@themoltnet/pi-runtime 0.15.3 → 0.16.0

package/dist/index.d.ts

@@ -438,7 +438,7 @@ export declare function createToolPolicyExtension(deps: ToolPolicyExtensionDeps)
  * Map a pi `tool_call` event to a gate decision, extracting the shell command
  * for `bash` and delegating to {@link decideToolCall}.
  */
-export declare function decideForEvent(event: ToolCallEvent, policy: SessionToolPolicy, analyze: ShellCommandAnalyzer['analyze'], structuredToolNames?: ReadonlySet<string>): GateDecision;
+export declare function decideForEvent(event: ToolCallEvent, policy: SessionToolPolicy, analyze: ShellCommandAnalyzer['analyze']): GateDecision;
 
 /**
  * Decide whether a tool call is permitted by the resolved policy.
@@ -455,15 +455,19 @@ export declare function decideForEvent(event: ToolCallEvent, policy: SessionTool
  *    allow-set can't bound it. This is the interim conservative stance for
  *    issue #1348 — an operator who lists `bash` still cannot smuggle
  *    `bash -c "curl … | sh"` past `enforce`.
- * 3. **Unauthorized executables** — any resolved executable without either a
- *    non-colliding broad grant or a matching scoped shell-command rule.
+ * 3. **Unauthorized executables** — any resolved executable without a matching
+ *    shell-command rule. Tool names in `allowedTools` never authorize a shell
+ *    invocation.
+ * 4. **Output redirection** — a `bash` command that redirects output (`>`,
+ *    `2>`, `>>`, `&>`, …). No shell-command rule authorizes it; file writes go
+ *    through structured tools.
  *
  * KNOWN LIMITATION (follow-up): the `escapable` risk tier (GTFOBins binaries
  * like `find`, `tar`, `awk` that document shell-spawn / file-write techniques)
  * is NOT blocked on the tier alone. The analyzer already re-analyzes the
  * sub-commands it can see through documented escape flags (`find -exec`,
  * `tar --to-command`, …), but techniques it cannot parse statically could still
- * escape a name-based allow-set. Tightening `escapable` (e.g. an LLM judge or a
+ * escape an argv-prefix rule. Tightening `escapable` (e.g. an LLM judge or a
  * capability-aware allow-set) is tracked as future work.
  */
 export declare function decideToolCall(input: GateInput): GateDecision;
@@ -768,11 +772,15 @@ export declare interface GateInput {
     /** The shell command, when `toolName === 'bash'`. */
     command?: string;
     enforcement: ToolEnforcement;
-    /** Names the policy allows (structured tool names + broad executables). */
+    /**
+     * Runtime and MCP tool names the policy allows. Matched against `toolName`
+     * only; a tool name never authorizes a shell invocation.
+     */
     allowedTools: ReadonlySet<string>;
-    /** Structured tool names registered by the active runtime adapter. */
-    structuredToolNames?: ReadonlySet<string>;
-    /** Shell argv rules. Each rule matches the first N statically known tokens. */
+    /**
+     * Shell argv rules, the only authority for shell invocations. Each rule
+     * matches the first N statically known tokens.
+     */
     allowedShellCommands: readonly ShellCommandRule[];
     /**
      * Synchronous shell analyzer (`ShellCommandAnalyzer.analyze`). Injected so the
@@ -1450,7 +1458,7 @@ export declare interface SessionToolPolicy {
 }
 
 declare interface ShellCommandRule {
-    argvPrefix: readonly [string, string, ...string[]];
+    argvPrefix: readonly [string, ...string[]];
 }
 
 export { SnapshotConfig }
@@ -1521,14 +1529,12 @@ export declare interface ToolPolicyDecisionContext {
  * - `{ allow: false, reason }` — block it (enforce mode).
  * - `{ audit, ... }` — would-block, but proceed and record it (watch mode).
  */
-export declare type ToolPolicyDecisionReason = 'policy_off' | 'executor_protocol_tool' | 'policy_allowed' | 'shell_command_prefix_allowed' | 'shell_command_unresolvable' | 'arbitrary_code_interpreter' | 'shell_output_redirection_requires_broad_permission' | 'tool_not_permitted';
+export declare type ToolPolicyDecisionReason = 'policy_off' | 'executor_protocol_tool' | 'policy_allowed' | 'shell_command_prefix_allowed' | 'shell_command_unresolvable' | 'arbitrary_code_interpreter' | 'shell_output_redirection_not_permitted' | 'tool_not_permitted';
 
 export declare interface ToolPolicyExtensionDeps {
     policy: SessionToolPolicy;
     analyzer: ShellCommandAnalyzer;
     logger: ToolPolicyLogger;
-    /** Structured tool names registered by the active runtime adapter. */
-    structuredToolNames?: ReadonlySet<string>;
     context?: ToolPolicyDecisionContext;
 }
 

package/dist/index.js

@@ -2890,18 +2890,6 @@ Type.Object({ profileId: Type.String({ format: "uuid" }) }, {
 	$id: "RuntimeProfileRef",
 	additionalProperties: false
 });
-var RuntimeProfileLeaseTtlSec = Type.Integer({
-	minimum: 1,
-	maximum: 86400
-});
-var RuntimeProfileHeartbeatIntervalMs = Type.Integer({
-	minimum: 0,
-	maximum: 36e5
-});
-var RuntimeProfileMaxBatchSize = Type.Integer({
-	minimum: 1,
-	maximum: 1e3
-});
 var RuntimeProfileMaxTurns = Type.Integer({
 	minimum: 0,
 	maximum: 1e4
@@ -2930,21 +2918,8 @@ Type.Object({
 	maxOutputTokens: RuntimeProfileNullableMaxOutputTokens,
 	runtimeKind: RuntimeProfileRuntimeKind,
 	sandbox: RuntimeProfileSandbox,
-	sessionStorageMode: Type.Literal("local"),
-	workspaceStorageMode: Type.Literal("local"),
 	defaultWorkspaceMode: Type.Union([RuntimeProfileWorkspaceMode, Type.Null()]),
 	allowedWorkspaceModes: RuntimeProfileAllowedWorkspaceModes,
-	sessionTtlSec: Type.Integer({
-		minimum: 1,
-		maximum: 86400
-	}),
-	workspaceTtlSec: Type.Integer({
-		minimum: 1,
-		maximum: 86400
-	}),
-	leaseTtlSec: RuntimeProfileLeaseTtlSec,
-	heartbeatIntervalMs: RuntimeProfileHeartbeatIntervalMs,
-	maxBatchSize: RuntimeProfileMaxBatchSize,
 	maxTurns: RuntimeProfileMaxTurns,
 	maxBashTimeouts: RuntimeProfileMaxBashTimeouts,
 	toolEnforcement: RuntimeProfileToolEnforcement,
@@ -3077,6 +3052,7 @@ var ResolvedRuntimeSlot = Type.Object({
 	workspace: Type.Union([RuntimeWorkspace, Type.Null()])
 }, { $id: "ResolvedRuntimeSlot" });
 Type.Object({ items: Type.Array(ResolvedRuntimeSlot) }, { $id: "RuntimeSlotListResponse" });
+var MAX_RUNTIME_WARM_RETENTION_SEC = 86400;
 Type.Object({
 	agentName: Type.String({
 		minLength: 1,
@@ -3103,7 +3079,11 @@ Type.Object({
 	worktreeBranch: Type.Optional(Type.String({ minLength: 1 })),
 	workspaceKind: Type.Optional(RuntimeWorkspaceKind),
 	lastTaskId: Type.String({ format: "uuid" }),
-	lastAttemptN: Type.Integer({ minimum: 1 })
+	lastAttemptN: Type.Integer({ minimum: 1 }),
+	warmRetentionSec: Type.Integer({
+		minimum: 0,
+		maximum: MAX_RUNTIME_WARM_RETENTION_SEC
+	})
 }, {
 	$id: "BeginRuntimeSlotBody",
 	additionalProperties: false
@@ -3125,7 +3105,11 @@ Type.Object({
 	slotKey: Type.String({ minLength: 1 }),
 	taskId: Type.String({ format: "uuid" }),
 	attemptN: Type.Integer({ minimum: 1 }),
-	sessionPath: Type.Optional(Type.String({ minLength: 1 }))
+	sessionPath: Type.Optional(Type.String({ minLength: 1 })),
+	warmRetentionSec: Type.Integer({
+		minimum: 0,
+		maximum: MAX_RUNTIME_WARM_RETENTION_SEC
+	})
 }, {
 	$id: "FinishRuntimeSlotBody",
 	additionalProperties: false
@@ -3978,15 +3962,19 @@ function createGondolinBashOps(vm, localCwd, guestWorkspace, config) {
 *    allow-set can't bound it. This is the interim conservative stance for
 *    issue #1348 — an operator who lists `bash` still cannot smuggle
 *    `bash -c "curl … | sh"` past `enforce`.
-* 3. **Unauthorized executables** — any resolved executable without either a
-*    non-colliding broad grant or a matching scoped shell-command rule.
+* 3. **Unauthorized executables** — any resolved executable without a matching
+*    shell-command rule. Tool names in `allowedTools` never authorize a shell
+*    invocation.
+* 4. **Output redirection** — a `bash` command that redirects output (`>`,
+*    `2>`, `>>`, `&>`, …). No shell-command rule authorizes it; file writes go
+*    through structured tools.
 *
 * KNOWN LIMITATION (follow-up): the `escapable` risk tier (GTFOBins binaries
 * like `find`, `tar`, `awk` that document shell-spawn / file-write techniques)
 * is NOT blocked on the tier alone. The analyzer already re-analyzes the
 * sub-commands it can see through documented escape flags (`find -exec`,
 * `tar --to-command`, …), but techniques it cannot parse statically could still
-* escape a name-based allow-set. Tightening `escapable` (e.g. an LLM judge or a
+* escape an argv-prefix rule. Tightening `escapable` (e.g. an LLM judge or a
 * capability-aware allow-set) is tracked as future work.
 */
 function decideToolCall(input) {
@@ -4011,20 +3999,21 @@ function decideToolCall(input) {
 		return fenced(input.enforcement, "tool_not_permitted", `not permitted by tool policy: ${missing.join(", ")}`, `would block (watch): ${missing.join(", ")}`, missing);
 	}
 	const matchedShellCommands = [];
-	const structuredToolNames = input.structuredToolNames ?? DEFAULT_PI_STRUCTURED_TOOL_NAMES;
 	const missingShellCommands = resolved.tools.filter((tool) => {
-		if (input.allowedTools.has(tool.name) && !structuredToolNames.has(tool.name)) return false;
 		const matched = input.allowedShellCommands.find((rule) => matchesArgvPrefix(tool.argv, rule.argvPrefix));
 		if (!matched) return true;
 		matchedShellCommands.push(toMatchedShellCommand(tool.name, matched.argvPrefix));
 		return false;
 	}).map(toMissingShellCommand);
-	if (missingShellCommands.length === 0 && resolved.hasOutputRedirection && matchedShellCommands.length > 0) return fenced(input.enforcement, "shell_output_redirection_requires_broad_permission", "shell output redirection requires broad executable permission", "would block shell output redirection under scoped command policy", [...new Set(matchedShellCommands.map(({ executable }) => executable))], matchedShellCommands.map(({ executable, argvPrefixFingerprint, argvPrefixLength }) => ({
-		executable,
-		argvFingerprint: argvPrefixFingerprint,
-		argvLength: argvPrefixLength,
-		dynamicTokenCount: 0
-	})));
+	if (missingShellCommands.length === 0 && resolved.hasOutputRedirection) {
+		const executables = [...new Set(matchedShellCommands.map(({ executable }) => executable))];
+		return fenced(input.enforcement, "shell_output_redirection_not_permitted", "shell output redirection is not permitted by tool policy", "would block shell output redirection (watch)", executables.length > 0 ? executables : void 0, matchedShellCommands.map(({ executable, argvPrefixFingerprint, argvPrefixLength }) => ({
+			executable,
+			argvFingerprint: argvPrefixFingerprint,
+			argvLength: argvPrefixLength,
+			dynamicTokenCount: 0
+		})));
+	}
 	if (missingShellCommands.length === 0) return matchedShellCommands.length > 0 ? {
 		allow: true,
 		reasonCode: "shell_command_prefix_allowed",
@@ -4036,20 +4025,6 @@ function decideToolCall(input) {
 	const missing = [...new Set(missingShellCommands.map(({ executable }) => executable))];
 	return fenced(input.enforcement, "tool_not_permitted", `not permitted by tool policy: ${missing.join(", ")}`, `would block (watch): ${missing.join(", ")}`, missing, missingShellCommands);
 }
-/**
-* Protect direct gate callers that predate active-runtime tool projection.
-* The session integration supplies the complete registered set, including
-* custom tools, while these are Pi's built-in structured tool names.
-*/
-var DEFAULT_PI_STRUCTURED_TOOL_NAMES = new Set([
-	"read",
-	"write",
-	"edit",
-	"bash",
-	"grep",
-	"ls",
-	"find"
-]);
 function fingerprintArgv(argv) {
 	return `sha256:${createHash("sha256").update(JSON.stringify(argv.map((token) => token === null ? { dynamic: true } : token))).digest("hex").slice(0, 16)}`;
 }
@@ -4152,7 +4127,7 @@ async function resolveSessionToolPolicy(input) {
 			enforcement: resolved.enforcement,
 			allowedTools: new Set(resolved.allowedTools),
 			allowedShellCommands: shellCommands.map((rule) => {
-				if (rule.argvPrefix.length < 2 || rule.argvPrefix.length > 8 || rule.argvPrefix.some((token) => !token)) throw new Error("runtime returned an invalid shell command rule");
+				if (rule.argvPrefix.length < 1 || rule.argvPrefix.length > 8 || rule.argvPrefix.some((token) => !token)) throw new Error("runtime returned an invalid shell command rule");
 				return { argvPrefix: rule.argvPrefix };
 			}),
 			executionPolicySnapshotHash: resolved.policySnapshotHash,
@@ -4212,14 +4187,13 @@ async function withTimeout$1(promise, timeoutMs) {
 * Map a pi `tool_call` event to a gate decision, extracting the shell command
 * for `bash` and delegating to {@link decideToolCall}.
 */
-function decideForEvent(event, policy, analyze, structuredToolNames) {
+function decideForEvent(event, policy, analyze) {
 	const command = event.toolName === "bash" ? event.input.command : void 0;
 	return decideToolCall({
 		toolName: event.toolName,
 		command,
 		enforcement: policy.enforcement,
 		allowedTools: policy.allowedTools,
-		structuredToolNames,
 		allowedShellCommands: policy.allowedShellCommands,
 		analyze
 	});
@@ -4238,7 +4212,7 @@ function createToolPolicyExtension(deps) {
 	return (pi) => {
 		if (deps.policy.enforcement === "off") return;
 		pi.on("tool_call", (event) => {
-			const decision = decideForEvent(event, deps.policy, (command) => deps.analyzer.analyze(command), deps.structuredToolNames);
+			const decision = decideForEvent(event, deps.policy, (command) => deps.analyzer.analyze(command));
 			if ("allow" in decision && decision.allow) {
 				deps.logger.info({
 					...decisionContext(deps),
@@ -4760,7 +4734,7 @@ function buildToolPolicyInstructions(policy) {
 	lines.push(policy.allowedTools.length > 0 ? "- The visible structured-tool definitions are the authorized surface." : policy.enforcement === "enforce" ? "- No optional structured tools are authorized." : "- No optional structured tools are registered.");
 	if (policy.enforcement === "watch") lines.push("- Watch mode records policy decisions but does not block tool calls.");
 	else if (policy.allowedShellCommands.length === 0) lines.push("- No shell commands are authorized. `bash` is not available; do not", "  attempt shell, filesystem, git, GitHub CLI, or MoltNet CLI commands.");
-	else lines.push("- Shell commands are restricted to these authorized argv prefixes:", ...renderShellCommandPrefixes(policy.allowedShellCommands), "- A visible `bash` tool does not grant broader shell authority. Do not", "  attempt commands outside those prefixes.");
+	else lines.push("- Shell commands are restricted to these authorized argv prefixes:", ...renderShellCommandPrefixes(policy.allowedShellCommands), "- A visible `bash` tool does not grant broader shell authority. Do not", "  attempt commands outside those prefixes.", "- Output redirection (`>`, `2>`, `>>`, `&>`) is never authorized, even", "  for an authorized prefix. Write files with the structured file tools.");
 	lines.push("- Tools and commands absent from this effective policy are unavailable,", "  even if advisory context mentions them.");
 	return lines.join("\n");
 }
@@ -6483,14 +6457,6 @@ async function executePiTask(claimedTask, reporter, opts) {
 			};
 			const toolPolicyDecisionContext = buildToolPolicyDecisionContext(claimedTask, opts.runtimeProfileId);
 			const taskHasSubagents = taskTypeUsesSubagents(task.taskType);
-			const structuredToolNames = new Set([
-				...gondolinCustomTools.map((tool) => tool.name),
-				...moltnetTools.map((tool) => tool.name),
-				...submitTools.map((tool) => tool.name),
-				...opts.runtimeDefinition?.tools.map((tool) => tool.descriptor.name) ?? [],
-				...opts.runtimeDefinition?.extensions.flatMap((extension) => extension.declaredTools) ?? [],
-				...taskHasSubagents ? ["subagent"] : []
-			]);
 			if (opts.runtimeProfileId && opts.toolEnforcement) {
 				const policy = await resolveSessionToolPolicy({
 					agent: moltnetAgent,
@@ -6515,7 +6481,6 @@ async function executePiTask(claimedTask, reporter, opts) {
 						policy: resolvedToolPolicy,
 						analyzer,
 						logger: toolPolicyLogger,
-						structuredToolNames,
 						context: toolPolicyDecisionContext
 					}));
 				}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/pi-runtime",
-  "version": "0.15.3",
+  "version": "0.16.0",
   "license": "MIT",
   "type": "module",
   "description": "Composable MoltNet runtime kernel for Pi agents in Gondolin VMs",
@@ -35,11 +35,11 @@
     "@opentelemetry/api": "^1.9.1",
     "multiformats": "^13.3.0",
     "typebox": "^1.2.8",
-    "@themoltnet/os-keyring": "0.3.0",
     "@themoltnet/agent-runtime": "1.0.3",
-    "@themoltnet/sandbox-gondolin": "0.5.1",
+    "@themoltnet/os-keyring": "0.3.0",
     "@themoltnet/sdk": "0.142.0",
-    "@themoltnet/shell-command-analyzer": "0.3.0"
+    "@themoltnet/shell-command-analyzer": "0.3.0",
+    "@themoltnet/sandbox-gondolin": "0.5.1"
   },
   "peerDependencies": {
     "@earendil-works/pi-ai": "0.84.4",
@@ -56,9 +56,9 @@
     "vite": "^8.0.0",
     "vite-plugin-dts": "^4.5.4",
     "vitest": "^3.0.0",
-    "@moltnet/crypto-service": "0.1.0",
-    "@moltnet/runtime-profiles": "0.1.0",
     "@moltnet/models": "0.1.0",
+    "@moltnet/runtime-profiles": "0.1.0",
+    "@moltnet/crypto-service": "0.1.0",
     "@moltnet/tasks": "0.1.0"
   },
   "engines": {