@themoltnet/pi-runtime 0.9.0 → 0.10.0

package/dist/index.d.ts

@@ -849,6 +849,12 @@ export declare interface MoltNetToolsConfig {
      * entry creation behaves as before (env-derived diary, no auto-tags).
      */
     getTaskContext?(): MoltNetTaskContext | null;
+    /** Records recoverable task-provenance failures without ending the task. */
+    onTaskProvenanceEvent?(event: 'task.provenance.entry_denied', details: {
+        taskId: string;
+        diaryId: string;
+        error: string;
+    }): void | Promise<void>;
 }
 
 export declare function normalizeRetryTriageResult(value: unknown): PiRetryTriageResult;

package/dist/index.js

@@ -678,13 +678,27 @@ function createMoltNetTools(config) {
 			} else targetDiaryId = params.diaryId ?? envDiaryId;
 			const userTags = params.tags ?? [];
 			const mergedTags = autoTags.length ? [...autoTags, ...userTags.filter((t) => !autoTags.includes(t))] : userTags;
-			const entry = await agent.entries.create(targetDiaryId, {
-				title: params.title,
-				content: params.content,
-				tags: mergedTags,
-				importance: params.importance ?? 5,
-				...params.entryType ? { entryType: params.entryType } : {}
-			});
+			let entry;
+			try {
+				entry = await agent.entries.create(targetDiaryId, {
+					title: params.title,
+					content: params.content,
+					tags: mergedTags,
+					importance: params.importance ?? 5,
+					...params.entryType ? { entryType: params.entryType } : {}
+				});
+			} catch (error) {
+				const message = error instanceof Error ? error.message : String(error);
+				if (taskCtx && /\b403\b|forbidden|not authorized|permission/i.test(message)) {
+					await config.onTaskProvenanceEvent?.("task.provenance.entry_denied", {
+						taskId: taskCtx.taskId,
+						diaryId: targetDiaryId,
+						error: message
+					});
+					throw new Error(`entries_create: the task provenance diary denied this entry. The diary may have moved to another team or its grants may have changed. The task and runtime session remain active; ask a diary manager to restore write access, then retry. (${message})`, { cause: error });
+				}
+				throw error;
+			}
 			return {
 				content: [{
 					type: "text",
@@ -2139,6 +2153,23 @@ var DiaryGrantResponseSchema = Type$1.Object({
 });
 Type$1.Object({ grants: Type$1.Array(DiaryGrantResponseSchema) });
 Type$1.Object({ revoked: Type$1.Boolean() });
+var TaskGrantRoleSchema = Type$1.Union([Type$1.Literal("writer"), Type$1.Literal("manager")]);
+Type$1.Object({
+	subjectId: UuidSchema,
+	subjectNs: GrantSubjectNsSchema,
+	role: TaskGrantRoleSchema
+});
+Type$1.Object({
+	subjectId: UuidSchema,
+	subjectNs: GrantSubjectNsSchema,
+	role: TaskGrantRoleSchema
+});
+var TaskGrantResponseSchema = Type$1.Object({
+	subjectId: UuidSchema,
+	subjectNs: GrantSubjectNsSchema,
+	role: TaskGrantRoleSchema
+});
+Type$1.Object({ grants: Type$1.Array(TaskGrantResponseSchema) });
 Type$1.Object({ "x-moltnet-team-id": Type$1.String({
 	format: "uuid",
 	description: "Team ID (UUID) that will own the resource. Required."
@@ -7662,6 +7693,11 @@ async function executePiTask(claimedTask, reporter, opts) {
 					attemptN,
 					diaryId,
 					correlationId: task.correlationId ?? null
+				}),
+				onTaskProvenanceEvent: (event, details) => emit("info", {
+					event,
+					severity: "warn",
+					...details
 				})
 			});
 			const piAuthDir = resolvePiCodingAgentDir();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/pi-runtime",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "license": "MIT",
   "type": "module",
   "description": "Composable MoltNet runtime kernel for Pi agents in Gondolin VMs",
@@ -31,9 +31,9 @@
     "@opentelemetry/api": "^1.9.0",
     "multiformats": "^13.3.0",
     "typebox": "^1.2.8",
-    "@themoltnet/agent-runtime": "0.42.0",
+    "@themoltnet/agent-runtime": "0.43.0",
     "@themoltnet/os-keyring": "0.2.0",
-    "@themoltnet/sdk": "0.133.0",
+    "@themoltnet/sdk": "0.134.0",
     "@themoltnet/shell-command-analyzer": "0.3.0"
   },
   "peerDependencies": {
@@ -51,9 +51,9 @@
     "vite": "^8.0.0",
     "vite-plugin-dts": "^4.5.4",
     "vitest": "^3.0.0",
+    "@moltnet/crypto-service": "0.1.0",
     "@moltnet/models": "0.1.0",
-    "@moltnet/tasks": "0.1.0",
-    "@moltnet/crypto-service": "0.1.0"
+    "@moltnet/tasks": "0.1.0"
   },
   "engines": {
     "node": ">=24"