@wpelevator/tug 0.3.0 → 0.5.0

package/dist/reconciler.js

@@ -0,0 +1,362 @@
+// The agent's container reconciler. Every service is one Docker container labelled with the hash of
+// its resolved definition (`tug.config-hash`); a container whose hash no longer matches is replaced.
+// `recreate` (the default) stops the old container and starts the new one. `rolling` starts the new
+// container beside the old one on a free host port, health-checks it, lets the ingress switch, and
+// removes the old one after a drain delay. State of rolling services lives in
+// `<project dir>/rollout.json` so an agent restart resumes mid-rollout.
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { isRolling } from "./compose.js";
+import { LABEL_HASH, LABEL_PROJECT, LABEL_SERVICE, startOrder, withHostPort, } from "./container-spec.js";
+import { isNotFound } from "./docker-api.js";
+import { ensureDir, errMessage, now, parseDuration } from "./util.js";
+export const DEFAULT_DRAIN = '30s';
+export const DEFAULT_PORT_RANGE = '20000-20999';
+export function parsePortRange(value) {
+    const m = (value || DEFAULT_PORT_RANGE).trim().match(/^(\d+)-(\d+)$/);
+    const lo = Number(m?.[1]);
+    const hi = Number(m?.[2]);
+    if (!m || lo < 1024 || hi > 65535 || lo > hi)
+        throw new Error(`invalid rollout port range ${JSON.stringify(value)} (expected LOW-HIGH within 1024-65535, e.g. ${DEFAULT_PORT_RANGE})`);
+    return [lo, hi];
+}
+// ---- Containers --------------------------------------------------------------------------------
+const containerNameOf = (c) => (c.Names?.[0] || c.Id).replace(/^\//, '');
+/** Containers of a project (or one service of it), running or not. */
+export async function projectContainers(docker, project, service) {
+    return docker.listContainers({
+        label: [`${LABEL_PROJECT}=${project}`, ...(service ? [`${LABEL_SERVICE}=${service}`] : [])],
+    });
+}
+async function removeContainers(docker, containers) {
+    for (const c of containers) {
+        if (c.State === 'running')
+            await docker.stopContainer(c.Id).catch(() => { });
+        await docker.removeContainer(c.Id);
+    }
+}
+async function removeByName(docker, name) {
+    await docker.stopContainer(name).catch(() => { });
+    await docker.removeContainer(name);
+}
+/** Creates the project network and its volumes; volumes are never removed by reconciliation. */
+export async function ensureProjectResources(docker, project, plan) {
+    if (!(await docker.inspectNetwork(plan.network)))
+        await docker.createNetwork(plan.network, { [LABEL_PROJECT]: project });
+    for (const volume of plan.volumes) {
+        if (await docker.inspectVolume(volume.name))
+            continue;
+        if (volume.external)
+            throw new Error(`external volume ${volume.name} does not exist on this node`);
+        await docker.createVolume(volume.name, {
+            driver: volume.driver,
+            opts: volume.opts,
+            labels: volume.labels,
+        });
+    }
+}
+/** Makes sure a service's container exists for `spec`, running, replacing any container with another hash. */
+export async function ensureContainer(docker, spec, existing) {
+    const match = existing.find((c) => c.Labels?.[LABEL_HASH] === spec.hash);
+    await removeContainers(docker, existing.filter((c) => c !== match));
+    if (match) {
+        if (match.State !== 'running')
+            await docker.startContainer(match.Id);
+        return match.Id;
+    }
+    const id = await docker.createContainer(spec.name, spec.body);
+    await docker.startContainer(id);
+    return id;
+}
+/** Removes containers of services that are not placed here any more (never volumes). */
+export async function sweepOrphans(docker, project, keep) {
+    const stray = (await projectContainers(docker, project)).filter((c) => !keep.has(c.Labels?.[LABEL_SERVICE] ?? ''));
+    await removeContainers(docker, stray);
+}
+const stateFile = (dir) => path.join(dir, 'rollout.json');
+export async function loadRolloutState(dir) {
+    try {
+        const parsed = JSON.parse(await fs.readFile(stateFile(dir), 'utf8'));
+        for (const s of Object.values(parsed.services))
+            s.draining ||= [];
+        return parsed;
+    }
+    catch {
+        return { services: {} };
+    }
+}
+async function saveRolloutState(dir, state) {
+    const tmp = `${stateFile(dir)}.tmp`;
+    await fs.writeFile(tmp, JSON.stringify(state, null, 2), { mode: 0o600 });
+    await fs.rename(tmp, stateFile(dir));
+}
+/** Host ports already published by containers on this node. */
+async function publishedHostPorts(docker) {
+    return new Set((await docker.listContainers({}, false)).flatMap((c) => (c.Ports || []).flatMap((p) => (p.PublicPort ? [p.PublicPort] : []))));
+}
+async function allocatePort(docker, range, known, exclude) {
+    const [lo, hi] = parsePortRange(range);
+    const busy = await publishedHostPorts(docker);
+    for (const port of [...known, ...exclude])
+        busy.add(port);
+    // Start after the newest port in use so a just-released port is not reused straight away.
+    const last = Math.max(lo - 1, ...known.filter((p) => p >= lo && p <= hi));
+    const size = hi - lo + 1;
+    for (let i = 0; i < size; i++) {
+        const port = lo + ((last + 1 - lo + i) % size);
+        if (!busy.has(port))
+            return port;
+    }
+    throw new Error(`no free host port left in the rollout range ${lo}-${hi} (TUG_ROLLOUT_PORTS)`);
+}
+const PORT_CONFLICT = /port is already allocated|address already in use|bind for .* failed/i;
+function knownPorts(rollout) {
+    return [rollout.active, rollout.candidate]
+        .filter((r) => Boolean(r))
+        .map((r) => r.port);
+}
+/** Waits for the dependencies a service started with `service_healthy` on. */
+async function waitForDependencies(docker, spec, containers, deps) {
+    for (const [dep, condition] of Object.entries(spec.dependsOn)) {
+        const id = containers.get(dep);
+        if (condition === 'service_healthy' && id)
+            await deps.waitForHealth(id, dep, true);
+    }
+}
+/**
+ * Recreate-strategy services: pull, then create/start each in dependency order. `onStarting` and
+ * `onHealth` let the agent report per-service state; a failure throws with the service named in
+ * `failing`.
+ */
+export async function reconcileRecreate(docker, input, report) {
+    const { plan, deps, services, desired } = input;
+    const only = Object.fromEntries(services.map((s) => [s, plan.specs[s]]));
+    for (const service of services)
+        await report.pulling(service);
+    for (const service of services) {
+        if (desired.services[service].artifact)
+            await deps.ensureArtifact(service);
+        else if (input.pull || !(await docker.inspectImage(plan.specs[service].body.Image)))
+            await deps.pullImage(service);
+    }
+    const ids = new Map();
+    const order = startOrder(Object.fromEntries(Object.entries(only).map(([name, spec]) => [
+        name,
+        {
+            ...spec,
+            dependsOn: Object.fromEntries(Object.entries(spec.dependsOn).filter(([d]) => d in only)),
+        },
+    ])));
+    for (const service of order) {
+        const spec = plan.specs[service];
+        await report.starting(service);
+        report.failing(service);
+        await waitForDependencies(docker, spec, ids, deps);
+        ids.set(service, await ensureContainer(docker, spec, await projectContainers(docker, desired.project, service)));
+        report.failing(undefined);
+    }
+    for (const service of order) {
+        await report.checking(service);
+        report.failing(service);
+        await deps.waitForHealth(ids.get(service), service);
+        report.failing(undefined);
+        await report.serving(service);
+    }
+}
+function servingState(rev, extra = {}) {
+    return {
+        rolloutState: 'serving',
+        image: rev.image,
+        healthyAt: now(),
+        port: rev.port,
+        rolloutRevision: rev.hash,
+        ...extra,
+    };
+}
+export const isRollingService = (desired, service) => isRolling(desired.compose.services[service]);
+/** The host port a container publishes for the container port `target`. */
+function publishedOf(c, target) {
+    const ports = (c.Ports || []).filter((p) => p.PublicPort);
+    return (ports.find((p) => p.PrivatePort === target) ?? ports[0])?.PublicPort;
+}
+export async function reconcileRolling(docker, input) {
+    const { desired, dir, services, plan, deps } = input;
+    const project = desired.project;
+    const state = await loadRolloutState(dir);
+    const result = { serviceStates: {}, errors: {} };
+    await ensureDir(dir);
+    // Drained revisions go first so their host ports are free for this rollout.
+    await retireRevisions(docker, dir, state, new Set(services), deps);
+    for (const service of services) {
+        const rollout = (state.services[service] ||= { draining: [] });
+        const spec = plan.specs[service];
+        const ext = desired.compose.services[service];
+        const ingressPort = ext['x-tug'].ingress.port;
+        const drainMs = parseDuration(ext['x-tug']?.rollout?.drain ?? DEFAULT_DRAIN, 30000);
+        const image = desired.services[service].image;
+        // Adopt a container that predates the rollout state (a service that used to be recreated, or a lost state file).
+        const present = await projectContainers(docker, project, service);
+        if (!rollout.active) {
+            const adopt = present.find((c) => c.State === 'running');
+            const port = adopt && publishedOf(adopt, ingressPort);
+            if (adopt && port)
+                rollout.active = {
+                    hash: adopt.Labels?.[LABEL_HASH] ?? 'unknown',
+                    container: containerNameOf(adopt),
+                    port,
+                    image,
+                };
+        }
+        if (rollout.candidate && rollout.candidate.hash !== spec.hash) {
+            await removeByName(docker, rollout.candidate.container).catch(() => { });
+            delete rollout.candidate;
+        }
+        if (rollout.active && rollout.active.hash === spec.hash) {
+            // Steady state: make sure the revision is still up and healthy; nothing restarts when it is.
+            const active = { ...rollout.active, image };
+            try {
+                const running = present.find((c) => containerNameOf(c) === active.container);
+                if (!running)
+                    await docker.startContainer(await docker.createContainer(active.container, withHostPort(spec.body, active.port)));
+                else if (running.State !== 'running')
+                    await docker.startContainer(running.Id);
+                await deps.waitForHealth(active.container, service);
+                delete rollout.failed;
+                result.serviceStates[service] = servingState(active);
+            }
+            catch (e) {
+                result.errors[service] = errMessage(e);
+                result.serviceStates[service] = {
+                    rolloutState: 'health_checking',
+                    image,
+                    rolloutRevision: spec.hash,
+                };
+            }
+            continue;
+        }
+        const key = `${desired.revision || desired.version}:${spec.hash}`;
+        const reject = (error) => {
+            result.errors[service] = error;
+            result.serviceStates[service] = rollout.active
+                ? servingState(rollout.active, { rolloutError: error })
+                : { rolloutState: 'health_checking', image, rolloutRevision: spec.hash };
+        };
+        if (rollout.failed?.key === key) {
+            reject(rollout.failed.error);
+            continue;
+        }
+        try {
+            const candidate = rollout.candidate ?? {
+                hash: spec.hash,
+                container: spec.name,
+                port: await allocatePort(docker, input.rolloutPorts, knownPorts(rollout), new Set()),
+                image,
+            };
+            rollout.candidate = candidate;
+            await saveRolloutState(dir, state);
+            await deps.emit(service, 'pulling');
+            if (desired.services[service].artifact)
+                await deps.ensureArtifact(service);
+            else
+                await deps.pullImage(service);
+            const exclude = new Set();
+            for (let attempt = 0;; attempt++) {
+                await deps.emit(service, 'starting', `starting new revision on host port ${candidate.port}`);
+                try {
+                    await removeByName(docker, candidate.container);
+                    const id = await docker.createContainer(candidate.container, withHostPort(spec.body, candidate.port));
+                    await docker.startContainer(id);
+                    break;
+                }
+                catch (e) {
+                    if (attempt >= 4 || !PORT_CONFLICT.test(errMessage(e)))
+                        throw e;
+                    exclude.add(candidate.port);
+                    candidate.port = await allocatePort(docker, input.rolloutPorts, knownPorts(rollout), exclude);
+                    await saveRolloutState(dir, state);
+                }
+            }
+            await deps.emit(service, 'health_checking');
+            await deps.waitForHealth(candidate.container, service);
+            // Takeover: the next status report carries the new port and control re-renders the ingress.
+            if (rollout.active)
+                rollout.draining.push({
+                    service,
+                    container: rollout.active.container,
+                    drainUntil: Date.now() + drainMs,
+                });
+            rollout.active = { ...candidate };
+            delete rollout.candidate;
+            delete rollout.failed;
+            await saveRolloutState(dir, state);
+            result.serviceStates[service] = servingState(rollout.active);
+            await deps.emit(service, 'serving', `new revision serving on host port ${rollout.active.port}`);
+        }
+        catch (e) {
+            const error = errMessage(e);
+            if (rollout.candidate)
+                await removeByName(docker, rollout.candidate.container).catch(() => { });
+            delete rollout.candidate;
+            rollout.failed = { key, error };
+            await saveRolloutState(dir, state);
+            reject(error);
+            await deps.emit(service, 'rollout_failed', `new revision rejected, previous revision keeps serving: ${error}`);
+        }
+    }
+    // Containers of a rolling service that are no revision of it (a failed adoption, a lost state file).
+    for (const service of services) {
+        const rollout = state.services[service];
+        const known = new Set([
+            rollout?.active?.container,
+            rollout?.candidate?.container,
+            ...(rollout?.draining || []).map((d) => d.container),
+        ].filter(Boolean));
+        const stray = (await projectContainers(docker, project, service)).filter((c) => !known.has(containerNameOf(c)));
+        await removeContainers(docker, stray).catch(() => { });
+    }
+    await saveRolloutState(dir, state);
+    return result;
+}
+/** Removes drained revisions, and revisions of services that are no longer rolling on this node. */
+async function retireRevisions(docker, dir, state, rolling, deps) {
+    for (const [service, rollout] of Object.entries(state.services)) {
+        if (!rolling.has(service)) {
+            // No longer rolling here: the recreate path (or the orphan sweep) removes the containers.
+            delete state.services[service];
+            continue;
+        }
+        const keep = [];
+        for (const old of rollout.draining) {
+            if (old.drainUntil > Date.now()) {
+                keep.push(old);
+                continue;
+            }
+            try {
+                await removeByName(docker, old.container);
+                await deps?.emit(service, 'drained', `previous revision ${old.container} removed after drain`);
+            }
+            catch (e) {
+                if (!isNotFound(e))
+                    keep.push(old);
+            }
+        }
+        rollout.draining = keep;
+        if (!rollout.active && !rollout.candidate && !rollout.draining.length && !rollout.failed)
+            delete state.services[service];
+    }
+}
+/** Drops rolling state of a project that has no rolling service on this node any more. */
+export async function clearRolloutState(dir) {
+    await fs.rm(stateFile(dir), { force: true });
+}
+/** Reported states for rolling services whose current revision is still serving, used when another part of the reconcile failed. */
+export async function activeRollingStates(dir, services) {
+    const state = await loadRolloutState(dir);
+    const out = {};
+    for (const service of services) {
+        const active = state.services[service]?.active;
+        if (active)
+            out[service] = servingState(active);
+    }
+    return out;
+}

package/dist/registry.d.ts

@@ -0,0 +1,17 @@
+export declare const REGISTRY_AUTH_SECRET = "TUG_REGISTRY_AUTH";
+export interface RegistryCredential {
+    username: string;
+    password: string;
+}
+export type RegistryCredentials = Record<string, RegistryCredential>;
+/** A project secret containing registry-host -> username/password entries; never a desired-state field. */
+export declare function parseRegistryCredentials(value?: string): RegistryCredentials;
+export declare function imageLocation(image: string): {
+    host: string;
+    repository: string;
+    tag: string;
+    digest: string;
+    name: string;
+};
+/** Pin the complete index, so amd64 and arm64 agents select from the same immutable manifest. */
+export declare function resolveImage(image: string, credentials?: RegistryCredentials, request?: typeof fetch): Promise<string>;

package/dist/registry.js

@@ -0,0 +1,133 @@
+import { createHash } from 'node:crypto';
+export const REGISTRY_AUTH_SECRET = 'TUG_REGISTRY_AUTH';
+/** A project secret containing registry-host -> username/password entries; never a desired-state field. */
+export function parseRegistryCredentials(value) {
+    if (!value)
+        return {};
+    try {
+        const entries = JSON.parse(value);
+        if (!entries || typeof entries !== 'object' || Array.isArray(entries))
+            throw new Error();
+        const credentials = {};
+        for (const [host, auth] of Object.entries(entries)) {
+            if (!/^[a-zA-Z0-9.:[\]-]+$/.test(host) ||
+                !auth ||
+                typeof auth !== 'object' ||
+                typeof auth.username !== 'string' ||
+                typeof auth.password !== 'string')
+                throw new Error();
+            credentials[host] = { username: auth.username, password: auth.password };
+        }
+        return credentials;
+    }
+    catch {
+        throw new Error(`${REGISTRY_AUTH_SECRET} must be a JSON object mapping registry hosts to username/password objects`);
+    }
+}
+export function imageLocation(image) {
+    const match = /^(?<name>[^@\s]+?)(?:@(?<digest>sha256:[a-f0-9]{64}))?$/.exec(image);
+    if (!match?.groups)
+        throw new Error('invalid image reference');
+    const { name, digest } = match.groups;
+    const slash = name.indexOf('/');
+    const qualified = slash >= 0 && /[.:]|^localhost$/.test(name.slice(0, slash));
+    let host = qualified ? name.slice(0, slash) : 'docker.io';
+    if (host === 'index.docker.io')
+        host = 'docker.io';
+    let repository = qualified ? name.slice(slash + 1) : name;
+    const colon = repository.lastIndexOf(':');
+    const tag = colon >= 0 ? repository.slice(colon + 1) : 'latest';
+    if (colon >= 0)
+        repository = repository.slice(0, colon);
+    if (host === 'docker.io' && !repository.includes('/'))
+        repository = `library/${repository}`;
+    if (!/^[a-z0-9]+(?:[._-]+[a-z0-9]+)*(?:\/[a-z0-9]+(?:[._-]+[a-z0-9]+)*)*$/.test(repository) ||
+        !/^[\w][\w.-]{0,127}$/.test(tag) ||
+        !/^[a-zA-Z0-9.:[\]-]+$/.test(host))
+        throw new Error('invalid image reference');
+    return { host, repository, tag, digest, name };
+}
+const accept = [
+    'application/vnd.oci.image.index.v1+json',
+    'application/vnd.docker.distribution.manifest.list.v2+json',
+    'application/vnd.oci.image.manifest.v1+json',
+    'application/vnd.docker.distribution.manifest.v2+json',
+].join(', ');
+/** Pin the complete index, so amd64 and arm64 agents select from the same immutable manifest. */
+export async function resolveImage(image, credentials = {}, request = fetch) {
+    const location = imageLocation(image);
+    if (location.digest)
+        return image;
+    const { host, repository, tag, name } = location;
+    const endpoint = host === 'docker.io' ? 'registry-1.docker.io' : host;
+    const url = `https://${endpoint}/v2/${repository}/manifests/${tag}`;
+    const auth = credentials[host];
+    const basic = auth
+        ? `Basic ${Buffer.from(`${auth.username}:${auth.password}`).toString('base64')}`
+        : undefined;
+    const get = (authorization) => request(url, {
+        headers: { Accept: accept, ...(authorization ? { Authorization: authorization } : {}) },
+        redirect: 'error',
+        signal: AbortSignal.timeout(30_000),
+    });
+    try {
+        let response = await get();
+        if (response.status === 401) {
+            const challenge = response.headers.get('www-authenticate') || '';
+            await response.body?.cancel();
+            if (/^Basic\s/i.test(challenge) && basic)
+                response = await get(basic);
+            else if (/^Bearer\s/i.test(challenge)) {
+                const params = Object.fromEntries([...challenge.matchAll(/(\w+)="([^"]*)"/g)].map((m) => [m[1], m[2]]));
+                const tokenUrl = new URL(params.realm);
+                if (tokenUrl.protocol !== 'https:' || tokenUrl.username || tokenUrl.password)
+                    throw new Error();
+                if (params.service)
+                    tokenUrl.searchParams.set('service', params.service);
+                tokenUrl.searchParams.set('scope', `repository:${repository}:pull`);
+                const tokenResponse = await request(tokenUrl, {
+                    headers: basic ? { Authorization: basic } : {},
+                    redirect: 'error',
+                    signal: AbortSignal.timeout(30_000),
+                });
+                if (!tokenResponse.ok) {
+                    await tokenResponse.body?.cancel();
+                    throw new Error();
+                }
+                const body = (await tokenResponse.json());
+                const token = body.token || body.access_token;
+                if (!token || typeof token !== 'string')
+                    throw new Error();
+                response = await get(`Bearer ${token}`);
+            }
+            else
+                throw new Error();
+        }
+        if (!response.ok) {
+            await response.body?.cancel();
+            throw new Error();
+        }
+        // Hash the exact bytes instead of trusting a registry's digest header. Bound manifest memory use.
+        const chunks = [];
+        let size = 0;
+        for await (const chunk of response.body) {
+            size += chunk.length;
+            if (size > 8 * 1024 * 1024)
+                throw new Error();
+            chunks.push(chunk);
+        }
+        const bytes = Buffer.concat(chunks);
+        const manifest = JSON.parse(bytes.toString());
+        if (manifest.schemaVersion !== 2 ||
+            !(Array.isArray(manifest.manifests) || (manifest.config && Array.isArray(manifest.layers))))
+            throw new Error();
+        const digest = `sha256:${createHash('sha256').update(bytes).digest('hex')}`;
+        const reported = response.headers.get('docker-content-digest');
+        if (reported && reported !== digest)
+            throw new Error();
+        return `${name}@${digest}`;
+    }
+    catch {
+        throw new Error(`cannot resolve image ${image}; check registry availability and project ${REGISTRY_AUTH_SECRET} credentials`);
+    }
+}

package/dist/runners.d.ts

@@ -1,11 +1,6 @@
 import type { RunResult } from './build.ts';
-export type DockerRunner = (args: string[], opts?: {
-    cwd?: string;
-}) => Promise<RunResult>;
 export type HttpClient = typeof fetch;
-/** Default runner: `docker <args>` via the shared `run()` helper. */
-export declare function createDockerRunner(): DockerRunner;
-/** Runs a host binary (`wg`, `ip`); rejects on a non-zero exit like the docker runner. */
+/** Runs a host binary (`wg`, `ip`); rejects on a non-zero exit. */
 export type HostRunner = (cmd: string, args: string[], opts?: {
     cwd?: string;
 }) => Promise<RunResult>;

package/dist/runners.js

@@ -1,10 +1,6 @@
 // Injectable seams for the agent's side effects so rollout/health/secret logic can be unit-tested
-// without a real Docker daemon or control plane.
+// without a real Docker daemon or control plane. Docker itself is the `DockerApi` in `docker-api.ts`.
 import { run } from "./build.js";
-/** Default runner: `docker <args>` via the shared `run()` helper. */
-export function createDockerRunner() {
-    return (args, opts) => run('docker', args, opts);
-}
 export function createHostRunner() {
     return (cmd, args, opts) => run(cmd, args, opts);
 }

package/dist/templates/control-compose.yml

@@ -8,12 +8,8 @@ services:
       TUG_DATA_DIR: /data
       TUG_OPERATOR_TOKEN: {{OPERATOR_TOKEN}}
       TUG_MESH: {{MESH}}
-      TUG_REGISTRY: {{REGISTRY_HOST}}
-      TUG_REGISTRY_AUTH_PATH: {{REGISTRY_AUTH_PATH}}
-      TUG_REGISTRY_CONTAINER: {{REGISTRY_CONTAINER}}
     ports:
       - "{{PORT}}:8080"
     volumes:
       - /var/lib/tug-control:/data
-      - /var/lib/tug-registry-auth:/registry-auth
       - /var/run/docker.sock:/var/run/docker.sock

package/dist/templates/install-docker.sh

@@ -1,6 +1,9 @@
 set -eu
-if docker version >/dev/null 2>&1 && docker compose version >/dev/null 2>&1; then
-  echo 'Docker Engine and Compose are already available.' >&2
+# Nodes need only the Docker Engine. The control host also runs its own install with Docker Compose,
+# which the caller asks for with TUG_INSTALL_COMPOSE=1.
+want_compose="${TUG_INSTALL_COMPOSE:-0}"
+if docker version >/dev/null 2>&1 && { [ "$want_compose" != 1 ] || docker compose version >/dev/null 2>&1; }; then
+  echo 'Docker Engine is already available.' >&2
   exit 0
 fi
 os_release="${TUG_OS_RELEASE:-/etc/os-release}"
@@ -61,9 +64,10 @@ Signed-By: /etc/apt/keyrings/docker.asc
 REPO
   apt-get update >&2
   if [ "$engine_present" = true ]; then
-    apt-get install -y --no-upgrade --no-remove docker-compose-plugin >&2
+    [ "$want_compose" != 1 ] || apt-get install -y --no-upgrade --no-remove docker-compose-plugin >&2
   else
-    apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin >&2
+    apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin >&2
+    [ "$want_compose" != 1 ] || apt-get install -y docker-compose-plugin >&2
   fi
 else
   if [ "$engine_present" = false ]; then
@@ -75,11 +79,12 @@ else
   command -v curl >/dev/null 2>&1 || dnf install -y curl >&2
   curl -fsSL "https://download.docker.com/linux/$repo_os/docker-ce.repo" -o /etc/yum.repos.d/docker-ce.repo
   if [ "$engine_present" = true ]; then
-    dnf install -y docker-compose-plugin >&2
+    [ "$want_compose" != 1 ] || dnf install -y docker-compose-plugin >&2
   else
-    dnf install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin >&2
+    dnf install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin >&2
+    [ "$want_compose" != 1 ] || dnf install -y docker-compose-plugin >&2
   fi
 fi
 [ "$engine_present" = true ] || systemctl enable --now docker >&2
 docker version >/dev/null
-docker compose version >/dev/null
+[ "$want_compose" != 1 ] || docker compose version >/dev/null

package/dist/templates/node-install.sh

@@ -3,6 +3,5 @@ mkdir -p /etc/tug /var/lib/tug
 cat > /etc/tug/agent.env <<'ENV'
 {{ENV}}ENV
 chmod 0600 /etc/tug/agent.env
-{{DOCKER_LOGIN}}
 docker rm -f tug-agent >/dev/null 2>&1 || true
 docker run -d --name tug-agent --restart unless-stopped --env-file /etc/tug/agent.env {{RUN_FLAGS}}-v /var/run/docker.sock:/var/run/docker.sock -v /var/lib/tug:/var/lib/tug {{IMAGE_SH}} agent

package/dist/tokens.d.ts

@@ -14,7 +14,7 @@ export declare const PROJECT_NAME_PATTERN: RegExp;
 /**
  * The single source of truth for who may call what. Every `/api/v1` route must appear here: createApp refuses to
  * register an unlisted route, and a test compares this table with the live router. `public` routes do their own
- * credential check (the registry hook) and are not behind the token guard. docs/access-control.md mirrors this table.
+ * credential check and are not behind the token guard. docs/access-control.md mirrors this table.
  */
 export declare const ROUTE_ROLES: Record<string, RouteRole>;
 /** The authenticated caller of an API request. `projects` is null when the credential is not project-scoped. */
@@ -60,14 +60,14 @@ export declare function parseTokenRequest(body: unknown): {
     expiresAt: string | null;
 };
 /** Creates a token. The plaintext is returned once; only its hash is stored. */
-export declare function createToken(db: Db, request: ReturnType<typeof parseTokenRequest>, createdBy: string): Promise<TokenInfo & {
+export declare function createToken(db: Db, request: ReturnType<typeof parseTokenRequest>, createdBy: string): TokenInfo & {
     token: string;
-}>;
-export declare function listTokens(db: Db): Promise<TokenInfo[]>;
+};
+export declare function listTokens(db: Db): TokenInfo[];
 /** Revokes a token immediately. Returns false if no such token exists; revoking twice keeps the first revocation time. */
-export declare function revokeToken(db: Db, name: string): Promise<boolean>;
+export declare function revokeToken(db: Db, name: string): boolean;
 /** Resolves a bearer value to an actor by hash lookup: the root operator token first, then named tokens. */
-export declare function authenticate(db: Db, raw: string): Promise<Actor | null>;
+export declare function authenticate(db: Db, raw: string): Actor | null;
 /**
  * Which project a request targets: a name, `null` for control-wide data (admin only), or `undefined` when it cannot be
  * resolved (for example an unknown ID). Unresolvable targets are denied to scoped tokens without saying why, so they
@@ -88,4 +88,4 @@ export declare function recordEvent(db: Db, event: {
     project?: string | null;
     deploymentId?: string | null;
     metadata?: Record<string, unknown>;
-}): Promise<void>;
+}): void;