: managed.guestWorkspace
 			};
-			const runtimeParentTools = opts.runtimeDefinition ? await materializePiTools({
+			const runtimeParentTools = opts.runtimeDefinition ? guardGondolinToolDefinitions(await materializePiTools({
 				runtime: opts.runtimeDefinition,
 				context: runtimeToolContext,
 				target: "parent",
 				policy: resolvedToolPolicy
-			}) : [];
-			const runtimeSubagentTools = opts.runtimeDefinition ? await materializePiTools({
+			}), gondolinLifecycle) : [];
+			const runtimeSubagentTools = opts.runtimeDefinition ? guardGondolinToolDefinitions(await materializePiTools({
 				runtime: opts.runtimeDefinition,
 				context: runtimeToolContext,
 				target: "subagent",
 				policy: resolvedToolPolicy
-			}) : [];
-			const runtimeParentExtensions = opts.runtimeDefinition ? await materializePiExtensions({
+			}), gondolinLifecycle) : [];
+			const runtimeParentExtensions = opts.runtimeDefinition ? guardGondolinExtensionFactories(await materializePiExtensions({
 				runtime: opts.runtimeDefinition,
 				context: runtimeToolContext,
 				target: "parent",
 				policy: resolvedToolPolicy
-			}) : [];
-			const runtimeSubagentExtensions = opts.runtimeDefinition ? await materializePiExtensions({
+			}), gondolinLifecycle) : [];
+			const runtimeSubagentExtensions = opts.runtimeDefinition ? guardGondolinExtensionFactories(await materializePiExtensions({
 				runtime: opts.runtimeDefinition,
 				context: runtimeToolContext,
 				target: "subagent",
 				policy: resolvedToolPolicy
-			}) : [];
+			}), gondolinLifecycle) : [];
 			const visibleBaseTools = filterModelVisibleTools([...gondolinCustomTools, ...moltnetTools], resolvedToolPolicy);
 			const taskHasSubagents = taskTypeUsesSubagents(task.taskType);
 			const visibleParentToolNames = modelVisiblePiToolNames({
@@ -6410,7 +6498,6 @@ async function executePiTask(claimedTask, reporter, opts) {
 					allowedHosts: [...effectiveSandboxConfig?.network?.allowedHosts ?? [], ...opts.extraAllowedHosts ?? []],
 					allowedInternalHosts: effectiveSandboxConfig?.network?.allowedInternalHosts ?? [],
 					brokeredSecretEnvNames,
-					guestCredentialMode: opts.guestCredentialMode ?? "guest-config",
 					...capabilityRouter && { hostCapabilities: capabilityRouter.manifest }
 				},
 				toolPolicy: capabilityProjection.instructorPolicy
@@ -6449,12 +6536,12 @@ async function executePiTask(claimedTask, reporter, opts) {
 				});
 				parentSubagentTools.push(subagentHandle.tool);
 			}
-			const parentTools = [
+			const parentTools = guardGondolinToolDefinitions([
 				...visibleBaseTools,
 				...runtimeParentTools,
 				...submitTools,
 				...parentSubagentTools
-			];
+			], gondolinLifecycle);
 			session = await traceRuntimePhase("moltnet.execution.session.create", {
 				"gen_ai.provider.name": opts.provider,
 				"gen_ai.request.model": opts.model
@@ -6547,6 +6634,9 @@ async function executePiTask(claimedTask, reporter, opts) {
 				message
 			}));
 		};
+		sandboxRetirementCoordinator.bindAbortHandler((retirement) => {
+			triggerCapAbort("sandbox_retired", `Sandbox VM retired after ${retirement.trigger}: ${retirement.reason}.`);
+		});
 		session.subscribe(makeSessionEventHandler({
 			state: turnState,
 			usage,
@@ -6616,7 +6706,7 @@ async function executePiTask(claimedTask, reporter, opts) {
 			event: "subagent_summary",
 			callCount: subagentHandle.getCallCount()
 		});
-		await Promise.all(recordingPromise);
+		await Promise.all([...recordingPromise, ...sandboxRetirementEvents]);
 		const cancelled = reporter.cancelSignal.aborted;
 		let parsedOutput = null;
 		let parsedOutputCid = null;
@@ -7387,4 +7477,4 @@ function describeToolErrorMessage(result) {
 	}
 }
 //#endregion
-export { BrokeredHttpSecretBoundaryError, DEFAULT_BROKERED_HTTP_SECRET_RESOLUTION_TIMEOUT_MS, GONDOLIN_BASE_EXECUTABLES, GONDOLIN_TOOL_NAMES, GUEST_ALLOWED_SIGNERS_PATH, GUEST_GITCONFIG_PATH, GUEST_SIGNER_SOCKET, GuestEnvironmentBoundaryError, HOST_EXEC_DEFAULT_BASE_ENV, MOLTNET_TOOL_NAMES, PI_EXECUTOR_MANIFEST_VERSION, PI_GUEST_AUTH_PATH, PI_RUNTIME_DEFINITION_VERSION, PiBrokeredHttpSecretResolutionError, activateAgentEnv, agentSigningCapability, assertGuestEnvironmentBoundary, assertHostAuthenticatedGuestEnvironment, buildAgentSession, buildPiExecutorManifest, buildRuntimeKernel, buildWorkspaceMountInstructions, createGondolinBashOps, createGondolinEditOps, createGondolinFindOps, createGondolinLsOps, createGondolinReadOps, createGondolinToolDefinitions, createGondolinWriteOps, createMoltNetTools, createPiOtelExtension, createPiRetryTriage, createPiTaskExecutor, createSubagentTool, createToolPolicyExtension, decideForEvent, decideToolCall, defineGondolinTemplate, definePiBrokeredHttpSecret, definePiExtension, definePiRuntime, definePiTool, enabledPiToolNames, ensureSnapshot, executeGondolinGrep, executePiTask, filterModelVisibleTools, findMainWorktree, injectRuntimeContext as injectTaskContext, isKernelTool, isResolvedPathInsideRoot, isToolVisible, loadCredentials, materializePiBrokeredHttpSecrets, materializePiExtensions, materializePiTools, normalizeRetryTriageResult, piProviderAuth, prepareBrokeredHttpSecrets, redactRetryTriageSecrets, resolveHostExecBaseEnv, resolveSessionToolPolicy, resolveTaskWorktreePath, resumeVm, toGuestPath };
+export { BrokeredHttpSecretBoundaryError, DEFAULT_BROKERED_HTTP_SECRET_RESOLUTION_TIMEOUT_MS, GONDOLIN_BASE_EXECUTABLES, GONDOLIN_TOOL_NAMES, GUEST_ALLOWED_SIGNERS_PATH, GUEST_GITCONFIG_PATH, GUEST_SIGNER_SOCKET, GondolinVmRetiredError, GuestEnvironmentBoundaryError, HOST_EXEC_DEFAULT_BASE_ENV, MOLTNET_TOOL_NAMES, PI_EXECUTOR_MANIFEST_VERSION, PI_RUNTIME_DEFINITION_VERSION, PiBrokeredHttpSecretResolutionError, activateAgentEnv, agentSigningCapability, assertGuestEnvironmentBoundary, assertHostAuthenticatedGuestEnvironment, buildAgentSession, buildPiExecutorManifest, buildRuntimeKernel, buildWorkspaceMountInstructions, createGondolinBashOps, createGondolinEditOps, createGondolinFindOps, createGondolinLsOps, createGondolinReadOps, createGondolinToolDefinitions, createGondolinToolLifecycle, createGondolinWriteOps, createMoltNetTools, createPiOtelExtension, createPiRetryTriage, createPiTaskExecutor, createSubagentTool, createToolPolicyExtension, decideForEvent, decideToolCall, defineGondolinTemplate, definePiBrokeredHttpSecret, definePiExtension, definePiRuntime, definePiTool, enabledPiToolNames, ensureSnapshot, executeGondolinGrep, executePiTask, filterModelVisibleTools, findMainWorktree, guardGondolinToolDefinitions, injectRuntimeContext as injectTaskContext, isKernelTool, isResolvedPathInsideRoot, isToolVisible, loadCredentials, materializePiBrokeredHttpSecrets, materializePiExtensions, materializePiTools, normalizeRetryTriageResult, prepareBrokeredHttpSecrets, redactRetryTriageSecrets, resolveHostExecBaseEnv, resolveSessionToolPolicy, resolveTaskWorktreePath, resumeVm, toGuestPath };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/pi-runtime",
-  "version": "0.12.0",
+  "version": "0.12.1",
   "license": "MIT",
   "type": "module",
   "description": "Composable MoltNet runtime kernel for Pi agents in Gondolin VMs",
@@ -23,7 +23,7 @@
     "!dist/.dts"
   ],
   "dependencies": {
-    "@earendil-works/gondolin": "^0.9.1",
+    "@earendil-works/gondolin": "^0.12.0",
     "@ipld/dag-cbor": "^9.2.5",
     "@noble/curves": "^2.0.0",
     "@noble/ed25519": "^2.0.0",
@@ -32,10 +32,10 @@
     "multiformats": "^13.3.0",
     "typebox": "^1.2.8",
     "@themoltnet/agent-runtime": "0.44.0",
-    "@themoltnet/sandbox-gondolin": "0.3.0",
-    "@themoltnet/sdk": "0.137.0",
     "@themoltnet/os-keyring": "0.2.0",
-    "@themoltnet/shell-command-analyzer": "0.3.0"
+    "@themoltnet/sdk": "0.137.0",
+    "@themoltnet/shell-command-analyzer": "0.3.0",
+    "@themoltnet/sandbox-gondolin": "0.4.0"
   },
   "peerDependencies": {
     "@earendil-works/pi-ai": "0.79.4",
@@ -52,10 +52,10 @@
     "vite": "^8.0.0",
     "vite-plugin-dts": "^4.5.4",
     "vitest": "^3.0.0",
-    "@moltnet/crypto-service": "0.1.0",
-    "@moltnet/tasks": "0.1.0",
+    "@moltnet/runtime-profiles": "0.1.0",
     "@moltnet/models": "0.1.0",
-    "@moltnet/runtime-profiles": "0.1.0"
+    "@moltnet/crypto-service": "0.1.0",
+    "@moltnet/tasks": "0.1.0"
   },
   "engines": {
     "node": ">=24"