@atolis-hq/wake 0.4.23 → 0.4.25

package/dist/src/bootstrap/initialise.js

@@ -401,7 +401,7 @@ ENV WAKE_MAIN_JS=/app/dist/src/main.js
 # Startup ownership repair is best effort because bind-mounted paths or host
 # permissions may prevent chown. The bounded direct-child pass avoids traversing
 # accumulated runtime data.
-ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake /wake/workspaces; chown wake:wake /wake/.wake /wake/workspaces || true; find /wake/.wake -mindepth 1 -maxdepth 1 -type d -exec chown wake:wake {} + || true; if [ -n \\"$WAKE_HOME_INIT_DIRS\\" ]; then printf '%s\\n' \\"$WAKE_HOME_INIT_DIRS\\" | while IFS= read -r directory; do case \\"$directory\\" in \\"$WAKE_HOME_INIT_ROOT\\"/*) mkdir -p \\"$directory\\"; chown wake:wake \\"$directory\\" ;; *) exit 1 ;; esac; done; fi; exec su wake -s /bin/sh -c 'HOME=/home/wake exec node \\"$WAKE_MAIN_JS\\" sandbox-entrypoint --wake-root /wake'"]
+ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake /wake/workspaces /wake/.wake/auth; chown wake:wake /wake/.wake /wake/workspaces /wake/.wake/auth || true; find /wake/.wake -mindepth 1 -maxdepth 1 -type d -exec chown wake:wake {} + || true; find /wake/.wake/auth -mindepth 1 -maxdepth 1 -type f -exec chown wake:wake {} + || true; if [ -n \\"$WAKE_HOME_INIT_DIRS\\" ]; then printf '%s\\n' \\"$WAKE_HOME_INIT_DIRS\\" | while IFS= read -r directory; do case \\"$directory\\" in \\"$WAKE_HOME_INIT_ROOT\\"/*) mkdir -p \\"$directory\\"; chown wake:wake \\"$directory\\" ;; *) exit 1 ;; esac; done; fi; exec su wake -s /bin/sh -c 'HOME=/home/wake exec node \\"$WAKE_MAIN_JS\\" sandbox-entrypoint --wake-root /wake'"]
 `;
 const packagedDockerfile = `# syntax=docker/dockerfile:1
 FROM node:24-bookworm-slim
@@ -468,7 +468,7 @@ EXPOSE 4317
 # Startup ownership repair is best effort because bind-mounted paths or host
 # permissions may prevent chown. The bounded direct-child pass avoids traversing
 # accumulated runtime data.
-ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake /wake/workspaces; chown wake:wake /wake/.wake /wake/workspaces || true; find /wake/.wake -mindepth 1 -maxdepth 1 -type d -exec chown wake:wake {} + || true; if [ -n \\"$WAKE_HOME_INIT_DIRS\\" ]; then printf '%s\\n' \\"$WAKE_HOME_INIT_DIRS\\" | while IFS= read -r directory; do case \\"$directory\\" in \\"$WAKE_HOME_INIT_ROOT\\"/*) mkdir -p \\"$directory\\"; chown wake:wake \\"$directory\\" ;; *) exit 1 ;; esac; done; fi; exec su wake -s /bin/sh -c 'HOME=/home/wake exec wake sandbox-entrypoint'"]
+ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake /wake/workspaces /wake/.wake/auth; chown wake:wake /wake/.wake /wake/workspaces /wake/.wake/auth || true; find /wake/.wake -mindepth 1 -maxdepth 1 -type d -exec chown wake:wake {} + || true; find /wake/.wake/auth -mindepth 1 -maxdepth 1 -type f -exec chown wake:wake {} + || true; if [ -n \\"$WAKE_HOME_INIT_DIRS\\" ]; then printf '%s\\n' \\"$WAKE_HOME_INIT_DIRS\\" | while IFS= read -r directory; do case \\"$directory\\" in \\"$WAKE_HOME_INIT_ROOT\\"/*) mkdir -p \\"$directory\\"; chown wake:wake \\"$directory\\" ;; *) exit 1 ;; esac; done; fi; exec su wake -s /bin/sh -c 'HOME=/home/wake exec wake sandbox-entrypoint'"]
 `;
 /** Creates an immediately-valid, human-readable target Wake root. */
 export async function initialiseWakeRoot(wakeRoot) {

package/dist/src/bootstrap/version.js

@@ -124,6 +124,6 @@ export function resolveWakeVersion(options = {}) {
         return `g${headHash.slice(0, 7)}`;
     return '0.1.0-dev';
 }
-export const wakeVersion = "v0.4.23";
+export const wakeVersion = "v0.4.25";
 /** The registry-installable version used by packaged sandbox images. */
 export const wakePackageVersion = packageVersion(defaultRepoRoot) ?? wakeVersion;

package/dist/src/orchestration/application/start-workflow.js

@@ -5,6 +5,7 @@ import { WorkflowInstanceKind, WorkflowStatus } from '../contracts/vocabulary.js
 import { validateChildProvenance } from '../domain/child-policy.js';
 import { workflowEventData } from '../domain/decision-events.js';
 import { startInstance } from '../domain/interpreter.js';
+import { appendWithIntentRecovery } from './durable-append.js';
 import { WorkflowDefinitionUnavailableError } from './workflow-definition-registry.js';
 const TERMINAL_OR_BLOCKED_STATUSES = new Set([
     WorkflowStatus.Blocked,
@@ -48,8 +49,17 @@ export class StartWorkflow {
             correlationId: context.correlationId,
             causationId: context.commandId,
         });
-        if (decision.kind === 'append')
-            await this.repository.append(command.workflowInstanceId, 0, decision.events);
+        if (decision.kind === 'append') {
+            const recovered = await appendWithIntentRecovery({
+                append: async () => {
+                    await this.repository.append(command.workflowInstanceId, 0, decision.events);
+                },
+                load: () => this.repository.load(command.workflowInstanceId),
+                alreadyApplied: (reloaded) => reloaded.view !== null,
+            });
+            if (recovered !== undefined)
+                return recovered.view;
+        }
         return (await this.repository.loadRequired(command.workflowInstanceId)).view;
     }
     async isWorkItemOpen(workItemId) {

package/dist/src/surfaces/cli/infrastructure/sandbox-workspace-ownership.d.ts

@@ -5,6 +5,6 @@ interface WorkspaceSandbox {
     readonly containerName: string;
     readonly wakeMountPath?: string;
 }
-/** Ensures the bind-mounted workspace root is usable by the unprivileged sandbox process. */
+/** Ensures the bind-mounted workspace and auth roots are usable by the sandbox process. */
 export declare function ensureSandboxWorkspaceOwnership(docker: RootDockerExecutor, options: WorkspaceSandbox): Promise<void>;
 export {};

package/dist/src/surfaces/cli/infrastructure/sandbox-workspace-ownership.js

@@ -1,4 +1,4 @@
-/** Ensures the bind-mounted workspace root is usable by the unprivileged sandbox process. */
+/** Ensures the bind-mounted workspace and auth roots are usable by the sandbox process. */
 export async function ensureSandboxWorkspaceOwnership(docker, options) {
     await docker.invoke([
         'exec',
@@ -7,8 +7,9 @@ export async function ensureSandboxWorkspaceOwnership(docker, options) {
         options.containerName,
         'sh',
         '-c',
-        'mkdir -p "$1" && chown wake:wake "$1"',
-        'wake-workspace-ownership',
+        'mkdir -p "$1" "$2" && chown wake:wake "$1" "$2" && find "$2" -mindepth 1 -maxdepth 1 -type f -exec chown wake:wake {} +',
+        'wake-sandbox-runtime-ownership',
         `${options.wakeMountPath ?? '/wake'}/workspaces`,
+        `${options.wakeMountPath ?? '/wake'}/.wake/auth`,
     ]);
 }

package/docker/Dockerfile

@@ -82,4 +82,4 @@ ENV WAKE_MAIN_JS=/app/dist/src/main.js
 # Startup ownership repair is best effort because bind-mounted paths or host
 # permissions may prevent chown. The bounded direct-child pass avoids traversing
 # accumulated runtime data.
-ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake /wake/workspaces; chown wake:wake /wake/.wake /wake/workspaces || true; find /wake/.wake -mindepth 1 -maxdepth 1 -type d -exec chown wake:wake {} + || true; exec su wake -s /bin/sh -c 'if [ \"$WAKE_START_ENABLED\" = \"true\" ]; then exec node /app/dist/src/main.js start --wake-root /wake --no-sandbox; else exec sleep infinity; fi'"]
+ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake /wake/workspaces /wake/.wake/auth; chown wake:wake /wake/.wake /wake/workspaces /wake/.wake/auth || true; find /wake/.wake -mindepth 1 -maxdepth 1 -type d -exec chown wake:wake {} + || true; find /wake/.wake/auth -mindepth 1 -maxdepth 1 -type f -exec chown wake:wake {} + || true; exec su wake -s /bin/sh -c 'if [ \"$WAKE_START_ENABLED\" = \"true\" ]; then exec node /app/dist/src/main.js start --wake-root /wake --no-sandbox; else exec sleep infinity; fi'"]

package/docker/Dockerfile.packaged

@@ -65,4 +65,4 @@ EXPOSE 4317
 # Startup ownership repair is best effort because bind-mounted paths or host
 # permissions may prevent chown. The bounded direct-child pass avoids traversing
 # accumulated runtime data.
-ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake /wake/workspaces; chown wake:wake /wake/.wake /wake/workspaces || true; find /wake/.wake -mindepth 1 -maxdepth 1 -type d -exec chown wake:wake {} + || true; exec su wake -s /bin/sh -c 'exec wake sandbox-entrypoint'"]
+ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake /wake/workspaces /wake/.wake/auth; chown wake:wake /wake/.wake /wake/workspaces /wake/.wake/auth || true; find /wake/.wake -mindepth 1 -maxdepth 1 -type d -exec chown wake:wake {} + || true; find /wake/.wake/auth -mindepth 1 -maxdepth 1 -type f -exec chown wake:wake {} + || true; exec su wake -s /bin/sh -c 'exec wake sandbox-entrypoint'"]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atolis-hq/wake",
-  "version": "0.4.23",
+  "version": "0.4.25",
   "description": "Local autonomous agent control plane for software development",
   "license": "Apache-2.0",
   "repository": {