hammerkit 1.27.0-next.2 → 1.27.0-next.20

package/dist/planner/validate.js

@@ -4,6 +4,7 @@ exports.checkIfContextExists = exports.hasDependencyCycle = exports.hasNeedCycle
 const read_build_file_1 = require("../parser/read-build-file");
 const plan_work_tasks_1 = require("./utils/plan-work-tasks");
 const unreferenced_build_file_envs_1 = require("./unreferenced-build-file-envs");
+const normalize_path_1 = require("./utils/normalize-path");
 async function* validate(workTree, context) {
     const cycleItems = [];
     for (const item of (0, plan_work_tasks_1.iterateWorkServices)(workTree)) {
@@ -16,6 +17,10 @@ async function* validate(workTree, context) {
                 yield { type: 'warn', message: 'missing healthcheck', item: service };
             }
             for (const mount of service.mounts) {
+                const pwd = getPwdMountWarning(mount);
+                if (pwd) {
+                    yield { type: 'warn', message: pwd, item: service };
+                }
                 if (!(await context.file.exists(mount.localPath))) {
                     yield {
                         type: 'warn',
@@ -62,6 +67,12 @@ async function* validate(workTree, context) {
                 item: task,
             };
         }
+        for (const mount of task.type === 'container-task' ? task.mounts : []) {
+            const pwd = getPwdMountWarning(mount);
+            if (pwd) {
+                yield { type: 'warn', message: pwd, item: task };
+            }
+        }
         for (const src of task.src) {
             if (!(await context.file.exists(src.absolutePath))) {
                 yield {
@@ -146,4 +157,15 @@ async function checkIfContextExists(service, context) {
     return false;
 }
 exports.checkIfContextExists = checkIfContextExists;
+// `$PWD` in a mount is the home directory, which reads like a path of the project
+function getPwdMountWarning(mount) {
+    const source = mount.mount.split(':')[0];
+    if ((0, normalize_path_1.getHomeReference)(source) !== '$PWD') {
+        return null;
+    }
+    const rest = source.substring('$PWD'.length);
+    const home = rest === '' || rest.startsWith('/') || rest.startsWith('\\') ? `~${rest}` : '~/…';
+    return (`mount ${source} is ${mount.localPath}: $PWD in a mount is the home directory, not the project. ` +
+        `Write ${home} for the home directory, or a relative path for the project`);
+}
 //# sourceMappingURL=validate.js.map

package/dist/planner/work-network.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.applyNetworkCeiling = exports.formatNetwork = exports.getTcpForwards = exports.matchesHost = exports.isLimitedNetwork = exports.toNetworkSchema = exports.exceedsNetwork = exports.getEffectiveNetwork = exports.limitNetwork = exports.parseNetworkOption = exports.parseWorkNetwork = exports.OPEN_NETWORK = void 0;
 const network_schema_1 = require("../schema/network-schema");
+const work_task_1 = require("./work-task");
 exports.OPEN_NETWORK = { type: 'open' };
 function parseWorkNetwork(schema) {
     if (!schema || schema === 'open') {
@@ -153,7 +154,8 @@ exports.formatNetwork = formatNetwork;
 function applyNetworkCeiling(workTree, ceiling) {
     const limit = ceiling && isLimitedNetwork(ceiling) ? ceiling : null;
     if (limit) {
-        const local = Object.values(workTree.tasks).find((task) => task.data.type === 'local-task');
+        // an aggregate runs nothing, so there is nothing of it to limit
+        const local = Object.values(workTree.tasks).find((task) => task.data.type === 'local-task' && !(0, work_task_1.isAggregateTask)(task.data));
         if (local) {
             throw new Error(`--network ${formatNetwork(limit)} needs every task in a container, ` +
                 `hammerkit can't limit the network of the local task ${local.name}`);

package/dist/planner/work-runtime-aggregate.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.aggregateWorkRuntime = void 0;
+// An aggregate runs nothing, so it touches nothing: no pid or state file in its
+// directory (on a server that is a checkout it doesn't trust), no outputs.
+function aggregateWorkRuntime() {
+    return {
+        async initialize() {
+            // nothing to prepare
+        },
+        async remove() {
+            // it has no outputs of its own
+        },
+        async execute() {
+            // its state stays running, and executeWorkTask completes it
+        },
+        async stop() {
+            // nothing is running
+        },
+        async archive() {
+            // never pushed, see pushToBackend
+        },
+        async restore() {
+            // never a hit, see checkCacheState
+        },
+        async currentStateKey() {
+            return null;
+        },
+    };
+}
+exports.aggregateWorkRuntime = aggregateWorkRuntime;
+//# sourceMappingURL=work-runtime-aggregate.js.map

package/dist/planner/work-runtime-docker.js

@@ -12,6 +12,7 @@ const event_cache_1 = require("../executer/event-cache");
 const get_docker_executor_1 = require("../executer/get-docker-executor");
 const path_1 = require("path");
 const tar_1 = require("tar");
+const tar_2 = require("../utils/tar");
 const plan_work_volume_1 = require("./utils/plan-work-volume");
 const work_instance_id_1 = require("./work-instance-id");
 const stream_1 = require("stream");
@@ -302,7 +303,7 @@ async function archiveContainer(docker, environment, item, path) {
         for (const generatedArchive of (0, event_cache_1.getArchivePaths)(item.data, path)) {
             // a file output is a bind mount of a host file, so archive it from the host
             const readable = hostFiles.has(generatedArchive.path)
-                ? stream_1.Readable.from((0, tar_1.create)({ cwd: (0, path_1.dirname)(generatedArchive.path) }, [(0, path_1.basename)(generatedArchive.path)]))
+                ? stream_1.Readable.from((0, tar_2.packArchive)({ cwd: (0, path_1.dirname)(generatedArchive.path) }, [(0, path_1.basename)(generatedArchive.path)]))
                 : await container.getArchive({
                     path: generatedArchive.path,
                 });

package/dist/planner/work-runtime-kubernetes.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.kubernetesForwardRuntime = exports.kubernetesServiceRuntime = exports.kubernetesTaskRuntime = exports.describeFailedJob = void 0;
+exports.kubernetesForwardRuntime = exports.kubernetesServiceRuntime = exports.kubernetesTaskRuntime = exports.getTaskJobContainers = exports.describeFailedJob = void 0;
 const abort_1 = require("../executer/abort");
 const kubernetes_service_1 = require("../executer/kubernetes-service");
 const kubernetes_instance_1 = require("../kubernetes/kubernetes-instance");
@@ -34,11 +34,12 @@ const job_placement_1 = require("../kubernetes/job-placement");
 const network_policy_1 = require("../kubernetes/network-policy");
 const run_id_1 = require("../utils/run-id");
 const work_network_1 = require("./work-network");
+const sandbox_runner_1 = require("../kubernetes/sandbox-runner");
 const work_secret_1 = require("./work-secret");
 async function listJobNames(instance, kubernetes, task) {
     const jobs = await instance.batchApi.listNamespacedJob({
         namespace: kubernetes.namespace,
-        labelSelector: `hammerkit.dev/id=${task.id()}`,
+        labelSelector: (0, resources_1.getItemSelector)(task, kubernetes),
     });
     return jobs.items.flatMap((job) => (job.metadata?.name ? [job.metadata.name] : []));
 }
@@ -125,6 +126,41 @@ async function describeFailedJob(instance, kubernetes, task, job, container, sec
     return undefined;
 }
 exports.describeFailedJob = describeFailedJob;
+/**
+ * The containers of the Job of a command: the network gate first, nothing runs before the
+ * item's policy holds, then the init containers that read its secrets, then the command. The
+ * proxy's token (`network.secretEnv`) reaches the init containers through `secretSpec` only:
+ * the command's container gets the proxy variables of a limited network without it.
+ */
+function getTaskJobContainers(options) {
+    const { task, cmd, envs, secrets, network, secretSpec, kubernetes } = options;
+    // the arguments after `--` keep their `$` as text, Kubernetes expands `$(NAME)`
+    const command = secretSpec.command(task.data.shell, (0, task_arguments_1.getKubernetesCommandText)(cmd));
+    const initContainers = [...network.initContainers, ...secretSpec.initContainers];
+    return {
+        ...(initContainers.length > 0 ? { initContainers } : {}),
+        containers: [
+            {
+                image: task.data.image,
+                // through the task's shell, as on Docker
+                command: command.command,
+                args: command.args,
+                workingDir: cmd.cwd,
+                env: [
+                    ...Object.entries(envs).map(([key, value]) => ({ name: key, value })),
+                    ...secrets.env,
+                    ...network.env,
+                    ...command.env,
+                ],
+                name: options.container,
+                volumeMounts: [...options.mounts, ...secrets.mounts, ...secretSpec.mounts],
+                ...(0, container_resources_1.getKubernetesResources)(task.data.resources),
+                ...(0, job_placement_1.getContainerSecurity)(kubernetes),
+            },
+        ],
+    };
+}
+exports.getTaskJobContainers = getTaskJobContainers;
 function kubernetesTaskRuntime(task, kubernetes) {
     const instance = (0, kubernetes_instance_1.createKubernetesInstances)(kubernetes);
     // on a server that keeps them, the task's claim stays after the run with the state of its
@@ -153,6 +189,28 @@ function kubernetesTaskRuntime(task, kubernetes) {
             const envs = (0, replace_env_variables_1.getEnvironmentVariables)(task.data.envs);
             const persistence = await (0, volumes_1.getKubernetesPersistence)(task, kubernetes);
             const workspace = (0, volumes_1.getWorkspacePodSpec)(kubernetes, persistence, { name: task.name, pool: task.data.pool });
+            // a shell of a sandbox: its commands go into the sandbox's runner, when it has one now
+            if ((0, sandbox_runner_1.canUseRunner)(task, kubernetes, persistence)) {
+                try {
+                    const result = await (0, sandbox_runner_1.executeInRunner)(instance, task, kubernetes, persistence, options.abort);
+                    if (result.type === 'crash') {
+                        options.state.set({ stateKey: options.stateKey, type: 'crash', exitCode: result.exitCode });
+                        return;
+                    }
+                    // stopped while the runner started: no Job for it either
+                    if (result.type === 'canceled' || options.abort.aborted) {
+                        options.state.set({ stateKey: options.stateKey, type: 'canceled' });
+                        return;
+                    }
+                    if (result.type === 'done') {
+                        return;
+                    }
+                }
+                catch (e) {
+                    options.state.set({ stateKey: options.stateKey, type: 'error', errorMessage: (0, log_1.getErrorMessage)(e) });
+                    return;
+                }
+            }
             await (0, ensure_namespace_1.ensureNamespace)(instance, kubernetes.namespace);
             try {
                 // the task writes to it now: what it holds stops being the outputs of a state, and
@@ -166,10 +224,11 @@ function kubernetesTaskRuntime(task, kubernetes) {
             }
             const server = kubernetes.server;
             const { delivered, inJob } = (0, job_secrets_1.splitJobSecrets)(task.data.secrets, server);
-            const secrets = (0, secrets_1.getKubernetesSecretRefs)(task, delivered);
+            const secrets = (0, secrets_1.getKubernetesSecretRefs)(task, kubernetes, delivered);
             const admitted = environment.hosted?.accounts;
+            let secretHosts;
             try {
-                (0, job_secrets_1.assertSecretsReachable)(task, inJob);
+                secretHosts = (0, job_secrets_1.getSecretHosts)(task, inJob, server);
                 if (server) {
                     (0, job_secrets_1.assertJobAccounts)(inJob, server, admitted);
                 }
@@ -194,7 +253,7 @@ function kubernetesTaskRuntime(task, kubernetes) {
                     : {}),
             };
             const labels = {
-                'hammerkit.dev/id': task.id(),
+                ...(0, resources_1.getItemLabels)(task, kubernetes),
                 'hammerkit.dev/state': options.stateKey,
                 ...workspace.labels,
                 [network_policy_1.RUN_LABEL]: scope.run,
@@ -210,7 +269,11 @@ function kubernetesTaskRuntime(task, kubernetes) {
             // NetworkPolicy and proxy of a limited network, both of this run
             let network;
             try {
-                network = await (0, network_policy_1.ensureKubernetesItemNetwork)(instance, kubernetes, task, { followLog: true, ...scope });
+                network = await (0, network_policy_1.ensureKubernetesItemNetwork)(instance, kubernetes, task, {
+                    followLog: true,
+                    secretHosts,
+                    ...scope,
+                });
             }
             catch (e) {
                 await removeTaskSecrets(instance, kubernetes, task).catch(() => undefined);
@@ -218,7 +281,7 @@ function kubernetesTaskRuntime(task, kubernetes) {
                 return;
             }
             try {
-                const podName = (0, resources_1.getResourceName)(task, '-job');
+                const podName = (0, resources_1.getResourceName)(task, kubernetes, '-job');
                 let i = 0;
                 for (const cmd of task.data.cmds) {
                     const container = `cmd-${++i}`;
@@ -226,15 +289,13 @@ function kubernetesTaskRuntime(task, kubernetes) {
                     try {
                         // made for each Job right before it, so a later command's token is as fresh
                         const credentials = await (0, job_secrets_1.ensureJobCredentials)(instance, kubernetes, task, inJob, admitted);
-                        secretSpec = (0, job_secrets_1.getJobSecretSpec)(task, inJob, server, credentials, environment);
+                        secretSpec = (0, job_secrets_1.getJobSecretSpec)(task, inJob, server, credentials, environment, network.secretEnv);
                     }
                     catch (e) {
                         await removeTaskSecrets(instance, kubernetes, task).catch(() => undefined);
                         options.state.set({ stateKey: options.stateKey, type: 'error', errorMessage: (0, log_1.getErrorMessage)(e) });
                         return;
                     }
-                    // the arguments after `--` keep their `$` as text, Kubernetes expands `$(NAME)`
-                    const command = secretSpec.command(task.data.shell, (0, task_arguments_1.getKubernetesCommandText)(cmd));
                     const spec = {
                         kind: 'Job',
                         apiVersion: 'batch/v1',
@@ -255,33 +316,17 @@ function kubernetesTaskRuntime(task, kubernetes) {
                                     labels,
                                 },
                                 spec: {
-                                    // the network gate first: nothing runs before the item's policy holds
-                                    ...(network.initContainers.length + secretSpec.initContainers.length > 0
-                                        ? { initContainers: [...network.initContainers, ...secretSpec.initContainers] }
-                                        : {}),
-                                    containers: [
-                                        {
-                                            image: task.data.image,
-                                            // through the task's shell, as on Docker
-                                            command: command.command,
-                                            args: command.args,
-                                            workingDir: cmd.cwd,
-                                            env: [
-                                                ...Object.entries(envs).map(([key, value]) => ({ name: key, value })),
-                                                ...secrets.env,
-                                                ...network.env,
-                                                ...command.env,
-                                            ],
-                                            name: container,
-                                            volumeMounts: [
-                                                ...persistence.mounts.map((m) => m.mount),
-                                                ...secrets.mounts,
-                                                ...secretSpec.mounts,
-                                            ],
-                                            ...(0, container_resources_1.getKubernetesResources)(task.data.resources),
-                                            ...(0, job_placement_1.getContainerSecurity)(kubernetes),
-                                        },
-                                    ],
+                                    ...getTaskJobContainers({
+                                        task,
+                                        cmd,
+                                        container,
+                                        envs,
+                                        secrets,
+                                        network,
+                                        secretSpec,
+                                        mounts: persistence.mounts.map((m) => m.mount),
+                                        kubernetes,
+                                    }),
                                     volumes: [
                                         ...persistence.volumes,
                                         ...persistence.workspace,
@@ -365,7 +410,7 @@ function kubernetesTaskRuntime(task, kubernetes) {
         async stop() {
             const jobs = await instance.batchApi.listNamespacedJob({
                 namespace: kubernetes.namespace,
-                labelSelector: `hammerkit.dev/id=${task.id()}`,
+                labelSelector: (0, resources_1.getItemSelector)(task, kubernetes),
             });
             for (const job of jobs.items) {
                 if (job.metadata?.name) {
@@ -374,7 +419,7 @@ function kubernetesTaskRuntime(task, kubernetes) {
             }
             const deployments = await instance.appsApi.listNamespacedDeployment({
                 namespace: kubernetes.namespace,
-                labelSelector: `hammerkit.dev/id=${task.id()}`,
+                labelSelector: (0, resources_1.getItemSelector)(task, kubernetes),
             });
             for (const deploy of deployments.items) {
                 if (deploy.metadata?.name) {
@@ -386,7 +431,7 @@ function kubernetesTaskRuntime(task, kubernetes) {
             }
             const pods = await instance.coreApi.listNamespacedPod({
                 namespace: kubernetes.namespace,
-                labelSelector: `hammerkit.dev/id=${task.id()}`,
+                labelSelector: (0, resources_1.getItemSelector)(task, kubernetes),
             });
             for (const pod of pods.items) {
                 if (pod.metadata?.name) {
@@ -408,7 +453,7 @@ function kubernetesTaskRuntime(task, kubernetes) {
             }
             const jobs = await instance.batchApi.listNamespacedJob({
                 namespace: kubernetes.namespace,
-                labelSelector: `hammerkit.dev/id=${task.id()}`,
+                labelSelector: (0, resources_1.getItemSelector)(task, kubernetes),
             });
             const completedStates = jobs.items
                 .filter((j) => j.status?.succeeded && j.metadata?.labels?.['hammerkit.dev/state'])
@@ -445,7 +490,7 @@ function kubernetesServiceRuntime(service, kubernetes) {
         async initialize(state) {
             const deployments = await instance.appsApi.listNamespacedDeployment({
                 namespace: kubernetes.namespace,
-                labelSelector: `hammerkit.dev/id=${service.id()}`,
+                labelSelector: (0, resources_1.getItemSelector)(service, kubernetes),
             });
             const deployment = deployments.items[0];
             if (!deployment?.metadata?.name) {
@@ -472,7 +517,7 @@ function kubernetesServiceRuntime(service, kubernetes) {
         async stop() {
             const deployments = await instance.appsApi.listNamespacedDeployment({
                 namespace: kubernetes.namespace,
-                labelSelector: `hammerkit.dev/id=${service.id()}`,
+                labelSelector: (0, resources_1.getItemSelector)(service, kubernetes),
             });
             for (const deployment of deployments.items) {
                 if (deployment.metadata?.name) {
@@ -492,9 +537,13 @@ function kubernetesServiceRuntime(service, kubernetes) {
             await (0, ensure_kubernetes_service_exists_1.ensureKubernetesServiceExists)(instance, kubernetes, service);
             await (0, ensure_persistent_data_1.ensurePersistentData)(instance, kubernetes, environment, service, persistence);
             await (0, secrets_1.ensureKubernetesSecret)(instance, kubernetes, service, service.data.secrets, environment);
-            const network = await (0, network_policy_1.ensureKubernetesItemNetwork)(instance, kubernetes, service, { followLog: false, run: null });
-            await (0, ensure_kubernetes_deployment_exists_1.ensureKubernetesDeploymentExists)(instance, kubernetes, service, persistence, (0, secrets_1.getKubernetesSecretRefs)(service, service.data.secrets), options.stateKey, network);
-            const name = (0, resources_1.getResourceName)(service);
+            // on a server, the run's: its runs share the namespace, and the service goes with the run
+            const network = await (0, network_policy_1.ensureKubernetesItemNetwork)(instance, kubernetes, service, {
+                followLog: false,
+                run: kubernetes.server ? (0, job_placement_1.getRunLabelValue)(kubernetes.server.run) : null,
+            });
+            await (0, ensure_kubernetes_deployment_exists_1.ensureKubernetesDeploymentExists)(instance, kubernetes, service, persistence, (0, secrets_1.getKubernetesSecretRefs)(service, kubernetes, service.data.secrets), options.stateKey, network);
+            const name = (0, resources_1.getResourceName)(service, kubernetes);
             options.state.set({
                 type: 'running',
                 dns: { containerId: name },
@@ -526,7 +575,7 @@ function kubernetesServiceRuntime(service, kubernetes) {
             }
             const services = await instance.coreApi.listNamespacedService({
                 namespace: kubernetes.namespace,
-                labelSelector: `hammerkit.dev/id=${service.id()}`,
+                labelSelector: (0, resources_1.getItemSelector)(service, kubernetes),
             });
             for (const service of services.items) {
                 if (service.metadata?.name) {
@@ -542,7 +591,7 @@ function kubernetesServiceRuntime(service, kubernetes) {
         async currentStateKey() {
             const deployments = await instance.appsApi.listNamespacedDeployment({
                 namespace: kubernetes.namespace,
-                labelSelector: `hammerkit.dev/id=${service.id()}`,
+                labelSelector: (0, resources_1.getItemSelector)(service, kubernetes),
             });
             const deployment = deployments.items[0];
             return deployment?.metadata?.labels?.['hammerkit.dev/state'] ?? null;

package/dist/planner/work-runtime-local.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getLocalWorkRuntime = exports.getStateFilename = void 0;
 const tar_1 = require("tar");
+const tar_2 = require("../utils/tar");
 const path_1 = require("path");
 const local_task_1 = require("../executer/local-task");
 const event_cache_1 = require("../executer/event-cache");
@@ -121,7 +122,7 @@ async function archiveLocal(environment, task, path) {
     for (const generatedArchive of (0, event_cache_1.getArchivePaths)(task.data, path)) {
         await environment.file.writeStream(generatedArchive.filename, 
         // tar's stream is a Minipass stream; Readable.from adapts it to a Node one
-        stream_1.Readable.from((0, tar_1.create)({ cwd: task.data.cwd, gzip: true }, [(0, path_1.relative)(task.data.cwd, generatedArchive.path)])));
+        stream_1.Readable.from((0, tar_2.packArchive)({ cwd: task.data.cwd, gzip: true }, [(0, path_1.relative)(task.data.cwd, generatedArchive.path)])));
     }
 }
 async function restoreLocal(environment, task, path) {

package/dist/planner/work-task.js

@@ -1,8 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isWorkTask = exports.isContainerWorkTask = void 0;
+exports.isAggregateTask = exports.isWorkTask = exports.isContainerWorkTask = void 0;
 const isContainerWorkTask = (val) => val.type === 'container-task';
 exports.isContainerWorkTask = isContainerWorkTask;
 const isWorkTask = (val) => val.type === 'container-task' || val.type === 'local-task';
 exports.isWorkTask = isWorkTask;
+// A task that only groups its dependencies: `deps`, and no `image`, `cmds`, `src`,
+// `generates`, `secrets`, `needs` or `continuous`. It needs no runtime, hands on what its dependencies generate to what
+// depends on it, and is up to date (or verified) when all its dependencies are.
+const isAggregateTask = (val) => val.type === 'local-task' && val.aggregate === true;
+exports.isAggregateTask = isAggregateTask;
 //# sourceMappingURL=work-task.js.map

package/dist/program.js

@@ -84,7 +84,8 @@ function printTaskDefinition(environment, definition) {
     }
 }
 // `ls --json`: what a caller (an agent picking a task) needs to know, with the
-// command that arguments after `--` are appended to (null: it takes none).
+// command that arguments after `--` are appended to (null: it takes none) and
+// `args` as the build file says it (false: it refuses them).
 function getListJson(tasks, services) {
     return {
         tasks: tasks.map(({ item }) => ({
@@ -96,6 +97,7 @@ function getListJson(tasks, services) {
             needs: item.needs.map((n) => n.name),
             labels: item.data.labels,
             command: (0, task_arguments_1.getArgumentsTarget)(item.data)?.cmd ?? null,
+            args: item.data.args,
         })),
         services: services.map(({ item }) => ({
             name: item.name,
@@ -105,6 +107,7 @@ function getListJson(tasks, services) {
             ports: item.data.ports.map((p) => ({ host: p.hostPort, container: p.containerPort })),
             labels: item.data.labels,
             command: (0, task_arguments_1.getArgumentsTarget)(item.data)?.cmd ?? null,
+            args: item.data.type === 'container-service' ? item.data.args : null,
         })),
     };
 }
@@ -159,11 +162,14 @@ async function getProgram(environment, argv) {
     if (fileIndex >= 0) {
         args.splice(fileIndex, 2);
     }
-    (0, remote_commands_1.registerRemoteCommands)(program, environment, fileName);
+    (0, remote_commands_1.registerRemoteCommands)(program, environment, fileName, passthrough);
     program.hook('preAction', (_, actionCommand) => {
-        const takesArguments = actionCommand.parent === program && ['run', 'up'].includes(actionCommand.name());
+        const takesArguments = (actionCommand.parent === program && ['run', 'up'].includes(actionCommand.name())) ||
+            (actionCommand.parent?.name() === 'remote' && actionCommand.name() === 'run');
         if (passthrough.length > 0 && !takesArguments) {
-            program.error(`${actionCommand.name()} takes no arguments after --, only run and up do`, { exitCode: 1 });
+            program.error(`${actionCommand.name()} takes no arguments after --, only run, up and remote run do`, {
+                exitCode: 1,
+            });
         }
     });
     if (await environment.file.exists(fileName)) {
@@ -602,6 +608,7 @@ async function getProgram(environment, argv) {
             .choices(['checksum', 'modify-date', 'none']))
             .addOption(new commander_1.Option('--cache-read-only', `restore from cache backends but never push to them (or set ${read_only_1.CACHE_READ_ONLY_ENV}=1)`).default(false))
             .addOption(new commander_1.Option('--timeout <duration>', 'fail tasks without their own timeout after this long (e.g. 10m)').argParser(units_1.parseDuration))
+            .addOption(new commander_1.Option('--max-timeout <duration>', 'fail any task after this long, also one with a longer timeout of its own (e.g. 2m)').argParser(units_1.parseDuration))
             .addOption(new commander_1.Option('--network <level>', 'the most any task or service reaches besides its needs: none, open or allow:<host>,<host>').argParser(parseNetworkArgument))
             .action(async (options, command) => {
             try {
@@ -620,6 +627,7 @@ async function getProgram(environment, argv) {
                     wait: options.wait,
                     cacheReadOnly: (0, read_only_1.isCacheReadOnly)(options.cacheReadOnly, environment.processEnvs),
                     timeout: options.timeout ?? null,
+                    maxTimeout: options.maxTimeout ?? null,
                     network: options.network ?? null,
                 });
                 if (!result.success) {
@@ -682,6 +690,7 @@ async function getProgram(environment, argv) {
             .addOption(new commander_1.Option('--dry-run', 'print the execution plan with predicted cache hits/misses without running').default(false))
             .addOption(new commander_1.Option('--cache-read-only', `restore from cache backends but never push to them (or set ${read_only_1.CACHE_READ_ONLY_ENV}=1)`).default(false))
             .addOption(new commander_1.Option('--timeout <duration>', 'fail tasks without their own timeout after this long (e.g. 10m)').argParser(units_1.parseDuration))
+            .addOption(new commander_1.Option('--max-timeout <duration>', 'fail any task after this long, also one with a longer timeout of its own (e.g. 2m)').argParser(units_1.parseDuration))
             .addOption(new commander_1.Option('--network <level>', 'the most any task or service reaches besides its needs: none, open or allow:<host>,<host>').argParser(parseNetworkArgument))
             .addOption(new commander_1.Option('--no-skip-deps', 'run dependencies even when nothing needing them has to run'))
             .action(async (task, options, command) => {
@@ -716,6 +725,7 @@ async function getProgram(environment, argv) {
                     explain: options.explain,
                     cacheReadOnly: (0, read_only_1.isCacheReadOnly)(options.cacheReadOnly, environment.processEnvs),
                     timeout: options.timeout ?? null,
+                    maxTimeout: options.maxTimeout ?? null,
                     network: options.network ?? null,
                     skipDeps: options.skipDeps !== false,
                 });

package/dist/remote/annotations.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.applyAnnotations = exports.collectAnnotations = exports.remoteRepo = void 0;
+exports.applyAnnotations = exports.collectAnnotations = exports.readCheckout = exports.remoteRepo = void 0;
 const child_process_1 = require("child_process");
 const os_1 = require("os");
 const path_1 = require("path");
@@ -36,6 +36,18 @@ function remoteRepo(url) {
     }
 }
 exports.remoteRepo = remoteRepo;
+// The checkout a directory is in: the repository of its `origin`, the branch it is on and
+// its commit, what can be found of them.
+async function readCheckout(cwd) {
+    if ((await git(cwd, 'rev-parse', '--is-inside-work-tree')) !== 'true') {
+        return {};
+    }
+    const remote = await git(cwd, 'remote', 'get-url', 'origin');
+    // a detached HEAD is on no branch
+    const branch = await git(cwd, 'symbolic-ref', '--quiet', '--short', 'HEAD');
+    return { repo: remote ? remoteRepo(remote) : undefined, branch, commit: await git(cwd, 'rev-parse', 'HEAD') };
+}
+exports.readCheckout = readCheckout;
 // Where a build file is published from: its path in its repository (or on this
 // machine, outside of one), the repository and commit, this machine and its user.
 // `files` are the paths of the bundle, relative to the build file's directory: when

package/dist/remote/device-login.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.deviceLogin = void 0;
+exports.deviceLogin = exports.NoSignInError = void 0;
 const server_client_1 = require("./server-client");
 const GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:device_code';
 const DEFAULT_INTERVAL_SECONDS = 5;
@@ -8,6 +8,11 @@ const SLOW_DOWN_SECONDS = 5;
 const FETCH_TIMEOUT_MS = 10000;
 const MIN_INTERVAL_SECONDS = 1;
 const MAX_LIFETIME_SECONDS = 30 * 60;
+// The server takes tokens of this issuer but offers no device sign-in for it: the token has
+// to come from elsewhere, such as a token command.
+class NoSignInError extends server_client_1.ServerError {
+}
+exports.NoSignInError = NoSignInError;
 const isLoopbackHost = (hostname) => ['localhost', '127.0.0.1', '[::1]'].includes(hostname);
 // An endpoint must use the scheme of the issuer: loopback http is for a test
 // identity provider on this machine only, never beside an https issuer.
@@ -89,7 +94,7 @@ async function deviceLogin(server, options) {
         throw new server_client_1.ServerError(`${server.url} does not accept tokens from ${server.issuer} (it accepts ${accepted})`);
     }
     if (!offered.clientId) {
-        throw new server_client_1.ServerError(`${server.url} offers no sign-in for ${server.issuer}, it needs a token obtained elsewhere`);
+        throw new NoSignInError(`${server.url} offers no sign-in for ${server.issuer}, it needs a token obtained elsewhere`);
     }
     // What was pinned (by `remote add` or an earlier login) wins; the server can
     // only offer the same, never something else to sign in with.