@ricsam/r5d-worker 0.0.158 → 0.0.160

package/dist/cjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.158",
+  "version": "0.0.160",
   "type": "commonjs"
 }

package/dist/mjs/internal-r5dctl.cjs

@@ -20605,7 +20605,7 @@ function resolveEntrypointPath(entrypoint) {
   }
 }
 function getR5dctlVersion() {
-  if (true) return "0.0.158";
+  if (true) return "0.0.160";
   const entrypoint = process.argv[1] ? resolveEntrypointPath(process.argv[1]) : null;
   let current = entrypoint ? import_node_path2.default.dirname(entrypoint) : process.cwd();
   for (let index = 0; index < 12; index += 1) {

package/dist/mjs/main.mjs

@@ -7,7 +7,7 @@ import { startManagerRpc } from "./runtime/releases/rpc-main.mjs";
 import { ManagerRpcConfig } from "./runtime/releases/rpc-protocol.mjs";
 const args = process.argv.slice(2);
 if (args.includes("--version")) {
-  console.log(`r5d-worker ${true ? "0.0.158" : "development"}`);
+  console.log(`r5d-worker ${true ? "0.0.160" : "development"}`);
 } else if (!args.length || args.includes("--help")) {
   console.log(
     "Usage: r5d-worker start --label <label> [--root <dir>] [--base-url <url>] [--token <worker-token>]\n       r5d-worker executor /absolute/private/config.json\n       r5d-worker manager /absolute/private/config.json\n\nRun independently supervised durable runtime services. Provision configuration with r5dinfra."
@@ -15,7 +15,7 @@ if (args.includes("--version")) {
 } else if (args[0] === "start") {
   const runtime = await startPersonalWorker(
     parsePersonalWorkerOptions(args.slice(1)),
-    true ? "0.0.158" : "development"
+    true ? "0.0.160" : "development"
   );
   console.log(`Worker connected: ${runtime.resourceId}`);
   let closing = false;

package/dist/mjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.158",
+  "version": "0.0.160",
   "type": "module"
 }

package/dist/mjs/personal/runtime.mjs

@@ -254,7 +254,6 @@ exec ${quote(executable)} ${quote(cli)} "$@"
       }
     }
     const blockedPublicationCodes = /* @__PURE__ */ new Set([
-      "ignore_policy",
       "secret_or_runtime_path",
       "secret_content",
       "unsafe_file",

package/dist/mjs/runtime/workspace/authority.mjs

@@ -9,8 +9,7 @@ import { ExecutorError, isDefiniteStartRejection, ShellPayload } from "../protoc
 import {
   ApprovedWorkbench,
   WorkspaceConfig,
-  WorkspaceError,
-  DEFAULT_WORKSPACE_IGNORE
+  WorkspaceError
 } from "./contracts.mjs";
 import { SessionArtifactStore, SessionArtifactChunk, RESERVED_ARTIFACT_ENV } from "./artifacts.mjs";
 import { WorkspaceFileWrite, WorkspaceFileWriteLookup } from "./file-write.mjs";
@@ -27,8 +26,7 @@ import {
   selectedTree,
   sha256,
   snapshotTree,
-  sourceBytes,
-  verifyIgnore
+  sourceBytes
 } from "./files.mjs";
 const GITHUB_CREDENTIAL_HELPER = '!f() { if [ "$1" = get ] && [ -n "$R5D_GIT_CREDENTIAL" ]; then git credential-store --file="$R5D_GIT_CREDENTIAL" get; else return 0; fi; }; f';
 class WorkspaceAuthority {
@@ -554,7 +552,6 @@ class WorkspaceAuthority {
     const staged = path.join(b.directory, `hydrate-${randomUUID()}`);
     await fs.mkdir(staged, { mode: 448 });
     await materializeTree(b.repo, staged, entries, 128 * 1024 * 1024, "Hydrated tree exceeds limit");
-    await verifyIgnore(b.repo, staged);
     const latest = await storage.read({
       method: "repository.get",
       repositoryId: b.config.repositoryId,
@@ -767,14 +764,12 @@ class WorkspaceAuthority {
         branch: b.config.branch
       });
       if (existing.head) throw new WorkspaceError("conflict", "Canonical branch already has a head; hydrate instead");
-      await fs.writeFile(path.join(b.config.cwd, ".gitignore"), DEFAULT_WORKSPACE_IGNORE, { mode: 384, flag: "wx" });
       await fs.writeFile(path.join(b.config.cwd, "README.md"), readme, { mode: 384, flag: "wx" });
       b.state.initialized = true;
       b.state.blocked = null;
       await this.save(b);
       const result = await this.publishIdle(b, identity);
       if (this.linkedWorkbench(b)) {
-        await fs.unlink(path.join(b.config.cwd, ".gitignore"));
         await fs.unlink(path.join(b.config.cwd, "README.md"));
       }
       await this.installGitPolicy(b, result.head);
@@ -1037,21 +1032,6 @@ class WorkspaceAuthority {
     const staged = path.join(b.directory, `import-${randomUUID()}`);
     await fs.mkdir(staged, { mode: 448 });
     await materializeTree(b.repo, staged, entries, STORAGE_LIMITS.blobBytes, "Imported tree exceeds limit");
-    const ignore = path.join(staged, ".gitignore");
-    try {
-      await verifyIgnore(b.repo, staged);
-    } catch (error) {
-      if (!(error instanceof WorkspaceError) && error.code !== "ENOENT") throw error;
-      const oldIgnore = await fs.readFile(ignore, "utf8").catch((error2) => {
-        if (error2.code === "ENOENT") return "";
-        throw error2;
-      });
-      await fs.writeFile(ignore, `${oldIgnore}
-${DEFAULT_WORKSPACE_IGNORE}`, { mode: 384 });
-      await verifyIgnore(b.repo, staged);
-    }
-    const tree = await snapshotTree(b.repo, staged, head);
-    if (tree !== (await git(b.repo, ["rev-parse", `${head}^{tree}`])).toString().trim()) head = (await git(b.repo, ["commit-tree", tree, "-p", head], "Configure workspace exclusions\n")).toString().trim();
     const storage = await this.storage(b, identity), operationId = `product-${sha256(id).slice(0, 48)}`;
     let existing;
     try {

package/dist/mjs/runtime/workspace/contracts.mjs

@@ -36,29 +36,8 @@ class WorkspaceError extends Error {
   code;
   rejectedBeforeAdmission;
 }
-const DEFAULT_WORKSPACE_IGNORE = `# Required destination workbench exclusions; keep these rules effective.
-.env
-.env.*
-!.env.example
-node_modules/
-.r5d/
-.r5d-next/
-.ssh/
-.kube/
-secrets/
-credentials/
-.next/
-dist/
-build/
-coverage/
-.cache/
-.bun/
-*.pem
-*.key
-`;
 export {
   ApprovedWorkbench,
-  DEFAULT_WORKSPACE_IGNORE,
   WorkspaceConfig,
   WorkspaceError
 };

package/dist/mjs/runtime/workspace/files.mjs

@@ -253,36 +253,19 @@ async function materializeTree(repo, destination, entries, limit, message) {
     await fs.writeFile(target, bytes, { mode: entry.mode === "100755" ? 448 : 384, flag: "wx" });
   }
 }
-async function verifyIgnore(repo, cwd) {
-  try {
-    await readRegular(path.join(cwd, ".gitignore"), 64 * 1024);
-  } catch (error) {
-    if (error.code === "ENOENT")
-      throw new WorkspaceError("ignore_policy", "Restore an effective .gitignore before publishing source");
-    throw error;
-  }
-  const probes = [
-    ".env",
-    ".env.local",
-    "node_modules/probe",
-    ".r5d/probe",
-    ".r5d-next/probe",
-    ".ssh/probe",
-    ".kube/probe",
-    "secrets/probe",
-    "credentials/probe",
-    ".next/probe",
-    "dist/probe",
-    "coverage/probe",
-    ".cache/probe",
-    "probe.pem",
-    "probe.key"
-  ];
-  const ignored = (await git(repo, [`--work-tree=${cwd}`, "check-ignore", "--no-index", "-z", "--stdin"], probes.join("\0") + "\0")).toString().split("\0").filter(Boolean);
-  if (ignored.length !== probes.length || probes.some((p) => !ignored.includes(p)))
-    throw new WorkspaceError("ignore_policy", "Restore effective .gitignore rules for secrets, dependency, cache and runtime roots");
-}
 async function snapshotTree(repo, cwd, canonicalHead, maxBytes = 128 * 1024 * 1024) {
+  const exposedRootDependencies = await git(repo, [
+    `--work-tree=${cwd}`,
+    "ls-files",
+    "--others",
+    "--exclude-standard",
+    "--directory",
+    "-z",
+    "--",
+    ":(glob)**/node_modules/**"
+  ]);
+  if (exposedRootDependencies.length)
+    throw new WorkspaceError("too_large", "An unignored dependency tree exceeds the automatic publication limit");
   const metadata = path.join(cwd, ".git");
   let workbenchIndex = null;
   if (await fs.lstat(metadata).then(
@@ -419,8 +402,6 @@ async function snapshotTree(repo, cwd, canonicalHead, maxBytes = 128 * 1024 * 10
     const oid = (await git(repo, ["hash-object", "-w", "--stdin", "--no-filters"], bytes)).toString().trim();
     records.push({ file, value: `${st.mode & 73 ? "100755" : "100644"} ${oid}	${file}\0` });
   }
-  if (!files.includes(".gitignore")) throw new WorkspaceError("ignore_policy", "The .gitignore policy itself must be published");
-  await verifyIgnore(repo, cwd);
   await git(repo, ["update-index", "-z", "--index-info"], records.sort((a, b) => a.file.localeCompare(b.file)).map((record) => record.value).join(""));
   return (await git(repo, ["write-tree"])).toString().trim();
 }
@@ -437,6 +418,5 @@ export {
   sha256,
   snapshotTree,
   sourceBytes,
-  sourcePath,
-  verifyIgnore
+  sourcePath
 };

package/dist/types/runtime/workspace/contracts.d.ts

@@ -87,4 +87,3 @@ export type WorkspaceState = {
         completedAt?: string;
     }>;
 };
-export declare const DEFAULT_WORKSPACE_IGNORE = "# Required destination workbench exclusions; keep these rules effective.\n.env\n.env.*\n!.env.example\nnode_modules/\n.r5d/\n.r5d-next/\n.ssh/\n.kube/\nsecrets/\ncredentials/\n.next/\ndist/\nbuild/\ncoverage/\n.cache/\n.bun/\n*.pem\n*.key\n";

package/dist/types/runtime/workspace/files.d.ts

@@ -25,5 +25,4 @@ export type TreeEntry = {
 };
 export declare function selectedTree(repo: string, commit: string): Promise<TreeEntry[]>;
 export declare function materializeTree(repo: string, destination: string, entries: TreeEntry[], limit: number, message: string): Promise<void>;
-export declare function verifyIgnore(repo: string, cwd: string): Promise<void>;
 export declare function snapshotTree(repo: string, cwd: string, canonicalHead?: string | null, maxBytes?: number): Promise<string>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.158",
+  "version": "0.0.160",
   "type": "module",
   "main": "./dist/mjs/main.mjs",
   "module": "./dist/mjs/main.mjs",
@@ -21,7 +21,7 @@
     "r5d-worker": "dist/mjs/main.mjs"
   },
   "dependencies": {
-    "@ricsam/r5d-api": "^0.0.158",
+    "@ricsam/r5d-api": "^0.0.160",
     "node-pty": "1.1.0",
     "zod": "^4.1.13",
     "picomatch": "^4.0.3"