hammerkit 1.27.0-next.16 → 1.27.0-next.17

package/dist/server/checks-api.js

@@ -0,0 +1,83 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleChecks = exports.MAX_LOOKUP_KEYS = void 0;
+const zod_1 = require("zod");
+const http_1 = require("./http");
+const policy_1 = require("./policy");
+const checks_1 = require("./checks");
+const repo_1 = require("./repo");
+// the tasks one lookup may ask about
+exports.MAX_LOOKUP_KEYS = 100;
+const lookupSchema = zod_1.z
+    .object({
+    repo: zod_1.z.string().transform((value, ctx) => {
+        const repo = (0, repo_1.normalizeRepo)(value);
+        if (!repo) {
+            ctx.addIssue({ code: zod_1.z.ZodIssueCode.custom, message: 'expected a repository like github.com/corp/payments' });
+            return zod_1.z.NEVER;
+        }
+        return repo;
+    }),
+    keys: zod_1.z
+        .array(zod_1.z
+        .object({
+        task: zod_1.z.string().min(1).max(200),
+        key: zod_1.z.string().regex(checks_1.CHECK_KEY_PATTERN, 'expected a check key, 64 hex digits'),
+    })
+        .strict())
+        .min(1)
+        .max(exports.MAX_LOOKUP_KEYS),
+})
+    .strict();
+/**
+ * What runs passed, for CI that verifies instead of running (`hammerkit remote verify`):
+ *
+ *   POST /v1/checks/lookup   { repo, keys: [{ task, key }] }  the newest passed run per key
+ *
+ * The caller computed the keys from its own checkout (check-key.ts); a key nothing passed
+ * for, or whose version of the build file was yanked since, is answered with none.
+ */
+async function handleChecks(config, checks, definitions, log, principal, req, res, url) {
+    if (url.pathname !== '/v1/checks/lookup') {
+        return false;
+    }
+    if (req.method !== 'POST') {
+        (0, http_1.send)(res, 405, { error: 'method not allowed' }, { allow: 'POST' });
+        return true;
+    }
+    const parsed = lookupSchema.safeParse(await (0, http_1.readJson)(req));
+    if (!parsed.success) {
+        const issue = parsed.error.issues[0];
+        (0, http_1.send)(res, 400, { error: `${issue.path.join('.') || 'request'}: ${issue.message}` });
+        return true;
+    }
+    const { repo, keys } = parsed.data;
+    const grant = (0, policy_1.getGrant)(config.entitlements, principal);
+    if (!(0, policy_1.mayReadChecks)(grant, repo)) {
+        log(`refuse checks iss=${principal.iss} sub=${principal.sub} repo=${repo}`);
+        (0, http_1.send)(res, 403, { error: `you may not read the checks of ${repo}` });
+        return true;
+    }
+    const answers = await Promise.all(keys.map(async ({ task, key }) => {
+        const record = await checks.find(repo, key);
+        const yanked = record ? definitions.find(record.definition)?.yanked : undefined;
+        if (!record || yanked) {
+            return {
+                task,
+                key,
+                passed: null,
+                ...(yanked ? { reason: `it passed with ${record?.definition}, which was yanked since` } : {}),
+            };
+        }
+        const { repo: _repo, key: _key, accounts: _accounts, ...view } = record;
+        void _repo;
+        void _key;
+        void _accounts;
+        return { task, key, passed: view };
+    }));
+    log(`checks iss=${principal.iss} sub=${principal.sub} repo=${repo} passed=${answers.filter((a) => a.passed).length}/${answers.length}`);
+    (0, http_1.send)(res, 200, { checks: answers });
+    return true;
+}
+exports.handleChecks = handleChecks;
+//# sourceMappingURL=checks-api.js.map

package/dist/server/checks.js

@@ -0,0 +1,116 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CheckStore = exports.getCheckRecords = exports.isCheckRun = exports.CHECK_KEY_PATTERN = void 0;
+const crypto_1 = require("crypto");
+const promises_1 = require("fs/promises");
+const path_1 = require("path");
+exports.CHECK_KEY_PATTERN = /^[0-9a-f]{64}$/;
+// The runs whose results are checks: those of a commit the server checked out, and those
+// on a copy of the files of a sandbox, which hold nothing a commit of them would not. A run
+// with arguments ran something other than the task, and is no check of it.
+function isCheckRun(run) {
+    // a run of services keeps them up, it passes nothing
+    if ((run.options.args ?? []).length > 0 || run.up) {
+        return false;
+    }
+    return run.source.type === 'ref' || (run.source.type === 'sandbox' && run.source.check === true);
+}
+exports.isCheckRun = isCheckRun;
+// What a run that ended passed, with the keys its executor reported before the tasks ran.
+function getCheckRecords(run, keys) {
+    if (!isCheckRun(run) || run.source.type === 'upload') {
+        return [];
+    }
+    const source = run.source.type === 'ref'
+        ? { type: 'ref', ref: run.source.ref, commit: run.source.commit }
+        : { type: 'sandbox', sandbox: run.source.id, commit: run.source.commit, tree: run.source.tree };
+    const records = [];
+    for (const [task, result] of Object.entries(run.results ?? {})) {
+        const key = keys[task];
+        if (!key || !exports.CHECK_KEY_PATTERN.test(key) || (result.status !== 'succeeded' && result.status !== 'cached')) {
+            continue;
+        }
+        records.push({
+            repo: run.source.repo,
+            key,
+            task,
+            status: result.status,
+            run: run.id,
+            by: { iss: run.owner.iss, sub: run.owner.sub },
+            source,
+            definition: run.definition,
+            accounts: [...run.accounts],
+            finishedAt: result.finishedAt ?? run.finishedAt ?? new Date().toISOString(),
+            ...(result.durationMs !== undefined ? { durationMs: result.durationMs } : {}),
+        });
+    }
+    return records;
+}
+exports.getCheckRecords = getCheckRecords;
+/**
+ * One file per repository and key, the newest run's: `<directory>/<repo hash>/<key>.json`,
+ * written to a temporary file and renamed. A record older than `keep` is not found and is
+ * removed by `sweep`.
+ */
+class CheckStore {
+    constructor(directory, options) {
+        this.directory = directory;
+        this.options = options;
+        this.now = options.now ?? Date.now;
+    }
+    async save(records) {
+        for (const record of records) {
+            const folder = (0, path_1.join)(this.directory, repoFolder(record.repo));
+            await (0, promises_1.mkdir)(folder, { recursive: true, mode: 0o700 });
+            const file = (0, path_1.join)(folder, `${record.key}.json`);
+            const temporary = `${file}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
+            await (0, promises_1.writeFile)(temporary, JSON.stringify(record), { mode: 0o600 });
+            await (0, promises_1.rename)(temporary, file);
+        }
+    }
+    async find(repo, key) {
+        if (!exports.CHECK_KEY_PATTERN.test(key)) {
+            return undefined;
+        }
+        let record;
+        try {
+            record = JSON.parse(await (0, promises_1.readFile)((0, path_1.join)(this.directory, repoFolder(repo), `${key}.json`), 'utf8'));
+        }
+        catch {
+            return undefined;
+        }
+        if (record.repo !== repo || record.key !== key || this.expired(record)) {
+            return undefined;
+        }
+        return record;
+    }
+    // Removes the records that are older than `keep`.
+    async sweep() {
+        let folders;
+        try {
+            folders = await (0, promises_1.readdir)(this.directory);
+        }
+        catch {
+            return;
+        }
+        for (const folder of folders) {
+            const path = (0, path_1.join)(this.directory, folder);
+            for (const name of await (0, promises_1.readdir)(path).catch(() => [])) {
+                const file = (0, path_1.join)(path, name);
+                const stats = await (0, promises_1.stat)(file).catch(() => undefined);
+                if (stats && this.now() - stats.mtimeMs > this.options.keep) {
+                    await (0, promises_1.rm)(file, { force: true });
+                }
+            }
+        }
+    }
+    expired(record) {
+        const at = Date.parse(record.finishedAt);
+        return !Number.isFinite(at) || this.now() - at > this.options.keep;
+    }
+}
+exports.CheckStore = CheckStore;
+function repoFolder(repo) {
+    return (0, crypto_1.createHash)('sha256').update(repo).digest('hex').slice(0, 32);
+}
+//# sourceMappingURL=checks.js.map

package/dist/server/executor.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.HostExecutor = exports.volumeScope = exports.cacheNamespace = exports.defaultWorker = void 0;
 const child_process_1 = require("child_process");
 const crypto_1 = require("crypto");
+const checks_1 = require("./checks");
 const fs_1 = require("fs");
 const promises_1 = require("fs/promises");
 const path_1 = require("path");
@@ -35,9 +36,18 @@ exports.defaultWorker = defaultWorker;
 // share one, those of an upload or a sandbox only their owner's. Somebody who can only
 // upload, or an agent on a sandbox, can not leave an entry for a run from a reviewed
 // repository to find.
+//
+// A check on a sandbox runs on a copy of the files a commit of them would hold, so it is a
+// run of the repository like a ref run of that commit, and shares its cache: what its
+// owner may write in the sandbox is not part of it. It leaves entries a run from main can
+// find, keyed by the files it ran on, as a ref run of a branch does: so only a caller who
+// may push a branch of the repository and run from it may check (server.ts).
 function cacheNamespace(run) {
-    const key = run.source.type === 'ref' ? `ref\0${run.source.repo}` : `${run.source.type}\0${run.owner.iss}\0${run.owner.sub}`;
-    return `${run.source.type}-${(0, crypto_1.createHash)('sha256').update(key).digest('hex').slice(0, 24)}`;
+    const repository = run.source.type === 'ref' || (run.source.type === 'sandbox' && run.source.check);
+    const key = repository
+        ? `ref\0${run.source.repo}`
+        : `${run.source.type}\0${run.owner.iss}\0${run.owner.sub}`;
+    return `${repository ? 'ref' : run.source.type}-${(0, crypto_1.createHash)('sha256').update(key).digest('hex').slice(0, 24)}`;
 }
 exports.cacheNamespace = cacheNamespace;
 // The docker volumes of a run's services are its caller's, within the cache's source trust:
@@ -121,7 +131,34 @@ class HostExecutor {
             let claim;
             // the files of the sandbox the tasks work on
             let work;
-            if (source.type === 'ref') {
+            if (source.type === 'sandbox' && source.check) {
+                // a check works on the files a push of the sandbox commits, copied out of it: never
+                // on the sandbox, whose ignored files (node_modules, outputs) its owner writes
+                const { registry, network } = sandboxes;
+                cwd = (0, path_1.join)(root, 'source');
+                try {
+                    await registry.exportTree(source.id, source.tree, cwd, abortCtrl.signal);
+                }
+                catch (e) {
+                    throw new Error(`the files of the sandbox ${source.id} could not be copied for the check, submit it again: ${e instanceof Error ? e.message : String(e)}`);
+                }
+                // a repository of its own, as a checkout of the commit is: the root of the project,
+                // which the paths of the tasks' keys are relative to, is the one of git
+                await (0, git_checkout_1.git)(['init', '--quiet', cwd], {}, abortCtrl.signal, `the check of sandbox ${source.id}`, 'init');
+                context.emit({
+                    type: 'log',
+                    task: 'hammerkit',
+                    stream: 'stdout',
+                    text: `check of sandbox ${source.id} of ${source.repo}: files ${source.tree}, fetched at ${source.commit}`,
+                });
+                await this.writeBundle(cwd, bundle.files);
+                input = {
+                    entry: (0, path_1.join)(cwd, version.entry),
+                    ...(planning.policy.network ? { network: (0, work_network_1.toNetworkSchema)(planning.policy.network) } : {}),
+                    sandboxNetwork: network,
+                };
+            }
+            else if (source.type === 'ref') {
                 cwd = (0, path_1.join)(root, 'source');
                 const { repo, ref, commit: pinned } = source;
                 const credentials = await repos.credentials(repo);
@@ -190,6 +227,7 @@ class HostExecutor {
                     options: run.options,
                     accounts: run.accounts,
                     volumeScope: volumeScope(run),
+                    ...((0, checks_1.isCheckRun)(run) ? { check: true } : {}),
                     catalog: planning.environment.hosted?.catalog,
                     ...(run.up
                         ? {

package/dist/server/kubernetes-backend.js

@@ -569,7 +569,7 @@ exports.KubernetesExecutor = KubernetesExecutor;
 // cache, and on a sandbox the runs of that sandbox only, whose claim is on the same node or
 // zone as the kept ones. The owner is the namespace's.
 function getVolumeScope(run) {
-    if (run.source.type === 'sandbox') {
+    if (run.source.type === 'sandbox' && !run.source.check) {
         return `sandbox-${(0, crypto_1.createHash)('sha256').update(run.source.id).digest('hex').slice(0, 24)}`;
     }
     return (0, executor_1.cacheNamespace)(run);

package/dist/server/kubernetes-sandbox-storage.js

@@ -261,6 +261,41 @@ class KubernetesSandboxStorage {
             await (0, promises_1.rm)(repository, { recursive: true, force: true });
         }
     }
+    // The pod writes the tree's files beside the sandbox on the claim and sends them as a tar,
+    // which is extracted here as the files of `attach` are: what a run plans with, up to the
+    // bytes a sandbox may take.
+    async exportTree(key, tree, into, signal) {
+        await (0, promises_1.mkdir)(into, { recursive: true });
+        let bytes = 0;
+        const extract = (0, tar_1.extract)({
+            cwd: into,
+            filter: (_path, entry) => 'type' in entry && ['File', 'OldFile', 'Directory', 'SymbolicLink'].includes(entry.type),
+        });
+        const counted = new stream_1.PassThrough();
+        counted.on('data', (chunk) => {
+            bytes += chunk.length;
+            if (bytes > this.limits.bytes) {
+                counted.destroy(new Error(`the files of the sandbox ${key.id} take more than ${(0, units_1.formatSize)(this.limits.bytes)}`));
+            }
+        });
+        const extracted = new Promise((resolve, reject) => {
+            extract.on('finish', resolve);
+            extract.on('error', reject);
+            counted.on('error', reject);
+        });
+        extracted.catch(() => undefined);
+        counted.pipe(extract);
+        const answer = await this.exclusive(key.id, () => this.call(key, { op: 'archive', id: key.id, tree }, signal, true));
+        if ('stream' in answer) {
+            // a pipeline, so the answer is ended with the copy: an error of the pod after the copy
+            // stopped (over the size limit) lands nowhere else
+            await (0, promises_2.pipeline)(answer.stream, counted);
+        }
+        else {
+            counted.end(answer.body);
+        }
+        await extracted;
+    }
     async moveTo(key, commit) {
         await this.request(key, { op: 'move', id: key.id, commit }, AbortSignal.timeout(FETCH_TIMEOUT_MS));
     }
@@ -506,7 +541,7 @@ class KubernetesSandboxStorage {
         const reader = new AnswerReader(body);
         // the process ends when the server stops waiting for it: closing the connection does
         // not end a command in a pod
-        const seconds = Math.ceil((['create', 'fetch', 'move'].includes(request.op) ? FETCH_TIMEOUT_MS : REQUEST_TIMEOUT_MS) / 1000);
+        const seconds = Math.ceil((['create', 'fetch', 'move', 'archive'].includes(request.op) ? FETCH_TIMEOUT_MS : REQUEST_TIMEOUT_MS) / 1000);
         const done = this.withPod(key, (pod) => this.exec(pod, ['timeout', String(seconds), 'hammerkit', 'server-sandbox', CLAIM_PATH], stream_1.Readable.from([Buffer.from(JSON.stringify(encoded))]), reader, signal));
         done.then(() => reader.complete(), (e) => reader.fail(e));
         const answer = await reader.answer;
@@ -889,6 +924,11 @@ class AnswerReader extends stream_1.Writable {
     }
     _write(chunk, _encoding, callback) {
         if (this.stream) {
+            if (this.stream.destroyed) {
+                // its reader stopped (over a size limit): the rest of the answer is nobody's
+                callback();
+                return;
+            }
             this.stream.write(chunk, callback);
             return;
         }

package/dist/server/policy.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.decideRun = exports.sandboxRepos = exports.decideSandbox = exports.sandboxPushBranches = exports.sandboxBranchType = exports.endpointLevel = exports.getGrant = exports.usedAccounts = exports.mayYank = exports.canUse = exports.maySeeDefinitions = exports.mayPublish = exports.mayPropose = exports.mayRun = exports.matches = void 0;
+exports.decideRun = exports.sandboxRepos = exports.decideSandbox = exports.sandboxPushBranches = exports.sandboxBranchType = exports.endpointLevel = exports.getGrant = exports.usedAccounts = exports.mayYank = exports.canUse = exports.maySeeDefinitions = exports.mayPublish = exports.mayPropose = exports.mayReadChecks = exports.mayRun = exports.matches = void 0;
 const repo_1 = require("./repo");
 const BUILDS_ORDER = ['run', 'propose', 'publish'];
 function matches(entitlement, principal) {
@@ -22,6 +22,12 @@ function atLeast(grant, level) {
 }
 const mayRun = (grant) => atLeast(grant, 'run');
 exports.mayRun = mayRun;
+// Who may run from a repository's refs may see what passed for its files, and so may who
+// is entitled to just that (a CI job that only verifies).
+function mayReadChecks(grant, repo) {
+    return (grant.checks || grant.builds !== null) && (0, repo_1.matchesAnyRepo)(grant.repos, repo);
+}
+exports.mayReadChecks = mayReadChecks;
 const mayPropose = (grant) => atLeast(grant, 'propose');
 exports.mayPropose = mayPropose;
 const mayPublish = (grant) => atLeast(grant, 'publish');
@@ -57,11 +63,13 @@ function getGrant(entitlements, principal) {
     const sandboxes = [];
     const endpoints = [];
     let builds = null;
+    let checks = false;
     entitlements.forEach((entitlement, index) => {
         if (!matches(entitlement, principal)) {
             return;
         }
         matched.push(index);
+        checks = checks || entitlement.checks === 'read';
         for (const [account, level] of Object.entries(entitlement.accounts)) {
             if (accounts[account] !== 'use') {
                 accounts[account] = level;
@@ -96,7 +104,7 @@ function getGrant(entitlements, principal) {
             }
         }
     });
-    return { accounts, repos, builds, sandboxes, endpoints, matched };
+    return { accounts, repos, builds, sandboxes, endpoints, checks, matched };
 }
 exports.getGrant = getGrant;
 // What the caller may do with the endpoints of service runs of a repository: the higher

package/dist/server/run-request.js

@@ -94,7 +94,13 @@ exports.runRequestSchema = zod_1.z
         zod_1.z.object({ type: zod_1.z.literal('upload'), snapshot: zod_1.z.string().regex(bundle_1.HASH_PATTERN) }).strict(),
         // a sandbox of the caller's, see POST /v1/sandboxes
         zod_1.z
-            .object({ type: zod_1.z.literal('sandbox'), id: zod_1.z.string().regex(runs_1.SANDBOX_ID_PATTERN, 'expected a sandbox id') })
+            .object({
+            type: zod_1.z.literal('sandbox'),
+            id: zod_1.z.string().regex(runs_1.SANDBOX_ID_PATTERN, 'expected a sandbox id'),
+            // a check: run on a copy of the files a push of the sandbox would commit, so what
+            // passes counts for that commit (remote verify)
+            check: zod_1.z.literal(true).optional(),
+        })
             .strict(),
     ]),
     options: exports.runOptionsSchema.default({}),
@@ -144,5 +150,10 @@ exports.runRequestSchema = zod_1.z
     .refine((request) => (request.options.args ?? []).length === 0 || request.tasks.length === 1, {
     message: 'arguments go to one task, name exactly one in tasks',
     path: ['options', 'args'],
+})
+    .refine((request) => request.source.type !== 'sandbox' || !request.source.check || (request.options.args ?? []).length === 0, { message: 'a check runs the task as the build file says, it takes no arguments', path: ['options', 'args'] })
+    .refine((request) => request.source.type !== 'sandbox' || !request.source.check || request.services.length === 0, {
+    message: 'a check runs tasks, a run of services keeps them up and passes nothing',
+    path: ['services'],
 });
 //# sourceMappingURL=run-request.js.map

package/dist/server/run-worker.js

@@ -22,6 +22,7 @@ const work_network_1 = require("../planner/work-network");
 const run_plan_1 = require("./run-plan");
 const runs_1 = require("./runs");
 const resources_1 = require("../kubernetes/resources");
+const check_keys_1 = require("../optimizer/check-keys");
 // one log line of a task is cut here, the registry caps how many events a run keeps
 const MAX_LOG_TEXT = 8 * 1024;
 /**
@@ -69,6 +70,8 @@ exports.workerInputSchema = zod_1.z
     })
         .strict()
         .optional(),
+    // the run's results count as checks: report each task's check key before it runs
+    check: zod_1.z.boolean().optional(),
 })
     .strict();
 // The ceiling of the run, combined here and not in the server: the lower of two allow lists
@@ -183,7 +186,8 @@ up) {
         const options = input.options;
         const execOptions = {
             logMode: 'live',
-            cacheDefault: options.cache ?? 'checksum',
+            // a check takes a cached result only for the same files, never for the same dates
+            cacheDefault: input.check && options.cache === 'modify-date' ? 'checksum' : options.cache ?? 'checksum',
             cacheReadOnly: options.cacheReadOnly ?? false,
             timeout: options.timeout ? (0, units_1.parseDuration)(options.timeout) : null,
             maxTimeout: options.maxTimeout ? (0, units_1.parseDuration)(options.maxTimeout) : null,
@@ -192,7 +196,17 @@ up) {
             // why a task was not taken from the cache goes into its result
             explain: true,
         };
-        for (const { name, scope } of (0, run_plan_1.getRunScopes)(input.tasks, options, input.up?.services)) {
+        const scopes = (0, run_plan_1.getRunScopes)(input.tasks, options, input.up?.services);
+        if (input.check) {
+            // the files as they are before any task wrote to them, a second task's too: a first
+            // one that formats or generates into src would key it by files no commit holds
+            for (const { scope } of scopes) {
+                for (const [task, { key }] of Object.entries(await (0, check_keys_1.getCheckKeys)(input.entry, environment, scope))) {
+                    emit({ type: 'key', task, key });
+                }
+            }
+        }
+        for (const { name, scope } of scopes) {
             const { ctx, scope: parsed } = await (0, schema_parser_1.createParseContext)(input.entry, environment, {
                 directory: input.directory,
             });

package/dist/server/runs.js

@@ -30,6 +30,8 @@ exports.SANDBOX_ID_PATTERN = /^sbx_[A-Za-z0-9_-]{16}$/;
 function onSandbox(run, sandbox) {
     return run.source.type === 'sandbox' && run.source.id === sandbox;
 }
+// the tasks of a run whose check keys are kept, a build file has fewer
+const MAX_KEYED_TASKS = 1000;
 // how much of the end of a task's output its result carries
 const TAIL_LINES = 20;
 const TAIL_LINE_LENGTH = 1000;
@@ -100,6 +102,7 @@ class RunRegistry {
                 bytes: 0,
                 tails: new Map(Object.entries(run.results ?? {}).map(([task, result]) => [task, result.lastLog])),
                 saving: Promise.resolve(),
+                keys: {},
             };
             this.entries.set(run.id, entry);
             if (run.state === 'awaiting-approval') {
@@ -166,6 +169,7 @@ class RunRegistry {
             bytes: 0,
             tails: new Map(),
             saving: Promise.resolve(),
+            keys: {},
         };
         this.entries.set(run.id, entry);
         if (waiting) {
@@ -790,9 +794,23 @@ class RunRegistry {
         }
         this.record(entry, { type: 'state', state, ...(error ? { error } : {}) }, true);
         entry.listeners.clear();
+        try {
+            this.options.onFinished?.(this.copy(entry.run), { ...entry.keys });
+        }
+        catch (e) {
+            this.options.log?.(`run ${entry.run.id} ended, but what it passed was not kept: ${e instanceof Error ? e.message : e}`);
+        }
         this.evict();
     }
     record(entry, recorded, force = false) {
+        if (recorded.type === 'key') {
+            // a task name is the executor's; the first key it reports for a task is the one
+            // computed before anything of the run had run
+            if (!(recorded.task in entry.keys) && Object.keys(entry.keys).length < MAX_KEYED_TASKS) {
+                entry.keys[recorded.task] = recorded.key;
+            }
+            return;
+        }
         const event = recorded.type === 'task' ? bounded(recorded) : recorded;
         if (event.type === 'log') {
             this.keepTail(entry, event.task, event.text);

package/dist/server/sandbox-pod.js

@@ -1,12 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.sandboxPodMain = exports.decodePodError = exports.encodeEditOps = exports.INCOMING_REF = exports.INCOMING = void 0;
+const crypto_1 = require("crypto");
 const promises_1 = require("fs/promises");
 const path_1 = require("path");
 const url_1 = require("url");
 const git_checkout_1 = require("./git-checkout");
 const sandbox_files_1 = require("./sandbox-files");
 const sandbox_storage_1 = require("./sandbox-storage");
+const tar_1 = require("../utils/tar");
 // On a cluster a sandbox is a claim, and what the server does with its files runs in a
 // short pod that mounts it (see KubernetesSandboxStorage): `hammerkit server-sandbox
 // <directory>` reads one request on its standard input, does it with the code of a host
@@ -91,6 +93,32 @@ async function answer(storage, directory, request, out) {
             }
             return send({ files: plan.files, bytes: plan.bytes });
         }
+        case 'archive': {
+            // written beside the sandbox on the claim, sent, and removed
+            const into = (0, path_1.join)(directory, `${request.id}-archive-${(0, crypto_1.randomBytes)(6).toString('hex')}`);
+            try {
+                await storage.exportTree(key, request.tree, into, AbortSignal.timeout(10 * 60000));
+                await write(out, JSON.stringify({ ok: true, result: null, stream: true }) + '\n');
+                const pack = (0, tar_1.packArchive)({ cwd: into, portable: true }, ['.']);
+                try {
+                    for await (const chunk of pack) {
+                        await write(out, chunk);
+                    }
+                }
+                catch (e) {
+                    throw new AnswerStarted(e instanceof Error ? e.message : String(e));
+                }
+                finally {
+                    // a reader that went away (over its size limit) leaves the pack reading files
+                    // that are removed next: what fails then is no answer of anybody's
+                    pack.on('error', () => undefined);
+                }
+                return;
+            }
+            finally {
+                await (0, promises_1.rm)(into, { recursive: true, force: true });
+            }
+        }
         case 'raw': {
             const raw = await files().raw(request.path);
             const header = {

package/dist/server/sandbox-storage.js

@@ -276,6 +276,29 @@ class HostSandboxStorage {
     // files change, and what it wrote to the git data is pruned again. Files a task made
     // unreadable are made readable first: git would leave them out and call the sandbox
     // clean.
+    async exportTree({ id }, tree, into, signal) {
+        if (!/^[0-9a-f]{40}([0-9a-f]{24})?$/.test(tree)) {
+            throw new Error(`${JSON.stringify(tree.slice(0, 80))} is not a git tree`);
+        }
+        return this.withIndex(id, signal, async (run) => {
+            const now = (await run(['write-tree'], 'read')).trim();
+            if (now !== tree) {
+                throw new Error(`the files of the sandbox ${id} are ${now} now, not ${tree}`);
+            }
+            // an index of its own holds the tree alone, whatever the sandbox's index says of its
+            // entries; the files are written as git has them, through no filter of the server's
+            const index = (0, path_1.join)(this.root(id), `export-${(0, crypto_1.randomBytes)(6).toString('hex')}`);
+            await (0, promises_1.mkdir)(into, { recursive: true });
+            try {
+                const env = this.readEnv({ GIT_INDEX_FILE: index });
+                await this.git(id, ['read-tree', tree], env, signal, 'read');
+                await this.git(id, ['checkout-index', '--all', '--force', `--prefix=${(0, path_1.join)(into, '/')}`], env, signal, 'read');
+            }
+            finally {
+                await (0, promises_1.rm)(index, { force: true });
+            }
+        });
+    }
     async state({ id }, signal = AbortSignal.timeout(5 * 60 * 1000)) {
         return this.withIndex(id, signal, async (run) => {
             const tree = (await run(['write-tree'], 'read')).trim();

package/dist/server/sandboxes.js

@@ -412,6 +412,14 @@ class SandboxRegistry {
     async state(id, signal) {
         return this.options.storage.state(keyOf(this.existing(id)), signal);
     }
+    // The files of `tree`, which the sandbox's files must be now, written into `into`: what a
+    // check runs on.
+    async exportTree(id, tree, into, signal) {
+        const sandbox = this.existing(id);
+        sandbox.lastUsedAt = this.timestamp();
+        await this.save(sandbox);
+        await this.options.storage.exportTree(keyOf(sandbox), tree, into, signal);
+    }
     // What a run works on, `into` a directory of the run when the storage copies the files;
     // the run is the sandbox's use.
     async attach(id, into) {

package/dist/server/server-config.js

@@ -341,6 +341,9 @@ exports.entitlementSchema = zod_1.z
     // the repositories (`host/path` patterns) the caller may run from a git ref
     repos: zod_1.z.array(repoPatternSchema).default([]),
     builds: exports.buildsLevelSchema.optional(),
+    // `read`: may look up which tasks runs passed for files of the `repos` (remote verify),
+    // and nothing more; a builds level includes it
+    checks: zod_1.z.literal('read').optional(),
     // the repositories the caller may keep sandboxes of, checkouts on the server that runs
     // work on: a list of its own, the `repos` above are for runs from a ref
     sandboxes: zod_1.z.array(exports.sandboxGrantSchema).optional(),
@@ -352,11 +355,19 @@ exports.entitlementSchema = zod_1.z
     checkWho(entitlement, ctx);
     if (Object.keys(entitlement.accounts).length === 0 &&
         entitlement.builds === undefined &&
+        entitlement.checks === undefined &&
         !entitlement.sandboxes?.length &&
         !entitlement.endpoints?.length) {
         ctx.addIssue({
             code: zod_1.z.ZodIssueCode.custom,
-            message: 'name accounts to use or request, a builds level, sandboxes or endpoints',
+            message: 'name accounts to use or request, a builds level, checks, sandboxes or endpoints',
+        });
+    }
+    if (entitlement.checks && entitlement.repos.length === 0) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['repos'],
+            message: 'checks are read for repositories: name them in repos',
         });
     }
 });
@@ -509,6 +520,8 @@ exports.serverConfigSchema = zod_1.z
         })
             .strict()
             .default({}),
+        // how long a passed check stays for `remote verify` to find (see checks.ts)
+        checksKeep: duration.default('30d'),
     })
         .strict()
         .default({}),