+ Press n or j to go to the next uncovered block, b, p or k for the previous block. +
+ +| File | ++ | Statements | ++ | Branches | ++ | Functions | ++ | Lines | ++ |
|---|---|---|---|---|---|---|---|---|---|
| src | +
+
+ |
+ 92.94% | +79/85 | +74.07% | +80/108 | +100% | +5/5 | +95.94% | +71/74 | +
| src/server | +
+
+ |
+ 40.43% | +243/601 | +38.46% | +200/520 | +33.78% | +25/74 | +39.51% | +213/539 | +
+ Press n or j to go to the next uncovered block, b, p or k for the previous block. +
+ +| File | ++ | Statements | ++ | Branches | ++ | Functions | ++ | Lines | ++ |
|---|---|---|---|---|---|---|---|---|---|
| ui-parser.ts | +
+
+ |
+ 92.94% | +79/85 | +74.07% | +80/108 | +100% | +5/5 | +95.94% | +71/74 | +
+ Press n or j to go to the next uncovered block, b, p or k for the previous block. +
+ +| 1 +2 +3 +4 +5 +6 +7 +8 +9 +10 +11 +12 +13 +14 +15 +16 +17 +18 +19 +20 +21 +22 +23 +24 +25 +26 +27 +28 +29 +30 +31 +32 +33 +34 +35 +36 +37 +38 +39 +40 +41 +42 +43 +44 +45 +46 +47 +48 +49 +50 +51 +52 +53 +54 +55 +56 +57 +58 +59 +60 +61 +62 +63 +64 +65 +66 +67 +68 +69 +70 +71 +72 +73 +74 +75 +76 +77 +78 +79 +80 +81 +82 +83 +84 +85 +86 +87 +88 +89 +90 +91 +92 +93 +94 +95 +96 +97 +98 +99 +100 +101 +102 +103 +104 +105 +106 +107 +108 +109 +110 +111 +112 +113 +114 +115 +116 +117 +118 +119 +120 +121 +122 +123 +124 +125 +126 +127 +128 +129 +130 +131 +132 +133 +134 +135 +136 +137 +138 +139 +140 +141 +142 +143 +144 +145 +146 +147 +148 +149 +150 +151 +152 +153 +154 +155 +156 +157 +158 +159 +160 +161 +162 +163 +164 +165 +166 +167 +168 +169 +170 +171 +172 +173 +174 +175 +176 +177 +178 +179 +180 +181 +182 +183 +184 +185 +186 +187 +188 +189 +190 +191 +192 +193 +194 +195 +196 +197 +198 +199 +200 +201 +202 +203 +204 +205 +206 +207 +208 +209 +210 +211 +212 +213 +214 +215 +216 +217 +218 +219 +220 +221 +222 +223 +224 +225 +226 +227 +228 +229 +230 +231 +232 +233 +234 +235 +236 +237 +238 +239 +240 +241 +242 +243 +244 +245 +246 +247 +248 +249 +250 +251 +252 +253 +254 +255 +256 +257 +258 +259 +260 +261 +262 +263 +264 +265 +266 +267 +268 +269 +270 +271 +272 +273 +274 +275 +276 +277 +278 +279 +280 +281 +282 +283 +284 +285 +286 +287 +288 +289 +290 +291 +292 +293 +294 +295 +296 +297 +298 +299 +300 +301 +302 +303 +304 +305 +306 +307 +308 +309 +310 +311 +312 +313 +314 +315 +316 +317 +318 +319 +320 +321 +322 +323 +324 +325 +326 +327 +328 +329 +330 +331 +332 +333 +334 +335 +336 +337 +338 +339 +340 +341 +342 +343 +344 +345 +346 +347 +348 +349 +350 +351 +352 +353 +354 +355 +356 +357 +358 +359 +360 +361 +362 +363 +364 +365 +366 +367 +368 +369 +370 +371 +372 +373 +374 +375 +376 +377 +378 +379 +380 +381 +382 +383 +384 +385 +386 +387 +388 +389 +390 +391 +392 +393 +394 +395 +396 +397 +398 +399 +400 +401 +402 +403 +404 +405 +406 +407 +408 +409 +410 +411 +412 +413 +414 +415 +416 +417 +418 +419 +420 +421 +422 +423 +424 +425 +426 +427 +428 +429 +430 +431 +432 +433 +434 +435 +436 +437 +438 +439 +440 +441 +442 +443 +444 +445 +446 +447 +448 +449 +450 +451 +452 +453 +454 +455 +456 +457 +458 +459 +460 +461 +462 +463 +464 +465 +466 +467 +468 +469 +470 +471 +472 +473 +474 +475 +476 +477 +478 +479 +480 +481 +482 +483 +484 +485 +486 +487 +488 +489 +490 | + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + | import type { AdapterExecutionContext, AdapterExecutionResult } from "@paperclipai/adapter-utils";
+import { asString, asNumber, asBoolean, parseObject } from "@paperclipai/adapter-utils/server-utils";
+import {
+ parseClaudeStreamJson,
+ describeClaudeFailure,
+ isClaudeMaxTurnsResult,
+ isClaudeUnknownSessionError,
+} from "./parse.js";
+import { getSelfPodInfo, getBatchApi, getCoreApi, getLogApi } from "./k8s-client.js";
+import { buildJobManifest } from "./job-manifest.js";
+import type * as k8s from "@kubernetes/client-node";
+import { Writable } from "node:stream";
+
+const POLL_INTERVAL_MS = 2000;
+
+/**
+ * Wait for the Job's pod to reach a terminal or running state.
+ * Returns the pod name once logs can be streamed, or throws on failure.
+ */
+async function waitForPod(
+ namespace: string,
+ jobName: string,
+ timeoutMs: number,
+ onLog: AdapterExecutionContext["onLog"],
+ kubeconfigPath?: string,
+): Promise<string> {
+ const coreApi = getCoreApi(kubeconfigPath);
+ const deadline = Date.now() + timeoutMs;
+ const labelSelector = `job-name=${jobName}`;
+
+ await onLog("stdout", `[paperclip] Waiting for pod to be scheduled (job: ${jobName})...\n`);
+
+ let lastStatus = "";
+ while (Date.now() < deadline) {
+ const podList = await coreApi.listNamespacedPod({
+ namespace,
+ labelSelector,
+ });
+ const pod = podList.items[0];
+
+ if (!pod) {
+ if (lastStatus !== "no-pod") {
+ await onLog("stdout", `[paperclip] Waiting for Job controller to create pod...\n`);
+ lastStatus = "no-pod";
+ }
+ await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
+ continue;
+ }
+
+ const podName = pod.metadata?.name ?? "unknown";
+ const phase = pod.status?.phase ?? "Unknown";
+ const initStatuses = pod.status?.initContainerStatuses ?? [];
+ const containerStatuses = pod.status?.containerStatuses ?? [];
+
+ // Log phase transitions
+ const statusKey = `${phase}:${initStatuses.map((s) => s.state?.waiting?.reason ?? s.state?.terminated?.reason ?? "ok").join(",")}:${containerStatuses.map((s) => s.state?.waiting?.reason ?? s.state?.running ? "running" : "waiting").join(",")}`;
+ if (statusKey !== lastStatus) {
+ const details: string[] = [`phase=${phase}`];
+ for (const init of initStatuses) {
+ if (init.state?.waiting) details.push(`init/${init.name}: waiting (${init.state.waiting.reason ?? "unknown"})`);
+ else if (init.state?.running) details.push(`init/${init.name}: running`);
+ else if (init.state?.terminated) details.push(`init/${init.name}: done (exit ${init.state.terminated.exitCode})`);
+ }
+ for (const cs of containerStatuses) {
+ if (cs.state?.waiting) details.push(`${cs.name}: waiting (${cs.state.waiting.reason ?? "unknown"})`);
+ else if (cs.state?.running) details.push(`${cs.name}: running`);
+ }
+ await onLog("stdout", `[paperclip] Pod ${podName}: ${details.join(", ")}\n`);
+ lastStatus = statusKey;
+ }
+
+ // Ready to stream logs
+ if (phase === "Running" || phase === "Succeeded" || phase === "Failed") {
+ return podName;
+ }
+
+ // Init containers done + main running (phase may still say Pending briefly)
+ const allInitsDone = initStatuses.length > 0 && initStatuses.every(
+ (s) => s.state?.terminated?.exitCode === 0,
+ );
+ const mainRunning = containerStatuses.some((s) => s.state?.running);
+ if (allInitsDone && mainRunning) {
+ return podName;
+ }
+
+ // Check for init container failures
+ for (const init of initStatuses) {
+ const terminated = init.state?.terminated;
+ if (terminated && (terminated.exitCode ?? 0) !== 0) {
+ throw new Error(`Init container "${init.name}" failed with exit code ${terminated.exitCode}: ${terminated.reason ?? terminated.message ?? "unknown"}`);
+ }
+ const waiting = init.state?.waiting;
+ if (waiting?.reason === "ErrImagePull" || waiting?.reason === "ImagePullBackOff") {
+ throw new Error(`Init container "${init.name}" image pull failed: ${waiting.message ?? waiting.reason}`);
+ }
+ if (waiting?.reason === "CrashLoopBackOff") {
+ throw new Error(`Init container "${init.name}" crash loop: ${waiting.message ?? waiting.reason}`);
+ }
+ }
+
+ // Check for unrecoverable scheduling failures
+ const conditions = pod.status?.conditions ?? [];
+ const unschedulable = conditions.find(
+ (c) => c.type === "PodScheduled" && c.status === "False" && c.reason === "Unschedulable",
+ );
+ if (unschedulable) {
+ throw new Error(`Pod unschedulable: ${unschedulable.message ?? "insufficient resources"}`);
+ }
+
+ // Check for main container image pull errors
+ for (const cs of containerStatuses) {
+ const waiting = cs.state?.waiting;
+ if (waiting?.reason === "ErrImagePull" || waiting?.reason === "ImagePullBackOff") {
+ throw new Error(`Image pull failed for "${cs.name}": ${waiting.message ?? waiting.reason}`);
+ }
+ if (waiting?.reason === "CrashLoopBackOff") {
+ throw new Error(`Container "${cs.name}" crash loop: ${waiting.message ?? waiting.reason}`);
+ }
+ }
+
+ await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
+ }
+
+ throw new Error(`Timed out waiting for pod to be scheduled (${Math.round(timeoutMs / 1000)}s)`);
+}
+
+/**
+ * Stream pod logs and accumulate stdout for result parsing.
+ * Returns accumulated stdout when the stream ends.
+ */
+async function streamPodLogs(
+ namespace: string,
+ podName: string,
+ onLog: AdapterExecutionContext["onLog"],
+ kubeconfigPath?: string,
+): Promise<string> {
+ const logApi = getLogApi(kubeconfigPath);
+ const chunks: string[] = [];
+
+ const writable = new Writable({
+ write(chunk: Buffer, _encoding, callback) {
+ const text = chunk.toString("utf-8");
+ chunks.push(text);
+ void onLog("stdout", text).then(() => callback(), callback);
+ },
+ });
+
+ try {
+ await logApi.log(namespace, podName, "claude", writable, {
+ follow: true,
+ pretty: false,
+ });
+ } catch {
+ // follow may fail if the container already exited — not fatal,
+ // we'll try a one-shot read below
+ }
+
+ return chunks.join("");
+}
+
+/**
+ * One-shot read of pod logs (no follow). Used as fallback when the
+ * follow stream missed output because the container exited quickly.
+ */
+async function readPodLogs(
+ namespace: string,
+ podName: string,
+ kubeconfigPath?: string,
+): Promise<string> {
+ const coreApi = getCoreApi(kubeconfigPath);
+ try {
+ const log = await coreApi.readNamespacedPodLog({
+ name: podName,
+ namespace,
+ container: "claude",
+ });
+ return typeof log === "string" ? log : "";
+ } catch {
+ return "";
+ }
+}
+
+/**
+ * Wait for the Job to reach a terminal state (Complete or Failed).
+ * Returns the Job's final status.
+ */
+async function waitForJobCompletion(
+ namespace: string,
+ jobName: string,
+ timeoutMs: number,
+ kubeconfigPath?: string,
+): Promise<{ succeeded: boolean; timedOut: boolean }> {
+ const batchApi = getBatchApi(kubeconfigPath);
+ const deadline = timeoutMs > 0 ? Date.now() + timeoutMs : 0;
+
+ while (deadline === 0 || Date.now() < deadline) {
+ const job = await batchApi.readNamespacedJob({ name: jobName, namespace });
+ const conditions = job.status?.conditions ?? [];
+
+ const complete = conditions.find((c) => c.type === "Complete" && c.status === "True");
+ if (complete) return { succeeded: true, timedOut: false };
+
+ const failed = conditions.find((c) => c.type === "Failed" && c.status === "True");
+ if (failed) {
+ const isDeadlineExceeded = failed.reason === "DeadlineExceeded";
+ return { succeeded: false, timedOut: isDeadlineExceeded };
+ }
+
+ await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
+ }
+
+ return { succeeded: false, timedOut: true };
+}
+
+/**
+ * Get the exit code from the Job's pod.
+ */
+async function getPodExitCode(namespace: string, jobName: string, kubeconfigPath?: string): Promise<number | null> {
+ const coreApi = getCoreApi(kubeconfigPath);
+ const podList = await coreApi.listNamespacedPod({
+ namespace,
+ labelSelector: `job-name=${jobName}`,
+ });
+ const pod = podList.items[0];
+ if (!pod) return null;
+
+ const containerStatus = pod.status?.containerStatuses?.find((s) => s.name === "claude");
+ return containerStatus?.state?.terminated?.exitCode ?? null;
+}
+
+/**
+ * Delete Job and its pods. Best-effort — failures are logged but not thrown.
+ */
+async function cleanupJob(
+ namespace: string,
+ jobName: string,
+ onLog: AdapterExecutionContext["onLog"],
+ kubeconfigPath?: string,
+): Promise<void> {
+ try {
+ const batchApi = getBatchApi(kubeconfigPath);
+ await batchApi.deleteNamespacedJob({
+ name: jobName,
+ namespace,
+ body: { propagationPolicy: "Background" },
+ });
+ } catch (err) {
+ const msg = err instanceof Error ? err.message : String(err);
+ await onLog("stderr", `[paperclip] Warning: failed to cleanup job ${jobName}: ${msg}\n`);
+ }
+}
+
+export async function execute(ctx: AdapterExecutionContext): Promise<AdapterExecutionResult> {
+ const { runId, runtime, config: rawConfig, onLog, onMeta } = ctx;
+ const config = parseObject(rawConfig);
+ const timeoutSec = asNumber(config.timeoutSec, 0);
+ const graceSec = asNumber(config.graceSec, 60);
+ const retainJobs = asBoolean(config.retainJobs, false);
+ const kubeconfigPath = asString(config.kubeconfig, "") || undefined;
+
+ // Guard: claude_k8s must not run concurrently for the same agent (shared PVC/session)
+ const agentId = ctx.agent.id;
+ const selfPod = await getSelfPodInfo(kubeconfigPath);
+ const guardNamespace = asString(config.namespace, "") || selfPod.namespace;
+ try {
+ const batchApi = getBatchApi(kubeconfigPath);
+ const existing = await batchApi.listNamespacedJob({
+ namespace: guardNamespace,
+ labelSelector: `paperclip.io/agent-id=${agentId},paperclip.io/adapter-type=claude_k8s`,
+ });
+ const running = existing.items.filter(
+ (j) => !j.status?.conditions?.some((c) => (c.type === "Complete" || c.type === "Failed") && c.status === "True"),
+ );
+ if (running.length > 0) {
+ const names = running.map((j) => j.metadata?.name).join(", ");
+ await onLog("stderr", `[paperclip] Concurrent run blocked: existing Job(s) still running for this agent: ${names}\n`);
+ return {
+ exitCode: null,
+ signal: null,
+ timedOut: false,
+ errorMessage: `Concurrent run blocked: Job ${names} is still running for this agent`,
+ errorCode: "k8s_concurrent_run_blocked",
+ };
+ }
+ } catch {
+ // If we can't check, proceed — the heartbeat service enforces concurrency too
+ }
+
+ // Build Job manifest
+ const { job, jobName, namespace, prompt, claudeArgs, promptMetrics } = buildJobManifest({
+ ctx,
+ selfPod,
+ });
+
+ // Report invocation metadata
+ if (onMeta) {
+ await onMeta({
+ adapterType: "claude_k8s",
+ command: `kubectl job/${jobName}`,
+ cwd: namespace,
+ commandArgs: claudeArgs,
+ commandNotes: [
+ `Image: ${job.spec?.template.spec?.containers[0]?.image ?? "unknown"}`,
+ `Namespace: ${namespace}`,
+ `Timeout: ${timeoutSec}s`,
+ ],
+ prompt,
+ ...(promptMetrics ? { promptMetrics } : {}),
+ context: ctx.context,
+ } as Parameters<typeof onMeta>[0]);
+ }
+
+ // Create the Job
+ const batchApi = getBatchApi(kubeconfigPath);
+ try {
+ await batchApi.createNamespacedJob({ namespace, body: job });
+ } catch (err) {
+ const msg = err instanceof Error ? err.message : String(err);
+ await onLog("stderr", `[paperclip] Failed to create K8s Job: ${msg}\n`);
+ return {
+ exitCode: null,
+ signal: null,
+ timedOut: false,
+ errorMessage: `Failed to create Kubernetes Job: ${msg}`,
+ errorCode: "k8s_job_create_failed",
+ };
+ }
+
+ await onLog("stdout", `[paperclip] Created K8s Job: ${jobName} in namespace ${namespace} (deadline: ${timeoutSec > 0 ? `${timeoutSec}s` : "none"})\n`);
+
+ let stdout = "";
+ let exitCode: number | null = null;
+ let jobTimedOut = false;
+
+ try {
+ // Wait for pod to be ready for log streaming
+ const scheduleTimeoutMs = 120_000; // 2 minutes for scheduling
+ let podName: string;
+ try {
+ podName = await waitForPod(namespace, jobName, scheduleTimeoutMs, onLog, kubeconfigPath);
+ await onLog("stdout", `[paperclip] Pod running: ${podName}\n`);
+ } catch (err) {
+ const msg = err instanceof Error ? err.message : String(err);
+ await onLog("stderr", `[paperclip] Pod scheduling failed: ${msg}\n`);
+ return {
+ exitCode: null,
+ signal: null,
+ timedOut: false,
+ errorMessage: `Pod scheduling failed: ${msg}`,
+ errorCode: "k8s_pod_schedule_failed",
+ };
+ }
+
+ // Stream logs and wait for completion concurrently.
+ // The log stream will end when the container exits.
+ // We also poll the Job status to detect deadline exceeded.
+ // 0 = no timeout (run indefinitely, matching claude_local behavior)
+ const completionTimeoutMs = timeoutSec > 0 ? (timeoutSec + graceSec) * 1000 : 0;
+
+ const [logResult, completionResult] = await Promise.allSettled([
+ streamPodLogs(namespace, podName, onLog, kubeconfigPath),
+ waitForJobCompletion(namespace, jobName, completionTimeoutMs, kubeconfigPath),
+ ]);
+
+ if (logResult.status === "fulfilled") {
+ stdout = logResult.value;
+ }
+
+ // If the follow stream missed output (container exited quickly), do a
+ // one-shot log read as fallback before the pod is cleaned up.
+ if (!stdout.trim()) {
+ await onLog("stdout", `[paperclip] Log stream returned empty — reading pod logs directly...\n`);
+ stdout = await readPodLogs(namespace, podName, kubeconfigPath);
+ if (stdout.trim()) {
+ await onLog("stdout", stdout);
+ }
+ }
+
+ if (completionResult.status === "fulfilled") {
+ jobTimedOut = completionResult.value.timedOut;
+ } else {
+ jobTimedOut = true;
+ }
+
+ exitCode = await getPodExitCode(namespace, jobName, kubeconfigPath);
+ } finally {
+ if (!retainJobs) {
+ await cleanupJob(namespace, jobName, onLog, kubeconfigPath);
+ } else {
+ await onLog("stdout", `[paperclip] Retaining job ${jobName} for debugging (retainJobs=true)\n`);
+ }
+ }
+
+ // Parse Claude output (reuse claude_local parsing)
+ if (jobTimedOut) {
+ return {
+ exitCode,
+ signal: null,
+ timedOut: true,
+ errorMessage: `Timed out after ${timeoutSec}s`,
+ errorCode: "timeout",
+ };
+ }
+
+ const parsedStream = parseClaudeStreamJson(stdout);
+ const parsed = parsedStream.resultJson;
+
+ // If the session was stale, clear it so the next heartbeat starts fresh
+ if (parsed && (exitCode ?? 0) !== 0 && isClaudeUnknownSessionError(parsed)) {
+ await onLog("stdout", `[paperclip] Claude session is unavailable; clearing for next run.\n`);
+ return {
+ exitCode,
+ signal: null,
+ timedOut: false,
+ errorMessage: describeClaudeFailure(parsed) ?? "Session unavailable",
+ errorCode: "session_unavailable",
+ clearSession: true,
+ resultJson: parsed,
+ };
+ }
+
+ if (!parsed) {
+ const stderrLine = stdout.split(/\r?\n/).map((l) => l.trim()).find(Boolean) ?? "";
+ return {
+ exitCode,
+ signal: null,
+ timedOut: false,
+ errorMessage: exitCode === 0
+ ? "Failed to parse Claude JSON output"
+ : stderrLine
+ ? `Claude exited with code ${exitCode ?? -1}: ${stderrLine}`
+ : `Claude exited with code ${exitCode ?? -1}`,
+ resultJson: { stdout },
+ };
+ }
+
+ const usage = parsedStream.usage ?? (() => {
+ const usageObj = parseObject(parsed.usage as Record<string, unknown>);
+ return {
+ inputTokens: asNumber(usageObj.input_tokens, 0),
+ cachedInputTokens: asNumber(usageObj.cache_read_input_tokens, 0),
+ outputTokens: asNumber(usageObj.output_tokens, 0),
+ };
+ })();
+
+ const runtimeSessionParams = parseObject(runtime.sessionParams);
+ const fallbackSessionId = asString(runtimeSessionParams.sessionId, runtime.sessionId ?? "");
+ const resolvedSessionId = parsedStream.sessionId
+ ?? (asString(parsed.session_id as string, fallbackSessionId) || fallbackSessionId);
+ const model = asString(config.model, "");
+ const workspaceContext = parseObject(ctx.context.paperclipWorkspace);
+ const workspaceId = asString(workspaceContext.workspaceId, "") || null;
+ const workspaceRepoUrl = asString(workspaceContext.repoUrl, "") || null;
+ const workspaceRepoRef = asString(workspaceContext.repoRef, "") || null;
+ const cwd = asString(workspaceContext.cwd, "");
+
+ const resolvedSessionParams = resolvedSessionId
+ ? {
+ sessionId: resolvedSessionId,
+ ...(cwd ? { cwd } : {}),
+ ...(workspaceId ? { workspaceId } : {}),
+ ...(workspaceRepoUrl ? { repoUrl: workspaceRepoUrl } : {}),
+ ...(workspaceRepoRef ? { repoRef: workspaceRepoRef } : {}),
+ } as Record<string, unknown>
+ : null;
+
+ const clearSessionForMaxTurns = isClaudeMaxTurnsResult(parsed);
+
+ return {
+ exitCode,
+ signal: null,
+ timedOut: false,
+ errorMessage:
+ (exitCode ?? 0) === 0
+ ? null
+ : describeClaudeFailure(parsed) ?? `Claude exited with code ${exitCode ?? -1}`,
+ usage,
+ sessionId: resolvedSessionId || null,
+ sessionParams: resolvedSessionParams,
+ sessionDisplayId: resolvedSessionId || null,
+ provider: "anthropic",
+ model: parsedStream.model || asString(parsed.model as string, model),
+ billingType: "api",
+ costUsd: parsedStream.costUsd ?? asNumber(parsed.total_cost_usd, 0),
+ resultJson: parsed,
+ summary: parsedStream.summary || asString(parsed.result as string, ""),
+ clearSession: clearSessionForMaxTurns,
+ } as AdapterExecutionResult;
+}
+ |
+ Press n or j to go to the next uncovered block, b, p or k for the previous block. +
+ +| File | ++ | Statements | ++ | Branches | ++ | Functions | ++ | Lines | ++ |
|---|---|---|---|---|---|---|---|---|---|
| execute.ts | +
+
+ |
+ 0% | +0/198 | +0% | +0/201 | +0% | +0/25 | +0% | +0/178 | +
| index.ts | +
+
+ |
+ 0% | +0/1 | +100% | +0/0 | +0% | +0/1 | +0% | +0/1 | +
| job-manifest.ts | +
+
+ |
+ 84.45% | +125/148 | +66.07% | +74/112 | +90.9% | +10/11 | +84.73% | +111/131 | +
| k8s-client.ts | +
+
+ |
+ 0% | +0/60 | +0% | +0/32 | +0% | +0/13 | +0% | +0/56 | +
| parse.ts | +
+
+ |
+ 91.08% | +92/101 | +78.4% | +69/88 | +100% | +11/11 | +91.01% | +81/89 | +
| session.ts | +
+
+ |
+ 100% | +26/26 | +100% | +57/57 | +100% | +4/4 | +100% | +21/21 | +
| test.ts | +
+
+ |
+ 0% | +0/67 | +0% | +0/30 | +0% | +0/9 | +0% | +0/63 | +
+ Press n or j to go to the next uncovered block, b, p or k for the previous block. +
+ +| 1 +2 +3 +4 +5 +6 +7 +8 +9 +10 +11 +12 +13 +14 +15 +16 +17 +18 +19 +20 | + + + + + + + + + + + + + + + + + + + | import type { ServerAdapterModule } from "@paperclipai/adapter-utils";
+import { type, models, agentConfigurationDoc } from "../index.js";
+import { execute } from "./execute.js";
+import { testEnvironment } from "./test.js";
+import { sessionCodec } from "./session.js";
+
+export function createServerAdapter(): ServerAdapterModule {
+ return {
+ type,
+ execute,
+ testEnvironment,
+ sessionCodec,
+ models,
+ supportsLocalAgentJwt: true,
+ agentConfigurationDoc,
+ };
+}
+
+export { execute, testEnvironment, sessionCodec };
+ |
+ Press n or j to go to the next uncovered block, b, p or k for the previous block. +
+ +| 1 +2 +3 +4 +5 +6 +7 +8 +9 +10 +11 +12 +13 +14 +15 +16 +17 +18 +19 +20 +21 +22 +23 +24 +25 +26 +27 +28 +29 +30 +31 +32 +33 +34 +35 +36 +37 +38 +39 +40 +41 +42 +43 +44 +45 +46 +47 +48 +49 +50 +51 +52 +53 +54 +55 +56 +57 +58 +59 +60 +61 +62 +63 +64 +65 +66 +67 +68 +69 +70 +71 +72 +73 +74 +75 +76 +77 +78 +79 +80 +81 +82 +83 +84 +85 +86 +87 +88 +89 +90 +91 +92 +93 +94 +95 +96 +97 +98 +99 +100 +101 +102 +103 +104 +105 +106 +107 +108 +109 +110 +111 +112 +113 +114 +115 +116 +117 +118 +119 +120 +121 +122 +123 +124 +125 +126 +127 +128 +129 +130 +131 +132 +133 +134 +135 +136 +137 +138 +139 +140 +141 +142 +143 +144 +145 +146 +147 +148 +149 +150 +151 +152 +153 +154 +155 +156 +157 +158 +159 +160 +161 +162 +163 +164 +165 +166 +167 +168 +169 +170 +171 +172 +173 +174 +175 +176 +177 +178 +179 +180 +181 +182 +183 +184 +185 +186 +187 +188 +189 +190 +191 +192 +193 +194 +195 +196 +197 +198 +199 +200 +201 +202 +203 +204 +205 +206 +207 +208 +209 +210 +211 +212 +213 +214 +215 +216 +217 +218 +219 +220 +221 +222 +223 +224 +225 +226 +227 +228 +229 +230 +231 +232 +233 +234 +235 +236 +237 +238 +239 +240 +241 +242 +243 +244 +245 +246 +247 +248 +249 +250 +251 +252 +253 +254 +255 +256 +257 +258 +259 +260 +261 +262 +263 +264 +265 +266 +267 +268 +269 +270 +271 +272 +273 +274 +275 +276 +277 +278 +279 +280 +281 +282 +283 +284 +285 +286 +287 +288 +289 +290 +291 +292 +293 +294 +295 +296 +297 +298 +299 +300 +301 +302 +303 +304 +305 +306 +307 +308 +309 +310 +311 +312 +313 +314 +315 +316 +317 +318 +319 +320 +321 +322 +323 +324 +325 +326 +327 +328 +329 +330 +331 +332 +333 +334 +335 +336 +337 +338 +339 +340 +341 +342 +343 +344 +345 +346 +347 +348 +349 +350 +351 +352 +353 +354 +355 +356 +357 +358 +359 +360 +361 +362 +363 +364 +365 +366 +367 +368 +369 +370 +371 +372 +373 +374 +375 +376 +377 +378 +379 +380 +381 +382 +383 +384 +385 +386 +387 +388 +389 +390 +391 +392 +393 | + + + + + + + + + + + + + +256x + + + +64x + + + + + + + + + +64x + + +64x +64x + + + + + + + + + + + + + + + + + + + + + + + + + + + + +128x + + + + + + + +64x +64x + + +64x + + +64x + +64x +960x +7x + + + +64x +64x +64x +64x +64x + +64x +64x + + + +64x +64x +64x +64x +64x +64x +64x +64x +64x +64x + +64x + + +64x + + + +64x + + +64x + + +64x + + +64x + + +64x +2x + + + + + +64x +1x + + + +64x + + + + + +64x +1x + + + +64x + + +332x + + + + +64x + + + +64x +64x +64x + + +64x +64x +64x +64x +64x + +64x +64x +64x +64x +64x +64x +64x +64x + + +64x +64x +64x +64x + +64x +64x +64x + + +64x + + + +64x +64x +64x +64x + + + + + + + + + +64x + + +64x +64x +64x +64x +64x + + + + + +64x + + + + + + + + +64x +64x +64x +64x +64x +64x +64x +64x +64x + + +64x + + +64x +64x +64x + + + + + + + + + + + +64x + + + + + + + +64x +3x + + + +64x + + + + + +64x + + + + + + + +64x +63x + + + +63x + + + + + + +64x +1x + + + +1x + + + + + + + +64x + + + + + + + +64x + + + + + + + + +396x +64x + +64x + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +64x + + | import type * as k8s from "@kubernetes/client-node";
+import type { AdapterExecutionContext } from "@paperclipai/adapter-utils";
+import {
+ asString,
+ asNumber,
+ asBoolean,
+ asStringArray,
+ parseObject,
+ buildPaperclipEnv,
+ renderTemplate,
+} from "@paperclipai/adapter-utils/server-utils";
+
+// Inline prompt assembly — these functions are not yet in the published adapter-utils
+function joinPromptSections(sections: string[], separator = "\n\n"): string {
+ return sections.filter((s) => s.trim().length > 0).join(separator);
+}
+
+function stringifyPaperclipWakePayload(wake: unknown): string | null {
+ Eif (!wake || typeof wake !== "object") return null;
+ try {
+ const json = JSON.stringify(wake);
+ return json === "{}" ? null : json;
+ } catch {
+ return null;
+ }
+}
+
+function renderPaperclipWakePrompt(wake: unknown, _opts?: { resumedSession?: boolean }): string {
+ Eif (!wake || typeof wake !== "object") return "";
+ const w = wake as Record<string, unknown>;
+ const reason = typeof w.reason === "string" ? w.reason.trim() : "";
+ const comments = Array.isArray(w.comments) ? w.comments : [];
+ Iif (!reason && comments.length === 0) return "";
+ const parts: string[] = [];
+ if (reason) parts.push(`Wake reason: ${reason}`);
+ for (const c of comments) {
+ if (typeof c === "object" && c !== null) {
+ const comment = c as Record<string, unknown>;
+ const body = typeof comment.body === "string" ? comment.body.trim() : "";
+ if (body) parts.push(`Comment: ${body}`);
+ }
+ }
+ return parts.join("\n\n");
+}
+import type { SelfPodInfo } from "./k8s-client.js";
+
+export interface JobBuildInput {
+ ctx: AdapterExecutionContext;
+ selfPod: SelfPodInfo;
+}
+
+export interface JobBuildResult {
+ job: k8s.V1Job;
+ jobName: string;
+ namespace: string;
+ prompt: string;
+ claudeArgs: string[];
+ promptMetrics: Record<string, number>;
+}
+
+function sanitizeForK8sName(value: string): string {
+ return value.toLowerCase().replace(/[^a-z0-9-]/g, "").slice(0, 8);
+}
+
+function buildEnvVars(
+ ctx: AdapterExecutionContext,
+ selfPod: SelfPodInfo,
+ config: Record<string, unknown>,
+): k8s.V1EnvVar[] {
+ const { runId, agent, context } = ctx;
+ const envConfig = parseObject(config.env);
+
+ // Layer 1: PAPERCLIP_* base vars
+ const paperclipEnv = buildPaperclipEnv(agent);
+
+ // Layer 2: Context vars (run, wake, workspace — same as claude_local)
+ paperclipEnv.PAPERCLIP_RUN_ID = runId;
+
+ const setIfPresent = (envKey: string, value: unknown) => {
+ if (typeof value === "string" && value.trim().length > 0) {
+ paperclipEnv[envKey] = value.trim();
+ }
+ };
+
+ setIfPresent("PAPERCLIP_TASK_ID", context.taskId ?? context.issueId);
+ setIfPresent("PAPERCLIP_WAKE_REASON", context.wakeReason);
+ setIfPresent("PAPERCLIP_WAKE_COMMENT_ID", context.wakeCommentId ?? context.commentId);
+ setIfPresent("PAPERCLIP_APPROVAL_ID", context.approvalId);
+ setIfPresent("PAPERCLIP_APPROVAL_STATUS", context.approvalStatus);
+
+ const wakePayloadJson = stringifyPaperclipWakePayload(context.paperclipWake);
+ Iif (wakePayloadJson) {
+ paperclipEnv.PAPERCLIP_WAKE_PAYLOAD_JSON = wakePayloadJson;
+ }
+
+ const workspaceContext = parseObject(context.paperclipWorkspace);
+ setIfPresent("PAPERCLIP_WORKSPACE_CWD", workspaceContext.cwd);
+ setIfPresent("PAPERCLIP_WORKSPACE_SOURCE", workspaceContext.source);
+ setIfPresent("PAPERCLIP_WORKSPACE_STRATEGY", workspaceContext.strategy);
+ setIfPresent("PAPERCLIP_WORKSPACE_ID", workspaceContext.workspaceId);
+ setIfPresent("PAPERCLIP_WORKSPACE_REPO_URL", workspaceContext.repoUrl);
+ setIfPresent("PAPERCLIP_WORKSPACE_REPO_REF", workspaceContext.repoRef);
+ setIfPresent("PAPERCLIP_WORKSPACE_BRANCH", workspaceContext.branchName);
+ setIfPresent("PAPERCLIP_WORKSPACE_WORKTREE_PATH", workspaceContext.worktreePath);
+ setIfPresent("AGENT_HOME", workspaceContext.agentHome);
+
+ const linkedIssueIds = Array.isArray(context.issueIds)
+ ? context.issueIds.filter((v): v is string => typeof v === "string" && v.trim().length > 0)
+ : [];
+ Iif (linkedIssueIds.length > 0) {
+ paperclipEnv.PAPERCLIP_LINKED_ISSUE_IDS = linkedIssueIds.join(",");
+ }
+
+ Iif (Array.isArray(context.paperclipWorkspaces) && context.paperclipWorkspaces.length > 0) {
+ paperclipEnv.PAPERCLIP_WORKSPACES_JSON = JSON.stringify(context.paperclipWorkspaces);
+ }
+ Iif (Array.isArray(context.paperclipRuntimeServiceIntents) && context.paperclipRuntimeServiceIntents.length > 0) {
+ paperclipEnv.PAPERCLIP_RUNTIME_SERVICE_INTENTS_JSON = JSON.stringify(context.paperclipRuntimeServiceIntents);
+ }
+ Iif (Array.isArray(context.paperclipRuntimeServices) && context.paperclipRuntimeServices.length > 0) {
+ paperclipEnv.PAPERCLIP_RUNTIME_SERVICES_JSON = JSON.stringify(context.paperclipRuntimeServices);
+ }
+ setIfPresent("PAPERCLIP_RUNTIME_PRIMARY_URL", context.paperclipRuntimePrimaryUrl);
+
+ // Auth token for agent callback to Paperclip API
+ if (ctx.authToken) {
+ paperclipEnv.PAPERCLIP_API_KEY = ctx.authToken;
+ }
+
+ // PAPERCLIP_API_URL is inherited from the Deployment env via selfPod.inheritedEnv.
+ // buildPaperclipEnv() sets a localhost value which is wrong for Job pods —
+ // the inherited value (set in the infra repo) points to the in-cluster service.
+ if (selfPod.inheritedEnv.PAPERCLIP_API_URL) {
+ paperclipEnv.PAPERCLIP_API_URL = selfPod.inheritedEnv.PAPERCLIP_API_URL;
+ }
+
+ // Layer 3: Inherited from Deployment (Bedrock, API keys, etc.)
+ const merged: Record<string, string> = {
+ ...selfPod.inheritedEnv,
+ ...paperclipEnv,
+ };
+
+ // Layer 4: User-defined overrides from adapterConfig.env (wins over everything)
+ for (const [key, value] of Object.entries(envConfig)) {
+ Eif (typeof value === "string") merged[key] = value;
+ }
+
+ // HOME must be /paperclip to match PVC mount and enable session resume
+ merged.HOME = "/paperclip";
+
+ // Convert to V1EnvVar array
+ const envVars: k8s.V1EnvVar[] = Object.entries(merged).map(([name, value]) => ({
+ name,
+ value,
+ }));
+
+ return envVars;
+}
+
+export function buildJobManifest(input: JobBuildInput): JobBuildResult {
+ const { ctx, selfPod } = input;
+ const { runId, agent, runtime, config: rawConfig, context } = ctx;
+ const config = parseObject(rawConfig);
+
+ // Resolve config values
+ const namespace = asString(config.namespace, "") || selfPod.namespace;
+ const image = asString(config.image, "") || selfPod.image;
+ const model = asString(config.model, "");
+ const effort = asString(config.effort, "");
+ const maxTurns = asNumber(config.maxTurnsPerRun, 0);
+ // K8s Job pods are always unattended — no one to approve permission prompts
+ const dangerouslySkipPermissions = asBoolean(config.dangerouslySkipPermissions, true);
+ const extraArgs = asStringArray(config.extraArgs);
+ const timeoutSec = asNumber(config.timeoutSec, 0);
+ const ttlSeconds = asNumber(config.ttlSecondsAfterFinished, 300);
+ const resources = parseObject(config.resources);
+ const nodeSelector = parseObject(config.nodeSelector);
+ const tolerations = Array.isArray(config.tolerations) ? config.tolerations : [];
+ const extraLabels = parseObject(config.labels);
+
+ // Resolve working directory — use workspace cwd, fall back to /paperclip
+ const workspaceContext = parseObject(context.paperclipWorkspace);
+ const workspaceCwd = asString(workspaceContext.cwd, "");
+ const configuredCwd = asString(config.cwd, "");
+ const workingDir = workspaceCwd || configuredCwd || "/paperclip";
+
+ const agentSlug = sanitizeForK8sName(agent.id);
+ const runSlug = sanitizeForK8sName(runId);
+ const jobName = `agent-claude-${agentSlug}-${runSlug}`;
+
+ // Build prompt (same logic as claude_local)
+ const promptTemplate = asString(
+ config.promptTemplate,
+ "You are agent {{agent.id}} ({{agent.name}}). Continue your Paperclip work.",
+ );
+ const bootstrapPromptTemplate = asString(config.bootstrapPromptTemplate, "");
+ const runtimeSessionParams = parseObject(runtime.sessionParams);
+ const runtimeSessionId = asString(runtimeSessionParams.sessionId, runtime.sessionId ?? "");
+ const templateData = {
+ agentId: agent.id,
+ companyId: agent.companyId,
+ runId,
+ company: { id: agent.companyId },
+ agent,
+ run: { id: runId, source: "on_demand" },
+ context,
+ };
+ const renderedBootstrapPrompt =
+ !runtimeSessionId && bootstrapPromptTemplate.trim().length > 0
+ ? renderTemplate(bootstrapPromptTemplate, templateData).trim()
+ : "";
+ const wakePrompt = renderPaperclipWakePrompt(context.paperclipWake, { resumedSession: Boolean(runtimeSessionId) });
+ const shouldUseResumeDeltaPrompt = Boolean(runtimeSessionId) && wakePrompt.length > 0;
+ const renderedPrompt = shouldUseResumeDeltaPrompt ? "" : renderTemplate(promptTemplate, templateData);
+ const sessionHandoffNote = asString(context.paperclipSessionHandoffMarkdown, "").trim();
+ const prompt = joinPromptSections([
+ renderedBootstrapPrompt,
+ wakePrompt,
+ sessionHandoffNote,
+ renderedPrompt,
+ ]);
+ const promptMetrics = {
+ promptChars: prompt.length,
+ bootstrapPromptChars: renderedBootstrapPrompt.length,
+ wakePromptChars: wakePrompt.length,
+ sessionHandoffChars: sessionHandoffNote.length,
+ heartbeatPromptChars: renderedPrompt.length,
+ };
+
+ // Build Claude CLI args
+ const instructionsFilePath = asString(config.instructionsFilePath, "").trim();
+ const claudeArgs = ["--print", "-", "--output-format", "stream-json", "--verbose"];
+ if (runtimeSessionId) claudeArgs.push("--resume", runtimeSessionId);
+ Eif (dangerouslySkipPermissions) claudeArgs.push("--dangerously-skip-permissions");
+ if (model) claudeArgs.push("--model", model);
+ if (effort) claudeArgs.push("--effort", effort);
+ if (maxTurns > 0) claudeArgs.push("--max-turns", String(maxTurns));
+ if (instructionsFilePath) claudeArgs.push("--append-system-prompt-file", instructionsFilePath);
+ if (extraArgs.length > 0) claudeArgs.push(...extraArgs);
+
+ // Build env vars
+ const envVars = buildEnvVars(ctx, selfPod, config);
+
+ // Resource defaults
+ const resourceRequests = parseObject(resources.requests);
+ const resourceLimits = parseObject(resources.limits);
+ const containerResources: k8s.V1ResourceRequirements = {
+ requests: {
+ cpu: asString(resourceRequests.cpu, "1000m"),
+ memory: asString(resourceRequests.memory, "2Gi"),
+ },
+ limits: {
+ cpu: asString(resourceLimits.cpu, "4000m"),
+ memory: asString(resourceLimits.memory, "8Gi"),
+ },
+ };
+
+ // Labels
+ const labels: Record<string, string> = {
+ "app.kubernetes.io/managed-by": "paperclip",
+ "app.kubernetes.io/component": "agent-job",
+ "paperclip.io/agent-id": agent.id,
+ "paperclip.io/run-id": runId,
+ "paperclip.io/company-id": agent.companyId,
+ "paperclip.io/adapter-type": "claude_k8s",
+ };
+ for (const [key, value] of Object.entries(extraLabels)) {
+ Eif (typeof value === "string") labels[key] = value;
+ }
+
+ // Volumes
+ const volumes: k8s.V1Volume[] = [
+ {
+ name: "prompt",
+ emptyDir: {},
+ },
+ ];
+ const volumeMounts: k8s.V1VolumeMount[] = [
+ {
+ name: "prompt",
+ mountPath: "/tmp/prompt",
+ },
+ ];
+
+ // Mount shared PVC for /paperclip (session state, workspaces, data)
+ if (selfPod.pvcClaimName) {
+ volumes.push({
+ name: "data",
+ persistentVolumeClaim: { claimName: selfPod.pvcClaimName },
+ });
+ volumeMounts.push({
+ name: "data",
+ mountPath: "/paperclip",
+ });
+ }
+
+ // Mount secret volumes inherited from the Deployment pod
+ for (const sv of selfPod.secretVolumes) {
+ volumes.push({
+ name: sv.volumeName,
+ secret: { secretName: sv.secretName, defaultMode: sv.defaultMode, optional: true },
+ });
+ volumeMounts.push({
+ name: sv.volumeName,
+ mountPath: sv.mountPath,
+ readOnly: true,
+ });
+ }
+
+ // Security context matching the main Deployment
+ const securityContext: k8s.V1SecurityContext = {
+ capabilities: { drop: ["ALL"] },
+ readOnlyRootFilesystem: false,
+ runAsNonRoot: true,
+ runAsUser: 1000,
+ allowPrivilegeEscalation: false,
+ };
+
+ const podSecurityContext: k8s.V1PodSecurityContext = {
+ runAsNonRoot: true,
+ runAsUser: 1000,
+ runAsGroup: 1000,
+ fsGroup: 1000,
+ fsGroupChangePolicy: "OnRootMismatch",
+ };
+
+ // Build the claude command string for the main container
+ const claudeArgsEscaped = claudeArgs.map((a) => `'${a.replace(/'/g, "'\\''")}'`).join(" ");
+ const mainCommand = `cat /tmp/prompt/prompt.txt | claude ${claudeArgsEscaped}`;
+
+ const job: k8s.V1Job = {
+ apiVersion: "batch/v1",
+ kind: "Job",
+ metadata: {
+ name: jobName,
+ namespace,
+ labels,
+ annotations: {
+ "paperclip.io/adapter-type": "claude_k8s",
+ "paperclip.io/agent-name": agent.name,
+ },
+ },
+ spec: {
+ backoffLimit: 0,
+ ...(timeoutSec > 0 ? { activeDeadlineSeconds: timeoutSec } : {}),
+ ttlSecondsAfterFinished: ttlSeconds,
+ template: {
+ metadata: { labels },
+ spec: {
+ restartPolicy: "Never",
+ serviceAccountName: asString(config.serviceAccountName, "") || undefined,
+ securityContext: podSecurityContext,
+ ...(selfPod.imagePullSecrets.length > 0 ? { imagePullSecrets: selfPod.imagePullSecrets } : {}),
+ ...(selfPod.dnsConfig ? { dnsConfig: selfPod.dnsConfig } : {}),
+ ...(Object.keys(nodeSelector).length > 0 ? { nodeSelector: nodeSelector as Record<string, string> } : {}),
+ ...(tolerations.length > 0 ? { tolerations: tolerations as k8s.V1Toleration[] } : {}),
+ initContainers: [
+ {
+ name: "write-prompt",
+ image: "busybox:1.36",
+ imagePullPolicy: "IfNotPresent",
+ command: ["sh", "-c", "echo \"$PROMPT_CONTENT\" > /tmp/prompt/prompt.txt"],
+ env: [{ name: "PROMPT_CONTENT", value: prompt }],
+ volumeMounts: [{ name: "prompt", mountPath: "/tmp/prompt" }],
+ securityContext,
+ resources: {
+ requests: { cpu: "10m", memory: "16Mi" },
+ limits: { cpu: "100m", memory: "64Mi" },
+ },
+ },
+ ],
+ containers: [
+ {
+ name: "claude",
+ image,
+ imagePullPolicy: asString(config.imagePullPolicy, "IfNotPresent"),
+ workingDir,
+ command: ["sh", "-c", mainCommand],
+ env: envVars,
+ volumeMounts,
+ securityContext,
+ resources: containerResources,
+ },
+ ],
+ volumes,
+ },
+ },
+ },
+ };
+
+ return { job, jobName, namespace, prompt, claudeArgs, promptMetrics };
+}
+ |
+ Press n or j to go to the next uncovered block, b, p or k for the previous block. +
+ +| 1 +2 +3 +4 +5 +6 +7 +8 +9 +10 +11 +12 +13 +14 +15 +16 +17 +18 +19 +20 +21 +22 +23 +24 +25 +26 +27 +28 +29 +30 +31 +32 +33 +34 +35 +36 +37 +38 +39 +40 +41 +42 +43 +44 +45 +46 +47 +48 +49 +50 +51 +52 +53 +54 +55 +56 +57 +58 +59 +60 +61 +62 +63 +64 +65 +66 +67 +68 +69 +70 +71 +72 +73 +74 +75 +76 +77 +78 +79 +80 +81 +82 +83 +84 +85 +86 +87 +88 +89 +90 +91 +92 +93 +94 +95 +96 +97 +98 +99 +100 +101 +102 +103 +104 +105 +106 +107 +108 +109 +110 +111 +112 +113 +114 +115 +116 +117 +118 +119 +120 +121 +122 +123 +124 +125 +126 +127 +128 +129 +130 +131 +132 +133 +134 +135 +136 +137 +138 +139 +140 +141 +142 +143 +144 +145 +146 +147 +148 +149 +150 +151 +152 +153 +154 +155 +156 +157 +158 +159 +160 +161 +162 +163 +164 +165 +166 +167 +168 +169 +170 +171 +172 +173 | + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + | import * as k8s from "@kubernetes/client-node";
+import { readFileSync } from "node:fs";
+
+/**
+ * Cached self-pod introspection result. Queried once on first execute(),
+ * then reused for all subsequent Job builds so every Job inherits the
+ * Deployment's image, imagePullSecrets, DNS config, and PVC claim.
+ */
+export interface SelfPodSecretVolume {
+ volumeName: string;
+ secretName: string;
+ mountPath: string;
+ defaultMode: number | undefined;
+}
+
+export interface SelfPodInfo {
+ namespace: string;
+ image: string;
+ imagePullSecrets: Array<{ name: string }>;
+ dnsConfig: k8s.V1PodDNSConfig | undefined;
+ pvcClaimName: string | null;
+ secretVolumes: SelfPodSecretVolume[];
+ /** Env vars inherited from the Deployment container. */
+ inheritedEnv: Record<string, string>;
+}
+
+/** Keys forwarded from the Deployment container env into Job pods. */
+const INHERITED_ENV_KEYS = [
+ "CLAUDE_CODE_USE_BEDROCK",
+ "AWS_REGION",
+ "AWS_BEARER_TOKEN_BEDROCK",
+ "ANTHROPIC_API_KEY",
+ "OPENAI_API_KEY",
+ "PAPERCLIP_API_URL",
+];
+
+let cachedSelfPod: SelfPodInfo | null = null;
+
+/**
+ * Cache keyed by kubeconfig path (empty string = in-cluster).
+ * Supports multiple agents with different kubeconfigs.
+ */
+const kcCache = new Map<string, k8s.KubeConfig>();
+
+function getKubeConfig(kubeconfigPath?: string): k8s.KubeConfig {
+ const key = kubeconfigPath ?? "";
+ let kc = kcCache.get(key);
+ if (!kc) {
+ kc = new k8s.KubeConfig();
+ if (kubeconfigPath) {
+ kc.loadFromFile(kubeconfigPath);
+ } else {
+ kc.loadFromCluster();
+ }
+ kcCache.set(key, kc);
+ }
+ return kc;
+}
+
+export function getBatchApi(kubeconfigPath?: string): k8s.BatchV1Api {
+ return getKubeConfig(kubeconfigPath).makeApiClient(k8s.BatchV1Api);
+}
+
+export function getCoreApi(kubeconfigPath?: string): k8s.CoreV1Api {
+ return getKubeConfig(kubeconfigPath).makeApiClient(k8s.CoreV1Api);
+}
+
+export function getAuthzApi(kubeconfigPath?: string): k8s.AuthorizationV1Api {
+ return getKubeConfig(kubeconfigPath).makeApiClient(k8s.AuthorizationV1Api);
+}
+
+export function getLogApi(kubeconfigPath?: string): k8s.Log {
+ return new k8s.Log(getKubeConfig(kubeconfigPath));
+}
+
+/**
+ * Read the current pod's namespace. Checks (in order):
+ * 1. PAPERCLIP_NAMESPACE env var (set explicitly in Deployment)
+ * 2. Service account namespace file (standard in-cluster path)
+ * 3. POD_NAMESPACE env var (Downward API convention)
+ * Falls back to "default" only if none of the above are available.
+ */
+function readInClusterNamespace(): string {
+ const fromEnv = process.env.PAPERCLIP_NAMESPACE ?? process.env.POD_NAMESPACE;
+ if (fromEnv?.trim()) return fromEnv.trim();
+ try {
+ return readFileSync("/var/run/secrets/kubernetes.io/serviceaccount/namespace", "utf-8").trim();
+ } catch {
+ return "default";
+ }
+}
+
+/**
+ * Query the K8s API for our own pod spec and cache the result.
+ * Extracts image, imagePullSecrets, dnsConfig, PVC claim name,
+ * and environment variables to forward to Job pods.
+ */
+export async function getSelfPodInfo(kubeconfigPath?: string): Promise<SelfPodInfo> {
+ if (cachedSelfPod) return cachedSelfPod;
+
+ const hostname = process.env.HOSTNAME;
+ if (!hostname) {
+ throw new Error("claude_k8s: HOSTNAME env var not set — cannot introspect running pod");
+ }
+
+ const namespace = readInClusterNamespace();
+ const coreApi = getCoreApi(kubeconfigPath);
+ const pod = await coreApi.readNamespacedPod({ name: hostname, namespace });
+
+ const spec = pod.spec;
+ if (!spec) {
+ throw new Error(`claude_k8s: pod ${hostname} has no spec`);
+ }
+
+ const mainContainer = spec.containers[0];
+ if (!mainContainer?.image) {
+ throw new Error(`claude_k8s: pod ${hostname} has no container image`);
+ }
+
+ // Find PVC claim name from volumes mounted at /paperclip
+ let pvcClaimName: string | null = null;
+ const dataMount = mainContainer.volumeMounts?.find(
+ (vm) => vm.mountPath === "/paperclip",
+ );
+ if (dataMount) {
+ const volume = spec.volumes?.find((v) => v.name === dataMount.name);
+ pvcClaimName = volume?.persistentVolumeClaim?.claimName ?? null;
+ }
+
+ // Discover secret volumes mounted on the main container
+ const secretVolumes: SelfPodSecretVolume[] = [];
+ for (const vm of mainContainer.volumeMounts ?? []) {
+ const vol = spec.volumes?.find((v) => v.name === vm.name);
+ if (vol?.secret?.secretName) {
+ secretVolumes.push({
+ volumeName: vm.name,
+ secretName: vol.secret.secretName,
+ mountPath: vm.mountPath,
+ defaultMode: vol.secret.defaultMode,
+ });
+ }
+ }
+
+ // Collect inherited env vars from process.env (these came from the Deployment spec)
+ const inheritedEnv: Record<string, string> = {};
+ for (const key of INHERITED_ENV_KEYS) {
+ const value = process.env[key];
+ if (value !== undefined) {
+ inheritedEnv[key] = value;
+ }
+ }
+
+ cachedSelfPod = {
+ namespace,
+ image: mainContainer.image,
+ imagePullSecrets: (spec.imagePullSecrets ?? []).map((s) => ({
+ name: s.name ?? "",
+ })).filter((s) => s.name.length > 0),
+ dnsConfig: spec.dnsConfig,
+ pvcClaimName,
+ secretVolumes,
+ inheritedEnv,
+ };
+
+ return cachedSelfPod;
+}
+
+/** Reset cached state — useful for tests. */
+export function resetCache(): void {
+ kcCache.clear();
+ cachedSelfPod = null;
+}
+ |
+ Press n or j to go to the next uncovered block, b, p or k for the previous block. +
+ +| 1 +2 +3 +4 +5 +6 +7 +8 +9 +10 +11 +12 +13 +14 +15 +16 +17 +18 +19 +20 +21 +22 +23 +24 +25 +26 +27 +28 +29 +30 +31 +32 +33 +34 +35 +36 +37 +38 +39 +40 +41 +42 +43 +44 +45 +46 +47 +48 +49 +50 +51 +52 +53 +54 +55 +56 +57 +58 +59 +60 +61 +62 +63 +64 +65 +66 +67 +68 +69 +70 +71 +72 +73 +74 +75 +76 +77 +78 +79 +80 +81 +82 +83 +84 +85 +86 +87 +88 +89 +90 +91 +92 +93 +94 +95 +96 +97 +98 +99 +100 +101 +102 +103 +104 +105 +106 +107 +108 +109 +110 +111 +112 +113 +114 +115 +116 +117 +118 +119 +120 +121 +122 +123 +124 +125 +126 +127 +128 +129 +130 +131 +132 +133 +134 +135 +136 +137 +138 +139 +140 +141 +142 +143 +144 +145 +146 +147 +148 +149 +150 +151 +152 +153 +154 +155 +156 +157 +158 +159 +160 +161 +162 +163 +164 +165 +166 +167 +168 +169 +170 +171 +172 +173 +174 +175 +176 +177 +178 +179 +180 | + + +1x +1x + + +10x +10x +10x +10x + +10x +15x +15x +13x +13x + +9x +9x +1x +1x +1x + + +8x +6x +6x +6x +6x +6x +6x +6x +4x +4x + + +6x + + +2x +2x +2x + + + +10x +8x + + + + + + + + + +2x +2x + + + + +2x +2x +10x + +10x + + + + + + + + + + +15x +15x + +15x +4x +4x +4x +4x + + + + + + + + +4x + + + + + + + + + + + +15x + + + +11x +11x +7x +8x +8x +5x + + +2x + + + + + + + +6x +6x + + +20x + + +6x +6x + + + + + + +4x +4x +4x + +4x +4x +1x + + +4x +4x +4x +4x + + + +9x + +7x +7x + +5x +5x + +4x +4x + + + +5x +5x +6x + + +5x +5x + + + | import type { UsageSummary } from "@paperclipai/adapter-utils";
+import { asString, asNumber, parseObject, parseJson } from "@paperclipai/adapter-utils/server-utils";
+
+const CLAUDE_AUTH_REQUIRED_RE = /(?:not\s+logged\s+in|please\s+log\s+in|please\s+run\s+`?claude\s+login`?|login\s+required|requires\s+login|unauthorized|authentication\s+required)/i;
+const URL_RE = /(https?:\/\/[^\s'"`<>()[\]{};,!?]+[^\s'"`<>()[\]{};,!.?:]+)/gi;
+
+export function parseClaudeStreamJson(stdout: string) {
+ let sessionId: string | null = null;
+ let model = "";
+ let finalResult: Record<string, unknown> | null = null;
+ const assistantTexts: string[] = [];
+
+ for (const rawLine of stdout.split(/\r?\n/)) {
+ const line = rawLine.trim();
+ if (!line) continue;
+ const event = parseJson(line);
+ if (!event) continue;
+
+ const type = asString(event.type, "");
+ if (type === "system" && asString(event.subtype, "") === "init") {
+ sessionId = asString(event.session_id, sessionId ?? "") || sessionId;
+ model = asString(event.model, model);
+ continue;
+ }
+
+ if (type === "assistant") {
+ sessionId = asString(event.session_id, sessionId ?? "") || sessionId;
+ const message = parseObject(event.message);
+ const content = Array.isArray(message.content) ? message.content : [];
+ for (const entry of content) {
+ Iif (typeof entry !== "object" || entry === null || Array.isArray(entry)) continue;
+ const block = entry as Record<string, unknown>;
+ if (asString(block.type, "") === "text") {
+ const text = asString(block.text, "");
+ Eif (text) assistantTexts.push(text);
+ }
+ }
+ continue;
+ }
+
+ Eif (type === "result") {
+ finalResult = event;
+ sessionId = asString(event.session_id, sessionId ?? "") || sessionId;
+ }
+ }
+
+ if (!finalResult) {
+ return {
+ sessionId,
+ model,
+ costUsd: null as number | null,
+ usage: null as UsageSummary | null,
+ summary: assistantTexts.join("\n\n").trim(),
+ resultJson: null as Record<string, unknown> | null,
+ };
+ }
+
+ const usageObj = parseObject(finalResult.usage);
+ const usage: UsageSummary = {
+ inputTokens: asNumber(usageObj.input_tokens, 0),
+ cachedInputTokens: asNumber(usageObj.cache_read_input_tokens, 0),
+ outputTokens: asNumber(usageObj.output_tokens, 0),
+ };
+ const costRaw = finalResult.total_cost_usd;
+ const costUsd = typeof costRaw === "number" && Number.isFinite(costRaw) ? costRaw : null;
+ const summary = asString(finalResult.result, assistantTexts.join("\n\n")).trim();
+
+ return {
+ sessionId,
+ model,
+ costUsd,
+ usage,
+ summary,
+ resultJson: finalResult,
+ };
+}
+
+function extractClaudeErrorMessages(parsed: Record<string, unknown>): string[] {
+ const raw = Array.isArray(parsed.errors) ? parsed.errors : [];
+ const messages: string[] = [];
+
+ for (const entry of raw) {
+ Eif (typeof entry === "string") {
+ const msg = entry.trim();
+ Eif (msg) messages.push(msg);
+ continue;
+ }
+
+ if (typeof entry !== "object" || entry === null || Array.isArray(entry)) {
+ continue;
+ }
+
+ const obj = entry as Record<string, unknown>;
+ const msg = asString(obj.message, "") || asString(obj.error, "") || asString(obj.code, "");
+ Iif (msg) {
+ messages.push(msg);
+ continue;
+ }
+
+ try {
+ messages.push(JSON.stringify(obj));
+ } catch {
+ // skip non-serializable entry
+ }
+ }
+
+ return messages;
+}
+
+export function extractClaudeLoginUrl(text: string): string | null {
+ const match = text.match(URL_RE);
+ if (!match || match.length === 0) return null;
+ for (const rawUrl of match) {
+ const cleaned = rawUrl.replace(/[\])}.!,?;:'\"]+$/g, "");
+ if (cleaned.includes("claude") || cleaned.includes("anthropic") || cleaned.includes("auth")) {
+ return cleaned;
+ }
+ }
+ return match[0]?.replace(/[\])}.!,?;:'\"]+$/g, "") ?? null;
+}
+
+export function detectClaudeLoginRequired(input: {
+ parsed: Record<string, unknown> | null;
+ stdout: string;
+ stderr: string;
+}): { requiresLogin: boolean; loginUrl: string | null } {
+ const resultText = asString(input.parsed?.result, "").trim();
+ const messages = [resultText, ...extractClaudeErrorMessages(input.parsed ?? {}), input.stdout, input.stderr]
+ .join("\n")
+ .split(/\r?\n/)
+ .map((line) => line.trim())
+ .filter(Boolean);
+
+ const requiresLogin = messages.some((line) => CLAUDE_AUTH_REQUIRED_RE.test(line));
+ return {
+ requiresLogin,
+ loginUrl: extractClaudeLoginUrl([input.stdout, input.stderr].join("\n")),
+ };
+}
+
+export function describeClaudeFailure(parsed: Record<string, unknown>): string | null {
+ const subtype = asString(parsed.subtype, "");
+ const resultText = asString(parsed.result, "").trim();
+ const errors = extractClaudeErrorMessages(parsed);
+
+ let detail = resultText;
+ if (!detail && errors.length > 0) {
+ detail = errors[0] ?? "";
+ }
+
+ const parts = ["Claude run failed"];
+ if (subtype) parts.push(`subtype=${subtype}`);
+ if (detail) parts.push(detail);
+ return parts.length > 1 ? parts.join(": ") : null;
+}
+
+export function isClaudeMaxTurnsResult(parsed: Record<string, unknown> | null | undefined): boolean {
+ if (!parsed) return false;
+
+ const subtype = asString(parsed.subtype, "").trim().toLowerCase();
+ if (subtype === "error_max_turns") return true;
+
+ const stopReason = asString(parsed.stop_reason, "").trim().toLowerCase();
+ if (stopReason === "max_turns") return true;
+
+ const resultText = asString(parsed.result, "").trim();
+ return /max(?:imum)?\s+turns?/i.test(resultText);
+}
+
+export function isClaudeUnknownSessionError(parsed: Record<string, unknown>): boolean {
+ const resultText = asString(parsed.result, "").trim();
+ const allMessages = [resultText, ...extractClaudeErrorMessages(parsed)]
+ .map((msg) => msg.trim())
+ .filter(Boolean);
+
+ return allMessages.some((msg) =>
+ /no conversation found with session id|unknown session|session .* not found/i.test(msg),
+ );
+}
+ |
+ Press n or j to go to the next uncovered block, b, p or k for the previous block. +
+ +| 1 +2 +3 +4 +5 +6 +7 +8 +9 +10 +11 +12 +13 +14 +15 +16 +17 +18 +19 +20 +21 +22 +23 +24 +25 +26 +27 +28 +29 +30 +31 +32 +33 +34 +35 +36 +37 +38 +39 +40 +41 +42 +43 +44 +45 +46 +47 +48 +49 +50 +51 +52 | + + +203x + + +1x + +25x +20x +20x +25x + +16x + + +25x +25x +25x +25x + + + + + + + + +8x +6x +8x + +4x + + +8x +8x +8x +8x + + + + + + + + +7x +5x + + + | import type { AdapterSessionCodec } from "@paperclipai/adapter-utils";
+
+function readNonEmptyString(value: unknown): string | null {
+ return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+}
+
+export const sessionCodec: AdapterSessionCodec = {
+ deserialize(raw: unknown) {
+ if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return null;
+ const record = raw as Record<string, unknown>;
+ const sessionId = readNonEmptyString(record.sessionId) ?? readNonEmptyString(record.session_id);
+ if (!sessionId) return null;
+ const cwd =
+ readNonEmptyString(record.cwd) ??
+ readNonEmptyString(record.workdir) ??
+ readNonEmptyString(record.folder);
+ const workspaceId = readNonEmptyString(record.workspaceId) ?? readNonEmptyString(record.workspace_id);
+ const repoUrl = readNonEmptyString(record.repoUrl) ?? readNonEmptyString(record.repo_url);
+ const repoRef = readNonEmptyString(record.repoRef) ?? readNonEmptyString(record.repo_ref);
+ return {
+ sessionId,
+ ...(cwd ? { cwd } : {}),
+ ...(workspaceId ? { workspaceId } : {}),
+ ...(repoUrl ? { repoUrl } : {}),
+ ...(repoRef ? { repoRef } : {}),
+ };
+ },
+ serialize(params: Record<string, unknown> | null) {
+ if (!params) return null;
+ const sessionId = readNonEmptyString(params.sessionId) ?? readNonEmptyString(params.session_id);
+ if (!sessionId) return null;
+ const cwd =
+ readNonEmptyString(params.cwd) ??
+ readNonEmptyString(params.workdir) ??
+ readNonEmptyString(params.folder);
+ const workspaceId = readNonEmptyString(params.workspaceId) ?? readNonEmptyString(params.workspace_id);
+ const repoUrl = readNonEmptyString(params.repoUrl) ?? readNonEmptyString(params.repo_url);
+ const repoRef = readNonEmptyString(params.repoRef) ?? readNonEmptyString(params.repo_ref);
+ return {
+ sessionId,
+ ...(cwd ? { cwd } : {}),
+ ...(workspaceId ? { workspaceId } : {}),
+ ...(repoUrl ? { repoUrl } : {}),
+ ...(repoRef ? { repoRef } : {}),
+ };
+ },
+ getDisplayId(params: Record<string, unknown> | null) {
+ if (!params) return null;
+ return readNonEmptyString(params.sessionId) ?? readNonEmptyString(params.session_id);
+ },
+};
+ |
+ Press n or j to go to the next uncovered block, b, p or k for the previous block. +
+ +| 1 +2 +3 +4 +5 +6 +7 +8 +9 +10 +11 +12 +13 +14 +15 +16 +17 +18 +19 +20 +21 +22 +23 +24 +25 +26 +27 +28 +29 +30 +31 +32 +33 +34 +35 +36 +37 +38 +39 +40 +41 +42 +43 +44 +45 +46 +47 +48 +49 +50 +51 +52 +53 +54 +55 +56 +57 +58 +59 +60 +61 +62 +63 +64 +65 +66 +67 +68 +69 +70 +71 +72 +73 +74 +75 +76 +77 +78 +79 +80 +81 +82 +83 +84 +85 +86 +87 +88 +89 +90 +91 +92 +93 +94 +95 +96 +97 +98 +99 +100 +101 +102 +103 +104 +105 +106 +107 +108 +109 +110 +111 +112 +113 +114 +115 +116 +117 +118 +119 +120 +121 +122 +123 +124 +125 +126 +127 +128 +129 +130 +131 +132 +133 +134 +135 +136 +137 +138 +139 +140 +141 +142 +143 +144 +145 +146 +147 +148 +149 +150 +151 +152 +153 +154 +155 +156 +157 +158 +159 +160 +161 +162 +163 +164 +165 +166 +167 +168 +169 +170 +171 +172 +173 +174 +175 +176 +177 +178 +179 +180 +181 +182 +183 +184 +185 +186 +187 +188 +189 +190 +191 +192 +193 +194 +195 +196 +197 +198 +199 +200 +201 +202 +203 +204 +205 +206 +207 +208 +209 +210 +211 +212 +213 +214 +215 +216 +217 +218 +219 +220 +221 +222 +223 +224 +225 +226 +227 +228 +229 +230 +231 +232 +233 +234 +235 +236 +237 +238 +239 +240 +241 +242 | + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + | import type {
+ AdapterEnvironmentCheck,
+ AdapterEnvironmentTestContext,
+ AdapterEnvironmentTestResult,
+} from "@paperclipai/adapter-utils";
+import { asString, parseObject } from "@paperclipai/adapter-utils/server-utils";
+import { getSelfPodInfo, getCoreApi, getAuthzApi } from "./k8s-client.js";
+
+function summarizeStatus(checks: AdapterEnvironmentCheck[]): AdapterEnvironmentTestResult["status"] {
+ if (checks.some((c) => c.level === "error")) return "fail";
+ if (checks.some((c) => c.level === "warn")) return "warn";
+ return "pass";
+}
+
+async function checkApiReachable(checks: AdapterEnvironmentCheck[], kubeconfigPath?: string): Promise<boolean> {
+ try {
+ const selfPod = await getSelfPodInfo(kubeconfigPath);
+ checks.push({
+ code: "k8s_api_reachable",
+ level: "info",
+ message: `Kubernetes API reachable; running in namespace ${selfPod.namespace}`,
+ detail: `Image: ${selfPod.image}`,
+ });
+ return true;
+ } catch (err) {
+ const msg = err instanceof Error ? err.message : String(err);
+ checks.push({
+ code: "k8s_api_unreachable",
+ level: "error",
+ message: `Cannot reach Kubernetes API: ${msg}`,
+ hint: "Ensure the pod has a valid service account token mounted and the API server is accessible.",
+ });
+ return false;
+ }
+}
+
+async function checkNamespace(
+ namespace: string,
+ selfPodNamespace: string,
+ checks: AdapterEnvironmentCheck[],
+ kubeconfigPath?: string,
+): Promise<boolean> {
+ // If targeting the same namespace we're running in, skip the cluster-scoped
+ // readNamespace call — we know it exists, and the SA may lack cluster-level
+ // namespace get permissions.
+ if (namespace === selfPodNamespace) {
+ checks.push({
+ code: "k8s_namespace_exists",
+ level: "info",
+ message: `Target namespace is the pod namespace: ${namespace}`,
+ });
+ return true;
+ }
+
+ try {
+ const coreApi = getCoreApi(kubeconfigPath);
+ await coreApi.readNamespace({ name: namespace });
+ checks.push({
+ code: "k8s_namespace_exists",
+ level: "info",
+ message: `Target namespace exists: ${namespace}`,
+ });
+ return true;
+ } catch (err) {
+ const msg = err instanceof Error ? err.message : String(err);
+ checks.push({
+ code: "k8s_namespace_check_failed",
+ level: "warn",
+ message: `Cannot verify namespace "${namespace}": ${msg}`,
+ hint: "The service account may lack cluster-level namespace read permissions. The namespace may still be usable — verify RBAC checks below.",
+ });
+ // Don't block on this — RBAC checks below will catch actual permission issues
+ return true;
+ }
+}
+
+async function checkRbac(
+ namespace: string,
+ checks: AdapterEnvironmentCheck[],
+ kubeconfigPath?: string,
+): Promise<void> {
+ const authzApi = getAuthzApi(kubeconfigPath);
+
+ const rbacChecks = [
+ { resource: "jobs", group: "batch", verb: "create", code: "k8s_rbac_job_create", label: "create Jobs" },
+ { resource: "jobs", group: "batch", verb: "delete", code: "k8s_rbac_job_delete", label: "delete Jobs" },
+ { resource: "jobs", group: "batch", verb: "get", code: "k8s_rbac_job_get", label: "get Jobs" },
+ { resource: "pods", group: "", verb: "list", code: "k8s_rbac_pod_list", label: "list Pods" },
+ { resource: "pods/log", group: "", verb: "get", code: "k8s_rbac_pod_log", label: "get Pod logs" },
+ ];
+
+ for (const check of rbacChecks) {
+ try {
+ const review = await authzApi.createSelfSubjectAccessReview({
+ body: {
+ apiVersion: "authorization.k8s.io/v1",
+ kind: "SelfSubjectAccessReview",
+ spec: {
+ resourceAttributes: {
+ namespace,
+ verb: check.verb,
+ resource: check.resource,
+ group: check.group,
+ },
+ },
+ },
+ });
+ if (review.status?.allowed) {
+ checks.push({
+ code: check.code,
+ level: "info",
+ message: `RBAC: allowed to ${check.label} in ${namespace}`,
+ });
+ } else {
+ checks.push({
+ code: check.code,
+ level: "error",
+ message: `RBAC: not allowed to ${check.label} in ${namespace}`,
+ hint: `Grant the service account permission to ${check.verb} ${check.resource} in namespace ${namespace}.`,
+ });
+ }
+ } catch (err) {
+ const msg = err instanceof Error ? err.message : String(err);
+ checks.push({
+ code: check.code,
+ level: "warn",
+ message: `RBAC check failed for ${check.label}: ${msg}`,
+ hint: "SelfSubjectAccessReview may not be available; verify permissions manually.",
+ });
+ }
+ }
+}
+
+async function checkSecret(
+ namespace: string,
+ secretName: string,
+ checks: AdapterEnvironmentCheck[],
+ kubeconfigPath?: string,
+): Promise<void> {
+ try {
+ const coreApi = getCoreApi(kubeconfigPath);
+ await coreApi.readNamespacedSecret({ name: secretName, namespace });
+ checks.push({
+ code: "k8s_secret_exists",
+ level: "info",
+ message: `Secret "${secretName}" exists in namespace ${namespace}`,
+ });
+ } catch {
+ checks.push({
+ code: "k8s_secret_missing",
+ level: "warn",
+ message: `Secret "${secretName}" not found in namespace ${namespace}`,
+ hint: `Ensure the paperclip-secrets Secret exists with keys for ANTHROPIC_API_KEY and/or AWS_BEARER_TOKEN_BEDROCK.`,
+ });
+ }
+}
+
+async function checkPvc(
+ selfPod: { pvcClaimName: string | null; namespace: string },
+ checks: AdapterEnvironmentCheck[],
+ kubeconfigPath?: string,
+): Promise<void> {
+ if (!selfPod.pvcClaimName) {
+ checks.push({
+ code: "k8s_pvc_not_detected",
+ level: "warn",
+ message: "No PVC detected on /paperclip mount — session resume and workspace sharing will not work.",
+ hint: "Ensure the Paperclip Deployment has a PVC mounted at /paperclip with ReadWriteMany access mode.",
+ });
+ return;
+ }
+
+ try {
+ const coreApi = getCoreApi(kubeconfigPath);
+ const pvc = await coreApi.readNamespacedPersistentVolumeClaim({
+ name: selfPod.pvcClaimName,
+ namespace: selfPod.namespace,
+ });
+ const accessModes = pvc.spec?.accessModes ?? [];
+ const isRwx = accessModes.includes("ReadWriteMany");
+ if (isRwx) {
+ checks.push({
+ code: "k8s_pvc_rwx",
+ level: "info",
+ message: `PVC "${selfPod.pvcClaimName}" has ReadWriteMany access — Job pods can mount it.`,
+ });
+ } else {
+ checks.push({
+ code: "k8s_pvc_not_rwx",
+ level: "warn",
+ message: `PVC "${selfPod.pvcClaimName}" access modes: ${accessModes.join(", ")}. ReadWriteMany is required for Job pods to share the volume.`,
+ hint: "Change the PVC accessMode to ReadWriteMany in Helm values.",
+ });
+ }
+ } catch (err) {
+ const msg = err instanceof Error ? err.message : String(err);
+ checks.push({
+ code: "k8s_pvc_check_failed",
+ level: "warn",
+ message: `Could not read PVC "${selfPod.pvcClaimName}": ${msg}`,
+ });
+ }
+}
+
+export async function testEnvironment(
+ ctx: AdapterEnvironmentTestContext,
+): Promise<AdapterEnvironmentTestResult> {
+ const checks: AdapterEnvironmentCheck[] = [];
+ const config = parseObject(ctx.config);
+ const secretRef = asString(config.secretRef, "paperclip-secrets");
+ const kubeconfigPath = asString(config.kubeconfig, "") || undefined;
+
+ // 1. K8s API reachable + self-pod introspection
+ const apiOk = await checkApiReachable(checks, kubeconfigPath);
+ if (!apiOk) {
+ return { adapterType: ctx.adapterType, status: summarizeStatus(checks), checks, testedAt: new Date().toISOString() };
+ }
+
+ const selfPod = await getSelfPodInfo(kubeconfigPath);
+ const namespace = asString(config.namespace, "") || selfPod.namespace;
+
+ // 2. Target namespace exists
+ const nsOk = await checkNamespace(namespace, selfPod.namespace, checks, kubeconfigPath);
+ if (!nsOk) {
+ return { adapterType: ctx.adapterType, status: summarizeStatus(checks), checks, testedAt: new Date().toISOString() };
+ }
+
+ // 3-5. Run remaining checks in parallel
+ await Promise.all([
+ checkRbac(namespace, checks, kubeconfigPath),
+ checkSecret(namespace, secretRef, checks, kubeconfigPath),
+ checkPvc(selfPod, checks, kubeconfigPath),
+ ]);
+
+ return {
+ adapterType: ctx.adapterType,
+ status: summarizeStatus(checks),
+ checks,
+ testedAt: new Date().toISOString(),
+ };
+}
+ |
+ Press n or j to go to the next uncovered block, b, p or k for the previous block. +
+ +| 1 +2 +3 +4 +5 +6 +7 +8 +9 +10 +11 +12 +13 +14 +15 +16 +17 +18 +19 +20 +21 +22 +23 +24 +25 +26 +27 +28 +29 +30 +31 +32 +33 +34 +35 +36 +37 +38 +39 +40 +41 +42 +43 +44 +45 +46 +47 +48 +49 +50 +51 +52 +53 +54 +55 +56 +57 +58 +59 +60 +61 +62 +63 +64 +65 +66 +67 +68 +69 +70 +71 +72 +73 +74 +75 +76 +77 +78 +79 +80 +81 +82 +83 +84 +85 +86 +87 +88 +89 +90 +91 +92 +93 +94 +95 +96 +97 +98 +99 +100 +101 +102 +103 +104 +105 +106 +107 +108 +109 +110 +111 +112 +113 +114 +115 +116 +117 +118 +119 +120 +121 +122 +123 +124 +125 +126 +127 +128 +129 +130 +131 +132 +133 +134 +135 +136 +137 +138 +139 +140 +141 +142 +143 +144 +145 +146 +147 +148 +149 +150 +151 +152 +153 +154 +155 +156 +157 +158 +159 | + + + + + + + + + + + + + + + + + +48x +43x + + + +16x + + + +4x +1x +1x + +1x + + + +4x + + + + + + + + +20x +20x + +2x + + + + +20x +20x +2x + + +18x +20x +2x + + + + + + + + + +16x +7x +7x +7x +7x +6x +6x +6x +6x +2x +2x +4x +2x +2x +2x +2x + + + + + + + + + + + + + +7x + + +9x +4x +4x +4x +4x +4x +4x +4x +4x +1x +1x +3x +3x +3x +3x +3x +2x +1x +1x +1x +2x +2x + +1x + +3x + + +4x + + +5x +4x +4x +4x +4x +4x +4x +4x +4x +4x +4x + + + + + + + + + + + + + +1x + + | /**
+ * Self-contained stdout parser for Claude stream-json output.
+ * Zero external imports — required by the Paperclip adapter plugin UI parser contract.
+ */
+
+type TranscriptEntry =
+ | { kind: "assistant"; ts: string; text: string }
+ | { kind: "thinking"; ts: string; text: string }
+ | { kind: "user"; ts: string; text: string }
+ | { kind: "tool_call"; ts: string; name: string; input: unknown; toolUseId?: string }
+ | { kind: "tool_result"; ts: string; toolUseId: string; content: string; isError: boolean }
+ | { kind: "init"; ts: string; model: string; sessionId: string }
+ | { kind: "result"; ts: string; text: string; inputTokens: number; outputTokens: number; cachedTokens: number; costUsd: number; subtype: string; isError: boolean; errors: string[] }
+ | { kind: "stderr"; ts: string; text: string }
+ | { kind: "system"; ts: string; text: string }
+ | { kind: "stdout"; ts: string; text: string };
+
+function asRecord(value: unknown): Record<string, unknown> | null {
+ if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+ return value as Record<string, unknown>;
+}
+
+function asNumber(value: unknown): number {
+ return typeof value === "number" && Number.isFinite(value) ? value : 0;
+}
+
+function errorText(value: unknown): string {
+ if (typeof value === "string") return value;
+ const rec = asRecord(value);
+ Iif (!rec) return "";
+ const msg =
+ (typeof rec.message === "string" && rec.message) ||
+ (typeof rec.error === "string" && rec.error) ||
+ (typeof rec.code === "string" && rec.code) ||
+ "";
+ if (msg) return msg;
+ try {
+ return JSON.stringify(rec);
+ } catch {
+ return "";
+ }
+}
+
+function safeJsonParse(text: string): unknown {
+ try {
+ return JSON.parse(text);
+ } catch {
+ return null;
+ }
+}
+
+export function parseStdoutLine(line: string, ts: string): TranscriptEntry[] {
+ const parsed = asRecord(safeJsonParse(line));
+ if (!parsed) {
+ return [{ kind: "stdout", ts, text: line }];
+ }
+
+ const type = typeof parsed.type === "string" ? parsed.type : "";
+ if (type === "system" && parsed.subtype === "init") {
+ return [
+ {
+ kind: "init",
+ ts,
+ model: typeof parsed.model === "string" ? parsed.model : "unknown",
+ sessionId: typeof parsed.session_id === "string" ? parsed.session_id : "",
+ },
+ ];
+ }
+
+ if (type === "assistant") {
+ const message = asRecord(parsed.message) ?? {};
+ const content = Array.isArray(message.content) ? message.content : [];
+ const entries: TranscriptEntry[] = [];
+ for (const blockRaw of content) {
+ const block = asRecord(blockRaw);
+ Iif (!block) continue;
+ const blockType = typeof block.type === "string" ? block.type : "";
+ if (blockType === "text") {
+ const text = typeof block.text === "string" ? block.text : "";
+ if (text) entries.push({ kind: "assistant", ts, text });
+ } else if (blockType === "thinking") {
+ const text = typeof block.thinking === "string" ? block.thinking : "";
+ if (text) entries.push({ kind: "thinking", ts, text });
+ } else if (EblockType === "tool_use") {
+ entries.push({
+ kind: "tool_call",
+ ts,
+ name: typeof block.name === "string" ? block.name : "unknown",
+ toolUseId:
+ typeof block.id === "string"
+ ? block.id
+ : typeof block.tool_use_id === "string"
+ ? block.tool_use_id
+ : undefined,
+ input: block.input ?? {},
+ });
+ }
+ }
+ return entries.length > 0 ? entries : [{ kind: "stdout", ts, text: line }];
+ }
+
+ if (type === "user") {
+ const message = asRecord(parsed.message) ?? {};
+ const content = Array.isArray(message.content) ? message.content : [];
+ const entries: TranscriptEntry[] = [];
+ for (const blockRaw of content) {
+ const block = asRecord(blockRaw);
+ Iif (!block) continue;
+ const blockType = typeof block.type === "string" ? block.type : "";
+ if (blockType === "text") {
+ const text = typeof block.text === "string" ? block.text : "";
+ Eif (text) entries.push({ kind: "user", ts, text });
+ } else if (EblockType === "tool_result") {
+ const toolUseId = typeof block.tool_use_id === "string" ? block.tool_use_id : "";
+ const isError = block.is_error === true;
+ let text = "";
+ if (typeof block.content === "string") {
+ text = block.content;
+ } else if (EArray.isArray(block.content)) {
+ const parts: string[] = [];
+ for (const part of block.content) {
+ const p = asRecord(part);
+ Eif (p && typeof p.text === "string") parts.push(p.text);
+ }
+ text = parts.join("\n");
+ }
+ entries.push({ kind: "tool_result", ts, toolUseId, content: text, isError });
+ }
+ }
+ Eif (entries.length > 0) return entries;
+ }
+
+ if (type === "result") {
+ const usage = asRecord(parsed.usage) ?? {};
+ const inputTokens = asNumber(usage.input_tokens);
+ const outputTokens = asNumber(usage.output_tokens);
+ const cachedTokens = asNumber(usage.cache_read_input_tokens);
+ const costUsd = asNumber(parsed.total_cost_usd);
+ const subtype = typeof parsed.subtype === "string" ? parsed.subtype : "";
+ const isError = parsed.is_error === true;
+ const errors = Array.isArray(parsed.errors) ? parsed.errors.map(errorText).filter(Boolean) : [];
+ const text = typeof parsed.result === "string" ? parsed.result : "";
+ return [{
+ kind: "result",
+ ts,
+ text,
+ inputTokens,
+ outputTokens,
+ cachedTokens,
+ costUsd,
+ subtype,
+ isError,
+ errors,
+ }];
+ }
+
+ return [{ kind: "stdout", ts, text: line }];
+}
+ |