@themoltnet/sandbox-gondolin 0.2.0 → 0.4.0

package/README.md

@@ -14,10 +14,9 @@ implementation can be added beside it without going through Pi.
   with VFS shadowing (`deny` / `tmpfs`), egress allowlist through Gondolin's
   host-side HTTP hooks, explicit guest environment, resource limits, resume
   commands, and abort-safe cleanup.
-- The guest credential boundary: `guest-config` injects the complete
-  `.moltnet/<agent>` tree; `host-authenticated` withholds it and refuses
-  `MOLTNET_*` names in runtime-controlled guest environment
-  (`assertGuestEnvironmentBoundary`).
+- The guest credential boundary: the guest never receives the
+  `.moltnet/<agent>` tree, and `MOLTNET_*` names are refused in
+  runtime-controlled guest environment (`assertGuestEnvironmentBoundary`).
 - `VmConfig.brokeredSecrets` — host-brokered secrets: the guest sees a
   placeholder, Gondolin's `SecretManager` substitutes the value only in
   requests to the declared protocol, host patterns, and ports.
@@ -27,10 +26,10 @@ implementation can be added beside it without going through Pi.
 
 ## What it deliberately does not own
 
-- **Provider authentication.** A runtime supplies `VmConfig.providerAuth`
-  (`{ load(): string | null; guestPath }`); the sandbox only carries the blob
-  across the boundary. Pi's `~/.pi/agent/auth.json` handling lives in
-  `@themoltnet/pi-runtime` (`piProviderAuth`, and its `resumeVm` wrapper).
+- **Provider authentication.** The coding-agent session and its model calls run
+  host-side (Pi's `createAgentSession` reads the host `~/.pi/agent` auth), so no
+  provider auth is projected into the guest — the guest only executes tools via
+  `vm.exec`.
 - Tool definitions, tool policy, task execution, workspace preparation —
   all Pi-runtime concerns.
 
@@ -54,7 +53,6 @@ contain a value or choose a host secret-provider coordinate.
 const managed = await resumeVm({
   checkpointPath,
   agentName: 'worker',
-  guestCredentialMode: 'host-authenticated',
   mountPath: workspace,
   sandboxConfig: {
     network: { allowedHosts: ['api.example.com'] },

package/dist/index.d.ts

@@ -1,3 +1,4 @@
+import { HttpIpAllowInfo } from '@earendil-works/gondolin';
 import { MemoryProvider } from '@earendil-works/gondolin';
 import { SecretDefinition } from '@earendil-works/gondolin';
 import { VirtualFileHandle } from '@earendil-works/gondolin';
@@ -20,12 +21,11 @@ declare interface AbortableResourceOptions<T> {
 export declare function activateAgentEnv(agentEnv: Record<string, string | undefined>, repoRoot: string): void;
 
 export declare function assertGuestEnvironmentBoundary(options: {
-    guestCredentialMode: GuestCredentialMode;
     forwardEnv?: readonly string[];
     sandboxEnv?: Readonly<Record<string, string>>;
 }): void;
 
-/** @deprecated Prefer assertGuestEnvironmentBoundary for mode-aware checks. */
+/** @deprecated Alias of assertGuestEnvironmentBoundary (a single boundary). */
 export declare function assertHostAuthenticatedGuestEnvironment(options: {
     forwardEnv?: readonly string[];
     sandboxEnv?: Readonly<Record<string, string>>;
@@ -85,6 +85,20 @@ export declare interface BrokeredHttpSecretManager {
  */
 export declare function canonicalizeBrokeredHttpSecretDescriptor(descriptor: BrokeredHttpSecretDescriptor): Required<BrokeredHttpSecretDescriptor>;
 
+/**
+ * Refine Gondolin's hostname allowlist for hosts carrying brokered
+ * credentials. The built-in allowlist is hostname-granular; these callbacks
+ * enforce the descriptor protocol and port before request or IP dispatch.
+ */
+export declare function createBrokeredHttpNetworkOriginPolicy(bindings: readonly BrokeredHttpSecretDescriptor[], options?: {
+    onDenied?: (denial: RequestOrigin & {
+        phase: 'request' | 'ip';
+    }) => void;
+}): {
+    isRequestAllowed: (request: Request) => boolean;
+    isIpAllowed: (info: HttpIpAllowInfo) => boolean;
+};
+
 export declare function delay(ms: number, signal: AbortSignal | undefined, label: string): Promise<void>;
 
 /**
@@ -100,6 +114,14 @@ export declare interface EnsureSnapshotOptions {
     maxCached?: number;
 }
 
+/**
+ * Execute one login-shell command in a Gondolin VM. Successful commands may
+ * reuse the VM. Timeout or cancellation retires the complete VM through the
+ * host API before returning, because no guest process/session boundary can
+ * prove containment against daemonization or a guest-mutated root filesystem.
+ */
+export declare function execManagedCommand(vm: VM, command: string, options?: ManagedExecOptions): Promise<ManagedExecResult>;
+
 /**
  * Resolve the main worktree root (where .moltnet/ lives — it's untracked,
  * only exists in the main worktree, not in git worktrees).
@@ -109,6 +131,9 @@ export declare function findMainWorktree(startPath?: string): string;
 /** Commands guaranteed by the base Gondolin snapshot. */
 export declare const GONDOLIN_BASE_EXECUTABLES: readonly string[];
 
+/** Guest directory holding one PID file per projected service. */
+export declare const GUEST_SERVICE_PID_DIR = "/run/moltnet/services";
+
 /**
  * Memory-backed VFS mount used by the daemon to inject task context
  * (#943 slice 1.5). This is a separate top-level mount because Gondolin
@@ -134,13 +159,44 @@ export declare const GUEST_TASK_CONTEXT_MOUNT = "/moltnet-task-context";
 /** @deprecated Use GUEST_TASK_CONTEXT_MOUNT. */
 export declare const GUEST_TASK_SKILLS_MOUNT = "/moltnet-task-context";
 
-export declare type GuestCredentialMode = 'guest-config' | 'host-authenticated';
-
 export declare class GuestEnvironmentBoundaryError extends Error {
     readonly refusedNames: readonly string[];
     constructor(refusedNames: readonly string[]);
 }
 
+/** Declarative, trusted-host guest projection (env, files, services). */
+export declare interface GuestProjectionInput {
+    env?: Record<string, string>;
+    files?: {
+        path: string;
+        content: string | Uint8Array;
+        mode?: number;
+    }[];
+    services?: {
+        id: string;
+        command: readonly string[];
+        env?: Record<string, string>;
+        /** Guest path to wait for before the session starts. */
+        readiness?: {
+            path: string;
+            timeoutMs?: number;
+            required?: boolean;
+        };
+    }[];
+}
+
+/** Lifecycle handle for projected guest services. */
+export declare interface GuestServices {
+    stop(): Promise<void>;
+}
+
+/**
+ * Host origins: hostnames the guest can reach whose responses are produced by
+ * host code inside the proxy (`onRequest` short-circuit). Nothing is listened
+ * on, nothing is forwarded; the sandbox knows only the origin → handler map.
+ */
+declare type HostOriginHandler = (request: Request) => Promise<Response>;
+
 /**
  * Check containment for already-resolved lexical or real paths.
  *
@@ -151,13 +207,51 @@ export declare class GuestEnvironmentBoundaryError extends Error {
  */
 export declare function isResolvedPathInsideRoot(path: string, root: string): boolean;
 
-export declare function loadCredentials(agentDir: string, mode?: GuestCredentialMode, onDiagnostic?: (diagnostic: VmDiagnostic) => void, providerAuth?: ProviderAuthSource): VmCredentials;
+export declare function loadCredentials(): VmCredentials;
+
+export declare interface ManagedExecDiagnostic {
+    event: 'managed_exec.backend_retirement';
+    trigger: 'cancellation' | 'timeout';
+    outcome: 'started' | 'succeeded' | 'failed';
+    message: string;
+}
+
+export declare interface ManagedExecOptions {
+    cwd?: string;
+    env?: Record<string, string>;
+    signal?: AbortSignal;
+    timeoutMs?: number;
+    onData?: (data: Buffer, stream: 'stdout' | 'stderr') => void;
+    onDiagnostic?: (diagnostic: ManagedExecDiagnostic) => void;
+    onStarted?: () => void;
+}
+
+export declare interface ManagedExecResult {
+    exitCode: number;
+    timedOut: boolean;
+    cancelled: boolean;
+    termination: ManagedExecTermination;
+}
+
+export declare type ManagedExecTermination = {
+    status: 'not-required';
+} | {
+    status: 'not-started';
+} | {
+    status: 'backend-retired';
+    mode: 'vm-close';
+} | {
+    status: 'recovery-required';
+    reason: 'backend-retirement-failed';
+};
 
 export declare interface ManagedVm {
     vm: VM;
     credentials: VmCredentials;
     /** Host-only rotation and revocation handle. It cannot widen destinations. */
     secretManager: BrokeredHttpSecretManager;
+    /** Projected guest services; `stop()` before closing the VM. Always present. */
+    services: GuestServices;
     mountPath: string;
     guestWorkspace: string;
     agentDir: string;
@@ -173,11 +267,10 @@ export declare function prepareBrokeredHttpSecrets(options: {
     occupiedGuestEnvNames?: readonly string[];
 }): Record<string, SecretDefinition>;
 
-export declare interface ProviderAuthSource {
-    /** Read the auth blob from the host, or return null when absent. */
-    load(): string | null;
-    /** Absolute guest path to write the blob to (mode 0600). */
-    guestPath: string;
+declare interface RequestOrigin {
+    hostname: string;
+    protocol: string;
+    port: number;
 }
 
 export declare function resolveVfsShadowConfig(config: SandboxConfig | undefined): {
@@ -221,44 +314,6 @@ export declare interface ResumeCommandWhen {
  */
 export declare function resumeVm(config: VmConfig): Promise<ManagedVm>;
 
-/**
- * Rewrite host-absolute paths inside an agent gitconfig to VM-local
- * equivalents before injecting it into the guest.
- *
- * Two rewrites:
- *   - `signingKey = <host path>`  → `<vmSshDir>/id_ed25519`
- *   - `... credential-helper --credentials <host moltnet.json>`
- *                                 → `<vmAgentDir>/moltnet.json`
- *
- * The credential-helper line is generated host-side by `moltnet github setup`
- * with a host-absolute `--credentials` path; inside the guest that path is
- * invalid, so it must point at the VM-side moltnet.json. The `insteadOf`
- * rewrite rule and every other line are workspace-independent and pass through
- * unchanged. A gitconfig without a credential helper is rewritten only for
- * `signingKey`.
- *
- * This is the single source of truth for git push auth in the guest: the
- * injected gitconfig carries the tokenless mint-on-demand helper, so the VM
- * no longer hand-rolls a credential-helper script or runs an imperative
- * `git config --global ... insteadOf` against the guest $HOME.
- */
-export declare function rewriteGitconfigPaths(gitconfig: string, vmSshDir: string, vmAgentDir: string): string;
-
-/**
- * Rewrite host-absolute paths inside moltnet.json to VM-local equivalents.
- *
- * Fields rewritten:
- *   ssh.private_key_path  → <vmSshDir>/<basename of original>
- *   ssh.public_key_path   → <vmSshDir>/<basename of original>
- *   git.config_path       → <vmAgentDir>/gitconfig
- *   github.private_key_path → <vmAgentDir>/<pemFilename>  (if present)
- *
- * All other fields are passed through unchanged.
- * Throws if moltnetJson is not valid JSON — callers must not inject a broken
- * moltnet.json into the guest.
- */
-export declare function rewriteMoltnetJsonPaths(moltnetJson: string, vmAgentDir: string, vmSshDir: string, githubAppPemFilename: string | null): string;
-
 export declare interface SandboxConfig {
     /**
      * Operator-owned snapshot build settings. Runtime profiles must never
@@ -348,12 +403,6 @@ export declare interface VmConfig {
     checkpointPath: string;
     /** MoltNet agent name (used to resolve credentials). */
     agentName: string;
-    /**
-     * Trust boundary for guest credentials. `guest-config` injects the complete
-     * legacy agent directory. `host-authenticated` never reads or injects it and
-     * relies exclusively on the supplied host-side Agent for MoltNet operations.
-     */
-    guestCredentialMode?: GuestCredentialMode;
     /**
      * Host root that owns `.moltnet/<agentName>/`.
      *
@@ -383,49 +432,52 @@ export declare interface VmConfig {
      * raw values or select host secret-provider coordinates.
      */
     brokeredSecrets?: readonly BrokeredHttpSecretBinding[];
+    /**
+     * Trusted-host origins answered in-process by the proxy. Keys are full
+     * origins (`https://name.moltnet.internal`). Like brokered secrets these are
+     * outside SandboxConfig: a remotely stored profile cannot register one.
+     */
+    hostOrigins?: Record<string, HostOriginHandler>;
+    /**
+     * Trusted-host guest projection: env merged last (after broker
+     * placeholders), files written before the session starts, services run in
+     * the guest for the session's lifetime. Not subject to the profile env
+     * reserved-name guard — the runtime, not the profile, declares it.
+     */
+    guestProjection?: GuestProjectionInput;
     /** Structured credential-boundary diagnostics for daemon loggers. */
     onDiagnostic?: (diagnostic: VmDiagnostic) => void;
     /** Abort resume/setup work, closing any live VM owned by resumeVm. */
     signal?: AbortSignal;
-    /**
-     * Coding-agent provider authentication to place in the guest (for example
-     * Pi's `auth.json`). The sandbox knows nothing about the provider: the
-     * runtime above it supplies the loader and the guest path. When omitted,
-     * nothing is written and the guest relies on forwarded env providers.
-     */
-    providerAuth?: ProviderAuthSource;
 }
 
 export declare interface VmCredentials {
-    /** Empty in host-authenticated mode; retained as strings for API stability. */
-    moltnetJson: string;
-    /** Empty in host-authenticated mode; retained as strings for API stability. */
-    agentEnvRaw: string;
     /**
-     * Provider auth blob supplied by `VmConfig.providerAuth`, or null when the
-     * runtime supplied none or the host file is absent — the guest then relies
-     * on env-var providers (`ANTHROPIC_API_KEY`, etc.) carried via `agentEnv`
-     * and the forwarded host environment instead. CI uses this path.
+     * Guest env carried across the boundary. Always empty: the guest receives no
+     * MoltNet credential material. Retained for API stability and because
+     * consumers read (empty) provider/diary/team hints from it.
      */
-    providerAuthJson: string | null;
     agentEnv: Record<string, string | undefined>;
-    gitconfig: string | null;
-    sshPrivateKey: string | null;
-    sshPublicKey: string | null;
-    allowedSigners: string | null;
-    /** Raw PEM content of the GitHub App private key, or null if not configured. */
-    githubAppPem: string | null;
-    /** VM-local filename for the GitHub App PEM (basename of host path), or null. */
-    githubAppPemFilename: string | null;
 }
 
 export declare interface VmDiagnostic {
-    event: 'vm.credentials.mode' | 'vm.credentials.github_key_missing' | 'vm.http_secrets.bound';
+    event: 'vm.credentials.mode' | 'vm.http_secrets.bound' | 'vm.host_origins.bound' | 'vm.guest_projection.applied' | 'vm.guest_service.not_ready' | 'vm.network.origin_denied';
     level: 'info' | 'warning';
     message: string;
-    credentialMode: GuestCredentialMode;
     /** Present only for the value-free broker summary event. */
     brokeredSecretCount?: number;
+    /** Present only for the host-origins summary event. */
+    hostOriginCount?: number;
+    /** Present only for the guest-projection summary event. */
+    projectedFileCount?: number;
+    projectedServiceCount?: number;
+    /** Present only for an exact-origin denial event. */
+    origin?: {
+        hostname: string;
+        protocol: string;
+        port: number;
+        phase: 'request' | 'ip';
+    };
 }
 
 export { }

package/dist/index.js

@@ -1,9 +1,9 @@
 import path, { isAbsolute, relative } from "node:path";
 import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync } from "node:fs";
+import { existsSync, mkdirSync, readdirSync, rmSync, statSync } from "node:fs";
 import { MemoryProvider, RealFSProvider, ShadowProvider, VM, VmCheckpoint, createHttpHooks, createShadowPathPredicate, ensureImageSelector, isWriteFlag, loadGuestAssets } from "@earendil-works/gondolin";
-import { parseEnv } from "node:util";
+import { isIP } from "node:net";
 //#region src/abort-utils.ts
 function throwIfAborted(signal, label) {
 	if (!signal?.aborted) return;
@@ -61,6 +61,138 @@ async function delay(ms, signal, label) {
 	});
 }
 //#endregion
+//#region src/managed-exec.ts
+function chunkBuffer(data) {
+	if (Buffer.isBuffer(data)) return data;
+	return typeof data === "string" ? Buffer.from(data, "utf8") : Buffer.from(data);
+}
+async function retireBackend(vm, trigger, onDiagnostic) {
+	onDiagnostic?.({
+		event: "managed_exec.backend_retirement",
+		trigger,
+		outcome: "started",
+		message: "retiring Gondolin VM after interrupted guest execution"
+	});
+	try {
+		await vm.close();
+		onDiagnostic?.({
+			event: "managed_exec.backend_retirement",
+			trigger,
+			outcome: "succeeded",
+			message: "Gondolin VM retirement completed"
+		});
+		return {
+			status: "backend-retired",
+			mode: "vm-close"
+		};
+	} catch (error) {
+		onDiagnostic?.({
+			event: "managed_exec.backend_retirement",
+			trigger,
+			outcome: "failed",
+			message: error instanceof Error ? `Gondolin VM retirement failed: ${error.message}` : "Gondolin VM retirement failed"
+		});
+		return {
+			status: "recovery-required",
+			reason: "backend-retirement-failed"
+		};
+	}
+}
+/**
+* Execute one login-shell command in a Gondolin VM. Successful commands may
+* reuse the VM. Timeout or cancellation retires the complete VM through the
+* host API before returning, because no guest process/session boundary can
+* prove containment against daemonization or a guest-mutated root filesystem.
+*/
+async function execManagedCommand(vm, command, options = {}) {
+	if (options.signal?.aborted) return {
+		exitCode: 130,
+		timedOut: false,
+		cancelled: true,
+		termination: { status: "not-started" }
+	};
+	const controller = new AbortController();
+	let timedOut = false;
+	let cancelled = false;
+	let executionSettled = false;
+	let acceptOutput = true;
+	let resolveInterrupted;
+	let retirementPromise;
+	const interrupted = new Promise((resolve) => {
+		resolveInterrupted = resolve;
+	});
+	const interrupt = (trigger) => {
+		if (executionSettled || retirementPromise) return;
+		acceptOutput = false;
+		controller.abort(/* @__PURE__ */ new Error(`guest command interrupted by ${trigger}`));
+		retirementPromise = retireBackend(vm, trigger, options.onDiagnostic);
+		resolveInterrupted?.();
+	};
+	const onAbort = () => {
+		cancelled = true;
+		interrupt("cancellation");
+	};
+	options.signal?.addEventListener("abort", onAbort, { once: true });
+	const timer = options.timeoutMs !== void 0 && options.timeoutMs > 0 ? setTimeout(() => {
+		timedOut = true;
+		interrupt("timeout");
+	}, options.timeoutMs) : void 0;
+	timer?.unref();
+	try {
+		const process = vm.exec([
+			"/bin/sh",
+			"-lc",
+			command
+		], {
+			cwd: options.cwd,
+			env: options.env,
+			signal: controller.signal,
+			stdout: "pipe",
+			stderr: "pipe"
+		});
+		options.onStarted?.();
+		const execution = (async () => {
+			for await (const chunk of process.output()) {
+				if (!acceptOutput) continue;
+				options.onData?.(chunkBuffer(chunk.data), chunk.stream);
+			}
+			return process;
+		})();
+		const observedExecution = execution.then((result) => {
+			executionSettled = true;
+			return {
+				kind: "result",
+				result
+			};
+		}, (error) => {
+			executionSettled = true;
+			return {
+				kind: "error",
+				error
+			};
+		});
+		const first = await Promise.race([observedExecution, interrupted.then(() => ({ kind: "interrupted" }))]);
+		if (first.kind === "result" && !timedOut && !cancelled) return {
+			exitCode: first.result.exitCode,
+			timedOut: false,
+			cancelled: false,
+			termination: { status: "not-required" }
+		};
+		if (first.kind === "error" && !timedOut && !cancelled) throw first.error;
+		execution.catch(() => void 0);
+		const termination = await (retirementPromise ??= retireBackend(vm, timedOut ? "timeout" : "cancellation", options.onDiagnostic));
+		return {
+			exitCode: timedOut ? 124 : 130,
+			timedOut,
+			cancelled: cancelled && !timedOut,
+			termination
+		};
+	} finally {
+		if (timer) clearTimeout(timer);
+		options.signal?.removeEventListener("abort", onAbort);
+	}
+}
+//#endregion
 //#region src/path-containment.ts
 /**
 * Check containment for already-resolved lexical or real paths.
@@ -100,6 +232,7 @@ var BASE_ALPINE_PACKAGE_EXECUTABLES = {
 	file: "file",
 	git: "git",
 	jq: "jq",
+	"openssh-keygen": "ssh-keygen",
 	ripgrep: "rg",
 	tar: "tar",
 	xz: "xz"
@@ -292,6 +425,35 @@ function pruneOldSnapshots(maxCached, currentDir) {
 	});
 }
 //#endregion
+//#region src/host-origins.ts
+function hostOriginHostnames(origins) {
+	return Object.keys(origins).map((origin) => new URL(origin).hostname).sort();
+}
+function blocked() {
+	return new Response(JSON.stringify({
+		code: "host_origin_blocked",
+		message: "origin not served"
+	}), {
+		status: 421,
+		headers: { "content-type": "application/json" }
+	});
+}
+/**
+* Serve a registered origin in-process. Fails closed for any request whose
+* hostname belongs to a virtual origin but whose exact origin (scheme, host,
+* port) is not registered: such a request must never fall through to normal
+* outbound proxy forwarding (an SSRF route to a host-controlled name).
+*/
+function createHostOriginsOnRequest(origins) {
+	const virtualHostnames = new Set(hostOriginHostnames(origins));
+	return async (request) => {
+		const url = new URL(request.url);
+		const handler = origins[url.origin];
+		if (handler) return handler(request);
+		if (virtualHostnames.has(url.hostname)) return blocked();
+	};
+}
+//#endregion
 //#region src/vm-manager.ts
 /**
 * Memory-backed VFS mount used by the daemon to inject task context
@@ -314,6 +476,12 @@ function pruneOldSnapshots(maxCached, currentDir) {
 *     investigation and the alternatives we rejected.
 */
 var GUEST_TASK_CONTEXT_MOUNT = "/moltnet-task-context";
+/** Guest directory holding one PID file per projected service. */
+var GUEST_SERVICE_PID_DIR = "/run/moltnet/services";
+var GUEST_SERVICE_ID_RE = /^[a-z][a-z0-9-]{0,62}$/;
+function assertGuestServiceId(id) {
+	if (!GUEST_SERVICE_ID_RE.test(id)) throw new Error(`Invalid guest service id "${id}": expected ${GUEST_SERVICE_ID_RE}`);
+}
 /** @deprecated Use GUEST_TASK_CONTEXT_MOUNT. */
 var GUEST_TASK_SKILLS_MOUNT = GUEST_TASK_CONTEXT_MOUNT;
 function resolveVfsShadowConfig(config) {
@@ -396,59 +564,8 @@ function resolveVmAgentDir(config) {
 	const rootDir = config.agentRootDir ?? findMainWorktree();
 	return path.join(rootDir, ".moltnet", config.agentName);
 }
-function loadCredentials(agentDir, mode = "guest-config", onDiagnostic, providerAuth) {
-	const moltnetPath = path.join(agentDir, "moltnet.json");
-	const agentEnvPath = path.join(agentDir, "env");
-	const providerAuthJson = providerAuth?.load() ?? null;
-	if (mode === "host-authenticated") return {
-		moltnetJson: "",
-		agentEnvRaw: "",
-		providerAuthJson,
-		agentEnv: {},
-		gitconfig: null,
-		sshPrivateKey: null,
-		sshPublicKey: null,
-		allowedSigners: null,
-		githubAppPem: null,
-		githubAppPemFilename: null
-	};
-	const hasMoltnetJson = existsSync(moltnetPath);
-	const hasAgentEnv = existsSync(agentEnvPath);
-	if (!hasMoltnetJson || !hasAgentEnv) throw new Error(`Guest credential mode requires both ${moltnetPath} and ${agentEnvPath}`);
-	const moltnetJson = readFileSync(moltnetPath, "utf8");
-	const agentEnvRaw = readFileSync(agentEnvPath, "utf8");
-	if (moltnetJson.trim() === "") throw new Error(`Agent configuration is empty: ${moltnetPath}`);
-	const gitconfigPath = path.join(agentDir, "gitconfig");
-	const gitconfig = existsSync(gitconfigPath) ? readFileSync(gitconfigPath, "utf8") : null;
-	const sshDir = path.join(agentDir, "ssh");
-	const sshPrivateKey = existsSync(path.join(sshDir, "id_ed25519")) ? readFileSync(path.join(sshDir, "id_ed25519"), "utf8") : null;
-	const sshPublicKey = existsSync(path.join(sshDir, "id_ed25519.pub")) ? readFileSync(path.join(sshDir, "id_ed25519.pub"), "utf8") : null;
-	const allowedSigners = existsSync(path.join(sshDir, "allowed_signers")) ? readFileSync(path.join(sshDir, "allowed_signers"), "utf8") : null;
-	let githubAppPem = null;
-	let githubAppPemFilename = null;
-	const pemPath = (moltnetJson ? JSON.parse(moltnetJson) : null)?.github?.private_key_path;
-	if (pemPath) if (!existsSync(pemPath)) onDiagnostic?.({
-		event: "vm.credentials.github_key_missing",
-		level: "warning",
-		credentialMode: mode,
-		message: `github.private_key_path not found at ${pemPath}; moltnet github token will fail inside the guest`
-	});
-	else {
-		githubAppPem = readFileSync(pemPath, "utf8");
-		githubAppPemFilename = path.basename(pemPath);
-	}
-	return {
-		moltnetJson,
-		agentEnvRaw,
-		providerAuthJson,
-		agentEnv: parseEnv(agentEnvRaw),
-		gitconfig,
-		sshPrivateKey,
-		sshPublicKey,
-		allowedSigners,
-		githubAppPem,
-		githubAppPemFilename
-	};
+function loadCredentials() {
+	return { agentEnv: {} };
 }
 /**
 * Apply agent env vars to the host process, mirroring `moltnet start`.
@@ -544,9 +661,13 @@ var OBJECT_META_PROPERTY_NAMES = new Set([
 	"prototype"
 ]);
 function normalizeHostPattern(pattern) {
-	return pattern.trim().toLowerCase();
+	let normalized = pattern.trim().toLowerCase();
+	if (normalized.startsWith("[") && normalized.endsWith("]")) normalized = normalized.slice(1, -1);
+	if (normalized.endsWith(".")) normalized = normalized.slice(0, -1);
+	return normalized;
 }
 function isValidHostPattern(pattern) {
+	if (isIP(pattern) !== 0) return true;
 	return pattern !== "" && !pattern.includes("://") && !pattern.includes("/") && !pattern.includes(":") && !/\s/.test(pattern);
 }
 /**
@@ -581,8 +702,8 @@ function canonicalizeBrokeredHttpSecretDescriptor(descriptor) {
 	});
 }
 function hostMatchesPattern(hostname, pattern) {
-	const expression = pattern.split("*").map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join(".*");
-	return new RegExp(`^${expression}$`, "i").test(hostname);
+	const expression = normalizeHostPattern(pattern).split("*").map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join(".*");
+	return new RegExp(`^${expression}$`, "i").test(normalizeHostPattern(hostname));
 }
 /**
 * Conservative subset check for Gondolin hostname globs. Exact secret hosts
@@ -654,6 +775,19 @@ function headersContainSecretValue(headers, value) {
 	}
 	return false;
 }
+function parseRequestOrigin(url) {
+	try {
+		const parsed = new URL(url);
+		const protocol = parsed.protocol.slice(0, -1);
+		return {
+			hostname: normalizeHostPattern(parsed.hostname),
+			protocol,
+			port: parsed.port ? Number(parsed.port) : protocol === "https" ? 443 : 80
+		};
+	} catch {
+		return null;
+	}
+}
 function createBrokeredHttpSecretOriginPolicy(bindings) {
 	const entries = /* @__PURE__ */ new Map();
 	for (const binding of bindings) {
@@ -670,17 +804,11 @@ function createBrokeredHttpSecretOriginPolicy(bindings) {
 	}
 	return {
 		isRequestAllowed(request) {
-			let url;
-			try {
-				url = new URL(request.url);
-			} catch {
-				return false;
-			}
-			const protocol = url.protocol.slice(0, -1);
-			const port = url.port ? Number(url.port) : protocol === "https" ? 443 : 80;
+			const requestOrigin = parseRequestOrigin(request.url);
+			if (!requestOrigin) return false;
 			for (const entry of entries.values()) {
 				if (entry.deleted || !headersContainSecretValue(request.headers, entry.value)) continue;
-				if (protocol !== entry.protocol || !entry.ports.includes(port) || !entry.hosts.some((host) => hostMatchesPattern(url.hostname, host))) return false;
+				if (requestOrigin.protocol !== entry.protocol || !entry.ports.includes(requestOrigin.port) || !entry.hosts.some((host) => hostMatchesPattern(requestOrigin.hostname, host))) return false;
 			}
 			return true;
 		},
@@ -697,18 +825,51 @@ function createBrokeredHttpSecretOriginPolicy(bindings) {
 		}
 	};
 }
+/**
+* Refine Gondolin's hostname allowlist for hosts carrying brokered
+* credentials. The built-in allowlist is hostname-granular; these callbacks
+* enforce the descriptor protocol and port before request or IP dispatch.
+*/
+function createBrokeredHttpNetworkOriginPolicy(bindings, options = {}) {
+	const origins = bindings.map(canonicalizeBrokeredHttpSecretDescriptor);
+	const isAllowed = (input) => {
+		const hostname = normalizeHostPattern(input.hostname);
+		const matching = origins.filter((origin) => origin.hosts.some((host) => hostMatchesPattern(hostname, host)));
+		if (matching.length === 0) return true;
+		const allowed = matching.some((origin) => origin.protocol === input.protocol && origin.ports.includes(input.port));
+		if (!allowed) options.onDenied?.({
+			hostname,
+			protocol: input.protocol,
+			port: input.port,
+			phase: input.phase
+		});
+		return allowed;
+	};
+	return {
+		isRequestAllowed(request) {
+			const requestOrigin = parseRequestOrigin(request.url);
+			return requestOrigin ? isAllowed({
+				...requestOrigin,
+				phase: "request"
+			}) : false;
+		},
+		isIpAllowed(info) {
+			return isAllowed({
+				...info,
+				phase: "ip"
+			});
+		}
+	};
+}
 function assertGuestEnvironmentBoundary(options) {
-	const refusedForwardEnv = (options.forwardEnv ?? []).filter((name) => isReservedGuestEnvironmentName(name) || options.guestCredentialMode === "host-authenticated" && !HOST_AUTHENTICATED_GUEST_ENV_ALLOWLIST.has(name));
+	const refusedForwardEnv = (options.forwardEnv ?? []).filter((name) => isReservedGuestEnvironmentName(name) || !HOST_AUTHENTICATED_GUEST_ENV_ALLOWLIST.has(name));
 	const refusedSandboxEnv = Object.keys(options.sandboxEnv ?? {}).filter(isReservedGuestEnvironmentName);
 	const refused = [...new Set([...refusedForwardEnv, ...refusedSandboxEnv])].sort();
 	if (refused.length > 0) throw new GuestEnvironmentBoundaryError(refused);
 }
-/** @deprecated Prefer assertGuestEnvironmentBoundary for mode-aware checks. */
+/** @deprecated Alias of assertGuestEnvironmentBoundary (a single boundary). */
 function assertHostAuthenticatedGuestEnvironment(options) {
-	assertGuestEnvironmentBoundary({
-		guestCredentialMode: "host-authenticated",
-		...options
-	});
+	assertGuestEnvironmentBoundary(options);
 }
 /**
 * Return whether two Gondolin hostname globs can match at least one common
@@ -752,6 +913,10 @@ function assertInternalHostsDoNotOverlapProtectedHosts(internalHosts, protectedH
 * surface immediately rather than fall through to cryptic agent
 * errors later.
 */
+/** Single-quote a POSIX shell argument (paths/ids are pre-validated). */
+function shellQuote(value) {
+	return `'${value.replaceAll("'", `'\\''`)}'`;
+}
 async function vmRun(vm, label, command, signal) {
 	const wrapped = `set -eu\nset -o pipefail\n${command}`;
 	throwIfAborted(signal, `resume step "${label}"`);
@@ -781,22 +946,17 @@ async function resumeVm(config) {
 	throwIfAborted(config.signal, "VM resume");
 	const agentDir = resolveVmAgentDir(config);
 	const guestWorkspace = path.resolve(config.mountPath);
-	const guestCredentialMode = config.guestCredentialMode ?? "guest-config";
-	if (guestCredentialMode === "guest-config" && !existsSync(agentDir)) throw new Error(`Agent directory not found: ${agentDir}. Run: moltnet register --name ${config.agentName}`);
 	assertGuestEnvironmentBoundary({
-		guestCredentialMode,
 		forwardEnv: config.forwardEnv,
 		sandboxEnv: config.sandboxConfig?.env
 	});
 	config.onDiagnostic?.({
 		event: "vm.credentials.mode",
 		level: "info",
-		credentialMode: guestCredentialMode,
-		message: guestCredentialMode === "host-authenticated" ? "MoltNet agent files and non-allowlisted host environment variables are withheld from the guest" : "The complete MoltNet agent configuration is available to the guest"
+		message: "MoltNet agent files and non-allowlisted host environment variables are withheld from the guest"
 	});
-	const creds = loadCredentials(agentDir, guestCredentialMode, config.onDiagnostic, config.providerAuth);
-	const configuredApiUrl = creds.moltnetJson ? JSON.parse(creds.moltnetJson).endpoints.api : void 0;
-	const apiHost = new URL(configuredApiUrl ?? process.env.MOLTNET_API_URL ?? DEFAULT_MOLTNET_API_URL).hostname;
+	const creds = loadCredentials();
+	const apiHost = new URL(process.env.MOLTNET_API_URL ?? DEFAULT_MOLTNET_API_URL).hostname;
 	const runtimeAllowedHosts = config.sandboxConfig?.network?.allowedHosts ?? [];
 	const runtimeAllowedInternalHosts = config.sandboxConfig?.network?.allowedInternalHosts ?? [];
 	const protectedExternalHosts = [...new Set([
@@ -806,9 +966,14 @@ async function resumeVm(config) {
 	])];
 	assertInternalHostsDoNotOverlapProtectedHosts(runtimeAllowedInternalHosts, protectedExternalHosts);
 	const allowedHosts = [...new Set([...protectedExternalHosts, ...runtimeAllowedHosts])];
+	const hostOrigins = config.hostOrigins ?? {};
+	const hostOriginHosts = hostOriginHostnames(hostOrigins);
+	assertInternalHostsDoNotOverlapProtectedHosts(hostOriginHosts, protectedExternalHosts);
+	const allowedInternalHosts = [...new Set([...runtimeAllowedInternalHosts, ...hostOriginHosts])];
+	const projectedEnv = config.guestProjection?.env ?? {};
 	const brokeredSecrets = prepareBrokeredHttpSecrets({
 		bindings: config.brokeredSecrets,
-		allowedHosts: [...allowedHosts, ...runtimeAllowedInternalHosts],
+		allowedHosts: [...allowedHosts, ...allowedInternalHosts],
 		occupiedGuestEnvNames: [
 			"PATH",
 			"HOME",
@@ -817,17 +982,28 @@ async function resumeVm(config) {
 			"MOLTNET_GUEST_WORKSPACE",
 			...config.forwardEnv ?? [],
 			...Object.keys(creds.agentEnv),
-			...Object.keys(config.sandboxConfig?.env ?? {})
+			...Object.keys(config.sandboxConfig?.env ?? {}),
+			...Object.keys(projectedEnv)
 		]
 	});
 	const brokeredSecretOriginPolicy = createBrokeredHttpSecretOriginPolicy(config.brokeredSecrets ?? []);
+	const brokeredNetworkOriginPolicy = createBrokeredHttpNetworkOriginPolicy(config.brokeredSecrets ?? [], { onDenied(origin) {
+		config.onDiagnostic?.({
+			event: "vm.network.origin_denied",
+			level: "warning",
+			message: "denied request outside a brokered credential origin",
+			origin
+		});
+	} });
 	const { httpHooks, env: secretEnv, secretManager: gondolinSecretManager } = createHttpHooks({
 		allowedHosts,
-		allowedInternalHosts: runtimeAllowedInternalHosts,
+		allowedInternalHosts,
 		...Object.keys(brokeredSecrets).length > 0 && {
 			secrets: brokeredSecrets,
-			isRequestAllowed: brokeredSecretOriginPolicy.isRequestAllowed
-		}
+			isRequestAllowed: (request) => brokeredNetworkOriginPolicy.isRequestAllowed(request) && brokeredSecretOriginPolicy.isRequestAllowed(request),
+			isIpAllowed: brokeredNetworkOriginPolicy.isIpAllowed
+		},
+		...hostOriginHosts.length > 0 && { onRequest: createHostOriginsOnRequest(hostOrigins) }
 	});
 	const secretManager = Object.freeze({
 		rotateSecret(guestEnv, value) {
@@ -843,19 +1019,15 @@ async function resumeVm(config) {
 	if (brokeredSecretCount > 0) config.onDiagnostic?.({
 		event: "vm.http_secrets.bound",
 		level: "info",
-		credentialMode: guestCredentialMode,
 		brokeredSecretCount,
 		message: `Bound ${brokeredSecretCount} HTTP secret placeholder${brokeredSecretCount === 1 ? "" : "s"} to the host proxy`
 	});
-	const vmAgentDir = `/home/agent/.moltnet/${config.agentName}`;
-	const vmAgentEnv = {};
-	for (const [k, v] of Object.entries(creds.agentEnv)) {
-		if (v === void 0 || v === "") continue;
-		if (k === "GIT_CONFIG_GLOBAL") vmAgentEnv[k] = `${vmAgentDir}/gitconfig`;
-		else if (k.endsWith("_PRIVATE_KEY_PATH")) vmAgentEnv[k] = `${vmAgentDir}/${path.basename(v)}`;
-		else vmAgentEnv[k] = v;
-	}
-	if (creds.moltnetJson) vmAgentEnv.MOLTNET_CREDENTIALS_PATH = `${vmAgentDir}/moltnet.json`;
+	if (hostOriginHosts.length > 0) config.onDiagnostic?.({
+		event: "vm.host_origins.bound",
+		level: "info",
+		hostOriginCount: hostOriginHosts.length,
+		message: `Bound ${hostOriginHosts.length} host origin${hostOriginHosts.length === 1 ? "" : "s"} to the host proxy`
+	});
 	const vfsConfig = resolveVfsShadowConfig(config.sandboxConfig);
 	let workspaceProvider = new RealFSProvider(config.mountPath);
 	workspaceProvider = new ShadowProvider(workspaceProvider, {
@@ -871,7 +1043,7 @@ async function resumeVm(config) {
 			writeMode: vfsConfig.mode
 		});
 	}
-	if (guestCredentialMode === "host-authenticated") workspaceProvider = new ShadowProvider(workspaceProvider, {
+	workspaceProvider = new ShadowProvider(workspaceProvider, {
 		shouldShadow: ({ path: shadowPath }) => shadowPath.split("/").includes(".moltnet"),
 		denySymlinkBypass: true,
 		writeMode: "deny"
@@ -884,7 +1056,6 @@ async function resumeVm(config) {
 	}
 	const envOverrides = config.sandboxConfig?.env ?? {};
 	const vmEnv = {
-		...vmAgentEnv,
 		...forwardedEnv,
 		PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/lib/go/bin",
 		HOME: "/home/agent",
@@ -892,7 +1063,8 @@ async function resumeVm(config) {
 		NODE_EXTRA_CA_CERTS: "/etc/ssl/certs/ca-certificates.crt",
 		...envOverrides,
 		MOLTNET_GUEST_WORKSPACE: guestWorkspace,
-		...secretEnv
+		...secretEnv,
+		...projectedEnv
 	};
 	const resources = config.sandboxConfig?.resources;
 	const workspaceMode = config.workspaceMode ?? "shared_mount";
@@ -915,6 +1087,27 @@ async function resumeVm(config) {
 			process.stderr.write(`[vm] aborted resume late vm.close() failed: ${message}\n`);
 		}
 	});
+	const servicesAbort = new AbortController();
+	const serviceHandles = [];
+	const serviceIds = [];
+	const services = { async stop() {
+		if (serviceIds.length > 0) {
+			const pidFiles = serviceIds.map((id) => `${GUEST_SERVICE_PID_DIR}/${id}.pid`).join(" ");
+			try {
+				await vm.exec([
+					"sh",
+					"-c",
+					`for f in ${pidFiles}; do [ -f "$f" ] || continue; pid=$(cat "$f"); kill -TERM -- "-\$pid" 2>/dev/null || kill -TERM "\$pid" 2>/dev/null || true; done; sleep 0.2; for f in ${pidFiles}; do [ -f "$f" ] || continue; pid=$(cat "$f"); kill -KILL -- "-\$pid" 2>/dev/null || kill -KILL "\$pid" 2>/dev/null || true; rm -f "\$f"; done`
+				], {
+					stdout: "ignore",
+					stderr: "ignore"
+				});
+			} catch {}
+			serviceIds.length = 0;
+		}
+		servicesAbort.abort();
+		await Promise.allSettled(serviceHandles);
+	} };
 	try {
 		await vmRun(vm, "TLS certificates", `
     cp /etc/gondolin/mitm/ca.crt /usr/local/share/ca-certificates/gondolin-mitm.crt
@@ -947,59 +1140,92 @@ async function resumeVm(config) {
 			}
 			if (lastErr) throw lastErr instanceof Error ? lastErr : new Error(nonErrorMessage(lastErr));
 		}
-		const vmSshDir = `${vmAgentDir}/ssh`;
-		const hasAgentFiles = guestCredentialMode === "guest-config";
-		const providerAuthDir = config.providerAuth ? path.posix.dirname(config.providerAuth.guestPath) : null;
-		const guestDirs = [...hasAgentFiles ? [`${vmAgentDir}/ssh`] : [], ...providerAuthDir ? [providerAuthDir] : []];
-		if (guestDirs.length > 0) await vm.exec(`mkdir -p ${guestDirs.join(" ")}`, { signal: config.signal });
-		if (creds.providerAuthJson !== null && config.providerAuth) await vm.fs.writeFile(config.providerAuth.guestPath, creds.providerAuthJson, {
-			mode: 384,
-			signal: config.signal
-		});
-		if (hasAgentFiles) {
-			const vmMoltnetJson = rewriteMoltnetJsonPaths(creds.moltnetJson, vmAgentDir, vmSshDir, creds.githubAppPemFilename);
-			await vm.fs.writeFile(`${vmAgentDir}/moltnet.json`, vmMoltnetJson, {
-				mode: 384,
+		const projectedFiles = config.guestProjection?.files ?? [];
+		const projectedDirs = [...new Set(projectedFiles.map((file) => path.posix.dirname(file.path)))];
+		const guestDirs = [...projectedDirs];
+		if (guestDirs.length > 0) await vmRun(vm, "create guest directories", `mkdir -p ${guestDirs.map(shellQuote).join(" ")}`, config.signal);
+		for (const file of projectedFiles) {
+			await vm.fs.writeFile(file.path, file.content, {
+				mode: file.mode ?? 420,
 				signal: config.signal
 			});
-			await vm.fs.writeFile(`${vmAgentDir}/env`, creds.agentEnvRaw, {
-				mode: 384,
-				signal: config.signal
+			if (file.mode !== void 0) await vmRun(vm, `chmod projected file ${file.path}`, `chmod ${file.mode.toString(8)} ${shellQuote(file.path)}`, config.signal);
+		}
+		await vmRun(vm, "chown guest directories", `set -e; for d in ${projectedDirs.filter((dir) => dir.startsWith("/home/agent/")).map(shellQuote).join(" ")}; do if [ -e "$d" ]; then chown -R agent:agent "$d"; fi; done`, config.signal);
+		const projectedServices = config.guestProjection?.services ?? [];
+		if (projectedServices.length > 0) await vmRun(vm, "create service pid directory", `mkdir -p ${GUEST_SERVICE_PID_DIR}`, config.signal);
+		for (const service of projectedServices) {
+			assertGuestServiceId(service.id);
+			const handle = vm.exec([
+				"setsid",
+				"sh",
+				"-c",
+				`echo $$ > ${GUEST_SERVICE_PID_DIR}/${service.id}.pid && exec "$@"`,
+				"moltnet-service",
+				...service.command
+			], {
+				stdout: "ignore",
+				stderr: "ignore",
+				...service.env && { env: service.env },
+				signal: servicesAbort.signal
 			});
-			if (creds.gitconfig) {
-				const vmGitconfig = rewriteGitconfigPaths(creds.gitconfig, vmSshDir, vmAgentDir);
-				await vm.fs.writeFile(`${vmAgentDir}/gitconfig`, vmGitconfig, {
-					mode: 420,
+			serviceHandles.push(Promise.resolve(handle).catch(() => void 0));
+			serviceIds.push(service.id);
+		}
+		async function awaitServiceReady(service) {
+			if (!service.readiness) return;
+			const deadline = Date.now() + (service.readiness.timeoutMs ?? 1e4);
+			const pidFile = `${GUEST_SERVICE_PID_DIR}/${service.id}.pid`;
+			let ready = false;
+			while (Date.now() < deadline) {
+				throwIfAborted(config.signal, `service "${service.id}" readiness`);
+				if ((await vm.exec([
+					"sh",
+					"-c",
+					"[ -e \"$1\" ] && [ -r \"$2\" ] && kill -0 \"$(cat \"$2\" 2>/dev/null)\" 2>/dev/null",
+					"moltnet-readiness",
+					service.readiness.path,
+					pidFile
+				], {
+					stdout: "ignore",
+					stderr: "ignore",
 					signal: config.signal
+				})).exitCode === 0) {
+					ready = true;
+					break;
+				}
+				await new Promise((resolve) => {
+					setTimeout(resolve, 200);
+				});
+			}
+			if (!ready) {
+				if (service.readiness.required) throw new Error(`Projected guest service "${service.id}" did not become ready: ${service.readiness.path} absent or its process exited`);
+				config.onDiagnostic?.({
+					event: "vm.guest_service.not_ready",
+					level: "warning",
+					message: `Projected guest service "${service.id}" did not become ready (${service.readiness.path} absent or its process exited); continuing without it`
 				});
 			}
-			if (creds.sshPrivateKey) await vm.fs.writeFile(`${vmSshDir}/id_ed25519`, creds.sshPrivateKey, {
-				mode: 384,
-				signal: config.signal
-			});
-			if (creds.sshPublicKey) await vm.fs.writeFile(`${vmSshDir}/id_ed25519.pub`, creds.sshPublicKey, {
-				mode: 420,
-				signal: config.signal
-			});
-			if (creds.allowedSigners) await vm.fs.writeFile(`${vmSshDir}/allowed_signers`, creds.allowedSigners, {
-				mode: 420,
-				signal: config.signal
-			});
-			if (creds.githubAppPem && creds.githubAppPemFilename) await vm.fs.writeFile(`${vmAgentDir}/${creds.githubAppPemFilename}`, creds.githubAppPem, {
-				mode: 384,
-				signal: config.signal
-			});
 		}
-		await vm.exec(hasAgentFiles ? "chown -R agent:agent /home/agent/.pi /home/agent/.moltnet" : "chown -R agent:agent /home/agent/.pi", { signal: config.signal });
+		await Promise.all(projectedServices.map((service) => awaitServiceReady(service)));
+		if (projectedFiles.length > 0 || projectedServices.length > 0) config.onDiagnostic?.({
+			event: "vm.guest_projection.applied",
+			level: "info",
+			projectedFileCount: projectedFiles.length,
+			projectedServiceCount: projectedServices.length,
+			message: `Applied guest projection: ${projectedFiles.length} file(s), ${projectedServices.length} service(s)`
+		});
 		return {
 			vm,
 			credentials: creds,
 			secretManager,
+			services,
 			mountPath: config.mountPath,
 			guestWorkspace,
 			agentDir
 		};
 	} catch (err) {
+		servicesAbort.abort();
 		try {
 			await vm.close();
 		} catch (closeErr) {
@@ -1009,66 +1235,5 @@ async function resumeVm(config) {
 		throw err;
 	}
 }
-/**
-* Rewrite host-absolute paths inside an agent gitconfig to VM-local
-* equivalents before injecting it into the guest.
-*
-* Two rewrites:
-*   - `signingKey = <host path>`  → `<vmSshDir>/id_ed25519`
-*   - `... credential-helper --credentials <host moltnet.json>`
-*                                 → `<vmAgentDir>/moltnet.json`
-*
-* The credential-helper line is generated host-side by `moltnet github setup`
-* with a host-absolute `--credentials` path; inside the guest that path is
-* invalid, so it must point at the VM-side moltnet.json. The `insteadOf`
-* rewrite rule and every other line are workspace-independent and pass through
-* unchanged. A gitconfig without a credential helper is rewritten only for
-* `signingKey`.
-*
-* This is the single source of truth for git push auth in the guest: the
-* injected gitconfig carries the tokenless mint-on-demand helper, so the VM
-* no longer hand-rolls a credential-helper script or runs an imperative
-* `git config --global ... insteadOf` against the guest $HOME.
-*/
-function rewriteGitconfigPaths(gitconfig, vmSshDir, vmAgentDir) {
-	return gitconfig.replace(/signingKey\s*=\s*.+/g, `signingKey = ${vmSshDir}/id_ed25519`).replace(/(moltnet github credential-helper --credentials )\S+/g, `$1${vmAgentDir}/moltnet.json`);
-}
-/**
-* Rewrite host-absolute paths inside moltnet.json to VM-local equivalents.
-*
-* Fields rewritten:
-*   ssh.private_key_path  → <vmSshDir>/<basename of original>
-*   ssh.public_key_path   → <vmSshDir>/<basename of original>
-*   git.config_path       → <vmAgentDir>/gitconfig
-*   github.private_key_path → <vmAgentDir>/<pemFilename>  (if present)
-*
-* All other fields are passed through unchanged.
-* Throws if moltnetJson is not valid JSON — callers must not inject a broken
-* moltnet.json into the guest.
-*/
-function rewriteMoltnetJsonPaths(moltnetJson, vmAgentDir, vmSshDir, githubAppPemFilename) {
-	const config = JSON.parse(moltnetJson);
-	if (config.ssh && typeof config.ssh === "object") {
-		const ssh = config.ssh;
-		const origPrivate = typeof ssh.private_key_path === "string" ? ssh.private_key_path : null;
-		const origPublic = typeof ssh.public_key_path === "string" ? ssh.public_key_path : null;
-		config.ssh = {
-			...ssh,
-			...origPrivate !== null && { private_key_path: `${vmSshDir}/${path.basename(origPrivate)}` },
-			...origPublic !== null && { public_key_path: `${vmSshDir}/${path.basename(origPublic)}` }
-		};
-	}
-	if (config.git && typeof config.git === "object") {
-		const git = { ...config.git };
-		git.config_path = `${vmAgentDir}/gitconfig`;
-		config.git = git;
-	}
-	if (githubAppPemFilename && config.github && typeof config.github === "object") {
-		const github = { ...config.github };
-		github.private_key_path = `${vmAgentDir}/${githubAppPemFilename}`;
-		config.github = github;
-	}
-	return JSON.stringify(config);
-}
 //#endregion
-export { AutoParentMemoryProvider, BrokeredHttpSecretBoundaryError, GONDOLIN_BASE_EXECUTABLES, GUEST_TASK_CONTEXT_MOUNT, GUEST_TASK_SKILLS_MOUNT, GuestEnvironmentBoundaryError, abortableResource, activateAgentEnv, assertGuestEnvironmentBoundary, assertHostAuthenticatedGuestEnvironment, canonicalizeBrokeredHttpSecretDescriptor, delay, ensureSnapshot, findMainWorktree, isResolvedPathInsideRoot, loadCredentials, prepareBrokeredHttpSecrets, resolveVfsShadowConfig, resolveVmAgentDir, resumeVm, rewriteGitconfigPaths, rewriteMoltnetJsonPaths, shouldRunResumeCommand, shouldShadowNodeModulesPath, throwIfAborted };
+export { AutoParentMemoryProvider, BrokeredHttpSecretBoundaryError, GONDOLIN_BASE_EXECUTABLES, GUEST_SERVICE_PID_DIR, GUEST_TASK_CONTEXT_MOUNT, GUEST_TASK_SKILLS_MOUNT, GuestEnvironmentBoundaryError, abortableResource, activateAgentEnv, assertGuestEnvironmentBoundary, assertHostAuthenticatedGuestEnvironment, canonicalizeBrokeredHttpSecretDescriptor, createBrokeredHttpNetworkOriginPolicy, delay, ensureSnapshot, execManagedCommand, findMainWorktree, isResolvedPathInsideRoot, loadCredentials, prepareBrokeredHttpSecrets, resolveVfsShadowConfig, resolveVmAgentDir, resumeVm, shouldRunResumeCommand, shouldShadowNodeModulesPath, throwIfAborted };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/sandbox-gondolin",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "Gondolin microVM sandbox lifecycle for MoltNet runtimes: checkpoint resume, egress policy, VFS shadowing, guest credential boundary, host-brokered secrets",
   "keywords": [
     "moltnet",
@@ -47,7 +47,7 @@
     }
   },
   "dependencies": {
-    "@earendil-works/gondolin": "^0.9.1"
+    "@earendil-works/gondolin": "^0.12.0"
   },
   "devDependencies": {
     "@types/node": "^22.19.0",