worker

type BuilderConfig struct {
	// Image is the buildkitd container image. Defaults to DefaultBuilderImage.
	Image string

	// ConfigPath is a host file path to a buildkitd.toml that will be bind-
	// mounted at /etc/buildkit/buildkitd.toml inside the sidecar. Empty means
	// the sidecar uses its image's built-in defaults.
	ConfigPath string

	// RegistryAuthPath is a host file path to a docker registry auth file
	// (config.json format) mounted into the sidecar at /root/.docker/config.json.
	// Buildkit uses this when pulling base images. Push credentials are
	// typically supplied client-side by the job via buildctl.
	RegistryAuthPath string

	// CacheVolume is an optional named docker volume (or k8s PVC name) mounted
	// at buildkit's state dir for cross-job layer cache. Empty means no cache
	// volume — each sidecar starts clean.
	CacheVolume string
}

type Config struct {
	QueueName        string
	PollInterval     time.Duration
	Concurrency      int
	DryRun           bool
	Store            store.Store
	WorkerID         string // Unique identifier for this worker instance
	ContainerRuntime string // Container runtime backend: "docker", "containerd", or "kubernetes"

	// Log shipping configuration
	ObjectStore      objects.ObjectStore // Object store for logs and artifacts
	LogChunkInterval time.Duration       // Interval for uploading log chunks (default: 3 seconds)

	// Heartbeat configuration
	HeartbeatInterval time.Duration // Interval for sending heartbeats to Corndogs (default: 30 seconds)
	HeartbeatTimeout  time.Duration // Timeout extension for each heartbeat (default: 10 minutes)

	// CancelGrace is how long a graceful cancel waits between SIGTERM
	// (JobRunner.Stop) and a forced Cleanup, checked on the heartbeat tick
	// (default: 60 seconds). Not used for kill (immediate, no grace).
	CancelGrace time.Duration
}

type ContainerdRunner struct {
	// contains filtered or unexported fields
}

type CornDogsWorker struct {
	// contains filtered or unexported fields
}

type DockerRunner struct {
	// contains filtered or unexported fields
}

type HeartbeatFunc func(ctx context.Context) error

type JobConfig struct {
	// Container image to use (e.g., "reactorcide/runner:latest")
	Image string

	// Command to execute in the container. The container's entrypoint is
	// cleared, so this is the full command (e.g., ["sh", "-c", "make build"])
	Command []string

	// Environment variables to inject into the container
	Env map[string]string

	// WorkspaceDir is the host directory to mount into the container at /job
	WorkspaceDir string

	// SourceDir is an optional host directory to mount at /job/src in the container.
	// Used by run-local to mount user's source into the standard production layout.
	SourceDir string

	// SourceMountPath is the container path where SourceDir is mounted. Defaults
	// to /job/src when empty.
	SourceMountPath string

	// WorkingDir is the working directory inside the container (default: /job)
	WorkingDir string

	// Capabilities declares what the job needs from the runtime environment.
	// Each runner interprets these appropriately for its environment.
	// See CapabilityDocker, CapabilityGPU constants.
	Capabilities []string

	// RunAsUser optionally overrides the container user ("uid:gid"). When
	// empty, runners default to RunnerUser. Capabilities provision runtime
	// services/privileges but do not implicitly change the job user.
	// run-local sets this to the host uid so bind-mounted sources are writable.
	RunAsUser string

	// ExtraMounts are additional bind mounts in "hostpath:containerpath[:ro]"
	// format. Used by run-local to inject a synthetic /etc/passwd and
	// /etc/group for the host uid so tools like ssh find a valid user entry.
	ExtraMounts []string

	// VCSAuth contains per-job checkout credential files. Docker/containerd
	// jobs read these from WorkspaceDir; Kubernetes jobs materialize them as
	// a short-lived Secret copied into an emptyDir.
	VCSAuth *VCSAuthConfig

	// Timeout for the job execution (0 = no timeout)
	TimeoutSeconds int

	// Resource limits
	CPULimit    string // e.g., "1.0" for 1 CPU
	MemoryLimit string // e.g., "512Mi" or "1Gi"

	// Job metadata (for labeling/tagging)
	JobID     string
	QueueName string
}

type JobContext struct {
	Job       *models.Job
	StartTime time.Time
	WorkDir   string
	Cancel    context.CancelFunc
}

type JobExecutionContext struct {
	HeartbeatFunc HeartbeatFunc // Optional: function to call for sending heartbeats
}

type JobProcessor struct {
	// contains filtered or unexported fields
}

type JobProcessorConfig struct {
	ObjectStore       objects.ObjectStore
	LogChunkInterval  time.Duration
	HeartbeatInterval time.Duration
	HeartbeatTimeout  time.Duration
	RetryConfig       *RetryConfig

	// CancelGrace is how long a graceful cancel (JobRunner.Stop) waits
	// between SIGTERM and the runner's own forced kill, checked on each
	// heartbeat tick alongside the cancel-status poll (default: 60s, see
	// DefaultCancelGrace).
	CancelGrace time.Duration

	// Publisher, if non-nil, is threaded into each LogShipper so chunk
	// flushes trigger NOTIFY events to WebSocket subscribers.
	Publisher *pubsub.Publisher

	// Optional: Callbacks for log updates and heartbeats
	OnLogUpdate func(jobID, objectKey string, bytesWritten int64) error

	// Secrets configuration
	// SecretsKeyManager is the master key manager for decrypting org keys
	SecretsKeyManager *secrets.MasterKeyManager
	// SecretsStorageType determines where secrets are stored: "database" (default), "local", or "none"
	SecretsStorageType string
	// SecretsLocalPath is the path for local secrets storage (only used when SecretsStorageType="local")
	SecretsLocalPath string
	// SecretsLocalPassword is the password for local secrets storage
	SecretsLocalPassword string
}

type JobProcessorInterface interface {
	ProcessJob(ctx context.Context, job *models.Job) *JobResult
	ProcessJobWithContext(ctx context.Context, job *models.Job, execCtx *JobExecutionContext) *JobResult
}

type JobResult struct {
	ExitCode           int
	Output             string
	Error              string
	LogsObjectKey      string
	ArtifactsObjectKey string
	Duration           time.Duration
	RetryCount         int    // Number of retry attempts made
	Retryable          bool   // Whether the failure was retryable
	WorkspaceDir       string // Host path to workspace directory; caller must clean up via os.RemoveAll

	// Cancelled is true when the cancel-poll observed the job's DB status
	// flip to "cancelling" during execution and drove the container to stop
	// (gracefully or via kill) itself, rather than the job command exiting
	// on its own. Callers should set the job's terminal status to
	// "cancelled" rather than deriving it from ExitCode, which is not
	// meaningful for a runner-initiated stop (see JobRunner.Stop, Killed).
	Cancelled bool

	// Killed is true when Cancelled is true and the cancel was an admin
	// kill (immediate force-Cleanup, no SIGTERM grace) rather than a
	// graceful cancel (JobRunner.Stop).
	Killed bool
}

type JobRunner interface {
	// SpawnJob creates and starts a job container with the specified configuration
	// Returns a unique job ID/handle and any error encountered
	SpawnJob(ctx context.Context, config *JobConfig) (string, error)

	// StreamLogs streams stdout/stderr from a running job container
	// Returns separate readers for stdout and stderr
	StreamLogs(ctx context.Context, jobID string) (stdout io.ReadCloser, stderr io.ReadCloser, err error)

	// WaitForCompletion blocks until the job container exits
	// Returns the exit code and any error encountered
	WaitForCompletion(ctx context.Context, jobID string) (int, error)

	// Stop requests a graceful shutdown of a running job: SIGTERM to the
	// container's PID 1 (giving runnerlib's SIGTERM trap a chance to run
	// PluginPhase.CLEANUP/ON_ERROR and cleanup_vcs_auth), then a forced kill
	// if the container/pod hasn't exited within grace. Stop does not remove
	// the container/pod — callers still call Cleanup afterward (WaitForCompletion
	// unblocking is what tells the caller it's safe to do so).
	//
	// grace == 0 requests immediate forced termination (no SIGTERM wait) —
	// used by the admin "kill" path when it needs an unambiguous immediate
	// stop rather than going through Cleanup directly (e.g. to unblock a
	// stuck WaitForCompletion caller). Cleanup remains the primary "kill"
	// primitive at the job_processor/corndogs_worker layer (see AGENTS.md /
	// UI_AUTH_PLAN.md Cancel vs Kill) — Stop(grace=0) exists so runner
	// backends have a single, testable primitive for "terminate now".
	//
	// Calling Stop on a container/pod that has already exited or been
	// removed must be a safe no-op (implementations should tolerate
	// "not found" style errors rather than returning them as failures),
	// since the worker's cancel-poll and the container's own natural
	// completion can race.
	Stop(ctx context.Context, jobID string, grace time.Duration) error

	// Cleanup removes the job container and associated resources
	// Should be called after the job completes (success or failure)
	Cleanup(ctx context.Context, jobID string) error
}

type JobSpec struct {
	// Name is a human-readable name for the job
	Name string `json:"name" yaml:"name"`

	// Command is the full command to execute.
	// Single-line commands are parsed and split on whitespace.
	// Multiline commands are wrapped with "sh -c" by default (see CommandPrefix).
	Command string `json:"command" yaml:"command"`

	// CommandPrefix overrides the default shell wrapper for multiline commands.
	// Default is "sh -c". Examples: "bash -c", "zsh -c", "/bin/ash -c"
	// Only applies to multiline commands that don't already start with a shell invocation.
	CommandPrefix string `json:"command_prefix" yaml:"command_prefix"`

	// Image is the container image to use (defaults to DefaultRunnerImage)
	Image string `json:"image" yaml:"image"`

	// Environment variables to set in the container
	// Values can contain ${secret:path:key} references that get resolved
	Environment map[string]string `json:"environment" yaml:"environment"`

	// Source defines how to prepare the source code
	Source *SourceSpec `json:"source" yaml:"source"`

	// WorkingDir is the working directory inside the container (default: /job)
	WorkingDir string `json:"working_dir" yaml:"working_dir"`

	// CodeDir is where source code is expected inside the job container.
	// run-local mounts local code here; runnerlib checks out remote source here.
	CodeDir string `json:"code_dir" yaml:"code_dir"`

	// JobDir is the directory runnerlib treats as the job working directory.
	// Defaults to CodeDir when empty.
	JobDir string `json:"job_dir" yaml:"job_dir"`

	// Capabilities declares what the job needs from the runtime environment.
	// The runner interprets these based on its environment:
	//   - "docker": Access to build/push container images
	//               DockerRunner: mounts /var/run/docker.sock
	//               KubernetesRunner: uses DinD sidecar or hostPath
	//   - "gpu": Access to GPU resources (future - not yet implemented)
	//            DockerRunner: --gpus all
	//            KubernetesRunner: nvidia.com/gpu resource request
	Capabilities []string `json:"capabilities" yaml:"capabilities"`

	// Timeout in seconds (0 = no timeout)
	TimeoutSeconds int `json:"timeout_seconds" yaml:"timeout_seconds"`

	// Resource limits
	CPULimit    string `json:"cpu_limit" yaml:"cpu_limit"`
	MemoryLimit string `json:"memory_limit" yaml:"memory_limit"`

	// RunAs controls the container user for deployed workers. run-local uses
	// this only as a fallback after run_local and CLI overrides.
	RunAs *RunAsSpec `json:"run_as" yaml:"run_as"`

	// DisableRunLocal marks this job as remote-only. run-local refuses to
	// execute jobs with this set — used for jobs that fundamentally need CI
	// state (PR diff base, push-back-to-remote with a PAT, etc.).
	DisableRunLocal bool `json:"disable_run_local" yaml:"disable_run_local"`

	// RunLocal holds settings that only affect `reactorcide run-local`. The
	// worker ignores this block entirely (ToJobConfig never reads it), so it's
	// the place to pin local-only behavior — e.g. the container uid — without
	// changing how the job runs in CI. Defining it here makes a job behave
	// consistently across local invocations without per-command flags.
	RunLocal *RunLocalSpec `json:"run_local" yaml:"run_local"`
}

type KubernetesRunner struct {
	// contains filtered or unexported fields
}

type KubernetesRunnerConfig struct {
	Namespace        string   // Namespace for job pods (default: current namespace)
	ServiceAccount   string   // Service account for job pods (default: "default")
	RunnerImage      string   // Default runner image if job doesn't specify one
	DindImage        string   // Docker-in-Docker sidecar image (default: "docker:27-dind")
	ImagePullSecrets []string // Image pull secrets for private registries
	NodeName         string   // Node to schedule job pods on (for workspace sharing via HostPath)
}

type LifecycleManager struct {
	// contains filtered or unexported fields
}

type LogEntry struct {
	Timestamp string `json:"timestamp"`
	Stream    string `json:"stream"`
	Level     string `json:"level,omitempty"`
	Message   string `json:"message"`
}

type LogShipper struct {
	// contains filtered or unexported fields
}

type LogShipperConfig struct {
	ObjectStore     objects.ObjectStore
	JobID           string
	StreamType      string // "stdout" or "stderr"
	ChunkInterval   time.Duration
	OnChunkUploaded func(objectKey string, bytesWritten int64) error // Callback for chunk uploads
	Publisher       *pubsub.Publisher                                // optional: NOTIFY WS clients when a chunk is flushed
}

type PodStartupError struct {
	Reason  string
	Message string
}

type ResourceMetrics struct {
	Timestamp time.Time `json:"timestamp"`

	// CPU metrics
	CPUPercent float64 `json:"cpu_percent"`
	CPUCores   int     `json:"cpu_cores"`
	GoRoutines int     `json:"go_routines"`

	// Memory metrics
	MemoryUsedMB  uint64  `json:"memory_used_mb"`
	MemoryTotalMB uint64  `json:"memory_total_mb"`
	MemoryPercent float64 `json:"memory_percent"`
	HeapAllocMB   uint64  `json:"heap_alloc_mb"`
	HeapSysMB     uint64  `json:"heap_sys_mb"`

	// Job metrics
	ActiveJobs     int   `json:"active_jobs"`
	MaxConcurrency int   `json:"max_concurrency"`
	JobsProcessed  int64 `json:"jobs_processed"`
	JobsFailed     int64 `json:"jobs_failed"`

	// Worker metrics
	WorkerID    string        `json:"worker_id"`
	Uptime      time.Duration `json:"uptime"`
	LastJobTime *time.Time    `json:"last_job_time"`
}

type ResourceMonitor struct {
	// contains filtered or unexported fields
}

type RetryConfig struct {
	MaxRetries     int           // Maximum number of retry attempts
	InitialDelay   time.Duration // Initial delay between retries
	MaxDelay       time.Duration // Maximum delay between retries
	BackoffFactor  float64       // Exponential backoff factor (e.g., 2.0)
	JitterFraction float64       // Fraction of delay to add as random jitter (0.0-1.0)
}

type RetryableError struct {
	Err       error
	Retryable bool
	Reason    string
}

type RunAsSpec struct {
	// User accepts "runner", "root", or numeric "uid[:gid]". "host" is
	// intentionally run-local-only and is not accepted by deployed workers.
	User string `json:"user" yaml:"user"`
}

type RunLocalSpec struct {
	// AsRunner runs the job container as the image's conventional runner uid
	// (1001:1001), matching the worker, instead of the host uid. This gives
	// sudo and HOME parity for jobs that rely on the image's runner user.
	AsRunner bool `json:"as_runner" yaml:"as_runner"`

	// User pins an explicit uid[:gid] for the job container (e.g. "1001:1001").
	// Takes precedence over AsRunner when both are set. Empty means unset.
	User string `json:"user" yaml:"user"`
}

type RunnerBackend string

type SecretOverride struct {
	Key         string
	OldValue    string // The ${secret:...} reference
	NewValue    string // The plaintext value
	OverlayFile string
}

type SecretResolutionResult struct {
	// Resolved contains all environment variables with secrets resolved
	Resolved map[string]string
	// SecretValues contains the actual secret values for masking
	SecretValues []string
	// SecretEnvNames contains the names of env vars that contained secret references
	SecretEnvNames []string
}

type SourceSpec struct {
	Type string `json:"type" yaml:"type"` // git, copy, none
	URL  string `json:"url" yaml:"url"`
	Ref  string `json:"ref" yaml:"ref"`
	Path string `json:"path" yaml:"path"` // for copy type
}

type TriggerProcessor struct {
	// contains filtered or unexported fields
}

type VCSAuthConfig struct {
	ContainerDir string
	GitConfig    string
	Credentials  string
	SecretValues []string
}

type Worker struct {
	// contains filtered or unexported fields
}