hammerkit 1.26.0 → 1.27.0-next.1

package/dist/remote/annotations.js

@@ -0,0 +1,103 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.applyAnnotations = exports.collectAnnotations = exports.remoteRepo = void 0;
+const child_process_1 = require("child_process");
+const os_1 = require("os");
+const path_1 = require("path");
+const util_1 = require("util");
+const repo_1 = require("../server/repo");
+const bundle_1 = require("./bundle");
+const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
+async function git(cwd, ...args) {
+    try {
+        const value = (await execFileAsync('git', args, { cwd, timeout: 5000 })).stdout.trim();
+        return value || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+// `host/path` of a remote, or nothing: a url that is neither https, ssh nor
+// `user@host:path` is left out, so a credential in it never leaves the machine.
+function remoteRepo(url) {
+    const scp = /^[\w.-]+@([\w.-]+):(?!\/)(.+)$/.exec(url);
+    if (scp) {
+        return (0, repo_1.normalizeRepo)(`${scp[1]}/${scp[2]}`) ?? undefined;
+    }
+    try {
+        const parsed = new URL(url);
+        if (!['https:', 'ssh:'].includes(parsed.protocol)) {
+            return undefined;
+        }
+        return (0, repo_1.normalizeRepo)(`${parsed.hostname}${parsed.pathname}`) ?? undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+exports.remoteRepo = remoteRepo;
+// Where a build file is published from: its path in its repository (or on this
+// machine, outside of one), the repository and commit, this machine and its user.
+// `files` are the paths of the bundle, relative to the build file's directory: when
+// one of them differs from the commit, `dirty=true` says the version is not that
+// commit's. What can not be found is left out.
+async function collectAnnotations(fileName, files = [(0, path_1.basename)(fileName)]) {
+    const path = (0, path_1.resolve)(fileName);
+    const cwd = (0, path_1.dirname)(path);
+    const annotations = {};
+    // git says where the directory is in the repository: comparing paths would trip on
+    // what the file system calls the same directory differently (symlinks, 8.3 names)
+    const inside = (await git(cwd, 'rev-parse', '--is-inside-work-tree')) === 'true';
+    const prefix = inside ? (await git(cwd, 'rev-parse', '--show-prefix')) ?? '' : undefined;
+    annotations.path = prefix !== undefined ? `${prefix}${(0, path_1.basename)(path)}` : path;
+    if (inside) {
+        const remote = await git(cwd, 'remote', 'get-url', 'origin');
+        const repo = remote ? remoteRepo(remote) : undefined;
+        const commit = await git(cwd, 'rev-parse', 'HEAD');
+        if (repo) {
+            annotations.repo = repo;
+        }
+        if (commit) {
+            annotations.commit = commit;
+            const changed = await git(cwd, '--literal-pathspecs', 'status', '--porcelain', '--untracked-files=all', '--', ...files);
+            if (changed) {
+                annotations.dirty = 'true';
+            }
+        }
+    }
+    annotations.machine = (0, os_1.hostname)();
+    try {
+        annotations.user = (0, os_1.userInfo)().username;
+    }
+    catch {
+        // a user without an entry in the password database
+    }
+    return Object.fromEntries(Object.entries(annotations).filter(([, value]) => value));
+}
+exports.collectAnnotations = collectAnnotations;
+// `--annotation key=value` sets one, `key=` leaves it out.
+function applyAnnotations(annotations, options) {
+    const result = { ...annotations };
+    for (const option of options) {
+        const index = option.indexOf('=');
+        if (index <= 0) {
+            throw new Error(`${option} is not an annotation, write it as key=value`);
+        }
+        const key = option.slice(0, index);
+        const value = option.slice(index + 1);
+        if (value) {
+            result[key] = value;
+        }
+        else {
+            delete result[key];
+        }
+    }
+    const parsed = bundle_1.annotationsSchema.safeParse(result);
+    if (!parsed.success) {
+        const issue = parsed.error.issues[0];
+        throw new Error(`${issue.path.length > 0 ? `annotation ${issue.path.join('.')}` : 'annotations'}: ${issue.message}`);
+    }
+    return parsed.data;
+}
+exports.applyAnnotations = applyAnnotations;
+//# sourceMappingURL=annotations.js.map

package/dist/remote/bundle-text.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.showBundle = exports.visible = void 0;
+// Text from a proposal is shown to somebody who decides on it, so nothing in it may
+// rewrite the terminal or hide what it says: control and format characters (which
+// include the ones that reorder text) are shown as `?`. Long lines are not cut,
+// what is hidden behind a cut is what a reviewer needs to see.
+function visible(line) {
+    return line.replace(/\t/g, '  ').replace(/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu, '?');
+}
+exports.visible = visible;
+const lines = (text) => (text === '' ? [] : text.replace(/\n$/, '').split('\n'));
+// Every file of a version, whole: a version has no other one it could be read
+// against, whoever decides on it reads all of it.
+function showBundle(bundle) {
+    return Object.keys(bundle.files)
+        .sort()
+        .flatMap((path) => [
+        `--- ${visible(path)}${path === bundle.entry ? ' (entry)' : ''}`,
+        ...lines(bundle.files[path]).map((line) => `  ${visible(line)}`),
+    ]);
+}
+exports.showBundle = showBundle;
+//# sourceMappingURL=bundle-text.js.map

package/dist/remote/bundle.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.HASH_PATTERN = exports.hashBundle = exports.bundleSchema = exports.isBundlePath = exports.MAX_BUNDLE_BYTES = exports.MAX_BUNDLE_FILES = exports.DEFAULT_ENTRY = void 0;
+exports.HASH_PATTERN = exports.hashBundle = exports.bundleSchema = exports.annotationsSchema = exports.MAX_ANNOTATIONS = exports.isBundlePath = exports.MAX_BUNDLE_BYTES = exports.MAX_BUNDLE_FILES = exports.DEFAULT_ENTRY = void 0;
 const crypto_1 = require("crypto");
 const zod_1 = require("zod");
 exports.DEFAULT_ENTRY = '.hammerkit.yaml';
@@ -16,6 +16,14 @@ function isBundlePath(path) {
         !path.split('/').some((part) => part === '' || part === '.' || part === '..'));
 }
 exports.isBundlePath = isBundlePath;
+exports.MAX_ANNOTATIONS = 20;
+exports.annotationsSchema = zod_1.z
+    .record(zod_1.z
+    .string()
+    .regex(/^[a-z][a-z0-9._-]{0,63}$/, 'use lower case letters, digits, ".", "_" and "-", starting with a letter'), zod_1.z.string().min(1).max(500))
+    .refine((annotations) => Object.keys(annotations).length <= exports.MAX_ANNOTATIONS, {
+    message: `at most ${exports.MAX_ANNOTATIONS} annotations`,
+});
 exports.bundleSchema = zod_1.z
     .object({
     entry: zod_1.z.string().default(exports.DEFAULT_ENTRY),

package/dist/remote/remote-commands.js

@@ -10,8 +10,10 @@ const log_1 = require("../log");
 const host_config_1 = require("./host-config");
 const device_login_1 = require("./device-login");
 const credentials_1 = require("./credentials");
+const token_source_1 = require("./token-source");
 const server_client_1 = require("./server-client");
 const remote_work_commands_1 = require("./remote-work-commands");
+const mcp_command_1 = require("../harness/mcp-command");
 // Host-level commands: they only touch the machine's config file, so they work
 // with or without a build file in the working directory.
 function registerRemoteCommands(program, environment, buildFile) {
@@ -129,7 +131,7 @@ function registerRemoteCommands(program, environment, buildFile) {
         .description('show who you are on a server and which service accounts you may use')
         .action(guarded('Remote accounts was not successful', async (name) => {
         const chosen = await getServer(name);
-        const token = await (0, credentials_1.getAccessToken)(environment, chosen.name, chosen.server);
+        const token = await (0, token_source_1.getTokenSource)(environment, chosen.name, chosen.server).token();
         const me = await (0, server_client_1.getMe)(chosen.server, token);
         const { body } = await (0, server_client_1.callServer)(chosen.server, token, 'GET', '/v1/accounts');
         environment.stdout.write(`${chosen.name}: ${(0, server_client_1.printable)(me.sub)} (${(0, server_client_1.printable)(me.iss)})\n`);
@@ -153,6 +155,7 @@ function registerRemoteCommands(program, environment, buildFile) {
         }
     }));
     (0, remote_work_commands_1.registerWorkCommands)(remote, { environment, buildFile, getServer, guarded });
+    (0, mcp_command_1.registerMcpCommand)(remote, environment);
 }
 exports.registerRemoteCommands = registerRemoteCommands;
 //# sourceMappingURL=remote-commands.js.map

package/dist/remote/remote-work-commands.js

@@ -3,32 +3,54 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.registerWorkCommands = void 0;
+exports.registerWorkCommands = exports.describePlan = exports.describeApproval = void 0;
 const commander_1 = require("commander");
 const colors_1 = __importDefault(require("colors"));
-const credentials_1 = require("./credentials");
+const token_source_1 = require("./token-source");
 const collect_bundle_1 = require("./collect-bundle");
 const bundle_1 = require("./bundle");
+const annotations_1 = require("./annotations");
 const server_client_1 = require("./server-client");
-const text_diff_1 = require("./text-diff");
-const PROPOSAL_NAME = /^([a-z0-9][a-z0-9._-]{0,63})@(sha256:[0-9a-f]{64})$/i;
-// A proposed version is named like `payments@sha256:...`
-function parseProposal(value) {
-    const match = PROPOSAL_NAME.exec(value);
-    return match && bundle_1.HASH_PATTERN.test(match[2]) ? { name: match[1], hash: match[2] } : undefined;
-}
+const bundle_text_1 = require("./bundle-text");
 const RUN_ID = /^run_[A-Za-z0-9_-]{16}$/;
+// what the publisher said about where a version comes from, one line
+// What a publisher said about where a version comes from: the server takes it as said,
+// so anybody else is told it is not checked.
+function annotationLines(annotations, label = 'from (unverified)') {
+    const entries = Object.entries(annotations ?? {});
+    return entries.length > 0
+        ? [`  ${label}: ${entries.map(([key, value]) => `${(0, server_client_1.printable)(key)}=${(0, server_client_1.printable)(value)}`).join(' ')}`]
+        : [];
+}
+function yankLines(version) {
+    return version.yanked
+        ? [
+            `  yanked by ${(0, server_client_1.printable)(version.yanked.by.sub)}${version.yanked.reason ? `: ${(0, server_client_1.printable)(version.yanked.reason)}` : ''}`,
+        ]
+        : [];
+}
+const collectOption = (value, previous = []) => [...previous, value];
 // What a person who approves is shown of a run: everything the decision rests on.
-function describe(run) {
-    const source = run.source.type === 'ref' ? `ref ${run.source.ref}` : `snapshot ${run.source.snapshot}`;
-    const options = Object.entries(run.options)
+function describeApproval(run) {
+    const source = run.source.type === 'ref'
+        ? `ref ${run.source.ref}`
+        : run.source.type === 'sandbox'
+            ? `sandbox of ${run.source.repo} at ${run.source.commit}, ${run.source.clean ? 'unchanged' : `with changes, files ${run.source.tree}`} (files .gitignore leaves out are not shown)`
+            : `snapshot ${run.source.snapshot}`;
+    // the arguments are shown whole on a line of their own, each as a JSON string,
+    // so commas, spaces and quotes inside one stay visible
+    const { args, ...settings } = run.options;
+    const options = Object.entries(settings)
         .map(([key, value]) => `${key}=${Array.isArray(value) ? value.join(',') : value}`)
         .join(' ');
     return [
         `${colors_1.default.bold((0, server_client_1.printable)(run.id))}  requested by ${(0, server_client_1.printable)(run.requestedBy.sub)} (${(0, server_client_1.printable)(run.requestedBy.iss)})`,
-        `  ${(0, server_client_1.printable)(run.definition.name)} ${(0, server_client_1.printable)(run.definition.hash)}`,
+        `  build file ${(0, server_client_1.printable)(run.definition)}`,
         `  tasks: ${run.tasks.length > 0 ? run.tasks.map(server_client_1.printable).join(', ') : 'selected by labels'}`,
         `  accounts: ${run.accounts.length > 0 ? run.accounts.map(server_client_1.printable).join(', ') : 'none'}, source ${(0, server_client_1.printable)(source)}${options ? `, ${(0, server_client_1.printable)(options)}` : ''}`,
+        ...(Array.isArray(args) && args.length > 0
+            ? [`  arguments: ${args.map((arg) => (0, server_client_1.printableWhole)(JSON.stringify(arg))).join(' ')}`]
+            : []),
         ...(run.approvals ?? []).map((approval) => `  ${(0, server_client_1.printable)(approval.account)}: ${approval.approvedBy
             ? `approved by ${(0, server_client_1.printable)(approval.approvedBy.sub)}`
             : 'waits for somebody who uses it to approve'}`),
@@ -36,6 +58,7 @@ function describe(run) {
         `  decide before ${(0, server_client_1.printable)(run.approvals?.[0]?.expiresAt ?? '-')}`,
     ];
 }
+exports.describeApproval = describeApproval;
 // What to look at first, one line.
 function flagLines(run) {
     const flagged = Object.entries(run.plan ?? {}).filter(([, entry]) => entry.flags.length > 0);
@@ -51,7 +74,11 @@ function flagLines(run) {
 function describePlan(plan) {
     return Object.entries(plan).flatMap(([name, entry]) => [
         `  ${colors_1.default.bold((0, server_client_1.printable)(name))}  ${entry.kind}, ${(0, server_client_1.printable)(entry.runtime)}${entry.image ? ` ${(0, server_client_1.printable)(entry.image)}` : ''}${entry.flags.length > 0 ? `  [${entry.flags.map(server_client_1.printable).join(', ')}]` : ''}`,
-        ...entry.cmds.map((cmd) => `    $ ${(0, server_client_1.printable)(cmd)}`),
+        // a command is what is decided on: shown whole, however long
+        ...entry.cmds.map((cmd) => `    $ ${(0, server_client_1.printableWhole)(cmd)}`),
+        ...(entry.network !== undefined && entry.network !== 'open'
+            ? [`    network: ${(0, server_client_1.printable)(typeof entry.network === 'string' ? entry.network : JSON.stringify(entry.network))}`]
+            : []),
         ...(entry.deps.length > 0 ? [`    after: ${entry.deps.map(server_client_1.printable).join(', ')}`] : []),
         ...(entry.needs.length > 0 ? [`    needs: ${entry.needs.map(server_client_1.printable).join(', ')}`] : []),
         ...entry.secrets.map((secret) => `    secret ${(0, server_client_1.printable)(secret.from)}${secret.account ? ` as ${(0, server_client_1.printable)(secret.account)}` : ''} -> ${(0, server_client_1.printable)(secret.target)}`),
@@ -60,29 +87,78 @@ function describePlan(plan) {
         ...(entry.generates.length > 0 ? [`    generates: ${entry.generates.map(server_client_1.printable).join(', ')}`] : []),
     ]);
 }
+exports.describePlan = describePlan;
 function registerWorkCommands(remote, context) {
     const { environment, buildFile, getServer, guarded } = context;
     const connect = async (name) => {
         const chosen = await getServer(name);
-        const token = await (0, credentials_1.getAccessToken)(environment, chosen.name, chosen.server);
+        // a CI job or an agent brings its own token, a person signs in
+        const token = await (0, token_source_1.getTokenSource)(environment, chosen.name, chosen.server).token();
         return { ...chosen, token };
     };
     remote
-        .command('publish <definition> [server]')
-        .description('publish the build file and the files it includes to a server, under a name runs can refer to')
-        .action(guarded('Remote publish was not successful', async (definition, name) => {
+        .command('publish [server]')
+        .description('publish the build file and the files it includes to a server, runs refer to it by its hash')
+        .addOption(new commander_1.Option('--annotation <key=value>', 'say more about where it comes from, or leave one out with key=; path, repo, commit, machine and user are filled in').argParser(collectOption))
+        .action(guarded('Remote publish was not successful', async (name, options) => {
         const bundle = await (0, collect_bundle_1.collectBundle)(buildFile, environment);
+        const annotations = (0, annotations_1.applyAnnotations)(await (0, annotations_1.collectAnnotations)(buildFile, Object.keys(bundle.files)), options.annotation ?? []);
         const { name: serverName, server, token } = await connect(name);
-        const answer = await (0, server_client_1.callServer)(server, token, 'PUT', `/v1/definitions/${encodeURIComponent(definition)}`, bundle);
+        const answer = await (0, server_client_1.callServer)(server, token, 'POST', '/v1/definitions', {
+            ...bundle,
+            annotations,
+        });
         const version = answer.body;
         const files = Object.keys(bundle.files).length;
         const proposed = answer.status === 202;
         const verb = proposed ? 'proposed' : answer.status === 201 ? 'published' : 'already published';
-        environment.stdout.write(`${verb} ${definition} to ${serverName}: ${(0, server_client_1.printable)(version.hash)} (${files} ${files === 1 ? 'file' : 'files'})\n`);
+        environment.stdout.write(`${verb} to ${serverName}: ${(0, server_client_1.printable)(version.hash)} (${files} ${files === 1 ? 'file' : 'files'})\n`);
         const names = [...(version.tasks ?? []), ...(version.services ?? [])];
         environment.stdout.write(`tasks and services: ${names.map(server_client_1.printable).join(', ') || 'none'}\n`);
+        for (const line of annotationLines(version.annotations, 'from')) {
+            environment.stdout.write(`${line.trimStart()}\n`);
+        }
         if (proposed) {
-            environment.stdout.write(`it can not run before somebody who may publish ${(0, server_client_1.printable)(definition)} approves it, until ${(0, server_client_1.printable)(version.expiresAt)}\n`);
+            environment.stdout.write(`it can not run before somebody who may publish approves it, until ${(0, server_client_1.printable)(version.expiresAt)}\n`);
+        }
+    }));
+    remote
+        .command('versions [server]')
+        .description('list the published versions of build files on a server, newest first, with where they come from')
+        .addOption(new commander_1.Option('--filter <key=value>', 'only the versions with this annotation, such as repo=github.com/corp/payments').argParser(collectOption))
+        .action(guarded('Remote versions was not successful', async (name, options) => {
+        const query = new URLSearchParams();
+        for (const filter of (options.filter ?? [])) {
+            const index = filter.indexOf('=');
+            if (index <= 0) {
+                throw new Error(`${(0, server_client_1.printable)(filter)} is not a filter, write it as key=value`);
+            }
+            if (index === filter.length - 1) {
+                throw new Error(`${(0, server_client_1.printable)(filter)} matches nothing, an annotation always has a value`);
+            }
+            query.append(filter.slice(0, index), filter.slice(index + 1));
+        }
+        const { name: serverName, server, token } = await connect(name);
+        const path = `/v1/definitions${query.toString() !== '' ? `?${query}` : ''}`;
+        const { body } = await (0, server_client_1.callServer)(server, token, 'GET', path);
+        if (body.definitions.length === 0) {
+            environment.stdout.write(`${serverName}: no published versions${query.toString() !== '' ? ' match' : ''}\n`);
+            return;
+        }
+        environment.stdout.write(`${serverName}: ${body.definitions.length} published\n`);
+        for (const version of body.definitions) {
+            environment.stdout.write(`${colors_1.default.bold((0, server_client_1.printable)(version.hash))}  published by ${(0, server_client_1.printable)(version.publishedBy.sub)} at ${(0, server_client_1.printable)(version.publishedAt)}${version.approvedBy ? `, approved by ${(0, server_client_1.printable)(version.approvedBy.sub)}` : ''}\n`);
+            for (const line of annotationLines(version.annotations)) {
+                environment.stdout.write(`${line}\n`);
+            }
+            const names = [...version.tasks, ...version.services];
+            environment.stdout.write(`  tasks and services: ${names.map(server_client_1.printable).join(', ') || 'none'}\n`);
+            if (version.accounts.length > 0) {
+                environment.stdout.write(`  accounts: ${version.accounts.map(server_client_1.printable).join(', ')}\n`);
+            }
+            for (const line of yankLines(version)) {
+                environment.stdout.write(`${line}\n`);
+            }
         }
     }));
     remote
@@ -97,21 +173,84 @@ function registerWorkCommands(remote, context) {
         }
         environment.stdout.write(`${serverName}: ${body.approvals.length} waiting for your approval\n`);
         for (const run of body.approvals) {
-            for (const line of describe(run)) {
+            for (const line of describeApproval(run)) {
                 environment.stdout.write(`${line}\n`);
             }
         }
     }));
+    // A version that is published: who published it, what its tasks do and every file.
+    const showPublished = async (hash, serverName, server, token) => {
+        const path = `/v1/definitions/${hash}`;
+        let version;
+        try {
+            version = (await (0, server_client_1.callServer)(server, token, 'GET', path)).body;
+        }
+        catch (e) {
+            if (e instanceof server_client_1.ServerError && e.status === 404) {
+                throw new Error(`${serverName} has no proposal or published version ${(0, server_client_1.printable)(hash)} you may see`);
+            }
+            throw e;
+        }
+        const files = (await (0, server_client_1.callServer)(server, token, 'GET', `${path}/files`)).body;
+        environment.stdout.write(`${colors_1.default.bold((0, server_client_1.printable)(version.hash))} on ${serverName}, published by ${(0, server_client_1.printable)(version.publishedBy.sub)} (${(0, server_client_1.printable)(version.publishedBy.iss)}) at ${(0, server_client_1.printable)(version.publishedAt)}${version.approvedBy ? `, approved by ${(0, server_client_1.printable)(version.approvedBy.sub)}` : ''}\n`);
+        for (const line of [
+            ...yankLines(version),
+            ...annotationLines(version.annotations),
+            ...flagLines(version),
+            ...(version.plan ? describePlan(version.plan) : ['  the server did not record what its tasks do']),
+            ...(0, bundle_text_1.showBundle)(files),
+        ]) {
+            environment.stdout.write(`${line}\n`);
+        }
+    };
     remote
-        .command('show <run> [server]')
-        .description('show a run that waits for your approval in full: the commands, secrets and accounts of its tasks')
-        .action(guarded('Remote show was not successful', async (run, name) => {
-        if (!RUN_ID.test(run)) {
-            throw new Error(`${(0, server_client_1.printable)(run)} is not a run id, list them with: hammerkit remote approvals`);
+        .command('show <target> [server]')
+        .description('show a run (run_...) or a proposed or published version (sha256:...) in full: the commands, secrets and accounts of its tasks, and the files of a version')
+        .action(guarded('Remote show was not successful', async (target, name) => {
+        if (!RUN_ID.test(target) && !bundle_1.HASH_PATTERN.test(target)) {
+            throw new Error(`${(0, server_client_1.printable)(target)} is not a run id or a version, list them with: hammerkit remote approvals, remote proposals or remote versions`);
         }
-        const { server, token } = await connect(name);
-        const view = (await (0, server_client_1.callServer)(server, token, 'GET', `/v1/approvals/${run}`)).body;
-        for (const line of describe(view)) {
+        const { name: serverName, server, token } = await connect(name);
+        if (bundle_1.HASH_PATTERN.test(target)) {
+            const path = `/v1/proposals/${target}`;
+            let proposal;
+            try {
+                proposal = (await (0, server_client_1.callServer)(server, token, 'GET', path)).body;
+            }
+            catch (e) {
+                if (e instanceof server_client_1.ServerError && e.status === 404) {
+                    await showPublished(target, serverName, server, token);
+                    return;
+                }
+                throw e;
+            }
+            if (proposal.state === 'approved') {
+                await showPublished(target, serverName, server, token);
+                return;
+            }
+            if (proposal.state !== 'waiting') {
+                // a decided proposal keeps no files
+                environment.stdout.write(`${colors_1.default.bold((0, server_client_1.printable)(proposal.hash))} on ${serverName}, proposed by ${(0, server_client_1.printable)(proposal.proposedBy.sub)}, ${(0, server_client_1.printable)(proposal.state)}${proposal.decidedBy ? ` by ${(0, server_client_1.printable)(proposal.decidedBy.sub)}` : ''}${proposal.reason ? `: ${(0, server_client_1.printable)(proposal.reason)}` : ''}\n`);
+                for (const line of annotationLines(proposal.annotations)) {
+                    environment.stdout.write(`${line}\n`);
+                }
+                environment.stdout.write('  its files are not kept once it is decided\n');
+                return;
+            }
+            const files = (await (0, server_client_1.callServer)(server, token, 'GET', `${path}/files`)).body;
+            environment.stdout.write(`${colors_1.default.bold((0, server_client_1.printable)(proposal.hash))} on ${serverName}, proposed by ${(0, server_client_1.printable)(proposal.proposedBy.sub)} (${(0, server_client_1.printable)(proposal.proposedBy.iss)}), ${(0, server_client_1.printable)(proposal.state)}\n`);
+            for (const line of [
+                ...annotationLines(proposal.annotations),
+                ...flagLines(proposal),
+                ...describePlan(proposal.plan ?? {}),
+                ...(0, bundle_text_1.showBundle)(files),
+            ]) {
+                environment.stdout.write(`${line}\n`);
+            }
+            return;
+        }
+        const view = (await (0, server_client_1.callServer)(server, token, 'GET', `/v1/approvals/${target}`)).body;
+        for (const line of describeApproval(view)) {
             environment.stdout.write(`${line}\n`);
         }
         environment.stdout.write(view.plan ? `${describePlan(view.plan).join('\n')}\n` : 'the server did not record what its tasks do\n');
@@ -130,7 +269,10 @@ function registerWorkCommands(remote, context) {
         for (const proposal of body.proposals) {
             const who = proposal.mine ? 'you' : (0, server_client_1.printable)(proposal.proposedBy.sub);
             const state = proposal.canDecide ? colors_1.default.bold('waits for your approval') : (0, server_client_1.printable)(proposal.state);
-            environment.stdout.write(`${colors_1.default.bold(`${(0, server_client_1.printable)(proposal.name)}@${(0, server_client_1.printable)(proposal.hash)}`)}  proposed by ${who}, ${state}\n`);
+            environment.stdout.write(`${colors_1.default.bold((0, server_client_1.printable)(proposal.hash))}  proposed by ${who}, ${state}\n`);
+            for (const line of annotationLines(proposal.annotations)) {
+                environment.stdout.write(`${line}\n`);
+            }
             const names = [...proposal.tasks, ...proposal.services];
             environment.stdout.write(`  tasks and services: ${names.map(server_client_1.printable).join(', ') || 'none'}\n`);
             if (proposal.accounts.length > 0) {
@@ -141,9 +283,6 @@ function registerWorkCommands(remote, context) {
             for (const line of flagLines(proposal)) {
                 environment.stdout.write(`${line}\n`);
             }
-            if (proposal.stale) {
-                environment.stdout.write(`  stale: ${(0, server_client_1.printable)(proposal.name)} has a newer version, reject it and propose again on top of it\n`);
-            }
             if (proposal.state === 'waiting') {
                 environment.stdout.write(`  decide before ${(0, server_client_1.printable)(proposal.expiresAt)}\n`);
             }
@@ -152,43 +291,19 @@ function registerWorkCommands(remote, context) {
             }
         }
     }));
-    remote
-        .command('diff <proposal> [server]')
-        .description('show what a proposed version (name@hash) changes against the version it follows')
-        .action(guarded('Remote diff was not successful', async (target, name) => {
-        const proposal = parseProposal(target);
-        if (!proposal) {
-            throw new Error(`${(0, server_client_1.printable)(target)} is not a proposal, list them with: hammerkit remote proposals`);
-        }
-        const { name: serverName, server, token } = await connect(name);
-        const path = `/v1/proposals/${encodeURIComponent(proposal.name)}/${proposal.hash}`;
-        const view = (await (0, server_client_1.callServer)(server, token, 'GET', path)).body;
-        const proposed = (await (0, server_client_1.callServer)(server, token, 'GET', `${path}/files`)).body;
-        const base = view.base
-            ? (await (0, server_client_1.callServer)(server, token, 'GET', `/v1/definitions/${encodeURIComponent(proposal.name)}/${view.base}/files`)).body
-            : undefined;
-        environment.stdout.write(`${(0, server_client_1.printable)(proposal.name)}@${(0, server_client_1.printable)(proposal.hash)} on ${serverName}, proposed by ${(0, server_client_1.printable)(view.proposedBy.sub)} (${(0, server_client_1.printable)(view.proposedBy.iss)})\n`);
-        environment.stdout.write(base ? `compared with ${(0, server_client_1.printable)(view.base)}\n` : 'no version is published yet, everything is new\n');
-        if (view.stale) {
-            environment.stdout.write(`warning: ${(0, server_client_1.printable)(proposal.name)} has a newer version (${(0, server_client_1.printable)(view.latest)}), this can only be rejected\n`);
-        }
-        const lines = (0, text_diff_1.diffBundles)(base, proposed);
-        environment.stdout.write(lines.length > 0 ? `${lines.join('\n')}\n` : 'the files are the same\n');
-    }));
     for (const action of ['yank', 'unyank']) {
         remote
             .command(`${action} <version> [server]`)
             .description(action === 'yank'
-            ? 'pull a published version (name@hash) back: no run starts from it and it is not latest'
-            : 'let a yanked version (name@hash) go on')
+            ? 'pull a published version (sha256:...) back: no run starts from it'
+            : 'let a yanked version (sha256:...) go on')
             .addOption(new commander_1.Option('--reason <text>', 'why, shown to whoever tries to run it').argParser((value) => value))
             .action(guarded(`Remote ${action} was not successful`, async (target, name, options) => {
-            const version = parseProposal(target);
-            if (!version) {
-                throw new Error(`${(0, server_client_1.printable)(target)} is not a version, name it like payments@sha256:...`);
+            if (!bundle_1.HASH_PATTERN.test(target)) {
+                throw new Error(`${(0, server_client_1.printable)(target)} is not a version, name it by its hash: sha256:...`);
             }
             const { name: serverName, server, token } = await connect(name);
-            await (0, server_client_1.callServer)(server, token, 'POST', `/v1/definitions/${encodeURIComponent(version.name)}/${version.hash}/${action}`, options.reason ? { reason: options.reason } : undefined);
+            await (0, server_client_1.callServer)(server, token, 'POST', `/v1/definitions/${target}/${action}`, options.reason ? { reason: options.reason } : undefined);
             environment.stdout.write(`${action === 'yank' ? 'yanked' : 'let go on'} ${(0, server_client_1.printable)(target)} on ${serverName}\n`);
         }));
     }
@@ -196,18 +311,16 @@ function registerWorkCommands(remote, context) {
         remote
             .command(`${action} <target> [server]`)
             .description(action === 'approve'
-            ? 'let a run (run_...) or a proposed version (name@hash) that waits for your approval go ahead'
-            : 'end a run (run_...) or drop a proposed version (name@hash) that waits for your approval')
+            ? 'let a run (run_...) or a proposed version (sha256:...) that waits for your approval go ahead'
+            : 'end a run (run_...) or drop a proposed version (sha256:...) that waits for your approval')
             .addOption(new commander_1.Option('--reason <text>', 'why, shown to who asked').argParser((value) => value))
             .action(guarded(`Remote ${action} was not successful`, async (target, name, options) => {
-            const proposal = parseProposal(target);
+            const proposal = bundle_1.HASH_PATTERN.test(target);
             if (!proposal && !RUN_ID.test(target)) {
                 throw new Error(`${(0, server_client_1.printable)(target)} is not a run id or a proposed version, list them with: hammerkit remote approvals or remote proposals`);
             }
             const { name: serverName, server, token } = await connect(name);
-            const path = proposal
-                ? `/v1/proposals/${encodeURIComponent(proposal.name)}/${proposal.hash}/${action}`
-                : `/v1/approvals/${target}/${action}`;
+            const path = proposal ? `/v1/proposals/${target}/${action}` : `/v1/approvals/${target}/${action}`;
             const { body } = await (0, server_client_1.callServer)(server, token, 'POST', path, options.reason ? { reason: options.reason } : undefined);
             const rejected = body.state === 'rejected';
             environment.stdout.write(proposal

package/dist/remote/server-client.js

@@ -1,20 +1,33 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.callServer = exports.getMe = exports.getDiscovery = exports.printable = exports.ServerError = void 0;
+exports.callServer = exports.getMe = exports.getDiscovery = exports.printableWhole = exports.printable = exports.ServerError = void 0;
 const discovery_1 = require("../server/discovery");
 const TIMEOUT_MS = 10000;
 const WRITE_TIMEOUT_MS = 30000;
 class ServerError extends Error {
+    // what the server answered, when it did
+    constructor(message, status) {
+        super(message);
+        this.status = status;
+    }
 }
 exports.ServerError = ServerError;
 // Text from the server or the identity provider is shown to the user: no
-// control characters, so it can't rewrite the terminal.
+// control characters, so it can't rewrite the terminal, and format characters
+// (bidi overrides, zero-width) written out, so text reads in the order it runs.
+// Long text is cut, and says how much was.
 function printable(value) {
+    const text = printableWhole(value);
+    return text.length > 300 ? `${text.slice(0, 300)}… (+${text.length - 300} chars)` : text;
+}
+exports.printable = printable;
+// The same, never cut: for what somebody decides on, such as a command.
+function printableWhole(value) {
     return String(value)
         .replace(/\p{Cc}/gu, '?')
-        .slice(0, 300);
+        .replace(/\p{Cf}/gu, (char) => `\\u{${char.codePointAt(0)?.toString(16)}}`);
 }
-exports.printable = printable;
+exports.printableWhole = printableWhole;
 async function getJson(url, token) {
     let response;
     try {
@@ -80,7 +93,7 @@ async function callServer(server, token, method, path, body) {
     }
     if (!response.ok) {
         const said = answer && typeof answer.error === 'string' ? `: ${printable(answer.error)}` : '';
-        throw new ServerError(`${server.url} answered ${response.status}${said}`);
+        throw new ServerError(`${server.url} answered ${response.status}${said}`, response.status);
     }
     return { status: response.status, body: answer };
 }

package/dist/remote/source-manifest.js

@@ -53,6 +53,16 @@ function hashSource(manifest) {
 }
 exports.hashSource = hashSource;
 const DENIED_DIRECTORIES = ['.git', '.ssh', '.aws', '.gnupg', '.kube'];
+// the short names Windows gives these directories, `GIT~1` for `.git`
+const DENIED_SHORT_NAMES = /^(git|ssh|aws|gnupg|kube)~\d+$/;
+// A name as a case-insensitive disk opens it: Windows and macOS open `.SSH` as `.ssh`, and
+// Windows drops trailing dots and spaces (`.git.`) and reads `name:stream` as `name`.
+function canonicalName(name) {
+    return name
+        .replace(/:.*$/, '')
+        .replace(/[. ]+$/, '')
+        .toLowerCase();
+}
 const DENIED_NAMES = [
     /^\.env$/i,
     /^\.env\.(?!example$|sample$|template$|dist$)/i,
@@ -65,12 +75,15 @@ const DENIED_NAMES = [
 // must not be what decides that a key leaves the machine.
 function deniedSourcePath(path) {
     const parts = path.split('/');
-    const directory = parts.slice(0, -1).find((part) => DENIED_DIRECTORIES.includes(part));
+    const directory = parts.slice(0, -1).find((part) => {
+        const name = canonicalName(part);
+        return DENIED_DIRECTORIES.includes(name) || DENIED_SHORT_NAMES.test(name);
+    });
     if (directory !== undefined) {
         return `${directory}/ holds credentials or history`;
     }
     const name = parts[parts.length - 1];
-    if (DENIED_NAMES.some((pattern) => pattern.test(name))) {
+    if (DENIED_NAMES.some((pattern) => pattern.test(name) || pattern.test(canonicalName(name)))) {
         return `${name} looks like a credential file`;
     }
     return null;