hammerkit 1.26.0 → 1.27.0-next.1

package/dist/kubernetes/secrets.js

@@ -5,6 +5,7 @@ const work_secret_1 = require("../planner/work-secret");
 const apply_1 = require("./apply");
 const resources_1 = require("./resources");
 const version_1 = require("../version");
+const job_placement_1 = require("./job-placement");
 const SECRET_VOLUME_NAME = 'hammerkit-secrets';
 function getSecretResourceName(item) {
     return (0, resources_1.getResourceName)(item, '-secrets');
@@ -55,6 +56,7 @@ async function ensureKubernetesSecret(instance, kubernetes, item, secrets, envir
             },
             labels: {
                 'hammerkit.dev/id': item.id(),
+                ...(0, job_placement_1.getRunLabels)(kubernetes),
             },
         },
         type: 'Opaque',

package/dist/kubernetes/store-kubernetes-data.js

@@ -6,7 +6,7 @@ const event_cache_1 = require("../executer/event-cache");
 const volumes_1 = require("./volumes");
 const ensure_persistent_data_1 = require("./ensure-persistent-data");
 async function storeKubernetesData(work, kubernetes, instance, environment, path) {
-    const persistence = await (0, volumes_1.getKubernetesPersistence)(work);
+    const persistence = await (0, volumes_1.getKubernetesPersistence)(work, kubernetes);
     await (0, ensure_persistent_data_1.getPodForPersistence)(instance, kubernetes, work, persistence, 'read', async (name) => {
         for (const generatedArchive of (0, event_cache_1.getArchivePaths)(work.data, path)) {
             const writerStream = environment.file.createWriteStream(generatedArchive.filename);

package/dist/kubernetes/volumes.js

@@ -1,37 +1,88 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.appendVolume = exports.getKubernetesPersistence = exports.getVolumeName = void 0;
+exports.getSandboxAffinity = exports.SANDBOX_LABEL = exports.getWorkspacePodSpec = exports.appendVolume = exports.getKubernetesPersistence = exports.getVolumeName = void 0;
 const path_1 = require("path");
-function getVolumeName(service) {
-    return 'hammerkit-' + service.id();
+const fs_1 = require("fs");
+const kept_claims_1 = require("./kept-claims");
+function getVolumeName(service, kubernetes) {
+    return (0, kept_claims_1.getClaimName)(service, kubernetes);
 }
 exports.getVolumeName = getVolumeName;
-async function getKubernetesPersistence(work) {
-    const persistence = { volumes: [], sources: [], mounts: [], initCommands: [] };
+const WORKSPACE_VOLUME = 'hammerkit-sandbox';
+// The path of `path` below the root of a sandbox's files, or undefined when it is not
+// below it
+function workspacePath(workspace, path) {
+    const rel = (0, path_1.relative)(workspace.root, path);
+    if (rel.startsWith('..') || (0, path_1.isAbsolute)(rel)) {
+        return undefined;
+    }
+    return [workspace.subPath, ...rel.split(path_1.sep).filter((part) => part.length > 0)].join('/');
+}
+// A path of a sandbox is mounted from its claim, read and write as on a host's docker,
+// so what the task writes is in the sandbox afterwards. A path that is not in the
+// sandbox is left out: Kubernetes would make a directory of it in the claim.
+function appendWorkspaceMount(workspace, persistence, containerPath, localPath, isFile, readOnly) {
+    const subPath = workspacePath(workspace, localPath);
+    if (subPath === undefined) {
+        return false;
+    }
+    if (!(0, fs_1.existsSync)(localPath)) {
+        return true;
+    }
+    if (persistence.workspace.length === 0) {
+        persistence.workspace.push({ name: WORKSPACE_VOLUME, persistentVolumeClaim: { claimName: workspace.claim } });
+    }
+    persistence.mounts.push({
+        mount: { readOnly, mountPath: containerPath, name: WORKSPACE_VOLUME, subPath },
+        uploadPath: '',
+        cwd: isFile ? (0, path_1.dirname)(containerPath) : containerPath,
+        workspace: true,
+    });
+    return true;
+}
+async function getKubernetesPersistence(work, kubernetes) {
+    const persistence = {
+        volumes: [],
+        sizes: {},
+        kept: [],
+        workspace: [],
+        sources: [],
+        mounts: [],
+        initCommands: [],
+    };
+    const workspace = kubernetes?.server?.workspace;
     for (const mount of work.data.mounts) {
-        appendVolume(work, persistence, mount.containerPath, mount.localPath, mount.isFile, true);
+        if (workspace &&
+            appendWorkspaceMount(workspace, persistence, mount.containerPath, mount.localPath, mount.isFile, mount.readOnly)) {
+            continue;
+        }
+        appendVolume(work, persistence, mount.containerPath, mount.localPath, mount.isFile, true, kubernetes);
     }
     for (const src of work.data.src) {
         if (src.inherited) {
             continue;
         }
-        appendVolume(work, persistence, src.absolutePath, src.absolutePath, src.isFile, true); // TODO matcher
+        if (workspace &&
+            appendWorkspaceMount(workspace, persistence, src.absolutePath, src.absolutePath, src.isFile, false)) {
+            continue;
+        }
+        appendVolume(work, persistence, src.absolutePath, src.absolutePath, src.isFile, true, kubernetes); // TODO matcher
     }
     if (work.data.type === 'container-task') {
         for (const generate of work.data.generates) {
-            appendVolume(generate.inherited ?? work, persistence, generate.path, null, false, !!generate.inherited);
+            appendVolume(generate.inherited ?? work, persistence, generate.path, null, false, !!generate.inherited, kubernetes);
         }
     }
     else {
         for (const volume of work.data.volumes) {
-            appendVolume(volume.inherited ?? work, persistence, volume.containerPath, null, false, !!volume.inherited || volume.readOnly);
+            appendVolume(volume.inherited ?? work, persistence, volume.containerPath, null, false, !!volume.inherited || volume.readOnly, kubernetes);
         }
     }
     return persistence;
 }
 exports.getKubernetesPersistence = getKubernetesPersistence;
-function appendVolume(sourceWork, persistence, containerPath, localPath, isFile, readOnly) {
-    const volumeName = getVolumeName(sourceWork);
+function appendVolume(sourceWork, persistence, containerPath, localPath, isFile, readOnly, kubernetes) {
+    const volumeName = getVolumeName(sourceWork, kubernetes);
     const existVolume = persistence.volumes.some((v) => v.name === volumeName);
     if (!existVolume) {
         persistence.volumes.push({
@@ -40,6 +91,10 @@ function appendVolume(sourceWork, persistence, containerPath, localPath, isFile,
                 claimName: volumeName,
             },
         });
+        persistence.sizes[volumeName] = 'volumeSize' in sourceWork.data ? sourceWork.data.volumeSize : null;
+        if (kubernetes && (0, kept_claims_1.isKeptClaim)(sourceWork, kubernetes)) {
+            persistence.kept.push(volumeName);
+        }
     }
     persistence.mounts.push({
         mount: {
@@ -61,4 +116,38 @@ function appendVolume(sourceWork, persistence, containerPath, localPath, isFile,
     }
 }
 exports.appendVolume = appendVolume;
+/**
+ * What a pod that mounts the claim of a sandbox needs: its label, and to go where the
+ * other pods that mount it run. A claim is usually `ReadWriteOnce`, which several pods
+ * share only on one node; the first pod (no other one runs) goes anywhere. The pod of the
+ * sandbox's files runs on the first pool while a run works, so a task on another pool
+ * would never start: it is refused.
+ */
+function getWorkspacePodSpec(kubernetes, persistence, task) {
+    const workspace = kubernetes.server?.workspace;
+    if (!workspace || persistence.workspace.length === 0) {
+        return { labels: {} };
+    }
+    const first = kubernetes.server?.pools[0]?.name;
+    if (task?.pool && first && task.pool !== first) {
+        throw new Error(`task ${task.name}: runs on the pool ${task.pool}, and the tasks of a run on a sandbox run on the first pool, ${first}, where its files are`);
+    }
+    return {
+        labels: { [exports.SANDBOX_LABEL]: workspace.label },
+        affinity: getSandboxAffinity(workspace.label),
+    };
+}
+exports.getWorkspacePodSpec = getWorkspacePodSpec;
+// the label of the pods that mount the claim of a sandbox
+exports.SANDBOX_LABEL = 'hammerkit.dev/sandbox';
+function getSandboxAffinity(label) {
+    return {
+        podAffinity: {
+            requiredDuringSchedulingIgnoredDuringExecution: [
+                { labelSelector: { matchLabels: { [exports.SANDBOX_LABEL]: label } }, topologyKey: 'kubernetes.io/hostname' },
+            ],
+        },
+    };
+}
+exports.getSandboxAffinity = getSandboxAffinity;
 //# sourceMappingURL=volumes.js.map

package/dist/main.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+// The CLI: what `hammerkit` runs, for all but the command of a sandbox's pod (see index.ts).
+const log_1 = require("./log");
+const get_file_context_1 = require("./file/get-file-context");
+const work_item_status_1 = require("./planner/work-item-status");
+const redact_1 = require("./utils/redact");
+const empty_writable_1 = require("./utils/empty-writable");
+const run_program_1 = require("./run-program");
+const abort_on_signals_1 = require("./utils/abort-on-signals");
+const abortCtrl = new AbortController();
+(0, abort_on_signals_1.abortOnSignals)(process, abortCtrl);
+let settled = false;
+// A run that never settles (a task waiting on something that can't happen)
+// lets the event loop drain, and Node then exits 0: CI would report success
+// for a build that never finished. Fail loudly instead.
+process.on('beforeExit', () => {
+    if (!settled) {
+        process.stderr.write('hammerkit stopped before the run finished\n');
+        process.exitCode = 1;
+    }
+});
+const secrets = (0, redact_1.createSecretRegistry)();
+(0, run_program_1.runProgram)({
+    cwd: process.cwd(),
+    abortCtrl,
+    processEnvs: process.env,
+    file: (0, get_file_context_1.getFileContext)(process.cwd()),
+    console: (0, log_1.consoleContext)(process.stdout),
+    status: (0, work_item_status_1.statusConsole)((0, empty_writable_1.emptyWritable)(), secrets),
+    secrets,
+    stdout: process.stdout,
+    stderr: process.stderr,
+    stdoutColumns: process.stdout.columns,
+}, process.argv, false).then(() => {
+    settled = true;
+}, () => {
+    settled = true;
+    process.exit(1);
+});
+//# sourceMappingURL=main.js.map

package/dist/network/egress-proxy.js

@@ -0,0 +1,368 @@
+"use strict";
+// The egress proxy of a task or service with `network: { allow: [hosts] }`.
+// It runs in its own container (a pod on Kubernetes) next to the item, on a
+// network only the item and the proxy join, and is the item's only way out: HTTP requests and
+// `CONNECT` tunnels to an allowed host pass, everything else gets a 403 and a
+// `refused` event on stdout. For each `host:port` entry it also listens on that
+// port and forwards raw TCP to that host, which the item reaches under the
+// host's name. The script is passed to `node -e`, so the proxy
+// needs no image of its own, only a stock Node image.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatEgressProxyEvent = exports.formatRefusedHost = exports.parseEgressProxyEvent = exports.getProxylessEnvironment = exports.getProxyClientEnvironment = exports.getEgressProxyPorts = exports.getItemProxyEnvironment = exports.getEgressProxyEnvironment = exports.getEgressProxyCommand = exports.EGRESS_PROXY_SCRIPT = exports.EGRESS_PROXY_HOST = exports.EGRESS_PROXY_PORT = exports.EGRESS_PROXY_IMAGE = void 0;
+const work_network_1 = require("../planner/work-network");
+const network_schema_1 = require("../schema/network-schema");
+// Pinned, so the code behind the boundary is the same on every host. To bump
+// it, take the index digest of the tag (`docker buildx imagetools inspect
+// node:24-alpine`). The port relay runs in it too.
+exports.EGRESS_PROXY_IMAGE = 'node:24-alpine@sha256:ebfe2f90462722a7a4de65e91990e97fe0d401c70e0e762c5b53302f905ec1c1';
+exports.EGRESS_PROXY_PORT = network_schema_1.PROXY_PORT;
+// the name the item reaches the proxy under
+exports.EGRESS_PROXY_HOST = 'hammerkit-proxy';
+// Kept free of anything but Node's own modules. The host rule is the one of
+// matchesHost in planner/work-network.ts. A name a wildcard allows must not
+// resolve to the host or a private network, and none to link-local.
+exports.EGRESS_PROXY_SCRIPT = `
+const http = require('http')
+const net = require('net')
+const dns = require('dns')
+const entries = JSON.parse(process.env.HAMMERKIT_ALLOW || '[]').map((h) => h.toLowerCase())
+// names and patterns for HTTP(S)
+const allow = entries.filter((e) => !e.includes(':'))
+// names and ports for raw TCP, each forwarded on its port
+const forwards = entries
+  .filter((e) => e.includes(':'))
+  .map((e) => ({ host: e.substring(0, e.lastIndexOf(':')), port: parseInt(e.substring(e.lastIndexOf(':') + 1), 10) }))
+// entries of both kinds that a ceiling allows only through a pattern: they
+// reach no private address, like a pattern
+const publicOnly = JSON.parse(process.env.HAMMERKIT_PUBLIC_ONLY || '[]').map((h) => h.toLowerCase())
+// the names of the needed services, for tools that ignore NO_PROXY: exact
+// names only, never patterns
+const needs = JSON.parse(process.env.HAMMERKIT_NEEDS || '[]').map((h) => h.toLowerCase())
+const port = parseInt(process.env.HAMMERKIT_PROXY_PORT || '${exports.EGRESS_PROXY_PORT}', 10)
+// the name whose address the proxy listens on, every address when unset
+const bind = process.env.HAMMERKIT_PROXY_BIND
+const refused = new Set()
+const httpsUrls = new Set()
+function emit(event) {
+  process.stdout.write(JSON.stringify(event) + '\\n')
+}
+// the rule that allows a host and port: its exact name, a wildcard, or none
+function allowedBy(host, port) {
+  const name = host.toLowerCase().replace(/\\.$/, '')
+  if (needs.includes(name)) {
+    return 'exact'
+  }
+  const named = []
+  if (allow.includes(name)) {
+    named.push(name)
+  }
+  if (forwards.some((f) => f.host === name && f.port === port)) {
+    named.push(name + ':' + port)
+  }
+  if (named.length > 0) {
+    return named.some((entry) => !publicOnly.includes(entry)) ? 'exact' : 'wildcard'
+  }
+  return allow.some((rule) => rule.startsWith('*.') && name.endsWith(rule.substring(1))) ? 'wildcard' : null
+}
+function ipv4(address) {
+  const mapped = /^::ffff:(\\d+\\.\\d+\\.\\d+\\.\\d+)$/i.exec(address)
+  const value = mapped ? mapped[1] : address
+  return net.isIPv4(value) ? value.split('.').map(Number) : null
+}
+// never allowed: the cloud metadata service lives there
+function isLinkLocal(address) {
+  const v4 = ipv4(address)
+  return v4 ? v4[0] === 169 && v4[1] === 254 : /^fe[89ab]/i.test(address)
+}
+// the host, its private networks (Docker's bridges among them) and the
+// cluster: only for a name listed exactly, such as a needed service
+function isInternal(address) {
+  const v4 = ipv4(address)
+  if (v4) {
+    const [a, b] = v4
+    return (
+      a === 0 ||
+      a === 10 ||
+      a === 127 ||
+      (a === 100 && b >= 64 && b < 128) ||
+      (a === 172 && b >= 16 && b < 32) ||
+      (a === 192 && b === 168)
+    )
+  }
+  return address === '::' || address === '::1' || /^f[cd]/i.test(address)
+}
+// The proxy resolves the name itself and connects only to the addresses it
+// checked, each in turn (a name can have an IPv6 address the network has no
+// route to).
+function resolve(host, rule, callback) {
+  dns.lookup(host, { all: true }, (err, addresses) => {
+    if (err || addresses.length === 0) {
+      callback(err || new Error('no address'), null)
+      return
+    }
+    const blocked = addresses.some((a) => isLinkLocal(a.address) || (rule !== 'exact' && isInternal(a.address)))
+    callback(null, blocked ? null : addresses)
+  })
+}
+// connection options that reach the checked addresses and nothing else
+function connectTo(host, addresses) {
+  const lookup = (hostname, options, callback) => {
+    const cb = typeof options === 'function' ? options : callback
+    if (typeof options === 'object' && options && options.all) {
+      cb(null, addresses)
+    } else {
+      cb(null, addresses[0].address, addresses[0].family)
+    }
+  }
+  return { host, lookup, autoSelectFamily: true }
+}
+function refuse(host) {
+  if (!refused.has(host)) {
+    refused.add(host)
+    emit({ type: 'refused', host })
+  }
+}
+function httpsUrl(host) {
+  if (!httpsUrls.has(host)) {
+    httpsUrls.add(host)
+    emit({ type: 'https-url', host })
+  }
+}
+function parseAuthority(value) {
+  const match = /^\\[([^\\]]+)\\](?::(\\d+))?$/.exec(value) || /^([^:]+)(?::(\\d+))?$/.exec(value)
+  return match ? { host: match[1], port: match[2] ? parseInt(match[2], 10) : 443 } : null
+}
+const server = http.createServer((req, res) => {
+  let url
+  try {
+    url = new URL(req.url)
+  } catch (e) {
+    res.writeHead(400, { 'content-type': 'text/plain' })
+    res.end('hammerkit: only proxy requests are served\\n')
+    return
+  }
+  // BusyBox wget sends an https URL to the proxy as it is: TLS belongs between
+  // the client and the host, so only a CONNECT tunnel reaches an https host
+  if (url.protocol === 'https:' && allowedBy(url.hostname, parseInt(url.port || '443', 10))) {
+    httpsUrl(url.hostname)
+    res.writeHead(501, { 'content-type': 'text/plain' })
+    res.end('hammerkit: ' + url.hostname + ' is allowed through a CONNECT tunnel only, not by its https URL\\n')
+    return
+  }
+  const rule = url.protocol === 'http:' ? allowedBy(url.hostname, parseInt(url.port || '80', 10)) : null
+  if (!rule) {
+    refuse(url.hostname)
+    res.writeHead(403, { 'content-type': 'text/plain' })
+    res.end('hammerkit: network access to ' + url.hostname + ' is not allowed\\n')
+    return
+  }
+  resolve(url.hostname, rule, (err, addresses) => {
+    if (err) {
+      res.writeHead(502, { 'content-type': 'text/plain' })
+      res.end()
+      return
+    }
+    if (!addresses) {
+      refuse(url.hostname)
+      res.writeHead(403, { 'content-type': 'text/plain' })
+      res.end('hammerkit: ' + url.hostname + ' resolves to an address that is not allowed\\n')
+      return
+    }
+    const headers = Object.assign({}, req.headers)
+    delete headers['proxy-connection']
+    delete headers['proxy-authorization']
+    // the absolute URL wins over a Host header that disagrees
+    headers.host = url.host
+    const upstream = http.request(
+      Object.assign(connectTo(url.hostname, addresses), {
+        port: url.port || 80,
+        method: req.method,
+        path: url.pathname + url.search,
+        headers,
+      }),
+      (response) => {
+        res.writeHead(response.statusCode || 502, response.headers)
+        response.pipe(res)
+      }
+    )
+    upstream.on('error', () => {
+      if (!res.headersSent) {
+        res.writeHead(502, { 'content-type': 'text/plain' })
+      }
+      res.end()
+    })
+    req.pipe(upstream)
+  })
+})
+server.on('connect', (req, socket, head) => {
+  const target = parseAuthority(req.url || '')
+  socket.on('error', () => socket.destroy())
+  const rule = target ? allowedBy(target.host, target.port) : null
+  if (!rule) {
+    refuse(target ? target.host : String(req.url))
+    socket.end('HTTP/1.1 403 Forbidden\\r\\ncontent-type: text/plain\\r\\n\\r\\nhammerkit: network access is not allowed\\n')
+    return
+  }
+  resolve(target.host, rule, (err, addresses) => {
+    if (err) {
+      socket.end('HTTP/1.1 502 Bad Gateway\\r\\n\\r\\n')
+      return
+    }
+    if (!addresses) {
+      refuse(target.host)
+      socket.end('HTTP/1.1 403 Forbidden\\r\\ncontent-type: text/plain\\r\\n\\r\\nhammerkit: network access is not allowed\\n')
+      return
+    }
+    let established = false
+    const upstream = net.connect(Object.assign(connectTo(target.host, addresses), { port: target.port }), () => {
+      established = true
+      socket.write('HTTP/1.1 200 Connection Established\\r\\n\\r\\n')
+      if (head && head.length > 0) {
+        upstream.write(head)
+      }
+      upstream.pipe(socket)
+      socket.pipe(upstream)
+    })
+    upstream.on('error', () => {
+      if (established) {
+        socket.destroy()
+      } else {
+        socket.end('HTTP/1.1 502 Bad Gateway\\r\\n\\r\\n')
+      }
+    })
+    socket.on('close', () => upstream.destroy())
+  })
+})
+// A TCP forward: each connection goes to the checked addresses of its host,
+// on the same port.
+function forward(target) {
+  return net.createServer({ allowHalfOpen: true }, (client) => {
+    client.on('error', () => client.destroy())
+    resolve(target.host, allowedBy(target.host, target.port), (err, addresses) => {
+      if (err || !addresses) {
+        if (!err) {
+          refuse(target.host)
+        }
+        client.destroy()
+        return
+      }
+      const upstream = net.connect(Object.assign(connectTo(target.host, addresses), { port: target.port }))
+      upstream.on('error', () => client.destroy())
+      client.on('close', () => upstream.destroy())
+      client.pipe(upstream)
+      upstream.pipe(client)
+    })
+  })
+}
+function listen(address) {
+  const servers = [{ server, port }].concat(forwards.map((f) => ({ server: forward(f), port: f.port })))
+  let pending = servers.length
+  for (const entry of servers) {
+    entry.server.on('error', (err) => {
+      process.stderr.write('hammerkit: unable to listen on port ' + entry.port + ': ' + err.message + '\\n')
+      process.exit(1)
+    })
+    entry.server.listen(entry.port, address, () => {
+      pending--
+      if (pending === 0) {
+        emit({ type: 'ready' })
+      }
+    })
+  }
+}
+if (bind) {
+  dns.lookup(bind, { family: 4 }, (err, address) => {
+    if (err) {
+      process.stderr.write('hammerkit: unable to resolve ' + bind + ': ' + err.message + '\\n')
+      process.exit(1)
+    }
+    listen(address)
+  })
+} else {
+  listen(undefined)
+}
+process.on('SIGTERM', () => process.exit(0))
+`;
+function getEgressProxyCommand() {
+    return ['node', '-e', exports.EGRESS_PROXY_SCRIPT];
+}
+exports.getEgressProxyCommand = getEgressProxyCommand;
+// `needs` are the names of the needed services, allowed as exactly those
+// names. `bind` is the name the proxy listens on alone, so that nothing on its
+// other networks reaches it. `publicOnly` are the entries of `hosts` that reach
+// no private address (see WorkNetwork).
+function getEgressProxyEnvironment(hosts, needs, bind, publicOnly = []) {
+    return {
+        HAMMERKIT_ALLOW: JSON.stringify(hosts),
+        ...(publicOnly.length > 0 ? { HAMMERKIT_PUBLIC_ONLY: JSON.stringify(publicOnly) } : {}),
+        HAMMERKIT_NEEDS: JSON.stringify(needs),
+        HAMMERKIT_PROXY_PORT: `${exports.EGRESS_PROXY_PORT}`,
+        ...(bind ? { HAMMERKIT_PROXY_BIND: bind } : {}),
+    };
+}
+exports.getEgressProxyEnvironment = getEgressProxyEnvironment;
+// The proxy of a task or service: the hosts of its network in this run (under
+// the run's ceiling), and the names of the services it needs, on every runtime.
+function getItemProxyEnvironment(item, bind) {
+    const network = (0, work_network_1.getEffectiveNetwork)(item.data);
+    return getEgressProxyEnvironment(network.type === 'allow' ? network.hosts : [], item.needs.map((need) => need.name), bind, network.type === 'allow' ? network.publicOnly ?? [] : []);
+}
+exports.getItemProxyEnvironment = getItemProxyEnvironment;
+// The variables that send the item's HTTP(S) through the proxy, both spellings
+// since tools read either. The services it needs are reached directly.
+// The ports the proxy of a network listens on: its own, and one per TCP forward.
+function getEgressProxyPorts(network) {
+    return [exports.EGRESS_PROXY_PORT, ...(0, work_network_1.getTcpForwards)(network).map((forward) => forward.port)];
+}
+exports.getEgressProxyPorts = getEgressProxyPorts;
+function getProxyClientEnvironment(directHosts) {
+    const proxy = `http://${exports.EGRESS_PROXY_HOST}:${exports.EGRESS_PROXY_PORT}`;
+    const noProxy = ['localhost', '127.0.0.1', ...directHosts].join(',');
+    return {
+        HTTP_PROXY: proxy,
+        HTTPS_PROXY: proxy,
+        NO_PROXY: noProxy,
+        http_proxy: proxy,
+        https_proxy: proxy,
+        no_proxy: noProxy,
+    };
+}
+exports.getProxyClientEnvironment = getProxyClientEnvironment;
+// The proxy variables emptied: a healthcheck checks the service itself, and
+// tools that ignore NO_PROXY (busybox wget) would ask the proxy for localhost.
+function getProxylessEnvironment(env) {
+    const proxyKeys = Object.keys(env).filter((key) => /^(https?|no)_proxy$/i.test(key));
+    return proxyKeys.length > 0 ? Object.fromEntries(proxyKeys.map((key) => [key, ''])) : undefined;
+}
+exports.getProxylessEnvironment = getProxylessEnvironment;
+// One line of the proxy's stdout, null for anything else.
+function parseEgressProxyEvent(line) {
+    try {
+        const value = JSON.parse(line);
+        if (value?.type === 'ready') {
+            return { type: 'ready' };
+        }
+        if ((value?.type === 'refused' || value?.type === 'https-url') && typeof value.host === 'string') {
+            return { type: value.type, host: value.host };
+        }
+    }
+    catch {
+        // not an event
+    }
+    return null;
+}
+exports.parseEgressProxyEvent = parseEgressProxyEvent;
+function formatRefusedHost(host) {
+    return `network: refused ${host}`;
+}
+exports.formatRefusedHost = formatRefusedHost;
+// The line of an event other than `ready` in the item's log.
+function formatEgressProxyEvent(event) {
+    if (event.type === 'https-url') {
+        return (`network: ${event.host} is allowed, but the client asked the proxy for its https URL instead of ` +
+            'tunneling with CONNECT (BusyBox wget does), use curl or GNU wget');
+    }
+    return formatRefusedHost(event.host);
+}
+exports.formatEgressProxyEvent = formatEgressProxyEvent;
+//# sourceMappingURL=egress-proxy.js.map

package/dist/network/port-relay.js

@@ -0,0 +1,35 @@
+"use strict";
+// The published ports of a service with a limited network. Docker publishes
+// ports only on a network with a way out, which a limited service must not
+// have, so a relay container on the default bridge publishes them and passes
+// each connection on to the service over the service's internal network.
+// Like the egress proxy, it is a script for `node -e` in a stock Node image.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getPortRelayEnvironment = exports.getPortRelayCommand = exports.PORT_RELAY_SCRIPT = void 0;
+// Kept free of anything but Node's own modules.
+exports.PORT_RELAY_SCRIPT = `
+const net = require('net')
+const targets = JSON.parse(process.env.HAMMERKIT_RELAY || '[]')
+for (const target of targets) {
+  // a client that ends its side still gets the answer
+  net
+    .createServer({ allowHalfOpen: true }, (client) => {
+      const upstream = net.connect(target.targetPort, target.host)
+      client.on('error', () => upstream.destroy())
+      upstream.on('error', () => client.destroy())
+      client.pipe(upstream)
+      upstream.pipe(client)
+    })
+    .listen(target.port)
+}
+process.on('SIGTERM', () => process.exit(0))
+`;
+function getPortRelayCommand() {
+    return ['node', '-e', exports.PORT_RELAY_SCRIPT];
+}
+exports.getPortRelayCommand = getPortRelayCommand;
+function getPortRelayEnvironment(targets) {
+    return { HAMMERKIT_RELAY: JSON.stringify(targets) };
+}
+exports.getPortRelayEnvironment = getPortRelayEnvironment;
+//# sourceMappingURL=port-relay.js.map

package/dist/optimizer/get-work-cache-stats.js

@@ -4,6 +4,7 @@ exports.getStateKey = exports.getWorkItemCacheStats = exports.getWorkCacheStats
 const calculate_checksum_1 = require("./calculate-checksum");
 const path_1 = require("path");
 const crypto_1 = require("crypto");
+const promises_1 = require("fs/promises");
 function isExcluded(path, excluded) {
     return excluded.some((excludedPath) => path === excludedPath || path.startsWith(excludedPath + path_1.sep));
 }
@@ -11,6 +12,21 @@ async function addWorkCacheStats(result, cwd, path, matcher, context, root, excl
     if (isExcluded(path, excluded)) {
         return 0;
     }
+    // On a server the files were written by a commit or a task: a link is a source as it is,
+    // its target, and never followed. A `**` would walk `x -> /` through the server's disk.
+    if (context.hosted) {
+        const link = await (0, promises_1.lstat)(path).catch(() => undefined);
+        if (link?.isSymbolicLink()) {
+            if (!matcher(path)) {
+                return 0;
+            }
+            const checksum = (0, crypto_1.createHash)('sha1')
+                .update(`link:${await (0, promises_1.readlink)(path)}`)
+                .digest('hex');
+            result.files[(0, path_1.relative)(cwd, path).split(path_1.sep).join(path_1.posix.sep)] = { lastModified: link.mtimeMs, checksum };
+            return 1;
+        }
+    }
     const exists = await context.file.exists(path);
     if (!exists) {
         return 0;

package/dist/optimizer/work-task-cache-description.js

@@ -24,8 +24,9 @@ function getWorkTaskCacheDescription(item) {
         shell: task.shell ?? undefined,
         platform: task.type === 'container-task' ? task.image : (0, os_1.platform)(),
         // outputs hold native binaries, and docker pulls images for the host
-        // architecture, so container tasks are keyed by it too
-        arch: process.arch,
+        // architecture, so container tasks are keyed by it too; on a cluster it is the
+        // one of the nodes the task runs on
+        arch: (task.type === 'container-task' && task.arch) || process.arch,
         generates: task.generates.map((g) => portable(g.path)).sort() ?? undefined,
         src: task.src.map((s) => s.source).sort() ?? undefined,
         envs: Object.keys(envs)