hammerkit 1.26.0 → 1.27.0-next.10

package/dist/remote/remote-work-commands.js

@@ -3,32 +3,61 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.registerWorkCommands = void 0;
+exports.registerWorkCommands = exports.describePlan = exports.describeApproval = void 0;
 const commander_1 = require("commander");
 const colors_1 = __importDefault(require("colors"));
-const credentials_1 = require("./credentials");
+const token_source_1 = require("./token-source");
 const collect_bundle_1 = require("./collect-bundle");
 const bundle_1 = require("./bundle");
+const annotations_1 = require("./annotations");
 const server_client_1 = require("./server-client");
-const text_diff_1 = require("./text-diff");
-const PROPOSAL_NAME = /^([a-z0-9][a-z0-9._-]{0,63})@(sha256:[0-9a-f]{64})$/i;
-// A proposed version is named like `payments@sha256:...`
-function parseProposal(value) {
-    const match = PROPOSAL_NAME.exec(value);
-    return match && bundle_1.HASH_PATTERN.test(match[2]) ? { name: match[1], hash: match[2] } : undefined;
-}
+const bundle_text_1 = require("./bundle-text");
+const sandbox_client_1 = require("../harness/sandbox-client");
+const path_1 = require("path");
 const RUN_ID = /^run_[A-Za-z0-9_-]{16}$/;
+// what the publisher said about where a version comes from, one line
+// What a publisher said about where a version comes from: the server takes it as said,
+// so anybody else is told it is not checked.
+function annotationLines(annotations, label = 'from (unverified)') {
+    const entries = Object.entries(annotations ?? {});
+    return entries.length > 0
+        ? [`  ${label}: ${entries.map(([key, value]) => `${(0, server_client_1.printable)(key)}=${(0, server_client_1.printable)(value)}`).join(' ')}`]
+        : [];
+}
+function yankLines(version) {
+    return version.yanked
+        ? [
+            `  yanked by ${(0, server_client_1.printable)(version.yanked.by.sub)}${version.yanked.reason ? `: ${(0, server_client_1.printable)(version.yanked.reason)}` : ''}`,
+        ]
+        : [];
+}
+// A line a task printed, shown as it is but for control characters, so it can't rewrite
+// the terminal; tabs stay.
+function printableLine(text) {
+    return text.split('\t').map(server_client_1.printableWhole).join('\t');
+}
+const collectOption = (value, previous = []) => [...previous, value];
 // What a person who approves is shown of a run: everything the decision rests on.
-function describe(run) {
-    const source = run.source.type === 'ref' ? `ref ${run.source.ref}` : `snapshot ${run.source.snapshot}`;
-    const options = Object.entries(run.options)
+function describeApproval(run) {
+    const source = run.source.type === 'ref'
+        ? `ref ${run.source.ref}`
+        : run.source.type === 'sandbox'
+            ? `sandbox of ${run.source.repo} at ${run.source.commit}, ${run.source.clean ? 'unchanged' : `with changes, files ${run.source.tree}`} (files .gitignore leaves out are not shown)`
+            : `snapshot ${run.source.snapshot}`;
+    // the arguments are shown whole on a line of their own, each as a JSON string,
+    // so commas, spaces and quotes inside one stay visible
+    const { args, ...settings } = run.options;
+    const options = Object.entries(settings)
         .map(([key, value]) => `${key}=${Array.isArray(value) ? value.join(',') : value}`)
         .join(' ');
     return [
         `${colors_1.default.bold((0, server_client_1.printable)(run.id))}  requested by ${(0, server_client_1.printable)(run.requestedBy.sub)} (${(0, server_client_1.printable)(run.requestedBy.iss)})`,
-        `  ${(0, server_client_1.printable)(run.definition.name)} ${(0, server_client_1.printable)(run.definition.hash)}`,
+        `  build file ${(0, server_client_1.printable)(run.definition)}`,
         `  tasks: ${run.tasks.length > 0 ? run.tasks.map(server_client_1.printable).join(', ') : 'selected by labels'}`,
         `  accounts: ${run.accounts.length > 0 ? run.accounts.map(server_client_1.printable).join(', ') : 'none'}, source ${(0, server_client_1.printable)(source)}${options ? `, ${(0, server_client_1.printable)(options)}` : ''}`,
+        ...(Array.isArray(args) && args.length > 0
+            ? [`  arguments: ${args.map((arg) => (0, server_client_1.printableWhole)(JSON.stringify(arg))).join(' ')}`]
+            : []),
         ...(run.approvals ?? []).map((approval) => `  ${(0, server_client_1.printable)(approval.account)}: ${approval.approvedBy
             ? `approved by ${(0, server_client_1.printable)(approval.approvedBy.sub)}`
             : 'waits for somebody who uses it to approve'}`),
@@ -36,6 +65,7 @@ function describe(run) {
         `  decide before ${(0, server_client_1.printable)(run.approvals?.[0]?.expiresAt ?? '-')}`,
     ];
 }
+exports.describeApproval = describeApproval;
 // What to look at first, one line.
 function flagLines(run) {
     const flagged = Object.entries(run.plan ?? {}).filter(([, entry]) => entry.flags.length > 0);
@@ -51,7 +81,11 @@ function flagLines(run) {
 function describePlan(plan) {
     return Object.entries(plan).flatMap(([name, entry]) => [
         `  ${colors_1.default.bold((0, server_client_1.printable)(name))}  ${entry.kind}, ${(0, server_client_1.printable)(entry.runtime)}${entry.image ? ` ${(0, server_client_1.printable)(entry.image)}` : ''}${entry.flags.length > 0 ? `  [${entry.flags.map(server_client_1.printable).join(', ')}]` : ''}`,
-        ...entry.cmds.map((cmd) => `    $ ${(0, server_client_1.printable)(cmd)}`),
+        // a command is what is decided on: shown whole, however long
+        ...entry.cmds.map((cmd) => `    $ ${(0, server_client_1.printableWhole)(cmd)}`),
+        ...(entry.network !== undefined && entry.network !== 'open'
+            ? [`    network: ${(0, server_client_1.printable)(typeof entry.network === 'string' ? entry.network : JSON.stringify(entry.network))}`]
+            : []),
         ...(entry.deps.length > 0 ? [`    after: ${entry.deps.map(server_client_1.printable).join(', ')}`] : []),
         ...(entry.needs.length > 0 ? [`    needs: ${entry.needs.map(server_client_1.printable).join(', ')}`] : []),
         ...entry.secrets.map((secret) => `    secret ${(0, server_client_1.printable)(secret.from)}${secret.account ? ` as ${(0, server_client_1.printable)(secret.account)}` : ''} -> ${(0, server_client_1.printable)(secret.target)}`),
@@ -60,29 +94,159 @@ function describePlan(plan) {
         ...(entry.generates.length > 0 ? [`    generates: ${entry.generates.map(server_client_1.printable).join(', ')}`] : []),
     ]);
 }
+exports.describePlan = describePlan;
 function registerWorkCommands(remote, context) {
-    const { environment, buildFile, getServer, guarded } = context;
+    const { environment, buildFile, getServer, guarded, passthrough, fail } = context;
     const connect = async (name) => {
         const chosen = await getServer(name);
-        const token = await (0, credentials_1.getAccessToken)(environment, chosen.name, chosen.server);
+        // a CI job or an agent brings its own token, a person signs in
+        const token = await (0, token_source_1.getTokenSource)(environment, chosen.name, chosen.server).token();
         return { ...chosen, token };
     };
     remote
-        .command('publish <definition> [server]')
-        .description('publish the build file and the files it includes to a server, under a name runs can refer to')
-        .action(guarded('Remote publish was not successful', async (definition, name) => {
+        .command('publish [server]')
+        .description('publish the build file and the files it includes to a server, runs refer to it by its hash')
+        .addOption(new commander_1.Option('--annotation <key=value>', 'say more about where it comes from, or leave one out with key=; path, repo, commit, machine and user are filled in').argParser(collectOption))
+        .action(guarded('Remote publish was not successful', async (name, options) => {
         const bundle = await (0, collect_bundle_1.collectBundle)(buildFile, environment);
+        const annotations = (0, annotations_1.applyAnnotations)(await (0, annotations_1.collectAnnotations)(buildFile, Object.keys(bundle.files)), options.annotation ?? []);
         const { name: serverName, server, token } = await connect(name);
-        const answer = await (0, server_client_1.callServer)(server, token, 'PUT', `/v1/definitions/${encodeURIComponent(definition)}`, bundle);
+        const answer = await (0, server_client_1.callServer)(server, token, 'POST', '/v1/definitions', {
+            ...bundle,
+            annotations,
+        });
         const version = answer.body;
         const files = Object.keys(bundle.files).length;
         const proposed = answer.status === 202;
         const verb = proposed ? 'proposed' : answer.status === 201 ? 'published' : 'already published';
-        environment.stdout.write(`${verb} ${definition} to ${serverName}: ${(0, server_client_1.printable)(version.hash)} (${files} ${files === 1 ? 'file' : 'files'})\n`);
+        environment.stdout.write(`${verb} to ${serverName}: ${(0, server_client_1.printable)(version.hash)} (${files} ${files === 1 ? 'file' : 'files'})\n`);
         const names = [...(version.tasks ?? []), ...(version.services ?? [])];
         environment.stdout.write(`tasks and services: ${names.map(server_client_1.printable).join(', ') || 'none'}\n`);
+        for (const line of annotationLines(version.annotations, 'from')) {
+            environment.stdout.write(`${line.trimStart()}\n`);
+        }
         if (proposed) {
-            environment.stdout.write(`it can not run before somebody who may publish ${(0, server_client_1.printable)(definition)} approves it, until ${(0, server_client_1.printable)(version.expiresAt)}\n`);
+            environment.stdout.write(`it can not run before somebody who may publish approves it, until ${(0, server_client_1.printable)(version.expiresAt)}\n`);
+        }
+    }));
+    remote
+        .command('run <tasks...>')
+        .description('run tasks of a published build file on a server from a git ref, print their output and exit as they did')
+        .addOption(new commander_1.Option('--server <name>', 'the server to run on; the default of remote use when left out'))
+        .addOption(new commander_1.Option('--build <hash>', 'the published version to run (sha256:...), or HAMMERKIT_BUILD; the hash of the build file here when left out'))
+        .addOption(new commander_1.Option('--repo <host/path>', 'the repository, such as github.com/corp/payments; origin of the checkout here when left out'))
+        .addOption(new commander_1.Option('--ref <ref>', 'the branch or tag to run; the branch checked out here when left out'))
+        .addOption(new commander_1.Option('--commit <sha>', 'the commit the ref has to be at, else the run is refused; the commit checked out here when --ref is left out'))
+        .addOption(new commander_1.Option('--env <name>', 'the environment of the build file, as --env of run'))
+        .addOption(new commander_1.Option('--cache <method>', 'as --cache of run').choices(['checksum', 'modify-date', 'none']))
+        .addOption(new commander_1.Option('--timeout <duration>', 'stop the run after this long, such as 30m'))
+        .action(guarded('Remote run was not successful', async (tasks, options) => {
+        const named = options.build ?? environment.processEnvs.HAMMERKIT_BUILD;
+        const definition = named ?? (0, bundle_1.hashBundle)(await (0, collect_bundle_1.collectBundle)(buildFile, environment));
+        if (!bundle_1.HASH_PATTERN.test(definition)) {
+            throw new Error(`${(0, server_client_1.printable)(definition)} is not the hash of a published version (sha256:...)`);
+        }
+        const checkout = options.repo && options.ref ? {} : await (0, annotations_1.readCheckout)((0, path_1.dirname)(buildFile));
+        const repo = options.repo ?? checkout.repo;
+        const ref = options.ref ?? checkout.branch;
+        // the commit checked out here is the code meant, when the ref is the branch it is on
+        const commit = options.commit ?? (options.ref ? undefined : checkout.commit);
+        if (!repo) {
+            throw new Error('name the repository with --repo, the checkout here has no origin it can be told by');
+        }
+        if (!ref) {
+            throw new Error('name the branch or tag with --ref, the checkout here is on no branch');
+        }
+        const { name: serverName, server } = await getServer(options.server);
+        const connection = { url: server.url, ...(0, token_source_1.getTokenSource)(environment, serverName, server) };
+        const runOptions = {};
+        for (const key of ['env', 'cache', 'timeout']) {
+            if (options[key] !== undefined) {
+                runOptions[key] = options[key];
+            }
+        }
+        if (passthrough.length > 0) {
+            runOptions.args = passthrough;
+        }
+        let submitted;
+        try {
+            submitted = await (0, sandbox_client_1.submitRun)(connection, {
+                definition,
+                tasks,
+                source: { type: 'ref', repo, ref, ...(commit ? { commit } : {}) },
+                options: runOptions,
+            });
+        }
+        catch (e) {
+            if (e.status === 400 && !named && /no published build file/.test(String(e))) {
+                throw new Error(`the build file here is not published on ${serverName} (${definition}), publish it first`);
+            }
+            throw e;
+        }
+        const at = submitted.source.type === 'ref' ? ` at ${(0, server_client_1.printable)(submitted.source.commit)}` : '';
+        environment.stdout.write(`${(0, server_client_1.printable)(submitted.id)} on ${serverName}: ${tasks.map(server_client_1.printable).join(', ')} from ${(0, server_client_1.printable)(ref)}${at}\n`);
+        const prefixed = tasks.length > 1;
+        const followed = await (0, sandbox_client_1.followRun)(connection, submitted, {
+            signal: environment.abortCtrl.signal,
+            onLine: (line) => {
+                environment.stdout.write(`${prefixed || line.task !== tasks[0] ? `[${(0, server_client_1.printable)(line.task)}] ` : ''}${printableLine(line.text)}\n`);
+            },
+            onWaiting: (run) => {
+                for (const approval of run.approvals ?? []) {
+                    environment.stdout.write(`waiting until somebody who uses ${(0, server_client_1.printable)(approval.account)} approves it, before ${(0, server_client_1.printable)(approval.expiresAt)}: hammerkit remote approve ${(0, server_client_1.printable)(run.id)}\n`);
+                }
+            },
+        });
+        const run = followed.run;
+        if (run.state === 'succeeded') {
+            environment.stdout.write(`${(0, server_client_1.printable)(run.id)} succeeded\n`);
+            return;
+        }
+        // the exit code of the first task that failed, as `hammerkit run` would end
+        const failed = tasks
+            .map((task) => run.results?.[task])
+            .concat(Object.values(run.results ?? {}))
+            .find((result) => result?.status === 'failed');
+        const exitCode = failed?.exitCode && failed.exitCode > 0 ? failed.exitCode : 1;
+        fail(`${(0, server_client_1.printable)(run.id)} ${run.state}${run.error ? `: ${(0, server_client_1.printable)(run.error)}` : ''}`, exitCode);
+    }));
+    remote
+        .command('versions [server]')
+        .description('list the published versions of build files on a server, newest first, with where they come from')
+        .addOption(new commander_1.Option('--filter <key=value>', 'only the versions with this annotation, such as repo=github.com/corp/payments').argParser(collectOption))
+        .action(guarded('Remote versions was not successful', async (name, options) => {
+        const query = new URLSearchParams();
+        for (const filter of (options.filter ?? [])) {
+            const index = filter.indexOf('=');
+            if (index <= 0) {
+                throw new Error(`${(0, server_client_1.printable)(filter)} is not a filter, write it as key=value`);
+            }
+            if (index === filter.length - 1) {
+                throw new Error(`${(0, server_client_1.printable)(filter)} matches nothing, an annotation always has a value`);
+            }
+            query.append(filter.slice(0, index), filter.slice(index + 1));
+        }
+        const { name: serverName, server, token } = await connect(name);
+        const path = `/v1/definitions${query.toString() !== '' ? `?${query}` : ''}`;
+        const { body } = await (0, server_client_1.callServer)(server, token, 'GET', path);
+        if (body.definitions.length === 0) {
+            environment.stdout.write(`${serverName}: no published versions${query.toString() !== '' ? ' match' : ''}\n`);
+            return;
+        }
+        environment.stdout.write(`${serverName}: ${body.definitions.length} published\n`);
+        for (const version of body.definitions) {
+            environment.stdout.write(`${colors_1.default.bold((0, server_client_1.printable)(version.hash))}  published by ${(0, server_client_1.printable)(version.publishedBy.sub)} at ${(0, server_client_1.printable)(version.publishedAt)}${version.approvedBy ? `, approved by ${(0, server_client_1.printable)(version.approvedBy.sub)}` : ''}\n`);
+            for (const line of annotationLines(version.annotations)) {
+                environment.stdout.write(`${line}\n`);
+            }
+            const names = [...version.tasks, ...version.services];
+            environment.stdout.write(`  tasks and services: ${names.map(server_client_1.printable).join(', ') || 'none'}\n`);
+            if (version.accounts.length > 0) {
+                environment.stdout.write(`  accounts: ${version.accounts.map(server_client_1.printable).join(', ')}\n`);
+            }
+            for (const line of yankLines(version)) {
+                environment.stdout.write(`${line}\n`);
+            }
         }
     }));
     remote
@@ -97,21 +261,84 @@ function registerWorkCommands(remote, context) {
         }
         environment.stdout.write(`${serverName}: ${body.approvals.length} waiting for your approval\n`);
         for (const run of body.approvals) {
-            for (const line of describe(run)) {
+            for (const line of describeApproval(run)) {
                 environment.stdout.write(`${line}\n`);
             }
         }
     }));
+    // A version that is published: who published it, what its tasks do and every file.
+    const showPublished = async (hash, serverName, server, token) => {
+        const path = `/v1/definitions/${hash}`;
+        let version;
+        try {
+            version = (await (0, server_client_1.callServer)(server, token, 'GET', path)).body;
+        }
+        catch (e) {
+            if (e instanceof server_client_1.ServerError && e.status === 404) {
+                throw new Error(`${serverName} has no proposal or published version ${(0, server_client_1.printable)(hash)} you may see`);
+            }
+            throw e;
+        }
+        const files = (await (0, server_client_1.callServer)(server, token, 'GET', `${path}/files`)).body;
+        environment.stdout.write(`${colors_1.default.bold((0, server_client_1.printable)(version.hash))} on ${serverName}, published by ${(0, server_client_1.printable)(version.publishedBy.sub)} (${(0, server_client_1.printable)(version.publishedBy.iss)}) at ${(0, server_client_1.printable)(version.publishedAt)}${version.approvedBy ? `, approved by ${(0, server_client_1.printable)(version.approvedBy.sub)}` : ''}\n`);
+        for (const line of [
+            ...yankLines(version),
+            ...annotationLines(version.annotations),
+            ...flagLines(version),
+            ...(version.plan ? describePlan(version.plan) : ['  the server did not record what its tasks do']),
+            ...(0, bundle_text_1.showBundle)(files),
+        ]) {
+            environment.stdout.write(`${line}\n`);
+        }
+    };
     remote
-        .command('show <run> [server]')
-        .description('show a run that waits for your approval in full: the commands, secrets and accounts of its tasks')
-        .action(guarded('Remote show was not successful', async (run, name) => {
-        if (!RUN_ID.test(run)) {
-            throw new Error(`${(0, server_client_1.printable)(run)} is not a run id, list them with: hammerkit remote approvals`);
-        }
-        const { server, token } = await connect(name);
-        const view = (await (0, server_client_1.callServer)(server, token, 'GET', `/v1/approvals/${run}`)).body;
-        for (const line of describe(view)) {
+        .command('show <target> [server]')
+        .description('show a run (run_...) or a proposed or published version (sha256:...) in full: the commands, secrets and accounts of its tasks, and the files of a version')
+        .action(guarded('Remote show was not successful', async (target, name) => {
+        if (!RUN_ID.test(target) && !bundle_1.HASH_PATTERN.test(target)) {
+            throw new Error(`${(0, server_client_1.printable)(target)} is not a run id or a version, list them with: hammerkit remote approvals, remote proposals or remote versions`);
+        }
+        const { name: serverName, server, token } = await connect(name);
+        if (bundle_1.HASH_PATTERN.test(target)) {
+            const path = `/v1/proposals/${target}`;
+            let proposal;
+            try {
+                proposal = (await (0, server_client_1.callServer)(server, token, 'GET', path)).body;
+            }
+            catch (e) {
+                if (e instanceof server_client_1.ServerError && e.status === 404) {
+                    await showPublished(target, serverName, server, token);
+                    return;
+                }
+                throw e;
+            }
+            if (proposal.state === 'approved') {
+                await showPublished(target, serverName, server, token);
+                return;
+            }
+            if (proposal.state !== 'waiting') {
+                // a decided proposal keeps no files
+                environment.stdout.write(`${colors_1.default.bold((0, server_client_1.printable)(proposal.hash))} on ${serverName}, proposed by ${(0, server_client_1.printable)(proposal.proposedBy.sub)}, ${(0, server_client_1.printable)(proposal.state)}${proposal.decidedBy ? ` by ${(0, server_client_1.printable)(proposal.decidedBy.sub)}` : ''}${proposal.reason ? `: ${(0, server_client_1.printable)(proposal.reason)}` : ''}\n`);
+                for (const line of annotationLines(proposal.annotations)) {
+                    environment.stdout.write(`${line}\n`);
+                }
+                environment.stdout.write('  its files are not kept once it is decided\n');
+                return;
+            }
+            const files = (await (0, server_client_1.callServer)(server, token, 'GET', `${path}/files`)).body;
+            environment.stdout.write(`${colors_1.default.bold((0, server_client_1.printable)(proposal.hash))} on ${serverName}, proposed by ${(0, server_client_1.printable)(proposal.proposedBy.sub)} (${(0, server_client_1.printable)(proposal.proposedBy.iss)}), ${(0, server_client_1.printable)(proposal.state)}\n`);
+            for (const line of [
+                ...annotationLines(proposal.annotations),
+                ...flagLines(proposal),
+                ...describePlan(proposal.plan ?? {}),
+                ...(0, bundle_text_1.showBundle)(files),
+            ]) {
+                environment.stdout.write(`${line}\n`);
+            }
+            return;
+        }
+        const view = (await (0, server_client_1.callServer)(server, token, 'GET', `/v1/approvals/${target}`)).body;
+        for (const line of describeApproval(view)) {
             environment.stdout.write(`${line}\n`);
         }
         environment.stdout.write(view.plan ? `${describePlan(view.plan).join('\n')}\n` : 'the server did not record what its tasks do\n');
@@ -130,7 +357,10 @@ function registerWorkCommands(remote, context) {
         for (const proposal of body.proposals) {
             const who = proposal.mine ? 'you' : (0, server_client_1.printable)(proposal.proposedBy.sub);
             const state = proposal.canDecide ? colors_1.default.bold('waits for your approval') : (0, server_client_1.printable)(proposal.state);
-            environment.stdout.write(`${colors_1.default.bold(`${(0, server_client_1.printable)(proposal.name)}@${(0, server_client_1.printable)(proposal.hash)}`)}  proposed by ${who}, ${state}\n`);
+            environment.stdout.write(`${colors_1.default.bold((0, server_client_1.printable)(proposal.hash))}  proposed by ${who}, ${state}\n`);
+            for (const line of annotationLines(proposal.annotations)) {
+                environment.stdout.write(`${line}\n`);
+            }
             const names = [...proposal.tasks, ...proposal.services];
             environment.stdout.write(`  tasks and services: ${names.map(server_client_1.printable).join(', ') || 'none'}\n`);
             if (proposal.accounts.length > 0) {
@@ -141,9 +371,6 @@ function registerWorkCommands(remote, context) {
             for (const line of flagLines(proposal)) {
                 environment.stdout.write(`${line}\n`);
             }
-            if (proposal.stale) {
-                environment.stdout.write(`  stale: ${(0, server_client_1.printable)(proposal.name)} has a newer version, reject it and propose again on top of it\n`);
-            }
             if (proposal.state === 'waiting') {
                 environment.stdout.write(`  decide before ${(0, server_client_1.printable)(proposal.expiresAt)}\n`);
             }
@@ -152,43 +379,19 @@ function registerWorkCommands(remote, context) {
             }
         }
     }));
-    remote
-        .command('diff <proposal> [server]')
-        .description('show what a proposed version (name@hash) changes against the version it follows')
-        .action(guarded('Remote diff was not successful', async (target, name) => {
-        const proposal = parseProposal(target);
-        if (!proposal) {
-            throw new Error(`${(0, server_client_1.printable)(target)} is not a proposal, list them with: hammerkit remote proposals`);
-        }
-        const { name: serverName, server, token } = await connect(name);
-        const path = `/v1/proposals/${encodeURIComponent(proposal.name)}/${proposal.hash}`;
-        const view = (await (0, server_client_1.callServer)(server, token, 'GET', path)).body;
-        const proposed = (await (0, server_client_1.callServer)(server, token, 'GET', `${path}/files`)).body;
-        const base = view.base
-            ? (await (0, server_client_1.callServer)(server, token, 'GET', `/v1/definitions/${encodeURIComponent(proposal.name)}/${view.base}/files`)).body
-            : undefined;
-        environment.stdout.write(`${(0, server_client_1.printable)(proposal.name)}@${(0, server_client_1.printable)(proposal.hash)} on ${serverName}, proposed by ${(0, server_client_1.printable)(view.proposedBy.sub)} (${(0, server_client_1.printable)(view.proposedBy.iss)})\n`);
-        environment.stdout.write(base ? `compared with ${(0, server_client_1.printable)(view.base)}\n` : 'no version is published yet, everything is new\n');
-        if (view.stale) {
-            environment.stdout.write(`warning: ${(0, server_client_1.printable)(proposal.name)} has a newer version (${(0, server_client_1.printable)(view.latest)}), this can only be rejected\n`);
-        }
-        const lines = (0, text_diff_1.diffBundles)(base, proposed);
-        environment.stdout.write(lines.length > 0 ? `${lines.join('\n')}\n` : 'the files are the same\n');
-    }));
     for (const action of ['yank', 'unyank']) {
         remote
             .command(`${action} <version> [server]`)
             .description(action === 'yank'
-            ? 'pull a published version (name@hash) back: no run starts from it and it is not latest'
-            : 'let a yanked version (name@hash) go on')
+            ? 'pull a published version (sha256:...) back: no run starts from it'
+            : 'let a yanked version (sha256:...) go on')
             .addOption(new commander_1.Option('--reason <text>', 'why, shown to whoever tries to run it').argParser((value) => value))
             .action(guarded(`Remote ${action} was not successful`, async (target, name, options) => {
-            const version = parseProposal(target);
-            if (!version) {
-                throw new Error(`${(0, server_client_1.printable)(target)} is not a version, name it like payments@sha256:...`);
+            if (!bundle_1.HASH_PATTERN.test(target)) {
+                throw new Error(`${(0, server_client_1.printable)(target)} is not a version, name it by its hash: sha256:...`);
             }
             const { name: serverName, server, token } = await connect(name);
-            await (0, server_client_1.callServer)(server, token, 'POST', `/v1/definitions/${encodeURIComponent(version.name)}/${version.hash}/${action}`, options.reason ? { reason: options.reason } : undefined);
+            await (0, server_client_1.callServer)(server, token, 'POST', `/v1/definitions/${target}/${action}`, options.reason ? { reason: options.reason } : undefined);
             environment.stdout.write(`${action === 'yank' ? 'yanked' : 'let go on'} ${(0, server_client_1.printable)(target)} on ${serverName}\n`);
         }));
     }
@@ -196,18 +399,16 @@ function registerWorkCommands(remote, context) {
         remote
             .command(`${action} <target> [server]`)
             .description(action === 'approve'
-            ? 'let a run (run_...) or a proposed version (name@hash) that waits for your approval go ahead'
-            : 'end a run (run_...) or drop a proposed version (name@hash) that waits for your approval')
+            ? 'let a run (run_...) or a proposed version (sha256:...) that waits for your approval go ahead'
+            : 'end a run (run_...) or drop a proposed version (sha256:...) that waits for your approval')
             .addOption(new commander_1.Option('--reason <text>', 'why, shown to who asked').argParser((value) => value))
             .action(guarded(`Remote ${action} was not successful`, async (target, name, options) => {
-            const proposal = parseProposal(target);
+            const proposal = bundle_1.HASH_PATTERN.test(target);
             if (!proposal && !RUN_ID.test(target)) {
                 throw new Error(`${(0, server_client_1.printable)(target)} is not a run id or a proposed version, list them with: hammerkit remote approvals or remote proposals`);
             }
             const { name: serverName, server, token } = await connect(name);
-            const path = proposal
-                ? `/v1/proposals/${encodeURIComponent(proposal.name)}/${proposal.hash}/${action}`
-                : `/v1/approvals/${target}/${action}`;
+            const path = proposal ? `/v1/proposals/${target}/${action}` : `/v1/approvals/${target}/${action}`;
             const { body } = await (0, server_client_1.callServer)(server, token, 'POST', path, options.reason ? { reason: options.reason } : undefined);
             const rejected = body.state === 'rejected';
             environment.stdout.write(proposal

package/dist/remote/server-client.js

@@ -1,20 +1,33 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.callServer = exports.getMe = exports.getDiscovery = exports.printable = exports.ServerError = void 0;
+exports.callServer = exports.getMe = exports.getDiscovery = exports.printableWhole = exports.printable = exports.ServerError = void 0;
 const discovery_1 = require("../server/discovery");
 const TIMEOUT_MS = 10000;
 const WRITE_TIMEOUT_MS = 30000;
 class ServerError extends Error {
+    // what the server answered, when it did
+    constructor(message, status) {
+        super(message);
+        this.status = status;
+    }
 }
 exports.ServerError = ServerError;
 // Text from the server or the identity provider is shown to the user: no
-// control characters, so it can't rewrite the terminal.
+// control characters, so it can't rewrite the terminal, and format characters
+// (bidi overrides, zero-width) written out, so text reads in the order it runs.
+// Long text is cut, and says how much was.
 function printable(value) {
+    const text = printableWhole(value);
+    return text.length > 300 ? `${text.slice(0, 300)}… (+${text.length - 300} chars)` : text;
+}
+exports.printable = printable;
+// The same, never cut: for what somebody decides on, such as a command.
+function printableWhole(value) {
     return String(value)
         .replace(/\p{Cc}/gu, '?')
-        .slice(0, 300);
+        .replace(/\p{Cf}/gu, (char) => `\\u{${char.codePointAt(0)?.toString(16)}}`);
 }
-exports.printable = printable;
+exports.printableWhole = printableWhole;
 async function getJson(url, token) {
     let response;
     try {
@@ -80,7 +93,7 @@ async function callServer(server, token, method, path, body) {
     }
     if (!response.ok) {
         const said = answer && typeof answer.error === 'string' ? `: ${printable(answer.error)}` : '';
-        throw new ServerError(`${server.url} answered ${response.status}${said}`);
+        throw new ServerError(`${server.url} answered ${response.status}${said}`, response.status);
     }
     return { status: response.status, body: answer };
 }

package/dist/remote/source-manifest.js

@@ -53,6 +53,16 @@ function hashSource(manifest) {
 }
 exports.hashSource = hashSource;
 const DENIED_DIRECTORIES = ['.git', '.ssh', '.aws', '.gnupg', '.kube'];
+// the short names Windows gives these directories, `GIT~1` for `.git`
+const DENIED_SHORT_NAMES = /^(git|ssh|aws|gnupg|kube)~\d+$/;
+// A name as a case-insensitive disk opens it: Windows and macOS open `.SSH` as `.ssh`, and
+// Windows drops trailing dots and spaces (`.git.`) and reads `name:stream` as `name`.
+function canonicalName(name) {
+    return name
+        .replace(/:.*$/, '')
+        .replace(/[. ]+$/, '')
+        .toLowerCase();
+}
 const DENIED_NAMES = [
     /^\.env$/i,
     /^\.env\.(?!example$|sample$|template$|dist$)/i,
@@ -65,12 +75,15 @@ const DENIED_NAMES = [
 // must not be what decides that a key leaves the machine.
 function deniedSourcePath(path) {
     const parts = path.split('/');
-    const directory = parts.slice(0, -1).find((part) => DENIED_DIRECTORIES.includes(part));
+    const directory = parts.slice(0, -1).find((part) => {
+        const name = canonicalName(part);
+        return DENIED_DIRECTORIES.includes(name) || DENIED_SHORT_NAMES.test(name);
+    });
     if (directory !== undefined) {
         return `${directory}/ holds credentials or history`;
     }
     const name = parts[parts.length - 1];
-    if (DENIED_NAMES.some((pattern) => pattern.test(name))) {
+    if (DENIED_NAMES.some((pattern) => pattern.test(name) || pattern.test(canonicalName(name)))) {
         return `${name} looks like a credential file`;
     }
     return null;

package/dist/remote/token-source.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getTokenSource = exports.isToken = void 0;
+const child_process_1 = require("child_process");
+const credentials_1 = require("./credentials");
+// A bearer token is one word of visible ASCII; anything else is output of a token command
+// that holds more than the token, which must never reach an error message.
+function isToken(value) {
+    return /^[\x21-\x7e]+$/.test(value);
+}
+exports.isToken = isToken;
+/**
+ * The token a client of a server sends: a harness, and the `remote` commands. In this order:
+ *
+ * - `HAMMERKIT_TOKEN_COMMAND`: a command that prints a short-lived token of the agent's own
+ *   identity, such as a workload identity or a service account of the identity provider. It
+ *   runs again when the server no longer accepts the token.
+ * - `HAMMERKIT_TOKEN`: such a token, as the agent's platform hands it over.
+ * - the sign-in of `hammerkit remote login <server>`.
+ *
+ * The token only goes to the URL the server is registered with in the host config.
+ */
+function getTokenSource(environment, name, server) {
+    const command = environment.processEnvs.HAMMERKIT_TOKEN_COMMAND;
+    if (command) {
+        let current;
+        const run = () => new Promise((resolve, reject) => {
+            (0, child_process_1.exec)(command, { env: environment.processEnvs, timeout: 60000 }, (error, stdout) => {
+                const token = String(stdout).trim();
+                if (error || !token) {
+                    reject(new Error('HAMMERKIT_TOKEN_COMMAND printed no token'));
+                }
+                else if (!isToken(token)) {
+                    // never the output itself: it can hold more secrets than the token
+                    reject(new Error('HAMMERKIT_TOKEN_COMMAND printed more than a token, it has to print the token alone'));
+                }
+                else {
+                    resolve(token);
+                }
+            });
+        });
+        return {
+            token: () => {
+                current = current ?? run();
+                current.catch(() => (current = undefined));
+                return current;
+            },
+            renew: async () => {
+                current = undefined;
+            },
+        };
+    }
+    const fixed = environment.processEnvs.HAMMERKIT_TOKEN?.trim();
+    if (fixed) {
+        return {
+            token: async () => {
+                if (!isToken(fixed)) {
+                    throw new Error('HAMMERKIT_TOKEN holds more than a token, it has to be the token alone');
+                }
+                return fixed;
+            },
+        };
+    }
+    return { token: () => (0, credentials_1.getAccessToken)(environment, name, server) };
+}
+exports.getTokenSource = getTokenSource;
+//# sourceMappingURL=token-source.js.map

package/dist/schema/build-file-base-task-schema.js

@@ -12,6 +12,7 @@ const duration_schema_1 = require("./duration-schema");
 const build_file_secret_schema_1 = require("./build-file-secret-schema");
 const resources_schema_1 = require("./resources-schema");
 const runner_schema_1 = require("./runner-schema");
+const network_schema_1 = require("./network-schema");
 // what `extend` adds to (the rest, e.g. `image` or `shell`, the task just overrides)
 exports.RESET_PROPERTIES = ['deps', 'needs', 'src', 'generates', 'cmds', 'mounts', 'envs', 'labels'];
 exports.buildFileBaseTaskSchema = (0, zod_1.object)({
@@ -39,6 +40,12 @@ exports.buildFileBaseTaskSchema = (0, zod_1.object)({
     account: (0, zod_1.string)().optional(),
     // CPU and memory limits of the container; a local task is not limited
     resources: resources_schema_1.resourcesSchema.optional(),
+    // what the container reaches besides its needs; a local task can be limited only where
+    // it runs in a container, on a server's cluster
+    network: network_schema_1.networkSchema.optional(),
+    // whether its last command takes the arguments after `--`: false refuses them, true
+    // says it is meant to, which a server with `runs.args: declared` requires
+    args: (0, zod_1.boolean)().optional(),
     // Name of the server (see `hammerkit remote`) the task has to run on; defaults
     // to the build file's `runner`. Never a local fallback when it is unknown.
     runner: runner_schema_1.runnerSchema.optional(),