hammerkit 1.27.0-next.8 → 2.0.0-next.1

package/dist/server/sandbox-pod.js

@@ -1,12 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.sandboxPodMain = exports.decodePodError = exports.encodeEditOps = exports.INCOMING_REF = exports.INCOMING = void 0;
+const crypto_1 = require("crypto");
 const promises_1 = require("fs/promises");
 const path_1 = require("path");
 const url_1 = require("url");
 const git_checkout_1 = require("./git-checkout");
 const sandbox_files_1 = require("./sandbox-files");
 const sandbox_storage_1 = require("./sandbox-storage");
+const tar_1 = require("../utils/tar");
 // On a cluster a sandbox is a claim, and what the server does with its files runs in a
 // short pod that mounts it (see KubernetesSandboxStorage): `hammerkit server-sandbox
 // <directory>` reads one request on its standard input, does it with the code of a host
@@ -91,6 +93,32 @@ async function answer(storage, directory, request, out) {
             }
             return send({ files: plan.files, bytes: plan.bytes });
         }
+        case 'archive': {
+            // written beside the sandbox on the claim, sent, and removed
+            const into = (0, path_1.join)(directory, `${request.id}-archive-${(0, crypto_1.randomBytes)(6).toString('hex')}`);
+            try {
+                await storage.exportTree(key, request.tree, into, AbortSignal.timeout(10 * 60000));
+                await write(out, JSON.stringify({ ok: true, result: null, stream: true }) + '\n');
+                const pack = (0, tar_1.packArchive)({ cwd: into, portable: true }, ['.']);
+                try {
+                    for await (const chunk of pack) {
+                        await write(out, chunk);
+                    }
+                }
+                catch (e) {
+                    throw new AnswerStarted(e instanceof Error ? e.message : String(e));
+                }
+                finally {
+                    // a reader that went away (over its size limit) leaves the pack reading files
+                    // that are removed next: what fails then is no answer of anybody's
+                    pack.on('error', () => undefined);
+                }
+                return;
+            }
+            finally {
+                await (0, promises_1.rm)(into, { recursive: true, force: true });
+            }
+        }
         case 'raw': {
             const raw = await files().raw(request.path);
             const header = {

package/dist/server/sandbox-storage.js

@@ -276,6 +276,29 @@ class HostSandboxStorage {
     // files change, and what it wrote to the git data is pruned again. Files a task made
     // unreadable are made readable first: git would leave them out and call the sandbox
     // clean.
+    async exportTree({ id }, tree, into, signal) {
+        if (!/^[0-9a-f]{40}([0-9a-f]{24})?$/.test(tree)) {
+            throw new Error(`${JSON.stringify(tree.slice(0, 80))} is not a git tree`);
+        }
+        return this.withIndex(id, signal, async (run) => {
+            const now = (await run(['write-tree'], 'read')).trim();
+            if (now !== tree) {
+                throw new Error(`the files of the sandbox ${id} are ${now} now, not ${tree}`);
+            }
+            // an index of its own holds the tree alone, whatever the sandbox's index says of its
+            // entries; the files are written as git has them, through no filter of the server's
+            const index = (0, path_1.join)(this.root(id), `export-${(0, crypto_1.randomBytes)(6).toString('hex')}`);
+            await (0, promises_1.mkdir)(into, { recursive: true });
+            try {
+                const env = this.readEnv({ GIT_INDEX_FILE: index });
+                await this.git(id, ['read-tree', tree], env, signal, 'read');
+                await this.git(id, ['checkout-index', '--all', '--force', `--prefix=${(0, path_1.join)(into, '/')}`], env, signal, 'read');
+            }
+            finally {
+                await (0, promises_1.rm)(index, { force: true });
+            }
+        });
+    }
     async state({ id }, signal = AbortSignal.timeout(5 * 60 * 1000)) {
         return this.withIndex(id, signal, async (run) => {
             const tree = (await run(['write-tree'], 'read')).trim();

package/dist/server/sandboxes.js

@@ -412,6 +412,14 @@ class SandboxRegistry {
     async state(id, signal) {
         return this.options.storage.state(keyOf(this.existing(id)), signal);
     }
+    // The files of `tree`, which the sandbox's files must be now, written into `into`: what a
+    // check runs on.
+    async exportTree(id, tree, into, signal) {
+        const sandbox = this.existing(id);
+        sandbox.lastUsedAt = this.timestamp();
+        await this.save(sandbox);
+        await this.options.storage.exportTree(keyOf(sandbox), tree, into, signal);
+    }
     // What a run works on, `into` a directory of the run when the storage copies the files;
     // the run is the sandbox's use.
     async attach(id, into) {

package/dist/server/server-config.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.detectPlatform = exports.getSecretCatalog = exports.readServerConfig = exports.getSourceAccounts = exports.getSandboxRuntimes = exports.serverConfigSchema = exports.sourceSchema = exports.entitlementSchema = exports.sandboxGrantSchema = exports.sandboxBranchTypeSchema = exports.buildsLevelSchema = exports.accountLevelSchema = exports.getMaxVolumeSize = exports.DEFAULT_MAX_VOLUME_SIZE = exports.DEFAULT_DENIED_EGRESS = exports.kubernetesPoolSchema = exports.accountSchema = exports.issuerSchema = exports.serverPlatformSchema = void 0;
+exports.detectPlatform = exports.getSecretCatalog = exports.readServerConfig = exports.getServerAccounts = exports.getSandboxRuntimes = exports.serverConfigSchema = exports.sourceSchema = exports.entitlementSchema = exports.endpointGrantSchema = exports.endpointLevelSchema = exports.sandboxGrantSchema = exports.sandboxBranchTypeSchema = exports.buildsLevelSchema = exports.accountLevelSchema = exports.getMaxVolumeSize = exports.DEFAULT_MAX_VOLUME_SIZE = exports.DEFAULT_DENIED_EGRESS = exports.kubernetesPoolSchema = exports.accountSchema = exports.issuerSchema = exports.serverPlatformSchema = void 0;
 const net_1 = require("net");
 const zod_1 = require("zod");
 const yaml_1 = require("yaml");
@@ -8,6 +8,7 @@ const log_1 = require("../log");
 const units_1 = require("../utils/units");
 const version_1 = require("../version");
 const network_schema_1 = require("../schema/network-schema");
+const capabilities_schema_1 = require("../schema/capabilities-schema");
 const build_file_secret_provider_schema_1 = require("../schema/build-file-secret-provider-schema");
 const repo_1 = require("./repo");
 const work_network_1 = require("../planner/work-network");
@@ -117,12 +118,24 @@ exports.accountSchema = zod_1.z
         });
     }
 });
+// The capabilities (`capAdd`) a task of a run may add, and the sandboxed runtime its
+// container then runs in, so they hold in the sandbox's own kernel and never in the host's
+const capabilitiesAllowSchema = zod_1.z
+    .array(zod_1.z.enum(capabilities_schema_1.LINUX_CAPABILITIES))
+    .min(1)
+    .refine((names) => new Set(names).size === names.length, 'a capability is listed twice');
 // The tasks of runs execute on this machine, with its docker daemon and local tools.
 const hostBackendSchema = zod_1.z
     .object({
     type: zod_1.z.literal('host'),
     // what this machine offers; detected when left out
     platform: exports.serverPlatformSchema.optional(),
+    // `runtime` is a runtime of the docker daemon (`runtimes` in its daemon.json), such as
+    // runsc of gVisor
+    capabilities: zod_1.z
+        .object({ allow: capabilitiesAllowSchema, runtime: zod_1.z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_.-]*$/) })
+        .strict()
+        .optional(),
 })
     .strict();
 const tolerationSchema = zod_1.z
@@ -188,8 +201,12 @@ const kubernetesSandboxesSchema = zod_1.z
     // when left out. With a class of their own, a ResourceQuota on that class in each
     // caller's namespace holds `sandboxes.limits`.
     storageClass: zod_1.z.string().min(1).optional(),
-    // how long the pod of a sandbox's files stays after the last request
+    // how long the pod of a sandbox's files stays after the last request; the runner of the
+    // sandbox goes with it
     idle: duration.default('1m'),
+    // exec the commands of a task shaped like a shell (it mounts the sandbox only, has no
+    // needs, outputs or secrets) into one pod per sandbox, in place of a Job each
+    runner: zod_1.z.boolean().default(true),
     // of the pod of a sandbox's files, which runs git and ripgrep over all of them
     resources: zod_1.z
         .object({ requests: quantitiesSchema.optional(), limits: quantitiesSchema.optional() })
@@ -278,6 +295,9 @@ const kubernetesBackendSchema = zod_1.z
     // build file's environment does: hammerkit can't tell from the API, and without it a
     // task with a limited network fails rather than runs open
     networkPolicy: zod_1.z.literal('enforced').optional(),
+    // `runtimeClass` is a RuntimeClass of a sandbox, such as gvisor; the pods of tasks that
+    // add capabilities run in it
+    capabilities: zod_1.z.object({ allow: capabilitiesAllowSchema, runtimeClass: kubernetesNameSchema }).strict().optional(),
 })
     .strict();
 // the most a task's claim may request on a server whose operator states no maxVolumeSize
@@ -323,6 +343,11 @@ exports.sandboxGrantSchema = zod_1.z
         .refine((branches) => Object.keys(branches).length > 0, 'name the branches a sandbox may start from'),
 })
     .strict();
+// `open`: open the endpoints of the service runs of a repository, whoever started them, and
+// extend those runs; `publish`: also name endpoints in one's own service runs.
+exports.endpointLevelSchema = zod_1.z.enum(['open', 'publish']);
+// One repository (`host/path` pattern) whose endpoints an entitlement opens or publishes.
+exports.endpointGrantSchema = zod_1.z.object({ repo: repoPatternSchema, level: exports.endpointLevelSchema }).strict();
 exports.entitlementSchema = zod_1.z
     .object({
     ...whoShape,
@@ -332,19 +357,38 @@ exports.entitlementSchema = zod_1.z
     // the repositories (`host/path` patterns) the caller may run from a git ref
     repos: zod_1.z.array(repoPatternSchema).default([]),
     builds: exports.buildsLevelSchema.optional(),
+    // `read`: may look up which tasks runs passed for files of the `repos` (remote verify),
+    // and nothing more; a builds level includes it
+    checks: zod_1.z.literal('read').optional(),
     // the repositories the caller may keep sandboxes of, checkouts on the server that runs
     // work on: a list of its own, the `repos` above are for runs from a ref
     sandboxes: zod_1.z.array(exports.sandboxGrantSchema).optional(),
+    // the repositories whose service runs' endpoints the caller may open, or publish
+    endpoints: zod_1.z.array(exports.endpointGrantSchema).optional(),
+    // sees every run of the server in full, who started it, its tasks and its log, in
+    // `remote status`, `remote runs --all` and the dashboard: for operators, it stops,
+    // extends and approves nothing
+    observe: zod_1.z.literal(true).optional(),
 })
     .strict()
     .superRefine((entitlement, ctx) => {
     checkWho(entitlement, ctx);
     if (Object.keys(entitlement.accounts).length === 0 &&
         entitlement.builds === undefined &&
-        !entitlement.sandboxes?.length) {
+        entitlement.checks === undefined &&
+        !entitlement.sandboxes?.length &&
+        !entitlement.endpoints?.length &&
+        !entitlement.observe) {
         ctx.addIssue({
             code: zod_1.z.ZodIssueCode.custom,
-            message: 'name accounts to use or request, a builds level or sandboxes',
+            message: 'name accounts to use or request, a builds level, checks, sandboxes, endpoints or observe',
+        });
+    }
+    if (entitlement.checks && entitlement.repos.length === 0) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['repos'],
+            message: 'checks are read for repositories: name them in repos',
         });
     }
 });
@@ -429,6 +473,10 @@ exports.serverConfigSchema = zod_1.z
         maxConcurrent: zod_1.z.number().int().min(1).default(4),
         // finished runs that are kept for their state and logs
         keep: zod_1.z.number().int().min(1).default(200),
+        // who sees the runs of others: `everyone` with an entitlement sees who runs what,
+        // where it stands and how long it took, never its arguments, error or log;
+        // `involved` only sees the runs they decide about or may open the endpoints of
+        activity: zod_1.z.enum(['everyone', 'involved']).default('everyone'),
         // what one caller (issuer and subject) may have at a time, so a single
         // caller can not take the whole machine; over it a request gets 429
         limits: zod_1.z
@@ -472,6 +520,40 @@ exports.serverConfigSchema = zod_1.z
         // which tasks take arguments: `any` but those that say `args: false`, or
         // `declared`, only those that say `args: true`
         args: zod_1.z.enum(['any', 'declared']).default('any'),
+        // runs of services (`services` in a run), kept up until their ttl ends
+        up: zod_1.z
+            .object({
+            // how long the services stay once ready, when the run names no ttl; then they are removed
+            ttl: duration.default('8h'),
+            // how long the services stay up without a request to an endpoint before they sleep,
+            // when the run names none: the next request wakes them. Unset, they never sleep.
+            sleepTtl: duration.optional(),
+            // the furthest a run, or an extend, sets the end from now
+            maxTtl: duration.default('72h'),
+            limits: zod_1.z
+                .object({
+                // service runs one caller has starting or up at a time; one more is 429
+                up: zod_1.z.number().int().min(1).default(3),
+                // service runs one caller has asleep, which take no place of `up`; a new run
+                // when there are this many is 429
+                asleep: zod_1.z.number().int().min(1).default(10),
+            })
+                .strict()
+                .default({}),
+            // service runs starting or up on the whole server; one more is 503
+            total: zod_1.z.number().int().min(1).default(20),
+            // on a Kubernetes backend, the ResourceQuota of the namespace of each service
+            // run; backend.quota when left out
+            quota: zod_1.z.record(zod_1.z.union([zod_1.z.string().min(1), zod_1.z.number()]).transform(String)).optional(),
+            // the volumes of a run's services stay while it sleeps, and are mounted again when
+            // it wakes; they go when the run ends. false for a server short on disk: a woken
+            // run starts from nothing.
+            keepVolumes: zod_1.z.boolean().default(true),
+        })
+            .strict()
+            .default({}),
+        // how long a passed check stays for `remote verify` to find (see checks.ts)
+        checksKeep: duration.default('30d'),
     })
         .strict()
         .default({}),
@@ -496,6 +578,9 @@ exports.serverConfigSchema = zod_1.z
             .object({ allow: zod_1.z.array(zod_1.z.string().regex(/^[A-Za-z_][A-Za-z0-9_()]*$/)).default([]) })
             .strict()
             .default({}),
+        // the capabilities of `backend.capabilities.allow` a task of a run on a sandbox may
+        // add: none by default, a sandbox holds code nobody reviewed
+        capabilities: zod_1.z.array(zod_1.z.enum(capabilities_schema_1.LINUX_CAPABILITIES)).default([]),
         // what one caller may keep; a sandbox over it can't be created
         limits: zod_1.z
             .object({
@@ -509,6 +594,59 @@ exports.serverConfigSchema = zod_1.z
     })
         .strict()
         .default({}),
+    // ports of service runs published at hosts of their own below `domain`, behind the
+    // server's sign-in. Absent, a run naming endpoints is refused.
+    endpoints: zod_1.z
+        .object({
+        // `run.example.com`: an endpoint is https://<label>.run.example.com, all of them
+        // pointing at this server with one wildcard DNS record
+        domain: zod_1.z
+            .string()
+            .regex(/^(?=.{1,200}$)([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)*[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/, 'expected a domain name in lower case, such as run.example.com'),
+        // a wildcard certificate for *.<domain>, served for the hosts of endpoints; left out
+        // behind a TLS proxy, which holds it
+        tls: zod_1.z
+            .object({ cert: zod_1.z.string().min(1), key: zod_1.z.string().min(1) })
+            .strict()
+            .optional(),
+        // how a person signs in with a browser: the authorization code flow of an issuer of
+        // `issuers`, with a client of its own; without it only tokens open endpoints
+        login: zod_1.z
+            .object({
+            issuer: zod_1.z.string().min(1),
+            clientId: zod_1.z.string().min(1),
+            // for providers whose web clients need one (Google): read as an account no
+            // entitlement may name, as the secret of a source is
+            clientSecret: zod_1.z
+                .object({
+                from: zod_1.z.string().regex(/^[A-Za-z][A-Za-z0-9_-]*:.+$/, 'expected provider:reference'),
+                account: accountNameSchema,
+            })
+                .strict()
+                .optional(),
+            scope: zod_1.z.string().min(1).default('openid'),
+        })
+            .strict()
+            .optional(),
+        // how long a sign-in at one endpoint lasts, at most until its run ends: the groups and
+        // claims of the sign-in hold that long, a change at the issuer counts at the next one
+        session: duration.default('1h'),
+        // the host of the dashboard below the domain, `hammerkit.<domain>`, signed in at like an
+        // endpoint (it needs `login`); false for none
+        dashboard: zod_1.z
+            .union([
+            zod_1.z.literal(false),
+            zod_1.z
+                .string()
+                .regex(/^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/, 'expected a host label, such as hammerkit')
+                .refine((label) => label !== 'login', 'login is the host of the sign-in')
+                // the hosts of endpoints end in -<port>-<12 hex>
+                .refine((label) => !/-\d+-[0-9a-f]{12}$/.test(label), 'that is how the hosts of endpoints are named'),
+        ])
+            .default('hammerkit'),
+    })
+        .strict()
+        .optional(),
     backend: zod_1.z.discriminatedUnion('type', [hostBackendSchema, kubernetesBackendSchema]).default({ type: 'host' }),
 })
     .strict()
@@ -576,7 +714,7 @@ exports.serverConfigSchema = zod_1.z
             });
         }
     });
-    const readers = getSourceAccounts(config);
+    const readers = getServerAccounts(config);
     config.entitlements.forEach((entitlement, index) => {
         for (const account of Object.keys(entitlement.accounts)) {
             if (readers.includes(account)) {
@@ -588,6 +726,16 @@ exports.serverConfigSchema = zod_1.z
             }
         }
     });
+    const allowed = config.backend.capabilities?.allow ?? [];
+    config.sandboxes.capabilities.forEach((capability, index) => {
+        if (!allowed.includes(capability)) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['sandboxes', 'capabilities', index],
+                message: `the capability ${capability} is not in backend.capabilities.allow, no run may add it`,
+            });
+        }
+    });
     const sandboxNetwork = (0, work_network_1.parseWorkNetwork)(config.sandboxes.network);
     const runsNetwork = (0, work_network_1.parseWorkNetwork)(config.runs.network);
     if ((0, work_network_1.exceedsNetwork)(sandboxNetwork, runsNetwork)) {
@@ -659,7 +807,7 @@ exports.serverConfigSchema = zod_1.z
         });
         // the secrets of tasks are read in their Job, with the image of the provider; the
         // ones of the sources are read by the server, which checks the code out itself
-        const readers = getSourceAccounts(config);
+        const readers = getServerAccounts(config);
         for (const [name, account] of Object.entries(config.accounts)) {
             if (readers.includes(name)) {
                 continue;
@@ -745,6 +893,87 @@ exports.serverConfigSchema = zod_1.z
             message: 'the network of a local task can not be limited, allow only the docker runtime with runs.network',
         });
     }
+    if ((0, units_1.parseDuration)(config.runs.up.ttl) > (0, units_1.parseDuration)(config.runs.up.maxTtl)) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['runs', 'up', 'ttl'],
+            message: `a ttl of ${config.runs.up.ttl} is more than maxTtl of ${config.runs.up.maxTtl}`,
+        });
+    }
+    const endpoints = config.endpoints;
+    if (endpoints) {
+        if (endpoints.tls && config.behindTlsProxy) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['endpoints', 'tls'],
+                message: 'behind a TLS proxy the proxy holds the certificate of the endpoints, leave out endpoints.tls',
+            });
+        }
+        if (endpoints.tls && !config.tls) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['endpoints', 'tls'],
+                message: 'the certificate of the endpoints is served next to the one of the server, set tls as well',
+            });
+        }
+        if (!endpoints.tls && !config.behindTlsProxy && (config.tls || !LOOPBACK_HOSTS.includes(config.listen.host))) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['endpoints', 'tls'],
+                message: `name the certificate of *.${endpoints.domain} in endpoints.tls, or set behindTlsProxy: true when a proxy in front holds it`,
+            });
+        }
+        const login = endpoints.login;
+        if (login && !config.issuers.some((issuer) => issuer.issuer === login.issuer)) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['endpoints', 'login', 'issuer'],
+                message: `issuer ${login.issuer} is not one of the accepted issuers`,
+            });
+        }
+        if (login?.clientSecret) {
+            const { from, account } = login.clientSecret;
+            const kind = from.substring(0, from.indexOf(':'));
+            const where = ['endpoints', 'login', 'clientSecret'];
+            if (!config.accounts[account]) {
+                ctx.addIssue({
+                    code: zod_1.z.ZodIssueCode.custom,
+                    path: [...where, 'account'],
+                    message: `unknown account ${account}`,
+                });
+            }
+            else if (!config.accounts[account].providers[kind]) {
+                ctx.addIssue({
+                    code: zod_1.z.ZodIssueCode.custom,
+                    path: [...where, 'from'],
+                    message: `account ${account} has no credentials for the provider ${kind}`,
+                });
+            }
+            if (!config.secretProviders[kind]) {
+                ctx.addIssue({
+                    code: zod_1.z.ZodIssueCode.custom,
+                    path: [...where, 'from'],
+                    message: `secret provider ${kind} is not declared in secretProviders`,
+                });
+            }
+        }
+        // only the server is to reach the services behind endpoints, which the NetworkPolicy of
+        // a service run says: without it, any pod of the cluster would get past the sign-in
+        if (backend.type === 'kubernetes' && backend.networkPolicy !== 'enforced') {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['backend', 'networkPolicy'],
+                message: 'endpoints keep the services of a run to the server with a NetworkPolicy, set networkPolicy: enforced once the network plugin of the cluster enforces them',
+            });
+        }
+        if (backend.type === 'kubernetes' && backend.kubeconfig) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['endpoints'],
+                message: 'endpoints reach the services of runs at their Service in the cluster, run the server in the cluster rather than with a kubeconfig',
+            });
+        }
+    }
     if (!config.tls && !config.behindTlsProxy && !LOOPBACK_HOSTS.includes(config.listen.host)) {
         ctx.addIssue({
             code: zod_1.z.ZodIssueCode.custom,
@@ -760,11 +989,18 @@ function getSandboxRuntimes(config) {
     return config.sandboxes.runtimes ?? config.runtimes.filter((runtime) => runtime === 'docker');
 }
 exports.getSandboxRuntimes = getSandboxRuntimes;
-// The accounts that read repositories: no caller uses them and no build file names them.
-function getSourceAccounts(config) {
-    return [...new Set(config.sources.flatMap((source) => (source.secret ? [source.secret.account] : [])))];
+// The accounts only the server reads secrets as: those that read the repositories of
+// `sources`, and the one of the client secret of `endpoints.login`. No caller uses them and
+// no build file names them.
+function getServerAccounts(config) {
+    return [
+        ...new Set([
+            ...config.sources.flatMap((source) => (source.secret ? [source.secret.account] : [])),
+            ...(config.endpoints?.login?.clientSecret ? [config.endpoints.login.clientSecret.account] : []),
+        ]),
+    ];
 }
-exports.getSourceAccounts = getSourceAccounts;
+exports.getServerAccounts = getServerAccounts;
 async function readServerConfig(environment, path) {
     if (!(await environment.file.exists(path))) {
         throw new Error(`unable to read ${path}: no such file`);