@ricsam/r5d-worker 0.0.151 → 0.0.153

package/dist/mjs/main.mjs

@@ -7,7 +7,7 @@ import { startManagerRpc } from "./runtime/releases/rpc-main.mjs";
 import { ManagerRpcConfig } from "./runtime/releases/rpc-protocol.mjs";
 const args = process.argv.slice(2);
 if (args.includes("--version")) {
-  console.log(`r5d-worker ${true ? "0.0.151" : "development"}`);
+  console.log(`r5d-worker ${true ? "0.0.153" : "development"}`);
 } else if (!args.length || args.includes("--help")) {
   console.log(
     "Usage: r5d-worker start --label <label> [--root <dir>] [--base-url <url>] [--token <worker-token>]\n       r5d-worker executor /absolute/private/config.json\n       r5d-worker manager /absolute/private/config.json\n\nRun independently supervised durable runtime services. Provision configuration with r5dinfra."
@@ -15,7 +15,7 @@ if (args.includes("--version")) {
 } else if (args[0] === "start") {
   const runtime = await startPersonalWorker(
     parsePersonalWorkerOptions(args.slice(1)),
-    true ? "0.0.151" : "development"
+    true ? "0.0.153" : "development"
   );
   console.log(`Worker connected: ${runtime.resourceId}`);
   let closing = false;

package/dist/mjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.151",
+  "version": "0.0.153",
   "type": "module"
 }

package/dist/mjs/personal/cli-entrypoint.mjs

@@ -6,6 +6,16 @@ function packageMain(moduleUrl) {
   const module = fileURLToPath(moduleUrl);
   return path.join(path.dirname(module), path.extname(module) === ".cjs" ? "main.cjs" : "main.mjs");
 }
+function internalMain(moduleUrl) {
+  return path.join(path.dirname(fileURLToPath(moduleUrl)), "..", "internal-r5dctl.cjs");
+}
+async function inspectInternal(candidate) {
+  const entrypoint = await fs.realpath(candidate);
+  const stat = await fs.lstat(entrypoint);
+  if (!stat.isFile() || stat.nlink !== 1 || stat.mode & 2 || ![0, process.getuid?.()].includes(stat.uid))
+    throw new Error("Untrusted internal r5dctl entrypoint");
+  return entrypoint;
+}
 async function inspectPackage(candidate) {
   const entrypoint = await fs.realpath(candidate);
   const entrypointStat = await fs.lstat(entrypoint);
@@ -39,13 +49,19 @@ async function resolvePersonalCliEntrypoint(explicit, workerVersion, dependencie
     source = "explicit";
     candidate = explicit;
   } else {
+    const bundled = dependencies.bundled ?? internalMain(import.meta.url);
     try {
-      const resolvePackage = dependencies.resolvePackage ?? ((specifier) => import.meta.resolve(specifier));
-      candidate = packageMain(resolvePackage(`${PACKAGE_NAME}/cli`));
-      source = "bundled";
-    } catch {
-      source = "path";
-      candidate = (dependencies.which ?? Bun.which)("r5dctl");
+      return { entrypoint: await inspectInternal(bundled), version: workerVersion, source: "bundled" };
+    } catch (error) {
+      if (error.code !== "ENOENT" || workerVersion !== "development") throw error;
+      try {
+        const resolvePackage = dependencies.resolvePackage ?? ((specifier) => import.meta.resolve(specifier));
+        candidate = packageMain(resolvePackage(`${PACKAGE_NAME}/cli`));
+        source = "bundled";
+      } catch {
+        source = "path";
+        candidate = (dependencies.which ?? Bun.which)("r5dctl");
+      }
     }
   }
   if (!candidate) throw new Error("Install @ricsam/r5dctl before starting this worker");

package/dist/mjs/personal/runtime.mjs

@@ -105,7 +105,7 @@ async function openPersonalWorkerRuntime(options) {
     let cliDirectory;
     if (options.cliEntrypoint) {
       const cli = await fs.realpath(options.cliEntrypoint), executable = await fs.realpath(process.execPath), stat = await fs.lstat(cli);
-      if (!stat.isFile() || stat.mode & 18 || ![0, process.getuid?.()].includes(stat.uid))
+      if (!stat.isFile() || stat.nlink !== 1 || stat.mode & 2 || ![0, process.getuid?.()].includes(stat.uid))
         throw new Error("Untrusted installed r5dctl entrypoint");
       cliDirectory = path.join(root, "bin");
       privateDirectory(cliDirectory);

package/dist/mjs/runtime/workspace/authority.mjs

@@ -94,6 +94,11 @@ class WorkspaceAuthority {
   linkedWorkbench(b) {
     return Boolean(b.config.namespace && b.config.projectName);
   }
+  githubOrigin(b) {
+    if (!b.config.namespace || !b.config.projectName)
+      throw new WorkspaceError("invalid_config", "Project checkout is missing its GitHub repository identity");
+    return `https://github.com/${b.config.namespace}/${b.config.projectName}.git`;
+  }
   resolveHostPath(value) {
     const expanded = value === "~" ? os.homedir() : value.startsWith("~/") ? path.join(os.homedir(), value.slice(2)) : value;
     if (!path.isAbsolute(expanded) || expanded.includes("\0")) throw new WorkspaceError("unsafe_path", "Host path must be absolute or home-relative");
@@ -783,10 +788,19 @@ class WorkspaceAuthority {
         if ((await fs.readdir(b.config.cwd)).length) throw new WorkspaceError("nonempty_workbench", "Linked worktree destination must be empty");
         await git(b.repo, ["worktree", "add", "--force", b.config.cwd, b.config.branch]);
       }
-      const remote2 = `r5d-canonical://${this.config.installationId}/${b.config.userId}/${b.config.repositoryId}`;
-      await git(b.repo, ["config", "remote.canonical.url", remote2]);
-      await git(b.repo, ["config", "remote.canonical.pushurl", remote2]);
+      const origin = this.githubOrigin(b);
+      await git(b.repo, ["config", "--local", "--replace-all", "remote.origin.url", origin]);
+      await git(b.repo, ["config", "--local", "--replace-all", "remote.origin.fetch", "+refs/heads/*:refs/remotes/origin/*"]);
+      const localConfig = (await readRegular(path.join(b.repo, "config"), 128 * 1024)).toString("utf8");
+      if (/^\[remote "canonical"\]\s*$/m.test(localConfig))
+        await git(b.repo, ["config", "--local", "--remove-section", "remote.canonical"]);
+      await git(b.repo, ["config", "--local", "--replace-all", `branch.${b.config.branch}.remote`, "origin"]);
+      await git(b.repo, ["config", "--local", "--replace-all", `branch.${b.config.branch}.merge`, `refs/heads/${b.config.branch}`]);
+      await git(b.repo, ["config", "--local", "--replace-all", "push.default", "upstream"]);
+      await git(b.repo, ["config", "--local", "--replace-all", "credential.helper", ""]);
+      await git(b.repo, ["config", "--local", "--replace-all", "credential.useHttpPath", "false"]);
       await git(b.repo, ["config", "protocol.allow", "never"]);
+      await git(b.repo, ["config", "protocol.https.allow", "always"]);
       return;
     }
     const destination = path.join(b.config.cwd, ".git");

package/dist/types/personal/cli-entrypoint.d.ts

@@ -1,4 +1,5 @@
 type ResolutionDependencies = {
+    bundled?: string;
     resolvePackage?: (specifier: string) => string;
     which?: (command: string) => string | null;
 };

package/dist/types/runtime/workspace/authority.d.ts

@@ -33,6 +33,7 @@ export declare class WorkspaceAuthority {
     private ensureRepository;
     private assertNonOverlappingCheckout;
     private linkedWorkbench;
+    private githubOrigin;
     private resolveHostPath;
     static open(options: WorkspaceAuthorityOptions): Promise<WorkspaceAuthority>;
     private readonly registrations;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.151",
+  "version": "0.0.153",
   "type": "module",
   "main": "./dist/mjs/main.mjs",
   "module": "./dist/mjs/main.mjs",
@@ -21,8 +21,7 @@
     "r5d-worker": "dist/mjs/main.mjs"
   },
   "dependencies": {
-    "@ricsam/r5d-api": "^0.0.151",
-    "@ricsam/r5dctl": "0.0.151",
+    "@ricsam/r5d-api": "^0.0.153",
     "node-pty": "1.1.0",
     "zod": "^4.1.13",
     "picomatch": "^4.0.3"