spawnfile 0.1.14 → 0.1.17

package/dist/compiler/compileProject.js

@@ -7,6 +7,7 @@ import { assertRuntimeCanCompile, createRuntimeLifecycleDiagnostics, getRuntimeA
 import { buildCompilePlan } from "./buildCompilePlan.js";
 import { createContainerArtifacts } from "./containerArtifacts.js";
 import { stageRuntimePackageOverrides } from "./containerPackageOverrides.js";
+import { stageWorkspaceBundles } from "./workspaceBundleArtifacts.js";
 import { augmentNodeReports } from "./compileProjectReports.js";
 import { enforcePolicy } from "./compileProjectPolicy.js";
 import { injectMoltnetWorkspaceFiles, injectTeamCompileSupportFiles, prepareTeamCompileSupport, writeEmittedFiles } from "./compileProjectSupport.js";
@@ -171,7 +172,7 @@ export const compileProject = async (inputPath, options = {}) => {
     for (const compiled of compiledNodes) {
         enforcePolicy(compiled.report, compiled.value.policyMode, compiled.value.policyOnDegrade);
     }
-    const moltnetArtifacts = await generateMoltnetArtifacts(plan);
+    const moltnetArtifacts = await generateMoltnetArtifacts(plan, options.deploymentLineage);
     const moltnetRelease = moltnetArtifacts
         ? await stageMoltnetBinaries(outputDirectory, {
             architecture: options.containerArchitecture
@@ -179,10 +180,13 @@ export const compileProject = async (inputPath, options = {}) => {
         : undefined;
     await injectMoltnetWorkspaceFiles(outputDirectory, compiledNodes, moltnetArtifacts);
     const resolvedRuntimePackageOverrides = await stageRuntimePackageOverrides(outputDirectory, options.runtimePackageOverrides);
+    const hasWorkspaceBundles = await stageWorkspaceBundles(outputDirectory, plan);
     const generatedAt = new Date().toISOString();
     const containerArtifacts = await createContainerArtifacts(plan, compiledNodes, {
+        deploymentLineage: options.deploymentLineage,
         generatedAt,
         hasStagedMoltnetBinaries: Boolean(moltnetRelease),
+        hasWorkspaceBundles,
         moltnet: moltnetArtifacts,
         moltnetRelease,
         runtimePackageOverrides: resolvedRuntimePackageOverrides,

package/dist/compiler/compileProjectSupport.js

@@ -100,6 +100,15 @@ export const injectMoltnetWorkspaceFiles = async (outputDirectory, compiledNodes
             upsertEmittedFile(compiled.emittedFiles, file);
         }
         await writeEmittedFiles(runtimeOutputDirectory, moltnetClientConfigFiles);
+        // Daimon agents talk Moltnet through the native moltnet_send/moltnet_read
+        // tools, and the moltnet CLI is not authenticated inside a Daimon
+        // workspace. Installing its skill there only teaches the agent a shell
+        // path that fails before it falls back to the tools it already has, so
+        // Daimon skips the skill install entirely; .moltnet/config.json above is
+        // still emitted since the native tools read it.
+        if (compiled.value.runtime.name === "daimon") {
+            continue;
+        }
         if (!moltnetCliCommand) {
             moltnetCliCommand = await resolveMoltnetCliCommand();
         }

package/dist/compiler/containerArtifacts.d.ts

@@ -1,4 +1,4 @@
-import type { RuntimeContainerPackageOverrides } from "../runtime/index.js";
+import { type RuntimeContainerPackageOverrides } from "../runtime/index.js";
 import type { MoltnetArtifacts } from "./moltnetArtifacts.js";
 import type { MoltnetReleaseIdentity } from "./moltnetBinaries.js";
 import type { CompiledNodeArtifact, GeneratedContainerArtifacts } from "./containerArtifactsTypes.js";
@@ -6,8 +6,10 @@ import type { CompilePlan } from "./types.js";
 import { type ResolvedWorldBindings } from "./worldBindings.js";
 export type { CompiledNodeArtifact, GeneratedContainerArtifacts } from "./containerArtifactsTypes.js";
 export interface ContainerArtifactOptions {
+    deploymentLineage?: string;
     generatedAt?: string;
     hasStagedMoltnetBinaries?: boolean;
+    hasWorkspaceBundles?: boolean;
     moltnet?: MoltnetArtifacts | null;
     moltnetRelease?: MoltnetReleaseIdentity;
     worldBindings?: ResolvedWorldBindings;

package/dist/compiler/containerArtifacts.js

@@ -1,5 +1,6 @@
 import { createHash } from "node:crypto";
 import { buildDistributionReport, createDistributionImageLabels, DISTRIBUTION_REPORT_OUTPUT_FILE, normalizeProjectLabelSlug, WORLD_BINDINGS_IMAGE_PATH } from "../distribution/index.js";
+import { DAIMON_LOCAL_RUNTIME_IDENTITY_ENV, loadLocalDaimonRuntimeIdentity } from "../runtime/index.js";
 import { SpawnfileError } from "../shared/index.js";
 import { createMoltnetSummary, createOrganizationSummary } from "./containerArtifactSummaries.js";
 import { createEnvVariableMap, createRuntimeTargetPlans } from "./containerArtifactsPlans.js";
@@ -7,9 +8,57 @@ import { createDockerIgnoreContent } from "./dockerBuildContext.js";
 import { createDaimonTelemetryArtifacts } from "./daimonTelemetryArtifacts.js";
 import { createRootfsFiles, renderDockerfile, renderEntrypoint, renderEnvExample } from "./containerArtifactsRender.js";
 import { createMemoryArtifactBundle } from "./memoryArtifacts.js";
+import { resolveWorkspaceResourceVolumes } from "./containerTargetResources.js";
+import { mergePersistentMounts } from "./containerPersistentMounts.js";
 import { SIMFILE_WORLD_BINDINGS_VERSION, WORLD_BINDINGS_OUTPUT_FILE } from "./worldBindings.js";
+/**
+ * Enforces the `specs/SURFACES.md` Moltnet/daimon promise: "A release without
+ * `daimon-bridge` is rejected; the public pi-only release cannot be relabeled
+ * as dual-capability."
+ *
+ * A daimon Moltnet attachment lowers a node runtime config of
+ * `kind: "daimon"` carrying `agent_id`, `token_env`, and `receipt_store_path`
+ * (`./moltnetRuntimeConfig.ts`). No published Moltnet release implements that
+ * kind -- `pkg/bridgeconfig` has no `RuntimeDaimon` through the latest tag, and
+ * `pkg/nodeconfig` decodes with `DisallowUnknownFields()`, so the node exits on
+ * `agent_id` at strict decode, before `Validate()` is even reached. The
+ * entrypoint launches `moltnet node <config> &` and then `wait -n`
+ * (`./containerEntrypointRender.ts`), so that exit tears the whole container
+ * down. Both a locally built Moltnet (`./localMoltnetAuthority.ts`) and, since
+ * the v0.1.18 pin, the published authority (`./moltnetReleaseAuthority.ts`) can
+ * advertise `daimon-bridge`; anything older, including every release through
+ * v0.1.17, advertises only `pi-bridge` and is still rejected here.
+ *
+ * This throws rather than warning, which is the opposite call from the other
+ * unlowerable-declaration diagnostics in this compiler. Those keep working
+ * projects compiling; here every affected project is already broken, and the
+ * failure it replaces is an opaque JSON decode error at container boot.
+ *
+ * `receiptStorePath` is set on a node plan if and only if the attached agent's
+ * runtime is daimon (`./moltnetArtifacts.ts`), so it is the exact daimon
+ * signal on an already-resolved plan.
+ */
+const assertMoltnetDaimonBridgeCapability = (moltnet, release) => {
+    const daimonNetworks = [...new Set((moltnet?.nodePlans ?? [])
+            .filter((nodePlan) => nodePlan.receiptStorePath !== undefined)
+            .map((nodePlan) => nodePlan.networkId))].sort();
+    if (daimonNetworks.length === 0)
+        return;
+    const capabilities = release?.capabilities ?? [];
+    if (capabilities.includes("daimon-bridge"))
+        return;
+    throw new SpawnfileError("compile_error", `Moltnet release ${release?.version ?? "(unstaged)"} does not advertise the daimon-bridge capability, but `
+        + `${daimonNetworks.length} network attachment(s) lower a daimon runtime bridge (${daimonNetworks.join(", ")}). `
+        + "The published release implements pi-bridge only and rejects a daimon node config at strict JSON decode, so "
+        + "the container would exit at boot. Build Moltnet locally (scripts/build-local-moltnet.ts, then "
+        + "SPAWNFILE_LOCAL_MOLTNET_RELEASE_DIR with SPAWNFILE_ALLOW_LOCAL_E2E=1) to stage a daimon-bridge release, or "
+        + "remove the Moltnet attachment from the daimon agent(s).");
+};
 export const createContainerArtifacts = async (plan, compiledNodes, options = {}) => {
-    const runtimePlans = await createRuntimeTargetPlans(plan, compiledNodes, options.worldBindings);
+    assertMoltnetDaimonBridgeCapability(options.moltnet, options.moltnetRelease);
+    const localDaimonIdentityPath = process.env[DAIMON_LOCAL_RUNTIME_IDENTITY_ENV]?.trim();
+    const localDaimonIdentity = localDaimonIdentityPath ? await loadLocalDaimonRuntimeIdentity(localDaimonIdentityPath) : undefined;
+    const runtimePlans = await createRuntimeTargetPlans(plan, compiledNodes, options.worldBindings, options.deploymentLineage);
     const daimonTelemetryArtifacts = createDaimonTelemetryArtifacts(plan, runtimePlans, compiledNodes);
     const envVariableMap = createEnvVariableMap(compiledNodes, runtimePlans, options.moltnet);
     const projectedWorldTokenEnvNames = [...new Set(runtimePlans.flatMap((runtimePlan) => runtimePlan.worldTokenEnvNames ?? []))].sort();
@@ -45,50 +94,23 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
         .filter((variable) => variable.required && variable.categories.includes("runtime"))
         .map((variable) => variable.name)
         .sort();
-    const memoryArtifacts = createMemoryArtifactBundle(plan);
-    const persistentMountsById = new Map();
-    for (const mount of memoryArtifacts.mounts) {
-        const existing = persistentMountsById.get(mount.id);
-        if (existing) {
-            if (existing.mount_path !== mount.mount_path || existing.volume_name !== mount.volume_name) {
-                throw new Error(`Container persistent mount ${mount.id} resolves to conflicting targets`);
-            }
-            continue;
-        }
-        persistentMountsById.set(mount.id, {
-            mount_path: mount.mount_path,
-            reason: mount.reason,
-            volume_name: mount.volume_name
-        });
-    }
-    const persistentMounts = [
+    const memoryArtifacts = createMemoryArtifactBundle(plan, options.deploymentLineage);
+    const { resources: resolvedWorkspaceResources, mounts: workspaceResourceMounts } = resolveWorkspaceResourceVolumes(runtimePlans);
+    const persistentMountCandidates = [
         ...memoryArtifacts.mounts,
+        ...workspaceResourceMounts,
         ...daimonTelemetryArtifacts.mounts,
+        ...runtimePlans.flatMap((runtimePlan) => runtimePlan.persistentMounts ?? []),
         ...((options.moltnet?.persistentMounts ?? []).map((mount) => ({
+            ...(mount.declaredVolumeName ? { declared_volume_name: mount.declaredVolumeName } : {}),
             id: mount.id,
+            ...(mount.lifecycle ? { lifecycle: mount.lifecycle } : {}),
             mount_path: mount.mountPath,
             reason: mount.reason,
             volume_name: mount.volumeName
         })))
-    ]
-        .sort((left, right) => left.id.localeCompare(right.id))
-        .filter((mount) => {
-        const existing = persistentMountsById.get(mount.id);
-        if (existing) {
-            if (existing.mount_path === mount.mount_path &&
-                existing.volume_name === mount.volume_name &&
-                existing.reason === mount.reason) {
-                return true;
-            }
-            throw new Error(`Container persistent mount ${mount.id} resolves to conflicting targets`);
-        }
-        persistentMountsById.set(mount.id, {
-            mount_path: mount.mount_path,
-            reason: mount.reason,
-            volume_name: mount.volume_name
-        });
-        return true;
-    });
+    ];
+    const persistentMounts = mergePersistentMounts(persistentMountCandidates);
     const runtimeInternalPorts = runtimePlans.flatMap((plan) => plan.port ? [plan.port] : []);
     const internalPorts = [...new Set([...runtimeInternalPorts, ...(options.moltnet?.ports ?? [])])].sort((left, right) => left - right);
     const runtimePublishedPorts = runtimePlans.flatMap((plan) => plan.publishedPort ? [plan.publishedPort] : []);
@@ -136,7 +158,14 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
                 link_path: resource.linkPath,
                 mode: resource.mode,
                 mount: resource.mount,
-                sharing: resource.sharing
+                mount_path: resource.linkPath,
+                replacement_sentinel: resource.replacementSentinel ? {
+                    path: resource.replacementSentinel,
+                    result: "verified_on_startup"
+                } : undefined,
+                resolved_identity: resource.resolvedIdentity,
+                sharing: resource.sharing,
+                volume_name: resource.volumeName ?? null
             }
         ]))).values()
     ].sort((left, right) => left.link_path.localeCompare(right.link_path) || left.id.localeCompare(right.id));
@@ -173,10 +202,19 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
         modelAuthMethods: mergedModelAuthMethods,
         moltnetNetworks,
         organization,
+        // The report deliberately omits the compiler-DERIVED volume name: it
+        // encodes the creator's plan root and deployment lineage and is private to
+        // that host. An author-DECLARED name is different — it is part of the
+        // declaration the image publishes, so a consumer must honour it verbatim
+        // or an operator who pre-created that volume silently gets an empty one.
         persistentMounts: persistentMounts.map((mount) => ({
+            ...(mount.declared_volume_name
+                ? { declared_volume_name: mount.declared_volume_name }
+                : {}),
             durability: "persistent",
             id: mount.id,
             kind: "volume",
+            ...(mount.lifecycle ? { lifecycle: mount.lifecycle } : {}),
             target: mount.mount_path
         })),
         portMappings,
@@ -194,7 +232,13 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
     });
     const distributionLabels = createDistributionImageLabels(projectSlug, distributionReport.compile_fingerprint);
     const files = [
-        ...createRootfsFiles(runtimePlans),
+        ...createRootfsFiles(runtimePlans, persistentMounts.map((mount) => mount.mount_path), options.moltnet
+            ? {
+                externalParticipantArtifacts: options.moltnet.externalParticipantArtifacts,
+                nodePlans: options.moltnet.nodePlans,
+                serverPlans: options.moltnet.serverPlans
+            }
+            : undefined, persistentMounts),
         ...(options.moltnet?.files ?? []),
         ...(options.worldBindings
             ? [{ content: options.worldBindings.canonicalBytes, mode: 0o600, path: WORLD_BINDINGS_OUTPUT_FILE }]
@@ -214,6 +258,7 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
                 },
                 hasMoltnet: Boolean(options.moltnet),
                 hasStagedMoltnetBinaries: options.hasStagedMoltnetBinaries,
+                hasWorkspaceBundles: options.hasWorkspaceBundles,
                 ...(options.moltnet
                     ? {
                         moltnet: {
@@ -236,7 +281,9 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
                         nodePlans: options.moltnet.nodePlans,
                         serverPlans: options.moltnet.serverPlans
                     }
-                    : undefined
+                    : undefined,
+                persistentMounts,
+                persistentMountPaths: persistentMounts.map((mount) => mount.mount_path)
             }),
             path: "entrypoint.sh"
         },
@@ -270,6 +317,11 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
             entrypoint: "entrypoint.sh",
             env_example: ".env.example",
             internal_ports: internalPorts,
+            ...(localDaimonIdentity ? { local_daimon_runtime: {
+                    capability_receipt_sha256: localDaimonIdentity.capabilityReceipt,
+                    image_reference: localDaimonIdentity.imageReference,
+                    registry_authority: localDaimonIdentity.registryAuthority
+                } } : {}),
             model_secrets_required: modelSecretsRequired,
             ...(moltnetSummary ? { moltnet: moltnetSummary } : {}),
             port_mappings: portMappings,

package/dist/compiler/containerArtifactsPlans.d.ts

@@ -3,4 +3,4 @@ import type { MoltnetArtifacts } from "./moltnetArtifacts.js";
 import type { CompilePlan } from "./types.js";
 import { type ResolvedWorldBindings } from "./worldBindings.js";
 export declare const createEnvVariableMap: (compiledNodes: CompiledNodeArtifact[], runtimePlans: RuntimeTargetPlan[], moltnet?: MoltnetArtifacts | null) => Map<string, ContainerEnvVariable>;
-export declare const createRuntimeTargetPlans: (plan: CompilePlan, compiledNodes: CompiledNodeArtifact[], worldBindings?: ResolvedWorldBindings) => Promise<RuntimeTargetPlan[]>;
+export declare const createRuntimeTargetPlans: (plan: CompilePlan, compiledNodes: CompiledNodeArtifact[], worldBindings?: ResolvedWorldBindings, deploymentLineage?: string) => Promise<RuntimeTargetPlan[]>;

package/dist/compiler/containerArtifactsPlans.js

@@ -1,8 +1,11 @@
 import { createRuntimeInstallRecipe, getRuntimeAdapter } from "../runtime/index.js";
+import { resolveNoopolisRunId } from "../runtime/index.js";
 import { listAgentSurfaceSecretNames } from "./agentSurfaces.js";
 import { resolveTargetResources } from "./containerTargetResources.js";
 import { assertTargetHasConfig, createDefaultTargets, resolveInstancePaths, resolveTargetConfigEnvBindings, resolveTargetEnvFiles, resolveTargetExposure, resolveTargetModelAuthMethods, resolveTargetModelSecrets, resolveTargetPackages } from "./containerTargetPlanResolution.js";
 import { listExecutionModelSecretNames } from "./modelEnv.js";
+import { createPersistentVolumeName } from "./moltnetArtifactPaths.js";
+import { createExclusiveReattachVolumeName } from "../shared/index.js";
 import { findWorldBindingForNode } from "./worldBindings.js";
 export const createEnvVariableMap = (compiledNodes, runtimePlans, moltnet) => {
     const variables = new Map();
@@ -32,8 +35,10 @@ export const createEnvVariableMap = (compiledNodes, runtimePlans, moltnet) => {
         if (node.value.kind === "agent") {
             for (const secret of node.value.secrets)
                 registerSecret(secret);
-            for (const secretName of listExecutionModelSecretNames(node.value.execution)) {
-                register(secretName, true, `Model provider auth for ${secretName}`, "model");
+            if (node.runtimeName !== "daimon") {
+                for (const secretName of listExecutionModelSecretNames(node.value.execution)) {
+                    register(secretName, true, `Model provider auth for ${secretName}`, "model");
+                }
             }
             for (const secretName of listAgentSurfaceSecretNames(node.value.surfaces)) {
                 register(secretName, true, "Bot token for declared agent surfaces", "surface");
@@ -58,14 +63,15 @@ export const createEnvVariableMap = (compiledNodes, runtimePlans, moltnet) => {
     }
     return variables;
 };
-export const createRuntimeTargetPlans = async (plan, compiledNodes, worldBindings) => {
+export const createRuntimeTargetPlans = async (plan, compiledNodes, worldBindings, deploymentLineage = "compile") => {
     const runtimeNames = Object.keys(plan.runtimes).sort();
+    const runId = resolveNoopolisRunId(process.env);
     const runtimePlans = [];
     for (const runtimeName of runtimeNames) {
         const adapter = getRuntimeAdapter(runtimeName);
         const recipe = await createRuntimeInstallRecipe(runtimeName);
         const targetInputs = compiledNodes
-            .filter((node) => node.runtimeName === runtimeName && node.emittedFiles.length > 0)
+            .filter((node) => node.runtimeName === runtimeName && (node.emittedFiles.length > 0 || runtimeName === "daimon"))
             .map((node) => {
             const id = node.id ?? `${node.kind}:${node.slug}`;
             const worldBinding = node.kind === "agent"
@@ -89,19 +95,30 @@ export const createRuntimeTargetPlans = async (plan, compiledNodes, worldBinding
             runtimePlans.push({
                 configEnvBindings: resolveTargetConfigEnvBindings(adapter.container, target) ?? [],
                 ...(target.engineByNodeId ? { engineByNodeId: target.engineByNodeId } : {}),
+                ...(target.grokModelByNodeId ? { grokModelByNodeId: target.grokModelByNodeId } : {}),
                 envFiles: resolveTargetEnvFiles(instancePaths.configPath, target),
                 packages: resolveTargetPackages(target, targetInputs),
                 id: target.id,
                 instancePaths,
                 meta: adapter.container,
-                modelAuthMethods: resolveTargetModelAuthMethods(target, targetInputs),
-                modelSecretsRequired: resolveTargetModelSecrets(target, targetInputs),
+                modelAuthMethods: runtimeName === "daimon" ? {} : resolveTargetModelAuthMethods(target, targetInputs),
+                modelSecretsRequired: runtimeName === "daimon" ? [] : resolveTargetModelSecrets(target, targetInputs),
+                ...(target.opaqueMountTargets ? { opaqueMountTargets: [...target.opaqueMountTargets].sort() } : {}),
+                ...(target.persistentMounts ? { persistentMounts: target.persistentMounts.map((mount) => ({
+                        id: mount.id,
+                        ...(mount.lifecycle ? { lifecycle: mount.lifecycle } : {}),
+                        mount_path: mount.mountPath.replaceAll("<instance-root>", instancePaths.instanceRoot),
+                        reason: mount.reason,
+                        volume_name: mount.lifecycle === "exclusive-reattach"
+                            ? createExclusiveReattachVolumeName(`${plan.root}\0${deploymentLineage}`, mount.id)
+                            : createPersistentVolumeName(plan.root, mount.id, runId)
+                    })).sort((left, right) => left.id.localeCompare(right.id)) } : {}),
                 port: adapter.container.port ? adapter.container.port + (index * portStride) : undefined,
                 publishedPort: resolveTargetExposure(target, targetInputs) && adapter.container.port
                     ? adapter.container.port + (index * portStride)
                     : undefined,
                 recipeEnv: recipe.env,
-                resources: resolveTargetResources(target, targetInputs, instancePaths, adapter.container),
+                resources: resolveTargetResources(target, targetInputs, instancePaths, adapter.container, plan.root, deploymentLineage),
                 runtimeName,
                 runtimeRoot: recipe.runtimeRoot,
                 sourceIds: [...(target.sourceIds ?? [])].sort(),

package/dist/compiler/containerArtifactsRender.d.ts

@@ -3,6 +3,7 @@ import type { ContainerEnvVariable, RuntimeTargetPlan } from "./containerArtifac
 import type { EntrypointOptions } from "./containerEntrypointRender.js";
 export { renderEntrypoint } from "./containerEntrypointRender.js";
 export type { EntrypointOptions } from "./containerEntrypointRender.js";
+import type { BackedMountRequirement } from "./containerBackedMountRender.js";
 export declare const renderEnvExample: (variables: ContainerEnvVariable[]) => string;
 export interface DockerfileDistributionOptions {
     labels: Record<string, string>;
@@ -13,4 +14,4 @@ export declare const renderDockerfile: (runtimePlans: RuntimeTargetPlan[], optio
     distribution?: DockerfileDistributionOptions;
     runtimePackageOverrides?: RuntimeContainerPackageOverrides;
 }) => Promise<string>;
-export declare const createRootfsFiles: (runtimePlans: RuntimeTargetPlan[]) => EmittedFile[];
+export declare const createRootfsFiles: (runtimePlans: RuntimeTargetPlan[], persistentMountPaths?: string[], moltnet?: EntrypointOptions["moltnet"], persistentMounts?: readonly BackedMountRequirement[]) => EmittedFile[];

package/dist/compiler/containerArtifactsRender.js

@@ -3,30 +3,20 @@ import { DISTRIBUTION_REPORT_IMAGE_PATH, WORLD_BINDINGS_IMAGE_PATH } from "../di
 import { createRuntimeInstallRecipe } from "../runtime/index.js";
 import { SpawnfileError } from "../shared/index.js";
 export { renderEntrypoint } from "./containerEntrypointRender.js";
+import { DAIMON_RUNTIME_UID, DAIMON_UID_ENTRYPOINT_PATH, renderDaimonUidEntrypoint } from "./containerDaimonUidEntrypointRender.js";
+import { createStateOwnershipCommand } from "./containerStateOwnershipRender.js";
+import { RUNTIME_LINK_MATERIALIZER_PATH, renderRuntimeLinkMaterializer } from "./containerRuntimeLinkMaterializer.js";
 import { MOLTNET_BIN_DIRECTORY, MOLTNET_BINARY_NAMES } from "./moltnetBinaries.js";
 import { collectPackagesByManager, createAptPackageInstallItem, createNpmPackageInstallCommand, createNpmPackageInstallItem, createPackageInstallCommand, createPipxPackageInstallCommand, createPipxPackageInstallItem, getNpmInstallItemName } from "./containerPackageRender.js";
 const CONTAINER_ROOTFS_ROOT = "container/rootfs";
 const GATEWAY_PORT_PLACEHOLDER = "<gateway-port>";
 const WORKSPACE_PLACEHOLDER = "<workspace-path>";
 const RUNTIME_ROOT_PLACEHOLDER = "<runtime-root>";
+const PREBUILT_FINAL_SYSTEM_DEPS_BY_RUNTIME = {
+    daimon: new Set(["bubblewrap", "dbus-daemon", "gnome-keyring", "util-linux"])
+};
 const shellQuote = (value) => `'${value.replace(/'/g, `'\"'\"'`)}'`;
 const extractNodeMajorVersion = (image) => Number(image.match(/^node:(\d+)/)?.[1] ?? "0");
-const createStateOwnershipCommand = (persistentMountPaths = []) => {
-    const mountPaths = [...new Set(persistentMountPaths)].sort();
-    const mkdirPaths = [...new Set(["/var/lib/spawnfile", ...mountPaths])].sort();
-    const markerCommands = mountPaths.map((mountPath) => `touch ${shellQuote(path.posix.join(mountPath, ".spawnfile-volume-init"))}`);
-    const chownPaths = [
-        ...new Set([
-            "/var/lib/spawnfile",
-            ...mountPaths.filter((mountPath) => !mountPath.startsWith("/var/lib/spawnfile/"))
-        ])
-    ].sort();
-    return [
-        `mkdir -p ${mkdirPaths.map(shellQuote).join(" ")}`,
-        ...markerCommands,
-        `chown -R spawnfile:spawnfile ${chownPaths.map(shellQuote).join(" ")}`
-    ].join(" && ");
-};
 const selectBaseImage = (runtimePlans, runtimeRecipes) => {
     const recipeBaseImages = [
         ...new Set(runtimeRecipes.flatMap((recipe) => recipe.baseImage ? [recipe.baseImage] : []))
@@ -74,6 +64,7 @@ export const renderDockerfile = async (runtimePlans, options = {}) => {
         throw new SpawnfileError("compile_error", "Moltnet must be supplied as a pinned, digest-verified, pi-bridge-stamped release; unpinned latest installation is disabled");
     }
     const runtimeNames = [...new Set(runtimePlans.map((plan) => plan.runtimeName))];
+    const hasDaimon = runtimeNames.includes("daimon");
     const runtimeRecipes = await Promise.all(runtimeNames.map((runtimeName) => createRuntimeInstallRecipe(runtimeName, { packageOverrides: options.runtimePackageOverrides })));
     const recipeByRuntimeName = new Map(runtimeRecipes.map((recipe) => [recipe.runtimeName, recipe]));
     const baseImage = selectBaseImage(runtimePlans, runtimeRecipes);
@@ -82,10 +73,14 @@ export const renderDockerfile = async (runtimePlans, options = {}) => {
             && plan.configPath !== null
             && plan.secretPatches.length > 0);
     const needsGit = runtimePlans.some((plan) => (plan.resources ?? []).some((resource) => resource.kind === "git"));
+    const needsBundle = runtimePlans.some((plan) => (plan.resources ?? []).some((resource) => resource.kind === "bundle"));
     const systemDeps = [
         ...new Set([
-            ...runtimePlans.flatMap((plan) => recipeByRuntimeName.get(plan.runtimeName)?.baseImage ? [] : plan.meta.systemDeps),
+            ...runtimePlans.flatMap((plan) => recipeByRuntimeName.get(plan.runtimeName)?.baseImage
+                ? plan.meta.systemDeps.filter((dependency) => PREBUILT_FINAL_SYSTEM_DEPS_BY_RUNTIME[plan.runtimeName]?.has(dependency))
+                : plan.meta.systemDeps),
             ...(needsGit ? ["git"] : []),
+            ...(needsBundle ? ["tar"] : []),
             ...(needsJsonEnvWriter ? ["python3"] : [])
         ])
     ].sort();
@@ -124,6 +119,8 @@ export const renderDockerfile = async (runtimePlans, options = {}) => {
     if (options.hasMoltnet && options.hasStagedMoltnetBinaries) {
         lines.push(`COPY ${MOLTNET_BIN_DIRECTORY}/ /usr/local/bin/`, `RUN chmod +x ${MOLTNET_BINARY_NAMES.map((binaryName) => `/usr/local/bin/${binaryName}`).join(" ")}`, "");
     }
+    if (options.hasWorkspaceBundles)
+        lines.push("COPY container/workspace-bundles/ /opt/spawnfile/workspace-bundles/", "");
     for (const recipe of runtimeRecipes) {
         for (const copyCommand of recipe.copyCommands) {
             lines.push(copyCommand);
@@ -133,8 +130,19 @@ export const renderDockerfile = async (runtimePlans, options = {}) => {
         }
         lines.push("");
     }
-    lines.push('RUN if ! id -u spawnfile >/dev/null 2>&1; then useradd --create-home --home-dir /home/spawnfile --shell /bin/bash spawnfile; fi', "");
-    lines.push("COPY container/rootfs/ /", "COPY .env.example /opt/spawnfile/.env.example", 'COPY entrypoint.sh /opt/spawnfile/entrypoint.sh', "RUN chmod +x /opt/spawnfile/entrypoint.sh");
+    lines.push(hasDaimon
+        ? `RUN if ! getent group spawnfile >/dev/null 2>&1; then groupadd --gid ${DAIMON_RUNTIME_UID} spawnfile; fi && if ! id -u spawnfile >/dev/null 2>&1; then useradd --uid ${DAIMON_RUNTIME_UID} --gid spawnfile --create-home --home-dir /home/spawnfile --shell /bin/bash spawnfile; fi`
+        : 'RUN if ! id -u spawnfile >/dev/null 2>&1; then useradd --create-home --home-dir /home/spawnfile --shell /bin/bash spawnfile; fi', "");
+    lines.push("COPY container/rootfs/ /", ...(hasDaimon
+        ? ["RUN chown root:root /var /var/lib /var/lib/spawnfile && chmod 755 /var /var/lib && chmod 711 /var/lib/spawnfile"]
+        : []), "COPY .env.example /opt/spawnfile/.env.example", 'COPY entrypoint.sh /opt/spawnfile/entrypoint.sh', `RUN chmod +x /opt/spawnfile/entrypoint.sh${hasDaimon ? ` ${DAIMON_UID_ENTRYPOINT_PATH}` : ""}${hasDaimon ? " && chmod 711 /opt /opt/spawnfile" : ""}`);
+    if (hasDaimon) {
+        for (const runtimeRoot of [...new Set(runtimePlans
+                .filter((plan) => plan.runtimeName === "daimon")
+                .map((plan) => plan.runtimeRoot))].sort()) {
+            lines.push(`RUN node ${shellQuote(RUNTIME_LINK_MATERIALIZER_PATH)} ${shellQuote(runtimeRoot)} && rm ${shellQuote(RUNTIME_LINK_MATERIALIZER_PATH)} && test -d ${shellQuote(runtimeRoot)} && test ! -L ${shellQuote(runtimeRoot)} && test -z "$(find -P ${shellQuote(runtimeRoot)} \\( -type l -o ! -user root -o ! -group root \\) -print -quit)" && chmod 711 /opt/spawnfile/runtime-installs ${shellQuote(runtimeRoot)} && find -P ${shellQuote(runtimeRoot)} -type d -exec chmod 711 {} + && find -P ${shellQuote(runtimeRoot)} -type f -perm /111 -exec chmod 555 {} + && find -P ${shellQuote(runtimeRoot)} -type f ! -perm /111 -exec chmod 444 {} + && chmod 555 ${shellQuote(path.posix.join(runtimeRoot, "daimon-start.sh"))}`);
+        }
+    }
     const postRootfsCommands = [
         ...new Set(runtimePlans.flatMap((plan) => plan.meta.postRootfsCommands ?? []))
     ];
@@ -151,48 +159,73 @@ export const renderDockerfile = async (runtimePlans, options = {}) => {
             .sort(([left], [right]) => left.localeCompare(right))
             .map(([name, value]) => `LABEL ${name}=${shellQuote(value)}`));
     }
-    lines.push(`RUN ${createStateOwnershipCommand(options.persistentMountPaths)}`);
+    lines.push(`RUN ${createStateOwnershipCommand(runtimePlans, options.persistentMountPaths, options.moltnet)}`);
     if (exposedPorts.length > 0) {
         lines.push(`EXPOSE ${exposedPorts.join(" ")}`);
     }
-    lines.push("USER spawnfile");
-    lines.push('ENTRYPOINT ["/opt/spawnfile/entrypoint.sh"]');
+    if (hasDaimon) {
+        const daimonConfig = runtimePlans.find((plan) => plan.runtimeName === "daimon")?.instancePaths.configPath;
+        if (!daimonConfig)
+            throw new Error("Daimon container plan is missing its runtime config path");
+        const healthProgram = "const fs=require('node:fs');const c=JSON.parse(fs.readFileSync(process.argv[1],'utf8'));fetch(`http://127.0.0.1:${c.host.port}/healthz`).then(async r=>{if(!r.ok||JSON.stringify(await r.json())!==JSON.stringify({status:'ok'}))process.exit(1)}).catch(()=>process.exit(1))";
+        lines.push(`HEALTHCHECK --interval=5s --timeout=3s --start-period=10s --retries=12 CMD ["node","-e",${JSON.stringify(healthProgram)},${JSON.stringify(daimonConfig)}]`);
+    }
+    lines.push(hasDaimon ? "USER root" : "USER spawnfile");
+    lines.push(hasDaimon
+        ? `ENTRYPOINT ["${DAIMON_UID_ENTRYPOINT_PATH}"]`
+        : 'ENTRYPOINT ["/opt/spawnfile/entrypoint.sh"]');
     return `${lines.join("\n").trimEnd()}\n`;
 };
-export const createRootfsFiles = (runtimePlans) => runtimePlans.flatMap((plan) => plan.targetFiles.map((file) => {
-    if (file.path === plan.meta.configFileName) {
-        return {
-            content: file.content
-                .replaceAll(WORKSPACE_PLACEHOLDER, plan.instancePaths.workspacePath)
-                .replaceAll(RUNTIME_ROOT_PLACEHOLDER, plan.runtimeRoot)
-                .replaceAll(`"${GATEWAY_PORT_PLACEHOLDER}"`, plan.port ? String(plan.port) : "0")
-                .replaceAll(GATEWAY_PORT_PLACEHOLDER, plan.port ? String(plan.port) : ""),
-            path: `${CONTAINER_ROOTFS_ROOT}${plan.instancePaths.configPath}`
-        };
-    }
-    if (file.path.startsWith("runtime/")) {
-        const relativeRuntimePath = file.path.slice("runtime/".length);
-        return {
-            content: file.content,
-            path: `${CONTAINER_ROOTFS_ROOT}${path.posix.join(plan.runtimeRoot, relativeRuntimePath)}`
-        };
-    }
-    if (file.path.startsWith("workspace/")) {
-        const relativeWorkspacePath = file.path.slice("workspace/".length);
-        return {
-            content: file.content,
-            path: `${CONTAINER_ROOTFS_ROOT}${path.posix.join(plan.instancePaths.workspacePath, relativeWorkspacePath)}`
-        };
-    }
-    if (file.path.startsWith("home/")) {
-        if (!plan.instancePaths.homePath) {
-            throw new SpawnfileError("runtime_error", `Container target ${plan.id} for ${plan.runtimeName} emitted home-scoped files without a home path`);
+export const createRootfsFiles = (runtimePlans, persistentMountPaths = [], moltnet, persistentMounts = []) => {
+    const files = runtimePlans.flatMap((plan) => plan.targetFiles.map((file) => {
+        const renderedContent = file.content
+            .replaceAll("<config-path>", plan.instancePaths.configPath)
+            .replaceAll(WORKSPACE_PLACEHOLDER, plan.instancePaths.workspacePath)
+            .replaceAll("<instance-root>", plan.instancePaths.instanceRoot ?? "")
+            .replaceAll(RUNTIME_ROOT_PLACEHOLDER, plan.runtimeRoot)
+            .replaceAll(`"${GATEWAY_PORT_PLACEHOLDER}"`, plan.port ? String(plan.port) : "0")
+            .replaceAll(GATEWAY_PORT_PLACEHOLDER, plan.port ? String(plan.port) : "");
+        if (file.path === plan.meta.configFileName) {
+            return {
+                content: renderedContent,
+                path: `${CONTAINER_ROOTFS_ROOT}${plan.instancePaths.configPath}`
+            };
+        }
+        if (file.path.startsWith("runtime/")) {
+            const relativeRuntimePath = file.path.slice("runtime/".length);
+            return {
+                content: renderedContent,
+                path: `${CONTAINER_ROOTFS_ROOT}${path.posix.join(plan.runtimeRoot, relativeRuntimePath)}`
+            };
+        }
+        if (file.path.startsWith("workspace/")) {
+            const relativeWorkspacePath = file.path.slice("workspace/".length);
+            return {
+                content: file.content,
+                path: `${CONTAINER_ROOTFS_ROOT}${path.posix.join(plan.instancePaths.workspacePath, relativeWorkspacePath)}`
+            };
         }
-        const relativeHomePath = file.path.slice("home/".length);
-        return {
-            content: file.content,
-            path: `${CONTAINER_ROOTFS_ROOT}${path.posix.join(plan.instancePaths.homePath, relativeHomePath)}`
-        };
-    }
-    throw new SpawnfileError("runtime_error", `Container target ${plan.id} for ${plan.runtimeName} emitted unsupported path ${file.path}`);
-}));
+        if (file.path.startsWith("home/")) {
+            if (!plan.instancePaths.homePath) {
+                throw new SpawnfileError("runtime_error", `Container target ${plan.id} for ${plan.runtimeName} emitted home-scoped files without a home path`);
+            }
+            const relativeHomePath = file.path.slice("home/".length);
+            return {
+                content: file.content,
+                path: `${CONTAINER_ROOTFS_ROOT}${path.posix.join(plan.instancePaths.homePath, relativeHomePath)}`
+            };
+        }
+        throw new SpawnfileError("runtime_error", `Container target ${plan.id} for ${plan.runtimeName} emitted unsupported path ${file.path}`);
+    }));
+    return runtimePlans.some((plan) => plan.runtimeName === "daimon")
+        ? [{
+                content: renderRuntimeLinkMaterializer(),
+                mode: 0o600,
+                path: `${CONTAINER_ROOTFS_ROOT}${RUNTIME_LINK_MATERIALIZER_PATH}`
+            }, {
+                content: renderDaimonUidEntrypoint(runtimePlans, persistentMountPaths, moltnet, persistentMounts),
+                mode: 0o755,
+                path: `${CONTAINER_ROOTFS_ROOT}${DAIMON_UID_ENTRYPOINT_PATH}`
+            }, ...files]
+        : files;
+};

package/dist/compiler/containerArtifactsTypes.d.ts

@@ -1,5 +1,6 @@
 import type { DistributionReport } from "../distribution/index.js";
 import type { ContainerReport } from "../report/index.js";
+import type { ContainerPersistentMountReport } from "../report/index.js";
 import type { EmittedFile, RuntimeContainerConfigEnvBinding, RuntimeContainerMeta } from "../runtime/index.js";
 import type { ModelAuthMethod } from "../shared/index.js";
 import type { ResolvedAgentNode, ResolvedPackage, ResolvedTeamNode } from "./types.js";
@@ -17,6 +18,11 @@ export interface RuntimeTargetPlan {
     /** Passthrough of `ContainerTarget.engineByNodeId` (see `runtime/types.ts`), for
      * `containerArtifacts.ts` to stamp onto `ContainerRuntimeInstanceReport.engine_by_node_id`. */
     engineByNodeId?: Record<string, string>;
+    /** Passthrough of `ContainerTarget.grokModelByNodeId` for the Daimon broker worker render. */
+    grokModelByNodeId?: Record<string, {
+        model: string;
+        reasoningEffort: string;
+    }>;
     packages?: ResolvedPackage[];
     envFiles: Array<{
         envName: string;
@@ -32,6 +38,8 @@ export interface RuntimeTargetPlan {
     meta: RuntimeContainerMeta;
     modelAuthMethods: Record<string, ModelAuthMethod>;
     modelSecretsRequired: string[];
+    opaqueMountTargets?: string[];
+    persistentMounts?: ContainerPersistentMountReport[];
     port?: number;
     publishedPort?: number;
     /**