@volter/world-runtime 2.0.33 → 2.0.35

package/dist/src/runtime.js

@@ -1585,8 +1585,16 @@ export async function upWorld(configId, options = {}, abort) {
         });
     }
     catch (error) {
-        if (resourcesClaimed)
-            releaseWorldLifecycle(root, name);
+        // the failure that stopped the boot leads: a release that also fails is added to it, never put in its place
+        if (resourcesClaimed) {
+            try {
+                releaseWorldLifecycle(root, name);
+            }
+            catch (release) {
+                if (error instanceof Error)
+                    error.message += `; releasing the World's claim failed too: ${release instanceof Error ? release.message : String(release)}`;
+            }
+        }
         throw error;
     }
     // From here on this call owns the claim; the finally below releases it however the boot
@@ -1785,7 +1793,7 @@ export async function upWorld(configId, options = {}, abort) {
             if (surviving.length)
                 rollbackErrors.push('owned processes remain alive or uncertain');
             if (error instanceof CommandRetirementError)
-                rollbackErrors.push(error.message);
+                rollbackErrors.push(error.retirement ?? error.message);
             if (rollbackErrors.length > 0) {
                 cleanupUncertain = true;
                 try {
@@ -3475,7 +3483,10 @@ function startProxyDaemonOwned(name, root, caCertPath, envFile, boot, caller = p
         }
     }
     catch (error) {
-        rmSync(marker, { force: true }); // partial pre-spawn writes own no child
+        try {
+            rmSync(marker, { force: true });
+        }
+        catch { /* the write's failure is the one to report */ } // partial pre-spawn writes own no child
         throw error;
     }
     let child;
@@ -3494,7 +3505,10 @@ function startProxyDaemonOwned(name, root, caCertPath, envFile, boot, caller = p
         }
     }
     catch (error) {
-        rmSync(marker, { force: true }); // no child was returned by spawn
+        try {
+            rmSync(marker, { force: true });
+        }
+        catch { /* the spawn's failure is the one to report */ } // no child was returned by spawn
         throw error;
     }
     child.on('error', () => { }); // a failed spawn can emit after this synchronous operation throws
@@ -3547,8 +3561,24 @@ function startProxyDaemonOwned(name, root, caCertPath, envFile, boot, caller = p
         return { url: '', caCertPath, env: {} };
     }
     catch (error) {
-        if (!retirementAttempted)
-            retire();
+        // the failure that stopped the start leads; a retirement that also fails is added to it, never put in its place
+        if (!retirementAttempted) {
+            // a retirement error is still what is thrown (its type keeps the survivor's ownership), with the cause it hid leading its
+            // message; any other cleanup failure is added to the original, which is thrown
+            try {
+                retire();
+            }
+            catch (retirement) {
+                const cause = error instanceof Error ? error.message : String(error);
+                if (retirement instanceof CommandRetirementError) {
+                    Object.assign(retirement, { retirement: retirement.message, cause: error });
+                    retirement.message = `${cause}; ${retirement.message}`;
+                    throw retirement;
+                }
+                if (error instanceof Error)
+                    error.message += `; retiring the proxy failed too: ${retirement instanceof Error ? retirement.message : String(retirement)}`;
+            }
+        }
         throw error;
     }
 }

package/dist/src/served-world.js

@@ -1189,6 +1189,15 @@ export class WorldDoors {
         }
         if (kind === 'links' && !name && request.method === 'GET')
             return Response.json({ links: this.links() });
+        // OPENING A SEAL — pointing this World at a vendor (a link, a twin's root) or sealing the credential it uses there — is
+        // the World token's act, or a person's at its page: never a key's, which an app or a script holds (an app that could
+        // open its own seal would be unsealed by itself, not deliberately)
+        const opensSeal = (kind === 'links' && name && (request.method === 'PUT' || request.method === 'DELETE'))
+            || (kind === 'twins' && name && (verb === 'root' || verb === 'credential') && request.method === 'PUT')
+            // a check runs in a local World's own process, with all it can reach: putting or removing one is the same act
+            || (kind === 'checks' && name && (request.method === 'PUT' || request.method === 'DELETE'));
+        if (opensSeal && via === 'key')
+            return Response.json({ error: 'opening a seal is the World\'s token\'s act, or a person\'s at its page: a key cannot point this World at a vendor, seal a credential, or change its checks' }, { status: 403 });
         if (kind === 'links' && name && request.method === 'PUT') {
             if (!/^[a-z0-9][a-z0-9_-]{0,63}$/.test(name) || this.up().services[name])
                 return Response.json({ error: 'a link is named [a-z0-9_-] and is not a twin of this World' }, { status: 400 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-runtime",
-  "version": "2.0.33",
+  "version": "2.0.35",
   "description": "World configs for twins: boot named local runtimes, allocate ports, generate world.env/instance.json, and run apps against fake-key twin worlds.",
   "keywords": [
     "twin",

package/src/runtime.ts

@@ -1567,7 +1567,11 @@ export async function upWorld(configId: string, options: UpWorldOptions = {}, ab
       writeFileSync(bootingFile(root, name), `${JSON.stringify({ pid: process.pid, at: new Date().toISOString() } satisfies BootingClaim)}\n`, { mode: 0o600 });
     });
   } catch (error) {
-    if (resourcesClaimed) releaseWorldLifecycle(root, name);
+    // the failure that stopped the boot leads: a release that also fails is added to it, never put in its place
+    if (resourcesClaimed) {
+      try { releaseWorldLifecycle(root, name); }
+      catch (release) { if (error instanceof Error) error.message += `; releasing the World's claim failed too: ${release instanceof Error ? release.message : String(release)}`; }
+    }
     throw error;
   }
 
@@ -1755,7 +1759,7 @@ export async function upWorld(configId: string, options: UpWorldOptions = {}, ab
       recordWorldStop(Object.values(services).filter((service) => rollbackKilled.includes(service.pid) && service.log).map((service) => service.log), 'world.service.killed', 'boot rollback', 'SIGKILL');
       const surviving = undeadPids(pids);
       if (surviving.length) rollbackErrors.push('owned processes remain alive or uncertain');
-      if (error instanceof CommandRetirementError) rollbackErrors.push(error.message);
+      if (error instanceof CommandRetirementError) rollbackErrors.push((error as CommandRetirementError & { retirement?: string }).retirement ?? error.message);
 
       if (rollbackErrors.length > 0) {
         cleanupUncertain = true;
@@ -3341,7 +3345,7 @@ function startProxyDaemonOwned(name: string, root: string, caCertPath: string, e
     try { writeFileSync(markerFd, JSON.stringify({ token: randomUUID(), ownerPid: process.pid, createdAt })); }
     finally { closeSync(markerFd); }
   } catch (error) {
-    rmSync(marker, { force: true }); // partial pre-spawn writes own no child
+    try { rmSync(marker, { force: true }); } catch { /* the write's failure is the one to report */ } // partial pre-spawn writes own no child
     throw error;
   }
   let child: ReturnType<typeof spawn>;
@@ -3356,7 +3360,7 @@ function startProxyDaemonOwned(name: string, root: string, caCertPath: string, e
       });
     } finally { closeSync(proxyOut); }
   } catch (error) {
-    rmSync(marker, { force: true }); // no child was returned by spawn
+    try { rmSync(marker, { force: true }); } catch { /* the spawn's failure is the one to report */ } // no child was returned by spawn
     throw error;
   }
   child.on('error', () => {}); // a failed spawn can emit after this synchronous operation throws
@@ -3399,7 +3403,20 @@ function startProxyDaemonOwned(name: string, root: string, caCertPath: string, e
     process.stderr.write(`!! WARN: ambient proxy daemon for world "${name}" did not report within ${deadlineMs}ms — world is NOT proxy-sealed; unmodified CLIs will bypass the twins (env-only redirect still active).\n`);
     return { url: '', caCertPath, env: {} };
   } catch (error) {
-    if (!retirementAttempted) retire();
+    // the failure that stopped the start leads; a retirement that also fails is added to it, never put in its place
+    if (!retirementAttempted) {
+      // a retirement error is still what is thrown (its type keeps the survivor's ownership), with the cause it hid leading its
+      // message; any other cleanup failure is added to the original, which is thrown
+      try { retire(); } catch (retirement) {
+        const cause = error instanceof Error ? error.message : String(error);
+        if (retirement instanceof CommandRetirementError) {
+          Object.assign(retirement, { retirement: retirement.message, cause: error });
+          retirement.message = `${cause}; ${retirement.message}`;
+          throw retirement;
+        }
+        if (error instanceof Error) error.message += `; retiring the proxy failed too: ${retirement instanceof Error ? retirement.message : String(retirement)}`;
+      }
+    }
     throw error;
   }
 }

package/src/served-world.ts

@@ -1037,6 +1037,14 @@ export class WorldDoors {
       return Response.json(approveWorldChangeset(name, { root: this.worldRoot, world: this.name, principal, ...(body.note ? { note: body.note } : {}) }));
     }
     if (kind === 'links' && !name && request.method === 'GET') return Response.json({ links: this.links() });
+    // OPENING A SEAL — pointing this World at a vendor (a link, a twin's root) or sealing the credential it uses there — is
+    // the World token's act, or a person's at its page: never a key's, which an app or a script holds (an app that could
+    // open its own seal would be unsealed by itself, not deliberately)
+    const opensSeal = (kind === 'links' && name && (request.method === 'PUT' || request.method === 'DELETE'))
+      || (kind === 'twins' && name && (verb === 'root' || verb === 'credential') && request.method === 'PUT')
+      // a check runs in a local World's own process, with all it can reach: putting or removing one is the same act
+      || (kind === 'checks' && name && (request.method === 'PUT' || request.method === 'DELETE'));
+    if (opensSeal && via === 'key') return Response.json({ error: 'opening a seal is the World\'s token\'s act, or a person\'s at its page: a key cannot point this World at a vendor, seal a credential, or change its checks' }, { status: 403 });
     if (kind === 'links' && name && request.method === 'PUT') {
       if (!/^[a-z0-9][a-z0-9_-]{0,63}$/.test(name) || this.up().services[name]) return Response.json({ error: 'a link is named [a-z0-9_-] and is not a twin of this World' }, { status: 400 });
       const body = (await request.json()) as { origin?: string };