hammerkit 1.27.0-next.15 → 1.27.0-next.17

package/dist/executer/scheduler/state-key.js

@@ -1,7 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.computeStateKey = exports.combineStateKeys = exports.resolveEffective = void 0;
-const crypto_1 = require("crypto");
+exports.computeStateKey = exports.combineStateKeys = exports.isOwnProvable = exports.resolveEffective = void 0;
 const get_work_cache_stats_1 = require("../../optimizer/get-work-cache-stats");
 // The state-key engine is shared by the scheduler's hit/miss decision
 // (`checkCacheState`) and the read-only cache-explain engine, so a prediction
@@ -24,6 +23,7 @@ function isOwnProvable(item, unmatched) {
     // unmatched ⊆ declared, so this is also false when nothing is declared
     return unmatched.length < item.data.src.filter((src) => !src.inherited).length;
 }
+exports.isOwnProvable = isOwnProvable;
 // Fold a task's own state key together with the state keys of its dependencies.
 // A change anywhere in the dependency subtree must change the resulting key, so
 // that a downstream task is invalidated when an upstream source changes — even
@@ -34,9 +34,7 @@ function combineStateKeys(ownKey, depKeys) {
     }
     // Sort so the key is independent of dependency declaration order.
     const sorted = [...depKeys].sort();
-    return (0, crypto_1.createHash)('md5')
-        .update([ownKey, ...sorted].join(','))
-        .digest('hex');
+    return (0, get_work_cache_stats_1.stateKeyDigest)([ownKey, ...sorted].join(','));
 }
 exports.combineStateKeys = combineStateKeys;
 // `none` only disables the cache *check* for a task; its sources still influence
@@ -72,7 +70,41 @@ async function computeStateKey(item, defaultCacheMethod, environment, memo = new
         depKeys.push(effective.stateKey);
         provable = provable && effective.provable;
     }
+    // what a task that needs a service passed against: the sources of the service and of the
+    // tasks it depends on (its definition is in the task id, getWorkServiceCacheIdentity)
+    for (const need of item.needs) {
+        const effective = await resolveNeedStateKey(need.service, defaultCacheMethod, environment, memo);
+        depKeys.push(`${need.name}=${effective.stateKey}`);
+    }
     return { stateKey: combineStateKeys(ownKey, depKeys), stats, resolved, provable, unmatched };
 }
 exports.computeStateKey = computeStateKey;
+// A needed service's sources folded with the state keys of its dependencies and needs. It
+// does not make the task that needs it unprovable: a dependency without `src` (resetting the
+// service's data, say) is skipped with the service when the task is a cache hit.
+async function resolveNeedStateKey(service, defaultCacheMethod, environment, memo) {
+    const memoKey = `need\0${service.name}`;
+    const existing = memo.get(memoKey);
+    if (existing !== undefined) {
+        return existing;
+    }
+    // services that need each other in a loop fail to plan (checkForLoop): this only has to end
+    memo.set(memoKey, { stateKey: 'loop', provable: true });
+    const resolved = resolveEffective(service, defaultCacheMethod);
+    const { stats } = await (0, get_work_cache_stats_1.getWorkItemCacheStats)(service, environment);
+    const keys = [];
+    for (const dep of service.deps) {
+        keys.push((await resolveEffectiveStateKey(dep, defaultCacheMethod, environment, memo)).stateKey);
+    }
+    for (const need of service.needs) {
+        const effective = await resolveNeedStateKey(need.service, defaultCacheMethod, environment, memo);
+        keys.push(`${need.name}=${effective.stateKey}`);
+    }
+    const effective = {
+        stateKey: combineStateKeys((0, get_work_cache_stats_1.getStateKey)(stats, concreteMethod(resolved, defaultCacheMethod)), keys),
+        provable: true,
+    };
+    memo.set(memoKey, effective);
+    return effective;
+}
 //# sourceMappingURL=state-key.js.map

package/dist/harness/mcp.js

@@ -35,7 +35,7 @@ function sandboxPath(path) {
  * of `run_task` lists; without `shell` there is no `bash`.
  */
 function createMcpTools(client, options = {}) {
-    const [runTask, runLogs] = (0, task_tools_1.createTaskTools)(options.tasks, options.shell || undefined).map((tool) => fromTaskTool(tool, client));
+    const [runTask, runLogs, check] = (0, task_tools_1.createTaskTools)(options.tasks, options.shell || undefined).map((tool) => fromTaskTool(tool, client));
     const bash = {
         name: 'bash',
         description: 'Run a shell command on the sandbox and answer its output and exit code. It runs as the shell task of ' +
@@ -196,6 +196,7 @@ function createMcpTools(client, options = {}) {
         },
         ...(options.shell === false ? [] : [bash]),
         runTask,
+        check,
         { ...runLogs, annotations: { ...runLogs.annotations, ...READ_ONLY } },
         {
             name: 'changes',

package/dist/harness/opencode.js

@@ -65,6 +65,7 @@ exports.OPENCODE_TOOLS = [
     'glob',
     'run_task',
     'run_logs',
+    'check',
     'push',
     'list',
     'services_up',
@@ -154,6 +155,7 @@ exports.OPENCODE_V2_TOOLS = [
     'grep',
     'run_task',
     'run_logs',
+    'check',
     'push',
     'services_up',
     'endpoint_get',
@@ -270,7 +272,7 @@ function createOpencodeV2Tools(client, directory, options = {}) {
             caseSensitive: flag('Match case (default true)'),
             limit: count(`The maximum number of matching lines (default ${SEARCH_LIMIT})`),
         }, ['pattern']), same),
-        ...['run_task', 'run_logs'].map((name) => tool(name, name, { ...(0, task_tools_1.taskToolSchema)(taskTools[name]), additionalProperties: false }, same)),
+        ...['run_task', 'run_logs', 'check'].map((name) => tool(name, name, { ...(0, task_tools_1.taskToolSchema)(taskTools[name]), additionalProperties: false }, same)),
         tool('push', 'push', object({
             branch: text('The branch to push to, created when it does not exist'),
             message: text('The commit message'),
@@ -317,7 +319,12 @@ function opencodeTools(client, options = {}) {
             args: (z) => (0, task_tools_1.taskToolArgs)(task, z),
             async execute(args, context) {
                 const output = await task.call(await client(), args, context.abort);
-                return { title: task.name === 'run_task' ? `run ${args.task}` : `log of ${args.run}`, output };
+                return {
+                    title: task.name === 'run_logs'
+                        ? `log of ${args.run}`
+                        : `${task.name === 'check' ? 'check' : 'run'} ${args.task}`,
+                    output,
+                };
             },
         },
     ]));

package/dist/harness/pi.js

@@ -192,6 +192,21 @@ function hammerkitPiExtension(library, settings = {}) {
                 },
             });
         }
+        register({
+            name: 'check',
+            label: 'check',
+            description: sandbox_client_1.CHECK_DESCRIPTION,
+            promptSnippet: 'Run a task as a check that CI verifies after the push',
+            parameters: {
+                type: 'object',
+                properties: { task: { type: 'string', description: 'The name of the task' } },
+                required: ['task'],
+            },
+            execute: async (_id, params, signal) => {
+                const text = await (0, sandbox_client_1.runCheck)(await client(), params.task, signal);
+                return { content: [{ type: 'text', text }], details: { task: params.task } };
+            },
+        });
         pi.on('session_start', async (_event, ctx) => {
             try {
                 const sandbox = await client();

package/dist/harness/sandbox-client.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.quotePosix = exports.fetchFailure = exports.toSandboxPath = exports.checkSandboxPath = exports.exitCodeOf = exports.followRun = exports.submitRun = exports.FINAL_RUN_STATES = exports.oneAtATime = exports.SandboxClient = exports.listPublishedTasks = exports.SandboxClientError = void 0;
+exports.quotePosix = exports.fetchFailure = exports.toSandboxPath = exports.checkSandboxPath = exports.exitCodeOf = exports.followRun = exports.submitRun = exports.FINAL_RUN_STATES = exports.oneAtATime = exports.SandboxClient = exports.listPublishedTasks = exports.runCheck = exports.CHECK_DESCRIPTION = exports.SandboxClientError = void 0;
 const path_1 = require("path");
 const token_source_1 = require("../remote/token-source");
 // a write carries up to 32 MiB
@@ -16,6 +16,30 @@ class SandboxClientError extends Error {
     }
 }
 exports.SandboxClientError = SandboxClientError;
+// What the agent is told of a check, on each harness.
+exports.CHECK_DESCRIPTION = 'Run a task as a check before you push, such as test or e2e: it runs on a copy of the files a push ' +
+    'would commit (what .gitignore leaves out is not there, so dependencies are installed by the tasks ' +
+    'the build file names), and when it passes, CI verifies it for that commit instead of running it. ' +
+    'Push without changing files afterwards, or the check no longer counts for the files that changed.';
+// A check, run to its end, in a few lines: how it went and the last lines of a failure.
+async function runCheck(client, task, signal) {
+    const ran = await client.runTask(task, { check: true, signal });
+    const result = ran.result;
+    const lines = [
+        result?.status === 'succeeded' || result?.status === 'cached'
+            ? `check ${task} passed (run ${ran.run.id}${result.status === 'cached' ? ', from the cache' : ''}): CI can verify it for a push of these files`
+            : `check ${task} did not pass (run ${ran.run.id}: ${result?.status ?? ran.run.state}${result?.exitCode !== undefined ? `, exit code ${result.exitCode}` : ''})`,
+    ];
+    const error = result?.error ?? ran.run.error;
+    if (error) {
+        lines.push(`error: ${error}`);
+    }
+    if (result && result.status !== 'succeeded' && result.status !== 'cached' && result.lastLog.length > 0) {
+        lines.push('last lines:', ...result.lastLog);
+    }
+    return lines.join('\n');
+}
+exports.runCheck = runCheck;
 /**
  * The tasks of a published version, without its services, as `GET /v1/definitions/<hash>`
  * answers them.
@@ -143,7 +167,7 @@ class SandboxClient {
         const submitted = await submitRun(this.connection, {
             definition: this.build.hash,
             tasks: [task],
-            source: { type: 'sandbox', id: this.id },
+            source: { type: 'sandbox', id: this.id, ...(options.check ? { check: true } : {}) },
             options: runOptions,
         });
         const followed = await followRun(this.connection, submitted, {

package/dist/harness/task-tools.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.taskToolArgs = exports.taskToolSchema = exports.createTaskTools = exports.describeTasks = exports.describeRun = exports.readLogHint = exports.readTaskListing = exports.LIST_TASKS_MS = void 0;
+const sandbox_client_1 = require("./sandbox-client");
 // the most tasks a description lists, and of a task's description or command it shows
 const MAX_LISTED = 40;
 const MAX_DESCRIPTION_CHARS = 200;
@@ -100,7 +101,7 @@ function cut(text, max) {
     return text.length > max ? `${text.slice(0, max)}…` : text;
 }
 /**
- * `run_task` and `run_logs`, with the tasks the description of `run_task` lists. Without a
+ * `run_task`, `run_logs` and `check`, with the tasks the description of `run_task` lists. Without a
  * listing it names none, as the MCP tools before a version could be read.
  */
 function createTaskTools(listing, shell) {
@@ -160,6 +161,16 @@ function createTaskTools(listing, shell) {
                 return lines.join('\n');
             },
         },
+        {
+            name: 'check',
+            title: 'Run a check',
+            description: sandbox_client_1.CHECK_DESCRIPTION,
+            parameters: { task: { type: 'string', description: 'The name of the task' } },
+            required: ['task'],
+            call(client, args, signal) {
+                return (0, sandbox_client_1.runCheck)(client, args.task, signal);
+            },
+        },
     ];
 }
 exports.createTaskTools = createTaskTools;

package/dist/optimizer/calculate-checksum.js

@@ -4,9 +4,10 @@ exports.calculateChecksum = void 0;
 const crypto_1 = require("crypto");
 // Hashes the raw bytes: decoding to text first would map every invalid UTF-8
 // sequence to U+FFFD, so two different binary files could share a checksum.
-// For UTF-8 text the result is unchanged.
+// For UTF-8 text the result is unchanged. sha256, which nobody can make two files share:
+// a cache hit is also what a verified check counts (check-key.ts).
 async function calculateChecksum(environment, path) {
-    const hash = (0, crypto_1.createHash)('sha1');
+    const hash = (0, crypto_1.createHash)('sha256');
     for await (const chunk of environment.file.readStream(path)) {
         hash.update(chunk);
     }

package/dist/optimizer/check-key.js

@@ -0,0 +1,94 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getCheckKey = void 0;
+const crypto_1 = require("crypto");
+const state_key_1 = require("../executer/scheduler/state-key");
+const get_work_cache_stats_1 = require("./get-work-cache-stats");
+const work_task_cache_description_1 = require("./work-task-cache-description");
+/**
+ * What a passed check is recorded under, and what `remote verify` looks it up by: the
+ * inputs of the task's cache key, so a cached result counts for the same key it was
+ * stored under. Its definition (the services it needs included), the files of its `src`,
+ * the keys of its dependencies, and the sources of the services it needs and of the tasks
+ * they depend on.
+ *
+ * It is computed on a checkout before anything ran in it, on both ends, so it also covers
+ * the files a commit holds where a dependency generates (the cache leaves those out, as
+ * they change once the dependency ran), and it leaves out `.git`, which is no file of a
+ * commit. Two checkouts of the same files give the same key wherever they are.
+ * Null for a task that can not be proven up to date (no `src` of its own, or none that
+ * matches a file, here or in a dependency): its result says nothing about any files.
+ */
+async function getCheckKey(item, environment, memo = new Map(), path = new Set()) {
+    return memoized(memo, path, `task\0${item.id()}`, (inner) => computeCheckKey(item, environment, memo, inner));
+}
+exports.getCheckKey = getCheckKey;
+async function computeCheckKey(item, environment, memo, path) {
+    const { stats, unmatched } = await (0, get_work_cache_stats_1.getWorkItemCheckoutStats)(item, environment);
+    if (!(0, state_key_1.isOwnProvable)(item, unmatched)) {
+        return null;
+    }
+    const inputs = await getInputKeys(item, environment, memo, path);
+    if (inputs === null) {
+        return null;
+    }
+    return hash({ task: (0, work_task_cache_description_1.getWorkTaskCacheDescription)(item), files: commitFiles(stats), ...inputs });
+}
+// The sources of a needed service, with the keys of what it depends on and needs; its
+// definition is in the description of the task that needs it.
+function getNeedKey(item, environment, memo, path) {
+    return memoized(memo, path, `need\0${item.name}`, async (inner) => {
+        const inputs = await getInputKeys(item, environment, memo, inner);
+        if (inputs === null) {
+            return null;
+        }
+        return hash({ files: commitFiles(await (0, get_work_cache_stats_1.getWorkCacheStats)(item.data, environment)), ...inputs });
+    });
+}
+async function getInputKeys(item, environment, memo, path) {
+    const deps = [];
+    for (const dep of item.deps) {
+        const key = await getCheckKey(dep, environment, memo, path);
+        if (key === null) {
+            return null;
+        }
+        deps.push(key);
+    }
+    const needs = [];
+    for (const need of item.needs) {
+        const key = await getNeedKey(need.service, environment, memo, path);
+        if (key === null) {
+            return null;
+        }
+        needs.push(`${need.name}=${key}`);
+    }
+    return { deps: deps.sort(), needs: needs.sort() };
+}
+// a commit never holds `.git`: what a checkout keeps there differs between a CI job's clone,
+// the server's fetch and a sandbox's copy, which has none
+function commitFiles(stats) {
+    return Object.keys(stats.files)
+        .filter((path) => !path.split('/').includes('.git'))
+        .sort()
+        .map((path) => [path, stats.files[path].checksum]);
+}
+function hash(value) {
+    return (0, crypto_1.createHash)('sha256').update(JSON.stringify(value)).digest('hex');
+}
+// `path` holds the keys being computed on the way here: one coming back is a loop (services
+// that need each other), which can not be proven and fails to plan anyway. Waiting on its
+// pending promise would never end. The keys are computed one after another, so every pending
+// promise in the memo is on the path.
+function memoized(memo, path, key, compute) {
+    if (path.has(key)) {
+        return Promise.resolve(null);
+    }
+    const known = memo.get(key);
+    if (known) {
+        return known;
+    }
+    const computed = compute(new Set([...path, key]));
+    memo.set(key, computed);
+    return computed;
+}
+//# sourceMappingURL=check-key.js.map

package/dist/optimizer/check-keys.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getCheckKeys = void 0;
+const plan_work_tasks_1 = require("../planner/utils/plan-work-tasks");
+const reference_parser_1 = require("../schema/reference-parser");
+const schema_parser_1 = require("../schema/schema-parser");
+const work_scope_parser_1 = require("../schema/work-scope-parser");
+const log_1 = require("../log");
+const check_key_1 = require("./check-key");
+/**
+ * The check keys of the tasks of a scope, as both ends compute them: the process of a run on
+ * the server before it executes anything, and `remote verify` in a CI job's checkout. So the
+ * build file is read the same way on both, as a server reads it (no `.env`, links are files)
+ * but placed nowhere: where a server runs a task (a pool, its tool image, the arch of its
+ * nodes) is the server's, and a result counts for the server it passed on. The secrets'
+ * providers and accounts are the server's too, and no part of a key, so any is taken here.
+ */
+async function getCheckKeys(entry, environment, scope) {
+    const keyed = { ...environment, hosted: { catalog: anyCatalog(), localTasksInContainers: true } };
+    const { ctx, scope: parsed } = await (0, schema_parser_1.createParseContext)(entry, keyed);
+    const workTree = (0, work_scope_parser_1.getWorkContext)(await (0, reference_parser_1.parseReferences)(ctx, parsed, keyed), scope, keyed);
+    const memo = new Map();
+    const keys = {};
+    for (const task of (0, plan_work_tasks_1.iterateWorkTasks)(workTree)) {
+        try {
+            const key = await (0, check_key_1.getCheckKey)(task, keyed, memo);
+            keys[task.name] = key
+                ? { key }
+                : {
+                    key: null,
+                    reason: 'it, or a task it or a service it needs depends on, declares no src that matches a file',
+                };
+        }
+        catch (e) {
+            // a secret whose value is part of the key (`cache: true`) is not known here
+            keys[task.name] = { key: null, reason: (0, log_1.getErrorMessage)(e) };
+        }
+    }
+    return keys;
+}
+exports.getCheckKeys = getCheckKeys;
+// Every provider and account name resolves, to a definition nothing runs.
+function anyCatalog() {
+    const provider = (name) => ({
+        name,
+        type: 'command',
+        command: [],
+        env: {},
+        timeoutMs: 0,
+        declaredIn: 'the server',
+    });
+    const account = (name) => ({
+        name,
+        default: false,
+        providers: new Proxy({}, { get: () => ({ env: {} }) }),
+        declaredIn: 'the server',
+    });
+    return {
+        providers: new Proxy({}, { get: (_target, name) => (typeof name === 'string' ? provider(name) : undefined) }),
+        accounts: new Proxy({}, { get: (_target, name) => (typeof name === 'string' ? account(name) : undefined) }),
+        explicitAccounts: true,
+    };
+}
+//# sourceMappingURL=check-keys.js.map

package/dist/optimizer/get-work-cache-stats.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getStateKey = exports.getWorkItemCacheStats = exports.getWorkCacheStats = void 0;
+exports.stateKeyDigest = exports.getStateKey = exports.getWorkItemCheckoutStats = exports.getWorkItemCacheStats = exports.getWorkCacheStats = void 0;
 const calculate_checksum_1 = require("./calculate-checksum");
 const path_1 = require("path");
 const crypto_1 = require("crypto");
@@ -20,7 +20,7 @@ async function addWorkCacheStats(result, cwd, path, matcher, context, root, excl
             if (!matcher(path)) {
                 return 0;
             }
-            const checksum = (0, crypto_1.createHash)('sha1')
+            const checksum = (0, crypto_1.createHash)('sha256')
                 .update(`link:${await (0, promises_1.readlink)(path)}`)
                 .digest('hex');
             result.files[(0, path_1.relative)(cwd, path).split(path_1.sep).join(path_1.posix.sep)] = { lastModified: link.mtimeMs, checksum };
@@ -85,6 +85,13 @@ function getWorkItemCacheStats(item, environment) {
     return collectSourceStats(item.data, environment, dependencyOutputs(item));
 }
 exports.getWorkItemCacheStats = getWorkItemCacheStats;
+// The source stats of a task with what its dependencies generate: on a checkout nothing ran
+// in, those are the files a commit holds there, see check-key.ts.
+async function getWorkItemCheckoutStats(item, environment) {
+    const { stats } = await collectSourceStats(item.data, environment, []);
+    return { stats, unmatched: (await getWorkItemCacheStats(item, environment)).unmatched };
+}
+exports.getWorkItemCheckoutStats = getWorkItemCheckoutStats;
 function dependencyOutputs(item) {
     const outputs = new Set();
     const visited = new Set();
@@ -113,7 +120,14 @@ function getStateKey(stats, cacheMethod) {
             contents.push(`${key}:${stats.files[key].lastModified}`);
         }
     }
-    return (0, crypto_1.createHash)('md5').update(contents.join(',')).digest('hex');
+    return stateKeyDigest(contents.join(','));
 }
 exports.getStateKey = getStateKey;
+// A state key is also the value of the `hammerkit.dev/state` label on Kubernetes, which
+// takes at most 63 characters: the sha256 in base 36 has 50.
+function stateKeyDigest(content) {
+    const hex = (0, crypto_1.createHash)('sha256').update(content).digest('hex');
+    return BigInt(`0x${hex}`).toString(36).padStart(50, '0');
+}
+exports.stateKeyDigest = stateKeyDigest;
 //# sourceMappingURL=get-work-cache-stats.js.map

package/dist/optimizer/work-task-cache-description.js

@@ -1,12 +1,15 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.storedCacheDescription = exports.getWorkTaskCacheDescription = void 0;
+exports.storedCacheDescription = exports.getWorkServiceCacheIdentity = exports.getWorkTaskCacheDescription = void 0;
 const os_1 = require("os");
 const crypto_1 = require("crypto");
 const replace_env_variables_1 = require("../environment/replace-env-variables");
 const portable_path_1 = require("../planner/utils/portable-path");
 const work_secret_1 = require("../planner/work-secret");
 const claim_layout_1 = require("../kubernetes/claim-layout");
+const work_service_1 = require("../planner/work-service");
+const work_service_id_1 = require("../planner/work-service-id");
+const work_cache_id_1 = require("../planner/work-cache-id");
 // Every path is made project-relative (portablePath) so the description, and the
 // task id hashed from it, is identical wherever the project is checked out.
 //
@@ -42,9 +45,54 @@ function getWorkTaskCacheDescription(item) {
         deps: item.deps.length > 0 ? item.deps.map((dep) => dep.id()).sort() : undefined,
         secrets: cachedSecrets.length > 0 ? cachedSecrets : undefined,
         claimLayout: (0, claim_layout_1.hasPathsEndingAlike)(item) || (0, claim_layout_1.hasOutputsFlatteningAlike)(item) ? 2 : undefined,
+        needs: item.needs.length > 0 ? getNeedsIdentities(item) : undefined,
     };
 }
 exports.getWorkTaskCacheDescription = getWorkTaskCacheDescription;
+// `visiting` holds the services on the way here: services that need each other in a loop
+// fail to plan (checkForLoop), the identity only has to come back to say so
+function getNeedsIdentities(item, visiting = new Set()) {
+    return (item.needs
+        // an init task needs the service it initializes, whose identity holds the init's id
+        .filter((need) => !isInitOf(item, need.service))
+        .map((need) => visiting.has(need.service)
+        ? `${need.name}=loop`
+        : `${need.name}=${getWorkServiceCacheIdentity(need.service, visiting)}`)
+        .sort());
+}
+function isInitOf(item, service) {
+    return (0, work_service_1.isContainerWorkService)(service.data) && service.data.init?.task.data === item.data;
+}
+// Everything that makes a service what a task needing it talks to: its definition, the ids of
+// the tasks it depends on and of its init task, and the services it needs in turn. The source
+// of those tasks and of the service is in the state key (computeStateKey), like a dependency's.
+// Not the service id, which leaves out what a service runs (getWorkServiceId).
+function getWorkServiceCacheIdentity(item, visiting = new Set()) {
+    const service = item.data;
+    const definition = (0, work_service_1.isContainerWorkService)(service)
+        ? {
+            cmd: service.cmd?.cmd ?? null,
+            envs: (0, replace_env_variables_1.getEnvironmentVariables)(service.envs),
+            healthcheck: service.healthcheck?.cmd.cmd ?? null,
+            secrets: service.secrets
+                .filter((secret) => secret.cache)
+                .map((secret) => `${(0, work_secret_1.getPortableSecretName)(service.projectRoot, secret)}=${secret.digest()}`)
+                .sort(),
+            // as declared: arguments after -- of a run of the init leave the service as it is
+            init: service.init ? (0, work_cache_id_1.getDeclaredWorkTaskId)(service.init.task) : null,
+        }
+        : { namespace: service.namespace };
+    return (0, crypto_1.createHash)('sha256')
+        .update(JSON.stringify({
+        id: (0, work_service_id_1.getWorkServiceId)(service),
+        ...definition,
+        ports: service.ports.map((port) => `${port.hostPort ?? ''}:${port.containerPort}`).sort(),
+        deps: item.deps.map((dep) => dep.id()).sort(),
+        needs: getNeedsIdentities(item, new Set([...visiting, item])),
+    }))
+        .digest('hex');
+}
+exports.getWorkServiceCacheIdentity = getWorkServiceCacheIdentity;
 // The form written to disk: description.json in a cache entry (pushed to remote
 // backends, readable by everyone who can pull) and the local explain record.
 // Env is where tokens get passed, so each value is stored as a digest; the task

package/dist/remote/remote-work-commands.js

@@ -16,7 +16,19 @@ const sandbox_client_1 = require("../harness/sandbox-client");
 const units_1 = require("../utils/units");
 const service_tools_1 = require("../harness/service-tools");
 const path_1 = require("path");
+const check_keys_1 = require("../optimizer/check-keys");
 const RUN_ID = /^run_[A-Za-z0-9_-]{16}$/;
+// how a check passed, one line
+function describePassed(passed) {
+    const from = passed.source.type === 'ref'
+        ? `${passed.source.ref} at ${passed.source.commit.slice(0, 12)}`
+        : `a check of sandbox ${passed.source.sandbox}, fetched at ${passed.source.commit.slice(0, 12)}`;
+    return `passed ${passed.finishedAt}${passed.status === 'cached'
+        ? ' from the cache'
+        : passed.durationMs !== undefined
+            ? ` in ${(0, units_1.formatDuration)(passed.durationMs)}`
+            : ''}, ${passed.run} by ${passed.by.sub}, from ${from}`;
+}
 // what the publisher said about where a version comes from, one line
 // What a publisher said about where a version comes from: the server takes it as said,
 // so anybody else is told it is not checked.
@@ -158,6 +170,7 @@ function registerWorkCommands(remote, context) {
         .addOption(new commander_1.Option('--cache <method>', 'as --cache of run').choices(['checksum', 'modify-date', 'none']))
         .addOption(new commander_1.Option('--timeout <duration>', 'as --timeout of run: for tasks without their own, such as 30m'))
         .addOption(new commander_1.Option('--max-timeout <duration>', 'as --max-timeout of run: for every task, also one with its own timeout'))
+        .addOption(new commander_1.Option('--detach', 'submit the run and exit, without following it: for a check that CI verifies later'))
         .action(guarded('Remote run was not successful', async (tasks, options) => {
         const named = options.build ?? environment.processEnvs.HAMMERKIT_BUILD;
         const definition = named ?? (0, bundle_1.hashBundle)(await (0, collect_bundle_1.collectBundle)(buildFile, environment));
@@ -194,6 +207,10 @@ function registerWorkCommands(remote, context) {
         }
         const at = submitted.source.type === 'ref' ? ` at ${(0, server_client_1.printable)(submitted.source.commit)}` : '';
         environment.stdout.write(`${(0, server_client_1.printable)(submitted.id)} on ${serverName}: ${tasks.map(server_client_1.printable).join(', ')} from ${(0, server_client_1.printable)(ref)}${at}\n`);
+        if (options.detach) {
+            environment.stdout.write(`follow it with: hammerkit remote show ${(0, server_client_1.printable)(submitted.id)}\n`);
+            return;
+        }
         const prefixed = tasks.length > 1;
         const followed = await (0, sandbox_client_1.followRun)(connection, submitted, {
             signal: environment.abortCtrl.signal,
@@ -297,6 +314,57 @@ function registerWorkCommands(remote, context) {
         const run = (await (0, server_client_1.callServer)(server, token, 'POST', `/v1/runs/${id}/cancel`)).body;
         environment.stdout.write(`${(0, server_client_1.printable)(run.id)} on ${serverName}: ${run.state === 'up' || run.state === 'running' ? 'stopping' : (0, server_client_1.printable)(run.state)}\n`);
     }));
+    remote
+        .command('verify <tasks...>')
+        .description('check that the server already passed tasks for the files checked out here, without running them; ' +
+        'exits 1 at once for any it did not')
+        .addOption(new commander_1.Option('--server <name>', 'the server to ask; the default of remote use when left out'))
+        .addOption(new commander_1.Option('--repo <host/path>', 'the repository, such as github.com/corp/payments; origin of the checkout here when left out'))
+        .addOption(new commander_1.Option('--env <name>', 'the environment of the build file, as --env of run'))
+        .action(guarded('Remote verify was not successful', async (tasks, options) => {
+        const repo = options.repo ?? (await (0, annotations_1.readCheckout)((0, path_1.dirname)(buildFile))).repo;
+        if (!repo) {
+            throw new Error('name the repository with --repo, the checkout here has no origin it can be told by');
+        }
+        const keys = [];
+        const unkeyed = [];
+        for (const task of tasks) {
+            const found = (await (0, check_keys_1.getCheckKeys)(buildFile, environment, { taskName: task, environmentName: options.env ?? null }))[task];
+            if (!found) {
+                throw new Error(`the build file has no task ${(0, server_client_1.printable)(task)}`);
+            }
+            if (found.key === null) {
+                unkeyed.push(`${(0, server_client_1.printable)(task)}: can not be verified, ${(0, server_client_1.printable)(found.reason)}`);
+            }
+            else {
+                keys.push({ task, key: found.key });
+            }
+        }
+        const { name: serverName, server, token } = await connect(options.server);
+        const answer = keys.length > 0
+            ? await (0, server_client_1.callServer)(server, token, 'POST', '/v1/checks/lookup', { repo, keys })
+            : { body: { checks: [] } };
+        const missing = [];
+        // by what was asked, never by what was answered: a task the answer leaves out, or
+        // answers for another key, is not verified
+        for (const { task, key } of keys) {
+            const check = answer.body.checks.find((answered) => answered.task === task && answered.key === key);
+            if (check?.passed) {
+                environment.stdout.write(`${(0, server_client_1.printable)(task)}: ${(0, server_client_1.printable)(describePassed(check.passed))}\n`);
+            }
+            else {
+                missing.push(task);
+                environment.stdout.write(`${(0, server_client_1.printable)(task)}: no run on ${serverName} passed it for these files${check?.reason ? `, ${(0, server_client_1.printable)(check.reason)}` : ''}\n`);
+            }
+        }
+        for (const line of unkeyed) {
+            environment.stdout.write(`${line}\n`);
+        }
+        if (missing.length > 0 || unkeyed.length > 0) {
+            const run = missing.length > 0 ? `; run on the server: hammerkit remote run ${missing.map(server_client_1.printable).join(' ')}` : '';
+            fail(`not verified: ${[...missing, ...unkeyed.map((line) => line.split(':')[0])].join(', ')}${run}`, 1);
+        }
+    }));
     remote
         .command('versions [server]')
         .description('list the published versions of build files on a server, newest first, with where they come from')

package/dist/server/accounts-api.js

@@ -31,6 +31,7 @@ async function handleAccounts(config, log, principal, req, res, url) {
             accounts,
             repos: grant.repos,
             builds: grant.builds,
+            checks: grant.checks || grant.builds !== null ? 'read' : null,
             sandboxes: grant.sandboxes,
             endpoints: grant.endpoints,
         });