@paperclipai/plugin-kubernetes 0.1.0 → 2026.620.0-canary.11

package/dist/upload-interceptor.js

@@ -0,0 +1,114 @@
+/**
+ * Fast-upload interceptor for the chunked-shell file transfer protocol used by
+ * `@paperclipai/adapter-utils`'s `command-managed-runtime.writeFile()`.
+ *
+ * The default protocol uploads a binary file by:
+ *   1. INIT:     mkdir -p '<DIR>' && rm -f '<B64>' && : > '<B64>'
+ *   2. CHUNKS:   printf '%s' '<base64-chunk>' >> '<B64>'   (repeated N times)
+ *   3. FINALIZE: base64 -d < '<B64>' > '<TARGET>' && rm -f '<B64>'
+ *
+ * Where `<B64>` is `<TARGET>.paperclip-upload.b64`. Over k8s exec each call costs
+ * ~50-100ms (new WebSocket + container exec), so N chunks = N round trips. For
+ * a 1MB payload split into 64KB base64 chunks that's ~250 round trips.
+ *
+ * This interceptor short-circuits the protocol entirely:
+ *   - INIT: capture `<B64>`, start a buffer, RESPOND success without exec.
+ *   - CHUNK: append the literal base64 chunk to the buffer, RESPOND success.
+ *   - FINALIZE: decode the buffered base64 → bytes → one exec `cat > '<TARGET>'`
+ *               with stdin = bytes. Drop intermediate `.b64` entirely.
+ *
+ * If any step doesn't match the protocol exactly, we abandon the buffer and let
+ * the caller go through the slow path (passthrough). This keeps the optimization
+ * **transparent and safe**: pattern drift → graceful fallback.
+ *
+ * Reference: see packages/adapter-utils/src/command-managed-runtime.ts.
+ */
+import { posix as pathPosix } from "node:path";
+const INIT_RE = /^mkdir -p '([^']+)' && rm -f '([^']+)\.paperclip-upload\.b64' && : > '\2\.paperclip-upload\.b64'$/;
+const CHUNK_RE = /^printf '%s' '([A-Za-z0-9+/=]+)' >> '([^']+)\.paperclip-upload\.b64'$/;
+const FINALIZE_RE = /^base64 -d < '([^']+)\.paperclip-upload\.b64' > '\1' && rm -f '\1\.paperclip-upload\.b64'$/;
+const MAX_BUFFER_BYTES = 100 * 1024 * 1024; // 100MB safety cap
+/**
+ * Stateful interceptor. Keyed by the base64 temp path (`<TARGET>.paperclip-upload.b64`).
+ * One instance per plugin worker is fine — concurrent uploads to different paths
+ * don't interfere.
+ */
+export class FastUploadInterceptor {
+    buffers = new Map();
+    /**
+     * Inspect a single shell command (the literal argument to `sh -c <cmd>`).
+     * Returns the action the plugin should take.
+     */
+    decide(command) {
+        // 1. INIT
+        const initMatch = INIT_RE.exec(command);
+        if (initMatch) {
+            const dir = initMatch[1];
+            const targetPath = initMatch[2];
+            const b64Path = `${targetPath}.paperclip-upload.b64`;
+            // Sanity: dir should be the parent of target. If not, fall through.
+            if (pathPosix.dirname(targetPath) !== dir) {
+                return { action: "passthrough", reason: "init dir/target mismatch" };
+            }
+            this.buffers.set(b64Path, { targetPath, chunks: [], totalChars: 0 });
+            return { action: "ack", reason: `init upload to ${targetPath}` };
+        }
+        // 2. CHUNK
+        const chunkMatch = CHUNK_RE.exec(command);
+        if (chunkMatch) {
+            const base64 = chunkMatch[1];
+            const targetPath = chunkMatch[2];
+            const b64Path = `${targetPath}.paperclip-upload.b64`;
+            const state = this.buffers.get(b64Path);
+            if (!state) {
+                // Chunk arrived without init — must passthrough (the upload was started
+                // some other way, perhaps before we started tracking).
+                return { action: "passthrough", reason: "chunk without prior init" };
+            }
+            if (state.totalChars + base64.length > MAX_BUFFER_BYTES * 4 / 3) {
+                // base64 is ~4/3 of binary size; cap memory.
+                this.buffers.delete(b64Path);
+                return { action: "passthrough", reason: "buffer cap exceeded" };
+            }
+            state.chunks.push(base64);
+            state.totalChars += base64.length;
+            return { action: "ack", reason: `buffered ${base64.length} b64 chars` };
+        }
+        // 3. FINALIZE
+        const finalizeMatch = FINALIZE_RE.exec(command);
+        if (finalizeMatch) {
+            const targetPath = finalizeMatch[1];
+            const b64Path = `${targetPath}.paperclip-upload.b64`;
+            const state = this.buffers.get(b64Path);
+            if (!state) {
+                return { action: "passthrough", reason: "finalize without buffered state" };
+            }
+            this.buffers.delete(b64Path);
+            // Decode in one go. base64.decode handles concatenated base64 strings
+            // because each chunk was emitted from the encoder in fixed-size pieces.
+            const joined = state.chunks.join("");
+            const payload = Buffer.from(joined, "base64");
+            return {
+                action: "flush",
+                flush: {
+                    targetPath: state.targetPath,
+                    payload,
+                },
+            };
+        }
+        return { action: "passthrough", reason: "no upload pattern" };
+    }
+    /**
+     * Drop all buffered state. Called on releaseLease so a new lease doesn't
+     * inherit stale buffers (lease IDs are unique so target paths shouldn't
+     * collide, but cleanup is hygiene).
+     */
+    reset() {
+        this.buffers.clear();
+    }
+    /** Number of in-flight uploads being tracked. Mostly for tests / diagnostics. */
+    get pendingCount() {
+        return this.buffers.size;
+    }
+}
+//# sourceMappingURL=upload-interceptor.js.map

package/dist/upload-interceptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload-interceptor.js","sourceRoot":"","sources":["../src/upload-interceptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAE/C,MAAM,OAAO,GACX,mGAAmG,CAAC;AACtG,MAAM,QAAQ,GACZ,uEAAuE,CAAC;AAC1E,MAAM,WAAW,GACf,4FAA4F,CAAC;AAE/F,MAAM,gBAAgB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,mBAAmB;AAuB/D;;;;GAIG;AACH,MAAM,OAAO,qBAAqB;IACxB,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAEjD;;;OAGG;IACH,MAAM,CAAC,OAAe;QACpB,UAAU;QACV,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YAChC,MAAM,OAAO,GAAG,GAAG,UAAU,uBAAuB,CAAC;YACrD,oEAAoE;YACpE,IAAI,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC1C,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;YACvE,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;YACrE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,UAAU,EAAE,EAAE,CAAC;QACnE,CAAC;QAED,WAAW;QACX,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC7B,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YACjC,MAAM,OAAO,GAAG,GAAG,UAAU,uBAAuB,CAAC;YACrD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACxC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,wEAAwE;gBACxE,uDAAuD;gBACvD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;YACvE,CAAC;YACD,IAAI,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,MAAM,GAAG,gBAAgB,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChE,6CAA6C;gBAC7C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC7B,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;YAClE,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1B,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC;YAClC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,MAAM,CAAC,MAAM,YAAY,EAAE,CAAC;QAC1E,CAAC;QAED,cAAc;QACd,MAAM,aAAa,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;YACpC,MAAM,OAAO,GAAG,GAAG,UAAU,uBAAuB,CAAC;YACrD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACxC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;YAC9E,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC7B,sEAAsE;YACtE,wEAAwE;YACxE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACrC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC9C,OAAO;gBACL,MAAM,EAAE,OAAO;gBACf,KAAK,EAAE;oBACL,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,OAAO;iBACR;aACF,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAChE,CAAC;IAED;;;;OAIG;IACH,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED,iFAAiF;IACjF,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;CACF"}

package/dist/utils.d.ts

@@ -0,0 +1,11 @@
+export declare function deriveCompanySlug(input: string): string;
+export declare function deriveNamespaceName(prefix: string, slug: string): string;
+export declare function newRunUlidDns(now?: () => number): string;
+export interface LabelsInput {
+    runId: string;
+    agentId: string;
+    companyId: string;
+    adapterType: string;
+}
+export declare function paperclipLabels(input: LabelsInput): Record<string, string>;
+//# sourceMappingURL=utils.d.ts.map

package/dist/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAQA,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAevD;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAExE;AAED,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAM,MAAiB,GAAG,MAAM,CAclE;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQ1E"}

package/dist/utils.js

@@ -0,0 +1,51 @@
+import { createHash, randomInt } from "node:crypto";
+const ULID_ALPHABET = "0123456789abcdefghjkmnpqrstvwxyz";
+// Namespace names are capped at 63 chars (RFC 1123). The default "paperclip-"
+// prefix leaves 53 for the slug, which fits a full 36-char UUID untruncated.
+const MAX_SLUG_LENGTH = 53;
+export function deriveCompanySlug(input) {
+    const slug = input
+        .toLowerCase()
+        .replace(/[^a-z0-9-]+/g, "-")
+        .replace(/^-+|-+$/g, "")
+        .replace(/-+$/, "");
+    if (slug.length === 0)
+        return "company";
+    if (slug.length <= MAX_SLUG_LENGTH)
+        return slug;
+    // Never drop entropy by plain truncation: two long inputs sharing a prefix
+    // (e.g. UUIDs differing only in their tail) must not map to the same slug,
+    // or the tenants would share a namespace and each other's per-run Secrets.
+    // Keep a readable head and append a hash of the FULL input so every byte
+    // contributes to the final name.
+    const digest = createHash("sha256").update(input).digest("hex").slice(0, 8);
+    return `${slug.slice(0, MAX_SLUG_LENGTH - 9).replace(/-+$/, "")}-${digest}`;
+}
+export function deriveNamespaceName(prefix, slug) {
+    return `${prefix}${slug}`;
+}
+export function newRunUlidDns(now = Date.now) {
+    const timestamp = now();
+    let out = "";
+    let t = timestamp;
+    for (let i = 0; i < 10; i++) {
+        out = ULID_ALPHABET[t & 0x1f] + out;
+        t = Math.floor(t / 32);
+    }
+    for (let i = 0; i < 16; i++) {
+        // crypto-strength randomness: these become Job/Sandbox CR names and the
+        // providerLeaseId, so they must not be enumerable.
+        out += ULID_ALPHABET[randomInt(32)];
+    }
+    return out;
+}
+export function paperclipLabels(input) {
+    return {
+        "paperclip.io/run-id": input.runId,
+        "paperclip.io/agent-id": input.agentId,
+        "paperclip.io/company-id": input.companyId,
+        "paperclip.io/adapter": input.adapterType,
+        "paperclip.io/managed-by": "paperclip-k8s-plugin",
+    };
+}
+//# sourceMappingURL=utils.js.map

package/dist/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAEpD,MAAM,aAAa,GAAG,kCAAkC,CAAC;AAEzD,8EAA8E;AAC9E,6EAA6E;AAC7E,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,MAAM,IAAI,GAAG,KAAK;SACf,WAAW,EAAE;SACb,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;SAC5B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,IAAI,CAAC,MAAM,IAAI,eAAe;QAAE,OAAO,IAAI,CAAC;IAChD,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,iCAAiC;IACjC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5E,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,MAAM,EAAE,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,IAAY;IAC9D,OAAO,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAoB,IAAI,CAAC,GAAG;IACxD,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC,GAAG,SAAS,CAAC;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,GAAG,GAAG,aAAa,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC;QACpC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IACzB,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,wEAAwE;QACxE,mDAAmD;QACnD,GAAG,IAAI,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AASD,MAAM,UAAU,eAAe,CAAC,KAAkB;IAChD,OAAO;QACL,qBAAqB,EAAE,KAAK,CAAC,KAAK;QAClC,uBAAuB,EAAE,KAAK,CAAC,OAAO;QACtC,yBAAyB,EAAE,KAAK,CAAC,SAAS;QAC1C,sBAAsB,EAAE,KAAK,CAAC,WAAW;QACzC,yBAAyB,EAAE,sBAAsB;KAClD,CAAC;AACJ,CAAC"}

package/dist/worker.d.ts

@@ -0,0 +1,3 @@
+import plugin from "./plugin.js";
+export default plugin;
+//# sourceMappingURL=worker.d.ts.map

package/dist/worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../src/worker.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,eAAe,MAAM,CAAC"}

package/dist/worker.js

@@ -0,0 +1,5 @@
+import { runWorker } from "@paperclipai/plugin-sdk";
+import plugin from "./plugin.js";
+export default plugin;
+runWorker(plugin, import.meta.url);
+//# sourceMappingURL=worker.js.map

package/dist/worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.js","sourceRoot":"","sources":["../src/worker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,eAAe,MAAM,CAAC;AACtB,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paperclipai/plugin-kubernetes",
-  "version": "0.1.0",
+  "version": "2026.620.0-canary.11",
   "description": "Kubernetes sandbox provider plugin for Paperclip environments",
   "license": "MIT",
   "homepage": "https://github.com/paperclipai/paperclip",
@@ -22,15 +22,7 @@
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "publishConfig": {
-    "access": "public",
-    "exports": {
-      ".": {
-        "types": "./dist/index.d.ts",
-        "import": "./dist/index.js"
-      }
-    },
-    "main": "./dist/index.js",
-    "types": "./dist/index.d.ts"
+    "access": "public"
   },
   "files": [
     "dist",
@@ -50,6 +42,6 @@
   "dependencies": {
     "@kubernetes/client-node": "^1.0.0",
     "zod": "^3.24.2",
-    "@paperclipai/plugin-sdk": "1.0.0"
+    "@paperclipai/plugin-sdk": "2026.620.0-canary.11"
   }
-}
+}