hammerkit 1.27.0-next.1 → 1.27.0-next.3

package/dist/harness/sandbox-client.js

@@ -1,12 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.quotePosix = exports.fetchFailure = exports.toSandboxPath = exports.checkSandboxPath = exports.exitCodeOf = exports.oneAtATime = exports.SandboxClient = exports.SandboxClientError = void 0;
+exports.quotePosix = exports.fetchFailure = exports.toSandboxPath = exports.checkSandboxPath = exports.exitCodeOf = exports.followRun = exports.submitRun = exports.FINAL_RUN_STATES = exports.oneAtATime = exports.SandboxClient = exports.SandboxClientError = void 0;
 const path_1 = require("path");
 const token_source_1 = require("../remote/token-source");
 // a write carries up to 32 MiB
 const TIMEOUT_MS = 60000;
 // a run is asked for this long at a time, the log is read in between
 const POLL_WAIT = '1s';
+// a cancelled run waits this long for the server to take the cancel, before it gives up
+const CANCEL_WAIT_MS = 10000;
 class SandboxClientError extends Error {
     constructor(message, status) {
         super(message);
@@ -115,72 +117,26 @@ class SandboxClient {
         if (options.timeoutSeconds) {
             runOptions.timeout = `${Math.max(1, Math.ceil(options.timeoutSeconds))}s`;
         }
-        const submitted = await json(await call(this.connection, 'POST', '/v1/runs', {
-            body: {
-                definition: this.build.hash,
-                tasks: [task],
-                source: { type: 'sandbox', id: this.id },
-                options: runOptions,
-            },
-        }));
-        const path = `/v1/runs/${encodeURIComponent(submitted.id)}`;
-        const cancel = () => {
-            call(this.connection, 'POST', `${path}/cancel`).catch(() => undefined);
-        };
-        options.signal?.addEventListener('abort', cancel, { once: true });
-        const lines = [];
-        let from = 1;
-        let truncated = false;
-        const readLog = async () => {
-            for (;;) {
-                const page = await json(await call(this.connection, 'GET', `${path}/logs`, { query: { task, from, limit: 1000 } }));
-                truncated = page.truncated;
-                for (const line of page.lines) {
-                    lines.push(line.text);
-                    options.onLine?.(line.text);
-                    from = line.line + 1;
-                }
-                if (!page.next) {
-                    return;
-                }
-            }
+        const submitted = await submitRun(this.connection, {
+            definition: this.build.hash,
+            tasks: [task],
+            source: { type: 'sandbox', id: this.id },
+            options: runOptions,
+        });
+        const followed = await followRun(this.connection, submitted, {
+            task,
+            signal: options.signal,
+            onLine: options.onLine ? (line) => options.onLine?.(line.text) : undefined,
+            onWaiting: options.onWaiting,
+        });
+        const result = followed.run.results?.[task];
+        return {
+            run: followed.run,
+            result,
+            output: followed.lines.map((line) => line.text).join('\n'),
+            truncated: followed.truncated,
+            exitCode: exitCodeOf(result),
         };
-        try {
-            let run = submitted;
-            let waitingSaid = false;
-            for (;;) {
-                if (options.signal?.aborted) {
-                    throw new SandboxClientError('the run was cancelled');
-                }
-                if (run.state === 'awaiting-approval' && !waitingSaid) {
-                    waitingSaid = true;
-                    options.onWaiting?.(run);
-                }
-                await readLog();
-                if (['succeeded', 'failed', 'cancelled', 'rejected'].includes(run.state)) {
-                    break;
-                }
-                run = await json(await call(this.connection, 'GET', path, { query: { wait: POLL_WAIT } }));
-            }
-            const result = run.results?.[task];
-            if (truncated && result) {
-                // the end of a long log is kept in the result
-                for (const line of ['… the server cut the log off at its limit, the last lines were:', ...result.lastLog]) {
-                    lines.push(line);
-                    options.onLine?.(line);
-                }
-            }
-            return {
-                run,
-                result,
-                output: lines.join('\n'),
-                truncated,
-                exitCode: exitCodeOf(result),
-            };
-        }
-        finally {
-            options.signal?.removeEventListener('abort', cancel);
-        }
     }
     /**
      * A shell command on the sandbox: the shell task of the build file with the command as
@@ -245,6 +201,88 @@ function oneAtATime() {
     };
 }
 exports.oneAtATime = oneAtATime;
+// a run that is over, its state does not change any more
+exports.FINAL_RUN_STATES = ['succeeded', 'failed', 'cancelled', 'rejected'];
+// Submits a run, as `POST /v1/runs` takes it, and answers it as the server queued it or
+// holds it for an approval.
+async function submitRun(connection, request) {
+    return json(await call(connection, 'POST', '/v1/runs', { body: request }));
+}
+exports.submitRun = submitRun;
+/**
+ * Follows a run to its end: its log as it grows, and its state. A signal cancels the run
+ * on the server and fails the follow.
+ */
+async function followRun(connection, submitted, options = {}) {
+    const path = `/v1/runs/${encodeURIComponent(submitted.id)}`;
+    let cancelling;
+    const cancel = () => {
+        cancelling ?? (cancelling = call(connection, 'POST', `${path}/cancel`).catch(() => undefined));
+    };
+    options.signal?.addEventListener('abort', cancel, { once: true });
+    const lines = [];
+    let from = 1;
+    let truncated = false;
+    const add = (line) => {
+        lines.push(line);
+        options.onLine?.(line);
+    };
+    const readLog = async () => {
+        for (;;) {
+            const page = await json(await call(connection, 'GET', `${path}/logs`, { query: { task: options.task, from, limit: 1000 } }));
+            truncated = page.truncated;
+            for (const line of page.lines) {
+                add(line);
+                from = line.line + 1;
+            }
+            if (!page.next) {
+                return;
+            }
+        }
+    };
+    try {
+        let run = submitted;
+        let waitingSaid = false;
+        for (;;) {
+            if (options.signal?.aborted) {
+                // the process may exit after this, so the cancel has to reach the server first
+                cancel();
+                let timer;
+                await Promise.race([cancelling, new Promise((resolve) => (timer = setTimeout(resolve, CANCEL_WAIT_MS)))]);
+                clearTimeout(timer);
+                throw new SandboxClientError('the run was cancelled');
+            }
+            if (run.state === 'awaiting-approval' && !waitingSaid) {
+                waitingSaid = true;
+                options.onWaiting?.(run);
+            }
+            await readLog();
+            if (exports.FINAL_RUN_STATES.includes(run.state)) {
+                break;
+            }
+            run = await json(await call(connection, 'GET', path, { query: { wait: POLL_WAIT } }));
+        }
+        if (truncated) {
+            // the end of a long log is kept in the results
+            const tasks = options.task !== undefined ? [options.task] : Object.keys(run.results ?? {});
+            for (const task of tasks) {
+                const result = run.results?.[task];
+                if (!result) {
+                    continue;
+                }
+                const said = options.task !== undefined ? 'the last lines were' : `the last lines of ${task} were`;
+                for (const text of [`… the server cut the log off at its limit, ${said}:`, ...result.lastLog]) {
+                    add({ line: 0, task, stream: 'stdout', text });
+                }
+            }
+        }
+        return { run, lines, truncated };
+    }
+    finally {
+        options.signal?.removeEventListener('abort', cancel);
+    }
+}
+exports.followRun = followRun;
 function exitCodeOf(result) {
     if (!result) {
         return null;

package/dist/log.js

@@ -216,7 +216,7 @@ function writeWorkItemLogToConsole(env, log, maxNodeNameLength) {
 exports.writeWorkItemLogToConsole = writeWorkItemLogToConsole;
 function formatDate(date) {
     return colors_1.default.grey(`[${date.getFullYear()}-${(date.getMonth() + 1).toString().padStart(2, '0')}-${date
-        .getDay()
+        .getDate()
         .toString()
         .padStart(2, '0')} ${date.getHours().toString().padStart(2, '0')}:${date
         .getMinutes()

package/dist/program.js

@@ -159,11 +159,14 @@ async function getProgram(environment, argv) {
     if (fileIndex >= 0) {
         args.splice(fileIndex, 2);
     }
-    (0, remote_commands_1.registerRemoteCommands)(program, environment, fileName);
+    (0, remote_commands_1.registerRemoteCommands)(program, environment, fileName, passthrough);
     program.hook('preAction', (_, actionCommand) => {
-        const takesArguments = actionCommand.parent === program && ['run', 'up'].includes(actionCommand.name());
+        const takesArguments = (actionCommand.parent === program && ['run', 'up'].includes(actionCommand.name())) ||
+            (actionCommand.parent?.name() === 'remote' && actionCommand.name() === 'run');
         if (passthrough.length > 0 && !takesArguments) {
-            program.error(`${actionCommand.name()} takes no arguments after --, only run and up do`, { exitCode: 1 });
+            program.error(`${actionCommand.name()} takes no arguments after --, only run, up and remote run do`, {
+                exitCode: 1,
+            });
         }
     });
     if (await environment.file.exists(fileName)) {
@@ -780,7 +783,8 @@ tasks:
     program.option('--file', 'set build file', '.hammerkit.yaml');
     program.option('--set <NAME=value>', 'value for $NAME / ${NAME} references, ahead of the shell and .env (repeatable)');
     program.configureOutput({
-        writeOut: (str) => environment.console.info(str),
+        // --version and --help as they are, so `VERSION=$(hammerkit --version)` works
+        writeOut: (str) => environment.stdout.write(str),
         writeErr: (str) => {
             environment.console.error(str);
         },

package/dist/remote/annotations.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.applyAnnotations = exports.collectAnnotations = exports.remoteRepo = void 0;
+exports.applyAnnotations = exports.collectAnnotations = exports.readCheckout = exports.remoteRepo = void 0;
 const child_process_1 = require("child_process");
 const os_1 = require("os");
 const path_1 = require("path");
@@ -36,6 +36,18 @@ function remoteRepo(url) {
     }
 }
 exports.remoteRepo = remoteRepo;
+// The checkout a directory is in: the repository of its `origin`, the branch it is on and
+// its commit, what can be found of them.
+async function readCheckout(cwd) {
+    if ((await git(cwd, 'rev-parse', '--is-inside-work-tree')) !== 'true') {
+        return {};
+    }
+    const remote = await git(cwd, 'remote', 'get-url', 'origin');
+    // a detached HEAD is on no branch
+    const branch = await git(cwd, 'symbolic-ref', '--quiet', '--short', 'HEAD');
+    return { repo: remote ? remoteRepo(remote) : undefined, branch, commit: await git(cwd, 'rev-parse', 'HEAD') };
+}
+exports.readCheckout = readCheckout;
 // Where a build file is published from: its path in its repository (or on this
 // machine, outside of one), the repository and commit, this machine and its user.
 // `files` are the paths of the bundle, relative to the build file's directory: when

package/dist/remote/remote-commands.js

@@ -16,7 +16,9 @@ const remote_work_commands_1 = require("./remote-work-commands");
 const mcp_command_1 = require("../harness/mcp-command");
 // Host-level commands: they only touch the machine's config file, so they work
 // with or without a build file in the working directory.
-function registerRemoteCommands(program, environment, buildFile) {
+function registerRemoteCommands(program, environment, buildFile, 
+// what follows `--`, the arguments of `remote run`
+passthrough = []) {
     const remote = program.command('remote').description('register the servers runs can be sent to');
     const guarded = (failure, fn) => {
         return async (...args) => {
@@ -154,7 +156,14 @@ function registerRemoteCommands(program, environment, buildFile) {
             environment.stdout.write(`repositories: ${me.repos.map(server_client_1.printable).join(', ')}\n`);
         }
     }));
-    (0, remote_work_commands_1.registerWorkCommands)(remote, { environment, buildFile, getServer, guarded });
+    (0, remote_work_commands_1.registerWorkCommands)(remote, {
+        environment,
+        buildFile,
+        getServer,
+        guarded,
+        passthrough,
+        fail: (message, exitCode) => program.error(message, { exitCode }),
+    });
     (0, mcp_command_1.registerMcpCommand)(remote, environment);
 }
 exports.registerRemoteCommands = registerRemoteCommands;

package/dist/remote/remote-work-commands.js

@@ -12,6 +12,8 @@ const bundle_1 = require("./bundle");
 const annotations_1 = require("./annotations");
 const server_client_1 = require("./server-client");
 const bundle_text_1 = require("./bundle-text");
+const sandbox_client_1 = require("../harness/sandbox-client");
+const path_1 = require("path");
 const RUN_ID = /^run_[A-Za-z0-9_-]{16}$/;
 // what the publisher said about where a version comes from, one line
 // What a publisher said about where a version comes from: the server takes it as said,
@@ -29,6 +31,11 @@ function yankLines(version) {
         ]
         : [];
 }
+// A line a task printed, shown as it is but for control characters, so it can't rewrite
+// the terminal; tabs stay.
+function printableLine(text) {
+    return text.split('\t').map(server_client_1.printableWhole).join('\t');
+}
 const collectOption = (value, previous = []) => [...previous, value];
 // What a person who approves is shown of a run: everything the decision rests on.
 function describeApproval(run) {
@@ -89,7 +96,7 @@ function describePlan(plan) {
 }
 exports.describePlan = describePlan;
 function registerWorkCommands(remote, context) {
-    const { environment, buildFile, getServer, guarded } = context;
+    const { environment, buildFile, getServer, guarded, passthrough, fail } = context;
     const connect = async (name) => {
         const chosen = await getServer(name);
         // a CI job or an agent brings its own token, a person signs in
@@ -122,6 +129,87 @@ function registerWorkCommands(remote, context) {
             environment.stdout.write(`it can not run before somebody who may publish approves it, until ${(0, server_client_1.printable)(version.expiresAt)}\n`);
         }
     }));
+    remote
+        .command('run <tasks...>')
+        .description('run tasks of a published build file on a server from a git ref, print their output and exit as they did')
+        .addOption(new commander_1.Option('--server <name>', 'the server to run on; the default of remote use when left out'))
+        .addOption(new commander_1.Option('--build <hash>', 'the published version to run (sha256:...), or HAMMERKIT_BUILD; the hash of the build file here when left out'))
+        .addOption(new commander_1.Option('--repo <host/path>', 'the repository, such as github.com/corp/payments; origin of the checkout here when left out'))
+        .addOption(new commander_1.Option('--ref <ref>', 'the branch or tag to run; the branch checked out here when left out'))
+        .addOption(new commander_1.Option('--commit <sha>', 'the commit the ref has to be at, else the run is refused; the commit checked out here when --ref is left out'))
+        .addOption(new commander_1.Option('--env <name>', 'the environment of the build file, as --env of run'))
+        .addOption(new commander_1.Option('--cache <method>', 'as --cache of run').choices(['checksum', 'modify-date', 'none']))
+        .addOption(new commander_1.Option('--timeout <duration>', 'stop the run after this long, such as 30m'))
+        .action(guarded('Remote run was not successful', async (tasks, options) => {
+        const named = options.build ?? environment.processEnvs.HAMMERKIT_BUILD;
+        const definition = named ?? (0, bundle_1.hashBundle)(await (0, collect_bundle_1.collectBundle)(buildFile, environment));
+        if (!bundle_1.HASH_PATTERN.test(definition)) {
+            throw new Error(`${(0, server_client_1.printable)(definition)} is not the hash of a published version (sha256:...)`);
+        }
+        const checkout = options.repo && options.ref ? {} : await (0, annotations_1.readCheckout)((0, path_1.dirname)(buildFile));
+        const repo = options.repo ?? checkout.repo;
+        const ref = options.ref ?? checkout.branch;
+        // the commit checked out here is the code meant, when the ref is the branch it is on
+        const commit = options.commit ?? (options.ref ? undefined : checkout.commit);
+        if (!repo) {
+            throw new Error('name the repository with --repo, the checkout here has no origin it can be told by');
+        }
+        if (!ref) {
+            throw new Error('name the branch or tag with --ref, the checkout here is on no branch');
+        }
+        const { name: serverName, server } = await getServer(options.server);
+        const connection = { url: server.url, ...(0, token_source_1.getTokenSource)(environment, serverName, server) };
+        const runOptions = {};
+        for (const key of ['env', 'cache', 'timeout']) {
+            if (options[key] !== undefined) {
+                runOptions[key] = options[key];
+            }
+        }
+        if (passthrough.length > 0) {
+            runOptions.args = passthrough;
+        }
+        let submitted;
+        try {
+            submitted = await (0, sandbox_client_1.submitRun)(connection, {
+                definition,
+                tasks,
+                source: { type: 'ref', repo, ref, ...(commit ? { commit } : {}) },
+                options: runOptions,
+            });
+        }
+        catch (e) {
+            if (e.status === 400 && !named && /no published build file/.test(String(e))) {
+                throw new Error(`the build file here is not published on ${serverName} (${definition}), publish it first`);
+            }
+            throw e;
+        }
+        const at = submitted.source.type === 'ref' ? ` at ${(0, server_client_1.printable)(submitted.source.commit)}` : '';
+        environment.stdout.write(`${(0, server_client_1.printable)(submitted.id)} on ${serverName}: ${tasks.map(server_client_1.printable).join(', ')} from ${(0, server_client_1.printable)(ref)}${at}\n`);
+        const prefixed = tasks.length > 1;
+        const followed = await (0, sandbox_client_1.followRun)(connection, submitted, {
+            signal: environment.abortCtrl.signal,
+            onLine: (line) => {
+                environment.stdout.write(`${prefixed || line.task !== tasks[0] ? `[${(0, server_client_1.printable)(line.task)}] ` : ''}${printableLine(line.text)}\n`);
+            },
+            onWaiting: (run) => {
+                for (const approval of run.approvals ?? []) {
+                    environment.stdout.write(`waiting until somebody who uses ${(0, server_client_1.printable)(approval.account)} approves it, before ${(0, server_client_1.printable)(approval.expiresAt)}: hammerkit remote approve ${(0, server_client_1.printable)(run.id)}\n`);
+                }
+            },
+        });
+        const run = followed.run;
+        if (run.state === 'succeeded') {
+            environment.stdout.write(`${(0, server_client_1.printable)(run.id)} succeeded\n`);
+            return;
+        }
+        // the exit code of the first task that failed, as `hammerkit run` would end
+        const failed = tasks
+            .map((task) => run.results?.[task])
+            .concat(Object.values(run.results ?? {}))
+            .find((result) => result?.status === 'failed');
+        const exitCode = failed?.exitCode && failed.exitCode > 0 ? failed.exitCode : 1;
+        fail(`${(0, server_client_1.printable)(run.id)} ${run.state}${run.error ? `: ${(0, server_client_1.printable)(run.error)}` : ''}`, exitCode);
+    }));
     remote
         .command('versions [server]')
         .description('list the published versions of build files on a server, newest first, with where they come from')

package/dist/secrets/github-app-token-command.js

@@ -6,6 +6,8 @@ const github_app_token_1 = require("./github-app-token");
 // `hammerkit github-app-token <owner/repo>`: a secret provider command for the token a
 // server reads and pushes a repository with, so the released binary mints it without a
 // script or a runtime of its own. It prints the token and nothing else, without a newline.
+// A failure goes to stderr, which the server puts in its error: the CLI's console writes to
+// stdout, and the server drops what a failed provider printed there.
 function registerGithubAppTokenCommand(program, environment) {
     program
         .command('github-app-token <repo>')
@@ -15,7 +17,8 @@ function registerGithubAppTokenCommand(program, environment) {
             environment.stdout.write(await (0, github_app_token_1.githubAppToken)(repo, environment.processEnvs));
         }
         catch (e) {
-            program.error(`github-app-token: ${(0, log_1.getErrorMessage)(e)}`, { exitCode: 1 });
+            environment.stderr.write(`github-app-token: ${(0, log_1.getErrorMessage)(e)}\n`);
+            throw e;
         }
     });
 }

package/dist/server/kubernetes-backend.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.awaitRunObjectsGone = exports.removeRunObjects = exports.CallerNamespaces = exports.getVolumeScope = exports.KubernetesExecutor = exports.getRunRoleBinding = exports.getNamespacePolicies = exports.getClusterAccess = exports.getCallerNamespace = void 0;
+exports.awaitRunObjectsGone = exports.removeRunObjects = exports.CallerNamespaces = exports.getVolumeScope = exports.KubernetesExecutor = exports.getRunRoleBinding = exports.getNamespacePolicies = exports.getClusterAccess = exports.isCallerNamespace = exports.getCallerNamespace = void 0;
 const crypto_1 = require("crypto");
 const fs_1 = require("fs");
 const os_1 = require("os");
@@ -32,6 +32,12 @@ function getCallerNamespace(prefix, owner) {
     return `${prefix}${(0, crypto_1.createHash)('sha256').update(`${owner.iss}\0${owner.sub}`).digest('hex').slice(0, 16)}`;
 }
 exports.getCallerNamespace = getCallerNamespace;
+// Whether a namespace is one getCallerNamespace makes with this prefix: a server named `hk`
+// passes over the namespaces of a server named `hk-test` on the same cluster.
+function isCallerNamespace(prefix, name) {
+    return name.startsWith(prefix) && /^[0-9a-f]{16}$/.test(name.slice(prefix.length));
+}
+exports.isCallerNamespace = isCallerNamespace;
 // How the server and the processes of its runs reach the cluster: a kubeconfig and
 // context the operator names, else the server's default kubeconfig, else the cluster
 // the server runs in (its pod's ServiceAccount, found through the variables
@@ -335,7 +341,9 @@ class KubernetesExecutor {
             .then((namespaces) => {
             for (const namespace of namespaces.items) {
                 const name = namespace.metadata?.name;
-                if (name?.startsWith(this.config.backend.namespacePrefix) && !namespace.metadata?.deletionTimestamp) {
+                if (name &&
+                    isCallerNamespace(this.config.backend.namespacePrefix, name) &&
+                    !namespace.metadata?.deletionTimestamp) {
                     this.sweepLater(name, 0);
                 }
             }

package/dist/server/run-request.js

@@ -75,6 +75,12 @@ exports.runRequestSchema = zod_1.z
                 return repo;
             }),
             ref: name,
+            // the commit the ref has to be at, such as the one a CI job checked out: a ref that
+            // moved since is refused, so the run executes the code that was asked for
+            commit: zod_1.z
+                .string()
+                .regex(/^([0-9a-f]{40}|[0-9a-f]{64})$/, 'expected a full commit hash, 40 or 64 hex digits')
+                .optional(),
         })
             .strict(),
         // the name of a tree announced with POST /v1/sources

package/dist/server/server.js

@@ -304,6 +304,12 @@ async function submitRun(config, registry, definitions, sources, sandboxes, plan
     if (request.source.type === 'ref') {
         try {
             const commit = await repos.resolve(request.source.repo, request.source.ref);
+            if (request.source.commit && commit !== request.source.commit) {
+                const error = `${request.source.ref} is at ${commit} now, not at ${request.source.commit}`;
+                log(`refuse run iss=${principal.iss} sub=${principal.sub}: ${error}`);
+                (0, http_2.send)(res, 409, { error });
+                return;
+            }
             source = { type: 'ref', repo: request.source.repo, ref: request.source.ref, commit };
         }
         catch (e) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "hammerkit",
   "description": "Containerized build tool with incremental caching that runs the same build file locally, in Docker and on Kubernetes.",
-  "version": "1.27.0-next.1",
+  "version": "1.27.0-next.3",
   "keywords": [
     "build",
     "build-tool",