@ricsam/r5d-worker 0.0.12 → 0.0.14

package/dist/cjs/main.cjs

@@ -31,6 +31,8 @@ var main_exports = {};
 __export(main_exports, {
   ensureVisibleGitCheckout: () => ensureVisibleGitCheckout,
   isArtifactEnvPath: () => isArtifactEnvPath,
+  prepareArtifactEnvForShell: () => prepareArtifactEnvForShell,
+  resolveProjectFilePath: () => resolveProjectFilePath,
   syncSessionArtifacts: () => syncSessionArtifacts
 });
 module.exports = __toCommonJS(main_exports);
@@ -410,6 +412,29 @@ function rejectArtifactWritePath(filePath) {
     throw new Error(`${R5D_ARTIFACTS_DIR_REF} attachments are read-only. Copy them into a project path before editing or creating files.`);
   }
 }
+async function prepareArtifactEnvForShell(input) {
+  if (!input.sessionId) {
+    return {};
+  }
+  try {
+    await syncSessionArtifacts({
+      baseUrl: input.baseUrl,
+      token: input.token,
+      projectId: input.projectId,
+      branchName: input.branchName,
+      sessionId: input.sessionId,
+      artifactRoot: input.artifactRoot
+    });
+  } catch (error) {
+    process.stderr.write(`[r5d-worker] artifact sync skipped for ${input.sessionId}: ${error instanceof Error ? error.message : String(error)}
+`);
+  }
+  const artifactsDir = sessionArtifactDir(input.artifactRoot, input.sessionId);
+  import_node_fs.default.mkdirSync(artifactsDir, { recursive: true });
+  return {
+    R5D_ARTIFACTS_DIR: artifactsDir
+  };
+}
 async function verifyR5dctlAuth(baseUrl, token) {
   const statusUrl = new URL("/api/r5dctl/auth/status", baseUrl);
   let response;
@@ -524,9 +549,12 @@ function getInternalStatus(context) {
 function hasInternalWorktreeChanges(context) {
   return getInternalStatus(context).trim().length > 0;
 }
+function isInsideBranchPath(branchPath, filePath) {
+  const relative = import_node_path.default.relative(import_node_path.default.resolve(branchPath), import_node_path.default.resolve(filePath));
+  return relative === "" || relative !== ".." && !relative.startsWith(`..${import_node_path.default.sep}`) && !import_node_path.default.isAbsolute(relative);
+}
 function assertInsideBranch(branchPath, filePath) {
-  const relative = import_node_path.default.relative(branchPath, filePath);
-  if (relative === ".." || relative.startsWith(`..${import_node_path.default.sep}`) || import_node_path.default.isAbsolute(relative)) {
+  if (!isInsideBranchPath(branchPath, filePath)) {
     throw new Error("File path escapes the project branch");
   }
 }
@@ -534,17 +562,27 @@ function resolveProjectFilePath(branchPath, virtualPath) {
   if (typeof virtualPath !== "string" || !virtualPath.startsWith("/") || virtualPath.includes("\0")) {
     throw new Error(`File path must be an absolute project path starting with /. Got: ${JSON.stringify(virtualPath)}`);
   }
+  const checkoutAbsolutePath = import_node_path.default.resolve(virtualPath);
+  if (isInsideBranchPath(branchPath, checkoutAbsolutePath)) {
+    const checkoutVirtualPath = toVirtualPath(import_node_path.default.resolve(branchPath), checkoutAbsolutePath);
+    if (checkoutVirtualPath !== virtualPath) {
+      return resolveProjectFilePath(branchPath, checkoutVirtualPath);
+    }
+  }
+  if (virtualPath.split("/").includes("..")) {
+    throw new Error(`Invalid project file path: ${virtualPath}`);
+  }
   const normalized = import_node_path.default.posix.normalize(virtualPath);
-  if (normalized === "/" || normalized.startsWith("/../")) {
+  if (normalized.startsWith("/../")) {
     throw new Error(`Invalid project file path: ${virtualPath}`);
   }
-  const repoRelativePath = normalized.slice(1);
+  const repoRelativePath = normalized === "/" ? "" : normalized.slice(1);
   if (repoRelativePath === ".git" || repoRelativePath.startsWith(".git/")) {
     throw new Error("Refusing to access .git through worker file tools");
   }
-  const absolutePath = import_node_path.default.resolve(branchPath, ...repoRelativePath.split("/"));
+  const absolutePath = repoRelativePath ? import_node_path.default.resolve(branchPath, ...repoRelativePath.split("/")) : import_node_path.default.resolve(branchPath);
   assertInsideBranch(branchPath, absolutePath);
-  return { absolutePath, virtualPath: `/${repoRelativePath}`, repoRelativePath };
+  return { absolutePath, virtualPath: repoRelativePath ? `/${repoRelativePath}` : "/", repoRelativePath };
 }
 function branchLockKey(projectId, branchName) {
   return `${projectId}:${branchName}`;
@@ -1486,18 +1524,14 @@ async function executeCommand(input) {
       branchName: input.message.branchName,
       manifest: input.manifest
     });
-    let artifactProcessEnv = {};
-    if (input.message.sessionId) {
-      await syncSessionArtifacts({
-        baseUrl: input.baseUrl,
-        token: input.token,
-        projectId: input.projectId,
-        branchName: input.message.branchName,
-        sessionId: input.message.sessionId,
-        artifactRoot: input.artifactRoot
-      });
-      artifactProcessEnv = artifactEnv(input.artifactRoot, input.message.sessionId);
-    }
+    const artifactProcessEnv = await prepareArtifactEnvForShell({
+      baseUrl: input.baseUrl,
+      token: input.token,
+      projectId: input.projectId,
+      branchName: input.message.branchName,
+      sessionId: input.message.sessionId,
+      artifactRoot: input.artifactRoot
+    });
     const cwd = resolveCommandCwd(workspace.branchPath, input.message.cwd);
     const subprocess = Bun.spawn(input.message.argv, {
       cwd,
@@ -1571,7 +1605,7 @@ async function executeStreamingCommand(input) {
       branchName: input.message.branchName,
       manifest: input.manifest
     });
-    await syncSessionArtifacts({
+    const artifactProcessEnv = await prepareArtifactEnvForShell({
       baseUrl: input.baseUrl,
       token: input.token,
       projectId: input.projectId,
@@ -1579,7 +1613,6 @@ async function executeStreamingCommand(input) {
       sessionId: input.message.sessionId,
       artifactRoot: input.artifactRoot
     });
-    const artifactProcessEnv = artifactEnv(input.artifactRoot, input.message.sessionId);
     const cwd = resolveCommandCwd(workspace.branchPath, input.message.cwd);
     const subprocess = Bun.spawn(input.message.argv, {
       cwd,
@@ -2218,5 +2251,7 @@ if (isCliEntrypoint()) {
 0 && (module.exports = {
   ensureVisibleGitCheckout,
   isArtifactEnvPath,
+  prepareArtifactEnvForShell,
+  resolveProjectFilePath,
   syncSessionArtifacts
 });

package/dist/cjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.12",
+  "version": "0.0.14",
   "type": "commonjs"
 }

package/dist/mjs/main.mjs

@@ -374,6 +374,29 @@ function rejectArtifactWritePath(filePath) {
     throw new Error(`${R5D_ARTIFACTS_DIR_REF} attachments are read-only. Copy them into a project path before editing or creating files.`);
   }
 }
+async function prepareArtifactEnvForShell(input) {
+  if (!input.sessionId) {
+    return {};
+  }
+  try {
+    await syncSessionArtifacts({
+      baseUrl: input.baseUrl,
+      token: input.token,
+      projectId: input.projectId,
+      branchName: input.branchName,
+      sessionId: input.sessionId,
+      artifactRoot: input.artifactRoot
+    });
+  } catch (error) {
+    process.stderr.write(`[r5d-worker] artifact sync skipped for ${input.sessionId}: ${error instanceof Error ? error.message : String(error)}
+`);
+  }
+  const artifactsDir = sessionArtifactDir(input.artifactRoot, input.sessionId);
+  fs.mkdirSync(artifactsDir, { recursive: true });
+  return {
+    R5D_ARTIFACTS_DIR: artifactsDir
+  };
+}
 async function verifyR5dctlAuth(baseUrl, token) {
   const statusUrl = new URL("/api/r5dctl/auth/status", baseUrl);
   let response;
@@ -488,9 +511,12 @@ function getInternalStatus(context) {
 function hasInternalWorktreeChanges(context) {
   return getInternalStatus(context).trim().length > 0;
 }
+function isInsideBranchPath(branchPath, filePath) {
+  const relative = path.relative(path.resolve(branchPath), path.resolve(filePath));
+  return relative === "" || relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+}
 function assertInsideBranch(branchPath, filePath) {
-  const relative = path.relative(branchPath, filePath);
-  if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+  if (!isInsideBranchPath(branchPath, filePath)) {
     throw new Error("File path escapes the project branch");
   }
 }
@@ -498,17 +524,27 @@ function resolveProjectFilePath(branchPath, virtualPath) {
   if (typeof virtualPath !== "string" || !virtualPath.startsWith("/") || virtualPath.includes("\0")) {
     throw new Error(`File path must be an absolute project path starting with /. Got: ${JSON.stringify(virtualPath)}`);
   }
+  const checkoutAbsolutePath = path.resolve(virtualPath);
+  if (isInsideBranchPath(branchPath, checkoutAbsolutePath)) {
+    const checkoutVirtualPath = toVirtualPath(path.resolve(branchPath), checkoutAbsolutePath);
+    if (checkoutVirtualPath !== virtualPath) {
+      return resolveProjectFilePath(branchPath, checkoutVirtualPath);
+    }
+  }
+  if (virtualPath.split("/").includes("..")) {
+    throw new Error(`Invalid project file path: ${virtualPath}`);
+  }
   const normalized = path.posix.normalize(virtualPath);
-  if (normalized === "/" || normalized.startsWith("/../")) {
+  if (normalized.startsWith("/../")) {
     throw new Error(`Invalid project file path: ${virtualPath}`);
   }
-  const repoRelativePath = normalized.slice(1);
+  const repoRelativePath = normalized === "/" ? "" : normalized.slice(1);
   if (repoRelativePath === ".git" || repoRelativePath.startsWith(".git/")) {
     throw new Error("Refusing to access .git through worker file tools");
   }
-  const absolutePath = path.resolve(branchPath, ...repoRelativePath.split("/"));
+  const absolutePath = repoRelativePath ? path.resolve(branchPath, ...repoRelativePath.split("/")) : path.resolve(branchPath);
   assertInsideBranch(branchPath, absolutePath);
-  return { absolutePath, virtualPath: `/${repoRelativePath}`, repoRelativePath };
+  return { absolutePath, virtualPath: repoRelativePath ? `/${repoRelativePath}` : "/", repoRelativePath };
 }
 function branchLockKey(projectId, branchName) {
   return `${projectId}:${branchName}`;
@@ -1450,18 +1486,14 @@ async function executeCommand(input) {
       branchName: input.message.branchName,
       manifest: input.manifest
     });
-    let artifactProcessEnv = {};
-    if (input.message.sessionId) {
-      await syncSessionArtifacts({
-        baseUrl: input.baseUrl,
-        token: input.token,
-        projectId: input.projectId,
-        branchName: input.message.branchName,
-        sessionId: input.message.sessionId,
-        artifactRoot: input.artifactRoot
-      });
-      artifactProcessEnv = artifactEnv(input.artifactRoot, input.message.sessionId);
-    }
+    const artifactProcessEnv = await prepareArtifactEnvForShell({
+      baseUrl: input.baseUrl,
+      token: input.token,
+      projectId: input.projectId,
+      branchName: input.message.branchName,
+      sessionId: input.message.sessionId,
+      artifactRoot: input.artifactRoot
+    });
     const cwd = resolveCommandCwd(workspace.branchPath, input.message.cwd);
     const subprocess = Bun.spawn(input.message.argv, {
       cwd,
@@ -1535,7 +1567,7 @@ async function executeStreamingCommand(input) {
       branchName: input.message.branchName,
       manifest: input.manifest
     });
-    await syncSessionArtifacts({
+    const artifactProcessEnv = await prepareArtifactEnvForShell({
       baseUrl: input.baseUrl,
       token: input.token,
       projectId: input.projectId,
@@ -1543,7 +1575,6 @@ async function executeStreamingCommand(input) {
       sessionId: input.message.sessionId,
       artifactRoot: input.artifactRoot
     });
-    const artifactProcessEnv = artifactEnv(input.artifactRoot, input.message.sessionId);
     const cwd = resolveCommandCwd(workspace.branchPath, input.message.cwd);
     const subprocess = Bun.spawn(input.message.argv, {
       cwd,
@@ -2181,5 +2212,7 @@ if (isCliEntrypoint()) {
 export {
   ensureVisibleGitCheckout,
   isArtifactEnvPath,
+  prepareArtifactEnvForShell,
+  resolveProjectFilePath,
   syncSessionArtifacts
 };

package/dist/mjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.12",
+  "version": "0.0.14",
   "type": "module"
 }

package/dist/types/main.d.ts

@@ -8,10 +8,23 @@ export declare function syncSessionArtifacts(input: {
     sessionId: string;
     artifactRoot: string;
 }): Promise<string>;
+export declare function prepareArtifactEnvForShell(input: {
+    baseUrl: string;
+    token: string;
+    projectId: string;
+    branchName: string;
+    sessionId?: string;
+    artifactRoot: string;
+}): Promise<Record<string, string>>;
 type GitAuth = {
     extraHeaderUrl: string;
     header: string;
 };
+export declare function resolveProjectFilePath(branchPath: string, virtualPath: string): {
+    absolutePath: string;
+    virtualPath: string;
+    repoRelativePath: string;
+};
 export declare function ensureVisibleGitCheckout(input: {
     projectRoot: string;
     branchName: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.12",
+  "version": "0.0.14",
   "type": "module",
   "main": "./dist/cjs/main.cjs",
   "module": "./dist/mjs/main.mjs",