@nimbus-sh/worker 0.12.0 → 0.13.1

package/dist/session/vite-command.js

@@ -16,15 +16,16 @@ import { normalizeVfsPath, parentVfsPath, resolveVfsPath, stripLeadingSlashes }
 import { errorText } from '@nimbus-sh/core/_shared/error-text.js';
 import { CRED_KERNEL, requireVfsCred } from '@nimbus-sh/core/runtime/os-contracts.js';
 import { engineKey } from '@nimbus-sh/core/runtime/process-files.js';
+import { execIdField } from '@nimbus-sh/core/runtime/process-table.js';
 import { parseViteConfigSource, parseViteConfigTypeScript, viteBuildBlockingPlugins, unhandledVitePlugins } from '@nimbus-sh/core/runtime/vite-config-parser.js';
 import { findHtmlScriptEntrypoint, rewriteViteBuildHtml } from '../runtime/html-entrypoint.js';
-import { handKernelArtifact, projectFs as viewFs } from '../runtime/project-fs.js';
+import { handKernelArtifact, projectEntryType, projectFs as viewFs } from '../runtime/project-fs.js';
 import { supervisorEsbuildService } from '../facets/esbuild-transform.js';
 import { ViteDevServer } from '../facets/vite-dev-server.js';
 import { shouldUseRealVite } from '../facets/cirrus-real.js';
 import { makeLongRunningPortStub, resolveLongRunningPort, expandArgvShellDefaults, } from '@nimbus-sh/core/runtime/long-running-handle.js';
 import { checkNodeModulesGuard, withLoudTimeout, VITE_BUILD_TIMEOUT_MS, } from './helpers.js';
-import { startRealVite } from './start-real-vite.js';
+import { devServerIdentity, startRealVite } from './start-real-vite.js';
 import { notifyTerminalEvent } from '../runtime/process-logs-api.js';
 import { VITE_CONFIG_KEY } from './keys.js';
 import { registerServingPort } from './serving-port.js';
@@ -124,7 +125,7 @@ export function createViteCommand(self) {
                 return 1;
             }
             ctx.stdout.write('Building for production...\n');
-            ctx.stdout.write('  Entry: ' + entryPoint + '\n');
+            ctx.stdout.write('  Entry: /' + entryPoint + '\n');
             const t0 = Date.now();
             try {
                 // Vite parity: build writes to the resolved outDir wherever it
@@ -162,7 +163,7 @@ export function createViteCommand(self) {
                 // Bounded (G5): an esbuild stall must surface as a loud timeout
                 // naming the entry, never a silent hang. The existing catch below
                 // renders the timeout as `Build error: …`.
-                ctx.stdout.write('  Bundling ' + entryPoint + ' …\n');
+                ctx.stdout.write('  Bundling /' + entryPoint + ' …\n');
                 const result = await withLoudTimeout(self.esbuildService.build([entryPoint], {
                     bundle: true, format: 'esm', target: 'es2020', platform: 'browser',
                     minify: true, outdir: distDir,
@@ -173,7 +174,7 @@ export function createViteCommand(self) {
                     viteAssets: true,
                     vitePublicDir: hasPublic ? publicDir : undefined,
                     fs: projectFs,
-                }), VITE_BUILD_TIMEOUT_MS, `vite build of ${entryPoint}`);
+                }), VITE_BUILD_TIMEOUT_MS, `vite build of /${entryPoint}`);
                 if (result.errors?.length) {
                     for (const e of result.errors)
                         ctx.stderr.write('  error: ' + e.text + '\n');
@@ -220,7 +221,7 @@ export function createViteCommand(self) {
                         try {
                             for (const e of await projectFs.readdir(dir)) {
                                 const fp = dir + '/' + e.name;
-                                if (e.type === 'directory')
+                                if ((await projectEntryType(projectFs, dir, e)) === 'directory')
                                     await collectCss(fp);
                                 else if (e.name.endsWith('.css')) {
                                     try {
@@ -262,7 +263,7 @@ export function createViteCommand(self) {
                         for (const e of await projectFs.readdir(src)) {
                             const s = src + '/' + e.name;
                             const d = dst + '/' + e.name;
-                            if (e.type === 'directory') {
+                            if ((await projectEntryType(projectFs, src, e)) === 'directory') {
                                 await copyTree(s, d);
                             }
                             else {
@@ -323,9 +324,11 @@ export function createViteCommand(self) {
             // process metadata support: same long-running treatment as the
             // dev path, just on the dist/ directory.
             const previewPort = viteConfig.port || 4173; // vite preview default
-            const previewProcEntry = self.processes.spawn('vite preview (' + distRoot + ')', ['vite', ...args], distRoot, { longRunning: true });
+            // A child of the command, under its credential: the server reads the
+            // build as the principal who ran it.
+            const previewProcEntry = self.processes.spawn('vite preview (' + distRoot + ')', ['vite', ...args], distRoot, { longRunning: true, parentPid: ctx.pid });
             self.viteDevServer = new ViteDevServer({
-                vfs: self.sqliteFs, esbuild: self.esbuildService, root: servedDist,
+                vfs: self.sqliteFs, cred: previewProcEntry.cred, esbuild: self.esbuildService, root: servedDist,
                 onHmrMessage: () => { },
                 sql: self.ctx.storage.sql,
                 basePath: previewBasePath,
@@ -348,7 +351,7 @@ export function createViteCommand(self) {
             try {
                 await self.ctx.storage.put(VITE_CONFIG_KEY, {
                     root: servedDist, basePath: previewBasePath, port: previewPort,
-                    identity: { cwd: previewProcEntry.cwd, argv: previewProcEntry.argv },
+                    identity: devServerIdentity(previewProcEntry),
                 });
             }
             catch { }
@@ -469,8 +472,8 @@ export function createViteCommand(self) {
             : undefined;
         const handedOff = adoptedEntry != null;
         const identity = adoptedEntry
-            ? { cwd: adoptedEntry.cwd, argv: adoptedEntry.argv }
-            : { cwd: vfsRoot, argv: expandedArgs };
+            ? devServerIdentity(adoptedEntry)
+            : { cwd: vfsRoot, argv: expandedArgs, cred: requireVfsCred(ctx.cred, 'vite'), ...execIdField(self.processes.get(ctx.pid)) };
         if (useReal) {
             const vitePort = resolvedPort;
             const previewBasePath = self.viteBasePath;
@@ -496,7 +499,7 @@ export function createViteCommand(self) {
                 ctx.stdout.write('\n\x1b[1;36m  Nimbus: real-vite mode\x1b[0m \x1b[2m(experimental, Phase 1-4)\x1b[0m\n\n');
                 ctx.stdout.write('  \x1b[32m\u279C\x1b[0m  Preview:    \x1b[36m' + previewBasePath + '/\x1b[0m\n');
                 ctx.stdout.write('  \x1b[32m\u279C\x1b[0m  Vite:       ' + cirrusReal.stats.viteVersion + ' (bundled)\n');
-                ctx.stdout.write('  \x1b[32m\u279C\x1b[0m  Root:       ' + vfsRoot + '\n');
+                ctx.stdout.write('  \x1b[32m\u279C\x1b[0m  Root:       /' + vfsRoot + '\n');
                 ctx.stdout.write('  \x1b[32m\u279C\x1b[0m  Port:       ' + vitePort + ' \x1b[2m(virtual routing key)\x1b[0m\n');
                 if (snap) {
                     const kb = (snap.totalBytes / 1024).toFixed(1);
@@ -506,7 +509,7 @@ export function createViteCommand(self) {
                         (pkgJson ? '\x1b[2m(incl. ' + pkgJson + ' package.json, rest lazy)\x1b[0m' : '') + '\n');
                 }
                 if (userConfigBundle) {
-                    ctx.stdout.write('  \x1b[32m\u279C\x1b[0m  Config:     ' + cfgPath + ' \x1b[2m(' +
+                    ctx.stdout.write('  \x1b[32m\u279C\x1b[0m  Config:     /' + cfgPath + ' \x1b[2m(' +
                         (userConfigBundle.length / 1024).toFixed(0) + ' KB bundled)\x1b[0m\n');
                 }
                 ctx.stdout.write('\n  \x1b[2mWorks:\x1b[0m @vitejs/plugin-react, JSX/TSX transforms, SPA fallback, HMR.\n');
@@ -546,11 +549,13 @@ export function createViteCommand(self) {
         //
         // The adopted wrapper pid stays `running` in /api/processes with this
         // port; a fresh spawn carries the identity inputs computed above.
-        const viteProcEntry = adoptedEntry ?? self.processes.spawn('vite (' + vfsRoot + ')', identity.argv, identity.cwd, { longRunning: true });
+        const viteProcEntry = adoptedEntry ?? self.processes.spawn('vite (' + vfsRoot + ')', identity.argv, identity.cwd, { longRunning: true, cred: identity.cred, execId: identity.execId });
         if (handedOff)
             self.processes.setLongRunning(viteProcEntry.pid);
         self.viteDevServer = new ViteDevServer({
             vfs: self.sqliteFs,
+            // The server reads and writes as the principal who ran the command.
+            cred: viteProcEntry.cred,
             esbuild: self.esbuildService,
             root: servedRoot,
             port: resolvedPort,
@@ -569,8 +574,7 @@ export function createViteCommand(self) {
             env: self.env,
             ctx: self.ctx,
             // The shared bundle pool puts cold /@modules/ misses on the facet
-            // path. This site never passed it before, so `vite` served every
-            // cold miss through in-supervisor esbuild-wasm.
+            // path, from a slice.
             bundlePool: self.ensureBundlePool(),
             // Process diagnostics support: wire dev-server diagnostics into the
             // supervisor's per-PID log store so the Process tab is not silent
@@ -584,7 +588,7 @@ export function createViteCommand(self) {
                 root: servedRoot, aliases: viteConfig.alias, define: viteDefine,
                 injectBasename: viteConfig.injectBasename, basePath: previewBasePath,
                 port: resolvedPort,
-                identity: { cwd: viteProcEntry.cwd, argv: viteProcEntry.argv },
+                identity: devServerIdentity(viteProcEntry),
             });
         }
         catch { }
@@ -623,7 +627,7 @@ export function createViteCommand(self) {
             ctx.stdout.write('  \x1b[2m(also: ' + previewBasePath + '/?port=' + resolvedPort + ')\x1b[0m');
         }
         ctx.stdout.write('\n');
-        ctx.stdout.write('  \x1b[32m\u279C\x1b[0m  Root:       ' + vfsRoot + '\n');
+        ctx.stdout.write('  \x1b[32m\u279C\x1b[0m  Root:       /' + vfsRoot + '\n');
         ctx.stdout.write('  \x1b[32m\u279C\x1b[0m  Port:       ' + resolvedPort + ' \x1b[2m(pid=' + viteProcEntry.pid + ')\x1b[0m\n');
         ctx.stdout.write('  \x1b[32m\u279C\x1b[0m  Transforms: .ts .tsx .jsx (React JSX automatic)\n');
         if (viteConfig.alias)

package/dist/session/ws-relay.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ws-relay.d.ts","sourceRoot":"","sources":["../../src/session/ws-relay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,4DAA4D;AAC5D,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,EAAE,UAAU,GAAG,IAAI,CAAA;CAAE,GAClE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAWvC;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,QAAkB,CAAC;AAW1D,qBAAa,cAAc;IACzB,OAAO,CAAC,OAAO,CAAiC;IAChD,OAAO,CAAC,MAAM,CAAK;IAEnB;;;;;;;;OAQG;IACG,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAoCpG;;;;OAIG;IACG,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAgB5E,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,GAAG,IAAI;IAMlF,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI;IASpE,kDAAkD;IAClD,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAM9B,OAAO,CAAC,QAAQ;IAOhB,OAAO,CAAC,KAAK;IAOb,OAAO,CAAC,OAAO;CAmBhB"}
+{"version":3,"file":"ws-relay.d.ts","sourceRoot":"","sources":["../../src/session/ws-relay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,4DAA4D;AAC5D,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,EAAE,UAAU,GAAG,IAAI,CAAA;CAAE,GAClE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAWvC;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,QAAkB,CAAC;AAwB1D,qBAAa,cAAc;IACzB,OAAO,CAAC,OAAO,CAAiC;IAChD,OAAO,CAAC,MAAM,CAAK;IAEnB;;;;;;;;OAQG;IACG,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAoCpG;;;;OAIG;IACG,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAgB5E,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,GAAG,IAAI;IAMlF,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI;IASpE,kDAAkD;IAClD,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAM9B,OAAO,CAAC,QAAQ;IAOhB,OAAO,CAAC,KAAK;IAOb,OAAO,CAAC,OAAO;CAmBhB"}

package/dist/session/ws-relay.js

@@ -48,6 +48,18 @@ function eventBytes(event) {
         return event.bytes.byteLength;
     return event.text ? event.text.length * 2 : 0;
 }
+/**
+ * The URL a socket's upgrade is fetched from: workerd's fetch takes http(s)
+ * only ("Fetch API cannot load: wss://..."), so ws: is http: and wss: is
+ * https:, the rest of the address as given. A fragment never reaches a
+ * server, in a WebSocket handshake or an HTTP request.
+ */
+function upgradeUrl(url) {
+    const target = new URL(url);
+    target.protocol = target.protocol === 'wss:' ? 'https:' : 'http:';
+    target.hash = '';
+    return target.href;
+}
 export class WebSocketRelay {
     entries = new Map();
     nextId = 1;
@@ -64,7 +76,7 @@ export class WebSocketRelay {
         const headers = { Upgrade: 'websocket' };
         if (protocols.length > 0)
             headers['Sec-WebSocket-Protocol'] = protocols.join(', ');
-        const response = await fetch(url, { headers });
+        const response = await fetch(upgradeUrl(url), { headers });
         const socket = response.webSocket;
         if (!socket) {
             throw new Error(`websocket relay: ${url} did not upgrade (HTTP ${response.status}); ` +

package/dist/shell/npm-bin-entrypoints.d.ts

@@ -1,10 +1,12 @@
 import { type ProcessFiles } from '@nimbus-sh/core/runtime/process-files.js';
 import type { SessionProcessSupervisor } from '@nimbus-sh/core/runtime/session-process-supervisor.js';
 import type { FacetManager } from '../facets/manager.js';
-import type { ResolveContext } from '@nimbus-sh/core/substrate/lifo/commands/registry.js';
+import { type ResolveContext } from '@nimbus-sh/core/substrate/lifo/commands/registry.js';
 type Output = {
     write(data: string): void;
 };
+/** Whether `command` is the stub a known runtime that is not installed resolves to: no registered command. */
+export declare function isRuntimeInstallHint(command: object): boolean;
 type RegistryLike = {
     resolve(name: string, from?: ResolveContext): Promise<unknown> | unknown;
 };

package/dist/shell/npm-bin-entrypoints.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"npm-bin-entrypoints.d.ts","sourceRoot":"","sources":["../../src/shell/npm-bin-entrypoints.ts"],"names":[],"mappings":"AACA,OAAO,EAAe,KAAK,YAAY,EAAE,MAAM,0CAA0C,CAAC;AAE1F,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,KAAK,EAAE,YAAY,EAA4B,MAAM,sBAAsB,CAAC;AASnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qDAAqD,CAAC;AAI1F,KAAK,MAAM,GAAG;IAAE,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAoB5C,KAAK,YAAY,GAAG;IAClB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CAC1E,CAAC;AAEF,KAAK,kBAAkB,GAAG;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC;AAezD,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,YAAY,EACtB,IAAI,EAAE;IACJ,2FAA2F;IAC3F,UAAU,EAAE,YAAY,CAAC;IACzB,MAAM,IAAI,MAAM,CAAC;IACjB,SAAS,EAAE,wBAAwB,CAAC;IACpC,eAAe,IAAI,YAAY,CAAC;IAChC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,mBAAmB,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACxJ,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC9D,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7F,GACA,IAAI,CAgKN;AAqFD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,yBAAyB,GAAG,MAAM,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;AAEnF,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EAAE,GACb,yBAAyB,CAS3B;AAiGD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAS/E"}
+{"version":3,"file":"npm-bin-entrypoints.d.ts","sourceRoot":"","sources":["../../src/shell/npm-bin-entrypoints.ts"],"names":[],"mappings":"AACA,OAAO,EAAqB,KAAK,YAAY,EAAE,MAAM,0CAA0C,CAAC;AAEhG,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,KAAK,EAAE,YAAY,EAA4B,MAAM,sBAAsB,CAAC;AASnF,OAAO,EAAkB,KAAK,cAAc,EAAE,MAAM,qDAAqD,CAAC;AAI1G,KAAK,MAAM,GAAG;IAAE,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAoB5C,8GAA8G;AAC9G,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED,KAAK,YAAY,GAAG;IAClB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CAC1E,CAAC;AAEF,KAAK,kBAAkB,GAAG;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC;AAezD,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,YAAY,EACtB,IAAI,EAAE;IACJ,2FAA2F;IAC3F,UAAU,EAAE,YAAY,CAAC;IACzB,MAAM,IAAI,MAAM,CAAC;IACjB,SAAS,EAAE,wBAAwB,CAAC;IACpC,eAAe,IAAI,YAAY,CAAC;IAChC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,mBAAmB,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACxJ,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC9D,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7F,GACA,IAAI,CAoLN;AA4ED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,yBAAyB,GAAG,MAAM,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;AAEnF,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EAAE,GACb,yBAAyB,CAS3B;AAiGD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAS/E"}

package/dist/shell/npm-bin-entrypoints.js

@@ -1,12 +1,17 @@
 import { CRED_KERNEL } from '@nimbus-sh/core/runtime/os-contracts.js';
-import { ProcessView } from '@nimbus-sh/core/runtime/process-files.js';
+import { ProcessView, X_OK } from '@nimbus-sh/core/runtime/process-files.js';
 import { projectFs } from '../runtime/project-fs.js';
-import { resolveNpmBin, resolveNpmBinFromPath, resolveNpmBinPath, isStagedArtifactTarget, stagedArtifactId, } from '../npm/bin-links.js';
+import { resolveNpmBin, resolveNpmBinPath, isStagedArtifactTarget, stagedArtifactId, } from '../npm/bin-links.js';
 import { bundleProfileForNpmBin } from '@nimbus-sh/core/runtime/bundle-profile.js';
 import { OPENCODE_TREE_SITTER_DIAG_ARG } from '../runtime/opencode-facet-runner.js';
 import { normalizeVfsPath } from '@nimbus-sh/core/vfs/path.js';
-import { DEFAULT_PATH } from '@nimbus-sh/core/constants.js';
+import { resolveContext } from '@nimbus-sh/core/substrate/lifo/commands/registry.js';
+import { isVfsError } from '@nimbus-sh/core/vfs/vfs-error.js';
 import { z } from 'zod/v4';
+/** Whether `command` is the stub a known runtime that is not installed resolves to: no registered command. */
+export function isRuntimeInstallHint(command) {
+    return '__nimbusRuntimeInstallHint' in command && command.__nimbusRuntimeInstallHint === true;
+}
 const NpmBinPackageMetadataSchema = z.object({
     name: z.string().optional(),
     keywords: z.array(z.string()).optional(),
@@ -19,10 +24,10 @@ const NpmBinPackageMetadataSchema = z.object({
 }).passthrough();
 export function installNpmBinFallbackResolver(registry, deps) {
     const upstreamResolve = registry.resolve.bind(registry);
-    // What `registry.resolve` probes a name with before any command runs (it
-    // has no caller): the namespace as the kernel, for the registry's life.
-    // The command that then runs looks its bin up again through its own view.
-    const inspector = projectFs(new ProcessView(deps.filesystem.openHost(CRED_KERNEL).fs));
+    // Bins are probed through the caller's view, the one the command that
+    // runs looks its bin up again through; a resolution without a caller sees
+    // the namespace as the kernel.
+    const kernelView = new ProcessView(deps.filesystem.openHost(CRED_KERNEL).fs);
     // A lookup the namespace cannot answer (a mount that fails under the cwd)
     // finds no bin: the name resolves as it would with none, and only the
     // command it names fails.
@@ -35,19 +40,25 @@ export function installNpmBinFallbackResolver(registry, deps) {
         }
     };
     registry.resolve = async function resolveWithNpmBins(name, from) {
-        const cwd = from?.cwd || deps.getCwd() || '/home/user';
-        // `<dir>/node_modules/.bin/<bin>` by path (a launcher's `exec`) is the
-        // same program as the bare name: same runtime choice, TTY and lifecycle.
+        const context = from ?? resolveContext(deps.getCwd() || '/home/user', undefined, kernelView);
+        const cwd = context.cwd;
+        const inspector = projectFs(context.view);
+        // An npm bin shim by path (a launcher's `exec`, or the file a search of
+        // PATH found for a bare name) is the same program as the bare name: same
+        // runtime choice, TTY and lifecycle. The command that runs looks the
+        // shim up again through its own view, at the same path.
         if (name.startsWith('/') || name.startsWith('./') || name.startsWith('../')) {
             const bin = await probe(() => resolveNpmBinPath(inspector, cwd, name));
             if (!bin)
-                return await upstreamResolve(name, from);
-            return binHandler(bin.name, async (ctx, vfs) => await resolveNpmBinPath(vfs, ctx.cwd || '/home/user', name));
+                return await upstreamResolve(name, context);
+            return binHandler(bin.name, async (vfs) => await resolveNpmBinPath(vfs, cwd, name), true);
         }
-        const upstream = await upstreamResolve(name, from);
+        // Registered commands, then PATH (searched upstream), then the bins of
+        // the node_modules directories from the cwd up.
+        const upstream = await upstreamResolve(name, context);
         if (upstream)
             return upstream;
-        if (!await probe(() => resolveNpmBinForInvocation(inspector, cwd, DEFAULT_PATH, name))) {
+        if (!context.search || !await probe(() => resolveNpmBin(inspector, cwd, name))) {
             let hint = null;
             try {
                 hint = await deps.runtimeCommandHint(name);
@@ -65,16 +76,25 @@ export function installNpmBinFallbackResolver(registry, deps) {
             hintHandler.__nimbusRuntimeInstallHint = true;
             return hintHandler;
         }
-        return binHandler(name, async (ctx, vfs) => await resolveNpmBinForInvocation(vfs, ctx.cwd || '/home/user', ctx.env?.PATH || DEFAULT_PATH, name));
+        return binHandler(name, async (vfs) => await resolveNpmBin(vfs, cwd, name), false);
     };
-    function binHandler(name, lookup) {
+    /**
+     * The command that runs an npm bin. `executesShim`: the shim file is what
+     * was invoked (by its path, or found on PATH), so the caller must be
+     * allowed to execute it, as execve checks; a bare name found in the cwd's
+     * node_modules/.bin runs the package's program, as npm's own lookup does,
+     * whatever mode an older install left its shim with.
+     */
+    function binHandler(name, lookup, executesShim) {
         return async (ctx) => {
             const invocationCwd = ctx.cwd || '/home/user';
-            // The bin as this command sees it, through its own view.
+            // The bin as this command sees it, through its own view; what it runs
+            // is resolved through that view too.
             const vfs = projectFs(ctx.vfs);
+            const from = resolveContext(invocationCwd, ctx.env, ctx.vfs);
             let bin;
             try {
-                bin = await lookup(ctx, vfs);
+                bin = await lookup(vfs);
             }
             catch (error) {
                 ctx.stderr.write(`${name}: ${error instanceof Error ? error.message : String(error)}\n`);
@@ -84,6 +104,17 @@ export function installNpmBinFallbackResolver(registry, deps) {
                 ctx.stderr.write(`${name}: command not found\n`);
                 return 127;
             }
+            if (executesShim) {
+                try {
+                    await ctx.vfs.access('/' + bin.shimPath, X_OK);
+                }
+                catch (error) {
+                    if (!isVfsError(error, 'EACCES') && !isVfsError(error, 'EPERM'))
+                        throw error;
+                    ctx.stderr.write(`/${bin.shimPath}: Permission denied\n`);
+                    return 126;
+                }
+            }
             const argv = Array.isArray(ctx.args) ? ctx.args.map(String) : [];
             // Staged-artifact sentinel (e.g. opencode): the runnable bundle lives in
             // the static-assets layer, not the VFS. Dispatch it through the
@@ -97,7 +128,7 @@ export function installNpmBinFallbackResolver(registry, deps) {
             // program: run it the way a path-shaped invocation of it runs.
             const runtimeName = await npmBinRuntimeForTarget(vfs, bin.targetPath);
             if (runtimeName === null) {
-                const execCmd = await upstreamResolve('/' + bin.shimPath);
+                const execCmd = await upstreamResolve('/' + bin.shimPath, from);
                 if (typeof execCmd !== 'function') {
                     ctx.stderr.write(`${name}: command not found\n`);
                     return 127;
@@ -108,7 +139,7 @@ export function installNpmBinFallbackResolver(registry, deps) {
             const metadata = await readNpmBinPackageMetadata(vfs, bin.packagePath);
             const attachedTty = looksAttachedTtyNpmBin(metadata, argv, ctx.env);
             const longRunning = attachedTty || looksLongRunningNpmBin(name, argv);
-            const runtimeCmd = await upstreamResolve(runtimeName);
+            const runtimeCmd = await upstreamResolve(runtimeName, from);
             if (typeof runtimeCmd !== 'function') {
                 ctx.stderr.write(`${name}: ${runtimeName} command unavailable\n`);
                 return 1;
@@ -180,17 +211,14 @@ export function installNpmBinFallbackResolver(registry, deps) {
         };
     }
 }
-async function resolveNpmBinForInvocation(vfs, cwd, envPath, name) {
-    return await resolveNpmBinFromPath(vfs, cwd, envPath, name)
-        ?? await resolveNpmBin(vfs, cwd, name);
-}
 async function runStagedArtifact(deps, name, artifact, argv, cwd, ctx, disposition) {
     const shellLine = `${name} ${argv.join(' ')}`.trim();
     const startedAt = Date.now();
     const fm = deps.getFacetManager();
     // Piped stdin is not yet wired for staged artifacts; the interactive TUI reads
     // keystrokes from the live ProcessInputStore via the attached-TTY stdin pump.
-    const base = { argv, env: ctx.env ?? {}, cwd, command: shellLine };
+    // The program carries the exec id of the command that runs it.
+    const base = { argv, env: ctx.env ?? {}, cwd, command: shellLine, invokerPid: ctx.pid };
     let result;
     try {
         // Same contract as the node-bin path: a user-invoked program runs to

package/dist/vfs/facet-resident-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"facet-resident-store.d.ts","sourceRoot":"","sources":["../../src/vfs/facet-resident-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoLG;AAUH;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B,MAAM,CAAC;AAEnD;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,OAA2B,CAAC;AAClE,eAAO,MAAM,yBAAyB,QAA8B,CAAC;AAErE;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,2BAA2B,QAozEhC,CAAC;AAET,iFAAiF;AACjF,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,UAAU,GAAG;IAAE,KAAK,EAAE,QAAQ,CAAA;CAAE,CAAC;AAErE;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1D,KAAK,IAAI,IAAI,CAAC;IACd,KAAK,IAAI;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;CACjE"}
+{"version":3,"file":"facet-resident-store.d.ts","sourceRoot":"","sources":["../../src/vfs/facet-resident-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoLG;AAUH;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B,MAAM,CAAC;AAEnD;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,OAA2B,CAAC;AAClE,eAAO,MAAM,yBAAyB,QAA8B,CAAC;AAErE;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,2BAA2B,QA0zEhC,CAAC;AAET,iFAAiF;AACjF,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,UAAU,GAAG;IAAE,KAAK,EAAE,QAAQ,CAAA;CAAE,CAAC;AAErE;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1D,KAAK,IAAI,IAAI,CAAC;IACd,KAAK,IAAI;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;CACjE"}

package/dist/vfs/facet-resident-store.js

@@ -629,7 +629,7 @@ function __residentTablesOnSql(sql) {
     nsOfKind(kind) { return [...sql.exec("SELECT parent, name FROM ns WHERE kind = ?", kind)]; },
     // Directories whose entries the listing did not name (__nsUnlisted): their target is the mount point.
     nsUnlisted() { return [...sql.exec("SELECT parent, name, target FROM ns WHERE kind = ? AND target IS NOT NULL", __NS_DIR)]; },
-    nsChildren(parent) { return [...sql.exec("SELECT name, kind FROM ns WHERE parent = ?", parent)]; },
+    nsChildren(parent) { return [...sql.exec("SELECT name, kind, mode FROM ns WHERE parent = ?", parent)]; },
     nsCount() { const row = first(sql.exec("SELECT count(*) AS n FROM ns")); return row === undefined ? 0 : Number(row.n); },
   };
 }
@@ -874,7 +874,7 @@ function __residentTablesInMemory() {
     nsChildren(parent) {
       const dir = ns.get(parent);
       if (!dir) return [];
-      return [...dir.keys()].sort(byName).map((name) => ({ name, kind: dir.get(name).kind }));
+      return [...dir.keys()].sort(byName).map((name) => ({ name, kind: dir.get(name).kind, mode: dir.get(name).mode }));
     },
     nsCount() { return names; },
   };
@@ -1454,13 +1454,19 @@ function __nsLoadLinks(t) {
 
 /**
  * The mount a lookup of \`k\` lands on unlisted: the mount point of the
- * nearest unlisted directory at \`k\` (when \`self\`) or above it, or null.
+ * nearest directory the namespace holds at \`k\` (when \`self\`) or above
+ * it, when that directory is unlisted, or null. A listed directory is known
+ * whatever is above it: a device mount that resolves its own paths can show
+ * a directory whose parents it will not list.
  */
 function __nsUnlistedOver(k, self) {
   if (__nsUnlisted.size === 0) return null;
+  const t = __residentRequire();
   for (let at = self ? k : __nsSplit(k)[0]; at !== ""; at = __nsSplit(at)[0]) {
     const mount = __nsUnlisted.get(at);
     if (mount !== undefined) return mount;
+    const row = __nsRowAt(t, at);
+    if (row && Number(row.kind) === __NS_DIR) return null;
   }
   return null;
 }
@@ -1624,9 +1630,9 @@ function __nsUnknown(k, followLeaf, listing) {
   return listing ? __nsUnlistedOver(found.path, true) : null;
 }
 
-/** The entries directly under directory \`k\` (already resolved): [{ name, kind }]. */
+/** The entries directly under directory \`k\` (already resolved): [{ name, kind, mode }]; the mode says what a file kind is. */
 function __nsChildren(k) {
-  return __residentRequire().nsChildren(k).map((row) => ({ name: String(row.name), kind: Number(row.kind) }));
+  return __residentRequire().nsChildren(k).map((row) => ({ name: String(row.name), kind: Number(row.kind), mode: Number(row.mode) }));
 }
 
 /** Whether the credential may search directory \`row\` (POSIX x). */

package/dist/wrangler/nimbus-wrangler.d.ts

@@ -100,6 +100,14 @@ export declare class NimbusWrangler {
      */
     private resolveEntryPath;
     private buildAndLoad;
+    /**
+     * Checks that `worker` (the inner Worker, loaded) exports each binding's
+     * class, asking its own isolate once through its `classesEntrypoint`
+     * (which also runs its module code, so an error there is the build's),
+     * then registers each class for the session's facets to run. False,
+     * logged, when one is missing.
+     */
+    private registerDoClasses;
     private buildInnerEnv;
     private handleVfsEvents;
     /**

package/dist/wrangler/nimbus-wrangler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nimbus-wrangler.d.ts","sourceRoot":"","sources":["../../src/wrangler/nimbus-wrangler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4CAA4C,CAAC;AACjF,OAAO,KAAK,EAAY,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAsD/E,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,eAAe,CAAC;IACrB,SAAS,EAAE,eAAe,CAAC;IAC3B,OAAO,EAAE,cAAc,CAAC;IACxB,GAAG,EAAE,GAAG,CAAC;IACT;;;;OAIG;IACH,GAAG,CAAC,EAAE,GAAG,CAAC;IACV,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,YAAY,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC;CAClC;AAID;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,MAAM,EACvB,iBAAiB,EAAE,MAAM,GACxB,MAAM,CA+BR;AAyDD,qBAAa,cAAc;IACzB,OAAO,CAAC,GAAG,CAAkB;IAC7B,OAAO,CAAC,SAAS,CAAkB;IACnC,OAAO,CAAC,OAAO,CAAiB;IAChC,OAAO,CAAC,SAAS,CAAM;IACvB,OAAO,CAAC,aAAa,CAAM;IAC3B,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,KAAK,CAAwB;IACrC,OAAO,CAAC,YAAY,CAAqB;IAEzC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAA+B;IAC7C,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,QAAQ,CAA6B;IAC7C,OAAO,CAAC,YAAY,CAAa;IACjC,6EAA6E;IAC7E,OAAO,CAAC,UAAU,CAA+B;gBAErC,IAAI,EAAE,qBAAqB;IAWvC,qCAAqC;IAC/B,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC;IAqB/B,oCAAoC;IACpC,IAAI,IAAI,IAAI;IAaZ,IAAI,SAAS,YAA2B;IAIxC,OAAO,CAAC,UAAU;IAiDlB,oFAAoF;IACpF,OAAO,CAAC,gBAAgB;IAqBxB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,gBAAgB;YAIV,YAAY;IA2L1B,OAAO,CAAC,aAAa;IAoOrB,OAAO,CAAC,eAAe;IAkCvB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACG,aAAa,CACjB,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,MAAM;IAChB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,QAAQ,CAAC;IAsFpB,IAAI,KAAK;;;;;;MAQR;IAYD,8FAA8F;IAC9F,kBAAkB,IAAI,OAAO;IAK7B,+EAA+E;IAC/E,qBAAqB,IAAI,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;IAI5C;;;;;gCAK4B;IAC5B,uBAAuB,IAAI,IAAI;CA4BhC"}
+{"version":3,"file":"nimbus-wrangler.d.ts","sourceRoot":"","sources":["../../src/wrangler/nimbus-wrangler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4CAA4C,CAAC;AACjF,OAAO,KAAK,EAAY,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAuD/E,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,eAAe,CAAC;IACrB,SAAS,EAAE,eAAe,CAAC;IAC3B,OAAO,EAAE,cAAc,CAAC;IACxB,GAAG,EAAE,GAAG,CAAC;IACT;;;;OAIG;IACH,GAAG,CAAC,EAAE,GAAG,CAAC;IACV,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,YAAY,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC;CAClC;AAID;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,MAAM,EACvB,iBAAiB,EAAE,MAAM,GACxB,MAAM,CA+BR;AAyDD,qBAAa,cAAc;IACzB,OAAO,CAAC,GAAG,CAAkB;IAC7B,OAAO,CAAC,SAAS,CAAkB;IACnC,OAAO,CAAC,OAAO,CAAiB;IAChC,OAAO,CAAC,SAAS,CAAM;IACvB,OAAO,CAAC,aAAa,CAAM;IAC3B,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,KAAK,CAAwB;IACrC,OAAO,CAAC,YAAY,CAAqB;IAEzC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAA+B;IAC7C,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,QAAQ,CAA6B;IAC7C,OAAO,CAAC,YAAY,CAAa;IACjC,6EAA6E;IAC7E,OAAO,CAAC,UAAU,CAA+B;gBAErC,IAAI,EAAE,qBAAqB;IAWvC,qCAAqC;IAC/B,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC;IAqB/B,oCAAoC;IACpC,IAAI,IAAI,IAAI;IAaZ,IAAI,SAAS,YAA2B;IAIxC,OAAO,CAAC,UAAU;IAiDlB,oFAAoF;IACpF,OAAO,CAAC,gBAAgB;IAqBxB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,gBAAgB;YAIV,YAAY;IA8J1B;;;;;;OAMG;YACW,iBAAiB;IAyB/B,OAAO,CAAC,aAAa;IAiOrB,OAAO,CAAC,eAAe;IAkCvB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACG,aAAa,CACjB,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,MAAM;IAChB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,QAAQ,CAAC;IAsFpB,IAAI,KAAK;;;;;;MAQR;IAYD,8FAA8F;IAC9F,kBAAkB,IAAI,OAAO;IAK7B,+EAA+E;IAC/E,qBAAqB,IAAI,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;IAI5C;;;;;gCAK4B;IAC5B,uBAAuB,IAAI,IAAI;CA4BhC"}

package/dist/wrangler/nimbus-wrangler.js

@@ -16,6 +16,7 @@
 import { normalizeVfsPath } from '@nimbus-sh/core/vfs/path.js';
 import { CF_COMPAT_DATE } from '@nimbus-sh/core/constants.js';
 import { registerInnerDoClass, clearInnerDoClasses, abortInnerDoFacets } from '@nimbus-sh/fabric/inner-do-registry.js';
+import { innerWorkerModules } from '@nimbus-sh/fabric/inner-do-env.js';
 import { KvEmulator } from '../bindings/kv.js';
 import { D1Emulator } from '../bindings/d1.js';
 import { R2Emulator } from '../bindings/r2.js';
@@ -321,7 +322,7 @@ export class NimbusWrangler {
             this.onLog(`\x1b[31mEntry point not found: ${entryPoint}\x1b[0m\n`);
             return false;
         }
-        // Bundle via esbuild
+        // Bundle (EsbuildService.build: the build facet, rolldown)
         this.onLog('  Building Worker...\n');
         try {
             // [WRANGLER-DEV-HANG P0b] Time-bound the bundle. Pre-fix,
@@ -391,16 +392,7 @@ export class NimbusWrangler {
             if (this.supervisorCtx) {
                 abortInnerDoFacets(this.supervisorCtx, this.doClassMap.keys(), new Error('nimbus-wrangler rebuilding'));
             }
-            // Two-pass load to break the chicken-and-egg:
-            //   Pass 1: load with NO env to extract any durable_objects classes.
-            //           buildInnerEnv needs this.doClassMap to synthesize DO
-            //           namespace bindings, but getDurableObjectClass() needs a
-            //           worker stub, which we get only by loading.
-            //   Pass 2: re-load with FULL env (including DO namespace shims)
-            //           that the inner Worker actually uses.
-            //
-            // workerd caches by content hash, so the second load is cheap —
-            // it reuses the same compiled isolate and just swaps env.
+            this.doClassMap.clear();
             const wrangCompatDate = this.config.compatibility_date || CF_COMPAT_DATE;
             // Filter flags that workerd refuses on dynamic-worker LOADER.load().
             // `experimental` gates behind the parent process's --experimental
@@ -419,46 +411,27 @@ export class NimbusWrangler {
             if (rawFlags.length !== wrangCompatFlags.length) {
                 this.onLog(`  \x1b[2mnote: stripped 'experimental' from inner compat_flags (not propagatable via LOADER.load)\x1b[0m\n`);
             }
-            const baseWorkerCode = {
-                compatibilityDate: wrangCompatDate,
-                compatibilityFlags: wrangCompatFlags,
-                mainModule: 'worker.js',
-                modules: { 'worker.js': bundledCode },
-            };
-            // Pass 1: class extraction (no env, no DO shims).
-            this.doClassMap.clear();
             const doBindings = this.config.durable_objects?.bindings || [];
-            if (doBindings.length > 0) {
-                let probeWorker;
-                try {
-                    probeWorker = this.loaderEnv.LOADER.load(baseWorkerCode);
-                }
-                catch (e) {
-                    this.onLog(`  \x1b[31mBuild error (probe load): ${e?.message || e}\x1b[0m\n`);
+            for (const b of doBindings) {
+                if (b.script_name && b.script_name !== this.config.name) {
+                    this.onLog(`  \x1b[31merror: durable_objects binding '${b.name}' references external script '${b.script_name}'. nimbus-wrangler cannot load external Workers by name.\x1b[0m\n`);
                     return false;
                 }
-                for (const b of doBindings) {
-                    if (b.script_name && b.script_name !== this.config.name) {
-                        this.onLog(`  \x1b[31merror: durable_objects binding '${b.name}' references external script '${b.script_name}'. nimbus-wrangler cannot load external Workers by name.\x1b[0m\n`);
-                        return false;
-                    }
-                    try {
-                        const cls = probeWorker.getDurableObjectClass(b.class_name);
-                        this.doClassMap.set(b.name, cls);
-                    }
-                    catch (e) {
-                        this.onLog(`  \x1b[31merror: durable_objects binding '${b.name}' => class '${b.class_name}' not found in bundle: ${e?.message || e}\x1b[0m\n`);
-                        return false;
-                    }
-                }
             }
-            // Pass 2: real load with the full synthesized env. buildInnerEnv
-            // reads this.doClassMap populated above.
-            const innerEnv = this.buildInnerEnv();
+            // One load, with the full env. A Durable Object binding is a local
+            // namespace in the inner isolate, over the binding the loader passes
+            // (inner-do-env.ts): the bundle's first import replaces it in the env
+            // every handler, entrypoint and object of the isolate sees.
+            const { mainModule, modules, classesEntrypoint } = innerWorkerModules(bundledCode, doBindings.map((b) => b.name));
             const worker = this.loaderEnv.LOADER.load({
-                ...baseWorkerCode,
-                env: innerEnv,
+                compatibilityDate: wrangCompatDate,
+                compatibilityFlags: wrangCompatFlags,
+                mainModule,
+                modules,
+                env: this.buildInnerEnv(),
             });
+            if (classesEntrypoint !== null && !(await this.registerDoClasses(worker, classesEntrypoint, doBindings)))
+                return false;
             this.workerStub = worker.getEntrypoint();
             for (const w of result.warnings || []) {
                 this.onLog(`  \x1b[33mwarning: ${w.text}\x1b[0m\n`);
@@ -486,6 +459,33 @@ export class NimbusWrangler {
     // At the end of each phase the inner Worker has one more kind of binding
     // it can access by name. Phase 0 is the plumbing: adding the `env` field
     // to LOADER.load() at all, plus forwarding plain string vars.
+    /**
+     * Checks that `worker` (the inner Worker, loaded) exports each binding's
+     * class, asking its own isolate once through its `classesEntrypoint`
+     * (which also runs its module code, so an error there is the build's),
+     * then registers each class for the session's facets to run. False,
+     * logged, when one is missing.
+     */
+    async registerDoClasses(worker, classesEntrypoint, bindings) {
+        const missing = new Set(await worker.getEntrypoint(classesEntrypoint).missing(bindings.map((b) => b.class_name)));
+        for (const b of bindings) {
+            if (missing.has(b.class_name)) {
+                this.onLog(`  \x1b[31merror: durable_objects binding '${b.name}' => class '${b.class_name}' is not exported by the Worker\x1b[0m\n`);
+            }
+        }
+        if (missing.size > 0)
+            return false;
+        const doId = this.supervisorCtx?.id?.toString?.() || '';
+        if (doId)
+            clearInnerDoClasses(doId);
+        for (const b of bindings) {
+            const cls = worker.getDurableObjectClass(b.class_name);
+            this.doClassMap.set(b.name, cls);
+            if (doId)
+                registerInnerDoClass(doId, b.name, cls);
+        }
+        return true;
+    }
     buildInnerEnv() {
         const env = {};
         // ── vars ──
@@ -584,29 +584,26 @@ export class NimbusWrangler {
             }
         }
         // ── durable_objects ──
-        // Inner worker: env[binding].idFromName(name) + env[binding].get(id).fetch(req).
-        // The class list was resolved and stored in this.doClassMap during
-        // buildAndLoad(); register each class into the module-level
-        // registry consulted by _rpcInnerDoFetch, then synthesize the
-        // namespace stub via ctx.exports.NimbusDurableObjectNamespace(...).
-        if (this.doClassMap.size > 0) {
+        // Inner worker: env[binding] is a local namespace (inner-do-env.ts) over
+        // the binding made here, whose fetchOn, callOn and getOn each stub
+        // relays to. buildAndLoad registers the classes, from the load this env
+        // goes into, in the registry _rpcInnerDoFetch and _rpcInnerDoCall read.
+        const doBindingNames = (this.config?.durable_objects?.bindings || []).map((b) => b.name);
+        if (doBindingNames.length > 0) {
             const ctxExports = this.supervisorCtx?.exports;
             const doId = this.supervisorCtx?.id?.toString?.() || '';
             if (!ctxExports?.NimbusDurableObjectNamespace) {
-                for (const [bindingName] of this.doClassMap) {
+                for (const bindingName of doBindingNames) {
                     this.onLog(`  \x1b[33mwarning: ctx.exports.NimbusDurableObjectNamespace unavailable; env.${bindingName} will not work\x1b[0m\n`);
                 }
             }
             else if (!doId) {
-                for (const [bindingName] of this.doClassMap) {
+                for (const bindingName of doBindingNames) {
                     this.onLog(`  \x1b[33mwarning: supervisor DO id unavailable; env.${bindingName} will not work\x1b[0m\n`);
                 }
             }
             else {
-                // Clear + repopulate the registry for this supervisor DO id.
-                clearInnerDoClasses(doId);
-                for (const [bindingName, cls] of this.doClassMap) {
-                    registerInnerDoClass(doId, bindingName, cls);
+                for (const bindingName of doBindingNames) {
                     if (bindingName in env) {
                         this.onLog(`  \x1b[33mwarning: durable_objects binding '${bindingName}' overwrites a previous key\x1b[0m\n`);
                     }