hammerkit 1.24.0 → 1.25.0

package/dist/server/definitions.js

@@ -2,152 +2,24 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DefinitionStore = exports.inspectBundle = exports.DefinitionError = void 0;
 const promises_1 = require("fs/promises");
-const os_1 = require("os");
 const path_1 = require("path");
 const crypto_1 = require("crypto");
-const yaml_1 = require("yaml");
-const get_file_context_1 = require("../file/get-file-context");
-const resolve_git_source_1 = require("../includes/resolve-git-source");
-const schema_parser_1 = require("../schema/schema-parser");
-const reference_parser_1 = require("../schema/reference-parser");
-const work_scope_parser_1 = require("../schema/work-scope-parser");
-const work_task_1 = require("../planner/work-task");
 const bundle_1 = require("../remote/bundle");
-const log_1 = require("../log");
-class DefinitionError extends Error {
-}
-exports.DefinitionError = DefinitionError;
-// 40 (sha-1) or 64 (sha-256) hex digits
-const COMMIT_PATTERN = /^[0-9a-f]{40}([0-9a-f]{24})?$/i;
-// A hash alone can only name what is inside the bundle, so everything a build
-// file pulls in from elsewhere has to be pinned: a git include needs a commit
-// and a remote that is not a path on the server.
-function findLooseIncludes(bundle) {
-    const problems = [];
-    for (const [path, content] of Object.entries(bundle.files)) {
-        if (!/\.ya?ml$/i.test(path)) {
-            continue;
-        }
-        let document;
-        try {
-            document = (0, yaml_1.parse)(content);
-        }
-        catch {
-            continue; // a file that isn't valid yaml is reported when the bundle is parsed
-        }
-        for (const block of ['includes', 'references']) {
-            for (const [name, include] of Object.entries(document?.[block] ?? {})) {
-                const source = include;
-                if (!source || typeof source !== 'object' || source.git === undefined) {
-                    continue;
-                }
-                if (typeof source.git !== 'string' || !/^(https:\/\/|ssh:\/\/|git@[\w.-]+:)/.test(source.git)) {
-                    problems.push(`${path}: ${block}.${name}: git has to be an https:// or ssh:// address`);
-                }
-                if (typeof source.ref !== 'string' || !COMMIT_PATTERN.test(source.ref)) {
-                    problems.push(`${path}: ${block}.${name}: pin ref to a commit, a branch or tag can move`);
-                }
-            }
-        }
-    }
-    return problems;
-}
-// What a build file may read while it is inspected: its own files. The rest of
-// the server is not its business (a missing file is "not there", not an error).
-function confined(files, root) {
-    const check = (path) => {
-        if (!(0, resolve_git_source_1.isWithin)(root, (0, path_1.resolve)(root, path))) {
-            throw new DefinitionError(`${path} is outside of the bundle`);
-        }
-    };
-    const guarded = (fn) => (path) => {
-        check(path);
-        return fn.call(files, path);
-    };
-    return {
-        ...files,
-        read: guarded(files.read),
-        readStream: guarded(files.readStream),
-        listFiles: guarded(files.listFiles),
-        stats: guarded(files.stats),
-        exists: async (path) => (0, resolve_git_source_1.isWithin)(root, (0, path_1.resolve)(root, path)) && files.exists(path),
-        watch: files.watch,
-    };
-}
-// A path of a task, written relative to the root of the bundle with forward
-// slashes. A leading `!` (an exclusion) is kept. Nothing is returned for a path
-// outside of the bundle.
-function insideBundle(root, cwd, path) {
-    const negated = path.startsWith('!');
-    const absolute = (0, path_1.resolve)(cwd, negated ? path.slice(1) : path);
-    const inside = (0, path_1.relative)(root, absolute);
-    if (inside === '..' || inside.startsWith(`..${path_1.sep}`) || (0, path_1.isAbsolute)(inside)) {
-        return [];
-    }
-    const portable = inside.split(path_1.sep).join(path_1.posix.sep);
-    // a pattern keeps its glob characters, `resolve` only normalizes separators
-    return [`${negated ? '!' : ''}${portable === '' ? '.' : portable}`];
-}
-// Writes the bundle into a directory of its own and reads it the way a run
-// would, so a build file that doesn't parse is refused when it is published, not
-// when somebody wants to run it.
-async function inspectBundle(bundle, environment) {
-    const problems = findLooseIncludes(bundle);
-    if (problems.length > 0) {
-        throw new DefinitionError(problems.join('\n'));
-    }
-    const directory = await (0, promises_1.mkdtemp)((0, path_1.join)((0, os_1.tmpdir)(), 'hammerkit-definition-'));
-    try {
-        for (const [path, content] of Object.entries(bundle.files)) {
-            await (0, promises_1.mkdir)((0, path_1.dirname)((0, path_1.join)(directory, path)), { recursive: true });
-            await (0, promises_1.writeFile)((0, path_1.join)(directory, path), content);
-        }
-        const inspected = {
-            ...environment,
-            cwd: directory,
-            file: confined((0, get_file_context_1.getFileContext)(directory), directory),
-        };
-        try {
-            const { ctx, scope } = await (0, schema_parser_1.createParseContext)((0, path_1.join)(directory, bundle.entry), inspected);
-            const context = await (0, reference_parser_1.parseReferences)(ctx, scope, inspected);
-            const workTree = (0, work_scope_parser_1.getWorkContext)(context, { environmentName: null }, inspected);
-            const inputs = {};
-            for (const item of Object.values(workTree.tasks)) {
-                inputs[item.name] = {
-                    // the sources a task inherits from its dependencies belong to those
-                    src: item.data.src
-                        .filter((source) => source.inherited === null)
-                        .flatMap((source) => insideBundle(directory, item.data.cwd, source.source)),
-                    mounts: (0, work_task_1.isContainerWorkTask)(item.data)
-                        ? item.data.mounts.flatMap((mount) => insideBundle(directory, item.data.cwd, mount.localPath))
-                        : [],
-                    deps: item.deps.map((dep) => dep.name).sort(),
-                    needs: item.needs.map((need) => need.name).sort(),
-                };
-            }
-            return {
-                tasks: Object.keys(context.tasks).sort(),
-                services: Object.keys(context.services).sort(),
-                inputs: Object.fromEntries(Object.entries(inputs).sort(([a], [b]) => (a < b ? -1 : 1))),
-            };
-        }
-        catch (e) {
-            throw new DefinitionError((0, log_1.getErrorMessage)(e).split(directory).join('.'));
-        }
-    }
-    finally {
-        await (0, promises_1.rm)(directory, { recursive: true, force: true });
-    }
-}
-exports.inspectBundle = inspectBundle;
+const plan_1 = require("./plan");
+var plan_2 = require("./plan");
+Object.defineProperty(exports, "DefinitionError", { enumerable: true, get: function () { return plan_2.DefinitionError; } });
+Object.defineProperty(exports, "inspectBundle", { enumerable: true, get: function () { return plan_2.inspectBundle; } });
 // The published build files: immutable versions, each named by its hash. They
 // are kept in files, so a restart doesn't forget what runs were started from.
 class DefinitionStore {
-    constructor(directory, environment, now = Date.now) {
+    constructor(directory, 
+    // the environment a build file is read with: on a server, the hosted one
+    environment, options = {}) {
         this.directory = directory;
         this.environment = environment;
-        this.now = now;
+        this.options = options;
         this.versions = new Map();
+        this.now = options.now ?? Date.now;
     }
     async load() {
         let names = [];
@@ -174,10 +46,43 @@ class DefinitionStore {
     list(name) {
         return this.has(name) ? [...this.versions.get(name)] : [];
     }
-    // a hash, or `latest` for the version published last
+    // a hash, or `latest` for the version published last that is not yanked
     find(name, hash) {
         const versions = this.list(name);
-        return hash === 'latest' ? versions[0] : versions.find((v) => v.hash === hash);
+        return hash === 'latest' ? versions.find((v) => !v.yanked) : versions.find((v) => v.hash === hash);
+    }
+    /**
+     * Pulls a version back (or, with `undo`, lets it go on). The version is rewritten in
+     * place, its files stay: a run that was started from it has them.
+     */
+    async yank(name, hash, by, options = {}) {
+        const version = this.versions.get(name)?.find((v) => v.hash === hash);
+        if (!version || Boolean(version.yanked) === !options.undo) {
+            return version;
+        }
+        const bundle = await this.files(version);
+        if (!bundle) {
+            return version;
+        }
+        const next = { ...version };
+        if (options.undo) {
+            delete next.yanked;
+        }
+        else {
+            next.yanked = {
+                at: new Date(this.now()).toISOString(),
+                by: { iss: by.iss, sub: by.sub },
+                ...(options.reason ? { reason: options.reason } : {}),
+            };
+        }
+        const file = this.file(name, hash);
+        const temporary = `${file}.${(0, crypto_1.randomBytes)(8).toString('hex')}.tmp`;
+        await (0, promises_1.writeFile)(temporary, JSON.stringify({ version: next, bundle }), { flag: 'wx' });
+        await (0, promises_1.rename)(temporary, file);
+        // the same object, so whoever holds the version sees it
+        Object.keys(version).forEach((key) => delete version[key]);
+        Object.assign(version, next);
+        return version;
     }
     async files(version) {
         try {
@@ -189,13 +94,18 @@ class DefinitionStore {
     }
     // Reads a bundle the way a run would and says what it would be as a version;
     // `existing` is the published version with the same hash, if there is one.
-    async prepare(name, bundle, publisher) {
+    async prepare(name, bundle, publisher, 
+    // a proposal is read before anybody trusts it: it may not make the server fetch
+    options = {}) {
         const hash = (0, bundle_1.hashBundle)(bundle);
         const existing = this.find(name, hash);
         if (existing) {
             return { version: existing, existing };
         }
-        const { tasks, services, inputs } = await inspectBundle(bundle, this.environment);
+        const { tasks, services, inputs, plan, accounts } = await (0, plan_1.planBundle)(bundle, this.environment, {
+            policy: this.options.policy,
+            noRemote: options.noRemote,
+        });
         return {
             version: {
                 name,
@@ -206,6 +116,8 @@ class DefinitionStore {
                 tasks,
                 services,
                 inputs,
+                plan,
+                accounts,
             },
         };
     }
@@ -239,7 +151,7 @@ class DefinitionStore {
     }
     file(name, hash) {
         if (!bundle_1.HASH_PATTERN.test(hash)) {
-            throw new DefinitionError('invalid hash');
+            throw new plan_1.DefinitionError('invalid hash');
         }
         return (0, path_1.join)(this.directory, name, `${hash.slice('sha256:'.length)}.json`);
     }

package/dist/server/executor.js

@@ -1,96 +1,87 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.HostExecutor = exports.passedEnvironment = void 0;
+exports.HostExecutor = exports.defaultWorker = void 0;
+const child_process_1 = require("child_process");
+const crypto_1 = require("crypto");
+const fs_1 = require("fs");
 const promises_1 = require("fs/promises");
 const path_1 = require("path");
-const cli_1 = require("../cli");
-const get_file_context_1 = require("../file/get-file-context");
-const log_1 = require("../log");
+const readline_1 = require("readline");
 const resolve_git_source_1 = require("../includes/resolve-git-source");
-const parse_label_arguments_1 = require("../parser/parse-label-arguments");
-const schema_parser_1 = require("../schema/schema-parser");
-const reference_parser_1 = require("../schema/reference-parser");
-const work_scope_parser_1 = require("../schema/work-scope-parser");
-const work_item_status_1 = require("../planner/work-item-status");
-const plan_work_tasks_1 = require("../planner/utils/plan-work-tasks");
-const redact_1 = require("../utils/redact");
-const empty_writable_1 = require("../utils/empty-writable");
-const units_1 = require("../utils/units");
 const git_checkout_1 = require("./git-checkout");
-// What a task on the server sees of the server's own environment: the tools it
-// needs to find and reach docker, nothing the operator keeps there for the server.
-const PASSED_ENVS = [
-    'PATH',
-    'HOME',
-    'LANG',
-    'LC_ALL',
-    'TMPDIR',
-    'DOCKER_HOST',
-    'DOCKER_CONFIG',
-    'SSL_CERT_FILE',
-    'HTTP_PROXY',
-    'HTTPS_PROXY',
-    'NO_PROXY',
-    'http_proxy',
-    'https_proxy',
-    'no_proxy',
-    'SSH_AUTH_SOCK',
-    // Windows: without these powershell and git can not find their profile
-    'SystemRoot',
-    'SystemDrive',
-    'windir',
-    'ComSpec',
-    'PATHEXT',
-    'USERPROFILE',
-    'APPDATA',
-    'LOCALAPPDATA',
-    'TEMP',
-    'TMP',
-    'ProgramData',
-    'ProgramFiles',
-    'ProgramFiles(x86)',
-    // powershell is very slow to start without it
-    'PSModulePath',
-];
-// one log line of a task is cut here, the registry caps how many events a run keeps
-const MAX_LOG_TEXT = 8 * 1024;
-function passedEnvironment(envs) {
-    const passed = {};
-    for (const name of PASSED_ENVS) {
-        if (envs[name] !== undefined) {
-            passed[name] = envs[name];
-        }
-    }
-    return passed;
+const run_plan_1 = require("./run-plan");
+// `.git` as a file system may read it: any case, and a name Windows reads without its
+// trailing dots and spaces, or by its short name
+function isGitDirectory(segment) {
+    const name = segment.toLowerCase().replace(/[. ]+$/, '');
+    return name === '.git' || name === 'git~1';
+}
+// A cancelled run gets this long to stop its tasks and remove its containers
+const STOP_GRACE_MS = 15000;
+// what is kept of the error output of a process that died without saying why
+const MAX_STDERR = 2 * 1024;
+/**
+ * The command that starts the process of a run: `hammerkit server-run`, from the
+ * build this module is part of. Only found next to a built `index.js`.
+ */
+function defaultWorker() {
+    const entry = (0, path_1.resolve)(__dirname, '..', 'index.js');
+    return (0, fs_1.existsSync)(entry) ? [process.execPath, entry, 'server-run'] : undefined;
+}
+exports.defaultWorker = defaultWorker;
+// The cache a run shares with others is the one of its source: the runs of a repository
+// share one, those of an upload only the uploader's. Somebody who can only upload can
+// not leave an entry for a run from a reviewed repository to find.
+function cacheNamespace(run) {
+    const key = run.source.type === 'ref' ? `ref\0${run.source.repo}` : `upload\0${run.owner.iss}\0${run.owner.sub}`;
+    return `${run.source.type}-${(0, crypto_1.createHash)('sha256').update(key).digest('hex').slice(0, 24)}`;
 }
-exports.passedEnvironment = passedEnvironment;
 /**
- * Runs the tasks of a run on this machine with the engine of `hammerkit run`.
+ * Runs the tasks of a run on this machine with the engine of `hammerkit run`, in a
+ * process of its own.
  *
  * The working directory is made for the run and removed afterwards. Its build
  * file is the published version the run is pinned to, written over the code of the
- * source, so the commands are the published ones whatever the source says. The
- * local cache is shared by all runs, a task is keyed by its definition and
- * sources and not by where they are.
+ * source, so the commands are the published ones whatever the source says. The process
+ * starts with an environment the server builds: the variables `runs.env` lists, a home
+ * directory that is the run's alone, and a cache directory per source trust. So what
+ * the engine reads of its process (the docker host, the registry logins in the home
+ * directory, the credentials of the operator) is what the operator gave runs and
+ * nothing else. The cache is shared by the runs of the same source, a task is keyed by
+ * its definition and sources and not by where they are.
  */
 class HostExecutor {
     constructor(options) {
         this.options = options;
     }
     async execute(run, context) {
-        const { definitions, config, environment } = this.options;
+        const { definitions, planning, repos } = this.options;
         const version = definitions.find(run.definition.name, run.definition.hash);
         const bundle = version ? await definitions.files(version) : undefined;
         if (!version || !bundle) {
             throw new Error(`the build file ${run.definition.name} at ${run.definition.hash} is no longer on this server`);
         }
+        // pulled back after the run was accepted, while it waited for an approval or in the queue
+        if (version.yanked) {
+            throw new Error(`the build file ${run.definition.name} at ${run.definition.hash} was yanked${version.yanked.reason ? `: ${version.yanked.reason}` : ''}`);
+        }
         if (run.source.type !== 'ref') {
             throw new Error('runs from an upload are not supported by this server yet, use a git ref');
         }
-        const repository = config.sources[run.definition.name]?.git;
-        if (!repository) {
-            throw new Error(`this server has no repository for ${run.definition.name} to run ${run.source.ref} from, ` +
-                `the operator sets sources.${run.definition.name}.git`);
+        const { repo, ref, commit: pinned } = run.source;
+        if (!repos.readable(repo)) {
+            throw new Error(`this server can not read ${repo}, the operator lists it in sources`);
+        }
+        const worker = this.options.worker ?? defaultWorker();
+        if (!worker) {
+            throw new Error('this server has no command to start a run with, it needs to run from a built hammerkit');
+        }
+        // what was approved is what runs: the accounts are read again from the files with
+        // the environment of the run, and the run may use no more than it was admitted for
+        const planned = await (0, run_plan_1.planRun)(bundle, run, planning.environment, planning.policy);
+        const extra = planned.accounts.filter((account) => !run.accounts.includes(account));
+        if (extra.length > 0) {
+            throw new Error(`the run would use ${extra.join(', ')}, which it was not admitted for`);
         }
         const abortCtrl = new AbortController();
         const abort = () => abortCtrl.abort();
@@ -101,138 +92,146 @@ class HostExecutor {
         const root = (0, path_1.join)(this.options.directory, run.id);
         const checkout = (0, path_1.join)(root, 'source');
         try {
-            const passed = passedEnvironment(environment.processEnvs);
-            const commit = await (0, git_checkout_1.checkoutRef)(repository, run.source.ref, checkout, passed, abortCtrl.signal);
-            context.emit({ type: 'log', task: 'hammerkit', stream: 'stdout', text: `checked out ${commit}` });
+            const credentials = await repos.credentials(repo);
+            let commit;
+            try {
+                commit = await (0, git_checkout_1.checkoutRef)(repos.url(repo), ref, checkout, credentials.env, abortCtrl.signal, pinned);
+            }
+            catch (e) {
+                throw repos.scrub(e, credentials.values);
+            }
+            context.emit({ type: 'log', task: 'hammerkit', stream: 'stdout', text: `checked out ${repo} at ${commit}` });
             await this.writeBundle(checkout, bundle.files);
-            await this.runTasks(run, context, (0, path_1.join)(checkout, version.entry), checkout, passed, abortCtrl);
+            const home = (0, path_1.join)(root, 'home');
+            await (0, promises_1.mkdir)(home, { recursive: true });
+            const cache = (0, path_1.join)(this.options.cache, cacheNamespace(run));
+            await (0, promises_1.mkdir)(cache, { recursive: true });
+            const input = {
+                entry: (0, path_1.join)(checkout, version.entry),
+                tasks: run.tasks,
+                options: run.options,
+                accounts: run.accounts,
+                catalog: planning.environment.hosted?.catalog,
+            };
+            await this.runInProcess(worker, input, checkout, this.processEnvironment(home, cache), context, abortCtrl.signal);
         }
         finally {
             context.signal.removeEventListener('abort', abort);
             await (0, promises_1.rm)(root, { recursive: true, force: true });
         }
     }
-    // The published files go over the checkout; nothing may land outside of it or in
-    // its git directory.
-    async writeBundle(directory, files) {
-        for (const [path, content] of Object.entries(files)) {
-            const target = (0, path_1.resolve)(directory, path);
-            if (!(0, resolve_git_source_1.isWithin)(directory, target) || /^\.git(\/|$)/.test(path)) {
-                throw new Error(`the published file ${JSON.stringify(path)} can not be written into the source`);
+    // What the process of a run sees: the variables the operator listed, and a home
+    // directory and cache that are the run's. The server's own are not in it.
+    processEnvironment(home, cache) {
+        const env = {};
+        for (const [key, value] of Object.entries(this.options.planning.environment.processEnvs)) {
+            if (value !== undefined) {
+                env[key] = value;
             }
-            await (0, promises_1.mkdir)((0, path_1.dirname)(target), { recursive: true });
-            await (0, promises_1.writeFile)(target, content);
         }
+        env.HOME = home;
+        env.USERPROFILE = home;
+        env.APPDATA = (0, path_1.join)(home, 'AppData', 'Roaming');
+        env.LOCALAPPDATA = (0, path_1.join)(home, 'AppData', 'Local');
+        env.HAMMERKIT_DIR = cache;
+        return env;
     }
-    async runTasks(run, context, entry, cwd, passed, abortCtrl) {
-        const secrets = (0, redact_1.createSecretRegistry)();
-        const status = (0, work_item_status_1.statusConsole)((0, empty_writable_1.emptyWritable)(), secrets);
-        // what the engine would print to a terminal is not wanted, its status console
-        // is what is streamed: it is redacted with the secrets of this run
-        const environment = {
-            processEnvs: passed,
-            abortCtrl,
-            cwd,
-            file: (0, get_file_context_1.getFileContext)(cwd),
-            console: (0, log_1.consoleContext)((0, empty_writable_1.emptyWritable)()),
-            status,
-            secrets,
-            stdout: (0, empty_writable_1.emptyWritable)(),
-            stderr: (0, empty_writable_1.emptyWritable)(),
-            stdoutColumns: 120,
-        };
-        const listener = status.on((message) => {
-            if (message.type === 'console') {
-                context.emit({
-                    type: 'log',
-                    task: message.context.name,
-                    stream: message.console,
-                    text: message.message.slice(0, MAX_LOG_TEXT),
-                });
+    // Starts the process, hands it the run on its standard input and relays what it reports. It
+    // is stopped with SIGTERM when the run is cancelled, so the engine removes its containers
+    // and stops its tasks, and killed if it does not stop in time.
+    runInProcess(command, input, cwd, env, context, signal) {
+        return new Promise((resolvePromise, reject) => {
+            const child = (0, child_process_1.spawn)(command[0], command.slice(1), {
+                cwd,
+                env,
+                stdio: ['pipe', 'pipe', 'pipe'],
+                windowsHide: true,
+            });
+            let result;
+            let stderr = '';
+            let killTimer;
+            const stop = () => {
+                child.kill('SIGTERM');
+                killTimer = setTimeout(() => child.kill('SIGKILL'), STOP_GRACE_MS);
+                killTimer.unref();
+            };
+            if (signal.aborted) {
+                stop();
             }
-            else if (message.level === 'error' || message.level === 'warn') {
-                context.emit({
-                    type: 'log',
-                    task: message.context.name,
-                    stream: 'stderr',
-                    text: message.message.slice(0, MAX_LOG_TEXT),
-                });
+            else {
+                signal.addEventListener('abort', stop, { once: true });
             }
-        });
-        try {
-            const options = run.options;
-            const execOptions = {
-                logMode: 'live',
-                cacheDefault: options.cache ?? 'checksum',
-                cacheReadOnly: options.cacheReadOnly ?? false,
-                timeout: options.timeout ? (0, units_1.parseDuration)(options.timeout) : null,
-                skipDeps: options.skipDeps !== false,
-            };
-            // the tasks in the order they were named; by labels when none is
-            const scopes = run.tasks.length > 0
-                ? run.tasks.map((task) => ({
-                    name: task,
-                    scope: { taskName: task, environmentName: options.env ?? null },
-                }))
-                : [
-                    {
-                        name: 'labels',
-                        scope: {
-                            filterLabels: labels(options.filter),
-                            excludeLabels: labels(options.exclude),
-                            environmentName: options.env ?? null,
-                        },
-                    },
-                ];
-            for (const { name, scope } of scopes) {
-                const { ctx, scope: parsed } = await (0, schema_parser_1.createParseContext)(entry, environment);
-                const workTree = (0, work_scope_parser_1.getWorkContext)(await (0, reference_parser_1.parseReferences)(ctx, parsed, environment), scope, environment);
-                const cli = (0, cli_1.getCli)(workTree, environment);
-                if (cli.tasks().length === 0) {
-                    throw new Error(`no tasks found for ${name}`);
-                }
-                const execution = cli.exec({ ...execOptions, workers: cli.defaultWorkers() });
-                const seen = new Map();
-                const watch = execution.state.on('run-events', () => reportTasks(context, execution.state.current, seen));
+            (0, readline_1.createInterface)({ input: child.stdout }).on('line', (line) => {
                 try {
-                    const result = await execution.start();
-                    reportTasks(context, execution.state.current, seen);
-                    if (!result.success) {
-                        throw new Error(context.signal.aborted ? 'the run was cancelled' : `${name} failed`);
+                    const message = JSON.parse(line);
+                    if (message.kind === 'event') {
+                        context.emit(message.event);
+                    }
+                    else if (message.kind === 'result') {
+                        result = message;
                     }
                 }
-                finally {
-                    watch.close();
+                catch {
+                    // not ours: whatever else the process prints is not an event of the run
                 }
+            });
+            child.stderr.on('data', (chunk) => {
+                stderr = (stderr + chunk.toString('utf8')).slice(-MAX_STDERR);
+            });
+            child.stdin.on('error', () => undefined);
+            child.stdin.end(JSON.stringify(input));
+            child.on('error', (e) => {
+                signal.removeEventListener('abort', stop);
+                clearTimeout(killTimer);
+                reject(new Error(`the process of the run could not start: ${e.message}`));
+            });
+            child.on('close', (code, killed) => {
+                signal.removeEventListener('abort', stop);
+                clearTimeout(killTimer);
+                if (result?.ok) {
+                    resolvePromise();
+                }
+                else if (result) {
+                    reject(new Error(result.error ?? 'the run failed'));
+                }
+                else if (signal.aborted) {
+                    reject(new Error('the run was cancelled'));
+                }
+                else {
+                    const reason = stderr.trim().split('\n').pop() ?? '';
+                    reject(new Error(`the process of the run stopped (${killed ? `signal ${killed}` : `code ${code}`})${reason ? `: ${reason}` : ''}`));
+                }
+            });
+        });
+    }
+    // The published files go over the checkout; nothing may land outside of it or in
+    // its git directory. The checkout is somebody else's: it may hold a symbolic link where
+    // a directory or a file of the bundle goes, which would carry the write out of it, so
+    // none is followed. `.git` is compared the way a case-insensitive or Windows file system
+    // would read it.
+    async writeBundle(directory, files) {
+        for (const [path, content] of Object.entries(files)) {
+            const target = (0, path_1.resolve)(directory, path);
+            const refused = () => new Error(`the published file ${JSON.stringify(path)} can not be written into the source`);
+            if (!(0, resolve_git_source_1.isWithin)(directory, target) || path.split(/[\\/]/).some((part) => isGitDirectory(part))) {
+                throw refused();
             }
-        }
-        finally {
-            listener.close();
+            const parts = (0, path_1.relative)(directory, target).split(path_1.sep);
+            let current = directory;
+            for (const [index, part] of parts.entries()) {
+                current = (0, path_1.join)(current, part);
+                const stats = await (0, promises_1.lstat)(current).catch(() => undefined);
+                if (!stats) {
+                    break;
+                }
+                if (stats.isSymbolicLink() || (index < parts.length - 1 && !stats.isDirectory())) {
+                    throw refused();
+                }
+            }
+            await (0, promises_1.mkdir)((0, path_1.dirname)(target), { recursive: true });
+            await (0, promises_1.writeFile)(target, content);
         }
     }
 }
 exports.HostExecutor = HostExecutor;
-function labels(values) {
-    return values && values.length > 0 ? (0, parse_label_arguments_1.parseLabelArguments)(values) : undefined;
-}
-// A task event when a task has moved on since the last look.
-function reportTasks(context, workTree, seen) {
-    for (const task of (0, plan_work_tasks_1.iterateWorkTasks)(workTree)) {
-        const state = task.state.current;
-        let event = null;
-        if (state.type === 'running') {
-            event = 'running';
-        }
-        else if (state.type === 'completed') {
-            event = state.skipped ? null : state.cached ? 'cached' : 'succeeded';
-        }
-        else if (state.type === 'error' || state.type === 'crash') {
-            event = 'failed';
-        }
-        if (event && seen.get(task.name) !== event) {
-            seen.set(task.name, event);
-            context.emit({ type: 'task', task: task.name, state: event });
-        }
-    }
-}
 //# sourceMappingURL=executor.js.map