fix: 收窄 Artificer pika 配置范围

This commit is contained in:
Codex
2026-07-12 17:57:44 +02:00
parent 18017306b9
commit acb9674454
14 changed files with 50 additions and 874 deletions
+15 -212
View File
@@ -43,7 +43,6 @@ import { arrayRecords, displayValue, isRecord, pickCompact, renderTable, truncat
import { innerData, pathValue, renderMachine, renderedCliResult } from "./render";
import { parseResourceOptions, stripAgentRunResourceWrapperArgs } from "./resource-actions";
import { AGENTRUN_GIT_MIRROR_RETRY_MAX_ATTEMPTS, agentRunGitMirrorRetryDelayMs, agentRunGitMirrorRetrySummary, agentRunGitMirrorRetryableFailure, createYamlLaneJobScript, yamlLaneGitMirrorJobManifest, yamlLaneGitMirrorStatusScript, yamlLaneJobProbeScript } from "./secrets";
import { renderAipodBindingHumanLines } from "./session-send-render";
import { capture, captureJsonPayload, compactCapture, nonNegativeIntegerOrNull, progressEvent, record, shQuote, sleep, stringOrNull } from "./utils";
export async function readGitMirrorStatus(config: UniDeskConfig, target: { configPath: string; spec: AgentRunLaneSpec }): Promise<Record<string, unknown> & { result: SshCaptureResult; raw: string; summary: Record<string, unknown> }> {
@@ -286,10 +285,10 @@ export async function runAgentRunRestCompatCommand(config: UniDeskConfig | null,
const options = parseAgentRunRestCompatOptions(args);
const command = `agentrun ${canonicalArgs.join(" ")}`.trim();
try {
return await withAgentRunRestTarget(resolveAgentRunRestTarget(config, options), async () => {
const raw = await runAgentRunRestCommand(config, group, stripAgentRunResourceWrapperArgs(args));
return renderAgentRunRestCompatResult(command, group, stripAgentRunResourceWrapperArgs(args), raw, options);
const raw = await withAgentRunRestTarget(resolveAgentRunRestTarget(config, options), async () => {
return await runAgentRunRestCommand(config, group, stripAgentRunResourceWrapperArgs(args));
});
return renderAgentRunRestCompatResult(command, group, stripAgentRunResourceWrapperArgs(args), raw, options);
} catch (error) {
if (error instanceof AgentRunRestError) {
if (options.raw || options.full || options.output === "json" || options.output === "yaml") {
@@ -336,7 +335,6 @@ export function renderAgentRunAipodSpecRenderSummary(command: string, raw: Recor
const namespace = stringOrNull(bridge.namespace) ?? stringOrNull(runnerJobDefaults.namespace) ?? "-";
const providerCredentials = agentRunRenderedProviderCredentials(secretScope, aipod);
const toolCredentials = agentRunRenderedToolCredentials(secretScope, aipod);
const aipodBinding = agentRunAipodBindingDisclosure(task, requestedAipod, record(data.modelResolution));
const bundleNames = agentRunResourceBundleNames(resourceBundle.bundles, "name");
const skillNames = agentRunResourceBundleNames(resourceBundle.requiredSkills, "name");
const targetArgs = agentRunCompatTargetCliArgs(node, lane);
@@ -345,7 +343,6 @@ export function renderAgentRunAipodSpecRenderSummary(command: string, raw: Recor
` AipodSpec: ${displayValue(aipod.name ?? requestedAipod)} hash=${displayValue(aipod.specHash)}`,
` Target: node=${displayValue(node)} lane=${displayValue(lane)} namespace=${displayValue(namespace)} bridge=${displayValue(bridge.mode)}`,
` TaskPolicy: backendProfile=${displayValue(task.backendProfile)} providerId=${displayValue(task.providerId)} queue=${displayValue(task.queue)} lane=${displayValue(task.lane)}`,
...renderAipodBindingHumanLines(aipodBinding),
` WorkspaceRef: ${agentRunCompactJson(task.workspaceRef, 140)}`,
` Execution: ${agentRunCompactJson(pickCompact(executionPolicy, ["sandbox", "approval", "timeoutMs", "network"]), 160)}`,
" Values: secret payloads are not printed; valuesPrinted=false",
@@ -568,16 +565,7 @@ export async function runAgentRunRunnerRest(action: string | undefined, id: stri
export async function runAgentRunAipodSpecsRest(action: string | undefined, id: string | undefined, args: string[]): Promise<Record<string, unknown>> {
if (action === "list") return await agentRunRestRequest("agentrun aipod-specs list", "GET", "/api/v1/aipod-specs");
if (action === "show" && id) return await agentRunRestRequest("agentrun aipod-specs show", "GET", `/api/v1/aipod-specs/${encodeURIComponent(id)}`);
if (action === "render" && id) {
const renderInput = await aipodRenderInputFromArgs(args, 2);
const rendered = await agentRunRestRequest("agentrun aipod-specs render", "POST", `/api/v1/aipod-specs/${encodeURIComponent(id)}/render`, renderInput);
const renderedData = record(innerData(rendered));
const task = record(renderedData.queueTask);
if (Object.keys(task).length === 0) throw new AgentRunRestError("schema-mismatch", `aipod-spec ${id} render did not return queueTask`);
normalizeAipodRenderedQueueTask(task, args, id);
agentRunAipodBindingDisclosure(task, id, record(renderedData.modelResolution), renderInput);
return rendered;
}
if (action === "render" && id) return await agentRunRestRequest("agentrun aipod-specs render", "POST", `/api/v1/aipod-specs/${encodeURIComponent(id)}/render`, await aipodRenderInputFromArgs(args, 2));
if (action === "apply" || action === "set") {
const yaml = readYamlInputFromArgs(args);
const pathValue = id ? `/api/v1/aipod-specs/${encodeURIComponent(id)}` : "/api/v1/aipod-specs";
@@ -593,16 +581,13 @@ export async function runAgentRunAipodSpecsRest(action: string | undefined, id:
export async function submitQueueTaskRest(args: string[]): Promise<Record<string, unknown>> {
const aipod = agentRunOption(args, "aipod") ?? agentRunOption(args, "aipod-spec");
if (aipod) {
const renderInput = await aipodRenderInputFromArgs(args, 2);
const rendered = await agentRunRestRequest("agentrun aipod-specs render", "POST", `/api/v1/aipod-specs/${encodeURIComponent(aipod)}/render`, renderInput);
const renderedData = record(innerData(rendered));
const body = normalizeAipodRenderedQueueTask(record(renderedData.queueTask), args, aipod);
const rendered = await agentRunRestRequest("agentrun aipod-specs render", "POST", `/api/v1/aipod-specs/${encodeURIComponent(aipod)}/render`, await aipodRenderInputFromArgs(args, 2));
const body = normalizeAipodRenderedQueueTask(record(record(innerData(rendered)).queueTask), args, aipod);
if (Object.keys(body).length === 0) throw new AgentRunRestError("schema-mismatch", `aipod-spec ${aipod} render did not return queueTask`);
const aipodBinding = agentRunAipodBindingDisclosure(body, aipod, record(renderedData.modelResolution), renderInput);
if (agentRunHasFlag(args, "dry-run")) {
return agentRunDryRunPlan("queue-submit", "/api/v1/queue/tasks", body, queueSubmitConfirmCommand(args, aipod), "POST", {
jsonInput: { source: "aipod-spec", aipod, valuesPrinted: false },
aipodBinding,
aipodBinding: agentRunAipodBindingDisclosure(body, aipod),
});
}
return await agentRunRestRequest("agentrun queue submit", "POST", "/api/v1/queue/tasks", body);
@@ -718,83 +703,12 @@ export async function sessionRunBodyFromArgs(sessionId: string, args: string[],
export function normalizeAipodRenderedQueueTask(task: Record<string, unknown>, args: string[], aipod: string): Record<string, unknown> {
if (Object.keys(task).length === 0) return task;
const sessionPolicy = readAgentRunClientConfig().client.sessionPolicy;
const policyTarget = resolveAgentRunSessionPolicyTarget();
const explicitProfile = agentRunOption(args, "profile") ?? agentRunOption(args, "backend-profile");
if (explicitProfile !== null) {
throw new AgentRunRestError("validation-failed", `AipodSpec ${aipod} owns backendProfile; explicit profile override ${explicitProfile} is not allowed`);
}
const renderedProfile = stringOrNull(task.backendProfile);
if (renderedProfile === null) {
throw new AgentRunRestError("schema-mismatch", `aipod-spec ${aipod} render did not return queueTask.backendProfile`);
}
const providerCredentials = agentRunProviderCredentialRefs(policyTarget.spec, renderedProfile);
if (providerCredentials.length === 0) {
throw new AgentRunRestError("validation-failed", `${policyTarget.configPath} has no providerCredential Secret binding for AipodSpec ${aipod} backendProfile=${renderedProfile} on ${policyTarget.spec.nodeId}/${policyTarget.spec.lane}`);
}
const basePolicy = record(task.executionPolicy);
if (Object.keys(basePolicy).length === 0) {
throw new AgentRunRestError("schema-mismatch", `aipod-spec ${aipod} render did not return queueTask.executionPolicy`);
}
validateAipodRenderedProviderCredentials(basePolicy, renderedProfile, providerCredentials, policyTarget, aipod);
const normalized: Record<string, unknown> = { ...task };
normalized.tenantId = stringOrNull(normalized.tenantId) ?? sessionPolicy.tenantId;
normalized.projectId = stringOrNull(normalized.projectId) ?? sessionPolicy.projectId;
normalized.providerId = stringOrNull(normalized.providerId) ?? defaultAgentRunProviderId(sessionPolicy, policyTarget);
normalized.backendProfile = renderedProfile;
if (!isRecord(normalized.workspaceRef)) normalized.workspaceRef = cloneJsonRecord(sessionPolicy.workspaceRef);
normalized.executionPolicy = defaultAgentRunExecutionPolicy(renderedProfile, sessionPolicy, policyTarget, {
includeToolCredentials: true,
basePolicy,
});
return normalized;
void args;
void aipod;
return { ...task };
}
function validateAipodRenderedProviderCredentials(
executionPolicy: Record<string, unknown>,
backendProfile: string,
expectedCredentials: readonly ReturnType<typeof agentRunProviderCredentialRefs>[number][],
policyTarget: ReturnType<typeof resolveAgentRunSessionPolicyTarget>,
aipod: string,
): void {
const rendered = arrayRecords(record(executionPolicy.secretScope).providerCredentials);
if (rendered.length === 0) {
throw new AgentRunRestError("schema-mismatch", `aipod-spec ${aipod} render did not return executionPolicy.secretScope.providerCredentials`);
}
const expectedByName = new Map(expectedCredentials.map((credential) => [credential.secretRef.name, credential]));
const seen = new Set<string>();
for (const [index, credential] of rendered.entries()) {
const renderedProfile = stringOrNull(credential.profile);
if (renderedProfile !== backendProfile) {
throw new AgentRunRestError("validation-failed", `aipod-spec ${aipod} providerCredentials[${index}].profile=${renderedProfile ?? "(missing)"} must exactly match queueTask.backendProfile=${backendProfile}`);
}
const secretRef = record(credential.secretRef);
const name = stringOrNull(secretRef.name);
const expected = name === null ? undefined : expectedByName.get(name);
if (name === null || expected === undefined || seen.has(name)) {
throw new AgentRunRestError("validation-failed", `aipod-spec ${aipod} provider credential SecretRef ${name ?? "(missing)"} is not the unique YAML binding for backendProfile=${backendProfile}`);
}
seen.add(name);
const namespace = stringOrNull(secretRef.namespace);
if (namespace !== null && namespace !== expected.secretRef.namespace) {
throw new AgentRunRestError("validation-failed", `aipod-spec ${aipod} provider credential ${name} namespace conflicts with YAML lane ${policyTarget.spec.nodeId}/${policyTarget.spec.lane}`);
}
const keys = Array.isArray(secretRef.keys) ? secretRef.keys.map(String) : [];
if (JSON.stringify([...keys].sort()) !== JSON.stringify([...expected.secretRef.keys].sort())) {
throw new AgentRunRestError("validation-failed", `aipod-spec ${aipod} provider credential ${name} keys conflict with YAML lane ${policyTarget.spec.nodeId}/${policyTarget.spec.lane}`);
}
}
if (seen.size !== expectedCredentials.length) {
throw new AgentRunRestError("validation-failed", `aipod-spec ${aipod} provider credential bindings are incomplete for backendProfile=${backendProfile}`);
}
}
export function agentRunAipodBindingDisclosure(
task: Record<string, unknown>,
aipod: string,
modelResolution: Record<string, unknown>,
renderInput: Record<string, unknown> | null = null,
): Record<string, unknown> {
export function agentRunAipodBindingDisclosure(task: Record<string, unknown>, aipod: string): Record<string, unknown> {
const policyTarget = resolveAgentRunSessionPolicyTarget();
const executionPolicy = record(task.executionPolicy);
const secretScope = record(executionPolicy.secretScope);
@@ -816,42 +730,6 @@ export function agentRunAipodBindingDisclosure(
projection: record(credential.projection),
valuesPrinted: false,
}));
const payload = record(task.payload);
const modelConfig = record(payload.modelConfig);
const model = requiredAipodResolutionString(modelResolution.model, aipod, "modelResolution.model");
const reasoningEffort = requiredAipodResolutionString(modelResolution.reasoningEffort, aipod, "modelResolution.reasoningEffort");
const modelSource = requiredAipodResolutionSource(modelResolution.modelSource, aipod, "modelResolution.modelSource");
const reasoningEffortSource = requiredAipodResolutionSource(modelResolution.reasoningEffortSource, aipod, "modelResolution.reasoningEffortSource");
const modelOverridden = requiredAipodResolutionBoolean(modelResolution.modelOverridden, aipod, "modelResolution.modelOverridden");
const reasoningEffortOverridden = requiredAipodResolutionBoolean(modelResolution.reasoningEffortOverridden, aipod, "modelResolution.reasoningEffortOverridden");
const backendProfile = requiredAipodResolutionString(task.backendProfile, aipod, "queueTask.backendProfile");
const resolvedBackendProfile = requiredAipodResolutionString(modelResolution.backendProfile, aipod, "modelResolution.backendProfile");
const backendProfileSource = requiredAipodResolutionString(modelResolution.backendProfileSource, aipod, "modelResolution.backendProfileSource");
assertAipodResolutionEqual(payload.model, model, aipod, "queueTask.payload.model", "modelResolution.model");
assertAipodResolutionEqual(payload.reasoningEffort, reasoningEffort, aipod, "queueTask.payload.reasoningEffort", "modelResolution.reasoningEffort");
assertAipodResolutionEqual(modelConfig.model, model, aipod, "queueTask.payload.modelConfig.model", "modelResolution.model");
assertAipodResolutionEqual(modelConfig.reasoningEffort, reasoningEffort, aipod, "queueTask.payload.modelConfig.reasoningEffort", "modelResolution.reasoningEffort");
assertAipodResolutionEqual(modelConfig.modelSource, modelSource, aipod, "queueTask.payload.modelConfig.modelSource", "modelResolution.modelSource");
assertAipodResolutionEqual(modelConfig.reasoningEffortSource, reasoningEffortSource, aipod, "queueTask.payload.modelConfig.reasoningEffortSource", "modelResolution.reasoningEffortSource");
if (modelConfig.valuesPrinted !== false || modelResolution.valuesPrinted !== false) {
throw new AgentRunRestError("schema-mismatch", `aipod-spec ${aipod} model resolution must disclose valuesPrinted=false`);
}
if (modelOverridden !== (modelSource === "render-input-override") || reasoningEffortOverridden !== (reasoningEffortSource === "render-input-override")) {
throw new AgentRunRestError("schema-mismatch", `aipod-spec ${aipod} model resolution override booleans conflict with source fields`);
}
if (renderInput !== null) {
validateAipodRenderOverride(renderInput, "model", model, modelSource, modelOverridden, aipod);
validateAipodRenderOverride(renderInput, "reasoningEffort", reasoningEffort, reasoningEffortSource, reasoningEffortOverridden, aipod);
}
if (resolvedBackendProfile !== backendProfile || backendProfileSource !== "aipod-spec") {
throw new AgentRunRestError("validation-failed", `aipod-spec ${aipod} modelResolution backendProfile must match queueTask.backendProfile and remain aipod-spec-owned`);
}
const credentialBindings = agentRunProviderCredentialRefs(policyTarget.spec, backendProfile);
if (credentialBindings.length !== 1) {
throw new AgentRunRestError("validation-failed", `${policyTarget.configPath} must declare one unique providerCredential Secret binding for AipodSpec ${aipod} backendProfile=${backendProfile}`);
}
const credentialBinding = credentialBindings[0]!;
validateAipodModelResolutionCredential(modelResolution, credentialBinding, aipod);
return {
aipod,
node: policyTarget.spec.nodeId,
@@ -859,15 +737,7 @@ export function agentRunAipodBindingDisclosure(
namespace: policyTarget.spec.runtime.namespace,
policySource: policyTarget.source,
providerId: task.providerId ?? null,
sourceProfile: credentialBinding.sourceProfile,
effectiveBackendProfile: backendProfile,
backendProfileSource,
model,
reasoningEffort,
modelSource,
reasoningEffortSource,
modelOverridden,
reasoningEffortOverridden,
backendProfile: task.backendProfile ?? null,
workspaceRef: task.workspaceRef ?? null,
executionPolicy: pickCompact(executionPolicy, ["sandbox", "approval", "timeoutMs", "network"]),
providerCredentials,
@@ -876,70 +746,6 @@ export function agentRunAipodBindingDisclosure(
};
}
function requiredAipodResolutionString(value: unknown, aipod: string, pathValue: string): string {
const parsed = stringOrNull(value);
if (parsed === null) throw new AgentRunRestError("schema-mismatch", `aipod-spec ${aipod} render did not return non-empty ${pathValue}`);
return parsed;
}
function requiredAipodResolutionSource(value: unknown, aipod: string, pathValue: string): "aipod-spec-default" | "render-input-override" {
const parsed = requiredAipodResolutionString(value, aipod, pathValue);
if (parsed !== "aipod-spec-default" && parsed !== "render-input-override") {
throw new AgentRunRestError("schema-mismatch", `aipod-spec ${aipod} ${pathValue} must be aipod-spec-default or render-input-override`);
}
return parsed;
}
function requiredAipodResolutionBoolean(value: unknown, aipod: string, pathValue: string): boolean {
if (typeof value !== "boolean") throw new AgentRunRestError("schema-mismatch", `aipod-spec ${aipod} render did not return boolean ${pathValue}`);
return value;
}
function assertAipodResolutionEqual(actual: unknown, expected: string, aipod: string, actualPath: string, expectedPath: string): void {
if (actual !== expected) throw new AgentRunRestError("schema-mismatch", `aipod-spec ${aipod} ${actualPath} must match ${expectedPath}`);
}
function validateAipodRenderOverride(
renderInput: Record<string, unknown>,
key: "model" | "reasoningEffort",
effectiveValue: string,
source: "aipod-spec-default" | "render-input-override",
overridden: boolean,
aipod: string,
): void {
const requested = Object.hasOwn(renderInput, key);
const expectedSource = requested ? "render-input-override" : "aipod-spec-default";
if (source !== expectedSource || overridden !== requested) {
throw new AgentRunRestError("schema-mismatch", `aipod-spec ${aipod} ${key} override disclosure does not match render input`);
}
if (requested && renderInput[key] !== effectiveValue) {
throw new AgentRunRestError("schema-mismatch", `aipod-spec ${aipod} effective ${key} does not match the explicit render input`);
}
}
function validateAipodModelResolutionCredential(
modelResolution: Record<string, unknown>,
expected: ReturnType<typeof agentRunProviderCredentialRefs>[number],
aipod: string,
): void {
const credential = record(modelResolution.providerCredential);
const secretRef = record(credential.secretRef);
const keys = Array.isArray(secretRef.keys) && secretRef.keys.every((key) => typeof key === "string")
? secretRef.keys.map(String).sort()
: null;
if (
credential.profile !== expected.profile
|| secretRef.namespace !== expected.secretRef.namespace
|| secretRef.name !== expected.secretRef.name
|| keys === null
|| JSON.stringify(keys) !== JSON.stringify([...expected.secretRef.keys].sort())
|| credential.valuesPrinted !== false
|| secretRef.valuesPrinted !== false
) {
throw new AgentRunRestError("validation-failed", `aipod-spec ${aipod} modelResolution.providerCredential must match the unique YAML SecretRef for backendProfile=${expected.profile}`);
}
}
export function agentRunSessionRunPolicyDisclosure(runBody: Record<string, unknown>): Record<string, unknown> {
const policyTarget = resolveAgentRunSessionPolicyTarget();
const executionPolicy = record(runBody.executionPolicy);
@@ -967,20 +773,17 @@ export function agentRunSessionRunPolicyDisclosure(runBody: Record<string, unkno
}
export async function sessionSendWithAipodRest(sessionId: string, aipod: string, args: string[]): Promise<Record<string, unknown>> {
const renderInput = await aipodRenderInputFromArgs(args, 2, { sessionId });
const rendered = await agentRunRestRequest("agentrun aipod-specs render", "POST", `/api/v1/aipod-specs/${encodeURIComponent(aipod)}/render`, renderInput);
const rendered = await agentRunRestRequest("agentrun aipod-specs render", "POST", `/api/v1/aipod-specs/${encodeURIComponent(aipod)}/render`, await aipodRenderInputFromArgs(args, 2, { sessionId }));
const renderedData = record(innerData(rendered));
const task = normalizeAipodRenderedQueueTask(record(renderedData.queueTask), args, aipod);
if (Object.keys(task).length === 0) throw new AgentRunRestError("schema-mismatch", `aipod-spec ${aipod} render did not return queueTask`);
const aipodBinding = agentRunAipodBindingDisclosure(task, aipod, record(renderedData.modelResolution), renderInput);
const sessionRef = record(task.sessionRef);
const metadata = record(sessionRef.metadata);
const title = agentRunOption(args, "title") ?? stringOrNull(task.title);
if (title) metadata.title = title;
const sessionPolicy = readAgentRunClientConfig().client.sessionPolicy;
const policyTarget = resolveAgentRunSessionPolicyTarget();
const backendProfile = stringOrNull(task.backendProfile);
if (backendProfile === null) throw new AgentRunRestError("schema-mismatch", `aipod-spec ${aipod} normalized queueTask has no backendProfile`);
const backendProfile = stringOrNull(task.backendProfile) ?? sessionPolicy.backendProfile;
const executionPolicy = record(task.executionPolicy);
const runBody: Record<string, unknown> = {
tenantId: stringOrNull(task.tenantId) ?? sessionPolicy.tenantId,
@@ -1015,7 +818,7 @@ export async function sessionSendWithAipodRest(sessionId: string, aipod: string,
aipod,
profile: String(task.backendProfile ?? ""),
sessionPolicy: agentRunSessionRunPolicyDisclosure(runBody),
aipodBinding,
aipodBinding: agentRunAipodBindingDisclosure(task, aipod),
valuesPrinted: false,
},
bridge: response.bridge,