@ricsam/r5d-worker 0.0.119 → 0.0.121

package/dist/cjs/main.cjs

@@ -940,24 +940,43 @@ function tryGit(args, options = {}) {
     return false;
   }
 }
+class GitTransportTimeoutError extends Error {
+}
 async function runGitAsync(args, options = {}) {
   const command = workerGitCommand.commandArgs(args);
+  const bounded = options.timeoutMs !== void 0;
   const subprocess = Bun.spawn(command, {
     cwd: options.cwd,
     stdin: "ignore",
     stdout: "pipe",
     stderr: "pipe",
-    env: (0, import_git_process_environment.workerGitProcessEnvironment)()
+    env: (0, import_git_process_environment.workerGitProcessEnvironment)(),
+    ...bounded ? { detached: true } : {}
   });
-  const [stdout, stderr, exitCode] = await Promise.all([
+  const completion = Promise.all([
     new Response(subprocess.stdout).text(),
     new Response(subprocess.stderr).text(),
     subprocess.exited
-  ]);
-  if (exitCode !== 0) {
-    throw new Error(`git ${args.join(" ")} failed: ${stderr.trim() || stdout.trim() || `exit ${exitCode}`}`);
+  ]).then(([stdout, stderr, exitCode]) => ({ stdout, stderr, exitCode }));
+  let timer;
+  const timedOut = bounded ? new Promise((_resolve, reject) => {
+    timer = setTimeout(() => reject(new GitTransportTimeoutError(`git ${args.join(" ")} timed out after ${options.timeoutMs}ms`)), options.timeoutMs);
+  }) : null;
+  try {
+    const { stdout, stderr, exitCode } = timedOut ? await Promise.race([completion, timedOut]) : await completion;
+    if (exitCode !== 0) {
+      throw new Error(`git ${args.join(" ")} failed: ${stderr.trim() || stdout.trim() || `exit ${exitCode}`}`);
+    }
+    return stdout.trim();
+  } catch (error) {
+    if (error instanceof GitTransportTimeoutError) {
+      void (0, import_process_tree.terminateProcessTree)(subprocess, { graceMs: 0 }).catch(() => void 0);
+      void completion.catch(() => void 0);
+    }
+    throw error;
+  } finally {
+    if (timer) clearTimeout(timer);
   }
-  return stdout.trim();
 }
 async function tryGitAsync(args, options = {}) {
   try {
@@ -1818,14 +1837,13 @@ const workerGitSecurityTestHarness = {
   executeEditFileOperation,
   terminateCredentialBearingChildren,
   terminateCredentialBearingChildrenWithRetention,
-  async commitCredentialGeneration(prepared, credential, children, beforeMutation, previousGenerationFenced = false) {
-    return await commitCredentialGeneration(
-      prepared,
-      credential,
-      async () => await terminateCredentialBearingChildren(children),
-      beforeMutation,
-      previousGenerationFenced
-    );
+  async commitCredentialGeneration(prepared, credential, options) {
+    return await commitCredentialGeneration(prepared, credential, {
+      secretMaterialChanged: options.secretMaterialChanged,
+      terminatePreviousGeneration: async () => await terminateCredentialBearingChildren(options.children),
+      beforeMutation: options.beforeMutation,
+      previousGenerationFenced: options.previousGenerationFenced ?? false
+    });
   },
   credentialGenerationReceiptPath,
   credentialAuthorityLockPath,
@@ -1863,14 +1881,14 @@ function installGitHubCredentialGeneration(credential) {
 `);
   }
 }
-async function commitCredentialGeneration(prepared, credential, terminatePreviousGeneration, beforeMutation, previousGenerationFenced = false) {
+async function commitCredentialGeneration(prepared, credential, options) {
   const changed = prepared.changed;
   try {
-    if (changed && !previousGenerationFenced) {
+    if (changed && options.secretMaterialChanged && !options.previousGenerationFenced) {
       githubCredential = null;
-      await terminatePreviousGeneration();
+      await options.terminatePreviousGeneration();
     }
-    prepared.commit(beforeMutation);
+    prepared.commit(options.beforeMutation);
   } catch (error) {
     prepared.discard();
     throw error instanceof import_registry_auth.RegistryAuthConfigurationError ? error : new import_registry_auth.RegistryAuthConfigurationError(error);
@@ -4319,33 +4337,56 @@ async function startWorker(options, projectRuntime = {
     return reconciledProjectIds;
   };
   const ORIGIN_DIVERGENCE_REFRESH_INTERVAL_MS = 5 * 60 * 1e3;
+  const ORIGIN_DIVERGENCE_FETCH_TIMEOUT_MS = 3e4;
+  const ORIGIN_DIVERGENCE_REFRESH_BUDGET_MS = 9e4;
   const lastOriginDivergenceFetchMs = /* @__PURE__ */ new Map();
-  const collectAheadOfOriginBranches = async (refetchOriginProjectIds) => {
+  const collectAheadOfOriginBranches = async (refetchOriginProjectIds, onProgress) => {
     const aheadBranches = [];
     for (const projectId of [...lastOriginDivergenceFetchMs.keys()]) {
       if (!projectConfigById.has(projectId)) lastOriginDivergenceFetchMs.delete(projectId);
     }
-    for (const project of projectConfigById.values()) {
+    const passStartedAtMs = Date.now();
+    let budgetSpentReported = false;
+    const projects = [...projectConfigById.values()];
+    for (const [projectIndex, project] of projects.entries()) {
       if (project.executionDisabled || !readyProjectIds.has(project.projectId) || project.branches.length === 0) continue;
+      onProgress?.({
+        detail: `Checking origin divergence for ${project.projectPath}`,
+        completedItems: projectIndex,
+        totalItems: projects.length
+      });
       const connection = projectConnection(project);
       const primaryPath = configuredProjectBranchPath(projectsRoot, project, primaryProjectBranch(project));
       const lastFetchedAtMs = lastOriginDivergenceFetchMs.get(project.projectId);
       if (refetchOriginProjectIds.has(project.projectId) || lastFetchedAtMs === void 0 || Date.now() - lastFetchedAtMs >= ORIGIN_DIVERGENCE_REFRESH_INTERVAL_MS) {
-        if (await tryGitAsync(
-          [
-            ...(0, import_git_process_environment.gitTransportSecurityArgs)(connection.originUrl, connection.credentialHelper, connection.originCredentialUsername),
-            "fetch",
-            "--no-recurse-submodules",
-            "--prune",
-            "origin",
-            "+refs/heads/*:refs/remotes/origin/*"
-          ],
-          { cwd: primaryPath }
-        )) {
-          lastOriginDivergenceFetchMs.set(project.projectId, Date.now());
+        if (Date.now() - passStartedAtMs >= ORIGIN_DIVERGENCE_REFRESH_BUDGET_MS) {
+          if (!budgetSpentReported) {
+            budgetSpentReported = true;
+            process.stderr.write(
+              `[r5d-worker] origin divergence refresh budget of ${ORIGIN_DIVERGENCE_REFRESH_BUDGET_MS}ms is spent; remaining origins keep their previous comparison until the next refresh
+`
+            );
+          }
         } else {
-          process.stderr.write(`[r5d-worker] could not refresh origin divergence for ${project.projectPath}
-`);
+          try {
+            await runGitAsync(
+              [
+                ...(0, import_git_process_environment.gitTransportSecurityArgs)(connection.originUrl, connection.credentialHelper, connection.originCredentialUsername),
+                "fetch",
+                "--no-recurse-submodules",
+                "--prune",
+                "origin",
+                "+refs/heads/*:refs/remotes/origin/*"
+              ],
+              { cwd: primaryPath, timeoutMs: ORIGIN_DIVERGENCE_FETCH_TIMEOUT_MS }
+            );
+            lastOriginDivergenceFetchMs.set(project.projectId, Date.now());
+          } catch (error) {
+            process.stderr.write(
+              `[r5d-worker] could not refresh origin divergence for ${project.projectPath}: ${error instanceof Error ? error.message : String(error)}
+`
+            );
+          }
         }
       }
       for (const branch of project.branches) {
@@ -5378,13 +5419,11 @@ async function startWorker(options, projectRuntime = {
         } catch (error) {
           throw error instanceof import_registry_auth.RegistryAuthConfigurationError ? error : new import_registry_auth.RegistryAuthConfigurationError(error);
         }
-        await commitCredentialGeneration(
-          preparedAuthGeneration,
-          message.githubCredential,
-          terminateActiveCredentialBearingChildren,
-          void 0,
-          credentialPublicationPreauthorized
-        );
+        await commitCredentialGeneration(preparedAuthGeneration, message.githubCredential, {
+          secretMaterialChanged: credentialTransitionPhase !== "current",
+          terminatePreviousGeneration: terminateActiveCredentialBearingChildren,
+          previousGenerationFenced: credentialPublicationPreauthorized
+        });
         if (receiptGeneration !== workspaceConfigurationReceiptGeneration) {
           throw new Error("Workspace configuration was superseded by a newer server generation");
         }
@@ -5519,7 +5558,15 @@ async function startWorker(options, projectRuntime = {
           }
         };
         const hasDurableBranchDeletion = projectWorkspaceState.tombstones.some((tombstone) => tombstone.kind === "branch");
-        const result = await performWorkspaceSync({
+        sendLifecycleProgress({
+          phase: "configuring",
+          operationId: configurationOperationId,
+          detail: `Synchronizing the workspace after configuring ${message.projects.length} project(s)`,
+          completedItems: message.projects.length,
+          totalItems: message.projects.length
+        });
+        const connectSyncStartedAtMs = Date.now();
+        const syncResult = await performWorkspaceSync({
           attemptId: crypto.randomUUID(),
           trigger: { type: "connect" },
           confirmedLargeDiff: hasDurableBranchDeletion,
@@ -5527,6 +5574,11 @@ async function startWorker(options, projectRuntime = {
           resetToCanonical: workspaceConfigurationResetToCanonicalIsAllowed(message.resetToCanonical, incidentDeferral.incidentId),
           assertStillAdmitted: assertConfigurationSyncStillAdmitted
         });
+        const connectSyncMs = Date.now() - connectSyncStartedAtMs;
+        const result = syncResult.telemetry ? syncResult : {
+          ...syncResult,
+          telemetry: { totalMs: connectSyncMs, queueMs: 0, prepareMs: lastWorkspaceSyncMirrorObservationMs, synchronizeMs: connectSyncMs }
+        };
         assertConfigurationSyncStillAdmitted();
         if (receiptGeneration !== workspaceConfigurationReceiptGeneration) {
           throw new Error("Workspace configuration was superseded by a newer server generation");
@@ -5559,7 +5611,14 @@ async function startWorker(options, projectRuntime = {
         const pending = [...pendingCheckouts.values()].sort(
           (left, right) => left.projectId.localeCompare(right.projectId) || left.branchName.localeCompare(right.branchName)
         );
-        return { result, pending, aheadOfOriginBranches: await collectAheadOfOriginBranches(reconciledProjectIds) };
+        return {
+          result,
+          pending,
+          aheadOfOriginBranches: await collectAheadOfOriginBranches(
+            reconciledProjectIds,
+            (progress) => sendLifecycleProgress({ phase: "configuring", operationId: configurationOperationId, ...progress })
+          )
+        };
       });
     } catch (error) {
       if (receiptGeneration !== workspaceConfigurationReceiptGeneration) {
@@ -5913,7 +5972,15 @@ async function startWorker(options, projectRuntime = {
       }
       if (message.type === "workspace_config") {
         const receiptGeneration = ++workspaceConfigurationReceiptGeneration;
-        const refreshesDeferredConfiguration = deferredWorkspaceConfiguration !== null && activeWorkspaceIncidentId === null && message.deferWorkspaceSyncForIncidentId === void 0;
+        const refreshesDeferredConfiguration = (0, import_workspace_incident_state.workspaceConfigurationRefreshesDeferredConfiguration)({
+          deferredIncidentId: deferredWorkspaceConfiguration?.incidentId ?? null,
+          activeIncidentId: activeWorkspaceIncidentId,
+          requestedDeferredIncidentId: message.deferWorkspaceSyncForIncidentId
+        });
+        if (refreshesDeferredConfiguration && deferredWorkspaceConfigurationRefreshTimer) {
+          clearTimeout(deferredWorkspaceConfigurationRefreshTimer);
+          deferredWorkspaceConfigurationRefreshTimer = void 0;
+        }
         const digest = (0, import_recovery_store.workerOperationDigest)(message);
         const cached = projectRuntime.configuration;
         const canReuseConfiguration = cached?.digest === digest && cached.workspaceSync?.remoteUrl === message.workspaceRemoteUrl && Boolean(cached.workspaceSync.credentialHelper) && cached.workspaceSync.credentialUsername === workerCredentialUsername && cached.workspaceSync.gitIdentity?.name === message.gitIdentity.name && cached.workspaceSync.gitIdentity?.email === message.gitIdentity.email && !unsafeWorkspaceSyncBouncePending && credentialGenerationFingerprint({ ...message, workerBaseUrl: baseUrl, workerAuthHeader: bearerAuthHeader }) === configuredCredentialGenerationFingerprint;

package/dist/cjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.119",
+  "version": "0.0.121",
   "type": "commonjs"
 }

package/dist/cjs/workspace-git-sync.cjs

@@ -2367,7 +2367,9 @@ async function runWorkspaceGitSynchronization(input, remoteHeadFetches) {
       }
       restoreDeferredWorkspaceMountsFromHead(
         workspacePath,
-        input.mounts.filter(({ id }) => deferredMountIds.has(id))
+        input.mounts.filter(
+          (mount) => deferredMountIds.has(mount.id) || mount.preserveLocalOnHydrationBasisChange === true && cycleSkippedMountIds.has(mount.id)
+        )
       );
       await stageAndCommitWorkspace();
       await fsyncWorkspaceCheckoutTreeYielding(workspacePath);

package/dist/cjs/workspace-incident-state.cjs

@@ -18,7 +18,8 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var workspace_incident_state_exports = {};
 __export(workspace_incident_state_exports, {
-  applyWorkspaceIncidentUpdate: () => applyWorkspaceIncidentUpdate
+  applyWorkspaceIncidentUpdate: () => applyWorkspaceIncidentUpdate,
+  workspaceConfigurationRefreshesDeferredConfiguration: () => workspaceConfigurationRefreshesDeferredConfiguration
 });
 module.exports = __toCommonJS(workspace_incident_state_exports);
 function applyWorkspaceIncidentUpdate(currentIncidentId, update) {
@@ -26,7 +27,11 @@ function applyWorkspaceIncidentUpdate(currentIncidentId, update) {
   if (currentIncidentId && update.incidentId && update.incidentId !== currentIncidentId) return currentIncidentId;
   return null;
 }
+function workspaceConfigurationRefreshesDeferredConfiguration(input) {
+  return input.deferredIncidentId !== null && input.activeIncidentId === null && input.requestedDeferredIncidentId === void 0;
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  applyWorkspaceIncidentUpdate
+  applyWorkspaceIncidentUpdate,
+  workspaceConfigurationRefreshesDeferredConfiguration
 });

package/dist/mjs/main.mjs

@@ -34,7 +34,7 @@ import {
   registryAuthHasAppManagedGitHubCredential,
   RegistryAuthConfigurationError
 } from "./registry-auth.mjs";
-import { applyWorkspaceIncidentUpdate } from "./workspace-incident-state.mjs";
+import { applyWorkspaceIncidentUpdate, workspaceConfigurationRefreshesDeferredConfiguration } from "./workspace-incident-state.mjs";
 import {
   hasActiveVisibleProjectsWorkspaceTarget,
   PENDING_CREATED_BRANCH_AUTOMATIC_SYNC_GRACE_MS,
@@ -959,24 +959,43 @@ function tryGit(args, options = {}) {
     return false;
   }
 }
+class GitTransportTimeoutError extends Error {
+}
 async function runGitAsync(args, options = {}) {
   const command = workerGitCommand.commandArgs(args);
+  const bounded = options.timeoutMs !== void 0;
   const subprocess = Bun.spawn(command, {
     cwd: options.cwd,
     stdin: "ignore",
     stdout: "pipe",
     stderr: "pipe",
-    env: workerGitProcessEnvironment()
+    env: workerGitProcessEnvironment(),
+    ...bounded ? { detached: true } : {}
   });
-  const [stdout, stderr, exitCode] = await Promise.all([
+  const completion = Promise.all([
     new Response(subprocess.stdout).text(),
     new Response(subprocess.stderr).text(),
     subprocess.exited
-  ]);
-  if (exitCode !== 0) {
-    throw new Error(`git ${args.join(" ")} failed: ${stderr.trim() || stdout.trim() || `exit ${exitCode}`}`);
+  ]).then(([stdout, stderr, exitCode]) => ({ stdout, stderr, exitCode }));
+  let timer;
+  const timedOut = bounded ? new Promise((_resolve, reject) => {
+    timer = setTimeout(() => reject(new GitTransportTimeoutError(`git ${args.join(" ")} timed out after ${options.timeoutMs}ms`)), options.timeoutMs);
+  }) : null;
+  try {
+    const { stdout, stderr, exitCode } = timedOut ? await Promise.race([completion, timedOut]) : await completion;
+    if (exitCode !== 0) {
+      throw new Error(`git ${args.join(" ")} failed: ${stderr.trim() || stdout.trim() || `exit ${exitCode}`}`);
+    }
+    return stdout.trim();
+  } catch (error) {
+    if (error instanceof GitTransportTimeoutError) {
+      void terminateProcessTree(subprocess, { graceMs: 0 }).catch(() => void 0);
+      void completion.catch(() => void 0);
+    }
+    throw error;
+  } finally {
+    if (timer) clearTimeout(timer);
   }
-  return stdout.trim();
 }
 async function tryGitAsync(args, options = {}) {
   try {
@@ -1837,14 +1856,13 @@ const workerGitSecurityTestHarness = {
   executeEditFileOperation,
   terminateCredentialBearingChildren,
   terminateCredentialBearingChildrenWithRetention,
-  async commitCredentialGeneration(prepared, credential, children, beforeMutation, previousGenerationFenced = false) {
-    return await commitCredentialGeneration(
-      prepared,
-      credential,
-      async () => await terminateCredentialBearingChildren(children),
-      beforeMutation,
-      previousGenerationFenced
-    );
+  async commitCredentialGeneration(prepared, credential, options) {
+    return await commitCredentialGeneration(prepared, credential, {
+      secretMaterialChanged: options.secretMaterialChanged,
+      terminatePreviousGeneration: async () => await terminateCredentialBearingChildren(options.children),
+      beforeMutation: options.beforeMutation,
+      previousGenerationFenced: options.previousGenerationFenced ?? false
+    });
   },
   credentialGenerationReceiptPath,
   credentialAuthorityLockPath,
@@ -1882,14 +1900,14 @@ function installGitHubCredentialGeneration(credential) {
 `);
   }
 }
-async function commitCredentialGeneration(prepared, credential, terminatePreviousGeneration, beforeMutation, previousGenerationFenced = false) {
+async function commitCredentialGeneration(prepared, credential, options) {
   const changed = prepared.changed;
   try {
-    if (changed && !previousGenerationFenced) {
+    if (changed && options.secretMaterialChanged && !options.previousGenerationFenced) {
       githubCredential = null;
-      await terminatePreviousGeneration();
+      await options.terminatePreviousGeneration();
     }
-    prepared.commit(beforeMutation);
+    prepared.commit(options.beforeMutation);
   } catch (error) {
     prepared.discard();
     throw error instanceof RegistryAuthConfigurationError ? error : new RegistryAuthConfigurationError(error);
@@ -4338,33 +4356,56 @@ async function startWorker(options, projectRuntime = {
     return reconciledProjectIds;
   };
   const ORIGIN_DIVERGENCE_REFRESH_INTERVAL_MS = 5 * 60 * 1e3;
+  const ORIGIN_DIVERGENCE_FETCH_TIMEOUT_MS = 3e4;
+  const ORIGIN_DIVERGENCE_REFRESH_BUDGET_MS = 9e4;
   const lastOriginDivergenceFetchMs = /* @__PURE__ */ new Map();
-  const collectAheadOfOriginBranches = async (refetchOriginProjectIds) => {
+  const collectAheadOfOriginBranches = async (refetchOriginProjectIds, onProgress) => {
     const aheadBranches = [];
     for (const projectId of [...lastOriginDivergenceFetchMs.keys()]) {
       if (!projectConfigById.has(projectId)) lastOriginDivergenceFetchMs.delete(projectId);
     }
-    for (const project of projectConfigById.values()) {
+    const passStartedAtMs = Date.now();
+    let budgetSpentReported = false;
+    const projects = [...projectConfigById.values()];
+    for (const [projectIndex, project] of projects.entries()) {
       if (project.executionDisabled || !readyProjectIds.has(project.projectId) || project.branches.length === 0) continue;
+      onProgress?.({
+        detail: `Checking origin divergence for ${project.projectPath}`,
+        completedItems: projectIndex,
+        totalItems: projects.length
+      });
       const connection = projectConnection(project);
       const primaryPath = configuredProjectBranchPath(projectsRoot, project, primaryProjectBranch(project));
       const lastFetchedAtMs = lastOriginDivergenceFetchMs.get(project.projectId);
       if (refetchOriginProjectIds.has(project.projectId) || lastFetchedAtMs === void 0 || Date.now() - lastFetchedAtMs >= ORIGIN_DIVERGENCE_REFRESH_INTERVAL_MS) {
-        if (await tryGitAsync(
-          [
-            ...gitTransportSecurityArgs(connection.originUrl, connection.credentialHelper, connection.originCredentialUsername),
-            "fetch",
-            "--no-recurse-submodules",
-            "--prune",
-            "origin",
-            "+refs/heads/*:refs/remotes/origin/*"
-          ],
-          { cwd: primaryPath }
-        )) {
-          lastOriginDivergenceFetchMs.set(project.projectId, Date.now());
+        if (Date.now() - passStartedAtMs >= ORIGIN_DIVERGENCE_REFRESH_BUDGET_MS) {
+          if (!budgetSpentReported) {
+            budgetSpentReported = true;
+            process.stderr.write(
+              `[r5d-worker] origin divergence refresh budget of ${ORIGIN_DIVERGENCE_REFRESH_BUDGET_MS}ms is spent; remaining origins keep their previous comparison until the next refresh
+`
+            );
+          }
         } else {
-          process.stderr.write(`[r5d-worker] could not refresh origin divergence for ${project.projectPath}
-`);
+          try {
+            await runGitAsync(
+              [
+                ...gitTransportSecurityArgs(connection.originUrl, connection.credentialHelper, connection.originCredentialUsername),
+                "fetch",
+                "--no-recurse-submodules",
+                "--prune",
+                "origin",
+                "+refs/heads/*:refs/remotes/origin/*"
+              ],
+              { cwd: primaryPath, timeoutMs: ORIGIN_DIVERGENCE_FETCH_TIMEOUT_MS }
+            );
+            lastOriginDivergenceFetchMs.set(project.projectId, Date.now());
+          } catch (error) {
+            process.stderr.write(
+              `[r5d-worker] could not refresh origin divergence for ${project.projectPath}: ${error instanceof Error ? error.message : String(error)}
+`
+            );
+          }
         }
       }
       for (const branch of project.branches) {
@@ -5397,13 +5438,11 @@ async function startWorker(options, projectRuntime = {
         } catch (error) {
           throw error instanceof RegistryAuthConfigurationError ? error : new RegistryAuthConfigurationError(error);
         }
-        await commitCredentialGeneration(
-          preparedAuthGeneration,
-          message.githubCredential,
-          terminateActiveCredentialBearingChildren,
-          void 0,
-          credentialPublicationPreauthorized
-        );
+        await commitCredentialGeneration(preparedAuthGeneration, message.githubCredential, {
+          secretMaterialChanged: credentialTransitionPhase !== "current",
+          terminatePreviousGeneration: terminateActiveCredentialBearingChildren,
+          previousGenerationFenced: credentialPublicationPreauthorized
+        });
         if (receiptGeneration !== workspaceConfigurationReceiptGeneration) {
           throw new Error("Workspace configuration was superseded by a newer server generation");
         }
@@ -5538,7 +5577,15 @@ async function startWorker(options, projectRuntime = {
           }
         };
         const hasDurableBranchDeletion = projectWorkspaceState.tombstones.some((tombstone) => tombstone.kind === "branch");
-        const result = await performWorkspaceSync({
+        sendLifecycleProgress({
+          phase: "configuring",
+          operationId: configurationOperationId,
+          detail: `Synchronizing the workspace after configuring ${message.projects.length} project(s)`,
+          completedItems: message.projects.length,
+          totalItems: message.projects.length
+        });
+        const connectSyncStartedAtMs = Date.now();
+        const syncResult = await performWorkspaceSync({
           attemptId: crypto.randomUUID(),
           trigger: { type: "connect" },
           confirmedLargeDiff: hasDurableBranchDeletion,
@@ -5546,6 +5593,11 @@ async function startWorker(options, projectRuntime = {
           resetToCanonical: workspaceConfigurationResetToCanonicalIsAllowed(message.resetToCanonical, incidentDeferral.incidentId),
           assertStillAdmitted: assertConfigurationSyncStillAdmitted
         });
+        const connectSyncMs = Date.now() - connectSyncStartedAtMs;
+        const result = syncResult.telemetry ? syncResult : {
+          ...syncResult,
+          telemetry: { totalMs: connectSyncMs, queueMs: 0, prepareMs: lastWorkspaceSyncMirrorObservationMs, synchronizeMs: connectSyncMs }
+        };
         assertConfigurationSyncStillAdmitted();
         if (receiptGeneration !== workspaceConfigurationReceiptGeneration) {
           throw new Error("Workspace configuration was superseded by a newer server generation");
@@ -5578,7 +5630,14 @@ async function startWorker(options, projectRuntime = {
         const pending = [...pendingCheckouts.values()].sort(
           (left, right) => left.projectId.localeCompare(right.projectId) || left.branchName.localeCompare(right.branchName)
         );
-        return { result, pending, aheadOfOriginBranches: await collectAheadOfOriginBranches(reconciledProjectIds) };
+        return {
+          result,
+          pending,
+          aheadOfOriginBranches: await collectAheadOfOriginBranches(
+            reconciledProjectIds,
+            (progress) => sendLifecycleProgress({ phase: "configuring", operationId: configurationOperationId, ...progress })
+          )
+        };
       });
     } catch (error) {
       if (receiptGeneration !== workspaceConfigurationReceiptGeneration) {
@@ -5932,7 +5991,15 @@ async function startWorker(options, projectRuntime = {
       }
       if (message.type === "workspace_config") {
         const receiptGeneration = ++workspaceConfigurationReceiptGeneration;
-        const refreshesDeferredConfiguration = deferredWorkspaceConfiguration !== null && activeWorkspaceIncidentId === null && message.deferWorkspaceSyncForIncidentId === void 0;
+        const refreshesDeferredConfiguration = workspaceConfigurationRefreshesDeferredConfiguration({
+          deferredIncidentId: deferredWorkspaceConfiguration?.incidentId ?? null,
+          activeIncidentId: activeWorkspaceIncidentId,
+          requestedDeferredIncidentId: message.deferWorkspaceSyncForIncidentId
+        });
+        if (refreshesDeferredConfiguration && deferredWorkspaceConfigurationRefreshTimer) {
+          clearTimeout(deferredWorkspaceConfigurationRefreshTimer);
+          deferredWorkspaceConfigurationRefreshTimer = void 0;
+        }
         const digest = workerOperationDigest(message);
         const cached = projectRuntime.configuration;
         const canReuseConfiguration = cached?.digest === digest && cached.workspaceSync?.remoteUrl === message.workspaceRemoteUrl && Boolean(cached.workspaceSync.credentialHelper) && cached.workspaceSync.credentialUsername === workerCredentialUsername && cached.workspaceSync.gitIdentity?.name === message.gitIdentity.name && cached.workspaceSync.gitIdentity?.email === message.gitIdentity.email && !unsafeWorkspaceSyncBouncePending && credentialGenerationFingerprint({ ...message, workerBaseUrl: baseUrl, workerAuthHeader: bearerAuthHeader }) === configuredCredentialGenerationFingerprint;

package/dist/mjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.119",
+  "version": "0.0.121",
   "type": "module"
 }

package/dist/mjs/workspace-git-sync.mjs

@@ -2330,7 +2330,9 @@ async function runWorkspaceGitSynchronization(input, remoteHeadFetches) {
       }
       restoreDeferredWorkspaceMountsFromHead(
         workspacePath,
-        input.mounts.filter(({ id }) => deferredMountIds.has(id))
+        input.mounts.filter(
+          (mount) => deferredMountIds.has(mount.id) || mount.preserveLocalOnHydrationBasisChange === true && cycleSkippedMountIds.has(mount.id)
+        )
       );
       await stageAndCommitWorkspace();
       await fsyncWorkspaceCheckoutTreeYielding(workspacePath);

package/dist/mjs/workspace-incident-state.mjs

@@ -3,6 +3,10 @@ function applyWorkspaceIncidentUpdate(currentIncidentId, update) {
   if (currentIncidentId && update.incidentId && update.incidentId !== currentIncidentId) return currentIncidentId;
   return null;
 }
+function workspaceConfigurationRefreshesDeferredConfiguration(input) {
+  return input.deferredIncidentId !== null && input.activeIncidentId === null && input.requestedDeferredIncidentId === void 0;
+}
 export {
-  applyWorkspaceIncidentUpdate
+  applyWorkspaceIncidentUpdate,
+  workspaceConfigurationRefreshesDeferredConfiguration
 };

package/dist/types/main.d.ts

@@ -957,10 +957,15 @@ export declare const workerGitSecurityTestHarness: {
     executeEditFileOperation: typeof executeEditFileOperation;
     terminateCredentialBearingChildren: typeof terminateCredentialBearingChildren;
     terminateCredentialBearingChildrenWithRetention: typeof terminateCredentialBearingChildrenWithRetention;
-    commitCredentialGeneration(prepared: PreparedPrivateAuthFileGeneration, credential: WorkerGitHubCredential | null, children: readonly {
-        label: string;
-        terminate: () => void | Promise<void>;
-    }[], beforeMutation?: (filePath: string, index: number) => void, previousGenerationFenced?: boolean): Promise<boolean>;
+    commitCredentialGeneration(prepared: PreparedPrivateAuthFileGeneration, credential: WorkerGitHubCredential | null, options: {
+        children: readonly {
+            label: string;
+            terminate: () => void | Promise<void>;
+        }[];
+        secretMaterialChanged: boolean;
+        beforeMutation?: (filePath: string, index: number) => void;
+        previousGenerationFenced?: boolean;
+    }): Promise<boolean>;
     credentialGenerationReceiptPath: typeof credentialGenerationReceiptPath;
     credentialAuthorityLockPath: typeof credentialAuthorityLockPath;
     acquireCredentialAuthorityLock: typeof acquireCredentialAuthorityLock;

package/dist/types/workspace-incident-state.d.ts

@@ -3,3 +3,17 @@ export type WorkspaceIncidentUpdate = {
     status: "remediating" | "waiting_for_worker" | "resolved" | "confirmed" | "reset" | null;
 };
 export declare function applyWorkspaceIncidentUpdate(currentIncidentId: string | null, update: WorkspaceIncidentUpdate): string | null;
+/**
+ * Whether an incoming `workspace_config` is the full configuration a terminal
+ * incident update promised: the worker still holds an incident-deferred
+ * configuration, no incident is active any more, and the server did not ask
+ * for another deferral. Arrival of that configuration disarms the refresh
+ * watchdog; from then on the configuration's own generation checks and its
+ * failure close govern, so a legitimately long full configuration is never
+ * cut off mid-flight by the arrival timer.
+ */
+export declare function workspaceConfigurationRefreshesDeferredConfiguration(input: {
+    deferredIncidentId: string | null;
+    activeIncidentId: string | null;
+    requestedDeferredIncidentId: string | undefined;
+}): boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.119",
+  "version": "0.0.121",
   "type": "module",
   "main": "./dist/cjs/main.cjs",
   "module": "./dist/mjs/main.mjs",