@vzn/vx-reapi 0.0.638 → 0.0.639

package/README.md

@@ -39,7 +39,9 @@ one) the plugin **declines** and costs nothing, so it is
 safe to leave declared. An endpoint that is not `host[:port]`, with an
 optional `grpc(s)://` or `http(s)://` scheme, or a gRPC resolver target
 (`unix:`, `unix-abstract:`, `dns:`, `ipv4:`, `ipv6:`), is refused at startup
-with a line naming the setting. `VX_REAPI_ENDPOINT` / `VX_REAPI_INSTANCE` configure it
+with a line naming the setting. So is a TLS endpoint at an IP address:
+Bun's TLS refuses an IP as the server name, so name the server by host
+name, or use `grpc://` for plaintext. `VX_REAPI_ENDPOINT` / `VX_REAPI_INSTANCE` configure it
 from the environment, and `VX_REAPI_EXECUTE=1` turns on remote execution the
 way `execute: true` does (off by default: a plugin must not move where a
 build runs merely by being configured for caching). `execute` is a
@@ -199,7 +201,7 @@ to `.git/hooks` and a declared directory under it wrote a hook.
 
 ## The existence probe confirms the artifact, not just the entry
 
-`has()` — what `vx run --dry` and `--graph` use to predict hit vs miss —
+`has()` — what `vx run --dry` uses to predict hit vs miss —
 reads the ActionCache entry AND checks the artifact blob is still in the
 CAS. The second call is not redundant, because servers disagree: measured
 against both, bazel-remote validates an ActionResult's referenced blobs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx-reapi",
-  "version": "0.0.638",
+  "version": "0.0.639",
   "license": "MIT",
   "description": "Bazel Remote Execution API plugin for vx — remote cache (ActionCache + CAS) against NativeLink, BuildBuddy, Buildbarn or bazel-remote.",
   "keywords": [
@@ -39,7 +39,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@vzn/vx": "^0.0.638"
+    "@vzn/vx": "^0.0.639"
   },
   "repository": {
     "type": "git",

package/src/cache.ts

@@ -165,6 +165,15 @@ export class ReapiRemoteCache {
    * stream.
    */
   async put(hash: string, body: Blob, meta: { durationMs: number }): Promise<void> {
+    // An entry is immutable, and UpdateActionResult replaces one: the
+    // lookup runs beside the upload (CAS writes are idempotent), so a key
+    // stored already costs no round trip of its own and keeps its result.
+    // A lookup that fails writes, as before.
+    const action = actionDigestFor(hash)
+    const stored = this.client.getActionResult(action).then(
+      (r) => r?.output_files?.some((f) => f.path === ARTIFACT_PATH) === true,
+      () => false,
+    )
     // Read once, and those bytes hashed and sent, wherever `writeBlob` would
     // read the Blob whole anyway: a second writer of the key renames its
     // artifact over the file, and two reads sent its bytes under this one's
@@ -186,7 +195,8 @@ export class ReapiRemoteCache {
       const missing = await this.client.findMissingBlobs([digest])
       if (missing.length > 0) await this.client.writeBlob(digest, data ?? body)
     }
-    await this.client.updateActionResult(actionDigestFor(hash), {
+    if (await stored) return
+    await this.client.updateActionResult(action, {
       exit_code: 0,
       output_files: [{ path: ARTIFACT_PATH, digest, is_executable: false }],
       stdout_raw: encodeDuration(meta.durationMs),

package/src/index.ts

@@ -10,6 +10,8 @@
 // plugin, so nothing here depends on core's internal layout.
 
 import { readFileSync } from 'node:fs'
+import { isIP } from 'node:net'
+import * as grpc from '@grpc/grpc-js'
 import {
   definePlugin,
   type RemoteCacheLayer,
@@ -21,7 +23,7 @@ import {
 } from '@vzn/vx'
 import { ReapiRemoteCache } from './cache.js'
 import { reapiExecutor } from './executor.js'
-import { ReapiClient, type ReapiOptions } from './wire.js'
+import { ReapiClient, type ReapiOptions, usesTls } from './wire.js'
 
 // `ReapiRemoteCache` is public for a workspace that composes cache
 // layers by hand; the wire, the Merkle encoders and the executor are
@@ -149,6 +151,11 @@ function connection(options: ReapiPluginOptions): ReapiOptions | undefined {
       'vx/reapi: a client certificate and its key go together — set both tlsClientCertificate and tlsClientKey (VX_REAPI_TLS_CLIENT_CERTIFICATE / VX_REAPI_TLS_CLIENT_KEY), or neither',
     )
   }
+  if (usesTls({ endpoint, tls: options.tls, tlsCaPem, tlsClientCertPem }) && ipTarget(endpoint)) {
+    throw new UserError(
+      `vx/reapi: ${from} is ${JSON.stringify(endpoint)}, TLS to an IP address, which Bun cannot open (it refuses an IP as the TLS server name) — name the server by host name, or use grpc:// for plaintext`,
+    )
+  }
   return {
     ...options,
     endpoint,
@@ -179,6 +186,20 @@ function assertEndpoint(endpoint: string, from: string): void {
   }
 }
 
+/**
+ * The endpoint names its server by IP address. grpc-js sends the host as
+ * the TLS server name, and Bun's TLS throws on an IP there (Node only
+ * warns), so every request failed and the remote was never reached.
+ */
+function ipTarget(endpoint: string): boolean {
+  if (/^ipv[46]:/.test(endpoint)) return true
+  const host = endpoint
+    .replace(/^(https?|grpcs?|dns):\/*/, '')
+    .replace(/:\d+$/, '')
+    .replace(/^\[(.*)\]$/, '$1')
+  return isIP(host) !== 0
+}
+
 /** Each option `ReapiPluginOptions` names, with its kind: derived from the type, so the two cannot drift. */
 const REAPI_PLUGIN_KEYS: PluginOptionKinds<ReapiPluginOptions> = {
   executeTimeoutMs: 'number',
@@ -226,6 +247,14 @@ export function reapi(options: ReapiPluginOptions = {}): VxPlugin {
         executorClient.close()
         executorClient = undefined
         const why = err instanceof Error ? err.message : String(err)
+        // A server that answered with a refusal was reached: the endpoint
+        // advice sent the user to check everything but the token.
+        const code = (err as { code?: unknown } | null)?.code
+        if (code === grpc.status.UNAUTHENTICATED || code === grpc.status.PERMISSION_DENIED) {
+          throw new Error(
+            `the REAPI server at ${conn.endpoint} refused the credentials for remote execution: ${why} — check the token in \`headers\`, or drop \`execute\` to use it as a cache only`,
+          )
+        }
         throw new Error(
           `cannot reach the REAPI server at ${conn.endpoint} for remote execution: ${why} — check the endpoint, that the server is running, and that this host can reach it, or drop \`execute\` to use it as a cache only`,
         )

package/src/wire.ts

@@ -421,6 +421,24 @@ async function* messagesOf(
   if (carry.length > 0) yield carry
 }
 
+/**
+ * TLS unless the endpoint says plaintext, as Bazel reads a schemeless
+ * `--remote_cache`; a unix socket stays plaintext.
+ */
+export function usesTls(opts: {
+  endpoint: string
+  tls?: boolean | undefined
+  tlsCaPem?: string | undefined
+  tlsClientCertPem?: string | undefined
+}): boolean {
+  return (
+    opts.tls ??
+    (opts.tlsCaPem !== undefined ||
+      opts.tlsClientCertPem !== undefined ||
+      !/^((http|grpc):\/\/|unix:|unix-abstract:)/.test(opts.endpoint))
+  )
+}
+
 export class ReapiClient {
   private readonly svc: ServiceClients
   private readonly instance: string
@@ -453,13 +471,7 @@ export class ReapiClient {
     assertBunSupportsChunking()
     const pem = (text: string | undefined): Buffer | null =>
       text === undefined ? null : Buffer.from(text)
-    // TLS unless the endpoint says plaintext, as Bazel reads a schemeless
-    // `--remote_cache`; a unix socket stays plaintext.
-    const tls =
-      opts.tls ??
-      (opts.tlsCaPem !== undefined ||
-        opts.tlsClientCertPem !== undefined ||
-        !/^((http|grpc):\/\/|unix:|unix-abstract:)/.test(opts.endpoint))
+    const tls = usesTls(opts)
     const target = opts.endpoint.replace(/^(https?|grpcs?):\/\//, '')
     this.svc = loadServices(
       target,