@agents-at-scale/ark 0.1.63 → 0.1.66

package/dist/commands/agents/index.js

@@ -1,7 +1,9 @@
 import { Command } from 'commander';
 import { execa } from 'execa';
+import chalk from 'chalk';
 import output from '../../lib/output.js';
-import { executeQuery } from '../../lib/executeQuery.js';
+import { executeQuery, parseParameters } from '../../lib/executeQuery.js';
+import { ExitCodes } from '../../lib/errors.js';
 async function listAgents(options) {
     try {
         // Use kubectl to get agents
@@ -55,12 +57,22 @@ export function createAgentsCommand(config) {
         .argument('<name>', 'Agent name')
         .argument('<message>', 'Message to send')
         .option('--timeout <timeout>', 'Query timeout (e.g., 30s, 5m, 1h)')
+        .option('-p, --parameter <name=value>', 'Template parameter in name=value format (can be used multiple times)', (val, acc) => [...acc, val], [])
         .action(async (name, message, options) => {
+        let parameters;
+        try {
+            parameters = parseParameters(options.parameter || []);
+        }
+        catch (error) {
+            console.error(chalk.red(error instanceof Error ? error.message : 'Unknown error'));
+            process.exit(ExitCodes.CliError);
+        }
         await executeQuery({
             targetType: 'agent',
             targetName: name,
             message,
             timeout: options.timeout || config.queryTimeout,
+            parameters,
         });
     });
     return agentsCommand;

package/dist/commands/install/index.js

@@ -50,7 +50,7 @@ function backendInstallArgs(service, backend, values) {
 function isValidVersion(version) {
     return /^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?(\+[a-zA-Z0-9.-]+)?$/.test(version);
 }
-function isVersionNotFoundError(error, options) {
+function notFoundVersion(error, options) {
     let errorMsg = '';
     if (error && typeof error === 'object') {
         const err = error;
@@ -61,24 +61,30 @@ function isVersionNotFoundError(error, options) {
         errorMsg = String(error);
     }
     if (options.arkVersion && errorMsg.includes(`:${options.arkVersion}: not found`)) {
-        return true;
+        return options.arkVersion;
     }
     if (options.marketplaceVersion && errorMsg.includes(`:${options.marketplaceVersion}: not found`)) {
-        return true;
+        return options.marketplaceVersion;
     }
-    return false;
+    return null;
 }
 function handleInstallError(error, service, options) {
-    if (isVersionNotFoundError(error, options)) {
-        const version = options.arkVersion || options.marketplaceVersion;
-        output.warning(`${service.name} version ${version} not found, skipping...`);
-        return true; // should continue to next service
+    const version = notFoundVersion(error, options);
+    if (version !== null) {
+        return version; // should continue to next service
     }
     // Other errors still fail
     output.error(`failed to install ${service.name}`);
     console.error(error);
     process.exit(1);
 }
+function exitIfServicesSkipped(skipped) {
+    if (skipped.length === 0)
+        return;
+    const detail = skipped.map((s) => `${s.name}@${s.version}`).join(', ');
+    output.error(`installation incomplete: ${skipped.length} service(s) skipped because the requested version was not found: ${detail}`);
+    process.exit(1);
+}
 async function uninstallPrerequisites(service, verbose = false) {
     if (!service.prerequisiteUninstalls?.length)
         return;
@@ -185,6 +191,7 @@ export async function installArk(config, serviceNames = [], options = {}) {
         process.exit(1);
     }
     const backend = requestedBackend;
+    const skippedServices = [];
     let postgresValues;
     if (backend === 'postgresql') {
         try {
@@ -233,7 +240,9 @@ export async function installArk(config, serviceNames = [], options = {}) {
                     output.success(`${service.name} installed successfully`);
                 }
                 catch (error) {
-                    if (handleInstallError(error, service, options)) {
+                    const skippedVersion = handleInstallError(error, service, options);
+                    if (skippedVersion) {
+                        skippedServices.push({ name: service.name, version: skippedVersion });
                         continue;
                     }
                 }
@@ -258,7 +267,7 @@ export async function installArk(config, serviceNames = [], options = {}) {
                 if (service.helmReleaseName === 'ark-apiserver' && backend === 'postgresql') {
                     const spinner = ora('Waiting for ark-apiserver to be ready...').start();
                     try {
-                        const results = await runReadinessChecks(120); // 2 minute timeout
+                        const results = await runReadinessChecks(120, backend); // 2 minute timeout
                         const failed = results.find((r) => !r.passed);
                         if (failed) {
                             spinner.fail(`ark-apiserver readiness check failed: ${failed.message || 'unknown error'}`);
@@ -274,11 +283,14 @@ export async function installArk(config, serviceNames = [], options = {}) {
                 }
             }
             catch (error) {
-                if (handleInstallError(error, service, options)) {
+                const skippedVersion = handleInstallError(error, service, options);
+                if (skippedVersion) {
+                    skippedServices.push({ name: service.name, version: skippedVersion });
                     continue;
                 }
             }
         }
+        exitIfServicesSkipped(skippedServices);
         return;
     }
     // If not using -y flag, show checklist interface
@@ -417,7 +429,7 @@ export async function installArk(config, serviceNames = [], options = {}) {
                 if (service.helmReleaseName === 'ark-apiserver' && backend === 'postgresql') {
                     const spinner = ora('Waiting for ark-apiserver to be ready...').start();
                     try {
-                        const results = await runReadinessChecks(120); // 2 minute timeout
+                        const results = await runReadinessChecks(120, backend); // 2 minute timeout
                         const failed = results.find((r) => !r.passed);
                         if (failed) {
                             spinner.fail(`ark-apiserver readiness check failed: ${failed.message || 'unknown error'}`);
@@ -434,7 +446,9 @@ export async function installArk(config, serviceNames = [], options = {}) {
                 console.log(); // Add blank line after command output
             }
             catch (error) {
-                if (handleInstallError(error, service, options)) {
+                const skippedVersion = handleInstallError(error, service, options);
+                if (skippedVersion) {
+                    skippedServices.push({ name: service.name, version: skippedVersion });
                     console.log(); // Add blank line after warning
                     continue;
                 }
@@ -476,7 +490,9 @@ export async function installArk(config, serviceNames = [], options = {}) {
                 console.log(); // Add blank line after command output
             }
             catch (error) {
-                if (handleInstallError(error, service, options)) {
+                const skippedVersion = handleInstallError(error, service, options);
+                if (skippedVersion) {
+                    skippedServices.push({ name: service.name, version: skippedVersion });
                     console.log(); // Add blank line after warning
                     continue;
                 }
@@ -496,7 +512,8 @@ export async function installArk(config, serviceNames = [], options = {}) {
                 s.category === 'core' &&
                 s.k8sDeploymentName &&
                 s.namespace &&
-                (!s.requiresBackend || s.requiresBackend === backend));
+                (!s.requiresBackend || s.requiresBackend === backend) &&
+                !skippedServices.some((sk) => sk.name === s.name));
             const spinner = ora(`Waiting for Ark to be ready (timeout: ${timeoutSeconds}s)...`).start();
             const statusMap = new Map();
             servicesToWait.forEach((s) => statusMap.set(s.name, false));
@@ -526,6 +543,7 @@ export async function installArk(config, serviceNames = [], options = {}) {
             process.exit(1);
         }
     }
+    exitIfServicesSkipped(skippedServices);
 }
 export function createInstallCommand(config) {
     const command = new Command('install');

package/dist/commands/mcp/authClient.d.ts

@@ -0,0 +1,37 @@
+export interface AuthStartResponse {
+    auth_id: string;
+    authorization_url: string;
+    flow_expires_at: string;
+}
+export interface AuthStatusResponse {
+    state: 'pending' | 'authorized' | 'failed' | 'expired';
+    expires_at?: string | null;
+    message?: string | null;
+    controller_state?: string | null;
+    controller_message?: string | null;
+}
+export interface AuthLogoutResponse {
+    cleared_keys?: string[];
+    deleted?: boolean;
+    noop?: boolean;
+}
+export interface AuthStartBody {
+    force?: boolean;
+    scope?: string[];
+}
+export interface AuthLogoutBody {
+    keep_client?: boolean;
+    delete_secret?: boolean;
+}
+export declare class AuthHttpError extends Error {
+    status: number;
+    body: string;
+    constructor(status: number, body: string);
+}
+export declare class McpAuthClient {
+    private baseUrl;
+    constructor(baseUrl: string);
+    start(name: string, namespace: string, body: AuthStartBody): Promise<AuthStartResponse>;
+    status(name: string, namespace: string, authId: string): Promise<AuthStatusResponse>;
+    logout(name: string, namespace: string, body: AuthLogoutBody): Promise<AuthLogoutResponse>;
+}

package/dist/commands/mcp/authClient.js

@@ -0,0 +1,47 @@
+export class AuthHttpError extends Error {
+    status;
+    body;
+    constructor(status, body) {
+        super(`HTTP ${status}: ${body}`);
+        this.status = status;
+        this.body = body;
+    }
+}
+export class McpAuthClient {
+    baseUrl;
+    constructor(baseUrl) {
+        this.baseUrl = baseUrl;
+    }
+    async start(name, namespace, body) {
+        const url = `${this.baseUrl}/v1/mcp-servers/${encodeURIComponent(name)}/auth/start?namespace=${encodeURIComponent(namespace)}`;
+        const response = await fetch(url, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(body),
+        });
+        if (!response.ok) {
+            throw new AuthHttpError(response.status, await response.text());
+        }
+        return (await response.json());
+    }
+    async status(name, namespace, authId) {
+        const url = `${this.baseUrl}/v1/mcp-servers/${encodeURIComponent(name)}/auth/status?namespace=${encodeURIComponent(namespace)}&auth_id=${encodeURIComponent(authId)}`;
+        const response = await fetch(url);
+        if (!response.ok) {
+            throw new AuthHttpError(response.status, await response.text());
+        }
+        return (await response.json());
+    }
+    async logout(name, namespace, body) {
+        const url = `${this.baseUrl}/v1/mcp-servers/${encodeURIComponent(name)}/auth/logout?namespace=${encodeURIComponent(namespace)}`;
+        const response = await fetch(url, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(body),
+        });
+        if (!response.ok) {
+            throw new AuthHttpError(response.status, await response.text());
+        }
+        return (await response.json());
+    }
+}

package/dist/commands/mcp/index.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+import type { ArkConfig } from '../../lib/config.js';
+export declare function createMcpCommand(_config: ArkConfig): Command;

package/dist/commands/mcp/index.js

@@ -0,0 +1,43 @@
+import { Command } from 'commander';
+import { runLogin } from './login.js';
+import { runLogout } from './logout.js';
+export function createMcpCommand(_config) {
+    const mcp = new Command('mcp');
+    mcp.description('manage MCP servers');
+    const auth = new Command('auth');
+    auth.description('manage MCP server authorization');
+    auth
+        .command('login <server-name>')
+        .description('start an OAuth flow for an MCPServer via ark-api')
+        .option('-n, --namespace <namespace>', 'namespace of the MCPServer')
+        .option('--force', 'bypass the Authorized preflight and force fresh client registration')
+        .option('--no-open', 'do not open a browser; print the URL only')
+        .option('--timeout <duration>', 'how long to wait for authorization to complete (e.g. 60s, 5m, 1h)')
+        .option('--scope <scope>', 'space- or comma-separated list of OAuth scopes to request')
+        .action(async (serverName, options) => {
+        const exitCode = await runLogin(serverName, {
+            namespace: options.namespace,
+            force: options.force,
+            open: options.open,
+            timeout: options.timeout,
+            scope: options.scope,
+        });
+        process.exit(exitCode);
+    });
+    auth
+        .command('logout <server-name>')
+        .description('clear OAuth state for an MCPServer via ark-api')
+        .option('-n, --namespace <namespace>', 'namespace of the MCPServer')
+        .option('--keep-client', 'preserve cached client_id/client_secret in the Secret')
+        .option('--delete-secret', 'delete the entire token Secret')
+        .action(async (serverName, options) => {
+        const exitCode = await runLogout(serverName, {
+            namespace: options.namespace,
+            keepClient: options.keepClient,
+            deleteSecret: options.deleteSecret,
+        });
+        process.exit(exitCode);
+    });
+    mcp.addCommand(auth);
+    return mcp;
+}

package/dist/commands/mcp/login.d.ts

@@ -0,0 +1,21 @@
+import { McpAuthClient } from './authClient.js';
+export interface LoginOptions {
+    namespace?: string;
+    force?: boolean;
+    open?: boolean;
+    timeout?: string;
+    scope?: string;
+}
+export interface LoginDeps {
+    buildClient: (baseUrl: string) => McpAuthClient;
+    openBrowser: (url: string) => Promise<unknown>;
+    resolveNs: (explicit?: string) => string;
+    startProxy: () => Promise<{
+        baseUrl: string;
+        stop: () => void;
+    }>;
+    sleep: (ms: number) => Promise<void>;
+    now: () => number;
+}
+export declare const defaultDeps: LoginDeps;
+export declare function runLogin(serverName: string, options: LoginOptions, deps?: LoginDeps): Promise<number>;

package/dist/commands/mcp/login.js

@@ -0,0 +1,130 @@
+import open from 'open';
+import output from '../../lib/output.js';
+import { ArkApiProxy } from '../../lib/arkApiProxy.js';
+import { loadConfig } from '../../lib/config.js';
+import { resolveNamespace } from './namespace.js';
+import { parseTimeoutDuration } from './timeout.js';
+import { AuthHttpError, McpAuthClient } from './authClient.js';
+export const defaultDeps = {
+    buildClient: (baseUrl) => new McpAuthClient(baseUrl),
+    openBrowser: (url) => open(url),
+    resolveNs: (explicit) => resolveNamespace(explicit),
+    startProxy: async () => {
+        const config = loadConfig();
+        const proxy = new ArkApiProxy(undefined, config.services?.reusePortForwards ?? false);
+        const client = await proxy.start();
+        return {
+            baseUrl: client.getBaseUrl(),
+            stop: () => proxy.stop(),
+        };
+    },
+    sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+    now: () => Date.now(),
+};
+const POLL_INTERVAL_MS = 2000;
+const DEFAULT_TIMEOUT_MS = 5 * 60 * 1000;
+const LOOPBACK_LITERALS = new Set(['127.0.0.1', '::1', 'localhost']);
+function warnIfCallbackUnreachable(authorizationUrl, proxyBaseUrl) {
+    let redirect;
+    try {
+        const raw = new URL(authorizationUrl).searchParams.get('redirect_uri');
+        if (!raw)
+            return;
+        redirect = new URL(raw);
+    }
+    catch {
+        return;
+    }
+    const host = redirect.hostname.replace(/^\[|\]$/g, '');
+    if (!LOOPBACK_LITERALS.has(host))
+        return;
+    const proxyPort = new URL(proxyBaseUrl).port;
+    if (redirect.port && proxyPort && redirect.port !== proxyPort) {
+        output.warning(`callback is configured for ${redirect.host} but the CLI port-forward is on ` +
+            `port ${proxyPort}; the browser redirect will not reach ark-api. Set ` +
+            `ARK_API_PUBLIC_CALLBACK_URL to use port ${proxyPort}, or port-forward ` +
+            `ark-api on port ${redirect.port}.`);
+    }
+}
+export async function runLogin(serverName, options, deps = defaultDeps) {
+    let timeoutMs = DEFAULT_TIMEOUT_MS;
+    if (options.timeout !== undefined) {
+        try {
+            timeoutMs = parseTimeoutDuration(options.timeout);
+        }
+        catch (err) {
+            output.error('mcp auth failed:', err.message);
+            return 1;
+        }
+    }
+    const namespace = deps.resolveNs(options.namespace);
+    const body = {};
+    if (options.force)
+        body.force = true;
+    if (options.scope) {
+        body.scope = options.scope.split(/[\s,]+/).filter((s) => s.length > 0);
+    }
+    const proxy = await deps.startProxy();
+    try {
+        const client = deps.buildClient(proxy.baseUrl);
+        let startResponse;
+        try {
+            startResponse = await client.start(serverName, namespace, body);
+        }
+        catch (err) {
+            if (err instanceof AuthHttpError) {
+                output.error('mcp auth failed:', err.body || `HTTP ${err.status}`);
+            }
+            else {
+                output.error('mcp auth failed:', err.message);
+            }
+            return 1;
+        }
+        warnIfCallbackUnreachable(startResponse.authorization_url, proxy.baseUrl);
+        console.log(`Authorization URL: ${startResponse.authorization_url}`);
+        if (options.open !== false) {
+            try {
+                await deps.openBrowser(startResponse.authorization_url);
+            }
+            catch {
+                // ignore — URL is already printed
+            }
+        }
+        const deadline = deps.now() + timeoutMs;
+        while (deps.now() < deadline) {
+            let status;
+            try {
+                status = await client.status(serverName, namespace, startResponse.auth_id);
+            }
+            catch (err) {
+                if (err instanceof AuthHttpError) {
+                    output.error('mcp auth failed:', err.body || `HTTP ${err.status}`);
+                }
+                else {
+                    output.error('mcp auth failed:', err.message);
+                }
+                return 1;
+            }
+            if (status.state === 'authorized') {
+                if (status.expires_at) {
+                    output.success(`authorized (token expires at ${status.expires_at})`);
+                }
+                else {
+                    output.success('authorized');
+                }
+                return 0;
+            }
+            if (status.state === 'failed' || status.state === 'expired') {
+                const reason = status.message || status.state;
+                output.error('mcp auth failed:', reason);
+                return 1;
+            }
+            await deps.sleep(POLL_INTERVAL_MS);
+        }
+        output.error('mcp auth failed:', 'timed out waiting for authorization');
+        return 1;
+    }
+    finally {
+        proxy.stop();
+    }
+}

package/dist/commands/mcp/logout.d.ts

@@ -0,0 +1,16 @@
+import { McpAuthClient } from './authClient.js';
+export interface LogoutOptions {
+    namespace?: string;
+    keepClient?: boolean;
+    deleteSecret?: boolean;
+}
+export interface LogoutDeps {
+    buildClient: (baseUrl: string) => McpAuthClient;
+    resolveNs: (explicit?: string) => string;
+    startProxy: () => Promise<{
+        baseUrl: string;
+        stop: () => void;
+    }>;
+}
+export declare const defaultLogoutDeps: LogoutDeps;
+export declare function runLogout(serverName: string, options: LogoutOptions, deps?: LogoutDeps): Promise<number>;

package/dist/commands/mcp/logout.js

@@ -0,0 +1,65 @@
+import output from '../../lib/output.js';
+import { ArkApiProxy } from '../../lib/arkApiProxy.js';
+import { loadConfig } from '../../lib/config.js';
+import { resolveNamespace } from './namespace.js';
+import { AuthHttpError, McpAuthClient } from './authClient.js';
+export const defaultLogoutDeps = {
+    buildClient: (baseUrl) => new McpAuthClient(baseUrl),
+    resolveNs: (explicit) => resolveNamespace(explicit),
+    startProxy: async () => {
+        const config = loadConfig();
+        const proxy = new ArkApiProxy(undefined, config.services?.reusePortForwards ?? false);
+        const client = await proxy.start();
+        return {
+            baseUrl: client.getBaseUrl(),
+            stop: () => proxy.stop(),
+        };
+    },
+};
+export async function runLogout(serverName, options, deps = defaultLogoutDeps) {
+    if (options.keepClient && options.deleteSecret) {
+        output.error('mcp auth failed:', '--keep-client and --delete-secret are mutually exclusive');
+        return 1;
+    }
+    const namespace = deps.resolveNs(options.namespace);
+    const body = {};
+    if (options.keepClient)
+        body.keep_client = true;
+    if (options.deleteSecret)
+        body.delete_secret = true;
+    const proxy = await deps.startProxy();
+    try {
+        const client = deps.buildClient(proxy.baseUrl);
+        let response;
+        try {
+            response = await client.logout(serverName, namespace, body);
+        }
+        catch (err) {
+            if (err instanceof AuthHttpError) {
+                if (err.status === 404) {
+                    output.error('mcp auth failed:', 'MCPServer not found');
+                }
+                else {
+                    output.error('mcp auth failed:', err.body || `HTTP ${err.status}`);
+                }
+                return 1;
+            }
+            output.error('mcp auth failed:', err.message);
+            return 1;
+        }
+        if (response.noop) {
+            output.success('logout: nothing to clear');
+        }
+        else if (response.deleted) {
+            output.success('logout: secret deleted');
+        }
+        else {
+            const keys = response.cleared_keys ?? [];
+            output.success(`logout: cleared ${keys.length} key(s)`);
+        }
+        return 0;
+    }
+    finally {
+        proxy.stop();
+    }
+}

package/dist/commands/mcp/namespace.d.ts

@@ -0,0 +1 @@
+export declare function resolveNamespace(explicit?: string): string;

package/dist/commands/mcp/namespace.js

@@ -0,0 +1,17 @@
+import { KubeConfig } from '@kubernetes/client-node';
+export function resolveNamespace(explicit) {
+    if (explicit && explicit.length > 0) {
+        return explicit;
+    }
+    const kc = new KubeConfig();
+    kc.loadFromDefault();
+    const contextName = kc.getCurrentContext();
+    if (!contextName) {
+        return 'default';
+    }
+    const ctx = kc.getContextObject(contextName);
+    if (ctx && ctx.namespace && ctx.namespace.length > 0) {
+        return ctx.namespace;
+    }
+    return 'default';
+}

package/dist/commands/mcp/timeout.d.ts

@@ -0,0 +1 @@
+export declare function parseTimeoutDuration(input: string): number;

package/dist/commands/mcp/timeout.js

@@ -0,0 +1,23 @@
+export function parseTimeoutDuration(input) {
+    const match = input.match(/^(\d+(?:\.\d+)?)(ms|s|m|h)$/);
+    if (!match) {
+        throw new Error(`invalid --timeout value: ${input} (expected Go duration such as 60s, 5m, 1h)`);
+    }
+    const value = parseFloat(match[1]);
+    if (!isFinite(value) || value <= 0) {
+        throw new Error(`invalid --timeout value: ${input} (must be a positive duration)`);
+    }
+    const unit = match[2];
+    switch (unit) {
+        case 'ms':
+            return value;
+        case 's':
+            return value * 1000;
+        case 'm':
+            return value * 60 * 1000;
+        case 'h':
+            return value * 60 * 60 * 1000;
+        default:
+            throw new Error(`invalid --timeout unit: ${unit}`);
+    }
+}

package/dist/commands/models/kubernetes/manifest-builder.js

@@ -109,34 +109,46 @@ export class KubernetesModelManifestBuilder {
                 region: {
                     value: config.region,
                 },
-                accessKeyId: {
-                    valueFrom: {
-                        secretKeyRef: {
-                            name: config.secretName,
-                            key: 'access-key-id',
-                        },
+            },
+        };
+        const bedrock = bedrockConfig.bedrock;
+        if (config.authMethod === 'api-key') {
+            bedrock.apiKey = {
+                valueFrom: {
+                    secretKeyRef: {
+                        name: config.secretName,
+                        key: 'bedrock-api-key',
                     },
                 },
-                secretAccessKey: {
-                    valueFrom: {
-                        secretKeyRef: {
-                            name: config.secretName,
-                            key: 'secret-access-key',
-                        },
+            };
+        }
+        else {
+            bedrock.accessKeyId = {
+                valueFrom: {
+                    secretKeyRef: {
+                        name: config.secretName,
+                        key: 'access-key-id',
                     },
                 },
-            },
-        };
-        const bedrock = bedrockConfig.bedrock;
-        if (config.sessionToken) {
-            bedrock.sessionToken = {
+            };
+            bedrock.secretAccessKey = {
                 valueFrom: {
                     secretKeyRef: {
                         name: config.secretName,
-                        key: 'session-token',
+                        key: 'secret-access-key',
                     },
                 },
             };
+            if (config.sessionToken) {
+                bedrock.sessionToken = {
+                    valueFrom: {
+                        secretKeyRef: {
+                            name: config.secretName,
+                            key: 'session-token',
+                        },
+                    },
+                };
+            }
         }
         if (config.modelArn) {
             bedrock.modelArn = {