hammerkit 1.27.0-next.19 → 1.27.0-next.20

package/dist/harness/connect.js

@@ -49,7 +49,7 @@ async function connectServer(environment, options) {
     if (!bundle_1.HASH_PATTERN.test(options.build)) {
         throw new Error(`${options.build} is not the hash of a published version (sha256:...), name it as hammerkit remote publish printed it (HAMMERKIT_BUILD or --build)`);
     }
-    const server = config.servers[name];
+    const server = (0, host_config_1.getRegisteredServer)(config, name);
     return { name, connection: { url: server.url, ...(0, token_source_1.getTokenSource)(environment, name, server) }, build: options.build };
 }
 exports.connectServer = connectServer;

package/dist/remote/device-login.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.deviceLogin = void 0;
+exports.deviceLogin = exports.NoSignInError = void 0;
 const server_client_1 = require("./server-client");
 const GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:device_code';
 const DEFAULT_INTERVAL_SECONDS = 5;
@@ -8,6 +8,11 @@ const SLOW_DOWN_SECONDS = 5;
 const FETCH_TIMEOUT_MS = 10000;
 const MIN_INTERVAL_SECONDS = 1;
 const MAX_LIFETIME_SECONDS = 30 * 60;
+// The server takes tokens of this issuer but offers no device sign-in for it: the token has
+// to come from elsewhere, such as a token command.
+class NoSignInError extends server_client_1.ServerError {
+}
+exports.NoSignInError = NoSignInError;
 const isLoopbackHost = (hostname) => ['localhost', '127.0.0.1', '[::1]'].includes(hostname);
 // An endpoint must use the scheme of the issuer: loopback http is for a test
 // identity provider on this machine only, never beside an https issuer.
@@ -89,7 +94,7 @@ async function deviceLogin(server, options) {
         throw new server_client_1.ServerError(`${server.url} does not accept tokens from ${server.issuer} (it accepts ${accepted})`);
     }
     if (!offered.clientId) {
-        throw new server_client_1.ServerError(`${server.url} offers no sign-in for ${server.issuer}, it needs a token obtained elsewhere`);
+        throw new NoSignInError(`${server.url} offers no sign-in for ${server.issuer}, it needs a token obtained elsewhere`);
     }
     // What was pinned (by `remote add` or an earlier login) wins; the server can
     // only offer the same, never something else to sign in with.

package/dist/remote/host-config.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.pinLogin = exports.setDefaultLocation = exports.removeServer = exports.addServer = exports.normalizeServerUrl = exports.validateServerName = exports.writeHostConfig = exports.readHostConfig = exports.getHostConfigPath = exports.hasServer = exports.hostConfigSchema = exports.hostServerSchema = exports.RESERVED_SERVER_NAMES = void 0;
+exports.pinLogin = exports.setDefaultLocation = exports.removeServer = exports.addServer = exports.normalizeServerUrl = exports.validateServerName = exports.writeHostConfig = exports.readHostConfig = exports.getHostConfigPath = exports.getRegisteredServer = exports.getTokenCommand = exports.hasServer = exports.hostConfigSchema = exports.hostServerSchema = exports.RESERVED_SERVER_NAMES = void 0;
 const path_1 = require("path");
 const zod_1 = require("zod");
 const yaml_1 = require("yaml");
@@ -28,11 +28,20 @@ exports.hostServerSchema = zod_1.z
     scope: zod_1.z.string().min(1).optional(),
 })
     .strict();
+// A command that prints the token for a server instead of a login, see token-source.ts.
+// It is bound to the url and issuer it was registered for, like a sign-in, and lives
+// beside `servers` rather than in it: hammerkit before 1.27 refuses unknown keys of a
+// server, but keeps unknown top-level keys. It is only ever read from the host config,
+// a build file can't name one.
+const tokenCommandSchema = zod_1.z
+    .object({ url: zod_1.z.string(), issuer: zod_1.z.string(), command: zod_1.z.string().trim().min(1) })
+    .passthrough();
 // Unknown top-level keys are kept when the file is written back, so a newer
 // hammerkit's settings survive an older one editing the file.
 exports.hostConfigSchema = zod_1.z
     .object({
     servers: zod_1.z.record(exports.hostServerSchema).default({}),
+    tokenCommands: zod_1.z.record(tokenCommandSchema).optional(),
     run: zod_1.z.object({ on: zod_1.z.string().optional() }).passthrough().default({}),
 })
     .passthrough();
@@ -41,6 +50,35 @@ function hasServer(servers, name) {
     return Object.prototype.hasOwnProperty.call(servers, name);
 }
 exports.hasServer = hasServer;
+// The token command of a server, unless it was registered for another url or issuer (an
+// older hammerkit that pointed the name elsewhere leaves it behind).
+function getTokenCommand(config, name) {
+    const commands = config.tokenCommands ?? {};
+    const entry = Object.prototype.hasOwnProperty.call(commands, name) ? commands[name] : undefined;
+    const server = hasServer(config.servers, name) ? config.servers[name] : undefined;
+    return entry && server && entry.url === server.url && entry.issuer === server.issuer ? entry.command : undefined;
+}
+exports.getTokenCommand = getTokenCommand;
+function getRegisteredServer(config, name) {
+    const tokenCommand = getTokenCommand(config, name);
+    return { ...config.servers[name], ...(tokenCommand ? { tokenCommand } : {}) };
+}
+exports.getRegisteredServer = getRegisteredServer;
+function setTokenCommand(config, name, entry) {
+    const commands = { ...(config.tokenCommands ?? {}) };
+    if (entry) {
+        commands[name] = entry;
+    }
+    else {
+        delete commands[name];
+    }
+    if (Object.keys(commands).length > 0) {
+        config.tokenCommands = commands;
+    }
+    else {
+        delete config.tokenCommands;
+    }
+}
 function getHostConfigPath(environment) {
     return environment.processEnvs.HAMMERKIT_CONFIG ?? (0, path_1.join)((0, get_cache_directory_1.getHammerkitDirectory)(), 'config.yaml');
 }
@@ -121,16 +159,38 @@ async function addServer(environment, name, url, options) {
             server[key] = options[key];
         }
     }
+    if (typeof options.tokenCommand === 'string' && !options.tokenCommand.trim()) {
+        throw new Error('the token command must not be empty, use --no-token-command to remove it');
+    }
     const config = await readHostConfig(environment);
     const existing = hasServer(config.servers, name) ? config.servers[name] : undefined;
-    const changed = (a, b) => a.url !== b.url || a.issuer !== b.issuer || PINNED.some((key) => a[key] !== b[key]);
+    const sameServer = (a, b) => a.url === b.url && a.issuer === b.issuer;
+    // Adding the same server again keeps what was pinned (by a login, too) unless it is given,
+    // so a later `remote add ... --token-command` needs no --force.
+    if (existing && sameServer(existing, server)) {
+        for (const key of PINNED) {
+            if (!server[key] && existing[key]) {
+                server[key] = existing[key];
+            }
+        }
+    }
+    const changed = (a, b) => !sameServer(a, b) || PINNED.some((key) => a[key] !== b[key]);
     if (existing && changed(existing, server) && !options.force) {
         throw new Error(`server "${name}" is already registered as ${existing.url} (issuer ${existing.issuer}); ` +
             `use --force to point it somewhere else`);
     }
+    // The command decides which identity's token goes to the server: changing it does not
+    // redirect anything, but a name pointed at another server does not keep the old one.
+    const kept = existing && sameServer(existing, server) ? getTokenCommand(config, name) : undefined;
+    const tokenCommand = typeof options.tokenCommand === 'string'
+        ? options.tokenCommand.trim()
+        : options.tokenCommand === undefined
+            ? kept
+            : undefined;
     config.servers[name] = server;
+    setTokenCommand(config, name, tokenCommand ? { url: server.url, issuer: server.issuer, command: tokenCommand } : undefined);
     await writeHostConfig(environment, config);
-    return server;
+    return { ...server, ...(tokenCommand ? { tokenCommand } : {}) };
 }
 exports.addServer = addServer;
 async function removeServer(environment, name) {
@@ -139,6 +199,7 @@ async function removeServer(environment, name) {
         throw new Error(`server "${name}" is not registered`);
     }
     delete config.servers[name];
+    setTokenCommand(config, name, undefined);
     const resetDefault = config.run.on === name;
     if (resetDefault) {
         delete config.run.on;

package/dist/remote/remote-commands.js

@@ -40,6 +40,8 @@ passthrough = []) {
         .addOption(new commander_1.Option('--client-id <id>', 'OAuth client to sign in with (pinned; default: what the server offers)'))
         .addOption(new commander_1.Option('--audience <audience>', 'audience of the token (pinned; default: what the server offers)'))
         .addOption(new commander_1.Option('--scope <scope>', 'scopes to request (pinned; default: what the server offers)'))
+        .addOption(new commander_1.Option('--token-command <command>', 'a command that prints the token for this server, instead of remote login (e.g. of a service account)'))
+        .addOption(new commander_1.Option('--no-token-command', 'remove the token command, sign in with remote login again'))
         .addOption(new commander_1.Option('--force', 'point an already registered name at a different server').default(false))
         .action(guarded('Remote add was not successful', async (name, url, options) => {
         const server = await (0, host_config_1.addServer)(environment, name, url, {
@@ -47,9 +49,13 @@ passthrough = []) {
             clientId: options.clientId,
             audience: options.audience,
             scope: options.scope,
+            tokenCommand: options.tokenCommand,
             force: options.force,
         });
         environment.stdout.write(`added ${name}: ${server.url} (issuer ${server.issuer})\n`);
+        if (server.tokenCommand) {
+            environment.stdout.write(`tokens for ${name} come from: ${server.tokenCommand}\n`);
+        }
     }));
     remote
         .command('list')
@@ -62,9 +68,10 @@ passthrough = []) {
             return;
         }
         for (const name of names) {
-            const server = config.servers[name];
+            const server = (0, host_config_1.getRegisteredServer)(config, name);
             const marker = config.run.on === name ? colors_1.default.green(' (default)') : '';
-            environment.stdout.write(`${colors_1.default.bold(name)}${marker}  ${server.url}  issuer ${server.issuer}\n`);
+            const token = server.tokenCommand ? `  token from: ${server.tokenCommand}` : '';
+            environment.stdout.write(`${colors_1.default.bold(name)}${marker}  ${server.url}  issuer ${server.issuer}${token}\n`);
         }
         if (config.run.on === 'auto' || config.run.on === 'local') {
             environment.stdout.write(`default location: ${config.run.on}\n`);
@@ -95,17 +102,33 @@ passthrough = []) {
                 ? `server ${name} is not registered, add it with: hammerkit remote add ${name} <url> --issuer <url>`
                 : 'name a server, or set one as the default with: hammerkit remote use <name>');
         }
-        return { name: chosen, server: config.servers[chosen] };
+        return { name: chosen, server: (0, host_config_1.getRegisteredServer)(config, chosen) };
     };
     remote
         .command('login <name>')
         .description('sign in to a registered server with your identity provider (device code, works headless)')
         .action(guarded('Remote login was not successful', async (name) => {
         const { server } = await getServer(name);
-        const { pinned, ...result } = await (0, device_login_1.deviceLogin)(server, {
-            prompt: (message) => environment.stdout.write(`${message}\n`),
-            signal: environment.abortCtrl.signal,
-        });
+        if (server.tokenCommand) {
+            // a sign-in would never be used: the command's token goes first
+            throw new Error(`${name} takes its tokens from its token command (${server.tokenCommand}), it needs no sign-in; ` +
+                `to sign in instead, remove it with: hammerkit remote add ${name} ${server.url} --issuer ${server.issuer} --no-token-command`);
+        }
+        let login;
+        try {
+            login = await (0, device_login_1.deviceLogin)(server, {
+                prompt: (message) => environment.stdout.write(`${message}\n`),
+                signal: environment.abortCtrl.signal,
+            });
+        }
+        catch (e) {
+            if (e instanceof device_login_1.NoSignInError) {
+                throw new Error(`${e.message}: register a command that prints one, such as the token of a service account, with: ` +
+                    `hammerkit remote add ${name} ${server.url} --issuer ${server.issuer} --token-command '<command>'`);
+            }
+            throw e;
+        }
+        const { pinned, ...result } = login;
         await (0, host_config_1.pinLogin)(environment, name, pinned);
         await (0, credentials_1.saveToken)(environment, name, { url: server.url, issuer: server.issuer, ...result });
         try {

package/dist/remote/token-source.js

@@ -9,6 +9,54 @@ function isToken(value) {
     return /^[\x21-\x7e]+$/.test(value);
 }
 exports.isToken = isToken;
+// What a failed token command said on stderr, for the user's own terminal: never its stdout,
+// and never in an error message, which a harness hands on to an agent.
+const MAX_STDERR_LINES = 20;
+const MAX_STDERR_LINE = 300;
+function writeStderr(environment, what, stderr) {
+    const lines = stderr
+        .split(/\r?\n/)
+        .map((line) => line.replace(/[^\x20-\x7e\t]/g, '?').slice(0, MAX_STDERR_LINE))
+        .filter((line) => line.trim())
+        .slice(-MAX_STDERR_LINES);
+    for (const line of lines) {
+        environment.stderr.write(`${what}: ${line}\n`);
+    }
+}
+function commandSource(environment, command, what) {
+    let current;
+    const run = () => new Promise((resolve, reject) => {
+        (0, child_process_1.exec)(command, { env: environment.processEnvs, timeout: 60000 }, (error, stdout, stderr) => {
+            const token = String(stdout).trim();
+            if (error || !token) {
+                writeStderr(environment, what, String(stderr));
+                const status = error?.killed
+                    ? ', it did not end within a minute'
+                    : typeof error?.code === 'number'
+                        ? `, it exited with ${error.code}`
+                        : '';
+                reject(new Error(`${what} printed no token${status}`));
+            }
+            else if (!isToken(token)) {
+                // never the output itself: it can hold more secrets than the token
+                reject(new Error(`${what} printed more than a token, it has to print the token alone`));
+            }
+            else {
+                resolve(token);
+            }
+        });
+    });
+    return {
+        token: () => {
+            current = current ?? run();
+            current.catch(() => (current = undefined));
+            return current;
+        },
+        renew: async () => {
+            current = undefined;
+        },
+    };
+}
 /**
  * The token a client of a server sends: a harness, and the `remote` commands. In this order:
  *
@@ -16,42 +64,29 @@ exports.isToken = isToken;
  *   identity, such as a workload identity or a service account of the identity provider. It
  *   runs again when the server no longer accepts the token.
  * - `HAMMERKIT_TOKEN`: such a token, as the agent's platform hands it over.
+ * - the token command of the server in the host config (`remote add --token-command`): the
+ *   same as `HAMMERKIT_TOKEN_COMMAND`, for one server, so each server can have the service
+ *   account and audience it accepts. It only ever comes from the host config, never from a
+ *   build file: whoever writes it decides what runs on this machine.
  * - the sign-in of `hammerkit remote login <server>`.
  *
  * The token only goes to the URL the server is registered with in the host config.
  */
 function getTokenSource(environment, name, server) {
+    // a variable holds for every server: say so when it takes the place of the one registered
+    const overrides = (variable) => {
+        if (server.tokenCommand) {
+            environment.stderr.write(`${variable} is set, so the token command of ${name} is not used\n`);
+        }
+    };
     const command = environment.processEnvs.HAMMERKIT_TOKEN_COMMAND;
     if (command) {
-        let current;
-        const run = () => new Promise((resolve, reject) => {
-            (0, child_process_1.exec)(command, { env: environment.processEnvs, timeout: 60000 }, (error, stdout) => {
-                const token = String(stdout).trim();
-                if (error || !token) {
-                    reject(new Error('HAMMERKIT_TOKEN_COMMAND printed no token'));
-                }
-                else if (!isToken(token)) {
-                    // never the output itself: it can hold more secrets than the token
-                    reject(new Error('HAMMERKIT_TOKEN_COMMAND printed more than a token, it has to print the token alone'));
-                }
-                else {
-                    resolve(token);
-                }
-            });
-        });
-        return {
-            token: () => {
-                current = current ?? run();
-                current.catch(() => (current = undefined));
-                return current;
-            },
-            renew: async () => {
-                current = undefined;
-            },
-        };
+        overrides('HAMMERKIT_TOKEN_COMMAND');
+        return commandSource(environment, command, 'HAMMERKIT_TOKEN_COMMAND');
     }
     const fixed = environment.processEnvs.HAMMERKIT_TOKEN?.trim();
     if (fixed) {
+        overrides('HAMMERKIT_TOKEN');
         return {
             token: async () => {
                 if (!isToken(fixed)) {
@@ -61,6 +96,9 @@ function getTokenSource(environment, name, server) {
             },
         };
     }
+    if (server.tokenCommand) {
+        return commandSource(environment, server.tokenCommand, `the token command of ${name}`);
+    }
     return { token: () => (0, credentials_1.getAccessToken)(environment, name, server) };
 }
 exports.getTokenSource = getTokenSource;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "hammerkit",
   "description": "Containerized build tool with incremental caching that runs the same build file locally, in Docker and on Kubernetes.",
-  "version": "1.27.0-next.19",
+  "version": "1.27.0-next.20",
   "keywords": [
     "build",
     "build-tool",