ag-ai 0.1.0

package/dist/k8s/runner.js

@@ -0,0 +1,247 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runnerStack = void 0;
+const node_fs_1 = require("node:fs");
+const node_path_1 = __importDefault(require("node:path"));
+const ag_rpi_mega_1 = require("ag-rpi-mega");
+const common_1 = require("./common");
+const networkInitTemplate = (0, node_fs_1.readFileSync)(node_path_1.default.join(__dirname, 'assets', 'network-init.sh'), 'utf8');
+const networkInitScript = ({ generationCidr, generationPort, opencodePort, }) => networkInitTemplate
+    .replaceAll('__GENERATION_CIDR__', generationCidr)
+    .replaceAll('__GENERATION_PORT__', String(generationPort))
+    .replaceAll('__OPENCODE_PORT__', String(opencodePort))
+    .replaceAll('__DNS_RULES__', '-A OUTPUT -p udp --dport 53 -j ACCEPT\n-A OUTPUT -p tcp --dport 53 -j ACCEPT')
+    .replaceAll('__GENERATION_REJECT__', `-A OUTPUT -d ${generationCidr} -j REJECT`);
+const healthProbe = (readiness) => ({
+    exec: {
+        command: [
+            'node',
+            '-e',
+            `try { const h = JSON.parse(require('node:fs').readFileSync('/tmp/runner-health.json','utf8')); process.exit(Date.now() - h.checkedAt < 60000${readiness ? ' && h.ready === true' : ''} ? 0 : 1); } catch { process.exit(1); }`,
+        ],
+    },
+    timeoutSeconds: 5,
+    periodSeconds: 10,
+});
+/** Queue worker: OpenCode executor, NFS generation store, LAN-only generation listener. */
+const runnerStack = (context) => {
+    const { facilities } = context;
+    const queueUrl = context.env.AG_AI_QUEUE_URL;
+    if (!queueUrl)
+        throw new Error('AG_AI_QUEUE_URL is required');
+    const generationCidr = context.env.AG_AI_GENERATION_CIDR;
+    if (!generationCidr)
+        throw new Error('AG_AI_GENERATION_CIDR is required');
+    const imageProvider = context.env.AG_AI_IMAGE_PROVIDER ?? 'openai';
+    const opencodeProvider = context.env.AG_AI_OPENCODE_PROVIDER;
+    const metalLbAddress = facilities.metalLb(common_1.METAL_LB_KEY);
+    if (!metalLbAddress)
+        throw new Error(`no MetalLB address is configured for ${common_1.METAL_LB_KEY}`);
+    const stack = new ag_rpi_mega_1.Stack({ namespace: common_1.NAMESPACE, appName: common_1.RUNNER_APP, facilities });
+    const [dataVolume, dataMounts] = stack.addNFSVolume({
+        namePrefix: 'data',
+        mountPath: '/data',
+        path: facilities.nfs.exportPath,
+        server: facilities.nfs.hostname,
+        accessMode: 'ReadWriteOnce',
+    });
+    (0, common_1.stripClusterScopedNamespaces)(stack);
+    const [scriptVolume, scriptMount, scriptConfigMap] = stack.addConfigMapVolumes({
+        name: 'startup',
+        baseMountDirectory: '/etc/ag-ai',
+        preserveData: true,
+        data: {
+            'network-init.sh': networkInitScript({
+                generationCidr,
+                generationPort: common_1.GENERATION_PORT,
+                opencodePort: common_1.OPENCODE_PORT,
+            }),
+        },
+    });
+    scriptConfigMap.immutable = true;
+    const secrets = {
+        runner: (0, common_1.secretMount)('runner-token', context.secret('runner-token')),
+        generation: (0, common_1.secretMount)('generation-token', context.secret('generation-token')),
+        analytica: (0, common_1.secretMount)('analytica-token', context.secret('analytica-token')),
+        opencode: (0, common_1.secretMount)('opencode-password', context.secret('opencode-password')),
+        image: (0, common_1.secretMount)('image-api-key', context.secret('image-api-key')),
+    };
+    const opencodeUrl = (0, common_1.serviceUrl)(facilities, common_1.OPENCODE_APP, common_1.OPENCODE_SERVICE, common_1.OPENCODE_PORT);
+    const container = {
+        name: 'runner',
+        image: facilities.image('ag-ai-runner'),
+        imagePullPolicy: 'IfNotPresent',
+        command: ['node', 'runtime/bridge.mjs'],
+        workingDir: '/app',
+        ports: [{ name: 'generation', containerPort: common_1.GENERATION_PORT, protocol: 'TCP' }],
+        startupProbe: { ...healthProbe(false), failureThreshold: 30 },
+        livenessProbe: { ...healthProbe(false), failureThreshold: 3 },
+        readinessProbe: { ...healthProbe(true), failureThreshold: 2 },
+        env: [
+            (0, common_1.env)('AG_AI_QUEUE_URL', queueUrl),
+            (0, common_1.env)('AG_AI_RUNNER_TOKEN_FILE', secrets.runner.file),
+            (0, common_1.env)('AG_AI_ANALYTICA_TOKEN_FILE', secrets.analytica.file),
+            (0, common_1.env)('AG_AI_OPENCODE_URL', opencodeUrl),
+            (0, common_1.env)('AG_AI_OPENCODE_PASSWORD_FILE', secrets.opencode.file),
+            ...(opencodeProvider === undefined ? [] : [(0, common_1.env)('AG_AI_OPENCODE_PROVIDER', opencodeProvider)]),
+            (0, common_1.env)('AG_AI_IMAGE_PROVIDER', imageProvider),
+            (0, common_1.env)('AG_AI_IMAGE_API_KEY_FILE', secrets.image.file),
+            (0, common_1.env)('AG_AI_RUNNER_ID', common_1.RUNNER_APP),
+            (0, common_1.env)('AG_AI_WORKSPACE', '/data/workspace'),
+            (0, common_1.env)('AG_AI_MAIN_WORKSPACE', '/data/workspace'),
+            (0, common_1.env)('AG_AI_GENERATED_IMAGES', '/data/generated-images'),
+            (0, common_1.env)('AG_AI_MAIN_GENERATED_IMAGES', '/data/generated-images'),
+            { name: 'AG_AI_GENERATION_HOST', valueFrom: { fieldRef: { fieldPath: 'status.podIP' } } },
+            (0, common_1.env)('AG_AI_GENERATION_PORT', String(common_1.GENERATION_PORT)),
+            (0, common_1.env)('AG_AI_GENERATION_STORE', '/data/generation-jobs'),
+            (0, common_1.env)('AG_AI_GENERATION_TOKEN_FILE', secrets.generation.file),
+        ],
+        resources: {
+            requests: { cpu: '50m', memory: '64Mi' },
+            limits: { cpu: '500m', memory: '512Mi' },
+        },
+        volumeMounts: [
+            ...dataMounts,
+            { name: 'runner-tmp', mountPath: '/tmp' },
+            secrets.runner.mount,
+            secrets.generation.mount,
+            secrets.analytica.mount,
+            secrets.opencode.mount,
+            secrets.image.mount,
+        ],
+    };
+    const deployment = stack.addDeployment({
+        name: 'runner',
+        containers: [container],
+        volumes: [
+            dataVolume,
+            scriptVolume,
+            { name: 'runner-tmp', emptyDir: { sizeLimit: '128Mi' } },
+            secrets.runner.volume,
+            secrets.generation.volume,
+            secrets.analytica.volume,
+            secrets.opencode.volume,
+            secrets.image.volume,
+        ],
+        replicas: 1,
+        architecture: facilities.arch,
+        securityMode: 'None',
+        changeNFSFilePerms: false,
+    });
+    const spec = deployment.spec;
+    // oxlint-disable-next-line typescript/no-unnecessary-condition -- the SDK class type hides runtime optionality.
+    const pod = spec?.template?.spec;
+    if (!spec || !pod)
+        throw new Error('runner deployment is missing its pod specification');
+    // A shared store must have only one writer during rollouts.
+    spec.strategy = { type: 'Recreate' };
+    pod.initContainers = [
+        {
+            name: 'restrict-network',
+            image: facilities.image('dockerAlpine'),
+            command: ['/bin/sh', '/etc/ag-ai/network-init.sh'],
+            volumeMounts: [{ name: scriptMount.name, mountPath: scriptMount.mountPath, readOnly: true }],
+            securityContext: {
+                runAsNonRoot: false,
+                runAsUser: 0,
+                runAsGroup: 0,
+                privileged: false,
+                allowPrivilegeEscalation: false,
+                capabilities: { drop: ['ALL'], add: ['NET_ADMIN'] },
+                seccompProfile: { type: 'RuntimeDefault' },
+            },
+            resources: {
+                requests: { cpu: '50m', memory: '32Mi' },
+                limits: { cpu: '500m', memory: '128Mi' },
+            },
+        },
+        {
+            name: 'prepare-generation-store',
+            image: facilities.image('ag-ai-runner'),
+            command: ['node', '-e'],
+            args: [
+                "require('node:fs').mkdirSync('/data/generation-jobs', { recursive: true, mode: 0o700 })",
+            ],
+            volumeMounts: dataMounts,
+            securityContext: {
+                runAsNonRoot: true,
+                runAsUser: 65534,
+                runAsGroup: 65534,
+                readOnlyRootFilesystem: true,
+                allowPrivilegeEscalation: false,
+                capabilities: { drop: ['ALL'] },
+                seccompProfile: { type: 'RuntimeDefault' },
+            },
+            resources: {
+                requests: { cpu: '10m', memory: '32Mi' },
+                limits: { cpu: '100m', memory: '64Mi' },
+            },
+        },
+    ];
+    pod.hostNetwork = false;
+    pod.hostPID = false;
+    pod.hostIPC = false;
+    pod.dnsPolicy = 'ClusterFirst';
+    pod.automountServiceAccountToken = false;
+    pod.shareProcessNamespace = false;
+    pod.enableServiceLinks = false;
+    pod.terminationGracePeriodSeconds = 60;
+    pod.securityContext = {
+        runAsNonRoot: true,
+        runAsUser: 65534,
+        runAsGroup: 65534,
+        fsGroup: 65534,
+        fsGroupChangePolicy: 'OnRootMismatch',
+        seccompProfile: { type: 'RuntimeDefault' },
+    };
+    // Only the authenticated generation listener is reachable from the LAN.
+    // Never add an Ingress, hostname route, public IP, or raw service.
+    stack.resources.push({
+        apiVersion: 'v1',
+        kind: 'Service',
+        metadata: {
+            name: (0, common_1.resourceName)(common_1.RUNNER_APP, common_1.RUNNER_SERVICE),
+            namespace: common_1.NAMESPACE,
+            annotations: { [facilities.annotations.addressPool]: common_1.METAL_LB_KEY },
+        },
+        spec: {
+            type: 'LoadBalancer',
+            loadBalancerIP: metalLbAddress,
+            loadBalancerSourceRanges: [generationCidr],
+            externalTrafficPolicy: 'Local',
+            allocateLoadBalancerNodePorts: false,
+            selector: { app: common_1.RUNNER_APP },
+            ports: [
+                {
+                    name: 'generation',
+                    protocol: 'TCP',
+                    port: common_1.GENERATION_PORT,
+                    targetPort: common_1.GENERATION_PORT,
+                },
+            ],
+        },
+    });
+    stack.resources.push({
+        apiVersion: 'networking.k8s.io/v1',
+        kind: 'NetworkPolicy',
+        metadata: {
+            name: (0, common_1.resourceName)(common_1.RUNNER_APP, 'generation-lan-only'),
+            namespace: common_1.NAMESPACE,
+        },
+        spec: {
+            podSelector: { matchLabels: { app: common_1.RUNNER_APP } },
+            policyTypes: ['Ingress'],
+            ingress: [
+                {
+                    from: [{ ipBlock: { cidr: generationCidr } }],
+                    ports: [{ protocol: 'TCP', port: common_1.GENERATION_PORT }],
+                },
+            ],
+        },
+    });
+    return stack;
+};
+exports.runnerStack = runnerStack;

package/dist/k8s/t3code.d.ts

@@ -0,0 +1,4 @@
+import { Stack } from 'ag-rpi-mega';
+import type { ClusterPluginContext } from 'ag-rpi-mega';
+/** T3 Code control surface: durable home, OpenCode provider, outbound T3 Connect only. */
+export declare const t3codeStack: (context: ClusterPluginContext) => Stack;

package/dist/k8s/t3code.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.t3codeStack = void 0;
+const ag_rpi_mega_1 = require("ag-rpi-mega");
+const common_1 = require("./common");
+/** T3 Code control surface: durable home, OpenCode provider, outbound T3 Connect only. */
+const t3codeStack = (context) => {
+    const { facilities } = context;
+    const stack = new ag_rpi_mega_1.Stack({ namespace: common_1.NAMESPACE, appName: common_1.T3CODE_APP, facilities });
+    const [dataVolume, dataMounts] = stack.addNFSVolume({
+        namePrefix: 'home',
+        mountPath: '/data',
+        path: facilities.nfs.exportPath,
+        server: facilities.nfs.hostname,
+        accessMode: 'ReadWriteOnce',
+    });
+    (0, common_1.stripClusterScopedNamespaces)(stack);
+    const opencodePassword = context.secret('opencode-password');
+    const credentials = (0, common_1.secretMount)('opencode-password', opencodePassword);
+    const opencodeUrl = (0, common_1.serviceUrl)(facilities, common_1.OPENCODE_APP, common_1.OPENCODE_SERVICE, common_1.OPENCODE_PORT);
+    const container = {
+        name: 't3code',
+        image: facilities.image('ag-ai-t3code'),
+        imagePullPolicy: 'IfNotPresent',
+        command: ['t3', 'serve', '--host', '0.0.0.0'],
+        ports: [{ name: 't3', containerPort: common_1.T3_PORT, protocol: 'TCP' }],
+        env: [
+            (0, common_1.env)('T3CODE_HOME', '/data/t3code'),
+            (0, common_1.env)('OPENCODE_URL', opencodeUrl),
+            (0, ag_rpi_mega_1.secretEnv)('OPENCODE_SERVER_PASSWORD', opencodePassword),
+            // T3 Connect is outbound-only; the server dials the relay, never the reverse.
+            (0, common_1.env)('T3CODE_CONNECT', '1'),
+        ],
+        startupProbe: { tcpSocket: { port: common_1.T3_PORT }, failureThreshold: 30, periodSeconds: 10 },
+        readinessProbe: { tcpSocket: { port: common_1.T3_PORT }, initialDelaySeconds: 5, periodSeconds: 10 },
+        livenessProbe: {
+            tcpSocket: { port: common_1.T3_PORT },
+            initialDelaySeconds: 15,
+            periodSeconds: 30,
+        },
+        resources: {
+            requests: { cpu: '50m', memory: '256Mi' },
+            limits: { cpu: '1000m', memory: '1Gi' },
+        },
+        volumeMounts: [...dataMounts, credentials.mount, { name: 'tmp', mountPath: '/tmp' }],
+    };
+    stack.addDeployment({
+        name: 'server',
+        containers: [container],
+        volumes: [dataVolume, credentials.volume, { name: 'tmp', emptyDir: { sizeLimit: '256Mi' } }],
+        replicas: 1,
+        architecture: facilities.arch,
+        securityMode: 'None',
+        changeNFSFilePerms: true,
+    });
+    // Internal only; T3 Connect is the outbound path. Never add an Ingress.
+    stack.addService({ name: common_1.T3_SERVICE, tcp: [common_1.T3_PORT], type: 'ClusterIP' });
+    return stack;
+};
+exports.t3codeStack = t3codeStack;

package/package.json

@@ -0,0 +1,56 @@
+{
+  "name": "ag-ai",
+  "version": "0.1.0",
+  "description": "Provider-neutral AI client and cluster runtime for the rpi-mega cluster.",
+  "license": "ISC",
+  "author": "admin@gec.dev",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/andreigec/ag-ai.git"
+  },
+  "files": [
+    "dist/**/*",
+    "runtime/**/*",
+    "README.md"
+  ],
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": "./dist/index.js",
+    "./client": "./dist/index.js",
+    "./k8s": "./dist/k8s/index.js",
+    "./runtime": "./runtime/index.mjs"
+  },
+  "scripts": {
+    "preinstall": "npx only-allow pnpm",
+    "format": "e7-oxfmt",
+    "lint": "e7-oxlint",
+    "typecheck": "tsc --noEmit",
+    "build": "rimraf dist tsconfig.build.tsbuildinfo && tsc -p tsconfig.build.json && node scripts/copy-k8s-assets.mjs",
+    "test": "pnpm run test:client && pnpm run test:runtime",
+    "test:client": "tsx --test \"src/tests/**/*.test.ts\"",
+    "test:runtime": "node --test \"runtime/tests/**/*.test.mjs\""
+  },
+  "dependencies": {
+    "@google/genai": "^2.19.0",
+    "node-cache": "^5.1.2"
+  },
+  "devDependencies": {
+    "@kubernetes/client-node": "2.0.0",
+    "@types/node": "^26.4.1",
+    "ag-rpi-mega": "file:../ag-rpi-mega",
+    "eslint-config-e7npm": "^0.1.68",
+    "rimraf": "^6.1.3",
+    "tsx": "^4.23.13",
+    "typescript": "7.0.2"
+  },
+  "peerDependencies": {
+    "ag-rpi-mega": ">=0.1.0"
+  },
+  "peerDependenciesMeta": {
+    "ag-rpi-mega": {
+      "optional": true
+    }
+  },
+  "packageManager": "pnpm@11.24.0"
+}