Cluster, step 1 of 5: a gateway in front of independent daemons

.changeset/gateway-check-in-and-lookup.md

@@ -0,0 +1,5 @@
+---
+"@dormice/shared": minor
+---
+
+Wire schemas for a fleet behind a gateway: `lookupSandbox` (a node answers "do you hold this sandbox?" by name or id), the node check-in (`checkInRequestSchema`, readings, build; its `endpoint` is an origin — `endpointSchema` drops a trailing slash and refuses a path), and the gateway's `listNodes` / `removeNode`. The host-metrics schema is split into named parts (`hostReadingSchema`, `dataDiskSchema`, `sandboxStateCountsSchema`) that `hostMetricsResponseSchema` still composes unchanged.

README.md

@@ -243,6 +243,7 @@ pnpm monorepo:
 | `packages/sdk` | `@dormice/sdk` — TypeScript client for the native API |
 | `packages/cli` | `dormice` command-line tool (`dor` for short) |
 | `packages/console` | Web console: React SPA, served by the daemon at `/console` |
+| `packages/gateway` | The fleet's one door in front of one or more daemons: places new sandboxes, finds existing ones by asking the nodes, forwards everything else |
 | `e2e` | Black-box suite: boots the built daemon, drives it over the wire |
 | `examples` | Runnable demos: the native SDK, the official `e2b` package, a resident agent |
 

deploy/dormice-gateway.service

@@ -0,0 +1,26 @@
+# Dormice gateway: the fleet's one door in front of one or more daemons.
+# Configuration lives in /etc/dormice/gateway.env (full-line comments only
+# there — systemd's EnvironmentFile treats an inline comment as part of the
+# value). install.sh does not install this unit yet: the two-role install
+# (gateway + node on one machine, `--role node` elsewhere) is a later step;
+# until then it is copied into place by hand (docs/测试机搭建手册.md). Once it
+# is enabled, install.sh re-runs rebuild the gateway with the daemon and
+# restart this unit before the daemon's, so both run one commit.
+[Unit]
+Description=Dormice gateway (fleet front door)
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+ExecStart=/usr/local/bin/node /opt/dormice/packages/gateway/dist/main.js
+EnvironmentFile=/etc/dormice/gateway.env
+# Crash-only: the gateway holds no sandbox state — nodes check in again
+# within seconds and the cache refills by asking — so restarting it is
+# always safe.
+Restart=always
+RestartSec=3
+# One process per database file. The SQLite lock enforces this; never wrap
+# the gateway in a process manager that forks workers.
+
+[Install]
+WantedBy=multi-user.target

deploy/install.sh

@@ -520,11 +520,15 @@ build_repo() {
   else
     pnpm install --frozen-lockfile
   fi
-  # Build only what a daemon host runs: the server (plus its workspace deps),
-  # the CLI, and the console SPA. The website package is the project's Next.js
-  # marketing site — building it here would cost minutes and import a frontend
-  # toolchain's failure modes into an installer whose job is the daemon.
-  pnpm --filter "@dormice/server..." --filter "@dormice/cli..." --filter "@dormice/console" build
+  # Build only what a Dormice host runs: the server (plus its workspace deps),
+  # the CLI, the console SPA — and the gateway, whose dist must move with the
+  # daemon's on a machine that runs both (the single-machine install is a
+  # fleet of one): a gateway left on an older dist runs it at its next
+  # restart, against a daemon whose check-in it may no longer parse. Seconds
+  # to build. The website package is the project's Next.js marketing site —
+  # building it here would cost minutes and import a frontend toolchain's
+  # failure modes into an installer whose job is the daemon.
+  pnpm --filter "@dormice/server..." --filter "@dormice/gateway..." --filter "@dormice/cli..." --filter "@dormice/console" build
 }
 
 log "Dormice code ($INSTALL_DIR)"
@@ -728,6 +732,16 @@ log 'systemd service'
 cp "$INSTALL_DIR/deploy/dormice.service" /etc/systemd/system/dormice.service
 systemctl daemon-reload
 systemctl enable dormice >/dev/null 2>&1
+# A gateway installed by hand on this machine (deploy/dormice-gateway.service;
+# install.sh does not install it yet) was just rebuilt with the daemon and is
+# restarted first, so the daemon's first check-in lands on the new one: the two
+# processes of a fleet of one run one commit, never two. Running or enabled —
+# a unit started by hand and never enabled is running the old dist just the
+# same.
+if systemctl is-active -q dormice-gateway 2>/dev/null || systemctl is-enabled -q dormice-gateway 2>/dev/null; then
+  systemctl restart dormice-gateway
+  note 'restarted dormice-gateway (hand-installed unit, rebuilt with the daemon)'
+fi
 # Restart, not start: a re-run just built fresh code, and the daemon is
 # crash-only by design — restarting it is always safe.
 systemctl restart dormice

e2e/package.json

@@ -14,6 +14,7 @@
     "e2b": "^2.31.0"
   },
   "devDependencies": {
+    "@dormice/gateway": "workspace:*",
     "@dormice/server": "workspace:*"
   }
 }