Add dynamic AI Workspace run profiles

This commit is contained in:
Codex
2026-06-13 17:30:48 +03:00
parent 385e2732e8
commit 6244b44c6e
21 changed files with 2179 additions and 52 deletions
+146
View File
@@ -0,0 +1,146 @@
#!/usr/bin/env sh
set -eu
SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
PLATFORM_ROOT=$(CDPATH= cd -- "$SCRIPT_DIR/../.." && pwd)
OPS_GATEWAY_REPO="${OPS_GATEWAY_REPO:-$PLATFORM_ROOT/../../data/NODEDC_TASKMANAGER_CODEXAPI}"
ENGINE_REPO="${ENGINE_REPO:-$PLATFORM_ROOT/../NODEDC_ENGINE_INFRA}"
PLATFORM_ENV="${PLATFORM_ENV:-$PLATFORM_ROOT/infra/.env}"
passed=0
failed=0
warnings=0
section() {
printf '\n== %s ==\n' "$1"
}
pass() {
passed=$((passed + 1))
printf 'PASS %s\n' "$1"
}
fail() {
failed=$((failed + 1))
printf 'FAIL %s\n' "$1" >&2
}
warn() {
warnings=$((warnings + 1))
printf 'WARN %s\n' "$1" >&2
}
require_file() {
file="$1"
label="$2"
if [ -f "$file" ]; then
pass "$label"
else
fail "$label (missing file: $file)"
fi
}
require_contains() {
file="$1"
needle="$2"
label="$3"
if [ ! -f "$file" ]; then
fail "$label (missing file: $file)"
return 0
fi
if grep -Fq "$needle" "$file"; then
pass "$label"
else
fail "$label (missing: $needle)"
fi
}
read_env() {
file="$1"
key="$2"
if [ ! -f "$file" ]; then
return 0
fi
awk -F= -v key="$key" '
$0 ~ "^[[:space:]]*#" { next }
$1 == key {
value = substr($0, index($0, "=") + 1)
gsub(/^[[:space:]]+|[[:space:]]+$/, "", value)
gsub(/^"|"$/, "", value)
print value
exit
}
' "$file"
}
require_env_value() {
file="$1"
key="$2"
expected="$3"
label="$4"
actual=$(read_env "$file" "$key" || true)
if [ "$actual" = "$expected" ]; then
pass "$label"
else
fail "$label (expected $key=$expected, got ${actual:-<missing>})"
fi
}
section "Required files"
require_file "$PLATFORM_ROOT/infra/.env.example" "Platform local env example exists"
require_file "$PLATFORM_ROOT/infra/synology/.env.synology.example" "Platform Synology env example exists"
require_file "$PLATFORM_ROOT/infra/docker-compose.dev.yml" "Platform local compose exists"
require_file "$PLATFORM_ROOT/infra/synology/docker-compose.platform-http.yml" "Platform Synology compose exists"
require_file "$OPS_GATEWAY_REPO/.env.example" "Ops Gateway local env example exists"
require_file "$OPS_GATEWAY_REPO/.env.synology.example" "Ops Gateway Synology env example exists"
require_file "$OPS_GATEWAY_REPO/docker-compose.local.yml" "Ops Gateway local compose exists"
require_file "$OPS_GATEWAY_REPO/docker-compose.synology.yml" "Ops Gateway Synology compose exists"
require_file "$ENGINE_REPO/docker-compose.yml" "Engine compose exists"
section "Platform local contract"
require_env_value "$PLATFORM_ROOT/infra/.env.example" "AI_WORKSPACE_OPS_ENTITLEMENT_URL" "http://host.docker.internal:4100/api/internal/v1/ai-workspace/entitlements" "Local Platform example points Ops entitlement to local Gateway"
require_env_value "$PLATFORM_ROOT/infra/.env.example" "AI_WORKSPACE_HUB_PUBLIC_URL" "wss://ai-hub.nodedc.ru/api/ai-workspace/hub" "Local Platform example keeps deployed Hub as hybrid worker relay by default"
require_env_value "$PLATFORM_ROOT/infra/.env.example" "AI_WORKSPACE_HUB_INTERNAL_URL" "https://ai-hub.nodedc.ru" "Local Platform example has explicit Hub internal URL"
require_contains "$PLATFORM_ROOT/infra/scripts/init-dev-env.sh" "AI_WORKSPACE_OPS_ENTITLEMENT_URL=http://host.docker.internal:4100/api/internal/v1/ai-workspace/entitlements" "Local env generator emits local Ops entitlement URL"
require_contains "$PLATFORM_ROOT/infra/scripts/init-dev-env.sh" "AI_WORKSPACE_HUB_INTERNAL_URL=https://ai-hub.nodedc.ru" "Local env generator emits explicit Hub internal URL"
section "Platform Synology contract"
require_env_value "$PLATFORM_ROOT/infra/synology/.env.synology.example" "NODEDC_AI_WORKSPACE_ASSISTANT_URL" "http://ai-workspace-assistant:18082" "Synology Platform exposes Assistant to app services on compose network"
require_env_value "$PLATFORM_ROOT/infra/synology/.env.synology.example" "AI_WORKSPACE_OPS_ENTITLEMENT_URL" "http://172.22.0.222:18190/api/internal/v1/ai-workspace/entitlements" "Synology Platform points Ops entitlement to Synology Gateway"
require_env_value "$PLATFORM_ROOT/infra/synology/.env.synology.example" "AI_WORKSPACE_HUB_PUBLIC_URL" "wss://ai-hub.nodedc.ru/api/ai-workspace/hub" "Synology Platform worker-facing Hub URL is public relay"
require_env_value "$PLATFORM_ROOT/infra/synology/.env.synology.example" "AI_WORKSPACE_HUB_INTERNAL_URL" "https://ai-hub.nodedc.ru" "Synology Platform backend Hub URL is explicit"
require_contains "$PLATFORM_ROOT/infra/synology/verify-current-runtime.sh" 'AI_WORKSPACE_OPS_ENTITLEMENT_URL" = "http://172.22.0.222:18190/api/internal/v1/ai-workspace/entitlements"' "Synology verify checks Ops entitlement URL"
section "Ops Gateway contract"
require_env_value "$OPS_GATEWAY_REPO/.env.example" "NODEDC_AGENT_GATEWAY_PUBLIC_URL" "https://ops-agents.nodedc.ru" "Ops Gateway local example keeps worker-facing MCP URL explicit"
require_env_value "$OPS_GATEWAY_REPO/.env.example" "NODEDC_TASKER_INTERNAL_URL" "http://task.local.nodedc" "Ops Gateway local example points downstream to local Tasker"
require_env_value "$OPS_GATEWAY_REPO/.env.synology.example" "NODEDC_AGENT_GATEWAY_PUBLIC_URL" "https://ops-agents.nodedc.ru" "Ops Gateway Synology public MCP URL is public relay"
require_env_value "$OPS_GATEWAY_REPO/.env.synology.example" "NODEDC_TASKER_INTERNAL_URL" "http://172.22.0.222:18090" "Ops Gateway Synology downstream points to Synology Tasker"
require_contains "$OPS_GATEWAY_REPO/docker-compose.synology.yml" '${HOST_BIND:-172.22.0.222}:${HOST_PORT:-18190}:${PORT:-4100}' "Ops Gateway Synology compose binds expected internal port"
require_contains "$OPS_GATEWAY_REPO/README.md" "The response uses the AI Workspace adapter contract" "Ops Gateway README documents AI Workspace adapter contract"
section "Engine contract"
require_contains "$ENGINE_REPO/docker-compose.yml" 'NODEDC_AI_WORKSPACE_ASSISTANT_URL: ${NODEDC_AI_WORKSPACE_ASSISTANT_URL:-http://ai-workspace-assistant:18082}' "Engine compose accepts configurable Assistant URL"
require_contains "$ENGINE_REPO/docker-compose.yml" 'NDC_AI_WORKSPACE_HUB_URL: ${NDC_AI_WORKSPACE_HUB_URL:-wss://ai-hub.nodedc.ru/api/ai-workspace/hub}' "Engine compose accepts configurable worker-facing Hub URL"
require_contains "$ENGINE_REPO/docker-compose.yml" 'NDC_AI_WORKSPACE_HUB_HTTP_URL: ${NDC_AI_WORKSPACE_HUB_HTTP_URL:-https://ai-hub.nodedc.ru}' "Engine compose accepts configurable Hub HTTP URL"
require_contains "$ENGINE_REPO/nodedc-source/server/aiWorkspace/assistantRegistryClient.js" "'X-NODEDC-User-Role': role" "Engine forwards user role to Assistant"
require_contains "$ENGINE_REPO/nodedc-source/server/aiWorkspace/assistantRegistryClient.js" "'X-NODEDC-User-Groups': groups.join(',')" "Engine forwards user groups to Assistant"
section "Current local env warnings"
if [ -f "$PLATFORM_ENV" ]; then
local_ops_entitlement=$(read_env "$PLATFORM_ENV" AI_WORKSPACE_OPS_ENTITLEMENT_URL || true)
if [ -z "$local_ops_entitlement" ]; then
warn "Current Platform env has no AI_WORKSPACE_OPS_ENTITLEMENT_URL; current Mac remains hybrid/contract-only until env is deliberately updated."
else
pass "Current Platform env has AI_WORKSPACE_OPS_ENTITLEMENT_URL"
fi
else
warn "Current Platform env not found: $PLATFORM_ENV"
fi
section "Summary"
printf 'passed=%s failed=%s warnings=%s\n' "$passed" "$failed" "$warnings"
if [ "$failed" -ne 0 ]; then
exit 1
fi
+123
View File
@@ -0,0 +1,123 @@
#!/usr/bin/env sh
set -eu
SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
PLATFORM_ROOT=$(CDPATH= cd -- "$SCRIPT_DIR/../.." && pwd)
AI_ASSISTANT_DIR="$PLATFORM_ROOT/services/ai-workspace-assistant"
OPS_GATEWAY_REPO="${OPS_GATEWAY_REPO:-$PLATFORM_ROOT/../../data/NODEDC_TASKMANAGER_CODEXAPI}"
ENGINE_REPO="${ENGINE_REPO:-$PLATFORM_ROOT/../NODEDC_ENGINE_INFRA}"
RUN_GATEWAY_SMOKE="${RUN_GATEWAY_SMOKE:-1}"
GATEWAY_DATABASE_URL="${GATEWAY_DATABASE_URL:-postgres://nodedc_agent_gateway:replace-with-local-postgres-password@localhost:54100/nodedc_agent_gateway}"
GATEWAY_INTERNAL_TOKEN="${GATEWAY_INTERNAL_TOKEN:-replace-with-gateway-internal-token}"
GATEWAY_RUN_TOKEN_TTL_SECONDS="${GATEWAY_RUN_TOKEN_TTL_SECONDS:-43200}"
passed=0
failed=0
skipped=0
section() {
printf '\n== %s ==\n' "$1"
}
pass() {
passed=$((passed + 1))
printf 'PASS %s\n' "$1"
}
fail() {
failed=$((failed + 1))
printf 'FAIL %s\n' "$1" >&2
}
skip() {
skipped=$((skipped + 1))
printf 'SKIP %s\n' "$1"
}
run_in() {
dir="$1"
label="$2"
command="$3"
if [ ! -d "$dir" ]; then
fail "$label (missing directory: $dir)"
return 0
fi
printf '\n$ %s\n' "$label"
set +e
(cd "$dir" && sh -lc "$command")
status=$?
set -e
if [ "$status" -eq 0 ]; then
pass "$label"
else
fail "$label (exit $status)"
fi
}
section "AI Workspace topology classification"
run_in "$PLATFORM_ROOT" \
"Classify current topology" \
"infra/scripts/check-ai-workspace-topology.sh"
section "Platform static and contract gates"
run_in "$PLATFORM_ROOT" \
"Platform shell syntax" \
"sh -n infra/scripts/init-dev-env.sh infra/scripts/check-ai-workspace-topology.sh infra/scripts/check-ai-workspace-config-contract.sh infra/scripts/check-ai-workspace-release-gates.sh infra/synology/check-ai-workspace-apply-plan.sh infra/synology/prepare-ai-workspace-env.sh infra/synology/deploy-current.sh infra/synology/verify-current-runtime.sh infra/synology/apply-current-runtime.sh infra/synology/backup-current.sh"
run_in "$PLATFORM_ROOT" \
"AI Workspace config contract" \
"infra/scripts/check-ai-workspace-config-contract.sh"
run_in "$AI_ASSISTANT_DIR" \
"AI Workspace Assistant server syntax" \
"node --check src/server.mjs"
run_in "$AI_ASSISTANT_DIR" \
"AI Workspace run profile smoke" \
"npm run smoke:run-profile"
run_in "$PLATFORM_ROOT" \
"Platform diff hygiene" \
"git diff --check"
section "Ops Gateway static and vertical gates"
if [ -d "$OPS_GATEWAY_REPO" ]; then
run_in "$OPS_GATEWAY_REPO" \
"Ops Gateway TypeScript check" \
"npm run check"
run_in "$OPS_GATEWAY_REPO" \
"Ops Gateway build" \
"npm run build"
if [ "$RUN_GATEWAY_SMOKE" = "1" ]; then
run_in "$OPS_GATEWAY_REPO" \
"Ops Gateway smoke" \
"DATABASE_URL='$GATEWAY_DATABASE_URL' NODEDC_AGENT_GATEWAY_INTERNAL_TOKEN='$GATEWAY_INTERNAL_TOKEN' NODEDC_AI_WORKSPACE_RUN_TOKEN_TTL_SECONDS='$GATEWAY_RUN_TOKEN_TTL_SECONDS' npm run smoke:gateway"
else
skip "Ops Gateway smoke (RUN_GATEWAY_SMOKE=$RUN_GATEWAY_SMOKE)"
fi
run_in "$OPS_GATEWAY_REPO" \
"Ops Gateway diff hygiene" \
"git diff --check"
else
fail "Ops Gateway repo not found: $OPS_GATEWAY_REPO"
fi
section "Engine static gates"
if [ -d "$ENGINE_REPO" ]; then
run_in "$ENGINE_REPO" \
"Engine AI Workspace client syntax" \
"node --check nodedc-source/server/aiWorkspace/assistantRegistryClient.js"
run_in "$ENGINE_REPO" \
"Engine diff hygiene" \
"git diff --check"
else
fail "Engine repo not found: $ENGINE_REPO"
fi
section "Summary"
printf 'passed=%s failed=%s skipped=%s\n' "$passed" "$failed" "$skipped"
if [ "$failed" -ne 0 ]; then
exit 1
fi
+194
View File
@@ -0,0 +1,194 @@
#!/usr/bin/env sh
set -eu
SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
INFRA_DIR=$(CDPATH= cd -- "$SCRIPT_DIR/.." && pwd)
PLATFORM_ENV="${PLATFORM_ENV:-$INFRA_DIR/.env}"
ASSISTANT_URL="${ASSISTANT_URL:-http://127.0.0.1:18082}"
HUB_URL="${HUB_URL:-http://127.0.0.1:18081}"
GATEWAY_URL="${GATEWAY_URL:-http://127.0.0.1:4100}"
TASK_URL="${TASK_URL:-http://task.local.nodedc/}"
ENGINE_URL="${ENGINE_URL:-http://127.0.0.1:5300/}"
read_env() {
file="$1"
key="$2"
if [ ! -f "$file" ]; then
return 0
fi
awk -F= -v key="$key" '
$0 ~ "^[[:space:]]*#" { next }
$1 == key {
value = substr($0, index($0, "=") + 1)
gsub(/^[[:space:]]+|[[:space:]]+$/, "", value)
gsub(/^"|"$/, "", value)
print value
exit
}
' "$file"
}
http_status() {
url="$1"
curl -k -sS -o /dev/null -w "%{http_code}" --max-time 3 "$url" 2>/dev/null || true
}
http_body() {
url="$1"
curl -k -sS --max-time 3 "$url" 2>/dev/null || true
}
ok_status() {
code="$1"
case "$code" in
2*|3*) printf true ;;
*) printf false ;;
esac
}
json_number() {
key="$1"
sed -n "s/.*\"$key\"[[:space:]]*:[[:space:]]*\\([0-9][0-9]*\\).*/\\1/p" | head -n 1
}
url_kind() {
value="$1"
case "$value" in
"")
printf missing
;;
*127.0.0.1*|*localhost*|*host.docker.internal*|*".local.nodedc"*|*ai-workspace-hub*|*agent-gateway*)
printf local
;;
*100.[6-9][0-9].*|*100.1[01][0-9].*|*100.12[0-7].*|*.ts.net*)
printf tailscale
;;
*172.22.0.222*|*".nas.nodedc"*)
printf synology-lan
;;
*ai-hub.nodedc.ru*|*ops-agents.nodedc.ru*|*hub.nodedc.ru*|*ops.nodedc.ru*)
printf prod-public
;;
http://172.*|http://192.168.*|http://10.*)
printf lan
;;
*)
printf custom
;;
esac
}
bool_and() {
left="$1"
right="$2"
if [ "$left" = true ] && [ "$right" = true ]; then
printf true
else
printf false
fi
}
assistant_code=$(http_status "$ASSISTANT_URL/healthz")
hub_body=$(http_body "$HUB_URL/healthz")
hub_code=000
if [ -n "$hub_body" ]; then
hub_code=$(http_status "$HUB_URL/healthz")
fi
gateway_code=$(http_status "$GATEWAY_URL/readyz")
task_code=$(http_status "$TASK_URL")
engine_code=$(http_status "$ENGINE_URL")
assistant_ok=$(ok_status "$assistant_code")
hub_ok=$(ok_status "$hub_code")
gateway_ok=$(ok_status "$gateway_code")
task_ok=$(ok_status "$task_code")
engine_ok=$(ok_status "$engine_code")
agents_online=$(printf "%s" "$hub_body" | json_number agentsOnline)
case "$agents_online" in
""|*[!0-9]*) agents_online=0 ;;
esac
hub_public=$(read_env "$PLATFORM_ENV" AI_WORKSPACE_HUB_PUBLIC_URL || true)
hub_internal=$(read_env "$PLATFORM_ENV" AI_WORKSPACE_HUB_INTERNAL_URL || true)
ops_entitlement=$(read_env "$PLATFORM_ENV" AI_WORKSPACE_OPS_ENTITLEMENT_URL || true)
hub_public_kind=$(url_kind "$hub_public")
hub_internal_kind=$(url_kind "$hub_internal")
ops_entitlement_kind=$(url_kind "$ops_entitlement")
local_services_ok=$(bool_and "$(bool_and "$assistant_ok" "$hub_ok")" "$(bool_and "$gateway_ok" "$task_ok")")
worker_on_local_hub=false
if [ "$agents_online" -gt 0 ]; then
worker_on_local_hub=true
fi
hub_runtime_kind=custom
case "$hub_public_kind:$hub_internal_kind" in
local:local|local:missing|missing:local) hub_runtime_kind=local ;;
tailscale:local|tailscale:tailscale|tailscale:missing) hub_runtime_kind=tailscale ;;
prod-public:prod-public|prod-public:missing|missing:prod-public) hub_runtime_kind=prod-public ;;
*) hub_runtime_kind=mixed ;;
esac
classification=contract-only
if [ "$local_services_ok" = true ]; then
if [ "$engine_ok" = true ] \
&& [ "$worker_on_local_hub" = true ] \
&& [ "$ops_entitlement_kind" = local ] \
&& [ "$hub_runtime_kind" = local ]; then
classification=true-local-e2e
elif [ "$engine_ok" = true ] \
&& [ "$worker_on_local_hub" = true ] \
&& { [ "$ops_entitlement_kind" = tailscale ] || [ "$hub_runtime_kind" = tailscale ]; }; then
classification=tunnel-local-e2e
elif [ "$hub_runtime_kind" = prod-public ] || [ "$worker_on_local_hub" = false ]; then
classification=hybrid-prod-bridge
else
classification=local-ops-vertical
fi
elif [ "$gateway_ok" = true ] && [ "$task_ok" = true ]; then
classification=local-ops-vertical
elif [ "$task_ok" = true ] || [ "$engine_ok" = true ]; then
classification=local-ui-only
fi
cat <<EOF
classification=$classification
platform_env=$PLATFORM_ENV
assistant_health=$assistant_ok status=$assistant_code url=$ASSISTANT_URL/healthz
hub_health=$hub_ok status=$hub_code url=$HUB_URL/healthz agents_online=$agents_online
gateway_health=$gateway_ok status=$gateway_code url=$GATEWAY_URL/readyz
task_health=$task_ok status=$task_code url=$TASK_URL
engine_health=$engine_ok status=$engine_code url=$ENGINE_URL
hub_public_kind=$hub_public_kind
hub_internal_kind=$hub_internal_kind
hub_runtime_kind=$hub_runtime_kind
ops_entitlement_kind=$ops_entitlement_kind
EOF
case "$classification" in
true-local-e2e|tunnel-local-e2e)
echo "meaning=local write-path e2e can be interpreted if the worker can reach returned MCP URLs"
;;
hybrid-prod-bridge)
echo "meaning=do not treat UI dialog as local write-path proof; worker/HUB/MCP topology is mixed"
;;
local-ops-vertical)
echo "meaning=Gateway and Tasker local vertical checks are valid, but no live Codex worker e2e is proven"
;;
local-ui-only)
echo "meaning=local UI/proxy is reachable, but AI Workspace write path is not proven"
;;
*)
echo "meaning=contract tests only; no runtime topology is proven"
;;
esac
if [ "${REQUIRE_TRUE_E2E:-0}" = "1" ]; then
case "$classification" in
true-local-e2e|tunnel-local-e2e) exit 0 ;;
*) exit 2 ;;
esac
fi
+7 -1
View File
@@ -60,14 +60,20 @@ NODEDC_INTERNAL_ACCESS_TOKEN=$(openssl rand -hex 48 | tr -d '\n')
COOKIE_DOMAIN=.local.nodedc
COOKIE_SECURE=false
# AI Workspace shared registry and Hub
# AI Workspace shared registry and Hub.
# Generated local env uses the deployed relay by default. This is suitable for
# UI/contract smoke, not proof of local live-worker write-path e2e.
AI_WORKSPACE_PG_DB=nodedc_ai_workspace
AI_WORKSPACE_PG_USER=nodedc_ai_workspace
AI_WORKSPACE_PG_PASS=$(rand 36)
AI_WORKSPACE_ASSISTANT_TOKEN=$(openssl rand -hex 48 | tr -d '\n')
AI_WORKSPACE_OPS_ENTITLEMENT_URL=http://host.docker.internal:4100/api/internal/v1/ai-workspace/entitlements
AI_WORKSPACE_OPS_ENTITLEMENT_TOKEN=replace-with-ops-agent-gateway-internal-token
AI_WORKSPACE_OPS_ENTITLEMENT_REQUIRED=false
AI_WORKSPACE_HUB_TOKEN=$(openssl rand -hex 48 | tr -d '\n')
AI_WORKSPACE_HUB_HOST_BIND=127.0.0.1:18081
AI_WORKSPACE_HUB_PUBLIC_URL=wss://ai-hub.nodedc.ru/api/ai-workspace/hub
AI_WORKSPACE_HUB_INTERNAL_URL=https://ai-hub.nodedc.ru
AI_WORKSPACE_HUB_FALLBACK_URLS=
EOF