agent-hitch 0.2.6 → 0.2.8

package/README.md

@@ -59,12 +59,24 @@ hitch run \
   --output jsonl
 ```
 
-The output includes a run ID. Use it to inspect the saved trajectory:
+The output includes a run ID. Use bounded trajectory and verifier views for
+automated consumers, or the full trajectory inspect view for explicit auditing:
 
 ```bash
+hitch trajectory project RUN_ID --profile analysis --json
+hitch trajectory events RUN_ID --types tool/call,tool/result --limit 100 --json
 hitch trajectory inspect RUN_ID
+hitch verifier inspect RUN_ID --json
 ```
 
+`project` reconstructs the DSH surface and coalesces streaming chunks per request
+attempt, keeping retries and their finish reasons separate. `events`
+filters and pages at the source; `--field` drill-down additionally requires the
+`canonical_sha256` returned by either bounded view. Streamed views fail closed
+for legacy trajectory refs that do not pin a canonical SHA-256.
+Commands invoked with `--json` emit a stable JSON error envelope on stderr when
+they fail.
+
 Every run is stored below `~/.hitch/runs/RUN_ID` with its manifest, result,
 events, logs, and trajectory.
 
@@ -105,12 +117,13 @@ Hitch records the chain from request to result:
 - normalized control-plane events and raw process logs;
 - redacted provider-native events where supported;
 - DSH-compatible canonical trajectory with SHA-256-bound files; and
-- versioned message feedback and evaluation evidence.
+- versioned message feedback and bounded verifier/evaluation evidence.
 
 Use the CLI to query runs and attach feedback without rewriting the trajectory:
 
 ```bash
 hitch runs list --json
+hitch verifier inspect RUN_ID --json
 hitch feedback list RUN_ID --json
 hitch feedback put RUN_ID \
   --message MESSAGE_ID \
@@ -152,14 +165,28 @@ portability rules.
 Start a queue when you need long-lived execution:
 
 ```bash
-hitch daemon start --max-concurrent 4
+hitch daemon start \
+  --max-concurrent 4 \
+  --capacity-cpu-millis 4000 \
+  --capacity-memory-mib 8192 \
+  --container-slots 4 \
+  --capacity-gpus 1 \
+  --eval-gpus 1
 hitch run --daemon --harness codex@version:0.92.0 --prompt-file task.md
 ```
 
+Windows is covered on Node 22 and 24, including npm/agent `.cmd` shims and the
+packaged-harness cache/integrity path. GPU-backed Harbor trials require a
+Docker host with GPU container support and explicit `--capacity-gpus` plus
+`--eval-gpus`; Hitch never guesses GPU capacity. A repository maintainer can
+run the real NVIDIA gate through the manually dispatched
+`NVIDIA GPU hardware canary` workflow on a compatible self-hosted runner.
+
 ## Documentation
 
 - [Design and architecture](docs/design.md)
 - [Harbor-backed evals](docs/evals.md)
+- [Verifier evidence](docs/verifier-evidence.md)
 - [Workspace isolation](docs/workspaces.md)
 - [Daemon design](docs/daemon.md)
 - [Hitch 0.2 development spec](docs/hitch-0.2-development-spec.md)

package/README.zh-CN.md

@@ -59,12 +59,22 @@ hitch run \
   --output jsonl
 ```
 
-输出中包含 run ID，可以用它查看保存的轨迹：
+输出中包含 run ID。自动化消费者应使用有界的轨迹和 verifier 视图，完整轨迹
+inspect 仅用于显式审计：
 
 ```bash
+hitch trajectory project RUN_ID --profile analysis --json
+hitch trajectory events RUN_ID --types tool/call,tool/result --limit 100 --json
 hitch trajectory inspect RUN_ID
+hitch verifier inspect RUN_ID --json
 ```
 
+`project` 会重建 DSH surface，并按请求 attempt 合并流式 chunk，使 retry 及其
+finish reason 保持独立；`events` 在源端完成过滤和分页。
+使用 `--field` 钻取字段时，还必须传入任一有界视图返回的 `canonical_sha256`。
+对于没有固定 canonical SHA-256 的旧版 trajectory ref，流式视图会 fail closed。
+使用 `--json` 调用的命令失败时，会在 stderr 返回稳定的 JSON 错误 envelope。
+
 每次运行的 manifest、结果、事件、日志和轨迹都会保存在
 `~/.hitch/runs/RUN_ID` 下。
 
@@ -105,12 +115,13 @@ Hitch 记录从请求到结果的完整链路：
 - 规范化控制面事件与原始进程日志；
 - 支持场景下经过脱敏的 provider-native 事件；
 - 采用 SHA-256 绑定文件、兼容 DSH 的规范化轨迹；
-- 带版本的消息反馈与评测证据。
+- 带版本的消息反馈，以及有界的 verifier/评测证据。
 
 可以通过 CLI 查询运行，并在不改写轨迹的情况下附加反馈：
 
 ```bash
 hitch runs list --json
+hitch verifier inspect RUN_ID --json
 hitch feedback list RUN_ID --json
 hitch feedback put RUN_ID \
   --message MESSAGE_ID \
@@ -159,6 +170,7 @@ hitch run --daemon --harness codex@version:0.92.0 --prompt-file task.md
 
 - [设计与架构](docs/design.md)
 - [Harbor 评测](docs/evals.md)
+- [Verifier evidence](docs/verifier-evidence.md)
 - [工作区隔离](docs/workspaces.md)
 - [守护进程设计](docs/daemon.md)
 - [Hitch 0.2 开发规范](docs/hitch-0.2-development-spec.md)

package/dist/bin/hitch.js

@@ -1,9 +1,31 @@
 #!/usr/bin/env node
 import { main } from "../src/cli/index.js";
-main(process.argv.slice(2)).catch((error) => {
+import { SCHEMA_VERSION } from "../src/foundation/index.js";
+const argv = process.argv.slice(2);
+main(argv).catch((error) => {
     const message = error instanceof Error ? error.message : String(error);
-    process.stderr.write(`hitch: ${message}\n`);
     const exitCode = error.exitCode;
-    process.exitCode = Number.isInteger(exitCode) ? exitCode : 12;
+    const normalizedExitCode = Number.isInteger(exitCode) ? exitCode : 12;
+    if (requestsJson(argv)) {
+        const rawCode = error.code;
+        process.stderr.write(`${JSON.stringify({
+            schema_version: SCHEMA_VERSION,
+            kind: "error",
+            error: {
+                code: typeof rawCode === "string" ? rawCode : "internal_error",
+                message,
+                exit_code: normalizedExitCode,
+            },
+        })}\n`);
+    }
+    else {
+        process.stderr.write(`hitch: ${message}\n`);
+    }
+    process.exitCode = normalizedExitCode;
 });
+function requestsJson(args) {
+    if (args.includes("--json"))
+        return true;
+    return args.some((value, index) => value === "--output" && args[index + 1] === "json");
+}
 //# sourceMappingURL=hitch.js.map

package/dist/bin/hitch.js.map

@@ -1 +1 @@
-{"version":3,"file":"hitch.js","sourceRoot":"","sources":["../../bin/hitch.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAE3C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IACnD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,OAAO,IAAI,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAI,KAAgC,CAAC,QAAQ,CAAC;IAC5D,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1E,CAAC,CAAC,CAAC"}
+{"version":3,"file":"hitch.js","sourceRoot":"","sources":["../../bin/hitch.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAEnC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IAClC,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAI,KAAgC,CAAC,QAAQ,CAAC;IAC5D,MAAM,kBAAkB,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,OAAO,GAAI,KAA4B,CAAC,IAAI,CAAC;QACnD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;YACrC,cAAc,EAAE,cAAc;YAC9B,IAAI,EAAE,OAAO;YACb,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB;gBAC9D,OAAO;gBACP,SAAS,EAAE,kBAAkB;aAC9B;SACF,CAAC,IAAI,CAAC,CAAC;IACV,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,OAAO,IAAI,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,CAAC,QAAQ,GAAG,kBAAkB,CAAC;AACxC,CAAC,CAAC,CAAC;AAEH,SAAS,YAAY,CAAC,IAAuB;IAC3C,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,UAAU,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC;AACzF,CAAC"}

package/dist/scripts/canary-benchmark.js

@@ -0,0 +1,54 @@
+/** Explicit Docker canary. Fixture harness is deterministic and calls no model. */
+import assert from "node:assert/strict";
+import { mkdir, mkdtemp, readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { tmpdir } from "node:os";
+import { pathToFileURL } from "node:url";
+import { validateBenchmark } from "../src/benchmarks/index.js";
+import { exportStandardBenchmarkDataset, runEval } from "../src/evals/index.js";
+import { atomicWriteJSON, runCommand } from "../src/foundation/index.js";
+import { writeBenchmarkFixture } from "../test-support/benchmark-fixture.js";
+if (process.argv[2] !== "--fixture")
+    throw new Error("Usage: node dist/scripts/canary-benchmark.js --fixture");
+const directory = await mkdtemp(path.join(tmpdir(), "hitch-benchmark-canary-"));
+const packageDir = path.join(directory, "package");
+await writeBenchmarkFixture(packageDir, { benchmark: "runtime-created-counter", task: "reach-seven", tool: "bump_value", metric: "goal_met" });
+await validateBenchmark(packageDir);
+const dataset = path.join(directory, "dataset");
+await exportStandardBenchmarkDataset(packageDir, dataset);
+const harnessDir = path.join(directory, "harness");
+await mkdir(harnessDir);
+const metadata = { name: "hitch-benchmark-deterministic-fixture", version: "1.0.0", private: true, scripts: { build: "node build.js" } };
+await atomicWriteJSON(path.join(harnessDir, "package.json"), metadata);
+await atomicWriteJSON(path.join(harnessDir, "package-lock.json"), { name: metadata.name, version: "1.0.0", lockfileVersion: 3, requires: true, packages: { "": { name: metadata.name, version: "1.0.0" } } });
+const code = `#!/usr/bin/env node
+if (process.argv.includes('--version')) { console.log('pi 1.0.0'); process.exit(0); }
+const fs=require('node:fs'), child=require('node:child_process');
+let prompt=''; process.stdin.setEncoding('utf8'); process.stdin.on('data', x=>prompt+=x);
+process.stdin.on('end',()=>{
+ const binding=JSON.parse(fs.readFileSync('/tmp/hitch-tool-binding.json','utf8'));
+ const result=child.execFileSync(process.execPath,['/tmp/hitch-tools.mjs',binding.tools[0].name,JSON.stringify({amount:7})],{encoding:'utf8'});
+ console.log(JSON.stringify({type:'session',version:3,id:'fixture_session',cwd:process.cwd()}));
+ console.log(JSON.stringify({type:'message_update',assistantMessageEvent:{type:'text_delta',contentIndex:0,delta:result}}));
+ console.log(JSON.stringify({type:'message_end',message:{role:'assistant',content:[{type:'text',text:result}],usage:{input:0,output:0,cacheRead:0,cacheWrite:0,totalTokens:0,cost:{input:0,output:0,cacheRead:0,cacheWrite:0,total:0}},stopReason:'stop'}}));
+});
+`;
+await writeFile(path.join(harnessDir, "build.js"), `const fs=require('node:fs'); fs.mkdirSync('packages/coding-agent/dist',{recursive:true}); fs.writeFileSync('packages/coding-agent/dist/cli.js',${JSON.stringify(code)},{mode:0o755});\n`);
+await runCommand("git", ["init", harnessDir]);
+await runCommand("git", ["-C", harnessDir, "add", "."]);
+await runCommand("git", ["-C", harnessDir, "-c", "user.name=Hitch Fixture", "-c", "user.email=fixture@example.test", "commit", "-m", "deterministic tool-server canary"]);
+const revision = (await runCommand("git", ["-C", harnessDir, "rev-parse", "HEAD"])).stdout.trim();
+console.log(JSON.stringify({ directory, candidate: "deterministic-fixture", revision }));
+const result = await runEval({
+    root: path.resolve(".hitch/benchmark-fixture-state"),
+    request: { dataset, harness_ref: `pi@git+${pathToFileURL(harnessDir).href}#${revision}`, model: "fixture", max_concurrent: 1, attempts: 1 },
+    onEvent: (event) => console.log(JSON.stringify(event)),
+});
+await atomicWriteJSON(path.join(directory, "result.json"), result);
+assert.equal(result.exit_code, 0, JSON.stringify(result));
+// A score must be present and one, proving the candidate called the new tool.
+const resultText = await readFile(path.join(directory, "result.json"), "utf8");
+assert.match(resultText, /"reward":\s*1/);
+assert.match(resultText, /"total_score":\s*1/);
+console.log(JSON.stringify({ passed: true, directory, result }, null, 2));
+//# sourceMappingURL=canary-benchmark.js.map

package/dist/scripts/canary-benchmark.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canary-benchmark.js","sourceRoot":"","sources":["../../scripts/canary-benchmark.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,8BAA8B,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAE7E,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,WAAW;IAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;AAC/G,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAC,CAAC;AAChF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AACnD,MAAM,qBAAqB,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,yBAAyB,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;AAC/I,MAAM,iBAAiB,CAAC,UAAU,CAAC,CAAC;AACpC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AAChD,MAAM,8BAA8B,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AACnD,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC;AACxB,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,uCAAuC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,CAAC;AACzI,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,QAAQ,CAAC,CAAC;AACvE,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;AAC9M,MAAM,IAAI,GAAG;;;;;;;;;;;CAWZ,CAAC;AACF,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,kJAAkJ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;AAC9O,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAC9C,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;AACxD,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,iCAAiC,EAAE,QAAQ,EAAE,IAAI,EAAE,kCAAkC,CAAC,CAAC,CAAC;AAC1K,MAAM,QAAQ,GAAG,CAAC,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AAClG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,uBAAuB,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;AACzF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;IAC3B,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,gCAAgC,CAAC;IACpD,OAAO,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,aAAa,CAAC,UAAU,CAAC,CAAC,IAAI,IAAI,QAAQ,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE;IAC3I,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;CACvD,CAAC,CAAC;AACH,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC;AACnE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;AAC1D,8EAA8E;AAC9E,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC;AAC/E,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;AAC1C,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC;AAC/C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC"}

package/dist/scripts/canary-buildkit-secrets.js

@@ -0,0 +1,166 @@
+import { randomBytes } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { mkdir, mkdtemp, readFile, readdir, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { gunzipSync, inflateSync, zstdDecompressSync } from "node:zlib";
+const SECRET_NAME = "HITCH_CANARY_SECRET";
+const MAX_SCAN_FILE_BYTES = 256 * 1024 * 1024;
+const docker = process.env.HITCH_DOCKER_PATH || "docker";
+const base = process.env.HITCH_DOCKER_CANARY_BASE || "ubuntu:24.04";
+const platform = process.env.HITCH_DOCKER_CANARY_PLATFORM || "linux/amd64";
+const temporary = await mkdtemp(path.join(tmpdir(), "hitch-buildkit-secret-canary-"));
+const context = path.join(temporary, "context");
+const cacheOne = path.join(temporary, "cache-one");
+const cacheTwo = path.join(temporary, "cache-two");
+const imageTar = path.join(temporary, "image.tar");
+const metadataOne = path.join(temporary, "metadata-one.json");
+const metadataTwo = path.join(temporary, "metadata-two.json");
+const tag = `hitch-buildkit-secret-canary:${randomBytes(8).toString("hex")}`;
+const secretOne = `hitch-canary-a-${randomBytes(24).toString("hex")}`;
+const secretTwo = `hitch-canary-b-${randomBytes(24).toString("hex")}`;
+const cacheMode = selectedBuilderDriver() === "docker" ? "inline" : "local";
+let baseContainer;
+try {
+    await writeFile(path.join(temporary, ".keep"), "");
+    await mkdir(context);
+    const baseInspect = run(["image", "inspect", "--format", "{{.Id}} {{.Os}}/{{.Architecture}}", base]);
+    const [baseIdentity, basePlatform] = baseInspect.stdout.trim().split(" ");
+    if (!baseIdentity || !/^sha256:[a-f0-9]{64}$/.test(baseIdentity) || basePlatform !== platform) {
+        throw new Error(`local canary base platform does not match ${platform}`);
+    }
+    baseContainer = run(["create", "--platform", platform, base]).stdout.trim();
+    if (!/^[a-f0-9]{64}$/.test(baseContainer))
+        throw new Error("Docker returned an invalid temporary container id");
+    run(["export", "--output", path.join(context, "rootfs.tar"), baseContainer]);
+    run(["container", "rm", baseContainer]);
+    baseContainer = undefined;
+    await writeFile(path.join(context, "Dockerfile"), [
+        "FROM scratch",
+        "ADD rootfs.tar /",
+        `RUN --mount=type=secret,id=${SECRET_NAME},required=true test \"$(wc -c < /run/secrets/${SECRET_NAME})\" -ge 32` + " \\",
+        "    && printf 'secret-mounted-not-copied\\n' > /hitch-secret-proof",
+        "",
+    ].join("\n"));
+    const first = build(secretOne, metadataOne, cacheOne);
+    const firstIdentity = imageIdentity(tag);
+    const second = build(secretTwo, metadataTwo, cacheTwo, cacheOne);
+    const secondIdentity = imageIdentity(tag);
+    if (firstIdentity !== secondIdentity)
+        throw new Error("rotating the secret changed the image config digest");
+    if (!/\bCACHED\b/.test(`${second.stdout}\n${second.stderr}`))
+        throw new Error("rotated-secret build did not reuse the exported cache");
+    const proof = run(["run", "--rm", "--entrypoint", "/bin/sh", tag, "-c", "cat /hitch-secret-proof"]);
+    if (proof.stdout.trim() !== "secret-mounted-not-copied")
+        throw new Error("built image did not prove the secret mount was readable");
+    run(["save", "--output", imageTar, tag]);
+    const secrets = [Buffer.from(secretOne), Buffer.from(secretTwo)];
+    assertTextDoesNotContain(first.stdout + first.stderr + second.stdout + second.stderr, secrets, "BuildKit output");
+    await scanTree(temporary, secrets);
+    const metadata = JSON.parse(await readFile(metadataTwo, "utf8"));
+    process.stdout.write(`${JSON.stringify({
+        ok: true,
+        docker: run(["version", "--format", "{{.Server.Version}}"]).stdout.trim(),
+        buildx: run(["buildx", "version"]).stdout.trim(),
+        base,
+        platform,
+        image_config_digest: secondIdentity,
+        manifest_digest: metadata["containerimage.digest"],
+        cache_export: cacheMode === "local" ? "local-directory" : "inline-image-metadata",
+        rotated_secret_cache_hit: true,
+        scanned: cacheMode === "local"
+            ? ["docker-save image tar", "first exported local cache", "rotated-secret exported local cache", "BuildKit logs and metadata"]
+            : ["docker-save image tar including inline cache metadata", "BuildKit logs and metadata"],
+    }, null, 2)}\n`);
+}
+finally {
+    if (baseContainer)
+        spawnSync(docker, ["container", "rm", "--force", baseContainer], { encoding: "utf8" });
+    spawnSync(docker, ["image", "rm", tag], { encoding: "utf8" });
+    await rm(temporary, { recursive: true, force: true });
+}
+function build(secret, metadataFile, cacheTo, cacheFrom) {
+    return run([
+        "buildx", "build",
+        "--progress", "plain",
+        "--load",
+        "--provenance=false",
+        "--platform", platform,
+        "--file", path.join(context, "Dockerfile"),
+        "--tag", tag,
+        "--metadata-file", metadataFile,
+        "--secret", `id=${SECRET_NAME},env=${SECRET_NAME}`,
+        ...(cacheMode === "local" && cacheFrom ? ["--cache-from", `type=local,src=${cacheFrom}`] : []),
+        "--cache-to", cacheMode === "local" ? `type=local,dest=${cacheTo},mode=max` : "type=inline",
+        context,
+    ], { [SECRET_NAME]: secret });
+}
+function selectedBuilderDriver() {
+    const inspected = run(["buildx", "inspect"]).stdout;
+    const driver = inspected.match(/^Driver:\s+(\S+)$/m)?.[1];
+    if (!driver)
+        throw new Error("cannot determine the selected Buildx driver");
+    return driver;
+}
+function imageIdentity(reference) {
+    const identity = run(["image", "inspect", "--format", "{{.Id}}", reference]).stdout.trim();
+    if (!/^sha256:[a-f0-9]{64}$/.test(identity))
+        throw new Error("Docker returned an invalid image config digest");
+    return identity;
+}
+function run(args, extraEnv = {}) {
+    const result = spawnSync(docker, args, {
+        encoding: "utf8",
+        env: { ...process.env, ...extraEnv },
+        maxBuffer: 64 * 1024 * 1024,
+    });
+    if (result.status !== 0) {
+        const output = `${result.stderr || ""}\n${result.stdout || ""}`.slice(0, 64 * 1024);
+        if ((secretOne && output.includes(secretOne)) || (secretTwo && output.includes(secretTwo))) {
+            throw new Error(`Docker command failed and exposed ${SECRET_NAME}`);
+        }
+        throw new Error(`Docker command failed (${args.slice(0, 2).join(" ")}): ${output}`);
+    }
+    return { stdout: result.stdout || "", stderr: result.stderr || "" };
+}
+async function scanTree(root, secrets) {
+    for (const entry of await readdir(root, { withFileTypes: true })) {
+        const target = path.join(root, entry.name);
+        if (entry.isDirectory())
+            await scanTree(target, secrets);
+        else if (entry.isFile())
+            await scanFile(target, secrets);
+    }
+}
+async function scanFile(file, secrets) {
+    const raw = await readFile(file);
+    if (raw.byteLength > MAX_SCAN_FILE_BYTES)
+        throw new Error(`canary evidence file is too large to scan safely: ${path.basename(file)}`);
+    assertBufferDoesNotContain(raw, secrets, file);
+    for (const decoded of decodedCandidates(raw))
+        assertBufferDoesNotContain(decoded, secrets, `${file} (decompressed)`);
+}
+function decodedCandidates(value) {
+    const candidates = [];
+    try {
+        if (value[0] === 0x1f && value[1] === 0x8b)
+            candidates.push(gunzipSync(value));
+        else if (value[0] === 0x78)
+            candidates.push(inflateSync(value));
+        else if (value[0] === 0x28 && value[1] === 0xb5 && value[2] === 0x2f && value[3] === 0xfd)
+            candidates.push(zstdDecompressSync(value));
+    }
+    catch {
+        throw new Error("canary could not decompress exported cache evidence");
+    }
+    return candidates;
+}
+function assertTextDoesNotContain(value, secrets, label) {
+    assertBufferDoesNotContain(Buffer.from(value), secrets, label);
+}
+function assertBufferDoesNotContain(value, secrets, label) {
+    for (const secret of secrets)
+        if (value.includes(secret))
+            throw new Error(`${SECRET_NAME} leaked into ${label}`);
+}
+//# sourceMappingURL=canary-buildkit-secrets.js.map

package/dist/scripts/canary-buildkit-secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canary-buildkit-secrets.js","sourceRoot":"","sources":["../../scripts/canary-buildkit-secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpF,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAExE,MAAM,WAAW,GAAG,qBAAqB,CAAC;AAC1C,MAAM,mBAAmB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,QAAQ,CAAC;AACzD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,cAAc,CAAC;AACpE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,aAAa,CAAC;AAC3E,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,+BAA+B,CAAC,CAAC,CAAC;AACtF,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AACnD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;AAC9D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;AAC9D,MAAM,GAAG,GAAG,gCAAgC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAC7E,MAAM,SAAS,GAAG,kBAAkB,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACtE,MAAM,SAAS,GAAG,kBAAkB,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACtE,MAAM,SAAS,GAAG,qBAAqB,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;AAC5E,IAAI,aAAiC,CAAC;AAEtC,IAAI,CAAC;IACH,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;IACrB,MAAM,WAAW,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,mCAAmC,EAAE,IAAI,CAAC,CAAC,CAAC;IACrG,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1E,IAAI,CAAC,YAAY,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,YAAY,KAAK,QAAQ,EAAE,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,6CAA6C,QAAQ,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,aAAa,GAAG,GAAG,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC5E,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAChH,GAAG,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC;IAC7E,GAAG,CAAC,CAAC,WAAW,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;IACxC,aAAa,GAAG,SAAS,CAAC;IAC1B,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE;QAChD,cAAc;QACd,kBAAkB;QAClB,8BAA8B,WAAW,gDAAgD,WAAW,YAAY,GAAG,KAAK;QACxH,oEAAoE;QACpE,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAEd,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IACtD,MAAM,aAAa,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjE,MAAM,cAAc,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,aAAa,KAAK,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IAC7G,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAEvI,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,yBAAyB,CAAC,CAAC,CAAC;IACpG,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,2BAA2B;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IACpI,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;IAEzC,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACjE,wBAAwB,CAAC,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAClH,MAAM,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAEnC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAA4B,CAAC;IAC5F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;QACrC,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,qBAAqB,CAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;QAC1E,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;QAChD,IAAI;QACJ,QAAQ;QACR,mBAAmB,EAAE,cAAc;QACnC,eAAe,EAAE,QAAQ,CAAC,uBAAuB,CAAC;QAClD,YAAY,EAAE,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,uBAAuB;QACjF,wBAAwB,EAAE,IAAI;QAC9B,OAAO,EAAE,SAAS,KAAK,OAAO;YAC5B,CAAC,CAAC,CAAC,uBAAuB,EAAE,4BAA4B,EAAE,qCAAqC,EAAE,4BAA4B,CAAC;YAC9H,CAAC,CAAC,CAAC,uDAAuD,EAAE,4BAA4B,CAAC;KAC5F,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AACnB,CAAC;QAAS,CAAC;IACT,IAAI,aAAa;QAAE,SAAS,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1G,SAAS,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9D,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,KAAK,CAAC,MAAc,EAAE,YAAoB,EAAE,OAAe,EAAE,SAAkB;IACtF,OAAO,GAAG,CAAC;QACT,QAAQ,EAAE,OAAO;QACjB,YAAY,EAAE,OAAO;QACrB,QAAQ;QACR,oBAAoB;QACpB,YAAY,EAAE,QAAQ;QACtB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC;QAC1C,OAAO,EAAE,GAAG;QACZ,iBAAiB,EAAE,YAAY;QAC/B,UAAU,EAAE,MAAM,WAAW,QAAQ,WAAW,EAAE;QAClD,GAAG,CAAC,SAAS,KAAK,OAAO,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,kBAAkB,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9F,YAAY,EAAE,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,mBAAmB,OAAO,WAAW,CAAC,CAAC,CAAC,aAAa;QAC3F,OAAO;KACR,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,qBAAqB;IAC5B,MAAM,SAAS,GAAG,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IACpD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC5E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,SAAiB;IACtC,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC3F,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAC/G,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,GAAG,CAAC,IAAc,EAAE,WAA8B,EAAE;IAC3D,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE;QACrC,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE;QACpC,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;KAC5B,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,KAAK,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;QACpF,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YAC3F,MAAM,IAAI,KAAK,CAAC,qCAAqC,WAAW,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,OAAiB;IACrD,KAAK,MAAM,KAAK,IAAI,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACjE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,KAAK,CAAC,WAAW,EAAE;YAAE,MAAM,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;aACpD,IAAI,KAAK,CAAC,MAAM,EAAE;YAAE,MAAM,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,OAAiB;IACrD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,GAAG,CAAC,UAAU,GAAG,mBAAmB;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtI,0BAA0B,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/C,KAAK,MAAM,OAAO,IAAI,iBAAiB,CAAC,GAAG,CAAC;QAAE,0BAA0B,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,iBAAiB,CAAC,CAAC;AACvH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;aAC1E,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;aAC3D,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,UAAU,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;IACxI,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IAAC,CAAC;IACnF,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAa,EAAE,OAAiB,EAAE,KAAa;IAC/E,0BAA0B,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAa,EAAE,OAAiB,EAAE,KAAa;IACjF,KAAK,MAAM,MAAM,IAAI,OAAO;QAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,WAAW,gBAAgB,KAAK,EAAE,CAAC,CAAC;AACnH,CAAC"}

package/dist/scripts/canary-collision-domains.js

@@ -0,0 +1,77 @@
+import { randomBytes } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { runCommand } from "../src/foundation/index.js";
+const docker = process.env.HITCH_DOCKER_PATH || "docker";
+const base = process.env.HITCH_COLLISION_CANARY_BASE || "ubuntu:24.04";
+const endpoints = (process.env.HITCH_COLLISION_DOMAIN_DOCKER_HOSTS ?? "")
+    .split(",").map((value) => value.trim()).filter(Boolean);
+if (endpoints.length !== 2) {
+    process.stdout.write(`${JSON.stringify({
+        schema_version: "1", status: "unsupported", code: "two_docker_endpoints_required",
+        message: "set HITCH_COLLISION_DOMAIN_DOCKER_HOSTS to two comma-separated Docker endpoints",
+    }, null, 2)}\n`);
+    process.exitCode = 3;
+}
+else {
+    await runCanary(endpoints);
+}
+async function runCanary(hosts) {
+    const nonce = randomBytes(8).toString("hex");
+    const name = `hitch-collision-domain-${nonce}`;
+    const containers = new Map();
+    const startedAt = Date.now();
+    try {
+        const engines = await Promise.all(hosts.map(async (host) => {
+            const [id, version] = (await command(host, ["info", "--format", "{{.ID}} {{.ServerVersion}}"])).stdout.trim().split(/\s+/);
+            if (!id || !version)
+                throw new Error(`Docker endpoint did not expose a stable engine identity: ${host}`);
+            return { host, id, version };
+        }));
+        if (engines[0].id === engines[1].id) {
+            process.stdout.write(`${JSON.stringify({
+                schema_version: "1", status: "unsupported", code: "collision_domains_not_independent",
+                engines,
+            }, null, 2)}\n`);
+            process.exitCode = 3;
+            return;
+        }
+        await Promise.all(engines.map((engine) => command(engine.host, ["image", "inspect", base])));
+        const launches = await Promise.all(engines.map(async (engine) => {
+            const id = (await command(engine.host, [
+                "container", "run", "--detach", "--name", name,
+                "--label", "io.hitch.canary=collision-domain-v1",
+                "--label", "io.hitch.task-id=same-task",
+                "--label", `io.hitch.collision-domain-id=${engine.id}`,
+                base, "/bin/sh", "-c", "sleep 3",
+            ])).stdout.trim();
+            if (!/^[a-f0-9]{64}$/.test(id))
+                throw new Error(`Docker endpoint returned an invalid container id: ${engine.host}`);
+            containers.set(engine.host, id);
+            return { ...engine, container_id: id };
+        }));
+        const running = await Promise.all(launches.map(async (entry) => ({
+            ...entry,
+            running: (await command(entry.host, ["container", "inspect", "--format", "{{.State.Running}}", entry.container_id])).stdout.trim() === "true",
+        })));
+        if (running.some((entry) => !entry.running))
+            throw new Error("same-task containers did not overlap across independent collision domains");
+        const exitCodes = await Promise.all(running.map(async (entry) => Number((await command(entry.host, ["container", "wait", entry.container_id], 10_000)).stdout.trim())));
+        if (exitCodes.some((code) => code !== 0))
+            throw new Error(`collision-domain container failed: ${exitCodes.join(",")}`);
+        process.stdout.write(`${JSON.stringify({
+            schema_version: "1", status: "passed", task_id: "same-task", identical_container_name: name,
+            engines: running.map(({ host, id, version, container_id }) => ({ host, collision_domain_id: id, docker_version: version, container_id })),
+            overlap_observed: true, duration_ms: Date.now() - startedAt,
+        }, null, 2)}\n`);
+    }
+    finally {
+        for (const [host, id] of containers)
+            spawnSync(docker, ["--host", host, "container", "rm", "--force", id], { encoding: "utf8" });
+    }
+}
+function command(host, args, timeoutMs = 15_000) {
+    return runCommand(docker, ["--host", host, ...args], {
+        env: process.env, timeoutMs, failureCode: "collision_domain_canary_failed",
+    });
+}
+//# sourceMappingURL=canary-collision-domains.js.map

package/dist/scripts/canary-collision-domains.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canary-collision-domains.js","sourceRoot":"","sources":["../../scripts/canary-collision-domains.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAExD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,QAAQ,CAAC;AACzD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,cAAc,CAAC;AACvE,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mCAAmC,IAAI,EAAE,CAAC;KACtE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAE3D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;IAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;QACrC,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,+BAA+B;QACjF,OAAO,EAAE,iFAAiF;KAC3F,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACjB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC;KAAM,CAAC;IACN,MAAM,SAAS,CAAC,SAA6B,CAAC,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAuB;IAC9C,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,0BAA0B,KAAK,EAAE,CAAC;IAC/C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YACzD,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,4BAA4B,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC3H,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,IAAI,EAAE,CAAC,CAAC;YACzG,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;QAC/B,CAAC,CAAC,CAAC,CAAC;QACJ,IAAI,OAAO,CAAC,CAAC,CAAE,CAAC,EAAE,KAAK,OAAO,CAAC,CAAC,CAAE,CAAC,EAAE,EAAE,CAAC;YACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;gBACrC,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,mCAAmC;gBACrF,OAAO;aACR,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YACjB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7F,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YAC9D,MAAM,EAAE,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE;gBACrC,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI;gBAC9C,SAAS,EAAE,qCAAqC;gBAChD,SAAS,EAAE,4BAA4B;gBACvC,SAAS,EAAE,gCAAgC,MAAM,CAAC,EAAE,EAAE;gBACtD,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS;aACjC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAClB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YACpH,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAChC,OAAO,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;QACzC,CAAC,CAAC,CAAC,CAAC;QACJ,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YAC/D,GAAG,KAAK;YACR,OAAO,EAAE,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,oBAAoB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,MAAM;SAC9I,CAAC,CAAC,CAAC,CAAC;QACL,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;QAC1I,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACxK,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;YACrC,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAE,IAAI;YAC3F,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,EAAE,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;YACzI,gBAAgB,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SAC5D,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;YAAS,CAAC;QACT,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,UAAU;YAAE,SAAS,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACnI,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,IAAc,EAAE,SAAS,GAAG,MAAM;IAC/D,OAAO,UAAU,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,EAAE;QACnD,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,WAAW,EAAE,gCAAgC;KAC3E,CAAC,CAAC;AACL,CAAC"}