@agentshouse/kit 0.1.0-alpha.38 → 0.1.0-alpha.39

package/README.md

@@ -13,13 +13,13 @@ The Skill set Kit installs is Matt Pocock's
 Linux (`amd64`, `arm64`) or macOS (Apple silicon, Intel):
 
 ```sh
-bash <(curl -fsSL https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.38/connect-linux.sh)
+bash <(curl -fsSL https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.39/connect-linux.sh)
 ```
 
 Windows 11 (`amd64`), in PowerShell:
 
 ```powershell
-& ([scriptblock]::Create((irm https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.38/connect-windows.ps1)))
+& ([scriptblock]::Create((irm https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.39/connect-windows.ps1)))
 ```
 
 The command sets up Docker if it is missing, creates `~/.house-kit` (Kit home)

package/bin/connect-linux.sh

@@ -559,6 +559,7 @@ if kit_installed; then
   else
     resume_kit
   fi
+  ((NATIVE == 0)) || native_kit kit workspace update
   exit 0
 fi
 

package/bin/kit.js

@@ -13,7 +13,7 @@ import { runResident, runWorkers } from "../src/worker.js";
 import { openSession, releaseControl, requestDrain } from "../src/house.js";
 import { reportHost } from "../src/host.js";
 import { signInAgent, updateAgents } from "../src/agents.js";
-import { serveWorkspaces } from "../src/workspace.js";
+import { serveWorkspaces, updateWorkspaces } from "../src/workspace.js";
 import { captureRepository } from "../src/repository.js";
 import { bootstrap, pull, rebootstrap, submit } from "../src/sync.js";
 import { formatMount, formatUnmount, mountPackage, unmountSubtree } from "../src/mount.js";
@@ -35,7 +35,7 @@ const LOGIN_USAGE =
 const HOST_USAGE = "usage: kit host report [--config <path>]";
 const AGENTS_USAGE =
   "usage: kit agents update [--config <path>] | kit agents sign-in <kind> [--config <path>]";
-const WORKSPACE_USAGE = "usage: kit workspace host [--config <path>] [--passes <count>]";
+const WORKSPACE_USAGE = "usage: kit workspace host [--config <path>] [--passes <count>] | kit workspace update";
 const SOURCE_USAGE =
   "usage: kit source <capture|status> <account|instance> [service] [--config <path>]\n" +
   "       kit source <reset|retry-files> <instance> [service] [--config <path>]\n" +
@@ -895,6 +895,21 @@ async function runWorkspaceHost(args, directory) {
   }
 }
 
+async function runWorkspaceUpdate(args, directory) {
+  declared(args, [], 0, { exact: true });
+  const answered = await updateWorkspaces({
+    house: await storedHouse(directory),
+    configuration: join(directory, "kit.json"),
+  });
+  for (const { workspace, running } of answered.updated) {
+    write(running ? `Updated workspace ${workspace}.` : `Updated workspace ${workspace}; it stays stopped.`);
+  }
+  for (const { workspace, cause } of answered.unchanged) {
+    write(`Workspace ${workspace} is unchanged: ${cause}`);
+  }
+  if (answered.unchanged.length > 0) process.exitCode = 1;
+}
+
 async function runTelegramConnect(args, directory) {
   declared(args, [], 0, { exact: true });
   const house = await storedHouse(directory);
@@ -1027,6 +1042,7 @@ async function main() {
   if (command === "workspace") {
     const [action, ...rest] = args;
     if (action === "host") return runWorkspaceHost(rest, directory);
+    if (action === "update") return runWorkspaceUpdate(rest, directory);
     throw new Error(WORKSPACE_USAGE);
   }
   if (command === "telegram") {

package/bootstrap.json

@@ -1,12 +1,12 @@
 {
   "schemaVersion": 1,
-  "version": "0.1.0-alpha.38",
+  "version": "0.1.0-alpha.39",
   "hosts": {
     "linux": {
-      "command": "bash <(curl -fsSL https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.38/connect-linux.sh)",
+      "command": "bash <(curl -fsSL https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.39/connect-linux.sh)",
       "asset": {
         "name": "connect-linux.sh",
-        "url": "https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.38/connect-linux.sh"
+        "url": "https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.39/connect-linux.sh"
       },
       "workspace": {
         "argument": "--workspace",
@@ -14,10 +14,10 @@
       }
     },
     "windows": {
-      "command": "& ([scriptblock]::Create((irm https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.38/connect-windows.ps1)))",
+      "command": "& ([scriptblock]::Create((irm https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.39/connect-windows.ps1)))",
       "asset": {
         "name": "connect-windows.ps1",
-        "url": "https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.38/connect-windows.ps1"
+        "url": "https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.39/connect-windows.ps1"
       },
       "workspace": {
         "argument": "--workspace",

package/docs/linux.md

@@ -69,3 +69,9 @@ The server connects as a continuous Environment. Put `--linux` before `kit` or
 `house` to run a Kit command, as in
 `bash <(curl -fsSL …/connect-linux.sh) --linux kit apply`, and run a newer
 release's command with `--linux` to update it, as above.
+
+The same run updates the container Environments the server hosts to that
+release. A running one waits, and is named, until its own Agent sessions end;
+run the command again then. A stopped one is updated and stays stopped. Each
+keeps its files, sign-ins and CPU, memory and disk limits; only what was
+installed outside its workspace and Kit home is not kept.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentshouse/kit",
-  "version": "0.1.0-alpha.38",
+  "version": "0.1.0-alpha.39",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/configuration.js

@@ -160,12 +160,11 @@ function maximaOf(value, declaration) {
 
 function hostOf(value, declaration) {
   if (value === null) return null;
-  const host = closed(value, ["workspace", "maxima", "image"], declaration);
+  const host = closed(value, ["workspace", "maxima"], declaration);
   if (host.maxima === undefined) refuse(`${declaration}.maxima`);
   return {
     workspace: absolutePath(host.workspace, `${declaration}.workspace`),
     maxima: maximaOf(host.maxima, `${declaration}.maxima`),
-    image: host.image === undefined || host.image === null ? null : text(host.image, `${declaration}.image`, 255),
   };
 }
 

package/src/contract.js

@@ -276,16 +276,20 @@ export const KIT_WORKSPACES_ACQUIRE_PATH = "/kit/workspaces/acquire";
 export const WORKSPACE_ACQUIRE_MAX = 10;
 export const WORKSPACE_POLL_MS = 2_000;
 export const WORKSPACE_LABEL = "house-kit.workspace";
-export const WORKSPACE_MOUNT = "/workspace";
-export const WORKSPACE_KIT_HOME = "/workspace/.house-kit";
+export const WORKSPACE_KIT_HOME = "/kit-home";
 export const WORKSPACE_DISK_IMAGE = "disk.img";
 export const WORKSPACE_DISK_MOUNT = "mnt";
+export const WORKSPACE_DISK_KIT_HOME = "kit-home";
+export const WORKSPACE_DISK_HOUSE = "house";
+export const WORKSPACE_SELECTED_IMAGE = "/opt/house-kit/image";
+export const WORKSPACE_RELEASE_IMAGE = /^ghcr\.io\/agentshouse\/kit@sha256:[0-9a-f]{64}$/;
 export const WORKSPACE_MOUNT_OPTIONS = "loop,nosuid,nodev";
 export const HOST_MOUNT_INFO = "/proc/self/mountinfo";
 export const WORKSPACE_SYSTEM_RESERVE_BYTES = 512 * 1024 * 1024;
 export const WORKSPACE_COMMAND_TIMEOUT_MS = 120_000;
 export const WORKSPACE_READY_ATTEMPTS = 60;
 export const WORKSPACE_READY_POLL_MS = 1_000;
+export const WORKSPACE_LOCK_POLL_MS = 1_000;
 export const WORKSPACE_STOP_TIMEOUT_SECONDS = 10;
 export const WORKSPACE_OPERATION_WITHDRAWN = "hosted_environment_operation_not_found";
 export const CGROUP_CONTROLLERS = "/sys/fs/cgroup/cgroup.controllers";

package/src/workspace.js

@@ -1,22 +1,28 @@
 import { access, mkdir, readFile, rm } from "node:fs/promises";
+import { createServer } from "node:net";
 import { join } from "node:path";
 import { readConfiguration } from "./configuration.js";
 import {
   CGROUP_CONTROLLERS,
   HOST_MOUNT_INFO,
+  LAUNCH_DIRECTORY_BASE,
   LOOP_CONTROL,
   WORKSPACE_ACQUIRE_MAX,
   WORKSPACE_COMMAND_TIMEOUT_MS,
+  WORKSPACE_DISK_HOUSE,
   WORKSPACE_DISK_IMAGE,
+  WORKSPACE_DISK_KIT_HOME,
   WORKSPACE_DISK_MOUNT,
   WORKSPACE_KIT_HOME,
   WORKSPACE_MOUNT_OPTIONS,
   WORKSPACE_LABEL,
-  WORKSPACE_MOUNT,
+  WORKSPACE_LOCK_POLL_MS,
   WORKSPACE_OPERATION_WITHDRAWN,
   WORKSPACE_POLL_MS,
   WORKSPACE_READY_ATTEMPTS,
   WORKSPACE_READY_POLL_MS,
+  WORKSPACE_RELEASE_IMAGE,
+  WORKSPACE_SELECTED_IMAGE,
   WORKSPACE_STOP_TIMEOUT_SECONDS,
   WORKSPACE_SYSTEM_RESERVE_BYTES,
 } from "./contract.js";
@@ -27,10 +33,13 @@ import {
   openSession,
   releaseControl,
   reportWorkspaceOutcome,
+  updateDrain,
 } from "./house.js";
 import { houseFailed, KitRefusal } from "./refusal.js";
 
 const REQUIRED_CONTROLLERS = ["cpu", "memory"];
+const PROVISIONED_DISK = "/disk";
+const STOPPED_STATES = ["created", "exited"];
 const MEMINFO = "/proc/meminfo";
 const MEM_AVAILABLE = /^MemAvailable:\s+(\d+)\s+kB$/m;
 
@@ -106,30 +115,35 @@ export function mountedPaths(document) {
   );
 }
 
-export function workspaceCreateArguments(identity, operation, image, house, root) {
+export function workspaceCreateArguments(identity, workspace, image, house, root) {
+  const disk = workspaceMountPath(root, identity);
   return [
     "create",
     "--name",
     identity,
     "--label",
-    `${WORKSPACE_LABEL}=${operation.environment}`,
+    `${WORKSPACE_LABEL}=${workspace.environment}`,
     "--cpus",
-    (operation.maxima.cpu_millicores / 1000).toFixed(3),
+    (workspace.maxima.cpu_millicores / 1000).toFixed(3),
     "--memory",
-    `${operation.maxima.memory_bytes}b`,
+    `${workspace.maxima.memory_bytes}b`,
     "--memory-swap",
-    `${operation.maxima.memory_bytes}b`,
+    `${workspace.maxima.memory_bytes}b`,
     "--restart",
     "no",
+    ...(new URL(house).protocol === "https:" ? [] : ["--network", "host"]),
     "--mount",
-    `type=bind,source=${workspaceMountPath(root, identity)},target=${WORKSPACE_MOUNT}`,
+    `type=bind,source=${disk}/${WORKSPACE_DISK_KIT_HOME},target=${WORKSPACE_KIT_HOME}`,
+    "--mount",
+    `type=bind,source=${disk}/${WORKSPACE_DISK_HOUSE},target=${LAUNCH_DIRECTORY_BASE}`,
+    "--env",
+    `HOME=${WORKSPACE_KIT_HOME}`,
     "--env",
     `HOUSE_KIT_HOME=${WORKSPACE_KIT_HOME}`,
     "--env",
-    `HOUSE_KIT_HOUSE=${house}`,
-    "--workdir",
-    WORKSPACE_MOUNT,
+    "HOUSE_KIT_CONTAINER=1",
     image,
+    "resident",
   ];
 }
 
@@ -198,7 +212,7 @@ export async function workspacePrerequisites(host, image) {
   if (formatter.status !== 0) {
     return {
       supported: false,
-      refusal: `the declared workspace image ${image} carries no mkfs.ext4, so no volume ceiling can be created`,
+      refusal: `the selected Kit image ${image} carries no mkfs.ext4, so no volume ceiling can be created`,
     };
   }
   return { supported: true, runtime: `docker ${version.stdout.trim()}` };
@@ -215,34 +229,45 @@ function bootstrapConfiguration() {
   });
 }
 
-function provisionArguments(root, identity, image, target, mode) {
+function diskArguments(root, identity, image, script) {
   return [
     "run",
     "--rm",
     "--interactive",
     "--mount",
-    `type=bind,source=${workspaceMountPath(root, identity)},target=${WORKSPACE_MOUNT}`,
+    `type=bind,source=${workspaceMountPath(root, identity)},target=${PROVISIONED_DISK}`,
     "--entrypoint",
     "sh",
     image,
     "-c",
-    `set -e; mkdir -p ${WORKSPACE_KIT_HOME}; chmod 700 ${WORKSPACE_KIT_HOME}; cat > ${target}; chmod ${mode} ${target}`,
+    script,
   ];
 }
 
-async function provisionWorkspaceState(host, root, identity, image, authority) {
-  for (const [target, mode, content] of [
-    [`${WORKSPACE_KIT_HOME}/credential`, "600", `${authority.credential}\n`],
-    [`${WORKSPACE_KIT_HOME}/kit.json`, "600", `${bootstrapConfiguration()}\n`],
-  ]) {
-    const written = await docker(
+async function onDisk(host, settings, identity, script, stdin = "") {
+  const written = await docker(host, diskArguments(settings.root, identity, settings.image, script), stdin);
+  if (written.status !== 0) {
+    throw new KitRefusal("kit_workspace_unprovisioned", written.stderr.trim() || identity);
+  }
+}
+
+async function provisionWorkspaceState(host, settings, identity, operation) {
+  const home = `${PROVISIONED_DISK}/${WORKSPACE_DISK_KIT_HOME}`;
+  const house = `${PROVISIONED_DISK}/${WORKSPACE_DISK_HOUSE}`;
+  const files = [
+    ...(operation.authority === undefined ? [] : [["credential", operation.authority.credential]]),
+    ["kit.json", bootstrapConfiguration()],
+    ["house", settings.house],
+    ["environment", operation.environment],
+  ];
+  for (const [name, content] of files) {
+    await onDisk(
       host,
-      provisionArguments(root, identity, image, target, mode),
-      content,
+      settings,
+      identity,
+      `set -e; mkdir -p ${home} ${house}; chmod 700 ${home} ${house}; cat > ${home}/${name}; chmod 600 ${home}/${name}`,
+      `${content}\n`,
     );
-    if (written.status !== 0) {
-      throw new KitRefusal("kit_workspace_unprovisioned", written.stderr.trim() || identity);
-    }
   }
 }
 
@@ -289,9 +314,7 @@ export async function createWorkspace(host, settings, operation) {
   }
   const mountRefusal = await mountWorkspace(host, settings, identity);
   if (mountRefusal !== null) return { outcome: "unsupported", refusal: mountRefusal };
-  if (operation.authority !== undefined) {
-    await provisionWorkspaceState(host, settings.root, identity, settings.image, operation.authority);
-  }
+  await provisionWorkspaceState(host, settings, identity, operation);
   const created = await docker(
     host,
     workspaceCreateArguments(identity, operation, settings.image, settings.house, settings.root),
@@ -312,9 +335,42 @@ async function workspacePresent(host, identity) {
   return inspected.status === 0 ? inspected.stdout.trim() : null;
 }
 
+async function heldWorkspace(host, identity) {
+  const inspected = await docker(host, [
+    "container",
+    "inspect",
+    "--format",
+    `{{.State.Status}} {{.Config.Image}} {{index .Config.Labels "${WORKSPACE_LABEL}"}} {{.HostConfig.NanoCpus}} {{.HostConfig.Memory}}`,
+    identity,
+  ]);
+  if (inspected.status !== 0) return null;
+  const [state, image, environment, nanoCpus, memory] = inspected.stdout.trim().split(/\s+/);
+  return {
+    state,
+    image,
+    environment,
+    maxima: { cpu_millicores: Number(nanoCpus) / 1_000_000, memory_bytes: Number(memory) },
+  };
+}
+
+async function replaceWorkspace(host, settings, identity, held) {
+  const mountRefusal = await mountWorkspace(host, settings, identity);
+  if (mountRefusal !== null) return mountRefusal;
+  await onDisk(host, settings, identity, `rm -f ${updateDrain(`${PROVISIONED_DISK}/${WORKSPACE_DISK_KIT_HOME}`)}`);
+  const removed = await docker(host, ["rm", "--force", identity]);
+  if (removed.status !== 0) return `the workspace was not replaced: ${removed.stderr.trim()}`;
+  const created = await docker(
+    host,
+    workspaceCreateArguments(identity, held, settings.image, settings.house, settings.root),
+  );
+  if (created.status !== 0) return `the workspace was not recreated: ${created.stderr.trim()}`;
+  return null;
+}
+
 export async function startWorkspace(host, settings, operation) {
   const identity = operation.workspace ?? workspaceIdentity(operation);
-  if ((await workspacePresent(host, identity)) === null) return { outcome: "absent" };
+  const held = await heldWorkspace(host, identity);
+  if (held === null) return { outcome: "absent" };
   const available = memoryAvailable(await host.read(MEMINFO));
   if (available - operation.maxima.memory_bytes < WORKSPACE_SYSTEM_RESERVE_BYTES) {
     return {
@@ -324,6 +380,10 @@ export async function startWorkspace(host, settings, operation) {
   }
   const mountRefusal = await mountWorkspace(host, settings, identity);
   if (mountRefusal !== null) return { outcome: "unsupported", refusal: mountRefusal };
+  if (STOPPED_STATES.includes(held.state) && held.image !== settings.image) {
+    const refusal = await replaceWorkspace(host, settings, identity, held);
+    if (refusal !== null) return { outcome: "failed", refusal };
+  }
   const started = await docker(host, ["start", identity]);
   if (started.status !== 0) {
     return { outcome: "failed", refusal: `the workspace did not start: ${started.stderr.trim()}` };
@@ -425,37 +485,123 @@ export async function reconcileWorkspaces(host, authorized) {
   );
   const stopped = [];
   for (const managed of await managedWorkspaces(host)) {
-    if (managed.state !== "running") continue;
     if (expected.get(managed.environment) === "running") continue;
-    const settled = await docker(host, [
-      "stop",
-      "--timeout",
-      String(WORKSPACE_STOP_TIMEOUT_SECONDS),
-      managed.name,
-    ]);
-    if (settled.status === 0) stopped.push(managed.name);
+    const settled = await exclusively(host, managed.name, async () => {
+      if ((await workspacePresent(host, managed.name)) !== "running") return false;
+      const stopping = await docker(host, [
+        "stop",
+        "--timeout",
+        String(WORKSPACE_STOP_TIMEOUT_SECONDS),
+        managed.name,
+      ]);
+      return stopping.status === 0;
+    });
+    if (settled) stopped.push(managed.name);
   }
   return stopped;
 }
 
+function workspaceLock(identity) {
+  return new Promise((resolve, reject) => {
+    const lock = createServer();
+    lock.once("error", reject);
+    lock.listen({ path: `\0${WORKSPACE_LABEL}/${identity}` }, () => resolve(lock));
+  });
+}
+
+async function exclusively(host, identity, act) {
+  let lock = null;
+  while (lock === null) {
+    try {
+      lock = await workspaceLock(identity);
+    } catch (error) {
+      if (error.code !== "EADDRINUSE") throw error;
+      await host.wait(WORKSPACE_LOCK_POLL_MS);
+    }
+  }
+  try {
+    return await act();
+  } finally {
+    await new Promise((resolve) => lock.close(resolve));
+  }
+}
+
 export async function performOperation(host, settings, operation) {
-  if (operation.kind === "create") return createWorkspace(host, settings, operation);
-  if (operation.kind === "start") return startWorkspace(host, settings, operation);
-  if (operation.kind === "stop") return stopWorkspace(host, operation);
-  return deleteWorkspace(host, settings, operation);
+  const selected = operation.kind === "stop" ? settings : { ...settings, image: await selectedImage(host) };
+  return exclusively(host, operation.workspace ?? workspaceIdentity(operation), () => {
+    if (operation.kind === "stop") return stopWorkspace(host, operation);
+    if (operation.kind === "create") return createWorkspace(host, selected, operation);
+    if (operation.kind === "start") return startWorkspace(host, selected, operation);
+    return deleteWorkspace(host, selected, operation);
+  });
 }
 
-export async function serveWorkspaces(options, dependencies = {}) {
+async function selectedImage(host) {
+  let image;
+  try {
+    image = (await host.read(WORKSPACE_SELECTED_IMAGE)).trim();
+  } catch {
+    image = null;
+  }
+  if (image === null || !WORKSPACE_RELEASE_IMAGE.test(image)) {
+    throw new KitRefusal("kit_workspace_host_unconfigured", WORKSPACE_SELECTED_IMAGE);
+  }
+  return image;
+}
+
+async function hostSettings(options) {
   const configuration = await readConfiguration(options.configuration);
-  if (configuration.host === null || configuration.host.image === null) {
+  if (configuration.host === null) {
     throw new KitRefusal("kit_workspace_host_unconfigured", options.configuration);
   }
+  return { root: configuration.host.workspace, house: options.house };
+}
+
+async function updateWorkspace(host, settings, name) {
+  try {
+    const held = await heldWorkspace(host, name);
+    if (held === null || held.image === settings.image) return null;
+    const running = !STOPPED_STATES.includes(held.state);
+    if (running) {
+      const drained = await docker(host, ["exec", name, "kit", "resident", "drain"]);
+      if (drained.status !== 0) {
+        return { workspace: name, cause: drained.stdout.trim() || drained.stderr.trim() };
+      }
+    }
+    const refusal = await replaceWorkspace(host, settings, name, held);
+    if (refusal !== null) return { workspace: name, cause: refusal };
+    if (running) {
+      const started = await docker(host, ["start", name]);
+      if (started.status !== 0) {
+        return { workspace: name, cause: `the workspace did not start: ${started.stderr.trim()}` };
+      }
+    }
+    return { workspace: name, running };
+  } catch (error) {
+    if (!(error instanceof KitRefusal)) throw error;
+    return { workspace: name, cause: error.message };
+  }
+}
+
+export async function updateWorkspaces(options, dependencies = {}) {
   const host = adapter(dependencies);
-  const settings = {
-    root: configuration.host.workspace,
-    image: configuration.host.image,
-    house: options.house,
-  };
+  const updated = [];
+  const unchanged = [];
+  const managed = await managedWorkspaces(host);
+  if (managed.length === 0) return { updated, unchanged };
+  const settings = { ...(await hostSettings(options)), image: await selectedImage(host) };
+  for (const { name } of managed) {
+    const answer = await exclusively(host, name, () => updateWorkspace(host, settings, name));
+    if (answer === null) continue;
+    if (answer.cause === undefined) updated.push(answer);
+    else unchanged.push(answer);
+  }
+  return { updated, unchanged };
+}
+
+export async function serveWorkspaces(options, dependencies = {}) {
+  const host = adapter(dependencies);
+  const settings = await hostSettings(options);
   const session = await openSession(options, dependencies);
   const settled = [];
   const withdrawn = [];