ag-ai 0.4.4 → 0.4.5

package/dist/k8s/assets/network-init.sh

@@ -13,7 +13,7 @@ iptables-restore <<'RULES'
 :OUTPUT DROP [0:0]
 -A INPUT -i lo -j ACCEPT
 -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
--A INPUT -s __GENERATION_CIDR__ -p tcp --dport __GENERATION_PORT__ -j ACCEPT
+__GENERATION_INGRESS__
 -A OUTPUT -o lo -j ACCEPT
 -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
 __DNS_RULES__

package/dist/k8s/runner.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runnerStack = void 0;
 const node_fs_1 = require("node:fs");
+const node_net_1 = require("node:net");
 const node_path_1 = __importDefault(require("node:path"));
 const ag_rpi_mega_1 = require("ag-rpi-mega");
 const common_1 = require("./common");
@@ -12,12 +13,14 @@ const networkInitTemplate = (0, node_fs_1.readFileSync)(node_path_1.default.join
 /** The published runtime is installed into a writable emptyDir at pod start. */
 const AG_AI_RUNTIME_DIR = '/opt/ag-ai';
 const AG_AI_BRIDGE = `${AG_AI_RUNTIME_DIR}/node_modules/ag-ai/runtime/bridge.mjs`;
-const networkInitScript = ({ generationCidr, generationPort, opencodePort, }) => networkInitTemplate
-    .replaceAll('__GENERATION_CIDR__', generationCidr)
+const networkInitScript = ({ generationCidrs, generationPort, opencodePort, }) => networkInitTemplate
+    .replaceAll('__GENERATION_INGRESS__', generationCidrs
+    .map((cidr) => `-A INPUT -s ${cidr} -p tcp --dport ${generationPort} -j ACCEPT`)
+    .join('\n'))
     .replaceAll('__GENERATION_PORT__', String(generationPort))
     .replaceAll('__OPENCODE_PORT__', String(opencodePort))
     .replaceAll('__DNS_RULES__', '-A OUTPUT -p udp --dport 53 -j ACCEPT\n-A OUTPUT -p tcp --dport 53 -j ACCEPT')
-    .replaceAll('__GENERATION_REJECT__', `-A OUTPUT -d ${generationCidr} -j REJECT`);
+    .replaceAll('__GENERATION_REJECT__', generationCidrs.map((cidr) => `-A OUTPUT -d ${cidr} -j REJECT`).join('\n'));
 const healthProbe = (readiness) => ({
     exec: {
         command: [
@@ -38,6 +41,25 @@ const runnerStack = (context) => {
     const generationCidr = context.env.AG_AI_GENERATION_CIDR;
     if (!generationCidr)
         throw new Error('AG_AI_GENERATION_CIDR is required');
+    const clusterCidr = context.env.AG_AI_GENERATION_CLUSTER_CIDR;
+    const generationCidrs = [generationCidr, ...(clusterCidr ? [clusterCidr] : [])];
+    for (const cidr of generationCidrs) {
+        const [address, prefix, ...extra] = cidr.split('/');
+        const minimum = address.startsWith('10.')
+            ? 8
+            : address.startsWith('192.168.')
+                ? 16
+                : /^172\.(1[6-9]|2\d|3[01])\./.test(address)
+                    ? 12
+                    : 33;
+        if ((0, node_net_1.isIP)(address) !== 4 ||
+            extra.length ||
+            !/^\d{1,2}$/.test(prefix) ||
+            Number(prefix) < minimum ||
+            Number(prefix) > 32) {
+            throw new Error('Generation ingress requires a valid private IPv4 CIDR');
+        }
+    }
     const imageProvider = context.env.AG_AI_IMAGE_PROVIDER ?? 'openai';
     const opencodeProvider = context.env.AG_AI_OPENCODE_PROVIDER;
     const agAiPackage = context.env.AG_AI_PACKAGE;
@@ -61,7 +83,7 @@ const runnerStack = (context) => {
         preserveData: true,
         data: {
             'network-init.sh': networkInitScript({
-                generationCidr,
+                generationCidrs,
                 generationPort: common_1.GENERATION_PORT,
                 opencodePort: common_1.OPENCODE_PORT,
             }),
@@ -138,9 +160,10 @@ const runnerStack = (context) => {
         changeNFSFilePerms: false,
     });
     const spec = deployment.spec;
-    // oxlint-disable-next-line typescript/no-unnecessary-condition -- the SDK class type hides runtime optionality.
-    const pod = spec?.template?.spec;
-    if (!spec || !pod)
+    if (!spec)
+        throw new Error('runner deployment is missing its specification');
+    const pod = spec.template.spec;
+    if (!pod)
         throw new Error('runner deployment is missing its pod specification');
     // A shared store must have only one writer during rollouts.
     spec.strategy = { type: 'Recreate' };
@@ -253,7 +276,7 @@ const runnerStack = (context) => {
         spec: {
             type: 'LoadBalancer',
             loadBalancerIP: metalLbAddress,
-            loadBalancerSourceRanges: [generationCidr],
+            loadBalancerSourceRanges: generationCidrs,
             externalTrafficPolicy: 'Local',
             allocateLoadBalancerNodePorts: false,
             selector: { app: common_1.RUNNER_APP },
@@ -279,7 +302,7 @@ const runnerStack = (context) => {
             policyTypes: ['Ingress'],
             ingress: [
                 {
-                    from: [{ ipBlock: { cidr: generationCidr } }],
+                    from: generationCidrs.map((cidr) => ({ ipBlock: { cidr } })),
                     ports: [{ protocol: 'TCP', port: common_1.GENERATION_PORT }],
                 },
             ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ag-ai",
-  "version": "0.4.4",
+  "version": "0.4.5",
   "description": "Provider-neutral AI client and cluster runtime for the rpi-mega cluster.",
   "license": "ISC",
   "author": "admin@gec.dev",