fix(orion): reclaim Antares overlays and reject builds under disk pressure (#2150)

* fix(orion): return all tasks for a CL instead of Multiple tasks

GET /v2/task/{cl} now returns Vec<OrionTaskDTO> (empty when none), so repeated
pushes no longer break Checks. Also document regenerating gitmono.json /
generated.ts via moon/script/gen-client, and bump tokio-stream to 0.1.19.

* fix(orion): reclaim Antares overlays and reject builds under disk pressure

Prevent long-lived VMs from filling the guest root FS (which drops
WebSocket heartbeats and marks workers Lost) by deleting upper/cl after
umount, pruning orphans on runner start, and refusing TaskBuild when
usage exceeds the reject threshold. Also raise default image_disk_gb to 50.

* feat(orion): stream runner startup logs to the /oc UI

Proxy orion-scheduler's /logs/orion/stream through mono as admin-only SSE,
and show live provision/startup output on the Orion Clients page after Start Runner.

* fix(orion): drop DashMap guard before await on build dispatch

Holding workers.get_mut across DB awaits on retry could stall the tokio
runtime under heartbeat/health-check contention. Extract claim_worker_for_build
and cover with a concurrency regression test.

* fix clippy

* fix ui fmt

Author: benjamin-747

.github/workflows/mono-engine-deploy.yml

@@ -128,7 +128,7 @@ jobs:
 
   deploy-aws:
     needs: manifest
-    if: ${{ github.repository == 'gitmono-dev/mega' }}
+    if: false # disabled
     runs-on: ubuntu-latest
     permissions:
       contents: read

.github/workflows/orion-server-deploy.yml

@@ -118,7 +118,7 @@ jobs:
 
   deploy-aws:
     needs: manifest
-    if: ${{ github.repository == 'gitmono-dev/mega' }}
+    if: false # disabled
     runs-on: ubuntu-latest
     permissions:
       contents: read

.github/workflows/web-deploy.yml

@@ -128,7 +128,7 @@ jobs:
 
   deploy-aws:
     needs: manifest
-    if: ${{ github.repository == 'gitmono-dev/mega' }}
+    if: false # disabled
     runs-on: ubuntu-latest
     permissions:
       contents: read

.github/workflows/web-sync-server-deploy.yml

@@ -68,7 +68,7 @@ jobs:
 
   deploy-aws:
     needs: build-and-push
-    if: ${{ github.repository == 'gitmono-dev/mega' }}
+    if: false # disabled
     runs-on: ubuntu-latest
     strategy:
       matrix:

Cargo.lock

@@ -54,7 +54,7 @@ clap = "4.6.4"
 
 #====
 tokio = "1.53.1"
-tokio-stream = "0.1.18"
+tokio-stream = "0.1.19"
 tokio-util = "0.7.19"
 async-trait = "0.1.89"
 async-stream = "0.3.6"

Cargo.toml

@@ -11,9 +11,10 @@ pub struct AdminListResponse {
     pub admins: Vec<String>,
 }
 
-/// Request body for generating `.mega_cedar.json` content from admin usernames.
+/// Request body for generating `.mega_cedar.json` content from admin GitHub logins.
 #[derive(Debug, Deserialize, ToSchema)]
 pub struct GenerateCedarRequest {
+    /// GitHub login names used as Cedar `User` euids (e.g. `octocat`).
     pub admins: Vec<String>,
 }
 

ceres/src/model/admin.rs

@@ -10,7 +10,7 @@ path = "src/lib.rs"
 
 [dependencies]
 common = { workspace = true }
-reqwest = { workspace = true, features = ["json"] }
+reqwest = { workspace = true, features = ["json", "stream"] }
 anyhow = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }

clients/orion-scheduler-client/Cargo.toml

@@ -128,6 +128,60 @@ impl OrionSchedulerHttpClient {
             ))
         }
     }
+
+    /// Open an SSE stream of live Orion runner logs (`GET /logs/orion/stream`).
+    ///
+    /// Prefer `vm_id`; when absent, `domain` is used. At least one must be set.
+    /// The returned response body is a long-lived `text/event-stream` — do not
+    /// apply a short request timeout.
+    pub async fn stream_orion_logs(
+        &self,
+        vm_id: Option<&str>,
+        domain: Option<&str>,
+    ) -> anyhow::Result<reqwest::Response> {
+        if vm_id.is_none() && domain.is_none() {
+            return Err(anyhow::anyhow!(
+                "stream_orion_logs requires vm_id or domain"
+            ));
+        }
+
+        let mut url = format!("{}/logs/orion/stream?", self.base_url);
+        let mut params: Vec<String> = Vec::new();
+        if let Some(id) = vm_id {
+            params.push(format!("vm_id={}", urlencoding_query(id)));
+        }
+        if let Some(d) = domain {
+            params.push(format!("domain={}", urlencoding_query(d)));
+        }
+        url.push_str(&params.join("&"));
+
+        let req = self.client.get(&url);
+        let res = self.auth_headers(req).send().await?;
+        let status = res.status();
+        if status.is_success() {
+            Ok(res)
+        } else {
+            let body = res.text().await.unwrap_or_default();
+            Err(anyhow::anyhow!(
+                "Scheduler stream_orion_logs failed ({}): {}",
+                status,
+                body
+            ))
+        }
+    }
+}
+
+fn urlencoding_query(value: &str) -> String {
+    let mut out = String::with_capacity(value.len());
+    for b in value.bytes() {
+        match b {
+            b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'_' | b'.' | b'~' => {
+                out.push(b as char)
+            }
+            _ => out.push_str(&format!("%{b:02X}")),
+        }
+    }
+    out
 }
 
 #[cfg(test)]
@@ -139,4 +193,10 @@ mod tests {
         let client = OrionSchedulerHttpClient::new("http://127.0.0.1:8080/", "");
         assert_eq!(client.base_url, "http://127.0.0.1:8080");
     }
+
+    #[test]
+    fn urlencoding_query_encodes_reserved_bytes() {
+        assert_eq!(urlencoding_query("a b"), "a%20b");
+        assert_eq!(urlencoding_query("orion.gitmega.com"), "orion.gitmega.com");
+    }
 }

clients/orion-scheduler-client/src/http_client.rs

@@ -1,4 +1,4 @@
-//! HTTP client for orion-scheduler VM provisioning (`/webhook`, `/status`, `/vms/{id}`).
+//! HTTP client for orion-scheduler VM provisioning (`/webhook`, `/status`, `/vms/{id}`, logs SSE).
 
 mod http_client;
 
@@ -95,4 +95,13 @@ impl OrionSchedulerClient {
     pub async fn get_status(&self) -> anyhow::Result<SchedulerStatusResponse> {
         self.http.get_status().await
     }
+
+    /// Proxy-friendly SSE stream of runner / orion-client startup logs.
+    pub async fn stream_orion_logs(
+        &self,
+        vm_id: Option<&str>,
+        domain: Option<&str>,
+    ) -> anyhow::Result<reqwest::Response> {
+        self.http.stream_orion_logs(vm_id, domain).await
+    }
 }