@git.zone/tsrust 1.12.0 → 1.13.2

package/ts/mod_matrix/classes.nativematrixbuilder.ts

@@ -969,8 +969,7 @@ export class NativeMatrixBuilder {
     });
     await this.assertInstalledTsrustVersion(workerWorkspace);
     if (this.plan.verificationCommand) {
-      const [command, ...args] = this.plan.verificationCommand;
-      await this.commandRunner.execute(command, args, {
+      await this.commandRunner.execute('/bin/sh', this.workerVerificationArgs(workerArg), {
         cwd: workerWorkspace,
         timeoutMs: this.remainingBuildTimeout(buildDeadline, workerArg.host),
         environment: workerEnvironment,
@@ -1012,6 +1011,24 @@ export class NativeMatrixBuilder {
     ];
   }
 
+  private workerVerificationArgs(workerArg: IResolvedMatrixWorker): string[] {
+    const bootstrap = "import { ToolchainManager } from './node_modules/@git.zone/tsrust/dist_ts/mod_toolchain/index.js'; await new ToolchainManager().ensureInstalled();";
+    return [
+      '-c',
+      [
+        'set -eu',
+        'if cargo --version >/dev/null 2>&1; then exec "$@"; fi',
+        `node --input-type=module -e ${shellQuote(bootstrap)}`,
+        // Toolchain installation owns its managed home. Verification keeps the
+        // worker's private Cargo registry/cache while using the managed proxies.
+        'matrix_cargo_home="$CARGO_HOME"',
+        `${new ToolchainManager().getEnvPrefix(workerArg.hostTriple)}export CARGO_HOME="$matrix_cargo_home" && exec "$@"`,
+      ].join('\n'),
+      'tsrust-matrix-verification',
+      ...this.plan.verificationCommand!,
+    ];
+  }
+
   private async assertWorkerSource(
     workspaceArg: string,
     gitCommitArg: string,
@@ -1257,7 +1274,7 @@ export class NativeMatrixBuilder {
         .map(shellQuote)
         .join(' '),
       ...(this.plan.verificationCommand ? [
-        ['run_matrix_worker', ...this.plan.verificationCommand].map(shellQuote).join(' '),
+        ['run_matrix_worker', '/bin/sh', ...this.workerVerificationArgs(remoteArg.worker)].map(shellQuote).join(' '),
         'test "$(git rev-parse HEAD)" = "$expected_commit"',
         'test -z "$(git status --porcelain=v1 --untracked-files=all)"',
         `test -z "$(git ls-files -v | grep -v '^H ' || true)"`,

package/ts/plugins.ts

@@ -1,3 +1,8 @@
+import fsPromises from 'node:fs/promises';
+import * as path from 'node:path';
+import * as net from 'node:net';
+import * as crypto from 'node:crypto';
+import { AsyncLocalStorage } from 'node:async_hooks';
 import * as early from '@push.rocks/early';
 import * as smartconfig from '@push.rocks/smartconfig';
 import * as smartcli from '@push.rocks/smartcli';
@@ -6,6 +11,7 @@ import * as smartpath from '@push.rocks/smartpath';
 import * as smartshell from '@push.rocks/smartshell';
 
 export {
+  fsPromises, path, net, crypto, AsyncLocalStorage,
   early,
   smartconfig,
   smartcli,

package/readme.hints.md

@@ -1,27 +0,0 @@
-# tsrust hints
-
-## Architecture
-- Follows tsbuild patterns for the `cli.js` entry point and TypeScript module layout.
-- Uses smartcli for CLI dispatch, smartshell for Cargo execution, native `child_process.execFile` for Git snapshots, and smol-toml for TOML parsing.
-- `mod_artifact` owns strict multi-host assembly; `mod_provenance` owns byte-preserving, hash-bound sidecars and Git source snapshots.
-- `mod_matrix` owns local/SSH worker scheduling, exact Git-bundle transport, capability checks, configured verification commands, smoke execution, and artifact collection. It delegates final publication to `mod_artifact`.
-
-## Key patterns
-- smartshell `.exec()` streams output to terminal (non-silent)
-- smartshell `.execSilent()` captures output without printing
-- Cargo workspace detection: check for `[workspace]` section in Cargo.toml
-- Binary targets: look for `[[bin]]` entries in member crate Cargo.toml files
-- New builds never append provenance to binaries. Keep legacy `ProvenanceStamper` reads for tsrust 1.7/1.8 artifacts, but use `ProvenanceStore` sidecars for all writes.
-- Host target precedence is CLI, exact host, OS family, legacy targets, then native. Assembly uses the union of all configured targets unless repeated CLI `--target` values define an explicit matrix, and rejects dirty or incomplete matrices.
-- Assembly owns only `dist_rust/`, `.nogit/tsrust-assembly*`, and transient `.nogit/.tsrust-assembly-*.tmp` owner records. Its atomically linked owner lock, serialized recovery claim, v2 phase journal, and digest manifest recover readable, owner-consistent transactions; committed v1 state is validated and migrated before completion, while malformed or inconsistent state fails closed.
-- Matrix configuration commits logical host keys, transport selection, environment-variable names, optional explicitly forwarded worker-variable names, and optional smoke arguments. SSH destinations, values, and dedicated temporary roots remain operator-local.
-- Project-controlled worker commands run with synthetic per-run home directories and a restricted baseline. Committed `matrix.forwardEnvironment` requests must be granted separately through operator-owned `TSRUST_MATRIX_ALLOWED_ENVIRONMENT`; never expose transport-only `HOME` or `SSH_AUTH_SOCK` to workload commands.
-- Exact-commit bundle transport accepts regular self-contained files only. Reject submodules, tracked symlinks, checkout filters, and external-content pointer records before cloning workers.
-- Matrix workers build isolated exact-commit clones. Failed local and remote workspaces are retained for diagnostics, capped at three runs per root; successful remote cleanup requires the exact path, commit, token, and regular owner marker.
-- Optional `matrix.verificationCommand` runs as literal executable/arguments after frozen installation and before each worker's artifact build. It shares the worker deadline, environment restrictions and process-group lifecycle; failure or tracked-source mutation prevents assembly. Successful build results report `verifiedWorkers`; capability-only checks do not run verification.
-- SSH builds use login shells for builder PATH setup and a heartbeat watchdog that kills the owned remote process group if the coordinator disconnects. Commands that deliberately create a new session or process group are outside that ownership boundary.
-- SSH transport uses stdin/stdout streams, not scp. Artifact output is byte-bounded both remotely and locally; bundle input is streamed under the shared worker deadline. Every transfer validates expected architecture and the exact random workspace owner marker in the same connection.
-- Matrix execution assumes the reviewed commit, dependency graph, lifecycle scripts, builders, toolchains, registries, and SSH configuration are trusted. Correctness checks are not same-UID sandboxing.
-- Artifact assembly persists and revalidates an exact staged digest manifest before initial publication and committed-transaction recovery.
-- Revalidate source compatibility and the clean Git snapshot around bundle creation so capability checks cannot leave a stale source decision.
-- Failed matrix workspaces are not pruned automatically. Inspect and remove only the exact diagnostic paths printed by the failed invocation before retrying.