pikasTech-unidesk/scripts/native/hwlab/runtime-gitops-postprocess.mjs

#!/usr/bin/env node
// SPEC: PJ2026-01060703 CI/CD branch follower runtime GitOps postprocess.
// Responsibility: mutate rendered runtime GitOps files after HWLAB source render, before publish.
import { existsSync, readdirSync, readFileSync, statSync, unlinkSync, writeFileSync } from "node:fs";
import { createRequire } from "node:module";
import path from "node:path";

const requireFromScript = createRequire(import.meta.url);
const requireFromCwd = createRequire(path.join(process.cwd(), "package.json"));
const YAML = requireYaml();
const repoDir = process.cwd();
const overlay = readOverlay();
const runtimePath = requiredOverlayString("runtimePath");
const runtimeDir = path.resolve(repoDir, runtimePath);
const prometheusOperatorKinds = new Set(["ServiceMonitor", "PrometheusRule", "PodMonitor", "Probe"]);

if (!existsSync(runtimeDir)) {
  emit({ ok: false, reason: "runtime-path-missing", runtimePath });
  process.exit(45);
}

const result = postprocessRuntimeGitops();
emit({ ok: true, runtimePath, ...result });

function postprocessRuntimeGitops() {
  const prometheusOperatorDisabled = overlay?.observability?.prometheusOperator === false;
  const changedFiles = [];
  const deletedFiles = [];
  for (const file of listYamlFiles(runtimeDir)) {
    const changed = prometheusOperatorDisabled ? stripPrometheusOperatorResourcesFromFile(file) : "unchanged";
    if (changed === "deleted") deletedFiles.push(path.relative(repoDir, file));
    if (changed === "changed") changedFiles.push(path.relative(repoDir, file));
  }
  const publicExposure = patchPublicExposure();
  const kustomizationChanged = reconcileKustomizationResources();
  const codeAgentRuntimeChanged = patchCodeAgentRuntimeWorkloads();
  return {
    observabilityPrometheusOperator: overlay?.observability?.prometheusOperator ?? null,
    observabilityWorkloadsChanged: changedFiles.length > 0 || deletedFiles.length > 0,
    publicExposure,
    kustomizationChanged,
    codeAgentRuntimeChanged,
    changedFiles,
    deletedFiles,
  };
}

function patchPublicExposure() {
  const exposure = overlay?.publicExposure;
  const frpcFile = path.join(runtimeDir, "node-frpc.yaml");
  const nodePortFile = path.join(runtimeDir, "node-public-service.yaml");
  if (!exposure?.enabled) {
    const frpcRemoved = removeFile(frpcFile);
    const nodePortRemoved = removeFile(nodePortFile);
    return { configured: false, changed: frpcRemoved || nodePortRemoved };
  }
  if (exposure.mode !== "node-port-shared-edge") {
    return { configured: true, mode: exposure.mode, changed: false };
  }
  if (typeof overlay.environment !== "string" || overlay.environment.length === 0) {
    throw new Error("node-port-shared-edge public exposure requires overlay.environment");
  }
  const service = {
    apiVersion: "v1",
    kind: "Service",
    metadata: {
      name: String(exposure.serviceName),
      namespace: String(overlay.runtimeNamespace),
      labels: {
        "app.kubernetes.io/name": String(exposure.serviceName),
        "app.kubernetes.io/part-of": "hwlab",
        "hwlab.pikastech.local/environment": overlay.environment,
      },
    },
    spec: {
      type: "NodePort",
      selector: exposure.selector,
      ports: [{
        name: "http",
        protocol: "TCP",
        port: Number(exposure.port),
        targetPort: Number(exposure.targetPort),
        nodePort: Number(exposure.nodePort),
      }],
    },
  };
  const rendered = YAML.stringify(service);
  const previous = existsSync(nodePortFile) ? readFileSync(nodePortFile, "utf8") : "";
  if (previous !== rendered) writeFileSync(nodePortFile, rendered, "utf8");
  const frpcRemoved = removeFile(frpcFile);
  return {
    configured: true,
    mode: exposure.mode,
    changed: previous !== rendered || frpcRemoved,
    serviceName: exposure.serviceName,
    nodePort: exposure.nodePort,
    frpcRemoved,
  };
}

function removeFile(file) {
  if (!existsSync(file)) return false;
  unlinkSync(file);
  return true;
}

function patchCodeAgentRuntimeWorkloads() {
  const runtime = overlay?.codeAgentRuntime;
  if (!runtime?.enabled) return false;
  const kafka = runtime.kafkaEventBridge;
  let changed = false;
  for (const file of listYamlFiles(runtimeDir)) {
    const documents = parseStructuredDocuments(readFileSync(file, "utf8"), file);
    let fileChanged = false;
    for (const document of documents.values) {
      const items = isKubernetesList(document) ? document.items : [document];
      for (const item of items) {
        const workloadName = String(item?.metadata?.labels?.["app.kubernetes.io/name"] ?? item?.metadata?.name ?? "");
        const containers = item?.spec?.template?.spec?.containers;
        if (!Array.isArray(containers)) continue;
        for (const container of containers) {
          if (!Array.isArray(container?.env)) continue;
          if (workloadName === "hwlab-cloud-api" && container.name === "hwlab-cloud-api") {
            fileChanged = patchCloudApiRuntimeEnv(container, runtime) || fileChanged;
            if (kafka) fileChanged = patchCloudApiKafkaEnv(container, kafka) || fileChanged;
          }
          if (workloadName === "hwlab-cloud-web" && container.name === "hwlab-cloud-web") {
            if (kafka) fileChanged = patchCloudWebKafkaEnv(container, kafka) || fileChanged;
            fileChanged = patchCloudWebRuntimeEnv(container, runtime.workbench?.webRuntimeConfig) || fileChanged;
          }
        }
      }
    }
    if (fileChanged) {
      writeFileSync(file, serializeStructuredDocuments(documents), "utf8");
      changed = true;
    }
  }
  return changed;
}

function patchCloudApiRuntimeEnv(container, runtime) {
  let changed = false;
  changed = setEnvValue(container, "HWLAB_CODE_AGENT_ADAPTER", String(runtime.adapter)) || changed;
  changed = setEnvValue(container, "AGENTRUN_MGR_URL", String(runtime.managerUrl)) || changed;
  changed = setEnvFromSecret(container, "AGENTRUN_API_KEY", String(runtime.apiKeySecretName), String(runtime.apiKeySecretKey)) || changed;
  changed = setEnvValue(container, "HWLAB_CODE_AGENT_AGENTRUN_RUNNER_NAMESPACE", String(runtime.runnerNamespace)) || changed;
  changed = setEnvValue(container, "HWLAB_CODE_AGENT_AGENTRUN_SECRET_NAMESPACE", String(runtime.secretNamespace)) || changed;
  for (const [profile, secretName] of Object.entries(runtime.providerSecretNames ?? {}).sort(([left], [right]) => left.localeCompare(right))) {
    const profileKey = profile.toUpperCase().replace(/[^A-Z0-9]+/gu, "_");
    changed = setEnvValue(container, `HWLAB_CODE_AGENT_AGENTRUN_${profileKey}_SECRET_NAME`, String(secretName)) || changed;
  }
  if (runtime.toolSecretNames) {
    changed = setEnvValue(container, "HWLAB_CODE_AGENT_AGENTRUN_GITHUB_TOOL_SECRET_NAME", String(runtime.toolSecretNames.githubPr)) || changed;
    changed = setEnvValue(container, "HWLAB_CODE_AGENT_AGENTRUN_UNIDESK_SSH_TOOL_SECRET_NAME", String(runtime.toolSecretNames.unideskSsh)) || changed;
  }
  changed = setEnvValue(container, "HWLAB_CODE_AGENT_DEFAULT_PROVIDER_PROFILE", String(runtime.defaultProviderProfile)) || changed;
  changed = setEnvValue(container, "HWLAB_CODE_AGENT_CODEX_STDIO_SUPERVISOR", String(runtime.codexStdioSupervisor)) || changed;
  const workbench = runtime.workbench;
  if (typeof workbench?.emptySessionGc?.enabled === "boolean") {
    changed = setEnvValue(container, "HWLAB_WORKBENCH_EMPTY_SESSION_GC_ENABLED", String(workbench.emptySessionGc.enabled)) || changed;
  }
  const isolatedKafka = workbench?.webRuntimeConfig?.workbench?.debugCapabilities?.isolatedKafka;
  if (typeof isolatedKafka === "boolean") {
    changed = setEnvValue(container, "HWLAB_WORKBENCH_KAFKA_DEBUG_REPLAY_ENABLED", String(isolatedKafka)) || changed;
  }
  return changed;
}

function patchCloudApiKafkaEnv(container, kafka) {
  let changed = false;
  changed = setEnvValue(container, "HWLAB_KAFKA_ENABLED", String(kafka.enabled)) || changed;
  changed = setEnvValue(container, "HWLAB_KAFKA_AGENTRUN_EVENT_CONSUME_ENABLED", String(kafka.enabled && (kafka.features.directPublish || kafka.features.transactionalProjector))) || changed;
  changed = setEnvValue(container, "HWLAB_KAFKA_BOOTSTRAP_SERVERS", String(kafka.bootstrapServers)) || changed;
  changed = setEnvValue(container, "HWLAB_KAFKA_STDIO_TOPIC", String(kafka.stdioTopic)) || changed;
  changed = setEnvValue(container, "HWLAB_KAFKA_AGENTRUN_EVENT_TOPIC", String(kafka.agentRunEventTopic)) || changed;
  changed = setEnvValue(container, "HWLAB_KAFKA_EVENT_TOPIC", String(kafka.hwlabEventTopic)) || changed;
  changed = setEnvValue(container, "HWLAB_KAFKA_CLIENT_ID", String(kafka.clientId)) || changed;
  changed = setEnvValue(container, "HWLAB_KAFKA_DIRECT_PUBLISH_ENABLED", String(kafka.enabled && kafka.features.directPublish)) || changed;
  changed = setEnvValue(container, "HWLAB_WORKBENCH_LIVE_KAFKA_SSE_ENABLED", String(kafka.enabled && kafka.features.liveKafkaSse)) || changed;
  const refreshReplayEnabled = kafka.enabled && kafka.features.kafkaRefreshReplay;
  changed = setEnvValue(container, "HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_ENABLED", String(refreshReplayEnabled)) || changed;
  changed = setEnvValue(container, "HWLAB_KAFKA_TRANSACTIONAL_PROJECTOR_ENABLED", String(kafka.enabled && kafka.features.transactionalProjector)) || changed;
  changed = setEnvValue(container, "HWLAB_KAFKA_PROJECTION_OUTBOX_RELAY_ENABLED", String(kafka.enabled && kafka.features.projectionOutboxRelay)) || changed;
  changed = setEnvValue(container, "HWLAB_WORKBENCH_PROJECTION_REALTIME_ENABLED", String(kafka.enabled && kafka.features.projectionRealtime)) || changed;
  changed = setEnvValue(container, "HWLAB_KAFKA_AGENTRUN_EVENT_GROUP_ID", String(kafka.directPublishConsumerGroupId)) || changed;
  changed = setEnvValue(container, "HWLAB_KAFKA_PROJECTOR_GROUP_ID", String(kafka.transactionalProjectorConsumerGroupId)) || changed;
  changed = setEnvValue(container, "HWLAB_KAFKA_HWLAB_EVENT_GROUP_ID", String(kafka.hwlabEventConsumerGroupId)) || changed;
  changed = patchOptionalEnvGroup(container, refreshReplayEnabled, {
    HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_GROUP_PREFIX: kafka.refreshReplay?.groupIdPrefix,
    HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_TIMEOUT_MS: kafka.refreshReplay?.timeoutMs,
    HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_SCAN_LIMIT: kafka.refreshReplay?.scanLimit,
    HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_MATCHED_EVENT_LIMIT: kafka.refreshReplay?.matchedEventLimit,
    HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_LIVE_BUFFER_LIMIT: kafka.refreshReplay?.liveBufferLimit,
  }) || changed;
  const sessionIndex = kafka.refreshReplay?.sessionIndex;
  const sessionIndexConfigured = refreshReplayEnabled && typeof sessionIndex?.enabled === "boolean";
  changed = patchOptionalEnvGroup(container, sessionIndexConfigured, {
    HWLAB_WORKBENCH_KAFKA_REFRESH_INDEX_ENABLED: sessionIndex?.enabled,
    HWLAB_WORKBENCH_KAFKA_REFRESH_INDEX_MAX_EVENTS: sessionIndex?.maxEvents,
    HWLAB_WORKBENCH_KAFKA_REFRESH_INDEX_MAX_EVENTS_PER_SESSION: sessionIndex?.maxEventsPerSession,
    HWLAB_WORKBENCH_KAFKA_REFRESH_INDEX_BOOTSTRAP_TIMEOUT_MS: sessionIndex?.bootstrapTimeoutMs,
    HWLAB_WORKBENCH_KAFKA_REFRESH_INDEX_REBUILD_INTERVAL_MS: sessionIndex?.rebuildIntervalMs,
    HWLAB_WORKBENCH_KAFKA_REFRESH_INDEX_REBUILD_COOLDOWN_MS: sessionIndex?.rebuildCooldownMs,
  }) || changed;
  changed = removeEnvValues(container, [
    "HWLAB_KAFKA_PROJECTOR_HEARTBEAT_INTERVAL_MS",
    "HWLAB_KAFKA_OUTBOX_RELAY_INTERVAL_MS",
    "HWLAB_KAFKA_OUTBOX_RELAY_BATCH_SIZE",
    "HWLAB_KAFKA_OUTBOX_RELAY_LEASE_MS",
    "HWLAB_KAFKA_OUTBOX_RELAY_SEND_TIMEOUT_MS",
    "HWLAB_KAFKA_OUTBOX_RELAY_RETRY_BACKOFF_MS",
    "HWLAB_WORKBENCH_OUTBOX_TAIL_BATCH_SIZE",
    "HWLAB_WORKBENCH_SSE_HEARTBEAT_MS",
    "HWLAB_WORKBENCH_SSE_DRAIN_TIMEOUT_MS",
  ]) || changed;
  return changed;
}

function patchCloudWebKafkaEnv(container, kafka) {
  let changed = false;
  changed = setEnvValue(container, "HWLAB_WORKBENCH_LIVE_KAFKA_SSE_ENABLED", String(kafka.enabled && kafka.features.liveKafkaSse)) || changed;
  changed = setEnvValue(container, "HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_ENABLED", String(kafka.enabled && kafka.features.kafkaRefreshReplay)) || changed;
  changed = setEnvValue(container, "HWLAB_WORKBENCH_PROJECTION_REALTIME_ENABLED", String(kafka.enabled && kafka.features.projectionRealtime)) || changed;
  return changed;
}

function patchCloudWebRuntimeEnv(container, webRuntimeConfig) {
  if (!webRuntimeConfig) return false;
  let changed = false;
  const displayTime = webRuntimeConfig.displayTime;
  const workbench = webRuntimeConfig.workbench;
  const debug = workbench?.debugCapabilities;
  const rawEvents = debug?.rawHwlabEventWindow;
  const traceTimeline = workbench?.traceTimeline;
  if (displayTime) {
    changed = setEnvValue(container, "HWLAB_CLOUD_WEB_DISPLAY_TIME_ZONE", String(displayTime.timeZone)) || changed;
    changed = setEnvValue(container, "HWLAB_CLOUD_WEB_DISPLAY_TIME_LOCALE", String(displayTime.locale)) || changed;
    changed = setEnvValue(container, "HWLAB_CLOUD_WEB_DISPLAY_TIME_LABEL", String(displayTime.label)) || changed;
  }
  if (typeof debug?.isolatedKafka === "boolean") {
    changed = setEnvValue(container, "HWLAB_WORKBENCH_KAFKA_DEBUG_REPLAY_ENABLED", String(debug.isolatedKafka)) || changed;
  }
  if (rawEvents) {
    changed = setEnvValue(container, "HWLAB_WORKBENCH_RAW_HWLAB_EVENT_WINDOW_ENABLED", String(rawEvents.enabled)) || changed;
    changed = setEnvValue(container, "HWLAB_WORKBENCH_RAW_HWLAB_EVENT_WINDOW_MAX_ENTRIES", String(rawEvents.maxEntries)) || changed;
    changed = setEnvValue(container, "HWLAB_WORKBENCH_RAW_HWLAB_EVENT_WINDOW_MAX_RETAINED_BYTES", String(rawEvents.maxRetainedBytes)) || changed;
  }
  if (traceTimeline) {
    changed = setEnvValue(container, "HWLAB_WORKBENCH_TRACE_AUTO_EXPAND_RUNNING", String(traceTimeline.autoExpandRunning)) || changed;
    changed = setEnvValue(container, "HWLAB_WORKBENCH_TRACE_AUTO_COLLAPSE_TERMINAL", String(traceTimeline.autoCollapseTerminal)) || changed;
  }
  return changed;
}

function patchOptionalEnvGroup(container, enabled, values) {
  let changed = false;
  for (const [name, value] of Object.entries(values)) {
    changed = enabled ? setEnvValue(container, name, String(value)) || changed : removeEnvValue(container, name) || changed;
  }
  return changed;
}

function removeEnvValues(container, names) {
  const next = container.env.filter((item) => !names.includes(item?.name));
  if (next.length === container.env.length) return false;
  container.env = next;
  return true;
}

function setEnvValue(container, name, value) {
  const existing = container.env.find((item) => item?.name === name);
  if (existing?.value === value && existing.valueFrom === undefined) return false;
  if (existing) {
    existing.value = value;
    delete existing.valueFrom;
  } else {
    container.env.push({ name, value });
  }
  return true;
}

function setEnvFromSecret(container, name, secretName, secretKey) {
  const existing = container.env.find((item) => item?.name === name);
  const secretKeyRef = existing?.valueFrom?.secretKeyRef;
  if (existing?.value === undefined && secretKeyRef?.name === secretName && secretKeyRef?.key === secretKey) return false;
  const valueFrom = { secretKeyRef: { name: secretName, key: secretKey } };
  if (existing) {
    delete existing.value;
    existing.valueFrom = valueFrom;
  } else {
    container.env.push({ name, valueFrom });
  }
  return true;
}

function removeEnvValue(container, name) {
  const next = container.env.filter((item) => item?.name !== name);
  if (next.length === container.env.length) return false;
  container.env = next;
  return true;
}

function stripPrometheusOperatorResourcesFromFile(file) {
  const original = readFileSync(file, "utf8");
  const jsonResult = stripPrometheusOperatorResourcesFromJsonFile(file, original);
  if (jsonResult !== null) return jsonResult;
  const docs = splitYamlDocuments(original);
  const nextDocs = docs.filter((doc) => !isPrometheusOperatorDocument(doc));
  if (nextDocs.length === docs.length) return "unchanged";
  if (nextDocs.length === 0) {
    unlinkSync(file);
    return "deleted";
  }
  writeFileSync(file, `${nextDocs.map((doc) => doc.trimEnd()).join("\n---\n")}\n`, "utf8");
  return "changed";
}

function stripPrometheusOperatorResourcesFromJsonFile(file, text) {
  const parsed = parseJsonDocument(text);
  if (parsed === null) return null;
  const next = stripPrometheusOperatorResourcesFromJsonValue(parsed);
  if (!next.changed) return "unchanged";
  if (next.value === null) {
    unlinkSync(file);
    return "deleted";
  }
  writeFileSync(file, `${JSON.stringify(next.value, null, 2)}\n`, "utf8");
  return "changed";
}

function stripPrometheusOperatorResourcesFromJsonValue(value) {
  if (isPrometheusOperatorResource(value)) return { changed: true, value: null };
  if (isKubernetesList(value)) {
    const originalItems = Array.isArray(value.items) ? value.items : [];
    const items = originalItems.filter((item) => !isPrometheusOperatorResource(item));
    if (items.length !== originalItems.length) return { changed: true, value: { ...value, items } };
  }
  return { changed: false, value };
}

function reconcileKustomizationResources() {
  const file = path.join(runtimeDir, "kustomization.yaml");
  if (!existsSync(file)) return false;
  const document = YAML.parse(readFileSync(file, "utf8")) ?? {};
  const resources = Array.isArray(document.resources) ? document.resources.map(String) : [];
  const exposureMode = overlay?.publicExposure?.enabled ? overlay.publicExposure.mode : null;
  const next = resources.filter((resource) => {
    if (resource === "node-frpc.yaml" && exposureMode !== "pk01-caddy-frp") return false;
    if (resource === "node-public-service.yaml" && exposureMode !== "node-port-shared-edge") return false;
    return !/\.ya?ml$/u.test(resource) || existsSync(path.resolve(runtimeDir, resource));
  });
  if (exposureMode === "node-port-shared-edge" && !next.includes("node-public-service.yaml")) {
    next.push("node-public-service.yaml");
  }
  if (JSON.stringify(next) === JSON.stringify(resources)) return false;
  document.resources = next;
  writeFileSync(file, YAML.stringify(document), "utf8");
  return true;
}

function splitYamlDocuments(text) {
  return text.split(/^---[ \t]*(?:#.*)?$/mu).map((doc) => doc.trim()).filter(Boolean);
}

function isPrometheusOperatorDocument(text) {
  const api = text.match(/^\s*apiVersion:\s*["']?(monitoring\.coreos\.com\/[^"'\s#]+)["']?\s*(?:#.*)?$/mu);
  const kind = text.match(/^\s*kind:\s*["']?([^"'\s#]+)["']?\s*(?:#.*)?$/mu);
  return Boolean(api && kind && prometheusOperatorKinds.has(kind[1]));
}

function isPrometheusOperatorResource(value) {
  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
  return typeof value.apiVersion === "string"
    && value.apiVersion.startsWith("monitoring.coreos.com/")
    && typeof value.kind === "string"
    && prometheusOperatorKinds.has(value.kind);
}

function isKubernetesList(value) {
  return value
    && typeof value === "object"
    && !Array.isArray(value)
    && value.apiVersion === "v1"
    && value.kind === "List"
    && Array.isArray(value.items);
}

function parseJsonDocument(text) {
  const trimmed = text.trim();
  if (!trimmed.startsWith("{") && !trimmed.startsWith("[")) return null;
  try {
    return JSON.parse(trimmed);
  } catch {
    return null;
  }
}

function parseStructuredDocuments(text, file) {
  const json = parseJsonDocument(text);
  if (json !== null) return { format: "json", values: [json] };
  const documents = YAML.parseAllDocuments(text);
  const errors = documents.flatMap((document) => document.errors);
  if (errors.length > 0) throw new Error(`invalid YAML in ${file}: ${errors.map((error) => error.message).join("; ")}`);
  return { format: "yaml", values: documents.map((document) => document.toJS()).filter((document) => document !== null) };
}

function serializeStructuredDocuments(documents) {
  if (documents.format === "json") return `${JSON.stringify(documents.values[0], null, 2)}\n`;
  return `${documents.values.map((document) => YAML.stringify(document).trimEnd()).join("\n---\n")}\n`;
}

function listYamlFiles(root) {
  const out = [];
  for (const name of readdirSync(root)) {
    const file = path.join(root, name);
    const stat = statSync(file);
    if (stat.isDirectory()) {
      out.push(...listYamlFiles(file));
    } else if (/\.(ya?ml)$/u.test(name)) {
      out.push(file);
    }
  }
  return out.sort();
}

function readOverlay() {
  const file = process.env.UNIDESK_RUNTIME_GITOPS_OVERLAY_FILE;
  if (file) return JSON.parse(readFileSync(file, "utf8"));
  const encoded = process.env.UNIDESK_RUNTIME_GITOPS_OVERLAY_B64;
  if (!encoded) throw new Error("UNIDESK_RUNTIME_GITOPS_OVERLAY_FILE or UNIDESK_RUNTIME_GITOPS_OVERLAY_B64 is required");
  return JSON.parse(Buffer.from(encoded, "base64").toString("utf8"));
}

function requireYaml() {
  try {
    return requireFromScript("yaml");
  } catch {
    return requireFromCwd("yaml");
  }
}

function requiredOverlayString(name) {
  const value = overlay[name];
  if (typeof value !== "string" || value.length === 0) throw new Error(`overlay.${name} is required`);
  return value;
}

function emit(fields) {
  console.error(JSON.stringify({ event: "unidesk-runtime-gitops-postprocess", ...fields }));
}