@outerlayer/cli 0.6.0 → 0.8.0

package/dist/chunk-5TNS3PL7.js

@@ -0,0 +1,263 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { BUILDKIT_IMAGE } from './chunk-CX22S5BA.js';
+import { compareVersions } from './chunk-GAYWY4GI.js';
+import { parseSize } from './chunk-7RQ73DLO.js';
+import { JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_PORT, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-OD2VTIHN.js';
+import { runnerDir } from './chunk-ZM2IMMYN.js';
+import { createHash } from 'crypto';
+import { realpathSync } from 'fs';
+import { join, dirname, resolve } from 'path';
+
+createRequire(import.meta.url);
+var BUILD_LABEL = "ai.outerlayer.build";
+var RUNNER_LABEL = "ai.outerlayer.runner";
+function resolvedRunnerDir(configPath) {
+  try {
+    return realpathSync(runnerDir(configPath));
+  } catch {
+    try {
+      return join(realpathSync(dirname(resolve(configPath))), "runner");
+    } catch {
+      return resolve(runnerDir(configPath));
+    }
+  }
+}
+function runnerLabelValue(configPath) {
+  return createHash("sha256").update(resolvedRunnerDir(configPath)).digest("hex").slice(0, 12);
+}
+function hardened(input) {
+  const { memory, cpus, pids } = input.limits;
+  return [
+    "--label",
+    `${BUILD_LABEL}=${input.buildId}`,
+    "--label",
+    `${RUNNER_LABEL}=${input.runnerId}`,
+    "--network",
+    "none",
+    "--cap-drop",
+    "ALL",
+    "--security-opt",
+    "no-new-privileges",
+    "--read-only",
+    "--user",
+    input.user,
+    // The same figure for swap as for memory leaves the container none.
+    "--memory",
+    memory,
+    "--memory-swap",
+    memory,
+    "--cpus",
+    String(cpus),
+    "--pids-limit",
+    String(pids)
+  ];
+}
+function mountPath(path) {
+  if (/[",]/.test(path)) throw new Error(`${path} holds a comma or a quote, which a Docker mount cannot carry; move the runner's config file`);
+  return path;
+}
+function containerRunArgs(input) {
+  return [
+    "--detach",
+    "--name",
+    input.container,
+    ...hardened(input),
+    "--mount",
+    `type=volume,src=${input.volume},dst=/build`,
+    // `/tmp` is a directory of the same volume, so it is measured and limited with the rest of the build.
+    "--mount",
+    `type=volume,src=${input.volume},dst=/tmp,volume-subpath=tmp`,
+    "--mount",
+    `type=bind,src=${mountPath(input.buildDir)},dst=${JOB_MOUNT},readonly`,
+    "--entrypoint",
+    "/opt/outerlayer/bin/tini",
+    input.image,
+    "--",
+    "/opt/outerlayer/bin/node",
+    "/opt/outerlayer/cli/dist/index.js",
+    "broker-relay",
+    "--port",
+    String(RELAY_PORT),
+    "--socket",
+    `${JOB_MOUNT}/tunnel.sock`,
+    ...Array.from({ length: input.destinations ?? 0 }, (_unused, index) => [
+      "--forward",
+      `${DESTINATION_BASE_PORT + index}=${JOB_MOUNT}/dest-${index}.sock`
+    ]).flat(),
+    ...input.builtIns === true ? [
+      "--forward",
+      `${GATEWAY_PORT}=${JOB_MOUNT}/${GATEWAY_SOCKET}`,
+      "--forward",
+      `${CLAUDE_PORT}=${JOB_MOUNT}/${CLAUDE_SOCKET}`
+    ] : []
+  ];
+}
+function prepareRunArgs(input) {
+  return [
+    "--rm",
+    ...hardened(input),
+    "--mount",
+    `type=volume,src=${input.volume},dst=/build`,
+    "--entrypoint",
+    "mkdir",
+    input.image,
+    "-p",
+    "-m",
+    "1777",
+    "/build/tmp",
+    "/build/home",
+    "/build/work"
+  ];
+}
+function containerExecArgs(input) {
+  const literals = Object.keys(input.env.literals).sort().flatMap((name) => ["-e", `${name}=${input.env.literals[name]}`]);
+  const passed = Object.keys(input.env.passed).filter((name) => input.env.passed[name] !== void 0).sort().flatMap((name) => ["-e", name]);
+  return [
+    "-u",
+    input.user,
+    ...input.workdir === void 0 ? [] : ["-w", input.workdir],
+    ...literals,
+    ...passed,
+    input.container,
+    ...input.argv
+  ];
+}
+
+// src/runner/image/builder.ts
+var MIN_BUILDX_VERSION = "0.18.0";
+var INSTALL_HINT = "install Docker's Buildx plugin (docker-buildx-plugin on Debian and Ubuntu with Docker's apt repository, docker-buildx on Ubuntu's own packages)";
+function builderName(configPath) {
+  return `outerlayer-${runnerLabelValue(configPath)}`;
+}
+function proxyEnvironment(env) {
+  const found = {};
+  for (const name of ["HTTP_PROXY", "HTTPS_PROXY", "NO_PROXY", "http_proxy", "https_proxy", "no_proxy"]) {
+    const value = env[name];
+    if (value !== void 0 && value !== "") found[name] = value;
+  }
+  return found;
+}
+function builderSpec(configPath, memory, env) {
+  return { name: builderName(configPath), memory, env: proxyEnvironment(env) };
+}
+function driverOpt(pair) {
+  return /[",]/.test(pair) ? `"${pair.replace(/"/g, '""')}"` : pair;
+}
+async function buildxState(run) {
+  const result = await run("docker", ["buildx", "version"]);
+  if (result.status !== 0) {
+    const said = (result.stderr.trim() || result.stdout.trim()).split("\n")[0] ?? "";
+    return { problem: `docker buildx is not available${said === "" ? "" : ` (${said})`}, so image builds cannot be limited; ${INSTALL_HINT}` };
+  }
+  const version = /\bv?(\d+\.\d+\.\d+)/.exec(result.stdout)?.[1];
+  if (version !== void 0 && compareVersions(version, MIN_BUILDX_VERSION) < 0) {
+    return { problem: `docker buildx ${version} is too old: the runner's image builder needs Buildx ${MIN_BUILDX_VERSION} or later; update ${INSTALL_HINT}` };
+  }
+  return "usable";
+}
+function isOutOfMemory(output) {
+  if (/cannot allocate memory/i.test(output)) return true;
+  if (/did not complete successfully: (exit code: 137|signal: killed)/i.test(output)) return true;
+  return /ResourceExhausted/i.test(output) && !/larger than max|message size|too large/i.test(output);
+}
+var running = 0;
+async function trackImageBuild(work) {
+  running++;
+  try {
+    return await work();
+  } finally {
+    running--;
+  }
+}
+var queue = Promise.resolve();
+function serialized(work) {
+  const next = queue.then(work, work);
+  queue = next.catch(() => void 0);
+  return next;
+}
+function readExisting(inspectOutput) {
+  const options = /^Driver Options:\s*(.*)$/m.exec(inspectOutput)?.[1] ?? "";
+  const option = (key) => new RegExp(`(?:^|\\s)${key}="([^"]*)"`).exec(options)?.[1];
+  return { driver: /^Driver:\s*(\S+)/m.exec(inspectOutput)?.[1], memory: option("memory"), image: option("image") };
+}
+function sameMemory(found, wanted) {
+  return (parseSize(found) ?? found) === (parseSize(wanted) ?? wanted);
+}
+var IDLE_POLL_MS = 1e3;
+var failures = 0;
+function ensureFailureCount() {
+  return failures;
+}
+function ensureBuilder(rawRun, spec, options = {}) {
+  const run = (command, args, opts) => rawRun(command, args, { ...opts, timeoutMs: args.includes("--bootstrap") ? 15 * 6e4 : 2 * 6e4 });
+  const result = serialized(async () => {
+    const state = await buildxState(run);
+    if (state !== "usable") return { ok: false, problem: state.problem };
+    const sleep = options.sleep ?? ((ms) => new Promise((resolve2) => setTimeout(resolve2, ms)));
+    const inspected = await run("docker", ["buildx", "inspect", spec.name]);
+    let create = inspected.status !== 0;
+    if (!create) {
+      const found = readExisting(inspected.stdout);
+      const current = found.driver === "docker-container" && sameMemory(found.memory ?? "", spec.memory) && found.image === BUILDKIT_IMAGE;
+      if (!current && options.replaceStale === false) {
+        return {
+          ok: false,
+          problem: `the image builder ${spec.name} was made with other settings than runner.build.memory (${spec.memory}) and the pinned BuildKit image; the runner service replaces it when no build is running, or remove it with docker buildx rm ${spec.name}`
+        };
+      }
+      if (!current) {
+        if (options.waitForIdle === true) while (running > 0) await sleep(IDLE_POLL_MS);
+        if (running === 0) {
+          const removed = await run("docker", ["buildx", "rm", spec.name]);
+          if (removed.status !== 0) return { ok: false, problem: `could not replace the image builder ${spec.name}: ${removed.stderr.trim() || `docker exited ${removed.status}`}` };
+          create = true;
+        }
+      }
+    }
+    if (create) {
+      const opts = [
+        `memory=${spec.memory}`,
+        `memory-swap=${spec.memory}`,
+        `image=${BUILDKIT_IMAGE}`,
+        ...Object.entries(spec.env ?? {}).map(([name, value]) => `env.${name}=${value}`),
+        ...spec.driverOpts ?? []
+      ];
+      const created = await run("docker", [
+        "buildx",
+        "create",
+        "--name",
+        spec.name,
+        "--driver",
+        "docker-container",
+        ...opts.flatMap((opt) => ["--driver-opt", driverOpt(opt)])
+      ]);
+      if (created.status !== 0) {
+        const said = created.stderr.trim() || `docker exited ${created.status}`;
+        if (/failed to find driver/i.test(said)) {
+          return { ok: false, problem: `this Docker's Buildx has no docker-container driver, so image builds cannot be limited; ${INSTALL_HINT}` };
+        }
+        return { ok: false, problem: `could not create the image builder ${spec.name}: ${said}` };
+      }
+    }
+    if (options.bootstrap === true) {
+      const started = await run("docker", ["buildx", "inspect", "--bootstrap", spec.name]);
+      if (started.status !== 0) {
+        return { ok: false, problem: `the image builder ${spec.name} did not start: ${started.stderr.trim() || `docker exited ${started.status}`}` };
+      }
+    }
+    return { ok: true, changed: create };
+  });
+  return result.then(
+    (outcome) => {
+      if (!outcome.ok) failures++;
+      return outcome;
+    },
+    (err) => {
+      failures++;
+      throw err;
+    }
+  );
+}
+
+export { BUILD_LABEL, MIN_BUILDX_VERSION, RUNNER_LABEL, builderName, builderSpec, buildxState, containerExecArgs, containerRunArgs, ensureBuilder, ensureFailureCount, isOutOfMemory, prepareRunArgs, proxyEnvironment, runnerLabelValue, trackImageBuild };

package/dist/chunk-7RQ73DLO.js

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+
+createRequire(import.meta.url);
+
+// src/runner/container/disk.ts
+var UNITS = { "": 1, k: 1024, m: 1024 ** 2, g: 1024 ** 3 };
+function parseSize(text) {
+  const match = /^(\d+(?:\.\d+)?)([kKmMgG]?)$/.exec(text);
+  if (match === null) return void 0;
+  const bytes = Number(match[1]) * UNITS[match[2].toLowerCase()];
+  return bytes > 0 ? bytes : void 0;
+}
+function parseDuKilobytes(output) {
+  const match = /^(\d+)\s/.exec(output);
+  return match === null ? void 0 : Number(match[1]);
+}
+function exceedsDisk(usedKilobytes, limit) {
+  const bytes = parseSize(limit);
+  return usedKilobytes * 1024 > (bytes ?? Number.POSITIVE_INFINITY);
+}
+
+export { exceedsDisk, parseDuKilobytes, parseSize };