spawnfile 0.1.13 → 0.1.14

package/dist/runtime/pi/appWakeContextSource.js

@@ -0,0 +1,398 @@
+export const renderPiWakeContextSource = () => String.raw `const TEAM_CONTEXTS_FILE = ".spawnfile/team-contexts.yaml";
+const TEAM_CONTEXT_INDEX_CACHE = new Map();
+const TEAM_CONTEXT_INDEX_PROMISES = new Map();
+
+const asString = (value) => (typeof value === "string" ? value.trim() : "");
+const asStringOrUndefined = (value) => {
+  const text = asString(value);
+  return text.length > 0 ? text : undefined;
+};
+
+const asStringList = (value) => {
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  return [...new Set(value.map(asString).filter((entry) => entry.length > 0))];
+};
+
+const asObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : undefined;
+
+const asMemoryScopeText = (value) => {
+  const scope = asStringOrUndefined(value?.scope);
+  const qualifier = asStringOrUndefined(value?.qualifier);
+  if (!scope || !qualifier) {
+    return undefined;
+  }
+  return scope + ":" + qualifier;
+};
+
+const parseLegacyMoltnetContextId = (contextId) => {
+  const value = asString(contextId);
+  const match = /^moltnet:([^:]+):room:([^:]+)(?::thread:([^:]+))?$/u.exec(value);
+  if (!match) {
+    return undefined;
+  }
+
+  return {
+    networkId: asString(match[1]),
+    roomId: asString(match[2]),
+    threadId: asString(match[3] ?? "")
+  };
+};
+
+const parseWakeContext = (payload) => {
+  const context = asObject(payload.context) ? payload.context : {};
+  const legacy = parseLegacyMoltnetContextId(payload.context_id);
+  const senderId = asStringOrUndefined(context.sender_id ?? context.senderId ?? context.from ?? payload.from);
+
+  const networkId = asStringOrUndefined(context.networkId ?? context.network ?? legacy?.networkId);
+  const roomId = asStringOrUndefined(context.roomId ?? context.room ?? context.channel ?? legacy?.roomId);
+  const threadId = asStringOrUndefined(context.threadId ?? context.thread ?? legacy?.threadId);
+
+  const resolved = {
+    artifactPaths: asStringList(context.artifactPaths ?? context.artifacts),
+    from: asStringOrUndefined(context.from),
+    networkId,
+    roomId,
+    surface: asStringOrUndefined(context.surface) || (networkId ? "moltnet" : undefined),
+    taskId: asStringOrUndefined(context.taskId ?? context.task),
+    teamId: asStringOrUndefined(context.teamId ?? context.team),
+    threadId,
+    roleId: asStringOrUndefined(context.roleId ?? context.role),
+    pairPeers: asStringList(context.pairPeers ?? context.participants),
+    participants: asStringList(context.participants ?? context.pairPeers)
+  };
+
+  if (senderId) {
+    if (resolved.pairPeers.length === 0) {
+      resolved.pairPeers = [senderId];
+      resolved.participants = [senderId];
+    }
+    if (resolved.from === undefined) {
+      resolved.from = senderId;
+    }
+  }
+
+  return {
+    senderId,
+    context: resolved
+  };
+};
+
+const readTeamContextIndex = async (workspacePath) => {
+  if (TEAM_CONTEXT_INDEX_CACHE.has(workspacePath)) {
+    return TEAM_CONTEXT_INDEX_CACHE.get(workspacePath);
+  }
+
+  if (TEAM_CONTEXT_INDEX_PROMISES.has(workspacePath)) {
+    return TEAM_CONTEXT_INDEX_PROMISES.get(workspacePath);
+  }
+
+  const load = (async () => {
+    try {
+      const indexPath = path.join(workspacePath, TEAM_CONTEXTS_FILE);
+      const text = await readFile(indexPath, "utf8");
+      const { parse: parseYaml } = await import("yaml");
+      const parsed = parseYaml(text);
+      const index = asObject(parsed) ? parsed : {};
+      TEAM_CONTEXT_INDEX_CACHE.set(workspacePath, index);
+      return index;
+    } catch {
+      TEAM_CONTEXT_INDEX_CACHE.set(workspacePath, undefined);
+      return undefined;
+    } finally {
+      TEAM_CONTEXT_INDEX_PROMISES.delete(workspacePath);
+    }
+  })();
+
+  TEAM_CONTEXT_INDEX_PROMISES.set(workspacePath, load);
+  return load;
+};
+
+const resolveRoomEnvironmentFromIndex = (index, networkId, roomId, threadId) => {
+  const activeRooms = asObject(asObject(index)?.active_environments)?.moltnet;
+  const activeEntry = asObject(activeRooms?.[networkId]?.rooms?.[roomId]);
+  if (activeEntry) {
+    return {
+      teamId: asStringOrUndefined(activeEntry.team_id),
+      team_doc: asStringOrUndefined(activeEntry.team_doc),
+      roster: asStringOrUndefined(activeEntry.roster),
+      session_key: asStringOrUndefined(activeEntry.session_key),
+      context_key: asStringOrUndefined(activeEntry.context_key),
+      member_slot: asStringOrUndefined(activeEntry.member_slot),
+      team_scope: asMemoryScopeText(activeEntry.memory?.durable_scope),
+      room_scope: asMemoryScopeText(activeEntry.memory?.ephemeral_scope),
+      thread_scope: threadId ? "thread:" + networkId + ":" + roomId + ":" + threadId : undefined
+    };
+  }
+
+  const membershipEntries = [
+    ...(Array.isArray(index?.direct_memberships) ? index.direct_memberships : []),
+    ...(Array.isArray(index?.representations) ? index.representations : [])
+  ];
+
+  for (const entry of membershipEntries) {
+    const resolvedEntry = asObject(entry);
+    if (!resolvedEntry) {
+      continue;
+    }
+
+    const bindings = Array.isArray(resolvedEntry.surfaces?.moltnet)
+      ? resolvedEntry.surfaces.moltnet
+      : [];
+
+    for (const binding of bindings) {
+      const resolvedBinding = asObject(binding);
+      if (!resolvedBinding) {
+        continue;
+      }
+      const bindingNetwork = asStringOrUndefined(resolvedBinding.network);
+      const rooms = asStringList(resolvedBinding.rooms);
+      if (bindingNetwork !== networkId || !rooms.includes(roomId)) {
+        continue;
+      }
+
+      return {
+        teamId: asStringOrUndefined(resolvedEntry.team),
+        team_doc: asStringOrUndefined(resolvedEntry.team_doc),
+        roster: asStringOrUndefined(resolvedEntry.roster),
+        team_scope: asStringOrUndefined(resolvedEntry.team)
+          ? "team:" + asStringOrUndefined(resolvedEntry.team)
+          : undefined,
+        room_scope: networkId && roomId ? "room:" + networkId + ":" + roomId : undefined,
+        thread_scope: threadId ? "thread:" + networkId + ":" + roomId + ":" + threadId : undefined,
+        context_key: asStringOrUndefined(resolvedEntry.context_key),
+        member_slot: asStringOrUndefined(resolvedEntry.member ?? resolvedEntry.representative)
+      };
+    }
+  }
+
+  return undefined;
+};
+
+const resolveScheduleContextFromIndex = (index) => {
+  const activeSchedules = asObject(asObject(asObject(index)?.active_environments)?.schedules);
+  const defaultSchedule = asObject(activeSchedules?.default);
+
+  if (defaultSchedule) {
+    const contextKey = asStringOrUndefined(defaultSchedule.context_key);
+    const membershipEntries = [
+      ...(Array.isArray(index?.direct_memberships) ? index.direct_memberships : []),
+      ...(Array.isArray(index?.representations) ? index.representations : [])
+    ];
+    const matched = contextKey
+      ? membershipEntries.find((entry) => asStringOrUndefined(entry?.context_key) === contextKey)
+      : undefined;
+
+    const resolvedMatch = asObject(matched);
+
+    if (contextKey === "self") {
+      return {
+        context_key: "self",
+        team_scope: asMemoryScopeText(defaultSchedule.memory?.durable_scope)
+      };
+    }
+
+    return {
+      teamId: asStringOrUndefined(resolvedMatch?.team) ?? contextKey,
+      team_doc: asStringOrUndefined(resolvedMatch?.team_doc),
+      roster: asStringOrUndefined(resolvedMatch?.roster),
+      context_key: contextKey,
+      member_slot: asStringOrUndefined(resolvedMatch?.member ?? resolvedMatch?.representative),
+      team_scope: asMemoryScopeText(defaultSchedule.memory?.durable_scope),
+      session_key: asStringOrUndefined(defaultSchedule.session_key)
+    };
+  }
+
+  if (!Array.isArray(index?.direct_memberships) || index.direct_memberships.length !== 1) {
+    return undefined;
+  }
+
+  const entry = asObject(index.direct_memberships[0]);
+  if (!entry) {
+    return undefined;
+  }
+
+  return {
+    teamId: asStringOrUndefined(entry.team),
+    team_doc: asStringOrUndefined(entry.team_doc),
+    roster: asStringOrUndefined(entry.roster),
+    context_key: asStringOrUndefined(entry.context_key),
+    member_slot: asStringOrUndefined(entry.member),
+    team_scope: asStringOrUndefined(entry.team)
+      ? "team:" + asStringOrUndefined(entry.team)
+      : undefined
+  };
+};
+
+const resolveDreamContextFromIndex = (index, environmentKey) => {
+  const activeDreams = asObject(asObject(asObject(index)?.active_environments)?.dreams);
+  if (!activeDreams) {
+    return undefined;
+  }
+
+  const membershipEntries = [
+    ...(Array.isArray(index?.direct_memberships) ? index.direct_memberships : []),
+    ...(Array.isArray(index?.representations) ? index.representations : [])
+  ];
+
+  const explicit = environmentKey ? asObject(activeDreams[environmentKey]) : undefined;
+  const selectedKey = explicit
+    ? environmentKey
+    : Object.keys(activeDreams).length === 1
+      ? Object.keys(activeDreams)[0]
+      : "self";
+  const selected = asObject(activeDreams[selectedKey]);
+  if (!selected) {
+    return undefined;
+  }
+
+  const contextKey = asStringOrUndefined(selected.context_key);
+  const matched = contextKey
+    ? membershipEntries.find((member) => asStringOrUndefined(member?.context_key) === contextKey)
+    : undefined;
+
+  const resolvedMatch = asObject(matched);
+  const teamScopeText = asMemoryScopeText(selected.memory?.durable_scope);
+
+  return {
+    context_key: contextKey,
+    environment_key: asStringOrUndefined(selected.environment_key),
+    session_key_template: asStringOrUndefined(selected.session_key_template),
+    team_scope: teamScopeText,
+    teamId: teamScopeText?.startsWith("team:") ? teamScopeText.slice(5) : asStringOrUndefined(resolvedMatch?.team) ?? (contextKey === "self" ? undefined : contextKey),
+    team_doc: asStringOrUndefined(resolvedMatch?.team_doc),
+    roster: asStringOrUndefined(resolvedMatch?.roster),
+    member_slot: asStringOrUndefined(resolvedMatch?.member ?? resolvedMatch?.representative)
+  };
+};
+
+const listDreamEnvironmentKeys = async (workspacePath) => {
+  const index = await readTeamContextIndex(workspacePath);
+  const activeDreams = asObject(asObject(asObject(index)?.active_environments)?.dreams);
+  return activeDreams ? Object.keys(activeDreams).sort() : ["self"];
+};
+
+const buildRuntimeContextForWake = (payload) => {
+  const parsed = parseWakeContext(payload);
+  const messageFrom = asStringOrUndefined(payload.from);
+  const kind = normalizeWakeKind(typeof payload.wake_kind === "string" ? payload.wake_kind : payload.kind);
+  const isMessageWake = kind === "message" || kind === "manual";
+  const surface = parsed.context.surface;
+  const isMoltnetRoomWake = isMessageWake && surface === "moltnet" && parsed.context.networkId && parsed.context.roomId;
+
+  return {
+    context: parsed.context,
+    activeEnvironment: {
+      ...parsed.context,
+      surface,
+      senderId: parsed.senderId
+    },
+    eventFrom: messageFrom ?? "moltnet",
+    messageFrom: messageFrom ?? parsed.senderId ?? "moltnet",
+    isRoomWake: isMoltnetRoomWake
+  };
+};
+
+const renderDreamSessionKey = (template, runId) => {
+  if (!template) {
+    return undefined;
+  }
+  return template.replace("{run_id}", runId);
+};
+
+const enrichWakeContext = async (workspacePath, payload) => {
+  const base = buildRuntimeContextForWake(payload);
+  const index = await readTeamContextIndex(workspacePath);
+  if (!index) {
+    return base;
+  }
+
+  const kind = normalizeWakeKind(typeof payload.wake_kind === "string" ? payload.wake_kind : payload.kind);
+  if (kind === "schedule") {
+    const scheduleContext = resolveScheduleContextFromIndex(index);
+    if (!scheduleContext) {
+      return base;
+    }
+
+    return {
+      ...base,
+      context: {
+        ...base.context,
+        surface: "schedule",
+        teamId: scheduleContext.teamId || base.context.teamId,
+        team_doc: scheduleContext.team_doc || base.context.team_doc,
+        roster: scheduleContext.roster || base.context.roster
+      },
+      activeEnvironment: {
+        ...base.activeEnvironment,
+        surface: "schedule",
+        ...scheduleContext
+      }
+    };
+  }
+
+  if (base.isRoomWake) {
+    const roomContext = resolveRoomEnvironmentFromIndex(
+      index,
+      base.context.networkId,
+      base.context.roomId,
+      base.context.threadId
+    );
+
+    if (roomContext) {
+      return {
+        ...base,
+        eventFrom: undefined,
+        context: {
+          ...base.context,
+          from: undefined,
+          networkId: base.context.networkId,
+          roomId: base.context.roomId,
+          threadId: base.context.threadId,
+          teamId: roomContext.teamId || base.context.teamId,
+          team_doc: roomContext.team_doc || base.context.team_doc,
+          roster: roomContext.roster || base.context.roster,
+          pairPeers: base.context.pairPeers,
+          participants: base.context.participants
+        },
+        activeEnvironment: {
+          ...base.activeEnvironment,
+          ...roomContext,
+          networkId: base.context.networkId,
+          roomId: base.context.roomId,
+          threadId: base.context.threadId,
+          surface: "moltnet"
+        },
+        isRoomWake: false
+      };
+    }
+  }
+
+  if (kind === "dream") {
+    const dreamContext = resolveDreamContextFromIndex(index, payload.dream_environment ?? payload.environment_key);
+    if (dreamContext) {
+      const runId = asStringOrUndefined(payload.run_id) ?? String(Date.now());
+      return {
+        ...base,
+        eventFrom: renderDreamSessionKey(dreamContext.session_key_template, runId) ?? base.eventFrom,
+        context: {
+          ...base.context,
+          surface: "dream",
+          teamId: dreamContext.teamId || base.context.teamId,
+          team_doc: dreamContext.team_doc || base.context.team_doc,
+          roster: dreamContext.roster || base.context.roster
+        },
+        activeEnvironment: {
+          ...base.activeEnvironment,
+          ...dreamContext,
+          run_id: runId,
+          surface: "dream"
+        }
+      };
+    }
+  }
+
+  return base;
+};
+`;

package/dist/runtime/pi/containerTargets.d.ts

@@ -0,0 +1,4 @@
+import type { ContainerTarget, ContainerTargetInput } from "../types.js";
+export declare const PI_CONFIG_FILE = "pi-app.json";
+export declare const PI_CONTROL_PORT = 19690;
+export declare const createPiContainerTargets: (inputs: ContainerTargetInput[]) => Promise<ContainerTarget[]>;

package/dist/runtime/pi/containerTargets.js

@@ -0,0 +1,57 @@
+import path from "node:path";
+import { listExecutionModelSecretNames } from "../../compiler/modelEnv.js";
+import { renderPiScheduleSource } from "./appScheduleSource.js";
+import { createPiAgentConfig, renderPiApp, renderPiAppConfig, renderPiModelsConfig, renderPiPackageJson, resolvePiEngine, } from "./appTemplate.js";
+export const PI_CONFIG_FILE = "pi-app.json";
+export const PI_CONTROL_PORT = 19690;
+const PI_MODELS_FILE = "home/.pi/agent/models.json";
+const moveWorkspaceFileToAgentWorkspace = (file, agentSlug) => {
+    if (!file.path.startsWith("workspace/"))
+        return file;
+    return {
+        ...file,
+        path: path.posix.join("workspace", "agents", agentSlug, file.path.slice("workspace/".length)),
+    };
+};
+export const createPiContainerTargets = async (inputs) => {
+    const agentInputs = inputs.filter((input) => input.kind === "agent" && input.value.kind === "agent");
+    if (agentInputs.length === 0)
+        return [];
+    const agents = agentInputs.map((input) => createPiAgentConfig(input.value, input.slug, input.id, input.worldBinding));
+    const engineByNodeId = Object.fromEntries(agentInputs.map((input) => [input.id, resolvePiEngine(input.value).kind]));
+    const worldTokenEnvNames = agents
+        .flatMap((agent) => agent.world ? [agent.world.tokenEnv] : [])
+        .sort();
+    const envFiles = [
+        ...new Set(agentInputs.flatMap((input) => listExecutionModelSecretNames(input.value.execution))),
+    ].map((secretName) => ({
+        envName: secretName,
+        relativePath: `secrets/${secretName}`,
+    }));
+    return [{
+            engineByNodeId,
+            envFiles,
+            files: [
+                ...agentInputs.flatMap((input) => input.emittedFiles.map((file) => moveWorkspaceFileToAgentWorkspace(file, input.slug))),
+                { content: renderPiAppConfig(agents), path: PI_CONFIG_FILE },
+                {
+                    content: renderPiModelsConfig(agentInputs.map((input) => input.value)),
+                    path: PI_MODELS_FILE,
+                },
+                { content: renderPiPackageJson(), path: "runtime/package.json" },
+                {
+                    content: renderPiScheduleSource(),
+                    mode: 0o644,
+                    path: "runtime/schedule.mjs",
+                },
+                {
+                    content: renderPiApp({ world: agents.some((agent) => agent.world !== undefined) }),
+                    mode: 0o755,
+                    path: "runtime/app.mjs",
+                },
+            ],
+            id: "pi-app",
+            sourceIds: agentInputs.map((input) => input.id).sort(),
+            ...(worldTokenEnvNames.length > 0 ? { worldTokenEnvNames } : {}),
+        }];
+};

package/dist/runtime/pi/runAuth.js

@@ -1,7 +1,8 @@
 import path from "node:path";
-import { chmod } from "node:fs/promises";
+import os from "node:os";
+import { chmod, cp, lstat, readdir } from "node:fs/promises";
 import { loadImportedClaudeCodeCredential, loadImportedCodexCredential } from "../../auth/index.js";
-import { ensureDirectory, writeUtf8File } from "../../filesystem/index.js";
+import { ensureDirectory, fileExists, writeUtf8File } from "../../filesystem/index.js";
 const createMountArgs = (hostPath, containerPath) => [
     "-v",
     `${hostPath}:${containerPath}`
@@ -19,21 +20,134 @@ const writeJsonFile = async (tempRoot, relativePath, value) => {
     return hostPath;
 };
 const collectCoveredSecrets = (instanceSecrets, enabled, secretName) => enabled && instanceSecrets.includes(secretName) ? [secretName] : [];
+const copyIfExists = async (sourcePath, targetPath) => {
+    if (!await fileExists(sourcePath)) {
+        return;
+    }
+    await ensureDirectory(path.dirname(targetPath));
+    await cp(sourcePath, targetPath, {
+        dereference: true,
+        force: true,
+        recursive: true
+    });
+};
+const makeReadable = async (targetPath) => {
+    const stats = await lstat(targetPath);
+    if (!stats.isDirectory()) {
+        await chmod(targetPath, 0o644);
+        return;
+    }
+    await chmod(targetPath, 0o755);
+    for (const entry of await readdir(targetPath)) {
+        await makeReadable(path.join(targetPath, entry));
+    }
+};
+const stageCliHome = async (sourcePath, tempRoot, relativeTarget, entries) => {
+    const targetPath = path.join(tempRoot, "runtime-auth", "pi", relativeTarget);
+    await ensureDirectory(targetPath);
+    for (const entry of entries) {
+        await copyIfExists(path.join(sourcePath, entry), path.join(targetPath, entry));
+    }
+    await makeReadable(targetPath);
+    return targetPath;
+};
+const stageGrokHome = async (sourcePath, tempRoot) => stageCliHome(sourcePath, tempRoot, "grok-home", [
+    ".metadata_version",
+    "auth.json",
+    "config.toml",
+    "mcp_credentials.json",
+    "version.json",
+    "worktrees.db"
+]);
+/** The generated `runCodexEngine` (appCliEnginesSource.ts) reads codex CLI
+ * auth from `<containerHome>/.codex/auth.json`, so — mirroring the grok and
+ * antigravity homes — stage the real host `~/.codex/auth.json` when a codex
+ * CLI engine runs. Only `auth.json` is staged: the host `config.toml` carries
+ * machine-specific settings the container should not inherit, and it is the
+ * only file `runCodexEngine` copies forward. */
+const stageCodexHome = async (sourcePath, tempRoot) => stageCliHome(sourcePath, tempRoot, "codex-home", ["auth.json"]);
+const stageAntigravityHome = async (sourcePath, tempRoot) => stageCliHome(sourcePath, tempRoot, "antigravity-home", [
+    "Cookies",
+    "Cookies-journal",
+    "Local Storage",
+    "Preferences",
+    "Session Storage",
+    "app_storage.json"
+]);
+const stageAntigravityCliHome = async (sourcePath, tempRoot) => stageCliHome(sourcePath, tempRoot, "antigravity-cli-home", [
+    "antigravity-oauth-token",
+    "cache/default_project_id.txt",
+    "cache/onboarding.json",
+    "config/.migrated",
+    "config/mcp_config.json"
+]);
+const firstExistingDirectory = async (paths) => {
+    for (const candidate of paths) {
+        if (await fileExists(candidate)) {
+            return candidate;
+        }
+    }
+    return null;
+};
+const collectOptionalCliHomeMounts = async (containerHomePath, tempRoot, options = {}) => {
+    const home = os.homedir();
+    const mounts = [];
+    const grokCandidates = process.env.GROK_HOME
+        ? [process.env.GROK_HOME]
+        : [path.join(home, ".grok")];
+    const grokHome = await firstExistingDirectory(grokCandidates);
+    if (grokHome) {
+        mounts.push(...createMountArgs(await stageGrokHome(grokHome, tempRoot), path.posix.join(containerHomePath, ".grok")));
+    }
+    if (!options.skipCodex) {
+        const codexCandidates = process.env.CODEX_HOME
+            ? [process.env.CODEX_HOME]
+            : [path.join(home, ".codex")];
+        const codexHome = await firstExistingDirectory(codexCandidates);
+        if (codexHome && await fileExists(path.join(codexHome, "auth.json"))) {
+            mounts.push(...createMountArgs(await stageCodexHome(codexHome, tempRoot), path.posix.join(containerHomePath, ".codex")));
+        }
+    }
+    const antigravityCandidates = process.env.ANTIGRAVITY_HOME
+        ? [process.env.ANTIGRAVITY_HOME]
+        : process.env.AGY_HOME
+            ? [process.env.AGY_HOME]
+            : [
+                path.join(home, "Library", "Application Support", "Antigravity"),
+                path.join(home, ".config", "Antigravity"),
+                path.join(home, ".antigravity")
+            ];
+    const antigravityHome = await firstExistingDirectory(antigravityCandidates);
+    if (antigravityHome) {
+        mounts.push(...createMountArgs(await stageAntigravityHome(antigravityHome, tempRoot), path.posix.join(containerHomePath, ".config", "Antigravity")));
+    }
+    const antigravityCliCandidates = process.env.ANTIGRAVITY_CLI_HOME
+        ? [process.env.ANTIGRAVITY_CLI_HOME]
+        : [path.join(home, ".gemini", "antigravity-cli")];
+    const antigravityCliHome = await firstExistingDirectory(antigravityCliCandidates);
+    if (antigravityCliHome) {
+        mounts.push(...createMountArgs(await stageAntigravityCliHome(antigravityCliHome, tempRoot), path.posix.join(containerHomePath, ".gemini", "antigravity-cli")));
+    }
+    return mounts;
+};
 export const preparePiRuntimeAuth = async (input) => {
     if (!input.instance.home_path) {
         return { coveredModelSecrets: [], mountArgs: [] };
     }
-    const codex = input.authProfile.imports.codex
+    const codex = input.authProfile?.imports.codex
         ? await loadImportedCodexCredential(input.authProfile.imports.codex.path)
         : null;
-    const claudeCode = input.authProfile.imports["claude-code"]
+    const claudeCode = input.authProfile?.imports["claude-code"]
         ? await loadImportedClaudeCodeCredential(input.authProfile.imports["claude-code"].path)
         : null;
     const useCodex = input.instance.model_auth_methods.openai === "codex" && codex;
     const useClaudeCode = input.instance.model_auth_methods.anthropic === "claude-code" && claudeCode;
-    if (!useCodex && !useClaudeCode) {
-        return { coveredModelSecrets: [], mountArgs: [] };
-    }
+    const mountArgs = await collectOptionalCliHomeMounts(input.instance.home_path, input.tempRoot, {
+        // `up` delivers this credential through the env-secret channel; do not
+        // also create a remote-host bind mount for the same Codex auth file.
+        skipCodex: Boolean(input.authProfile?.imports.codex) ||
+            typeof input.env.SPAWNFILE_CLI_AUTH_JSON === "string"
+    });
     const authProfiles = {};
     if (useCodex) {
         authProfiles["openai-codex"] = {
@@ -57,12 +171,15 @@ export const preparePiRuntimeAuth = async (input) => {
                 type: "api_key"
             };
     }
-    const authPath = await writeJsonFile(input.tempRoot, path.join("runtime-auth", "pi", input.instance.id, "auth.json"), authProfiles);
+    if (useCodex || useClaudeCode) {
+        const authPath = await writeJsonFile(input.tempRoot, path.join("runtime-auth", "pi", input.instance.id, "auth.json"), authProfiles);
+        mountArgs.push(...createMountArgs(authPath, path.posix.join(input.instance.home_path, ".pi", "agent", "auth.json")));
+    }
     return {
         coveredModelSecrets: [
             ...collectCoveredSecrets(input.instance.model_secrets_required, Boolean(useCodex), "OPENAI_API_KEY"),
             ...collectCoveredSecrets(input.instance.model_secrets_required, Boolean(useClaudeCode), "ANTHROPIC_API_KEY")
         ],
-        mountArgs: createMountArgs(authPath, path.posix.join(input.instance.home_path, ".pi", "agent", "auth.json"))
+        mountArgs
     };
 };

package/dist/runtime/pi/testHelpers.d.ts

@@ -0,0 +1,2 @@
+import type { ResolvedAgentNode } from "../../compiler/types.js";
+export declare const createPiTestNode: (overrides?: Partial<ResolvedAgentNode>) => ResolvedAgentNode;

package/dist/runtime/pi/testHelpers.js

@@ -0,0 +1,40 @@
+export const createPiTestNode = (overrides = {}) => ({
+    description: "Pi test agent",
+    docs: [
+        {
+            content: "# Instructions\n",
+            role: "system",
+            sourcePath: "/tmp/AGENTS.md"
+        }
+    ],
+    env: {},
+    execution: {
+        model: {
+            primary: {
+                auth: { method: "codex" },
+                name: "gpt-5.4-mini",
+                provider: "openai"
+            }
+        },
+        sandbox: { mode: "workspace" }
+    },
+    kind: "agent",
+    mcpServers: [],
+    name: "assistant",
+    policyMode: null,
+    policyOnDegrade: null,
+    runtime: { name: "pi", options: {} },
+    secrets: [],
+    skills: [
+        {
+            content: "---\nname: note\ndescription: Note\n---\n\nCreate notes.\n",
+            name: "note",
+            ref: "./skills/note",
+            requiresMcp: [],
+            sourcePath: "/tmp/skills/note/SKILL.md"
+        }
+    ],
+    source: "/tmp/agent/Spawnfile",
+    subagents: [],
+    ...overrides
+});