open-source/qinglong
1
0
Fork 0
mirror of https://github.com/whyour/qinglong.git synced 2026-09-21 18:08:20 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(ql3): observe package installations in console

Browse Source
This commit is contained in:
whyour
2026-08-20 14:42:54 +08:00
parent 344680d64a
commit ffa4b4e7cb
29 changed files with 1259 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/ql3-cluster-admin/src/copilot-console/assets.ts
+3 -3
View File
@@ -24,7 +24,7 @@ const ASSETS = Object.freeze([
name: 'index.html',
field: 'html',
maximumBytes: 32 * 1024,
digest: '363fcf2d52ff86e5b2a1c9ed8b7810226920a9270b6d0c41a1f61ce24f957832',
digest: '429d7b3dd2da4989865be6ac07180cc9c3ebdcbbac5028054cddaac870ad520c',
}),
Object.freeze({
name: 'app.css',
@@ -36,13 +36,13 @@ const ASSETS = Object.freeze([
name: 'evidence-bundle.js',
field: 'evidenceBundle',
maximumBytes: 32 * 1024,
digest: 'ae4a08572cfc3296284c56549a3850f530474151573e2705401996730bf0466e',
digest: '83d17dfa815c175161b35c1aca5f270b15005a16cb79be41c2884b490f617783',
}),
Object.freeze({
name: 'app.js',
field: 'javascript',
maximumBytes: 32 * 1024,
digest: '4b13da1a85d59e29a606da3b1a3327419926a496a498a06ddc323365ce5230c1',
digest: '365ccd43ae2aa4b11a0ab3d142cd04e89ec0b96711bef253f63584e8182589ee',
}),
] as const);
packages/ql3-cluster-admin/src/copilot-console/cli.ts
+106 -3
View File
@@ -10,7 +10,16 @@ import {
validateClusterCopilotClientCredentialFile,
} from '../copilot-client/client';
import { readCanonicalFile } from '../management-support/managementClientConfiguration';
import { validateClusterAuthenticatedManagementClientConfiguration } from '../management-support/pluginPackageManagementClient';
import {
executeClusterPluginPackageManagementCommand,
validateClusterAuthenticatedManagementClientConfiguration,
} from '../management-support/pluginPackageManagementClient';
import {
createPluginPackageInstallationInspectionCommand,
createPluginPackageInstallationListCommand,
projectPluginPackageInstallationInspection,
projectPluginPackageInstallationList,
} from '../plugin-package/management/pluginPackageInstallationProduct';
import {
createRunCancellationBlockedListCommand,
projectRunCancellationBlockedList,
@@ -50,6 +59,7 @@ const USAGE = [
' ql3-copilot-console --container-published-loopback --port=1024..65535 --config /absolute/client.json --credential /absolute/credential --session /absolute/session [--check]',
' Optional Run reads: --run-management-config /absolute/run-client.json --run-management-assertion /absolute/assertion.jwt',
' Optional Worker reads: --worker-management-config /absolute/worker-client.json --worker-management-assertion /absolute/assertion.jwt',
' Optional Package reads: --package-management-config /absolute/package-client.json --package-management-assertion /absolute/assertion.jwt',
'',
'Native mode binds 127.0.0.1. Container mode requires host-loopback port publication.',
'The browser session key remains in a separate owner-private 0600 file.',
@@ -60,6 +70,8 @@ interface ClusterCopilotConsoleCliArguments {
readonly configFile: string;
readonly credentialFile: string;
readonly networkBoundary: 'host-loopback' | 'container-published-loopback';
readonly packageManagementAssertionFile?: string;
readonly packageManagementConfigFile?: string;
readonly runManagementAssertionFile?: string;
readonly runManagementConfigFile?: string;
readonly workerManagementAssertionFile?: string;
@@ -78,6 +90,10 @@ const RUN_MANAGEMENT_OPERATIONS = new Set([
'run_cancellation_inspect',
]);
const WORKER_MANAGEMENT_OPERATIONS = new Set(['worker_list', 'worker_inspect']);
const PACKAGE_MANAGEMENT_OPERATIONS = new Set([
'package_list',
'package_inspect',
]);
function usageFailure(): never {
process.stderr.write(USAGE + '\n');
@@ -118,6 +134,8 @@ export function parseClusterCopilotConsoleCliArguments(
let runManagementAssertionFile: string | undefined;
let workerManagementConfigFile: string | undefined;
let workerManagementAssertionFile: string | undefined;
let packageManagementConfigFile: string | undefined;
let packageManagementAssertionFile: string | undefined;
let port = 0;
let portSeen = false;
let containerPublishedLoopback = false;
@@ -201,6 +219,28 @@ export function parseClusterCopilotConsoleCliArguments(
index += workerManagementAssertion.consumed;
continue;
}
const packageManagementConfig = argumentValue(
argv,
index,
'--package-management-config',
);
if (packageManagementConfig) {
if (packageManagementConfigFile !== undefined) return usageFailure();
packageManagementConfigFile = packageManagementConfig.value;
index += packageManagementConfig.consumed;
continue;
}
const packageManagementAssertion = argumentValue(
argv,
index,
'--package-management-assertion',
);
if (packageManagementAssertion) {
if (packageManagementAssertionFile !== undefined) return usageFailure();
packageManagementAssertionFile = packageManagementAssertion.value;
index += packageManagementAssertion.consumed;
continue;
}
const portArgument = argumentValue(argv, index, '--port');
if (portArgument) {
if (portSeen || !/^(?:0|[1-9][0-9]{0,4})$/.test(portArgument.value)) {
@@ -227,6 +267,8 @@ export function parseClusterCopilotConsoleCliArguments(
(runManagementAssertionFile === undefined) ||
(workerManagementConfigFile === undefined) !==
(workerManagementAssertionFile === undefined) ||
(packageManagementConfigFile === undefined) !==
(packageManagementAssertionFile === undefined) ||
(containerPublishedLoopback && port === 0) ||
(!containerPublishedLoopback && check && port !== 0)
) {
@@ -247,6 +289,10 @@ export function parseClusterCopilotConsoleCliArguments(
workerManagementAssertionFile !== undefined
? { workerManagementConfigFile, workerManagementAssertionFile }
: {}),
...(packageManagementConfigFile !== undefined &&
packageManagementAssertionFile !== undefined
? { packageManagementConfigFile, packageManagementAssertionFile }
: {}),
sessionFile,
port,
});
@@ -255,7 +301,7 @@ export function parseClusterCopilotConsoleCliArguments(
function validateManagementAuthority(
configFile: string | undefined,
assertionFile: string | undefined,
kind: 'run' | 'worker',
kind: 'package' | 'run' | 'worker',
): boolean {
if (configFile === undefined || assertionFile === undefined) return false;
validateClusterAuthenticatedManagementClientConfiguration(configFile, kind);
@@ -281,12 +327,15 @@ function validateManagementAuthority(
function availableOperations(
runManagementAuthority: boolean,
workerManagementAuthority: boolean,
packageManagementAuthority: boolean,
) {
return CLUSTER_COPILOT_CONSOLE_READ_OPERATIONS.filter(
(operation) =>
(runManagementAuthority || !RUN_MANAGEMENT_OPERATIONS.has(operation)) &&
(workerManagementAuthority ||
!WORKER_MANAGEMENT_OPERATIONS.has(operation)),
!WORKER_MANAGEMENT_OPERATIONS.has(operation)) &&
(packageManagementAuthority ||
!PACKAGE_MANAGEMENT_OPERATIONS.has(operation)),
);
}
@@ -393,6 +442,48 @@ async function executeConsoleRead(
result: projected as unknown as Readonly<Record<string, unknown>>,
});
}
if (
request.operation === 'package_list' ||
request.operation === 'package_inspect'
) {
if (
parsed.packageManagementConfigFile === undefined ||
parsed.packageManagementAssertionFile === undefined
) {
throw new Error('Package management authority is disabled');
}
const createUuid = commandIdSource(request.requestId);
const command =
request.operation === 'package_list'
? createPluginPackageInstallationListCommand(
request.projectId,
request.afterPackageName ?? undefined,
createUuid,
)
: createPluginPackageInstallationInspectionCommand(
request.projectId,
request.packageName,
createUuid,
);
const result = await executeClusterPluginPackageManagementCommand({
configFile: parsed.packageManagementConfigFile,
assertionFile: parsed.packageManagementAssertionFile,
command,
});
const projected =
request.operation === 'package_list'
? projectPluginPackageInstallationList(request.projectId, result)
: projectPluginPackageInstallationInspection(
request.projectId,
request.packageName,
result,
);
return Object.freeze({
schemaVersion: 1 as const,
requestId: request.requestId,
result: projected as unknown as Readonly<Record<string, unknown>>,
});
}
return executeClusterProjectApiRead({
configFile: parsed.configFile,
credentialFile: parsed.credentialFile,
@@ -439,9 +530,15 @@ async function main(): Promise<void> {
parsed.workerManagementAssertionFile,
'worker',
);
const packageManagementAuthority = validateManagementAuthority(
parsed.packageManagementConfigFile,
parsed.packageManagementAssertionFile,
'package',
);
const operations = availableOperations(
runManagementAuthority,
workerManagementAuthority,
packageManagementAuthority,
);
const sessionDigest = readSessionDigest(parsed.sessionFile);
if (parsed.check) {
@@ -465,6 +562,9 @@ async function main(): Promise<void> {
workerManagementAuthority: workerManagementAuthority
? 'server_only'
: 'disabled',
packageManagementAuthority: packageManagementAuthority
? 'server_only'
: 'disabled',
operations,
mutation: false,
}) + '\n',
@@ -504,6 +604,9 @@ async function main(): Promise<void> {
workerManagementAuthority: workerManagementAuthority
? 'server_only'
: 'disabled',
packageManagementAuthority: packageManagementAuthority
? 'server_only'
: 'disabled',
operations,
mutation: false,
}) + '\n',
packages/ql3-cluster-admin/src/copilot-console/contracts.ts
+35 -1
View File
@@ -16,6 +16,8 @@ export const CLUSTER_COPILOT_CONSOLE_READ_OPERATIONS = Object.freeze([
'run_cancellation_inspect',
'worker_list',
'worker_inspect',
'package_list',
'package_inspect',
'run_list',
'run_read',
'run_event_list',
@@ -51,6 +53,9 @@ export type ClusterCopilotConsoleReadRequest =
| (BaseReadRequest<'worker_list'> &
Readonly<{ afterWorkerId: string | null }>)
| (BaseReadRequest<'worker_inspect'> & Readonly<{ workerId: string }>)
| (BaseReadRequest<'package_list'> &
Readonly<{ afterPackageName: string | null }>)
| (BaseReadRequest<'package_inspect'> & Readonly<{ packageName: string }>)
| (BaseReadRequest<'run_list'> &
Readonly<{
afterCreatedAtMs: number | null;
@@ -267,6 +272,33 @@ export function normalizeClusterCopilotConsoleReadRequest(
workerId: record.workerId,
});
}
if (op === 'package_list') {
exact(record, op, ['afterPackageName']);
if (
record.afterPackageName !== null &&
(typeof record.afterPackageName !== 'string' ||
!PACKAGE_NAME.test(record.afterPackageName))
)
invalid();
return Object.freeze({
...common(record),
operation: op,
afterPackageName: record.afterPackageName as string | null,
});
}
if (op === 'package_inspect') {
exact(record, op, ['packageName']);
if (
typeof record.packageName !== 'string' ||
!PACKAGE_NAME.test(record.packageName)
)
invalid();
return Object.freeze({
...common(record),
operation: op,
packageName: record.packageName,
});
}
if (op === 'run_list') {
exact(record, op, ['afterCreatedAtMs', 'afterRunId', 'limit']);
if (
@@ -502,7 +534,9 @@ export function clusterCopilotConsoleProjectReadPath(
normalized.operation === 'run_cancellation_blocked_list' ||
normalized.operation === 'run_cancellation_inspect' ||
normalized.operation === 'worker_list' ||
normalized.operation === 'worker_inspect'
normalized.operation === 'worker_inspect' ||
normalized.operation === 'package_list' ||
normalized.operation === 'package_inspect'
)
invalid();
const project = '/api/v3/projects/' + encoded(normalized.projectId);
packages/ql3-cluster-admin/src/copilot-console/evidenceVerifier.ts
+33 -1
View File
@@ -35,6 +35,8 @@ const OPERATIONS = Object.freeze([
'run_cancellation_inspect',
'worker_list',
'worker_inspect',
'package_list',
'package_inspect',
'run_list',
'run_read',
'run_event_list',
@@ -66,6 +68,8 @@ const REQUEST_FIELDS: Readonly<Record<EvidenceOperation, readonly string[]>> =
]),
worker_list: Object.freeze(['afterWorkerId', 'projectId', 'requestId']),
worker_inspect: Object.freeze(['projectId', 'requestId', 'workerId']),
package_list: Object.freeze(['afterPackageName', 'projectId', 'requestId']),
package_inspect: Object.freeze(['packageName', 'projectId', 'requestId']),
run_list: Object.freeze([
'afterCreatedAtMs',
'afterRunId',
@@ -139,6 +143,7 @@ const IDENTIFIER_DOMAINS: Readonly<Record<string, string>> = Object.freeze({
afterStepRunId: 'step',
afterTaskId: 'task',
afterWorkerId: 'worker',
afterPackageName: 'package',
artifactId: 'artifact',
attemptId: 'attempt',
contentDigest: 'digest',
@@ -148,6 +153,7 @@ const IDENTIFIER_DOMAINS: Readonly<Record<string, string>> = Object.freeze({
id: 'identifier',
modelId: 'model',
nextAfterWorkerId: 'worker',
nextAfterPackageName: 'package',
outputRef: 'artifact',
packageName: 'package',
projectId: 'project',
@@ -187,6 +193,8 @@ const SAFE_CONTAINERS = new Set([
'runtimes',
'worker',
'workers',
'installation',
'installations',
'usage',
'workflow',
'workflows',
@@ -224,6 +232,12 @@ const SAFE_ENUM_KEYS = new Set([
'status',
'supportTier',
'operatingSystem',
'availability',
'failureReason',
'installOperation',
'quarantineReason',
'recoveryAction',
'state',
]);
const SAFE_ENUM_VALUES = new Set([
'accepted',
@@ -319,9 +333,27 @@ const SAFE_ENUM_VALUES = new Set([
'ok',
'unavailable',
'workflow',
'not_active',
'install',
'reinstall',
'upgrade',
'rollback',
'resume_stage',
'resume_activation',
'inspect_activation',
'source_unavailable',
'source_mismatch',
'stage_failed',
'activation_failed',
'activation_fact_conflict',
'approval_expired',
'policy_fence_changed',
'resource_exhausted',
'suspected_key_compromise',
'confirmed_key_compromise',
]);
const NUMERIC_KEY =
/^(?:schemaVersion|version|revision|sequence|attempt|priority|limit|offset|size|total|count|exitCode|pending|leased|retryWait|dispatched|blocked|due|expiredLease|identityMismatch|pidMismatch|unsupported|invalid|availableSlots|maxConcurrentRuns|cpuCores|[A-Za-z0-9_]*(?:AtMs|TimeMs|DurationMs|Bytes|Tokens|Micros|Sequence|Version|Count|Limit|Offset|Size|Total))$/u;
/^(?:schemaVersion|version|revision|sequence|attempt|priority|limit|offset|size|total|count|exitCode|pending|leased|retryWait|dispatched|blocked|due|expiredLease|identityMismatch|pidMismatch|unsupported|invalid|availableSlots|maxConcurrentRuns|cpuCores|targetGeneration|[A-Za-z0-9_]*(?:AtMs|TimeMs|DurationMs|Bytes|Tokens|Micros|Sequence|Version|Count|Limit|Offset|Size|Total))$/u;
const SCHEMA_VALUE = /^[a-z0-9][a-z0-9./_-]{0,126}@[a-z0-9._-]{1,16}$/u;
const SHA256 = /^[0-9a-f]{64}$/u;
const CONTROL = /[\0-\x1f\x7f]/u;
packages/ql3-cluster-admin/src/copilot-console/server.ts
+2
View File
@@ -197,6 +197,8 @@ const READ_ROUTES: Readonly<
'/api/v1/run-management/cancellation-inspect': 'run_cancellation_inspect',
'/api/v1/worker-management/workers': 'worker_list',
'/api/v1/worker-management/worker': 'worker_inspect',
'/api/v1/package-management/installations': 'package_list',
'/api/v1/package-management/installation': 'package_inspect',
'/api/v1/observe/run-list': 'run_list',
'/api/v1/observe/run': 'run_read',
'/api/v1/observe/run-events': 'run_event_list',