@kilogent/runner 0.1.9 → 0.1.10

package/dist/cli.js

@@ -1712,12 +1712,12 @@ import os from "node:os";
 import path from "node:path";
 
 // src/version.ts
-var RUNNER_VERSION = true ? "0.1.9" : "0.0.0-dev";
+var RUNNER_VERSION = true ? "0.1.10" : "0.0.0-dev";
 var RUNNER_PACKAGE = true ? "@kilogent/runner" : "@kilogent/runner-dev";
 var RUNNER_BIN = true ? "kilogent-runner" : "kilogent-runner-dev";
 var SESSION_IMAGE = true ? "europe-west1-docker.pkg.dev/kilogent-crew-prod/sessions/session@sha256:247ecb20c7ee497a75cb02dc8397b6db2375a04923b727ab3e673ff0eccf0559" : "";
 var RUNSC_MIN = true ? "release-20260202.0" : "";
-var LAUNCHER_SHA256 = true ? "75a75420b36364158139030300e53da806208fbbd9a8e07a80c10e48c1f87498" : "";
+var LAUNCHER_SHA256 = true ? "07d4570416e9feed4a7bd10dbd3d4eed645858e0cee5212f8883f23918b5adfb" : "";
 
 // src/config.ts
 var KNOWN_KEYS = ["apiKey", "projectId", "fleet", "mcpUrl", "notifications", "keepAwake", "autoInstallEngines"];
@@ -3781,7 +3781,7 @@ function classifyPullError(message2, code) {
   if (code === "ECONNREFUSED" || code === "ENOENT" || code === "EACCES" || /cannot connect to the docker daemon/i.test(message2)) {
     return "docker";
   }
-  if (/unauthori[sz]ed|denied|forbidden|\b401\b|\b403\b|authentication required/i.test(message2)) return "auth";
+  if (/unauthori[sz]ed|unauthenticated|denied|forbidden|\b401\b|\b403\b|authentication required/i.test(message2)) return "auth";
   if (/manifest unknown|not found|no such manifest|name unknown|\b404\b/i.test(message2)) return "registry";
   return "network";
 }

package/dist/kg-session-launcher.mjs

@@ -53,7 +53,7 @@ function classifyPullError(message, code) {
   if (code === "ECONNREFUSED" || code === "ENOENT" || code === "EACCES" || /cannot connect to the docker daemon/i.test(message)) {
     return "docker";
   }
-  if (/unauthori[sz]ed|denied|forbidden|\b401\b|\b403\b|authentication required/i.test(message)) return "auth";
+  if (/unauthori[sz]ed|unauthenticated|denied|forbidden|\b401\b|\b403\b|authentication required/i.test(message)) return "auth";
   if (/manifest unknown|not found|no such manifest|name unknown|\b404\b/i.test(message)) return "registry";
   return "network";
 }

package/dist/provision-root.mjs

@@ -126,6 +126,7 @@ function unsupportedHostSentence(os3) {
   return `This is ${os3.id || "an unknown system"} ${os3.versionId}; provision installs on ${names}. With Docker Engine and gVisor (runsc) installed by hand, it checks them instead.`;
 }
 var RUNSC_PATH = "/usr/bin/runsc";
+var IMAGE_STORE_FEATURE = "containerd-snapshotter";
 function mergeDaemonJson(existing) {
   let doc = {};
   if (existing && existing.trim()) {
@@ -145,9 +146,22 @@ function mergeDaemonJson(existing) {
   if ("live-restore" in doc && doc["live-restore"] !== true) {
     return { ok: false, reason: "daemon.json sets live-restore to false. Provision needs it on; change it by hand if that is safe here." };
   }
-  const changed = !runsc || doc["live-restore"] !== true;
-  const next = { ...doc, runtimes: { ...runtimes, runsc: { path: RUNSC_PATH } }, "live-restore": true };
-  return { ok: true, changed, text: `${JSON.stringify(next, null, 2)}
+  const features = doc.features && typeof doc.features === "object" && !Array.isArray(doc.features) ? doc.features : {};
+  if (features[IMAGE_STORE_FEATURE] === true) {
+    return {
+      ok: false,
+      reason: `daemon.json turns on Docker's containerd image store ("${IMAGE_STORE_FEATURE}": true), which pulls the session image without its token. Set it to false by hand if nothing else on this host needs it, then run provision again.`
+    };
+  }
+  const restart = features[IMAGE_STORE_FEATURE] !== false;
+  const changed = !runsc || doc["live-restore"] !== true || restart;
+  const next = {
+    ...doc,
+    runtimes: { ...runtimes, runsc: { path: RUNSC_PATH } },
+    "live-restore": true,
+    features: { ...features, [IMAGE_STORE_FEATURE]: false }
+  };
+  return { ok: true, changed, restart, text: `${JSON.stringify(next, null, 2)}
 ` };
 }
 var SESSION_BRIDGE = "kg-sessions";
@@ -265,7 +279,13 @@ function planLinuxProvision(facts, options) {
   else add("gvisor", "root", supported ? "do" : "check", supported ? "Install gVisor from gVisor's signed repository." : "gVisor must be installed by hand here.");
   const merged = mergeDaemonJson(facts.daemonJson);
   if (!merged.ok) add("daemon-json", "root", "check", merged.reason);
-  else add("daemon-json", "root", merged.changed ? "do" : "check", merged.changed ? "Register runsc and turn live-restore on, then reload Docker (never restart it)." : "runsc is registered and live-restore is on.");
+  else
+    add(
+      "daemon-json",
+      "root",
+      merged.changed ? "do" : "check",
+      merged.changed ? "Register runsc, turn live-restore on and use the classic image store, then reload Docker \u2014 restart it only when nothing runs." : "runsc is registered, live-restore is on, and Docker uses the classic image store."
+    );
   if (facts.network.exists && facts.network.iccDisabled === true) {
     add("network", "root", "check", "The kg-sessions network exists, and its sessions cannot reach each other.");
   } else if (facts.network.exists && facts.network.attachedContainers > 0) {
@@ -579,8 +599,16 @@ async function runStep(step, ctx) {
         else fs3.rmSync("/etc/docker/daemon.json", { force: true });
         throw new StepFailure(`Docker refused the merged daemon.json, so the old one was put back: ${valid.err.trim().slice(0, 200)}`);
       }
+      const kept = backup ? `; the old file is at ${backup}` : "";
+      if (merged.restart) {
+        const containers = run("docker", ["ps", "-q"]);
+        if (containers.ok && containers.out.trim() === "") {
+          must("systemctl", ["restart", "docker"], "Restarting Docker for the classic image store");
+          return `runsc registered, live-restore on, and the classic image store in use${kept}.`;
+        }
+      }
       must("systemctl", ["reload", "docker"], "Reloading Docker");
-      return `runsc registered and live-restore on${backup ? `; the old file is at ${backup}` : ""}.`;
+      return merged.restart ? `runsc registered and live-restore on. The classic image store needs Docker restarted, and containers are running: run provision again with --upgrade-host, which lets the jobs finish first${kept}.` : `runsc registered and live-restore on${kept}.`;
     }
     case "network": {
       if (step.action === "check") {

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@kilogent/runner",
-  "version": "0.1.9",
+  "version": "0.1.10",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@kilogent/runner",
-      "version": "0.1.9",
+      "version": "0.1.10",
       "dependencies": {
         "@clack/prompts": "^1.7.0",
         "commander": "^15.0.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kilogent/runner",
-  "version": "0.1.9",
+  "version": "0.1.10",
   "type": "module",
   "description": "Kilogent's internal server runner — leases the agent jobs Kilogent's scheduler places on this server and runs each as a sandboxed headless agent session. Not for customer installation.",
   "//name": "The ONLY package in this monorepo published to the public registry, so it is the one that does not follow the internal @lumi/crew-* convention: `@lumi` is not a scope we own, `@lumi.ai` is (the npm org). The workspace DIRECTORY stays packages/crew/runner — renaming the package is not renaming the folder.",