@ricsam/r5d-worker 0.0.77 → 0.0.79

package/README.md

@@ -15,6 +15,10 @@ The worker uses the existing `r5dctl` config file and accepts `R5D_WORKER_TOKEN`
 
 Web shells and agent shell commands receive a server-issued `r5dctl` credential automatically. The credential is scoped to the signed-in user and revoked when the shell or command finishes, so every `r5dctl` command can use the user's account without a separate login on the worker host. Worker-specific process and session operations remain bound to the worker that received the credential.
 
+Commands, streaming commands, and PTYs never inherit the token or API key that bootstrapped the worker. Only the server-issued per-run `r5dctl` credential and the currently committed GitHub credential generation are added explicitly. A process-lifetime SQLite/OS file lock rejects a second worker credential authority under the same OS account and releases automatically after a crash. Keep the worker's credential/config home on one host; sharing or copying that home is unsupported.
+
+On direct macOS and Linux workers, a changed credential generation is published only after a proved reboot of that same machine. Linux containers expose the host kernel's boot ID, so restarting a container is not enough. Direct Windows credential rotation is currently unsupported and fails closed; use the verified systemd service path or reprovision a clean worker host for a changed generation.
+
 When the user has signed in with GitHub, web shells and agent commands also receive that OAuth credential through `GH_TOKEN`. GitHub CLI commands such as `gh pr`, `gh issue`, and `gh workflow` therefore use the signed-in user's permissions without a separate `gh auth login` on the worker host. Signing in again refreshes the granted OAuth scopes for subsequently started commands and shells.
 
 Project folders are the user/agent workbench. The primary branch is an ordinary clone and every sibling branch is a linked Git worktree, so branches share objects and refs and can cherry-pick or merge each other's commits directly. Connected projects keep GitHub as `origin`; greenfield projects use the r5d project repository. HTTP credentials are supplied through a worker-managed credential helper and are never written into synchronized files.
@@ -31,6 +35,8 @@ Worker labels are mandatory and unique per user. Choose labels that describe hos
 
 The supervisor also reconnects automatically after server rollouts and transient network failures. A brief bounded delay prevents a tight retry loop while the server is unavailable. Pressing Ctrl+C still stops the worker, and agent-managed processes retain their existing in-process recovery path while disconnected.
 
+Credential-generation restart fencing protects against stale or accidentally detached descendants. It is not a hostile same-UID sandbox: code running as the worker's OS user can read or tamper with that user's config and auth files, install a persistent user service, or return after reboot. Run untrusted agents in a disposable VM that is reset at the boundary, or use a separately privileged credential broker/service account. When rotating the worker's own local `r5dctl` credential, stop the worker and reboot/reset the host before writing the replacement credential so an old same-UID descendant cannot read the new config.
+
 One-click updates use the current user's global npm prefix and never invoke `sudo`. If that prefix is not writable, User Settings provides the exact command to run manually.
 
 The agent runs commands through the virtual shell command: