@ricsam/r5d-worker 0.0.29 → 0.0.31

package/dist/mjs/main.mjs

@@ -7,6 +7,7 @@ import { spawn as spawnChildProcess } from "node:child_process";
 import { installCliUpdate, readInstalledCliVersion } from "./cli-update.mjs";
 import { configureVisibleGitIdentity } from "./git-identity.mjs";
 import { hasWorkerHeartbeatTimedOut, WORKER_HEARTBEAT_INTERVAL_MS } from "./heartbeat.mjs";
+import { terminateProcessTree } from "./process-tree.mjs";
 import { superviseWorkerRuntime, WORKER_RELOAD_EXIT_CODE, WORKER_RUNTIME_ENV } from "./supervisor.mjs";
 const DEFAULT_BASE_URL = "https://r5d.dev";
 const WORKER_PACKAGE_NAME = "@ricsam/r5d-worker";
@@ -662,36 +663,69 @@ function isInsideBranchPath(branchPath, filePath) {
   const relative = path.relative(path.resolve(branchPath), path.resolve(filePath));
   return relative === "" || relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
 }
-function assertInsideBranch(branchPath, filePath) {
-  if (!isInsideBranchPath(branchPath, filePath)) {
-    throw new Error("File path escapes the project branch");
+function toProjectDisplayPath(branchPath, absolutePath) {
+  const relative = path.relative(path.resolve(branchPath), path.resolve(absolutePath)).split(path.sep).join(path.posix.sep);
+  return relative || ".";
+}
+function assertAllowedProjectPath(repoRelativePath, inputPath) {
+  if (repoRelativePath === ".git" || repoRelativePath.startsWith(".git/")) {
+    throw new Error("Refusing to access .git through worker file tools");
+  }
+  if (repoRelativePath.split("/").includes("..")) {
+    throw new Error(`Invalid project file path: ${inputPath}`);
   }
 }
-function resolveProjectFilePath(branchPath, virtualPath) {
-  if (typeof virtualPath !== "string" || !virtualPath.startsWith("/") || virtualPath.includes("\0")) {
-    throw new Error(`File path must be an absolute project path starting with /. Got: ${JSON.stringify(virtualPath)}`);
+function resolveWorkerFilePath(branchPath, inputPath) {
+  if (typeof inputPath !== "string" || inputPath.length === 0 || inputPath.includes("\0")) {
+    throw new Error(`File path must be a non-empty string. Got: ${JSON.stringify(inputPath)}`);
   }
-  const checkoutAbsolutePath = path.resolve(virtualPath);
-  if (isInsideBranchPath(branchPath, checkoutAbsolutePath)) {
-    const checkoutVirtualPath = toVirtualPath(path.resolve(branchPath), checkoutAbsolutePath);
-    if (checkoutVirtualPath !== virtualPath) {
-      return resolveProjectFilePath(branchPath, checkoutVirtualPath);
+  const resolvedBranchPath = path.resolve(branchPath);
+  if (path.isAbsolute(inputPath)) {
+    const absolutePath2 = path.resolve(inputPath);
+    if (!isInsideBranchPath(resolvedBranchPath, absolutePath2)) {
+      return {
+        absolutePath: absolutePath2,
+        displayPath: absolutePath2,
+        repoRelativePath: null,
+        scope: "host"
+      };
     }
+    const displayPath = toProjectDisplayPath(resolvedBranchPath, absolutePath2);
+    const repoRelativePath2 = displayPath === "." ? "" : displayPath;
+    assertAllowedProjectPath(repoRelativePath2, inputPath);
+    return {
+      absolutePath: absolutePath2,
+      displayPath,
+      repoRelativePath: repoRelativePath2,
+      scope: "project"
+    };
   }
-  if (virtualPath.split("/").includes("..")) {
-    throw new Error(`Invalid project file path: ${virtualPath}`);
+  const normalizedInputPath = inputPath.replace(/\\/g, "/");
+  if (normalizedInputPath.split("/").includes("..")) {
+    throw new Error(`Invalid project file path: ${inputPath}`);
   }
-  const normalized = path.posix.normalize(virtualPath);
-  if (normalized.startsWith("/../")) {
-    throw new Error(`Invalid project file path: ${virtualPath}`);
+  const normalized = path.posix.normalize(normalizedInputPath);
+  const repoRelativePath = normalized === "." ? "" : normalized.replace(/^\.\/+/, "");
+  assertAllowedProjectPath(repoRelativePath, inputPath);
+  const absolutePath = repoRelativePath ? path.resolve(resolvedBranchPath, ...repoRelativePath.split("/")) : resolvedBranchPath;
+  if (!isInsideBranchPath(resolvedBranchPath, absolutePath)) {
+    throw new Error(`Invalid project file path: ${inputPath}`);
   }
-  const repoRelativePath = normalized === "/" ? "" : normalized.slice(1);
-  if (repoRelativePath === ".git" || repoRelativePath.startsWith(".git/")) {
-    throw new Error("Refusing to access .git through worker file tools");
+  return {
+    absolutePath,
+    displayPath: repoRelativePath || ".",
+    repoRelativePath,
+    scope: "project"
+  };
+}
+function resolveProjectFilePath(branchPath, inputPath) {
+  const resolved = resolveWorkerFilePath(branchPath, inputPath);
+  if (resolved.scope === "host") {
+    throw new Error(
+      `Project file writes must use a checkout-relative path. Absolute host paths are read-only in file tools: ${inputPath}`
+    );
   }
-  const absolutePath = repoRelativePath ? path.resolve(branchPath, ...repoRelativePath.split("/")) : path.resolve(branchPath);
-  assertInsideBranch(branchPath, absolutePath);
-  return { absolutePath, virtualPath: repoRelativePath ? `/${repoRelativePath}` : "/", repoRelativePath };
+  return resolved;
 }
 function resolveRemoteUrl(baseUrl, remoteUrl) {
   if (/^https?:\/\//i.test(remoteUrl)) {
@@ -1305,6 +1339,21 @@ async function withFileMutationQueue(key, operation) {
 function mutationQueueKey(projectId, branchName, filePath) {
   return `${projectId}:${branchName}:${path.posix.normalize(filePath)}`;
 }
+function readWorkerTextFile(branchPath, filePath, offset, limit) {
+  const resolved = resolveWorkerFilePath(branchPath, filePath);
+  if (!fs.existsSync(resolved.absolutePath) || !fs.statSync(resolved.absolutePath).isFile()) {
+    throw new Error(`File not found: ${resolved.displayPath}`);
+  }
+  const buffer = fs.readFileSync(resolved.absolutePath);
+  const formatted = formatLineNumberedContent(buffer.toString("utf8"), offset, limit);
+  return {
+    type: "read",
+    kind: "text",
+    file: resolved.displayPath,
+    gitBlobHash: getGitBlobHashForContent(buffer),
+    ...formatted
+  };
+}
 async function executeReadFileOperation(input) {
   const artifact = await resolveArtifactEnvFilePath({
     filePath: input.message.filePath,
@@ -1319,55 +1368,43 @@ async function executeReadFileOperation(input) {
     if (!fs.existsSync(artifact.absolutePath) || !fs.statSync(artifact.absolutePath).isFile()) {
       throw new Error(`File not found: ${artifact.virtualPath}`);
     }
-    const buffer2 = fs.readFileSync(artifact.absolutePath);
-    const formatted2 = formatLineNumberedContent(buffer2.toString("utf8"), input.message.offset, input.message.limit);
+    const buffer = fs.readFileSync(artifact.absolutePath);
+    const formatted = formatLineNumberedContent(buffer.toString("utf8"), input.message.offset, input.message.limit);
     return {
       type: "read",
       kind: "text",
       file: artifact.virtualPath,
-      gitBlobHash: getGitBlobHashForContent(buffer2),
-      ...formatted2
+      gitBlobHash: getGitBlobHashForContent(buffer),
+      ...formatted
     };
   }
   const workspace = ensureOperationBranch({ ...input, branchName: input.message.branchName });
-  const resolved = resolveProjectFilePath(workspace.branchPath, input.message.filePath);
-  if (!fs.existsSync(resolved.absolutePath) || !fs.statSync(resolved.absolutePath).isFile()) {
-    throw new Error(`File not found: ${resolved.virtualPath}`);
-  }
-  const buffer = fs.readFileSync(resolved.absolutePath);
-  const formatted = formatLineNumberedContent(buffer.toString("utf8"), input.message.offset, input.message.limit);
-  return {
-    type: "read",
-    kind: "text",
-    file: resolved.virtualPath,
-    gitBlobHash: getGitBlobHashForContent(buffer),
-    ...formatted
-  };
+  return readWorkerTextFile(workspace.branchPath, input.message.filePath, input.message.offset, input.message.limit);
 }
 async function executeWriteFileOperation(input) {
   rejectArtifactWritePath(input.message.filePath);
-  return withFileMutationQueue(mutationQueueKey(input.projectId, input.message.branchName, input.message.filePath), async () => {
-    const workspace = ensureOperationBranch({ ...input, branchName: input.message.branchName });
-    const resolved = resolveProjectFilePath(workspace.branchPath, input.message.filePath);
+  const workspace = ensureOperationBranch({ ...input, branchName: input.message.branchName });
+  const resolved = resolveProjectFilePath(workspace.branchPath, input.message.filePath);
+  return withFileMutationQueue(mutationQueueKey(input.projectId, input.message.branchName, resolved.repoRelativePath), async () => {
     fs.mkdirSync(path.dirname(resolved.absolutePath), { recursive: true });
     fs.writeFileSync(resolved.absolutePath, input.message.content, "utf8");
     return {
       type: "write",
-      file: resolved.virtualPath,
+      file: resolved.displayPath,
       gitBlobHash: getGitBlobHashForContent(input.message.content)
     };
   });
 }
 async function executeEditFileOperation(input) {
   rejectArtifactWritePath(input.message.filePath);
-  return withFileMutationQueue(mutationQueueKey(input.projectId, input.message.branchName, input.message.filePath), async () => {
-    const workspace = ensureOperationBranch({ ...input, branchName: input.message.branchName });
-    const resolved = resolveProjectFilePath(workspace.branchPath, input.message.filePath);
+  const workspace = ensureOperationBranch({ ...input, branchName: input.message.branchName });
+  const resolved = resolveProjectFilePath(workspace.branchPath, input.message.filePath);
+  return withFileMutationQueue(mutationQueueKey(input.projectId, input.message.branchName, resolved.repoRelativePath), async () => {
     if (!Array.isArray(input.message.edits) || input.message.edits.length === 0) {
       throw new Error("edit requires at least one replacement");
     }
     if (!fs.existsSync(resolved.absolutePath) || !fs.statSync(resolved.absolutePath).isFile()) {
-      throw new Error(`File not found: ${resolved.virtualPath}`);
+      throw new Error(`File not found: ${resolved.displayPath}`);
     }
     const originalContent = fs.readFileSync(resolved.absolutePath, "utf8");
     const ranges = input.message.edits.map((edit, index) => {
@@ -1402,7 +1439,7 @@ async function executeEditFileOperation(input) {
     fs.writeFileSync(resolved.absolutePath, nextContent, "utf8");
     return {
       type: "edit",
-      file: resolved.virtualPath,
+      file: resolved.displayPath,
       edits: input.message.edits.length
     };
   });
@@ -1422,47 +1459,70 @@ function wildcardToRegex(pattern) {
 function normalizeFindPattern(pattern) {
   return /[*?]/.test(pattern) ? pattern : `*${pattern}*`;
 }
-function toVirtualPath(branchPath, absolutePath) {
-  const relative = path.relative(branchPath, absolutePath).split(path.sep).join(path.posix.sep);
-  return relative ? `/${relative}` : "/";
-}
-function walkProjectEntries(branchPath, startPath) {
+function walkWorkerEntries(branchPath, start) {
   const entries = [];
-  const visit = (absolutePath) => {
-    const stat = fs.statSync(absolutePath);
-    const virtualPath = toVirtualPath(branchPath, absolutePath);
-    entries.push({ absolutePath, virtualPath, stat });
+  const visitedDirectories = /* @__PURE__ */ new Set();
+  const visit = (absolutePath, isRoot) => {
+    let stat;
+    try {
+      stat = fs.statSync(absolutePath);
+    } catch (error) {
+      if (isRoot) throw error;
+      return;
+    }
+    const displayPath = start.scope === "project" ? toProjectDisplayPath(branchPath, absolutePath) : path.resolve(absolutePath);
+    const hostRelativePath = path.relative(start.absolutePath, absolutePath).split(path.sep).join(path.posix.sep);
+    const matchPath = start.scope === "project" ? displayPath : hostRelativePath || path.basename(start.absolutePath);
+    entries.push({ absolutePath, displayPath, matchPath, stat });
     if (!stat.isDirectory()) return;
-    const children = fs.readdirSync(absolutePath, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+    let realDirectoryPath;
+    try {
+      realDirectoryPath = fs.realpathSync(absolutePath);
+    } catch (error) {
+      if (isRoot) throw error;
+      return;
+    }
+    if (visitedDirectories.has(realDirectoryPath)) return;
+    visitedDirectories.add(realDirectoryPath);
+    let children;
+    try {
+      children = fs.readdirSync(absolutePath, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+    } catch (error) {
+      if (isRoot) throw error;
+      return;
+    }
     for (const child of children) {
       if (IGNORED_ENTRY_NAMES.has(child.name)) continue;
-      visit(path.join(absolutePath, child.name));
+      visit(path.join(absolutePath, child.name), false);
     }
   };
-  visit(startPath);
+  visit(start.absolutePath, true);
   return entries;
 }
 function isProbablyText(bytes) {
   return !bytes.subarray(0, Math.min(bytes.length, 4096)).includes(0);
 }
-async function executeGrepOperation(input) {
-  const workspace = ensureOperationBranch({ ...input, branchName: input.message.branchName });
-  const start = resolveProjectFilePath(workspace.branchPath, input.message.path ?? "/");
+function grepWorkerFiles(branchPath, input) {
+  const start = resolveWorkerFilePath(branchPath, input.path ?? ".");
   if (!fs.existsSync(start.absolutePath)) {
-    throw new Error(`Path not found: ${start.virtualPath}`);
+    throw new Error(`Path not found: ${start.displayPath}`);
   }
-  const limit = normalizeToolLimit(input.message.limit, 100, 1e3);
-  const flags = input.message.caseSensitive === false ? "i" : "";
-  const regex = new RegExp(input.message.pattern, flags);
-  const globRegex = input.message.glob ? wildcardToRegex(input.message.glob) : null;
+  const limit = normalizeToolLimit(input.limit, 100, 1e3);
+  const flags = input.caseSensitive === false ? "i" : "";
+  const regex = new RegExp(input.pattern, flags);
+  const globRegex = input.glob ? wildcardToRegex(input.glob) : null;
   const lines = [];
   let matchCount = 0;
   let truncated = false;
-  for (const entry of walkProjectEntries(workspace.branchPath, start.absolutePath)) {
+  for (const entry of walkWorkerEntries(branchPath, start)) {
     if (!entry.stat.isFile()) continue;
-    const repoRelative = entry.virtualPath.slice(1);
-    if (globRegex && !globRegex.test(repoRelative)) continue;
-    const bytes = fs.readFileSync(entry.absolutePath);
+    if (globRegex && !globRegex.test(entry.matchPath)) continue;
+    let bytes;
+    try {
+      bytes = fs.readFileSync(entry.absolutePath);
+    } catch {
+      continue;
+    }
     if (!isProbablyText(bytes)) continue;
     const fileLines = bytes.toString("utf8").split(/\r?\n/);
     for (let index = 0; index < fileLines.length; index += 1) {
@@ -1473,7 +1533,7 @@ async function executeGrepOperation(input) {
       matchCount += 1;
       if (lines.length < limit) {
         const column = Math.max(1, (match.index ?? 0) + 1);
-        lines.push(`${entry.virtualPath}:${index + 1}:${column}: ${line.slice(0, MAX_LINE_LENGTH)}`);
+        lines.push(`${entry.displayPath}:${index + 1}:${column}: ${line.slice(0, MAX_LINE_LENGTH)}`);
       } else {
         truncated = true;
       }
@@ -1488,26 +1548,35 @@ async function executeGrepOperation(input) {
     truncated
   };
 }
-async function executeFindOperation(input) {
+async function executeGrepOperation(input) {
   const workspace = ensureOperationBranch({ ...input, branchName: input.message.branchName });
-  const start = resolveProjectFilePath(workspace.branchPath, input.message.path ?? "/");
+  return grepWorkerFiles(workspace.branchPath, {
+    pattern: input.message.pattern,
+    path: input.message.path,
+    glob: input.message.glob,
+    caseSensitive: input.message.caseSensitive,
+    limit: input.message.limit
+  });
+}
+function findWorkerFiles(branchPath, input) {
+  const start = resolveWorkerFilePath(branchPath, input.path ?? ".");
   if (!fs.existsSync(start.absolutePath) || !fs.statSync(start.absolutePath).isDirectory()) {
-    throw new Error(`Directory not found: ${start.virtualPath}`);
+    throw new Error(`Directory not found: ${start.displayPath}`);
   }
-  const pattern = normalizeFindPattern(input.message.pattern ?? "*");
+  const pattern = normalizeFindPattern(input.pattern ?? "*");
   const matcher = wildcardToRegex(pattern);
-  const entryType = input.message.entryType ?? "file";
-  const limit = normalizeToolLimit(input.message.limit, 200, 1e3);
+  const entryType = input.entryType ?? "file";
+  const limit = normalizeToolLimit(input.limit, 200, 1e3);
   const matches = [];
   let count = 0;
   let truncated = false;
-  for (const entry of walkProjectEntries(workspace.branchPath, start.absolutePath)) {
-    if (entry.virtualPath === start.virtualPath) continue;
+  for (const entry of walkWorkerEntries(branchPath, start)) {
+    if (entry.absolutePath === start.absolutePath) continue;
     const isDirectory = entry.stat.isDirectory();
     if (entryType === "file" && !entry.stat.isFile()) continue;
     if (entryType === "directory" && !isDirectory) continue;
-    const label = isDirectory ? `${entry.virtualPath}/` : entry.virtualPath;
-    if (!matcher.test(path.posix.basename(entry.virtualPath)) && !matcher.test(entry.virtualPath.slice(1))) continue;
+    const label = isDirectory ? `${entry.displayPath}${start.scope === "host" ? path.sep : "/"}` : entry.displayPath;
+    if (!matcher.test(path.basename(entry.absolutePath)) && !matcher.test(entry.matchPath)) continue;
     count += 1;
     if (matches.length < limit) {
       matches.push(label);
@@ -1523,25 +1592,59 @@ async function executeFindOperation(input) {
     truncated
   };
 }
-async function executeLsOperation(input) {
+async function executeFindOperation(input) {
   const workspace = ensureOperationBranch({ ...input, branchName: input.message.branchName });
-  const resolved = resolveProjectFilePath(workspace.branchPath, input.message.path ?? "/");
+  return findWorkerFiles(workspace.branchPath, {
+    pattern: input.message.pattern,
+    path: input.message.path,
+    entryType: input.message.entryType,
+    limit: input.message.limit
+  });
+}
+function listWorkerDirectory(branchPath, inputPath = ".", inputLimit) {
+  const resolved = resolveWorkerFilePath(branchPath, inputPath);
   if (!fs.existsSync(resolved.absolutePath) || !fs.statSync(resolved.absolutePath).isDirectory()) {
-    throw new Error(`Directory not found: ${resolved.virtualPath}`);
+    throw new Error(`Directory not found: ${resolved.displayPath}`);
   }
-  const limit = normalizeToolLimit(input.message.limit, 200, 1e3);
+  const limit = normalizeToolLimit(inputLimit, 200, 1e3);
   const entries = fs.readdirSync(resolved.absolutePath, { withFileTypes: true }).filter((entry) => !IGNORED_ENTRY_NAMES.has(entry.name)).sort((a, b) => Number(b.isDirectory()) - Number(a.isDirectory()) || a.name.localeCompare(b.name));
   const displayed = entries.slice(0, limit).map((entry) => `${entry.name}${entry.isDirectory() ? "/" : ""}`);
   const truncated = entries.length > displayed.length;
   const hint = truncated ? "\n... truncated. Increase limit to continue." : "";
   return {
     type: "ls",
-    path: resolved.virtualPath,
+    path: resolved.displayPath,
     content: displayed.length > 0 ? `${displayed.join("\n")}${hint}` : "(empty directory)",
     count: entries.length,
     truncated
   };
 }
+async function executeLsOperation(input) {
+  const workspace = ensureOperationBranch({ ...input, branchName: input.message.branchName });
+  return listWorkerDirectory(workspace.branchPath, input.message.path, input.message.limit);
+}
+function readWorkerImageFile(branchPath, filePath) {
+  const resolved = resolveWorkerFilePath(branchPath, filePath);
+  if (!fs.existsSync(resolved.absolutePath) || !fs.statSync(resolved.absolutePath).isFile()) {
+    throw new Error(`File not found: ${resolved.displayPath}`);
+  }
+  const extension = path.extname(resolved.absolutePath).toLowerCase();
+  const mediaType = extension === ".jpg" || extension === ".jpeg" ? "image/jpeg" : extension === ".png" ? "image/png" : null;
+  if (!mediaType) {
+    throw new Error("read supports PNG and JPEG image inputs only");
+  }
+  const bytes = fs.readFileSync(resolved.absolutePath);
+  const dimensions = readImageDimensions(bytes, mediaType);
+  return {
+    type: "view_file_bytes",
+    filePath: resolved.displayPath,
+    mediaType,
+    base64: bytes.toString("base64"),
+    fileSizeBytes: bytes.length,
+    width: dimensions.width,
+    height: dimensions.height
+  };
+}
 async function executeViewFileBytesOperation(input) {
   const artifact = await resolveArtifactEnvFilePath({
     filePath: input.message.filePath,
@@ -1556,44 +1659,25 @@ async function executeViewFileBytesOperation(input) {
     if (!fs.existsSync(artifact.absolutePath) || !fs.statSync(artifact.absolutePath).isFile()) {
       throw new Error(`File not found: ${artifact.virtualPath}`);
     }
-    const extension2 = path.extname(artifact.absolutePath).toLowerCase();
-    const mediaType2 = extension2 === ".jpg" || extension2 === ".jpeg" ? "image/jpeg" : extension2 === ".png" ? "image/png" : null;
-    if (!mediaType2) {
+    const extension = path.extname(artifact.absolutePath).toLowerCase();
+    const mediaType = extension === ".jpg" || extension === ".jpeg" ? "image/jpeg" : extension === ".png" ? "image/png" : null;
+    if (!mediaType) {
       throw new Error("read supports PNG and JPEG image inputs only");
     }
-    const bytes2 = fs.readFileSync(artifact.absolutePath);
-    const dimensions2 = readImageDimensions(bytes2, mediaType2);
+    const bytes = fs.readFileSync(artifact.absolutePath);
+    const dimensions = readImageDimensions(bytes, mediaType);
     return {
       type: "view_file_bytes",
       filePath: artifact.virtualPath,
-      mediaType: mediaType2,
-      base64: bytes2.toString("base64"),
-      fileSizeBytes: bytes2.length,
-      width: dimensions2.width,
-      height: dimensions2.height
+      mediaType,
+      base64: bytes.toString("base64"),
+      fileSizeBytes: bytes.length,
+      width: dimensions.width,
+      height: dimensions.height
     };
   }
   const workspace = ensureOperationBranch({ ...input, branchName: input.message.branchName });
-  const resolved = resolveProjectFilePath(workspace.branchPath, input.message.filePath);
-  if (!fs.existsSync(resolved.absolutePath) || !fs.statSync(resolved.absolutePath).isFile()) {
-    throw new Error(`File not found: ${resolved.virtualPath}`);
-  }
-  const extension = path.extname(resolved.absolutePath).toLowerCase();
-  const mediaType = extension === ".jpg" || extension === ".jpeg" ? "image/jpeg" : extension === ".png" ? "image/png" : null;
-  if (!mediaType) {
-    throw new Error("read supports PNG and JPEG image inputs only");
-  }
-  const bytes = fs.readFileSync(resolved.absolutePath);
-  const dimensions = readImageDimensions(bytes, mediaType);
-  return {
-    type: "view_file_bytes",
-    filePath: resolved.virtualPath,
-    mediaType,
-    base64: bytes.toString("base64"),
-    fileSizeBytes: bytes.length,
-    width: dimensions.width,
-    height: dimensions.height
-  };
+  return readWorkerImageFile(workspace.branchPath, input.message.filePath);
 }
 function stagedBlobSizeBytes(context) {
   const names = runInternalGit(context, ["diff", "--cached", "--name-only", "-z", "--", ".", ":(exclude).git"]).split("\0").filter(Boolean);
@@ -1774,6 +1858,7 @@ async function executeCommand(input) {
       cwd,
       stdout: "pipe",
       stderr: "pipe",
+      detached: true,
       env: {
         ...process.env,
         ...containerRegistryEnv(),
@@ -1795,7 +1880,12 @@ async function executeCommand(input) {
     });
     if (input.message.timeoutMs) {
       timeout = setTimeout(() => {
-        subprocess.kill("SIGTERM");
+        void terminateProcessTree(subprocess).catch((error) => {
+          process.stderr.write(
+            `[r5d-worker] failed to terminate timed-out command ${input.message.runId}: ${error instanceof Error ? error.message : String(error)}
+`
+          );
+        });
       }, input.message.timeoutMs);
     }
     const [stdout, stderr, exitCode] = await Promise.all([
@@ -1831,6 +1921,8 @@ async function executeCommand(input) {
 async function executeStreamingCommand(input) {
   const startedAt = Date.now();
   let started = false;
+  let timedOut = false;
+  let timeout;
   try {
     if (cancelledProcessRuns.delete(input.message.runId)) {
       sendWorkerMessage(input.ws, {
@@ -1871,6 +1963,7 @@ async function executeStreamingCommand(input) {
       cwd,
       stdout: "pipe",
       stderr: "pipe",
+      detached: true,
       env: {
         ...process.env,
         ...containerRegistryEnv(),
@@ -1897,6 +1990,17 @@ async function executeStreamingCommand(input) {
       requestId: input.message.requestId,
       runId: input.message.runId
     });
+    if (input.message.timeoutMs) {
+      timeout = setTimeout(() => {
+        timedOut = true;
+        void terminateProcessTree(subprocess).catch((error) => {
+          process.stderr.write(
+            `[r5d-worker] failed to terminate timed-out process ${input.message.runId}: ${error instanceof Error ? error.message : String(error)}
+`
+          );
+        });
+      }, input.message.timeoutMs);
+    }
     const [exitCode] = await Promise.all([
       subprocess.exited,
       streamCommandOutput(subprocess.stdout, (data) => {
@@ -1920,7 +2024,8 @@ async function executeStreamingCommand(input) {
       type: "exec_exit",
       runId: input.message.runId,
       exitCode,
-      durationMs: Date.now() - startedAt
+      durationMs: Date.now() - startedAt,
+      ...timedOut ? { timedOut: true } : {}
     });
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
@@ -1940,6 +2045,9 @@ async function executeStreamingCommand(input) {
       });
     }
   } finally {
+    if (timeout) {
+      clearTimeout(timeout);
+    }
     activeProcesses.delete(input.message.runId);
     cancelledProcessRuns.delete(input.message.runId);
   }
@@ -2502,18 +2610,27 @@ async function startWorker(options) {
       }
       if (message.type === "cancel") {
         const active = activeProcesses.get(message.runId);
+        let cancelled = true;
+        let cancelMessage;
         if (active) {
-          active.process.kill("SIGTERM");
+          try {
+            await terminateProcessTree(active.process);
+            cancelMessage = `Stopped ${active.command}`;
+          } catch (error) {
+            cancelled = false;
+            cancelMessage = `Failed to stop ${active.command}: ${error instanceof Error ? error.message : String(error)}`;
+          }
         } else {
           cancelledProcessRuns.add(message.runId);
+          cancelMessage = "Cancellation queued before command start";
         }
         ws.send(
           JSON.stringify({
             type: "cancel_result",
             requestId: message.requestId,
             runId: message.runId,
-            cancelled: true,
-            message: active ? `Sent SIGTERM to ${active.command}` : "Cancellation queued before command start"
+            cancelled,
+            message: cancelMessage
           })
         );
         return;
@@ -2752,11 +2869,17 @@ if (isCliEntrypoint()) {
 export {
   ensureVisibleGitCheckout,
   findRepositorySyncBlockers,
+  findWorkerFiles,
+  grepWorkerFiles,
   isArtifactEnvPath,
+  listWorkerDirectory,
   prepareArtifactEnvForShell,
   preparePlanEnvForShell,
+  readWorkerImageFile,
+  readWorkerTextFile,
   resolveHostShell,
   resolveProjectFilePath,
+  resolveWorkerFilePath,
   syncManifestProjectsFromInternal,
   syncProjectPlans,
   syncSessionArtifacts

package/dist/mjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.29",
+  "version": "0.0.31",
   "type": "module"
 }