spawnfile 0.1.33 → 0.1.35

package/dist/compiler/training/trial/login.js

@@ -0,0 +1,85 @@
+import { mkdir, mkdtemp, rm } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { ensureAuthProfile, registerSubscriptionRealm } from "../../../auth/index.js";
+import { getDaimonEngineDescriptor } from "../../../runtime/daimon/index.js";
+import { DAIMON_ORGANIZATION_UID } from "../../../runtime/daimon/runtimeIdentity.js";
+import { DAIMON_PROFILE_UNLOCK_FILE } from "../../../runtime/daimon/subscriptionRealms.js";
+import { SpawnfileError } from "../../../shared/index.js";
+import { slugify } from "../../helpers.js";
+import { prepareTrial } from "./boot.js";
+import { createTrialDocker } from "./docker.js";
+import { trainingGatewayRealmVolume } from "./gateway.js";
+import { JUDGE_INSTRUCTIONS, writeJudgeAgent } from "./judge.js";
+const LABEL = "spawnfile.subscription-realm";
+/** The profile's volume names for an engine's volume-held login. */
+export const subscriptionRealmBinding = (profileName, engine) => {
+    const prefix = `spawnfile-training-${slugify(profileName) || "profile"}-${engine}`;
+    return { homeVolume: `${prefix}-home`, realmVolume: trainingGatewayRealmVolume(profileName, engine), unlockVolume: `${prefix}-unlock` };
+};
+/**
+ * Creates the unlock secret inside its volume exactly once, as the organization
+ * uid Daimon checks it against (one `0600` regular file, no newline). Generated
+ * and written inside a network-less container: the bytes never reach the host.
+ * An existing secret is kept (replacing it would orphan the encrypted keyring)
+ * unless it is unsafe, which is refused.
+ */
+const UNLOCK_PROGRAM = [
+    "const fs = require('node:fs'), crypto = require('node:crypto');",
+    "const [uid, name] = process.argv.slice(1); const target = `/unlock/${name}`;",
+    "try { const entry = fs.lstatSync(target);",
+    "  if (!entry.isFile() || entry.nlink !== 1 || entry.uid !== Number(uid) || (entry.mode & 0o777) !== 0o600 || entry.size < 1) { console.error('existing unlock secret is unsafe'); process.exit(3); }",
+    "  process.exit(0);",
+    "} catch (error) { if (error.code !== 'ENOENT') throw error; }",
+    "const fd = fs.openSync(target, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_NOFOLLOW, 0o600);",
+    "const bytes = Buffer.from(crypto.randomBytes(32).toString('hex'));",
+    "fs.writeSync(fd, bytes); bytes.fill(0); fs.fchmodSync(fd, 0o600); fs.fsyncSync(fd); fs.fchownSync(fd, Number(uid), Number(uid)); fs.closeSync(fd);"
+].join("\n");
+export const ensureSubscriptionRealmVolumes = async (docker, image, engine, binding) => {
+    for (const volume of [binding.realmVolume, binding.unlockVolume, ...(binding.homeVolume ? [binding.homeVolume] : [])]) {
+        await docker(["volume", "create", "--label", `${LABEL}=${engine}`, volume]);
+    }
+    await docker(["run", "--rm", "--network", "none", "--user", "0:0", "--cap-drop", "ALL", "--cap-add", "CHOWN",
+        "--security-opt", "no-new-privileges", "--entrypoint", "node", "--mount", `type=volume,source=${binding.unlockVolume},target=/unlock`,
+        image, "-e", UNLOCK_PROGRAM, String(DAIMON_ORGANIZATION_UID), DAIMON_PROFILE_UNLOCK_FILE]);
+};
+/**
+ * `spawnfile auth login <engine>`: gives an auth profile its own volume-held
+ * login for an engine that keeps its login in a Daimon secret-service realm
+ * (AGY). Creates the profile's realm, unlock and home login volumes, then runs
+ * Daimon's own interactive `auth <engine> login` in a throwaway,
+ * production-booted one-agent organization (a tool-free judge) attached to the
+ * operator's terminal, keeps the engine's login files from that throwaway home
+ * in the home login volume, and records the volume names on the profile once
+ * it succeeds.
+ * Spawnfile never reads the login or the unlock secret.
+ */
+export const loginSubscriptionRealm = async (options) => {
+    const descriptor = getDaimonEngineDescriptor(options.engine);
+    if (descriptor?.auth.staging !== "secret-service") {
+        throw new SpawnfileError("validation_error", `Engine ${options.engine} has no volume-held login; use \`spawnfile auth import ${options.engine}\``);
+    }
+    const docker = options.docker ?? createTrialDocker();
+    const current = await ensureAuthProfile(options.profileName);
+    // An earlier login keeps its volumes; one recorded before home login files were kept gains its home volume.
+    const binding = { ...subscriptionRealmBinding(current.name, options.engine), ...current.realms?.[options.engine] };
+    const realms = { ...current, env: {}, imports: {}, realms: { [options.engine]: binding } };
+    const scratch = options.scratchRoot ?? os.tmpdir();
+    await mkdir(scratch, { recursive: true });
+    const root = await mkdtemp(path.join(scratch, "spawnfile-auth-login-"));
+    let prepared;
+    try {
+        prepared = await (options.prepare ?? prepareTrial)({
+            agentManifestPath: await writeJudgeAgent({ engine: options.engine, model: "default" }, path.join(root, "source")),
+            directory: root, docker, instructions: JUDGE_INSTRUCTIONS, trialId: `login-${options.engine}-${current.name}`
+        });
+        await ensureSubscriptionRealmVolumes(docker, prepared.image, options.engine, binding);
+        const command = await prepared.login(realms, { dryRun: options.dryRun === true });
+        const profile = options.dryRun ? current : await registerSubscriptionRealm(current.name, options.engine, binding);
+        return { binding, command, profile };
+    }
+    finally {
+        await prepared?.dispose();
+        await rm(root, { recursive: true, force: true });
+    }
+};

package/dist/compiler/training/trial/project.d.ts

@@ -0,0 +1,11 @@
+/** The candidate's instructions become this agent's system document. */
+export declare const TRIAL_INSTRUCTIONS_FILE = "TRAINING_INSTRUCTIONS.md";
+/**
+ * Writes the trial's one-agent organization: a copy of the subject agent's own
+ * declaration directory (so every relative doc, skill and resource keeps
+ * resolving) whose Spawnfile is the subject's, re-rendered with the candidate
+ * prompt as its system document and with every surface (federation), its
+ * schedule and its training block removed. Nothing else changes: runtime,
+ * engine, model, memory and tools are the subject's.
+ */
+export declare const writeTrialProject: (agentManifestPath: string, instructions: string, directory: string) => Promise<string>;

package/dist/compiler/training/trial/project.js

@@ -0,0 +1,31 @@
+import { cp, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { isAgentManifest, loadManifest, renderSpawnfile } from "../../../manifest/index.js";
+import { SpawnfileError } from "../../../shared/index.js";
+/** The candidate's instructions become this agent's system document. */
+export const TRIAL_INSTRUCTIONS_FILE = "TRAINING_INSTRUCTIONS.md";
+const SKIPPED = new Set([".git", "node_modules", ".runtime", ".spawn", ".spawn-dev", ".sim"]);
+/**
+ * Writes the trial's one-agent organization: a copy of the subject agent's own
+ * declaration directory (so every relative doc, skill and resource keeps
+ * resolving) whose Spawnfile is the subject's, re-rendered with the candidate
+ * prompt as its system document and with every surface (federation), its
+ * schedule and its training block removed. Nothing else changes: runtime,
+ * engine, model, memory and tools are the subject's.
+ */
+export const writeTrialProject = async (agentManifestPath, instructions, directory) => {
+    const { manifest } = await loadManifest(agentManifestPath);
+    if (!isAgentManifest(manifest)) {
+        throw new SpawnfileError("validation_error", "A production-booted training subject must be declared in its own agent Spawnfile");
+    }
+    await cp(path.dirname(agentManifestPath), directory, {
+        recursive: true,
+        filter: (source) => !SKIPPED.has(path.basename(source))
+    });
+    const { schedule: _schedule, surfaces: _surfaces, training: _training, ...kept } = manifest;
+    const trial = { ...kept, workspace: { ...kept.workspace, docs: { ...kept.workspace?.docs, system: TRIAL_INSTRUCTIONS_FILE } } };
+    await writeFile(path.join(directory, TRIAL_INSTRUCTIONS_FILE), instructions);
+    const manifestPath = path.join(directory, "Spawnfile");
+    await writeFile(manifestPath, renderSpawnfile(trial));
+    return manifestPath;
+};

package/dist/compiler/training/trial/realmTurns.d.ts

@@ -0,0 +1,20 @@
+/** Gives the turn back; idempotent. */
+export type ReleaseRealmTurn = () => void;
+export interface RealmTurnOptions {
+    /** Called once on the holder when another caller starts waiting: a warm holder should hand the turn over. */
+    onContended?: () => void;
+    /** Bound on the wait; on expiry the caller is refused instead of waiting forever. */
+    timeoutMs?: number;
+    signal?: AbortSignal;
+}
+/**
+ * First-come turns on exclusive login realms, one holder per realm at a time.
+ * An engine whose login is one realm held under an exclusive lock (Daimon's
+ * AGY keyring, `flock` on `.daimon-lease`) admits one container per login:
+ * every container of a run that mounts that realm takes a turn here first, so
+ * a second container never boots into the lock and dies at readiness.
+ */
+export interface RealmTurns {
+    take(realm: string, options?: RealmTurnOptions): Promise<ReleaseRealmTurn>;
+}
+export declare const createRealmTurns: () => RealmTurns;

package/dist/compiler/training/trial/realmTurns.js

@@ -0,0 +1,69 @@
+import { SpawnfileError } from "../../../shared/index.js";
+export const createRealmTurns = () => {
+    const realms = new Map();
+    const release = (key, state) => {
+        let released = false;
+        return () => {
+            if (released)
+                return;
+            released = true;
+            const next = state.queue.shift();
+            if (!next) {
+                realms.delete(key);
+                return;
+            }
+            state.holder = next.options;
+            state.contended = false;
+            next.grant();
+            if (state.queue.length > 0)
+                notify(state);
+        };
+    };
+    const notify = (state) => {
+        if (state.contended)
+            return;
+        state.contended = true;
+        state.holder?.onContended?.();
+    };
+    return {
+        take: (key, options = {}) => {
+            if (options.signal?.aborted)
+                return Promise.reject(new SpawnfileError("runtime_error", `cancelled waiting for login realm ${key}`));
+            const state = realms.get(key);
+            if (!state) {
+                const fresh = { holder: options, contended: false, queue: [] };
+                realms.set(key, fresh);
+                return Promise.resolve(release(key, fresh));
+            }
+            return new Promise((resolve, reject) => {
+                let timer;
+                const leave = (message) => {
+                    const index = state.queue.indexOf(waiter);
+                    if (index < 0)
+                        return;
+                    state.queue.splice(index, 1);
+                    if (timer)
+                        clearTimeout(timer);
+                    options.signal?.removeEventListener("abort", onAbort);
+                    reject(new SpawnfileError("runtime_error", message));
+                };
+                const onAbort = () => leave(`cancelled waiting for login realm ${key}`);
+                const waiter = {
+                    options,
+                    grant: () => {
+                        if (timer)
+                            clearTimeout(timer);
+                        options.signal?.removeEventListener("abort", onAbort);
+                        resolve(release(key, state));
+                    }
+                };
+                state.queue.push(waiter);
+                if (options.timeoutMs !== undefined) {
+                    timer = setTimeout(() => leave(`login realm ${key} stayed held by another container for ${options.timeoutMs}ms; one login admits one container at a time`), options.timeoutMs);
+                }
+                options.signal?.addEventListener("abort", onAbort, { once: true });
+                notify(state);
+            });
+        }
+    };
+};

package/dist/compiler/upReceipt.d.ts

@@ -1,24 +1,9 @@
 import { type CompiledEngineEntry, type CompiledScheduleEntry, type UpReceipt } from "../deployment/index.js";
 import type { CompilePlan } from "./types.js";
 import type { UpProjectResult } from "./upProject.js";
-/**
- * Extracts the `{agent, cron}` pairs an up-receipt's `compiled_schedule` field carries
- * (Decision 21 Piece 4) — the raw material for simfile's wake-diff denominator oracle.
- * Only `kind: "cron"` schedules are represented; `every`/`disabled` schedules have no
- * cron-fire cadence to diff against sim-time and are intentionally omitted, not zeroed.
- */
+/** Reads adapter-resolved engine kinds from the compiled report for the up receipt. */
 export declare const resolveCompiledSchedule: (plan: CompilePlan) => CompiledScheduleEntry[];
-/**
- * Extracts `{agent, engine}` pairs (Piece 5, Slice B) — disclosure ground truth for the
- * run-manifest's `pinned-engine` field, so a `scripted` (or any non-default) pi engine is
- * visibly disclosed rather than an invisible test-only branch. Reads
- * `report.container.runtime_instances[].engine_by_node_id`, the single source of truth
- * `containerArtifacts.ts` already stamps from the pi adapter's own resolved engine kinds
- * (see `src/runtime/pi/adapter.ts`'s `createContainerTargets`) — deliberately not
- * re-derived from a fresh `buildCompilePlan` walk (unlike `resolveCompiledSchedule` above),
- * since that would recompute the exact same fact from pi-adapter-internal logic
- * (`resolvePiEngine`) that compiler code has no business reaching into directly.
- */
+/** Reads adapter-resolved engine kinds from the compiled report for the up receipt. */
 export declare const resolveCompiledEngines: (report: UpProjectResult["report"]) => CompiledEngineEntry[];
 /**
  * Builds `spawnfile.up-receipt.v1` from a project-path `upProject()` result. Reads back

package/dist/compiler/upReceipt.js

@@ -1,12 +1,7 @@
 import { readDeploymentRecord, UP_RECEIPT_VERSION } from "../deployment/index.js";
 import { SpawnfileError } from "../shared/index.js";
 import { buildCompilePlan } from "./buildCompilePlan.js";
-/**
- * Extracts the `{agent, cron}` pairs an up-receipt's `compiled_schedule` field carries
- * (Decision 21 Piece 4) — the raw material for simfile's wake-diff denominator oracle.
- * Only `kind: "cron"` schedules are represented; `every`/`disabled` schedules have no
- * cron-fire cadence to diff against sim-time and are intentionally omitted, not zeroed.
- */
+/** Reads adapter-resolved engine kinds from the compiled report for the up receipt. */
 export const resolveCompiledSchedule = (plan) => plan.nodes
     .filter((node) => node.kind === "agent")
     .flatMap((node) => {
@@ -14,17 +9,7 @@ export const resolveCompiledSchedule = (plan) => plan.nodes
     return schedule?.kind === "cron" ? [{ agent: node.id, cron: schedule.cron }] : [];
 })
     .sort((left, right) => left.agent.localeCompare(right.agent));
-/**
- * Extracts `{agent, engine}` pairs (Piece 5, Slice B) — disclosure ground truth for the
- * run-manifest's `pinned-engine` field, so a `scripted` (or any non-default) pi engine is
- * visibly disclosed rather than an invisible test-only branch. Reads
- * `report.container.runtime_instances[].engine_by_node_id`, the single source of truth
- * `containerArtifacts.ts` already stamps from the pi adapter's own resolved engine kinds
- * (see `src/runtime/pi/adapter.ts`'s `createContainerTargets`) — deliberately not
- * re-derived from a fresh `buildCompilePlan` walk (unlike `resolveCompiledSchedule` above),
- * since that would recompute the exact same fact from pi-adapter-internal logic
- * (`resolvePiEngine`) that compiler code has no business reaching into directly.
- */
+/** Reads adapter-resolved engine kinds from the compiled report for the up receipt. */
 export const resolveCompiledEngines = (report) => (report.container?.runtime_instances ?? [])
     .flatMap((instance) => Object.entries(instance.engine_by_node_id ?? {}))
     .map(([agent, engine]) => ({ agent, engine }))

package/dist/deployment/artifactsExportPlan.js

@@ -73,25 +73,9 @@ const planMnemeFiles = (report, mounts) => (report.container?.memory ?? []).flat
         }
     }));
 });
-/** Daimon: per pi/daimon runtime instance, per agent it covers, the turn-causal telemetry
- * stream at `runtime/agents/<slug>/telemetry/causal.jsonl` under the instance root (see
- * `ecosystem/daimon/src/observability/causalEvents.ts`). As of Piece 4b, that directory is
- * a run-scoped durable volume (`daimonTelemetryArtifacts.ts`, mirroring how
- * `moltnetArtifacts.ts` mounts the Moltnet causal directory), resolved here via each
- * instance's `telemetry_mount_ids` (node id -> persistent mount id). This is the real
- * relaxation of the export-before-teardown invariant (Decision 21) for daimon truth:
- * `spawnfile down` (without `--volumes`) can run BEFORE `spawnfile artifacts export`, and
- * export still recovers every agent's causal.jsonl from its named volume.
- *
- * The `instance.home_path`-keyed branch below is a legacy fallback for a compile report
- * written before Piece 4b (no `telemetry_mount_ids` yet) — it reads the old container-local
- * path with `docker cp`, which only works while the container is still live. Any report
- * produced by this compiler build always populates `telemetry_mount_ids` for a pi/daimon
- * instance, so that branch never fires today; it exists only so an out-of-date report
- * doesn't silently export zero daimon files. Optional either way: a fresh instance that
- * never woke has no telemetry file yet. */
+/** Plans optional Daimon causal telemetry exports from declared mounts or a legacy instance home. */
 const planDaimonFiles = (report, mounts) => (report.container?.runtime_instances ?? [])
-    .filter((instance) => instance.runtime === "pi" || instance.runtime === "daimon")
+    .filter((instance) => instance.runtime === "daimon")
     .flatMap((instance) => (instance.node_ids ?? []).flatMap((nodeId) => {
     const slug = agentSlugFromNodeId(nodeId);
     if (!slug) {

package/dist/deployment/privateArtifactsExport.js

@@ -4,7 +4,7 @@ import path from "node:path";
 import { ensureDirectory } from "../filesystem/index.js";
 import { copyContainerFileToHost, } from "./artifactsExportDocker.js";
 const plans = (report) => (report.container?.runtime_instances ?? [])
-    .filter((instance) => (instance.runtime === "pi" || instance.runtime === "daimon")
+    .filter((instance) => instance.runtime === "daimon"
     && instance.home_path !== null)
     .flatMap((instance) => {
     const instanceRoot = path.posix.dirname(instance.home_path);

package/dist/dev/docker.d.ts

@@ -1,4 +1,3 @@
-import { type CompileProjectResult } from "../compiler/index.js";
 import { type DeploymentRecord } from "../deployment/index.js";
 export type DevExecFile = (file: string, args: string[], options: {
     timeout: number;
@@ -9,8 +8,4 @@ export type DevExecFile = (file: string, args: string[], options: {
 export declare const defaultExecFile: DevExecFile;
 export declare const dockerArgsForRecord: (record: DeploymentRecord) => string[];
 export declare const firstContainerName: (record: DeploymentRecord) => string;
-export declare const compileForDevApply: (inputPath: string, outputDirectory: string, record: DeploymentRecord, dockerCommand: string, execFileImpl: DevExecFile) => Promise<CompileProjectResult>;
 export declare const runDocker: (command: string, args: string[], execFileImpl: DevExecFile, timeout?: number) => Promise<string>;
-export declare const copyIntoContainer: (dockerCommand: string, dockerPrefix: string[], source: string, destination: string, execFileImpl: DevExecFile) => Promise<void>;
-export declare const ensureContainerDirectories: (dockerCommand: string, dockerPrefix: string[], containerName: string, paths: string[], execFileImpl: DevExecFile) => Promise<void>;
-export declare const chownContainerPaths: (dockerCommand: string, dockerPrefix: string[], containerName: string, paths: string[], execFileImpl: DevExecFile) => Promise<void>;

package/dist/dev/docker.js

@@ -1,6 +1,5 @@
 import { execFile as execFileCallback } from "node:child_process";
 import { promisify } from "node:util";
-import { compileProject, normalizeDockerArchitecture } from "../compiler/index.js";
 import { dockerContextNameForTarget, dockerHostValueForTarget } from "../deployment/index.js";
 import { SpawnfileError } from "../shared/index.js";
 export const defaultExecFile = promisify(execFileCallback);
@@ -20,52 +19,7 @@ export const firstContainerName = (record) => {
     }
     return name;
 };
-export const compileForDevApply = async (inputPath, outputDirectory, record, dockerCommand, execFileImpl) => {
-    const dockerContext = dockerContextNameForTarget(record.target) ?? undefined;
-    const architecture = dockerContext
-        ? normalizeDockerArchitecture((await execFileImpl(dockerCommand, ["--context", dockerContext, "info", "--format", "{{.Architecture}}"], { timeout: 10_000 })).stdout)
-        : undefined;
-    return compileProject(inputPath, {
-        clean: false,
-        containerArchitecture: architecture,
-        outputDirectory
-    });
-};
 export const runDocker = async (command, args, execFileImpl, timeout = 30_000) => {
     const { stdout } = await execFileImpl(command, args, { timeout });
     return stdout;
 };
-export const copyIntoContainer = async (dockerCommand, dockerPrefix, source, destination, execFileImpl) => {
-    await runDocker(dockerCommand, [...dockerPrefix, "cp", source, destination], execFileImpl, 60_000);
-};
-export const ensureContainerDirectories = async (dockerCommand, dockerPrefix, containerName, paths, execFileImpl) => {
-    if (paths.length === 0) {
-        return;
-    }
-    await runDocker(dockerCommand, [
-        ...dockerPrefix,
-        "exec",
-        "--user",
-        "root",
-        containerName,
-        "mkdir",
-        "-p",
-        ...paths
-    ], execFileImpl);
-};
-export const chownContainerPaths = async (dockerCommand, dockerPrefix, containerName, paths, execFileImpl) => {
-    if (paths.length === 0) {
-        return;
-    }
-    await runDocker(dockerCommand, [
-        ...dockerPrefix,
-        "exec",
-        "--user",
-        "root",
-        containerName,
-        "chown",
-        "-R",
-        "spawnfile:spawnfile",
-        ...paths
-    ], execFileImpl);
-};

package/dist/dev/index.d.ts

@@ -1,2 +1 @@
-export * from "./activity.js";
 export * from "./project.js";

package/dist/dev/index.js

@@ -1,2 +1 @@
-export * from "./activity.js";
 export * from "./project.js";

package/dist/dev/project.d.ts

@@ -1,25 +1,11 @@
 import { type UpProjectOptions, type UpProjectResult } from "../compiler/index.js";
 import { type DeploymentRecord } from "../deployment/index.js";
 import { type DevExecFile } from "./docker.js";
-export declare const PI_CONTROL_URL = "http://127.0.0.1:19690";
 export interface DevProjectOptions {
     deploymentName?: string;
     dockerCommand?: string;
     outputDirectory?: string;
 }
-export interface DevApplyProjectOptions extends DevProjectOptions {
-    agent: string;
-    execFile?: DevExecFile;
-    restart?: boolean;
-}
-export interface DevApplyProjectResult {
-    agentId: string;
-    bridgeStarted: boolean;
-    containerName: string;
-    deploymentName: string;
-    existingAgent: boolean;
-    outputDirectory: string;
-}
 export interface DevStopProjectResult {
     containerName: string;
     deploymentName: string;
@@ -35,8 +21,6 @@ export declare const resolveDevOutputDirectory: (inputPath: string, outputDirect
  */
 export declare const devUpProject: (inputPath: string, options?: UpProjectOptions) => Promise<UpProjectResult>;
 export declare const selectDeploymentRecord: (outputDirectory: string, deploymentName?: string) => Promise<DeploymentRecord>;
-export declare const devApplyProject: (inputPath: string, options: DevApplyProjectOptions) => Promise<DevApplyProjectResult>;
-export declare const devRestartProject: (inputPath: string, options: DevApplyProjectOptions) => Promise<DevApplyProjectResult>;
 export declare const devStopProject: (inputPath: string, options?: DevProjectOptions & {
     execFile?: DevExecFile;
 }) => Promise<DevStopProjectResult>;

package/dist/dev/project.js

@@ -1,12 +1,10 @@
 import path from "node:path";
-import { readFile } from "node:fs/promises";
 import { buildCompilePlan, upProject } from "../compiler/index.js";
 import { listDeploymentRecords, normalizeDeploymentName } from "../deployment/index.js";
 import { SpawnfileError } from "../shared/index.js";
 import { DEV_DEPLOYMENT_LINEAGE_NAMESPACE } from "../compiler/deploymentLineage.js";
-import { chownContainerPaths, compileForDevApply, copyIntoContainer, defaultExecFile, dockerArgsForRecord, ensureContainerDirectories, firstContainerName, runDocker } from "./docker.js";
+import { defaultExecFile, dockerArgsForRecord, firstContainerName, runDocker } from "./docker.js";
 const DEV_OUTPUT_DIRECTORY = ".spawn-dev";
-export const PI_CONTROL_URL = "http://127.0.0.1:19690";
 export const resolveDevOutputDirectory = async (inputPath, outputDirectory) => {
     if (outputDirectory) {
         return path.resolve(outputDirectory);
@@ -45,131 +43,6 @@ export const selectDeploymentRecord = async (outputDirectory, deploymentName) =>
     }
     return records[0].record;
 };
-const readJson = async (filePath) => JSON.parse(await readFile(filePath, "utf8"));
-const rootfsPath = (outputDirectory, containerPath) => path.join(outputDirectory, "container", "rootfs", containerPath.replace(/^\/+/u, ""));
-const matchesAgent = (agent, input) => agent.slug === input || agent.id === input || agent.name === input || agent.id === `agent:${input}`;
-const selectPiAgent = async (compileResult, agentInput) => {
-    const instance = compileResult.report.container?.runtime_instances.find((candidate) => candidate.id === "pi-app" && ["daimon", "pi"].includes(candidate.runtime));
-    if (!instance?.config_path || !instance.workspace_path || !instance.home_path) {
-        throw new SpawnfileError("runtime_error", "Compiled output does not contain a generated Daimon runtime instance");
-    }
-    const configPath = rootfsPath(compileResult.outputDirectory, instance.config_path);
-    const config = await readJson(configPath);
-    const agent = (config.agents ?? []).find((candidate) => matchesAgent(candidate, agentInput));
-    if (!agent) {
-        throw new SpawnfileError("validation_error", `Daimon agent "${agentInput}" was not found in compiled output`);
-    }
-    return {
-        agent,
-        configPath,
-        instanceRoot: path.posix.dirname(instance.home_path),
-        remoteConfigPath: instance.config_path,
-        remoteWorkspaceRoot: `${instance.workspace_path}/agents`,
-        workspacePath: rootfsPath(compileResult.outputDirectory, `${instance.workspace_path}/agents/${agent.slug}`)
-    };
-};
-const selectMoltnetNodes = async (result, agent) => {
-    const nodePlans = result.report.container?.moltnet?.node_plans ?? [];
-    const matches = [];
-    for (const plan of nodePlans) {
-        const configPath = rootfsPath(result.outputDirectory, plan.config_path);
-        const config = await readJson(configPath);
-        const attachment = (config.attachments ?? []).find((candidate) => {
-            const id = candidate.agent?.id ?? "";
-            const name = candidate.agent?.name ?? "";
-            return id === agent.slug || id === agent.id || name === agent.name;
-        });
-        if (attachment?.agent?.id) {
-            matches.push({
-                configPath,
-                remotePath: plan.config_path,
-                ...(attachment.moltnet?.token_path
-                    ? { tokenDirectory: path.posix.dirname(attachment.moltnet.token_path) }
-                    : {})
-            });
-        }
-    }
-    return matches;
-};
-const selectManagedMoltnetServers = (result) => (result.report.container?.moltnet?.server_plans ?? [])
-    .filter((plan) => plan.mode === "managed" && Boolean(plan.config_path))
-    .map((plan) => ({
-    configPath: rootfsPath(result.outputDirectory, plan.config_path),
-    remotePath: plan.config_path
-}));
-const shellQuote = (value) => `'${value.replaceAll("'", "'\"'\"'")}'`;
-const listRunningPiAgents = async (dockerCommand, dockerPrefix, containerName, execFileImpl) => {
-    const stdout = await runDocker(dockerCommand, [...dockerPrefix, "exec", containerName, "curl", "-fsS", `${PI_CONTROL_URL}/spawnfile/agents`], execFileImpl);
-    const parsed = JSON.parse(stdout);
-    return parsed.agents ?? [];
-};
-const loadPiAgent = async (dockerCommand, dockerPrefix, containerName, slug, action, execFileImpl) => {
-    await runDocker(dockerCommand, [
-        ...dockerPrefix,
-        "exec",
-        containerName,
-        "curl",
-        "-fsS",
-        "-X",
-        "POST",
-        "-H",
-        "content-type: application/json",
-        "--data",
-        JSON.stringify({ slug }),
-        `${PI_CONTROL_URL}/spawnfile/agents/${action}`
-    ], execFileImpl, 120_000);
-};
-export const devApplyProject = async (inputPath, options) => {
-    const outputDirectory = await resolveDevOutputDirectory(inputPath, options.outputDirectory);
-    const record = await selectDeploymentRecord(outputDirectory, options.deploymentName);
-    const dockerCommand = options.dockerCommand ?? "docker";
-    const dockerPrefix = dockerArgsForRecord(record);
-    const containerName = firstContainerName(record);
-    const execFileImpl = options.execFile ?? defaultExecFile;
-    const existingAgents = await listRunningPiAgents(dockerCommand, dockerPrefix, containerName, execFileImpl);
-    const compileResult = await compileForDevApply(inputPath, outputDirectory, record, dockerCommand, execFileImpl);
-    const { agent, configPath, instanceRoot, remoteConfigPath, remoteWorkspaceRoot, workspacePath } = await selectPiAgent(compileResult, options.agent);
-    const nodes = await selectMoltnetNodes(compileResult, agent);
-    const serverConfigs = selectManagedMoltnetServers(compileResult);
-    const existingAgent = existingAgents.some((candidate) => matchesAgent(candidate, agent.slug));
-    await copyIntoContainer(dockerCommand, dockerPrefix, configPath, `${containerName}:${remoteConfigPath}`, execFileImpl);
-    await copyIntoContainer(dockerCommand, dockerPrefix, workspacePath, `${containerName}:${remoteWorkspaceRoot}`, execFileImpl);
-    for (const node of nodes) {
-        await copyIntoContainer(dockerCommand, dockerPrefix, node.configPath, `${containerName}:${node.remotePath}`, execFileImpl);
-    }
-    for (const serverConfig of serverConfigs) {
-        await copyIntoContainer(dockerCommand, dockerPrefix, serverConfig.configPath, `${containerName}:${serverConfig.remotePath}`, execFileImpl);
-    }
-    const tokenDirectories = nodes
-        .map((node) => node.tokenDirectory)
-        .filter((directory) => Boolean(directory));
-    await ensureContainerDirectories(dockerCommand, dockerPrefix, containerName, tokenDirectories, execFileImpl);
-    await chownContainerPaths(dockerCommand, dockerPrefix, containerName, [
-        instanceRoot,
-        ...nodes.flatMap((node) => [
-            node.remotePath,
-            ...(node.tokenDirectory ? [node.tokenDirectory] : [])
-        ]),
-        ...serverConfigs.map((serverConfig) => serverConfig.remotePath)
-    ], execFileImpl);
-    await loadPiAgent(dockerCommand, dockerPrefix, containerName, agent.slug, options.restart === true ? "restart" : "load", execFileImpl);
-    if (!existingAgent) {
-        for (const node of nodes) {
-            const prepare = node.tokenDirectory ? `mkdir -p ${shellQuote(node.tokenDirectory)} && ` : "";
-            const command = `${prepare}/usr/local/bin/moltnet node ${shellQuote(node.remotePath)}`;
-            await runDocker(dockerCommand, [...dockerPrefix, "exec", "-d", "--user", "spawnfile", containerName, "sh", "-lc", command], execFileImpl);
-        }
-    }
-    return {
-        agentId: agent.id,
-        bridgeStarted: !existingAgent && nodes.length > 0,
-        containerName,
-        deploymentName: record.name,
-        existingAgent,
-        outputDirectory
-    };
-};
-export const devRestartProject = async (inputPath, options) => devApplyProject(inputPath, { ...options, restart: true });
 export const devStopProject = async (inputPath, options = {}) => {
     const outputDirectory = await resolveDevOutputDirectory(inputPath, options.outputDirectory);
     const record = await selectDeploymentRecord(outputDirectory, options.deploymentName);

package/dist/distribution/distributionReportSchema.js

@@ -42,7 +42,7 @@ const runtimeInstanceSchema = z.object({
     node_ids: z.array(z.string()),
     published_port: portSchema.nullable(),
     runtime: z.string().min(1),
-    // node id -> persistent mount id for per-agent telemetry; every pi/Daimon
+    // node id -> persistent mount id for per-agent telemetry; every Daimon
     // image this compiler builds carries it, so a strict schema without it
     // refused image-mode `up` of the compiler's own output.
     telemetry_mount_ids: z.record(z.string().min(1), instanceIdSchema).optional(),

package/dist/distribution/imageRuntimeAuth.js

@@ -1,3 +1,4 @@
+import { daimonGatewayBootstrapMountPath } from "../runtime/daimon/gateway.js";
 import { DAIMON_ENGINE_DESCRIPTORS } from "../runtime/daimon/engines.js";
 import path from "node:path";
 import { loadImportedClaudeCodeCredential, loadImportedCodexCredential } from "../auth/index.js";
@@ -60,7 +61,7 @@ export const prepareDaimonImageAuthMounts = async (instance, environment, authPr
         const source = daimonSourcePathForEngine(descriptor.id, environment, authProfile, descriptor);
         const ownerUid = await assertSafeDaimonSourceFile(source, descriptor.id, descriptor.auth.maxCredentialBytes, descriptor);
         assertDaimonCredentialContainerOwner(ownerUid, descriptor.id, containerCredentialUid);
-        mounts.push("-v", `${source}:${descriptor.auth.realm.bootstrapMountPath}:ro`);
+        mounts.push("-v", `${source}:${daimonGatewayBootstrapMountPath(descriptor.auth.realm)}:ro`);
     }
     for (const descriptor of descriptors) {
         if (descriptor.auth.staging !== "broker-realm")
@@ -69,7 +70,7 @@ export const prepareDaimonImageAuthMounts = async (instance, environment, authPr
         // do not require ownership by the eventual organization uid.
         const source = daimonSourcePathForEngine(descriptor.id, environment, null, descriptor);
         await assertSafeDaimonSourceFile(source, descriptor.id, descriptor.auth.maxCredentialBytes, descriptor);
-        mounts.push("-v", `${source}:${descriptor.auth.realm.bootstrapMountPath}:ro`);
+        mounts.push("-v", `${source}:${daimonGatewayBootstrapMountPath(descriptor.auth.realm)}:ro`);
     }
     for (const descriptor of descriptors) {
         if (descriptor.auth.staging !== "secret-service")

package/dist/manifest/renderSpawnfile.js

@@ -31,7 +31,8 @@ const orderModelTarget = (target) => {
         ["provider", target.provider],
         ["name", target.name],
         ["auth", orderModelEntryAuth(target.auth)],
-        ["endpoint", target.endpoint]
+        ["endpoint", target.endpoint],
+        ["reasoning_effort", target.reasoning_effort]
     ]);
 };
 const orderExecution = (execution) => {