hammerkit 1.25.0 → 1.27.0-next.1

package/dist/planner/work-service.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getHealthcheckCommand = exports.getServiceCommand = exports.getServiceWorkingDir = exports.isContainerWorkService = void 0;
+const task_arguments_1 = require("./utils/task-arguments");
 const isContainerWorkService = (svc) => 'image' in svc && svc.type === 'container-service';
 exports.isContainerWorkService = isContainerWorkService;
 // The container's working directory: the declared `workdir`, else the build
@@ -10,14 +11,17 @@ exports.getServiceWorkingDir = getServiceWorkingDir;
 // The container's entrypoint and command for a service: with a `shell`, its
 // `cmd` runs as `<shell> -c "<cmd>"` in place of the image entrypoint; without
 // one the tokenized `cmd` becomes the command and the image entrypoint stays.
-function getServiceCommand(service) {
+// For Kubernetes, the arguments after -- are escaped so they stay text there.
+function getServiceCommand(service, options = {}) {
     if (!service.cmd) {
         return { entrypoint: null, cmd: null };
     }
     if (service.shell) {
-        return { entrypoint: [service.shell, '-c'], cmd: [service.cmd.cmd] };
+        const cmd = options.kubernetes ? (0, task_arguments_1.getKubernetesCommandText)(service.cmd) : service.cmd.cmd;
+        return { entrypoint: [service.shell, '-c'], cmd: [cmd] };
     }
-    return { entrypoint: null, cmd: [service.cmd.parsed.command, ...service.cmd.parsed.args] };
+    const args = options.kubernetes ? (0, task_arguments_1.getKubernetesCommandArgs)(service.cmd) : service.cmd.parsed.args;
+    return { entrypoint: null, cmd: [service.cmd.parsed.command, ...args] };
 }
 exports.getServiceCommand = getServiceCommand;
 // The healthcheck as an exec command, through the service's `shell` if it has one.

package/dist/planner/work-state-record.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseStateRecord = exports.formatStateRecord = exports.getStateRecordName = void 0;
+const crypto_1 = require("crypto");
+// The state record says "the outputs at this task's paths were made by this
+// variant of the task (its id), from this state key". It is kept per task
+// *name*, because every variant of a task (other arguments after --, another
+// --set value) writes the same output paths: a record per id would let a run of
+// one variant overwrite the outputs while the record of another one still
+// claims them. The id stored with the key makes the next run of that other
+// variant a miss.
+function getStateRecordName(task) {
+    return (0, crypto_1.createHash)('sha1').update(`${task.name}\0${task.data.projectRoot}`).digest('hex');
+}
+exports.getStateRecordName = getStateRecordName;
+function formatStateRecord(task, stateKey) {
+    return `${task.id()}:${stateKey}`;
+}
+exports.formatStateRecord = formatStateRecord;
+// The state key of the record when this variant made the outputs, else null.
+function parseStateRecord(task, content) {
+    const record = content.trim();
+    const separator = record.indexOf(':');
+    if (separator < 0 || record.slice(0, separator) !== task.id()) {
+        return null;
+    }
+    return record.slice(separator + 1) || null;
+}
+exports.parseStateRecord = parseStateRecord;
+//# sourceMappingURL=work-state-record.js.map

package/dist/program.js

@@ -28,6 +28,9 @@ const cache_inventory_1 = require("./cache/cache-inventory");
 const remote_commands_1 = require("./remote/remote-commands");
 const server_command_1 = require("./server/server-command");
 const run_worker_command_1 = require("./server/run-worker-command");
+const github_app_token_command_1 = require("./secrets/github-app-token-command");
+const work_network_1 = require("./planner/work-network");
+const task_arguments_1 = require("./planner/utils/task-arguments");
 async function createCli(fileName, environment, workScope) {
     const { ctx, scope } = await (0, schema_parser_1.createParseContext)(fileName, environment);
     const referencedScope = await (0, reference_parser_1.parseReferences)(ctx, scope, environment);
@@ -80,6 +83,31 @@ function printTaskDefinition(environment, definition) {
         (0, log_1.printProperty)(environment, `env ${reference.name}`, `from $${reference.from} ${colors_1.default.grey(reference.available ? '(set)' : '(not set)')}`);
     }
 }
+// `ls --json`: what a caller (an agent picking a task) needs to know, with the
+// command that arguments after `--` are appended to (null: it takes none).
+function getListJson(tasks, services) {
+    return {
+        tasks: tasks.map(({ item }) => ({
+            name: item.name,
+            description: item.data.description,
+            type: item.data.type,
+            ...(item.data.type === 'container-task' ? { image: item.data.image } : {}),
+            deps: item.deps.map((d) => d.name),
+            needs: item.needs.map((n) => n.name),
+            labels: item.data.labels,
+            command: (0, task_arguments_1.getArgumentsTarget)(item.data)?.cmd ?? null,
+        })),
+        services: services.map(({ item }) => ({
+            name: item.name,
+            description: item.data.description,
+            type: item.data.type,
+            ...(item.data.type === 'container-service' ? { image: item.data.image } : {}),
+            ports: item.data.ports.map((p) => ({ host: p.hostPort, container: p.containerPort })),
+            labels: item.data.labels,
+            command: (0, task_arguments_1.getArgumentsTarget)(item.data)?.cmd ?? null,
+        })),
+    };
+}
 function parseWorkLabelScope(options) {
     const scope = {
         environmentName: null,
@@ -103,30 +131,57 @@ function parseWorkLabelScope(options) {
     }
     return scope;
 }
+// A task given arguments after -- skips the cache, unless the caller asks for a
+// cache method on the command line.
+function keepsCache(command) {
+    return command.getOptionValueSource('cache') === 'cli';
+}
 async function getProgram(environment, argv) {
     const program = new commander_1.Command();
     (0, server_command_1.registerServerCommand)(program, environment);
     (0, run_worker_command_1.registerRunWorkerCommand)(program, environment);
-    const parsed = (0, parse_set_arguments_1.parseSetArguments)(argv);
+    (0, run_worker_command_1.registerSandboxPodCommand)(program, environment);
+    (0, github_app_token_command_1.registerGithubAppTokenCommand)(program, environment);
+    // What follows `--` belongs to the one task or service of a run or up, not to
+    // hammerkit: a `--set` or `--file` there is an argument like any other.
+    const separator = argv.indexOf('--');
+    const passthrough = separator >= 0 ? argv.slice(separator + 1) : [];
+    const parsed = (0, parse_set_arguments_1.parseSetArguments)(separator >= 0 ? argv.slice(0, separator) : argv);
     const args = parsed.args;
     environment.processEnvs = { ...environment.processEnvs, ...parsed.values };
+    const remote = args.indexOf('remote');
+    if (remote >= 0 && args[remote + 1] === 'mcp') {
+        // `remote mcp` speaks its protocol on stdout: a warning there would break it
+        environment.console = (0, log_1.consoleContext)(environment.stderr);
+    }
     const fileIndex = args.indexOf('--file');
     const fileName = fileIndex >= 0 ? (0, path_1.join)(environment.cwd, args[fileIndex + 1]) : await (0, default_build_file_1.getBuildFilename)(environment.cwd, environment);
     if (fileIndex >= 0) {
         args.splice(fileIndex, 2);
     }
     (0, remote_commands_1.registerRemoteCommands)(program, environment, fileName);
+    program.hook('preAction', (_, actionCommand) => {
+        const takesArguments = actionCommand.parent === program && ['run', 'up'].includes(actionCommand.name());
+        if (passthrough.length > 0 && !takesArguments) {
+            program.error(`${actionCommand.name()} takes no arguments after --, only run and up do`, { exitCode: 1 });
+        }
+    });
     if (await environment.file.exists(fileName)) {
         program
             .command('ls')
             .description('list all tasks')
             .addOption(new commander_1.Option('-f, --filter <labels...>', 'filter task and services with labels'))
             .addOption(new commander_1.Option('-e, --exclude <labels...>', 'exclude task and services with labels'))
+            .addOption(new commander_1.Option('--json', 'emit the tasks and services as JSON').default(false))
             .action(async (options) => {
             const cli = await createCli(fileName, environment, parseWorkLabelScope(options));
             const items = cli.ls();
             const tasks = items.filter(cli_1.isCliTask);
             const services = items.filter(cli_1.isCliService);
+            if (options.json) {
+                environment.stdout.write(`${JSON.stringify(getListJson(tasks, services), null, 2)}\n`);
+                return;
+            }
             if (services.length > 0) {
                 (0, log_1.printTitle)(environment, 'Services');
                 for (const service of services) {
@@ -527,7 +582,8 @@ async function getProgram(environment, argv) {
         });
         program
             .command('up')
-            .description('start services(s)')
+            .description("start services(s), with the arguments after -- appended to the selected service's cmd")
+            .usage('[options] [-- args...]')
             .addOption(new commander_1.Option('-f, --filter <labels...>', 'filter task and services with labels'))
             .addOption(new commander_1.Option('-e, --exclude <labels...>', 'exclude task and services with labels'))
             .addOption(new commander_1.Option('-c, --concurrency <number>', 'parallel worker count (default 4, unbounded when every task and service requests cpus and memory)').argParser(parseInt))
@@ -546,9 +602,13 @@ async function getProgram(environment, argv) {
             .choices(['checksum', 'modify-date', 'none']))
             .addOption(new commander_1.Option('--cache-read-only', `restore from cache backends but never push to them (or set ${read_only_1.CACHE_READ_ONLY_ENV}=1)`).default(false))
             .addOption(new commander_1.Option('--timeout <duration>', 'fail tasks without their own timeout after this long (e.g. 10m)').argParser(units_1.parseDuration))
-            .action(async (options) => {
+            .addOption(new commander_1.Option('--network <level>', 'the most any task or service reaches besides its needs: none, open or allow:<host>,<host>').argParser(parseNetworkArgument))
+            .action(async (options, command) => {
             try {
-                const scope = parseWorkLabelScope(options);
+                const scope = {
+                    ...parseWorkLabelScope(options),
+                    args: { values: passthrough, services: true, cache: keepsCache(command) },
+                };
                 const cli = await createCli(fileName, environment, scope);
                 const result = await cli.runUp({
                     cacheDefault: options.cache,
@@ -560,6 +620,7 @@ async function getProgram(environment, argv) {
                     wait: options.wait,
                     cacheReadOnly: (0, read_only_1.isCacheReadOnly)(options.cacheReadOnly, environment.processEnvs),
                     timeout: options.timeout ?? null,
+                    network: options.network ?? null,
                 });
                 if (!result.success) {
                     program.error('Up was not successful', { exitCode: 1 });
@@ -601,7 +662,8 @@ async function getProgram(environment, argv) {
         });
         program
             .command('run [task]', { isDefault: true })
-            .description('execute task')
+            .description('execute task, with the arguments after -- appended to its last command')
+            .usage('[options] [task] [-- args...]')
             .addOption(new commander_1.Option('-f, --filter <labels...>', 'filter task and services with labels'))
             .addOption(new commander_1.Option('-e, --exclude <labels...>', 'exclude task and services with labels'))
             .addOption(new commander_1.Option('-c, --concurrency <number>', 'parallel worker count (default 4, unbounded when every task and service requests cpus and memory)').argParser(parseInt))
@@ -620,15 +682,17 @@ async function getProgram(environment, argv) {
             .addOption(new commander_1.Option('--dry-run', 'print the execution plan with predicted cache hits/misses without running').default(false))
             .addOption(new commander_1.Option('--cache-read-only', `restore from cache backends but never push to them (or set ${read_only_1.CACHE_READ_ONLY_ENV}=1)`).default(false))
             .addOption(new commander_1.Option('--timeout <duration>', 'fail tasks without their own timeout after this long (e.g. 10m)').argParser(units_1.parseDuration))
+            .addOption(new commander_1.Option('--network <level>', 'the most any task or service reaches besides its needs: none, open or allow:<host>,<host>').argParser(parseNetworkArgument))
             .addOption(new commander_1.Option('--no-skip-deps', 'run dependencies even when nothing needing them has to run'))
-            .action(async (task, options) => {
+            .action(async (task, options, command) => {
             try {
                 // For machine-readable JSON, suppress the human progress logger (which
                 // also writes to stdout) so the only thing on stdout is the JSON.
                 const runEnvironment = options.summaryJson
                     ? { ...environment, stdout: (0, empty_writable_1.emptyWritable)(), console: (0, log_1.consoleContext)((0, empty_writable_1.emptyWritable)()) }
                     : environment;
-                const cli = await createCli(fileName, runEnvironment, task ? { taskName: task, environmentName: options.env } : parseWorkLabelScope(options));
+                const args = { values: passthrough, services: false, cache: keepsCache(command) };
+                const cli = await createCli(fileName, runEnvironment, task ? { taskName: task, environmentName: options.env, args } : { ...parseWorkLabelScope(options), args });
                 if (cli.tasks().length === 0) {
                     program.error('No tasks found', { exitCode: 127 });
                     return;
@@ -652,6 +716,7 @@ async function getProgram(environment, argv) {
                     explain: options.explain,
                     cacheReadOnly: (0, read_only_1.isCacheReadOnly)(options.cacheReadOnly, environment.processEnvs),
                     timeout: options.timeout ?? null,
+                    network: options.network ?? null,
                     skipDeps: options.skipDeps !== false,
                 });
                 // Reporting only: the summary never changes the exit code or behavior.
@@ -723,4 +788,12 @@ tasks:
     return { program, args };
 }
 exports.getProgram = getProgram;
+function parseNetworkArgument(value) {
+    try {
+        return (0, work_network_1.parseNetworkOption)(value);
+    }
+    catch (e) {
+        throw new commander_1.InvalidArgumentError((0, log_1.getErrorMessage)(e));
+    }
+}
 //# sourceMappingURL=program.js.map

package/dist/remote/annotations.js

@@ -0,0 +1,103 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.applyAnnotations = exports.collectAnnotations = exports.remoteRepo = void 0;
+const child_process_1 = require("child_process");
+const os_1 = require("os");
+const path_1 = require("path");
+const util_1 = require("util");
+const repo_1 = require("../server/repo");
+const bundle_1 = require("./bundle");
+const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
+async function git(cwd, ...args) {
+    try {
+        const value = (await execFileAsync('git', args, { cwd, timeout: 5000 })).stdout.trim();
+        return value || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+// `host/path` of a remote, or nothing: a url that is neither https, ssh nor
+// `user@host:path` is left out, so a credential in it never leaves the machine.
+function remoteRepo(url) {
+    const scp = /^[\w.-]+@([\w.-]+):(?!\/)(.+)$/.exec(url);
+    if (scp) {
+        return (0, repo_1.normalizeRepo)(`${scp[1]}/${scp[2]}`) ?? undefined;
+    }
+    try {
+        const parsed = new URL(url);
+        if (!['https:', 'ssh:'].includes(parsed.protocol)) {
+            return undefined;
+        }
+        return (0, repo_1.normalizeRepo)(`${parsed.hostname}${parsed.pathname}`) ?? undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+exports.remoteRepo = remoteRepo;
+// Where a build file is published from: its path in its repository (or on this
+// machine, outside of one), the repository and commit, this machine and its user.
+// `files` are the paths of the bundle, relative to the build file's directory: when
+// one of them differs from the commit, `dirty=true` says the version is not that
+// commit's. What can not be found is left out.
+async function collectAnnotations(fileName, files = [(0, path_1.basename)(fileName)]) {
+    const path = (0, path_1.resolve)(fileName);
+    const cwd = (0, path_1.dirname)(path);
+    const annotations = {};
+    // git says where the directory is in the repository: comparing paths would trip on
+    // what the file system calls the same directory differently (symlinks, 8.3 names)
+    const inside = (await git(cwd, 'rev-parse', '--is-inside-work-tree')) === 'true';
+    const prefix = inside ? (await git(cwd, 'rev-parse', '--show-prefix')) ?? '' : undefined;
+    annotations.path = prefix !== undefined ? `${prefix}${(0, path_1.basename)(path)}` : path;
+    if (inside) {
+        const remote = await git(cwd, 'remote', 'get-url', 'origin');
+        const repo = remote ? remoteRepo(remote) : undefined;
+        const commit = await git(cwd, 'rev-parse', 'HEAD');
+        if (repo) {
+            annotations.repo = repo;
+        }
+        if (commit) {
+            annotations.commit = commit;
+            const changed = await git(cwd, '--literal-pathspecs', 'status', '--porcelain', '--untracked-files=all', '--', ...files);
+            if (changed) {
+                annotations.dirty = 'true';
+            }
+        }
+    }
+    annotations.machine = (0, os_1.hostname)();
+    try {
+        annotations.user = (0, os_1.userInfo)().username;
+    }
+    catch {
+        // a user without an entry in the password database
+    }
+    return Object.fromEntries(Object.entries(annotations).filter(([, value]) => value));
+}
+exports.collectAnnotations = collectAnnotations;
+// `--annotation key=value` sets one, `key=` leaves it out.
+function applyAnnotations(annotations, options) {
+    const result = { ...annotations };
+    for (const option of options) {
+        const index = option.indexOf('=');
+        if (index <= 0) {
+            throw new Error(`${option} is not an annotation, write it as key=value`);
+        }
+        const key = option.slice(0, index);
+        const value = option.slice(index + 1);
+        if (value) {
+            result[key] = value;
+        }
+        else {
+            delete result[key];
+        }
+    }
+    const parsed = bundle_1.annotationsSchema.safeParse(result);
+    if (!parsed.success) {
+        const issue = parsed.error.issues[0];
+        throw new Error(`${issue.path.length > 0 ? `annotation ${issue.path.join('.')}` : 'annotations'}: ${issue.message}`);
+    }
+    return parsed.data;
+}
+exports.applyAnnotations = applyAnnotations;
+//# sourceMappingURL=annotations.js.map

package/dist/remote/bundle-text.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.showBundle = exports.visible = void 0;
+// Text from a proposal is shown to somebody who decides on it, so nothing in it may
+// rewrite the terminal or hide what it says: control and format characters (which
+// include the ones that reorder text) are shown as `?`. Long lines are not cut,
+// what is hidden behind a cut is what a reviewer needs to see.
+function visible(line) {
+    return line.replace(/\t/g, '  ').replace(/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu, '?');
+}
+exports.visible = visible;
+const lines = (text) => (text === '' ? [] : text.replace(/\n$/, '').split('\n'));
+// Every file of a version, whole: a version has no other one it could be read
+// against, whoever decides on it reads all of it.
+function showBundle(bundle) {
+    return Object.keys(bundle.files)
+        .sort()
+        .flatMap((path) => [
+        `--- ${visible(path)}${path === bundle.entry ? ' (entry)' : ''}`,
+        ...lines(bundle.files[path]).map((line) => `  ${visible(line)}`),
+    ]);
+}
+exports.showBundle = showBundle;
+//# sourceMappingURL=bundle-text.js.map

package/dist/remote/bundle.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.HASH_PATTERN = exports.hashBundle = exports.bundleSchema = exports.isBundlePath = exports.MAX_BUNDLE_BYTES = exports.MAX_BUNDLE_FILES = exports.DEFAULT_ENTRY = void 0;
+exports.HASH_PATTERN = exports.hashBundle = exports.bundleSchema = exports.annotationsSchema = exports.MAX_ANNOTATIONS = exports.isBundlePath = exports.MAX_BUNDLE_BYTES = exports.MAX_BUNDLE_FILES = exports.DEFAULT_ENTRY = void 0;
 const crypto_1 = require("crypto");
 const zod_1 = require("zod");
 exports.DEFAULT_ENTRY = '.hammerkit.yaml';
@@ -16,6 +16,14 @@ function isBundlePath(path) {
         !path.split('/').some((part) => part === '' || part === '.' || part === '..'));
 }
 exports.isBundlePath = isBundlePath;
+exports.MAX_ANNOTATIONS = 20;
+exports.annotationsSchema = zod_1.z
+    .record(zod_1.z
+    .string()
+    .regex(/^[a-z][a-z0-9._-]{0,63}$/, 'use lower case letters, digits, ".", "_" and "-", starting with a letter'), zod_1.z.string().min(1).max(500))
+    .refine((annotations) => Object.keys(annotations).length <= exports.MAX_ANNOTATIONS, {
+    message: `at most ${exports.MAX_ANNOTATIONS} annotations`,
+});
 exports.bundleSchema = zod_1.z
     .object({
     entry: zod_1.z.string().default(exports.DEFAULT_ENTRY),

package/dist/remote/remote-commands.js

@@ -10,8 +10,10 @@ const log_1 = require("../log");
 const host_config_1 = require("./host-config");
 const device_login_1 = require("./device-login");
 const credentials_1 = require("./credentials");
+const token_source_1 = require("./token-source");
 const server_client_1 = require("./server-client");
 const remote_work_commands_1 = require("./remote-work-commands");
+const mcp_command_1 = require("../harness/mcp-command");
 // Host-level commands: they only touch the machine's config file, so they work
 // with or without a build file in the working directory.
 function registerRemoteCommands(program, environment, buildFile) {
@@ -129,7 +131,7 @@ function registerRemoteCommands(program, environment, buildFile) {
         .description('show who you are on a server and which service accounts you may use')
         .action(guarded('Remote accounts was not successful', async (name) => {
         const chosen = await getServer(name);
-        const token = await (0, credentials_1.getAccessToken)(environment, chosen.name, chosen.server);
+        const token = await (0, token_source_1.getTokenSource)(environment, chosen.name, chosen.server).token();
         const me = await (0, server_client_1.getMe)(chosen.server, token);
         const { body } = await (0, server_client_1.callServer)(chosen.server, token, 'GET', '/v1/accounts');
         environment.stdout.write(`${chosen.name}: ${(0, server_client_1.printable)(me.sub)} (${(0, server_client_1.printable)(me.iss)})\n`);
@@ -153,6 +155,7 @@ function registerRemoteCommands(program, environment, buildFile) {
         }
     }));
     (0, remote_work_commands_1.registerWorkCommands)(remote, { environment, buildFile, getServer, guarded });
+    (0, mcp_command_1.registerMcpCommand)(remote, environment);
 }
 exports.registerRemoteCommands = registerRemoteCommands;
 //# sourceMappingURL=remote-commands.js.map