hammerkit 1.27.0-next.16 → 1.27.0-next.18

package/dist/executer/execution-steps.js

@@ -89,8 +89,11 @@ exports.prepareMounts = prepareMounts;
 async function setUserPermissions(item, container, environment) {
     if (item.data.user) {
         // On a server only the volumes: a chown as the container's root on a path of the host
-        // would follow a link a task put there after the binds were checked
-        const binds = (0, get_container_binds_1.getContainerBinds)(item).filter((bind) => !environment.hosted || !(0, path_1.isAbsolute)(bind.localPath));
+        // would follow a link a task put there after the binds were checked. Never a mount: it
+        // is a path of the host the build file names, such as /var/run/docker.sock, whose owner
+        // is not hammerkit's to change
+        const mounted = new Set(item.data.mounts.map((mount) => mount.containerPath));
+        const binds = (0, get_container_binds_1.getContainerBinds)(item).filter((bind) => !mounted.has(bind.containerPath) && (!environment.hosted || !(0, path_1.isAbsolute)(bind.localPath)));
         if (!environment.hosted) {
             await (0, set_user_permission_1.setUserPermission)(item.data.cwd, item.status, environment, container, item.data.user);
         }

package/dist/executer/scheduler/state-key.js

@@ -1,7 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.computeStateKey = exports.combineStateKeys = exports.resolveEffective = void 0;
-const crypto_1 = require("crypto");
+exports.computeStateKey = exports.combineStateKeys = exports.isOwnProvable = exports.resolveEffective = void 0;
 const get_work_cache_stats_1 = require("../../optimizer/get-work-cache-stats");
 // The state-key engine is shared by the scheduler's hit/miss decision
 // (`checkCacheState`) and the read-only cache-explain engine, so a prediction
@@ -24,6 +23,7 @@ function isOwnProvable(item, unmatched) {
     // unmatched ⊆ declared, so this is also false when nothing is declared
     return unmatched.length < item.data.src.filter((src) => !src.inherited).length;
 }
+exports.isOwnProvable = isOwnProvable;
 // Fold a task's own state key together with the state keys of its dependencies.
 // A change anywhere in the dependency subtree must change the resulting key, so
 // that a downstream task is invalidated when an upstream source changes — even
@@ -34,9 +34,7 @@ function combineStateKeys(ownKey, depKeys) {
     }
     // Sort so the key is independent of dependency declaration order.
     const sorted = [...depKeys].sort();
-    return (0, crypto_1.createHash)('md5')
-        .update([ownKey, ...sorted].join(','))
-        .digest('hex');
+    return (0, get_work_cache_stats_1.stateKeyDigest)([ownKey, ...sorted].join(','));
 }
 exports.combineStateKeys = combineStateKeys;
 // `none` only disables the cache *check* for a task; its sources still influence
@@ -72,7 +70,41 @@ async function computeStateKey(item, defaultCacheMethod, environment, memo = new
         depKeys.push(effective.stateKey);
         provable = provable && effective.provable;
     }
+    // what a task that needs a service passed against: the sources of the service and of the
+    // tasks it depends on (its definition is in the task id, getWorkServiceCacheIdentity)
+    for (const need of item.needs) {
+        const effective = await resolveNeedStateKey(need.service, defaultCacheMethod, environment, memo);
+        depKeys.push(`${need.name}=${effective.stateKey}`);
+    }
     return { stateKey: combineStateKeys(ownKey, depKeys), stats, resolved, provable, unmatched };
 }
 exports.computeStateKey = computeStateKey;
+// A needed service's sources folded with the state keys of its dependencies and needs. It
+// does not make the task that needs it unprovable: a dependency without `src` (resetting the
+// service's data, say) is skipped with the service when the task is a cache hit.
+async function resolveNeedStateKey(service, defaultCacheMethod, environment, memo) {
+    const memoKey = `need\0${service.name}`;
+    const existing = memo.get(memoKey);
+    if (existing !== undefined) {
+        return existing;
+    }
+    // services that need each other in a loop fail to plan (checkForLoop): this only has to end
+    memo.set(memoKey, { stateKey: 'loop', provable: true });
+    const resolved = resolveEffective(service, defaultCacheMethod);
+    const { stats } = await (0, get_work_cache_stats_1.getWorkItemCacheStats)(service, environment);
+    const keys = [];
+    for (const dep of service.deps) {
+        keys.push((await resolveEffectiveStateKey(dep, defaultCacheMethod, environment, memo)).stateKey);
+    }
+    for (const need of service.needs) {
+        const effective = await resolveNeedStateKey(need.service, defaultCacheMethod, environment, memo);
+        keys.push(`${need.name}=${effective.stateKey}`);
+    }
+    const effective = {
+        stateKey: combineStateKeys((0, get_work_cache_stats_1.getStateKey)(stats, concreteMethod(resolved, defaultCacheMethod)), keys),
+        provable: true,
+    };
+    memo.set(memoKey, effective);
+    return effective;
+}
 //# sourceMappingURL=state-key.js.map

package/dist/harness/mcp.js

@@ -35,7 +35,7 @@ function sandboxPath(path) {
  * of `run_task` lists; without `shell` there is no `bash`.
  */
 function createMcpTools(client, options = {}) {
-    const [runTask, runLogs] = (0, task_tools_1.createTaskTools)(options.tasks, options.shell || undefined).map((tool) => fromTaskTool(tool, client));
+    const [runTask, runLogs, check] = (0, task_tools_1.createTaskTools)(options.tasks, options.shell || undefined).map((tool) => fromTaskTool(tool, client));
     const bash = {
         name: 'bash',
         description: 'Run a shell command on the sandbox and answer its output and exit code. It runs as the shell task of ' +
@@ -196,6 +196,7 @@ function createMcpTools(client, options = {}) {
         },
         ...(options.shell === false ? [] : [bash]),
         runTask,
+        check,
         { ...runLogs, annotations: { ...runLogs.annotations, ...READ_ONLY } },
         {
             name: 'changes',

package/dist/harness/opencode.js

@@ -65,6 +65,7 @@ exports.OPENCODE_TOOLS = [
     'glob',
     'run_task',
     'run_logs',
+    'check',
     'push',
     'list',
     'services_up',
@@ -154,6 +155,7 @@ exports.OPENCODE_V2_TOOLS = [
     'grep',
     'run_task',
     'run_logs',
+    'check',
     'push',
     'services_up',
     'endpoint_get',
@@ -270,7 +272,7 @@ function createOpencodeV2Tools(client, directory, options = {}) {
             caseSensitive: flag('Match case (default true)'),
             limit: count(`The maximum number of matching lines (default ${SEARCH_LIMIT})`),
         }, ['pattern']), same),
-        ...['run_task', 'run_logs'].map((name) => tool(name, name, { ...(0, task_tools_1.taskToolSchema)(taskTools[name]), additionalProperties: false }, same)),
+        ...['run_task', 'run_logs', 'check'].map((name) => tool(name, name, { ...(0, task_tools_1.taskToolSchema)(taskTools[name]), additionalProperties: false }, same)),
         tool('push', 'push', object({
             branch: text('The branch to push to, created when it does not exist'),
             message: text('The commit message'),
@@ -317,7 +319,12 @@ function opencodeTools(client, options = {}) {
             args: (z) => (0, task_tools_1.taskToolArgs)(task, z),
             async execute(args, context) {
                 const output = await task.call(await client(), args, context.abort);
-                return { title: task.name === 'run_task' ? `run ${args.task}` : `log of ${args.run}`, output };
+                return {
+                    title: task.name === 'run_logs'
+                        ? `log of ${args.run}`
+                        : `${task.name === 'check' ? 'check' : 'run'} ${args.task}`,
+                    output,
+                };
             },
         },
     ]));

package/dist/harness/pi.js

@@ -192,6 +192,21 @@ function hammerkitPiExtension(library, settings = {}) {
                 },
             });
         }
+        register({
+            name: 'check',
+            label: 'check',
+            description: sandbox_client_1.CHECK_DESCRIPTION,
+            promptSnippet: 'Run a task as a check that CI verifies after the push',
+            parameters: {
+                type: 'object',
+                properties: { task: { type: 'string', description: 'The name of the task' } },
+                required: ['task'],
+            },
+            execute: async (_id, params, signal) => {
+                const text = await (0, sandbox_client_1.runCheck)(await client(), params.task, signal);
+                return { content: [{ type: 'text', text }], details: { task: params.task } };
+            },
+        });
         pi.on('session_start', async (_event, ctx) => {
             try {
                 const sandbox = await client();

package/dist/harness/sandbox-client.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.quotePosix = exports.fetchFailure = exports.toSandboxPath = exports.checkSandboxPath = exports.exitCodeOf = exports.followRun = exports.submitRun = exports.FINAL_RUN_STATES = exports.oneAtATime = exports.SandboxClient = exports.listPublishedTasks = exports.SandboxClientError = void 0;
+exports.quotePosix = exports.fetchFailure = exports.toSandboxPath = exports.checkSandboxPath = exports.exitCodeOf = exports.followRun = exports.submitRun = exports.FINAL_RUN_STATES = exports.oneAtATime = exports.SandboxClient = exports.listPublishedTasks = exports.runCheck = exports.CHECK_DESCRIPTION = exports.SandboxClientError = void 0;
 const path_1 = require("path");
 const token_source_1 = require("../remote/token-source");
 // a write carries up to 32 MiB
@@ -16,6 +16,30 @@ class SandboxClientError extends Error {
     }
 }
 exports.SandboxClientError = SandboxClientError;
+// What the agent is told of a check, on each harness.
+exports.CHECK_DESCRIPTION = 'Run a task as a check before you push, such as test or e2e: it runs on a copy of the files a push ' +
+    'would commit (what .gitignore leaves out is not there, so dependencies are installed by the tasks ' +
+    'the build file names), and when it passes, CI verifies it for that commit instead of running it. ' +
+    'Push without changing files afterwards, or the check no longer counts for the files that changed.';
+// A check, run to its end, in a few lines: how it went and the last lines of a failure.
+async function runCheck(client, task, signal) {
+    const ran = await client.runTask(task, { check: true, signal });
+    const result = ran.result;
+    const lines = [
+        result?.status === 'succeeded' || result?.status === 'cached'
+            ? `check ${task} passed (run ${ran.run.id}${result.status === 'cached' ? ', from the cache' : ''}): CI can verify it for a push of these files`
+            : `check ${task} did not pass (run ${ran.run.id}: ${result?.status ?? ran.run.state}${result?.exitCode !== undefined ? `, exit code ${result.exitCode}` : ''})`,
+    ];
+    const error = result?.error ?? ran.run.error;
+    if (error) {
+        lines.push(`error: ${error}`);
+    }
+    if (result && result.status !== 'succeeded' && result.status !== 'cached' && result.lastLog.length > 0) {
+        lines.push('last lines:', ...result.lastLog);
+    }
+    return lines.join('\n');
+}
+exports.runCheck = runCheck;
 /**
  * The tasks of a published version, without its services, as `GET /v1/definitions/<hash>`
  * answers them.
@@ -143,7 +167,7 @@ class SandboxClient {
         const submitted = await submitRun(this.connection, {
             definition: this.build.hash,
             tasks: [task],
-            source: { type: 'sandbox', id: this.id },
+            source: { type: 'sandbox', id: this.id, ...(options.check ? { check: true } : {}) },
             options: runOptions,
         });
         const followed = await followRun(this.connection, submitted, {

package/dist/harness/task-tools.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.taskToolArgs = exports.taskToolSchema = exports.createTaskTools = exports.describeTasks = exports.describeRun = exports.readLogHint = exports.readTaskListing = exports.LIST_TASKS_MS = void 0;
+const sandbox_client_1 = require("./sandbox-client");
 // the most tasks a description lists, and of a task's description or command it shows
 const MAX_LISTED = 40;
 const MAX_DESCRIPTION_CHARS = 200;
@@ -100,7 +101,7 @@ function cut(text, max) {
     return text.length > max ? `${text.slice(0, max)}…` : text;
 }
 /**
- * `run_task` and `run_logs`, with the tasks the description of `run_task` lists. Without a
+ * `run_task`, `run_logs` and `check`, with the tasks the description of `run_task` lists. Without a
  * listing it names none, as the MCP tools before a version could be read.
  */
 function createTaskTools(listing, shell) {
@@ -160,6 +161,16 @@ function createTaskTools(listing, shell) {
                 return lines.join('\n');
             },
         },
+        {
+            name: 'check',
+            title: 'Run a check',
+            description: sandbox_client_1.CHECK_DESCRIPTION,
+            parameters: { task: { type: 'string', description: 'The name of the task' } },
+            required: ['task'],
+            call(client, args, signal) {
+                return (0, sandbox_client_1.runCheck)(client, args.task, signal);
+            },
+        },
     ];
 }
 exports.createTaskTools = createTaskTools;

package/dist/optimizer/calculate-checksum.js

@@ -4,9 +4,10 @@ exports.calculateChecksum = void 0;
 const crypto_1 = require("crypto");
 // Hashes the raw bytes: decoding to text first would map every invalid UTF-8
 // sequence to U+FFFD, so two different binary files could share a checksum.
-// For UTF-8 text the result is unchanged.
+// For UTF-8 text the result is unchanged. sha256, which nobody can make two files share:
+// a cache hit is also what a verified check counts (check-key.ts).
 async function calculateChecksum(environment, path) {
-    const hash = (0, crypto_1.createHash)('sha1');
+    const hash = (0, crypto_1.createHash)('sha256');
     for await (const chunk of environment.file.readStream(path)) {
         hash.update(chunk);
     }

package/dist/optimizer/check-key.js

@@ -0,0 +1,94 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getCheckKey = void 0;
+const crypto_1 = require("crypto");
+const state_key_1 = require("../executer/scheduler/state-key");
+const get_work_cache_stats_1 = require("./get-work-cache-stats");
+const work_task_cache_description_1 = require("./work-task-cache-description");
+/**
+ * What a passed check is recorded under, and what `remote verify` looks it up by: the
+ * inputs of the task's cache key, so a cached result counts for the same key it was
+ * stored under. Its definition (the services it needs included), the files of its `src`,
+ * the keys of its dependencies, and the sources of the services it needs and of the tasks
+ * they depend on.
+ *
+ * It is computed on a checkout before anything ran in it, on both ends, so it also covers
+ * the files a commit holds where a dependency generates (the cache leaves those out, as
+ * they change once the dependency ran), and it leaves out `.git`, which is no file of a
+ * commit. Two checkouts of the same files give the same key wherever they are.
+ * Null for a task that can not be proven up to date (no `src` of its own, or none that
+ * matches a file, here or in a dependency): its result says nothing about any files.
+ */
+async function getCheckKey(item, environment, memo = new Map(), path = new Set()) {
+    return memoized(memo, path, `task\0${item.id()}`, (inner) => computeCheckKey(item, environment, memo, inner));
+}
+exports.getCheckKey = getCheckKey;
+async function computeCheckKey(item, environment, memo, path) {
+    const { stats, unmatched } = await (0, get_work_cache_stats_1.getWorkItemCheckoutStats)(item, environment);
+    if (!(0, state_key_1.isOwnProvable)(item, unmatched)) {
+        return null;
+    }
+    const inputs = await getInputKeys(item, environment, memo, path);
+    if (inputs === null) {
+        return null;
+    }
+    return hash({ task: (0, work_task_cache_description_1.getWorkTaskCacheDescription)(item), files: commitFiles(stats), ...inputs });
+}
+// The sources of a needed service, with the keys of what it depends on and needs; its
+// definition is in the description of the task that needs it.
+function getNeedKey(item, environment, memo, path) {
+    return memoized(memo, path, `need\0${item.name}`, async (inner) => {
+        const inputs = await getInputKeys(item, environment, memo, inner);
+        if (inputs === null) {
+            return null;
+        }
+        return hash({ files: commitFiles(await (0, get_work_cache_stats_1.getWorkCacheStats)(item.data, environment)), ...inputs });
+    });
+}
+async function getInputKeys(item, environment, memo, path) {
+    const deps = [];
+    for (const dep of item.deps) {
+        const key = await getCheckKey(dep, environment, memo, path);
+        if (key === null) {
+            return null;
+        }
+        deps.push(key);
+    }
+    const needs = [];
+    for (const need of item.needs) {
+        const key = await getNeedKey(need.service, environment, memo, path);
+        if (key === null) {
+            return null;
+        }
+        needs.push(`${need.name}=${key}`);
+    }
+    return { deps: deps.sort(), needs: needs.sort() };
+}
+// a commit never holds `.git`: what a checkout keeps there differs between a CI job's clone,
+// the server's fetch and a sandbox's copy, which has none
+function commitFiles(stats) {
+    return Object.keys(stats.files)
+        .filter((path) => !path.split('/').includes('.git'))
+        .sort()
+        .map((path) => [path, stats.files[path].checksum]);
+}
+function hash(value) {
+    return (0, crypto_1.createHash)('sha256').update(JSON.stringify(value)).digest('hex');
+}
+// `path` holds the keys being computed on the way here: one coming back is a loop (services
+// that need each other), which can not be proven and fails to plan anyway. Waiting on its
+// pending promise would never end. The keys are computed one after another, so every pending
+// promise in the memo is on the path.
+function memoized(memo, path, key, compute) {
+    if (path.has(key)) {
+        return Promise.resolve(null);
+    }
+    const known = memo.get(key);
+    if (known) {
+        return known;
+    }
+    const computed = compute(new Set([...path, key]));
+    memo.set(key, computed);
+    return computed;
+}
+//# sourceMappingURL=check-key.js.map

package/dist/optimizer/check-keys.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getCheckKeys = void 0;
+const plan_work_tasks_1 = require("../planner/utils/plan-work-tasks");
+const reference_parser_1 = require("../schema/reference-parser");
+const schema_parser_1 = require("../schema/schema-parser");
+const work_scope_parser_1 = require("../schema/work-scope-parser");
+const log_1 = require("../log");
+const check_key_1 = require("./check-key");
+/**
+ * The check keys of the tasks of a scope, as both ends compute them: the process of a run on
+ * the server before it executes anything, and `remote verify` in a CI job's checkout. So the
+ * build file is read the same way on both, as a server reads it (no `.env`, links are files)
+ * but placed nowhere: where a server runs a task (a pool, its tool image, the arch of its
+ * nodes) is the server's, and a result counts for the server it passed on. The secrets'
+ * providers and accounts are the server's too, and no part of a key, so any is taken here.
+ */
+async function getCheckKeys(entry, environment, scope) {
+    const keyed = { ...environment, hosted: { catalog: anyCatalog(), localTasksInContainers: true } };
+    const { ctx, scope: parsed } = await (0, schema_parser_1.createParseContext)(entry, keyed);
+    const workTree = (0, work_scope_parser_1.getWorkContext)(await (0, reference_parser_1.parseReferences)(ctx, parsed, keyed), scope, keyed);
+    const memo = new Map();
+    const keys = {};
+    for (const task of (0, plan_work_tasks_1.iterateWorkTasks)(workTree)) {
+        try {
+            const key = await (0, check_key_1.getCheckKey)(task, keyed, memo);
+            keys[task.name] = key
+                ? { key }
+                : {
+                    key: null,
+                    reason: 'it, or a task it or a service it needs depends on, declares no src that matches a file',
+                };
+        }
+        catch (e) {
+            // a secret whose value is part of the key (`cache: true`) is not known here
+            keys[task.name] = { key: null, reason: (0, log_1.getErrorMessage)(e) };
+        }
+    }
+    return keys;
+}
+exports.getCheckKeys = getCheckKeys;
+// Every provider and account name resolves, to a definition nothing runs.
+function anyCatalog() {
+    const provider = (name) => ({
+        name,
+        type: 'command',
+        command: [],
+        env: {},
+        timeoutMs: 0,
+        declaredIn: 'the server',
+    });
+    const account = (name) => ({
+        name,
+        default: false,
+        providers: new Proxy({}, { get: () => ({ env: {} }) }),
+        declaredIn: 'the server',
+    });
+    return {
+        providers: new Proxy({}, { get: (_target, name) => (typeof name === 'string' ? provider(name) : undefined) }),
+        accounts: new Proxy({}, { get: (_target, name) => (typeof name === 'string' ? account(name) : undefined) }),
+        explicitAccounts: true,
+    };
+}
+//# sourceMappingURL=check-keys.js.map

package/dist/optimizer/get-work-cache-stats.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getStateKey = exports.getWorkItemCacheStats = exports.getWorkCacheStats = void 0;
+exports.stateKeyDigest = exports.getStateKey = exports.getWorkItemCheckoutStats = exports.getWorkItemCacheStats = exports.getWorkCacheStats = void 0;
 const calculate_checksum_1 = require("./calculate-checksum");
 const path_1 = require("path");
 const crypto_1 = require("crypto");
@@ -20,7 +20,7 @@ async function addWorkCacheStats(result, cwd, path, matcher, context, root, excl
             if (!matcher(path)) {
                 return 0;
             }
-            const checksum = (0, crypto_1.createHash)('sha1')
+            const checksum = (0, crypto_1.createHash)('sha256')
                 .update(`link:${await (0, promises_1.readlink)(path)}`)
                 .digest('hex');
             result.files[(0, path_1.relative)(cwd, path).split(path_1.sep).join(path_1.posix.sep)] = { lastModified: link.mtimeMs, checksum };
@@ -85,6 +85,13 @@ function getWorkItemCacheStats(item, environment) {
     return collectSourceStats(item.data, environment, dependencyOutputs(item));
 }
 exports.getWorkItemCacheStats = getWorkItemCacheStats;
+// The source stats of a task with what its dependencies generate: on a checkout nothing ran
+// in, those are the files a commit holds there, see check-key.ts.
+async function getWorkItemCheckoutStats(item, environment) {
+    const { stats } = await collectSourceStats(item.data, environment, []);
+    return { stats, unmatched: (await getWorkItemCacheStats(item, environment)).unmatched };
+}
+exports.getWorkItemCheckoutStats = getWorkItemCheckoutStats;
 function dependencyOutputs(item) {
     const outputs = new Set();
     const visited = new Set();
@@ -113,7 +120,14 @@ function getStateKey(stats, cacheMethod) {
             contents.push(`${key}:${stats.files[key].lastModified}`);
         }
     }
-    return (0, crypto_1.createHash)('md5').update(contents.join(',')).digest('hex');
+    return stateKeyDigest(contents.join(','));
 }
 exports.getStateKey = getStateKey;
+// A state key is also the value of the `hammerkit.dev/state` label on Kubernetes, which
+// takes at most 63 characters: the sha256 in base 36 has 50.
+function stateKeyDigest(content) {
+    const hex = (0, crypto_1.createHash)('sha256').update(content).digest('hex');
+    return BigInt(`0x${hex}`).toString(36).padStart(50, '0');
+}
+exports.stateKeyDigest = stateKeyDigest;
 //# sourceMappingURL=get-work-cache-stats.js.map

package/dist/optimizer/work-task-cache-description.js

@@ -1,12 +1,15 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.storedCacheDescription = exports.getWorkTaskCacheDescription = void 0;
+exports.storedCacheDescription = exports.getWorkServiceCacheIdentity = exports.getWorkTaskCacheDescription = void 0;
 const os_1 = require("os");
 const crypto_1 = require("crypto");
 const replace_env_variables_1 = require("../environment/replace-env-variables");
 const portable_path_1 = require("../planner/utils/portable-path");
 const work_secret_1 = require("../planner/work-secret");
 const claim_layout_1 = require("../kubernetes/claim-layout");
+const work_service_1 = require("../planner/work-service");
+const work_service_id_1 = require("../planner/work-service-id");
+const work_cache_id_1 = require("../planner/work-cache-id");
 // Every path is made project-relative (portablePath) so the description, and the
 // task id hashed from it, is identical wherever the project is checked out.
 //
@@ -42,9 +45,54 @@ function getWorkTaskCacheDescription(item) {
         deps: item.deps.length > 0 ? item.deps.map((dep) => dep.id()).sort() : undefined,
         secrets: cachedSecrets.length > 0 ? cachedSecrets : undefined,
         claimLayout: (0, claim_layout_1.hasPathsEndingAlike)(item) || (0, claim_layout_1.hasOutputsFlatteningAlike)(item) ? 2 : undefined,
+        needs: item.needs.length > 0 ? getNeedsIdentities(item) : undefined,
     };
 }
 exports.getWorkTaskCacheDescription = getWorkTaskCacheDescription;
+// `visiting` holds the services on the way here: services that need each other in a loop
+// fail to plan (checkForLoop), the identity only has to come back to say so
+function getNeedsIdentities(item, visiting = new Set()) {
+    return (item.needs
+        // an init task needs the service it initializes, whose identity holds the init's id
+        .filter((need) => !isInitOf(item, need.service))
+        .map((need) => visiting.has(need.service)
+        ? `${need.name}=loop`
+        : `${need.name}=${getWorkServiceCacheIdentity(need.service, visiting)}`)
+        .sort());
+}
+function isInitOf(item, service) {
+    return (0, work_service_1.isContainerWorkService)(service.data) && service.data.init?.task.data === item.data;
+}
+// Everything that makes a service what a task needing it talks to: its definition, the ids of
+// the tasks it depends on and of its init task, and the services it needs in turn. The source
+// of those tasks and of the service is in the state key (computeStateKey), like a dependency's.
+// Not the service id, which leaves out what a service runs (getWorkServiceId).
+function getWorkServiceCacheIdentity(item, visiting = new Set()) {
+    const service = item.data;
+    const definition = (0, work_service_1.isContainerWorkService)(service)
+        ? {
+            cmd: service.cmd?.cmd ?? null,
+            envs: (0, replace_env_variables_1.getEnvironmentVariables)(service.envs),
+            healthcheck: service.healthcheck?.cmd.cmd ?? null,
+            secrets: service.secrets
+                .filter((secret) => secret.cache)
+                .map((secret) => `${(0, work_secret_1.getPortableSecretName)(service.projectRoot, secret)}=${secret.digest()}`)
+                .sort(),
+            // as declared: arguments after -- of a run of the init leave the service as it is
+            init: service.init ? (0, work_cache_id_1.getDeclaredWorkTaskId)(service.init.task) : null,
+        }
+        : { namespace: service.namespace };
+    return (0, crypto_1.createHash)('sha256')
+        .update(JSON.stringify({
+        id: (0, work_service_id_1.getWorkServiceId)(service),
+        ...definition,
+        ports: service.ports.map((port) => `${port.hostPort ?? ''}:${port.containerPort}`).sort(),
+        deps: item.deps.map((dep) => dep.id()).sort(),
+        needs: getNeedsIdentities(item, new Set([...visiting, item])),
+    }))
+        .digest('hex');
+}
+exports.getWorkServiceCacheIdentity = getWorkServiceCacheIdentity;
 // The form written to disk: description.json in a cache entry (pushed to remote
 // backends, readable by everyone who can pull) and the local explain record.
 // Env is where tokens get passed, so each value is stored as a digest; the task

package/dist/planner/utils/normalize-path.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.normalizePath = void 0;
+exports.normalizeHostPath = exports.getHomeReference = exports.normalizePath = void 0;
 const path_1 = require("path");
 function normalizePath(cwd, pwd, path) {
     if (path.startsWith('/')) {
@@ -14,4 +14,22 @@ function normalizePath(cwd, pwd, path) {
     }
 }
 exports.normalizePath = normalizePath;
+// What a path of the host starts with to name the home directory: `~` and `$HOME`, and
+// `$PWD`, which in a mount has always meant the home directory, not the project it reads like
+function getHomeReference(path) {
+    for (const reference of ['~', '$HOME']) {
+        if (path === reference || path.startsWith(`${reference}/`) || path.startsWith(`${reference}\\`)) {
+            return reference;
+        }
+    }
+    return path.startsWith('$PWD') ? '$PWD' : null;
+}
+exports.getHomeReference = getHomeReference;
+// A path of the host in a mount: in the home directory when it starts with one of the
+// references above, else in the directory of the build file unless it is absolute
+function normalizeHostPath(cwd, home, path) {
+    const reference = getHomeReference(path);
+    return reference ? (0, path_1.join)(home, path.substring(reference.length)) : normalizePath(cwd, home, path);
+}
+exports.normalizeHostPath = normalizeHostPath;
 //# sourceMappingURL=normalize-path.js.map

package/dist/planner/utils/parse-work-mount.js

@@ -7,6 +7,12 @@ const path_1 = require("path");
 function parseWorkMount(cwd, dir) {
     const parts = dir.split(':');
     if (parts.length === 1) {
+        const home = (0, normalize_path_1.getHomeReference)(dir);
+        if (home === '~' || home === '$HOME') {
+            // the container has no such directory: the same path on both sides would be one of the
+            // project there (`$PWD` has always been, so it stays)
+            throw new Error(`mount ${dir} is in the home directory, name where it goes in the container (${dir}:/path)`);
+        }
         return parseLocalMount(cwd, dir, dir, dir, false);
     }
     else if (parts.length === 2) {
@@ -22,7 +28,7 @@ function parseWorkMount(cwd, dir) {
 exports.parseWorkMount = parseWorkMount;
 function parseLocalMount(cwd, localPath, containerPath, mount, readOnly) {
     return {
-        localPath: (0, normalize_path_1.normalizePath)(cwd, (0, os_1.homedir)(), localPath),
+        localPath: (0, normalize_path_1.normalizeHostPath)(cwd, (0, os_1.homedir)(), localPath),
         containerPath: (0, normalize_path_1.normalizePath)(cwd, cwd, containerPath),
         isFile: (0, path_1.extname)(localPath).length > 1,
         mount,

package/dist/planner/validate.js

@@ -4,6 +4,7 @@ exports.checkIfContextExists = exports.hasDependencyCycle = exports.hasNeedCycle
 const read_build_file_1 = require("../parser/read-build-file");
 const plan_work_tasks_1 = require("./utils/plan-work-tasks");
 const unreferenced_build_file_envs_1 = require("./unreferenced-build-file-envs");
+const normalize_path_1 = require("./utils/normalize-path");
 async function* validate(workTree, context) {
     const cycleItems = [];
     for (const item of (0, plan_work_tasks_1.iterateWorkServices)(workTree)) {
@@ -16,6 +17,10 @@ async function* validate(workTree, context) {
                 yield { type: 'warn', message: 'missing healthcheck', item: service };
             }
             for (const mount of service.mounts) {
+                const pwd = getPwdMountWarning(mount);
+                if (pwd) {
+                    yield { type: 'warn', message: pwd, item: service };
+                }
                 if (!(await context.file.exists(mount.localPath))) {
                     yield {
                         type: 'warn',
@@ -62,6 +67,12 @@ async function* validate(workTree, context) {
                 item: task,
             };
         }
+        for (const mount of task.type === 'container-task' ? task.mounts : []) {
+            const pwd = getPwdMountWarning(mount);
+            if (pwd) {
+                yield { type: 'warn', message: pwd, item: task };
+            }
+        }
         for (const src of task.src) {
             if (!(await context.file.exists(src.absolutePath))) {
                 yield {
@@ -146,4 +157,15 @@ async function checkIfContextExists(service, context) {
     return false;
 }
 exports.checkIfContextExists = checkIfContextExists;
+// `$PWD` in a mount is the home directory, which reads like a path of the project
+function getPwdMountWarning(mount) {
+    const source = mount.mount.split(':')[0];
+    if ((0, normalize_path_1.getHomeReference)(source) !== '$PWD') {
+        return null;
+    }
+    const rest = source.substring('$PWD'.length);
+    const home = rest === '' || rest.startsWith('/') || rest.startsWith('\\') ? `~${rest}` : '~/…';
+    return (`mount ${source} is ${mount.localPath}: $PWD in a mount is the home directory, not the project. ` +
+        `Write ${home} for the home directory, or a relative path for the project`);
+}
 //# sourceMappingURL=validate.js.map