hammerkit 1.27.0-next.1 → 1.27.0-next.11

package/build.schema.json

@@ -289,6 +289,9 @@
                     ],
                     "description": "network the task or service reaches besides its needs: open (default), none or { allow: [hosts or host:port] }"
                   },
+                  "args": {
+                    "type": "boolean"
+                  },
                   "runner": {
                     "type": "string",
                     "minLength": 1
@@ -370,6 +373,9 @@
                   "network": {
                     "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/network"
                   },
+                  "args": {
+                    "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/args"
+                  },
                   "runner": {
                     "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/runner"
                   },
@@ -511,6 +517,9 @@
                   "network": {
                     "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/network",
                     "description": "network the task or service reaches besides its needs: open (default), none or { allow: [hosts or host:port] }"
+                  },
+                  "args": {
+                    "type": "boolean"
                   }
                 },
                 "required": [

package/dist/cache/backends/registry-cache-backend.js

@@ -5,6 +5,7 @@ const crypto_1 = require("crypto");
 const os_1 = require("os");
 const path_1 = require("path");
 const tar_1 = require("tar");
+const tar_2 = require("../../utils/tar");
 const registry_reference_1 = require("./registry/registry-reference");
 const registry_client_1 = require("./registry/registry-client");
 const MAX_TAG_LENGTH = 128;
@@ -74,8 +75,7 @@ function createRegistryCacheBackend(spec) {
                 const layerFile = (0, path_1.join)(dir, 'layer.tar');
                 const files = (await environment.file.listFiles(from)).sort();
                 // portable + mtime-free so identical entries produce identical digests
-                // `noMtime` is supported by tar 6 but missing from its type definitions
-                await (0, tar_1.create)({ file: layerFile, cwd: from, portable: true, noMtime: true }, files);
+                await (0, tar_2.packArchive)({ file: layerFile, cwd: from, portable: true, noMtime: true }, files);
                 const layer = await (0, registry_client_1.digestFile)(layerFile);
                 const config = Buffer.from(JSON.stringify({
                     architecture: 'amd64',

package/dist/executer/event-cache.js

@@ -8,6 +8,8 @@ const execute_docker_1 = require("./execute-docker");
 const plan_work_tasks_1 = require("../planner/utils/plan-work-tasks");
 const get_cache_directory_1 = require("../optimizer/get-cache-directory");
 const path_1 = require("path");
+const crypto_1 = require("crypto");
+const claim_layout_1 = require("../kubernetes/claim-layout");
 const move_files_1 = require("../file/move-files");
 const work_instance_id_1 = require("../planner/work-instance-id");
 async function restoreCache(environment, path, workTree) {
@@ -43,8 +45,24 @@ function* getArchivePaths(task, path) {
         }
     }
     else {
-        for (const generate of task.generates.filter((g) => !g.inherited)) {
-            const generateId = (0, path_1.relative)(task.cwd, generate.path).split(path_1.sep).join('-');
+        // `a-b` and `a/b` flatten alike: of those, the least deep (then the first in sorted
+        // order) keeps the name, the others' names carry a hash of their relative path, so a
+        // store and a restore in another directory or order find the same archive
+        const generates = task.generates
+            .filter((g) => !g.inherited)
+            .map((generate) => ({ generate, rel: (0, path_1.relative)(task.cwd, generate.path).split(path_1.sep).join(path_1.posix.sep) }));
+        const holders = new Map();
+        for (const { rel } of [...generates].sort((a, b) => (0, claim_layout_1.byDepth)(a.rel, b.rel))) {
+            const id = rel.split(path_1.posix.sep).join('-');
+            if (!holders.has(id)) {
+                holders.set(id, rel);
+            }
+        }
+        for (const { generate, rel } of generates) {
+            let generateId = rel.split(path_1.posix.sep).join('-');
+            if (holders.get(generateId) !== rel) {
+                generateId += '-' + (0, crypto_1.createHash)('sha256').update(rel).digest('hex').slice(0, 12);
+            }
             yield {
                 filename: (0, path_1.join)(path, generateId + '-generates.tgz'),
                 path: generate.path,

package/dist/harness/sandbox-client.js

@@ -1,12 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.quotePosix = exports.fetchFailure = exports.toSandboxPath = exports.checkSandboxPath = exports.exitCodeOf = exports.oneAtATime = exports.SandboxClient = exports.SandboxClientError = void 0;
+exports.quotePosix = exports.fetchFailure = exports.toSandboxPath = exports.checkSandboxPath = exports.exitCodeOf = exports.followRun = exports.submitRun = exports.FINAL_RUN_STATES = exports.oneAtATime = exports.SandboxClient = exports.SandboxClientError = void 0;
 const path_1 = require("path");
 const token_source_1 = require("../remote/token-source");
 // a write carries up to 32 MiB
 const TIMEOUT_MS = 60000;
 // a run is asked for this long at a time, the log is read in between
 const POLL_WAIT = '1s';
+// a cancelled run waits this long for the server to take the cancel, before it gives up
+const CANCEL_WAIT_MS = 10000;
 class SandboxClientError extends Error {
     constructor(message, status) {
         super(message);
@@ -115,72 +117,26 @@ class SandboxClient {
         if (options.timeoutSeconds) {
             runOptions.timeout = `${Math.max(1, Math.ceil(options.timeoutSeconds))}s`;
         }
-        const submitted = await json(await call(this.connection, 'POST', '/v1/runs', {
-            body: {
-                definition: this.build.hash,
-                tasks: [task],
-                source: { type: 'sandbox', id: this.id },
-                options: runOptions,
-            },
-        }));
-        const path = `/v1/runs/${encodeURIComponent(submitted.id)}`;
-        const cancel = () => {
-            call(this.connection, 'POST', `${path}/cancel`).catch(() => undefined);
-        };
-        options.signal?.addEventListener('abort', cancel, { once: true });
-        const lines = [];
-        let from = 1;
-        let truncated = false;
-        const readLog = async () => {
-            for (;;) {
-                const page = await json(await call(this.connection, 'GET', `${path}/logs`, { query: { task, from, limit: 1000 } }));
-                truncated = page.truncated;
-                for (const line of page.lines) {
-                    lines.push(line.text);
-                    options.onLine?.(line.text);
-                    from = line.line + 1;
-                }
-                if (!page.next) {
-                    return;
-                }
-            }
+        const submitted = await submitRun(this.connection, {
+            definition: this.build.hash,
+            tasks: [task],
+            source: { type: 'sandbox', id: this.id },
+            options: runOptions,
+        });
+        const followed = await followRun(this.connection, submitted, {
+            task,
+            signal: options.signal,
+            onLine: options.onLine ? (line) => options.onLine?.(line.text) : undefined,
+            onWaiting: options.onWaiting,
+        });
+        const result = followed.run.results?.[task];
+        return {
+            run: followed.run,
+            result,
+            output: followed.lines.map((line) => line.text).join('\n'),
+            truncated: followed.truncated,
+            exitCode: exitCodeOf(result),
         };
-        try {
-            let run = submitted;
-            let waitingSaid = false;
-            for (;;) {
-                if (options.signal?.aborted) {
-                    throw new SandboxClientError('the run was cancelled');
-                }
-                if (run.state === 'awaiting-approval' && !waitingSaid) {
-                    waitingSaid = true;
-                    options.onWaiting?.(run);
-                }
-                await readLog();
-                if (['succeeded', 'failed', 'cancelled', 'rejected'].includes(run.state)) {
-                    break;
-                }
-                run = await json(await call(this.connection, 'GET', path, { query: { wait: POLL_WAIT } }));
-            }
-            const result = run.results?.[task];
-            if (truncated && result) {
-                // the end of a long log is kept in the result
-                for (const line of ['… the server cut the log off at its limit, the last lines were:', ...result.lastLog]) {
-                    lines.push(line);
-                    options.onLine?.(line);
-                }
-            }
-            return {
-                run,
-                result,
-                output: lines.join('\n'),
-                truncated,
-                exitCode: exitCodeOf(result),
-            };
-        }
-        finally {
-            options.signal?.removeEventListener('abort', cancel);
-        }
     }
     /**
      * A shell command on the sandbox: the shell task of the build file with the command as
@@ -245,6 +201,88 @@ function oneAtATime() {
     };
 }
 exports.oneAtATime = oneAtATime;
+// a run that is over, its state does not change any more
+exports.FINAL_RUN_STATES = ['succeeded', 'failed', 'cancelled', 'rejected'];
+// Submits a run, as `POST /v1/runs` takes it, and answers it as the server queued it or
+// holds it for an approval.
+async function submitRun(connection, request) {
+    return json(await call(connection, 'POST', '/v1/runs', { body: request }));
+}
+exports.submitRun = submitRun;
+/**
+ * Follows a run to its end: its log as it grows, and its state. A signal cancels the run
+ * on the server and fails the follow.
+ */
+async function followRun(connection, submitted, options = {}) {
+    const path = `/v1/runs/${encodeURIComponent(submitted.id)}`;
+    let cancelling;
+    const cancel = () => {
+        cancelling ?? (cancelling = call(connection, 'POST', `${path}/cancel`).catch(() => undefined));
+    };
+    options.signal?.addEventListener('abort', cancel, { once: true });
+    const lines = [];
+    let from = 1;
+    let truncated = false;
+    const add = (line) => {
+        lines.push(line);
+        options.onLine?.(line);
+    };
+    const readLog = async () => {
+        for (;;) {
+            const page = await json(await call(connection, 'GET', `${path}/logs`, { query: { task: options.task, from, limit: 1000 } }));
+            truncated = page.truncated;
+            for (const line of page.lines) {
+                add(line);
+                from = line.line + 1;
+            }
+            if (!page.next) {
+                return;
+            }
+        }
+    };
+    try {
+        let run = submitted;
+        let waitingSaid = false;
+        for (;;) {
+            if (options.signal?.aborted) {
+                // the process may exit after this, so the cancel has to reach the server first
+                cancel();
+                let timer;
+                await Promise.race([cancelling, new Promise((resolve) => (timer = setTimeout(resolve, CANCEL_WAIT_MS)))]);
+                clearTimeout(timer);
+                throw new SandboxClientError('the run was cancelled');
+            }
+            if (run.state === 'awaiting-approval' && !waitingSaid) {
+                waitingSaid = true;
+                options.onWaiting?.(run);
+            }
+            await readLog();
+            if (exports.FINAL_RUN_STATES.includes(run.state)) {
+                break;
+            }
+            run = await json(await call(connection, 'GET', path, { query: { wait: POLL_WAIT } }));
+        }
+        if (truncated) {
+            // the end of a long log is kept in the results
+            const tasks = options.task !== undefined ? [options.task] : Object.keys(run.results ?? {});
+            for (const task of tasks) {
+                const result = run.results?.[task];
+                if (!result) {
+                    continue;
+                }
+                const said = options.task !== undefined ? 'the last lines were' : `the last lines of ${task} were`;
+                for (const text of [`… the server cut the log off at its limit, ${said}:`, ...result.lastLog]) {
+                    add({ line: 0, task, stream: 'stdout', text });
+                }
+            }
+        }
+        return { run, lines, truncated };
+    }
+    finally {
+        options.signal?.removeEventListener('abort', cancel);
+    }
+}
+exports.followRun = followRun;
 function exitCodeOf(result) {
     if (!result) {
         return null;

package/dist/kubernetes/apply.js

@@ -36,28 +36,39 @@ exports.apply = apply;
  * of a policy).
  */
 async function replace(instance, spec) {
-    let current;
-    try {
-        current = await instance.objectApi.read(spec);
-    }
-    catch (e) {
-        if (statusCodeOf(e) !== 404) {
-            throw e;
+    for (let attempt = 1;; attempt++) {
+        let current;
+        try {
+            current = await instance.objectApi.read(spec);
+        }
+        catch (e) {
+            if (statusCodeOf(e) !== 404) {
+                throw e;
+            }
+            try {
+                return await instance.objectApi.create(spec);
+            }
+            catch (createError) {
+                if (statusCodeOf(createError) !== 409) {
+                    throw createError;
+                }
+                current = await instance.objectApi.read(spec);
+            }
         }
         try {
-            return await instance.objectApi.create(spec);
+            return await instance.objectApi.replace({
+                ...spec,
+                metadata: { ...spec.metadata, resourceVersion: current.metadata?.resourceVersion },
+            });
         }
-        catch (createError) {
-            if (statusCodeOf(createError) !== 409) {
-                throw createError;
+        catch (e) {
+            // replaced by someone else since it was read (the server sets up a caller's
+            // namespace for a run and for a sandbox at the same time): read it again
+            if (statusCodeOf(e) !== 409 || attempt >= 3) {
+                throw e;
             }
-            current = await instance.objectApi.read(spec);
         }
     }
-    return await instance.objectApi.replace({
-        ...spec,
-        metadata: { ...spec.metadata, resourceVersion: current.metadata?.resourceVersion },
-    });
 }
 exports.replace = replace;
 //# sourceMappingURL=apply.js.map

package/dist/kubernetes/claim-layout.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hasOutputsFlatteningAlike = exports.hasPathsEndingAlike = exports.byDepth = exports.getClaimSubPath = void 0;
+const crypto_1 = require("crypto");
+const path_1 = require("path");
+const portable_path_1 = require("../planner/utils/portable-path");
+// The paths a work item keeps in its claim. Its consumers mount its outputs by the same
+// paths, so they find the same folders.
+function getClaimPaths(work) {
+    const data = work.data;
+    const paths = [];
+    if ('mounts' in data) {
+        paths.push(...data.mounts.map((mount) => mount.containerPath));
+    }
+    if ('src' in data) {
+        paths.push(...data.src.filter((src) => !src.inherited).map((src) => src.absolutePath));
+    }
+    if ('generates' in data) {
+        paths.push(...data.generates.filter((generate) => !generate.inherited).map((generate) => generate.path));
+    }
+    if ('volumes' in data) {
+        paths.push(...data.volumes.filter((volume) => !volume.inherited).map((volume) => volume.containerPath));
+    }
+    return paths;
+}
+// Where `path` is in the claim of `work`, relative to its root. A path is named after its
+// last segment, so claims without two such paths are laid out as they always were (a
+// service's data among them). Of the paths with the same last segment, the least deep one
+// (then the first in sorted order) keeps the name, and the others also carry a hash of
+// their path. Both go by the path
+// relative to the project, as the task's id does, so a run in another checkout directory
+// (each run of a server has its own) or with its `generates` in another order finds the
+// same folders in a kept claim.
+function getClaimSubPath(work, path) {
+    const name = (0, path_1.basename)(path) || 'root';
+    const alike = getClaimPaths(work).filter((other) => other !== path && (0, path_1.basename)(other) === (0, path_1.basename)(path));
+    if (alike.length === 0) {
+        return name;
+    }
+    const own = (0, portable_path_1.portablePath)(work.data.projectRoot, path);
+    const first = [own, ...alike.map((other) => (0, portable_path_1.portablePath)(work.data.projectRoot, other))].sort(byDepth)[0];
+    if (first === own) {
+        return name;
+    }
+    return `${name}-${(0, crypto_1.createHash)('sha256').update(own).digest('hex').slice(0, 12)}`;
+}
+exports.getClaimSubPath = getClaimSubPath;
+function byDepth(a, b) {
+    return a.split('/').length - b.split('/').length || (a < b ? -1 : a > b ? 1 : 0);
+}
+exports.byDepth = byDepth;
+// Whether two different paths of the claim of `work` end alike. Before getClaimSubPath
+// named them apart, they shared one folder, and outputs made then are mixed.
+function hasPathsEndingAlike(work) {
+    const paths = new Set(getClaimPaths(work));
+    return new Set([...paths].map((path) => (0, path_1.basename)(path))).size < paths.size;
+}
+exports.hasPathsEndingAlike = hasPathsEndingAlike;
+// Whether two outputs of `work` flatten to the same name of a cache archive (`a-b` and
+// `a/b`, see getArchivePaths). Before they were named apart, one archive held both.
+function hasOutputsFlatteningAlike(work) {
+    const data = work.data;
+    if (!('generates' in data) || !('cwd' in data)) {
+        return false;
+    }
+    const paths = new Set(data.generates.filter((generate) => !generate.inherited).map((generate) => generate.path));
+    const names = new Set([...paths].map((path) => (0, path_1.relative)(data.cwd, path).split(path_1.sep).join('-')));
+    return names.size < paths.size;
+}
+exports.hasOutputsFlatteningAlike = hasOutputsFlatteningAlike;
+//# sourceMappingURL=claim-layout.js.map

package/dist/kubernetes/ensure-http-route.js

@@ -36,7 +36,7 @@ async function ensureHttpRoute(instance, env, route, service) {
                     ],
                     backendRefs: [
                         {
-                            name: (0, resources_1.getResourceName)(service),
+                            name: (0, resources_1.getResourceName)(service, env),
                             port: route.servicePort ?? service.data.ports[0].containerPort,
                         },
                     ],

package/dist/kubernetes/ensure-kubernetes-deployment-exists.js

@@ -21,7 +21,7 @@ async function ensureKubernetesDeploymentExists(instance, env, service, persiste
 // the needed services by name, and the proxy of a limited network
 network) {
     const envs = (0, replace_env_variables_1.getEnvironmentVariables)(service.data.envs);
-    const name = (0, resources_1.getResourceName)(service);
+    const name = (0, resources_1.getResourceName)(service, env);
     const healthcheckCommand = (0, work_service_1.getHealthcheckCommand)(service.data);
     const serviceCommand = (0, work_service_1.getServiceCommand)(service.data, { kubernetes: true });
     const probe = healthcheckCommand
@@ -47,25 +47,21 @@ network) {
                 'hammerkit.dev/version': (0, version_1.getVersion)(),
             },
             labels: {
-                'hammerkit.dev/id': service.id(),
+                ...(0, resources_1.getItemLabels)(service, env),
                 'hammerkit.dev/state': stateKey,
-                ...(0, job_placement_1.getRunLabels)(env),
                 [exports.DEFINITION_LABEL]: (0, service_definition_1.getServiceDefinitionHash)(service),
             },
         },
         spec: {
             selector: {
-                matchLabels: {
-                    'hammerkit.dev/id': service.id(),
-                },
+                matchLabels: (0, resources_1.getItemLabels)(service, env),
             },
             replicas: 1,
             template: {
                 metadata: {
                     labels: {
-                        'hammerkit.dev/id': service.id(),
+                        ...(0, resources_1.getItemLabels)(service, env),
                         'hammerkit.dev/state': stateKey,
-                        ...(0, job_placement_1.getRunLabels)(env),
                         ...workspace.labels,
                         ...(0, network_policy_1.getNetworkLabels)(env, service),
                     },
@@ -127,7 +123,7 @@ network) {
         return;
     }
     await (0, await_running_state_1.awaitDeployRunningState)(instance, env, name, {
-        podSelector: `hammerkit.dev/id=${service.id()}`,
+        podSelector: (0, resources_1.getItemSelector)(service, env),
         timeout: service.data.healthcheck?.timeout ?? null,
         timeoutMessage: service.data.healthcheck
             ? (0, work_healthcheck_1.getHealthcheckTimeoutMessage)(service.name, service.data.healthcheck)

package/dist/kubernetes/ensure-kubernetes-persistent-volume-claim-exists.js

@@ -65,7 +65,7 @@ async function ensureKubernetesPersistentVolumeClaimExists(instance, env, volume
             },
         },
     };
-    service.status.console('stdout', `ensure volume ${volume.name}`);
+    service.status.write('debug', `ensure volume ${volume.name}`);
     // Don't block on the PVC reaching "Bound". Storage classes with
     // volumeBindingMode WaitForFirstConsumer (docker-desktop's "standard",
     // k3d/k3s local-path, most cloud defaults) keep the claim Pending until a pod

package/dist/kubernetes/ensure-kubernetes-service-exists.js

@@ -4,11 +4,10 @@ exports.ensureKubernetesServiceExists = void 0;
 const apply_1 = require("./apply");
 const resources_1 = require("./resources");
 const version_1 = require("../version");
-const job_placement_1 = require("./job-placement");
 // A service without ports gets a headless Service: a ClusterIP one needs a port,
 // and its tasks reach every port of the pod, as on docker.
 async function ensureKubernetesServiceExists(instance, env, service) {
-    const name = (0, resources_1.getResourceName)(service);
+    const name = (0, resources_1.getResourceName)(service, env);
     const headless = service.data.ports.length === 0;
     const svc = {
         kind: 'Service',
@@ -19,17 +18,13 @@ async function ensureKubernetesServiceExists(instance, env, service) {
             annotations: {
                 'hammerkit.dev/version': (0, version_1.getVersion)(),
             },
-            labels: {
-                'hammerkit.dev/id': service.id(),
-                ...(0, job_placement_1.getRunLabels)(env),
-            },
+            labels: (0, resources_1.getItemLabels)(service, env),
         },
         spec: {
             type: 'ClusterIP',
             ...(headless ? { clusterIP: 'None' } : {}),
-            selector: {
-                'hammerkit.dev/id': service.id(),
-            },
+            // the pods of the service of this run, on a server where runs share the namespace
+            selector: (0, resources_1.getItemLabels)(service, env),
             ...(headless
                 ? {}
                 : {

package/dist/kubernetes/ensure-persistent-data.js

@@ -1,9 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ensurePersistentData = exports.clearClaim = exports.getPodForPersistence = void 0;
+exports.ensurePersistentData = exports.packSource = exports.clearClaim = exports.getPodForPersistence = void 0;
 const apply_1 = require("./apply");
 const path_1 = require("path");
-const tar_1 = require("tar");
+const tar_1 = require("../utils/tar");
 const resources_1 = require("./resources");
 const await_running_state_1 = require("./await-running-state");
 const sleep_1 = require("../utils/sleep");
@@ -67,17 +67,14 @@ async function getPodForPersistence(instance, env, service, persistence, type, f
     for (const volume of persistence.volumes) {
         await (0, ensure_kubernetes_persistent_volume_claim_exists_1.ensureKubernetesPersistentVolumeClaimExists)(instance, env, volume, service, persistence.sizes[volume.name], persistence.kept.includes(volume.name));
     }
-    const name = (0, resources_1.getResourceName)(service, type === 'write' ? '-upload' : '-download');
+    const name = (0, resources_1.getResourceName)(service, env, type === 'write' ? '-upload' : '-download');
     const podSpec = {
         kind: 'Pod',
         apiVersion: 'v1',
         metadata: {
             namespace: env.namespace,
             name,
-            labels: {
-                'hammerkit.dev/id': service.id(),
-                ...(0, job_placement_1.getRunLabels)(env),
-            },
+            labels: (0, resources_1.getItemLabels)(service, env),
             annotations: {
                 'hammerkit.dev/version': (0, version_1.getVersion)(),
             },
@@ -104,18 +101,18 @@ async function getPodForPersistence(instance, env, service, persistence, type, f
             volumes: persistence.volumes,
         },
     };
-    service.status.console('stdout', `create pod ${name}`);
+    service.status.write('debug', `create pod ${name}`);
     await removeStalePod(instance, env.namespace, name);
     const pod = await (0, apply_1.apply)(instance, podSpec);
     if (pod.status?.phase !== 'Running') {
-        service.status.console('stdout', `await running state ${name}`);
+        service.status.write('debug', `await running state ${name}`);
         await (0, await_running_state_1.awaitRunningState)(instance, env, name, 'Running');
     }
     try {
         await fn(name);
     }
     finally {
-        service.status.console('stdout', `delete pod ${name}`);
+        service.status.write('debug', `delete pod ${name}`);
         await instance.coreApi.deleteNamespacedPod({ name, namespace: env.namespace });
     }
 }
@@ -124,7 +121,7 @@ exports.getPodForPersistence = getPodForPersistence;
 // the task runs on it or outputs are restored into it, so it holds what a new one would
 async function clearClaim(instance, env, work, pod) {
     const targetPath = `/dev/hammerkit/${work.id()}`;
-    work.status.console('stdout', `clear what an earlier run left in ${targetPath}`);
+    work.status.write('info', `clear what an earlier run left in ${targetPath}`);
     let failure = null;
     const res = await instance.exec.exec(env.namespace, pod, 'volume', ['find', targetPath, '-mindepth', '1', '-maxdepth', '1', '-exec', 'rm', '-rf', '{}', '+'], process.stdout, process.stderr, null, false, (status) => {
         if (status.status !== 'Success') {
@@ -137,6 +134,25 @@ async function clearClaim(instance, env, work, pod) {
     });
 }
 exports.clearClaim = clearClaim;
+// The archive that uploads a source into the claim: its file or directory, at its place in
+// the claim (see getClaimSubPath) instead of under its own name
+function packSource(source) {
+    const fileItem = (0, path_1.basename)(source.localPath);
+    return stream_1.Readable.from((0, tar_1.packArchive)({
+        cwd: (0, path_1.dirname)(source.localPath),
+        filter(path) {
+            return source.matcher(path, source.localPath);
+        },
+        onWriteEntry(entry) {
+            entry.path = source.subPath + entry.path.slice(fileItem.length);
+            // the second of two hard-linked files links to the first by its path in the archive
+            if (entry.type === 'Link' && entry.linkpath?.startsWith(fileItem)) {
+                entry.linkpath = source.subPath + entry.linkpath.slice(fileItem.length);
+            }
+        },
+    }, [fileItem]));
+}
+exports.packSource = packSource;
 async function ensurePersistentData(instance, env, environment, service, persistence, 
 // the kept claim of the work holds what an earlier run left, which goes first
 options = {}) {
@@ -153,7 +169,7 @@ options = {}) {
     if (persistence.sources.length === 0 && !options.reset) {
         return;
     }
-    service.status.console('stdout', 'start upload container');
+    service.status.write('debug', 'start upload container');
     await getPodForPersistence(instance, env, service, persistence, 'write', async (name) => {
         if (options.reset) {
             await clearClaim(instance, env, service, name);
@@ -163,14 +179,8 @@ options = {}) {
             if (!(await environment.file.exists(source.localPath))) {
                 continue;
             }
-            const fileItem = (0, path_1.basename)(source.localPath);
-            const data = stream_1.Readable.from((0, tar_1.create)({
-                cwd: (0, path_1.dirname)(source.localPath),
-                filter(path) {
-                    return source.matcher(path, source.localPath);
-                },
-            }, [fileItem]));
-            service.status.console('stdout', `upload ${source.localPath}`);
+            const data = packSource(source);
+            service.status.write('info', `upload ${source.localPath}`);
             const targetPath = `/dev/hammerkit/${service.id()}`;
             const res = await instance.exec.exec(env.namespace, name, 'volume', ['tar', 'xf', '-', '-C', targetPath], process.stdout, process.stderr, data, false, (status) => {
                 service.status.write('debug', `upload ${source.localPath} to ${name}: ${status}`);

package/dist/kubernetes/get-service-ip.js

@@ -5,7 +5,7 @@ const resources_1 = require("./resources");
 // The address a task reaches the service on: its clusterIP, or for a headless
 // Service (a service without ports) the address of its ready pod.
 async function getServiceIp(instance, env, workService) {
-    const name = (0, resources_1.getResourceName)(workService);
+    const name = (0, resources_1.getResourceName)(workService, env);
     const svc = await instance.coreApi.readNamespacedService({ name, namespace: env.namespace });
     const clusterIP = svc.spec?.clusterIP ?? null;
     if (clusterIP !== 'None') {
@@ -13,7 +13,7 @@ async function getServiceIp(instance, env, workService) {
     }
     const pods = await instance.coreApi.listNamespacedPod({
         namespace: env.namespace,
-        labelSelector: `hammerkit.dev/id=${workService.id()}`,
+        labelSelector: (0, resources_1.getItemSelector)(workService, env),
     });
     const ready = pods.items.find((pod) => !pod.metadata?.deletionTimestamp &&
         pod.status?.podIP &&