spawnfile 0.1.1 → 0.1.3

package/dist/manifest/surfaceSchemas.d.ts

@@ -48,6 +48,9 @@ declare const discordSurfaceSchema: z.ZodObject<{
         users: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>;
     bot_token_secret: z.ZodOptional<z.ZodString>;
+    identity: z.ZodOptional<z.ZodObject<{
+        user_id: z.ZodString;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
 declare const telegramSurfaceSchema: z.ZodObject<{
     access: z.ZodOptional<z.ZodObject<{
@@ -60,6 +63,10 @@ declare const telegramSurfaceSchema: z.ZodObject<{
         users: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>;
     bot_token_secret: z.ZodOptional<z.ZodString>;
+    identity: z.ZodOptional<z.ZodObject<{
+        user_id: z.ZodOptional<z.ZodString>;
+        username: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
 declare const whatsappSurfaceSchema: z.ZodObject<{
     access: z.ZodOptional<z.ZodObject<{
@@ -71,6 +78,9 @@ declare const whatsappSurfaceSchema: z.ZodObject<{
         }>>;
         users: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>;
+    identity: z.ZodOptional<z.ZodObject<{
+        phone: z.ZodString;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
 declare const slackSurfaceSchema: z.ZodObject<{
     access: z.ZodOptional<z.ZodObject<{
@@ -84,7 +94,98 @@ declare const slackSurfaceSchema: z.ZodObject<{
     }, z.core.$strict>>;
     app_token_secret: z.ZodOptional<z.ZodString>;
     bot_token_secret: z.ZodOptional<z.ZodString>;
+    identity: z.ZodOptional<z.ZodObject<{
+        user_id: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+declare const webhookSurfaceSchema: z.ZodObject<{
+    signing_secret: z.ZodOptional<z.ZodString>;
+    url: z.ZodString;
+}, z.core.$strict>;
+declare const moltnetReadSchema: z.ZodEnum<{
+    all: "all";
+    mentions: "mentions";
+    thread_only: "thread_only";
+}>;
+declare const moltnetReplySchema: z.ZodEnum<{
+    never: "never";
+    auto: "auto";
+}>;
+declare const moltnetRoomBehaviorSchema: z.ZodObject<{
+    read: z.ZodOptional<z.ZodEnum<{
+        all: "all";
+        mentions: "mentions";
+        thread_only: "thread_only";
+    }>>;
+    reply: z.ZodOptional<z.ZodEnum<{
+        never: "never";
+        auto: "auto";
+    }>>;
+}, z.core.$strict>;
+declare const moltnetDmSchema: z.ZodObject<{
+    enabled: z.ZodBoolean;
+    read: z.ZodOptional<z.ZodEnum<{
+        all: "all";
+        mentions: "mentions";
+        thread_only: "thread_only";
+    }>>;
+    reply: z.ZodOptional<z.ZodEnum<{
+        never: "never";
+        auto: "auto";
+    }>>;
+}, z.core.$strict>;
+declare const moltnetAttachmentSchema: z.ZodObject<{
+    dms: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodBoolean;
+        read: z.ZodOptional<z.ZodEnum<{
+            all: "all";
+            mentions: "mentions";
+            thread_only: "thread_only";
+        }>>;
+        reply: z.ZodOptional<z.ZodEnum<{
+            never: "never";
+            auto: "auto";
+        }>>;
+    }, z.core.$strict>>;
+    network: z.ZodString;
+    rooms: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        read: z.ZodOptional<z.ZodEnum<{
+            all: "all";
+            mentions: "mentions";
+            thread_only: "thread_only";
+        }>>;
+        reply: z.ZodOptional<z.ZodEnum<{
+            never: "never";
+            auto: "auto";
+        }>>;
+    }, z.core.$strict>>>;
 }, z.core.$strict>;
+declare const moltnetSurfaceSchema: z.ZodArray<z.ZodObject<{
+    dms: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodBoolean;
+        read: z.ZodOptional<z.ZodEnum<{
+            all: "all";
+            mentions: "mentions";
+            thread_only: "thread_only";
+        }>>;
+        reply: z.ZodOptional<z.ZodEnum<{
+            never: "never";
+            auto: "auto";
+        }>>;
+    }, z.core.$strict>>;
+    network: z.ZodString;
+    rooms: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        read: z.ZodOptional<z.ZodEnum<{
+            all: "all";
+            mentions: "mentions";
+            thread_only: "thread_only";
+        }>>;
+        reply: z.ZodOptional<z.ZodEnum<{
+            never: "never";
+            auto: "auto";
+        }>>;
+    }, z.core.$strict>>>;
+}, z.core.$strict>>;
 export declare const surfacesSchema: z.ZodObject<{
     discord: z.ZodOptional<z.ZodObject<{
         access: z.ZodOptional<z.ZodObject<{
@@ -98,7 +199,36 @@ export declare const surfacesSchema: z.ZodObject<{
             users: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$strict>>;
         bot_token_secret: z.ZodOptional<z.ZodString>;
+        identity: z.ZodOptional<z.ZodObject<{
+            user_id: z.ZodString;
+        }, z.core.$strict>>;
     }, z.core.$strict>>;
+    moltnet: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        dms: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodBoolean;
+            read: z.ZodOptional<z.ZodEnum<{
+                all: "all";
+                mentions: "mentions";
+                thread_only: "thread_only";
+            }>>;
+            reply: z.ZodOptional<z.ZodEnum<{
+                never: "never";
+                auto: "auto";
+            }>>;
+        }, z.core.$strict>>;
+        network: z.ZodString;
+        rooms: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            read: z.ZodOptional<z.ZodEnum<{
+                all: "all";
+                mentions: "mentions";
+                thread_only: "thread_only";
+            }>>;
+            reply: z.ZodOptional<z.ZodEnum<{
+                never: "never";
+                auto: "auto";
+            }>>;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>>>;
     slack: z.ZodOptional<z.ZodObject<{
         access: z.ZodOptional<z.ZodObject<{
             channels: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -111,6 +241,9 @@ export declare const surfacesSchema: z.ZodObject<{
         }, z.core.$strict>>;
         app_token_secret: z.ZodOptional<z.ZodString>;
         bot_token_secret: z.ZodOptional<z.ZodString>;
+        identity: z.ZodOptional<z.ZodObject<{
+            user_id: z.ZodString;
+        }, z.core.$strict>>;
     }, z.core.$strict>>;
     telegram: z.ZodOptional<z.ZodObject<{
         access: z.ZodOptional<z.ZodObject<{
@@ -123,6 +256,14 @@ export declare const surfacesSchema: z.ZodObject<{
             users: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$strict>>;
         bot_token_secret: z.ZodOptional<z.ZodString>;
+        identity: z.ZodOptional<z.ZodObject<{
+            user_id: z.ZodOptional<z.ZodString>;
+            username: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    webhook: z.ZodOptional<z.ZodObject<{
+        signing_secret: z.ZodOptional<z.ZodString>;
+        url: z.ZodString;
     }, z.core.$strict>>;
     whatsapp: z.ZodOptional<z.ZodObject<{
         access: z.ZodOptional<z.ZodObject<{
@@ -134,14 +275,27 @@ export declare const surfacesSchema: z.ZodObject<{
             }>>;
             users: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$strict>>;
+        identity: z.ZodOptional<z.ZodObject<{
+            phone: z.ZodString;
+        }, z.core.$strict>>;
     }, z.core.$strict>>;
 }, z.core.$strict>;
 export type DiscordSurfaceAccess = z.infer<typeof discordSurfaceAccessSchema>;
 export type DiscordSurface = z.infer<typeof discordSurfaceSchema>;
+export type HttpSurfaceAccess = never;
+export type HttpSurfaceAuth = never;
+export type HttpSurface = never;
+export type MoltnetAttachment = z.infer<typeof moltnetAttachmentSchema>;
+export type MoltnetDM = z.infer<typeof moltnetDmSchema>;
+export type MoltnetRead = z.infer<typeof moltnetReadSchema>;
+export type MoltnetReply = z.infer<typeof moltnetReplySchema>;
+export type MoltnetRoomBehavior = z.infer<typeof moltnetRoomBehaviorSchema>;
+export type MoltnetSurface = z.infer<typeof moltnetSurfaceSchema>;
 export type SlackSurfaceAccess = z.infer<typeof slackSurfaceAccessSchema>;
 export type SlackSurface = z.infer<typeof slackSurfaceSchema>;
 export type TelegramSurfaceAccess = z.infer<typeof telegramSurfaceAccessSchema>;
 export type TelegramSurface = z.infer<typeof telegramSurfaceSchema>;
+export type WebhookSurface = z.infer<typeof webhookSurfaceSchema>;
 export type WhatsAppSurfaceAccess = z.infer<typeof whatsappSurfaceAccessSchema>;
 export type WhatsAppSurface = z.infer<typeof whatsappSurfaceSchema>;
 export type SurfacesBlock = z.infer<typeof surfacesSchema>;

package/dist/manifest/surfaceSchemas.js

@@ -120,40 +120,112 @@ const slackSurfaceAccessSchema = z
         });
     }
 });
+const userIdIdentitySchema = z
+    .object({
+    user_id: z.string().min(1)
+})
+    .strict();
+const telegramIdentitySchema = z
+    .object({
+    user_id: z.string().min(1).optional(),
+    username: z.string().min(1).optional()
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (!value.user_id && !value.username) {
+        context.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "telegram identity must declare user_id or username"
+        });
+    }
+});
+const whatsappIdentitySchema = z
+    .object({
+    phone: z.string().min(1)
+})
+    .strict();
 const discordSurfaceSchema = z
     .object({
     access: discordSurfaceAccessSchema.optional(),
-    bot_token_secret: z.string().min(1).optional()
+    bot_token_secret: z.string().min(1).optional(),
+    identity: userIdIdentitySchema.optional()
 })
     .strict();
 const telegramSurfaceSchema = z
     .object({
     access: telegramSurfaceAccessSchema.optional(),
-    bot_token_secret: z.string().min(1).optional()
+    bot_token_secret: z.string().min(1).optional(),
+    identity: telegramIdentitySchema.optional()
 })
     .strict();
 const whatsappSurfaceSchema = z
     .object({
-    access: whatsappSurfaceAccessSchema.optional()
+    access: whatsappSurfaceAccessSchema.optional(),
+    identity: whatsappIdentitySchema.optional()
 })
     .strict();
 const slackSurfaceSchema = z
     .object({
     access: slackSurfaceAccessSchema.optional(),
     app_token_secret: z.string().min(1).optional(),
-    bot_token_secret: z.string().min(1).optional()
+    bot_token_secret: z.string().min(1).optional(),
+    identity: userIdIdentitySchema.optional()
 })
     .strict();
+const webhookSurfaceSchema = z
+    .object({
+    signing_secret: z.string().min(1).optional(),
+    url: z.string().url()
+})
+    .strict();
+const moltnetReadSchema = z.enum(["all", "mentions", "thread_only"]);
+const moltnetReplySchema = z.enum(["auto", "never"]);
+const moltnetRoomBehaviorSchema = z
+    .object({
+    read: moltnetReadSchema.optional(),
+    reply: moltnetReplySchema.optional()
+})
+    .strict();
+const moltnetDmSchema = z
+    .object({
+    enabled: z.boolean(),
+    read: moltnetReadSchema.optional(),
+    reply: moltnetReplySchema.optional()
+})
+    .strict();
+const moltnetAttachmentSchema = z
+    .object({
+    dms: moltnetDmSchema.optional(),
+    network: z.string().min(1),
+    rooms: z.record(z.string().min(1), moltnetRoomBehaviorSchema).optional()
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (!value.rooms && !value.dms) {
+        context.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "moltnet attachments must declare rooms or dms"
+        });
+    }
+});
+const moltnetSurfaceSchema = z.array(moltnetAttachmentSchema).min(1);
 export const surfacesSchema = z
     .object({
     discord: discordSurfaceSchema.optional(),
+    moltnet: moltnetSurfaceSchema.optional(),
     slack: slackSurfaceSchema.optional(),
     telegram: telegramSurfaceSchema.optional(),
+    webhook: webhookSurfaceSchema.optional(),
     whatsapp: whatsappSurfaceSchema.optional()
 })
     .strict()
     .superRefine((value, context) => {
-    if (!value.discord && !value.telegram && !value.whatsapp && !value.slack) {
+    if (!value.discord &&
+        !value.moltnet &&
+        !value.telegram &&
+        !value.whatsapp &&
+        !value.slack &&
+        !value.webhook) {
         context.addIssue({
             code: z.ZodIssueCode.custom,
             message: "surfaces must declare at least one surface"

package/dist/runtime/common.js

@@ -47,6 +47,9 @@ export const createAgentCapabilities = (node, options = {}) => {
     if (node.surfaces?.discord) {
         capabilities.push(createCapability("surfaces.discord", "supported"));
     }
+    if (node.surfaces?.moltnet) {
+        capabilities.push(createCapability("surfaces.moltnet", "supported"));
+    }
     if (node.surfaces?.telegram) {
         capabilities.push(createCapability("surfaces.telegram", "supported"));
     }

package/dist/runtime/openclaw/adapter.js

@@ -4,6 +4,7 @@ import { SpawnfileError } from "../../shared/index.js";
 import { prepareOpenClawRuntimeAuth } from "./runAuth.js";
 import { createOpenClawAgentScaffold } from "./scaffold.js";
 import { assertSupportedOpenClawSurfaces, buildOpenClawChannelConfig, buildOpenClawSurfaceEnvBindings } from "./surfaces.js";
+import { buildOpenClawMoltnetConfig, buildOpenClawMoltnetEnvBindings, validateOpenClawMoltnetRuntimeOptions } from "./moltnet.js";
 const buildEnvSecretRef = (envName) => ({
     id: envName,
     provider: "default",
@@ -53,7 +54,7 @@ const buildOpenClawConfig = (node) => {
             auth: {
                 mode: "token"
             },
-            bind: "lan",
+            bind: "loopback",
             controlUi: {
                 allowedOrigins: [
                     "http://127.0.0.1:<gateway-port>",
@@ -64,6 +65,14 @@ const buildOpenClawConfig = (node) => {
             port: "<gateway-port>"
         }
     };
+    if ((node.surfaces?.moltnet?.length ?? 0) > 0) {
+        config.hooks = {
+            allowRequestSessionKey: true,
+            allowedSessionKeyPrefixes: ["hook:"],
+            enabled: true,
+            token: "${OPENCLAW_HOOKS_TOKEN}"
+        };
+    }
     const channels = buildOpenClawChannelConfig(node.surfaces);
     if (Object.keys(channels).length > 0) {
         config.channels = channels;
@@ -73,6 +82,10 @@ const buildOpenClawConfig = (node) => {
             providers: modelConfig.providers
         };
     }
+    const moltnet = buildOpenClawMoltnetConfig(node.runtime.options);
+    if (moltnet) {
+        config.moltnet = moltnet;
+    }
     return `${JSON.stringify(config, null, 2)}\n`;
 };
 const createOpenClawStateFiles = () => [
@@ -89,8 +102,20 @@ const createOpenClawStateFiles = () => [
 ];
 const createContainerTargets = async (inputs) => inputs.map((input) => {
     const agent = input.kind === "agent" ? input.value : null;
+    const configEnvBindings = [
+        ...(agent?.surfaces?.moltnet
+            ? [
+                {
+                    envName: "OPENCLAW_HOOKS_TOKEN",
+                    jsonPath: "hooks.token"
+                }
+            ]
+            : []),
+        ...(buildOpenClawSurfaceEnvBindings(agent?.surfaces) ?? []),
+        ...(agent ? (buildOpenClawMoltnetEnvBindings(agent.runtime.options) ?? []) : [])
+    ];
     return {
-        configEnvBindings: buildOpenClawSurfaceEnvBindings(agent?.surfaces),
+        ...(configEnvBindings.length > 0 ? { configEnvBindings } : {}),
         files: input.emittedFiles,
         id: `${input.kind}-${input.slug}`,
         sourceIds: [input.id]
@@ -139,6 +164,7 @@ export const openClawAdapter = {
             workspacePathTemplate: "<instance-root>/home/.openclaw/workspace"
         },
         port: 18789,
+        portStride: 20,
         portEnv: "OPENCLAW_GATEWAY_PORT",
         standaloneBaseImage: "node:24-bookworm-slim",
         startCommand: [
@@ -147,13 +173,19 @@ export const openClawAdapter = {
             "gateway",
             "--allow-unconfigured",
             "--bind",
-            "lan",
+            "loopback",
             "--port",
             "<port>",
             "--verbose"
         ],
         systemDeps: ["bash", "ca-certificates", "curl", "git", "hostname", "openssl", "procps"]
     },
+    systemInstructionSurface: {
+        placement: "append_pointer",
+        resolvePath() {
+            return "workspace/AGENTS.md";
+        }
+    },
     async compileAgent(node) {
         return {
             capabilities: createAgentCapabilities(node, {
@@ -186,9 +218,10 @@ export const openClawAdapter = {
     prepareRuntimeAuth: prepareOpenClawRuntimeAuth,
     scaffoldAgentProject: createOpenClawAgentScaffold,
     validateRuntimeOptions(options) {
+        const diagnostics = validateOpenClawMoltnetRuntimeOptions(options).map((message) => createDiagnostic("error", message));
         if ("profile" in options && typeof options.profile !== "string") {
-            return [createDiagnostic("error", "OpenClaw runtime option profile must be a string")];
+            diagnostics.push(createDiagnostic("error", "OpenClaw runtime option profile must be a string"));
         }
-        return [];
+        return diagnostics;
     }
 };

package/dist/runtime/openclaw/moltnet.d.ts

@@ -0,0 +1,12 @@
+import type { RuntimeContainerConfigEnvBinding } from "../types.js";
+export interface OpenClawMoltnetRuntimeOptions {
+    baseUrl?: string;
+    enabled?: boolean;
+    networkId?: string;
+    token?: string;
+    tokenSecret?: string;
+    timeoutMs?: number;
+}
+export declare const validateOpenClawMoltnetRuntimeOptions: (options: Record<string, unknown>) => string[];
+export declare const buildOpenClawMoltnetConfig: (options: Record<string, unknown>) => Record<string, unknown> | undefined;
+export declare const buildOpenClawMoltnetEnvBindings: (options: Record<string, unknown>) => RuntimeContainerConfigEnvBinding[] | undefined;

package/dist/runtime/openclaw/moltnet.js

@@ -0,0 +1,124 @@
+const MOLTNET_OPTION_KEYS = new Set([
+    "base_url",
+    "enabled",
+    "network_id",
+    "timeout_ms",
+    "token",
+    "token_secret"
+]);
+const parseMoltnetOptions = (options) => {
+    const raw = options.moltnet;
+    if (raw === undefined) {
+        return { errors: [] };
+    }
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        return {
+            errors: [
+                "OpenClaw runtime option moltnet must be an object with enabled/base_url/network_id/timeout_ms/token/token_secret"
+            ]
+        };
+    }
+    const value = raw;
+    const errors = [];
+    for (const key of Object.keys(value)) {
+        if (!MOLTNET_OPTION_KEYS.has(key)) {
+            errors.push(`OpenClaw runtime option moltnet.${key} is unsupported`);
+        }
+    }
+    const parsed = {};
+    if ("enabled" in value) {
+        if (typeof value.enabled !== "boolean") {
+            errors.push("OpenClaw runtime option moltnet.enabled must be a boolean");
+        }
+        else {
+            parsed.enabled = value.enabled;
+        }
+    }
+    if ("base_url" in value) {
+        if (typeof value.base_url !== "string" || value.base_url.trim().length === 0) {
+            errors.push("OpenClaw runtime option moltnet.base_url must be a non-empty string");
+        }
+        else {
+            try {
+                const url = new URL(value.base_url);
+                if (url.protocol !== "http:" && url.protocol !== "https:") {
+                    errors.push("OpenClaw runtime option moltnet.base_url must use http or https");
+                }
+                else {
+                    parsed.baseUrl = value.base_url.trim().replace(/\/+$/, "");
+                }
+            }
+            catch {
+                errors.push("OpenClaw runtime option moltnet.base_url must be a valid URL");
+            }
+        }
+    }
+    if ("network_id" in value) {
+        if (typeof value.network_id !== "string" || value.network_id.trim().length === 0) {
+            errors.push("OpenClaw runtime option moltnet.network_id must be a non-empty string");
+        }
+        else {
+            parsed.networkId = value.network_id.trim();
+        }
+    }
+    if ("timeout_ms" in value) {
+        if (typeof value.timeout_ms !== "number" ||
+            !Number.isInteger(value.timeout_ms) ||
+            value.timeout_ms <= 0) {
+            errors.push("OpenClaw runtime option moltnet.timeout_ms must be a positive integer");
+        }
+        else {
+            parsed.timeoutMs = value.timeout_ms;
+        }
+    }
+    if ("token" in value) {
+        if (typeof value.token !== "string" || value.token.trim().length === 0) {
+            errors.push("OpenClaw runtime option moltnet.token must be a non-empty string");
+        }
+        else {
+            parsed.token = value.token.trim();
+        }
+    }
+    if ("token_secret" in value) {
+        if (typeof value.token_secret !== "string" || value.token_secret.trim().length === 0) {
+            errors.push("OpenClaw runtime option moltnet.token_secret must be a non-empty string");
+        }
+        else {
+            parsed.tokenSecret = value.token_secret.trim();
+        }
+    }
+    if (parsed.enabled === true && !parsed.baseUrl) {
+        errors.push("OpenClaw runtime option moltnet.base_url is required when moltnet.enabled=true");
+    }
+    if (parsed.token && parsed.tokenSecret) {
+        errors.push("OpenClaw runtime option moltnet must not declare both token and token_secret");
+    }
+    return errors.length > 0 ? { errors } : { errors, value: parsed };
+};
+export const validateOpenClawMoltnetRuntimeOptions = (options) => parseMoltnetOptions(options).errors;
+export const buildOpenClawMoltnetConfig = (options) => {
+    const parsed = parseMoltnetOptions(options);
+    if (parsed.errors.length > 0 || !parsed.value) {
+        return undefined;
+    }
+    const config = {
+        ...(parsed.value.enabled !== undefined ? { enabled: parsed.value.enabled } : {}),
+        ...(parsed.value.baseUrl ? { baseUrl: parsed.value.baseUrl } : {}),
+        ...(parsed.value.networkId ? { networkId: parsed.value.networkId } : {}),
+        ...(parsed.value.timeoutMs !== undefined ? { timeoutMs: parsed.value.timeoutMs } : {}),
+        ...(parsed.value.token ? { token: parsed.value.token } : {})
+    };
+    return Object.keys(config).length > 0 ? config : undefined;
+};
+export const buildOpenClawMoltnetEnvBindings = (options) => {
+    const parsed = parseMoltnetOptions(options);
+    if (parsed.errors.length > 0 || !parsed.value?.tokenSecret) {
+        return undefined;
+    }
+    return [
+        {
+            envName: parsed.value.tokenSecret,
+            jsonPath: "moltnet.token"
+        }
+    ];
+};

package/dist/runtime/openclaw/surfaces.js

@@ -246,6 +246,9 @@ export const buildOpenClawSurfaceEnvBindings = (surfaces) => {
     return bindings.length > 0 ? bindings : undefined;
 };
 export const assertSupportedOpenClawSurfaces = (surfaces) => {
+    if (surfaces?.http) {
+        throw new SpawnfileError("validation_error", "OpenClaw does not support portable HTTP surfaces in Spawnfile v0.1");
+    }
     const discordAccess = surfaces?.discord?.access;
     if (discordAccess && discordAccess.mode === "allowlist" && discordAccess.channels.length > 0 && discordAccess.guilds.length !== 1) {
         throw new SpawnfileError("validation_error", "OpenClaw Discord channel allowlists require exactly one guild id");

package/dist/runtime/picoclaw/adapter.js

@@ -4,6 +4,7 @@ import { createAgentCapabilities, createDiagnostic, createDocumentFiles, createS
 import { preparePicoClawRuntimeAuth } from "./runAuth.js";
 import { createPicoClawAgentScaffold } from "./scaffold.js";
 import { assertSupportedPicoClawSurfaces, buildPicoClawChannelConfig, buildPicoClawSurfaceEnvBindings } from "./surfaces.js";
+import { PICOCLAW_GATEWAY_BASE_PORT, PICOCLAW_INTERNAL_PICO_TOKEN } from "./pico.js";
 const formatModelName = (node) => {
     const primary = node.execution?.model?.primary;
     if (!primary)
@@ -79,6 +80,21 @@ const buildMcpServers = (servers) => {
     }
     return result;
 };
+const buildPicoClawToolsConfig = (node) => {
+    const tools = {};
+    if (node.surfaces?.moltnet) {
+        tools.exec = {
+            enabled: true
+        };
+    }
+    if (node.mcpServers.length > 0) {
+        tools.mcp = {
+            enabled: true,
+            servers: buildMcpServers(node.mcpServers)
+        };
+    }
+    return Object.keys(tools).length > 0 ? tools : undefined;
+};
 const buildPicoClawConfig = (node) => {
     const modelName = formatModelName(node);
     const restrictToWorkspace = node.runtime.options.restrict_to_workspace ?? true;
@@ -98,13 +114,9 @@ const buildPicoClawConfig = (node) => {
     if (Object.keys(channels).length > 0) {
         config.channels = channels;
     }
-    if (node.mcpServers.length > 0) {
-        config.tools = {
-            mcp: {
-                enabled: true,
-                servers: buildMcpServers(node.mcpServers)
-            }
-        };
+    const tools = buildPicoClawToolsConfig(node);
+    if (tools) {
+        config.tools = tools;
     }
     return `${JSON.stringify(config, null, 2)}\n`;
 };
@@ -163,15 +175,22 @@ export const picoClawAdapter = {
             homePathTemplate: "<instance-root>/picoclaw",
             workspacePathTemplate: "<instance-root>/picoclaw/workspace"
         },
-        port: 18790,
+        port: PICOCLAW_GATEWAY_BASE_PORT,
         portEnv: "PICOCLAW_GATEWAY_PORT",
         standaloneBaseImage: "debian:bookworm-slim",
         startCommand: ["picoclaw", "gateway", "--allow-empty"],
         staticEnv: {
+            PICOCLAW_CHANNELS_PICO_TOKEN: PICOCLAW_INTERNAL_PICO_TOKEN,
             PICOCLAW_GATEWAY_HOST: "0.0.0.0"
         },
         systemDeps: ["bash", "ca-certificates", "curl", "nodejs", "npm", "tar"]
     },
+    systemInstructionSurface: {
+        placement: "append_pointer",
+        resolvePath() {
+            return "workspace/AGENTS.md";
+        }
+    },
     async compileAgent(node) {
         return {
             capabilities: createAgentCapabilities(node),

package/dist/runtime/picoclaw/pico.d.ts

@@ -0,0 +1,2 @@
+export declare const PICOCLAW_GATEWAY_BASE_PORT = 18990;
+export declare const PICOCLAW_INTERNAL_PICO_TOKEN = "spawnfile-internal-pico";

package/dist/runtime/picoclaw/pico.js

@@ -0,0 +1,2 @@
+export const PICOCLAW_GATEWAY_BASE_PORT = 18990;
+export const PICOCLAW_INTERNAL_PICO_TOKEN = "spawnfile-internal-pico";