@themoltnet/pi-runtime 0.9.0 → 0.10.1

package/dist/index.d.ts

@@ -849,6 +849,12 @@ export declare interface MoltNetToolsConfig {
      * entry creation behaves as before (env-derived diary, no auto-tags).
      */
     getTaskContext?(): MoltNetTaskContext | null;
+    /** Records recoverable task-provenance failures without ending the task. */
+    onTaskProvenanceEvent?(event: 'task.provenance.entry_denied', details: {
+        taskId: string;
+        diaryId: string;
+        error: string;
+    }): void | Promise<void>;
 }
 
 export declare function normalizeRetryTriageResult(value: unknown): PiRetryTriageResult;

package/dist/index.js

@@ -7,17 +7,8 @@ import { Type } from "@earendil-works/pi-ai";
 import { AuthStorage, DEFAULT_MAX_BYTES, DefaultResourceLoader, ModelRegistry, SessionManager, createAgentSession, createBashToolDefinition, createEditToolDefinition, createFindToolDefinition, createGrepToolDefinition, createLsToolDefinition, createReadToolDefinition, createSyntheticSourceInfo, createWriteToolDefinition, defineTool, formatSize, parseFrontmatter, truncateHead, truncateLine } from "@earendil-works/pi-coding-agent";
 import { SpanStatusCode, context, metrics, trace } from "@opentelemetry/api";
 import { CID } from "multiformats/cid";
-import "multiformats/codecs/raw";
-import "multiformats/hashes/digest";
-import { sha256 } from "multiformats/hashes/sha2";
-import "@noble/hashes/sha2";
-import "multiformats/bases/base32";
-import "@noble/curves/ed25519.js";
-import * as ed from "@noble/ed25519";
-import { createHash } from "crypto";
-import { createHash as createHash$1 } from "node:crypto";
 import * as json from "multiformats/codecs/json";
-import "@ipld/dag-cbor";
+import { sha256 } from "multiformats/hashes/sha2";
 import { FREEFORM_TYPE, SUBMIT_OUTPUT_GATE_ID, TaskContext, buildTaskUserPrompt, getSubmitOutputContract, materializeTaskOutput, mergeRuntimeProfileContext, resolveTaskContext, taskTypeUsesSubagents, traceRuntimePhase, validateTaskOutput, validateTaskSubmission } from "@themoltnet/agent-runtime";
 import { connect } from "@themoltnet/sdk/node";
 import { ShellCommandAnalyzer } from "@themoltnet/shell-command-analyzer";
@@ -25,6 +16,7 @@ import { homedir } from "node:os";
 import { MemoryProvider, RealFSProvider, ShadowProvider, VM, VmCheckpoint, createHttpHooks, createShadowPathPredicate, ensureImageSelector, isWriteFlag, loadGuestAssets } from "@earendil-works/gondolin";
 import { Type as Type$1 } from "typebox";
 import { Value } from "typebox/value";
+import { createHash } from "node:crypto";
 import { parseEnv } from "node:util";
 //#region src/path-containment.ts
 /**
@@ -678,13 +670,27 @@ function createMoltNetTools(config) {
 			} else targetDiaryId = params.diaryId ?? envDiaryId;
 			const userTags = params.tags ?? [];
 			const mergedTags = autoTags.length ? [...autoTags, ...userTags.filter((t) => !autoTags.includes(t))] : userTags;
-			const entry = await agent.entries.create(targetDiaryId, {
-				title: params.title,
-				content: params.content,
-				tags: mergedTags,
-				importance: params.importance ?? 5,
-				...params.entryType ? { entryType: params.entryType } : {}
-			});
+			let entry;
+			try {
+				entry = await agent.entries.create(targetDiaryId, {
+					title: params.title,
+					content: params.content,
+					tags: mergedTags,
+					importance: params.importance ?? 5,
+					...params.entryType ? { entryType: params.entryType } : {}
+				});
+			} catch (error) {
+				const message = error instanceof Error ? error.message : String(error);
+				if (taskCtx && /\b403\b|forbidden|not authorized|permission/i.test(message)) {
+					await config.onTaskProvenanceEvent?.("task.provenance.entry_denied", {
+						taskId: taskCtx.taskId,
+						diaryId: targetDiaryId,
+						error: message
+					});
+					throw new Error(`entries_create: the task provenance diary denied this entry. The diary may have moved to another team or its grants may have changed. The task and runtime session remain active; ask a diary manager to restore write access, then retry. (${message})`, { cause: error });
+				}
+				throw error;
+			}
 			return {
 				content: [{
 					type: "text",
@@ -1296,21 +1302,6 @@ async function resolvePersistentSessionManager(args) {
 	await SessionManager.list(args.cwd, args.sessionDir);
 	return SessionManager.continueRecent(args.cwd, args.sessionDir);
 }
-new TextEncoder();
-//#endregion
-//#region ../crypto-service/src/crypto.service.ts
-ed.etc.sha512Sync = (...m) => {
-	const hash = createHash("sha512");
-	m.forEach((msg) => hash.update(msg));
-	return hash.digest();
-};
-//#endregion
-//#region ../crypto-service/src/executor-attestation.ts
-ed.etc.sha512Sync = (...m) => {
-	const hash = createHash$1("sha512");
-	m.forEach((msg) => hash.update(msg));
-	return hash.digest();
-};
 //#endregion
 //#region ../crypto-service/src/json-cid.ts
 /**
@@ -1326,19 +1317,6 @@ async function computeJsonCid(value) {
 	return CID.create(1, json.code, hash).toString();
 }
 //#endregion
-//#region ../crypto-service/src/ssh.ts
-/**
-* SSH key format conversion for MoltNet Ed25519 keys
-*
-* Converts MoltNet agent keys (ed25519:<base64>) to OpenSSH format
-* for use with git commit signing and SSH authentication.
-*/
-if (!ed.etc.sha512Sync) ed.etc.sha512Sync = (...m) => {
-	const hash = createHash("sha512");
-	m.forEach((msg) => hash.update(msg));
-	return hash.digest();
-};
-//#endregion
 //#region src/config.ts
 /** Resolve Pi's host-side auth/config directory from process configuration. */
 function resolvePiCodingAgentDir() {
@@ -1953,10 +1931,10 @@ Type$1.Object({
 		Type$1.Literal("completed"),
 		Type$1.Literal("failed")
 	]),
-	githubCode: Type$1.Optional(Type$1.String()),
+	githubCode: Type$1.Optional(Type$1.String({ description: "GitHub manifest code sealed to the onboarding agent public key." })),
 	identityId: Type$1.Optional(Type$1.String()),
 	clientId: Type$1.Optional(Type$1.String()),
-	clientSecret: Type$1.Optional(Type$1.String()),
+	clientSecret: Type$1.Optional(Type$1.String({ description: "OAuth2 client secret sealed to the onboarding agent public key." })),
 	installationId: Type$1.Optional(Type$1.String())
 });
 Type$1.Object({
@@ -2139,6 +2117,23 @@ var DiaryGrantResponseSchema = Type$1.Object({
 });
 Type$1.Object({ grants: Type$1.Array(DiaryGrantResponseSchema) });
 Type$1.Object({ revoked: Type$1.Boolean() });
+var TaskGrantRoleSchema = Type$1.Union([Type$1.Literal("writer"), Type$1.Literal("manager")]);
+Type$1.Object({
+	subjectId: UuidSchema,
+	subjectNs: GrantSubjectNsSchema,
+	role: TaskGrantRoleSchema
+});
+Type$1.Object({
+	subjectId: UuidSchema,
+	subjectNs: GrantSubjectNsSchema,
+	role: TaskGrantRoleSchema
+});
+var TaskGrantResponseSchema = Type$1.Object({
+	subjectId: UuidSchema,
+	subjectNs: GrantSubjectNsSchema,
+	role: TaskGrantRoleSchema
+});
+Type$1.Object({ grants: Type$1.Array(TaskGrantResponseSchema) });
 Type$1.Object({ "x-moltnet-team-id": Type$1.String({
 	format: "uuid",
 	description: "Team ID (UUID) that will own the resource. Required."
@@ -3851,7 +3846,7 @@ Type$1.Object({
 	allowedProfiles: Type$1.Array(RuntimeProfileRef, { maxItems: 16 }),
 	status: TaskStatus,
 	queuedAt: IsoTimestamp,
-	completedAt: Type$1.Union([IsoTimestamp, Type$1.Null()]),
+	completedAt: Type$1.Union([IsoTimestamp, Type$1.Null()], { description: "First time the task entered completed, failed, cancelled, or expired; null until terminal." }),
 	expiresAt: Type$1.Union([IsoTimestamp, Type$1.Null()]),
 	cancelledByAgentId: Type$1.Union([Uuid, Type$1.Null()]),
 	cancelledByHumanId: Type$1.Union([Uuid, Type$1.Null()]),
@@ -4028,7 +4023,7 @@ function getCacheDir() {
 	return path.join(base, "moltnet", "gondolin");
 }
 function computeConfigHash(config) {
-	const h = createHash$1("sha256");
+	const h = createHash("sha256");
 	h.update(JSON.stringify({
 		baseAlpine: BASE_ALPINE_PACKAGES,
 		ghVersion: GH_VERSION,
@@ -5470,7 +5465,7 @@ function decideToolCall(input) {
 	return fenced(input.enforcement, "tool_not_permitted", `not permitted by tool policy: ${missing.join(", ")}`, `would block (watch): ${missing.join(", ")}`, missing, missingShellCommands);
 }
 function fingerprintArgv(argv) {
-	return `sha256:${createHash$1("sha256").update(JSON.stringify(argv.map((token) => token === null ? { dynamic: true } : token))).digest("hex").slice(0, 16)}`;
+	return `sha256:${createHash("sha256").update(JSON.stringify(argv.map((token) => token === null ? { dynamic: true } : token))).digest("hex").slice(0, 16)}`;
 }
 function toMatchedShellCommand(executable, argvPrefix) {
 	return {
@@ -7662,6 +7657,11 @@ async function executePiTask(claimedTask, reporter, opts) {
 					attemptN,
 					diaryId,
 					correlationId: task.correlationId ?? null
+				}),
+				onTaskProvenanceEvent: (event, details) => emit("info", {
+					event,
+					severity: "warn",
+					...details
 				})
 			});
 			const piAuthDir = resolvePiCodingAgentDir();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/pi-runtime",
-  "version": "0.9.0",
+  "version": "0.10.1",
   "license": "MIT",
   "type": "module",
   "description": "Composable MoltNet runtime kernel for Pi agents in Gondolin VMs",
@@ -31,9 +31,9 @@
     "@opentelemetry/api": "^1.9.0",
     "multiformats": "^13.3.0",
     "typebox": "^1.2.8",
-    "@themoltnet/agent-runtime": "0.42.0",
+    "@themoltnet/agent-runtime": "0.43.1",
+    "@themoltnet/sdk": "0.135.0",
     "@themoltnet/os-keyring": "0.2.0",
-    "@themoltnet/sdk": "0.133.0",
     "@themoltnet/shell-command-analyzer": "0.3.0"
   },
   "peerDependencies": {
@@ -52,8 +52,8 @@
     "vite-plugin-dts": "^4.5.4",
     "vitest": "^3.0.0",
     "@moltnet/models": "0.1.0",
-    "@moltnet/tasks": "0.1.0",
-    "@moltnet/crypto-service": "0.1.0"
+    "@moltnet/crypto-service": "0.1.0",
+    "@moltnet/tasks": "0.1.0"
   },
   "engines": {
     "node": ">=24"