hammerkit 1.27.0-next.2 → 1.27.0-next.21

package/dist/remote/host-config.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.pinLogin = exports.setDefaultLocation = exports.removeServer = exports.addServer = exports.normalizeServerUrl = exports.validateServerName = exports.writeHostConfig = exports.readHostConfig = exports.getHostConfigPath = exports.hasServer = exports.hostConfigSchema = exports.hostServerSchema = exports.RESERVED_SERVER_NAMES = void 0;
+exports.pinLogin = exports.setDefaultLocation = exports.removeServer = exports.addServer = exports.normalizeServerUrl = exports.validateServerName = exports.writeHostConfig = exports.readHostConfig = exports.getHostConfigPath = exports.getRegisteredServer = exports.getTokenCommand = exports.hasServer = exports.hostConfigSchema = exports.hostServerSchema = exports.RESERVED_SERVER_NAMES = void 0;
 const path_1 = require("path");
 const zod_1 = require("zod");
 const yaml_1 = require("yaml");
@@ -28,11 +28,20 @@ exports.hostServerSchema = zod_1.z
     scope: zod_1.z.string().min(1).optional(),
 })
     .strict();
+// A command that prints the token for a server instead of a login, see token-source.ts.
+// It is bound to the url and issuer it was registered for, like a sign-in, and lives
+// beside `servers` rather than in it: hammerkit before 1.27 refuses unknown keys of a
+// server, but keeps unknown top-level keys. It is only ever read from the host config,
+// a build file can't name one.
+const tokenCommandSchema = zod_1.z
+    .object({ url: zod_1.z.string(), issuer: zod_1.z.string(), command: zod_1.z.string().trim().min(1) })
+    .passthrough();
 // Unknown top-level keys are kept when the file is written back, so a newer
 // hammerkit's settings survive an older one editing the file.
 exports.hostConfigSchema = zod_1.z
     .object({
     servers: zod_1.z.record(exports.hostServerSchema).default({}),
+    tokenCommands: zod_1.z.record(tokenCommandSchema).optional(),
     run: zod_1.z.object({ on: zod_1.z.string().optional() }).passthrough().default({}),
 })
     .passthrough();
@@ -41,6 +50,35 @@ function hasServer(servers, name) {
     return Object.prototype.hasOwnProperty.call(servers, name);
 }
 exports.hasServer = hasServer;
+// The token command of a server, unless it was registered for another url or issuer (an
+// older hammerkit that pointed the name elsewhere leaves it behind).
+function getTokenCommand(config, name) {
+    const commands = config.tokenCommands ?? {};
+    const entry = Object.prototype.hasOwnProperty.call(commands, name) ? commands[name] : undefined;
+    const server = hasServer(config.servers, name) ? config.servers[name] : undefined;
+    return entry && server && entry.url === server.url && entry.issuer === server.issuer ? entry.command : undefined;
+}
+exports.getTokenCommand = getTokenCommand;
+function getRegisteredServer(config, name) {
+    const tokenCommand = getTokenCommand(config, name);
+    return { ...config.servers[name], ...(tokenCommand ? { tokenCommand } : {}) };
+}
+exports.getRegisteredServer = getRegisteredServer;
+function setTokenCommand(config, name, entry) {
+    const commands = { ...(config.tokenCommands ?? {}) };
+    if (entry) {
+        commands[name] = entry;
+    }
+    else {
+        delete commands[name];
+    }
+    if (Object.keys(commands).length > 0) {
+        config.tokenCommands = commands;
+    }
+    else {
+        delete config.tokenCommands;
+    }
+}
 function getHostConfigPath(environment) {
     return environment.processEnvs.HAMMERKIT_CONFIG ?? (0, path_1.join)((0, get_cache_directory_1.getHammerkitDirectory)(), 'config.yaml');
 }
@@ -121,16 +159,38 @@ async function addServer(environment, name, url, options) {
             server[key] = options[key];
         }
     }
+    if (typeof options.tokenCommand === 'string' && !options.tokenCommand.trim()) {
+        throw new Error('the token command must not be empty, use --no-token-command to remove it');
+    }
     const config = await readHostConfig(environment);
     const existing = hasServer(config.servers, name) ? config.servers[name] : undefined;
-    const changed = (a, b) => a.url !== b.url || a.issuer !== b.issuer || PINNED.some((key) => a[key] !== b[key]);
+    const sameServer = (a, b) => a.url === b.url && a.issuer === b.issuer;
+    // Adding the same server again keeps what was pinned (by a login, too) unless it is given,
+    // so a later `remote add ... --token-command` needs no --force.
+    if (existing && sameServer(existing, server)) {
+        for (const key of PINNED) {
+            if (!server[key] && existing[key]) {
+                server[key] = existing[key];
+            }
+        }
+    }
+    const changed = (a, b) => !sameServer(a, b) || PINNED.some((key) => a[key] !== b[key]);
     if (existing && changed(existing, server) && !options.force) {
         throw new Error(`server "${name}" is already registered as ${existing.url} (issuer ${existing.issuer}); ` +
             `use --force to point it somewhere else`);
     }
+    // The command decides which identity's token goes to the server: changing it does not
+    // redirect anything, but a name pointed at another server does not keep the old one.
+    const kept = existing && sameServer(existing, server) ? getTokenCommand(config, name) : undefined;
+    const tokenCommand = typeof options.tokenCommand === 'string'
+        ? options.tokenCommand.trim()
+        : options.tokenCommand === undefined
+            ? kept
+            : undefined;
     config.servers[name] = server;
+    setTokenCommand(config, name, tokenCommand ? { url: server.url, issuer: server.issuer, command: tokenCommand } : undefined);
     await writeHostConfig(environment, config);
-    return server;
+    return { ...server, ...(tokenCommand ? { tokenCommand } : {}) };
 }
 exports.addServer = addServer;
 async function removeServer(environment, name) {
@@ -139,6 +199,7 @@ async function removeServer(environment, name) {
         throw new Error(`server "${name}" is not registered`);
     }
     delete config.servers[name];
+    setTokenCommand(config, name, undefined);
     const resetDefault = config.run.on === name;
     if (resetDefault) {
         delete config.run.on;

package/dist/remote/remote-commands.js

@@ -16,7 +16,9 @@ const remote_work_commands_1 = require("./remote-work-commands");
 const mcp_command_1 = require("../harness/mcp-command");
 // Host-level commands: they only touch the machine's config file, so they work
 // with or without a build file in the working directory.
-function registerRemoteCommands(program, environment, buildFile) {
+function registerRemoteCommands(program, environment, buildFile, 
+// what follows `--`, the arguments of `remote run`
+passthrough = []) {
     const remote = program.command('remote').description('register the servers runs can be sent to');
     const guarded = (failure, fn) => {
         return async (...args) => {
@@ -38,6 +40,8 @@ function registerRemoteCommands(program, environment, buildFile) {
         .addOption(new commander_1.Option('--client-id <id>', 'OAuth client to sign in with (pinned; default: what the server offers)'))
         .addOption(new commander_1.Option('--audience <audience>', 'audience of the token (pinned; default: what the server offers)'))
         .addOption(new commander_1.Option('--scope <scope>', 'scopes to request (pinned; default: what the server offers)'))
+        .addOption(new commander_1.Option('--token-command <command>', 'a command that prints the token for this server, instead of remote login (e.g. of a service account)'))
+        .addOption(new commander_1.Option('--no-token-command', 'remove the token command, sign in with remote login again'))
         .addOption(new commander_1.Option('--force', 'point an already registered name at a different server').default(false))
         .action(guarded('Remote add was not successful', async (name, url, options) => {
         const server = await (0, host_config_1.addServer)(environment, name, url, {
@@ -45,9 +49,13 @@ function registerRemoteCommands(program, environment, buildFile) {
             clientId: options.clientId,
             audience: options.audience,
             scope: options.scope,
+            tokenCommand: options.tokenCommand,
             force: options.force,
         });
         environment.stdout.write(`added ${name}: ${server.url} (issuer ${server.issuer})\n`);
+        if (server.tokenCommand) {
+            environment.stdout.write(`tokens for ${name} come from: ${server.tokenCommand}\n`);
+        }
     }));
     remote
         .command('list')
@@ -60,9 +68,10 @@ function registerRemoteCommands(program, environment, buildFile) {
             return;
         }
         for (const name of names) {
-            const server = config.servers[name];
+            const server = (0, host_config_1.getRegisteredServer)(config, name);
             const marker = config.run.on === name ? colors_1.default.green(' (default)') : '';
-            environment.stdout.write(`${colors_1.default.bold(name)}${marker}  ${server.url}  issuer ${server.issuer}\n`);
+            const token = server.tokenCommand ? `  token from: ${server.tokenCommand}` : '';
+            environment.stdout.write(`${colors_1.default.bold(name)}${marker}  ${server.url}  issuer ${server.issuer}${token}\n`);
         }
         if (config.run.on === 'auto' || config.run.on === 'local') {
             environment.stdout.write(`default location: ${config.run.on}\n`);
@@ -93,17 +102,33 @@ function registerRemoteCommands(program, environment, buildFile) {
                 ? `server ${name} is not registered, add it with: hammerkit remote add ${name} <url> --issuer <url>`
                 : 'name a server, or set one as the default with: hammerkit remote use <name>');
         }
-        return { name: chosen, server: config.servers[chosen] };
+        return { name: chosen, server: (0, host_config_1.getRegisteredServer)(config, chosen) };
     };
     remote
         .command('login <name>')
         .description('sign in to a registered server with your identity provider (device code, works headless)')
         .action(guarded('Remote login was not successful', async (name) => {
         const { server } = await getServer(name);
-        const { pinned, ...result } = await (0, device_login_1.deviceLogin)(server, {
-            prompt: (message) => environment.stdout.write(`${message}\n`),
-            signal: environment.abortCtrl.signal,
-        });
+        if (server.tokenCommand) {
+            // a sign-in would never be used: the command's token goes first
+            throw new Error(`${name} takes its tokens from its token command (${server.tokenCommand}), it needs no sign-in; ` +
+                `to sign in instead, remove it with: hammerkit remote add ${name} ${server.url} --issuer ${server.issuer} --no-token-command`);
+        }
+        let login;
+        try {
+            login = await (0, device_login_1.deviceLogin)(server, {
+                prompt: (message) => environment.stdout.write(`${message}\n`),
+                signal: environment.abortCtrl.signal,
+            });
+        }
+        catch (e) {
+            if (e instanceof device_login_1.NoSignInError) {
+                throw new Error(`${e.message}: register a command that prints one, such as the token of a service account, with: ` +
+                    `hammerkit remote add ${name} ${server.url} --issuer ${server.issuer} --token-command '<command>'`);
+            }
+            throw e;
+        }
+        const { pinned, ...result } = login;
         await (0, host_config_1.pinLogin)(environment, name, pinned);
         await (0, credentials_1.saveToken)(environment, name, { url: server.url, issuer: server.issuer, ...result });
         try {
@@ -154,7 +179,14 @@ function registerRemoteCommands(program, environment, buildFile) {
             environment.stdout.write(`repositories: ${me.repos.map(server_client_1.printable).join(', ')}\n`);
         }
     }));
-    (0, remote_work_commands_1.registerWorkCommands)(remote, { environment, buildFile, getServer, guarded });
+    (0, remote_work_commands_1.registerWorkCommands)(remote, {
+        environment,
+        buildFile,
+        getServer,
+        guarded,
+        passthrough,
+        fail: (message, exitCode) => program.error(message, { exitCode }),
+    });
     (0, mcp_command_1.registerMcpCommand)(remote, environment);
 }
 exports.registerRemoteCommands = registerRemoteCommands;

package/dist/remote/remote-work-commands.js

@@ -12,7 +12,23 @@ const bundle_1 = require("./bundle");
 const annotations_1 = require("./annotations");
 const server_client_1 = require("./server-client");
 const bundle_text_1 = require("./bundle-text");
+const sandbox_client_1 = require("../harness/sandbox-client");
+const units_1 = require("../utils/units");
+const service_tools_1 = require("../harness/service-tools");
+const path_1 = require("path");
+const check_keys_1 = require("../optimizer/check-keys");
 const RUN_ID = /^run_[A-Za-z0-9_-]{16}$/;
+// how a check passed, one line
+function describePassed(passed) {
+    const from = passed.source.type === 'ref'
+        ? `${passed.source.ref} at ${passed.source.commit.slice(0, 12)}`
+        : `a check of sandbox ${passed.source.sandbox}, fetched at ${passed.source.commit.slice(0, 12)}`;
+    return `passed ${passed.finishedAt}${passed.status === 'cached'
+        ? ' from the cache'
+        : passed.durationMs !== undefined
+            ? ` in ${(0, units_1.formatDuration)(passed.durationMs)}`
+            : ''}, ${passed.run} by ${passed.by.sub}, from ${from}`;
+}
 // what the publisher said about where a version comes from, one line
 // What a publisher said about where a version comes from: the server takes it as said,
 // so anybody else is told it is not checked.
@@ -29,6 +45,11 @@ function yankLines(version) {
         ]
         : [];
 }
+// A line a task printed, shown as it is but for control characters, so it can't rewrite
+// the terminal; tabs stay.
+function printableLine(text) {
+    return text.split('\t').map(server_client_1.printableWhole).join('\t');
+}
 const collectOption = (value, previous = []) => [...previous, value];
 // What a person who approves is shown of a run: everything the decision rests on.
 function describeApproval(run) {
@@ -89,7 +110,22 @@ function describePlan(plan) {
 }
 exports.describePlan = describePlan;
 function registerWorkCommands(remote, context) {
-    const { environment, buildFile, getServer, guarded } = context;
+    const { environment, buildFile, getServer, guarded, passthrough, fail } = context;
+    // the ref a run starts from: what the options name, else the checkout here
+    const refSource = async (options) => {
+        const checkout = options.repo && options.ref ? {} : await (0, annotations_1.readCheckout)((0, path_1.dirname)(buildFile));
+        const repo = options.repo ?? checkout.repo;
+        const ref = options.ref ?? checkout.branch;
+        // the commit checked out here is the code meant, when the ref is the branch it is on
+        const commit = options.commit ?? (options.ref ? undefined : checkout.commit);
+        if (!repo) {
+            throw new Error('name the repository with --repo, the checkout here has no origin it can be told by');
+        }
+        if (!ref) {
+            throw new Error('name the branch or tag with --ref, the checkout here is on no branch');
+        }
+        return { type: 'ref', repo, ref, ...(commit ? { commit } : {}) };
+    };
     const connect = async (name) => {
         const chosen = await getServer(name);
         // a CI job or an agent brings its own token, a person signs in
@@ -122,6 +158,215 @@ function registerWorkCommands(remote, context) {
             environment.stdout.write(`it can not run before somebody who may publish approves it, until ${(0, server_client_1.printable)(version.expiresAt)}\n`);
         }
     }));
+    remote
+        .command('run <tasks...>')
+        .description('run tasks of a published build file on a server from a git ref, print their output and exit as they did')
+        .addOption(new commander_1.Option('--server <name>', 'the server to run on; the default of remote use when left out'))
+        .addOption(new commander_1.Option('--build <hash>', 'the published version to run (sha256:...), or HAMMERKIT_BUILD; the hash of the build file here when left out'))
+        .addOption(new commander_1.Option('--repo <host/path>', 'the repository, such as github.com/corp/payments; origin of the checkout here when left out'))
+        .addOption(new commander_1.Option('--ref <ref>', 'the branch or tag to run; the branch checked out here when left out'))
+        .addOption(new commander_1.Option('--commit <sha>', 'the commit the ref has to be at, else the run is refused; the commit checked out here when --ref is left out'))
+        .addOption(new commander_1.Option('--env <name>', 'the environment of the build file, as --env of run'))
+        .addOption(new commander_1.Option('--cache <method>', 'as --cache of run').choices(['checksum', 'modify-date', 'none']))
+        .addOption(new commander_1.Option('--timeout <duration>', 'as --timeout of run: for tasks without their own, such as 30m'))
+        .addOption(new commander_1.Option('--max-timeout <duration>', 'as --max-timeout of run: for every task, also one with its own timeout'))
+        .addOption(new commander_1.Option('--detach', 'submit the run and exit, without following it: for a check that CI verifies later'))
+        .action(guarded('Remote run was not successful', async (tasks, options) => {
+        const named = options.build ?? environment.processEnvs.HAMMERKIT_BUILD;
+        const definition = named ?? (0, bundle_1.hashBundle)(await (0, collect_bundle_1.collectBundle)(buildFile, environment));
+        if (!bundle_1.HASH_PATTERN.test(definition)) {
+            throw new Error(`${(0, server_client_1.printable)(definition)} is not the hash of a published version (sha256:...)`);
+        }
+        const source = await refSource(options);
+        const ref = source.ref;
+        const { name: serverName, server } = await getServer(options.server);
+        const connection = { url: server.url, ...(0, token_source_1.getTokenSource)(environment, serverName, server) };
+        const runOptions = {};
+        for (const key of ['env', 'cache', 'timeout', 'maxTimeout']) {
+            if (options[key] !== undefined) {
+                runOptions[key] = options[key];
+            }
+        }
+        if (passthrough.length > 0) {
+            runOptions.args = passthrough;
+        }
+        let submitted;
+        try {
+            submitted = await (0, sandbox_client_1.submitRun)(connection, {
+                definition,
+                tasks,
+                source,
+                options: runOptions,
+            });
+        }
+        catch (e) {
+            if (e.status === 400 && !named && /no published build file/.test(String(e))) {
+                throw new Error(`the build file here is not published on ${serverName} (${definition}), publish it first`);
+            }
+            throw e;
+        }
+        const at = submitted.source.type === 'ref' ? ` at ${(0, server_client_1.printable)(submitted.source.commit)}` : '';
+        environment.stdout.write(`${(0, server_client_1.printable)(submitted.id)} on ${serverName}: ${tasks.map(server_client_1.printable).join(', ')} from ${(0, server_client_1.printable)(ref)}${at}\n`);
+        if (options.detach) {
+            environment.stdout.write(`follow it with: hammerkit remote show ${(0, server_client_1.printable)(submitted.id)}\n`);
+            return;
+        }
+        const prefixed = tasks.length > 1;
+        const followed = await (0, sandbox_client_1.followRun)(connection, submitted, {
+            signal: environment.abortCtrl.signal,
+            onLine: (line) => {
+                environment.stdout.write(`${prefixed || line.task !== tasks[0] ? `[${(0, server_client_1.printable)(line.task)}] ` : ''}${printableLine(line.text)}\n`);
+            },
+            onWaiting: (run) => {
+                for (const approval of run.approvals ?? []) {
+                    environment.stdout.write(`waiting until somebody who uses ${(0, server_client_1.printable)(approval.account)} approves it, before ${(0, server_client_1.printable)(approval.expiresAt)}: hammerkit remote approve ${(0, server_client_1.printable)(run.id)}\n`);
+                }
+            },
+        });
+        const run = followed.run;
+        if (run.state === 'succeeded') {
+            environment.stdout.write(`${(0, server_client_1.printable)(run.id)} succeeded\n`);
+            return;
+        }
+        // the exit code of the first task that failed, as `hammerkit run` would end
+        const failed = tasks
+            .map((task) => run.results?.[task])
+            .concat(Object.values(run.results ?? {}))
+            .find((result) => result?.status === 'failed');
+        const exitCode = failed?.exitCode && failed.exitCode > 0 ? failed.exitCode : 1;
+        fail(`${(0, server_client_1.printable)(run.id)} ${run.state}${run.error ? `: ${(0, server_client_1.printable)(run.error)}` : ''}`, exitCode);
+    }));
+    remote
+        .command('up <services...>')
+        .description('start services of a published build file on a server from a git ref and keep them up until their ttl ends, ' +
+        'with their endpoints at addresses of their own behind the sign-in of the server')
+        .addOption(new commander_1.Option('--server <name>', 'the server to run on; the default of remote use when left out'))
+        .addOption(new commander_1.Option('--endpoint <service:port>', 'publish this port of a service, such as web:8080; may be given more than once').argParser(collectOption))
+        .addOption(new commander_1.Option('--ttl <duration>', 'how long they stay once ready, such as 2h, then they are removed; the server default when left out'))
+        .addOption(new commander_1.Option('--sleep-ttl <duration>', 'how long they stay up without a request, such as 30m, then they sleep until the next request wakes them; ' +
+        'the server default when left out'))
+        .addOption(new commander_1.Option('--name <name>', 'a later run of yours with the same name replaces this one and keeps its addresses; the branch when left out'))
+        .addOption(new commander_1.Option('--build <hash>', 'the published version to run (sha256:...), or HAMMERKIT_BUILD; the hash of the build file here when left out'))
+        .addOption(new commander_1.Option('--repo <host/path>', 'the repository; origin of the checkout here when left out'))
+        .addOption(new commander_1.Option('--ref <ref>', 'the branch or tag to start; the branch checked out here when left out'))
+        .addOption(new commander_1.Option('--commit <sha>', 'the commit the ref has to be at; the commit checked out here when --ref is left out'))
+        .addOption(new commander_1.Option('--env <name>', 'the environment of the build file, as --env of run'))
+        .action(guarded('Remote up was not successful', async (services, options) => {
+        const named = options.build ?? environment.processEnvs.HAMMERKIT_BUILD;
+        const definition = named ?? (0, bundle_1.hashBundle)(await (0, collect_bundle_1.collectBundle)(buildFile, environment));
+        if (!bundle_1.HASH_PATTERN.test(definition)) {
+            throw new Error(`${(0, server_client_1.printable)(definition)} is not the hash of a published version (sha256:...)`);
+        }
+        const endpoints = (options.endpoint ?? []).map(service_tools_1.parseEndpoint);
+        const source = await refSource(options);
+        const { name: serverName, server } = await getServer(options.server);
+        const connection = { url: server.url, ...(0, token_source_1.getTokenSource)(environment, serverName, server) };
+        const submitted = await (0, sandbox_client_1.submitRun)(connection, {
+            definition,
+            services,
+            endpoints,
+            ...(options.ttl ? { ttl: options.ttl } : {}),
+            ...(options.sleepTtl ? { sleepTtl: options.sleepTtl } : {}),
+            ...(options.name ? { name: options.name } : {}),
+            source,
+            options: options.env ? { env: options.env } : {},
+        });
+        environment.stdout.write(`${(0, server_client_1.printable)(submitted.id)} on ${serverName}: ${services.map(server_client_1.printable).join(', ')} from ${(0, server_client_1.printable)(source.ref)}${submitted.source.type === 'ref' ? ` at ${(0, server_client_1.printable)(submitted.source.commit)}` : ''}\n`);
+        const followed = await (0, sandbox_client_1.followRun)(connection, submitted, {
+            signal: environment.abortCtrl.signal,
+            untilUp: true,
+            onLine: (line) => environment.stdout.write(`[${(0, server_client_1.printable)(line.task)}] ${printableLine(line.text)}\n`),
+            onWaiting: (run) => {
+                for (const approval of run.approvals ?? []) {
+                    environment.stdout.write(`waiting until somebody who uses ${(0, server_client_1.printable)(approval.account)} approves it, before ${(0, server_client_1.printable)(approval.expiresAt)}: hammerkit remote approve ${(0, server_client_1.printable)(run.id)}\n`);
+                }
+            },
+        });
+        const run = followed.run;
+        if (run.state !== 'up') {
+            fail(`${(0, server_client_1.printable)(run.id)} ${run.state}${run.error ? `: ${(0, server_client_1.printable)(run.error)}` : ''}`, 1);
+        }
+        environment.stdout.write(`${(0, server_client_1.printable)(run.id)} is up until ${(0, server_client_1.printable)(run.expiresAt ?? '-')}${run.up?.sleepTtl ? `, asleep after ${(0, units_1.formatDuration)(run.up.sleepTtl)} without a request` : ''}\n`);
+        for (const endpoint of run.up?.endpoints ?? []) {
+            environment.stdout.write(`  ${(0, server_client_1.printable)(endpoint.service)}:${endpoint.port}  ${(0, server_client_1.printable)(endpoint.url)}\n`);
+        }
+        environment.stdout.write(`extend it with: hammerkit remote extend ${(0, server_client_1.printable)(run.id)} 8h, stop it with: hammerkit remote stop ${(0, server_client_1.printable)(run.id)}\n`);
+    }));
+    remote
+        .command('extend <run> <ttl> [server]')
+        .description('keep a service run that is up for this long from now, such as 8h, at most the maxTtl of the server')
+        .action(guarded('Remote extend was not successful', async (id, ttl, name) => {
+        if (!RUN_ID.test(id)) {
+            throw new Error(`${(0, server_client_1.printable)(id)} is not a run id (run_...)`);
+        }
+        const { name: serverName, server, token } = await connect(name);
+        const run = (await (0, server_client_1.callServer)(server, token, 'POST', `/v1/runs/${id}/extend`, { ttl })).body;
+        environment.stdout.write(`${(0, server_client_1.printable)(run.id)} on ${serverName} stays up until ${(0, server_client_1.printable)(run.expiresAt ?? '-')}\n`);
+    }));
+    remote
+        .command('stop <run> [server]')
+        .description('stop a run: a service run takes its services and endpoints down')
+        .action(guarded('Remote stop was not successful', async (id, name) => {
+        if (!RUN_ID.test(id)) {
+            throw new Error(`${(0, server_client_1.printable)(id)} is not a run id (run_...)`);
+        }
+        const { name: serverName, server, token } = await connect(name);
+        const run = (await (0, server_client_1.callServer)(server, token, 'POST', `/v1/runs/${id}/cancel`)).body;
+        environment.stdout.write(`${(0, server_client_1.printable)(run.id)} on ${serverName}: ${run.state === 'up' || run.state === 'running' ? 'stopping' : (0, server_client_1.printable)(run.state)}\n`);
+    }));
+    remote
+        .command('verify <tasks...>')
+        .description('check that the server already passed tasks for the files checked out here, without running them; ' +
+        'exits 1 at once for any it did not')
+        .addOption(new commander_1.Option('--server <name>', 'the server to ask; the default of remote use when left out'))
+        .addOption(new commander_1.Option('--repo <host/path>', 'the repository, such as github.com/corp/payments; origin of the checkout here when left out'))
+        .addOption(new commander_1.Option('--env <name>', 'the environment of the build file, as --env of run'))
+        .action(guarded('Remote verify was not successful', async (tasks, options) => {
+        const repo = options.repo ?? (await (0, annotations_1.readCheckout)((0, path_1.dirname)(buildFile))).repo;
+        if (!repo) {
+            throw new Error('name the repository with --repo, the checkout here has no origin it can be told by');
+        }
+        const keys = [];
+        const unkeyed = [];
+        for (const task of tasks) {
+            const found = (await (0, check_keys_1.getCheckKeys)(buildFile, environment, { taskName: task, environmentName: options.env ?? null }))[task];
+            if (!found) {
+                throw new Error(`the build file has no task ${(0, server_client_1.printable)(task)}`);
+            }
+            if (found.key === null) {
+                unkeyed.push({ task, reason: found.reason });
+            }
+            else {
+                keys.push({ task, key: found.key });
+            }
+        }
+        const { name: serverName, server, token } = await connect(options.server);
+        const answer = keys.length > 0
+            ? await (0, server_client_1.callServer)(server, token, 'POST', '/v1/checks/lookup', { repo, keys })
+            : { body: { checks: [] } };
+        const missing = [];
+        // by what was asked, never by what was answered: a task the answer leaves out, or
+        // answers for another key, is not verified
+        for (const { task, key } of keys) {
+            const check = answer.body.checks.find((answered) => answered.task === task && answered.key === key);
+            if (check?.passed) {
+                environment.stdout.write(`${(0, server_client_1.printable)(task)}: ${(0, server_client_1.printable)(describePassed(check.passed))}\n`);
+            }
+            else {
+                missing.push(task);
+                environment.stdout.write(`${(0, server_client_1.printable)(task)}: no run on ${serverName} passed it for these files${check?.reason ? `, ${(0, server_client_1.printable)(check.reason)}` : ''}\n`);
+            }
+        }
+        for (const { task, reason } of unkeyed) {
+            environment.stdout.write(`${(0, server_client_1.printable)(task)}: can not be verified, ${(0, server_client_1.printable)(reason)}\n`);
+        }
+        if (missing.length > 0 || unkeyed.length > 0) {
+            const run = missing.length > 0 ? `; run on the server: hammerkit remote run ${missing.map(server_client_1.printable).join(' ')}` : '';
+            // whole names: a task of an include is named like build:all
+            const names = [...missing, ...unkeyed.map(({ task }) => task)].map(server_client_1.printable);
+            fail(`not verified: ${names.join(', ')}${run}`, 1);
+        }
+    }));
     remote
         .command('versions [server]')
         .description('list the published versions of build files on a server, newest first, with where they come from')

package/dist/remote/server-client.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.callServer = exports.getMe = exports.getDiscovery = exports.printableWhole = exports.printable = exports.ServerError = void 0;
+exports.callServer = exports.getMe = exports.getDiscovery = exports.printableWhole = exports.printableLines = exports.printable = exports.ServerError = void 0;
 const discovery_1 = require("../server/discovery");
 const TIMEOUT_MS = 10000;
 const WRITE_TIMEOUT_MS = 30000;
@@ -21,6 +21,17 @@ function printable(value) {
     return text.length > 300 ? `${text.slice(0, 300)}… (+${text.length - 300} chars)` : text;
 }
 exports.printable = printable;
+// Text of several lines, such as every problem of a refused publish: each line made
+// printable and cut like `printable`, one per line, and at most `MAX_LINES` of them.
+const MAX_LINES = 100;
+function printableLines(value) {
+    const lines = String(value)
+        .split(/\r?\n/)
+        .filter((line) => line.trim().length > 0);
+    const shown = lines.slice(0, MAX_LINES).map(printable);
+    return lines.length > MAX_LINES ? [...shown, `… (+${lines.length - MAX_LINES} lines)`] : shown;
+}
+exports.printableLines = printableLines;
 // The same, never cut: for what somebody decides on, such as a command.
 function printableWhole(value) {
     return String(value)
@@ -92,7 +103,9 @@ async function callServer(server, token, method, path, body) {
         throw new ServerError(`${server.url} did not accept the token`);
     }
     if (!response.ok) {
-        const said = answer && typeof answer.error === 'string' ? `: ${printable(answer.error)}` : '';
+        const lines = answer && typeof answer.error === 'string' ? printableLines(answer.error) : [];
+        // a refused publish says every problem, each on a line of its own
+        const said = lines.length > 1 ? `:\n${lines.map((line) => `  ${line}`).join('\n')}` : lines.length === 1 ? `: ${lines[0]}` : '';
         throw new ServerError(`${server.url} answered ${response.status}${said}`, response.status);
     }
     return { status: response.status, body: answer };

package/dist/remote/token-source.js

@@ -9,6 +9,54 @@ function isToken(value) {
     return /^[\x21-\x7e]+$/.test(value);
 }
 exports.isToken = isToken;
+// What a failed token command said on stderr, for the user's own terminal: never its stdout,
+// and never in an error message, which a harness hands on to an agent.
+const MAX_STDERR_LINES = 20;
+const MAX_STDERR_LINE = 300;
+function writeStderr(environment, what, stderr) {
+    const lines = stderr
+        .split(/\r?\n/)
+        .map((line) => line.replace(/[^\x20-\x7e\t]/g, '?').slice(0, MAX_STDERR_LINE))
+        .filter((line) => line.trim())
+        .slice(-MAX_STDERR_LINES);
+    for (const line of lines) {
+        environment.stderr.write(`${what}: ${line}\n`);
+    }
+}
+function commandSource(environment, command, what) {
+    let current;
+    const run = () => new Promise((resolve, reject) => {
+        (0, child_process_1.exec)(command, { env: environment.processEnvs, timeout: 60000 }, (error, stdout, stderr) => {
+            const token = String(stdout).trim();
+            if (error || !token) {
+                writeStderr(environment, what, String(stderr));
+                const status = error?.killed
+                    ? ', it did not end within a minute'
+                    : typeof error?.code === 'number'
+                        ? `, it exited with ${error.code}`
+                        : '';
+                reject(new Error(`${what} printed no token${status}`));
+            }
+            else if (!isToken(token)) {
+                // never the output itself: it can hold more secrets than the token
+                reject(new Error(`${what} printed more than a token, it has to print the token alone`));
+            }
+            else {
+                resolve(token);
+            }
+        });
+    });
+    return {
+        token: () => {
+            current = current ?? run();
+            current.catch(() => (current = undefined));
+            return current;
+        },
+        renew: async () => {
+            current = undefined;
+        },
+    };
+}
 /**
  * The token a client of a server sends: a harness, and the `remote` commands. In this order:
  *
@@ -16,42 +64,29 @@ exports.isToken = isToken;
  *   identity, such as a workload identity or a service account of the identity provider. It
  *   runs again when the server no longer accepts the token.
  * - `HAMMERKIT_TOKEN`: such a token, as the agent's platform hands it over.
+ * - the token command of the server in the host config (`remote add --token-command`): the
+ *   same as `HAMMERKIT_TOKEN_COMMAND`, for one server, so each server can have the service
+ *   account and audience it accepts. It only ever comes from the host config, never from a
+ *   build file: whoever writes it decides what runs on this machine.
  * - the sign-in of `hammerkit remote login <server>`.
  *
  * The token only goes to the URL the server is registered with in the host config.
  */
 function getTokenSource(environment, name, server) {
+    // a variable holds for every server: say so when it takes the place of the one registered
+    const overrides = (variable) => {
+        if (server.tokenCommand) {
+            environment.stderr.write(`${variable} is set, so the token command of ${name} is not used\n`);
+        }
+    };
     const command = environment.processEnvs.HAMMERKIT_TOKEN_COMMAND;
     if (command) {
-        let current;
-        const run = () => new Promise((resolve, reject) => {
-            (0, child_process_1.exec)(command, { env: environment.processEnvs, timeout: 60000 }, (error, stdout) => {
-                const token = String(stdout).trim();
-                if (error || !token) {
-                    reject(new Error('HAMMERKIT_TOKEN_COMMAND printed no token'));
-                }
-                else if (!isToken(token)) {
-                    // never the output itself: it can hold more secrets than the token
-                    reject(new Error('HAMMERKIT_TOKEN_COMMAND printed more than a token, it has to print the token alone'));
-                }
-                else {
-                    resolve(token);
-                }
-            });
-        });
-        return {
-            token: () => {
-                current = current ?? run();
-                current.catch(() => (current = undefined));
-                return current;
-            },
-            renew: async () => {
-                current = undefined;
-            },
-        };
+        overrides('HAMMERKIT_TOKEN_COMMAND');
+        return commandSource(environment, command, 'HAMMERKIT_TOKEN_COMMAND');
     }
     const fixed = environment.processEnvs.HAMMERKIT_TOKEN?.trim();
     if (fixed) {
+        overrides('HAMMERKIT_TOKEN');
         return {
             token: async () => {
                 if (!isToken(fixed)) {
@@ -61,6 +96,9 @@ function getTokenSource(environment, name, server) {
             },
         };
     }
+    if (server.tokenCommand) {
+        return commandSource(environment, server.tokenCommand, `the token command of ${name}`);
+    }
     return { token: () => (0, credentials_1.getAccessToken)(environment, name, server) };
 }
 exports.getTokenSource = getTokenSource;