@wardby/cli 0.1.0

package/dist/providers/executor/types.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Executor seam — how the scheduler durably runs a `Run` to a terminal
+ * state.
+ *
+ * Phase 2's default (`InProcessExecutor`) provides durability via a
+ * heartbeat plus an external reconciler. Phase 3 can add a `DbosExecutor`
+ * backed by durable workflow steps with no scheduler or CLI change — the
+ * scheduler only ever calls `start(runId)` and never sees the mechanism.
+ */
+export interface PersistedExecutionHandle {
+    runId: string;
+    backend: string;
+    id: string;
+}
+export type ExecutionRecoveryResult = {
+    state: "active";
+} | {
+    state: "terminal";
+} | {
+    state: "lost";
+    reason?: string;
+};
+export interface CodingImageSelector {
+    provider: CodingProvider;
+    toolchain: string;
+    toolchainVersion: string | null;
+    workerImageRef: string | null;
+}
+export interface Executor {
+    start: (runId: string) => Promise<void>;
+    stop: (runId: string, reason?: string) => Promise<void>;
+    /**
+     * Implementations must query the persisted handle and, before returning
+     * `lost`, best-effort stop and collect it. `terminal` means collection and
+     * terminal Run persistence completed. Recovery must never relaunch a job.
+     */
+    recover?: (handle: PersistedExecutionHandle) => Promise<ExecutionRecoveryResult>;
+    /**
+     * Optional one-time startup. A durable backend connects and re-drives the
+     * workflows it owned before the last restart. Composition roots call it
+     * before starting the scheduler or MCP server.
+     */
+    launch?: () => Promise<void>;
+    /** Optional graceful shutdown counterpart to `launch`. */
+    close?: () => Promise<void>;
+    /**
+     * Resolves a coding agent's profile selection to an immutable worker
+     * image digest, once, at dispatch time (src/core/dispatch.ts) — never
+     * called from the hot path. Must throw on an unresolvable
+     * (provider, toolchain, toolchainVersion) tuple, fail-closed, same convention as
+     * the LLM pricing tables' unknown-model throw.
+     */
+    resolveCodingWorkerImage?(selector: CodingImageSelector): string;
+}
+import type { CodingProvider } from "../../coding/provider.js";

package/dist/providers/executor/types.js

@@ -0,0 +1 @@
+export {};

package/dist/providers/index.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Provider seams — the interfaces the core depends on.
+ *
+ * The core imports only from here; it never references a concrete adapter or a
+ * cloud SDK. Adapters live alongside each interface (e.g. `jobs/local.ts`,
+ * `jobs/kubernetes.ts`) and are wired up from configuration.
+ */
+export * from "./jobs/types.js";
+export * from "./email/types.js";
+export * from "./llm/types.js";
+export * from "./secrets/types.js";
+export * from "./auth/types.js";
+export * from "./storage/types.js";
+export * from "./executor/types.js";
+export * from "./datastore/types.js";
+export * from "./memory/types.js";
+export * from "./engine/types.js";
+export * from "./vcs/types.js";
+import type { JobLauncher } from "./jobs/types.js";
+import type { EmailProvider } from "./email/types.js";
+import type { LlmProvider } from "./llm/types.js";
+import type { SecretCipher } from "./secrets/types.js";
+import type { AuthProvider } from "./auth/types.js";
+import type { BlobStore } from "./storage/types.js";
+import type { Executor } from "./executor/types.js";
+import type { Datastore } from "./datastore/types.js";
+import type { AgentMemoryStore } from "./memory/types.js";
+import type { Engine } from "./engine/types.js";
+import type { VcsProvider } from "./vcs/types.js";
+/** The full set of providers the core is given at startup. */
+export interface ProviderRegistry {
+    jobs: JobLauncher;
+    email: EmailProvider;
+    llm: LlmProvider;
+    secrets: SecretCipher;
+    auth: AuthProvider;
+    storage: BlobStore;
+    executor: Executor;
+    datastore: Datastore;
+    memory: AgentMemoryStore;
+    engine: Engine;
+    vcs: VcsProvider;
+}

package/dist/providers/index.js

@@ -0,0 +1,18 @@
+/**
+ * Provider seams — the interfaces the core depends on.
+ *
+ * The core imports only from here; it never references a concrete adapter or a
+ * cloud SDK. Adapters live alongside each interface (e.g. `jobs/local.ts`,
+ * `jobs/kubernetes.ts`) and are wired up from configuration.
+ */
+export * from "./jobs/types.js";
+export * from "./email/types.js";
+export * from "./llm/types.js";
+export * from "./secrets/types.js";
+export * from "./auth/types.js";
+export * from "./storage/types.js";
+export * from "./executor/types.js";
+export * from "./datastore/types.js";
+export * from "./memory/types.js";
+export * from "./engine/types.js";
+export * from "./vcs/types.js";

package/dist/providers/jobs/docker-isolation.d.ts

@@ -0,0 +1,166 @@
+import type { JobSpec } from "./types.js";
+export declare const CODING_WORKER_UID = 10001;
+export declare const CODING_WORKER_GID = 10001;
+export declare const CODING_PROXY_ALIAS = "wardby-proxy";
+export declare const CODING_PROXY_PORT = 8787;
+/**
+ * The proxy's deny port. Nothing is served here (see coding-proxy/deny-port.ts);
+ * it is the enforcement witness — the one destination a run's NetworkPolicy must
+ * refuse while permitting CODING_PROXY_PORT on the same pod.
+ */
+export declare const CODING_PROXY_DENY_PORT = 8788;
+export declare const DOCKER_ISOLATION_ERROR = "docker_isolation_unsupported";
+export declare const WORKER_STOP_GRACE_SECONDS = 10;
+export declare const WORKER_PATHS: {
+    readonly workspace: "/workspace";
+    readonly git: "/workspace/.git";
+    readonly input: "/run/wardby/input";
+    readonly output: "/run/wardby/output";
+    readonly tool: "/run/wardby/tool";
+    readonly storage: "/run/wardby/storage";
+};
+export interface DockerIsolationNames {
+    network: string;
+    storageVolume: string;
+    keeperContainer: string;
+    workerContainer: string;
+    toolContainer: string;
+}
+export interface DockerIsolationPlan {
+    names: DockerIsolationNames;
+    deadlineMs: number;
+    stopGraceSeconds: number;
+    networkCreateArgs: string[];
+    storageVolumeCreateArgs: string[];
+    keeperCreateArgs: string[];
+    workerCreateArgs: string[];
+    toolCreateArgs?: string[];
+    proxyNetworkConnectArgs: string[];
+}
+export interface DockerHostInfo {
+    OSType?: string;
+    CgroupVersion?: string;
+    MemoryLimit?: boolean;
+    SwapLimit?: boolean;
+    CpuCfsQuota?: boolean;
+    PidsLimit?: boolean;
+    SecurityOptions?: string[];
+    Plugins?: {
+        Volume?: string[];
+        Network?: string[];
+    };
+}
+export interface DockerNetworkInspection {
+    Name?: string;
+    Driver?: string;
+    Internal?: boolean;
+    EnableIPv6?: boolean;
+    Attachable?: boolean;
+    Ingress?: boolean;
+    Labels?: Record<string, string>;
+    Options?: Record<string, string>;
+    Containers?: Record<string, {
+        Name?: string;
+    }>;
+}
+export interface DockerVolumeInspection {
+    Name?: string;
+    Driver?: string;
+    Labels?: Record<string, string>;
+    Options?: Record<string, string>;
+}
+export interface DockerContainerInspection {
+    Config?: {
+        Env?: string[];
+        User?: string;
+        Image?: string;
+        Labels?: Record<string, string>;
+    };
+    HostConfig?: {
+        AutoRemove?: boolean;
+        Binds?: string[] | null;
+        CapAdd?: string[] | null;
+        CapDrop?: string[] | null;
+        CgroupnsMode?: string;
+        CpuQuota?: number;
+        CpuPeriod?: number;
+        Devices?: unknown[];
+        DeviceRequests?: unknown[] | null;
+        Dns?: string[] | null;
+        DnsOptions?: string[] | null;
+        DnsSearch?: string[] | null;
+        ExtraHosts?: string[] | null;
+        GroupAdd?: string[] | null;
+        IpcMode?: string;
+        Init?: boolean;
+        LogConfig?: {
+            Type?: string;
+            Config?: Record<string, string>;
+        };
+        Memory?: number;
+        MemorySwap?: number;
+        MemorySwappiness?: number | null;
+        NetworkMode?: string;
+        NanoCpus?: number;
+        PidsLimit?: number | null;
+        PortBindings?: Record<string, unknown>;
+        PublishAllPorts?: boolean;
+        PidMode?: string;
+        Privileged?: boolean;
+        ReadonlyRootfs?: boolean;
+        RestartPolicy?: {
+            Name?: string;
+        };
+        SecurityOpt?: string[] | null;
+        ShmSize?: number;
+        Tmpfs?: Record<string, string>;
+        Mounts?: Array<{
+            Type?: string;
+            Source?: string;
+            Target?: string;
+            ReadOnly?: boolean;
+            VolumeOptions?: {
+                NoCopy?: boolean;
+                Subpath?: string;
+            };
+        }>;
+    };
+    Mounts?: Array<{
+        Type?: string;
+        Name?: string;
+        Destination?: string;
+        RW?: boolean;
+    }>;
+    NetworkSettings?: {
+        Networks?: Record<string, {
+            Aliases?: string[] | null;
+            DNSNames?: string[] | null;
+            Gateway?: string;
+        }>;
+        Ports?: Record<string, unknown>;
+    };
+}
+/** A registry digest reference (`[host[:port]/]path@sha256:<64 hex>`); no local image IDs, no tags. */
+export declare function isRepositoryDigest(image: string): boolean;
+/** Accepts a registry digest or Docker's content-addressed local image ID. */
+export declare function isImmutableDockerImage(image: string): boolean;
+export declare function isolationNames(runId: string): DockerIsolationNames;
+export declare function buildIsolationNetworkCreateArgs(runId: string): string[];
+export declare function buildStorageVolumeCreateArgs(spec: JobSpec): string[];
+export declare function buildKeeperCreateArgs(spec: JobSpec): string[];
+export declare function buildWorkerCreateArgs(spec: JobSpec, proxyPort?: number): string[];
+/** The Claude agent sees the task/result and socket, never the repository workspace. */
+export declare function buildClaudeAgentCreateArgs(spec: JobSpec, proxyPort?: number): string[];
+/** The tool runner receives only the checkout and socket; it never joins the proxy network. */
+export declare function buildClaudeToolRunnerCreateArgs(spec: JobSpec): string[];
+export declare function buildProxyNetworkConnectArgs(runId: string, proxyContainer: string): string[];
+export declare function buildDockerIsolationPlan(spec: JobSpec, proxyContainer: string): DockerIsolationPlan;
+export declare function assertDockerHostSupportsIsolation(info: DockerHostInfo): void;
+export declare function assertIsolationNetworkInspection(network: DockerNetworkInspection, runId: string): void;
+export declare function assertIsolationNetworkParticipants(network: DockerNetworkInspection, expectedContainerNames: string[]): void;
+export declare function assertStorageVolumeInspection(volume: DockerVolumeInspection, spec: JobSpec): void;
+export declare function assertKeeperContainerInspection(container: DockerContainerInspection, spec: JobSpec): void;
+export declare function assertProxyContainerInspection(container: DockerContainerInspection, runId: string): void;
+export declare function assertWorkerContainerInspection(container: DockerContainerInspection, spec: JobSpec, expectedCapability: string): void;
+export declare function assertClaudeAgentContainerInspection(container: DockerContainerInspection, spec: JobSpec, expectedCapability: string): void;
+export declare function assertClaudeToolRunnerContainerInspection(container: DockerContainerInspection, spec: JobSpec): void;