From 344680d64a77ed71f2a02be21d19db404cfc6e3f Mon Sep 17 00:00:00 2001 From: whyour Date: Thu, 20 Aug 2026 14:02:01 +0800 Subject: [PATCH] feat(ql3): expose worker observations in console --- deploy/console/ql3-cluster-copilot/README.md | 37 +++- .../ql3-cluster-copilot/docker-loopback.sh | 11 + .../host-environment.example.json | 3 +- ...rker-management-client-config.example.json | 9 + .../containers/ql3-cluster-admin/Dockerfile | 2 + docs/QINGLONG_3_0_ARCHITECTURE_RFC.md | 21 ++ ...468-optional-console-worker-observation.md | 78 +++++++ docs/adr/README.md | 1 + .../assets/copilot-console/app.js | 30 ++- .../assets/copilot-console/evidence-bundle.js | 41 +++- .../assets/copilot-console/index.html | 21 +- .../src/copilot-console/assets.ts | 6 +- .../src/copilot-console/cli.ts | 141 ++++++++++--- .../src/copilot-console/contracts.ts | 28 ++- .../src/copilot-console/evidenceVerifier.ts | 41 +++- .../src/copilot-console/server.ts | 2 + .../test/copilotConsole.test.cjs | 73 +++++++ .../test/copilotConsoleCli.test.cjs | 190 +++++++++++++++++- .../copilotConsoleEvidenceBundle.test.cjs | 61 ++++++ .../copilotConsoleEvidenceVerifier.test.cjs | 39 ++-- scripts/ql3-cluster-copilot-console-audit.cjs | 12 ++ ...ter-copilot-console-distribution-audit.cjs | 19 ++ .../ql3ClusterCopilotConsoleAudit.test.cjs | 2 + ...erCopilotConsoleDistributionAudit.test.cjs | 1 + .../ql3ClusterCopilotConsoleLauncher.test.cjs | 20 ++ 25 files changed, 840 insertions(+), 49 deletions(-) create mode 100644 deploy/console/ql3-cluster-copilot/worker-management-client-config.example.json create mode 100644 docs/adr/ADR-0468-optional-console-worker-observation.md diff --git a/deploy/console/ql3-cluster-copilot/README.md b/deploy/console/ql3-cluster-copilot/README.md index 57bca7e3..c7c946aa 100644 --- a/deploy/console/ql3-cluster-copilot/README.md +++ b/deploy/console/ql3-cluster-copilot/README.md @@ -12,6 +12,12 @@ by default. Supplying a separate Run management mTLS config and short-lived User assertion adds only status, blocked-list and inspect reads to the same loopback process; rearm, stop and retry remain absent. +Worker observation is a third, independent authority and is also disabled by +default. Supplying its generic Worker management mTLS config and short-lived +User assertion adds only a fixed 16-item list and point inspect to the same +loopback process. Credential mutation, drain, revoke, background polling and +automatic pagination remain absent. + Use `ql3-cluster-admin` from the same independently verified Admin release as the Cluster deployment. D-328 also supports the image-carried `docker-loopback.sh`: it uses an explicit container-only listener but publishes @@ -111,6 +117,14 @@ credential. Supplying only one of config/assertion is rejected before a listener or Cluster request is created. The assertion is reread for every explicit click so it can be rotated or removed while the Console is running. +To enable Worker observation, copy +`worker-management-client-config.example.json` to +`worker-management-client.json`, install its separate CA, client certificate +and private key, and issue a short-lived strong User assertion with only +`worker.manage` into `worker-management-assertion.jwt`. Its endpoint must be +the D-374 canonical `/api/v3/workers/management`; the Console cannot accept the +legacy credential-management path or a credential mutation command file. + Create an independent 256-bit browser session key without placing its value in argv or an environment variable: @@ -125,6 +139,10 @@ If optional Run management reads are enabled, apply the same owner-private, canonical, non-symlink `0600` rule to `run-management-client.json`, `run-management-ca.pem`, `run-management-client.crt`, `run-management-client.key` and `run-management-assertion.jwt`. +Apply the same rule to `worker-management-client.json`, +`worker-management-ca.pem`, `worker-management-client.crt`, +`worker-management-client.key` and `worker-management-assertion.jwt` when +Worker observation is enabled. Every file must be a current-owner, non-symlink, canonical regular file. The session file contains exactly 43 base64url characters and no newline. It is a @@ -151,7 +169,14 @@ intended: --run-management-assertion /absolute/private/ql3-copilot-console/run-management-assertion.jwt ``` -It validates all three private authorities and performs one unauthenticated +Worker observation uses its own pair: + +```sh +--worker-management-config /absolute/private/ql3-copilot-console/worker-management-client.json \ +--worker-management-assertion /absolute/private/ql3-copilot-console/worker-management-assertion.jwt +``` + +It validates every configured private authority and performs one unauthenticated TLS 1.3 `GET /readyz`. It does not open the Console listener or reveal paths, endpoint, credential, Project or Cluster identity. @@ -191,6 +216,12 @@ offers a user-clicked blocked-list step; each returned Run offers a user-clicked inspect step. Pagination is also click-only. There is no polling, automatic page traversal, bulk inspection or mutation route. +Explicit Worker management authority adds `worker_list|worker_inspect`. The +list is fixed at 16 items and exposes a next cursor only as a new user-clicked +read; each listed Worker can be inspected only by another explicit click. The +projection contains bounded lifecycle, compatibility, architecture, protocol +and capacity facts, but no credential, raw capability, label or Secret. + ## Export a redacted evidence bundle After at least one successful read, **Export redacted bundle** creates one @@ -243,6 +274,10 @@ The image launcher keeps Run management disabled unless `run-management-client.json` and `run-management-assertion.jwt` from the same read-only private mount; all certificate paths in the config must point into that mount. `disabled` is the only default and unknown values fail closed. +Worker observation follows the independent +`QL3_COPILOT_CONSOLE_WORKER_MANAGEMENT=enabled` switch and reads only its +Worker config/assertion pair. Enabling one management authority does not enable +the other. | Resource class | Memory | CPU | PIDs | Console reads | | --- | ---: | ---: | ---: | ---: | diff --git a/deploy/console/ql3-cluster-copilot/docker-loopback.sh b/deploy/console/ql3-cluster-copilot/docker-loopback.sh index a0916ecc..af60715c 100755 --- a/deploy/console/ql3-cluster-copilot/docker-loopback.sh +++ b/deploy/console/ql3-cluster-copilot/docker-loopback.sh @@ -25,6 +25,7 @@ network=${QL3_COPILOT_CONSOLE_NETWORK-} port=${QL3_COPILOT_CONSOLE_PORT-} resource_class=${QL3_COPILOT_CONSOLE_RESOURCE_CLASS-compact} run_management=${QL3_COPILOT_CONSOLE_RUN_MANAGEMENT-disabled} +worker_management=${QL3_COPILOT_CONSOLE_WORKER_MANAGEMENT-disabled} printf '%s' "$image" | grep -Eq '^[A-Za-z0-9][A-Za-z0-9._/-]{0,191}@sha256:[0-9a-f]{64}$' || fail printf '%s' "$network" | grep -Eq '^[A-Za-z0-9][A-Za-z0-9_.-]{0,62}$' || fail @@ -62,6 +63,10 @@ case "$run_management" in disabled|enabled) ;; *) fail ;; esac +case "$worker_management" in + disabled|enabled) ;; + *) fail ;; +esac set -- docker run --rm --pull never --init --read-only \ --network "$network" \ @@ -92,6 +97,12 @@ if [ "$run_management" = enabled ]; then --run-management-assertion /var/run/secrets/qinglong3/copilot-console/run-management-assertion.jwt fi +if [ "$worker_management" = enabled ]; then + set -- "$@" \ + --worker-management-config /var/run/secrets/qinglong3/copilot-console/worker-management-client.json \ + --worker-management-assertion /var/run/secrets/qinglong3/copilot-console/worker-management-assertion.jwt +fi + if [ "$mode" = check ]; then set -- "$@" --check fi diff --git a/deploy/console/ql3-cluster-copilot/host-environment.example.json b/deploy/console/ql3-cluster-copilot/host-environment.example.json index ab31f06f..403e625b 100644 --- a/deploy/console/ql3-cluster-copilot/host-environment.example.json +++ b/deploy/console/ql3-cluster-copilot/host-environment.example.json @@ -4,5 +4,6 @@ "QL3_COPILOT_CONSOLE_NETWORK": "qinglong3-copilot-console-egress", "QL3_COPILOT_CONSOLE_PORT": "5701", "QL3_COPILOT_CONSOLE_RESOURCE_CLASS": "compact", - "QL3_COPILOT_CONSOLE_RUN_MANAGEMENT": "disabled" + "QL3_COPILOT_CONSOLE_RUN_MANAGEMENT": "disabled", + "QL3_COPILOT_CONSOLE_WORKER_MANAGEMENT": "disabled" } diff --git a/deploy/console/ql3-cluster-copilot/worker-management-client-config.example.json b/deploy/console/ql3-cluster-copilot/worker-management-client-config.example.json new file mode 100644 index 00000000..8d0bd152 --- /dev/null +++ b/deploy/console/ql3-cluster-copilot/worker-management-client-config.example.json @@ -0,0 +1,9 @@ +{ + "schemaVersion": 1, + "endpoint": "https://replace-cluster-api.example.com:8448/api/v3/workers/management", + "servername": "replace-cluster-api.example.com", + "caFile": "/absolute/private/ql3-copilot-console/worker-management-ca.pem", + "clientCertificateFile": "/absolute/private/ql3-copilot-console/worker-management-client.crt", + "clientPrivateKeyFile": "/absolute/private/ql3-copilot-console/worker-management-client.key", + "requestTimeoutMs": 5000 +} diff --git a/deploy/containers/ql3-cluster-admin/Dockerfile b/deploy/containers/ql3-cluster-admin/Dockerfile index b946a3c5..fbe0c78b 100644 --- a/deploy/containers/ql3-cluster-admin/Dockerfile +++ b/deploy/containers/ql3-cluster-admin/Dockerfile @@ -87,6 +87,8 @@ COPY --chmod=0444 deploy/console/ql3-cluster-copilot/client-config.example.json share/ql3-copilot-console/client-config.example.json COPY --chmod=0444 deploy/console/ql3-cluster-copilot/run-management-client-config.example.json \ share/ql3-copilot-console/run-management-client-config.example.json +COPY --chmod=0444 deploy/console/ql3-cluster-copilot/worker-management-client-config.example.json \ + share/ql3-copilot-console/worker-management-client-config.example.json COPY --chmod=0444 deploy/console/ql3-cluster-copilot/host-environment.example.json \ share/ql3-copilot-console/host-environment.example.json diff --git a/docs/QINGLONG_3_0_ARCHITECTURE_RFC.md b/docs/QINGLONG_3_0_ARCHITECTURE_RFC.md index 9c1e1604..c59056d5 100644 --- a/docs/QINGLONG_3_0_ARCHITECTURE_RFC.md +++ b/docs/QINGLONG_3_0_ARCHITECTURE_RFC.md @@ -11,6 +11,27 @@ 最新增量证据（2026-08-20）： +- D-375/ADR-0468（已接受）：在既有 operator-workstation、loopback-only Copilot Console 内接入 D-374 通用 Worker + management 的两个只读产品操作，而不是新增包、服务或集群工作负载。Browser/BFF 只新增固定 + `worker_list|worker_inspect` 与 `/api/v1/worker-management/workers|worker`，上游只走 canonical + `/api/v3/workers/management`；Worker config/assertion 必须成对显式提供，宿主启动器也只在 + `QL3_COPILOT_CONSOLE_WORKER_MANAGEMENT=enabled` 时只读挂载，默认输出 `workerManagementAuthority=disabled`。 + list 固定 16 项并只在用户点击时携带 `afterWorkerId`，inspect 只由用户选定一个 Worker；没有 credential mutation、drain、 + revoke、caller limit/filter、自动翻页、poller、retry、queue、cache、watcher 或后台 timer。浏览器不接触 mTLS key/assertion， + Console 返回 caller request ID 并丢弃 management transport request ID；证据 bundle 对 Worker/Project/request identity 使用域内 + alias，只保留有界 lifecycle、compatibility、support tier、architecture、OS、runtime 和 capacity 事实。实现继续内聚在现有 + `@qinglong/cluster-admin/copilot-console`，复用 `worker-management/` client/product；workspace 保持 18 packages，没有新增依赖、 + binary、端口、数据库对象、Deployment、Ingress 或常驻连接。专项门 `48/48`；Cluster Admin 全量为 + `431 total / 428 pass / 3 conditional skip / 0 fail`，backend 为 + `1,504 total / 1,502 pass / 2 conditional skip / 0 fail`，18-package clean build/逐包测试单次退出 0。package boundary、Cluster + dependency、Edge import、Cluster/Worker deployment、Console 与 Console distribution 审计全部 compatible；仍为 + `singleSourcePackages=[]`、`shallowSourcePackages=[]`，Cluster Admin `128 source / 127 nested`。14 档 Local artifact audit 全部 + compatible；基础 Edge/Standalone 为 `2,598,669 / 2,598,747` bytes、57 loaded modules、RSS 增量 + `11,272,192 / 11,223,040` bytes，Application+AI 为 `4,501,822 / 4,501,954` bytes，MCP 为 + `7,324,601 / 7,324,709` bytes，证明 Cluster Console/Worker authority 没有进入低配路由设备闭包。本切片不改变 schema、ACL、 + repository、role、Pool、连接或 failover 语义，不重跑并不重新占有 PostgreSQL HA 证明；D-373/D-374 的 PostgreSQL 18.6 + arm64 HA `146/146`、timeline `1→2` 仅作为相邻既有基线，任何后续数据库语义变化必须重新执行 HA 门。 + - D-374/ADR-0467（已接受）：完成 D-373 留下的 Worker 产品命名债务，同时保持零新增常驻服务。通用 canonical path 为 `/api/v3/workers/management`；旧 `/api/v3/worker-credentials/management` 作为精确兼容 alias 继续由同一个 TLS 1.3/mTLS/ OIDC listener、transport、quota、rate limiter 和连接集合处理。共享 host 只允许这一对 alias，任意跨 Run/Automation/ diff --git a/docs/adr/ADR-0468-optional-console-worker-observation.md b/docs/adr/ADR-0468-optional-console-worker-observation.md new file mode 100644 index 00000000..8c9b7481 --- /dev/null +++ b/docs/adr/ADR-0468-optional-console-worker-observation.md @@ -0,0 +1,78 @@ +# ADR-0468：Copilot Console 显式可选 Worker 只读观察 + +- 状态：Accepted +- 日期：2026-08-20 +- 关联 RFC：QL-RFC-0001 D-375、D-14、D-16、D-107 +- 关联 ADR：ADR-0462、ADR-0463、ADR-0466、ADR-0467 + +## 上下文 + +ADR-0466/0467 已在现有 Worker management authority 上提供通用 `worker-session.inspect|list` 产品入口。集群运维仍需要在 +Copilot Console 中把 Run 异常与 Worker 在线状态、兼容性和剩余 slot 放在同一个只读工作台观察，但这不能让浏览器持有 mTLS +key/OIDC assertion，也不能把 Cluster 诊断能力带入低配 Edge/Standalone 常驻闭包。 + +新建 Worker UI 服务或 workspace package 会复制 Console session、TLS、分发、端口和生命周期边界。把 Worker authority 默认并入 +Console 又会让普通 Project API 观察面静默获得更强的管理身份，并可能诱发自动轮询和不可控分页负载。 + +## 决策 + +1. 在既有 `@qinglong/cluster-admin/copilot-console` 增加 `worker_list` 与 `worker_inspect`，分别只接受固定 BFF route + `/api/v1/worker-management/workers` 与 `/api/v1/worker-management/worker`。浏览器不能提供上游 path、method 或任意 command。 +2. Worker authority 使用独立的 `--worker-management-config` 与 `--worker-management-assertion`，两者必须成对存在且 config 必须指向 + canonical `/api/v3/workers/management`。它不复用普通 Cluster credential，也不接受 legacy credential mutation path。 +3. 未提供 Worker authority 时，Console 正常提供原有操作并报告 `workerManagementAuthority=disabled`。宿主容器启动器仅在 + `QL3_COPILOT_CONSOLE_WORKER_MANAGEMENT=enabled` 时挂载两份 owner-private 文件并添加参数；Run 与 Worker 两个可选 authority + 独立开关，不能互相隐式启用。 +4. `worker_list` 每次固定最多 16 项，只接受 nullable `afterWorkerId`；下一页必须由用户点击。`worker_inspect` 只观察用户明确选中的 + canonical Worker ID。禁止 caller limit/filter、自动翻页、poller、retry、queue、cache、watcher、WebSocket/SSE 和后台 timer。 +5. BFF 复用 ADR-0467 的 generic Worker client、严格 transport validator 与产品投影。一次浏览器请求只产生一次上游 POST；Console + 使用 caller request ID 作为关联身份，不向浏览器返回 management transport request ID、inspection ID、assertion 或 credential。 +6. UI 只展示有界 Session、lifecycle、compatibility、support tier、architecture、OS、runtime、capacity 与下一页事实；所有文本继续以 + data/textContent 渲染。证据 bundle 对 Worker、Project 和 request identity 使用 bundle-local 域内 alias，且不声明服务器签名或 + action authority。 +7. 本切片不新增 workspace package、external dependency、binary、监听端口、Kubernetes workload、Ingress、数据库 schema/role/Pool + 或持久化状态。Console 仍只在受信 operator workstation 回环生命周期运行，Edge/Standalone 不导入 Cluster Admin。 + +## 被拒绝的替代方案 + +### 独立 Worker Console 服务或 package + +拒绝。两个 caller-driven 只读操作不足以承担第二套 session、TLS、镜像、发布和运维生命周期；代码应留在已有 Console 与 +Worker management 内聚目录。 + +### 默认启用 Worker authority + +拒绝。普通 Project 观察与 Worker management mTLS/OIDC 是不同权限域。显式成对文件与独立启动开关让部署者可以证明未启用路径 +不会读取 assertion、打开额外连接或展示 Worker 操作。 + +### 自动刷新、自动翻页或实时 Worker dashboard + +拒绝。它会把一次诊断变成持续数据库、网络和浏览器成本，并掩盖低配管理节点上的真实压力。固定 16 项页面与用户驱动 inspect/ +next 是本阶段唯一接受的负载模型。 + +### 把 assertion 或 transport identity 发给浏览器 + +拒绝。浏览器只应持有短期 Console session；上游身份、私钥和传输关联信息必须留在 BFF authority 内。 + +## 升级与回滚 + +- 旧启动方式不传 Worker 参数时行为不变。需要观察 Worker 的部署者先提供 canonical generic config 与专用 assertion，再显式启用 + launcher switch。 +- 回滚到 ADR-0467 时只失去 Console 中两个 Worker tab/route；generic CLI、manager、数据库与 Worker Session 不变，无数据迁移。 +- 若未来增加 Worker mutation、历史指标、label/filter、跨 Project inventory 或实时流，必须另立 authority、索引、retention、隐私和 + 资源预算 ADR，不能在本只读 BFF 上渐进偷渡。 + +## 验证与证据 + +- Console/CLI/evidence/launcher 专项门 `48/48`；覆盖 exact route、固定分页、mTLS canonical read、authority 默认关闭、独立开关、 + transport identity 隔离、证据脱敏和 mutation/remote-listener/ambient-authority 拒绝。 +- `@qinglong/cluster-admin` 全量 `431 total / 428 pass / 3 conditional skip / 0 fail`；backend + `1,504 total / 1,502 pass / 2 conditional skip / 0 fail`；18-package clean build/逐包测试单次退出 0。 +- package boundary、Cluster dependency、Edge import、Cluster/Worker deployment、Console 与 distribution 审计全部 compatible。 + workspace 保持 18 packages、`singleSourcePackages=[]`、`shallowSourcePackages=[]`；Cluster Admin 为 + `128 source / 127 nested`，没有新增 dependency。 +- 14 档 Local artifact audit 全部 compatible。基础 Edge/Standalone 为 `2,598,669 / 2,598,747` bytes、57 loaded modules，RSS + 增量 `11,272,192 / 11,223,040` bytes；Application+AI 为 `4,501,822 / 4,501,954` bytes；MCP 为 + `7,324,601 / 7,324,709` bytes。Console/Worker authority 未进入低配路由设备制品。 +- 本切片没有 PostgreSQL schema、ACL、repository、role、Pool、连接或 failover 变化，因此不重跑并不重新占有物理 HA 证明；仅引用 + D-373/D-374 PostgreSQL 18.6 arm64 HA `146/146`、timeline `1→2` 相邻基线。数据库语义一旦改变必须重新运行 HA 门。 diff --git a/docs/adr/README.md b/docs/adr/README.md index db93da32..4324f96f 100644 --- a/docs/adr/README.md +++ b/docs/adr/README.md @@ -471,6 +471,7 @@ | [ADR-0465](./ADR-0465-versioned-worker-support-tier-admission.md) | 版本化 Worker 支持等级准入 | Accepted | | [ADR-0466](./ADR-0466-bounded-worker-session-compatibility-observation.md) | 有界 Worker Session 兼容性观察 | Accepted | | [ADR-0467](./ADR-0467-generic-worker-management-product-entry.md) | 通用 Worker Management 产品入口与兼容路径 | Accepted | +| [ADR-0468](./ADR-0468-optional-console-worker-observation.md) | 可选 Console Worker 只读观察 | Accepted | ## 规则 diff --git a/packages/ql3-cluster-admin/assets/copilot-console/app.js b/packages/ql3-cluster-admin/assets/copilot-console/app.js index 491a7f4c..9fa0c76e 100644 --- a/packages/ql3-cluster-admin/assets/copilot-console/app.js +++ b/packages/ql3-cluster-admin/assets/copilot-console/app.js @@ -8,8 +8,9 @@ run_cancellation_status: '/api/v1/run-management/cancellation-status', run_cancellation_blocked_list: '/api/v1/run-management/blocked-cancellations', - run_cancellation_inspect: - '/api/v1/run-management/cancellation-inspect', + run_cancellation_inspect: '/api/v1/run-management/cancellation-inspect', + worker_list: '/api/v1/worker-management/workers', + worker_inspect: '/api/v1/worker-management/worker', run_list: '/api/v1/observe/run-list', run_read: '/api/v1/observe/run', run_event_list: '/api/v1/observe/run-events', @@ -28,6 +29,8 @@ run_cancellation_status: '取消可用性', run_cancellation_blocked_list: 'Blocked Cancellations', run_cancellation_inspect: '取消诊断', + worker_list: 'Worker 目录', + worker_inspect: 'Worker 详情', run_list: 'Run 目录', run_read: 'Run 详情', run_event_list: 'Run Events', @@ -124,6 +127,10 @@ result.cursor = null; } else if (operation === 'run_cancellation_inspect') { result.runId = value('cancellation-run-id'); + } else if (operation === 'worker_list') { + result.afterWorkerId = null; + } else if (operation === 'worker_inspect') { + result.workerId = value('worker-id'); } else if (operation === 'run_list') { result.afterCreatedAtMs = null; result.afterRunId = null; @@ -176,6 +183,11 @@ typeof fact.nextCursor === 'string' ) { next.cursor = fact.nextCursor; + } else if ( + operation === 'worker_list' && + typeof fact.nextAfterWorkerId === 'string' + ) { + next.afterWorkerId = fact.nextAfterWorkerId; } else if (operation === 'run_list' && fact.hasMore === true && fact.next) { next.afterCreatedAtMs = fact.next.createdAtMs; next.afterRunId = fact.next.runId; @@ -234,6 +246,20 @@ entry.append(button); return; } + if (operation === 'worker_list' && Array.isArray(fact.workers)) { + fact.workers.forEach(function (worker) { + if (!worker || typeof worker.workerId !== 'string') return; + const button = document.createElement('button'); + button.type = 'button'; + button.textContent = '显式检查 ' + worker.workerId; + button.addEventListener('click', function () { + document.getElementById('worker-id').value = worker.workerId; + void execute('worker_inspect'); + }); + entry.append(button); + }); + return; + } if ( operation !== 'run_cancellation_blocked_list' || !Array.isArray(fact.items) diff --git a/packages/ql3-cluster-admin/assets/copilot-console/evidence-bundle.js b/packages/ql3-cluster-admin/assets/copilot-console/evidence-bundle.js index ddad720e..437ef127 100644 --- a/packages/ql3-cluster-admin/assets/copilot-console/evidence-bundle.js +++ b/packages/ql3-cluster-admin/assets/copilot-console/evidence-bundle.js @@ -31,6 +31,8 @@ 'run_cancellation_status', 'run_cancellation_blocked_list', 'run_cancellation_inspect', + 'worker_list', + 'worker_inspect', 'run_list', 'run_read', 'run_event_list', @@ -50,6 +52,8 @@ run_cancellation_status: ['projectId', 'requestId'], run_cancellation_blocked_list: ['cursor', 'projectId', 'requestId'], run_cancellation_inspect: ['projectId', 'requestId', 'runId'], + worker_list: ['afterWorkerId', 'projectId', 'requestId'], + worker_inspect: ['projectId', 'requestId', 'workerId'], run_list: [ 'afterCreatedAtMs', 'afterRunId', @@ -117,6 +121,7 @@ afterStepKey: 'step', afterStepRunId: 'step', afterTaskId: 'task', + afterWorkerId: 'worker', artifactId: 'artifact', attemptId: 'attempt', contentDigest: 'digest', @@ -125,6 +130,7 @@ executionId: 'execution', id: 'identifier', modelId: 'model', + nextAfterWorkerId: 'worker', outputRef: 'artifact', packageName: 'package', projectId: 'project', @@ -160,6 +166,10 @@ 'target', 'task', 'tasks', + 'declaredCapacity', + 'runtimes', + 'worker', + 'workers', 'usage', 'workflow', 'workflows', @@ -170,6 +180,7 @@ 'available', 'cancelRequested', 'enabled', + 'found', 'hasMore', 'outputAvailable', 'ready', @@ -183,6 +194,9 @@ 'assessment', 'cancelReason', 'kind', + 'architecture', + 'compatibility', + 'lifecycle', 'lastResult', 'operation', 'operatorAction', @@ -191,6 +205,8 @@ 'severity', 'stage', 'status', + 'supportTier', + 'operatingSystem', ]); const safeEnumValues = new Set([ 'accepted', @@ -198,6 +214,13 @@ 'admission', 'attention_required', 'available', + 'amd64', + 'arm64', + 'ppc64le', + 's390x', + 'arm/v7', + 'arm/v6', + '386', 'blocked', 'cancelled', 'completed', @@ -208,6 +231,22 @@ 'dispatch', 'dispatching', 'disabled', + 'default_placement', + 'explicit_placement_required', + 'protocol_incompatible', + 'online', + 'draining', + 'offline', + 'lease_expired', + 'tier1', + 'candidate', + 'experimental', + 'legacy-only', + 'linux', + 'darwin', + 'win32', + 'freebsd', + 'aix', 'enabled', 'execution', 'failed', @@ -269,7 +308,7 @@ const freeTextKey = /text|content|stdout|stderr|command|input|output|environment|reason|error|message|description|name|path|url|uri|host|endpoint/iu; const numericKey = - /^(?:schemaVersion|version|revision|sequence|attempt|priority|limit|offset|size|total|count|exitCode|pending|leased|retryWait|dispatched|blocked|due|expiredLease|identityMismatch|pidMismatch|unsupported|invalid|[A-Za-z0-9_]*(?:AtMs|TimeMs|DurationMs|Bytes|Tokens|Micros|Sequence|Version|Count|Limit|Offset|Size|Total))$/u; + /^(?:schemaVersion|version|revision|sequence|attempt|priority|limit|offset|size|total|count|exitCode|pending|leased|retryWait|dispatched|blocked|due|expiredLease|identityMismatch|pidMismatch|unsupported|invalid|availableSlots|maxConcurrentRuns|cpuCores|[A-Za-z0-9_]*(?:AtMs|TimeMs|DurationMs|Bytes|Tokens|Micros|Sequence|Version|Count|Limit|Offset|Size|Total))$/u; const schemaValue = /^[a-z0-9][a-z0-9./_-]{0,126}@[a-z0-9._-]{1,16}$/u; class ClusterConsoleEvidenceBundleError extends TypeError { diff --git a/packages/ql3-cluster-admin/assets/copilot-console/index.html b/packages/ql3-cluster-admin/assets/copilot-console/index.html index 8d3c0d6c..54513a21 100644 --- a/packages/ql3-cluster-admin/assets/copilot-console/index.html +++ b/packages/ql3-cluster-admin/assets/copilot-console/index.html @@ -24,7 +24,7 @@
本机只读 BFF - Run · Task · Workflow · Copilot · Optional management + Run · Task · Workflow · Worker · Copilot
@@ -52,6 +52,7 @@ @@ -80,6 +81,20 @@ + +