@vzn/vx-reapi 0.0.638 → 0.0.640

package/README.md

@@ -39,7 +39,9 @@ one) the plugin **declines** and costs nothing, so it is
 safe to leave declared. An endpoint that is not `host[:port]`, with an
 optional `grpc(s)://` or `http(s)://` scheme, or a gRPC resolver target
 (`unix:`, `unix-abstract:`, `dns:`, `ipv4:`, `ipv6:`), is refused at startup
-with a line naming the setting. `VX_REAPI_ENDPOINT` / `VX_REAPI_INSTANCE` configure it
+with a line naming the setting. So is a TLS endpoint at an IP address:
+Bun's TLS refuses an IP as the server name, so name the server by host
+name, or use `grpc://` for plaintext. `VX_REAPI_ENDPOINT` / `VX_REAPI_INSTANCE` configure it
 from the environment, and `VX_REAPI_EXECUTE=1` turns on remote execution the
 way `execute: true` does (off by default: a plugin must not move where a
 build runs merely by being configured for caching). `execute` is a
@@ -199,7 +201,7 @@ to `.git/hooks` and a declared directory under it wrote a hook.
 
 ## The existence probe confirms the artifact, not just the entry
 
-`has()` — what `vx run --dry` and `--graph` use to predict hit vs miss —
+`has()` — what `vx run --dry` uses to predict hit vs miss —
 reads the ActionCache entry AND checks the artifact blob is still in the
 CAS. The second call is not redundant, because servers disagree: measured
 against both, bazel-remote validates an ActionResult's referenced blobs
@@ -439,15 +441,15 @@ the packages a build needs. The answer is the design doc's §7.4 recipe,
 ```ts
 install: {
   exec: { command: 'pnpm install --frozen-lockfile', remote: 'only' },
+  inputs: { files: ['package.json', 'pnpm-lock.yaml'] },
   cache: {
-    inputs: { files: ['package.json', 'pnpm-lock.yaml'] },
     outputs: { files: ['node_modules/**'] },
   },
 },
 build: {
   dependsOn: ['install'],
   exec: { command: 'tsc -p .' },
-  cache: { inputs: { files: ['src/**'] }, outputs: { files: ['dist/**'] } },
+  inputs: { files: ['src/**'] }, cache: { outputs: { files: ['dist/**'] } },
 },
 ```
 
@@ -485,7 +487,7 @@ sorted by name — the proto requires that, so equivalent Commands hash alike:
 - **`exec.env.define`** — literal `name: value` pairs from the task config.
   They read the same on every machine, so they are safe to put into the
   action identity, and they are already in the vx cache key.
-- **`cache.inputs.env`** — the values this machine resolved for those names,
+- **`inputs.env`** — the values this machine resolved for those names,
   for each name the task's local child would get too (it is also in
   `exec.env.passThrough`). They are in the vx cache key by definition, so a
   change to one already produces a different action. A name unset here, or
@@ -509,6 +511,6 @@ the worker has its own. Two reasons, and both matter:
   can name its digest.
 
 So a task that needs a value on a worker must `define` it (config literal) or
-list it in both `cache.inputs.env` and `exec.env.passThrough` (host value,
+list it in both `inputs.env` and `exec.env.passThrough` (host value,
 keyed, and seen by a local run the same way). A task whose command reads
 a `passThrough` secret is one to keep local with `exec: { remote: false }`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx-reapi",
-  "version": "0.0.638",
+  "version": "0.0.640",
   "license": "MIT",
   "description": "Bazel Remote Execution API plugin for vx — remote cache (ActionCache + CAS) against NativeLink, BuildBuddy, Buildbarn or bazel-remote.",
   "keywords": [
@@ -39,7 +39,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@vzn/vx": "^0.0.638"
+    "@vzn/vx": "^0.0.640"
   },
   "repository": {
     "type": "git",

package/src/cache.ts

@@ -165,6 +165,15 @@ export class ReapiRemoteCache {
    * stream.
    */
   async put(hash: string, body: Blob, meta: { durationMs: number }): Promise<void> {
+    // An entry is immutable, and UpdateActionResult replaces one: the
+    // lookup runs beside the upload (CAS writes are idempotent), so a key
+    // stored already costs no round trip of its own and keeps its result.
+    // A lookup that fails writes, as before.
+    const action = actionDigestFor(hash)
+    const stored = this.client.getActionResult(action).then(
+      (r) => r?.output_files?.some((f) => f.path === ARTIFACT_PATH) === true,
+      () => false,
+    )
     // Read once, and those bytes hashed and sent, wherever `writeBlob` would
     // read the Blob whole anyway: a second writer of the key renames its
     // artifact over the file, and two reads sent its bytes under this one's
@@ -186,7 +195,8 @@ export class ReapiRemoteCache {
       const missing = await this.client.findMissingBlobs([digest])
       if (missing.length > 0) await this.client.writeBlob(digest, data ?? body)
     }
-    await this.client.updateActionResult(actionDigestFor(hash), {
+    if (await stored) return
+    await this.client.updateActionResult(action, {
       exit_code: 0,
       output_files: [{ path: ARTIFACT_PATH, digest, is_executable: false }],
       stdout_raw: encodeDuration(meta.durationMs),

package/src/executor.ts

@@ -1269,7 +1269,7 @@ export function globToOutputPath(glob: string): string {
 }
 
 /**
- * The action's environment: `cache.inputs.env` (values read from THIS
+ * The action's environment: `inputs.env` (values read from THIS
  * machine's environment, already folded into the cache key) plus
  * `exec.env.define` (literals from the task config). A define wins on
  * collision — it is the more explicit statement of intent. An `inputs.env`

package/src/index.ts

@@ -10,6 +10,8 @@
 // plugin, so nothing here depends on core's internal layout.
 
 import { readFileSync } from 'node:fs'
+import { isIP } from 'node:net'
+import * as grpc from '@grpc/grpc-js'
 import {
   definePlugin,
   type RemoteCacheLayer,
@@ -21,7 +23,7 @@ import {
 } from '@vzn/vx'
 import { ReapiRemoteCache } from './cache.js'
 import { reapiExecutor } from './executor.js'
-import { ReapiClient, type ReapiOptions } from './wire.js'
+import { ReapiClient, type ReapiOptions, usesTls } from './wire.js'
 
 // `ReapiRemoteCache` is public for a workspace that composes cache
 // layers by hand; the wire, the Merkle encoders and the executor are
@@ -149,6 +151,11 @@ function connection(options: ReapiPluginOptions): ReapiOptions | undefined {
       'vx/reapi: a client certificate and its key go together — set both tlsClientCertificate and tlsClientKey (VX_REAPI_TLS_CLIENT_CERTIFICATE / VX_REAPI_TLS_CLIENT_KEY), or neither',
     )
   }
+  if (usesTls({ endpoint, tls: options.tls, tlsCaPem, tlsClientCertPem }) && ipTarget(endpoint)) {
+    throw new UserError(
+      `vx/reapi: ${from} is ${JSON.stringify(endpoint)}, TLS to an IP address, which Bun cannot open (it refuses an IP as the TLS server name) — name the server by host name, or use grpc:// for plaintext`,
+    )
+  }
   return {
     ...options,
     endpoint,
@@ -179,6 +186,20 @@ function assertEndpoint(endpoint: string, from: string): void {
   }
 }
 
+/**
+ * The endpoint names its server by IP address. grpc-js sends the host as
+ * the TLS server name, and Bun's TLS throws on an IP there (Node only
+ * warns), so every request failed and the remote was never reached.
+ */
+function ipTarget(endpoint: string): boolean {
+  if (/^ipv[46]:/.test(endpoint)) return true
+  const host = endpoint
+    .replace(/^(https?|grpcs?|dns):\/*/, '')
+    .replace(/:\d+$/, '')
+    .replace(/^\[(.*)\]$/, '$1')
+  return isIP(host) !== 0
+}
+
 /** Each option `ReapiPluginOptions` names, with its kind: derived from the type, so the two cannot drift. */
 const REAPI_PLUGIN_KEYS: PluginOptionKinds<ReapiPluginOptions> = {
   executeTimeoutMs: 'number',
@@ -226,6 +247,14 @@ export function reapi(options: ReapiPluginOptions = {}): VxPlugin {
         executorClient.close()
         executorClient = undefined
         const why = err instanceof Error ? err.message : String(err)
+        // A server that answered with a refusal was reached: the endpoint
+        // advice sent the user to check everything but the token.
+        const code = (err as { code?: unknown } | null)?.code
+        if (code === grpc.status.UNAUTHENTICATED || code === grpc.status.PERMISSION_DENIED) {
+          throw new Error(
+            `the REAPI server at ${conn.endpoint} refused the credentials for remote execution: ${why} — check the token in \`headers\`, or drop \`execute\` to use it as a cache only`,
+          )
+        }
         throw new Error(
           `cannot reach the REAPI server at ${conn.endpoint} for remote execution: ${why} — check the endpoint, that the server is running, and that this host can reach it, or drop \`execute\` to use it as a cache only`,
         )

package/src/wire.ts

@@ -421,6 +421,24 @@ async function* messagesOf(
   if (carry.length > 0) yield carry
 }
 
+/**
+ * TLS unless the endpoint says plaintext, as Bazel reads a schemeless
+ * `--remote_cache`; a unix socket stays plaintext.
+ */
+export function usesTls(opts: {
+  endpoint: string
+  tls?: boolean | undefined
+  tlsCaPem?: string | undefined
+  tlsClientCertPem?: string | undefined
+}): boolean {
+  return (
+    opts.tls ??
+    (opts.tlsCaPem !== undefined ||
+      opts.tlsClientCertPem !== undefined ||
+      !/^((http|grpc):\/\/|unix:|unix-abstract:)/.test(opts.endpoint))
+  )
+}
+
 export class ReapiClient {
   private readonly svc: ServiceClients
   private readonly instance: string
@@ -453,13 +471,7 @@ export class ReapiClient {
     assertBunSupportsChunking()
     const pem = (text: string | undefined): Buffer | null =>
       text === undefined ? null : Buffer.from(text)
-    // TLS unless the endpoint says plaintext, as Bazel reads a schemeless
-    // `--remote_cache`; a unix socket stays plaintext.
-    const tls =
-      opts.tls ??
-      (opts.tlsCaPem !== undefined ||
-        opts.tlsClientCertPem !== undefined ||
-        !/^((http|grpc):\/\/|unix:|unix-abstract:)/.test(opts.endpoint))
+    const tls = usesTls(opts)
     const target = opts.endpoint.replace(/^(https?|grpcs?):\/\//, '')
     this.svc = loadServices(
       target,