@rallycry/conveyor-agent 10.13.9 → 10.13.11

package/runtime/entrypoint.sh

@@ -34,9 +34,8 @@ start_workspace_sshd() {
 # The postgres / firebase wait moved into `conveyor-agent` (setup waitForSidecars())
 # so it gates only the project setupCommand/startCommand and never the agent's
 # thinking loop — even on-demand pods now launch the agent without blocking on the
-# slow firebase emulator. The agent keeps the same per-target deadlines learned
-# here (postgres 30s, firebase 60s). See:
-# docs/superpowers/specs/2026-06-28-agent-launch-before-sidecar-setup-design.md
+# slow firebase emulator. The agent keeps separate per-target deadlines here
+# (postgres 30s, firebase 60s).
 
 # ── Refresh agent runner to latest before launch (payload-independent) ──
 # The image version can be stale vs. what the API expects (protocol/contract
@@ -143,7 +142,20 @@ reclaim_home_ownership() {
   done
 }
 
-start_workspace_sshd
+# ── Container role (workbench split) ──
+# Split-mode pods run TWO app containers from this same entrypoint:
+#   agent     — supervisor + conveyor-agent only (protected, restartPolicy
+#               Never semantics); no repo, no sshd, no git prep.
+#   workbench — the workspace: git prep, sshd, claude + all workloads behind
+#               the launcher daemon (native sidecar, restartPolicy Always).
+# Unset = today's monolith container; every guard below must be a no-op then.
+CONTAINER_ROLE="${CONVEYOR_CONTAINER_ROLE:-}"
+
+# Split-mode pods: SSH attach lands in the WORKBENCH container (the workspace
+# lives there); the agent container skips sshd.
+if [ "${CONTAINER_ROLE}" != "agent" ]; then
+  start_workspace_sshd
+fi
 
 # ── Required env vars (injected by pod spec — v3: exactly these two) ──
 : "${CONVEYOR_API_URL:?CONVEYOR_API_URL is required}"
@@ -166,8 +178,7 @@ reclaim_home_ownership
 
 # ═══════════════════════════════════════════════════════════════════════════
 # PULL-BASED BOOTSTRAP — poll until the reconciler binds this pod to a
-# Workspace. 204 = still unbound; 200 = full bundle. No HMAC, no hostname
-# derivation, no exec-push, no /tmp/assignment.json.
+# Workspace. 204 = still unbound; 200 = full bundle.
 # ═══════════════════════════════════════════════════════════════════════════
 # Bash runs as PID 1: without a trap, SIGTERM is ignored during standby and
 # every pool drain/scale-down rides the full terminationGracePeriod (180s) to
@@ -442,6 +453,13 @@ if [ -n "${CONVEYOR_USER_ID}" ] && [ -n "${USER_HOME_PROJECT_ID}" ] && [ -d "${U
   # blocks wrong-account attribution.
   CRED_SHARED="${USER_HOME_ROOT}/.claude/.credentials.json"
   CRED_POD_LOCAL="/home/conveyor/.claude-credentials.pod.json"
+  # Split-mode pods: the agent container WRITES credentials (harness auth) and
+  # claude in the workbench READS them through the shared-dir symlink — so the
+  # pod-local file must live on the shared emptyDir. Still pod-local, so the
+  # concurrent-pods clobber fix above is preserved.
+  if [ -n "${CONVEYOR_SHARED_DIR:-}" ]; then
+    CRED_POD_LOCAL="${CONVEYOR_SHARED_DIR}/claude-credentials.pod.json"
+  fi
   if [ -f "${CRED_SHARED}" ] && [ ! -L "${CRED_SHARED}" ]; then
     # Legacy shared regular file: carry its contents into this pod so auth
     # survives the cutover; the agent re-synthesizes from its own token at
@@ -464,6 +482,14 @@ else
   # No persistent home — the CLI reads the pod-local config; seed it there so
   # non-FUSE pods get the same first-run gate suppression as the mounted path.
   seed_claude_json /home/conveyor/.claude.json
+  # Split-mode pods without a persistent user-home: ~/.claude must still cross
+  # the container boundary (claude writes transcripts in the workbench; the
+  # agent's tailer reads them), so it lives on the shared emptyDir.
+  if [ -n "${CONVEYOR_SHARED_DIR:-}" ]; then
+    mkdir -p "${CONVEYOR_SHARED_DIR}/claude-home/.claude" 2>/dev/null || true
+    rm -rf /home/conveyor/.claude 2>/dev/null || true
+    ln -sfn "${CONVEYOR_SHARED_DIR}/claude-home/.claude" /home/conveyor/.claude
+  fi
   boot_mark "no user-home mount — pod-local seed only"
 fi
 
@@ -636,6 +662,12 @@ configure_graphify_env
 # ═══════════════════════════════════════════════════════════════════════════
 GIT_READY_MARKER="/workspaces/.conveyor-git-ready"
 GIT_FAILED_MARKER="/workspaces/.conveyor-git-failed"
+# Split-mode pods: the markers live on the shared emptyDir so the workbench's
+# git prep is visible to the agent container (which never sees /workspaces).
+if [ -n "${CONVEYOR_SHARED_DIR:-}" ]; then
+  GIT_READY_MARKER="${CONVEYOR_SHARED_DIR}/git-ready"
+  GIT_FAILED_MARKER="${CONVEYOR_SHARED_DIR}/git-failed"
+fi
 
 reset_tracked_repo_changes_before_assignment_checkout() {
   # The baked/pooled repo is not user-owned until this git gate succeeds. Reset
@@ -878,15 +910,23 @@ prepare_workspace_git() {
 # A leftover ready marker from a PRIOR pod on the baked image would be
 # catastrophic: the agent would spawn Claude before THIS pod's git runs. Clear
 # both before starting the background prep.
-rm -f "$GIT_READY_MARKER" "$GIT_FAILED_MARKER"
-# Ensure the repo dir exists for launch on BOTH paths (the background clone
-# populates an empty dir on the non-image path; the pod-image path already has
-# repo/.git).
-mkdir -p /workspaces/repo
+#
+# Split-mode agent container: the WORKBENCH owns the repo and the git prep and
+# writes the shared markers; this container only reads them. It must not clear
+# them either — the workbench may have already written ready.
+if [ "${CONTAINER_ROLE}" != "agent" ]; then
+  rm -f "$GIT_READY_MARKER" "$GIT_FAILED_MARKER"
+  # Ensure the repo dir exists for launch on BOTH paths (the background clone
+  # populates an empty dir on the non-image path; the pod-image path already has
+  # repo/.git).
+  mkdir -p /workspaces/repo
 
-# Run the full git prep in the background so the agent can connect (card lights
-# up) and stream setup output while git finishes.
-prepare_workspace_git &
+  # Run the full git prep in the background so the agent can connect (card lights
+  # up) and stream setup output while git finishes.
+  prepare_workspace_git &
+else
+  echo "[pool] agent role — skipping git prep (workbench owns the workspace)"
+fi
 
 # Signal to the agent that bash owns the git block (skip the agent's OWN
 # git-sync fallback) and that it must await the ready marker before spawning
@@ -897,10 +937,52 @@ export CONVEYOR_GIT_FAILED_MARKER="$GIT_FAILED_MARKER"
 # Target the repo regardless of when the background clone lands.
 export CONVEYOR_WORKSPACE=/workspaces/repo
 
+# ── Workbench container (split-mode): exec the launcher daemon as PID 1 ──
+# No crash loop here — the workbench is a native sidecar (restartPolicy
+# Always); the kubelet owns restarts. Git prep above ran in THIS container
+# (the repo lives here); the daemon serves the agent container's exec/pty/
+# snapshot/file operations over loopback (token-authed, see workbench/server).
+if [ "${CONTAINER_ROLE}" = "workbench" ]; then
+  # Bounded git-prep retry, backgrounded so the daemon starts immediately
+  # (the startupProbe gates pod readiness on the daemon listening). The repo
+  # lives HERE, so the retry must run here — the agent container's launch-loop
+  # retry is role-guarded off (found live 2026-07-16: an unguarded agent-side
+  # retry cloned the repo into the agent's own dead overlay).
+  (
+    _wb_git_attempts=0
+    while true; do
+      sleep 10
+      [ -f "$GIT_READY_MARKER" ] && break
+      if [ -f "$GIT_FAILED_MARKER" ]; then
+        if [ "$_wb_git_attempts" -ge 3 ]; then
+          echo "[pool] workbench git prep failed 3 times — giving up (agent surfaces the failure)."
+          break
+        fi
+        _wb_git_attempts=$((_wb_git_attempts + 1))
+        echo "[pool] workbench git prep failed — retrying (attempt ${_wb_git_attempts}/3)..."
+        rm -f "$GIT_READY_MARKER" "$GIT_FAILED_MARKER"
+        prepare_workspace_git
+      fi
+    done
+  ) &
+  cd /workspaces/repo
+  boot_mark "launching workbench daemon (env-inject → daemon-launch total)"
+  echo "[pool] Launching workbench launcher daemon..."
+  export CONVEYOR_MODE=workbench
+  exec conveyor-agent
+fi
+
 # Launch agent — exit-code-aware restart loop.
 # Exit 0 = clean shutdown (idle timeout, task complete) — pod dies.
 # Non-zero = crash — retry after a brief pause.
-cd /workspaces/repo
+#
+# Split-mode agent container: /workspaces/repo in THIS container is a stale
+# baked overlay, never the live tree — cwd must not resolve into it.
+if [ "${CONTAINER_ROLE}" = "agent" ]; then
+  cd /home/conveyor
+else
+  cd /workspaces/repo
+fi
 boot_mark "launching agent (env-inject → agent-launch total)"
 echo "[pool] Launching agent..."
 set +e
@@ -935,7 +1017,9 @@ report_agent_crash() {
 }
 
 while true; do
-  if [ -f "$GIT_FAILED_MARKER" ]; then
+  # Split-mode agent container: the workbench owns git prep AND its retry —
+  # re-running prep here would clone into this container's dead overlay.
+  if [ -f "$GIT_FAILED_MARKER" ] && [ "${CONTAINER_ROLE}" != "agent" ]; then
     if [ "$_git_prep_attempts" -lt "$GIT_PREP_MAX_RETRIES" ]; then
       _git_prep_attempts=$((_git_prep_attempts + 1))
       echo "[pool] git prep previously failed — retrying (attempt ${_git_prep_attempts}/${GIT_PREP_MAX_RETRIES})..."