@themoltnet/sandbox-gondolin 0.3.0 → 0.4.0

package/README.md

@@ -14,10 +14,9 @@ implementation can be added beside it without going through Pi.
   with VFS shadowing (`deny` / `tmpfs`), egress allowlist through Gondolin's
   host-side HTTP hooks, explicit guest environment, resource limits, resume
   commands, and abort-safe cleanup.
-- The guest credential boundary: `guest-config` injects the complete
-  `.moltnet/<agent>` tree; `host-authenticated` withholds it and refuses
-  `MOLTNET_*` names in runtime-controlled guest environment
-  (`assertGuestEnvironmentBoundary`).
+- The guest credential boundary: the guest never receives the
+  `.moltnet/<agent>` tree, and `MOLTNET_*` names are refused in
+  runtime-controlled guest environment (`assertGuestEnvironmentBoundary`).
 - `VmConfig.brokeredSecrets` — host-brokered secrets: the guest sees a
   placeholder, Gondolin's `SecretManager` substitutes the value only in
   requests to the declared protocol, host patterns, and ports.
@@ -27,10 +26,10 @@ implementation can be added beside it without going through Pi.
 
 ## What it deliberately does not own
 
-- **Provider authentication.** A runtime supplies `VmConfig.providerAuth`
-  (`{ load(): string | null; guestPath }`); the sandbox only carries the blob
-  across the boundary. Pi's `~/.pi/agent/auth.json` handling lives in
-  `@themoltnet/pi-runtime` (`piProviderAuth`, and its `resumeVm` wrapper).
+- **Provider authentication.** The coding-agent session and its model calls run
+  host-side (Pi's `createAgentSession` reads the host `~/.pi/agent` auth), so no
+  provider auth is projected into the guest — the guest only executes tools via
+  `vm.exec`.
 - Tool definitions, tool policy, task execution, workspace preparation —
   all Pi-runtime concerns.
 
@@ -54,7 +53,6 @@ contain a value or choose a host secret-provider coordinate.
 const managed = await resumeVm({
   checkpointPath,
   agentName: 'worker',
-  guestCredentialMode: 'host-authenticated',
   mountPath: workspace,
   sandboxConfig: {
     network: { allowedHosts: ['api.example.com'] },

package/dist/index.d.ts

@@ -1,3 +1,4 @@
+import { HttpIpAllowInfo } from '@earendil-works/gondolin';
 import { MemoryProvider } from '@earendil-works/gondolin';
 import { SecretDefinition } from '@earendil-works/gondolin';
 import { VirtualFileHandle } from '@earendil-works/gondolin';
@@ -20,12 +21,11 @@ declare interface AbortableResourceOptions<T> {
 export declare function activateAgentEnv(agentEnv: Record<string, string | undefined>, repoRoot: string): void;
 
 export declare function assertGuestEnvironmentBoundary(options: {
-    guestCredentialMode: GuestCredentialMode;
     forwardEnv?: readonly string[];
     sandboxEnv?: Readonly<Record<string, string>>;
 }): void;
 
-/** @deprecated Prefer assertGuestEnvironmentBoundary for mode-aware checks. */
+/** @deprecated Alias of assertGuestEnvironmentBoundary (a single boundary). */
 export declare function assertHostAuthenticatedGuestEnvironment(options: {
     forwardEnv?: readonly string[];
     sandboxEnv?: Readonly<Record<string, string>>;
@@ -85,6 +85,20 @@ export declare interface BrokeredHttpSecretManager {
  */
 export declare function canonicalizeBrokeredHttpSecretDescriptor(descriptor: BrokeredHttpSecretDescriptor): Required<BrokeredHttpSecretDescriptor>;
 
+/**
+ * Refine Gondolin's hostname allowlist for hosts carrying brokered
+ * credentials. The built-in allowlist is hostname-granular; these callbacks
+ * enforce the descriptor protocol and port before request or IP dispatch.
+ */
+export declare function createBrokeredHttpNetworkOriginPolicy(bindings: readonly BrokeredHttpSecretDescriptor[], options?: {
+    onDenied?: (denial: RequestOrigin & {
+        phase: 'request' | 'ip';
+    }) => void;
+}): {
+    isRequestAllowed: (request: Request) => boolean;
+    isIpAllowed: (info: HttpIpAllowInfo) => boolean;
+};
+
 export declare function delay(ms: number, signal: AbortSignal | undefined, label: string): Promise<void>;
 
 /**
@@ -100,6 +114,14 @@ export declare interface EnsureSnapshotOptions {
     maxCached?: number;
 }
 
+/**
+ * Execute one login-shell command in a Gondolin VM. Successful commands may
+ * reuse the VM. Timeout or cancellation retires the complete VM through the
+ * host API before returning, because no guest process/session boundary can
+ * prove containment against daemonization or a guest-mutated root filesystem.
+ */
+export declare function execManagedCommand(vm: VM, command: string, options?: ManagedExecOptions): Promise<ManagedExecResult>;
+
 /**
  * Resolve the main worktree root (where .moltnet/ lives — it's untracked,
  * only exists in the main worktree, not in git worktrees).
@@ -137,8 +159,6 @@ export declare const GUEST_TASK_CONTEXT_MOUNT = "/moltnet-task-context";
 /** @deprecated Use GUEST_TASK_CONTEXT_MOUNT. */
 export declare const GUEST_TASK_SKILLS_MOUNT = "/moltnet-task-context";
 
-export declare type GuestCredentialMode = 'guest-config' | 'host-authenticated';
-
 export declare class GuestEnvironmentBoundaryError extends Error {
     readonly refusedNames: readonly string[];
     constructor(refusedNames: readonly string[]);
@@ -187,7 +207,43 @@ declare type HostOriginHandler = (request: Request) => Promise<Response>;
  */
 export declare function isResolvedPathInsideRoot(path: string, root: string): boolean;
 
-export declare function loadCredentials(agentDir: string, mode?: GuestCredentialMode, onDiagnostic?: (diagnostic: VmDiagnostic) => void, providerAuth?: ProviderAuthSource): VmCredentials;
+export declare function loadCredentials(): VmCredentials;
+
+export declare interface ManagedExecDiagnostic {
+    event: 'managed_exec.backend_retirement';
+    trigger: 'cancellation' | 'timeout';
+    outcome: 'started' | 'succeeded' | 'failed';
+    message: string;
+}
+
+export declare interface ManagedExecOptions {
+    cwd?: string;
+    env?: Record<string, string>;
+    signal?: AbortSignal;
+    timeoutMs?: number;
+    onData?: (data: Buffer, stream: 'stdout' | 'stderr') => void;
+    onDiagnostic?: (diagnostic: ManagedExecDiagnostic) => void;
+    onStarted?: () => void;
+}
+
+export declare interface ManagedExecResult {
+    exitCode: number;
+    timedOut: boolean;
+    cancelled: boolean;
+    termination: ManagedExecTermination;
+}
+
+export declare type ManagedExecTermination = {
+    status: 'not-required';
+} | {
+    status: 'not-started';
+} | {
+    status: 'backend-retired';
+    mode: 'vm-close';
+} | {
+    status: 'recovery-required';
+    reason: 'backend-retirement-failed';
+};
 
 export declare interface ManagedVm {
     vm: VM;
@@ -211,11 +267,10 @@ export declare function prepareBrokeredHttpSecrets(options: {
     occupiedGuestEnvNames?: readonly string[];
 }): Record<string, SecretDefinition>;
 
-export declare interface ProviderAuthSource {
-    /** Read the auth blob from the host, or return null when absent. */
-    load(): string | null;
-    /** Absolute guest path to write the blob to (mode 0600). */
-    guestPath: string;
+declare interface RequestOrigin {
+    hostname: string;
+    protocol: string;
+    port: number;
 }
 
 export declare function resolveVfsShadowConfig(config: SandboxConfig | undefined): {
@@ -259,44 +314,6 @@ export declare interface ResumeCommandWhen {
  */
 export declare function resumeVm(config: VmConfig): Promise<ManagedVm>;
 
-/**
- * Rewrite host-absolute paths inside an agent gitconfig to VM-local
- * equivalents before injecting it into the guest.
- *
- * Two rewrites:
- *   - `signingKey = <host path>`  → `<vmSshDir>/id_ed25519`
- *   - `... credential-helper --credentials <host moltnet.json>`
- *                                 → `<vmAgentDir>/moltnet.json`
- *
- * The credential-helper line is generated host-side by `moltnet github setup`
- * with a host-absolute `--credentials` path; inside the guest that path is
- * invalid, so it must point at the VM-side moltnet.json. The `insteadOf`
- * rewrite rule and every other line are workspace-independent and pass through
- * unchanged. A gitconfig without a credential helper is rewritten only for
- * `signingKey`.
- *
- * This is the single source of truth for git push auth in the guest: the
- * injected gitconfig carries the tokenless mint-on-demand helper, so the VM
- * no longer hand-rolls a credential-helper script or runs an imperative
- * `git config --global ... insteadOf` against the guest $HOME.
- */
-export declare function rewriteGitconfigPaths(gitconfig: string, vmSshDir: string, vmAgentDir: string): string;
-
-/**
- * Rewrite host-absolute paths inside moltnet.json to VM-local equivalents.
- *
- * Fields rewritten:
- *   ssh.private_key_path  → <vmSshDir>/<basename of original>
- *   ssh.public_key_path   → <vmSshDir>/<basename of original>
- *   git.config_path       → <vmAgentDir>/gitconfig
- *   github.private_key_path → <vmAgentDir>/<pemFilename>  (if present)
- *
- * All other fields are passed through unchanged.
- * Throws if moltnetJson is not valid JSON — callers must not inject a broken
- * moltnet.json into the guest.
- */
-export declare function rewriteMoltnetJsonPaths(moltnetJson: string, vmAgentDir: string, vmSshDir: string, githubAppPemFilename: string | null): string;
-
 export declare interface SandboxConfig {
     /**
      * Operator-owned snapshot build settings. Runtime profiles must never
@@ -386,12 +403,6 @@ export declare interface VmConfig {
     checkpointPath: string;
     /** MoltNet agent name (used to resolve credentials). */
     agentName: string;
-    /**
-     * Trust boundary for guest credentials. `guest-config` injects the complete
-     * legacy agent directory. `host-authenticated` never reads or injects it and
-     * relies exclusively on the supplied host-side Agent for MoltNet operations.
-     */
-    guestCredentialMode?: GuestCredentialMode;
     /**
      * Host root that owns `.moltnet/<agentName>/`.
      *
@@ -438,43 +449,21 @@ export declare interface VmConfig {
     onDiagnostic?: (diagnostic: VmDiagnostic) => void;
     /** Abort resume/setup work, closing any live VM owned by resumeVm. */
     signal?: AbortSignal;
-    /**
-     * Coding-agent provider authentication to place in the guest (for example
-     * Pi's `auth.json`). The sandbox knows nothing about the provider: the
-     * runtime above it supplies the loader and the guest path. When omitted,
-     * nothing is written and the guest relies on forwarded env providers.
-     */
-    providerAuth?: ProviderAuthSource;
 }
 
 export declare interface VmCredentials {
-    /** Empty in host-authenticated mode; retained as strings for API stability. */
-    moltnetJson: string;
-    /** Empty in host-authenticated mode; retained as strings for API stability. */
-    agentEnvRaw: string;
     /**
-     * Provider auth blob supplied by `VmConfig.providerAuth`, or null when the
-     * runtime supplied none or the host file is absent — the guest then relies
-     * on env-var providers (`ANTHROPIC_API_KEY`, etc.) carried via `agentEnv`
-     * and the forwarded host environment instead. CI uses this path.
+     * Guest env carried across the boundary. Always empty: the guest receives no
+     * MoltNet credential material. Retained for API stability and because
+     * consumers read (empty) provider/diary/team hints from it.
      */
-    providerAuthJson: string | null;
     agentEnv: Record<string, string | undefined>;
-    gitconfig: string | null;
-    sshPrivateKey: string | null;
-    sshPublicKey: string | null;
-    allowedSigners: string | null;
-    /** Raw PEM content of the GitHub App private key, or null if not configured. */
-    githubAppPem: string | null;
-    /** VM-local filename for the GitHub App PEM (basename of host path), or null. */
-    githubAppPemFilename: string | null;
 }
 
 export declare interface VmDiagnostic {
-    event: 'vm.credentials.mode' | 'vm.credentials.github_key_missing' | 'vm.http_secrets.bound' | 'vm.host_origins.bound' | 'vm.guest_projection.applied' | 'vm.guest_service.not_ready';
+    event: 'vm.credentials.mode' | 'vm.http_secrets.bound' | 'vm.host_origins.bound' | 'vm.guest_projection.applied' | 'vm.guest_service.not_ready' | 'vm.network.origin_denied';
     level: 'info' | 'warning';
     message: string;
-    credentialMode: GuestCredentialMode;
     /** Present only for the value-free broker summary event. */
     brokeredSecretCount?: number;
     /** Present only for the host-origins summary event. */
@@ -482,6 +471,13 @@ export declare interface VmDiagnostic {
     /** Present only for the guest-projection summary event. */
     projectedFileCount?: number;
     projectedServiceCount?: number;
+    /** Present only for an exact-origin denial event. */
+    origin?: {
+        hostname: string;
+        protocol: string;
+        port: number;
+        phase: 'request' | 'ip';
+    };
 }
 
 export { }

package/dist/index.js

@@ -1,9 +1,9 @@
 import path, { isAbsolute, relative } from "node:path";
 import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync } from "node:fs";
+import { existsSync, mkdirSync, readdirSync, rmSync, statSync } from "node:fs";
 import { MemoryProvider, RealFSProvider, ShadowProvider, VM, VmCheckpoint, createHttpHooks, createShadowPathPredicate, ensureImageSelector, isWriteFlag, loadGuestAssets } from "@earendil-works/gondolin";
-import { parseEnv } from "node:util";
+import { isIP } from "node:net";
 //#region src/abort-utils.ts
 function throwIfAborted(signal, label) {
 	if (!signal?.aborted) return;
@@ -61,6 +61,138 @@ async function delay(ms, signal, label) {
 	});
 }
 //#endregion
+//#region src/managed-exec.ts
+function chunkBuffer(data) {
+	if (Buffer.isBuffer(data)) return data;
+	return typeof data === "string" ? Buffer.from(data, "utf8") : Buffer.from(data);
+}
+async function retireBackend(vm, trigger, onDiagnostic) {
+	onDiagnostic?.({
+		event: "managed_exec.backend_retirement",
+		trigger,
+		outcome: "started",
+		message: "retiring Gondolin VM after interrupted guest execution"
+	});
+	try {
+		await vm.close();
+		onDiagnostic?.({
+			event: "managed_exec.backend_retirement",
+			trigger,
+			outcome: "succeeded",
+			message: "Gondolin VM retirement completed"
+		});
+		return {
+			status: "backend-retired",
+			mode: "vm-close"
+		};
+	} catch (error) {
+		onDiagnostic?.({
+			event: "managed_exec.backend_retirement",
+			trigger,
+			outcome: "failed",
+			message: error instanceof Error ? `Gondolin VM retirement failed: ${error.message}` : "Gondolin VM retirement failed"
+		});
+		return {
+			status: "recovery-required",
+			reason: "backend-retirement-failed"
+		};
+	}
+}
+/**
+* Execute one login-shell command in a Gondolin VM. Successful commands may
+* reuse the VM. Timeout or cancellation retires the complete VM through the
+* host API before returning, because no guest process/session boundary can
+* prove containment against daemonization or a guest-mutated root filesystem.
+*/
+async function execManagedCommand(vm, command, options = {}) {
+	if (options.signal?.aborted) return {
+		exitCode: 130,
+		timedOut: false,
+		cancelled: true,
+		termination: { status: "not-started" }
+	};
+	const controller = new AbortController();
+	let timedOut = false;
+	let cancelled = false;
+	let executionSettled = false;
+	let acceptOutput = true;
+	let resolveInterrupted;
+	let retirementPromise;
+	const interrupted = new Promise((resolve) => {
+		resolveInterrupted = resolve;
+	});
+	const interrupt = (trigger) => {
+		if (executionSettled || retirementPromise) return;
+		acceptOutput = false;
+		controller.abort(/* @__PURE__ */ new Error(`guest command interrupted by ${trigger}`));
+		retirementPromise = retireBackend(vm, trigger, options.onDiagnostic);
+		resolveInterrupted?.();
+	};
+	const onAbort = () => {
+		cancelled = true;
+		interrupt("cancellation");
+	};
+	options.signal?.addEventListener("abort", onAbort, { once: true });
+	const timer = options.timeoutMs !== void 0 && options.timeoutMs > 0 ? setTimeout(() => {
+		timedOut = true;
+		interrupt("timeout");
+	}, options.timeoutMs) : void 0;
+	timer?.unref();
+	try {
+		const process = vm.exec([
+			"/bin/sh",
+			"-lc",
+			command
+		], {
+			cwd: options.cwd,
+			env: options.env,
+			signal: controller.signal,
+			stdout: "pipe",
+			stderr: "pipe"
+		});
+		options.onStarted?.();
+		const execution = (async () => {
+			for await (const chunk of process.output()) {
+				if (!acceptOutput) continue;
+				options.onData?.(chunkBuffer(chunk.data), chunk.stream);
+			}
+			return process;
+		})();
+		const observedExecution = execution.then((result) => {
+			executionSettled = true;
+			return {
+				kind: "result",
+				result
+			};
+		}, (error) => {
+			executionSettled = true;
+			return {
+				kind: "error",
+				error
+			};
+		});
+		const first = await Promise.race([observedExecution, interrupted.then(() => ({ kind: "interrupted" }))]);
+		if (first.kind === "result" && !timedOut && !cancelled) return {
+			exitCode: first.result.exitCode,
+			timedOut: false,
+			cancelled: false,
+			termination: { status: "not-required" }
+		};
+		if (first.kind === "error" && !timedOut && !cancelled) throw first.error;
+		execution.catch(() => void 0);
+		const termination = await (retirementPromise ??= retireBackend(vm, timedOut ? "timeout" : "cancellation", options.onDiagnostic));
+		return {
+			exitCode: timedOut ? 124 : 130,
+			timedOut,
+			cancelled: cancelled && !timedOut,
+			termination
+		};
+	} finally {
+		if (timer) clearTimeout(timer);
+		options.signal?.removeEventListener("abort", onAbort);
+	}
+}
+//#endregion
 //#region src/path-containment.ts
 /**
 * Check containment for already-resolved lexical or real paths.
@@ -432,59 +564,8 @@ function resolveVmAgentDir(config) {
 	const rootDir = config.agentRootDir ?? findMainWorktree();
 	return path.join(rootDir, ".moltnet", config.agentName);
 }
-function loadCredentials(agentDir, mode = "guest-config", onDiagnostic, providerAuth) {
-	const moltnetPath = path.join(agentDir, "moltnet.json");
-	const agentEnvPath = path.join(agentDir, "env");
-	const providerAuthJson = providerAuth?.load() ?? null;
-	if (mode === "host-authenticated") return {
-		moltnetJson: "",
-		agentEnvRaw: "",
-		providerAuthJson,
-		agentEnv: {},
-		gitconfig: null,
-		sshPrivateKey: null,
-		sshPublicKey: null,
-		allowedSigners: null,
-		githubAppPem: null,
-		githubAppPemFilename: null
-	};
-	const hasMoltnetJson = existsSync(moltnetPath);
-	const hasAgentEnv = existsSync(agentEnvPath);
-	if (!hasMoltnetJson || !hasAgentEnv) throw new Error(`Guest credential mode requires both ${moltnetPath} and ${agentEnvPath}`);
-	const moltnetJson = readFileSync(moltnetPath, "utf8");
-	const agentEnvRaw = readFileSync(agentEnvPath, "utf8");
-	if (moltnetJson.trim() === "") throw new Error(`Agent configuration is empty: ${moltnetPath}`);
-	const gitconfigPath = path.join(agentDir, "gitconfig");
-	const gitconfig = existsSync(gitconfigPath) ? readFileSync(gitconfigPath, "utf8") : null;
-	const sshDir = path.join(agentDir, "ssh");
-	const sshPrivateKey = existsSync(path.join(sshDir, "id_ed25519")) ? readFileSync(path.join(sshDir, "id_ed25519"), "utf8") : null;
-	const sshPublicKey = existsSync(path.join(sshDir, "id_ed25519.pub")) ? readFileSync(path.join(sshDir, "id_ed25519.pub"), "utf8") : null;
-	const allowedSigners = existsSync(path.join(sshDir, "allowed_signers")) ? readFileSync(path.join(sshDir, "allowed_signers"), "utf8") : null;
-	let githubAppPem = null;
-	let githubAppPemFilename = null;
-	const pemPath = (moltnetJson ? JSON.parse(moltnetJson) : null)?.github?.private_key_path;
-	if (pemPath) if (!existsSync(pemPath)) onDiagnostic?.({
-		event: "vm.credentials.github_key_missing",
-		level: "warning",
-		credentialMode: mode,
-		message: `github.private_key_path not found at ${pemPath}; moltnet github token will fail inside the guest`
-	});
-	else {
-		githubAppPem = readFileSync(pemPath, "utf8");
-		githubAppPemFilename = path.basename(pemPath);
-	}
-	return {
-		moltnetJson,
-		agentEnvRaw,
-		providerAuthJson,
-		agentEnv: parseEnv(agentEnvRaw),
-		gitconfig,
-		sshPrivateKey,
-		sshPublicKey,
-		allowedSigners,
-		githubAppPem,
-		githubAppPemFilename
-	};
+function loadCredentials() {
+	return { agentEnv: {} };
 }
 /**
 * Apply agent env vars to the host process, mirroring `moltnet start`.
@@ -580,9 +661,13 @@ var OBJECT_META_PROPERTY_NAMES = new Set([
 	"prototype"
 ]);
 function normalizeHostPattern(pattern) {
-	return pattern.trim().toLowerCase();
+	let normalized = pattern.trim().toLowerCase();
+	if (normalized.startsWith("[") && normalized.endsWith("]")) normalized = normalized.slice(1, -1);
+	if (normalized.endsWith(".")) normalized = normalized.slice(0, -1);
+	return normalized;
 }
 function isValidHostPattern(pattern) {
+	if (isIP(pattern) !== 0) return true;
 	return pattern !== "" && !pattern.includes("://") && !pattern.includes("/") && !pattern.includes(":") && !/\s/.test(pattern);
 }
 /**
@@ -617,8 +702,8 @@ function canonicalizeBrokeredHttpSecretDescriptor(descriptor) {
 	});
 }
 function hostMatchesPattern(hostname, pattern) {
-	const expression = pattern.split("*").map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join(".*");
-	return new RegExp(`^${expression}$`, "i").test(hostname);
+	const expression = normalizeHostPattern(pattern).split("*").map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join(".*");
+	return new RegExp(`^${expression}$`, "i").test(normalizeHostPattern(hostname));
 }
 /**
 * Conservative subset check for Gondolin hostname globs. Exact secret hosts
@@ -690,6 +775,19 @@ function headersContainSecretValue(headers, value) {
 	}
 	return false;
 }
+function parseRequestOrigin(url) {
+	try {
+		const parsed = new URL(url);
+		const protocol = parsed.protocol.slice(0, -1);
+		return {
+			hostname: normalizeHostPattern(parsed.hostname),
+			protocol,
+			port: parsed.port ? Number(parsed.port) : protocol === "https" ? 443 : 80
+		};
+	} catch {
+		return null;
+	}
+}
 function createBrokeredHttpSecretOriginPolicy(bindings) {
 	const entries = /* @__PURE__ */ new Map();
 	for (const binding of bindings) {
@@ -706,17 +804,11 @@ function createBrokeredHttpSecretOriginPolicy(bindings) {
 	}
 	return {
 		isRequestAllowed(request) {
-			let url;
-			try {
-				url = new URL(request.url);
-			} catch {
-				return false;
-			}
-			const protocol = url.protocol.slice(0, -1);
-			const port = url.port ? Number(url.port) : protocol === "https" ? 443 : 80;
+			const requestOrigin = parseRequestOrigin(request.url);
+			if (!requestOrigin) return false;
 			for (const entry of entries.values()) {
 				if (entry.deleted || !headersContainSecretValue(request.headers, entry.value)) continue;
-				if (protocol !== entry.protocol || !entry.ports.includes(port) || !entry.hosts.some((host) => hostMatchesPattern(url.hostname, host))) return false;
+				if (requestOrigin.protocol !== entry.protocol || !entry.ports.includes(requestOrigin.port) || !entry.hosts.some((host) => hostMatchesPattern(requestOrigin.hostname, host))) return false;
 			}
 			return true;
 		},
@@ -733,18 +825,51 @@ function createBrokeredHttpSecretOriginPolicy(bindings) {
 		}
 	};
 }
+/**
+* Refine Gondolin's hostname allowlist for hosts carrying brokered
+* credentials. The built-in allowlist is hostname-granular; these callbacks
+* enforce the descriptor protocol and port before request or IP dispatch.
+*/
+function createBrokeredHttpNetworkOriginPolicy(bindings, options = {}) {
+	const origins = bindings.map(canonicalizeBrokeredHttpSecretDescriptor);
+	const isAllowed = (input) => {
+		const hostname = normalizeHostPattern(input.hostname);
+		const matching = origins.filter((origin) => origin.hosts.some((host) => hostMatchesPattern(hostname, host)));
+		if (matching.length === 0) return true;
+		const allowed = matching.some((origin) => origin.protocol === input.protocol && origin.ports.includes(input.port));
+		if (!allowed) options.onDenied?.({
+			hostname,
+			protocol: input.protocol,
+			port: input.port,
+			phase: input.phase
+		});
+		return allowed;
+	};
+	return {
+		isRequestAllowed(request) {
+			const requestOrigin = parseRequestOrigin(request.url);
+			return requestOrigin ? isAllowed({
+				...requestOrigin,
+				phase: "request"
+			}) : false;
+		},
+		isIpAllowed(info) {
+			return isAllowed({
+				...info,
+				phase: "ip"
+			});
+		}
+	};
+}
 function assertGuestEnvironmentBoundary(options) {
-	const refusedForwardEnv = (options.forwardEnv ?? []).filter((name) => isReservedGuestEnvironmentName(name) || options.guestCredentialMode === "host-authenticated" && !HOST_AUTHENTICATED_GUEST_ENV_ALLOWLIST.has(name));
+	const refusedForwardEnv = (options.forwardEnv ?? []).filter((name) => isReservedGuestEnvironmentName(name) || !HOST_AUTHENTICATED_GUEST_ENV_ALLOWLIST.has(name));
 	const refusedSandboxEnv = Object.keys(options.sandboxEnv ?? {}).filter(isReservedGuestEnvironmentName);
 	const refused = [...new Set([...refusedForwardEnv, ...refusedSandboxEnv])].sort();
 	if (refused.length > 0) throw new GuestEnvironmentBoundaryError(refused);
 }
-/** @deprecated Prefer assertGuestEnvironmentBoundary for mode-aware checks. */
+/** @deprecated Alias of assertGuestEnvironmentBoundary (a single boundary). */
 function assertHostAuthenticatedGuestEnvironment(options) {
-	assertGuestEnvironmentBoundary({
-		guestCredentialMode: "host-authenticated",
-		...options
-	});
+	assertGuestEnvironmentBoundary(options);
 }
 /**
 * Return whether two Gondolin hostname globs can match at least one common
@@ -821,22 +946,17 @@ async function resumeVm(config) {
 	throwIfAborted(config.signal, "VM resume");
 	const agentDir = resolveVmAgentDir(config);
 	const guestWorkspace = path.resolve(config.mountPath);
-	const guestCredentialMode = config.guestCredentialMode ?? "guest-config";
-	if (guestCredentialMode === "guest-config" && !existsSync(agentDir)) throw new Error(`Agent directory not found: ${agentDir}. Run: moltnet register --name ${config.agentName}`);
 	assertGuestEnvironmentBoundary({
-		guestCredentialMode,
 		forwardEnv: config.forwardEnv,
 		sandboxEnv: config.sandboxConfig?.env
 	});
 	config.onDiagnostic?.({
 		event: "vm.credentials.mode",
 		level: "info",
-		credentialMode: guestCredentialMode,
-		message: guestCredentialMode === "host-authenticated" ? "MoltNet agent files and non-allowlisted host environment variables are withheld from the guest" : "The complete MoltNet agent configuration is available to the guest"
+		message: "MoltNet agent files and non-allowlisted host environment variables are withheld from the guest"
 	});
-	const creds = loadCredentials(agentDir, guestCredentialMode, config.onDiagnostic, config.providerAuth);
-	const configuredApiUrl = creds.moltnetJson ? JSON.parse(creds.moltnetJson).endpoints.api : void 0;
-	const apiHost = new URL(configuredApiUrl ?? process.env.MOLTNET_API_URL ?? DEFAULT_MOLTNET_API_URL).hostname;
+	const creds = loadCredentials();
+	const apiHost = new URL(process.env.MOLTNET_API_URL ?? DEFAULT_MOLTNET_API_URL).hostname;
 	const runtimeAllowedHosts = config.sandboxConfig?.network?.allowedHosts ?? [];
 	const runtimeAllowedInternalHosts = config.sandboxConfig?.network?.allowedInternalHosts ?? [];
 	const protectedExternalHosts = [...new Set([
@@ -867,12 +987,21 @@ async function resumeVm(config) {
 		]
 	});
 	const brokeredSecretOriginPolicy = createBrokeredHttpSecretOriginPolicy(config.brokeredSecrets ?? []);
+	const brokeredNetworkOriginPolicy = createBrokeredHttpNetworkOriginPolicy(config.brokeredSecrets ?? [], { onDenied(origin) {
+		config.onDiagnostic?.({
+			event: "vm.network.origin_denied",
+			level: "warning",
+			message: "denied request outside a brokered credential origin",
+			origin
+		});
+	} });
 	const { httpHooks, env: secretEnv, secretManager: gondolinSecretManager } = createHttpHooks({
 		allowedHosts,
 		allowedInternalHosts,
 		...Object.keys(brokeredSecrets).length > 0 && {
 			secrets: brokeredSecrets,
-			isRequestAllowed: brokeredSecretOriginPolicy.isRequestAllowed
+			isRequestAllowed: (request) => brokeredNetworkOriginPolicy.isRequestAllowed(request) && brokeredSecretOriginPolicy.isRequestAllowed(request),
+			isIpAllowed: brokeredNetworkOriginPolicy.isIpAllowed
 		},
 		...hostOriginHosts.length > 0 && { onRequest: createHostOriginsOnRequest(hostOrigins) }
 	});
@@ -890,26 +1019,15 @@ async function resumeVm(config) {
 	if (brokeredSecretCount > 0) config.onDiagnostic?.({
 		event: "vm.http_secrets.bound",
 		level: "info",
-		credentialMode: guestCredentialMode,
 		brokeredSecretCount,
 		message: `Bound ${brokeredSecretCount} HTTP secret placeholder${brokeredSecretCount === 1 ? "" : "s"} to the host proxy`
 	});
 	if (hostOriginHosts.length > 0) config.onDiagnostic?.({
 		event: "vm.host_origins.bound",
 		level: "info",
-		credentialMode: guestCredentialMode,
 		hostOriginCount: hostOriginHosts.length,
 		message: `Bound ${hostOriginHosts.length} host origin${hostOriginHosts.length === 1 ? "" : "s"} to the host proxy`
 	});
-	const vmAgentDir = `/home/agent/.moltnet/${config.agentName}`;
-	const vmAgentEnv = {};
-	for (const [k, v] of Object.entries(creds.agentEnv)) {
-		if (v === void 0 || v === "") continue;
-		if (k === "GIT_CONFIG_GLOBAL") vmAgentEnv[k] = `${vmAgentDir}/gitconfig`;
-		else if (k.endsWith("_PRIVATE_KEY_PATH")) vmAgentEnv[k] = `${vmAgentDir}/${path.basename(v)}`;
-		else vmAgentEnv[k] = v;
-	}
-	if (creds.moltnetJson) vmAgentEnv.MOLTNET_CREDENTIALS_PATH = `${vmAgentDir}/moltnet.json`;
 	const vfsConfig = resolveVfsShadowConfig(config.sandboxConfig);
 	let workspaceProvider = new RealFSProvider(config.mountPath);
 	workspaceProvider = new ShadowProvider(workspaceProvider, {
@@ -925,7 +1043,7 @@ async function resumeVm(config) {
 			writeMode: vfsConfig.mode
 		});
 	}
-	if (guestCredentialMode === "host-authenticated") workspaceProvider = new ShadowProvider(workspaceProvider, {
+	workspaceProvider = new ShadowProvider(workspaceProvider, {
 		shouldShadow: ({ path: shadowPath }) => shadowPath.split("/").includes(".moltnet"),
 		denySymlinkBypass: true,
 		writeMode: "deny"
@@ -938,7 +1056,6 @@ async function resumeVm(config) {
 	}
 	const envOverrides = config.sandboxConfig?.env ?? {};
 	const vmEnv = {
-		...vmAgentEnv,
 		...forwardedEnv,
 		PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/lib/go/bin",
 		HOME: "/home/agent",
@@ -1023,55 +1140,10 @@ async function resumeVm(config) {
 			}
 			if (lastErr) throw lastErr instanceof Error ? lastErr : new Error(nonErrorMessage(lastErr));
 		}
-		const vmSshDir = `${vmAgentDir}/ssh`;
-		const hasAgentFiles = guestCredentialMode === "guest-config";
-		const providerAuthDir = config.providerAuth ? path.posix.dirname(config.providerAuth.guestPath) : null;
 		const projectedFiles = config.guestProjection?.files ?? [];
 		const projectedDirs = [...new Set(projectedFiles.map((file) => path.posix.dirname(file.path)))];
-		const guestDirs = [
-			...hasAgentFiles ? [`${vmAgentDir}/ssh`] : [],
-			...providerAuthDir ? [providerAuthDir] : [],
-			...projectedDirs
-		];
+		const guestDirs = [...projectedDirs];
 		if (guestDirs.length > 0) await vmRun(vm, "create guest directories", `mkdir -p ${guestDirs.map(shellQuote).join(" ")}`, config.signal);
-		if (creds.providerAuthJson !== null && config.providerAuth) await vm.fs.writeFile(config.providerAuth.guestPath, creds.providerAuthJson, {
-			mode: 384,
-			signal: config.signal
-		});
-		if (hasAgentFiles) {
-			const vmMoltnetJson = rewriteMoltnetJsonPaths(creds.moltnetJson, vmAgentDir, vmSshDir, creds.githubAppPemFilename);
-			await vm.fs.writeFile(`${vmAgentDir}/moltnet.json`, vmMoltnetJson, {
-				mode: 384,
-				signal: config.signal
-			});
-			await vm.fs.writeFile(`${vmAgentDir}/env`, creds.agentEnvRaw, {
-				mode: 384,
-				signal: config.signal
-			});
-			if (creds.gitconfig) {
-				const vmGitconfig = rewriteGitconfigPaths(creds.gitconfig, vmSshDir, vmAgentDir);
-				await vm.fs.writeFile(`${vmAgentDir}/gitconfig`, vmGitconfig, {
-					mode: 420,
-					signal: config.signal
-				});
-			}
-			if (creds.sshPrivateKey) await vm.fs.writeFile(`${vmSshDir}/id_ed25519`, creds.sshPrivateKey, {
-				mode: 384,
-				signal: config.signal
-			});
-			if (creds.sshPublicKey) await vm.fs.writeFile(`${vmSshDir}/id_ed25519.pub`, creds.sshPublicKey, {
-				mode: 420,
-				signal: config.signal
-			});
-			if (creds.allowedSigners) await vm.fs.writeFile(`${vmSshDir}/allowed_signers`, creds.allowedSigners, {
-				mode: 420,
-				signal: config.signal
-			});
-			if (creds.githubAppPem && creds.githubAppPemFilename) await vm.fs.writeFile(`${vmAgentDir}/${creds.githubAppPemFilename}`, creds.githubAppPem, {
-				mode: 384,
-				signal: config.signal
-			});
-		}
 		for (const file of projectedFiles) {
 			await vm.fs.writeFile(file.path, file.content, {
 				mode: file.mode ?? 420,
@@ -1079,11 +1151,7 @@ async function resumeVm(config) {
 			});
 			if (file.mode !== void 0) await vmRun(vm, `chmod projected file ${file.path}`, `chmod ${file.mode.toString(8)} ${shellQuote(file.path)}`, config.signal);
 		}
-		await vmRun(vm, "chown guest directories", `set -e; for d in ${[
-			"/home/agent/.pi",
-			...hasAgentFiles ? ["/home/agent/.moltnet"] : [],
-			...projectedDirs.filter((dir) => dir.startsWith("/home/agent/"))
-		].map(shellQuote).join(" ")}; do if [ -e "$d" ]; then chown -R agent:agent "$d"; fi; done`, config.signal);
+		await vmRun(vm, "chown guest directories", `set -e; for d in ${projectedDirs.filter((dir) => dir.startsWith("/home/agent/")).map(shellQuote).join(" ")}; do if [ -e "$d" ]; then chown -R agent:agent "$d"; fi; done`, config.signal);
 		const projectedServices = config.guestProjection?.services ?? [];
 		if (projectedServices.length > 0) await vmRun(vm, "create service pid directory", `mkdir -p ${GUEST_SERVICE_PID_DIR}`, config.signal);
 		for (const service of projectedServices) {
@@ -1135,7 +1203,6 @@ async function resumeVm(config) {
 				config.onDiagnostic?.({
 					event: "vm.guest_service.not_ready",
 					level: "warning",
-					credentialMode: guestCredentialMode,
 					message: `Projected guest service "${service.id}" did not become ready (${service.readiness.path} absent or its process exited); continuing without it`
 				});
 			}
@@ -1144,7 +1211,6 @@ async function resumeVm(config) {
 		if (projectedFiles.length > 0 || projectedServices.length > 0) config.onDiagnostic?.({
 			event: "vm.guest_projection.applied",
 			level: "info",
-			credentialMode: guestCredentialMode,
 			projectedFileCount: projectedFiles.length,
 			projectedServiceCount: projectedServices.length,
 			message: `Applied guest projection: ${projectedFiles.length} file(s), ${projectedServices.length} service(s)`
@@ -1169,66 +1235,5 @@ async function resumeVm(config) {
 		throw err;
 	}
 }
-/**
-* Rewrite host-absolute paths inside an agent gitconfig to VM-local
-* equivalents before injecting it into the guest.
-*
-* Two rewrites:
-*   - `signingKey = <host path>`  → `<vmSshDir>/id_ed25519`
-*   - `... credential-helper --credentials <host moltnet.json>`
-*                                 → `<vmAgentDir>/moltnet.json`
-*
-* The credential-helper line is generated host-side by `moltnet github setup`
-* with a host-absolute `--credentials` path; inside the guest that path is
-* invalid, so it must point at the VM-side moltnet.json. The `insteadOf`
-* rewrite rule and every other line are workspace-independent and pass through
-* unchanged. A gitconfig without a credential helper is rewritten only for
-* `signingKey`.
-*
-* This is the single source of truth for git push auth in the guest: the
-* injected gitconfig carries the tokenless mint-on-demand helper, so the VM
-* no longer hand-rolls a credential-helper script or runs an imperative
-* `git config --global ... insteadOf` against the guest $HOME.
-*/
-function rewriteGitconfigPaths(gitconfig, vmSshDir, vmAgentDir) {
-	return gitconfig.replace(/signingKey\s*=\s*.+/g, `signingKey = ${vmSshDir}/id_ed25519`).replace(/(moltnet github credential-helper --credentials )\S+/g, `$1${vmAgentDir}/moltnet.json`);
-}
-/**
-* Rewrite host-absolute paths inside moltnet.json to VM-local equivalents.
-*
-* Fields rewritten:
-*   ssh.private_key_path  → <vmSshDir>/<basename of original>
-*   ssh.public_key_path   → <vmSshDir>/<basename of original>
-*   git.config_path       → <vmAgentDir>/gitconfig
-*   github.private_key_path → <vmAgentDir>/<pemFilename>  (if present)
-*
-* All other fields are passed through unchanged.
-* Throws if moltnetJson is not valid JSON — callers must not inject a broken
-* moltnet.json into the guest.
-*/
-function rewriteMoltnetJsonPaths(moltnetJson, vmAgentDir, vmSshDir, githubAppPemFilename) {
-	const config = JSON.parse(moltnetJson);
-	if (config.ssh && typeof config.ssh === "object") {
-		const ssh = config.ssh;
-		const origPrivate = typeof ssh.private_key_path === "string" ? ssh.private_key_path : null;
-		const origPublic = typeof ssh.public_key_path === "string" ? ssh.public_key_path : null;
-		config.ssh = {
-			...ssh,
-			...origPrivate !== null && { private_key_path: `${vmSshDir}/${path.basename(origPrivate)}` },
-			...origPublic !== null && { public_key_path: `${vmSshDir}/${path.basename(origPublic)}` }
-		};
-	}
-	if (config.git && typeof config.git === "object") {
-		const git = { ...config.git };
-		git.config_path = `${vmAgentDir}/gitconfig`;
-		config.git = git;
-	}
-	if (githubAppPemFilename && config.github && typeof config.github === "object") {
-		const github = { ...config.github };
-		github.private_key_path = `${vmAgentDir}/${githubAppPemFilename}`;
-		config.github = github;
-	}
-	return JSON.stringify(config);
-}
 //#endregion
-export { AutoParentMemoryProvider, BrokeredHttpSecretBoundaryError, GONDOLIN_BASE_EXECUTABLES, GUEST_SERVICE_PID_DIR, GUEST_TASK_CONTEXT_MOUNT, GUEST_TASK_SKILLS_MOUNT, GuestEnvironmentBoundaryError, abortableResource, activateAgentEnv, assertGuestEnvironmentBoundary, assertHostAuthenticatedGuestEnvironment, canonicalizeBrokeredHttpSecretDescriptor, delay, ensureSnapshot, findMainWorktree, isResolvedPathInsideRoot, loadCredentials, prepareBrokeredHttpSecrets, resolveVfsShadowConfig, resolveVmAgentDir, resumeVm, rewriteGitconfigPaths, rewriteMoltnetJsonPaths, shouldRunResumeCommand, shouldShadowNodeModulesPath, throwIfAborted };
+export { AutoParentMemoryProvider, BrokeredHttpSecretBoundaryError, GONDOLIN_BASE_EXECUTABLES, GUEST_SERVICE_PID_DIR, GUEST_TASK_CONTEXT_MOUNT, GUEST_TASK_SKILLS_MOUNT, GuestEnvironmentBoundaryError, abortableResource, activateAgentEnv, assertGuestEnvironmentBoundary, assertHostAuthenticatedGuestEnvironment, canonicalizeBrokeredHttpSecretDescriptor, createBrokeredHttpNetworkOriginPolicy, delay, ensureSnapshot, execManagedCommand, findMainWorktree, isResolvedPathInsideRoot, loadCredentials, prepareBrokeredHttpSecrets, resolveVfsShadowConfig, resolveVmAgentDir, resumeVm, shouldRunResumeCommand, shouldShadowNodeModulesPath, throwIfAborted };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/sandbox-gondolin",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Gondolin microVM sandbox lifecycle for MoltNet runtimes: checkpoint resume, egress policy, VFS shadowing, guest credential boundary, host-brokered secrets",
   "keywords": [
     "moltnet",
@@ -47,7 +47,7 @@
     }
   },
   "dependencies": {
-    "@earendil-works/gondolin": "^0.9.1"
+    "@earendil-works/gondolin": "^0.12.0"
   },
   "devDependencies": {
     "@types/node": "^22.19.0",