spawnfile 0.1.13 → 0.1.14

package/dist/compiler/organizationReadyEvidence.js

@@ -0,0 +1,261 @@
+import { createHash } from "node:crypto";
+import { normalizeProjectLabelSlug } from "../distribution/projectName.js";
+import { createDistributionFingerprint } from "../distribution/fingerprint.js";
+import { WORLD_BINDINGS_IMAGE_PATH } from "../distribution/types.js";
+import { SpawnfileError } from "../shared/index.js";
+import { MAX_ORGANIZATION_AGENT_MEMBERS, ORGANIZATION_MEMBER_ID_PATTERN_SOURCE, resolveCanonicalAgentMemberId } from "./organizationIdentity.js";
+export const ORGANIZATION_READINESS_EVIDENCE_VERSION = "spawnfile.organization-ready-evidence.v1";
+const fail = (message) => {
+    throw new SpawnfileError("compile_error", `organization readiness evidence is inconsistent: ${message}`);
+};
+const sha256 = (content) => `sha256:${createHash("sha256").update(content).digest("hex")}`;
+const compareAscii = (left, right) => left < right ? -1 : left > right ? 1 : 0;
+const sort = (values, key) => [...values].sort((left, right) => compareAscii(key(left), key(right)));
+const assertUnique = (values, key, label) => {
+    const seen = new Set();
+    for (const value of values) {
+        const valueKey = key(value);
+        if (seen.has(valueKey))
+            fail(`duplicate ${label}: ${valueKey}`);
+        seen.add(valueKey);
+    }
+};
+const freeze = (value, seen = new WeakSet()) => {
+    if (value && typeof value === "object") {
+        if (seen.has(value))
+            return value;
+        seen.add(value);
+        Object.freeze(value);
+        for (const child of Object.values(value))
+            freeze(child, seen);
+    }
+    return value;
+};
+const ID = /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$/u;
+const MEMBER_ID = new RegExp(ORGANIZATION_MEMBER_ID_PATTERN_SOURCE, "u");
+const FINGERPRINT = /^sf1:[a-f0-9]{12}$/u;
+const DIGEST = /^sha256:[a-f0-9]{64}$/u;
+const CONFIG_PATH = /^\/var\/lib\/spawnfile\/moltnet\/nodes\/[A-Za-z0-9_.-]+\.json$/u;
+const nodeByMember = (plan) => {
+    const members = plan.organizationIdentity?.agentMembers ?? [];
+    if (members.length > MAX_ORGANIZATION_AGENT_MEMBERS)
+        fail("organization member cardinality exceeds bounds");
+    assertUnique(members, (member) => member.memberId, "organization member");
+    const result = new Map();
+    for (const node of plan.nodes) {
+        if (node.kind !== "agent")
+            continue;
+        assertId(node.id, "organization node id");
+        const memberId = resolveCanonicalAgentMemberId(plan, node.value.source);
+        if (!memberId)
+            continue;
+        if (!members.some((member) => member.memberId === memberId) || result.has(memberId)) {
+            fail(`organization member ${memberId} does not resolve to exactly one node`);
+        }
+        result.set(memberId, node.id);
+    }
+    if (result.size !== members.length)
+        fail("organization member cardinality mismatch");
+    return result;
+};
+const emittedConfigContent = (artifacts, configPath) => {
+    const emittedPath = `container/rootfs${configPath}`;
+    const matches = artifacts.files.filter((file) => file.path === emittedPath);
+    if (matches.length !== 1)
+        fail(`node config ${configPath} is not emitted exactly once`);
+    return matches[0].content;
+};
+const attachmentRecords = (plan) => {
+    const records = [];
+    for (const node of plan.nodes) {
+        if (node.kind !== "agent")
+            continue;
+        const agent = node.value;
+        for (const attachment of agent.surfaces?.moltnet ?? []) {
+            const memberId = attachment.memberId ?? fail(`Moltnet attachment on ${node.id} has no member`);
+            assertId(attachment.network, "Moltnet attachment network id");
+            assertMemberId(memberId, "Moltnet attachment member id");
+            records.push({
+                memberId,
+                networkId: attachment.network,
+                nodeId: node.id,
+                rooms: Object.keys(attachment.rooms ?? {})
+            });
+        }
+    }
+    assertUnique(records, (record) => `${record.networkId}\u0000${record.memberId}`, "Moltnet attachment member");
+    assertUnique(records, (record) => `${record.networkId}\u0000${record.nodeId}`, "Moltnet attachment node");
+    return records;
+};
+const assertId = (value, label) => {
+    if (!ID.test(value)) {
+        fail(`${label} is unbounded or noncanonical`);
+    }
+};
+const assertMemberId = (value, label) => {
+    if (!MEMBER_ID.test(value))
+        fail(`${label} is unbounded or noncanonical`);
+};
+const assertConfigPath = (value) => {
+    if (value.length > 255 || !CONFIG_PATH.test(value)) {
+        fail(`Moltnet config path is noncanonical: ${value}`);
+    }
+};
+const validateMoltnet = (artifacts, plan) => {
+    const servers = artifacts?.serverPlans ?? [];
+    const nodePlans = artifacts?.nodePlans ?? [];
+    const attachments = attachmentRecords(plan);
+    assertUnique(servers, (server) => server.networkId, "Moltnet network");
+    assertUnique(servers, (server) => server.id, "Moltnet server");
+    assertUnique(nodePlans, (node) => node.configPath, "Moltnet node config");
+    assertUnique(nodePlans, (node) => `${node.networkId}\u0000${node.memberId ?? ""}`, "Moltnet node member");
+    if (!artifacts && attachments.length > 0)
+        fail("Moltnet attachments exist without artifacts");
+    if (servers.length > MAX_ORGANIZATION_AGENT_MEMBERS || nodePlans.length > MAX_ORGANIZATION_AGENT_MEMBERS
+        || attachments.length > MAX_ORGANIZATION_AGENT_MEMBERS)
+        fail("Moltnet topology exceeds organization bounds");
+    const serverByNetwork = new Map(servers.map((server) => [server.networkId, server]));
+    const attachmentByKey = new Map(attachments.map((attachment) => [
+        `${attachment.networkId}\u0000${attachment.memberId}`, attachment
+    ]));
+    const nodeByKey = new Map(nodePlans.map((node) => [
+        `${node.networkId}\u0000${node.memberId ?? ""}`, node
+    ]));
+    for (const attachment of attachments) {
+        const server = serverByNetwork.get(attachment.networkId)
+            ?? fail(`Moltnet attachment references nonexistent network ${attachment.networkId}`);
+        const rooms = new Map(server.rooms.map((room) => [room.id, room]));
+        for (const roomId of attachment.rooms) {
+            const room = rooms.get(roomId);
+            if (!room || !room.members.includes(attachment.memberId)) {
+                fail(`Moltnet attachment room ${attachment.networkId}/${roomId} lacks ${attachment.memberId}`);
+            }
+        }
+        if (!nodeByKey.has(`${attachment.networkId}\u0000${attachment.memberId}`)) {
+            fail(`Moltnet attachment ${attachment.networkId}/${attachment.memberId} has no node plan`);
+        }
+    }
+    for (const node of nodePlans) {
+        const memberId = node.memberId ?? fail(`Moltnet node ${node.configPath} has no member`);
+        assertConfigPath(node.configPath);
+        assertId(node.networkId, "Moltnet node network id");
+        assertMemberId(memberId, "Moltnet node member id");
+        if (!serverByNetwork.has(node.networkId))
+            fail(`Moltnet node references nonexistent network ${node.networkId}`);
+        if (!attachmentByKey.has(`${node.networkId}\u0000${node.memberId}`)) {
+            fail(`Moltnet node ${node.networkId}/${node.memberId} has no attachment`);
+        }
+        emittedConfigContent(artifacts, node.configPath);
+    }
+    for (const membership of plan.moltnetRoomMemberships ?? []) {
+        const server = serverByNetwork.get(membership.networkId);
+        const room = server?.rooms.filter((candidate) => candidate.id === membership.roomId);
+        if (!server || room?.length !== 1 || !room[0].members.includes(membership.concreteMemberId)) {
+            fail(`Moltnet room membership ${membership.networkId}/${membership.roomId} lacks ${membership.concreteMemberId}`);
+        }
+        const attachment = attachmentByKey.get(`${membership.networkId}\u0000${membership.concreteMemberId}`);
+        if (!attachment || attachment.nodeId === "" || !attachment.rooms.includes(membership.roomId)) {
+            fail(`Moltnet room membership has no concrete attachment`);
+        }
+    }
+    return sort(servers.map((server) => {
+        assertId(server.networkId, "Moltnet network id");
+        assertId(server.id, "Moltnet server id");
+        if (server.mode === "managed" && (!Number.isInteger(server.port) || server.port < 1 || server.port > 65535)) {
+            fail(`Moltnet managed port is invalid for ${server.networkId}`);
+        }
+        const rooms = sort(server.rooms.map((room) => {
+            assertId(room.id, "Moltnet room id");
+            assertUnique(room.members, (member) => member, `Moltnet room member on ${server.networkId}/${room.id}`);
+            for (const member of room.members)
+                assertMemberId(member, `Moltnet room member on ${server.networkId}/${room.id}`);
+            return { id: room.id, members: sort(room.members, (member) => member) };
+        }), (room) => room.id);
+        assertUnique(rooms, (room) => room.id, `Moltnet room on ${server.networkId}`);
+        const nodes = sort(nodePlans.filter((node) => node.networkId === server.networkId).map((node) => {
+            const attachment = attachmentByKey.get(`${node.networkId}\u0000${node.memberId}`);
+            return { configPath: node.configPath, memberId: node.memberId, nodeId: attachment.nodeId,
+                sha256: sha256(emittedConfigContent(artifacts, node.configPath)) };
+        }), (node) => `${node.memberId}\u0000${node.nodeId}`);
+        return { id: server.networkId, internalPort: server.mode === "managed" ? server.port : null,
+            mode: server.mode, nodes, rooms };
+    }), (network) => network.id);
+};
+export const createOrganizationReadinessEvidence = (input) => {
+    const { containerArtifacts, moltnetArtifacts, plan, worldBindings } = input;
+    const distribution = containerArtifacts.distribution.report;
+    if (input.compileVersion !== "0.1")
+        fail("compile version is invalid");
+    const { compile_fingerprint: fingerprint, generated_at: _generatedAt, ...distributionBody } = distribution;
+    if (!FINGERPRINT.test(fingerprint) || containerArtifacts.distribution.fingerprint !== fingerprint
+        || createDistributionFingerprint(distributionBody) !== fingerprint) {
+        fail("compile fingerprint disagrees with canonical distribution report");
+    }
+    const memberNodes = nodeByMember(plan);
+    const organizationMembers = sort([...memberNodes.entries()].map(([memberId, nodeId]) => ({ memberId, nodeId })), (member) => member.memberId);
+    assertUnique(organizationMembers, (member) => member.nodeId, "organization node assignment");
+    for (const member of organizationMembers) {
+        assertMemberId(member.memberId, "organization member id");
+        assertId(member.nodeId, "organization node id");
+    }
+    const worldBindingEvidence = distribution.world_bindings;
+    let projectedWorldBindings = null;
+    if (worldBindings) {
+        const distributionBinding = worldBindingEvidence
+            ?? fail("distribution world-binding evidence is missing or incompatible");
+        if (distributionBinding.artifact_path !== WORLD_BINDINGS_IMAGE_PATH
+            || distributionBinding.schema !== "simfile.world-bindings.v1") {
+            fail("distribution world-binding evidence is missing or incompatible");
+        }
+        const digest = sha256(worldBindings.canonicalBytes);
+        if (!DIGEST.test(distributionBinding.digest) || distributionBinding.digest !== digest) {
+            fail("distribution world-binding digest disagrees with resolved bindings");
+        }
+        const assignments = sort(worldBindings.assignments.map((assignment) => ({
+            memberId: assignment.binding.member.id,
+            nodeId: assignment.nodeId
+        })), (assignment) => assignment.memberId);
+        assertUnique(assignments, (assignment) => assignment.memberId, "world-binding member");
+        assertUnique(assignments, (assignment) => assignment.nodeId, "world-binding node");
+        for (const assignment of assignments) {
+            assertMemberId(assignment.memberId, "world-binding member id");
+            assertId(assignment.nodeId, "world-binding node id");
+        }
+        if (assignments.length !== organizationMembers.length
+            || assignments.some((assignment, index) => assignment.memberId !== organizationMembers[index]?.memberId
+                || assignment.nodeId !== organizationMembers[index]?.nodeId)) {
+            fail("world-binding assignments disagree with resolved organization members");
+        }
+        projectedWorldBindings = {
+            artifactPath: WORLD_BINDINGS_IMAGE_PATH,
+            assignments,
+            digest,
+            schema: "simfile.world-bindings.v1"
+        };
+    }
+    else if (worldBindingEvidence) {
+        fail("distribution contains world-binding evidence without resolved bindings");
+    }
+    const networks = validateMoltnet(moltnetArtifacts, plan);
+    const distributionNetworks = sort(distribution.moltnet.networks, (network) => network.id);
+    assertUnique(distributionNetworks, (network) => network.id, "distribution Moltnet network");
+    if (distributionNetworks.length !== networks.length || networks.some((network, index) => {
+        const distributionNetwork = distributionNetworks[index];
+        return distributionNetwork?.id !== network.id || distributionNetwork.server_mode !== network.mode;
+    })) {
+        fail("distribution Moltnet networks disagree with emitted topology");
+    }
+    const projectLabel = normalizeProjectLabelSlug(distribution.organization.project);
+    if (projectLabel.length > 128 || !ID.test(projectLabel))
+        fail("project label is unbounded or noncanonical");
+    return freeze({
+        compileFingerprint: fingerprint,
+        compileVersion: input.compileVersion,
+        hasExternalMoltnet: networks.some((network) => network.mode === "external"),
+        networks,
+        organizationMembers,
+        projectLabel,
+        version: ORGANIZATION_READINESS_EVIDENCE_VERSION,
+        worldBindings: projectedWorldBindings
+    });
+};

package/dist/compiler/projectManifestGraph.d.ts

@@ -0,0 +1,4 @@
+import { type InlineAgentMember, type TeamManifest } from "../manifest/index.js";
+export declare const createInlineAgentSource: (teamSource: string, memberId: string) => string;
+export declare const collectProjectManifestPaths: (manifestPath: string, recursive: boolean, visited?: Set<string>) => Promise<string[]>;
+export declare const rewriteInlineAgentMembers: (manifest: TeamManifest, mutate: (member: InlineAgentMember) => InlineAgentMember) => TeamManifest;

package/dist/compiler/projectManifestGraph.js

@@ -0,0 +1,24 @@
+import path from "node:path";
+import { getCanonicalManifestPath, getManifestPath, getProjectRoot } from "../filesystem/index.js";
+import { isReferencedMember, loadManifest } from "../manifest/index.js";
+export const createInlineAgentSource = (teamSource, memberId) => `${teamSource}#member=${encodeURIComponent(memberId)}`;
+export const collectProjectManifestPaths = async (manifestPath, recursive, visited = new Set()) => {
+    const canonicalPath = getCanonicalManifestPath(manifestPath);
+    if (visited.has(canonicalPath)) {
+        return [];
+    }
+    visited.add(canonicalPath);
+    if (!recursive) {
+        return [canonicalPath];
+    }
+    const loadedManifest = await loadManifest(canonicalPath);
+    const childRefs = loadedManifest.manifest.kind === "team"
+        ? loadedManifest.manifest.members.filter(isReferencedMember).map((member) => member.ref)
+        : (loadedManifest.manifest.subagents ?? []).map((subagent) => subagent.ref);
+    const nestedPaths = await Promise.all(childRefs.map((ref) => collectProjectManifestPaths(getManifestPath(path.resolve(getProjectRoot(canonicalPath), ref)), true, visited)));
+    return [canonicalPath, ...nestedPaths.flat()];
+};
+export const rewriteInlineAgentMembers = (manifest, mutate) => ({
+    ...manifest,
+    members: manifest.members.map((member) => isReferencedMember(member) ? member : mutate(member))
+});

package/dist/compiler/runProject.d.ts

@@ -25,6 +25,10 @@ export interface RunProjectResult extends CompileProjectResult {
 }
 export declare const createDockerRunInvocation: (compileResult: CompileProjectResult, imageTag: string, options?: {
     authProfile?: ResolvedAuthProfile | null;
+    cliCredential?: {
+        name: string;
+        value: string;
+    };
     containerName?: string;
     detach?: boolean;
     deploymentName?: string;

package/dist/compiler/runProject.js

@@ -5,11 +5,13 @@ import { requireAuthProfile } from "../auth/index.js";
 import { ensureDirectory, fileExists, removeDirectory, writeUtf8File } from "../filesystem/index.js";
 import { appendDockerLabelArgs, createDockerDeploymentLabels, createDockerDeploymentUnitId, createDockerProjectLabel, dockerContextNameForTarget, dockerHostValueForTarget, normalizeDeploymentName, readDeploymentRecordFromOutput, resolveDeploymentRecordPath, verifyDockerDeploymentTarget, writeDockerDeploymentRecordForRun } from "../deployment/index.js";
 import { DEFAULT_OUTPUT_DIRECTORY, SpawnfileError } from "../shared/index.js";
+import { ensureNoopolisRunId, resolveNoopolisRunId } from "../runtime/index.js";
 import { compileProject } from "./compileProject.js";
 import { createDefaultImageTag, resolveDockerBuildArchitecture } from "./buildProject.js";
 import { slugify } from "./helpers.js";
 import { runDockerContainer } from "./runProjectDocker.js";
-import { assertDeclaredModelAuthSatisfied, assertRunEnvironmentSatisfied, prepareRuntimeAuthMounts, readRunEnvFile, renderDockerEnvFile, resolveAuthMountArgs, resolveRunEnvironment } from "./runProjectAuth.js";
+import { executeDockerRunWithSupportCleanup } from "./runProjectLifecycle.js";
+import { assertDeclaredModelAuthSatisfied, assertMoltnetCredentialValuesDistinct, assertRunEnvironmentSatisfied, prepareRuntimeAuthMounts, readRunEnvFile, renderDockerEnvFile, resolveAuthMountArgs, resolveRunEnvironment } from "./runProjectAuth.js";
 export { runDockerContainer };
 const resolveImageTagRoot = (inputPath) => {
     const resolvedPath = path.resolve(inputPath);
@@ -29,10 +31,14 @@ export const createDockerRunInvocation = async (compileResult, imageTag, options
     const supportDirectory = await mkdtemp(path.join(os.tmpdir(), "spawnfile-run-"));
     const envFilePath = path.join(supportDirectory, "run.env");
     try {
-        assertDeclaredModelAuthSatisfied(containerReport, options.authProfile ?? null);
-        const env = resolveRunEnvironment(containerReport, options.authProfile ?? null, await readRunEnvFile(options.envFilePath));
+        assertDeclaredModelAuthSatisfied(containerReport, options.authProfile ?? null, options.cliCredential !== undefined);
+        const env = resolveRunEnvironment(containerReport, options.authProfile ?? null, {
+            ...(await readRunEnvFile(options.envFilePath)),
+            ...(options.cliCredential ? { [options.cliCredential.name]: options.cliCredential.value } : {})
+        });
         const preparedRuntimeAuth = await prepareRuntimeAuthMounts(compileResult.outputDirectory, containerReport, options.authProfile ?? null, env, supportDirectory);
         assertRunEnvironmentSatisfied(containerReport, env, preparedRuntimeAuth.coveredModelSecrets);
+        assertMoltnetCredentialValuesDistinct(containerReport, env);
         await ensureDirectory(supportDirectory);
         await writeUtf8File(envFilePath, renderDockerEnvFile(env));
         const deploymentName = options.deploymentName
@@ -59,16 +65,17 @@ export const createDockerRunInvocation = async (compileResult, imageTag, options
         for (const mount of containerReport.persistent_mounts ?? []) {
             args.push("-v", `${mount.volume_name}:${mount.mount_path}`);
         }
-        if (options.detach && deploymentName) {
+        const deploymentLabels = options.detach && deploymentName ? (() => {
             const compileFingerprint = compileResult.report.compile_fingerprint ?? "sf1:unknown";
-            appendDockerLabelArgs(args, createDockerDeploymentLabels({
-                compileFingerprint,
-                deployment: deploymentName,
+            const runId = resolveNoopolisRunId(process.env);
+            if (!runId)
+                throw new SpawnfileError("runtime_error", "Detached deployment requires a run id for deployment labels");
+            return createDockerDeploymentLabels({ compileFingerprint, deployment: deploymentName,
                 project: createDockerProjectLabel(compileResult.report.root, compileResult.report.project_name),
-                unit: createDockerDeploymentUnitId(deploymentName),
-                version: compileResult.report.spawnfile_version
-            }));
-        }
+                runId, unit: createDockerDeploymentUnitId(deploymentName), version: compileResult.report.spawnfile_version });
+        })() : undefined;
+        if (deploymentLabels)
+            appendDockerLabelArgs(args, deploymentLabels);
         args.push("--env-file", envFilePath);
         args.push(...(await resolveAuthMountArgs(containerReport, options.authProfile ?? null)));
         args.push(...preparedRuntimeAuth.mountArgs);
@@ -80,6 +87,7 @@ export const createDockerRunInvocation = async (compileResult, imageTag, options
             cwd: compileResult.outputDirectory,
             detach: options.detach ?? false,
             deploymentName,
+            ...(deploymentLabels ? { deploymentLabels } : {}),
             dockerContext: options.dockerContext ?? null,
             dockerHost: options.dockerHost ?? null,
             envFilePath,
@@ -147,10 +155,19 @@ export const runProject = async (inputPath, options = {}) => {
             dockerCommand: options.dockerCommand,
             dockerContext: resolvedOptions.dockerContext
         });
+    // Every authority container compiled for this run must stamp causal
+    // events under the same real run id (see specs/CAUSAL.md). compileProject
+    // itself stays a deterministic function of the host env; this only fills
+    // in a generated id when the host did not already provide one, before the
+    // compile step that bakes it into the entrypoint/recipe env.
+    ensureNoopolisRunId();
     const compileResult = await compileProject(inputPath, {
         clean: options.clean,
         containerArchitecture: targetArchitecture,
-        outputDirectory: options.outputDirectory
+        outputDirectory: options.outputDirectory,
+        ...(options.worldBindingsPath !== undefined
+            ? { worldBindingsPath: options.worldBindingsPath }
+            : {})
     });
     const imageTag = resolvedOptions.imageTag ?? createDefaultImageTag(resolveImageTagRoot(inputPath));
     const authProfile = resolvedOptions.authProfile
@@ -166,15 +183,7 @@ export const runProject = async (inputPath, options = {}) => {
         dockerHost: resolvedOptions.dockerHost,
         envFilePath: resolvedOptions.envFilePath
     });
-    let runMetadata;
-    try {
-        runMetadata = await (options.runRunner ?? runDockerContainer)(invocation);
-    }
-    finally {
-        if (!invocation.detach) {
-            await removeDirectory(invocation.supportDirectory);
-        }
-    }
+    const runMetadata = await executeDockerRunWithSupportCleanup(invocation, options.runRunner ?? runDockerContainer);
     const deploymentRecordPath = invocation.detach && invocation.deploymentName
         ? await writeDockerDeploymentRecordForRun({
             authProfileName: authProfile?.name ?? null,

package/dist/compiler/runProjectAuth.d.ts

@@ -4,10 +4,16 @@ interface PreparedRunAuth {
     coveredModelSecrets: Set<string>;
     mountArgs: string[];
 }
+export declare const resolveHostCliCredential: (containerReport: ContainerReport) => Promise<{
+    name: string;
+    sourcePath: string;
+    value: string;
+} | null>;
 export declare const prepareRuntimeAuthMounts: (outputDirectory: string, containerReport: ContainerReport, authProfile: ResolvedAuthProfile | null, env: Record<string, string>, tempRoot: string) => Promise<PreparedRunAuth>;
-export declare const assertDeclaredModelAuthSatisfied: (containerReport: ContainerReport, authProfile: ResolvedAuthProfile | null) => void;
+export declare const assertDeclaredModelAuthSatisfied: (containerReport: ContainerReport, authProfile: ResolvedAuthProfile | null, cliCredentialProvided?: boolean) => void;
 export declare const resolveRunEnvironment: (containerReport: ContainerReport, authProfile: ResolvedAuthProfile | null, envFileEnv?: Record<string, string>) => Record<string, string>;
 export declare const assertRunEnvironmentSatisfied: (containerReport: ContainerReport, env: Record<string, string>, coveredModelSecrets: Set<string>) => void;
+export declare const assertMoltnetCredentialValuesDistinct: (containerReport: ContainerReport, env: Record<string, string>) => void;
 export declare const renderDockerEnvFile: (env: Record<string, string>) => string;
 export declare const readRunEnvFile: (envFilePath: string | undefined) => Promise<Record<string, string>>;
 export declare const resolveAuthMountArgs: (containerReport: ContainerReport, authProfile: ResolvedAuthProfile | null) => Promise<string[]>;

package/dist/compiler/runProjectAuth.js

@@ -1,24 +1,57 @@
+import os from "node:os";
 import path from "node:path";
 import { randomBytes } from "node:crypto";
 import { parseEnvFile } from "../auth/index.js";
 import { fileExists, readUtf8File } from "../filesystem/index.js";
 import { SpawnfileError } from "../shared/index.js";
 import { getRuntimeAdapter } from "../runtime/index.js";
+import { CLI_CREDENTIAL_SECRET_NAME, modelAuthMethodNeedsCliCredential } from "./modelEnv.js";
 const MODEL_AUTH_IMPORT_KINDS = {
     api_key: null,
     "claude-code": "claude-code",
     codex: "codex",
     none: null
 };
+export const resolveHostCliCredential = async (containerReport) => {
+    const needsCredential = containerReport.runtime_instances.some((instance) => Object.values(instance.model_auth_methods).some(modelAuthMethodNeedsCliCredential));
+    if (!needsCredential) {
+        return null;
+    }
+    const codexHome = process.env.CODEX_HOME || path.join(os.homedir(), ".codex");
+    const sourcePath = path.join(codexHome, "auth.json");
+    if (!await fileExists(sourcePath)) {
+        throw new SpawnfileError("validation_error", `Missing ${CLI_CREDENTIAL_SECRET_NAME}; host CLI credential source does not exist: ${sourcePath}`);
+    }
+    let value;
+    try {
+        value = await readUtf8File(sourcePath);
+    }
+    catch (error) {
+        throw new SpawnfileError("validation_error", `Unable to read ${CLI_CREDENTIAL_SECRET_NAME} from host CLI credential source ${sourcePath}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (value.trim().length === 0) {
+        throw new SpawnfileError("validation_error", `Missing ${CLI_CREDENTIAL_SECRET_NAME}; host CLI credential source is empty: ${sourcePath}`);
+    }
+    try {
+        return { name: CLI_CREDENTIAL_SECRET_NAME, sourcePath, value: JSON.stringify(JSON.parse(value)) };
+    }
+    catch (error) {
+        throw new SpawnfileError("validation_error", `Unable to read ${CLI_CREDENTIAL_SECRET_NAME} from host CLI credential source ${sourcePath}: invalid JSON (${error instanceof Error ? error.message : String(error)})`);
+    }
+};
 const addCoveredModelSecrets = (coveredModelSecrets, instanceId, secretNames) => {
     for (const secretName of secretNames) {
         coveredModelSecrets.add(`${instanceId}:${secretName}`);
     }
 };
 export const prepareRuntimeAuthMounts = async (outputDirectory, containerReport, authProfile, env, tempRoot) => {
-    if (!authProfile) {
-        return { coveredModelSecrets: new Set(), mountArgs: [] };
-    }
+    // No early return when `authProfile` is null: an adapter's
+    // `prepareRuntimeAuth` may still have host-credential staging to do that
+    // does not depend on an imported Spawnfile auth profile (e.g. the Pi
+    // adapter mounting the host's `~/.grok`/`~/.codex`/antigravity CLI homes
+    // for a real-engine org — see `src/runtime/pi/runAuth.ts`). Each adapter is
+    // responsible for treating a `null` `authProfile` as "no profile-derived
+    // imports available" rather than failing.
     const coveredModelSecrets = new Set();
     const mountArgs = [];
     for (const instance of containerReport.runtime_instances) {
@@ -38,7 +71,7 @@ export const prepareRuntimeAuthMounts = async (outputDirectory, containerReport,
     }
     return { coveredModelSecrets, mountArgs };
 };
-export const assertDeclaredModelAuthSatisfied = (containerReport, authProfile) => {
+export const assertDeclaredModelAuthSatisfied = (containerReport, authProfile, cliCredentialProvided = false) => {
     const requiredImportKinds = new Set();
     for (const instance of containerReport.runtime_instances) {
         for (const method of Object.values(instance.model_auth_methods)) {
@@ -51,9 +84,15 @@ export const assertDeclaredModelAuthSatisfied = (containerReport, authProfile) =
     if (requiredImportKinds.size === 0) {
         return;
     }
-    if (!authProfile) {
+    if (!authProfile && !cliCredentialProvided) {
         throw new SpawnfileError("validation_error", `Auth profile is required for declared model auth methods: ${[...requiredImportKinds].sort().join(", ")}`);
     }
+    if (cliCredentialProvided) {
+        return;
+    }
+    if (!authProfile) {
+        return;
+    }
     const missingImportKinds = [...requiredImportKinds]
         .filter((kind) => !authProfile.imports[kind])
         .sort();
@@ -62,10 +101,13 @@ export const assertDeclaredModelAuthSatisfied = (containerReport, authProfile) =
     }
 };
 const getImportMountTargetName = (kind) => kind === "claude-code" ? ".claude" : ".codex";
-const createGeneratedRuntimeSecret = (secretName) => {
+const createGeneratedRuntimeSecret = (secretName, generatedMoltnetSecrets) => {
     if (secretName === "OPENCLAW_GATEWAY_TOKEN" || secretName === "OPENCLAW_HOOKS_TOKEN") {
         return randomBytes(24).toString("hex");
     }
+    if (generatedMoltnetSecrets.has(secretName)) {
+        return randomBytes(32).toString("base64url");
+    }
     return null;
 };
 const hasEnvValue = (env, name) => typeof env[name] === "string" && env[name].length > 0;
@@ -93,17 +135,23 @@ export const resolveRunEnvironment = (containerReport, authProfile, envFileEnv =
         ...(authProfile?.env ?? {}),
         ...envFileEnv
     };
+    const generatedMoltnetSecrets = new Set((containerReport.moltnet?.server_plans ?? [])
+        .filter((server) => server.mode === "managed" && server.auth_mode === "bearer")
+        .flatMap((server) => (server.auth_tokens ?? []).map((token) => token.secret)));
     for (const name of new Set([...Object.keys(env), ...containerReport.secrets_required])) {
         const processValue = process.env[name];
         if (typeof processValue === "string" && processValue.length > 0) {
             env[name] = processValue;
         }
     }
-    for (const name of containerReport.runtime_secrets_required) {
+    for (const name of new Set([
+        ...containerReport.runtime_secrets_required,
+        ...generatedMoltnetSecrets
+    ])) {
         if (hasEnvValue(env, name)) {
             continue;
         }
-        const generatedValue = createGeneratedRuntimeSecret(name);
+        const generatedValue = createGeneratedRuntimeSecret(name, generatedMoltnetSecrets);
         if (generatedValue) {
             env[name] = generatedValue;
         }
@@ -121,6 +169,27 @@ export const assertRunEnvironmentSatisfied = (containerReport, env, coveredModel
         throw new SpawnfileError("validation_error", `Missing required runtime env: ${missing.sort().join(", ")}`);
     }
 };
+export const assertMoltnetCredentialValuesDistinct = (containerReport, env) => {
+    for (const server of containerReport.moltnet?.server_plans ?? []) {
+        if (server.mode !== "managed" || server.auth_mode !== "bearer") {
+            continue;
+        }
+        const secretNames = (server.auth_tokens ?? []).map((token) => token.secret);
+        const normalizedValues = secretNames.map((name) => {
+            const value = env[name];
+            if (typeof value !== "string" || value.trim().length === 0) {
+                return null;
+            }
+            if (value !== value.trim()) {
+                throw new SpawnfileError("validation_error", `Moltnet credential ${name} must not contain leading or trailing whitespace`);
+            }
+            return value;
+        }).filter((value) => value !== null);
+        if (new Set(normalizedValues).size !== normalizedValues.length) {
+            throw new SpawnfileError("validation_error", `Moltnet network ${server.network_id} requires distinct credential values`);
+        }
+    }
+};
 export const renderDockerEnvFile = (env) => `${Object.entries(env)
     .sort(([left], [right]) => left.localeCompare(right))
     .map(([name, value]) => `${name}=${value}`)
@@ -142,6 +211,15 @@ export const resolveAuthMountArgs = async (containerReport, authProfile) => {
         return [];
     }
     const args = [];
+    // Pi owns its model and CLI-engine auth projection in preparePiRuntimeAuth.
+    // Mounting the generic imported home onto the same destination would create
+    // duplicate Docker mount points and bypass the adapter's minimal-file staging.
+    const piRuntimeHomes = new Set(containerReport.runtime_instances
+        .filter((instance) => instance.runtime === "pi" || instance.runtime === "daimon")
+        .map((instance) => instance.home_path)
+        .filter((homePath) => homePath !== null));
+    const genericRuntimeHomes = containerReport.runtime_homes
+        .filter((runtimeHome) => !piRuntimeHomes.has(runtimeHome));
     for (const [kind, entry] of Object.entries(authProfile.imports)) {
         if (!entry) {
             continue;
@@ -149,7 +227,7 @@ export const resolveAuthMountArgs = async (containerReport, authProfile) => {
         if (!(await fileExists(entry.path))) {
             throw new SpawnfileError("validation_error", `Imported auth path for ${kind} does not exist: ${entry.path}`);
         }
-        for (const runtimeHome of containerReport.runtime_homes) {
+        for (const runtimeHome of genericRuntimeHomes) {
             args.push("-v", `${entry.path}:${path.posix.join(runtimeHome, getImportMountTargetName(kind))}`);
         }
     }

package/dist/compiler/runProjectDocker.d.ts

@@ -5,15 +5,22 @@ export interface DockerRunInvocation {
     cwd: string;
     detach: boolean;
     deploymentName?: string | null;
+    deploymentLabels?: Readonly<Record<string, string>>;
     dockerContext?: string | null;
     dockerHost?: string | null;
     envFilePath: string;
     imageTag: string;
+    onDetachedStarted?: (result: {
+        containerId: string;
+    }) => Promise<void>;
     supportDirectory: string;
 }
 export interface DockerRunResult {
     containerId?: string;
+    deploymentLabels?: Readonly<Record<string, string>>;
     imageId?: string;
 }
 export type DockerRunRunner = (invocation: DockerRunInvocation) => Promise<DockerRunResult | void>;
+export declare const createDetachedContainerInspectArgs: (invocation: DockerRunInvocation, containerId: string) => string[];
+export declare const parseDetachedContainerInspect: (stdout: string, expectedContainerId: string, expectedLabels?: Readonly<Record<string, string>>) => DockerRunResult;
 export declare const runDockerContainer: DockerRunRunner;