@cat-factory/executor-harness 1.39.3 → 1.41.0

package/dist/server.js

@@ -6,6 +6,7 @@ import { handleInline } from './inline.js';
 import { redactSecrets } from './git.js';
 import { JobRegistry, loadRunnerLimits } from './runner.js';
 import { log } from './logger.js';
+import { HARNESS_VERSION } from './version.js';
 // The container's HTTP entry point. The Worker addresses one instance per run and
 // POSTs a job to /jobs (the body's `kind` selects which agent runs); the harness
 // starts that job in the background (bounded by an inactivity + max-duration
@@ -90,7 +91,14 @@ function send(res, status, body) {
 const server = createServer((req, res) => {
     void (async () => {
         if (req.method === 'GET' && req.url === '/health') {
-            return send(res, 200, { status: 'ok' });
+            // Report the harness version so a backend can detect a stale/mismatched executor and
+            // fail loudly early (see version.ts). Unauthenticated like the rest of /health — the
+            // version is not a secret. An old image predating this field simply omits it, which the
+            // backend treats as a stale signal.
+            return send(res, 200, {
+                status: 'ok',
+                ...(HARNESS_VERSION ? { version: HARNESS_VERSION } : {}),
+            });
         }
         // All non-health endpoints are gated by the optional shared secret.
         if (!authorized(req)) {

package/dist/version.js

@@ -0,0 +1,44 @@
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+// The harness's OWN version, resolved once at module load and reported on `/health`. A
+// backend reads it back over the health handshake to detect a STALE or MISMATCHED executor
+// (an old image left behind by a mutable tag, an outdated native install) and fail loudly
+// and early — instead of the cryptic downstream symptom a version skew otherwise produces
+// (e.g. a since-removed git flag reappearing and breaking every authenticated clone/push).
+//
+// Resolution order, most authoritative first:
+//   1. `HARNESS_VERSION` env — the Docker image can bake it; an operator can override.
+//   2. the version file the image writes next to `dist/` (the image deliberately ships NO
+//      package.json, so it captures the version into `harness-version.txt` at build time).
+//   3. `package.json` — the native/npm install and a source checkout both keep it beside
+//      `dist/`, so `dist/version.js` finds it one level up.
+// Undefined only for an oddly-assembled runtime carrying none of the three; the backend then
+// treats "no reported version" as a strong stale signal in its own right.
+function readVersionFile(dir, rel) {
+    try {
+        const raw = readFileSync(join(dir, rel), 'utf8');
+        const value = rel.endsWith('.json') ? JSON.parse(raw).version : raw;
+        const trimmed = value?.trim();
+        return trimmed || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function resolveHarnessVersion() {
+    const fromEnv = process.env.HARNESS_VERSION?.trim();
+    if (fromEnv)
+        return fromEnv;
+    let dir;
+    try {
+        // Compiled to `dist/version.js`; the baked file / package.json sit one level up from dist.
+        dir = dirname(fileURLToPath(import.meta.url));
+    }
+    catch {
+        return undefined;
+    }
+    return readVersionFile(dir, '../harness-version.txt') ?? readVersionFile(dir, '../package.json');
+}
+/** The running harness version, or undefined when it cannot be determined. */
+export const HARNESS_VERSION = resolveHarnessVersion();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/executor-harness",
-  "version": "1.39.3",
+  "version": "1.41.0",
   "description": "Container payload: a thin TypeScript wrapper that runs the Pi coding agent against a cloned repo and opens a PR. Runs in the Cloudflare Container (and, in local native mode, as a host process); carries no secrets.",
   "repository": {
     "type": "git",
@@ -26,8 +26,8 @@
     "hono": "^4.12.27",
     "typescript": "^6.0.3",
     "vitest": "^4.1.9",
-    "@cat-factory/server": "0.106.0",
-    "@cat-factory/spend": "0.12.0"
+    "@cat-factory/server": "0.106.1",
+    "@cat-factory/spend": "0.12.1"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",

package/src/server.ts

@@ -6,6 +6,7 @@ import { handleInline } from './inline.js'
 import { redactSecrets } from './git.js'
 import { JobRegistry, loadRunnerLimits, type JobResultBase, type RunOptions } from './runner.js'
 import { log } from './logger.js'
+import { HARNESS_VERSION } from './version.js'
 
 // The container's HTTP entry point. The Worker addresses one instance per run and
 // POSTs a job to /jobs (the body's `kind` selects which agent runs); the harness
@@ -109,7 +110,14 @@ function send(res: ServerResponse, status: number, body: unknown): void {
 const server = createServer((req, res) => {
   void (async () => {
     if (req.method === 'GET' && req.url === '/health') {
-      return send(res, 200, { status: 'ok' })
+      // Report the harness version so a backend can detect a stale/mismatched executor and
+      // fail loudly early (see version.ts). Unauthenticated like the rest of /health — the
+      // version is not a secret. An old image predating this field simply omits it, which the
+      // backend treats as a stale signal.
+      return send(res, 200, {
+        status: 'ok',
+        ...(HARNESS_VERSION ? { version: HARNESS_VERSION } : {}),
+      })
     }
     // All non-health endpoints are gated by the optional shared secret.
     if (!authorized(req)) {

package/src/version.ts

@@ -0,0 +1,45 @@
+import { readFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+// The harness's OWN version, resolved once at module load and reported on `/health`. A
+// backend reads it back over the health handshake to detect a STALE or MISMATCHED executor
+// (an old image left behind by a mutable tag, an outdated native install) and fail loudly
+// and early — instead of the cryptic downstream symptom a version skew otherwise produces
+// (e.g. a since-removed git flag reappearing and breaking every authenticated clone/push).
+//
+// Resolution order, most authoritative first:
+//   1. `HARNESS_VERSION` env — the Docker image can bake it; an operator can override.
+//   2. the version file the image writes next to `dist/` (the image deliberately ships NO
+//      package.json, so it captures the version into `harness-version.txt` at build time).
+//   3. `package.json` — the native/npm install and a source checkout both keep it beside
+//      `dist/`, so `dist/version.js` finds it one level up.
+// Undefined only for an oddly-assembled runtime carrying none of the three; the backend then
+// treats "no reported version" as a strong stale signal in its own right.
+
+function readVersionFile(dir: string, rel: string): string | undefined {
+  try {
+    const raw = readFileSync(join(dir, rel), 'utf8')
+    const value = rel.endsWith('.json') ? (JSON.parse(raw) as { version?: string }).version : raw
+    const trimmed = value?.trim()
+    return trimmed || undefined
+  } catch {
+    return undefined
+  }
+}
+
+function resolveHarnessVersion(): string | undefined {
+  const fromEnv = process.env.HARNESS_VERSION?.trim()
+  if (fromEnv) return fromEnv
+  let dir: string
+  try {
+    // Compiled to `dist/version.js`; the baked file / package.json sit one level up from dist.
+    dir = dirname(fileURLToPath(import.meta.url))
+  } catch {
+    return undefined
+  }
+  return readVersionFile(dir, '../harness-version.txt') ?? readVersionFile(dir, '../package.json')
+}
+
+/** The running harness version, or undefined when it cannot be determined. */
+export const HARNESS_VERSION: string | undefined = resolveHarnessVersion()