@cyanautomation/kaseki-agent 1.4.1

package/src/docker/DockerManager.ts

@@ -0,0 +1,319 @@
+/**
+ * Docker Manager
+ * 
+ * Handles Docker operations: image pulling, container spawning, log streaming
+ */
+
+import { execSync, spawn } from 'child_process';
+import { createLogger } from '../logger';
+
+const logger = createLogger('docker');
+
+export interface ContainerConfig {
+  image: string;
+  name: string;
+  workspaceDir: string;
+  resultsDir: string;
+  cacheDir?: string;
+  apiKeyFile?: string;
+  environment: Record<string, string>;
+  timeout?: number; // in seconds
+  entrypoint?: string;
+  command?: string[];
+}
+
+export interface ContainerResult {
+  exitCode: number;
+  stdout: string;
+  stderr: string;
+}
+
+export class DockerManager {
+  /**
+   * Check if Docker is available and daemon is running
+   */
+  static isDockerAvailable(): boolean {
+    try {
+      execSync('docker ps > /dev/null 2>&1', { shell: '/bin/bash' });
+      return true;
+    } catch {
+      return false;
+    }
+  }
+
+  /**
+   * Pull Docker image (with retry logic)
+   */
+  static pullImage(image: string, maxRetries: number = 3): boolean {
+    logger.info(`Pulling Docker image: ${image}`);
+
+    for (let attempt = 1; attempt <= maxRetries; attempt++) {
+      try {
+        execSync(`docker pull ${image}`, {
+          stdio: 'inherit',
+          timeout: 5 * 60 * 1000, // 5 minute timeout
+        });
+        logger.info(`Successfully pulled image: ${image}`);
+        return true;
+      } catch (error) {
+        if (attempt < maxRetries) {
+          logger.warn(`Pull attempt ${attempt} failed. Retrying...`);
+        } else {
+          logger.error(`Failed to pull image after ${maxRetries} attempts: ${error}`);
+          return false;
+        }
+      }
+    }
+
+    return false;
+  }
+
+  /**
+   * Check if Docker image exists locally
+   */
+  static imageExists(image: string): boolean {
+    try {
+      execSync(`docker inspect ${image} > /dev/null 2>&1`, { shell: '/bin/bash' });
+      return true;
+    } catch {
+      return false;
+    }
+  }
+
+  /**
+   * Get Docker image ID
+   */
+  static getImageId(image: string): string | null {
+    try {
+      const id = execSync(`docker inspect -f '{{.ID}}' ${image}`, {
+        encoding: 'utf-8',
+      }).trim();
+      return id || null;
+    } catch {
+      return null;
+    }
+  }
+
+  /**
+   * Run Docker container and stream output
+   */
+  static async runContainer(config: ContainerConfig): Promise<ContainerResult> {
+    logger.debug(`Running container: ${config.name}`);
+
+    // Ensure directories exist
+    this.ensureDirectories(config.workspaceDir, config.resultsDir, config.cacheDir);
+
+    // Build Docker run command
+    const dockerArgs = this.buildDockerArgs(config);
+
+    logger.debug(`Docker command: docker run ${dockerArgs.join(' ')}`);
+
+    return new Promise((resolve) => {
+      let stdout = '';
+      let stderr = '';
+
+      const child = spawn('docker', ['run', ...dockerArgs], {
+        stdio: ['ignore', 'pipe', 'pipe'],
+        timeout: (config.timeout || 1200) * 1000,
+      });
+
+      // Collect stdout
+      if (child.stdout) {
+        child.stdout.on('data', (data: Buffer) => {
+          const text = data.toString();
+          stdout += text;
+          // Also stream to console for real-time feedback
+          process.stdout.write(text);
+        });
+      }
+
+      // Collect stderr
+      if (child.stderr) {
+        child.stderr.on('data', (data: Buffer) => {
+          const text = data.toString();
+          stderr += text;
+          process.stderr.write(text);
+        });
+      }
+
+      // Handle completion
+      child.on('exit', (code: number | null) => {
+        resolve({
+          exitCode: code ?? 1,
+          stdout,
+          stderr,
+        });
+      });
+
+      // Handle errors
+      child.on('error', (error: Error) => {
+        logger.error(`Failed to spawn docker: ${error.message}`);
+        resolve({
+          exitCode: 1,
+          stdout,
+          stderr: error.message,
+        });
+      });
+
+      // Handle timeout
+      child.on('timeout', () => {
+        logger.warn(`Container timeout after ${config.timeout} seconds`);
+        child.kill('SIGTERM');
+        resolve({
+          exitCode: 124,
+          stdout,
+          stderr: `Container timeout after ${config.timeout} seconds`,
+        });
+      });
+    });
+  }
+
+  /**
+   * Build Docker run arguments
+   */
+  private static buildDockerArgs(config: ContainerConfig): string[] {
+    const args: string[] = [];
+
+    // Container name
+    args.push('--name', config.name);
+
+    // Security flags (from run-kaseki.sh)
+    args.push('--read-only');
+    args.push('--cap-drop=ALL');
+    args.push('--security-opt', 'no-new-privileges:true');
+    args.push('-u', '10001:10001');
+
+    // Temporary filesystems for writable areas
+    args.push('--tmpfs', '/tmp:rw,nosuid,nodev,noexec');
+    args.push('--tmpfs', '/var/tmp:rw,nosuid,nodev,noexec');
+    args.push('--tmpfs', '/run:rw,nosuid,nodev,noexec');
+
+    // Mount workspace (rw for agent to clone repo)
+    args.push('-v', `${config.workspaceDir}:/workspace:rw`);
+
+    // Mount results (rw for writing outputs)
+    args.push('-v', `${config.resultsDir}:/results:rw`);
+
+    // Mount cache if provided
+    if (config.cacheDir) {
+      args.push('-v', `${config.cacheDir}:/cache:rw`);
+    }
+
+    // Mount API key file (ro for security)
+    if (config.apiKeyFile) {
+      args.push('-v', `${config.apiKeyFile}:/run/secrets/openrouter_api_key:ro`);
+    }
+
+    // Set environment variables (never pass API key via env)
+    for (const [key, value] of Object.entries(config.environment)) {
+      if (key !== 'OPENROUTER_API_KEY') {
+        // Skip inline API key
+        args.push('-e', `${key}=${value}`);
+      }
+    }
+
+    // Set entrypoint if provided
+    if (config.entrypoint) {
+      args.push('--entrypoint', config.entrypoint);
+    }
+
+    // Image
+    args.push(config.image);
+
+    // Command and arguments
+    if (config.command) {
+      args.push(...config.command);
+    }
+
+    return args;
+  }
+
+  /**
+   * Ensure required directories exist with correct permissions
+   */
+  private static ensureDirectories(
+    workspaceDir: string,
+    resultsDir: string,
+    cacheDir?: string
+  ): void {
+    const dirs = [workspaceDir, resultsDir];
+    if (cacheDir) {
+      dirs.push(cacheDir);
+    }
+
+    for (const dir of dirs) {
+      try {
+        execSync(`mkdir -p "${dir}"`, { shell: '/bin/bash' });
+        logger.debug(`Created/verified directory: ${dir}`);
+      } catch (error) {
+        throw new Error(`Failed to create directory ${dir}: ${error}`);
+      }
+    }
+  }
+
+  /**
+   * Stop a running container
+   */
+  static stopContainer(containerId: string, timeout: number = 10): boolean {
+    try {
+      execSync(`docker stop -t ${timeout} ${containerId}`, { stdio: 'ignore' });
+      logger.debug(`Stopped container: ${containerId}`);
+      return true;
+    } catch {
+      logger.warn(`Failed to stop container: ${containerId}`);
+      return false;
+    }
+  }
+
+  /**
+   * Remove a container
+   */
+  static removeContainer(containerId: string, force: boolean = true): boolean {
+    try {
+      const args = ['rm'];
+      if (force) args.push('-f');
+      args.push(containerId);
+      execSync(`docker ${args.join(' ')}`, { stdio: 'ignore' });
+      logger.debug(`Removed container: ${containerId}`);
+      return true;
+    } catch {
+      logger.warn(`Failed to remove container: ${containerId}`);
+      return false;
+    }
+  }
+
+  /**
+   * List running containers matching a pattern
+   */
+  static listContainers(pattern: string = 'kaseki'): string[] {
+    try {
+      const output = execSync(
+        `docker ps --filter "name=${pattern}" --format "{{.Names}}"`,
+        { encoding: 'utf-8' }
+      );
+      return output
+        .split('\n')
+        .filter((name) => name.trim())
+        .map((name) => name.trim());
+    } catch {
+      return [];
+    }
+  }
+
+  /**
+   * Get container logs
+   */
+  static getContainerLogs(containerId: string, tail?: number): string {
+    try {
+      const args = ['logs'];
+      if (tail) {
+        args.push(`--tail=${tail}`);
+      }
+      args.push(containerId);
+
+      return execSync(`docker ${args.join(' ')}`, { encoding: 'utf-8' });
+    } catch {
+      return '';
+    }
+  }
+}

package/src/docker-entrypoint-packaging.test.ts

@@ -0,0 +1,33 @@
+import * as fs from 'fs';
+import * as path from 'path';
+
+const repoRoot = path.resolve(__dirname, '..');
+
+describe('Docker runtime packaging', () => {
+  test('worker can resolve allowlist helper from the /app fallback path', () => {
+    const script = fs.readFileSync(path.join(repoRoot, 'kaseki-agent.sh'), 'utf-8');
+    expect(script).toContain('ALLOWLIST_HELPER="$SCRIPT_DIR/scripts/allowlist-helper.sh"');
+    expect(script).toContain('[ -r /app/scripts/allowlist-helper.sh ]');
+    expect(script).toContain('ALLOWLIST_HELPER="/app/scripts/allowlist-helper.sh"');
+  });
+
+  test('image entrypoint dispatches api and explicit commands without replacing entrypoint', () => {
+    const dockerfile = fs.readFileSync(path.join(repoRoot, 'Dockerfile'), 'utf-8');
+    const entrypoint = fs.readFileSync(path.join(repoRoot, 'scripts/docker-entrypoint.sh'), 'utf-8');
+
+    expect(dockerfile).toContain('ENTRYPOINT ["/usr/local/bin/kaseki-entrypoint"]');
+    expect(dockerfile).toContain('CMD ["agent"]');
+    expect(entrypoint).toContain('api|kaseki-api)');
+    expect(entrypoint).toContain('exec node /app/dist/kaseki-api-service.js');
+    expect(entrypoint).toContain('exec "$@"');
+  });
+
+  test('template deployment preserves the configured image ref and records digest separately', () => {
+    const deployScript = fs.readFileSync(path.join(repoRoot, 'scripts/deploy-pi-template.sh'), 'utf-8');
+
+    expect(deployScript).toContain('REQUESTED_IMAGE="${KASEKI_IMAGE:-docker.io/cyanautomation/kaseki-agent:latest}"');
+    expect(deployScript).toContain('printf \'%s\\n\' "$configured_image" > "$target/.kaseki-image"');
+    expect(deployScript).toContain('docker image inspect "$deployed_image" --format');
+    expect(deployScript).not.toContain('IMAGE="$resolved_digest"');
+  });
+});

package/src/event-aggregator.test.ts

@@ -0,0 +1,117 @@
+import { EventCounterAggregator } from './event-aggregator';
+
+describe('EventCounterAggregator', () => {
+  it('should record event types and increment counts', () => {
+    const aggregator = new EventCounterAggregator();
+    aggregator.recordEventType('assistant_message');
+    aggregator.recordEventType('assistant_message');
+    aggregator.recordEventType('thinking_start');
+
+    const summary = aggregator.summary();
+    expect(summary.event_counts['assistant_message']).toBe(2);
+    expect(summary.event_counts['thinking_start']).toBe(1);
+  });
+
+  it('should handle missing event types by using <missing> placeholder', () => {
+    const aggregator = new EventCounterAggregator();
+    aggregator.recordEventType(undefined);
+    aggregator.recordEventType(undefined);
+
+    const summary = aggregator.summary();
+    expect(summary.event_counts['<missing>']).toBe(2);
+  });
+
+  it('should cap cardinality at 1000 keys and fold into __other__', () => {
+    const aggregator = new EventCounterAggregator();
+
+    // Add 1001 unique event types
+    for (let i = 0; i < 1001; i++) {
+      aggregator.recordEventType(`event_${i}`);
+    }
+
+    const summary = aggregator.summary();
+    const uniqueKeys = Object.keys(summary.event_counts).filter((k) => k !== '__other__');
+
+    // Should have at most 1000 unique keys (plus __other__)
+    expect(uniqueKeys.length).toBe(1000);
+    expect(summary.event_counts['__other__']).toBe(1);
+  });
+
+  it('should record model and API observations', () => {
+    const aggregator = new EventCounterAggregator();
+    aggregator.recordModelAndApi({ model: 'claude-3-opus', api: 'openrouter' });
+    aggregator.recordModelAndApi({ model: 'claude-3-opus', api: 'openrouter' });
+    aggregator.recordModelAndApi({ model: 'gpt-4', api: 'openai' });
+
+    const summary = aggregator.summary();
+    expect(summary.selected_model).toBe('claude-3-opus');
+    expect(summary.selected_api).toBe('openrouter');
+  });
+
+  it.each([
+    ['empty object', {}],
+    ['null', null],
+    ['undefined', undefined],
+    ['empty string', ''],
+    ['non-object string', 'not an object'],
+    ['number', 42],
+  ])(
+    'should ignore %s model/API observations',
+    (_description, invalidObservation) => {
+      const emptyAggregator = new EventCounterAggregator();
+      emptyAggregator.recordModelAndApi(invalidObservation);
+
+      const emptySummary = emptyAggregator.summary();
+      expect(emptySummary.selected_model).toBe('');
+      expect(emptySummary.selected_api).toBe('');
+
+      const aggregator = new EventCounterAggregator();
+      aggregator.recordModelAndApi({ model: 'claude-3-opus', api: 'openrouter' });
+      aggregator.recordModelAndApi(invalidObservation);
+
+      const summary = aggregator.summary();
+      expect(summary.selected_model).toBe('claude-3-opus');
+      expect(summary.selected_api).toBe('openrouter');
+    }
+  );
+
+  it('should track assistant event types separately', () => {
+    const aggregator = new EventCounterAggregator();
+    aggregator.recordAssistantEventType('assistant_message');
+    aggregator.recordAssistantEventType('thinking');
+    aggregator.recordAssistantEventType('thinking');
+
+    const summary = aggregator.summary();
+    expect(summary.assistant_event_counts['assistant_message']).toBe(1);
+    expect(summary.assistant_event_counts['thinking']).toBe(2);
+  });
+
+  it('should count tool start and end events', () => {
+    const aggregator = new EventCounterAggregator();
+    aggregator.recordToolStart();
+    aggregator.recordToolStart();
+    aggregator.recordToolEnd();
+    aggregator.recordToolEnd();
+    aggregator.recordToolEnd();
+
+    const summary = aggregator.summary();
+    expect(summary.tool_start_count).toBe(2);
+    expect(summary.tool_end_count).toBe(3);
+  });
+
+  it('should select top model/api by frequency', () => {
+    const aggregator = new EventCounterAggregator();
+
+    // Model A more frequent
+    aggregator.recordModelAndApi({ model: 'model-a', api: 'api-a' });
+    aggregator.recordModelAndApi({ model: 'model-a', api: 'api-a' });
+    aggregator.recordModelAndApi({ model: 'model-a', api: 'api-b' });
+    aggregator.recordModelAndApi({ model: 'model-b', api: 'api-a' });
+
+    const summary = aggregator.summary();
+    expect(summary.selected_model).toBe('model-a');
+    // api-a has count 3 (appears with model-a twice and model-b once)
+    expect(summary.selected_api).toBe('api-a');
+  });
+
+});

package/src/event-aggregator.ts

@@ -0,0 +1,126 @@
+/**
+ * event-aggregator.ts
+ *
+ * Encapsulates counter aggregation logic for Pi event stream processing.
+ * Tracks event types, models, APIs, tool executions, and assistant message types
+ * with bounded cardinality (1000 keys per counter).
+ */
+
+const MAX_DISTINCT_SUMMARY_KEYS = 1000;
+const OTHER_BUCKET_KEY = '__other__';
+
+export interface EventCountMap {
+  [key: string]: number;
+}
+
+export interface AggregatorSummary {
+  selected_model: string;
+  selected_api: string;
+  event_counts: EventCountMap;
+  assistant_event_counts: EventCountMap;
+  tool_start_count: number;
+  tool_end_count: number;
+}
+
+/**
+ * EventCounterAggregator manages counter maps for event stream aggregation.
+ *
+ * Responsibilities:
+ * - Track event type counts with cardinality cap
+ * - Track assistant message type counts
+ * - Observe and count models and APIs
+ * - Track tool execution start/end events
+ * - Provide summarized output with top model/API selected
+ */
+export class EventCounterAggregator {
+  private eventCounts: EventCountMap = {};
+  private assistantEventCounts: EventCountMap = {};
+  private models: EventCountMap = {};
+  private apis: EventCountMap = {};
+  private toolStartCount = 0;
+  private toolEndCount = 0;
+
+  /**
+   * Increment a counter in a map with cardinality cap.
+   * Once a map reaches MAX_DISTINCT_SUMMARY_KEYS entries, new unseen keys
+   * are folded into the "__other__" bucket.
+   */
+  private incrementMap(
+    map: EventCountMap,
+    key: string | undefined,
+    maxDistinctKeys: number = MAX_DISTINCT_SUMMARY_KEYS
+  ): void {
+    if (!key) return;
+
+    let targetKey = key;
+    if (
+      map[key] === undefined &&
+      Object.keys(map).filter((k) => k !== OTHER_BUCKET_KEY).length >= maxDistinctKeys
+    ) {
+      targetKey = OTHER_BUCKET_KEY;
+    }
+    map[targetKey] = (map[targetKey] ?? 0) + 1;
+  }
+
+  /**
+   * Record an event type observation.
+   */
+  recordEventType(eventType: string | undefined): void {
+    this.incrementMap(this.eventCounts, eventType ?? '<missing>', MAX_DISTINCT_SUMMARY_KEYS);
+  }
+
+  /**
+   * Record an assistant message type observation.
+   */
+  recordAssistantEventType(assistantType: string | undefined): void {
+    this.incrementMap(
+      this.assistantEventCounts,
+      assistantType,
+      MAX_DISTINCT_SUMMARY_KEYS
+    );
+  }
+
+  /**
+   * Record model and API observations from a message object.
+   */
+  recordModelAndApi(message: any): void {
+    if (!message || typeof message !== 'object') return;
+    this.incrementMap(this.models, message.model, MAX_DISTINCT_SUMMARY_KEYS);
+    this.incrementMap(this.apis, message.api, MAX_DISTINCT_SUMMARY_KEYS);
+  }
+
+  /**
+   * Record a tool execution start event.
+   */
+  recordToolStart(): void {
+    this.toolStartCount++;
+  }
+
+  /**
+   * Record a tool execution end event.
+   */
+  recordToolEnd(): void {
+    this.toolEndCount++;
+  }
+
+  /**
+   * Get the top model by frequency.
+   */
+  private topByFrequency(map: EventCountMap): string {
+    return Object.entries(map).sort((a, b) => b[1] - a[1])[0]?.[0] ?? '';
+  }
+
+  /**
+   * Generate summary with selected model/API and all counters.
+   */
+  summary(): AggregatorSummary {
+    return {
+      selected_model: this.topByFrequency(this.models),
+      selected_api: this.topByFrequency(this.apis),
+      event_counts: this.eventCounts,
+      assistant_event_counts: this.assistantEventCounts,
+      tool_start_count: this.toolStartCount,
+      tool_end_count: this.toolEndCount,
+    };
+  }
+}