@ricsam/r5d-worker 0.0.124 → 0.0.126

package/README.md

@@ -89,8 +89,12 @@ The launcher owns admission, OS isolation, budgets, and diagnostic evidence. Its
 
 Requests must be processed concurrently so cancellation and cleanup cannot wait behind queued admission. Controller RPCs are bounded (10 seconds, or 90 seconds for acquisition); external policy must reject excessive queue waits within that bound. Controller loss or protocol failure stops command admission, preserves uncertain outcomes for recovery, reaps ordinary children, and restarts the runtime through its supervisor. It never falls back to direct spawning. Shutdown closes controller stdin; the controller must reap its jobs before exiting.
 
-Cancellation is checked again immediately before spawn. Transient disconnects preserve commands and terminals; expiry of the five-minute execution lease cancels agent work and closes terminals. File operations, communication recovery, and cancellation do not enter launcher admission. Internal worker maintenance subprocesses are also outside this hook. The worker reports its own view of every lane (holders and queue, by run id) to the server with `capacity_report` whenever an admission changes; the platform exposes it through `r5dctl ps list` and `r5dctl workspace status`. Deployment-specific limits and service protection are documented in [Worker deployment resources](../../docs/worker-deployment-resources.md).
+Cancellation is checked again immediately before spawn. A `cancel` carrying `scope: "unstarted"` is the server giving up on a start whose budget expired: it revokes only a launch that has not spawned (capacity queue, mount hold, preparation) and leaves a running process alone; `cancel_result.outcome` reports `unstarted`, `started`, `stopped`, or `unknown` (no record of the run; the cancellation is remembered so a later arrival is refused). Transient disconnects preserve commands and terminals; expiry of the five-minute execution lease cancels agent work and closes terminals. File operations, communication recovery, and cancellation do not enter launcher admission. Internal worker maintenance subprocesses are also outside this hook. The worker reports its own view of every lane (holders and queue, by run id) to the server with `capacity_report` whenever an admission changes; the platform exposes it through `r5dctl ps list` and `r5dctl workspace status`. Deployment-specific limits and service protection are documented in [Worker deployment resources](../../docs/worker-deployment-resources.md).
 
 When the connected `r5d-browser` requests a port forward, the worker opens each relayed connection only to `127.0.0.1` on the requested worker port. Browser-side and worker-side ports may differ. The worker never opens a public listener, and a disconnected worker leaves the browser's long-lived mapping unavailable until the same worker label reconnects.
 
 Control execution requires an initialized launcher that explicitly declares its control capacity (or direct execution without an external launcher), an updated worker, and r5dctl installed on the worker's own PATH. Missing control support is an update error; a control request never falls back to a general shell. Deploy the app and worker support assets, update the CLI/worker, and reconnect before resuming paused work.
+
+## Uploading files to the signed-in browser
+
+`browser_upload_files` transfers regular files from this worker to the connected r5d-browser and attaches them to the selected file input in one agent operation. Source paths may be anywhere this worker can read, including outside the project; relative paths resolve from the session working directory. `$R5D_ROOT`, `$R5D_SESSION_ID`, and `~/` are expanded without executing a shell. File reads are bounded to 1 MiB per RPC, and source metadata is checked throughout the transfer. These transient reads and binary responses bypass recovery journals. Uploads interrupted by a disconnect must be retried as a new operation.

package/dist/cjs/browser-upload.cjs

@@ -0,0 +1,73 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var browser_upload_exports = {};
+__export(browser_upload_exports, {
+  readBrowserUploadChunk: () => readBrowserUploadChunk
+});
+module.exports = __toCommonJS(browser_upload_exports);
+var import_promises = __toESM(require("node:fs/promises"), 1);
+var import_node_fs = require("node:fs");
+var import_node_os = __toESM(require("node:os"), 1);
+var import_node_path = __toESM(require("node:path"), 1);
+var import_browser_upload = require("@ricsam/r5d-api/browser-upload");
+async function readBrowserUploadChunk(input, context) {
+  if (typeof input.filePath !== "string" || !input.filePath.trim() || input.filePath.includes("\0"))
+    throw new Error("Upload requires a file path.");
+  if (!Number.isSafeInteger(input.offset) || input.offset < 0) throw new Error("Invalid upload read offset.");
+  if (input.offset > 0 && !input.version) throw new Error("Upload continuation requires a file version.");
+  const expanded = input.filePath.replace(/\$\{R5D_ROOT\}|\$R5D_ROOT\b/g, () => context.rootDir).replace(/\$\{R5D_SESSION_ID\}|\$R5D_SESSION_ID\b/g, () => context.sessionId).replace(/^~\//, () => `${import_node_os.default.homedir()}/`);
+  const filePath = import_node_path.default.resolve(context.cwd, expanded);
+  const handle = await import_promises.default.open(filePath, import_node_fs.constants.O_RDONLY | import_node_fs.constants.O_NONBLOCK);
+  try {
+    const stat = await handle.stat({ bigint: true });
+    if (!stat.isFile()) throw new Error(`Upload source is not a regular file: ${input.filePath}`);
+    const metadata = (0, import_browser_upload.validateUploadFile)({ filename: import_node_path.default.basename(filePath), size: Number(stat.size) });
+    const versionOf = (s) => `${s.dev}:${s.ino}:${s.size}:${s.mtimeNs}:${s.ctimeNs}`;
+    const version = versionOf(stat);
+    if (input.version !== void 0 && input.version !== version)
+      throw new Error(`Upload source changed while being transferred: ${input.filePath}`);
+    if (input.offset > metadata.size) throw new Error("Upload offset is past the end of the file.");
+    const bytes = Buffer.alloc(input.metadataOnly === true ? 0 : Math.min(import_browser_upload.BROWSER_UPLOAD_CHUNK_BYTES, metadata.size - input.offset));
+    let read = 0;
+    while (read < bytes.length) {
+      const { bytesRead } = await handle.read(bytes, read, bytes.length - read, input.offset + read);
+      if (!bytesRead) throw new Error(`Upload source was truncated: ${input.filePath}`);
+      read += bytesRead;
+    }
+    if (versionOf(await handle.stat({ bigint: true })) !== version)
+      throw new Error(`Upload source changed while being read: ${input.filePath}`);
+    return { type: "browser_upload_read", ...metadata, version, offset: input.offset, base64: bytes.toString("base64") };
+  } finally {
+    await handle.close();
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  readBrowserUploadChunk
+});

package/dist/cjs/command-launcher.cjs

@@ -245,7 +245,9 @@ class WorkerCommandLauncher {
         if (!argv.length) throw new Error("Command argv must not be empty");
         return [...prefix, ...argv];
       },
-      cancel: () => this.cancel(request.id),
+      cancel: async () => {
+        await this.cancel(request.id);
+      },
       diagnose: async () => {
         this.assertHealthy();
         if (!this.child) return void 0;
@@ -261,9 +263,10 @@ class WorkerCommandLauncher {
       release: () => this.releaseRecord(record)
     };
   }
+  /** Revoke a launch. Returns whether this launcher still held it (queued or acquired, not yet released). */
   async cancel(id) {
     const record = this.launches.get(id);
-    if (!record || record.released) return;
+    if (!record || record.released) return false;
     record.revoked = true;
     record.rejectAdmission(new CommandLaunchCancelledError());
     if (this.child) {
@@ -273,6 +276,7 @@ class WorkerCommandLauncher {
         throw this.fail(error instanceof Error ? error : new Error(String(error)));
       }
     }
+    return true;
   }
   async cancelSession(sessionId) {
     await this.cancelMatching((_id, ownerSessionId) => ownerSessionId === sessionId);

package/dist/cjs/main.cjs

@@ -56,6 +56,7 @@ __export(main_exports, {
   writeWorkerTextFile: () => writeWorkerTextFile
 });
 module.exports = __toCommonJS(main_exports);
+var import_browser_upload = require("./browser-upload.cjs");
 var import_runtime_version = require("./runtime-version.cjs");
 var import_plan_paths = require("./plan-paths.cjs");
 var import_plan_parser = require("./plan-parser.cjs");
@@ -325,9 +326,10 @@ function unregisterPendingReservation(key, controller) {
 }
 function abortPendingReservation(key, reason) {
   const pending = pendingReservationAborts.get(key);
-  if (!pending) return;
+  if (!pending) return false;
   pendingReservationAborts.delete(key);
   pending.controller.abort(new import_workspace_mount_hold_fence.WorkspaceMountHoldAbortedError(reason));
+  return true;
 }
 function abortPendingReservations(reason, sessionId) {
   for (const [key, pending] of [...pendingReservationAborts]) {
@@ -2818,6 +2820,13 @@ async function executeOperation(input) {
       return executeViewFileBytesOperation({ ...input, message: input.message });
     case "code_list":
       return executeCodeListOperation({ ...input, message: input.message });
+    case "browser_upload_read":
+      input.assertAdmission();
+      return (0, import_browser_upload.readBrowserUploadChunk)(input.message.input, {
+        cwd: input.resolvedTarget.rootPath,
+        rootDir: input.rootDir,
+        sessionId: input.message.sessionId
+      });
     case "code_read":
       return executeCodeReadOperation({ ...input, message: input.message });
   }
@@ -3191,32 +3200,38 @@ async function reapCompletedCredentialBearingProcessGroup(runId, subprocess) {
     );
   }
 }
-async function cancelProcessRun(runId) {
+async function cancelProcessRun(runId, scope) {
+  const spawned = activeProcesses.get(runId);
+  if (scope === "unstarted" && spawned) return { cancelled: false, message: `${spawned.command} already started`, outcome: "started" };
+  if (!spawned) cancelledProcessRuns.add(runId);
+  const revocation = workerCommandLauncher?.cancel(runId);
   let resourceCancellationError;
+  let launchRevoked = false;
   try {
-    await workerCommandLauncher?.cancel(runId);
+    launchRevoked = await revocation ?? false;
   } catch (error) {
     resourceCancellationError = error instanceof Error ? error.message : String(error);
   }
-  const active = activeProcesses.get(runId);
   let cancelled = resourceCancellationError === void 0;
   let cancelMessage;
-  if (active) {
+  let outcome;
+  if (spawned) {
+    outcome = "stopped";
     try {
-      closeProcessStdin(active);
-      await (0, import_process_tree.terminateProcessTree)(active.process);
-      cancelMessage = `Stopped ${active.command}`;
+      closeProcessStdin(spawned);
+      await (0, import_process_tree.terminateProcessTree)(spawned.process);
+      cancelMessage = `Stopped ${spawned.command}`;
     } catch (error) {
       cancelled = false;
-      cancelMessage = `Failed to stop ${active.command}: ${error instanceof Error ? error.message : String(error)}`;
+      cancelMessage = `Failed to stop ${spawned.command}: ${error instanceof Error ? error.message : String(error)}`;
     }
   } else {
-    cancelledProcessRuns.add(runId);
-    abortPendingReservation(`run:${runId}`, "Cancellation queued before command start");
+    const reservationAborted = abortPendingReservation(`run:${runId}`, "Cancellation queued before command start");
+    outcome = launchRevoked || reservationAborted ? "unstarted" : "unknown";
     cancelMessage = "Cancellation queued before command start";
   }
   if (resourceCancellationError) cancelMessage += `; job resource termination failed: ${resourceCancellationError}`;
-  return { cancelled, message: cancelMessage };
+  return { cancelled, message: cancelMessage, outcome };
 }
 function closeProcessStdin(active) {
   if (!active?.stdin) {
@@ -3243,6 +3258,10 @@ function sendReplayWorkerMessage(ws, message) {
 }
 function sendWorkerMessage(ws, message) {
   if (launcherFailureInProgress) return;
+  if (message.type === "browser_upload_read_result") {
+    if (currentWorkerSocket === ws && ws.readyState === WebSocket.OPEN) ws.send(JSON.stringify(message));
+    return;
+  }
   const transportError = "error" in message && typeof message.error === "string" ? message.error : message.type === "workspace_sync_result" && message.result.outcome === "failed" ? message.result.error : void 0;
   if (recoveryJournal && transportError && isWorkerCommunicationFailure(transportError) && "requestId" in message && typeof message.requestId === "string") {
     recoveryJournal.unknown(message.requestId);
@@ -6029,6 +6048,7 @@ async function startWorker(options, projectRuntime = {
         capabilities: {
           updateClis: true,
           browserPortForwarding: true,
+          browserFileUploads: true,
           execStdinV1: true,
           ptyEnvFilesV1: true,
           workspaceRemediationAncestorGuardV1: true,
@@ -6165,10 +6185,10 @@ async function startWorker(options, projectRuntime = {
       if (!startupRecoveryComplete && message.type !== "ping") await startupRecoveryPromise;
       if (!startupRecoveryComplete && message.type !== "ping") return;
       if (currentWorkerSocket !== ws) return;
-      const operationRequestId = "requestId" in message && typeof message.requestId === "string" && message.type !== "workspace_config" ? message.requestId : void 0;
+      const operationRequestId = "requestId" in message && typeof message.requestId === "string" && message.type !== "workspace_config" && message.type !== "browser_upload_read" ? message.requestId : void 0;
       if (message.type === "cancel") {
         const admission = recoveryJournal.admit({ ...message, requestId: message.requestId });
-        const cancelled = await cancelProcessRun(message.runId);
+        const cancelled = await cancelProcessRun(message.runId, message.scope);
         let admitted;
         try {
           admitted = await admission;
@@ -6194,7 +6214,8 @@ async function startWorker(options, projectRuntime = {
             requestId: message.requestId,
             runId: message.runId,
             cancelled: cancelled.cancelled,
-            message: cancelled.message
+            message: cancelled.message,
+            outcome: cancelled.outcome
           })
         );
         return;
@@ -7070,10 +7091,10 @@ async function startWorker(options, projectRuntime = {
         });
         return;
       }
-      if (message.type === "read_plan" || message.type === "lint_plans" || message.type === "update_task_status" || message.type === "read" || message.type === "write" || message.type === "edit" || message.type === "grep" || message.type === "find" || message.type === "ls" || message.type === "view_file_bytes" || message.type === "code_list" || message.type === "code_read") {
+      if (message.type === "read_plan" || message.type === "lint_plans" || message.type === "update_task_status" || message.type === "read" || message.type === "write" || message.type === "edit" || message.type === "grep" || message.type === "find" || message.type === "ls" || message.type === "view_file_bytes" || message.type === "code_list" || message.type === "code_read" || message.type === "browser_upload_read") {
         if (workspaceOperationsAreFenced(deferredWorkspaceConfiguration, activeWorkspaceIncidentId)) {
           sendWorkerMessage(ws, {
-            type: "operation_result",
+            type: message.type === "browser_upload_read" ? "browser_upload_read_result" : "operation_result",
             requestId: message.requestId,
             error: `Workspace operations are deferred for incident ${deferredWorkspaceConfiguration?.incidentId ?? activeWorkspaceIncidentId}; use a canonical remediation shell`
           });
@@ -7101,7 +7122,7 @@ async function startWorker(options, projectRuntime = {
             sendSerializedWorkerMessage(
               ws,
               JSON.stringify({
-                type: "operation_result",
+                type: message.type === "browser_upload_read" ? "browser_upload_read_result" : "operation_result",
                 requestId: message.requestId,
                 error: error instanceof Error ? error.message : String(error)
               })
@@ -7129,7 +7150,7 @@ async function startWorker(options, projectRuntime = {
           sendSerializedWorkerMessage(
             ws,
             JSON.stringify({
-              type: "operation_result",
+              type: message.type === "browser_upload_read" ? "browser_upload_read_result" : "operation_result",
               requestId: message.requestId,
               result
             })
@@ -7147,7 +7168,7 @@ async function startWorker(options, projectRuntime = {
           sendSerializedWorkerMessage(
             ws,
             JSON.stringify({
-              type: "operation_result",
+              type: message.type === "browser_upload_read" ? "browser_upload_read_result" : "operation_result",
               requestId: message.requestId,
               error: error instanceof Error ? error.message : String(error)
             })

package/dist/cjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.124",
+  "version": "0.0.126",
   "type": "commonjs"
 }

package/dist/mjs/browser-upload.mjs

@@ -0,0 +1,42 @@
+import fs from "node:fs/promises";
+import { constants } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import {
+  BROWSER_UPLOAD_CHUNK_BYTES,
+  validateUploadFile
+} from "@ricsam/r5d-api/browser-upload";
+async function readBrowserUploadChunk(input, context) {
+  if (typeof input.filePath !== "string" || !input.filePath.trim() || input.filePath.includes("\0"))
+    throw new Error("Upload requires a file path.");
+  if (!Number.isSafeInteger(input.offset) || input.offset < 0) throw new Error("Invalid upload read offset.");
+  if (input.offset > 0 && !input.version) throw new Error("Upload continuation requires a file version.");
+  const expanded = input.filePath.replace(/\$\{R5D_ROOT\}|\$R5D_ROOT\b/g, () => context.rootDir).replace(/\$\{R5D_SESSION_ID\}|\$R5D_SESSION_ID\b/g, () => context.sessionId).replace(/^~\//, () => `${os.homedir()}/`);
+  const filePath = path.resolve(context.cwd, expanded);
+  const handle = await fs.open(filePath, constants.O_RDONLY | constants.O_NONBLOCK);
+  try {
+    const stat = await handle.stat({ bigint: true });
+    if (!stat.isFile()) throw new Error(`Upload source is not a regular file: ${input.filePath}`);
+    const metadata = validateUploadFile({ filename: path.basename(filePath), size: Number(stat.size) });
+    const versionOf = (s) => `${s.dev}:${s.ino}:${s.size}:${s.mtimeNs}:${s.ctimeNs}`;
+    const version = versionOf(stat);
+    if (input.version !== void 0 && input.version !== version)
+      throw new Error(`Upload source changed while being transferred: ${input.filePath}`);
+    if (input.offset > metadata.size) throw new Error("Upload offset is past the end of the file.");
+    const bytes = Buffer.alloc(input.metadataOnly === true ? 0 : Math.min(BROWSER_UPLOAD_CHUNK_BYTES, metadata.size - input.offset));
+    let read = 0;
+    while (read < bytes.length) {
+      const { bytesRead } = await handle.read(bytes, read, bytes.length - read, input.offset + read);
+      if (!bytesRead) throw new Error(`Upload source was truncated: ${input.filePath}`);
+      read += bytesRead;
+    }
+    if (versionOf(await handle.stat({ bigint: true })) !== version)
+      throw new Error(`Upload source changed while being read: ${input.filePath}`);
+    return { type: "browser_upload_read", ...metadata, version, offset: input.offset, base64: bytes.toString("base64") };
+  } finally {
+    await handle.close();
+  }
+}
+export {
+  readBrowserUploadChunk
+};

package/dist/mjs/command-launcher.mjs

@@ -216,7 +216,9 @@ class WorkerCommandLauncher {
         if (!argv.length) throw new Error("Command argv must not be empty");
         return [...prefix, ...argv];
       },
-      cancel: () => this.cancel(request.id),
+      cancel: async () => {
+        await this.cancel(request.id);
+      },
       diagnose: async () => {
         this.assertHealthy();
         if (!this.child) return void 0;
@@ -232,9 +234,10 @@ class WorkerCommandLauncher {
       release: () => this.releaseRecord(record)
     };
   }
+  /** Revoke a launch. Returns whether this launcher still held it (queued or acquired, not yet released). */
   async cancel(id) {
     const record = this.launches.get(id);
-    if (!record || record.released) return;
+    if (!record || record.released) return false;
     record.revoked = true;
     record.rejectAdmission(new CommandLaunchCancelledError());
     if (this.child) {
@@ -244,6 +247,7 @@ class WorkerCommandLauncher {
         throw this.fail(error instanceof Error ? error : new Error(String(error)));
       }
     }
+    return true;
   }
   async cancelSession(sessionId) {
     await this.cancelMatching((_id, ownerSessionId) => ownerSessionId === sessionId);

package/dist/mjs/main.mjs

@@ -1,4 +1,5 @@
 #!/usr/bin/env bun
+import { readBrowserUploadChunk } from "./browser-upload.mjs";
 import { WORKER_RUNTIME_VERSION } from "./runtime-version.mjs";
 import { getWorkerPlanPath, getWorkerPlansPath, validatePlanId } from "./plan-paths.mjs";
 import { createPlanMarkdown, updateTaskCheckbox } from "./plan-parser.mjs";
@@ -346,9 +347,10 @@ function unregisterPendingReservation(key, controller) {
 }
 function abortPendingReservation(key, reason) {
   const pending = pendingReservationAborts.get(key);
-  if (!pending) return;
+  if (!pending) return false;
   pendingReservationAborts.delete(key);
   pending.controller.abort(new WorkspaceMountHoldAbortedError(reason));
+  return true;
 }
 function abortPendingReservations(reason, sessionId) {
   for (const [key, pending] of [...pendingReservationAborts]) {
@@ -2839,6 +2841,13 @@ async function executeOperation(input) {
       return executeViewFileBytesOperation({ ...input, message: input.message });
     case "code_list":
       return executeCodeListOperation({ ...input, message: input.message });
+    case "browser_upload_read":
+      input.assertAdmission();
+      return readBrowserUploadChunk(input.message.input, {
+        cwd: input.resolvedTarget.rootPath,
+        rootDir: input.rootDir,
+        sessionId: input.message.sessionId
+      });
     case "code_read":
       return executeCodeReadOperation({ ...input, message: input.message });
   }
@@ -3212,32 +3221,38 @@ async function reapCompletedCredentialBearingProcessGroup(runId, subprocess) {
     );
   }
 }
-async function cancelProcessRun(runId) {
+async function cancelProcessRun(runId, scope) {
+  const spawned = activeProcesses.get(runId);
+  if (scope === "unstarted" && spawned) return { cancelled: false, message: `${spawned.command} already started`, outcome: "started" };
+  if (!spawned) cancelledProcessRuns.add(runId);
+  const revocation = workerCommandLauncher?.cancel(runId);
   let resourceCancellationError;
+  let launchRevoked = false;
   try {
-    await workerCommandLauncher?.cancel(runId);
+    launchRevoked = await revocation ?? false;
   } catch (error) {
     resourceCancellationError = error instanceof Error ? error.message : String(error);
   }
-  const active = activeProcesses.get(runId);
   let cancelled = resourceCancellationError === void 0;
   let cancelMessage;
-  if (active) {
+  let outcome;
+  if (spawned) {
+    outcome = "stopped";
     try {
-      closeProcessStdin(active);
-      await terminateProcessTree(active.process);
-      cancelMessage = `Stopped ${active.command}`;
+      closeProcessStdin(spawned);
+      await terminateProcessTree(spawned.process);
+      cancelMessage = `Stopped ${spawned.command}`;
     } catch (error) {
       cancelled = false;
-      cancelMessage = `Failed to stop ${active.command}: ${error instanceof Error ? error.message : String(error)}`;
+      cancelMessage = `Failed to stop ${spawned.command}: ${error instanceof Error ? error.message : String(error)}`;
     }
   } else {
-    cancelledProcessRuns.add(runId);
-    abortPendingReservation(`run:${runId}`, "Cancellation queued before command start");
+    const reservationAborted = abortPendingReservation(`run:${runId}`, "Cancellation queued before command start");
+    outcome = launchRevoked || reservationAborted ? "unstarted" : "unknown";
     cancelMessage = "Cancellation queued before command start";
   }
   if (resourceCancellationError) cancelMessage += `; job resource termination failed: ${resourceCancellationError}`;
-  return { cancelled, message: cancelMessage };
+  return { cancelled, message: cancelMessage, outcome };
 }
 function closeProcessStdin(active) {
   if (!active?.stdin) {
@@ -3264,6 +3279,10 @@ function sendReplayWorkerMessage(ws, message) {
 }
 function sendWorkerMessage(ws, message) {
   if (launcherFailureInProgress) return;
+  if (message.type === "browser_upload_read_result") {
+    if (currentWorkerSocket === ws && ws.readyState === WebSocket.OPEN) ws.send(JSON.stringify(message));
+    return;
+  }
   const transportError = "error" in message && typeof message.error === "string" ? message.error : message.type === "workspace_sync_result" && message.result.outcome === "failed" ? message.result.error : void 0;
   if (recoveryJournal && transportError && isWorkerCommunicationFailure(transportError) && "requestId" in message && typeof message.requestId === "string") {
     recoveryJournal.unknown(message.requestId);
@@ -6050,6 +6069,7 @@ async function startWorker(options, projectRuntime = {
         capabilities: {
           updateClis: true,
           browserPortForwarding: true,
+          browserFileUploads: true,
           execStdinV1: true,
           ptyEnvFilesV1: true,
           workspaceRemediationAncestorGuardV1: true,
@@ -6186,10 +6206,10 @@ async function startWorker(options, projectRuntime = {
       if (!startupRecoveryComplete && message.type !== "ping") await startupRecoveryPromise;
       if (!startupRecoveryComplete && message.type !== "ping") return;
       if (currentWorkerSocket !== ws) return;
-      const operationRequestId = "requestId" in message && typeof message.requestId === "string" && message.type !== "workspace_config" ? message.requestId : void 0;
+      const operationRequestId = "requestId" in message && typeof message.requestId === "string" && message.type !== "workspace_config" && message.type !== "browser_upload_read" ? message.requestId : void 0;
       if (message.type === "cancel") {
         const admission = recoveryJournal.admit({ ...message, requestId: message.requestId });
-        const cancelled = await cancelProcessRun(message.runId);
+        const cancelled = await cancelProcessRun(message.runId, message.scope);
         let admitted;
         try {
           admitted = await admission;
@@ -6215,7 +6235,8 @@ async function startWorker(options, projectRuntime = {
             requestId: message.requestId,
             runId: message.runId,
             cancelled: cancelled.cancelled,
-            message: cancelled.message
+            message: cancelled.message,
+            outcome: cancelled.outcome
           })
         );
         return;
@@ -7091,10 +7112,10 @@ async function startWorker(options, projectRuntime = {
         });
         return;
       }
-      if (message.type === "read_plan" || message.type === "lint_plans" || message.type === "update_task_status" || message.type === "read" || message.type === "write" || message.type === "edit" || message.type === "grep" || message.type === "find" || message.type === "ls" || message.type === "view_file_bytes" || message.type === "code_list" || message.type === "code_read") {
+      if (message.type === "read_plan" || message.type === "lint_plans" || message.type === "update_task_status" || message.type === "read" || message.type === "write" || message.type === "edit" || message.type === "grep" || message.type === "find" || message.type === "ls" || message.type === "view_file_bytes" || message.type === "code_list" || message.type === "code_read" || message.type === "browser_upload_read") {
         if (workspaceOperationsAreFenced(deferredWorkspaceConfiguration, activeWorkspaceIncidentId)) {
           sendWorkerMessage(ws, {
-            type: "operation_result",
+            type: message.type === "browser_upload_read" ? "browser_upload_read_result" : "operation_result",
             requestId: message.requestId,
             error: `Workspace operations are deferred for incident ${deferredWorkspaceConfiguration?.incidentId ?? activeWorkspaceIncidentId}; use a canonical remediation shell`
           });
@@ -7122,7 +7143,7 @@ async function startWorker(options, projectRuntime = {
             sendSerializedWorkerMessage(
               ws,
               JSON.stringify({
-                type: "operation_result",
+                type: message.type === "browser_upload_read" ? "browser_upload_read_result" : "operation_result",
                 requestId: message.requestId,
                 error: error instanceof Error ? error.message : String(error)
               })
@@ -7150,7 +7171,7 @@ async function startWorker(options, projectRuntime = {
           sendSerializedWorkerMessage(
             ws,
             JSON.stringify({
-              type: "operation_result",
+              type: message.type === "browser_upload_read" ? "browser_upload_read_result" : "operation_result",
               requestId: message.requestId,
               result
             })
@@ -7168,7 +7189,7 @@ async function startWorker(options, projectRuntime = {
           sendSerializedWorkerMessage(
             ws,
             JSON.stringify({
-              type: "operation_result",
+              type: message.type === "browser_upload_read" ? "browser_upload_read_result" : "operation_result",
               requestId: message.requestId,
               error: error instanceof Error ? error.message : String(error)
             })

package/dist/mjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.124",
+  "version": "0.0.126",
   "type": "module"
 }

package/dist/types/browser-upload.d.ts

@@ -0,0 +1,7 @@
+import { type BrowserUploadChunk, type BrowserUploadReadInput } from "@ricsam/r5d-api/browser-upload";
+/** Unlike code-view paths, uploads may read any regular file accessible to this worker. */
+export declare function readBrowserUploadChunk(input: BrowserUploadReadInput, context: {
+    cwd: string;
+    rootDir: string;
+    sessionId: string;
+}): Promise<BrowserUploadChunk>;

package/dist/types/command-launcher.d.ts

@@ -86,7 +86,8 @@ export declare class WorkerCommandLauncher {
     capacityReport(): CommandLaunchCapacityReport;
     private notifyCapacityChange;
     acquire(request: CommandLaunchRequest): Promise<CommandLaunchLease>;
-    cancel(id: string): Promise<void>;
+    /** Revoke a launch. Returns whether this launcher still held it (queued or acquired, not yet released). */
+    cancel(id: string): Promise<boolean>;
     cancelSession(sessionId: string): Promise<void>;
     cancelMatching(matches: (id: string, sessionId?: string) => boolean): Promise<void>;
     close(): Promise<void>;

package/dist/types/main.d.ts

@@ -1,4 +1,5 @@
 #!/usr/bin/env bun
+import type { BrowserUploadChunk, BrowserUploadReadInput } from "@ricsam/r5d-api/browser-upload";
 import type { WorkerLintPlansResult, WorkerUpdatePlanTaskResult } from "./plan-paths";
 import { WORKER_RESUMABLE_PROTOCOL, type WorkerRecoveryClientMessage, type WorkerRecoveryServerMessage } from "./recovery-protocol";
 import { Database } from "bun:sqlite";
@@ -141,6 +142,8 @@ export type WorkerSessionTarget = {
     ownerUserId: string;
     rootProfile: "visible_projects" | "canonical_sync";
 };
+type WorkerCancelScope = "unstarted";
+type WorkerCancelOutcome = "unstarted" | "started" | "stopped" | "unknown";
 type WorkerClientMessage = WorkerRecoveryClientMessage | {
     type: "capacity_report";
     capacity: import("./command-launcher").CommandLaunchCapacityReport & {
@@ -202,6 +205,11 @@ type WorkerClientMessage = WorkerRecoveryClientMessage | {
     ptyId: string;
     requestId?: string;
     error: string;
+} | {
+    type: "browser_upload_read_result";
+    requestId: string;
+    result?: WorkerOperationResult;
+    error?: string;
 } | {
     type: "operation_result";
     requestId: string;
@@ -262,6 +270,8 @@ type WorkerClientMessage = WorkerRecoveryClientMessage | {
     runId: string;
     cancelled: boolean;
     message?: string;
+    /** `unstarted`: a launch that had not spawned was revoked; `started`: a spawned process was left alone; `stopped`; `unknown`: no record, cancellation recorded. */
+    outcome?: WorkerCancelOutcome;
 } | {
     type: "pong";
 } | {
@@ -351,6 +361,12 @@ type WorkerServerMessage = WorkerRecoveryServerMessage | {
         type: "project";
     }>;
     path: string;
+} | {
+    type: "browser_upload_read";
+    requestId: string;
+    target: WorkerSessionTarget;
+    sessionId: string;
+    input: BrowserUploadReadInput;
 } | {
     type: "code_read";
     requestId: string;
@@ -533,6 +549,8 @@ type WorkerServerMessage = WorkerRecoveryServerMessage | {
     type: "cancel";
     requestId: string;
     runId: string;
+    /** `unstarted`: the server's start-deadline abandonment; never touch a spawned process. */
+    scope?: WorkerCancelScope;
 } | {
     type: "ping";
 };
@@ -633,9 +651,9 @@ type WorkerCodeReadResult = {
     mtime: string;
     base64: string;
 };
-type WorkerOperationResult = WorkerReadFileResult | WorkerReadPlanResult | WorkerLintPlansResult | WorkerUpdatePlanTaskResult | WorkerWriteFileResult | WorkerEditFileResult | WorkerGrepResult | WorkerFindResult | WorkerLsResult | WorkerViewFileBytesResult | WorkerExecStdinAck | WorkerCreateProjectBranchResult | WorkerDeleteProjectBranchResult | WorkerCodeListResult | WorkerCodeReadResult;
+type WorkerOperationResult = WorkerReadFileResult | WorkerReadPlanResult | WorkerLintPlansResult | WorkerUpdatePlanTaskResult | WorkerWriteFileResult | WorkerEditFileResult | WorkerGrepResult | WorkerFindResult | WorkerLsResult | WorkerViewFileBytesResult | WorkerExecStdinAck | WorkerCreateProjectBranchResult | WorkerDeleteProjectBranchResult | WorkerCodeListResult | WorkerCodeReadResult | BrowserUploadChunk;
 type WorkerOperationServerMessage = Extract<WorkerServerMessage, {
-    type: "read_plan" | "lint_plans" | "update_task_status" | "read" | "write" | "edit" | "grep" | "find" | "ls" | "view_file_bytes" | "code_list" | "code_read";
+    type: "read_plan" | "lint_plans" | "update_task_status" | "read" | "write" | "edit" | "grep" | "find" | "ls" | "view_file_bytes" | "code_list" | "code_read" | "browser_upload_read";
 }>;
 declare class WorkspaceSyncAdmissionChangedError extends Error {
     readonly name = "WorkspaceSyncAdmissionChangedError";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.124",
+  "version": "0.0.126",
   "type": "module",
   "main": "./dist/cjs/main.cjs",
   "module": "./dist/mjs/main.mjs",
@@ -21,6 +21,7 @@
     "r5d-worker": "dist/cjs/main.cjs"
   },
   "dependencies": {
+    "@ricsam/r5d-api": "^0.0.126",
     "node-pty": "^1.1.0",
     "picomatch": "^4.0.3"
   },