hammerkit 1.27.0-next.17 → 1.27.0-next.19

package/dist/cache/explain.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.explainWorkTree = exports.explainTask = exports.describeCause = void 0;
+const work_task_1 = require("../planner/work-task");
 const state_key_1 = require("../executer/scheduler/state-key");
 const work_task_cache_description_1 = require("../optimizer/work-task-cache-description");
 const get_cache_directory_1 = require("../optimizer/get-cache-directory");
@@ -157,6 +158,22 @@ async function explainTask(item, defaultCacheMethod, environment, memo = new Map
         visiting.delete(item.id());
         return explanation;
     }
+    // Mirrors executeWorkTask: an aggregate is never looked up itself, and is reported
+    // cached when all its dependencies were. What changed is in its dependencies.
+    if ((0, work_task_1.isAggregateTask)(item.data)) {
+        const causes = [];
+        for (const dep of item.deps) {
+            const depExplanation = await explainTask(dep, defaultCacheMethod, environment, memo, visiting);
+            if (depExplanation.status !== 'hit') {
+                causes.push({ kind: 'dependency-changed', identifier: dep.name });
+            }
+        }
+        const status = causes.length === 0 ? 'hit' : 'miss';
+        const explanation = { taskId: item.id(), taskName: item.name, status, causes };
+        memo.set(item.id(), explanation);
+        visiting.delete(item.id());
+        return explanation;
+    }
     const runtimeStateKey = await safeCurrentStateKey(item, environment);
     const hasEntry = await safeHas(item, stateKey, environment);
     const predictedHit = runtimeStateKey === stateKey || hasEntry;

package/dist/executer/execute-work-task.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.executeWorkTask = void 0;
+const work_task_1 = require("../planner/work-task");
 const states_1 = require("./states");
 const abort_1 = require("./abort");
 const log_1 = require("../log");
@@ -12,7 +13,8 @@ const archive_task_entry_1 = require("./archive-task-entry");
 const units_1 = require("../utils/units");
 async function pushToBackend(work, environment, cacheState, options) {
     const { resolved, stateKey, provable } = cacheState;
-    if (resolved.method === 'none' || !provable) {
+    // an aggregate has nothing to store, see checkCacheState
+    if (resolved.method === 'none' || !provable || (0, work_task_1.isAggregateTask)(work.data)) {
         return;
     }
     if (options.cacheReadOnly) {
@@ -29,7 +31,7 @@ async function pushToBackend(work, environment, cacheState, options) {
     }
 }
 // A task without cmds only groups its dependencies (`ci: { deps: [test, build] }`).
-// Having no src of its own it is never a cache hit, so its dependencies are
+// It is never a cache hit itself (see checkCacheState), so its dependencies are
 // always checked and their outputs restored. When every one of them was a hit,
 // nothing ran: report the group as cached too. Reporting only, the cache
 // decision is untouched.

package/dist/executer/execution-steps.js

@@ -89,8 +89,11 @@ exports.prepareMounts = prepareMounts;
 async function setUserPermissions(item, container, environment) {
     if (item.data.user) {
         // On a server only the volumes: a chown as the container's root on a path of the host
-        // would follow a link a task put there after the binds were checked
-        const binds = (0, get_container_binds_1.getContainerBinds)(item).filter((bind) => !environment.hosted || !(0, path_1.isAbsolute)(bind.localPath));
+        // would follow a link a task put there after the binds were checked. Never a mount: it
+        // is a path of the host the build file names, such as /var/run/docker.sock, whose owner
+        // is not hammerkit's to change
+        const mounted = new Set(item.data.mounts.map((mount) => mount.containerPath));
+        const binds = (0, get_container_binds_1.getContainerBinds)(item).filter((bind) => !mounted.has(bind.containerPath) && (!environment.hosted || !(0, path_1.isAbsolute)(bind.localPath)));
         if (!environment.hosted) {
             await (0, set_user_permission_1.setUserPermission)(item.data.cwd, item.status, environment, container, item.data.user);
         }

package/dist/executer/scheduler/enqueue-next.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkCacheState = exports.UNCACHED_STATE_KEY = void 0;
 const work_item_1 = require("../../planner/work-item");
+const work_task_1 = require("../../planner/work-task");
 const get_cache_directory_1 = require("../../optimizer/get-cache-directory");
 const cache_metadata_1 = require("../cache-metadata");
 const work_task_cache_description_1 = require("../../optimizer/work-task-cache-description");
@@ -35,6 +36,12 @@ options = {}) {
         item.status.write('debug', `${item.name} always runs, it or one of its dependencies has no src files`);
         return { cached: false, stateKey, resolved, provable };
     }
+    // An aggregate runs nothing, so running it costs nothing, and it is never a hit itself:
+    // asked for, it still has its dependencies checked and their outputs restored. Its key
+    // counts for what depends on it, and it is reported cached when they all were.
+    if ((0, work_item_1.isWorkTaskItem)(item) && (0, work_task_1.isAggregateTask)(item.data)) {
+        return { cached: false, stateKey, resolved, provable };
+    }
     if ((0, work_item_1.isWorkTaskItem)(item)) {
         const runtimeStateKey = await item.runtime.currentStateKey(environment);
         if (runtimeStateKey === stateKey) {

package/dist/executer/scheduler/state-key.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.computeStateKey = exports.combineStateKeys = exports.isOwnProvable = exports.resolveEffective = void 0;
 const get_work_cache_stats_1 = require("../../optimizer/get-work-cache-stats");
+const work_task_1 = require("../../planner/work-task");
 // The state-key engine is shared by the scheduler's hit/miss decision
 // (`checkCacheState`) and the read-only cache-explain engine, so a prediction
 // can never diverge from the decision it predicts — there is one implementation.
@@ -20,6 +21,10 @@ exports.resolveEffective = resolveEffective;
 // whose `src` entries all match no file (a typo, a moved path). Services are not
 // affected.
 function isOwnProvable(item, unmatched) {
+    if ((0, work_task_1.isAggregateTask)(item.data)) {
+        // it runs nothing and reads nothing: what its dependencies prove is all there is
+        return true;
+    }
     // unmatched ⊆ declared, so this is also false when nothing is declared
     return unmatched.length < item.data.src.filter((src) => !src.inherited).length;
 }

package/dist/planner/utils/append-work-dependencies.js

@@ -17,8 +17,10 @@ function appendWorkDependencies(workTree, referenced, item, environment, context
                 }
             }
         }
-        if (((0, work_task_1.isContainerWorkTask)(depNode.data) || (0, work_service_1.isContainerWorkService)(depNode.data)) &&
-            ((0, work_task_1.isContainerWorkTask)(item.data) || (0, work_service_1.isContainerWorkService)(item.data))) {
+        // an aggregate hands on what its dependencies generate, as if what depends on it
+        // depended on them
+        if (((0, work_task_1.isContainerWorkTask)(depNode.data) || (0, work_service_1.isContainerWorkService)(depNode.data) || (0, work_task_1.isAggregateTask)(depNode.data)) &&
+            ((0, work_task_1.isContainerWorkTask)(item.data) || (0, work_service_1.isContainerWorkService)(item.data) || (0, work_task_1.isAggregateTask)(item.data))) {
             // the outputs of the dep's own deps too, which stay those of the task that made them
             // (on Kubernetes, they are in its claim)
             for (const generate of depNode.data.generates) {
@@ -39,7 +41,7 @@ function appendWorkDependencies(workTree, referenced, item, environment, context
                         });
                     }
                 }
-                else {
+                else if ((0, work_task_1.isWorkTask)(item.data)) {
                     if (!item.data.generates.some((v) => v.volumeName === generate.volumeName)) {
                         item.data.generates.push({
                             volumeName: generate.volumeName,

package/dist/planner/utils/append-work-task.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.appendWorkTask = void 0;
 const work_secret_1 = require("../work-secret");
+const work_task_1 = require("../work-task");
 const parse_work_generate_1 = require("./parse-work-generate");
 const template_value_1 = require("./template-value");
 const parse_work_mounts_1 = require("./parse-work-mounts");
@@ -25,7 +26,8 @@ function appendWorkTask(workTree, cwd, referenceTask, environment, context) {
     const parsed = parseTask(cwd, referenceTask, environment, context);
     // on a server's cluster a local task runs in a tool image like a container task
     const server = workTree.environment.type === 'kubernetes' ? workTree.environment.server : undefined;
-    const task = !server
+    // an aggregate runs nothing, so it needs no pod either
+    const task = !server || (0, work_task_1.isAggregateTask)(parsed)
         ? parsed
         : parsed.type === 'local-task'
             ? (0, job_placement_1.runInToolImage)(parsed, server, referenceTask.schema.platform)
@@ -107,9 +109,17 @@ function parseTask(cwd, task, environment, context) {
             throw new Error(`task ${task.relativeName}: network ${(0, work_network_1.formatNetwork)(baseWorkNode.network)} needs a container, ` +
                 `hammerkit can't limit the network of a local task`);
         }
+        const aggregate = task.deps.length > 0 &&
+            task.needs.length === 0 &&
+            baseWorkNode.src.length === 0 &&
+            !baseWorkNode.continuous &&
+            baseWorkNode.cmds.length === 0 &&
+            baseWorkNode.generates.length === 0 &&
+            baseWorkNode.secrets.length === 0;
         return {
             ...baseWorkNode,
             type: 'local-task',
+            ...(aggregate ? { aggregate } : {}),
         };
     }
 }

package/dist/planner/utils/get-work-runtime.js

@@ -4,6 +4,8 @@ exports.getWorkTaskRuntime = exports.getWorkServiceRuntime = void 0;
 const work_runtime_docker_1 = require("../work-runtime-docker");
 const work_runtime_kubernetes_1 = require("../work-runtime-kubernetes");
 const work_runtime_local_1 = require("../work-runtime-local");
+const work_runtime_aggregate_1 = require("../work-runtime-aggregate");
+const work_task_1 = require("../work-task");
 const work_item_1 = require("../work-item");
 function getWorkServiceRuntime(workTree, service) {
     if ((0, work_item_1.isContainerWorkServiceItem)(service)) {
@@ -24,7 +26,10 @@ function getWorkServiceRuntime(workTree, service) {
 }
 exports.getWorkServiceRuntime = getWorkServiceRuntime;
 function getWorkTaskRuntime(workTree, task) {
-    if ((0, work_item_1.isLocalWorkTaskItem)(task)) {
+    if ((0, work_task_1.isAggregateTask)(task.data)) {
+        return (0, work_runtime_aggregate_1.aggregateWorkRuntime)();
+    }
+    else if ((0, work_item_1.isLocalWorkTaskItem)(task)) {
         return (0, work_runtime_local_1.getLocalWorkRuntime)(task);
     }
     else if ((0, work_item_1.isContainerWorkTaskItem)(task)) {

package/dist/planner/utils/normalize-path.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.normalizePath = void 0;
+exports.normalizeHostPath = exports.getHomeReference = exports.normalizePath = void 0;
 const path_1 = require("path");
 function normalizePath(cwd, pwd, path) {
     if (path.startsWith('/')) {
@@ -14,4 +14,22 @@ function normalizePath(cwd, pwd, path) {
     }
 }
 exports.normalizePath = normalizePath;
+// What a path of the host starts with to name the home directory: `~` and `$HOME`, and
+// `$PWD`, which in a mount has always meant the home directory, not the project it reads like
+function getHomeReference(path) {
+    for (const reference of ['~', '$HOME']) {
+        if (path === reference || path.startsWith(`${reference}/`) || path.startsWith(`${reference}\\`)) {
+            return reference;
+        }
+    }
+    return path.startsWith('$PWD') ? '$PWD' : null;
+}
+exports.getHomeReference = getHomeReference;
+// A path of the host in a mount: in the home directory when it starts with one of the
+// references above, else in the directory of the build file unless it is absolute
+function normalizeHostPath(cwd, home, path) {
+    const reference = getHomeReference(path);
+    return reference ? (0, path_1.join)(home, path.substring(reference.length)) : normalizePath(cwd, home, path);
+}
+exports.normalizeHostPath = normalizeHostPath;
 //# sourceMappingURL=normalize-path.js.map

package/dist/planner/utils/parse-work-mount.js

@@ -7,6 +7,12 @@ const path_1 = require("path");
 function parseWorkMount(cwd, dir) {
     const parts = dir.split(':');
     if (parts.length === 1) {
+        const home = (0, normalize_path_1.getHomeReference)(dir);
+        if (home === '~' || home === '$HOME') {
+            // the container has no such directory: the same path on both sides would be one of the
+            // project there (`$PWD` has always been, so it stays)
+            throw new Error(`mount ${dir} is in the home directory, name where it goes in the container (${dir}:/path)`);
+        }
         return parseLocalMount(cwd, dir, dir, dir, false);
     }
     else if (parts.length === 2) {
@@ -22,7 +28,7 @@ function parseWorkMount(cwd, dir) {
 exports.parseWorkMount = parseWorkMount;
 function parseLocalMount(cwd, localPath, containerPath, mount, readOnly) {
     return {
-        localPath: (0, normalize_path_1.normalizePath)(cwd, (0, os_1.homedir)(), localPath),
+        localPath: (0, normalize_path_1.normalizeHostPath)(cwd, (0, os_1.homedir)(), localPath),
         containerPath: (0, normalize_path_1.normalizePath)(cwd, cwd, containerPath),
         isFile: (0, path_1.extname)(localPath).length > 1,
         mount,

package/dist/planner/validate.js

@@ -4,6 +4,7 @@ exports.checkIfContextExists = exports.hasDependencyCycle = exports.hasNeedCycle
 const read_build_file_1 = require("../parser/read-build-file");
 const plan_work_tasks_1 = require("./utils/plan-work-tasks");
 const unreferenced_build_file_envs_1 = require("./unreferenced-build-file-envs");
+const normalize_path_1 = require("./utils/normalize-path");
 async function* validate(workTree, context) {
     const cycleItems = [];
     for (const item of (0, plan_work_tasks_1.iterateWorkServices)(workTree)) {
@@ -16,6 +17,10 @@ async function* validate(workTree, context) {
                 yield { type: 'warn', message: 'missing healthcheck', item: service };
             }
             for (const mount of service.mounts) {
+                const pwd = getPwdMountWarning(mount);
+                if (pwd) {
+                    yield { type: 'warn', message: pwd, item: service };
+                }
                 if (!(await context.file.exists(mount.localPath))) {
                     yield {
                         type: 'warn',
@@ -62,6 +67,12 @@ async function* validate(workTree, context) {
                 item: task,
             };
         }
+        for (const mount of task.type === 'container-task' ? task.mounts : []) {
+            const pwd = getPwdMountWarning(mount);
+            if (pwd) {
+                yield { type: 'warn', message: pwd, item: task };
+            }
+        }
         for (const src of task.src) {
             if (!(await context.file.exists(src.absolutePath))) {
                 yield {
@@ -146,4 +157,15 @@ async function checkIfContextExists(service, context) {
     return false;
 }
 exports.checkIfContextExists = checkIfContextExists;
+// `$PWD` in a mount is the home directory, which reads like a path of the project
+function getPwdMountWarning(mount) {
+    const source = mount.mount.split(':')[0];
+    if ((0, normalize_path_1.getHomeReference)(source) !== '$PWD') {
+        return null;
+    }
+    const rest = source.substring('$PWD'.length);
+    const home = rest === '' || rest.startsWith('/') || rest.startsWith('\\') ? `~${rest}` : '~/…';
+    return (`mount ${source} is ${mount.localPath}: $PWD in a mount is the home directory, not the project. ` +
+        `Write ${home} for the home directory, or a relative path for the project`);
+}
 //# sourceMappingURL=validate.js.map

package/dist/planner/work-network.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.applyNetworkCeiling = exports.formatNetwork = exports.getTcpForwards = exports.matchesHost = exports.isLimitedNetwork = exports.toNetworkSchema = exports.exceedsNetwork = exports.getEffectiveNetwork = exports.limitNetwork = exports.parseNetworkOption = exports.parseWorkNetwork = exports.OPEN_NETWORK = void 0;
 const network_schema_1 = require("../schema/network-schema");
+const work_task_1 = require("./work-task");
 exports.OPEN_NETWORK = { type: 'open' };
 function parseWorkNetwork(schema) {
     if (!schema || schema === 'open') {
@@ -153,7 +154,8 @@ exports.formatNetwork = formatNetwork;
 function applyNetworkCeiling(workTree, ceiling) {
     const limit = ceiling && isLimitedNetwork(ceiling) ? ceiling : null;
     if (limit) {
-        const local = Object.values(workTree.tasks).find((task) => task.data.type === 'local-task');
+        // an aggregate runs nothing, so there is nothing of it to limit
+        const local = Object.values(workTree.tasks).find((task) => task.data.type === 'local-task' && !(0, work_task_1.isAggregateTask)(task.data));
         if (local) {
             throw new Error(`--network ${formatNetwork(limit)} needs every task in a container, ` +
                 `hammerkit can't limit the network of the local task ${local.name}`);

package/dist/planner/work-runtime-aggregate.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.aggregateWorkRuntime = void 0;
+// An aggregate runs nothing, so it touches nothing: no pid or state file in its
+// directory (on a server that is a checkout it doesn't trust), no outputs.
+function aggregateWorkRuntime() {
+    return {
+        async initialize() {
+            // nothing to prepare
+        },
+        async remove() {
+            // it has no outputs of its own
+        },
+        async execute() {
+            // its state stays running, and executeWorkTask completes it
+        },
+        async stop() {
+            // nothing is running
+        },
+        async archive() {
+            // never pushed, see pushToBackend
+        },
+        async restore() {
+            // never a hit, see checkCacheState
+        },
+        async currentStateKey() {
+            return null;
+        },
+    };
+}
+exports.aggregateWorkRuntime = aggregateWorkRuntime;
+//# sourceMappingURL=work-runtime-aggregate.js.map

package/dist/planner/work-task.js

@@ -1,8 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isWorkTask = exports.isContainerWorkTask = void 0;
+exports.isAggregateTask = exports.isWorkTask = exports.isContainerWorkTask = void 0;
 const isContainerWorkTask = (val) => val.type === 'container-task';
 exports.isContainerWorkTask = isContainerWorkTask;
 const isWorkTask = (val) => val.type === 'container-task' || val.type === 'local-task';
 exports.isWorkTask = isWorkTask;
+// A task that only groups its dependencies: `deps`, and no `image`, `cmds`, `src`,
+// `generates`, `secrets`, `needs` or `continuous`. It needs no runtime, hands on what its dependencies generate to what
+// depends on it, and is up to date (or verified) when all its dependencies are.
+const isAggregateTask = (val) => val.type === 'local-task' && val.aggregate === true;
+exports.isAggregateTask = isAggregateTask;
 //# sourceMappingURL=work-task.js.map

package/dist/remote/remote-work-commands.js

@@ -334,7 +334,7 @@ function registerWorkCommands(remote, context) {
                 throw new Error(`the build file has no task ${(0, server_client_1.printable)(task)}`);
             }
             if (found.key === null) {
-                unkeyed.push(`${(0, server_client_1.printable)(task)}: can not be verified, ${(0, server_client_1.printable)(found.reason)}`);
+                unkeyed.push({ task, reason: found.reason });
             }
             else {
                 keys.push({ task, key: found.key });
@@ -357,12 +357,14 @@ function registerWorkCommands(remote, context) {
                 environment.stdout.write(`${(0, server_client_1.printable)(task)}: no run on ${serverName} passed it for these files${check?.reason ? `, ${(0, server_client_1.printable)(check.reason)}` : ''}\n`);
             }
         }
-        for (const line of unkeyed) {
-            environment.stdout.write(`${line}\n`);
+        for (const { task, reason } of unkeyed) {
+            environment.stdout.write(`${(0, server_client_1.printable)(task)}: can not be verified, ${(0, server_client_1.printable)(reason)}\n`);
         }
         if (missing.length > 0 || unkeyed.length > 0) {
             const run = missing.length > 0 ? `; run on the server: hammerkit remote run ${missing.map(server_client_1.printable).join(' ')}` : '';
-            fail(`not verified: ${[...missing, ...unkeyed.map((line) => line.split(':')[0])].join(', ')}${run}`, 1);
+            // whole names: a task of an include is named like build:all
+            const names = [...missing, ...unkeyed.map(({ task }) => task)].map(server_client_1.printable);
+            fail(`not verified: ${names.join(', ')}${run}`, 1);
         }
     }));
     remote

package/dist/remote/server-client.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.callServer = exports.getMe = exports.getDiscovery = exports.printableWhole = exports.printable = exports.ServerError = void 0;
+exports.callServer = exports.getMe = exports.getDiscovery = exports.printableWhole = exports.printableLines = exports.printable = exports.ServerError = void 0;
 const discovery_1 = require("../server/discovery");
 const TIMEOUT_MS = 10000;
 const WRITE_TIMEOUT_MS = 30000;
@@ -21,6 +21,17 @@ function printable(value) {
     return text.length > 300 ? `${text.slice(0, 300)}… (+${text.length - 300} chars)` : text;
 }
 exports.printable = printable;
+// Text of several lines, such as every problem of a refused publish: each line made
+// printable and cut like `printable`, one per line, and at most `MAX_LINES` of them.
+const MAX_LINES = 100;
+function printableLines(value) {
+    const lines = String(value)
+        .split(/\r?\n/)
+        .filter((line) => line.trim().length > 0);
+    const shown = lines.slice(0, MAX_LINES).map(printable);
+    return lines.length > MAX_LINES ? [...shown, `… (+${lines.length - MAX_LINES} lines)`] : shown;
+}
+exports.printableLines = printableLines;
 // The same, never cut: for what somebody decides on, such as a command.
 function printableWhole(value) {
     return String(value)
@@ -92,7 +103,9 @@ async function callServer(server, token, method, path, body) {
         throw new ServerError(`${server.url} did not accept the token`);
     }
     if (!response.ok) {
-        const said = answer && typeof answer.error === 'string' ? `: ${printable(answer.error)}` : '';
+        const lines = answer && typeof answer.error === 'string' ? printableLines(answer.error) : [];
+        // a refused publish says every problem, each on a line of its own
+        const said = lines.length > 1 ? `:\n${lines.map((line) => `  ${line}`).join('\n')}` : lines.length === 1 ? `: ${lines[0]}` : '';
         throw new ServerError(`${server.url} answered ${response.status}${said}`, response.status);
     }
     return { status: response.status, body: answer };

package/dist/run-program.js

@@ -7,6 +7,8 @@ exports.runProgram = void 0;
 const program_1 = require("./program");
 const parse_error_1 = require("./schema/parse-error");
 const colors_1 = __importDefault(require("colors"));
+const commander_1 = require("commander");
+const log_1 = require("./log");
 function runProgram(env, argv, exitOverride) {
     return (0, program_1.getProgram)(env, argv)
         .then(({ program, args }) => {
@@ -18,8 +20,15 @@ function runProgram(env, argv, exitOverride) {
             for (const error of err.zod.errors) {
                 env.stderr.write(` ${colors_1.default.underline(colors_1.default.blue(`error`))} at ${colors_1.default.gray(error.path.join('.'))} ${error.message}  ${colors_1.default.gray(error.code)}\n`);
             }
+            // printed, but still a failure: CI must not pass on a build file that doesn't parse
+            throw err;
         }
         else {
+            // what commander reports (program.error, a wrong option) is printed already; anything
+            // else, such as a build file that is no YAML, would otherwise end the process silently
+            if (!(err instanceof commander_1.CommanderError)) {
+                env.stderr.write(`${colors_1.default.red('error')}: ${(0, log_1.getErrorMessage)(err)}\n`);
+            }
             throw err;
         }
     });

package/dist/schema/reference-parser.js

@@ -210,7 +210,9 @@ function resolveNeeds(reference, taskOrService, scope, schema) {
     for (const needName of schema.needs || []) {
         if (typeof needName === 'string') {
             taskOrService.needs.push({
-                relativeName: needName,
+                // the host name it is reached by: a service of an include, `services:postgres`, as
+                // `services-postgres`, since Docker and DNS take no colon
+                relativeName: needName.replace(/:/g, '-'),
                 service: findService(reference, scope, needName),
             });
         }
@@ -221,6 +223,11 @@ function resolveNeeds(reference, taskOrService, scope, schema) {
             });
         }
     }
+    const names = taskOrService.needs.map((need) => need.relativeName);
+    const twice = names.find((name, index) => names.indexOf(name) !== index);
+    if (twice) {
+        throw new Error(`${taskOrService.relativeName} needs two services as ${twice}, give one another name with name:`);
+    }
 }
 function findTask(ctx, scope, name, type) {
     const ref = (0, split_name_1.splitName)(name);

package/dist/secrets/github-app-token-command.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerGithubAppTokenCommand = void 0;
+const commander_1 = require("commander");
 const log_1 = require("../log");
 const github_app_token_1 = require("./github-app-token");
 // `hammerkit github-app-token <owner/repo>`: a secret provider command for the token a
@@ -18,7 +19,8 @@ function registerGithubAppTokenCommand(program, environment) {
         }
         catch (e) {
             environment.stderr.write(`github-app-token: ${(0, log_1.getErrorMessage)(e)}\n`);
-            throw e;
+            // said already: the CLI does not print it again
+            throw new commander_1.CommanderError(1, 'hammerkit.githubAppToken', (0, log_1.getErrorMessage)(e));
         }
     });
 }

package/dist/server/plan.js

@@ -13,6 +13,7 @@ const work_scope_parser_1 = require("../schema/work-scope-parser");
 const work_task_1 = require("../planner/work-task");
 const work_service_1 = require("../planner/work-service");
 const hosted_volumes_1 = require("../planner/utils/hosted-volumes");
+const normalize_path_1 = require("../planner/utils/normalize-path");
 const log_1 = require("../log");
 const parse_error_1 = require("../schema/parse-error");
 const task_arguments_1 = require("../planner/utils/task-arguments");
@@ -165,101 +166,127 @@ function describeSecret(secret) {
 // server has no account, so nothing would stand between the build file and the
 // operator's own credentials.
 function findPolicyProblems(items, policy, root) {
-    const problems = [];
+    // the problems of each item, said once for the items of a directory that share one, such
+    // as the tasks of an included file that all mount the docker socket
+    const grouped = new Map();
     for (const item of items) {
-        const runtime = item.data.type === 'local-task' ? 'local' : 'docker';
-        if (policy.runtimes && !policy.runtimes.includes(runtime)) {
-            problems.push(`${item.name}: runs on the ${runtime} runtime, which this server does not allow (runtimes: ${policy.runtimes.join(', ')})`);
-        }
-        const data = item.data;
-        // what a task reads and writes is the bundle's: `src: ../..` would have the server
-        // copy its own files (its credentials, other callers' caches) into the task
-        for (const source of 'src' in data ? data.src : []) {
-            if (!source.inherited && insideBundle(root, data.cwd, source.absolutePath).length === 0) {
-                problems.push(`${item.name}: src ${source.source} is outside of the bundle`);
+        const prefix = `${item.name}: `;
+        for (const problem of findItemPolicyProblems(item, policy, root)) {
+            const said = problem.startsWith(prefix) ? problem.slice(prefix.length) : problem;
+            const key = `${item.data.cwd}\0${said}`;
+            const group = grouped.get(key);
+            if (group) {
+                group.names.push(item.name);
             }
-        }
-        for (const generate of (0, work_task_1.isWorkTask)(data) ? data.generates : []) {
-            if (!generate.inherited && insideBundle(root, data.cwd, generate.path).length === 0) {
-                problems.push(`${item.name}: generates ${generate.path}, which is outside of the bundle`);
+            else {
+                grouped.set(key, { names: [item.name], problem: said });
             }
         }
-        // what holds a credential gets at most `runs.secretNetwork`, so a tool it runs can't
-        // send the credential anywhere else
-        const reads = getCredentialReads({
-            secrets: secretsOf(item).map(describeSecret),
-            serverEnvs: 'envs' in data ? data.envs.processNames ?? [] : [],
-        });
-        const ceilings = [];
-        if (policy.network && (0, work_network_1.isLimitedNetwork)(policy.network)) {
-            ceilings.push({ ceiling: policy.network, setting: 'runs.network', reason: '' });
+    }
+    return [...grouped.values()].map(({ names: [name, ...others], problem }) => others.length > 0 ? `${name} (also ${others.join(', ')}): ${problem}` : `${name}: ${problem}`);
+}
+function findItemPolicyProblems(item, policy, root) {
+    const problems = [];
+    const runtime = item.data.type === 'local-task' ? 'local' : 'docker';
+    // an aggregate runs nothing, on no runtime
+    if (policy.runtimes && !(0, work_task_1.isAggregateTask)(item.data) && !policy.runtimes.includes(runtime)) {
+        problems.push(`${item.name}: runs on the ${runtime} runtime, which this server does not allow (runtimes: ${policy.runtimes.join(', ')})`);
+    }
+    const data = item.data;
+    // what a task reads and writes is the bundle's: `src: ../..` would have the server
+    // copy its own files (its credentials, other callers' caches) into the task
+    for (const source of 'src' in data ? data.src : []) {
+        if (!source.inherited && insideBundle(root, data.cwd, source.absolutePath).length === 0) {
+            problems.push(`${item.name}: src ${source.source} is outside of the bundle`);
         }
-        if (reads.length > 0 && policy.secretNetwork && (0, work_network_1.isLimitedNetwork)(policy.secretNetwork)) {
-            ceilings.push({
-                ceiling: policy.secretNetwork,
-                setting: 'runs.secretNetwork',
-                reason: ` to what reads ${reads.join(', ')}`,
-            });
+    }
+    for (const generate of (0, work_task_1.isWorkTask)(data) ? data.generates : []) {
+        if (!generate.inherited && insideBundle(root, data.cwd, generate.path).length === 0) {
+            problems.push(`${item.name}: generates ${generate.path}, which is outside of the bundle`);
         }
-        for (const { ceiling, setting, reason } of ceilings) {
-            // on a cluster a local task is a pod of a pool's tool image, limited like any other
-            if (data.type === 'local-task' && policy.backend !== 'kubernetes') {
-                problems.push(`${item.name}: is a local task, which can't be limited to the network this server allows${reason} ` +
-                    `(${setting}: ${(0, work_network_1.formatNetwork)(ceiling)})`);
-            }
-            else if ('network' in data && (0, work_network_1.exceedsNetwork)(data.network, ceiling)) {
-                problems.push(`${item.name}: asks for network ${(0, work_network_1.formatNetwork)(data.network)}, more than this server allows${reason} ` +
-                    `(${setting}: ${(0, work_network_1.formatNetwork)(ceiling)})`);
-            }
+    }
+    // what holds a credential gets at most `runs.secretNetwork`, so a tool it runs can't
+    // send the credential anywhere else
+    const reads = getCredentialReads({
+        secrets: secretsOf(item).map(describeSecret),
+        serverEnvs: 'envs' in data ? data.envs.processNames ?? [] : [],
+    });
+    const ceilings = [];
+    if (policy.network && (0, work_network_1.isLimitedNetwork)(policy.network)) {
+        ceilings.push({ ceiling: policy.network, setting: 'runs.network', reason: '' });
+    }
+    if (reads.length > 0 && policy.secretNetwork && (0, work_network_1.isLimitedNetwork)(policy.secretNetwork)) {
+        ceilings.push({
+            ceiling: policy.secretNetwork,
+            setting: 'runs.secretNetwork',
+            reason: ` to what reads ${reads.join(', ')}`,
+        });
+    }
+    // an aggregate reaches nothing: it runs no command
+    for (const { ceiling, setting, reason } of (0, work_task_1.isAggregateTask)(data) ? [] : ceilings) {
+        // on a cluster a local task is a pod of a pool's tool image, limited like any other
+        if (data.type === 'local-task' && policy.backend !== 'kubernetes') {
+            problems.push(`${item.name}: is a local task, which can't be limited to the network this server allows${reason} ` +
+                `(${setting}: ${(0, work_network_1.formatNetwork)(ceiling)})`);
         }
-        if ((0, work_task_1.isContainerWorkTask)(data) || (0, work_service_1.isContainerWorkService)(data)) {
-            for (const mount of data.mounts) {
-                // a path of the server is not the build file's to mount: the docker socket, /etc, a home directory
-                if (insideBundle(root, data.cwd, mount.localPath).length === 0) {
-                    problems.push(`${item.name}: mounts ${mount.localPath}, which is outside of the bundle`);
-                }
-            }
+        else if ('network' in data && (0, work_network_1.exceedsNetwork)(data.network, ceiling)) {
+            problems.push(`${item.name}: asks for network ${(0, work_network_1.formatNetwork)(data.network)}, more than this server allows${reason} ` +
+                `(${setting}: ${(0, work_network_1.formatNetwork)(ceiling)})`);
         }
-        for (const volume of (0, work_service_1.isContainerWorkService)(data) ? data.volumes : []) {
-            // docker takes anything else for a path of the host, such as the docker socket
-            if (!(0, hosted_volumes_1.isVolumeName)(volume.name)) {
-                problems.push(`${item.name}: volume ${volume.name} is not a volume name, a path of the server can't be mounted`);
+    }
+    if ((0, work_task_1.isContainerWorkTask)(data) || (0, work_service_1.isContainerWorkService)(data)) {
+        for (const mount of data.mounts) {
+            // a path of the server is not the build file's to mount: the docker socket, /etc, a home directory
+            if (insideBundle(root, data.cwd, mount.localPath).length === 0) {
+                problems.push(`${item.name}: mounts ${describeMountSource(mount)}, which is outside of the bundle`);
             }
         }
-        for (const secret of secretsOf(item)) {
-            const source = secret.source;
-            if (policy.backend === 'kubernetes' && source.type === 'provider') {
-                // the server reads no secret of a provider on a cluster: the Job of a task does
-                if (!(0, work_task_1.isWorkTask)(item.data)) {
-                    problems.push(`${item.name}: the secret ${describeSecret(secret).target} is read from ${source.provider}, which ` +
-                        'this server does for tasks only, a service on its cluster gets no provider secret yet');
-                }
-                else if (secret.cache) {
-                    problems.push(`${item.name}: the secret ${describeSecret(secret).target} has cache: true, its digest would need ` +
-                        'the value before the Job of the task reads it, which this server does not support yet');
-                }
-                else if ((0, work_network_1.isLimitedNetwork)(item.data.network) && !policy.proxiedProviders?.includes(source.provider)) {
-                    // the init containers that read it share the pod's NetworkPolicy, and reach the
-                    // provider only through the egress proxy
-                    problems.push(`${item.name}: the secret ${describeSecret(secret).target} is read from ${source.provider} in the ` +
-                        `Job of the task, which network ${(0, work_network_1.formatNetwork)(item.data.network)} would cut off from it: ` +
-                        `this server names no endpoints of ${source.provider} in backend.providers.${source.provider}.allow ` +
-                        'for the egress proxy to let through, so the task keeps an open network');
-                }
-            }
-            if (source.type === 'provider' && policy.reserved?.includes(source.account)) {
-                problems.push(`${item.name}: the secret ${describeSecret(secret).target} is read as ${source.account}, which the server uses to read repositories`);
+    }
+    for (const volume of (0, work_service_1.isContainerWorkService)(data) ? data.volumes : []) {
+        // docker takes anything else for a path of the host, such as the docker socket
+        if (!(0, hosted_volumes_1.isVolumeName)(volume.name)) {
+            problems.push(`${item.name}: volume ${volume.name} is not a volume name, a path of the server can't be mounted`);
+        }
+    }
+    for (const secret of secretsOf(item)) {
+        const source = secret.source;
+        if (policy.backend === 'kubernetes' && source.type === 'provider') {
+            // the server reads no secret of a provider on a cluster: the Job of a task does
+            if (!(0, work_task_1.isWorkTask)(item.data)) {
+                problems.push(`${item.name}: the secret ${describeSecret(secret).target} is read from ${source.provider}, which ` +
+                    'this server does for tasks only, a service on its cluster gets no provider secret yet');
             }
-            else if (source.type === 'file') {
-                problems.push(`${item.name}: a secret can not read a file of the server (file:), use a secret provider`);
+            else if (secret.cache) {
+                problems.push(`${item.name}: the secret ${describeSecret(secret).target} has cache: true, its digest would need ` +
+                    'the value before the Job of the task reads it, which this server does not support yet');
             }
-            else if (source.type === 'env' && !policy.envs.includes(source.name)) {
-                problems.push(`${item.name}: the secret ${describeSecret(secret).target} reads env:${source.name}, which the server does not list in ${policy.envsFrom ?? 'runs.env.allow'}`);
+            else if ((0, work_network_1.isLimitedNetwork)(item.data.network) && !policy.proxiedProviders?.includes(source.provider)) {
+                // the init containers that read it share the pod's NetworkPolicy, and reach the
+                // provider only through the egress proxy
+                problems.push(`${item.name}: the secret ${describeSecret(secret).target} is read from ${source.provider} in the ` +
+                    `Job of the task, which network ${(0, work_network_1.formatNetwork)(item.data.network)} would cut off from it: ` +
+                    `this server names no endpoints of ${source.provider} in backend.providers.${source.provider}.allow ` +
+                    'for the egress proxy to let through, so the task keeps an open network');
             }
         }
+        if (source.type === 'provider' && policy.reserved?.includes(source.account)) {
+            problems.push(`${item.name}: the secret ${describeSecret(secret).target} is read as ${source.account}, which the server uses to read repositories`);
+        }
+        else if (source.type === 'file') {
+            problems.push(`${item.name}: a secret can not read a file of the server (file:), use a secret provider`);
+        }
+        else if (source.type === 'env' && !policy.envs.includes(source.name)) {
+            problems.push(`${item.name}: the secret ${describeSecret(secret).target} reads env:${source.name}, which the server does not list in ${policy.envsFrom ?? 'runs.env.allow'}`);
+        }
     }
     return problems;
 }
+// A mount of the home directory says so: `$PWD` in a mount is the home directory, not the
+// project, which reads like a path of the checkout
+function describeMountSource(mount) {
+    const home = (0, normalize_path_1.getHomeReference)(mount.mount.split(':')[0]);
+    return home ? `${mount.localPath} (${home} is the home directory)` : mount.localPath;
+}
 function toPlan(root, item) {
     const data = item.data;
     const secrets = secretsOf(item).map(describeSecret);
@@ -272,7 +299,7 @@ function toPlan(root, item) {
         : [];
     const ports = 'ports' in data ? data.ports.map((port) => `${port.hostPort ?? ''}:${port.containerPort}`) : [];
     const flags = [];
-    if (data.type === 'local-task') {
+    if (data.type === 'local-task' && !(0, work_task_1.isAggregateTask)(data)) {
         flags.push('local-task');
     }
     if ('ports' in data && data.ports.some((port) => port.hostPort !== null)) {
@@ -285,7 +312,7 @@ function toPlan(root, item) {
     return {
         kind: isTask ? 'task' : 'service',
         ...(data.description ? { description: data.description } : {}),
-        runtime: data.type === 'local-task' ? 'local' : 'docker',
+        runtime: (0, work_task_1.isAggregateTask)(data) ? 'none' : data.type === 'local-task' ? 'local' : 'docker',
         ...((0, work_task_1.isContainerWorkTask)(data) || (0, work_service_1.isContainerWorkService)(data) ? { image: data.image } : {}),
         cmds: 'cmds' in data ? data.cmds.map((cmd) => cmd.cmd) : 'cmd' in data && data.cmd ? [data.cmd.cmd] : [],
         command: (0, task_arguments_1.getArgumentsTarget)(data)?.cmd ?? null,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "hammerkit",
   "description": "Containerized build tool with incremental caching that runs the same build file locally, in Docker and on Kubernetes.",
-  "version": "1.27.0-next.17",
+  "version": "1.27.0-next.19",
   "keywords": [
     "build",
     "build-tool",