hammerkit 1.27.0-next.16 → 1.27.0-next.18

package/dist/remote/remote-work-commands.js

@@ -16,7 +16,19 @@ const sandbox_client_1 = require("../harness/sandbox-client");
 const units_1 = require("../utils/units");
 const service_tools_1 = require("../harness/service-tools");
 const path_1 = require("path");
+const check_keys_1 = require("../optimizer/check-keys");
 const RUN_ID = /^run_[A-Za-z0-9_-]{16}$/;
+// how a check passed, one line
+function describePassed(passed) {
+    const from = passed.source.type === 'ref'
+        ? `${passed.source.ref} at ${passed.source.commit.slice(0, 12)}`
+        : `a check of sandbox ${passed.source.sandbox}, fetched at ${passed.source.commit.slice(0, 12)}`;
+    return `passed ${passed.finishedAt}${passed.status === 'cached'
+        ? ' from the cache'
+        : passed.durationMs !== undefined
+            ? ` in ${(0, units_1.formatDuration)(passed.durationMs)}`
+            : ''}, ${passed.run} by ${passed.by.sub}, from ${from}`;
+}
 // what the publisher said about where a version comes from, one line
 // What a publisher said about where a version comes from: the server takes it as said,
 // so anybody else is told it is not checked.
@@ -158,6 +170,7 @@ function registerWorkCommands(remote, context) {
         .addOption(new commander_1.Option('--cache <method>', 'as --cache of run').choices(['checksum', 'modify-date', 'none']))
         .addOption(new commander_1.Option('--timeout <duration>', 'as --timeout of run: for tasks without their own, such as 30m'))
         .addOption(new commander_1.Option('--max-timeout <duration>', 'as --max-timeout of run: for every task, also one with its own timeout'))
+        .addOption(new commander_1.Option('--detach', 'submit the run and exit, without following it: for a check that CI verifies later'))
         .action(guarded('Remote run was not successful', async (tasks, options) => {
         const named = options.build ?? environment.processEnvs.HAMMERKIT_BUILD;
         const definition = named ?? (0, bundle_1.hashBundle)(await (0, collect_bundle_1.collectBundle)(buildFile, environment));
@@ -194,6 +207,10 @@ function registerWorkCommands(remote, context) {
         }
         const at = submitted.source.type === 'ref' ? ` at ${(0, server_client_1.printable)(submitted.source.commit)}` : '';
         environment.stdout.write(`${(0, server_client_1.printable)(submitted.id)} on ${serverName}: ${tasks.map(server_client_1.printable).join(', ')} from ${(0, server_client_1.printable)(ref)}${at}\n`);
+        if (options.detach) {
+            environment.stdout.write(`follow it with: hammerkit remote show ${(0, server_client_1.printable)(submitted.id)}\n`);
+            return;
+        }
         const prefixed = tasks.length > 1;
         const followed = await (0, sandbox_client_1.followRun)(connection, submitted, {
             signal: environment.abortCtrl.signal,
@@ -297,6 +314,59 @@ function registerWorkCommands(remote, context) {
         const run = (await (0, server_client_1.callServer)(server, token, 'POST', `/v1/runs/${id}/cancel`)).body;
         environment.stdout.write(`${(0, server_client_1.printable)(run.id)} on ${serverName}: ${run.state === 'up' || run.state === 'running' ? 'stopping' : (0, server_client_1.printable)(run.state)}\n`);
     }));
+    remote
+        .command('verify <tasks...>')
+        .description('check that the server already passed tasks for the files checked out here, without running them; ' +
+        'exits 1 at once for any it did not')
+        .addOption(new commander_1.Option('--server <name>', 'the server to ask; the default of remote use when left out'))
+        .addOption(new commander_1.Option('--repo <host/path>', 'the repository, such as github.com/corp/payments; origin of the checkout here when left out'))
+        .addOption(new commander_1.Option('--env <name>', 'the environment of the build file, as --env of run'))
+        .action(guarded('Remote verify was not successful', async (tasks, options) => {
+        const repo = options.repo ?? (await (0, annotations_1.readCheckout)((0, path_1.dirname)(buildFile))).repo;
+        if (!repo) {
+            throw new Error('name the repository with --repo, the checkout here has no origin it can be told by');
+        }
+        const keys = [];
+        const unkeyed = [];
+        for (const task of tasks) {
+            const found = (await (0, check_keys_1.getCheckKeys)(buildFile, environment, { taskName: task, environmentName: options.env ?? null }))[task];
+            if (!found) {
+                throw new Error(`the build file has no task ${(0, server_client_1.printable)(task)}`);
+            }
+            if (found.key === null) {
+                unkeyed.push({ task, reason: found.reason });
+            }
+            else {
+                keys.push({ task, key: found.key });
+            }
+        }
+        const { name: serverName, server, token } = await connect(options.server);
+        const answer = keys.length > 0
+            ? await (0, server_client_1.callServer)(server, token, 'POST', '/v1/checks/lookup', { repo, keys })
+            : { body: { checks: [] } };
+        const missing = [];
+        // by what was asked, never by what was answered: a task the answer leaves out, or
+        // answers for another key, is not verified
+        for (const { task, key } of keys) {
+            const check = answer.body.checks.find((answered) => answered.task === task && answered.key === key);
+            if (check?.passed) {
+                environment.stdout.write(`${(0, server_client_1.printable)(task)}: ${(0, server_client_1.printable)(describePassed(check.passed))}\n`);
+            }
+            else {
+                missing.push(task);
+                environment.stdout.write(`${(0, server_client_1.printable)(task)}: no run on ${serverName} passed it for these files${check?.reason ? `, ${(0, server_client_1.printable)(check.reason)}` : ''}\n`);
+            }
+        }
+        for (const { task, reason } of unkeyed) {
+            environment.stdout.write(`${(0, server_client_1.printable)(task)}: can not be verified, ${(0, server_client_1.printable)(reason)}\n`);
+        }
+        if (missing.length > 0 || unkeyed.length > 0) {
+            const run = missing.length > 0 ? `; run on the server: hammerkit remote run ${missing.map(server_client_1.printable).join(' ')}` : '';
+            // whole names: a task of an include is named like build:all
+            const names = [...missing, ...unkeyed.map(({ task }) => task)].map(server_client_1.printable);
+            fail(`not verified: ${names.join(', ')}${run}`, 1);
+        }
+    }));
     remote
         .command('versions [server]')
         .description('list the published versions of build files on a server, newest first, with where they come from')

package/dist/remote/server-client.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.callServer = exports.getMe = exports.getDiscovery = exports.printableWhole = exports.printable = exports.ServerError = void 0;
+exports.callServer = exports.getMe = exports.getDiscovery = exports.printableWhole = exports.printableLines = exports.printable = exports.ServerError = void 0;
 const discovery_1 = require("../server/discovery");
 const TIMEOUT_MS = 10000;
 const WRITE_TIMEOUT_MS = 30000;
@@ -21,6 +21,17 @@ function printable(value) {
     return text.length > 300 ? `${text.slice(0, 300)}… (+${text.length - 300} chars)` : text;
 }
 exports.printable = printable;
+// Text of several lines, such as every problem of a refused publish: each line made
+// printable and cut like `printable`, one per line, and at most `MAX_LINES` of them.
+const MAX_LINES = 100;
+function printableLines(value) {
+    const lines = String(value)
+        .split(/\r?\n/)
+        .filter((line) => line.trim().length > 0);
+    const shown = lines.slice(0, MAX_LINES).map(printable);
+    return lines.length > MAX_LINES ? [...shown, `… (+${lines.length - MAX_LINES} lines)`] : shown;
+}
+exports.printableLines = printableLines;
 // The same, never cut: for what somebody decides on, such as a command.
 function printableWhole(value) {
     return String(value)
@@ -92,7 +103,9 @@ async function callServer(server, token, method, path, body) {
         throw new ServerError(`${server.url} did not accept the token`);
     }
     if (!response.ok) {
-        const said = answer && typeof answer.error === 'string' ? `: ${printable(answer.error)}` : '';
+        const lines = answer && typeof answer.error === 'string' ? printableLines(answer.error) : [];
+        // a refused publish says every problem, each on a line of its own
+        const said = lines.length > 1 ? `:\n${lines.map((line) => `  ${line}`).join('\n')}` : lines.length === 1 ? `: ${lines[0]}` : '';
         throw new ServerError(`${server.url} answered ${response.status}${said}`, response.status);
     }
     return { status: response.status, body: answer };

package/dist/run-program.js

@@ -7,6 +7,8 @@ exports.runProgram = void 0;
 const program_1 = require("./program");
 const parse_error_1 = require("./schema/parse-error");
 const colors_1 = __importDefault(require("colors"));
+const commander_1 = require("commander");
+const log_1 = require("./log");
 function runProgram(env, argv, exitOverride) {
     return (0, program_1.getProgram)(env, argv)
         .then(({ program, args }) => {
@@ -18,8 +20,15 @@ function runProgram(env, argv, exitOverride) {
             for (const error of err.zod.errors) {
                 env.stderr.write(` ${colors_1.default.underline(colors_1.default.blue(`error`))} at ${colors_1.default.gray(error.path.join('.'))} ${error.message}  ${colors_1.default.gray(error.code)}\n`);
             }
+            // printed, but still a failure: CI must not pass on a build file that doesn't parse
+            throw err;
         }
         else {
+            // what commander reports (program.error, a wrong option) is printed already; anything
+            // else, such as a build file that is no YAML, would otherwise end the process silently
+            if (!(err instanceof commander_1.CommanderError)) {
+                env.stderr.write(`${colors_1.default.red('error')}: ${(0, log_1.getErrorMessage)(err)}\n`);
+            }
             throw err;
         }
     });

package/dist/schema/reference-parser.js

@@ -210,7 +210,9 @@ function resolveNeeds(reference, taskOrService, scope, schema) {
     for (const needName of schema.needs || []) {
         if (typeof needName === 'string') {
             taskOrService.needs.push({
-                relativeName: needName,
+                // the host name it is reached by: a service of an include, `services:postgres`, as
+                // `services-postgres`, since Docker and DNS take no colon
+                relativeName: needName.replace(/:/g, '-'),
                 service: findService(reference, scope, needName),
             });
         }
@@ -221,6 +223,11 @@ function resolveNeeds(reference, taskOrService, scope, schema) {
             });
         }
     }
+    const names = taskOrService.needs.map((need) => need.relativeName);
+    const twice = names.find((name, index) => names.indexOf(name) !== index);
+    if (twice) {
+        throw new Error(`${taskOrService.relativeName} needs two services as ${twice}, give one another name with name:`);
+    }
 }
 function findTask(ctx, scope, name, type) {
     const ref = (0, split_name_1.splitName)(name);

package/dist/secrets/github-app-token-command.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerGithubAppTokenCommand = void 0;
+const commander_1 = require("commander");
 const log_1 = require("../log");
 const github_app_token_1 = require("./github-app-token");
 // `hammerkit github-app-token <owner/repo>`: a secret provider command for the token a
@@ -18,7 +19,8 @@ function registerGithubAppTokenCommand(program, environment) {
         }
         catch (e) {
             environment.stderr.write(`github-app-token: ${(0, log_1.getErrorMessage)(e)}\n`);
-            throw e;
+            // said already: the CLI does not print it again
+            throw new commander_1.CommanderError(1, 'hammerkit.githubAppToken', (0, log_1.getErrorMessage)(e));
         }
     });
 }

package/dist/server/accounts-api.js

@@ -31,6 +31,7 @@ async function handleAccounts(config, log, principal, req, res, url) {
             accounts,
             repos: grant.repos,
             builds: grant.builds,
+            checks: grant.checks || grant.builds !== null ? 'read' : null,
             sandboxes: grant.sandboxes,
             endpoints: grant.endpoints,
         });

package/dist/server/checks-api.js

@@ -0,0 +1,83 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleChecks = exports.MAX_LOOKUP_KEYS = void 0;
+const zod_1 = require("zod");
+const http_1 = require("./http");
+const policy_1 = require("./policy");
+const checks_1 = require("./checks");
+const repo_1 = require("./repo");
+// the tasks one lookup may ask about
+exports.MAX_LOOKUP_KEYS = 100;
+const lookupSchema = zod_1.z
+    .object({
+    repo: zod_1.z.string().transform((value, ctx) => {
+        const repo = (0, repo_1.normalizeRepo)(value);
+        if (!repo) {
+            ctx.addIssue({ code: zod_1.z.ZodIssueCode.custom, message: 'expected a repository like github.com/corp/payments' });
+            return zod_1.z.NEVER;
+        }
+        return repo;
+    }),
+    keys: zod_1.z
+        .array(zod_1.z
+        .object({
+        task: zod_1.z.string().min(1).max(200),
+        key: zod_1.z.string().regex(checks_1.CHECK_KEY_PATTERN, 'expected a check key, 64 hex digits'),
+    })
+        .strict())
+        .min(1)
+        .max(exports.MAX_LOOKUP_KEYS),
+})
+    .strict();
+/**
+ * What runs passed, for CI that verifies instead of running (`hammerkit remote verify`):
+ *
+ *   POST /v1/checks/lookup   { repo, keys: [{ task, key }] }  the newest passed run per key
+ *
+ * The caller computed the keys from its own checkout (check-key.ts); a key nothing passed
+ * for, or whose version of the build file was yanked since, is answered with none.
+ */
+async function handleChecks(config, checks, definitions, log, principal, req, res, url) {
+    if (url.pathname !== '/v1/checks/lookup') {
+        return false;
+    }
+    if (req.method !== 'POST') {
+        (0, http_1.send)(res, 405, { error: 'method not allowed' }, { allow: 'POST' });
+        return true;
+    }
+    const parsed = lookupSchema.safeParse(await (0, http_1.readJson)(req));
+    if (!parsed.success) {
+        const issue = parsed.error.issues[0];
+        (0, http_1.send)(res, 400, { error: `${issue.path.join('.') || 'request'}: ${issue.message}` });
+        return true;
+    }
+    const { repo, keys } = parsed.data;
+    const grant = (0, policy_1.getGrant)(config.entitlements, principal);
+    if (!(0, policy_1.mayReadChecks)(grant, repo)) {
+        log(`refuse checks iss=${principal.iss} sub=${principal.sub} repo=${repo}`);
+        (0, http_1.send)(res, 403, { error: `you may not read the checks of ${repo}` });
+        return true;
+    }
+    const answers = await Promise.all(keys.map(async ({ task, key }) => {
+        const record = await checks.find(repo, key);
+        const yanked = record ? definitions.find(record.definition)?.yanked : undefined;
+        if (!record || yanked) {
+            return {
+                task,
+                key,
+                passed: null,
+                ...(yanked ? { reason: `it passed with ${record?.definition}, which was yanked since` } : {}),
+            };
+        }
+        const { repo: _repo, key: _key, accounts: _accounts, ...view } = record;
+        void _repo;
+        void _key;
+        void _accounts;
+        return { task, key, passed: view };
+    }));
+    log(`checks iss=${principal.iss} sub=${principal.sub} repo=${repo} passed=${answers.filter((a) => a.passed).length}/${answers.length}`);
+    (0, http_1.send)(res, 200, { checks: answers });
+    return true;
+}
+exports.handleChecks = handleChecks;
+//# sourceMappingURL=checks-api.js.map

package/dist/server/checks.js

@@ -0,0 +1,116 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CheckStore = exports.getCheckRecords = exports.isCheckRun = exports.CHECK_KEY_PATTERN = void 0;
+const crypto_1 = require("crypto");
+const promises_1 = require("fs/promises");
+const path_1 = require("path");
+exports.CHECK_KEY_PATTERN = /^[0-9a-f]{64}$/;
+// The runs whose results are checks: those of a commit the server checked out, and those
+// on a copy of the files of a sandbox, which hold nothing a commit of them would not. A run
+// with arguments ran something other than the task, and is no check of it.
+function isCheckRun(run) {
+    // a run of services keeps them up, it passes nothing
+    if ((run.options.args ?? []).length > 0 || run.up) {
+        return false;
+    }
+    return run.source.type === 'ref' || (run.source.type === 'sandbox' && run.source.check === true);
+}
+exports.isCheckRun = isCheckRun;
+// What a run that ended passed, with the keys its executor reported before the tasks ran.
+function getCheckRecords(run, keys) {
+    if (!isCheckRun(run) || run.source.type === 'upload') {
+        return [];
+    }
+    const source = run.source.type === 'ref'
+        ? { type: 'ref', ref: run.source.ref, commit: run.source.commit }
+        : { type: 'sandbox', sandbox: run.source.id, commit: run.source.commit, tree: run.source.tree };
+    const records = [];
+    for (const [task, result] of Object.entries(run.results ?? {})) {
+        const key = keys[task];
+        if (!key || !exports.CHECK_KEY_PATTERN.test(key) || (result.status !== 'succeeded' && result.status !== 'cached')) {
+            continue;
+        }
+        records.push({
+            repo: run.source.repo,
+            key,
+            task,
+            status: result.status,
+            run: run.id,
+            by: { iss: run.owner.iss, sub: run.owner.sub },
+            source,
+            definition: run.definition,
+            accounts: [...run.accounts],
+            finishedAt: result.finishedAt ?? run.finishedAt ?? new Date().toISOString(),
+            ...(result.durationMs !== undefined ? { durationMs: result.durationMs } : {}),
+        });
+    }
+    return records;
+}
+exports.getCheckRecords = getCheckRecords;
+/**
+ * One file per repository and key, the newest run's: `<directory>/<repo hash>/<key>.json`,
+ * written to a temporary file and renamed. A record older than `keep` is not found and is
+ * removed by `sweep`.
+ */
+class CheckStore {
+    constructor(directory, options) {
+        this.directory = directory;
+        this.options = options;
+        this.now = options.now ?? Date.now;
+    }
+    async save(records) {
+        for (const record of records) {
+            const folder = (0, path_1.join)(this.directory, repoFolder(record.repo));
+            await (0, promises_1.mkdir)(folder, { recursive: true, mode: 0o700 });
+            const file = (0, path_1.join)(folder, `${record.key}.json`);
+            const temporary = `${file}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
+            await (0, promises_1.writeFile)(temporary, JSON.stringify(record), { mode: 0o600 });
+            await (0, promises_1.rename)(temporary, file);
+        }
+    }
+    async find(repo, key) {
+        if (!exports.CHECK_KEY_PATTERN.test(key)) {
+            return undefined;
+        }
+        let record;
+        try {
+            record = JSON.parse(await (0, promises_1.readFile)((0, path_1.join)(this.directory, repoFolder(repo), `${key}.json`), 'utf8'));
+        }
+        catch {
+            return undefined;
+        }
+        if (record.repo !== repo || record.key !== key || this.expired(record)) {
+            return undefined;
+        }
+        return record;
+    }
+    // Removes the records that are older than `keep`.
+    async sweep() {
+        let folders;
+        try {
+            folders = await (0, promises_1.readdir)(this.directory);
+        }
+        catch {
+            return;
+        }
+        for (const folder of folders) {
+            const path = (0, path_1.join)(this.directory, folder);
+            for (const name of await (0, promises_1.readdir)(path).catch(() => [])) {
+                const file = (0, path_1.join)(path, name);
+                const stats = await (0, promises_1.stat)(file).catch(() => undefined);
+                if (stats && this.now() - stats.mtimeMs > this.options.keep) {
+                    await (0, promises_1.rm)(file, { force: true });
+                }
+            }
+        }
+    }
+    expired(record) {
+        const at = Date.parse(record.finishedAt);
+        return !Number.isFinite(at) || this.now() - at > this.options.keep;
+    }
+}
+exports.CheckStore = CheckStore;
+function repoFolder(repo) {
+    return (0, crypto_1.createHash)('sha256').update(repo).digest('hex').slice(0, 32);
+}
+//# sourceMappingURL=checks.js.map

package/dist/server/executor.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.HostExecutor = exports.volumeScope = exports.cacheNamespace = exports.defaultWorker = void 0;
 const child_process_1 = require("child_process");
 const crypto_1 = require("crypto");
+const checks_1 = require("./checks");
 const fs_1 = require("fs");
 const promises_1 = require("fs/promises");
 const path_1 = require("path");
@@ -35,9 +36,18 @@ exports.defaultWorker = defaultWorker;
 // share one, those of an upload or a sandbox only their owner's. Somebody who can only
 // upload, or an agent on a sandbox, can not leave an entry for a run from a reviewed
 // repository to find.
+//
+// A check on a sandbox runs on a copy of the files a commit of them would hold, so it is a
+// run of the repository like a ref run of that commit, and shares its cache: what its
+// owner may write in the sandbox is not part of it. It leaves entries a run from main can
+// find, keyed by the files it ran on, as a ref run of a branch does: so only a caller who
+// may push a branch of the repository and run from it may check (server.ts).
 function cacheNamespace(run) {
-    const key = run.source.type === 'ref' ? `ref\0${run.source.repo}` : `${run.source.type}\0${run.owner.iss}\0${run.owner.sub}`;
-    return `${run.source.type}-${(0, crypto_1.createHash)('sha256').update(key).digest('hex').slice(0, 24)}`;
+    const repository = run.source.type === 'ref' || (run.source.type === 'sandbox' && run.source.check);
+    const key = repository
+        ? `ref\0${run.source.repo}`
+        : `${run.source.type}\0${run.owner.iss}\0${run.owner.sub}`;
+    return `${repository ? 'ref' : run.source.type}-${(0, crypto_1.createHash)('sha256').update(key).digest('hex').slice(0, 24)}`;
 }
 exports.cacheNamespace = cacheNamespace;
 // The docker volumes of a run's services are its caller's, within the cache's source trust:
@@ -121,7 +131,34 @@ class HostExecutor {
             let claim;
             // the files of the sandbox the tasks work on
             let work;
-            if (source.type === 'ref') {
+            if (source.type === 'sandbox' && source.check) {
+                // a check works on the files a push of the sandbox commits, copied out of it: never
+                // on the sandbox, whose ignored files (node_modules, outputs) its owner writes
+                const { registry, network } = sandboxes;
+                cwd = (0, path_1.join)(root, 'source');
+                try {
+                    await registry.exportTree(source.id, source.tree, cwd, abortCtrl.signal);
+                }
+                catch (e) {
+                    throw new Error(`the files of the sandbox ${source.id} could not be copied for the check, submit it again: ${e instanceof Error ? e.message : String(e)}`);
+                }
+                // a repository of its own, as a checkout of the commit is: the root of the project,
+                // which the paths of the tasks' keys are relative to, is the one of git
+                await (0, git_checkout_1.git)(['init', '--quiet', cwd], {}, abortCtrl.signal, `the check of sandbox ${source.id}`, 'init');
+                context.emit({
+                    type: 'log',
+                    task: 'hammerkit',
+                    stream: 'stdout',
+                    text: `check of sandbox ${source.id} of ${source.repo}: files ${source.tree}, fetched at ${source.commit}`,
+                });
+                await this.writeBundle(cwd, bundle.files);
+                input = {
+                    entry: (0, path_1.join)(cwd, version.entry),
+                    ...(planning.policy.network ? { network: (0, work_network_1.toNetworkSchema)(planning.policy.network) } : {}),
+                    sandboxNetwork: network,
+                };
+            }
+            else if (source.type === 'ref') {
                 cwd = (0, path_1.join)(root, 'source');
                 const { repo, ref, commit: pinned } = source;
                 const credentials = await repos.credentials(repo);
@@ -190,6 +227,7 @@ class HostExecutor {
                     options: run.options,
                     accounts: run.accounts,
                     volumeScope: volumeScope(run),
+                    ...((0, checks_1.isCheckRun)(run) ? { check: true } : {}),
                     catalog: planning.environment.hosted?.catalog,
                     ...(run.up
                         ? {

package/dist/server/kubernetes-backend.js

@@ -569,7 +569,7 @@ exports.KubernetesExecutor = KubernetesExecutor;
 // cache, and on a sandbox the runs of that sandbox only, whose claim is on the same node or
 // zone as the kept ones. The owner is the namespace's.
 function getVolumeScope(run) {
-    if (run.source.type === 'sandbox') {
+    if (run.source.type === 'sandbox' && !run.source.check) {
         return `sandbox-${(0, crypto_1.createHash)('sha256').update(run.source.id).digest('hex').slice(0, 24)}`;
     }
     return (0, executor_1.cacheNamespace)(run);

package/dist/server/kubernetes-sandbox-storage.js

@@ -261,6 +261,41 @@ class KubernetesSandboxStorage {
             await (0, promises_1.rm)(repository, { recursive: true, force: true });
         }
     }
+    // The pod writes the tree's files beside the sandbox on the claim and sends them as a tar,
+    // which is extracted here as the files of `attach` are: what a run plans with, up to the
+    // bytes a sandbox may take.
+    async exportTree(key, tree, into, signal) {
+        await (0, promises_1.mkdir)(into, { recursive: true });
+        let bytes = 0;
+        const extract = (0, tar_1.extract)({
+            cwd: into,
+            filter: (_path, entry) => 'type' in entry && ['File', 'OldFile', 'Directory', 'SymbolicLink'].includes(entry.type),
+        });
+        const counted = new stream_1.PassThrough();
+        counted.on('data', (chunk) => {
+            bytes += chunk.length;
+            if (bytes > this.limits.bytes) {
+                counted.destroy(new Error(`the files of the sandbox ${key.id} take more than ${(0, units_1.formatSize)(this.limits.bytes)}`));
+            }
+        });
+        const extracted = new Promise((resolve, reject) => {
+            extract.on('finish', resolve);
+            extract.on('error', reject);
+            counted.on('error', reject);
+        });
+        extracted.catch(() => undefined);
+        counted.pipe(extract);
+        const answer = await this.exclusive(key.id, () => this.call(key, { op: 'archive', id: key.id, tree }, signal, true));
+        if ('stream' in answer) {
+            // a pipeline, so the answer is ended with the copy: an error of the pod after the copy
+            // stopped (over the size limit) lands nowhere else
+            await (0, promises_2.pipeline)(answer.stream, counted);
+        }
+        else {
+            counted.end(answer.body);
+        }
+        await extracted;
+    }
     async moveTo(key, commit) {
         await this.request(key, { op: 'move', id: key.id, commit }, AbortSignal.timeout(FETCH_TIMEOUT_MS));
     }
@@ -506,7 +541,7 @@ class KubernetesSandboxStorage {
         const reader = new AnswerReader(body);
         // the process ends when the server stops waiting for it: closing the connection does
         // not end a command in a pod
-        const seconds = Math.ceil((['create', 'fetch', 'move'].includes(request.op) ? FETCH_TIMEOUT_MS : REQUEST_TIMEOUT_MS) / 1000);
+        const seconds = Math.ceil((['create', 'fetch', 'move', 'archive'].includes(request.op) ? FETCH_TIMEOUT_MS : REQUEST_TIMEOUT_MS) / 1000);
         const done = this.withPod(key, (pod) => this.exec(pod, ['timeout', String(seconds), 'hammerkit', 'server-sandbox', CLAIM_PATH], stream_1.Readable.from([Buffer.from(JSON.stringify(encoded))]), reader, signal));
         done.then(() => reader.complete(), (e) => reader.fail(e));
         const answer = await reader.answer;
@@ -889,6 +924,11 @@ class AnswerReader extends stream_1.Writable {
     }
     _write(chunk, _encoding, callback) {
         if (this.stream) {
+            if (this.stream.destroyed) {
+                // its reader stopped (over a size limit): the rest of the answer is nobody's
+                callback();
+                return;
+            }
             this.stream.write(chunk, callback);
             return;
         }