hammerkit 1.26.0 → 1.27.0-next.10

package/dist/server/server.js

@@ -13,7 +13,9 @@ const runs_1 = require("./runs");
 const git_checkout_1 = require("./git-checkout");
 const repo_access_1 = require("./repo-access");
 const executor_1 = require("./executor");
+const kubernetes_backend_1 = require("./kubernetes-backend");
 const run_plan_1 = require("./run-plan");
+const work_network_1 = require("../planner/work-network");
 const run_environment_1 = require("./run-environment");
 const accounts_api_1 = require("./accounts-api");
 const run_request_1 = require("./run-request");
@@ -25,7 +27,13 @@ const proposals_api_1 = require("./proposals-api");
 const proposals_1 = require("./proposals");
 const sources_1 = require("./sources");
 const sources_api_1 = require("./sources-api");
+const sandboxes_1 = require("./sandboxes");
+const sandbox_storage_1 = require("./sandbox-storage");
+const kubernetes_sandbox_storage_1 = require("./kubernetes-sandbox-storage");
+const sandbox_docker_1 = require("./sandbox-docker");
+const sandboxes_api_1 = require("./sandboxes-api");
 const units_1 = require("../utils/units");
+const run_logs_1 = require("./run-logs");
 const get_cache_directory_1 = require("../optimizer/get-cache-directory");
 const path_1 = require("path");
 var discovery_2 = require("./discovery");
@@ -42,11 +50,20 @@ function getDiscoveryDocument(config) {
             ...(i.clientId ? { clientId: i.clientId } : {}),
             scope: i.scope,
         })),
-        backend: { type: config.backend.type, platform: config.backend.platform ?? (0, server_config_1.detectPlatform)() },
+        backend: config.backend.type === 'kubernetes'
+            ? {
+                type: 'kubernetes',
+                platform: config.backend.pools[0].platform,
+                pools: config.backend.pools.map((pool) => ({ name: pool.name, platform: pool.platform })),
+            }
+            : { type: 'host', platform: config.backend.platform ?? (0, server_config_1.detectPlatform)() },
     };
 }
 exports.getDiscoveryDocument = getDiscoveryDocument;
 const HEARTBEAT_MS = 15000;
+// the longest `?wait=` of a run: below the 60 seconds after which a proxy in front of the
+// server (nginx by default) closes a connection that says nothing
+const MAX_WAIT_MS = 50000;
 // Server-sent events: `id` is the sequence number, so a client that lost the
 // connection continues with Last-Event-ID (or ?after=) and misses nothing.
 function streamEvents(registry, config, principal, id, req, res, url) {
@@ -79,8 +96,8 @@ function streamEvents(registry, config, principal, id, req, res, url) {
         watch.stop();
     });
 }
-async function handleRuns(config, registry, definitions, sources, planning, repos, log, principal, req, res, url) {
-    const match = /^\/v1\/runs(?:\/([^/]+)(?:\/(cancel|events))?)?$/.exec(url.pathname);
+async function handleRuns(config, registry, definitions, sources, sandboxes, planning, repos, log, principal, req, res, url) {
+    const match = /^\/v1\/runs(?:\/([^/]+)(?:\/(cancel|events|logs))?)?$/.exec(url.pathname);
     if (!match) {
         return false;
     }
@@ -88,10 +105,17 @@ async function handleRuns(config, registry, definitions, sources, planning, repo
     const method = req.method;
     if (!id) {
         if (method === 'GET') {
-            (0, http_2.send)(res, 200, { runs: registry.list(principal).map(toRunResponse) });
+            // the results of each task are read one run at a time
+            (0, http_2.send)(res, 200, {
+                runs: registry.list(principal).map((run) => {
+                    const { results, ...listed } = toRunResponse(run);
+                    void results;
+                    return listed;
+                }),
+            });
         }
         else if (method === 'POST') {
-            await submitRun(config, registry, definitions, sources, planning, repos, log, principal, req, res);
+            await submitRun(config, registry, definitions, sources, sandboxes, planning, repos, log, principal, req, res);
         }
         else {
             (0, http_2.send)(res, 405, { error: 'method not allowed' }, { allow: 'GET, POST' });
@@ -116,9 +140,39 @@ async function handleRuns(config, registry, definitions, sources, planning, repo
     else if (action === 'events') {
         streamEvents(registry, config, principal, id, req, res, url);
     }
+    else if (action === 'logs') {
+        let query;
+        try {
+            query = (0, run_logs_1.parseLogQuery)(url.searchParams);
+        }
+        catch (e) {
+            (0, http_2.send)(res, 400, { error: e instanceof Error ? e.message : String(e) });
+            return true;
+        }
+        const logs = registry.logs(principal, id, accountsOf(config, principal));
+        logs
+            ? (0, http_2.send)(res, 200, (0, run_logs_1.readLogs)(logs.events, logs.index, query, logs.truncated))
+            : (0, http_2.send)(res, 404, { error: 'not found' });
+    }
     else {
-        const run = registry.get(principal, id, accountsOf(config, principal));
-        run ? (0, http_2.send)(res, 200, toRunResponse(run)) : (0, http_2.send)(res, 404, { error: 'not found' });
+        let wait = 0;
+        const waitParam = url.searchParams.get('wait');
+        if (waitParam !== null) {
+            try {
+                wait = Math.min((0, units_1.parseDuration)(waitParam), MAX_WAIT_MS);
+            }
+            catch {
+                (0, http_2.send)(res, 400, { error: `wait is a duration up to ${(0, units_1.formatDuration)(MAX_WAIT_MS)}, for example 30s` });
+                return true;
+            }
+        }
+        // a caller that hangs up stops waiting
+        const gone = new AbortController();
+        res.on('close', () => gone.abort());
+        const run = await registry.wait(principal, id, wait, accountsOf(config, principal), gone.signal);
+        if (!gone.signal.aborted) {
+            run ? (0, http_2.send)(res, 200, toRunResponse(run)) : (0, http_2.send)(res, 404, { error: 'not found' });
+        }
     }
     return true;
 }
@@ -130,9 +184,9 @@ function accountsOf(config, principal) {
 function toRunResponse(run) {
     const { owner, ...visible } = run;
     void owner;
-    return visible;
+    return { ...visible, results: run.results ?? {} };
 }
-async function submitRun(config, registry, definitions, sources, planning, repos, log, principal, req, res) {
+async function submitRun(config, registry, definitions, sources, sandboxes, planning, repos, log, principal, req, res) {
     const parsed = run_request_1.runRequestSchema.safeParse(await (0, http_2.readJson)(req));
     if (!parsed.success) {
         const issue = parsed.error.issues[0];
@@ -147,21 +201,26 @@ async function submitRun(config, registry, definitions, sources, planning, repos
         (0, http_2.send)(res, 403, { error: 'you are not entitled to run anything on this server' });
         return;
     }
-    const version = definitions.find(request.definition.name, request.definition.hash);
+    const version = definitions.find(request.definition);
     if (!version) {
-        (0, http_2.send)(res, 400, { error: `there is no build file ${request.definition.name} at ${request.definition.hash}` });
+        (0, http_2.send)(res, 400, { error: `there is no published build file ${request.definition}` });
         return;
     }
     if (version.yanked) {
         (0, http_2.send)(res, 409, {
-            error: `${version.name} at ${version.hash} was yanked${version.yanked.reason ? `: ${version.yanked.reason}` : ''}`,
+            error: `${version.hash} was yanked${version.yanked.reason ? `: ${version.yanked.reason}` : ''}`,
         });
         return;
     }
     const known = [...version.tasks, ...version.services];
     const unknown = request.tasks.filter((task) => !known.includes(task));
     if (unknown.length > 0) {
-        (0, http_2.send)(res, 400, { error: `${version.name} has no task ${unknown.map(oauth_1.quote).join(', ')}` });
+        (0, http_2.send)(res, 400, { error: `${version.hash} has no task ${unknown.map(oauth_1.quote).join(', ')}` });
+        return;
+    }
+    const argued = (request.options.args ?? []).length > 0 ? request.tasks[0] : undefined;
+    if (argued !== undefined && version.services.includes(argued)) {
+        (0, http_2.send)(res, 400, { error: `${argued} is a service, arguments go to a task` });
         return;
     }
     if (request.source.type === 'upload') {
@@ -180,29 +239,57 @@ async function submitRun(config, registry, definitions, sources, planning, repos
             return;
         }
     }
+    const sandbox = request.source.type === 'sandbox' ? sandboxes.registry.get(principal, request.source.id) : undefined;
+    if (request.source.type === 'sandbox') {
+        if (!sandbox) {
+            (0, http_2.send)(res, 400, { error: `there is no sandbox ${request.source.id}, create one with POST /v1/sandboxes` });
+            return;
+        }
+        if (sandboxes.policy.runtimes?.length === 0) {
+            (0, http_2.send)(res, 403, {
+                error: 'this server runs only local tasks, which it runs on no sandbox unless sandboxes.runtimes names local',
+            });
+            return;
+        }
+        await sandboxes.registry.measured(principal);
+        const over = sandboxes.registry.overLimit(principal);
+        if (over) {
+            (0, http_2.send)(res, 413, { error: over });
+            return;
+        }
+    }
     // the accounts of a run are read from the files it is pinned to, with the engine
     const bundle = version.plan ? await definitions.files(version) : undefined;
     if (!version.plan || !bundle) {
         (0, http_2.send)(res, 409, {
-            error: `${version.name} at ${version.hash} was published before accounts were recorded, publish it again`,
+            error: `${version.hash} was published before accounts were recorded, publish it again`,
         });
         return;
     }
     let planned;
     try {
-        planned = await (0, run_plan_1.planRun)(bundle, request, planning.environment, planning.policy);
+        // a run on a sandbox may only use the runtimes of `sandboxes.runtimes`
+        planned = await (0, run_plan_1.planRun)(bundle, request, planning.environment, sandbox ? sandboxes.policy : planning.policy);
     }
     catch (e) {
         (0, http_2.send)(res, 400, { error: `the run does not load: ${e instanceof Error ? e.message : String(e)}` });
         return;
     }
+    const refused = (0, run_plan_1.refuseArguments)(request, planned.plan, sandbox ? sandboxes.policy : planning.policy);
+    if (refused) {
+        log(`refuse run iss=${principal.iss} sub=${principal.sub}: ${refused}`);
+        (0, http_2.send)(res, 400, { error: refused });
+        return;
+    }
     const decision = (0, policy_1.decideRun)({
         grant,
         accounts: planned.accounts,
         catalog: config.accounts,
         source: request.source.type === 'ref'
             ? { type: 'ref', repo: request.source.repo, ref: request.source.ref }
-            : { type: 'upload' },
+            : sandbox
+                ? { type: 'sandbox', repo: sandbox.repo, branch: sandbox.ref }
+                : { type: 'upload' },
         approvable: (account) => config.entitlements.some((entitlement) => entitlement.accounts[account] === 'use'),
         readable: (repo) => repos.readable(repo),
     });
@@ -217,6 +304,12 @@ async function submitRun(config, registry, definitions, sources, planning, repos
     if (request.source.type === 'ref') {
         try {
             const commit = await repos.resolve(request.source.repo, request.source.ref);
+            if (request.source.commit && commit !== request.source.commit) {
+                const error = `${request.source.ref} is at ${commit} now, not at ${request.source.commit}`;
+                log(`refuse run iss=${principal.iss} sub=${principal.sub}: ${error}`);
+                (0, http_2.send)(res, 409, { error });
+                return;
+            }
             source = { type: 'ref', repo: request.source.repo, ref: request.source.ref, commit };
         }
         catch (e) {
@@ -228,19 +321,34 @@ async function submitRun(config, registry, definitions, sources, planning, repos
             return;
         }
     }
-    else {
+    else if (request.source.type === 'upload') {
         source = request.source;
     }
+    const submit = (runSource) => registry.submit(principal, {
+        definition: version.hash,
+        tasks: request.tasks,
+        accounts: planned.accounts,
+        plan: planned.plan,
+        source: runSource,
+        options: request.options,
+    }, approvals);
     try {
-        const run = registry.submit(principal, {
-            definition: { name: version.name, hash: version.hash },
-            tasks: request.tasks,
-            accounts: planned.accounts,
-            plan: planned.plan,
-            source,
-            options: request.options,
-        }, approvals);
-        log(`run ${run.id} iss=${principal.iss} sub=${principal.sub} accounts=[${planned.accounts.join(',')}] source=${run.source.type} tasks=${run.tasks.length}${approvals.length > 0 ? ` approval=[${approvals.join(',')}]` : ''}`);
+        // a sandbox is read and the run submitted while nothing else changes it: the run
+        // records what the sandbox held, and holds it from now on
+        const run = source
+            ? submit(source)
+            : await sandboxes.registry.withSandbox(principal, sandbox.id, async (current) => {
+                const state = await sandboxes.registry.state(current.id);
+                return submit({
+                    type: 'sandbox',
+                    id: current.id,
+                    repo: current.repo,
+                    commit: state.commit,
+                    tree: state.tree,
+                    clean: state.clean,
+                });
+            });
+        log(`run ${run.id} iss=${principal.iss} sub=${principal.sub} accounts=[${planned.accounts.join(',')}] source=${run.source.type}${run.source.type === 'sandbox' ? ` sandbox=${run.source.id}` : ''} tasks=${run.tasks.length}${approvals.length > 0 ? ` approval=[${approvals.join(',')}]` : ''}`);
         (0, http_2.send)(res, 202, toRunResponse(run));
     }
     catch (e) {
@@ -248,6 +356,12 @@ async function submitRun(config, registry, definitions, sources, planning, repos
             (0, http_2.send)(res, e.status, { error: e.message });
             return;
         }
+        if (e instanceof sandboxes_1.SandboxError) {
+            (0, http_2.send)(res, e.status === 404 ? 400 : e.status, {
+                error: e.status === 404 ? `there is no sandbox ${sandbox.id}` : e.message,
+            });
+            return;
+        }
         throw e;
     }
 }
@@ -271,7 +385,7 @@ async function authenticate(verifier, log, req, res) {
         return null;
     }
 }
-async function handle(config, registry, definitions, proposals, sources, planning, repos, verifier, log, req, res) {
+async function handle(config, registry, definitions, proposals, sources, sandboxes, planning, repos, verifier, log, req, res) {
     const url = new URL(req.url ?? '/', 'http://localhost');
     const path = url.pathname;
     if (path === discovery_1.DISCOVERY_PATH || path === '/healthz') {
@@ -295,7 +409,10 @@ async function handle(config, registry, definitions, proposals, sources, plannin
     if (await (0, sources_api_1.handleSources)(config, sources, log, principal, req, res, url)) {
         return;
     }
-    if (await handleRuns(config, registry, definitions, sources, planning, repos, log, principal, req, res, url)) {
+    if (await (0, sandboxes_api_1.handleSandboxes)(config, sandboxes.registry, repos, log, principal, req, res, url)) {
+        return;
+    }
+    if (await handleRuns(config, registry, definitions, sources, sandboxes, planning, repos, log, principal, req, res, url)) {
         return;
     }
     if (await (0, approvals_api_1.handleApprovals)(config, registry, log, principal, req, res, url)) {
@@ -315,7 +432,7 @@ async function startServer(config, environment, options = {}) {
     const write = options.log ?? (() => undefined);
     // request urls and subjects come from callers: no control characters, so no forged log lines
     const log = (line) => write(line.replace(/\p{Cc}/gu, '?').slice(0, 1000));
-    if (config.runtimes.includes('local')) {
+    if (config.runtimes.includes('local') && config.backend.type === 'host') {
         log('warning: the local runtime is allowed, local tasks run as the user of this server and read all it can read; ' +
             'an account is then an approval class, not a credential boundary');
     }
@@ -325,9 +442,23 @@ async function startServer(config, environment, options = {}) {
         environment: {
             ...environment,
             processEnvs: (0, run_environment_1.runEnvironment)(config, environment.processEnvs),
-            hosted: { catalog: (0, server_config_1.getSecretCatalog)(config) },
+            // on a cluster a local task runs in a pod of a pool's tool image
+            hosted: { catalog: (0, server_config_1.getSecretCatalog)(config), localTasksInContainers: config.backend.type === 'kubernetes' },
+        },
+        policy: {
+            envs: config.runs.env.allow,
+            reserved: (0, server_config_1.getSourceAccounts)(config),
+            runtimes: config.runtimes,
+            backend: config.backend.type,
+            network: (0, work_network_1.parseWorkNetwork)(config.runs.network),
+            secretNetwork: (0, work_network_1.parseWorkNetwork)(config.runs.secretNetwork),
+            args: config.runs.args,
+            proxiedProviders: config.backend.type === 'kubernetes'
+                ? Object.entries(config.backend.providers)
+                    .filter(([, provider]) => provider.allow)
+                    .map(([name]) => name)
+                : [],
         },
-        policy: { envs: config.runs.env.allow, reserved: (0, server_config_1.getSourceAccounts)(config), runtimes: config.runtimes },
     };
     const storage = config.storage.directory ?? (0, path_1.join)((0, get_cache_directory_1.getHammerkitDirectory)(), 'server');
     const definitions = new definitions_1.DefinitionStore((0, path_1.join)(storage, 'definitions'), planning.environment, {
@@ -335,15 +466,59 @@ async function startServer(config, environment, options = {}) {
     });
     await definitions.load();
     const repos = new repo_access_1.RepoAccess(config, planning.environment, options.repos);
-    const executor = options.executor ??
-        new executor_1.HostExecutor({
-            definitions,
-            planning,
+    const sandboxRuntimes = (0, server_config_1.getSandboxRuntimes)(config);
+    const sandboxLimits = {
+        count: config.sandboxes.limits.count,
+        bytes: (0, units_1.parseSize)(config.sandboxes.limits.bytes),
+        total: (0, units_1.parseSize)(config.sandboxes.total),
+    };
+    const sandboxes = {
+        registry: new sandboxes_1.SandboxRegistry({
+            // on a cluster a claim per sandbox in the caller's namespace, else a directory
+            storage: config.backend.type === 'kubernetes'
+                ? new kubernetes_sandbox_storage_1.KubernetesSandboxStorage({ ...config, backend: config.backend }, sandboxLimits, planning.environment.processEnvs, (0, path_1.join)(storage, 'sandboxes', 'staging'))
+                : new sandbox_storage_1.HostSandboxStorage((0, path_1.join)(storage, 'sandboxes', 'files'), planning.environment.processEnvs, 
+                // what containers of runs leave behind is given back and removed with a container
+                sandboxRuntimes.includes('docker')
+                    ? new sandbox_docker_1.DockerSandboxContainers(planning.environment.processEnvs.DOCKER_HOST)
+                    : undefined),
+            records: (0, path_1.join)(storage, 'sandboxes', 'records'),
+            limits: sandboxLimits,
             repos,
-            directory: (0, path_1.join)(storage, 'runs'),
-            cache: (0, path_1.join)(storage, 'cache'),
-            worker: options.worker,
-        });
+            log,
+        }),
+        // a sandbox holds code nobody reviewed: only the variables of `sandboxes.env`
+        policy: {
+            ...planning.policy,
+            envs: config.sandboxes.env.allow,
+            envsFrom: 'sandboxes.env.allow',
+            runtimes: sandboxRuntimes,
+        },
+    };
+    if (sandboxRuntimes.length === 0 && config.entitlements.some((entitlement) => entitlement.sandboxes?.length)) {
+        log('warning: entitlements keep sandboxes, but this server runs only local tasks, which it runs on no sandbox; ' +
+            'runs on sandboxes are refused until sandboxes.runtimes names a runtime');
+    }
+    // on a cluster that lists the claims of sandboxes in the namespaces of callers, which a
+    // server without sandboxes need not be allowed to
+    if (config.backend.type === 'host' || config.entitlements.some((entitlement) => entitlement.sandboxes?.length)) {
+        await sandboxes.registry.load();
+    }
+    const executorOptions = {
+        definitions,
+        planning,
+        repos,
+        directory: (0, path_1.join)(storage, 'runs'),
+        cache: (0, path_1.join)(storage, 'cache'),
+        worker: options.worker,
+        sandboxes: { ...sandboxes, network: config.sandboxes.network },
+        log,
+    };
+    const backend = config.backend;
+    const executor = options.executor ??
+        (backend.type === 'kubernetes'
+            ? new kubernetes_backend_1.KubernetesExecutor({ ...config, backend }, environment.processEnvs, executorOptions)
+            : new executor_1.HostExecutor(executorOptions));
     const sources = new sources_1.SourceStore((0, path_1.join)(storage, 'sources'));
     const registry = new runs_1.RunRegistry({
         executor,
@@ -358,13 +533,17 @@ async function startServer(config, environment, options = {}) {
         log,
     });
     await registry.restore();
+    sandboxes.registry.useRuns({
+        holder: (id) => registry.holder(id),
+        stop: (id) => registry.stopSandbox(id, 'the sandbox was deleted'),
+    });
     const proposals = new proposals_1.ProposalRegistry({
         maxWaiting: config.approvals.maxWaiting,
         timeout: (0, units_1.parseDuration)(config.approvals.timeout),
         cooldown: (0, units_1.parseDuration)(config.approvals.cooldown),
     });
     const listener = (req, res) => {
-        handle(config, registry, definitions, proposals, sources, planning, repos, verifier, log, req, res).catch((e) => {
+        handle(config, registry, definitions, proposals, sources, sandboxes, planning, repos, verifier, log, req, res).catch((e) => {
             if (e instanceof http_2.HttpError) {
                 (0, http_2.send)(res, e.status, { error: e.message });
                 return;

package/dist/utils/abort-on-signals.js

@@ -1,17 +1,57 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.abortOnSignals = exports.ABORT_SIGNALS = void 0;
+exports.takeOverSignal = exports.abortOnSignals = exports.ABORT_SIGNALS = void 0;
 // Ctrl-C (SIGINT), a CI job being cancelled or a supervisor stopping hammerkit
 // (SIGTERM) and a closed terminal (SIGHUP) all stop the run the same way: abort,
 // so services are removed and local tasks' process groups are killed. Without a
 // handler Node exits on SIGTERM/SIGHUP at once and leaves both behind.
 exports.ABORT_SIGNALS = ['SIGINT', 'SIGTERM', 'SIGHUP'];
-function abortOnSignals(source, abortCtrl) {
-    for (const signal of exports.ABORT_SIGNALS) {
-        source.on(signal, () => {
-            abortCtrl.abort();
-        });
+// signals a running command gives a meaning of its own (the server reloads its
+// entitlements on SIGHUP), per source and counted by how many hold them: they don't
+// abort the run
+const takenOver = new WeakMap();
+function heldOn(source) {
+    let held = takenOver.get(source);
+    if (!held) {
+        held = new Map();
+        takenOver.set(source, held);
     }
+    return held;
+}
+/**
+ * Stops the run on the abort signals, all but those a command took over with
+ * `takeOverSignal`. Returns what removes the listeners again.
+ */
+function abortOnSignals(source, abortCtrl) {
+    const listeners = exports.ABORT_SIGNALS.map((signal) => {
+        const listener = () => {
+            if (!takenOver.get(source)?.get(signal)) {
+                abortCtrl.abort();
+            }
+        };
+        source.on(signal, listener);
+        return { signal, listener };
+    });
+    return () => listeners.forEach(({ signal, listener }) => source.off(signal, listener));
 }
 exports.abortOnSignals = abortOnSignals;
+/**
+ * Calls `handler` on `signal` instead of stopping the run, until the returned function
+ * gives the signal back.
+ */
+function takeOverSignal(source, signal, handler) {
+    const held = heldOn(source);
+    held.set(signal, (held.get(signal) ?? 0) + 1);
+    source.on(signal, handler);
+    let released = false;
+    return () => {
+        if (released) {
+            return;
+        }
+        released = true;
+        source.off(signal, handler);
+        held.set(signal, (held.get(signal) ?? 1) - 1);
+    };
+}
+exports.takeOverSignal = takeOverSignal;
 //# sourceMappingURL=abort-on-signals.js.map

package/dist/utils/run-id.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getRunId = void 0;
+const crypto_1 = require("crypto");
+const runId = (0, crypto_1.randomBytes)(4).toString('hex');
+// Tells this process's run apart from a concurrent one of the same items, on
+// this machine or another one using the same daemon or cluster.
+function getRunId() {
+    return runId;
+}
+exports.getRunId = getRunId;
+//# sourceMappingURL=run-id.js.map

package/dist/utils/tar.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.packArchive = void 0;
+const tar_1 = require("tar");
+function packArchive(options, files) {
+    return (0, tar_1.create)({ ...options, jobs: 1, linkCache: new ExactLinkCache() }, files);
+}
+exports.packArchive = packArchive;
+// node-tar packs a file with more than one link as a link to the first file it packed with
+// the same `dev:ino`. On Windows a file id has 64 bits, and Node gives it as a number, so
+// ids above 2^53 are rounded and files of two link groups can get the same one. Packed as
+// a link, a file would be restored with the other file's content. This cache leaves out the
+// ids that may be rounded, so those files are packed in full.
+class ExactLinkCache extends Map {
+    get(key) {
+        return isExact(key) ? super.get(key) : undefined;
+    }
+    set(key, path) {
+        return isExact(key) ? super.set(key, path) : this;
+    }
+}
+function isExact(key) {
+    return key.split(':').every((part) => Number.isSafeInteger(Number(part)));
+}
+//# sourceMappingURL=tar.js.map

package/harness/opencode.ts

@@ -0,0 +1,11 @@
+// The hammerkit plugin for opencode 2, and for opencode 1 by its `server`, re-exported by a plugin
+// file of the project: `export { default } from 'hammerkit/harness/opencode'`, see
+// https://hammerkit.dev/docs/remote-compute/agents
+import { hammerkitOpencodeEntry } from '../dist/harness/opencode'
+
+const plugin = hammerkitOpencodeEntry((specifier) => import(specifier))
+
+export default plugin
+
+// the name plugin files of opencode 1 re-exported, the same plugin so opencode 1 loads it once
+export const HammerkitPlugin = plugin

package/harness/pi.ts

@@ -0,0 +1,7 @@
+// The hammerkit extension for pi: `pi install npm:hammerkit`. pi loads this file with its
+// own module, whose tools hammerkit gives a sandbox as their backend, see
+// https://hammerkit.dev/docs/remote-compute/agents
+import * as pi from '@earendil-works/pi-coding-agent'
+import { hammerkitPiExtension } from '../dist/harness/pi'
+
+export default hammerkitPiExtension(pi)

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "hammerkit",
   "description": "Containerized build tool with incremental caching that runs the same build file locally, in Docker and on Kubernetes.",
-  "version": "1.26.0",
+  "version": "1.27.0-next.10",
   "keywords": [
     "build",
     "build-tool",
@@ -19,8 +19,14 @@
     "!dist/**/*.spec.*",
     "!dist/testing",
     "!dist/**/*.map",
-    "build.schema.json"
+    "build.schema.json",
+    "harness"
   ],
+  "pi": {
+    "extensions": [
+      "./harness/pi.ts"
+    ]
+  },
   "bugs": {
     "url": "https://github.com/no0dles/hammerkit/issues"
   },