spawnfile 0.1.5 → 0.1.7

package/README.md

@@ -24,6 +24,7 @@ Pairs with [**Moltnet**](https://moltnet.dev) as the first provider for `team.ne
 
 ```bash
 npm install -g spawnfile
+spawnfile --version
 spawnfile --help
 ```
 

package/dist/cli/runCli.js

@@ -1,3 +1,4 @@
+import { readFileSync } from "node:fs";
 import { Command } from "commander";
 import { importClaudeCodeAuth, importCodexAuth, importEnvFile, requireAuthProfile } from "../auth/index.js";
 import { addAgentProject, addProjectSurface, addProjectModelFallback, addSubagentProject, addTeamProject, buildOrganizationView, buildCompilePlan, buildProject, clearProjectModelFallbacks, compileProject, initProject, upProject, removeProjectSurface, runProject, setProjectPrimaryModel, setProjectRuntime, setProjectSurfaceAccess, showProjectSurfaces, syncProjectAuth } from "../compiler/index.js";
@@ -8,6 +9,11 @@ import { registerModelCommands } from "./modelCommands.js";
 import { registerRuntimeCommands } from "./runtimeCommands.js";
 import { registerSurfaceCommands } from "./surfaceCommands.js";
 import { registerViewCommand } from "./viewCommand.js";
+const packageJsonPath = new URL("../../package.json", import.meta.url);
+const readPackageVersion = () => {
+    const packageJson = JSON.parse(readFileSync(packageJsonPath, "utf8"));
+    return typeof packageJson.version === "string" ? packageJson.version : "0.0.0";
+};
 const createDefaultStreams = () => ({
     stderr: (message) => process.stderr.write(`${message}\n`),
     stdout: (message) => process.stdout.write(`${message}\n`)
@@ -77,7 +83,7 @@ export const runCli = async (argv, optionsOrStreams, handlerOverrides = {}) => {
     const streams = cliOptions.streams;
     const handlers = { ...createDefaultHandlers(), ...cliOptions.handlers };
     const program = new Command();
-    program.name("spawnfile").description("Spawnfile v0.1 compiler");
+    program.name("spawnfile").description("Spawnfile v0.1 compiler").version(readPackageVersion());
     program.exitOverride();
     program.configureOutput({
         outputError: (message, write) => write(message),

package/dist/compiler/containerArtifacts.js

@@ -15,6 +15,14 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
         .filter((variable) => variable.required && variable.categories.includes("runtime"))
         .map((variable) => variable.name)
         .sort();
+    const persistentMounts = (options.moltnet?.persistentMounts ?? [])
+        .map((mount) => ({
+        id: mount.id,
+        mount_path: mount.mountPath,
+        reason: mount.reason,
+        volume_name: mount.volumeName
+    }))
+        .sort((left, right) => left.id.localeCompare(right.id));
     const files = [
         ...createRootfsFiles(runtimePlans),
         ...(options.moltnet?.files ?? []),
@@ -22,7 +30,8 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
             content: await renderDockerfile(runtimePlans, {
                 hasMoltnet: Boolean(options.moltnet),
                 hasStagedMoltnetBinaries: options.hasStagedMoltnetBinaries,
-                moltnetPublishedPorts: options.moltnet?.publishedPorts ?? []
+                moltnetPublishedPorts: options.moltnet?.publishedPorts ?? [],
+                persistentMountPaths: persistentMounts.map((mount) => mount.mount_path)
             }),
             path: "Dockerfile"
         },
@@ -95,6 +104,7 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
             runtime_secrets_required: runtimeSecretsRequired,
             runtimes_installed: runtimesInstalled,
             secrets_required: requiredSecrets,
+            ...(persistentMounts.length > 0 ? { persistent_mounts: persistentMounts } : {}),
             ...(workspaceResources.length > 0 ? { workspace_resources: workspaceResources } : {})
         }
     };

package/dist/compiler/containerArtifactsRender.js

@@ -6,12 +6,30 @@ import { MOLTNET_BIN_DIRECTORY, MOLTNET_BINARY_NAMES } from "./moltnetBinaries.j
 const CONTAINER_ROOTFS_ROOT = "container/rootfs";
 const GATEWAY_PORT_PLACEHOLDER = "<gateway-port>";
 const MOLTNET_INSTALL_SCRIPT_URL = "https://moltnet.dev/install.sh";
+const MOLTNET_RELEASE_METADATA_URL = "https://api.github.com/repos/noopolis/moltnet/releases/latest";
 const WORKSPACE_PLACEHOLDER = "<workspace-path>";
 const shellQuote = (value) => `'${value.replace(/'/g, `'\"'\"'`)}'`;
 const extractNodeMajorVersion = (image) => Number(image.match(/^node:(\d+)/)?.[1] ?? "0");
 const createPackageInstallCommand = (packages) => `RUN apt-get update && apt-get install -y --no-install-recommends ${packages.join(" ")} && rm -rf /var/lib/apt/lists/*`;
 const createNpmPackageInstallCommand = (packages) => `RUN npm install -g --omit=dev --no-fund --no-audit ${packages.join(" ")}`;
 const createPipxPackageInstallCommand = (packages) => `RUN PIPX_HOME=/opt/pipx PIPX_BIN_DIR=/usr/local/bin pipx install ${packages.join(" ")}`;
+const createStateOwnershipCommand = (persistentMountPaths = []) => {
+    const mountPaths = [...new Set(persistentMountPaths)].sort();
+    const mkdirPaths = [...new Set(["/var/lib/spawnfile", ...mountPaths])].sort();
+    const markerCommands = mountPaths.map((mountPath) => `touch ${shellQuote(path.posix.join(mountPath, ".spawnfile-volume-init"))}`);
+    const chownPaths = [
+        ...new Set([
+            "/var/lib/spawnfile",
+            "/opt/spawnfile",
+            ...mountPaths.filter((mountPath) => !mountPath.startsWith("/var/lib/spawnfile/"))
+        ])
+    ].sort();
+    return [
+        `mkdir -p ${mkdirPaths.map(shellQuote).join(" ")}`,
+        ...markerCommands,
+        `chown -R spawnfile:spawnfile ${chownPaths.map(shellQuote).join(" ")}`
+    ].join(" && ");
+};
 const dedupePackages = (packages) => {
     const seen = new Map();
     for (const currentPackage of packages) {
@@ -163,7 +181,7 @@ export const renderDockerfile = async (runtimePlans, options = {}) => {
         lines.push(`COPY ${MOLTNET_BIN_DIRECTORY}/ /usr/local/bin/`, `RUN chmod +x ${MOLTNET_BINARY_NAMES.map((binaryName) => `/usr/local/bin/${binaryName}`).join(" ")}`, "");
     }
     else if (options.hasMoltnet) {
-        lines.push(`RUN MOLTNET_INSTALL_DIR=/usr/local/bin sh -c ${shellQuote(`curl -fsSL ${MOLTNET_INSTALL_SCRIPT_URL} | sh`)}`, "");
+        lines.push(`ADD ${MOLTNET_RELEASE_METADATA_URL} /tmp/spawnfile-moltnet-release.json`, `RUN MOLTNET_RELEASE="$${"("}sed -n 's/.*\\"tag_name\\": *\\"\\([^\\"]*\\)\\".*/\\1/p' /tmp/spawnfile-moltnet-release.json | head -n 1${")"}" && echo "Installing Moltnet $${"{MOLTNET_RELEASE:-latest}"}" && MOLTNET_INSTALL_DIR=/usr/local/bin sh -c ${shellQuote(`curl -fsSL ${MOLTNET_INSTALL_SCRIPT_URL} | sh`)}`, "");
     }
     for (const recipe of runtimeRecipes) {
         for (const copyCommand of recipe.copyCommands) {
@@ -176,7 +194,7 @@ export const renderDockerfile = async (runtimePlans, options = {}) => {
     }
     lines.push('RUN if ! id -u spawnfile >/dev/null 2>&1; then useradd --create-home --home-dir /home/spawnfile --shell /bin/bash spawnfile; fi', "");
     lines.push("COPY container/rootfs/ /", "COPY .env.example /opt/spawnfile/.env.example", 'COPY entrypoint.sh /opt/spawnfile/entrypoint.sh', "RUN chmod +x /opt/spawnfile/entrypoint.sh");
-    lines.push("RUN mkdir -p /var/lib/spawnfile && chown -R spawnfile:spawnfile /var/lib/spawnfile /opt/spawnfile");
+    lines.push(`RUN ${createStateOwnershipCommand(options.persistentMountPaths)}`);
     if (exposedPorts.length > 0) {
         lines.push(`EXPOSE ${exposedPorts.join(" ")}`);
     }

package/dist/compiler/containerEntrypointRender.d.ts

@@ -8,5 +8,6 @@ export interface EntrypointOptions {
         serverPlans: MoltnetArtifacts["serverPlans"];
     };
     moltnetPublishedPorts?: number[];
+    persistentMountPaths?: string[];
 }
 export declare const renderEntrypoint: (runtimePlans: RuntimeTargetPlan[], requiredSecrets: string[], options?: EntrypointOptions) => string;

package/dist/compiler/containerEntrypointRender.js

@@ -1,4 +1,5 @@
 import path from "node:path";
+import { resolveMoltnetStorePath } from "./moltnetConfigLowering.js";
 import { createWorkspaceResourceCommands, createWorkspaceResourceShellFunctions } from "./containerWorkspaceResourceRender.js";
 const MOLTNET_SERVER_DATA_DIRECTORY = "/var/lib/spawnfile/moltnet/servers";
 const shellQuote = (value) => `'${value.replace(/'/g, `'\"'\"'`)}'`;
@@ -36,6 +37,17 @@ const createAuthSetupCommands = (plan) => {
     }
     return [`configure_codex_api_key_auth ${shellQuote(plan.instancePaths.homePath)}`];
 };
+const createMoltnetStorePrepareCommands = (serverPlan) => {
+    const server = serverPlan.server;
+    if (server.mode !== "managed" || server.store.kind === "memory" || server.store.kind === "postgres") {
+        return [];
+    }
+    const storePath = resolveMoltnetStorePath(serverPlan.networkId, server.store);
+    if (!storePath) {
+        return [];
+    }
+    return [`mkdir -p ${shellQuote(path.posix.dirname(storePath))}`];
+};
 const resolveStartCommand = (plan) => plan.meta.startCommand
     .map((token) => token
     .replaceAll("<runtime-root>", plan.runtimeRoot)
@@ -174,7 +186,7 @@ export const renderEntrypoint = (runtimePlans, requiredSecrets, options = {}) =>
         for (const patch of serverPlan.secretPatches) {
             lines.push(`apply_json_env_value ${shellQuote(serverPlan.configPath)} ${shellQuote(patch.envName)} ${shellQuote(patch.jsonPath)}`);
         }
-        lines.push(`MOLTNET_CONFIG=${shellQuote(serverPlan.configPath)} /usr/local/bin/moltnet &`, 'PIDS+=("$!")', "");
+        lines.push(...createMoltnetStorePrepareCommands(serverPlan), `MOLTNET_CONFIG=${shellQuote(serverPlan.configPath)} /usr/local/bin/moltnet &`, 'PIDS+=("$!")', "");
     }
     for (const serverPlan of managedMoltnetServerPlans) {
         if (!serverPlan.port) {

package/dist/compiler/moltnetArtifacts.d.ts

@@ -23,9 +23,16 @@ export interface MoltnetNodePlan {
     configPath: string;
     networkId: string;
 }
+export interface MoltnetPersistentMount {
+    id: string;
+    mountPath: string;
+    reason: string;
+    volumeName: string;
+}
 export interface MoltnetArtifacts {
     files: EmittedFile[];
     nodePlans: MoltnetNodePlan[];
+    persistentMounts: MoltnetPersistentMount[];
     ports: number[];
     publishedPorts: number[];
     serverPlans: MoltnetServerPlan[];

package/dist/compiler/moltnetArtifacts.js

@@ -1,10 +1,20 @@
 import { SpawnfileError } from "../shared/index.js";
-import { createMoltnetNativeServerConfig, createMoltnetNodeConfigPath, createMoltnetServerConfigPath, resolveMoltnetBaseUrl, resolveMoltnetClientAuth } from "./moltnetConfigLowering.js";
+import { createMoltnetOpenTokenDirectory, createMoltnetNativeServerConfig, createMoltnetNodeConfigPath, createMoltnetServerConfigPath, resolveMoltnetBaseUrl, resolveMoltnetClientAuth, resolveMoltnetStorePersistenceMountPath } from "./moltnetConfigLowering.js";
 import { listConcreteMoltnetRoomMemberIds } from "./moltnetRoomMemberships.js";
 import { resolveRuntimeConfig } from "./moltnetRuntimeConfig.js";
+import { createShortHash, slugify } from "./helpers.js";
 const DEFAULT_MOLTNET_PORT = 8787;
 const ROOTFS_PREFIX = "container/rootfs";
 const createServerKey = (networkId) => networkId;
+const truncateSegment = (value, maxLength) => value.length > maxLength ? value.slice(0, maxLength).replace(/[-_.]+$/u, "") : value;
+const createPersistentVolumeName = (planRoot, id, explicitName) => {
+    if (explicitName && explicitName.trim().length > 0) {
+        return explicitName.trim();
+    }
+    const project = truncateSegment(slugify(planRoot.split("/").slice(-2, -1)[0] ?? "project") || "project", 32);
+    const suffix = truncateSegment(slugify(id) || "state", 48);
+    return `spawnfile-${project}-${suffix}-${createShortHash(`${planRoot}:${id}`)}`;
+};
 const toContainerRootfsPath = (rootfsPath) => `/${rootfsPath.replace(`${ROOTFS_PREFIX}/`, "")}`;
 const isNetworkHttpEnabled = (network) => network.server?.mode === "managed" && network.server.human_ingress === true;
 const resolveNetworkPort = (network, fallbackPort) => network.server?.mode === "managed" ? network.server.listen.port : fallbackPort;
@@ -78,6 +88,17 @@ export const generateMoltnetArtifacts = async (plan) => {
     const nodePlans = [];
     const nodePlanKeys = new Set();
     const configFiles = [];
+    const persistentMounts = new Map();
+    const addPersistentMount = (mount) => {
+        const existing = persistentMounts.get(mount.id);
+        if (!existing) {
+            persistentMounts.set(mount.id, mount);
+            return;
+        }
+        if (existing.mountPath !== mount.mountPath || existing.volumeName !== mount.volumeName) {
+            throw new SpawnfileError("validation_error", `Moltnet persistent mount ${mount.id} resolves to conflicting targets`);
+        }
+    };
     for (const teamNode of teamNodes) {
         for (const network of teamNode.value.networks ?? []) {
             const serverPlan = serverPlans.get(createServerKey(network.id));
@@ -96,6 +117,20 @@ export const generateMoltnetArtifacts = async (plan) => {
                 mode: 0o600,
                 path: createMoltnetServerConfigPath(serverPlan.id)
             });
+            const storeMountPath = resolveMoltnetStorePersistenceMountPath(network.id, network.server.store);
+            if (storeMountPath) {
+                const mountId = `moltnet-${network.id}-store`;
+                const store = network.server.store;
+                const volumeName = store.kind === "sqlite" || store.kind === "json"
+                    ? store.persistence?.name
+                    : undefined;
+                addPersistentMount({
+                    id: mountId,
+                    mountPath: storeMountPath,
+                    reason: `managed Moltnet ${network.server.store.kind} store for ${network.id}`,
+                    volumeName: createPersistentVolumeName(plan.root, mountId, volumeName)
+                });
+            }
         }
     }
     for (const node of plan.nodes) {
@@ -134,17 +169,28 @@ export const generateMoltnetArtifacts = async (plan) => {
                 throw new SpawnfileError("validation_error", `Duplicate Moltnet node attachment for ${attachment.network}/${attachment.memberId}`);
             }
             nodePlanKeys.add(nodePlanKey);
-            const clientAuth = resolveMoltnetClientAuth(network.server, attachment.network, attachment.memberId);
+            const clientAuth = resolveMoltnetClientAuth(network.server, attachment.network, attachment.memberId, node.slug);
             const usesPerAttachmentOpenToken = clientAuth.mode === "open" &&
                 clientAuth.staticToken !== true &&
                 Boolean(clientAuth.tokenEnv || clientAuth.tokenPath);
+            if (usesPerAttachmentOpenToken && clientAuth.tokenPath) {
+                const mountId = `agent-${node.slug}-moltnet-tokens`;
+                addPersistentMount({
+                    id: mountId,
+                    mountPath: createMoltnetOpenTokenDirectory(node.slug),
+                    reason: `Moltnet open-mode generated agent tokens for ${agentNode.name}`,
+                    volumeName: createPersistentVolumeName(plan.root, mountId)
+                });
+            }
             configFiles.push({
                 content: `${JSON.stringify({
                     version: "moltnet.node.v1",
                     moltnet: {
                         base_url: serverPlan.baseUrl,
                         network_id: attachment.network,
-                        auth_mode: clientAuth.mode,
+                        ...(clientAuth.mode === "none"
+                            ? {}
+                            : { auth_mode: clientAuth.mode }),
                         ...(clientAuth.staticToken
                             ? { static_token: true }
                             : {}),
@@ -210,6 +256,7 @@ export const generateMoltnetArtifacts = async (plan) => {
     return {
         files: configFiles,
         nodePlans: nodePlans.sort((left, right) => left.configPath.localeCompare(right.configPath)),
+        persistentMounts: [...persistentMounts.values()].sort((left, right) => left.id.localeCompare(right.id)),
         ports: [...new Set(managedServerPlans.map((serverPlan) => serverPlan.port).filter((port) => port !== undefined))].sort((left, right) => left - right),
         publishedPorts: [
             ...new Set(teamNodes

package/dist/compiler/moltnetConfigLowering.d.ts

@@ -22,15 +22,24 @@ export interface MoltnetNativeServerConfigInput {
         mode: "managed";
     }>;
 }
-export declare const createMoltnetOpenTokenPath: (networkId: string, memberId: string) => string;
+type ManagedMoltnetStore = Extract<TeamNetworkServer, {
+    mode: "managed";
+}>["store"];
+export declare const createMoltnetOpenTokenDirectory: (agentSlug: string) => string;
+export declare const createMoltnetOpenTokenPath: (networkId: string, memberId: string, agentSlug?: string) => string;
+export declare const createMoltnetNetworkStateDirectory: (networkId: string) => string;
+export declare const createDefaultMoltnetStorePath: (networkId: string, kind: "json" | "sqlite", mountPath?: string) => string;
+export declare const resolveMoltnetStorePath: (networkId: string, store: ManagedMoltnetStore) => string | null;
+export declare const resolveMoltnetStorePersistenceMountPath: (networkId: string, store: ManagedMoltnetStore) => string | null;
 export declare const createMoltnetServerConfigPath: (serverId: string) => string;
 export declare const createMoltnetNodeConfigPath: (teamSlug: string, networkId: string, agentId: string) => string;
 export declare const renderMoltnetListenAddr: (server: Extract<TeamNetworkServer, {
     mode: "managed";
 }>) => string;
 export declare const resolveMoltnetBaseUrl: (server: TeamNetworkServer) => string;
-export declare const resolveMoltnetClientAuth: (server: TeamNetworkServer, networkId: string, memberId: string) => MoltnetClientAuthPlan;
+export declare const resolveMoltnetClientAuth: (server: TeamNetworkServer, networkId: string, memberId: string, agentSlug?: string) => MoltnetClientAuthPlan;
 export declare const createMoltnetNativeServerConfig: ({ networkId, networkName, rooms, server }: MoltnetNativeServerConfigInput) => {
     config: Record<string, unknown>;
     secretPatches: MoltnetSecretPatch[];
 };
+export {};

package/dist/compiler/moltnetConfigLowering.js

@@ -1,6 +1,34 @@
 const pathSafeSegment = (value) => value.replace(/[^A-Za-z0-9_.-]+/g, "-").replace(/^-+|-+$/g, "") || "item";
 const isIpv6Literal = (value) => value.includes(":");
-export const createMoltnetOpenTokenPath = (networkId, memberId) => `/var/lib/spawnfile/moltnet/tokens/${pathSafeSegment(networkId)}/${pathSafeSegment(memberId)}.token`;
+const normalizePosixPath = (value) => value.replace(/\/+/g, "/").replace(/\/+$/u, "") || "/";
+export const createMoltnetOpenTokenDirectory = (agentSlug) => `/var/lib/spawnfile/agents/${pathSafeSegment(agentSlug)}/state/moltnet`;
+export const createMoltnetOpenTokenPath = (networkId, memberId, agentSlug = memberId) => `${createMoltnetOpenTokenDirectory(agentSlug)}/${pathSafeSegment(networkId)}-${pathSafeSegment(memberId)}.token`;
+export const createMoltnetNetworkStateDirectory = (networkId) => `/var/lib/spawnfile/moltnet/networks/${pathSafeSegment(networkId)}`;
+export const createDefaultMoltnetStorePath = (networkId, kind, mountPath) => {
+    const directory = mountPath
+        ? normalizePosixPath(mountPath)
+        : createMoltnetNetworkStateDirectory(networkId);
+    return `${directory}/${kind === "sqlite" ? "moltnet.sqlite" : "state.json"}`;
+};
+export const resolveMoltnetStorePath = (networkId, store) => {
+    if (store.kind !== "sqlite" && store.kind !== "json") {
+        return null;
+    }
+    return store.path ?? createDefaultMoltnetStorePath(networkId, store.kind, store.persistence?.mount);
+};
+export const resolveMoltnetStorePersistenceMountPath = (networkId, store) => {
+    if (store.kind !== "sqlite" && store.kind !== "json") {
+        return null;
+    }
+    if (store.persistence?.mode === "ephemeral") {
+        return null;
+    }
+    if (store.persistence?.mount) {
+        return normalizePosixPath(store.persistence.mount);
+    }
+    const storePath = resolveMoltnetStorePath(networkId, store);
+    return storePath ? storePath.slice(0, storePath.lastIndexOf("/")) || "/" : null;
+};
 export const createMoltnetServerConfigPath = (serverId) => `container/rootfs/var/lib/spawnfile/moltnet/servers/${pathSafeSegment(serverId)}/Moltnet.json`;
 export const createMoltnetNodeConfigPath = (teamSlug, networkId, agentId) => `container/rootfs/var/lib/spawnfile/moltnet/nodes/${pathSafeSegment(teamSlug)}-${pathSafeSegment(networkId)}-${pathSafeSegment(agentId)}.json`;
 export const renderMoltnetListenAddr = (server) => {
@@ -22,7 +50,7 @@ export const resolveMoltnetBaseUrl = (server) => {
             : bind;
     return `http://${host}:${server.listen.port}`;
 };
-export const resolveMoltnetClientAuth = (server, networkId, memberId) => {
+export const resolveMoltnetClientAuth = (server, networkId, memberId, agentSlug) => {
     if (server.auth.mode === "none") {
         return { mode: "none" };
     }
@@ -30,7 +58,7 @@ export const resolveMoltnetClientAuth = (server, networkId, memberId) => {
     if (server.auth.mode === "open" && !client) {
         return {
             mode: "open",
-            tokenPath: createMoltnetOpenTokenPath(networkId, memberId)
+            tokenPath: createMoltnetOpenTokenPath(networkId, memberId, agentSlug)
         };
     }
     if (!client) {
@@ -47,12 +75,12 @@ export const resolveMoltnetClientAuth = (server, networkId, memberId) => {
         ...(client.token_path ? { tokenPath: client.token_path } : {})
     };
 };
-const storageConfigFor = (store) => {
+const storageConfigFor = (networkId, store) => {
     switch (store.kind) {
         case "sqlite":
-            return { kind: "sqlite", sqlite: { path: store.path } };
+            return { kind: "sqlite", sqlite: { path: resolveMoltnetStorePath(networkId, store) } };
         case "json":
-            return { kind: "json", json: { path: store.path } };
+            return { kind: "json", json: { path: resolveMoltnetStorePath(networkId, store) } };
         case "postgres":
             return { kind: "postgres", postgres: { dsn: "" } };
         case "memory":
@@ -112,7 +140,7 @@ export const createMoltnetNativeServerConfig = ({ networkId, networkName, rooms,
                 mode: server.auth.mode,
                 ...(tokens.length > 0 ? { tokens } : {})
             },
-            storage: storageConfigFor(server.store),
+            storage: storageConfigFor(networkId, server.store),
             rooms: rooms.map((room) => ({
                 id: room.id,
                 ...(room.name ? { name: room.name } : {}),

package/dist/compiler/runProject.js

@@ -140,6 +140,9 @@ export const createDockerRunInvocation = async (compileResult, imageTag, options
         for (const port of containerReport.ports) {
             args.push("-p", `${port}:${port}`);
         }
+        for (const mount of containerReport.persistent_mounts ?? []) {
+            args.push("-v", `${mount.volume_name}:${mount.mount_path}`);
+        }
         args.push("--env-file", envFilePath);
         args.push(...(await resolveAuthMountArgs(containerReport, options.authProfile ?? null)));
         args.push(...preparedRuntimeAuth.mountArgs);

package/dist/filesystem/paths.js

@@ -1,6 +1,5 @@
 import path from "node:path";
 import { SpawnfileError } from "../shared/index.js";
-const INVALID_PATH_SEGMENT = "..";
 export const assertPortableRelativePath = (inputPath) => {
     if (inputPath.includes("\\")) {
         throw new SpawnfileError("validation_error", `Paths must use forward slashes: ${inputPath}`);
@@ -8,10 +7,6 @@ export const assertPortableRelativePath = (inputPath) => {
     if (path.isAbsolute(inputPath)) {
         throw new SpawnfileError("validation_error", `Absolute paths are not allowed: ${inputPath}`);
     }
-    const segments = inputPath.split("/");
-    if (segments.includes(INVALID_PATH_SEGMENT)) {
-        throw new SpawnfileError("validation_error", `Path traversal is not allowed: ${inputPath}`);
-    }
 };
 export const getCanonicalManifestPath = (filePath) => path.resolve(filePath);
 export const getManifestPath = (inputPath) => path.basename(inputPath) === "Spawnfile"
@@ -21,10 +16,6 @@ export const getProjectRoot = (manifestPath) => path.dirname(manifestPath);
 export const resolveProjectPath = (manifestPath, relativePath) => {
     assertPortableRelativePath(relativePath);
     const projectRoot = getProjectRoot(manifestPath);
-    const resolved = path.resolve(projectRoot, relativePath);
-    if (!resolved.startsWith(projectRoot + path.sep) && resolved !== projectRoot) {
-        throw new SpawnfileError("validation_error", `Path escapes project root: ${relativePath}`);
-    }
-    return resolved;
+    return path.resolve(projectRoot, relativePath);
 };
 export const toPosixPath = (value) => value.split(path.sep).join("/");

package/dist/manifest/renderSpawnfileNetworks.js

@@ -10,6 +10,23 @@ const orderTeamAuthPairing = (pairing) => withDefinedEntries([
     ["remote_network_id", pairing.remote_network_id],
     ["remote_network_name", pairing.remote_network_name]
 ]);
+const orderTeamStore = (server) => server.mode === "managed"
+    ? withDefinedEntries([
+        ["kind", server.store.kind],
+        ["path", server.store.kind === "sqlite" || server.store.kind === "json" ? server.store.path : undefined],
+        [
+            "persistence",
+            (server.store.kind === "sqlite" || server.store.kind === "json") && server.store.persistence
+                ? withDefinedEntries([
+                    ["mode", server.store.persistence.mode],
+                    ["name", server.store.persistence.name],
+                    ["mount", server.store.persistence.mount]
+                ])
+                : undefined
+        ],
+        ["dsn_secret", server.store.kind === "postgres" ? server.store.dsn_secret : undefined]
+    ])
+    : undefined;
 const orderTeamAuth = (server) => withDefinedEntries([
     ["mode", server.mode],
     ["url", server.url],
@@ -32,7 +49,7 @@ const orderTeamAuth = (server) => withDefinedEntries([
             ]
         ])
     ],
-    ["store", server.mode === "managed" ? server.store : undefined],
+    ["store", orderTeamStore(server)],
     [
         "pairings",
         server.mode === "managed" && server.pairings

package/dist/manifest/schemas.d.ts

@@ -673,11 +673,27 @@ declare const teamManifestSchema: z.ZodObject<{
                 token_secret: z.ZodString;
             }, z.core.$strict>>>;
             store: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                path: z.ZodOptional<z.ZodString>;
+                persistence: z.ZodOptional<z.ZodObject<{
+                    mode: z.ZodEnum<{
+                        durable: "durable";
+                        ephemeral: "ephemeral";
+                    }>;
+                    mount: z.ZodOptional<z.ZodString>;
+                    name: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>>;
                 kind: z.ZodLiteral<"sqlite">;
-                path: z.ZodString;
             }, z.core.$strict>, z.ZodObject<{
+                path: z.ZodOptional<z.ZodString>;
+                persistence: z.ZodOptional<z.ZodObject<{
+                    mode: z.ZodEnum<{
+                        durable: "durable";
+                        ephemeral: "ephemeral";
+                    }>;
+                    mount: z.ZodOptional<z.ZodString>;
+                    name: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>>;
                 kind: z.ZodLiteral<"json">;
-                path: z.ZodString;
             }, z.core.$strict>, z.ZodObject<{
                 kind: z.ZodLiteral<"postgres">;
                 dsn_secret: z.ZodString;
@@ -1312,11 +1328,27 @@ export declare const manifestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
                 token_secret: z.ZodString;
             }, z.core.$strict>>>;
             store: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                path: z.ZodOptional<z.ZodString>;
+                persistence: z.ZodOptional<z.ZodObject<{
+                    mode: z.ZodEnum<{
+                        durable: "durable";
+                        ephemeral: "ephemeral";
+                    }>;
+                    mount: z.ZodOptional<z.ZodString>;
+                    name: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>>;
                 kind: z.ZodLiteral<"sqlite">;
-                path: z.ZodString;
             }, z.core.$strict>, z.ZodObject<{
+                path: z.ZodOptional<z.ZodString>;
+                persistence: z.ZodOptional<z.ZodObject<{
+                    mode: z.ZodEnum<{
+                        durable: "durable";
+                        ephemeral: "ephemeral";
+                    }>;
+                    mount: z.ZodOptional<z.ZodString>;
+                    name: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>>;
                 kind: z.ZodLiteral<"json">;
-                path: z.ZodString;
             }, z.core.$strict>, z.ZodObject<{
                 kind: z.ZodLiteral<"postgres">;
                 dsn_secret: z.ZodString;

package/dist/manifest/teamNetworkSchemas.d.ts

@@ -27,11 +27,27 @@ declare const teamNetworkAuthSchema: z.ZodObject<{
     }, z.core.$strict>>>;
 }, z.core.$strict>;
 declare const teamNetworkStoreSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    path: z.ZodOptional<z.ZodString>;
+    persistence: z.ZodOptional<z.ZodObject<{
+        mode: z.ZodEnum<{
+            durable: "durable";
+            ephemeral: "ephemeral";
+        }>;
+        mount: z.ZodOptional<z.ZodString>;
+        name: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
     kind: z.ZodLiteral<"sqlite">;
-    path: z.ZodString;
 }, z.core.$strict>, z.ZodObject<{
+    path: z.ZodOptional<z.ZodString>;
+    persistence: z.ZodOptional<z.ZodObject<{
+        mode: z.ZodEnum<{
+            durable: "durable";
+            ephemeral: "ephemeral";
+        }>;
+        mount: z.ZodOptional<z.ZodString>;
+        name: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
     kind: z.ZodLiteral<"json">;
-    path: z.ZodString;
 }, z.core.$strict>, z.ZodObject<{
     kind: z.ZodLiteral<"postgres">;
     dsn_secret: z.ZodString;
@@ -80,11 +96,27 @@ declare const teamNetworkServerSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         token_secret: z.ZodString;
     }, z.core.$strict>>>;
     store: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        path: z.ZodOptional<z.ZodString>;
+        persistence: z.ZodOptional<z.ZodObject<{
+            mode: z.ZodEnum<{
+                durable: "durable";
+                ephemeral: "ephemeral";
+            }>;
+            mount: z.ZodOptional<z.ZodString>;
+            name: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
         kind: z.ZodLiteral<"sqlite">;
-        path: z.ZodString;
     }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodOptional<z.ZodString>;
+        persistence: z.ZodOptional<z.ZodObject<{
+            mode: z.ZodEnum<{
+                durable: "durable";
+                ephemeral: "ephemeral";
+            }>;
+            mount: z.ZodOptional<z.ZodString>;
+            name: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
         kind: z.ZodLiteral<"json">;
-        path: z.ZodString;
     }, z.core.$strict>, z.ZodObject<{
         kind: z.ZodLiteral<"postgres">;
         dsn_secret: z.ZodString;
@@ -178,11 +210,27 @@ export declare const teamNetworkSchema: z.ZodObject<{
             token_secret: z.ZodString;
         }, z.core.$strict>>>;
         store: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            path: z.ZodOptional<z.ZodString>;
+            persistence: z.ZodOptional<z.ZodObject<{
+                mode: z.ZodEnum<{
+                    durable: "durable";
+                    ephemeral: "ephemeral";
+                }>;
+                mount: z.ZodOptional<z.ZodString>;
+                name: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>;
             kind: z.ZodLiteral<"sqlite">;
-            path: z.ZodString;
         }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodOptional<z.ZodString>;
+            persistence: z.ZodOptional<z.ZodObject<{
+                mode: z.ZodEnum<{
+                    durable: "durable";
+                    ephemeral: "ephemeral";
+                }>;
+                mount: z.ZodOptional<z.ZodString>;
+                name: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>;
             kind: z.ZodLiteral<"json">;
-            path: z.ZodString;
         }, z.core.$strict>, z.ZodObject<{
             kind: z.ZodLiteral<"postgres">;
             dsn_secret: z.ZodString;

package/dist/manifest/teamNetworkSchemas.js

@@ -2,6 +2,19 @@ import { z } from "zod";
 export { teamWorkspaceDocsSchema, teamWorkspaceSchema } from "./workspaceSchemas.js";
 const moltnetScopeSchema = z.enum(["observe", "write", "admin", "attach", "pair"]);
 const countTruthy = (value) => value.filter((entry) => Boolean(entry)).length;
+const absolutePosixPathSchema = z
+    .string()
+    .trim()
+    .min(1)
+    .refine((value) => value.startsWith("/"), {
+    message: "path must be an absolute POSIX path"
+});
+const normalizePosixPath = (value) => value.replace(/\/+/g, "/").replace(/\/+$/u, "") || "/";
+const pathIsInsideMount = (filePath, mountPath) => {
+    const normalizedPath = normalizePosixPath(filePath);
+    const normalizedMount = normalizePosixPath(mountPath);
+    return normalizedPath.startsWith(`${normalizedMount}/`);
+};
 const teamNetworkAuthTokenSchema = z
     .object({
     agents: z.array(z.string().trim().min(1)).optional(),
@@ -91,18 +104,41 @@ const teamNetworkAuthSchema = z
         }
     }
 });
-const teamNetworkStoreSqliteSchema = z
+const teamNetworkStorePersistenceSchema = z
     .object({
-    kind: z.literal("sqlite"),
-    path: z.string().trim().min(1)
+    mode: z.enum(["durable", "ephemeral"]),
+    mount: absolutePosixPathSchema.optional(),
+    name: z.string().trim().min(1).optional()
 })
-    .strict();
-const teamNetworkStoreJsonSchema = z
+    .strict()
+    .superRefine((value, context) => {
+    if (value.mode === "ephemeral" && (value.mount || value.name)) {
+        context.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "ephemeral persistence must not declare mount or name"
+        });
+    }
+});
+const teamNetworkFileStoreSchema = z
     .object({
-    kind: z.literal("json"),
-    path: z.string().trim().min(1)
+    path: absolutePosixPathSchema.optional(),
+    persistence: teamNetworkStorePersistenceSchema.optional()
 })
-    .strict();
+    .strict()
+    .superRefine((value, context) => {
+    if (value.path && value.persistence?.mount && !pathIsInsideMount(value.path, value.persistence.mount)) {
+        context.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "store.path must be inside persistence.mount"
+        });
+    }
+});
+const teamNetworkStoreSqliteSchema = teamNetworkFileStoreSchema.extend({
+    kind: z.literal("sqlite")
+});
+const teamNetworkStoreJsonSchema = teamNetworkFileStoreSchema.extend({
+    kind: z.literal("json")
+});
 const teamNetworkStorePostgresSchema = z
     .object({
     kind: z.literal("postgres"),

package/dist/report/types.d.ts

@@ -27,6 +27,12 @@ export interface ContainerWorkspaceResourceReport {
     mount: string;
     sharing: "per_agent" | "team";
 }
+export interface ContainerPersistentMountReport {
+    id: string;
+    mount_path: string;
+    reason: string;
+    volume_name: string;
+}
 export interface NodeReport {
     capabilities: CapabilityReport[];
     diagnostics: DiagnosticReport[];
@@ -49,6 +55,7 @@ export interface ContainerReport {
     runtime_secrets_required: string[];
     runtimes_installed: string[];
     secrets_required: string[];
+    persistent_mounts?: ContainerPersistentMountReport[];
     workspace_resources?: ContainerWorkspaceResourceReport[];
 }
 export interface CompileReport {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spawnfile",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "Canonical source compiler for autonomous agents and teams.",
   "license": "MIT",
   "type": "module",