@ricsam/r5d-worker 0.0.80 → 0.0.81

package/README.md

@@ -7,7 +7,13 @@ r5d-worker start --label macos
 r5d-worker --version
 ```
 
-The worker uses the existing `r5dctl` config file and accepts `R5D_WORKER_TOKEN` or `R5D_API_KEY`. Project checkouts are managed under:
+Authorize the exact worker label before starting it:
+
+```sh
+r5dctl auth login --worker-label macos
+```
+
+The worker uses that label-bound credential from the existing `r5dctl` config file or `R5D_WORKER_TOKEN`. `R5D_API_KEY` remains an accepted legacy environment-variable name, but its value must still be the exact label-bound worker credential; a general API key or device credential cannot connect a worker. Project checkouts are managed under:
 
 ```text
 ~/.r5d/projects/<namespace>/<project>/<branch-name>

package/dist/cjs/main.cjs

@@ -629,7 +629,7 @@ function preparePlanEnvForShell(input) {
   import_node_fs.default.mkdirSync(plansDir, { recursive: true });
   return planEnv(input.planRoot, input.target, input.activePlanId);
 }
-async function verifyR5dctlAuth(baseUrl, token) {
+async function verifyR5dctlAuth(baseUrl, token, workerLabel) {
   const statusUrl = new URL("/api/r5dctl/auth/status", baseUrl);
   let response;
   try {
@@ -658,13 +658,16 @@ async function verifyR5dctlAuth(baseUrl, token) {
     throw new WorkerServerUnavailableError(`Server unavailable at ${baseUrl} (${response.status})${detail}`);
   }
   throw new Error(
-    `Authentication failed against ${baseUrl} (${response.status})${detail}. Run \`r5dctl auth login --base-url ${baseUrl}\` or pass --token/--api-key for this server.`
+    `Authentication failed against ${baseUrl} (${response.status})${detail}. Run \`r5dctl auth login --base-url ${baseUrl} --worker-label ${workerLabel}\` or pass that exact label-bound worker token.`
   );
 }
 function resolveCredentials(options, config) {
   const token = options.token ?? process.env.R5D_WORKER_TOKEN ?? process.env.R5D_TOKEN ?? process.env.R5DCTL_TOKEN ?? config.token ?? options.apiKey ?? process.env.R5D_API_KEY ?? process.env.R5DCTL_API_KEY ?? config.apiKey;
   if (!token) {
-    throw new Error("Authentication required. Run `r5dctl auth login` or set R5D_WORKER_TOKEN/R5D_API_KEY.");
+    const workerLabel = options.label ?? "<label>";
+    throw new Error(
+      `Authentication required. Run \`r5dctl auth login --worker-label ${workerLabel}\` or set R5D_WORKER_TOKEN to that label-bound token.`
+    );
   }
   return {
     baseUrl: normalizeBaseUrl(
@@ -3021,7 +3024,7 @@ async function startWorker(options) {
   process.stdout.write(`[r5d-worker] server: ${baseUrl}
 `);
   runGit(["--version"]);
-  await verifyR5dctlAuth(baseUrl, token);
+  await verifyR5dctlAuth(baseUrl, token, label);
   const initializedWorkspaceState = await workspaceSyncSingleFlight.runExclusive(() => {
     if (!startupProjectSnapshotRecoveryCompleted) {
       const snapshotRecovery = (0, import_project_worktrees.recoverStaleProjectWorktreeSnapshots)({

package/dist/cjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.80",
+  "version": "0.0.81",
   "type": "commonjs"
 }

package/dist/mjs/main.mjs

@@ -633,7 +633,7 @@ function preparePlanEnvForShell(input) {
   fs.mkdirSync(plansDir, { recursive: true });
   return planEnv(input.planRoot, input.target, input.activePlanId);
 }
-async function verifyR5dctlAuth(baseUrl, token) {
+async function verifyR5dctlAuth(baseUrl, token, workerLabel) {
   const statusUrl = new URL("/api/r5dctl/auth/status", baseUrl);
   let response;
   try {
@@ -662,13 +662,16 @@ async function verifyR5dctlAuth(baseUrl, token) {
     throw new WorkerServerUnavailableError(`Server unavailable at ${baseUrl} (${response.status})${detail}`);
   }
   throw new Error(
-    `Authentication failed against ${baseUrl} (${response.status})${detail}. Run \`r5dctl auth login --base-url ${baseUrl}\` or pass --token/--api-key for this server.`
+    `Authentication failed against ${baseUrl} (${response.status})${detail}. Run \`r5dctl auth login --base-url ${baseUrl} --worker-label ${workerLabel}\` or pass that exact label-bound worker token.`
   );
 }
 function resolveCredentials(options, config) {
   const token = options.token ?? process.env.R5D_WORKER_TOKEN ?? process.env.R5D_TOKEN ?? process.env.R5DCTL_TOKEN ?? config.token ?? options.apiKey ?? process.env.R5D_API_KEY ?? process.env.R5DCTL_API_KEY ?? config.apiKey;
   if (!token) {
-    throw new Error("Authentication required. Run `r5dctl auth login` or set R5D_WORKER_TOKEN/R5D_API_KEY.");
+    const workerLabel = options.label ?? "<label>";
+    throw new Error(
+      `Authentication required. Run \`r5dctl auth login --worker-label ${workerLabel}\` or set R5D_WORKER_TOKEN to that label-bound token.`
+    );
   }
   return {
     baseUrl: normalizeBaseUrl(
@@ -3025,7 +3028,7 @@ async function startWorker(options) {
   process.stdout.write(`[r5d-worker] server: ${baseUrl}
 `);
   runGit(["--version"]);
-  await verifyR5dctlAuth(baseUrl, token);
+  await verifyR5dctlAuth(baseUrl, token, label);
   const initializedWorkspaceState = await workspaceSyncSingleFlight.runExclusive(() => {
     if (!startupProjectSnapshotRecoveryCompleted) {
       const snapshotRecovery = recoverStaleProjectWorktreeSnapshots({

package/dist/mjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.80",
+  "version": "0.0.81",
   "type": "module"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.80",
+  "version": "0.0.81",
   "type": "module",
   "main": "./dist/cjs/main.cjs",
   "module": "./dist/mjs/main.mjs",