aglio-worker 0.25.0 → 0.28.21

package/agent.js

@@ -27344,6 +27344,119 @@ function validateRoutingLabels(input2) {
   return labels;
 }
 
+// ../../packages/shared/src/worker-capacity.ts
+var WORKER_DEFAULT_CAPACITY = 1;
+var WORKER_MAX_CAPACITY = 8;
+var WORKER_MIN_CAPACITY = 1;
+var WORKER_CAPACITY_OPTIONS = Array.from(
+  { length: WORKER_MAX_CAPACITY },
+  (_, index) => index + 1
+);
+function workerCapacity(input2, fallback = WORKER_DEFAULT_CAPACITY) {
+  const value = typeof input2 === "number" ? input2 : Number(input2);
+  if (!Number.isFinite(value)) return fallback;
+  return Math.min(WORKER_MAX_CAPACITY, Math.max(WORKER_MIN_CAPACITY, Math.trunc(value)));
+}
+function workerCapacityForMode(input2, mode) {
+  return mode === "host" ? WORKER_MIN_CAPACITY : workerCapacity(input2);
+}
+
+// ../../packages/shared/src/pool.ts
+var JOB_TARGETS = ["auto", "byow", "cloud"];
+var POOL_SIZES = ["small", "medium", "large", "xlarge"];
+var DEFAULT_POOL_SIZE = "small";
+var POOL_IDLE_TIMEOUT_MS = 5 * 6e4;
+var POOL_STALE_PROVISIONING_MS = 3 * 6e4;
+var POOL_SIZE_CONFIG = {
+  small: {
+    capacity: 2,
+    cpuLimit: 2,
+    memoryLimit: "2560m",
+    instanceType: "c7i.xlarge",
+    vcpu: 4,
+    hourlyUsd: 0.1786,
+    maxInstances: 4
+  },
+  medium: {
+    capacity: 4,
+    cpuLimit: 2,
+    memoryLimit: "2560m",
+    instanceType: "c7i.2xlarge",
+    vcpu: 8,
+    hourlyUsd: 0.3572,
+    maxInstances: 2
+  },
+  large: {
+    capacity: 8,
+    cpuLimit: 2,
+    memoryLimit: "2560m",
+    instanceType: "c7i.4xlarge",
+    vcpu: 16,
+    hourlyUsd: 0.7144,
+    // Documented only: the controller provisions small and medium machines.
+    maxInstances: 0
+  },
+  xlarge: {
+    capacity: 16,
+    cpuLimit: 2,
+    memoryLimit: "2560m",
+    instanceType: "c7i.8xlarge",
+    vcpu: 32,
+    hourlyUsd: 1.4288,
+    maxInstances: 0
+  }
+};
+var POOL_REGION_LABEL = "region:us-east";
+function isPoolSize(value) {
+  return typeof value === "string" && POOL_SIZES.includes(value);
+}
+function normalizePoolSize(value, fallback = DEFAULT_POOL_SIZE) {
+  return isPoolSize(value) ? value : fallback;
+}
+function poolWorkerLabels(size) {
+  return ["os:linux", "mode:docker", `size:${size}`, POOL_REGION_LABEL];
+}
+var POOL_HOST_RESERVE_BYTES = 1024 ** 3;
+var MEMORY_UNITS = {
+  b: 1,
+  k: 1024,
+  m: 1024 ** 2,
+  g: 1024 ** 3,
+  t: 1024 ** 4
+};
+function parsePoolMemoryLimit(value) {
+  const match = /^(\d+(?:\.\d+)?)\s*([bkmgt])?b?$/i.exec(value.trim());
+  if (!match) return null;
+  const unit = (match[2] ?? "").toLowerCase();
+  const multiplier = unit === "" ? 1 : MEMORY_UNITS[unit];
+  const amount = Number(match[1]);
+  if (!multiplier || !Number.isFinite(amount) || amount <= 0) return null;
+  return Math.round(amount * multiplier);
+}
+function poolBootCapCheck(input2) {
+  const config2 = POOL_SIZE_CONFIG[input2.size];
+  const capacity = workerCapacity(input2.capacity);
+  const requiredCpu = capacity * config2.cpuLimit;
+  const requiredMemoryBytes = capacity * (parsePoolMemoryLimit(config2.memoryLimit) ?? 0) + POOL_HOST_RESERVE_BYTES;
+  const hostMemoryBytes = input2.hostMemoryBytes ?? null;
+  const base = { requiredCpu, hostCpu: input2.hostCpu, requiredMemoryBytes, hostMemoryBytes };
+  if (requiredCpu > input2.hostCpu) {
+    return {
+      ...base,
+      ok: false,
+      reason: `capacity ${capacity} x ${config2.cpuLimit} vCPU exceeds the host ${input2.hostCpu} vCPU`
+    };
+  }
+  if (hostMemoryBytes != null && requiredMemoryBytes > hostMemoryBytes) {
+    return {
+      ...base,
+      ok: false,
+      reason: `capacity ${capacity} x ${config2.memoryLimit} plus the 1 GiB reserve (${Math.round(requiredMemoryBytes / 1024 ** 2)} MiB) exceeds the host ${Math.round(hostMemoryBytes / 1024 ** 2)} MiB`
+    };
+  }
+  return { ...base, ok: true };
+}
+
 // ../../packages/shared/src/schemas.ts
 var cardColumnSchema = external_exports.enum(CARD_COLUMNS);
 var runStatusSchema = external_exports.enum(RUN_STATUSES_FOR_SCHEMA);
@@ -27429,8 +27542,11 @@ var projectSettingsSchema = external_exports.object({
   /** Planning job labels. Empty means any online worker, so planning never waits on a build machine. */
   planningRequiredWorkerLabels: routingLabelsSchema.default([]),
   /** Undefined inherits the workspace switch. True or false overrides it. */
-  postBuildReply: external_exports.boolean().optional()
+  postBuildReply: external_exports.boolean().optional(),
+  /** Default pool size for cloud runs started from this project. Auto picks one at dispatch. */
+  cloudRunnerSize: external_exports.enum(POOL_SIZES).default("small")
 });
+var jobTargetSchema = external_exports.enum(JOB_TARGETS);
 var repoConfigSchema = external_exports.object({
   id: external_exports.string(),
   name: external_exports.string(),
@@ -27564,23 +27680,6 @@ var MAX_SCAN_MINUTES = 8 * 24 * 60;
 // ../../packages/shared/src/workers.ts
 import { createHash, randomBytes } from "node:crypto";
 
-// ../../packages/shared/src/worker-capacity.ts
-var WORKER_DEFAULT_CAPACITY = 1;
-var WORKER_MAX_CAPACITY = 8;
-var WORKER_MIN_CAPACITY = 1;
-var WORKER_CAPACITY_OPTIONS = Array.from(
-  { length: WORKER_MAX_CAPACITY },
-  (_, index) => index + 1
-);
-function workerCapacity(input2, fallback = WORKER_DEFAULT_CAPACITY) {
-  const value = typeof input2 === "number" ? input2 : Number(input2);
-  if (!Number.isFinite(value)) return fallback;
-  return Math.min(WORKER_MAX_CAPACITY, Math.max(WORKER_MIN_CAPACITY, Math.trunc(value)));
-}
-function workerCapacityForMode(input2, mode) {
-  return mode === "host" ? WORKER_MIN_CAPACITY : workerCapacity(input2);
-}
-
 // ../../packages/shared/src/job-contract.ts
 var WORKER_JOB_LOG_BATCH_BYTES = 64 * 1024;
 var WORKER_JOB_LOG_BATCH_MS = 1500;
@@ -28224,7 +28323,8 @@ var PLAN_CATALOG = {
       seats: 1,
       projects: 2,
       runsPerMonth: 50,
-      storageBytes: 500 * MEGABYTE
+      storageBytes: 500 * MEGABYTE,
+      poolSecondsPerMonth: 18e3
     }
   },
   team: {
@@ -28236,7 +28336,8 @@ var PLAN_CATALOG = {
       seats: 10,
       projects: 20,
       runsPerMonth: 2e3,
-      storageBytes: 20 * GIGABYTE
+      storageBytes: 20 * GIGABYTE,
+      poolSecondsPerMonth: 18e4
     }
   },
   enterprise: {
@@ -28248,7 +28349,8 @@ var PLAN_CATALOG = {
       seats: null,
       projects: null,
       runsPerMonth: null,
-      storageBytes: null
+      storageBytes: null,
+      poolSecondsPerMonth: null
     }
   }
 };
@@ -28277,6 +28379,124 @@ var cardOpenModeSchema = external_exports.enum(CARD_OPEN_MODES);
 var CARD_OPEN_SIZES = ["default", "large", "fullscreen"];
 var cardOpenSizeSchema = external_exports.enum(CARD_OPEN_SIZES);
 
+// src/pool-boot.ts
+import { createHash as createHash2, createHmac } from "node:crypto";
+import { cpus, totalmem } from "node:os";
+async function containerCredentials(fetchImpl) {
+  const relative5 = process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI?.trim();
+  const full = process.env.AWS_CONTAINER_CREDENTIALS_FULL_URI?.trim();
+  if (!relative5 && !full) return null;
+  const response = await fetchImpl(relative5 ? `http://169.254.170.2${relative5}` : full);
+  if (!response.ok) return null;
+  const json3 = await response.json();
+  if (!json3.AccessKeyId || !json3.SecretAccessKey) return null;
+  return {
+    accessKeyId: json3.AccessKeyId,
+    secretAccessKey: json3.SecretAccessKey,
+    sessionToken: json3.Token ?? null
+  };
+}
+async function resolveAwsCredentials(fetchImpl = fetch) {
+  const key = process.env.AWS_ACCESS_KEY_ID?.trim();
+  const secret = process.env.AWS_SECRET_ACCESS_KEY?.trim();
+  if (key && secret) {
+    return {
+      accessKeyId: key,
+      secretAccessKey: secret,
+      sessionToken: process.env.AWS_SESSION_TOKEN?.trim() || null
+    };
+  }
+  return containerCredentials(fetchImpl);
+}
+function sha256(value) {
+  return createHash2("sha256").update(value, "utf8").digest("hex");
+}
+function hmac(key, value) {
+  return createHmac("sha256", key).update(value, "utf8").digest();
+}
+async function ssmCall(action, name, region, credentials, fetchImpl) {
+  const host = `ssm.${region}.amazonaws.com`;
+  const body = JSON.stringify(
+    action === "GetParameter" ? { Name: name, WithDecryption: true } : { Name: name }
+  );
+  const now = /* @__PURE__ */ new Date();
+  const long = now.toISOString().replace(/[:-]|\.\d{3}/g, "");
+  const short = long.slice(0, 8);
+  const headers = {
+    host,
+    "content-type": "application/x-amz-json-1.1",
+    "x-amz-date": long,
+    "x-amz-target": `AmazonSSM.${action}`
+  };
+  if (credentials.sessionToken) headers["x-amz-security-token"] = credentials.sessionToken;
+  const names = Object.keys(headers).map((h) => h.toLowerCase()).sort();
+  const canonicalHeaders = names.map((h) => `${h}:${headers[h]}
+`).join("");
+  const signedHeaders = names.join(";");
+  const canonicalRequest = [
+    "POST",
+    "/",
+    "",
+    canonicalHeaders,
+    signedHeaders,
+    sha256(body)
+  ].join("\n");
+  const scope = `${short}/${region}/ssm/aws4_request`;
+  const stringToSign = ["AWS4-HMAC-SHA256", long, scope, sha256(canonicalRequest)].join("\n");
+  const signingKey = hmac(
+    hmac(hmac(hmac(`AWS4${credentials.secretAccessKey}`, short), region), "ssm"),
+    "aws4_request"
+  );
+  const signature = createHmac("sha256", signingKey).update(stringToSign, "utf8").digest("hex");
+  headers.authorization = `AWS4-HMAC-SHA256 Credential=${credentials.accessKeyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`;
+  const response = await fetchImpl(`https://${host}/`, { method: "POST", headers, body });
+  const text = await response.text();
+  if (!response.ok) {
+    throw new Error(`SSM ${action} failed ${response.status}: ${text.slice(0, 300)}`);
+  }
+  return text ? JSON.parse(text) : {};
+}
+async function readAndDeletePoolToken(input2) {
+  const fetchImpl = input2.fetchImpl ?? fetch;
+  const credentials = input2.credentials ?? await resolveAwsCredentials(fetchImpl);
+  if (!credentials) throw new Error("Pool worker has no AWS credentials for SSM");
+  const region = input2.region ?? process.env.AWS_REGION?.trim() ?? "us-east-1";
+  const prefix = input2.prefix ?? process.env.AGLIO_POOL_SSM_PREFIX?.trim() ?? "/aglio/pool/workers";
+  const name = `${prefix}/${input2.workerId}`;
+  const response = await ssmCall("GetParameter", name, region, credentials, fetchImpl);
+  const parameter = response.Parameter;
+  const token = parameter?.Value;
+  if (!token || !token.startsWith("aglio_wkr_")) {
+    throw new Error("SSM parameter did not contain a worker token");
+  }
+  await ssmCall("DeleteParameter", name, region, credentials, fetchImpl).catch((error62) => {
+    console.warn("[pool] could not delete the SSM token parameter", {
+      error: error62 instanceof Error ? error62.message : String(error62)
+    });
+  });
+  return token;
+}
+async function resolvePoolBoot(options) {
+  const config2 = POOL_SIZE_CONFIG[options.size];
+  const check2 = poolBootCapCheck({
+    size: options.size,
+    capacity: config2.capacity,
+    hostCpu: cpus().length,
+    hostMemoryBytes: totalmem()
+  });
+  if (!check2.ok) throw new Error(`Pool worker refuses to start: ${check2.reason}`);
+  return {
+    size: options.size,
+    workerId: options.workerId,
+    token: options.token,
+    capacity: config2.capacity,
+    labels: poolWorkerLabels(options.size),
+    cpuLimit: config2.cpuLimit,
+    memoryLimit: config2.memoryLimit,
+    name: process.env.AGLIO_POOL_WORKER_NAME?.trim() || `pool-${options.size}-${options.workerId}`
+  };
+}
+
 // src/remote-docker.ts
 import { existsSync, readFileSync as readFileSync2 } from "node:fs";
 import { PassThrough } from "node:stream";
@@ -28386,7 +28606,7 @@ async function ensureDockerImage(input2) {
 // src/resources.ts
 var GIB = 1024 * 1024 * 1024;
 var AUTO_MEMORY_RATIO = 0.8;
-var MEMORY_UNITS = {
+var MEMORY_UNITS2 = {
   "": 1,
   b: 1,
   k: 1024,
@@ -28419,7 +28639,7 @@ function parseCpuLimit(value, variable = "AGENT_CPU_LIMIT") {
 function parseMemoryLimit(value, variable = "AGENT_MEMORY_LIMIT") {
   const trimmed = value.trim().toLowerCase();
   const match = /^(\d+(?:\.\d+)?)\s*([bkmgt]?b?)$/.exec(trimmed);
-  const multiplier = match ? MEMORY_UNITS[match[2] ?? ""] : void 0;
+  const multiplier = match ? MEMORY_UNITS2[match[2] ?? ""] : void 0;
   const amount = match ? Number(match[1]) : Number.NaN;
   if (!match || multiplier === void 0 || !Number.isFinite(amount)) {
     throw invalid(variable, value, "bytes or a Docker-style size such as 512m, 8g, 1073741824");
@@ -28433,6 +28653,11 @@ function parseMemoryLimit(value, variable = "AGENT_MEMORY_LIMIT") {
 function cpuToNanoCpus(cpu) {
   return Math.round(cpu * 1e9);
 }
+var NODE_HEAP_RATIO = 0.7;
+function nodeOptionsForMemory(memoryBytes) {
+  const heapMb = Math.max(64, Math.floor(memoryBytes / 1024 ** 2 * NODE_HEAP_RATIO));
+  return `--max-old-space-size=${heapMb}`;
+}
 function readAgentResourceOverrides(source = process.env) {
   const cpu = source.AGENT_CPU_LIMIT?.trim();
   const memory = source.AGENT_MEMORY_LIMIT?.trim();
@@ -28606,6 +28831,8 @@ async function createDockerJobExecutor(input2) {
     Cmd: ["sleep", "infinity"],
     WorkingDir: CONTAINER_WORKSPACE,
     Tty: false,
+    // Heap follows the container cap, so a stale image default cannot overshoot it.
+    Env: [`NODE_OPTIONS=${nodeOptionsForMemory(resources.memoryBytes)}`],
     Labels: { "aglio.remote_job": input2.jobId },
     HostConfig: hostConfig
   });
@@ -28727,13 +28954,18 @@ async function createDockerLoginContainer(input2) {
     if (error62.statusCode !== 404) throw error62;
   }
   const overrides = readAgentResourceOverrides();
+  const memory = overrides.memory ?? 2 * 1024 * 1024 * 1024;
   const container = await client.createContainer({
     Image: input2.image,
     name,
     Cmd: ["sleep", "infinity"],
     WorkingDir: CONTAINER_WORKSPACE,
     Tty: false,
-    Env: Object.entries(input2.env ?? {}).map(([key, value]) => `${key}=${value}`),
+    Env: Object.entries({
+      ...input2.env ?? {},
+      // Heap follows the container cap, so a stale image default cannot overshoot it.
+      NODE_OPTIONS: nodeOptionsForMemory(memory)
+    }).map(([key, value]) => `${key}=${value}`),
     Labels: { "aglio.remote_login": input2.jobId },
     HostConfig: {
       Binds: [`${hostPath}:${CONTAINER_WORKSPACE}`],
@@ -28741,7 +28973,7 @@ async function createDockerLoginContainer(input2) {
       ExtraHosts: input2.extraHosts ?? [],
       // Login keeps its small legacy default and never auto-detects, but an
       // explicit AGENT_CPU_LIMIT / AGENT_MEMORY_LIMIT override wins.
-      Memory: overrides.memory ?? 2 * 1024 * 1024 * 1024,
+      Memory: memory,
       NanoCpus: overrides.cpu != null ? cpuToNanoCpus(overrides.cpu) : await loginCpuNanoCpus(client),
       PidsLimit: 512,
       AutoRemove: false,
@@ -30694,29 +30926,44 @@ async function runRemoteCardJob(deps) {
       }
     });
   }
-  async function runGit(cwd, args) {
+  async function runGit(cwd, args, env = {}) {
     let output2 = "";
-    const code = await exec([`git ${args.map(shellArg2).join(" ")}`], cwd, await gitEnv(), {
-      log: false,
-      onOutput: (chunk) => {
-        output2 += chunk;
+    const code = await exec(
+      [`git ${args.map(shellArg2).join(" ")}`],
+      cwd,
+      Object.keys(env).length > 0 ? env : gitAuthEnv(),
+      {
+        log: false,
+        onOutput: (chunk) => {
+          output2 += chunk;
+        }
       }
-    });
+    );
     return { code, output: output2 };
   }
   async function repoGit(targetRun) {
     return (args) => runGit(workspace, ["-C", targetRun, ...args]);
   }
   async function git(args, cwd, options = {}) {
-    const { code } = await runGit(cwd, args);
+    const { code } = await runGit(cwd, args, options.env);
     if (code !== 0 && !options.allowFailure) throw new Error(`git ${args[0]} failed with code ${code}`);
     return { code };
   }
-  async function gitEnv() {
-    return {
+  function gitAuthEnv() {
+    const env = {
       GIT_TERMINAL_PROMPT: "0",
-      GIT_CONFIG_NOSYSTEM: "1",
-      ...context.git.token ? { GIT_CONFIG_GLOBAL: containerPath(runRoot, workspace, gitConfigPath) } : {}
+      GIT_CONFIG_NOSYSTEM: "1"
+    };
+    if (!context.git.token) return env;
+    const encoded = Buffer.from(
+      `${context.git.username || "x-access-token"}:${context.git.token}`,
+      "utf8"
+    ).toString("base64");
+    return {
+      ...env,
+      GIT_CONFIG_COUNT: "1",
+      GIT_CONFIG_KEY_0: "http.extraheader",
+      GIT_CONFIG_VALUE_0: `AUTHORIZATION: basic ${encoded}`
     };
   }
   async function pushBranch(repo, branch) {
@@ -30781,7 +31028,7 @@ async function runRemoteCardJob(deps) {
     const code = await deps.runCommand({
       command: `git ${args.map(shellArg2).join(" ")}`,
       cwd: workspace,
-      env: await gitEnv(),
+      env: gitAuthEnv(),
       signal: deps.signal,
       onOutput: (chunk) => {
         output2 += chunk.toString("utf8");
@@ -31769,7 +32016,7 @@ async function runRemoteWorker(config2, deps = {}) {
                   ...input2,
                   workspaceRoot: config2.workspaceRoot ?? input2.workspace,
                   hostWorkspaceRoot: config2.hostWorkspaceRoot ?? config2.workspaceRoot ?? input2.workspace,
-                  image: config2.runnerImage ?? "ghcr.io/h4kbas/aglio-runner:master",
+                  image: config2.runnerImage ?? "ghcr.io/h4kbas/aglio-runner:latest",
                   socketPath: config2.dockerSocket,
                   extraHosts: config2.extraHosts,
                   api: workerProviderLoginApi(
@@ -43936,10 +44183,23 @@ function defaultRunnerImage() {
 }
 async function main() {
   const apiUrl = required2("AGLIO_API_URL");
-  const token = required2("AGLIO_WORKER_TOKEN");
+  const poolMode = process.env.AGLIO_POOL === "1" || process.env.AGLIO_POOL === "true";
+  const poolSize = poolMode ? normalizePoolSize(process.env.AGLIO_POOL_SIZE) : null;
+  const poolWorkerId = poolMode ? required2("AGLIO_POOL_WORKER_ID") : null;
+  const poolBoot = poolMode ? await resolvePoolBoot({
+    workerId: poolWorkerId,
+    size: poolSize,
+    // Local stub only. Production reads the one-time token from SSM.
+    token: process.env.AGLIO_POOL_TOKEN?.trim() || await readAndDeletePoolToken({ workerId: poolWorkerId })
+  }) : null;
+  if (poolBoot) {
+    process.env.AGENT_CPU_LIMIT = String(poolBoot.cpuLimit);
+    process.env.AGENT_MEMORY_LIMIT = poolBoot.memoryLimit;
+  }
+  const token = poolBoot ? poolBoot.token : required2("AGLIO_WORKER_TOKEN");
   const mode = normalizeWorkerMode(process.env.AGLIO_WORKER_MODE?.trim() || "docker");
-  const os = normalizeWorkerOs(process.env.AGLIO_WORKER_OS?.trim() || defaultOs());
-  const labels = parseWorkerLabels(process.env.AGLIO_WORKER_LABELS ?? "");
+  const os = normalizeWorkerOs(poolBoot ? "linux" : process.env.AGLIO_WORKER_OS?.trim() || defaultOs());
+  const labels = poolBoot ? poolBoot.labels : parseWorkerLabels(process.env.AGLIO_WORKER_LABELS ?? "");
   const stateFile = process.env.AGLIO_WORKER_STATE_FILE?.trim() || join8(homedir3(), ".aglio", "worker.json");
   const workspaceRoot = process.env.AGLIO_WORKER_WORKSPACE?.trim() || defaultWorkspaceRoot();
   const hostWorkspaceRoot = process.env.AGLIO_WORKER_HOST_WORKSPACE?.trim() || workspaceRoot;
@@ -43973,14 +44233,14 @@ async function main() {
   const config2 = {
     apiUrl,
     token,
-    name: process.env.AGLIO_WORKER_NAME?.trim() || hostname3(),
+    name: poolBoot?.name ?? (process.env.AGLIO_WORKER_NAME?.trim() || hostname3()),
     os,
     mode,
     labels,
     version: process.env.AGLIO_WORKER_VERSION?.trim() || WORKER_MIN_VERSION,
     stateFile,
     // Simulators and Xcode share one signing context on a Mac host.
-    capacity: workerCapacityForMode(process.env.AGLIO_WORKER_CAPACITY ?? 1, mode),
+    capacity: poolBoot?.capacity ?? workerCapacityForMode(process.env.AGLIO_WORKER_CAPACITY ?? 1, mode),
     claimTimeoutSeconds,
     workspaceRoot,
     hostWorkspaceRoot,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aglio-worker",
-  "version": "0.25.0",
+  "version": "0.28.21",
   "description": "Host machine agent for Aglio: claims jobs over the API and starts aglio-runner containers.",
   "type": "module",
   "bin": {