@norskvideo/ctl-product-template-schema 0.1.61 → 0.1.62

package/index.js

@@ -601,11 +601,14 @@ const ProductTemplateFileSchema = z.object({
 // subpath) turns this into tar bytes at the paths below.
 //
 // `workflow`, `components` and `dashboards` are known top-level paths in the
-// v1 tar format. The runner detects studio in the compose stack and mounts
-// all three into the studio container automatically — products don't need
-// to declare the mounts.
+// v1 tar format. The runner detects studio in the compose stack and places
+// all three in the studio container automatically — products don't need
+// to declare the mounts. workflow.yml is COPIED into the working directory on
+// every launch (a single-file bind under /data is refused by OrbStack and
+// Docker Desktop); the template stays authoritative, so a Studio save of it
+// lasts only until the next launch.
 //
-//   workflow.yml         → /data/studio-save-files/workflow.yml (RO)
+//   workflow.yml         → /data/studio-save-files/workflow.yml (copied)
 //   components/<name>/   → /usr/src/app/plugins/<name>/         (RO)
 //   dashboards/<name>/   → /data/studio-save-files/<name>/dashboards/ (RO)
 //

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-product-template-schema",
-  "version": "0.1.61",
+  "version": "0.1.62",
   "type": "module",
   "repository": {
     "type": "git",

package/workdir-path.js

@@ -10,14 +10,19 @@
 // Two separate hazards, deliberately not conflated:
 //   escape    — `../../etc/x` writes outside the workdir. A hole.
 //   shadowing — a file written UNDER one of the runner's read-only bind
-//               mounts is on disk and invisible to the container. Not a
-//               security problem, but a miserable one to debug, so it is
-//               refused at upload time rather than discovered at runtime.
-/** Runner-managed read-only mount points inside the working directory
- *  (override-generator.ts). `workflow.yml` is a file mount; the other two are
- *  directory mounts, so anything beneath them is shadowed too. */
+//               mounts is on disk and invisible to the container, and a file
+//               at a path the launch writes itself is never the one used.
+//               Not a security problem, but a miserable one to debug, so it
+//               is refused at upload time rather than discovered at runtime.
+/** Files the launch writes into the working directory itself. The product
+ *  template's workflow.yml is copied to the path Studio's `server.document`
+ *  names on every launch (norsk-ctl's workflow-sync.ts; it used to be a
+ *  read-only single-file bind, which OrbStack and Docker Desktop refuse), so an
+ *  operator asset there is replaced or skipped and never opened. */
+const RUNNER_WRITTEN_FILES = ["studio-save-files/workflow.yml"];
+/** Runner-managed read-only directory mount points inside the working
+ *  directory (override-generator.ts); anything beneath them is shadowed. */
 const READONLY_MOUNTS = {
-    file: ["studio-save-files/workflow.yml"],
     dir: [".norsk"],
     /** `studio-save-files/<anything>/dashboards` — the per-workflow dashboard mount. */
     pattern: [/^studio-save-files\/[^/]+\/dashboards(\/|$)/],
@@ -46,9 +51,17 @@ export function checkWorkdirPath(raw) {
             message: `'${path}' lands under the read-only mount '${mount}', where it would be on disk but invisible to the container`,
         },
     });
-    for (const file of READONLY_MOUNTS.file)
-        if (path === file)
-            return shadowed(file);
+    for (const file of RUNNER_WRITTEN_FILES) {
+        if (path === file) {
+            return {
+                ok: false,
+                problem: {
+                    kind: "shadowed",
+                    message: `'${path}' is where each launch copies the product template's workflow.yml, so an asset there would never be the one Studio opens`,
+                },
+            };
+        }
+    }
     for (const dir of READONLY_MOUNTS.dir)
         if (path === dir || path.startsWith(`${dir}/`))
             return shadowed(dir);