@magland/mochi 0.3.1

package/dist/ci/views.js

@@ -0,0 +1,441 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runsPage = runsPage;
+exports.runPage = runPage;
+exports.execCommandPage = execCommandPage;
+exports.runnersPage = runnersPage;
+exports.runnerPage = runnerPage;
+exports.runnerTokenPage = runnerTokenPage;
+exports.runnerWakePage = runnerWakePage;
+const ansi_1 = require("../ansi");
+const avatar_1 = require("../avatar");
+const html_1 = require("../html");
+const icons_1 = require("../icons");
+const render_1 = require("../render");
+const forms_1 = require("../forms");
+const views_1 = require("../views");
+const manual_1 = require("./manual");
+function statusOf(x) {
+    if (x.status !== 'completed')
+        return x.status === 'running' ? 'running' : 'queued';
+    const c = x.conclusion;
+    if (c === 'success' || c === 'failure' || c === 'cancelled' || c === 'skipped')
+        return c;
+    return 'failure';
+}
+const STATUS_LABEL = {
+    queued: 'Queued',
+    running: 'Running',
+    success: 'Success',
+    failure: 'Failure',
+    cancelled: 'Cancelled',
+    skipped: 'Skipped',
+};
+// The status glyphs are the ringed ones from icons.ts: a tick in a ring for
+// success, a cross in a ring for failure, a turning arc while a job runs, and
+// grey for the states where nothing happened. Ringed rather than filled, so a
+// column of them reads at the weight of the text beside it.
+const STATUS_ICON = {
+    queued: 'clock',
+    running: 'sync',
+    success: 'check-circle',
+    failure: 'x-circle',
+    cancelled: 'stop',
+    skipped: 'skip',
+};
+function statusIcon(s) {
+    return (0, html_1.html) `<span class="run-status ${s}" title="${STATUS_LABEL[s]}" aria-label="${STATUS_LABEL[s]}" role="img">${(0, icons_1.icon)(STATUS_ICON[s])}</span>`;
+}
+function duration(from, to) {
+    if (!from)
+        return '';
+    const start = new Date(from).getTime();
+    const end = to ? new Date(to).getTime() : Date.now();
+    const secs = Math.max(0, Math.round((end - start) / 1000));
+    if (secs < 60)
+        return `${secs}s`;
+    const m = Math.floor(secs / 60);
+    const s = secs % 60;
+    if (m < 60)
+        return `${m}m ${s}s`;
+    return `${Math.floor(m / 60)}h ${m % 60}m`;
+}
+function runTitle(run) {
+    if (run.message)
+        return run.message;
+    if (run.event === 'workflow_dispatch')
+        return `${run.workflowName} (manual)`;
+    return run.workflowName;
+}
+// ---- the runs list ----
+function runsPage(ctx, runs, workflows, selectedWorkflow, flash) {
+    const base = (0, views_1.repoUrl)(ctx);
+    const actionsBase = `${base}/actions`;
+    const rows = runs.map((r) => {
+        const s = statusOf(r);
+        const when = r.createdAt ? (0, render_1.timeTag)(r.createdAt) : '';
+        const dur = duration(r.startedAt, r.completedAt);
+        const sha = r.sha
+            ? (0, html_1.html) ` <a class="sha" href="${base}/commit/${r.sha}">${r.sha.slice(0, 7)}</a>`
+            : '';
+        return (0, html_1.html) `<tr>
+<td class="run-cell">${statusIcon(s)}<span><a href="${actionsBase}/runs/${r.number}"><b>${runTitle(r)}</b></a>
+<div class="muted small run-sub">${r.workflowName} #${r.number}: ${r.event} by ${(0, avatar_1.avatar)(r.actor, 16)}${r.actor}${sha}</div></span></td>
+<td class="right muted small"><span class="chip">${(0, icons_1.icon)('git-branch')}${r.refName}</span></td>
+<td class="right muted small">${when}${dur ? (0, html_1.html) ` &middot; ${dur}` : ''}</td>
+</tr>`;
+    });
+    // GitHub lists the workflows down the side of the runs, which is both the
+    // filter and the answer to "what can this repository do".
+    const sidebar = workflows.length
+        ? (0, html_1.html) `<aside class="wf-side"><div class="side-block"><h3>${(0, icons_1.icon)('workflow')}Workflows</h3><div class="side-links">${[
+            (0, html_1.html) `<a class="${selectedWorkflow === null ? 'current' : ''}" href="${actionsBase}">${(0, icons_1.icon)('history')}<span>All workflows</span></a>`,
+            ...workflows.map((w) => (0, html_1.html) `<a class="${selectedWorkflow === w.path ? 'current' : ''}" href="${actionsBase}?workflow=${encodeURIComponent(w.path)}" title="${w.path}">${(0, icons_1.icon)('play')}<span>${w.name}</span></a>`),
+        ]}</div></div></aside>`
+        : '';
+    const brokenList = workflows.filter((w) => w.error);
+    const broken = brokenList.length
+        ? (0, html_1.html) `<div class="form-error">${brokenList.map((w) => (0, html_1.html) `<div>${w.path}: ${w.error}</div>`)}</div>`
+        : '';
+    const dispatchable = workflows.filter((w) => w.dispatch !== null);
+    const dispatchForm = ctx.canPush && ctx.viewer && dispatchable.length
+        ? dispatchBox(ctx, ctx.viewer, dispatchable)
+        : '';
+    const body = runs.length
+        ? (0, html_1.html) `<table class="listing runs"><tbody>${rows}</tbody></table>`
+        : (0, html_1.html) `<div class="empty-state"><p><b>No workflow runs yet.</b></p><p class="muted">Runs appear here when a push matches a workflow in <code>.github/workflows</code> or <code>.mochi/workflows</code>.</p><p class="muted small">Workflows run without credentials: this vault holds no secrets, and a workflow that references <code>secrets.*</code> is refused with a message saying so.</p></div>`;
+    const content = (0, html_1.html) `${(0, views_1.repoHeader)(ctx, 'actions')}
+${flash ? (0, html_1.html) `<div class="flash">${flash}</div>` : ''}
+${broken}
+<div class="page-head"><h2>Workflow runs</h2>${dispatchForm}</div>
+<div class="actions-layout">${sidebar}<div class="actions-main">${body}</div></div>`;
+    return (0, views_1.layout)(`Actions - ${ctx.collection}/${ctx.repo}`, content, (0, views_1.repoOpts)(ctx, actionsBase));
+}
+function dispatchBox(ctx, viewer, workflows) {
+    const base = (0, views_1.repoUrl)(ctx);
+    const panels = workflows.map((w, i) => {
+        const inputs = Object.entries(w.dispatch ?? {}).map(([name, def]) => {
+            const id = `wf${i}-${name}`;
+            const label = (0, html_1.html) `<label for="${id}">${name}${def.required ? ' *' : ''}</label>`;
+            const help = def.description ? (0, html_1.html) `<p class="muted small">${def.description}</p>` : '';
+            if (def.type === 'choice' && def.options?.length) {
+                const opts = def.options.map((o) => (0, html_1.html) `<option value="${o}"${String(def.default ?? '') === o ? (0, html_1.raw)(' selected') : ''}>${o}</option>`);
+                return (0, html_1.html) `<div class="field">${label}<select id="${id}" name="input.${name}">${opts}</select>${help}</div>`;
+            }
+            if (def.type === 'boolean') {
+                return (0, html_1.html) `<div class="field"><label class="checkbox"><input type="checkbox" id="${id}" name="input.${name}" value="true"${def.default === true || def.default === 'true' ? (0, html_1.raw)(' checked') : ''}> ${name}</label>${help}</div>`;
+            }
+            return (0, html_1.html) `<div class="field">${label}<input type="text" id="${id}" name="input.${name}" value="${def.default ?? ''}"${def.required ? (0, html_1.raw)(' required') : ''}>${help}</div>`;
+        });
+        const refOptions = ctx.branches.map((b) => (0, html_1.html) `<option value="${b.name}"${b.name === ctx.defaultBranch ? (0, html_1.raw)(' selected') : ''}>${b.name}</option>`);
+        return (0, html_1.html) `<form method="post" action="${base}/actions/dispatch" class="dispatch-panel" data-wf="${w.path}"${i === 0 ? '' : (0, html_1.raw)(' hidden')}>
+${(0, views_1.csrfField)(viewer)}
+<input type="hidden" name="workflow" value="${w.path}">
+<div class="field"><label>Use branch</label><select name="ref">${refOptions}</select></div>
+${inputs}
+<button type="submit" class="btn btn-primary">Run workflow</button>
+</form>`;
+    });
+    const picker = workflows.length > 1
+        ? (0, html_1.html) `<div class="field"><label>Workflow</label><select data-workflow-picker>${workflows.map((w) => (0, html_1.html) `<option value="${w.path}">${w.name}</option>`)}</select></div>`
+        : '';
+    return (0, html_1.html) `<details class="dropdown dispatch">
+<summary class="btn">${(0, icons_1.icon)('play')}<span>Run workflow</span>${(0, icons_1.icon)('chevron-down', 'caret')}</summary>
+<div class="dropdown-menu dd-right dispatch-body">${picker}${panels}</div>
+</details>`;
+}
+// ---- one run ----
+// The runner logs its own setup and cleanup against step index -1, which is
+// not a workflow step at all; it gets its own block rather than being
+// mistaken for one.
+function stepBlocks(job, logLines) {
+    const byStep = new Map();
+    for (const line of logLines) {
+        if (!byStep.has(line.s))
+            byStep.set(line.s, []);
+        byStep.get(line.s).push(line.l);
+    }
+    const states = job.stepStates ?? [];
+    const indices = new Set([...byStep.keys(), ...states.map((_, i) => i)]);
+    const ordered = [...indices].sort((a, b) => a - b);
+    if (ordered.length === 0)
+        return '';
+    // ansiLineHtml escapes the log text itself and adds only its own spans, so
+    // a rendered line is HTML by the time it lands here.
+    const log = (lines) => (0, html_1.raw)(lines.map((l) => (0, ansi_1.ansiLineHtml)(l)).join('\n'));
+    return (0, html_1.joinHtml)(ordered.map((i) => {
+        const lines = byStep.get(i) ?? [];
+        if (i < 0) {
+            return (0, html_1.html) `<details class="step">
+<summary><span class="run-status queued" aria-hidden="true">&middot;</span><span class="step-name">Runner</span></summary>
+<pre class="joblog">${log(lines)}</pre>
+</details>`;
+        }
+        const st = states[i];
+        const name = st?.name ?? `Step ${i + 1}`;
+        const s = st ? statusOf({ status: st.status, conclusion: st.conclusion }) : 'queued';
+        const open = s === 'failure' || s === 'running';
+        return (0, html_1.html) `<details class="step"${open ? (0, html_1.raw)(' open') : ''}>
+<summary>${statusIcon(s)}<span class="step-name">${name}</span><span class="muted small">${duration(st?.startedAt, st?.completedAt)}</span></summary>
+<pre class="joblog">${log(lines)}</pre>
+</details>`;
+    }));
+}
+function runPage(ctx, run, jobs, selected, logLines, logOffset, artifacts = []) {
+    const base = (0, views_1.repoUrl)(ctx);
+    const actionsBase = `${base}/actions`;
+    const runBase = `${actionsBase}/runs/${run.number}`;
+    const s = statusOf(run);
+    const viewer = ctx.viewer;
+    const jobList = jobs.map((j) => {
+        const js = statusOf(j);
+        const current = selected && j.id === selected.id;
+        return (0, html_1.html) `<a class="job-item${current ? ' current' : ''}" href="${runBase}?job=${encodeURIComponent(j.id)}">${statusIcon(js)}<span>${j.name}</span><span class="muted small">${duration(j.startedAt, j.completedAt)}</span></a>`;
+    });
+    let detail;
+    if (run.error) {
+        detail = (0, html_1.html) `<div class="form-error"><b>${run.workflowPath}</b> could not be used: ${run.error}</div>`;
+    }
+    else if (!selected) {
+        detail = (0, html_1.html) `<div class="empty-state">This run has no jobs.</div>`;
+    }
+    else if (selected.error && selected.stepStates.length === 0) {
+        detail = (0, html_1.html) `<div class="form-error">${selected.error}</div>`;
+    }
+    else {
+        const js = statusOf(selected);
+        const live = js === 'running' || js === 'queued';
+        const summaries = (selected.summaries ?? []).filter((x) => x.trim() !== '');
+        const summaryBox = summaries.length
+            ? (0, html_1.html) `<div class="box"><div class="box-header">Summary</div><div class="box-body"><pre class="joblog">${summaries.join('\n')}</pre></div></div>`
+            : '';
+        const errorBox = selected.error ? (0, html_1.html) `<div class="form-error">${selected.error}</div>` : '';
+        // The audit line for a job that executed through a pasted command: who
+        // authorized it and where it said it ran. The host is what the session
+        // reported about itself, so it is presented as a report, not a finding.
+        const manualBy = selected.manual
+            ? (0, html_1.html) ` <span class="muted small">&middot; run manually by ${selected.manual.user}${selected.manual.host ? (0, html_1.html) ` on ${selected.manual.host}` : ''}</span>`
+            : '';
+        if (live) {
+            // The tailer appends as textContent, so a live log is stripped of
+            // escapes rather than coloured; colour arrives with the step view when
+            // the job completes and the page reloads into it.
+            const initial = logLines.map((l) => (0, ansi_1.stripAnsi)(l.l)).join('\n');
+            // The endpoint and the offset ride on the element rather than in a
+            // script, which is what lets /assets/page.js stay one cacheable file
+            // and this page carry no executable markup; the tailer there picks
+            // them up.
+            const waitingFor = (0, manual_1.isManualJob)(selected.runsOn)
+                ? ctx.canPush
+                    ? 'waiting for someone to run it (Run it yourself, above)'
+                    : 'waiting for someone to run it'
+                : 'waiting for a runner';
+            detail = (0, html_1.html) `${errorBox}<div class="job-head"><b>${selected.name}</b> ${statusIcon(js)} <span class="muted small">${js === 'queued' ? waitingFor : 'running'}</span>${manualBy}</div>
+<pre class="joblog live" id="livelog" data-log-url="${runBase}/log/${encodeURIComponent(selected.id)}" data-log-offset="${logOffset}">${initial}</pre>`;
+        }
+        else {
+            const rawLink = (0, html_1.html) `<a class="btn raw-log-link" href="${runBase}/log/${encodeURIComponent(selected.id)}/raw" title="Download the log as the runner wrote it">Raw log</a>`;
+            detail = (0, html_1.html) `${errorBox}<div class="job-head"><b>${selected.name}</b> ${statusIcon(js)} <span class="muted small">${duration(selected.startedAt, selected.completedAt)}</span>${manualBy}${rawLink}</div>
+${stepBlocks(selected, logLines)}
+${summaryBox}`;
+        }
+    }
+    const canOperate = ctx.canPush && viewer;
+    // Offered while a manual job is waiting: the command that runs this run's
+    // manual jobs on a machine of the viewer's. Minting is a POST because it
+    // issues a credential; the token appears on the page it lands on and
+    // nowhere else.
+    const manualWaiting = jobs.some((j) => (0, manual_1.isManualJob)(j.runsOn) && j.status === 'queued');
+    const execBtn = canOperate && run.status !== 'completed' && manualWaiting
+        ? (0, html_1.html) `<form method="post" action="${runBase}/exec-command">${(0, views_1.csrfField)(viewer)}<button type="submit" class="btn btn-primary" title="Get a command that runs this run's manual jobs on a machine of yours">Run it yourself</button></form>`
+        : '';
+    const cancelBtn = canOperate && run.status !== 'completed'
+        ? (0, html_1.html) `<form method="post" action="${runBase}/cancel">${(0, views_1.csrfField)(viewer)}<button type="submit" class="btn btn-danger-outline">Cancel run</button></form>`
+        : '';
+    const rerunBtn = canOperate
+        ? (0, html_1.html) `<form method="post" action="${runBase}/rerun">${(0, views_1.csrfField)(viewer)}<button type="submit" class="btn">Re-run</button></form>`
+        : '';
+    const artifactBox = artifacts.length
+        ? (0, html_1.html) `<div class="box artifacts"><div class="box-header">Artifacts</div><div class="box-body">${artifacts.map((a) => (0, html_1.html) `<a class="artifact" href="${runBase}/artifacts/${encodeURIComponent(a.name)}"><b>${a.name}</b><span class="muted small">${(0, render_1.formatSize)(a.size)}</span></a>`)}<p class="muted small">Artifacts are tar archives, and are removed when the run is pruned.</p></div></div>`
+        : '';
+    const content = (0, html_1.html) `${(0, views_1.repoHeader)(ctx, 'actions')}
+<div class="run-head">
+  <div class="run-title">${statusIcon(s)}<h2>${runTitle(run)}</h2></div>
+  <div class="right-group">${execBtn}${rerunBtn}${cancelBtn}</div>
+</div>
+<div class="run-meta muted small">
+  <a href="${actionsBase}?workflow=${encodeURIComponent(run.workflowPath)}">${run.workflowName}</a>
+  &middot; #${run.number}
+  &middot; ${run.event} by <span class="run-actor">${(0, avatar_1.avatar)(run.actor, 16)}${run.actor}</span>
+  &middot; <span class="chip">${run.refName}</span>
+  ${run.sha ? (0, html_1.html) `&middot; <a class="sha" href="${base}/commit/${run.sha}">${run.sha.slice(0, 7)}</a>` : ''}
+  &middot; <a href="${base}/blob/${(0, views_1.encPath)(run.refName)}/${(0, views_1.encPath)(run.workflowPath)}">${run.workflowPath}</a>
+  ${run.createdAt ? (0, html_1.html) `&middot; ${(0, render_1.timeTag)(run.createdAt, '')}` : ''}
+</div>
+<div class="run-body">
+  <div class="job-list">${jobList}</div>
+  <div class="job-detail">${detail}</div>
+</div>
+${artifactBox}`;
+    return (0, views_1.layout)(`${runTitle(run)} - ${ctx.collection}/${ctx.repo}`, content, (0, views_1.repoOpts)(ctx, runBase));
+}
+/**
+ * The page a minted exec command lands on, and the only place it appears:
+ * only its hash is stored, as with tokens. Everything the person at the other
+ * terminal needs is here, because by the time they are pasting they are no
+ * longer looking at this page.
+ */
+function execCommandPage(ctx, runNumber, command, expiresInMinutes, back) {
+    const content = (0, html_1.html) `${(0, views_1.repoHeader)(ctx, 'actions')}
+<div class="form-box wide">
+<h1>Run it yourself</h1>
+<p>On a machine with Docker or Podman and Node, paste this. It shows run #${runNumber}'s manual jobs step by step and asks before executing anything; what it runs reports back to this run as any runner would.</p>
+${(0, views_1.copyRow)(command)}
+<p class="muted small">The command must be pasted within ${expiresInMinutes} minutes and works once: redeeming it trades the token here for a session that lives only in that process, so a copy left in scrollback or shell history buys nothing afterwards. Reloading this page will not show it again; minting another command is the way to get one.</p>
+<p class="muted small">The jobs run as whoever pastes this, on that machine. Read the steps it shows before agreeing to them.</p>
+<p><a class="btn" href="${back}">Back to run #${runNumber}</a></p>
+</div>`;
+    return (0, views_1.layout)(`Run it yourself - ${ctx.collection}/${ctx.repo}`, content, (0, views_1.repoOpts)(ctx, back));
+}
+// A runner is either working on something, idle but in touch, or not there at
+// all. The third case is the one an operator is usually looking for, so it gets
+// a plain word rather than an empty cell.
+function runnerStatus(r) {
+    if (r.running) {
+        const at = `/${encodeURIComponent(r.running.collection)}/${encodeURIComponent(r.running.repo)}/actions/runs/${r.running.run}?job=${encodeURIComponent(r.running.job)}`;
+        return (0, html_1.html) `${statusIcon('running')}<span>running <a href="${at}">${r.running.collection}/${r.running.repo} #${r.running.run}</a> ${r.running.job}</span>`;
+    }
+    if (r.lastSeen) {
+        return (0, html_1.html) `${statusIcon('success')}<span>idle, last heard from ${(0, render_1.timeTag)(r.lastSeen, '')}</span>`;
+    }
+    // A runner with a wake address is meant to be absent between jobs, so the
+    // absence is the arrangement working rather than something to look into.
+    if (r.wakeUrl) {
+        return (0, html_1.html) `${statusIcon('queued')}<span class="muted">stopped; the vault starts it when a job is waiting</span>`;
+    }
+    return (0, html_1.html) `${statusIcon('queued')}<span class="muted">not seen since the vault restarted</span>`;
+}
+function runnersPage(viewer, runners, flash, error) {
+    const rows = runners.map((r) => (0, html_1.html) `<tr><td class="with-avatar-row">${(0, icons_1.icon)('server', 'icon')}<span><b><a href="/admin/runners/${encodeURIComponent(r.name)}">${r.name}</a></b><div class="muted small">registered by ${r.createdBy}${r.createdAt ? (0, html_1.html) ` ${(0, render_1.timeTag)(r.createdAt, '')}` : ''}</div></span></td>
+<td class="small"><div class="runner-status">${runnerStatus(r)}</div></td>
+<td class="small">${(0, html_1.joinHtml)(r.labels.map((l) => (0, html_1.html) `<span class="chip">${l}</span>`), ' ')}</td>
+<td class="small mono">${r.allow.join(' ')}</td>
+<td class="right"><a class="btn" href="/admin/runners/${encodeURIComponent(r.name)}">Details</a></td></tr>`);
+    const content = (0, html_1.html) `<div class="page-head"><h1>Runners</h1></div>
+${flash ? (0, html_1.html) `<div class="flash">${flash}</div>` : ''}
+${error ? (0, html_1.html) `<div class="form-error">${error}</div>` : ''}
+<p class="muted">A runner is a machine that executes workflow jobs. Jobs never run on the vault's own machine: register a runner, then start it with <code>mochi runner run</code> somewhere with Docker.</p>
+${runners.length
+        ? (0, html_1.html) `<table class="listing"><tbody>${rows}</tbody></table>`
+        : (0, html_1.raw)('<div class="empty-state">No runners registered.</div>')}
+<div class="form-box wide" style="margin-top:24px">
+<h2>Register a runner</h2>
+<form method="post" action="/admin/runners">
+${(0, views_1.csrfField)(viewer)}
+<div class="field"><label for="name">Name</label><input type="text" id="name" name="name" placeholder="laptop" required>
+<p class="muted small">Identifies the machine in job history.</p></div>
+<div class="field"><label for="labels">Labels</label><input type="text" id="labels" name="labels" value="ubuntu-latest">
+<p class="muted small">Matched against a job's <code>runs-on</code>. Space or comma separated.</p></div>
+<div class="field"><label for="allow">Repositories</label><input type="text" id="allow" name="allow" placeholder="mycollection/*" required>
+<p class="muted small">Globs over <code>collection/repo</code>. A runner executes whatever those repositories' workflows say, on the machine you start it on, so grant it only what you trust.</p></div>
+<button type="submit" class="btn btn-primary">Register runner</button>
+</form>
+</div>`;
+    return (0, forms_1.adminShell)(viewer, 'runners', 'Runners', '/admin/runners', content);
+}
+// One runner: what it is allowed to do, whether it is there, and the two
+// operations an operator comes here for, which are getting the start command
+// and replacing a token that was lost or leaked.
+function runnerPage(viewer, r, host, flash) {
+    const fact = (label, value) => value === '' ? '' : (0, html_1.html) `<div class="fact"><span class="k">${label}</span><span class="v">${value}</span></div>`;
+    const facts = (0, html_1.html) `<div class="facts">
+${fact('Status', (0, html_1.html) `<span class="runner-status">${runnerStatus(r)}</span>`)}
+${fact('Labels', r.labels.length
+        ? (0, html_1.joinHtml)(r.labels.map((l) => (0, html_1.html) `<span class="chip">${l}</span>`), ' ')
+        : (0, html_1.raw)('<span class="muted">none</span>'))}
+${fact('Repositories', (0, html_1.html) `<span class="mono">${r.allow.join(' ')}</span>`)}
+${fact('Registered', (0, html_1.html) `by ${r.createdBy}${r.createdAt ? (0, html_1.html) ` ${(0, render_1.timeTag)(r.createdAt, '')}` : ''}`)}
+${fact('Token', r.tokenUpdatedAt ? (0, html_1.html) `regenerated ${(0, render_1.timeTag)(r.tokenUpdatedAt, '')}` : (0, html_1.html) `the one issued at registration`)}
+${fact('Wake', r.wakeUrl ? (0, html_1.html) `<span class="mono">${r.wakeUrl}</span>` : (0, html_1.raw)('<span class="muted">nothing starts this runner</span>'))}
+</div>`;
+    const content = (0, html_1.html) `<div class="page-head"><h1>${(0, icons_1.icon)('server', 'icon')}${r.name}</h1></div>
+${flash ? (0, html_1.html) `<div class="flash">${flash}</div>` : ''}
+<p class="muted"><a href="/admin/runners">Runners</a> &middot; a machine that takes jobs for ${r.allow.join(', ')} and runs them under Docker.</p>
+${facts}
+<div class="form-box wide" style="margin-top:24px">
+<h2>Start this runner</h2>
+<p class="muted">On the machine that will execute the jobs, with Docker installed and running, and the <code>mochi</code> CLI on the path (<code>npm install -g @magland/mochi</code>):</p>
+${(0, views_1.copyRow)(`mochi runner run --host ${host} --runner-token <token>`)}
+<p class="muted small">The token is shown only when it is issued, so if you no longer have it, regenerate it below and the command will be filled in for you. Adding <code>--save</code> writes the host and token to <code>~/.config/mochi/runner.json</code>, after which <code>mochi runner run</code> needs no arguments; <code>MOCHI_RUNNER_TOKEN</code> supplies the token where a command line is the wrong place for it, as in a systemd unit. Leave the process running; it polls for work and exits only when you stop it.</p>
+<p class="muted small">Jobs are matched by label, so this runner will be offered jobs whose <code>runs-on</code> names ${r.labels.length
+        ? (0, html_1.joinHtml)(r.labels.map((l) => (0, html_1.html) `<code>${l}</code>`), ' or ')
+        : 'nothing yet'}.</p>
+</div>
+<div class="form-box wide" style="margin-top:24px">
+<h2>Wake address</h2>
+<p class="muted">A runner started with <code>--idle</code> stops when it has had no job for that long, which is how a runner on hardware billed by the minute stops costing anything between runs. It cannot be told that work has arrived, though, so the vault sends a request to this address instead, and whatever is in front of the runner (a Fly proxy, a socket unit) starts it. The request carries a secret and nothing else; a new one is generated when you save an address, and the runner has to be started with it.</p>
+<p class="muted">Sent at most once a minute per runner, however many jobs are waiting, and only when the runner has not been heard from.</p>
+<form method="post" action="/admin/runners/${encodeURIComponent(r.name)}/wake">
+${(0, views_1.csrfField)(viewer)}
+<div class="field"><label for="wakeUrl">URL</label><input type="text" id="wakeUrl" name="wakeUrl" value="${r.wakeUrl ?? ''}" placeholder="https://my-runner.fly.dev/wake">
+<p class="muted small">Leave empty to remove the address, after which nothing starts this runner.</p></div>
+<button type="submit" class="btn">${(0, icons_1.icon)('sync')}<span>Save wake address</span></button>
+</form>
+${r.wakeUrl
+        ? (0, html_1.html) `<form method="post" action="/admin/runners/${encodeURIComponent(r.name)}/wake/send" style="margin-top:12px">
+${(0, views_1.csrfField)(viewer)}
+<button type="submit" class="btn">${(0, icons_1.icon)('play')}<span>Send a wake request now</span></button>
+<p class="muted small">Tests the address without queuing a job. A machine that has to boot may take half a minute to answer.</p>
+</form>`
+        : ''}
+</div>
+<div class="form-box wide" style="margin-top:24px">
+<h2>Regenerate token</h2>
+<p class="muted">Issues a new token for ${r.name} and invalidates the current one. Its labels and repositories are kept, but a runner still running with the old token will start failing to poll and has to be restarted.</p>
+<form method="post" action="/admin/runners/${encodeURIComponent(r.name)}/token" data-confirm="Regenerate the token for ${r.name}? The current token stops working immediately.">
+${(0, views_1.csrfField)(viewer)}
+<button type="submit" class="btn">${(0, icons_1.icon)('sync')}<span>Regenerate token</span></button>
+</form>
+</div>
+<div class="form-box wide" style="margin-top:24px">
+<h2>Remove runner</h2>
+<p class="muted">Removes ${r.name} from the registry. It stops being able to take jobs; a job it is running now will be handed back to the queue when its lease expires.</p>
+<form method="post" action="/admin/runners/${encodeURIComponent(r.name)}/remove" data-confirm="Remove runner ${r.name}? It will stop being able to take jobs.">
+${(0, views_1.csrfField)(viewer)}
+<button type="submit" class="btn btn-danger-outline">${(0, icons_1.icon)('trash')}<span>Remove runner</span></button>
+</form>
+</div>`;
+    return (0, forms_1.adminShell)(viewer, 'runners', `Runner ${r.name}`, '/admin/runners', content);
+}
+function runnerTokenPage(viewer, name, token, host, regenerated = false) {
+    const heading = regenerated ? `New token for ${name}` : 'Runner registered';
+    const content = (0, html_1.html) `<div class="form-box wide">
+<h1>${heading}</h1>
+<p>The token for <b>${name}</b> is shown once; only its hash is stored.${regenerated ? ' The previous token no longer works.' : ''}</p>
+${(0, views_1.copyRow)(token)}
+<h2>Start it</h2>
+<p class="muted">On a machine with Docker:</p>
+${(0, views_1.copyRow)(`mochi runner run --host ${host} --runner-token ${token}`)}
+<p class="muted small">Adding <code>--save</code> keeps the host and token in <code>~/.config/mochi/runner.json</code>, so <code>mochi runner run</code> needs no arguments afterwards.${regenerated ? ' If the runner is already running with the old token, restart it now.' : ''}</p>
+<p><a class="btn" href="/admin/runners/${encodeURIComponent(name)}">Back to ${name}</a> <a class="btn" href="/admin/runners">All runners</a></p>
+</div>`;
+    return (0, views_1.layout)(heading, content, { viewer, path: '/admin/runners' });
+}
+// The secret a saved wake address is given, shown once for the same reason a
+// token is: the vault keeps it in order to send it, and the runner has to be
+// started with the same one, so this page is the only place the two halves
+// meet.
+function runnerWakePage(viewer, name, url, secret) {
+    const content = (0, html_1.html) `<div class="form-box wide">
+<h1>Wake address saved</h1>
+<p>The vault will start <b>${name}</b> by sending a request to <span class="mono">${url}</span> when a job it could take is waiting and it has not been heard from.</p>
+<p>The secret that request carries, shown once here because the runner has to be started with it:</p>
+${(0, views_1.copyRow)(secret)}
+<h2>Start it</h2>
+<p class="muted">With an idle timeout, so that there is something to wake, and a port for the request to arrive on:</p>
+${(0, views_1.copyRow)(`MOCHI_WAKE_SECRET=${secret} mochi runner run --idle 5m --wake-port 3000`)}
+<p class="muted small">A runner deployed with <code>mochi deploy fly runner</code> is given all of this already; this page is for a runner you start yourself. Saving an address again issues a new secret, so the runner has to be restarted with it.</p>
+<p><a class="btn" href="/admin/runners/${encodeURIComponent(name)}">Back to ${name}</a> <a class="btn" href="/admin/runners">All runners</a></p>
+</div>`;
+    return (0, views_1.layout)('Wake address saved', content, { viewer, path: '/admin/runners' });
+}

package/dist/ci/wake.js

@@ -0,0 +1,194 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sendWake = sendWake;
+exports.newWakeSecret = newWakeSecret;
+exports.wakeOf = wakeOf;
+exports.startWakeDispatcher = startWakeDispatcher;
+const crypto = __importStar(require("crypto"));
+const runners_1 = require("./runners");
+// Starting a runner that is not there.
+//
+// A runner reaches the vault and never the other way round, which is what lets
+// one sit behind NAT with nothing open. The cost of that arrangement is that a
+// runner which has stopped to save money cannot be told there is work: it has
+// to be started by whatever is in front of it. A runner may therefore carry a
+// wake address, and this pokes it when there is a job it could take and no
+// sign of it.
+//
+// The request means nothing by itself. Nothing is sent but the shared secret,
+// nothing is expected back, and the runner learns what to do the ordinary way,
+// by polling. All that matters is that the thing in front of the runner - a
+// Fly proxy, a systemd socket, anything - treats an arriving request as the
+// signal to start it.
+/** How recently a runner must have spoken to the vault to count as present. */
+const PRESENT_MS = 60 * 1000;
+/** The least time between two wake requests to the same runner. */
+const RETRY_MS = 60 * 1000;
+/**
+ * How long to give one wake request.
+ *
+ * Generous, because the platform in front of a stopped runner usually holds
+ * the request open while it starts the machine rather than answering and
+ * starting one behind it: a cold Fly machine with a Docker daemon to bring up
+ * took half a minute to answer in testing. The answer is discarded either way;
+ * this is only how long the attempt is allowed to occupy.
+ */
+const REQUEST_TIMEOUT_MS = 120 * 1000;
+/** How often to look for work waiting on a runner that is not there. */
+const SWEEP_MS = 20 * 1000;
+/**
+ * Send one wake request, and say what happened.
+ *
+ * Exported because both the timer below and `mochi runner wake` want the
+ * same request with the same headers; a wake tested by hand that differed
+ * from the one the vault sends would test the wrong thing.
+ */
+async function sendWake(wake, timeoutMs = REQUEST_TIMEOUT_MS) {
+    const res = await fetch(wake.url, {
+        method: 'POST',
+        headers: { 'x-mochi-wake': wake.secret, 'content-length': '0' },
+        signal: AbortSignal.timeout(timeoutMs),
+    });
+    // A runner that answers 401 is running somebody else's secret, and one that
+    // answers 404 is not the endpoint anybody meant. Both are worth a message,
+    // since the visible symptom otherwise is a run that never starts.
+    if (!res.ok && res.status !== 204) {
+        throw new Error(`the wake endpoint answered HTTP ${res.status}`);
+    }
+}
+/**
+ * The secret a wake request must present.
+ *
+ * Not a token in the vault's sense: it authenticates the vault to a runner
+ * rather than a caller to the vault, both sides keep it in the clear because
+ * both sides have to send it, and all it buys is the right to start a machine
+ * that will then ask for work in the ordinary way. It exists because starting
+ * a machine costs its owner money, and an address anyone could poke would be a
+ * way to spend it.
+ */
+function newWakeSecret() {
+    return crypto.randomBytes(32).toString('hex');
+}
+function wakeOf(runner) {
+    if (!runner.wakeUrl || !runner.wakeSecret)
+        return null;
+    return { url: runner.wakeUrl, secret: runner.wakeSecret };
+}
+/**
+ * Watch for queued jobs whose runner is not present, and start it.
+ *
+ * The unit throttled here is the runner, not the job. A run of twelve jobs
+ * that all wait on the same stopped runner is one machine to start, and
+ * twelve requests would be eleven wasted and a good way to look like an
+ * attack to whatever is in front of it.
+ */
+function startWakeDispatcher(root, engine) {
+    const attempts = new Map();
+    let stopped = false;
+    const wakeRunner = (name, wake, attempt) => {
+        attempt.at = Date.now();
+        attempt.inFlight = true;
+        void sendWake(wake)
+            .then(() => {
+            if (attempt.lastError)
+                console.log(`CI: runner ${name} answered a wake request`);
+            attempt.lastError = null;
+        })
+            .catch((e) => {
+            const message = e instanceof Error ? e.message : String(e);
+            // Once per distinct failure. A runner whose wake address is wrong
+            // stays wrong, and a line a minute about it for as long as a job is
+            // queued would bury everything else in the log.
+            if (attempt.lastError !== message) {
+                console.error(`CI: could not wake runner ${name} at ${wake.url}: ${message}`);
+                attempt.lastError = message;
+            }
+        })
+            .finally(() => {
+            attempt.inFlight = false;
+            // The request is answered only once the runner is up, so this is the
+            // moment its first poll is imminent: the throttle should count from
+            // here rather than from when the attempt began.
+            attempt.at = Date.now();
+        });
+    };
+    const sweep = () => {
+        if (stopped)
+            return;
+        const load = engine.runnerLoad();
+        if (load.queued.length === 0)
+            return;
+        const registry = (0, runners_1.loadRunners)(root);
+        const now = Date.now();
+        for (const [name, runner] of Object.entries(registry.runners)) {
+            const wake = wakeOf(runner);
+            if (!wake)
+                continue;
+            // Present, by either measure: holding a job, or having polled within
+            // the last minute. Waking a runner that is already there costs nothing
+            // but is a request nobody needed.
+            if (load.running[name])
+                continue;
+            const seen = (0, runners_1.runnerLastSeen)(name);
+            if (seen && now - Date.parse(seen) < PRESENT_MS)
+                continue;
+            // A manual job is waiting for a person, not a machine; starting a
+            // runner for one would cost its owner a boot for a job it may not take.
+            const waiting = load.queued.some((j) => !j.manual && (0, runners_1.runnerAllows)(runner, j.collection, j.repo) && j.runsOn.some((l) => runner.labels.includes(l)));
+            if (!waiting)
+                continue;
+            const attempt = attempts.get(name) ?? { at: 0, inFlight: false, lastError: null };
+            attempts.set(name, attempt);
+            if (attempt.inFlight || now - attempt.at < RETRY_MS)
+                continue;
+            wakeRunner(name, wake, attempt);
+        }
+    };
+    // Both a timer and the engine's own signal: the signal makes the usual case
+    // immediate, since a push that queues a job should not wait out a sweep,
+    // and the timer is what keeps trying for a job that is still sitting there.
+    const timer = setInterval(sweep, SWEEP_MS);
+    timer.unref();
+    const unsubscribe = engine.onQueueChanged(sweep);
+    return {
+        sweep,
+        stop() {
+            stopped = true;
+            clearInterval(timer);
+            unsubscribe();
+        },
+    };
+}