open-source/qinglong
1
0
Fork 0
mirror of https://github.com/whyour/qinglong.git synced 2026-09-21 01:00:24 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(ql3): expose worker observations in console

Browse Source
This commit is contained in:
whyour
2026-08-20 14:02:01 +08:00
parent af5d5bfc0b
commit 344680d64a
25 changed files with 840 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/ql3-cluster-admin/src/copilot-console/assets.ts
+3 -3
View File
@@ -24,7 +24,7 @@ const ASSETS = Object.freeze([
name: 'index.html',
field: 'html',
maximumBytes: 32 * 1024,
digest: 'a5a3d46a8493a27b53bd4a253ef38ebaf00d204a1454f4b47a1f1ceff668855f',
digest: '363fcf2d52ff86e5b2a1c9ed8b7810226920a9270b6d0c41a1f61ce24f957832',
}),
Object.freeze({
name: 'app.css',
@@ -36,13 +36,13 @@ const ASSETS = Object.freeze([
name: 'evidence-bundle.js',
field: 'evidenceBundle',
maximumBytes: 32 * 1024,
digest: '739ff786b651de23876fc5f4df5073e211085dfdfa1d2ecb79f53d5c871c6c1d',
digest: 'ae4a08572cfc3296284c56549a3850f530474151573e2705401996730bf0466e',
}),
Object.freeze({
name: 'app.js',
field: 'javascript',
maximumBytes: 32 * 1024,
digest: '7ed994d8f2f5b151a247c5dec1d2841d45d30ff05b14dd1f41c12c5582acf9e6',
digest: '4b13da1a85d59e29a606da3b1a3327419926a496a498a06ddc323365ce5230c1',
}),
] as const);
packages/ql3-cluster-admin/src/copilot-console/cli.ts
+118 -23
View File
@@ -24,6 +24,13 @@ import {
projectRunCancellationStatus,
} from '../run-management/runCancellationStatus';
import { executeClusterRunManagementCommand } from '../run-management/runManagementClient';
import { executeClusterWorkerManagementClient } from '../worker-management/workerManagementClient';
import {
createWorkerSessionInspectionCommand,
createWorkerSessionListCommand,
projectWorkerSessionInspection,
projectWorkerSessionList,
} from '../worker-management/workerManagementProduct';
import { loadClusterCopilotConsoleAssets } from './assets';
import {
CLUSTER_COPILOT_CONSOLE_READ_OPERATIONS,
@@ -42,6 +49,7 @@ const USAGE = [
' ql3-copilot-console --check --config /absolute/client.json --credential /absolute/credential --session /absolute/session',
' ql3-copilot-console --container-published-loopback --port=1024..65535 --config /absolute/client.json --credential /absolute/credential --session /absolute/session [--check]',
' Optional Run reads: --run-management-config /absolute/run-client.json --run-management-assertion /absolute/assertion.jwt',
' Optional Worker reads: --worker-management-config /absolute/worker-client.json --worker-management-assertion /absolute/assertion.jwt',
'',
'Native mode binds 127.0.0.1. Container mode requires host-loopback port publication.',
'The browser session key remains in a separate owner-private 0600 file.',
@@ -54,6 +62,8 @@ interface ClusterCopilotConsoleCliArguments {
readonly networkBoundary: 'host-loopback' | 'container-published-loopback';
readonly runManagementAssertionFile?: string;
readonly runManagementConfigFile?: string;
readonly workerManagementAssertionFile?: string;
readonly workerManagementConfigFile?: string;
readonly sessionFile: string;
readonly port: number;
}
@@ -67,6 +77,7 @@ const RUN_MANAGEMENT_OPERATIONS = new Set([
'run_cancellation_blocked_list',
'run_cancellation_inspect',
]);
const WORKER_MANAGEMENT_OPERATIONS = new Set(['worker_list', 'worker_inspect']);
function usageFailure(): never {
process.stderr.write(USAGE + '\n');
@@ -105,6 +116,8 @@ export function parseClusterCopilotConsoleCliArguments(
let sessionFile: string | undefined;
let runManagementConfigFile: string | undefined;
let runManagementAssertionFile: string | undefined;
let workerManagementConfigFile: string | undefined;
let workerManagementAssertionFile: string | undefined;
let port = 0;
let portSeen = false;
let containerPublishedLoopback = false;
@@ -166,6 +179,28 @@ export function parseClusterCopilotConsoleCliArguments(
index += runManagementAssertion.consumed;
continue;
}
const workerManagementConfig = argumentValue(
argv,
index,
'--worker-management-config',
);
if (workerManagementConfig) {
if (workerManagementConfigFile !== undefined) return usageFailure();
workerManagementConfigFile = workerManagementConfig.value;
index += workerManagementConfig.consumed;
continue;
}
const workerManagementAssertion = argumentValue(
argv,
index,
'--worker-management-assertion',
);
if (workerManagementAssertion) {
if (workerManagementAssertionFile !== undefined) return usageFailure();
workerManagementAssertionFile = workerManagementAssertion.value;
index += workerManagementAssertion.consumed;
continue;
}
const portArgument = argumentValue(argv, index, '--port');
if (portArgument) {
if (portSeen || !/^(?:0|[1-9][0-9]{0,4})$/.test(portArgument.value)) {
@@ -190,6 +225,8 @@ export function parseClusterCopilotConsoleCliArguments(
sessionFile === undefined ||
(runManagementConfigFile === undefined) !==
(runManagementAssertionFile === undefined) ||
(workerManagementConfigFile === undefined) !==
(workerManagementAssertionFile === undefined) ||
(containerPublishedLoopback && port === 0) ||
(!containerPublishedLoopback && check && port !== 0)
) {
@@ -206,28 +243,26 @@ export function parseClusterCopilotConsoleCliArguments(
runManagementAssertionFile !== undefined
? { runManagementConfigFile, runManagementAssertionFile }
: {}),
...(workerManagementConfigFile !== undefined &&
workerManagementAssertionFile !== undefined
? { workerManagementConfigFile, workerManagementAssertionFile }
: {}),
sessionFile,
port,
});
}
function validateRunManagementAuthority(
parsed: Readonly<ClusterCopilotConsoleCliArguments>,
function validateManagementAuthority(
configFile: string | undefined,
assertionFile: string | undefined,
kind: 'run' | 'worker',
): boolean {
if (
parsed.runManagementConfigFile === undefined ||
parsed.runManagementAssertionFile === undefined
) {
return false;
}
validateClusterAuthenticatedManagementClientConfiguration(
parsed.runManagementConfigFile,
'run',
);
if (configFile === undefined || assertionFile === undefined) return false;
validateClusterAuthenticatedManagementClientConfiguration(configFile, kind);
let bytes: Buffer | undefined;
try {
bytes = readCanonicalFile(
parsed.runManagementAssertionFile,
assertionFile,
MAXIMUM_MANAGEMENT_ASSERTION_BYTES,
'private',
);
@@ -235,7 +270,7 @@ function validateRunManagementAuthority(
bytes.some((byte) => byte > 0x7f) ||
!MANAGEMENT_ASSERTION.test(bytes.toString('ascii'))
) {
throw new Error('invalid Run management assertion');
throw new Error('invalid management assertion');
}
return true;
} finally {
@@ -243,12 +278,16 @@ function validateRunManagementAuthority(
}
}
function availableOperations(runManagementAuthority: boolean) {
return runManagementAuthority
? CLUSTER_COPILOT_CONSOLE_READ_OPERATIONS
: CLUSTER_COPILOT_CONSOLE_READ_OPERATIONS.filter(
(operation) => !RUN_MANAGEMENT_OPERATIONS.has(operation),
);
function availableOperations(
runManagementAuthority: boolean,
workerManagementAuthority: boolean,
) {
return CLUSTER_COPILOT_CONSOLE_READ_OPERATIONS.filter(
(operation) =>
(runManagementAuthority || !RUN_MANAGEMENT_OPERATIONS.has(operation)) &&
(workerManagementAuthority ||
!WORKER_MANAGEMENT_OPERATIONS.has(operation)),
);
}
function commandIdSource(requestId: string): () => string {
@@ -312,7 +351,45 @@ async function executeConsoleRead(
: projectRunCancellationInspection(result);
return Object.freeze({
schemaVersion: 1 as const,
requestId: result.requestId,
requestId: request.requestId,
result: projected as unknown as Readonly<Record<string, unknown>>,
});
}
if (
request.operation === 'worker_list' ||
request.operation === 'worker_inspect'
) {
if (
parsed.workerManagementConfigFile === undefined ||
parsed.workerManagementAssertionFile === undefined
) {
throw new Error('Worker management authority is disabled');
}
const createUuid = commandIdSource(request.requestId);
const command =
request.operation === 'worker_list'
? createWorkerSessionListCommand(
request.projectId,
request.afterWorkerId ?? undefined,
createUuid,
)
: createWorkerSessionInspectionCommand(
request.projectId,
request.workerId,
createUuid,
);
const result = await executeClusterWorkerManagementClient({
configFile: parsed.workerManagementConfigFile,
assertionFile: parsed.workerManagementAssertionFile,
command,
});
const projected =
request.operation === 'worker_list'
? projectWorkerSessionList(request.projectId, result)
: projectWorkerSessionInspection(request.projectId, result);
return Object.freeze({
schemaVersion: 1 as const,
requestId: request.requestId,
result: projected as unknown as Readonly<Record<string, unknown>>,
});
}
@@ -352,8 +429,20 @@ async function main(): Promise<void> {
const assets = loadClusterCopilotConsoleAssets(__dirname);
validateClusterCopilotClientConfiguration(parsed.configFile);
validateClusterCopilotClientCredentialFile(parsed.credentialFile);
const runManagementAuthority = validateRunManagementAuthority(parsed);
const operations = availableOperations(runManagementAuthority);
const runManagementAuthority = validateManagementAuthority(
parsed.runManagementConfigFile,
parsed.runManagementAssertionFile,
'run',
);
const workerManagementAuthority = validateManagementAuthority(
parsed.workerManagementConfigFile,
parsed.workerManagementAssertionFile,
'worker',
);
const operations = availableOperations(
runManagementAuthority,
workerManagementAuthority,
);
const sessionDigest = readSessionDigest(parsed.sessionFile);
if (parsed.check) {
try {
@@ -373,6 +462,9 @@ async function main(): Promise<void> {
runManagementAuthority: runManagementAuthority
? 'server_only'
: 'disabled',
workerManagementAuthority: workerManagementAuthority
? 'server_only'
: 'disabled',
operations,
mutation: false,
}) + '\n',
@@ -409,6 +501,9 @@ async function main(): Promise<void> {
runManagementAuthority: runManagementAuthority
? 'server_only'
: 'disabled',
workerManagementAuthority: workerManagementAuthority
? 'server_only'
: 'disabled',
operations,
mutation: false,
}) + '\n',
packages/ql3-cluster-admin/src/copilot-console/contracts.ts
+27 -1
View File
@@ -14,6 +14,8 @@ export const CLUSTER_COPILOT_CONSOLE_READ_OPERATIONS = Object.freeze([
'run_cancellation_status',
'run_cancellation_blocked_list',
'run_cancellation_inspect',
'worker_list',
'worker_inspect',
'run_list',
'run_read',
'run_event_list',
@@ -46,6 +48,9 @@ export type ClusterCopilotConsoleReadRequest =
| (BaseReadRequest<'run_cancellation_blocked_list'> &
Readonly<{ cursor: string | null }>)
| (BaseReadRequest<'run_cancellation_inspect'> & Readonly<{ runId: string }>)
| (BaseReadRequest<'worker_list'> &
Readonly<{ afterWorkerId: string | null }>)
| (BaseReadRequest<'worker_inspect'> & Readonly<{ workerId: string }>)
| (BaseReadRequest<'run_list'> &
Readonly<{
afterCreatedAtMs: number | null;
@@ -243,6 +248,25 @@ export function normalizeClusterCopilotConsoleReadRequest(
runId: record.runId,
});
}
if (op === 'worker_list') {
exact(record, op, ['afterWorkerId']);
if (record.afterWorkerId !== null && !identifier(record.afterWorkerId))
invalid();
return Object.freeze({
...common(record),
operation: op,
afterWorkerId: record.afterWorkerId as string | null,
});
}
if (op === 'worker_inspect') {
exact(record, op, ['workerId']);
if (!identifier(record.workerId)) invalid();
return Object.freeze({
...common(record),
operation: op,
workerId: record.workerId,
});
}
if (op === 'run_list') {
exact(record, op, ['afterCreatedAtMs', 'afterRunId', 'limit']);
if (
@@ -476,7 +500,9 @@ export function clusterCopilotConsoleProjectReadPath(
normalized.operation === 'output' ||
normalized.operation === 'run_cancellation_status' ||
normalized.operation === 'run_cancellation_blocked_list' ||
normalized.operation === 'run_cancellation_inspect'
normalized.operation === 'run_cancellation_inspect' ||
normalized.operation === 'worker_list' ||
normalized.operation === 'worker_inspect'
)
invalid();
const project = '/api/v3/projects/' + encoded(normalized.projectId);
packages/ql3-cluster-admin/src/copilot-console/evidenceVerifier.ts
+40 -1
View File
@@ -33,6 +33,8 @@ const OPERATIONS = Object.freeze([
'run_cancellation_status',
'run_cancellation_blocked_list',
'run_cancellation_inspect',
'worker_list',
'worker_inspect',
'run_list',
'run_read',
'run_event_list',
@@ -62,6 +64,8 @@ const REQUEST_FIELDS: Readonly<Record<EvidenceOperation, readonly string[]>> =
'requestId',
'runId',
]),
worker_list: Object.freeze(['afterWorkerId', 'projectId', 'requestId']),
worker_inspect: Object.freeze(['projectId', 'requestId', 'workerId']),
run_list: Object.freeze([
'afterCreatedAtMs',
'afterRunId',
@@ -134,6 +138,7 @@ const IDENTIFIER_DOMAINS: Readonly<Record<string, string>> = Object.freeze({
afterStepKey: 'step',
afterStepRunId: 'step',
afterTaskId: 'task',
afterWorkerId: 'worker',
artifactId: 'artifact',
attemptId: 'attempt',
contentDigest: 'digest',
@@ -142,6 +147,7 @@ const IDENTIFIER_DOMAINS: Readonly<Record<string, string>> = Object.freeze({
executionId: 'execution',
id: 'identifier',
modelId: 'model',
nextAfterWorkerId: 'worker',
outputRef: 'artifact',
packageName: 'package',
projectId: 'project',
@@ -177,6 +183,10 @@ const SAFE_CONTAINERS = new Set([
'target',
'task',
'tasks',
'declaredCapacity',
'runtimes',
'worker',
'workers',
'usage',
'workflow',
'workflows',
@@ -187,6 +197,7 @@ const SAFE_BOOLEANS = new Set([
'available',
'cancelRequested',
'enabled',
'found',
'hasMore',
'outputAvailable',
'ready',
@@ -199,8 +210,11 @@ const SAFE_ENUM_KEYS = new Set([
'assessment',
'cancelReason',
'finishReason',
'architecture',
'compatibility',
'kind',
'lastResult',
'lifecycle',
'operation',
'operatorAction',
'outcome',
@@ -208,6 +222,8 @@ const SAFE_ENUM_KEYS = new Set([
'severity',
'stage',
'status',
'supportTier',
'operatingSystem',
]);
const SAFE_ENUM_VALUES = new Set([
'accepted',
@@ -215,6 +231,13 @@ const SAFE_ENUM_VALUES = new Set([
'admission',
'attention_required',
'available',
'amd64',
'arm64',
'ppc64le',
's390x',
'arm/v7',
'arm/v6',
'386',
'blocked',
'cancelled',
'completed',
@@ -225,6 +248,22 @@ const SAFE_ENUM_VALUES = new Set([
'dispatch',
'dispatching',
'disabled',
'default_placement',
'explicit_placement_required',
'protocol_incompatible',
'online',
'draining',
'offline',
'lease_expired',
'tier1',
'candidate',
'experimental',
'legacy-only',
'linux',
'darwin',
'win32',
'freebsd',
'aix',
'enabled',
'execution',
'failed',
@@ -282,7 +321,7 @@ const SAFE_ENUM_VALUES = new Set([
'workflow',
]);
const NUMERIC_KEY =
/^(?:schemaVersion|version|revision|sequence|attempt|priority|limit|offset|size|total|count|exitCode|pending|leased|retryWait|dispatched|blocked|due|expiredLease|identityMismatch|pidMismatch|unsupported|invalid|[A-Za-z0-9_]*(?:AtMs|TimeMs|DurationMs|Bytes|Tokens|Micros|Sequence|Version|Count|Limit|Offset|Size|Total))$/u;
/^(?:schemaVersion|version|revision|sequence|attempt|priority|limit|offset|size|total|count|exitCode|pending|leased|retryWait|dispatched|blocked|due|expiredLease|identityMismatch|pidMismatch|unsupported|invalid|availableSlots|maxConcurrentRuns|cpuCores|[A-Za-z0-9_]*(?:AtMs|TimeMs|DurationMs|Bytes|Tokens|Micros|Sequence|Version|Count|Limit|Offset|Size|Total))$/u;
const SCHEMA_VALUE = /^[a-z0-9][a-z0-9./_-]{0,126}@[a-z0-9._-]{1,16}$/u;
const SHA256 = /^[0-9a-f]{64}$/u;
const CONTROL = /[\0-\x1f\x7f]/u;
packages/ql3-cluster-admin/src/copilot-console/server.ts
+2
View File
@@ -195,6 +195,8 @@ const READ_ROUTES: Readonly<
'/api/v1/run-management/blocked-cancellations':
'run_cancellation_blocked_list',
'/api/v1/run-management/cancellation-inspect': 'run_cancellation_inspect',
'/api/v1/worker-management/workers': 'worker_list',
'/api/v1/worker-management/worker': 'worker_inspect',
'/api/v1/observe/run-list': 'run_list',
'/api/v1/observe/run': 'run_read',
'/api/v1/observe/run-events': 'run_event_list',