Add D601 Tekton CI

2026-05-17 03:22:55 +00:00
parent 857b4bc298
commit 1cafe6da6a
12 changed files with 1309 additions and 1 deletions
@@ -0,0 +1,165 @@
+interface TimingSample {
+  label: string;
+  method: string;
+  url: string;
+  ok: boolean;
+  status: number;
+  durationMs: number;
+  bytes: number;
+  error: string | null;
+}
+
+export {};
+
+function envNumber(name: string, fallback: number): number {
+  const raw = process.env[name];
+  if (raw === undefined || raw.length === 0) return fallback;
+  const value = Number(raw);
+  if (!Number.isFinite(value) || value <= 0) throw new Error(`${name} must be a positive number`);
+  return Math.floor(value);
+}
+
+function baseUrl(): string {
+  return (process.env.CI_CODE_QUEUE_URL ?? "http://code-queue-ci-read.unidesk-ci.svc.cluster.local:4222").replace(/\/+$/u, "");
+}
+
+async function fetchSample(label: string, url: string, timeoutMs = 30_000): Promise<TimingSample> {
+  const started = performance.now();
+  try {
+    const response = await fetch(url, { signal: AbortSignal.timeout(timeoutMs) });
+    const text = await response.text();
+    return {
+      label,
+      method: "GET",
+      url,
+      ok: response.ok,
+      status: response.status,
+      durationMs: Math.round((performance.now() - started) * 10) / 10,
+      bytes: text.length,
+      error: null,
+    };
+  } catch (error) {
+    return {
+      label,
+      method: "GET",
+      url,
+      ok: false,
+      status: 0,
+      durationMs: Math.round((performance.now() - started) * 10) / 10,
+      bytes: 0,
+      error: error instanceof Error ? error.message : String(error),
+    };
+  }
+}
+
+function percentile(values: number[], percentileValue: number): number {
+  if (values.length === 0) return 0;
+  const sorted = values.slice().sort((left, right) => left - right);
+  if (percentileValue <= 0) return sorted[0] ?? 0;
+  if (percentileValue >= 100) return sorted[sorted.length - 1] ?? 0;
+  const index = Math.min(sorted.length - 1, Math.max(0, Math.ceil((percentileValue / 100) * sorted.length) - 1));
+  return sorted[index] ?? 0;
+}
+
+async function candidateTaskIds(url: string): Promise<string[]> {
+  const response = await fetch(`${url}/api/tasks/overview?limit=24&transcriptLimit=0&compact=1&selected=1&includeActive=0&stats=0&skipTrace=1`, {
+    signal: AbortSignal.timeout(30_000),
+  });
+  const body = await response.json() as { selected?: { task?: { id?: string } }; tasks?: Array<{ id?: string }> };
+  const ids = [
+    body.selected?.task?.id,
+    ...(body.tasks ?? []).map((task) => task.id),
+  ].filter((id): id is string => typeof id === "string" && id.length > 0);
+  return [...new Set(ids)];
+}
+
+async function traceSeq(url: string, taskId: string): Promise<number | null> {
+  const response = await fetch(`${url}/api/tasks/${encodeURIComponent(taskId)}/trace-steps?tail=1&limit=8`, {
+    signal: AbortSignal.timeout(30_000),
+  });
+  const body = await response.json() as { steps?: Array<{ seq?: number }> };
+  const seq = body.steps?.find((step) => Number.isFinite(Number(step.seq)))?.seq;
+  if (!Number.isFinite(Number(seq))) return null;
+  return Number(seq);
+}
+
+async function traceTarget(url: string): Promise<{ taskId: string; seq: number; skippedTaskIds: string[] }> {
+  const ids = await candidateTaskIds(url);
+  if (ids.length === 0) throw new Error("Code Queue CI perf could not find a task id in the production PostgreSQL task table");
+  const skippedTaskIds: string[] = [];
+  for (const taskId of ids) {
+    const seq = await traceSeq(url, taskId);
+    if (seq !== null) return { taskId, seq, skippedTaskIds };
+    skippedTaskIds.push(taskId);
+  }
+  throw new Error(`Code Queue CI perf could not find a task with trace steps among ${ids.length} candidates: ${skippedTaskIds.join(",")}`);
+}
+
+async function measureFirstPaint(url: string): Promise<Record<string, unknown>> {
+  const sample = await fetchSample("code-queue-read-first-paint-proxy", `${url}/api/tasks/overview?limit=12&transcriptLimit=1&compact=1&selected=0&includeActive=0&stats=0&skipTrace=1`, 60_000);
+  return {
+    ok: sample.ok,
+    url: sample.url,
+    firstPaintMs: sample.durationMs,
+    apiTimings: [sample],
+    consoleErrors: [],
+    note: "Code Queue service is API-only in k3s; this measures the first overview payload used by the frontend Code Queue page.",
+  };
+}
+
+async function main(): Promise<void> {
+  const url = baseUrl();
+  const budgets = {
+    firstPaintMs: envNumber("FIRST_PAINT_BUDGET_MS", 2000),
+    traceSummaryMs: envNumber("TRACE_SUMMARY_BUDGET_MS", 700),
+    traceStepsMs: envNumber("TRACE_STEPS_BUDGET_MS", 900),
+    traceStepDetailMs: envNumber("TRACE_STEP_DETAIL_BUDGET_MS", 700),
+    overviewP95Ms: envNumber("OVERVIEW_P95_BUDGET_MS", 900),
+  };
+  const health = await fetchSample("health", `${url}/health`);
+  if (!health.ok) throw new Error(`Code Queue CI read health failed: ${JSON.stringify(health)}`);
+  const target = await traceTarget(url);
+  const { taskId, seq } = target;
+  const firstPaint = await measureFirstPaint(url);
+  const traceSummary = await fetchSample("trace-summary", `${url}/api/tasks/${encodeURIComponent(taskId)}/trace-summary`);
+  const traceSteps = await fetchSample("trace-steps", `${url}/api/tasks/${encodeURIComponent(taskId)}/trace-steps?tail=1&limit=20`);
+  const traceStepDetail = await fetchSample("trace-step-detail", `${url}/api/tasks/${encodeURIComponent(taskId)}/trace-step?seq=${encodeURIComponent(String(seq))}`);
+  const overviewSamples: TimingSample[] = [];
+  for (let index = 0; index < 10; index += 1) {
+    overviewSamples.push(await fetchSample("overview", `${url}/api/tasks/overview?limit=12&transcriptLimit=1&compact=1&selected=0&includeActive=0&stats=0&skipTrace=1&__ci=${Date.now()}-${index}`));
+  }
+  const overviewSuccessful = overviewSamples.filter((sample) => sample.ok).map((sample) => sample.durationMs);
+  const overviewP95Ms = Math.round(percentile(overviewSuccessful, 95) * 10) / 10;
+  const firstPaintMs = Number((firstPaint as { firstPaintMs?: number }).firstPaintMs ?? 0);
+  const checks = [
+    { name: "first-paint", ok: firstPaintMs <= budgets.firstPaintMs, valueMs: firstPaintMs, budgetMs: budgets.firstPaintMs },
+    { name: "trace-summary", ok: traceSummary.ok && traceSummary.durationMs <= budgets.traceSummaryMs, valueMs: traceSummary.durationMs, budgetMs: budgets.traceSummaryMs },
+    { name: "trace-steps", ok: traceSteps.ok && traceSteps.durationMs <= budgets.traceStepsMs, valueMs: traceSteps.durationMs, budgetMs: budgets.traceStepsMs },
+    { name: "trace-step-detail", ok: traceStepDetail.ok && traceStepDetail.durationMs <= budgets.traceStepDetailMs, valueMs: traceStepDetail.durationMs, budgetMs: budgets.traceStepDetailMs },
+    { name: "overview-p95", ok: overviewSamples.every((sample) => sample.ok) && overviewP95Ms <= budgets.overviewP95Ms, valueMs: overviewP95Ms, budgetMs: budgets.overviewP95Ms },
+  ];
+  const result = {
+    ok: checks.every((check) => check.ok),
+    measuredAt: new Date().toISOString(),
+    url,
+    taskId,
+    seq,
+    skippedTaskIds: target.skippedTaskIds,
+    budgets,
+    checks,
+    health,
+    firstPaint,
+    traceSummary,
+    traceSteps,
+    traceStepDetail,
+    overview: {
+      p50Ms: Math.round(percentile(overviewSuccessful, 50) * 10) / 10,
+      p95Ms: overviewP95Ms,
+      samples: overviewSamples,
+    },
+  };
+  console.log(JSON.stringify(result, null, 2));
+  if (!result.ok) process.exitCode = 1;
+}
+
+await main();
@@ -13,6 +13,7 @@ import { runCodeQueueDeployCompatCommand, runDeployCommand } from "./src/deploy"
 import { runProviderCommand } from "./src/provider-attach";
 import { runScheduleCommand } from "./src/schedules";
 import { parseNetworkPerfOptions, runNetworkPerf } from "./src/network-perf";
+import { runCiCommand } from "./src/ci";

 const remoteOptions = extractRemoteCliOptions(process.argv.slice(2));
 const args = remoteOptions.args;
@@ -58,6 +59,7 @@ function help(): unknown {
      { command: "debug dispatch [providerId] [docker.ps|provider.upgrade|host.ssh|microservice.http|echo] [--wait-ms N]", description: "Submit a real internal-core dispatch request for CLI debugging." },
      { command: "debug task <taskId|latest>", description: "Read a dispatched task record from internal core for CLI debugging." },
      { command: "network perf [--service code-queue --path /api/tasks/overview?limit=30 --count N --concurrency N --label before|after]", description: "Benchmark frontend -> backend-core -> provider/adapter user-service networking and report latency/proxy-mode distributions." },
+      { command: "ci install|status|run|logs", description: "Manage D601 k3s Tekton CI only; does not deploy CD. CI reads the production PostgreSQL through a temporary read-only Code Queue service." },
      { command: "e2e run [--only pattern[,pattern...]] [--skip pattern[,pattern...]]", description: "Run selected public/internal/Playwright E2E checks; use --only for focused iteration and rerun without filters for final regression." },
    ],
  };
@@ -247,6 +249,11 @@ async function main(): Promise<void> {
    return;
  }

+  if (top === "ci") {
+    emitJson(commandName, runCiCommand(config, args.slice(1)));
+    return;
+  }
+
  if (top === "e2e" && sub === "run") {
    const result = await runE2E(config, parseE2ERunOptions(args.slice(2)));
    const ok = (result as { ok?: unknown }).ok === true;
@@ -0,0 +1,353 @@
+import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { runCommand } from "./command";
+import { type UniDeskConfig, repoRoot, rootPath } from "./config";
+import { startJob } from "./jobs";
+
+const k3sctlContainerName = "k3sctl-adapter";
+const k3sctlSshKey = "/run/host-ssh/id_ed25519";
+const d601SshTarget = "ubuntu@host.docker.internal";
+const d601Kubeconfig = "/etc/rancher/k3s/k3s.yaml";
+const tektonPipelineVersion = "v1.12.0";
+const tektonTriggersVersion = "v0.34.0";
+const tektonPipelineReleaseUrl = `https://infra.tekton.dev/tekton-releases/pipeline/previous/${tektonPipelineVersion}/release.yaml`;
+const tektonTriggersReleaseUrl = `https://infra.tekton.dev/tekton-releases/triggers/previous/${tektonTriggersVersion}/release.yaml`;
+const tektonTriggersInterceptorsUrl = `https://infra.tekton.dev/tekton-releases/triggers/previous/${tektonTriggersVersion}/interceptors.yaml`;
+const providerGatewayWsEgressProxyUrl = "http://127.0.0.1:18789";
+const ciRuntimeImages = [
+  "rancher/mirrored-pause:3.6",
+  "rancher/mirrored-library-busybox:1.36.1",
+  "cgr.dev/chainguard/busybox@sha256:19f02276bf8dbdd62f069b922f10c65262cc34b710eea26ff928129a736be791",
+  "ghcr.io/tektoncd/pipeline/entrypoint-bff0a22da108bc2f16c818c97641a296:v1.12.0",
+  "ghcr.io/tektoncd/pipeline/workingdirinit-0c558922ec6a1b739e550e349f2d5fc1:v1.12.0",
+  "ghcr.io/tektoncd/pipeline/nop-8eac7c133edad5df719dc37b36b62482:v1.12.0",
+  "ghcr.io/tektoncd/pipeline/events-a9042f7efb0cbade2a868a1ee5ddd52c:v1.12.0",
+  "ghcr.io/tektoncd/triggers/eventlistenersink-7ad1faa98cddbcb0c24990303b220bb8:v0.34.0",
+  "oven/bun:1-debian",
+  "alpine/git:2.45.2",
+  "unidesk-code-queue:d601",
+];
+
+interface CiOptions {
+  repoUrl: string;
+  revision: string;
+  waitMs: number;
+}
+
+function stringOption(args: string[], name: string): string | null {
+  const index = args.indexOf(name);
+  if (index === -1) return null;
+  const value = args[index + 1];
+  if (value === undefined || value.startsWith("--")) throw new Error(`${name} requires a value`);
+  return value;
+}
+
+function numberOption(args: string[], name: string, fallback: number): number {
+  const raw = stringOption(args, name);
+  if (raw === null) return fallback;
+  const value = Number(raw);
+  if (!Number.isInteger(value) || value < 0) throw new Error(`${name} must be a non-negative integer`);
+  return value;
+}
+
+function requireRevision(value: string | null): string {
+  if (value === null || value.length === 0) throw new Error("ci run requires --revision <commit-or-ref>");
+  if (!/^[A-Za-z0-9._/@:-]{1,160}$/u.test(value)) throw new Error("ci --revision contains unsupported characters");
+  return value;
+}
+
+function shellQuote(value: string): string {
+  return `'${value.replace(/'/gu, "'\\''")}'`;
+}
+
+function dockerExecK3sctl(args: string[]) {
+  return runCommand(["docker", "exec", k3sctlContainerName, ...args], repoRoot);
+}
+
+function dockerExecK3sctlWithInput(args: string[], input: string) {
+  const command = ["docker", "exec", "-i", k3sctlContainerName, ...args];
+  const result = spawnSync(command[0], command.slice(1), {
+    cwd: repoRoot,
+    encoding: "utf8",
+    input,
+    maxBuffer: 1024 * 1024 * 8,
+  });
+  return {
+    command,
+    cwd: repoRoot,
+    exitCode: result.status,
+    stdout: result.stdout ?? "",
+    stderr: result.stderr ?? result.error?.message ?? "",
+  };
+}
+
+function remoteKubectlCommand(script: string): string[] {
+  return [
+    "sh",
+    "-lc",
+    [
+      "ssh",
+      "-i",
+      shellQuote(k3sctlSshKey),
+      "-o",
+      "StrictHostKeyChecking=no",
+      "-o",
+      "UserKnownHostsFile=/tmp/unidesk-ci-known-hosts",
+      "-o",
+      "ConnectTimeout=10",
+      shellQuote(d601SshTarget),
+      shellQuote(`KUBECONFIG=${d601Kubeconfig} bash -lc ${shellQuote(script)}`),
+    ].join(" "),
+  ];
+}
+
+function runRemoteKubectl(script: string) {
+  const result = dockerExecK3sctl(remoteKubectlCommand(script));
+  if (result.exitCode !== 0) {
+    throw new Error(`D601 kubectl command failed: ${result.stderr || result.stdout}`);
+  }
+  return result;
+}
+
+function remoteApplyManifest(path: string): void {
+  const absolute = rootPath(path);
+  if (!existsSync(absolute)) throw new Error(`manifest not found: ${path}`);
+  const result = dockerExecK3sctlWithInput([
+    "sh",
+    "-lc",
+    [
+      "ssh",
+      "-i",
+      shellQuote(k3sctlSshKey),
+      "-o",
+      "StrictHostKeyChecking=no",
+      "-o",
+      "UserKnownHostsFile=/tmp/unidesk-ci-known-hosts",
+      "-o",
+      "ConnectTimeout=10",
+      shellQuote(d601SshTarget),
+      shellQuote(`KUBECONFIG=${d601Kubeconfig} kubectl apply -f -`),
+    ].join(" "),
+  ], readFileSync(absolute, "utf8"));
+  if (result.exitCode !== 0) {
+    throw new Error(`kubectl apply failed for ${path}: ${result.stderr || result.stdout}`);
+  }
+}
+
+function prewarmCiRuntimeImages(): void {
+  const images = ciRuntimeImages.map(shellQuote).join(" ");
+  runRemoteKubectl([
+    "set -euo pipefail",
+    "export DOCKER_CONFIG=/tmp/unidesk-ci-docker-config",
+    "mkdir -p \"$DOCKER_CONFIG\"",
+    "printf '{}\\n' > \"$DOCKER_CONFIG/config.json\"",
+    `images=(${images})`,
+    "for image in \"${images[@]}\"; do",
+    "  if ! docker image inspect \"$image\" >/dev/null 2>&1; then",
+    "    echo ci_runtime_image_pull=$image",
+    `    HTTP_PROXY=${shellQuote(providerGatewayWsEgressProxyUrl)} HTTPS_PROXY=${shellQuote(providerGatewayWsEgressProxyUrl)} ALL_PROXY=${shellQuote(providerGatewayWsEgressProxyUrl)} NO_PROXY=localhost,127.0.0.1,::1,host.docker.internal docker pull --platform linux/amd64 "$image"`,
+    "  else",
+    "    echo ci_runtime_image_cached=$image",
+    "  fi",
+    "done",
+    "pause_entrypoint=$(docker image inspect rancher/mirrored-pause:3.6 --format '{{json .Config.Entrypoint}}' 2>/dev/null || true)",
+    "if ! printf '%s' \"$pause_entrypoint\" | grep -q '\"/pause\"'; then echo native_k3s_pause_image_invalid_entrypoint=$pause_entrypoint >&2; exit 1; fi",
+    "rm -f /tmp/unidesk-ci-runtime-images.tar",
+    "docker save \"${images[@]}\" -o /tmp/unidesk-ci-runtime-images.tar",
+    "/mnt/c/Windows/System32/wsl.exe -u root -- ctr --address /run/k3s/containerd/containerd.sock -n k8s.io images import --digests --all-platforms /tmp/unidesk-ci-runtime-images.tar >/tmp/unidesk-ci-runtime-images-import.log",
+    "/mnt/c/Windows/System32/wsl.exe -u root -- ctr --address /run/k3s/containerd/containerd.sock -n k8s.io images ls | grep -F 'docker.io/rancher/mirrored-pause:3.6' >/dev/null",
+    "/mnt/c/Windows/System32/wsl.exe -u root -- ctr --address /run/k3s/containerd/containerd.sock -n k8s.io images ls | grep -F 'docker.io/oven/bun:1-debian' >/dev/null",
+    "/mnt/c/Windows/System32/wsl.exe -u root -- ctr --address /run/k3s/containerd/containerd.sock -n k8s.io images ls | grep -F 'docker.io/alpine/git:2.45.2' >/dev/null",
+    "/mnt/c/Windows/System32/wsl.exe -u root -- ctr --address /run/k3s/containerd/containerd.sock -n k8s.io images ls | grep -F 'docker.io/library/unidesk-code-queue:d601' >/dev/null",
+  ].join("\n"));
+}
+
+function status(): Record<string, unknown> {
+  const summary = runRemoteKubectl([
+    "set -euo pipefail",
+    "printf 'tekton_pipelines='",
+    "kubectl get deploy -n tekton-pipelines -o name 2>/dev/null | tr '\\n' ' ' || true",
+    "printf '\\ntekton_triggers='",
+    "kubectl get deploy -n tekton-pipelines-resolvers -o name 2>/dev/null | tr '\\n' ' ' || true",
+    "printf '\\nunidesk_ci='",
+    "kubectl get pipeline,task,pipelinerun,eventlistener,svc -n unidesk-ci -o name 2>/dev/null | tr '\\n' ' ' || true",
+    "printf '\\n'",
+  ].join("\n"));
+  return {
+    ok: true,
+    providerId: "D601",
+    orchestrator: "native-k3s",
+    tekton: {
+      pipelineVersion: tektonPipelineVersion,
+      triggersVersion: tektonTriggersVersion,
+    },
+    summary: summary.stdout.trim(),
+  };
+}
+
+function install(): Record<string, unknown> {
+  if (!existsSync(rootPath("src/components/microservices/k3sctl-adapter/k3s/ci/unidesk-ci.pipeline.yaml"))) {
+    throw new Error("CI manifests are missing");
+  }
+  prewarmCiRuntimeImages();
+  runRemoteKubectl([
+    "set -euo pipefail",
+    `kubectl apply -f ${shellQuote(tektonPipelineReleaseUrl)}`,
+    "kubectl wait --for=condition=Available deployment --all -n tekton-pipelines --timeout=900s",
+    `kubectl apply -f ${shellQuote(tektonTriggersReleaseUrl)}`,
+    `kubectl apply -f ${shellQuote(tektonTriggersInterceptorsUrl)}`,
+    "kubectl wait --for=condition=Available deployment --all -n tekton-pipelines --timeout=900s",
+    "kubectl wait --for=condition=Available deployment --all -n tekton-pipelines-resolvers --timeout=900s",
+  ].join("\n"));
+  remoteApplyManifest("src/components/microservices/k3sctl-adapter/k3s/ci/tekton-install.yaml");
+  remoteApplyManifest("src/components/microservices/k3sctl-adapter/k3s/ci/unidesk-ci.pipeline.yaml");
+  remoteApplyManifest("src/components/microservices/k3sctl-adapter/k3s/ci/unidesk-ci.triggers.yaml");
+  return status();
+}
+
+function pipelineRunManifest(options: CiOptions): string {
+  const safeSuffix = new Date().toISOString().replace(/[-:.TZ]/g, "").slice(0, 14).toLowerCase();
+  return `apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  generateName: unidesk-ci-${safeSuffix}-
+  namespace: unidesk-ci
+  labels:
+    app.kubernetes.io/name: unidesk-ci
+    app.kubernetes.io/part-of: unidesk
+    unidesk.ai/revision: ${JSON.stringify(options.revision)}
+spec:
+  pipelineRef:
+    name: unidesk-ci
+  taskRunTemplate:
+    serviceAccountName: unidesk-ci-runner
+  params:
+    - name: repo-url
+      value: ${JSON.stringify(options.repoUrl)}
+    - name: revision
+      value: ${JSON.stringify(options.revision)}
+  workspaces:
+    - name: shared-workspace
+      persistentVolumeClaim:
+        claimName: unidesk-ci-cache
+`;
+}
+
+function remoteCreatePipelineRun(manifest: string): string {
+  const result = dockerExecK3sctlWithInput([
+    "sh",
+    "-lc",
+    [
+      "ssh",
+      "-i",
+      shellQuote(k3sctlSshKey),
+      "-o",
+      "StrictHostKeyChecking=no",
+      "-o",
+      "UserKnownHostsFile=/tmp/unidesk-ci-known-hosts",
+      shellQuote(d601SshTarget),
+      shellQuote(`KUBECONFIG=${d601Kubeconfig} kubectl create -f - -o jsonpath='{.metadata.name}'`),
+    ].join(" "),
+  ], manifest);
+  if (result.exitCode !== 0) throw new Error(result.stderr || result.stdout);
+  return result.stdout.trim();
+}
+
+function run(options: CiOptions): Record<string, unknown> {
+  const name = remoteCreatePipelineRun(pipelineRunManifest(options));
+  const wait = options.waitMs > 0 ? dockerExecK3sctl(remoteKubectlCommand([
+    "set -euo pipefail",
+    `deadline=$((SECONDS + ${Math.ceil(options.waitMs / 1000)}))`,
+    "while [ \"$SECONDS\" -lt \"$deadline\" ]; do",
+    `  condition="$(kubectl get pipelinerun/${shellQuote(name)} -n unidesk-ci -o jsonpath='{range .status.conditions[?(@.type==\"Succeeded\")]}{.status}{\"\\t\"}{.reason}{\"\\t\"}{.message}{end}' 2>/dev/null || true)"`,
+    "  case \"$condition\" in",
+    "    True*)",
+    "      echo \"$condition\"",
+    `      kubectl get pipelinerun/${shellQuote(name)} -n unidesk-ci -o json`,
+    "      exit 0",
+    "      ;;",
+    "    False*)",
+    "      echo \"$condition\"",
+    `      kubectl get pipelinerun/${shellQuote(name)} -n unidesk-ci -o json`,
+    "      exit 1",
+    "      ;;",
+    "  esac",
+    "  sleep 2",
+    "done",
+    `echo "Timed out waiting for pipelinerun/${name}" >&2`,
+    `kubectl get pipelinerun/${shellQuote(name)} -n unidesk-ci -o json`,
+    "exit 124",
+  ].join("\n"))) : null;
+  return {
+    ok: wait === null || wait.exitCode === 0,
+    pipelineRun: name,
+    namespace: "unidesk-ci",
+    repoUrl: options.repoUrl,
+    revision: options.revision,
+    wait: wait === null ? null : {
+      stdoutTail: wait.stdout.slice(-6000),
+      stderrTail: wait.stderr.slice(-6000),
+    },
+    next: [
+      `bun scripts/cli.ts ci logs ${name}`,
+      "bun scripts/cli.ts ci status",
+    ],
+  };
+}
+
+function logs(name: string): Record<string, unknown> {
+  if (name.length === 0) throw new Error("ci logs requires PipelineRun name");
+  const result = runRemoteKubectl([
+    "set -euo pipefail",
+    `kubectl get pipelinerun/${shellQuote(name)} -n unidesk-ci -o wide`,
+    `kubectl get taskrun -n unidesk-ci -l tekton.dev/pipelineRun=${shellQuote(name)} -o wide`,
+    `for pod in $(kubectl get pods -n unidesk-ci -l tekton.dev/pipelineRun=${shellQuote(name)} -o name); do echo "===== $pod"; kubectl logs -n unidesk-ci "$pod" --all-containers=true --tail=160; done`,
+  ].join("\n"));
+  return {
+    ok: true,
+    pipelineRun: name,
+    output: result.stdout,
+    stderr: result.stderr,
+  };
+}
+
+function help(): Record<string, unknown> {
+  return {
+    command: "ci install|status|run|logs",
+    description: "Manage the D601 k3s Tekton CI gate. This intentionally does not deploy CD.",
+    examples: [
+      "bun scripts/cli.ts ci install",
+      "bun scripts/cli.ts ci run --revision <commit>",
+      "bun scripts/cli.ts ci logs <pipelineRun>",
+    ],
+    tekton: {
+      pipelineVersion: tektonPipelineVersion,
+      triggersVersion: tektonTriggersVersion,
+      sources: {
+        pipeline: tektonPipelineReleaseUrl,
+        triggers: tektonTriggersReleaseUrl,
+        interceptors: tektonTriggersInterceptorsUrl,
+      },
+    },
+  };
+}
+
+export function runCiCommand(_config: UniDeskConfig, args: string[]): Record<string, unknown> {
+  const [action = "status", nameArg] = args;
+  if (action === "help" || action === "--help" || action === "-h") return help();
+  if (action === "install") return install();
+  if (action === "status") return status();
+  if (action === "run") {
+    const repoUrl = stringOption(args, "--repo") ?? stringOption(args, "--repo-url") ?? "https://github.com/pikasTech/unidesk";
+    const revision = requireRevision(stringOption(args, "--revision") ?? stringOption(args, "--commit"));
+    const waitMs = numberOption(args, "--wait-ms", 0);
+    return run({ repoUrl, revision, waitMs });
+  }
+  if (action === "logs") return logs(nameArg ?? "");
+  throw new Error("ci command must be one of: install, status, run, logs");
+}
+
+export function startCiInstallJob(): Record<string, unknown> {
+  const job = startJob("ci_install", ["bun", "scripts/cli.ts", "ci", "install"], "Install/refresh Tekton CI on D601 k3s");
+  return { ok: true, job };
+}
@@ -9,5 +9,5 @@
    "noFallthroughCasesInSwitch": true,
    "skipLibCheck": true
  },
-  "include": ["cli.ts", "src/**/*.ts"]
+  "include": ["cli.ts", "src/**/*.ts", "../scripts/*.ts"]
 }