@kici-dev/orchestrator 0.18.0 → 0.20.0

package/dist/cli.js

@@ -15246,19 +15246,60 @@ function writeInstallManifest(instanceDir, fresh, launch, opts = {}) {
 function resolveNpmInstallTarget(spec, component, opts) {
 	const entryRe = new RegExp(`[/\\\\]@kici-dev[/\\\\]${component}[/\\\\]dist[/\\\\](?:server|standalone)\\.js$`);
 	const entry = [spec.execPath, ...spec.args].find((a) => entryRe.test(a));
-	if (!entry) return null;
+	if (!entry) return {
+		ok: false,
+		reason: "no-entry"
+	};
 	const owningPackage = firstGlobalPackage(entry);
-	if (!owningPackage) return null;
+	if (!owningPackage) return {
+		ok: false,
+		reason: "no-entry"
+	};
 	const p = opts.windows ? path.win32 : path.posix;
-	const npmBin = opts.windows ? "npm.cmd" : "npm";
-	const npmPath = p.join(p.dirname(spec.execPath), npmBin);
+	const globalPrefix = globalPrefixOf(entry, opts.windows);
+	if (!globalPrefix) return {
+		ok: false,
+		reason: "not-global",
+		entry
+	};
+	const nodeDir = p.dirname(spec.execPath);
+	const npmPath = p.join(nodeDir, opts.windows ? "npm.cmd" : "npm");
+	const npmCliJs = opts.windows ? p.join(nodeDir, "node_modules", "npm", "bin", "npm-cli.js") : p.join(nodeDir, "..", "lib", "node_modules", "npm", "bin", "npm-cli.js");
+	const npmInvocation = (opts.exists ?? fs.existsSync)(npmCliJs) ? {
+		cmd: spec.execPath,
+		preArgs: [npmCliJs]
+	} : {
+		cmd: npmPath,
+		preArgs: []
+	};
 	return {
-		nodeExecPath: spec.execPath,
-		npmPath,
-		owningPackage
+		ok: true,
+		target: {
+			nodeExecPath: spec.execPath,
+			npmPath,
+			owningPackage,
+			globalPrefix,
+			npmInvocation
+		}
 	};
 }
 /**
+* The npm global prefix holding `entry`, split on its FIRST `node_modules`
+* segment like {@link firstGlobalPackage}. Windows lays a global install out as
+* `<prefix>\node_modules\<pkg>`; posix as `<prefix>/lib/node_modules/<pkg>`, so
+* there the segment before must be `lib`, which tells a global install from a
+* local `node_modules` tree. Null for anything else.
+*/
+function globalPrefixOf(entry, windows) {
+	const p = windows ? path.win32 : path.posix;
+	const segments = entry.split(/[/\\]/);
+	const idx = segments.indexOf("node_modules");
+	if (idx < 1) return null;
+	if (windows) return segments.slice(0, idx).join(p.sep) || null;
+	if (idx < 2 || segments[idx - 1] !== "lib") return null;
+	return segments.slice(0, idx - 1).join(p.sep) || p.sep;
+}
+/**
 * The package under the FIRST `node_modules` segment (the global root), which
 * `npm install -g` must target; `@scope/name` keeps both segments. Null
 * without a `node_modules` segment.
@@ -22300,6 +22341,25 @@ function encryptPrivateKey(privateKey, secretKey) {
 	return encrypt(privateKey.toString("base64"), key, 1, PRIVATE_KEY_AAD).data;
 }
 createLogger({ prefix: "job-secret-seal" });
+//#endregion
+//#region src/agent/agent-version.ts
+/**
+* Parse `MAJOR.MINOR.PATCH`, or `null` for a non-version. The `-prerelease`
+* suffix is dropped rather than ordered: it is a build counter (`0.5.0-9159`),
+* and strict semver would order it BELOW `0.5.0`, reading every prerelease
+* agent as too old for a feature it carries.
+*/
+function parseVersionBase(version) {
+	const parts = version.trim().split("-")[0].split(".");
+	if (parts.length !== 3) return null;
+	const nums = parts.map((part) => /^\d+$/.test(part) ? Number(part) : NaN);
+	if (nums.some((n) => Number.isNaN(n))) return null;
+	return [
+		nums[0],
+		nums[1],
+		nums[2]
+	];
+}
 runtimeLabel(RuntimeFact.enum.docker), runtimeLabel(RuntimeFact.enum.podman);
 //#endregion
 //#region src/helpers/run-detached.ts
@@ -24091,6 +24151,117 @@ async function preflightBareMetalBinaryPaths(args) {
 Nothing was installed and the service was not restarted. Fix binaryPath and run the upgrade again, or pass ${SKIP_BINARY_PATH_CHECK_FLAG} to upgrade anyway.`);
 }
 //#endregion
+//#region src/cli/commands/shared/container-agent-image-check.ts
+/**
+* The container-scaler agent image check `kici-admin orchestrator upgrade`
+* runs before it restarts the service.
+*
+* A container scaler spawns each agent from the image its label set names, not
+* from the upgraded orchestrator. So an upgrade leaves container agents on the
+* old release when a label set pins an older `kici-agent:<version>`, or names
+* the moving `:latest` tag with the default `imagePullPolicy: IfNotPresent`: a
+* host that already pulled `:latest` keeps that image. The check only warns:
+* it never rewrites the operator's scaler config and never stops the upgrade.
+*/
+/** The repository name of the published agent image, under any registry or mirror. */
+const AGENT_IMAGE_NAME = "kici-agent";
+/** The moving tag an untagged image reference resolves to. */
+const LATEST_TAG = "latest";
+/**
+* Split `[registry/]path/name[:tag][@digest]`. A `:` before the last `/` is a
+* registry port, not a tag.
+*/
+function parseImageRef(image) {
+	const at = image.indexOf("@");
+	const named = at === -1 ? image : image.slice(0, at);
+	const digest = at === -1 ? null : image.slice(at + 1);
+	const colon = named.lastIndexOf(":");
+	if (colon > named.lastIndexOf("/")) return {
+		repository: named.slice(0, colon),
+		tag: named.slice(colon + 1),
+		digest
+	};
+	return {
+		repository: named,
+		tag: null,
+		digest
+	};
+}
+/** True when the repository is the KiCI agent image, from quay.io or a mirror. */
+function isAgentImage(repository) {
+	return repository.slice(repository.lastIndexOf("/") + 1) === AGENT_IMAGE_NAME;
+}
+/** -1, 0 or 1 as `a` is an older, the same or a newer release than `b`; null for a non-version. */
+function compareReleases(a, b) {
+	const left = parseVersionBase(a.replace(/^v/, ""));
+	const right = parseVersionBase(b.replace(/^v/, ""));
+	if (!left || !right) return null;
+	for (let i = 0; i < 3; i++) if (left[i] !== right[i]) return left[i] < right[i] ? -1 : 1;
+	return 0;
+}
+/**
+* Every container-scaler label set whose agent image an upgrade to
+* `targetVersion` leaves unchanged. An empty result means each agent image is
+* pinned to the target (or newer), pulled on every spawn, or not a KiCI agent.
+*/
+function checkContainerAgentImages(args) {
+	const { config } = args;
+	const bare = args.targetVersion?.trim().replace(/^v/, "") ?? null;
+	const targetVersion = bare && parseVersionBase(bare) ? bare : null;
+	const where = args.scalerConfigDir ? `${args.scalerConfigPath} (or the file under ${args.scalerConfigDir} that declares it)` : args.scalerConfigPath;
+	const findings = [];
+	for (const entry of config.scalers) {
+		if (entry.type !== ScalerBackendType.enum.container) continue;
+		for (const ls of entry.labelSets) {
+			if (!ls.image) continue;
+			const ref = parseImageRef(ls.image);
+			if (!isAgentImage(ref.repository)) continue;
+			const pinned = targetVersion ? `${ref.repository}:${targetVersion}` : null;
+			const prefix = `container scaler "${entry.name}", label set [${ls.labels.join(", ")}]: image ${ls.image}`;
+			const finding = (issue, message) => ({
+				issue,
+				scaler: entry.name,
+				labels: ls.labels,
+				image: ls.image,
+				message: `${prefix} ${message}`
+			});
+			const policy = ls.imagePullPolicy ?? ImagePullPolicy.enum.IfNotPresent;
+			if ((ref.tag === null || ref.tag === LATEST_TAG) && ref.digest === null && policy === ImagePullPolicy.enum.IfNotPresent) {
+				const pin = pinned ? `set "image: ${pinned}"` : `set image to the kici-agent release you upgrade to (${ref.repository}:<version>)`;
+				findings.push(finding("moving-tag", `with imagePullPolicy IfNotPresent keeps the agent image this host already pulled, so the upgrade does not change the container agents. In ${where}, ${pin} on this label set, or set "imagePullPolicy: Always" to pull ${LATEST_TAG} on every spawn.`));
+				continue;
+			}
+			if (!targetVersion || ref.tag === null) continue;
+			if (compareReleases(ref.tag, targetVersion) === -1) findings.push(finding("older-pin", `is older than the upgrade target ${targetVersion}, so the container agents keep running ${ref.tag}. In ${where}, set "image: ${pinned}" on this label set.`));
+		}
+	}
+	return findings;
+}
+/**
+* Print one warning per container label set whose agent image the upgrade
+* leaves unchanged. Never throws, and stays silent when the env file or the
+* scaler config cannot be read: the bare-metal `binaryPath` check, which runs
+* first on the same files, already reports that.
+*/
+async function warnAboutContainerAgentImages(args) {
+	let location;
+	let config;
+	try {
+		location = scalerConfigLocation(fs.readFileSync(args.envFilePath, "utf-8"), args.workingDirectory);
+		if (!location) return;
+		config = await loadScalerConfig(location.configPath, location.configDir);
+	} catch {
+		return;
+	}
+	const findings = checkContainerAgentImages({
+		config,
+		targetVersion: args.targetVersion,
+		scalerConfigPath: location.configPath,
+		...location.configDir ? { scalerConfigDir: location.configDir } : {}
+	});
+	for (const f of findings) args.warn(`Warning: ${f.message}`);
+}
+//#endregion
 //#region src/cli/commands/shared/versioned-upgrade.ts
 /**
 * Versioned-directory upgrade shared by the kici-admin upgrade commands: each
@@ -24100,14 +24271,16 @@ Nothing was installed and the service was not restarted. Fix binaryPath and run
 */
 init_service();
 /**
-* Check every bare-metal `binaryPath` of an orchestrator before the upgrade
-* installs or restarts anything. `spec` is the unit's launch command: the
-* `kici-agent` installed with its runtime is the one each `binaryPath` should
+* Check an orchestrator's scaler config before the upgrade installs or
+* restarts anything. `spec` is the unit's launch command: the `kici-agent`
+* installed with its runtime is the one each bare-metal `binaryPath` should
 * name. `expectedVersion` is what that agent runs after the upgrade, when the
 * caller knows it. Throws when a `binaryPath` would stop the restarted service,
-* unless `skip` is set: then every finding is a warning.
+* unless `skip` is set: then every finding is a warning. Then warns about each
+* container label set whose agent image stays behind `targetVersion`, the
+* release the service runs after the upgrade.
 */
-async function checkBareMetalBinaryPathsBeforeUpgrade(args) {
+async function checkScalersBeforeUpgrade(args) {
 	if (args.component !== "orchestrator" || args.platform === "compose") return;
 	const expectedAgent = args.spec ? agentBinaryFromLaunch(args.spec, isWindows(args.platform)) : null;
 	await preflightBareMetalBinaryPaths({
@@ -24120,6 +24293,12 @@ async function checkBareMetalBinaryPathsBeforeUpgrade(args) {
 		skip: args.skip,
 		warn: (line) => console.warn(line)
 	});
+	await warnAboutContainerAgentImages({
+		envFilePath: args.config.envFilePath,
+		workingDirectory: args.config.workingDirectory,
+		targetVersion: args.targetVersion,
+		warn: (line) => console.warn(line)
+	});
 }
 /**
 * Resolve the upgrade target through {@link resolveInstanceTarget}: `instanceDir`,
@@ -24448,14 +24627,18 @@ function planNpmSourceUpgrade(opts) {
 		kind: "error",
 		reason: "self-driving upgrade requires --version <target> (the version to install). Pass --restart-only to restart the already-installed package without installing."
 	};
-	const target = spec ? resolveNpmInstallTarget(spec, component, { windows }) : null;
-	if (!target) return {
+	const resolution = spec ? resolveNpmInstallTarget(spec, component, { windows }) : null;
+	if (resolution && !resolution.ok && resolution.reason === "not-global") return {
+		kind: "error",
+		reason: `npm-source upgrade cannot self-install: the unit's launch target ${resolution.entry} is not inside a global npm install, so the unit's npm has no global prefix that holds it. The unit runs ${spec.execPath}; this kici-admin runs ${process.execPath}. Use an archive upgrade (--from <archive> / --url <url> + --version), or pre-install the package and re-run with --restart-only.`
+	};
+	if (!resolution?.ok) return {
 		kind: "error",
 		reason: "npm-source upgrade cannot self-install: the unit's launch target is a custom --binary install or a non-node_modules path, so there is no global package to update. Use an archive upgrade (--from <archive> / --url <url> + --version), or pre-install the package and re-run with --restart-only."
 	};
 	return {
 		kind: "self-drive",
-		target,
+		target: resolution.target,
 		version: requestedVersion
 	};
 }
@@ -24471,9 +24654,14 @@ function windowsShellCommand(cmd, args) {
 	for (const arg of args) if (!/^[A-Za-z0-9@/._+-]+$/.test(arg)) throw new Error(`cannot pass "${arg}" to npm: it holds a character cmd.exe reads as syntax`);
 	return [`"${cmd}"`, ...args].join(" ");
 }
+/**
+* Only a Windows batch file (`npm.cmd`) goes through cmd.exe; the pinned
+* `node.exe` running npm-cli.js spawns directly, with no shell to parse its
+* `C:\…` arguments.
+*/
 const defaultSpawnRunner = (cmd, args, opts) => {
 	const env = opts?.env ?? process.env;
-	const r = process.platform === "win32" ? spawnSync(windowsShellCommand(cmd, args), {
+	const r = process.platform === "win32" && /\.cmd$/i.test(cmd) ? spawnSync(windowsShellCommand(cmd, args), {
 		encoding: "utf-8",
 		shell: true,
 		env
@@ -24488,15 +24676,40 @@ const defaultSpawnRunner = (cmd, args, opts) => {
 	};
 };
 /**
-* The environment npm runs in: the unit's pinned node first on PATH, because
-* npm derives its global prefix from the node that runs it.
+* The environment npm runs in: the unit's pinned node first on PATH, so a
+* wrapper fallback (`npmPath`, an `env node` shebang) resolves that node. The
+* caller's `npm_config_*` stay, so an operator-set registry or proxy still
+* applies.
+*
+* On the `npm.cmd` fallback the prefix goes through `npm_config_prefix`:
+* {@link windowsShellCommand} refuses the `\`, `:` and `=` a `--prefix=C:\…`
+* argument holds. Every other invocation passes `--prefix` on the command
+* line ({@link npmArgs}), which npm ranks above the environment.
 */
 function npmEnv(target) {
 	const pinnedBinDir = path.dirname(target.nodeExecPath);
-	return {
+	const env = {
 		...process.env,
 		PATH: `${pinnedBinDir}${path.delimiter}${process.env.PATH ?? ""}`
 	};
+	if (prefixViaEnv(target)) {
+		for (const key of Object.keys(env)) if (/^npm_config_(global_)?prefix$/i.test(key)) delete env[key];
+		env.npm_config_prefix = target.globalPrefix;
+	}
+	return env;
+}
+/** Whether the prefix travels in the environment: the `npm.cmd` fallback. */
+function prefixViaEnv(target) {
+	return target.npmInvocation.preArgs.length === 0 && /\.cmd$/i.test(target.npmInvocation.cmd);
+}
+/** The argv for one npm call: npm-cli.js first when the pinned node runs it, `--prefix` last. */
+function npmArgs(target, args) {
+	const prefix = prefixViaEnv(target) ? [] : [`--prefix=${target.globalPrefix}`];
+	return [
+		...target.npmInvocation.preArgs,
+		...args,
+		...prefix
+	];
 }
 /**
 * Whether `version` reads KICI_ENV_FILE, asked of the unit's npm registry. Such
@@ -24504,12 +24717,12 @@ function npmEnv(target) {
 * KiCI package of that version depends on.
 */
 function npmReleaseReadsEnvFile(target, version, run = defaultSpawnRunner) {
-	const res = run(target.npmPath, [
+	const res = run(target.npmInvocation.cmd, npmArgs(target, [
 		"view",
 		`@kici-dev/shared@${version}`,
 		"exports",
 		"--json"
-	], { env: npmEnv(target) });
+	]), { env: npmEnv(target) });
 	if (res.status !== 0) return {
 		ok: false,
 		error: res.stderr.trim() || `npm view exited with ${res.status}`
@@ -24538,20 +24751,20 @@ function npmReleaseReadsEnvFile(target, version, run = defaultSpawnRunner) {
 	};
 }
 /**
-* Install `<owningPackage>@<version>` globally under the unit's pinned node, so
-* it lands in the prefix the unit's ExecStart resolves from. npm derives its
-* global prefix from the node that runs npm-cli.js, and the unit's
-* `<pinned>/bin/npm` (an `env node` shebang or a version-manager wrapper)
-* resolves `node` off PATH; run bare it would inherit the shell's active node,
-* the mise/nvm/asdf drift this upgrade fixes. Hence the pinned bin dir goes
-* first on PATH ({@link npmEnv}).
+* Install `<owningPackage>@<version>` globally into the prefix the unit's
+* ExecStart resolves from, with the unit's pinned node. Without an explicit
+* prefix npm derives one from the node that runs npm-cli.js, or takes the
+* `npm_config_prefix` the caller's environment carries (`npx` exports its
+* own), so the install would land where the unit never reads it. The pinned
+* node runs npm-cli.js directly, skipping a version-manager wrapper at
+* `<pinned>/bin/npm`, which also keeps the shell's active node out of it.
 */
 function installGlobalPackage(target, version, run = defaultSpawnRunner) {
-	const res = run(target.npmPath, [
+	const res = run(target.npmInvocation.cmd, npmArgs(target, [
 		"install",
 		"-g",
 		`${target.owningPackage}@${version}`
-	], { env: npmEnv(target) });
+	]), { env: npmEnv(target) });
 	return {
 		ok: res.status === 0,
 		stderr: res.stderr
@@ -24673,12 +24886,13 @@ async function performVersionedUpgrade(component, opts, hooks = {}) {
 			console.error(`Error: service "${config.name}" is not installed`);
 			process.exit(1);
 		}
-		await checkBareMetalBinaryPathsBeforeUpgrade({
+		await checkScalersBeforeUpgrade({
 			component,
 			config,
 			platform,
 			spec: await manager.readLaunchSpec(config),
 			expectedVersion: null,
+			targetVersion: version,
 			willInstall: false,
 			skip: opts.skipBinaryPathCheck ?? false
 		});
@@ -24834,12 +25048,13 @@ async function restartOnlyUpgrade(args) {
 		console.error(`Error: ${verdict.reason}`);
 		process.exit(1);
 	}
-	await checkBareMetalBinaryPathsBeforeUpgrade({
+	await checkScalersBeforeUpgrade({
 		component: args.component,
 		config,
 		platform,
 		spec,
 		expectedVersion: null,
+		targetVersion: verdict.version,
 		willInstall: false,
 		skip: opts.skipBinaryPathCheck ?? false
 	});
@@ -24870,12 +25085,13 @@ async function restartOnlyUpgrade(args) {
 async function performSelfDrivingInstall(args) {
 	const { component, config, resolvedInstance, manager, action, opts, platform, spec } = args;
 	const { target, version } = action;
-	await checkBareMetalBinaryPathsBeforeUpgrade({
+	await checkScalersBeforeUpgrade({
 		component,
 		config,
 		platform,
 		spec,
 		expectedVersion: `${target.owningPackage}@${version}`,
+		targetVersion: version,
 		willInstall: true,
 		skip: opts.skipBinaryPathCheck ?? false
 	});
@@ -24886,15 +25102,14 @@ async function performSelfDrivingInstall(args) {
 		if (!verdict.reads) throw new Error(`refusing to install ${release} for "${config.name}": ${envFileRefusal(release, config.envFilePath)} The service and the installed package were not changed.`);
 	}
 	if (!opts.yes) {
-		console.log(`This will install ${target.owningPackage}@${version} using ${target.npmPath}`);
-		console.log(`  (node runtime: ${target.nodeExecPath}), then restart "${config.name}".`);
+		console.log(`This will install ${target.owningPackage}@${version} with ${target.nodeExecPath} into ${target.globalPrefix} (the unit's runtime), then restart "${config.name}".`);
 		console.log("");
 		if (!await confirm$1("Proceed with upgrade?")) {
 			console.log("Upgrade cancelled.");
 			return;
 		}
 	}
-	console.log(`Installing ${target.owningPackage}@${version} under the unit's runtime...`);
+	console.log(`Installing ${target.owningPackage}@${version} with ${target.nodeExecPath} into ${target.globalPrefix} (the unit's runtime)...`);
 	const result = installGlobalPackage(target, version, args.run);
 	if (!result.ok) {
 		const hint = /EACCES|permission denied|EPERM/i.test(result.stderr) ? " The unit's global prefix is not writable — re-run with privileges matching the unit's runtime." : "";
@@ -25034,7 +25249,7 @@ async function switchToInstalledVersion(args) {
 		action: `switch "${config.name}" to ${targetVersion}`,
 		config
 	});
-	await warnAboutBareMetalBinaryPaths(args);
+	await warnAboutScalers(args);
 	if (!await assertSchemaAllowsSwitch({
 		component,
 		targetVersion,
@@ -25068,18 +25283,20 @@ async function switchToInstalledVersion(args) {
 	});
 }
 /**
-* Print the bare-metal `binaryPath` diagnosis before `--rollback` or `--pick`
-* restarts the service. Never refuses and never throws: both are recovery
-* paths, and a check that cannot run must not block a recovery.
+* Print the bare-metal `binaryPath` and container agent image diagnoses before
+* `--rollback` or `--pick` restarts the service. Never refuses and never
+* throws: both are recovery paths, and a check that cannot run must not block
+* a recovery.
 */
-async function warnAboutBareMetalBinaryPaths(args) {
+async function warnAboutScalers(args) {
 	try {
-		await checkBareMetalBinaryPathsBeforeUpgrade({
+		await checkScalersBeforeUpgrade({
 			component: args.component,
 			config: args.config,
 			platform: args.platform,
 			spec: await args.manager.readLaunchSpec(args.config).catch(() => null),
 			expectedVersion: null,
+			targetVersion: args.targetVersion,
 			willInstall: false,
 			skip: true
 		});
@@ -26603,7 +26820,7 @@ init_manifest();
 const ALL_PLATFORMS = AgentPlatform.options;
 /** The orchestrator's own version (single-version invariant) = the packaged agent version. */
 function resolveKiciVersion() {
-	return "0.18.0";
+	return "0.20.0";
 }
 /** Parse the --platform value: default set | single | CSV | `all`. */
 function parsePlatforms(raw) {
@@ -35310,6 +35527,7 @@ function buildAgentContainerHostConfig(input) {
 		...typeof cpus === "number" && cpus > 0 ? { NanoCpus: Math.round(cpus * 1e9) } : {},
 		...input.binds && input.binds.length > 0 ? { Binds: input.binds } : {},
 		...input.extraHosts && input.extraHosts.length > 0 ? { ExtraHosts: input.extraHosts } : {},
+		...input.supplementaryGroups && input.supplementaryGroups.length > 0 ? { GroupAdd: input.supplementaryGroups.map(String) } : {},
 		AutoRemove: false,
 		PidsLimit: AGENT_CONTAINER_PIDS_LIMIT
 	};
@@ -35374,6 +35592,19 @@ async function detectRuntime(runtimeHint) {
 * Create a LogCapture from a running container's stdout/stderr streams.
 * Uses dockerode's demuxStream to strip Docker's 8-byte multiplexed headers.
 */
+/**
+* The cpu / memory ceiling for one spawn. `effectiveLimits` from ScalerManager
+* wins: it already folds in job overrides, label-set and scaler defaults.
+* Otherwise the label set's (or the scaler's default) `resources.limits` apply.
+*/
+function resolveSpawnLimits(effectiveLimits, resources) {
+	if (effectiveLimits && (effectiveLimits.cpus || effectiveLimits.memBytes)) return effectiveLimits;
+	const limits = resources?.limits;
+	return {
+		...limits?.memory ? { memBytes: parseMemoryString(limits.memory) } : {},
+		...limits?.cpus ? { cpus: limits.cpus } : {}
+	};
+}
 async function createContainerLogCapture(docker, containerId) {
 	const stream = await docker.getContainer(containerId).logs({
 		follow: true,
@@ -35661,15 +35892,7 @@ var ContainerScalerBackend = class ContainerScalerBackend {
 			];
 			const binds = [...matchedLabelSet.volumes ?? []];
 			if (matchedLabelSet.containerSocket && this.resolvedSocketPath) binds.push(`${this.resolvedSocketPath}:${this.resolvedSocketPath}`);
-			let resolvedLimits;
-			if (effectiveLimits && (effectiveLimits.cpus || effectiveLimits.memBytes)) resolvedLimits = effectiveLimits;
-			else {
-				const limits = (matchedLabelSet.resources ?? this.defaultResources)?.limits;
-				resolvedLimits = {
-					...limits?.memory ? { memBytes: parseMemoryString(limits.memory) } : {},
-					...limits?.cpus ? { cpus: limits.cpus } : {}
-				};
-			}
+			const resolvedLimits = resolveSpawnLimits(effectiveLimits, matchedLabelSet.resources ?? this.defaultResources);
 			const jobContainer = spawnContext?.container;
 			const spawnImage = jobContainer?.image ?? matchedLabelSet.image;
 			await pullImageIfMissing({
@@ -35692,6 +35915,7 @@ var ContainerScalerBackend = class ContainerScalerBackend {
 				binds.push(runtimeInjectBind(runtimeVolume));
 				agentInit = runtimeInitCommand(await agentImageLabels(this.docker, matchedLabelSet.image));
 			}
+			if (!jobContainer) env.push("KICI_SCALER_SINGLE_JOB=1");
 			emit(ScalerEventType.enum["scaler.provisioning"], "creating container");
 			const normalizedLabelSetStr = normalizeLabelSet(labelSet);
 			const container = await this.docker.createContainer({
@@ -35710,7 +35934,8 @@ var ContainerScalerBackend = class ContainerScalerBackend {
 				HostConfig: buildAgentContainerHostConfig({
 					limits: resolvedLimits,
 					binds,
-					...this.extraHosts ? { extraHosts: this.extraHosts } : {}
+					...this.extraHosts ? { extraHosts: this.extraHosts } : {},
+					...!jobContainer && { supplementaryGroups: [1990] }
 				}),
 				...this.networkIsolation && { NetworkingConfig: { EndpointsConfig: { ["kici-agent-net"]: {} } } }
 			});
@@ -36844,7 +37069,7 @@ function routeRootArgs(root, args) {
 * build entry; the fallback covers a source run (tests, `tsx`), the same shape
 * `server.ts` and `standalone.ts` use for `ORCHESTRATOR_VERSION`.
 */
-const CLI_VERSION = "0.18.0";
+const CLI_VERSION = "0.20.0";
 /**
 * Root command whose option parsing first routes argv through
 * {@link routeRootArgs}: a leading `--version` prints the CLI version, and an

package/dist/dashboard/handler.d.ts

@@ -156,6 +156,8 @@ export declare class DashboardHandler {
     private enforcePolicy;
     /** dashboard.run.detail: the run's nested job/step tree. */
     handleRunDetail(msg: DashboardRunDetailRequest): Promise<void>;
+    /** Answer a run-detail read for a run this orchestrator does not hold. */
+    private sendRunDetailNotFound;
     /**
      * dashboard.run.structured: the user-plane twin of the orchestrator-admin
      * `/runs/:id/structured` endpoint, byte-identical because it reuses the

package/dist/pipeline/dispatch-matched-workflow.d.ts

@@ -71,7 +71,7 @@ export interface WorkflowDispatchContext {
     fullLockFile: {
         workflows: readonly LockWorkflow[];
         lockfileHash?: string;
-        /** In-repo `workspace:` sibling closure digest; part of the dep pointer key. */
+        /** In-repo workspace sibling closure digest; part of the dep pointer key. */
         siblingsDigest?: string;
         source: {
             file: string;

package/dist/pipeline/global-eval-round.d.ts

@@ -193,14 +193,6 @@ export declare function narrowVerdict(raw: unknown, workflowName: string): Globa
  * best-effort post, so the check would vanish.
  */
 export declare const MAX_ROUND_REASON_CHARS = 4000;
-/**
- * Truncate `text` to at most `max` UTF-16 code units, marking that it was cut.
- *
- * - A `max` no larger than the marker returns the truncated marker, never a
- *   string longer than `max`.
- * - The cut backs off one unit rather than split a surrogate pair.
- */
-export declare function truncateReasonText(text: string, max: number): string;
 /**
  * One round that produced no verdicts after every attempt. Exactly one per
  * failed round, never one per candidate (the round exists to collapse N

package/dist/scaler/bare-metal-backend.d.ts

@@ -2,7 +2,8 @@
  * Bare-metal scaler backend: ephemeral agent processes via child_process.spawn.
  * On Linux and macOS each agent leads its own process group, which teardown
  * signals; on Windows teardown ends the agent's process tree with taskkill.
- * All agents are single-use: destroyed after job completion.
+ * An agent exits once it is idle past its idle window (a follow-up job that
+ * arrives within the window reuses it), and the backend destroys it on disconnect.
  */
 import { type ToolRequirement } from '@kici-dev/shared';
 import type { AgentTokenStore } from '../agent/token-store.js';

package/dist/scaler/container-hostconfig.d.ts

@@ -15,6 +15,13 @@ import type { EffectiveLimits } from './types.js';
  * its own docs and validation, and nothing yet says the constant is wrong.
  */
 export declare const AGENT_CONTAINER_PIDS_LIMIT = 4096;
+/**
+ * Group id of `kici-sudo` in the KiCI agent image (`packages/agent/Dockerfile`
+ * creates it). `/etc/sudoers.d/kici-sudo` grants that group passwordless sudo.
+ * The container scaler adds the group only to the single-job containers it
+ * starts from a pool's own image, so root never outlives one job.
+ */
+export declare const AGENT_SUDO_GROUP_GID = 1990;
 /**
  * Why this container is NOT capability-dropped, though the job containers the
  * agent starts are.
@@ -42,6 +49,8 @@ export interface AgentContainerHostConfigInput {
     binds?: string[];
     /** Extra `host:ip` entries (e.g. a private registry alias). */
     extraHosts?: string[];
+    /** Extra group ids for the container's process (`GroupAdd`). */
+    supplementaryGroups?: number[];
 }
 /**
  * Build the agent container's `HostConfig`.

package/dist/scaler/warm-pool.d.ts

@@ -19,7 +19,10 @@ export interface WarmPoolCallbacks {
     countAvailable: (labels: string[]) => number;
     /**
      * Agents this backend spawned that match the label set and have never run a
-     * job. `registeredAt` doubles as "idle since": scaler agents are single-use.
+     * job. `registeredAt` stands in for "idle since". That is exact for a
+     * container-backend agent, which exits after its one job. An agent of another
+     * backend can finish a job and wait out its idle window before it exits, so it
+     * can read as idle for longer than it has been.
      *
      * Scoped to the backend because the reaper destroys what it is given; a
      * matching static agent is ready capacity, not this pool's to tear down.