spawnfile 0.1.12 → 0.1.14

package/dist/compiler/runProjectDocker.js

@@ -1,57 +1,225 @@
 import { execFile as execFileCallback, spawn } from "node:child_process";
+import path from "node:path";
 import { promisify } from "node:util";
 import { SpawnfileError } from "../shared/index.js";
 const execFile = promisify(execFileCallback);
-const inspectImageArgs = (invocation, containerId) => {
+const parseDockerContextHost = (stdout) => {
+    const trimmed = stdout.trim();
+    if (!trimmed) {
+        return null;
+    }
+    try {
+        const parsed = JSON.parse(trimmed);
+        return typeof parsed === "string" ? parsed : null;
+    }
+    catch {
+        return trimmed;
+    }
+};
+const resolveSshDockerContext = async (invocation) => {
+    if (!invocation.dockerContext) {
+        return null;
+    }
+    const { stdout } = await execFile(invocation.command, [
+        "context",
+        "inspect",
+        invocation.dockerContext,
+        "--format",
+        "{{json .Endpoints.docker.Host}}"
+    ], { cwd: invocation.cwd, timeout: 10_000 });
+    const host = parseDockerContextHost(stdout);
+    if (!host?.startsWith("ssh://")) {
+        return null;
+    }
+    const url = new URL(host);
+    const user = decodeURIComponent(url.username);
+    const targetHost = url.hostname;
+    return {
+        host,
+        ...(url.port ? { port: url.port } : {}),
+        target: user ? `${user}@${targetHost}` : targetHost
+    };
+};
+const sshArgs = (context, command) => [
+    ...(context.port ? ["-p", context.port] : []),
+    context.target,
+    command
+];
+const scpArgs = (context, source, target) => [
+    ...(context.port ? ["-P", context.port] : []),
+    "-r",
+    source,
+    `${context.target}:${target}`
+];
+const shellQuote = (value) => `'${value.replace(/'/g, `'\"'\"'`)}'`;
+const createRemoteDirectory = async (context) => {
+    const { stdout } = await execFile("ssh", sshArgs(context, "mktemp -d /tmp/spawnfile-run-XXXXXX"), {
+        timeout: 10_000
+    });
+    return stdout.trim();
+};
+const copyPathToRemote = async (context, sourcePath, remotePath) => {
+    await execFile("scp", scpArgs(context, sourcePath, remotePath), { timeout: 120_000 });
+};
+const removeRemoteDirectory = async (context, remoteDirectory) => {
+    await execFile("ssh", sshArgs(context, `rm -rf ${shellQuote(remoteDirectory)}`), {
+        timeout: 10_000
+    });
+};
+const splitVolumeSpec = (spec) => {
+    const delimiter = spec.indexOf(":");
+    if (delimiter <= 0) {
+        return null;
+    }
+    return {
+        rest: spec.slice(delimiter),
+        source: spec.slice(0, delimiter)
+    };
+};
+const collectBindMountSources = (args) => {
+    const sources = new Set();
+    for (let index = 0; index < args.length; index += 1) {
+        if (args[index] !== "-v" && args[index] !== "--volume") {
+            continue;
+        }
+        const volume = args[index + 1];
+        if (!volume) {
+            continue;
+        }
+        const parsed = splitVolumeSpec(volume);
+        if (parsed && path.isAbsolute(parsed.source)) {
+            sources.add(parsed.source);
+        }
+        index += 1;
+    }
+    return [...sources].sort();
+};
+const rewriteBindMountSources = (args, replacements) => args.map((arg, index) => {
+    const previous = args[index - 1];
+    if (previous !== "-v" && previous !== "--volume") {
+        return arg;
+    }
+    const parsed = splitVolumeSpec(arg);
+    if (!parsed) {
+        return arg;
+    }
+    const replacement = replacements.get(parsed.source);
+    return replacement ? `${replacement}${parsed.rest}` : arg;
+});
+const prepareRemoteBindMounts = async (invocation) => {
+    const context = await resolveSshDockerContext(invocation);
+    if (!context) {
+        return { cleanup: async () => undefined, invocation };
+    }
+    const sources = collectBindMountSources(invocation.args);
+    if (sources.length === 0) {
+        return { cleanup: async () => undefined, invocation };
+    }
+    const remoteDirectory = await createRemoteDirectory(context);
+    const replacements = new Map();
+    for (const [index, source] of sources.entries()) {
+        const remotePath = `${remoteDirectory}/${index}-${path.basename(source) || "mount"}`;
+        await copyPathToRemote(context, source, remotePath);
+        replacements.set(source, remotePath);
+    }
+    return {
+        cleanup: invocation.detach
+            ? async () => undefined
+            : async () => removeRemoteDirectory(context, remoteDirectory),
+        invocation: {
+            ...invocation,
+            args: rewriteBindMountSources(invocation.args, replacements)
+        }
+    };
+};
+export const createDetachedContainerInspectArgs = (invocation, containerId) => {
     const base = invocation.dockerContext
         ? ["--context", invocation.dockerContext, "inspect"]
         : invocation.dockerHost
             ? ["--host", invocation.dockerHost, "inspect"]
             : ["inspect"];
-    return [...base, "--format", "{{.Image}}", containerId];
+    return [...base, "--format", "{{json .Id}}\n{{json .Image}}\n{{json .Config.Labels}}", containerId];
 };
-const inspectDetachedImageId = async (invocation, containerId) => {
+export const parseDetachedContainerInspect = (stdout, expectedContainerId, expectedLabels) => {
+    const [idRaw, imageRaw, labelsRaw, ...extra] = stdout.trim().split("\n");
+    if (!idRaw || !imageRaw || !labelsRaw || extra.length > 0)
+        throw new Error("unexpected inspect response");
+    const actualId = JSON.parse(idRaw);
+    const imageId = JSON.parse(imageRaw);
+    const labels = JSON.parse(labelsRaw);
+    if (typeof actualId !== "string" || actualId !== expectedContainerId || !/^[a-f0-9]{64}$/u.test(actualId)
+        || typeof imageId !== "string" || !/^sha256:[a-f0-9]{64}$/u.test(imageId))
+        throw new Error("malformed detached container metadata");
+    if (!expectedLabels)
+        return { containerId: actualId, imageId };
+    if (!labels || typeof labels !== "object" || Array.isArray(labels))
+        throw new Error("missing detached deployment labels");
+    const actual = Object.fromEntries(Object.keys(expectedLabels).sort().map((key) => {
+        const value = labels[key];
+        if (typeof value !== "string" || value !== expectedLabels[key])
+            throw new Error("detached deployment label drift");
+        return [key, value];
+    }));
+    return { containerId: actualId, imageId, deploymentLabels: actual };
+};
+const inspectDetachedContainer = async (invocation, containerId) => {
     try {
-        const { stdout } = await execFile(invocation.command, inspectImageArgs(invocation, containerId), {
+        const { stdout } = await execFile(invocation.command, createDetachedContainerInspectArgs(invocation, containerId), {
             cwd: invocation.cwd,
             timeout: 10_000
         });
-        return stdout.trim() || undefined;
+        return parseDetachedContainerInspect(stdout, containerId, invocation.deploymentLabels);
     }
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);
-        throw new SpawnfileError("runtime_error", `Unable to inspect detached container ${containerId} image id: ${message}`);
+        throw new SpawnfileError("runtime_error", `Unable to inspect detached container ${containerId}: ${message}`);
     }
 };
-export const runDockerContainer = async (invocation) => new Promise((resolve, reject) => {
+const runPreparedDockerContainer = (prepared) => new Promise((resolve, reject) => {
     let stdout = "";
-    const child = spawn(invocation.command, invocation.args, {
-        cwd: invocation.cwd,
-        stdio: invocation.detach ? ["ignore", "pipe", "inherit"] : "inherit"
+    const child = spawn(prepared.invocation.command, prepared.invocation.args, {
+        cwd: prepared.invocation.cwd,
+        stdio: prepared.invocation.detach ? ["ignore", "pipe", "inherit"] : "inherit"
     });
-    if (invocation.detach && child.stdout) {
+    const settle = (finish) => {
+        prepared.cleanup().then(finish, reject);
+    };
+    const rejectAfterCleanup = (error) => {
+        prepared.cleanup().then(() => reject(error), reject);
+    };
+    if (prepared.invocation.detach && child.stdout) {
         child.stdout.setEncoding("utf8");
         child.stdout.on("data", (chunk) => {
             stdout += chunk;
         });
     }
     child.once("error", (error) => {
-        reject(new SpawnfileError("runtime_error", `Unable to start docker run for ${invocation.imageTag}: ${error.message}`));
+        rejectAfterCleanup(new SpawnfileError("runtime_error", `Unable to start docker run for ${prepared.invocation.imageTag}: ${error.message}`));
     });
     child.once("exit", (code, signal) => {
         if (code === 0) {
             const containerId = stdout.trim().split(/\s+/)[0];
-            if (!invocation.detach || !containerId) {
-                resolve(undefined);
+            if (!prepared.invocation.detach || !containerId) {
+                settle(() => resolve(undefined));
                 return;
             }
-            inspectDetachedImageId(invocation, containerId)
-                .then((imageId) => resolve({ containerId, ...(imageId ? { imageId } : {}) }))
+            Promise.resolve(prepared.invocation.onDetachedStarted?.({ containerId }))
+                .then(() => inspectDetachedContainer(prepared.invocation, containerId))
+                .then(resolve)
                 .catch(reject);
             return;
         }
-        reject(new SpawnfileError("runtime_error", signal
-            ? `Docker run for ${invocation.imageTag} exited from signal ${signal}`
-            : `Docker run for ${invocation.imageTag} failed with exit code ${code ?? "unknown"}`));
+        rejectAfterCleanup(new SpawnfileError("runtime_error", signal
+            ? `Docker run for ${prepared.invocation.imageTag} exited from signal ${signal}`
+            : `Docker run for ${prepared.invocation.imageTag} failed with exit code ${code ?? "unknown"}`));
     });
 });
+export const runDockerContainer = (invocation) => {
+    if (!invocation.dockerContext || collectBindMountSources(invocation.args).length === 0) {
+        return runPreparedDockerContainer({
+            cleanup: async () => undefined,
+            invocation
+        });
+    }
+    return prepareRemoteBindMounts(invocation).then(runPreparedDockerContainer);
+};

package/dist/compiler/runProjectLifecycle.d.ts

@@ -0,0 +1,7 @@
+import type { DockerRunInvocation, DockerRunResult, DockerRunRunner } from "./runProjectDocker.js";
+/**
+ * Docker consumes an env file before a detached container is started, so the
+ * generated copy must not become a durable credential store. Other files in
+ * the support directory may be active bind-mount sources and must remain.
+ */
+export declare const executeDockerRunWithSupportCleanup: (invocation: DockerRunInvocation, runner: DockerRunRunner) => Promise<DockerRunResult | void>;

package/dist/compiler/runProjectLifecycle.js

@@ -0,0 +1,40 @@
+import { rm } from "node:fs/promises";
+import { removeDirectory } from "../filesystem/index.js";
+/**
+ * Docker consumes an env file before a detached container is started, so the
+ * generated copy must not become a durable credential store. Other files in
+ * the support directory may be active bind-mount sources and must remain.
+ */
+export const executeDockerRunWithSupportCleanup = async (invocation, runner) => {
+    let started = false;
+    try {
+        const runInvocation = invocation.detach
+            ? {
+                ...invocation,
+                onDetachedStarted: async (result) => {
+                    started = true;
+                    await rm(invocation.envFilePath, { force: true });
+                    await invocation.onDetachedStarted?.(result);
+                }
+            }
+            : invocation;
+        const result = await runner(runInvocation);
+        if (invocation.detach) {
+            if (!started) {
+                started = true;
+                await rm(invocation.envFilePath, { force: true });
+            }
+        }
+        else {
+            started = true;
+            await removeDirectory(invocation.supportDirectory);
+        }
+        return result;
+    }
+    catch (error) {
+        if (!started) {
+            await removeDirectory(invocation.supportDirectory);
+        }
+        throw error;
+    }
+};

package/dist/compiler/syncProjectAuth.js

@@ -4,7 +4,7 @@ import { SpawnfileError } from "../shared/index.js";
 import { listAgentSurfaceSecretNames } from "./agentSurfaces.js";
 import { buildCompilePlan } from "./buildCompilePlan.js";
 import { listMoltnetNetworkSecretNames } from "./compilePlanHelpers.js";
-import { listExecutionModelSecretNames, resolveExecutionModelAuthMethods } from "./modelEnv.js";
+import { CLI_CREDENTIAL_SECRET_NAME, listExecutionModelSecretNames, resolveExecutionModelAuthMethods } from "./modelEnv.js";
 const resolveAuthRequirements = async (inputPath) => {
     const plan = await buildCompilePlan(inputPath);
     const methods = new Set();
@@ -46,6 +46,9 @@ const resolveAuthRequirements = async (inputPath) => {
             methods.add(method);
         }
         for (const envName of listExecutionModelSecretNames(node.value.execution)) {
+            if (envName === CLI_CREDENTIAL_SECRET_NAME) {
+                continue;
+            }
             requiredEnvNames.add(envName);
             optionalEnvNames.delete(envName);
         }

package/dist/compiler/teamContextActiveEnvironments.d.ts

@@ -0,0 +1,13 @@
+import type { DiagnosticReport } from "../report/index.js";
+import type { CompileReportActiveEnvironments } from "../report/types.js";
+import type { AgentContext } from "./teamContextTypes.js";
+import type { CompilePlan, ResolvedAgentNode } from "./types.js";
+export type ActiveEnvironmentsIndex = CompileReportActiveEnvironments;
+export interface ActiveEnvironmentsResult {
+    activeEnvironments?: ActiveEnvironmentsIndex;
+    diagnostics: Array<{
+        source: string;
+        diagnostic: DiagnosticReport;
+    }>;
+}
+export declare const buildActiveEnvironments: (plan: CompilePlan, agentNode: ResolvedAgentNode, contexts: AgentContext[], directContextCount: number) => ActiveEnvironmentsResult;

package/dist/compiler/teamContextActiveEnvironments.js

@@ -0,0 +1,255 @@
+import { findTeamBySource, pathSafe } from "./teamContextHelpers.js";
+const ROOM_DERIVATION_RULE = "first_listed_room_member_containing_agent";
+const SCHEDULE_SINGLE_DIRECT_RULE = "single_direct_team_context_for_agent_schedule";
+const SCHEDULE_MULTI_CONTEXT_RULE = "multi_context_agent_schedule_uses_global_self";
+const agentSessionId = (agentNode) => pathSafe(agentNode.name);
+const getContextProfiles = (contexts) => contexts.map((context) => context.kind === "direct"
+    ? {
+        context,
+        contextKey: context.contextKey,
+        concreteMemberId: context.membership.memberId,
+        teamSource: context.teamNode.source
+    }
+    : {
+        context,
+        contextKey: context.contextKey,
+        concreteMemberId: context.representativeMemberId,
+        representedSlot: context.representedMember.id,
+        teamSource: context.parentTeamNode.source
+    });
+const contextKeyByMatch = {
+    direct: (teamSource, concreteMemberId) => `direct:${teamSource}:${concreteMemberId}`,
+    representative: (teamSource, representedSlot, concreteMemberId) => `representative:${teamSource}:${representedSlot}:${concreteMemberId}`
+};
+const findRoomMemberPosition = (plan, teamSource, networkId, roomId, memberSlot) => {
+    const teamNode = findTeamBySource(plan, teamSource);
+    if (!teamNode) {
+        return -1;
+    }
+    const network = teamNode.networks?.find((entry) => entry.id === networkId);
+    if (!network) {
+        return -1;
+    }
+    const room = network.rooms.find((entry) => entry.id === roomId);
+    if (!room) {
+        return -1;
+    }
+    return room.members.indexOf(memberSlot);
+};
+const deriveMoltnetEnvironments = (plan, agentNode, profiles) => {
+    const memberships = plan.moltnetRoomMemberships;
+    if (!memberships || memberships.length === 0) {
+        return { moltnet: undefined, diagnostics: [] };
+    }
+    const direct = new Map();
+    const representative = new Map();
+    const profileByContextKey = new Map();
+    for (const profile of profiles) {
+        profileByContextKey.set(profile.contextKey, profile);
+        if (profile.representedSlot === undefined) {
+            const key = contextKeyByMatch.direct(profile.teamSource, profile.concreteMemberId);
+            direct.set(key, [...(direct.get(key) ?? []), profile]);
+        }
+        else {
+            const key = contextKeyByMatch.representative(profile.teamSource, profile.representedSlot, profile.concreteMemberId);
+            representative.set(key, [...(representative.get(key) ?? []), profile]);
+        }
+    }
+    const diagnostics = [];
+    const byRoom = new Map();
+    for (const membership of memberships) {
+        if (membership.agentSource !== agentNode.source) {
+            continue;
+        }
+        const directProfiles = direct.get(contextKeyByMatch.direct(membership.directTeamSource, membership.concreteMemberId));
+        const representativeProfiles = membership.representedSlot
+            ? representative.get(contextKeyByMatch.representative(membership.declaringTeamSource, membership.representedSlot, membership.concreteMemberId))
+            : undefined;
+        const candidateProfiles = plan.organizationIdentity
+            ? profiles.filter((profile) => membership.representedSlot
+                ? profile.representedSlot === membership.representedSlot &&
+                    profile.teamSource === membership.declaringTeamSource
+                : profile.representedSlot === undefined &&
+                    profile.teamSource === membership.directTeamSource)
+            : membership.representedSlot
+                ? representativeProfiles
+                : directProfiles;
+        if (!candidateProfiles || candidateProfiles.length === 0) {
+            diagnostics.push({
+                source: membership.declaringTeamSource,
+                diagnostic: {
+                    level: "error",
+                    message: `Unable to derive active moltnet context for ${agentNode.name} in ${membership.networkId}/${membership.roomId}`
+                }
+            });
+            continue;
+        }
+        const memberPosition = findRoomMemberPosition(plan, membership.declaringTeamSource, membership.networkId, membership.roomId, membership.declaredSlot);
+        if (memberPosition === -1) {
+            diagnostics.push({
+                source: membership.declaringTeamSource,
+                diagnostic: {
+                    level: "error",
+                    message: `Unable to locate room member ${membership.declaredSlot} for ${membership.networkId}/${membership.roomId} in ${agentNode.name}`
+                }
+            });
+            continue;
+        }
+        const roomKey = `${membership.networkId}\u0000${membership.roomId}`;
+        byRoom.set(roomKey, [
+            ...(byRoom.get(roomKey) ?? []),
+            ...candidateProfiles.map((profile) => ({ profile, memberPosition }))
+        ]);
+    }
+    const moltnet = {};
+    for (const [roomBindingKey, candidates] of byRoom) {
+        if (candidates.length === 0) {
+            continue;
+        }
+        const roomKeyed = new Map();
+        for (const candidate of candidates) {
+            const existing = roomKeyed.get(candidate.profile.contextKey);
+            if (!existing || candidate.memberPosition < existing.memberPosition) {
+                roomKeyed.set(candidate.profile.contextKey, candidate);
+            }
+        }
+        const selected = [...roomKeyed.values()].sort((left, right) => {
+            if (left.memberPosition !== right.memberPosition) {
+                return left.memberPosition - right.memberPosition;
+            }
+            return left.profile.contextKey.localeCompare(right.profile.contextKey);
+        })[0];
+        if (!selected) {
+            continue;
+        }
+        const [networkId, roomId] = roomBindingKey.split("\u0000");
+        if (!networkId || !roomId) {
+            continue;
+        }
+        const profile = profileByContextKey.get(selected.profile.contextKey);
+        if (!profile) {
+            continue;
+        }
+        moltnet[networkId] ??= { rooms: {} };
+        moltnet[networkId].rooms[roomId] = {
+            context_key: profile.contextKey,
+            derivation: {
+                member_position: selected.memberPosition,
+                rule: ROOM_DERIVATION_RULE
+            },
+            member_slot: profile.representedSlot ?? profile.concreteMemberId,
+            roster: `.spawnfile/rosters/${profile.contextKey}.yaml`,
+            team_id: profile.contextKey,
+            team_doc: `.spawnfile/team-contexts/${profile.contextKey}/TEAM.md`,
+            session_key: `${agentSessionId(agentNode)}@moltnet:${networkId}:room:${roomId}`,
+            memory: {
+                durable_scope: {
+                    qualifier: profile.contextKey,
+                    scope: "team"
+                },
+                ephemeral_scope: {
+                    qualifier: `${networkId}:${roomId}`,
+                    scope: "room"
+                }
+            }
+        };
+    }
+    return {
+        moltnet: Object.keys(moltnet).length > 0 ? moltnet : undefined,
+        diagnostics
+    };
+};
+const deriveSchedules = (profiles, directContextCount, agentNode) => {
+    if (!agentNode.schedule || agentNode.schedule.kind === "disabled") {
+        return undefined;
+    }
+    const directProfile = directContextCount === 1
+        ? profiles.find((profile) => profile.context.kind === "direct")
+        : undefined;
+    const contextKey = directProfile ? directProfile.contextKey : "self";
+    return {
+        default: {
+            context_key: contextKey,
+            derivation: {
+                rule: directProfile ? SCHEDULE_SINGLE_DIRECT_RULE : SCHEDULE_MULTI_CONTEXT_RULE
+            },
+            environment_key: `schedule:${contextKey}`,
+            memory: {
+                durable_scope: {
+                    qualifier: directProfile ? directProfile.contextKey : agentSessionId(agentNode),
+                    scope: directProfile ? "team" : "global"
+                }
+            },
+            session_key: `${agentSessionId(agentNode)}@schedule:${contextKey}`
+        }
+    };
+};
+const hasAnyMemoryAccess = (agentNode) => (agentNode.memoryAccess?.length ?? 0) > 0 || (agentNode.memory?.length ?? 0) > 0;
+const resolveTeamMemoryScopes = (access) => {
+    if (access.declaringKind !== "team" || !access.slotId) {
+        return null;
+    }
+    return `${access.source}::${access.slotId}`;
+};
+const deriveDreams = (agentNode, profiles) => {
+    const dreams = {};
+    if (hasAnyMemoryAccess(agentNode)) {
+        dreams.self = {
+            context_key: "self",
+            environment_key: "dream:self",
+            memory: {
+                durable_scope: {
+                    qualifier: agentSessionId(agentNode),
+                    scope: "global"
+                }
+            },
+            session_key_template: `${agentSessionId(agentNode)}@dream:self:{run_id}`
+        };
+    }
+    const addProfileDream = (profile) => {
+        dreams[profile.contextKey] ??= {
+            context_key: profile.contextKey,
+            environment_key: `dream:${profile.contextKey}`,
+            memory: {
+                durable_scope: {
+                    qualifier: profile.contextKey,
+                    scope: "team"
+                }
+            },
+            session_key_template: `${agentSessionId(agentNode)}@dream:${profile.contextKey}:{run_id}`
+        };
+    };
+    if ((agentNode.memory?.length ?? 0) > 0) {
+        profiles.forEach(addProfileDream);
+    }
+    const profileByTeamSlot = new Map();
+    for (const profile of profiles) {
+        const key = `${profile.teamSource}::${profile.concreteMemberId}`;
+        profileByTeamSlot.set(key, [...(profileByTeamSlot.get(key) ?? []), profile]);
+    }
+    for (const access of agentNode.memoryAccess ?? []) {
+        const scopeKey = resolveTeamMemoryScopes(access);
+        if (!scopeKey) {
+            continue;
+        }
+        for (const profile of profileByTeamSlot.get(scopeKey) ?? []) {
+            addProfileDream(profile);
+        }
+    }
+    return Object.keys(dreams).length > 0 ? dreams : undefined;
+};
+export const buildActiveEnvironments = (plan, agentNode, contexts, directContextCount) => {
+    const profiles = getContextProfiles(contexts);
+    const moltnetResult = deriveMoltnetEnvironments(plan, agentNode, profiles);
+    const schedules = deriveSchedules(profiles, directContextCount, agentNode);
+    const dreams = deriveDreams(agentNode, profiles);
+    const activeEnvironments = {
+        ...(moltnetResult.moltnet ? { moltnet: moltnetResult.moltnet } : {}),
+        ...(schedules ? { schedules } : {}),
+        ...(dreams ? { dreams } : {})
+    };
+    if (Object.keys(activeEnvironments).length === 0) {
+        return { activeEnvironments: undefined, diagnostics: moltnetResult.diagnostics };
+    }
+    return { activeEnvironments, diagnostics: moltnetResult.diagnostics };
+};