@magland/mochi 0.3.1 → 0.4.1

package/dist/ci/artifacts.js

@@ -39,6 +39,8 @@ exports.artifactsDir = artifactsDir;
 exports.artifactPath = artifactPath;
 exports.listArtifacts = listArtifacts;
 exports.deploySite = deploySite;
+exports.pruneDeployedArtifacts = pruneDeployedArtifacts;
+exports.installSiteFromTar = installSiteFromTar;
 const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
@@ -122,6 +124,11 @@ function run(cmd, args) {
 // path is checked to be inside it, and only then does the new site replace
 // the old one by rename. A half-extracted archive therefore never becomes the
 // live site, and a crafted archive cannot write outside the vault.
+//
+// Once the site is in place the artifact is deleted. The site directory is
+// its copy, and keeping both doubled the cost of every deploy for as long as
+// the run was retained: on a vault that deploys on every push, superseded
+// site archives were most of the disk.
 async function deploySite(root, collection, repo, n, artifactName) {
     if (!(0, scan_1.isValidName)(collection) || !(0, scan_1.isValidName)(repo))
         throw new ArtifactError('invalid repository');
@@ -129,6 +136,79 @@ async function deploySite(root, collection, repo, n, artifactName) {
     if (!tar || !fs.existsSync(tar)) {
         throw new ArtifactError(`no artifact named ${artifactName} in run #${n}`);
     }
+    const result = await installSiteFromTar(root, collection, repo, tar, {
+        unwrapPagesArtifact: true,
+        what: `artifact ${artifactName}`,
+    });
+    fs.rmSync(tar, { force: true });
+    return result;
+}
+// The name of the artifact a deploy-pages step published, when a completed
+// job shows one that succeeded. The step states line up with the steps, one
+// for one, as the runner reports them. A name written as an expression cannot
+// be resolved after the fact, so such a step answers nothing and its artifact
+// is left alone.
+function deployedArtifactNames(job) {
+    const names = [];
+    job.steps.forEach((raw, i) => {
+        const step = (raw ?? {});
+        if (typeof step.uses !== 'string' || !/^actions\/deploy-pages(@|$)/i.test(step.uses.trim()))
+            return;
+        if (job.stepStates[i]?.conclusion !== 'success')
+            return;
+        const given = step.with?.artifact_name;
+        const name = typeof given === 'string' && given.trim() !== '' ? given.trim() : 'github-pages';
+        if (!name.includes('${{') && isValidArtifactName(name))
+            names.push(name);
+    });
+    return names;
+}
+/**
+ * Delete the artifacts that completed runs have already deployed as the
+ * repository's site, and return how many bytes that freed.
+ *
+ * deploySite now deletes its artifact itself, so this is for runs from before
+ * it did, and for a deletion that did not happen (the server stopping between
+ * the swap and the rm). Only runs that are completed are touched, and only
+ * artifacts a deploy-pages step reported publishing: an artifact that was
+ * uploaded and never deployed is left for retention to decide.
+ */
+function pruneDeployedArtifacts(root, collection, repo) {
+    let freed = 0;
+    for (const r of (0, runs_1.listRuns)(root, collection, repo)) {
+        if (r.status !== 'completed')
+            continue;
+        for (const jobId of r.jobs) {
+            const job = (0, runs_1.readJob)(root, collection, repo, r.number, jobId);
+            if (!job || job.status !== 'completed')
+                continue;
+            for (const name of deployedArtifactNames(job)) {
+                const tar = artifactPath(root, collection, repo, r.number, name);
+                if (!tar)
+                    continue;
+                try {
+                    freed += fs.statSync(tar).size;
+                    fs.rmSync(tar, { force: true });
+                }
+                catch {
+                    // already gone
+                }
+            }
+        }
+    }
+    return freed;
+}
+/**
+ * Replace a repository's site directory with the contents of a tar archive:
+ * extracted into a scratch directory beside the site, checked for symlinks
+ * that would escape it, and swapped into place in one rename with the
+ * previous site kept until the swap has succeeded. The same path publishes a
+ * workflow's artifact (above) and a 'repository' site's tree
+ * (src/sitepublish.ts); the archive is untrusted in both cases.
+ */
+async function installSiteFromTar(root, collection, repo, tar, opts) {
+    if (!(0, scan_1.isValidName)(collection) || !(0, scan_1.isValidName)(repo))
+        throw new ArtifactError('invalid repository');
     const dir = (0, layout_1.repoPath)(root, collection, `${(0, scan_1.displayName)(repo)}.site`);
     const scratch = `${dir}.incoming-${process.pid}`;
     const previous = `${dir}.previous-${process.pid}`;
@@ -147,7 +227,7 @@ async function deploySite(root, collection, repo, n, artifactName) {
         // artifact holding exactly one artifact.tar is unwrapped once more. This
         // is what makes the real actions/upload-pages-artifact work unchanged.
         const entries = fs.readdirSync(scratch);
-        if (entries.length === 1 && entries[0] === 'artifact.tar') {
+        if (opts.unwrapPagesArtifact && entries.length === 1 && entries[0] === 'artifact.tar') {
             const inner = path.join(scratch, 'artifact.tar');
             const unwrapped = `${scratch}.inner`;
             fs.rmSync(unwrapped, { recursive: true, force: true });
@@ -178,7 +258,7 @@ async function deploySite(root, collection, repo, n, artifactName) {
         };
         walk(scratch);
         if (files === 0)
-            throw new ArtifactError(`artifact ${artifactName} contains no files`);
+            throw new ArtifactError(`${opts.what} contains no files`);
         fs.rmSync(previous, { recursive: true, force: true });
         const had = fs.existsSync(dir);
         if (had)

package/dist/ci/engine.js

@@ -98,18 +98,21 @@ async function discoverWorkflows(repo, sha) {
                 continue;
             if (!/\.(yml|yaml)$/i.test(e.name))
                 continue;
-            byBase.set(e.name, { path: `${dir}/${e.name}` });
+            byBase.set(e.name, { path: `${dir}/${e.name}`, size: e.size ?? 0 });
         }
     }
     const out = [];
-    for (const [, { path: p }] of [...byBase.entries()].sort((a, b) => a[0].localeCompare(b[0]))) {
+    for (const [, { path: p, size }] of [...byBase.entries()].sort((a, b) => a[0].localeCompare(b[0]))) {
+        // Judged from the listing's size, before the file is read: a workflow
+        // file the size of the machine would otherwise be held in memory to be
+        // found too large.
+        if (size > MAX_WORKFLOW_SIZE) {
+            out.push({ path: p, source: '', error: 'workflow file is too large' });
+            continue;
+        }
         let source;
         try {
             const buf = await repo.catBlob(sha, p);
-            if (buf.length > MAX_WORKFLOW_SIZE) {
-                out.push({ path: p, source: '', error: 'workflow file is too large' });
-                continue;
-            }
             source = buf.toString('utf8');
         }
         catch {
@@ -687,8 +690,6 @@ class CiEngine {
         this.maybeCompleteRun(ar);
     }
     jobCondition(ar, j, needs, st) {
-        if (j.if === undefined)
-            return st.allSucceeded;
         const env = {
             contexts: {
                 github: this.githubContext(ar.run, ar.collection, ar.repo, j.key, ''),
@@ -703,7 +704,7 @@ class CiEngine {
                 always: () => true,
             },
         };
-        return (0, expr_1.evalCondition)(j.if, env);
+        return (0, expr_1.evalGatedCondition)(j.if, st.allSucceeded, env);
     }
     completeJob(ar, j, conclusion) {
         j.status = 'completed';
@@ -780,17 +781,22 @@ class CiEngine {
         }
         return null;
     }
-    // Try to lease a job now; returns null when nothing matches.
-    acquire(runnerName, labels, allow, serverUrl) {
+    // Try to lease a job now; returns null when nothing matches. `limitMinutes`
+    // is the runner's own ceiling on how long a job may run there; see leaseJob.
+    acquire(runnerName, labels, allow, serverUrl, limitMinutes) {
         const found = this.runnableJob(labels, allow);
         if (!found)
             return null;
-        return this.leaseJob(found.ar, found.job, runnerName, serverUrl);
+        return this.leaseJob(found.ar, found.job, runnerName, serverUrl, limitMinutes);
     }
     // Lease one chosen job to a runner (registered or manual session) and build
     // the spec it executes from. The caller has already decided the job may go
     // to this runner; everything from here on is the same for both kinds.
-    leaseJob(ar, job, runnerName, serverUrl) {
+    //
+    // `limitMinutes` is the longest the runner taking the job allows one to run,
+    // or null for a manual session, which has no registration to carry one and a
+    // person watching it instead.
+    leaseJob(ar, job, runnerName, serverUrl, limitMinutes) {
         job.status = 'running';
         job.attempts += 1;
         job.startedAt = job.startedAt ?? nowIso();
@@ -823,6 +829,13 @@ class CiEngine {
                 // default stands
             }
         }
+        // The runner's limit is a ceiling on what the workflow asked for, not a
+        // default it could override: the job runs on somebody else's machine, and
+        // six hours of a hung step is the operator's cost. A job asking for less
+        // than the ceiling keeps what it asked for, which is what makes
+        // `timeout-minutes` still worth writing.
+        if (typeof limitMinutes === 'number')
+            timeout = Math.min(timeout, limitMinutes);
         // A private repository cannot be cloned anonymously, so a job for one
         // carries an ephemeral read token for exactly that repository (see
         // src/jobtoken.ts), living a little longer than the job may run. A public
@@ -866,8 +879,8 @@ class CiEngine {
     // then released again with nobody to run it. A runner stopped and started
     // within one poll would otherwise see its first job cancelled before it
     // could ask for one.
-    waitForJob(runnerName, labels, allow, serverUrl, timeoutMs, gone) {
-        const first = this.acquire(runnerName, labels, allow, serverUrl);
+    waitForJob(runnerName, labels, allow, serverUrl, limitMinutes, timeoutMs, gone) {
+        const first = this.acquire(runnerName, labels, allow, serverUrl, limitMinutes);
         if (first)
             return Promise.resolve(first);
         if (gone?.aborted)
@@ -878,7 +891,7 @@ class CiEngine {
                 resolve(null);
             }, timeoutMs);
             const onWake = () => {
-                const spec = this.acquire(runnerName, labels, allow, serverUrl);
+                const spec = this.acquire(runnerName, labels, allow, serverUrl, limitMinutes);
                 if (spec) {
                     cleanup();
                     resolve(spec);
@@ -1039,7 +1052,7 @@ class CiEngine {
                 // the moment the job completes, and who ran a job is a fact about the
                 // job. Set before leaseJob so its save persists it.
                 j.manual = { user: grant.mintedBy, host: grant.host ?? '' };
-                return { kind: 'job', spec: this.leaseJob(ar, j, name, serverUrl) };
+                return { kind: 'job', spec: this.leaseJob(ar, j, name, serverUrl, null) };
             }
         }
         const queued = matching.some((j) => j.status === 'queued');

package/dist/ci/expr.js

@@ -20,6 +20,7 @@ exports.render = render;
 exports.renderDeep = renderDeep;
 exports.evalCondition = evalCondition;
 exports.mentionsStatusOverride = mentionsStatusOverride;
+exports.evalGatedCondition = evalGatedCondition;
 class ExprError extends Error {
 }
 exports.ExprError = ExprError;
@@ -524,3 +525,16 @@ function evalCondition(cond, env) {
 function mentionsStatusOverride(cond) {
     return /\b(always|failure|cancelled)\s*\(/.test(cond);
 }
+// An `if:` on a step or a job, judged with the status of what came before it.
+// GitHub prepends an implicit `success() &&` unless the condition itself
+// names a status function, so once something has failed a plain
+// `if: github.ref == 'refs/heads/main'` skips however the comparison comes
+// out, while `if: always()` and `if: failure()` are judged on their own
+// terms. An absent condition is the bare gate.
+function evalGatedCondition(cond, succeeded, env) {
+    if (cond === undefined)
+        return succeeded;
+    if (!succeeded && !mentionsStatusOverride(cond))
+        return false;
+    return evalCondition(cond, env);
+}

package/dist/ci/runners.js

@@ -33,12 +33,15 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.RUNNERS_FILE = void 0;
+exports.MAX_JOB_TIMEOUT_MINUTES = exports.DEFAULT_JOB_TIMEOUT_MINUTES = exports.RUNNERS_FILE = void 0;
+exports.runnerJobTimeout = runnerJobTimeout;
+exports.isUsableJobTimeout = isUsableJobTimeout;
 exports.runnersFilePath = runnersFilePath;
 exports.loadRunners = loadRunners;
 exports.hashRunnerToken = hashRunnerToken;
 exports.registerRunner = registerRunner;
 exports.regenerateRunnerToken = regenerateRunnerToken;
+exports.setRunnerJobTimeout = setRunnerJobTimeout;
 exports.setRunnerWake = setRunnerWake;
 exports.removeRunner = removeRunner;
 exports.noteRunnerSeen = noteRunnerSeen;
@@ -60,6 +63,32 @@ const vault_1 = require("../vault");
 //
 // Only a hash of each runner token is stored, as with user tokens.
 exports.RUNNERS_FILE = 'runners.json';
+/**
+ * How long a job may run on a runner that has not been given a limit.
+ *
+ * Twenty minutes rather than GitHub's six hours because the failure this bounds
+ * is a job that hangs: a step waiting on input that never comes, a network call
+ * with no timeout of its own. On a hosted runner that costs someone else's
+ * money; on a machine an operator registered here it costs theirs, and holds
+ * the runner against every other job in the meantime. A build that genuinely
+ * takes longer is a runner whose limit is raised, deliberately and once.
+ */
+exports.DEFAULT_JOB_TIMEOUT_MINUTES = 20;
+/** The longest a job may run on this runner, whether it was set or defaulted. */
+function runnerJobTimeout(runner) {
+    return runner.jobTimeoutMinutes ?? exports.DEFAULT_JOB_TIMEOUT_MINUTES;
+}
+/** Four weeks: past this a millisecond delay overflows a signed 32-bit field. */
+exports.MAX_JOB_TIMEOUT_MINUTES = 40320;
+/**
+ * Whether a number may be stored as a runner's job timeout: whole minutes, at
+ * least one, and no more than MAX_JOB_TIMEOUT_MINUTES, past which the runner's
+ * own setTimeout would fire immediately. Refusing an absurd value is kinder
+ * than a limit that does the opposite of what it says.
+ */
+function isUsableJobTimeout(minutes) {
+    return Number.isInteger(minutes) && minutes >= 1 && minutes <= exports.MAX_JOB_TIMEOUT_MINUTES;
+}
 function runnersFilePath(root) {
     return path.join(root, exports.RUNNERS_FILE);
 }
@@ -91,6 +120,13 @@ function normalize(parsed) {
             allow: strings(r.allow, 'allow'),
             createdBy: typeof r.createdBy === 'string' ? r.createdBy : '',
             createdAt: typeof r.createdAt === 'string' ? r.createdAt : '',
+            // An unusable value is dropped rather than refused, unlike the fields
+            // above whose absence would leave no runner at all: a hand-edited
+            // timeout of "soon" leaves the runner working under the default, which
+            // is the safe direction for a bound.
+            ...(typeof r.jobTimeoutMinutes === 'number' && isUsableJobTimeout(r.jobTimeoutMinutes)
+                ? { jobTimeoutMinutes: r.jobTimeoutMinutes }
+                : {}),
             ...(typeof r.tokenUpdatedAt === 'string' ? { tokenUpdatedAt: r.tokenUpdatedAt } : {}),
             ...(typeof r.wakeUrl === 'string' ? { wakeUrl: r.wakeUrl } : {}),
             ...(typeof r.wakeSecret === 'string' ? { wakeSecret: r.wakeSecret } : {}),
@@ -149,6 +185,7 @@ function registerRunner(root, name, opts) {
             allow: opts.allow,
             createdBy: opts.createdBy,
             createdAt: new Date().toISOString(),
+            ...(opts.jobTimeoutMinutes ? { jobTimeoutMinutes: opts.jobTimeoutMinutes } : {}),
             ...(opts.wake ? { wakeUrl: opts.wake.url, wakeSecret: opts.wake.secret } : {}),
         };
         registry.runners[name] = runner;
@@ -180,6 +217,28 @@ function regenerateRunnerToken(root, name) {
         return { token, runner };
     });
 }
+/**
+ * Set the longest a job may run on this runner, or put it back on the default
+ * with null. Separate from registration, as the wake address is, because it is
+ * the setting most likely to be changed after the fact: the first job that
+ * runs long is when an operator learns the limit is wrong. Returns null if no
+ * runner by that name is registered.
+ */
+function setRunnerJobTimeout(root, name, minutes) {
+    return editRunners(root, () => {
+        const registry = loadRunners(root);
+        const existing = registry.runners[name];
+        if (!existing)
+            return null;
+        const runner = { ...existing };
+        delete runner.jobTimeoutMinutes;
+        if (minutes !== null)
+            runner.jobTimeoutMinutes = minutes;
+        registry.runners[name] = runner;
+        write(root, registry);
+        return runner;
+    });
+}
 /**
  * Point a runner's wake address somewhere, or clear it with null.
  *

package/dist/ci/runs.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.MIN_RUN_AGE_MS = void 0;
 exports.runsDir = runsDir;
 exports.createRun = createRun;
 exports.readRun = readRun;
@@ -185,9 +186,19 @@ function listRuns(root, collection, repoName) {
     runs.sort((a, b) => b.number - a.number);
     return runs;
 }
+/**
+ * A completed run is kept for at least this long, whatever the retention
+ * settings say. A low run count is otherwise at the mercy of a busy hour: a
+ * repository whose workflows fire on every push could lose the run somebody is
+ * still reading, or the one that failed, to the twenty that followed it. Timed
+ * from completion, since a run is history from then on. A constant rather than
+ * a setting, for the reason the sweep's are (see src/maintenance.ts).
+ */
+exports.MIN_RUN_AGE_MS = 24 * 60 * 60 * 1000;
 // Delete completed runs beyond the retention settings. Active runs are never
-// pruned regardless of age.
-function pruneRuns(root, collection, repoName, retain) {
+// pruned regardless of age, and neither is a run completed in the last
+// MIN_RUN_AGE_MS, so `runs` is a floor that a busy day may exceed.
+function pruneRuns(root, collection, repoName, retain, now = Date.now()) {
     const base = runsDir(root, collection, repoName);
     if (!base)
         return;
@@ -196,12 +207,19 @@ function pruneRuns(root, collection, repoName, retain) {
     const doomed = new Set();
     completed.slice(Math.max(0, retain.runs)).forEach((r) => doomed.add(r.number));
     if (retain.days > 0) {
-        const cutoff = Date.now() - retain.days * 24 * 60 * 60 * 1000;
+        const cutoff = now - retain.days * 24 * 60 * 60 * 1000;
         for (const r of completed) {
             if (new Date(r.createdAt).getTime() < cutoff)
                 doomed.add(r.number);
         }
     }
+    for (const r of completed) {
+        const finished = new Date(r.completedAt ?? r.createdAt).getTime();
+        // An unparseable time is treated as old, so a damaged record cannot pin
+        // its run forever.
+        if (Number.isFinite(finished) && now - finished < exports.MIN_RUN_AGE_MS)
+            doomed.delete(r.number);
+    }
     for (const n of doomed) {
         fs.rmSync(path.join(base, String(n)), { recursive: true, force: true });
     }

package/dist/ci/trigger.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.firePush = firePush;
 const scan_1 = require("../scan");
+const sitepublish_1 = require("../sitepublish");
 // One place that turns a branch having moved into a workflow event.
 //
 // A commit made in the browser, a commit made over the API, and a merge are all
@@ -17,12 +18,13 @@ const ZERO = '0'.repeat(40);
  * it, which by this point has already been committed.
  */
 function firePush(root, engine, repo, branch, before, after, actor) {
-    if (!engine)
-        return;
     const gitRepo = (0, scan_1.findRepo)(root, repo.collection, repo.name);
     if (!gitRepo)
         return;
-    engine
-        .handlePush(gitRepo, { ref: `refs/heads/${branch}`, before: before ?? ZERO, after, actor })
+    const ref = `refs/heads/${branch}`;
+    // The site first, then CI: a site published from the repository follows
+    // the branch whichever door the commit came through, engine or no engine.
+    (0, sitepublish_1.publishSiteAfterPush)(root, gitRepo, ref)
+        .then(() => engine?.handlePush(gitRepo, { ref, before: before ?? ZERO, after, actor }))
         .catch((e) => console.error(`CI trigger failed: ${e instanceof Error ? e.message : e}`));
 }

package/dist/ci/views.js

@@ -8,13 +8,13 @@ exports.runnerPage = runnerPage;
 exports.runnerTokenPage = runnerTokenPage;
 exports.runnerWakePage = runnerWakePage;
 const ansi_1 = require("../ansi");
-const avatar_1 = require("../avatar");
 const html_1 = require("../html");
 const icons_1 = require("../icons");
 const render_1 = require("../render");
 const forms_1 = require("../forms");
 const views_1 = require("../views");
 const manual_1 = require("./manual");
+const runners_1 = require("./runners");
 function statusOf(x) {
     if (x.status !== 'completed')
         return x.status === 'running' ? 'running' : 'queued';
@@ -80,7 +80,7 @@ function runsPage(ctx, runs, workflows, selectedWorkflow, flash) {
             : '';
         return (0, html_1.html) `<tr>
 <td class="run-cell">${statusIcon(s)}<span><a href="${actionsBase}/runs/${r.number}"><b>${runTitle(r)}</b></a>
-<div class="muted small run-sub">${r.workflowName} #${r.number}: ${r.event} by ${(0, avatar_1.avatar)(r.actor, 16)}${r.actor}${sha}</div></span></td>
+<div class="muted small run-sub">${r.workflowName} #${r.number}: ${r.event} by ${(0, views_1.userLink)(r.actor, { face: 16 })}${sha}</div></span></td>
 <td class="right muted small"><span class="chip">${(0, icons_1.icon)('git-branch')}${r.refName}</span></td>
 <td class="right muted small">${when}${dur ? (0, html_1.html) ` &middot; ${dur}` : ''}</td>
 </tr>`;
@@ -266,7 +266,7 @@ ${summaryBox}`;
 <div class="run-meta muted small">
   <a href="${actionsBase}?workflow=${encodeURIComponent(run.workflowPath)}">${run.workflowName}</a>
   &middot; #${run.number}
-  &middot; ${run.event} by <span class="run-actor">${(0, avatar_1.avatar)(run.actor, 16)}${run.actor}</span>
+  &middot; ${run.event} by <span class="run-actor">${(0, views_1.userLink)(run.actor, { face: 16 })}</span>
   &middot; <span class="chip">${run.refName}</span>
   ${run.sha ? (0, html_1.html) `&middot; <a class="sha" href="${base}/commit/${run.sha}">${run.sha.slice(0, 7)}</a>` : ''}
   &middot; <a href="${base}/blob/${(0, views_1.encPath)(run.refName)}/${(0, views_1.encPath)(run.workflowPath)}">${run.workflowPath}</a>
@@ -297,6 +297,14 @@ ${(0, views_1.copyRow)(command)}
 </div>`;
     return (0, views_1.layout)(`Run it yourself - ${ctx.collection}/${ctx.repo}`, content, (0, views_1.repoOpts)(ctx, back));
 }
+/** Minutes as an operator reads them: 90 minutes is worth saying as 1h 30m. */
+function minutesLabel(minutes) {
+    if (minutes < 60)
+        return `${minutes} minute${minutes === 1 ? '' : 's'}`;
+    const h = Math.floor(minutes / 60);
+    const m = minutes % 60;
+    return m === 0 ? `${h} hour${h === 1 ? '' : 's'}` : `${h}h ${m}m`;
+}
 // A runner is either working on something, idle but in touch, or not there at
 // all. The third case is the one an operator is usually looking for, so it gets
 // a plain word rather than an empty cell.
@@ -338,6 +346,8 @@ ${(0, views_1.csrfField)(viewer)}
 <p class="muted small">Matched against a job's <code>runs-on</code>. Space or comma separated.</p></div>
 <div class="field"><label for="allow">Repositories</label><input type="text" id="allow" name="allow" placeholder="mycollection/*" required>
 <p class="muted small">Globs over <code>collection/repo</code>. A runner executes whatever those repositories' workflows say, on the machine you start it on, so grant it only what you trust.</p></div>
+<div class="field"><label for="minutes">Job timeout</label><input type="number" id="minutes" name="minutes" min="1" max="${String(runners_1.MAX_JOB_TIMEOUT_MINUTES)}" step="1" placeholder="${String(runners_1.DEFAULT_JOB_TIMEOUT_MINUTES)}">
+<p class="muted small">Minutes a single job may run here, ${String(runners_1.DEFAULT_JOB_TIMEOUT_MINUTES)} by default. A ceiling on what a job's own <code>timeout-minutes</code> may ask for, and changeable afterwards.</p></div>
 <button type="submit" class="btn btn-primary">Register runner</button>
 </form>
 </div>`;
@@ -356,6 +366,7 @@ ${fact('Labels', r.labels.length
 ${fact('Repositories', (0, html_1.html) `<span class="mono">${r.allow.join(' ')}</span>`)}
 ${fact('Registered', (0, html_1.html) `by ${r.createdBy}${r.createdAt ? (0, html_1.html) ` ${(0, render_1.timeTag)(r.createdAt, '')}` : ''}`)}
 ${fact('Token', r.tokenUpdatedAt ? (0, html_1.html) `regenerated ${(0, render_1.timeTag)(r.tokenUpdatedAt, '')}` : (0, html_1.html) `the one issued at registration`)}
+${fact('Job timeout', (0, html_1.html) `${minutesLabel(r.jobTimeout)}${r.jobTimeoutSet ? '' : (0, html_1.html) ` <span class="counter">default</span>`}`)}
 ${fact('Wake', r.wakeUrl ? (0, html_1.html) `<span class="mono">${r.wakeUrl}</span>` : (0, html_1.raw)('<span class="muted">nothing starts this runner</span>'))}
 </div>`;
     const content = (0, html_1.html) `<div class="page-head"><h1>${(0, icons_1.icon)('server', 'icon')}${r.name}</h1></div>
@@ -372,6 +383,16 @@ ${(0, views_1.copyRow)(`mochi runner run --host ${host} --runner-token <token>`)
         : 'nothing yet'}.</p>
 </div>
 <div class="form-box wide" style="margin-top:24px">
+<h2>Job timeout</h2>
+<p class="muted">The longest a single job may run on ${r.name}. It is a ceiling, not a default: a job whose <code>timeout-minutes</code> asks for less keeps what it asked for, and one asking for more, or asking for nothing, is held to this. Reaching it removes the job's container, which fails the step that was running and the job with it.</p>
+<form method="post" action="/admin/runners/${encodeURIComponent(r.name)}/job-timeout">
+${(0, views_1.csrfField)(viewer)}
+<div class="field"><label for="jobTimeout">Minutes</label><input type="number" id="jobTimeout" name="minutes" min="1" max="${String(runners_1.MAX_JOB_TIMEOUT_MINUTES)}" step="1" value="${r.jobTimeoutSet ? String(r.jobTimeout) : ''}" placeholder="${String(runners_1.DEFAULT_JOB_TIMEOUT_MINUTES)}">
+<p class="muted small">Empty means the vault's default of ${String(runners_1.DEFAULT_JOB_TIMEOUT_MINUTES)} minutes. A change applies to the next job this runner takes; one already running keeps the timeout it started with.</p></div>
+<button type="submit" class="btn">${(0, icons_1.icon)('clock')}<span>Save job timeout</span></button>
+</form>
+</div>
+<div class="form-box wide" style="margin-top:24px">
 <h2>Wake address</h2>
 <p class="muted">A runner started with <code>--idle</code> stops when it has had no job for that long, which is how a runner on hardware billed by the minute stops costing anything between runs. It cannot be told that work has arrived, though, so the vault sends a request to this address instead, and whatever is in front of the runner (a Fly proxy, a socket unit) starts it. The request carries a secret and nothing else; a new one is generated when you save an address, and the runner has to be started with it.</p>
 <p class="muted">Sent at most once a minute per runner, however many jobs are waiting, and only when the runner has not been heard from.</p>

package/dist/ci/web.js

@@ -424,6 +424,8 @@ function registerCiWeb(app, root, engine) {
             createdBy: r.createdBy,
             createdAt: r.createdAt,
             tokenUpdatedAt: r.tokenUpdatedAt,
+            jobTimeout: (0, runners_1.runnerJobTimeout)(r),
+            jobTimeoutSet: r.jobTimeoutMinutes !== undefined,
             lastSeen: (0, runners_1.runnerLastSeen)(name),
             running: load.running[name] ?? null,
             wakeUrl: r.wakeUrl ?? null,
@@ -495,10 +497,16 @@ function registerCiWeb(app, root, engine) {
             showError(`'${manual_1.MANUAL_LABEL}' is a reserved label: a job that names it runs only through a command pasted from its run page, never on a registered runner.`);
             return;
         }
+        const minutes = jobTimeoutField(req);
+        if (minutes === 'bad') {
+            showError(`A job timeout is a whole number of minutes from 1 to ${runners_1.MAX_JOB_TIMEOUT_MINUTES}, or empty for the default of ${runners_1.DEFAULT_JOB_TIMEOUT_MINUTES}.`);
+            return;
+        }
         const { token } = (0, runners_1.registerRunner)(root, name, {
             labels: labels.length ? labels : ['ubuntu-latest'],
             allow,
             createdBy: viewer.auth.username,
+            jobTimeoutMinutes: minutes,
         });
         res.type('html').send(ciViews.runnerTokenPage(viewer, name, token, (0, web_1.baseUrlOf)(req)));
     });
@@ -523,6 +531,46 @@ function registerCiWeb(app, root, engine) {
         }
         res.type('html').send(ciViews.runnerTokenPage(viewer, name, issued.token, (0, web_1.baseUrlOf)(req), true));
     });
+    /**
+     * The job timeout a form carried: a number of minutes, null for the default
+     * when the field is empty, or 'bad' for anything else. Empty is a real
+     * answer here rather than a missing one, since the field is always rendered.
+     */
+    function jobTimeoutField(req) {
+        const raw = (0, web_1.field)(req, 'minutes').trim();
+        if (raw === '')
+            return null;
+        if (!/^\d{1,7}$/.test(raw))
+            return 'bad';
+        const n = parseInt(raw, 10);
+        return (0, runners_1.isUsableJobTimeout)(n) ? n : 'bad';
+    }
+    app.post('/admin/runners/:name/job-timeout', form, (req, res) => {
+        const viewer = (0, web_1.requireViewerPost)(root, req, res);
+        if (!viewer)
+            return;
+        if (!(0, session_1.viewerIsAdmin)(viewer)) {
+            (0, web_1.fail)(res, 403, 'Admin access is required to manage runners.', viewer);
+            return;
+        }
+        const name = req.params.name;
+        const existing = (0, runners_1.loadRunners)(root).runners[name];
+        if (!existing) {
+            (0, web_1.send404)(res, `No runner named ${name} is registered.`, viewer);
+            return;
+        }
+        const back = `/admin/runners/${encodeURIComponent(name)}`;
+        const minutes = jobTimeoutField(req);
+        if (minutes === 'bad') {
+            (0, web_1.fail)(res, 400, `A job timeout is a whole number of minutes from 1 to ${runners_1.MAX_JOB_TIMEOUT_MINUTES}, or empty for the default of ${runners_1.DEFAULT_JOB_TIMEOUT_MINUTES}.`, viewer, back);
+            return;
+        }
+        (0, runners_1.setRunnerJobTimeout)(root, name, minutes);
+        const flash = minutes === null
+            ? `${name} is back on the default job timeout of ${runners_1.DEFAULT_JOB_TIMEOUT_MINUTES} minutes.`
+            : `Jobs on ${name} now stop after ${minutes} minute${minutes === 1 ? '' : 's'}.`;
+        res.redirect(`${back}?flash=${encodeURIComponent(flash)}`);
+    });
     // Setting the address and sending a request to it are separate posts
     // because they are separate acts: one changes what is stored, the other
     // starts a machine and waits for it. A single form doing both would make

package/dist/cli/admin-cmd.js

@@ -151,11 +151,48 @@ rename is undone by renaming back.`,
             console.log('Remotes pointing at the old name, and token scopes naming it, need changing.');
         },
     },
+    {
+        path: ['collection', 'edit'],
+        summary: "Change a collection's site alias",
+        description: `The alias is the label that stands in for the collection's name in each of its
+repositories' site hostnames, <repo>--<alias>.<sites host>. Empty means the
+collection's own name where that name is usable as a hostname label, and the
+name rewritten as one otherwise (simulated_instruments becomes
+simulated-instruments), the rewrite being skipped when another collection
+already holds the label it would produce.
+
+Takes ownership of the collection. An alias another collection is already
+reached by is refused, naming it. Changing the alias moves every site in the
+collection to a new origin, and the hostnames they had stop resolving.`,
+        args: [{ name: 'name', required: true }],
+        options: [
+            { name: 'site-alias', type: 'string', value: '<l>', summary: "Alias under the sites host; '' for the default" },
+            output_1.JSON_OPTION,
+            ...target_1.TARGET_OPTIONS,
+        ],
+        async run(inv) {
+            const alias = inv.str('site-alias');
+            if (alias === null)
+                throw new exit_1.CliError('Nothing to change. Pass --site-alias.', exit_1.EXIT_USAGE);
+            const target = await (0, target_1.targetFrom)(inv);
+            const data = await (0, cli_api_1.api)(target, 'PATCH', `/api/collections/${encodeURIComponent(inv.args[0])}`, {
+                siteAlias: alias,
+            });
+            const json = (0, output_1.jsonMode)(inv);
+            if (json.enabled) {
+                (0, output_1.printJson)((0, output_1.pickObject)(data, json.fields));
+                return;
+            }
+            console.log(data.alias
+                ? `Sites in ${data.name} are served under <repo>--${data.alias}`
+                : `${data.name} has no site alias, so nothing in it has a derived hostname`);
+        },
+    },
     {
         path: ['collection', 'delete'],
         summary: 'Remove an empty collection',
-        description: `A collection is a directory, so this is an rmdir: one holding anything at all is
-refused rather than emptied.`,
+        description: `Only an empty collection: one holding any repository is refused rather than
+emptied. The collection's own owners list goes with it.`,
         args: [{ name: 'name', required: true }],
         options: [YES_OPTION, output_1.JSON_OPTION, ...target_1.TARGET_OPTIONS],
         async run(inv) {
@@ -239,7 +276,7 @@ the running server had not made. Edit config.json in the vault and restart.`,
                 value: '<host>',
                 summary: "Hostname whose subdomains serve sites; '' to serve them sandboxed on the forge host",
             },
-            { name: 'ci-runs', type: 'int', value: '<n>', summary: 'Completed runs to keep per repository' },
+            { name: 'ci-runs', type: 'int', value: '<n>', summary: 'Completed runs to keep per repository (runs from the last 24 hours are always kept)' },
             { name: 'ci-days', type: 'int', value: '<n>', summary: 'Also drop runs older than this; 0 disables' },
             { name: 'ci-artifact-mb', type: 'int', value: '<n>', summary: 'Largest artifact a job may upload' },
             {