@themoltnet/pi-runtime 0.15.3 → 0.17.0

package/dist/index.d.ts

@@ -438,7 +438,7 @@ export declare function createToolPolicyExtension(deps: ToolPolicyExtensionDeps)
  * Map a pi `tool_call` event to a gate decision, extracting the shell command
  * for `bash` and delegating to {@link decideToolCall}.
  */
-export declare function decideForEvent(event: ToolCallEvent, policy: SessionToolPolicy, analyze: ShellCommandAnalyzer['analyze'], structuredToolNames?: ReadonlySet<string>): GateDecision;
+export declare function decideForEvent(event: ToolCallEvent, policy: SessionToolPolicy, analyze: ShellCommandAnalyzer['analyze']): GateDecision;
 
 /**
  * Decide whether a tool call is permitted by the resolved policy.
@@ -455,15 +455,19 @@ export declare function decideForEvent(event: ToolCallEvent, policy: SessionTool
  *    allow-set can't bound it. This is the interim conservative stance for
  *    issue #1348 — an operator who lists `bash` still cannot smuggle
  *    `bash -c "curl … | sh"` past `enforce`.
- * 3. **Unauthorized executables** — any resolved executable without either a
- *    non-colliding broad grant or a matching scoped shell-command rule.
+ * 3. **Unauthorized executables** — any resolved executable without a matching
+ *    shell-command rule. Tool names in `allowedTools` never authorize a shell
+ *    invocation.
+ * 4. **Output redirection** — a `bash` command that redirects output (`>`,
+ *    `2>`, `>>`, `&>`, …). No shell-command rule authorizes it; file writes go
+ *    through structured tools.
  *
  * KNOWN LIMITATION (follow-up): the `escapable` risk tier (GTFOBins binaries
  * like `find`, `tar`, `awk` that document shell-spawn / file-write techniques)
  * is NOT blocked on the tier alone. The analyzer already re-analyzes the
  * sub-commands it can see through documented escape flags (`find -exec`,
  * `tar --to-command`, …), but techniques it cannot parse statically could still
- * escape a name-based allow-set. Tightening `escapable` (e.g. an LLM judge or a
+ * escape an argv-prefix rule. Tightening `escapable` (e.g. an LLM judge or a
  * capability-aware allow-set) is tracked as future work.
  */
 export declare function decideToolCall(input: GateInput): GateDecision;
@@ -768,11 +772,15 @@ export declare interface GateInput {
     /** The shell command, when `toolName === 'bash'`. */
     command?: string;
     enforcement: ToolEnforcement;
-    /** Names the policy allows (structured tool names + broad executables). */
+    /**
+     * Runtime and MCP tool names the policy allows. Matched against `toolName`
+     * only; a tool name never authorizes a shell invocation.
+     */
     allowedTools: ReadonlySet<string>;
-    /** Structured tool names registered by the active runtime adapter. */
-    structuredToolNames?: ReadonlySet<string>;
-    /** Shell argv rules. Each rule matches the first N statically known tokens. */
+    /**
+     * Shell argv rules, the only authority for shell invocations. Each rule
+     * matches the first N statically known tokens.
+     */
     allowedShellCommands: readonly ShellCommandRule[];
     /**
      * Synchronous shell analyzer (`ShellCommandAnalyzer.analyze`). Injected so the
@@ -1450,7 +1458,7 @@ export declare interface SessionToolPolicy {
 }
 
 declare interface ShellCommandRule {
-    argvPrefix: readonly [string, string, ...string[]];
+    argvPrefix: readonly [string, ...string[]];
 }
 
 export { SnapshotConfig }
@@ -1521,14 +1529,12 @@ export declare interface ToolPolicyDecisionContext {
  * - `{ allow: false, reason }` — block it (enforce mode).
  * - `{ audit, ... }` — would-block, but proceed and record it (watch mode).
  */
-export declare type ToolPolicyDecisionReason = 'policy_off' | 'executor_protocol_tool' | 'policy_allowed' | 'shell_command_prefix_allowed' | 'shell_command_unresolvable' | 'arbitrary_code_interpreter' | 'shell_output_redirection_requires_broad_permission' | 'tool_not_permitted';
+export declare type ToolPolicyDecisionReason = 'policy_off' | 'executor_protocol_tool' | 'policy_allowed' | 'shell_command_prefix_allowed' | 'shell_command_unresolvable' | 'arbitrary_code_interpreter' | 'shell_output_redirection_not_permitted' | 'tool_not_permitted';
 
 export declare interface ToolPolicyExtensionDeps {
     policy: SessionToolPolicy;
     analyzer: ShellCommandAnalyzer;
     logger: ToolPolicyLogger;
-    /** Structured tool names registered by the active runtime adapter. */
-    structuredToolNames?: ReadonlySet<string>;
     context?: ToolPolicyDecisionContext;
 }
 

package/dist/index.js

@@ -2890,18 +2890,6 @@ Type.Object({ profileId: Type.String({ format: "uuid" }) }, {
 	$id: "RuntimeProfileRef",
 	additionalProperties: false
 });
-var RuntimeProfileLeaseTtlSec = Type.Integer({
-	minimum: 1,
-	maximum: 86400
-});
-var RuntimeProfileHeartbeatIntervalMs = Type.Integer({
-	minimum: 0,
-	maximum: 36e5
-});
-var RuntimeProfileMaxBatchSize = Type.Integer({
-	minimum: 1,
-	maximum: 1e3
-});
 var RuntimeProfileMaxTurns = Type.Integer({
 	minimum: 0,
 	maximum: 1e4
@@ -2930,21 +2918,8 @@ Type.Object({
 	maxOutputTokens: RuntimeProfileNullableMaxOutputTokens,
 	runtimeKind: RuntimeProfileRuntimeKind,
 	sandbox: RuntimeProfileSandbox,
-	sessionStorageMode: Type.Literal("local"),
-	workspaceStorageMode: Type.Literal("local"),
 	defaultWorkspaceMode: Type.Union([RuntimeProfileWorkspaceMode, Type.Null()]),
 	allowedWorkspaceModes: RuntimeProfileAllowedWorkspaceModes,
-	sessionTtlSec: Type.Integer({
-		minimum: 1,
-		maximum: 86400
-	}),
-	workspaceTtlSec: Type.Integer({
-		minimum: 1,
-		maximum: 86400
-	}),
-	leaseTtlSec: RuntimeProfileLeaseTtlSec,
-	heartbeatIntervalMs: RuntimeProfileHeartbeatIntervalMs,
-	maxBatchSize: RuntimeProfileMaxBatchSize,
 	maxTurns: RuntimeProfileMaxTurns,
 	maxBashTimeouts: RuntimeProfileMaxBashTimeouts,
 	toolEnforcement: RuntimeProfileToolEnforcement,
@@ -3077,6 +3052,7 @@ var ResolvedRuntimeSlot = Type.Object({
 	workspace: Type.Union([RuntimeWorkspace, Type.Null()])
 }, { $id: "ResolvedRuntimeSlot" });
 Type.Object({ items: Type.Array(ResolvedRuntimeSlot) }, { $id: "RuntimeSlotListResponse" });
+var MAX_RUNTIME_WARM_RETENTION_SEC = 86400;
 Type.Object({
 	agentName: Type.String({
 		minLength: 1,
@@ -3103,7 +3079,11 @@ Type.Object({
 	worktreeBranch: Type.Optional(Type.String({ minLength: 1 })),
 	workspaceKind: Type.Optional(RuntimeWorkspaceKind),
 	lastTaskId: Type.String({ format: "uuid" }),
-	lastAttemptN: Type.Integer({ minimum: 1 })
+	lastAttemptN: Type.Integer({ minimum: 1 }),
+	warmRetentionSec: Type.Integer({
+		minimum: 0,
+		maximum: MAX_RUNTIME_WARM_RETENTION_SEC
+	})
 }, {
 	$id: "BeginRuntimeSlotBody",
 	additionalProperties: false
@@ -3125,7 +3105,11 @@ Type.Object({
 	slotKey: Type.String({ minLength: 1 }),
 	taskId: Type.String({ format: "uuid" }),
 	attemptN: Type.Integer({ minimum: 1 }),
-	sessionPath: Type.Optional(Type.String({ minLength: 1 }))
+	sessionPath: Type.Optional(Type.String({ minLength: 1 })),
+	warmRetentionSec: Type.Integer({
+		minimum: 0,
+		maximum: MAX_RUNTIME_WARM_RETENTION_SEC
+	})
 }, {
 	$id: "FinishRuntimeSlotBody",
 	additionalProperties: false
@@ -3978,15 +3962,19 @@ function createGondolinBashOps(vm, localCwd, guestWorkspace, config) {
 *    allow-set can't bound it. This is the interim conservative stance for
 *    issue #1348 — an operator who lists `bash` still cannot smuggle
 *    `bash -c "curl … | sh"` past `enforce`.
-* 3. **Unauthorized executables** — any resolved executable without either a
-*    non-colliding broad grant or a matching scoped shell-command rule.
+* 3. **Unauthorized executables** — any resolved executable without a matching
+*    shell-command rule. Tool names in `allowedTools` never authorize a shell
+*    invocation.
+* 4. **Output redirection** — a `bash` command that redirects output (`>`,
+*    `2>`, `>>`, `&>`, …). No shell-command rule authorizes it; file writes go
+*    through structured tools.
 *
 * KNOWN LIMITATION (follow-up): the `escapable` risk tier (GTFOBins binaries
 * like `find`, `tar`, `awk` that document shell-spawn / file-write techniques)
 * is NOT blocked on the tier alone. The analyzer already re-analyzes the
 * sub-commands it can see through documented escape flags (`find -exec`,
 * `tar --to-command`, …), but techniques it cannot parse statically could still
-* escape a name-based allow-set. Tightening `escapable` (e.g. an LLM judge or a
+* escape an argv-prefix rule. Tightening `escapable` (e.g. an LLM judge or a
 * capability-aware allow-set) is tracked as future work.
 */
 function decideToolCall(input) {
@@ -4011,20 +3999,21 @@ function decideToolCall(input) {
 		return fenced(input.enforcement, "tool_not_permitted", `not permitted by tool policy: ${missing.join(", ")}`, `would block (watch): ${missing.join(", ")}`, missing);
 	}
 	const matchedShellCommands = [];
-	const structuredToolNames = input.structuredToolNames ?? DEFAULT_PI_STRUCTURED_TOOL_NAMES;
 	const missingShellCommands = resolved.tools.filter((tool) => {
-		if (input.allowedTools.has(tool.name) && !structuredToolNames.has(tool.name)) return false;
 		const matched = input.allowedShellCommands.find((rule) => matchesArgvPrefix(tool.argv, rule.argvPrefix));
 		if (!matched) return true;
 		matchedShellCommands.push(toMatchedShellCommand(tool.name, matched.argvPrefix));
 		return false;
 	}).map(toMissingShellCommand);
-	if (missingShellCommands.length === 0 && resolved.hasOutputRedirection && matchedShellCommands.length > 0) return fenced(input.enforcement, "shell_output_redirection_requires_broad_permission", "shell output redirection requires broad executable permission", "would block shell output redirection under scoped command policy", [...new Set(matchedShellCommands.map(({ executable }) => executable))], matchedShellCommands.map(({ executable, argvPrefixFingerprint, argvPrefixLength }) => ({
-		executable,
-		argvFingerprint: argvPrefixFingerprint,
-		argvLength: argvPrefixLength,
-		dynamicTokenCount: 0
-	})));
+	if (missingShellCommands.length === 0 && resolved.hasOutputRedirection) {
+		const executables = [...new Set(matchedShellCommands.map(({ executable }) => executable))];
+		return fenced(input.enforcement, "shell_output_redirection_not_permitted", "shell output redirection is not permitted by tool policy", "would block shell output redirection (watch)", executables.length > 0 ? executables : void 0, matchedShellCommands.map(({ executable, argvPrefixFingerprint, argvPrefixLength }) => ({
+			executable,
+			argvFingerprint: argvPrefixFingerprint,
+			argvLength: argvPrefixLength,
+			dynamicTokenCount: 0
+		})));
+	}
 	if (missingShellCommands.length === 0) return matchedShellCommands.length > 0 ? {
 		allow: true,
 		reasonCode: "shell_command_prefix_allowed",
@@ -4036,20 +4025,6 @@ function decideToolCall(input) {
 	const missing = [...new Set(missingShellCommands.map(({ executable }) => executable))];
 	return fenced(input.enforcement, "tool_not_permitted", `not permitted by tool policy: ${missing.join(", ")}`, `would block (watch): ${missing.join(", ")}`, missing, missingShellCommands);
 }
-/**
-* Protect direct gate callers that predate active-runtime tool projection.
-* The session integration supplies the complete registered set, including
-* custom tools, while these are Pi's built-in structured tool names.
-*/
-var DEFAULT_PI_STRUCTURED_TOOL_NAMES = new Set([
-	"read",
-	"write",
-	"edit",
-	"bash",
-	"grep",
-	"ls",
-	"find"
-]);
 function fingerprintArgv(argv) {
 	return `sha256:${createHash("sha256").update(JSON.stringify(argv.map((token) => token === null ? { dynamic: true } : token))).digest("hex").slice(0, 16)}`;
 }
@@ -4152,7 +4127,7 @@ async function resolveSessionToolPolicy(input) {
 			enforcement: resolved.enforcement,
 			allowedTools: new Set(resolved.allowedTools),
 			allowedShellCommands: shellCommands.map((rule) => {
-				if (rule.argvPrefix.length < 2 || rule.argvPrefix.length > 8 || rule.argvPrefix.some((token) => !token)) throw new Error("runtime returned an invalid shell command rule");
+				if (rule.argvPrefix.length < 1 || rule.argvPrefix.length > 8 || rule.argvPrefix.some((token) => !token)) throw new Error("runtime returned an invalid shell command rule");
 				return { argvPrefix: rule.argvPrefix };
 			}),
 			executionPolicySnapshotHash: resolved.policySnapshotHash,
@@ -4212,14 +4187,13 @@ async function withTimeout$1(promise, timeoutMs) {
 * Map a pi `tool_call` event to a gate decision, extracting the shell command
 * for `bash` and delegating to {@link decideToolCall}.
 */
-function decideForEvent(event, policy, analyze, structuredToolNames) {
+function decideForEvent(event, policy, analyze) {
 	const command = event.toolName === "bash" ? event.input.command : void 0;
 	return decideToolCall({
 		toolName: event.toolName,
 		command,
 		enforcement: policy.enforcement,
 		allowedTools: policy.allowedTools,
-		structuredToolNames,
 		allowedShellCommands: policy.allowedShellCommands,
 		analyze
 	});
@@ -4238,7 +4212,7 @@ function createToolPolicyExtension(deps) {
 	return (pi) => {
 		if (deps.policy.enforcement === "off") return;
 		pi.on("tool_call", (event) => {
-			const decision = decideForEvent(event, deps.policy, (command) => deps.analyzer.analyze(command), deps.structuredToolNames);
+			const decision = decideForEvent(event, deps.policy, (command) => deps.analyzer.analyze(command));
 			if ("allow" in decision && decision.allow) {
 				deps.logger.info({
 					...decisionContext(deps),
@@ -4760,7 +4734,7 @@ function buildToolPolicyInstructions(policy) {
 	lines.push(policy.allowedTools.length > 0 ? "- The visible structured-tool definitions are the authorized surface." : policy.enforcement === "enforce" ? "- No optional structured tools are authorized." : "- No optional structured tools are registered.");
 	if (policy.enforcement === "watch") lines.push("- Watch mode records policy decisions but does not block tool calls.");
 	else if (policy.allowedShellCommands.length === 0) lines.push("- No shell commands are authorized. `bash` is not available; do not", "  attempt shell, filesystem, git, GitHub CLI, or MoltNet CLI commands.");
-	else lines.push("- Shell commands are restricted to these authorized argv prefixes:", ...renderShellCommandPrefixes(policy.allowedShellCommands), "- A visible `bash` tool does not grant broader shell authority. Do not", "  attempt commands outside those prefixes.");
+	else lines.push("- Shell commands are restricted to these authorized argv prefixes:", ...renderShellCommandPrefixes(policy.allowedShellCommands), "- A visible `bash` tool does not grant broader shell authority. Do not", "  attempt commands outside those prefixes.", "- Output redirection (`>`, `2>`, `>>`, `&>`) is never authorized, even", "  for an authorized prefix. Write files with the structured file tools.");
 	lines.push("- Tools and commands absent from this effective policy are unavailable,", "  even if advisory context mentions them.");
 	return lines.join("\n");
 }
@@ -6483,14 +6457,6 @@ async function executePiTask(claimedTask, reporter, opts) {
 			};
 			const toolPolicyDecisionContext = buildToolPolicyDecisionContext(claimedTask, opts.runtimeProfileId);
 			const taskHasSubagents = taskTypeUsesSubagents(task.taskType);
-			const structuredToolNames = new Set([
-				...gondolinCustomTools.map((tool) => tool.name),
-				...moltnetTools.map((tool) => tool.name),
-				...submitTools.map((tool) => tool.name),
-				...opts.runtimeDefinition?.tools.map((tool) => tool.descriptor.name) ?? [],
-				...opts.runtimeDefinition?.extensions.flatMap((extension) => extension.declaredTools) ?? [],
-				...taskHasSubagents ? ["subagent"] : []
-			]);
 			if (opts.runtimeProfileId && opts.toolEnforcement) {
 				const policy = await resolveSessionToolPolicy({
 					agent: moltnetAgent,
@@ -6515,7 +6481,6 @@ async function executePiTask(claimedTask, reporter, opts) {
 						policy: resolvedToolPolicy,
 						analyzer,
 						logger: toolPolicyLogger,
-						structuredToolNames,
 						context: toolPolicyDecisionContext
 					}));
 				}

package/dist/pi-config.d.ts

@@ -1,8 +1,30 @@
+/**
+ * Every input modality Pi understands. Canonical for the repo: daemon
+ * validation, CLI parsing and wire schemas derive their allowed values from
+ * this list so they cannot drift from what Pi actually accepts.
+ */
+export declare const PI_MODEL_MODALITIES: readonly ["text", "image"];
+
+/** Input modalities Pi understands for a model entry. */
+export declare type PiModelModality = (typeof PI_MODEL_MODALITIES)[number];
+
+/**
+ * A model entry in Pi's `models.json`. `input` declares the modalities the
+ * model accepts. Pi treats an entry with no `input` as text-only, so a vision
+ * model must declare `['text', 'image']` or image content parts never reach
+ * the provider.
+ */
+export declare interface PiModelSpec {
+    id: string;
+    input?: readonly PiModelModality[];
+}
+
 export declare interface WriteMultiProviderPiConfigInput extends WritePiConfigBase {
     /** Provider registry keyed by Pi provider id. */
     providers: Readonly<Record<string, WritePiProviderInput>>;
     provider?: never;
     model?: never;
+    input?: never;
     baseUrl?: never;
     apiKeyEnvRef?: never;
 }
@@ -27,8 +49,8 @@ export declare interface WritePiProviderInput {
     api: string;
     /** Provider base URL. */
     baseUrl: string;
-    /** Model ids exposed by this provider. */
-    models: readonly string[];
+    /** Models exposed by this provider. */
+    models: readonly PiModelSpec[];
     /** Optional Pi environment placeholder, e.g. `$OLLAMA_API_KEY`. */
     apiKeyEnvRef?: string;
 }
@@ -38,6 +60,8 @@ export declare interface WriteSingleProviderPiConfigInput extends WritePiConfigB
     provider: string;
     /** Pi model id, e.g. `qwen3-coder:480b-cloud`. */
     model: string;
+    /** Input modalities for `model`. Omitted leaves Pi's text-only default. */
+    input?: readonly PiModelModality[];
     /**
      * OpenAI-completions base URL for the provider. Defaults to Ollama Cloud.
      */

package/dist/pi-config.js

@@ -3,6 +3,22 @@ import { join } from "node:path";
 //#region src/pi-config.ts
 /** Node-only writer used by daemon serve runs and live evals. */
 /**
+* Every input modality Pi understands. Canonical for the repo: daemon
+* validation, CLI parsing and wire schemas derive their allowed values from
+* this list so they cannot drift from what Pi actually accepts.
+*/
+var PI_MODEL_MODALITIES = ["text", "image"];
+/**
+* Normalise a model entry to Pi's on-disk shape. `input` is emitted only when
+* declared, so a text-only model serializes as a bare `{ id }`.
+*/
+function toPiModel(entry) {
+	return {
+		id: entry.id,
+		...entry.input && entry.input.length > 0 ? { input: [...entry.input] } : {}
+	};
+}
+/**
 * Write Pi `models.json` + `settings.json`. Eval callers use the single-provider
 * form so scores stay attributable; serve callers may supply many providers.
 */
@@ -12,12 +28,15 @@ function writePiConfig(input) {
 		api: provider.api,
 		...provider.apiKeyEnvRef ? { apiKey: provider.apiKeyEnvRef } : {},
 		baseUrl: provider.baseUrl,
-		models: provider.models.map((id) => ({ id }))
+		models: provider.models.map(toPiModel)
 	}])) : { [input.provider]: {
 		api: "openai-completions",
 		apiKey: input.apiKeyEnvRef ?? "$OLLAMA_API_KEY",
 		baseUrl: input.baseUrl ?? "https://ollama.com/v1",
-		models: [{ id: input.model }]
+		models: [toPiModel({
+			id: input.model,
+			input: input.input
+		})]
 	} };
 	writeFileSync(join(input.piDir, "models.json"), JSON.stringify({ providers }, null, 2) + "\n", "utf8");
 	const defaultSettings = multiProvider ? { enableInstallTelemetry: false } : {
@@ -35,4 +54,4 @@ function writePiConfig(input) {
 	}, null, 2) + "\n", "utf8");
 }
 //#endregion
-export { writePiConfig };
+export { PI_MODEL_MODALITIES, writePiConfig };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/pi-runtime",
-  "version": "0.15.3",
+  "version": "0.17.0",
   "license": "MIT",
   "type": "module",
   "description": "Composable MoltNet runtime kernel for Pi agents in Gondolin VMs",
@@ -35,11 +35,11 @@
     "@opentelemetry/api": "^1.9.1",
     "multiformats": "^13.3.0",
     "typebox": "^1.2.8",
-    "@themoltnet/os-keyring": "0.3.0",
     "@themoltnet/agent-runtime": "1.0.3",
-    "@themoltnet/sandbox-gondolin": "0.5.1",
     "@themoltnet/sdk": "0.142.0",
-    "@themoltnet/shell-command-analyzer": "0.3.0"
+    "@themoltnet/shell-command-analyzer": "0.3.0",
+    "@themoltnet/os-keyring": "0.3.0",
+    "@themoltnet/sandbox-gondolin": "0.5.1"
   },
   "peerDependencies": {
     "@earendil-works/pi-ai": "0.84.4",
@@ -57,9 +57,9 @@
     "vite-plugin-dts": "^4.5.4",
     "vitest": "^3.0.0",
     "@moltnet/crypto-service": "0.1.0",
-    "@moltnet/runtime-profiles": "0.1.0",
     "@moltnet/models": "0.1.0",
-    "@moltnet/tasks": "0.1.0"
+    "@moltnet/tasks": "0.1.0",
+    "@moltnet/runtime-profiles": "0.1.0"
   },
   "engines": {
     "node": ">=24"