ag-ai 0.1.1 → 0.1.3

package/dist/k8s/common.d.ts

@@ -24,6 +24,11 @@ export interface SecretMount {
     file: string;
 }
 export declare const secretMount: (name: string, reference: SecretReference) => SecretMount;
+/**
+ * Mount one Secret key as one concrete file path, for tools that read a config
+ * file rather than an environment variable (for example OpenCode's auth.json).
+ */
+export declare const secretFileMount: (name: string, reference: SecretReference, file: string) => SecretMount;
 export declare const env: (name: string, value: string) => V1EnvVar;
 /** OpenCode health probe with basic auth, evaluated inside the container. */
 export declare const openCodeHealthProbe: (port: number) => {

package/dist/k8s/common.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.openCodeHealthProbe = exports.env = exports.secretMount = exports.stripClusterScopedNamespaces = exports.serviceUrl = exports.resourceName = exports.METAL_LB_KEY = exports.T3_SERVICE = exports.RUNNER_SERVICE = exports.OPENCODE_SERVICE = exports.T3_PORT = exports.GENERATION_PORT = exports.OPENCODE_PORT = exports.T3CODE_APP = exports.RUNNER_APP = exports.OPENCODE_APP = exports.NAMESPACE = void 0;
+exports.openCodeHealthProbe = exports.env = exports.secretFileMount = exports.secretMount = exports.stripClusterScopedNamespaces = exports.serviceUrl = exports.resourceName = exports.METAL_LB_KEY = exports.T3_SERVICE = exports.RUNNER_SERVICE = exports.OPENCODE_SERVICE = exports.T3_PORT = exports.GENERATION_PORT = exports.OPENCODE_PORT = exports.T3CODE_APP = exports.RUNNER_APP = exports.OPENCODE_APP = exports.NAMESPACE = void 0;
 const ag_rpi_mega_1 = require("ag-rpi-mega");
 /** The plugin owns its identity; addresses, hosts, and secrets come from the host. */
 exports.NAMESPACE = 'ag-ai';
@@ -39,6 +39,28 @@ const secretMount = (name, reference) => {
     return { volume, mount, file: `${mountPath}/${reference.key}` };
 };
 exports.secretMount = secretMount;
+/**
+ * Mount one Secret key as one concrete file path, for tools that read a config
+ * file rather than an environment variable (for example OpenCode's auth.json).
+ */
+const secretFileMount = (name, reference, file) => {
+    const volume = {
+        name: `${name}-file`,
+        secret: {
+            defaultMode: 0o400,
+            items: [{ key: reference.key, path: reference.key }],
+            secretName: reference.name,
+        },
+    };
+    const mount = {
+        mountPath: file,
+        name: volume.name,
+        readOnly: true,
+        subPath: reference.key,
+    };
+    return { volume, mount, file };
+};
+exports.secretFileMount = secretFileMount;
 const env = (name, value) => ({ name, value });
 exports.env = env;
 /** OpenCode health probe with basic auth, evaluated inside the container. */

package/dist/k8s/index.js

@@ -20,6 +20,7 @@ exports.plugin = {
         'generation-token',
         'analytica-token',
         'opencode-password',
+        'opencode-auth',
         'image-api-key',
     ],
     requiredImages: ['ag-ai-runner', 'ag-ai-opencode', 'ag-ai-t3code'],

package/dist/k8s/opencode.js

@@ -3,6 +3,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.opencodeStack = void 0;
 const ag_rpi_mega_1 = require("ag-rpi-mega");
 const common_1 = require("./common");
+/** The published OpenCode CLI is installed into a writable emptyDir at pod start. */
+const OPENCODE_PACKAGE = 'opencode-ai@1.18.31';
+const OPENCODE_PREFIX = '/opt/opencode';
+const OPENCODE_BIN = `${OPENCODE_PREFIX}/node_modules/.bin/opencode`;
 /** OpenCode server: durable state, basic auth from a mounted Secret, ClusterIP only. */
 const opencodeStack = (context) => {
     const { facilities } = context;
@@ -17,12 +21,14 @@ const opencodeStack = (context) => {
     (0, common_1.stripClusterScopedNamespaces)(stack);
     const password = context.secret('opencode-password');
     const credentials = (0, common_1.secretMount)('opencode-password', password);
+    // Provider credentials live in OpenCode's auth.json under XDG_DATA_HOME.
+    const auth = (0, common_1.secretFileMount)('opencode-auth', context.secret('opencode-auth'), '/data/opencode/data/opencode/auth.json');
     const probe = (0, common_1.openCodeHealthProbe)(common_1.OPENCODE_PORT);
     const container = {
         name: 'opencode',
         image: facilities.image('ag-ai-opencode'),
         imagePullPolicy: 'IfNotPresent',
-        command: ['opencode', 'serve', '--hostname', '0.0.0.0', '--port', String(common_1.OPENCODE_PORT)],
+        command: [OPENCODE_BIN, 'serve', '--hostname', '0.0.0.0', '--port', String(common_1.OPENCODE_PORT)],
         ports: [{ name: 'opencode', containerPort: common_1.OPENCODE_PORT, protocol: 'TCP' }],
         env: [
             (0, ag_rpi_mega_1.secretEnv)('OPENCODE_SERVER_PASSWORD', password),
@@ -38,17 +44,58 @@ const opencodeStack = (context) => {
             requests: { cpu: '50m', memory: '256Mi' },
             limits: { cpu: '1000m', memory: '1Gi' },
         },
-        volumeMounts: [...dataMounts, credentials.mount, { name: 'tmp', mountPath: '/tmp' }],
+        volumeMounts: [
+            ...dataMounts,
+            credentials.mount,
+            auth.mount,
+            { name: 'opencode', mountPath: OPENCODE_PREFIX, readOnly: true },
+            { name: 'tmp', mountPath: '/tmp' },
+        ],
     };
-    stack.addDeployment({
+    // The postinstall script selects and copies the platform binary, so this
+    // install must not be run with --ignore-scripts.
+    const installer = {
+        name: 'install-opencode',
+        image: facilities.image('ag-ai-opencode'),
+        command: ['npm'],
+        args: ['install', '--prefix', OPENCODE_PREFIX, '--no-audit', '--no-fund', OPENCODE_PACKAGE],
+        env: [(0, common_1.env)('HOME', '/tmp'), (0, common_1.env)('NPM_CONFIG_CACHE', '/tmp/npm-cache')],
+        volumeMounts: [
+            { name: 'opencode', mountPath: OPENCODE_PREFIX },
+            { name: 'tmp', mountPath: '/tmp' },
+        ],
+        resources: {
+            requests: { cpu: '100m', memory: '256Mi' },
+            limits: { cpu: '1000m', memory: '1Gi' },
+        },
+    };
+    const deployment = stack.addDeployment({
         name: 'server',
         containers: [container],
-        volumes: [dataVolume, credentials.volume, { name: 'tmp', emptyDir: { sizeLimit: '256Mi' } }],
+        initContainers: [installer],
+        volumes: [
+            dataVolume,
+            credentials.volume,
+            auth.volume,
+            { name: 'opencode', emptyDir: { sizeLimit: '1Gi' } },
+            { name: 'tmp', emptyDir: { sizeLimit: '1Gi' } },
+        ],
         replicas: 1,
         architecture: facilities.arch,
         securityMode: 'None',
         changeNFSFilePerms: true,
     });
+    const spec = deployment.spec;
+    // oxlint-disable-next-line typescript/no-unnecessary-condition -- the SDK class type hides runtime optionality.
+    const pod = spec?.template?.spec;
+    if (!spec || !pod)
+        throw new Error('opencode deployment is missing its pod specification');
+    // Group-own the emptyDirs for the non-root install and runtime containers.
+    pod.securityContext = {
+        fsGroup: 65534,
+        fsGroupChangePolicy: 'OnRootMismatch',
+        seccompProfile: { type: 'RuntimeDefault' },
+    };
     stack.addService({ name: common_1.OPENCODE_SERVICE, tcp: [common_1.OPENCODE_PORT], type: 'ClusterIP' });
     return stack;
 };

package/dist/k8s/runner.js

@@ -9,6 +9,10 @@ const node_path_1 = __importDefault(require("node:path"));
 const ag_rpi_mega_1 = require("ag-rpi-mega");
 const common_1 = require("./common");
 const networkInitTemplate = (0, node_fs_1.readFileSync)(node_path_1.default.join(__dirname, 'assets', 'network-init.sh'), 'utf8');
+/** The published runtime is installed into a writable emptyDir at pod start. */
+const AG_AI_PACKAGE = 'ag-ai@0.1.1';
+const AG_AI_RUNTIME_DIR = '/opt/ag-ai';
+const AG_AI_BRIDGE = `${AG_AI_RUNTIME_DIR}/node_modules/ag-ai/runtime/bridge.mjs`;
 const networkInitScript = ({ generationCidr, generationPort, opencodePort, }) => networkInitTemplate
     .replaceAll('__GENERATION_CIDR__', generationCidr)
     .replaceAll('__GENERATION_PORT__', String(generationPort))
@@ -74,8 +78,8 @@ const runnerStack = (context) => {
         name: 'runner',
         image: facilities.image('ag-ai-runner'),
         imagePullPolicy: 'IfNotPresent',
-        command: ['node', 'runtime/bridge.mjs'],
-        workingDir: '/app',
+        command: ['node', AG_AI_BRIDGE],
+        workingDir: '/data',
         ports: [{ name: 'generation', containerPort: common_1.GENERATION_PORT, protocol: 'TCP' }],
         startupProbe: { ...healthProbe(false), failureThreshold: 30 },
         livenessProbe: { ...healthProbe(false), failureThreshold: 3 },
@@ -106,6 +110,7 @@ const runnerStack = (context) => {
         volumeMounts: [
             ...dataMounts,
             { name: 'runner-tmp', mountPath: '/tmp' },
+            { name: 'runtime', mountPath: AG_AI_RUNTIME_DIR, readOnly: true },
             secrets.runner.mount,
             secrets.generation.mount,
             secrets.analytica.mount,
@@ -119,6 +124,7 @@ const runnerStack = (context) => {
         volumes: [
             dataVolume,
             scriptVolume,
+            { name: 'runtime', emptyDir: { sizeLimit: '512Mi' } },
             { name: 'runner-tmp', emptyDir: { sizeLimit: '128Mi' } },
             secrets.runner.volume,
             secrets.generation.volume,
@@ -158,6 +164,39 @@ const runnerStack = (context) => {
                 limits: { cpu: '500m', memory: '128Mi' },
             },
         },
+        {
+            name: 'install-ag-ai',
+            image: facilities.image('ag-ai-runner'),
+            command: ['npm'],
+            args: [
+                'install',
+                '--prefix',
+                AG_AI_RUNTIME_DIR,
+                '--no-audit',
+                '--no-fund',
+                '--omit=dev',
+                '--ignore-scripts',
+                AG_AI_PACKAGE,
+            ],
+            env: [(0, common_1.env)('HOME', '/tmp'), (0, common_1.env)('NPM_CONFIG_CACHE', '/tmp/npm-cache')],
+            volumeMounts: [
+                { name: 'runtime', mountPath: AG_AI_RUNTIME_DIR },
+                { name: 'runner-tmp', mountPath: '/tmp' },
+            ],
+            securityContext: {
+                runAsNonRoot: true,
+                runAsUser: 65534,
+                runAsGroup: 65534,
+                readOnlyRootFilesystem: true,
+                allowPrivilegeEscalation: false,
+                capabilities: { drop: ['ALL'] },
+                seccompProfile: { type: 'RuntimeDefault' },
+            },
+            resources: {
+                requests: { cpu: '50m', memory: '64Mi' },
+                limits: { cpu: '500m', memory: '512Mi' },
+            },
+        },
         {
             name: 'prepare-generation-store',
             image: facilities.image('ag-ai-runner'),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ag-ai",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Provider-neutral AI client and cluster runtime for the rpi-mega cluster.",
   "license": "ISC",
   "author": "admin@gec.dev",