version: 1 kind: AgentRunConfig metadata: name: agentrun manager: baseUrl: https://agentrun.74-48-78-17.nip.io/ timeoutMs: 15000 publicExposure: enabled: true proxyName: agentrun-v01-frpc remotePort: 22880 publicBaseUrl: https://agentrun.74-48-78-17.nip.io/ masterBaseUrl: http://127.0.0.1:22880 masterFrps: configPath: /opt/hwlab-frp/frps.dev.toml containerName: hwlab-frps-dev masterCaddy: enabled: true domain: agentrun.74-48-78-17.nip.io configPath: /etc/caddy/Caddyfile serviceName: caddy upstreamBaseUrl: http://127.0.0.1:22880 responseHeaderTimeoutSeconds: 60 auth: env: HWLAB_API_KEY file: /root/.unidesk/.env/agentrun.env header: Authorization scheme: Bearer client: role: render-only transport: direct-http sessionPolicy: tenantId: unidesk projectId: default providerId: NC01 backendProfile: codex workspaceRef: kind: opaque path: "." executionPolicy: sandbox: workspace-write approval: never timeoutMs: 900000 network: enabled secretScope: allowCredentialEcho: false controlPlane: default: node: NC01 lane: nc01-v02 nodes: NC01: route: NC01 kubeRoute: NC01:k3s lanes: nc01-v02: deployment: format: unidesk-yaml-only gitopsRoot: deploy/gitops/node/nc01 runtimeRenderDir: runtime-v02 artifactCatalogPath: deploy/artifact-catalog.nc01-v02.json argocd: project: agentrun-nc01-v02 applicationFile: application-v02.yaml manager: serviceAccount: agentrun-nc01-v02-mgr apiKeySecretRef: name: agentrun-v02-api-key key: HWLAB_API_KEY env: AGENTRUN_POSTGRES_POOL_MAX: "4" AGENTRUN_MANAGER_RECONCILER_BATCH_SIZE: "20" AGENTRUN_MANAGER_RECONCILER_ENABLED: "true" AGENTRUN_MANAGER_RECONCILER_INTERVAL_MS: "30000" AGENTRUN_RUNNER_DISPATCHER_ENABLED: "true" AGENTRUN_RUNNER_DISPATCHER_INTERVAL_MS: "1000" AGENTRUN_RUNNER_DISPATCHER_BATCH_SIZE: "10" AGENTRUN_RUNNER_DISPATCHER_LEASE_MS: "120000" AGENTRUN_RUNNER_DISPATCHER_ATTEMPT_TIMEOUT_MS: "90000" AGENTRUN_RUNNER_DISPATCHER_MAX_ATTEMPTS: "5" AGENTRUN_RUNNER_DISPATCHER_RETRY_BACKOFF_MS: "5000" AGENTRUN_KAFKA_ENABLED: "true" AGENTRUN_KAFKA_OUTBOX_INTERVAL_MS: "500" AGENTRUN_KAFKA_OUTBOX_BATCH_SIZE: "100" AGENTRUN_KAFKA_OUTBOX_LEASE_MS: "60000" AGENTRUN_KAFKA_OUTBOX_RETRY_BACKOFF_MS: "5000" AGENTRUN_KAFKA_STDIO_PRODUCE_ENABLED: "true" AGENTRUN_KAFKA_BOOTSTRAP_SERVERS: platform-infra-kafka-kafka-bootstrap.platform-infra.svc.cluster.local:9092 AGENTRUN_KAFKA_EVENT_TOPIC: agentrun.event.v1 AGENTRUN_KAFKA_STDIO_TOPIC: codex-stdio.raw.v1 AGENTRUN_KAFKA_CLIENT_ID: agentrun-v02-manager AGENTRUN_KAFKA_STDIO_CLIENT_ID: agentrun-v02-runner OTEL_EXPORTER_OTLP_TRACES_ENDPOINT: http://otel-collector.platform-infra.svc.cluster.local:4318/v1/traces OTEL_SERVICE_NAME: agentrun-manager UNIDESK_NODE_ID: NC01 HWLAB_RUNTIME_LANE: v0.3 unideskSshEndpointEnv: name: UNIDESK_MAIN_SERVER_IP value: 152.53.229.148 bootRepoUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-agentrun.git imageBuild: context: "." containerfile: deploy/container/Containerfile repository: agentrun-mgr-env network: host buildArgs: BUN_IMAGE: oven/bun:1-alpine httpProxy: http://127.0.0.1:10808 httpsProxy: http://127.0.0.1:10808 noProxy: - localhost - 127.0.0.1 - "::1" - 127.0.0.1:5000 - localhost:5000 - .svc - .svc.cluster.local - .cluster.local - hyueapi.com - .hyueapi.com buildContainerProxy: httpProxy: http://127.0.0.1:10808 httpsProxy: http://127.0.0.1:10808 noProxy: - localhost - 127.0.0.1 - "::1" - 127.0.0.1:5000 - localhost:5000 - .svc - .svc.cluster.local - .cluster.local - hyueapi.com - .hyueapi.com envIdentityFiles: - deploy/container/Containerfile - deploy/runtime/boot/agentrun-boot.sh - deploy/runtime/boot/agentrun-mgr.sh - deploy/runtime/boot/agentrun-runner.sh - src - scripts - package.json - bun.lock - tsconfig.json timeoutSeconds: 1800 pollSeconds: 15 resources: requests: cpu: 100m memory: 256Mi limits: cpu: 800m memory: 1Gi runner: serviceAccount: agentrun-nc01-v02-runner jobNamePrefix: agentrun-nc01-v02-runner idleTimeoutMs: 600000 backendRetry: maxAttempts: 5 initialBackoffMs: 1000 maxBackoffMs: 30000 apiKeySecretRef: name: agentrun-v02-api-key key: HWLAB_API_KEY egressProxyUrl: http://10.42.0.1:10808 noProxyExtra: - localhost - 127.0.0.1 - "::1" - .svc - .svc.cluster.local - .cluster.local - hyueapi.com - .hyueapi.com - api.pikapython.com - .pikapython.com retention: maxRunners: 20 cleanupOrder: oldest-inactive-last-active-first activeHeartbeatMaxAgeMs: 900000 stalePendingMaxAgeMs: 900000 selectors: matchLabels: app.kubernetes.io/part-of: agentrun app.kubernetes.io/name: agentrun-runner app.kubernetes.io/component: runner jobNamePrefixes: - agentrun-nc01-v02-runner - agentrun-v02-runner - agentrun-v01-runner ageBasedCleanup: enabled: false maxAgeHours: 48 sessionPvcRetention: enabled: true prefixes: - agentrun-v01-session- - agentrun-v02-session- - agentrun-nc01-v02-session- maxDeletePerRun: 1000 cancelLifecycle: deliveryMode: manager-epoch gracefulAbortMs: 15000 killEscalationMs: 30000 staleHeartbeatFencingMs: 900000 lateWriteFencing: enabled: true eventStages: - accepted - persisted - delivered - aborting - terminalized - fenced - late-write-rejected localPostgres: enabled: false serviceName: agentrun-v02-postgres image: postgres:16-alpine storage: 5Gi port: 5432 database: agentrun_v02 user: agentrun_v02 passwordSourceRef: agentrun/nc01-v02-local-postgres.env passwordSourceKey: POSTGRES_PASSWORD gitMirror: namespace: devops-infra readService: git-mirror-http readDeployment: git-mirror-http writeService: git-mirror-write writeDeployment: git-mirror-write resourceBundleBaseUrl: http://git-mirror-http.devops-infra.svc.cluster.local:8080 readUrl: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/agentrun.git writeUrl: http://git-mirror-write.devops-infra.svc.cluster.local:8080/pikasTech/agentrun.git cachePvc: hwlab-git-mirror-cache cacheHostPath: null sshSecretName: git-mirror-github-ssh githubProxy: host: 127.0.0.1 port: 10808 toolsImage: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1 syncJobPrefix: git-mirror-agentrun-nc01-v02-sync-manual flushJobPrefix: git-mirror-agentrun-nc01-v02-flush-manual repositoryReconciler: enabled: true deploymentName: agentrun-nc01-v02-managed-repository-reconciler configMapName: agentrun-nc01-v02-managed-repository-reconciler serviceAccountName: agentrun-nc01-v02-managed-repository-reconciler remoteAuth: configRef: config/platform-infra/gitea.yaml#sourceAuthority.credentials.github.gitFetchCredential hostNetwork: true dnsPolicy: ClusterFirstWithHostNet imagePullPolicy: IfNotPresent cacheMountPath: /cache stateDirectory: .agentrun-managed-repositories/nc01-v02 reconcileIntervalMs: 30000 fetchTimeoutMs: 240000 shutdownGraceMs: 30000 maxConcurrentRepositories: 2 retry: maxAttempts: 4 initialDelayMs: 1000 maxDelayMs: 15000 freshness: maxAgeMs: 180000 readiness: initialDelaySeconds: 5 periodSeconds: 10 timeoutSeconds: 5 failureThreshold: 6 status: defaultRepositoryLimit: 8 lifecycle: undeclaredRepositoryPolicy: retain managedRefs: source-branch-only resources: requests: cpu: 50m memory: 96Mi limits: cpu: 500m memory: 256Mi repositories: - key: agentrun repository: pikasTech/agentrun remote: https://github.com/pikasTech/agentrun.git sourceBranch: v0.2 gitopsBranch: nc01-v0.2-gitops - key: unidesk repository: pikasTech/unidesk remote: https://github.com/pikasTech/unidesk.git sourceBranch: master - key: agent_skills repository: pikasTech/agent_skills remote: https://github.com/pikasTech/agent_skills.git sourceBranch: master database: mode: external-postgres provider: NC01 configRef: config/platform-db/postgres-nc01.yaml database: agentrun_v02 user: agentrun_v02 sslmode: require secretSourceRef: agentrun/nc01-v02-mgr-db.env secretRef: name: agentrun-v02-mgr-db key: DATABASE_URL localPostgresExpectedAbsent: true toolCredentials: - extends: controlPlane.templates.toolCredentials.githubPr - extends: controlPlane.templates.toolCredentials.unideskSsh - extends: controlPlane.templates.toolCredentials.githubSsh secrets: - id: manager-api-key sourceRef: hwlab/nc01-v03-admin.env sourceKey: HWLAB_API_KEY targetRef: namespace: agentrun-v02 name: agentrun-v02-api-key key: HWLAB_API_KEY - id: provider-codex-auth-json sourceMode: file sourceRef: /root/.codex/auth.json targetRef: namespace: agentrun-v02 name: agentrun-v01-provider-codex key: auth.json providerCredential: profile: codex - id: provider-codex-config sourceMode: file sourceRef: /root/.codex/config.toml targetRef: namespace: agentrun-v02 name: agentrun-v01-provider-codex key: config.toml providerCredential: profile: codex - id: provider-gpt-pika-auth-json sourceMode: file sourceRef: /root/.codex/auth.json targetRef: namespace: agentrun-v02 name: agentrun-v02-provider-gpt-pika key: auth.json providerCredential: profile: gpt.pika - id: provider-gpt-pika-config sourceMode: codex-config sourceRef: config/agentrun.yaml#controlPlane.lanes.nc01-v02.secrets.provider-gpt-pika-config.codexConfig codexConfig: modelProvider: OpenAI model: gpt-5.4-mini reviewModel: gpt-5.4-mini modelReasoningEffort: xhigh disableResponseStorage: true networkAccess: enabled windowsWslSetupAcknowledged: true serviceTier: fast modelProviders: OpenAI: name: OpenAI baseUrl: https://api.pikapython.com/v1 wireApi: responses requiresOpenaiAuth: true features: goals: true projects: /root: trustLevel: trusted /root/unidesk: trustLevel: trusted tuiModelAvailabilityNux: gpt-5.4-mini: 4 targetRef: namespace: agentrun-v02 name: agentrun-v02-provider-gpt-pika key: config.toml providerCredential: profile: gpt.pika - id: provider-dsflash-go-auth-json sourceMode: env sourceRef: hwlab/nc01-v03-code-agent-provider.env sourceKey: OPENCODE_API_KEY transform: codex-auth-json-openai-api-key targetRef: namespace: agentrun-v02 name: agentrun-v01-provider-dsflash-go key: auth.json providerCredential: profile: dsflash-go - id: provider-dsflash-go-config sourceMode: codex-config sourceRef: config/agentrun.yaml#controlPlane.lanes.nc01-v02.secrets.provider-dsflash-go-config.codexConfig codexConfig: modelProvider: opencode model: deepseek-v4-flash reviewModel: deepseek-v4-flash modelReasoningEffort: xhigh disableResponseStorage: true networkAccess: enabled modelContextWindow: 1000000 modelAutoCompactTokenLimit: 900000 modelCatalogJson: /home/agentrun/.codex-dsflash-go/model-catalog.json approvalsReviewer: user modelProviders: opencode: name: Moon Bridge OpenCode Zen Go Flash baseUrl: http://hwlab-deepseek-proxy.hwlab-v03.svc.cluster.local:4000/v1 wireApi: responses requiresOpenaiAuth: true projects: /root: trustLevel: trusted /home/agentrun/workspaces: trustLevel: trusted tuiModelAvailabilityNux: deepseek-v4-flash: 4 noticeHideFullAccessWarning: true targetRef: namespace: agentrun-v02 name: agentrun-v01-provider-dsflash-go key: config.toml providerCredential: profile: dsflash-go - id: provider-dsflash-go-model-catalog sourceMode: json sourceRef: config/agentrun.yaml#controlPlane.lanes.nc01-v02.secrets.provider-dsflash-go-model-catalog.jsonValue jsonValue: models: - slug: deepseek-v4-flash display_name: DeepSeek V4 Flash via OpenCode Zen Go description: >- DeepSeek V4 Flash exposed to Codex through OpenCode Zen Go and a Responses-compatible Moon Bridge profile. default_reasoning_level: xhigh supported_reasoning_levels: - effort: low description: Fast responses with lighter reasoning - effort: medium description: Balanced reasoning - effort: high description: Deep reasoning - effort: xhigh description: Maximum reasoning shell_type: shell_command visibility: list supported_in_api: true priority: 0 additional_speed_tiers: [] service_tiers: [] availability_nux: null upgrade: null base_instructions: >- You are Codex, a coding agent based on DeepSeek V4 Flash. You and the user share one workspace, and your job is to collaborate with them until their goal is genuinely handled. model_messages: {} supports_reasoning_summaries: true default_reasoning_summary: auto support_verbosity: false apply_patch_tool_type: freeform web_search_tool_type: text_and_image truncation_policy: mode: tokens limit: 10000 supports_parallel_tool_calls: true supports_image_detail_original: false context_window: 1000000 max_context_window: 1000000 auto_compact_token_limit: 900000 effective_context_window_percent: 95 experimental_supported_tools: [] input_modalities: - text supports_search_tool: false targetRef: namespace: agentrun-v02 name: agentrun-v01-provider-dsflash-go key: model-catalog.json providerCredential: profile: dsflash-go - extends: controlPlane.templates.secrets.githubPrRawToken - extends: controlPlane.templates.secrets.unideskSshToken - extends: controlPlane.templates.secrets.githubSshPrivateKey - extends: controlPlane.templates.secrets.githubSshKnownHosts extends: controlPlane.templates.agentrunV02Lane variables: NODE: NC01 remote: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-agentrun.git workspace: /root/agentrun-v02 pipeline: agentrun-nc01-v02-ci-image-publish pipelineRunPrefix: agentrun-nc01-v02-ci serviceAccountName: agentrun-nc01-v02-tekton-runner gitopsBranch: nc01-v0.2-gitops gitopsPath: deploy/gitops/node/nc01/runtime-v02 argoApplication: agentrun-nc01-v02 templates: agentrunV02Lane: version: v0.2 node: "${NODE}" source: statusMode: k3s-git-mirror repository: pikasTech/agentrun worktreeRemote: git@github.com:pikasTech/agentrun.git branch: v0.2 sourceAuthority: mode: gitMirrorSnapshot resolver: k8s-git-mirror allowHostGit: false allowHostWorkspace: false allowGithubDirectInPipeline: false sourceSnapshot: stageRefPrefix: "refs/unidesk/snapshots/agentrun-yaml-lane/{branch}" missingObjectPolicy: fail-fast refreshPolicy: sync-before-snapshot bootstrapFromBranch: v0.1 bootstrapTimeoutSeconds: 900 bootstrapPollSeconds: 15 remote: "${remote}" workspace: "${workspace}" runtime: namespace: agentrun-v02 managerDeployment: agentrun-mgr managerService: agentrun-mgr managerPort: 8080 internalBaseUrl: http://agentrun-mgr.agentrun-v02.svc.cluster.local:8080 ci: namespace: agentrun-ci pipeline: "${pipeline}" pipelineRunPrefix: "${pipelineRunPrefix}" serviceAccountName: "${serviceAccountName}" registryPrefix: 127.0.0.1:5000/agentrun toolsImage: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1 buildkitImage: 127.0.0.1:5000/hwlab/buildkit:rootless gitops: branch: "${gitopsBranch}" path: "${gitopsPath}" argoNamespace: argocd argoApplication: "${argoApplication}" repoURL: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/agentrun.git toolCredentials: githubPr: id: github-pr tool: github purpose: github-pr secretRef: namespace: agentrun-v02 name: agentrun-v01-tool-github-pr keys: - GH_TOKEN projection: kind: env envName: GH_TOKEN secretKey: GH_TOKEN unideskSsh: id: unidesk-ssh tool: unidesk-ssh purpose: ssh-passthrough secretRef: namespace: agentrun-v02 name: agentrun-v01-tool-unidesk-ssh keys: - UNIDESK_SSH_CLIENT_TOKEN projection: kind: env envName: UNIDESK_SSH_CLIENT_TOKEN secretKey: UNIDESK_SSH_CLIENT_TOKEN githubSsh: id: github-ssh tool: github purpose: github-ssh secretRef: namespace: agentrun-v02 name: agentrun-v01-tool-github-ssh keys: - id_ed25519 - known_hosts projection: kind: volume mountPath: /home/agentrun/.ssh secrets: githubPrRawToken: id: tool-github-pr-token sourceRef: /root/.unidesk/.env/gh_token.txt sourceKey: GH_TOKEN sourceFormat: raw-token targetRef: namespace: agentrun-v02 name: agentrun-v01-tool-github-pr key: GH_TOKEN unideskSshToken: id: tool-unidesk-ssh-token sourceRef: /root/.unidesk/.state/docker-compose.env sourceKey: UNIDESK_SSH_CLIENT_TOKEN targetRef: namespace: agentrun-v02 name: agentrun-v01-tool-unidesk-ssh key: UNIDESK_SSH_CLIENT_TOKEN githubSshPrivateKey: id: tool-github-ssh-private-key sourceMode: file sourceRef: deploy-ssh/github.com/id_ed25519 targetRef: namespace: agentrun-v02 name: agentrun-v01-tool-github-ssh key: id_ed25519 githubSshKnownHosts: id: tool-github-ssh-known-hosts sourceMode: file sourceRef: deploy-ssh/github.com/known_hosts targetRef: namespace: agentrun-v02 name: agentrun-v01-tool-github-ssh key: known_hosts