@skaile/workspaces 0.37.0 → 0.39.0

package/CHANGELOG.md

@@ -1,5 +1,49 @@
 # Changelog
 
+## 0.39.0
+
+### Minor Changes
+
+- [#152](https://github.com/skaile-ai/workspaces/pull/152) [`630af66`](https://github.com/skaile-ai/workspaces/commit/630af66a84918830e86ca643b9a2320e259bea33) Thanks [@peteralbert](https://github.com/peteralbert)! - Backend-auth materialized connectors now authenticate end-to-end, off-disk. The credential is delivered through the in-memory `session_init` channel — `cmd.credentials.connectors[<id>]` at boot/wake and a new optional `runner.attach_instance.preMintedToken` on live-attach — and staged into `PreMintedSecretProvider` under `connector:<id>`. Tool-face connectors now receive the wrapped token mediator (previously filesystem-face only), so a tool-face connector (e.g. postgres) resolves its `auth: backend` credential via `ctx.tokenMediator`. The connector secret is no longer read from `.instance.json` (`readResolvedConnectorSecret` removed) — credentials never touch disk.
+
+### Patch Changes
+
+- [#150](https://github.com/skaile-ai/workspaces/pull/150) [`e0cc721`](https://github.com/skaile-ai/workspaces/commit/e0cc7211c01dd96893d00c163ad799e2c744a098) Thanks [@Frozen666](https://github.com/Frozen666)! - fix(git-connector): publish session branch to origin on create (B-142)
+
+  A non-main git session created its session branch locally but never pushed it,
+  so peers and other sessions couldn't see the branch until a clean
+  hibernate/close (and never with the default `pushAfterCommit=false`). Add a
+  `lifecycle.publishOnCreate` flag (default `true`) that best-effort
+  `push -u origin <branch>` on the branch-creation paths only (not reuse-local or
+  checkout-from-origin), swallowing failures so `connect` never fails; the
+  lifecycle push hooks remain the backstop.
+
+- [#149](https://github.com/skaile-ai/workspaces/pull/149) [`3c604d0`](https://github.com/skaile-ai/workspaces/commit/3c604d0725299f257ad0753760bea14d2ca4c87d) Thanks [@Frozen666](https://github.com/Frozen666)! - fix(runner): strip stale tail after `</html>` in mount HTML reads
+
+  A writable rclone mount can serve a non-truncated VFS cache item — a clean
+  document followed by the leftover tail of an older, longer version of the same
+  file (which carries its own duplicate closing tags). The mount read now truncates
+  `text/html` content at the first `</html>`, so neither the workspace HTML preview
+  nor the agent sees the garbled trailing fragment. Mitigation for the SharePoint
+  preview corruption; the underlying rclone VFS cause is tracked separately.
+
+## 0.38.0
+
+### Minor Changes
+
+- [#147](https://github.com/skaile-ai/workspaces/pull/147) [`9a77b0c`](https://github.com/skaile-ai/workspaces/commit/9a77b0c3f6c6d3ff24245e778efbf75e432b7976) Thanks [@peteralbert](https://github.com/peteralbert)! - feat(connectors): wire library-assigned connectors to the runtime (Phase 2.5).
+
+  Materialized `.skaile/assets/connector/<name>/CONNECTOR.md` projections are now
+  derived into ConnectorDeclarations at boot (`loadConnectorDeclarations` merges
+  them alongside `skaile.yaml` connectors), and `runner.attach_instance` supports
+  `kind: "connector"` (materialize-then-attach-by-ref → `ConnectorManager.connect`).
+  Symmetric with the MCP live-attach path. Connectors stay first-party (driver
+  resolved by name).
+
+### Patch Changes
+
+- [#146](https://github.com/skaile-ai/workspaces/pull/146) [`0b8edfd`](https://github.com/skaile-ai/workspaces/commit/0b8edfd530a27b7f08cea7899b384f97edbc4dde) Thanks [@peteralbert](https://github.com/peteralbert)! - rclone fleet hardening: spawn the rclone rc server with `--rc-no-auth` (loopback-only) so the flush-before-stop `POST /vfs/refresh` no longer 403s — graceful stop drains the write-back cache instead of leaving it poisoned. Surface non-retryable `itemNotFound` upload failures immediately via the existing stuck-upload signal (the remote target is gone; retrying can never land). Create `.skaile/fleet-health/` group-writable + setgid (`0o2770`) so the platform backend can write the verdict flag the runner reads.
+
 ## 0.37.0
 
 ### Minor Changes

package/dist/asset-manager/index.js

@@ -1,4 +1,4 @@
-export { AssetManager, parseCanonicalLockKey } from '../chunk-RNFNWOKZ.js';
+export { AssetManager, parseCanonicalLockKey } from '../chunk-WVWX76IB.js';
 export { createScaffold, deployAll, installAgent, removeAsset } from '../chunk-4A2LAEX6.js';
 import '../chunk-FBIQ4QPF.js';
 import '../chunk-CFCSDZYF.js';

package/dist/{chunk-3HR6IN5B.js → chunk-CMZWYMGD.js}

@@ -1,6 +1,6 @@
 import { renderGoogleDriveConfig, renderOneDriveConfig, renderWebDAVConfig } from './chunk-OVRSNIKJ.js';
-import { resolveAuthRef, resolveAuth, resolveMountCredentialString, resolveMountCredential } from './chunk-CC5ZHSHJ.js';
-import { PortPool, createFsWatcher, RcloneProcessManager, ensureDirMode } from './chunk-XT6AZWK3.js';
+import { resolveAuthRef, resolveAuth, resolveMountCredentialString, resolveMountCredential } from './chunk-WLWHOA3S.js';
+import { PortPool, createFsWatcher, RcloneProcessManager, ensureDirMode } from './chunk-P7CIT445.js';
 import { pluginRegistry } from './chunk-6E6PKKAD.js';
 import { computeFlowStateFromSnapshots } from './chunk-X46FY45B.js';
 import { renderStimulusPrompt } from './chunk-DEYYRFQU.js';
@@ -722,7 +722,8 @@ var LEGACY_DEFAULTS = {
     mergeOnClose: true,
     pushOnClose: true,
     autoCommitIdleMs: 3e4,
-    pushAfterCommit: false
+    pushAfterCommit: false,
+    publishOnCreate: true
   }
 };
 var MODE_DEFAULTS = {
@@ -773,7 +774,8 @@ function parseLifecycleConfig(opts, defaults) {
     mergeOnClose: Boolean(raw.mergeOnClose ?? defaults.mergeOnClose),
     pushOnClose: Boolean(raw.pushOnClose ?? defaults.pushOnClose),
     autoCommitIdleMs: Number(raw.autoCommitIdleMs ?? defaults.autoCommitIdleMs),
-    pushAfterCommit: Boolean(raw.pushAfterCommit ?? defaults.pushAfterCommit)
+    pushAfterCommit: Boolean(raw.pushAfterCommit ?? defaults.pushAfterCommit),
+    publishOnCreate: Boolean(raw.publishOnCreate ?? defaults.publishOnCreate)
   };
 }
 function resolveGitConfig(args) {
@@ -969,22 +971,40 @@ var GitConnector = class extends AbstractConnector {
     if (!isValidGitRefOrSha(sessionBranch)) {
       throw new Error(`Git connector: invalid session branch name "${sessionBranch}"`);
     }
+    let created = false;
     if (localBranchExists(sessionBranch, targetDir)) {
       git(`checkout ${sessionBranch}`, targetDir);
       this.log.info("reusing existing local session branch", { sessionBranch });
     } else {
+      let originHasBranch = false;
       try {
         git(`rev-parse --verify origin/${sessionBranch}`, targetDir);
-        git(`checkout -B ${sessionBranch} origin/${sessionBranch}`, targetDir);
+        originHasBranch = true;
       } catch {
-        if (!this.branchFromRef(session, sessionBranch, targetDir)) {
-          git(`checkout -b ${sessionBranch}`, targetDir);
-        }
+      }
+      if (originHasBranch) {
+        git(`checkout -B ${sessionBranch} origin/${sessionBranch}`, targetDir);
+      } else if (!this.branchFromRef(session, sessionBranch, targetDir)) {
+        git(`checkout -b ${sessionBranch}`, targetDir);
+        created = true;
+      } else {
+        created = true;
       }
     }
     syncSubmodules(targetDir);
     state.activeBranch = sessionBranch;
     this.log.info("session branch checked out", { sessionBranch });
+    if (created && state.lifecycle.publishOnCreate) {
+      try {
+        git(`push -u origin ${sessionBranch}`, targetDir, 6e4);
+        this.log.info("published new session branch", { sessionBranch });
+      } catch (err) {
+        this.log.warn("publish-on-create push failed; deferring to lifecycle push", {
+          sessionBranch,
+          error: err instanceof Error ? err.message : String(err)
+        });
+      }
+    }
   }
   /**
    * Attempt to create `sessionBranch` anchored on `session.fromRef`. Returns
@@ -3069,7 +3089,16 @@ var PostgresConnector = class extends AbstractConnector {
   }
   async connect(declaration, ctx) {
     const started = Date.now();
-    const dsn = ctx.resolvedFields?.dsn ?? resolveAuth(declaration.auth, ctx.secrets) ?? String(declaration.options?.dsn ?? "");
+    let dsn = ctx.resolvedFields?.dsn ?? String(declaration.options?.dsn ?? "");
+    if (!dsn && declaration.auth === "backend" && ctx.tokenMediator) {
+      const mint = await ctx.tokenMediator({ connectorId: declaration.id, reason: "initial" });
+      if (mint.ok) dsn = mint.token;
+      else
+        throw new Error(
+          `PostgresAdapter '${declaration.id}': backend credential ${mint.code} \u2014 ${mint.message}`
+        );
+    }
+    if (!dsn) dsn = resolveAuth(declaration.auth, ctx.secrets) ?? "";
     if (!dsn) {
       this.log.error("connect failed: missing dsn", void 0);
       throw new Error("PostgresAdapter requires auth (connection string) or options.dsn");
@@ -5811,10 +5840,11 @@ var ConnectorManager = class {
   async buildConnectContext(declaration, connector) {
     const ctx = {
       secrets: this.chain ?? this.secrets,
-      tokenMediator: void 0,
+      // Both filesystem and tool faces use this for the auth: backend initial-mint path.
+      tokenMediator: this.buildWrappedMediator(),
       abortSignal: this.disposeController.signal
     };
-    if (this.chain && connector.describeFields) {
+    if (this.chain && connector.describeFields && declaration.auth !== "backend") {
       const fields = connector.describeFields();
       ctx.resolvedFields = await resolveFields(declaration, fields, this.chain);
     }
@@ -5822,7 +5852,6 @@ var ConnectorManager = class {
       const absPath = this.resolveMountTarget(declaration);
       if (!existsSync(absPath)) mkdirSync(absPath, { recursive: true });
       ctx.mountTarget = absPath;
-      ctx.tokenMediator = this.buildWrappedMediator();
     }
     return ctx;
   }
@@ -5856,7 +5885,7 @@ var ConnectorManager = class {
    * 1. Resolves the `Connector` from the registry (or catalog).
    * 2. Calls `setLogger` when available.
    * 3. Resolves fields via `describeFields()` + secret chain.
-   * 4. For filesystem-face connectors: allocates mount-target dir, wraps mediator.
+   * 4. For filesystem-face connectors: allocates mount-target dir.
    * 5. Calls `connector.connect(decl, ctx)`.
    * 6. Tracks in the active map; emits `onStatusChange`.
    *
@@ -8387,5 +8416,5 @@ function createConnector() {
 }
 
 export { AbstractConnector, BUILTIN_CONNECTOR_CATALOG, ConnectorFieldMissingError, ConnectorManager, ConnectorStartupError, DEFAULT_REACTIVE_COOLDOWN_MS, DeployConnector, DevServerConnector, FleetHealthGate, FlowAdapter, GitConnector, GmailConnector, GoogleDriveConnector, LocalConnector, LogBuffer, ManagedGitconfigCollisionError, MattermostConnector, MemoryConnector, MinIOConnector, NOT_READY_SENTINEL, PROACTIVE_RCLONE_REFRESH_MARGIN_MS, PostgresConnector, RoMountPlaceholderBarrier, S3Connector, SQLiteConnector, SharePointConnector, StaticServerConnector, TunnelConnector, WebDAVConnector, XStateConnector, XStateStoreConnector, __test, atomicReplaceCredential, buildConnectorPromptSection, buildSdkConnectorTools, createConnector, createConnector10, createConnector11, createConnector12, createConnector13, createConnector14, createConnector15, createConnector16, createConnector17, createConnector18, createConnector19, createConnector2, createConnector3, createConnector4, createConnector5, createConnector6, createConnector7, createConnector8, createConnector9, createRcloneTokenRefresh, createWorktree, defaultMountPlaceholderBarrier, defaultSpawn, ensureFleetMounted, findGitRoot, findMissingPackages, getConnector, installNpmPackages, isFleetManaged, isPackageResolvable, listConnectors, listWorktrees, probeFleetHealth, registerBuiltinConnectors, removeMountBlock, renderCredentialHelperScript, tryGetConnector, worktreeRegistry, writeHelperScript, writeMountBlock };
-//# sourceMappingURL=chunk-3HR6IN5B.js.map
-//# sourceMappingURL=chunk-3HR6IN5B.js.map
+//# sourceMappingURL=chunk-CMZWYMGD.js.map
+//# sourceMappingURL=chunk-CMZWYMGD.js.map