@almyty/runner 1.5.3 → 1.5.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +13 -0
- package/dist/binaries.js +8 -1
- package/dist/binaries.js.map +1 -1
- package/dist/cli-args.d.ts +6 -0
- package/dist/cli-args.js +19 -0
- package/dist/cli-args.js.map +1 -1
- package/dist/cli.d.ts +3 -0
- package/dist/cli.js +23 -8
- package/dist/cli.js.map +1 -1
- package/dist/config.d.ts +6 -0
- package/dist/config.js +15 -8
- package/dist/config.js.map +1 -1
- package/dist/daemon.d.ts +37 -0
- package/dist/daemon.js +148 -14
- package/dist/daemon.js.map +1 -1
- package/dist/enroll.d.ts +91 -0
- package/dist/enroll.js +261 -0
- package/dist/enroll.js.map +1 -0
- package/dist/hosted-setup.d.ts +43 -0
- package/dist/hosted-setup.js +202 -0
- package/dist/hosted-setup.js.map +1 -0
- package/dist/model-proxy.d.ts +95 -0
- package/dist/model-proxy.js +210 -0
- package/dist/model-proxy.js.map +1 -0
- package/dist/policy.d.ts +26 -0
- package/dist/policy.js +143 -0
- package/dist/policy.js.map +1 -1
- package/dist/streamable-client.d.ts +23 -5
- package/dist/streamable-client.js +32 -5
- package/dist/streamable-client.js.map +1 -1
- package/dist/types.d.ts +7 -0
- package/dist/types.js.map +1 -1
- package/package.json +2 -2
package/README.md
CHANGED
|
@@ -52,6 +52,19 @@ you only, not even org admins), **Team**, or **Org-wide**. It is enforced on
|
|
|
52
52
|
the server when runners are listed and fetched, when work is dispatched, and on
|
|
53
53
|
the tools a runner publishes.
|
|
54
54
|
|
|
55
|
+
## Hosted runners: `--enroll`
|
|
56
|
+
|
|
57
|
+
Inside a hosted runner pod there is no login. `almyty runner start --enroll`
|
|
58
|
+
(what the `almyty/runner-env` images run) reads the single-use enrollment token
|
|
59
|
+
from `ALMYTY_ENROLLMENT_TOKEN` (or the file named by
|
|
60
|
+
`ALMYTY_ENROLLMENT_TOKEN_FILE`), trades it at `ALMYTY_API_URL` for a runner
|
|
61
|
+
credential that works only on that runner's own stream, keeps the credential in
|
|
62
|
+
memory and renews it before it expires. A refused enrollment or renewal exits
|
|
63
|
+
non-zero, so Kubernetes restarts the container. When the pod carries a model
|
|
64
|
+
token, the runner serves it to the coding CLIs through a loopback model proxy
|
|
65
|
+
(`127.0.0.1:$ALMYTY_MODEL_PROXY_PORT`) and renews it while the pod runs; the
|
|
66
|
+
CLIs only ever see a placeholder key. See
|
|
67
|
+
[docs/hosted-runners.md](../../docs/hosted-runners.md).
|
|
55
68
|
## What that command lets almyty do to your machine
|
|
56
69
|
|
|
57
70
|
Read this before you run it on a machine you care about. The daemon prints the
|
package/dist/binaries.js
CHANGED
|
@@ -1,5 +1,12 @@
|
|
|
1
1
|
import { spawn } from 'child_process';
|
|
2
|
-
|
|
2
|
+
// Generous on purpose: a timeout reports the binary as missing, so the
|
|
3
|
+
// backend never routes to it. gemini and aider take 1.2-1.4 s for
|
|
4
|
+
// `--version` on their own (a Node bundle and a Python import of litellm);
|
|
5
|
+
// probed alongside two dozen others in the runner-env image, 1.5 s missed
|
|
6
|
+
// gemini, and a one-CPU hosted pod under gVisor is slower still. A missing
|
|
7
|
+
// binary still answers at once (ENOENT), and a timeout ends the probe of
|
|
8
|
+
// that binary without trying the other flags.
|
|
9
|
+
const VERSION_TIMEOUT_MS = 10_000;
|
|
3
10
|
/**
|
|
4
11
|
* Probe `binary --version` (or equivalent) with a tight timeout.
|
|
5
12
|
* Returns the first non-empty line of stdout/stderr the binary emits,
|
package/dist/binaries.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"binaries.js","sourceRoot":"","sources":["../src/binaries.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAEtC,MAAM,kBAAkB,GAAG,
|
|
1
|
+
{"version":3,"file":"binaries.js","sourceRoot":"","sources":["../src/binaries.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAEtC,uEAAuE;AACvE,kEAAkE;AAClE,2EAA2E;AAC3E,0EAA0E;AAC1E,2EAA2E;AAC3E,yEAAyE;AACzE,8CAA8C;AAC9C,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC;;;;;;;;;;;;GAYG;AACH,MAAM,qBAAqB,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;AACnE,MAAM,gBAAgB,GAA6B;AACjD,uEAAuE;AACvE,6DAA6D;AAC7D,uDAAuD;AACvD,uEAAuE;CACxE,CAAC;AAiBF,MAAM,CAAC,MAAM,QAAQ,GAAc,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;IAC/C,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;QAC3B,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,KAA+B,CAAC;QACpC,IAAI,CAAC;YACH,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;YACnE,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YACpE,OAAO;QACT,CAAC;QACD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACrB,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,QAAQ,GAAG,IAAI,CAAC;YAChB,IAAI,CAAC;gBAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;QAChD,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACvB,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAChB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,IAAY,EAAE,WAAsB,QAAQ;IACtE,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,qBAAqB,CAAC,CAAC;IAC5E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5C,IAAI,MAAM,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QACjC,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;YAC5B,0DAA0D;YAC1D,yCAAyC;YACzC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACpD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnB,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC1B,iEAAiE;YACjE,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,2CAA2C;IAC7C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,KAAe,EACf,WAAsB,QAAQ;IAE9B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAC,CAAC,EAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAU,CAAC,CAAC,CAAC;IAChG,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,SAAS,CAAC,CAAS;IAC1B,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC1C,CAAC"}
|
package/dist/cli-args.d.ts
CHANGED
|
@@ -13,6 +13,12 @@ export interface ParsedFlags {
|
|
|
13
13
|
labels?: Record<string, string>;
|
|
14
14
|
/** --org: the organization to register in (X-Organization-Id). */
|
|
15
15
|
org?: string;
|
|
16
|
+
/**
|
|
17
|
+
* --enroll: run as a hosted runner, trading the pod's enrollment token
|
|
18
|
+
* (ALMYTY_ENROLLMENT_TOKEN) for a runner credential instead of using a
|
|
19
|
+
* login. Only for start.
|
|
20
|
+
*/
|
|
21
|
+
enroll?: boolean;
|
|
16
22
|
/**
|
|
17
23
|
* A usage problem worth exiting on. Parsing reports it rather than
|
|
18
24
|
* exiting itself, so the surface can be tested without a process, and
|
package/dist/cli-args.js
CHANGED
|
@@ -58,10 +58,29 @@ export function parseArgs(argv) {
|
|
|
58
58
|
flags.labels[value.slice(0, eq)] = value.slice(eq + 1);
|
|
59
59
|
continue;
|
|
60
60
|
}
|
|
61
|
+
if (a === '--enroll') {
|
|
62
|
+
if (flags.command !== 'start')
|
|
63
|
+
return { ...flags, error: '--enroll only applies to start' };
|
|
64
|
+
flags.enroll = true;
|
|
65
|
+
continue;
|
|
66
|
+
}
|
|
61
67
|
// Silently dropping an unknown flag is how `--nmae` spends an
|
|
62
68
|
// afternoon looking like a runner that ignores its own name.
|
|
63
69
|
return { ...flags, error: `Unknown option: ${a}\nRun \`almyty-runner --help\` to see what ${flags.command} accepts.` };
|
|
64
70
|
}
|
|
71
|
+
if (flags.enroll) {
|
|
72
|
+
// An enrolled runner's identity is the token's: the backend already
|
|
73
|
+
// made the runner row, in the organization, with the name it chose.
|
|
74
|
+
const identity = [
|
|
75
|
+
flags.name !== undefined && '--name',
|
|
76
|
+
flags.org !== undefined && '--org',
|
|
77
|
+
flags.labels !== undefined && '--label',
|
|
78
|
+
flags.configPath !== undefined && '--config',
|
|
79
|
+
].filter(Boolean);
|
|
80
|
+
if (identity.length) {
|
|
81
|
+
return { ...flags, error: `--enroll takes its identity from the enrollment token; ${identity.join(', ')} cannot be combined with it` };
|
|
82
|
+
}
|
|
83
|
+
}
|
|
65
84
|
return flags;
|
|
66
85
|
}
|
|
67
86
|
//# sourceMappingURL=cli-args.js.map
|
package/dist/cli-args.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cli-args.js","sourceRoot":"","sources":["../src/cli-args.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;
|
|
1
|
+
{"version":3,"file":"cli-args.js","sourceRoot":"","sources":["../src/cli-args.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAwBH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAU,CAAC;AAEhF,MAAM,WAAW,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAExE,wEAAwE;AACxE,MAAM,UAAU,SAAS,CAAC,IAAc;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClD,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,OAAO,KAAK,WAAW,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAC/E,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAEzE,IAAI,CAAE,QAA8B,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvD,oEAAoE;QACpE,OAAO;YACL,OAAO,EAAE,MAAM;YACf,KAAK,EAAE,oBAAoB,OAAO,eAAe,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,4CAA4C;SACjH,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAgB,EAAE,OAAO,EAAE,OAAiC,EAAE,CAAC;IAC1E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAC7D,IAAI,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjD,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC;YACnD,CAAC;YACD,CAAC,EAAE,CAAC;YACJ,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC;gBAAC,SAAS;YAAC,CAAC;YACrD,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;gBAAC,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC7D,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC;gBAAC,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC;gBAAC,SAAS;YAAC,CAAC;YACnD,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC;gBAAC,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC;gBAAC,SAAS;YAAC,CAAC;YACnD,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,EAAE,IAAI,CAAC;gBAAE,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,mCAAmC,KAAK,EAAE,EAAE,CAAC;YACpF,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;YAClC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YACvD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;YACrB,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO;gBAAE,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;YAC5F,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;YACpB,SAAS;QACX,CAAC;QACD,8DAA8D;QAC9D,6DAA6D;QAC7D,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,mBAAmB,CAAC,8CAA8C,KAAK,CAAC,OAAO,WAAW,EAAE,CAAC;IACzH,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,oEAAoE;QACpE,oEAAoE;QACpE,MAAM,QAAQ,GAAG;YACf,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,QAAQ;YACpC,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO;YAClC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,SAAS;YACvC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,UAAU;SAC7C,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAClB,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpB,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,0DAA0D,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,EAAE,CAAC;QACzI,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
|
package/dist/cli.d.ts
CHANGED
|
@@ -3,11 +3,14 @@
|
|
|
3
3
|
* almyty runner CLI.
|
|
4
4
|
*
|
|
5
5
|
* almyty runner start [--name X] [--org ORG_ID] [--label k=v]... [--config path] [--url URL]
|
|
6
|
+
* almyty runner start --enroll [--url URL]
|
|
6
7
|
* almyty runner status
|
|
7
8
|
* almyty runner stop
|
|
8
9
|
*
|
|
9
10
|
* Auth: ALMYTY_TOKEN env or ~/.almyty/credentials.json (run
|
|
10
11
|
* `almyty login` first if neither is configured). The runner is
|
|
11
12
|
* registered to whoever that login belongs to; the name is only a label.
|
|
13
|
+
* With --enroll (inside a hosted pod) there is no login: the pod's
|
|
14
|
+
* single-use enrollment token is traded for a runner credential (enroll.ts).
|
|
12
15
|
*/
|
|
13
16
|
export { parseArgs, COMMANDS, type ParsedFlags } from './cli-args.js';
|
package/dist/cli.js
CHANGED
|
@@ -3,12 +3,15 @@
|
|
|
3
3
|
* almyty runner CLI.
|
|
4
4
|
*
|
|
5
5
|
* almyty runner start [--name X] [--org ORG_ID] [--label k=v]... [--config path] [--url URL]
|
|
6
|
+
* almyty runner start --enroll [--url URL]
|
|
6
7
|
* almyty runner status
|
|
7
8
|
* almyty runner stop
|
|
8
9
|
*
|
|
9
10
|
* Auth: ALMYTY_TOKEN env or ~/.almyty/credentials.json (run
|
|
10
11
|
* `almyty login` first if neither is configured). The runner is
|
|
11
12
|
* registered to whoever that login belongs to; the name is only a label.
|
|
13
|
+
* With --enroll (inside a hosted pod) there is no login: the pod's
|
|
14
|
+
* single-use enrollment token is traded for a runner credential (enroll.ts).
|
|
12
15
|
*/
|
|
13
16
|
import { RunnerDaemon, readStatus, stopDaemon } from './daemon.js';
|
|
14
17
|
import { RUNNER_VERSION } from './runtime-info.js';
|
|
@@ -28,6 +31,11 @@ Options for start:
|
|
|
28
31
|
--label key=value Add a descriptive label; repeat for multiple
|
|
29
32
|
--config <path> Path to a JSON config file (overrides global+project)
|
|
30
33
|
--url <backend-url> Override backend URL (e.g. https://api.almyty.com)
|
|
34
|
+
--enroll Hosted runner mode: trade the enrollment token in
|
|
35
|
+
ALMYTY_ENROLLMENT_TOKEN (or the file named by
|
|
36
|
+
ALMYTY_ENROLLMENT_TOKEN_FILE) for a runner credential
|
|
37
|
+
at ALMYTY_API_URL, instead of using a login. Used by
|
|
38
|
+
the runner-env images; takes no --name/--org/--label/--config
|
|
31
39
|
|
|
32
40
|
Other:
|
|
33
41
|
-h, --help Show this help
|
|
@@ -35,7 +43,7 @@ Other:
|
|
|
35
43
|
|
|
36
44
|
Exit codes:
|
|
37
45
|
0 success
|
|
38
|
-
1 the command ran and failed (no daemon running, start refused)
|
|
46
|
+
1 the command ran and failed (no daemon running, start or enrollment refused)
|
|
39
47
|
2 usage error (unknown command, bad flags)
|
|
40
48
|
|
|
41
49
|
Auth:
|
|
@@ -78,15 +86,22 @@ async function main() {
|
|
|
78
86
|
case 'start': {
|
|
79
87
|
const daemon = new RunnerDaemon();
|
|
80
88
|
try {
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
89
|
+
if (flags.enroll) {
|
|
90
|
+
await daemon.startEnrolled({ url: flags.url });
|
|
91
|
+
}
|
|
92
|
+
else {
|
|
93
|
+
await daemon.start({
|
|
94
|
+
name: flags.name,
|
|
95
|
+
labels: flags.labels,
|
|
96
|
+
backendUrl: flags.url,
|
|
97
|
+
organizationId: flags.org,
|
|
98
|
+
configPath: flags.configPath,
|
|
99
|
+
});
|
|
100
|
+
}
|
|
88
101
|
}
|
|
89
102
|
catch (err) {
|
|
103
|
+
// Non-zero on a failed enrollment too: in a hosted pod that is
|
|
104
|
+
// what makes Kubernetes restart the container.
|
|
90
105
|
process.stderr.write(`failed to start: ${err.message}\n`);
|
|
91
106
|
process.exit(1);
|
|
92
107
|
}
|
package/dist/cli.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA
|
|
1
|
+
{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE1C,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAoB,MAAM,eAAe,CAAC;AAEtE,SAAS,SAAS;IAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgCtD,CAAC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,QAAQ,KAAK,CAAC,OAAO,EAAE,CAAC;QACtB,KAAK,SAAS;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,cAAc,IAAI,CAAC,CAAC;YAAC,OAAO;QACpE,KAAK,MAAM;YAAE,SAAS,EAAE,CAAC;YAAC,OAAO;QACjC,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;YAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;gBAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;YACxB,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;gBAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;oBACjB,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;gBACjD,CAAC;qBAAM,CAAC;oBACN,MAAM,MAAM,CAAC,KAAK,CAAC;wBACjB,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,UAAU,EAAE,KAAK,CAAC,GAAG;wBACrB,cAAc,EAAE,KAAK,CAAC,GAAG;wBACzB,UAAU,EAAE,KAAK,CAAC,UAAU;qBAC7B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,+DAA+D;gBAC/D,+CAA+C;gBAC/C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;gBAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,wDAAwD;YACxD,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC5B,OAAO;QACT,CAAC;IACH,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;IACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,GAAG,EAAE,OAAO,IAAI,GAAG,IAAI,CAAC,CAAC;IACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
|
package/dist/config.d.ts
CHANGED
|
@@ -71,3 +71,9 @@ export interface LoadConfigInputs {
|
|
|
71
71
|
*/
|
|
72
72
|
export declare function runnerNameFromHostname(host: string): string;
|
|
73
73
|
export declare function loadConfig(inputs?: LoadConfigInputs): ResolvedConfig;
|
|
74
|
+
/**
|
|
75
|
+
* The runner's command channel (RCE-capable) and its bearer token ride
|
|
76
|
+
* the backend URL, so plaintext http:// to a remote host is refused. http
|
|
77
|
+
* is allowed only for loopback (local dev). Throws with a sentence.
|
|
78
|
+
*/
|
|
79
|
+
export declare function assertSecureBackendUrl(backendUrl: string): void;
|
package/dist/config.js
CHANGED
|
@@ -109,6 +109,8 @@ export function describeIsolationPosture(config) {
|
|
|
109
109
|
: 'cwd unrestricted');
|
|
110
110
|
if (config.denyPatterns.length > 0)
|
|
111
111
|
guards.push(`${config.denyPatterns.length} deny pattern(s)`);
|
|
112
|
+
if (config.allowBinaries?.length)
|
|
113
|
+
guards.push(`binaries limited to ${config.allowBinaries.length}`);
|
|
112
114
|
return `isolation=host — commands run on this machine as you (${guards.join(', ')})`;
|
|
113
115
|
}
|
|
114
116
|
export const GLOBAL_CONFIG_PATH = join(homedir(), '.almyty', 'config.json');
|
|
@@ -199,24 +201,29 @@ export function loadConfig(inputs = {}) {
|
|
|
199
201
|
// fail with a less-helpful message.
|
|
200
202
|
throw new Error('runner name is required (set via --name, ALMYTY_RUNNER_NAME, or config.name)');
|
|
201
203
|
}
|
|
202
|
-
|
|
203
|
-
|
|
204
|
-
|
|
204
|
+
assertSecureBackendUrl(resolved.backendUrl);
|
|
205
|
+
return resolved;
|
|
206
|
+
}
|
|
207
|
+
/**
|
|
208
|
+
* The runner's command channel (RCE-capable) and its bearer token ride
|
|
209
|
+
* the backend URL, so plaintext http:// to a remote host is refused. http
|
|
210
|
+
* is allowed only for loopback (local dev). Throws with a sentence.
|
|
211
|
+
*/
|
|
212
|
+
export function assertSecureBackendUrl(backendUrl) {
|
|
205
213
|
try {
|
|
206
|
-
const u = new URL(
|
|
214
|
+
const u = new URL(backendUrl);
|
|
207
215
|
const host = u.hostname;
|
|
208
|
-
const loopback = host === 'localhost' || host === '127.0.0.1' || host === '::1' || host.endsWith('.localhost');
|
|
216
|
+
const loopback = host === 'localhost' || host === '127.0.0.1' || host === '::1' || host === '[::1]' || host.endsWith('.localhost');
|
|
209
217
|
if (u.protocol !== 'https:' && !loopback) {
|
|
210
|
-
throw new Error(`Refusing an insecure ${u.protocol}// backend URL for a remote host: ${
|
|
218
|
+
throw new Error(`Refusing an insecure ${u.protocol}// backend URL for a remote host: ${backendUrl}. ` +
|
|
211
219
|
'Use https:// (http is only allowed for localhost).');
|
|
212
220
|
}
|
|
213
221
|
}
|
|
214
222
|
catch (e) {
|
|
215
223
|
if (e instanceof Error && e.message.startsWith('Refusing'))
|
|
216
224
|
throw e;
|
|
217
|
-
throw new Error(`Invalid backend URL: ${
|
|
225
|
+
throw new Error(`Invalid backend URL: ${backendUrl}`);
|
|
218
226
|
}
|
|
219
|
-
return resolved;
|
|
220
227
|
}
|
|
221
228
|
// ── helpers ─────────────────────────────────────────────────────────
|
|
222
229
|
function safeRead(path) {
|
package/dist/config.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,MAAM,CAAC;AAEhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAG5D;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,+DAA+D;IAC/D,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK;IAClC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO;IACpC,QAAQ,EAAE,QAAQ;IAClB,0EAA0E;IAC1E,4EAA4E;IAC5E,GAAG,gBAAgB,EAAE;CACtB,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,wBAAwB,CAAC;AAE5D,MAAM,CAAC,MAAM,QAAQ,GAAmB;IACtC,MAAM,EAAE;QACN;;;;;;;;;;;;;;;;;;;;;;;;WAwBG;QACH,gBAAgB,EAAE,MAAM;QACxB,aAAa,EAAE,CAAC;QAChB,eAAe,EAAE,EAAE;QACnB,YAAY,EAAE,EAAE;QAChB;;;;WAIG;QACH,cAAc,EAAE,KAAK;QACrB;;;;;;WAMG;QACH,cAAc,EAAE,IAAI;KACrB;IACD,IAAI,EAAE,EAAE;IACR,MAAM,EAAE,EAAE;IACV,eAAe,EAAE,yBAAyB;IAC1C,UAAU,EAAE,mBAAmB;CAChC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAoB;IAC3D,IAAI,MAAM,CAAC,gBAAgB,KAAK,WAAW,EAAE,CAAC;QAC5C,OAAO,CACL,sFAAsF;YACtF,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,OAAO,CACL,8FAA8F;YAC9F,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAC7E,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;QAC/B,CAAC,CAAC,kBAAkB,MAAM,CAAC,eAAe,CAAC,MAAM,UAAU;QAC3D,CAAC,CAAC,kBAAkB,CACvB,CAAC;IACF,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,kBAAkB,CAAC,CAAC;IACjG,OAAO,yDAAyD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AACvF,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;AAC5E,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;AA2BjF;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,OAAO,IAAI;SACR,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SACb,WAAW,EAAE;SACb,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC;SAC7B,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC;SAC7B,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,SAA2B,EAAE;IACtD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,QAAQ,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,UAAU,CAAC;IAC3C,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,kBAAkB,CAAC;IAC3D,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,mBAAmB,CAAC;IAE9D,IAAI,QAAQ,GAAmB,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,QAAQ,CAAC,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC;QAC7C,QAAQ,CAAC,cAAc,GAAG,MAAM,CAAC,WAAW,CAAC,cAAc,CAAC;IAC9D,CAAC;IAED,+BAA+B;IAC/B,IAAI,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QACvB,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;IAClF,CAAC;IACD,sCAAsC;IACtC,IAAI,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QACxB,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;IACpF,CAAC;IACD,iEAAiE;IACjE,kEAAkE;IAClE,iEAAiE;IACjE,IAAI,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;QACzC,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC;QACnF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,EAAE,CAAC,CAAC;QACnD,CAAC;QACD,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,mEAAmE;IACnE,qEAAqE;IACrE,IAAI,GAAG,CAAC,UAAU;QAAE,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;IACzD,IAAI,GAAG,CAAC,kBAAkB;QAAE,QAAQ,CAAC,IAAI,GAAG,GAAG,CAAC,kBAAkB,CAAC;IACnE,IAAI,GAAG,CAAC,aAAa;QAAE,QAAQ,CAAC,cAAc,GAAG,GAAG,CAAC,aAAa,CAAC;IACnE,IAAI,GAAG,CAAC,uBAAuB,EAAE,CAAC;QAChC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;QACD,QAAQ,CAAC,MAAM,CAAC,gBAAgB,GAAG,GAAG,CAAC,uBAAuB,CAAC;IACjE,CAAC;IAED,8DAA8D;IAC9D,yBAAyB;IACzB,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,CAAC,IAAI;QAAE,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IACnC,IAAI,CAAC,CAAC,MAAM;QAAE,QAAQ,CAAC,MAAM,GAAG,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;IACpE,IAAI,CAAC,CAAC,UAAU;QAAE,QAAQ,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;IACrD,IAAI,CAAC,CAAC,cAAc;QAAE,QAAQ,CAAC,cAAc,GAAG,CAAC,CAAC,cAAc,CAAC;IACjE,IAAI,CAAC,CAAC,MAAM;QAAE,QAAQ,CAAC,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7E,IAAI,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtD,QAAQ,CAAC,eAAe,GAAG,CAAC,CAAC,eAAe,CAAC;IAC/C,CAAC;IAED,QAAQ,CAAC,YAAY,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;IAExC,kEAAkE;IAClE,4CAA4C;IAC5C,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,QAAQ,CAAC,IAAI,GAAG,sBAAsB,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,2DAA2D;QAC3D,4DAA4D;QAC5D,8DAA8D;QAC9D,oCAAoC;QACpC,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;IAED,
|
|
1
|
+
{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,MAAM,CAAC;AAEhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAG5D;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,+DAA+D;IAC/D,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK;IAClC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO;IACpC,QAAQ,EAAE,QAAQ;IAClB,0EAA0E;IAC1E,4EAA4E;IAC5E,GAAG,gBAAgB,EAAE;CACtB,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,wBAAwB,CAAC;AAE5D,MAAM,CAAC,MAAM,QAAQ,GAAmB;IACtC,MAAM,EAAE;QACN;;;;;;;;;;;;;;;;;;;;;;;;WAwBG;QACH,gBAAgB,EAAE,MAAM;QACxB,aAAa,EAAE,CAAC;QAChB,eAAe,EAAE,EAAE;QACnB,YAAY,EAAE,EAAE;QAChB;;;;WAIG;QACH,cAAc,EAAE,KAAK;QACrB;;;;;;WAMG;QACH,cAAc,EAAE,IAAI;KACrB;IACD,IAAI,EAAE,EAAE;IACR,MAAM,EAAE,EAAE;IACV,eAAe,EAAE,yBAAyB;IAC1C,UAAU,EAAE,mBAAmB;CAChC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAoB;IAC3D,IAAI,MAAM,CAAC,gBAAgB,KAAK,WAAW,EAAE,CAAC;QAC5C,OAAO,CACL,sFAAsF;YACtF,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,OAAO,CACL,8FAA8F;YAC9F,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAC7E,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;QAC/B,CAAC,CAAC,kBAAkB,MAAM,CAAC,eAAe,CAAC,MAAM,UAAU;QAC3D,CAAC,CAAC,kBAAkB,CACvB,CAAC;IACF,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,kBAAkB,CAAC,CAAC;IACjG,IAAI,MAAM,CAAC,aAAa,EAAE,MAAM;QAAE,MAAM,CAAC,IAAI,CAAC,uBAAuB,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;IACpG,OAAO,yDAAyD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AACvF,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;AAC5E,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;AA2BjF;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,OAAO,IAAI;SACR,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SACb,WAAW,EAAE;SACb,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC;SAC7B,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC;SAC7B,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,SAA2B,EAAE;IACtD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,QAAQ,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,UAAU,CAAC;IAC3C,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,kBAAkB,CAAC;IAC3D,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,mBAAmB,CAAC;IAE9D,IAAI,QAAQ,GAAmB,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,QAAQ,CAAC,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC;QAC7C,QAAQ,CAAC,cAAc,GAAG,MAAM,CAAC,WAAW,CAAC,cAAc,CAAC;IAC9D,CAAC;IAED,+BAA+B;IAC/B,IAAI,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QACvB,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;IAClF,CAAC;IACD,sCAAsC;IACtC,IAAI,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QACxB,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;IACpF,CAAC;IACD,iEAAiE;IACjE,kEAAkE;IAClE,iEAAiE;IACjE,IAAI,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;QACzC,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC;QACnF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,EAAE,CAAC,CAAC;QACnD,CAAC;QACD,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,mEAAmE;IACnE,qEAAqE;IACrE,IAAI,GAAG,CAAC,UAAU;QAAE,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;IACzD,IAAI,GAAG,CAAC,kBAAkB;QAAE,QAAQ,CAAC,IAAI,GAAG,GAAG,CAAC,kBAAkB,CAAC;IACnE,IAAI,GAAG,CAAC,aAAa;QAAE,QAAQ,CAAC,cAAc,GAAG,GAAG,CAAC,aAAa,CAAC;IACnE,IAAI,GAAG,CAAC,uBAAuB,EAAE,CAAC;QAChC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;QACD,QAAQ,CAAC,MAAM,CAAC,gBAAgB,GAAG,GAAG,CAAC,uBAAuB,CAAC;IACjE,CAAC;IAED,8DAA8D;IAC9D,yBAAyB;IACzB,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,CAAC,IAAI;QAAE,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IACnC,IAAI,CAAC,CAAC,MAAM;QAAE,QAAQ,CAAC,MAAM,GAAG,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;IACpE,IAAI,CAAC,CAAC,UAAU;QAAE,QAAQ,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;IACrD,IAAI,CAAC,CAAC,cAAc;QAAE,QAAQ,CAAC,cAAc,GAAG,CAAC,CAAC,cAAc,CAAC;IACjE,IAAI,CAAC,CAAC,MAAM;QAAE,QAAQ,CAAC,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7E,IAAI,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtD,QAAQ,CAAC,eAAe,GAAG,CAAC,CAAC,eAAe,CAAC;IAC/C,CAAC;IAED,QAAQ,CAAC,YAAY,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;IAExC,kEAAkE;IAClE,4CAA4C;IAC5C,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,QAAQ,CAAC,IAAI,GAAG,sBAAsB,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,2DAA2D;QAC3D,4DAA4D;QAC5D,8DAA8D;QAC9D,oCAAoC;QACpC,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;IAED,sBAAsB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAE5C,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAAkB;IACvD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC;QACxB,MAAM,QAAQ,GACZ,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACpH,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,wBAAwB,CAAC,CAAC,QAAQ,qCAAqC,UAAU,IAAI;gBACnF,oDAAoD,CACvD,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,MAAM,CAAC,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,wBAAwB,UAAU,EAAE,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED,uEAAuE;AAEvE,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAAmB,EAAE,IAAY;IACxD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzF,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,IAAoB,EAAE,KAA8B;IACnE,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI;QAC7B,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE;QACnD,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU;QAC/C,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc;QAC3D,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;YACxE,CAAC,CAAC,KAAK,CAAC,eAAe;YACvB,CAAC,CAAC,IAAI,CAAC,eAAe;QACxB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM;KAClF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAkB,EAAE,KAA4B;IACzE,OAAO;QACL,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,IAAI,CAAC,gBAAgB;QACjE,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa;QACxD,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI,CAAC,eAAe;QAC9D,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY;QACrD,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc;QAC3D,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc;KAC5D,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,MAAM,CAAC;AACnD,CAAC;AAED,SAAS,KAAK,CAAI,KAAQ;IACxB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AAC3C,CAAC"}
|
package/dist/daemon.d.ts
CHANGED
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
import { ResolvedConfig } from './types.js';
|
|
2
|
+
import { prepareHostedWorkspace } from './hosted-setup.js';
|
|
2
3
|
export interface DaemonStatus {
|
|
3
4
|
pid: number;
|
|
4
5
|
startedAt: string;
|
|
@@ -9,6 +10,20 @@ export interface DaemonStatus {
|
|
|
9
10
|
inUseProcesses: number;
|
|
10
11
|
connectionState: 'connecting' | 'online' | 'reconnecting' | 'fatal';
|
|
11
12
|
}
|
|
13
|
+
export interface EnrolledStartOptions {
|
|
14
|
+
/** --url: overrides ALMYTY_API_URL. */
|
|
15
|
+
url?: string;
|
|
16
|
+
/** Defaults to process.env; the token variables are removed from it once read. */
|
|
17
|
+
env?: Record<string, string | undefined>;
|
|
18
|
+
/** Test injection. */
|
|
19
|
+
fetch?: typeof globalThis.fetch;
|
|
20
|
+
/** How a fatal credential problem ends the process. Defaults to process.exit. */
|
|
21
|
+
exit?: (code: number) => void;
|
|
22
|
+
/** Tests leave the process's signal handlers alone. */
|
|
23
|
+
installSignals?: boolean;
|
|
24
|
+
/** Test injection for the first-start workspace setup. */
|
|
25
|
+
prepare?: typeof prepareHostedWorkspace;
|
|
26
|
+
}
|
|
12
27
|
/**
|
|
13
28
|
* Runner daemon. Responsibilities, in order:
|
|
14
29
|
*
|
|
@@ -36,6 +51,11 @@ export declare class RunnerDaemon {
|
|
|
36
51
|
private runnerId;
|
|
37
52
|
private heartbeatTimer;
|
|
38
53
|
private status;
|
|
54
|
+
/** A hosted runner's renewable credential (enroll mode only). */
|
|
55
|
+
private credential;
|
|
56
|
+
/** The pod model token and the loopback proxy that serves it (enroll mode). */
|
|
57
|
+
private modelToken;
|
|
58
|
+
private closeModelProxy;
|
|
39
59
|
/** Guards against overlapping re-establish attempts. */
|
|
40
60
|
private reestablishing;
|
|
41
61
|
/** Consecutive failed re-establish attempts; bounds the retry loop. */
|
|
@@ -49,6 +69,23 @@ export declare class RunnerDaemon {
|
|
|
49
69
|
start(flags: Partial<ResolvedConfig> & {
|
|
50
70
|
configPath?: string;
|
|
51
71
|
}): Promise<void>;
|
|
72
|
+
/**
|
|
73
|
+
* Enroll mode, for a runner inside a hosted pod (enroll.ts). Trades the
|
|
74
|
+
* pod's single-use enrollment token for a runner credential, sets the
|
|
75
|
+
* workspace up on its first start (hosted-setup.ts), and then holds the
|
|
76
|
+
* hosted stream like any runner holds its own. Throws EnrollmentError
|
|
77
|
+
* when enrollment fails; the CLI exits non-zero and Kubernetes restarts
|
|
78
|
+
* the container.
|
|
79
|
+
*/
|
|
80
|
+
startEnrolled(opts?: EnrolledStartOptions): Promise<void>;
|
|
81
|
+
/** Stop heartbeats, renewal and the stream; tell the backend it is draining. */
|
|
82
|
+
shutdown(): Promise<void>;
|
|
83
|
+
/**
|
|
84
|
+
* Everything after the runner knows who it is: the process manager,
|
|
85
|
+
* the stream, the heartbeat loop and the state file. Shared by the
|
|
86
|
+
* login path and enroll mode.
|
|
87
|
+
*/
|
|
88
|
+
private connect;
|
|
52
89
|
/**
|
|
53
90
|
* Exit signal flow. On the first SIGINT/SIGTERM, transition to
|
|
54
91
|
* draining and inform the backend; on the second, hard exit.
|
package/dist/daemon.js
CHANGED
|
@@ -1,14 +1,18 @@
|
|
|
1
1
|
import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync, chmodSync } from 'fs';
|
|
2
|
-
import { homedir } from 'os';
|
|
2
|
+
import { homedir, hostname } from 'os';
|
|
3
3
|
import { join } from 'path';
|
|
4
4
|
import { resolveCredentialsOrExit } from '@almyty/client';
|
|
5
|
-
import { describeIsolationPosture, loadConfig } from './config.js';
|
|
5
|
+
import { DEFAULT_BINARY_PROBE_LIST, describeIsolationPosture, loadConfig, runnerNameFromHostname } from './config.js';
|
|
6
6
|
import { detectRuntimeInfo, RUNNER_VERSION } from './runtime-info.js';
|
|
7
7
|
import { createDefaultAdapterFactory, ProcessManager } from './process-manager.js';
|
|
8
8
|
import { StreamableClient, envelope } from './streamable-client.js';
|
|
9
9
|
import { dispatchHandler } from './handlers.js';
|
|
10
10
|
import { CodingSessionManager } from './coding-sessions.js';
|
|
11
11
|
import { WorkspaceReclaimer } from './workspace-reclaimer.js';
|
|
12
|
+
import { enroll, EnrollmentError, readEnrollSettings, RunnerCredential } from './enroll.js';
|
|
13
|
+
import { parseAllowBinaries, withAllowBinaries } from './policy.js';
|
|
14
|
+
import { prepareHostedWorkspace } from './hosted-setup.js';
|
|
15
|
+
import { ModelToken, readModelAccess, startModelProxy } from './model-proxy.js';
|
|
12
16
|
// An override keeps independent local test/demo daemons away from the user's runner.
|
|
13
17
|
const STATE_DIR = process.env.ALMYTY_RUNNER_STATE_DIR || join(homedir(), '.almyty', 'runner');
|
|
14
18
|
const PID_FILE = join(STATE_DIR, 'daemon.pid');
|
|
@@ -45,6 +49,11 @@ export class RunnerDaemon {
|
|
|
45
49
|
runnerId = null;
|
|
46
50
|
heartbeatTimer = null;
|
|
47
51
|
status = null;
|
|
52
|
+
/** A hosted runner's renewable credential (enroll mode only). */
|
|
53
|
+
credential = null;
|
|
54
|
+
/** The pod model token and the loopback proxy that serves it (enroll mode). */
|
|
55
|
+
modelToken = null;
|
|
56
|
+
closeModelProxy = null;
|
|
48
57
|
/** Guards against overlapping re-establish attempts. */
|
|
49
58
|
reestablishing = false;
|
|
50
59
|
/** Consecutive failed re-establish attempts; bounds the retry loop. */
|
|
@@ -104,10 +113,127 @@ export class RunnerDaemon {
|
|
|
104
113
|
this.runnerId = regBody.data.runner.id;
|
|
105
114
|
resolved.name = regBody.data.runner.name;
|
|
106
115
|
process.stdout.write(`registered as ${this.runnerId}\n`);
|
|
107
|
-
//
|
|
108
|
-
//
|
|
109
|
-
|
|
110
|
-
|
|
116
|
+
// The process manager takes the effective config (backend may have
|
|
117
|
+
// constrained max_concurrent below what we requested).
|
|
118
|
+
await this.connect({
|
|
119
|
+
backendUrl,
|
|
120
|
+
token: credentials.token,
|
|
121
|
+
organizationId: resolved.organizationId,
|
|
122
|
+
effective: regBody.data.effectiveConfig,
|
|
123
|
+
installSignals: true,
|
|
124
|
+
});
|
|
125
|
+
}
|
|
126
|
+
/**
|
|
127
|
+
* Enroll mode, for a runner inside a hosted pod (enroll.ts). Trades the
|
|
128
|
+
* pod's single-use enrollment token for a runner credential, sets the
|
|
129
|
+
* workspace up on its first start (hosted-setup.ts), and then holds the
|
|
130
|
+
* hosted stream like any runner holds its own. Throws EnrollmentError
|
|
131
|
+
* when enrollment fails; the CLI exits non-zero and Kubernetes restarts
|
|
132
|
+
* the container.
|
|
133
|
+
*/
|
|
134
|
+
async startEnrolled(opts = {}) {
|
|
135
|
+
const env = opts.env ?? process.env;
|
|
136
|
+
const fetchImpl = opts.fetch ?? globalThis.fetch;
|
|
137
|
+
const exit = opts.exit ?? ((code) => process.exit(code));
|
|
138
|
+
const settings = readEnrollSettings(env, { url: opts.url });
|
|
139
|
+
// Out of the environment before anything is started, like the
|
|
140
|
+
// enrollment token: the coding CLIs reach models through the proxy.
|
|
141
|
+
const modelAccess = readModelAccess(env);
|
|
142
|
+
// Read before the token is spent: a list the runner cannot read stops
|
|
143
|
+
// it here (exit 1, the pod restarts) rather than running unrestricted.
|
|
144
|
+
let allowBinaries;
|
|
145
|
+
try {
|
|
146
|
+
allowBinaries = parseAllowBinaries(env.ALMYTY_ALLOW_BINARIES);
|
|
147
|
+
}
|
|
148
|
+
catch (err) {
|
|
149
|
+
throw new EnrollmentError(err.message);
|
|
150
|
+
}
|
|
151
|
+
process.stdout.write(`almyty-runner v${RUNNER_VERSION} starting in enroll mode\n`);
|
|
152
|
+
process.stdout.write(`url=${settings.backendUrl}\n`);
|
|
153
|
+
const runtime = await detectRuntimeInfo({ binaries: DEFAULT_BINARY_PROBE_LIST });
|
|
154
|
+
process.stdout.write(`detected ${Object.values(runtime.binaries).filter(v => v).length}/${DEFAULT_BINARY_PROBE_LIST.length} binaries on PATH\n`);
|
|
155
|
+
const enrolled = await enroll(settings, { runtimeInfo: runtime }, fetchImpl);
|
|
156
|
+
// Spent either way; nothing else needs it.
|
|
157
|
+
settings.token = '';
|
|
158
|
+
this.runnerId = enrolled.runnerId;
|
|
159
|
+
process.stdout.write(`enrolled as ${enrolled.runnerId}; credential valid until ${enrolled.expiresAt.toISOString()}\n`);
|
|
160
|
+
this.credential = new RunnerCredential({
|
|
161
|
+
backendUrl: settings.backendUrl,
|
|
162
|
+
renewPath: enrolled.renewPath,
|
|
163
|
+
credential: enrolled.credential,
|
|
164
|
+
expiresAt: enrolled.expiresAt,
|
|
165
|
+
fetch: fetchImpl,
|
|
166
|
+
log: (line) => process.stdout.write(`${line}\n`),
|
|
167
|
+
onFatal: (reason) => {
|
|
168
|
+
process.stderr.write(`${reason}; exiting\n`);
|
|
169
|
+
this.updateState({ connectionState: 'fatal' });
|
|
170
|
+
void this.shutdown().finally(() => exit(1));
|
|
171
|
+
},
|
|
172
|
+
});
|
|
173
|
+
this.credential.start();
|
|
174
|
+
// The pod model token: served to the coding CLIs through the loopback
|
|
175
|
+
// model proxy and renewed while the pod runs (model-proxy.ts). A proxy
|
|
176
|
+
// that cannot listen leaves the CLIs without models, not the runner down.
|
|
177
|
+
if (modelAccess) {
|
|
178
|
+
this.modelToken = new ModelToken({
|
|
179
|
+
backendUrl: settings.backendUrl,
|
|
180
|
+
renewPath: modelAccess.renewPath,
|
|
181
|
+
token: modelAccess.token,
|
|
182
|
+
expiresAt: modelAccess.expiresAt,
|
|
183
|
+
fetch: fetchImpl,
|
|
184
|
+
log: (line) => process.stdout.write(`${line}\n`),
|
|
185
|
+
});
|
|
186
|
+
this.modelToken.start();
|
|
187
|
+
try {
|
|
188
|
+
const proxy = await startModelProxy({
|
|
189
|
+
backendUrl: settings.backendUrl,
|
|
190
|
+
port: modelAccess.port,
|
|
191
|
+
token: () => this.modelToken?.current() ?? '',
|
|
192
|
+
log: (line) => process.stdout.write(`${line}\n`),
|
|
193
|
+
});
|
|
194
|
+
this.closeModelProxy = proxy.close;
|
|
195
|
+
process.stdout.write(`model proxy listening on 127.0.0.1:${proxy.port}\n`);
|
|
196
|
+
}
|
|
197
|
+
catch (err) {
|
|
198
|
+
process.stderr.write(`model proxy could not listen on 127.0.0.1:${modelAccess.port}: ${err?.code ?? err?.message ?? err}\n`);
|
|
199
|
+
}
|
|
200
|
+
}
|
|
201
|
+
// The pod is the sandbox: the backend decides the policy (host
|
|
202
|
+
// isolation, cwd limited to the workspace volume), narrowed by the
|
|
203
|
+
// environment's binary allowlist when it has one.
|
|
204
|
+
const config = withAllowBinaries(enrolled.effectiveConfig, allowBinaries);
|
|
205
|
+
process.stdout.write(`${describeIsolationPosture(config)}\n`);
|
|
206
|
+
// Before the stream opens, so the machine reports ready only once its
|
|
207
|
+
// checkout and setup are in place. The credential renews meanwhile.
|
|
208
|
+
await (opts.prepare ?? prepareHostedWorkspace)({ env });
|
|
209
|
+
this.resolved = {
|
|
210
|
+
name: runnerNameFromHostname(hostname()) || 'hosted-runner',
|
|
211
|
+
labels: {},
|
|
212
|
+
config,
|
|
213
|
+
binaryProbeList: DEFAULT_BINARY_PROBE_LIST,
|
|
214
|
+
backendUrl: settings.backendUrl,
|
|
215
|
+
};
|
|
216
|
+
await this.connect({
|
|
217
|
+
backendUrl: settings.backendUrl,
|
|
218
|
+
token: () => this.credential?.current() ?? '',
|
|
219
|
+
streamPath: enrolled.streamPath,
|
|
220
|
+
effective: config,
|
|
221
|
+
fetch: opts.fetch,
|
|
222
|
+
installSignals: opts.installSignals ?? true,
|
|
223
|
+
});
|
|
224
|
+
}
|
|
225
|
+
/** Stop heartbeats, renewal and the stream; tell the backend it is draining. */
|
|
226
|
+
async shutdown() {
|
|
227
|
+
await this.gracefulShutdown();
|
|
228
|
+
}
|
|
229
|
+
/**
|
|
230
|
+
* Everything after the runner knows who it is: the process manager,
|
|
231
|
+
* the stream, the heartbeat loop and the state file. Shared by the
|
|
232
|
+
* login path and enroll mode.
|
|
233
|
+
*/
|
|
234
|
+
async connect(o) {
|
|
235
|
+
const resolved = this.resolved;
|
|
236
|
+
this.processes = new ProcessManager(createDefaultAdapterFactory(), o.effective.maxConcurrent);
|
|
111
237
|
// Coding-session registry for the chat bridge. Output events are sent
|
|
112
238
|
// through the same streamable client the heartbeats ride; the client is
|
|
113
239
|
// captured lazily so construction order doesn't matter.
|
|
@@ -127,15 +253,17 @@ export class RunnerDaemon {
|
|
|
127
253
|
});
|
|
128
254
|
// Open the Streamable HTTP stream.
|
|
129
255
|
this.client = new StreamableClient({
|
|
130
|
-
baseUrl: backendUrl,
|
|
131
|
-
token:
|
|
132
|
-
organizationId:
|
|
256
|
+
baseUrl: o.backendUrl,
|
|
257
|
+
token: o.token,
|
|
258
|
+
organizationId: o.organizationId,
|
|
259
|
+
streamPath: o.streamPath,
|
|
260
|
+
fetch: o.fetch,
|
|
133
261
|
});
|
|
134
262
|
this.wireClient();
|
|
135
263
|
// First POST mints the session id; send a hello envelope so the
|
|
136
264
|
// backend's worker stream (WorkerStreamTransport) assigns one.
|
|
137
265
|
await this.client.send(envelope('event', { kind: 'runner.hello', runnerId: this.runnerId }));
|
|
138
|
-
await this.client.
|
|
266
|
+
await this.client.startStream();
|
|
139
267
|
// Heartbeat loop. This timer is deliberately REF'd: it is the daemon's
|
|
140
268
|
// keep-alive. The GET command stream can briefly drop (e.g. a reconnect
|
|
141
269
|
// after a wrong-replica 404), and during that gap the fetch handle is
|
|
@@ -151,12 +279,13 @@ export class RunnerDaemon {
|
|
|
151
279
|
void this.heartbeat().catch(err => {
|
|
152
280
|
process.stderr.write(`initial heartbeat failed: ${err.message}\n`);
|
|
153
281
|
});
|
|
154
|
-
|
|
282
|
+
if (o.installSignals)
|
|
283
|
+
this.installSignalHandlers();
|
|
155
284
|
this.writeState({
|
|
156
285
|
pid: process.pid,
|
|
157
286
|
startedAt: new Date().toISOString(),
|
|
158
287
|
runnerName: resolved.name,
|
|
159
|
-
backendUrl,
|
|
288
|
+
backendUrl: o.backendUrl,
|
|
160
289
|
runnerId: this.runnerId,
|
|
161
290
|
sessionId: this.client.getSessionId(),
|
|
162
291
|
inUseProcesses: 0,
|
|
@@ -186,6 +315,11 @@ export class RunnerDaemon {
|
|
|
186
315
|
try {
|
|
187
316
|
if (this.heartbeatTimer)
|
|
188
317
|
clearInterval(this.heartbeatTimer);
|
|
318
|
+
this.heartbeatTimer = null;
|
|
319
|
+
this.credential?.stop();
|
|
320
|
+
this.modelToken?.stop();
|
|
321
|
+
await this.closeModelProxy?.().catch(() => undefined);
|
|
322
|
+
this.closeModelProxy = null;
|
|
189
323
|
if (this.client) {
|
|
190
324
|
await this.client.send(envelope('event', { kind: 'runner.draining' })).catch(() => { });
|
|
191
325
|
this.client.stop();
|
|
@@ -295,8 +429,8 @@ export class RunnerDaemon {
|
|
|
295
429
|
await new Promise(r => setTimeout(r, delay));
|
|
296
430
|
// Re-mint a session (client already cleared the stale id) and reopen.
|
|
297
431
|
await this.client.send(envelope('event', { kind: 'runner.hello', runnerId: this.runnerId }));
|
|
298
|
-
await this.client.
|
|
299
|
-
//
|
|
432
|
+
await this.client.startStream();
|
|
433
|
+
// The stream's 'open' event resets connectionState to 'online'; a clean
|
|
300
434
|
// reopen means the streak is broken.
|
|
301
435
|
this.sessionLostStreak = 0;
|
|
302
436
|
this.updateState({ connectionState: 'online', sessionId: this.client.getSessionId() });
|