spawnfile 0.1.11 → 0.1.12

package/dist/runtime/openclaw/configAuth.js

@@ -0,0 +1,46 @@
+import { listEffectiveExecutionModelTargets } from "../../compiler/modelEnv.js";
+/** Determines which import-based auth modes an agent's models declare. */
+export const resolveOpenClawImportAuthModes = (node) => {
+    const targets = listEffectiveExecutionModelTargets(node.execution);
+    return {
+        useClaudeCode: targets.some((target) => target.provider === "anthropic" && target.auth.method === "claude-code"),
+        useCodex: targets.some((target) => target.provider === "openai" && target.auth.method === "codex")
+    };
+};
+export const normalizeOpenClawCodexModel = (model) => {
+    const modelName = model.slice("openai/".length);
+    return modelName === "gpt-5" ? "gpt-5.4" : modelName;
+};
+/**
+ * Applies the import-auth structure (OAuth profiles, provider order, and the
+ * Codex model rename) to an OpenClaw config. This is deterministic from the
+ * declared auth methods, so it is baked into the image at compile time. Only
+ * the OAuth credential tokens are injected at run time.
+ */
+export const applyOpenClawImportAuthConfig = (config, modes) => {
+    if (!modes.useClaudeCode && !modes.useCodex) {
+        return config;
+    }
+    const agents = config.agents ?? {};
+    const defaults = agents.defaults ?? {};
+    const model = defaults.model;
+    const auth = config.auth ?? {};
+    const profiles = auth.profiles ?? {};
+    const order = auth.order ?? {};
+    if (modes.useCodex && typeof model === "string" && model.startsWith("openai/")) {
+        defaults.model = `openai-codex/${normalizeOpenClawCodexModel(model)}`;
+    }
+    if (modes.useClaudeCode) {
+        profiles["anthropic:default"] = { mode: "oauth", provider: "anthropic" };
+        order.anthropic = ["anthropic:default"];
+    }
+    if (modes.useCodex) {
+        profiles["openai-codex:default"] = { mode: "oauth", provider: "openai-codex" };
+        order["openai-codex"] = ["openai-codex:default"];
+    }
+    return {
+        ...config,
+        agents: { ...agents, defaults },
+        auth: { ...auth, order, profiles }
+    };
+};

package/dist/runtime/openclaw/runAuth.d.ts

@@ -1,2 +1,8 @@
 import type { RuntimeAuthPreparationInput, RuntimeAuthPreparationResult } from "../types.js";
+/**
+ * Injects the consumer's imported OAuth credentials for an OpenClaw instance.
+ * The OAuth-mode config is already baked into the image at compile time, so this
+ * only materializes and mounts the credential tokens — no source rootfs needed,
+ * which is what lets it run for both project deployments and sourceless images.
+ */
 export declare const prepareOpenClawRuntimeAuth: (input: RuntimeAuthPreparationInput) => Promise<RuntimeAuthPreparationResult>;

package/dist/runtime/openclaw/runAuth.js

@@ -1,7 +1,6 @@
 import path from "node:path";
 import { loadImportedClaudeCodeCredential, loadImportedCodexCredential } from "../../auth/index.js";
-import { ensureDirectory, readUtf8File, writeUtf8File } from "../../filesystem/index.js";
-const resolveRootfsSourcePath = (outputDirectory, containerPath) => path.join(outputDirectory, "container", "rootfs", ...path.posix.relative("/", containerPath).split("/"));
+import { ensureDirectory, writeUtf8File } from "../../filesystem/index.js";
 const writeJsonFile = async (tempRoot, relativePath, value) => {
     const hostPath = path.join(tempRoot, relativePath);
     await ensureDirectory(path.dirname(hostPath));
@@ -35,47 +34,12 @@ const createOpenClawCredential = (provider, credential) => credential && "type"
         refresh: credential.refresh,
         type: "oauth"
     };
-const normalizeOpenClawCodexModel = (model) => {
-    const modelName = model.slice("openai/".length);
-    return modelName === "gpt-5" ? "gpt-5.4" : modelName;
-};
-const patchOpenClawConfig = (config, options) => {
-    const agents = config.agents ?? {};
-    const defaults = agents.defaults ?? {};
-    const model = defaults.model;
-    const auth = config.auth ?? {};
-    const profiles = auth.profiles ?? {};
-    const order = auth.order ?? {};
-    if (options.useCodex && typeof model === "string" && model.startsWith("openai/")) {
-        defaults.model = `openai-codex/${normalizeOpenClawCodexModel(model)}`;
-    }
-    if (options.useClaudeCode) {
-        profiles["anthropic:default"] = {
-            mode: "oauth",
-            provider: "anthropic"
-        };
-        order.anthropic = ["anthropic:default"];
-    }
-    if (options.useCodex) {
-        profiles["openai-codex:default"] = {
-            mode: "oauth",
-            provider: "openai-codex"
-        };
-        order["openai-codex"] = ["openai-codex:default"];
-    }
-    return {
-        ...config,
-        agents: {
-            ...agents,
-            defaults
-        },
-        auth: {
-            ...auth,
-            order,
-            profiles
-        }
-    };
-};
+/**
+ * Injects the consumer's imported OAuth credentials for an OpenClaw instance.
+ * The OAuth-mode config is already baked into the image at compile time, so this
+ * only materializes and mounts the credential tokens — no source rootfs needed,
+ * which is what lets it run for both project deployments and sourceless images.
+ */
 export const prepareOpenClawRuntimeAuth = async (input) => {
     if (!input.instance.home_path) {
         return { coveredModelSecrets: [], mountArgs: [] };
@@ -88,7 +52,6 @@ export const prepareOpenClawRuntimeAuth = async (input) => {
         : null;
     const coveredModelSecrets = [];
     const authProfiles = {};
-    let patchedConfig = null;
     const useClaudeCode = input.instance.model_auth_methods.anthropic === "claude-code" && claudeCode;
     const useCodex = input.instance.model_auth_methods.openai === "codex" && codex;
     if (useClaudeCode) {
@@ -99,13 +62,6 @@ export const prepareOpenClawRuntimeAuth = async (input) => {
         authProfiles["openai-codex:default"] = createOpenClawCredential("openai-codex", codex);
         coveredModelSecrets.push("OPENAI_API_KEY");
     }
-    if (useClaudeCode || useCodex) {
-        const sourceConfig = JSON.parse(await readUtf8File(resolveRootfsSourcePath(input.outputDirectory, input.instance.config_path)));
-        patchedConfig = patchOpenClawConfig(sourceConfig, {
-            useClaudeCode: Boolean(useClaudeCode),
-            useCodex: Boolean(useCodex)
-        });
-    }
     const mountArgs = [];
     if (Object.keys(authProfiles).length > 0) {
         const authStorePath = await writeJsonFile(input.tempRoot, path.join("runtime-auth", "openclaw", input.instance.id, "auth-profiles.json"), {
@@ -114,10 +70,6 @@ export const prepareOpenClawRuntimeAuth = async (input) => {
         });
         mountArgs.push(...createMountArgs(authStorePath, path.posix.join(input.instance.home_path, ".openclaw", "agents", "main", "agent", "auth-profiles.json")));
     }
-    if (patchedConfig) {
-        const patchedConfigPath = await writeJsonFile(input.tempRoot, path.join("runtime-auth", "openclaw", input.instance.id, "openclaw.json"), patchedConfig);
-        mountArgs.push(...createMountArgs(patchedConfigPath, input.instance.config_path));
-    }
     return {
         coveredModelSecrets,
         mountArgs

package/dist/runtime/openclaw/statusProbes.d.ts

@@ -0,0 +1,2 @@
+import type { RuntimeStatusProbe } from "../types.js";
+export declare const openClawStatusProbes: RuntimeStatusProbe[];

package/dist/runtime/openclaw/statusProbes.js

@@ -0,0 +1,31 @@
+import { createRuntimeHttpProbe, createRuntimePathProbe } from "../statusProbes.js";
+export const openClawStatusProbes = [
+    createRuntimePathProbe({
+        id: "home",
+        key: "runtime.home",
+        label: "OpenClaw home",
+        pathFor: (instance) => instance.home_path,
+        testFlag: "-d"
+    }),
+    createRuntimePathProbe({
+        id: "workspace",
+        key: "runtime.workspace",
+        label: "OpenClaw workspace",
+        pathFor: (instance) => instance.workspace_path,
+        testFlag: "-d"
+    }),
+    createRuntimePathProbe({
+        id: "config",
+        key: "runtime.config",
+        label: "OpenClaw config",
+        pathFor: (instance) => instance.config_path,
+        testFlag: "-f"
+    }),
+    createRuntimeHttpProbe({
+        id: "healthz",
+        key: "runtime.health",
+        label: "OpenClaw gateway",
+        path: "/healthz",
+        portFor: (instance) => instance.internal_port
+    })
+];

package/dist/runtime/picoclaw/adapter.js

@@ -6,6 +6,7 @@ import { createPicoClawAgentScaffold } from "./scaffold.js";
 import { createPicoClawCronStoreFile, createScheduleDiagnostics, scheduleOutcomeFor } from "./schedules.js";
 import { assertSupportedPicoClawSurfaces, buildPicoClawChannelConfig, buildPicoClawSurfaceEnvBindings } from "./surfaces.js";
 import { PICOCLAW_GATEWAY_BASE_PORT, PICOCLAW_INTERNAL_PICO_TOKEN } from "./pico.js";
+import { picoClawStatusProbes } from "./statusProbes.js";
 const formatModelName = (node) => {
     const primary = node.execution?.model?.primary;
     if (!primary)
@@ -55,6 +56,14 @@ const buildModelList = (node) => {
                 workspace: "<workspace-path>"
             };
         }
+        // Bake claude-cli (Claude Code subscription) auth at compile time so the
+        // image is self-sufficient; only the credential import is mounted at run.
+        if (target.provider === "anthropic" && target.auth.method === "claude-code") {
+            return {
+                model: `claude-cli/${target.name.replaceAll(".", "-")}`,
+                model_name: target.name
+            };
+        }
         return {
             ...(target.auth.method === "api_key"
                 ? {
@@ -230,6 +239,7 @@ export const picoClawAdapter = {
     name: "picoclaw",
     prepareRuntimeAuth: preparePicoClawRuntimeAuth,
     scaffoldAgentProject: createPicoClawAgentScaffold,
+    statusProbes: picoClawStatusProbes,
     validateRuntimeOptions(options) {
         if ("restrict_to_workspace" in options &&
             typeof options.restrict_to_workspace !== "boolean") {

package/dist/runtime/picoclaw/runAuth.d.ts

@@ -1,2 +1,9 @@
 import type { RuntimeAuthPreparationInput, RuntimeAuthPreparationResult } from "../types.js";
+/**
+ * PicoClaw claude-cli (Claude Code) auth: the claude-cli model config is baked
+ * into the image at compile time and the credential import (~/.claude) is
+ * mounted into the runtime home by the caller, so this only reports that the
+ * model secret is covered. No source rootfs is read, which is what lets it run
+ * for both project deployments and sourceless images.
+ */
 export declare const preparePicoClawRuntimeAuth: (input: RuntimeAuthPreparationInput) => Promise<RuntimeAuthPreparationResult>;

package/dist/runtime/picoclaw/runAuth.js

@@ -1,59 +1,11 @@
-import path from "node:path";
 import { loadImportedClaudeCodeCredential } from "../../auth/index.js";
-import { copyDirectory, ensureDirectory, readUtf8File, writeUtf8File } from "../../filesystem/index.js";
-const resolveRootfsSourcePath = (outputDirectory, containerPath) => path.join(outputDirectory, "container", "rootfs", ...path.posix.relative("/", containerPath).split("/"));
-const createMountArgs = (hostPath, containerPath) => [
-    "-v",
-    `${hostPath}:${containerPath}`
-];
-const createMountedHomeDirectory = async (input, patchedConfig) => {
-    const sourceHomePath = resolveRootfsSourcePath(input.outputDirectory, input.instance.home_path);
-    const mountedHomePath = path.join("runtime-auth", "picoclaw", input.instance.id, "home");
-    const hostHomePath = path.join(input.tempRoot, mountedHomePath);
-    await ensureDirectory(path.dirname(hostHomePath));
-    await copyDirectory(sourceHomePath, hostHomePath);
-    const relativeConfigPath = path.posix.relative(input.instance.home_path, input.instance.config_path);
-    const hostConfigPath = path.join(hostHomePath, ...relativeConfigPath.split("/"));
-    await ensureDirectory(path.dirname(hostConfigPath));
-    await writeUtf8File(hostConfigPath, `${JSON.stringify(patchedConfig, null, 2)}\n`);
-    return hostHomePath;
-};
-const normalizeClaudeCliModelName = (modelName) => modelName.replaceAll(".", "-");
-const patchPicoClawConfig = (config, options) => {
-    const agents = config.agents ?? {};
-    const defaults = agents.defaults ?? {};
-    const providers = (config.providers ?? {});
-    const modelList = Array.isArray(config.model_list) ? config.model_list : [];
-    const nextProviders = { ...providers };
-    const nextModelList = modelList.map((entry) => {
-        if (!entry || typeof entry !== "object") {
-            return entry;
-        }
-        const record = { ...entry };
-        const model = record.model;
-        const modelName = typeof record.model_name === "string" ? record.model_name : null;
-        if (options.useClaudeCode && typeof model === "string" && model.startsWith("anthropic/")) {
-            delete record.api_key;
-            delete record.auth_method;
-            if (modelName) {
-                record.model = `claude-cli/${normalizeClaudeCliModelName(modelName)}`;
-            }
-        }
-        return record;
-    });
-    if (options.useClaudeCode) {
-        delete nextProviders.anthropic;
-    }
-    return {
-        ...config,
-        agents: {
-            ...agents,
-            defaults
-        },
-        model_list: nextModelList,
-        providers: nextProviders
-    };
-};
+/**
+ * PicoClaw claude-cli (Claude Code) auth: the claude-cli model config is baked
+ * into the image at compile time and the credential import (~/.claude) is
+ * mounted into the runtime home by the caller, so this only reports that the
+ * model secret is covered. No source rootfs is read, which is what lets it run
+ * for both project deployments and sourceless images.
+ */
 export const preparePicoClawRuntimeAuth = async (input) => {
     if (!input.instance.home_path) {
         return { coveredModelSecrets: [], mountArgs: [] };
@@ -65,17 +17,5 @@ export const preparePicoClawRuntimeAuth = async (input) => {
     if (!useClaudeCode) {
         return { coveredModelSecrets: [], mountArgs: [] };
     }
-    const coveredModelSecrets = [];
-    if (useClaudeCode) {
-        coveredModelSecrets.push("ANTHROPIC_API_KEY");
-    }
-    const sourceConfig = JSON.parse(await readUtf8File(resolveRootfsSourcePath(input.outputDirectory, input.instance.config_path)));
-    const patchedConfig = patchPicoClawConfig(sourceConfig, {
-        useClaudeCode: Boolean(useClaudeCode)
-    });
-    const mountedHomePath = await createMountedHomeDirectory(input, patchedConfig);
-    return {
-        coveredModelSecrets,
-        mountArgs: createMountArgs(mountedHomePath, input.instance.home_path)
-    };
+    return { coveredModelSecrets: ["ANTHROPIC_API_KEY"], mountArgs: [] };
 };

package/dist/runtime/picoclaw/statusProbes.d.ts

@@ -0,0 +1,2 @@
+import type { RuntimeStatusProbe } from "../types.js";
+export declare const picoClawStatusProbes: RuntimeStatusProbe[];

package/dist/runtime/picoclaw/statusProbes.js

@@ -0,0 +1,100 @@
+import { createRuntimeHttpProbe, createRuntimePathProbe } from "../statusProbes.js";
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const toNumber = (value) => typeof value === "number" && Number.isFinite(value) ? value : null;
+const toString = (value) => typeof value === "string" ? value : null;
+const cronStorePathFor = (workspacePath) => workspacePath ? `${workspacePath}/cron/jobs.json` : null;
+const earliestNextRun = (parsed) => {
+    const jobs = isRecord(parsed) && Array.isArray(parsed.jobs) ? parsed.jobs : [];
+    const dueJobs = jobs.flatMap((job) => {
+        if (!isRecord(job)) {
+            return [];
+        }
+        const state = isRecord(job.state) ? job.state : {};
+        const nextRunAtMs = toNumber(state.nextRunAtMs ?? state.next_run_at_ms);
+        return nextRunAtMs === null
+            ? []
+            : [{ jobId: toString(job.id), nextRunAtMs }];
+    });
+    return dueJobs.sort((left, right) => left.nextRunAtMs - right.nextRunAtMs)[0] ?? null;
+};
+const formatIso = (epochMs) => new Date(epochMs).toISOString();
+const createPicoClawScheduleProbe = () => ({
+    id: "schedule-next-run",
+    label: "PicoClaw schedule next run",
+    async run(context) {
+        const cronStorePath = cronStorePathFor(context.instance.workspace_path);
+        if (!cronStorePath) {
+            return [{
+                    key: "schedule.next_run",
+                    message: "PicoClaw workspace path is not present in the compile report",
+                    severity: "unknown"
+                }];
+        }
+        try {
+            const result = await context.manager.exec(["cat", cronStorePath]);
+            const nextRun = earliestNextRun(JSON.parse(result.stdout));
+            if (!nextRun) {
+                return [{
+                        key: "schedule.next_run",
+                        message: `PicoClaw cron store ${cronStorePath} has no computed next run`,
+                        severity: "unknown"
+                    }];
+            }
+            return [{
+                    details: {
+                        job_id: nextRun.jobId,
+                        next_run_at: formatIso(nextRun.nextRunAtMs),
+                        next_run_at_ms: nextRun.nextRunAtMs
+                    },
+                    key: "schedule.next_run",
+                    message: `next scheduled PicoClaw wake for ${nextRun.jobId ?? "job"} at ${formatIso(nextRun.nextRunAtMs)}`,
+                    severity: "ok"
+                }];
+        }
+        catch (error) {
+            return [{
+                    key: "schedule.next_run",
+                    message: `PicoClaw cron store unavailable at ${cronStorePath}: ${error instanceof Error ? error.message : String(error)}`,
+                    severity: "unknown"
+                }];
+        }
+    }
+});
+export const picoClawStatusProbes = [
+    createRuntimePathProbe({
+        id: "home",
+        key: "runtime.home",
+        label: "PicoClaw home",
+        pathFor: (instance) => instance.home_path,
+        testFlag: "-d"
+    }),
+    createRuntimePathProbe({
+        id: "workspace",
+        key: "runtime.workspace",
+        label: "PicoClaw workspace",
+        pathFor: (instance) => instance.workspace_path,
+        testFlag: "-d"
+    }),
+    createRuntimePathProbe({
+        id: "config",
+        key: "runtime.config",
+        label: "PicoClaw config",
+        pathFor: (instance) => instance.config_path,
+        testFlag: "-f"
+    }),
+    createRuntimeHttpProbe({
+        id: "health",
+        key: "runtime.health",
+        label: "PicoClaw health",
+        path: "/health",
+        portFor: (instance) => instance.internal_port
+    }),
+    createRuntimeHttpProbe({
+        id: "ready",
+        key: "runtime.ready",
+        label: "PicoClaw readiness",
+        path: "/ready",
+        portFor: (instance) => instance.internal_port
+    }),
+    createPicoClawScheduleProbe()
+];

package/dist/runtime/registry.d.ts

@@ -11,11 +11,6 @@ export type RuntimeRegistryInstall = {
     binary: string;
     repository: string;
     tag: string;
-} | {
-    kind: "github_release_bundle";
-    asset: string;
-    repository: string;
-    tag: string;
 } | {
     kind: "npm";
     package: string;

package/dist/runtime/registry.js

@@ -4,11 +4,9 @@ import { z } from "zod";
 import { SpawnfileError } from "../shared/index.js";
 import { openClawAdapter } from "./openclaw/adapter.js";
 import { picoClawAdapter } from "./picoclaw/adapter.js";
-import { tinyClawAdapter } from "./tinyclaw/adapter.js";
 const runtimeAdapters = new Map([
     [openClawAdapter.name, openClawAdapter],
-    [picoClawAdapter.name, picoClawAdapter],
-    [tinyClawAdapter.name, tinyClawAdapter]
+    [picoClawAdapter.name, picoClawAdapter]
 ]);
 const runtimeInstallSchema = z.discriminatedUnion("kind", [
     z
@@ -34,14 +32,6 @@ const runtimeInstallSchema = z.discriminatedUnion("kind", [
         tag: z.string().min(1)
     })
         .strict(),
-    z
-        .object({
-        asset: z.string().min(1),
-        kind: z.literal("github_release_bundle"),
-        repository: z.string().min(1),
-        tag: z.string().min(1)
-    })
-        .strict(),
     z
         .object({
         kind: z.literal("source_repo")
@@ -106,7 +96,7 @@ export const hasRuntimeAdapter = (runtimeName) => runtimeAdapters.has(runtimeNam
 export const assertRuntimeCanCompile = async (runtimeName) => {
     const registeredRuntime = await getRegisteredRuntime(runtimeName);
     if (!registeredRuntime) {
-        throw new SpawnfileError("runtime_error", `Unknown runtime binding: ${runtimeName}`);
+        throw new SpawnfileError("validation_error", `Unknown runtime binding: ${runtimeName}`);
     }
     if (registeredRuntime.status === "exploratory") {
         throw new SpawnfileError("runtime_error", `Runtime ${runtimeName} is exploratory and cannot be compiled in v0.1`);

package/dist/runtime/statusProbes.d.ts

@@ -0,0 +1,16 @@
+import type { ContainerRuntimeInstanceReport } from "../report/index.js";
+import type { RuntimeStatusProbe } from "./types.js";
+export declare const createRuntimePathProbe: (input: {
+    id: string;
+    key: string;
+    label: string;
+    pathFor(instance: ContainerRuntimeInstanceReport): string | null | undefined;
+    testFlag: "-d" | "-e" | "-f";
+}) => RuntimeStatusProbe;
+export declare const createRuntimeHttpProbe: (input: {
+    id: string;
+    key: string;
+    label: string;
+    path: string;
+    portFor(instance: ContainerRuntimeInstanceReport): number | null | undefined;
+}) => RuntimeStatusProbe;

package/dist/runtime/statusProbes.js

@@ -0,0 +1,41 @@
+const observation = (key, severity, message) => ({ key, message, severity });
+const errorMessage = (error) => error instanceof Error ? error.message : String(error);
+export const createRuntimePathProbe = (input) => ({
+    id: input.id,
+    label: input.label,
+    async run(context) {
+        const targetPath = input.pathFor(context.instance);
+        if (!targetPath) {
+            return [
+                observation(input.key, "unknown", `${input.label} path is not present in the compile report`)
+            ];
+        }
+        try {
+            await context.manager.exec(["test", input.testFlag, targetPath]);
+            return [observation(input.key, "ok", `${input.label} exists at ${targetPath}`)];
+        }
+        catch (error) {
+            return [
+                observation(input.key, "error", `${input.label} missing at ${targetPath}: ${errorMessage(error)}`)
+            ];
+        }
+    }
+});
+export const createRuntimeHttpProbe = (input) => ({
+    id: input.id,
+    label: input.label,
+    async run(context) {
+        const port = input.portFor(context.instance);
+        if (!port) {
+            return [
+                observation(input.key, "unknown", `${input.label} port is not present in the compile report`)
+            ];
+        }
+        const response = await context.manager.httpGet(port, input.path);
+        return [
+            response.ok
+                ? observation(input.key, "ok", `${input.label} responded on ${input.path}`)
+                : observation(input.key, "error", `${input.label} failed on ${input.path}: ${response.error ?? "request failed"}`)
+        ];
+    }
+});

package/dist/runtime/types.d.ts

@@ -3,6 +3,8 @@ import type { ResolvedAuthProfile } from "../auth/index.js";
 import type { AgentManifest } from "../manifest/index.js";
 import type { CapabilityReport, DiagnosticReport } from "../report/index.js";
 import type { ContainerRuntimeInstanceReport } from "../report/index.js";
+import type { DeploymentRecord, DockerUnitInspection } from "../deployment/index.js";
+import type { ModelAuthMethod } from "../shared/index.js";
 export interface EmittedFile {
     content: string;
     mode?: number;
@@ -38,6 +40,7 @@ export interface RuntimeContainerInstancePaths {
 }
 export interface RuntimeContainerConfigEnvBinding {
     envName: string;
+    generated?: boolean;
     jsonPath: string;
 }
 export interface RuntimeContainerMeta {
@@ -46,6 +49,7 @@ export interface RuntimeContainerMeta {
     configPathEnv?: string;
     env?: Array<{
         description: string;
+        generated?: boolean;
         name: string;
         required: boolean;
     }>;
@@ -60,10 +64,24 @@ export interface RuntimeContainerMeta {
     staticEnv?: Record<string, string>;
     systemDeps: string[];
 }
+/**
+ * The minimal runtime-instance shape an auth preparer needs. Both the compile
+ * report's `ContainerRuntimeInstanceReport` and the distribution report's
+ * runtime instances structurally satisfy this, so sourceless image consumption
+ * can reuse the same preparers without casting through compiler-only types.
+ */
+export interface RuntimeAuthInstance {
+    config_path: string;
+    home_path: string | null;
+    id: string;
+    model_auth_methods: Record<string, ModelAuthMethod>;
+    model_secrets_required: string[];
+    runtime: string;
+}
 export interface RuntimeAuthPreparationInput {
     authProfile: ResolvedAuthProfile;
     env: Record<string, string>;
-    instance: ContainerRuntimeInstanceReport;
+    instance: RuntimeAuthInstance;
     outputDirectory: string;
     tempRoot: string;
 }
@@ -71,6 +89,38 @@ export interface RuntimeAuthPreparationResult {
     coveredModelSecrets: string[];
     mountArgs: string[];
 }
+export interface RuntimeProbeExecResult {
+    stderr: string;
+    stdout: string;
+}
+export interface RuntimeProbeHttpResult {
+    body: string;
+    error?: string;
+    ok: boolean;
+}
+export interface RuntimeProbeGateway {
+    exec(command: string[]): Promise<RuntimeProbeExecResult>;
+    httpGet(port: number, requestPath: string, headers?: Record<string, string>): Promise<RuntimeProbeHttpResult>;
+    inspectUnit(): Promise<DockerUnitInspection>;
+}
+export interface RuntimeProbeObservation {
+    details?: Record<string, unknown>;
+    key: string;
+    message: string;
+    severity: "error" | "ok" | "unknown" | "warn";
+}
+export interface RuntimeStatusProbeContext {
+    deployment: DeploymentRecord;
+    instance: ContainerRuntimeInstanceReport;
+    manager: RuntimeProbeGateway;
+    timeoutMs: number;
+    unit: DeploymentRecord["units"][number];
+}
+export interface RuntimeStatusProbe {
+    id: string;
+    label: string;
+    run(context: RuntimeStatusProbeContext): Promise<RuntimeProbeObservation[]>;
+}
 export interface RuntimeSystemInstructionSurfaceInput {
     node: ResolvedAgentNode;
 }
@@ -94,6 +144,7 @@ export interface RuntimeAdapter {
     name: string;
     prepareRuntimeAuth?(input: RuntimeAuthPreparationInput): Promise<RuntimeAuthPreparationResult>;
     scaffoldAgentProject?(): RuntimeAgentScaffold;
+    statusProbes?: RuntimeStatusProbe[];
     systemInstructionSurface?: RuntimeSystemInstructionSurface;
     validateRuntimeOptions?(options: Record<string, unknown>): DiagnosticReport[];
 }

package/dist/shared/errors.d.ts

@@ -4,3 +4,9 @@ export declare class SpawnfileError extends Error {
     constructor(code: SpawnfileErrorCode, message: string);
 }
 export declare const isSpawnfileError: (value: unknown) => value is SpawnfileError;
+/**
+ * Maps an error to the shared CLI exit-code convention: 2 for usage/input
+ * errors, 1 for runtime failures. Used wherever the CLI turns a caught error
+ * into a process exit code, so every path agrees (see specs/SPEC.md §9.1).
+ */
+export declare const errorExitCode: (error: unknown) => 1 | 2;

package/dist/shared/errors.js

@@ -7,3 +7,12 @@ export class SpawnfileError extends Error {
     }
 }
 export const isSpawnfileError = (value) => value instanceof SpawnfileError;
+// Codes that mean the input itself was bad (usage/input errors → exit 2).
+// Everything else is a runtime failure that surfaced after validation (→ exit 1).
+const USAGE_ERROR_CODES = new Set(["validation_error", "invalid_manifest"]);
+/**
+ * Maps an error to the shared CLI exit-code convention: 2 for usage/input
+ * errors, 1 for runtime failures. Used wherever the CLI turns a caught error
+ * into a process exit code, so every path agrees (see specs/SPEC.md §9.1).
+ */
+export const errorExitCode = (error) => isSpawnfileError(error) && USAGE_ERROR_CODES.has(error.code) ? 2 : 1;

package/dist/status/buildStatus.d.ts

@@ -0,0 +1,13 @@
+import { type LoadedCompileReport } from "./compileReport.js";
+import type { StaticStatus, StatusDeploymentSummary, StatusExitCode, StatusLiveRequest, StatusObservation, StatusObservationCounts, StatusSelection } from "./types.js";
+export declare const countObservations: (observations: StatusObservation[]) => StatusObservationCounts;
+export declare const getVisibleObservations: (status: StaticStatus) => StatusObservation[];
+export declare const exitCodeForStatus: (status: StaticStatus) => StatusExitCode;
+export declare const createStaticStatus: (view: StaticStatus["view"], loadedReport: LoadedCompileReport, input: {
+    deployments?: StatusDeploymentSummary[];
+    inputPath: string;
+    liveObservations?: StatusObservation[];
+    live?: StatusLiveRequest;
+    outputDirectory: string;
+    selection: StatusSelection | null;
+}) => StaticStatus;