alasio 7.0.0 → 9.0.0

package/dist/src/binder/tokens.js

@@ -0,0 +1,58 @@
+/**
+ * The binder's tokens, which say what they are for and are checked by the key that signed
+ * them alone, so whatever checks one holds no store of them, as the binder holds no state:
+ * `<claims>.<signature>`, the claims base64url JSON, the signature their HMAC-SHA256 under the
+ * key, base64url, compared in constant time.
+ *
+ * A caller's token names the key it may reach, when it stops, and what its key is bound with:
+ * what the binder's callers present, which the binder checks and never forwards. A binding's
+ * token names the key, the binding, its Lease's uid, so one minted for a binding is no
+ * other's, even of the same key, and the namespace its Lease is in: what the bound pod is
+ * given, to take its calls, and its telemetry, by (bindingToken).
+ */
+import { createHmac, timingSafeEqual } from "node:crypto";
+import { Option, Schema } from "effect";
+/**
+ * What a token says: the key it is for; the binding, and its Lease's namespace, for a
+ * binding's; and, for a caller's, the time it stops, in ms, and what its key is bound with
+ * where it is not bound yet, which the binder's gateway reads (as a session's environment and
+ * internet).
+ */
+export const TokenClaims = Schema.Struct({
+    key: Schema.String,
+    binding: Schema.optional(Schema.String),
+    namespace: Schema.optional(Schema.String),
+    expires: Schema.optional(Schema.Number),
+    options: Schema.optional(Schema.Record(Schema.String, Schema.String)),
+});
+const decodeClaims = Schema.decodeUnknownOption(Schema.fromJsonString(TokenClaims));
+const signatureOf = (secret, claims) => createHmac("sha256", secret).update(claims).digest();
+/** A token of `claims`, signed with `secret`. */
+export function mintToken(secret, claims) {
+    const encoded = Buffer.from(JSON.stringify(claims)).toString("base64url");
+    return `${encoded}.${signatureOf(secret, encoded).toString("base64url")}`;
+}
+/** The token of the binding `binding` of `key`, its Lease in `namespace`: the same text wherever it is minted, as its pod compares it whole. */
+export const bindingToken = (secret, { key, binding, namespace }) => mintToken(secret, { key, binding, namespace });
+/**
+ * What `token` says, where the key `secret` names of what it says signed it, as a key the
+ * claims choose (./names.ts environmentKey's), and it has not stopped by `now`; else null. Its claims
+ * are trusted only once its signature is checked by the key they named.
+ */
+export function verifyToken(secret, token, now) {
+    const dot = token.indexOf(".");
+    if (dot < 0)
+        return null;
+    const [encoded, signature] = [token.slice(0, dot), Buffer.from(token.slice(dot + 1), "base64url")];
+    const claims = decodeClaims(Buffer.from(encoded, "base64url").toString("utf8"));
+    if (Option.isNone(claims))
+        return null;
+    const key = typeof secret === "function" ? secret(claims.value) : secret;
+    if (key === null)
+        return null;
+    const expected = signatureOf(key, encoded);
+    if (signature.length !== expected.length || !timingSafeEqual(signature, expected))
+        return null;
+    return claims.value.expires !== undefined && claims.value.expires <= now ? null : claims.value;
+}
+//# sourceMappingURL=tokens.js.map

package/dist/src/binder/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../../../src/binder/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAExC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC;IACvC,GAAG,EAAE,MAAM,CAAC,MAAM;IAClB,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;IACvC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;IACzC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;IACvC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;CACtE,CAAC,CAAC;AAGH,MAAM,YAAY,GAAG,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,CAAC;AAEpF,MAAM,WAAW,GAAG,CAAC,MAAc,EAAE,MAAc,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AAErH,iDAAiD;AACjD,MAAM,UAAU,SAAS,CAAC,MAAc,EAAE,MAAmB;IAC3D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1E,OAAO,GAAG,OAAO,IAAI,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED,gJAAgJ;AAChJ,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAc,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAkF,EAAU,EAAE,CAClK,SAAS,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;AAEjD;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAAyD,EAAE,KAAa,EAAE,GAAW;IAC/G,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;IACnG,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAChF,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,GAAG,GAAG,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACzE,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/F,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;AACjG,CAAC"}

package/dist/src/branch/names.js

@@ -1,10 +1,20 @@
 /**
  * What a branch environment is called, and what it is known by, as alasio and its command
- * line both say it: its namespaces, the port its parent forks its sessions on, and its
- * token to ask with (./fork.ts). Free of anything but Node's own, so the command line
+ * line both say it: its namespaces and the label they and its objects carry, the port its
+ * parent forks its sessions on, and its token to ask with (./fork.ts). Free of anything but Node's own, so the command line
  * takes it without the server.
  */
 import { createHmac } from "node:crypto";
+/** The label of a branch environment's objects and namespaces, whose value is its name. */
+export const BRANCH_LABEL = "alasio.dev/branch";
+/**
+ * The label of a branch environment's sessions' namespace whose value is the environment it
+ * was branched from, its parent's, main's: the one the sandbox gateway forks sessions into it
+ * for (src/gateway/sessions.ts).
+ */
+export const BRANCH_PARENT_LABEL = "alasio.dev/branch-parent";
+/** The name of main's environment, as its sessions are told apart from a branch's. */
+export const MAIN_ENVIRONMENT_NAME = "main";
 /** The port an alasio forks its sessions for its branch environments on. */
 export const BRANCH_FORK_PORT = 4319;
 /** The namespace of the branch environment `branch`: its alasio, its compute and its lake, and their Secrets. */

package/dist/src/branch/names.js.map

@@ -1 +1 @@
-{"version":3,"file":"names.js","sourceRoot":"","sources":["../../../../src/branch/names.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,4EAA4E;AAC5E,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAErC,iHAAiH;AACjH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,iBAAiB,MAAM,EAAE,CAAC;AAErF,mEAAmE;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC;AAEzG,gGAAgG;AAChG,MAAM,UAAU,SAAS,CAAC,GAAW,EAAE,MAAc;IACnD,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,sBAAsB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAC9F,CAAC"}
+{"version":3,"file":"names.js","sourceRoot":"","sources":["../../../../src/branch/names.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,2FAA2F;AAC3F,MAAM,CAAC,MAAM,YAAY,GAAG,mBAAmB,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;AAE9D,sFAAsF;AACtF,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAE5C,4EAA4E;AAC5E,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAErC,iHAAiH;AACjH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,iBAAiB,MAAM,EAAE,CAAC;AAErF,mEAAmE;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC;AAEzG,gGAAgG;AAChG,MAAM,UAAU,SAAS,CAAC,GAAW,EAAE,MAAc;IACnD,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,sBAAsB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAC9F,CAAC"}

package/dist/src/events/names.js

@@ -0,0 +1,7 @@
+/**
+ * What an environment's events (./events.ts) are known by: their topic in the log. Free of
+ * anything but itself, so the command line, which makes the topic, takes it without the events.
+ */
+/** The events topic of the environment `environment`: main's, or its branch's. */
+export const eventsTopic = (environment) => `events.${environment}`;
+//# sourceMappingURL=names.js.map

package/dist/src/events/names.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"names.js","sourceRoot":"","sources":["../../../../src/events/names.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,kFAAkF;AAClF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,WAAmB,EAAU,EAAE,CAAC,UAAU,WAAW,EAAE,CAAC"}

package/dist/src/gateway/names.js

@@ -0,0 +1,201 @@
+/**
+ * What the sandbox gateway (./gateway.ts) and the session telemetry receiver
+ * (../receiver/receiver.ts) are configured by: their variables, and the gateway's
+ * configuration file. Free of anything but Effect's Schema and Node's own, so the command
+ * line, which renders them, takes it without either.
+ */
+import { createHash } from "node:crypto";
+import { posix } from "node:path";
+import { Schema } from "effect";
+import { keyHash } from "../binder/names.js";
+import { sanitizePathToken } from "../kube/sandbox-shape.js";
+import { ATTACH_ROOT } from "../node-agent/names.js";
+export { RESTORE_POD } from "../node-agent/names.js";
+/** The variable of the path of the gateway's configuration, a GatewayConfig as JSON. */
+export const GATEWAY_CONFIG_VARIABLE = "ALASIO_GATEWAY_CONFIG";
+/** The variables of the keys callers' tokens, and bindings', are signed with: the keys' text, as the stack's setup makes them. */
+export const CALLER_KEY_VARIABLE = "CALLER_KEY";
+export const BINDING_KEY_VARIABLE = "BINDING_KEY";
+/**
+ * The variables alasio reaches its environment's sessions through the gateway by: the gateway's
+ * address, its environment's name, as its callers' tokens name it, and its environment's own key
+ * of the gateway's caller key, which signs them (../binder/names.ts environmentKey).
+ */
+export const ALASIO_GATEWAY_URL_VARIABLE = "ALASIO_GATEWAY_URL";
+export const ALASIO_GATEWAY_ENVIRONMENT_VARIABLE = "ALASIO_GATEWAY_ENVIRONMENT";
+export const ALASIO_GATEWAY_CALLER_KEY_VARIABLE = "ALASIO_GATEWAY_CALLER_KEY";
+/** The variable that says the gateway serves alasio's folder workspaces' instances too: "1" where it does. */
+export const ALASIO_GATEWAY_FOLDERS_VARIABLE = "ALASIO_GATEWAY_FOLDERS";
+/** The variables of where the gateway tells of events (../events/events.ts): the log's brokers, its principal's name, and the file of its password. */
+export const EVENTS_BROKERS_VARIABLE = "EVENTS_BROKERS";
+export const EVENTS_USERNAME_VARIABLE = "EVENTS_USERNAME";
+export const EVENTS_PASSWORD_FILE_VARIABLE = "EVENTS_PASSWORD_FILE";
+/** The variables of the receiver's port, and of main's sessions' namespace, beside which it takes branch environments' bindings. */
+export const RECEIVER_PORT_VARIABLE = "RECEIVER_PORT";
+export const SESSIONS_NAMESPACE_VARIABLE = "SESSIONS_NAMESPACE";
+/** The variable of the folder namespace, whose folder conversations' instances' bindings the receiver takes too; empty where there are none. */
+export const FOLDERS_NAMESPACE_VARIABLE = "FOLDERS_NAMESPACE";
+/** The hash of `template`, of its JSON with every object's keys in order, as a pool's template records its own (cli/src/manifests/sandbox-gateway.ts poolTemplate). */
+export function templateHash(template) {
+    const sorted = (_key, value) => typeof value === "object" && value !== null && !Array.isArray(value) ? Object.fromEntries(Object.entries(value).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))) : value;
+    return createHash("sha256").update(JSON.stringify(template, sorted)).digest("hex");
+}
+/** The name of a restore's pod of the pool `pool`, by its random part, `suffix`, seven of base 36's digits, as RESTORE_POD matches it. */
+export const restorePodName = (pool, suffix) => `${pool}-restore-${suffix}`;
+/** The volume of a pool's pod's own directory on its node, which its workspace is attached under (cli/src/manifests/sandbox-gateway.ts poolTemplate). */
+export const ATTACH_VOLUME = "attach";
+/**
+ * The spec `spec`, a pool's template's, of a restore's pod named `name` in `namespace`: its own
+ * directory on its node named by its volume's path, not by a subpath of the directory of every
+ * pod's. A subpath is
+ * bound into its container alone, without what is mounted beneath it, as kubelet binds one; a
+ * volume's path is bound with it, so the workspace attached there before the pod is made is
+ * there as its restore reopens the files it held open.
+ */
+export function ownDirectory(spec, namespace, name) {
+    const unsubpathed = (container) => ({
+        ...container,
+        ...(container.volumeMounts
+            ? {
+                volumeMounts: container.volumeMounts.map((mount) => {
+                    if (mount.name !== ATTACH_VOLUME)
+                        return mount;
+                    const { subPathExpr: _subPath, ...own } = mount;
+                    return own;
+                }),
+            }
+            : {}),
+    });
+    return {
+        ...spec,
+        containers: spec.containers.map(unsubpathed),
+        ...(spec.initContainers ? { initContainers: spec.initContainers.map(unsubpathed) } : {}),
+        // One there already, as its node's agent made it, its workspace attached; kubelet makes none, so the pod starts not where it is not there.
+        ...(spec.volumes ? { volumes: spec.volumes.map((volume) => (volume.name === ATTACH_VOLUME ? { name: ATTACH_VOLUME, hostPath: { path: `${ATTACH_ROOT}/${namespace}/${name}`, type: "Directory" } } : volume)) } : {}),
+    };
+}
+/** The pool of folder instances, by its name, in the folder namespace: its Leases' and its pods' label (./folders.ts). */
+export const FOLDER_POOL = "folder";
+/** What a folder instance's key begins with: `folder:<harness>:<conversation>` (./folders.ts). */
+export const FOLDER_KEY_PREFIX = "folder:";
+/** A harness's name, as a folder instance's key carries it. */
+const HARNESS = /^[a-z][a-z0-9-]{0,30}$/u;
+/** The key of the folder instance of the conversation `conversation` under the harness `harness`. */
+export const folderKey = (harness, conversation) => `${FOLDER_KEY_PREFIX}${harness}:${conversation}`;
+/** The harness and conversation of the folder instance `key` is of; null where it is no folder instance's. */
+export function folderOfKey(key) {
+    if (!key.startsWith(FOLDER_KEY_PREFIX))
+        return null;
+    const rest = key.slice(FOLDER_KEY_PREFIX.length);
+    const at = rest.indexOf(":");
+    const [harness, conversation] = [rest.slice(0, Math.max(at, 0)), rest.slice(at + 1)];
+    return at > 0 && HARNESS.test(harness) && conversation.length > 0 && conversation.length <= 512 ? { harness, conversation } : null;
+}
+/**
+ * Where the folder instance of `conversation` under `harness` keeps its state, under
+ * `stateRoot`: bayma leases its state directory to a single server, and a Codex thread keeps
+ * its server alive after the conversation switches to Claude, so the directory is keyed by
+ * harness as well as conversation.
+ */
+export const folderStateDir = (stateRoot, harness, conversation) => posix.join(stateRoot, sanitizePathToken(harness), sanitizePathToken(conversation));
+/** The name of a folder instance's pod of `key`, by its random part, `suffix`, five of base 36's digits, as FOLDER_POD matches it. */
+export const folderPodName = (key, suffix) => `bayma-${keyHash(key).slice(0, 16)}-${suffix}`;
+export const FOLDER_POD = /^bayma-[0-9a-f]{16}-[0-9a-z]{5}$/u;
+/** The Secret of a folder instance's pod `pod`'s binding's token, which its bayma takes requests with, mounted where FOLDER_TOKEN_FILE is. */
+export const folderTokenSecret = (pod) => `${pod}-bayma-token`;
+const FOLDER_TOKEN_VOLUME = "alasio-bayma-token";
+const FOLDER_TOKEN_DIRECTORY = "/run/alasio/bayma";
+export const FOLDER_TOKEN_FILE = `${FOLDER_TOKEN_DIRECTORY}/token`;
+/**
+ * How long a folder instance's pod is given to stop: its bayma's CRIU dumps of its idle REPL
+ * sessions, one at a time, each within bayma's own 120 s; a state of the box's size is dumped
+ * in well under a minute (gate G8, program/13.4-folder-instances.md).
+ */
+export const FOLDER_STOP_SECONDS = 600;
+/** How long a folder instance's release, or its next bind, waits for its pod to be gone, past its stop. */
+export const FOLDER_GONE_MS = (FOLDER_STOP_SECONDS + 60) * 1000;
+/** How long a folder instance's bind gives its pod to run, and its bayma, once it runs, to answer. */
+export const FOLDER_START_MS = 120_000;
+/** How long it gives its pod to run while its image is still being pulled, as a node that has never run it pulls it first. */
+export const FOLDER_PULL_MS = 8 * 60_000;
+/**
+ * How long a folder instance's bind may take in all, given `pullMs` and `startMs`: a release
+ * of it under way, or its pod before, gone first; then its pod run, its image pulled; then its
+ * bayma answering. A bind of the key meanwhile waits as long for it.
+ */
+export const folderBindMs = (pullMs = FOLDER_PULL_MS, startMs = FOLDER_START_MS) => FOLDER_GONE_MS + pullMs + startMs;
+/**
+ * The spec of a folder instance's pod, `pod`, of the folder template's `spec`: its bayma
+ * given its binding's token, from its Secret, and its state directory, `stateDir`; stopped
+ * within FOLDER_STOP_SECONDS; and never started again, as a bayma that ended is a binding to
+ * release, not a container to start. Pure, as the gateway makes it and the folder pods' policy
+ * pins it (cli/src/manifests/admission.ts folderPodPolicy).
+ */
+export function folderPodSpec(spec, pod, stateDir) {
+    return {
+        ...spec,
+        terminationGracePeriodSeconds: FOLDER_STOP_SECONDS,
+        restartPolicy: "Never",
+        containers: spec.containers.map((container) => container.name !== "bayma" ? container : {
+            ...container,
+            args: [...(container.args ?? []), "--token-file", FOLDER_TOKEN_FILE, "--state-dir", stateDir],
+            volumeMounts: [...(container.volumeMounts ?? []), { name: FOLDER_TOKEN_VOLUME, mountPath: FOLDER_TOKEN_DIRECTORY, readOnly: true }],
+        }),
+        volumes: [...(spec.volumes ?? []), { name: FOLDER_TOKEN_VOLUME, secret: { secretName: folderTokenSecret(pod), defaultMode: 0o440 } }],
+    };
+}
+/** A pod template, as the gateway's configuration holds one: an object, as the API server takes it. */
+const Template = Schema.Record(Schema.String, Schema.Unknown);
+/**
+ * How main's sessions are snapshotted (./snapshots.ts), as alasio's own were: how often one whose
+ * execs run is saved live, the gVisor releases a snapshot is restored under, each by its
+ * RuntimeClass, the current one first, and each pool's template, by its sessions' internet, as
+ * `alasio up` renders it now and as it rendered it before it last changed, which a snapshot taken
+ * on it still restores onto, and nothing older.
+ */
+export const GatewaySnapshots = Schema.Struct({
+    liveEverySeconds: Schema.Number,
+    /** Each kept release, its RuntimeClass, and the checkpoint gofer a restore of a snapshot it took asks for, if any (../node-agent/names.ts goferOf). */
+    releases: Schema.Array(Schema.Struct({
+        release: Schema.String,
+        runtimeClassName: Schema.String,
+        gofer: Schema.NullOr(Schema.Struct({ transport: Schema.Literals(["socket", "tcp"]), pagesRetry: Schema.Boolean })),
+    })),
+    templates: Schema.Struct({
+        none: Schema.Struct({ current: Template, previous: Schema.NullOr(Template) }),
+        full: Schema.Struct({ current: Template, previous: Schema.NullOr(Template) }),
+    }),
+});
+/** The sandbox pods' policy, which holds every pod of a sessions' namespace to its pools' templates (cli/src/manifests/admission.ts sandboxPodPolicy). */
+export const SANDBOX_POD_POLICY = "alasio-sandbox-pods";
+/** The gateway's configuration, as `alasio up` renders it (cli/src/manifests/sandbox-gateway.ts). */
+export const GatewayConfig = Schema.Struct({
+    /** The port it serves on, and the host its replicas' headless Service resolves to, each at that port. */
+    port: Schema.Number,
+    peers: Schema.String,
+    /** The port pool pods' bayma serves on. */
+    podPort: Schema.Number,
+    /** How long a bind waits for a free pod, and an idle pod is kept. */
+    waitSeconds: Schema.Number,
+    releaseAfterSeconds: Schema.Number,
+    /** main's environment of sessions, by its name, and the namespace its pools are in; branch environments' are found (./environments.ts). */
+    environment: Schema.Struct({ name: Schema.String, namespace: Schema.String }),
+    /** The quota of a workspace the gateway makes, in bytes. */
+    quotaBytes: Schema.Number,
+    /** How main's sessions are snapshotted; none where they are not. */
+    snapshots: Schema.NullOr(GatewaySnapshots),
+    /** Each pool's name, by its sessions' internet. */
+    pools: Schema.Struct({ none: Schema.String, full: Schema.String }),
+    /** Where the node agents are. */
+    nodeAgents: Schema.Struct({ namespace: Schema.String, selector: Schema.String, port: Schema.Number }),
+    /** Where bound pods' bayma exports its telemetry, the session telemetry receiver's Service, by its name and port; none where none runs. */
+    receiver: Schema.NullOr(Schema.Struct({ host: Schema.String, port: Schema.Number })),
+    /**
+     * Folder conversations' instances (./folders.ts): the namespace they run in, the template of
+     * their pods, as `alasio up` renders it of the host profile, the directory under which each
+     * keeps its state, and how long an idle one is kept; none where the installation has no
+     * folder workspaces.
+     */
+    folders: Schema.NullOr(Schema.Struct({ namespace: Schema.String, template: Template, stateRoot: Schema.String, releaseAfterSeconds: Schema.Number })),
+});
+//# sourceMappingURL=names.js.map

package/dist/src/gateway/names.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"names.js","sourceRoot":"","sources":["../../../../src/gateway/names.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAGlC,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD,wFAAwF;AACxF,MAAM,CAAC,MAAM,uBAAuB,GAAG,uBAAuB,CAAC;AAC/D,kIAAkI;AAClI,MAAM,CAAC,MAAM,mBAAmB,GAAG,YAAY,CAAC;AAChD,MAAM,CAAC,MAAM,oBAAoB,GAAG,aAAa,CAAC;AAElD;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,oBAAoB,CAAC;AAChE,MAAM,CAAC,MAAM,mCAAmC,GAAG,4BAA4B,CAAC;AAChF,MAAM,CAAC,MAAM,kCAAkC,GAAG,2BAA2B,CAAC;AAC9E,8GAA8G;AAC9G,MAAM,CAAC,MAAM,+BAA+B,GAAG,wBAAwB,CAAC;AAExE,uJAAuJ;AACvJ,MAAM,CAAC,MAAM,uBAAuB,GAAG,gBAAgB,CAAC;AACxD,MAAM,CAAC,MAAM,wBAAwB,GAAG,iBAAiB,CAAC;AAC1D,MAAM,CAAC,MAAM,6BAA6B,GAAG,sBAAsB,CAAC;AAEpE,oIAAoI;AACpI,MAAM,CAAC,MAAM,sBAAsB,GAAG,eAAe,CAAC;AACtD,MAAM,CAAC,MAAM,2BAA2B,GAAG,oBAAoB,CAAC;AAChE,gJAAgJ;AAChJ,MAAM,CAAC,MAAM,0BAA0B,GAAG,mBAAmB,CAAC;AAE9D,uKAAuK;AACvK,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,KAAc,EAAW,EAAE,CACvD,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5K,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACrF,CAAC;AAED,0IAA0I;AAC1I,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAY,EAAE,MAAc,EAAU,EAAE,CAAC,GAAG,IAAI,YAAY,MAAM,EAAE,CAAC;AAEpG,yJAAyJ;AACzJ,MAAM,CAAC,MAAM,aAAa,GAAG,QAAQ,CAAC;AAEtC;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,IAAe,EAAE,SAAiB,EAAE,IAAY;IAC3E,MAAM,WAAW,GAAG,CAAC,SAAsB,EAAe,EAAE,CAAC,CAAC;QAC5D,GAAG,SAAS;QACZ,GAAG,CAAC,SAAS,CAAC,YAAY;YACxB,CAAC,CAAC;gBACA,YAAY,EAAE,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;oBACjD,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa;wBAAE,OAAO,KAAK,CAAC;oBAC/C,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,GAAG,EAAE,GAAG,KAAK,CAAC;oBAChD,OAAO,GAAG,CAAC;gBACb,CAAC,CAAC;aACH;YACD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IACH,OAAO;QACL,GAAG,IAAI;QACP,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC;QAC5C,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,2IAA2I;QAC3I,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,WAAW,IAAI,SAAS,IAAI,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrN,CAAC;AACJ,CAAC;AAED,0HAA0H;AAC1H,MAAM,CAAC,MAAM,WAAW,GAAG,QAAQ,CAAC;AAEpC,kGAAkG;AAClG,MAAM,CAAC,MAAM,iBAAiB,GAAG,SAAS,CAAC;AAE3C,+DAA+D;AAC/D,MAAM,OAAO,GAAG,yBAAyB,CAAC;AAE1C,qGAAqG;AACrG,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,OAAe,EAAE,YAAoB,EAAU,EAAE,CAAC,GAAG,iBAAiB,GAAG,OAAO,IAAI,YAAY,EAAE,CAAC;AAE7H,8GAA8G;AAC9G,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,iBAAiB,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACrF,OAAO,EAAE,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACrI,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,SAAiB,EAAE,OAAe,EAAE,YAAoB,EAAU,EAAE,CACjG,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC;AAErF,sIAAsI;AACtI,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAW,EAAE,MAAc,EAAU,EAAE,CAAC,SAAS,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,EAAE,CAAC;AACrH,MAAM,CAAC,MAAM,UAAU,GAAG,mCAAmC,CAAC;AAE9D,8IAA8I;AAC9I,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,GAAG,GAAG,cAAc,CAAC;AAC/E,MAAM,mBAAmB,GAAG,oBAAoB,CAAC;AACjD,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AACnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,sBAAsB,QAAQ,CAAC;AAEnE;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEvC,2GAA2G;AAC3G,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,mBAAmB,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;AAChE,sGAAsG;AACtG,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC;AACvC,8HAA8H;AAC9H,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAG,MAAM,CAAC;AACzC;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAM,GAAG,cAAc,EAAE,OAAO,GAAG,eAAe,EAAU,EAAE,CAAC,cAAc,GAAG,MAAM,GAAG,OAAO,CAAC;AAE9H;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,IAAe,EAAE,GAAW,EAAE,QAAgB;IAC1E,OAAO;QACL,GAAG,IAAI;QACP,6BAA6B,EAAE,mBAAmB;QAClD,aAAa,EAAE,OAAO;QACtB,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAC5C,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;YACvC,GAAG,SAAS;YACZ,IAAI,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,cAAc,EAAE,iBAAiB,EAAE,aAAa,EAAE,QAAQ,CAAC;YAC7F,YAAY,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,SAAS,EAAE,sBAAsB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;SACpI,CACF;QACD,OAAO,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,iBAAiB,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,CAAC;KACtI,CAAC;AACJ,CAAC;AAED,uGAAuG;AACvG,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;AAE9D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC5C,gBAAgB,EAAE,MAAM,CAAC,MAAM;IAC/B,uJAAuJ;IACvJ,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;QACnC,OAAO,EAAE,MAAM,CAAC,MAAM;QACtB,gBAAgB,EAAE,MAAM,CAAC,MAAM;QAC/B,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;KACnH,CAAC,CAAC;IACH,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;QACvB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7E,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;KAC9E,CAAC;CACH,CAAC,CAAC;AAGH,0JAA0J;AAC1J,MAAM,CAAC,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AAExD,qGAAqG;AACrG,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;IACzC,yGAAyG;IACzG,IAAI,EAAE,MAAM,CAAC,MAAM;IACnB,KAAK,EAAE,MAAM,CAAC,MAAM;IACpB,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC,MAAM;IACtB,qEAAqE;IACrE,WAAW,EAAE,MAAM,CAAC,MAAM;IAC1B,mBAAmB,EAAE,MAAM,CAAC,MAAM;IAClC,2IAA2I;IAC3I,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAC7E,4DAA4D;IAC5D,UAAU,EAAE,MAAM,CAAC,MAAM;IACzB,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC;IAC1C,mDAAmD;IACnD,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAClE,iCAAiC;IACjC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IACrG,2IAA2I;IAC3I,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACpF;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;CACtJ,CAAC,CAAC"}

package/dist/src/harness/names.js

@@ -0,0 +1,49 @@
+/**
+ * Harness identifiers shared by persistence, operator controls, and runtime selection.
+ *
+ * A harness is the agent runtime alasio drives for a Telegram conversation. Each
+ * conversation has at most one active harness at a time; the other harness keeps
+ * its own parked session pointer so switching never mounts a foreign session.
+ *
+ * A conversation starts with no harness mounted. Until the operator chooses one
+ * through /service, alasio only ever answers with the service picker. The
+ * `null` harness is therefore a real state, not a fallback, and callers must
+ * not coerce it to a default.
+ */
+export const CODEX_HARNESS = "codex";
+export const CLAUDE_HARNESS = "claude";
+export const HARNESS_NAMES = Object.freeze([CODEX_HARNESS, CLAUDE_HARNESS]);
+const DISPLAY_NAMES = Object.freeze({
+    [CODEX_HARNESS]: "Codex",
+    [CLAUDE_HARNESS]: "Claude",
+});
+export function isHarnessName(candidate) {
+    const names = HARNESS_NAMES;
+    return typeof candidate === "string" && names.includes(candidate);
+}
+export function normalizeHarnessName(candidate, fallback = CODEX_HARNESS) {
+    if (typeof candidate !== "string") {
+        return fallback;
+    }
+    const lowered = candidate.trim().toLowerCase();
+    if (lowered === "claude" || lowered === "claude-code" || lowered === "claude_code" || lowered === "claudecode" || lowered === "claude code") {
+        return CLAUDE_HARNESS;
+    }
+    if (lowered === "codex") {
+        return CODEX_HARNESS;
+    }
+    return fallback;
+}
+export function harnessDisplayName(harness) {
+    return (harness && DISPLAY_NAMES[harness]) ?? DISPLAY_NAMES[CODEX_HARNESS];
+}
+/**
+ * Harness pre-mounted on newly created conversations.
+ *
+ * Neutral by default: returns null unless ALASIO_DEFAULT_HARNESS opts into a
+ * harness, in which case new conversations skip the picker.
+ */
+export function getDefaultHarness(env = process.env) {
+    return normalizeHarnessName(env["ALASIO_DEFAULT_HARNESS"], null);
+}
+//# sourceMappingURL=names.js.map

package/dist/src/harness/names.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"names.js","sourceRoot":"","sources":["../../../../src/harness/names.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC;AACrC,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC;AACvC,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,cAAc,CAAU,CAAC,CAAC;AAKrF,MAAM,aAAa,GAA0C,MAAM,CAAC,MAAM,CAAC;IACzE,CAAC,aAAa,CAAC,EAAE,OAAO;IACxB,CAAC,cAAc,CAAC,EAAE,QAAQ;CAC3B,CAAC,CAAC;AAEH,MAAM,UAAU,aAAa,CAAC,SAAkB;IAC9C,MAAM,KAAK,GAAsB,aAAa,CAAC;IAC/C,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AACpE,CAAC;AAID,MAAM,UAAU,oBAAoB,CAAC,SAAkB,EAAE,QAAQ,GAAuB,aAAa;IACnG,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,aAAa,IAAI,OAAO,KAAK,aAAa,IAAI,OAAO,KAAK,YAAY,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;QAC5I,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAA2B;IAC5D,OAAO,CAAC,OAAO,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC,IAAI,aAAa,CAAC,aAAa,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IACpE,OAAO,oBAAoB,CAAC,GAAG,CAAC,wBAAwB,CAAC,EAAE,IAAI,CAAC,CAAC;AACnE,CAAC"}

package/dist/src/kube/sandbox-shape.js

@@ -1,49 +1,28 @@
 /**
- * What alasio adds to a workspace's Sandbox over the template its installation gives it
- * (../kube/config.ts): bayma's token, mounted from a Secret of the Sandbox's, and passed
- * as a file; the labels that name the Sandbox and say what it is; and, of a session's,
- * its internet's gate and DNS (../sandbox/index.ts), and of a folder's bayma, its state
- * directory (../mcp/bayma.ts). In one place, with no dependency, so the admission policy
- * that holds alasio to its templates (cli/src/manifests/admission.ts) knows it as they do.
+ * What alasio's pods of bayma carry, beyond their templates, that more than one of its
+ * parts knows: the gateway that binds them (../gateway/), the node agents that snapshot and
+ * restore them (../node-agent/), and the admission policies that hold them to what alasio
+ * up renders (cli/src/manifests/admission.ts). In one place, with no dependency, so the
+ * command line takes it as it is.
  */
-/** The container in every Sandbox's pod that runs bayma. */
+/** The container of a session's or a folder instance's pod that runs bayma. */
 export const BAYMA_CONTAINER = "bayma";
-/** Where a Sandbox's token Secret is mounted in its bayma container, its key, and its volume. */
-export const TOKEN_DIR = "/run/alasio/bayma";
-export const TOKEN_KEY = "token";
-export const TOKEN_VOLUME = "alasio-bayma-token";
-/** The token volume's files' mode: readable by the pod's group, which is how a non-root bayma reads it. */
-export const TOKEN_MODE = 0o440;
-/** The file bayma reads its token from, which a restored Sandbox's new token replaces. */
-export const TOKEN_FILE = `${TOKEN_DIR}/${TOKEN_KEY}`;
-/** The arguments bayma is given after its template's: where its token is. */
-export const TOKEN_FILE_ARGS = ["--token-file", TOKEN_FILE];
-/** The arguments a session's bayma is given after those when it exports telemetry: the token it exports with, read from the same file for each export. */
-export const TELEMETRY_TOKEN_FILE_ARGS = ["--telemetry-token-file", TOKEN_FILE];
-/** The name of a Sandbox's token Secret. */
-export function tokenSecretName(name) {
-    return `${name}-bayma-token`;
-}
-/** The label every object alasio makes carries, and the one that names its Sandbox. */
-export const MANAGED_BY = { "app.kubernetes.io/managed-by": "alasio" };
-export const SANDBOX_LABEL = "alasio.dev/sandbox";
-/** What a Sandbox's pod is to alasio: a session's, or a folder's bayma's. */
-export const WORKLOAD_LABEL = "alasio.dev/workload";
 /** A session's internet, `none` or `full`, which its NetworkPolicies follow. */
 export const NET_MODE_LABEL = "alasio.dev/net-mode";
-/** The harness a folder's bayma serves, as a path segment. */
-export const HARNESS_LABEL = "alasio.dev/harness";
-/** The resolvers a session with internet uses unless its template names others. */
-export const DEFAULT_FULL_MODE_NAMESERVERS = ["1.1.1.1", "8.8.8.8"];
-/** The argument a folder's bayma is given its state directory by, under its template's state root. */
-export const STATE_DIR_ARG = "--state-dir";
+/**
+ * The argument a session's bayma is given how long it holds a stop by, for alasio to
+ * snapshot it first (bayma's mcp-http help): a bayma run without it holds none.
+ */
+export const STOP_WAIT_ARG = "--stop-wait-ms";
+/** How long a session's bayma takes to stop once it holds its stop no more: it persists its sessions. */
+export const BAYMA_STOP_SECONDS = 30;
 /** A path segment from `value`: never empty, nor starting with a dot. */
 export function sanitizePathToken(value) {
     return String(value).replace(/[^A-Za-z0-9_.-]+/g, "-").replace(/^[-.]+|-+$/g, "") || "default";
 }
 /**
  * What a session's pod template carries of its whole-sandbox snapshots
- * (../sandbox/snapshots.ts): the hash of the template it was made from, which its
+ * (../gateway/snapshots.ts): the hash of the template it was made from, which its
  * snapshots record; the CPU features its sandbox is held to; and, of a pod restored from
  * a snapshot, the image it is restored from, on its node under the snapshot cache, left
  * paused until its node's agent resumes it, which its readiness gate waits for.
@@ -57,42 +36,13 @@ export const RESTORE_ANNOTATION = "dev.gvisor.internal.restore.host-image-path";
 export const RESTORE_PAUSED_ANNOTATION = "dev.gvisor.internal.restore.paused";
 /** The condition of a restored pod's readiness gate, which alasio sets once its sandbox is resumed. */
 export const RESUMED_CONDITION = "alasio.dev/resumed";
-/**
- * The annotation of a suspended Sandbox naming the snapshot its pod was saved into, which
- * alone it may be restored from: set as it is suspended, removed as it is next resumed,
- * from that snapshot or not, so a snapshot outlives no resume of its Sandbox's.
- */
-export const SNAPSHOT_ANNOTATION = "alasio.dev/snapshot";
-/**
- * The annotation naming the gVisor release that took the snapshot SNAPSHOT_ANNOTATION
- * names, beside it, the only one that restores it: `alasio up` keeps every release one
- * names (cli/src/kept-releases.ts).
- */
-export const SNAPSHOT_RELEASE_ANNOTATION = "alasio.dev/snapshot-release";
 /** Where a node agent keeps the snapshots it prepares, as `<environment>/<workspace>/<snapshot>` (../node-agent/cache.ts). */
 export const SNAPSHOT_CACHE_DIR = "/var/lib/alasio/snapshots";
-/** A snapshot's id, as a node agent names it: when it was taken, then 32 random bits. */
-export const SNAPSHOT_ID = "[0-9]{8}T[0-9]{6}Z-[0-9a-f]{8}";
-/** A DNS label: an environment's name (its sessions' namespace) and a workspace's (its Sandbox's), as the snapshot cache's directories are named. */
-export const NAME = /^[a-z0-9]([-a-z0-9]{0,61}[a-z0-9])?$/u;
-/** The init container that holds a session's pod until its egress is confined: its name, and its resources. */
-export const EGRESS_GATE = { name: "egress-gate", resources: { requests: { cpu: "10m", memory: "32Mi" }, limits: { memory: "64Mi" } } };
 /**
- * The egress gate's program: exits once three connections in a row to the API server
- * fail, and fails the pod if they still succeed after two minutes. Runs on the agent
- * image's Node.
+ * A snapshot's id, as a node agent names it: when it was taken, to the millisecond, so a
+ * workspace's ids sort as its snapshots were taken, then 32 random bits.
  */
-export const EGRESS_GATE_SCRIPT = [
-    "const net = require('node:net');",
-    "const host = process.env.KUBERNETES_SERVICE_HOST, port = Number(process.env.KUBERNETES_SERVICE_PORT);",
-    "const deadline = Date.now() + 120000; let refused = 0;",
-    "(function probe() {",
-    "  const socket = net.connect({ host, port, timeout: 1000 });",
-    "  const next = (blocked) => { socket.destroy(); refused = blocked ? refused + 1 : 0;",
-    "    if (refused >= 3) process.exit(0);",
-    "    if (Date.now() > deadline) { console.error('egress is not confined: is NetworkPolicy enforced in this cluster?'); process.exit(1); }",
-    "    setTimeout(probe, 250); };",
-    "  socket.once('connect', () => next(false)); socket.once('timeout', () => next(true)); socket.once('error', () => next(true));",
-    "})();",
-].join("\n");
+export const SNAPSHOT_ID = "[0-9]{8}T[0-9]{9}Z-[0-9a-f]{8}";
+/** A DNS label: an environment's name (its sessions' namespace) and a workspace's, as the snapshot cache's directories are named. */
+export const NAME = /^[a-z0-9]([-a-z0-9]{0,61}[a-z0-9])?$/u;
 //# sourceMappingURL=sandbox-shape.js.map

package/dist/src/kube/sandbox-shape.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-shape.js","sourceRoot":"","sources":["../../../../src/kube/sandbox-shape.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,4DAA4D;AAC5D,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC;AAEvC,iGAAiG;AACjG,MAAM,CAAC,MAAM,SAAS,GAAG,mBAAmB,CAAC;AAC7C,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC;AACjC,MAAM,CAAC,MAAM,YAAY,GAAG,oBAAoB,CAAC;AACjD,2GAA2G;AAC3G,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,CAAC;AAChC,0FAA0F;AAC1F,MAAM,CAAC,MAAM,UAAU,GAAG,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC;AAEtD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAsB,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;AAC/E,0JAA0J;AAC1J,MAAM,CAAC,MAAM,yBAAyB,GAAsB,CAAC,wBAAwB,EAAE,UAAU,CAAC,CAAC;AAEnG,4CAA4C;AAC5C,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,GAAG,IAAI,cAAc,CAAC;AAC/B,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,MAAM,UAAU,GAAG,EAAE,8BAA8B,EAAE,QAAQ,EAAW,CAAC;AAChF,MAAM,CAAC,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAElD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AACpD,gFAAgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AACpD,8DAA8D;AAC9D,MAAM,CAAC,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAElD,mFAAmF;AACnF,MAAM,CAAC,MAAM,6BAA6B,GAAsB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AAEvF,sGAAsG;AACtG,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAC;AAE3C,yEAAyE;AACzE,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC;AACjG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,6BAA6B,CAAC;AACzE,oGAAoG;AACpG,MAAM,CAAC,MAAM,uBAAuB,GAAG,iCAAiC,CAAC;AACzE,0GAA0G;AAC1G,MAAM,CAAC,MAAM,kBAAkB,GAAG,6CAA6C,CAAC;AAChF,yGAAyG;AACzG,MAAM,CAAC,MAAM,yBAAyB,GAAG,oCAAoC,CAAC;AAC9E,uGAAuG;AACvG,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AACtD;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AACzD;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,6BAA6B,CAAC;AACzE,8HAA8H;AAC9H,MAAM,CAAC,MAAM,kBAAkB,GAAG,2BAA2B,CAAC;AAC9D,yFAAyF;AACzF,MAAM,CAAC,MAAM,WAAW,GAAG,gCAAgC,CAAC;AAC5D,qJAAqJ;AACrJ,MAAM,CAAC,MAAM,IAAI,GAAG,uCAAuC,CAAC;AAE5D,+GAA+G;AAC/G,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAW,CAAC;AAEjJ;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,kCAAkC;IAClC,uGAAuG;IACvG,wDAAwD;IACxD,qBAAqB;IACrB,8DAA8D;IAC9D,sFAAsF;IACtF,wCAAwC;IACxC,0IAA0I;IAC1I,gCAAgC;IAChC,gIAAgI;IAChI,OAAO;CACR,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC"}
+{"version":3,"file":"sandbox-shape.js","sourceRoot":"","sources":["../../../../src/kube/sandbox-shape.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC;AAEvC,gFAAgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAEpD;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,gBAAgB,CAAC;AAE9C,yGAAyG;AACzG,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAErC,yEAAyE;AACzE,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC;AACjG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,6BAA6B,CAAC;AACzE,oGAAoG;AACpG,MAAM,CAAC,MAAM,uBAAuB,GAAG,iCAAiC,CAAC;AACzE,0GAA0G;AAC1G,MAAM,CAAC,MAAM,kBAAkB,GAAG,6CAA6C,CAAC;AAChF,yGAAyG;AACzG,MAAM,CAAC,MAAM,yBAAyB,GAAG,oCAAoC,CAAC;AAC9E,uGAAuG;AACvG,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AACtD,8HAA8H;AAC9H,MAAM,CAAC,MAAM,kBAAkB,GAAG,2BAA2B,CAAC;AAC9D;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,gCAAgC,CAAC;AAC5D,qIAAqI;AACrI,MAAM,CAAC,MAAM,IAAI,GAAG,uCAAuC,CAAC"}