@kilogent/runner 0.1.6 → 0.1.8

package/dist/provision-root.mjs

@@ -0,0 +1,877 @@
+#!/usr/bin/env node
+
+// src/provision/root.ts
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import fs3 from "node:fs";
+import os2 from "node:os";
+import path2 from "node:path";
+import { fileURLToPath } from "node:url";
+
+// src/config.ts
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+// src/version.ts
+var RUNNER_PACKAGE = typeof __RUNNER_PACKAGE__ === "string" ? __RUNNER_PACKAGE__ : "@kilogent/runner-dev";
+var RUNNER_BIN = typeof __RUNNER_BIN__ === "string" ? __RUNNER_BIN__ : "kilogent-runner-dev";
+
+// src/config.ts
+var IS_DEV_BUILD = RUNNER_PACKAGE.endsWith("-dev");
+var LEGACY_DIR_NAME = ".crew-runner";
+var DIR_NAME = `.${RUNNER_BIN}`;
+var LUMI_DIR_NAME = ".lumi-runner";
+var FALLBACK_DIR_NAMES = [LUMI_DIR_NAME, LEGACY_DIR_NAME];
+function configDir() {
+  const override = process.env.LUMI_RUNNER_HOME || process.env.CREW_RUNNER_HOME;
+  if (override) return override;
+  const home = os.homedir();
+  const current = path.join(home, DIR_NAME);
+  if (fs.existsSync(current)) return current;
+  for (const name of FALLBACK_DIR_NAMES) {
+    const older = path.join(home, name);
+    if (fs.existsSync(older)) return older;
+  }
+  return current;
+}
+function fleetStatePath() {
+  return path.join(configDir(), "fleet-state.json");
+}
+
+// src/fleet/drain.ts
+var DRAIN_REQUEST_FILE = "drain-request.json";
+var DRAIN_REQUEST_MAX_MS = 2 * 60 * 6e4;
+function drainProgress(state, input) {
+  if (!state || input.now - state.updatedAt > input.staleMs) return { state: "no-daemon" };
+  if (state.drainRequestAt !== input.requestedAt) return { state: "waiting", running: state.running.length };
+  return state.running.length === 0 ? { state: "drained" } : { state: "waiting", running: state.running.length };
+}
+
+// src/fleet/state.ts
+import fs2 from "node:fs";
+function readFleetState(file = fleetStatePath()) {
+  try {
+    const parsed = JSON.parse(fs2.readFileSync(file, "utf8"));
+    if (parsed?.version !== 1 || typeof parsed.serverId !== "string") return null;
+    return {
+      ...parsed,
+      running: Array.isArray(parsed.running) ? parsed.running : [],
+      engines: Array.isArray(parsed.engines) ? parsed.engines : []
+    };
+  } catch {
+    return null;
+  }
+}
+var FLEET_STATE_STALE_MS = 2 * 6e4;
+
+// src/jobs/capacity.ts
+var HOST_RESERVE_MB = 4096;
+
+// src/launcher/memoryWatch.ts
+var GROW_PLAN_BOUNDS = Object.freeze({
+  startMb: [256, 4096],
+  stepMb: [50, 1024],
+  maxMb: [256, 4096],
+  growAtPct: [50, 95],
+  pollMs: [100, 5e3]
+});
+
+// src/launcher/protocol.ts
+var LAUNCHER_PATH = "/usr/local/lib/kilogent/kg-session-launcher.mjs";
+var LAUNCHER_SETTINGS_PATH = "/etc/kilogent/launcher.json";
+var MAX_REQUEST_BYTES = 1024 * 1024;
+var SESSION_ENV_NAMES = Object.freeze([
+  "ANTHROPIC_BASE_URL",
+  "ANTHROPIC_AUTH_TOKEN",
+  "ANTHROPIC_API_KEY",
+  "CLAUDE_CODE_OAUTH_TOKEN",
+  "OPENAI_API_KEY",
+  "OPENAI_BASE_URL",
+  "GOOGLE_API_KEY",
+  "GH_TOKEN",
+  "GITHUB_TOKEN",
+  "GIT_CONFIG_COUNT",
+  "GIT_CONFIG_KEY_0",
+  "GIT_CONFIG_VALUE_0",
+  "GIT_CONFIG_KEY_1",
+  "GIT_CONFIG_VALUE_1",
+  "GIT_CONFIG_KEY_2",
+  "GIT_CONFIG_VALUE_2",
+  "CREW_JOB_ID",
+  "CREW_MODEL_INPUT"
+]);
+var SESSION_ENV_SINCE = Object.freeze({ CREW_MODEL_INPUT: 1 });
+var MAX_ARG_BYTES = 256 * 1024;
+
+// src/provision/host.ts
+function parseOsRelease(text) {
+  const values = {};
+  for (const line of text.split("\n")) {
+    const match = /^([A-Z_]+)=("?)(.*)\2$/.exec(line.trim());
+    if (match) values[match[1]] = match[3];
+  }
+  return { id: values.ID ?? "", versionId: values.VERSION_ID ?? "", codename: values.VERSION_CODENAME ?? "" };
+}
+var SUPPORTED_HOSTS = Object.freeze([
+  { id: "ubuntu", versionId: "22.04", codename: "jammy" },
+  { id: "ubuntu", versionId: "24.04", codename: "noble" },
+  { id: "debian", versionId: "12", codename: "bookworm" }
+]);
+function supportedHost(os3) {
+  return SUPPORTED_HOSTS.some((h) => h.id === os3.id && h.versionId === os3.versionId && h.codename === os3.codename);
+}
+function unsupportedHostSentence(os3) {
+  const names = SUPPORTED_HOSTS.map((h) => `${h.id === "ubuntu" ? "Ubuntu" : "Debian"} ${h.versionId}`).join(", ");
+  return `This is ${os3.id || "an unknown system"} ${os3.versionId}; provision installs on ${names}. With Docker Engine and gVisor (runsc) installed by hand, it checks them instead.`;
+}
+var RUNSC_PATH = "/usr/bin/runsc";
+function mergeDaemonJson(existing) {
+  let doc = {};
+  if (existing && existing.trim()) {
+    try {
+      const parsed = JSON.parse(existing);
+      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return { ok: false, reason: "/etc/docker/daemon.json is not a JSON object." };
+      doc = parsed;
+    } catch {
+      return { ok: false, reason: "/etc/docker/daemon.json is not valid JSON. Fix it by hand, then run provision again." };
+    }
+  }
+  const runtimes = doc.runtimes && typeof doc.runtimes === "object" ? doc.runtimes : {};
+  const runsc = runtimes.runsc;
+  if (runsc && runsc.path !== RUNSC_PATH) {
+    return { ok: false, reason: `daemon.json already registers runsc at ${String(runsc.path)}. Provision expects ${RUNSC_PATH}.` };
+  }
+  if ("live-restore" in doc && doc["live-restore"] !== true) {
+    return { ok: false, reason: "daemon.json sets live-restore to false. Provision needs it on; change it by hand if that is safe here." };
+  }
+  const changed = !runsc || doc["live-restore"] !== true;
+  const next = { ...doc, runtimes: { ...runtimes, runsc: { path: RUNSC_PATH } }, "live-restore": true };
+  return { ok: true, changed, text: `${JSON.stringify(next, null, 2)}
+` };
+}
+var SESSION_BRIDGE = "kg-sessions";
+var FIREWALL_CHAIN = "KG-SESSIONS";
+var BLOCKED_RANGES = Object.freeze(["169.254.0.0/16", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "100.64.0.0/10"]);
+function firewallRules(input) {
+  const bridge = input.bridge ?? SESSION_BRIDGE;
+  const resolvers = [...new Set(input.resolvers.filter((r) => /^\d{1,3}(\.\d{1,3}){3}$/.test(r)))];
+  const lines = ["*filter", `:${FIREWALL_CHAIN} - [0:0]`, `-F ${FIREWALL_CHAIN}`];
+  lines.push(`-A ${FIREWALL_CHAIN} -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN`);
+  for (const r of resolvers) {
+    lines.push(`-A ${FIREWALL_CHAIN} -i ${bridge} -d ${r}/32 -p udp --dport 53 -j RETURN`);
+    lines.push(`-A ${FIREWALL_CHAIN} -i ${bridge} -d ${r}/32 -p tcp --dport 53 -j RETURN`);
+  }
+  for (const range of BLOCKED_RANGES) lines.push(`-A ${FIREWALL_CHAIN} -i ${bridge} -d ${range} -j DROP`);
+  lines.push(`-A ${FIREWALL_CHAIN} -i ${bridge} -j RETURN`);
+  lines.push("COMMIT");
+  return `${lines.join("\n")}
+`;
+}
+function firewallJumps(bridge = SESSION_BRIDGE) {
+  return [
+    { chain: "DOCKER-USER", rule: ["-i", bridge, "-j", FIREWALL_CHAIN] },
+    { chain: "INPUT", rule: ["-i", bridge, "-j", "DROP"] }
+  ];
+}
+function firewallUnit(rulesPath, bridge = SESSION_BRIDGE) {
+  const ensure = firewallJumps(bridge).map(({ chain, rule }) => `ExecStart=/bin/sh -c 'iptables -C ${chain} ${rule.join(" ")} 2>/dev/null || iptables -I ${chain} 1 ${rule.join(" ")}'`).join("\n");
+  return `[Unit]
+Description=Kilogent session firewall
+After=docker.service
+PartOf=docker.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/sbin/iptables-restore --noflush ${rulesPath}
+${ensure}
+
+[Install]
+WantedBy=docker.service
+`;
+}
+function resolversFrom(resolvConf) {
+  return resolvConf.split("\n").map((l) => /^\s*nameserver\s+(\d{1,3}(?:\.\d{1,3}){3})\s*$/.exec(l)?.[1]).filter((r) => Boolean(r) && !r.startsWith("127."));
+}
+function sudoersLine(user, launcher) {
+  if (!/^[a-z_][a-z0-9_-]{0,31}$/.test(user)) throw new Error("Not a user name.");
+  if (!/^\/[A-Za-z0-9._/-]+$/.test(launcher)) throw new Error("Not an absolute path.");
+  return `${user} ALL=(root) NOPASSWD: ${launcher} ""
+`;
+}
+
+// src/provision/plan.ts
+var MIN_PROVISION_NODE_MAJOR = 18;
+var SERVICE_NODE_MAJOR = 22;
+var MIN_PROVISION_DISK_BYTES = 10 * 1024 ** 3;
+var OWNER_USER = "kilogent";
+var SESSION_USER = "kilogent-s";
+var SESSIONS_ROOT = "/var/lib/kilogent/sessions";
+var HOST_STATE_PATH = "/etc/kilogent/host.json";
+var SUDOERS_PATH = "/etc/sudoers.d/kilogent";
+var FIREWALL_UNIT = "kg-sessions-firewall.service";
+function versionAtLeast(have, want) {
+  const parse = (v) => (/^(\d+)\.(\d+)\.(\d+)/.exec(v) ?? []).slice(1).map(Number);
+  const a = parse(have);
+  const b = parse(want);
+  if (a.length !== 3 || b.length !== 3) return false;
+  for (let i = 0; i < 3; i += 1) {
+    if (a[i] !== b[i]) return a[i] > b[i];
+  }
+  return true;
+}
+function planLinuxProvision(facts, options) {
+  const refusal = preflightRefusal(facts);
+  if (refusal) return { refusal, steps: [] };
+  const steps = [{ id: "preflight", as: "root", action: "check", why: "The host can run a Kilogent server." }];
+  const supported = supportedHost(facts.osRelease);
+  const add = (id, as, action, why) => steps.push({ id, as, action, why });
+  add(
+    "users",
+    "root",
+    facts.users.owner && facts.users.session ? "check" : "do",
+    facts.users.owner && facts.users.session ? `${OWNER_USER} and ${SESSION_USER} exist.` : `Create ${[!facts.users.owner && OWNER_USER, !facts.users.session && SESSION_USER].filter(Boolean).join(" and ")}.`
+  );
+  add(
+    "node",
+    "root",
+    facts.systemNodeMajor !== null && facts.systemNodeMajor >= SERVICE_NODE_MAJOR ? "check" : "do",
+    facts.systemNodeMajor !== null && facts.systemNodeMajor >= SERVICE_NODE_MAJOR ? `Node ${facts.systemNodeMajor} is installed.` : `Install Node ${SERVICE_NODE_MAJOR} from NodeSource's signed repository.`
+  );
+  if (!options.hostOnly) {
+    const runnerCurrent = facts.runnerVersion !== null && versionAtLeast(facts.runnerVersion, options.version);
+    add(
+      "runner",
+      "owner",
+      runnerCurrent ? "skip" : "do",
+      runnerCurrent ? `The runner ${facts.runnerVersion} is installed, which is this release or newer.` : `Install the runner ${options.version} into ${OWNER_USER}'s own prefix.`
+    );
+    const reEnrol = facts.enrolled && options.reEnrol === true;
+    add(
+      "enrol",
+      "owner",
+      facts.enrolled && !reEnrol ? "skip" : "do",
+      !facts.enrolled ? "Enrol with the one-time code." : reEnrol ? "Enrol again with the new code, replacing this server's key." : "This server is enrolled already."
+    );
+    add("service", "owner", "do", "Install and start the service. It takes no work until the host is ready.");
+  }
+  if (facts.docker.present) {
+    add("docker", "root", "check", `Docker is installed (${facts.docker.source ?? "unknown source"}), and is used as it is.`);
+  } else {
+    add("docker", "root", supported ? "do" : "check", supported ? "Install Docker Engine from Docker's signed repository." : "Docker Engine must be installed by hand here.");
+  }
+  if (facts.runsc.present) add("gvisor", "root", "check", "gVisor (runsc) is installed.");
+  else add("gvisor", "root", supported ? "do" : "check", supported ? "Install gVisor from gVisor's signed repository." : "gVisor must be installed by hand here.");
+  const merged = mergeDaemonJson(facts.daemonJson);
+  if (!merged.ok) add("daemon-json", "root", "check", merged.reason);
+  else add("daemon-json", "root", merged.changed ? "do" : "check", merged.changed ? "Register runsc and turn live-restore on, then reload Docker (never restart it)." : "runsc is registered and live-restore is on.");
+  if (facts.network.exists && facts.network.iccDisabled === true) {
+    add("network", "root", "check", "The kg-sessions network exists, and its sessions cannot reach each other.");
+  } else if (facts.network.exists && facts.network.attachedContainers > 0) {
+    add("network", "root", "check", "kg-sessions lets sessions reach each other, and has containers on it, so it is not recreated now.");
+  } else {
+    add("network", "root", "do", facts.network.exists ? "Recreate kg-sessions so its sessions cannot reach each other." : "Create the kg-sessions network.");
+  }
+  add("firewall", "root", "do", "Apply the session firewall, and a unit that applies it again whenever Docker starts.");
+  add(
+    "launcher",
+    "root",
+    facts.launcherSha256 === options.launcherSha256 ? "check" : "do",
+    facts.launcherSha256 === options.launcherSha256 ? "The session launcher is this release's." : "Install this release's session launcher and its settings."
+  );
+  add("sudoers", "root", facts.sudoers === options.expectedSudoers ? "check" : "do", facts.sudoers === options.expectedSudoers ? "sudo allows the launcher, and nothing else." : "Allow the service user the launcher, and nothing else.");
+  add("hold", "root", "do", "Hold the packages provision installed, so an unattended upgrade cannot restart Docker under a session.");
+  if (!options.hostOnly) add("wait", "owner", "do", "Wait for the server to report ready.");
+  return { refusal: null, steps };
+}
+function preflightRefusal(f) {
+  if (f.nodeMajor < MIN_PROVISION_NODE_MAJOR) {
+    return `Provision needs Node ${MIN_PROVISION_NODE_MAJOR} or newer to start; this is Node ${f.nodeMajor}. Install a newer nodejs, then run it again.`;
+  }
+  if (!f.systemd) return "This host has no systemd, so a service cannot be installed. Provision runs on a VM or a bare machine, not in a container.";
+  if (!f.cgroupV2) return "This host does not use cgroup v2, which the session limits need.";
+  if (f.diskFreeBytes !== null && f.diskFreeBytes < MIN_PROVISION_DISK_BYTES) {
+    return `This host has ${(f.diskFreeBytes / 1024 ** 3).toFixed(1)} GB free; a server needs at least ${MIN_PROVISION_DISK_BYTES / 1024 ** 3} GB.`;
+  }
+  if (!supportedHost(f.osRelease) && (!f.docker.present || !f.runsc.present)) return unsupportedHostSentence(f.osRelease);
+  if (f.docker.present && !f.docker.answers) {
+    return "Docker is installed and does not answer. Provision starts a stopped Docker; one that will not start is broken, and `systemctl status docker` says why. Fix that, then run provision again.";
+  }
+  return null;
+}
+function provisionExitCode(results) {
+  const serviceIndex = results.findIndex((r) => r.id === "service");
+  const firstFailure = results.findIndex((r) => !r.ok);
+  if (firstFailure < 0) return 0;
+  if (serviceIndex >= 0 && results[serviceIndex].ok && firstFailure > serviceIndex) return 2;
+  return 1;
+}
+
+// src/provision/root.ts
+var ROOT_ENV = { PATH: "/usr/sbin:/usr/bin:/sbin:/bin", LANG: "C.UTF-8", DEBIAN_FRONTEND: "noninteractive" };
+var OWNER_HOME = `/home/${OWNER_USER}`;
+var OWNER_PREFIX = `${OWNER_HOME}/.local`;
+var FIREWALL_RULES_PATH = "/etc/kilogent/firewall.rules";
+var KEYRINGS = "/etc/apt/keyrings";
+var APT_KEY_FINGERPRINTS = {
+  docker: ["9DC858229FC7DD38854AE2D88D81803C0EBFCD88"],
+  nodesource: ["6F71F525282841EEDAF851B42F59B5F99B1BE0B4"],
+  gvisor: ["6F1DF85E3A71C24918E727D56FC6D554E32BD943"]
+};
+var StepFailure = class extends Error {
+};
+function say(line) {
+  process.stdout.write(`${line}
+`);
+}
+function run(command, args, opts = {}) {
+  const res = spawnSync(command, [...args], { env: ROOT_ENV, encoding: "utf8", timeout: 15 * 6e4, ...opts });
+  return { ok: res.status === 0, out: String(res.stdout ?? ""), err: String(res.stderr ?? "") || (res.error ? res.error.message : "") };
+}
+function must(command, args, what, opts = {}) {
+  const res = run(command, args, opts);
+  if (!res.ok) throw new StepFailure(`${what} failed: ${(res.err || res.out).trim().split("\n").slice(-3).join(" ").slice(0, 300)}`);
+  return res.out;
+}
+function parseArgs(argv) {
+  const get = (flag) => {
+    const i = argv.indexOf(flag);
+    return i >= 0 ? argv[i + 1] ?? null : null;
+  };
+  return {
+    project: get("--project") ?? "",
+    apiKey: get("--api-key") ?? "",
+    codeStdin: argv.includes("--code-stdin"),
+    yes: argv.includes("--yes"),
+    hostOnly: argv.includes("--host-only"),
+    planOnly: argv.includes("--plan"),
+    upgradeHost: argv.some((a) => a === "--upgrade-host" || a.startsWith("--upgrade-host=")),
+    upgradeOnly: (argv.find((a) => a.startsWith("--upgrade-host="))?.slice("--upgrade-host=".length) ?? "").split(",").map((name) => name.trim()).filter((name) => name.length > 0),
+    now: argv.includes("--now"),
+    reEnrol: argv.includes("--re-enrol"),
+    tarball: get("--tarball")
+  };
+}
+function thisRelease() {
+  const root = path2.dirname(path2.dirname(fileURLToPath(import.meta.url)));
+  const pkg = JSON.parse(fs3.readFileSync(path2.join(root, "package.json"), "utf8"));
+  const launcher = fs3.readFileSync(path2.join(root, "dist/kg-session-launcher.mjs"));
+  const bin = Object.keys(pkg.bin ?? {})[0];
+  if (!bin) throw new Error(`${path2.join(root, "package.json")} names no command, so it is not a runner release.`);
+  return {
+    root,
+    name: pkg.name,
+    version: pkg.version,
+    bin,
+    sessionImage: pkg.kilogent?.sessionImage ?? "",
+    launcherSha256: createHash("sha256").update(launcher).digest("hex")
+  };
+}
+function readText(file) {
+  try {
+    return fs3.readFileSync(file, "utf8");
+  } catch {
+    return null;
+  }
+}
+function idOf(user, flag) {
+  const res = run("id", [flag, user]);
+  const n = Number(res.out.trim());
+  return res.ok && Number.isInteger(n) ? n : null;
+}
+function gatherFacts(release) {
+  const systemNode = run("/usr/bin/node", ["--version"]);
+  const dockerPresent = run("sh", ["-c", "command -v docker"]).ok;
+  const dockerAnswers = dockerPresent && run("docker", ["version", "--format", "{{.Server.Version}}"], { timeout: 2e4 }).ok;
+  const source = !dockerPresent ? null : fs3.existsSync("/snap/bin/docker") ? "snap" : run("dpkg-query", ["-W", "-f=${Status}", "docker-ce"]).out.includes("installed") ? "docker-ce" : run("dpkg-query", ["-W", "-f=${Status}", "docker.io"]).out.includes("installed") ? "docker.io" : "other";
+  const running = dockerAnswers ? run("docker", ["ps", "--quiet"]).out.split("\n").filter(Boolean).length : 0;
+  const network = dockerAnswers ? run("docker", ["network", "inspect", SESSION_BRIDGE, "--format", "{{json .Options}}|{{len .Containers}}"]) : null;
+  let iccDisabled = null;
+  let attached = 0;
+  if (network?.ok) {
+    const [options, count] = network.out.trim().split("|");
+    try {
+      iccDisabled = JSON.parse(options)?.["com.docker.network.bridge.enable_icc"] === "false";
+    } catch {
+      iccDisabled = null;
+    }
+    attached = Number(count) || 0;
+  }
+  const launcher = fs3.existsSync(LAUNCHER_PATH) ? createHash("sha256").update(fs3.readFileSync(LAUNCHER_PATH)).digest("hex") : null;
+  const installed = readText(path2.join(OWNER_PREFIX, "lib/node_modules", release.name, "package.json"));
+  const configDir2 = path2.join(OWNER_HOME, `.${release.bin}`);
+  let diskFreeBytes = null;
+  try {
+    const st = fs3.statfsSync(fs3.existsSync("/var/lib") ? "/var/lib" : "/");
+    diskFreeBytes = Number(st.bavail) * Number(st.bsize);
+  } catch {
+    diskFreeBytes = null;
+  }
+  return {
+    osRelease: parseOsRelease(readText("/etc/os-release") ?? ""),
+    nodeMajor: Number(process.versions.node.split(".")[0]),
+    systemNodeMajor: systemNode.ok ? Number(/^v(\d+)/.exec(systemNode.out.trim())?.[1] ?? NaN) || null : null,
+    systemd: fs3.existsSync("/run/systemd/system"),
+    cgroupV2: fs3.existsSync("/sys/fs/cgroup/cgroup.controllers"),
+    diskFreeBytes,
+    docker: { present: dockerPresent, answers: dockerAnswers, source, runningContainers: running },
+    runsc: { present: run("sh", ["-c", "command -v runsc"]).ok },
+    daemonJson: readText("/etc/docker/daemon.json"),
+    users: { owner: idOf(OWNER_USER, "-u") !== null, session: idOf(SESSION_USER, "-u") !== null },
+    network: { exists: Boolean(network?.ok), iccDisabled, attachedContainers: attached },
+    launcherSha256: launcher,
+    sudoers: readText(SUDOERS_PATH),
+    runnerVersion: installed ? JSON.parse(installed).version ?? null : null,
+    enrolled: fs3.existsSync(path2.join(configDir2, "fleet.key")) && fs3.existsSync(path2.join(configDir2, "config.json"))
+  };
+}
+var aptListsFresh = false;
+function aptUpdateOnce() {
+  if (aptListsFresh) return;
+  must("apt-get", ["update"], "apt-get update");
+  aptListsFresh = true;
+}
+async function installAptKey(name, url) {
+  aptUpdateOnce();
+  must("apt-get", ["install", "-y", "--no-install-recommends", "ca-certificates", "gnupg"], "Installing gnupg");
+  const res = await fetch(url, { signal: AbortSignal.timeout(3e4) });
+  if (!res.ok) throw new StepFailure(`Could not fetch the ${name} signing key (${res.status}).`);
+  const tmp = path2.join(os2.tmpdir(), `kg-${name}-${process.pid}.key`);
+  fs3.writeFileSync(tmp, Buffer.from(await res.arrayBuffer()), { mode: 384 });
+  try {
+    const shown = must("gpg", ["--show-keys", "--with-colons", tmp], `Reading the ${name} signing key`);
+    const fingerprints = shown.split("\n").filter((l) => l.startsWith("fpr:")).map((l) => l.split(":")[9]).filter(Boolean);
+    const trusted = APT_KEY_FINGERPRINTS[name];
+    if (fingerprints.length === 0) throw new StepFailure(`The ${name} signing key has no fingerprint.`);
+    if (trusted.length > 0 && !fingerprints.some((f) => trusted.includes(f))) {
+      throw new StepFailure(`The ${name} signing key (${fingerprints[0]}) is not one this release trusts.`);
+    }
+    fs3.mkdirSync(KEYRINGS, { recursive: true, mode: 493 });
+    const keyring = path2.join(KEYRINGS, `${name}.gpg`);
+    must("gpg", ["--batch", "--yes", "--dearmor", "-o", keyring, tmp], `Installing the ${name} keyring`);
+    fs3.chmodSync(keyring, 420);
+    return { keyring, fingerprints };
+  } finally {
+    fs3.rmSync(tmp, { force: true });
+  }
+}
+function aptSource(file, line) {
+  fs3.writeFileSync(path2.join("/etc/apt/sources.list.d", file), `${line}
+`, { mode: 420 });
+  must("apt-get", ["update"], "apt-get update");
+}
+function ownerEnv(uid) {
+  return [
+    `HOME=${OWNER_HOME}`,
+    `PATH=${OWNER_PREFIX}/bin:/usr/bin:/bin`,
+    `XDG_RUNTIME_DIR=/run/user/${uid}`,
+    `DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/${uid}/bus`
+  ];
+}
+function asOwner(args, what, opts = {}) {
+  const uid = idOf(OWNER_USER, "-u");
+  if (uid === null) throw new StepFailure(`${OWNER_USER} does not exist.`);
+  return must("runuser", ["-u", OWNER_USER, "--", "setsid", "/usr/bin/env", "-i", ...ownerEnv(uid), ...args], what, {
+    cwd: OWNER_HOME,
+    ...opts.input !== void 0 ? { input: opts.input } : {}
+  });
+}
+function ownerCli(release) {
+  return path2.join(OWNER_PREFIX, "lib/node_modules", release.name, "dist/cli.js");
+}
+async function runStep(step, ctx) {
+  const { release, options } = ctx;
+  if (step.action === "skip") return step.why;
+  switch (step.id) {
+    case "preflight":
+      return step.why;
+    case "users": {
+      if (step.action === "do") {
+        if (idOf(OWNER_USER, "-u") === null) {
+          must("useradd", ["--create-home", "--home-dir", OWNER_HOME, "--shell", "/usr/sbin/nologin", "--user-group", OWNER_USER], `Creating ${OWNER_USER}`);
+        }
+        if (idOf(SESSION_USER, "-u") === null) {
+          must("useradd", ["--system", "--no-create-home", "--home-dir", "/nonexistent", "--shell", "/usr/sbin/nologin", "--user-group", SESSION_USER], `Creating ${SESSION_USER}`);
+        }
+      }
+      const groups = run("id", ["-Gn", OWNER_USER]).out.split(/\s+/);
+      if (groups.includes("docker")) must("gpasswd", ["-d", OWNER_USER, "docker"], `Removing ${OWNER_USER} from the docker group`);
+      must("loginctl", ["enable-linger", OWNER_USER], "Keeping the service user\u2019s services running without a login");
+      const uid = idOf(OWNER_USER, "-u");
+      for (let i = 0; i < 30 && !fs3.existsSync(`/run/user/${uid}/bus`); i += 1) spawnSync("sleep", ["1"]);
+      return step.why;
+    }
+    case "node": {
+      if (step.action === "check") return step.why;
+      const { keyring, fingerprints } = await installAptKey("nodesource", "https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key");
+      ctx.notes.nodesourceKey = fingerprints;
+      aptSource("nodesource.list", `deb [signed-by=${keyring}] https://deb.nodesource.com/node_${SERVICE_NODE_MAJOR}.x nodistro main`);
+      must("apt-get", ["install", "-y", "nodejs"], `Installing Node ${SERVICE_NODE_MAJOR}`);
+      ctx.installed.push("nodejs");
+      return `Node ${SERVICE_NODE_MAJOR} installed (key ${fingerprints[0]}).`;
+    }
+    case "runner": {
+      const tarball = options.tarball ?? (fs3.existsSync(path2.resolve("kg.tgz")) ? path2.resolve("kg.tgz") : null);
+      const staged = path2.join(os2.tmpdir(), `kg-runner-${release.version}-${process.pid}.tgz`);
+      if (tarball) fs3.copyFileSync(tarball, staged);
+      else must("npm", ["pack", "--pack-destination", os2.tmpdir(), release.root], "Packing the runner").trim();
+      if (!tarball) fs3.renameSync(path2.join(os2.tmpdir(), `${release.name.replace("@", "").replace("/", "-")}-${release.version}.tgz`), staged);
+      fs3.chmodSync(staged, 420);
+      try {
+        asOwner(["/usr/bin/npm", "install", "--global", "--prefix", OWNER_PREFIX, "--ignore-scripts", "--no-audit", "--no-fund", staged], "Installing the runner");
+      } finally {
+        fs3.rmSync(staged, { force: true });
+      }
+      return `${release.name}@${release.version} installed in ${OWNER_PREFIX}.`;
+    }
+    case "enrol": {
+      if (!ctx.code) throw new StepFailure("No enrolment code was given.");
+      const replace = options.reEnrol ? ["--replace"] : [];
+      const out = asOwner(["/usr/bin/node", ownerCli(release), "enrol", "--project", options.project, "--api-key", options.apiKey, ...replace], "Enrolling", {
+        input: `${ctx.code}
+`
+      });
+      const tail = /key ends …?([0-9a-f]{4})/.exec(out)?.[1];
+      const approve = /Approve this server[^\n]*/.exec(out)?.[0];
+      return approve ? `Enrolled. ${approve}` : `Enrolled${tail ? `; the key ends \u2026${tail}` : ""}.`;
+    }
+    case "service":
+      asOwner(["/usr/bin/node", ownerCli(release), "--yes", "service", "install"], "Installing the service");
+      return "The service is installed and running. It takes no work until this server is ready.";
+    case "docker": {
+      if (step.action === "check") return step.why;
+      const id = parseOsRelease(readText("/etc/os-release") ?? "");
+      const arch = must("dpkg", ["--print-architecture"], "Reading the architecture").trim();
+      const { keyring } = await installAptKey("docker", `https://download.docker.com/linux/${id.id}/gpg`);
+      aptSource("docker.list", `deb [arch=${arch} signed-by=${keyring}] https://download.docker.com/linux/${id.id} ${id.codename} stable`);
+      must("apt-get", ["install", "-y", "docker-ce", "docker-ce-cli", "containerd.io"], "Installing Docker Engine");
+      ctx.installed.push("docker-ce", "docker-ce-cli", "containerd.io");
+      must("systemctl", ["enable", "--now", "docker"], "Starting Docker");
+      return "Docker Engine installed and started.";
+    }
+    case "gvisor": {
+      if (step.action === "check") return step.why;
+      const arch = must("dpkg", ["--print-architecture"], "Reading the architecture").trim();
+      const { keyring, fingerprints } = await installAptKey("gvisor", "https://gvisor.dev/archive.key");
+      ctx.notes.gvisorKey = fingerprints;
+      aptSource("gvisor.list", `deb [arch=${arch} signed-by=${keyring}] https://storage.googleapis.com/gvisor/releases release main`);
+      must("apt-get", ["install", "-y", "runsc"], "Installing gVisor");
+      ctx.installed.push("runsc");
+      return `gVisor installed (key ${fingerprints[0]}).`;
+    }
+    case "daemon-json": {
+      if (step.action === "check") {
+        const merged2 = mergeDaemonJson(readText("/etc/docker/daemon.json"));
+        if (!merged2.ok) throw new StepFailure(merged2.reason);
+        return step.why;
+      }
+      const current = readText("/etc/docker/daemon.json");
+      const merged = mergeDaemonJson(current);
+      if (!merged.ok) throw new StepFailure(merged.reason);
+      fs3.mkdirSync("/etc/docker", { recursive: true, mode: 493 });
+      const backup = current !== null ? `/etc/docker/daemon.json.kg-backup-${Date.now()}` : null;
+      if (backup) fs3.writeFileSync(backup, current, { mode: 420 });
+      fs3.writeFileSync("/etc/docker/daemon.json", merged.text, { mode: 420 });
+      const valid = run("dockerd", ["--validate", "--config-file", "/etc/docker/daemon.json"]);
+      if (!valid.ok) {
+        if (backup) fs3.copyFileSync(backup, "/etc/docker/daemon.json");
+        else fs3.rmSync("/etc/docker/daemon.json", { force: true });
+        throw new StepFailure(`Docker refused the merged daemon.json, so the old one was put back: ${valid.err.trim().slice(0, 200)}`);
+      }
+      must("systemctl", ["reload", "docker"], "Reloading Docker");
+      return `runsc registered and live-restore on${backup ? `; the old file is at ${backup}` : ""}.`;
+    }
+    case "network": {
+      if (step.action === "check") {
+        if (step.why.includes("has containers on it")) throw new StepFailure(step.why);
+        return step.why;
+      }
+      if (run("docker", ["network", "inspect", SESSION_BRIDGE]).ok) must("docker", ["network", "rm", SESSION_BRIDGE], "Removing the old session network");
+      must(
+        "docker",
+        ["network", "create", "--driver", "bridge", "--opt", `com.docker.network.bridge.name=${SESSION_BRIDGE}`, "--opt", "com.docker.network.bridge.enable_icc=false", SESSION_BRIDGE],
+        "Creating the session network"
+      );
+      return step.why;
+    }
+    case "firewall": {
+      const resolvers = [
+        ...resolversFrom(readText("/run/systemd/resolve/resolv.conf") ?? ""),
+        ...resolversFrom(readText("/etc/resolv.conf") ?? "")
+      ];
+      fs3.mkdirSync("/etc/kilogent", { recursive: true, mode: 493 });
+      fs3.writeFileSync(FIREWALL_RULES_PATH, firewallRules({ resolvers }), { mode: 420 });
+      fs3.writeFileSync(path2.join("/etc/systemd/system", FIREWALL_UNIT), firewallUnit(FIREWALL_RULES_PATH), { mode: 420 });
+      must("systemctl", ["daemon-reload"], "Loading the firewall unit");
+      must("systemctl", ["enable", FIREWALL_UNIT], "Enabling the firewall unit");
+      must("systemctl", ["restart", FIREWALL_UNIT], "Applying the session firewall");
+      return `Applied, with DNS to ${[...new Set(resolvers)].join(", ") || "no resolver found"}.`;
+    }
+    case "launcher": {
+      if (!release.sessionImage) throw new StepFailure("This package names no session image, so it is not a published release.");
+      const repository = release.sessionImage.split("@")[0];
+      const sessionUid = idOf(SESSION_USER, "-u");
+      const sessionGid = idOf(SESSION_USER, "-g");
+      const ownerUid = idOf(OWNER_USER, "-u");
+      if (sessionUid === null || sessionGid === null || ownerUid === null) throw new StepFailure("The service users do not exist.");
+      for (const dir of ["/usr/local/lib/kilogent", "/etc/kilogent", "/var/lib/kilogent", SESSIONS_ROOT]) {
+        fs3.mkdirSync(dir, { recursive: true, mode: 493 });
+        fs3.chownSync(dir, 0, 0);
+        fs3.chmodSync(dir, 493);
+      }
+      const staged = `${LAUNCHER_PATH}.new`;
+      fs3.copyFileSync(path2.join(release.root, "dist/kg-session-launcher.mjs"), staged);
+      fs3.chownSync(staged, 0, 0);
+      fs3.chmodSync(staged, 493);
+      fs3.renameSync(staged, LAUNCHER_PATH);
+      const settings = {
+        repository,
+        runtime: "runsc",
+        network: SESSION_BRIDGE,
+        sessionUid,
+        sessionGid,
+        ownerUid,
+        sessionsRoot: SESSIONS_ROOT,
+        requireRuntime: true,
+        // What sessions may REALLY use at once: the machine's memory less the host's own share. The launcher
+        // refuses a raise past it, so growing sessions never run the machine out of memory.
+        sessionCapMb: Math.max(1024, Math.floor(os2.totalmem() / (1024 * 1024)) - HOST_RESERVE_MB)
+      };
+      fs3.writeFileSync(LAUNCHER_SETTINGS_PATH, `${JSON.stringify(settings, null, 2)}
+`, { mode: 420 });
+      return step.action === "check" ? `The session launcher is this release's; its settings were written again, for ${repository}.` : `Installed at ${LAUNCHER_PATH}, for ${repository}.`;
+    }
+    case "sudoers": {
+      if (step.action === "check") return step.why;
+      const staged = `${SUDOERS_PATH}.new`;
+      fs3.writeFileSync(staged, sudoersLine(OWNER_USER, LAUNCHER_PATH), { mode: 288 });
+      const checked = run("visudo", ["-cf", staged]);
+      if (!checked.ok) {
+        fs3.rmSync(staged, { force: true });
+        throw new StepFailure(`visudo refused the sudoers line: ${checked.err.trim().slice(0, 200)}`);
+      }
+      fs3.renameSync(staged, SUDOERS_PATH);
+      return step.why;
+    }
+    case "hold":
+      if (ctx.installed.length === 0) return "Nothing was installed this run; what an earlier run held stays held.";
+      must("apt-mark", ["hold", ...ctx.installed], "Holding the installed packages");
+      return `Held: ${ctx.installed.join(", ")}.`;
+    case "wait":
+      return waitForReadiness(release);
+  }
+}
+function waitForReadiness(release) {
+  const file = path2.join(OWNER_HOME, `.${release.bin}`, "readiness.json");
+  let last = "";
+  for (let i = 0; i < 60; i += 1) {
+    const doc = readText(file);
+    if (doc) {
+      try {
+        const run2 = JSON.parse(doc).run;
+        const notOk = (run2?.items ?? []).filter((item) => item.state !== "ok").map((item) => `${item.id} ${item.state}`);
+        const line = notOk.length ? `Not ready yet: ${notOk.join(", ")}.` : "Every readiness item is ok.";
+        if (line !== last) say(`   ${line}`);
+        last = line;
+        if (!notOk.length) return "The server reports ready.";
+      } catch {
+      }
+    }
+    spawnSync("sleep", ["5"]);
+  }
+  return last ? `${last} See \`${release.bin} doctor\` as ${OWNER_USER}, and the Fleet page.` : "The server has not reported yet. See the Fleet page.";
+}
+function readCode(options) {
+  if (options.codeStdin) return fs3.readFileSync(0, "utf8").trim() || null;
+  let fd;
+  try {
+    fd = fs3.openSync("/dev/tty", "r+");
+  } catch {
+    return null;
+  }
+  fs3.writeSync(fd, "Enrolment code (from the Fleet page): ");
+  spawnSync("stty", ["-echo"], { stdio: [fd, "ignore", "ignore"] });
+  const buf = Buffer.alloc(1);
+  let code = "";
+  try {
+    while (fs3.readSync(fd, buf, 0, 1, null) === 1 && buf[0] !== 10) code += buf.toString("utf8");
+  } finally {
+    spawnSync("stty", ["echo"], { stdio: [fd, "ignore", "ignore"] });
+    fs3.writeSync(fd, "\n");
+    fs3.closeSync(fd);
+  }
+  return code.trim() || null;
+}
+function confirm() {
+  let fd;
+  try {
+    fd = fs3.openSync("/dev/tty", "r+");
+  } catch {
+    return false;
+  }
+  fs3.writeSync(fd, "Go ahead? [y/N] ");
+  const buf = Buffer.alloc(64);
+  const n = fs3.readSync(fd, buf, 0, buf.length, null);
+  fs3.closeSync(fd);
+  return /^y(es)?$/i.test(buf.subarray(0, n).toString("utf8").trim());
+}
+function writeHostState(release, results, notes) {
+  try {
+    fs3.mkdirSync(path2.dirname(HOST_STATE_PATH), { recursive: true, mode: 493 });
+    fs3.writeFileSync(HOST_STATE_PATH, `${JSON.stringify({ version: 1, release: release.version, at: Date.now(), steps: results, ...notes }, null, 2)}
+`, { mode: 420 });
+  } catch {
+  }
+}
+var HOST_PACKAGES = ["docker-ce", "docker-ce-cli", "containerd.io", "runsc", "nodejs"];
+function drainServer(release, now) {
+  const dir = path2.join(OWNER_HOME, `.${release.bin}`);
+  const uid = idOf(OWNER_USER, "-u");
+  const gid = idOf(OWNER_USER, "-g");
+  if (!fs3.existsSync(dir) || uid === null || gid === null) return null;
+  const file = path2.join(dir, DRAIN_REQUEST_FILE);
+  const request = { at: Date.now(), reason: "provision --upgrade-host" };
+  fs3.writeFileSync(file, `${JSON.stringify(request)}
+`, { mode: 384 });
+  fs3.chownSync(file, uid, gid);
+  if (now) return file;
+  const stateFile = path2.join(dir, "fleet-state.json");
+  let said = "";
+  for (let waited = 0; waited < 45 * 6e4; waited += 5e3) {
+    const progress = drainProgress(readFleetState(stateFile), { requestedAt: request.at, now: Date.now(), staleMs: FLEET_STATE_STALE_MS });
+    if (progress.state !== "waiting") return file;
+    const line = `Waiting for ${progress.running} running job(s) to finish (--now does not wait)\u2026`;
+    if (line !== said) say(`   ${line}`);
+    said = line;
+    spawnSync("sleep", ["5"]);
+  }
+  fs3.rmSync(file, { force: true });
+  throw new StepFailure("Jobs were still running after 45 minutes, so nothing was upgraded. Run it again, or with --now.");
+}
+function startStoppedDocker() {
+  if (!run("sh", ["-c", "command -v docker"]).ok) return;
+  if (run("docker", ["version", "--format", "{{.Server.Version}}"], { timeout: 2e4 }).ok) return;
+  if (!run("systemctl", ["cat", "docker.service"]).ok) return;
+  say("Docker is installed and stopped; starting it.");
+  run("systemctl", ["start", "docker"], { timeout: 12e4 });
+  for (let i = 0; i < 30; i += 1) {
+    if (run("docker", ["version", "--format", "{{.Server.Version}}"], { timeout: 1e4 }).ok) return;
+    spawnSync("sleep", ["1"]);
+  }
+}
+function upgradeHostPackages(only = []) {
+  const unknown = only.filter((name) => !HOST_PACKAGES.includes(name));
+  if (unknown.length) {
+    throw new StepFailure(`--upgrade-host names ${unknown.join(", ")}, which provision does not install. It installs: ${HOST_PACKAGES.join(", ")}.`);
+  }
+  const wanted = only.length ? HOST_PACKAGES.filter((pkg) => only.includes(pkg)) : HOST_PACKAGES;
+  const installed = wanted.filter((pkg) => run("dpkg-query", ["-W", "-f=${Status}", pkg]).out.includes("ok installed"));
+  if (installed.length === 0) {
+    return only.length ? `${only.join(", ")} ${only.length === 1 ? "is" : "are"} not installed here; nothing to upgrade.` : "None of the packages provision installs are here; nothing to upgrade.";
+  }
+  const held = run("apt-mark", ["showhold"]).out.split("\n").map((l) => l.trim()).filter((p) => installed.includes(p));
+  if (held.length) must("apt-mark", ["unhold", ...held], "Releasing the held packages");
+  try {
+    must("apt-get", ["update"], "apt-get update");
+    must("apt-get", ["install", "-y", "--only-upgrade", ...installed], "Upgrading the host packages");
+  } finally {
+    if (held.length) must("apt-mark", ["hold", ...held], "Holding the packages again");
+  }
+  return `Upgraded ${installed.join(", ")}.`;
+}
+async function main() {
+  if (process.platform !== "linux") {
+    say("provision-root runs on a Linux server. On the dev Mac, run `npx <package>@<version> provision` as the runner user.");
+    process.exit(1);
+  }
+  if (typeof process.getuid !== "function" || process.getuid() !== 0) {
+    say("Run this as root.");
+    process.exit(1);
+  }
+  process.umask(18);
+  const options = parseArgs(process.argv.slice(2));
+  const release = thisRelease();
+  let drainFile = null;
+  if (options.upgradeHost) {
+    options.hostOnly = true;
+    if (!options.yes && !confirm()) {
+      say("Nothing was changed.");
+      process.exit(1);
+    }
+    options.yes = true;
+    try {
+      drainFile = drainServer(release, options.now);
+      say(`\u2713 drain: ${drainFile ? "no jobs are running." : "no runner is set up here, so there is nothing to drain."}`);
+      say(`\u2713 upgrade: ${upgradeHostPackages(options.upgradeOnly)}`);
+    } catch (e) {
+      if (drainFile) fs3.rmSync(drainFile, { force: true });
+      say(`\u2717 ${e instanceof Error ? e.message : String(e)}`);
+      process.exit(1);
+    }
+    process.on("exit", () => {
+      if (drainFile) fs3.rmSync(drainFile, { force: true });
+    });
+  }
+  if (!options.planOnly) startStoppedDocker();
+  const facts = gatherFacts(release);
+  const plan = planLinuxProvision(facts, {
+    version: release.version,
+    launcherSha256: release.launcherSha256,
+    expectedSudoers: sudoersLine(OWNER_USER, LAUNCHER_PATH),
+    hostOnly: options.hostOnly,
+    reEnrol: options.reEnrol
+  });
+  say(`Kilogent server provisioning \u2014 ${release.name}@${release.version}`);
+  if (plan.refusal) {
+    say(`\u2717 ${plan.refusal}`);
+    say("Nothing was changed.");
+    process.exit(1);
+  }
+  for (const step of plan.steps) say(`  ${step.action === "do" ? "\u2022" : step.action === "check" ? "\u2713" : "\u2013"} ${step.id}: ${step.why}`);
+  if (options.planOnly) {
+    say("That is the plan. Nothing was changed.");
+    process.exit(0);
+  }
+  if (!options.hostOnly && (!/^[a-z0-9-]{1,64}$/.test(options.project) || !/^[A-Za-z0-9_-]{1,128}$/.test(options.apiKey))) {
+    say("\u2717 --project and --api-key are required. The Fleet page prints the whole command.");
+    process.exit(1);
+  }
+  if (!options.yes && !confirm()) {
+    say("Nothing was changed.");
+    process.exit(1);
+  }
+  const enrols = plan.steps.some((s) => s.id === "enrol" && s.action === "do");
+  const code = enrols ? readCode(options) : null;
+  if (enrols && !code) {
+    say("\u2717 No enrolment code was given. Nothing was changed.");
+    process.exit(1);
+  }
+  const results = [];
+  const notes = {};
+  const ctx = { release, options, code, installed: [], notes };
+  for (const step of plan.steps) {
+    try {
+      const detail = await runStep(step, ctx);
+      results.push({ id: step.id, action: step.action, ok: true, detail });
+      say(`\u2713 ${step.id}: ${detail}`);
+    } catch (e) {
+      const detail = e instanceof Error ? e.message : String(e);
+      results.push({ id: step.id, action: step.action, ok: false, detail });
+      say(`\u2717 ${step.id}: ${detail}`);
+      writeHostState(release, results, notes);
+      if (!results.some((r) => r.id === "service" && r.ok) && !options.hostOnly) break;
+      if (options.hostOnly && ["docker", "gvisor", "daemon-json"].includes(step.id)) break;
+    }
+    writeHostState(release, results, notes);
+  }
+  const code_ = provisionExitCode(results);
+  say(
+    code_ === 0 ? "Done. This server is set up." : code_ === 2 ? `The server is running, and a host step failed. Fix what is named above, then run this again.` : "Provisioning stopped before the server was running. Fix what is named above, then run this again."
+  );
+  process.exit(code_);
+}
+void main();
+export {
+  APT_KEY_FINGERPRINTS
+};