@atomic-chat/core 0.5.1 → 0.13.2

package/dist/runtime/container/exec.js

@@ -0,0 +1,79 @@
+/**
+ * Running one already-built docker argv (`argv.ts`) against the real `docker` binary. No shell:
+ * `spawn` receives the executable and every argument as its own array element, so nothing a
+ * descriptor, a probe or a mount path contains is ever interpreted by a shell. Modeled on
+ * `src/hardware/probe.ts`'s `runTool` and `src/runtime/environment/host-exec.ts`'s `hostExec`: a
+ * command that could not answer (missing binary, spawn failure, past its deadline) resolves with
+ * `code: null` rather than rejecting, so a caller always gets one shape back.
+ *
+ * `options.dockerConfigDir` is required (review round 1, item 5 ruling): every call creates it if
+ * missing and points `DOCKER_CONFIG` at it, so the docker CLI never falls back to the user's own
+ * `~/.docker/config.json` — see `env.ts`'s doc comment for why that fallback matters.
+ */
+import { spawn } from 'node:child_process';
+import { HeadAndTail } from '../shared/index.js';
+import { dockerChildEnv, ensureDockerConfigDir } from './env.js';
+const DEFAULT_TIMEOUT_MS = 30_000;
+const DEFAULT_MAX_OUTPUT_BYTES = 4 * 1024 * 1024;
+/** `spawn(exe, args)` with no shell, a sanitized environment (`env.ts`), a deadline and a bounded buffer. */
+export async function runDockerCommand(exe, args, options, callOptions = {}) {
+    const timeoutMs = callOptions.timeoutMs ?? options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const limit = options.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES;
+    await ensureDockerConfigDir(options.dockerConfigDir);
+    const env = dockerChildEnv({ dockerConfigDir: options.dockerConfigDir, base: options.env ?? process.env });
+    return new Promise((resolve) => {
+        let settled = false;
+        const stdout = new HeadAndTail(limit);
+        const stderr = new HeadAndTail(limit);
+        // Unset until spawn succeeds: a spawn that throws synchronously leaves nothing to kill.
+        let child;
+        const finish = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            resolve(result);
+        };
+        // Armed before the spawn so a spawn that throws on the spot still has a real timer to clear.
+        const timer = setTimeout(() => {
+            child?.kill('SIGKILL');
+            finish({ code: null, stdout: '', stderr: `docker did not answer within ${timeoutMs} ms` });
+        }, timeoutMs);
+        timer.unref();
+        try {
+            child = spawn(exe, args, {
+                shell: false,
+                windowsHide: true,
+                stdio: ['ignore', 'pipe', 'pipe'],
+                env,
+            });
+        }
+        catch (error) {
+            // Some malformed calls throw synchronously; that is an unanswered command, not a crash.
+            finish({ code: null, stdout: '', stderr: error.message });
+            return;
+        }
+        child.stdout?.on('data', (chunk) => stdout.push(chunk));
+        child.stderr?.on('data', (chunk) => stderr.push(chunk));
+        // A binary that is not on the machine arrives here as ENOENT, not as an exit code.
+        child.on('error', (error) => finish({ code: null, stdout: '', stderr: error.message }));
+        child.on('close', (code) => {
+            finish({
+                code,
+                stdout: stdout.text(),
+                stderr: stderr.text(),
+            });
+        });
+    });
+}
+/**
+ * The production `DockerExec`: real `docker`, the system socket already forced by `argv.ts`'s
+ * builders. `dockerConfigDir` is required — see `env.ts`'s doc comment for why this module never
+ * runs `docker` without one. The returned function accepts a per-call `DockerExecCallOptions`
+ * (review round 1, item 3): `stopContainer` uses it to extend the deadline past a long `--time`.
+ */
+export function createDockerExec(options) {
+    const dockerPath = options.dockerPath ?? 'docker';
+    return (args, callOptions) => runDockerCommand(dockerPath, args, options, callOptions);
+}
+//# sourceMappingURL=exec.js.map

package/dist/runtime/container/exec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec.js","sourceRoot":"","sources":["../../../src/runtime/container/exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAE1C,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAChD,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAA;AAgBhE,MAAM,kBAAkB,GAAG,MAAM,CAAA;AACjC,MAAM,wBAAwB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AAEhD,6GAA6G;AAC7G,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAW,EACX,IAAc,EACd,OAA6B,EAC7B,cAAqC,EAAE;IAEvC,MAAM,SAAS,GAAG,WAAW,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAA;IAClF,MAAM,KAAK,GAAG,OAAO,CAAC,cAAc,IAAI,wBAAwB,CAAA;IAChE,MAAM,qBAAqB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;IACpD,MAAM,GAAG,GAAG,cAAc,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;IAE1G,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,KAAK,CAAC,CAAA;QACrC,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,KAAK,CAAC,CAAA;QACrC,wFAAwF;QACxF,IAAI,KAA2C,CAAA;QAE/C,MAAM,MAAM,GAAG,CAAC,MAA2B,EAAQ,EAAE;YACnD,IAAI,OAAO;gBAAE,OAAM;YACnB,OAAO,GAAG,IAAI,CAAA;YACd,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,OAAO,CAAC,MAAM,CAAC,CAAA;QACjB,CAAC,CAAA;QAED,6FAA6F;QAC7F,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;YACtB,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,gCAAgC,SAAS,KAAK,EAAE,CAAC,CAAA;QAC5F,CAAC,EAAE,SAAS,CAAC,CAAA;QACb,KAAK,CAAC,KAAK,EAAE,CAAA;QAEb,IAAI,CAAC;YACH,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;gBACvB,KAAK,EAAE,KAAK;gBACZ,WAAW,EAAE,IAAI;gBACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;gBACjC,GAAG;aACJ,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wFAAwF;YACxF,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAA;YACpE,OAAM;QACR,CAAC;QAED,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;QAC/D,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;QAE/D,mFAAmF;QACnF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;QACvF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,MAAM,CAAC;gBACL,IAAI;gBACJ,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE;gBACrB,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE;aACtB,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAOD;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAgC;IAC/D,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,QAAQ,CAAA;IACjD,OAAO,CAAC,IAAc,EAAE,WAAmC,EAAE,EAAE,CAC7D,gBAAgB,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,CAAA;AAC5D,CAAC"}

package/dist/runtime/container/execution-journal.d.ts

@@ -0,0 +1,55 @@
+import type { DataLayout } from '../../config/index.js';
+/** One journalled container: identity enough to find it again and decide whether it is ours. */
+export interface ExecutionRecord {
+    container_id: string;
+    engine_id: string;
+    image_digest: string;
+    scope: string;
+    /** The core instance (`InstanceLock.instanceId`) that created this container. */
+    instance_id: string;
+    created_at: string;
+}
+export declare class ExecutionJournal {
+    private readonly dir;
+    private records;
+    /**
+     * Serializes every disk write behind this journal, so concurrent `add`/`remove` calls land on disk
+     * in the order they were *called*, never the order their own I/O happens to finish in — the same
+     * `flush` queue `process-journal.ts` chains its whole-array rewrites through. The in-memory map is
+     * always mutated synchronously before a write is enqueued, so `list()` is never behind the queue;
+     * only what ends up on disk depended on write-completion order before this queue existed.
+     *
+     * Always kept *settled-or-pending*, never rejected: `enqueue` neutralizes each task's own outcome
+     * before storing it back here, so one call's write failing (ENOSPC, EACCES, …) can never poison
+     * every later call on this journal — round 2 of the task 2.10 review, `execution-journal.ts:134-137`.
+     * A naive `this.queue = this.queue.then(task)` leaves a rejected `this.queue` behind a failed task;
+     * every later `.then(task)` chained onto a rejected promise skips `task` entirely and rejects with
+     * that *old* error instead, silently dropping every write queued after the first failure.
+     */
+    private queue;
+    private constructor();
+    static open(layout: DataLayout): Promise<ExecutionJournal>;
+    list(): ExecutionRecord[];
+    /**
+     * A record must exist before the container can serve anything, so this write is awaited. If the
+     * write does not persist, the in-memory map is rolled back to what it held before this call (the
+     * previous record for this id, or none) rather than keeping the new value: `list()` promises what a
+     * reopen would see, and a reopen never sees a record whose write failed. A caller that gets a
+     * rejection here must treat the container as *not* journalled — retry, or stop and remove the
+     * container it just created — never assume it is safe because `add()` was called.
+     */
+    add(record: ExecutionRecord): Promise<void>;
+    /**
+     * Drop the record for a container that is gone, stopped, or adopted by reconcile. Idempotent. If
+     * the disk removal fails, the in-memory map is rolled back to still hold the record — the file is
+     * still on disk, so pretending it is gone would desynchronize `list()` from what a reopen finds.
+     */
+    remove(containerId: string): Promise<void>;
+    private fileFor;
+    /**
+     * Chains one disk write onto whatever this journal already had queued, and returns a promise that
+     * rejects only with *this* task's own error — never a previous task's. `this.queue` itself is kept
+     * always non-rejecting (`.catch(() => {})`) so a failed task never blocks the tasks queued after it.
+     */
+    private enqueue;
+}

package/dist/runtime/container/execution-journal.js

@@ -0,0 +1,167 @@
+/**
+ * `<data>/atomic-core/managed-runtimes/executions` (task 2.10): the private record of the model
+ * containers *this core instance* created. It is never a way to discover containers on the host —
+ * `reconcile.ts` is the only reader, and it only ever acts on a container whose id is recorded here.
+ * Container labels (`ModelContainerLabels`, `types.ts`) stay discovery-only and play no part in this
+ * decision (spec `tensorrt-llm-runtime`, "Метки контейнера MUST NOT служить единственным основанием
+ * для остановки").
+ *
+ * One file per container, named by its id, so a crash mid-write can only ever corrupt that one
+ * record — the rest of the journal is unaffected. `process-journal.ts` gives the native-process
+ * journal the same guarantee through a whole-array rewrite instead; a container journal that rarely
+ * holds more than one record (spec `tensorrt-llm-runtime`, "Одна сессия tensorrt-llm одновременно")
+ * gets it more simply by splitting one record per file.
+ */
+import { randomUUID } from 'node:crypto';
+import { mkdir, readFile, readdir, rename, rm, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { AtomicCoreError } from '../../contracts/index.js';
+const SAFE_FILENAME = /^[A-Za-z0-9_.-]+$/;
+function assertSafeContainerId(id) {
+    if (!SAFE_FILENAME.test(id)) {
+        throw new AtomicCoreError('INVALID_ARGUMENT', `Not a safe container id for the execution journal: ${id}`);
+    }
+    return id;
+}
+function isExecutionRecord(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const r = value;
+    return (typeof r['container_id'] === 'string' &&
+        typeof r['engine_id'] === 'string' &&
+        typeof r['image_digest'] === 'string' &&
+        typeof r['scope'] === 'string' &&
+        typeof r['instance_id'] === 'string' &&
+        typeof r['created_at'] === 'string');
+}
+async function readOne(path) {
+    const text = await readFile(path, 'utf8').catch(() => '');
+    if (!text.trim())
+        return undefined;
+    let raw;
+    try {
+        raw = JSON.parse(text);
+    }
+    catch {
+        return undefined; // a torn write costs that one record, never the journal's correctness
+    }
+    return isExecutionRecord(raw) ? raw : undefined;
+}
+async function readAll(dir) {
+    const records = new Map();
+    const names = await readdir(dir).catch((e) => {
+        if (e.code === 'ENOENT')
+            return [];
+        throw e;
+    });
+    for (const name of names) {
+        if (!name.endsWith('.json'))
+            continue;
+        const record = await readOne(join(dir, name));
+        if (record)
+            records.set(record.container_id, record);
+    }
+    return records;
+}
+async function writeRecord(dir, path, record) {
+    await mkdir(dir, { recursive: true });
+    const tmp = `${path}.${randomUUID()}.tmp`;
+    await writeFile(tmp, `${JSON.stringify(record, null, 2)}\n`);
+    await rename(tmp, path).catch(async (e) => {
+        await rm(tmp, { force: true }).catch(() => { });
+        throw e;
+    });
+}
+export class ExecutionJournal {
+    dir;
+    records = new Map();
+    /**
+     * Serializes every disk write behind this journal, so concurrent `add`/`remove` calls land on disk
+     * in the order they were *called*, never the order their own I/O happens to finish in — the same
+     * `flush` queue `process-journal.ts` chains its whole-array rewrites through. The in-memory map is
+     * always mutated synchronously before a write is enqueued, so `list()` is never behind the queue;
+     * only what ends up on disk depended on write-completion order before this queue existed.
+     *
+     * Always kept *settled-or-pending*, never rejected: `enqueue` neutralizes each task's own outcome
+     * before storing it back here, so one call's write failing (ENOSPC, EACCES, …) can never poison
+     * every later call on this journal — round 2 of the task 2.10 review, `execution-journal.ts:134-137`.
+     * A naive `this.queue = this.queue.then(task)` leaves a rejected `this.queue` behind a failed task;
+     * every later `.then(task)` chained onto a rejected promise skips `task` entirely and rejects with
+     * that *old* error instead, silently dropping every write queued after the first failure.
+     */
+    queue = Promise.resolve();
+    constructor(dir) {
+        this.dir = dir;
+    }
+    static async open(layout) {
+        const journal = new ExecutionJournal(layout.managed.executionsDir);
+        journal.records = await readAll(journal.dir);
+        return journal;
+    }
+    list() {
+        return [...this.records.values()].map((r) => ({ ...r }));
+    }
+    /**
+     * A record must exist before the container can serve anything, so this write is awaited. If the
+     * write does not persist, the in-memory map is rolled back to what it held before this call (the
+     * previous record for this id, or none) rather than keeping the new value: `list()` promises what a
+     * reopen would see, and a reopen never sees a record whose write failed. A caller that gets a
+     * rejection here must treat the container as *not* journalled — retry, or stop and remove the
+     * container it just created — never assume it is safe because `add()` was called.
+     */
+    async add(record) {
+        assertSafeContainerId(record.container_id);
+        const previous = this.records.get(record.container_id);
+        this.records.set(record.container_id, record);
+        const path = this.fileFor(record.container_id);
+        try {
+            await this.enqueue(() => writeRecord(this.dir, path, record));
+        }
+        catch (error) {
+            // Only roll back if nothing else changed this id in the meantime (a concurrent call that
+            // mutated it after us owns the current value; rolling back over it would lose that mutation).
+            if (this.records.get(record.container_id) === record) {
+                if (previous)
+                    this.records.set(record.container_id, previous);
+                else
+                    this.records.delete(record.container_id);
+            }
+            throw error;
+        }
+    }
+    /**
+     * Drop the record for a container that is gone, stopped, or adopted by reconcile. Idempotent. If
+     * the disk removal fails, the in-memory map is rolled back to still hold the record — the file is
+     * still on disk, so pretending it is gone would desynchronize `list()` from what a reopen finds.
+     */
+    async remove(containerId) {
+        if (!this.records.has(containerId))
+            return;
+        const previous = this.records.get(containerId);
+        this.records.delete(containerId);
+        const path = this.fileFor(containerId);
+        try {
+            await this.enqueue(() => rm(path, { force: true }));
+        }
+        catch (error) {
+            // Only restore if nothing else has since claimed this id (e.g. a concurrent add()).
+            if (!this.records.has(containerId))
+                this.records.set(containerId, previous);
+            throw error;
+        }
+    }
+    fileFor(containerId) {
+        return join(this.dir, `${assertSafeContainerId(containerId)}.json`);
+    }
+    /**
+     * Chains one disk write onto whatever this journal already had queued, and returns a promise that
+     * rejects only with *this* task's own error — never a previous task's. `this.queue` itself is kept
+     * always non-rejecting (`.catch(() => {})`) so a failed task never blocks the tasks queued after it.
+     */
+    enqueue(task) {
+        const run = this.queue.catch(() => { }).then(task);
+        this.queue = run.catch(() => { });
+        return run;
+    }
+}
+//# sourceMappingURL=execution-journal.js.map

package/dist/runtime/container/execution-journal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-journal.js","sourceRoot":"","sources":["../../../src/runtime/container/execution-journal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAClF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAc1D,MAAM,aAAa,GAAG,mBAAmB,CAAA;AAEzC,SAAS,qBAAqB,CAAC,EAAU;IACvC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,sDAAsD,EAAE,EAAE,CAAC,CAAA;IAC3G,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACrD,MAAM,CAAC,GAAG,KAAgC,CAAA;IAC1C,OAAO,CACL,OAAO,CAAC,CAAC,cAAc,CAAC,KAAK,QAAQ;QACrC,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,QAAQ;QAClC,OAAO,CAAC,CAAC,cAAc,CAAC,KAAK,QAAQ;QACrC,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ;QAC9B,OAAO,CAAC,CAAC,aAAa,CAAC,KAAK,QAAQ;QACpC,OAAO,CAAC,CAAC,YAAY,CAAC,KAAK,QAAQ,CACpC,CAAA;AACH,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,IAAY;IACjC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;IACzD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,SAAS,CAAA;IAClC,IAAI,GAAY,CAAA;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA,CAAC,sEAAsE;IACzF,CAAC;IACD,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;AACjD,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,GAAW;IAChC,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAA;IAClD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3C,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAA;QAC7D,MAAM,CAAC,CAAA;IACT,CAAC,CAAC,CAAA;IACF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAQ;QACrC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAA;QAC7C,IAAI,MAAM;YAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAA;IACtD,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,IAAY,EAAE,MAAuB;IAC3E,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACrC,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,UAAU,EAAE,MAAM,CAAA;IACzC,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAA;IAC5D,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QACxC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC9C,MAAM,CAAC,CAAA;IACT,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,OAAO,gBAAgB;IAkBU;IAjB7B,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAA;IACpD;;;;;;;;;;;;;OAaG;IACK,KAAK,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAA;IAEhD,YAAqC,GAAW;QAAX,QAAG,GAAH,GAAG,CAAQ;IAAG,CAAC;IAEpD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAkB;QAClC,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;QAClE,OAAO,CAAC,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC5C,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,IAAI;QACF,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;IAC1D,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,GAAG,CAAC,MAAuB;QAC/B,qBAAqB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;QACtD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAA;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;QAC9C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;QAC/D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yFAAyF;YACzF,8FAA8F;YAC9F,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,MAAM,EAAE,CAAC;gBACrD,IAAI,QAAQ;oBAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAA;;oBACxD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;YAC/C,CAAC;YACD,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,WAAmB;QAC9B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;YAAE,OAAM;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAoB,CAAA;QACjE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QACtC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,oFAAoF;YACpF,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;gBAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;YAC3E,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IAEO,OAAO,CAAC,WAAmB;QACjC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,qBAAqB,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;IACrE,CAAC;IAED;;;;OAIG;IACK,OAAO,CAAC,IAAyB;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACjD,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAChC,OAAO,GAAG,CAAA;IACZ,CAAC;CACF"}

package/dist/runtime/container/heartbeat.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Touches the heartbeat file the watchdog entrypoint (`watchdog.ts`) polls, on a fixed interval,
+ * for as long as the managed session lifecycle (task 2.12, which owns this ticker's lifecycle) keeps
+ * it running. This file being written from the host, and the watchdog inside the container reading
+ * its mtime, is the whole mechanism the "Watchdog гарантирует освобождение GPU" requirement relies
+ * on to notice a dead core: no update within the stale limit means the core stopped ticking,
+ * whatever the reason (crash, kill, a slept host).
+ *
+ * Timer, filesystem and clock are all injected so tests run instantly under fake timers. `onError`
+ * is required, not optional: a write failure here is a silent gap in the one signal the watchdog
+ * trusts, and swallowing it by default is exactly the kind of thing that only gets noticed once the
+ * GPU is stuck — the caller must say what happens to it, even if that is just logging. A failed
+ * write never throws out of a tick either way; it is retried on the next tick, not treated as fatal
+ * to the ticker itself. A dead engine is the watchdog's problem to notice via the *absence* of
+ * heartbeats, not this ticker's problem to detect directly.
+ *
+ * `ready` always settles: it resolves on the first successful write, or rejects if `stop()` is
+ * called before that ever happens (findings-2.9-r2 item 5 — a ticker whose writes keep failing, or
+ * that is stopped before its first attempt lands, used to leave a caller `await`ing `ready` hanging
+ * forever). It can still take arbitrarily long to settle if the ticker is neither stopped nor ever
+ * manages a successful write, so a caller awaiting it should race it against its own timeout rather
+ * than await it unconditionally.
+ */
+/** The slice of `node:fs/promises` the ticker needs; tests pass an in-memory fake. */
+export interface HeartbeatFs {
+    writeFile(path: string, data: string): Promise<void>;
+}
+export interface HeartbeatTickerOptions {
+    /** Path to the heartbeat file. The lifecycle owns its location; this module never derives one. */
+    path: string;
+    /** Defaults to `DEFAULT_HEARTBEAT_INTERVAL_SECS` (see watchdog.ts for why it is a placeholder). */
+    intervalMs?: number;
+    fs?: HeartbeatFs;
+    /** Clock used for the heartbeat's own content (an epoch-millis string); defaults to `Date.now`. */
+    now?: () => number;
+    setIntervalFn?: (handler: () => void, ms: number) => ReturnType<typeof setInterval>;
+    clearIntervalFn?: (handle: ReturnType<typeof setInterval>) => void;
+    /** Called instead of throwing when a tick's write fails; the ticker keeps running either way. */
+    onError: (error: unknown) => void;
+}
+export interface HeartbeatTicker {
+    /** Resolves on the first successful write; rejects if `stop()` is called before that happens. */
+    ready: Promise<void>;
+    stop(): void;
+}
+/** Starts ticking immediately (the first write is issued before this returns) and every `intervalMs` after. */
+export declare function startHeartbeatTicker(options: HeartbeatTickerOptions): HeartbeatTicker;

package/dist/runtime/container/heartbeat.js

@@ -0,0 +1,78 @@
+/**
+ * Touches the heartbeat file the watchdog entrypoint (`watchdog.ts`) polls, on a fixed interval,
+ * for as long as the managed session lifecycle (task 2.12, which owns this ticker's lifecycle) keeps
+ * it running. This file being written from the host, and the watchdog inside the container reading
+ * its mtime, is the whole mechanism the "Watchdog гарантирует освобождение GPU" requirement relies
+ * on to notice a dead core: no update within the stale limit means the core stopped ticking,
+ * whatever the reason (crash, kill, a slept host).
+ *
+ * Timer, filesystem and clock are all injected so tests run instantly under fake timers. `onError`
+ * is required, not optional: a write failure here is a silent gap in the one signal the watchdog
+ * trusts, and swallowing it by default is exactly the kind of thing that only gets noticed once the
+ * GPU is stuck — the caller must say what happens to it, even if that is just logging. A failed
+ * write never throws out of a tick either way; it is retried on the next tick, not treated as fatal
+ * to the ticker itself. A dead engine is the watchdog's problem to notice via the *absence* of
+ * heartbeats, not this ticker's problem to detect directly.
+ *
+ * `ready` always settles: it resolves on the first successful write, or rejects if `stop()` is
+ * called before that ever happens (findings-2.9-r2 item 5 — a ticker whose writes keep failing, or
+ * that is stopped before its first attempt lands, used to leave a caller `await`ing `ready` hanging
+ * forever). It can still take arbitrarily long to settle if the ticker is neither stopped nor ever
+ * manages a successful write, so a caller awaiting it should race it against its own timeout rather
+ * than await it unconditionally.
+ */
+import { writeFile } from 'node:fs/promises';
+import { DEFAULT_HEARTBEAT_INTERVAL_SECS } from './watchdog.js';
+const NODE_FS = { writeFile };
+/** Starts ticking immediately (the first write is issued before this returns) and every `intervalMs` after. */
+export function startHeartbeatTicker(options) {
+    const fs = options.fs ?? NODE_FS;
+    const now = options.now ?? Date.now;
+    const intervalMs = options.intervalMs ?? DEFAULT_HEARTBEAT_INTERVAL_SECS * 1000;
+    const setIntervalFn = options.setIntervalFn ?? setInterval;
+    const clearIntervalFn = options.clearIntervalFn ?? clearInterval;
+    let inFlight = false;
+    let readySettled = false;
+    let resolveReady;
+    let rejectReady;
+    const ready = new Promise((resolve, reject) => {
+        resolveReady = resolve;
+        rejectReady = reject;
+    });
+    // A caller that never touches `ready` (most callers just want the ticker running) must not turn a
+    // stop-before-success into an unhandled rejection; a caller that does await/catch it separately
+    // still observes the same rejection, since a promise can have more than one listener.
+    ready.catch(() => { });
+    // A tick that fires while the previous write is still pending is skipped outright rather than
+    // queued: the ticker's only job is to keep the mtime moving, and a queue of stale writes racing
+    // a slow filesystem would just reorder themselves for no benefit, or pile up behind it.
+    const tick = () => {
+        if (inFlight)
+            return;
+        inFlight = true;
+        fs.writeFile(options.path, String(now()))
+            .then(() => {
+            if (!readySettled) {
+                readySettled = true;
+                resolveReady();
+            }
+        })
+            .catch((error) => options.onError(error))
+            .finally(() => {
+            inFlight = false;
+        });
+    };
+    tick();
+    const handle = setIntervalFn(tick, intervalMs);
+    return {
+        ready,
+        stop() {
+            clearIntervalFn(handle);
+            if (!readySettled) {
+                readySettled = true;
+                rejectReady(new Error('Heartbeat ticker stopped before its first write succeeded.'));
+            }
+        },
+    };
+}
+//# sourceMappingURL=heartbeat.js.map

package/dist/runtime/container/heartbeat.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"heartbeat.js","sourceRoot":"","sources":["../../../src/runtime/container/heartbeat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC5C,OAAO,EAAE,+BAA+B,EAAE,MAAM,eAAe,CAAA;AAO/D,MAAM,OAAO,GAAgB,EAAE,SAAS,EAAE,CAAA;AAsB1C,+GAA+G;AAC/G,MAAM,UAAU,oBAAoB,CAAC,OAA+B;IAClE,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,OAAO,CAAA;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAA;IACnC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,+BAA+B,GAAG,IAAI,CAAA;IAC/E,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,WAAW,CAAA;IAC1D,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,aAAa,CAAA;IAEhE,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,IAAI,YAAY,GAAG,KAAK,CAAA;IACxB,IAAI,YAAyB,CAAA;IAC7B,IAAI,WAAsC,CAAA;IAC1C,MAAM,KAAK,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAClD,YAAY,GAAG,OAAO,CAAA;QACtB,WAAW,GAAG,MAAM,CAAA;IACtB,CAAC,CAAC,CAAA;IACF,kGAAkG;IAClG,gGAAgG;IAChG,sFAAsF;IACtF,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAErB,8FAA8F;IAC9F,gGAAgG;IAChG,wFAAwF;IACxF,MAAM,IAAI,GAAG,GAAS,EAAE;QACtB,IAAI,QAAQ;YAAE,OAAM;QACpB,QAAQ,GAAG,IAAI,CAAA;QACf,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;aACtC,IAAI,CAAC,GAAG,EAAE;YACT,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,YAAY,GAAG,IAAI,CAAA;gBACnB,YAAY,EAAE,CAAA;YAChB,CAAC;QACH,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;aACjD,OAAO,CAAC,GAAG,EAAE;YACZ,QAAQ,GAAG,KAAK,CAAA;QAClB,CAAC,CAAC,CAAA;IACN,CAAC,CAAA;IAED,IAAI,EAAE,CAAA;IACN,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;IAE9C,OAAO;QACL,KAAK;QACL,IAAI;YACF,eAAe,CAAC,MAAM,CAAC,CAAA;YACvB,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,YAAY,GAAG,IAAI,CAAA;gBACnB,WAAW,CAAC,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC,CAAA;YACtF,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/runtime/container/index.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The Docker executor (task 2.8, openspec change `add-tensorrt-llm-linux`): pulls, inspects,
+ * creates, starts, stops, removes and reads the logs of a model container, and runs one-shot GPU
+ * probes. `argv.ts` is pure argv construction; `exec.ts` and `operations.ts` are the injectable I/O
+ * that runs it; `pull.ts` talks to the Docker Engine API directly for byte-level pull progress. No
+ * shell is ever used, and everything a descriptor or a probe contributed is validated before it
+ * becomes an argv token or a URL query value (`argv.ts`'s `assertSafeArgvValue`).
+ *
+ * `wiring.ts` (task 2.12) is what core startup calls on Linux: it resolves the docker CLI to an
+ * absolute system path (`docker-binary.ts`), builds the one executor, and reconciles the journal.
+ *
+ * `execution-journal.ts` (task 2.10) is the private record of the containers this core instance
+ * created; `reconcile.ts` uses it and `operations.ts` to stop and remove what a previous instance
+ * left running, and never touches a container that is not in the journal.
+ *
+ * Public API of this module is exported from this file only.
+ */
+export * from './types.js';
+export * from './argv.js';
+export * from './env.js';
+export * from './exec.js';
+export * from './operations.js';
+export * from './pull.js';
+export * from './execution-journal.js';
+export * from './reconcile.js';
+export * from './watchdog.js';
+export * from './heartbeat.js';
+export * from './docker-binary.js';
+export * from './wiring.js';
+export * from './wsl-exec.js';

package/dist/runtime/container/index.js

@@ -0,0 +1,31 @@
+/**
+ * The Docker executor (task 2.8, openspec change `add-tensorrt-llm-linux`): pulls, inspects,
+ * creates, starts, stops, removes and reads the logs of a model container, and runs one-shot GPU
+ * probes. `argv.ts` is pure argv construction; `exec.ts` and `operations.ts` are the injectable I/O
+ * that runs it; `pull.ts` talks to the Docker Engine API directly for byte-level pull progress. No
+ * shell is ever used, and everything a descriptor or a probe contributed is validated before it
+ * becomes an argv token or a URL query value (`argv.ts`'s `assertSafeArgvValue`).
+ *
+ * `wiring.ts` (task 2.12) is what core startup calls on Linux: it resolves the docker CLI to an
+ * absolute system path (`docker-binary.ts`), builds the one executor, and reconciles the journal.
+ *
+ * `execution-journal.ts` (task 2.10) is the private record of the containers this core instance
+ * created; `reconcile.ts` uses it and `operations.ts` to stop and remove what a previous instance
+ * left running, and never touches a container that is not in the journal.
+ *
+ * Public API of this module is exported from this file only.
+ */
+export * from './types.js';
+export * from './argv.js';
+export * from './env.js';
+export * from './exec.js';
+export * from './operations.js';
+export * from './pull.js';
+export * from './execution-journal.js';
+export * from './reconcile.js';
+export * from './watchdog.js';
+export * from './heartbeat.js';
+export * from './docker-binary.js';
+export * from './wiring.js';
+export * from './wsl-exec.js';
+//# sourceMappingURL=index.js.map

package/dist/runtime/container/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/runtime/container/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,UAAU,CAAA;AACxB,cAAc,WAAW,CAAA;AACzB,cAAc,iBAAiB,CAAA;AAC/B,cAAc,WAAW,CAAA;AACzB,cAAc,wBAAwB,CAAA;AACtC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,eAAe,CAAA;AAC7B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,oBAAoB,CAAA;AAClC,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA"}

package/dist/runtime/container/operations.d.ts

@@ -0,0 +1,40 @@
+import type { DockerCommandResult, DockerExec, ImageRef, ModelContainerCreateSpec, OneShotRunSpec, Realpath, StopOutcome } from './types.js';
+/** `docker image/container inspect`'s answer: `value` is the first (only) element of docker's JSON array. */
+export interface InspectResult {
+    found: boolean;
+    value: unknown;
+}
+/**
+ * The host port Docker published `containerPort` on, for a container created with a Docker-chosen
+ * port (`host_port: 0`). Only a `127.0.0.1` publication is accepted, whatever Docker answers.
+ */
+export declare function publishedHostPort(exec: DockerExec, containerId: string, containerPort: number): Promise<number>;
+export declare function inspectImage(exec: DockerExec, image: ImageRef): Promise<InspectResult>;
+export declare function inspectContainer(exec: DockerExec, containerId: string): Promise<InspectResult>;
+export interface CreateContainerDeps {
+    /** Defaults to `node:fs/promises`'s `realpath`; tests inject a fake or a real symlinked tmpdir. */
+    realpath?: Realpath;
+}
+/** Creates (but does not start) the model container; returns the id docker printed to stdout. */
+export declare function createContainer(exec: DockerExec, spec: ModelContainerCreateSpec, deps?: CreateContainerDeps): Promise<{
+    containerId: string;
+}>;
+export declare function startContainer(exec: DockerExec, containerId: string): Promise<void>;
+/**
+ * Stops the container and waits for Docker to confirm it exited (or was already absent) — never
+ * treats "our own exec call did not get an answer" as a stop (spec `tensorrt-llm-runtime`,
+ * requirement "unloading waits for a confirmed stop"). `confirmed: false` is what a caller maps to
+ * `MANAGED_STOP_UNCONFIRMED` and a held GPU reservation.
+ */
+export declare function stopContainer(exec: DockerExec, containerId: string, timeoutSeconds: number): Promise<StopOutcome>;
+/** Idempotent: a container already removed (or never created) is success, not an error. */
+export declare function removeContainer(exec: DockerExec, containerId: string): Promise<void>;
+/** Ids of every container, running or stopped, created from `image`. Fails when docker cannot answer. */
+export declare function containersUsingImage(exec: DockerExec, image: ImageRef): Promise<string[]>;
+/** Removes the digest reference; an image already gone is `absent`, anything else docker refuses throws. */
+export declare function removeImage(exec: DockerExec, image: ImageRef): Promise<'removed' | 'absent'>;
+/** The last `tailLines` lines (or, with `'all'`, every line) of the container's combined,
+ *  chronologically merged stdout+stderr log. The exec's own per-stream output cap still bounds it. */
+export declare function containerLogs(exec: DockerExec, containerId: string, tailLines: number | 'all'): Promise<string>;
+/** A one-shot `docker run --rm` probe (task 2.x's GPU check): the raw result, never thrown — the caller classifies it. */
+export declare function runOnce(exec: DockerExec, spec: OneShotRunSpec): Promise<DockerCommandResult>;