ag-ai 0.1.2 → 0.1.4

package/dist/k8s/common.d.ts

@@ -24,6 +24,11 @@ export interface SecretMount {
     file: string;
 }
 export declare const secretMount: (name: string, reference: SecretReference) => SecretMount;
+/**
+ * Mount one Secret key as one concrete file path, for tools that read a config
+ * file rather than an environment variable (for example OpenCode's auth.json).
+ */
+export declare const secretFileMount: (name: string, reference: SecretReference, file: string) => SecretMount;
 export declare const env: (name: string, value: string) => V1EnvVar;
 /** OpenCode health probe with basic auth, evaluated inside the container. */
 export declare const openCodeHealthProbe: (port: number) => {

package/dist/k8s/common.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.openCodeHealthProbe = exports.env = exports.secretMount = exports.stripClusterScopedNamespaces = exports.serviceUrl = exports.resourceName = exports.METAL_LB_KEY = exports.T3_SERVICE = exports.RUNNER_SERVICE = exports.OPENCODE_SERVICE = exports.T3_PORT = exports.GENERATION_PORT = exports.OPENCODE_PORT = exports.T3CODE_APP = exports.RUNNER_APP = exports.OPENCODE_APP = exports.NAMESPACE = void 0;
+exports.openCodeHealthProbe = exports.env = exports.secretFileMount = exports.secretMount = exports.stripClusterScopedNamespaces = exports.serviceUrl = exports.resourceName = exports.METAL_LB_KEY = exports.T3_SERVICE = exports.RUNNER_SERVICE = exports.OPENCODE_SERVICE = exports.T3_PORT = exports.GENERATION_PORT = exports.OPENCODE_PORT = exports.T3CODE_APP = exports.RUNNER_APP = exports.OPENCODE_APP = exports.NAMESPACE = void 0;
 const ag_rpi_mega_1 = require("ag-rpi-mega");
 /** The plugin owns its identity; addresses, hosts, and secrets come from the host. */
 exports.NAMESPACE = 'ag-ai';
@@ -39,6 +39,28 @@ const secretMount = (name, reference) => {
     return { volume, mount, file: `${mountPath}/${reference.key}` };
 };
 exports.secretMount = secretMount;
+/**
+ * Mount one Secret key as one concrete file path, for tools that read a config
+ * file rather than an environment variable (for example OpenCode's auth.json).
+ */
+const secretFileMount = (name, reference, file) => {
+    const volume = {
+        name: `${name}-file`,
+        secret: {
+            defaultMode: 0o400,
+            items: [{ key: reference.key, path: reference.key }],
+            secretName: reference.name,
+        },
+    };
+    const mount = {
+        mountPath: file,
+        name: volume.name,
+        readOnly: true,
+        subPath: reference.key,
+    };
+    return { volume, mount, file };
+};
+exports.secretFileMount = secretFileMount;
 const env = (name, value) => ({ name, value });
 exports.env = env;
 /** OpenCode health probe with basic auth, evaluated inside the container. */

package/dist/k8s/index.js

@@ -20,9 +20,10 @@ exports.plugin = {
         'generation-token',
         'analytica-token',
         'opencode-password',
+        'opencode-auth',
         'image-api-key',
     ],
-    requiredImages: ['ag-ai-runner', 'ag-ai-opencode', 'ag-ai-t3code'],
+    requiredImages: ['ag-ai-runner', 'ag-ai-opencode', 'ag-ai-t3code', 'ag-ai-firewall'],
     stacks: (context) => [
         (0, opencode_1.opencodeStack)(context),
         (0, runner_1.runnerStack)(context),

package/dist/k8s/opencode.js

@@ -21,6 +21,8 @@ const opencodeStack = (context) => {
     (0, common_1.stripClusterScopedNamespaces)(stack);
     const password = context.secret('opencode-password');
     const credentials = (0, common_1.secretMount)('opencode-password', password);
+    // Provider credentials live in OpenCode's auth.json under XDG_DATA_HOME.
+    const auth = (0, common_1.secretFileMount)('opencode-auth', context.secret('opencode-auth'), '/data/opencode/data/opencode/auth.json');
     const probe = (0, common_1.openCodeHealthProbe)(common_1.OPENCODE_PORT);
     const container = {
         name: 'opencode',
@@ -45,6 +47,7 @@ const opencodeStack = (context) => {
         volumeMounts: [
             ...dataMounts,
             credentials.mount,
+            auth.mount,
             { name: 'opencode', mountPath: OPENCODE_PREFIX, readOnly: true },
             { name: 'tmp', mountPath: '/tmp' },
         ],
@@ -73,6 +76,7 @@ const opencodeStack = (context) => {
         volumes: [
             dataVolume,
             credentials.volume,
+            auth.volume,
             { name: 'opencode', emptyDir: { sizeLimit: '1Gi' } },
             { name: 'tmp', emptyDir: { sizeLimit: '1Gi' } },
         ],

package/dist/k8s/runner.js

@@ -147,7 +147,7 @@ const runnerStack = (context) => {
     pod.initContainers = [
         {
             name: 'restrict-network',
-            image: facilities.image('dockerAlpine'),
+            image: facilities.image('ag-ai-firewall'),
             command: ['/bin/sh', '/etc/ag-ai/network-init.sh'],
             volumeMounts: [{ name: scriptMount.name, mountPath: scriptMount.mountPath, readOnly: true }],
             securityContext: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ag-ai",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "Provider-neutral AI client and cluster runtime for the rpi-mega cluster.",
   "license": "ISC",
   "author": "admin@gec.dev",