hammerkit 1.27.0-next.2 → 1.27.0-next.4

package/dist/harness/sandbox-client.js

@@ -1,12 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.quotePosix = exports.fetchFailure = exports.toSandboxPath = exports.checkSandboxPath = exports.exitCodeOf = exports.oneAtATime = exports.SandboxClient = exports.SandboxClientError = void 0;
+exports.quotePosix = exports.fetchFailure = exports.toSandboxPath = exports.checkSandboxPath = exports.exitCodeOf = exports.followRun = exports.submitRun = exports.FINAL_RUN_STATES = exports.oneAtATime = exports.SandboxClient = exports.SandboxClientError = void 0;
 const path_1 = require("path");
 const token_source_1 = require("../remote/token-source");
 // a write carries up to 32 MiB
 const TIMEOUT_MS = 60000;
 // a run is asked for this long at a time, the log is read in between
 const POLL_WAIT = '1s';
+// a cancelled run waits this long for the server to take the cancel, before it gives up
+const CANCEL_WAIT_MS = 10000;
 class SandboxClientError extends Error {
     constructor(message, status) {
         super(message);
@@ -115,72 +117,26 @@ class SandboxClient {
         if (options.timeoutSeconds) {
             runOptions.timeout = `${Math.max(1, Math.ceil(options.timeoutSeconds))}s`;
         }
-        const submitted = await json(await call(this.connection, 'POST', '/v1/runs', {
-            body: {
-                definition: this.build.hash,
-                tasks: [task],
-                source: { type: 'sandbox', id: this.id },
-                options: runOptions,
-            },
-        }));
-        const path = `/v1/runs/${encodeURIComponent(submitted.id)}`;
-        const cancel = () => {
-            call(this.connection, 'POST', `${path}/cancel`).catch(() => undefined);
-        };
-        options.signal?.addEventListener('abort', cancel, { once: true });
-        const lines = [];
-        let from = 1;
-        let truncated = false;
-        const readLog = async () => {
-            for (;;) {
-                const page = await json(await call(this.connection, 'GET', `${path}/logs`, { query: { task, from, limit: 1000 } }));
-                truncated = page.truncated;
-                for (const line of page.lines) {
-                    lines.push(line.text);
-                    options.onLine?.(line.text);
-                    from = line.line + 1;
-                }
-                if (!page.next) {
-                    return;
-                }
-            }
+        const submitted = await submitRun(this.connection, {
+            definition: this.build.hash,
+            tasks: [task],
+            source: { type: 'sandbox', id: this.id },
+            options: runOptions,
+        });
+        const followed = await followRun(this.connection, submitted, {
+            task,
+            signal: options.signal,
+            onLine: options.onLine ? (line) => options.onLine?.(line.text) : undefined,
+            onWaiting: options.onWaiting,
+        });
+        const result = followed.run.results?.[task];
+        return {
+            run: followed.run,
+            result,
+            output: followed.lines.map((line) => line.text).join('\n'),
+            truncated: followed.truncated,
+            exitCode: exitCodeOf(result),
         };
-        try {
-            let run = submitted;
-            let waitingSaid = false;
-            for (;;) {
-                if (options.signal?.aborted) {
-                    throw new SandboxClientError('the run was cancelled');
-                }
-                if (run.state === 'awaiting-approval' && !waitingSaid) {
-                    waitingSaid = true;
-                    options.onWaiting?.(run);
-                }
-                await readLog();
-                if (['succeeded', 'failed', 'cancelled', 'rejected'].includes(run.state)) {
-                    break;
-                }
-                run = await json(await call(this.connection, 'GET', path, { query: { wait: POLL_WAIT } }));
-            }
-            const result = run.results?.[task];
-            if (truncated && result) {
-                // the end of a long log is kept in the result
-                for (const line of ['… the server cut the log off at its limit, the last lines were:', ...result.lastLog]) {
-                    lines.push(line);
-                    options.onLine?.(line);
-                }
-            }
-            return {
-                run,
-                result,
-                output: lines.join('\n'),
-                truncated,
-                exitCode: exitCodeOf(result),
-            };
-        }
-        finally {
-            options.signal?.removeEventListener('abort', cancel);
-        }
     }
     /**
      * A shell command on the sandbox: the shell task of the build file with the command as
@@ -245,6 +201,88 @@ function oneAtATime() {
     };
 }
 exports.oneAtATime = oneAtATime;
+// a run that is over, its state does not change any more
+exports.FINAL_RUN_STATES = ['succeeded', 'failed', 'cancelled', 'rejected'];
+// Submits a run, as `POST /v1/runs` takes it, and answers it as the server queued it or
+// holds it for an approval.
+async function submitRun(connection, request) {
+    return json(await call(connection, 'POST', '/v1/runs', { body: request }));
+}
+exports.submitRun = submitRun;
+/**
+ * Follows a run to its end: its log as it grows, and its state. A signal cancels the run
+ * on the server and fails the follow.
+ */
+async function followRun(connection, submitted, options = {}) {
+    const path = `/v1/runs/${encodeURIComponent(submitted.id)}`;
+    let cancelling;
+    const cancel = () => {
+        cancelling ?? (cancelling = call(connection, 'POST', `${path}/cancel`).catch(() => undefined));
+    };
+    options.signal?.addEventListener('abort', cancel, { once: true });
+    const lines = [];
+    let from = 1;
+    let truncated = false;
+    const add = (line) => {
+        lines.push(line);
+        options.onLine?.(line);
+    };
+    const readLog = async () => {
+        for (;;) {
+            const page = await json(await call(connection, 'GET', `${path}/logs`, { query: { task: options.task, from, limit: 1000 } }));
+            truncated = page.truncated;
+            for (const line of page.lines) {
+                add(line);
+                from = line.line + 1;
+            }
+            if (!page.next) {
+                return;
+            }
+        }
+    };
+    try {
+        let run = submitted;
+        let waitingSaid = false;
+        for (;;) {
+            if (options.signal?.aborted) {
+                // the process may exit after this, so the cancel has to reach the server first
+                cancel();
+                let timer;
+                await Promise.race([cancelling, new Promise((resolve) => (timer = setTimeout(resolve, CANCEL_WAIT_MS)))]);
+                clearTimeout(timer);
+                throw new SandboxClientError('the run was cancelled');
+            }
+            if (run.state === 'awaiting-approval' && !waitingSaid) {
+                waitingSaid = true;
+                options.onWaiting?.(run);
+            }
+            await readLog();
+            if (exports.FINAL_RUN_STATES.includes(run.state)) {
+                break;
+            }
+            run = await json(await call(connection, 'GET', path, { query: { wait: POLL_WAIT } }));
+        }
+        if (truncated) {
+            // the end of a long log is kept in the results
+            const tasks = options.task !== undefined ? [options.task] : Object.keys(run.results ?? {});
+            for (const task of tasks) {
+                const result = run.results?.[task];
+                if (!result) {
+                    continue;
+                }
+                const said = options.task !== undefined ? 'the last lines were' : `the last lines of ${task} were`;
+                for (const text of [`… the server cut the log off at its limit, ${said}:`, ...result.lastLog]) {
+                    add({ line: 0, task, stream: 'stdout', text });
+                }
+            }
+        }
+        return { run, lines, truncated };
+    }
+    finally {
+        options.signal?.removeEventListener('abort', cancel);
+    }
+}
+exports.followRun = followRun;
 function exitCodeOf(result) {
     if (!result) {
         return null;

package/dist/program.js

@@ -159,11 +159,14 @@ async function getProgram(environment, argv) {
     if (fileIndex >= 0) {
         args.splice(fileIndex, 2);
     }
-    (0, remote_commands_1.registerRemoteCommands)(program, environment, fileName);
+    (0, remote_commands_1.registerRemoteCommands)(program, environment, fileName, passthrough);
     program.hook('preAction', (_, actionCommand) => {
-        const takesArguments = actionCommand.parent === program && ['run', 'up'].includes(actionCommand.name());
+        const takesArguments = (actionCommand.parent === program && ['run', 'up'].includes(actionCommand.name())) ||
+            (actionCommand.parent?.name() === 'remote' && actionCommand.name() === 'run');
         if (passthrough.length > 0 && !takesArguments) {
-            program.error(`${actionCommand.name()} takes no arguments after --, only run and up do`, { exitCode: 1 });
+            program.error(`${actionCommand.name()} takes no arguments after --, only run, up and remote run do`, {
+                exitCode: 1,
+            });
         }
     });
     if (await environment.file.exists(fileName)) {

package/dist/remote/annotations.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.applyAnnotations = exports.collectAnnotations = exports.remoteRepo = void 0;
+exports.applyAnnotations = exports.collectAnnotations = exports.readCheckout = exports.remoteRepo = void 0;
 const child_process_1 = require("child_process");
 const os_1 = require("os");
 const path_1 = require("path");
@@ -36,6 +36,18 @@ function remoteRepo(url) {
     }
 }
 exports.remoteRepo = remoteRepo;
+// The checkout a directory is in: the repository of its `origin`, the branch it is on and
+// its commit, what can be found of them.
+async function readCheckout(cwd) {
+    if ((await git(cwd, 'rev-parse', '--is-inside-work-tree')) !== 'true') {
+        return {};
+    }
+    const remote = await git(cwd, 'remote', 'get-url', 'origin');
+    // a detached HEAD is on no branch
+    const branch = await git(cwd, 'symbolic-ref', '--quiet', '--short', 'HEAD');
+    return { repo: remote ? remoteRepo(remote) : undefined, branch, commit: await git(cwd, 'rev-parse', 'HEAD') };
+}
+exports.readCheckout = readCheckout;
 // Where a build file is published from: its path in its repository (or on this
 // machine, outside of one), the repository and commit, this machine and its user.
 // `files` are the paths of the bundle, relative to the build file's directory: when

package/dist/remote/remote-commands.js

@@ -16,7 +16,9 @@ const remote_work_commands_1 = require("./remote-work-commands");
 const mcp_command_1 = require("../harness/mcp-command");
 // Host-level commands: they only touch the machine's config file, so they work
 // with or without a build file in the working directory.
-function registerRemoteCommands(program, environment, buildFile) {
+function registerRemoteCommands(program, environment, buildFile, 
+// what follows `--`, the arguments of `remote run`
+passthrough = []) {
     const remote = program.command('remote').description('register the servers runs can be sent to');
     const guarded = (failure, fn) => {
         return async (...args) => {
@@ -154,7 +156,14 @@ function registerRemoteCommands(program, environment, buildFile) {
             environment.stdout.write(`repositories: ${me.repos.map(server_client_1.printable).join(', ')}\n`);
         }
     }));
-    (0, remote_work_commands_1.registerWorkCommands)(remote, { environment, buildFile, getServer, guarded });
+    (0, remote_work_commands_1.registerWorkCommands)(remote, {
+        environment,
+        buildFile,
+        getServer,
+        guarded,
+        passthrough,
+        fail: (message, exitCode) => program.error(message, { exitCode }),
+    });
     (0, mcp_command_1.registerMcpCommand)(remote, environment);
 }
 exports.registerRemoteCommands = registerRemoteCommands;

package/dist/remote/remote-work-commands.js

@@ -12,6 +12,8 @@ const bundle_1 = require("./bundle");
 const annotations_1 = require("./annotations");
 const server_client_1 = require("./server-client");
 const bundle_text_1 = require("./bundle-text");
+const sandbox_client_1 = require("../harness/sandbox-client");
+const path_1 = require("path");
 const RUN_ID = /^run_[A-Za-z0-9_-]{16}$/;
 // what the publisher said about where a version comes from, one line
 // What a publisher said about where a version comes from: the server takes it as said,
@@ -29,6 +31,11 @@ function yankLines(version) {
         ]
         : [];
 }
+// A line a task printed, shown as it is but for control characters, so it can't rewrite
+// the terminal; tabs stay.
+function printableLine(text) {
+    return text.split('\t').map(server_client_1.printableWhole).join('\t');
+}
 const collectOption = (value, previous = []) => [...previous, value];
 // What a person who approves is shown of a run: everything the decision rests on.
 function describeApproval(run) {
@@ -89,7 +96,7 @@ function describePlan(plan) {
 }
 exports.describePlan = describePlan;
 function registerWorkCommands(remote, context) {
-    const { environment, buildFile, getServer, guarded } = context;
+    const { environment, buildFile, getServer, guarded, passthrough, fail } = context;
     const connect = async (name) => {
         const chosen = await getServer(name);
         // a CI job or an agent brings its own token, a person signs in
@@ -122,6 +129,87 @@ function registerWorkCommands(remote, context) {
             environment.stdout.write(`it can not run before somebody who may publish approves it, until ${(0, server_client_1.printable)(version.expiresAt)}\n`);
         }
     }));
+    remote
+        .command('run <tasks...>')
+        .description('run tasks of a published build file on a server from a git ref, print their output and exit as they did')
+        .addOption(new commander_1.Option('--server <name>', 'the server to run on; the default of remote use when left out'))
+        .addOption(new commander_1.Option('--build <hash>', 'the published version to run (sha256:...), or HAMMERKIT_BUILD; the hash of the build file here when left out'))
+        .addOption(new commander_1.Option('--repo <host/path>', 'the repository, such as github.com/corp/payments; origin of the checkout here when left out'))
+        .addOption(new commander_1.Option('--ref <ref>', 'the branch or tag to run; the branch checked out here when left out'))
+        .addOption(new commander_1.Option('--commit <sha>', 'the commit the ref has to be at, else the run is refused; the commit checked out here when --ref is left out'))
+        .addOption(new commander_1.Option('--env <name>', 'the environment of the build file, as --env of run'))
+        .addOption(new commander_1.Option('--cache <method>', 'as --cache of run').choices(['checksum', 'modify-date', 'none']))
+        .addOption(new commander_1.Option('--timeout <duration>', 'stop the run after this long, such as 30m'))
+        .action(guarded('Remote run was not successful', async (tasks, options) => {
+        const named = options.build ?? environment.processEnvs.HAMMERKIT_BUILD;
+        const definition = named ?? (0, bundle_1.hashBundle)(await (0, collect_bundle_1.collectBundle)(buildFile, environment));
+        if (!bundle_1.HASH_PATTERN.test(definition)) {
+            throw new Error(`${(0, server_client_1.printable)(definition)} is not the hash of a published version (sha256:...)`);
+        }
+        const checkout = options.repo && options.ref ? {} : await (0, annotations_1.readCheckout)((0, path_1.dirname)(buildFile));
+        const repo = options.repo ?? checkout.repo;
+        const ref = options.ref ?? checkout.branch;
+        // the commit checked out here is the code meant, when the ref is the branch it is on
+        const commit = options.commit ?? (options.ref ? undefined : checkout.commit);
+        if (!repo) {
+            throw new Error('name the repository with --repo, the checkout here has no origin it can be told by');
+        }
+        if (!ref) {
+            throw new Error('name the branch or tag with --ref, the checkout here is on no branch');
+        }
+        const { name: serverName, server } = await getServer(options.server);
+        const connection = { url: server.url, ...(0, token_source_1.getTokenSource)(environment, serverName, server) };
+        const runOptions = {};
+        for (const key of ['env', 'cache', 'timeout']) {
+            if (options[key] !== undefined) {
+                runOptions[key] = options[key];
+            }
+        }
+        if (passthrough.length > 0) {
+            runOptions.args = passthrough;
+        }
+        let submitted;
+        try {
+            submitted = await (0, sandbox_client_1.submitRun)(connection, {
+                definition,
+                tasks,
+                source: { type: 'ref', repo, ref, ...(commit ? { commit } : {}) },
+                options: runOptions,
+            });
+        }
+        catch (e) {
+            if (e.status === 400 && !named && /no published build file/.test(String(e))) {
+                throw new Error(`the build file here is not published on ${serverName} (${definition}), publish it first`);
+            }
+            throw e;
+        }
+        const at = submitted.source.type === 'ref' ? ` at ${(0, server_client_1.printable)(submitted.source.commit)}` : '';
+        environment.stdout.write(`${(0, server_client_1.printable)(submitted.id)} on ${serverName}: ${tasks.map(server_client_1.printable).join(', ')} from ${(0, server_client_1.printable)(ref)}${at}\n`);
+        const prefixed = tasks.length > 1;
+        const followed = await (0, sandbox_client_1.followRun)(connection, submitted, {
+            signal: environment.abortCtrl.signal,
+            onLine: (line) => {
+                environment.stdout.write(`${prefixed || line.task !== tasks[0] ? `[${(0, server_client_1.printable)(line.task)}] ` : ''}${printableLine(line.text)}\n`);
+            },
+            onWaiting: (run) => {
+                for (const approval of run.approvals ?? []) {
+                    environment.stdout.write(`waiting until somebody who uses ${(0, server_client_1.printable)(approval.account)} approves it, before ${(0, server_client_1.printable)(approval.expiresAt)}: hammerkit remote approve ${(0, server_client_1.printable)(run.id)}\n`);
+                }
+            },
+        });
+        const run = followed.run;
+        if (run.state === 'succeeded') {
+            environment.stdout.write(`${(0, server_client_1.printable)(run.id)} succeeded\n`);
+            return;
+        }
+        // the exit code of the first task that failed, as `hammerkit run` would end
+        const failed = tasks
+            .map((task) => run.results?.[task])
+            .concat(Object.values(run.results ?? {}))
+            .find((result) => result?.status === 'failed');
+        const exitCode = failed?.exitCode && failed.exitCode > 0 ? failed.exitCode : 1;
+        fail(`${(0, server_client_1.printable)(run.id)} ${run.state}${run.error ? `: ${(0, server_client_1.printable)(run.error)}` : ''}`, exitCode);
+    }));
     remote
         .command('versions [server]')
         .description('list the published versions of build files on a server, newest first, with where they come from')

package/dist/server/run-request.js

@@ -75,6 +75,12 @@ exports.runRequestSchema = zod_1.z
                 return repo;
             }),
             ref: name,
+            // the commit the ref has to be at, such as the one a CI job checked out: a ref that
+            // moved since is refused, so the run executes the code that was asked for
+            commit: zod_1.z
+                .string()
+                .regex(/^([0-9a-f]{40}|[0-9a-f]{64})$/, 'expected a full commit hash, 40 or 64 hex digits')
+                .optional(),
         })
             .strict(),
         // the name of a tree announced with POST /v1/sources

package/dist/server/server-command.js

@@ -5,6 +5,7 @@ const commander_1 = require("commander");
 const log_1 = require("../log");
 const server_config_1 = require("./server-config");
 const server_1 = require("./server");
+const abort_on_signals_1 = require("../utils/abort-on-signals");
 // Runs this machine as a hammerkit server until interrupted. Like `remote`, it
 // only needs its own config file, not a build file.
 function registerServerCommand(program, environment) {
@@ -13,31 +14,46 @@ function registerServerCommand(program, environment) {
         .description('serve this machine to remote runs (experimental)')
         .addOption(new commander_1.Option('-c, --config <file>', 'server config file').env('HAMMERKIT_SERVER_CONFIG'))
         .action(async (options) => {
+        // SIGHUP reads the entitlements again, so who may do what changes without a
+        // restart; the rest of the config needs one. The server takes it over from the
+        // abort of the CLI, which stops other commands on it, before it starts: a SIGHUP
+        // while it reads its config and starts waits for it. Windows sends SIGHUP when the
+        // console closes, which stops the server there too.
+        let server;
+        let reloadWhenStarted = false;
+        const reload = async (running) => {
+            try {
+                const result = running.reload(await (0, server_config_1.readServerConfig)(environment, options.config));
+                if (result.restart.length > 0) {
+                    environment.stdout.write(`changed but not reloaded, restart for: ${result.restart.join(', ')}\n`);
+                }
+            }
+            catch (e) {
+                environment.stdout.write(`entitlements were not reloaded: ${(0, log_1.getErrorMessage)(e)}\n`);
+            }
+        };
+        const releaseReload = process.platform !== 'win32'
+            ? (0, abort_on_signals_1.takeOverSignal)(process, 'SIGHUP', () => {
+                if (server) {
+                    void reload(server);
+                }
+                else {
+                    reloadWhenStarted = true;
+                }
+            })
+            : () => undefined;
         try {
             if (!options.config) {
                 throw new Error('pass the server config with --config or HAMMERKIT_SERVER_CONFIG');
             }
             const config = await (0, server_config_1.readServerConfig)(environment, options.config);
-            const server = await (0, server_1.startServer)(config, environment, {
+            const running = await (0, server_1.startServer)(config, environment, {
                 log: (line) => environment.stdout.write(`${line}\n`),
             });
-            environment.stdout.write(`hammerkit server listening on ${server.url}\n`);
-            // SIGHUP reads the entitlements again, so who may do what changes without
-            // a restart; the rest of the config needs one
-            const reload = async () => {
-                try {
-                    const result = server.reload(await (0, server_config_1.readServerConfig)(environment, options.config));
-                    if (result.restart.length > 0) {
-                        environment.stdout.write(`changed but not reloaded, restart for: ${result.restart.join(', ')}\n`);
-                    }
-                }
-                catch (e) {
-                    environment.stdout.write(`entitlements were not reloaded: ${(0, log_1.getErrorMessage)(e)}\n`);
-                }
-            };
-            const onReload = () => void reload();
-            if (process.platform !== 'win32') {
-                process.on('SIGHUP', onReload);
+            server = running;
+            environment.stdout.write(`hammerkit server listening on ${running.url}\n`);
+            if (reloadWhenStarted) {
+                void reload(running);
             }
             await new Promise((resolve) => {
                 if (environment.abortCtrl.signal.aborted) {
@@ -45,8 +61,8 @@ function registerServerCommand(program, environment) {
                 }
                 environment.abortCtrl.signal.addEventListener('abort', () => resolve(), { once: true });
             });
-            process.off('SIGHUP', onReload);
-            await server.close();
+            releaseReload();
+            await running.close();
             environment.stdout.write('hammerkit server stopped\n');
         }
         catch (e) {
@@ -55,6 +71,9 @@ function registerServerCommand(program, environment) {
             }
             program.error(`Server was not successful: ${(0, log_1.getErrorMessage)(e)}`, { exitCode: 1 });
         }
+        finally {
+            releaseReload();
+        }
     });
 }
 exports.registerServerCommand = registerServerCommand;

package/dist/server/server.js

@@ -304,6 +304,12 @@ async function submitRun(config, registry, definitions, sources, sandboxes, plan
     if (request.source.type === 'ref') {
         try {
             const commit = await repos.resolve(request.source.repo, request.source.ref);
+            if (request.source.commit && commit !== request.source.commit) {
+                const error = `${request.source.ref} is at ${commit} now, not at ${request.source.commit}`;
+                log(`refuse run iss=${principal.iss} sub=${principal.sub}: ${error}`);
+                (0, http_2.send)(res, 409, { error });
+                return;
+            }
             source = { type: 'ref', repo: request.source.repo, ref: request.source.ref, commit };
         }
         catch (e) {

package/dist/utils/abort-on-signals.js

@@ -1,17 +1,57 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.abortOnSignals = exports.ABORT_SIGNALS = void 0;
+exports.takeOverSignal = exports.abortOnSignals = exports.ABORT_SIGNALS = void 0;
 // Ctrl-C (SIGINT), a CI job being cancelled or a supervisor stopping hammerkit
 // (SIGTERM) and a closed terminal (SIGHUP) all stop the run the same way: abort,
 // so services are removed and local tasks' process groups are killed. Without a
 // handler Node exits on SIGTERM/SIGHUP at once and leaves both behind.
 exports.ABORT_SIGNALS = ['SIGINT', 'SIGTERM', 'SIGHUP'];
-function abortOnSignals(source, abortCtrl) {
-    for (const signal of exports.ABORT_SIGNALS) {
-        source.on(signal, () => {
-            abortCtrl.abort();
-        });
+// signals a running command gives a meaning of its own (the server reloads its
+// entitlements on SIGHUP), per source and counted by how many hold them: they don't
+// abort the run
+const takenOver = new WeakMap();
+function heldOn(source) {
+    let held = takenOver.get(source);
+    if (!held) {
+        held = new Map();
+        takenOver.set(source, held);
     }
+    return held;
+}
+/**
+ * Stops the run on the abort signals, all but those a command took over with
+ * `takeOverSignal`. Returns what removes the listeners again.
+ */
+function abortOnSignals(source, abortCtrl) {
+    const listeners = exports.ABORT_SIGNALS.map((signal) => {
+        const listener = () => {
+            if (!takenOver.get(source)?.get(signal)) {
+                abortCtrl.abort();
+            }
+        };
+        source.on(signal, listener);
+        return { signal, listener };
+    });
+    return () => listeners.forEach(({ signal, listener }) => source.off(signal, listener));
 }
 exports.abortOnSignals = abortOnSignals;
+/**
+ * Calls `handler` on `signal` instead of stopping the run, until the returned function
+ * gives the signal back.
+ */
+function takeOverSignal(source, signal, handler) {
+    const held = heldOn(source);
+    held.set(signal, (held.get(signal) ?? 0) + 1);
+    source.on(signal, handler);
+    let released = false;
+    return () => {
+        if (released) {
+            return;
+        }
+        released = true;
+        source.off(signal, handler);
+        held.set(signal, (held.get(signal) ?? 1) - 1);
+    };
+}
+exports.takeOverSignal = takeOverSignal;
 //# sourceMappingURL=abort-on-signals.js.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "hammerkit",
   "description": "Containerized build tool with incremental caching that runs the same build file locally, in Docker and on Kubernetes.",
-  "version": "1.27.0-next.2",
+  "version": "1.27.0-next.4",
   "keywords": [
     "build",
     "build-tool",