spawnfile 0.1.3 → 0.1.5

package/dist/manifest/teamNetworkSchemas.js

@@ -0,0 +1,295 @@
+import { z } from "zod";
+export { teamWorkspaceDocsSchema, teamWorkspaceSchema } from "./workspaceSchemas.js";
+const moltnetScopeSchema = z.enum(["observe", "write", "admin", "attach", "pair"]);
+const countTruthy = (value) => value.filter((entry) => Boolean(entry)).length;
+const teamNetworkAuthTokenSchema = z
+    .object({
+    agents: z.array(z.string().trim().min(1)).optional(),
+    id: z.string().trim().min(1),
+    secret: z.string().trim().min(1),
+    scopes: z.array(moltnetScopeSchema).min(1)
+})
+    .strict();
+const teamNetworkAuthClientSchema = z
+    .object({
+    static_token: z.boolean().optional(),
+    token_env: z.string().trim().min(1).optional(),
+    token_id: z.string().trim().min(1).optional(),
+    token_path: z.string().trim().min(1).optional()
+})
+    .strict()
+    .superRefine((value, context) => {
+    const tokenSourceCount = countTruthy([value.token_id, value.token_env, value.token_path]);
+    if (tokenSourceCount > 1) {
+        context.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "auth.client must declare exactly one of token_id, token_env, or token_path"
+        });
+    }
+    if (value.static_token === true && tokenSourceCount === 0) {
+        context.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "auth.client.static_token requires exactly one token source"
+        });
+    }
+});
+const teamNetworkAuthSchema = z
+    .object({
+    client: teamNetworkAuthClientSchema.optional(),
+    mode: z.enum(["none", "bearer", "open"]),
+    tokens: z.array(teamNetworkAuthTokenSchema).optional()
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.mode === "none") {
+        if (value.tokens && value.tokens.length > 0) {
+            context.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: "auth.mode none must not declare tokens"
+            });
+        }
+        if (value.client) {
+            context.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: "auth.mode none must not declare client"
+            });
+        }
+        return;
+    }
+    if (value.mode === "bearer" && !value.client) {
+        context.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "auth.mode bearer requires auth.client"
+        });
+    }
+    if (value.mode === "open" && value.client) {
+        const tokenSourceCount = countTruthy([
+            value.client.token_id,
+            value.client.token_env,
+            value.client.token_path
+        ]);
+        if (value.client.static_token !== true) {
+            context.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: "open auth with auth.client requires static_token: true"
+            });
+        }
+        if (tokenSourceCount === 0) {
+            context.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: "open auth with auth.client requires exactly one token source"
+            });
+        }
+    }
+    if (value.tokens) {
+        const tokenIds = value.tokens.map((token) => token.id);
+        if (new Set(tokenIds).size !== tokenIds.length) {
+            context.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: "auth.tokens ids must be unique"
+            });
+        }
+    }
+});
+const teamNetworkStoreSqliteSchema = z
+    .object({
+    kind: z.literal("sqlite"),
+    path: z.string().trim().min(1)
+})
+    .strict();
+const teamNetworkStoreJsonSchema = z
+    .object({
+    kind: z.literal("json"),
+    path: z.string().trim().min(1)
+})
+    .strict();
+const teamNetworkStorePostgresSchema = z
+    .object({
+    kind: z.literal("postgres"),
+    dsn_secret: z.string().trim().min(1)
+})
+    .strict();
+const teamNetworkStoreMemorySchema = z.object({ kind: z.literal("memory") }).strict();
+const teamNetworkStoreSchema = z.discriminatedUnion("kind", [
+    teamNetworkStoreSqliteSchema,
+    teamNetworkStoreJsonSchema,
+    teamNetworkStorePostgresSchema,
+    teamNetworkStoreMemorySchema
+]);
+const teamNetworkListenSchema = z
+    .object({
+    bind: z
+        .string()
+        .trim()
+        .min(1)
+        .superRefine((value, context) => {
+        if (value.startsWith("[") || value.endsWith("]") || /\[.*\]/.test(value)) {
+            context.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: "listen.bind must be unbracketed"
+            });
+        }
+    }),
+    port: z.number().int().min(1).max(65535)
+})
+    .strict();
+const teamNetworkPairingSchema = z
+    .object({
+    id: z.string().trim().min(1),
+    remote_base_url: z.string().trim().min(1),
+    remote_network_id: z.string().trim().min(1),
+    remote_network_name: z.string().trim().min(1),
+    token_secret: z.string().trim().min(1)
+})
+    .strict();
+const teamNetworkManagedServerSchema = z
+    .object({
+    allowed_origins: z.array(z.string().trim().min(1)).optional(),
+    auth: teamNetworkAuthSchema,
+    direct_messages: z.boolean().optional(),
+    human_ingress: z.boolean().optional(),
+    listen: teamNetworkListenSchema,
+    mode: z.literal("managed"),
+    pairings: z.array(teamNetworkPairingSchema).optional(),
+    store: teamNetworkStoreSchema,
+    trust_forwarded_proto: z.boolean().optional(),
+    url: z.string().trim().optional()
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.auth.mode === "bearer") {
+        if (!value.auth.tokens || value.auth.tokens.length === 0) {
+            context.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: "managed server with auth.mode bearer requires at least one auth token"
+            });
+        }
+        if (!value.auth.client?.token_id) {
+            context.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: "managed bearer auth requires auth.client.token_id"
+            });
+        }
+        if (value.auth.client?.token_env || value.auth.client?.token_path) {
+            context.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: "managed bearer auth requires auth.client.token_id"
+            });
+        }
+        if (value.auth.client?.token_id && value.auth.tokens) {
+            const tokenById = new Map(value.auth.tokens.map((token) => [token.id, token]));
+            const selected = tokenById.get(value.auth.client.token_id);
+            if (!selected) {
+                context.addIssue({
+                    code: z.ZodIssueCode.custom,
+                    message: `managed bearer auth references unknown token: ${value.auth.client.token_id}`
+                });
+            }
+            else if (!(selected.scopes.includes("attach") && selected.scopes.includes("write"))) {
+                context.addIssue({
+                    code: z.ZodIssueCode.custom,
+                    message: "managed bearer auth.client.token_id must reference a token with attach and write scopes"
+                });
+            }
+        }
+    }
+    if (value.auth.mode === "open" && value.auth.client) {
+        if (!value.auth.client.token_id) {
+            context.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: "managed open auth requires auth.client.token_id"
+            });
+        }
+        if (value.auth.client.token_env || value.auth.client.token_path) {
+            context.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: "managed open auth client token source must be token_id"
+            });
+        }
+    }
+});
+const teamNetworkExternalServerSchema = z
+    .object({
+    auth: teamNetworkAuthSchema,
+    mode: z.literal("external"),
+    url: z.string().trim().min(1)
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.auth.tokens && value.auth.tokens.length > 0) {
+        context.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "external server does not accept auth.tokens"
+        });
+    }
+    if (value.auth.mode === "none" && value.auth.client) {
+        context.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "auth.mode none must not declare client"
+        });
+    }
+    if (!value.auth.client) {
+        return;
+    }
+    if (value.auth.client.token_id) {
+        context.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "auth.client.token_id is only valid for managed servers"
+        });
+    }
+    if (value.auth.mode === "open" && value.auth.client.static_token !== true) {
+        context.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "open auth with auth.client requires static_token: true"
+        });
+    }
+    if (value.auth.mode === "open" &&
+        countTruthy([value.auth.client.token_env, value.auth.client.token_path]) !== 1) {
+        context.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "external open auth requires token_env or token_path"
+        });
+    }
+    if (value.auth.mode === "bearer") {
+        const sourceCount = countTruthy([
+            value.auth.client.token_id,
+            value.auth.client.token_env,
+            value.auth.client.token_path
+        ]);
+        if (sourceCount !== 1 || !value.auth.client.token_env && !value.auth.client.token_path) {
+            context.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: "external bearer auth requires exactly one external token source"
+            });
+        }
+    }
+});
+const teamNetworkServerSchema = z.discriminatedUnion("mode", [
+    teamNetworkManagedServerSchema,
+    teamNetworkExternalServerSchema
+]);
+const teamNetworkRoomSchema = z
+    .object({
+    id: z.string().trim().min(1),
+    members: z.array(z.string().trim().min(1)).min(1),
+    name: z.string().trim().min(1).optional()
+})
+    .strict();
+export const teamNetworkSchema = z
+    .object({
+    id: z.string().trim().min(1),
+    name: z.string().trim().min(1).optional(),
+    provider: z.literal("moltnet"),
+    rooms: z.array(teamNetworkRoomSchema).min(1),
+    server: teamNetworkServerSchema
+})
+    .strict()
+    .superRefine((value, context) => {
+    const roomIds = value.rooms.map((room) => room.id);
+    if (new Set(roomIds).size !== roomIds.length) {
+        context.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: `network ${value.id} declares duplicate room ids`
+        });
+    }
+});

package/dist/manifest/workspaceSchemas.d.ts

@@ -0,0 +1,96 @@
+import { z } from "zod";
+export declare const teamWorkspaceDocsSchema: z.ZodObject<{
+    extras: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    heartbeat: z.ZodOptional<z.ZodString>;
+    identity: z.ZodOptional<z.ZodString>;
+    memory: z.ZodOptional<z.ZodString>;
+    soul: z.ZodOptional<z.ZodString>;
+    system: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+declare const teamWorkspaceResourceSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    branch: z.ZodOptional<z.ZodString>;
+    id: z.ZodString;
+    kind: z.ZodLiteral<"git">;
+    mount: z.ZodString;
+    mode: z.ZodEnum<{
+        readonly: "readonly";
+        mutable: "mutable";
+    }>;
+    ref: z.ZodOptional<z.ZodString>;
+    sharing: z.ZodOptional<z.ZodEnum<{
+        per_agent: "per_agent";
+        team: "team";
+    }>>;
+    tag: z.ZodOptional<z.ZodString>;
+    url: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    id: z.ZodString;
+    kind: z.ZodLiteral<"volume">;
+    mount: z.ZodString;
+    mode: z.ZodEnum<{
+        readonly: "readonly";
+        mutable: "mutable";
+    }>;
+    name: z.ZodOptional<z.ZodString>;
+    sharing: z.ZodOptional<z.ZodEnum<{
+        per_agent: "per_agent";
+        team: "team";
+    }>>;
+}, z.core.$strict>], "kind">;
+declare const workspaceSkillReferenceSchema: z.ZodObject<{
+    ref: z.ZodString;
+    requires: z.ZodOptional<z.ZodObject<{
+        mcp: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const teamWorkspaceSchema: z.ZodObject<{
+    docs: z.ZodOptional<z.ZodObject<{
+        extras: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        heartbeat: z.ZodOptional<z.ZodString>;
+        identity: z.ZodOptional<z.ZodString>;
+        memory: z.ZodOptional<z.ZodString>;
+        soul: z.ZodOptional<z.ZodString>;
+        system: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    resources: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        branch: z.ZodOptional<z.ZodString>;
+        id: z.ZodString;
+        kind: z.ZodLiteral<"git">;
+        mount: z.ZodString;
+        mode: z.ZodEnum<{
+            readonly: "readonly";
+            mutable: "mutable";
+        }>;
+        ref: z.ZodOptional<z.ZodString>;
+        sharing: z.ZodOptional<z.ZodEnum<{
+            per_agent: "per_agent";
+            team: "team";
+        }>>;
+        tag: z.ZodOptional<z.ZodString>;
+        url: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        id: z.ZodString;
+        kind: z.ZodLiteral<"volume">;
+        mount: z.ZodString;
+        mode: z.ZodEnum<{
+            readonly: "readonly";
+            mutable: "mutable";
+        }>;
+        name: z.ZodOptional<z.ZodString>;
+        sharing: z.ZodOptional<z.ZodEnum<{
+            per_agent: "per_agent";
+            team: "team";
+        }>>;
+    }, z.core.$strict>], "kind">>>;
+    skills: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        ref: z.ZodString;
+        requires: z.ZodOptional<z.ZodObject<{
+            mcp: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
+export type TeamWorkspace = z.infer<typeof teamWorkspaceSchema>;
+export type TeamWorkspaceDocs = z.infer<typeof teamWorkspaceDocsSchema>;
+export type TeamWorkspaceResource = z.infer<typeof teamWorkspaceResourceSchema>;
+export type TeamWorkspaceSkill = z.infer<typeof workspaceSkillReferenceSchema>;
+export {};

package/dist/manifest/workspaceSchemas.js

@@ -0,0 +1,166 @@
+import { z } from "zod";
+const workspaceResourceModeSchema = z.enum(["mutable", "readonly"]);
+const workspaceResourceSharingSchema = z.enum(["per_agent", "team"]);
+export const teamWorkspaceDocsSchema = z
+    .object({
+    extras: z.record(z.string(), z.string()).optional(),
+    heartbeat: z.string().min(1).optional(),
+    identity: z.string().min(1).optional(),
+    memory: z.string().min(1).optional(),
+    soul: z.string().min(1).optional(),
+    system: z.string().min(1).optional()
+})
+    .strict();
+const normalizeMount = (value) => {
+    const trimmed = value.trim();
+    const workspaceRelative = trimmed.startsWith("${workspace}/")
+        ? `./${trimmed.slice("${workspace}/".length)}`
+        : trimmed;
+    const collapsed = workspaceRelative.replace(/\/+/g, "/");
+    if (collapsed.startsWith("./")) {
+        const relativePath = collapsed.slice(2).replace(/\/+$/u, "");
+        return `./${relativePath}`;
+    }
+    return collapsed.length > 1 ? collapsed.replace(/\/+$/u, "") : "/";
+};
+const mountHasParentSegment = (value) => value.split("/").some((segment) => segment === "..");
+const resourceMountSchema = z
+    .string()
+    .trim()
+    .min(1)
+    .superRefine((value, context) => {
+    const normalized = normalizeMount(value);
+    if (mountHasParentSegment(normalized)) {
+        context.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "mount must not contain parent path segments"
+        });
+    }
+    if (normalized === "." || normalized === "./" || normalized === "${workspace}") {
+        context.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "mount must point inside the workspace, not at the workspace root"
+        });
+    }
+    if (!normalized.startsWith("/") &&
+        !normalized.startsWith("./") &&
+        !normalized.startsWith("${workspace}/")) {
+        context.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "mount must be an absolute POSIX path, ./ workspace path, or ${workspace}/ path"
+        });
+    }
+});
+const teamWorkspaceResourceGitSchema = z
+    .object({
+    branch: z.string().trim().optional(),
+    id: z.string().trim().min(1),
+    kind: z.literal("git"),
+    mount: resourceMountSchema,
+    mode: workspaceResourceModeSchema,
+    ref: z.string().trim().optional(),
+    sharing: workspaceResourceSharingSchema.optional(),
+    tag: z.string().trim().optional(),
+    url: z.string().trim().min(1)
+})
+    .strict()
+    .superRefine((value, context) => {
+    const selectors = [value.branch, value.tag, value.ref].filter(Boolean).length;
+    if (selectors > 1) {
+        context.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "git resources may declare at most one of branch, tag, or ref"
+        });
+    }
+    if (value.sharing === "team") {
+        context.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "git resources do not support team sharing"
+        });
+    }
+});
+const teamWorkspaceResourceVolumeSchema = z
+    .object({
+    id: z.string().trim().min(1),
+    kind: z.literal("volume"),
+    mount: resourceMountSchema,
+    mode: workspaceResourceModeSchema,
+    name: z.string().trim().optional(),
+    sharing: workspaceResourceSharingSchema.optional()
+})
+    .strict();
+const teamWorkspaceResourceSchema = z.discriminatedUnion("kind", [
+    teamWorkspaceResourceGitSchema,
+    teamWorkspaceResourceVolumeSchema
+]);
+const workspaceSkillRequirementSchema = z
+    .object({
+    mcp: z.array(z.string()).optional()
+})
+    .strict();
+const workspaceSkillReferenceSchema = z
+    .object({
+    ref: z.string(),
+    requires: workspaceSkillRequirementSchema.optional()
+})
+    .strict();
+export const teamWorkspaceSchema = z
+    .object({
+    docs: teamWorkspaceDocsSchema.optional(),
+    resources: z.array(teamWorkspaceResourceSchema).optional(),
+    skills: z.array(workspaceSkillReferenceSchema).optional()
+})
+    .strict()
+    .superRefine((value, context) => {
+    const resources = value.resources;
+    if (!resources || resources.length === 0) {
+        return;
+    }
+    const normalizeResourceIdentity = (resource) => {
+        if (resource.kind === "git") {
+            return JSON.stringify({
+                branch: resource.branch?.trim() ?? "",
+                kind: "git",
+                mode: resource.mode,
+                mount: normalizeMount(resource.mount),
+                ref: resource.ref?.trim() ?? "",
+                sharing: resource.sharing ?? "per_agent",
+                tag: resource.tag?.trim() ?? "",
+                url: resource.url
+            });
+        }
+        return JSON.stringify({
+            kind: "volume",
+            mode: resource.mode,
+            mount: normalizeMount(resource.mount),
+            name: resource.name?.trim() ?? "",
+            sharing: resource.sharing ?? "per_agent"
+        });
+    };
+    for (let leftIndex = 0; leftIndex < resources.length; leftIndex += 1) {
+        const leftResource = resources[leftIndex];
+        const leftNormalizedIdentity = normalizeResourceIdentity(leftResource);
+        const leftMount = normalizeMount(leftResource.mount);
+        for (let rightIndex = leftIndex + 1; rightIndex < resources.length; rightIndex += 1) {
+            const rightResource = resources[rightIndex];
+            const rightNormalizedIdentity = normalizeResourceIdentity(rightResource);
+            const rightMount = normalizeMount(rightResource.mount);
+            if (leftResource.id === rightResource.id && leftNormalizedIdentity !== rightNormalizedIdentity) {
+                context.addIssue({
+                    code: z.ZodIssueCode.custom,
+                    message: `resource id ${leftResource.id} must use identical resource declarations`
+                });
+            }
+            if (leftMount === rightMount ||
+                leftMount.startsWith(`${rightMount}/`) ||
+                rightMount.startsWith(`${leftMount}/`)) {
+                if (leftResource.id !== rightResource.id) {
+                    context.addIssue({
+                        code: z.ZodIssueCode.custom,
+                        message: `resources ${leftResource.id} and ${rightResource.id} use overlapping mounts`
+                    });
+                }
+            }
+        }
+    }
+});

package/dist/report/types.d.ts

@@ -18,6 +18,15 @@ export interface ContainerRuntimeInstanceReport {
     model_secrets_required: string[];
     runtime: string;
 }
+export interface ContainerWorkspaceResourceReport {
+    backing_path: string;
+    id: string;
+    kind: "git" | "volume";
+    link_path: string;
+    mode: "mutable" | "readonly";
+    mount: string;
+    sharing: "per_agent" | "team";
+}
 export interface NodeReport {
     capabilities: CapabilityReport[];
     diagnostics: DiagnosticReport[];
@@ -40,6 +49,7 @@ export interface ContainerReport {
     runtime_secrets_required: string[];
     runtimes_installed: string[];
     secrets_required: string[];
+    workspace_resources?: ContainerWorkspaceResourceReport[];
 }
 export interface CompileReport {
     container?: ContainerReport;

package/dist/runtime/common.d.ts

@@ -8,6 +8,7 @@ export declare const createSkillFiles: (baseDirectory: string, skills: ResolvedS
 export declare const createAgentCapabilities: (node: ResolvedAgentNode, options?: {
     mcpOutcome?: CapabilityReport["outcome"];
     sandboxOutcome?: CapabilityReport["outcome"];
+    scheduleMessage?: string;
+    scheduleOutcome?: CapabilityReport["outcome"];
     subagentOutcome?: CapabilityReport["outcome"];
-    workspaceOutcome?: CapabilityReport["outcome"];
 }) => CapabilityReport[];

package/dist/runtime/common.js

@@ -38,12 +38,12 @@ export const createAgentCapabilities = (node, options = {}) => {
     if (node.execution?.model) {
         capabilities.push(createCapability("execution.model", "supported"));
     }
-    if (node.execution?.workspace) {
-        capabilities.push(createCapability("execution.workspace", options.workspaceOutcome ?? "supported"));
-    }
     if (node.execution?.sandbox) {
         capabilities.push(createCapability("execution.sandbox", options.sandboxOutcome ?? "supported"));
     }
+    if (node.schedule) {
+        capabilities.push(createCapability("agent.schedule", options.scheduleOutcome ?? "degraded", options.scheduleMessage ?? "Schedule intent is validated but no runtime scheduler is emitted yet"));
+    }
     if (node.surfaces?.discord) {
         capabilities.push(createCapability("surfaces.discord", "supported"));
     }

package/dist/runtime/picoclaw/adapter.js

@@ -47,6 +47,13 @@ const buildModelList = (node) => {
                 model_name: target.name
             };
         }
+        if (target.provider === "openai" && target.auth.method === "codex") {
+            return {
+                model: `codex-cli/${target.name}`,
+                model_name: target.name,
+                workspace: "<workspace-path>"
+            };
+        }
         return {
             ...(target.auth.method === "api_key"
                 ? {