@ricsam/r5d-macos-vm 0.0.133 → 0.0.161

package/README.md

@@ -27,7 +27,7 @@ r5d-macos-vm create build-mac \
   --disk-bytes 85899345920
 ```
 
-Complete macOS Setup Assistant in the VM, then double-click `/Volumes/My Shared Files/r5d Setup/Install r5d.command`. The shared bootstrap opens a visible Terminal, installs Homebrew and the r5d command-line tools, and starts worker enrollment. On another device, visit `https://r5d.dev/auth` and enter the displayed code, or scan its QR code. The worker starts only after authorization succeeds.
+Complete macOS Setup Assistant in the VM, then double-click `/Volumes/My Shared Files/r5d Setup/Install r5d.command`. It installs development tools and a visible executor launcher. The installation operator must provision the private `~/Library/Application Support/r5d/executor.json` and matching manager, workspace, and network configuration. The launcher invokes `r5d-worker executor` with that file; there is no device-pairing endpoint.
 
 Useful commands:
 

package/bootstrap/Install r5d.command

@@ -77,5 +77,5 @@ print
 touch "$STATE_DIR/bootstrap-complete"
 chmod 600 "$STATE_DIR/bootstrap-complete"
 print
-print "Tools installed. The visible r5d worker Terminal is opening for authorization and startup…"
+print "Tools installed. The visible r5d worker Terminal is opening for configured executor startup…"
 print "You may close this setup window."

package/bootstrap/README.txt

@@ -1,7 +1,7 @@
 r5d macOS VM guest setup
 
-After completing macOS Setup Assistant, open “Install r5d.command” from this
-folder. It installs the development tools, asks you to authorize the worker,
-and configures a visible r5d-worker Terminal at each graphical login.
-
-The installer is idempotent and safe to run again after an interrupted step.
+After completing macOS Setup Assistant, open “Install r5d.command”. It installs
+local tools and a visible executor launcher. The installation operator must
+provision a private executor.json in ~/Library/Application Support/r5d together
+with matching manager, workspace, and private network access configuration.
+The launcher uses that configuration and does not perform device enrollment.

package/bootstrap/start-worker.command.template

@@ -1,103 +1,13 @@
 #!/bin/zsh
 set -euo pipefail
-
-export PATH="/opt/homebrew/bin:$HOME/.bun/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin"
+export PATH="/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin"
 STATE_DIR="$HOME/Library/Application Support/r5d"
-LOCK_DIR="$STATE_DIR/worker-credential-authority.lock"
-BOOT_SESSION_ID="$(/usr/sbin/sysctl -n kern.bootsessionuuid 2>/dev/null | /usr/bin/tr '[:upper:]' '[:lower:]' || true)"
-if [[ ! "$BOOT_SESSION_ID" =~ ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$ ]]; then
-  BOOT_SESSION_ID="unknown"
+CONFIG_FILE="$STATE_DIR/executor.json"
+if [[ ! -f "$CONFIG_FILE" || -L "$CONFIG_FILE" ]]; then
+  print -u2 "This VM needs its installation's private executor configuration at: $CONFIG_FILE"
+  print -u2 "Have the installation operator provision the executor and its matching workspace and manager services."
+  exit 1
 fi
-RECOVERY_GUARD="$STATE_DIR/worker-lock-recovery-$BOOT_SESSION_ID.lock"
-
-mkdir -p "$STATE_DIR"
-chmod 700 "$STATE_DIR"
-
-while ! mkdir "$LOCK_DIR" 2>/dev/null; do
-  existing_pid="$(cat "$LOCK_DIR/pid" 2>/dev/null || true)"
-  if [[ "$existing_pid" == <-> ]] && kill -0 "$existing_pid" 2>/dev/null; then
-    existing_command="$(ps -ww -p "$existing_pid" -o command= 2>/dev/null || true)"
-    if [[ -n "$existing_command" && "$existing_command" == *"start-worker.command"* ]]; then
-      print "An r5d-worker credential authority is already running in another Terminal (PID $existing_pid)."
-      read -r "?Press Return to close this window: "
-      exit 0
-    fi
-  fi
-
-  # A newly-created lock may not have its PID file yet. Never reap that
-  # acquisition window; only recover ownerless locks that have stayed stale.
-  lock_modified_at="$(stat -f %m "$LOCK_DIR" 2>/dev/null || print 0)"
-  current_epoch="$(date +%s)"
-  if [[ "$lock_modified_at" == <-> ]] && (( current_epoch - lock_modified_at < 60 )); then
-    sleep 1
-    continue
-  fi
-
-  if ! mkdir "$RECOVERY_GUARD" 2>/dev/null; then
-    recovery_modified_at="$(stat -f %m "$RECOVERY_GUARD" 2>/dev/null || print 0)"
-    if [[ "$recovery_modified_at" == <-> ]] && (( current_epoch - recovery_modified_at >= 60 )); then
-      print "A prior worker-lock recovery was interrupted in this boot session. Reboot the VM before retrying."
-      read -r "?Press Return to close this window: "
-      exit 1
-    fi
-    sleep 1
-    continue
-  fi
-
-  # Re-read under the boot-scoped recovery guard. Without this second check,
-  # two stale-lock contenders can move a newly acquired live lock (ABA).
-  guarded_pid="$(cat "$LOCK_DIR/pid" 2>/dev/null || true)"
-  if [[ "$guarded_pid" == <-> ]] && kill -0 "$guarded_pid" 2>/dev/null; then
-    guarded_command="$(ps -ww -p "$guarded_pid" -o command= 2>/dev/null || true)"
-    if [[ -n "$guarded_command" && "$guarded_command" == *"start-worker.command"* ]]; then
-      rmdir "$RECOVERY_GUARD" 2>/dev/null || true
-      print "An r5d-worker credential authority is already running in another Terminal (PID $guarded_pid)."
-      read -r "?Press Return to close this window: "
-      exit 0
-    fi
-  fi
-  stale_lock="$LOCK_DIR.stale.$$.$RANDOM"
-  if mv "$LOCK_DIR" "$stale_lock" 2>/dev/null; then
-    rm -rf "$stale_lock"
-  fi
-  rmdir "$RECOVERY_GUARD" 2>/dev/null || true
-done
-
-print $$ > "$LOCK_DIR/pid"
-chmod 600 "$LOCK_DIR/pid"
-cleanup() { rm -rf "$LOCK_DIR"; }
-trap cleanup EXIT INT TERM HUP
-
-print "Starting r5d-worker (__WORKER_LABEL__)"
-print "Keep this Terminal open while the VM is available to r5d.dev."
-print
-
-auth_source="$(r5dctl --json auth status 2>/dev/null | /usr/bin/sed -n 's/.*"source"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | /usr/bin/head -n 1 || true)"
-if [[ "$auth_source" != "device" ]]; then
-  if [[ -n "$auth_source" ]]; then
-    print "The shared r5d config currently uses '$auth_source' authentication. This VM requires its own revocable device credential."
-    print
-  fi
-  print "Authorize this VM before its worker starts."
-  print
-  r5dctl auth login --no-open --device-name "r5d macOS VM (__VM_NAME__)" --worker-label "__WORKER_LABEL__"
-  print
-fi
-
-r5d-worker start --label "__WORKER_LABEL__" &
-worker_pid=$!
-trap 'kill -INT "$worker_pid" 2>/dev/null || true' INT TERM HUP
-set +e
-wait "$worker_pid"
-worker_status=$?
-set -e
-print
-if [[ "$worker_status" == "77" ]]; then
-  print "r5d-worker staged a credential rotation without publishing the new secret."
-  print "Shut down and restart the entire r5d macOS VM before opening this launcher again."
-  print "Closing this window, logging out, or reopening Terminal is not sufficient."
-else
-  print "r5d-worker stopped with status $worker_status."
-fi
-read -r "?Press Return to close this window: "
-exit "$worker_status"
+print "Starting configured r5d executor (__WORKER_LABEL__)"
+print "Keep this Terminal open while this execution service is in use."
+exec r5d-worker executor "$CONFIG_FILE"

package/dist/cjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-macos-vm",
-  "version": "0.0.133",
+  "version": "0.0.161",
   "type": "commonjs"
 }

package/dist/mjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-macos-vm",
-  "version": "0.0.133",
+  "version": "0.0.161",
   "type": "module"
 }

package/native-artifact.json

@@ -1,9 +1,9 @@
 {
   "schemaVersion": 1,
-  "packageVersion": "0.0.133",
-  "url": "https://downloads.r5d.dev/r5d-macos-vm/0.0.133/R5DMacOSVM.app.zip",
-  "sha256": "551554fac14cdb6588769c2485ef76e8ab1346618967b83c21861bc3551b9487",
-  "byteLength": 191303,
+  "packageVersion": "0.0.161",
+  "url": "https://downloads.r5d.dev/r5d-macos-vm/0.0.161/R5DMacOSVM.app.zip",
+  "sha256": "4372906f9fed75dc94910adc559ea8e2021573eba755fa0501af63d4b84b1e1d",
+  "byteLength": 191297,
   "archiveName": "R5DMacOSVM.app.zip",
   "appName": "R5DMacOSVM.app",
   "executableName": "R5DMacOSVM",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ricsam/r5d-macos-vm",
-  "version": "0.0.133",
+  "version": "0.0.161",
   "type": "module",
   "main": "./dist/cjs/cli.cjs",
   "module": "./dist/mjs/cli.mjs",