ag-ai 0.3.2 → 0.3.4

package/README.md

@@ -55,6 +55,13 @@ the actual selected model and provider (`google` or `cluster`). Cluster
 network operations and retry waits for this fallback are individually capped
 at 3000 ms; model generation time is not included in that cap.
 
+Quota (429) and capacity (5xx) failures only put a model/key on a short
+cooldown (60 s doubling to 15 min, or the provider's retry delay). Models that
+return 404 are hidden for an hour. Without a fallback, a request whose whole
+pool is cooling down waits for the soonest model to recover and retries, at
+most `MAX_COOLDOWN_WAITS` times and never past the request timeout; with a
+fallback it falls back immediately instead.
+
 ## Tooling
 
 Formatting and linting use `e7-oxfmt` / `e7-oxlint` from

package/dist/client/adapters/google.d.ts

@@ -4,14 +4,24 @@ import type { AIClientDependencies, AIModel, AIRequest, GenerationResult } from
 export type GoogleAdapterConfig = {
     dependencies?: AIClientDependencies;
     createAI?: (apiKey: string) => GoogleGenAI;
+    /**
+     * Wait out the soonest model/key cooldown and retry when the whole pool is
+     * cooling down, instead of failing fast. Bounded by the request timeout.
+     */
+    waitForCooldown?: boolean;
 };
+/** Upper bound on cooldown waits per request, so a pool that never recovers still fails. */
+export declare const MAX_COOLDOWN_WAITS = 5;
 /** Every eligible Gemini combination was exhausted by quota/capacity or cooldown. */
 export declare class GeminiPoolExhaustedError extends Error {
     readonly causes: readonly unknown[];
     readonly models: readonly string[];
+    /** Time until the soonest cooling model/key becomes eligible again, when known. */
+    readonly retryAfterMs: number | undefined;
     constructor(options?: {
         causes?: readonly unknown[];
         models?: readonly string[];
+        retryAfterMs?: number;
     });
 }
 export declare const generateGoogle: (request: AIRequest, config?: GoogleAdapterConfig) => Promise<GenerationResult>;

package/dist/client/adapters/google.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.resetGoogleAdapterForTests = exports.resetModelBackoff = exports.listGoogleModels = exports.generateGoogle = exports.GeminiPoolExhaustedError = void 0;
+exports.resetGoogleAdapterForTests = exports.resetModelBackoff = exports.listGoogleModels = exports.generateGoogle = exports.GeminiPoolExhaustedError = exports.MAX_COOLDOWN_WAITS = void 0;
 const genai_1 = require("@google/genai");
 const apikey_1 = require("../../internal/apikey");
 const log_1 = require("../../internal/log");
@@ -25,15 +25,20 @@ const NON_TEXT_MODEL_CAPABILITIES = [
     'robotics',
     'tts',
 ];
+/** Upper bound on cooldown waits per request, so a pool that never recovers still fails. */
+exports.MAX_COOLDOWN_WAITS = 5;
 /** Every eligible Gemini combination was exhausted by quota/capacity or cooldown. */
 class GeminiPoolExhaustedError extends Error {
     causes;
     models;
+    /** Time until the soonest cooling model/key becomes eligible again, when known. */
+    retryAfterMs;
     constructor(options = {}) {
         super('Gemini model pool exhausted; all eligible combinations are unavailable');
         this.name = 'GeminiPoolExhaustedError';
         this.causes = options.causes ?? [];
         this.models = options.models ?? [];
+        this.retryAfterMs = options.retryAfterMs;
     }
 }
 exports.GeminiPoolExhaustedError = GeminiPoolExhaustedError;
@@ -212,6 +217,17 @@ const getClients = (createAI = (apiKey) => new genai_1.GoogleGenAI({ apiKey }))
         return ai === undefined ? [] : [[key, ai]];
     });
 };
+const isKeyServiceAvailable = (key, model) => (0, apikey_1.getAvailableCombinations)(`gemini-${model}`, false).some((entry) => entry.key === key);
+/** Soonest remaining model/key cooldown across combinations, or undefined when none cool. */
+const soonestCooldownMs = (combinations, nowMs) => {
+    let soonest;
+    for (const [key, , model] of combinations) {
+        const remainingMs = (0, quota_1.modelKeyBackoffRemainingMs)(model, key, nowMs);
+        if (remainingMs > 0 && (soonest === undefined || remainingMs < soonest))
+            soonest = remainingMs;
+    }
+    return soonest;
+};
 const getCombinations = async (model, prefer, output, signal, config) => {
     const clients = getClients(config.createAI);
     const requiresNonTextModel = (output ?? ['text']).some((modality) => modality !== 'text');
@@ -223,28 +239,14 @@ const getCombinations = async (model, prefer, output, signal, config) => {
         : sortModelsByPreference((await getAvailableGeminiModels(config.dependencies, signal)).filter(isTextGenerationModel), prefer);
     if (models.length === 0)
         throw new Error('No text generation models are available');
-    const combinations = [];
-    let cooldownOnly = false;
-    let nonCooldownBlock = false;
-    for (const [key, ai] of clients) {
-        for (const selectedModel of models) {
-            const service = `gemini-${selectedModel}`;
-            const status = (0, quota_1.getModelKeyBackoffStatus)(selectedModel, key, config.dependencies?.now?.() ?? Date.now());
-            if (status === 'expired')
-                (0, apikey_1.clearKeyServiceBlock)(key, service);
-            const available = (0, apikey_1.getAvailableCombinations)(service, false);
-            if (available.some((entry) => entry.key === key)) {
-                combinations.push([key, ai, selectedModel]);
-            }
-            else if (status === 'active') {
-                cooldownOnly = true;
-            }
-            else {
-                nonCooldownBlock = true;
-            }
-        }
-    }
-    return { combinations, models, cooldownOnly: cooldownOnly && !nonCooldownBlock, nonCooldownBlock };
+    const nowMs = config.dependencies?.now?.() ?? Date.now();
+    // Unavailable (404) models stay blocklisted; quota/capacity failures only
+    // cool down briefly, so they are tracked separately and never hidden longer.
+    const candidates = clients.flatMap(([key, ai]) => models
+        .filter((selectedModel) => isKeyServiceAvailable(key, selectedModel))
+        .map((selectedModel) => [key, ai, selectedModel]));
+    const combinations = candidates.filter(([key, , selectedModel]) => !(0, quota_1.isModelKeyBackedOff)(selectedModel, key, nowMs));
+    return { combinations, models, cooldownRemainingMs: soonestCooldownMs(candidates, nowMs) };
 };
 const mediaType = (mimeType) => {
     const normalized = mimeType.toLowerCase();
@@ -402,38 +404,36 @@ const generateGoogle = async (request, config = {}) => {
             ((ms) => new Promise((resolve) => {
                 setTimeout(resolve, ms);
             }));
-        const result = await (0, retryOnError_1.retryOnError)(`generation:${request.ident ?? 'unknown'}`, async () => {
+        const now = () => config.dependencies?.now?.() ?? Date.now();
+        const startedAtMs = now();
+        const attemptPool = (initialDelayMs) => (0, retryOnError_1.retryOnError)(`generation:${request.ident ?? 'unknown'}`, async () => {
             const combinationSet = await getCombinations(request.model, request.prefer, request.output, controller.signal, config);
             const combinations = combinationSet.combinations;
             if (combinations.length === 0) {
-                if (combinationSet.cooldownOnly) {
+                if (combinationSet.cooldownRemainingMs !== undefined) {
                     throw new GeminiPoolExhaustedError({
                         models: combinationSet.models,
+                        retryAfterMs: combinationSet.cooldownRemainingMs,
                     });
                 }
                 throw new Error('No available model for this request');
             }
             let lastFailure;
+            let unavailableFailure;
             const exhaustionCauses = [];
             const exhaustedModels = new Set();
-            let attemptedCombination = false;
-            let nonExhaustionFailure;
-            let skippedForNonCooldown = false;
             for (const [key, ai, selectedModel] of combinations) {
-                const service = `gemini-${selectedModel}`;
-                const nowMs = config.dependencies?.now?.() ?? Date.now();
-                const keyBackoffStatus = (0, quota_1.getModelKeyBackoffStatus)(selectedModel, key, nowMs);
-                if (keyBackoffStatus === 'active') {
+                // Concurrent requests may have cooled or retired this combination
+                // since the pool snapshot was taken.
+                const nowMs = now();
+                if ((0, quota_1.isModelKeyBackedOff)(selectedModel, key, nowMs)) {
                     (0, log_1.debug)(`[${selectedModel}] skipping rate-limited model/key`, {
                         remainingMs: (0, quota_1.modelKeyBackoffRemainingMs)(selectedModel, key, nowMs),
                     });
                     continue;
                 }
-                if (!(0, apikey_1.getAvailableCombinations)(service, false).some((entry) => entry.key === key)) {
-                    skippedForNonCooldown = true;
+                if (!isKeyServiceAvailable(key, selectedModel))
                     continue;
-                }
-                attemptedCombination = true;
                 const selectedRequest = {
                     ...requestConfig,
                     model: selectedModel,
@@ -446,7 +446,7 @@ const generateGoogle = async (request, config = {}) => {
                     const result = {
                         output: responseOutput(response),
                         model: response.modelVersion || selectedModel,
-                        generatedAt: config.dependencies?.now?.() ?? Date.now(),
+                        generatedAt: now(),
                         ...(usage === undefined ? {} : { usage }),
                     };
                     (0, log_1.debug)(`[${result.model}] generation completed`, request.ident);
@@ -460,53 +460,68 @@ const generateGoogle = async (request, config = {}) => {
                     const rateLimited = failureStatus === 429 || (0, retryOnError_1.isOverloadedApiKeyError)(error);
                     const overloadedModel = failureStatus === 503 || failureStatus === 500 || failureStatus === 502;
                     const unavailableModel = failureStatus === 404 && message.includes(selectedModel);
-                    // Fallback only; per-model backoff below is keyed by rate limiting.
-                    if (rateLimited || overloadedModel || unavailableModel) {
-                        (0, log_1.debug)(`[${selectedModel}] generation attempt failed; trying next available combination`, {
-                            status: failureStatus,
-                        });
+                    if (!rateLimited && !overloadedModel && !unavailableModel)
+                        throw error;
+                    (0, log_1.debug)(`[${selectedModel}] generation attempt failed; trying next available combination`, { status: failureStatus });
+                    lastFailure = error;
+                    if (unavailableModel) {
+                        // Retired/unknown models will not recover soon: hide them for the blocklist window.
                         (0, apikey_1.blockKeyService)(key, `gemini-${selectedModel}`);
-                        if (rateLimited || overloadedModel) {
-                            (0, quota_1.recordModelKeyRateLimit)(selectedModel, key, {
-                                cause: error,
-                                nowMs: config.dependencies?.now?.(),
-                            });
-                        }
-                        if (unavailableModel)
-                            nonExhaustionFailure = error;
-                        if (rateLimited || overloadedModel)
-                            exhaustionCauses.push(error);
-                        if (!unavailableModel)
-                            exhaustedModels.add(selectedModel);
-                        lastFailure = error;
+                        unavailableFailure = error;
                         continue;
                     }
-                    throw error;
+                    // Quota and capacity failures are transient: cool down briefly, never blocklist.
+                    (0, quota_1.recordModelKeyRateLimit)(selectedModel, key, { cause: error, nowMs: now() });
+                    exhaustionCauses.push(error);
+                    exhaustedModels.add(selectedModel);
                 }
             }
-            if (nonExhaustionFailure !== undefined)
-                throw nonExhaustionFailure;
-            if (skippedForNonCooldown || combinationSet.nonCooldownBlock) {
-                throw new Error('No available model for this request');
-            }
-            if (!attemptedCombination || exhaustionCauses.length > 0) {
+            const retryAfterMs = soonestCooldownMs(combinations, now());
+            if (exhaustionCauses.length > 0 || retryAfterMs !== undefined) {
                 throw new GeminiPoolExhaustedError({
                     causes: exhaustionCauses,
                     models: [...exhaustedModels],
+                    retryAfterMs,
                 });
             }
-            throw lastFailure ?? new Error('No available model for this request');
+            throw (unavailableFailure ?? lastFailure ?? new Error('No available model for this request'));
         }, {
             retries: 1,
             errorDelay: 5000,
-            initialDelayMs: staggerMs,
+            initialDelayMs,
             signal: controller.signal,
             sleepFn: async (ms) => {
                 await sleep(ms);
             },
             errorCheck: (error) => !(error instanceof GeminiPoolExhaustedError) && (0, retryOnError_1.isRetryableApiError)(error),
         });
-        return result;
+        for (let cooldownWaits = 0;; cooldownWaits++) {
+            // Awaited into a binding (not `return await`) so the lint autofix cannot
+            // strip the await and let the rejection escape this cooldown handler.
+            let result;
+            try {
+                // oxlint-disable-next-line no-await-in-loop -- cooldown waits are sequential by design
+                result = await attemptPool(cooldownWaits === 0 ? staggerMs : 0);
+            }
+            catch (error) {
+                const retryAfterMs = error instanceof GeminiPoolExhaustedError ? error.retryAfterMs : undefined;
+                const remainingBudgetMs = timeoutMs - (now() - startedAtMs);
+                if (config.waitForCooldown !== true ||
+                    retryAfterMs === undefined ||
+                    cooldownWaits >= exports.MAX_COOLDOWN_WAITS ||
+                    retryAfterMs >= remainingBudgetMs) {
+                    throw error;
+                }
+                (0, log_1.info)('Gemini pool cooling down; waiting for the soonest model to recover', {
+                    ident: request.ident,
+                    retryAfterMs,
+                });
+                // oxlint-disable-next-line no-await-in-loop -- cooldown waits are sequential by design
+                await awaitWithSignal(sleep(retryAfterMs), controller.signal);
+                continue;
+            }
+            return result;
+        }
     }
     catch (error) {
         if (controller.signal.aborted) {

package/dist/client/client.js

@@ -141,7 +141,11 @@ const createAIClient = (defaults = {}) => {
         let provider;
         if (merged.endpoint === undefined) {
             try {
-                result = await (0, google_1.generateGoogle)(merged, { dependencies });
+                // Without a fallback, waiting out a short Gemini cooldown beats failing the request.
+                result = await (0, google_1.generateGoogle)(merged, {
+                    dependencies,
+                    waitForCooldown: defaults.fallback === undefined,
+                });
                 provider = 'google';
             }
             catch (error) {

package/dist/internal/apikey.d.ts

@@ -3,5 +3,3 @@ export declare const getAvailableCombinations: (service: string, resetIfExhauste
     key: string;
 }[];
 export declare const blockKeyService: (apiKey: string, service: string) => void;
-/** Remove only one key+service block, preserving every unrelated blocklist entry. */
-export declare const clearKeyServiceBlock: (apiKey: string, service: string) => void;

package/dist/internal/apikey.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.clearKeyServiceBlock = exports.blockKeyService = exports.getAvailableCombinations = void 0;
+exports.blockKeyService = exports.getAvailableCombinations = void 0;
 const array_1 = require("./array");
 const log_1 = require("./log");
 const node_cache_1 = require("./node-cache");
@@ -49,8 +49,3 @@ const blockKeyService = (apiKey, service) => {
     addToBlocklist(apiKey, service);
 };
 exports.blockKeyService = blockKeyService;
-/** Remove only one key+service block, preserving every unrelated blocklist entry. */
-const clearKeyServiceBlock = (apiKey, service) => {
-    blocklist.del(getBlocklistKey(apiKey, service));
-};
-exports.clearKeyServiceBlock = clearKeyServiceBlock;

package/dist/k8s/common.d.ts

@@ -1,5 +1,5 @@
 import type { V1EnvVar, V1Volume, V1VolumeMount } from '@kubernetes/client-node';
-import type { ClusterFacilities, IStack, SecretReference } from 'ag-rpi-mega';
+import type { ClusterFacilities, ClusterPluginContext, IStack, SecretReference } from 'ag-rpi-mega';
 /** The plugin owns its identity; addresses, hosts, and secrets come from the host. */
 export declare const NAMESPACE = "ag-ai";
 export declare const OPENCODE_APP = "ag-ai-opencode";
@@ -30,6 +30,38 @@ export declare const secretMount: (name: string, reference: SecretReference) =>
  */
 export declare const secretFileMount: (name: string, reference: SecretReference, file: string) => SecretMount;
 export declare const env: (name: string, value: string) => V1EnvVar;
+/** A GitHub owner whose repositories authenticate with a dedicated token. */
+export interface GitToken {
+    owner: string;
+    tokenFile: string;
+}
+/**
+ * Git credentials and identity for the agent pods, expressed entirely as
+ * `GIT_CONFIG_*` environment variables so no writable `$HOME`/`.gitconfig` is
+ * needed: the pods run as uid 65534 with a read-only root filesystem and, for
+ * t3code, an unwritable `$HOME`.
+ *
+ * A single credential helper dispatches on the requested repository path.
+ * Multiple accounts on github.com cannot be separated by `credential.<url>`
+ * subsections, because git accumulates helpers across URL scopes and a
+ * host-level helper wins before an owner-scoped one; instead the helper reads
+ * the `path=` line git sends (which requires `credential.useHttpPath=true`) and
+ * picks the token whose `owner` matches. `defaultTokenFile` backs every other
+ * github.com path. The `url.*.insteadOf` rewrites make existing
+ * `git@github.com:` and `ssh://git@github.com/` remotes resolve over HTTPS, so
+ * the owner selection applies regardless of the scheme a repo was cloned with.
+ */
+export declare const gitConfigEnv: ({ name, email, defaultTokenFile, ownerTokens, }: {
+    name: string;
+    email: string;
+    defaultTokenFile: string;
+    ownerTokens?: readonly GitToken[];
+}) => V1EnvVar[];
+/** The commit identity the host injects; declared in `requiredEnv`. */
+export declare const gitIdentity: (context: ClusterPluginContext) => {
+    name: string;
+    email: string;
+};
 /** Readiness must consume the model response, not just see a listening HTTP server. */
 export declare const openCodeHealthProbe: (port: number, target?: 'health' | 'models') => {
     exec: {

package/dist/k8s/common.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.openCodeHealthProbe = exports.env = exports.secretFileMount = exports.secretMount = exports.stripClusterScopedNamespaces = exports.serviceUrl = exports.resourceName = exports.METAL_LB_KEY = exports.T3_SERVICE = exports.RUNNER_SERVICE = exports.OPENCODE_SERVICE = exports.T3_PORT = exports.GENERATION_PORT = exports.OPENCODE_PORT = exports.T3CODE_APP = exports.RUNNER_APP = exports.OPENCODE_APP = exports.NAMESPACE = void 0;
+exports.openCodeHealthProbe = exports.gitIdentity = exports.gitConfigEnv = exports.env = exports.secretFileMount = exports.secretMount = exports.stripClusterScopedNamespaces = exports.serviceUrl = exports.resourceName = exports.METAL_LB_KEY = exports.T3_SERVICE = exports.RUNNER_SERVICE = exports.OPENCODE_SERVICE = exports.T3_PORT = exports.GENERATION_PORT = exports.OPENCODE_PORT = exports.T3CODE_APP = exports.RUNNER_APP = exports.OPENCODE_APP = exports.NAMESPACE = void 0;
 const ag_rpi_mega_1 = require("ag-rpi-mega");
 /** The plugin owns its identity; addresses, hosts, and secrets come from the host. */
 exports.NAMESPACE = 'ag-ai';
@@ -63,6 +63,57 @@ const secretFileMount = (name, reference, file) => {
 exports.secretFileMount = secretFileMount;
 const env = (name, value) => ({ name, value });
 exports.env = env;
+/**
+ * Git credentials and identity for the agent pods, expressed entirely as
+ * `GIT_CONFIG_*` environment variables so no writable `$HOME`/`.gitconfig` is
+ * needed: the pods run as uid 65534 with a read-only root filesystem and, for
+ * t3code, an unwritable `$HOME`.
+ *
+ * A single credential helper dispatches on the requested repository path.
+ * Multiple accounts on github.com cannot be separated by `credential.<url>`
+ * subsections, because git accumulates helpers across URL scopes and a
+ * host-level helper wins before an owner-scoped one; instead the helper reads
+ * the `path=` line git sends (which requires `credential.useHttpPath=true`) and
+ * picks the token whose `owner` matches. `defaultTokenFile` backs every other
+ * github.com path. The `url.*.insteadOf` rewrites make existing
+ * `git@github.com:` and `ssh://git@github.com/` remotes resolve over HTTPS, so
+ * the owner selection applies regardless of the scheme a repo was cloned with.
+ */
+const gitConfigEnv = ({ name, email, defaultTokenFile, ownerTokens = [], }) => {
+    const arms = ownerTokens
+        .map((token) => `${token.owner}/*) tokenFile=${token.tokenFile} ;;`)
+        .join(' ');
+    const helper = '!f() { path=; while IFS= read -r line; do case "$line" in path=*) path=${line#path=} ;; esac; done; ' +
+        `case "$path" in ${arms} *) tokenFile=${defaultTokenFile} ;; esac; ` +
+        'echo username=x-access-token; echo "password=$(cat "$tokenFile")"; }; f';
+    const entries = [
+        ['credential.https://github.com.helper', helper],
+        ['credential.useHttpPath', 'true'],
+        ['url.https://github.com/.insteadOf', 'git@github.com:'],
+        ['url.https://github.com/.insteadOf', 'ssh://git@github.com/'],
+        ['user.name', name],
+        ['user.email', email],
+    ];
+    return [
+        (0, exports.env)('GIT_CONFIG_COUNT', String(entries.length)),
+        ...entries.flatMap(([key, value], index) => [
+            (0, exports.env)(`GIT_CONFIG_KEY_${index}`, key),
+            (0, exports.env)(`GIT_CONFIG_VALUE_${index}`, value),
+        ]),
+    ];
+};
+exports.gitConfigEnv = gitConfigEnv;
+/** The commit identity the host injects; declared in `requiredEnv`. */
+const gitIdentity = (context) => {
+    const name = context.env.AG_AI_GIT_NAME;
+    if (!name)
+        throw new Error('AG_AI_GIT_NAME is required');
+    const email = context.env.AG_AI_GIT_EMAIL;
+    if (!email)
+        throw new Error('AG_AI_GIT_EMAIL is required');
+    return { name, email };
+};
+exports.gitIdentity = gitIdentity;
 /** Readiness must consume the model response, not just see a listening HTTP server. */
 const openCodeHealthProbe = (port, target = 'health') => ({
     exec: {

package/dist/k8s/index.js

@@ -14,7 +14,14 @@ const t3code_1 = require("./t3code");
 exports.plugin = {
     name: 'ag-ai',
     namespace: common_1.NAMESPACE,
-    requiredEnv: ['AG_AI_QUEUE_URL', 'AG_AI_GENERATION_CIDR', 'AG_AI_PACKAGE'],
+    requiredEnv: [
+        'AG_AI_QUEUE_URL',
+        'AG_AI_GENERATION_CIDR',
+        'AG_AI_PACKAGE',
+        'AG_AI_GIT_NAME',
+        'AG_AI_GIT_EMAIL',
+        'AG_AI_GIT_OWNER_2',
+    ],
     requiredSecrets: [
         'runner-token',
         'generation-token',
@@ -22,6 +29,8 @@ exports.plugin = {
         'opencode-password',
         'opencode-auth',
         'image-api-key',
+        'git-token',
+        'git-token-2',
     ],
     requiredImages: ['ag-ai-runner', 'ag-ai-opencode', 'ag-ai-t3code', 'ag-ai-firewall'],
     stacks: (context) => [

package/dist/k8s/opencode.js

@@ -25,6 +25,15 @@ const opencodeStack = (context) => {
     const credentials = (0, common_1.secretMount)('opencode-password', password);
     // Seed only: OAuth credentials must remain writable for login and token refresh.
     const auth = (0, common_1.secretFileMount)('opencode-auth', context.secret('opencode-auth'), OPENCODE_AUTH_SEED);
+    // GitHub read/write for the agent's git and `gh` operations. `git-token` is
+    // the fallback for any github.com owner; `git-token-2` is scoped to the owner
+    // in AG_AI_GIT_OWNER_2 (a separate GitHub account).
+    const gitToken = (0, common_1.secretMount)('git-token', context.secret('git-token'));
+    const gitToken2 = (0, common_1.secretMount)('git-token-2', context.secret('git-token-2'));
+    const gitUser = (0, common_1.gitIdentity)(context);
+    const gitOwner2 = context.env.AG_AI_GIT_OWNER_2;
+    if (!gitOwner2)
+        throw new Error('AG_AI_GIT_OWNER_2 is required');
     const probe = (0, common_1.openCodeHealthProbe)(common_1.OPENCODE_PORT);
     const container = {
         name: 'opencode',
@@ -56,6 +65,12 @@ const opencodeStack = (context) => {
                     },
                 },
             })),
+            ...(0, common_1.gitConfigEnv)({
+                name: gitUser.name,
+                email: gitUser.email,
+                defaultTokenFile: gitToken.file,
+                ownerTokens: [{ owner: gitOwner2, tokenFile: gitToken2.file }],
+            }),
         ],
         startupProbe: { ...probe, failureThreshold: 30 },
         readinessProbe: { ...(0, common_1.openCodeHealthProbe)(common_1.OPENCODE_PORT, 'models'), initialDelaySeconds: 5 },
@@ -67,6 +82,8 @@ const opencodeStack = (context) => {
         volumeMounts: [
             ...dataMounts,
             credentials.mount,
+            gitToken.mount,
+            gitToken2.mount,
             { name: 'opencode', mountPath: OPENCODE_PREFIX, readOnly: true },
             { name: 'tmp', mountPath: '/tmp' },
         ],
@@ -120,6 +137,8 @@ const opencodeStack = (context) => {
         volumes: [
             dataVolume,
             credentials.volume,
+            gitToken.volume,
+            gitToken2.volume,
             auth.volume,
             { name: 'opencode', emptyDir: { sizeLimit: '1Gi' } },
             { name: 'tmp', emptyDir: { sizeLimit: '1Gi' } },

package/dist/k8s/t3code.js

@@ -22,6 +22,15 @@ const t3codeStack = (context) => {
     const opencodePassword = context.secret('opencode-password');
     const credentials = (0, common_1.secretMount)('opencode-password', opencodePassword);
     const opencodeUrl = (0, common_1.serviceUrl)(facilities, common_1.OPENCODE_APP, common_1.OPENCODE_SERVICE, common_1.OPENCODE_PORT);
+    // GitHub read/write for T3's own git operations (and any agent it drives).
+    // `git-token` is the fallback for any github.com owner; `git-token-2` is
+    // scoped to the owner in AG_AI_GIT_OWNER_2 (a separate GitHub account).
+    const gitToken = (0, common_1.secretMount)('git-token', context.secret('git-token'));
+    const gitToken2 = (0, common_1.secretMount)('git-token-2', context.secret('git-token-2'));
+    const gitUser = (0, common_1.gitIdentity)(context);
+    const gitOwner2 = context.env.AG_AI_GIT_OWNER_2;
+    if (!gitOwner2)
+        throw new Error('AG_AI_GIT_OWNER_2 is required');
     const container = {
         name: 't3code',
         image: facilities.image('ag-ai-t3code'),
@@ -44,6 +53,12 @@ const t3codeStack = (context) => {
             (0, ag_rpi_mega_1.secretEnv)('OPENCODE_SERVER_PASSWORD', opencodePassword),
             // T3 Connect is outbound-only; the server dials the relay, never the reverse.
             (0, common_1.env)('T3CODE_CONNECT', '1'),
+            ...(0, common_1.gitConfigEnv)({
+                name: gitUser.name,
+                email: gitUser.email,
+                defaultTokenFile: gitToken.file,
+                ownerTokens: [{ owner: gitOwner2, tokenFile: gitToken2.file }],
+            }),
         ],
         startupProbe: { tcpSocket: { port: common_1.T3_PORT }, failureThreshold: 30, periodSeconds: 10 },
         readinessProbe: { tcpSocket: { port: common_1.T3_PORT }, initialDelaySeconds: 5, periodSeconds: 10 },
@@ -59,6 +74,8 @@ const t3codeStack = (context) => {
         volumeMounts: [
             ...dataMounts,
             credentials.mount,
+            gitToken.mount,
+            gitToken2.mount,
             { name: 't3', mountPath: T3_PREFIX, readOnly: true },
             { name: 'tmp', mountPath: '/tmp' },
         ],
@@ -91,6 +108,8 @@ const t3codeStack = (context) => {
         volumes: [
             dataVolume,
             credentials.volume,
+            gitToken.volume,
+            gitToken2.volume,
             { name: 't3', emptyDir: { sizeLimit: '1Gi' } },
             { name: 'tmp', emptyDir: { sizeLimit: '256Mi' } },
         ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ag-ai",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "description": "Provider-neutral AI client and cluster runtime for the rpi-mega cluster.",
   "license": "ISC",
   "author": "admin@gec.dev",
@@ -53,7 +53,7 @@
     "typecheck": "tsc --noEmit",
     "build": "rimraf dist tsconfig.build.tsbuildinfo && tsc -p tsconfig.build.json && node scripts/copy-k8s-assets.mjs",
     "test": "pnpm run test:client && pnpm run test:runtime",
-    "test:client": "tsx --test \"src/tests/**/*.test.ts\"",
-    "test:runtime": "node --test \"runtime/tests/**/*.test.mjs\""
+    "test:client": "tsx --test --test-timeout=3000 --test-force-exit \"src/tests/**/*.test.ts\"",
+    "test:runtime": "node --test --test-timeout=3000 --test-force-exit \"runtime/tests/**/*.test.mjs\""
   }
 }