@tsplc/build 0.2.8 → 0.2.10

package/python/build.py

@@ -258,12 +258,15 @@ def reconcile(application, previous, current):
 	names = set(item["name"].lower() for item in current)
 	gone = []
 	for old in previous:
+		fresh = new.get((tuple(old["folder"]), old["name"].lower()))
+		# Most objects keep their kind, folder and children; each CODESYS lookup costs a call.
+		if fresh is not None and object_key(old) == object_key(fresh):
+			continue
 		parent = application
 		for name in old["folder"]:
 			parent = unique_child(parent, name)
 			if parent is None:
 				raise RuntimeError("Saved source folder is missing: " + name)
-		fresh = new.get((tuple(old["folder"]), old["name"].lower()))
 		if fresh is None and old["name"].lower() in names:
 			# A folder move changes placement rather than text. Remove/recreate just
 			# that moved object, letting the vendor decide whether the update is valid.

package/python/codesys_online.py

@@ -139,7 +139,25 @@ def fail_on_errors_after_transfer(engine, progress):
         raise CompilerError(errors)
 
 
-def connect_controller(engine, application, settings):
+def controller_credentials(settings, credentials_file):
+    """The controller user: from a file a warm worker writes for one operation, else the environment."""
+    if credentials_file:
+        try:
+            with io.open(credentials_file, encoding='utf-8') as source:
+                credentials = json.load(source)
+        finally:
+            os.remove(credentials_file)
+        return credentials['username'], credentials['password']
+    names = settings.get('credentials')
+    if not names:
+        return None
+    username, password = (os.environ.get(names[key]) for key in ('usernameEnv', 'passwordEnv'))
+    if not username or not password:
+        raise RuntimeError('CODESYS online credential environment variables are required')
+    return username, password
+
+
+def connect_controller(engine, application, settings, credentials_file=None):
     """Route the application's controller through the configured gateway; returns it and its credentials."""
     device = application.parent
     while device is not None and not getattr(device, 'is_device', False):
@@ -148,19 +166,20 @@ def connect_controller(engine, application, settings):
         raise RuntimeError('Application has no controller device')
     gateway_ip = str(Dns.GetHostAddresses(settings['gateway']['host'])[0])
     device_ip = str(Dns.GetHostAddresses(settings['device']['host'])[0])
-    gateway = engine.online.gateways.add_new_gateway('codesys-build', {0: gateway_ip, 1: settings['gateway']['port']})
+    gateways = engine.online.gateways
+    # A warm worker connects for every operation, and gateway names needn't be unique.
+    for stale in list(gateways.find_with_name('codesys-build')):
+        gateways.remove_gateway(stale)
+    gateway = gateways.add_new_gateway('codesys-build', {0: gateway_ip, 1: settings['gateway']['port']})
     device.set_gateway_and_ip_address(gateway.guid, IPAddress.Parse(device_ip), settings['device']['port'])
-    credentials = settings.get('credentials')
-    if not credentials:
-        return device, None
-    username, password = (os.environ.get(credentials[key]) for key in ('usernameEnv', 'passwordEnv'))
-    if not username or not password:
-        raise RuntimeError('CODESYS online credential environment variables are required')
-    engine.online.set_specific_credentials(device, username, password)
-    return device, (username, password)
+    credentials = controller_credentials(settings, credentials_file)
+    if credentials:
+        engine.online.set_specific_credentials(device, *credentials)
+    return device, credentials
 
 
-def run_online(engine, request):
+def run_online(engine, request, prepared=None):
+    """`prepared` is a project a warm worker opened ahead; an online change of that project uses it."""
     progress_path = request.get('progress')
     def progress(stage):
         if progress_path:
@@ -168,8 +187,15 @@ def run_online(engine, request):
                 output.write(u'{0}Z {1}\n'.format(time.strftime('%Y-%m-%dT%H:%M:%S', time.gmtime()), stage))
     progress('Starting; processor count {0}'.format(Environment.ProcessorCount))
     # A download starts from the template; online changes reuse the downloaded project, which has its controller and tree.
+    if prepared is not None and (request['operation'] == 'download' or
+                                 os.path.normcase(prepared.path) != os.path.normcase(request['project'])):
+        prepared.close()
+        prepared = None
     if request['operation'] == 'download':
         project, pinned, generated = open_template(engine, request, request['project'], request.get('devices'), request['caches'], progress)
+    elif prepared is not None:
+        progress('Using the project opened ahead')
+        project, pinned, generated = prepared, {}, None
     else:
         progress('Opening project')
         project = engine.projects.open(request['project'], primary=True)
@@ -181,7 +207,7 @@ def run_online(engine, request):
         progress('Project opened; configuring controller connection')
         if application is None:
             raise RuntimeError('Project has no active Application')
-        device, credentials = connect_controller(engine, application, request['online'])
+        device, credentials = connect_controller(engine, application, request['online'], request.get('credentialsFile'))
         online_device = engine.online.create_online_device(device)
         if request.get('initializeUser'):
             if request['operation'] != 'download' or not credentials:

package/python/test_codesys_online.py

@@ -1,3 +1,4 @@
+import json
 import os
 import sys
 import tempfile
@@ -65,7 +66,8 @@ class OnlineLifecycleTests(unittest.TestCase):
         self.engine = SimpleNamespace(
             projects=SimpleNamespace(open=Mock(return_value=self.project)),
             online=SimpleNamespace(
-                gateways=SimpleNamespace(add_new_gateway=Mock(return_value=SimpleNamespace(guid='gateway'))),
+                gateways=SimpleNamespace(add_new_gateway=Mock(return_value=SimpleNamespace(guid='gateway')),
+                                     find_with_name=Mock(return_value=[]), remove_gateway=Mock()),
                 create_online_device=Mock(return_value=SimpleNamespace(Dispose=Mock())),
                 create_online_application=Mock(side_effect=wrapper),
             ),
@@ -172,6 +174,34 @@ class OnlineLifecycleTests(unittest.TestCase):
         codesys_online.run_online(self.engine, self.request)
         self.assertEqual(self.events, ['online-wrapper', 'import', 'remove', 'compile'])
 
+    def test_a_warm_worker_replaces_its_gateway_and_reads_credentials_once_from_a_file(self):
+        stale = SimpleNamespace(guid='earlier')
+        gateways = self.engine.online.gateways
+        gateways.find_with_name.return_value = [stale]
+        self.engine.online.set_specific_credentials = Mock()
+        with tempfile.NamedTemporaryFile('w', suffix='.json', delete=False) as source:
+            json.dump({'username': 'tsplc', 'password': 'pw'}, source)
+        _, credentials = codesys_online.connect_controller(self.engine, self.app, self.request['online'], source.name)
+        gateways.remove_gateway.assert_called_once_with(stale)
+        self.engine.online.set_specific_credentials.assert_called_once_with(self.app.parent, 'tsplc', 'pw')
+        self.assertEqual(credentials, ('tsplc', 'pw'))
+        self.assertFalse(os.path.exists(source.name))
+
+    def test_online_change_uses_the_project_a_warm_worker_opened_ahead(self):
+        self.request.update(operation='online-change', baseline={
+            'applicationGuid': self.app.guid, 'controllerIds': self.ids, 'objects': [],
+        })
+        self.project.path = 'Application.project'
+        codesys_online.run_online(self.engine, self.request, self.project)
+        self.engine.projects.open.assert_not_called()
+        self.project.close.assert_called_once()
+
+    def test_a_download_or_another_project_closes_the_one_opened_ahead(self):
+        stale = SimpleNamespace(path='Other.project', close=Mock())
+        codesys_online.run_online(self.engine, self.request, stale)
+        stale.close.assert_called_once()
+        codesys_online.open_template.assert_called_once()
+
     def test_full_download_rejects_library_errors_reported_after_transfer(self):
         def report_library_error(core):
             self.messages.append(SimpleNamespace(text="Could not open library '#VisuShared'."))

package/python/worker.py

@@ -34,6 +34,14 @@ def run_build(engine, directory, loaded):
 		raise
 
 
+def close_loaded(loaded):
+	"""Closes the project an earlier build or prepare left open."""
+	for key in ("project", "prepared"):
+		if loaded.get(key) is not None:
+			loaded[key].close()
+	loaded.clear()
+
+
 def serve(engine, directory):
 	request_path = os.path.join(directory, "request.json")
 	loaded = {}
@@ -49,22 +57,23 @@ def serve(engine, directory):
 		try:
 			if command["action"] == "build":
 				run_build(engine, directory, loaded)
+			elif command["action"] == "prepare":
+				# A warm worker opens the next online change's project before it is asked for.
+				close_loaded(loaded)
+				loaded["prepared"] = engine.projects.open(command["project"], primary=True)
 			elif command["action"] == "online":
 				from codesys_online import run_online
-				if loaded.get("project") is not None:
-					loaded["project"].close()
-				loaded.clear()
+				prepared = loaded.pop("prepared", None)
+				close_loaded(loaded)
 				root = os.path.join(os.path.dirname(directory), "controller")
 				with io.open(os.path.join(root, "request.json"), encoding="utf-8") as source:
 					request = json.load(source)
-				write_json(os.path.join(root, "result.json"), run_online(engine, request))
+				write_json(os.path.join(root, "result.json"), run_online(engine, request, prepared))
 			elif command["action"] == "login":
 				from codesys_login import close_login, open_login, run_command
 				arguments = command["arguments"]
 				if arguments["command"] == "open":
-					if loaded.get("project") is not None:
-						loaded["project"].close()
-					loaded.clear()
+					close_loaded(loaded)
 					loaded["login"] = open_login(engine, arguments)
 					response["result"] = run_command(engine, loaded["login"], {"command": "state"})
 				elif arguments["command"] == "close":

package/src/controller-online.ts

@@ -3,13 +3,13 @@ import { existsSync } from "node:fs";
 import { createHash, randomUUID } from "node:crypto";
 import { mkdir, mkdtemp, readFile, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { resolve } from "node:path";
+import { posix, resolve } from "node:path";
 import { setTimeout as delay } from "node:timers/promises";
 import { promisify } from "node:util";
 import { z } from "zod";
 import { controllerSchema, dockerImage, type ResolvedConfig } from "./config";
 import { controllerFailureFile } from "./diagnostics.ts";
-import { prepareContainerRun, runDocker } from "./docker-run.ts";
+import { prepareContainerRun, runDocker, writeOperationRequest } from "./docker-run.ts";
 
 const execute = promisify(execFile);
 const imageIdSchema = z.string().regex(/^sha256:[a-f0-9]{64}$/);
@@ -44,6 +44,27 @@ export const controllerResultSchema = z.strictObject({
   values: z.record(z.string(), z.string()),
 });
 export type ControllerResult = z.infer<typeof controllerResultSchema>;
+export const controllerCredentialsSchema = z.strictObject({
+  username: z.string().nonempty(),
+  password: z.string().nonempty(),
+});
+export type ControllerCredentials = z.infer<typeof controllerCredentialsSchema>;
+
+/** One operation for the warm builder container; `request` is the container path of its config. */
+export const warmOperationSchema = z.strictObject({
+  operation: z.enum(["download", "online-change"]),
+  operationId: z.uuid(),
+  request: z.string().nonempty(),
+  initializeUser: z.boolean(),
+  credentials: controllerCredentialsSchema.optional(),
+});
+
+/** The worker reports a Python traceback; its last line names the failure. */
+export const failureReason = (error: unknown) => {
+  const message = error instanceof Error ? error.message : String(error);
+  return (message.trim().split("\n").at(-1) ?? message).replace(/^\w+: /, "");
+};
+
 export type ControllerUpdateOptions = {
   initializeUser?: boolean;
   read?: string[];
@@ -66,6 +87,19 @@ export const controllerTarget = (
   }),
 });
 
+/** The controller user's environment variables, which a container started now passes to CODESYS. */
+const credentialEnvironment = (config: ResolvedConfig) => {
+  const names = config.online?.credentials
+    ? [config.online.credentials.usernameEnv, config.online.credentials.passwordEnv]
+    : [];
+  for (const name of names) {
+    if (process.env[name] === undefined) {
+      throw new Error(`Controller credential environment variable ${name} is not set`);
+    }
+  }
+  return names;
+};
+
 /** Checks the settings every engineering connection needs and names its builder image and target. */
 const controllerConnection = async (config: ResolvedConfig) => {
   if (!config.docker || !config.online) {
@@ -73,14 +107,6 @@ const controllerConnection = async (config: ResolvedConfig) => {
       "Docker image and online gateway/device configuration are required for controller operations",
     );
   }
-  const environmentNames = config.online.credentials
-    ? [config.online.credentials.usernameEnv, config.online.credentials.passwordEnv]
-    : [];
-  for (const name of environmentNames) {
-    if (process.env[name] === undefined) {
-      throw new Error(`Controller credential environment variable ${name} is not set`);
-    }
-  }
   const { stdout } = await execute(
     "docker",
     ["image", "inspect", "--format", "{{.Id}}", dockerImage],
@@ -92,7 +118,6 @@ const controllerConnection = async (config: ResolvedConfig) => {
     );
   });
   return {
-    environmentNames,
     imageId: imageIdSchema.parse(stdout.trim()),
     templateHash: createHash("sha256")
       .update(await readFile(config.template))
@@ -101,12 +126,35 @@ const controllerConnection = async (config: ResolvedConfig) => {
   };
 };
 
+const checkReceipt = (
+  result: ControllerResult,
+  expected: Pick<
+    ControllerResult,
+    "operationId" | "operation" | "imageId" | "templateHash" | "target"
+  >,
+  diagnostics: string,
+) => {
+  if (
+    result.operationId !== expected.operationId ||
+    result.operation !== expected.operation ||
+    result.imageId !== expected.imageId ||
+    result.templateHash !== expected.templateHash ||
+    JSON.stringify(result.target) !== JSON.stringify(expected.target)
+  ) {
+    throw new Error(
+      `Controller receipt does not match this operation's image, template or target. Inspect ${diagnostics} for diagnostics`,
+    );
+  }
+  return result;
+};
+
 const controllerOperation = async (
   config: ResolvedConfig,
   operation: ControllerResult["operation"],
   options: ControllerUpdateOptions,
 ): Promise<ControllerResult> => {
-  const { environmentNames, imageId, templateHash, target } = await controllerConnection(config);
+  const environmentNames = credentialEnvironment(config);
+  const { imageId, templateHash, target } = await controllerConnection(config);
   const operationId = randomUUID();
   const requestDirectory = await mkdtemp(resolve(tmpdir(), "codesys-controller-"));
   const diagnostics = resolve(config.outDir, ".codesys/controller");
@@ -150,18 +198,11 @@ const controllerOperation = async (
           { cause },
         );
       });
-    if (
-      result.operationId !== operationId ||
-      result.operation !== operation ||
-      result.imageId !== imageId ||
-      result.templateHash !== templateHash ||
-      JSON.stringify(result.target) !== JSON.stringify(target)
-    ) {
-      throw new Error(
-        `Controller receipt does not match this operation's image, template or target. Inspect ${diagnostics} for diagnostics`,
-      );
-    }
-    return result;
+    return checkReceipt(
+      result,
+      { operationId, operation, imageId, templateHash, target },
+      diagnostics,
+    );
   } finally {
     await rm(requestDirectory, { recursive: true, force: true });
   }
@@ -214,8 +255,9 @@ const loginReplySchema = z.discriminatedUnion("ok", [
   z.strictObject({ ok: z.literal(false), error: z.string() }),
 ]);
 
-/** The port a login container serves its commands on, published to the host's loopback only. */
+/** The ports login and warm containers serve on, inside the container. */
 const loginPort = 4851;
+const warmPort = 4852;
 
 const docker = (args: string[], timeout: number) =>
   execute("docker", args, { timeout }).then(({ stdout }) => stdout.trim());
@@ -223,39 +265,71 @@ const docker = (args: string[], timeout: number) =>
 const isRunning = async (name: string, timeout: number) =>
   (await docker(["container", "ls", "--quiet", "--filter", `name=^${name}$`], timeout)) !== "";
 
-/** A login held open in builder container `name`; it ends with `close` or when the container stops. */
-const attachLogin = async (name: string, timeout: number) => {
-  const published = await docker(["port", name, String(loginPort)], timeout);
-  const url = `http://${published.split("\n")[0]}`;
-  const call = async (init: RequestInit) => {
-    const reply = loginReplySchema.parse(await (await fetch(url, init)).json());
-    if (!reply.ok) throw new Error(reply.error);
-    return reply.result;
-  };
-  return {
-    name,
-    /** The relay answers only once CODESYS has logged in. */
-    ready: () =>
-      fetch(url)
-        .then((response) => response.ok)
-        .catch(() => false),
-    send: async (command: LoginCommand) =>
-      loginResultSchema.parse(
-        await call({
-          method: "POST",
-          headers: { "Content-Type": "application/json" },
-          body: JSON.stringify(command),
-        }),
-      ),
-    /** Logs out and waits for the container to stop. */
-    close: async () => {
-      await call({ method: "DELETE" });
-      await docker(["wait", name], timeout);
-      await docker(["rm", name], timeout);
+/**
+ * Calls the server builder container `name` runs on `port`. The container's internal network
+ * publishes no ports, so the request goes through `docker exec`; the body, which can hold
+ * credentials, through its standard input.
+ */
+const callContainer = async (
+  name: string,
+  port: number,
+  method: "GET" | "POST" | "DELETE",
+  body?: unknown,
+) => {
+  const child = Bun.spawn(
+    [
+      "docker",
+      "exec",
+      ...(body === undefined ? [] : ["--interactive"]),
+      name,
+      "curl",
+      "--silent",
+      "--show-error",
+      "--request",
+      method,
+      ...(body === undefined
+        ? []
+        : ["--header", "Content-Type: application/json", "--data-binary", "@-"]),
+      `http://127.0.0.1:${port}/`,
+    ],
+    {
+      stdin: body === undefined ? "ignore" : new Blob([JSON.stringify(body)]),
+      stdout: "pipe",
+      stderr: "pipe",
     },
-  };
+  );
+  const [output, errors, code] = await Promise.all([
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+    child.exited,
+  ]);
+  if (code !== 0) throw new Error(errors.trim() || `docker exec failed (${code})`);
+  const reply = loginReplySchema.parse(JSON.parse(output));
+  if (!reply.ok) throw new Error(reply.error);
+  return reply.result;
 };
-export type ControllerLogin = Awaited<ReturnType<typeof attachLogin>>;
+
+/** The container answers once its server listens, which for a login is once CODESYS has logged in. */
+const answers = (name: string, port: number) =>
+  callContainer(name, port, "GET").then(
+    () => true,
+    () => false,
+  );
+
+/** A login held open in builder container `name`; it ends with `close` or when the container stops. */
+const attachLogin = (name: string, timeout: number) => ({
+  name,
+  ready: () => answers(name, loginPort),
+  send: async (command: LoginCommand) =>
+    loginResultSchema.parse(await callContainer(name, loginPort, "POST", command)),
+  /** Logs out and waits for the container to stop. */
+  close: async () => {
+    await callContainer(name, loginPort, "DELETE");
+    await docker(["wait", name], timeout);
+    await docker(["rm", name], timeout);
+  },
+});
+export type ControllerLogin = ReturnType<typeof attachLogin>;
 
 /** The login in container `name`, if one is running; it outlives the process that opened it. */
 export const findControllerLogin = async (name: string) =>
@@ -266,7 +340,8 @@ export const findControllerLogin = async (name: string) =>
  * container named `name`. Commands then take seconds instead of a CODESYS start each.
  */
 export const openControllerLogin = async (config: ResolvedConfig, name: string) => {
-  const { environmentNames, imageId, target } = await controllerConnection(config);
+  const environmentNames = credentialEnvironment(config);
+  const { imageId, target } = await controllerConnection(config);
   const timeout = config.timeouts.hostCommand;
   // A login that failed to open leaves its stopped container for diagnostics until the next one.
   await docker(["rm", "--force", name], timeout);
@@ -280,8 +355,6 @@ export const openControllerLogin = async (config: ResolvedConfig, name: string)
       "--detach",
       "--name",
       name,
-      "--publish",
-      `127.0.0.1::${loginPort}`,
       ...(await prepareContainerRun(config, requestDirectory, {
         network: target.network,
         environment: environmentNames,
@@ -298,19 +371,129 @@ export const openControllerLogin = async (config: ResolvedConfig, name: string)
     ],
     timeout,
   );
+  const login = attachLogin(name, timeout);
   const deadline = Date.now() + config.timeouts.startup + config.timeouts.build;
   while (Date.now() < deadline) {
-    // A container that stops right after starting never publishes its port, so check it first.
-    const login = (await isRunning(name, timeout))
-      ? await attachLogin(name, timeout).catch(() => undefined)
-      : undefined;
-    if (!login && !(await isRunning(name, timeout))) {
+    if (!(await isRunning(name, timeout))) {
       const logs = await execute("docker", ["logs", "--tail", "40", name], { timeout });
       throw new Error(`The controller login failed:\n${logs.stdout}${logs.stderr}`);
     }
-    if (login && (await login.ready())) return login;
+    if (await login.ready()) return login;
     await delay(2000);
   }
   await docker(["rm", "--force", name], timeout);
   throw new Error("The controller login did not open in time");
 };
+
+/** Builder container `name`, running warm on this image, target and settings, started if needed. */
+const warmController = async (
+  config: ResolvedConfig,
+  name: string,
+  connection: Awaited<ReturnType<typeof controllerConnection>>,
+) => {
+  const timeout = config.timeouts.hostCommand;
+  const { imageId, target } = connection;
+  const settings = createHash("sha256")
+    .update(JSON.stringify({ imageId, target, timeouts: config.timeouts, docker: config.docker }))
+    .digest("hex");
+  const label = `tsplc.warm=${settings}`;
+  const running = async () =>
+    (await docker(
+      ["container", "ls", "--quiet", "--filter", `name=^${name}$`, "--filter", `label=${label}`],
+      timeout,
+    )) !== "";
+  if (!(await running())) {
+    await docker(["rm", "--force", name], timeout);
+    // Its own request: the operations' configs come later, one per release.
+    const requestDirectory = resolve(config.outDir, ".codesys/warm-request");
+    await mkdir(requestDirectory, { recursive: true });
+    await docker(
+      [
+        "run",
+        "--detach",
+        "--name",
+        name,
+        "--label",
+        label,
+        ...(await prepareContainerRun(config, requestDirectory, {
+          network: target.network,
+          sources: false,
+        })),
+        imageId,
+        "warm",
+        "--request",
+        "/input/config.json",
+        "--image-id",
+        imageId,
+        "--port",
+        String(warmPort),
+      ],
+      timeout,
+    );
+  }
+  const deadline = Date.now() + config.timeouts.startup;
+  while (Date.now() < deadline) {
+    if (!(await running())) {
+      const logs = await execute("docker", ["logs", "--tail", "40", name], { timeout });
+      throw new Error(`CODESYS failed to start:\n${logs.stdout}${logs.stderr}`);
+    }
+    if (await answers(name, warmPort)) return;
+    await delay(2000);
+  }
+  await docker(["rm", "--force", name], timeout);
+  throw new Error("CODESYS did not start in time");
+};
+
+/** Starts warm builder container `name` ahead of the first operation, unless it already runs. */
+export const startWarmController = async (config: ResolvedConfig, name: string) => {
+  await warmController(config, name, await controllerConnection(config));
+};
+
+/**
+ * A download or online change in builder container `name`, which keeps CODESYS running between
+ * operations so each skips starting the container, Wine and CODESYS. The first operation, or one
+ * with a new image, target or settings, starts it. Credentials go to CODESYS for this operation only.
+ */
+export const updateWarmController = async (
+  config: ResolvedConfig,
+  name: string,
+  operation: "download" | "online-change",
+  options: { initializeUser?: boolean; credentials?: ControllerCredentials } = {},
+): Promise<ControllerResult> => {
+  const connection = await controllerConnection(config);
+  await warmController(config, name, connection);
+  const operationId = randomUUID();
+  const diagnostics = resolve(config.outDir, ".codesys/controller");
+  const directory = resolve(config.outDir, ".codesys/requests", operationId);
+  try {
+    const request = await writeOperationRequest(
+      config,
+      directory,
+      posix.join("/output/.codesys/requests", operationId),
+    );
+    const result = await callContainer(name, warmPort, "POST", {
+      operation,
+      operationId,
+      request,
+      initializeUser: options.initializeUser ?? false,
+      credentials: options.credentials,
+    } satisfies z.input<typeof warmOperationSchema>).catch((error: unknown) => {
+      throw new Error(`${failureReason(error)}. Inspect ${diagnostics} for diagnostics`, {
+        cause: error,
+      });
+    });
+    return checkReceipt(
+      controllerResultSchema.parse(result),
+      {
+        operationId,
+        operation,
+        imageId: connection.imageId,
+        templateHash: connection.templateHash,
+        target: connection.target,
+      },
+      diagnostics,
+    );
+  } finally {
+    await rm(directory, { recursive: true, force: true });
+  }
+};