ag-ai 0.2.0 → 0.2.1

package/dist/k8s/common.d.ts

@@ -30,8 +30,8 @@ export declare const secretMount: (name: string, reference: SecretReference) =>
  */
 export declare const secretFileMount: (name: string, reference: SecretReference, file: string) => SecretMount;
 export declare const env: (name: string, value: string) => V1EnvVar;
-/** OpenCode health probe with basic auth, evaluated inside the container. */
-export declare const openCodeHealthProbe: (port: number) => {
+/** Readiness must consume the model response, not just see a listening HTTP server. */
+export declare const openCodeHealthProbe: (port: number, target?: 'health' | 'models') => {
     exec: {
         command: string[];
     };

package/dist/k8s/common.js

@@ -63,16 +63,16 @@ const secretFileMount = (name, reference, file) => {
 exports.secretFileMount = secretFileMount;
 const env = (name, value) => ({ name, value });
 exports.env = env;
-/** OpenCode health probe with basic auth, evaluated inside the container. */
-const openCodeHealthProbe = (port) => ({
+/** Readiness must consume the model response, not just see a listening HTTP server. */
+const openCodeHealthProbe = (port, target = 'health') => ({
     exec: {
         command: [
             'node',
             '-e',
-            `fetch('http://127.0.0.1:${port}/global/health',{headers:{authorization:'Basic '+Buffer.from('opencode:'+(process.env.OPENCODE_SERVER_PASSWORD??'')).toString('base64')}}).then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))`,
+            `fetch('http://127.0.0.1:${port}/${target === 'models' ? 'provider' : 'global/health'}',{signal:AbortSignal.timeout(3000),headers:{authorization:'Basic '+Buffer.from('opencode:'+(process.env.OPENCODE_SERVER_PASSWORD??'')).toString('base64')}}).then(async r=>{if(!r.ok){process.exit(1);return;}const data=await r.json();process.exit(${target === 'models' ? 'Array.isArray(data.connected)&&data.connected.length>0' : 'data.healthy===true'}?0:1);}).catch(()=>process.exit(1))`,
         ],
     },
-    timeoutSeconds: 5,
+    timeoutSeconds: 3,
     periodSeconds: 10,
 });
 exports.openCodeHealthProbe = openCodeHealthProbe;

package/dist/k8s/opencode.js

@@ -7,6 +7,8 @@ const common_1 = require("./common");
 const OPENCODE_PACKAGE = 'opencode-ai@1.18.31';
 const OPENCODE_PREFIX = '/opt/opencode';
 const OPENCODE_BIN = `${OPENCODE_PREFIX}/node_modules/.bin/opencode`;
+const OPENCODE_AUTH_PATH = '/data/opencode/data/opencode/auth.json';
+const OPENCODE_AUTH_SEED = '/var/run/secrets/ag-ai/opencode-auth/auth.json';
 /** OpenCode server: durable state, basic auth from a mounted Secret, ClusterIP only. */
 const opencodeStack = (context) => {
     const { facilities } = context;
@@ -21,8 +23,8 @@ const opencodeStack = (context) => {
     (0, common_1.stripClusterScopedNamespaces)(stack);
     const password = context.secret('opencode-password');
     const credentials = (0, common_1.secretMount)('opencode-password', password);
-    // Provider credentials live in OpenCode's auth.json under XDG_DATA_HOME.
-    const auth = (0, common_1.secretFileMount)('opencode-auth', context.secret('opencode-auth'), '/data/opencode/data/opencode/auth.json');
+    // Seed only: OAuth credentials must remain writable for login and token refresh.
+    const auth = (0, common_1.secretFileMount)('opencode-auth', context.secret('opencode-auth'), OPENCODE_AUTH_SEED);
     const probe = (0, common_1.openCodeHealthProbe)(common_1.OPENCODE_PORT);
     const container = {
         name: 'opencode',
@@ -36,9 +38,12 @@ const opencodeStack = (context) => {
             (0, common_1.env)('XDG_DATA_HOME', '/data/opencode/data'),
             (0, common_1.env)('XDG_CONFIG_HOME', '/data/opencode/config'),
             (0, common_1.env)('XDG_CACHE_HOME', '/data/opencode/cache'),
+            // The unrestricted /provider response processes thousands of models from
+            // unconfigured providers on every request, exceeding the runner's budget.
+            (0, common_1.env)('OPENCODE_CONFIG_CONTENT', JSON.stringify({ enabled_providers: ['openai', 'google'] })),
         ],
         startupProbe: { ...probe, failureThreshold: 30 },
-        readinessProbe: { ...probe, initialDelaySeconds: 5 },
+        readinessProbe: { ...(0, common_1.openCodeHealthProbe)(common_1.OPENCODE_PORT, 'models'), initialDelaySeconds: 5 },
         livenessProbe: { ...probe, initialDelaySeconds: 15, periodSeconds: 30 },
         resources: {
             requests: { cpu: '50m', memory: '256Mi' },
@@ -47,7 +52,6 @@ const opencodeStack = (context) => {
         volumeMounts: [
             ...dataMounts,
             credentials.mount,
-            auth.mount,
             { name: 'opencode', mountPath: OPENCODE_PREFIX, readOnly: true },
             { name: 'tmp', mountPath: '/tmp' },
         ],
@@ -72,7 +76,32 @@ const opencodeStack = (context) => {
     const deployment = stack.addDeployment({
         name: 'server',
         containers: [container],
-        initContainers: [installer],
+        initContainers: [
+            installer,
+            {
+                name: 'initialize-opencode-auth',
+                image: facilities.image('ag-ai-opencode'),
+                command: [
+                    'node',
+                    '-e',
+                    [
+                        "const fs = require('node:fs');",
+                        `const target = '${OPENCODE_AUTH_PATH}';`,
+                        "fs.mkdirSync(require('node:path').dirname(target), { recursive: true, mode: 0o700 });",
+                        `try { fs.copyFileSync('${OPENCODE_AUTH_SEED}', target, fs.constants.COPYFILE_EXCL); }`,
+                        "catch (error) { if (error.code !== 'EEXIST') throw error; }",
+                        // Kubernetes leaves an empty mount-point file behind when migrating off subPath.
+                        `if (fs.statSync(target).size === 0) fs.copyFileSync('${OPENCODE_AUTH_SEED}', target);`,
+                        'fs.chmodSync(target, 0o600);',
+                    ].join('\n'),
+                ],
+                volumeMounts: [...dataMounts, auth.mount],
+                resources: {
+                    requests: { cpu: '50m', memory: '64Mi' },
+                    limits: { cpu: '100m', memory: '128Mi' },
+                },
+            },
+        ],
         volumes: [
             dataVolume,
             credentials.volume,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ag-ai",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Provider-neutral AI client and cluster runtime for the rpi-mega cluster.",
   "license": "ISC",
   "author": "admin@gec.dev",