@ricsam/r5d-worker 0.0.145 → 0.0.147

package/README.md

@@ -8,3 +8,5 @@ r5d-worker manager /absolute/private/manager-config.json
 ```
 
 The executor retains processes and durable receipts independently of application releases. The manager authenticates the approved workspace keeper and retains old adapters until their delivery receipts are settled. Configuration and host roots belong exclusively to one installation. Never share an executor's state directory, credentials or workspace root between environments.
+
+The published worker has an exact-version dependency on `@ricsam/r5dctl`. A personal worker resolves that bundled CLI before the host `PATH`, verifies that its package version equals the running worker version, and exposes it to agent shells through a private worker-owned wrapper. Each worker remains bound to one server origin and installation, so stage, production, and review workers cannot accidentally select another environment's global CLI or credentials.

package/dist/cjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.145",
+  "version": "0.0.147",
   "type": "commonjs"
 }

package/dist/mjs/main.mjs

@@ -7,7 +7,7 @@ import { startManagerRpc } from "./runtime/releases/rpc-main.mjs";
 import { ManagerRpcConfig } from "./runtime/releases/rpc-protocol.mjs";
 const args = process.argv.slice(2);
 if (args.includes("--version")) {
-  console.log(`r5d-worker ${true ? "0.0.145" : "development"}`);
+  console.log(`r5d-worker ${true ? "0.0.147" : "development"}`);
 } else if (!args.length || args.includes("--help")) {
   console.log(
     "Usage: r5d-worker start --label <label> [--root <dir>] [--base-url <url>] [--token <worker-token>]\n       r5d-worker executor /absolute/private/config.json\n       r5d-worker manager /absolute/private/config.json\n\nRun independently supervised durable runtime services. Provision configuration with r5dinfra."
@@ -15,7 +15,7 @@ if (args.includes("--version")) {
 } else if (args[0] === "start") {
   const runtime = await startPersonalWorker(
     parsePersonalWorkerOptions(args.slice(1)),
-    true ? "0.0.145" : "development"
+    true ? "0.0.147" : "development"
   );
   console.log(`Worker connected: ${runtime.resourceId}`);
   let closing = false;

package/dist/mjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.145",
+  "version": "0.0.147",
   "type": "module"
 }

package/dist/mjs/personal/cli-entrypoint.mjs

@@ -0,0 +1,59 @@
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { promises as fs } from "node:fs";
+const PACKAGE_NAME = "@ricsam/r5dctl";
+function packageMain(moduleUrl) {
+  const module = fileURLToPath(moduleUrl);
+  return path.join(path.dirname(module), path.extname(module) === ".cjs" ? "main.cjs" : "main.mjs");
+}
+async function inspectPackage(candidate) {
+  const entrypoint = await fs.realpath(candidate);
+  const entrypointStat = await fs.lstat(entrypoint);
+  if (!entrypointStat.isFile() || entrypointStat.nlink !== 1 || entrypointStat.mode & 18 || ![0, process.getuid?.()].includes(entrypointStat.uid))
+    throw new Error("Untrusted installed r5dctl entrypoint");
+  let directory = path.dirname(entrypoint);
+  for (let depth = 0; depth < 6; depth += 1) {
+    const manifest = path.join(directory, "package.json");
+    try {
+      const stat = await fs.lstat(manifest);
+      if (!stat.isFile() || stat.nlink !== 1 || stat.mode & 18 || ![0, process.getuid?.()].includes(stat.uid))
+        throw new Error("Untrusted installed r5dctl package manifest");
+      const parsed = JSON.parse(await fs.readFile(manifest, "utf8"));
+      if (parsed?.name === PACKAGE_NAME) {
+        if (typeof parsed.version !== "string" || !/^\d+\.\d+\.\d+(?:-[a-zA-Z0-9.-]+)?$/.test(parsed.version))
+          throw new Error("Invalid installed r5dctl package version");
+        return { entrypoint, version: parsed.version };
+      }
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+    const parent = path.dirname(directory);
+    if (parent === directory) break;
+    directory = parent;
+  }
+  throw new Error("Resolved r5dctl entrypoint is not inside an @ricsam/r5dctl package");
+}
+async function resolvePersonalCliEntrypoint(explicit, workerVersion, dependencies = {}) {
+  let source, candidate;
+  if (explicit) {
+    source = "explicit";
+    candidate = explicit;
+  } else {
+    try {
+      const resolvePackage = dependencies.resolvePackage ?? ((specifier) => import.meta.resolve(specifier));
+      candidate = packageMain(resolvePackage(`${PACKAGE_NAME}/cli`));
+      source = "bundled";
+    } catch {
+      source = "path";
+      candidate = (dependencies.which ?? Bun.which)("r5dctl");
+    }
+  }
+  if (!candidate) throw new Error("Install @ricsam/r5dctl before starting this worker");
+  const inspected = await inspectPackage(candidate);
+  if (workerVersion !== "development" && inspected.version !== workerVersion)
+    throw new Error(`r5d-worker ${workerVersion} requires its bundled r5dctl ${workerVersion}; resolved ${inspected.version}`);
+  return { ...inspected, source };
+}
+export {
+  resolvePersonalCliEntrypoint
+};

package/dist/mjs/personal/client.mjs

@@ -1,5 +1,4 @@
 import path from "node:path";
-import { fileURLToPath } from "node:url";
 import os from "node:os";
 import { createHash, randomUUID } from "node:crypto";
 import { promises as fs, openSync, closeSync } from "node:fs";
@@ -7,9 +6,10 @@ import { Database } from "bun:sqlite";
 import { canonicalJson } from "@ricsam/r5d-api/runtime-protocol";
 import { privateDirectory, readPrivateJson } from "../runtime/storage.mjs";
 import { openPersonalWorkerRuntime, PersonalWorkerGrant } from "./runtime.mjs";
-import { installCliUpdate, readInstalledCliVersion } from "../cli-update.mjs";
+import { installCliUpdate } from "../cli-update.mjs";
 import { WorkspaceError } from "../runtime/workspace/contracts.mjs";
 import { PersonalActionScheduler } from "./action-scheduler.mjs";
+import { resolvePersonalCliEntrypoint } from "./cli-entrypoint.mjs";
 class PersonalResponseError extends Error {
   constructor(code, status, rejectedBeforeAdmission) {
     super(`Personal worker request failed (${status})`);
@@ -95,9 +95,11 @@ async function startPersonalWorker(options, version) {
     }
     return data;
   }
+  const cli = await resolvePersonalCliEntrypoint(options.cliEntrypoint, version);
   const metadata = () => ({
     version,
-    r5dctlVersion: readInstalledCliVersion("r5dctl"),
+    r5dctlVersion: cli.version,
+    r5dctlSource: cli.source,
     platform: process.platform,
     arch: process.arch,
     hostname: os.hostname(),
@@ -106,18 +108,9 @@ async function startPersonalWorker(options, version) {
   const grant = PersonalWorkerGrant.parse(
     await request("/api/personal/resources/register", { kind: "worker", ...identity, label: options.label, metadata: metadata() })
   );
-  let cliEntrypoint = options.cliEntrypoint ?? Bun.which("r5dctl");
-  if (!cliEntrypoint) {
-    try {
-      const module = fileURLToPath(import.meta.resolve("@ricsam/r5dctl/cli"));
-      cliEntrypoint = path.join(path.dirname(module), path.extname(module) === ".cjs" ? "main.cjs" : "main.mjs");
-    } catch {
-    }
-  }
-  if (!cliEntrypoint) throw new Error("Install @ricsam/r5dctl before starting this worker");
   const runtime = await openPersonalWorkerRuntime({
     root,
-    cliEntrypoint,
+    cliEntrypoint: cli.entrypoint,
     grant,
     storage: (sessionId) => async (storageRequest) => {
       try {

package/dist/mjs/runtime/workspace/authority.mjs

@@ -19,6 +19,7 @@ import {
   durableJson,
   ensureAuthorityGitRepositoryLayout,
   git,
+  materializeTree,
   noSymlinkAncestors,
   privateRoot,
   readHostRegular,
@@ -542,15 +543,7 @@ class WorkspaceAuthority {
     const entries = await selectedTree(b.repo, head);
     const staged = path.join(b.directory, `hydrate-${randomUUID()}`);
     await fs.mkdir(staged, { mode: 448 });
-    let total = 0;
-    for (const entry of entries) {
-      const bytes = await git(b.repo, ["cat-file", "blob", entry.oid]);
-      sourceBytes(bytes, entry.file);
-      if ((total += bytes.length) > 128 * 1024 * 1024) throw new WorkspaceError("too_large", "Hydrated tree exceeds limit");
-      const target = path.join(staged, entry.file);
-      await fs.mkdir(path.dirname(target), { recursive: true, mode: 448 });
-      await fs.writeFile(target, bytes, { mode: entry.mode === "100755" ? 448 : 384, flag: "wx" });
-    }
+    await materializeTree(b.repo, staged, entries, 128 * 1024 * 1024, "Hydrated tree exceeds limit");
     await verifyIgnore(b.repo, staged);
     const latest = await storage.read({
       method: "repository.get",
@@ -573,14 +566,16 @@ class WorkspaceAuthority {
     } else {
       await this.cleanRefreshBase(b, expectedBase);
       const original = await selectedTree(b.repo, expectedBase);
-      const originalPaths = new Set(original.map((entry) => entry.file));
+      const originalPaths = new Map(original.map((entry) => [entry.file, entry]));
       for (const entry of entries) {
         const target = path.join(b.config.cwd, entry.file);
         const existing = await fs.lstat(target).catch((error) => {
           if (error.code === "ENOENT") return null;
           throw error;
         });
-        if (existing && (!originalPaths.has(entry.file) || !existing.isFile() || existing.isSymbolicLink()))
+        const originalEntry = originalPaths.get(entry.file);
+        const expectedType = entry.mode === "160000" ? existing?.isDirectory() : existing?.isFile();
+        if (existing && (!originalEntry || originalEntry.mode === "160000" !== (entry.mode === "160000") || !expectedType || existing.isSymbolicLink()))
           throw new WorkspaceError("refresh_collision", "Canonical source would replace retained local content");
         let parent = path.dirname(target);
         while (parent !== b.config.cwd) {
@@ -625,6 +620,7 @@ class WorkspaceAuthority {
         changed(path.dirname(destination), retained);
       }
       for (const entry of original) {
+        if (entry.mode === "160000") continue;
         const destination = path.join(retained, "source", entry.file);
         await fs.mkdir(path.dirname(destination), { recursive: true, mode: 448 });
         await persistFile(path.join(b.config.cwd, entry.file));
@@ -634,6 +630,11 @@ class WorkspaceAuthority {
       }
       for (const entry of entries) {
         const destination = path.join(b.config.cwd, entry.file);
+        if (entry.mode === "160000") {
+          await fs.mkdir(destination, { recursive: true, mode: 448 });
+          changed(destination, b.config.cwd);
+          continue;
+        }
         await fs.mkdir(path.dirname(destination), { recursive: true, mode: 448 });
         await persistFile(path.join(staged, entry.file));
         await fs.rename(path.join(staged, entry.file), destination);
@@ -1001,15 +1002,7 @@ class WorkspaceAuthority {
     const entries = await selectedTree(b.repo, head);
     const staged = path.join(b.directory, `import-${randomUUID()}`);
     await fs.mkdir(staged, { mode: 448 });
-    let total = 0;
-    for (const entry of entries) {
-      const bytes2 = await git(b.repo, ["cat-file", "blob", entry.oid]);
-      sourceBytes(bytes2, entry.file);
-      if ((total += bytes2.length) > STORAGE_LIMITS.blobBytes) throw new WorkspaceError("too_large", "Imported tree exceeds limit");
-      const destination = path.join(staged, entry.file);
-      await fs.mkdir(path.dirname(destination), { recursive: true, mode: 448 });
-      await fs.writeFile(destination, bytes2, { mode: entry.mode === "100755" ? 448 : 384, flag: "wx" });
-    }
+    await materializeTree(b.repo, staged, entries, STORAGE_LIMITS.blobBytes, "Imported tree exceeds limit");
     const ignore = path.join(staged, ".gitignore");
     try {
       await verifyIgnore(b.repo, staged);

package/dist/mjs/runtime/workspace/files.mjs

@@ -225,17 +225,34 @@ function sourceBytes(bytes, file) {
 async function selectedTree(repo, commit) {
   if (!/^[0-9a-f]{40}$/.test(commit) || (await git(repo, ["cat-file", "-t", commit])).toString().trim() !== "commit")
     throw new WorkspaceError("invalid_tip", "Selected tip must be a SHA-1 commit");
-  const raw = await git(repo, ["ls-tree", "-rz", "--full-tree", commit]);
+  const raw = await git(repo, ["ls-tree", "-r", "-z", "--full-tree", commit]);
   if (!Buffer.from(raw.toString("utf8")).equals(raw)) throw new WorkspaceError("unsafe_path", "Non-UTF8 tree names unsupported");
-  const entries = raw.toString("utf8").split("\0").filter(Boolean).map((record) => {
-    const match = /^(100644|100755) blob ([0-9a-f]{40})\t(.+)$/.exec(record);
-    if (!match) throw new WorkspaceError("unsafe_tree", "Symlinks, gitlinks and special modes unsupported");
-    sourcePath(match[3]);
-    return { file: match[3], mode: match[1], oid: match[2] };
-  });
-  if (entries.length > STORAGE_LIMITS.treeEntries) throw new WorkspaceError("too_large", "Too many source entries");
+  const records = raw.toString("utf8").split("\0").filter(Boolean);
+  if (records.length > STORAGE_LIMITS.treeEntries) throw new WorkspaceError("too_large", "Too many source entries");
+  const entries = [];
+  for (const record of records) {
+    const match = /^(?:(100644|100755) blob|(160000) commit) ([0-9a-f]{40})\t(.+)$/.exec(record);
+    if (!match) throw new WorkspaceError("unsafe_tree", "Symlinks and special tree modes unsupported");
+    sourcePath(match[4]);
+    entries.push({ file: match[4], mode: match[1] ?? match[2], oid: match[3] });
+  }
   return entries;
 }
+async function materializeTree(repo, destination, entries, limit, message) {
+  let total = 0;
+  for (const entry of entries) {
+    const target = path.join(destination, entry.file);
+    if (entry.mode === "160000") {
+      await fs.mkdir(target, { recursive: true, mode: 448 });
+      continue;
+    }
+    const bytes = await git(repo, ["cat-file", "blob", entry.oid]);
+    sourceBytes(bytes, entry.file);
+    if ((total += bytes.length) > limit) throw new WorkspaceError("too_large", message);
+    await fs.mkdir(path.dirname(target), { recursive: true, mode: 448 });
+    await fs.writeFile(target, bytes, { mode: entry.mode === "100755" ? 448 : 384, flag: "wx" });
+  }
+}
 async function verifyIgnore(repo, cwd) {
   await readRegular(path.join(cwd, ".gitignore"), 64 * 1024);
   const probes = [
@@ -261,6 +278,7 @@ async function verifyIgnore(repo, cwd) {
 }
 async function snapshotTree(repo, cwd, canonicalHead) {
   const metadata = path.join(cwd, ".git");
+  let workbenchIndex = null;
   if (await fs.lstat(metadata).then(
     () => true,
     (e) => {
@@ -305,24 +323,84 @@ async function snapshotTree(repo, cwd, canonicalHead) {
       await fs.writeFile(copy, await readRegular(index, 8 * 1024 * 1024), { mode: 384 });
       if ((await git(repo, ["ls-files", "--unmerged", "-z"], void 0, copy)).length)
         throw new WorkspaceError("workbench_conflict", "Unmerged index entries retained; resolve explicitly before publication");
+      workbenchIndex = copy;
+    }
+  }
+  const canonical = canonicalHead ? await selectedTree(repo, canonicalHead) : [];
+  const indexedGitlinks = /* @__PURE__ */ new Map();
+  if (workbenchIndex) {
+    const indexed = await git(repo, ["ls-files", "--stage", "-z"], void 0, workbenchIndex);
+    if (!Buffer.from(indexed.toString()).equals(indexed)) throw new WorkspaceError("unsafe_path", "Non-UTF8 index names unsupported");
+    for (const record of indexed.toString().split("\0").filter(Boolean)) {
+      const match = /^160000 ([0-9a-f]{40}) 0\t(.+)$/.exec(record);
+      if (record.startsWith("160000 ") && !match) throw new WorkspaceError("unsafe_tree", "Malformed gitlink index entry");
+      if (!match) continue;
+      sourcePath(match[2]);
+      indexedGitlinks.set(match[2], match[1]);
     }
   }
+  const canonicalGitlinks = new Map(canonical.filter((entry) => entry.mode === "160000").map((entry) => [entry.file, entry.oid]));
+  const gitlinks = new Map([...canonicalGitlinks, ...indexedGitlinks]);
+  for (const file of [...gitlinks.keys()]) {
+    const entry = await fs.lstat(path.join(cwd, file)).catch((error) => {
+      if (error.code === "ENOENT" || error.code === "ENOTDIR") return null;
+      throw error;
+    });
+    if (!entry) gitlinks.delete(file);
+    else if (!entry.isDirectory() || entry.isSymbolicLink()) gitlinks.delete(file);
+  }
+  const gitlinkRoots = [];
+  for (const file of [...gitlinks.keys()].sort((a, b) => a.split("/").length - b.split("/").length || a.localeCompare(b))) {
+    let parent = path.posix.dirname(file);
+    let nested = false;
+    while (parent !== ".") {
+      if (gitlinks.has(parent)) {
+        nested = true;
+        break;
+      }
+      parent = path.posix.dirname(parent);
+    }
+    if (nested) gitlinks.delete(file);
+    else gitlinkRoots.push(file);
+  }
   await verifyIgnore(repo, cwd);
   await git(repo, ["read-tree", "--empty"]);
-  const listing = await git(repo, [`--work-tree=${cwd}`, "ls-files", "--others", "--exclude-standard", "-z"]);
+  const listing = await git(repo, [
+    `--work-tree=${cwd}`,
+    "ls-files",
+    "--others",
+    "--exclude-standard",
+    "-z",
+    "--",
+    ".",
+    ...gitlinkRoots.map((file) => `:(exclude,literal)${file}`)
+  ]);
   if (!Buffer.from(listing.toString()).equals(listing)) throw new WorkspaceError("unsafe_path", "Non-UTF8 names unsupported");
-  const tracked = [];
-  if (canonicalHead) for (const entry of await selectedTree(repo, canonicalHead)) {
-    const exists = await fs.lstat(path.join(cwd, entry.file)).then(() => true, (error) => {
-      if (error.code === "ENOENT") return false;
+  const beneathGitlink = (file) => {
+    let current = file;
+    while (true) {
+      if (gitlinks.has(current)) return true;
+      const parent = path.posix.dirname(current);
+      if (parent === "." || parent === current) return false;
+      current = parent;
+    }
+  };
+  const tracked = canonical.filter((entry) => entry.mode !== "160000").map((entry) => entry.file);
+  const existingTracked = [];
+  for (const file of tracked) {
+    const exists = await fs.lstat(path.join(cwd, file)).then(() => true, (error) => {
+      if (error.code === "ENOENT" || error.code === "ENOTDIR") return false;
       throw error;
     });
-    if (exists) tracked.push(entry.file);
+    if (exists) existingTracked.push(file);
   }
-  const files = [.../* @__PURE__ */ new Set([...listing.toString().split("\0").filter(Boolean), ...tracked])].sort();
-  if (files.length > STORAGE_LIMITS.treeEntries) throw new WorkspaceError("too_large", "Too many source files");
+  const files = [.../* @__PURE__ */ new Set([...listing.toString().split("\0").filter(Boolean), ...existingTracked])].filter((file) => !beneathGitlink(file)).sort();
+  if (files.length + gitlinks.size > STORAGE_LIMITS.treeEntries) throw new WorkspaceError("too_large", "Too many source files");
   let size = 0;
-  const records = [];
+  const records = [...gitlinks].map(([file, oid]) => ({
+    file,
+    value: `160000 ${oid}	${file}\0`
+  }));
   for (const file of files) {
     sourcePath(file);
     const bytes = await readRegular(path.join(cwd, file));
@@ -330,16 +408,17 @@ async function snapshotTree(repo, cwd, canonicalHead) {
     if ((size += bytes.length) > 128 * 1024 * 1024) throw new WorkspaceError("too_large", "Source snapshot exceeds 128 MiB");
     const st = await fs.lstat(path.join(cwd, file));
     const oid = (await git(repo, ["hash-object", "-w", "--stdin", "--no-filters"], bytes)).toString().trim();
-    records.push(`${st.mode & 73 ? "100755" : "100644"} ${oid}	${file}\0`);
+    records.push({ file, value: `${st.mode & 73 ? "100755" : "100644"} ${oid}	${file}\0` });
   }
   if (!files.includes(".gitignore")) throw new WorkspaceError("ignore_policy", "The .gitignore policy itself must be published");
-  await git(repo, ["update-index", "-z", "--index-info"], records.join(""));
+  await git(repo, ["update-index", "-z", "--index-info"], records.sort((a, b) => a.file.localeCompare(b.file)).map((record) => record.value).join(""));
   return (await git(repo, ["write-tree"])).toString().trim();
 }
 export {
   durableJson,
   ensureAuthorityGitRepositoryLayout,
   git,
+  materializeTree,
   noSymlinkAncestors,
   privateRoot,
   readHostRegular,

package/dist/types/personal/cli-entrypoint.d.ts

@@ -0,0 +1,13 @@
+type ResolutionDependencies = {
+    resolvePackage?: (specifier: string) => string;
+    which?: (command: string) => string | null;
+};
+export type PersonalCliEntrypoint = {
+    entrypoint: string;
+    version: string;
+    source: "explicit" | "bundled" | "path";
+};
+/** Resolve the CLI that agent shells receive. Published workers always prefer
+ * their exact npm dependency; PATH is only a development/source fallback. */
+export declare function resolvePersonalCliEntrypoint(explicit: string | undefined, workerVersion: string, dependencies?: ResolutionDependencies): Promise<PersonalCliEntrypoint>;
+export {};

package/dist/types/runtime/workspace/files.d.ts

@@ -20,9 +20,10 @@ export declare function sourcePath(file: string): void;
 export declare function sourceBytes(bytes: Buffer, file?: string): void;
 export type TreeEntry = {
     file: string;
-    mode: string;
+    mode: "100644" | "100755" | "160000";
     oid: string;
 };
 export declare function selectedTree(repo: string, commit: string): Promise<TreeEntry[]>;
+export declare function materializeTree(repo: string, destination: string, entries: TreeEntry[], limit: number, message: string): Promise<void>;
 export declare function verifyIgnore(repo: string, cwd: string): Promise<void>;
 export declare function snapshotTree(repo: string, cwd: string, canonicalHead?: string | null): Promise<string>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.145",
+  "version": "0.0.147",
   "type": "module",
   "main": "./dist/mjs/main.mjs",
   "module": "./dist/mjs/main.mjs",
@@ -21,8 +21,8 @@
     "r5d-worker": "dist/mjs/main.mjs"
   },
   "dependencies": {
-    "@ricsam/r5d-api": "^0.0.145",
-    "@ricsam/r5dctl": "0.0.145",
+    "@ricsam/r5d-api": "^0.0.147",
+    "@ricsam/r5dctl": "0.0.147",
     "node-pty": "1.1.0",
     "zod": "^4.1.13",
     "picomatch": "^4.0.3"