hammerkit 2.0.0-next.4 → 2.0.0-next.6

package/dist/remote/remote-work-commands.js

@@ -519,16 +519,25 @@ function registerWorkCommands(remote, context) {
         .command('tasks [server]')
         .description('show what the past runs of each task took, over the runs the server keeps: how often it ran, failed and came from the cache, the median and 90th percentile of its time, and how long its runs waited for a place')
         .addOption(new commander_1.Option('--mine', 'only your runs'))
+        .addOption(new commander_1.Option('--since <when>', 'only the runs created since then: back from now, such as 24h or 7d, or a time'))
+        .addOption(new commander_1.Option('--until <when>', 'only the runs created until then: back from now, or a time'))
         .addOption(new commander_1.Option('--json', 'print it as the server answers it'))
         .action(guarded('Remote tasks was not successful', async (name, options) => {
         const { name: serverName, server, token } = await connect(name);
-        const { tasks } = (await (0, server_client_1.callServer)(server, token, 'GET', `/v1/tasks?scope=${options.mine ? 'mine' : 'visible'}`)).body;
+        const query = new URLSearchParams({ scope: options.mine ? 'mine' : 'visible' });
+        if (options.since) {
+            query.set('since', options.since);
+        }
+        if (options.until) {
+            query.set('until', options.until);
+        }
+        const { tasks } = (await (0, server_client_1.callServer)(server, token, 'GET', `/v1/tasks?${query}`)).body;
         if (options.json) {
             environment.stdout.write(`${JSON.stringify(tasks, null, 2)}\n`);
             return;
         }
         if (tasks.length === 0) {
-            environment.stdout.write(`${serverName}: no task ran in the runs it keeps\n`);
+            environment.stdout.write(`${serverName}: no task ran in the runs it keeps${options.since || options.until ? ' of that period' : ''}\n`);
             return;
         }
         for (const line of (0, remote_status_1.describeTaskStats)(tasks)) {

package/dist/server/capacity.js

@@ -4,6 +4,9 @@ exports.formatMemory = exports.formatCpu = exports.HostCapacity = exports.Kubern
 const os_1 = require("os");
 const log_1 = require("../log");
 const apply_1 = require("../kubernetes/apply");
+const job_placement_1 = require("../kubernetes/job-placement");
+const volumes_1 = require("../kubernetes/volumes");
+const network_policy_1 = require("../kubernetes/network-policy");
 const UNITS = {
     n: 1e-9,
     u: 1e-6,
@@ -90,6 +93,17 @@ function why(what, e, rule) {
     }
     return `${what}: ${(0, log_1.getErrorMessage)(e)}`;
 }
+// `why`, in a few words
+function briefly(e, what) {
+    const code = (0, apply_1.statusCodeOf)(e);
+    if (code === 403) {
+        return what === 'nodes' ? 'may not list nodes' : 'may not read metrics';
+    }
+    if (code === 404 && what === 'metrics') {
+        return 'no metrics API';
+    }
+    return what === 'nodes' ? 'nodes not readable' : 'metrics not readable';
+}
 const ENDED = ['Succeeded', 'Failed'];
 // On Kubernetes: per namespace of the server, its pods' requests, its quota and its usage.
 class KubernetesCapacity {
@@ -107,6 +121,37 @@ class KubernetesCapacity {
         catch (e) {
             problems.push(why('the namespaces of the server', e));
         }
+        const unknown = {};
+        // the runs by the value of their label, and what the pods of each run or sandbox take
+        const byLabel = new Map(runs.map((run) => [(0, job_placement_1.getRunLabelValue)(run.id), run]));
+        const uses = new Map();
+        const useOf = (namespace, labels, owner) => {
+            const run = byLabel.get(labels?.[job_placement_1.RUN_LABEL] ?? '');
+            const sandbox = labels?.[volumes_1.SANDBOX_LABEL] ?? labels?.[network_policy_1.PROXY_OF_SANDBOX_LABEL];
+            const key = run ? `run ${run.id}` : sandbox ? `sandbox ${sandbox}` : `other ${namespace}`;
+            let use = uses.get(key);
+            if (!use) {
+                use = run
+                    ? {
+                        kind: 'run',
+                        run: run.id,
+                        tasks: run.tasks,
+                        ...(run.up ? { up: { name: run.up.name, services: run.up.services } } : {}),
+                        repo: run.source.type === 'upload' ? 'an upload' : run.source.repo,
+                        owner: { iss: run.owner.iss, sub: run.owner.sub, ...(run.owner.name ? { name: run.owner.name } : {}) },
+                        pods: 0,
+                        requested: { cpu: 0, memory: 0 },
+                    }
+                    : {
+                        kind: sandbox ? 'sandbox' : 'other',
+                        ...(owner ? { owner } : {}),
+                        pods: 0,
+                        requested: { cpu: 0, memory: 0 },
+                    };
+                uses.set(key, use);
+            }
+            return use;
+        };
         const said = new Set();
         const once = (text) => {
             if (!said.has(text)) {
@@ -123,6 +168,8 @@ class KubernetesCapacity {
                 // a namespace whose pods could be listed and that has none asks for nothing
                 requested: { cpu: 0, memory: 0 },
             };
+            // the use of each pod that runs, by its name
+            const usesOfPods = new Map();
             try {
                 const pods = await this.instance.coreApi.listNamespacedPod({ namespace });
                 for (const pod of pods.items) {
@@ -130,9 +177,13 @@ class KubernetesCapacity {
                         continue;
                     }
                     group.pods++;
+                    const use = useOf(namespace, pod.metadata?.labels, group.owner);
+                    usesOfPods.set(pod.metadata?.name ?? '', use);
+                    use.pods++;
                     for (const container of pod.spec?.containers ?? []) {
                         const requests = container.resources?.requests ?? {};
                         add(group.requested, parseQuantity(requests.cpu) ?? 0, parseQuantity(requests.memory) ?? 0);
+                        add(use.requested, parseQuantity(requests.cpu) ?? 0, parseQuantity(requests.memory) ?? 0);
                     }
                 }
             }
@@ -162,13 +213,19 @@ class KubernetesCapacity {
                     const metrics = await this.instance.metrics.getPodMetrics(namespace);
                     const used = { cpu: 0, memory: 0 };
                     for (const pod of metrics.items) {
+                        const use = usesOfPods.get(pod.metadata?.name ?? '');
                         for (const container of pod.containers) {
                             add(used, parseQuantity(container.usage.cpu), parseQuantity(container.usage.memory));
+                            if (use) {
+                                use.used ?? (use.used = { cpu: 0, memory: 0 });
+                                add(use.used, parseQuantity(container.usage.cpu), parseQuantity(container.usage.memory));
+                            }
                         }
                     }
                     group.used = used;
                 }
                 catch (e) {
+                    unknown.used ?? (unknown.used = briefly(e, 'metrics'));
                     once(why('what the pods use (metrics)', e, 'list on pods.metrics.k8s.io in them (runRole, see the backend docs)'));
                 }
             }
@@ -204,11 +261,13 @@ class KubernetesCapacity {
                     machines.used = nodesUsed;
                 }
                 catch (e) {
+                    unknown.used ?? (unknown.used = briefly(e, 'metrics'));
                     once(why('what the nodes use (metrics)', e, 'list on nodes.metrics.k8s.io (see the backend docs)'));
                 }
             }
         }
         catch (e) {
+            unknown.total = briefly(e, 'nodes');
             // listing nodes is optional, and many clusters do not let a workload do it
             if ((0, apply_1.statusCodeOf)(e) === 403) {
                 once('the nodes: not shown, the server may not list nodes (optional, see the backend docs)');
@@ -223,7 +282,11 @@ class KubernetesCapacity {
             ...(machines ? { machines } : {}),
             runs: total,
             groups,
+            uses: [...uses.values()].sort((a, b) => (b.used?.cpu ?? 0) - (a.used?.cpu ?? 0) ||
+                (b.requested.cpu ?? 0) - (a.requested.cpu ?? 0) ||
+                (b.requested.memory ?? 0) - (a.requested.memory ?? 0)),
             problems,
+            ...(Object.keys(unknown).length > 0 ? { unknown } : {}),
         };
     }
 }

package/dist/server/dashboard.js

@@ -5,12 +5,14 @@ const crypto_1 = require("crypto");
 const promises_1 = require("fs/promises");
 const path_1 = require("path");
 const http_1 = require("./http");
+const oauth_1 = require("./oauth");
 const policy_1 = require("./policy");
 const overview_1 = require("./overview");
 // Approving and publishing take a sign-in of the last minutes: the groups of a session are
 // those of its sign-in, and somebody taken out of a group must not decide for hours.
 exports.DECIDE_WITHIN_MS = 15 * 60000;
 const RUN = 'run_[A-Za-z0-9_-]{16}';
+const SANDBOX = 'sbx_[A-Za-z0-9_-]{16}';
 // a hash of a build file version, checked by the API
 const HASH = '[A-Za-z0-9:_-]{1,200}';
 const path = (pattern) => new RegExp(`^/v1/${pattern}$`);
@@ -28,9 +30,19 @@ const READS = [
     'proposals',
     `proposals/${HASH}`,
     `proposals/${HASH}/files`,
+    // the build files, and the page of the version a task or run ran
+    'definitions',
+    `definitions/${HASH}`,
+    `definitions/${HASH}/files`,
+    // the person's sandboxes and what changed in them; not their files, nothing that writes
+    'sandboxes',
+    `sandboxes/${SANDBOX}`,
+    `sandboxes/${SANDBOX}/changes`,
 ].map(path);
 // what the buttons do
-const ACTIONS = [`runs/${RUN}/(cancel|extend)`].map(path);
+const ACTIONS = [`runs/${RUN}/(cancel|extend|wake)`].map(path);
+// what the delete buttons remove: a sandbox of the person's
+const REMOVALS = [`sandboxes/${SANDBOX}`].map(path);
 // what needs a recent sign-in
 const DECISIONS = [`approvals/${RUN}/(approve|reject)`, `proposals/${HASH}/(approve|reject)`].map(path);
 exports.HEADERS = {
@@ -52,8 +64,8 @@ const TYPES = {
 };
 async function handleDashboard(context, principal, req, res, url) {
     const now = context.now ?? Date.now;
-    const grant = (0, policy_1.getGrant)(context.config.entitlements, principal);
-    const viewer = { principal, grant, activity: context.config.runs.activity === 'everyone' };
+    const viewer = (0, overview_1.getViewer)(context.config, principal);
+    const { grant } = viewer;
     const pathname = url.pathname;
     for (const [name, value] of Object.entries(exports.HEADERS)) {
         res.setHeader(name, value);
@@ -78,9 +90,11 @@ async function api(context, principal, viewer, now, req, res, url) {
         if (method !== 'GET') {
             return (0, http_1.send)(res, 405, { error: 'method not allowed' }, { allow: 'GET' });
         }
+        const name = (0, oauth_1.displayName)(principal);
         const session = {
             iss: principal.iss,
             sub: principal.sub,
+            ...(name ? { name } : {}),
             observe: grant.observe,
             seesOthers: grant.observe || (0, overview_1.seesActivity)(viewer),
             publishes: (0, policy_1.mayPublish)(grant),
@@ -103,15 +117,19 @@ async function api(context, principal, viewer, now, req, res, url) {
     const read = READS.some((pattern) => pattern.test(target));
     const action = ACTIONS.some((pattern) => pattern.test(target));
     const decision = DECISIONS.some((pattern) => pattern.test(target));
-    if (!read && !action && !decision) {
+    const removal = REMOVALS.some((pattern) => pattern.test(target));
+    if (!read && !action && !decision && !removal) {
         return (0, http_1.send)(res, 404, { error: 'not found' });
     }
+    const allow = [read ? 'GET' : '', action || decision ? 'POST' : '', removal ? 'DELETE' : '']
+        .filter(Boolean)
+        .join(', ');
     if (method === 'GET' || method === 'HEAD') {
         if (!read) {
-            return (0, http_1.send)(res, 405, { error: 'method not allowed' }, { allow: 'POST' });
+            return (0, http_1.send)(res, 405, { error: 'method not allowed' }, { allow });
         }
     }
-    else if (method === 'POST' && (action || decision)) {
+    else if ((method === 'POST' && (action || decision)) || (method === 'DELETE' && removal)) {
         // a page of another site can not set the header, nor read the token
         const given = Buffer.from(String(req.headers['x-hammerkit-csrf'] ?? ''));
         const expected = Buffer.from(csrf);
@@ -128,7 +146,7 @@ async function api(context, principal, viewer, now, req, res, url) {
         context.log(`dashboard ${method} ${target} iss=${principal.iss} sub=${principal.sub}`);
     }
     else {
-        return (0, http_1.send)(res, 405, { error: 'method not allowed' }, { allow: read ? 'GET' : 'POST' });
+        return (0, http_1.send)(res, 405, { error: 'method not allowed' }, { allow });
     }
     const forwarded = new URL(`${target}${url.search}`, 'http://localhost');
     return context.api(principal, req, res, forwarded);
@@ -165,8 +183,8 @@ async function asset(context, req, res, pathname) {
     const root = context.assets ?? (0, path_1.join)(__dirname, '..', 'dashboard');
     const file = /^\/assets\/[A-Za-z0-9_-][A-Za-z0-9._-]{0,200}$/.test(pathname)
         ? pathname.slice(1)
-        : pathname === '/favicon.svg'
-            ? 'favicon.svg'
+        : pathname === '/logo.png'
+            ? 'logo.png'
             : pathname.startsWith('/assets/') || pathname.startsWith('/.')
                 ? undefined
                 : 'index.html';

package/dist/server/endpoints.js

@@ -285,7 +285,15 @@ class EndpointGateway {
             return null;
         }
         const session = this.readSession(label, req.headers.cookie);
-        return session ? { iss: session.iss, sub: session.sub, groups: session.groups, claims: session.claims } : null;
+        return session
+            ? {
+                iss: session.iss,
+                sub: session.sub,
+                groups: session.groups,
+                claims: session.claims,
+                ...(session.name ? { name: session.name } : {}),
+            }
+            : null;
     }
     // Whether the browser sends the request for another page than the endpoint's own: an
     // upgrade from another origin, or a request a page of another site makes (a frame too),
@@ -652,6 +660,7 @@ ${run.state === 'up'
                     host: label,
                     iss: issued.principal.iss,
                     sub: issued.principal.sub,
+                    ...((0, oauth_1.displayName)(issued.principal) ? { name: (0, oauth_1.displayName)(issued.principal) } : {}),
                     groups: issued.principal.groups,
                     claims: this.matchedClaims(issued.principal),
                     exp,

package/dist/server/executor.js

@@ -220,6 +220,7 @@ class HostExecutor {
             let claim;
             // the files of the sandbox the tasks work on
             let work;
+            const sourceStarted = new Date();
             if (source.type === 'sandbox' && source.check) {
                 // a check works on the files a push of the sandbox commits, copied out of it: never
                 // on the sandbox, whose ignored files (node_modules, outputs) its owner writes
@@ -303,12 +304,17 @@ class HostExecutor {
                     sandboxNetwork: network,
                 };
             }
+            emitPhase(context, 'source', sourceStarted);
             const home = (0, path_1.join)(root, 'home');
             await (0, promises_1.mkdir)(home, { recursive: true });
             const cache = (0, path_1.join)(this.options.cache, cacheNamespace(run));
             await (0, promises_1.mkdir)(cache, { recursive: true });
             const placement = this.options.placement;
+            const namespaceStarted = new Date();
             const placed = placement ? await placement.prepare(run, context, { root: work ?? cwd, claim }) : undefined;
+            if (placed) {
+                emitPhase(context, 'namespace', namespaceStarted);
+            }
             try {
                 await this.runInProcess(worker, {
                     ...input,
@@ -504,4 +510,8 @@ class HostExecutor {
     }
 }
 exports.HostExecutor = HostExecutor;
+// A step of a run before its tasks, for its timeline (RunPhase)
+function emitPhase(context, phase, startedAt) {
+    context.emit({ type: 'phase', phase, startedAt: startedAt.toISOString(), finishedAt: new Date().toISOString() });
+}
 //# sourceMappingURL=executor.js.map

package/dist/server/oauth.js

@@ -1,7 +1,22 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TokenVerifier = exports.quote = exports.TokenError = void 0;
+exports.TokenVerifier = exports.quote = exports.TokenError = exports.displayName = void 0;
 const crypto_1 = require("crypto");
+/**
+ * How pages name a person: the `name` of their token, else `preferred_username`, else `email`
+ * (with the scopes `profile email`); none with `openid` alone, which carries the subject only.
+ */
+function displayName(principal) {
+    const claims = principal.claims ?? {};
+    for (const value of [principal.name, claims.name, claims.preferred_username, claims.email]) {
+        const trimmed = value?.trim();
+        if (trimmed) {
+            return trimmed.slice(0, 100);
+        }
+    }
+    return undefined;
+}
+exports.displayName = displayName;
 // The reason is for the operator's log, never for the caller.
 class TokenError extends Error {
 }

package/dist/server/overview.js

@@ -5,6 +5,7 @@ const policy_1 = require("./policy");
 const runs_1 = require("./runs");
 const service_runs_1 = require("./service-runs");
 const repo_1 = require("./repo");
+const units_1 = require("../utils/units");
 var wait_reason_1 = require("./wait-reason");
 Object.defineProperty(exports, "describeWait", { enumerable: true, get: function () { return wait_reason_1.describeWait; } });
 function getViewer(config, principal) {
@@ -12,6 +13,7 @@ function getViewer(config, principal) {
         principal,
         grant: (0, policy_1.getGrant)(config.entitlements, principal),
         activity: config.runs.activity === 'everyone',
+        nameOf: (owner) => (0, policy_1.subjectName)(config.entitlements, owner),
     };
 }
 exports.getViewer = getViewer;
@@ -21,9 +23,14 @@ function runActions(viewer, run) {
     }
     const mine = owns(viewer, run);
     const may = {
-        ...(mine || decides(viewer, run) ? { stop: true } : {}),
+        ...(mine || decides(viewer, run) || (run.up && (0, service_runs_1.mayPublishEndpoints)(viewer.grant, run))
+            ? { stop: true }
+            : {}),
         ...(run.up && run.upAt && (mine || (0, service_runs_1.mayOpenEndpoints)(viewer.grant, run)) ? { extend: true } : {}),
         ...(mayDecide(viewer, run) ? { decide: true } : {}),
+        ...(run.up && run.state === 'asleep' && (mine || (0, service_runs_1.mayOpenEndpoints)(viewer.grant, run))
+            ? { wake: true }
+            : {}),
     };
     return Object.keys(may).length > 0 ? may : undefined;
 }
@@ -85,7 +92,8 @@ function mayRead(viewer, run) {
     return owns(viewer, run) || viewer.grant.observe || decides(viewer, run);
 }
 exports.mayRead = mayRead;
-function toListedRun(viewer, run, queue) {
+// `entryOf` names where in its repository the build file of a version is.
+function toListedRun(viewer, run, queue, entryOf) {
     const { owner, results, plan, options, up, error, ...rest } = run;
     const mine = owns(viewer, run);
     const may = runActions(viewer, run);
@@ -100,9 +108,11 @@ function toListedRun(viewer, run, queue) {
             ...(result.cache ? { cached: result.cache.hit } : {}),
         },
     ]));
+    const entry = entryOf?.(run.definition);
+    const name = owner.name ?? viewer.nameOf?.(owner);
     return {
         ...rest,
-        ...(mine ? { plan, options } : { owner: { iss: owner.iss, sub: owner.sub } }),
+        ...(mine ? { plan, options } : { owner: { iss: owner.iss, sub: owner.sub, ...(name ? { name } : {}) } }),
         ...(up
             ? {
                 up: {
@@ -116,6 +126,7 @@ function toListedRun(viewer, run, queue) {
         ...(queue ? { queue } : {}),
         ...(may ? { may } : {}),
         ...(!mine && mayRead(viewer, run) ? { readable: true } : {}),
+        ...(entry ? { entry } : {}),
     };
 }
 exports.toListedRun = toListedRun;
@@ -141,7 +152,8 @@ function queuePlace(registry, viewer, run) {
     return { position: queue.position, waitsFor: visibleReason(queue.waitsFor, visible) };
 }
 exports.queuePlace = queuePlace;
-function getOverview(snapshot, usage, viewer) {
+function getOverview(snapshot, usage, viewer, entryOf) {
+    const list = (run, place) => toListedRun(viewer, run, place, entryOf);
     const runs = new Map();
     for (const run of [
         ...snapshot.running,
@@ -160,7 +172,7 @@ function getOverview(snapshot, usage, viewer) {
         return {
             ...place,
             mine: owns(viewer, entry.run),
-            ...(maySee(viewer, entry.run) ? { run: toListedRun(viewer, entry.run, place) } : {}),
+            ...(maySee(viewer, entry.run) ? { run: list(entry.run, place) } : {}),
         };
     });
     const running = snapshot.running.filter((run) => maySee(viewer, run));
@@ -170,19 +182,19 @@ function getOverview(snapshot, usage, viewer) {
         places: {
             max: snapshot.places.max,
             used: snapshot.places.used,
-            runs: running.map((run) => toListedRun(viewer, run)),
+            runs: running.map((run) => list(run)),
             others: snapshot.running.length - running.length,
         },
         queue,
         approvals: {
             waiting: snapshot.awaiting.runs.length,
             max: snapshot.awaiting.max,
-            runs: snapshot.awaiting.runs.filter((run) => maySee(viewer, run)).map((run) => toListedRun(viewer, run)),
+            runs: snapshot.awaiting.runs.filter((run) => maySee(viewer, run)).map((run) => list(run)),
         },
         services: {
             open: snapshot.services.taken,
             ...(snapshot.services.max !== undefined ? { max: snapshot.services.max } : {}),
-            runs: snapshot.services.runs.filter((run) => maySee(viewer, run)).map((run) => toListedRun(viewer, run)),
+            runs: snapshot.services.runs.filter((run) => maySee(viewer, run)).map((run) => list(run)),
         },
         limits: {
             waiting: meter(usage.waiting, limits?.waiting),
@@ -209,7 +221,7 @@ const STATES = [
     'rejected',
 ];
 // `scope`, `state` (a comma separated list) and `kind` of GET /v1/runs.
-function parseRunFilter(params, grant) {
+function parseRunFilter(params, grant, now = Date.now()) {
     const scope = params.get('scope') ?? 'mine';
     if (scope !== 'mine' && scope !== 'visible' && scope !== 'all') {
         throw new Error('scope: mine, visible or all');
@@ -234,9 +246,35 @@ function parseRunFilter(params, grant) {
     if (id !== undefined && !/^run_[A-Za-z0-9_-]{16}$/.test(id)) {
         throw new Error('id: the id of a run, run_...');
     }
-    return { scope, ...(states ? { states } : {}), ...(kind ? { kind } : {}), ...(id ? { id } : {}) };
+    const since = parseMoment(params.get('since'), now, 'since');
+    const until = parseMoment(params.get('until'), now, 'until');
+    if (since !== undefined && until !== undefined && until < since) {
+        throw new Error('until: after since');
+    }
+    return {
+        scope,
+        ...(states ? { states } : {}),
+        ...(kind ? { kind } : {}),
+        ...(id ? { id } : {}),
+        ...(since !== undefined ? { since } : {}),
+        ...(until !== undefined ? { until } : {}),
+    };
 }
 exports.parseRunFilter = parseRunFilter;
+// `7d` back from now, or a time such as `2026-11-01T08:00:00Z`, in ms
+function parseMoment(value, now, name) {
+    if (value === null) {
+        return undefined;
+    }
+    if (/^(\d+(\.\d+)?(ms|s|m|h|d))+$/.test(value)) {
+        return now - (0, units_1.parseDuration)(value);
+    }
+    const at = /^\d{4}-\d{2}-\d{2}/.test(value) ? Date.parse(value) : NaN;
+    if (!Number.isFinite(at)) {
+        throw new Error(`${name}: a duration back from now, such as 1h, 24h or 7d, or a time, such as 2026-11-01T08:00:00Z`);
+    }
+    return at;
+}
 class FilterRefused extends Error {
 }
 exports.FilterRefused = FilterRefused;
@@ -244,7 +282,9 @@ function filterRuns(runs, viewer, filter) {
     return runs.filter((run) => (filter.scope === 'mine' ? owns(viewer, run) : maySee(viewer, run)) &&
         (!filter.id || run.id === filter.id) &&
         (!filter.states || filter.states.includes(run.state)) &&
-        (!filter.kind || (filter.kind === 'services') === !!run.up));
+        (!filter.kind || (filter.kind === 'services') === !!run.up) &&
+        (filter.since === undefined || Date.parse(run.createdAt) >= filter.since) &&
+        (filter.until === undefined || Date.parse(run.createdAt) <= filter.until));
 }
 exports.filterRuns = filterRuns;
 // The machines and what the runs take, with whose the namespaces are where the caller may
@@ -255,6 +295,35 @@ function visibleCapacity(capacity, viewer) {
         ...capacity,
         // what the cluster answered is for operators; others learn that something is missing
         problems: viewer.grant.observe || capacity.problems.length === 0 ? capacity.problems : ['some of it could not be read'],
+        ...(capacity.unknown
+            ? {
+                unknown: everyone
+                    ? capacity.unknown
+                    : {
+                        ...(capacity.unknown.total ? { total: 'not readable' } : {}),
+                        ...(capacity.unknown.used ? { used: 'not readable' } : {}),
+                    },
+            }
+            : {}),
+        // what others' runs and sandboxes take shows, not what they are
+        ...(capacity.uses
+            ? {
+                uses: capacity.uses.map((use) => {
+                    const mine = use.owner?.iss === viewer.principal.iss && use.owner?.sub === viewer.principal.sub;
+                    const name = use.owner && !use.owner.name ? viewer.nameOf?.(use.owner) : undefined;
+                    return everyone || mine || !use.owner
+                        ? name && use.owner
+                            ? { ...use, owner: { ...use.owner, name } }
+                            : use
+                        : {
+                            kind: use.kind,
+                            pods: use.pods,
+                            requested: use.requested,
+                            ...(use.used ? { used: use.used } : {}),
+                        };
+                }),
+            }
+            : {}),
         groups: capacity.groups.map((group) => {
             const mine = group.owner?.iss === viewer.principal.iss && group.owner?.sub === viewer.principal.sub;
             if (everyone || mine || !group.owner) {

package/dist/server/plan.js

@@ -294,6 +294,13 @@ function describeMountSource(mount) {
     const home = (0, normalize_path_1.getHomeReference)(mount.mount.split(':')[0]);
     return home ? `${mount.localPath} (${home} is the home directory)` : mount.localPath;
 }
+// where the build file of an item is: in the bundle, or in the repository of a git include
+function declaredIn(root, scope) {
+    if (scope.remote) {
+        return `${scope.remote.git} ${(0, path_1.relative)(scope.remote.root, scope.fileName).split(path_1.sep).join('/')}`;
+    }
+    return (0, path_1.relative)(root, scope.fileName).split(path_1.sep).join('/');
+}
 function toPlan(root, item) {
     const data = item.data;
     const secrets = secretsOf(item).map(describeSecret);
@@ -322,6 +329,7 @@ function toPlan(root, item) {
     const isTask = data.type === 'local-task' || data.type === 'container-task';
     return {
         kind: isTask ? 'task' : 'service',
+        file: declaredIn(root, data.scope),
         ...(data.description ? { description: data.description } : {}),
         runtime: (0, work_task_1.isAggregateTask)(data) ? 'none' : data.type === 'local-task' ? 'local' : 'docker',
         ...((0, work_task_1.isContainerWorkTask)(data) || (0, work_service_1.isContainerWorkService)(data) ? { image: data.image } : {}),
@@ -330,13 +338,18 @@ function toPlan(root, item) {
         network: (0, work_network_1.toNetworkSchema)('network' in data ? data.network : { type: 'open' }),
         ...('args' in data && data.args !== null ? { args: data.args } : {}),
         deps: item.deps.map((dep) => dep.name).sort(),
-        needs: item.needs.map((need) => need.name).sort(),
+        // by their names in the plan, not the names the task reaches them at (`postgres` of an include)
+        needs: item.needs.map((need) => need.service.name).sort(),
         accounts,
         secrets,
         serverEnvs: 'envs' in data ? data.envs.processNames ?? [] : [],
         mounts,
         ports,
-        generates: 'generates' in data ? data.generates.map((generate) => generate.path) : [],
+        // where in the bundle, as the build file names them: the directory the server read it in is
+        // its own
+        generates: 'generates' in data
+            ? data.generates.map((generate) => insideBundle(root, data.cwd, generate.path)[0] ?? generate.path)
+            : [],
         ...(capAdd.length > 0 ? { capAdd: [...capAdd] } : {}),
         flags,
     };
@@ -400,7 +413,7 @@ async function planBundle(bundle, environment, options = {}) {
                         ? item.data.mounts.flatMap((mount) => insideBundle(directory, item.data.cwd, mount.localPath))
                         : [],
                     deps: item.deps.map((dep) => dep.name).sort(),
-                    needs: item.needs.map((need) => need.name).sort(),
+                    needs: item.needs.map((need) => need.service.name).sort(),
                 };
             }
             const plan = {};

package/dist/server/policy.js

@@ -1,8 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.decideRun = exports.sandboxRepos = exports.decideSandbox = exports.sandboxPushBranches = exports.sandboxBranchType = exports.endpointLevel = exports.getGrant = exports.usedAccounts = exports.mayYank = exports.canUse = exports.maySeeDefinitions = exports.mayPublish = exports.mayPropose = exports.mayReadChecks = exports.mayRun = exports.matches = void 0;
+exports.decideRun = exports.sandboxRepos = exports.decideSandbox = exports.sandboxPushBranches = exports.sandboxBranchType = exports.endpointLevel = exports.getGrant = exports.usedAccounts = exports.mayYank = exports.canUse = exports.maySeeDefinitions = exports.mayPublish = exports.mayPropose = exports.mayReadChecks = exports.mayRun = exports.matches = exports.subjectName = void 0;
 const repo_1 = require("./repo");
 const BUILDS_ORDER = ['run', 'propose', 'publish'];
+// The name an entitlement gives a subject, for the pages to name its runs by when its tokens
+// name nobody.
+function subjectName(entitlements, who) {
+    return entitlements.find((entitlement) => entitlement.subject?.name && entitlement.subject.iss === who.iss && entitlement.subject.sub === who.sub)?.subject?.name;
+}
+exports.subjectName = subjectName;
 function matches(entitlement, principal) {
     if (entitlement.subject) {
         return entitlement.subject.iss === principal.iss && entitlement.subject.sub === principal.sub;
@@ -34,9 +40,9 @@ const mayPublish = (grant) => atLeast(grant, 'publish');
 exports.mayPublish = mayPublish;
 // A caller who can neither run nor publish anything sees nothing of the server's
 // build files either. Someone who uses an account sees them: they have to know what
-// they approve.
+// they approve. Who observes sees them too, as they see what every run ran.
 function maySeeDefinitions(grant) {
-    return grant.builds !== null || Object.keys(grant.accounts).length > 0;
+    return grant.builds !== null || Object.keys(grant.accounts).length > 0 || grant.observe;
 }
 exports.maySeeDefinitions = maySeeDefinitions;
 // `use` includes deciding about the runs others request on the account.