@usine/executor 0.2.0 → 0.3.0

package/dist/salvage.js

@@ -0,0 +1,104 @@
+import { SalvagePushed, SalvageRetained, } from "@usine/core/attempt/salvage";
+import { CommitSha } from "@usine/core/repository";
+import { Effect, Option, Result, Schema } from "effect";
+const PUSH_TIMEOUT = "2 minutes";
+/** The git identity for commits usine creates in an Attempt's worktree. */
+export const SALVAGE_GIT_CONFIG = [
+    "-c",
+    "user.name=usine",
+    "-c",
+    "user.email=usine@basaltbytes.dev",
+    "-c",
+    "commit.gpgsign=false",
+];
+const decodeCommit = Schema.decodeUnknownEffect(CommitSha);
+/**
+ * Returns the operator-facing line for the run drawer: the failure's message followed by its
+ * cause's message. For a failed command, the cause is the stderr, which local and SSH executors
+ * scrub of the Attempt's token.
+ */
+export const failureMessage = (failure) => {
+    const detail = failure.cause instanceof Error ? failure.cause.message.trim() : "";
+    return detail.length === 0 ? failure.message : `${failure.message}: ${detail}`;
+};
+/**
+ * Commits everything in an unsuccessful Attempt's checkout and pushes HEAD to its salvage ref
+ * before the worktree is removed. Skips a clean checkout at its base commit. If the push fails,
+ * keeps the worktree and reports its path. Never fails; skipped and failed stages are logged.
+ */
+export const salvageWorktree = Effect.fn("Executor.salvageWorktree")(function* (options) {
+    const fields = {
+        attemptId: options.attemptId,
+        worker: options.worker,
+        host: options.host,
+        worktree: options.worktree,
+    };
+    yield* Effect.annotateCurrentSpan(fields);
+    const git = (args) => options.git(["-C", options.worktree, ...args]);
+    const head = () => git(["rev-parse", "HEAD"]).pipe(Effect.flatMap((output) => decodeCommit(output.trim())));
+    const inspected = yield* Effect.all({
+        head: head(),
+        status: git(["status", "--porcelain", "--untracked-files=all"]),
+    }).pipe(Effect.result);
+    if (Result.isFailure(inspected)) {
+        const message = failureMessage(inspected.failure);
+        yield* Effect.logError("Could not inspect the Attempt worktree for salvage", {
+            ...fields,
+            message,
+        });
+        return Option.some(new SalvageRetained({ path: options.worktree, commit: options.baseCommit, message }));
+    }
+    const dirty = inspected.success.status.trim().length > 0;
+    if (!dirty && Option.contains(options.baseCommit, inspected.success.head)) {
+        yield* Effect.logInfo("Nothing to salvage from the Attempt worktree", fields);
+        return Option.none();
+    }
+    let commit = inspected.success.head;
+    if (dirty) {
+        const committed = yield* git(["add", "--all"]).pipe(Effect.andThen(git([
+            ...SALVAGE_GIT_CONFIG,
+            "commit",
+            "--quiet",
+            "--no-verify",
+            "--message",
+            `wip(usine): salvage attempt ${options.attemptId}`,
+        ])), Effect.andThen(head()), Effect.result);
+        if (Result.isFailure(committed)) {
+            const message = failureMessage(committed.failure);
+            yield* Effect.logError("Could not commit the Attempt's uncommitted changes", {
+                ...fields,
+                message,
+            });
+            return Option.some(new SalvageRetained({ path: options.worktree, commit: Option.some(commit), message }));
+        }
+        else {
+            commit = committed.success;
+        }
+    }
+    const pushFailure = yield* git([
+        "push",
+        "--force",
+        "--no-verify",
+        "origin",
+        `${commit}:refs/heads/${options.ref}`,
+    ]).pipe(Effect.timeoutOption(PUSH_TIMEOUT), Effect.match({
+        onFailure: (failure) => Option.some(failureMessage(failure)),
+        onSuccess: Option.match({
+            onNone: () => Option.some(`git push didn't finish within ${PUSH_TIMEOUT}`),
+            onSome: () => Option.none(),
+        }),
+    }));
+    if (Option.isSome(pushFailure)) {
+        const message = pushFailure.value;
+        yield* Effect.logError("Salvage push failed; retaining the Attempt worktree", {
+            ...fields,
+            ref: options.ref,
+            commit,
+            message,
+        });
+        return Option.some(new SalvageRetained({ path: options.worktree, commit: Option.some(commit), message }));
+    }
+    yield* Effect.logInfo("Salvaged the Attempt's work", { ...fields, ref: options.ref, commit });
+    return Option.some(new SalvagePushed({ ref: options.ref, commit }));
+});
+//# sourceMappingURL=salvage.js.map

package/dist/salvage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"salvage.js","sourceRoot":"","sources":["../src/salvage.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,aAAa,EACb,eAAe,GAChB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAEnD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAExD,MAAM,YAAY,GAAG,WAAW,CAAC;AACjC,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,IAAI;IACJ,iBAAiB;IACjB,IAAI;IACJ,kCAAkC;IAClC,IAAI;IACJ,sBAAsB;CACvB,CAAC;AAaF,MAAM,YAAY,GAAG,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;AAE3D;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAc,EAAU,EAAE;IACvD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;AACjF,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC,QAAQ,CAAC,EAC5E,OAA0B;IAE1B,MAAM,MAAM,GAAG;QACb,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC;IACF,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,CAAC,IAA2B,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IAC5F,MAAM,IAAI,GAAG,GAAG,EAAE,CAChB,GAAG,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAE3F,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAClC,IAAI,EAAE,IAAI,EAAE;QACZ,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,aAAa,EAAE,uBAAuB,CAAC,CAAC;KAChE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvB,IAAI,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,cAAc,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAClD,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,oDAAoD,EAAE;YAC3E,GAAG,MAAM;YACT,OAAO;SACR,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC,CACrF,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IACzD,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1E,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,8CAA8C,EAAE,MAAM,CAAC,CAAC;QAC9E,OAAO,MAAM,CAAC,IAAI,EAAkB,CAAC;IACvC,CAAC;IAED,IAAI,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC;IACpC,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CACjD,MAAM,CAAC,OAAO,CACZ,GAAG,CAAC;YACF,GAAG,kBAAkB;YACrB,QAAQ;YACR,SAAS;YACT,aAAa;YACb,WAAW;YACX,+BAA+B,OAAO,CAAC,SAAS,EAAE;SACnD,CAAC,CACH,EACD,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EACtB,MAAM,CAAC,MAAM,CACd,CAAC;QACF,IAAI,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,cAAc,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YAClD,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,oDAAoD,EAAE;gBAC3E,GAAG,MAAM;gBACT,OAAO;aACR,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CACtF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC;QAC7B,MAAM;QACN,SAAS;QACT,aAAa;QACb,QAAQ;QACR,GAAG,MAAM,eAAe,OAAO,CAAC,GAAG,EAAE;KACtC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,EAClC,MAAM,CAAC,KAAK,CAAC;QACX,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAC5D,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC;YACtB,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,YAAY,EAAE,CAAC;YAC1E,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAU;SACpC,CAAC;KACH,CAAC,CACH,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC;QAClC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,qDAAqD,EAAE;YAC5E,GAAG,MAAM;YACT,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,MAAM;YACN,OAAO;SACR,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CACtF,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,6BAA6B,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9F,OAAO,MAAM,CAAC,IAAI,CAAiB,IAAI,aAAa,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;AACtF,CAAC,CAAC,CAAC"}

package/dist/ssh/credentials.d.ts

@@ -0,0 +1,40 @@
+import type { WorkerName } from "@usine/core/worker";
+import { Effect } from "effect";
+import { CredentialProvider, type ExecutorError } from "../executor.ts";
+import type { RemoteCommands } from "../remote/commands.ts";
+import type { SshMachine } from "./model.ts";
+/**
+ * Writes each Attempt's token to a directory next to the Worker's checkouts that only the SSH
+ * user can read, renews it before expiry, and removes it when the Attempt's scope closes. All
+ * Attempts on the Worker can read each other's tokens (ADR 0026). `reclaim` removes credentials
+ * left by an earlier process, once per process.
+ */
+export declare const sshCredentialsFor: (commands: RemoteCommands, machineFor: (worker: WorkerName) => Effect.Effect<SshMachine, ExecutorError>) => Effect.Effect<{
+    acquire: (attemptId: string & import("effect/Brand").Brand<"AttemptId">, worker: string & import("effect/Brand").Brand<"WorkerName">, repository: string & import("effect/Brand").Brand<"RepositoryName">, permissions: "read" | "write", machine: SshMachine, operation: "cancel" | "cleanup" | "launch" | "preflight" | "prepare") => Effect.Effect<{
+        environment: {
+            GH_CONFIG_DIR: string;
+            GH_PROMPT_DISABLED: string;
+            USINE_GITHUB_TOKEN_FILE: string;
+            GIT_CONFIG_COUNT: string;
+            GIT_CONFIG_KEY_0: string;
+            GIT_CONFIG_VALUE_0: string;
+            GIT_CONFIG_KEY_1: string;
+            GIT_CONFIG_VALUE_1: string;
+        };
+        gitEnvironment: {
+            GH_CONFIG_DIR: string;
+            GH_PROMPT_DISABLED: string;
+            USINE_GITHUB_TOKEN_FILE: string;
+            GIT_CONFIG_COUNT: string;
+            GIT_CONFIG_KEY_0: string;
+            GIT_CONFIG_VALUE_0: string;
+            GIT_CONFIG_KEY_1: string;
+            GIT_CONFIG_VALUE_1: string;
+        };
+        shell: import("@usine/agents/child-host").RemoteShell;
+        refresh: Effect.Effect<void, import("../executor.ts").CredentialUnavailableError | import("../executor.ts").ExecutorOperationError, never>;
+        scrub: (text: string) => string;
+    }, import("../executor.ts").CredentialUnavailableError | import("../executor.ts").ExecutorOperationError, import("effect/Scope").Scope>;
+    reclaim: (worker: WorkerName) => Effect.Effect<void, never, never>;
+}, never, CredentialProvider>;
+//# sourceMappingURL=credentials.d.ts.map

package/dist/ssh/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/ssh/credentials.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAS,MAAM,EAAY,MAAM,QAAQ,CAAC;AAEjD,OAAO,EACL,kBAAkB,EAClB,KAAK,aAAa,EAGnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAG5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAuB7C;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,kDAEP,UAAU,KAAK,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;sBA+BnD,UAAU;6BA0EnC,CAAC"}

package/dist/ssh/credentials.js

@@ -0,0 +1,83 @@
+import { safeSegment } from "@usine/core/repository";
+import { Cache, Effect, Redacted } from "effect";
+import { credentialEnvironment, GH_CONFIG, ghHostsConfig } from "../credential-environment.js";
+import { CredentialProvider, } from "../executor.js";
+import { renewableCredential } from "../renewable-credential.js";
+/**
+ * A script that writes the Attempt's credential directory `$3` inside the credentials root
+ * `$2`: the token from the first stdin line, gh's `hosts.yml` from the rest, and gh's
+ * `config.yml` from `$1`. Sets mode 700 on both directories. Reading the token from stdin keeps
+ * it out of arguments and the environment; each file is written then renamed.
+ */
+const WRITE_CREDENTIAL_SCRIPT = String.raw `
+set -e
+umask 077
+mkdir -p "$2" "$3"
+chmod 700 "$2" "$3"
+IFS= read -r token
+printf '%s' "$token" > "$3/token.next"
+cat > "$3/hosts.next"
+test -f "$3/config.yml" || printf '%s' "$1" > "$3/config.yml"
+mv "$3/token.next" "$3/token"
+mv "$3/hosts.next" "$3/hosts.yml"
+`.trim();
+const credentialsRoot = (machine) => `${machine.workerDirectory}/credentials`;
+/**
+ * Writes each Attempt's token to a directory next to the Worker's checkouts that only the SSH
+ * user can read, renews it before expiry, and removes it when the Attempt's scope closes. All
+ * Attempts on the Worker can read each other's tokens (ADR 0026). `reclaim` removes credentials
+ * left by an earlier process, once per process.
+ */
+export const sshCredentialsFor = Effect.fn("SshExecutor.credentialsFor")(function* (commands, machineFor) {
+    const provider = yield* CredentialProvider;
+    const removeStale = Effect.fn("SshExecutor.removeStaleCredentials")(function* (worker) {
+        const machine = yield* machineFor(worker);
+        const host = machine.shell.destination;
+        yield* Effect.annotateCurrentSpan({ worker, host });
+        yield* commands.run("cleanup", machine.shell, "rm", ["-rf", credentialsRoot(machine)]);
+        yield* Effect.logInfo("Removed credentials an earlier process left on the SSH Worker", {
+            worker,
+            host,
+        });
+    });
+    // A failed removal is logged and cached, not retried: the remaining tokens expire within an
+    // hour and the next start removes them.
+    const reclaimed = yield* Cache.make({
+        capacity: Number.POSITIVE_INFINITY,
+        lookup: (worker) => removeStale(worker).pipe(Effect.tapError((error) => Effect.logWarning("Could not remove stale credentials from the SSH Worker", {
+            worker,
+            message: error.message,
+        })), Effect.ignore),
+    });
+    const reclaim = (worker) => Cache.get(reclaimed, worker);
+    const write = Effect.fn("SshExecutor.writeCredential")(function* (operation, machine, directory, { value }) {
+        yield* Effect.annotateCurrentSpan({ host: machine.shell.destination, directory });
+        const payload = Redacted.make(`${Redacted.value(value)}\n${ghHostsConfig(Redacted.value(value))}`);
+        yield* commands
+            .runWithInput(operation, machine.shell, "sh", ["-c", WRITE_CREDENTIAL_SCRIPT, "sh", GH_CONFIG, credentialsRoot(machine), directory], payload)
+            .pipe(Effect.ensuring(Effect.sync(() => Redacted.wipeUnsafe(payload))));
+    }, 
+    // Scope closure waits for an in-flight write, so a late renewal cannot run after the removal.
+    Effect.uninterruptible);
+    const acquire = Effect.fn("SshExecutor.acquireCredential")(function* (attemptId, worker, repository, permissions, machine, operation) {
+        const host = machine.shell.destination;
+        yield* Effect.annotateCurrentSpan({ attemptId, worker, repository, permissions, host });
+        const directory = `${credentialsRoot(machine)}/${safeSegment(attemptId)}`;
+        yield* Effect.addFinalizer(() => commands.run("cleanup", machine.shell, "rm", ["-rf", directory]).pipe(Effect.tap(() => Effect.logInfo("Removed the Attempt's credential from the SSH Worker", {
+            attemptId,
+            worker,
+            host,
+        })), Effect.tapError((error) => Effect.logError("Could not remove the Attempt's credential from the SSH Worker; it expires within the hour", { attemptId, worker, host, message: error.message })), Effect.ignore));
+        const credential = yield* renewableCredential(provider.issue, repository, attemptId, permissions, (issued) => write(operation, machine, directory, issued));
+        const environment = credentialEnvironment(directory);
+        return {
+            environment,
+            gitEnvironment: environment,
+            shell: machine.shell,
+            refresh: credential.refresh(),
+            scrub: credential.scrub,
+        };
+    });
+    return { acquire, reclaim };
+});
+//# sourceMappingURL=credentials.js.map

package/dist/ssh/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/ssh/credentials.ts"],"names":[],"mappings":"AAEA,OAAO,EAAuB,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1E,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC/F,OAAO,EACL,kBAAkB,GAInB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAGjE;;;;;GAKG;AACH,MAAM,uBAAuB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;CAWzC,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,eAAe,GAAG,CAAC,OAAmB,EAAU,EAAE,CAAC,GAAG,OAAO,CAAC,eAAe,cAAc,CAAC;AAElG;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,EAAE,CAAC,4BAA4B,CAAC,CAAC,QAAQ,CAAC,EAChF,QAAwB,EACxB,UAA4E;IAE5E,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC;IAE3C,MAAM,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC,oCAAoC,CAAC,CAAC,QAAQ,CAAC,EAC3E,MAAkB;QAElB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACvC,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACvF,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,+DAA+D,EAAE;YACrF,MAAM;YACN,IAAI;SACL,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,4FAA4F;IAC5F,wCAAwC;IACxC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QAClC,QAAQ,EAAE,MAAM,CAAC,iBAAiB;QAClC,MAAM,EAAE,CAAC,MAAkB,EAAE,EAAE,CAC7B,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,CACtB,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,MAAM,CAAC,UAAU,CAAC,wDAAwD,EAAE;YAC1E,MAAM;YACN,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CACH,EACD,MAAM,CAAC,MAAM,CACd;KACJ,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,CAAC,MAAkB,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAErE,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,6BAA6B,CAAC,CACpD,QAAQ,CAAC,EACP,SAA4B,EAC5B,OAAmB,EACnB,SAAiB,EACjB,EAAE,KAAK,EAAoB;QAE3B,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;QAClF,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAC3B,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CACpE,CAAC;QACF,KAAK,CAAC,CAAC,QAAQ;aACZ,YAAY,CACX,SAAS,EACT,OAAO,CAAC,KAAK,EACb,IAAI,EACJ,CAAC,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,EACrF,OAAO,CACR;aACA,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,8FAA8F;IAC9F,MAAM,CAAC,eAAe,CACvB,CAAC;IAEF,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,+BAA+B,CAAC,CAAC,QAAQ,CAAC,EAClE,SAAoB,EACpB,MAAkB,EAClB,UAA0B,EAC1B,WAA4B,EAC5B,OAAmB,EACnB,SAA4B;QAE5B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACvC,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,MAAM,SAAS,GAAG,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1E,KAAK,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,CAC9B,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CACnE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CACd,MAAM,CAAC,OAAO,CAAC,sDAAsD,EAAE;YACrE,SAAS;YACT,MAAM;YACN,IAAI;SACL,CAAC,CACH,EACD,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,MAAM,CAAC,QAAQ,CACb,2FAA2F,EAC3F,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CACpD,CACF,EACD,MAAM,CAAC,MAAM,CACd,CACF,CAAC;QACF,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAC3C,QAAQ,CAAC,KAAK,EACd,UAAU,EACV,SAAS,EACT,WAAW,EACX,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CACzD,CAAC;QACF,MAAM,WAAW,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;QACrD,OAAO;YACL,WAAW;YACX,cAAc,EAAE,WAAW;YAC3B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE;YAC7B,KAAK,EAAE,UAAU,CAAC,KAAK;SACD,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC,CAAC,CAAC"}

package/dist/ssh/gateway/admin.d.ts

@@ -0,0 +1,45 @@
+import { type AttachRequest, type Attached, type AttachmentId, type AttachmentList, type Detached, type LlmProviderList } from "@usine/gateway/admin";
+import { Effect, Option, Schema } from "effect";
+import { HttpClient } from "effect/unstable/http";
+import type { SshWorkerGateway } from "../model.ts";
+import { type GatewayForward } from "./forward.ts";
+declare const GatewayAdminError_base: Schema.Class<GatewayAdminError, Schema.TaggedStruct<"GatewayAdminError", {
+    readonly worker: Schema.brand<Schema.String, "WorkerName">;
+    readonly operation: Schema.Literals<readonly ["attach", "renew", "detach", "list", "providers"]>;
+    readonly message: Schema.NonEmptyString;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * The error for a failed Gateway admin API request. `message` contains no token; the request
+ * and raw failure are discarded because an attach request contains the installation token.
+ */
+export declare class GatewayAdminError extends GatewayAdminError_base {
+}
+export interface GatewayAdmin {
+    /** Attaches an Attempt's token for the Worker and a repository. Returns the attachment ID and its caller token. */
+    readonly attach: (request: AttachRequest) => Effect.Effect<Attached, GatewayAdminError>;
+    /** Replaces the token and expiry of attachment `id`, or re-creates it after a Gateway restart. The caller token doesn't change. */
+    readonly renew: (id: AttachmentId, request: AttachRequest) => Effect.Effect<Attached, GatewayAdminError>;
+    /** Removes attachment `id` and returns whether it existed. */
+    readonly detach: (id: AttachmentId) => Effect.Effect<Detached, GatewayAdminError>;
+    /** Returns the active attachments for all the Gateway's Workers. */
+    readonly list: Effect.Effect<AttachmentList, GatewayAdminError>;
+    /**
+     * Returns the LLM providers the Gateway has credentials for, with each credential kind. Returns
+     * `None` if the Gateway predates this endpoint.
+     */
+    readonly providers: Effect.Effect<Option.Option<LlmProviderList>, GatewayAdminError>;
+}
+/**
+ * Returns the admin API client for the Gateway in front of `worker`, connected through
+ * `forward` with the admin token as a bearer token. If the forward is closed or a request gets
+ * no response, reopens the forward and retries once.
+ */
+export declare const gatewayAdminFor: (worker: string & import("effect/Brand").Brand<"WorkerName">, gateway: SshWorkerGateway, forward: GatewayForward) => Effect.Effect<{
+    attach: (request: AttachRequest) => Effect.Effect<Attached, GatewayAdminError, never>;
+    renew: (id: string & import("effect/Brand").Brand<"AttachmentId">, request: AttachRequest) => Effect.Effect<Attached, GatewayAdminError, never>;
+    detach: (id: string & import("effect/Brand").Brand<"AttachmentId">) => Effect.Effect<Detached, GatewayAdminError, never>;
+    list: Effect.Effect<AttachmentList, GatewayAdminError, never>;
+    providers: Effect.Effect<Option.Option<never> | Option.Option<LlmProviderList>, GatewayAdminError, never>;
+}, never, HttpClient.HttpClient>;
+export {};
+//# sourceMappingURL=admin.d.ts.map

package/dist/ssh/gateway/admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../../src/ssh/gateway/admin.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,QAAQ,EAEb,KAAK,eAAe,EACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAkB,MAAM,EAAE,MAAM,EAAyB,MAAM,EAAE,MAAM,QAAQ,CAAC;AACvF,OAAO,EAAE,UAAU,EAAsC,MAAM,sBAAsB,CAAC;AAEtF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,KAAK,cAAc,EAA0C,MAAM,cAAc,CAAC;;;;;;AAa3F;;;GAGG;AACH,qBAAa,iBAAkB,SAAQ,sBAMrC;CAAG;AAEL,MAAM,WAAW,YAAY;IAC3B,mHAAmH;IACnH,QAAQ,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;IACxF,mIAAmI;IACnI,QAAQ,CAAC,KAAK,EAAE,CACd,EAAE,EAAE,YAAY,EAChB,OAAO,EAAE,aAAa,KACnB,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;IAChD,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,YAAY,KAAK,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;IAClF,oEAAoE;IACpE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;IAChE;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,iBAAiB,CAAC,CAAC;CACtF;AAmED;;;;GAIG;AACH,eAAO,MAAM,eAAe;;;;;;gCAgF1B,CAAC"}

package/dist/ssh/gateway/admin.js

@@ -0,0 +1,129 @@
+import { WorkerName } from "@usine/core/worker";
+import { GatewayAdminApi, } from "@usine/gateway/admin";
+import { Data, DateTime, Effect, Option, Result, Schema } from "effect";
+import { HttpClient, HttpClientError, HttpClientRequest } from "effect/unstable/http";
+import { HttpApiClient } from "effect/unstable/httpapi";
+import { GatewayForwardClosed } from "./forward.js";
+const GatewayAdminOperation = Schema.Literals(["attach", "renew", "detach", "list", "providers"]);
+const ACTIONS = {
+    attach: "attach a token",
+    renew: "renew an attachment",
+    detach: "detach an attachment",
+    list: "list the attachments",
+    providers: "list the LLM providers",
+};
+/**
+ * The error for a failed Gateway admin API request. `message` contains no token; the request
+ * and raw failure are discarded because an attach request contains the installation token.
+ */
+export class GatewayAdminError extends Schema.TaggedError("@usine/executor/GatewayAdminError")("GatewayAdminError", {
+    worker: WorkerName,
+    operation: GatewayAdminOperation,
+    message: Schema.NonEmptyString,
+}) {
+}
+/** The timeout for one admin request. A publish keeps the Attempt's scope open while it runs. */
+const ADMIN_REQUEST_TIMEOUT = "30 seconds";
+/**
+ * The error when an admin request through the open forward gets no response. `since` is when
+ * the first unanswered request after the last response was sent.
+ */
+class GatewayAdminUnanswered extends Data.TaggedError("GatewayAdminUnanswered") {
+}
+/** Returns the failure reason, built only from the forward's state or the failure's tag and status. */
+const reason = (failure) => {
+    if (failure instanceof GatewayForwardClosed)
+        return `the forward through ${failure.gateway} has been closed since ${DateTime.formatIso(failure.since)}: ${failure.reason}`;
+    if (failure instanceof GatewayAdminUnanswered)
+        return `the admin API through ${failure.gateway} hasn't responded since ${DateTime.formatIso(failure.since)}: ${failure.detail}`;
+    if (HttpClientError.isHttpClientError(failure))
+        return failure.response === undefined
+            ? `no response (${failure.reason._tag})`
+            : `the admin API returned status ${String(failure.response.status)}`;
+    switch (failure._tag) {
+        case "TimeoutError":
+            return `no response within ${ADMIN_REQUEST_TIMEOUT}`;
+        case "Unauthorized":
+            return "the gateway rejected the admin token";
+        case "AttachmentAlreadyExpired":
+            return "the token had already expired";
+        case "AttachmentConflict":
+            return "the attachment ID belongs to another worker or repository";
+        case "SchemaError":
+            return "the admin API response doesn't match its schema";
+        default:
+            return `the request failed with ${failure._tag}`;
+    }
+};
+/** Returns whether the admin API returned 404 because the Gateway predates the endpoint. */
+const unknownRoute = (failure) => HttpClientError.isHttpClientError(failure) && failure.response?.status === 404;
+/** Returns whether the request got no response, possibly because the forward's SSH connection died unnoticed. */
+const unanswered = (failure) => failure._tag === "TimeoutError" ||
+    (HttpClientError.isHttpClientError(failure) && failure.response === undefined);
+/** Returns the log field with the time the admin API became unreachable, if the failure has it. */
+const sinceFields = (failure) => {
+    if (failure instanceof GatewayForwardClosed)
+        return { closedSince: DateTime.formatIso(failure.since) };
+    if (failure instanceof GatewayAdminUnanswered)
+        return { unansweredSince: DateTime.formatIso(failure.since) };
+    return {};
+};
+const adminClientAt = (url, adminToken) => HttpApiClient.make(GatewayAdminApi, {
+    baseUrl: url,
+    transformClient: HttpClient.mapRequest(HttpClientRequest.bearerToken(adminToken)),
+});
+/**
+ * Returns the admin API client for the Gateway in front of `worker`, connected through
+ * `forward` with the admin token as a bearer token. If the forward is closed or a request gets
+ * no response, reopens the forward and retries once.
+ */
+export const gatewayAdminFor = Effect.fn("SshExecutor.gatewayAdminFor")(function* (worker, gateway, forward) {
+    const http = yield* HttpClient.HttpClient;
+    const exchange = Effect.fn("SshExecutor.gatewayAdminRequest")(function* (operation, call) {
+        yield* Effect.annotateCurrentSpan({ worker, operation, gateway: forward.gateway });
+        const through = Effect.fnUntraced(function* (open) {
+            const sentAt = yield* DateTime.now;
+            const sent = yield* Effect.result(adminClientAt(open.url, gateway.adminToken).pipe(Effect.provideService(HttpClient.HttpClient, http), Effect.flatMap(call), Effect.timeout(ADMIN_REQUEST_TIMEOUT)));
+            if (Result.isFailure(sent) && unanswered(sent.failure))
+                return yield* new GatewayAdminUnanswered({
+                    gateway: forward.gateway,
+                    since: yield* forward.unanswered(sentAt),
+                    detail: reason(sent.failure),
+                });
+            yield* forward.answered;
+            if (Result.isFailure(sent))
+                return yield* Effect.fail(sent.failure);
+            return sent.success;
+        });
+        const retried = (generation, failure) => Effect.logWarning("A Gateway admin request did not get through; reopening the forward and sending it once more", {
+            worker,
+            operation,
+            gateway: forward.gateway,
+            generation,
+            reason: reason(failure),
+            ...sinceFields(failure),
+        }).pipe(Effect.andThen(forward.reopen(generation)), Effect.flatMap(through));
+        const opened = yield* Effect.result(forward.current);
+        if (Result.isFailure(opened))
+            return yield* retried(opened.failure.generation, opened.failure);
+        const answered = yield* Effect.result(through(opened.success));
+        if (Result.isSuccess(answered))
+            return answered.success;
+        if (!(answered.failure instanceof GatewayAdminUnanswered))
+            return yield* Effect.fail(answered.failure);
+        return yield* retried(opened.success.generation, answered.failure);
+    });
+    const bounded = (operation) => (call) => exchange(operation, call).pipe(Effect.mapError((failure) => new GatewayAdminError({
+        worker,
+        operation,
+        message: `Can't ${ACTIONS[operation]} on the admin API of gateway ${forward.gateway} for worker "${worker}": ${reason(failure)}`,
+    })));
+    return {
+        attach: (request) => bounded("attach")((client) => client.attachments.attach({ payload: request })),
+        renew: (id, request) => bounded("renew")((client) => client.attachments.renew({ params: { id }, payload: request })),
+        detach: (id) => bounded("detach")((client) => client.attachments.detach({ params: { id } })),
+        list: bounded("list")((client) => client.attachments.list()),
+        providers: bounded("providers")((client) => client.llm.providers().pipe(Effect.map(Option.some), Effect.catchIf(unknownRoute, () => Effect.succeedNone))),
+    };
+});
+//# sourceMappingURL=admin.js.map

package/dist/ssh/gateway/admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../../../src/ssh/gateway/admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAML,eAAe,GAEhB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAiB,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACvF,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACtF,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAExD,OAAO,EAAuB,oBAAoB,EAAoB,MAAM,cAAc,CAAC;AAE3F,MAAM,qBAAqB,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;AAGlG,MAAM,OAAO,GAAG;IACd,MAAM,EAAE,gBAAgB;IACxB,KAAK,EAAE,qBAAqB;IAC5B,MAAM,EAAE,sBAAsB;IAC9B,IAAI,EAAE,sBAAsB;IAC5B,SAAS,EAAE,wBAAwB;CACqB,CAAC;AAE3D;;;GAGG;AACH,MAAM,OAAO,iBAAkB,SAAQ,MAAM,CAAC,WAAW,CACvD,mCAAmC,CACpC,CAAC,mBAAmB,EAAE;IACrB,MAAM,EAAE,UAAU;IAClB,SAAS,EAAE,qBAAqB;IAChC,OAAO,EAAE,MAAM,CAAC,cAAc;CAC/B,CAAC;CAAG;AAqBL,iGAAiG;AACjG,MAAM,qBAAqB,GAAG,YAAY,CAAC;AAE3C;;;GAGG;AACH,MAAM,sBAAuB,SAAQ,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAI5E;CAAG;AAEL,uGAAuG;AACvG,MAAM,MAAM,GAAG,CAAC,OAAkC,EAAU,EAAE;IAC5D,IAAI,OAAO,YAAY,oBAAoB;QACzC,OAAO,uBAAuB,OAAO,CAAC,OAAO,0BAA0B,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;IAChI,IAAI,OAAO,YAAY,sBAAsB;QAC3C,OAAO,yBAAyB,OAAO,CAAC,OAAO,2BAA2B,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;IACnI,IAAI,eAAe,CAAC,iBAAiB,CAAC,OAAO,CAAC;QAC5C,OAAO,OAAO,CAAC,QAAQ,KAAK,SAAS;YACnC,CAAC,CAAC,gBAAgB,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG;YACxC,CAAC,CAAC,iCAAiC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;IACzE,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,cAAc;YACjB,OAAO,sBAAsB,qBAAqB,EAAE,CAAC;QACvD,KAAK,cAAc;YACjB,OAAO,sCAAsC,CAAC;QAChD,KAAK,0BAA0B;YAC7B,OAAO,+BAA+B,CAAC;QACzC,KAAK,oBAAoB;YACvB,OAAO,2DAA2D,CAAC;QACrE,KAAK,aAAa;YAChB,OAAO,iDAAiD,CAAC;QAC3D;YACE,OAAO,2BAA2B,OAAO,CAAC,IAAI,EAAE,CAAC;IACrD,CAAC;AACH,CAAC,CAAC;AAEF,4FAA4F;AAC5F,MAAM,YAAY,GAAG,CAAC,OAAkC,EAAW,EAAE,CACnE,eAAe,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,EAAE,MAAM,KAAK,GAAG,CAAC;AAEjF,iHAAiH;AACjH,MAAM,UAAU,GAAG,CAAC,OAAkC,EAAW,EAAE,CACjE,OAAO,CAAC,IAAI,KAAK,cAAc;IAC/B,CAAC,eAAe,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;AAEjF,mGAAmG;AACnG,MAAM,WAAW,GAAG,CAAC,OAAkC,EAAE,EAAE;IACzD,IAAI,OAAO,YAAY,oBAAoB;QACzC,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5D,IAAI,OAAO,YAAY,sBAAsB;QAC3C,OAAO,EAAE,eAAe,EAAE,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;IAChE,OAAO,EAAE,CAAC;AACZ,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,GAAQ,EAAE,UAAqC,EAAE,EAAE,CACxE,aAAa,CAAC,IAAI,CAAC,eAAe,EAAE;IAClC,OAAO,EAAE,GAAG;IACZ,eAAe,EAAE,UAAU,CAAC,UAAU,CAAC,iBAAiB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;CAClF,CAAC,CAAC;AAIL;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,EAAE,CAAC,6BAA6B,CAAC,CAAC,QAAQ,CAAC,EAC/E,MAAkB,EAClB,OAAyB,EACzB,OAAuB;IAEvB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IAC1C,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC,iCAAiC,CAAC,CAAC,QAAQ,CAAC,EAGrE,SAAgC,EAAE,IAAkD;QACpF,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QACnF,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAiB;YAC5D,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;YACnC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAC/B,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAC9C,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,EAClD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EACpB,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,CACtC,CACF,CAAC;YACF,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;gBACpD,OAAO,KAAK,CAAC,CAAC,IAAI,sBAAsB,CAAC;oBACvC,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,KAAK,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;oBACxC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;iBAC7B,CAAC,CAAC;YACL,KAAK,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;YACxB,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpE,OAAO,IAAI,CAAC,OAAO,CAAC;QACtB,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,CAAC,UAAkB,EAAE,OAAkC,EAAE,EAAE,CACzE,MAAM,CAAC,UAAU,CACf,6FAA6F,EAC7F;YACE,MAAM;YACN,SAAS;YACT,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,UAAU;YACV,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC;YACvB,GAAG,WAAW,CAAC,OAAO,CAAC;SACxB,CACF,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;QAE9E,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/F,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/D,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC,OAAO,CAAC;QACxD,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,YAAY,sBAAsB,CAAC;YACvD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9C,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GACX,CAAC,SAAgC,EAAE,EAAE,CACrC,CACE,IAAkD,EACb,EAAE,CACvC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,IAAI,CAC5B,MAAM,CAAC,QAAQ,CACb,CAAC,OAAO,EAAE,EAAE,CACV,IAAI,iBAAiB,CAAC;QACpB,MAAM;QACN,SAAS;QACT,OAAO,EAAE,SAAS,OAAO,CAAC,SAAS,CAAC,gCAAgC,OAAO,CAAC,OAAO,gBAAgB,MAAM,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE;KACjI,CAAC,CACL,CACF,CAAC;IACN,OAAO;QACL,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAClB,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAChF,KAAK,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,CACrB,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9F,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5F,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QAC5D,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CACzC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,CACzB,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EACvB,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CACvD,CACF;KACqB,CAAC;AAC3B,CAAC,CAAC,CAAC"}

package/dist/ssh/gateway/attachments.d.ts

@@ -0,0 +1,22 @@
+import type { WorkerName } from "@usine/core/worker";
+import { Effect } from "effect";
+import { CredentialProvider, CredentialUnavailableError, type ExecutorError } from "../../executor.ts";
+import { type RemoteCommands } from "../../remote/commands.ts";
+import type { MachineGateway, SshMachine } from "../model.ts";
+/**
+ * Grants each Attempt repository access through the Gateway without a token on the machine
+ * (ADR 0027). Attaches the token, renews it before expiry, re-stores it every two minutes, and
+ * detaches it when the scope closes. On first use of a Worker, detaches attachments left by an
+ * earlier process.
+ */
+export declare const gatewayAttachmentsFor: (commands: RemoteCommands, machineFor: (worker: WorkerName) => Effect.Effect<SshMachine, ExecutorError>) => Effect.Effect<{
+    acquire: (attemptId: string & import("effect/Brand").Brand<"AttemptId">, worker: string & import("effect/Brand").Brand<"WorkerName">, repository: string & import("effect/Brand").Brand<"RepositoryName">, permissions: "read" | "write", machine: SshMachine, gateway: MachineGateway, operation: "cancel" | "cleanup" | "launch" | "preflight" | "prepare") => Effect.Effect<{
+        shell: import("@usine/agents/child-host").RemoteShell;
+        environment: Readonly<Record<string, string>>;
+        gitEnvironment: Readonly<Record<string, string>>;
+        refresh: Effect.Effect<void, CredentialUnavailableError, never>;
+        scrub: (text: string) => string;
+    }, CredentialUnavailableError | import("../../executor.ts").ExecutorOperationError, import("effect/Scope").Scope>;
+    reclaim: (worker: WorkerName) => Effect.Effect<void, never, never>;
+}, never, CredentialProvider>;
+//# sourceMappingURL=attachments.d.ts.map

package/dist/ssh/gateway/attachments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachments.d.ts","sourceRoot":"","sources":["../../../src/ssh/gateway/attachments.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,EAAmB,MAAM,EAAoC,MAAM,QAAQ,CAAC;AACnF,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC1B,KAAK,aAAa,EAGnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,KAAK,cAAc,EAAgB,MAAM,0BAA0B,CAAC;AAG7E,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA2B9D;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,kDAEX,UAAU,KAAK,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC;;;;;;;;sBA4DnD,UAAU;6BA+JnC,CAAC"}

package/dist/ssh/gateway/attachments.js

@@ -0,0 +1,154 @@
+import { AttachRequest, InstallationCredential } from "@usine/gateway/admin";
+import { Cache, DateTime, Effect, Option, Redacted, Ref, Semaphore } from "effect";
+import { CredentialProvider, CredentialUnavailableError, } from "../../executor.js";
+import { sendingShell } from "../../remote/commands.js";
+import { renewableCredential } from "../../renewable-credential.js";
+import { gatewayEnvironment, ghGatewayConfig } from "./environment.js";
+/**
+ * A script that writes `$2` and `$3` as `config.yml` and `hosts.yml` in directory `$1`. Each
+ * file is written to a temporary name and renamed.
+ */
+const WRITE_GH_CONFIG_SCRIPT = String.raw `
+set -e
+mkdir -p "$1"
+printf '%s' "$2" > "$1/config.yml.$$"
+printf '%s' "$3" > "$1/hosts.yml.$$"
+mv "$1/config.yml.$$" "$1/config.yml"
+mv "$1/hosts.yml.$$" "$1/hosts.yml"
+`.trim();
+/** The interval for re-storing a live Attempt's attachment, which bounds the outage after a Gateway restart. */
+const RESTORE_INTERVAL = "2 minutes";
+/** Returns gh's configuration directory on a Worker behind a Gateway. The directory contains no token. */
+const ghConfigDirectory = (machine) => `${machine.workerDirectory}/gh`;
+/**
+ * Grants each Attempt repository access through the Gateway without a token on the machine
+ * (ADR 0027). Attaches the token, renews it before expiry, re-stores it every two minutes, and
+ * detaches it when the scope closes. On first use of a Worker, detaches attachments left by an
+ * earlier process.
+ */
+export const gatewayAttachmentsFor = Effect.fn("SshExecutor.gatewayAttachmentsFor")(function* (commands, machineFor) {
+    const provider = yield* CredentialProvider;
+    const detachLeftovers = Effect.fn("SshExecutor.detachLeftoverAttachments")(function* (worker) {
+        const machine = yield* machineFor(worker);
+        yield* Effect.annotateCurrentSpan({ worker });
+        if (Option.isNone(machine.gateway))
+            return yield* Effect.logDebug("The Worker has no Gateway to detach leftovers from", {
+                worker,
+            });
+        const { admin, settings } = machine.gateway.value;
+        yield* Effect.annotateCurrentSpan({ domain: settings.domain });
+        const { attachments } = yield* admin.list;
+        const leftovers = attachments.filter((attachment) => attachment.worker === worker);
+        if (leftovers.length === 0)
+            return yield* Effect.logDebug("No earlier process left a Gateway attachment for the Worker", {
+                worker,
+                domain: settings.domain,
+            });
+        // Detaches each leftover separately so one failure doesn't stop the others.
+        yield* Effect.forEach(leftovers, ({ id, repository }) => admin.detach(id).pipe(Effect.tap(({ detached }) => Effect.logInfo("Detached a Gateway attachment an earlier process left", {
+            worker,
+            repository,
+            attachment: id,
+            detached,
+        })), Effect.tapError((error) => Effect.logWarning("Could not detach a Gateway attachment an earlier process left; it expires with its token", { worker, repository, attachment: id, message: error.message })), Effect.ignore), { discard: true });
+    });
+    // Caches a failed listing; the leftover attachments expire with their tokens within an hour.
+    const reclaimed = yield* Cache.make({
+        capacity: Number.POSITIVE_INFINITY,
+        lookup: (worker) => detachLeftovers(worker).pipe(Effect.tapError((error) => Effect.logWarning("Could not list the Gateway attachments an earlier process left; they expire with their tokens", { worker, message: error.message })), Effect.ignore),
+    });
+    const reclaim = (worker) => Cache.get(reclaimed, worker);
+    const acquire = Effect.fn("SshExecutor.attachToGateway")(function* (attemptId, worker, repository, permissions, machine, gateway, operation) {
+        const { admin, settings } = gateway;
+        const fields = { attemptId, worker, repository, permissions, domain: settings.domain };
+        yield* Effect.annotateCurrentSpan(fields);
+        const config = ghGatewayConfig(settings.domain);
+        yield* commands.run(operation, machine.shell, "sh", [
+            "-c",
+            WRITE_GH_CONFIG_SCRIPT,
+            "sh",
+            ghConfigDirectory(machine),
+            config["config.yml"],
+            config["hosts.yml"],
+        ]);
+        const attached = yield* Ref.make(Option.none());
+        // Serializes publish and restore so the Gateway never gets an older token.
+        const turn = yield* Semaphore.make(1);
+        yield* Effect.addFinalizer(() => Ref.get(attached).pipe(Effect.flatMap(Option.match({
+            onNone: () => Effect.logDebug("The Attempt has no Gateway attachment to detach", fields),
+            onSome: ({ id }) => admin.detach(id).pipe(Effect.tap(({ detached }) => Effect.logInfo("Detached the Attempt's token from the Gateway", {
+                ...fields,
+                attachment: id,
+                detached,
+            })), Effect.tapError((error) => Effect.logWarning("Could not detach the Attempt's token from the Gateway; the attachment expires with the token", { ...fields, attachment: id, message: error.message })), Effect.ignore),
+        }))));
+        const requestFor = (credential) => new AttachRequest({
+            worker,
+            repository,
+            credential: new InstallationCredential({ token: credential.value }),
+            expiresAt: credential.expiresAt,
+        });
+        const publish = Effect.fn("SshExecutor.publishAttachment")(function* (credential) {
+            yield* Effect.annotateCurrentSpan(fields);
+            const current = yield* Ref.get(attached);
+            const answer = yield* Option.match(current, {
+                onNone: () => admin.attach(requestFor(credential)),
+                onSome: ({ id }) => admin.renew(id, requestFor(credential)),
+            }).pipe(Effect.mapError((cause) => new CredentialUnavailableError({
+                repository,
+                reason: "unreachable",
+                message: cause.message,
+                cause,
+            })));
+            yield* Ref.set(attached, Option.some({ id: answer.attachment.id, credential }));
+            yield* Effect.annotateCurrentSpan({ attachment: answer.attachment.id });
+            yield* Effect.logInfo(Option.isNone(current)
+                ? "Attached the Attempt's token to the Gateway"
+                : "Renewed the Attempt's attachment on the Gateway", {
+                ...fields,
+                attachment: answer.attachment.id,
+                expiresAt: DateTime.formatIso(answer.attachment.expiresAt),
+            });
+            return answer.callerToken;
+        }, 
+        // Scope closure waits for an in-flight attach, so the detach has the attachment ID.
+        turn.withPermits(1), Effect.uninterruptible);
+        // The Gateway stores attachments in memory. After a restart, re-creates the attachment with
+        // the same ID and the current token.
+        const restore = Effect.fn("SshExecutor.restoreAttachment")(function* () {
+            yield* Effect.annotateCurrentSpan(fields);
+            const current = yield* Ref.get(attached);
+            if (Option.isNone(current))
+                return;
+            const { id, credential } = current.value;
+            yield* Effect.annotateCurrentSpan({ attachment: id });
+            yield* admin.renew(id, requestFor(credential));
+            yield* Effect.logDebug("Confirmed the Attempt's attachment on the Gateway", {
+                ...fields,
+                attachment: id,
+            });
+        }, turn.withPermits(1), Effect.uninterruptible);
+        const credential = yield* renewableCredential(provider.issue, repository, attemptId, permissions, publish);
+        const callerToken = credential.published;
+        // Forked after renewal so scope closure stops it before the token is wiped and detached.
+        yield* Effect.forever(Effect.sleep(RESTORE_INTERVAL).pipe(Effect.andThen(restore()), Effect.tapError((error) => Effect.logWarning("Could not confirm the Attempt's attachment on the Gateway; will retry", {
+            ...fields,
+            message: error.message,
+        })), Effect.ignore)).pipe(Effect.forkScoped);
+        const { exported, sent } = gatewayEnvironment({
+            domain: settings.domain,
+            llmProviders: settings.llmProviders,
+            ghConfigDirectory: ghConfigDirectory(machine),
+            callerToken,
+        });
+        return {
+            shell: sendingShell(machine.shell, sent),
+            environment: exported,
+            gitEnvironment: exported,
+            refresh: credential.refresh(),
+            scrub: (text) => credential.scrub(text).replaceAll(Redacted.value(callerToken), "[REDACTED]"),
+        };
+    });
+    return { acquire, reclaim };
+});
+//# sourceMappingURL=attachments.js.map