fix(paths): preserve selected command, output, and source identities

src/javascript/recovery/WakaruCommand.ts

@@ -1,6 +1,7 @@
+import { selectArtifactCommandPath } from "../../process/ArtifactCommandPath.js";
 import { randomUUID } from "node:crypto";
 import { constants } from "node:fs";
-import { access, realpath, stat } from "node:fs/promises";
+import { access, stat } from "node:fs/promises";
 import { isAbsolute } from "node:path";
 import {
   AnalysisArtifactChangedError,
@@ -87,10 +88,10 @@ export const resolveWakaruCommand = async (
       { userMessage: WAKARU_REQUIREMENT },
     );
   try {
-    const command = await realpath(configured);
-    await access(command, constants.R_OK | constants.X_OK);
+    const selection = await selectArtifactCommandPath(configured, signal);
+    await access(selection.resolvedPath, constants.R_OK | constants.X_OK);
     const fingerprint = await fingerprintRecoveryFile(
-      command,
+      selection.resolvedPath,
       RECOVERY_LIMITS.outputBytes,
       signal,
       resources,
@@ -99,10 +100,11 @@ export const resolveWakaruCommand = async (
       environment.REA_JAVASCRIPT_PRLIMIT_COMMAND ?? "/usr/bin/prlimit";
     if (!isAbsolute(limiter))
       throw new TypeError("REA_JAVASCRIPT_PRLIMIT_COMMAND must be absolute");
-    await access(limiter, constants.X_OK);
+    const limiterSelection = await selectArtifactCommandPath(limiter, signal);
+    await access(limiterSelection.resolvedPath, constants.X_OK);
     if (!(await stat(limiter)).isFile())
       throw new TypeError(`Resource limiter is not a regular file: ${limiter}`);
-    return { command, limiter, ...fingerprint };
+    return { command: selection, limiter: limiterSelection, ...fingerprint };
   } catch (cause: unknown) {
     if (
       cause instanceof AnalysisCancelledError ||

src/javascript/recovery/WakaruExecution.ts

@@ -1,3 +1,4 @@
+import { assertArtifactCommandPath } from "../../process/ArtifactCommandPath.js";
 import { join } from "node:path";
 import {
   createAnalysisExecution,
@@ -61,7 +62,8 @@ const executeWakaruRecovery = async (context: RecoveryWorkspace) => {
   } = context;
   const staging = join(root, "modules");
   const commandContext = {
-    ...engine,
+    command: engine.command.invocationPath,
+    limiter: engine.limiter.invocationPath,
     cwd: root,
     deadline: context.deadline,
     environment: environment,
@@ -69,7 +71,25 @@ const executeWakaruRecovery = async (context: RecoveryWorkspace) => {
     ...(launcher === undefined ? {} : { launcher: launcher }),
     resources,
   };
-  const version = await runWakaruCommand({
+  const run = async (execution: Parameters<typeof runWakaruCommand>[0]) => {
+    for (const selected of [engine.command, engine.limiter])
+      await assertArtifactCommandPath(selected, OPERATION, {
+        signal: options?.signal,
+      });
+    const output = await runWakaruCommand(execution);
+    for (const selected of [engine.command, engine.limiter])
+      await assertArtifactCommandPath(selected, OPERATION, {
+        capturedOutput: {
+          stdout: output.stdout,
+          stderr: output.stderr,
+          exit_code: output.exit_code,
+          signal: output.signal,
+          truncated: false,
+        },
+      });
+    return output;
+  };
+  const version = await run({
     ...commandContext,
     arguments: ["--version"],
   });
@@ -87,7 +107,7 @@ const executeWakaruRecovery = async (context: RecoveryWorkspace) => {
       { userMessage: `${mismatch}.` },
     );
   }
-  const run = await runWakaruCommand({
+  const execution = await run({
     ...commandContext,
     staging,
     arguments: [
@@ -118,14 +138,14 @@ const executeWakaruRecovery = async (context: RecoveryWorkspace) => {
       ),
     );
   const parsed = await parseWakaruReports({
-    execution: run,
+    execution,
     provenancePath: join(staging, "provenance.json"),
     snapshots,
     files,
     ...(options?.signal === undefined ? {} : { signal: options.signal }),
     resources,
   });
-  return { version, admitted, run, parsed };
+  return { version, admitted, run: execution, parsed };
 };
 
 /** Publish validated recovery and retain exact source and engine bindings. */
@@ -170,7 +190,7 @@ export const prepareWakaruExecution = async (context: RecoveryWorkspace) => {
       );
   }
   const currentEngine = await fingerprintRecoveryFile(
-    engine.command,
+    engine.command.resolvedPath,
     RECOVERY_LIMITS.outputBytes,
     options?.signal,
     resources,
@@ -178,7 +198,7 @@ export const prepareWakaruExecution = async (context: RecoveryWorkspace) => {
   if (currentEngine.sha256 !== engine.sha256)
     throw new AnalysisArtifactChangedError(
       OPERATION,
-      engine.command,
+      engine.command.invocationPath,
       "Configured engine bytes changed during recovery",
       {
         diagnostics: {

src/javascript/recovery/WakaruPublication.ts

@@ -109,7 +109,7 @@ export const publishWakaruArtifacts = async (
       id: "wakaru",
       version: context.admitted.version,
       executable: {
-        path: context.engine.command,
+        path: context.engine.command.resolvedPath,
         sha256: context.engine.sha256,
         bytes: context.engine.bytes,
       },