@almyty/runner 1.5.2 → 1.5.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +28 -14
- package/dist/binaries.js +8 -1
- package/dist/binaries.js.map +1 -1
- package/dist/cli-args.d.ts +6 -0
- package/dist/cli-args.js +19 -0
- package/dist/cli-args.js.map +1 -1
- package/dist/cli.d.ts +8 -5
- package/dist/cli.js +34 -19
- package/dist/cli.js.map +1 -1
- package/dist/config.d.ts +11 -0
- package/dist/config.js +21 -8
- package/dist/config.js.map +1 -1
- package/dist/daemon.d.ts +34 -0
- package/dist/daemon.js +117 -18
- package/dist/daemon.js.map +1 -1
- package/dist/enroll.d.ts +91 -0
- package/dist/enroll.js +261 -0
- package/dist/enroll.js.map +1 -0
- package/dist/hosted-setup.d.ts +43 -0
- package/dist/hosted-setup.js +196 -0
- package/dist/hosted-setup.js.map +1 -0
- package/dist/policy.d.ts +26 -0
- package/dist/policy.js +143 -0
- package/dist/policy.js.map +1 -1
- package/dist/streamable-client.d.ts +23 -5
- package/dist/streamable-client.js +32 -5
- package/dist/streamable-client.js.map +1 -1
- package/dist/types.d.ts +9 -0
- package/dist/types.js.map +1 -1
- package/package.json +2 -2
package/README.md
CHANGED
|
@@ -16,32 +16,32 @@ start, restart, query and stop on that machine, so it is a pinned global
|
|
|
16
16
|
install rather than whatever `npx` resolves on each start.
|
|
17
17
|
|
|
18
18
|
```
|
|
19
|
-
npm i -g @almyty/
|
|
20
|
-
almyty
|
|
21
|
-
almyty
|
|
19
|
+
npm i -g @almyty/cli
|
|
20
|
+
almyty login # once per machine
|
|
21
|
+
almyty runner start # organization comes from login; hostname names the runner
|
|
22
22
|
# in another terminal:
|
|
23
|
-
almyty
|
|
23
|
+
almyty runner status
|
|
24
24
|
```
|
|
25
25
|
|
|
26
|
-
Stop with `almyty
|
|
26
|
+
Stop with `almyty runner stop` or ctrl-c in the daemon's terminal.
|
|
27
27
|
|
|
28
28
|
Or use the UI: log into your almyty account and head to **Runners → Start a
|
|
29
|
-
runner**.
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
29
|
+
runner**. It shows the three commands above. Login chooses your organization
|
|
30
|
+
when you belong to several. Starting the daemon creates a private runner named
|
|
31
|
+
after the machine's hostname; a duplicate hostname gets a number. Rename it or
|
|
32
|
+
change who can use it on the runner page. Labels live under Advanced.
|
|
33
33
|
|
|
34
34
|
## What identifies and authorises a runner
|
|
35
35
|
|
|
36
|
-
Your almyty login on that machine, not the name. `almyty
|
|
37
|
-
the token `almyty
|
|
36
|
+
Your almyty login on that machine, not the name. `almyty runner start` sends
|
|
37
|
+
the token `almyty login` stored in `~/.almyty/credentials.json` (or
|
|
38
38
|
`ALMYTY_TOKEN`); the backend attaches the daemon to the runner of that user in
|
|
39
39
|
that organization. The name is a label, unique within the organization:
|
|
40
40
|
|
|
41
41
|
- Someone who knows the name cannot connect to your runner. Their daemon
|
|
42
42
|
carries their login, so it is refused (the name is already used in the org)
|
|
43
43
|
rather than attached to yours.
|
|
44
|
-
- Restarting
|
|
44
|
+
- Restarting from a machine logged in as you keeps your saved runner name and replaces the
|
|
45
45
|
previous connection of your runner; that is how a rebuilt machine takes over.
|
|
46
46
|
- `--org` only picks among organizations you belong to; any other is refused.
|
|
47
47
|
- The daemon's live session is bound to your user as well: another member of
|
|
@@ -52,6 +52,16 @@ you only, not even org admins), **Team**, or **Org-wide**. It is enforced on
|
|
|
52
52
|
the server when runners are listed and fetched, when work is dispatched, and on
|
|
53
53
|
the tools a runner publishes.
|
|
54
54
|
|
|
55
|
+
## Hosted runners: `--enroll`
|
|
56
|
+
|
|
57
|
+
Inside a hosted runner pod there is no login. `almyty runner start --enroll`
|
|
58
|
+
(what the `almyty/runner-env` images run) reads the single-use enrollment token
|
|
59
|
+
from `ALMYTY_ENROLLMENT_TOKEN` (or the file named by
|
|
60
|
+
`ALMYTY_ENROLLMENT_TOKEN_FILE`), trades it at `ALMYTY_API_URL` for a runner
|
|
61
|
+
credential that works only on that runner's own stream, keeps the credential in
|
|
62
|
+
memory and renews it before it expires. A refused enrollment or renewal exits
|
|
63
|
+
non-zero, so Kubernetes restarts the container. See
|
|
64
|
+
[docs/hosted-runners.md](../../docs/hosted-runners.md).
|
|
55
65
|
## What that command lets almyty do to your machine
|
|
56
66
|
|
|
57
67
|
Read this before you run it on a machine you care about. The daemon prints the
|
|
@@ -107,13 +117,17 @@ The generic `process.*` layer has no tool-specific knowledge — there is no `cl
|
|
|
107
117
|
|
|
108
118
|
JSON, layered lowest precedence first:
|
|
109
119
|
|
|
110
|
-
1. Built-in defaults (host isolation, network allowed, installs blocked)
|
|
120
|
+
1. Built-in defaults plus the backend URL and chosen organization from login (host isolation, network allowed, installs blocked)
|
|
111
121
|
2. `~/.almyty/config.json` (global)
|
|
112
122
|
3. `./.almyty/config.json` (project-local)
|
|
113
|
-
4. Environment variables (`ALMYTY_URL`, `ALMYTY_TOKEN`, `ALMYTY_RUNNER_NAME`, `ALMYTY_RUNNER_ISOLATION`)
|
|
123
|
+
4. Environment variables (`ALMYTY_URL`, `ALMYTY_TOKEN`, `ALMYTY_ORG_ID`, `ALMYTY_RUNNER_NAME`, `ALMYTY_RUNNER_ISOLATION`)
|
|
114
124
|
5. CLI flags (`--name`, `--org`, `--label`, `--config`, `--url`)
|
|
115
125
|
6. Backend overrides (constrain-only; never escalate)
|
|
116
126
|
|
|
127
|
+
For an isolated local demo, set `ALMYTY_RUNNER_STATE_DIR` to a private directory
|
|
128
|
+
to keep that daemon's PID and status files separate. Use the same value with
|
|
129
|
+
`almyty runner start`, `status` and `stop`. The default is `~/.almyty/runner`.
|
|
130
|
+
|
|
117
131
|
A `~/.almyty/config.json` that keeps work inside one tree — the shape worth
|
|
118
132
|
copying if you want more than the defaults:
|
|
119
133
|
|
package/dist/binaries.js
CHANGED
|
@@ -1,5 +1,12 @@
|
|
|
1
1
|
import { spawn } from 'child_process';
|
|
2
|
-
|
|
2
|
+
// Generous on purpose: a timeout reports the binary as missing, so the
|
|
3
|
+
// backend never routes to it. gemini and aider take 1.2-1.4 s for
|
|
4
|
+
// `--version` on their own (a Node bundle and a Python import of litellm);
|
|
5
|
+
// probed alongside two dozen others in the runner-env image, 1.5 s missed
|
|
6
|
+
// gemini, and a one-CPU hosted pod under gVisor is slower still. A missing
|
|
7
|
+
// binary still answers at once (ENOENT), and a timeout ends the probe of
|
|
8
|
+
// that binary without trying the other flags.
|
|
9
|
+
const VERSION_TIMEOUT_MS = 10_000;
|
|
3
10
|
/**
|
|
4
11
|
* Probe `binary --version` (or equivalent) with a tight timeout.
|
|
5
12
|
* Returns the first non-empty line of stdout/stderr the binary emits,
|
package/dist/binaries.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"binaries.js","sourceRoot":"","sources":["../src/binaries.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAEtC,MAAM,kBAAkB,GAAG,
|
|
1
|
+
{"version":3,"file":"binaries.js","sourceRoot":"","sources":["../src/binaries.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAEtC,uEAAuE;AACvE,kEAAkE;AAClE,2EAA2E;AAC3E,0EAA0E;AAC1E,2EAA2E;AAC3E,yEAAyE;AACzE,8CAA8C;AAC9C,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC;;;;;;;;;;;;GAYG;AACH,MAAM,qBAAqB,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;AACnE,MAAM,gBAAgB,GAA6B;AACjD,uEAAuE;AACvE,6DAA6D;AAC7D,uDAAuD;AACvD,uEAAuE;CACxE,CAAC;AAiBF,MAAM,CAAC,MAAM,QAAQ,GAAc,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;IAC/C,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;QAC3B,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,KAA+B,CAAC;QACpC,IAAI,CAAC;YACH,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;YACnE,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YACpE,OAAO;QACT,CAAC;QACD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACrB,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,QAAQ,GAAG,IAAI,CAAC;YAChB,IAAI,CAAC;gBAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;QAChD,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACvB,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAChB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,IAAY,EAAE,WAAsB,QAAQ;IACtE,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,qBAAqB,CAAC,CAAC;IAC5E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5C,IAAI,MAAM,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QACjC,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;YAC5B,0DAA0D;YAC1D,yCAAyC;YACzC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACpD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnB,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC1B,iEAAiE;YACjE,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,2CAA2C;IAC7C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,KAAe,EACf,WAAsB,QAAQ;IAE9B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAC,CAAC,EAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAU,CAAC,CAAC,CAAC;IAChG,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,SAAS,CAAC,CAAS;IAC1B,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC1C,CAAC"}
|
package/dist/cli-args.d.ts
CHANGED
|
@@ -13,6 +13,12 @@ export interface ParsedFlags {
|
|
|
13
13
|
labels?: Record<string, string>;
|
|
14
14
|
/** --org: the organization to register in (X-Organization-Id). */
|
|
15
15
|
org?: string;
|
|
16
|
+
/**
|
|
17
|
+
* --enroll: run as a hosted runner, trading the pod's enrollment token
|
|
18
|
+
* (ALMYTY_ENROLLMENT_TOKEN) for a runner credential instead of using a
|
|
19
|
+
* login. Only for start.
|
|
20
|
+
*/
|
|
21
|
+
enroll?: boolean;
|
|
16
22
|
/**
|
|
17
23
|
* A usage problem worth exiting on. Parsing reports it rather than
|
|
18
24
|
* exiting itself, so the surface can be tested without a process, and
|
package/dist/cli-args.js
CHANGED
|
@@ -58,10 +58,29 @@ export function parseArgs(argv) {
|
|
|
58
58
|
flags.labels[value.slice(0, eq)] = value.slice(eq + 1);
|
|
59
59
|
continue;
|
|
60
60
|
}
|
|
61
|
+
if (a === '--enroll') {
|
|
62
|
+
if (flags.command !== 'start')
|
|
63
|
+
return { ...flags, error: '--enroll only applies to start' };
|
|
64
|
+
flags.enroll = true;
|
|
65
|
+
continue;
|
|
66
|
+
}
|
|
61
67
|
// Silently dropping an unknown flag is how `--nmae` spends an
|
|
62
68
|
// afternoon looking like a runner that ignores its own name.
|
|
63
69
|
return { ...flags, error: `Unknown option: ${a}\nRun \`almyty-runner --help\` to see what ${flags.command} accepts.` };
|
|
64
70
|
}
|
|
71
|
+
if (flags.enroll) {
|
|
72
|
+
// An enrolled runner's identity is the token's: the backend already
|
|
73
|
+
// made the runner row, in the organization, with the name it chose.
|
|
74
|
+
const identity = [
|
|
75
|
+
flags.name !== undefined && '--name',
|
|
76
|
+
flags.org !== undefined && '--org',
|
|
77
|
+
flags.labels !== undefined && '--label',
|
|
78
|
+
flags.configPath !== undefined && '--config',
|
|
79
|
+
].filter(Boolean);
|
|
80
|
+
if (identity.length) {
|
|
81
|
+
return { ...flags, error: `--enroll takes its identity from the enrollment token; ${identity.join(', ')} cannot be combined with it` };
|
|
82
|
+
}
|
|
83
|
+
}
|
|
65
84
|
return flags;
|
|
66
85
|
}
|
|
67
86
|
//# sourceMappingURL=cli-args.js.map
|
package/dist/cli-args.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cli-args.js","sourceRoot":"","sources":["../src/cli-args.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;
|
|
1
|
+
{"version":3,"file":"cli-args.js","sourceRoot":"","sources":["../src/cli-args.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAwBH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAU,CAAC;AAEhF,MAAM,WAAW,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAExE,wEAAwE;AACxE,MAAM,UAAU,SAAS,CAAC,IAAc;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClD,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,OAAO,KAAK,WAAW,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAC/E,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAEzE,IAAI,CAAE,QAA8B,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvD,oEAAoE;QACpE,OAAO;YACL,OAAO,EAAE,MAAM;YACf,KAAK,EAAE,oBAAoB,OAAO,eAAe,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,4CAA4C;SACjH,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAgB,EAAE,OAAO,EAAE,OAAiC,EAAE,CAAC;IAC1E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAC7D,IAAI,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjD,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC;YACnD,CAAC;YACD,CAAC,EAAE,CAAC;YACJ,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC;gBAAC,SAAS;YAAC,CAAC;YACrD,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;gBAAC,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC7D,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC;gBAAC,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC;gBAAC,SAAS;YAAC,CAAC;YACnD,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC;gBAAC,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC;gBAAC,SAAS;YAAC,CAAC;YACnD,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,EAAE,IAAI,CAAC;gBAAE,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,mCAAmC,KAAK,EAAE,EAAE,CAAC;YACpF,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;YAClC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YACvD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;YACrB,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO;gBAAE,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;YAC5F,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;YACpB,SAAS;QACX,CAAC;QACD,8DAA8D;QAC9D,6DAA6D;QAC7D,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,mBAAmB,CAAC,8CAA8C,KAAK,CAAC,OAAO,WAAW,EAAE,CAAC;IACzH,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,oEAAoE;QACpE,oEAAoE;QACpE,MAAM,QAAQ,GAAG;YACf,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,QAAQ;YACpC,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO;YAClC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,SAAS;YACvC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,UAAU;SAC7C,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAClB,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpB,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,0DAA0D,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,EAAE,CAAC;QACzI,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
|
package/dist/cli.d.ts
CHANGED
|
@@ -1,13 +1,16 @@
|
|
|
1
1
|
#!/usr/bin/env node
|
|
2
2
|
/**
|
|
3
|
-
* almyty
|
|
3
|
+
* almyty runner CLI.
|
|
4
4
|
*
|
|
5
|
-
* almyty
|
|
6
|
-
* almyty
|
|
7
|
-
* almyty
|
|
5
|
+
* almyty runner start [--name X] [--org ORG_ID] [--label k=v]... [--config path] [--url URL]
|
|
6
|
+
* almyty runner start --enroll [--url URL]
|
|
7
|
+
* almyty runner status
|
|
8
|
+
* almyty runner stop
|
|
8
9
|
*
|
|
9
10
|
* Auth: ALMYTY_TOKEN env or ~/.almyty/credentials.json (run
|
|
10
|
-
* `almyty
|
|
11
|
+
* `almyty login` first if neither is configured). The runner is
|
|
11
12
|
* registered to whoever that login belongs to; the name is only a label.
|
|
13
|
+
* With --enroll (inside a hosted pod) there is no login: the pod's
|
|
14
|
+
* single-use enrollment token is traded for a runner credential (enroll.ts).
|
|
12
15
|
*/
|
|
13
16
|
export { parseArgs, COMMANDS, type ParsedFlags } from './cli-args.js';
|
package/dist/cli.js
CHANGED
|
@@ -1,33 +1,41 @@
|
|
|
1
1
|
#!/usr/bin/env node
|
|
2
2
|
/**
|
|
3
|
-
* almyty
|
|
3
|
+
* almyty runner CLI.
|
|
4
4
|
*
|
|
5
|
-
* almyty
|
|
6
|
-
* almyty
|
|
7
|
-
* almyty
|
|
5
|
+
* almyty runner start [--name X] [--org ORG_ID] [--label k=v]... [--config path] [--url URL]
|
|
6
|
+
* almyty runner start --enroll [--url URL]
|
|
7
|
+
* almyty runner status
|
|
8
|
+
* almyty runner stop
|
|
8
9
|
*
|
|
9
10
|
* Auth: ALMYTY_TOKEN env or ~/.almyty/credentials.json (run
|
|
10
|
-
* `almyty
|
|
11
|
+
* `almyty login` first if neither is configured). The runner is
|
|
11
12
|
* registered to whoever that login belongs to; the name is only a label.
|
|
13
|
+
* With --enroll (inside a hosted pod) there is no login: the pod's
|
|
14
|
+
* single-use enrollment token is traded for a runner credential (enroll.ts).
|
|
12
15
|
*/
|
|
13
16
|
import { RunnerDaemon, readStatus, stopDaemon } from './daemon.js';
|
|
14
17
|
import { RUNNER_VERSION } from './runtime-info.js';
|
|
15
18
|
import { parseArgs } from './cli-args.js';
|
|
16
19
|
export { parseArgs, COMMANDS } from './cli-args.js';
|
|
17
20
|
function printHelp() {
|
|
18
|
-
process.stdout.write(`almyty
|
|
21
|
+
process.stdout.write(`almyty runner v${RUNNER_VERSION}
|
|
19
22
|
|
|
20
23
|
Usage:
|
|
21
|
-
almyty
|
|
22
|
-
almyty
|
|
23
|
-
almyty
|
|
24
|
+
almyty runner start [options] Register and run the daemon
|
|
25
|
+
almyty runner status Show local daemon status
|
|
26
|
+
almyty runner stop Send SIGTERM to the local daemon
|
|
24
27
|
|
|
25
28
|
Options for start:
|
|
26
29
|
--name <name> Runner name (matches [a-zA-Z0-9_-]{1,64}), unique in the org; defaults to this machine's hostname
|
|
27
|
-
--org <org-id>
|
|
30
|
+
--org <org-id> Override the organization saved by login
|
|
28
31
|
--label key=value Add a descriptive label; repeat for multiple
|
|
29
32
|
--config <path> Path to a JSON config file (overrides global+project)
|
|
30
33
|
--url <backend-url> Override backend URL (e.g. https://api.almyty.com)
|
|
34
|
+
--enroll Hosted runner mode: trade the enrollment token in
|
|
35
|
+
ALMYTY_ENROLLMENT_TOKEN (or the file named by
|
|
36
|
+
ALMYTY_ENROLLMENT_TOKEN_FILE) for a runner credential
|
|
37
|
+
at ALMYTY_API_URL, instead of using a login. Used by
|
|
38
|
+
the runner-env images; takes no --name/--org/--label/--config
|
|
31
39
|
|
|
32
40
|
Other:
|
|
33
41
|
-h, --help Show this help
|
|
@@ -35,11 +43,11 @@ Other:
|
|
|
35
43
|
|
|
36
44
|
Exit codes:
|
|
37
45
|
0 success
|
|
38
|
-
1 the command ran and failed (no daemon running, start refused)
|
|
46
|
+
1 the command ran and failed (no daemon running, start or enrollment refused)
|
|
39
47
|
2 usage error (unknown command, bad flags)
|
|
40
48
|
|
|
41
49
|
Auth:
|
|
42
|
-
ALMYTY_TOKEN env or ~/.almyty/credentials.json (\`almyty
|
|
50
|
+
ALMYTY_TOKEN env or ~/.almyty/credentials.json (\`almyty login\`).
|
|
43
51
|
The runner belongs to the user that login is for. Nobody else can
|
|
44
52
|
attach to it, whatever name they pick.
|
|
45
53
|
`);
|
|
@@ -78,15 +86,22 @@ async function main() {
|
|
|
78
86
|
case 'start': {
|
|
79
87
|
const daemon = new RunnerDaemon();
|
|
80
88
|
try {
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
89
|
+
if (flags.enroll) {
|
|
90
|
+
await daemon.startEnrolled({ url: flags.url });
|
|
91
|
+
}
|
|
92
|
+
else {
|
|
93
|
+
await daemon.start({
|
|
94
|
+
name: flags.name,
|
|
95
|
+
labels: flags.labels,
|
|
96
|
+
backendUrl: flags.url,
|
|
97
|
+
organizationId: flags.org,
|
|
98
|
+
configPath: flags.configPath,
|
|
99
|
+
});
|
|
100
|
+
}
|
|
88
101
|
}
|
|
89
102
|
catch (err) {
|
|
103
|
+
// Non-zero on a failed enrollment too: in a hosted pod that is
|
|
104
|
+
// what makes Kubernetes restart the container.
|
|
90
105
|
process.stderr.write(`failed to start: ${err.message}\n`);
|
|
91
106
|
process.exit(1);
|
|
92
107
|
}
|
package/dist/cli.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA
|
|
1
|
+
{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE1C,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAoB,MAAM,eAAe,CAAC;AAEtE,SAAS,SAAS;IAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgCtD,CAAC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,QAAQ,KAAK,CAAC,OAAO,EAAE,CAAC;QACtB,KAAK,SAAS;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,cAAc,IAAI,CAAC,CAAC;YAAC,OAAO;QACpE,KAAK,MAAM;YAAE,SAAS,EAAE,CAAC;YAAC,OAAO;QACjC,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;YAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;gBAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;YACxB,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;gBAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;oBACjB,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;gBACjD,CAAC;qBAAM,CAAC;oBACN,MAAM,MAAM,CAAC,KAAK,CAAC;wBACjB,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,UAAU,EAAE,KAAK,CAAC,GAAG;wBACrB,cAAc,EAAE,KAAK,CAAC,GAAG;wBACzB,UAAU,EAAE,KAAK,CAAC,UAAU;qBAC7B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,+DAA+D;gBAC/D,+CAA+C;gBAC/C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;gBAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,wDAAwD;YACxD,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC5B,OAAO;QACT,CAAC;IACH,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;IACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,GAAG,EAAE,OAAO,IAAI,GAAG,IAAI,CAAC,CAAC;IACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
|
package/dist/config.d.ts
CHANGED
|
@@ -42,6 +42,11 @@ export declare const PROJECT_CONFIG_PATH: string;
|
|
|
42
42
|
* patching `fs` or `process.env`.
|
|
43
43
|
*/
|
|
44
44
|
export interface LoadConfigInputs {
|
|
45
|
+
/** Defaults from the shared login, before config/env/flag overrides. */
|
|
46
|
+
credentials?: {
|
|
47
|
+
url: string;
|
|
48
|
+
organizationId?: string;
|
|
49
|
+
};
|
|
45
50
|
/** CLI flag overrides. Highest precedence. */
|
|
46
51
|
flags?: Partial<ResolvedConfig> & {
|
|
47
52
|
configPath?: string;
|
|
@@ -66,3 +71,9 @@ export interface LoadConfigInputs {
|
|
|
66
71
|
*/
|
|
67
72
|
export declare function runnerNameFromHostname(host: string): string;
|
|
68
73
|
export declare function loadConfig(inputs?: LoadConfigInputs): ResolvedConfig;
|
|
74
|
+
/**
|
|
75
|
+
* The runner's command channel (RCE-capable) and its bearer token ride
|
|
76
|
+
* the backend URL, so plaintext http:// to a remote host is refused. http
|
|
77
|
+
* is allowed only for loopback (local dev). Throws with a sentence.
|
|
78
|
+
*/
|
|
79
|
+
export declare function assertSecureBackendUrl(backendUrl: string): void;
|
package/dist/config.js
CHANGED
|
@@ -109,6 +109,8 @@ export function describeIsolationPosture(config) {
|
|
|
109
109
|
: 'cwd unrestricted');
|
|
110
110
|
if (config.denyPatterns.length > 0)
|
|
111
111
|
guards.push(`${config.denyPatterns.length} deny pattern(s)`);
|
|
112
|
+
if (config.allowBinaries?.length)
|
|
113
|
+
guards.push(`binaries limited to ${config.allowBinaries.length}`);
|
|
112
114
|
return `isolation=host — commands run on this machine as you (${guards.join(', ')})`;
|
|
113
115
|
}
|
|
114
116
|
export const GLOBAL_CONFIG_PATH = join(homedir(), '.almyty', 'config.json');
|
|
@@ -133,6 +135,10 @@ export function loadConfig(inputs = {}) {
|
|
|
133
135
|
const globalPath = inputs.globalPath ?? GLOBAL_CONFIG_PATH;
|
|
134
136
|
const projectPath = inputs.projectPath ?? PROJECT_CONFIG_PATH;
|
|
135
137
|
let resolved = clone(DEFAULTS);
|
|
138
|
+
if (inputs.credentials) {
|
|
139
|
+
resolved.backendUrl = inputs.credentials.url;
|
|
140
|
+
resolved.organizationId = inputs.credentials.organizationId;
|
|
141
|
+
}
|
|
136
142
|
// Layer 2: global config file.
|
|
137
143
|
if (exists(globalPath)) {
|
|
138
144
|
resolved = mergeIn(resolved, parseConfigFile(readFile(globalPath), globalPath));
|
|
@@ -182,6 +188,7 @@ export function loadConfig(inputs = {}) {
|
|
|
182
188
|
if (f.binaryProbeList && f.binaryProbeList.length > 0) {
|
|
183
189
|
resolved.binaryProbeList = f.binaryProbeList;
|
|
184
190
|
}
|
|
191
|
+
resolved.explicitName = !!resolved.name;
|
|
185
192
|
// No name anywhere: use the machine's own, which is what a person
|
|
186
193
|
// would type anyway ("franes-macbook-pro").
|
|
187
194
|
if (!resolved.name) {
|
|
@@ -194,24 +201,29 @@ export function loadConfig(inputs = {}) {
|
|
|
194
201
|
// fail with a less-helpful message.
|
|
195
202
|
throw new Error('runner name is required (set via --name, ALMYTY_RUNNER_NAME, or config.name)');
|
|
196
203
|
}
|
|
197
|
-
|
|
198
|
-
|
|
199
|
-
|
|
204
|
+
assertSecureBackendUrl(resolved.backendUrl);
|
|
205
|
+
return resolved;
|
|
206
|
+
}
|
|
207
|
+
/**
|
|
208
|
+
* The runner's command channel (RCE-capable) and its bearer token ride
|
|
209
|
+
* the backend URL, so plaintext http:// to a remote host is refused. http
|
|
210
|
+
* is allowed only for loopback (local dev). Throws with a sentence.
|
|
211
|
+
*/
|
|
212
|
+
export function assertSecureBackendUrl(backendUrl) {
|
|
200
213
|
try {
|
|
201
|
-
const u = new URL(
|
|
214
|
+
const u = new URL(backendUrl);
|
|
202
215
|
const host = u.hostname;
|
|
203
|
-
const loopback = host === 'localhost' || host === '127.0.0.1' || host === '::1' || host.endsWith('.localhost');
|
|
216
|
+
const loopback = host === 'localhost' || host === '127.0.0.1' || host === '::1' || host === '[::1]' || host.endsWith('.localhost');
|
|
204
217
|
if (u.protocol !== 'https:' && !loopback) {
|
|
205
|
-
throw new Error(`Refusing an insecure ${u.protocol}// backend URL for a remote host: ${
|
|
218
|
+
throw new Error(`Refusing an insecure ${u.protocol}// backend URL for a remote host: ${backendUrl}. ` +
|
|
206
219
|
'Use https:// (http is only allowed for localhost).');
|
|
207
220
|
}
|
|
208
221
|
}
|
|
209
222
|
catch (e) {
|
|
210
223
|
if (e instanceof Error && e.message.startsWith('Refusing'))
|
|
211
224
|
throw e;
|
|
212
|
-
throw new Error(`Invalid backend URL: ${
|
|
225
|
+
throw new Error(`Invalid backend URL: ${backendUrl}`);
|
|
213
226
|
}
|
|
214
|
-
return resolved;
|
|
215
227
|
}
|
|
216
228
|
// ── helpers ─────────────────────────────────────────────────────────
|
|
217
229
|
function safeRead(path) {
|
|
@@ -238,6 +250,7 @@ function mergeIn(into, layer) {
|
|
|
238
250
|
name: layer.name ?? into.name,
|
|
239
251
|
labels: { ...into.labels, ...(layer.labels ?? {}) },
|
|
240
252
|
backendUrl: layer.backendUrl ?? into.backendUrl,
|
|
253
|
+
organizationId: layer.organizationId ?? into.organizationId,
|
|
241
254
|
binaryProbeList: layer.binaryProbeList && layer.binaryProbeList.length > 0
|
|
242
255
|
? layer.binaryProbeList
|
|
243
256
|
: into.binaryProbeList,
|
package/dist/config.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,MAAM,CAAC;AAEhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAG5D;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,+DAA+D;IAC/D,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK;IAClC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO;IACpC,QAAQ,EAAE,QAAQ;IAClB,0EAA0E;IAC1E,4EAA4E;IAC5E,GAAG,gBAAgB,EAAE;CACtB,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,wBAAwB,CAAC;AAE5D,MAAM,CAAC,MAAM,QAAQ,GAAmB;IACtC,MAAM,EAAE;QACN;;;;;;;;;;;;;;;;;;;;;;;;WAwBG;QACH,gBAAgB,EAAE,MAAM;QACxB,aAAa,EAAE,CAAC;QAChB,eAAe,EAAE,EAAE;QACnB,YAAY,EAAE,EAAE;QAChB;;;;WAIG;QACH,cAAc,EAAE,KAAK;QACrB;;;;;;WAMG;QACH,cAAc,EAAE,IAAI;KACrB;IACD,IAAI,EAAE,EAAE;IACR,MAAM,EAAE,EAAE;IACV,eAAe,EAAE,yBAAyB;IAC1C,UAAU,EAAE,mBAAmB;CAChC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAoB;IAC3D,IAAI,MAAM,CAAC,gBAAgB,KAAK,WAAW,EAAE,CAAC;QAC5C,OAAO,CACL,sFAAsF;YACtF,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,OAAO,CACL,8FAA8F;YAC9F,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAC7E,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;QAC/B,CAAC,CAAC,kBAAkB,MAAM,CAAC,eAAe,CAAC,MAAM,UAAU;QAC3D,CAAC,CAAC,kBAAkB,CACvB,CAAC;IACF,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,kBAAkB,CAAC,CAAC;IACjG,OAAO,yDAAyD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AACvF,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;AAC5E,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;
|
|
1
|
+
{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,MAAM,CAAC;AAEhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAG5D;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,+DAA+D;IAC/D,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK;IAClC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO;IACpC,QAAQ,EAAE,QAAQ;IAClB,0EAA0E;IAC1E,4EAA4E;IAC5E,GAAG,gBAAgB,EAAE;CACtB,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,wBAAwB,CAAC;AAE5D,MAAM,CAAC,MAAM,QAAQ,GAAmB;IACtC,MAAM,EAAE;QACN;;;;;;;;;;;;;;;;;;;;;;;;WAwBG;QACH,gBAAgB,EAAE,MAAM;QACxB,aAAa,EAAE,CAAC;QAChB,eAAe,EAAE,EAAE;QACnB,YAAY,EAAE,EAAE;QAChB;;;;WAIG;QACH,cAAc,EAAE,KAAK;QACrB;;;;;;WAMG;QACH,cAAc,EAAE,IAAI;KACrB;IACD,IAAI,EAAE,EAAE;IACR,MAAM,EAAE,EAAE;IACV,eAAe,EAAE,yBAAyB;IAC1C,UAAU,EAAE,mBAAmB;CAChC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAoB;IAC3D,IAAI,MAAM,CAAC,gBAAgB,KAAK,WAAW,EAAE,CAAC;QAC5C,OAAO,CACL,sFAAsF;YACtF,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,OAAO,CACL,8FAA8F;YAC9F,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAC7E,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;QAC/B,CAAC,CAAC,kBAAkB,MAAM,CAAC,eAAe,CAAC,MAAM,UAAU;QAC3D,CAAC,CAAC,kBAAkB,CACvB,CAAC;IACF,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,kBAAkB,CAAC,CAAC;IACjG,IAAI,MAAM,CAAC,aAAa,EAAE,MAAM;QAAE,MAAM,CAAC,IAAI,CAAC,uBAAuB,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;IACpG,OAAO,yDAAyD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AACvF,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;AAC5E,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;AA2BjF;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,OAAO,IAAI;SACR,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SACb,WAAW,EAAE;SACb,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC;SAC7B,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC;SAC7B,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,SAA2B,EAAE;IACtD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,QAAQ,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,UAAU,CAAC;IAC3C,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,kBAAkB,CAAC;IAC3D,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,mBAAmB,CAAC;IAE9D,IAAI,QAAQ,GAAmB,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,QAAQ,CAAC,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC;QAC7C,QAAQ,CAAC,cAAc,GAAG,MAAM,CAAC,WAAW,CAAC,cAAc,CAAC;IAC9D,CAAC;IAED,+BAA+B;IAC/B,IAAI,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QACvB,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;IAClF,CAAC;IACD,sCAAsC;IACtC,IAAI,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QACxB,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;IACpF,CAAC;IACD,iEAAiE;IACjE,kEAAkE;IAClE,iEAAiE;IACjE,IAAI,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;QACzC,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC;QACnF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,EAAE,CAAC,CAAC;QACnD,CAAC;QACD,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,mEAAmE;IACnE,qEAAqE;IACrE,IAAI,GAAG,CAAC,UAAU;QAAE,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;IACzD,IAAI,GAAG,CAAC,kBAAkB;QAAE,QAAQ,CAAC,IAAI,GAAG,GAAG,CAAC,kBAAkB,CAAC;IACnE,IAAI,GAAG,CAAC,aAAa;QAAE,QAAQ,CAAC,cAAc,GAAG,GAAG,CAAC,aAAa,CAAC;IACnE,IAAI,GAAG,CAAC,uBAAuB,EAAE,CAAC;QAChC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;QACD,QAAQ,CAAC,MAAM,CAAC,gBAAgB,GAAG,GAAG,CAAC,uBAAuB,CAAC;IACjE,CAAC;IAED,8DAA8D;IAC9D,yBAAyB;IACzB,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,CAAC,IAAI;QAAE,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IACnC,IAAI,CAAC,CAAC,MAAM;QAAE,QAAQ,CAAC,MAAM,GAAG,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;IACpE,IAAI,CAAC,CAAC,UAAU;QAAE,QAAQ,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;IACrD,IAAI,CAAC,CAAC,cAAc;QAAE,QAAQ,CAAC,cAAc,GAAG,CAAC,CAAC,cAAc,CAAC;IACjE,IAAI,CAAC,CAAC,MAAM;QAAE,QAAQ,CAAC,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7E,IAAI,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtD,QAAQ,CAAC,eAAe,GAAG,CAAC,CAAC,eAAe,CAAC;IAC/C,CAAC;IAED,QAAQ,CAAC,YAAY,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;IAExC,kEAAkE;IAClE,4CAA4C;IAC5C,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,QAAQ,CAAC,IAAI,GAAG,sBAAsB,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,2DAA2D;QAC3D,4DAA4D;QAC5D,8DAA8D;QAC9D,oCAAoC;QACpC,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;IAED,sBAAsB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAE5C,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAAkB;IACvD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC;QACxB,MAAM,QAAQ,GACZ,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACpH,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,wBAAwB,CAAC,CAAC,QAAQ,qCAAqC,UAAU,IAAI;gBACnF,oDAAoD,CACvD,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,MAAM,CAAC,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,wBAAwB,UAAU,EAAE,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED,uEAAuE;AAEvE,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAAmB,EAAE,IAAY;IACxD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzF,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,IAAoB,EAAE,KAA8B;IACnE,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI;QAC7B,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE;QACnD,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU;QAC/C,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc;QAC3D,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;YACxE,CAAC,CAAC,KAAK,CAAC,eAAe;YACvB,CAAC,CAAC,IAAI,CAAC,eAAe;QACxB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM;KAClF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAkB,EAAE,KAA4B;IACzE,OAAO;QACL,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,IAAI,CAAC,gBAAgB;QACjE,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa;QACxD,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI,CAAC,eAAe;QAC9D,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY;QACrD,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc;QAC3D,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc;KAC5D,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,MAAM,CAAC;AACnD,CAAC;AAED,SAAS,KAAK,CAAI,KAAQ;IACxB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AAC3C,CAAC"}
|
package/dist/daemon.d.ts
CHANGED
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
import { ResolvedConfig } from './types.js';
|
|
2
|
+
import { prepareHostedWorkspace } from './hosted-setup.js';
|
|
2
3
|
export interface DaemonStatus {
|
|
3
4
|
pid: number;
|
|
4
5
|
startedAt: string;
|
|
@@ -9,6 +10,20 @@ export interface DaemonStatus {
|
|
|
9
10
|
inUseProcesses: number;
|
|
10
11
|
connectionState: 'connecting' | 'online' | 'reconnecting' | 'fatal';
|
|
11
12
|
}
|
|
13
|
+
export interface EnrolledStartOptions {
|
|
14
|
+
/** --url: overrides ALMYTY_API_URL. */
|
|
15
|
+
url?: string;
|
|
16
|
+
/** Defaults to process.env; the token variables are removed from it once read. */
|
|
17
|
+
env?: Record<string, string | undefined>;
|
|
18
|
+
/** Test injection. */
|
|
19
|
+
fetch?: typeof globalThis.fetch;
|
|
20
|
+
/** How a fatal credential problem ends the process. Defaults to process.exit. */
|
|
21
|
+
exit?: (code: number) => void;
|
|
22
|
+
/** Tests leave the process's signal handlers alone. */
|
|
23
|
+
installSignals?: boolean;
|
|
24
|
+
/** Test injection for the first-start workspace setup. */
|
|
25
|
+
prepare?: typeof prepareHostedWorkspace;
|
|
26
|
+
}
|
|
12
27
|
/**
|
|
13
28
|
* Runner daemon. Responsibilities, in order:
|
|
14
29
|
*
|
|
@@ -36,6 +51,8 @@ export declare class RunnerDaemon {
|
|
|
36
51
|
private runnerId;
|
|
37
52
|
private heartbeatTimer;
|
|
38
53
|
private status;
|
|
54
|
+
/** A hosted runner's renewable credential (enroll mode only). */
|
|
55
|
+
private credential;
|
|
39
56
|
/** Guards against overlapping re-establish attempts. */
|
|
40
57
|
private reestablishing;
|
|
41
58
|
/** Consecutive failed re-establish attempts; bounds the retry loop. */
|
|
@@ -49,6 +66,23 @@ export declare class RunnerDaemon {
|
|
|
49
66
|
start(flags: Partial<ResolvedConfig> & {
|
|
50
67
|
configPath?: string;
|
|
51
68
|
}): Promise<void>;
|
|
69
|
+
/**
|
|
70
|
+
* Enroll mode, for a runner inside a hosted pod (enroll.ts). Trades the
|
|
71
|
+
* pod's single-use enrollment token for a runner credential, sets the
|
|
72
|
+
* workspace up on its first start (hosted-setup.ts), and then holds the
|
|
73
|
+
* hosted stream like any runner holds its own. Throws EnrollmentError
|
|
74
|
+
* when enrollment fails; the CLI exits non-zero and Kubernetes restarts
|
|
75
|
+
* the container.
|
|
76
|
+
*/
|
|
77
|
+
startEnrolled(opts?: EnrolledStartOptions): Promise<void>;
|
|
78
|
+
/** Stop heartbeats, renewal and the stream; tell the backend it is draining. */
|
|
79
|
+
shutdown(): Promise<void>;
|
|
80
|
+
/**
|
|
81
|
+
* Everything after the runner knows who it is: the process manager,
|
|
82
|
+
* the stream, the heartbeat loop and the state file. Shared by the
|
|
83
|
+
* login path and enroll mode.
|
|
84
|
+
*/
|
|
85
|
+
private connect;
|
|
52
86
|
/**
|
|
53
87
|
* Exit signal flow. On the first SIGINT/SIGTERM, transition to
|
|
54
88
|
* draining and inform the backend; on the second, hard exit.
|