spawnfile 0.1.33 → 0.1.34

package/dist/deployment/privateArtifactsExport.js

@@ -4,7 +4,7 @@ import path from "node:path";
 import { ensureDirectory } from "../filesystem/index.js";
 import { copyContainerFileToHost, } from "./artifactsExportDocker.js";
 const plans = (report) => (report.container?.runtime_instances ?? [])
-    .filter((instance) => (instance.runtime === "pi" || instance.runtime === "daimon")
+    .filter((instance) => instance.runtime === "daimon"
     && instance.home_path !== null)
     .flatMap((instance) => {
     const instanceRoot = path.posix.dirname(instance.home_path);

package/dist/dev/docker.d.ts

@@ -1,4 +1,3 @@
-import { type CompileProjectResult } from "../compiler/index.js";
 import { type DeploymentRecord } from "../deployment/index.js";
 export type DevExecFile = (file: string, args: string[], options: {
     timeout: number;
@@ -9,8 +8,4 @@ export type DevExecFile = (file: string, args: string[], options: {
 export declare const defaultExecFile: DevExecFile;
 export declare const dockerArgsForRecord: (record: DeploymentRecord) => string[];
 export declare const firstContainerName: (record: DeploymentRecord) => string;
-export declare const compileForDevApply: (inputPath: string, outputDirectory: string, record: DeploymentRecord, dockerCommand: string, execFileImpl: DevExecFile) => Promise<CompileProjectResult>;
 export declare const runDocker: (command: string, args: string[], execFileImpl: DevExecFile, timeout?: number) => Promise<string>;
-export declare const copyIntoContainer: (dockerCommand: string, dockerPrefix: string[], source: string, destination: string, execFileImpl: DevExecFile) => Promise<void>;
-export declare const ensureContainerDirectories: (dockerCommand: string, dockerPrefix: string[], containerName: string, paths: string[], execFileImpl: DevExecFile) => Promise<void>;
-export declare const chownContainerPaths: (dockerCommand: string, dockerPrefix: string[], containerName: string, paths: string[], execFileImpl: DevExecFile) => Promise<void>;

package/dist/dev/docker.js

@@ -1,6 +1,5 @@
 import { execFile as execFileCallback } from "node:child_process";
 import { promisify } from "node:util";
-import { compileProject, normalizeDockerArchitecture } from "../compiler/index.js";
 import { dockerContextNameForTarget, dockerHostValueForTarget } from "../deployment/index.js";
 import { SpawnfileError } from "../shared/index.js";
 export const defaultExecFile = promisify(execFileCallback);
@@ -20,52 +19,7 @@ export const firstContainerName = (record) => {
     }
     return name;
 };
-export const compileForDevApply = async (inputPath, outputDirectory, record, dockerCommand, execFileImpl) => {
-    const dockerContext = dockerContextNameForTarget(record.target) ?? undefined;
-    const architecture = dockerContext
-        ? normalizeDockerArchitecture((await execFileImpl(dockerCommand, ["--context", dockerContext, "info", "--format", "{{.Architecture}}"], { timeout: 10_000 })).stdout)
-        : undefined;
-    return compileProject(inputPath, {
-        clean: false,
-        containerArchitecture: architecture,
-        outputDirectory
-    });
-};
 export const runDocker = async (command, args, execFileImpl, timeout = 30_000) => {
     const { stdout } = await execFileImpl(command, args, { timeout });
     return stdout;
 };
-export const copyIntoContainer = async (dockerCommand, dockerPrefix, source, destination, execFileImpl) => {
-    await runDocker(dockerCommand, [...dockerPrefix, "cp", source, destination], execFileImpl, 60_000);
-};
-export const ensureContainerDirectories = async (dockerCommand, dockerPrefix, containerName, paths, execFileImpl) => {
-    if (paths.length === 0) {
-        return;
-    }
-    await runDocker(dockerCommand, [
-        ...dockerPrefix,
-        "exec",
-        "--user",
-        "root",
-        containerName,
-        "mkdir",
-        "-p",
-        ...paths
-    ], execFileImpl);
-};
-export const chownContainerPaths = async (dockerCommand, dockerPrefix, containerName, paths, execFileImpl) => {
-    if (paths.length === 0) {
-        return;
-    }
-    await runDocker(dockerCommand, [
-        ...dockerPrefix,
-        "exec",
-        "--user",
-        "root",
-        containerName,
-        "chown",
-        "-R",
-        "spawnfile:spawnfile",
-        ...paths
-    ], execFileImpl);
-};

package/dist/dev/index.d.ts

@@ -1,2 +1 @@
-export * from "./activity.js";
 export * from "./project.js";

package/dist/dev/index.js

@@ -1,2 +1 @@
-export * from "./activity.js";
 export * from "./project.js";

package/dist/dev/project.d.ts

@@ -1,25 +1,11 @@
 import { type UpProjectOptions, type UpProjectResult } from "../compiler/index.js";
 import { type DeploymentRecord } from "../deployment/index.js";
 import { type DevExecFile } from "./docker.js";
-export declare const PI_CONTROL_URL = "http://127.0.0.1:19690";
 export interface DevProjectOptions {
     deploymentName?: string;
     dockerCommand?: string;
     outputDirectory?: string;
 }
-export interface DevApplyProjectOptions extends DevProjectOptions {
-    agent: string;
-    execFile?: DevExecFile;
-    restart?: boolean;
-}
-export interface DevApplyProjectResult {
-    agentId: string;
-    bridgeStarted: boolean;
-    containerName: string;
-    deploymentName: string;
-    existingAgent: boolean;
-    outputDirectory: string;
-}
 export interface DevStopProjectResult {
     containerName: string;
     deploymentName: string;
@@ -35,8 +21,6 @@ export declare const resolveDevOutputDirectory: (inputPath: string, outputDirect
  */
 export declare const devUpProject: (inputPath: string, options?: UpProjectOptions) => Promise<UpProjectResult>;
 export declare const selectDeploymentRecord: (outputDirectory: string, deploymentName?: string) => Promise<DeploymentRecord>;
-export declare const devApplyProject: (inputPath: string, options: DevApplyProjectOptions) => Promise<DevApplyProjectResult>;
-export declare const devRestartProject: (inputPath: string, options: DevApplyProjectOptions) => Promise<DevApplyProjectResult>;
 export declare const devStopProject: (inputPath: string, options?: DevProjectOptions & {
     execFile?: DevExecFile;
 }) => Promise<DevStopProjectResult>;

package/dist/dev/project.js

@@ -1,12 +1,10 @@
 import path from "node:path";
-import { readFile } from "node:fs/promises";
 import { buildCompilePlan, upProject } from "../compiler/index.js";
 import { listDeploymentRecords, normalizeDeploymentName } from "../deployment/index.js";
 import { SpawnfileError } from "../shared/index.js";
 import { DEV_DEPLOYMENT_LINEAGE_NAMESPACE } from "../compiler/deploymentLineage.js";
-import { chownContainerPaths, compileForDevApply, copyIntoContainer, defaultExecFile, dockerArgsForRecord, ensureContainerDirectories, firstContainerName, runDocker } from "./docker.js";
+import { defaultExecFile, dockerArgsForRecord, firstContainerName, runDocker } from "./docker.js";
 const DEV_OUTPUT_DIRECTORY = ".spawn-dev";
-export const PI_CONTROL_URL = "http://127.0.0.1:19690";
 export const resolveDevOutputDirectory = async (inputPath, outputDirectory) => {
     if (outputDirectory) {
         return path.resolve(outputDirectory);
@@ -45,131 +43,6 @@ export const selectDeploymentRecord = async (outputDirectory, deploymentName) =>
     }
     return records[0].record;
 };
-const readJson = async (filePath) => JSON.parse(await readFile(filePath, "utf8"));
-const rootfsPath = (outputDirectory, containerPath) => path.join(outputDirectory, "container", "rootfs", containerPath.replace(/^\/+/u, ""));
-const matchesAgent = (agent, input) => agent.slug === input || agent.id === input || agent.name === input || agent.id === `agent:${input}`;
-const selectPiAgent = async (compileResult, agentInput) => {
-    const instance = compileResult.report.container?.runtime_instances.find((candidate) => candidate.id === "pi-app" && ["daimon", "pi"].includes(candidate.runtime));
-    if (!instance?.config_path || !instance.workspace_path || !instance.home_path) {
-        throw new SpawnfileError("runtime_error", "Compiled output does not contain a generated Daimon runtime instance");
-    }
-    const configPath = rootfsPath(compileResult.outputDirectory, instance.config_path);
-    const config = await readJson(configPath);
-    const agent = (config.agents ?? []).find((candidate) => matchesAgent(candidate, agentInput));
-    if (!agent) {
-        throw new SpawnfileError("validation_error", `Daimon agent "${agentInput}" was not found in compiled output`);
-    }
-    return {
-        agent,
-        configPath,
-        instanceRoot: path.posix.dirname(instance.home_path),
-        remoteConfigPath: instance.config_path,
-        remoteWorkspaceRoot: `${instance.workspace_path}/agents`,
-        workspacePath: rootfsPath(compileResult.outputDirectory, `${instance.workspace_path}/agents/${agent.slug}`)
-    };
-};
-const selectMoltnetNodes = async (result, agent) => {
-    const nodePlans = result.report.container?.moltnet?.node_plans ?? [];
-    const matches = [];
-    for (const plan of nodePlans) {
-        const configPath = rootfsPath(result.outputDirectory, plan.config_path);
-        const config = await readJson(configPath);
-        const attachment = (config.attachments ?? []).find((candidate) => {
-            const id = candidate.agent?.id ?? "";
-            const name = candidate.agent?.name ?? "";
-            return id === agent.slug || id === agent.id || name === agent.name;
-        });
-        if (attachment?.agent?.id) {
-            matches.push({
-                configPath,
-                remotePath: plan.config_path,
-                ...(attachment.moltnet?.token_path
-                    ? { tokenDirectory: path.posix.dirname(attachment.moltnet.token_path) }
-                    : {})
-            });
-        }
-    }
-    return matches;
-};
-const selectManagedMoltnetServers = (result) => (result.report.container?.moltnet?.server_plans ?? [])
-    .filter((plan) => plan.mode === "managed" && Boolean(plan.config_path))
-    .map((plan) => ({
-    configPath: rootfsPath(result.outputDirectory, plan.config_path),
-    remotePath: plan.config_path
-}));
-const shellQuote = (value) => `'${value.replaceAll("'", "'\"'\"'")}'`;
-const listRunningPiAgents = async (dockerCommand, dockerPrefix, containerName, execFileImpl) => {
-    const stdout = await runDocker(dockerCommand, [...dockerPrefix, "exec", containerName, "curl", "-fsS", `${PI_CONTROL_URL}/spawnfile/agents`], execFileImpl);
-    const parsed = JSON.parse(stdout);
-    return parsed.agents ?? [];
-};
-const loadPiAgent = async (dockerCommand, dockerPrefix, containerName, slug, action, execFileImpl) => {
-    await runDocker(dockerCommand, [
-        ...dockerPrefix,
-        "exec",
-        containerName,
-        "curl",
-        "-fsS",
-        "-X",
-        "POST",
-        "-H",
-        "content-type: application/json",
-        "--data",
-        JSON.stringify({ slug }),
-        `${PI_CONTROL_URL}/spawnfile/agents/${action}`
-    ], execFileImpl, 120_000);
-};
-export const devApplyProject = async (inputPath, options) => {
-    const outputDirectory = await resolveDevOutputDirectory(inputPath, options.outputDirectory);
-    const record = await selectDeploymentRecord(outputDirectory, options.deploymentName);
-    const dockerCommand = options.dockerCommand ?? "docker";
-    const dockerPrefix = dockerArgsForRecord(record);
-    const containerName = firstContainerName(record);
-    const execFileImpl = options.execFile ?? defaultExecFile;
-    const existingAgents = await listRunningPiAgents(dockerCommand, dockerPrefix, containerName, execFileImpl);
-    const compileResult = await compileForDevApply(inputPath, outputDirectory, record, dockerCommand, execFileImpl);
-    const { agent, configPath, instanceRoot, remoteConfigPath, remoteWorkspaceRoot, workspacePath } = await selectPiAgent(compileResult, options.agent);
-    const nodes = await selectMoltnetNodes(compileResult, agent);
-    const serverConfigs = selectManagedMoltnetServers(compileResult);
-    const existingAgent = existingAgents.some((candidate) => matchesAgent(candidate, agent.slug));
-    await copyIntoContainer(dockerCommand, dockerPrefix, configPath, `${containerName}:${remoteConfigPath}`, execFileImpl);
-    await copyIntoContainer(dockerCommand, dockerPrefix, workspacePath, `${containerName}:${remoteWorkspaceRoot}`, execFileImpl);
-    for (const node of nodes) {
-        await copyIntoContainer(dockerCommand, dockerPrefix, node.configPath, `${containerName}:${node.remotePath}`, execFileImpl);
-    }
-    for (const serverConfig of serverConfigs) {
-        await copyIntoContainer(dockerCommand, dockerPrefix, serverConfig.configPath, `${containerName}:${serverConfig.remotePath}`, execFileImpl);
-    }
-    const tokenDirectories = nodes
-        .map((node) => node.tokenDirectory)
-        .filter((directory) => Boolean(directory));
-    await ensureContainerDirectories(dockerCommand, dockerPrefix, containerName, tokenDirectories, execFileImpl);
-    await chownContainerPaths(dockerCommand, dockerPrefix, containerName, [
-        instanceRoot,
-        ...nodes.flatMap((node) => [
-            node.remotePath,
-            ...(node.tokenDirectory ? [node.tokenDirectory] : [])
-        ]),
-        ...serverConfigs.map((serverConfig) => serverConfig.remotePath)
-    ], execFileImpl);
-    await loadPiAgent(dockerCommand, dockerPrefix, containerName, agent.slug, options.restart === true ? "restart" : "load", execFileImpl);
-    if (!existingAgent) {
-        for (const node of nodes) {
-            const prepare = node.tokenDirectory ? `mkdir -p ${shellQuote(node.tokenDirectory)} && ` : "";
-            const command = `${prepare}/usr/local/bin/moltnet node ${shellQuote(node.remotePath)}`;
-            await runDocker(dockerCommand, [...dockerPrefix, "exec", "-d", "--user", "spawnfile", containerName, "sh", "-lc", command], execFileImpl);
-        }
-    }
-    return {
-        agentId: agent.id,
-        bridgeStarted: !existingAgent && nodes.length > 0,
-        containerName,
-        deploymentName: record.name,
-        existingAgent,
-        outputDirectory
-    };
-};
-export const devRestartProject = async (inputPath, options) => devApplyProject(inputPath, { ...options, restart: true });
 export const devStopProject = async (inputPath, options = {}) => {
     const outputDirectory = await resolveDevOutputDirectory(inputPath, options.outputDirectory);
     const record = await selectDeploymentRecord(outputDirectory, options.deploymentName);

package/dist/distribution/distributionReportSchema.js

@@ -42,7 +42,7 @@ const runtimeInstanceSchema = z.object({
     node_ids: z.array(z.string()),
     published_port: portSchema.nullable(),
     runtime: z.string().min(1),
-    // node id -> persistent mount id for per-agent telemetry; every pi/Daimon
+    // node id -> persistent mount id for per-agent telemetry; every Daimon
     // image this compiler builds carries it, so a strict schema without it
     // refused image-mode `up` of the compiler's own output.
     telemetry_mount_ids: z.record(z.string().min(1), instanceIdSchema).optional(),

package/dist/distribution/imageRuntimeAuth.js

@@ -1,3 +1,4 @@
+import { daimonGatewayBootstrapMountPath } from "../runtime/daimon/gateway.js";
 import { DAIMON_ENGINE_DESCRIPTORS } from "../runtime/daimon/engines.js";
 import path from "node:path";
 import { loadImportedClaudeCodeCredential, loadImportedCodexCredential } from "../auth/index.js";
@@ -60,7 +61,7 @@ export const prepareDaimonImageAuthMounts = async (instance, environment, authPr
         const source = daimonSourcePathForEngine(descriptor.id, environment, authProfile, descriptor);
         const ownerUid = await assertSafeDaimonSourceFile(source, descriptor.id, descriptor.auth.maxCredentialBytes, descriptor);
         assertDaimonCredentialContainerOwner(ownerUid, descriptor.id, containerCredentialUid);
-        mounts.push("-v", `${source}:${descriptor.auth.realm.bootstrapMountPath}:ro`);
+        mounts.push("-v", `${source}:${daimonGatewayBootstrapMountPath(descriptor.auth.realm)}:ro`);
     }
     for (const descriptor of descriptors) {
         if (descriptor.auth.staging !== "broker-realm")
@@ -69,7 +70,7 @@ export const prepareDaimonImageAuthMounts = async (instance, environment, authPr
         // do not require ownership by the eventual organization uid.
         const source = daimonSourcePathForEngine(descriptor.id, environment, null, descriptor);
         await assertSafeDaimonSourceFile(source, descriptor.id, descriptor.auth.maxCredentialBytes, descriptor);
-        mounts.push("-v", `${source}:${descriptor.auth.realm.bootstrapMountPath}:ro`);
+        mounts.push("-v", `${source}:${daimonGatewayBootstrapMountPath(descriptor.auth.realm)}:ro`);
     }
     for (const descriptor of descriptors) {
         if (descriptor.auth.staging !== "secret-service")

package/dist/release/drainControl.d.ts

@@ -1,24 +1,10 @@
-/**
- * The running organization's control plane, reached the way every other
- * Spawnfile probe reaches a container's loopback: an ephemeral helper from the
- * same image inside the target's network namespace. The bearer token goes to
- * curl on stdin (`-H @-`), never on a command line another host process could
- * read.
- */
-export interface RuntimeControlTarget {
-    containerRef: string;
-    dockerArgs: readonly string[];
-    dockerCommand: string;
-    imageRef: string;
-    token: string;
-}
-export interface ControlResponse {
-    body: string;
-    status: number;
-}
+import { type DaimonControlResponse, type DaimonControlTarget } from "../runtime/daimon/control.js";
+/** The running organization's control plane, through the shared Daimon control client. */
+export type RuntimeControlTarget = DaimonControlTarget;
+export type ControlResponse = DaimonControlResponse;
 export type ControlCall = (target: RuntimeControlTarget, method: "GET" | "POST", route: string) => Promise<ControlResponse>;
 export declare const CONTROL_CALL_TIMEOUT_MS = 60000;
-export declare const controlHelperArgs: (target: RuntimeControlTarget, method: "GET" | "POST", route: string) => string[];
+export declare const controlHelperArgs: (target: DaimonControlTarget, method: import("../runtime/daimon/control.js").DaimonControlMethod, route: string) => string[];
 export declare const parseHelperOutput: (stdout: string) => ControlResponse;
 export declare const helperControlCall: ControlCall;
 export type DrainState = "draining" | "drained" | null;

package/dist/release/drainControl.js

@@ -1,74 +1,19 @@
-import { spawn } from "node:child_process";
-import { DAIMON_CONTROL_PORT } from "../runtime/daimon/config.js";
+import { DAIMON_CONTROL_CALL_TIMEOUT_MS, DaimonControlError, daimonControlHelperArgs, daimonHelperControlCall, parseDaimonControlHelperOutput } from "../runtime/daimon/control.js";
 import { ReleaseError } from "./types.js";
-export const CONTROL_CALL_TIMEOUT_MS = 60_000;
-const MAX_CONTROL_OUTPUT_BYTES = 1024 * 1024;
-export const controlHelperArgs = (target, method, route) => [
-    ...target.dockerArgs,
-    "run", "--rm", "-i", "--pull", "never",
-    "--network", `container:${target.containerRef}`,
-    "--entrypoint", "curl",
-    target.imageRef,
-    "-sS", "--max-time", "15", "-X", method, "-H", "@-",
-    "--output", "-", "--write-out", "\\n%{http_code}",
-    `http://127.0.0.1:${DAIMON_CONTROL_PORT}${route}`
-];
-const redact = (text, token) => (token ? text.split(token).join("[redacted]") : text).replace(/\s+/gu, " ").slice(0, 240);
+export const CONTROL_CALL_TIMEOUT_MS = DAIMON_CONTROL_CALL_TIMEOUT_MS;
+export const controlHelperArgs = daimonControlHelperArgs;
+const asRelease = (error) => {
+    throw error instanceof DaimonControlError ? new ReleaseError("drain-failed", error.message) : error;
+};
 export const parseHelperOutput = (stdout) => {
-    const match = /\n(\d{3})$/u.exec(stdout);
-    if (!match || match.index === undefined) {
-        throw new ReleaseError("drain-failed", "the runtime control helper returned no HTTP status");
+    try {
+        return parseDaimonControlHelperOutput(stdout);
+    }
+    catch (error) {
+        return asRelease(error);
     }
-    return { body: stdout.slice(0, match.index), status: Number(match[1]) };
 };
-export const helperControlCall = (target, method, route) => new Promise((resolve, reject) => {
-    const child = spawn(target.dockerCommand, controlHelperArgs(target, method, route), {
-        stdio: ["pipe", "pipe", "pipe"]
-    });
-    const out = [];
-    let bytes = 0;
-    let stderr = "";
-    let settled = false;
-    const finish = (error, value) => {
-        if (settled)
-            return;
-        settled = true;
-        clearTimeout(timer);
-        if (error)
-            reject(error);
-        else
-            resolve(value);
-    };
-    const timer = setTimeout(() => {
-        child.kill("SIGKILL");
-        finish(new ReleaseError("drain-failed", `runtime control ${method} ${route} timed out`));
-    }, CONTROL_CALL_TIMEOUT_MS);
-    child.stdout.on("data", (chunk) => {
-        bytes += chunk.length;
-        if (bytes > MAX_CONTROL_OUTPUT_BYTES) {
-            child.kill("SIGKILL");
-            finish(new ReleaseError("drain-failed", `runtime control ${method} ${route} answered more than the output bound`));
-            return;
-        }
-        out.push(chunk);
-    });
-    child.stderr.on("data", (chunk) => { stderr = `${stderr}${chunk.toString("utf8")}`.slice(-2000); });
-    child.once("error", (error) => finish(new ReleaseError("drain-failed", `cannot start the runtime control helper: ${error.message}`)));
-    child.once("close", (code) => {
-        if (code !== 0) {
-            finish(new ReleaseError("drain-failed", `runtime control ${method} ${route} failed (exit ${code ?? "signal"}): ${redact(stderr, target.token)}`));
-            return;
-        }
-        try {
-            finish(null, parseHelperOutput(Buffer.concat(out).toString("utf8")));
-        }
-        catch (error) {
-            finish(error);
-        }
-    });
-    child.stdin.on("error", () => undefined);
-    child.stdin.end(`Authorization: Bearer ${target.token}\n`);
-});
+export const helperControlCall = (target, method, route) => daimonHelperControlCall(target, method, route).catch(asRelease);
 /** The parts of `noopolis.daimon.work-availability.v1` a release reads. */
 export const parseAvailability = (response, route) => {
     if (response.status === 404) {

package/dist/report/types.d.ts

@@ -19,10 +19,7 @@ export interface ContainerRuntimeInstanceReport {
         skill_roots: string[];
     }>;
     config_path: string;
-    /** Per pi/daimon agent (keyed by node id, e.g. "agent:eleanor"): the resolved pi
-     * engine kind (see `PI_ENGINE_KINDS` in `src/runtime/pi/appTemplate.ts`, e.g.
-     * "scripted"), so a scripted-engine run is disclosable on the compile report rather
-     * than an invisible test-only branch. Only pi/daimon runtime instances populate this. */
+    /** Adapter-resolved engine kinds by agent node id. */
     engine_by_node_id?: Record<string, string>;
     home_path: string | null;
     id: string;
@@ -32,8 +29,8 @@ export interface ContainerRuntimeInstanceReport {
     node_ids?: string[];
     published_port?: number | null;
     runtime: string;
-    /** Per pi/daimon agent (keyed by node id, e.g. "agent:eleanor"): the id of its daimon
-     * telemetry persistent mount (see `daimonTelemetryArtifacts.ts`), so
+    /** Per daimon agent (keyed by node id, e.g. "agent:eleanor"): the id of its daimon
+     * telemetry persistent mount, so
      * `artifactsExportPlan.ts` can egress `causal.jsonl` from that agent's durable volume
      * instead of `docker cp`ing it out of the (possibly already-gone) live container. */
     telemetry_mount_ids?: Record<string, string>;

package/dist/runtime/common.d.ts

@@ -39,7 +39,7 @@ export declare const createDiagnostic: (level: DiagnosticReport["level"], messag
 export declare const createDocumentFiles: (baseDirectory: string, documents: ResolvedDocument[]) => EmittedFile[];
 /**
  * Skill roots for the runtimes whose declared skills are read by an external
- * coding-agent CLI engine (`daimon` and `pi`). `.codex/skills` is Codex's own
+ * coding-agent CLI engine (`daimon`). `.codex/skills` is Codex's own
  * workspace discovery root; `.agents/skills` is the generic cross-engine root
  * that grok, agy, and every other file-reading CLI engine use. Both entries
  * are required and the two emitted files are byte-identical on purpose — this

package/dist/runtime/common.js

@@ -64,7 +64,7 @@ export const createDocumentFiles = (baseDirectory, documents) => documents.map((
 }));
 /**
  * Skill roots for the runtimes whose declared skills are read by an external
- * coding-agent CLI engine (`daimon` and `pi`). `.codex/skills` is Codex's own
+ * coding-agent CLI engine (`daimon`). `.codex/skills` is Codex's own
  * workspace discovery root; `.agents/skills` is the generic cross-engine root
  * that grok, agy, and every other file-reading CLI engine use. Both entries
  * are required and the two emitted files are byte-identical on purpose — this

package/dist/runtime/container.d.ts

@@ -1,4 +1,4 @@
-import { type RuntimeContainerPackageOverrides } from "./containerPackageOverrides.js";
+import type { RuntimeContainerPackageOverrides } from "./containerPackageOverrides.js";
 export declare const RUNTIME_INSTALL_ROOT = "/opt/spawnfile/runtime-installs";
 export interface RuntimeInstallRecipe {
     baseImage?: string;
@@ -33,4 +33,4 @@ export interface RuntimeInstallRecipeOptions {
      */
     packageOverrides?: RuntimeContainerPackageOverrides;
 }
-export declare const createRuntimeInstallRecipe: (runtimeName: string, options?: RuntimeInstallRecipeOptions) => Promise<RuntimeInstallRecipe>;
+export declare const createRuntimeInstallRecipe: (runtimeName: string, _options?: RuntimeInstallRecipeOptions) => Promise<RuntimeInstallRecipe>;

package/dist/runtime/container.js

@@ -1,24 +1,15 @@
-import { DAIMON_PACKAGE_NAME } from './daimon/packageName.js';
 import { createDaimonInstallCommands } from "./daimonInstall.js";
 import { SpawnfileError } from "../shared/index.js";
 import { NOOPOLIS_RUN_ID_ENV, resolveNoopolisRunId } from "./common.js";
-import { createVendorCopyCommand, needsVendorCopyCommand, resolveInstallPackageSpec } from "./containerPackageOverrides.js";
 import { resolveRuntimeInstallSelection } from "./install.js";
 import { DAIMON_LOCAL_RUNTIME_IDENTITY_ENV, loadLocalDaimonRuntimeIdentity } from "./localDaimonAuthority.js";
 import { DAIMON_CONTRACT_MANIFEST_SHA256 } from "./daimon/contractManifest.js";
 import { DAIMON_WAKE_FUSE_DIRECTORY, DAIMON_WAKE_FUSE_DIRECTORY_ENV } from "./daimon/config.js";
 export const RUNTIME_INSTALL_ROOT = "/opt/spawnfile/runtime-installs";
-const PI_RUNTIME_BASE_IMAGE_ENV = "SPAWNFILE_PI_RUNTIME_BASE_IMAGE";
 const LEGACY_DAIMON_RUNTIME_IMAGE_ENV = "SPAWNFILE_DAIMON_RUNTIME_IMAGE";
 const LEGACY_DAIMON_RUNTIME_CAPABILITY_RECEIPT_ENV = "SPAWNFILE_DAIMON_RUNTIME_CAPABILITY_RECEIPT";
 const OPENCLAW_RUNTIME_IMAGE_ENV = "SPAWNFILE_OPENCLAW_RUNTIME_IMAGE";
 const PICOCLAW_RUNTIME_IMAGE_ENV = "SPAWNFILE_PICOCLAW_RUNTIME_IMAGE";
-const PI_DAIMON_PACKAGE_VERSION = "0.1.2";
-const MNEME_PACKAGE_NAME = "@noopolis/mneme";
-const MNEME_PACKAGE_VERSION = "0.1.1";
-const PI_AI_PACKAGE_NAME = "@earendil-works/pi-ai";
-const PI_CODING_AGENT_PACKAGE_NAME = "@earendil-works/pi-coding-agent";
-const PI_PACKAGE_VERSION = "0.79.10";
 /**
  * Builds the shared container env assembly injected into every generated
  * runtime install recipe. Currently just NOOPOLIS_RUN_ID, sourced from the
@@ -75,12 +66,11 @@ const resolveDaimonRuntimeImageRef = async (selection) => {
         image: pinnedImage
     };
 };
-export const createRuntimeInstallRecipe = async (runtimeName, options = {}) => {
+export const createRuntimeInstallRecipe = async (runtimeName, _options = {}) => {
     const selection = await resolveRuntimeInstallSelection(runtimeName);
     assertArtifactInstallSelection(runtimeName, selection);
     const installRoot = `${RUNTIME_INSTALL_ROOT}/${runtimeName}`;
     const containerEnv = createRuntimeContainerEnv();
-    const packageOverrides = options.packageOverrides;
     switch (runtimeName) {
         case "openclaw": {
             const openClawRuntimeImage = resolveRuntimeImageRef(OPENCLAW_RUNTIME_IMAGE_ENV, selection);
@@ -143,34 +133,6 @@ export const createRuntimeInstallRecipe = async (runtimeName, options = {}) => {
                 runtimeRoot: installRoot
             };
         }
-        case "pi": {
-            if (selection.kind !== "npm") {
-                throw new SpawnfileError("runtime_error", `Runtime ${runtimeName} has no compiled artifact recipe for ${selection.kind}`);
-            }
-            const prebuiltBaseImage = process.env[PI_RUNTIME_BASE_IMAGE_ENV]?.trim() || undefined;
-            const npmPackages = [
-                resolveInstallPackageSpec(DAIMON_PACKAGE_NAME, PI_DAIMON_PACKAGE_VERSION, packageOverrides),
-                resolveInstallPackageSpec(MNEME_PACKAGE_NAME, MNEME_PACKAGE_VERSION, packageOverrides),
-                `${selection.packageName}@${selection.version}`,
-                `${PI_AI_PACKAGE_NAME}@${selection.version}`
-            ];
-            return {
-                ...(prebuiltBaseImage ? { baseImage: prebuiltBaseImage } : {}),
-                commands: prebuiltBaseImage
-                    ? [`mkdir -p ${installRoot}`]
-                    : [
-                        `mkdir -p ${installRoot}`,
-                        `cd ${installRoot} && npm install --omit=dev --no-fund --no-audit ${npmPackages.join(" ")}`
-                    ],
-                copyCommands: !prebuiltBaseImage &&
-                    needsVendorCopyCommand([DAIMON_PACKAGE_NAME, MNEME_PACKAGE_NAME], packageOverrides)
-                    ? [createVendorCopyCommand()]
-                    : [],
-                env: containerEnv,
-                runtimeName,
-                runtimeRoot: installRoot
-            };
-        }
         /* c8 ignore next 5 -- compileable runtimes are exhaustively covered above */
         default:
             throw new SpawnfileError("runtime_error", `Runtime ${runtimeName} has no container install recipe`);

package/dist/runtime/daimon/config.js

@@ -2,10 +2,10 @@ import path from "node:path";
 import { CLI_ENGINE_SKILL_BASE_DIRECTORIES } from "../common.js";
 import { daimonGrokSkillsError } from "./grokSkillsSupport.js";
 import { daimonAgentSkillsFromResolved } from "./grokWorkerSkills.js";
-import { daimonPortableSubscriptionRealms } from "./subscriptionRealms.js";
+import { daimonGatewayedSubscriptionRealms } from "./subscriptionRealms.js";
 import { parseEveryScheduleMs } from "../scheduleUtils.js";
 import { SpawnfileError } from "../../shared/index.js";
-import { DAIMON_AGY_SUBSCRIPTION_REALM, DAIMON_GROK_SUBSCRIPTION_REALM, DAIMON_GROK_TURN_USAGE_LEDGER } from "./contractManifest.js";
+import { DAIMON_AGY_SUBSCRIPTION_REALM, DAIMON_GROK_TURN_USAGE_LEDGER } from "./contractManifest.js";
 import { DAIMON_INSTANCE_STATE_ROOT, daimonMemoryCapabilityFor, daimonMemorySelectionWarning, daimonMemoryVectorRecallWarning, resolveDaimonAgentMemory } from "./memory.js";
 import { assertDaimonScheduleAuthority } from "./scheduleAuthority.js";
 import { assertDaimonAttentionAuthority, resolveDaimonAttention } from "./attention.js";
@@ -224,7 +224,7 @@ export const createDaimonContainerTargets = async (inputs) => {
         .map((input) => [input.id, daimonAgentSkillsFromResolved(input.value.skills)]));
     const hasAgy = configAgents.some((agent) => getDaimonEngineDescriptor(agent.engine.kind)?.auth.staging === "secret-service");
     const hasGrok = configAgents.some((agent) => daimonEngineHasBroker(agent.engine.kind));
-    const portableRealms = daimonPortableSubscriptionRealms(configAgents.map((agent) => agent.engine.kind));
+    const portableRealms = daimonGatewayedSubscriptionRealms(configAgents.map((agent) => agent.engine.kind));
     const agyRuntimeHomeMounts = configAgents
         .filter((agent) => getDaimonEngineDescriptor(agent.engine.kind)?.auth.staging === "secret-service")
         .map((agent) => ({
@@ -279,11 +279,10 @@ export const createDaimonContainerTargets = async (inputs) => {
                 }
             ],
             id: DAIMON_ORGANIZATION_TARGET_ID,
-            ...(hasAgy || hasGrok || portableRealms.opaqueMountTargets.length > 0 ? {
+            ...(hasAgy || portableRealms.opaqueMountTargets.length > 0 ? {
                 opaqueMountTargets: [
                     ...portableRealms.opaqueMountTargets,
-                    ...(hasAgy ? [DAIMON_AGY_SUBSCRIPTION_REALM.unlockMountPath] : []),
-                    ...(hasGrok ? [DAIMON_GROK_SUBSCRIPTION_REALM.bootstrapMountPath] : [])
+                    ...(hasAgy ? [DAIMON_AGY_SUBSCRIPTION_REALM.unlockMountPath] : [])
                 ],
             } : {}),
             persistentMounts: [...portableRealms.persistentMounts, ...portableEngineHomeMounts, ...toolStateMounts, ...recordingMounts, {
@@ -295,12 +294,7 @@ export const createDaimonContainerTargets = async (inputs) => {
                     lifecycle: "exclusive-reattach",
                     mountPath: DAIMON_WAKE_FUSE_DIRECTORY,
                     reason: "Daimon durable wake-fuse admission ledger"
-                }, ...(hasGrok ? [{
-                        id: "daimon-grok-subscription-realm",
-                        lifecycle: "exclusive-reattach",
-                        mountPath: DAIMON_GROK_SUBSCRIPTION_REALM.durableMountPath,
-                        reason: "Daimon host Grok subscription credential realm"
-                    }] : []), {
+                }, {
                     // Non-run-scoped for the same reason as the durable memory mounts (see
                     // durableMemoryVolumeName in src/compiler/memoryArtifacts.ts): a
                     // run-scoped volume means every `spawnfile up` starts a new empty

package/dist/runtime/daimon/contractManifest.js

@@ -253,4 +253,3 @@ export const readVerifiedDaimonContractManifest = async (runtimeRoot) => {
         return fail("digest sidecar does not match its bytes");
     return Object.freeze({ digest: `sha256:${digest}`, manifest: parseDaimonContractManifest(parsed) });
 };
-//# sourceMappingURL=contractManifest.js.map

package/dist/runtime/daimon/contractManifestSchema.js

@@ -25,4 +25,3 @@ export const DAIMON_CONTRACT_MANIFEST_V7_JSON_SCHEMA = {
     ...z.toJSONSchema(daimonContractManifestV7Schema),
     $id: DAIMON_CONTRACT_MANIFEST_V7_VERSION
 };
-//# sourceMappingURL=contractManifestSchema.js.map