@wardby/cli 0.4.1 → 0.5.0

package/dist/providers/executor/container.js

@@ -9,8 +9,11 @@ import { parseStoredServices, storedServiceNames, workerServices } from "../../c
 import { MAX_SERVICE_DECLARATION_BYTES, SERVICE_DECLARATION_PATH } from "../../coding/services/declaration.js";
 import { SERVICE_UNREADY_CATEGORY, SERVICE_UNREADY_ERROR, serviceUnreadyName, serviceUnreadySentence, } from "../../coding/services/wording.js";
 import { PROTECTED_PATH_CATEGORY, protectedPathFromError, protectedPathSentence, } from "../../coding/protected-path-wording.js";
+import { CONTINUATION_CLOSED_CATEGORY, CONTINUATION_CLOSED_ERROR } from "../../coding/continuation-wording.js";
 import { budgetSentence } from "../../core/budget-wording.js";
 import { fileSelfDefect } from "../../core/self-defects.js";
+import { isTransactionUnavailable } from "../../core/dispatch.js";
+import { CONTENDED_TX_MAX_WAIT_MS } from "../../core/timing.js";
 import { classifyProviderFailure, providerClassOfCategory, providerSentence, } from "../../core/provider-wording.js";
 import { logger } from "../../core/logger.js";
 import { requiredLevel } from "../../core/repo-access.js";
@@ -23,7 +26,10 @@ import { CODING_PROXY_ALIAS, CODING_PROXY_PORT, isImmutableDockerImage } from ".
 import { normalizeRegistryLockfiles } from "../../coding/registry/lockfiles.js";
 import { ISSUE_KEY, ISSUE_TRACKER_NAMES } from "../issue-tracker/types.js";
 import { HEARTBEAT_TIMEOUT_MS } from "../../core/timing.js";
+import { collectRelatedPullRequests } from "../../core/related-pull-requests.js";
 const containerLog = logger.child({ module: "container-executor" });
+/** The input path in a spec built only to ask the launcher about capacity; never written or read. */
+const CAPACITY_PROBE_INPUT = "/dev/null";
 const TERMINAL_STATUSES = new Set(["succeeded", "failed", "refused", "lost", "budget_exhausted", "cancelled"]);
 const PROVISIONING_BACKEND = "provisioning";
 /** Serializes concurrency-slot claims across replicas. Distinct from the OAuth client lock (7412901). */
@@ -119,6 +125,7 @@ export class PrismaContainerExecutionStore {
             toolImage: row.codingRun.toolImage,
             workspaceDiskMb: row.codingRun.workspaceDiskMb,
             debugTrace: row.codingRun.debugTrace,
+            maxTurns: row.codingRun.maxTurns,
             services: row.codingRun.services,
             failureCategory: row.codingRun.failureCategory,
             profileRepository: row.agent.codingProfile?.repository ?? null,
@@ -127,6 +134,15 @@ export class PrismaContainerExecutionStore {
             pricingSnapshot: row.pricingSnapshot,
         };
     }
+    async relatedPullRequests(runId) {
+        const group = await collectRelatedPullRequests(this.db, runId);
+        // Every PR of the request so far, merged/closed ones included (listed as context).
+        return group.pullRequests.map((pr) => ({
+            repository: pr.repository,
+            number: pr.number,
+            ...(pr.state ? { state: pr.state } : {}),
+        }));
+    }
     async claimProvisioning(runId, claimId) {
         try {
             return await this.db.$transaction(async (tx) => {
@@ -195,14 +211,27 @@ export class PrismaContainerExecutionStore {
                     throw new RunNoLongerActiveError();
                 }
                 return "claimed";
-            });
+            }, { maxWait: CONTENDED_TX_MAX_WAIT_MS });
         }
         catch (err) {
             if (err instanceof RunNoLongerActiveError)
                 return "unavailable";
+            // A burst of claims queued on the slot lock left no connection in time.
+            // Nothing was claimed: wait in the coding queue (drainCodingQueue starts
+            // it, oldest first) instead of failing a run that only needed to wait.
+            if (isTransactionUnavailable(err)) {
+                await this.markQueued(runId);
+                return "queued";
+            }
             throw err;
         }
     }
+    async markQueued(runId) {
+        await this.db.codingRun.updateMany({
+            where: { runId, jobBackend: null, jobHandle: null, queuedAt: null, run: { status: "pending" } },
+            data: { queuedAt: new Date() },
+        });
+    }
     async persistHandle(runId, claimId, handle) {
         await this.db.$transaction(async (tx) => {
             const coding = await tx.codingRun.findUnique({ where: { runId }, include: { run: true } });
@@ -236,7 +265,7 @@ export class PrismaContainerExecutionStore {
             data: { heartbeatAt: new Date() },
         });
     }
-    async complete(runId, status, result) {
+    async complete(runId, status, result, record = {}) {
         const finishedAt = new Date();
         const finished = await this.db.$transaction(async (tx) => {
             const run = await tx.run.findUnique({ where: { id: runId }, include: { codingRun: true } });
@@ -249,7 +278,12 @@ export class PrismaContainerExecutionStore {
             }
             await tx.codingRun.update({
                 where: { runId },
-                data: { result, resultSchema: CODING_PROTOCOL_VERSION },
+                data: {
+                    result,
+                    resultSchema: CODING_PROTOCOL_VERSION,
+                    ...(record.resultBranch ? { resultBranch: record.resultBranch } : {}),
+                    ...(record.baseSha ? { baseSha: record.baseSha } : {}),
+                },
             });
             await tx.run.update({
                 where: { id: runId },
@@ -328,7 +362,7 @@ export class ContainerExecutor {
         this.artifactRoot = resolve(options.artifactRoot);
         if (this.artifactRoot === resolve("/"))
             throw new Error("coding_artifact_root_invalid");
-        if (!isImmutableDockerImage(options.workerImage)) {
+        if (options.workerImage !== undefined && !isImmutableDockerImage(options.workerImage)) {
             throw new Error("coding_worker_image_invalid");
         }
         for (const versions of Object.values(options.additionalWorkerImages ?? {})) {
@@ -464,6 +498,10 @@ export class ContainerExecutor {
             if (!handle) {
                 if (run.provisioningClaim)
                     return;
+                // No room in the cluster yet (the namespace quota): wait in the queue rather than claim a
+                // slot and then fail when the API server refuses the job.
+                if (!(await this.fitsCluster(run)))
+                    return;
                 claimId = randomUUID();
                 // "queued": every slot is taken; the run stays pending and
                 // drainCodingQueue starts it when one frees. "unavailable": another
@@ -665,6 +703,28 @@ export class ContainerExecutor {
             },
         };
     }
+    /** The new PR's Related pull requests input: earlier PRs of the same request, then this one. Never throws. */
+    async relatedFor(run) {
+        // A continuation pushes onto an existing PR, whose body is never rewritten here.
+        if (run.rootCodingRunId || !this.options.store.relatedPullRequests)
+            return {};
+        try {
+            const earlier = await this.options.store.relatedPullRequests(run.runId);
+            if (earlier.length === 0)
+                return {};
+            const { issue } = this.issueFor(run);
+            return {
+                related: {
+                    entries: [...earlier, { repository: run.repository, self: true }],
+                    ...(issue ? { issue } : {}),
+                },
+            };
+        }
+        catch (err) {
+            containerLog.warn({ err, runId: run.runId }, "could not list the request's related pull requests");
+            return {};
+        }
+    }
     /** The run's stored model terms; a run from before the catalog resolves them from the current catalog. */
     modelTerms(run) {
         if (run.provider !== "codex" && run.provider !== "claude-code")
@@ -810,10 +870,18 @@ export class ContainerExecutor {
                 tag: output.tag,
                 ...report,
                 ...this.issueFor(current),
+                ...(await this.relatedFor(current)),
             });
+            // A pushed branch (local repository) is a successful run with no pull
+            // request; its branch is recorded on the run for the operator to merge.
             const result = this.resultFor(output, current, finalized.outcome, finalized);
-            await this.options.store.complete(run.runId, "succeeded", result);
-            if (finalized.outcome === "pull_request_opened" || finalized.outcome === "pull_request_updated") {
+            await this.options.store.complete(run.runId, "succeeded", result, {
+                baseSha: finalized.baseCommit,
+                ...(finalized.outcome === "branch_pushed" ? { resultBranch: finalized.headRef } : {}),
+            });
+            if (finalized.outcome === "pull_request_opened" ||
+                finalized.outcome === "pull_request_updated" ||
+                finalized.outcome === "branch_pushed") {
                 this.emit({ stage: finalized.outcome, runId: run.runId, jobId: handle.id });
             }
             this.terminal(current, "succeeded");
@@ -886,7 +954,9 @@ export class ContainerExecutor {
                     pullRequestUrl: finalized.pullRequestUrl,
                     pullRequestNumber: finalized.pullRequestNumber,
                 }
-                : {}),
+                : outcome === "branch_pushed" && finalized?.outcome === "branch_pushed"
+                    ? { headRef: finalized.headRef, commitSha: finalized.commitSha }
+                    : {}),
             summary: output.summary,
             tests: output.tests,
             tag: output.tag,
@@ -911,8 +981,11 @@ export class ContainerExecutor {
                 throw new Error("coding_worker_image_invalid");
             return selector.workerImageRef;
         }
-        if (selector.toolchain === "node")
+        if (selector.toolchain === "node") {
+            if (!this.options.workerImage)
+                throw new Error("coding_provider_not_configured:codex");
             return this.options.workerImage;
+        }
         const versions = this.options.additionalWorkerImages?.[selector.toolchain];
         const image = selector.toolchainVersion ? versions?.[selector.toolchainVersion] : undefined;
         if (!image) {
@@ -971,11 +1044,31 @@ export class ContainerExecutor {
             throw new Error("coding_run_not_found");
         return current;
     }
+    /**
+     * False when the launcher reports this run's job would not fit the cluster right now; the run
+     * is then queued and drainCodingQueue retries it. Launchers and stores without the hooks, and
+     * any error, answer true: the launch stays the authority.
+     */
+    async fitsCluster(run) {
+        const { jobs, store } = this.options;
+        if (!jobs.hasCapacityFor || !store.markQueued)
+            return true;
+        const fits = await jobs.hasCapacityFor(this.jobSpec(run, CAPACITY_PROBE_INPUT)).catch(() => true);
+        if (fits)
+            return true;
+        await store.markQueued(run.runId);
+        this.emit({ stage: "queued", runId: run.runId });
+        return false;
+    }
     jobSpec(run, inputArtifact) {
         const provider = run.provider === "claude-code" ? "claude-code" : "codex";
         if (provider === "claude-code" && (!run.workerImage || !this.options.claudeToolRunnerImage)) {
             throw new Error("coding_provider_not_configured:claude-code");
         }
+        // Runs keep the image they were dispatched with; one without it needs the deployment default.
+        const image = run.workerImage ?? this.options.workerImage;
+        if (!image)
+            throw new Error("coding_provider_not_configured:codex");
         if (run.workspaceDiskMb && run.workspaceDiskMb > this.options.maxDiskMb) {
             throw new Error("coding_workspace_disk_exceeds_limit");
         }
@@ -988,7 +1081,7 @@ export class ContainerExecutor {
             kind: "coding-agent",
             runId: run.runId,
             provider,
-            image: run.workerImage ?? this.options.workerImage,
+            image,
             // A run keeps the tool image it was dispatched with; rows from before CodingRun.toolImage use the default.
             ...(provider === "claude-code" ? { toolImage: run.toolImage ?? this.options.claudeToolRunnerImage } : {}),
             inputArtifact,
@@ -1035,6 +1128,8 @@ export class ContainerExecutor {
             continuationOf: run.rootCodingRunId ? { runId: run.rootCodingRunId } : undefined,
             // Only when true: an untraced run's input stays exactly what older workers expect.
             ...(run.debugTrace ? { debugTrace: true } : {}),
+            // Only when the agent sets one: every other run's input stays exactly what older workers expect.
+            ...(run.maxTurns ? { maxTurns: run.maxTurns } : {}),
             // Only when there are some: every other run's input stays exactly what older workers expect.
             ...(services.length > 0 ? { services: workerServices(services) } : {}),
         });
@@ -1248,6 +1343,8 @@ function safeError(error) {
  * "workspace" because "github" contains "git".
  */
 const CATEGORY_BY_PREFIX = [
+    // Claude Code reached the agent's turn limit (codingProfile.maxTurns) before finishing.
+    ["job_coding_turn_limit", "turn_limit"],
     // A service sidecar never became ready (src/providers/jobs/kubernetes.ts).
     [SERVICE_UNREADY_ERROR, SERVICE_UNREADY_CATEGORY],
     // Services on a launcher that can't start them: refused at dispatch, failed here as a backstop.
@@ -1262,15 +1359,49 @@ const CATEGORY_BY_PREFIX = [
     // Checked before the generic "vcs_" fallback: the collected diff touched a
     // path this agent may not edit, not a generic workspace/git failure.
     ["vcs_protected_path:", PROTECTED_PATH_CATEGORY],
+    // A continuation whose pull request was merged or closed: nothing pushed (coding/continuation-wording.ts).
+    [CONTINUATION_CLOSED_ERROR, CONTINUATION_CLOSED_CATEGORY],
+    // A provider whose worker images this deployment doesn't configure (codex or claude-code): configuration.
+    ["coding_provider_not_configured", "preflight"],
+    // A GitHub repository on a server with no GitHub App: configuration, like an unsupported service.
+    ["vcs_github_not_configured", "preflight"],
     ["vcs_", "workspace"],
+    // Local repositories (LocalRepoError codes): the same family as the vcs_ errors.
+    ["local_", "workspace"],
     ["git_", "workspace"],
 ];
+/**
+ * Whether `error` or something in its `cause` chain (bounded depth, in case a
+ * cycle somehow formed) is -- or wraps -- an error whose own message starts
+ * with `prefix`.
+ */
+function causeChainStartsWith(error, prefix) {
+    let current = error;
+    for (let depth = 0; depth < 5 && current; depth += 1) {
+        const raw = current instanceof Error ? current.message : typeof current === "string" ? current : "";
+        if (raw.startsWith(prefix))
+            return true;
+        current = current instanceof Error ? current.cause : undefined;
+    }
+    return false;
+}
 function failureCategory(error) {
     const raw = error instanceof Error ? error.message : typeof error === "string" ? error : "";
     for (const [prefix, category] of CATEGORY_BY_PREFIX) {
         if (raw.startsWith(prefix))
             return category;
     }
+    // A continuation whose pull request is no longer open can fail before a
+    // session or job exists (assertContinuationOpen, called at the top of
+    // prepareWorkspace) -- that failure is re-thrown as a PreflightError whose
+    // own message is `safeError(error)`, a sanitized wrapper that no longer
+    // starts with CONTINUATION_CLOSED_ERROR (see the `!spendEnabled && !handle`
+    // branch above). The real, un-wrapped error survives on `cause`. Only this
+    // one category is looked up through the cause chain this way -- every
+    // other prefix above keeps matching only the top-level message, exactly as
+    // before, so no other prepare-time failure's category changes here.
+    if (causeChainStartsWith(error, CONTINUATION_CLOSED_ERROR))
+        return CONTINUATION_CLOSED_CATEGORY;
     const message = safeError(error);
     if (message.includes("preflight") || message.includes("ownership") || message.includes("image"))
         return "preflight";

package/dist/providers/executor/types.d.ts

@@ -70,7 +70,7 @@ export interface Executor {
     }): Promise<string | null>;
     /**
      * The raw text of one repository file at `baseRef`, or null when absent.
-     * Throws (github_file_too_large, github_file_not_a_file, github_file_not_utf8)
+     * Throws (github_file_* or local_file_*: too_large, not_a_file, not_utf8)
      * when the file is oversized or not UTF-8 text. Called by dispatch before its transaction (network call).
      * Used for the knowledge note (src/knowledge/note.ts).
      */

package/dist/providers/jobs/fake-kubernetes-api.d.ts

@@ -1,4 +1,4 @@
-import type { V1ConfigMap, V1Endpoints, V1NetworkPolicy, V1Pod, V1Secret, V1Service } from "@kubernetes/client-node";
+import type { V1ConfigMap, V1Endpoints, V1NetworkPolicy, V1Pod, V1ResourceQuota, V1Secret, V1Service } from "@kubernetes/client-node";
 import type { Readable, Writable } from "node:stream";
 import { type KubernetesApi, type KubernetesExecOptions } from "./kubernetes-api.js";
 export interface FakeExecCall {
@@ -10,7 +10,7 @@ export interface FakeExecCall {
     stdout?: Writable;
     timeoutMs: number;
 }
-type Kind = "configmap" | "secret" | "pod" | "networkpolicy" | "service" | "endpoints";
+type Kind = "configmap" | "secret" | "pod" | "networkpolicy" | "service" | "endpoints" | "resourcequota";
 type Obj = {
     metadata?: {
         name?: string;
@@ -91,6 +91,7 @@ export declare class FakeKubernetesApi implements KubernetesApi {
     deleteNetworkPolicy(namespace: string, name: string): Promise<void>;
     readService(namespace: string, name: string): Promise<V1Service | undefined>;
     readEndpoints(namespace: string, name: string): Promise<V1Endpoints | undefined>;
+    readResourceQuota(namespace: string, name: string): Promise<V1ResourceQuota | undefined>;
     readApiServerVersion(): Promise<string>;
     readNamespace(name: string): Promise<boolean>;
     exec(namespace: string, pod: string, container: string, command: string[], options: KubernetesExecOptions): Promise<number>;

package/dist/providers/jobs/fake-kubernetes-api.js

@@ -114,6 +114,9 @@ export class FakeKubernetesApi {
     async readEndpoints(namespace, name) {
         return this.read("endpoints", namespace, name);
     }
+    async readResourceQuota(namespace, name) {
+        return this.read("resourcequota", namespace, name);
+    }
     async readApiServerVersion() {
         return this.apiServerVersion;
     }

package/dist/providers/jobs/kubernetes-api.d.ts

@@ -3,7 +3,7 @@
  * so every launcher behavior is unit-tested against FakeKubernetesApi and
  * re-proven against a real cluster by kubernetes.integration.test.ts.
  */
-import type { V1ConfigMap, V1Endpoints, V1NetworkPolicy, V1Pod, V1Secret, V1Service } from "@kubernetes/client-node";
+import type { V1ConfigMap, V1Endpoints, V1NetworkPolicy, V1Pod, V1ResourceQuota, V1Secret, V1Service } from "@kubernetes/client-node";
 import type { Readable, Writable } from "node:stream";
 export declare class KubernetesNotFoundError extends Error {
     constructor(message?: string);
@@ -46,6 +46,8 @@ export interface KubernetesApi {
      * resource (migrating to it is a follow-up); Endpoints is read by name so RBAC stays one object wide.
      */
     readEndpoints(namespace: string, name: string): Promise<V1Endpoints | undefined>;
+    /** Reads one ResourceQuota by name (its status carries hard and used), for the launcher's capacity check. */
+    readResourceQuota(namespace: string, name: string): Promise<V1ResourceQuota | undefined>;
     readNamespace(name: string): Promise<boolean>;
     /** Runs a command in a container; resolves with its exit code. Never uses a shell. */
     exec(namespace: string, pod: string, container: string, command: string[], options: KubernetesExecOptions): Promise<number>;

package/dist/providers/jobs/kubernetes-client.d.ts

@@ -3,7 +3,7 @@
  * method is one client call plus HTTP-status translation into the seam's
  * error classes. Proven against a real cluster by kubernetes.integration.test.ts.
  */
-import { type V1ConfigMap, type V1Endpoints, type V1NetworkPolicy, type V1Pod, type V1Secret, type V1Service } from "@kubernetes/client-node";
+import { type V1ConfigMap, type V1Endpoints, type V1ResourceQuota, type V1NetworkPolicy, type V1Pod, type V1Secret, type V1Service } from "@kubernetes/client-node";
 import { type KubernetesApi, type KubernetesExecOptions } from "./kubernetes-api.js";
 export interface ClientNodeKubernetesApiOptions {
     /** kubeconfig context to use; defaults to the current context (or in-cluster credentials). */
@@ -29,6 +29,7 @@ export declare class ClientNodeKubernetesApi implements KubernetesApi {
     deleteNetworkPolicy(namespace: string, name: string): Promise<void>;
     readService(namespace: string, name: string): Promise<V1Service | undefined>;
     readEndpoints(namespace: string, name: string): Promise<V1Endpoints | undefined>;
+    readResourceQuota(namespace: string, name: string): Promise<V1ResourceQuota | undefined>;
     readApiServerVersion(): Promise<string>;
     readNamespace(name: string): Promise<boolean>;
     exec(namespace: string, pod: string, container: string, command: string[], options: KubernetesExecOptions): Promise<number>;

package/dist/providers/jobs/kubernetes-client.js

@@ -121,6 +121,9 @@ export class ClientNodeKubernetesApi {
     readEndpoints(namespace, name) {
         return readOrUndefined(() => this.core.readNamespacedEndpoints({ namespace, name }));
     }
+    readResourceQuota(namespace, name) {
+        return readOrUndefined(() => this.core.readNamespacedResourceQuota({ namespace, name }));
+    }
     async readApiServerVersion() {
         return (await this.version.getCode()).gitVersion;
     }

package/dist/providers/jobs/kubernetes-isolation.d.ts

@@ -33,6 +33,13 @@ export declare const PROXY_POD_LABEL: {
 export declare const RUN_COMPONENT_LABEL: {
     readonly "wardby.io/component": "coding-run";
 };
+/** Kubernetes managed-by label on every run pod. */
+export declare const RUN_MANAGED_BY_LABEL: {
+    readonly "app.kubernetes.io/managed-by": "wardby";
+};
+/** Label on every coding-run pod/Job: the first 40 hex chars of sha256(runId). */
+export declare const RUN_SHA_LABEL = "wardby.io/run-sha256";
+export declare const RUN_SHA_CHARS = 40;
 /** The probe proved enforcement: the proxy port connected and the deny port was blocked. */
 export declare const ENFORCEMENT_PROBE_PROVEN = 0;
 /** The deny port was reachable: no policy is blocking it, or the policy is not port-scoped. */

package/dist/providers/jobs/kubernetes-isolation.js

@@ -42,6 +42,11 @@ export const PROXY_POD_LABEL = { "app.kubernetes.io/name": "wardby-coding-proxy"
  * Single source: `runLabels` stamps it, `readProxyWitness` checks the proxy admits it.
  */
 export const RUN_COMPONENT_LABEL = { "wardby.io/component": "coding-run" };
+/** Kubernetes managed-by label on every run pod. */
+export const RUN_MANAGED_BY_LABEL = { "app.kubernetes.io/managed-by": "wardby" };
+/** Label on every coding-run pod/Job: the first 40 hex chars of sha256(runId). */
+export const RUN_SHA_LABEL = "wardby.io/run-sha256";
+export const RUN_SHA_CHARS = 40;
 /** The probe proved enforcement: the proxy port connected and the deny port was blocked. */
 export const ENFORCEMENT_PROBE_PROVEN = 0;
 /** The deny port was reachable: no policy is blocking it, or the policy is not port-scoped. */
@@ -120,13 +125,13 @@ export function kubernetesRunNames(runId) {
     if (!RUN_ID.test(runId))
         throw isolationError();
     const digest = sha256(runId);
-    return { ...kubernetesRunNamesForToken(digest.slice(0, 20)), runSha: digest.slice(0, 40) };
+    return { ...kubernetesRunNamesForToken(digest.slice(0, 20)), runSha: digest.slice(0, RUN_SHA_CHARS) };
 }
 export function runLabels(runId) {
     return {
-        "app.kubernetes.io/managed-by": "wardby",
+        ...RUN_MANAGED_BY_LABEL,
         ...RUN_COMPONENT_LABEL,
-        "wardby.io/run-sha256": kubernetesRunNames(runId).runSha,
+        [RUN_SHA_LABEL]: kubernetesRunNames(runId).runSha,
     };
 }
 /** Same grammar as Docker's repository digests; a cluster cannot pull a bare local image ID. */

package/dist/providers/jobs/kubernetes-preflight.d.ts

@@ -11,6 +11,14 @@ export interface KubernetesPreflightOptions {
     timeoutMs?: number;
     cleanupTimeoutMs?: number;
 }
+/**
+ * The image the preflight canary runs (it only needs node): the Codex worker when configured,
+ * else the Claude Code worker, so a Claude-only deployment is checked too.
+ */
+export declare function preflightCanaryImage(images: {
+    workerImage?: string;
+    claudeWorkerImage?: string;
+}): string | undefined;
 export interface CanaryResult {
     dns: boolean;
     /** The proxy's deny port: reachable means the run policy is not being enforced. */

package/dist/providers/jobs/kubernetes-preflight.js

@@ -12,6 +12,13 @@ import { CODING_PROXY_DENY_PORT, CODING_PROXY_PORT } from "./docker-isolation.js
 import { KUBERNETES_ISOLATION_ERROR, WORKER_CONTAINER, buildRunNetworkPolicy, buildRunPod, isRegistryDigest, } from "./kubernetes-isolation.js";
 import { KubernetesPlatformError, assertPlatformConfig, platformProfile } from "./kubernetes-platform.js";
 import { readProxyWitness } from "./kubernetes-witness.js";
+/**
+ * The image the preflight canary runs (it only needs node): the Codex worker when configured,
+ * else the Claude Code worker, so a Claude-only deployment is checked too.
+ */
+export function preflightCanaryImage(images) {
+    return images.workerImage || images.claudeWorkerImage || undefined;
+}
 const DEFAULT_TIMEOUT_MS = 90_000;
 const DEFAULT_CLEANUP_TIMEOUT_MS = 15_000;
 const POLL_INTERVAL_MS = 500;

package/dist/providers/jobs/kubernetes-quota.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Whether one more coding-run pod fits a namespace ResourceQuota (KUBERNETES_RESOURCE_QUOTA).
+ * The launcher asks before a run claims a slot, so a run that would be refused at pod create
+ * ("exceeded quota") waits in the coding queue instead of failing.
+ */
+import type { V1Pod, V1ResourceQuota } from "@kubernetes/client-node";
+/** What a pod adds to a quota: millicores, bytes, and one pod. */
+export interface PodQuotaUsage {
+    "requests.cpu": number;
+    "limits.cpu": number;
+    "requests.memory": number;
+    "limits.memory": number;
+    pods: number;
+}
+/** A Kubernetes CPU quantity ("250m", "1.5", "8") in millicores, or null when unparseable. */
+export declare function cpuMillicores(quantity: string | number | undefined): number | null;
+/** A Kubernetes memory quantity ("512Mi", "1G", "1048576") in bytes, or null when unparseable. */
+export declare function memoryBytes(quantity: string | number | undefined): number | null;
+/**
+ * The pod's effective requests and limits, as quota admission counts them: its containers plus
+ * native sidecars (init containers with restartPolicy Always), or its largest ordinary init
+ * container if that is bigger. Close enough for an admission pre-check; the API server stays the
+ * authority.
+ */
+export declare function podQuotaUsage(pod: V1Pod): PodQuotaUsage;
+/**
+ * The first quota resource the pod would exceed (for example "requests.cpu"), or null when it
+ * fits. A quota with no status yet, or a value this can't parse, never blocks: the API server
+ * still has the final word at create.
+ */
+export declare function quotaShortfall(quota: V1ResourceQuota, usage: PodQuotaUsage): string | null;

package/dist/providers/jobs/kubernetes-quota.js

@@ -0,0 +1,110 @@
+const BINARY = { Ki: 2 ** 10, Mi: 2 ** 20, Gi: 2 ** 30, Ti: 2 ** 40, Pi: 2 ** 50 };
+const DECIMAL = { k: 1e3, M: 1e6, G: 1e9, T: 1e12, P: 1e15 };
+const QUANTITY = /^([0-9]+(?:\.[0-9]+)?)(m|Ki|Mi|Gi|Ti|Pi|k|M|G|T|P)?$/;
+/** A Kubernetes CPU quantity ("250m", "1.5", "8") in millicores, or null when unparseable. */
+export function cpuMillicores(quantity) {
+    if (quantity === undefined)
+        return 0;
+    const match = QUANTITY.exec(String(quantity).trim());
+    if (!match)
+        return null;
+    const value = Number(match[1]);
+    if (match[2] === "m")
+        return value;
+    if (match[2] !== undefined)
+        return null;
+    return value * 1000;
+}
+/** A Kubernetes memory quantity ("512Mi", "1G", "1048576") in bytes, or null when unparseable. */
+export function memoryBytes(quantity) {
+    if (quantity === undefined)
+        return 0;
+    const match = QUANTITY.exec(String(quantity).trim());
+    if (!match)
+        return null;
+    const value = Number(match[1]);
+    const unit = match[2];
+    if (unit === undefined)
+        return value;
+    if (unit === "m")
+        return value / 1000;
+    return value * (BINARY[unit] ?? DECIMAL[unit] ?? NaN);
+}
+function sum(containers) {
+    const total = {
+        "requests.cpu": 0,
+        "limits.cpu": 0,
+        "requests.memory": 0,
+        "limits.memory": 0,
+        pods: 1,
+    };
+    for (const container of containers) {
+        const requests = container.resources?.requests ?? {};
+        const limits = container.resources?.limits ?? {};
+        total["requests.cpu"] += cpuMillicores(requests.cpu) ?? 0;
+        total["limits.cpu"] += cpuMillicores(limits.cpu) ?? 0;
+        total["requests.memory"] += memoryBytes(requests.memory) ?? 0;
+        total["limits.memory"] += memoryBytes(limits.memory) ?? 0;
+    }
+    return total;
+}
+/**
+ * The pod's effective requests and limits, as quota admission counts them: its containers plus
+ * native sidecars (init containers with restartPolicy Always), or its largest ordinary init
+ * container if that is bigger. Close enough for an admission pre-check; the API server stays the
+ * authority.
+ */
+export function podQuotaUsage(pod) {
+    const init = pod.spec?.initContainers ?? [];
+    const sidecars = init.filter((container) => container.restartPolicy === "Always");
+    const running = sum([...(pod.spec?.containers ?? []), ...sidecars]);
+    for (const container of init.filter((c) => c.restartPolicy !== "Always")) {
+        const one = sum([container]);
+        for (const key of ["requests.cpu", "limits.cpu", "requests.memory", "limits.memory"]) {
+            running[key] = Math.max(running[key], one[key]);
+        }
+    }
+    return running;
+}
+/** Quota keys and the aliases Kubernetes accepts for them ("cpu" means "requests.cpu"). */
+const KEYS = [
+    ["requests.cpu", ["requests.cpu", "cpu"], "cpu"],
+    ["limits.cpu", ["limits.cpu"], "cpu"],
+    ["requests.memory", ["requests.memory", "memory"], "memory"],
+    ["limits.memory", ["limits.memory"], "memory"],
+    ["pods", ["pods", "count/pods"], "count"],
+];
+function parse(kind, value) {
+    if (kind === "cpu")
+        return cpuMillicores(value);
+    if (kind === "memory")
+        return memoryBytes(value);
+    if (value === undefined)
+        return 0;
+    const count = Number(value);
+    return Number.isFinite(count) ? count : null;
+}
+/**
+ * The first quota resource the pod would exceed (for example "requests.cpu"), or null when it
+ * fits. A quota with no status yet, or a value this can't parse, never blocks: the API server
+ * still has the final word at create.
+ */
+export function quotaShortfall(quota, usage) {
+    const hard = quota.status?.hard;
+    if (!hard)
+        return null;
+    const used = quota.status?.used ?? {};
+    for (const [field, names, kind] of KEYS) {
+        for (const name of names) {
+            if (hard[name] === undefined)
+                continue;
+            const limit = parse(kind, hard[name]);
+            const current = parse(kind, used[name]);
+            if (limit === null || current === null)
+                continue;
+            if (current + usage[field] > limit)
+                return name;
+        }
+    }
+    return null;
+}

package/dist/providers/jobs/kubernetes.d.ts

@@ -73,6 +73,15 @@ export declare class KubernetesJobLauncher implements WorkspaceJobLauncher {
      * launcher itself has no `list` permission and so can never rediscover stray objects).
      */
     plannedHandle(spec: JobSpec): JobHandle | undefined;
+    /**
+     * Whether this spec's pod fits the free room in the namespace's ResourceQuota
+     * (KubernetesJobConfig.resourceQuota), counted from the same pod `launch` would create. Any
+     * doubt (no quota configured, unreadable, unparseable, a spec the pod builder rejects) answers
+     * yes, so the launch and the API server stay the authority.
+     */
+    hasCapacityFor(spec: JobSpec): Promise<boolean>;
+    private readonly warnedOnce;
+    private warnOnce;
     launch(spec: JobSpec): Promise<JobHandle>;
     status(handle: JobHandle): Promise<JobStatus>;
     collect(handle: JobHandle): Promise<JobResult>;