redkite 0.1.8 → 0.1.10

package/src/cli/viewer.ts

@@ -79,8 +79,13 @@ export function createViewer(
   input.resume();
   input.setEncoding("utf8");
 
+  const plan = (points: string[]) => change((current) => ({ ...current, planned: points }));
+
   const say = (message: string) =>
-    change((current) => ({ ...current, messages: [...current.messages, message] }));
+    change((current) => ({
+      ...current,
+      messages: [...current.messages, { text: message, at: Date.now() }],
+    }));
 
   const onKey = (data: string) => {
     for (const key of keysOf(data)) {
@@ -159,16 +164,23 @@ export function createViewer(
         expanded: item.held,
       }));
 
+    // Both mark the step as having spoken, which is what tells a working step
+    // from a wedged one on the row itself
     return {
-      detail: (message) => edit((item) => ({ ...item, detail: message })),
+      detail: (message) => edit((item) => ({ ...item, detail: message, spoke: Date.now() })),
       line: (message) =>
-        edit((item) => ({ ...item, lines: [...item.lines, message].slice(-KEPT) })),
+        edit((item) => ({
+          ...item,
+          spoke: Date.now(),
+          lines: [...item.lines, message].slice(-KEPT),
+        })),
       done: (message) => settle("done", message),
       fail: (message) => settle("failed", message),
     };
   };
 
   return Object.assign(say, {
+    plan,
     warn: say,
     fail: say,
     done: say,
@@ -188,5 +200,30 @@ function summary(model: Model): string[] {
     return `${glyph} ${step.label}${said} (${took})`;
   });
 
-  return [...rows, ...model.messages];
+  return [
+    ...rows,
+    ...model.messages.map((message) => message.text),
+    ...whatFailed(model),
+  ];
+}
+
+// The end of what the step that failed was saying. The reason a build stopped
+// is in its own output, and the alternate screen takes every frame with it
+const TAIL = 20;
+
+function whatFailed(model: Model) {
+  const rows: string[] = [];
+
+  for (const step of model.steps.filter((item) => item.state === "failed")) {
+    if (step.lines.length === 0) continue;
+
+    const kept = step.lines.slice(-TAIL);
+    const dropped = step.lines.length - kept.length;
+
+    rows.push("", `${step.label} said:`);
+    if (dropped > 0) rows.push(`  ... ${dropped} earlier lines`);
+    rows.push(...kept.map((line) => `  ${line}`));
+  }
+
+  return rows;
 }

package/src/config.ts

@@ -1,3 +1,4 @@
+import { PROXY } from "./services/proxy.js";
 import { assertSteps } from "./pipeline.js";
 import { pluginSteps } from "./plugin.js";
 import type { Deployment, Environment } from "./types.js";
@@ -65,6 +66,14 @@ function assertOneSource(config: Deployment) {
       throw new Error(`${app.name} says what to include, but is cloned rather than built from a path`);
     }
 
+    const refs = ["branch", "tag", "commit"].filter((kind) => app[kind as "branch"]);
+
+    if (refs.length > 1) {
+      throw new Error(
+        `${app.name} names ${refs.join(" and ")} to build from, and they are different commits`,
+      );
+    }
+
     if (app.include?.length === 0) {
       throw new Error(`${app.name} includes nothing, so there would be no build context`);
     }
@@ -92,6 +101,16 @@ function assertUniqueNames(config: Deployment) {
   const names = [...config.apps, ...config.services].map((item) => item.name);
   const duplicate = names.find((name, i) => names.indexOf(name) !== i);
   if (duplicate) throw new Error(`Duplicate name in deployment: ${duplicate}`);
+
+  // The proxy is derived rather than listed, and it already has this name. A
+  // service claiming it is a second container on the first one's name, which
+  // nothing downstream can tell apart
+  if (!names.includes(PROXY)) return;
+
+  throw new Error(
+    `${PROXY} is the derived proxy, so a service cannot be called that. ` +
+      "What it runs and what goes in its server block is proxy: nginx({ … })",
+  );
 }
 
 // Two apps on the same route means one of them is unreachable, and which one

package/src/deploy.ts

@@ -349,14 +349,26 @@ async function buildAll(
       const task = log.step(`Building ${app.name}`);
 
       try {
+        // Said before the reads rather than after them. Every ref is a call to
+        // the vault, and a step that has not spoken yet looks like one that is
+        // not doing anything
+        task.detail("reading its environment");
+        const env = await readEnv(app.secrets, context.secrets);
+
+        task.detail("reading the files it ships with");
+        const files = await resolveFiles(app, context.secrets);
+
         const buildContext: BuildContext = {
           host: here ?? context.host,
           docker: here ? new Docker(here) : context.docker,
           deliver: here && { host: context.host, docker: context.docker },
-          env: await readEnv(app.secrets, context.secrets),
-          files: await resolveFiles(app, context.secrets),
+          env,
+          files,
           branch: environment.branch,
           environment: context.environment,
+          // Forwarded to the deploy host by the connection, so what this
+          // process holds is what the build there can reach
+          agent: Boolean(process.env["SSH_AUTH_SOCK"]),
           detail: task.detail,
           output: task.line,
         };

package/src/docker.ts

@@ -15,6 +15,8 @@ export type BuildInvocation = {
   tags: string[];
   // Secret id to a path on the host holding its contents
   secrets?: Record<string, string>;
+  // Forwards the agent this shell holds into the build
+  ssh?: boolean;
   // Stops at the builder stage, for the image a step before the swap runs in
   target?: string;
 };
@@ -174,6 +176,9 @@ class DockerImage {
       ...Object.entries(spec.secrets ?? {}).map(
         ([id, path]) => `--secret id=${id},src=${path}`,
       ),
+      // Forwards this shell's agent into the build, which is how a dependency
+      // fetched over ssh is authenticated
+      ...(spec.ssh ? ["--ssh default"] : []),
       ...(spec.target ? [`--target ${spec.target}`] : []),
       spec.context,
     ].join(" ");

package/src/dockerfile.ts

@@ -1,3 +1,5 @@
+import { dirname } from "node:path";
+
 import { appRoot, destinationFor, mountFor, rootedAt } from "./layout.js";
 import type { BuildSpec, CarryPath } from "./types.js";
 
@@ -20,6 +22,10 @@ export type DockerfileContext = {
   envSecret: string;
   // Container path to secret id, for credentials that have to be files
   fileSecrets: Record<string, string>;
+  // Whether an agent is there to forward. A dependency fetched over ssh during
+  // the install needs one, and asking for a mount nothing is behind fails the
+  // build outright
+  agent?: boolean;
   // Where the app sits in the repository, when it is not the repository. The
   // build steps and the shipped command run there, and every /app path the
   // spec names is read against it
@@ -73,7 +79,18 @@ function builderStage(spec: BuildSpec, context: DockerfileContext) {
   lines.push(`ENV NODE_ENV=${context.environment}`);
   lines.push("ENV NEXT_TELEMETRY_DISABLED=1");
 
-  if (spec.dependencies) lines.push(...dependencyLayer(spec, mounts));
+  // accept-new rather than no, the same as the checkout on the host. Without a
+  // known_hosts of its own a build has nothing to compare against, and a first
+  // sight it refuses is a dependency it cannot fetch
+  if (context.agent) {
+    lines.push(`ENV GIT_SSH_COMMAND="ssh -o StrictHostKeyChecking=accept-new"`);
+  }
+
+  // The agent reaches the install and the steps, which is where a manifest's
+  // git dependencies are resolved
+  const agent = context.agent ? "--mount=type=ssh " : "";
+
+  if (spec.dependencies) lines.push(...dependencyLayer(spec, `${agent}${mounts}`));
 
   // Submodules are already in the context: the checkout on the host resolved
   // them, so nothing in the build needs an agent or a .git directory
@@ -93,7 +110,7 @@ function builderStage(spec: BuildSpec, context: DockerfileContext) {
   // written exactly as it would be typed. Quoting it made the whole command one
   // word, and the shell went looking for a program by that name
   for (const step of spec.steps) {
-    lines.push(`RUN ${env}${mounts}${step}`);
+    lines.push(`RUN ${env}${agent}${mounts}${step}`);
   }
 
   return lines;
@@ -134,9 +151,12 @@ function runtimeStage(spec: BuildSpec, context: DockerfileContext) {
     lines.push(optional ? copyOrSkip(from, to, BUILDER_STAGE) : copy(from, to, BUILDER_STAGE));
   }
 
+  // The directory first: cp does not make one, and a credential belongs
+  // somewhere of its own more often than beside the code
   for (const [path, secret] of Object.entries(context.fileSecrets)) {
     lines.push(
-      `RUN --mount=type=secret,id=${secret} cp /run/secrets/${secret} ${path}`,
+      `RUN --mount=type=secret,id=${secret} mkdir -p ${dirname(path)} && ` +
+        `cp /run/secrets/${secret} ${path}`,
     );
   }
 

package/src/environment.ts

@@ -14,7 +14,7 @@ export async function envFileFor(app: AppSpec, context: Context) {
   if (!app.secrets) return undefined;
 
   const contents = await readEnv(app.secrets, context.secrets);
-  return await context.host.write(`apps/${app.name}/env`, contents);
+  return await context.host.write(`apps/${app.name}/env`, dockerEnv(contents));
 }
 
 // The flag, or nothing at all for an app that names no secrets
@@ -22,3 +22,73 @@ export async function envFlags(app: AppSpec, context: Context) {
   const path = await envFileFor(app, context);
   return path ? [`--env-file ${path}`] : [];
 }
+
+// A vault holds dotenv, and docker's env file is not dotenv: a quote is part of
+// the value there, so DATABASE_URL="postgres://..." reaches the process with the
+// quote still on it and every url parser rejects the scheme
+export function dockerEnv(contents: string) {
+  const lines = Object.entries(parseEnv(contents)).map(([key, value]) => {
+    // The format is one variable per line, so there is no spelling of this that
+    // docker would read back. Better to name the variable than to truncate it
+    if (value.includes("\n")) {
+      throw new Error(
+        `${key} spans more than one line, which a docker env file cannot carry. ` +
+          "Pass it as a file secret instead",
+      );
+    }
+
+    return `${key}=${value}`;
+  });
+
+  return lines.length > 0 ? `${lines.join("\n")}\n` : "";
+}
+
+// Enough of the format to carry a credential: KEY=value, quotes stripped,
+// blank lines and comments skipped. A quoted value may run past the end of its
+// line, because a key or a certificate is written the way it was generated
+export function parseEnv(contents: string) {
+  const values: Record<string, string> = {};
+  const lines = contents.split("\n");
+
+  for (let at = 0; at < lines.length; at += 1) {
+    const text = (lines[at] ?? "").trim();
+    if (!text || text.startsWith("#")) continue;
+
+    const split = text.indexOf("=");
+    if (split < 1) continue;
+
+    const key = text.slice(0, split).replace(/^export\s+/, "").trim();
+    const start = text.slice(split + 1).trim();
+    const edge = start[0];
+
+    if (edge !== '"' && edge !== "'") {
+      values[key] = start;
+      continue;
+    }
+
+    if (start.length > 1 && start.endsWith(edge)) {
+      values[key] = start.slice(1, -1);
+      continue;
+    }
+
+    // The quote never closed on its own line. Take whole lines until one closes
+    // it, so a pem arrives whole rather than as its first line
+    const held = [start.slice(1)];
+
+    while (at + 1 < lines.length) {
+      at += 1;
+      const next = (lines[at] ?? "").trimEnd();
+
+      if (next.endsWith(edge)) {
+        held.push(next.slice(0, -1));
+        break;
+      }
+
+      held.push(next);
+    }
+
+    values[key] = held.join("\n");
+  }
+
+  return values;
+}

package/src/index.ts

@@ -9,18 +9,19 @@ export * from "./host.js";
 export * from "./layout.js";
 export * from "./localHost.js";
 export * from "./log.js";
-export * from "./nginx.js";
 export * from "./pipeline.js";
 export * from "./plugin.js";
 export * from "./plugins/index.js";
 export * from "./recover.js";
 export * from "./presets/index.js";
+export * from "./secrets/manager.js";
 export * from "./secrets/refs.js";
 export * from "./secrets/store.js";
 export * from "./shell.js";
 export * from "./services/ensure.js";
 export * from "./services/index.js";
 export * from "./services/planned.js";
+export * from "./services/proxy.js";
 export * from "./source.js";
 export * from "./sshHost.js";
 export * from "./steps.js";

package/src/log.ts

@@ -14,6 +14,9 @@ export type Task = {
 };
 
 export type Log = ((message: string) => void) & {
+  // Every point the run will walk, said once before the first of them starts.
+  // A view that knows the whole list can show what has not begun
+  plan?(points: string[]): void;
   // Something the run survived, but that the person should know happened
   warn(message: string): void;
   // The reason a deploy is about to stop, or did
@@ -31,6 +34,7 @@ const NOTHING: Task = {
 };
 
 export const silent: Log = Object.assign(() => {}, {
+  plan: () => {},
   warn: () => {},
   fail: () => {},
   done: () => {},

package/src/pipeline.ts

@@ -207,6 +207,10 @@ export async function runPipeline(
   const ordered = sequence(steps, RUNS[run]);
   const plan: Plan = { config: setting.config, environment: setting.environment };
 
+  // What the run will walk, said before any of it does. Nothing depends on it
+  // being heard: a log without a view has nothing to do with the list
+  setting.log.plan?.(ordered.map((step) => step.point));
+
   // Every check before any step, so a run that is going to fail on a config
   // mistake fails before it has created a network or built an image. Nothing
   // wraps what a check throws: it is about the config, and the config is what

package/src/plugins/bitwarden.ts

@@ -1,26 +1,34 @@
 import { definePlugin, type OpenContext, type Plugin } from "../plugin.js";
+import { secretsManagerStore } from "../secrets/manager.js";
 import { bitwardenStore } from "../secrets/store.js";
 import type { SecretRef } from "../types.js";
 
 // Redkite's own vault, and a plugin like any other: a deployment that does not
 // register it cannot resolve a bitwarden ref, and says so before it builds.
+//
+// Bitwarden is two services rather than one. Secrets Manager holds secrets for
+// machines and opens with an access token, which is what a deploy wants. The
+// password manager holds a person's vault and wants a session obtained by
+// unlocking it. The ids are different, the CLIs are different, and giving one
+// service's credential to the other is how a deploy ends up waiting on a
+// password prompt nobody can see.
 
-// The one variable a vault needs when the session was obtained elsewhere. A CI
-// job that unlocked once and reuses it across several deploys is the case
+// The one variable either side reads, so a job sets one thing whichever it is
 const KEY = "BW_KEY";
 
 export type BitwardenOptions = {
-  // Whether this vault answers secret refs, and what unlocks it. true reads
-  // BW_KEY, and falls back to the api credentials when that is not set. A
-  // string is the session itself, for a config that names its own variable.
-  // false registers the plugin without a store, for a deployment that has
-  // stopped reading from it but has not yet taken the refs out
+  // Which Bitwarden this deployment reads, and what opens it.
+  //
+  // true, the default, is Secrets Manager: BW_KEY is the access token. A
+  // string is that token given directly, for a config naming its own variable.
+  //
+  // false is the password manager: BW_KEY is a session from bw unlock --raw,
+  // and without one the api credentials obtain one.
   secrets?: boolean | string;
 };
 
 function vault(options: BitwardenOptions = {}): Plugin {
   const secrets = options.secrets ?? true;
-  if (secrets === false) return definePlugin({ name: "bitwarden" });
 
   return definePlugin({
     name: "bitwarden",
@@ -28,8 +36,26 @@ function vault(options: BitwardenOptions = {}): Plugin {
   });
 }
 
-async function open(secrets: true | string, context: OpenContext) {
-  const session = typeof secrets === "string" ? secrets : process.env[KEY];
+async function open(secrets: boolean | string, context: OpenContext) {
+  if (secrets === false) return await passwords(context);
+
+  const token = typeof secrets === "string" ? secrets : process.env[KEY];
+
+  if (!token) {
+    throw new Error(
+      `${KEY} is not set, and this deployment reads from Bitwarden Secrets ` +
+        "Manager. It is an access token, not a password. A deployment reading " +
+        "the password manager instead says bitwarden({ secrets: false })",
+    );
+  }
+
+  return await secretsManagerStore({ token, detail: context.detail });
+}
+
+// The personal vault. A session skips the login and the unlock, which is two
+// fewer round trips and the only way a job without a master password gets in
+async function passwords(context: OpenContext) {
+  const session = process.env[KEY];
   if (session) return await bitwardenStore({ session, detail: context.detail });
 
   return await bitwardenStore({
@@ -45,7 +71,8 @@ function required(name: string) {
   if (value) return value;
 
   throw new Error(
-    `Neither ${KEY} nor ${name} is set, and this deployment reads its environment from Bitwarden`,
+    `Neither ${KEY} nor ${name} is set, and this deployment reads its ` +
+      "environment from the Bitwarden password manager",
   );
 }
 

package/src/presets/nextApp.ts

@@ -57,10 +57,11 @@ export function nextApp(options: NextAppOptions = {}): BuildSpec {
       // whatever the repository put there, and plenty of apps have none
       carry: ["/app/.next/static", { path: "/app/public", optional: true }],
       entrypoint: start("node server.js"),
-      // app-modules is what makes the build fast: node_modules on a mount
-      // rather than in a layer, which the standalone tree makes safe by
-      // carrying its own copy of everything the server reaches
-      caches: ["yarn", "npm", "modules", "app-modules", "next-app"],
+      // next-app is Next's own build cache, which only ever makes a build
+      // slower when it is dropped. node_modules is not here for the same
+      // reason it is not in nodeApp: a dropped mount and a kept layer is a
+      // build that cannot find what the manifest lists
+      caches: ["yarn", "npm", "next-app"],
     }),
     preset: "nextApp",
     // The standalone tree traces from the workspace root, so an app in a

package/src/presets/nodeApp.ts

@@ -31,13 +31,22 @@ export function nodeApp(options: NodeAppOptions): BuildSpec {
     output: options.output,
     carry: options.carry ?? [],
     entrypoint: options.entrypoint,
-    // Not the app's own node_modules: a step after the build runs in this image
-    // without the mounts, and a migration that cannot find prisma is what a
-    // cache mount instead of a layer looks like from the outside
-    caches: options.caches ?? ["yarn", "npm", "modules"],
+    // The package manager's own cache, and nothing else. node_modules used to
+    // be a mount too, and BuildKit drops a cache mount whenever it likes while
+    // keeping the layer that filled it: the install then does not re-run and
+    // the modules are simply gone. What that looks like is a build saying it
+    // cannot find a dependency the manifest plainly lists.
+    //
+    // Installed into the layer instead, they are there for every step below,
+    // for a migration run in this image afterwards, and for a check. The
+    // manager's cache still makes the install itself fast
+    caches: options.caches ?? ["yarn", "npm"],
     submodules: options.submodules ?? false,
-    // The checkout arrives complete, so this is what a build step itself needs
-    aptPackages: ["git"],
+    // The checkout arrives complete, so this is what a build step itself needs.
+    // openssh-client is for the dependencies it resolves rather than the
+    // repository: a git+ssh entry in a manifest is fetched during the install,
+    // and git cannot do that without an ssh to run
+    aptPackages: ["git", "openssh-client"],
     runtimePackages: ["curl"],
     runtimeSteps: [],
   };

package/src/secrets/manager.ts

@@ -0,0 +1,172 @@
+import { spawn } from "node:child_process";
+import { chmodSync, existsSync } from "node:fs";
+import { mkdir, rm, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+import type { SecretStore } from "./refs.js";
+
+// Bitwarden Secrets Manager, which is not the password manager: different
+// service, different CLI, different credential. An access token opens a set of
+// projects rather than a personal vault, which is what a deploy wants, and it
+// is the whole of the authentication: nothing to log in to and nothing to
+// unlock, so there is no session to obtain or lose.
+
+// Not an npm package. The password manager's CLI is one and redkite installs
+// it with npm; this one is a released binary, and the only thing on npm under
+// its name belongs to somebody else entirely. Pinned for the same reason the
+// other is: an unpinned CLI is a different program on a machine that has never
+// run a deploy before
+const VERSION = "2.1.0";
+const RELEASES = "https://github.com/bitwarden/sdk-sm/releases/download";
+const CLIS = join(homedir(), ".cache", "redkite", "cli");
+
+// What the release calls each platform. Anything not here has to bring its own
+const TARGETS: Record<string, string> = {
+  "linux-x64": "x86_64-unknown-linux-gnu",
+  "linux-arm64": "aarch64-unknown-linux-gnu",
+  "darwin-x64": "x86_64-apple-darwin",
+  "darwin-arm64": "aarch64-apple-darwin",
+  "win32-x64": "x86_64-pc-windows-msvc",
+  "win32-arm64": "aarch64-pc-windows-msvc",
+};
+
+export type ManagerCredentials = {
+  // The access token, which is the only credential this service has
+  token: string;
+  detail?: (message: string) => void;
+  // Injected so the argv this builds is asserted on rather than trusted
+  bws?: Bws;
+};
+
+export type Bws = (args: string[], env: Record<string, string>) => Promise<string>;
+
+export async function secretsManagerStore(
+  credentials: ManagerCredentials,
+): Promise<SecretStore> {
+  const detail = credentials.detail ?? (() => {});
+  const bws = credentials.bws ?? (await resolve(detail));
+
+  // Fetched once each. A second read of the same item during a deploy is the
+  // same answer, and this avoids a process per call site
+  const cache = new Map<string, Promise<string>>();
+
+  const fetch = async (id: string) => {
+    detail(`reading ${id.slice(0, 8)}`);
+
+    const answer = await bws(["secret", "get", id, "--output", "json"], {
+      BWS_ACCESS_TOKEN: credentials.token,
+    }).catch((error: unknown) => {
+      throw new Error(`Could not read ${id} from Bitwarden Secrets Manager: ${messageOf(error)}`);
+    });
+
+    return valueOf(answer, id);
+  };
+
+  return {
+    read: async (id) => {
+      const pending = cache.get(id) ?? fetch(id);
+      cache.set(id, pending);
+      return await pending;
+    },
+  };
+}
+
+// The secret's value, which is the whole of what a ref points at. Everything
+// else the call answers with is about the item rather than in it
+function valueOf(answer: string, id: string) {
+  try {
+    const parsed = JSON.parse(answer) as { value?: unknown };
+    if (typeof parsed.value === "string") return parsed.value;
+  } catch {
+    // Falls through to the same refusal as a shape without a value
+  }
+
+  throw new Error(`Bitwarden Secrets Manager answered for ${id} without a value`);
+}
+
+async function resolve(detail: (message: string) => void): Promise<Bws> {
+  const file = await binary(detail);
+  return async (args, env) => await run(file, args, env);
+}
+
+async function binary(detail: (message: string) => void) {
+  const override = process.env["REDKITE_BWS_BIN"];
+  if (override) return override;
+
+  const onPath = await run("bws", ["--version"], {}).then(
+    () => true,
+    () => false,
+  );
+
+  if (onPath) return "bws";
+
+  const directory = join(CLIS, `bws-${VERSION}`);
+  const installed = join(directory, process.platform === "win32" ? "bws.exe" : "bws");
+  if (existsSync(installed)) return installed;
+
+  return await install(directory, installed, detail);
+}
+
+// Downloaded once per machine per pinned version, the way the other CLI is
+// installed once. The archive is a zip with one file in it, and unzip is the
+// one thing on every platform that reads one
+async function install(directory: string, installed: string, detail: (m: string) => void) {
+  const target = TARGETS[`${process.platform}-${process.arch}`];
+
+  if (!target) {
+    throw new Error(
+      `Bitwarden publishes no bws for ${process.platform}-${process.arch}. ` +
+        "Install it yourself and point REDKITE_BWS_BIN at it",
+    );
+  }
+
+  const url = `${RELEASES}/bws-v${VERSION}/bws-${target}-${VERSION}.zip`;
+  detail(`installing bws ${VERSION}, once for this machine`);
+
+  await mkdir(directory, { recursive: true });
+  const archive = join(directory, "bws.zip");
+
+  const answer = await globalThis.fetch(url);
+  if (!answer.ok) throw new Error(`Could not download bws from ${url}: ${answer.status}`);
+
+  await writeFile(archive, Buffer.from(await answer.arrayBuffer()));
+  await run("unzip", ["-o", "-q", archive, "-d", directory], {}).catch((error: unknown) => {
+    throw new Error(`Could not unpack bws: ${messageOf(error)}`);
+  });
+
+  await rm(archive, { force: true });
+
+  // The zip carries no mode anything trusts, so it arrives unrunnable
+  chmodSync(installed, 0o755);
+
+  return installed;
+}
+
+// Nothing on stdin, and the output kept exactly as it came. The same reasoning
+// as the password manager's runner: a question nobody can answer is a deploy
+// that waits for ever
+function run(file: string, args: string[], env: Record<string, string>) {
+  return new Promise<string>((resolve_, reject) => {
+    const child = spawn(file, args, {
+      stdio: ["ignore", "pipe", "pipe"],
+      env: { ...process.env, ...env },
+    });
+
+    let stdout = "";
+    let stderr = "";
+
+    child.stdout.on("data", (chunk: Buffer) => (stdout += chunk.toString()));
+    child.stderr.on("data", (chunk: Buffer) => (stderr += chunk.toString()));
+    child.on("error", reject);
+
+    child.on("close", (code) => {
+      if (code === 0) return resolve_(stdout);
+      reject(new Error(stderr.trim() || stdout.trim() || `${file} exited ${code}`));
+    });
+  });
+}
+
+function messageOf(error: unknown) {
+  return error instanceof Error ? error.message : String(error);
+}