ag-ai 0.1.1 → 0.1.2

package/dist/k8s/opencode.js

@@ -3,6 +3,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.opencodeStack = void 0;
 const ag_rpi_mega_1 = require("ag-rpi-mega");
 const common_1 = require("./common");
+/** The published OpenCode CLI is installed into a writable emptyDir at pod start. */
+const OPENCODE_PACKAGE = 'opencode-ai@1.18.31';
+const OPENCODE_PREFIX = '/opt/opencode';
+const OPENCODE_BIN = `${OPENCODE_PREFIX}/node_modules/.bin/opencode`;
 /** OpenCode server: durable state, basic auth from a mounted Secret, ClusterIP only. */
 const opencodeStack = (context) => {
     const { facilities } = context;
@@ -22,7 +26,7 @@ const opencodeStack = (context) => {
         name: 'opencode',
         image: facilities.image('ag-ai-opencode'),
         imagePullPolicy: 'IfNotPresent',
-        command: ['opencode', 'serve', '--hostname', '0.0.0.0', '--port', String(common_1.OPENCODE_PORT)],
+        command: [OPENCODE_BIN, 'serve', '--hostname', '0.0.0.0', '--port', String(common_1.OPENCODE_PORT)],
         ports: [{ name: 'opencode', containerPort: common_1.OPENCODE_PORT, protocol: 'TCP' }],
         env: [
             (0, ag_rpi_mega_1.secretEnv)('OPENCODE_SERVER_PASSWORD', password),
@@ -38,17 +42,56 @@ const opencodeStack = (context) => {
             requests: { cpu: '50m', memory: '256Mi' },
             limits: { cpu: '1000m', memory: '1Gi' },
         },
-        volumeMounts: [...dataMounts, credentials.mount, { name: 'tmp', mountPath: '/tmp' }],
+        volumeMounts: [
+            ...dataMounts,
+            credentials.mount,
+            { name: 'opencode', mountPath: OPENCODE_PREFIX, readOnly: true },
+            { name: 'tmp', mountPath: '/tmp' },
+        ],
     };
-    stack.addDeployment({
+    // The postinstall script selects and copies the platform binary, so this
+    // install must not be run with --ignore-scripts.
+    const installer = {
+        name: 'install-opencode',
+        image: facilities.image('ag-ai-opencode'),
+        command: ['npm'],
+        args: ['install', '--prefix', OPENCODE_PREFIX, '--no-audit', '--no-fund', OPENCODE_PACKAGE],
+        env: [(0, common_1.env)('HOME', '/tmp'), (0, common_1.env)('NPM_CONFIG_CACHE', '/tmp/npm-cache')],
+        volumeMounts: [
+            { name: 'opencode', mountPath: OPENCODE_PREFIX },
+            { name: 'tmp', mountPath: '/tmp' },
+        ],
+        resources: {
+            requests: { cpu: '100m', memory: '256Mi' },
+            limits: { cpu: '1000m', memory: '1Gi' },
+        },
+    };
+    const deployment = stack.addDeployment({
         name: 'server',
         containers: [container],
-        volumes: [dataVolume, credentials.volume, { name: 'tmp', emptyDir: { sizeLimit: '256Mi' } }],
+        initContainers: [installer],
+        volumes: [
+            dataVolume,
+            credentials.volume,
+            { name: 'opencode', emptyDir: { sizeLimit: '1Gi' } },
+            { name: 'tmp', emptyDir: { sizeLimit: '1Gi' } },
+        ],
         replicas: 1,
         architecture: facilities.arch,
         securityMode: 'None',
         changeNFSFilePerms: true,
     });
+    const spec = deployment.spec;
+    // oxlint-disable-next-line typescript/no-unnecessary-condition -- the SDK class type hides runtime optionality.
+    const pod = spec?.template?.spec;
+    if (!spec || !pod)
+        throw new Error('opencode deployment is missing its pod specification');
+    // Group-own the emptyDirs for the non-root install and runtime containers.
+    pod.securityContext = {
+        fsGroup: 65534,
+        fsGroupChangePolicy: 'OnRootMismatch',
+        seccompProfile: { type: 'RuntimeDefault' },
+    };
     stack.addService({ name: common_1.OPENCODE_SERVICE, tcp: [common_1.OPENCODE_PORT], type: 'ClusterIP' });
     return stack;
 };

package/dist/k8s/runner.js

@@ -9,6 +9,10 @@ const node_path_1 = __importDefault(require("node:path"));
 const ag_rpi_mega_1 = require("ag-rpi-mega");
 const common_1 = require("./common");
 const networkInitTemplate = (0, node_fs_1.readFileSync)(node_path_1.default.join(__dirname, 'assets', 'network-init.sh'), 'utf8');
+/** The published runtime is installed into a writable emptyDir at pod start. */
+const AG_AI_PACKAGE = 'ag-ai@0.1.1';
+const AG_AI_RUNTIME_DIR = '/opt/ag-ai';
+const AG_AI_BRIDGE = `${AG_AI_RUNTIME_DIR}/node_modules/ag-ai/runtime/bridge.mjs`;
 const networkInitScript = ({ generationCidr, generationPort, opencodePort, }) => networkInitTemplate
     .replaceAll('__GENERATION_CIDR__', generationCidr)
     .replaceAll('__GENERATION_PORT__', String(generationPort))
@@ -74,8 +78,8 @@ const runnerStack = (context) => {
         name: 'runner',
         image: facilities.image('ag-ai-runner'),
         imagePullPolicy: 'IfNotPresent',
-        command: ['node', 'runtime/bridge.mjs'],
-        workingDir: '/app',
+        command: ['node', AG_AI_BRIDGE],
+        workingDir: '/data',
         ports: [{ name: 'generation', containerPort: common_1.GENERATION_PORT, protocol: 'TCP' }],
         startupProbe: { ...healthProbe(false), failureThreshold: 30 },
         livenessProbe: { ...healthProbe(false), failureThreshold: 3 },
@@ -106,6 +110,7 @@ const runnerStack = (context) => {
         volumeMounts: [
             ...dataMounts,
             { name: 'runner-tmp', mountPath: '/tmp' },
+            { name: 'runtime', mountPath: AG_AI_RUNTIME_DIR, readOnly: true },
             secrets.runner.mount,
             secrets.generation.mount,
             secrets.analytica.mount,
@@ -119,6 +124,7 @@ const runnerStack = (context) => {
         volumes: [
             dataVolume,
             scriptVolume,
+            { name: 'runtime', emptyDir: { sizeLimit: '512Mi' } },
             { name: 'runner-tmp', emptyDir: { sizeLimit: '128Mi' } },
             secrets.runner.volume,
             secrets.generation.volume,
@@ -158,6 +164,39 @@ const runnerStack = (context) => {
                 limits: { cpu: '500m', memory: '128Mi' },
             },
         },
+        {
+            name: 'install-ag-ai',
+            image: facilities.image('ag-ai-runner'),
+            command: ['npm'],
+            args: [
+                'install',
+                '--prefix',
+                AG_AI_RUNTIME_DIR,
+                '--no-audit',
+                '--no-fund',
+                '--omit=dev',
+                '--ignore-scripts',
+                AG_AI_PACKAGE,
+            ],
+            env: [(0, common_1.env)('HOME', '/tmp'), (0, common_1.env)('NPM_CONFIG_CACHE', '/tmp/npm-cache')],
+            volumeMounts: [
+                { name: 'runtime', mountPath: AG_AI_RUNTIME_DIR },
+                { name: 'runner-tmp', mountPath: '/tmp' },
+            ],
+            securityContext: {
+                runAsNonRoot: true,
+                runAsUser: 65534,
+                runAsGroup: 65534,
+                readOnlyRootFilesystem: true,
+                allowPrivilegeEscalation: false,
+                capabilities: { drop: ['ALL'] },
+                seccompProfile: { type: 'RuntimeDefault' },
+            },
+            resources: {
+                requests: { cpu: '50m', memory: '64Mi' },
+                limits: { cpu: '500m', memory: '512Mi' },
+            },
+        },
         {
             name: 'prepare-generation-store',
             image: facilities.image('ag-ai-runner'),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ag-ai",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Provider-neutral AI client and cluster runtime for the rpi-mega cluster.",
   "license": "ISC",
   "author": "admin@gec.dev",