spawnfile 0.1.11 → 0.1.12

package/dist/manifest/schemas.d.ts

@@ -258,27 +258,21 @@ declare const agentManifestSchema: z.ZodObject<{
         moltnet: z.ZodOptional<z.ZodArray<z.ZodObject<{
             dms: z.ZodOptional<z.ZodObject<{
                 enabled: z.ZodBoolean;
-                read: z.ZodOptional<z.ZodEnum<{
+                wake: z.ZodOptional<z.ZodEnum<{
+                    never: "never";
                     all: "all";
                     mentions: "mentions";
                     thread_only: "thread_only";
                 }>>;
-                reply: z.ZodOptional<z.ZodEnum<{
-                    never: "never";
-                    auto: "auto";
-                }>>;
             }, z.core.$strict>>;
             network: z.ZodString;
             rooms: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
-                read: z.ZodOptional<z.ZodEnum<{
+                wake: z.ZodOptional<z.ZodEnum<{
+                    never: "never";
                     all: "all";
                     mentions: "mentions";
                     thread_only: "thread_only";
                 }>>;
-                reply: z.ZodOptional<z.ZodEnum<{
-                    never: "never";
-                    auto: "auto";
-                }>>;
             }, z.core.$strict>>>;
         }, z.core.$strict>>>;
         slack: z.ZodOptional<z.ZodObject<{
@@ -536,27 +530,21 @@ declare const teamManifestSchema: z.ZodObject<{
         moltnet: z.ZodOptional<z.ZodArray<z.ZodObject<{
             dms: z.ZodOptional<z.ZodObject<{
                 enabled: z.ZodBoolean;
-                read: z.ZodOptional<z.ZodEnum<{
+                wake: z.ZodOptional<z.ZodEnum<{
+                    never: "never";
                     all: "all";
                     mentions: "mentions";
                     thread_only: "thread_only";
                 }>>;
-                reply: z.ZodOptional<z.ZodEnum<{
-                    never: "never";
-                    auto: "auto";
-                }>>;
             }, z.core.$strict>>;
             network: z.ZodString;
             rooms: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
-                read: z.ZodOptional<z.ZodEnum<{
+                wake: z.ZodOptional<z.ZodEnum<{
+                    never: "never";
                     all: "all";
                     mentions: "mentions";
                     thread_only: "thread_only";
                 }>>;
-                reply: z.ZodOptional<z.ZodEnum<{
-                    never: "never";
-                    auto: "auto";
-                }>>;
             }, z.core.$strict>>>;
         }, z.core.$strict>>>;
         slack: z.ZodOptional<z.ZodObject<{
@@ -942,27 +930,21 @@ export declare const manifestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         moltnet: z.ZodOptional<z.ZodArray<z.ZodObject<{
             dms: z.ZodOptional<z.ZodObject<{
                 enabled: z.ZodBoolean;
-                read: z.ZodOptional<z.ZodEnum<{
+                wake: z.ZodOptional<z.ZodEnum<{
+                    never: "never";
                     all: "all";
                     mentions: "mentions";
                     thread_only: "thread_only";
                 }>>;
-                reply: z.ZodOptional<z.ZodEnum<{
-                    never: "never";
-                    auto: "auto";
-                }>>;
             }, z.core.$strict>>;
             network: z.ZodString;
             rooms: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
-                read: z.ZodOptional<z.ZodEnum<{
+                wake: z.ZodOptional<z.ZodEnum<{
+                    never: "never";
                     all: "all";
                     mentions: "mentions";
                     thread_only: "thread_only";
                 }>>;
-                reply: z.ZodOptional<z.ZodEnum<{
-                    never: "never";
-                    auto: "auto";
-                }>>;
             }, z.core.$strict>>>;
         }, z.core.$strict>>>;
         slack: z.ZodOptional<z.ZodObject<{
@@ -1219,27 +1201,21 @@ export declare const manifestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         moltnet: z.ZodOptional<z.ZodArray<z.ZodObject<{
             dms: z.ZodOptional<z.ZodObject<{
                 enabled: z.ZodBoolean;
-                read: z.ZodOptional<z.ZodEnum<{
+                wake: z.ZodOptional<z.ZodEnum<{
+                    never: "never";
                     all: "all";
                     mentions: "mentions";
                     thread_only: "thread_only";
                 }>>;
-                reply: z.ZodOptional<z.ZodEnum<{
-                    never: "never";
-                    auto: "auto";
-                }>>;
             }, z.core.$strict>>;
             network: z.ZodString;
             rooms: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
-                read: z.ZodOptional<z.ZodEnum<{
+                wake: z.ZodOptional<z.ZodEnum<{
+                    never: "never";
                     all: "all";
                     mentions: "mentions";
                     thread_only: "thread_only";
                 }>>;
-                reply: z.ZodOptional<z.ZodEnum<{
-                    never: "never";
-                    auto: "auto";
-                }>>;
             }, z.core.$strict>>>;
         }, z.core.$strict>>>;
         slack: z.ZodOptional<z.ZodObject<{
@@ -1540,6 +1516,6 @@ export type SkillReference = z.infer<typeof skillReferenceSchema>;
 export type TeamManifest = z.infer<typeof teamManifestSchema>;
 export type { ExecutionBlock, ModelEndpoint, ModelEntryAuth, ModelTarget } from "./executionSchemas.js";
 export type { TeamNetwork, TeamNetworkRoom, TeamNetworkServer, TeamWorkspace, TeamWorkspaceResource } from "./teamNetworkSchemas.js";
-export type { DiscordSurface, DiscordSurfaceAccess, HttpSurface, HttpSurfaceAccess, HttpSurfaceAuth, MoltnetAttachment, MoltnetDM, MoltnetRead, MoltnetReply, MoltnetRoomBehavior, MoltnetSurface, SlackSurface, SlackSurfaceAccess, SurfacesBlock, TelegramSurface, TelegramSurfaceAccess, WebhookSurface, WhatsAppSurface, WhatsAppSurfaceAccess } from "./surfaceSchemas.js";
+export type { DiscordSurface, DiscordSurfaceAccess, HttpSurface, HttpSurfaceAccess, HttpSurfaceAuth, MoltnetAttachment, MoltnetDM, MoltnetRoomBehavior, MoltnetSurface, MoltnetWake, SlackSurface, SlackSurfaceAccess, SurfacesBlock, TelegramSurface, TelegramSurfaceAccess, WebhookSurface, WhatsAppSurface, WhatsAppSurfaceAccess } from "./surfaceSchemas.js";
 export declare const isAgentManifest: (manifest: Manifest) => manifest is AgentManifest;
 export declare const isTeamManifest: (manifest: Manifest) => manifest is TeamManifest;

package/dist/manifest/surfaceSchemas.d.ts

@@ -102,88 +102,67 @@ declare const webhookSurfaceSchema: z.ZodObject<{
     signing_secret: z.ZodOptional<z.ZodString>;
     url: z.ZodString;
 }, z.core.$strict>;
-declare const moltnetReadSchema: z.ZodEnum<{
+declare const moltnetWakeSchema: z.ZodEnum<{
+    never: "never";
     all: "all";
     mentions: "mentions";
     thread_only: "thread_only";
 }>;
-declare const moltnetReplySchema: z.ZodEnum<{
-    never: "never";
-    auto: "auto";
-}>;
 declare const moltnetRoomBehaviorSchema: z.ZodObject<{
-    read: z.ZodOptional<z.ZodEnum<{
+    wake: z.ZodOptional<z.ZodEnum<{
+        never: "never";
         all: "all";
         mentions: "mentions";
         thread_only: "thread_only";
     }>>;
-    reply: z.ZodOptional<z.ZodEnum<{
-        never: "never";
-        auto: "auto";
-    }>>;
 }, z.core.$strict>;
 declare const moltnetDmSchema: z.ZodObject<{
     enabled: z.ZodBoolean;
-    read: z.ZodOptional<z.ZodEnum<{
+    wake: z.ZodOptional<z.ZodEnum<{
+        never: "never";
         all: "all";
         mentions: "mentions";
         thread_only: "thread_only";
     }>>;
-    reply: z.ZodOptional<z.ZodEnum<{
-        never: "never";
-        auto: "auto";
-    }>>;
 }, z.core.$strict>;
 declare const moltnetAttachmentSchema: z.ZodObject<{
     dms: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodBoolean;
-        read: z.ZodOptional<z.ZodEnum<{
+        wake: z.ZodOptional<z.ZodEnum<{
+            never: "never";
             all: "all";
             mentions: "mentions";
             thread_only: "thread_only";
         }>>;
-        reply: z.ZodOptional<z.ZodEnum<{
-            never: "never";
-            auto: "auto";
-        }>>;
     }, z.core.$strict>>;
     network: z.ZodString;
     rooms: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
-        read: z.ZodOptional<z.ZodEnum<{
+        wake: z.ZodOptional<z.ZodEnum<{
+            never: "never";
             all: "all";
             mentions: "mentions";
             thread_only: "thread_only";
         }>>;
-        reply: z.ZodOptional<z.ZodEnum<{
-            never: "never";
-            auto: "auto";
-        }>>;
     }, z.core.$strict>>>;
 }, z.core.$strict>;
 declare const moltnetSurfaceSchema: z.ZodArray<z.ZodObject<{
     dms: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodBoolean;
-        read: z.ZodOptional<z.ZodEnum<{
+        wake: z.ZodOptional<z.ZodEnum<{
+            never: "never";
             all: "all";
             mentions: "mentions";
             thread_only: "thread_only";
         }>>;
-        reply: z.ZodOptional<z.ZodEnum<{
-            never: "never";
-            auto: "auto";
-        }>>;
     }, z.core.$strict>>;
     network: z.ZodString;
     rooms: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
-        read: z.ZodOptional<z.ZodEnum<{
+        wake: z.ZodOptional<z.ZodEnum<{
+            never: "never";
             all: "all";
             mentions: "mentions";
             thread_only: "thread_only";
         }>>;
-        reply: z.ZodOptional<z.ZodEnum<{
-            never: "never";
-            auto: "auto";
-        }>>;
     }, z.core.$strict>>>;
 }, z.core.$strict>>;
 export declare const surfacesSchema: z.ZodObject<{
@@ -206,27 +185,21 @@ export declare const surfacesSchema: z.ZodObject<{
     moltnet: z.ZodOptional<z.ZodArray<z.ZodObject<{
         dms: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodBoolean;
-            read: z.ZodOptional<z.ZodEnum<{
+            wake: z.ZodOptional<z.ZodEnum<{
+                never: "never";
                 all: "all";
                 mentions: "mentions";
                 thread_only: "thread_only";
             }>>;
-            reply: z.ZodOptional<z.ZodEnum<{
-                never: "never";
-                auto: "auto";
-            }>>;
         }, z.core.$strict>>;
         network: z.ZodString;
         rooms: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
-            read: z.ZodOptional<z.ZodEnum<{
+            wake: z.ZodOptional<z.ZodEnum<{
+                never: "never";
                 all: "all";
                 mentions: "mentions";
                 thread_only: "thread_only";
             }>>;
-            reply: z.ZodOptional<z.ZodEnum<{
-                never: "never";
-                auto: "auto";
-            }>>;
         }, z.core.$strict>>>;
     }, z.core.$strict>>>;
     slack: z.ZodOptional<z.ZodObject<{
@@ -287,10 +260,9 @@ export type HttpSurfaceAuth = never;
 export type HttpSurface = never;
 export type MoltnetAttachment = z.infer<typeof moltnetAttachmentSchema>;
 export type MoltnetDM = z.infer<typeof moltnetDmSchema>;
-export type MoltnetRead = z.infer<typeof moltnetReadSchema>;
-export type MoltnetReply = z.infer<typeof moltnetReplySchema>;
 export type MoltnetRoomBehavior = z.infer<typeof moltnetRoomBehaviorSchema>;
 export type MoltnetSurface = z.infer<typeof moltnetSurfaceSchema>;
+export type MoltnetWake = z.infer<typeof moltnetWakeSchema>;
 export type SlackSurfaceAccess = z.infer<typeof slackSurfaceAccessSchema>;
 export type SlackSurface = z.infer<typeof slackSurfaceSchema>;
 export type TelegramSurfaceAccess = z.infer<typeof telegramSurfaceAccessSchema>;

package/dist/manifest/surfaceSchemas.js

@@ -178,19 +178,16 @@ const webhookSurfaceSchema = z
     url: z.string().url()
 })
     .strict();
-const moltnetReadSchema = z.enum(["all", "mentions", "thread_only"]);
-const moltnetReplySchema = z.enum(["auto", "never"]);
+const moltnetWakeSchema = z.enum(["all", "mentions", "thread_only", "never"]);
 const moltnetRoomBehaviorSchema = z
     .object({
-    read: moltnetReadSchema.optional(),
-    reply: moltnetReplySchema.optional()
+    wake: moltnetWakeSchema.optional()
 })
     .strict();
 const moltnetDmSchema = z
     .object({
     enabled: z.boolean(),
-    read: moltnetReadSchema.optional(),
-    reply: moltnetReplySchema.optional()
+    wake: moltnetWakeSchema.optional()
 })
     .strict();
 const moltnetAttachmentSchema = z

package/dist/report/createReport.d.ts

@@ -1,2 +1,8 @@
 import { CompileReport, ContainerReport, DiagnosticReport, NodeReport } from "./types.js";
-export declare const createCompileReport: (root: string, nodes: NodeReport[], diagnostics?: DiagnosticReport[], container?: ContainerReport) => CompileReport;
+export interface CreateCompileReportOptions {
+    compileFingerprint?: string;
+    generatedAt?: string;
+    outputDirectory?: string;
+    projectName?: string;
+}
+export declare const createCompileReport: (root: string, nodes: NodeReport[], diagnostics?: DiagnosticReport[], container?: ContainerReport, options?: CreateCompileReportOptions) => CompileReport;

package/dist/report/createReport.js

@@ -1,7 +1,34 @@
-export const createCompileReport = (root, nodes, diagnostics = [], container) => ({
+import { createHash } from "node:crypto";
+const stableStringify = (value) => {
+    if (Array.isArray(value)) {
+        return `[${value.map((item) => stableStringify(item)).join(",")}]`;
+    }
+    if (value && typeof value === "object") {
+        return `{${Object.entries(value)
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([key, item]) => `${JSON.stringify(key)}:${stableStringify(item)}`)
+            .join(",")}}`;
+    }
+    return JSON.stringify(value);
+};
+const createCompileFingerprint = (root, nodes, diagnostics, container) => {
+    const payload = stableStringify({
+        container,
+        diagnostics,
+        nodes,
+        root,
+        spawnfile_version: "0.1"
+    });
+    return `sf1:${createHash("sha1").update(payload).digest("hex").slice(0, 12)}`;
+};
+export const createCompileReport = (root, nodes, diagnostics = [], container, options = {}) => ({
+    compile_fingerprint: options.compileFingerprint ?? createCompileFingerprint(root, nodes, diagnostics, container),
     ...(container ? { container } : {}),
     diagnostics,
+    generated_at: options.generatedAt ?? new Date().toISOString(),
     nodes,
+    ...(options.outputDirectory ? { output_directory: options.outputDirectory } : {}),
+    ...(options.projectName ? { project_name: options.projectName } : {}),
     root,
     spawnfile_version: "0.1"
 });

package/dist/report/types.d.ts

@@ -14,9 +14,13 @@ export interface ContainerRuntimeInstanceReport {
     config_path: string;
     home_path: string | null;
     id: string;
+    internal_port?: number | null;
     model_auth_methods: Record<string, ModelAuthMethod>;
     model_secrets_required: string[];
+    node_ids?: string[];
+    published_port?: number | null;
     runtime: string;
+    workspace_path?: string;
 }
 export interface ContainerWorkspaceResourceReport {
     backing_path: string;
@@ -33,6 +37,37 @@ export interface ContainerPersistentMountReport {
     reason: string;
     volume_name: string;
 }
+export interface ContainerPortMappingReport {
+    internal_port: number;
+    published_port: number;
+}
+export interface ContainerMoltnetNodePlanSummary {
+    config_path: string;
+    network_id: string;
+}
+export interface ContainerMoltnetServerPlanSummary {
+    auth_mode?: "bearer" | "none" | "open";
+    base_url: string;
+    config_path?: string;
+    direct_messages?: boolean;
+    id: string;
+    mode: "external" | "managed";
+    network_id: string;
+    operator_token_secret?: string;
+    port?: number;
+    public_read?: boolean;
+    rooms: Array<{
+        id: string;
+        members: string[];
+        visibility?: "public" | "private";
+        write_policy?: "members" | "operators" | "registered_agents";
+    }>;
+    store_kind?: "json" | "memory" | "postgres" | "sqlite";
+}
+export interface ContainerMoltnetPlanSummary {
+    node_plans: ContainerMoltnetNodePlanSummary[];
+    server_plans: ContainerMoltnetServerPlanSummary[];
+}
 export interface NodeReport {
     capabilities: CapabilityReport[];
     diagnostics: DiagnosticReport[];
@@ -48,8 +83,12 @@ export interface ContainerReport {
     dockerfile: string;
     entrypoint: string;
     env_example: string;
+    internal_ports?: number[];
     model_secrets_required: string[];
+    moltnet?: ContainerMoltnetPlanSummary;
+    port_mappings?: ContainerPortMappingReport[];
     ports: number[];
+    published_ports?: number[];
     runtime_instances: ContainerRuntimeInstanceReport[];
     runtime_homes: string[];
     runtime_secrets_required: string[];
@@ -59,9 +98,13 @@ export interface ContainerReport {
     workspace_resources?: ContainerWorkspaceResourceReport[];
 }
 export interface CompileReport {
+    compile_fingerprint?: string;
     container?: ContainerReport;
     diagnostics: DiagnosticReport[];
+    generated_at?: string;
     nodes: NodeReport[];
+    output_directory?: string;
+    project_name?: string;
     root: string;
     spawnfile_version: "0.1";
 }

package/dist/runtime/container.js

@@ -1,7 +1,6 @@
 import { SpawnfileError } from "../shared/index.js";
 import { resolveRuntimeInstallSelection } from "./install.js";
 export const RUNTIME_INSTALL_ROOT = "/opt/spawnfile/runtime-installs";
-const createGitHubReleaseUrl = (repository, tag, asset) => `https://github.com/${repository}/releases/download/${tag}/${asset}`;
 const assertArtifactInstallSelection = (runtimeName, selection) => {
     if (selection.kind !== "source_repo") {
         return;
@@ -45,21 +44,6 @@ export const createRuntimeInstallRecipe = async (runtimeName) => {
                 runtimeRoot: installRoot
             };
         }
-        case "tinyclaw": {
-            if (selection.kind !== "github_release_bundle") {
-                throw new SpawnfileError("runtime_error", `Runtime ${runtimeName} has no compiled artifact recipe for ${selection.kind}`);
-            }
-            return {
-                commands: [
-                    `mkdir -p ${installRoot}`,
-                    `curl -fsSL ${JSON.stringify(createGitHubReleaseUrl(selection.repository, selection.tag, selection.asset))} | tar -xz --strip-components=1 -C ${installRoot}`,
-                    `cd ${installRoot} && npm rebuild better-sqlite3 --silent`
-                ],
-                copyCommands: [],
-                runtimeName,
-                runtimeRoot: installRoot
-            };
-        }
         /* c8 ignore next 5 -- compileable runtimes are exhaustively covered above */
         default:
             throw new SpawnfileError("runtime_error", `Runtime ${runtimeName} has no container install recipe`);

package/dist/runtime/index.d.ts

@@ -1,4 +1,5 @@
 export * from "./container.js";
 export * from "./install.js";
 export * from "./registry.js";
+export * from "./statusProbes.js";
 export * from "./types.js";

package/dist/runtime/index.js

@@ -1,4 +1,5 @@
 export * from "./container.js";
 export * from "./install.js";
 export * from "./registry.js";
+export * from "./statusProbes.js";
 export * from "./types.js";

package/dist/runtime/install.d.ts

@@ -18,16 +18,6 @@ export type RuntimeInstallSelection = {
     selectionSource: "runtime_registry_install";
     tag: string;
     versionedAssets: Record<string, string>;
-} | {
-    asset: string;
-    ecosystem: "node";
-    installHint: string;
-    kind: "github_release_bundle";
-    repository: string;
-    runtimeName: string;
-    runtimeRef: string;
-    selectionSource: "runtime_registry_install";
-    tag: string;
 } | {
     ecosystem: "node";
     installHint: string;

package/dist/runtime/install.js

@@ -20,10 +20,6 @@ const installHints = new Map([
                 ecosystem: "node",
                 installHint: "Download the pinned OpenClaw artifact archive from the release."
             },
-            github_release_bundle: {
-                ecosystem: "node",
-                installHint: "Download the pinned OpenClaw bundle artifact from the release."
-            },
             npm: {
                 ecosystem: "node",
                 installHint: "Install the pinned OpenClaw package version from npm."
@@ -45,10 +41,6 @@ const installHints = new Map([
                 ecosystem: "go",
                 installHint: "Download the pinned PicoClaw release archive for the target platform."
             },
-            github_release_bundle: {
-                ecosystem: "node",
-                installHint: "Download the pinned PicoClaw bundle artifact from the release."
-            },
             npm: {
                 ecosystem: "node",
                 installHint: "Install the pinned PicoClaw package version from npm."
@@ -58,31 +50,6 @@ const installHints = new Map([
                 installHint: "Checkout the pinned repo ref and build/install from the repository root."
             }
         }
-    ],
-    [
-        "tinyclaw",
-        {
-            container_image: {
-                ecosystem: "node",
-                installHint: "Copy the pinned TinyClaw runtime files from the official container image."
-            },
-            github_release_archive: {
-                ecosystem: "go",
-                installHint: "Download the pinned TinyClaw release archive for the target platform."
-            },
-            github_release_bundle: {
-                ecosystem: "node",
-                installHint: "Download the pinned TinyClaw bundle artifact from the release."
-            },
-            npm: {
-                ecosystem: "node",
-                installHint: "Install the pinned TinyClaw package version from npm."
-            },
-            source_repo: {
-                ecosystem: "node",
-                installHint: "Checkout the pinned repo ref and run the TinyAGI install flow from the repository root."
-            }
-        }
     ]
 ]);
 export const resolveRuntimeInstallSelection = async (runtimeName) => {
@@ -127,18 +94,6 @@ export const resolveRuntimeInstallSelection = async (runtimeName) => {
                 tag: runtime.install.tag,
                 versionedAssets: runtime.install.assets
             };
-        case "github_release_bundle":
-            return {
-                ecosystem: "node",
-                installHint: installProfile.github_release_bundle.installHint,
-                asset: runtime.install.asset,
-                kind: "github_release_bundle",
-                repository: runtime.install.repository,
-                runtimeName: runtime.name,
-                runtimeRef: runtime.ref,
-                selectionSource: "runtime_registry_install",
-                tag: runtime.install.tag
-            };
         case "source_repo":
         case undefined:
             return {

package/dist/runtime/openclaw/adapter.js

@@ -1,10 +1,12 @@
 import { listEffectiveExecutionModelTargets } from "../../compiler/modelEnv.js";
 import { createAgentCapabilities, createDiagnostic, createDocumentFiles, createSkillFiles } from "../common.js";
 import { SpawnfileError } from "../../shared/index.js";
+import { applyOpenClawImportAuthConfig, resolveOpenClawImportAuthModes } from "./configAuth.js";
 import { prepareOpenClawRuntimeAuth } from "./runAuth.js";
 import { createOpenClawAgentScaffold } from "./scaffold.js";
 import { assertSupportedOpenClawSurfaces, buildOpenClawChannelConfig, buildOpenClawSurfaceEnvBindings } from "./surfaces.js";
 import { buildOpenClawMoltnetConfig, buildOpenClawMoltnetEnvBindings, validateOpenClawMoltnetRuntimeOptions } from "./moltnet.js";
+import { openClawStatusProbes } from "./statusProbes.js";
 const buildEnvSecretRef = (envName) => ({
     id: envName,
     provider: "default",
@@ -86,7 +88,10 @@ const buildOpenClawConfig = (node) => {
     if (moltnet) {
         config.moltnet = moltnet;
     }
-    return `${JSON.stringify(config, null, 2)}\n`;
+    // Bake the import-auth (claude-code/codex) OAuth structure at compile time so
+    // the image is self-sufficient; only the credential tokens are injected later.
+    const authBaked = applyOpenClawImportAuthConfig(config, resolveOpenClawImportAuthModes(node));
+    return `${JSON.stringify(authBaked, null, 2)}\n`;
 };
 const createOpenClawStateFiles = () => [
     {
@@ -107,6 +112,7 @@ const createContainerTargets = async (inputs) => inputs.map((input) => {
             ? [
                 {
                     envName: "OPENCLAW_HOOKS_TOKEN",
+                    generated: true,
                     jsonPath: "hooks.token"
                 }
             ]
@@ -153,6 +159,7 @@ export const openClawAdapter = {
         env: [
             {
                 description: "Gateway auth token required for non-loopback OpenClaw access",
+                generated: true,
                 name: "OPENCLAW_GATEWAY_TOKEN",
                 required: true
             }
@@ -217,6 +224,7 @@ export const openClawAdapter = {
     name: "openclaw",
     prepareRuntimeAuth: prepareOpenClawRuntimeAuth,
     scaffoldAgentProject: createOpenClawAgentScaffold,
+    statusProbes: openClawStatusProbes,
     validateRuntimeOptions(options) {
         const diagnostics = validateOpenClawMoltnetRuntimeOptions(options).map((message) => createDiagnostic("error", message));
         if ("profile" in options && typeof options.profile !== "string") {

package/dist/runtime/openclaw/configAuth.d.ts

@@ -0,0 +1,15 @@
+import type { ResolvedAgentNode } from "../../compiler/types.js";
+export interface OpenClawImportAuthModes {
+    useClaudeCode: boolean;
+    useCodex: boolean;
+}
+/** Determines which import-based auth modes an agent's models declare. */
+export declare const resolveOpenClawImportAuthModes: (node: ResolvedAgentNode) => OpenClawImportAuthModes;
+export declare const normalizeOpenClawCodexModel: (model: string) => string;
+/**
+ * Applies the import-auth structure (OAuth profiles, provider order, and the
+ * Codex model rename) to an OpenClaw config. This is deterministic from the
+ * declared auth methods, so it is baked into the image at compile time. Only
+ * the OAuth credential tokens are injected at run time.
+ */
+export declare const applyOpenClawImportAuthConfig: (config: Record<string, unknown>, modes: OpenClawImportAuthModes) => Record<string, unknown>;