@themoltnet/pi-runtime 0.17.0 → 0.18.1

package/dist/index.d.ts

@@ -461,6 +461,11 @@ export declare function decideForEvent(event: ToolCallEvent, policy: SessionTool
  * 4. **Output redirection** — a `bash` command that redirects output (`>`,
  *    `2>`, `>>`, `&>`, …). No shell-command rule authorizes it; file writes go
  *    through structured tools.
+ * 5. **Execution-redirecting environment prefixes** — a `VAR=value` prefix that
+ *    changes which binary argv names or injects code into it (`PATH`, `LD_*`,
+ *    `BASH_ENV`, …; see {@link UNSAFE_ENV_NAMES}). Such a prefix is not argv, so
+ *    the matched rule would describe a different program than the one that runs.
+ *    Benign assignments are unaffected.
  *
  * KNOWN LIMITATION (follow-up): the `escapable` risk tier (GTFOBins binaries
  * like `find`, `tar`, `awk` that document shell-spawn / file-write techniques)
@@ -1529,13 +1534,41 @@ export declare interface ToolPolicyDecisionContext {
  * - `{ allow: false, reason }` — block it (enforce mode).
  * - `{ audit, ... }` — would-block, but proceed and record it (watch mode).
  */
-export declare type ToolPolicyDecisionReason = 'policy_off' | 'executor_protocol_tool' | 'policy_allowed' | 'shell_command_prefix_allowed' | 'shell_command_unresolvable' | 'arbitrary_code_interpreter' | 'shell_output_redirection_not_permitted' | 'tool_not_permitted';
+export declare type ToolPolicyDecisionReason = 'policy_off' | 'executor_protocol_tool' | 'policy_allowed' | 'shell_command_prefix_allowed' | 'shell_command_unresolvable' | 'arbitrary_code_interpreter' | 'shell_output_redirection_not_permitted' | 'unsafe_environment_assignment' | 'tool_not_permitted';
+
+/**
+ * A refusal, shaped for the task record. Carries no argv literals: the
+ * executables and the fingerprint identify an invocation without reproducing
+ * its arguments, which is what lets this reach a persisted, readable record
+ * with no redaction rule.
+ */
+declare interface ToolPolicyDecisionRecord {
+    /** `blocked` in enforce, `would_block` in watch. */
+    decision: 'blocked' | 'would_block';
+    tool_name: string;
+    tool_call_id?: string;
+    reason_code: ToolPolicyDecisionReason;
+    enforcement: ToolEnforcement;
+    /** Executables the policy did not authorize. */
+    unauthorized_executables?: string[];
+    /** Literal-free identification of each refused shell invocation. */
+    shell_fingerprints?: MissingShellCommand[];
+    degraded: boolean;
+    policy_snapshot_hash?: string;
+    runtime_profile_revision?: number;
+}
 
 export declare interface ToolPolicyExtensionDeps {
     policy: SessionToolPolicy;
     analyzer: ShellCommandAnalyzer;
     logger: ToolPolicyLogger;
     context?: ToolPolicyDecisionContext;
+    /**
+     * Called for every refusal so it reaches the task record, not only the
+     * daemon log. Pi's `tool_call` handler is synchronous, so this must not
+     * block: implementations fire and forget.
+     */
+    onDecision?: (decision: ToolPolicyDecisionRecord) => void;
 }
 
 /**

package/dist/index.js

@@ -253,11 +253,54 @@ var CREDENTIAL_SCOPES = {
 	TaskManage: "task:manage",
 	TaskRead: "task:read",
 	TaskWrite: "task:write",
+	TeamJoin: "team:join",
 	TeamManage: "team:manage",
 	TeamRead: "team:read"
 };
 var ALL_CREDENTIAL_SCOPES = Object.freeze(Object.values(CREDENTIAL_SCOPES));
-CREDENTIAL_SCOPES.AgentProfile, CREDENTIAL_SCOPES.CryptoSign, CREDENTIAL_SCOPES.RuntimeRead, CREDENTIAL_SCOPES.TaskRead, CREDENTIAL_SCOPES.TaskClaim, CREDENTIAL_SCOPES.TaskExecute;
+/**
+* What the agent daemon cannot run without, checked against
+* `GET /agents/whoami` at startup. Task credentials attenuate it further to
+* `task:execute` alone.
+*
+* This is the **boot floor**, and deliberately not the same list as
+* `AGENT_CREDENTIAL_SCOPES`. A credential's scopes are fixed when it is minted
+* and `POST /agent-keys` caps a new key at the scopes of the credential
+* requesting it, so no key can ever widen itself. A scope added here therefore
+* stops every daemon already in the field, and only a human with a Console
+* session can mint the replacement. Add one only when the daemon genuinely
+* cannot work without it; anything a caller merely benefits from belongs in
+* `DAEMON_OPTIONAL_SCOPES`, where absence costs a capability instead.
+*
+* `crypto:sign` is part of the minimum because host-capability signing runs on
+* the daemon's own credential: the local seed signer calls the signing-request
+* endpoints, which require it. A grant without it produces a daemon that boots
+* cleanly and then fails the first time guest code signs a diary entry or a
+* commit.
+*/
+var DAEMON_MINIMUM_SCOPES = [
+	CREDENTIAL_SCOPES.AgentProfile,
+	CREDENTIAL_SCOPES.CryptoSign,
+	CREDENTIAL_SCOPES.RuntimeRead,
+	CREDENTIAL_SCOPES.TaskRead,
+	CREDENTIAL_SCOPES.TaskClaim,
+	CREDENTIAL_SCOPES.TaskExecute
+];
+/**
+* Read and enrollment authority a daemon uses when it has it, and runs without
+* when it does not: reading the teams it belongs to and their diaries, and
+* joining a team it is not yet a member of.
+*
+* Which product surface each one enables is deliberately not recorded here.
+* That mapping belongs to whatever consumes the scope and changes with it,
+* while the scope names are the contract and do not.
+*/
+var DAEMON_OPTIONAL_SCOPES = [
+	CREDENTIAL_SCOPES.DiaryRead,
+	CREDENTIAL_SCOPES.TeamRead,
+	CREDENTIAL_SCOPES.TeamJoin
+];
+[...DAEMON_MINIMUM_SCOPES, ...DAEMON_OPTIONAL_SCOPES];
 CREDENTIAL_SCOPES.AgentProfile, CREDENTIAL_SCOPES.TaskRead, CREDENTIAL_SCOPES.TaskWrite;
 CREDENTIAL_SCOPES.AgentProfile, CREDENTIAL_SCOPES.DiaryRead, CREDENTIAL_SCOPES.PackRead, CREDENTIAL_SCOPES.RuntimeRead, CREDENTIAL_SCOPES.TaskRead, CREDENTIAL_SCOPES.TeamRead;
 Object.freeze(ALL_CREDENTIAL_SCOPES.filter((scope) => scope !== CREDENTIAL_SCOPES.HumanProfile));
@@ -281,6 +324,7 @@ var MCP_CLIENT_SCOPES = [
 	CREDENTIAL_SCOPES.TaskManage,
 	CREDENTIAL_SCOPES.TaskRead,
 	CREDENTIAL_SCOPES.TaskWrite,
+	CREDENTIAL_SCOPES.TeamJoin,
 	CREDENTIAL_SCOPES.TeamManage,
 	CREDENTIAL_SCOPES.TeamRead
 ];
@@ -634,17 +678,16 @@ Type.Object({
 		Type.Literal("executor"),
 		Type.Literal("member")
 	])),
-	maxUses: Type.Optional(Type.Integer({
-		minimum: 1,
-		default: 1
-	})),
 	expiresInHours: Type.Optional(Type.Integer({
 		minimum: 1,
 		maximum: 720,
 		default: 168
 	}))
 });
-Type.Object({ code: Type.String({ minLength: 1 }) });
+Type.Object({
+	code: Type.String({ minLength: 1 }),
+	issueAgentKey: Type.Optional(Type.Literal(true))
+});
 Type.Object({ role: Type.Union([
 	Type.Literal("manager"),
 	Type.Literal("executor"),
@@ -669,8 +712,7 @@ Type.Object({
 		Type.Literal("executor"),
 		Type.Literal("member")
 	]),
-	maxUses: Type.Integer(),
-	useCount: Type.Integer(),
+	usedAt: Type.Union([Type.String({ format: "date-time" }), Type.Null()]),
 	expiresAt: DateTimeUnsafe,
 	createdAt: DateTimeUnsafe
 });
@@ -701,11 +743,7 @@ Type.Object({
 });
 Type.Object({
 	teamId: UuidSchema,
-	role: Type.Union([
-		Type.Literal("manager"),
-		Type.Literal("executor"),
-		Type.Literal("member")
-	])
+	role: TeamRoleSchema
 });
 Type.Object({
 	updated: Type.Boolean(),
@@ -2285,7 +2323,7 @@ function createMoltNetTools(config) {
 }
 //#endregion
 //#region src/otel/index.ts
-var TRACER_NAME = "@themoltnet/pi-extension/otel";
+var TRACER_NAME$1 = "@themoltnet/pi-extension/otel";
 function stripReservedAttrs(attrs) {
 	const out = {};
 	for (const [k, v] of Object.entries(attrs)) {
@@ -2296,7 +2334,7 @@ function stripReservedAttrs(attrs) {
 }
 function createPiOtelExtension(options = {}) {
 	return function piOtelExtension(pi) {
-		const tracer = trace.getTracer(TRACER_NAME);
+		const tracer = trace.getTracer(TRACER_NAME$1);
 		const extraAttrs = stripReservedAttrs(options.spanAttributes ?? {});
 		let sessionSpan;
 		let sessionCtx = context.active();
@@ -3946,8 +3984,123 @@ function createGondolinBashOps(vm, localCwd, guestWorkspace, config) {
 	} };
 }
 //#endregion
+//#region src/tool-policy/decision-sink.ts
+function createToolPolicyDecisionSink(emit) {
+	const pending = [];
+	return {
+		record(record) {
+			try {
+				pending.push(Promise.resolve(emit(record)).catch(() => void 0));
+			} catch {}
+		},
+		async drain() {
+			while (pending.length > 0) {
+				const batch = pending.splice(0, pending.length);
+				await Promise.all(batch);
+			}
+		},
+		get size() {
+			return pending.length;
+		}
+	};
+}
+//#endregion
+//#region src/redact.ts
+var REDACTED = "[redacted]";
+/**
+* Replace values matching well-known credential shapes.
+*
+* Shape matching only: it catches the common accident (a pasted token, a
+* bearer header, an `env` dump) and nothing else. It is not a guarantee that a
+* string is free of secrets, and must never be described as one. Content-aware
+* processing is #1294's job; this is the cheap layer that composes with it.
+*/
+function redactKnownSecretShapes(value) {
+	return value.replace(/((?:bearer|basic)\s+)[a-z0-9._~+/=-]{16,}/gi, `$1${REDACTED}`).replace(/\bgh[pousr]_[a-z0-9_]{20,}\b/gi, REDACTED).replace(/\bsk-[a-z0-9_-]{16,}\b/gi, REDACTED).replace(/\beyJ[a-z0-9_-]{20,}\.[a-z0-9_-]{20,}\.[a-z0-9_-]{20,}\b/gi, REDACTED);
+}
+//#endregion
+//#region src/tool-policy/sanitize.ts
+/**
+* What a plausible executable name looks like once the analyzer has stripped
+* any directory: a bounded token of portable filename characters, plus the
+* punctuation that names real shell builtins (`:`, `[`).
+*/
+var PLAUSIBLE_EXECUTABLE = /^[A-Za-z0-9._@+:[\]-]{1,64}$/;
+/** Stands in for a command name we will not reproduce. */
+var UNREPORTABLE_EXECUTABLE = "<unreportable>";
+/**
+* Bound a command name before it reaches a durable sink.
+*
+* The executable name is model-controlled: whatever the model writes in
+* command position becomes the "executable" the gate reports, and refusals are
+* persisted to the task record, the daemon log and the trace. Without this, a
+* secret written in command position is copied verbatim into all three, which
+* is exactly the content those records are supposed not to carry.
+*
+* Two bounds, in order:
+*
+* 1. Known credential shapes are redacted outright.
+* 2. Anything that does not look like an executable name — too long, or
+*    outside portable filename characters — is replaced wholesale.
+*
+* Limits, stated plainly: this bounds the *shape* of what is reported. A short
+* secret made only of filename characters and matching no known token shape
+* still passes, and the {@link MissingShellCommand} fingerprint remains the
+* reliable identifier. Narrowing further would mean refusing to name the
+* program an operator needs to see, so this is the deliberate stopping point
+* until #1294's content-aware processing can be applied here too.
+*/
+function sanitizeExecutableName(name) {
+	if (redactKnownSecretShapes(name) !== name) return UNREPORTABLE_EXECUTABLE;
+	return PLAUSIBLE_EXECUTABLE.test(name) ? name : UNREPORTABLE_EXECUTABLE;
+}
+//#endregion
 //#region src/tool-policy/gate.ts
 /**
+* Environment variables that decide *which* binary an argv names, or inject
+* code into whichever one runs. A `VAR=value` prefix is not argv, so no
+* argv-prefix rule can describe it: `PATH=/tmp ls -la` matches a rule granting
+* `ls -la` while running an entirely different `ls`.
+*
+* Deliberately a short list of the loader, shell and interpreter entry points,
+* not a model of every program's configuration. Program-specific variables are
+* the same long tail as the analyzer's escape-flag table, and the ones git
+* honours are included because that table already models their `-c` twins.
+* What a process can reach once running is the sandbox's job (#2025).
+*/
+var UNSAFE_ENV_PREFIXES = ["LD_", "DYLD_"];
+var UNSAFE_ENV_NAMES = new Set([
+	"PATH",
+	"CDPATH",
+	"IFS",
+	"ENV",
+	"BASH_ENV",
+	"SHELLOPTS",
+	"BASHOPTS",
+	"PS4",
+	"PYTHONPATH",
+	"PYTHONSTARTUP",
+	"PYTHONHOME",
+	"PERL5OPT",
+	"PERL5LIB",
+	"RUBYOPT",
+	"RUBYLIB",
+	"NODE_OPTIONS",
+	"CLASSPATH",
+	"JAVA_TOOL_OPTIONS",
+	"GIT_SSH",
+	"GIT_SSH_COMMAND",
+	"GIT_EXTERNAL_DIFF",
+	"GIT_PAGER",
+	"GIT_EDITOR",
+	"GIT_SEQUENCE_EDITOR",
+	"GIT_EXEC_PATH"
+]);
+function isUnsafeEnvName(name) {
+	const upper = name.toUpperCase();
+	return UNSAFE_ENV_NAMES.has(upper) || UNSAFE_ENV_PREFIXES.some((prefix) => upper.startsWith(prefix));
+}
+/**
 * Decide whether a tool call is permitted by the resolved policy.
 *
 * Fail-closed in `enforce` (audited-but-allowed in `watch`, no-op in `off`) for:
@@ -3968,6 +4121,11 @@ function createGondolinBashOps(vm, localCwd, guestWorkspace, config) {
 * 4. **Output redirection** — a `bash` command that redirects output (`>`,
 *    `2>`, `>>`, `&>`, …). No shell-command rule authorizes it; file writes go
 *    through structured tools.
+* 5. **Execution-redirecting environment prefixes** — a `VAR=value` prefix that
+*    changes which binary argv names or injects code into it (`PATH`, `LD_*`,
+*    `BASH_ENV`, …; see {@link UNSAFE_ENV_NAMES}). Such a prefix is not argv, so
+*    the matched rule would describe a different program than the one that runs.
+*    Benign assignments are unaffected.
 *
 * KNOWN LIMITATION (follow-up): the `escapable` risk tier (GTFOBins binaries
 * like `find`, `tar`, `awk` that document shell-spawn / file-write techniques)
@@ -3988,10 +4146,12 @@ function decideToolCall(input) {
 	};
 	const resolved = resolveNames(input);
 	if (resolved.kind === "unresolvable") return fenced(input.enforcement, "shell_command_unresolvable", "shell command could not be statically authorized", "unresolvable shell command (watch)");
-	const arbitraryCode = [...new Set(resolved.tools.filter((tool) => tool.risk === "arbitrary-code").map((tool) => tool.name))];
+	const unsafeEnv = (resolved.envAssignments ?? []).filter(isUnsafeEnvName);
+	if (unsafeEnv.length > 0) return fenced(input.enforcement, "unsafe_environment_assignment", `environment assignment not permitted by tool policy: ${unsafeEnv.join(", ")}`, `would block — environment assignment (watch): ${unsafeEnv.join(", ")}`, unsafeEnv);
+	const arbitraryCode = [...new Set(resolved.tools.filter((tool) => tool.risk === "arbitrary-code").map((tool) => sanitizeExecutableName(tool.name)))];
 	if (arbitraryCode.length > 0) return fenced(input.enforcement, "arbitrary_code_interpreter", `arbitrary-code interpreter not authorizable by tool policy: ${arbitraryCode.join(", ")}`, `would block — arbitrary-code interpreter (watch): ${arbitraryCode.join(", ")}`, arbitraryCode);
 	if (input.toolName !== "bash") {
-		const missing = resolved.tools.map((tool) => tool.name).filter((name) => !input.allowedTools.has(name));
+		const missing = resolved.tools.filter((tool) => !input.allowedTools.has(tool.name)).map((tool) => sanitizeExecutableName(tool.name));
 		if (missing.length === 0) return {
 			allow: true,
 			reasonCode: "policy_allowed"
@@ -4030,14 +4190,14 @@ function fingerprintArgv(argv) {
 }
 function toMatchedShellCommand(executable, argvPrefix) {
 	return {
-		executable,
+		executable: sanitizeExecutableName(executable),
 		argvPrefixFingerprint: fingerprintArgv(argvPrefix),
 		argvPrefixLength: argvPrefix.length
 	};
 }
 function toMissingShellCommand(tool) {
 	return {
-		executable: tool.name,
+		executable: sanitizeExecutableName(tool.name),
 		argvFingerprint: fingerprintArgv(tool.argv),
 		argvLength: tool.argv.length,
 		dynamicTokenCount: tool.argv.filter((token) => token === null).length
@@ -4093,12 +4253,94 @@ function resolveNames(input) {
 			argv: tool.argv,
 			risk: tool.risk
 		})),
-		hasOutputRedirection: analysis.hasOutputRedirection === true
+		hasOutputRedirection: analysis.hasOutputRedirection === true,
+		envAssignments: analysis.envAssignments
 	} : {
 		kind: "unresolvable",
 		reason: analysis.reason
 	};
 }
+//#endregion
+//#region src/tool-policy/telemetry.ts
+var METER_NAME$1 = "@themoltnet/pi-extension/tool-policy";
+/**
+* Counts every tool-policy decision.
+*
+* A decision reaches four sinks, each answering a different question:
+*
+* - **task record** (`tool_policy_decision` message) — the durable, per-attempt
+*   evidence an operator reads to see what was refused and under which policy.
+* - **this counter** — aggregate rates and alerting. Bounded attributes only;
+*   correlation ids deliberately live in the other three.
+* - **span** ({@link recordToolPolicyDecisionSpan}) — trace-level evidence. The
+*   gate refuses at pi's `tool_call` event, earlier than the
+*   `tool_execution_start` that creates `execute_tool`, so without it a blocked
+*   call appears in no trace at all.
+* - **daemon log** — local diagnostics. Not exported today; see #2326.
+*
+* Allowed decisions are counted too — without the denominator a refusal count
+* cannot be read as a rate.
+*/
+var decisionCounter = null;
+function getDecisionCounter() {
+	decisionCounter ??= metrics.getMeter(METER_NAME$1).createCounter("agent_runtime.tool_policy.decisions", {
+		description: "Runtime tool-policy decisions by outcome, reason and enforcement mode.",
+		unit: "1"
+	});
+	return decisionCounter;
+}
+/**
+* Attributes are deliberately low-cardinality: outcome, reason code,
+* enforcement mode and the degraded flag are all small closed sets. Task,
+* team, lease and tool-call ids are never attached — they are unbounded, and
+* the collector strips task ids from public metric datapoints anyway. The
+* per-decision detail lives in the task record instead.
+*/
+function recordToolPolicyDecisionMetric(metric) {
+	try {
+		getDecisionCounter().add(1, {
+			decision: metric.decision,
+			reason: metric.reason,
+			enforcement: metric.enforcement,
+			degraded: String(metric.degraded)
+		});
+	} catch {}
+}
+var TRACER_NAME = "@themoltnet/pi-extension/tool-policy";
+/**
+* Record a refusal on the trace.
+*
+* A blocked call has no span of its own otherwise: the gate refuses at pi's
+* `tool_call` event, which is earlier than the `tool_execution_start` that
+* creates `execute_tool`, so the call simply never appears. This span is that
+* missing evidence, parented to the live session span so it lands in the same
+* trace as the turn that attempted it.
+*
+* Unlike the counter, a span tolerates high cardinality, so it carries the
+* correlation fields the metric deliberately leaves off. It still carries no
+* argv literals — the executables and the record's fingerprints identify the
+* invocation without reproducing its arguments.
+*
+* The status is left UNSET on purpose: a refusal is the policy working, not a
+* system fault, and marking it ERROR would put correct behaviour in error views.
+*/
+function recordToolPolicyDecisionSpan(input, parentContext, correlation = {}) {
+	try {
+		const attributes = {
+			...correlation,
+			"moltnet.tool_policy.decision": input.decision,
+			"moltnet.tool_policy.reason": input.reason_code,
+			"moltnet.tool_policy.enforcement": input.enforcement,
+			"moltnet.tool_policy.degraded": input.degraded,
+			"gen_ai.tool.name": input.tool_name,
+			...input.policy_snapshot_hash ? { "moltnet.tool_policy.snapshot_hash": input.policy_snapshot_hash } : {},
+			...input.runtime_profile_revision !== void 0 ? { "moltnet.runtime_profile.revision": input.runtime_profile_revision } : {},
+			...input.unauthorized_executables?.length ? { "moltnet.tool_policy.unauthorized_executables": input.unauthorized_executables } : {}
+		};
+		const tracer = trace.getTracer(TRACER_NAME);
+		(parentContext ? tracer.startSpan("moltnet.tool_policy.decision", { attributes }, parentContext) : tracer.startSpan("moltnet.tool_policy.decision", { attributes })).end();
+	} catch {}
+}
 /**
 * Resolve the session's tool policy at start-up.
 *
@@ -4222,6 +4464,12 @@ function createToolPolicyExtension(deps) {
 					reason: decision.reasonCode,
 					...decision.matchedShellCommands?.length ? { shellFingerprints: decision.matchedShellCommands } : {}
 				}, "tool_policy.allowed");
+				recordToolPolicyDecisionMetric({
+					decision: "allowed",
+					reason: decision.reasonCode,
+					enforcement: deps.policy.enforcement,
+					degraded: deps.policy.degraded === true
+				});
 				return;
 			}
 			if ("audit" in decision) {
@@ -4231,9 +4479,10 @@ function createToolPolicyExtension(deps) {
 					toolCallId: event.toolCallId,
 					decision: "audit",
 					reason: decision.reasonCode,
-					...decision.missing?.length ? { missingExecutables: decision.missing } : {},
+					...decision.missing?.length ? { unauthorizedExecutables: decision.missing } : {},
 					...decision.missingShellCommands?.length ? { shellFingerprints: decision.missingShellCommands } : {}
 				}, "tool_policy.audit");
+				reportDecision(deps, "would_block", event, decision);
 				return;
 			}
 			deps.logger.warn({
@@ -4242,9 +4491,10 @@ function createToolPolicyExtension(deps) {
 				toolCallId: event.toolCallId,
 				decision: "blocked",
 				reason: decision.reasonCode,
-				...decision.missing?.length ? { missingExecutables: decision.missing } : {},
+				...decision.missing?.length ? { unauthorizedExecutables: decision.missing } : {},
 				...decision.missingShellCommands?.length ? { shellFingerprints: decision.missingShellCommands } : {}
 			}, "tool_policy.blocked");
+			reportDecision(deps, "blocked", event, decision);
 			return {
 				block: true,
 				reason: decision.reason
@@ -4252,6 +4502,37 @@ function createToolPolicyExtension(deps) {
 		});
 	};
 }
+/**
+* Hand a refusal to {@link ToolPolicyExtensionDeps.onDecision}, never letting a
+* reporting failure change the gate's verdict.
+*/
+function reportDecision(deps, decision, event, gateDecision) {
+	recordToolPolicyDecisionMetric({
+		decision,
+		reason: gateDecision.reasonCode,
+		enforcement: deps.policy.enforcement,
+		degraded: deps.policy.degraded === true
+	});
+	if (!deps.onDecision) return;
+	const missing = "missing" in gateDecision ? gateDecision.missing : void 0;
+	const shell = "missingShellCommands" in gateDecision ? gateDecision.missingShellCommands : void 0;
+	try {
+		deps.onDecision({
+			decision,
+			tool_name: event.toolName,
+			...event.toolCallId ? { tool_call_id: event.toolCallId } : {},
+			reason_code: gateDecision.reasonCode,
+			enforcement: deps.policy.enforcement,
+			...missing?.length ? { unauthorized_executables: missing } : {},
+			...shell?.length ? { shell_fingerprints: shell } : {},
+			degraded: deps.policy.degraded === true,
+			...deps.policy.executionPolicySnapshotHash ? { policy_snapshot_hash: deps.policy.executionPolicySnapshotHash } : {},
+			...deps.policy.executionRuntimeProfileRevision !== void 0 ? { runtime_profile_revision: deps.policy.executionRuntimeProfileRevision } : {}
+		});
+	} catch (error) {
+		deps.logger.warn({ err: error instanceof Error ? error.message : String(error) }, "tool_policy.decision_report_failed");
+	}
+}
 function decisionContext(deps) {
 	return {
 		...deps.context ?? {},
@@ -4401,7 +4682,6 @@ async function resolvePriorContext(agent, continueFrom) {
 //#region src/runtime/retry-triage.ts
 var MAX_TRIAGE_JSON_CHARS = 12e3;
 var MAX_TRIAGE_FIELD_CHARS = 2e3;
-var REDACTED = "[redacted]";
 var SECRET_KEY_PATTERN = /(?:api[_-]?key|token|secret|password|passwd|credential|authorization|private[_-]?key|access[_-]?token|refresh[_-]?token)/i;
 function createPiRetryTriage(options) {
 	return async (input) => {
@@ -4534,7 +4814,7 @@ function redactAndTruncate(value, path) {
 	return value;
 }
 function redactRetryTriageSecrets(value) {
-	return value.replace(/((?:bearer|basic)\s+)[a-z0-9._~+/=-]{16,}/gi, `$1${REDACTED}`).replace(/\bgh[pousr]_[a-z0-9_]{20,}\b/gi, REDACTED).replace(/\bsk-[a-z0-9_-]{16,}\b/gi, REDACTED).replace(/\beyJ[a-z0-9_-]{20,}\.[a-z0-9_-]{20,}\.[a-z0-9_-]{20,}\b/gi, REDACTED);
+	return redactKnownSecretShapes(value);
 }
 function truncateString(value, maxChars) {
 	if (value.length <= maxChars) return value;
@@ -5517,6 +5797,7 @@ function summarizePayloadForLog(kind, payload) {
 			phase: payload.phase,
 			message: typeof payload.message === "string" ? payload.message.slice(0, LOG_TRUNCATE_LIMIT) : payload.message
 		};
+		case "tool_policy_decision": return payload;
 		case "info": return Object.fromEntries(Object.entries(payload).map(([k, v]) => [k, typeof v === "string" ? v.slice(0, LOG_TRUNCATE_LIMIT) : v]));
 		default: return payload;
 	}
@@ -6053,6 +6334,7 @@ async function executePiTask(claimedTask, reporter, opts) {
 	let reporterOpen = opts.reporterAlreadyOpened ?? false;
 	let managed = null;
 	let session = null;
+	const policyDecisionSink = createToolPolicyDecisionSink((record) => emit("tool_policy_decision", { ...record }));
 	let piSessionContext;
 	let providerRequestContext;
 	let subagentHandle = null;
@@ -6438,7 +6720,7 @@ async function executePiTask(claimedTask, reporter, opts) {
 			const piAuthDir = resolvePiCodingAgentDir();
 			const { modelHandle, modelRuntime } = await resolveRuntimeProfileModel(piAuthDir, opts.provider, opts.model, opts.runtimeProfileId);
 			const injectedSkills = injectedContext.skills;
-			const toolPolicyExtensions = [];
+			let buildToolPolicyExtensions = () => [];
 			let resolvedToolPolicy;
 			let unavailableRuntimeShellCommands = [];
 			let verifiedGuestExecutables = [];
@@ -6477,12 +6759,24 @@ async function executePiTask(claimedTask, reporter, opts) {
 						...policy,
 						allowedShellCommands
 					};
-					toolPolicyExtensions.push(createToolPolicyExtension({
-						policy: resolvedToolPolicy,
+					const sessionPolicy = resolvedToolPolicy;
+					buildToolPolicyExtensions = (execution) => [createToolPolicyExtension({
+						policy: sessionPolicy,
 						analyzer,
 						logger: toolPolicyLogger,
-						context: toolPolicyDecisionContext
-					}));
+						context: toolPolicyDecisionContext,
+						onDecision: (record) => {
+							recordToolPolicyDecisionSpan(record, piSessionContext, {
+								"moltnet.task.id": task.id,
+								"moltnet.task.attempt": attemptN,
+								"moltnet.execution.kind": execution
+							});
+							policyDecisionSink.record({
+								...record,
+								execution
+							});
+						}
+					})];
 				}
 			}
 			capabilityRouter?.setPolicy(resolvedToolPolicy ? {
@@ -6609,7 +6903,7 @@ async function executePiTask(claimedTask, reporter, opts) {
 					parentAttemptN: attemptN,
 					contractRegistry: opts.subagentContractRegistry,
 					parentCancelSignal: reporter.cancelSignal,
-					extraExtensionFactories: [...runtimeSubagentExtensions, ...toolPolicyExtensions]
+					extraExtensionFactories: [...runtimeSubagentExtensions, ...buildToolPolicyExtensions("subagent")]
 				});
 				parentSubagentTools.push(subagentHandle.tool);
 			}
@@ -6658,7 +6952,7 @@ async function executePiTask(claimedTask, reporter, opts) {
 				sessionPersistence: executionPlan?.sessionPersistence ?? void 0,
 				extraExtensionFactories: [
 					...runtimeParentExtensions,
-					...toolPolicyExtensions,
+					...buildToolPolicyExtensions("parent"),
 					submitCompletion.extension
 				]
 			}));
@@ -6783,6 +7077,7 @@ async function executePiTask(claimedTask, reporter, opts) {
 			event: "subagent_summary",
 			callCount: subagentHandle.getCallCount()
 		});
+		await policyDecisionSink.drain();
 		await Promise.all([...recordingPromise, ...sandboxRetirementEvents]);
 		const cancelled = reporter.cancelSignal.aborted;
 		let parsedOutput = null;
@@ -6863,6 +7158,7 @@ async function executePiTask(claimedTask, reporter, opts) {
 	} catch (err) {
 		return makeFailedOutput("executor_unexpected_error", err instanceof Error ? err.message : String(err));
 	} finally {
+		await policyDecisionSink.drain();
 		await cleanupAttempt({
 			cancelSignal: reporter.cancelSignal,
 			cancelListener,