spawnfile 0.1.12 → 0.1.13

package/dist/runtime/pi/runAuth.js

@@ -0,0 +1,68 @@
+import path from "node:path";
+import { chmod } from "node:fs/promises";
+import { loadImportedClaudeCodeCredential, loadImportedCodexCredential } from "../../auth/index.js";
+import { ensureDirectory, writeUtf8File } from "../../filesystem/index.js";
+const createMountArgs = (hostPath, containerPath) => [
+    "-v",
+    `${hostPath}:${containerPath}`
+];
+const writeJsonFile = async (tempRoot, relativePath, value) => {
+    const hostPath = path.join(tempRoot, relativePath);
+    const hostDirectory = path.dirname(hostPath);
+    await ensureDirectory(hostDirectory);
+    await writeUtf8File(hostPath, `${JSON.stringify(value, null, 2)}\n`);
+    await chmod(hostDirectory, 0o700);
+    // Docker bind mounts preserve host file mode; the generated image runs as
+    // the non-root `spawnfile` user, so the mounted auth file must be readable
+    // by a UID that usually differs from the host owner.
+    await chmod(hostPath, 0o644);
+    return hostPath;
+};
+const collectCoveredSecrets = (instanceSecrets, enabled, secretName) => enabled && instanceSecrets.includes(secretName) ? [secretName] : [];
+export const preparePiRuntimeAuth = async (input) => {
+    if (!input.instance.home_path) {
+        return { coveredModelSecrets: [], mountArgs: [] };
+    }
+    const codex = input.authProfile.imports.codex
+        ? await loadImportedCodexCredential(input.authProfile.imports.codex.path)
+        : null;
+    const claudeCode = input.authProfile.imports["claude-code"]
+        ? await loadImportedClaudeCodeCredential(input.authProfile.imports["claude-code"].path)
+        : null;
+    const useCodex = input.instance.model_auth_methods.openai === "codex" && codex;
+    const useClaudeCode = input.instance.model_auth_methods.anthropic === "claude-code" && claudeCode;
+    if (!useCodex && !useClaudeCode) {
+        return { coveredModelSecrets: [], mountArgs: [] };
+    }
+    const authProfiles = {};
+    if (useCodex) {
+        authProfiles["openai-codex"] = {
+            access: codex.access,
+            ...(codex.accountId ? { accountId: codex.accountId } : {}),
+            expires: codex.expires,
+            refresh: codex.refresh,
+            type: "oauth"
+        };
+    }
+    if (useClaudeCode) {
+        authProfiles.anthropic = claudeCode.type === "oauth" && claudeCode.refresh
+            ? {
+                access: claudeCode.access,
+                expires: claudeCode.expires,
+                refresh: claudeCode.refresh,
+                type: "oauth"
+            }
+            : {
+                key: claudeCode.access,
+                type: "api_key"
+            };
+    }
+    const authPath = await writeJsonFile(input.tempRoot, path.join("runtime-auth", "pi", input.instance.id, "auth.json"), authProfiles);
+    return {
+        coveredModelSecrets: [
+            ...collectCoveredSecrets(input.instance.model_secrets_required, Boolean(useCodex), "OPENAI_API_KEY"),
+            ...collectCoveredSecrets(input.instance.model_secrets_required, Boolean(useClaudeCode), "ANTHROPIC_API_KEY")
+        ],
+        mountArgs: createMountArgs(authPath, path.posix.join(input.instance.home_path, ".pi", "agent", "auth.json"))
+    };
+};

package/dist/runtime/registry.js

@@ -3,9 +3,12 @@ import { parse as parseYaml } from "yaml";
 import { z } from "zod";
 import { SpawnfileError } from "../shared/index.js";
 import { openClawAdapter } from "./openclaw/adapter.js";
+import { daimonAdapter, piAdapter } from "./pi/adapter.js";
 import { picoClawAdapter } from "./picoclaw/adapter.js";
 const runtimeAdapters = new Map([
+    [daimonAdapter.name, daimonAdapter],
     [openClawAdapter.name, openClawAdapter],
+    [piAdapter.name, piAdapter],
     [picoClawAdapter.name, picoClawAdapter]
 ]);
 const runtimeInstallSchema = z.discriminatedUnion("kind", [

package/dist/runtime/types.d.ts

@@ -59,6 +59,7 @@ export interface RuntimeContainerMeta {
     port?: number;
     portStride?: number;
     portEnv?: string;
+    postRootfsCommands?: string[];
     standaloneBaseImage: string;
     startCommand: string[];
     staticEnv?: Record<string, string>;

package/dist/status/deployments.js

@@ -68,24 +68,17 @@ export const createDeploymentSummaries = (records, inspections = new Map()) => r
 }));
 export const createDeploymentObservations = (deployments, options) => {
     const observations = [];
-    if (deployments.length === 0 && options.liveRequested && !options.recover) {
+    if (deployments.length === 0 && options.liveRequested) {
         observations.push(createObservation({
-            key: "deployment.record",
-            message: `No deployment records found under ${options.outputDirectory}`,
+            key: options.recover ? "deployment.recover" : "deployment.record",
+            message: options.recover
+                ? `No recoverable deployment labels found for ${options.outputDirectory}`
+                : `No deployment records found under ${options.outputDirectory}`,
             severity: "warn",
             source: "deployment",
             subject: "deployment"
         }));
     }
-    if (options.recover) {
-        observations.push(createObservation({
-            key: "deployment.recover",
-            message: "Label recovery is not implemented yet; use record-backed status for live checks",
-            severity: "unknown",
-            source: "deployment",
-            subject: "deployment"
-        }));
-    }
     for (const deployment of deployments) {
         observations.push(createObservation({
             key: "deployment.record",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spawnfile",
-  "version": "0.1.12",
+  "version": "0.1.13",
   "description": "Canonical source compiler for autonomous agents and teams.",
   "license": "MIT",
   "type": "module",
@@ -25,6 +25,10 @@
     "release:patch": "npm version patch && npm publish",
     "release:minor": "npm version minor && npm publish",
     "release:major": "npm version major && npm publish",
+    "runtime:images": "npm run runtime:openclaw-image && npm run runtime:picoclaw-image",
+    "runtime:openclaw-image": "docker build -f runtime-images/openclaw/Dockerfile -t noopolis/spawnfile-runtime-openclaw:2026.6.8-local runtime-images/openclaw",
+    "runtime:pi-base": "./scripts/build-pi-runtime-base.sh",
+    "runtime:picoclaw-image": "docker build -f runtime-images/picoclaw/Dockerfile -t noopolis/spawnfile-runtime-picoclaw:0.2.9-local runtime-images/picoclaw",
     "runtimes": "./scripts/runtimes.sh",
     "runtimes:sync": "./scripts/runtimes.sh && ./scripts/blueprints.sh",
     "test:e2e:docker-auth": "tsx src/e2e/cli.ts",
@@ -33,7 +37,8 @@
     "test": "vitest run",
     "typecheck": "tsc --project tsconfig.json --noEmit",
     "test:e2e:distribution-image": "tsx src/e2e/cli.ts distribution-image",
-    "test:e2e:distribution-roundtrip": "tsx src/e2e/cli.ts distribution-roundtrip"
+    "test:e2e:distribution-roundtrip": "tsx src/e2e/cli.ts distribution-roundtrip",
+    "test:e2e:pi-harness-org": "tsx src/e2e/cli.ts pi-harness-org"
   },
   "dependencies": {
     "commander": "^14.0.1",

package/runtimes.yaml

@@ -14,14 +14,24 @@
 # pinned refs.
 
 runtimes:
+  daimon:
+    remote: git@github.com:noopolis/daimon.git
+    ref: v0.1.0
+    default_branch: main
+    install:
+      kind: container_image
+      image: noopolis/spawnfile-runtime-daimon
+      tag: 0.1.0
+    status: active
+
   openclaw:
     remote: git@github.com:openclaw/openclaw.git
-    ref: v2026.6.5
+    ref: v2026.6.8
     default_branch: main
     install:
-      kind: npm
-      package: openclaw
-      version: 2026.6.5
+      kind: container_image
+      image: noopolis/spawnfile-runtime-openclaw
+      tag: 2026.6.8
     status: active
 
   picoclaw:
@@ -29,13 +39,19 @@ runtimes:
     ref: v0.2.9
     default_branch: main
     install:
-      kind: github_release_archive
-      repository: sipeed/picoclaw
-      tag: v0.2.9
-      binary: picoclaw
-      assets:
-        linux_amd64: picoclaw_Linux_x86_64.tar.gz
-        linux_arm64: picoclaw_Linux_arm64.tar.gz
+      kind: container_image
+      image: noopolis/spawnfile-runtime-picoclaw
+      tag: 0.2.9
+    status: active
+
+  pi:
+    remote: git@github.com:earendil-works/pi.git
+    ref: v0.79.9
+    default_branch: main
+    install:
+      kind: npm
+      package: "@earendil-works/pi-coding-agent"
+      version: 0.79.9
     status: active
 
   hermes-agent: