spawnfile 0.1.11 → 0.1.13

package/dist/compiler/containerEntrypointRender.js

@@ -1,5 +1,6 @@
 import path from "node:path";
 import { resolveMoltnetStorePath } from "./moltnetConfigLowering.js";
+import { networkUrlEnvName } from "./networkBinding.js";
 import { createWorkspaceResourceCommands, createWorkspaceResourceShellFunctions } from "./containerWorkspaceResourceRender.js";
 const MOLTNET_SERVER_DATA_DIRECTORY = "/var/lib/spawnfile/moltnet/servers";
 const shellQuote = (value) => `'${value.replace(/'/g, `'\"'\"'`)}'`;
@@ -8,9 +9,9 @@ const createEnvironmentAssignments = (plan) => {
     if (plan.instancePaths.homePath) {
         envAssignments.push(`HOME=${shellQuote(plan.instancePaths.homePath)}`);
     }
-    if (plan.instancePaths.homePath && ((plan.runtimeName === "tinyclaw" &&
-        (plan.modelAuthMethods.openai === "api_key" || plan.modelAuthMethods.openai === "codex")) ||
-        (plan.runtimeName === "picoclaw" && plan.modelAuthMethods.openai === "codex"))) {
+    if (plan.instancePaths.homePath &&
+        plan.runtimeName === "picoclaw" &&
+        plan.modelAuthMethods.openai === "codex") {
         envAssignments.push(`CODEX_HOME=${shellQuote(path.posix.join(plan.instancePaths.homePath, ".codex"))}`);
     }
     if (plan.meta.homeEnv && plan.instancePaths.homePath) {
@@ -29,14 +30,6 @@ const createEnvironmentAssignments = (plan) => {
 };
 const createEnvFileWrites = (plan) => plan.envFiles.map((binding) => `write_env_file ${shellQuote(binding.envName)} ${shellQuote(binding.filePath)}`);
 const createConfigEnvWrites = (plan) => (plan.configEnvBindings ?? []).map((binding) => `apply_json_env_value ${shellQuote(plan.instancePaths.configPath)} ${shellQuote(binding.envName)} ${shellQuote(binding.jsonPath)}`);
-const createAuthSetupCommands = (plan) => {
-    if (plan.runtimeName !== "tinyclaw" ||
-        !plan.instancePaths.homePath ||
-        plan.modelAuthMethods.openai !== "api_key") {
-        return [];
-    }
-    return [`configure_codex_api_key_auth ${shellQuote(plan.instancePaths.homePath)}`];
-};
 const createMoltnetStorePrepareCommands = (serverPlan) => {
     const server = serverPlan.server;
     if (server.mode !== "managed" || server.store.kind === "memory" || server.store.kind === "postgres") {
@@ -50,11 +43,14 @@ const createMoltnetStorePrepareCommands = (serverPlan) => {
 };
 const resolveStartCommand = (plan) => plan.meta.startCommand
     .map((token) => token
+    .replaceAll("<config-path>", plan.instancePaths.configPath)
+    .replaceAll("<home-path>", plan.instancePaths.homePath ?? "")
     .replaceAll("<runtime-root>", plan.runtimeRoot)
+    .replaceAll("<workspace-path>", plan.instancePaths.workspacePath)
     .replaceAll("<port>", plan.port ? String(plan.port) : ""))
     .filter((token) => token.length > 0);
 const createRuntimeReadinessWait = (plan) => {
-    if (plan.runtimeName !== "openclaw" || !plan.port) {
+    if (!["openclaw", "pi"].includes(plan.runtimeName) || !plan.port) {
         return [];
     }
     return [
@@ -145,15 +141,6 @@ export const renderEntrypoint = (runtimePlans, requiredSecrets, options = {}) =>
         "PY",
         "}",
         "",
-        "configure_codex_api_key_auth() {",
-        '  local home_path="$1"',
-        '  if [ -z "${OPENAI_API_KEY:-}" ]; then',
-        "    return",
-        "  fi",
-        '  mkdir -p "$home_path/.codex"',
-        '  printf "%s\\n" "${OPENAI_API_KEY:-}" | HOME="$home_path" CODEX_HOME="$home_path/.codex" codex login --with-api-key >/dev/null',
-        "}",
-        "",
         ...createWorkspaceResourceShellFunctions()
     ];
     lines.push('if [ -n "${OPENCLAW_GATEWAY_TOKEN:-}" ] && [ -z "${OPENCLAW_HOOKS_TOKEN:-}" ]; then', '  export OPENCLAW_HOOKS_TOKEN="hooks-${OPENCLAW_GATEWAY_TOKEN}"', "fi", "");
@@ -171,7 +158,7 @@ export const renderEntrypoint = (runtimePlans, requiredSecrets, options = {}) =>
         const plan = runtimePlans[0];
         const commandTokens = resolveStartCommand(plan);
         const envAssignments = createEnvironmentAssignments(plan);
-        lines.push(`mkdir -p ${shellQuote(plan.instancePaths.workspacePath)}`, ...createWorkspaceResourceCommands(plan), `require_file ${shellQuote(plan.instancePaths.configPath)}`, ...createEnvFileWrites(plan), ...createConfigEnvWrites(plan), ...createAuthSetupCommands(plan), `${envAssignments.join(" ")} exec ${commandTokens.map(shellQuote).join(" ")}`);
+        lines.push(`mkdir -p ${shellQuote(plan.instancePaths.workspacePath)}`, ...createWorkspaceResourceCommands(plan), `require_file ${shellQuote(plan.instancePaths.configPath)}`, ...createEnvFileWrites(plan), ...createConfigEnvWrites(plan), `${envAssignments.join(" ")} exec ${commandTokens.map(shellQuote).join(" ")}`);
         return `${lines.join("\n").trimEnd()}\n`;
     }
     lines.push("PIDS=()", "", "terminate_children() {", '  for pid in "${PIDS[@]:-}"; do', '    kill "$pid" 2>/dev/null || true', "  done", "}", "", "trap terminate_children INT TERM EXIT", "");
@@ -183,25 +170,28 @@ export const renderEntrypoint = (runtimePlans, requiredSecrets, options = {}) =>
         if (!serverPlan.configPath) {
             continue;
         }
+        const urlEnv = networkUrlEnvName(serverPlan.networkId);
+        const serverLines = [];
         for (const patch of serverPlan.secretPatches) {
-            lines.push(`apply_json_env_value ${shellQuote(serverPlan.configPath)} ${shellQuote(patch.envName)} ${shellQuote(patch.jsonPath)}`);
+            serverLines.push(`apply_json_env_value ${shellQuote(serverPlan.configPath)} ${shellQuote(patch.envName)} ${shellQuote(patch.jsonPath)}`);
         }
-        lines.push(...createMoltnetStorePrepareCommands(serverPlan), `MOLTNET_CONFIG=${shellQuote(serverPlan.configPath)} /usr/local/bin/moltnet &`, 'PIDS+=("$!")', "");
-    }
-    for (const serverPlan of managedMoltnetServerPlans) {
-        if (!serverPlan.port) {
-            continue;
+        serverLines.push(...createMoltnetStorePrepareCommands(serverPlan), `MOLTNET_CONFIG=${shellQuote(serverPlan.configPath)} /usr/local/bin/moltnet &`, 'PIDS+=("$!")');
+        if (serverPlan.port) {
+            serverLines.push(`until curl -sf ${shellQuote(`http://127.0.0.1:${serverPlan.port}/healthz`)} >/dev/null; do sleep 1; done`);
         }
-        lines.push(`until curl -sf ${shellQuote(`http://127.0.0.1:${serverPlan.port}/healthz`)} >/dev/null; do sleep 1; done`);
-        lines.push("");
+        // Suppress the in-image managed server when an external endpoint is bound.
+        lines.push(`if [ -z "\${${urlEnv}:-}" ]; then`, ...serverLines.map((line) => `  ${line}`), "fi", "");
     }
     for (const plan of runtimePlans) {
         const commandTokens = resolveStartCommand(plan);
         const envAssignments = createEnvironmentAssignments(plan);
-        lines.push(`mkdir -p ${shellQuote(plan.instancePaths.workspacePath)}`, ...createWorkspaceResourceCommands(plan), `require_file ${shellQuote(plan.instancePaths.configPath)}`, ...createEnvFileWrites(plan), ...createConfigEnvWrites(plan), ...createAuthSetupCommands(plan), `${envAssignments.join(" ")} ${commandTokens.map(shellQuote).join(" ")} &`, 'PIDS+=("$!")', "", ...createRuntimeReadinessWait(plan));
+        lines.push(`mkdir -p ${shellQuote(plan.instancePaths.workspacePath)}`, ...createWorkspaceResourceCommands(plan), `require_file ${shellQuote(plan.instancePaths.configPath)}`, ...createEnvFileWrites(plan), ...createConfigEnvWrites(plan), `${envAssignments.join(" ")} ${commandTokens.map(shellQuote).join(" ")} &`, 'PIDS+=("$!")', "", ...createRuntimeReadinessWait(plan));
     }
     for (const nodePlan of moltnetNodePlans) {
-        lines.push(`/usr/local/bin/moltnet node ${shellQuote(nodePlan.configPath)} &`, 'PIDS+=("$!")', "");
+        const urlEnv = networkUrlEnvName(nodePlan.networkId);
+        lines.push(
+        // Rebind the bridge endpoint when an external network URL is provided.
+        `if [ -n "\${${urlEnv}:-}" ]; then`, `  apply_json_env_value ${shellQuote(nodePlan.configPath)} ${shellQuote(urlEnv)} ${shellQuote("moltnet.base_url")}`, "fi", `/usr/local/bin/moltnet node ${shellQuote(nodePlan.configPath)} &`, 'PIDS+=("$!")', "");
     }
     lines.push('if [ "${#PIDS[@]}" -eq 0 ]; then', '  echo "No runtime targets were generated for this compile output" >&2', "  exit 1", "fi", "", "status=0", 'for pid in "${PIDS[@]}"; do', '  if ! wait "$pid"; then', "    status=1", "  fi", "done", "", 'exit "$status"');
     return `${lines.join("\n").trimEnd()}\n`;

package/dist/compiler/containerPackageRender.d.ts

@@ -0,0 +1,15 @@
+import type { RuntimeTargetPlan } from "./containerArtifactsTypes.js";
+import type { ResolvedPackage } from "./types.js";
+export interface PackagesByManager {
+    apt: ResolvedPackage[];
+    npm: ResolvedPackage[];
+    pipx: ResolvedPackage[];
+}
+export declare const createPackageInstallCommand: (packages: string[]) => string;
+export declare const createNpmPackageInstallCommand: (packages: string[]) => string;
+export declare const createPipxPackageInstallCommand: (packages: string[]) => string;
+export declare const createAptPackageInstallItem: (pkg: ResolvedPackage) => string;
+export declare const createNpmPackageInstallItem: (pkg: ResolvedPackage) => string;
+export declare const createPipxPackageInstallItem: (pkg: ResolvedPackage) => string;
+export declare const getNpmInstallItemName: (item: string) => string;
+export declare const collectPackagesByManager: (runtimePlans: RuntimeTargetPlan[]) => PackagesByManager;

package/dist/compiler/containerPackageRender.js

@@ -0,0 +1,63 @@
+import { SpawnfileError } from "../shared/index.js";
+export const createPackageInstallCommand = (packages) => `RUN apt-get update && apt-get install -y --no-install-recommends ${packages.join(" ")} && rm -rf /var/lib/apt/lists/*`;
+export const createNpmPackageInstallCommand = (packages) => `RUN npm install -g --omit=dev --no-fund --no-audit ${packages.join(" ")}`;
+export const createPipxPackageInstallCommand = (packages) => `RUN PIPX_HOME=/opt/pipx PIPX_BIN_DIR=/usr/local/bin pipx install ${packages.join(" ")}`;
+const packageIdentity = (pkg) => `${pkg.manager}\u0000${pkg.name}\u0000${pkg.version ?? ""}\u0000${pkg.scope ?? ""}`;
+const packageConflictIdentity = (pkg) => `${pkg.manager}\u0000${pkg.name}`;
+const dedupePackages = (packages) => {
+    const seen = new Map();
+    for (const currentPackage of packages) {
+        seen.set(packageIdentity(currentPackage), currentPackage);
+    }
+    return [...seen.values()].sort((left, right) => packageIdentity(left).localeCompare(packageIdentity(right)));
+};
+const assertImagePackageCompatibility = (packages) => {
+    const byName = new Map();
+    for (const currentPackage of packages) {
+        const conflictIdentity = packageConflictIdentity(currentPackage);
+        const existingPackage = byName.get(conflictIdentity);
+        if (!existingPackage) {
+            byName.set(conflictIdentity, currentPackage);
+            continue;
+        }
+        if (packageIdentity(existingPackage) !== packageIdentity(currentPackage)) {
+            throw new SpawnfileError("validation_error", `Generated container declares conflicting package definitions for ${currentPackage.manager} package ${currentPackage.name}`);
+        }
+    }
+};
+export const createAptPackageInstallItem = (pkg) => pkg.version ? `${pkg.name}=${pkg.version}` : pkg.name;
+export const createNpmPackageInstallItem = (pkg) => pkg.version ? `${pkg.name}@${pkg.version}` : pkg.name;
+export const createPipxPackageInstallItem = (pkg) => pkg.version ? `${pkg.name}==${pkg.version}` : pkg.name;
+export const getNpmInstallItemName = (item) => {
+    if (!item.startsWith("@")) {
+        const versionMarker = item.indexOf("@");
+        return versionMarker === -1 ? item : item.slice(0, versionMarker);
+    }
+    const slashIndex = item.indexOf("/");
+    if (slashIndex === -1) {
+        return item;
+    }
+    const versionMarker = item.indexOf("@", slashIndex);
+    return versionMarker === -1 ? item : item.slice(0, versionMarker);
+};
+export const collectPackagesByManager = (runtimePlans) => {
+    const packagesByManager = {
+        apt: [],
+        npm: [],
+        pipx: []
+    };
+    const imagePackages = runtimePlans.flatMap((plan) => plan.packages ?? []);
+    assertImagePackageCompatibility(imagePackages);
+    for (const packageConfig of dedupePackages(imagePackages)) {
+        if (packageConfig.manager === "apt") {
+            packagesByManager.apt.push(packageConfig);
+            continue;
+        }
+        if (packageConfig.manager === "npm") {
+            packagesByManager.npm.push(packageConfig);
+            continue;
+        }
+        packagesByManager.pipx.push(packageConfig);
+    }
+    return packagesByManager;
+};

package/dist/compiler/containerTargetResources.js

@@ -4,13 +4,15 @@ import { mergeWorkspaceResourcePlans } from "./workspaceResources.js";
 const CONFIG_FILE_PLACEHOLDER = "<config-file>";
 const INSTANCE_ROOT_PLACEHOLDER = "<instance-root>";
 const SOURCE_AGENT_PLACEHOLDER = "<agent-name>";
+const SOURCE_SLUG_PLACEHOLDER = "<source-slug>";
 const replaceSourceWorkspacePathTemplate = (template, input, instancePaths, meta) => {
     const agentName = input.value.kind === "agent" ? input.value.name : input.slug;
     const instanceRoot = instancePaths.instanceRoot ?? path.posix.dirname(instancePaths.workspacePath);
     return template
         .replaceAll(INSTANCE_ROOT_PLACEHOLDER, instanceRoot)
         .replaceAll(CONFIG_FILE_PLACEHOLDER, meta.configFileName)
-        .replaceAll(SOURCE_AGENT_PLACEHOLDER, agentName);
+        .replaceAll(SOURCE_AGENT_PLACEHOLDER, agentName)
+        .replaceAll(SOURCE_SLUG_PLACEHOLDER, input.slug);
 };
 const resolveSourceWorkspacePath = (input, instancePaths, meta) => meta.instancePaths.sourceWorkspacePathTemplate
     ? replaceSourceWorkspacePathTemplate(meta.instancePaths.sourceWorkspacePathTemplate, input, instancePaths, meta)

package/dist/compiler/index.d.ts

@@ -1,6 +1,7 @@
 export * from "./addProjectNode.js";
 export * from "./buildCompilePlan.js";
 export * from "./buildProject.js";
+export * from "./publishProject.js";
 export * from "./upProject.js";
 export * from "./compileProject.js";
 export * from "./initProject.js";

package/dist/compiler/index.js

@@ -1,6 +1,7 @@
 export * from "./addProjectNode.js";
 export * from "./buildCompilePlan.js";
 export * from "./buildProject.js";
+export * from "./publishProject.js";
 export * from "./upProject.js";
 export * from "./compileProject.js";
 export * from "./initProject.js";

package/dist/compiler/moltnetArtifacts.js

@@ -1,5 +1,6 @@
 import { SpawnfileError } from "../shared/index.js";
-import { createMoltnetOpenTokenDirectory, createMoltnetNativeServerConfig, createMoltnetNodeConfigPath, createMoltnetServerConfigPath, resolveMoltnetBaseUrl, resolveMoltnetStorePersistenceMountPath } from "./moltnetConfigLowering.js";
+import { createMoltnetOpenTokenDirectory, createMoltnetNativeServerConfig, createMoltnetNodeConfigPath, createMoltnetServerConfigPath, resolveMoltnetClientAuth, resolveMoltnetBaseUrl, resolveMoltnetStorePersistenceMountPath } from "./moltnetConfigLowering.js";
+import { assertNetworkBindingEnvUniqueness } from "./networkBinding.js";
 import { listConcreteMoltnetRoomMemberIds } from "./moltnetRoomMemberships.js";
 import { assertCompatibleMoltnetNetworkName, assertCompatibleMoltnetRoomPolicy, assertCompatibleMoltnetServer } from "./moltnetRoomPolicyCompatibility.js";
 import { createMoltnetNodeConfigContent } from "./moltnetNodeConfig.js";
@@ -177,6 +178,21 @@ export const generateMoltnetArtifacts = async (plan) => {
                 throw new SpawnfileError("validation_error", `Duplicate Moltnet node attachment for ${attachment.network}/${attachment.memberId}`);
             }
             nodePlanKeys.add(nodePlanKey);
+            if (agentNode.runtime.name === "pi") {
+                const clientAuth = resolveMoltnetClientAuth(serverPlan.server, attachment.network, attachment.memberId, node.slug);
+                const usesPerAttachmentOpenToken = clientAuth.mode === "open" &&
+                    clientAuth.staticToken !== true &&
+                    Boolean(clientAuth.tokenEnv || clientAuth.tokenPath);
+                if (usesPerAttachmentOpenToken && clientAuth.tokenPath) {
+                    const mountId = `agent-${node.slug}-moltnet-tokens`;
+                    addPersistentMount({
+                        id: mountId,
+                        mountPath: createMoltnetOpenTokenDirectory(node.slug),
+                        reason: `Moltnet open-mode generated agent tokens for ${agentNode.name}`,
+                        volumeName: createPersistentVolumeName(plan.root, mountId)
+                    });
+                }
+            }
             const nodeConfig = createMoltnetNodeConfigContent({
                 agentNode,
                 attachment: { ...attachment, memberId: attachment.memberId },
@@ -207,6 +223,10 @@ export const generateMoltnetArtifacts = async (plan) => {
         }
     }
     const managedServerPlans = [...serverPlans.values()].filter((serverPlan) => serverPlan.mode === "managed");
+    assertNetworkBindingEnvUniqueness([...serverPlans.values()].map((serverPlan) => ({
+        id: serverPlan.networkId,
+        members: [...new Set(serverPlan.rooms.flatMap((room) => room.members))]
+    })));
     return {
         files: configFiles,
         nodePlans: nodePlans.sort((left, right) => left.configPath.localeCompare(right.configPath)),

package/dist/compiler/moltnetBinaries.d.ts

@@ -1,4 +1,7 @@
 export declare const MOLTNET_BIN_DIRECTORY = "moltnet-bin";
 export declare const MOLTNET_BINARY_NAMES: readonly ["moltnet"];
+export type MoltnetTargetArchitecture = "amd64" | "arm64";
 export declare const resolveMoltnetCliCommand: () => Promise<string>;
-export declare const stageMoltnetBinaries: (outputDirectory: string) => Promise<boolean>;
+export declare const stageMoltnetBinaries: (outputDirectory: string, options?: {
+    architecture?: MoltnetTargetArchitecture;
+}) => Promise<boolean>;

package/dist/compiler/moltnetBinaries.js

@@ -7,11 +7,32 @@ import { SpawnfileError } from "../shared/index.js";
 const execFile = promisify(execFileCallback);
 const MOLTNET_CLI_ENV = "SPAWNFILE_MOLTNET_CLI";
 const MOLTNET_RELEASE_DIR_ENV = "SPAWNFILE_MOLTNET_RELEASE_DIR";
+const MOLTNET_TARGET_ARCH_ENV = "SPAWNFILE_MOLTNET_TARGET_ARCH";
 const LOCAL_MOLTNET_CLI_PATH = path.resolve(process.cwd(), "moltnet", "bin", "moltnet");
 const MOLTNET_TARGET_OS = "linux";
 export const MOLTNET_BIN_DIRECTORY = "moltnet-bin";
 export const MOLTNET_BINARY_NAMES = ["moltnet"];
-const resolveTargetArchitecture = () => {
+const normalizeTargetArchitecture = (architecture) => {
+    switch (architecture) {
+        case "amd64":
+        case "x86_64":
+        case "x64":
+            return "amd64";
+        case "aarch64":
+        case "arm64":
+            return "arm64";
+        default:
+            throw new SpawnfileError("compile_error", `Moltnet container installs do not support target architecture ${architecture}`);
+    }
+};
+const resolveTargetArchitecture = (architecture) => {
+    if (architecture) {
+        return architecture;
+    }
+    const configuredArchitecture = process.env[MOLTNET_TARGET_ARCH_ENV]?.trim();
+    if (configuredArchitecture) {
+        return normalizeTargetArchitecture(configuredArchitecture);
+    }
     switch (process.arch) {
         case "arm64":
             return "arm64";
@@ -73,12 +94,12 @@ export const resolveMoltnetCliCommand = async () => {
     }
     return validateMoltnetCli("moltnet", "PATH");
 };
-export const stageMoltnetBinaries = async (outputDirectory) => {
+export const stageMoltnetBinaries = async (outputDirectory, options = {}) => {
     const releaseDirectory = await resolveConfiguredReleaseDirectory();
     if (!releaseDirectory) {
         return false;
     }
-    const architecture = resolveTargetArchitecture();
+    const architecture = resolveTargetArchitecture(options.architecture);
     const releaseAssetPath = path.join(releaseDirectory, createReleaseAssetName(architecture));
     if (!(await fileExists(releaseAssetPath))) {
         throw new SpawnfileError("compile_error", `Moltnet release asset ${releaseAssetPath} does not exist. Build it with \`cd moltnet && make release-assets\` or set ${MOLTNET_RELEASE_DIR_ENV}.`);

package/dist/compiler/moltnetClientConfig.d.ts

@@ -7,5 +7,5 @@ export interface MoltnetWorkspaceLayout {
     skillPaths: string[];
     workspaceRootPath: string;
 }
-export declare const resolveMoltnetWorkspaceLayout: (runtimeName: string, agentName: string) => MoltnetWorkspaceLayout;
+export declare const resolveMoltnetWorkspaceLayout: (runtimeName: string, _agentName: string) => MoltnetWorkspaceLayout;
 export declare const createMoltnetClientConfigFiles: (node: ResolvedAgentNode, artifacts: MoltnetArtifacts, agentSlug?: string) => EmittedFile[];

package/dist/compiler/moltnetClientConfig.js

@@ -38,8 +38,7 @@ const createAttachmentConfig = (node, artifacts, attachment, agentSlug) => {
             ? {
                 dms: {
                     enabled: attachment.dms.enabled,
-                    ...(attachment.dms.read ? { read: attachment.dms.read } : {}),
-                    ...(attachment.dms.reply ? { reply: attachment.dms.reply } : {})
+                    ...(attachment.dms.wake ? { wake: attachment.dms.wake } : {})
                 }
             }
             : {}),
@@ -56,32 +55,31 @@ const createAttachmentConfig = (node, artifacts, attachment, agentSlug) => {
                         id: roomId,
                         ...(room?.visibility ? { visibility: room.visibility } : {}),
                         ...(room?.write_policy ? { write_policy: room.write_policy } : {}),
-                        ...(policy.read ? { read: policy.read } : {}),
-                        ...(policy.reply ? { reply: policy.reply } : {})
+                        ...(policy.wake ? { wake: policy.wake } : {})
                     };
                 })
             }
             : {})
     };
 };
-export const resolveMoltnetWorkspaceLayout = (runtimeName, agentName) => {
-    if (runtimeName === "openclaw" || runtimeName === "picoclaw") {
+export const resolveMoltnetWorkspaceLayout = (runtimeName, _agentName) => {
+    if (runtimeName === "daimon" || runtimeName === "pi") {
         return {
-            clientConfigPath: `workspace/${GENERATED_CONFIG_PATH}`,
-            cliRuntime: runtimeName,
-            skillPaths: [`workspace/skills/${GENERATED_SKILL_NAME}/SKILL.md`],
+            clientConfigPath: `workspace/.moltnet/config.json`,
+            cliRuntime: "codex",
+            skillPaths: [
+                `workspace/.agents/skills/${GENERATED_SKILL_NAME}/SKILL.md`,
+                `workspace/.codex/skills/${GENERATED_SKILL_NAME}/SKILL.md`
+            ],
             workspaceRootPath: "workspace"
         };
     }
-    if (runtimeName === "tinyclaw") {
+    if (runtimeName === "openclaw" || runtimeName === "picoclaw") {
         return {
-            clientConfigPath: `workspace/${agentName}/${GENERATED_CONFIG_PATH}`,
+            clientConfigPath: `workspace/${GENERATED_CONFIG_PATH}`,
             cliRuntime: runtimeName,
-            skillPaths: [
-                `workspace/${agentName}/.agents/skills/${GENERATED_SKILL_NAME}/SKILL.md`,
-                `workspace/${agentName}/.claude/skills/${GENERATED_SKILL_NAME}/SKILL.md`
-            ],
-            workspaceRootPath: `workspace/${agentName}`
+            skillPaths: [`workspace/skills/${GENERATED_SKILL_NAME}/SKILL.md`],
+            workspaceRootPath: "workspace"
         };
     }
     throw new SpawnfileError("compile_error", `Moltnet client config does not know how to emit files for runtime ${runtimeName}`);

package/dist/compiler/moltnetNodeConfig.js

@@ -47,8 +47,7 @@ export const createMoltnetNodeConfigContent = ({ agentNode, attachment, networkS
                                     id: roomId,
                                     ...(room?.visibility ? { visibility: room.visibility } : {}),
                                     ...(room?.write_policy ? { write_policy: room.write_policy } : {}),
-                                    ...(policy.read ? { read: policy.read } : {}),
-                                    ...(policy.reply ? { reply: policy.reply } : {})
+                                    ...(policy.wake ? { wake: policy.wake } : {})
                                 };
                             })
                         }
@@ -57,8 +56,7 @@ export const createMoltnetNodeConfigContent = ({ agentNode, attachment, networkS
                         ? {
                             dms: {
                                 enabled: attachment.dms.enabled,
-                                ...(attachment.dms.read ? { read: attachment.dms.read } : {}),
-                                ...(attachment.dms.reply ? { reply: attachment.dms.reply } : {})
+                                ...(attachment.dms.wake ? { wake: attachment.dms.wake } : {})
                             }
                         }
                         : {})

package/dist/compiler/moltnetResolution.js

@@ -52,7 +52,7 @@ const synthesizeRepresentativeAttachments = (memberships) => memberships
     teamSource: membership.declaringTeamSource
 }));
 const roomPolicyKey = (policy) => JSON.stringify(policy ?? {});
-const hasRoomPolicy = (policy) => policy.read !== undefined || policy.reply !== undefined;
+const hasRoomPolicy = (policy) => policy.wake !== undefined;
 const mergeAttachment = (target, next, nodeName) => {
     if (target.dms &&
         next.dms &&

package/dist/compiler/moltnetRoomMemberships.js

@@ -16,8 +16,7 @@ const findTeamBySource = (plan, source) => {
     return node.value;
 };
 const clonePolicy = (policy) => ({
-    ...(policy.read ? { read: policy.read } : {}),
-    ...(policy.reply ? { reply: policy.reply } : {})
+    ...(policy.wake ? { wake: policy.wake } : {})
 });
 const findDirectRoomPolicy = (plan, teamNode, agentSource, memberId, networkId, roomId) => {
     const agentNode = findAgentBySource(plan, agentSource);

package/dist/compiler/moltnetRuntimeConfig.d.ts

@@ -1,2 +1,2 @@
 import type { CompilePlan, ResolvedAgentNode } from "./types.js";
-export declare const resolveRuntimeConfig: (plan: CompilePlan, agentNode: ResolvedAgentNode, nodeSlug: string, networkId: string, agentId: string) => Record<string, string>;
+export declare const resolveRuntimeConfig: (plan: CompilePlan, agentNode: ResolvedAgentNode, nodeSlug: string, _networkId: string, _agentId: string) => Record<string, string>;

package/dist/compiler/moltnetRuntimeConfig.js

@@ -1,6 +1,5 @@
 import { getRuntimeAdapter } from "../runtime/index.js";
 import { SpawnfileError } from "../shared/index.js";
-const DEFAULT_TINYCLAW_PORT = 3777;
 const INSTANCE_ROOT_PLACEHOLDER = "<instance-root>";
 const CONFIG_FILE_PLACEHOLDER = "<config-file>";
 const resolveSequentialRuntimePort = (plan, runtimeName, slug) => {
@@ -16,7 +15,6 @@ const resolveSequentialRuntimePort = (plan, runtimeName, slug) => {
     }
     return basePort + (index * (adapter.container.portStride ?? 1));
 };
-const createTinyClawChannel = (networkId, agentId) => `moltnet:${networkId}:${agentId}`;
 const replaceContainerPathTemplate = (template, instanceRoot, configFileName) => template
     .replaceAll(INSTANCE_ROOT_PLACEHOLDER, instanceRoot)
     .replaceAll(CONFIG_FILE_PLACEHOLDER, configFileName);
@@ -30,7 +28,7 @@ const resolveRuntimeInstancePaths = (runtimeName, slug) => {
             : undefined
     };
 };
-export const resolveRuntimeConfig = (plan, agentNode, nodeSlug, networkId, agentId) => {
+export const resolveRuntimeConfig = (plan, agentNode, nodeSlug, _networkId, _agentId) => {
     switch (agentNode.runtime.name) {
         case "openclaw": {
             const port = resolveSequentialRuntimePort(plan, "openclaw", nodeSlug);
@@ -53,14 +51,15 @@ export const resolveRuntimeConfig = (plan, agentNode, nodeSlug, networkId, agent
                 kind: "picoclaw"
             };
         }
-        case "tinyclaw": {
-            const channel = createTinyClawChannel(networkId, agentId);
+        case "daimon":
+        case "pi": {
+            const port = getRuntimeAdapter(agentNode.runtime.name).container.port;
+            if (!port) {
+                throw new SpawnfileError("compile_error", `Unable to resolve ${agentNode.runtime.name} control port for Moltnet agent ${agentNode.name}`);
+            }
             return {
-                ack_url: `http://127.0.0.1:${DEFAULT_TINYCLAW_PORT}/api/responses`,
-                channel,
-                inbound_url: `http://127.0.0.1:${DEFAULT_TINYCLAW_PORT}/api/message`,
-                kind: "tinyclaw",
-                outbound_url: `http://127.0.0.1:${DEFAULT_TINYCLAW_PORT}/api/responses/pending?channel=${encodeURIComponent(channel)}`
+                control_url: `http://127.0.0.1:${port}/agents/${nodeSlug}/wake`,
+                kind: "pi"
             };
         }
         default:

package/dist/compiler/networkBinding.d.ts

@@ -0,0 +1,14 @@
+/** Uppercases an id and replaces every non-[A-Z0-9] character with `_`. */
+export declare const normalizeNetworkEnvSegment: (id: string) => string;
+export declare const networkUrlEnvName: (networkId: string) => string;
+export declare const networkTokenEnvName: (networkId: string, memberId?: string) => string;
+export interface NetworkBindingInput {
+    id: string;
+    members: string[];
+}
+/**
+ * Asserts that every generated network binding env name (URL and token vars,
+ * across all networks and members) is globally unique after normalization.
+ * Collisions are baked into immutable images, so they must fail at compile.
+ */
+export declare const assertNetworkBindingEnvUniqueness: (networks: NetworkBindingInput[]) => void;

package/dist/compiler/networkBinding.js

@@ -0,0 +1,34 @@
+import { SpawnfileError } from "../shared/index.js";
+const ENV_PREFIX = "SPAWNFILE_NETWORK_";
+/** Uppercases an id and replaces every non-[A-Z0-9] character with `_`. */
+export const normalizeNetworkEnvSegment = (id) => id.toUpperCase().replace(/[^A-Z0-9]+/g, "_");
+export const networkUrlEnvName = (networkId) => `${ENV_PREFIX}${normalizeNetworkEnvSegment(networkId)}_URL`;
+export const networkTokenEnvName = (networkId, memberId) => memberId === undefined
+    ? `${ENV_PREFIX}${normalizeNetworkEnvSegment(networkId)}_TOKEN`
+    : `${ENV_PREFIX}${normalizeNetworkEnvSegment(networkId)}_TOKEN_${normalizeNetworkEnvSegment(memberId)}`;
+/**
+ * Asserts that every generated network binding env name (URL and token vars,
+ * across all networks and members) is globally unique after normalization.
+ * Collisions are baked into immutable images, so they must fail at compile.
+ */
+export const assertNetworkBindingEnvUniqueness = (networks) => {
+    const seen = new Map();
+    const claim = (envName, owner) => {
+        const existing = seen.get(envName);
+        if (existing && existing !== owner) {
+            throw new SpawnfileError("validation_error", `Network binding env name ${envName} collides between ${existing} and ${owner}. ` +
+                "Rename a network or member so their normalized env names stay unique.");
+        }
+        seen.set(envName, owner);
+    };
+    for (const network of networks) {
+        claim(networkUrlEnvName(network.id), `network ${network.id} url`);
+        const members = [...new Set(network.members)];
+        if (members.length === 1) {
+            claim(networkTokenEnvName(network.id), `network ${network.id} token`);
+        }
+        for (const member of members) {
+            claim(networkTokenEnvName(network.id, member), `network ${network.id} member ${member}`);
+        }
+    }
+};

package/dist/compiler/publishProject.d.ts

@@ -0,0 +1,13 @@
+import { type BuildProjectOptions, type BuildProjectResult } from "./buildProject.js";
+export type DockerPushRunner = (command: string, args: string[]) => Promise<string>;
+export interface PublishProjectOptions extends BuildProjectOptions {
+    pushRunner?: DockerPushRunner;
+}
+export interface PublishProjectResult extends BuildProjectResult {
+    digest: string | null;
+}
+/**
+ * Compiles, builds, verifies, and pushes a project image. Pre-push verification
+ * refuses to publish a report that leaks creator paths or omits secret markers.
+ */
+export declare const publishProject: (inputPath: string, options?: PublishProjectOptions) => Promise<PublishProjectResult>;

package/dist/compiler/publishProject.js

@@ -0,0 +1,72 @@
+import path from "node:path";
+import { spawn } from "node:child_process";
+import { readFile } from "node:fs/promises";
+import { DISTRIBUTION_REPORT_OUTPUT_FILE, verifyDistributionReport } from "../distribution/index.js";
+import { SpawnfileError } from "../shared/index.js";
+import { buildProject } from "./buildProject.js";
+/* v8 ignore start -- docker push runner is covered by distribution E2E */
+const runDockerCapture = async (command, args) => new Promise((resolve, reject) => {
+    const child = spawn(command, args, { stdio: ["ignore", "pipe", "pipe"] });
+    const stdout = [];
+    const stderr = [];
+    child.stdout.on("data", (chunk) => stdout.push(String(chunk)));
+    child.stderr.on("data", (chunk) => stderr.push(String(chunk)));
+    child.on("error", reject);
+    child.on("close", (code) => {
+        if (code === 0) {
+            resolve(stdout.join(""));
+            return;
+        }
+        reject(new SpawnfileError("runtime_error", `docker ${args[0]} failed (${code}): ${stderr.join("").trim()}`));
+    });
+});
+/* v8 ignore stop */
+const resolvePushedDigest = async (command, imageTag, runDocker) => {
+    try {
+        const raw = (await runDocker(command, ["image", "inspect", "--format", "{{json .RepoDigests}}", imageTag])).trim();
+        const digests = JSON.parse(raw);
+        const match = digests
+            .map((entry) => (entry.includes("@") ? entry.slice(entry.indexOf("@") + 1) : null))
+            .find((entry) => Boolean(entry));
+        return match ?? null;
+    }
+    catch {
+        return null;
+    }
+};
+/**
+ * Compiles, builds, verifies, and pushes a project image. Pre-push verification
+ * refuses to publish a report that leaks creator paths or omits secret markers.
+ */
+export const publishProject = async (inputPath, options = {}) => {
+    if (!options.imageTag) {
+        throw new SpawnfileError("validation_error", "publish requires --tag with a registry image reference");
+    }
+    const buildResult = await buildProject(inputPath, options);
+    const dockerCommand = options.dockerCommand ?? "docker";
+    const runDocker = options.pushRunner ?? runDockerCapture;
+    const reportPath = path.join(buildResult.outputDirectory, DISTRIBUTION_REPORT_OUTPUT_FILE);
+    let parsedReport;
+    try {
+        parsedReport = JSON.parse(await readFile(reportPath, "utf8"));
+    }
+    catch (error) {
+        /* v8 ignore next 2 -- compile always emits the report; defensive only */
+        const reason = error instanceof Error ? error.message : String(error);
+        throw new SpawnfileError("validation_error", `Unable to read distribution report for publish: ${reason}`);
+    }
+    verifyDistributionReport({
+        forbiddenPathFragments: [
+            path.resolve(inputPath),
+            buildResult.outputDirectory,
+            buildResult.report.root
+        ],
+        report: parsedReport
+    });
+    await runDocker(dockerCommand, ["push", buildResult.imageTag]);
+    const digest = await resolvePushedDigest(dockerCommand, buildResult.imageTag, runDocker);
+    return {
+        ...buildResult,
+        digest
+    };
+};