@kilogent/runner 0.1.8 → 0.1.10

package/dist/cli.js

@@ -1712,12 +1712,12 @@ import os from "node:os";
 import path from "node:path";
 
 // src/version.ts
-var RUNNER_VERSION = true ? "0.1.8" : "0.0.0-dev";
+var RUNNER_VERSION = true ? "0.1.10" : "0.0.0-dev";
 var RUNNER_PACKAGE = true ? "@kilogent/runner" : "@kilogent/runner-dev";
 var RUNNER_BIN = true ? "kilogent-runner" : "kilogent-runner-dev";
 var SESSION_IMAGE = true ? "europe-west1-docker.pkg.dev/kilogent-crew-prod/sessions/session@sha256:247ecb20c7ee497a75cb02dc8397b6db2375a04923b727ab3e673ff0eccf0559" : "";
 var RUNSC_MIN = true ? "release-20260202.0" : "";
-var LAUNCHER_SHA256 = true ? "75a75420b36364158139030300e53da806208fbbd9a8e07a80c10e48c1f87498" : "";
+var LAUNCHER_SHA256 = true ? "07d4570416e9feed4a7bd10dbd3d4eed645858e0cee5212f8883f23918b5adfb" : "";
 
 // src/config.ts
 var KNOWN_KEYS = ["apiKey", "projectId", "fleet", "mcpUrl", "notifications", "keepAwake", "autoInstallEngines"];
@@ -1750,6 +1750,13 @@ function connectedConfig(stored) {
 var IS_DEV_BUILD = RUNNER_PACKAGE.endsWith("-dev");
 var DEFAULT_PROJECT_ID = IS_DEV_BUILD ? "lumi-afb7d" : "kilogent-crew-prod";
 var DEFAULT_MCP_URL = IS_DEV_BUILD ? "https://dev-app-kilogent.web.app/mcp" : "https://app.kilogent.com/mcp";
+var FUNCTIONS_REGIONS = {
+  "lumi-afb7d": "us-central1",
+  "kilogent-crew-prod": "europe-west1"
+};
+function functionsRegionFor(projectId) {
+  return FUNCTIONS_REGIONS[projectId] ?? "us-central1";
+}
 var LEGACY_DIR_NAME = ".crew-runner";
 var DIR_NAME = `.${RUNNER_BIN}`;
 var LUMI_DIR_NAME = ".lumi-runner";
@@ -1821,7 +1828,7 @@ function engineInstallAllowed(config2) {
   return config2?.autoInstallEngines ?? TOGGLE_DEFAULTS.autoInstallEngines;
 }
 function mcpUrl(config2) {
-  return process.env.CREW_MCP_URL || config2.mcpUrl || (config2.projectId === DEFAULT_PROJECT_ID ? DEFAULT_MCP_URL : `https://us-central1-${config2.projectId}.cloudfunctions.net/workspaceMcp`);
+  return process.env.CREW_MCP_URL || config2.mcpUrl || (config2.projectId === DEFAULT_PROJECT_ID ? DEFAULT_MCP_URL : `https://${functionsRegionFor(config2.projectId)}-${config2.projectId}.cloudfunctions.net/workspaceMcp`);
 }
 
 // src/auth.ts
@@ -3774,7 +3781,7 @@ function classifyPullError(message2, code) {
   if (code === "ECONNREFUSED" || code === "ENOENT" || code === "EACCES" || /cannot connect to the docker daemon/i.test(message2)) {
     return "docker";
   }
-  if (/unauthori[sz]ed|denied|forbidden|\b401\b|\b403\b|authentication required/i.test(message2)) return "auth";
+  if (/unauthori[sz]ed|unauthenticated|denied|forbidden|\b401\b|\b403\b|authentication required/i.test(message2)) return "auth";
   if (/manifest unknown|not found|no such manifest|name unknown|\b404\b/i.test(message2)) return "registry";
   return "network";
 }
@@ -5329,7 +5336,7 @@ function functionsBaseUrl(config2) {
   return functionsBaseUrlFor(config2.projectId);
 }
 function functionsBaseUrlFor(projectId) {
-  return process.env.CREW_FUNCTIONS_URL?.replace(/\/$/, "") || `https://us-central1-${projectId}.cloudfunctions.net`;
+  return process.env.CREW_FUNCTIONS_URL?.replace(/\/$/, "") || `https://${functionsRegionFor(projectId)}-${projectId}.cloudfunctions.net`;
 }
 var CallableError = class extends Error {
   constructor(status, message2, details) {

package/dist/kg-session-launcher.mjs

@@ -53,7 +53,7 @@ function classifyPullError(message, code) {
   if (code === "ECONNREFUSED" || code === "ENOENT" || code === "EACCES" || /cannot connect to the docker daemon/i.test(message)) {
     return "docker";
   }
-  if (/unauthori[sz]ed|denied|forbidden|\b401\b|\b403\b|authentication required/i.test(message)) return "auth";
+  if (/unauthori[sz]ed|unauthenticated|denied|forbidden|\b401\b|\b403\b|authentication required/i.test(message)) return "auth";
   if (/manifest unknown|not found|no such manifest|name unknown|\b404\b/i.test(message)) return "registry";
   return "network";
 }

package/dist/provision-root.mjs

@@ -126,6 +126,7 @@ function unsupportedHostSentence(os3) {
   return `This is ${os3.id || "an unknown system"} ${os3.versionId}; provision installs on ${names}. With Docker Engine and gVisor (runsc) installed by hand, it checks them instead.`;
 }
 var RUNSC_PATH = "/usr/bin/runsc";
+var IMAGE_STORE_FEATURE = "containerd-snapshotter";
 function mergeDaemonJson(existing) {
   let doc = {};
   if (existing && existing.trim()) {
@@ -145,9 +146,22 @@ function mergeDaemonJson(existing) {
   if ("live-restore" in doc && doc["live-restore"] !== true) {
     return { ok: false, reason: "daemon.json sets live-restore to false. Provision needs it on; change it by hand if that is safe here." };
   }
-  const changed = !runsc || doc["live-restore"] !== true;
-  const next = { ...doc, runtimes: { ...runtimes, runsc: { path: RUNSC_PATH } }, "live-restore": true };
-  return { ok: true, changed, text: `${JSON.stringify(next, null, 2)}
+  const features = doc.features && typeof doc.features === "object" && !Array.isArray(doc.features) ? doc.features : {};
+  if (features[IMAGE_STORE_FEATURE] === true) {
+    return {
+      ok: false,
+      reason: `daemon.json turns on Docker's containerd image store ("${IMAGE_STORE_FEATURE}": true), which pulls the session image without its token. Set it to false by hand if nothing else on this host needs it, then run provision again.`
+    };
+  }
+  const restart = features[IMAGE_STORE_FEATURE] !== false;
+  const changed = !runsc || doc["live-restore"] !== true || restart;
+  const next = {
+    ...doc,
+    runtimes: { ...runtimes, runsc: { path: RUNSC_PATH } },
+    "live-restore": true,
+    features: { ...features, [IMAGE_STORE_FEATURE]: false }
+  };
+  return { ok: true, changed, restart, text: `${JSON.stringify(next, null, 2)}
 ` };
 }
 var SESSION_BRIDGE = "kg-sessions";
@@ -265,7 +279,13 @@ function planLinuxProvision(facts, options) {
   else add("gvisor", "root", supported ? "do" : "check", supported ? "Install gVisor from gVisor's signed repository." : "gVisor must be installed by hand here.");
   const merged = mergeDaemonJson(facts.daemonJson);
   if (!merged.ok) add("daemon-json", "root", "check", merged.reason);
-  else add("daemon-json", "root", merged.changed ? "do" : "check", merged.changed ? "Register runsc and turn live-restore on, then reload Docker (never restart it)." : "runsc is registered and live-restore is on.");
+  else
+    add(
+      "daemon-json",
+      "root",
+      merged.changed ? "do" : "check",
+      merged.changed ? "Register runsc, turn live-restore on and use the classic image store, then reload Docker \u2014 restart it only when nothing runs." : "runsc is registered, live-restore is on, and Docker uses the classic image store."
+    );
   if (facts.network.exists && facts.network.iccDisabled === true) {
     add("network", "root", "check", "The kg-sessions network exists, and its sessions cannot reach each other.");
   } else if (facts.network.exists && facts.network.attachedContainers > 0) {
@@ -579,8 +599,16 @@ async function runStep(step, ctx) {
         else fs3.rmSync("/etc/docker/daemon.json", { force: true });
         throw new StepFailure(`Docker refused the merged daemon.json, so the old one was put back: ${valid.err.trim().slice(0, 200)}`);
       }
+      const kept = backup ? `; the old file is at ${backup}` : "";
+      if (merged.restart) {
+        const containers = run("docker", ["ps", "-q"]);
+        if (containers.ok && containers.out.trim() === "") {
+          must("systemctl", ["restart", "docker"], "Restarting Docker for the classic image store");
+          return `runsc registered, live-restore on, and the classic image store in use${kept}.`;
+        }
+      }
       must("systemctl", ["reload", "docker"], "Reloading Docker");
-      return `runsc registered and live-restore on${backup ? `; the old file is at ${backup}` : ""}.`;
+      return merged.restart ? `runsc registered and live-restore on. The classic image store needs Docker restarted, and containers are running: run provision again with --upgrade-host, which lets the jobs finish first${kept}.` : `runsc registered and live-restore on${kept}.`;
     }
     case "network": {
       if (step.action === "check") {

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@kilogent/runner",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@kilogent/runner",
-      "version": "0.1.8",
+      "version": "0.1.10",
       "dependencies": {
         "@clack/prompts": "^1.7.0",
         "commander": "^15.0.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kilogent/runner",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "type": "module",
   "description": "Kilogent's internal server runner — leases the agent jobs Kilogent's scheduler places on this server and runs each as a sandboxed headless agent session. Not for customer installation.",
   "//name": "The ONLY package in this monorepo published to the public registry, so it is the one that does not follow the internal @lumi/crew-* convention: `@lumi` is not a scope we own, `@lumi.ai` is (the npm org). The workspace DIRECTORY stays packages/crew/runner — renaming the package is not renaming the folder.",