spawnfile 0.1.13 → 0.1.17

package/dist/compiler/containerArtifactsPlans.js

@@ -1,69 +1,13 @@
-import path from "node:path";
 import { createRuntimeInstallRecipe, getRuntimeAdapter } from "../runtime/index.js";
-import { SpawnfileError } from "../shared/index.js";
+import { resolveNoopolisRunId } from "../runtime/index.js";
 import { listAgentSurfaceSecretNames } from "./agentSurfaces.js";
-import { listExecutionModelSecretNames, resolveExecutionModelAuthMethods } from "./modelEnv.js";
 import { resolveTargetResources } from "./containerTargetResources.js";
-const CONFIG_FILE_PLACEHOLDER = "<config-file>";
-const INSTANCE_ROOT_PLACEHOLDER = "<instance-root>";
-const createDefaultTargets = (inputs) => inputs.map((input) => ({
-    files: input.emittedFiles,
-    id: `${input.kind}-${input.slug}`,
-    sourceIds: [input.id]
-}));
-const resolveTargetEnvFiles = (configPath, target) => (target.envFiles ?? []).map((binding) => ({
-    envName: binding.envName,
-    filePath: path.posix.join(path.posix.dirname(configPath), binding.relativePath)
-}));
-const resolveTargetConfigEnvBindings = (meta, target) => [...(meta.configEnvBindings ?? []), ...(target.configEnvBindings ?? [])];
-const assertTargetHasConfig = (runtimeName, targetId, meta, files) => {
-    if (!files.some((file) => file.path === meta.configFileName)) {
-        throw new SpawnfileError("runtime_error", `Container target ${targetId} for ${runtimeName} is missing ${meta.configFileName}`);
-    }
-};
-const createPackageIdentity = (pkg) => `${pkg.manager}\u0000${pkg.name}\u0000${pkg.version ?? ""}\u0000${pkg.scope ?? ""}`;
-const createPackageConflictIdentity = (pkg) => `${pkg.manager}\u0000${pkg.name}`;
-const createPackageLabel = (pkg) => `${pkg.manager} package ${pkg.name}`;
-const resolveTargetPackages = (target, inputs) => {
-    const sourceIds = new Set(target.sourceIds ?? []);
-    if (sourceIds.size === 0) {
-        return [];
-    }
-    const byIdentity = new Map();
-    for (const input of inputs) {
-        if (!sourceIds.has(input.id) || input.value.kind !== "agent") {
-            continue;
-        }
-        const candidatePackages = input.value.packages ?? [];
-        for (const currentPackage of candidatePackages) {
-            const conflictIdentity = createPackageConflictIdentity(currentPackage);
-            const existingPackage = byIdentity.get(conflictIdentity);
-            if (!existingPackage) {
-                byIdentity.set(conflictIdentity, currentPackage);
-                continue;
-            }
-            if (createPackageIdentity(existingPackage) !== createPackageIdentity(currentPackage)) {
-                throw new SpawnfileError("validation_error", `Container target ${target.id} declares conflicting package definitions for ${createPackageLabel(currentPackage)}`);
-            }
-        }
-    }
-    return [...byIdentity.values()].sort((left, right) => createPackageIdentity(left).localeCompare(createPackageIdentity(right)));
-};
-const replaceContainerPathTemplate = (template, instanceRoot, configFileName) => template
-    .replaceAll(INSTANCE_ROOT_PLACEHOLDER, instanceRoot)
-    .replaceAll(CONFIG_FILE_PLACEHOLDER, configFileName);
-const resolveInstancePaths = (runtimeName, targetId, meta) => {
-    const instanceRoot = `/var/lib/spawnfile/instances/${runtimeName}/${targetId}`;
-    return {
-        configPath: replaceContainerPathTemplate(meta.instancePaths.configPathTemplate, instanceRoot, meta.configFileName),
-        homePath: meta.instancePaths.homePathTemplate
-            ? replaceContainerPathTemplate(meta.instancePaths.homePathTemplate, instanceRoot, meta.configFileName)
-            : undefined,
-        instanceRoot,
-        workspacePath: replaceContainerPathTemplate(meta.instancePaths.workspacePathTemplate, instanceRoot, meta.configFileName)
-    };
-};
-export const createEnvVariableMap = (compiledNodes, runtimePlans) => {
+import { assertTargetHasConfig, createDefaultTargets, resolveInstancePaths, resolveTargetConfigEnvBindings, resolveTargetEnvFiles, resolveTargetExposure, resolveTargetModelAuthMethods, resolveTargetModelSecrets, resolveTargetPackages } from "./containerTargetPlanResolution.js";
+import { listExecutionModelSecretNames } from "./modelEnv.js";
+import { createPersistentVolumeName } from "./moltnetArtifactPaths.js";
+import { createExclusiveReattachVolumeName } from "../shared/index.js";
+import { findWorldBindingForNode } from "./worldBindings.js";
+export const createEnvVariableMap = (compiledNodes, runtimePlans, moltnet) => {
     const variables = new Map();
     const register = (name, required, description, category, generated = false) => {
         const current = variables.get(name);
@@ -89,20 +33,20 @@ export const createEnvVariableMap = (compiledNodes, runtimePlans) => {
     };
     for (const node of compiledNodes) {
         if (node.value.kind === "agent") {
-            for (const secret of node.value.secrets) {
+            for (const secret of node.value.secrets)
                 registerSecret(secret);
-            }
-            for (const secretName of listExecutionModelSecretNames(node.value.execution)) {
-                register(secretName, true, `Model provider auth for ${secretName}`, "model");
+            if (node.runtimeName !== "daimon") {
+                for (const secretName of listExecutionModelSecretNames(node.value.execution)) {
+                    register(secretName, true, `Model provider auth for ${secretName}`, "model");
+                }
             }
             for (const secretName of listAgentSurfaceSecretNames(node.value.surfaces)) {
                 register(secretName, true, "Bot token for declared agent surfaces", "surface");
             }
             continue;
         }
-        for (const secret of node.value.shared.secrets) {
+        for (const secret of node.value.shared.secrets)
             registerSecret(secret);
-        }
     }
     for (const runtimePlan of runtimePlans) {
         for (const variable of runtimePlan.meta.env ?? []) {
@@ -112,66 +56,36 @@ export const createEnvVariableMap = (compiledNodes, runtimePlans) => {
             register(binding.envName, true, `Injected into ${runtimePlan.runtimeName} runtime config`, "runtime", binding.generated ?? false);
         }
     }
-    return variables;
-};
-const resolveTargetModelSecrets = (target, inputs) => {
-    const sourceIds = new Set(target.sourceIds ?? []);
-    if (sourceIds.size === 0) {
-        return [];
-    }
-    const secretNames = new Set();
-    for (const input of inputs) {
-        if (!sourceIds.has(input.id) || input.value.kind !== "agent") {
-            continue;
-        }
-        for (const secretName of listExecutionModelSecretNames(input.value.execution)) {
-            secretNames.add(secretName);
-        }
-    }
-    return [...secretNames].sort();
-};
-const resolveTargetModelAuthMethods = (target, inputs) => {
-    const sourceIds = new Set(target.sourceIds ?? []);
-    if (sourceIds.size === 0) {
-        return {};
-    }
-    const methods = new Map();
-    for (const input of inputs) {
-        if (!sourceIds.has(input.id) || input.value.kind !== "agent") {
-            continue;
-        }
-        for (const [provider, method] of Object.entries(resolveExecutionModelAuthMethods(input.value.execution))) {
-            const existingMethod = methods.get(provider);
-            if (existingMethod && existingMethod !== method) {
-                throw new SpawnfileError("validation_error", `Container target ${target.id} declares conflicting auth methods for provider ${provider}`);
-            }
-            methods.set(provider, method);
+    for (const serverPlan of moltnet?.serverPlans ?? []) {
+        for (const patch of serverPlan.secretPatches) {
+            register(patch.envName, true, `Managed Moltnet secret for ${serverPlan.networkId}`, "surface");
         }
     }
-    return Object.fromEntries([...methods.entries()].sort(([left], [right]) => left.localeCompare(right)));
-};
-const resolveTargetExposure = (target, inputs) => {
-    const sourceIds = new Set(target.sourceIds ?? []);
-    if (sourceIds.size === 0) {
-        return false;
-    }
-    return inputs.some((input) => sourceIds.has(input.id) && input.value.kind === "agent" && input.value.expose === true);
+    return variables;
 };
-export const createRuntimeTargetPlans = async (plan, compiledNodes) => {
+export const createRuntimeTargetPlans = async (plan, compiledNodes, worldBindings, deploymentLineage = "compile") => {
     const runtimeNames = Object.keys(plan.runtimes).sort();
+    const runId = resolveNoopolisRunId(process.env);
     const runtimePlans = [];
     for (const runtimeName of runtimeNames) {
         const adapter = getRuntimeAdapter(runtimeName);
         const recipe = await createRuntimeInstallRecipe(runtimeName);
         const targetInputs = compiledNodes
-            .filter((node) => node.runtimeName === runtimeName && node.emittedFiles.length > 0)
-            .map((node) => ({
-            emittedFiles: node.emittedFiles,
-            id: node.id ?? `${node.kind}:${node.slug}`,
-            kind: node.kind,
-            slug: node.slug,
-            value: node.value
-        }));
+            .filter((node) => node.runtimeName === runtimeName && (node.emittedFiles.length > 0 || runtimeName === "daimon"))
+            .map((node) => {
+            const id = node.id ?? `${node.kind}:${node.slug}`;
+            const worldBinding = node.kind === "agent"
+                ? findWorldBindingForNode(worldBindings, id)
+                : undefined;
+            return {
+                emittedFiles: node.emittedFiles,
+                id,
+                kind: node.kind,
+                slug: node.slug,
+                value: node.value,
+                ...(worldBinding ? { worldBinding } : {})
+            };
+        });
         const targets = (await adapter.createContainerTargets?.(targetInputs)) ??
             createDefaultTargets(targetInputs);
         targets.forEach((target, index) => {
@@ -180,23 +94,39 @@ export const createRuntimeTargetPlans = async (plan, compiledNodes) => {
             const portStride = adapter.container.portStride ?? 1;
             runtimePlans.push({
                 configEnvBindings: resolveTargetConfigEnvBindings(adapter.container, target) ?? [],
+                ...(target.engineByNodeId ? { engineByNodeId: target.engineByNodeId } : {}),
+                ...(target.grokModelByNodeId ? { grokModelByNodeId: target.grokModelByNodeId } : {}),
                 envFiles: resolveTargetEnvFiles(instancePaths.configPath, target),
                 packages: resolveTargetPackages(target, targetInputs),
                 id: target.id,
                 instancePaths,
                 meta: adapter.container,
-                modelAuthMethods: resolveTargetModelAuthMethods(target, targetInputs),
-                modelSecretsRequired: resolveTargetModelSecrets(target, targetInputs),
+                modelAuthMethods: runtimeName === "daimon" ? {} : resolveTargetModelAuthMethods(target, targetInputs),
+                modelSecretsRequired: runtimeName === "daimon" ? [] : resolveTargetModelSecrets(target, targetInputs),
+                ...(target.opaqueMountTargets ? { opaqueMountTargets: [...target.opaqueMountTargets].sort() } : {}),
+                ...(target.persistentMounts ? { persistentMounts: target.persistentMounts.map((mount) => ({
+                        id: mount.id,
+                        ...(mount.lifecycle ? { lifecycle: mount.lifecycle } : {}),
+                        mount_path: mount.mountPath.replaceAll("<instance-root>", instancePaths.instanceRoot),
+                        reason: mount.reason,
+                        volume_name: mount.lifecycle === "exclusive-reattach"
+                            ? createExclusiveReattachVolumeName(`${plan.root}\0${deploymentLineage}`, mount.id)
+                            : createPersistentVolumeName(plan.root, mount.id, runId)
+                    })).sort((left, right) => left.id.localeCompare(right.id)) } : {}),
                 port: adapter.container.port ? adapter.container.port + (index * portStride) : undefined,
                 publishedPort: resolveTargetExposure(target, targetInputs) && adapter.container.port
                     ? adapter.container.port + (index * portStride)
                     : undefined,
-                resources: resolveTargetResources(target, targetInputs, instancePaths, adapter.container),
+                recipeEnv: recipe.env,
+                resources: resolveTargetResources(target, targetInputs, instancePaths, adapter.container, plan.root, deploymentLineage),
                 runtimeName,
                 runtimeRoot: recipe.runtimeRoot,
                 sourceIds: [...(target.sourceIds ?? [])].sort(),
                 targetConfigEnvBindings: target.configEnvBindings,
-                targetFiles: target.files
+                targetFiles: target.files,
+                ...(target.worldTokenEnvNames
+                    ? { worldTokenEnvNames: target.worldTokenEnvNames }
+                    : {})
             });
         });
     }

package/dist/compiler/containerArtifactsRender.d.ts

@@ -1,14 +1,17 @@
-import type { EmittedFile } from "../runtime/index.js";
+import type { EmittedFile, RuntimeContainerPackageOverrides } from "../runtime/index.js";
 import type { ContainerEnvVariable, RuntimeTargetPlan } from "./containerArtifactsTypes.js";
 import type { EntrypointOptions } from "./containerEntrypointRender.js";
 export { renderEntrypoint } from "./containerEntrypointRender.js";
 export type { EntrypointOptions } from "./containerEntrypointRender.js";
+import type { BackedMountRequirement } from "./containerBackedMountRender.js";
 export declare const renderEnvExample: (variables: ContainerEnvVariable[]) => string;
 export interface DockerfileDistributionOptions {
     labels: Record<string, string>;
     reportOutputFile: string;
+    worldBindingsOutputFile?: string;
 }
 export declare const renderDockerfile: (runtimePlans: RuntimeTargetPlan[], options?: EntrypointOptions & {
     distribution?: DockerfileDistributionOptions;
+    runtimePackageOverrides?: RuntimeContainerPackageOverrides;
 }) => Promise<string>;
-export declare const createRootfsFiles: (runtimePlans: RuntimeTargetPlan[]) => EmittedFile[];
+export declare const createRootfsFiles: (runtimePlans: RuntimeTargetPlan[], persistentMountPaths?: string[], moltnet?: EntrypointOptions["moltnet"], persistentMounts?: readonly BackedMountRequirement[]) => EmittedFile[];

package/dist/compiler/containerArtifactsRender.js

@@ -1,34 +1,22 @@
 import path from "node:path";
-import { DISTRIBUTION_REPORT_IMAGE_PATH } from "../distribution/index.js";
+import { DISTRIBUTION_REPORT_IMAGE_PATH, WORLD_BINDINGS_IMAGE_PATH } from "../distribution/index.js";
 import { createRuntimeInstallRecipe } from "../runtime/index.js";
 import { SpawnfileError } from "../shared/index.js";
 export { renderEntrypoint } from "./containerEntrypointRender.js";
+import { DAIMON_RUNTIME_UID, DAIMON_UID_ENTRYPOINT_PATH, renderDaimonUidEntrypoint } from "./containerDaimonUidEntrypointRender.js";
+import { createStateOwnershipCommand } from "./containerStateOwnershipRender.js";
+import { RUNTIME_LINK_MATERIALIZER_PATH, renderRuntimeLinkMaterializer } from "./containerRuntimeLinkMaterializer.js";
 import { MOLTNET_BIN_DIRECTORY, MOLTNET_BINARY_NAMES } from "./moltnetBinaries.js";
 import { collectPackagesByManager, createAptPackageInstallItem, createNpmPackageInstallCommand, createNpmPackageInstallItem, createPackageInstallCommand, createPipxPackageInstallCommand, createPipxPackageInstallItem, getNpmInstallItemName } from "./containerPackageRender.js";
 const CONTAINER_ROOTFS_ROOT = "container/rootfs";
 const GATEWAY_PORT_PLACEHOLDER = "<gateway-port>";
-const MOLTNET_INSTALL_SCRIPT_URL = "https://moltnet.dev/install.sh";
-const MOLTNET_RELEASE_METADATA_URL = "https://api.github.com/repos/noopolis/moltnet/releases/latest";
 const WORKSPACE_PLACEHOLDER = "<workspace-path>";
 const RUNTIME_ROOT_PLACEHOLDER = "<runtime-root>";
+const PREBUILT_FINAL_SYSTEM_DEPS_BY_RUNTIME = {
+    daimon: new Set(["bubblewrap", "dbus-daemon", "gnome-keyring", "util-linux"])
+};
 const shellQuote = (value) => `'${value.replace(/'/g, `'\"'\"'`)}'`;
 const extractNodeMajorVersion = (image) => Number(image.match(/^node:(\d+)/)?.[1] ?? "0");
-const createStateOwnershipCommand = (persistentMountPaths = []) => {
-    const mountPaths = [...new Set(persistentMountPaths)].sort();
-    const mkdirPaths = [...new Set(["/var/lib/spawnfile", ...mountPaths])].sort();
-    const markerCommands = mountPaths.map((mountPath) => `touch ${shellQuote(path.posix.join(mountPath, ".spawnfile-volume-init"))}`);
-    const chownPaths = [
-        ...new Set([
-            "/var/lib/spawnfile",
-            ...mountPaths.filter((mountPath) => !mountPath.startsWith("/var/lib/spawnfile/"))
-        ])
-    ].sort();
-    return [
-        `mkdir -p ${mkdirPaths.map(shellQuote).join(" ")}`,
-        ...markerCommands,
-        `chown -R spawnfile:spawnfile ${chownPaths.map(shellQuote).join(" ")}`
-    ].join(" && ");
-};
 const selectBaseImage = (runtimePlans, runtimeRecipes) => {
     const recipeBaseImages = [
         ...new Set(runtimeRecipes.flatMap((recipe) => recipe.baseImage ? [recipe.baseImage] : []))
@@ -72,19 +60,27 @@ export const renderEnvExample = (variables) => {
     return `${lines.join("\n").trimEnd()}\n`;
 };
 export const renderDockerfile = async (runtimePlans, options = {}) => {
+    if (options.hasMoltnet && !options.hasStagedMoltnetBinaries) {
+        throw new SpawnfileError("compile_error", "Moltnet must be supplied as a pinned, digest-verified, pi-bridge-stamped release; unpinned latest installation is disabled");
+    }
     const runtimeNames = [...new Set(runtimePlans.map((plan) => plan.runtimeName))];
-    const runtimeRecipes = await Promise.all(runtimeNames.map((runtimeName) => createRuntimeInstallRecipe(runtimeName)));
+    const hasDaimon = runtimeNames.includes("daimon");
+    const runtimeRecipes = await Promise.all(runtimeNames.map((runtimeName) => createRuntimeInstallRecipe(runtimeName, { packageOverrides: options.runtimePackageOverrides })));
     const recipeByRuntimeName = new Map(runtimeRecipes.map((recipe) => [recipe.runtimeName, recipe]));
     const baseImage = selectBaseImage(runtimePlans, runtimeRecipes);
-    const needsJsonEnvWriter = runtimePlans.some((plan) => (plan.configEnvBindings?.length ?? 0) > 0);
+    const needsJsonEnvWriter = runtimePlans.some((plan) => (plan.configEnvBindings?.length ?? 0) > 0) || (options.moltnet?.nodePlans.length ?? 0) > 0
+        || (options.moltnet?.serverPlans ?? []).some((plan) => plan.mode === "managed"
+            && plan.configPath !== null
+            && plan.secretPatches.length > 0);
     const needsGit = runtimePlans.some((plan) => (plan.resources ?? []).some((resource) => resource.kind === "git"));
+    const needsBundle = runtimePlans.some((plan) => (plan.resources ?? []).some((resource) => resource.kind === "bundle"));
     const systemDeps = [
         ...new Set([
-            ...runtimePlans.flatMap((plan) => recipeByRuntimeName.get(plan.runtimeName)?.baseImage ? [] : plan.meta.systemDeps),
+            ...runtimePlans.flatMap((plan) => recipeByRuntimeName.get(plan.runtimeName)?.baseImage
+                ? plan.meta.systemDeps.filter((dependency) => PREBUILT_FINAL_SYSTEM_DEPS_BY_RUNTIME[plan.runtimeName]?.has(dependency))
+                : plan.meta.systemDeps),
             ...(needsGit ? ["git"] : []),
-            ...(options.hasMoltnet && !options.hasStagedMoltnetBinaries
-                ? ["ca-certificates", "curl", "tar"]
-                : []),
+            ...(needsBundle ? ["tar"] : []),
             ...(needsJsonEnvWriter ? ["python3"] : [])
         ])
     ].sort();
@@ -123,9 +119,8 @@ export const renderDockerfile = async (runtimePlans, options = {}) => {
     if (options.hasMoltnet && options.hasStagedMoltnetBinaries) {
         lines.push(`COPY ${MOLTNET_BIN_DIRECTORY}/ /usr/local/bin/`, `RUN chmod +x ${MOLTNET_BINARY_NAMES.map((binaryName) => `/usr/local/bin/${binaryName}`).join(" ")}`, "");
     }
-    else if (options.hasMoltnet) {
-        lines.push(`ADD ${MOLTNET_RELEASE_METADATA_URL} /tmp/spawnfile-moltnet-release.json`, `RUN MOLTNET_RELEASE="$${"("}sed -n 's/.*\\"tag_name\\": *\\"\\([^\\"]*\\)\\".*/\\1/p' /tmp/spawnfile-moltnet-release.json | head -n 1${")"}" && echo "Installing Moltnet $${"{MOLTNET_RELEASE:-latest}"}" && MOLTNET_INSTALL_DIR=/usr/local/bin sh -c ${shellQuote(`curl -fsSL ${MOLTNET_INSTALL_SCRIPT_URL} | sh`)}`, "");
-    }
+    if (options.hasWorkspaceBundles)
+        lines.push("COPY container/workspace-bundles/ /opt/spawnfile/workspace-bundles/", "");
     for (const recipe of runtimeRecipes) {
         for (const copyCommand of recipe.copyCommands) {
             lines.push(copyCommand);
@@ -135,8 +130,19 @@ export const renderDockerfile = async (runtimePlans, options = {}) => {
         }
         lines.push("");
     }
-    lines.push('RUN if ! id -u spawnfile >/dev/null 2>&1; then useradd --create-home --home-dir /home/spawnfile --shell /bin/bash spawnfile; fi', "");
-    lines.push("COPY container/rootfs/ /", "COPY .env.example /opt/spawnfile/.env.example", 'COPY entrypoint.sh /opt/spawnfile/entrypoint.sh', "RUN chmod +x /opt/spawnfile/entrypoint.sh");
+    lines.push(hasDaimon
+        ? `RUN if ! getent group spawnfile >/dev/null 2>&1; then groupadd --gid ${DAIMON_RUNTIME_UID} spawnfile; fi && if ! id -u spawnfile >/dev/null 2>&1; then useradd --uid ${DAIMON_RUNTIME_UID} --gid spawnfile --create-home --home-dir /home/spawnfile --shell /bin/bash spawnfile; fi`
+        : 'RUN if ! id -u spawnfile >/dev/null 2>&1; then useradd --create-home --home-dir /home/spawnfile --shell /bin/bash spawnfile; fi', "");
+    lines.push("COPY container/rootfs/ /", ...(hasDaimon
+        ? ["RUN chown root:root /var /var/lib /var/lib/spawnfile && chmod 755 /var /var/lib && chmod 711 /var/lib/spawnfile"]
+        : []), "COPY .env.example /opt/spawnfile/.env.example", 'COPY entrypoint.sh /opt/spawnfile/entrypoint.sh', `RUN chmod +x /opt/spawnfile/entrypoint.sh${hasDaimon ? ` ${DAIMON_UID_ENTRYPOINT_PATH}` : ""}${hasDaimon ? " && chmod 711 /opt /opt/spawnfile" : ""}`);
+    if (hasDaimon) {
+        for (const runtimeRoot of [...new Set(runtimePlans
+                .filter((plan) => plan.runtimeName === "daimon")
+                .map((plan) => plan.runtimeRoot))].sort()) {
+            lines.push(`RUN node ${shellQuote(RUNTIME_LINK_MATERIALIZER_PATH)} ${shellQuote(runtimeRoot)} && rm ${shellQuote(RUNTIME_LINK_MATERIALIZER_PATH)} && test -d ${shellQuote(runtimeRoot)} && test ! -L ${shellQuote(runtimeRoot)} && test -z "$(find -P ${shellQuote(runtimeRoot)} \\( -type l -o ! -user root -o ! -group root \\) -print -quit)" && chmod 711 /opt/spawnfile/runtime-installs ${shellQuote(runtimeRoot)} && find -P ${shellQuote(runtimeRoot)} -type d -exec chmod 711 {} + && find -P ${shellQuote(runtimeRoot)} -type f -perm /111 -exec chmod 555 {} + && find -P ${shellQuote(runtimeRoot)} -type f ! -perm /111 -exec chmod 444 {} + && chmod 555 ${shellQuote(path.posix.join(runtimeRoot, "daimon-start.sh"))}`);
+        }
+    }
     const postRootfsCommands = [
         ...new Set(runtimePlans.flatMap((plan) => plan.meta.postRootfsCommands ?? []))
     ];
@@ -144,52 +150,82 @@ export const renderDockerfile = async (runtimePlans, options = {}) => {
         lines.push(`RUN ${command}`);
     }
     if (options.distribution) {
-        lines.push("", `COPY ${options.distribution.reportOutputFile} ${DISTRIBUTION_REPORT_IMAGE_PATH}`, ...Object.entries(options.distribution.labels)
+        lines.push("", `COPY ${options.distribution.reportOutputFile} ${DISTRIBUTION_REPORT_IMAGE_PATH}`, ...(options.distribution.worldBindingsOutputFile
+            ? [
+                `COPY ${options.distribution.worldBindingsOutputFile} ${WORLD_BINDINGS_IMAGE_PATH}`,
+                `RUN chmod 600 ${WORLD_BINDINGS_IMAGE_PATH} && chown spawnfile:spawnfile ${WORLD_BINDINGS_IMAGE_PATH}`
+            ]
+            : []), ...Object.entries(options.distribution.labels)
             .sort(([left], [right]) => left.localeCompare(right))
             .map(([name, value]) => `LABEL ${name}=${shellQuote(value)}`));
     }
-    lines.push(`RUN ${createStateOwnershipCommand(options.persistentMountPaths)}`);
+    lines.push(`RUN ${createStateOwnershipCommand(runtimePlans, options.persistentMountPaths, options.moltnet)}`);
     if (exposedPorts.length > 0) {
         lines.push(`EXPOSE ${exposedPorts.join(" ")}`);
     }
-    lines.push("USER spawnfile");
-    lines.push('ENTRYPOINT ["/opt/spawnfile/entrypoint.sh"]');
+    if (hasDaimon) {
+        const daimonConfig = runtimePlans.find((plan) => plan.runtimeName === "daimon")?.instancePaths.configPath;
+        if (!daimonConfig)
+            throw new Error("Daimon container plan is missing its runtime config path");
+        const healthProgram = "const fs=require('node:fs');const c=JSON.parse(fs.readFileSync(process.argv[1],'utf8'));fetch(`http://127.0.0.1:${c.host.port}/healthz`).then(async r=>{if(!r.ok||JSON.stringify(await r.json())!==JSON.stringify({status:'ok'}))process.exit(1)}).catch(()=>process.exit(1))";
+        lines.push(`HEALTHCHECK --interval=5s --timeout=3s --start-period=10s --retries=12 CMD ["node","-e",${JSON.stringify(healthProgram)},${JSON.stringify(daimonConfig)}]`);
+    }
+    lines.push(hasDaimon ? "USER root" : "USER spawnfile");
+    lines.push(hasDaimon
+        ? `ENTRYPOINT ["${DAIMON_UID_ENTRYPOINT_PATH}"]`
+        : 'ENTRYPOINT ["/opt/spawnfile/entrypoint.sh"]');
     return `${lines.join("\n").trimEnd()}\n`;
 };
-export const createRootfsFiles = (runtimePlans) => runtimePlans.flatMap((plan) => plan.targetFiles.map((file) => {
-    if (file.path === plan.meta.configFileName) {
-        return {
-            content: file.content
-                .replaceAll(WORKSPACE_PLACEHOLDER, plan.instancePaths.workspacePath)
-                .replaceAll(RUNTIME_ROOT_PLACEHOLDER, plan.runtimeRoot)
-                .replaceAll(`"${GATEWAY_PORT_PLACEHOLDER}"`, plan.port ? String(plan.port) : "0")
-                .replaceAll(GATEWAY_PORT_PLACEHOLDER, plan.port ? String(plan.port) : ""),
-            path: `${CONTAINER_ROOTFS_ROOT}${plan.instancePaths.configPath}`
-        };
-    }
-    if (file.path.startsWith("runtime/")) {
-        const relativeRuntimePath = file.path.slice("runtime/".length);
-        return {
-            content: file.content,
-            path: `${CONTAINER_ROOTFS_ROOT}${path.posix.join(plan.runtimeRoot, relativeRuntimePath)}`
-        };
-    }
-    if (file.path.startsWith("workspace/")) {
-        const relativeWorkspacePath = file.path.slice("workspace/".length);
-        return {
-            content: file.content,
-            path: `${CONTAINER_ROOTFS_ROOT}${path.posix.join(plan.instancePaths.workspacePath, relativeWorkspacePath)}`
-        };
-    }
-    if (file.path.startsWith("home/")) {
-        if (!plan.instancePaths.homePath) {
-            throw new SpawnfileError("runtime_error", `Container target ${plan.id} for ${plan.runtimeName} emitted home-scoped files without a home path`);
+export const createRootfsFiles = (runtimePlans, persistentMountPaths = [], moltnet, persistentMounts = []) => {
+    const files = runtimePlans.flatMap((plan) => plan.targetFiles.map((file) => {
+        const renderedContent = file.content
+            .replaceAll("<config-path>", plan.instancePaths.configPath)
+            .replaceAll(WORKSPACE_PLACEHOLDER, plan.instancePaths.workspacePath)
+            .replaceAll("<instance-root>", plan.instancePaths.instanceRoot ?? "")
+            .replaceAll(RUNTIME_ROOT_PLACEHOLDER, plan.runtimeRoot)
+            .replaceAll(`"${GATEWAY_PORT_PLACEHOLDER}"`, plan.port ? String(plan.port) : "0")
+            .replaceAll(GATEWAY_PORT_PLACEHOLDER, plan.port ? String(plan.port) : "");
+        if (file.path === plan.meta.configFileName) {
+            return {
+                content: renderedContent,
+                path: `${CONTAINER_ROOTFS_ROOT}${plan.instancePaths.configPath}`
+            };
+        }
+        if (file.path.startsWith("runtime/")) {
+            const relativeRuntimePath = file.path.slice("runtime/".length);
+            return {
+                content: renderedContent,
+                path: `${CONTAINER_ROOTFS_ROOT}${path.posix.join(plan.runtimeRoot, relativeRuntimePath)}`
+            };
         }
-        const relativeHomePath = file.path.slice("home/".length);
-        return {
-            content: file.content,
-            path: `${CONTAINER_ROOTFS_ROOT}${path.posix.join(plan.instancePaths.homePath, relativeHomePath)}`
-        };
-    }
-    throw new SpawnfileError("runtime_error", `Container target ${plan.id} for ${plan.runtimeName} emitted unsupported path ${file.path}`);
-}));
+        if (file.path.startsWith("workspace/")) {
+            const relativeWorkspacePath = file.path.slice("workspace/".length);
+            return {
+                content: file.content,
+                path: `${CONTAINER_ROOTFS_ROOT}${path.posix.join(plan.instancePaths.workspacePath, relativeWorkspacePath)}`
+            };
+        }
+        if (file.path.startsWith("home/")) {
+            if (!plan.instancePaths.homePath) {
+                throw new SpawnfileError("runtime_error", `Container target ${plan.id} for ${plan.runtimeName} emitted home-scoped files without a home path`);
+            }
+            const relativeHomePath = file.path.slice("home/".length);
+            return {
+                content: file.content,
+                path: `${CONTAINER_ROOTFS_ROOT}${path.posix.join(plan.instancePaths.homePath, relativeHomePath)}`
+            };
+        }
+        throw new SpawnfileError("runtime_error", `Container target ${plan.id} for ${plan.runtimeName} emitted unsupported path ${file.path}`);
+    }));
+    return runtimePlans.some((plan) => plan.runtimeName === "daimon")
+        ? [{
+                content: renderRuntimeLinkMaterializer(),
+                mode: 0o600,
+                path: `${CONTAINER_ROOTFS_ROOT}${RUNTIME_LINK_MATERIALIZER_PATH}`
+            }, {
+                content: renderDaimonUidEntrypoint(runtimePlans, persistentMountPaths, moltnet, persistentMounts),
+                mode: 0o755,
+                path: `${CONTAINER_ROOTFS_ROOT}${DAIMON_UID_ENTRYPOINT_PATH}`
+            }, ...files]
+        : files;
+};

package/dist/compiler/containerArtifactsTypes.d.ts

@@ -1,5 +1,6 @@
 import type { DistributionReport } from "../distribution/index.js";
 import type { ContainerReport } from "../report/index.js";
+import type { ContainerPersistentMountReport } from "../report/index.js";
 import type { EmittedFile, RuntimeContainerConfigEnvBinding, RuntimeContainerMeta } from "../runtime/index.js";
 import type { ModelAuthMethod } from "../shared/index.js";
 import type { ResolvedAgentNode, ResolvedPackage, ResolvedTeamNode } from "./types.js";
@@ -14,6 +15,14 @@ export interface ContainerEnvVariable {
 }
 export interface RuntimeTargetPlan {
     configEnvBindings?: RuntimeContainerConfigEnvBinding[];
+    /** Passthrough of `ContainerTarget.engineByNodeId` (see `runtime/types.ts`), for
+     * `containerArtifacts.ts` to stamp onto `ContainerRuntimeInstanceReport.engine_by_node_id`. */
+    engineByNodeId?: Record<string, string>;
+    /** Passthrough of `ContainerTarget.grokModelByNodeId` for the Daimon broker worker render. */
+    grokModelByNodeId?: Record<string, {
+        model: string;
+        reasoningEffort: string;
+    }>;
     packages?: ResolvedPackage[];
     envFiles: Array<{
         envName: string;
@@ -29,14 +38,25 @@ export interface RuntimeTargetPlan {
     meta: RuntimeContainerMeta;
     modelAuthMethods: Record<string, ModelAuthMethod>;
     modelSecretsRequired: string[];
+    opaqueMountTargets?: string[];
+    persistentMounts?: ContainerPersistentMountReport[];
     port?: number;
     publishedPort?: number;
+    /**
+     * Per-run container environment carried by this target's
+     * RuntimeInstallRecipe (see src/runtime/container.ts). Sourced only from
+     * the host/compile process environment (e.g. NOOPOLIS_RUN_ID), never
+     * model output. Rendered into the container RUN-time env surface
+     * (entrypoint exec env), never baked into the Dockerfile build layer.
+     */
+    recipeEnv?: Record<string, string>;
     resources?: WorkspaceResourcePlan[];
     runtimeName: string;
     runtimeRoot: string;
     sourceIds?: string[];
     targetConfigEnvBindings?: RuntimeContainerConfigEnvBinding[];
     targetFiles: EmittedFile[];
+    worldTokenEnvNames?: string[];
 }
 export interface CompiledNodeArtifact {
     emittedFiles: EmittedFile[];

package/dist/compiler/containerBackedMountRender.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Fail-closed guard for durable container state.
+ *
+ * Every path in `container.persistent_mounts[]` is state the compiler expects
+ * a host-backed named volume to hold. `spawnfile run`/`spawnfile up` and
+ * `spawnfile deploy` mount them; a hand-rolled `docker run` of the same image
+ * does not, and nothing in the image declares `VOLUME`, so the container would
+ * silently write its whole durable record onto the container's own writable
+ * layer and lose it on `docker rm`. That is exactly how a newsroom's message
+ * history was destroyed by a routine recreate.
+ *
+ * These checks make that case loud instead of silent: the entrypoint refuses
+ * to start unless each durable path is a real mount point, naming the mount
+ * id, the path, and the volume name to attach. `SPAWNFILE_ALLOW_EPHEMERAL_STATE=1`
+ * is the deliberate opt-out for throwaway containers.
+ *
+ * Detection reads `/proc/self/mountinfo` and looks for an EXACT mount point,
+ * rather than comparing `stat -c %d` against the parent directory: two nested
+ * durable volumes live on the same host filesystem and therefore share a
+ * device number, which would make a device comparison report a genuinely
+ * backed inner mount as unbacked.
+ *
+ * The kernel octal-escapes four characters in the mountinfo mount-point field
+ * (`show_mountinfo` passes `" \t\n\\"` to `seq_path_root`), so a declared
+ * `mount: "/var/lib/my store"` appears there as `/var/lib/my\040store`. The
+ * comparison is therefore made against the compiler-escaped form — computed
+ * here, where it is exactly testable — while the operator-facing message keeps
+ * the real path. Escaping at compile time rather than decoding in shell keeps
+ * the check a deterministic string compare with no dependence on how a
+ * particular `printf %b` implementation treats `\nnn` vs `\0nnn`. For a path
+ * containing none of those four characters both forms are identical.
+ */
+export declare const EPHEMERAL_STATE_OPT_OUT_ENV = "SPAWNFILE_ALLOW_EPHEMERAL_STATE";
+export interface BackedMountRequirement {
+    id: string;
+    mount_path: string;
+    volume_name: string;
+}
+/** The mount-point field exactly as `/proc/self/mountinfo` renders this path. */
+export declare const escapeMountInfoPath: (value: string) => string;
+export declare const createBackedMountShellFunction: () => string[];
+/**
+ * One check per durable mount, deduplicated by path and ordered by path so the
+ * rendered entrypoint is a deterministic function of the compile plan.
+ */
+export declare const createBackedMountChecks: (mounts: readonly BackedMountRequirement[]) => string[];
+/**
+ * The full guard — function plus checks — or nothing at all when the compile
+ * declares no durable mounts.
+ */
+export declare const createBackedMountGuard: (mounts: readonly BackedMountRequirement[]) => string[];
+/**
+ * Compile-time operator surface: how many durable mounts this organization
+ * requires a launcher to attach.
+ */
+export declare const describeBackedMountRequirement: (mounts: readonly BackedMountRequirement[]) => string | null;