fix: expose resource aliases on runner path

src/runner/resource-bundle.ts

@@ -1,5 +1,5 @@
 import { spawn } from "node:child_process";
-import { chmod, mkdir, writeFile } from "node:fs/promises";
+import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { AgentRunError } from "../common/errors.js";
 import { redactText } from "../common/redaction.js";
@@ -59,7 +59,9 @@ async function materializeToolAliases(checkoutPath: string, aliases: NonNullable
   for (const alias of aliases) {
     const target = resolveBundlePath(checkoutPath, alias.path, `toolAliases.${alias.name}.path`);
     const wrapper = path.join(binPath, alias.name);
-    await writeFile(wrapper, aliasWrapper(alias.kind, target), "utf8");
+    const content = aliasWrapper(alias.kind, target);
+    await assertAliasWrapperWritable(wrapper, alias.name);
+    await writeFile(wrapper, content, "utf8");
     await chmod(wrapper, 0o755);
     names.push(alias.name);
   }
@@ -67,10 +69,22 @@ async function materializeToolAliases(checkoutPath: string, aliases: NonNullable
 }
 
 function aliasWrapper(kind: string, target: string): string {
-  if (kind === "node-script") return `#!/usr/bin/env sh\nexec node ${shellArg(target)} "$@"\n`;
-  if (kind === "bun-script") return `#!/usr/bin/env sh\nexec bun ${shellArg(target)} "$@"\n`;
-  if (kind === "sh-script") return `#!/usr/bin/env sh\nexec sh ${shellArg(target)} "$@"\n`;
-  return `#!/usr/bin/env sh\nexec ${shellArg(target)} "$@"\n`;
+  if (kind === "node-script") return `#!/usr/bin/env sh\n# agentrun-resource-alias-wrapper\nexec node ${shellArg(target)} "$@"\n`;
+  if (kind === "bun-script") return `#!/usr/bin/env sh\n# agentrun-resource-alias-wrapper\nexec bun ${shellArg(target)} "$@"\n`;
+  if (kind === "sh-script") return `#!/usr/bin/env sh\n# agentrun-resource-alias-wrapper\nexec sh ${shellArg(target)} "$@"\n`;
+  return `#!/usr/bin/env sh\n# agentrun-resource-alias-wrapper\nexec ${shellArg(target)} "$@"\n`;
+}
+
+async function assertAliasWrapperWritable(wrapper: string, name: string): Promise<void> {
+  try {
+    const existing = await readFile(wrapper, "utf8");
+    if (existing.includes("agentrun-resource-alias-wrapper")) return;
+    throw new AgentRunError("schema-invalid", `resource bundle tool alias ${name} would overwrite an existing command`, { httpStatus: 409, details: { wrapper: pathSummary(wrapper) } });
+  } catch (error) {
+    if (error instanceof AgentRunError) throw error;
+    if (error && typeof error === "object" && "code" in error && (error as { code?: unknown }).code === "ENOENT") return;
+    throw error;
+  }
 }
 
 async function git(args: string[], cwd: string, options: { allowFailure?: boolean } = {}): Promise<{ stdout: string; stderr: string }> {