aglio-worker 0.9.2 → 0.11.0

package/agent.js

@@ -7302,8 +7302,8 @@ var require_content_type = __commonJS({
 });
 
 // src/remote-agent.ts
-import { homedir as homedir2, hostname as hostname3 } from "node:os";
-import { join as join7 } from "node:path";
+import { homedir as homedir3, hostname as hostname3 } from "node:os";
+import { join as join8 } from "node:path";
 
 // ../../packages/shared/src/enums.ts
 var CARD_COLUMNS = ["backlog", "todo", "doing", "review", "done"];
@@ -28241,11 +28241,117 @@ var boardListMoveSchema = external_exports.object({
 // ../../packages/shared/src/password-reset.ts
 var PASSWORD_RESET_TTL_SECONDS = 60 * 60;
 
+// ../../packages/shared/src/card-open-mode.ts
+var CARD_OPEN_MODES = ["popup", "page"];
+var cardOpenModeSchema = external_exports.enum(CARD_OPEN_MODES);
+
 // src/remote-docker.ts
 import { existsSync } from "node:fs";
 import { PassThrough } from "node:stream";
-import { join, posix, relative, resolve } from "node:path";
+import { join as join2, posix, relative, resolve } from "node:path";
 import Dockerode from "dockerode";
+
+// src/docker-images.ts
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+function isRegistryImage(image) {
+  return image.includes("/");
+}
+function registryHost(image) {
+  const first = image.split("/")[0] ?? "";
+  if (first.includes(".") || first.includes(":") || first === "localhost") return first;
+  return "https://index.docker.io/v1/";
+}
+function dockerAuthFor(image) {
+  const configDir = process.env.DOCKER_CONFIG || join(homedir(), ".docker");
+  let config2;
+  try {
+    config2 = JSON.parse(readFileSync(join(configDir, "config.json"), "utf8"));
+  } catch {
+    return void 0;
+  }
+  const host = registryHost(image);
+  const entry = config2.auths?.[host] ?? config2.auths?.[`https://${host}`] ?? config2.auths?.[`http://${host}`];
+  if (!entry) return void 0;
+  if (entry.auth) {
+    const decoded = Buffer.from(entry.auth, "base64").toString("utf8");
+    const separator = decoded.indexOf(":");
+    if (separator > 0) {
+      return {
+        username: decoded.slice(0, separator),
+        password: decoded.slice(separator + 1)
+      };
+    }
+  }
+  if (entry.username && entry.password) {
+    return { username: entry.username, password: entry.password };
+  }
+  if (entry.identitytoken) return { identitytoken: entry.identitytoken };
+  if (entry.registrytoken) return { registrytoken: entry.registrytoken };
+  return void 0;
+}
+var inFlight = /* @__PURE__ */ new WeakMap();
+async function pullDockerImage(client, image) {
+  if (!isRegistryImage(image)) {
+    throw new Error(
+      `Runner image ${image} is not registry-qualified. Build it with: pnpm runner:build`
+    );
+  }
+  let pending = inFlight.get(client);
+  if (!pending) {
+    pending = /* @__PURE__ */ new Map();
+    inFlight.set(client, pending);
+  }
+  const existing = pending.get(image);
+  if (existing) return existing;
+  const pull = (async () => {
+    const stream = await client.pull(image, { authconfig: dockerAuthFor(image) });
+    await new Promise((resolve6, reject) => {
+      stream.on("data", () => void 0);
+      stream.on("end", () => resolve6());
+      stream.on("error", (error62) => reject(error62));
+    });
+  })();
+  pending.set(image, pull);
+  try {
+    await pull;
+  } finally {
+    pending.delete(image);
+  }
+}
+async function ensureDockerImage(input2) {
+  try {
+    await input2.client.getImage(input2.image).inspect();
+    return "present";
+  } catch {
+  }
+  if (!isRegistryImage(input2.image)) {
+    throw new Error(
+      `Runner image ${input2.image} not found on this machine. Build it with: pnpm runner:build`
+    );
+  }
+  input2.log?.("runner image missing, pulling", { image: input2.image });
+  try {
+    await pullDockerImage(input2.client, input2.image);
+  } catch (error62) {
+    const reason = error62 instanceof Error ? error62.message : String(error62);
+    throw new Error(
+      `Runner image ${input2.image} not found and could not be pulled: ${reason}. Check registry access or docker login, then retry: docker pull ${input2.image}`
+    );
+  }
+  try {
+    await input2.client.getImage(input2.image).inspect();
+  } catch {
+    throw new Error(
+      `Runner image ${input2.image} pull finished but the image is still missing locally. Retry: docker pull ${input2.image}`
+    );
+  }
+  input2.log?.("runner image pulled", { image: input2.image });
+  return "pulled";
+}
+
+// src/remote-docker.ts
 async function runnerCpuCount(client) {
   const info = await client.info().catch(() => null);
   return Math.max(1, Math.min(2, Math.floor(info?.NCPU ?? 1)));
@@ -28287,25 +28393,24 @@ function mapDockerWorkspace(input2) {
     throw new Error(`Path escapes the job workspace: ${input2.target}`);
   }
   return {
-    hostPath: resolve(join(input2.hostWorkspaceRoot, rel)),
+    hostPath: resolve(join2(input2.hostWorkspaceRoot, rel)),
     containerPath: containerRel ? posix.join(CONTAINER_WORKSPACE, containerRel.split(/[\\/]+/).join("/")) : CONTAINER_WORKSPACE
   };
 }
 function sleep(ms) {
   return new Promise((resolvePromise) => setTimeout(resolvePromise, ms));
 }
+var defaultClients = /* @__PURE__ */ new Map();
 function defaultClient(socketPath) {
-  return new Dockerode({ socketPath });
+  const existing = defaultClients.get(socketPath);
+  if (existing) return existing;
+  const client = new Dockerode({ socketPath });
+  defaultClients.set(socketPath, client);
+  return client;
 }
 async function createDockerJobExecutor(input2) {
   const client = input2.client ?? defaultClient(input2.socketPath ?? "/var/run/docker.sock");
-  try {
-    await client.getImage(input2.image).inspect();
-  } catch {
-    throw new Error(
-      `Runner image ${input2.image} not found on this machine. Pull it with: docker pull ${input2.image}`
-    );
-  }
+  await ensureDockerImage({ client, image: input2.image, log: input2.log });
   const { hostPath } = mapDockerWorkspace({
     workspaceRoot: input2.workspaceRoot,
     hostWorkspaceRoot: input2.hostWorkspaceRoot,
@@ -28417,13 +28522,35 @@ async function createDockerJobExecutor(input2) {
     }
   };
 }
-async function createDockerLoginContainer(input2) {
-  const client = new Dockerode({ socketPath: input2.socketPath ?? "/var/run/docker.sock" });
+async function prefetchRunnerImage(input2) {
+  const client = input2.client ?? defaultClient(input2.socketPath ?? "/var/run/docker.sock");
   try {
-    await client.getImage(input2.image).inspect();
-  } catch {
-    throw new Error(`Runner image ${input2.image} not found on this machine.`);
+    if (isRegistryImage(input2.image)) {
+      await pullDockerImage(client, input2.image);
+      input2.log?.("runner image refreshed", { image: input2.image });
+      return true;
+    }
+    const result = await ensureDockerImage({
+      client,
+      image: input2.image,
+      log: input2.log
+    });
+    if (result === "present") input2.log?.("runner image ready", { image: input2.image });
+    return true;
+  } catch (error62) {
+    input2.log?.("runner image unavailable", {
+      image: input2.image,
+      error: error62 instanceof Error ? error62.message : String(error62)
+    });
+    return false;
   }
+}
+async function createDockerLoginContainer(input2) {
+  const client = new Dockerode({ socketPath: input2.socketPath ?? "/var/run/docker.sock" });
+  await ensureDockerImage({
+    client,
+    image: input2.image
+  });
   const { hostPath } = mapDockerWorkspace({
     workspaceRoot: input2.workspaceRoot,
     hostWorkspaceRoot: input2.hostWorkspaceRoot,
@@ -28550,8 +28677,8 @@ async function verifyHostRuntime(input2, run = defaultRunner) {
 // src/job-runner.ts
 import { spawn } from "node:child_process";
 import { access, mkdir, readFile, stat } from "node:fs/promises";
-import { homedir } from "node:os";
-import { isAbsolute, join as join2, relative as relative2, resolve as resolve2 } from "node:path";
+import { homedir as homedir2 } from "node:os";
+import { isAbsolute, join as join3, relative as relative2, resolve as resolve2 } from "node:path";
 
 // src/job-log-batcher.ts
 var DEFAULT_MAX_RETRIES = 3;
@@ -28758,7 +28885,7 @@ var JobAbortedError = class extends Error {
   }
 };
 function defaultWorkspaceRoot() {
-  return process.env.AGLIO_WORKER_WORKSPACE?.trim() || join2(homedir(), ".aglio", "workspaces");
+  return process.env.AGLIO_WORKER_WORKSPACE?.trim() || join3(homedir2(), ".aglio", "workspaces");
 }
 function safeSegment(value) {
   return value.replace(/[^A-Za-z0-9._-]+/g, "-").slice(0, 120) || "job";
@@ -28778,7 +28905,7 @@ function inside(root, target) {
 async function executeRemoteJob(job, deps) {
   if (deps.signal?.aborted) throw new JobAbortedError();
   const root = deps.workspaceRoot ?? defaultWorkspaceRoot();
-  const workspace = join2(
+  const workspace = join3(
     root,
     safeSegment(job.workspaceId || "workspace"),
     safeSegment(job.project?.id || "workspace"),
@@ -28887,7 +29014,7 @@ ${job.instructions.trim()}
     for (const step of job.steps) {
       if (deps.signal?.aborted) throw new JobAbortedError();
       if (leaseAbort.signal.aborted) throw new JobLeaseLostError("Lease was lost before the next step.");
-      const cwd = step.cwd ? inside(workspace, join2(workspace, step.cwd)) : workspace;
+      const cwd = step.cwd ? inside(workspace, join3(workspace, step.cwd)) : workspace;
       write(`[aglio] step: ${step.name}
 $ ${step.command}
 `);
@@ -28946,8 +29073,8 @@ async function finish(deps, job, state, error62) {
 }
 async function checkoutRepos(job, workspace, write, signal) {
   for (const repo of job.project?.repos ?? []) {
-    const target = inside(workspace, join2(workspace, repo.name));
-    const hasGit = await access(join2(target, ".git")).then(
+    const target = inside(workspace, join3(workspace, repo.name));
+    const hasGit = await access(join3(target, ".git")).then(
       () => true,
       () => false
     );
@@ -29029,7 +29156,7 @@ async function uploadJobArtifacts(job, workspace, deps, write) {
 `);
       continue;
     }
-    const path = inside(workspace, join2(workspace, artifact.name));
+    const path = inside(workspace, join3(workspace, artifact.name));
     const info = await stat(path).catch(() => null);
     if (!info?.isFile()) {
       write(`[aglio] artifact missing: ${artifact.name}
@@ -29078,7 +29205,7 @@ import { dirname as dirname2 } from "node:path";
 
 // src/remote-card-run.ts
 import { mkdir as mkdir2, readFile as readFile2, rm as rm2, stat as stat3, writeFile } from "node:fs/promises";
-import { dirname, isAbsolute as isAbsolute2, join as join4, relative as relative3, resolve as resolve3 } from "node:path";
+import { dirname, isAbsolute as isAbsolute2, join as join5, relative as relative3, resolve as resolve3 } from "node:path";
 
 // ../../packages/agents/src/drivers.ts
 function withSystemPrompt(prompt, append) {
@@ -29732,13 +29859,13 @@ function credentialFiles(payload) {
 
 // src/remote-cleanup.ts
 import { access as access2, readdir, rm, stat as stat2 } from "node:fs/promises";
-import { join as join3 } from "node:path";
+import { join as join4 } from "node:path";
 import Dockerode2 from "dockerode";
 var JOB_WORKSPACE_RETENTION_MS = 7 * 24 * 60 * 60 * 1e3;
 var STALE_CONTAINER_RETENTION_SECONDS = 24 * 60 * 60;
 var SESSION_RESUME_MARKER = "resume-pending";
 function sessionResumeMarkerPath(workspaceDir) {
-  return join3(workspaceDir, ".aglio", SESSION_RESUME_MARKER);
+  return join4(workspaceDir, ".aglio", SESSION_RESUME_MARKER);
 }
 async function workspaceHasResumeMarker(workspaceDir) {
   return access2(sessionResumeMarkerPath(workspaceDir)).then(
@@ -29761,16 +29888,16 @@ async function cleanupRemoteWorkspaces(input2) {
   const rootEntries = await readdir(input2.workspaceRoot, { withFileTypes: true }).catch(() => []);
   for (const workspace of rootEntries) {
     if (!workspace.isDirectory()) continue;
-    const workspaceDir = join3(input2.workspaceRoot, workspace.name);
+    const workspaceDir = join4(input2.workspaceRoot, workspace.name);
     const projectEntries = await readdir(workspaceDir, { withFileTypes: true }).catch(() => []);
     for (const project of projectEntries) {
       if (!project.isDirectory()) continue;
-      const projectDir = join3(workspaceDir, project.name);
+      const projectDir = join4(workspaceDir, project.name);
       const jobEntries = await readdir(projectDir, { withFileTypes: true }).catch(() => []);
       for (const job of jobEntries) {
         if (!job.isDirectory()) continue;
         scanned += 1;
-        const jobDir = join3(projectDir, job.name);
+        const jobDir = join4(projectDir, job.name);
         const info = await stat2(jobDir).catch(() => null);
         if (!info) continue;
         if (!shouldRemoveWorkspace({
@@ -29932,12 +30059,12 @@ async function runRemoteCardJob(deps) {
   const lease = { jobId: job.id, leaseId: job.lease.id, token: job.lease.token };
   let context;
   try {
-    const workspaceReady = await stat3(join4(workspace, ".aglio")).then(
+    const workspaceReady = await stat3(join5(workspace, ".aglio")).then(
       (info) => info.isDirectory(),
       () => false
     );
     context = await deps.api.fetchContext({ ...lease, workspaceRoot: runRoot, workspaceReady });
-    await rm2(join4(workspace, ".aglio", SESSION_RESUME_MARKER), { force: true }).catch(() => void 0);
+    await rm2(join5(workspace, ".aglio", SESSION_RESUME_MARKER), { force: true }).catch(() => void 0);
   } catch (error62) {
     return { state: "failed", error: `Could not load run context: ${errorText2(error62)}` };
   }
@@ -29946,9 +30073,9 @@ async function runRemoteCardJob(deps) {
     write("[aglio] waiting for a free run slot\n");
     return { state: "succeeded", error: null };
   }
-  const toolDir = join4(workspace, ".aglio", context.agent.driver);
-  const homeHost = join4(toolDir, "home");
-  const gitConfigPath = join4(workspace, ".aglio", "gitconfig");
+  const toolDir = join5(workspace, ".aglio", context.agent.driver);
+  const homeHost = join5(toolDir, "home");
+  const gitConfigPath = join5(workspace, ".aglio", "gitconfig");
   const mcpRelativePath = mcpConfigRelativePath(context.agent.driver);
   const mcpUrl = deps.mcp ? `${deps.mcp.baseUrl.replace(/\/+$/, "")}/mcp/${context.run.id}` : "";
   const extraServers = context.mcp.servers;
@@ -29996,7 +30123,7 @@ async function runRemoteCardJob(deps) {
       options: context.agent.options,
       sessionId: context.run.sessionId,
       resume: Boolean(context.run.sessionId),
-      mcpConfigPath: mcpRelativePath ? containerPath(runRoot, workspace, join4(toolDir, mcpRelativePath)) : "",
+      mcpConfigPath: mcpRelativePath ? containerPath(runRoot, workspace, join5(toolDir, mcpRelativePath)) : "",
       piHome: containerPath(runRoot, workspace, toolDir),
       workingDirectory: repoPaths.length === 1 ? containerPath(runRoot, workspace, repoPaths[0]) : runRoot,
       systemPromptAppend: context.systemPromptAppend
@@ -30016,14 +30143,14 @@ async function runRemoteCardJob(deps) {
     deps.mcp?.stopRun(context.run.id);
     await rm2(homeHost, { recursive: true, force: true }).catch(() => void 0);
     await rm2(gitConfigPath, { force: true }).catch(() => void 0);
-    await rm2(join4(toolDir, "models.json"), { force: true }).catch(() => void 0);
+    await rm2(join5(toolDir, "models.json"), { force: true }).catch(() => void 0);
     if (mcpRelativePath) {
-      await rm2(join4(toolDir, mcpRelativePath), { force: true }).catch(() => void 0);
+      await rm2(join5(toolDir, mcpRelativePath), { force: true }).catch(() => void 0);
     }
   }
   async function prepareWorkspace() {
     await mkdir2(homeHost, { recursive: true, mode: 448 });
-    await mkdir2(join4(workspace, ".aglio", "attachments"), { recursive: true });
+    await mkdir2(join5(workspace, ".aglio", "attachments"), { recursive: true });
     const files = credentialFiles(context.agent.credential.payload);
     if (context.agent.credential.authType === "session_bundle" && Object.keys(files).length === 0) {
       throw new Error(`Credential "${context.agent.credential.label}" has no session files.`);
@@ -30044,7 +30171,7 @@ async function runRemoteCardJob(deps) {
         throw new Error(`Credential "${context.agent.credential.label}" has no base URL.`);
       }
       await writeFile(
-        join4(toolDir, "models.json"),
+        join5(toolDir, "models.json"),
         JSON.stringify(
           {
             providers: {
@@ -30063,7 +30190,7 @@ async function runRemoteCardJob(deps) {
       );
     }
     if (mcpRelativePath && mcpUrl) {
-      const hostConfigPath = join4(toolDir, mcpRelativePath);
+      const hostConfigPath = join5(toolDir, mcpRelativePath);
       await mkdir2(dirname(hostConfigPath), { recursive: true });
       await writeFile(
         hostConfigPath,
@@ -30093,7 +30220,7 @@ async function runRemoteCardJob(deps) {
       try {
         const data = await deps.api.fetchAttachment({ ...lease, artifactId: attachment.id });
         await writeFile(
-          join4(workspace, ".aglio", "attachments", artifactFileName(attachment.id, attachment.label)),
+          join5(workspace, ".aglio", "attachments", artifactFileName(attachment.id, attachment.label)),
           data
         );
       } catch {
@@ -30105,10 +30232,10 @@ async function runRemoteCardJob(deps) {
   async function cloneRepos() {
     const repoPaths = [];
     for (const repo of context.repos) {
-      const target = inside2(workspace, join4(workspace, repo.name));
+      const target = inside2(workspace, join5(workspace, repo.name));
       const targetRun = containerPath(runRoot, workspace, target);
       repoPaths.push(target);
-      const hasGit = await readFile2(join4(target, ".git", "HEAD"), "utf8").then(
+      const hasGit = await readFile2(join5(target, ".git", "HEAD"), "utf8").then(
         () => true,
         () => false
       );
@@ -30212,7 +30339,7 @@ async function runRemoteCardJob(deps) {
     };
   }
   async function pushBranch(repo, branch) {
-    const target = inside2(workspace, join4(workspace, repo.name));
+    const target = inside2(workspace, join5(workspace, repo.name));
     const targetRun = containerPath(runRoot, workspace, target);
     write(`[aglio] pushing ${repo.name} ${branch}
 `);
@@ -30473,7 +30600,7 @@ async function runRemoteCardJob(deps) {
 
 // src/remote-provider-login.ts
 import { mkdir as mkdir3, readFile as readFile3, rm as rm3 } from "node:fs/promises";
-import { join as join5, resolve as resolve4, sep } from "node:path";
+import { join as join6, resolve as resolve4, sep } from "node:path";
 var FINAL = ["completed", "failed", "cancelled", "expired"];
 var POLL_MS = 700;
 var KICKOFF_MS = 4e3;
@@ -30486,8 +30613,8 @@ function errorText3(error62) {
 async function runRemoteProviderLogin(input2) {
   let session = await input2.api.fetch();
   const method = session.command;
-  const root = join5(input2.workspace, "login");
-  const home = join5(root, "home");
+  const root = join6(input2.workspace, "login");
+  const home = join6(root, "home");
   const target = resolve4(home, session.bundlePath);
   if (!target.startsWith(resolve4(home) + sep)) {
     return { state: "failed", error: "Unsafe credential bundle path." };
@@ -31316,7 +31443,7 @@ async function runRemoteWorker(config2, deps = {}) {
 // src/remote-mcp.ts
 import { createServer as createServer2 } from "node:http";
 import { mkdir as mkdir5, readFile as readFile5, stat as stat4, writeFile as writeFile3 } from "node:fs/promises";
-import { basename, isAbsolute as isAbsolute3, join as join6, relative as relative4, resolve as resolve5 } from "node:path";
+import { basename, isAbsolute as isAbsolute3, join as join7, relative as relative4, resolve as resolve5 } from "node:path";
 
 // ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v3/helpers/util.js
 var util;
@@ -43024,7 +43151,7 @@ function fail(message) {
 function workspaceHostPath(workspace, input2) {
   const root = resolve5(workspace);
   const trimmed = input2.trim();
-  const mapped = !trimmed.startsWith("/") ? join6(root, trimmed) : trimmed === root || trimmed.startsWith(`${root}/`) ? trimmed : join6(root, relative4("/workspace", trimmed));
+  const mapped = !trimmed.startsWith("/") ? join7(root, trimmed) : trimmed === root || trimmed.startsWith(`${root}/`) ? trimmed : join7(root, relative4("/workspace", trimmed));
   const normalized = resolve5(mapped);
   const rel = relative4(root, normalized);
   if (rel.startsWith("..") || isAbsolute3(rel)) throw new Error("Artifact path escapes the workspace");
@@ -43134,9 +43261,9 @@ function createServerForRun(run) {
     try {
       const result = await run.callTool({ tool, input: input2 });
       if (run.kind !== "planning" && (tool === "question_ask" || tool === "spec_propose") && result && typeof result === "object" && ["awaiting_input", "pending"].includes(String(result.status ?? ""))) {
-        await mkdir5(join6(run.workspace, ".aglio"), { recursive: true }).catch(() => void 0);
+        await mkdir5(join7(run.workspace, ".aglio"), { recursive: true }).catch(() => void 0);
         await writeFile3(
-          join6(run.workspace, ".aglio", SESSION_RESUME_MARKER),
+          join7(run.workspace, ".aglio", SESSION_RESUME_MARKER),
           (/* @__PURE__ */ new Date()).toISOString(),
           "utf8"
         ).catch((error62) => run.log(`resume marker write failed: ${String(error62)}`));
@@ -43416,7 +43543,7 @@ async function main() {
   const mode = normalizeWorkerMode(process.env.AGLIO_WORKER_MODE?.trim() || "docker");
   const os = normalizeWorkerOs(process.env.AGLIO_WORKER_OS?.trim() || defaultOs());
   const labels = parseWorkerLabels(process.env.AGLIO_WORKER_LABELS ?? "");
-  const stateFile = process.env.AGLIO_WORKER_STATE_FILE?.trim() || join7(homedir2(), ".aglio", "worker.json");
+  const stateFile = process.env.AGLIO_WORKER_STATE_FILE?.trim() || join8(homedir3(), ".aglio", "worker.json");
   const workspaceRoot = process.env.AGLIO_WORKER_WORKSPACE?.trim() || defaultWorkspaceRoot();
   const hostWorkspaceRoot = process.env.AGLIO_WORKER_HOST_WORKSPACE?.trim() || workspaceRoot;
   const runnerImage = defaultRunnerImage();
@@ -43472,6 +43599,13 @@ async function main() {
   );
   const hostTools = await verifyHostRuntime({ mode, labels, platform: process.platform });
   if (hostTools.length > 0) console.log(`[worker-agent] host tools ${hostTools.join(" | ")}`);
+  if (mode === "docker") {
+    void prefetchRunnerImage({
+      image: runnerImage,
+      socketPath: dockerSocket,
+      log: (message, extra) => console.log(`[worker-agent] ${message}`, extra ?? "")
+    });
+  }
   try {
     process.exitCode = await runRemoteWorker(config2, {
       signal: controller.signal,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aglio-worker",
-  "version": "0.9.2",
+  "version": "0.11.0",
   "description": "Host machine agent for Aglio: claims jobs over the API and starts aglio-runner containers.",
   "type": "module",
   "bin": {