spawnfile 0.1.14 → 0.1.18

package/dist/compiler/containerEntrypointRender.js

@@ -5,6 +5,9 @@ import { createWorkspaceResourceCommands, createWorkspaceResourceShellFunctions
 import { createConfigEnvMaterializationFunction, createConfigEnvWrites } from "./containerConfigEnvRender.js";
 import { CLI_CREDENTIAL_SECRET_NAME, modelAuthMethodNeedsCliCredential } from "./modelEnv.js";
 import { createCliCredentialMaterialization, createRecipeEnvAssignments, mergeRecipeEnv, shellQuote } from "./containerEntrypointShell.js";
+import { MOLTNET_READINESS_DIRECTORY } from "./containerReadinessPaths.js";
+import { createRuntimeReadinessWait } from "./containerRuntimeReadinessRender.js";
+import { createBackedMountGuard } from "./containerBackedMountRender.js";
 const MOLTNET_SERVER_DATA_DIRECTORY = "/var/lib/spawnfile/moltnet/servers";
 // moltnet reads this path from MOLTNET_CAUSAL_EVENTS_PATH
 // (internal/app/config_load.go's mergeEnvConfig) and, when set, stamps
@@ -59,28 +62,13 @@ const resolveStartCommand = (plan) => plan.meta.startCommand
     .map((token) => token
     .replaceAll("<config-path>", plan.instancePaths.configPath)
     .replaceAll("<home-path>", plan.instancePaths.homePath ?? "")
+    .replaceAll("<instance-root>", plan.instancePaths.instanceRoot ?? "")
     .replaceAll("<runtime-root>", plan.runtimeRoot)
     .replaceAll("<workspace-path>", plan.instancePaths.workspacePath)
     .replaceAll("<port>", plan.port ? String(plan.port) : ""))
     .filter((token) => token.length > 0);
-const createRuntimeReadinessWait = (plan) => {
-    if (!["openclaw", "pi"].includes(plan.runtimeName) || !plan.port) {
-        return [];
-    }
-    return [
-        "attempts=0",
-        `until curl -sf ${shellQuote(`http://127.0.0.1:${plan.port}/healthz`)} >/dev/null; do`,
-        "  attempts=$((attempts + 1))",
-        '  if [ "$attempts" -ge 180 ]; then',
-        `    echo ${shellQuote(`Timed out waiting for ${plan.runtimeName} on port ${plan.port}`)} >&2`,
-        "    exit 1",
-        "  fi",
-        "  sleep 1",
-        "done",
-        ""
-    ];
-};
 export const renderEntrypoint = (runtimePlans, requiredSecrets, options = {}) => {
+    const usesDaimonRuntime = runtimePlans.some((plan) => plan.runtimeName === "daimon");
     const cliCredentialMaterialization = createCliCredentialMaterialization(runtimePlans);
     const renderedRequiredSecrets = [
         ...new Set([
@@ -91,7 +79,19 @@ export const renderEntrypoint = (runtimePlans, requiredSecrets, options = {}) =>
     const lines = [
         "#!/usr/bin/env bash",
         "set -euo pipefail",
+        ...(usesDaimonRuntime ? [
+            'if [ "$#" -ne 3 ] || [ "$1" != "--spawnfile-runtime-identity" ]; then echo "Missing trusted Daimon runtime identity" >&2; exit 1; fi',
+            'volume_bootstrap_uid="$2"',
+            'volume_bootstrap_gid="$3"',
+            'if ! [[ "$volume_bootstrap_uid" =~ ^[1-9][0-9]{0,9}$ ]] || [ "$volume_bootstrap_uid" -gt 2147483647 ]; then echo "Invalid trusted Daimon runtime UID" >&2; exit 1; fi',
+            'if ! [[ "$volume_bootstrap_gid" =~ ^[1-9][0-9]{0,9}$ ]] || [ "$volume_bootstrap_gid" -gt 2147483647 ]; then echo "Invalid trusted Daimon runtime GID" >&2; exit 1; fi',
+            "shift 3"
+        ] : [
+            "volume_bootstrap_uid=1001",
+            "volume_bootstrap_gid=1001"
+        ]),
         "",
+        ...createBackedMountGuard(options.persistentMounts ?? []),
         "require_env() {",
         '  local name=\"$1\"',
         '  if [ -z \"${!name:-}\" ]; then',
@@ -143,6 +143,11 @@ export const renderEntrypoint = (runtimePlans, requiredSecrets, options = {}) =>
         return `${lines.join("\n").trimEnd()}\n`;
     }
     lines.push("PIDS=()", "", "terminate_children() {", '  for pid in "${PIDS[@]:-}"; do', '    kill "$pid" 2>/dev/null || true', "  done", "}", "", "trap terminate_children INT TERM EXIT", "");
+    for (const receiptDirectory of [...new Set(moltnetNodePlans.flatMap((plan) => plan.receiptStorePath ? [path.posix.dirname(plan.receiptStorePath)] : []))].sort()) {
+        lines.push(`install -d -m 700 ${shellQuote(receiptDirectory)}`);
+    }
+    if (moltnetNodePlans.some((plan) => plan.receiptStorePath))
+        lines.push("");
     const recipeEnvAssignments = createRecipeEnvAssignments(mergeRecipeEnv(runtimePlans));
     const recipeEnvPrefix = recipeEnvAssignments.length > 0 ? `${recipeEnvAssignments.join(" ")} ` : "";
     const managedMoltnetServerPlans = moltnetServerPlans.filter((serverPlan) => serverPlan.mode === "managed");
@@ -159,9 +164,9 @@ export const renderEntrypoint = (runtimePlans, requiredSecrets, options = {}) =>
             serverLines.push(`apply_json_env_value ${shellQuote(serverPlan.configPath)} ${shellQuote(patch.envName)} ${shellQuote(patch.jsonPath)}`);
         }
         const causalEventsPath = moltnetCausalEventsPath(serverPlan.configPath);
-        serverLines.push(...createMoltnetStorePrepareCommands(serverPlan), `MOLTNET_CONFIG=${shellQuote(serverPlan.configPath)} MOLTNET_CAUSAL_EVENTS_PATH=${shellQuote(causalEventsPath)} ${recipeEnvPrefix}/usr/local/bin/moltnet &`, 'PIDS+=("$!")');
+        serverLines.push(...createMoltnetStorePrepareCommands(serverPlan), `MOLTNET_CONFIG=${shellQuote(serverPlan.configPath)} MOLTNET_CAUSAL_EVENTS_PATH=${shellQuote(causalEventsPath)} ${recipeEnvPrefix}/usr/local/bin/moltnet start --config ${shellQuote(serverPlan.configPath)} &`, 'moltnet_server_pid="$!"', 'PIDS+=("$moltnet_server_pid")');
         if (serverPlan.port) {
-            serverLines.push(`until curl -sf ${shellQuote(`http://127.0.0.1:${serverPlan.port}/healthz`)} >/dev/null; do sleep 1; done`);
+            serverLines.push(`until curl -sf ${shellQuote(`http://127.0.0.1:${serverPlan.port}/healthz`)} >/dev/null; do if ! kill -0 "$moltnet_server_pid" 2>/dev/null; then wait "$moltnet_server_pid" || true; echo ${shellQuote(`Moltnet exited before readiness on port ${serverPlan.port}`)} >&2; exit 1; fi; sleep 1; done`);
         }
         const externalParticipants = moltnetExternalParticipants.filter((artifact) => artifact.network.id === serverPlan.networkId);
         if (externalParticipants.length > 0) {
@@ -189,14 +194,15 @@ export const renderEntrypoint = (runtimePlans, requiredSecrets, options = {}) =>
     for (const plan of runtimePlans) {
         const commandTokens = resolveStartCommand(plan);
         const envAssignments = createEnvironmentAssignments(plan);
-        lines.push(`mkdir -p ${shellQuote(plan.instancePaths.workspacePath)}`, ...createWorkspaceResourceCommands(plan), `require_file ${shellQuote(plan.instancePaths.configPath)}`, ...createEnvFileWrites(plan), ...createConfigEnvWrites(plan), `${envAssignments.join(" ")} ${commandTokens.map(shellQuote).join(" ")} &`, 'PIDS+=("$!")', "", ...createRuntimeReadinessWait(plan));
+        lines.push(`mkdir -p ${shellQuote(plan.instancePaths.workspacePath)}`, ...createWorkspaceResourceCommands(plan), `require_file ${shellQuote(plan.instancePaths.configPath)}`, ...createEnvFileWrites(plan), ...createConfigEnvWrites(plan), `${envAssignments.join(" ")} ${commandTokens.map(shellQuote).join(" ")} &`, 'runtime_pid="$!"', 'PIDS+=("$runtime_pid")', "", ...createRuntimeReadinessWait(plan, "runtime_pid"));
     }
     for (const nodePlan of moltnetNodePlans) {
         const urlEnv = networkUrlEnvName(nodePlan.networkId);
+        const receiptPath = `${MOLTNET_READINESS_DIRECTORY}/${nodePlan.networkId}-${nodePlan.memberId}.json`;
         lines.push(
         // Rebind the bridge endpoint when an external network URL is provided.
-        `if [ -n "\${${urlEnv}:-}" ]; then`, `  apply_json_env_value ${shellQuote(nodePlan.configPath)} ${shellQuote(urlEnv)} ${shellQuote("moltnet.base_url")}`, "fi", `${recipeEnvPrefix}/usr/local/bin/moltnet node ${shellQuote(nodePlan.configPath)} &`, 'PIDS+=("$!")', "");
+        `if [ -n "\${${urlEnv}:-}" ]; then`, `  apply_json_env_value ${shellQuote(nodePlan.configPath)} ${shellQuote(urlEnv)} ${shellQuote("moltnet.base_url")}`, "fi", `install -d -m 700 ${shellQuote(path.posix.dirname(receiptPath))}`, `rm -f ${shellQuote(receiptPath)}`, `MOLTNET_NODE_READINESS_RECEIPT=${shellQuote(receiptPath)} ${recipeEnvPrefix}/usr/local/bin/moltnet node ${shellQuote(nodePlan.configPath)} &`, 'PIDS+=("$!")', "");
     }
-    lines.push('if [ "${#PIDS[@]}" -eq 0 ]; then', '  echo "No runtime targets were generated for this compile output" >&2', "  exit 1", "fi", "", "status=0", 'for pid in "${PIDS[@]}"; do', '  if ! wait "$pid"; then', "    status=1", "  fi", "done", "", 'exit "$status"');
+    lines.push('if [ "${#PIDS[@]}" -eq 0 ]; then', '  echo "No runtime targets were generated for this compile output" >&2', "  exit 1", "fi", "", "# Every child is critical. Exit on the first child termination so Docker", "# can restart the complete, mutually consistent organization unit.", "set +e", 'wait -n "${PIDS[@]}"', "status=$?", "set -e", "terminate_children", 'for pid in "${PIDS[@]}"; do wait "$pid" 2>/dev/null || true; done', 'if [ "$status" -eq 0 ]; then status=1; fi', 'exit "$status"');
     return `${lines.join("\n").trimEnd()}\n`;
 };

package/dist/compiler/containerPersistentMounts.d.ts

@@ -0,0 +1,30 @@
+import type { ContainerPersistentMountReport } from "../report/types.js";
+/**
+ * Merges every durable-mount source into one report list.
+ *
+ * Sources are independent (memory banks, workspace `kind: volume` resources,
+ * Daimon telemetry, runtime-declared mounts, Moltnet stores and token
+ * directories) and may legitimately name the same mount twice; two sources
+ * describing one id DIFFERENTLY is a compile error, as is two ids claiming one
+ * host volume name.
+ */
+export declare const mergePersistentMounts: (candidates: readonly ContainerPersistentMountReport[]) => ContainerPersistentMountReport[];
+/**
+ * Durable mount names come from four independent sources — memory banks
+ * (`memoryArtifacts.ts`), workspace `kind: volume` resources
+ * (`containerTargetResources.ts`), Moltnet stores and token directories
+ * (`moltnetArtifacts.ts`), and runtime-declared mounts (`runtimePlans`) —
+ * and each source only ever checked itself.
+ *
+ * Author-declared names cross those boundaries. A resource with
+ * `name: X` and a managed Moltnet store with `persistence.name: X` used to
+ * compile to two mounts at two different paths carrying one `volume_name`, so
+ * `spawnfile run` mounted a single host volume at both. A sqlite store and a
+ * team's edition state then shared one directory, where their bootstrap-marker
+ * and replacement-sentinel protocols contradict each other.
+ *
+ * There is no safe interpretation of that declaration, so it fails at compile
+ * naming both sides. (Two mounts legitimately SHARE a name only when they are
+ * the same mount, which the id-keyed merge upstream has already collapsed.)
+ */
+export declare const assertPersistentMountVolumeNamesAreUnique: (mounts: readonly ContainerPersistentMountReport[]) => void;

package/dist/compiler/containerPersistentMounts.js

@@ -0,0 +1,66 @@
+import { SpawnfileError } from "../shared/index.js";
+/**
+ * Merges every durable-mount source into one report list.
+ *
+ * Sources are independent (memory banks, workspace `kind: volume` resources,
+ * Daimon telemetry, runtime-declared mounts, Moltnet stores and token
+ * directories) and may legitimately name the same mount twice; two sources
+ * describing one id DIFFERENTLY is a compile error, as is two ids claiming one
+ * host volume name.
+ */
+export const mergePersistentMounts = (candidates) => {
+    const byId = new Map();
+    const merged = [...candidates]
+        .sort((left, right) => left.id.localeCompare(right.id))
+        .filter((mount) => {
+        const existing = byId.get(mount.id);
+        if (!existing) {
+            byId.set(mount.id, mount);
+            return true;
+        }
+        if (existing.mount_path !== mount.mount_path ||
+            existing.volume_name !== mount.volume_name ||
+            existing.reason !== mount.reason ||
+            existing.lifecycle !== mount.lifecycle) {
+            throw new SpawnfileError("validation_error", `Container persistent mount ${mount.id} resolves to conflicting targets`);
+        }
+        // Deliberately kept, not deduplicated: two sources describing one mount
+        // identically was already reported twice before this merge was extracted,
+        // and silently changing that is not this fix's business.
+        return true;
+    });
+    assertPersistentMountVolumeNamesAreUnique(merged);
+    return merged;
+};
+/**
+ * Durable mount names come from four independent sources — memory banks
+ * (`memoryArtifacts.ts`), workspace `kind: volume` resources
+ * (`containerTargetResources.ts`), Moltnet stores and token directories
+ * (`moltnetArtifacts.ts`), and runtime-declared mounts (`runtimePlans`) —
+ * and each source only ever checked itself.
+ *
+ * Author-declared names cross those boundaries. A resource with
+ * `name: X` and a managed Moltnet store with `persistence.name: X` used to
+ * compile to two mounts at two different paths carrying one `volume_name`, so
+ * `spawnfile run` mounted a single host volume at both. A sqlite store and a
+ * team's edition state then shared one directory, where their bootstrap-marker
+ * and replacement-sentinel protocols contradict each other.
+ *
+ * There is no safe interpretation of that declaration, so it fails at compile
+ * naming both sides. (Two mounts legitimately SHARE a name only when they are
+ * the same mount, which the id-keyed merge upstream has already collapsed.)
+ */
+export const assertPersistentMountVolumeNamesAreUnique = (mounts) => {
+    const byVolumeName = new Map();
+    for (const mount of mounts) {
+        const existing = byVolumeName.get(mount.volume_name);
+        if (existing && existing.mount_path !== mount.mount_path) {
+            throw new SpawnfileError("validation_error", `Durable volume name "${mount.volume_name}" is claimed by two different mounts: `
+                + `${existing.id} (${existing.reason}) at ${existing.mount_path}, and `
+                + `${mount.id} (${mount.reason}) at ${mount.mount_path}. `
+                + "One host volume cannot back two container paths; give each declaration its own name.");
+        }
+        if (!existing)
+            byVolumeName.set(mount.volume_name, mount);
+    }
+};

package/dist/compiler/containerReadinessPaths.d.ts

@@ -0,0 +1 @@
+export declare const MOLTNET_READINESS_DIRECTORY = "/run/spawnfile/moltnet-readiness";

package/dist/compiler/containerReadinessPaths.js

@@ -0,0 +1 @@
+export const MOLTNET_READINESS_DIRECTORY = "/run/spawnfile/moltnet-readiness";

package/dist/compiler/containerRuntimeLinkMaterializer.d.ts

@@ -0,0 +1,2 @@
+export declare const RUNTIME_LINK_MATERIALIZER_PATH = "/opt/spawnfile/materialize-runtime-links.cjs";
+export declare const renderRuntimeLinkMaterializer: () => string;

package/dist/compiler/containerRuntimeLinkMaterializer.js

@@ -0,0 +1,12 @@
+export const RUNTIME_LINK_MATERIALIZER_PATH = "/opt/spawnfile/materialize-runtime-links.cjs";
+export const renderRuntimeLinkMaterializer = () => `"use strict";
+const fs=require("node:fs"),path=require("node:path"),root=path.resolve(process.argv[2]||"");
+if(!root.startsWith("/opt/spawnfile/runtime-installs/"))throw Error("unsafe root");
+const rootInfo=fs.lstatSync(root),links=[];
+if(!rootInfo.isDirectory()||rootInfo.isSymbolicLink()||rootInfo.uid||rootInfo.gid)throw Error("unsafe root identity");
+const walk=d=>{for(const n of fs.readdirSync(d).sort()){const p=path.join(d,n),s=fs.lstatSync(p);if(s.isSymbolicLink())links.push(p);else if(s.isDirectory())walk(p);else if(!s.isFile())throw Error("unsupported entry");}};
+const inside=p=>p.startsWith(root+path.sep);
+const resolve=p=>{let hops=0;for(;;){const rel=path.relative(root,p);if(!rel||rel.startsWith("..")||path.isAbsolute(rel))throw Error("link escape");const parts=rel.split(path.sep);let q=root,again=false;for(let i=0;i<parts.length;i++){q=path.join(q,parts[i]);const s=fs.lstatSync(q);if(!s.isSymbolicLink())continue;if(++hops>16||s.uid||s.gid)throw Error("unsafe link chain");const l=fs.readlinkSync(q);if(path.isAbsolute(l))throw Error("absolute link");p=path.resolve(path.dirname(q),l,...parts.slice(i+1));if(!inside(p))throw Error("link escape");again=true;break;}if(!again)return p;}};
+walk(root);
+for(const link of links){const s=fs.lstatSync(link);if(!s.isSymbolicLink()||s.uid||s.gid)throw Error("link changed");const target=resolve(link),t=fs.lstatSync(target);if(!t.isFile()||t.isSymbolicLink()||t.uid||t.gid||t.dev!==rootInfo.dev||t.nlink<1)throw Error("unsafe target");const b=fs.readFileSync(target);if(b.length>67108864)throw Error("target too large");const tmp=link+".spawnfile-materialize",fd=fs.openSync(tmp,fs.constants.O_CREAT|fs.constants.O_EXCL|fs.constants.O_WRONLY|fs.constants.O_NOFOLLOW,t.mode&0o111?0o555:0o444);try{fs.writeFileSync(fd,b);fs.fsyncSync(fd);}finally{fs.closeSync(fd);}fs.renameSync(tmp,link);}
+`;

package/dist/compiler/containerRuntimeReadinessRender.d.ts

@@ -0,0 +1,7 @@
+import type { RuntimeTargetPlan } from "./containerArtifactsTypes.js";
+/**
+ * Blocks until a runtime with an HTTP port answers /healthz, failing fast if
+ * the child dies first. Split out of containerEntrypointRender.ts to keep that
+ * module under the repository's 400-line ceiling.
+ */
+export declare const createRuntimeReadinessWait: (plan: RuntimeTargetPlan, pidVariable: string) => string[];

package/dist/compiler/containerRuntimeReadinessRender.js

@@ -0,0 +1,40 @@
+import { shellQuote } from "./containerEntrypointShell.js";
+/**
+ * Blocks until a runtime with an HTTP port answers /healthz, failing fast if
+ * the child dies first. Split out of containerEntrypointRender.ts to keep that
+ * module under the repository's 400-line ceiling.
+ */
+export const createRuntimeReadinessWait = (plan, pidVariable) => {
+    if (!plan.port)
+        return [];
+    if (plan.runtimeName === "daimon") {
+        return [
+            "attempts=0",
+            `until curl -sf ${shellQuote(`http://127.0.0.1:${plan.port}/healthz`)} >/dev/null; do`,
+            `  if ! kill -0 "$${pidVariable}" 2>/dev/null; then wait "$${pidVariable}" || true; echo ${shellQuote(`Daimon exited before readiness on port ${plan.port}`)} >&2; exit 1; fi`,
+            "  attempts=$((attempts + 1))",
+            '  if [ "$attempts" -ge 180 ]; then',
+            `    echo ${shellQuote(`Timed out waiting for daimon on port ${plan.port}`)} >&2`,
+            "    exit 1",
+            "  fi",
+            "  sleep 1",
+            "done",
+            ""
+        ];
+    }
+    if (!["openclaw", "pi"].includes(plan.runtimeName))
+        return [];
+    return [
+        "attempts=0",
+        `until curl -sf ${shellQuote(`http://127.0.0.1:${plan.port}/healthz`)} >/dev/null; do`,
+        `  if ! kill -0 "$${pidVariable}" 2>/dev/null; then wait "$${pidVariable}" || true; echo ${shellQuote(`${plan.runtimeName} exited before readiness on port ${plan.port}`)} >&2; exit 1; fi`,
+        "  attempts=$((attempts + 1))",
+        '  if [ "$attempts" -ge 180 ]; then',
+        `    echo ${shellQuote(`Timed out waiting for ${plan.runtimeName} on port ${plan.port}`)} >&2`,
+        "    exit 1",
+        "  fi",
+        "  sleep 1",
+        "done",
+        ""
+    ];
+};

package/dist/compiler/containerStateOwnershipRender.d.ts

@@ -0,0 +1,4 @@
+import type { RuntimeTargetPlan } from "./containerArtifactsTypes.js";
+import type { EntrypointOptions } from "./containerEntrypointRender.js";
+export { VOLUME_BOOTSTRAP_MARKER, VOLUME_BOOTSTRAP_MARKER_CONTENT } from "./containerVolumeBootstrap.js";
+export declare const createStateOwnershipCommand: (runtimePlans: RuntimeTargetPlan[], persistentMountPaths?: string[], moltnet?: EntrypointOptions["moltnet"]) => string;

package/dist/compiler/containerStateOwnershipRender.js

@@ -0,0 +1,75 @@
+import path from "node:path";
+import { SpawnfileError } from "../shared/index.js";
+import { DAIMON_RUNTIME_UID, resolveDaimonUidEntrypointStateRoots } from "./containerDaimonUidEntrypointRender.js";
+import { VOLUME_BOOTSTRAP_MARKER, VOLUME_BOOTSTRAP_MARKER_CONTENT } from "./containerVolumeBootstrap.js";
+export { VOLUME_BOOTSTRAP_MARKER, VOLUME_BOOTSTRAP_MARKER_CONTENT } from "./containerVolumeBootstrap.js";
+const SPAWNFILE_STATE_ROOT = "/var/lib/spawnfile";
+const MOLTNET_STATE_ROOT = `${SPAWNFILE_STATE_ROOT}/moltnet`;
+const shellQuote = (value) => `'${value.replace(/'/g, `'\"'\"'`)}'`;
+const privateDirectoriesThrough = (target) => {
+    const relative = path.posix.relative(SPAWNFILE_STATE_ROOT, target);
+    if (relative.startsWith("../") || path.posix.isAbsolute(relative)) {
+        throw new SpawnfileError("compile_error", `Generated Moltnet state path escapes ${SPAWNFILE_STATE_ROOT}: ${target}`);
+    }
+    const segments = relative === "" ? [] : relative.split("/");
+    return [
+        SPAWNFILE_STATE_ROOT,
+        ...segments.map((_, index) => path.posix.join(SPAWNFILE_STATE_ROOT, ...segments.slice(0, index + 1)))
+    ];
+};
+const createMoltnetPrivacyCommands = (runtimePlans, persistentMountPaths, moltnet) => {
+    if (!runtimePlans.some((plan) => plan.runtimeName === "daimon") || !moltnet)
+        return [];
+    const configPaths = [
+        ...moltnet.serverPlans.flatMap((plan) => plan.mode === "managed" && plan.configPath ? [plan.configPath] : []),
+        ...moltnet.nodePlans.map((plan) => plan.configPath)
+    ].sort();
+    const receiptDirectories = moltnet.nodePlans.flatMap((plan) => plan.receiptStorePath ? [path.posix.dirname(plan.receiptStorePath)] : []);
+    if (configPaths.length === 0)
+        return [];
+    if (configPaths.some((configPath) => !configPath.startsWith(`${MOLTNET_STATE_ROOT}/`))) {
+        throw new SpawnfileError("compile_error", "Generated Moltnet config paths must stay beneath the private Moltnet state root");
+    }
+    const moltnetMountPaths = persistentMountPaths
+        .filter((mountPath) => mountPath.startsWith(`${MOLTNET_STATE_ROOT}/`));
+    const privateDirectories = [
+        ...new Set([
+            ...configPaths.flatMap((configPath) => privateDirectoriesThrough(path.posix.dirname(configPath))),
+            ...receiptDirectories.flatMap(privateDirectoriesThrough),
+            ...moltnetMountPaths.flatMap(privateDirectoriesThrough)
+        ])
+    ].filter((directory) => directory !== SPAWNFILE_STATE_ROOT).sort();
+    const ownership = `${DAIMON_RUNTIME_UID}:${DAIMON_RUNTIME_UID}`;
+    return [
+        `install -d -o ${DAIMON_RUNTIME_UID} -g ${DAIMON_RUNTIME_UID} -m 700 ${privateDirectories.map(shellQuote).join(" ")}`,
+        `chown root:root ${configPaths.map(shellQuote).join(" ")}`,
+        `chmod 600 ${configPaths.map(shellQuote).join(" ")}`,
+        `chown ${ownership} ${configPaths.map(shellQuote).join(" ")}`
+    ];
+};
+export const createStateOwnershipCommand = (runtimePlans, persistentMountPaths = [], moltnet) => {
+    const mountPaths = [...new Set(persistentMountPaths)].sort();
+    const wrapperStateRoots = runtimePlans.some((plan) => plan.runtimeName === "daimon")
+        ? resolveDaimonUidEntrypointStateRoots(runtimePlans)
+        : [];
+    const mkdirPaths = [...new Set([SPAWNFILE_STATE_ROOT, ...mountPaths])].sort();
+    const markerCommands = mountPaths.map((mountPath) => `printf '%s\\n' ${shellQuote(VOLUME_BOOTSTRAP_MARKER_CONTENT)} > ${shellQuote(path.posix.join(mountPath, VOLUME_BOOTSTRAP_MARKER))} && chmod 600 ${shellQuote(path.posix.join(mountPath, VOLUME_BOOTSTRAP_MARKER))}`);
+    const chownPaths = [
+        ...new Set([
+            ...(runtimePlans.some((plan) => plan.runtimeName === "daimon") ? [] : [SPAWNFILE_STATE_ROOT]),
+            ...mountPaths.filter((mountPath) => !mountPath.startsWith(`${SPAWNFILE_STATE_ROOT}/`))
+        ])
+    ].sort();
+    return [
+        `mkdir -p ${mkdirPaths.map(shellQuote).join(" ")}`,
+        ...markerCommands,
+        ...(chownPaths.length > 0
+            ? [`chown -R spawnfile:spawnfile ${chownPaths.map(shellQuote).join(" ")}`]
+            : []),
+        ...(runtimePlans.some((plan) => plan.runtimeName === "daimon")
+            ? [`chown root:root ${shellQuote(SPAWNFILE_STATE_ROOT)} && chmod 711 ${shellQuote(SPAWNFILE_STATE_ROOT)}`]
+            : []),
+        ...wrapperStateRoots.map((stateRoot) => `install -d -o root -g root -m 700 ${shellQuote(stateRoot)}`),
+        ...createMoltnetPrivacyCommands(runtimePlans, mountPaths, moltnet)
+    ].join(" && ");
+};

package/dist/compiler/containerTargetResources.d.ts

@@ -1,4 +1,35 @@
 import type { ContainerTarget, ContainerTargetInput, RuntimeContainerMeta } from "../runtime/index.js";
 import type { RuntimeTargetPlan } from "./containerArtifactsTypes.js";
 import { type WorkspaceResourcePlan } from "./workspaceResources.js";
-export declare const resolveTargetResources: (target: ContainerTarget, inputs: ContainerTargetInput[], instancePaths: RuntimeTargetPlan["instancePaths"], meta: RuntimeContainerMeta) => WorkspaceResourcePlan[];
+export interface ResolvedTargetResourcePlan extends WorkspaceResourcePlan {
+    canonicalBackingPath: string;
+    ownerId: string;
+    persistentMountId?: string;
+    replacementSentinel?: string;
+    resolvedIdentity: string;
+    volumeName?: string;
+}
+export interface WorkspaceResourcePersistentMount {
+    /** The author's `name`, when declared on the resource. */
+    declared_volume_name?: string;
+    id: string;
+    lifecycle: "exclusive-reattach";
+    mount_path: string;
+    reason: string;
+    volume_name: string;
+}
+export declare const resolveWorkspaceResourceVolumes: (runtimePlans: readonly RuntimeTargetPlan[]) => {
+    resources: ResolvedTargetResourcePlan[];
+    mounts: WorkspaceResourcePersistentMount[];
+};
+/**
+ * One source agent's workspace path inside its runtime target, still in the
+ * target's placeholder vocabulary (`<instance-root>`, `<workspace-path>`),
+ * which container rendering substitutes once the target's instance paths are
+ * known. Mount link paths and MCP `${workspace}` both resolve through here.
+ */
+export declare const expandSourceWorkspacePathTemplate: (meta: RuntimeContainerMeta, source: {
+    agentName: string;
+    slug: string;
+}) => string;
+export declare const resolveTargetResources: (target: ContainerTarget, inputs: ContainerTargetInput[], instancePaths: RuntimeTargetPlan["instancePaths"], meta: RuntimeContainerMeta, planRoot: string, deploymentLineage?: string) => ResolvedTargetResourcePlan[];

package/dist/compiler/containerTargetResources.js

@@ -1,30 +1,79 @@
 import path from "node:path";
+import { createHash } from "node:crypto";
 import { SpawnfileError } from "../shared/index.js";
-import { mergeWorkspaceResourcePlans } from "./workspaceResources.js";
+import { createExclusiveReattachVolumeName } from "../shared/index.js";
+import { mergeWorkspaceResourcePlans, workspaceResourceTargetId } from "./workspaceResources.js";
 const CONFIG_FILE_PLACEHOLDER = "<config-file>";
 const INSTANCE_ROOT_PLACEHOLDER = "<instance-root>";
 const SOURCE_AGENT_PLACEHOLDER = "<agent-name>";
 const SOURCE_SLUG_PLACEHOLDER = "<source-slug>";
-const replaceSourceWorkspacePathTemplate = (template, input, instancePaths, meta) => {
-    const agentName = input.value.kind === "agent" ? input.value.name : input.slug;
+const WORKSPACE_PATH_PLACEHOLDER = "<workspace-path>";
+const digest = (value) => createHash("sha256").update(value).digest("hex");
+export const resolveWorkspaceResourceVolumes = (runtimePlans) => {
+    const resources = runtimePlans.flatMap((runtimePlan) => (runtimePlan.resources ?? []));
+    const byBackingPath = new Map();
+    const backingPathByVolumeName = new Map();
+    for (const resource of resources.filter((candidate) => candidate.kind === "volume")) {
+        const existing = byBackingPath.get(resource.canonicalBackingPath);
+        // Two DIFFERENT declared resources landing on one backing path is always a
+        // mistake: the path segment derives from an explicit `name` when one is
+        // given, so `id: a`/`id: b` both declaring `name: X` in one scope used to
+        // collapse into a single directory and volume, silently, with both
+        // workspace symlinks pointing at it. The same id across runtime plans is
+        // the legitimate `sharing: team` case and still merges.
+        if (existing && existing.id !== resource.id) {
+            throw new SpawnfileError("validation_error", `Workspace resources ${existing.id} and ${resource.id} resolve to the same backing volume ${resource.canonicalBackingPath}; a declared volume name must be unique within its scope`);
+        }
+        if (existing && (existing.mode !== resource.mode || existing.sharing !== resource.sharing || existing.volumeName !== resource.volumeName || (resource.sharing === "per_agent" && existing.ownerId !== resource.ownerId))) {
+            throw new SpawnfileError("validation_error", `Workspace volume ${resource.canonicalBackingPath} has incompatible mode, sharing, or owner declarations`);
+        }
+        const conflictingPath = backingPathByVolumeName.get(resource.volumeName);
+        if (conflictingPath && conflictingPath !== resource.canonicalBackingPath)
+            throw new SpawnfileError("validation_error", "Workspace volume name collision");
+        byBackingPath.set(resource.canonicalBackingPath, resource);
+        backingPathByVolumeName.set(resource.volumeName, resource.canonicalBackingPath);
+    }
+    // Workspace `kind: volume` resources are durable product state: an author
+    // declares one precisely so it outlives the container. They are therefore
+    // `exclusive-reattach` — deployment-stable name, reattached rather than
+    // recreated, one live holder at a time.
+    return { resources, mounts: [...byBackingPath.values()].map((resource) => ({
+            ...(resource.name?.trim() ? { declared_volume_name: resource.name.trim() } : {}),
+            id: resource.persistentMountId, lifecycle: "exclusive-reattach",
+            mount_path: resource.canonicalBackingPath,
+            reason: `Workspace ${resource.sharing} resource ${resource.id}`, volume_name: resource.volumeName
+        })) };
+};
+/**
+ * One source agent's workspace path inside its runtime target, still in the
+ * target's placeholder vocabulary (`<instance-root>`, `<workspace-path>`),
+ * which container rendering substitutes once the target's instance paths are
+ * known. Mount link paths and MCP `${workspace}` both resolve through here.
+ */
+export const expandSourceWorkspacePathTemplate = (meta, source) => meta.instancePaths.sourceWorkspacePathTemplate
+    ? meta.instancePaths.sourceWorkspacePathTemplate
+        .replaceAll(CONFIG_FILE_PLACEHOLDER, meta.configFileName)
+        .replaceAll(SOURCE_AGENT_PLACEHOLDER, source.agentName)
+        .replaceAll(SOURCE_SLUG_PLACEHOLDER, source.slug)
+    : WORKSPACE_PATH_PLACEHOLDER;
+const resolveSourceWorkspacePath = (input, instancePaths, meta) => {
     const instanceRoot = instancePaths.instanceRoot ?? path.posix.dirname(instancePaths.workspacePath);
-    return template
+    return expandSourceWorkspacePathTemplate(meta, {
+        agentName: input.value.kind === "agent" ? input.value.name : input.slug,
+        slug: input.slug
+    })
         .replaceAll(INSTANCE_ROOT_PLACEHOLDER, instanceRoot)
-        .replaceAll(CONFIG_FILE_PLACEHOLDER, meta.configFileName)
-        .replaceAll(SOURCE_AGENT_PLACEHOLDER, agentName)
-        .replaceAll(SOURCE_SLUG_PLACEHOLDER, input.slug);
+        .replaceAll(WORKSPACE_PATH_PLACEHOLDER, instancePaths.workspacePath);
 };
-const resolveSourceWorkspacePath = (input, instancePaths, meta) => meta.instancePaths.sourceWorkspacePathTemplate
-    ? replaceSourceWorkspacePathTemplate(meta.instancePaths.sourceWorkspacePathTemplate, input, instancePaths, meta)
-    : instancePaths.workspacePath;
-const sourceTargetId = (target, input, isMergedTarget) => isMergedTarget ? `${target.id}:${input.id}` : target.id;
 const pathsOverlap = (left, right) => left === right || left.startsWith(`${right}/`) || right.startsWith(`${left}/`);
 const dedupeAndAssertResourcePlans = (target, resources) => {
     const byLinkPath = new Map();
+    const volumesByBackingPath = new Map();
+    const backingPathByVolumeName = new Map();
     for (const resource of resources) {
         const existing = byLinkPath.get(resource.linkPath);
         if (existing) {
-            if (existing.backingPath !== resource.backingPath || existing.id !== resource.id) {
+            if (existing.resolvedIdentity !== resource.resolvedIdentity) {
                 throw new SpawnfileError("validation_error", `Container target ${target.id} declares conflicting workspace resources at ${resource.linkPath}`);
             }
             continue;
@@ -34,22 +83,73 @@ const dedupeAndAssertResourcePlans = (target, resources) => {
             throw new SpawnfileError("validation_error", `Container target ${target.id} declares overlapping workspace resource links ${overlapping.linkPath} and ${resource.linkPath}`);
         }
         byLinkPath.set(resource.linkPath, resource);
+        if (resource.kind !== "volume")
+            continue;
+        const existingVolume = volumesByBackingPath.get(resource.canonicalBackingPath);
+        if (existingVolume && existingVolume.id !== resource.id) {
+            throw new SpawnfileError("validation_error", `Container target ${target.id} declares workspace resources ${existingVolume.id} and ${resource.id} that resolve to the same backing volume ${resource.canonicalBackingPath}; a declared volume name must be unique within its scope`);
+        }
+        if (existingVolume) {
+            const incompatible = existingVolume.mode !== resource.mode ||
+                existingVolume.sharing !== resource.sharing ||
+                existingVolume.volumeName !== resource.volumeName ||
+                (resource.sharing === "per_agent" && existingVolume.ownerId !== resource.ownerId);
+            if (incompatible) {
+                throw new SpawnfileError("validation_error", `Container target ${target.id} declares incompatible workspace volume owners or modes at ${resource.canonicalBackingPath}`);
+            }
+        }
+        else {
+            volumesByBackingPath.set(resource.canonicalBackingPath, resource);
+        }
+        const conflictingBackingPath = backingPathByVolumeName.get(resource.volumeName);
+        if (conflictingBackingPath && conflictingBackingPath !== resource.canonicalBackingPath) {
+            throw new SpawnfileError("validation_error", `Container target ${target.id} workspace volume identity collision`);
+        }
+        backingPathByVolumeName.set(resource.volumeName, resource.canonicalBackingPath);
     }
     return [...byLinkPath.values()].sort((left, right) => left.linkPath.localeCompare(right.linkPath) || left.id.localeCompare(right.id));
 };
-export const resolveTargetResources = (target, inputs, instancePaths, meta) => {
+export const resolveTargetResources = (target, inputs, instancePaths, meta, planRoot, deploymentLineage = "compile") => {
     const sourceIds = new Set(target.sourceIds ?? []);
     if (sourceIds.size === 0) {
         return [];
     }
-    const isMergedTarget = sourceIds.size > 1;
     const resources = inputs.flatMap((input) => {
         if (!sourceIds.has(input.id) || input.value.kind !== "agent") {
             return [];
         }
         return mergeWorkspaceResourcePlans(input.value.workspaceResources ?? [], `${target.id}/${input.id}`, {
-            targetId: sourceTargetId(target, input, isMergedTarget),
+            targetId: workspaceResourceTargetId(target.id, input.id, sourceIds.size),
             workspacePath: resolveSourceWorkspacePath(input, instancePaths, meta)
+        }).map((resource) => {
+            const canonicalBackingPath = path.posix.normalize(resource.backingPath);
+            const ownerId = resource.sharing === "per_agent" ? input.id : canonicalBackingPath;
+            const resolvedIdentity = `sha256:${digest(JSON.stringify({
+                backingPath: canonicalBackingPath,
+                kind: resource.kind,
+                mode: resource.mode,
+                ownerId,
+                ...(resource.kind === "bundle" ? { archivePath: resource.archivePath, sha256: resource.sha256 } : {}),
+                sharing: resource.sharing
+            }))}`;
+            if (resource.kind !== "volume")
+                return { ...resource, backingPath: canonicalBackingPath, canonicalBackingPath, ownerId, resolvedIdentity };
+            const pathDigest = digest(canonicalBackingPath);
+            return {
+                ...resource,
+                backingPath: canonicalBackingPath,
+                canonicalBackingPath,
+                ownerId,
+                persistentMountId: `workspace-resource-${pathDigest.slice(0, 24)}`,
+                replacementSentinel: path.posix.join(canonicalBackingPath, ".spawnfile-resource-identity"),
+                resolvedIdentity,
+                // Author-declared `name` verbatim (an operator can pre-create or
+                // migrate the host volume under exactly that name); otherwise a
+                // deployment-stable derived name. Never run-scoped: a fresh
+                // NOOPOLIS_RUN_ID must not strand the previous run's state.
+                volumeName: resource.name?.trim()
+                    || createExclusiveReattachVolumeName(`${planRoot}\0${deploymentLineage}`, `workspace-resource-${pathDigest.slice(0, 24)}`)
+            };
         });
     });
     return dedupeAndAssertResourcePlans(target, resources);

package/dist/compiler/containerVolumeBootstrap.d.ts

@@ -0,0 +1,3 @@
+export declare const VOLUME_BOOTSTRAP_MARKER = ".spawnfile-volume-init";
+export declare const VOLUME_BOOTSTRAP_CLAIM = ".spawnfile-volume-init.claim";
+export declare const VOLUME_BOOTSTRAP_MARKER_CONTENT = "spawnfile.volume-bootstrap.v1";

package/dist/compiler/containerVolumeBootstrap.js

@@ -0,0 +1,3 @@
+export const VOLUME_BOOTSTRAP_MARKER = ".spawnfile-volume-init";
+export const VOLUME_BOOTSTRAP_CLAIM = `${VOLUME_BOOTSTRAP_MARKER}.claim`;
+export const VOLUME_BOOTSTRAP_MARKER_CONTENT = "spawnfile.volume-bootstrap.v1";