@atomic-chat/core 0.5.1 → 0.13.2

package/dist/runtime/environment/linux-blockers.js

@@ -0,0 +1,251 @@
+/**
+ * The structured reasons `assessLinux` (`linux-plan.ts`) refuses a host — split out of that file
+ * once it grew past the ~500-line guidance for this module (task 2.4 fix round 2). Everything here
+ * is pure: a reason code, the message a person reads, and the machine-checkable specifics. A few
+ * small, self-contained decision helpers moved in alongside them in round 3, for the same reason
+ * (`linux-plan.ts` growing past the guidance again): `effectiveGpuRuntime` and the two exact-command
+ * builders (`archCommands`, `groupOnlyCommands`) that blockers built here actually use. Round 4 moved
+ * the install-gate blockers here too (`gateBlocker`), and added the relogin path's per-component
+ * blockers (`missingComponentBlockers`).
+ */
+export function blocker(reason, message, params, commands) {
+    return {
+        reason,
+        message,
+        ...(params === undefined ? {} : { params }),
+        ...(commands === undefined ? {} : { commands }),
+    };
+}
+/**
+ * A Docker install this integration will never adopt or install over, regardless of whether it
+ * happens to expose a GPU runtime — there is no safe way to lay `docker-ce` next to or over it.
+ */
+export function installMethodBlocker(method) {
+    switch (method) {
+        case 'snap':
+            return blocker('docker-snap', 'Docker was installed from the snap store, which does not support the NVIDIA Container ' +
+                'Toolkit. Switch to the docker-ce package instead; nothing here removes the snap install.');
+        case 'rootless':
+            return blocker('docker-rootless', 'Rootless Docker is not supported for this runtime. Switch to a standard (rootful) docker-ce ' +
+                'installation; nothing here removes the rootless install.');
+        case 'docker-desktop':
+            return blocker('docker-desktop-only', 'Docker Desktop without a separate system Docker Engine cannot be configured for this runtime. ' +
+                'Install docker-ce as the system engine; nothing here changes the Docker Desktop install.');
+        case 'podman-docker':
+            return blocker('podman-docker', "The docker command here is Podman's compatibility shim, not Docker Engine; Podman is not " +
+                'supported by this runtime. podman-docker conflicts with docker-ce at the package level, so ' +
+                'it must be removed first; install Docker Engine (docker-ce) afterward. Nothing here removes ' +
+                'Podman itself or installs docker-ce over it automatically.');
+        default:
+            return null;
+    }
+}
+/**
+ * Whether the GPU reaches a container: a listed NVIDIA CDI device (task 2.23, F-5), from `docker
+ * info`'s side when the daemon answered, from `nvidia-ctk cdi list` alone when it did not (item 3).
+ */
+export function effectiveGpuRuntime(facts) {
+    return facts.docker.daemon_reachable ? facts.docker.gpu_runtime : facts.docker.gpu_runtime_from_config;
+}
+/**
+ * The commands a host missing only its `docker` group membership needs — everything else is
+ * already ready. An rpm-ostree host (Silverblue/Kinoite/Bazzite) needs one step first: package
+ * layering puts the `docker` group's line in `/usr/lib/group` (the vendor/OS-tree database), but
+ * `/etc/group` — what `usermod`/`getent` actually consult — does not inherit it automatically, so
+ * `usermod -aG docker` alone would fail with "group 'docker' does not exist" (round 3, ruling 6).
+ * Never called for root (D4): root needs no group membership, and the caller never reaches here for it.
+ */
+export function groupOnlyCommands(immutableOs, user) {
+    const usermod = `sudo usermod -aG docker ${user}`;
+    if (!immutableOs)
+        return [usermod];
+    // Idempotent (round 4, item F): run twice, it must not append a second `docker:` line.
+    return [
+        `grep -q '^docker:' /etc/group || grep -E '^docker:' /usr/lib/group | sudo tee -a /etc/group`,
+        usermod,
+    ];
+}
+/** The CDI spec the recipe generates, as a person runs it (task 2.23, F-5; ruling R-core-8). */
+const GENERATE_CDI_COMMAND = 'sudo nvidia-ctk cdi generate --output=/var/run/cdi/nvidia.yaml';
+/**
+ * Arch never supports a partial `pacman -S` of just these two packages (design D2): installing a
+ * package without syncing the whole system can leave it inconsistent, so the commands run a full
+ * `-Syu` instead — which may itself bring in a newer kernel and NVIDIA driver, hence the reboot
+ * note. The CDI spec is generated too (task 2.23, F-5: Docker 28.2+ passes `--gpus` through it).
+ * `nvidia-ctk runtime configure` changes `/etc/docker/daemon.json`, so Docker is explicitly
+ * restarted afterward rather than relying on `enable --now` to notice the new config on its own
+ * (item 12). The `usermod` line uses the actual probed account, never the literal `$USER`, and is
+ * omitted entirely for root, which needs no group membership at all (round 3, ruling 8), and for an
+ * account that is already a member (round 5, item 1: `groupNeeded` false).
+ */
+export function archCommands(user, groupNeeded = user !== 'root') {
+    const commands = [
+        'sudo pacman -Syu --needed docker nvidia-container-toolkit',
+        'sudo nvidia-ctk runtime configure --runtime=docker',
+        GENERATE_CDI_COMMAND,
+        'sudo systemctl restart docker',
+        'sudo systemctl enable --now docker',
+    ];
+    if (groupNeeded && user !== 'root')
+        commands.push(`sudo usermod -aG docker ${user}`);
+    return commands;
+}
+/** Group membership confirmed, but this login session predates it (round 3, ruling 4). */
+export function reloginRequiredBlocker() {
+    return blocker('relogin-required', 'This account is already a member of the docker group, but this login session started before that ' +
+        'took effect. Log out and back in (or restart this session) to pick it up.', undefined, []);
+}
+/**
+ * Whether the gate's own blocker applies to this host — one decision, read by the relogin path and the
+ * full-install path alike (round 5, item 2). Never on a recipe distribution. On an immutable base only
+ * when a package (Docker or the toolkit) is missing, since layering packages is what the gate is about
+ * (spec: "система неизменяемая … и Docker или toolkit нет"); a missing runtime configuration or a
+ * stopped service is an ordinary step there, reported per component. Every other gate always applies.
+ */
+export function gateBlockerApplies(gate, facts) {
+    if (gate === 'recipe')
+        return false;
+    if (gate === 'immutable')
+        return !facts.docker.cli || !facts.toolkit_installed;
+    return true;
+}
+/** `immutable-os`, naming exactly the packages that are missing — never docker-ce over an engine (round 5, item 2). */
+function immutableOsBlocker(facts) {
+    const missing = [];
+    if (!facts.docker.cli)
+        missing.push(['docker', 'Docker Engine']);
+    if (!facts.toolkit_installed)
+        missing.push(['nvidia-container-toolkit', 'the NVIDIA Container Toolkit']);
+    const base = 'This system uses an immutable base (rpm-ostree — Silverblue, Kinoite, Bazzite, or similar)';
+    if (missing.length === 0) {
+        return blocker('immutable-os', `${base}. Automatic setup is not offered here; finish the remaining Docker setup by hand, then try again.`);
+    }
+    const names = missing.map(([, label]) => label).join(' and ');
+    const plural = missing.length > 1;
+    return blocker('immutable-os', `${base}, and ${names} ${plural ? 'are' : 'is'} not installed. Installing a package here means ` +
+        'layering it and rebooting, which this integration does not do automatically. ' +
+        `Layer ${plural ? 'them' : 'it'} yourself, then try again.`, { missing: missing.map(([key]) => key).join(',') });
+}
+/**
+ * The exact commands for joining the `docker` group, for a host where automatic setup is not offered.
+ * `everythingElseReady` picks the wording: the only step left, or one step among others (round 5).
+ */
+export function dockerGroupManualBlocker(immutableOs, user, everythingElseReady) {
+    const commands = groupOnlyCommands(immutableOs, user);
+    const run = `run ${commands.map((c) => `\`${c}\``).join(', then ')}, then log out and back in.`;
+    return blocker('docker-group-manual', everythingElseReady
+        ? 'Everything else is ready — Docker, the toolkit and the NVIDIA runtime are all configured. ' +
+            "This account just needs to join the docker group, which is not something this distribution's " +
+            `automatic install can add for you: ${run}`
+        : `This account also needs to join the docker group: ${run}`, { user }, commands);
+}
+/** Why automatic setup is not offered, for every gate but `'recipe'`. */
+export function gateBlocker(gate, facts, distribution, user) {
+    switch (gate) {
+        case 'immutable':
+            return immutableOsBlocker(facts);
+        case 'pacman': {
+            // An account already in the group (or root) gets no usermod and no "new membership" note.
+            const groupNeeded = user !== 'root' && facts.docker_group.configured !== true;
+            return blocker('arch-manual-install', "Arch and its derivatives don't support a partial package install: adding just these two " +
+                'packages without a full system sync can leave the system inconsistent, so the commands ' +
+                'below run a full `pacman -Syu` instead — which may itself update your kernel and NVIDIA ' +
+                'driver. Reboot afterward if it does' +
+                (groupNeeded
+                    ? ', then log out and back in so the new docker group membership takes effect.'
+                    : '.') +
+                ' Automatic install is not offered here.', { family: 'pacman' }, archCommands(user, groupNeeded));
+        }
+        case 'unrecognised':
+            // Never lay docker-ce over an unknown quantity (round 1, item 15).
+            return blocker('docker-unrecognised', "This machine's docker command does not match any Docker install this integration " +
+                'recognises (not docker-ce, docker.io, moby-engine, snap, rootless, Docker Desktop, or the ' +
+                'podman-docker shim). Nothing will be installed over it automatically.');
+        case 'manifest-unavailable':
+            return environmentManifestUnavailableBlocker();
+        case 'unqualified':
+            return blocker('distribution-not-in-recipe', 'Setting the runtime up automatically is only qualified on some distributions so far.', { id: distribution.id, version_id: distribution.version_id, arch: facts.architecture ?? 'unknown' });
+    }
+}
+/**
+ * No environment manifest: which distributions the install recipe is qualified for is unknown, so no
+ * automatic setup is offered — not because this distribution is unsupported, but because the list
+ * could not be had (no network and nothing cached, or none this core accepts). Retrying with a
+ * network is the fix; a ready host never sees this (it is adopted before any gate).
+ */
+export function environmentManifestUnavailableBlocker() {
+    return blocker('environment-manifest-unavailable', 'The list of systems where setup can install Docker and the NVIDIA Container Toolkit could not be ' +
+        'loaded, and none was saved before. Check the internet connection and try again.');
+}
+/** Refuses to write next to a daemon.json this probe could not read or parse (round 2, item 6). */
+/**
+ * The recipe installs and starts Docker through systemd (`systemctl enable --now docker`, a restart
+ * after `nvidia-ctk runtime configure`), so on a host that does not run it — a container whose PID 1
+ * is a shell, as the vast.ai GB10 instance was — every such plan would fail only at the privileged
+ * step, after the user consented. Whether systemd runs could not be read is the unread fact
+ * `init-system` instead (`unknown-fact`), never this.
+ */
+export function initNotSystemdBlocker() {
+    return blocker('init-not-systemd', 'This system does not run systemd, which the Docker install needs.');
+}
+export function daemonJsonUnreadableBlocker() {
+    return blocker('daemon-json-unreadable', '/etc/docker/daemon.json exists but could not be read or parsed, so this integration cannot tell ' +
+        "whether the NVIDIA runtime is already configured there. Fix the file's permissions or contents " +
+        'by hand, then try again — nothing here will overwrite a file it cannot read back.');
+}
+const CONFIGURE_RUNTIME_COMMANDS = [
+    'sudo nvidia-ctk runtime configure --runtime=docker',
+    GENERATE_CDI_COMMAND,
+    'sudo systemctl restart docker',
+];
+const ENABLE_SERVICE_COMMANDS = ['sudo systemctl enable --now docker'];
+/**
+ * One blocker per component offline evidence shows missing, for a host that also has to relogin
+ * (round 4, item 1 — the refined ruling 4): the Docker CLI, the NVIDIA Container Toolkit, the GPU
+ * runtime in Docker (or `daemon-json-unreadable` when that cannot be told), and `docker.service`
+ * when `systemctl` says it is not active. An `'unknown'` service state is not evidence of anything and
+ * is not reported. Empty when the relogin alone is the fix.
+ *
+ * What each one tells the person depends on the gate: on a recipe distribution setup will do it after
+ * the relogin, so there is nothing to run by hand; on Arch each carries its exact commands (a full
+ * `pacman -Syu` for packages, design D2); anywhere else the package steps have no command this
+ * integration can vouch for (the caller adds the gate's own blocker), while the runtime and service
+ * steps are the same `nvidia-ctk`/`systemctl` commands on every distribution.
+ */
+export function missingComponentBlockers(facts, gate) {
+    const recipe = gate === 'recipe';
+    const later = (what) => ` After you log back in, setup will offer to ${what}.`;
+    const packageStep = (reason, subject, pacmanPackage) => blocker(reason, `${subject} is not installed.` +
+        (recipe
+            ? later('install it')
+            : gate === 'pacman'
+                ? ' Install it with a full system sync (Arch does not support partial upgrades); reboot ' +
+                    'afterward if the kernel or NVIDIA driver was updated.'
+                : gate === 'manifest-unavailable'
+                    ? ' Whether setup can install it for you is not known until the list of supported ' +
+                        'systems loads; try again with a working internet connection.'
+                    : ' Automatic install is not offered on this system; install it yourself.'), undefined, gate === 'pacman' ? [`sudo pacman -Syu --needed ${pacmanPackage}`] : []);
+    const blockers = [];
+    if (!facts.docker.cli)
+        blockers.push(packageStep('docker-cli-missing', 'Docker Engine', 'docker'));
+    if (!facts.toolkit_installed) {
+        blockers.push(packageStep('toolkit-missing', 'The NVIDIA Container Toolkit', 'nvidia-container-toolkit'));
+    }
+    if (!effectiveGpuRuntime(facts)) {
+        // A registered `nvidia` runtime without a CDI spec needs only the spec, and no restart (F-5).
+        const specOnly = facts.docker.nvidia_runtime;
+        blockers.push(facts.docker.daemon_json_unreadable && !specOnly
+            ? daemonJsonUnreadableBlocker()
+            : blocker('gpu-runtime-not-configured', (specOnly
+                ? 'Docker has no NVIDIA CDI specification, so it cannot pass the GPU into a container.'
+                : 'Docker is not configured with the NVIDIA runtime and has no NVIDIA CDI specification. ' +
+                    'Configuring it restarts Docker, which stops any running containers.') +
+                (recipe ? later('configure it') : ' Configure it yourself with the commands below.'), undefined, recipe ? [] : specOnly ? [GENERATE_CDI_COMMAND] : CONFIGURE_RUNTIME_COMMANDS));
+    }
+    if (facts.docker.service_active === false) {
+        blockers.push(blocker('docker-service-inactive', 'docker.service is not running.' +
+            (recipe ? later('enable and start it') : ' Enable and start it with the command below.'), undefined, recipe ? [] : ENABLE_SERVICE_COMMANDS));
+    }
+    return blockers;
+}
+//# sourceMappingURL=linux-blockers.js.map

package/dist/runtime/environment/linux-blockers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"linux-blockers.js","sourceRoot":"","sources":["../../../src/runtime/environment/linux-blockers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAsDH,MAAM,UAAU,OAAO,CACrB,MAA0B,EAC1B,OAAe,EACf,MAA+B,EAC/B,QAAmB;IAEnB,OAAO;QACL,MAAM;QACN,OAAO;QACP,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3C,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;KAChD,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA8C;IACjF,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,MAAM;YACT,OAAO,OAAO,CACZ,aAAa,EACb,wFAAwF;gBACtF,0FAA0F,CAC7F,CAAA;QACH,KAAK,UAAU;YACb,OAAO,OAAO,CACZ,iBAAiB,EACjB,8FAA8F;gBAC5F,0DAA0D,CAC7D,CAAA;QACH,KAAK,gBAAgB;YACnB,OAAO,OAAO,CACZ,qBAAqB,EACrB,gGAAgG;gBAC9F,0FAA0F,CAC7F,CAAA;QACH,KAAK,eAAe;YAClB,OAAO,OAAO,CACZ,eAAe,EACf,2FAA2F;gBACzF,6FAA6F;gBAC7F,8FAA8F;gBAC9F,4DAA4D,CAC/D,CAAA;QACH;YACE,OAAO,IAAI,CAAA;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAiB;IACnD,OAAO,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,uBAAuB,CAAA;AACxG,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAoB,EAAE,IAAY;IAClE,MAAM,OAAO,GAAG,2BAA2B,IAAI,EAAE,CAAA;IACjD,IAAI,CAAC,WAAW;QAAE,OAAO,CAAC,OAAO,CAAC,CAAA;IAClC,uFAAuF;IACvF,OAAO;QACL,6FAA6F;QAC7F,OAAO;KACR,CAAA;AACH,CAAC;AAED,gGAAgG;AAChG,MAAM,oBAAoB,GAAG,gEAAgE,CAAA;AAE7F;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,WAAW,GAAG,IAAI,KAAK,MAAM;IACtE,MAAM,QAAQ,GAAG;QACf,2DAA2D;QAC3D,oDAAoD;QACpD,oBAAoB;QACpB,+BAA+B;QAC/B,oCAAoC;KACrC,CAAA;IACD,IAAI,WAAW,IAAI,IAAI,KAAK,MAAM;QAAE,QAAQ,CAAC,IAAI,CAAC,2BAA2B,IAAI,EAAE,CAAC,CAAA;IACpF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,sBAAsB;IACpC,OAAO,OAAO,CACZ,kBAAkB,EAClB,mGAAmG;QACjG,2EAA2E,EAC7E,SAAS,EACT,EAAE,CACH,CAAA;AACH,CAAC;AAcD;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAiB,EAAE,KAAiB;IACrE,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACnC,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAA;IAC9E,OAAO,IAAI,CAAA;AACb,CAAC;AAED,uHAAuH;AACvH,SAAS,kBAAkB,CAAC,KAAiB;IAC3C,MAAM,OAAO,GAA4B,EAAE,CAAA;IAC3C,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAA;IAChE,IAAI,CAAC,KAAK,CAAC,iBAAiB;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC,0BAA0B,EAAE,8BAA8B,CAAC,CAAC,CAAA;IACxG,MAAM,IAAI,GAAG,4FAA4F,CAAA;IACzG,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,OAAO,CACZ,cAAc,EACd,GAAG,IAAI,mGAAmG,CAC3G,CAAA;IACH,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAA;IACjC,OAAO,OAAO,CACZ,cAAc,EACd,GAAG,IAAI,SAAS,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,kDAAkD;QAC9F,+EAA+E;QAC/E,SAAS,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,4BAA4B,EAC7D,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CACnD,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,WAAoB,EACpB,IAAY,EACZ,mBAA4B;IAE5B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;IACrD,MAAM,GAAG,GAAG,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,6BAA6B,CAAA;IAC/F,OAAO,OAAO,CACZ,qBAAqB,EACrB,mBAAmB;QACjB,CAAC,CAAC,4FAA4F;YAC1F,+FAA+F;YAC/F,sCAAsC,GAAG,EAAE;QAC/C,CAAC,CAAC,qDAAqD,GAAG,EAAE,EAC9D,EAAE,IAAI,EAAE,EACR,QAAQ,CACT,CAAA;AACH,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,WAAW,CACzB,IAAoC,EACpC,KAAiB,EACjB,YAA+B,EAC/B,IAAY;IAEZ,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,WAAW;YACd,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAA;QAClC,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,0FAA0F;YAC1F,MAAM,WAAW,GAAG,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,UAAU,KAAK,IAAI,CAAA;YAC7E,OAAO,OAAO,CACZ,qBAAqB,EACrB,0FAA0F;gBACxF,yFAAyF;gBACzF,0FAA0F;gBAC1F,qCAAqC;gBACrC,CAAC,WAAW;oBACV,CAAC,CAAC,6EAA6E;oBAC/E,CAAC,CAAC,GAAG,CAAC;gBACR,yCAAyC,EAC3C,EAAE,MAAM,EAAE,QAAQ,EAAE,EACpB,YAAY,CAAC,IAAI,EAAE,WAAW,CAAC,CAChC,CAAA;QACH,CAAC;QACD,KAAK,cAAc;YACjB,mEAAmE;YACnE,OAAO,OAAO,CACZ,qBAAqB,EACrB,mFAAmF;gBACjF,4FAA4F;gBAC5F,uEAAuE,CAC1E,CAAA;QACH,KAAK,sBAAsB;YACzB,OAAO,qCAAqC,EAAE,CAAA;QAChD,KAAK,aAAa;YAChB,OAAO,OAAO,CACZ,4BAA4B,EAC5B,sFAAsF,EACtF,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,UAAU,EAAE,YAAY,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,YAAY,IAAI,SAAS,EAAE,CACpG,CAAA;IACL,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qCAAqC;IACnD,OAAO,OAAO,CACZ,kCAAkC,EAClC,mGAAmG;QACjG,iFAAiF,CACpF,CAAA;AACH,CAAC;AAED,mGAAmG;AACnG;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO,OAAO,CAAC,kBAAkB,EAAE,mEAAmE,CAAC,CAAA;AACzG,CAAC;AAED,MAAM,UAAU,2BAA2B;IACzC,OAAO,OAAO,CACZ,wBAAwB,EACxB,kGAAkG;QAChG,iGAAiG;QACjG,mFAAmF,CACtF,CAAA;AACH,CAAC;AAED,MAAM,0BAA0B,GAAG;IACjC,oDAAoD;IACpD,oBAAoB;IACpB,+BAA+B;CAChC,CAAA;AACD,MAAM,uBAAuB,GAAG,CAAC,oCAAoC,CAAC,CAAA;AAEtE;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAiB,EAAE,IAAiB;IAC3E,MAAM,MAAM,GAAG,IAAI,KAAK,QAAQ,CAAA;IAChC,MAAM,KAAK,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,+CAA+C,IAAI,GAAG,CAAA;IAC9F,MAAM,WAAW,GAAG,CAAC,MAA0B,EAAE,OAAe,EAAE,aAAqB,EAAgB,EAAE,CACvG,OAAO,CACL,MAAM,EACN,GAAG,OAAO,oBAAoB;QAC5B,CAAC,MAAM;YACL,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;YACrB,CAAC,CAAC,IAAI,KAAK,QAAQ;gBACjB,CAAC,CAAC,uFAAuF;oBACvF,uDAAuD;gBACzD,CAAC,CAAC,IAAI,KAAK,sBAAsB;oBAC/B,CAAC,CAAC,iFAAiF;wBACjF,8DAA8D;oBAChE,CAAC,CAAC,wEAAwE,CAAC,EACnF,SAAS,EACT,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,6BAA6B,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CACxE,CAAA;IAEH,MAAM,QAAQ,GAAmB,EAAE,CAAA;IACnC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG;QAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,oBAAoB,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC,CAAA;IAClG,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,iBAAiB,EAAE,8BAA8B,EAAE,0BAA0B,CAAC,CAAC,CAAA;IAC3G,CAAC;IACD,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,8FAA8F;QAC9F,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,cAAc,CAAA;QAC5C,QAAQ,CAAC,IAAI,CACX,KAAK,CAAC,MAAM,CAAC,sBAAsB,IAAI,CAAC,QAAQ;YAC9C,CAAC,CAAC,2BAA2B,EAAE;YAC/B,CAAC,CAAC,OAAO,CACL,4BAA4B,EAC5B,CAAC,QAAQ;gBACP,CAAC,CAAC,qFAAqF;gBACvF,CAAC,CAAC,wFAAwF;oBACxF,qEAAqE,CAAC;gBACxE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,iDAAiD,CAAC,EACtF,SAAS,EACT,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAC7E,CACN,CAAA;IACH,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;QAC1C,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,yBAAyB,EACzB,gCAAgC;YAC9B,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,8CAA8C,CAAC,EAC1F,SAAS,EACT,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,uBAAuB,CACtC,CACF,CAAA;IACH,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/runtime/environment/linux-docker-facts.d.ts

@@ -0,0 +1,200 @@
+/**
+ * What `docker info` and the distribution's package database say about this machine's Docker
+ * install, read without running or changing anything.
+ *
+ * `docker info` alone cannot say *how* Docker got here: a `docker-ce` package and a `moby-engine`
+ * package expose the same daemon shape over the same socket. That distinction matters because the
+ * install plan must never lay `docker-ce` over a `moby-engine` or `docker.io` install (design D2:
+ * they conflict at the package-manager level) and must never touch a snap, rootless, Docker
+ * Desktop or Podman-shim install at all. So install-method detection also reads the package
+ * database (`dpkg-query`/`rpm -q`, both read-only queries) and `docker --version`'s own banner,
+ * which is all `podman-docker`'s `docker` shim actually prints differently.
+ *
+ * `docker info`'s own exit code cannot be trusted either: the CLI shipped in docker-ce/docker.io/
+ * moby-engine through roughly 28.2 (which is what Debian, Ubuntu and Fedora's recipe-qualified
+ * releases carry) still exits `0` and prints a fully-formed JSON document when the daemon call
+ * itself failed — `ServerErrors` holds the real error and every other field is the Go zero value
+ * (`""`/`0`/`null`). 28.3 and later exit non-zero instead. `parseDockerInfo` treats the former the
+ * same as the latter (task 2.4 fix round 2, item 1) — the alternative, trusting `code === 0`, was
+ * reading a `docker.io`/`moby-engine` host that plainly refused a connection as reachable, which
+ * broke both relogin detection and runtime-config planning downstream.
+ *
+ * The installed *engine version* (round 3, ruling 5) is a separate signal from any of the above: it
+ * comes from the package database alone (`dpkg-query`'s `${Version}` field, `rpm -q`'s own
+ * name-version-release string, or `pacman -Q docker`), so it is available even when the daemon
+ * cannot be reached at all. Since task 2.23 it is diagnostic only: whether the GPU reaches a
+ * container no longer depends on Docker's CDI-on-by-default version (see `cdiListsNvidiaGpu`).
+ *
+ * The GPU runtime counts as ready only when `nvidia-ctk cdi list` names an `nvidia.com/gpu` device
+ * (task 2.23, finding F-5, ruling R-core-8). Docker 28.2+ serves `--gpus` through CDI, so without a
+ * spec the card never reaches the container — even with a runtime named `nvidia` registered, which
+ * is what this probe used to accept (the 3.10 host: `nvidia-container-toolkit-base` only, `--gpus`
+ * failed with "unresolvable CDI devices"). An older Docker without CDI serves `--gpus` through the
+ * full toolkit's `nvidia-container-runtime-hook` instead; the recipe installs the full toolkit and
+ * generates the spec, so a host it set up passes on either path. A runtime named `nvidia` is still
+ * read (`nvidia_runtime`), but only to decide whether `nvidia-ctk runtime configure` is needed.
+ */
+import type { CommandOutput } from './linux-probe.js';
+import type { LinuxDockerInstallMethod } from '../../contracts/index.js';
+/**
+ * Parsed `docker info --format '{{json .}}'`, plus the signals `docker info` alone cannot settle
+ * (`rootless`, `desktop`) that feed into {@link detectDockerInstallMethod}.
+ */
+export interface DockerInfoFacts {
+    daemon_reachable: boolean;
+    engine_identity: string | null;
+    version: string | null;
+    /** `nvidia-ctk cdi list` names an `nvidia.com/gpu` device: `--gpus` can reach the card (F-5). */
+    gpu_runtime: boolean;
+    /** The daemon that answered loaded a runtime named `nvidia` (`Runtimes`). Not readiness on its own. */
+    nvidia_runtime: boolean;
+    /**
+     * `SecurityOptions` names `selinux`. Docker is enforcing for containers, so a mount of our own
+     * directories (model, engine cache, entrypoint, heartbeat) needs the shared `:z` label — never
+     * `:Z`, which would take exclusive ownership and break the next container of the same model
+     * (design D15).
+     */
+    selinux: boolean;
+    docker_root_dir: string | null;
+    containers_running: number;
+    /** `SecurityOptions` names `rootless` on the daemon that actually answered this query. */
+    rootless: boolean;
+    /** `Name`/`OperatingSystem` names Docker Desktop. */
+    desktop: boolean;
+    /**
+     * `ServerErrors`: partial failures (a plugin, a storage-driver problem) the daemon reports even
+     * though `info` itself returned successfully. Surfaced for diagnostics; a populated payload next
+     * to a real `ServerVersion` is still read as reachable — only an *empty* payload (round 2, item 1)
+     * is read as a failed call.
+     */
+    server_errors: string[];
+}
+/**
+ * `nvidia-ctk cdi list`: read-only, and the only way this probe confirms an NVIDIA CDI device actually
+ * exists — the one readiness signal for the GPU runtime (F-5). It reads the spec directories
+ * (`/etc/cdi`, `/var/run/cdi`) itself, so it answers whether or not the daemon does.
+ */
+export declare function cdiListsNvidiaGpu(cdiList: CommandOutput | null): boolean;
+/**
+ * Whether `/etc/docker/daemon.json`'s own `runtimes` map names `nvidia` — read-only evidence the
+ * GPU runtime is configured that does not require the daemon to answer at all, used when the system
+ * socket could not be reached (item 3: never plan a runtime reconfigure without real evidence).
+ *
+ * Three-way rather than boolean (round 2, item 6): a file that does not exist yet is a real fact
+ * ("not configured"), but one that exists and fails to parse is not — planning `nvidia-ctk runtime
+ * configure` against a daemon.json this probe cannot even read risks corrupting it further, so that
+ * case is surfaced separately as `'unreadable'` and `assessLinux` blocks instead of guessing.
+ *
+ * `read` distinguishes the file genuinely not existing (`{ text: null, unreadable: false }`, e.g.
+ * `readFile` resolving `null` for `ENOENT`) from a real read failure such as `EACCES` on a `0600`
+ * file (`{ text: null, unreadable: true }`, e.g. `readFile` rejecting) — round 3, item 2: a caller
+ * that collapsed both into `null` would read "permission denied" as "nothing configured yet" and
+ * plan a runtime reconfigure against a file it was never able to look at in the first place.
+ */
+export type DaemonJsonEvidence = 'configured' | 'not-configured' | 'unreadable';
+export declare function daemonJsonNvidiaRuntimeEvidence(read: {
+    text: string | null;
+    unreadable: boolean;
+}): DaemonJsonEvidence;
+/** `dpkg-query -W -f '${db:Status-Abbrev} ${Package} ${Version}\n' <candidates>`'s third column, for
+ *  whichever recognised engine package is `ii` (installed). */
+export declare function dpkgEngineVersion(output: CommandOutput | null): string | null;
+/** `rpm -q <candidates>`'s name-version-release line for whichever recognised engine package hit. */
+export declare function rpmEngineVersion(output: CommandOutput | null): string | null;
+/**
+ * `pacman -Q docker docker-desktop`: a `name version` line on stdout per installed name (`docker
+ * 1:28.3.3-1`, with Arch's epoch), an `error: package '...' was not found` line on stderr per
+ * missing one, and exit `1` whenever any name is missing — so the exit code says nothing about
+ * whether `docker` itself is installed; only stdout does (round 4, item E).
+ */
+export declare function pacmanEngineVersion(output: CommandOutput | null): string | null;
+/** The first engine version any of the three package managers can confirm, or null (round 3, ruling 5). */
+export declare function detectEngineVersion(dpkgQuery: CommandOutput | null, rpmQuery: CommandOutput | null, pacmanQuery: CommandOutput | null): string | null;
+/**
+ * `docker -H unix:///var/run/docker.sock info --format '{{json .}}'`. The `-H` flag pins the
+ * query to the system socket under the current user and overrides both `DOCKER_HOST` and an
+ * active `DOCKER_CONTEXT`, so this reads the same daemon a `docker` group member would reach —
+ * never a user's own rootless daemon or a context pointed elsewhere (spec: "Доступ к Docker MUST
+ * определяться фактическим вызовом daemon по системному сокету... а не пользовательским Docker
+ * context").
+ *
+ * `cdiList` is {@link cdiListsNvidiaGpu}'s source command.
+ */
+export declare function parseDockerInfo(output: CommandOutput | null, cdiList: CommandOutput | null): DockerInfoFacts;
+/**
+ * `dpkg-query -W -f '${db:Status-Abbrev} ${Package} ${Version}\n' <candidates>`: one line per
+ * package dpkg has ever heard of, prefixed with its status (`ii` installed, `rc` removed with
+ * config left behind, `un` unknown/never installed, ...). Only `ii` counts as actually installed —
+ * `-W` alone (without the status prefix) would also print a `rc` package's name, which is exactly a
+ * package that `apt remove` (not `purge`) took out, and treating that as present would leave a
+ * stale install undetected. A package dpkg has never heard of at all prints nothing to stdout (and
+ * "no packages found matching ..." to stderr instead), which this simply never matches. The
+ * trailing `${Version}` column (round 3, ruling 5) is read by {@link dpkgEngineVersion}; this
+ * function only ever reads the first two.
+ */
+export declare function installedDpkgPackages(output: CommandOutput | null, candidates: string[]): string[];
+/**
+ * `rpm -q <candidates>`: a hit prints the full name-version-release (`docker-ce-3:28.3.0-1.fc41...`)
+ * on its own line; a miss prints `package <name> is not installed` (to stdout, with a non-zero exit
+ * code this parser does not need to check), which this only has to avoid matching.
+ */
+export declare function installedRpmPackages(output: CommandOutput | null, candidates: string[]): string[];
+/**
+ * `pacman -Q <candidates>`: one `name version` line on stdout per installed name; a missing name
+ * only adds an error line on stderr (and makes the exit code 1, whatever else was found).
+ */
+export declare function installedPacmanPackages(output: CommandOutput | null, candidates: string[]): string[];
+/** The package the recipe installs, and the only one that counts as the toolkit (F-5). */
+export declare const TOOLKIT_PACKAGE = "nvidia-container-toolkit";
+/**
+ * Whether the full NVIDIA Container Toolkit is installed — the `nvidia-container-toolkit` package,
+ * not `nvidia-container-toolkit-base` alone (F-5). `-base` ships `nvidia-ctk` and
+ * `nvidia-container-runtime`, so `nvidia-ctk --version` answers either way; the package database is
+ * what tells them apart. `query` is the family's own single-package query (`dpkg-query -W -f
+ * '${db:Status-Abbrev} ${Package}\n' nvidia-container-toolkit`, `rpm -q nvidia-container-toolkit` or
+ * `pacman -Q nvidia-container-toolkit`), or null on a family without one, where the CLI answering is
+ * all there is to go by.
+ */
+export declare function fullToolkitInstalled(family: 'apt' | 'dnf' | 'pacman' | 'other' | null, ctkVersion: CommandOutput, query: CommandOutput | null): boolean;
+/** Arch's own engine package, and Docker Desktop's package on Arch (round 4, item E). */
+export declare const PACMAN_PACKAGE_CANDIDATES: string[];
+/** The read-only lookups {@link detectDockerInstallMethod} needs beyond `docker info` itself. */
+export interface DockerPackageSignals {
+    /** `docker --version`: podman-docker's shim prints Podman's own banner here, not Docker's. */
+    dockerVersion: CommandOutput | null;
+    dpkgQuery: CommandOutput | null;
+    rpmQuery: CommandOutput | null;
+    /** `pacman -Q docker docker-desktop` (round 4, item E). */
+    pacmanQuery: CommandOutput | null;
+    /** `snap list docker`. */
+    snapList: CommandOutput | null;
+}
+/** `docker-desktop` is Docker Desktop for Linux's own `.deb`/`.rpm` package name (item 5). */
+export declare const DOCKER_PACKAGE_CANDIDATES: string[];
+/**
+ * How Docker got onto this machine, or null when none of the signals recognise an install.
+ *
+ * Order matters: a `podman-docker` shim or a snap package is decided before anything from `docker
+ * info` (their `docker` command may not even resolve to a real Engine, so `info`'s own answer is
+ * not trusted over the package database for these).
+ *
+ * Desktop is decided next, but only two ways (round 2, item 4 — the previous order blocked a
+ * working Desktop+Engine host that also happened to have the `docker-desktop` package installed
+ * alongside a real, reachable `docker-ce`): `info.desktop` when the daemon that actually answered
+ * says so directly, or the `docker-desktop` package **only when the system socket did not answer at
+ * all and no recognised engine package is also present** — a reachable `docker-ce`/`moby-engine`/
+ * `docker.io` always wins over a Desktop package that merely happens to be installed alongside it.
+ *
+ * `rootlessSocketPresent` (a leftover `$XDG_RUNTIME_DIR/docker.sock`) only counts when the system
+ * socket itself did not answer *and* `docker.service` is not active either (round 2, item 8) — a
+ * working rootful engine, or one that is simply unreachable for some other reason while the service
+ * is confirmed running, takes priority over a stray rootless socket file from an earlier, abandoned
+ * setup.
+ *
+ * Arch's own `docker` package never becomes an install method here (it is not a
+ * `LinuxDockerInstallMethod`; `assessLinux` recognises it through `distribution.family === 'pacman'
+ * && docker.cli` instead, round 3 item 1). It does count as an installed engine for the Desktop rule
+ * above, and `pacman -Q docker-desktop` counts as the Desktop package, so a Desktop-only Arch host is
+ * read as Docker Desktop, not as an unrecognised install (round 4, item E).
+ */
+export declare function detectDockerInstallMethod(info: DockerInfoFacts, packages: DockerPackageSignals, rootlessSocketPresent: boolean, serviceActive: boolean | 'unknown'): LinuxDockerInstallMethod | null;