ag-ai 0.1.7 → 0.2.1

package/dist/client/adapters/google.js

@@ -390,8 +390,7 @@ const generateGoogle = async (request, config = {}) => {
                 // Reactive per-model backoff: a 429 skips the model until its window
                 // elapses while every other model keeps serving.
                 if ((0, quota_1.isModelBackedOff)(selectedModel)) {
-                    (0, log_1.debug)('skipping rate-limited model', {
-                        model: selectedModel,
+                    (0, log_1.debug)(`[${selectedModel}] skipping rate-limited model`, {
                         remainingMs: (0, quota_1.modelBackoffRemainingMs)(selectedModel),
                     });
                     continue;
@@ -400,7 +399,7 @@ const generateGoogle = async (request, config = {}) => {
                     ...requestConfig,
                     model: selectedModel,
                 };
-                (0, log_1.info)('generation request', { model: selectedModel, ident: request.ident });
+                (0, log_1.info)(`[${selectedModel}] generation request`, { ident: request.ident });
                 try {
                     // oxlint-disable-next-line no-await-in-loop -- model fallback is sequential by design
                     const response = await awaitWithSignal(ai.models.generateContent(selectedRequest), controller.signal);
@@ -411,7 +410,7 @@ const generateGoogle = async (request, config = {}) => {
                         generatedAt: config.dependencies?.now?.() ?? Date.now(),
                         ...(usage === undefined ? {} : { usage }),
                     };
-                    (0, log_1.debug)('generation completed', request.ident);
+                    (0, log_1.debug)(`[${result.model}] generation completed`, request.ident);
                     return result;
                 }
                 catch (error) {
@@ -424,8 +423,7 @@ const generateGoogle = async (request, config = {}) => {
                     const unavailableModel = failureStatus === 404 && message.includes(selectedModel);
                     // Fallback only; per-model backoff below is keyed by rate limiting.
                     if (rateLimited || overloadedModel || unavailableModel) {
-                        (0, log_1.warn)('generation attempt failed; trying next available combination', {
-                            model: selectedModel,
+                        (0, log_1.warn)(`[${selectedModel}] generation attempt failed; trying next available combination`, {
                             status: failureStatus,
                         });
                         (0, apikey_1.blockKeyService)(key, `gemini-${selectedModel}`);

package/dist/index.d.ts

@@ -1,2 +1,3 @@
 export * from './client';
 export * from './internal/apikey';
+export * from './internal/log';

package/dist/index.js

@@ -16,3 +16,4 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./client"), exports);
 __exportStar(require("./internal/apikey"), exports);
+__exportStar(require("./internal/log"), exports);

package/dist/internal/apikey.js

@@ -33,7 +33,7 @@ const getAvailableCombinations = (service, resetIfExhausted = true) => {
     }
     // If all combinations are blocklisted, clear the blocklist and try again
     if (combinations.length === 0 && resetIfExhausted) {
-        (0, log_1.warn)(`All API key + service combinations were blocklisted for ${service}. Clearing blocklist and trying again.`);
+        (0, log_1.warn)(`[${service}] all API key + service combinations were blocklisted; clearing blocklist and trying again.`);
         blocklist.flushAll();
         for (const key of keys) {
             combinations.push({ service, key });
@@ -45,7 +45,7 @@ const getAvailableCombinations = (service, resetIfExhausted = true) => {
 exports.getAvailableCombinations = getAvailableCombinations;
 // Block a key+service combination
 const blockKeyService = (apiKey, service) => {
-    (0, log_1.warn)(`key+service blocklisted for ${service}`);
+    (0, log_1.warn)(`[${service}] key+service blocklisted`);
     addToBlocklist(apiKey, service);
 };
 exports.blockKeyService = blockKeyService;

package/dist/k8s/common.d.ts

@@ -30,8 +30,8 @@ export declare const secretMount: (name: string, reference: SecretReference) =>
  */
 export declare const secretFileMount: (name: string, reference: SecretReference, file: string) => SecretMount;
 export declare const env: (name: string, value: string) => V1EnvVar;
-/** OpenCode health probe with basic auth, evaluated inside the container. */
-export declare const openCodeHealthProbe: (port: number) => {
+/** Readiness must consume the model response, not just see a listening HTTP server. */
+export declare const openCodeHealthProbe: (port: number, target?: 'health' | 'models') => {
     exec: {
         command: string[];
     };

package/dist/k8s/common.js

@@ -63,16 +63,16 @@ const secretFileMount = (name, reference, file) => {
 exports.secretFileMount = secretFileMount;
 const env = (name, value) => ({ name, value });
 exports.env = env;
-/** OpenCode health probe with basic auth, evaluated inside the container. */
-const openCodeHealthProbe = (port) => ({
+/** Readiness must consume the model response, not just see a listening HTTP server. */
+const openCodeHealthProbe = (port, target = 'health') => ({
     exec: {
         command: [
             'node',
             '-e',
-            `fetch('http://127.0.0.1:${port}/global/health',{headers:{authorization:'Basic '+Buffer.from('opencode:'+(process.env.OPENCODE_SERVER_PASSWORD??'')).toString('base64')}}).then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))`,
+            `fetch('http://127.0.0.1:${port}/${target === 'models' ? 'provider' : 'global/health'}',{signal:AbortSignal.timeout(3000),headers:{authorization:'Basic '+Buffer.from('opencode:'+(process.env.OPENCODE_SERVER_PASSWORD??'')).toString('base64')}}).then(async r=>{if(!r.ok){process.exit(1);return;}const data=await r.json();process.exit(${target === 'models' ? 'Array.isArray(data.connected)&&data.connected.length>0' : 'data.healthy===true'}?0:1);}).catch(()=>process.exit(1))`,
         ],
     },
-    timeoutSeconds: 5,
+    timeoutSeconds: 3,
     periodSeconds: 10,
 });
 exports.openCodeHealthProbe = openCodeHealthProbe;

package/dist/k8s/opencode.js

@@ -7,6 +7,8 @@ const common_1 = require("./common");
 const OPENCODE_PACKAGE = 'opencode-ai@1.18.31';
 const OPENCODE_PREFIX = '/opt/opencode';
 const OPENCODE_BIN = `${OPENCODE_PREFIX}/node_modules/.bin/opencode`;
+const OPENCODE_AUTH_PATH = '/data/opencode/data/opencode/auth.json';
+const OPENCODE_AUTH_SEED = '/var/run/secrets/ag-ai/opencode-auth/auth.json';
 /** OpenCode server: durable state, basic auth from a mounted Secret, ClusterIP only. */
 const opencodeStack = (context) => {
     const { facilities } = context;
@@ -21,8 +23,8 @@ const opencodeStack = (context) => {
     (0, common_1.stripClusterScopedNamespaces)(stack);
     const password = context.secret('opencode-password');
     const credentials = (0, common_1.secretMount)('opencode-password', password);
-    // Provider credentials live in OpenCode's auth.json under XDG_DATA_HOME.
-    const auth = (0, common_1.secretFileMount)('opencode-auth', context.secret('opencode-auth'), '/data/opencode/data/opencode/auth.json');
+    // Seed only: OAuth credentials must remain writable for login and token refresh.
+    const auth = (0, common_1.secretFileMount)('opencode-auth', context.secret('opencode-auth'), OPENCODE_AUTH_SEED);
     const probe = (0, common_1.openCodeHealthProbe)(common_1.OPENCODE_PORT);
     const container = {
         name: 'opencode',
@@ -36,9 +38,12 @@ const opencodeStack = (context) => {
             (0, common_1.env)('XDG_DATA_HOME', '/data/opencode/data'),
             (0, common_1.env)('XDG_CONFIG_HOME', '/data/opencode/config'),
             (0, common_1.env)('XDG_CACHE_HOME', '/data/opencode/cache'),
+            // The unrestricted /provider response processes thousands of models from
+            // unconfigured providers on every request, exceeding the runner's budget.
+            (0, common_1.env)('OPENCODE_CONFIG_CONTENT', JSON.stringify({ enabled_providers: ['openai', 'google'] })),
         ],
         startupProbe: { ...probe, failureThreshold: 30 },
-        readinessProbe: { ...probe, initialDelaySeconds: 5 },
+        readinessProbe: { ...(0, common_1.openCodeHealthProbe)(common_1.OPENCODE_PORT, 'models'), initialDelaySeconds: 5 },
         livenessProbe: { ...probe, initialDelaySeconds: 15, periodSeconds: 30 },
         resources: {
             requests: { cpu: '50m', memory: '256Mi' },
@@ -47,7 +52,6 @@ const opencodeStack = (context) => {
         volumeMounts: [
             ...dataMounts,
             credentials.mount,
-            auth.mount,
             { name: 'opencode', mountPath: OPENCODE_PREFIX, readOnly: true },
             { name: 'tmp', mountPath: '/tmp' },
         ],
@@ -72,7 +76,32 @@ const opencodeStack = (context) => {
     const deployment = stack.addDeployment({
         name: 'server',
         containers: [container],
-        initContainers: [installer],
+        initContainers: [
+            installer,
+            {
+                name: 'initialize-opencode-auth',
+                image: facilities.image('ag-ai-opencode'),
+                command: [
+                    'node',
+                    '-e',
+                    [
+                        "const fs = require('node:fs');",
+                        `const target = '${OPENCODE_AUTH_PATH}';`,
+                        "fs.mkdirSync(require('node:path').dirname(target), { recursive: true, mode: 0o700 });",
+                        `try { fs.copyFileSync('${OPENCODE_AUTH_SEED}', target, fs.constants.COPYFILE_EXCL); }`,
+                        "catch (error) { if (error.code !== 'EEXIST') throw error; }",
+                        // Kubernetes leaves an empty mount-point file behind when migrating off subPath.
+                        `if (fs.statSync(target).size === 0) fs.copyFileSync('${OPENCODE_AUTH_SEED}', target);`,
+                        'fs.chmodSync(target, 0o600);',
+                    ].join('\n'),
+                ],
+                volumeMounts: [...dataMounts, auth.mount],
+                resources: {
+                    requests: { cpu: '50m', memory: '64Mi' },
+                    limits: { cpu: '100m', memory: '128Mi' },
+                },
+            },
+        ],
         volumes: [
             dataVolume,
             credentials.volume,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ag-ai",
-  "version": "0.1.7",
+  "version": "0.2.1",
   "description": "Provider-neutral AI client and cluster runtime for the rpi-mega cluster.",
   "license": "ISC",
   "author": "admin@gec.dev",