@ricsam/r5d-worker 0.0.138 → 0.0.139

package/dist/cjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.138",
+  "version": "0.0.139",
   "type": "commonjs"
 }

package/dist/mjs/main.mjs

@@ -7,7 +7,7 @@ import { startManagerRpc } from "./runtime/releases/rpc-main.mjs";
 import { ManagerRpcConfig } from "./runtime/releases/rpc-protocol.mjs";
 const args = process.argv.slice(2);
 if (args.includes("--version")) {
-  console.log(`r5d-worker ${true ? "0.0.138" : "development"}`);
+  console.log(`r5d-worker ${true ? "0.0.139" : "development"}`);
 } else if (!args.length || args.includes("--help")) {
   console.log(
     "Usage: r5d-worker start --label <label> [--root <dir>] [--base-url <url>] [--token <worker-token>]\n       r5d-worker executor /absolute/private/config.json\n       r5d-worker manager /absolute/private/config.json\n\nRun independently supervised durable runtime services. Provision configuration with r5dinfra."
@@ -15,7 +15,7 @@ if (args.includes("--version")) {
 } else if (args[0] === "start") {
   const runtime = await startPersonalWorker(
     parsePersonalWorkerOptions(args.slice(1)),
-    true ? "0.0.138" : "development"
+    true ? "0.0.139" : "development"
   );
   console.log(`Worker connected: ${runtime.resourceId}`);
   let closing = false;

package/dist/mjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.138",
+  "version": "0.0.139",
   "type": "module"
 }

package/dist/mjs/personal/runtime.mjs

@@ -35,6 +35,33 @@ const PersonalWorkspaceRequest = z.object({
   command: z.record(z.string(), z.unknown()),
   credentials: z.array(ExecutorCredential).max(32).optional()
 }).strict();
+async function personalExecutorToken(root, grant) {
+  const identity = { installationId: grant.installationId, userId: grant.userId, resourceId: grant.resourceId, instanceId: grant.instanceId, workerId: grant.workerFence.resourceId };
+  const file = path.join(root, "executor-identity.json");
+  try {
+    const handle = await fs.open(file, "wx", 384);
+    try {
+      await handle.writeFile(canonicalJson({ version: 1, ...identity, token: randomBytes(32).toString("hex") }));
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+    const directory = await fs.open(root, "r");
+    try {
+      await directory.sync();
+    } finally {
+      await directory.close();
+    }
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+  }
+  const stat = await fs.lstat(file);
+  if (stat.nlink !== 1) throw new Error("Personal executor identity must be a private single-link file");
+  const stored = z.object({ version: z.literal(1), installationId: RuntimeId, userId: RuntimeId, resourceId: RuntimeId, instanceId: RuntimeId, workerId: RuntimeId, token: z.string().regex(/^[a-f0-9]{64}$/) }).strict().parse(readPrivateJson(file));
+  const { token, version: _, ...bound } = stored;
+  if (canonicalJson(bound) !== canonicalJson(identity)) throw new Error("Personal executor identity changed; retain the original keeper");
+  return token;
+}
 async function openPersonalWorkerRuntime(options) {
   const grant = PersonalWorkerGrant.parse(options.grant), root = path.resolve(options.root);
   privateDirectory(root);
@@ -43,7 +70,7 @@ async function openPersonalWorkerRuntime(options) {
   const credentialsRoot = path.join(root, "credentials"), workspaceRoot = path.join(root, "workspace", grant.installationId);
   privateDirectory(credentialsRoot);
   privateDirectory(workspaceRoot);
-  const token = randomBytes(32).toString("hex"), controllerId = `controller-${createHash("sha256").update(grant.instanceId).digest("hex").slice(0, 24)}`;
+  const token = await personalExecutorToken(root, grant), controllerId = `controller-${createHash("sha256").update(grant.instanceId).digest("hex").slice(0, 24)}`;
   const daemon = await startHostExecutor({
     installationId: grant.installationId,
     workerId: grant.workerFence.resourceId,
@@ -62,16 +89,6 @@ async function openPersonalWorkerRuntime(options) {
         cwdRoots: [workspaceRoot],
         lanes: ["general", "utility", "control"],
         credentialIds: []
-      },
-      {
-        id: grant.workerHello.instanceId,
-        role: "adapter",
-        ownerId: grant.workerHello.instanceId,
-        tokenHash: tokenHash(token),
-        userIds: [grant.userId],
-        cwdRoots: [workspaceRoot],
-        lanes: ["general", "utility", "control"],
-        credentialIds: []
       }
     ]
   });
@@ -105,7 +122,7 @@ exec ${quote(executable)} ${quote(cli)} "$@"
       hello: grant.workerHello,
       timeoutMs: 1e4
     });
-    let current = grant;
+    let current = grant, installed = false, retirementPending = false;
     const manifests = /* @__PURE__ */ new Map();
     const manifestFile = path.join(root, "workbenches.json");
     try {
@@ -118,12 +135,20 @@ exec ${quote(executable)} ${quote(cli)} "$@"
       if (error.code !== "ENOENT") throw error;
     }
     const artifactDigest = createHash("sha256").update(await fs.readFile(new URL(import.meta.url))).digest("hex");
+    async function retireObsoleteAdapters(retain) {
+      const status = await controller.status();
+      for (const adapter of status.adapters) {
+        if (adapter.state === "registered" && adapter.ownerId !== status.authority?.fence.ownerId && !retain.includes(adapter.ownerId))
+          await controller.retireAdapter(adapter.principalId);
+      }
+    }
     async function renew(value) {
       const next = PersonalWorkerGrant.parse(value);
       if (next.instanceId !== grant.instanceId || next.installationId !== grant.installationId || next.resourceId !== grant.resourceId || next.userId !== grant.userId || next.workerFence.installationId !== grant.installationId || next.workerHello.installationId !== grant.installationId || next.workerHello.role !== "worker-adapter" || next.workerFence.resourceId !== grant.workerFence.resourceId || next.workerHello.instanceId !== next.workerFence.ownerId)
         throw new Error("Personal worker resource identity changed; inspect retained keeper before rebinding");
       let successor = client;
-      if (canonicalJson(next.workerHello) !== canonicalJson(current.workerHello)) {
+      if (!installed || canonicalJson(next.workerHello) !== canonicalJson(current.workerHello)) {
+        await retireObsoleteAdapters([next.workerHello.instanceId]);
         await controller.registerAdapter({
           installationId: grant.installationId,
           workerId: grant.workerFence.resourceId,
@@ -149,8 +174,14 @@ exec ${quote(executable)} ${quote(cli)} "$@"
         });
       }
       await controller.setAuthority(next.workerFence, next.leaseExpiresAt);
+      if (!installed || canonicalJson(next.workerHello) !== canonicalJson(current.workerHello)) retirementPending = true;
       client = successor;
       current = next;
+      installed = true;
+      if (retirementPending) {
+        await retireObsoleteAdapters([next.workerHello.instanceId]);
+        retirementPending = false;
+      }
     }
     await renew(grant);
     const authority = await WorkspaceAuthority.open({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.138",
+  "version": "0.0.139",
   "type": "module",
   "main": "./dist/mjs/main.mjs",
   "module": "./dist/mjs/main.mjs",
@@ -21,8 +21,8 @@
     "r5d-worker": "dist/mjs/main.mjs"
   },
   "dependencies": {
-    "@ricsam/r5d-api": "^0.0.138",
-    "@ricsam/r5dctl": "0.0.138",
+    "@ricsam/r5d-api": "^0.0.139",
+    "@ricsam/r5dctl": "0.0.139",
     "node-pty": "1.1.0",
     "zod": "^4.1.13",
     "picomatch": "^4.0.3"