alasio 5.1.0 → 6.0.0

package/dist/src/kube/sandbox-shape.js

@@ -0,0 +1,62 @@
+/**
+ * What alasio adds to a workspace's Sandbox over the template its installation gives it
+ * (../kube/config.ts): bayma's token, mounted from a Secret of the Sandbox's, and passed
+ * as a file; the labels that name the Sandbox and say what it is; and, of a session's,
+ * its internet's gate and DNS (../sandbox/index.ts), and of a folder's bayma, its state
+ * directory (../mcp/bayma.ts). In one place, with no dependency, so the admission policy
+ * that holds alasio to its templates (cli/src/manifests/admission.ts) knows it as they do.
+ */
+/** The container in every Sandbox's pod that runs bayma. */
+export const BAYMA_CONTAINER = "bayma";
+/** Where a Sandbox's token Secret is mounted in its bayma container, its key, and its volume. */
+export const TOKEN_DIR = "/run/alasio/bayma";
+export const TOKEN_KEY = "token";
+export const TOKEN_VOLUME = "alasio-bayma-token";
+/** The token volume's files' mode: readable by the pod's group, which is how a non-root bayma reads it. */
+export const TOKEN_MODE = 0o440;
+/** The arguments bayma is given after its template's: where its token is. */
+export const TOKEN_FILE_ARGS = ["--token-file", `${TOKEN_DIR}/${TOKEN_KEY}`];
+/** The name of a Sandbox's token Secret. */
+export function tokenSecretName(name) {
+    return `${name}-bayma-token`;
+}
+/** The label every object alasio makes carries, and the one that names its Sandbox. */
+export const MANAGED_BY = { "app.kubernetes.io/managed-by": "alasio" };
+export const SANDBOX_LABEL = "alasio.dev/sandbox";
+/** What a Sandbox's pod is to alasio: a session's, or a folder's bayma's. */
+export const WORKLOAD_LABEL = "alasio.dev/workload";
+/** A session's internet, `none` or `full`, which its NetworkPolicies follow. */
+export const NET_MODE_LABEL = "alasio.dev/net-mode";
+/** The harness a folder's bayma serves, as a path segment. */
+export const HARNESS_LABEL = "alasio.dev/harness";
+/** The token's environment variable in a session's bayma container, which its OTLP headers expand. */
+export const TOKEN_ENV = "ALASIO_SANDBOX_TOKEN";
+/** The resolvers a session with internet uses unless its template names others. */
+export const DEFAULT_FULL_MODE_NAMESERVERS = ["1.1.1.1", "8.8.8.8"];
+/** The argument a folder's bayma is given its state directory by, under its template's state root. */
+export const STATE_DIR_ARG = "--state-dir";
+/** A path segment from `value`: never empty, nor starting with a dot. */
+export function sanitizePathToken(value) {
+    return String(value).replace(/[^A-Za-z0-9_.-]+/g, "-").replace(/^[-.]+|-+$/g, "") || "default";
+}
+/** The init container that holds a session's pod until its egress is confined: its name, and its resources. */
+export const EGRESS_GATE = { name: "egress-gate", resources: { requests: { cpu: "10m", memory: "32Mi" }, limits: { memory: "64Mi" } } };
+/**
+ * The egress gate's program: exits once three connections in a row to the API server
+ * fail, and fails the pod if they still succeed after two minutes. Runs on the agent
+ * image's Node.
+ */
+export const EGRESS_GATE_SCRIPT = [
+    "const net = require('node:net');",
+    "const host = process.env.KUBERNETES_SERVICE_HOST, port = Number(process.env.KUBERNETES_SERVICE_PORT);",
+    "const deadline = Date.now() + 120000; let refused = 0;",
+    "(function probe() {",
+    "  const socket = net.connect({ host, port, timeout: 1000 });",
+    "  const next = (blocked) => { socket.destroy(); refused = blocked ? refused + 1 : 0;",
+    "    if (refused >= 3) process.exit(0);",
+    "    if (Date.now() > deadline) { console.error('egress is not confined: is NetworkPolicy enforced in this cluster?'); process.exit(1); }",
+    "    setTimeout(probe, 250); };",
+    "  socket.once('connect', () => next(false)); socket.once('timeout', () => next(true)); socket.once('error', () => next(true));",
+    "})();",
+].join("\n");
+//# sourceMappingURL=sandbox-shape.js.map

package/dist/src/kube/sandbox-shape.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-shape.js","sourceRoot":"","sources":["../../../../src/kube/sandbox-shape.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,4DAA4D;AAC5D,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC;AAEvC,iGAAiG;AACjG,MAAM,CAAC,MAAM,SAAS,GAAG,mBAAmB,CAAC;AAC7C,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC;AACjC,MAAM,CAAC,MAAM,YAAY,GAAG,oBAAoB,CAAC;AACjD,2GAA2G;AAC3G,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,CAAC;AAEhC,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAsB,CAAC,cAAc,EAAE,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC,CAAC;AAEhG,4CAA4C;AAC5C,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,GAAG,IAAI,cAAc,CAAC;AAC/B,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,MAAM,UAAU,GAAG,EAAE,8BAA8B,EAAE,QAAQ,EAAW,CAAC;AAChF,MAAM,CAAC,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAElD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AACpD,gFAAgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AACpD,8DAA8D;AAC9D,MAAM,CAAC,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAElD,sGAAsG;AACtG,MAAM,CAAC,MAAM,SAAS,GAAG,sBAAsB,CAAC;AAEhD,mFAAmF;AACnF,MAAM,CAAC,MAAM,6BAA6B,GAAsB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AAEvF,sGAAsG;AACtG,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAC;AAE3C,yEAAyE;AACzE,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC;AACjG,CAAC;AAED,+GAA+G;AAC/G,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAW,CAAC;AAEjJ;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,kCAAkC;IAClC,uGAAuG;IACvG,wDAAwD;IACxD,qBAAqB;IACrB,8DAA8D;IAC9D,sFAAsF;IACtF,wCAAwC;IACxC,0IAA0I;IAC1I,gCAAgC;IAChC,gIAAgI;IAChI,OAAO;CACR,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC"}

package/dist/src/sandbox/names.js

@@ -0,0 +1,44 @@
+/**
+ * Naming for session filesystems. A workspace is one of two kinds (see
+ * ../workspace/kind.ts): a folder, or a session filesystem identified by a volume id.
+ * A volume id is what alasio generates and stores, and its session's Sandbox, Service and
+ * volume claim are named for it.
+ */
+import { Schema } from "effect";
+/**
+ * The longest a volume id is: a DNS label's 63 characters, less a claim template's name
+ * of up to CLAIM_TEMPLATE_MAX and the hyphen after it, so its volume claims' names,
+ * `<template>-<id>` (../kube/sandboxes.ts claimName), are DNS labels too, as alasio's
+ * admission policy of its clones holds them to (cli/src/manifests/admission.ts).
+ */
+export const VOLUME_ID_MAX = 58;
+/** The longest a claim template's name is, of which a volume id's claims are named. */
+export const CLAIM_TEMPLATE_MAX = 63 - 1 - VOLUME_ID_MAX;
+/**
+ * A volume id is a DNS label of 3–58 characters from `[a-z0-9-]` that starts and ends
+ * with a letter or digit, as the names of the Sandbox, its Service and its pod must be,
+ * and short enough for its claims' (VOLUME_ID_MAX). alasio generates ids that already
+ * satisfy this, and this guards against any that would not.
+ */
+const VOLUME_ID_PATTERN = new RegExp(`^[a-z0-9][a-z0-9-]{1,${VOLUME_ID_MAX - 2}}[a-z0-9]$`, "u");
+/** A volume id, as what comes from outside alasio is decoded. */
+const VolumeId = Schema.String.check(Schema.isPattern(VOLUME_ID_PATTERN));
+/**
+ * A session's token, `<volumeId>.<random>` (../kube/sandboxes.ts newToken), decoded into
+ * the session it names and the rest.
+ */
+export const SessionToken = Schema.TemplateLiteralParser([VolumeId, ".", Schema.NonEmptyString]);
+export function isValidVolumeId(volumeId) {
+    return typeof volumeId === "string" && VOLUME_ID_PATTERN.test(volumeId);
+}
+export function assertValidVolumeId(volumeId) {
+    if (!isValidVolumeId(volumeId)) {
+        throw new Error(`invalid session volume id: ${JSON.stringify(volumeId)} (need 3–${VOLUME_ID_MAX} chars of [a-z0-9-], starting and ending with a letter or digit)`);
+    }
+    return volumeId;
+}
+/** A fresh volume id, e.g. `fs-1a2b3c4d5e`, valid by construction. */
+export function newVolumeId(random = () => crypto.randomUUID()) {
+    return `fs-${random().replace(/-/g, "").slice(0, 12)}`;
+}
+//# sourceMappingURL=names.js.map

package/dist/src/sandbox/names.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"names.js","sourceRoot":"","sources":["../../../../src/sandbox/names.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC;AAEhC,uFAAuF;AACvF,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,CAAC,GAAG,aAAa,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,IAAI,MAAM,CAAC,wBAAwB,aAAa,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;AAEjG,iEAAiE;AACjE,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC,CAAC;AAE1E;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;AAEjG,MAAM,UAAU,eAAe,CAAC,QAAiB;IAC/C,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAiB;IACnD,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,aAAa,kEAAkE,CAAC,CAAC;IACrK,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,WAAW,CAAC,MAAM,GAAiB,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE;IAC1E,OAAO,MAAM,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACzD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "alasio",
-  "version": "5.1.0",
+  "version": "6.0.0",
   "description": "alasio: coding agents you talk to from Telegram, installed and run with npx alasio",
   "type": "module",
   "license": "MIT",