hammerkit 1.26.0 → 1.27.0-next.10

package/dist/program.js

@@ -28,6 +28,8 @@ const cache_inventory_1 = require("./cache/cache-inventory");
 const remote_commands_1 = require("./remote/remote-commands");
 const server_command_1 = require("./server/server-command");
 const run_worker_command_1 = require("./server/run-worker-command");
+const github_app_token_command_1 = require("./secrets/github-app-token-command");
+const work_network_1 = require("./planner/work-network");
 const task_arguments_1 = require("./planner/utils/task-arguments");
 async function createCli(fileName, environment, workScope) {
     const { ctx, scope } = await (0, schema_parser_1.createParseContext)(fileName, environment);
@@ -82,7 +84,8 @@ function printTaskDefinition(environment, definition) {
     }
 }
 // `ls --json`: what a caller (an agent picking a task) needs to know, with the
-// command that arguments after `--` are appended to (null: it takes none).
+// command that arguments after `--` are appended to (null: it takes none) and
+// `args` as the build file says it (false: it refuses them).
 function getListJson(tasks, services) {
     return {
         tasks: tasks.map(({ item }) => ({
@@ -94,6 +97,7 @@ function getListJson(tasks, services) {
             needs: item.needs.map((n) => n.name),
             labels: item.data.labels,
             command: (0, task_arguments_1.getArgumentsTarget)(item.data)?.cmd ?? null,
+            args: item.data.args,
         })),
         services: services.map(({ item }) => ({
             name: item.name,
@@ -103,6 +107,7 @@ function getListJson(tasks, services) {
             ports: item.data.ports.map((p) => ({ host: p.hostPort, container: p.containerPort })),
             labels: item.data.labels,
             command: (0, task_arguments_1.getArgumentsTarget)(item.data)?.cmd ?? null,
+            args: item.data.type === 'container-service' ? item.data.args : null,
         })),
     };
 }
@@ -138,6 +143,8 @@ async function getProgram(environment, argv) {
     const program = new commander_1.Command();
     (0, server_command_1.registerServerCommand)(program, environment);
     (0, run_worker_command_1.registerRunWorkerCommand)(program, environment);
+    (0, run_worker_command_1.registerSandboxPodCommand)(program, environment);
+    (0, github_app_token_command_1.registerGithubAppTokenCommand)(program, environment);
     // What follows `--` belongs to the one task or service of a run or up, not to
     // hammerkit: a `--set` or `--file` there is an argument like any other.
     const separator = argv.indexOf('--');
@@ -145,16 +152,24 @@ async function getProgram(environment, argv) {
     const parsed = (0, parse_set_arguments_1.parseSetArguments)(separator >= 0 ? argv.slice(0, separator) : argv);
     const args = parsed.args;
     environment.processEnvs = { ...environment.processEnvs, ...parsed.values };
+    const remote = args.indexOf('remote');
+    if (remote >= 0 && args[remote + 1] === 'mcp') {
+        // `remote mcp` speaks its protocol on stdout: a warning there would break it
+        environment.console = (0, log_1.consoleContext)(environment.stderr);
+    }
     const fileIndex = args.indexOf('--file');
     const fileName = fileIndex >= 0 ? (0, path_1.join)(environment.cwd, args[fileIndex + 1]) : await (0, default_build_file_1.getBuildFilename)(environment.cwd, environment);
     if (fileIndex >= 0) {
         args.splice(fileIndex, 2);
     }
-    (0, remote_commands_1.registerRemoteCommands)(program, environment, fileName);
+    (0, remote_commands_1.registerRemoteCommands)(program, environment, fileName, passthrough);
     program.hook('preAction', (_, actionCommand) => {
-        const takesArguments = actionCommand.parent === program && ['run', 'up'].includes(actionCommand.name());
+        const takesArguments = (actionCommand.parent === program && ['run', 'up'].includes(actionCommand.name())) ||
+            (actionCommand.parent?.name() === 'remote' && actionCommand.name() === 'run');
         if (passthrough.length > 0 && !takesArguments) {
-            program.error(`${actionCommand.name()} takes no arguments after --, only run and up do`, { exitCode: 1 });
+            program.error(`${actionCommand.name()} takes no arguments after --, only run, up and remote run do`, {
+                exitCode: 1,
+            });
         }
     });
     if (await environment.file.exists(fileName)) {
@@ -593,6 +608,7 @@ async function getProgram(environment, argv) {
             .choices(['checksum', 'modify-date', 'none']))
             .addOption(new commander_1.Option('--cache-read-only', `restore from cache backends but never push to them (or set ${read_only_1.CACHE_READ_ONLY_ENV}=1)`).default(false))
             .addOption(new commander_1.Option('--timeout <duration>', 'fail tasks without their own timeout after this long (e.g. 10m)').argParser(units_1.parseDuration))
+            .addOption(new commander_1.Option('--network <level>', 'the most any task or service reaches besides its needs: none, open or allow:<host>,<host>').argParser(parseNetworkArgument))
             .action(async (options, command) => {
             try {
                 const scope = {
@@ -610,6 +626,7 @@ async function getProgram(environment, argv) {
                     wait: options.wait,
                     cacheReadOnly: (0, read_only_1.isCacheReadOnly)(options.cacheReadOnly, environment.processEnvs),
                     timeout: options.timeout ?? null,
+                    network: options.network ?? null,
                 });
                 if (!result.success) {
                     program.error('Up was not successful', { exitCode: 1 });
@@ -671,6 +688,7 @@ async function getProgram(environment, argv) {
             .addOption(new commander_1.Option('--dry-run', 'print the execution plan with predicted cache hits/misses without running').default(false))
             .addOption(new commander_1.Option('--cache-read-only', `restore from cache backends but never push to them (or set ${read_only_1.CACHE_READ_ONLY_ENV}=1)`).default(false))
             .addOption(new commander_1.Option('--timeout <duration>', 'fail tasks without their own timeout after this long (e.g. 10m)').argParser(units_1.parseDuration))
+            .addOption(new commander_1.Option('--network <level>', 'the most any task or service reaches besides its needs: none, open or allow:<host>,<host>').argParser(parseNetworkArgument))
             .addOption(new commander_1.Option('--no-skip-deps', 'run dependencies even when nothing needing them has to run'))
             .action(async (task, options, command) => {
             try {
@@ -704,6 +722,7 @@ async function getProgram(environment, argv) {
                     explain: options.explain,
                     cacheReadOnly: (0, read_only_1.isCacheReadOnly)(options.cacheReadOnly, environment.processEnvs),
                     timeout: options.timeout ?? null,
+                    network: options.network ?? null,
                     skipDeps: options.skipDeps !== false,
                 });
                 // Reporting only: the summary never changes the exit code or behavior.
@@ -767,7 +786,8 @@ tasks:
     program.option('--file', 'set build file', '.hammerkit.yaml');
     program.option('--set <NAME=value>', 'value for $NAME / ${NAME} references, ahead of the shell and .env (repeatable)');
     program.configureOutput({
-        writeOut: (str) => environment.console.info(str),
+        // --version and --help as they are, so `VERSION=$(hammerkit --version)` works
+        writeOut: (str) => environment.stdout.write(str),
         writeErr: (str) => {
             environment.console.error(str);
         },
@@ -775,4 +795,12 @@ tasks:
     return { program, args };
 }
 exports.getProgram = getProgram;
+function parseNetworkArgument(value) {
+    try {
+        return (0, work_network_1.parseNetworkOption)(value);
+    }
+    catch (e) {
+        throw new commander_1.InvalidArgumentError((0, log_1.getErrorMessage)(e));
+    }
+}
 //# sourceMappingURL=program.js.map

package/dist/remote/annotations.js

@@ -0,0 +1,115 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.applyAnnotations = exports.collectAnnotations = exports.readCheckout = exports.remoteRepo = void 0;
+const child_process_1 = require("child_process");
+const os_1 = require("os");
+const path_1 = require("path");
+const util_1 = require("util");
+const repo_1 = require("../server/repo");
+const bundle_1 = require("./bundle");
+const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
+async function git(cwd, ...args) {
+    try {
+        const value = (await execFileAsync('git', args, { cwd, timeout: 5000 })).stdout.trim();
+        return value || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+// `host/path` of a remote, or nothing: a url that is neither https, ssh nor
+// `user@host:path` is left out, so a credential in it never leaves the machine.
+function remoteRepo(url) {
+    const scp = /^[\w.-]+@([\w.-]+):(?!\/)(.+)$/.exec(url);
+    if (scp) {
+        return (0, repo_1.normalizeRepo)(`${scp[1]}/${scp[2]}`) ?? undefined;
+    }
+    try {
+        const parsed = new URL(url);
+        if (!['https:', 'ssh:'].includes(parsed.protocol)) {
+            return undefined;
+        }
+        return (0, repo_1.normalizeRepo)(`${parsed.hostname}${parsed.pathname}`) ?? undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+exports.remoteRepo = remoteRepo;
+// The checkout a directory is in: the repository of its `origin`, the branch it is on and
+// its commit, what can be found of them.
+async function readCheckout(cwd) {
+    if ((await git(cwd, 'rev-parse', '--is-inside-work-tree')) !== 'true') {
+        return {};
+    }
+    const remote = await git(cwd, 'remote', 'get-url', 'origin');
+    // a detached HEAD is on no branch
+    const branch = await git(cwd, 'symbolic-ref', '--quiet', '--short', 'HEAD');
+    return { repo: remote ? remoteRepo(remote) : undefined, branch, commit: await git(cwd, 'rev-parse', 'HEAD') };
+}
+exports.readCheckout = readCheckout;
+// Where a build file is published from: its path in its repository (or on this
+// machine, outside of one), the repository and commit, this machine and its user.
+// `files` are the paths of the bundle, relative to the build file's directory: when
+// one of them differs from the commit, `dirty=true` says the version is not that
+// commit's. What can not be found is left out.
+async function collectAnnotations(fileName, files = [(0, path_1.basename)(fileName)]) {
+    const path = (0, path_1.resolve)(fileName);
+    const cwd = (0, path_1.dirname)(path);
+    const annotations = {};
+    // git says where the directory is in the repository: comparing paths would trip on
+    // what the file system calls the same directory differently (symlinks, 8.3 names)
+    const inside = (await git(cwd, 'rev-parse', '--is-inside-work-tree')) === 'true';
+    const prefix = inside ? (await git(cwd, 'rev-parse', '--show-prefix')) ?? '' : undefined;
+    annotations.path = prefix !== undefined ? `${prefix}${(0, path_1.basename)(path)}` : path;
+    if (inside) {
+        const remote = await git(cwd, 'remote', 'get-url', 'origin');
+        const repo = remote ? remoteRepo(remote) : undefined;
+        const commit = await git(cwd, 'rev-parse', 'HEAD');
+        if (repo) {
+            annotations.repo = repo;
+        }
+        if (commit) {
+            annotations.commit = commit;
+            const changed = await git(cwd, '--literal-pathspecs', 'status', '--porcelain', '--untracked-files=all', '--', ...files);
+            if (changed) {
+                annotations.dirty = 'true';
+            }
+        }
+    }
+    annotations.machine = (0, os_1.hostname)();
+    try {
+        annotations.user = (0, os_1.userInfo)().username;
+    }
+    catch {
+        // a user without an entry in the password database
+    }
+    return Object.fromEntries(Object.entries(annotations).filter(([, value]) => value));
+}
+exports.collectAnnotations = collectAnnotations;
+// `--annotation key=value` sets one, `key=` leaves it out.
+function applyAnnotations(annotations, options) {
+    const result = { ...annotations };
+    for (const option of options) {
+        const index = option.indexOf('=');
+        if (index <= 0) {
+            throw new Error(`${option} is not an annotation, write it as key=value`);
+        }
+        const key = option.slice(0, index);
+        const value = option.slice(index + 1);
+        if (value) {
+            result[key] = value;
+        }
+        else {
+            delete result[key];
+        }
+    }
+    const parsed = bundle_1.annotationsSchema.safeParse(result);
+    if (!parsed.success) {
+        const issue = parsed.error.issues[0];
+        throw new Error(`${issue.path.length > 0 ? `annotation ${issue.path.join('.')}` : 'annotations'}: ${issue.message}`);
+    }
+    return parsed.data;
+}
+exports.applyAnnotations = applyAnnotations;
+//# sourceMappingURL=annotations.js.map

package/dist/remote/bundle-text.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.showBundle = exports.visible = void 0;
+// Text from a proposal is shown to somebody who decides on it, so nothing in it may
+// rewrite the terminal or hide what it says: control and format characters (which
+// include the ones that reorder text) are shown as `?`. Long lines are not cut,
+// what is hidden behind a cut is what a reviewer needs to see.
+function visible(line) {
+    return line.replace(/\t/g, '  ').replace(/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu, '?');
+}
+exports.visible = visible;
+const lines = (text) => (text === '' ? [] : text.replace(/\n$/, '').split('\n'));
+// Every file of a version, whole: a version has no other one it could be read
+// against, whoever decides on it reads all of it.
+function showBundle(bundle) {
+    return Object.keys(bundle.files)
+        .sort()
+        .flatMap((path) => [
+        `--- ${visible(path)}${path === bundle.entry ? ' (entry)' : ''}`,
+        ...lines(bundle.files[path]).map((line) => `  ${visible(line)}`),
+    ]);
+}
+exports.showBundle = showBundle;
+//# sourceMappingURL=bundle-text.js.map

package/dist/remote/bundle.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.HASH_PATTERN = exports.hashBundle = exports.bundleSchema = exports.isBundlePath = exports.MAX_BUNDLE_BYTES = exports.MAX_BUNDLE_FILES = exports.DEFAULT_ENTRY = void 0;
+exports.HASH_PATTERN = exports.hashBundle = exports.bundleSchema = exports.annotationsSchema = exports.MAX_ANNOTATIONS = exports.isBundlePath = exports.MAX_BUNDLE_BYTES = exports.MAX_BUNDLE_FILES = exports.DEFAULT_ENTRY = void 0;
 const crypto_1 = require("crypto");
 const zod_1 = require("zod");
 exports.DEFAULT_ENTRY = '.hammerkit.yaml';
@@ -16,6 +16,14 @@ function isBundlePath(path) {
         !path.split('/').some((part) => part === '' || part === '.' || part === '..'));
 }
 exports.isBundlePath = isBundlePath;
+exports.MAX_ANNOTATIONS = 20;
+exports.annotationsSchema = zod_1.z
+    .record(zod_1.z
+    .string()
+    .regex(/^[a-z][a-z0-9._-]{0,63}$/, 'use lower case letters, digits, ".", "_" and "-", starting with a letter'), zod_1.z.string().min(1).max(500))
+    .refine((annotations) => Object.keys(annotations).length <= exports.MAX_ANNOTATIONS, {
+    message: `at most ${exports.MAX_ANNOTATIONS} annotations`,
+});
 exports.bundleSchema = zod_1.z
     .object({
     entry: zod_1.z.string().default(exports.DEFAULT_ENTRY),

package/dist/remote/remote-commands.js

@@ -10,11 +10,15 @@ const log_1 = require("../log");
 const host_config_1 = require("./host-config");
 const device_login_1 = require("./device-login");
 const credentials_1 = require("./credentials");
+const token_source_1 = require("./token-source");
 const server_client_1 = require("./server-client");
 const remote_work_commands_1 = require("./remote-work-commands");
+const mcp_command_1 = require("../harness/mcp-command");
 // Host-level commands: they only touch the machine's config file, so they work
 // with or without a build file in the working directory.
-function registerRemoteCommands(program, environment, buildFile) {
+function registerRemoteCommands(program, environment, buildFile, 
+// what follows `--`, the arguments of `remote run`
+passthrough = []) {
     const remote = program.command('remote').description('register the servers runs can be sent to');
     const guarded = (failure, fn) => {
         return async (...args) => {
@@ -129,7 +133,7 @@ function registerRemoteCommands(program, environment, buildFile) {
         .description('show who you are on a server and which service accounts you may use')
         .action(guarded('Remote accounts was not successful', async (name) => {
         const chosen = await getServer(name);
-        const token = await (0, credentials_1.getAccessToken)(environment, chosen.name, chosen.server);
+        const token = await (0, token_source_1.getTokenSource)(environment, chosen.name, chosen.server).token();
         const me = await (0, server_client_1.getMe)(chosen.server, token);
         const { body } = await (0, server_client_1.callServer)(chosen.server, token, 'GET', '/v1/accounts');
         environment.stdout.write(`${chosen.name}: ${(0, server_client_1.printable)(me.sub)} (${(0, server_client_1.printable)(me.iss)})\n`);
@@ -152,7 +156,15 @@ function registerRemoteCommands(program, environment, buildFile) {
             environment.stdout.write(`repositories: ${me.repos.map(server_client_1.printable).join(', ')}\n`);
         }
     }));
-    (0, remote_work_commands_1.registerWorkCommands)(remote, { environment, buildFile, getServer, guarded });
+    (0, remote_work_commands_1.registerWorkCommands)(remote, {
+        environment,
+        buildFile,
+        getServer,
+        guarded,
+        passthrough,
+        fail: (message, exitCode) => program.error(message, { exitCode }),
+    });
+    (0, mcp_command_1.registerMcpCommand)(remote, environment);
 }
 exports.registerRemoteCommands = registerRemoteCommands;
 //# sourceMappingURL=remote-commands.js.map