hammerkit 1.27.0-next.3 → 1.27.0-next.30

package/dist/executer/execute-work-task.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.executeWorkTask = void 0;
+const work_task_1 = require("../planner/work-task");
 const states_1 = require("./states");
 const abort_1 = require("./abort");
 const log_1 = require("../log");
@@ -10,9 +11,11 @@ const deadline_1 = require("./deadline");
 const explain_1 = require("../cache/explain");
 const archive_task_entry_1 = require("./archive-task-entry");
 const units_1 = require("../utils/units");
+const deferred_restore_1 = require("./deferred-restore");
 async function pushToBackend(work, environment, cacheState, options) {
     const { resolved, stateKey, provable } = cacheState;
-    if (resolved.method === 'none' || !provable) {
+    // an aggregate has nothing to store, see checkCacheState
+    if (resolved.method === 'none' || !provable || (0, work_task_1.isAggregateTask)(work.data)) {
         return;
     }
     if (options.cacheReadOnly) {
@@ -29,7 +32,7 @@ async function pushToBackend(work, environment, cacheState, options) {
     }
 }
 // A task without cmds only groups its dependencies (`ci: { deps: [test, build] }`).
-// Having no src of its own it is never a cache hit, so its dependencies are
+// It is never a cache hit itself (see checkCacheState), so its dependencies are
 // always checked and their outputs restored. When every one of them was a hit,
 // nothing ran: report the group as cached too. Reporting only, the cache
 // decision is untouched.
@@ -87,6 +90,10 @@ dependents = null) {
                 }
             }
             await (0, await_completed_dependencies_1.awaitCompletedDependencies)(work, work.deps, abort);
+            // an aggregate runs nothing, so it needs no outputs on disk
+            if (!(0, work_task_1.isAggregateTask)(work.data)) {
+                await (0, deferred_restore_1.restoreDeferred)(work, (0, await_completed_dependencies_1.transitiveDeps)(work.deps), abort);
+            }
             await (0, await_completed_dependencies_1.awaitRunningNeeds)(work, work.needs.map((n) => n.service), abort);
             await options.processManager.task(work, async () => {
                 work.state.set({
@@ -94,7 +101,7 @@ dependents = null) {
                     stateKey: cacheState.stateKey,
                     started,
                 });
-                const timeout = work.data.timeout ?? options.timeout;
+                const timeout = (0, deadline_1.getTaskTimeout)(work.data.timeout, options);
                 const deadline = (0, deadline_1.withDeadline)(abort, timeout);
                 try {
                     await work.runtime.execute(environment, {

package/dist/executer/execution-steps.js

@@ -9,6 +9,7 @@ const work_task_1 = require("../planner/work-task");
 const work_service_1 = require("../planner/work-service");
 const get_container_binds_1 = require("./get-container-binds");
 const assert_item_paths_1 = require("../planner/utils/assert-item-paths");
+const log_1 = require("../log");
 // The files a server run works on: its checkout, or a sandbox. Somebody else wrote them.
 function hostedRoot(environment) {
     return environment.hosted ? environment.cwd : undefined;
@@ -66,10 +67,27 @@ async function prepareMounts(item, environment) {
             continue;
         }
         if ((0, path_1.extname)(mount.localPath)) {
-            await environment.file.writeFile(mount.localPath, '');
+            try {
+                await environment.file.writeFile(mount.localPath, '');
+            }
+            catch (e) {
+                // Docker would make a directory there
+                throw new Error(`mount ${mount.localPath} does not exist and can't be created (${(0, log_1.getErrorMessage)(e)})`);
+            }
         }
         else {
-            await environment.file.createDirectory(mount.localPath);
+            try {
+                await environment.file.createDirectory(mount.localPath);
+            }
+            catch (e) {
+                // on a server a root-owned directory in the run's files could break its cleanup
+                if (environment.hosted) {
+                    throw e;
+                }
+                // hammerkit may run in a container whose file system is not the one of the Docker
+                // host: Docker creates the missing directory of a bind on its own
+                item.status.write('warn', `can't create ${mount.localPath} (${(0, log_1.getErrorMessage)(e)}), Docker creates it on its host as root`);
+            }
         }
     }
     if ((0, work_task_1.isContainerWorkTask)(item.data)) {
@@ -89,8 +107,11 @@ exports.prepareMounts = prepareMounts;
 async function setUserPermissions(item, container, environment) {
     if (item.data.user) {
         // On a server only the volumes: a chown as the container's root on a path of the host
-        // would follow a link a task put there after the binds were checked
-        const binds = (0, get_container_binds_1.getContainerBinds)(item).filter((bind) => !environment.hosted || !(0, path_1.isAbsolute)(bind.localPath));
+        // would follow a link a task put there after the binds were checked. Never a mount: it
+        // is a path of the host the build file names, such as /var/run/docker.sock, whose owner
+        // is not hammerkit's to change
+        const mounted = new Set(item.data.mounts.map((mount) => mount.containerPath));
+        const binds = (0, get_container_binds_1.getContainerBinds)(item).filter((bind) => !mounted.has(bind.containerPath) && (!environment.hosted || !(0, path_1.isAbsolute)(bind.localPath)));
         if (!environment.hosted) {
             await (0, set_user_permission_1.setUserPermission)(item.data.cwd, item.status, environment, container, item.data.user);
         }

package/dist/executer/reset-work-tree.js

@@ -5,6 +5,10 @@ const state_1 = require("./state");
 function resetWorkTree(workTree, type) {
     return {
         tasks: Object.entries(workTree.tasks).reduce((tasks, [key, task]) => {
+            // down only stops services: a task it selects names the services it needs
+            if (type === 'down') {
+                return tasks;
+            }
             task.state = new state_1.State({
                 type: 'pending',
                 stateKey: null,

package/dist/executer/scheduler/enqueue-next.js

@@ -2,19 +2,24 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkCacheState = exports.UNCACHED_STATE_KEY = void 0;
 const work_item_1 = require("../../planner/work-item");
+const work_task_1 = require("../../planner/work-task");
 const get_cache_directory_1 = require("../../optimizer/get-cache-directory");
 const cache_metadata_1 = require("../cache-metadata");
 const work_task_cache_description_1 = require("../../optimizer/work-task-cache-description");
 const log_1 = require("../../log");
 const state_key_1 = require("./state-key");
 const work_instance_id_1 = require("../../planner/work-instance-id");
+const deferred_restore_1 = require("../deferred-restore");
 // The key a task whose cache is off runs and records its outputs under. It is
 // no hash, so a later run with its cache on never takes those outputs as its own.
 exports.UNCACHED_STATE_KEY = 'uncached';
 async function checkCacheState(item, defaultCacheMethod, environment, 
 // watch mode compares keys to rerun on a change, so it needs one even when
 // the cache is off
+// restore: false only looks a backend hit up, its outputs are downloaded once
+// something that runs depends on them (`run --no-restore`, see deferred-restore)
 options = {}) {
+    (0, deferred_restore_1.clearDeferredRestore)(item);
     // A task whose cache is off is never looked up, so hashing its sources buys
     // nothing, and a `**` over a node_modules takes most of a minute (every run
     // with arguments). Its dependents still hash its sources for their own key.
@@ -35,18 +40,41 @@ options = {}) {
         item.status.write('debug', `${item.name} always runs, it or one of its dependencies has no src files`);
         return { cached: false, stateKey, resolved, provable };
     }
+    // An aggregate runs nothing, so running it costs nothing, and it is never a hit itself:
+    // asked for, it still has its dependencies checked and their outputs restored. Its key
+    // counts for what depends on it, and it is reported cached when they all were.
+    if ((0, work_item_1.isWorkTaskItem)(item) && (0, work_task_1.isAggregateTask)(item.data)) {
+        return { cached: false, stateKey, resolved, provable };
+    }
     if ((0, work_item_1.isWorkTaskItem)(item)) {
         const runtimeStateKey = await item.runtime.currentStateKey(environment);
         if (runtimeStateKey === stateKey) {
             return { cached: true, stateKey, resolved, provable };
         }
+        if (options.restore === false && options.watch) {
+            item.status.write('debug', `${item.name} restores cache hits, --no-restore has no effect in watch mode`);
+        }
+        if (options.restore === false && !options.watch) {
+            try {
+                if (await resolved.backend.has(item.id(), stateKey, environment)) {
+                    item.status.write('info', `${item.name} found in cache "${resolved.name}" (${resolved.backend.type}), not restored`);
+                    await touchEntry(item, resolved, stateKey, environment);
+                    (0, deferred_restore_1.deferRestore)(item, async () => {
+                        if (!(await restoreFromBackend(item, resolved, stateKey, currentStats, environment))) {
+                            throw new Error(`${item.name} is no longer in cache "${resolved.name}", its outputs can not be restored. ` +
+                                'Run again without --no-restore.');
+                        }
+                    });
+                    return { cached: true, stateKey, resolved, provable };
+                }
+            }
+            catch (e) {
+                item.status.write('warn', `${item.name} failed to look up cache "${resolved.name}": ${(0, log_1.getErrorMessage)(e)} — continuing with local execution`);
+            }
+            return { cached: false, stateKey, resolved, provable };
+        }
         try {
-            const cacheDir = (0, get_cache_directory_1.getCacheDirectory)((0, work_instance_id_1.getWorkInstanceId)(item));
-            const pulled = await resolved.backend.pull(item.id(), stateKey, cacheDir, environment);
-            if (pulled) {
-                item.status.write('info', `${item.name} pulled from cache "${resolved.name}" (${resolved.backend.type})`);
-                await item.runtime.restore(environment, cacheDir, stateKey);
-                await (0, cache_metadata_1.writeCacheMetadata)(environment, item, currentStats, (0, work_task_cache_description_1.getWorkTaskCacheDescription)(item));
+            if (await restoreFromBackend(item, resolved, stateKey, currentStats, environment)) {
                 return { cached: true, stateKey, resolved, provable };
             }
         }
@@ -57,4 +85,27 @@ options = {}) {
     return { cached: false, stateKey, resolved, provable };
 }
 exports.checkCacheState = checkCacheState;
+// Pull a task's entry and restore its outputs into the checkout. False when the
+// backend has no such entry.
+async function restoreFromBackend(item, resolved, stateKey, currentStats, environment) {
+    const cacheDir = (0, get_cache_directory_1.getCacheDirectory)((0, work_instance_id_1.getWorkInstanceId)(item));
+    const pulled = await resolved.backend.pull(item.id(), stateKey, cacheDir, environment);
+    if (!pulled) {
+        return false;
+    }
+    item.status.write('info', `${item.name} pulled from cache "${resolved.name}" (${resolved.backend.type})`);
+    await item.runtime.restore(environment, cacheDir, stateKey);
+    await (0, cache_metadata_1.writeCacheMetadata)(environment, item, currentStats, (0, work_task_cache_description_1.getWorkTaskCacheDescription)(item));
+    return true;
+}
+// A hit that is only looked up still counts as used, so retention keeps it.
+// Best effort: the hit stands whether or not the marker could be written.
+async function touchEntry(item, resolved, stateKey, environment) {
+    try {
+        await resolved.backend.touch?.(item.id(), stateKey, environment);
+    }
+    catch (e) {
+        item.status.write('debug', `${item.name} could not mark its cache entry as used: ${(0, log_1.getErrorMessage)(e)}`);
+    }
+}
 //# sourceMappingURL=enqueue-next.js.map

package/dist/executer/scheduler/state-key.js

@@ -1,8 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.computeStateKey = exports.combineStateKeys = exports.resolveEffective = void 0;
-const crypto_1 = require("crypto");
+exports.computeStateKey = exports.combineStateKeys = exports.isOwnProvable = exports.resolveEffective = void 0;
 const get_work_cache_stats_1 = require("../../optimizer/get-work-cache-stats");
+const work_task_1 = require("../../planner/work-task");
 // The state-key engine is shared by the scheduler's hit/miss decision
 // (`checkCacheState`) and the read-only cache-explain engine, so a prediction
 // can never diverge from the decision it predicts — there is one implementation.
@@ -21,9 +21,14 @@ exports.resolveEffective = resolveEffective;
 // whose `src` entries all match no file (a typo, a moved path). Services are not
 // affected.
 function isOwnProvable(item, unmatched) {
+    if ((0, work_task_1.isAggregateTask)(item.data)) {
+        // it runs nothing and reads nothing: what its dependencies prove is all there is
+        return true;
+    }
     // unmatched ⊆ declared, so this is also false when nothing is declared
     return unmatched.length < item.data.src.filter((src) => !src.inherited).length;
 }
+exports.isOwnProvable = isOwnProvable;
 // Fold a task's own state key together with the state keys of its dependencies.
 // A change anywhere in the dependency subtree must change the resulting key, so
 // that a downstream task is invalidated when an upstream source changes — even
@@ -34,9 +39,7 @@ function combineStateKeys(ownKey, depKeys) {
     }
     // Sort so the key is independent of dependency declaration order.
     const sorted = [...depKeys].sort();
-    return (0, crypto_1.createHash)('md5')
-        .update([ownKey, ...sorted].join(','))
-        .digest('hex');
+    return (0, get_work_cache_stats_1.stateKeyDigest)([ownKey, ...sorted].join(','));
 }
 exports.combineStateKeys = combineStateKeys;
 // `none` only disables the cache *check* for a task; its sources still influence
@@ -72,7 +75,41 @@ async function computeStateKey(item, defaultCacheMethod, environment, memo = new
         depKeys.push(effective.stateKey);
         provable = provable && effective.provable;
     }
+    // what a task that needs a service passed against: the sources of the service and of the
+    // tasks it depends on (its definition is in the task id, getWorkServiceCacheIdentity)
+    for (const need of item.needs) {
+        const effective = await resolveNeedStateKey(need.service, defaultCacheMethod, environment, memo);
+        depKeys.push(`${need.name}=${effective.stateKey}`);
+    }
     return { stateKey: combineStateKeys(ownKey, depKeys), stats, resolved, provable, unmatched };
 }
 exports.computeStateKey = computeStateKey;
+// A needed service's sources folded with the state keys of its dependencies and needs. It
+// does not make the task that needs it unprovable: a dependency without `src` (resetting the
+// service's data, say) is skipped with the service when the task is a cache hit.
+async function resolveNeedStateKey(service, defaultCacheMethod, environment, memo) {
+    const memoKey = `need\0${service.name}`;
+    const existing = memo.get(memoKey);
+    if (existing !== undefined) {
+        return existing;
+    }
+    // services that need each other in a loop fail to plan (checkForLoop): this only has to end
+    memo.set(memoKey, { stateKey: 'loop', provable: true });
+    const resolved = resolveEffective(service, defaultCacheMethod);
+    const { stats } = await (0, get_work_cache_stats_1.getWorkItemCacheStats)(service, environment);
+    const keys = [];
+    for (const dep of service.deps) {
+        keys.push((await resolveEffectiveStateKey(dep, defaultCacheMethod, environment, memo)).stateKey);
+    }
+    for (const need of service.needs) {
+        const effective = await resolveNeedStateKey(need.service, defaultCacheMethod, environment, memo);
+        keys.push(`${need.name}=${effective.stateKey}`);
+    }
+    const effective = {
+        stateKey: combineStateKeys((0, get_work_cache_stats_1.getStateKey)(stats, concreteMethod(resolved, defaultCacheMethod)), keys),
+        provable: true,
+    };
+    memo.set(memoKey, effective);
+    return effective;
+}
 //# sourceMappingURL=state-key.js.map

package/dist/executer/watch-loop.js

@@ -12,7 +12,10 @@ async function watchLoop(work, environment, options, factory) {
     // kubernetes-service has no such field. Read it wherever it exists.
     const continuous = 'continuous' in work.data ? work.data.continuous : false;
     const watchMode = options.watch && !options.daemon && !continuous;
-    const currentStats = await (0, enqueue_next_1.checkCacheState)(work, options.cacheDefault, environment, { watch: watchMode });
+    const currentStats = await (0, enqueue_next_1.checkCacheState)(work, options.cacheDefault, environment, {
+        watch: watchMode,
+        restore: options.restore,
+    });
     (0, abort_1.checkForAbort)(environment.abortCtrl.signal);
     const watchState = watchMode
         ? (0, watch_state_key_1.watchStateKey)(work, currentStats, environment, options)

package/dist/harness/connect.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getHarnessEnvironment = exports.connectSandbox = exports.harnessOptionsFromEnv = exports.DEFAULT_SHELL_TASK = void 0;
+exports.getHarnessEnvironment = exports.connectSandbox = exports.connectServer = exports.hasShell = exports.harnessOptionsFromEnv = exports.DEFAULT_SHELL_TASK = void 0;
 const get_file_context_1 = require("../file/get-file-context");
 const log_1 = require("../log");
 const work_item_status_1 = require("../planner/work-item-status");
@@ -20,11 +20,21 @@ function harnessOptionsFromEnv(env) {
         repo: value('HAMMERKIT_REPO'),
         ref: value('HAMMERKIT_REF'),
         build: value('HAMMERKIT_BUILD'),
-        shell: value('HAMMERKIT_SHELL'),
+        // set but empty is no shell, unset the default one
+        shell: env.HAMMERKIT_SHELL !== undefined ? env.HAMMERKIT_SHELL.trim() : undefined,
     };
 }
 exports.harnessOptionsFromEnv = harnessOptionsFromEnv;
-async function connectSandbox(environment, options, log = () => undefined) {
+// whether the clients offer a shell tool
+function hasShell(options) {
+    return options.shell !== '';
+}
+exports.hasShell = hasShell;
+/**
+ * The registered server a harness works on and the published version it runs, checked:
+ * what the clients need to list the tasks of the version before they take a sandbox.
+ */
+async function connectServer(environment, options) {
     const config = await (0, host_config_1.readHostConfig)(environment);
     const name = options.server ?? config.run.on;
     if (!name || !(0, host_config_1.hasServer)(config.servers, name)) {
@@ -39,8 +49,12 @@ async function connectSandbox(environment, options, log = () => undefined) {
     if (!bundle_1.HASH_PATTERN.test(options.build)) {
         throw new Error(`${options.build} is not the hash of a published version (sha256:...), name it as hammerkit remote publish printed it (HAMMERKIT_BUILD or --build)`);
     }
-    const server = config.servers[name];
-    const connection = { url: server.url, ...(0, token_source_1.getTokenSource)(environment, name, server) };
+    const server = (0, host_config_1.getRegisteredServer)(config, name);
+    return { name, connection: { url: server.url, ...(0, token_source_1.getTokenSource)(environment, name, server) }, build: options.build };
+}
+exports.connectServer = connectServer;
+async function connectSandbox(environment, options, log = () => undefined) {
+    const { name, connection, build } = await connectServer(environment, options);
     let sandbox;
     if (options.sandbox) {
         sandbox = await sandbox_client_1.SandboxClient.get(connection, options.sandbox);
@@ -59,7 +73,7 @@ async function connectSandbox(environment, options, log = () => undefined) {
     else {
         throw new Error('name a sandbox (HAMMERKIT_SANDBOX or --sandbox), or a repository and ref to create one from (HAMMERKIT_REPO and HAMMERKIT_REF, or --repo and --ref)');
     }
-    return new sandbox_client_1.SandboxClient(connection, sandbox, { hash: options.build, shell: options.shell ?? exports.DEFAULT_SHELL_TASK });
+    return new sandbox_client_1.SandboxClient(connection, sandbox, { hash: build, shell: options.shell ?? exports.DEFAULT_SHELL_TASK });
 }
 exports.connectSandbox = connectSandbox;
 // A client that starts with a repository and ref takes a sandbox of the caller's of the same

package/dist/harness/mcp-command.js

@@ -6,6 +6,15 @@ const log_1 = require("../log");
 const version_1 = require("../version");
 const connect_1 = require("./connect");
 const mcp_1 = require("./mcp");
+const task_tools_1 = require("./task-tools");
+// the tasks run_task lists; a server that does not answer leaves them out, the tools still work
+async function listTasks(sandbox, log) {
+    const listing = await (0, task_tools_1.readTaskListing)(() => sandbox.tasks());
+    if (!Array.isArray(listing)) {
+        log(`the tasks of ${sandbox.build.hash} could not be listed: ${listing.error}`);
+    }
+    return listing;
+}
 // `hammerkit remote mcp`: a Model Context Protocol server on stdio for one sandbox of a
 // server. It lives under `remote`, which already is a command: a top-level `mcp` would hide a
 // task named `mcp`, since `hammerkit <task>` runs a task. Like the other `remote` commands it
@@ -21,20 +30,27 @@ function registerMcpCommand(remote, environment, input = process.stdin) {
         .addOption(new commander_1.Option('--repo <repo>', 'create a sandbox of this repository').env('HAMMERKIT_REPO'))
         .addOption(new commander_1.Option('--ref <ref>', 'at this branch').env('HAMMERKIT_REF'))
         .addOption(new commander_1.Option('--build <hash>', 'hash of the published version of the build file whose tasks run on it').env('HAMMERKIT_BUILD'))
-        .addOption(new commander_1.Option('--shell <task>', 'its task whose last command is a shell, like sh -c')
+        .addOption(new commander_1.Option('--shell <task>', "its task whose last command is a shell, like sh -c; '' for no bash tool")
         .env('HAMMERKIT_SHELL')
         .default(connect_1.DEFAULT_SHELL_TASK))
         .action(async (options) => {
         try {
             // stdout carries the protocol only, everything else goes to stderr
             const log = (line) => environment.stderr.write(`hammerkit remote mcp: ${line}\n`);
-            const sandbox = await (0, connect_1.connectSandbox)(environment, options, log);
+            // as the plugins read it: blank is no shell
+            const sandbox = await (0, connect_1.connectSandbox)(environment, { ...options, shell: options.shell.trim() }, log);
             log(`sandbox ${sandbox.id} of ${sandbox.sandbox.repo} at ${sandbox.sandbox.commit}`);
+            const shell = sandbox.build.shell;
             const instructions = `The tools work on hammerkit sandbox ${sandbox.id}, a checkout of ${sandbox.sandbox.repo} at ` +
-                `${sandbox.sandbox.commit} on a server. Paths are relative to its root. bash runs a command as the ` +
-                `task ${sandbox.build.shell} of the published build file ${sandbox.build.hash}, run_task runs its other ` +
-                'tasks; only the files are kept between commands. changes shows what changed since the fetch.';
-            const served = (0, mcp_1.serveMcp)(input, environment.stdout, (0, mcp_1.createMcpTools)(async () => sandbox), {
+                `${sandbox.sandbox.commit} on a server. Paths are relative to its root. ` +
+                (shell
+                    ? `bash runs a command as the task ${shell} of the published build file ${sandbox.build.hash}, ` +
+                        'run_task runs its other tasks; only the files are kept between commands. '
+                    : `run_task runs the tasks of the published build file ${sandbox.build.hash}; only the files are ` +
+                        'kept between runs. ') +
+                'changes shows what changed since the fetch.';
+            const tasks = await listTasks(sandbox, log);
+            const served = (0, mcp_1.serveMcp)(input, environment.stdout, (0, mcp_1.createMcpTools)(async () => sandbox, { tasks, shell: shell || false }), {
                 name: 'hammerkit',
                 version: (0, version_1.getVersion)(),
                 instructions,

package/dist/harness/mcp.js

@@ -4,6 +4,8 @@ exports.serveMcp = exports.createMcpTools = void 0;
 const readline_1 = require("readline");
 const format_1 = require("./format");
 const sandbox_client_1 = require("./sandbox-client");
+const task_tools_1 = require("./task-tools");
+const service_tools_1 = require("./service-tools");
 // the newest first; a client asking for an older one gets it
 const PROTOCOL_VERSIONS = ['2025-06-18', '2025-03-26', '2024-11-05'];
 const READ_ONLY = { readOnlyHint: true, openWorldHint: false };
@@ -25,40 +27,47 @@ const flag = (description) => ({ type: 'boolean', description });
 function sandboxPath(path) {
     return (path ?? '').replace(/\\/g, '/').replace(/^\/+/, '');
 }
-function readLog(run, task) {
-    return `read more of the log with run_logs { "run": "${run}", "task": "${task}" }`;
-}
-function describeRun(task, ran) {
-    const result = ran.result;
-    const lines = [`run ${ran.run.id}: ${ran.run.state}`];
-    if (result) {
-        lines.push(`task ${task}: ${result.status}` +
-            (result.exitCode !== undefined ? `, exit code ${result.exitCode}` : '') +
-            (result.durationMs !== undefined ? `, ${result.durationMs} ms` : '') +
-            (result.cache?.hit ? ', from the cache' : ''));
-        if (result.error) {
-            lines.push(`error: ${result.error}`);
-        }
-        if (result.cache?.causes?.length) {
-            lines.push(`ran because: ${result.cache.causes.join('; ')}`);
-        }
-    }
-    else if (ran.run.error) {
-        lines.push(`error: ${ran.run.error}`);
-    }
-    if (result && result.lastLog.length > 0) {
-        lines.push('last lines:', ...result.lastLog);
-    }
-    lines.push(readLog(ran.run.id, task));
-    return lines.join('\n');
-}
 /**
  * The tools of `hammerkit remote mcp`, for chat clients and agents without file and shell tools of
  * their own. They take the shapes models are trained on: numbered reads with offset and
  * limit, exact-string replace, `apply_patch` or a git diff, ripgrep's parameters, a shell
- * command. Paths are relative to the root of the sandbox.
+ * command. Paths are relative to the root of the sandbox. `tasks` are the tasks the description
+ * of `run_task` lists; without `shell` there is no `bash`.
  */
-function createMcpTools(client) {
+function createMcpTools(client, options = {}) {
+    const [runTask, runLogs, check] = (0, task_tools_1.createTaskTools)(options.tasks, options.shell || undefined).map((tool) => fromTaskTool(tool, client));
+    const bash = {
+        name: 'bash',
+        description: 'Run a shell command on the sandbox and answer its output and exit code. It runs as the shell task of ' +
+            'the published build file, in its container and with its network; commands run one at a time, and ' +
+            'only the files are kept between them.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                command: text('The command'),
+                workdir: text('The directory to run it in, relative to the root of the sandbox'),
+                timeout: count('Stop the command after this many seconds', 1),
+            },
+            required: ['command'],
+        },
+        annotations: { title: 'Run a command' },
+        async call(args, signal) {
+            const sandbox = await client();
+            const ran = await sandbox.exec(args.command, sandboxPath(args.workdir), {
+                signal,
+                timeoutSeconds: args.timeout,
+            });
+            const output = (0, format_1.capOutput)(ran.output, (0, task_tools_1.readLogHint)(ran.run.id, sandbox.build.shell));
+            const lines = output ? [output, ''] : [];
+            if (ran.exitCode === null) {
+                lines.push(`hammerkit: ${ran.result?.error ?? ran.run.error ?? `the run ended ${ran.run.state}`}`);
+            }
+            else {
+                lines.push(`exit code ${ran.exitCode}`);
+            }
+            return lines.join('\n');
+        },
+    };
     return inOrder([
         {
             name: 'read',
@@ -185,91 +194,10 @@ function createMcpTools(client) {
                 return (0, format_1.formatTree)(await (await client()).tree({ path, glob: args.pattern, limit: 500 }));
             },
         },
-        {
-            name: 'bash',
-            description: 'Run a shell command on the sandbox and answer its output and exit code. It runs as the shell task of ' +
-                'the published build file, in its container and with its network; commands run one at a time, and ' +
-                'only the files are kept between them.',
-            inputSchema: {
-                type: 'object',
-                properties: {
-                    command: text('The command'),
-                    workdir: text('The directory to run it in, relative to the root of the sandbox'),
-                    timeout: count('Stop the command after this many seconds', 1),
-                },
-                required: ['command'],
-            },
-            annotations: { title: 'Run a command' },
-            async call(args, signal) {
-                const sandbox = await client();
-                const ran = await sandbox.exec(args.command, sandboxPath(args.workdir), {
-                    signal,
-                    timeoutSeconds: args.timeout,
-                });
-                const output = (0, format_1.capOutput)(ran.output, readLog(ran.run.id, sandbox.build.shell));
-                const lines = output ? [output, ''] : [];
-                if (ran.exitCode === null) {
-                    lines.push(`hammerkit: ${ran.result?.error ?? ran.run.error ?? `the run ended ${ran.run.state}`}`);
-                }
-                else {
-                    lines.push(`exit code ${ran.exitCode}`);
-                }
-                return lines.join('\n');
-            },
-        },
-        {
-            name: 'run_task',
-            description: 'Run a task of the published build file on the sandbox, such as test or build, and answer how it went: ' +
-                'its status, exit code, why it was not taken from the cache, and its last lines. args are appended to ' +
-                'its last command, for example a test file.',
-            inputSchema: {
-                type: 'object',
-                properties: {
-                    task: text('The name of the task'),
-                    args: { type: 'array', items: { type: 'string' }, description: 'Arguments for its last command' },
-                },
-                required: ['task'],
-            },
-            annotations: { title: 'Run a task' },
-            async call(args, signal) {
-                const ran = await (await client()).runTask(args.task, { args: args.args, signal });
-                return describeRun(args.task, ran);
-            },
-        },
-        {
-            name: 'run_logs',
-            description: 'Read the log of a run as numbered lines: one task, the last lines (tail), a range (from, limit) or ' +
-                'the lines that contain a text (grep, a fixed string) with lines of context around them.',
-            inputSchema: {
-                type: 'object',
-                properties: {
-                    run: text('The id of the run'),
-                    task: text('Only the lines of this task'),
-                    tail: count('The last lines, or with grep the last matches', 1, 1000),
-                    from: count('The first line to read', 1),
-                    limit: count('How many lines to read', 1, 1000),
-                    grep: text('Only lines that contain this text'),
-                    ignore_case: flag('Ignore case in grep'),
-                    context: count('Lines before and after each match', 0, 20),
-                },
-                required: ['run'],
-            },
-            annotations: { title: 'Read the log of a run', ...READ_ONLY },
-            async call(args) {
-                const page = await (await client()).logs(args.run, {
-                    task: args.task,
-                    tail: args.tail,
-                    from: args.from,
-                    limit: args.limit,
-                    grep: args.grep,
-                    i: args.ignore_case,
-                    context: args.context,
-                });
-                const lines = page.lines.map((line) => `${line.line}${line.match === false ? '-' : ':'} ${args.task ? '' : `[${line.task}] `}${line.text}`);
-                lines.push('', `(${page.total} lines${args.grep ? ` searched, ${page.lines.filter((line) => line.match !== false).length} match here` : ''}${page.next ? `, read on with from ${page.next}` : ''}${page.truncated ? ', the server cut the log off at its limit' : ''})`);
-                return lines.join('\n');
-            },
-        },
+        ...(options.shell === false ? [] : [bash]),
+        runTask,
+        check,
+        { ...runLogs, annotations: { ...runLogs.annotations, ...READ_ONLY } },
         {
             name: 'changes',
             description: 'What changed in the sandbox since the commit it was fetched at: a summary of the files, a diff, or a ' +
@@ -315,9 +243,30 @@ function createMcpTools(client) {
                 return `pushed ${pushed.commit} to ${pushed.branch}`;
             },
         },
+        ...service_tools_1.SERVICE_TOOLS.map((tool) => ({
+            name: tool.name,
+            description: tool.description,
+            inputSchema: (0, service_tools_1.serviceToolSchema)(tool),
+            annotations: { title: tool.title, readOnlyHint: tool.name === 'endpoint_get', openWorldHint: false },
+            async call(args, signal) {
+                return tool.call(await client(), args, signal);
+            },
+        })),
     ]);
 }
 exports.createMcpTools = createMcpTools;
+// a tool shared with the other harnesses, as an MCP tool
+function fromTaskTool(tool, client) {
+    return {
+        name: tool.name,
+        description: tool.description,
+        inputSchema: (0, task_tools_1.taskToolSchema)(tool),
+        annotations: { title: tool.title },
+        async call(args, signal) {
+            return tool.call(await client(), args, signal);
+        },
+    };
+}
 // the calls of a client go to the sandbox one at a time, in the order the client sent them
 function inOrder(tools) {
     const inTurn = (0, sandbox_client_1.oneAtATime)();