hammerkit 1.26.0 → 1.27.0-next.1

package/dist/server/run-logs.js

@@ -0,0 +1,217 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readLogs = exports.LogIndex = exports.parseLogQuery = exports.MAX_LOG_LINES = void 0;
+// what one call returns at most, and by default
+exports.MAX_LOG_LINES = 1000;
+const DEFAULT_LOG_LINES = 200;
+const MAX_CONTEXT = 20;
+const MAX_PATTERN = 200;
+const PARAMETERS = ['task', 'tail', 'from', 'limit', 'grep', 'i', 'context'];
+function count(params, name, min, max) {
+    const value = params.get(name);
+    if (value === null) {
+        return undefined;
+    }
+    if (!/^\d{1,9}$/.test(value) || Number(value) < min || Number(value) > max) {
+        throw new Error(`${name} is a number from ${min} to ${max}`);
+    }
+    return Number(value);
+}
+// Reads the query of `GET /v1/runs/<id>/logs`; throws with what is wrong.
+function parseLogQuery(params) {
+    for (const name of new Set(params.keys())) {
+        if (!PARAMETERS.includes(name)) {
+            throw new Error(`there is no parameter ${name}, the log takes ${PARAMETERS.join(', ')}`);
+        }
+        if (params.getAll(name).length > 1) {
+            throw new Error(`${name} is given more than once`);
+        }
+    }
+    const tail = count(params, 'tail', 1, exports.MAX_LOG_LINES);
+    const from = count(params, 'from', 1, 999999999);
+    if (tail !== undefined && from !== undefined) {
+        throw new Error('tail and from do not go together, tail reads the end and from reads on from a line');
+    }
+    const grep = params.get('grep') ?? undefined;
+    if (grep !== undefined && (grep.length === 0 || grep.length > MAX_PATTERN || /[\r\n]/.test(grep))) {
+        throw new Error(`grep is a text of 1 to ${MAX_PATTERN} characters on one line`);
+    }
+    const i = params.get('i');
+    if (i !== null && !['true', 'false', '1', '0'].includes(i)) {
+        throw new Error('i is true or false');
+    }
+    const task = params.get('task') ?? undefined;
+    if (task === '') {
+        throw new Error('task is the name of a task, leave it out for the lines of every task');
+    }
+    return {
+        ...(task !== undefined ? { task } : {}),
+        tail,
+        from,
+        // `tail=500` means 500 lines, unless a smaller limit says otherwise
+        limit: count(params, 'limit', 1, exports.MAX_LOG_LINES) ?? tail ?? DEFAULT_LOG_LINES,
+        grep,
+        ignoreCase: i === 'true' || i === '1',
+        context: count(params, 'context', 0, MAX_CONTEXT) ?? 0,
+    };
+}
+exports.parseLogQuery = parseLogQuery;
+/**
+ * Where the lines of a run's log are: built as the log grows, so a read costs the lines it
+ * returns and not the whole log. A line is a range of the text of one log event, the line
+ * break and a `\r` before it not included.
+ */
+class LogIndex {
+    constructor() {
+        // the events looked at so far
+        this.scanned = 0;
+        this.lineEvent = [];
+        this.lineStart = [];
+        this.lineEnd = [];
+        // per task, its lines by their index in the whole log
+        this.taskLines = new Map();
+        // per log event, its first line and how many it has
+        this.eventLines = new Map();
+    }
+    update(events) {
+        for (; this.scanned < events.length; this.scanned++) {
+            const event = events[this.scanned];
+            if (event.type !== 'log') {
+                continue;
+            }
+            let lines = this.taskLines.get(event.task);
+            if (!lines) {
+                lines = [];
+                this.taskLines.set(event.task, lines);
+            }
+            const text = event.text;
+            const end = text.endsWith('\r\n') ? text.length - 2 : text.endsWith('\n') ? text.length - 1 : text.length;
+            const first = this.lineStart.length;
+            let start = 0;
+            for (;;) {
+                const lineBreak = text.indexOf('\n', start);
+                const stop = lineBreak < 0 || lineBreak >= end ? end : lineBreak;
+                this.lineEvent.push(this.scanned);
+                this.lineStart.push(start);
+                this.lineEnd.push(stop > start && text[stop - 1] === '\r' ? stop - 1 : stop);
+                lines.push(this.lineStart.length - 1);
+                if (stop >= end) {
+                    break;
+                }
+                start = stop + 1;
+            }
+            this.eventLines.set(this.scanned, [first, this.lineStart.length - first]);
+        }
+    }
+    get size() {
+        return this.lineStart.length;
+    }
+    lines(task) {
+        return this.taskLines.get(task) ?? [];
+    }
+    text(events, line) {
+        const event = events[this.lineEvent[line]];
+        return { task: event.task, stream: event.stream, text: event.text.slice(this.lineStart[line], this.lineEnd[line]) };
+    }
+    // The lines that contain `needle`, found per event so a line is not copied to be searched.
+    matches(events, needle, ignoreCase) {
+        const hits = new Uint8Array(this.size);
+        // a literal pattern, so the search is linear; the `i` flag folds case without changing
+        // where in the text a match is
+        const pattern = new RegExp(needle.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'), ignoreCase ? 'gi' : 'g');
+        for (const [index, [first, length]] of this.eventLines) {
+            const text = events[index].text;
+            pattern.lastIndex = 0;
+            let line = first;
+            let found;
+            while ((found = pattern.exec(text)) !== null) {
+                while (line < first + length - 1 && this.lineEnd[line] < found.index + needle.length) {
+                    line++;
+                }
+                if (this.lineEnd[line] < found.index + needle.length) {
+                    break;
+                }
+                hits[line] = 1;
+                // one hit per line is enough
+                pattern.lastIndex = this.lineEnd[line] + 1;
+            }
+        }
+        return hits;
+    }
+}
+exports.LogIndex = LogIndex;
+// The lines of the log a query selects, see LogQuery.
+function readLogs(events, index, query, truncated) {
+    const selected = query.task !== undefined ? index.lines(query.task) : undefined;
+    const total = selected ? selected.length : index.size;
+    const at = (position) => (selected ? selected[position] : position);
+    const hits = query.grep !== undefined ? index.matches(events, query.grep, query.ignoreCase) : undefined;
+    const toLine = (position) => ({
+        line: position + 1,
+        ...index.text(events, at(position)),
+        ...(hits ? { match: hits[at(position)] === 1 } : {}),
+    });
+    // the positions of the selection to answer, in order
+    const positions = [];
+    const want = query.tail !== undefined ? Math.min(query.tail, query.limit) : query.limit;
+    let next;
+    if (!hits) {
+        if (query.tail !== undefined) {
+            for (let position = Math.max(0, total - want); position < total; position++) {
+                positions.push(position);
+            }
+        }
+        else {
+            const start = (query.from ?? 1) - 1;
+            for (let position = start; position < Math.min(total, start + query.limit); position++) {
+                positions.push(position);
+            }
+            next = start + query.limit < total ? start + query.limit + 1 : undefined;
+        }
+    }
+    else if (query.tail !== undefined) {
+        // from the end: the last matches with the lines around them
+        let lowest = total;
+        for (let position = total - 1; position >= 0 && positions.length < want; position--) {
+            if (hits[at(position)] !== 1) {
+                continue;
+            }
+            const high = Math.min(total - 1, position + query.context, lowest - 1);
+            for (let near = high; near >= Math.max(0, position - query.context) && positions.length < want; near--) {
+                positions.push(near);
+                lowest = near;
+            }
+        }
+        positions.reverse();
+    }
+    else {
+        const start = (query.from ?? 1) - 1;
+        // a match just before `from` still shows the lines after it
+        let emitted = start - 1;
+        for (let position = Math.max(0, start - query.context); position < total; position++) {
+            if (hits[at(position)] !== 1) {
+                continue;
+            }
+            const high = Math.min(total - 1, position + query.context);
+            for (let near = Math.max(emitted + 1, position - query.context); near <= high; near++) {
+                if (positions.length === query.limit) {
+                    next = near + 1;
+                    break;
+                }
+                positions.push(near);
+                emitted = near;
+            }
+            if (next !== undefined) {
+                break;
+            }
+        }
+    }
+    return {
+        lines: positions.map(toLine),
+        total,
+        ...(next !== undefined ? { next } : {}),
+        truncated,
+    };
+}
+exports.readLogs = readLogs;
+//# sourceMappingURL=run-logs.js.map

package/dist/server/run-plan.js

@@ -1,17 +1,22 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.planRun = exports.getRunScopes = void 0;
+exports.refuseArguments = exports.planRun = exports.getRunScopes = void 0;
 const parse_label_arguments_1 = require("../parser/parse-label-arguments");
 const plan_1 = require("./plan");
 function labels(values) {
     return values && values.length > 0 ? (0, parse_label_arguments_1.parseLabelArguments)(values) : undefined;
 }
 // The tasks in the order they were named, one scope each; by labels when none is.
+// The arguments, if any, go to the one task named (the request allows no more). That
+// task runs uncached unless the request names a `cache` method, as `run --cache` does.
 function getRunScopes(tasks, options) {
+    const args = options.args && options.args.length > 0
+        ? { values: options.args, services: false, cache: options.cache !== undefined }
+        : undefined;
     return tasks.length > 0
         ? tasks.map((task) => ({
             name: task,
-            scope: { taskName: task, environmentName: options.env ?? null },
+            scope: { taskName: task, environmentName: options.env ?? null, ...(args ? { args } : {}) },
         }))
         : [
             {
@@ -41,4 +46,48 @@ async function planRun(bundle, run, environment, policy) {
     };
 }
 exports.planRun = planRun;
+// Variables of a server that hold no credential (FR-008): a task may read these and
+// still take arguments.
+const PLAIN_SERVER_ENVS = ['PATH', 'HOME', 'CI'];
+function readsOf(entry) {
+    return [
+        ...entry.secrets.map((secret) => `the secret ${secret.target}`),
+        ...(entry.serverEnvs ?? [])
+            .filter((env) => !PLAIN_SERVER_ENVS.includes(env.toUpperCase()))
+            .map((env) => `$${env} of the server`),
+    ];
+}
+/**
+ * Why a run may not pass its arguments, or null when it may. They go to a task, never a
+ * service, and never to a run in which an item reads a secret or takes a variable of the
+ * server into its `envs`: an argument can make the command print what the task holds,
+ * and what its dependencies write into their outputs or its services serve, past the
+ * masking of secrets. So a shell on a server runs with no account and no credential of
+ * the server.
+ */
+function refuseArguments(run, plan) {
+    if (!run.options.args || run.options.args.length === 0) {
+        return null;
+    }
+    const [name] = run.tasks;
+    const entry = plan[name];
+    // a service named as a task is planned as nothing
+    if (!entry || entry.kind !== 'task') {
+        return `${name} is not a task of this version`;
+    }
+    const reads = readsOf(entry);
+    if (reads.length > 0) {
+        return `${name} reads ${reads.join(', ')}, it takes no arguments on a server: an argument could make it print them`;
+    }
+    // what a dependency or a service of the run holds reaches the task through its outputs or
+    // its answers, where an argument can print it in a form no mask knows (`rev token.txt`)
+    for (const [other, item] of Object.entries(plan).sort(([a], [b]) => a.localeCompare(b))) {
+        const held = (other === name ? [] : readsOf(item)).join(', ');
+        if (held.length > 0) {
+            return `${name} takes no arguments on a server: ${other} in its run reads ${held}, and an argument could make ${name} print what ${other} hands on`;
+        }
+    }
+    return null;
+}
+exports.refuseArguments = refuseArguments;
 //# sourceMappingURL=run-plan.js.map

package/dist/server/run-request.js

@@ -1,12 +1,15 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.runRequestSchema = exports.runOptionsSchema = void 0;
+exports.runRequestSchema = exports.runOptionsSchema = exports.MAX_ARGS_BYTES = exports.MAX_ARGS = void 0;
 const zod_1 = require("zod");
 const units_1 = require("../utils/units");
 const bundle_1 = require("../remote/bundle");
-const server_config_1 = require("./server-config");
 const repo_1 = require("./repo");
+const runs_1 = require("./runs");
 const name = zod_1.z.string().min(1).max(200);
+// what one run may pass after `--`
+exports.MAX_ARGS = 100;
+exports.MAX_ARGS_BYTES = 16 * 1024;
 // What `POST /v1/runs` takes. Who is asking and which accounts they may use is
 // decided from the token, never from this body; the accounts a run uses are those
 // its secrets are read as, which the server derives from the published build file.
@@ -37,18 +40,20 @@ exports.runOptionsSchema = zod_1.z
     timeout: duration.optional(),
     // as --no-skip-deps when false
     skipDeps: zod_1.z.boolean().optional(),
+    // as the text after `--`: appended to the last command of the one task the run
+    // names, each quoted for its shell. A task that reads a secret or a variable of the
+    // server takes none (see refuseArguments).
+    args: zod_1.z
+        .array(zod_1.z.string().refine((arg) => !arg.includes('\0'), 'an argument can not contain a NUL character'))
+        .max(exports.MAX_ARGS)
+        .refine((args) => args.reduce((total, arg) => total + Buffer.byteLength(arg), 0) <= exports.MAX_ARGS_BYTES, `the arguments are longer than ${exports.MAX_ARGS_BYTES / 1024} KiB together`)
+        .optional(),
 })
     .strict();
 exports.runRequestSchema = zod_1.z
     .object({
-    // the published build file to run, and the version of it: a hash, or the
-    // latest when left out. The server answers with the hash it chose.
-    definition: zod_1.z
-        .object({
-        name: server_config_1.definitionName,
-        hash: zod_1.z.union([zod_1.z.literal('latest'), zod_1.z.string().regex(bundle_1.HASH_PATTERN)]).default('latest'),
-    })
-        .strict(),
+    // the published version of the build file to run, by its hash
+    definition: zod_1.z.string().regex(bundle_1.HASH_PATTERN, 'expected the hash of a published build file, sha256:...'),
     // tasks by their name in the build file, as on the command line; labels in
     // the options can select tasks instead
     tasks: zod_1.z.array(name).max(100).default([]),
@@ -74,6 +79,10 @@ exports.runRequestSchema = zod_1.z
             .strict(),
         // the name of a tree announced with POST /v1/sources
         zod_1.z.object({ type: zod_1.z.literal('upload'), snapshot: zod_1.z.string().regex(bundle_1.HASH_PATTERN) }).strict(),
+        // a sandbox of the caller's, see POST /v1/sandboxes
+        zod_1.z
+            .object({ type: zod_1.z.literal('sandbox'), id: zod_1.z.string().regex(runs_1.SANDBOX_ID_PATTERN, 'expected a sandbox id') })
+            .strict(),
     ]),
     options: exports.runOptionsSchema.default({}),
 })
@@ -81,5 +90,9 @@ exports.runRequestSchema = zod_1.z
     .refine((request) => request.tasks.length > 0 || (request.options.filter ?? []).length > 0, {
     message: 'name at least one task, or filter by labels',
     path: ['tasks'],
+})
+    .refine((request) => (request.options.args ?? []).length === 0 || request.tasks.length === 1, {
+    message: 'arguments go to one task, name exactly one in tasks',
+    path: ['options', 'args'],
 });
 //# sourceMappingURL=run-request.js.map

package/dist/server/run-store.js

@@ -47,6 +47,11 @@ class FileRunStore {
                 if (!runs_1.RUN_ID_PATTERN.test(record.run.id) || `${record.run.id}.json` !== name || !Array.isArray(record.events)) {
                     throw new Error('not a run record');
                 }
+                // an older server kept the name the build file was published under with its hash
+                const definition = record.run.definition;
+                if (definition && typeof definition === 'object' && 'hash' in definition) {
+                    record.run.definition = String(definition.hash);
+                }
                 records.push(record);
             }
             catch {

package/dist/server/run-worker-command.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.registerRunWorkerCommand = void 0;
+exports.registerSandboxPodCommand = exports.registerRunWorkerCommand = void 0;
 const run_worker_1 = require("./run-worker");
+const sandbox_pod_command_1 = require("./sandbox-pod-command");
 // `hammerkit server-run`: what the server starts for each run. It reads the run on its
 // standard input, executes it in the current directory and reports on its standard output.
 // Not for people: the input comes from the server and says which accounts it may read.
@@ -14,4 +15,15 @@ function registerRunWorkerCommand(program, environment) {
     });
 }
 exports.registerRunWorkerCommand = registerRunWorkerCommand;
+// `hammerkit server-sandbox <directory>`, see sandbox-pod-command.ts. index.ts starts it
+// without loading the rest of the CLI; the program has it too, as every command.
+function registerSandboxPodCommand(program, environment) {
+    program
+        .command('server-sandbox <directory>', { hidden: true })
+        .description('read or change the files of a sandbox for a hammerkit server (internal)')
+        .action(async (directory) => {
+        await (0, sandbox_pod_command_1.runSandboxPodCommand)(directory, process.stdin, environment.stdout);
+    });
+}
+exports.registerSandboxPodCommand = registerSandboxPodCommand;
 //# sourceMappingURL=run-worker-command.js.map

package/dist/server/run-worker.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.workerMain = exports.runTasks = exports.workerInputSchema = void 0;
+exports.workerMain = exports.taskCauses = exports.runTasks = exports.getRunNetwork = exports.workerInputSchema = void 0;
+const readline_1 = require("readline");
 const zod_1 = require("zod");
 const cli_1 = require("../cli");
 const get_file_context_1 = require("../file/get-file-context");
@@ -10,11 +11,16 @@ const reference_parser_1 = require("../schema/reference-parser");
 const work_scope_parser_1 = require("../schema/work-scope-parser");
 const work_item_status_1 = require("../planner/work-item-status");
 const plan_work_tasks_1 = require("../planner/utils/plan-work-tasks");
+const assert_item_paths_1 = require("../planner/utils/assert-item-paths");
+const hosted_volumes_1 = require("../planner/utils/hosted-volumes");
 const redact_1 = require("../utils/redact");
 const empty_writable_1 = require("../utils/empty-writable");
 const units_1 = require("../utils/units");
 const run_request_1 = require("./run-request");
+const network_schema_1 = require("../schema/network-schema");
+const work_network_1 = require("../planner/work-network");
 const run_plan_1 = require("./run-plan");
+const runs_1 = require("./runs");
 // one log line of a task is cut here, the registry caps how many events a run keeps
 const MAX_LOG_TEXT = 8 * 1024;
 /**
@@ -27,14 +33,41 @@ exports.workerInputSchema = zod_1.z
     .object({
     // the build file to start from, in the checkout
     entry: zod_1.z.string().min(1),
+    // set when the build files are read from a directory of the run and work on the
+    // files of a sandbox
+    directory: zod_1.z
+        .object({ read: zod_1.z.string().min(1), work: zod_1.z.string().min(1) })
+        .strict()
+        .optional(),
     tasks: zod_1.z.array(zod_1.z.string()),
     options: run_request_1.runOptionsSchema,
     // the accounts the run was admitted for; a secret of any other is refused
     accounts: zod_1.z.array(zod_1.z.string()),
     // the operator's providers and accounts, as the server read them from its config
     catalog: zod_1.z.custom((value) => typeof value === 'object' && value !== null),
+    // the cluster and namespace container tasks and services run in, on a Kubernetes backend
+    kubernetes: zod_1.z
+        .custom((value) => typeof value === 'object' && value !== null && value.type === 'kubernetes')
+        .optional(),
+    // the most any task or service reaches besides its needs, as `--network`: `runs.network`
+    network: network_schema_1.networkSchema.optional(),
+    // for a run on a sandbox, `sandboxes.network`: the run gets the lower of the two
+    sandboxNetwork: network_schema_1.networkSchema.optional(),
+    // the caller and source trust of the run, in front of the names of its services' docker
+    // volumes (see scopeServiceVolumes)
+    volumeScope: zod_1.z
+        .string()
+        .regex(/^[a-z]+-[0-9a-f]{24}$/)
+        .optional(),
 })
     .strict();
+// The ceiling of the run, combined here and not in the server: the lower of two allow lists
+// marks what one allows only through a pattern, which a build file's `network` can't say.
+function getRunNetwork(input) {
+    const runs = input.network ? (0, work_network_1.parseWorkNetwork)(input.network) : null;
+    return input.sandboxNetwork ? (0, work_network_1.limitNetwork)((0, work_network_1.parseWorkNetwork)(input.sandboxNetwork), runs) : runs;
+}
+exports.getRunNetwork = getRunNetwork;
 /**
  * Executes the tasks of a run with the engine of `hammerkit run`. The caller says which
  * process this is in: it reports what happens through `emit` and stops when `abortCtrl`
@@ -45,14 +78,16 @@ async function runTasks(input, cwd, processEnvs, abortCtrl,
 cancelled, emit) {
     const secrets = (0, redact_1.createSecretRegistry)();
     const status = (0, work_item_status_1.statusConsole)((0, empty_writable_1.emptyWritable)(), secrets);
+    // the process starts in a directory of the server, the tasks work on the run's files
+    const work = input.directory?.work ?? cwd;
     // what the engine would print to a terminal is not wanted, its status console
     // is what is streamed: it is redacted with the secrets of this run
     const environment = {
         processEnvs,
-        hosted: { catalog: input.catalog, accounts: input.accounts },
+        hosted: { catalog: input.catalog, accounts: input.accounts, kubernetes: input.kubernetes },
         abortCtrl,
-        cwd,
-        file: (0, get_file_context_1.getFileContext)(cwd),
+        cwd: work,
+        file: (0, get_file_context_1.getFileContext)(work),
         console: (0, log_1.consoleContext)((0, empty_writable_1.emptyWritable)()),
         status,
         secrets,
@@ -86,20 +121,30 @@ cancelled, emit) {
             cacheReadOnly: options.cacheReadOnly ?? false,
             timeout: options.timeout ? (0, units_1.parseDuration)(options.timeout) : null,
             skipDeps: options.skipDeps !== false,
+            network: getRunNetwork(input),
+            // why a task was not taken from the cache goes into its result
+            explain: true,
         };
         for (const { name, scope } of (0, run_plan_1.getRunScopes)(input.tasks, options)) {
-            const { ctx, scope: parsed } = await (0, schema_parser_1.createParseContext)(input.entry, environment);
+            const { ctx, scope: parsed } = await (0, schema_parser_1.createParseContext)(input.entry, environment, {
+                directory: input.directory,
+            });
             const workTree = (0, work_scope_parser_1.getWorkContext)(await (0, reference_parser_1.parseReferences)(ctx, parsed, environment), scope, environment);
+            await (0, assert_item_paths_1.assertWorkTreePathsWithinRoot)(workTree, work);
+            if (input.volumeScope && !input.kubernetes) {
+                (0, hosted_volumes_1.scopeServiceVolumes)(workTree, input.volumeScope);
+            }
             const cli = (0, cli_1.getCli)(workTree, environment);
             if (cli.tasks().length === 0) {
                 throw new Error(`no tasks found for ${name}`);
             }
             const execution = cli.exec({ ...execOptions, workers: cli.defaultWorkers() });
             const seen = new Map();
-            const watch = execution.state.on('run-events', () => reportTasks(emit, execution.state.current, seen));
+            const report = () => reportTasks(emit, execution.state.current, seen, (text) => secrets.redact(text));
+            const watch = execution.state.on('run-events', report);
             try {
                 const result = await execution.start();
-                reportTasks(emit, execution.state.current, seen);
+                report();
                 if (!result.success) {
                     throw new Error(cancelled() ? 'the run was cancelled' : `${name} failed`);
                 }
@@ -114,32 +159,80 @@ cancelled, emit) {
     }
 }
 exports.runTasks = runTasks;
-// A task event when a task has moved on since the last look.
-function reportTasks(emit, workTree, seen) {
+// Why a task ran, as a task event carries it: the first causes, masked and cut short.
+function taskCauses(causes, redact) {
+    return causes?.length
+        ? {
+            causes: [
+                ...causes.slice(0, runs_1.MAX_CAUSES).map((cause) => redact(cause).slice(0, runs_1.MAX_TASK_ERROR)),
+                ...(causes.length > runs_1.MAX_CAUSES ? [`… and ${causes.length - runs_1.MAX_CAUSES} more`] : []),
+            ],
+        }
+        : {};
+}
+exports.taskCauses = taskCauses;
+// A task event when a task has moved on since the last look, with what its result needs
+// once it is over.
+function reportTasks(emit, workTree, seen, 
+// what leaves the process is masked like the log is: an error may quote a value
+redact) {
     for (const task of (0, plan_work_tasks_1.iterateWorkTasks)(workTree)) {
         const state = task.state.current;
+        const before = seen.get(task.name);
+        const started = 'started' in state ? state.started.getTime() : before?.started;
+        const since = () => (started !== undefined ? { durationMs: Math.max(0, Date.now() - started) } : {});
         let event = null;
         if (state.type === 'running') {
-            event = 'running';
+            event = { type: 'task', task: task.name, state: 'running' };
         }
         else if (state.type === 'completed') {
-            event = state.skipped ? null : state.cached ? 'cached' : 'succeeded';
+            const status = state.skipped ? 'skipped' : state.cached ? 'cached' : 'succeeded';
+            event = {
+                type: 'task',
+                task: task.name,
+                state: status,
+                ...(status === 'skipped' ? {} : { durationMs: state.duration }),
+                ...taskCauses(state.missCauses, redact),
+            };
+        }
+        else if (state.type === 'crash') {
+            event = { type: 'task', task: task.name, state: 'failed', exitCode: state.exitCode, ...since() };
+        }
+        else if (state.type === 'error') {
+            const error = redact(state.errorMessage).slice(0, runs_1.MAX_TASK_ERROR);
+            event = { type: 'task', task: task.name, state: 'failed', error, ...since() };
         }
-        else if (state.type === 'error' || state.type === 'crash') {
-            event = 'failed';
+        else if (state.type === 'canceled') {
+            event = { type: 'task', task: task.name, state: 'cancelled' };
         }
-        if (event && seen.get(task.name) !== event) {
-            seen.set(task.name, event);
-            emit({ type: 'task', task: task.name, state: event });
+        if (event && before?.status !== event.state) {
+            seen.set(task.name, { status: event.state, started });
+            emit(event);
+        }
+        else if (started !== undefined && before?.started === undefined) {
+            seen.set(task.name, { status: before?.status, started });
         }
     }
 }
-async function readAll(stream) {
-    const chunks = [];
-    for await (const chunk of stream) {
-        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
-    }
-    return Buffer.concat(chunks).toString('utf8');
+// The run is the first line of the standard input. The server keeps it open and writes
+// `cancel` on it to stop the run: that works the same on every platform, where a signal
+// on Windows ends the process without letting it stop its tasks.
+function readInput(stdin, cancel) {
+    const lines = (0, readline_1.createInterface)({ input: stdin, crlfDelay: Infinity });
+    let first;
+    const input = new Promise((resolve) => {
+        lines.on('line', (line) => {
+            if (first === undefined) {
+                first = line;
+                resolve(line);
+            }
+            else if (line.trim() === 'cancel') {
+                cancel();
+            }
+        });
+        lines.on('close', () => resolve(first ?? ''));
+    });
+    return { input, close: () => lines.close() };
 }
 /**
  * The process of one run: reads its input, executes the tasks in the current directory
@@ -148,7 +241,7 @@ async function readAll(stream) {
  */
 async function workerMain(stdin, stdout, processEnvs, cwd, abortCtrl) {
     const say = (message) => stdout.write(`${JSON.stringify(message)}\n`);
-    // the server stops a run with a signal
+    // the server stops a run with `cancel` on the standard input, anybody else with a signal
     let cancelled = false;
     const stop = () => {
         cancelled = true;
@@ -156,11 +249,14 @@ async function workerMain(stdin, stdout, processEnvs, cwd, abortCtrl) {
     };
     const signals = ['SIGINT', 'SIGTERM', 'SIGHUP'];
     signals.forEach((signal) => process.on(signal, stop));
+    const reader = readInput(stdin, stop);
     let input;
     try {
-        input = exports.workerInputSchema.parse(JSON.parse(await readAll(stdin)));
+        input = exports.workerInputSchema.parse(JSON.parse(await reader.input));
     }
     catch (e) {
+        reader.close();
+        signals.forEach((signal) => process.off(signal, stop));
         say({ kind: 'result', ok: false, error: `the run could not be read: ${e instanceof Error ? e.message : e}` });
         return;
     }
@@ -172,6 +268,7 @@ async function workerMain(stdin, stdout, processEnvs, cwd, abortCtrl) {
         say({ kind: 'result', ok: false, error: e instanceof Error ? e.message : String(e) });
     }
     finally {
+        reader.close();
         signals.forEach((signal) => process.off(signal, stop));
     }
 }