@themoltnet/pi-runtime 0.7.2 → 0.8.0

package/dist/index.d.ts

@@ -53,6 +53,18 @@ export declare interface AllowedToolsClient {
     };
 }
 
+export declare function assertGuestEnvironmentBoundary(options: {
+    guestCredentialMode: GuestCredentialMode;
+    forwardEnv?: readonly string[];
+    sandboxEnv?: Readonly<Record<string, string>>;
+}): void;
+
+/** @deprecated Prefer assertGuestEnvironmentBoundary for mode-aware checks. */
+export declare function assertHostAuthenticatedGuestEnvironment(options: {
+    forwardEnv?: readonly string[];
+    sandboxEnv?: Readonly<Record<string, string>>;
+}): void;
+
 /**
  * Construct an `AgentSession`. By default it is in-memory; callers may opt
  * parent sessions into daemon-owned file persistence via `sessionPersistence`.
@@ -390,6 +402,10 @@ export declare function executePiTask(claimedTask: ClaimedTask, reporter: TaskRe
 export declare interface ExecutePiTaskOptions {
     /** MoltNet agent whose credentials the VM boots with. */
     agentName: string;
+    /** Already-authenticated host-side Agent. Daemon callers always supply it. */
+    moltnetAgent?: Agent;
+    /** Explicit trust boundary for MoltNet credentials inside the guest. */
+    guestCredentialMode?: GuestCredentialMode;
     /**
      * Host root that owns `.moltnet/<agentName>/`.
      *
@@ -447,6 +463,8 @@ export declare interface ExecutePiTaskOptions {
     promptExtras?: Record<string, unknown>;
     /** Snapshot progress callback; defaults to stderr logging. */
     onSnapshotProgress?: (message: string) => void;
+    /** Structured VM credential-boundary diagnostics. */
+    onVmDiagnostic?: (diagnostic: VmDiagnostic) => void;
     /**
      * Optional pre-resolved checkpoint path. If omitted, `ensureSnapshot` is
      * invoked. Useful for batch execution where the caller wants to cache
@@ -642,6 +660,13 @@ export declare interface GondolinTemplateResolveContext {
     onProgress?: (message: string) => void;
 }
 
+export declare type GuestCredentialMode = 'guest-config' | 'host-authenticated';
+
+export declare class GuestEnvironmentBoundaryError extends Error {
+    readonly refusedNames: readonly string[];
+    constructor(refusedNames: readonly string[]);
+}
+
 /**
  * Baseline env keys forwarded to host-exec child processes.
  * Callers can extend this set at sandbox startup via `MoltNetToolsConfig.hostExecBaseEnv`.
@@ -703,7 +728,7 @@ export declare function isResolvedPathInsideRoot(path: string, root: string): bo
 
 export declare function isToolVisible(name: string, policy?: ModelVisibleToolPolicy): boolean;
 
-export declare function loadCredentials(agentDir: string): VmCredentials;
+export declare function loadCredentials(agentDir: string, mode?: GuestCredentialMode, onDiagnostic?: (diagnostic: VmDiagnostic) => void): VmCredentials;
 
 export declare interface ManagedVm {
     vm: VM;
@@ -1076,6 +1101,8 @@ export declare interface ResolvedGondolinTemplate {
     resumeCommands: readonly ResumeCommand[];
 }
 
+export declare function resolveHostExecBaseEnv(guestCredentialMode: GuestCredentialMode, agentEnv: Readonly<Record<string, string | undefined>>): Set<string>;
+
 /**
  * Resolve the session's tool policy at start-up.
  *
@@ -1366,6 +1393,12 @@ export declare interface VmConfig {
     checkpointPath: string;
     /** MoltNet agent name (used to resolve credentials). */
     agentName: string;
+    /**
+     * Trust boundary for guest credentials. `guest-config` injects the complete
+     * legacy agent directory. `host-authenticated` never reads or injects it and
+     * relies exclusively on the supplied host-side Agent for MoltNet operations.
+     */
+    guestCredentialMode?: GuestCredentialMode;
     /**
      * Host root that owns `.moltnet/<agentName>/`.
      *
@@ -1389,12 +1422,16 @@ export declare interface VmConfig {
      * into the guest without storing secret values in the profile.
      */
     forwardEnv?: string[];
+    /** Structured credential-boundary diagnostics for daemon loggers. */
+    onDiagnostic?: (diagnostic: VmDiagnostic) => void;
     /** Abort resume/setup work, closing any live VM owned by resumeVm. */
     signal?: AbortSignal;
 }
 
 export declare interface VmCredentials {
+    /** Empty in host-authenticated mode; retained as strings for API stability. */
     moltnetJson: string;
+    /** Empty in host-authenticated mode; retained as strings for API stability. */
     agentEnvRaw: string;
     /**
      * Pi OAuth/API-key auth blob. Null when neither `~/.pi/agent/auth.json`
@@ -1415,6 +1452,13 @@ export declare interface VmCredentials {
     githubAppPemFilename: string | null;
 }
 
+export declare interface VmDiagnostic {
+    event: 'vm.credentials.mode' | 'vm.credentials.github_key_missing';
+    level: 'info' | 'warning';
+    message: string;
+    credentialMode: GuestCredentialMode;
+}
+
 /**
  * Subset of `@earendil-works/gondolin`'s `VmFs` we actually use. We
  * narrow the dependency surface so unit tests can hand in a

package/dist/index.js

@@ -19,7 +19,7 @@ import { createHash as createHash$1 } from "node:crypto";
 import * as json from "multiformats/codecs/json";
 import "@ipld/dag-cbor";
 import { FREEFORM_TYPE, SUBMIT_OUTPUT_GATE_ID, TaskContext, buildTaskUserPrompt, getSubmitOutputContract, materializeTaskOutput, mergeRuntimeProfileContext, resolveTaskContext, taskTypeUsesSubagents, traceRuntimePhase, validateTaskOutput, validateTaskSubmission } from "@themoltnet/agent-runtime";
-import { connect } from "@themoltnet/sdk";
+import { connect } from "@themoltnet/sdk/node";
 import { ShellCommandAnalyzer } from "@themoltnet/shell-command-analyzer";
 import { homedir } from "node:os";
 import { MemoryProvider, RealFSProvider, ShadowProvider, VM, VmCheckpoint, createHttpHooks, createShadowPathPredicate, ensureImageSelector, isWriteFlag, loadGuestAssets } from "@earendil-works/gondolin";
@@ -4532,12 +4532,30 @@ function resolveVmAgentDir(config) {
 	const rootDir = config.agentRootDir ?? findMainWorktree();
 	return path.join(rootDir, ".moltnet", config.agentName);
 }
-function loadCredentials(agentDir) {
-	const moltnetJson = readFileSync(path.join(agentDir, "moltnet.json"), "utf8");
-	const agentEnvRaw = readFileSync(path.join(agentDir, "env"), "utf8");
+function loadCredentials(agentDir, mode = "guest-config", onDiagnostic) {
+	const moltnetPath = path.join(agentDir, "moltnet.json");
+	const agentEnvPath = path.join(agentDir, "env");
 	const piAgentDir = resolvePiCodingAgentDir();
 	const piAuthPath = path.join(piAgentDir, "auth.json");
 	const piAuthJson = existsSync(piAuthPath) ? readFileSync(piAuthPath, "utf8") : null;
+	if (mode === "host-authenticated") return {
+		moltnetJson: "",
+		agentEnvRaw: "",
+		piAuthJson,
+		agentEnv: {},
+		gitconfig: null,
+		sshPrivateKey: null,
+		sshPublicKey: null,
+		allowedSigners: null,
+		githubAppPem: null,
+		githubAppPemFilename: null
+	};
+	const hasMoltnetJson = existsSync(moltnetPath);
+	const hasAgentEnv = existsSync(agentEnvPath);
+	if (!hasMoltnetJson || !hasAgentEnv) throw new Error(`Guest credential mode requires both ${moltnetPath} and ${agentEnvPath}`);
+	const moltnetJson = readFileSync(moltnetPath, "utf8");
+	const agentEnvRaw = readFileSync(agentEnvPath, "utf8");
+	if (moltnetJson.trim() === "") throw new Error(`Agent configuration is empty: ${moltnetPath}`);
 	const gitconfigPath = path.join(agentDir, "gitconfig");
 	const gitconfig = existsSync(gitconfigPath) ? readFileSync(gitconfigPath, "utf8") : null;
 	const sshDir = path.join(agentDir, "ssh");
@@ -4546,9 +4564,13 @@ function loadCredentials(agentDir) {
 	const allowedSigners = existsSync(path.join(sshDir, "allowed_signers")) ? readFileSync(path.join(sshDir, "allowed_signers"), "utf8") : null;
 	let githubAppPem = null;
 	let githubAppPemFilename = null;
-	const pemPath = JSON.parse(moltnetJson).github?.private_key_path;
-	if (pemPath) if (!existsSync(pemPath)) process.stderr.write(`[pi-extension] Warning: github.private_key_path not found at ${pemPath} — moltnet github token will fail inside the guest
-`);
+	const pemPath = (moltnetJson ? JSON.parse(moltnetJson) : null)?.github?.private_key_path;
+	if (pemPath) if (!existsSync(pemPath)) onDiagnostic?.({
+		event: "vm.credentials.github_key_missing",
+		level: "warning",
+		credentialMode: mode,
+		message: `github.private_key_path not found at ${pemPath}; moltnet github token will fail inside the guest`
+	});
 	else {
 		githubAppPem = readFileSync(pemPath, "utf8");
 		githubAppPemFilename = path.basename(pemPath);
@@ -4594,6 +4616,70 @@ var BASE_ALLOWED_HOSTS = [
 	"storage.googleapis.com",
 	"*.googlesource.com"
 ];
+var DEFAULT_MOLTNET_API_URL = "https://api.themolt.net";
+/**
+* Host environment names that may intentionally cross into a
+* host-authenticated guest. This local list is the authority boundary;
+* server-supplied runtime-profile `requiredEnv` cannot widen it.
+*/
+var HOST_AUTHENTICATED_GUEST_ENV_ALLOWLIST = new Set([
+	"ANTHROPIC_API_KEY",
+	"OPENAI_API_KEY",
+	"OPENAI_BASE_URL",
+	"AZURE_OPENAI_API_KEY",
+	"AZURE_OPENAI_ENDPOINT",
+	"AZURE_OPENAI_API_VERSION",
+	"GOOGLE_API_KEY",
+	"GEMINI_API_KEY",
+	"MISTRAL_API_KEY",
+	"GROQ_API_KEY",
+	"OPENROUTER_API_KEY",
+	"XAI_API_KEY",
+	"CEREBRAS_API_KEY",
+	"DEEPSEEK_API_KEY",
+	"OLLAMA_API_KEY",
+	"OLLAMA_BASE_URL",
+	"AWS_ACCESS_KEY_ID",
+	"AWS_SECRET_ACCESS_KEY",
+	"AWS_SESSION_TOKEN",
+	"AWS_REGION",
+	"AWS_DEFAULT_REGION",
+	"GITHUB_TOKEN",
+	"GH_TOKEN",
+	"LINEAR_API_KEY"
+]);
+var RESERVED_GUEST_ENVIRONMENT_NAMES = new Set([
+	"PATH",
+	"HOME",
+	"NODE_EXTRA_CA_CERTS",
+	"MOLTNET_GUEST_WORKSPACE",
+	"GIT_SSH",
+	"GIT_SSH_COMMAND",
+	"SSH_AUTH_SOCK"
+]);
+function isReservedGuestEnvironmentName(name) {
+	return name.startsWith("MOLTNET_") || name.startsWith("GIT_CONFIG_") || RESERVED_GUEST_ENVIRONMENT_NAMES.has(name);
+}
+var GuestEnvironmentBoundaryError = class extends Error {
+	constructor(refusedNames) {
+		super(`Guest credential boundary refuses runtime-controlled environment variables: ${refusedNames.join(", ")}. Remove them from the runtime profile; MoltNet operations use the trusted host-side Agent.`);
+		this.refusedNames = refusedNames;
+		this.name = "GuestEnvironmentBoundaryError";
+	}
+};
+function assertGuestEnvironmentBoundary(options) {
+	const refusedForwardEnv = (options.forwardEnv ?? []).filter((name) => isReservedGuestEnvironmentName(name) || options.guestCredentialMode === "host-authenticated" && !HOST_AUTHENTICATED_GUEST_ENV_ALLOWLIST.has(name));
+	const refusedSandboxEnv = Object.keys(options.sandboxEnv ?? {}).filter(isReservedGuestEnvironmentName);
+	const refused = [...new Set([...refusedForwardEnv, ...refusedSandboxEnv])].sort();
+	if (refused.length > 0) throw new GuestEnvironmentBoundaryError(refused);
+}
+/** @deprecated Prefer assertGuestEnvironmentBoundary for mode-aware checks. */
+function assertHostAuthenticatedGuestEnvironment(options) {
+	assertGuestEnvironmentBoundary({
+		guestCredentialMode: "host-authenticated",
+		...options
+	});
+}
 /**
 * Return whether two Gondolin hostname globs can match at least one common
 * string. Each `*` is an arbitrary substring, so this walks the product of the
@@ -4665,10 +4751,22 @@ async function resumeVm(config) {
 	throwIfAborted(config.signal, "VM resume");
 	const agentDir = resolveVmAgentDir(config);
 	const guestWorkspace = path.resolve(config.mountPath);
-	if (!existsSync(agentDir)) throw new Error(`Agent directory not found: ${agentDir}. Run: moltnet register --name ${config.agentName}`);
-	const creds = loadCredentials(agentDir);
-	const moltnetConfig = JSON.parse(creds.moltnetJson);
-	const apiHost = new URL(moltnetConfig.endpoints.api).hostname;
+	const guestCredentialMode = config.guestCredentialMode ?? "guest-config";
+	if (guestCredentialMode === "guest-config" && !existsSync(agentDir)) throw new Error(`Agent directory not found: ${agentDir}. Run: moltnet register --name ${config.agentName}`);
+	assertGuestEnvironmentBoundary({
+		guestCredentialMode,
+		forwardEnv: config.forwardEnv,
+		sandboxEnv: config.sandboxConfig?.env
+	});
+	config.onDiagnostic?.({
+		event: "vm.credentials.mode",
+		level: "info",
+		credentialMode: guestCredentialMode,
+		message: guestCredentialMode === "host-authenticated" ? "MoltNet agent files and non-allowlisted host environment variables are withheld from the guest" : "The complete MoltNet agent configuration is available to the guest"
+	});
+	const creds = loadCredentials(agentDir, guestCredentialMode, config.onDiagnostic);
+	const configuredApiUrl = creds.moltnetJson ? JSON.parse(creds.moltnetJson).endpoints.api : void 0;
+	const apiHost = new URL(configuredApiUrl ?? process.env.MOLTNET_API_URL ?? DEFAULT_MOLTNET_API_URL).hostname;
 	const runtimeAllowedHosts = config.sandboxConfig?.network?.allowedHosts ?? [];
 	const runtimeAllowedInternalHosts = config.sandboxConfig?.network?.allowedInternalHosts ?? [];
 	const protectedExternalHosts = [...new Set([
@@ -4689,7 +4787,7 @@ async function resumeVm(config) {
 		else if (k.endsWith("_PRIVATE_KEY_PATH")) vmAgentEnv[k] = `${vmAgentDir}/${path.basename(v)}`;
 		else vmAgentEnv[k] = v;
 	}
-	vmAgentEnv.MOLTNET_CREDENTIALS_PATH = `${vmAgentDir}/moltnet.json`;
+	if (creds.moltnetJson) vmAgentEnv.MOLTNET_CREDENTIALS_PATH = `${vmAgentDir}/moltnet.json`;
 	const vfsConfig = resolveVfsShadowConfig(config.sandboxConfig);
 	let workspaceProvider = new RealFSProvider(config.mountPath);
 	workspaceProvider = new ShadowProvider(workspaceProvider, {
@@ -4705,6 +4803,11 @@ async function resumeVm(config) {
 			writeMode: vfsConfig.mode
 		});
 	}
+	if (guestCredentialMode === "host-authenticated") workspaceProvider = new ShadowProvider(workspaceProvider, {
+		shouldShadow: ({ path: shadowPath }) => shadowPath.split("/").includes(".moltnet"),
+		denySymlinkBypass: true,
+		writeMode: "deny"
+	});
 	const forwardedEnv = {};
 	for (const name of config.forwardEnv ?? []) {
 		const value = process.env[name];
@@ -4777,44 +4880,47 @@ async function resumeVm(config) {
 			if (lastErr) throw lastErr instanceof Error ? lastErr : new Error(nonErrorMessage(lastErr));
 		}
 		const vmSshDir = `${vmAgentDir}/ssh`;
-		await vm.exec(`mkdir -p ${vmAgentDir}/ssh /home/agent/.pi/agent`, { signal: config.signal });
+		const hasAgentFiles = guestCredentialMode === "guest-config";
+		await vm.exec(hasAgentFiles ? `mkdir -p ${vmAgentDir}/ssh /home/agent/.pi/agent` : "mkdir -p /home/agent/.pi/agent", { signal: config.signal });
 		if (creds.piAuthJson !== null) await vm.fs.writeFile("/home/agent/.pi/agent/auth.json", creds.piAuthJson, {
 			mode: 384,
 			signal: config.signal
 		});
-		const vmMoltnetJson = rewriteMoltnetJsonPaths(creds.moltnetJson, vmAgentDir, vmSshDir, creds.githubAppPemFilename);
-		await vm.fs.writeFile(`${vmAgentDir}/moltnet.json`, vmMoltnetJson, {
-			mode: 384,
-			signal: config.signal
-		});
-		await vm.fs.writeFile(`${vmAgentDir}/env`, creds.agentEnvRaw, {
-			mode: 384,
-			signal: config.signal
-		});
-		if (creds.gitconfig) {
-			const vmGitconfig = rewriteGitconfigPaths(creds.gitconfig, vmSshDir, vmAgentDir);
-			await vm.fs.writeFile(`${vmAgentDir}/gitconfig`, vmGitconfig, {
+		if (hasAgentFiles) {
+			const vmMoltnetJson = rewriteMoltnetJsonPaths(creds.moltnetJson, vmAgentDir, vmSshDir, creds.githubAppPemFilename);
+			await vm.fs.writeFile(`${vmAgentDir}/moltnet.json`, vmMoltnetJson, {
+				mode: 384,
+				signal: config.signal
+			});
+			await vm.fs.writeFile(`${vmAgentDir}/env`, creds.agentEnvRaw, {
+				mode: 384,
+				signal: config.signal
+			});
+			if (creds.gitconfig) {
+				const vmGitconfig = rewriteGitconfigPaths(creds.gitconfig, vmSshDir, vmAgentDir);
+				await vm.fs.writeFile(`${vmAgentDir}/gitconfig`, vmGitconfig, {
+					mode: 420,
+					signal: config.signal
+				});
+			}
+			if (creds.sshPrivateKey) await vm.fs.writeFile(`${vmSshDir}/id_ed25519`, creds.sshPrivateKey, {
+				mode: 384,
+				signal: config.signal
+			});
+			if (creds.sshPublicKey) await vm.fs.writeFile(`${vmSshDir}/id_ed25519.pub`, creds.sshPublicKey, {
 				mode: 420,
 				signal: config.signal
 			});
+			if (creds.allowedSigners) await vm.fs.writeFile(`${vmSshDir}/allowed_signers`, creds.allowedSigners, {
+				mode: 420,
+				signal: config.signal
+			});
+			if (creds.githubAppPem && creds.githubAppPemFilename) await vm.fs.writeFile(`${vmAgentDir}/${creds.githubAppPemFilename}`, creds.githubAppPem, {
+				mode: 384,
+				signal: config.signal
+			});
 		}
-		if (creds.sshPrivateKey) await vm.fs.writeFile(`${vmSshDir}/id_ed25519`, creds.sshPrivateKey, {
-			mode: 384,
-			signal: config.signal
-		});
-		if (creds.sshPublicKey) await vm.fs.writeFile(`${vmSshDir}/id_ed25519.pub`, creds.sshPublicKey, {
-			mode: 420,
-			signal: config.signal
-		});
-		if (creds.allowedSigners) await vm.fs.writeFile(`${vmSshDir}/allowed_signers`, creds.allowedSigners, {
-			mode: 420,
-			signal: config.signal
-		});
-		if (creds.githubAppPem && creds.githubAppPemFilename) await vm.fs.writeFile(`${vmAgentDir}/${creds.githubAppPemFilename}`, creds.githubAppPem, {
-			mode: 384,
-			signal: config.signal
-		});
-		await vm.exec("chown -R agent:agent /home/agent/.pi /home/agent/.moltnet", { signal: config.signal });
+		await vm.exec(hasAgentFiles ? "chown -R agent:agent /home/agent/.pi /home/agent/.moltnet" : "chown -R agent:agent /home/agent/.pi", { signal: config.signal });
 		return {
 			vm,
 			credentials: creds,
@@ -7104,6 +7210,19 @@ var GONDOLIN_TOOL_NAMES = [
 	"find",
 	"grep"
 ];
+var HOST_AUTHENTICATED_HOST_EXEC_REFUSED_ENV = new Set([
+	"GIT_CONFIG_GLOBAL",
+	"MOLTNET_CREDENTIALS_PATH",
+	"SSH_AUTH_SOCK"
+]);
+function resolveHostExecBaseEnv(guestCredentialMode, agentEnv) {
+	const names = new Set([...HOST_EXEC_DEFAULT_BASE_ENV, ...Object.keys(agentEnv)]);
+	if (guestCredentialMode === "host-authenticated") {
+		for (const name of HOST_AUTHENTICATED_HOST_EXEC_REFUSED_ENV) names.delete(name);
+		for (const name of names) if (name.startsWith("MOLTNET_")) names.delete(name);
+	}
+	return names;
+}
 var noopTurnEventHandler = () => {};
 async function openVmWorkspaceFileForRead(config) {
 	const localPath = isAbsolute(config.filePath) ? config.filePath : resolve(config.cwdPath, config.filePath);
@@ -7135,6 +7254,16 @@ function createGondolinToolDefinitions(config) {
 		}
 	];
 }
+function createMoltNetAgentResolver(input) {
+	let resolved;
+	return () => {
+		if (!resolved) resolved = (input.moltnetAgent ? Promise.resolve(input.moltnetAgent) : (input.connectAgent ?? ((configDir) => connect({ configDir })))(input.configDir)).catch((error) => {
+			resolved = void 0;
+			throw error;
+		});
+		return resolved;
+	};
+}
 /**
 * Factory that builds a pi-specific `executeTask` function suitable for
 * injection into `AgentRuntime`. The returned function caches the resolved
@@ -7318,11 +7447,13 @@ async function executePiTask(claimedTask, reporter, opts) {
 				checkpointPath,
 				agentName: opts.agentName,
 				agentRootDir,
+				guestCredentialMode: opts.guestCredentialMode,
 				mountPath,
 				workspaceMode: preparedWorkspace.mode,
 				extraAllowedHosts: opts.extraAllowedHosts,
 				sandboxConfig: effectiveSandboxConfig,
 				forwardEnv: opts.forwardEnv,
+				onDiagnostic: opts.onVmDiagnostic,
 				signal: reporter.cancelSignal
 			}));
 		} catch (err) {
@@ -7339,6 +7470,10 @@ async function executePiTask(claimedTask, reporter, opts) {
 		activateAgentEnv(managed.credentials.agentEnv, agentRootDir);
 		const activeWorkspace = preparedWorkspace;
 		const activeManaged = managed;
+		const getMoltNetAgent = createMoltNetAgentResolver({
+			moltnetAgent: opts.moltnetAgent,
+			configDir: managed.agentDir
+		});
 		await emit("info", {
 			event: "execute_start",
 			correlationId: task.correlationId ?? null,
@@ -7353,7 +7488,7 @@ async function executePiTask(claimedTask, reporter, opts) {
 		let resolvedPriorContext;
 		const continueFrom = task.input?.continueFrom;
 		if (task.taskType === FREEFORM_TYPE && continueFrom) try {
-			const resolved = await resolvePriorContext(await connect({ configDir: managed.agentDir }), continueFrom);
+			const resolved = await resolvePriorContext(await getMoltNetAgent(), continueFrom);
 			if (resolved) {
 				resolvedPriorContext = resolved;
 				await emit("info", {
@@ -7468,7 +7603,7 @@ async function executePiTask(claimedTask, reporter, opts) {
 		});
 		const submitTools = submitToolDefs;
 		try {
-			const moltnetAgent = await connect({ configDir: managed.agentDir });
+			const moltnetAgent = await getMoltNetAgent();
 			const moltnetTools = createMoltNetTools({
 				getAgent: () => moltnetAgent,
 				getDiaryId: () => diaryId,
@@ -7482,7 +7617,7 @@ async function executePiTask(claimedTask, reporter, opts) {
 					guestWorkspace: activeManaged.guestWorkspace,
 					filePath
 				}),
-				hostExecBaseEnv: new Set([...HOST_EXEC_DEFAULT_BASE_ENV, ...Object.keys(managed.credentials.agentEnv)]),
+				hostExecBaseEnv: resolveHostExecBaseEnv(opts.guestCredentialMode ?? "guest-config", managed.credentials.agentEnv),
 				hostExecAutoApprove: opts.hostExecAutoApprove ?? opts.sandboxConfig?.hostExec?.autoApprove ?? false,
 				getTaskContext: () => ({
 					taskId: task.id,
@@ -8564,4 +8699,4 @@ function describeToolErrorMessage(result) {
 	}
 }
 //#endregion
-export { GONDOLIN_BASE_EXECUTABLES, GONDOLIN_TOOL_NAMES, HOST_EXEC_DEFAULT_BASE_ENV, MOLTNET_TOOL_NAMES, PI_EXECUTOR_MANIFEST_VERSION, PI_RUNTIME_DEFINITION_VERSION, activateAgentEnv, buildAgentSession, buildPiExecutorManifest, buildRuntimeKernel, buildWorkspaceMountInstructions, createGondolinBashOps, createGondolinEditOps, createGondolinFindOps, createGondolinLsOps, createGondolinReadOps, createGondolinToolDefinitions, createGondolinWriteOps, createMoltNetTools, createPiOtelExtension, createPiRetryTriage, createPiTaskExecutor, createSubagentTool, createToolPolicyExtension, decideForEvent, decideToolCall, defineGondolinTemplate, definePiExtension, definePiRuntime, definePiTool, enabledPiToolNames, ensureSnapshot, executeGondolinGrep, executePiTask, filterModelVisibleTools, findMainWorktree, injectRuntimeContext as injectTaskContext, isKernelTool, isResolvedPathInsideRoot, isToolVisible, loadCredentials, materializePiExtensions, materializePiTools, normalizeRetryTriageResult, redactRetryTriageSecrets, resolveSessionToolPolicy, resolveTaskWorktreePath, resumeVm, toGuestPath };
+export { GONDOLIN_BASE_EXECUTABLES, GONDOLIN_TOOL_NAMES, GuestEnvironmentBoundaryError, HOST_EXEC_DEFAULT_BASE_ENV, MOLTNET_TOOL_NAMES, PI_EXECUTOR_MANIFEST_VERSION, PI_RUNTIME_DEFINITION_VERSION, activateAgentEnv, assertGuestEnvironmentBoundary, assertHostAuthenticatedGuestEnvironment, buildAgentSession, buildPiExecutorManifest, buildRuntimeKernel, buildWorkspaceMountInstructions, createGondolinBashOps, createGondolinEditOps, createGondolinFindOps, createGondolinLsOps, createGondolinReadOps, createGondolinToolDefinitions, createGondolinWriteOps, createMoltNetTools, createPiOtelExtension, createPiRetryTriage, createPiTaskExecutor, createSubagentTool, createToolPolicyExtension, decideForEvent, decideToolCall, defineGondolinTemplate, definePiExtension, definePiRuntime, definePiTool, enabledPiToolNames, ensureSnapshot, executeGondolinGrep, executePiTask, filterModelVisibleTools, findMainWorktree, injectRuntimeContext as injectTaskContext, isKernelTool, isResolvedPathInsideRoot, isToolVisible, loadCredentials, materializePiExtensions, materializePiTools, normalizeRetryTriageResult, redactRetryTriageSecrets, resolveHostExecBaseEnv, resolveSessionToolPolicy, resolveTaskWorktreePath, resumeVm, toGuestPath };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/pi-runtime",
-  "version": "0.7.2",
+  "version": "0.8.0",
   "license": "MIT",
   "type": "module",
   "description": "Composable MoltNet runtime kernel for Pi agents in Gondolin VMs",
@@ -31,8 +31,9 @@
     "@opentelemetry/api": "^1.9.0",
     "multiformats": "^13.3.0",
     "typebox": "^1.2.8",
-    "@themoltnet/agent-runtime": "0.41.2",
-    "@themoltnet/sdk": "0.131.0",
+    "@themoltnet/agent-runtime": "0.41.3",
+    "@themoltnet/os-keyring": "0.2.0",
+    "@themoltnet/sdk": "0.132.0",
     "@themoltnet/shell-command-analyzer": "0.3.0"
   },
   "peerDependencies": {
@@ -50,8 +51,8 @@
     "vite": "^8.0.0",
     "vite-plugin-dts": "^4.5.4",
     "vitest": "^3.0.0",
-    "@moltnet/tasks": "0.1.0",
     "@moltnet/crypto-service": "0.1.0",
+    "@moltnet/tasks": "0.1.0",
     "@moltnet/models": "0.1.0"
   },
   "engines": {