spawnfile 0.1.14 → 0.1.18

package/dist/compiler/containerDaimonOwnershipGuardRender.js

@@ -0,0 +1,204 @@
+import path from "node:path";
+import { VOLUME_BOOTSTRAP_MARKER, VOLUME_BOOTSTRAP_MARKER_CONTENT } from "./containerVolumeBootstrap.js";
+const SPAWNFILE_PRIVATE_STATE_ROOT = "/var/lib/spawnfile";
+export const renderDaimonOwnershipProgram = (opaqueTargets, opaqueDescendantRoots, immutableRuntimeRoots, volumeIdentityFiles, privateDirectories, privateFiles, privateModeDirectories, creatablePrivateDirectories, 
+/**
+ * A brokered Grok worker's sandbox cannot be applied when `/var` is traverse-only.
+ * Grok 1.0.34 builds every profile inside bubblewrap and then verifies it from the
+ * worker uid; with `/var` at 0711 that verification fails and the worker refuses to
+ * start ("could not apply the 'daimon-strict' sandbox profile"), which is every turn
+ * of every Grok agent. Bisected on the production host: with `/var` at 0755 the
+ * sandbox applies and the turn runs, at 0711 it never does, and the deeper ancestors
+ * (`/var/lib`, the worker root) make no difference either way — so only this one
+ * level is widened, only for an organization that actually runs a Grok worker, and
+ * only to the mode the proven-working training container has always had. Codex- and
+ * AGY-only organizations keep the traverse-only `/var` unchanged.
+ */
+grokWorkersPresent = false) => [
+    "const fs = require('node:fs');",
+    "const constants = fs.constants;",
+    "const uid = Number(process.argv[2]);",
+    "const roots = process.argv.slice(3);",
+    "const fail = (message) => { process.stderr.write(`Daimon ownership guard: ${message}\\n`); process.exit(1); };",
+    `const opaquePaths = new Set(${JSON.stringify(opaqueTargets)});`,
+    `const opaqueDescendantRoots = new Set(${JSON.stringify(opaqueDescendantRoots)});`,
+    `const immutableRuntimeRoots = ${JSON.stringify(immutableRuntimeRoots)};`,
+    `const volumeIdentityFiles = ${JSON.stringify(volumeIdentityFiles)};`,
+    "const volumeIdentityPaths = new Set(volumeIdentityFiles.map((entry) => entry.path)); if (volumeIdentityPaths.size !== volumeIdentityFiles.length) fail('duplicate volume identity path');",
+    `const privateDirectories = ${JSON.stringify(privateDirectories)};`,
+    `const privateFiles = ${JSON.stringify(privateFiles)};`,
+    `const privateModeDirectories = ${JSON.stringify(privateModeDirectories)};`,
+    `const creatablePrivateDirectories = ${JSON.stringify(creatablePrivateDirectories)};`,
+    "if (!Number.isSafeInteger(uid) || uid < 1 || roots.length === 0) fail('invalid compiler-authored roots');",
+    "const decodeMountPath = (value) => value.replace(/\\\\([0-7]{3})/g, (_, octal) => String.fromCharCode(Number.parseInt(octal, 8)));",
+    "const mountOptionsFor = (target) => {",
+    "  const matches = fs.readFileSync('/proc/self/mountinfo', 'utf8').trim().split('\\n').map((line) => line.split(' ')).filter((parts) => parts.length > 5).map((parts) => ({ point: decodeMountPath(parts[4]), options: parts[5].split(',') })).filter((mount) => target === mount.point || target.startsWith(`${mount.point}/`));",
+    "  return matches.sort((left, right) => right.point.length - left.point.length)[0]?.options ?? [];",
+    "};",
+    "const openDirectoryPath = (target) => {",
+    "  if (!target.startsWith('/') || target === '/' || target.includes('//') || target.split('/').includes('..')) fail('unsafe compiler-authored root');",
+    "  let fd = fs.openSync('/', constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);",
+    "  try {",
+    "    for (const segment of target.slice(1).split('/')) {",
+    "      if (!segment || segment === '.' || segment === '..') fail('unsafe compiler-authored root');",
+    "      const next = fs.openSync(`/proc/self/fd/${fd}/${segment}`, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);",
+    "      fs.closeSync(fd); fd = next;",
+    "    }",
+    "    const info = fs.fstatSync(fd);",
+    "    if (!info.isDirectory()) fail('root is not a directory');",
+    "    if (mountOptionsFor(target).includes('ro')) fail('root is read-only');",
+    "    return fd;",
+    "  } catch (error) { try { fs.closeSync(fd); } catch {} fail('root has a symbolic-link or unavailable path component'); }",
+    "};",
+    "const openRegularFilePath = (target) => {",
+    "  if (!target.startsWith('/') || target === '/' || target.includes('//') || target.split('/').includes('..')) fail('unsafe compiler-authored file');",
+    "  let fd = fs.openSync('/', constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);",
+    "  try {",
+    "    const segments = target.slice(1).split('/');",
+    "    for (const [index, segment] of segments.entries()) {",
+    "      if (!segment || segment === '.' || segment === '..') fail('unsafe compiler-authored file');",
+    "      const isFile = index === segments.length - 1;",
+    "      const next = fs.openSync(`/proc/self/fd/${fd}/${segment}`, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK | (isFile ? 0 : constants.O_DIRECTORY));",
+    "      fs.closeSync(fd); fd = next;",
+    "    }",
+    "    const info = fs.fstatSync(fd);",
+    "    if (!info.isFile() || info.nlink !== 1) fail('compiler-authored file is not one regular file');",
+    "    if (mountOptionsFor(target).includes('ro')) fail('compiler-authored file is read-only');",
+    "    return fd;",
+    "  } catch (error) { try { fs.closeSync(fd); } catch {} fail('file has a symbolic-link or unavailable path component'); }",
+    "};",
+    "const secureFixedTraversalAncestor = (target) => {",
+    "  const fd = openDirectoryPath(target);",
+    "  try {",
+    "    const info = fs.fstatSync(fd);",
+    "    const mode = info.mode & 0o777;",
+    "    if (info.uid !== 0 || info.gid !== 0 || (mode !== 0o775 && mode !== 0o755 && mode !== 0o711)) fail('fixed state ancestor has an unexpected preimage');",
+    "    fs.fchmodSync(fd, 0o711);",
+    "    const secured = fs.fstatSync(fd);",
+    "    if (secured.uid !== 0 || secured.gid !== 0 || (secured.mode & 0o777) !== 0o711) fail('fixed state ancestor traversal mode did not apply');",
+    "  } finally { fs.closeSync(fd); }",
+    "};",
+    "const secureSharedStateAncestor = (target) => {",
+    "  const fd = openDirectoryPath(target);",
+    "  try {",
+    "    const info = fs.fstatSync(fd);",
+    "    const mode = info.mode & 0o777;",
+    "    const current = info.uid === 0 && info.gid === 0 && mode === 0o711;",
+    "    const legacy = info.uid === uid && info.gid === uid && mode === 0o700;",
+    "    if (!current && !legacy) fail('shared state ancestor has an unexpected preimage');",
+    "    fs.fchownSync(fd, 0, 0); fs.fchmodSync(fd, 0o711);",
+    "    const secured = fs.fstatSync(fd);",
+    "    if (secured.uid !== 0 || secured.gid !== 0 || (secured.mode & 0o777) !== 0o711) fail('shared state ancestor traversal mode did not apply');",
+    "  } finally { fs.closeSync(fd); }",
+    "};",
+    "const createPrivateDirectoryPath = ({ anchor, target }) => {",
+    "  if (target !== anchor && !target.startsWith(`${anchor}/`)) fail('private directory escapes its compiler-authored anchor');",
+    "  let fd = openDirectoryPath(anchor);",
+    "  const anchorInfo = fs.fstatSync(fd);",
+    "  const createdFds = [];",
+    "  let preparationError;",
+    "  let current = anchor;",
+    "  try {",
+    "    const relative = target.slice(anchor.length).replace(/^\\//, '');",
+    "    for (const segment of relative ? relative.split('/') : []) {",
+    "      if (!segment || segment === '.' || segment === '..') throw new Error('unsafe');",
+    "      fs.fchownSync(fd, 0, 0);",
+    "      const childPath = `/proc/self/fd/${fd}/${segment}`;",
+    "      try { fs.mkdirSync(childPath, { mode: 0o700 }); } catch (error) { if (error.code !== 'EEXIST') throw error; }",
+    "      const next = fs.openSync(childPath, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);",
+    "      createdFds.push(fd); fd = next; current = `${current}/${segment}`;",
+    "      const info = fs.fstatSync(fd);",
+    "      if (!info.isDirectory() || mountOptionsFor(current).includes('ro')) throw new Error('unsafe-or-read-only');",
+    "    }",
+    "    createdFds.push(fd); fd = -1;",
+    "    for (const ownedFd of createdFds.slice(1).reverse()) { fs.fchownSync(ownedFd, 0, 0); fs.fchmodSync(ownedFd, 0o700); fs.fchownSync(ownedFd, uid, uid); }",
+    "  } catch (error) { preparationError = error.code ?? error.message ?? 'unknown'; } finally { const anchorFd = createdFds[0] ?? fd; if (anchorFd >= 0) try { fs.fchownSync(anchorFd, anchorInfo.uid, anchorInfo.gid); } catch { preparationError = 'restore-anchor-ownership'; }; if (fd >= 0) try { fs.closeSync(fd); } catch {}; for (const ownedFd of createdFds) try { fs.closeSync(ownedFd); } catch {} }",
+    "  if (preparationError) fail(`unable to prepare compiler-authored private directory: ${preparationError}`);",
+    "};",
+    "const ownTree = (fd, device, currentPath) => {",
+    "  const info = fs.fstatSync(fd);",
+    "  if (!info.isDirectory() || info.dev !== device) return;",
+    "  fs.fchownSync(fd, uid, uid);",
+    "  for (const entry of fs.readdirSync(`/proc/self/fd/${fd}`, { withFileTypes: true })) {",
+    "    const childPath = `${currentPath}/${entry.name}`;",
+    "    if (opaquePaths.has(childPath) || opaqueDescendantRoots.has(childPath) || volumeIdentityPaths.has(childPath)) continue;",
+    "    if (entry.isSymbolicLink()) continue;",
+    "    if (!entry.isFile() && !entry.isDirectory()) fail('state tree contains an unsupported entry');",
+    "    let child;",
+    "    try { child = fs.openSync(`/proc/self/fd/${fd}/${entry.name}`, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK | (entry.isDirectory() ? constants.O_DIRECTORY : 0)); } catch { fail('state tree contains a symbolic link or unavailable entry'); }",
+    "    try { const childInfo = fs.fstatSync(child); if (childInfo.dev !== device || mountOptionsFor(childPath).includes('ro')) continue; if (childInfo.isDirectory()) ownTree(child, device, childPath); else if (childInfo.isFile() && childInfo.nlink === 1) fs.fchownSync(child, uid, uid); else if (!childInfo.isFile()) fail('state tree contains an unsupported entry'); } finally { fs.closeSync(child); }",
+    "  }",
+    "};",
+    "const validateImmutableTree = (fd, device, currentPath) => {",
+    "  const info = fs.fstatSync(fd);",
+    "  if (!info.isDirectory() || info.dev !== device || info.uid !== 0 || info.gid !== 0 || (info.mode & 0o777) !== 0o711) fail('immutable runtime directory is unsafe');",
+    "  for (const entry of fs.readdirSync(`/proc/self/fd/${fd}`, { withFileTypes: true })) {",
+    "    let child; try { child = fs.openSync(`/proc/self/fd/${fd}/${entry.name}`, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK | (entry.isDirectory() ? constants.O_DIRECTORY : 0)); } catch { fail('immutable runtime contains a symbolic link or unavailable entry'); }",
+    "    try { const childInfo = fs.fstatSync(child); if (childInfo.dev !== device || childInfo.uid !== 0 || childInfo.gid !== 0) fail('immutable runtime entry is unsafe'); if (childInfo.isDirectory()) validateImmutableTree(child, device, `${currentPath}/${entry.name}`); else if (!childInfo.isFile() || childInfo.nlink !== 1 || (childInfo.mode & 0o222) !== 0) fail('immutable runtime contains an unsupported entry'); } finally { fs.closeSync(child); }",
+    "  }",
+    "};",
+    "const securePrivateDirectory = (fd) => {",
+    "  try {",
+    "    fs.fchownSync(fd, 0, 0);",
+    "    fs.fchmodSync(fd, 0o700);",
+    "    fs.fchownSync(fd, uid, uid);",
+    "  } catch {",
+    "    try { fs.fchownSync(fd, uid, uid); } catch {}",
+    "    fail('unable to secure private directory');",
+    "  }",
+    "  const info = fs.fstatSync(fd);",
+    "  if (info.uid !== uid || info.gid !== uid || (info.mode & 0o777) !== 0o700) fail('private directory ownership or mode did not apply');",
+    "};",
+    "const securePrivateFile = (fd) => {",
+    "  try {",
+    "    fs.fchownSync(fd, 0, 0);",
+    "    fs.fchmodSync(fd, 0o600);",
+    "    fs.fchownSync(fd, uid, uid);",
+    "  } catch {",
+    "    try { fs.fchownSync(fd, uid, uid); } catch {}",
+    "    fail('unable to secure private file');",
+    "  }",
+    "  const info = fs.fstatSync(fd);",
+    "  if (info.uid !== uid || info.gid !== uid || (info.mode & 0o777) !== 0o600) fail('private file ownership or mode did not apply');",
+    "};",
+    `const volumeBootstrapMarker = ${JSON.stringify(VOLUME_BOOTSTRAP_MARKER)}, volumeBootstrapContent = ${JSON.stringify(`${VOLUME_BOOTSTRAP_MARKER_CONTENT}\n`)};`,
+    "const verifyVolumeIdentityFile = (fd, expected, mode, device) => { const before = fs.fstatSync(fd); if (!before.isFile() || before.nlink !== 1 || before.uid !== 0 || before.gid !== 0 || (before.mode & 0o777) !== mode || before.dev !== device || before.size !== Buffer.byteLength(expected)) fail('volume identity anchor is unsafe'); const bytes = Buffer.alloc(before.size); let offset=0; while(offset<bytes.length){const count=fs.readSync(fd,bytes,offset,bytes.length-offset,offset);if(count<1)fail('volume identity anchor read failed');offset+=count;} const after = fs.fstatSync(fd); if (!bytes.equals(Buffer.from(expected)) || after.dev !== before.dev || after.ino !== before.ino || after.size !== before.size || after.mtimeMs !== before.mtimeMs || after.ctimeMs !== before.ctimeMs) fail('volume identity anchor changed'); };",
+    "const secureVolumeIdentity = (entry) => { const parentPath = require('node:path').posix.dirname(entry.path); if (entry.path !== `${parentPath}/.spawnfile-resource-identity`) fail('volume identity anchor path is invalid'); const parent = openDirectoryPath(parentPath); let marker, sentinel; try { const parentInfo = fs.fstatSync(parent), parentMode = parentInfo.mode & 0o777, freshParent = parentInfo.uid === 0 && parentInfo.gid === 0 && parentMode === 0o755, establishedParent = parentInfo.uid === uid && parentInfo.gid === uid && parentMode === 0o755; if (!freshParent && !establishedParent) fail('volume identity parent is unsafe'); const names = fs.readdirSync(`/proc/self/fd/${parent}`).sort(), hasSentinel = names.includes('.spawnfile-resource-identity'), hasMarker = names.includes(volumeBootstrapMarker); if (hasSentinel) { sentinel = fs.openSync(`/proc/self/fd/${parent}/.spawnfile-resource-identity`, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK); verifyVolumeIdentityFile(sentinel, `${entry.identity}\n`, 0o644, parentInfo.dev); if (hasMarker) { if (!freshParent || names.length !== 2) fail('volume bootstrap recovery preimage is unsafe'); marker = fs.openSync(`/proc/self/fd/${parent}/${volumeBootstrapMarker}`, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK); verifyVolumeIdentityFile(marker, volumeBootstrapContent, 0o600, parentInfo.dev); fs.fsyncSync(sentinel); fs.fsyncSync(parent); verifyVolumeIdentityFile(sentinel, `${entry.identity}\n`, 0o644, parentInfo.dev); verifyVolumeIdentityFile(marker, volumeBootstrapContent, 0o600, parentInfo.dev); fs.unlinkSync(`/proc/self/fd/${parent}/${volumeBootstrapMarker}`); fs.fsyncSync(parent); } return; } if (!freshParent || names.length !== 1 || !hasMarker) fail('volume bootstrap preimage is unsafe'); marker = fs.openSync(`/proc/self/fd/${parent}/${volumeBootstrapMarker}`, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK); verifyVolumeIdentityFile(marker, volumeBootstrapContent, 0o600, parentInfo.dev); const expected = Buffer.from(`${entry.identity}\n`); try { sentinel = fs.openSync(`/proc/self/fd/${parent}/.spawnfile-resource-identity`, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW | constants.O_NONBLOCK, 0o644); let offset=0; while(offset<expected.length){const written=fs.writeSync(sentinel,expected,offset,expected.length-offset,offset);if(written<1)fail('volume identity anchor write failed');offset+=written;} fs.fchownSync(sentinel,0,0);fs.fchmodSync(sentinel,0o644);fs.fsyncSync(sentinel); } finally { expected.fill(0); } fs.closeSync(sentinel); sentinel=undefined; sentinel=fs.openSync(`/proc/self/fd/${parent}/.spawnfile-resource-identity`,constants.O_RDONLY|constants.O_NOFOLLOW|constants.O_NONBLOCK);verifyVolumeIdentityFile(sentinel,`${entry.identity}\n`,0o644,parentInfo.dev);fs.fsyncSync(parent);verifyVolumeIdentityFile(marker,volumeBootstrapContent,0o600,parentInfo.dev);fs.unlinkSync(`/proc/self/fd/${parent}/${volumeBootstrapMarker}`);fs.fsyncSync(parent); } finally { if(marker!==undefined)fs.closeSync(marker);if(sentinel!==undefined)fs.closeSync(sentinel);fs.closeSync(parent); } };",
+    `for (const target of ${grokWorkersPresent ? "['/var/lib']" : "['/var', '/var/lib']"}) secureFixedTraversalAncestor(target);`,
+    `secureSharedStateAncestor('${SPAWNFILE_PRIVATE_STATE_ROOT}');`,
+    // `/var/lib/spawnfile/daimon` hosts several independently-owned children
+    // (AGY/Grok subscription realms and the wake fuse at organization uid, the
+    // broker realm and usage ledger at broker/broker:organization uid), so —
+    // exactly like SPAWNFILE_PRIVATE_STATE_ROOT above — it must stay a shared,
+    // root-owned, universally traversable ancestor, never chowned to any one
+    // child's uid. Docker always creates it fresh as root:root when it first
+    // provisions any volume mounted under it (guaranteed for every Daimon
+    // organization now that the usage ledger is provisioned unconditionally:
+    // `renderDaimonUsageLedgerProvisioning`), so the plain fixed-traversal
+    // preimage — never the organization uid — is the only state this needs to
+    // tolerate.
+    `secureFixedTraversalAncestor('${SPAWNFILE_PRIVATE_STATE_ROOT}/daimon');`,
+    "for (const target of immutableRuntimeRoots) { const fd = openDirectoryPath(target); try { validateImmutableTree(fd, fs.fstatSync(fd).dev, target); const start = openRegularFilePath(`${target}/daimon-start.sh`); try { const info = fs.fstatSync(start); if ((info.mode & 0o111) === 0 || (info.mode & 0o222) !== 0 || info.uid !== 0 || info.gid !== 0) fail('Daimon start script is not immutable executable'); } finally { fs.closeSync(start); } } finally { fs.closeSync(fd); } }",
+    "for (const entry of volumeIdentityFiles) secureVolumeIdentity(entry);",
+    "for (const target of creatablePrivateDirectories) createPrivateDirectoryPath(target);",
+    "for (const target of privateDirectories) { if (opaquePaths.has(target)) fail('compiler-authored directory overlaps opaque path'); const fd = openDirectoryPath(target); try { fs.fchownSync(fd, uid, uid); } finally { fs.closeSync(fd); } }",
+    "for (const target of privateModeDirectories) { if (opaquePaths.has(target)) fail('private directory overlaps opaque path'); const fd = openDirectoryPath(target); try { securePrivateDirectory(fd); } finally { fs.closeSync(fd); } }",
+    "for (const target of privateFiles) { if (opaquePaths.has(target)) fail('compiler-authored file overlaps opaque path'); const fd = openRegularFilePath(target); try { securePrivateFile(fd); } finally { fs.closeSync(fd); } }",
+    "for (const root of roots) { if (opaquePaths.has(root) || opaqueDescendantRoots.has(root)) fail('state root overlaps opaque path'); const fd = openDirectoryPath(root); try { ownTree(fd, fs.fstatSync(fd).dev, root); } finally { fs.closeSync(fd); } }"
+].join("\n");
+export const resolveDaimonVolumeIdentityFiles = (runtimePlans) => {
+    const byPath = new Map();
+    const resourceRoot = "/var/lib/spawnfile/resources";
+    for (const resource of runtimePlans.flatMap((plan) => plan.resources ?? [])) {
+        if (resource.kind !== "volume" || !("replacementSentinel" in resource) || typeof resource.replacementSentinel !== "string" || !("resolvedIdentity" in resource) || typeof resource.resolvedIdentity !== "string")
+            continue;
+        const relative = typeof resource.backingPath === "string" ? path.posix.relative(resourceRoot, resource.backingPath) : "";
+        if (typeof resource.backingPath !== "string" || path.posix.normalize(resource.backingPath) !== resource.backingPath || resource.backingPath.includes("//") || !relative || relative.startsWith("../") || path.posix.isAbsolute(relative) || resource.replacementSentinel !== path.posix.join(resource.backingPath, ".spawnfile-resource-identity") || !/^sha256:[a-f0-9]{64}$/u.test(resource.resolvedIdentity))
+            throw new Error("invalid compiler-authored volume identity anchor");
+        const existing = byPath.get(resource.replacementSentinel);
+        if (existing !== undefined && existing !== resource.resolvedIdentity)
+            throw new Error("conflicting compiler-authored volume identity anchor");
+        byPath.set(resource.replacementSentinel, resource.resolvedIdentity);
+    }
+    return [...byPath].map(([path, identity]) => ({ path, identity })).sort((left, right) => left.path.localeCompare(right.path));
+};

package/dist/compiler/containerDaimonUidEntrypointRender.d.ts

@@ -0,0 +1,24 @@
+import type { RuntimeTargetPlan } from "./containerArtifactsTypes.js";
+import type { EntrypointOptions } from "./containerEntrypointRender.js";
+import { type BackedMountRequirement } from "./containerBackedMountRender.js";
+export { resolveDaimonVolumeIdentityFiles } from "./containerDaimonOwnershipGuardRender.js";
+export declare const DAIMON_AUTHORIZED_UID_ENV = "SPAWNFILE_DAIMON_AUTHORIZED_UID";
+export declare const DAIMON_RUNTIME_UID = 2000;
+export declare const DAIMON_UID_ENTRYPOINT_PATH = "/opt/spawnfile/daimon-uid-entrypoint.sh";
+export declare const DAIMON_RUNTIME_HOMES_DIRECTORY = "runtime-homes";
+export declare const DAIMON_BROKER_STARTUP_TIMEOUT_SECONDS = 60;
+export declare const renderDaimonBrokerSocketWait: (timeoutSeconds?: number, pollSeconds?: number) => string[];
+export declare const resolveDaimonUidEntrypointStateRoots: (runtimePlans: RuntimeTargetPlan[]) => string[];
+export interface DaimonUidEntrypointOwnershipPlan {
+    creatablePrivateDirectories: Array<{
+        anchor: string;
+        target: string;
+    }>;
+    opaqueDescendantRoots: string[];
+    privateDirectories: string[];
+    privateFiles: string[];
+    privateModeDirectories: string[];
+    stateRoots: string[];
+}
+export declare const resolveDaimonUidEntrypointOwnershipPlan: (runtimePlans: RuntimeTargetPlan[], persistentMountPaths?: string[], moltnet?: EntrypointOptions["moltnet"]) => DaimonUidEntrypointOwnershipPlan;
+export declare const renderDaimonUidEntrypoint: (runtimePlans: RuntimeTargetPlan[], persistentMountPaths?: string[], moltnet?: EntrypointOptions["moltnet"], persistentMounts?: readonly BackedMountRequirement[]) => string;

package/dist/compiler/containerDaimonUidEntrypointRender.js

@@ -0,0 +1,291 @@
+import path from "node:path";
+import { DAIMON_RUNTIME_ACCEPTANCE_STORE_MOUNT_ID, DAIMON_WAKE_FUSE_DIRECTORY } from "../runtime/daimon/config.js";
+import { DAIMON_GROK_TURN_USAGE_LEDGER } from "../runtime/daimon/contractManifest.js";
+import { DAIMON_RECORDING_MOUNT_ID_PREFIX } from "../runtime/daimon/recording.js";
+import { MOLTNET_READINESS_DIRECTORY } from "./containerReadinessPaths.js";
+import { createBackedMountGuard } from "./containerBackedMountRender.js";
+import { renderDaimonOwnershipProgram, resolveDaimonVolumeIdentityFiles } from "./containerDaimonOwnershipGuardRender.js";
+export { resolveDaimonVolumeIdentityFiles } from "./containerDaimonOwnershipGuardRender.js";
+import { renderDaimonGrokHostPreflight } from "./containerDaimonGrokWorkerProvisioning.js";
+import { DAIMON_BROKER_EXECUTABLE, DAIMON_BROKER_BACKEND_SOCKET, DAIMON_BROKER_LAUNCHER_SOCKET, DAIMON_BROKER_REALM, DAIMON_BROKER_SOCKET, DAIMON_BROKER_TMPDIR, DAIMON_BROKER_UID, DAIMON_ORGANIZATION_UID, renderDaimonBrokerProvisioning, renderDaimonUsageLedgerProvisioning, resolveDaimonGrokRegistrations } from "./containerDaimonBrokerRender.js";
+export const DAIMON_AUTHORIZED_UID_ENV = "SPAWNFILE_DAIMON_AUTHORIZED_UID";
+export const DAIMON_RUNTIME_UID = DAIMON_ORGANIZATION_UID;
+export const DAIMON_UID_ENTRYPOINT_PATH = "/opt/spawnfile/daimon-uid-entrypoint.sh";
+export const DAIMON_RUNTIME_HOMES_DIRECTORY = "runtime-homes";
+export const DAIMON_BROKER_STARTUP_TIMEOUT_SECONDS = 60;
+export const renderDaimonBrokerSocketWait = (timeoutSeconds = DAIMON_BROKER_STARTUP_TIMEOUT_SECONDS, pollSeconds = 0.1) => [
+    `broker_startup_timeout_seconds=${timeoutSeconds}`,
+    `broker_startup_poll_seconds=${pollSeconds}`,
+    "broker_startup_started=$SECONDS",
+    "broker_process_status_root=/proc",
+    "wait_for_broker_socket() {",
+    "  socket=$1; child=$2; label=$3",
+    "  while [ ! -S \"$socket\" ]; do",
+    "    if ! kill -0 \"$child\" 2>/dev/null; then set +e; wait \"$child\"; child_status=$?; set -e; echo \"$label exited before readiness (status $child_status)\" >&2; return 1; fi",
+    "    if [ $((SECONDS - broker_startup_started)) -ge \"$broker_startup_timeout_seconds\" ]; then echo \"$label readiness timed out after ${broker_startup_timeout_seconds}s\" >&2; return 1; fi",
+    "    sleep \"$broker_startup_poll_seconds\"",
+    "  done",
+    "}",
+    "wait_for_broker_identity() {",
+    "  child=$1; expected_uid=$2; expected_caps=$3; label=$4",
+    "  while kill -0 \"$child\" 2>/dev/null; do",
+    "    status_path=$broker_process_status_root/$child/status",
+    "    observed_uid=$(awk '/^Uid:/{print $2}' \"$status_path\" 2>/dev/null || true)",
+    "    observed_caps=$(awk '/^CapBnd:/{print $2}' \"$status_path\" 2>/dev/null || true)",
+    "    if [ \"$observed_uid\" = \"$expected_uid\" ] && [ \"$observed_caps\" = \"$expected_caps\" ]; then return 0; fi",
+    "    if [ $((SECONDS - broker_startup_started)) -ge \"$broker_startup_timeout_seconds\" ]; then echo \"$label identity readiness timed out after ${broker_startup_timeout_seconds}s\" >&2; return 1; fi",
+    "    sleep \"$broker_startup_poll_seconds\"",
+    "  done",
+    "  set +e; wait \"$child\"; child_status=$?; set -e; echo \"$label exited before identity readiness (status $child_status)\" >&2; return 1",
+    "}"
+];
+const SPAWNFILE_PRIVATE_STATE_ROOT = "/var/lib/spawnfile";
+/**
+ * `/var/lib/spawnfile/daimon` hosts several independently-owned children —
+ * the AGY/Grok subscription realms (organization uid), the broker realm and
+ * usage ledger (broker uid, or broker:organization), the wake fuse
+ * (organization uid) — so it must stay a shared, root-owned, universally
+ * traversable ancestor (0711), exactly like `SPAWNFILE_PRIVATE_STATE_ROOT`
+ * itself, never chowned to the organization uid. Before this exclusion, any
+ * organization with an AGY agent (whose realm mount lives here and is not
+ * itself excluded from the ancestor walk below) got this directory chowned
+ * to the organization uid as a side effect of securing that one mount —
+ * which then made every *other* child that must be provisioned here as a
+ * different uid (most concretely, the usage ledger provisioned unconditionally
+ * by `renderDaimonUsageLedgerProvisioning`) fail to be created at all, because
+ * the entrypoint runs that provisioning as root without `CAP_DAC_OVERRIDE`
+ * (`runProject.ts`'s capability set), which cannot write into a directory it
+ * does not own by matching uid or gid.
+ */
+const DAIMON_SHARED_STATE_ROOT = `${SPAWNFILE_PRIVATE_STATE_ROOT}/daimon`;
+const DAIMON_AGY_SUBSCRIPTION_REALM_MOUNT_ID = "daimon-agy-subscription-realm";
+const DAIMON_AGY_RUNTIME_HOME_MOUNT_ID_PREFIX = "daimon-agy-runtime-home-";
+const DAIMON_PORTABLE_ENGINE_HOME_MOUNT_ID_PREFIX = "daimon-engine-home-";
+const quote = (value) => `'${value.replace(/'/g, `'"'"'`)}'`;
+const nodeSlug = (nodeId) => nodeId.replace(/^agent:/u, "")
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "");
+const opaqueMountTargets = (runtimePlans) => [...new Set(runtimePlans
+        .filter((plan) => plan.runtimeName === "daimon")
+        .flatMap((plan) => [
+        ...(plan.opaqueMountTargets ?? []),
+        ...(plan.resources ?? []).map((resource) => resource.linkPath),
+        ...Object.entries(plan.engineByNodeId ?? {})
+            .filter(([, engine]) => engine === "codex")
+            .map(([nodeId, engine]) => path.posix.join(plan.instancePaths.instanceRoot ?? "", DAIMON_RUNTIME_HOMES_DIRECTORY, nodeSlug(nodeId), ".daimon-inbound", `${engine}-auth`))
+    ])
+        .filter((target) => target.startsWith("/")))].sort();
+export const resolveDaimonUidEntrypointStateRoots = (runtimePlans) => [
+    ...new Set([
+        ...runtimePlans.flatMap((plan) => [
+            plan.instancePaths.workspacePath,
+            ...(plan.instancePaths.homePath ? [plan.instancePaths.homePath] : []),
+            ...(plan.runtimeName === "daimon" && plan.instancePaths.instanceRoot
+                ? [path.posix.join(plan.instancePaths.instanceRoot, DAIMON_RUNTIME_HOMES_DIRECTORY)]
+                : [])
+        ])
+    ])
+].filter((root) => root.startsWith("/")).sort();
+const writableStateRoots = (runtimePlans, persistentMountPaths) => [
+    ...new Set([
+        ...resolveDaimonUidEntrypointStateRoots(runtimePlans),
+        ...persistentMountPaths
+    ])
+].filter((root) => root.startsWith("/")
+    && root !== DAIMON_BROKER_REALM
+    && root !== DAIMON_GROK_TURN_USAGE_LEDGER.directoryPath
+    && root !== DAIMON_WAKE_FUSE_DIRECTORY).sort();
+const privateDirectoriesThrough = (target) => {
+    if (target !== SPAWNFILE_PRIVATE_STATE_ROOT &&
+        !target.startsWith(`${SPAWNFILE_PRIVATE_STATE_ROOT}/`))
+        return [];
+    const relative = path.posix.relative(SPAWNFILE_PRIVATE_STATE_ROOT, target);
+    const segments = relative === "" ? [] : relative.split("/");
+    return [
+        SPAWNFILE_PRIVATE_STATE_ROOT,
+        ...segments.map((_, index) => path.posix.join(SPAWNFILE_PRIVATE_STATE_ROOT, ...segments.slice(0, index + 1)))
+    ];
+};
+const privateModeDirectories = (runtimePlans, moltnet) => [
+    ...new Set(runtimePlans
+        .filter((plan) => plan.runtimeName === "daimon")
+        .flatMap((plan) => plan.persistentMounts ?? [])
+        .filter((mount) => mount.id === DAIMON_RUNTIME_ACCEPTANCE_STORE_MOUNT_ID
+        || mount.id === DAIMON_AGY_SUBSCRIPTION_REALM_MOUNT_ID
+        || mount.id.startsWith(DAIMON_AGY_RUNTIME_HOME_MOUNT_ID_PREFIX)
+        || mount.id.startsWith(DAIMON_RECORDING_MOUNT_ID_PREFIX)
+        || mount.id.startsWith(DAIMON_PORTABLE_ENGINE_HOME_MOUNT_ID_PREFIX))
+        // Secure the acceptance store's parent as well: Docker creates state/ at
+        // 0755 and the ancestor pass only chowns it. Mode 0700 prevents Grok worker
+        // traversal while retaining organization-uid and privileged exec access.
+        .flatMap((mount) => mount.id === DAIMON_RUNTIME_ACCEPTANCE_STORE_MOUNT_ID
+        ? [mount.mount_path, path.posix.dirname(mount.mount_path)]
+        : [mount.mount_path])
+        .filter((target) => target.startsWith("/"))
+        .concat((moltnet?.nodePlans ?? []).flatMap((plan) => plan.receiptStorePath ? [path.posix.dirname(plan.receiptStorePath)] : [])))
+].sort();
+const portableEngineHomeDirectories = (runtimePlans) => [
+    ...new Set(runtimePlans
+        .filter((plan) => plan.runtimeName === "daimon")
+        .flatMap((plan) => plan.persistentMounts ?? [])
+        .filter((mount) => mount.id.startsWith(DAIMON_PORTABLE_ENGINE_HOME_MOUNT_ID_PREFIX))
+        .map((mount) => mount.mount_path)
+        .filter((target) => target.startsWith("/")))
+].sort();
+const moltnetConfigPaths = (moltnet) => {
+    if (!moltnet)
+        return [];
+    return [
+        ...moltnet.serverPlans.flatMap((plan) => plan.mode === "managed" && plan.configPath ? [plan.configPath] : []),
+        ...moltnet.nodePlans.map((plan) => plan.configPath)
+    ].filter((configPath) => configPath.startsWith("/")).sort();
+};
+const daimonConfigPaths = (runtimePlans) => [
+    ...new Set(runtimePlans
+        .filter((plan) => plan.runtimeName === "daimon")
+        .map((plan) => plan.instancePaths.configPath)
+        .filter((configPath) => configPath.startsWith("/")))
+].sort();
+const moltnetReceiptDirectories = (moltnet) => [...new Set((moltnet?.nodePlans ?? []).flatMap((plan) => plan.receiptStorePath ? [path.posix.dirname(plan.receiptStorePath)] : []))].filter((directory) => directory.startsWith("/")).sort();
+export const resolveDaimonUidEntrypointOwnershipPlan = (runtimePlans, persistentMountPaths = [], moltnet) => {
+    const opaqueDescendantRoots = portableEngineHomeDirectories(runtimePlans);
+    const stateRoots = writableStateRoots(runtimePlans, persistentMountPaths)
+        .filter((root) => !opaqueDescendantRoots.some((opaqueRoot) => root === opaqueRoot || root.startsWith(`${opaqueRoot}/`)));
+    const privateFiles = [
+        ...new Set([...daimonConfigPaths(runtimePlans), ...moltnetConfigPaths(moltnet)])
+    ].sort();
+    const modeDirectories = [
+        ...new Set([
+            ...privateModeDirectories(runtimePlans, moltnet),
+            ...daimonConfigPaths(runtimePlans).map((configPath) => path.posix.dirname(configPath))
+        ])
+    ].sort();
+    const receiptDirectories = moltnetReceiptDirectories(moltnet);
+    const creatableTargets = [
+        ...receiptDirectories,
+        ...((moltnet?.nodePlans.length ?? 0) > 0 ? [MOLTNET_READINESS_DIRECTORY] : [])
+    ];
+    const privateDirectories = [
+        ...new Set([
+            ...stateRoots.flatMap(privateDirectoriesThrough),
+            ...moltnetReceiptDirectories(moltnet).flatMap(privateDirectoriesThrough),
+            ...privateFiles.flatMap((configPath) => privateDirectoriesThrough(path.posix.dirname(configPath)))
+        ])
+    ].filter((directory) => directory !== SPAWNFILE_PRIVATE_STATE_ROOT && directory !== DAIMON_SHARED_STATE_ROOT).sort();
+    return {
+        creatablePrivateDirectories: creatableTargets.map((target) => ({
+            anchor: target === MOLTNET_READINESS_DIRECTORY
+                ? "/run"
+                : stateRoots.filter((root) => target === root || target.startsWith(`${root}/`))
+                    .sort((left, right) => right.length - left.length)[0] ?? SPAWNFILE_PRIVATE_STATE_ROOT,
+            target
+        })),
+        opaqueDescendantRoots,
+        privateDirectories,
+        privateFiles,
+        privateModeDirectories: modeDirectories,
+        stateRoots
+    };
+};
+export const renderDaimonUidEntrypoint = (runtimePlans, persistentMountPaths = [], moltnet, persistentMounts = []) => {
+    const opaqueTargets = opaqueMountTargets(runtimePlans);
+    const daimonPlan = runtimePlans.find((plan) => plan.runtimeName === "daimon");
+    const daimonConfigPath = daimonPlan?.instancePaths.configPath;
+    const daimonStartPath = daimonPlan
+        ? path.posix.join(daimonPlan.runtimeRoot, "daimon-start.sh")
+        : "";
+    const ownershipPlan = resolveDaimonUidEntrypointOwnershipPlan(runtimePlans, persistentMountPaths, moltnet);
+    const immutableRuntimeRoots = [
+        ...new Set(runtimePlans
+            .filter((plan) => plan.runtimeName === "daimon")
+            .map((plan) => plan.runtimeRoot)
+            .filter((runtimeRoot) => runtimeRoot.startsWith("/opt/spawnfile/runtime-installs/")))
+    ].sort();
+    const volumeIdentityFiles = resolveDaimonVolumeIdentityFiles(runtimePlans);
+    return [
+        "#!/usr/bin/env bash",
+        "set -euo pipefail",
+        `uid=${DAIMON_ORGANIZATION_UID}`,
+        'gid="$uid"',
+        `runtime_command=(${quote("/opt/spawnfile/entrypoint.sh")} --spawnfile-runtime-identity "$uid" "$gid")`,
+        'if [ "$#" -gt 0 ]; then',
+        `  if [ "$#" -ne 5 ] || [ "$1" != auth ] || [ "$2" != agy ] || [ "$3" != login ] || [ "$4" != --config ] || [ "$5" != ${quote(daimonConfigPath ?? "")} ]; then echo "Unsupported Daimon container command" >&2; exit 1; fi`,
+        `  runtime_command=(bash ${quote(daimonStartPath)} "$@")`,
+        "fi",
+        // Fail closed BEFORE the ownership guard touches anything: an unbacked
+        // durable path would otherwise be bootstrapped, owned and written on the
+        // container's own writable layer, and lost on `docker rm`.
+        ...createBackedMountGuard(persistentMounts),
+        `state_roots=(${ownershipPlan.stateRoots.map(quote).join(" ")})`,
+        "node - \"$uid\" \"${state_roots[@]}\" <<'SPAWNFILE_DAIMON_OWNERSHIP'",
+        renderDaimonOwnershipProgram(opaqueTargets, ownershipPlan.opaqueDescendantRoots, immutableRuntimeRoots, volumeIdentityFiles, ownershipPlan.privateDirectories, ownershipPlan.privateFiles, ownershipPlan.privateModeDirectories, ownershipPlan.creatablePrivateDirectories, resolveDaimonGrokRegistrations(runtimePlans).length > 0),
+        "SPAWNFILE_DAIMON_OWNERSHIP",
+        `for fixed_uid in ${DAIMON_ORGANIZATION_UID} ${DAIMON_BROKER_UID} ${resolveDaimonGrokRegistrations(runtimePlans).map((entry) => entry.uid).join(" ")}; do`,
+        '  if ! getent group "$fixed_uid" >/dev/null; then groupadd -K GID_MIN=1 --gid "$fixed_uid" "daimon-$fixed_uid"; fi',
+        '  if ! getent passwd "$fixed_uid" >/dev/null; then useradd -K UID_MIN=1 --no-create-home --no-log-init --uid "$fixed_uid" --gid "$fixed_uid" --home-dir /nonexistent --shell /usr/sbin/nologin "daimon-$fixed_uid"; fi',
+        "done",
+        ...(resolveDaimonGrokRegistrations(runtimePlans).length === 0 ? [] : renderDaimonGrokHostPreflight()),
+        ...renderDaimonBrokerProvisioning(runtimePlans),
+        'if ! getent passwd "$uid" >/dev/null; then',
+        '  runtime_identity="daimon-$uid"',
+        '  runtime_group="$(getent group "$gid" | cut -d: -f1 || true)"',
+        '  if [ -z "$runtime_group" ]; then groupadd -K GID_MIN=1 --gid "$gid" "$runtime_identity"; runtime_group="$runtime_identity"; fi',
+        '  useradd -K UID_MIN=1 --no-create-home --no-log-init --uid "$uid" --gid "$gid" --home-dir /nonexistent --shell /usr/sbin/nologin "$runtime_identity"',
+        'fi',
+        'if ! getent passwd "$uid" >/dev/null; then echo "Daimon authorized UID has no local identity" >&2; exit 1; fi',
+        `chown 0:0 ${quote(DAIMON_WAKE_FUSE_DIRECTORY)} && chmod 0700 ${quote(DAIMON_WAKE_FUSE_DIRECTORY)} && chown ${DAIMON_ORGANIZATION_UID}:${DAIMON_ORGANIZATION_UID} ${quote(DAIMON_WAKE_FUSE_DIRECTORY)}`,
+        // Unconditional: AGY and Codex write the per-turn usage ledger from the
+        // organization-uid runtime process below, not the (Grok-only) broker, so
+        // this cannot be gated on `resolveDaimonGrokRegistrations`.
+        ...renderDaimonUsageLedgerProvisioning(),
+        ...(resolveDaimonGrokRegistrations(runtimePlans).length === 0 ? [] : [
+            ...renderDaimonBrokerSocketWait(),
+            "startup_children=()",
+            "cleanup_broker_startup() { status=$?; trap - EXIT; for child in \"${startup_children[@]}\"; do kill -TERM \"$child\" 2>/dev/null || true; wait \"$child\" 2>/dev/null || true; done; return \"$status\"; }",
+            "trap cleanup_broker_startup EXIT",
+            "trap 'exit 143' TERM INT HUP",
+            `install -d -o ${DAIMON_BROKER_UID} -g ${DAIMON_BROKER_UID} -m 0700 ${quote(DAIMON_BROKER_REALM)}`,
+            `if [ -e ${quote(`${DAIMON_BROKER_REALM}/auth.json`)} ]; then test -f ${quote(`${DAIMON_BROKER_REALM}/auth.json`)} && test ! -L ${quote(`${DAIMON_BROKER_REALM}/auth.json`)}; chown 0:0 ${quote(`${DAIMON_BROKER_REALM}/auth.json`)}; chmod 0600 ${quote(`${DAIMON_BROKER_REALM}/auth.json`)}; chown ${DAIMON_BROKER_UID}:${DAIMON_BROKER_UID} ${quote(`${DAIMON_BROKER_REALM}/auth.json`)}; fi`,
+            `setpriv --clear-groups --reuid ${DAIMON_BROKER_UID} --regid ${DAIMON_BROKER_UID} --inh-caps=-all --ambient-caps=-all --bounding-set=-all -- bash -ceu 'probe=${DAIMON_BROKER_REALM}/.daimon-ancestry-probe; umask 077; : > "$probe"; rm "$probe"'`,
+            `setpriv --clear-groups --reuid ${DAIMON_ORGANIZATION_UID} --regid ${DAIMON_ORGANIZATION_UID} --inh-caps=-all --ambient-caps=-all --bounding-set=-all -- bash -ceu '! test -r ${DAIMON_BROKER_REALM}'`,
+            ...resolveDaimonGrokRegistrations(runtimePlans).map((entry) => `setpriv --clear-groups --reuid ${entry.uid} --regid ${entry.uid} --inh-caps=-all --ambient-caps=-all --bounding-set=-all -- bash -ceu '! test -r ${DAIMON_BROKER_REALM}'`),
+            `setpriv --inh-caps=-all --ambient-caps=-all --bounding-set=-all,+chown,+setuid,+setgid -- ${quote(DAIMON_BROKER_EXECUTABLE)} &`,
+            "launcher_pid=$!",
+            "startup_children+=(\"$launcher_pid\")",
+            `wait_for_broker_socket ${quote(DAIMON_BROKER_LAUNCHER_SOCKET)} "$launcher_pid" "engine broker launcher"`,
+            `wait_for_broker_identity "$launcher_pid" 0 00000000000000c1 "engine broker launcher"`,
+            `setpriv --clear-groups --reuid ${DAIMON_BROKER_UID} --regid ${DAIMON_BROKER_UID} --inh-caps=-all --ambient-caps=-all --bounding-set=-all -- env TMPDIR=${quote(DAIMON_BROKER_TMPDIR)} ${quote(path.posix.join(daimonPlan?.runtimeRoot ?? "", "bin/daimon-runtime"))} engine-broker serve &`,
+            "broker_pid=$!",
+            "startup_children+=(\"$broker_pid\")",
+            `wait_for_broker_socket ${quote(DAIMON_BROKER_BACKEND_SOCKET)} "$broker_pid" "engine broker backend"`,
+            `wait_for_broker_identity "$broker_pid" ${DAIMON_BROKER_UID} 0000000000000000 "engine broker backend"`,
+            `setpriv --inh-caps=-all --ambient-caps=-all --bounding-set=-all,+chown,+setuid,+setgid,+setpcap -- env TMPDIR=${quote(DAIMON_BROKER_TMPDIR)} ${quote(DAIMON_BROKER_EXECUTABLE)} --relay &`,
+            "relay_pid=$!",
+            "startup_children+=(\"$relay_pid\")",
+            `wait_for_broker_socket ${quote(DAIMON_BROKER_SOCKET)} "$relay_pid" "engine broker control relay"`,
+            `wait_for_broker_identity "$relay_pid" ${DAIMON_BROKER_UID} 0000000000000000 "engine broker control relay"`,
+            `[ -S ${quote(DAIMON_BROKER_SOCKET)} ] || exit 1`,
+            "for child_spec in \"$launcher_pid:0:00000000000000c1\" \"$relay_pid:2100:0000000000000000\" \"$broker_pid:2100:0000000000000000\"; do child=${child_spec%%:*}; rest=${child_spec#*:}; expected_uid=${rest%%:*}; expected_caps=${rest##*:}; observed_uid=$(awk '/^Uid:/{print $2}' \"/proc/$child/status\"); cap_bnd=$(awk '/^CapBnd:/{print $2}' \"/proc/$child/status\"); [ \"$observed_uid\" = \"$expected_uid\" ] && [ \"$cap_bnd\" = \"$expected_caps\" ] || exit 1; done"
+        ]),
+        "setpriv --clear-groups --reuid \"$uid\" --regid \"$gid\" --inh-caps=-all --ambient-caps=-all --bounding-set=-all -- bash -ceu '",
+        "  if [ \"$EUID\" -eq 0 ]; then exit 1; fi",
+        "  test \"$(sed -n \"s/^CapEff:[[:space:]]*//p\" /proc/self/status)\" = 0000000000000000",
+        "  exec \"$@\"",
+        `' bash "\${runtime_command[@]}" &`,
+        "runtime_pid=$!",
+        "trap - EXIT TERM INT HUP",
+        "stopping=0",
+        "stop_children() { stopping=1; kill -TERM \"$runtime_pid\" 2>/dev/null || true; for child in \"${relay_pid:-}\" \"${broker_pid:-}\" \"${launcher_pid:-}\"; do [ -z \"$child\" ] || kill -TERM \"$child\" 2>/dev/null || true; done; }",
+        "trap stop_children TERM INT HUP",
+        'watch_pids=("$runtime_pid")',
+        ...(resolveDaimonGrokRegistrations(runtimePlans).length === 0 ? [] : ['watch_pids+=("$relay_pid" "$broker_pid" "$launcher_pid")']),
+        "finished_pid=",
+        'set +e; wait -n -p finished_pid "${watch_pids[@]}"; status=$?; set -e',
+        'if [ "${finished_pid:-}" != "$runtime_pid" ]; then status=1; fi',
+        'kill -TERM "$runtime_pid" 2>/dev/null || true',
+        "for child in \"${relay_pid:-}\" \"${broker_pid:-}\" \"${launcher_pid:-}\"; do [ -z \"$child\" ] || { kill -TERM \"$child\" 2>/dev/null || true; wait \"$child\" 2>/dev/null || true; }; done",
+        'wait "$runtime_pid" 2>/dev/null || true',
+        "exit \"$status\""
+    ].join("\n") + "\n";
+};

package/dist/compiler/containerEntrypointRender.d.ts

@@ -1,14 +1,21 @@
 import type { RuntimeTargetPlan } from "./containerArtifactsTypes.js";
 import type { MoltnetArtifacts } from "./moltnetArtifacts.js";
+import { type BackedMountRequirement } from "./containerBackedMountRender.js";
 export interface EntrypointOptions {
     hasMoltnet?: boolean;
     hasStagedMoltnetBinaries?: boolean;
+    hasWorkspaceBundles?: boolean;
     moltnet?: {
         externalParticipantArtifacts?: NonNullable<MoltnetArtifacts["externalParticipantArtifacts"]>;
         nodePlans: MoltnetArtifacts["nodePlans"];
         serverPlans: MoltnetArtifacts["serverPlans"];
     };
     moltnetPublishedPorts?: number[];
+    /**
+     * Durable mounts this image requires a launcher to attach. Drives the
+     * fail-closed `require_backed_mount` guard; see containerBackedMountRender.ts.
+     */
+    persistentMounts?: readonly BackedMountRequirement[];
     persistentMountPaths?: string[];
 }
 export declare const renderEntrypoint: (runtimePlans: RuntimeTargetPlan[], requiredSecrets: string[], options?: EntrypointOptions) => string;