Codex
950 lines
45 KiB
TypeScript
950 lines
45 KiB
TypeScript
// SPEC: pikasTech/unidesk#1190 fake Responses provider for HWLAB v0.3 / AgentRun v0.2.
|
|
// Responsibility: YAML-first fake model provider materialization, k3s apply, status, and smoke checks.
|
|
import { createHash, randomBytes } from "node:crypto";
|
|
import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
|
|
import { dirname, join } from "node:path";
|
|
import { repoRoot, rootPath, type Config } from "./config";
|
|
import { runCommand, type CommandResult } from "./command";
|
|
import { resolveCliChildJsonCommandResult } from "./cli-child-json-recovery";
|
|
import { resolveAgentRunLaneTarget, type AgentRunLaneSpec } from "./agentrun-lanes";
|
|
import { resolveSecretSourceRoot } from "./agentrun/secrets";
|
|
import { hwlabRuntimeLaneSpecForNode, isHwlabRuntimeLane, type HwlabRuntimeLane, type HwlabRuntimeLaneSpec } from "./hwlab-node-lanes";
|
|
import { parseEnvFile, sha256Fingerprint, shQuote } from "./platform-infra-ops-library";
|
|
|
|
type FakeModelProviderAction = "plan" | "materialize" | "apply" | "status" | "smoke";
|
|
|
|
interface FakeModelProviderOptions {
|
|
action: FakeModelProviderAction;
|
|
node: string;
|
|
lane: HwlabRuntimeLane;
|
|
provider: string;
|
|
confirm: boolean;
|
|
dryRun: boolean;
|
|
timeoutSeconds: number;
|
|
full: boolean;
|
|
}
|
|
|
|
interface FakeModelProviderState {
|
|
options: FakeModelProviderOptions;
|
|
spec: HwlabRuntimeLaneSpec;
|
|
rootPath: string;
|
|
root: Record<string, unknown>;
|
|
runtimeRef: string;
|
|
secretsRef: string;
|
|
profileRef: string;
|
|
runtime: Record<string, unknown>;
|
|
secrets: Record<string, unknown>;
|
|
profile: Record<string, unknown>;
|
|
agentrun: {
|
|
configPath: string;
|
|
spec: AgentRunLaneSpec;
|
|
secretSourceRoot: string;
|
|
};
|
|
}
|
|
|
|
interface SourceMaterial {
|
|
purpose: string;
|
|
sourceRef: string;
|
|
sourceKey: string | null;
|
|
sourcePath: string;
|
|
existsBefore: boolean;
|
|
mutation: boolean;
|
|
valueBytes: number;
|
|
fingerprint: string;
|
|
valuesPrinted: false;
|
|
}
|
|
|
|
interface MaterializationResult {
|
|
ok: boolean;
|
|
mutation: boolean;
|
|
secretSourceRoot: string;
|
|
sources: SourceMaterial[];
|
|
files: Array<{
|
|
purpose: string;
|
|
sourceRef: string;
|
|
sourcePath: string;
|
|
existsBefore: boolean;
|
|
mutation: boolean;
|
|
byteCount: number;
|
|
fingerprint: string;
|
|
valuesPrinted: false;
|
|
}>;
|
|
providerApiKey: string;
|
|
valuesPrinted: false;
|
|
}
|
|
|
|
export function fakeModelProviderHelp(): Record<string, unknown> {
|
|
return {
|
|
ok: true,
|
|
command: "hwlab nodes fake-model-provider",
|
|
description: "YAML-first fake OpenAI-compatible Responses provider for HWLAB/AgentRun sentinel smoke.",
|
|
examples: [
|
|
"bun scripts/cli.ts hwlab nodes fake-model-provider plan --node D518 --lane v03 --provider fake-echo",
|
|
"bun scripts/cli.ts hwlab nodes fake-model-provider materialize --node D518 --lane v03 --provider fake-echo --confirm",
|
|
"bun scripts/cli.ts hwlab nodes fake-model-provider apply --node D518 --lane v03 --provider fake-echo --confirm",
|
|
"bun scripts/cli.ts hwlab nodes fake-model-provider status --node D518 --lane v03 --provider fake-echo",
|
|
"bun scripts/cli.ts hwlab nodes fake-model-provider smoke --node D518 --lane v03 --provider fake-echo",
|
|
],
|
|
actions: {
|
|
plan: "Read YAML configRefs and show local source/materialization and target k3s objects without mutation.",
|
|
materialize: "Create/update local .state/secrets source files for provider auth, Codex config, and sentinel prompt set.",
|
|
apply: "Materialize local sources, then apply ConfigMap/Secret/Deployment/Service to the selected node k3s namespace.",
|
|
status: "Inspect remote Deployment/Service/Secret/ConfigMap/pod readiness and /healthz without printing values.",
|
|
smoke: "Exec a deterministic ECHO streaming and non-ECHO error check inside the fake provider pod.",
|
|
},
|
|
notes: [
|
|
"Mutation actions require --confirm; --dry-run is accepted for apply.",
|
|
"Secret values are never printed; output is limited to sourceRef, key names, byte counts, and fingerprints.",
|
|
],
|
|
};
|
|
}
|
|
|
|
export async function runHwlabFakeModelProviderCommand(_config: Config, args: string[]): Promise<Record<string, unknown>> {
|
|
if (args.length === 0 || args.includes("--help") || args.includes("-h") || args[0] === "help") return fakeModelProviderHelp();
|
|
const options = parseFakeModelProviderOptions(args);
|
|
const state = readFakeModelProviderState(options);
|
|
if (options.action === "plan") return planFakeModelProvider(state);
|
|
if (options.action === "materialize") {
|
|
if (!options.confirm) throw new Error("fake-model-provider materialize requires --confirm");
|
|
const materialized = materializeFakeModelProviderSources(state);
|
|
return {
|
|
ok: materialized.ok,
|
|
command: "hwlab nodes fake-model-provider materialize",
|
|
node: options.node,
|
|
lane: options.lane,
|
|
provider: options.provider,
|
|
mutation: materialized.mutation,
|
|
materialized: redactMaterialization(materialized),
|
|
next: {
|
|
providerApply: `bun scripts/cli.ts hwlab nodes fake-model-provider apply --node ${options.node} --lane ${options.lane} --provider ${options.provider} --confirm`,
|
|
agentrunSecretSync: `bun scripts/cli.ts agentrun control-plane secret-sync --node ${options.node} --lane ${state.agentrun.spec.lane} --confirm`,
|
|
},
|
|
valuesPrinted: false,
|
|
};
|
|
}
|
|
if (options.action === "apply") return applyFakeModelProvider(state);
|
|
if (options.action === "status") return remoteFakeModelProviderStatus(state);
|
|
if (options.action === "smoke") return remoteFakeModelProviderSmoke(state);
|
|
throw new Error(`unsupported fake-model-provider action: ${options.action}`);
|
|
}
|
|
|
|
function parseFakeModelProviderOptions(args: string[]): FakeModelProviderOptions {
|
|
const [actionRaw] = args;
|
|
if (actionRaw !== "plan" && actionRaw !== "materialize" && actionRaw !== "apply" && actionRaw !== "status" && actionRaw !== "smoke") {
|
|
throw new Error(`fake-model-provider action must be plan, materialize, apply, status, or smoke; got ${actionRaw ?? "<missing>"}`);
|
|
}
|
|
const knownString = new Set(["--node", "--lane", "--provider", "--timeout-seconds"]);
|
|
const knownFlags = new Set(["--confirm", "--dry-run", "--full", "--raw"]);
|
|
for (let index = 1; index < args.length; index += 1) {
|
|
const arg = args[index];
|
|
if (knownString.has(arg)) {
|
|
const value = args[index + 1];
|
|
if (value === undefined || value.startsWith("--")) throw new Error(`${arg} requires a value`);
|
|
index += 1;
|
|
continue;
|
|
}
|
|
if (knownFlags.has(arg)) continue;
|
|
throw new Error(`unsupported fake-model-provider option: ${arg}`);
|
|
}
|
|
const node = requiredOption(args, "--node");
|
|
if (!/^[A-Z][A-Z0-9_-]*$/u.test(node)) throw new Error("--node must be a simple node id such as D518");
|
|
const laneRaw = requiredOption(args, "--lane");
|
|
if (!isHwlabRuntimeLane(laneRaw)) throw new Error(`--lane must be one of v02, v03; got ${laneRaw}`);
|
|
const provider = optionValue(args, "--provider") ?? "fake-echo";
|
|
if (!/^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/u.test(provider)) throw new Error("--provider must be a Kubernetes-safe id");
|
|
const confirm = args.includes("--confirm");
|
|
const dryRun = args.includes("--dry-run");
|
|
if (confirm && dryRun) throw new Error("fake-model-provider accepts only one of --confirm or --dry-run");
|
|
if (actionRaw === "apply" && !confirm && !dryRun) throw new Error("fake-model-provider apply requires --dry-run or --confirm");
|
|
if (actionRaw !== "apply" && dryRun) throw new Error(`fake-model-provider ${actionRaw} does not accept --dry-run`);
|
|
if ((actionRaw === "status" || actionRaw === "smoke" || actionRaw === "plan") && confirm) throw new Error(`fake-model-provider ${actionRaw} is read-only and does not accept --confirm`);
|
|
return {
|
|
action: actionRaw,
|
|
node,
|
|
lane: laneRaw,
|
|
provider,
|
|
confirm,
|
|
dryRun,
|
|
timeoutSeconds: positiveIntegerOption(args, "--timeout-seconds", 120, 900),
|
|
full: args.includes("--full") || args.includes("--raw"),
|
|
};
|
|
}
|
|
|
|
function readFakeModelProviderState(options: FakeModelProviderOptions): FakeModelProviderState {
|
|
const spec = hwlabRuntimeLaneSpecForNode(options.lane, options.node);
|
|
const configPath = rootPath("config", "hwlab-fake-model-provider", `${options.node.toLowerCase()}-${options.lane}`, `${options.provider}.yaml`);
|
|
if (!existsSync(configPath)) throw new Error(`fake provider config is missing: ${repoRelative(configPath)}`);
|
|
const root = readYamlRecord(configPath, "HwlabFakeModelProvider");
|
|
const provider = record(root.provider, "provider");
|
|
if (stringAt(provider, "id") !== options.provider) throw new Error(`${repoRelative(configPath)} provider.id must be ${options.provider}`);
|
|
if (provider.enabled !== true) throw new Error(`${repoRelative(configPath)} provider.enabled must be true`);
|
|
const target = record(provider.target, "provider.target");
|
|
if (stringAt(target, "node") !== options.node) throw new Error(`${repoRelative(configPath)} provider.target.node must be ${options.node}`);
|
|
if (stringAt(target, "lane") !== options.lane) throw new Error(`${repoRelative(configPath)} provider.target.lane must be ${options.lane}`);
|
|
const configRefs = record(provider.configRefs, "provider.configRefs");
|
|
const runtimeRef = stringAt(configRefs, "runtime");
|
|
const secretsRef = stringAt(configRefs, "secrets");
|
|
const profileRef = stringAt(configRefs, "profile");
|
|
const runtime = record(readConfigRefTarget(runtimeRef), runtimeRef);
|
|
const secrets = record(readConfigRefTarget(secretsRef), secretsRef);
|
|
const profile = record(readConfigRefTarget(profileRef), profileRef);
|
|
const runtimeTarget = record(runtime.target, "provider.runtime.target");
|
|
const agentrunLane = stringAt(runtimeTarget, "agentrunLane");
|
|
const agentrunTarget = resolveAgentRunLaneTarget({ node: options.node, lane: agentrunLane });
|
|
return {
|
|
options,
|
|
spec,
|
|
rootPath: configPath,
|
|
root,
|
|
runtimeRef,
|
|
secretsRef,
|
|
profileRef,
|
|
runtime,
|
|
secrets,
|
|
profile,
|
|
agentrun: {
|
|
configPath: agentrunTarget.configPath,
|
|
spec: agentrunTarget.spec,
|
|
secretSourceRoot: resolveSecretSourceRoot(agentrunTarget.spec),
|
|
},
|
|
};
|
|
}
|
|
|
|
function planFakeModelProvider(state: FakeModelProviderState): Record<string, unknown> {
|
|
const runtime = state.runtime;
|
|
const profile = state.profile;
|
|
const materialization = plannedMaterialSources(state);
|
|
return {
|
|
ok: true,
|
|
command: "hwlab nodes fake-model-provider plan",
|
|
node: state.options.node,
|
|
lane: state.options.lane,
|
|
provider: state.options.provider,
|
|
configRefs: {
|
|
root: repoRelative(state.rootPath),
|
|
runtime: state.runtimeRef,
|
|
secrets: state.secretsRef,
|
|
profile: state.profileRef,
|
|
},
|
|
runtime: {
|
|
namespace: stringAt(runtime, "namespace"),
|
|
deployment: stringAt(runtime, "deploymentName"),
|
|
service: stringAt(runtime, "serviceName"),
|
|
configMap: stringAt(runtime, "configMapName"),
|
|
secret: stringAt(runtime, "secretName"),
|
|
image: record(runtime.image, "provider.runtime.image").imageRef,
|
|
model: record(runtime.config, "provider.runtime.config").modelId,
|
|
endpoint: `http://${stringAt(runtime, "serviceName")}.${stringAt(runtime, "namespace")}.svc.cluster.local:${numberAt(runtime, "servicePort")}/v1`,
|
|
},
|
|
agentrun: {
|
|
configPath: repoRelative(state.agentrun.configPath.startsWith("/") ? state.agentrun.configPath : rootPath(state.agentrun.configPath)),
|
|
node: state.agentrun.spec.nodeId,
|
|
lane: state.agentrun.spec.lane,
|
|
namespace: state.agentrun.spec.runtime.namespace,
|
|
providerCredential: record(profile.providerCredential, "provider.profile.providerCredential"),
|
|
secretSourceRoot: displayPath(state.agentrun.secretSourceRoot),
|
|
},
|
|
localSources: materialization,
|
|
next: {
|
|
materialize: `bun scripts/cli.ts hwlab nodes fake-model-provider materialize --node ${state.options.node} --lane ${state.options.lane} --provider ${state.options.provider} --confirm`,
|
|
apply: `bun scripts/cli.ts hwlab nodes fake-model-provider apply --node ${state.options.node} --lane ${state.options.lane} --provider ${state.options.provider} --confirm`,
|
|
agentrunSecretSync: `bun scripts/cli.ts agentrun control-plane secret-sync --node ${state.options.node} --lane ${state.agentrun.spec.lane} --confirm`,
|
|
sentinelPlan: `bun scripts/cli.ts web-probe sentinel plan --node ${state.options.node} --lane ${state.options.lane} --sentinel workbench-fake-echo-session-invariance-10x`,
|
|
},
|
|
valuesPrinted: false,
|
|
};
|
|
}
|
|
|
|
function plannedMaterialSources(state: FakeModelProviderState): Record<string, unknown> {
|
|
const sources = [];
|
|
const providerSource = sourceByPurpose(state.secrets, "provider-api-key");
|
|
const promptSource = sourceByPurpose(state.secrets, "sentinel-prompts");
|
|
for (const source of [providerSource, promptSource]) {
|
|
const sourceRef = stringAt(source, "sourceRef");
|
|
const sourceKey = stringAt(source, "sourceKey");
|
|
const sourcePath = secretSourcePath(state, sourceRef);
|
|
const values = existsSync(sourcePath) ? parseEnvFile(readFileSync(sourcePath, "utf8")) : {};
|
|
const value = values[sourceKey] ?? "";
|
|
sources.push({
|
|
purpose: stringAt(source, "purpose"),
|
|
sourceRef,
|
|
sourceKey,
|
|
sourcePath: displayPath(sourcePath),
|
|
exists: existsSync(sourcePath),
|
|
keyPresent: value.length > 0,
|
|
valueBytes: value.length > 0 ? Buffer.byteLength(value) : 0,
|
|
fingerprint: value.length > 0 ? sha256Fingerprint(value) : null,
|
|
valuesPrinted: false,
|
|
});
|
|
}
|
|
const credential = record(state.profile.providerCredential, "provider.profile.providerCredential");
|
|
const files = [stringAt(credential, "authJsonSourceRef"), stringAt(credential, "configTomlSourceRef")].map((sourceRef) => {
|
|
const sourcePath = secretSourcePath(state, sourceRef);
|
|
const value = existsSync(sourcePath) ? readFileSync(sourcePath, "utf8") : "";
|
|
return {
|
|
sourceRef,
|
|
sourcePath: displayPath(sourcePath),
|
|
exists: existsSync(sourcePath),
|
|
byteCount: Buffer.byteLength(value),
|
|
fingerprint: value.length > 0 ? sha256Fingerprint(value) : null,
|
|
valuesPrinted: false,
|
|
};
|
|
});
|
|
return {
|
|
secretSourceRoot: displayPath(state.agentrun.secretSourceRoot),
|
|
sources,
|
|
files,
|
|
valuesPrinted: false,
|
|
};
|
|
}
|
|
|
|
function materializeFakeModelProviderSources(state: FakeModelProviderState): MaterializationResult {
|
|
const providerSource = sourceByPurpose(state.secrets, "provider-api-key");
|
|
const promptSource = sourceByPurpose(state.secrets, "sentinel-prompts");
|
|
const apiKey = ensureEnvSourceValue(state, providerSource, () => randomBytes(randomHexBytes(providerSource, 24)).toString("hex"));
|
|
const promptJson = JSON.stringify(fakeEchoPrompts());
|
|
const prompts = ensureEnvSourceExactValue(state, promptSource, promptJson);
|
|
const credential = record(state.profile.providerCredential, "provider.profile.providerCredential");
|
|
const authJsonRef = stringAt(credential, "authJsonSourceRef");
|
|
const configTomlRef = stringAt(credential, "configTomlSourceRef");
|
|
const authJson = `${JSON.stringify({ OPENAI_API_KEY: apiKey.value }, null, 2)}\n`;
|
|
const configToml = renderFakeEchoCodexConfig(state);
|
|
const authFile = writeSecretFileSource(state, authJsonRef, authJson, "provider-auth-json");
|
|
const configFile = writeSecretFileSource(state, configTomlRef, configToml, "provider-config-toml");
|
|
const mutation = apiKey.mutation || prompts.mutation || authFile.mutation || configFile.mutation;
|
|
return {
|
|
ok: true,
|
|
mutation,
|
|
secretSourceRoot: displayPath(state.agentrun.secretSourceRoot),
|
|
sources: [apiKey, prompts],
|
|
files: [authFile, configFile],
|
|
providerApiKey: apiKey.value,
|
|
valuesPrinted: false,
|
|
};
|
|
}
|
|
|
|
function redactMaterialization(materialized: MaterializationResult): Record<string, unknown> {
|
|
return {
|
|
ok: materialized.ok,
|
|
mutation: materialized.mutation,
|
|
secretSourceRoot: materialized.secretSourceRoot,
|
|
sources: materialized.sources.map(({ value: _value, ...item }) => item),
|
|
files: materialized.files,
|
|
valuesPrinted: false,
|
|
};
|
|
}
|
|
|
|
function applyFakeModelProvider(state: FakeModelProviderState): Record<string, unknown> {
|
|
if (state.options.dryRun) {
|
|
const preview = renderFakeModelProviderManifests(state, null);
|
|
return {
|
|
ok: true,
|
|
command: "hwlab nodes fake-model-provider apply --dry-run",
|
|
node: state.options.node,
|
|
lane: state.options.lane,
|
|
provider: state.options.provider,
|
|
mutation: false,
|
|
manifest: preview.summary,
|
|
localSources: plannedMaterialSources(state),
|
|
confirm: `bun scripts/cli.ts hwlab nodes fake-model-provider apply --node ${state.options.node} --lane ${state.options.lane} --provider ${state.options.provider} --confirm`,
|
|
valuesPrinted: false,
|
|
};
|
|
}
|
|
if (!state.options.confirm) throw new Error("fake-model-provider apply requires --confirm");
|
|
const materialized = materializeFakeModelProviderSources(state);
|
|
const rendered = renderFakeModelProviderManifests(state, materialized.providerApiKey);
|
|
const applyResult = runRemoteApply(state, rendered.yaml);
|
|
const applyResolution = resolveFakeModelProviderRemotePayload(applyResult, "fake-model-provider apply JSON");
|
|
const applyPayload = applyResolution.parsed ?? {};
|
|
const status = remoteFakeModelProviderStatus(state);
|
|
return {
|
|
ok: applyResult.exitCode === 0 && applyPayload.ok === true && status.ok === true,
|
|
command: "hwlab nodes fake-model-provider apply",
|
|
node: state.options.node,
|
|
lane: state.options.lane,
|
|
provider: state.options.provider,
|
|
mutation: true,
|
|
materialized: redactMaterialization(materialized),
|
|
manifest: rendered.summary,
|
|
apply: Object.keys(applyPayload).length > 0 ? { ...applyPayload, stdoutRecovery: applyResolution.diagnostics, valuesRedacted: true } : { ...compactCommand(applyResult, state.options.full), stdoutRecovery: applyResolution.diagnostics },
|
|
status,
|
|
next: {
|
|
smoke: `bun scripts/cli.ts hwlab nodes fake-model-provider smoke --node ${state.options.node} --lane ${state.options.lane} --provider ${state.options.provider}`,
|
|
agentrunSecretSync: `bun scripts/cli.ts agentrun control-plane secret-sync --node ${state.options.node} --lane ${state.agentrun.spec.lane} --confirm`,
|
|
sentinelTrigger: "bun scripts/cli.ts web-probe sentinel control-plane trigger-current --node D518 --lane v03 --sentinel workbench-fake-echo-session-invariance-10x --confirm --wait",
|
|
},
|
|
valuesPrinted: false,
|
|
};
|
|
}
|
|
|
|
function renderFakeModelProviderManifests(state: FakeModelProviderState, apiKey: string | null): { yaml: string; summary: Record<string, unknown> } {
|
|
const runtime = state.runtime;
|
|
const namespace = stringAt(runtime, "namespace");
|
|
const serviceName = stringAt(runtime, "serviceName");
|
|
const deploymentName = stringAt(runtime, "deploymentName");
|
|
const configMapName = stringAt(runtime, "configMapName");
|
|
const secretName = stringAt(runtime, "secretName");
|
|
const containerName = stringAt(runtime, "containerName");
|
|
const servicePort = numberAt(runtime, "servicePort");
|
|
const image = record(runtime.image, "provider.runtime.image");
|
|
const config = record(runtime.config, "provider.runtime.config");
|
|
const resources = record(runtime.resources, "provider.runtime.resources");
|
|
const probes = record(runtime.probes, "provider.runtime.probes");
|
|
const source = record(runtime.source, "provider.runtime.source");
|
|
const files = arrayAt(source, "files").map((item) => {
|
|
if (typeof item !== "string" || item.length === 0 || item.startsWith("/") || item.includes("..")) throw new Error("provider.runtime.source.files entries must be relative safe paths");
|
|
const path = rootPath(item);
|
|
if (!existsSync(path)) throw new Error(`fake provider source file is missing: ${item}`);
|
|
return { path: item, key: sourceConfigKey(item), content: readFileSync(path, "utf8") };
|
|
});
|
|
const labels = {
|
|
"app.kubernetes.io/name": serviceName,
|
|
"app.kubernetes.io/part-of": "hwlab-fake-model-provider",
|
|
"app.kubernetes.io/managed-by": "unidesk",
|
|
"unidesk.ai/node": state.options.node,
|
|
"unidesk.ai/lane": state.options.lane,
|
|
"unidesk.ai/provider": state.options.provider,
|
|
};
|
|
const objects: Record<string, unknown>[] = [{
|
|
apiVersion: "v1",
|
|
kind: "Namespace",
|
|
metadata: { name: namespace },
|
|
}, {
|
|
apiVersion: "v1",
|
|
kind: "ConfigMap",
|
|
metadata: { name: configMapName, namespace, labels },
|
|
data: Object.fromEntries(files.map((file) => [file.key, file.content])),
|
|
}];
|
|
if (apiKey !== null) {
|
|
objects.push({
|
|
apiVersion: "v1",
|
|
kind: "Secret",
|
|
metadata: { name: secretName, namespace, labels },
|
|
type: "Opaque",
|
|
stringData: { "api-key": apiKey },
|
|
});
|
|
}
|
|
objects.push({
|
|
apiVersion: "apps/v1",
|
|
kind: "Deployment",
|
|
metadata: { name: deploymentName, namespace, labels },
|
|
spec: {
|
|
replicas: 1,
|
|
selector: { matchLabels: { "app.kubernetes.io/name": serviceName, "unidesk.ai/provider": state.options.provider } },
|
|
template: {
|
|
metadata: { labels },
|
|
spec: {
|
|
serviceAccountName: stringAt(runtime, "serviceAccountName"),
|
|
volumes: [{ name: "provider-source", configMap: { name: configMapName } }],
|
|
containers: [{
|
|
name: containerName,
|
|
image: stringAt(image, "imageRef"),
|
|
imagePullPolicy: stringAt(image, "imagePullPolicy"),
|
|
command: ["/bin/sh", "-ec"],
|
|
args: [providerContainerCommand(files, stringAt(source, "entrypoint"))],
|
|
env: [
|
|
{ name: "LISTEN_HOST", value: stringAt(runtime, "listenHost") },
|
|
{ name: "PORT", value: String(servicePort) },
|
|
{ name: "FAKE_RESPONSES_MODEL_ID", value: stringAt(config, "modelId") },
|
|
{ name: "FAKE_RESPONSES_MODE", value: stringAt(config, "mode") },
|
|
{ name: "FAKE_RESPONSES_DELAY_MS", value: String(numberAt(config, "responseDelayMs")) },
|
|
{ name: "FAKE_RESPONSES_VERSION", value: sourceDigest(files).slice(0, 16) },
|
|
{ name: "FAKE_ECHO_API_KEY", valueFrom: { secretKeyRef: { name: secretName, key: "api-key", optional: true } } },
|
|
],
|
|
ports: [{ name: "http", containerPort: servicePort }],
|
|
resources,
|
|
readinessProbe: {
|
|
httpGet: { path: stringAt(runtime, "healthPath"), port: "http" },
|
|
initialDelaySeconds: numberAt(probes, "initialDelaySeconds"),
|
|
periodSeconds: numberAt(probes, "periodSeconds"),
|
|
timeoutSeconds: numberAt(probes, "timeoutSeconds"),
|
|
failureThreshold: numberAt(probes, "failureThreshold"),
|
|
},
|
|
livenessProbe: {
|
|
httpGet: { path: stringAt(runtime, "healthPath"), port: "http" },
|
|
initialDelaySeconds: numberAt(probes, "initialDelaySeconds"),
|
|
periodSeconds: numberAt(probes, "periodSeconds"),
|
|
timeoutSeconds: numberAt(probes, "timeoutSeconds"),
|
|
failureThreshold: numberAt(probes, "failureThreshold"),
|
|
},
|
|
volumeMounts: [{ name: "provider-source", mountPath: "/config/provider-source", readOnly: true }],
|
|
}],
|
|
},
|
|
},
|
|
},
|
|
}, {
|
|
apiVersion: "v1",
|
|
kind: "Service",
|
|
metadata: { name: serviceName, namespace, labels },
|
|
spec: {
|
|
type: "ClusterIP",
|
|
selector: { "app.kubernetes.io/name": serviceName, "unidesk.ai/provider": state.options.provider },
|
|
ports: [{ name: "http", port: servicePort, targetPort: "http" }],
|
|
},
|
|
});
|
|
const yaml = `${objects.map((item) => Bun.YAML.stringify(item).trim()).join("\n---\n")}\n`;
|
|
return {
|
|
yaml,
|
|
summary: {
|
|
namespace,
|
|
objects: objects.map((item) => `${item.kind}/${record(item.metadata, "metadata").name}`),
|
|
manifestSha256: sha256Fingerprint(yaml),
|
|
sourceFiles: files.map((file) => ({ path: file.path, key: file.key, bytes: Buffer.byteLength(file.content), sha256: sha256Fingerprint(file.content) })),
|
|
secretIncluded: apiKey !== null,
|
|
valuesPrinted: false,
|
|
},
|
|
};
|
|
}
|
|
|
|
function providerContainerCommand(files: Array<{ path: string; key: string }>, entrypoint: string): string {
|
|
if (entrypoint.startsWith("/") || entrypoint.includes("..")) throw new Error("provider.runtime.source.entrypoint must be a relative safe path");
|
|
return [
|
|
"set -eu",
|
|
"rm -rf /work",
|
|
"mkdir -p /work",
|
|
...files.map((file) => {
|
|
const target = `/work/${file.path}`;
|
|
return `mkdir -p ${shQuote(dirname(target))}; cp ${shQuote(`/config/provider-source/${file.key}`)} ${shQuote(target)}`;
|
|
}),
|
|
"cd /work",
|
|
`exec bun ${shQuote(entrypoint)}`,
|
|
].join("\n");
|
|
}
|
|
|
|
function runRemoteApply(state: FakeModelProviderState, manifestYaml: string): CommandResult {
|
|
const runtime = state.runtime;
|
|
const namespace = stringAt(runtime, "namespace");
|
|
const deployment = stringAt(runtime, "deploymentName");
|
|
const timeout = Math.min(state.options.timeoutSeconds, 300);
|
|
const script = [
|
|
"set +e",
|
|
`namespace=${shQuote(namespace)}`,
|
|
`deployment=${shQuote(deployment)}`,
|
|
"tmp=$(mktemp -d)",
|
|
"trap 'rm -rf \"$tmp\"' EXIT",
|
|
"manifest=\"$tmp/fake-model-provider.yaml\"",
|
|
"cat >\"$manifest\"",
|
|
"kubectl apply --server-side --force-conflicts --field-manager=unidesk-hwlab-fake-model-provider -f \"$manifest\" >/tmp/fake-provider-apply.out 2>/tmp/fake-provider-apply.err",
|
|
"apply_rc=$?",
|
|
"rollout_rc=0",
|
|
"if [ \"$apply_rc\" -eq 0 ]; then",
|
|
` kubectl -n "$namespace" rollout status deployment/"$deployment" --timeout=${timeout}s >/tmp/fake-provider-rollout.out 2>/tmp/fake-provider-rollout.err`,
|
|
" rollout_rc=$?",
|
|
"fi",
|
|
"python3 - \"$apply_rc\" \"$rollout_rc\" <<'PY'",
|
|
"import json, pathlib, sys",
|
|
"apply_rc = int(sys.argv[1]); rollout_rc = int(sys.argv[2])",
|
|
"def tail(path, n=4000):",
|
|
" try: return pathlib.Path(path).read_text(errors='replace')[-n:]",
|
|
" except FileNotFoundError: return ''",
|
|
"print(json.dumps({'ok': apply_rc == 0 and rollout_rc == 0, 'applyExitCode': apply_rc, 'rolloutExitCode': rollout_rc, 'applyStdoutTail': tail('/tmp/fake-provider-apply.out'), 'applyStderrTail': tail('/tmp/fake-provider-apply.err'), 'rolloutStdoutTail': tail('/tmp/fake-provider-rollout.out'), 'rolloutStderrTail': tail('/tmp/fake-provider-rollout.err'), 'valuesPrinted': False}, ensure_ascii=False))",
|
|
"PY",
|
|
].join("\n");
|
|
return runCommand([transPath(), state.spec.nodeKubeRoute, "sh", "--", script], repoRoot, {
|
|
input: manifestYaml,
|
|
timeoutMs: (state.options.timeoutSeconds + 30) * 1000,
|
|
});
|
|
}
|
|
|
|
function remoteFakeModelProviderStatus(state: FakeModelProviderState): Record<string, unknown> {
|
|
const runtime = state.runtime;
|
|
const script = remoteStatusScript(runtime);
|
|
const result = runCommand([transPath(), state.spec.nodeKubeRoute, "sh", "--", script], repoRoot, { timeoutMs: state.options.timeoutSeconds * 1000 });
|
|
const payloadResolution = resolveFakeModelProviderRemotePayload(result, "fake-model-provider status JSON");
|
|
const payload = payloadResolution.parsed ?? {};
|
|
return {
|
|
ok: result.exitCode === 0 && payload.ok === true,
|
|
command: "hwlab nodes fake-model-provider status",
|
|
node: state.options.node,
|
|
lane: state.options.lane,
|
|
provider: state.options.provider,
|
|
target: {
|
|
route: state.spec.nodeKubeRoute,
|
|
namespace: stringAt(runtime, "namespace"),
|
|
deployment: stringAt(runtime, "deploymentName"),
|
|
service: stringAt(runtime, "serviceName"),
|
|
},
|
|
...(Object.keys(payload).length > 0 ? payload : { result: compactCommand(result, state.options.full) }),
|
|
stdoutRecovery: payloadResolution.diagnostics,
|
|
valuesPrinted: false,
|
|
};
|
|
}
|
|
|
|
function remoteFakeModelProviderSmoke(state: FakeModelProviderState): Record<string, unknown> {
|
|
const runtime = state.runtime;
|
|
const script = remoteSmokeScript(runtime);
|
|
const result = runCommand([transPath(), state.spec.nodeKubeRoute, "sh", "--", script], repoRoot, { timeoutMs: state.options.timeoutSeconds * 1000 });
|
|
const payloadResolution = resolveFakeModelProviderRemotePayload(result, "fake-model-provider smoke JSON");
|
|
const payload = payloadResolution.parsed ?? {};
|
|
return {
|
|
ok: result.exitCode === 0 && payload.ok === true,
|
|
command: "hwlab nodes fake-model-provider smoke",
|
|
node: state.options.node,
|
|
lane: state.options.lane,
|
|
provider: state.options.provider,
|
|
target: {
|
|
route: state.spec.nodeKubeRoute,
|
|
namespace: stringAt(runtime, "namespace"),
|
|
deployment: stringAt(runtime, "deploymentName"),
|
|
service: stringAt(runtime, "serviceName"),
|
|
},
|
|
...(Object.keys(payload).length > 0 ? payload : { result: compactCommand(result, state.options.full) }),
|
|
stdoutRecovery: payloadResolution.diagnostics,
|
|
valuesPrinted: false,
|
|
};
|
|
}
|
|
|
|
function remoteStatusScript(runtime: Record<string, unknown>): string {
|
|
return remoteCommonNodeScript(runtime, `
|
|
const deploy = kubectlJson(['-n', ns, 'get', 'deployment', deployment, '-o', 'json']);
|
|
const svc = kubectlJson(['-n', ns, 'get', 'service', service, '-o', 'json']);
|
|
const cm = kubectlJson(['-n', ns, 'get', 'configmap', configMap, '-o', 'json']);
|
|
const secret = kubectlJson(['-n', ns, 'get', 'secret', secretName, '-o', 'json']);
|
|
const pods = kubectlJson(['-n', ns, 'get', 'pod', '-l', selector, '-o', 'json']);
|
|
const pod = selectPod(pods.value);
|
|
let health = { ok: false, skipped: pod === null, status: null, body: null, valuesPrinted: false };
|
|
if (pod !== null) {
|
|
const js = "const r=await fetch('http://127.0.0.1:" + port + "/healthz'); const t=await r.text(); console.log(JSON.stringify({status:r.status, body:t, valuesPrinted:false}));";
|
|
const out = run(['kubectl', '-n', ns, 'exec', pod.name, '-c', container, '--', 'bun', '-e', js]);
|
|
const parsed = parseJson(out.stdout);
|
|
health = { ok: out.status === 0 && parsed.status === 200, status: parsed.status ?? null, body: parseJson(parsed.body || ''), exitCode: out.status, stderrTail: out.stderr.slice(-1000), valuesPrinted: false };
|
|
}
|
|
const available = Number(deploy.value?.status?.availableReplicas || 0);
|
|
const ready = Number(deploy.value?.status?.readyReplicas || 0);
|
|
const data = secret.value?.data && typeof secret.value.data === 'object' ? secret.value.data : {};
|
|
const configData = cm.value?.data && typeof cm.value.data === 'object' ? cm.value.data : {};
|
|
const ok = deploy.ok && svc.ok && cm.ok && secret.ok && available >= 1 && health.ok;
|
|
console.log(JSON.stringify({
|
|
ok,
|
|
deployment: { exists: deploy.ok, availableReplicas: available, readyReplicas: ready, observedGeneration: deploy.value?.status?.observedGeneration ?? null },
|
|
service: { exists: svc.ok, clusterIP: svc.value?.spec?.clusterIP ?? null, ports: (svc.value?.spec?.ports || []).map((item) => ({ name: item.name, port: item.port, targetPort: item.targetPort })) },
|
|
configMap: { exists: cm.ok, keys: Object.keys(configData).sort(), valuesPrinted: false },
|
|
secret: { exists: secret.ok, keys: Object.keys(data).sort(), valuesPrinted: false },
|
|
pod,
|
|
health,
|
|
valuesPrinted: false
|
|
}, null, 0));
|
|
`);
|
|
}
|
|
|
|
function remoteSmokeScript(runtime: Record<string, unknown>): string {
|
|
const model = stringAt(record(runtime.config, "provider.runtime.config"), "modelId");
|
|
return remoteCommonNodeScript(runtime, `
|
|
const pods = kubectlJson(['-n', ns, 'get', 'pod', '-l', selector, '-o', 'json']);
|
|
const pod = selectPod(pods.value);
|
|
if (pod === null) {
|
|
console.log(JSON.stringify({ ok: false, error: 'fake-provider-pod-missing', valuesPrinted: false }));
|
|
process.exit(0);
|
|
}
|
|
const js = ${JSON.stringify(`
|
|
const base = 'http://127.0.0.1:${numberAt(runtime, "servicePort")}';
|
|
const body = { model: ${JSON.stringify(model)}, input: [{ role: 'user', content: [{ type: 'input_text', text: 'ECHO AGENTRUN_FAKE_OK' }] }], stream: true };
|
|
const response = await fetch(base + '/v1/responses', { method: 'POST', headers: { 'content-type': 'application/json', authorization: 'Bearer test-redacted' }, body: JSON.stringify(body) });
|
|
const text = await response.text();
|
|
const bad = await fetch(base + '/v1/responses', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ model: ${JSON.stringify(model)}, input: 'non echo', stream: false }) });
|
|
const badText = await bad.text();
|
|
const ok = response.status === 200 && text.includes('AGENTRUN_FAKE_OK') && text.includes('response.completed') && bad.status === 400;
|
|
console.log(JSON.stringify({ ok, streamStatus: response.status, deltaSeen: text.includes('AGENTRUN_FAKE_OK'), completedSeen: text.includes('response.completed'), doneSeen: text.includes('[DONE]'), nonEchoStatus: bad.status, nonEchoStructuredError: badText.includes('non_echo_prompt'), valuesPrinted: false }));
|
|
`)};
|
|
const out = run(['kubectl', '-n', ns, 'exec', pod.name, '-c', container, '--', 'bun', '-e', js]);
|
|
const parsed = parseJson(out.stdout);
|
|
console.log(JSON.stringify({
|
|
ok: out.status === 0 && parsed.ok === true,
|
|
pod,
|
|
smoke: Object.keys(parsed).length > 0 ? parsed : null,
|
|
exec: { exitCode: out.status, stderrTail: out.stderr.slice(-1200), valuesPrinted: false },
|
|
valuesPrinted: false
|
|
}));
|
|
`);
|
|
}
|
|
|
|
function remoteCommonNodeScript(runtime: Record<string, unknown>, body: string): string {
|
|
const namespace = stringAt(runtime, "namespace");
|
|
const deployment = stringAt(runtime, "deploymentName");
|
|
const service = stringAt(runtime, "serviceName");
|
|
const configMap = stringAt(runtime, "configMapName");
|
|
const secretName = stringAt(runtime, "secretName");
|
|
const container = stringAt(runtime, "containerName");
|
|
const port = numberAt(runtime, "servicePort");
|
|
const selector = `app.kubernetes.io/name=${service},unidesk.ai/provider=fake-echo`;
|
|
return [
|
|
"set +e",
|
|
`NS=${shQuote(namespace)} DEPLOYMENT=${shQuote(deployment)} SERVICE=${shQuote(service)} CONFIG_MAP=${shQuote(configMap)} SECRET_NAME=${shQuote(secretName)} CONTAINER=${shQuote(container)} PORT=${shQuote(String(port))} SELECTOR=${shQuote(selector)} node <<'NODE'`,
|
|
"const cp = require('node:child_process');",
|
|
"const ns = process.env.NS;",
|
|
"const deployment = process.env.DEPLOYMENT;",
|
|
"const service = process.env.SERVICE;",
|
|
"const configMap = process.env.CONFIG_MAP;",
|
|
"const secretName = process.env.SECRET_NAME;",
|
|
"const container = process.env.CONTAINER;",
|
|
"const port = process.env.PORT;",
|
|
"const selector = process.env.SELECTOR;",
|
|
"function run(argv) { return cp.spawnSync(argv[0], argv.slice(1), { encoding: 'utf8', maxBuffer: 8 * 1024 * 1024 }); }",
|
|
"function parseJson(text) { try { return JSON.parse(String(text || '').trim()); } catch { const s=String(text||''); const a=s.indexOf('{'); const b=s.lastIndexOf('}'); if (a>=0&&b>a) { try { return JSON.parse(s.slice(a,b+1)); } catch {} } return {}; } }",
|
|
"function kubectlJson(args) { const out = run(['kubectl', ...args]); return { ok: out.status === 0, exitCode: out.status, value: out.status === 0 ? parseJson(out.stdout) : {}, stderrTail: out.stderr.slice(-1200) }; }",
|
|
"function selectPod(pods) { const items = Array.isArray(pods?.items) ? pods.items : []; const mapped = items.map((item) => { const statuses = Array.isArray(item.status?.containerStatuses) ? item.status.containerStatuses : []; const target = statuses.find((status) => status.name === container); return { name: item.metadata?.name || '', phase: item.status?.phase || null, ready: item.status?.phase === 'Running' && target?.ready === true, containerReady: target?.ready === true, restartCount: target?.restartCount ?? null }; }).filter((item) => item.name); return mapped.find((item) => item.ready) || mapped.find((item) => item.phase === 'Running') || mapped[0] || null; }",
|
|
body,
|
|
"NODE",
|
|
].join("\n");
|
|
}
|
|
|
|
function sourceByPurpose(secrets: Record<string, unknown>, purpose: string): Record<string, unknown> {
|
|
const source = arrayAt(secrets, "sources").map((item) => record(item, "provider.secrets.sources[]")).find((item) => item.purpose === purpose);
|
|
if (source === undefined) throw new Error(`provider.secrets.sources is missing purpose=${purpose}`);
|
|
return source;
|
|
}
|
|
|
|
function ensureEnvSourceValue(state: FakeModelProviderState, source: Record<string, unknown>, createValue: () => string): SourceMaterial & { value: string } {
|
|
const purpose = stringAt(source, "purpose");
|
|
const sourceRef = stringAt(source, "sourceRef");
|
|
const sourceKey = stringAt(source, "sourceKey");
|
|
const sourcePath = secretSourcePath(state, sourceRef);
|
|
const existsBefore = existsSync(sourcePath);
|
|
const existingText = existsBefore ? readFileSync(sourcePath, "utf8") : "";
|
|
const values = parseEnvFile(existingText);
|
|
const existing = values[sourceKey];
|
|
const value = existing && existing.length > 0 ? existing : createValue();
|
|
let nextText = existingText;
|
|
let mutation = false;
|
|
if (!existing || existing.length === 0) {
|
|
nextText = upsertEnvLine(existingText, sourceKey, value);
|
|
writePrivateFile(sourcePath, nextText);
|
|
mutation = true;
|
|
}
|
|
return {
|
|
purpose,
|
|
sourceRef,
|
|
sourceKey,
|
|
sourcePath: displayPath(sourcePath),
|
|
existsBefore,
|
|
mutation,
|
|
value,
|
|
valueBytes: Buffer.byteLength(value),
|
|
fingerprint: sha256Fingerprint(value),
|
|
valuesPrinted: false,
|
|
};
|
|
}
|
|
|
|
function ensureEnvSourceExactValue(state: FakeModelProviderState, source: Record<string, unknown>, value: string): SourceMaterial & { value: string } {
|
|
const purpose = stringAt(source, "purpose");
|
|
const sourceRef = stringAt(source, "sourceRef");
|
|
const sourceKey = stringAt(source, "sourceKey");
|
|
const sourcePath = secretSourcePath(state, sourceRef);
|
|
const existsBefore = existsSync(sourcePath);
|
|
const existingText = existsBefore ? readFileSync(sourcePath, "utf8") : "";
|
|
const values = parseEnvFile(existingText);
|
|
const existing = values[sourceKey] ?? "";
|
|
const mutation = existing !== value;
|
|
if (mutation) writePrivateFile(sourcePath, upsertEnvLine(existingText, sourceKey, value));
|
|
return {
|
|
purpose,
|
|
sourceRef,
|
|
sourceKey,
|
|
sourcePath: displayPath(sourcePath),
|
|
existsBefore,
|
|
mutation,
|
|
value,
|
|
valueBytes: Buffer.byteLength(value),
|
|
fingerprint: sha256Fingerprint(value),
|
|
valuesPrinted: false,
|
|
};
|
|
}
|
|
|
|
function writeSecretFileSource(state: FakeModelProviderState, sourceRef: string, content: string, purpose: string): MaterializationResult["files"][number] {
|
|
const sourcePath = secretSourcePath(state, sourceRef);
|
|
const existsBefore = existsSync(sourcePath);
|
|
const current = existsBefore ? readFileSync(sourcePath, "utf8") : "";
|
|
const mutation = current !== content;
|
|
if (mutation) writePrivateFile(sourcePath, content);
|
|
return {
|
|
purpose,
|
|
sourceRef,
|
|
sourcePath: displayPath(sourcePath),
|
|
existsBefore,
|
|
mutation,
|
|
byteCount: Buffer.byteLength(content),
|
|
fingerprint: sha256Fingerprint(content),
|
|
valuesPrinted: false,
|
|
};
|
|
}
|
|
|
|
function renderFakeEchoCodexConfig(state: FakeModelProviderState): string {
|
|
const config = record(state.profile.codexConfig, "provider.profile.codexConfig");
|
|
return [
|
|
`model = ${tomlString(stringAt(config, "model"))}`,
|
|
`model_provider = ${tomlString(stringAt(config, "modelProvider"))}`,
|
|
`review_model = ${tomlString(stringAt(config, "model"))}`,
|
|
`model_context_window = ${numberAt(config, "modelContextWindow")}`,
|
|
`model_auto_compact_token_limit = ${numberAt(config, "modelAutoCompactTokenLimit")}`,
|
|
`model_supports_reasoning_summaries = ${config.modelSupportsReasoningSummaries === true ? "true" : "false"}`,
|
|
"",
|
|
`[model_providers.${stringAt(config, "modelProvider")}]`,
|
|
`name = ${tomlString(stringAt(config, "modelProvider"))}`,
|
|
`base_url = ${tomlString(stringAt(config, "baseUrl"))}`,
|
|
`wire_api = ${tomlString(stringAt(config, "wireApi"))}`,
|
|
`requires_openai_auth = ${config.requiresOpenaiAuth === true ? "true" : "false"}`,
|
|
"",
|
|
].join("\n");
|
|
}
|
|
|
|
function fakeEchoPrompts(): string[] {
|
|
return Array.from({ length: 10 }, (_, index) => {
|
|
const marker = `sentinel-${String(index + 1).padStart(2, "0")}`;
|
|
return `ECHO ${marker} fake-echo session invariance round ${index + 1}`;
|
|
});
|
|
}
|
|
|
|
function randomHexBytes(source: Record<string, unknown>, fallback: number): number {
|
|
const policy = record(source.createIfMissing, "createIfMissing");
|
|
const value = policy.randomHexBytes;
|
|
return typeof value === "number" && Number.isInteger(value) && value > 0 && value <= 256 ? value : fallback;
|
|
}
|
|
|
|
function secretSourcePath(state: FakeModelProviderState, sourceRef: string): string {
|
|
if (sourceRef.includes("..")) throw new Error(`secret sourceRef must not contain ..: ${sourceRef}`);
|
|
if (sourceRef.startsWith("/")) return sourceRef;
|
|
return join(state.agentrun.secretSourceRoot, ...sourceRef.split("/"));
|
|
}
|
|
|
|
function sourceConfigKey(path: string): string {
|
|
return path.replace(/[^A-Za-z0-9_.-]+/gu, "__");
|
|
}
|
|
|
|
function sourceDigest(files: Array<{ path: string; content: string }>): string {
|
|
const hash = createHash("sha256");
|
|
for (const file of files.slice().sort((a, b) => a.path.localeCompare(b.path))) {
|
|
hash.update(file.path);
|
|
hash.update("\0");
|
|
hash.update(file.content);
|
|
hash.update("\0");
|
|
}
|
|
return hash.digest("hex");
|
|
}
|
|
|
|
function writePrivateFile(path: string, content: string): void {
|
|
mkdirSync(dirname(path), { recursive: true });
|
|
writeFileSync(path, content, { mode: 0o600 });
|
|
try {
|
|
chmodSync(path, 0o600);
|
|
} catch {
|
|
// chmod is best-effort on non-POSIX filesystems.
|
|
}
|
|
}
|
|
|
|
function upsertEnvLine(text: string, key: string, value: string): string {
|
|
const quoted = `${key}=${envSingleQuote(value)}`;
|
|
const lines = text.length === 0 ? [] : text.replace(/\n?$/u, "").split(/\r?\n/u);
|
|
const index = lines.findIndex((line) => line.trim().startsWith(`${key}=`));
|
|
if (index >= 0) lines[index] = quoted;
|
|
else lines.push(quoted);
|
|
return `${lines.join("\n")}\n`;
|
|
}
|
|
|
|
function envSingleQuote(value: string): string {
|
|
if (value.includes("'")) throw new Error("fake provider source values containing single quotes are not supported by the current env parser");
|
|
return `'${value}'`;
|
|
}
|
|
|
|
function readConfigRefTarget(ref: string): unknown {
|
|
const [pathPart, selector] = ref.split("#");
|
|
if (!pathPart || !selector) throw new Error(`configRef must use path#selector: ${ref}`);
|
|
const parsed = readYamlRecord(rootPath(pathPart));
|
|
let current: unknown = parsed;
|
|
for (const rawPart of selector.split(".")) {
|
|
const part = rawPart.trim();
|
|
if (part.length === 0) continue;
|
|
current = record(current, ref)[part];
|
|
}
|
|
return current;
|
|
}
|
|
|
|
function readYamlRecord(path: string, expectedKind?: string): Record<string, unknown> {
|
|
const parsed = Bun.YAML.parse(readFileSync(path, "utf8")) as unknown;
|
|
const value = record(parsed, repoRelative(path));
|
|
if (expectedKind !== undefined && value.kind !== expectedKind) throw new Error(`${repoRelative(path)} kind must be ${expectedKind}`);
|
|
return value;
|
|
}
|
|
|
|
function optionValue(args: string[], name: string): string | null {
|
|
const index = args.indexOf(name);
|
|
return index >= 0 ? args[index + 1] ?? null : null;
|
|
}
|
|
|
|
function requiredOption(args: string[], name: string): string {
|
|
const value = optionValue(args, name);
|
|
if (value === null || value.length === 0 || value.startsWith("--")) throw new Error(`${name} is required`);
|
|
return value;
|
|
}
|
|
|
|
function positiveIntegerOption(args: string[], name: string, defaultValue: number, max: number): number {
|
|
const raw = optionValue(args, name);
|
|
if (raw === null) return defaultValue;
|
|
const value = Number(raw);
|
|
if (!Number.isInteger(value) || value <= 0 || value > max) throw new Error(`${name} must be an integer in 1..${max}`);
|
|
return value;
|
|
}
|
|
|
|
function arrayAt(obj: Record<string, unknown>, key: string): unknown[] {
|
|
const value = obj[key];
|
|
if (!Array.isArray(value)) throw new Error(`${key} must be an array`);
|
|
return value;
|
|
}
|
|
|
|
function record(value: unknown, label: string): Record<string, unknown> {
|
|
if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} must be an object`);
|
|
return value as Record<string, unknown>;
|
|
}
|
|
|
|
function stringAt(obj: Record<string, unknown>, key: string): string {
|
|
const value = obj[key];
|
|
if (typeof value !== "string" || value.length === 0) throw new Error(`${key} must be a non-empty string`);
|
|
return value;
|
|
}
|
|
|
|
function numberAt(obj: Record<string, unknown>, key: string): number {
|
|
const value = obj[key];
|
|
if (typeof value !== "number" || !Number.isFinite(value)) throw new Error(`${key} must be a number`);
|
|
return value;
|
|
}
|
|
|
|
function tomlString(value: string): string {
|
|
return JSON.stringify(value);
|
|
}
|
|
|
|
function resolveFakeModelProviderRemotePayload(result: CommandResult, requestedStdoutType: string): { parsed: Record<string, unknown> | null; diagnostics: Record<string, unknown> } {
|
|
const resolved = resolveCliChildJsonCommandResult({
|
|
result,
|
|
requestedStdoutType,
|
|
acceptParsed: (value) => typeof value.ok === "boolean" || typeof value.error === "string" || typeof value.failureKind === "string" || Object.keys(value).length > 1,
|
|
});
|
|
return { parsed: resolved.parsed, diagnostics: resolved.diagnostics };
|
|
}
|
|
|
|
function compactCommand(result: CommandResult, full = false): Record<string, unknown> {
|
|
return {
|
|
exitCode: result.exitCode,
|
|
timedOut: result.timedOut,
|
|
stdoutBytes: Buffer.byteLength(result.stdout),
|
|
stderrBytes: Buffer.byteLength(result.stderr),
|
|
stdoutTail: full || result.exitCode !== 0 ? result.stdout.trim().slice(-4000) : "",
|
|
stderrTail: full || result.exitCode !== 0 ? result.stderr.trim().slice(-4000) : "",
|
|
};
|
|
}
|
|
|
|
function transPath(): string {
|
|
return join(repoRoot, "scripts", "trans");
|
|
}
|
|
|
|
function repoRelative(path: string): string {
|
|
return path.startsWith(`${repoRoot}/`) ? path.slice(repoRoot.length + 1) : path;
|
|
}
|
|
|
|
function displayPath(path: string): string {
|
|
if (path.startsWith(`${repoRoot}/`)) return path.slice(repoRoot.length + 1);
|
|
const marker = "/.state/secrets/";
|
|
const index = path.indexOf(marker);
|
|
if (index >= 0) return `.state/secrets/${path.slice(index + marker.length)}`;
|
|
if (path.endsWith("/.state/secrets")) return ".state/secrets";
|
|
return path;
|
|
}
|