@ricsam/r5d-worker 0.0.152 → 0.0.153

package/dist/mjs/main.mjs

@@ -7,7 +7,7 @@ import { startManagerRpc } from "./runtime/releases/rpc-main.mjs";
 import { ManagerRpcConfig } from "./runtime/releases/rpc-protocol.mjs";
 const args = process.argv.slice(2);
 if (args.includes("--version")) {
-  console.log(`r5d-worker ${true ? "0.0.152" : "development"}`);
+  console.log(`r5d-worker ${true ? "0.0.153" : "development"}`);
 } else if (!args.length || args.includes("--help")) {
   console.log(
     "Usage: r5d-worker start --label <label> [--root <dir>] [--base-url <url>] [--token <worker-token>]\n       r5d-worker executor /absolute/private/config.json\n       r5d-worker manager /absolute/private/config.json\n\nRun independently supervised durable runtime services. Provision configuration with r5dinfra."
@@ -15,7 +15,7 @@ if (args.includes("--version")) {
 } else if (args[0] === "start") {
   const runtime = await startPersonalWorker(
     parsePersonalWorkerOptions(args.slice(1)),
-    true ? "0.0.152" : "development"
+    true ? "0.0.153" : "development"
   );
   console.log(`Worker connected: ${runtime.resourceId}`);
   let closing = false;

package/dist/mjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.152",
+  "version": "0.0.153",
   "type": "module"
 }

package/dist/mjs/personal/cli-entrypoint.mjs

@@ -6,6 +6,16 @@ function packageMain(moduleUrl) {
   const module = fileURLToPath(moduleUrl);
   return path.join(path.dirname(module), path.extname(module) === ".cjs" ? "main.cjs" : "main.mjs");
 }
+function internalMain(moduleUrl) {
+  return path.join(path.dirname(fileURLToPath(moduleUrl)), "..", "internal-r5dctl.cjs");
+}
+async function inspectInternal(candidate) {
+  const entrypoint = await fs.realpath(candidate);
+  const stat = await fs.lstat(entrypoint);
+  if (!stat.isFile() || stat.nlink !== 1 || stat.mode & 2 || ![0, process.getuid?.()].includes(stat.uid))
+    throw new Error("Untrusted internal r5dctl entrypoint");
+  return entrypoint;
+}
 async function inspectPackage(candidate) {
   const entrypoint = await fs.realpath(candidate);
   const entrypointStat = await fs.lstat(entrypoint);
@@ -39,13 +49,19 @@ async function resolvePersonalCliEntrypoint(explicit, workerVersion, dependencie
     source = "explicit";
     candidate = explicit;
   } else {
+    const bundled = dependencies.bundled ?? internalMain(import.meta.url);
     try {
-      const resolvePackage = dependencies.resolvePackage ?? ((specifier) => import.meta.resolve(specifier));
-      candidate = packageMain(resolvePackage(`${PACKAGE_NAME}/cli`));
-      source = "bundled";
-    } catch {
-      source = "path";
-      candidate = (dependencies.which ?? Bun.which)("r5dctl");
+      return { entrypoint: await inspectInternal(bundled), version: workerVersion, source: "bundled" };
+    } catch (error) {
+      if (error.code !== "ENOENT" || workerVersion !== "development") throw error;
+      try {
+        const resolvePackage = dependencies.resolvePackage ?? ((specifier) => import.meta.resolve(specifier));
+        candidate = packageMain(resolvePackage(`${PACKAGE_NAME}/cli`));
+        source = "bundled";
+      } catch {
+        source = "path";
+        candidate = (dependencies.which ?? Bun.which)("r5dctl");
+      }
     }
   }
   if (!candidate) throw new Error("Install @ricsam/r5dctl before starting this worker");

package/dist/mjs/personal/runtime.mjs

@@ -105,7 +105,7 @@ async function openPersonalWorkerRuntime(options) {
     let cliDirectory;
     if (options.cliEntrypoint) {
       const cli = await fs.realpath(options.cliEntrypoint), executable = await fs.realpath(process.execPath), stat = await fs.lstat(cli);
-      if (!stat.isFile() || stat.mode & 18 || ![0, process.getuid?.()].includes(stat.uid))
+      if (!stat.isFile() || stat.nlink !== 1 || stat.mode & 2 || ![0, process.getuid?.()].includes(stat.uid))
         throw new Error("Untrusted installed r5dctl entrypoint");
       cliDirectory = path.join(root, "bin");
       privateDirectory(cliDirectory);

package/dist/types/personal/cli-entrypoint.d.ts

@@ -1,4 +1,5 @@
 type ResolutionDependencies = {
+    bundled?: string;
     resolvePackage?: (specifier: string) => string;
     which?: (command: string) => string | null;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.152",
+  "version": "0.0.153",
   "type": "module",
   "main": "./dist/mjs/main.mjs",
   "module": "./dist/mjs/main.mjs",
@@ -21,8 +21,7 @@
     "r5d-worker": "dist/mjs/main.mjs"
   },
   "dependencies": {
-    "@ricsam/r5d-api": "^0.0.152",
-    "@ricsam/r5dctl": "0.0.152",
+    "@ricsam/r5d-api": "^0.0.153",
     "node-pty": "1.1.0",
     "zod": "^4.1.13",
     "picomatch": "^4.0.3"