ysk-server-core 1.0.0

package/dist/agents/install.js

@@ -0,0 +1,154 @@
+import { tl } from 'ysk-server-shared';
+/**
+ * Apply agent runtime install plan under EXECUTE policy (never fake success).
+ */
+import { mkdirSync, writeFileSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { planAgentInstall, parseAgentKind } from './runtime.js';
+import { renderAgentSystemdUnit, probeAgentRuntime, resolveAgentBinary } from './probe.js';
+/**
+ * Write install dir + unit under dataDir; optionally run install commands + systemctl enable.
+ */
+export async function applyAgentInstall(input) {
+    const kind = parseAgentKind(typeof input.kind === 'string' ? input.kind : input.kind);
+    const plan = planAgentInstall(kind);
+    const installPath = plan.runtime.installPath ?? `/opt/ysk-server/agents/${kind}`;
+    const notes = [...plan.supervision];
+    const written = [];
+    const commandResults = [];
+    // Always write managed artifacts under dataDir
+    const managedDir = join(input.dataDir, 'agents', kind);
+    mkdirSync(managedDir, { recursive: true });
+    const readme = join(managedDir, 'README.txt');
+    writeFileSync(readme, [
+        `YSK managed agent: ${kind}`,
+        `Target install path: ${installPath}`,
+        'Commands:',
+        ...plan.commands.map((c) => `  ${c}`),
+        '',
+        'Binaries:',
+        ...plan.binNames.map((b) => `  - ${b}`),
+        '',
+        'Supervision:',
+        ...plan.supervision.map((s) => `  - ${s}`),
+        '',
+    ].join('\n'), 'utf8');
+    written.push(readme);
+    const want = Boolean(input.execute);
+    const can = want && input.host.executeEnabled();
+    let enabled = false;
+    let binaryPath;
+    if (want && !can) {
+        notes.push(tl('ops.blocked.install'));
+    }
+    if (can) {
+        const mk = await input.host.runCommand(['mkdir', '-p', installPath], { timeoutMs: 10_000 });
+        commandResults.push({
+            argv: ['mkdir', '-p', installPath],
+            exitCode: mk.exitCode,
+            stderr: mk.stderr,
+        });
+        if (mk.exitCode !== 0) {
+            notes.push(`mkdir ${installPath} failed (need root for /opt?): ${mk.stderr}`);
+        }
+        for (const cmd of plan.commands) {
+            // Skip redundant mkdir already done; keep npm install honest (no || true)
+            if (cmd.startsWith('mkdir -p '))
+                continue;
+            const r = await input.host.runCommand(['bash', '-c', cmd], { timeoutMs: 180_000 });
+            commandResults.push({
+                argv: ['bash', '-c', cmd],
+                exitCode: r.exitCode,
+                stderr: r.stderr,
+            });
+            notes.push(`${cmd} => exit ${r.exitCode}`);
+            if (r.exitCode !== 0) {
+                notes.push(tl('notes.auto.t0498', { v0: ((r.stderr || r.stdout).slice(0, 300)) }));
+            }
+        }
+    }
+    // Resolve binary after install attempt (or probe existing)
+    binaryPath = await resolveAgentBinary(kind, input.host);
+    if (binaryPath)
+        notes.push(`CLI binary: ${binaryPath}`);
+    else
+        notes.push(tl('notes.auto.n0844'));
+    const unitsDir = join(input.dataDir, 'systemd');
+    mkdirSync(unitsDir, { recursive: true });
+    const unitName = `ysk-agent-${kind}.service`;
+    const unitPath = join(unitsDir, unitName);
+    const unit = renderAgentSystemdUnit({
+        kind,
+        installPath,
+        nodePath: input.nodePath ?? process.execPath,
+        binaryPath,
+    });
+    writeFileSync(unitPath, unit, 'utf8');
+    written.push(unitPath);
+    notes.push(`Unit template: ${unitPath}${binaryPath ? ' (real ExecStart)' : ' (fail-closed, no binary)'}`);
+    if (can && input.enableUnit !== false) {
+        if (!binaryPath) {
+            notes.push(tl('notes.auto.n0871'));
+        }
+        else if (!input.host.isRoot()) {
+            notes.push(tl('notes.auto.n1155'));
+        }
+        else {
+            const cp = await input.host.runCommand(['cp', unitPath, `/etc/systemd/system/${unitName}`], { timeoutMs: 10_000 });
+            commandResults.push({
+                argv: ['cp', unitPath, `/etc/systemd/system/${unitName}`],
+                exitCode: cp.exitCode,
+                stderr: cp.stderr,
+            });
+            const reload = await input.host.runCommand(['systemctl', 'daemon-reload'], {
+                timeoutMs: 15_000,
+            });
+            commandResults.push({
+                argv: ['systemctl', 'daemon-reload'],
+                exitCode: reload.exitCode,
+                stderr: reload.stderr,
+            });
+            const en = await input.host.runCommand(['systemctl', 'enable', '--now', unitName], {
+                timeoutMs: 30_000,
+            });
+            commandResults.push({
+                argv: ['systemctl', 'enable', '--now', unitName],
+                exitCode: en.exitCode,
+                stderr: en.stderr,
+            });
+            enabled = cp.exitCode === 0 && en.exitCode === 0;
+            notes.push(enabled ? `systemd enabled ${unitName}` : `systemd enable failed: ${en.stderr}`);
+        }
+    }
+    const probe = await probeAgentRuntime(kind, input.host);
+    const ranOk = commandResults.every((c) => c.exitCode === 0);
+    // execute path: all cmds ok + binary present (enable optional)
+    // plan-only: artifacts written only
+    const ok = want ? can && ranOk && Boolean(binaryPath) : true;
+    if (want && can && ranOk && !binaryPath) {
+        notes.push(tl('notes.auto.n0348'));
+    }
+    return {
+        ok,
+        kind,
+        written,
+        commandResults,
+        notes,
+        requiresExecute: !input.host.executeEnabled(),
+        requiresRoot: !input.host.isRoot(),
+        enabled,
+        binaryPath,
+        probe,
+    };
+}
+/** Ensure install path marker file exists under dataDir for non-root demos */
+export function markAgentManaged(dataDir, kind) {
+    const dir = join(dataDir, 'agents', kind);
+    mkdirSync(dir, { recursive: true });
+    const marker = join(dir, 'managed.json');
+    if (!existsSync(marker)) {
+        writeFileSync(marker, JSON.stringify({ kind, managedAt: new Date().toISOString() }, null, 2), 'utf8');
+    }
+    return marker;
+}
+//# sourceMappingURL=install.js.map

package/dist/agents/install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.js","sourceRoot":"","sources":["../../src/agents/install.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAe3F;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAQvC;IACC,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtF,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,0BAA0B,IAAI,EAAE,CAAC;IACjF,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;IACpC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,cAAc,GAAyC,EAAE,CAAC;IAEhE,+CAA+C;IAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACvD,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC9C,aAAa,CACX,MAAM,EACN;QACE,sBAAsB,IAAI,EAAE;QAC5B,wBAAwB,WAAW,EAAE;QACrC,WAAW;QACX,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,EAAE;QACF,WAAW;QACX,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,EAAE;QACF,cAAc;QACd,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,MAAM,CACP,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAErB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;IAChD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,UAA8B,CAAC;IAEnC,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACjB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5F,cAAc,CAAC,IAAI,CAAC;YAClB,IAAI,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC;YAClC,QAAQ,EAAE,EAAE,CAAC,QAAQ;YACrB,MAAM,EAAE,EAAE,CAAC,MAAM;SAClB,CAAC,CAAC;QACH,IAAI,EAAE,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YACtB,KAAK,CAAC,IAAI,CAAC,SAAS,WAAW,kCAAkC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChC,0EAA0E;YAC1E,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC;gBAAE,SAAS;YAC1C,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;YACnF,cAAc,CAAC,IAAI,CAAC;gBAClB,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC;gBACzB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,MAAM,EAAE,CAAC,CAAC,MAAM;aACjB,CAAC,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC3C,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBACrB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;IACH,CAAC;IAED,2DAA2D;IAC3D,UAAU,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,UAAU;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,UAAU,EAAE,CAAC,CAAC;;QACnD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAExC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAChD,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,aAAa,IAAI,UAAU,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,sBAAsB,CAAC;QAClC,IAAI;QACJ,WAAW;QACX,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ;QAC5C,UAAU;KACX,CAAC,CAAC;IACH,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,KAAK,CAAC,IAAI,CAAC,kBAAkB,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,2BAA2B,EAAE,CAAC,CAAC;IAE1G,IAAI,GAAG,IAAI,KAAK,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;QACtC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACrC,CAAC;aAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YAChC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CACpC,CAAC,IAAI,EAAE,QAAQ,EAAE,uBAAuB,QAAQ,EAAE,CAAC,EACnD,EAAE,SAAS,EAAE,MAAM,EAAE,CACtB,CAAC;YACF,cAAc,CAAC,IAAI,CAAC;gBAClB,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,uBAAuB,QAAQ,EAAE,CAAC;gBACzD,QAAQ,EAAE,EAAE,CAAC,QAAQ;gBACrB,MAAM,EAAE,EAAE,CAAC,MAAM;aAClB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,eAAe,CAAC,EAAE;gBACzE,SAAS,EAAE,MAAM;aAClB,CAAC,CAAC;YACH,cAAc,CAAC,IAAI,CAAC;gBAClB,IAAI,EAAE,CAAC,WAAW,EAAE,eAAe,CAAC;gBACpC,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE;gBACjF,SAAS,EAAE,MAAM;aAClB,CAAC,CAAC;YACH,cAAc,CAAC,IAAI,CAAC;gBAClB,IAAI,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC;gBAChD,QAAQ,EAAE,EAAE,CAAC,QAAQ;gBACrB,MAAM,EAAE,EAAE,CAAC,MAAM;aAClB,CAAC,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,KAAK,CAAC,CAAC;YACjD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,QAAQ,EAAE,CAAC,CAAC,CAAC,0BAA0B,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC;IAC5D,+DAA+D;IAC/D,oCAAoC;IACpC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE7D,IAAI,IAAI,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,OAAO;QACL,EAAE;QACF,IAAI;QACJ,OAAO;QACP,cAAc;QACd,KAAK;QACL,eAAe,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE;QAC7C,YAAY,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE;QAClC,OAAO;QACP,UAAU;QACV,KAAK;KACN,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,IAAY;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC1C,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IACzC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,aAAa,CACX,MAAM,EACN,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EACtE,MAAM,CACP,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/agents/outbound-agent.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Outbound fleet agent loop — polls control plane for commands and acks results.
+ */
+export interface OutboundAgentOptions {
+    controlPlane: string;
+    agentId: string;
+    group?: string;
+    intervalMs?: number;
+    fetchImpl?: typeof fetch;
+    onCommand?: (cmd: {
+        id: string;
+        payload: unknown;
+    }) => Promise<unknown> | unknown;
+    signal?: AbortSignal;
+    /** Enrollment token for unauthenticated edge register (YSK_FLEET_ENROLL_TOKEN). */
+    enrollToken?: string;
+    /** Panel bearer when enrolling via authenticated panel API. */
+    panelToken?: string;
+    /** Persisted agent secret from previous register (preferred over re-register). */
+    agentToken?: string;
+}
+/**
+ * Register, heartbeat, pull commands, execute handler, ack — one cycle.
+ */
+export declare function agentCycle(opts: OutboundAgentOptions & {
+    sessionId?: string;
+    agentToken?: string;
+}): Promise<{
+    sessionId: string;
+    agentToken: string;
+    heartbeated: boolean;
+    commandsHandled: number;
+}>;
+/**
+ * Run agent loop until aborted.
+ */
+export declare function runOutboundAgent(opts: OutboundAgentOptions): Promise<void>;
+/** Detect failed CLI/handler payload so fleet history marks status=error. */
+export declare function isCommandFailure(result: unknown): boolean;
+//# sourceMappingURL=outbound-agent.d.ts.map

package/dist/agents/outbound-agent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbound-agent.d.ts","sourceRoot":"","sources":["../../src/agents/outbound-agent.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IAClF,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,mFAAmF;IACnF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+DAA+D;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,oBAAoB,GAAG;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GACvE,OAAO,CAAC;IACT,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC,CAkFD;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBhF;AAgBD,6EAA6E;AAC7E,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAOzD"}

package/dist/agents/outbound-agent.js

@@ -0,0 +1,135 @@
+/**
+ * Outbound fleet agent loop — polls control plane for commands and acks results.
+ */
+/**
+ * Register, heartbeat, pull commands, execute handler, ack — one cycle.
+ */
+export async function agentCycle(opts) {
+    const fetchFn = opts.fetchImpl ?? fetch;
+    const base = opts.controlPlane.replace(/\/$/, '');
+    let sessionId = opts.sessionId;
+    let agentToken = opts.agentToken;
+    if (!sessionId || !agentToken) {
+        const headers = { 'Content-Type': 'application/json' };
+        if (opts.panelToken)
+            headers.Authorization = `Bearer ${opts.panelToken}`;
+        if (opts.enrollToken)
+            headers['X-Ysk-Enroll'] = opts.enrollToken;
+        const reg = await fetchFn(`${base}/api/v1/fleet/agents/register`, {
+            method: 'POST',
+            headers,
+            body: JSON.stringify({
+                agentId: opts.agentId,
+                group: opts.group,
+                meta: { source: 'edge' },
+                enrollToken: opts.enrollToken,
+            }),
+        });
+        if (!reg.ok) {
+            throw new Error(`register failed: HTTP ${reg.status}`);
+        }
+        const body = (await reg.json());
+        sessionId = body.id;
+        agentToken = body.token;
+        if (!agentToken) {
+            throw new Error('register failed: no agent token in response');
+        }
+    }
+    const agentHeaders = {
+        'X-Ysk-Agent-Token': agentToken,
+        Authorization: `Bearer ${agentToken}`,
+    };
+    const hb = await fetchFn(`${base}/api/v1/fleet/agents/${sessionId}/heartbeat`, {
+        method: 'POST',
+        headers: agentHeaders,
+    });
+    if (!hb.ok) {
+        throw new Error(`heartbeat failed: HTTP ${hb.status}`);
+    }
+    const pull = await fetchFn(`${base}/api/v1/fleet/agents/${sessionId}/commands`, {
+        headers: agentHeaders,
+    });
+    if (!pull.ok) {
+        throw new Error(`pull commands failed: HTTP ${pull.status}`);
+    }
+    const { items } = (await pull.json());
+    let handled = 0;
+    for (const cmd of items ?? []) {
+        let result;
+        let err = false;
+        try {
+            result = opts.onCommand
+                ? await opts.onCommand(cmd)
+                : {
+                    ok: false,
+                    agentId: opts.agentId,
+                    error: 'no command handler — refuse silent echo success',
+                    payload: cmd.payload,
+                };
+            // CLI / handler results: non-zero exit or ok:false → error status in history
+            if (isCommandFailure(result))
+                err = true;
+        }
+        catch (e) {
+            err = true;
+            result = { error: e instanceof Error ? e.message : String(e), ok: false };
+        }
+        await fetchFn(`${base}/api/v1/fleet/commands/${cmd.id}/ack`, {
+            method: 'POST',
+            headers: { ...agentHeaders, 'Content-Type': 'application/json' },
+            body: JSON.stringify({ result, error: err }),
+        }).catch(() => undefined);
+        handled += 1;
+    }
+    return { sessionId, agentToken, heartbeated: true, commandsHandled: handled };
+}
+/**
+ * Run agent loop until aborted.
+ */
+export async function runOutboundAgent(opts) {
+    const interval = opts.intervalMs ?? 5000;
+    let sessionId;
+    let agentToken = opts.agentToken;
+    while (!opts.signal?.aborted) {
+        try {
+            const r = await agentCycle({ ...opts, sessionId, agentToken });
+            sessionId = r.sessionId;
+            agentToken = r.agentToken;
+        }
+        catch (e) {
+            // reconnect next tick
+            sessionId = undefined;
+            if (opts.signal?.aborted)
+                break;
+            void e;
+        }
+        await sleep(interval, opts.signal);
+    }
+}
+function sleep(ms, signal) {
+    return new Promise((resolve) => {
+        if (signal?.aborted) {
+            resolve();
+            return;
+        }
+        const t = setTimeout(resolve, ms);
+        signal?.addEventListener('abort', () => {
+            clearTimeout(t);
+            resolve();
+        });
+    });
+}
+/** Detect failed CLI/handler payload so fleet history marks status=error. */
+export function isCommandFailure(result) {
+    if (result == null || typeof result !== 'object')
+        return false;
+    const r = result;
+    if (r.ok === false)
+        return true;
+    if (typeof r.exitCode === 'number' && r.exitCode !== 0)
+        return true;
+    if (typeof r.error === 'string' && r.error.length > 0 && r.ok !== true)
+        return true;
+    return false;
+}
+//# sourceMappingURL=outbound-agent.js.map

package/dist/agents/outbound-agent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbound-agent.js","sourceRoot":"","sources":["../../src/agents/outbound-agent.ts"],"names":[],"mappings":"AAAA;;GAEG;AAkBH;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAwE;IAOxE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAElD,IAAI,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAC/B,IAAI,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACjC,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,EAAE,CAAC;QAC9B,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;QAC/E,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,CAAC,aAAa,GAAG,UAAU,IAAI,CAAC,UAAU,EAAE,CAAC;QACzE,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC;QACjE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,+BAA+B,EAAE;YAChE,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;gBACxB,WAAW,EAAE,IAAI,CAAC,WAAW;aAC9B,CAAC;SACH,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmC,CAAC;QAClE,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC;QACpB,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAA2B;QAC3C,mBAAmB,EAAE,UAAU;QAC/B,aAAa,EAAE,UAAU,UAAU,EAAE;KACtC,CAAC;IAEF,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,wBAAwB,SAAS,YAAY,EAAE;QAC7E,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,YAAY;KACtB,CAAC,CAAC;IACH,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,0BAA0B,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,wBAAwB,SAAS,WAAW,EAAE;QAC9E,OAAO,EAAE,YAAY;KACtB,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAEnC,CAAC;IAEF,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,GAAG,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;QAC9B,IAAI,MAAe,CAAC;QACpB,IAAI,GAAG,GAAG,KAAK,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,SAAS;gBACrB,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;gBAC3B,CAAC,CAAC;oBACE,EAAE,EAAE,KAAK;oBACT,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,KAAK,EAAE,iDAAiD;oBACxD,OAAO,EAAE,GAAG,CAAC,OAAO;iBACrB,CAAC;YACN,6EAA6E;YAC7E,IAAI,gBAAgB,CAAC,MAAM,CAAC;gBAAE,GAAG,GAAG,IAAI,CAAC;QAC3C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,GAAG,IAAI,CAAC;YACX,MAAM,GAAG,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QAC5E,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,IAAI,0BAA0B,GAAG,CAAC,EAAE,MAAM,EAAE;YAC3D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,GAAG,YAAY,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAChE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;SAC7C,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC,CAAC;IACf,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;AAChF,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAA0B;IAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC;IACzC,IAAI,SAA6B,CAAC;IAClC,IAAI,UAAU,GAAuB,IAAI,CAAC,UAAU,CAAC;IACrD,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;YAC/D,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;YACxB,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,sBAAsB;YACtB,SAAS,GAAG,SAAS,CAAC;YACtB,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO;gBAAE,MAAM;YAChC,KAAK,CAAC,CAAC;QACT,CAAC;QACD,MAAM,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,EAAU,EAAE,MAAoB;IAC7C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,OAAO,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,MAAM,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAClC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE;YACrC,YAAY,CAAC,CAAC,CAAC,CAAC;YAChB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB,CAAC,MAAe;IAC9C,IAAI,MAAM,IAAI,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC/D,MAAM,CAAC,GAAG,MAAiC,CAAC;IAC5C,IAAI,CAAC,CAAC,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACpF,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/agents/probe.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Probe managed AI agent runtimes on disk + systemd (real host truth).
+ */
+import type { AgentRuntimeDto, AgentRuntimeKind } from 'ysk-server-shared';
+import type { HostExecutor } from '../host/executor.js';
+export interface AgentRuntimeProbe extends AgentRuntimeDto {
+    pathExists: boolean;
+    unitActive?: string;
+    unitName: string;
+    installPlan: string[];
+    supervision: string[];
+    notes: string[];
+    probedAt: string;
+    /** Absolute path to CLI if found */
+    binaryPath?: string;
+}
+/**
+ * Probe all catalog runtimes.
+ */
+export declare function probeAllAgentRuntimes(host: HostExecutor): Promise<AgentRuntimeProbe[]>;
+/**
+ * Resolve first available binary for a kind (HostSoftwareProbe PATH rules).
+ */
+export declare function resolveAgentBinary(kind: AgentRuntimeKind | string, host: HostExecutor): Promise<string | undefined>;
+/**
+ * Probe a single runtime: install path, optional binary, systemd unit.
+ */
+export declare function probeAgentRuntime(kind: AgentRuntimeKind | string, host: HostExecutor): Promise<AgentRuntimeProbe>;
+/**
+ * Write a systemd unit for an agent.
+ * When binaryPath is set → real ExecStart.
+ * When missing → unit stays disabled template with honest comment (install refuses enable).
+ */
+export declare function renderAgentSystemdUnit(opts: {
+    kind: AgentRuntimeKind;
+    installPath: string;
+    nodePath?: string;
+    user?: string;
+    /** Real CLI absolute path — required for production enable */
+    binaryPath?: string;
+    /** Extra args after binary */
+    binaryArgs?: string[];
+}): string;
+//# sourceMappingURL=probe.d.ts.map

package/dist/agents/probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe.d.ts","sourceRoot":"","sources":["../../src/agents/probe.ts"],"names":[],"mappings":"AACA;;GAEG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAIxD,MAAM,WAAW,iBAAkB,SAAQ,eAAe;IACxD,UAAU,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,oCAAoC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAO5F;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,gBAAgB,GAAG,MAAM,EAC/B,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAe7B;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,gBAAgB,GAAG,MAAM,EAC/B,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,iBAAiB,CAAC,CA6C5B;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,IAAI,EAAE,gBAAgB,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8BAA8B;IAC9B,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB,GAAG,MAAM,CAmCT"}

package/dist/agents/probe.js

@@ -0,0 +1,129 @@
+import { tl } from 'ysk-server-shared';
+import { listAgentRuntimes, parseAgentKind, planAgentInstall } from './runtime.js';
+import { resolveBin } from '../hosting/software-probe/index.js';
+/**
+ * Probe all catalog runtimes.
+ */
+export async function probeAllAgentRuntimes(host) {
+    const kinds = listAgentRuntimes().map((r) => r.kind);
+    const out = [];
+    for (const kind of kinds) {
+        out.push(await probeAgentRuntime(kind, host));
+    }
+    return out;
+}
+/**
+ * Resolve first available binary for a kind (HostSoftwareProbe PATH rules).
+ */
+export async function resolveAgentBinary(kind, host) {
+    const k = typeof kind === 'string' ? parseAgentKind(kind) : kind;
+    const plan = planAgentInstall(k);
+    const names = plan.binNames.length
+        ? plan.binNames
+        : [k, plan.runtime.name.toLowerCase()];
+    for (const n of names) {
+        try {
+            const p = await resolveBin(host, n);
+            if (p)
+                return p;
+        }
+        catch {
+            /* invalid name skip */
+        }
+    }
+    return undefined;
+}
+/**
+ * Probe a single runtime: install path, optional binary, systemd unit.
+ */
+export async function probeAgentRuntime(kind, host) {
+    const k = typeof kind === 'string' ? parseAgentKind(kind) : kind;
+    const plan = planAgentInstall(k);
+    const path = plan.runtime.installPath ?? `/opt/ysk-server/agents/${k}`;
+    const pathExists = host.pathExists(path);
+    const unitName = `ysk-agent-${k}.service`;
+    const notes = [];
+    let unitActive;
+    if (host.pathExists('/bin/systemctl') || host.pathExists('/usr/bin/systemctl')) {
+        const r = await host.runCommand(['systemctl', 'is-active', unitName], { timeoutMs: 5_000 });
+        unitActive = (r.stdout || r.stderr || `exit_${r.exitCode}`).trim();
+        notes.push(tl('notes.auto.t0494', { v0: (unitActive) }));
+    }
+    else {
+        notes.push(tl('notes.auto.n1035'));
+    }
+    const binaryPath = await resolveAgentBinary(k, host);
+    if (binaryPath)
+        notes.push(tl('notes.auto.t0495', { v0: (binaryPath) }));
+    else
+        notes.push(tl('notes.auto.n0519'));
+    let status = 'unknown';
+    if (unitActive === 'active') {
+        // active unit with only placeholder is still "running" but probe notes honesty
+        status = 'running';
+        if (!binaryPath) {
+            notes.push(tl('notes.auto.n1431'));
+        }
+    }
+    else if (pathExists || binaryPath)
+        status = 'stopped';
+    else
+        status = 'not_installed';
+    return {
+        kind: k,
+        name: plan.runtime.name,
+        status,
+        installPath: path,
+        pathExists,
+        unitActive,
+        unitName,
+        installPlan: plan.commands,
+        supervision: plan.supervision,
+        notes,
+        binaryPath,
+        probedAt: new Date().toISOString(),
+    };
+}
+/**
+ * Write a systemd unit for an agent.
+ * When binaryPath is set → real ExecStart.
+ * When missing → unit stays disabled template with honest comment (install refuses enable).
+ */
+export function renderAgentSystemdUnit(opts) {
+    const user = opts.user ?? 'root';
+    const args = (opts.binaryArgs ?? []).map((a) => JSON.stringify(a)).join(' ');
+    let execStart;
+    let comment;
+    if (opts.binaryPath) {
+        execStart = args
+            ? `${opts.binaryPath} ${args}`
+            : opts.binaryPath;
+        comment = `# Real agent binary: ${opts.binaryPath}`;
+    }
+    else {
+        // Fail-closed: Type=oneshot that exits non-zero so enable --now cannot look healthy
+        const node = opts.nodePath ?? '/usr/bin/node';
+        execStart = `${node} -e "console.error('ysk-agent-${opts.kind}: no CLI binary installed — refuse to run placeholder'); process.exit(1)"`;
+        comment =
+            '# No CLI binary detected — unit exits 1 (not a silent success placeholder)';
+    }
+    return `[Unit]
+Description=YSK managed AI agent (${opts.kind})
+After=network.target ysk-server.service
+
+[Service]
+Type=simple
+User=${user}
+WorkingDirectory=${opts.installPath}
+Environment=NODE_ENV=production
+Environment=YSK_AGENT_KIND=${opts.kind}
+${comment}
+ExecStart=${execStart}
+Restart=on-failure
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+//# sourceMappingURL=probe.js.map

package/dist/agents/probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe.js","sourceRoot":"","sources":["../../src/agents/probe.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAOvC,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACnF,OAAO,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAC;AAchE;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAkB;IAC5D,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,GAAG,CAAC,IAAI,CAAC,MAAM,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAA+B,EAC/B,IAAkB;IAElB,MAAM,CAAC,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM;QAChC,CAAC,CAAC,IAAI,CAAC,QAAQ;QACf,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACpC,IAAI,CAAC;gBAAE,OAAO,CAAC,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,uBAAuB;QACzB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAA+B,EAC/B,IAAkB;IAElB,MAAM,CAAC,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,0BAA0B,CAAC,EAAE,CAAC;IACvE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,CAAC;IAC1C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,UAA8B,CAAC;IAEnC,IAAI,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC/E,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5F,UAAU,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACnE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3D,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACrD,IAAI,UAAU;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;;QACpE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAExC,IAAI,MAAM,GAA8B,SAAS,CAAC;IAClD,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,+EAA+E;QAC/E,MAAM,GAAG,SAAS,CAAC;QACnB,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;SAAM,IAAI,UAAU,IAAI,UAAU;QAAE,MAAM,GAAG,SAAS,CAAC;;QACnD,MAAM,GAAG,eAAe,CAAC;IAE9B,OAAO;QACL,IAAI,EAAE,CAAC;QACP,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;QACvB,MAAM;QACN,WAAW,EAAE,IAAI;QACjB,UAAU;QACV,UAAU;QACV,QAAQ;QACR,WAAW,EAAE,IAAI,CAAC,QAAQ;QAC1B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,KAAK;QACL,UAAU;QACV,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACnC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAStC;IACC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC;IACjC,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7E,IAAI,SAAiB,CAAC;IACtB,IAAI,OAAe,CAAC;IACpB,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,SAAS,GAAG,IAAI;YACd,CAAC,CAAC,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,EAAE;YAC9B,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;QACpB,OAAO,GAAG,wBAAwB,IAAI,CAAC,UAAU,EAAE,CAAC;IACtD,CAAC;SAAM,CAAC;QACN,oFAAoF;QACpF,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAC;QAC9C,SAAS,GAAG,GAAG,IAAI,iCAAiC,IAAI,CAAC,IAAI,2EAA2E,CAAC;QACzI,OAAO;YACL,4EAA4E,CAAC;IACjF,CAAC;IACD,OAAO;oCAC2B,IAAI,CAAC,IAAI;;;;;OAKtC,IAAI;mBACQ,IAAI,CAAC,WAAW;;6BAEN,IAAI,CAAC,IAAI;EACpC,OAAO;YACG,SAAS;;;;;;CAMpB,CAAC;AACF,CAAC"}

package/dist/agents/runtime.d.ts

@@ -0,0 +1,25 @@
+/**
+ * AI agent runtime management for OpenClaw / Hermes / IonClaw.
+ * Install commands must not mask failure with `|| true`.
+ */
+import type { AgentRuntimeDto, AgentRuntimeKind } from 'ysk-server-shared';
+export type AgentCatalogEntry = {
+    name: string;
+    defaultInstallPath: string;
+    /** npm package(s) to install globally (real exit codes) */
+    npmPackages: string[];
+    /** CLI binary names to probe after install (first found wins for ExecStart) */
+    binNames: string[];
+    installCommands: string[];
+};
+export declare function getAgentCatalogEntry(kind: AgentRuntimeKind): AgentCatalogEntry;
+export declare function listAgentRuntimes(): AgentRuntimeDto[];
+export declare function planAgentInstall(kind: AgentRuntimeKind): {
+    runtime: AgentRuntimeDto;
+    commands: string[];
+    supervision: string[];
+    binNames: string[];
+    npmPackages: string[];
+};
+export declare function parseAgentKind(value: string): AgentRuntimeKind;
+//# sourceMappingURL=runtime.d.ts.map

package/dist/agents/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/agents/runtime.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAG3E,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,kBAAkB,EAAE,MAAM,CAAC;IAC3B,2DAA2D;IAC3D,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B,CAAC;AAmCF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,gBAAgB,GAAG,iBAAiB,CAE9E;AAED,wBAAgB,iBAAiB,IAAI,eAAe,EAAE,CAOrD;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,GAAG;IACxD,OAAO,EAAE,eAAe,CAAC;IACzB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB,CAwBA;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,gBAAgB,CAO9D"}

package/dist/agents/runtime.js

@@ -0,0 +1,82 @@
+/**
+ * AI agent runtime management for OpenClaw / Hermes / IonClaw.
+ * Install commands must not mask failure with `|| true`.
+ */
+import { ErrorCodes, YskError, tl } from 'ysk-server-shared';
+const CATALOG = {
+    openclaw: {
+        name: 'OpenClaw',
+        defaultInstallPath: '/opt/ysk-server/agents/openclaw',
+        npmPackages: ['openclaw'],
+        binNames: ['openclaw'],
+        installCommands: [
+            'mkdir -p /opt/ysk-server/agents/openclaw',
+            'npm install -g openclaw',
+        ],
+    },
+    hermes: {
+        name: 'Hermes',
+        defaultInstallPath: '/opt/ysk-server/agents/hermes',
+        npmPackages: ['@hermes-agent/cli'],
+        binNames: ['hermes', 'hermes-agent'],
+        installCommands: [
+            'mkdir -p /opt/ysk-server/agents/hermes',
+            'npm install -g @hermes-agent/cli',
+        ],
+    },
+    ionclaw: {
+        name: 'IonClaw',
+        defaultInstallPath: '/opt/ysk-server/agents/ionclaw',
+        npmPackages: ['ionclaw'],
+        binNames: ['ionclaw'],
+        installCommands: [
+            'mkdir -p /opt/ysk-server/agents/ionclaw',
+            'npm install -g ionclaw',
+        ],
+    },
+};
+export function getAgentCatalogEntry(kind) {
+    return CATALOG[kind];
+}
+export function listAgentRuntimes() {
+    return Object.keys(CATALOG).map((kind) => ({
+        kind,
+        name: CATALOG[kind].name,
+        status: 'unknown',
+        installPath: CATALOG[kind].defaultInstallPath,
+    }));
+}
+export function planAgentInstall(kind) {
+    const entry = CATALOG[kind];
+    if (!entry) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.t0496', { v0: (kind) }), {
+            httpStatus: 400,
+        });
+    }
+    return {
+        runtime: {
+            kind,
+            name: entry.name,
+            status: 'stopped',
+            installPath: entry.defaultInstallPath,
+        },
+        commands: entry.installCommands,
+        binNames: entry.binNames,
+        npmPackages: entry.npmPackages,
+        supervision: [
+            `systemd unit: ysk-agent-${kind}.service`,
+            'All agent tool calls must pass YSK Allowlist + Approval',
+            'Agent role RBAC capped at write-low',
+            'ExecStart uses real CLI binary when present — never a silent placeholder as success',
+        ],
+    };
+}
+export function parseAgentKind(value) {
+    if (value === 'openclaw' || value === 'hermes' || value === 'ionclaw') {
+        return value;
+    }
+    throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.t0497', { v0: (value) }), {
+        httpStatus: 400,
+    });
+}
+//# sourceMappingURL=runtime.js.map

package/dist/agents/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../src/agents/runtime.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAC,MAAM,mBAAmB,CAAC;AAY5D,MAAM,OAAO,GAAgD;IAC3D,QAAQ,EAAE;QACR,IAAI,EAAE,UAAU;QAChB,kBAAkB,EAAE,iCAAiC;QACrD,WAAW,EAAE,CAAC,UAAU,CAAC;QACzB,QAAQ,EAAE,CAAC,UAAU,CAAC;QACtB,eAAe,EAAE;YACf,0CAA0C;YAC1C,yBAAyB;SAC1B;KACF;IACD,MAAM,EAAE;QACN,IAAI,EAAE,QAAQ;QACd,kBAAkB,EAAE,+BAA+B;QACnD,WAAW,EAAE,CAAC,mBAAmB,CAAC;QAClC,QAAQ,EAAE,CAAC,QAAQ,EAAE,cAAc,CAAC;QACpC,eAAe,EAAE;YACf,wCAAwC;YACxC,kCAAkC;SACnC;KACF;IACD,OAAO,EAAE;QACP,IAAI,EAAE,SAAS;QACf,kBAAkB,EAAE,gCAAgC;QACpD,WAAW,EAAE,CAAC,SAAS,CAAC;QACxB,QAAQ,EAAE,CAAC,SAAS,CAAC;QACrB,eAAe,EAAE;YACf,yCAAyC;YACzC,wBAAwB;SACzB;KACF;CACF,CAAC;AAEF,MAAM,UAAU,oBAAoB,CAAC,IAAsB;IACzD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAQ,MAAM,CAAC,IAAI,CAAC,OAAO,CAAwB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACjE,IAAI;QACJ,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI;QACxB,MAAM,EAAE,SAAS;QACjB,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,kBAAkB;KAC9C,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAsB;IAOrD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;YAChF,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IACD,OAAO;QACL,OAAO,EAAE;YACP,IAAI;YACJ,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,SAAS;YACjB,WAAW,EAAE,KAAK,CAAC,kBAAkB;SACtC;QACD,QAAQ,EAAE,KAAK,CAAC,eAAe;QAC/B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE;YACX,2BAA2B,IAAI,UAAU;YACzC,yDAAyD;YACzD,qCAAqC;YACrC,qFAAqF;SACtF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACtE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE;QACjF,UAAU,EAAE,GAAG;KAChB,CAAC,CAAC;AACL,CAAC"}