@usine/executor 0.2.1 → 0.4.0

package/dist/ssh/codex-homes.js

@@ -0,0 +1,78 @@
+import { safeSegment } from "@usine/core/repository";
+import { Effect, Ref } from "effect";
+import { directChildren } from "../remote/sweep.js";
+/**
+ * A script that prints each directory in the Codex homes directory `$1` whose Attempt has no
+ * checkout in the attempts directory `$2`, NUL-terminated. Prints nothing if `$1` is missing.
+ */
+const HOMES_WITHOUT_CHECKOUT_SCRIPT = String.raw `
+set -e
+[ -d "$1" ] || exit 0
+for home in "$1"/* "$1"/.[!.]* "$1"/..?*; do
+  [ -e "$home" ] || continue
+  [ -e "$2/$(basename "$home")" ] || printf '%s\0' "$home"
+done
+`.trim();
+/** Returns the Codex home of `attemptId` in the Worker directory `workerDirectory`. */
+export const codexHomeIn = (workerDirectory, attemptId) => `${workerDirectory}/codex/${safeSegment(attemptId)}`;
+/** Returns the Attempt's Codex home on `machine`, which Codex also writes its sessions to. */
+export const attemptCodexHome = (machine, attemptId) => codexHomeIn(machine.workerDirectory, attemptId);
+/**
+ * Tracks the Codex homes that Attempts in this process use. `hold` gives an Attempt its Codex
+ * home and removes the directory when the caller's scope closes. `sweep` removes the Codex homes
+ * on a long-lived machine that no Attempt holds and whose Attempt has no checkout there, which
+ * a crash or a failed removal left.
+ */
+export const codexHomesFor = Effect.fn("SshExecutor.codexHomesFor")(function* (commands) {
+    // The number of holds on each Codex home, by path.
+    const held = yield* Ref.make(new Map());
+    const count = (codexHome, change) => Ref.update(held, (current) => {
+        const next = new Map(current);
+        const holds = (current.get(codexHome) ?? 0) + change;
+        if (holds > 0)
+            next.set(codexHome, holds);
+        else
+            next.delete(codexHome);
+        return next;
+    });
+    const hold = Effect.fn("SshExecutor.holdCodexHome")(function* (machine, attemptId) {
+        const codexHome = attemptCodexHome(machine, attemptId);
+        const fields = { attemptId, worker: machine.address.name, codexHome };
+        yield* Effect.annotateCurrentSpan(fields);
+        // Held before the caller writes the directory, so a sweep that lists it finds the hold.
+        yield* Effect.acquireRelease(count(codexHome, 1), () => commands.run("cleanup", machine.shell, "rm", ["-rf", codexHome]).pipe(Effect.tap(() => Effect.logDebug("Removed the Attempt's Codex home", fields)), Effect.tapError((error) => Effect.logWarning("Could not remove the Attempt's Codex home; the next sweep removes it once the Attempt's checkout is gone", { ...fields, message: error.message })), Effect.ignore, Effect.ensuring(count(codexHome, -1))));
+        return codexHome;
+    });
+    const sweep = Effect.fn("SshExecutor.sweepCodexHomes")(function* (machine) {
+        const worker = machine.address.name;
+        const host = machine.shell.destination;
+        yield* Effect.annotateCurrentSpan({ worker, host });
+        const root = `${machine.workerDirectory}/codex`;
+        const output = yield* commands.run("cleanup", machine.shell, "sh", [
+            "-c",
+            HOMES_WITHOUT_CHECKOUT_SCRIPT,
+            "sh",
+            root,
+            `${machine.workerDirectory}/attempts`,
+        ]);
+        const listed = yield* directChildren("cleanup", root, output);
+        // Read after the listing, so a Codex home created since then can't be removed.
+        const holds = yield* Ref.get(held);
+        const leftovers = listed.filter((codexHome) => !holds.has(codexHome));
+        if (leftovers.length === 0)
+            return yield* Effect.logDebug("No Codex home to remove on the SSH Worker", {
+                worker,
+                host,
+                withoutCheckout: listed.length,
+            });
+        // Removes each Codex home separately, so one failure doesn't keep the others.
+        yield* Effect.forEach(leftovers, (codexHome) => commands.run("cleanup", machine.shell, "rm", ["-rf", codexHome]).pipe(Effect.tap(() => Effect.logInfo("Removed a Codex home that no Attempt holds and whose Attempt has no checkout", { worker, host, codexHome })), Effect.tapError((error) => Effect.logWarning("Could not remove a Codex home; the next sweep tries again", {
+            worker,
+            host,
+            codexHome,
+            message: error.message,
+        })), Effect.ignore), { discard: true });
+    });
+    return { hold, sweep };
+});
+//# sourceMappingURL=codex-homes.js.map

package/dist/ssh/codex-homes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-homes.js","sourceRoot":"","sources":["../../src/ssh/codex-homes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAErC,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGpD;;;GAGG;AACH,MAAM,6BAA6B,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;CAO/C,CAAC,IAAI,EAAE,CAAC;AAET,uFAAuF;AACvF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,eAAuB,EAAE,SAAoB,EAAU,EAAE,CACnF,GAAG,eAAe,UAAU,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;AAEvD,8FAA8F;AAC9F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAmB,EAAE,SAAoB,EAAU,EAAE,CACpF,WAAW,CAAC,OAAO,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;AAElD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,EAAE,CAAC,2BAA2B,CAAC,CAAC,QAAQ,CAAC,EAC3E,QAAwB;IAExB,mDAAmD;IACnD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAA8B,IAAI,GAAG,EAAE,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,CAAC,SAAiB,EAAE,MAAc,EAAE,EAAE,CAClD,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE;QAC3B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC;QACrD,IAAI,KAAK,GAAG,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;;YACrC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEL,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,2BAA2B,CAAC,CAAC,QAAQ,CAAC,EAC3D,OAAmB,EACnB,SAAoB;QAEpB,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QACtE,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAC1C,wFAAwF;QACxF,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CACrD,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CACnE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAC,EAC7E,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,MAAM,CAAC,UAAU,CACf,0GAA0G,EAC1G,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CACtC,CACF,EACD,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CACtC,CACF,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,6BAA6B,CAAC,CAAC,QAAQ,CAAC,EAAE,OAAmB;QACnF,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;QACpC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACvC,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,GAAG,OAAO,CAAC,eAAe,QAAQ,CAAC;QAChD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE;YACjE,IAAI;YACJ,6BAA6B;YAC7B,IAAI;YACJ,IAAI;YACJ,GAAG,OAAO,CAAC,eAAe,WAAW;SACtC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9D,+EAA+E;QAC/E,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;QACtE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YACxB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,2CAA2C,EAAE;gBACzE,MAAM;gBACN,IAAI;gBACJ,eAAe,EAAE,MAAM,CAAC,MAAM;aAC/B,CAAC,CAAC;QACL,8EAA8E;QAC9E,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACnB,SAAS,EACT,CAAC,SAAS,EAAE,EAAE,CACZ,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CACnE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CACd,MAAM,CAAC,OAAO,CACZ,8EAA8E,EAC9E,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAC5B,CACF,EACD,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,MAAM,CAAC,UAAU,CAAC,2DAA2D,EAAE;YAC7E,MAAM;YACN,IAAI;YACJ,SAAS;YACT,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CACH,EACD,MAAM,CAAC,MAAM,CACd,EACH,EAAE,OAAO,EAAE,IAAI,EAAE,CAClB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC,CAAC,CAAC"}

package/dist/ssh/container.d.ts

@@ -0,0 +1,32 @@
+import { type WorkerName } from "@usine/core/worker";
+import { Effect } from "effect";
+import { type ExecutorError, WorkerCapabilityError } from "../executor.ts";
+import type { RemoteCommands } from "../remote/commands.ts";
+import { type AttemptIsolation, type ContainerSettings } from "../remote/container.ts";
+import { type ResolvedLimits } from "./limits.ts";
+import type { SshMachine } from "./model.ts";
+/**
+ * The image of each Attempt container when `usine.yaml` names none, built from
+ * `infra/worker-image/Dockerfile` with this release's harness versions.
+ */
+export declare const ATTEMPT_IMAGE: string & import("effect/Brand").Brand<"ContainerImage">;
+/**
+ * Returns the container operations of the SSH executor: the preflight checks of a Worker's
+ * Docker and image, the isolation they found, a container for a preflight's harness probes, and
+ * the removal of containers an earlier process left.
+ */
+export declare const sshContainersFor: (commands: RemoteCommands, machineFor: (worker: WorkerName) => Effect.Effect<SshMachine, ExecutorError>, instance: string, instanceId: string & import("effect/Brand").Brand<"InstanceId">) => Effect.Effect<{
+    verify: (machine: SshMachine, slots: number) => Effect.Effect<{
+        _tag: "Container";
+        settings: ContainerSettings;
+        limits: ResolvedLimits;
+    } | {
+        _tag: "SharedUser";
+        degraded: string;
+    }, import("../executor.ts").ExecutorOperationError | WorkerCapabilityError, never>;
+    isolation: (machine: SshMachine) => Effect.Effect<AttemptIsolation, import("../executor.ts").ExecutorOperationError | WorkerCapabilityError, never>;
+    preflightShell: (machine: SshMachine, settings: ContainerSettings, harnesses: readonly ("claude" | "codex" | "pi")[], environment: Readonly<Record<string, string>>) => Effect.Effect<import("@usine/agents/child-host").RemoteShell, import("../executor.ts").ExecutorOperationError, import("effect/Scope").Scope>;
+    reclaim: (worker: WorkerName) => Effect.Effect<void, never, never>;
+}, never, never>;
+export type SshContainers = Effect.Success<ReturnType<typeof sshContainersFor>>;
+//# sourceMappingURL=container.d.ts.map

package/dist/ssh/container.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"container.d.ts","sourceRoot":"","sources":["../../src/ssh/container.ts"],"names":[],"mappings":"AAIA,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAS,MAAM,EAA+B,MAAM,QAAQ,CAAC;AACpE,OAAO,EAAE,KAAK,aAAa,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAE3E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EACL,KAAK,gBAAgB,EAErB,KAAK,iBAAiB,EAMvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAKL,KAAK,cAAc,EAEpB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C;;;GAGG;AACH,eAAO,MAAM,aAAa,yDAEzB,CAAC;AA8CF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,kDAEN,UAAU,KAAK,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC;;;;;;;;;;;sBAkUxD,UAAU;gBAE9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAC,CAAC"}

package/dist/ssh/container.js

@@ -0,0 +1,282 @@
+import { SSH_FAILURE } from "@usine/agents/child-host";
+import { safeSegment } from "@usine/core/repository";
+import { ContainerImage } from "@usine/core/worker";
+import { Cache, Effect, Option, Random, Ref, Schema } from "effect";
+import { WorkerCapabilityError } from "../executor.js";
+import { keyedLockFor } from "../keyed-lock.js";
+import { CONTAINER_RUNTIME, containersFor, PNPM_STORE_MOUNT, PNPM_STORE_PATH, PNPM_STORE_VOLUME, sharedUser, } from "../remote/container.js";
+import { configuredLimits, limitFields, RESOURCES_SCRIPT, resolveLimits, resourcesFromOutput, } from "./limits.js";
+/**
+ * The image of each Attempt container when `usine.yaml` names none, built from
+ * `infra/worker-image/Dockerfile` with this release's harness versions.
+ */
+export const ATTEMPT_IMAGE = ContainerImage.make("ghcr.io/basaltbytes/usine-worker:claude-2.1.308-codex-0.159.2");
+/** The exit code of `DETECT_SCRIPT` when the machine has no Docker and the SSH user no access to one. */
+const RUNTIME_ABSENT = 3;
+/** The exit code of `DETECT_SCRIPT` when the SSH user can use Docker's socket but has no `docker` CLI. */
+const SOCKET_WITHOUT_CLI = 4;
+/**
+ * A script that prints the version of the container runtime `$1`'s server. Without the CLI, it
+ * exits 4 if the SSH user is in the `docker` group or can write Docker's socket, and 3 if not.
+ */
+const DETECT_SCRIPT = String.raw `
+if ! command -v "$1" >/dev/null 2>&1; then
+  for group in $(id -nG); do
+    if [ "$group" = docker ]; then exit 4; fi
+  done
+  if [ -w /var/run/docker.sock ]; then exit 4; fi
+  exit 3
+fi
+exec "$1" version -f '{{.Server.Version}}'
+`.trim();
+/** A script that prints the SSH user's ID and the ID of image `$2`'s user, separated by a space. */
+const USER_IDS_SCRIPT = String.raw `
+image_uid=$("$1" run --rm --network none --entrypoint id "$2" -u) || exit 1
+printf '%s %s\n' "$(id -u)" "$image_uid"
+`.trim();
+const decodeStoreSize = Schema.decodeUnknownEffect(Schema.NumberFromString.check(Schema.isInt(), Schema.isGreaterThanOrEqualTo(0)));
+const containerGap = (worker, message, cause) => new WorkerCapabilityError({ worker, capability: "container", message, cause });
+/**
+ * Returns the container operations of the SSH executor: the preflight checks of a Worker's
+ * Docker and image, the isolation they found, a container for a preflight's harness probes, and
+ * the removal of containers an earlier process left.
+ */
+export const sshContainersFor = Effect.fn("SshExecutor.containersFor")(function* (commands, machineFor, instance, instanceId) {
+    const containers = containersFor(commands);
+    const preparedStores = new WeakSet();
+    const storeLocks = yield* keyedLockFor();
+    const prepareStore = Effect.fn("SshExecutor.preparePnpmStore")(function* (machine, image) {
+        const fields = { worker: machine.address.name, host: machine.shell.destination, image };
+        yield* Effect.annotateCurrentSpan(fields);
+        if (preparedStores.has(machine)) {
+            yield* Effect.logDebug("Shared pnpm store already prepared on this machine", fields);
+            return;
+        }
+        yield* containers.prepareStore("prepare", machine.shell, image, machine.address.name);
+        preparedStores.add(machine);
+    }, (effect, machine) => effect.pipe(storeLocks.withLock(machine.address.name)));
+    const isolations = yield* Ref.make(new Map());
+    // Workers whose earlier containers this process removed. Their containers on a shared machine
+    // belong to this process, so another Worker's removal keeps them.
+    const reclaimed = yield* Ref.make(new Set());
+    const imageFor = (machine) => Option.getOrElse(machine.address.container.image, () => ATTEMPT_IMAGE);
+    /** Reads the CPUs, memory, and task limit of the machine's kernel. */
+    const readResources = Effect.fn("SshExecutor.readMachineResources")(function* (machine) {
+        const worker = machine.address.name;
+        const host = machine.shell.destination;
+        yield* Effect.annotateCurrentSpan({ worker, host });
+        const read = yield* commands.inspect("preflight", machine.shell, "sh", [
+            "-c",
+            RESOURCES_SCRIPT,
+        ]);
+        const resources = resourcesFromOutput(read.stdout);
+        if (read.exitCode === 0 && Option.isSome(resources))
+            return resources.value;
+        return yield* containerGap(worker, read.exitCode === SSH_FAILURE
+            ? `Can't reach SSH worker "${worker}" at ${host} to read its CPUs and memory`
+            : `Can't read the CPUs, memory, and task limit of SSH worker "${worker}" to derive the limits of its containers. Set cpus, memory_mib, and pids under the worker's container in usine.yaml.`, new Error(read.stderr.trim() || `exit code ${read.exitCode}`));
+    });
+    /**
+     * Returns the limits of each container on the machine when `slots` Attempts run on it at once:
+     * the ones `usine.yaml` sets, and the others derived from the machine. Reads the machine only
+     * if a limit is unset.
+     */
+    const limitsFor = Effect.fn("SshExecutor.containerLimits")(function* (machine, slots) {
+        yield* Effect.annotateCurrentSpan({ worker: machine.address.name, slots });
+        const configured = configuredLimits(machine.address.container);
+        if (Option.isSome(configured))
+            return configured.value;
+        return resolveLimits(machine.address.container, yield* readResources(machine), slots);
+    });
+    /**
+     * Returns the server version of the machine's Docker, or `None` if the machine has none and
+     * the SSH user no access to one. Fails if the SSH user can use Docker but Docker doesn't
+     * answer, because Attempts must then run in containers: as the SSH user, they could use
+     * Docker's socket to act as root.
+     */
+    const detect = Effect.fn("SshExecutor.detectContainerRuntime")(function* (machine) {
+        const worker = machine.address.name;
+        const host = machine.shell.destination;
+        yield* Effect.annotateCurrentSpan({ worker, host });
+        const detected = yield* commands.inspect("preflight", machine.shell, "sh", [
+            "-c",
+            DETECT_SCRIPT,
+            "sh",
+            CONTAINER_RUNTIME,
+        ]);
+        if (detected.exitCode === RUNTIME_ABSENT)
+            return Option.none();
+        const version = detected.stdout.trim();
+        if (detected.exitCode === 0 && version !== "")
+            return Option.some(version);
+        if (detected.exitCode === SSH_FAILURE)
+            return yield* containerGap(worker, `Can't reach SSH worker "${worker}" at ${host} to check Docker`, new Error(detected.stderr.trim() || `ssh exited with code ${SSH_FAILURE}`));
+        if (detected.exitCode === SOCKET_WITHOUT_CLI)
+            return yield* containerGap(worker, `The SSH user of worker "${worker}" can use Docker's socket, but the docker CLI isn't installed. Install it, so that each attempt runs in its own container, or take the user out of the docker group.`, new Error("docker group or writable socket without the docker CLI"));
+        return yield* containerGap(worker, `Docker on SSH worker "${worker}" doesn't respond to its SSH user. Start Docker, and add the user to the docker group.`, new Error(detected.stderr.trim() || `docker version exited with code ${detected.exitCode}`));
+    });
+    const record = (worker, isolation) => Ref.update(isolations, (current) => new Map(current).set(worker, isolation));
+    /**
+     * Records that the machine's Worker runs its Attempts as the SSH user, since the machine has no
+     * Docker, and logs it.
+     */
+    const recordSharedUser = (machine) => record(machine.address.name, sharedUser).pipe(Effect.andThen(Effect.logWarning("SSH Worker has no Docker; its Attempts run as the SSH user and can read each other's credentials", { worker: machine.address.name, host: machine.shell.destination })), Effect.as(sharedUser));
+    /**
+     * Records that each Attempt of the machine's Worker runs in its own container from the image,
+     * with the limits for `slots` Attempts on the machine at once, and logs them. `docker` is the
+     * server version of the machine's Docker.
+     */
+    const recordContainer = Effect.fn("SshExecutor.recordContainer")(function* (machine, docker, slots) {
+        const worker = machine.address.name;
+        const image = imageFor(machine);
+        yield* Effect.annotateCurrentSpan({ worker, image, slots });
+        const limits = yield* limitsFor(machine, slots);
+        const settings = { image, limits: limits.limits, instance, instanceId };
+        yield* record(worker, { _tag: "Container", settings });
+        yield* Effect.logInfo("SSH Worker runs each Attempt in its own container", {
+            worker,
+            host: machine.shell.destination,
+            docker,
+            image,
+            ...limitFields(limits),
+        });
+        return { _tag: "Container", settings, limits };
+    });
+    /**
+     * Checks the machine's Docker for preflight, pulls the Attempt image, checks that the image's
+     * user has the SSH user's ID, so the containers can write the checkouts, and finds the limits
+     * of each container when `slots` Attempts run on the machine at once. Only a machine without
+     * Docker runs Attempts as the SSH user, which the result reports as degraded; with Docker, any
+     * failure fails the preflight.
+     */
+    const verify = Effect.fn("SshExecutor.verifyContainers")(function* (machine, slots) {
+        const worker = machine.address.name;
+        const host = machine.shell.destination;
+        const image = imageFor(machine);
+        yield* Effect.annotateCurrentSpan({ worker, host, image, slots });
+        const version = yield* detect(machine);
+        if (Option.isNone(version)) {
+            yield* recordSharedUser(machine);
+            return {
+                _tag: "SharedUser",
+                degraded: "Docker isn't installed, so attempts run as the SSH user and can read each other's credentials. Install Docker to run each attempt in its own container.",
+            };
+        }
+        const pulled = yield* commands.inspect("preflight", machine.shell, CONTAINER_RUNTIME, [
+            "pull",
+            "--quiet",
+            image,
+        ]);
+        if (pulled.exitCode !== 0) {
+            const local = yield* commands.inspect("preflight", machine.shell, CONTAINER_RUNTIME, [
+                "image",
+                "inspect",
+                "--format",
+                "{{.Id}}",
+                image,
+            ]);
+            if (local.exitCode !== 0)
+                return yield* containerGap(worker, `SSH worker "${worker}" can't pull the attempt image ${image}`, new Error(pulled.stderr.trim() || `docker pull exited with code ${pulled.exitCode}`));
+            yield* Effect.logWarning("SSH Worker could not pull the Attempt image; its Attempts use the image already on the machine", { worker, host, image, message: pulled.stderr.trim() });
+        }
+        const ids = yield* commands.inspect("preflight", machine.shell, "sh", [
+            "-c",
+            USER_IDS_SCRIPT,
+            "sh",
+            CONTAINER_RUNTIME,
+            image,
+        ]);
+        const [hostId, imageId] = ids.stdout.trim().split(" ");
+        if (ids.exitCode !== 0 || hostId === undefined || imageId === undefined)
+            return yield* containerGap(worker, `SSH worker "${worker}" can't run the attempt image ${image}`, new Error(ids.stderr.trim() || `exit code ${ids.exitCode}`));
+        if (hostId !== imageId)
+            return yield* containerGap(worker, `The attempt image ${image} runs as user ID ${imageId}, and the SSH user of worker "${worker}" has ID ${hostId}, so its containers can't write the checkouts. Build the image with --build-arg USINE_UID=${hostId}.`, new Error(`user IDs ${hostId} and ${imageId}`));
+        yield* containers
+            .prepareStore("preflight", machine.shell, image, worker)
+            .pipe(Effect.mapError((error) => containerGap(worker, `Can't prepare the shared pnpm store: ${error.message}`, error)));
+        preparedStores.add(machine);
+        const size = yield* commands
+            .run("preflight", machine.shell, CONTAINER_RUNTIME, [
+            "run",
+            "--rm",
+            "--network",
+            "none",
+            "--mount",
+            PNPM_STORE_MOUNT,
+            "--entrypoint",
+            "du",
+            image,
+            "-sk",
+            PNPM_STORE_PATH,
+        ])
+            .pipe(Effect.flatMap((output) => decodeStoreSize(output.trim().split(/\s+/u)[0])), Effect.mapError((error) => containerGap(worker, `Can't measure the shared pnpm store on worker "${worker}"`, error)));
+        yield* Effect.logInfo("Shared pnpm store disk usage", {
+            worker,
+            host,
+            volume: PNPM_STORE_VOLUME,
+            sizeKiB: size,
+        });
+        return yield* recordContainer(machine, version.value, slots);
+    });
+    /**
+     * Returns how new Attempts on the machine run, as the Worker's last preflight found, or detects
+     * and logs it. Before any preflight on the Worker, as for the recovery of a provisioned Worker's
+     * machine, it derives the unset limits for one Attempt on the machine.
+     */
+    const isolationOf = Effect.fn("SshExecutor.isolation")(function* (machine) {
+        const recorded = (yield* Ref.get(isolations)).get(machine.address.name);
+        if (recorded !== undefined) {
+            if (recorded._tag === "Container")
+                yield* prepareStore(machine, recorded.settings.image);
+            return recorded;
+        }
+        const version = yield* detect(machine);
+        if (Option.isNone(version))
+            return yield* recordSharedUser(machine);
+        yield* prepareStore(machine, imageFor(machine));
+        const { settings } = yield* recordContainer(machine, version.value, 1);
+        return { _tag: "Container", settings };
+    });
+    /**
+     * Starts a container from `settings` for a preflight's harness probes, with the login files
+     * of `harnesses` and `environment`, until the caller's scope closes. It removes itself after
+     * 15 minutes if this process can't.
+     */
+    const preflightShell = Effect.fn("SshExecutor.preflightContainer")(function* (machine, settings, harnesses, environment) {
+        const suffix = yield* Random.nextIntBetween(0, 1_000_000_000);
+        return yield* containers.start("preflight", machine.shell, {
+            name: `usine-preflight-${safeSegment(machine.address.name)}-${suffix}`,
+            settings,
+            worker: machine.address.name,
+            attemptId: Option.none(),
+            checkout: Option.none(),
+            readOnly: [],
+            writable: [],
+            harnesses,
+            environment,
+            secrets: {},
+        });
+    });
+    const sweep = Effect.fn("SshExecutor.removeLeftContainers")(function* (worker) {
+        const machine = yield* machineFor(worker);
+        yield* Effect.annotateCurrentSpan({ worker, host: machine.shell.destination });
+        yield* Ref.update(reclaimed, (current) => new Set(current).add(worker));
+        yield* containers.sweep(machine.shell, instance, instanceId, worker, yield* Ref.get(reclaimed));
+    });
+    // Runs once per Worker in this process, before its first container starts. A failure is
+    // logged; the containers stay until the next process.
+    const swept = yield* Cache.make({
+        capacity: Number.POSITIVE_INFINITY,
+        lookup: (worker) => sweep(worker).pipe(Effect.tapError((error) => Effect.logWarning("Could not remove the containers an earlier process left", {
+            worker,
+            message: error.message,
+        })), Effect.ignore),
+    });
+    return {
+        verify,
+        isolation: isolationOf,
+        preflightShell,
+        reclaim: (worker) => Cache.get(swept, worker),
+    };
+});
+//# sourceMappingURL=container.js.map

package/dist/ssh/container.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"container.js","sourceRoot":"","sources":["../../src/ssh/container.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAmB,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACpE,OAAO,EAAsB,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,EAEL,iBAAiB,EAEjB,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,UAAU,GACX,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,gBAAgB,EAChB,aAAa,EAEb,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAGrB;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,cAAc,CAAC,IAAI,CAC9C,+DAA+D,CAChE,CAAC;AAEF,yGAAyG;AACzG,MAAM,cAAc,GAAG,CAAC,CAAC;AACzB,0GAA0G;AAC1G,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAE7B;;;GAGG;AACH,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;CAS/B,CAAC,IAAI,EAAE,CAAC;AAET,oGAAoG;AACpG,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,CAAA;;;CAGjC,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,eAAe,GAAG,MAAM,CAAC,mBAAmB,CAChD,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAChF,CAAC;AAaF,MAAM,YAAY,GAAG,CAAC,MAAkB,EAAE,OAAe,EAAE,KAAc,EAAE,EAAE,CAC3E,IAAI,qBAAqB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;AAEjF;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,EAAE,CAAC,2BAA2B,CAAC,CAAC,QAAQ,CAAC,EAC9E,QAAwB,EACxB,UAA4E,EAC5E,QAAgB,EAChB,UAAsB;IAEtB,MAAM,UAAU,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,cAAc,GAAG,IAAI,OAAO,EAAc,CAAC;IACjD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,YAAY,EAAc,CAAC;IACrD,MAAM,YAAY,GAAG,MAAM,CAAC,EAAE,CAAC,8BAA8B,CAAC,CAC5D,QAAQ,CAAC,EAAE,OAAmB,EAAE,KAAqB;QACnD,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC;QACxF,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,oDAAoD,EAAE,MAAM,CAAC,CAAC;YACrF,OAAO;QACT,CAAC;QACD,KAAK,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACtF,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC,EACD,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAC5E,CAAC;IACF,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,EAAgC,CAAC,CAAC;IAC5E,8FAA8F;IAC9F,kEAAkE;IAClE,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,EAAU,CAAC,CAAC;IAErD,MAAM,QAAQ,GAAG,CAAC,OAAmB,EAAkB,EAAE,CACvD,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC;IAEzE,sEAAsE;IACtE,MAAM,aAAa,GAAG,MAAM,CAAC,EAAE,CAAC,kCAAkC,CAAC,CAAC,QAAQ,CAAC,EAC3E,OAAmB;QAEnB,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;QACpC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACvC,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE;YACrE,IAAI;YACJ,gBAAgB;SACjB,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC,KAAK,CAAC;QAC5E,OAAO,KAAK,CAAC,CAAC,YAAY,CACxB,MAAM,EACN,IAAI,CAAC,QAAQ,KAAK,WAAW;YAC3B,CAAC,CAAC,2BAA2B,MAAM,QAAQ,IAAI,8BAA8B;YAC7E,CAAC,CAAC,8DAA8D,MAAM,sHAAsH,EAC9L,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,aAAa,IAAI,CAAC,QAAQ,EAAE,CAAC,CAC9D,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH;;;;OAIG;IACH,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,6BAA6B,CAAC,CAAC,QAAQ,CAAC,EAClE,OAAmB,EACnB,KAAa;QAEb,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3E,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC/D,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;YAAE,OAAO,UAAU,CAAC,KAAK,CAAC;QACvD,OAAO,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IAEH;;;;;OAKG;IACH,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,oCAAoC,CAAC,CAAC,QAAQ,CAAC,EAAE,OAAmB;QAC3F,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;QACpC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACvC,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE;YACzE,IAAI;YACJ,aAAa;YACb,IAAI;YACJ,iBAAiB;SAClB,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,QAAQ,KAAK,cAAc;YAAE,OAAO,MAAM,CAAC,IAAI,EAAU,CAAC;QACvE,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACvC,IAAI,QAAQ,CAAC,QAAQ,KAAK,CAAC,IAAI,OAAO,KAAK,EAAE;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3E,IAAI,QAAQ,CAAC,QAAQ,KAAK,WAAW;YACnC,OAAO,KAAK,CAAC,CAAC,YAAY,CACxB,MAAM,EACN,2BAA2B,MAAM,QAAQ,IAAI,kBAAkB,EAC/D,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,wBAAwB,WAAW,EAAE,CAAC,CAC3E,CAAC;QACJ,IAAI,QAAQ,CAAC,QAAQ,KAAK,kBAAkB;YAC1C,OAAO,KAAK,CAAC,CAAC,YAAY,CACxB,MAAM,EACN,2BAA2B,MAAM,sKAAsK,EACvM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CACpE,CAAC;QACJ,OAAO,KAAK,CAAC,CAAC,YAAY,CACxB,MAAM,EACN,yBAAyB,MAAM,wFAAwF,EACvH,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,mCAAmC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAC5F,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,CAAC,MAAkB,EAAE,SAA2B,EAAE,EAAE,CACjE,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IAE/E;;;OAGG;IACH,MAAM,gBAAgB,GAAG,CAAC,OAAmB,EAAE,EAAE,CAC/C,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,IAAI,CAC3C,MAAM,CAAC,OAAO,CACZ,MAAM,CAAC,UAAU,CACf,kGAAkG,EAClG,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAClE,CACF,EACD,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,CACtB,CAAC;IAEJ;;;;OAIG;IACH,MAAM,eAAe,GAAG,MAAM,CAAC,EAAE,CAAC,6BAA6B,CAAC,CAAC,QAAQ,CAAC,EACxE,OAAmB,EACnB,MAAc,EACd,KAAa;QAEb,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;QACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChC,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAsB,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;QAC3F,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC;QACvD,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,mDAAmD,EAAE;YACzE,MAAM;YACN,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW;YAC/B,MAAM;YACN,KAAK;YACL,GAAG,WAAW,CAAC,MAAM,CAAC;SACvB,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAA2B,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH;;;;;;OAMG;IACH,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,8BAA8B,CAAC,CAAC,QAAQ,CAAC,EAChE,OAAmB,EACnB,KAAa;QAEb,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;QACpC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChC,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,KAAK,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACjC,OAAO;gBACL,IAAI,EAAE,YAAY;gBAClB,QAAQ,EACN,yJAAyJ;aACnI,CAAC;QAC7B,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,EAAE,iBAAiB,EAAE;YACpF,MAAM;YACN,SAAS;YACT,KAAK;SACN,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,EAAE,iBAAiB,EAAE;gBACnF,OAAO;gBACP,SAAS;gBACT,UAAU;gBACV,SAAS;gBACT,KAAK;aACN,CAAC,CAAC;YACH,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC;gBACtB,OAAO,KAAK,CAAC,CAAC,YAAY,CACxB,MAAM,EACN,eAAe,MAAM,kCAAkC,KAAK,EAAE,EAC9D,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,gCAAgC,MAAM,CAAC,QAAQ,EAAE,CAAC,CACrF,CAAC;YACJ,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CACtB,gGAAgG,EAChG,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CACvD,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE;YACpE,IAAI;YACJ,eAAe;YACf,IAAI;YACJ,iBAAiB;YACjB,KAAK;SACN,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvD,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;YACrE,OAAO,KAAK,CAAC,CAAC,YAAY,CACxB,MAAM,EACN,eAAe,MAAM,iCAAiC,KAAK,EAAE,EAC7D,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,aAAa,GAAG,CAAC,QAAQ,EAAE,CAAC,CAC5D,CAAC;QACJ,IAAI,MAAM,KAAK,OAAO;YACpB,OAAO,KAAK,CAAC,CAAC,YAAY,CACxB,MAAM,EACN,qBAAqB,KAAK,oBAAoB,OAAO,iCAAiC,MAAM,YAAY,MAAM,6FAA6F,MAAM,GAAG,EACpN,IAAI,KAAK,CAAC,YAAY,MAAM,QAAQ,OAAO,EAAE,CAAC,CAC/C,CAAC;QACJ,KAAK,CAAC,CAAC,UAAU;aACd,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC;aACvD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,YAAY,CAAC,MAAM,EAAE,wCAAwC,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,CACrF,CACF,CAAC;QACJ,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ;aACzB,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,EAAE,iBAAiB,EAAE;YAClD,KAAK;YACL,MAAM;YACN,WAAW;YACX,MAAM;YACN,SAAS;YACT,gBAAgB;YAChB,cAAc;YACd,IAAI;YACJ,KAAK;YACL,KAAK;YACL,eAAe;SAChB,CAAC;aACD,IAAI,CACH,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAC3E,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,YAAY,CAAC,MAAM,EAAE,kDAAkD,MAAM,GAAG,EAAE,KAAK,CAAC,CACzF,CACF,CAAC;QACJ,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,8BAA8B,EAAE;YACpD,MAAM;YACN,IAAI;YACJ,MAAM,EAAE,iBAAiB;YACzB,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH;;;;OAIG;IACH,MAAM,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC,QAAQ,CAAC,EAAE,OAAmB;QACnF,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACxE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW;gBAAE,KAAK,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACzF,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACpE,KAAK,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAChD,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACvE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAA6B,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH;;;;OAIG;IACH,MAAM,cAAc,GAAG,MAAM,CAAC,EAAE,CAAC,gCAAgC,CAAC,CAAC,QAAQ,CAAC,EAC1E,OAAmB,EACnB,QAA2B,EAC3B,SAAiC,EACjC,WAA6C;QAE7C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;QAC9D,OAAO,KAAK,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,EAAE;YACzD,IAAI,EAAE,mBAAmB,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE;YACtE,QAAQ;YACR,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;YAC5B,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE;YACxB,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE;YACvB,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,EAAE;YACZ,SAAS;YACT,WAAW;YACX,OAAO,EAAE,EAAE;SACZ,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,kCAAkC,CAAC,CAAC,QAAQ,CAAC,EAAE,MAAkB;QACvF,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC1C,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/E,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACxE,KAAK,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IAClG,CAAC,CAAC,CAAC;IACH,wFAAwF;IACxF,sDAAsD;IACtD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QAC9B,QAAQ,EAAE,MAAM,CAAC,iBAAiB;QAClC,MAAM,EAAE,CAAC,MAAkB,EAAE,EAAE,CAC7B,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAChB,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,MAAM,CAAC,UAAU,CAAC,yDAAyD,EAAE;YAC3E,MAAM;YACN,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CACH,EACD,MAAM,CAAC,MAAM,CACd;KACJ,CAAC,CAAC;IAEH,OAAO;QACL,MAAM;QACN,SAAS,EAAE,WAAW;QACtB,cAAc;QACd,OAAO,EAAE,CAAC,MAAkB,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC;KAC1D,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/ssh/credentials.d.ts

@@ -0,0 +1,43 @@
+import type { WorkerName } from "@usine/core/worker";
+import { Effect } from "effect";
+import { CredentialProvider, type ExecutorError } from "../executor.ts";
+import type { RemoteCommands } from "../remote/commands.ts";
+import type { SshMachine } from "./model.ts";
+/**
+ * Writes each Attempt's token to a directory next to the Worker's checkouts that only the SSH
+ * user can read, renews it before expiry, and removes it when the Attempt's scope closes. All
+ * Attempts on the Worker can read each other's tokens (ADR 0026). `reclaim` removes credentials
+ * left by an earlier process, once per process.
+ */
+export declare const sshCredentialsFor: (commands: RemoteCommands, machineFor: (worker: WorkerName) => Effect.Effect<SshMachine, ExecutorError>) => Effect.Effect<{
+    acquire: (attemptId: string & import("effect/Brand").Brand<"AttemptId">, worker: string & import("effect/Brand").Brand<"WorkerName">, repository: string & import("effect/Brand").Brand<"RepositoryName">, permissions: "read" | "write", machine: SshMachine, operation: "cancel" | "cleanup" | "launch" | "preflight" | "prepare") => Effect.Effect<{
+        environment: {
+            GH_CONFIG_DIR: string;
+            GH_PROMPT_DISABLED: string;
+            USINE_GITHUB_TOKEN_FILE: string;
+            GIT_CONFIG_COUNT: string;
+            GIT_CONFIG_KEY_0: string;
+            GIT_CONFIG_VALUE_0: string;
+            GIT_CONFIG_KEY_1: string;
+            GIT_CONFIG_VALUE_1: string;
+        };
+        gitEnvironment: {
+            GH_CONFIG_DIR: string;
+            GH_PROMPT_DISABLED: string;
+            USINE_GITHUB_TOKEN_FILE: string;
+            GIT_CONFIG_COUNT: string;
+            GIT_CONFIG_KEY_0: string;
+            GIT_CONFIG_VALUE_0: string;
+            GIT_CONFIG_KEY_1: string;
+            GIT_CONFIG_VALUE_1: string;
+        };
+        shell: import("@usine/agents/child-host").RemoteShell;
+        secrets: {};
+        readOnlyPaths: string[];
+        writablePaths: never[];
+        refresh: Effect.Effect<void, import("../executor.ts").CredentialUnavailableError | import("../executor.ts").ExecutorOperationError, never>;
+        scrub: (text: string) => string;
+    }, import("../executor.ts").CredentialUnavailableError | import("../executor.ts").ExecutorOperationError, import("effect/Scope").Scope>;
+    reclaim: (worker: WorkerName) => Effect.Effect<void, never, never>;
+}, never, CredentialProvider>;
+//# sourceMappingURL=credentials.d.ts.map

package/dist/ssh/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/ssh/credentials.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAS,MAAM,EAAY,MAAM,QAAQ,CAAC;AAEjD,OAAO,EACL,kBAAkB,EAClB,KAAK,aAAa,EAGnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAG5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAuB7C;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,kDAEP,UAAU,KAAK,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sBA+BnD,UAAU;6BA6EnC,CAAC"}

package/dist/ssh/credentials.js

@@ -0,0 +1,86 @@
+import { safeSegment } from "@usine/core/repository";
+import { Cache, Effect, Redacted } from "effect";
+import { credentialEnvironment, GH_CONFIG, ghHostsConfig } from "../credential-environment.js";
+import { CredentialProvider, } from "../executor.js";
+import { renewableCredential } from "../renewable-credential.js";
+/**
+ * A script that writes the Attempt's credential directory `$3` inside the credentials root
+ * `$2`: the token from the first stdin line, gh's `hosts.yml` from the rest, and gh's
+ * `config.yml` from `$1`. Sets mode 700 on both directories. Reading the token from stdin keeps
+ * it out of arguments and the environment; each file is written then renamed.
+ */
+const WRITE_CREDENTIAL_SCRIPT = String.raw `
+set -e
+umask 077
+mkdir -p "$2" "$3"
+chmod 700 "$2" "$3"
+IFS= read -r token
+printf '%s' "$token" > "$3/token.next"
+cat > "$3/hosts.next"
+test -f "$3/config.yml" || printf '%s' "$1" > "$3/config.yml"
+mv "$3/token.next" "$3/token"
+mv "$3/hosts.next" "$3/hosts.yml"
+`.trim();
+const credentialsRoot = (machine) => `${machine.workerDirectory}/credentials`;
+/**
+ * Writes each Attempt's token to a directory next to the Worker's checkouts that only the SSH
+ * user can read, renews it before expiry, and removes it when the Attempt's scope closes. All
+ * Attempts on the Worker can read each other's tokens (ADR 0026). `reclaim` removes credentials
+ * left by an earlier process, once per process.
+ */
+export const sshCredentialsFor = Effect.fn("SshExecutor.credentialsFor")(function* (commands, machineFor) {
+    const provider = yield* CredentialProvider;
+    const removeStale = Effect.fn("SshExecutor.removeStaleCredentials")(function* (worker) {
+        const machine = yield* machineFor(worker);
+        const host = machine.shell.destination;
+        yield* Effect.annotateCurrentSpan({ worker, host });
+        yield* commands.run("cleanup", machine.shell, "rm", ["-rf", credentialsRoot(machine)]);
+        yield* Effect.logInfo("Removed credentials an earlier process left on the SSH Worker", {
+            worker,
+            host,
+        });
+    });
+    // A failed removal is logged and cached, not retried: the remaining tokens expire within an
+    // hour and the next start removes them.
+    const reclaimed = yield* Cache.make({
+        capacity: Number.POSITIVE_INFINITY,
+        lookup: (worker) => removeStale(worker).pipe(Effect.tapError((error) => Effect.logWarning("Could not remove stale credentials from the SSH Worker", {
+            worker,
+            message: error.message,
+        })), Effect.ignore),
+    });
+    const reclaim = (worker) => Cache.get(reclaimed, worker);
+    const write = Effect.fn("SshExecutor.writeCredential")(function* (operation, machine, directory, { value }) {
+        yield* Effect.annotateCurrentSpan({ host: machine.shell.destination, directory });
+        const payload = Redacted.make(`${Redacted.value(value)}\n${ghHostsConfig(Redacted.value(value))}`);
+        yield* commands
+            .runWithInput(operation, machine.shell, "sh", ["-c", WRITE_CREDENTIAL_SCRIPT, "sh", GH_CONFIG, credentialsRoot(machine), directory], payload)
+            .pipe(Effect.ensuring(Effect.sync(() => Redacted.wipeUnsafe(payload))));
+    }, 
+    // Scope closure waits for an in-flight write, so a late renewal cannot run after the removal.
+    Effect.uninterruptible);
+    const acquire = Effect.fn("SshExecutor.acquireCredential")(function* (attemptId, worker, repository, permissions, machine, operation) {
+        const host = machine.shell.destination;
+        yield* Effect.annotateCurrentSpan({ attemptId, worker, repository, permissions, host });
+        const directory = `${credentialsRoot(machine)}/${safeSegment(attemptId)}`;
+        yield* Effect.addFinalizer(() => commands.run("cleanup", machine.shell, "rm", ["-rf", directory]).pipe(Effect.tap(() => Effect.logInfo("Removed the Attempt's credential from the SSH Worker", {
+            attemptId,
+            worker,
+            host,
+        })), Effect.tapError((error) => Effect.logError("Could not remove the Attempt's credential from the SSH Worker; it expires within the hour", { attemptId, worker, host, message: error.message })), Effect.ignore));
+        const credential = yield* renewableCredential(provider.issue, repository, attemptId, permissions, (issued) => write(operation, machine, directory, issued));
+        const environment = credentialEnvironment(directory);
+        return {
+            environment,
+            gitEnvironment: environment,
+            shell: machine.shell,
+            secrets: {},
+            readOnlyPaths: [directory],
+            writablePaths: [],
+            refresh: credential.refresh(),
+            scrub: credential.scrub,
+        };
+    });
+    return { acquire, reclaim };
+});
+//# sourceMappingURL=credentials.js.map

package/dist/ssh/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/ssh/credentials.ts"],"names":[],"mappings":"AAEA,OAAO,EAAuB,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1E,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC/F,OAAO,EACL,kBAAkB,GAInB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAGjE;;;;;GAKG;AACH,MAAM,uBAAuB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;CAWzC,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,eAAe,GAAG,CAAC,OAAmB,EAAU,EAAE,CAAC,GAAG,OAAO,CAAC,eAAe,cAAc,CAAC;AAElG;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,EAAE,CAAC,4BAA4B,CAAC,CAAC,QAAQ,CAAC,EAChF,QAAwB,EACxB,UAA4E;IAE5E,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC;IAE3C,MAAM,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC,oCAAoC,CAAC,CAAC,QAAQ,CAAC,EAC3E,MAAkB;QAElB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACvC,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACvF,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,+DAA+D,EAAE;YACrF,MAAM;YACN,IAAI;SACL,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,4FAA4F;IAC5F,wCAAwC;IACxC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QAClC,QAAQ,EAAE,MAAM,CAAC,iBAAiB;QAClC,MAAM,EAAE,CAAC,MAAkB,EAAE,EAAE,CAC7B,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,CACtB,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,MAAM,CAAC,UAAU,CAAC,wDAAwD,EAAE;YAC1E,MAAM;YACN,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CACH,EACD,MAAM,CAAC,MAAM,CACd;KACJ,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,CAAC,MAAkB,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAErE,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,6BAA6B,CAAC,CACpD,QAAQ,CAAC,EACP,SAA4B,EAC5B,OAAmB,EACnB,SAAiB,EACjB,EAAE,KAAK,EAAoB;QAE3B,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;QAClF,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAC3B,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CACpE,CAAC;QACF,KAAK,CAAC,CAAC,QAAQ;aACZ,YAAY,CACX,SAAS,EACT,OAAO,CAAC,KAAK,EACb,IAAI,EACJ,CAAC,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,EACrF,OAAO,CACR;aACA,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,8FAA8F;IAC9F,MAAM,CAAC,eAAe,CACvB,CAAC;IAEF,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,+BAA+B,CAAC,CAAC,QAAQ,CAAC,EAClE,SAAoB,EACpB,MAAkB,EAClB,UAA0B,EAC1B,WAA4B,EAC5B,OAAmB,EACnB,SAA4B;QAE5B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACvC,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,MAAM,SAAS,GAAG,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1E,KAAK,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,CAC9B,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CACnE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CACd,MAAM,CAAC,OAAO,CAAC,sDAAsD,EAAE;YACrE,SAAS;YACT,MAAM;YACN,IAAI;SACL,CAAC,CACH,EACD,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,MAAM,CAAC,QAAQ,CACb,2FAA2F,EAC3F,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CACpD,CACF,EACD,MAAM,CAAC,MAAM,CACd,CACF,CAAC;QACF,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAC3C,QAAQ,CAAC,KAAK,EACd,UAAU,EACV,SAAS,EACT,WAAW,EACX,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CACzD,CAAC;QACF,MAAM,WAAW,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;QACrD,OAAO;YACL,WAAW;YACX,cAAc,EAAE,WAAW;YAC3B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO,EAAE,EAAE;YACX,aAAa,EAAE,CAAC,SAAS,CAAC;YAC1B,aAAa,EAAE,EAAE;YACjB,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE;YAC7B,KAAK,EAAE,UAAU,CAAC,KAAK;SACD,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC,CAAC,CAAC"}

package/dist/ssh/gateway/admin.d.ts

@@ -0,0 +1,45 @@
+import { type AttachRequest, type Attached, type AttachmentId, type AttachmentList, type Detached, type LlmProviderList } from "@usine/gateway/admin";
+import { Effect, Option, Schema } from "effect";
+import { HttpClient } from "effect/http";
+import type { SshWorkerGateway } from "../model.ts";
+import { type GatewayForward } from "./forward.ts";
+declare const GatewayAdminError_base: Schema.Class<GatewayAdminError, Schema.TaggedStruct<"GatewayAdminError", {
+    readonly worker: Schema.brand<Schema.String, "WorkerName">;
+    readonly operation: Schema.Literals<readonly ["attach", "renew", "detach", "list", "providers"]>;
+    readonly message: Schema.NonEmptyString;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * The error for a failed Gateway admin API request. `message` contains no token; the request
+ * and raw failure are discarded because an attach request contains the installation token.
+ */
+export declare class GatewayAdminError extends GatewayAdminError_base {
+}
+export interface GatewayAdmin {
+    /** Attaches an Attempt's token for the Worker and a repository. Returns the attachment ID and its caller token. */
+    readonly attach: (request: AttachRequest) => Effect.Effect<Attached, GatewayAdminError>;
+    /** Replaces the token and expiry of attachment `id`, or re-creates it after a Gateway restart. The caller token doesn't change. */
+    readonly renew: (id: AttachmentId, request: AttachRequest) => Effect.Effect<Attached, GatewayAdminError>;
+    /** Removes attachment `id` and returns whether it existed. */
+    readonly detach: (id: AttachmentId) => Effect.Effect<Detached, GatewayAdminError>;
+    /** Returns the active attachments for all the Gateway's Workers. */
+    readonly list: Effect.Effect<AttachmentList, GatewayAdminError>;
+    /**
+     * Returns the LLM providers the Gateway has credentials for, with each credential kind. Returns
+     * `None` if the Gateway predates this endpoint.
+     */
+    readonly providers: Effect.Effect<Option.Option<LlmProviderList>, GatewayAdminError>;
+}
+/**
+ * Returns the admin API client for the Gateway in front of `worker`, connected through
+ * `forward` with the admin token as a bearer token. If the forward is closed or a request gets
+ * no response, reopens the forward and retries once.
+ */
+export declare const gatewayAdminFor: (worker: string & import("effect/Brand").Brand<"WorkerName">, gateway: SshWorkerGateway, forward: GatewayForward) => Effect.Effect<{
+    attach: (request: AttachRequest) => Effect.Effect<Attached, GatewayAdminError, never>;
+    renew: (id: string & import("effect/Brand").Brand<"AttachmentId">, request: AttachRequest) => Effect.Effect<Attached, GatewayAdminError, never>;
+    detach: (id: string & import("effect/Brand").Brand<"AttachmentId">) => Effect.Effect<Detached, GatewayAdminError, never>;
+    list: Effect.Effect<AttachmentList, GatewayAdminError, never>;
+    providers: Effect.Effect<Option.Option<never> | Option.Option<LlmProviderList>, GatewayAdminError, never>;
+}, never, HttpClient.HttpClient>;
+export {};
+//# sourceMappingURL=admin.d.ts.map

package/dist/ssh/gateway/admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../../src/ssh/gateway/admin.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,QAAQ,EAEb,KAAK,eAAe,EACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAkB,MAAM,EAAE,MAAM,EAAyB,MAAM,EAAE,MAAM,QAAQ,CAAC;AACvF,OAAO,EAAE,UAAU,EAAsC,MAAM,aAAa,CAAC;AAE7E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,KAAK,cAAc,EAA0C,MAAM,cAAc,CAAC;;;;;;AAa3F;;;GAGG;AACH,qBAAa,iBAAkB,SAAQ,sBAMrC;CAAG;AAEL,MAAM,WAAW,YAAY;IAC3B,mHAAmH;IACnH,QAAQ,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;IACxF,mIAAmI;IACnI,QAAQ,CAAC,KAAK,EAAE,CACd,EAAE,EAAE,YAAY,EAChB,OAAO,EAAE,aAAa,KACnB,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;IAChD,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,YAAY,KAAK,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;IAClF,oEAAoE;IACpE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;IAChE;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,iBAAiB,CAAC,CAAC;CACtF;AAmED;;;;GAIG;AACH,eAAO,MAAM,eAAe;;;;;;gCAgF1B,CAAC"}