@ricsam/r5d-worker 0.0.138 → 0.0.140

package/dist/cjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.138",
+  "version": "0.0.140",
   "type": "commonjs"
 }

package/dist/mjs/main.mjs

@@ -7,7 +7,7 @@ import { startManagerRpc } from "./runtime/releases/rpc-main.mjs";
 import { ManagerRpcConfig } from "./runtime/releases/rpc-protocol.mjs";
 const args = process.argv.slice(2);
 if (args.includes("--version")) {
-  console.log(`r5d-worker ${true ? "0.0.138" : "development"}`);
+  console.log(`r5d-worker ${true ? "0.0.140" : "development"}`);
 } else if (!args.length || args.includes("--help")) {
   console.log(
     "Usage: r5d-worker start --label <label> [--root <dir>] [--base-url <url>] [--token <worker-token>]\n       r5d-worker executor /absolute/private/config.json\n       r5d-worker manager /absolute/private/config.json\n\nRun independently supervised durable runtime services. Provision configuration with r5dinfra."
@@ -15,7 +15,7 @@ if (args.includes("--version")) {
 } else if (args[0] === "start") {
   const runtime = await startPersonalWorker(
     parsePersonalWorkerOptions(args.slice(1)),
-    true ? "0.0.138" : "development"
+    true ? "0.0.140" : "development"
   );
   console.log(`Worker connected: ${runtime.resourceId}`);
   let closing = false;

package/dist/mjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.138",
+  "version": "0.0.140",
   "type": "module"
 }

package/dist/mjs/personal/runtime.mjs

@@ -35,6 +35,33 @@ const PersonalWorkspaceRequest = z.object({
   command: z.record(z.string(), z.unknown()),
   credentials: z.array(ExecutorCredential).max(32).optional()
 }).strict();
+async function personalExecutorToken(root, grant) {
+  const identity = { installationId: grant.installationId, userId: grant.userId, resourceId: grant.resourceId, instanceId: grant.instanceId, workerId: grant.workerFence.resourceId };
+  const file = path.join(root, "executor-identity.json");
+  try {
+    const handle = await fs.open(file, "wx", 384);
+    try {
+      await handle.writeFile(canonicalJson({ version: 1, ...identity, token: randomBytes(32).toString("hex") }));
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+    const directory = await fs.open(root, "r");
+    try {
+      await directory.sync();
+    } finally {
+      await directory.close();
+    }
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+  }
+  const stat = await fs.lstat(file);
+  if (stat.nlink !== 1) throw new Error("Personal executor identity must be a private single-link file");
+  const stored = z.object({ version: z.literal(1), installationId: RuntimeId, userId: RuntimeId, resourceId: RuntimeId, instanceId: RuntimeId, workerId: RuntimeId, token: z.string().regex(/^[a-f0-9]{64}$/) }).strict().parse(readPrivateJson(file));
+  const { token, version: _, ...bound } = stored;
+  if (canonicalJson(bound) !== canonicalJson(identity)) throw new Error("Personal executor identity changed; retain the original keeper");
+  return token;
+}
 async function openPersonalWorkerRuntime(options) {
   const grant = PersonalWorkerGrant.parse(options.grant), root = path.resolve(options.root);
   privateDirectory(root);
@@ -43,7 +70,7 @@ async function openPersonalWorkerRuntime(options) {
   const credentialsRoot = path.join(root, "credentials"), workspaceRoot = path.join(root, "workspace", grant.installationId);
   privateDirectory(credentialsRoot);
   privateDirectory(workspaceRoot);
-  const token = randomBytes(32).toString("hex"), controllerId = `controller-${createHash("sha256").update(grant.instanceId).digest("hex").slice(0, 24)}`;
+  const token = await personalExecutorToken(root, grant), controllerId = `controller-${createHash("sha256").update(grant.instanceId).digest("hex").slice(0, 24)}`;
   const daemon = await startHostExecutor({
     installationId: grant.installationId,
     workerId: grant.workerFence.resourceId,
@@ -62,16 +89,6 @@ async function openPersonalWorkerRuntime(options) {
         cwdRoots: [workspaceRoot],
         lanes: ["general", "utility", "control"],
         credentialIds: []
-      },
-      {
-        id: grant.workerHello.instanceId,
-        role: "adapter",
-        ownerId: grant.workerHello.instanceId,
-        tokenHash: tokenHash(token),
-        userIds: [grant.userId],
-        cwdRoots: [workspaceRoot],
-        lanes: ["general", "utility", "control"],
-        credentialIds: []
       }
     ]
   });
@@ -105,7 +122,7 @@ exec ${quote(executable)} ${quote(cli)} "$@"
       hello: grant.workerHello,
       timeoutMs: 1e4
     });
-    let current = grant;
+    let current = grant, installed = false, retirementPending = false;
     const manifests = /* @__PURE__ */ new Map();
     const manifestFile = path.join(root, "workbenches.json");
     try {
@@ -118,12 +135,20 @@ exec ${quote(executable)} ${quote(cli)} "$@"
       if (error.code !== "ENOENT") throw error;
     }
     const artifactDigest = createHash("sha256").update(await fs.readFile(new URL(import.meta.url))).digest("hex");
+    async function retireObsoleteAdapters(retain) {
+      const status = await controller.status();
+      for (const adapter of status.adapters) {
+        if (adapter.state === "registered" && adapter.ownerId !== status.authority?.fence.ownerId && !retain.includes(adapter.ownerId))
+          await controller.retireAdapter(adapter.principalId);
+      }
+    }
     async function renew(value) {
       const next = PersonalWorkerGrant.parse(value);
       if (next.instanceId !== grant.instanceId || next.installationId !== grant.installationId || next.resourceId !== grant.resourceId || next.userId !== grant.userId || next.workerFence.installationId !== grant.installationId || next.workerHello.installationId !== grant.installationId || next.workerHello.role !== "worker-adapter" || next.workerFence.resourceId !== grant.workerFence.resourceId || next.workerHello.instanceId !== next.workerFence.ownerId)
         throw new Error("Personal worker resource identity changed; inspect retained keeper before rebinding");
       let successor = client;
-      if (canonicalJson(next.workerHello) !== canonicalJson(current.workerHello)) {
+      if (!installed || canonicalJson(next.workerHello) !== canonicalJson(current.workerHello)) {
+        await retireObsoleteAdapters([next.workerHello.instanceId]);
         await controller.registerAdapter({
           installationId: grant.installationId,
           workerId: grant.workerFence.resourceId,
@@ -149,8 +174,14 @@ exec ${quote(executable)} ${quote(cli)} "$@"
         });
       }
       await controller.setAuthority(next.workerFence, next.leaseExpiresAt);
+      if (!installed || canonicalJson(next.workerHello) !== canonicalJson(current.workerHello)) retirementPending = true;
       client = successor;
       current = next;
+      installed = true;
+      if (retirementPending) {
+        await retireObsoleteAdapters([next.workerHello.instanceId]);
+        retirementPending = false;
+      }
     }
     await renew(grant);
     const authority = await WorkspaceAuthority.open({

package/dist/mjs/runtime/workspace/authority.mjs

@@ -17,6 +17,7 @@ import { WorkspaceFileWrite, WorkspaceFileWriteLookup } from "./file-write.mjs";
 import { WorkspaceStorageClient } from "./storage-client.mjs";
 import {
   durableJson,
+  ensureAuthorityGitRepositoryLayout,
   git,
   noSymlinkAncestors,
   privateRoot,
@@ -86,7 +87,9 @@ class WorkspaceAuthority {
       const state = JSON.parse((await readRegular(path.join(directory, "state.json"), 1024 * 1024)).toString());
       if (typeof state.initialized !== "boolean" || !state.runs || !(state.head === null || GitOid.safeParse(state.head).success))
         throw new WorkspaceError("invalid_state", "Invalid durable workspace state; maintenance required");
-      authority.benches.set(b.id, { config: b, state, directory, repo: path.join(directory, "repo") });
+      const repo = path.join(directory, "repo");
+      await ensureAuthorityGitRepositoryLayout(repo);
+      authority.benches.set(b.id, { config: b, state, directory, repo });
     }
     if (config.dynamicWorkbenches) {
       for (const id of await fs.readdir(path.join(config.root, "state"))) {
@@ -98,7 +101,9 @@ class WorkspaceAuthority {
         await noSymlinkAncestors(b.cwd);
         const state = JSON.parse((await readRegular(path.join(directory, "state.json"), 1024 * 1024)).toString());
         if (typeof state.initialized !== "boolean" || !state.runs || !(state.head === null || GitOid.safeParse(state.head).success)) throw new WorkspaceError("invalid_state", "Invalid dynamic workspace state");
-        authority.benches.set(id, { config: b, state, directory, repo: path.join(directory, "repo") });
+        const repo = path.join(directory, "repo");
+        await ensureAuthorityGitRepositoryLayout(repo);
+        authority.benches.set(id, { config: b, state, directory, repo });
       }
     }
     return authority;
@@ -145,7 +150,9 @@ class WorkspaceAuthority {
         await noSymlinkAncestors(config.cwd);
         const state = JSON.parse((await readRegular(path.join(directory, "state.json"), 1024 * 1024)).toString());
         if (typeof state.initialized !== "boolean" || !state.runs || !(state.head === null || GitOid.safeParse(state.head).success)) throw new WorkspaceError("invalid_state", "Invalid workspace state");
-        const bench = { config, state, directory, repo: path.join(directory, "repo") };
+        const repo = path.join(directory, "repo");
+        await ensureAuthorityGitRepositoryLayout(repo);
+        const bench = { config, state, directory, repo };
         this.benches.set(config.id, bench);
         return bench;
       })();

package/dist/mjs/runtime/workspace/files.mjs

@@ -35,6 +35,33 @@ async function readRegular(file, limit = 32 * 1024 * 1024) {
     await handle.close();
   }
 }
+async function ensureAuthorityGitRepositoryLayout(repo) {
+  await noSymlinkAncestors(repo);
+  const repository = await fs.lstat(repo);
+  if (!repository.isDirectory() || repository.isSymbolicLink()) throw new WorkspaceError("unsafe_git", "Authority Git repository is invalid");
+  await readRegular(path.join(repo, "HEAD"), 4096);
+  await readRegular(path.join(repo, "config"), 128 * 1024);
+  for (const relative of ["objects", "objects/info", "objects/pack", "refs", "refs/heads", "refs/tags"]) {
+    const target = path.join(repo, relative);
+    let created = false;
+    try {
+      await fs.mkdir(target, { mode: 448 });
+      created = true;
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+    }
+    const entry = await fs.lstat(target);
+    if (!entry.isDirectory() || entry.isSymbolicLink()) throw new WorkspaceError("unsafe_git", "Authority Git structure is invalid");
+    if (created) {
+      const parent = await fs.open(path.dirname(target), constants.O_RDONLY);
+      try {
+        await parent.sync();
+      } finally {
+        await parent.close();
+      }
+    }
+  }
+}
 async function durableJson(file, value) {
   const temporary = `${file}.next`;
   const handle = await fs.open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 384);
@@ -295,6 +322,7 @@ async function snapshotTree(repo, cwd, canonicalHead) {
 }
 export {
   durableJson,
+  ensureAuthorityGitRepositoryLayout,
   git,
   noSymlinkAncestors,
   privateRoot,

package/dist/types/runtime/workspace/files.d.ts

@@ -2,6 +2,10 @@ export declare const sha256: (bytes: Buffer | string) => string;
 export declare function privateRoot(root: string, installationId: string): Promise<void>;
 export declare function noSymlinkAncestors(file: string): Promise<void>;
 export declare function readRegular(file: string, limit?: number): Promise<Buffer>;
+/** File-only migration capsules can omit Git's empty structural directories.
+ * Restore only that directory skeleton after confirming the authority-owned
+ * repository markers; refs, objects, indexes and configuration are untouched. */
+export declare function ensureAuthorityGitRepositoryLayout(repo: string): Promise<void>;
 export declare function durableJson(file: string, value: unknown): Promise<void>;
 /** All Git operates in authority-created repos; NEVER workbench .git/config/index.
  * hash-object --no-filters and update-index --index-info replace git add/checkout.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.138",
+  "version": "0.0.140",
   "type": "module",
   "main": "./dist/mjs/main.mjs",
   "module": "./dist/mjs/main.mjs",
@@ -21,8 +21,8 @@
     "r5d-worker": "dist/mjs/main.mjs"
   },
   "dependencies": {
-    "@ricsam/r5d-api": "^0.0.138",
-    "@ricsam/r5dctl": "0.0.138",
+    "@ricsam/r5d-api": "^0.0.140",
+    "@ricsam/r5dctl": "0.0.140",
     "node-pty": "1.1.0",
     "zod": "^4.1.13",
     "picomatch": "^4.0.3"