@ricsam/r5d-worker 0.0.141 → 0.0.143

package/dist/cjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.141",
+  "version": "0.0.143",
   "type": "commonjs"
 }

package/dist/mjs/main.mjs

@@ -7,7 +7,7 @@ import { startManagerRpc } from "./runtime/releases/rpc-main.mjs";
 import { ManagerRpcConfig } from "./runtime/releases/rpc-protocol.mjs";
 const args = process.argv.slice(2);
 if (args.includes("--version")) {
-  console.log(`r5d-worker ${true ? "0.0.141" : "development"}`);
+  console.log(`r5d-worker ${true ? "0.0.143" : "development"}`);
 } else if (!args.length || args.includes("--help")) {
   console.log(
     "Usage: r5d-worker start --label <label> [--root <dir>] [--base-url <url>] [--token <worker-token>]\n       r5d-worker executor /absolute/private/config.json\n       r5d-worker manager /absolute/private/config.json\n\nRun independently supervised durable runtime services. Provision configuration with r5dinfra."
@@ -15,7 +15,7 @@ if (args.includes("--version")) {
 } else if (args[0] === "start") {
   const runtime = await startPersonalWorker(
     parsePersonalWorkerOptions(args.slice(1)),
-    true ? "0.0.141" : "development"
+    true ? "0.0.143" : "development"
   );
   console.log(`Worker connected: ${runtime.resourceId}`);
   let closing = false;

package/dist/mjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.141",
+  "version": "0.0.143",
   "type": "module"
 }

package/dist/mjs/personal/action-scheduler.mjs

@@ -16,7 +16,7 @@ class PersonalActionScheduler {
         continue;
       }
       const request = action.request;
-      const lane = request.kind === "tcp" && typeof request.command?.streamId === "string" ? `tcp:${request.sessionId}:${request.command.streamId}` : request.kind === "inspect" && ["processes", "status"].includes(request.command?.method ?? "") ? `inspect:${request.sessionId}` : "mutation";
+      const lane = request.kind === "tcp" && typeof request.command?.streamId === "string" ? `tcp:${request.sessionId}:${request.command.streamId}` : request.kind === "terminal" && ["poll", "processPoll"].includes(request.command?.method ?? "") ? `terminal-poll:${request.sessionId}:${request.command?.operationId ?? request.command?.runId ?? "unknown"}` : request.kind === "inspect" && ["processes", "status"].includes(request.command?.method ?? "") ? `inspect:${request.sessionId}` : "mutation";
       if (this.active.size >= this.limit || [...this.active.values()].some((value) => value.lane === lane)) continue;
       const task = Promise.resolve().then(() => this.execute(action)).catch(this.failed).finally(() => this.active.delete(action.id));
       this.active.set(action.id, { hash: action.requestHash, lane, task });

package/dist/mjs/personal/runtime.mjs

@@ -23,7 +23,15 @@ const PersonalWorkerGrant = z.object({
   workerHello: RuntimeHello,
   leaseExpiresAt: z.coerce.number().int().positive()
 }).passthrough();
-const Workbench = z.object({ id: StorageId, repositoryId: StorageId, branch: BranchName, sessionId: RuntimeId, sharedSessionId: RuntimeId.optional() }).strict();
+const Workbench = z.object({
+  id: StorageId,
+  repositoryId: StorageId,
+  branch: BranchName,
+  sessionId: RuntimeId,
+  rootProfile: z.enum(["account", "project"]).default("project"),
+  namespace: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/).optional(),
+  projectName: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/).optional()
+}).strict();
 const PersonalWorkspaceRequest = z.object({
   protocol: z.literal(1),
   userId: RuntimeId,
@@ -67,9 +75,10 @@ async function openPersonalWorkerRuntime(options) {
   privateDirectory(root);
   if (grant.workerFence.installationId !== grant.installationId || grant.workerHello.installationId !== grant.installationId || grant.workerHello.instanceId !== grant.workerFence.ownerId || grant.workerHello.role !== "worker-adapter")
     throw new Error("Invalid personal worker grant");
-  const credentialsRoot = path.join(root, "credentials"), workspaceRoot = path.join(root, "workspace", grant.installationId);
+  const credentialsRoot = path.join(root, "credentials"), workspaceRoot = path.join(root, "workspace", grant.installationId), authorityRoot = path.join(root, "workspace-authority", grant.installationId), hostRoot = path.parse(workspaceRoot).root;
   privateDirectory(credentialsRoot);
   privateDirectory(workspaceRoot);
+  privateDirectory(authorityRoot);
   const token = await personalExecutorToken(root, grant), controllerId = `controller-${createHash("sha256").update(grant.instanceId).digest("hex").slice(0, 24)}`;
   const daemon = await startHostExecutor({
     installationId: grant.installationId,
@@ -86,7 +95,7 @@ async function openPersonalWorkerRuntime(options) {
         ownerId: controllerId,
         tokenHash: tokenHash(token),
         userIds: [grant.userId],
-        cwdRoots: [workspaceRoot],
+        cwdRoots: [hostRoot],
         lanes: ["general", "utility", "control"],
         credentialIds: []
       }
@@ -123,13 +132,14 @@ exec ${quote(executable)} ${quote(cli)} "$@"
       timeoutMs: 1e4
     });
     let current = grant, installed = false, retirementPending = false;
-    const manifests = /* @__PURE__ */ new Map();
+    const manifests = /* @__PURE__ */ new Map(), routes = /* @__PURE__ */ new Map();
     const manifestFile = path.join(root, "workbenches.json");
     try {
       const rows = z.array(ApprovedWorkbench).parse(readPrivateJson(manifestFile));
       for (const row of rows) {
-        if (row.userId !== grant.userId || !row.cwd.startsWith(workspaceRoot + path.sep)) throw new Error("Invalid retained workbench");
-        manifests.set(row.sessionId, row);
+        if (row.userId !== grant.userId || row.cwd !== workspaceRoot && !row.cwd.startsWith(workspaceRoot + path.sep))
+          throw new Error("Invalid retained workbench");
+        manifests.set(row.id, row);
       }
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
@@ -160,7 +170,7 @@ exec ${quote(executable)} ${quote(cli)} "$@"
             ownerId: next.workerHello.instanceId,
             tokenHash: tokenHash(token),
             userIds: [grant.userId],
-            cwdRoots: [workspaceRoot],
+            cwdRoots: [hostRoot],
             lanes: ["general", "utility", "control"],
             credentialIds: []
           }
@@ -185,22 +195,27 @@ exec ${quote(executable)} ${quote(cli)} "$@"
     }
     await renew(grant);
     const authority = await WorkspaceAuthority.open({
-      config: { installationId: grant.installationId, root: workspaceRoot, dynamicWorkbenches: true, workbenches: [] },
+      config: { installationId: grant.installationId, root: authorityRoot, workspaceRoot, dynamicWorkbenches: true, workbenches: [] },
       executor: async () => ({ client, workerFence: current.workerFence }),
-      resolveWorkbench: async (identity) => identity.userId === grant.userId ? manifests.get(identity.sessionId) ?? null : null,
+      resolveWorkbench: async (identity) => identity.userId === grant.userId ? manifests.get(routes.get(identity.sessionId) ?? "") ?? null : null,
       storage: async (identity) => new WorkspaceStorageClient(grant.installationId, options.storage(identity.sessionId), async () => current.workerFence)
     });
     async function approve(input) {
+      const cwd = input.rootProfile === "account" ? workspaceRoot : input.namespace && input.projectName ? path.join(workspaceRoot, "projects", input.namespace, input.projectName, ...input.branch.split("/")) : path.join(workspaceRoot, "workbenches", input.id);
       const row = ApprovedWorkbench.parse({
         ...input,
         userId: grant.userId,
-        cwd: path.join(workspaceRoot, "workbenches", input.id),
+        cwd,
         nonmutatingArgv: []
       });
-      const previous = manifests.get(input.sessionId);
-      if (previous && canonicalJson(previous) !== canonicalJson(row)) throw new Error("Personal workbench identity changed");
+      const previous = manifests.get(input.id);
+      const stable = (value) => {
+        const { sessionId: _sessionId, sharedSessionId: _sharedSessionId, ...binding } = value;
+        return binding;
+      };
+      if (previous && canonicalJson(stable(previous)) !== canonicalJson(stable(row))) throw new Error("Personal workbench identity changed");
       if (!previous) {
-        manifests.set(input.sessionId, row);
+        manifests.set(input.id, row);
         const tmp = `${manifestFile}.${randomBytes(8).toString("hex")}.next`;
         const handle = await fs.open(tmp, "wx", 384);
         try {
@@ -211,6 +226,7 @@ exec ${quote(executable)} ${quote(cli)} "$@"
         }
         await fs.rename(tmp, manifestFile);
       }
+      routes.set(input.sessionId, input.id);
     }
     async function installCredentials(values) {
       for (const source of values) {
@@ -234,7 +250,7 @@ exec ${quote(executable)} ${quote(cli)} "$@"
     const tcp = new PersonalTcpManager(path.join(root, "tcp"));
     async function dispatch(raw) {
       const request = PersonalWorkspaceRequest.parse(raw);
-      if (request.userId !== grant.userId || request.workbench.sessionId !== request.sessionId)
+      if (request.userId !== grant.userId)
         throw new Error("Wrong personal worker principal");
       if (request.kind === "tcp") return tcp.dispatch(request.sessionId, request.command);
       for (const parent of request.sharedWorkbenches ?? []) await approve(parent);
@@ -268,7 +284,7 @@ exec ${quote(executable)} ${quote(cli)} "$@"
                 fence: current.workerFence,
                 payload: {
                   argv,
-                  cwd: manifests.get(identity.sessionId).cwd,
+                  cwd: manifests.get(routes.get(identity.sessionId)).cwd,
                   ...command.method === "open" ? { interactive: true, pty: { cols: command.cols, rows: command.rows } } : {},
                   credentials: (request.credentials ?? []).map(({ id, generation }) => ({ id, generation }))
                 }
@@ -321,7 +337,7 @@ exec ${quote(executable)} ${quote(cli)} "$@"
             fence: current.workerFence,
             payload: {
               ...operation.payload,
-              cwd: manifests.get(identity.sessionId).cwd,
+              cwd: manifests.get(routes.get(identity.sessionId)).cwd,
               credentials: (request.credentials ?? []).map(({ id, generation }) => ({ id, generation }))
             }
           });

package/dist/mjs/runtime/workspace/artifacts.mjs

@@ -19,19 +19,19 @@ const SessionArtifactChunk = z.object({
 const RESERVED_ARTIFACT_ENV = ["R5D_ROOT", "R5D_SESSION_ID"];
 const sha = (value) => createHash("sha256").update(value).digest("hex");
 class SessionArtifactStore {
-  constructor(authorityRoot) {
-    this.authorityRoot = authorityRoot;
+  constructor(workspaceRoot) {
+    this.workspaceRoot = workspaceRoot;
   }
-  authorityRoot;
+  workspaceRoot;
   async environment(identity) {
     const scope = { userId: RuntimeId.parse(identity.userId), sessionId: RuntimeId.parse(identity.sessionId) };
-    const base = path.join(this.authorityRoot, "session-artifacts"), root = path.join(base, sha(canonicalJson(scope)));
+    const root = this.workspaceRoot, incoming = path.join(root, ".incoming", sha(canonicalJson(scope)));
     for (const directory of [
-      base,
       root,
       path.join(root, "artifacts"),
       path.join(root, "artifacts", identity.sessionId),
-      path.join(root, ".incoming")
+      path.join(root, ".incoming"),
+      incoming
     ]) {
       await fs.mkdir(directory, { mode: 448 }).catch((error) => {
         if (error.code !== "EEXIST") throw error;
@@ -44,7 +44,7 @@ class SessionArtifactStore {
     const chunk = SessionArtifactChunk.parse(input), bytes = Buffer.from(chunk.base64, "base64");
     if (bytes.length > 64 * 1024 || bytes.toString("base64") !== chunk.base64 || chunk.offset + bytes.length > chunk.size)
       throw new WorkspaceError("invalid_artifact_chunk", "Invalid bounded artifact bytes");
-    const env = await this.environment(identity), destination = path.join(env.R5D_ROOT, "artifacts", identity.sessionId, chunk.filename), incoming = path.join(env.R5D_ROOT, ".incoming", sha(chunk.filename));
+    const env = await this.environment(identity), destination = path.join(env.R5D_ROOT, "artifacts", identity.sessionId, chunk.filename), incoming = path.join(env.R5D_ROOT, ".incoming", sha(canonicalJson({ userId: identity.userId, sessionId: identity.sessionId })), sha(chunk.filename));
     const binding = { filename: chunk.filename, sha256: chunk.sha256, size: chunk.size }, manifest = `${incoming}.json`, temporary = `${incoming}.part`;
     const old = await readRegular(manifest, 1024).catch((error) => {
       if (error.code === "ENOENT") return null;

package/dist/mjs/runtime/workspace/authority.mjs

@@ -1,6 +1,7 @@
 import fs from "node:fs/promises";
 import { constants } from "node:fs";
 import path from "node:path";
+import os from "node:os";
 import { createHash, randomUUID } from "node:crypto";
 import { canonicalJson, OperationEnvelope, operationPayloadHash } from "@ricsam/r5d-api/runtime-protocol";
 import { STORAGE_LIMITS, GitOid, BranchName, safeTreePath } from "./storage-wire.mjs";
@@ -21,6 +22,7 @@ import {
   git,
   noSymlinkAncestors,
   privateRoot,
+  readHostRegular,
   readRegular,
   selectedTree,
   sha256,
@@ -42,7 +44,61 @@ class WorkspaceAuthority {
   closed = false;
   closeTask;
   actions = /* @__PURE__ */ new Set();
+  repositoryInitializations = /* @__PURE__ */ new Map();
   pending = 0;
+  expectedCwd(config) {
+    const workspaceRoot = this.config.workspaceRoot ?? this.config.root;
+    if (config.rootProfile === "account") return workspaceRoot;
+    if (config.namespace && config.projectName)
+      return path.join(workspaceRoot, "projects", config.namespace, config.projectName, ...config.branch.split("/"));
+    return path.join(workspaceRoot, "workbenches", config.id);
+  }
+  stableBinding(config) {
+    const { sessionId: _sessionId, sharedSessionId: _sharedSessionId, ...binding } = config;
+    return binding;
+  }
+  repositoryPath(config, directory) {
+    return config.namespace && config.projectName ? path.join(this.config.root, "repositories", config.repositoryId) : path.join(directory, "repo");
+  }
+  async ensureRepository(config, directory) {
+    const repo = this.repositoryPath(config, directory);
+    let task = this.repositoryInitializations.get(repo);
+    if (!task) {
+      task = (async () => {
+        const exists = await fs.lstat(repo).then(() => true, (error) => {
+          if (error.code === "ENOENT") return false;
+          throw error;
+        });
+        if (!exists) {
+          await fs.mkdir(repo, { recursive: true, mode: 448 });
+          await git(repo, ["init", "--bare", "--template=", "."]);
+        }
+        await ensureAuthorityGitRepositoryLayout(repo);
+        return repo;
+      })();
+      this.repositoryInitializations.set(repo, task);
+      void task.finally(() => this.repositoryInitializations.delete(repo)).catch(() => {
+      });
+    }
+    return task;
+  }
+  assertNonOverlappingCheckout(config) {
+    if (config.rootProfile !== "project") return;
+    for (const bench of this.benches.values()) {
+      if (bench.config.rootProfile !== "project" || bench.config.id === config.id || bench.state.blocked?.code === "archived") continue;
+      const relative = path.relative(bench.config.cwd, config.cwd), reverse = path.relative(config.cwd, bench.config.cwd);
+      if (!relative.startsWith("..") && !path.isAbsolute(relative) || !reverse.startsWith("..") && !path.isAbsolute(reverse))
+        throw new WorkspaceError("overlapping_branch_path", "Branch worktree paths may not contain one another");
+    }
+  }
+  linkedWorkbench(b) {
+    return Boolean(b.config.namespace && b.config.projectName);
+  }
+  resolveHostPath(value) {
+    const expanded = value === "~" ? os.homedir() : value.startsWith("~/") ? path.join(os.homedir(), value.slice(2)) : value;
+    if (!path.isAbsolute(expanded) || expanded.includes("\0")) throw new WorkspaceError("unsafe_path", "Host path must be absolute or home-relative");
+    return path.normalize(expanded);
+  }
   static async open(options) {
     const authority = new WorkspaceAuthority(options);
     const { config } = authority;
@@ -52,10 +108,8 @@ class WorkspaceAuthority {
     if (Boolean(config.dynamicWorkbenches) !== Boolean(options.resolveWorkbench)) throw new WorkspaceError("invalid_config", "Dynamic workspace requires catalog authorization");
     if (new Set(config.workbenches.map((b) => b.id)).size !== config.workbenches.length || new Set(config.workbenches.map((b) => `${b.userId}:${b.sessionId}`)).size !== config.workbenches.length)
       throw new WorkspaceError("invalid_config", "Duplicate workbench or session route");
-    for (const b of config.workbenches) {
-      if (b.cwd !== path.join(config.root, "workbenches", b.id))
-        throw new WorkspaceError("unsafe_root", "Approved cwd must equal root/workbenches/id; arbitrary and legacy roots are forbidden");
-    }
+    for (const b of config.workbenches)
+      if (b.cwd !== authority.expectedCwd(b)) throw new WorkspaceError("unsafe_root", "Approved cwd does not match its managed worktree path");
     if (contents.length) {
       const existing = JSON.parse((await readRegular(path.join(config.root, "installation.json"), 128 * 1024)).toString());
       if (canonicalJson(existing) !== canonicalJson(binding))
@@ -72,13 +126,13 @@ class WorkspaceAuthority {
       await durableJson(path.join(config.root, "installation.json"), binding);
       await fs.mkdir(path.join(config.root, "workbenches"), { mode: 448 });
       await fs.mkdir(path.join(config.root, "state"), { mode: 448 });
+      await fs.mkdir(path.join(config.root, "repositories"), { mode: 448 });
       for (const b of config.workbenches) {
-        await fs.mkdir(b.cwd, { mode: 448 });
+        await fs.mkdir(b.cwd, { recursive: true, mode: 448 });
         const directory = path.join(config.root, "state", b.id);
         await fs.mkdir(directory, { mode: 448 });
-        await fs.mkdir(path.join(directory, "repo"), { mode: 448 });
-        await git(path.join(directory, "repo"), ["init", "--bare", "--template=", "."]);
-        await durableJson(path.join(directory, "state.json"), { initialized: false, head: null, blocked: null, runs: {} });
+        await authority.ensureRepository(b, directory);
+        await durableJson(path.join(directory, "state.json"), { initialized: b.rootProfile === "account", head: null, blocked: null, runs: {} });
       }
     }
     for (const b of config.workbenches) {
@@ -87,8 +141,7 @@ class WorkspaceAuthority {
       const state = JSON.parse((await readRegular(path.join(directory, "state.json"), 1024 * 1024)).toString());
       if (typeof state.initialized !== "boolean" || !state.runs || !(state.head === null || GitOid.safeParse(state.head).success))
         throw new WorkspaceError("invalid_state", "Invalid durable workspace state; maintenance required");
-      const repo = path.join(directory, "repo");
-      await ensureAuthorityGitRepositoryLayout(repo);
+      const repo = await authority.ensureRepository(b, directory);
       authority.benches.set(b.id, { config: b, state, directory, repo });
     }
     if (config.dynamicWorkbenches) {
@@ -97,12 +150,11 @@ class WorkspaceAuthority {
         const directory = path.join(config.root, "state", id);
         await noSymlinkAncestors(directory);
         const b = ApprovedWorkbench.parse(JSON.parse((await readRegular(path.join(directory, "workbench.json"), 128 * 1024)).toString()));
-        if (b.id !== id || b.cwd !== path.join(config.root, "workbenches", id)) throw new WorkspaceError("wrong_binding", "Invalid durable dynamic workbench");
+        if (b.id !== id || b.cwd !== authority.expectedCwd(b)) throw new WorkspaceError("wrong_binding", "Invalid durable dynamic workbench");
         await noSymlinkAncestors(b.cwd);
         const state = JSON.parse((await readRegular(path.join(directory, "state.json"), 1024 * 1024)).toString());
         if (typeof state.initialized !== "boolean" || !state.runs || !(state.head === null || GitOid.safeParse(state.head).success)) throw new WorkspaceError("invalid_state", "Invalid dynamic workspace state");
-        const repo = path.join(directory, "repo");
-        await ensureAuthorityGitRepositoryLayout(repo);
+        const repo = await authority.ensureRepository(b, directory);
         authority.benches.set(id, { config: b, state, directory, repo });
       }
     }
@@ -115,7 +167,7 @@ class WorkspaceAuthority {
     const approved = fixed ?? await this.options.resolveWorkbench?.(identity);
     if (!approved) throw new WorkspaceError("forbidden", "No approved workbench for authenticated user/session");
     const config = ApprovedWorkbench.parse(approved);
-    if (config.userId !== identity.userId || config.sessionId !== identity.sessionId || config.cwd !== path.join(this.config.root, "workbenches", config.id))
+    if (config.userId !== identity.userId || config.cwd !== this.expectedCwd(config))
       throw new WorkspaceError("unsafe_root", "Catalog returned an invalid workspace identity");
     if (config.sharedSessionId) {
       const parent = await this.bench({ userId: identity.userId, sessionId: config.sharedSessionId }, /* @__PURE__ */ new Set([...visited, identity.sessionId]));
@@ -124,9 +176,11 @@ class WorkspaceAuthority {
     }
     const existing = this.benches.get(config.id);
     if (existing) {
-      if (canonicalJson(existing.config) !== canonicalJson(config)) throw new WorkspaceError("wrong_binding", "Workbench identity is immutable");
+      if (canonicalJson(this.stableBinding(existing.config)) !== canonicalJson(this.stableBinding(config)))
+        throw new WorkspaceError("wrong_binding", "Workbench identity is immutable");
       return existing;
     }
+    this.assertNonOverlappingCheckout(config);
     let task = this.registrations.get(config.id);
     if (!task) {
       task = (async () => {
@@ -138,20 +192,20 @@ class WorkspaceAuthority {
           throw error;
         });
         if (stored) {
-          if (canonicalJson(JSON.parse(stored)) !== canonicalJson(config)) throw new WorkspaceError("wrong_binding", "Persisted workbench identity changed");
+          const persisted = ApprovedWorkbench.parse(JSON.parse(stored));
+          if (canonicalJson(this.stableBinding(persisted)) !== canonicalJson(this.stableBinding(config)))
+            throw new WorkspaceError("wrong_binding", "Persisted workbench identity changed");
         } else {
           await fs.mkdir(directory, { mode: 448 });
           await durableJson(manifest, config);
-          await fs.mkdir(config.cwd, { mode: 448 });
-          await fs.mkdir(path.join(directory, "repo"), { mode: 448 });
-          await git(path.join(directory, "repo"), ["init", "--bare", "--template=", "."]);
-          await durableJson(path.join(directory, "state.json"), { initialized: false, head: null, blocked: null, runs: {} });
+          await fs.mkdir(config.cwd, { recursive: true, mode: 448 });
+          await this.ensureRepository(config, directory);
+          await durableJson(path.join(directory, "state.json"), { initialized: config.rootProfile === "account", head: null, blocked: null, runs: {} });
         }
         await noSymlinkAncestors(config.cwd);
         const state = JSON.parse((await readRegular(path.join(directory, "state.json"), 1024 * 1024)).toString());
         if (typeof state.initialized !== "boolean" || !state.runs || !(state.head === null || GitOid.safeParse(state.head).success)) throw new WorkspaceError("invalid_state", "Invalid workspace state");
-        const repo = path.join(directory, "repo");
-        await ensureAuthorityGitRepositoryLayout(repo);
+        const repo = await this.ensureRepository(config, directory);
         const bench = { config, state, directory, repo };
         this.benches.set(config.id, bench);
         return bench;
@@ -165,6 +219,7 @@ class WorkspaceAuthority {
   hydrations = /* @__PURE__ */ new Map();
   async ensureHydrated(identity) {
     const b = await this.bench(identity);
+    if (b.config.rootProfile === "account") return;
     if (b.state.initialized) return;
     let task = this.hydrations.get(b.config.id);
     if (!task) {
@@ -186,7 +241,7 @@ class WorkspaceAuthority {
     return { path: file, content: bytes.toString("utf8"), bytes: bytes.length };
   }
   async processes(identity) {
-    const b = await this.bench(identity), route = await this.route(b);
+    const b = await this.bench(identity), route = await this.route(b, identity);
     const result = [];
     for (const [operationId, metadata] of Object.entries(b.state.runs)) {
       if (metadata.state === "rejected_capacity" || (metadata.sessionId ?? b.config.sessionId) !== identity.sessionId) continue;
@@ -214,18 +269,22 @@ class WorkspaceAuthority {
   /** Bounded file browsing through the same catalog-authorized workbench as tools. */
   async inspectFiles(identity, command) {
     const b = await this.bench(identity);
-    const relative = command.path.replace(/^\/+/, "").replace(/\/+$/, "");
-    if (relative) safeTreePath(relative);
-    if (!relative && command.method === "raw") throw new WorkspaceError("unsafe_path", "A file path is required");
-    const target = path.join(b.config.cwd, relative);
-    await noSymlinkAncestors(target).catch((error) => {
+    const relative = command.hostPath ? "" : command.path.replace(/^\/+/, "").replace(/\/+$/, "");
+    if (!command.hostPath && relative) safeTreePath(relative);
+    if (!command.hostPath && !relative && command.method === "raw") throw new WorkspaceError("unsafe_path", "A file path is required");
+    const target = command.hostPath ? this.resolveHostPath(command.path) : path.join(b.config.cwd, relative);
+    const display = command.hostPath ? target : `/${relative}`;
+    const inspect = command.hostPath ? fs.lstat(target).then((stat2) => {
+      if (stat2.isSymbolicLink()) throw new WorkspaceError("unsafe_path", "Final symlink paths are not inspected");
+    }) : noSymlinkAncestors(target);
+    await inspect.catch((error) => {
       if (error.code === "ENOENT" || error.code === "ENOTDIR") throw new WorkspaceError("not_found", "File or directory not found");
       throw error;
     });
     const stat = await fs.stat(target);
     if (command.method === "raw") {
-      const bytes = await readRegular(target, 8 * 1024 * 1024);
-      return { path: `/${relative}`, base64: bytes.toString("base64"), size: bytes.length, modifiedAt: stat.mtime.toISOString() };
+      const bytes = await (command.hostPath ? readHostRegular : readRegular)(target, 8 * 1024 * 1024);
+      return { path: display, base64: bytes.toString("base64"), size: bytes.length, modifiedAt: stat.mtime.toISOString() };
     }
     if (!stat.isDirectory()) throw new WorkspaceError("not_found", "Directory not found");
     const names = await fs.readdir(target, { withFileTypes: true });
@@ -234,13 +293,13 @@ class WorkspaceAuthority {
       const nested = await fs.stat(path.join(target, entry.name));
       return {
         name: entry.name,
-        path: `/${path.posix.join(relative, entry.name)}`,
+        path: command.hostPath ? path.join(target, entry.name) : `/${path.posix.join(relative, entry.name)}`,
         type: entry.isDirectory() ? "directory" : "file",
         size: entry.isDirectory() ? null : nested.size,
         modifiedAt: nested.mtime.toISOString()
       };
     }));
-    return { directory: `/${relative}`, entries };
+    return { directory: display, entries };
   }
   async inspectGit(identity, command) {
     const b = await this.bench(identity);
@@ -299,15 +358,16 @@ class WorkspaceAuthority {
     if (this.closing && !admitted) return Promise.reject(new WorkspaceError("authority_closed", "Workspace authority is closing"));
     if (this.pending >= 32) return Promise.reject(new WorkspaceError("busy", "Workspace request budget reached"));
     this.pending++;
-    const task = (this.queues.get(b.config.id) ?? Promise.resolve()).catch(() => {
+    const queueKey = this.linkedWorkbench(b) ? b.repo : b.config.id;
+    const task = (this.queues.get(queueKey) ?? Promise.resolve()).catch(() => {
     }).then(async () => {
       await this.owned(admitted);
       return fn();
     });
-    this.queues.set(b.config.id, task);
+    this.queues.set(queueKey, task);
     void task.finally(() => {
       this.pending--;
-      if (this.queues.get(b.config.id) === task) this.queues.delete(b.config.id);
+      if (this.queues.get(queueKey) === task) this.queues.delete(queueKey);
     }).catch(() => {
     });
     return task;
@@ -318,8 +378,8 @@ class WorkspaceAuthority {
       throw new WorkspaceError("wrong_installation", "Executor route is for another installation");
     return route;
   }
-  async storage(b) {
-    const storage = await this.options.storage(b.config);
+  async storage(b, identity) {
+    const storage = await this.options.storage(identity);
     if (storage.installationId !== this.config.installationId)
       throw new WorkspaceError("wrong_installation", "Storage client is for another installation");
     return storage;
@@ -365,7 +425,7 @@ class WorkspaceAuthority {
         } catch {
         }
       }
-      return { workbench: b.config, ...structuredClone(b.state), files };
+      return { workbench: { ...b.config, sessionId: identity.sessionId }, ...structuredClone(b.state), files };
     });
   }
   async cleanRefreshBase(b, expectedBase) {
@@ -374,6 +434,12 @@ class WorkspaceAuthority {
     const expectedTree = (await git(b.repo, ["rev-parse", `${expectedBase}^{tree}`])).toString().trim();
     if (await snapshotTree(b.repo, b.config.cwd, expectedBase) !== expectedTree)
       throw new WorkspaceError("dirty_workbench", "Source differs from its canonical base; preserve and publish or reconcile edits first");
+    if (this.linkedWorkbench(b)) {
+      const localHead2 = (await git(b.config.cwd, ["rev-parse", "HEAD"])).toString().trim();
+      if (localHead2 !== expectedBase || (await git(b.config.cwd, ["write-tree"])).toString().trim() !== expectedTree)
+        throw new WorkspaceError("dirty_workbench", "Local branch or index changed; preserve and reconcile it before refreshing");
+      return;
+    }
     const metadata = path.join(b.config.cwd, ".git");
     const ref = `refs/heads/${b.config.branch}`;
     const indexBytes = await readRegular(path.join(metadata, "index"), 8 * 1024 * 1024);
@@ -392,15 +458,16 @@ class WorkspaceAuthority {
    * idle workbench refresh; all replaced source/index/ref bytes are retained. */
   async hydrate(identity, expectedBase) {
     const b = await this.bench(identity);
-    return this.serial(b, () => this.hydrateIdle(b, expectedBase));
+    if (b.config.rootProfile === "account") return { head: "", unchanged: true };
+    return this.serial(b, () => this.hydrateIdle(b, identity, expectedBase));
   }
-  async hydrateIdle(b, expectedBase) {
+  async hydrateIdle(b, identity, expectedBase) {
     if (b.state.blocked?.code === "account_initialization_unknown") {
       await this.idle(b, true);
       await this.assertFreshAccountWorkbench(b, expectedBase);
       const operationId = `account-initialize-${sha256(b.config.userId)}`;
       if (b.state.blocked.operationId !== operationId) throw new WorkspaceError("wrong_binding", "Account initialization receipt identity changed");
-      const storage2 = await this.storage(b);
+      const storage2 = await this.storage(b, identity);
       const receipt = await storage2.read({ method: "operation.get", lookupId: operationId });
       if (receipt.state !== "completed" || receipt.result?.repositoryId !== b.config.repositoryId || !GitOid.safeParse(receipt.result?.head).success)
         throw new WorkspaceError("account_initialization_unknown", "Original account initialization is not proven complete; preserve its receipt");
@@ -416,7 +483,7 @@ class WorkspaceAuthority {
         "nonempty_workbench",
         "Hydration requires initially empty approved workbench; preserve/import existing work explicitly"
       );
-    const storage = await this.storage(b);
+    const storage = await this.storage(b, identity);
     const readHead = () => storage.read({ method: "repository.get", repositoryId: b.config.repositoryId, branch: b.config.branch });
     let canonical;
     const account = b.config.repositoryId === `user-workspace-${sha256(b.config.userId).slice(0, 40)}` && b.config.branch === "main";
@@ -492,8 +559,14 @@ class WorkspaceAuthority {
     if (expectedBase === void 0) {
       if ((await fs.readdir(b.config.cwd)).length)
         throw new WorkspaceError("nonempty_workbench", "Workbench changed during hydration; no overwrite");
-      for (const name of await fs.readdir(staged)) await fs.rename(path.join(staged, name), path.join(b.config.cwd, name));
+      if (this.linkedWorkbench(b)) await fs.rm(staged, { recursive: true });
+      else for (const name of await fs.readdir(staged)) await fs.rename(path.join(staged, name), path.join(b.config.cwd, name));
       await this.installGitPolicy(b, head);
+    } else if (this.linkedWorkbench(b)) {
+      await this.cleanRefreshBase(b, expectedBase);
+      await git(b.repo, ["update-ref", `refs/heads/${b.config.branch}`, head, expectedBase]);
+      await git(b.config.cwd, ["reset", "--hard", head]);
+      await fs.rm(staged, { recursive: true });
     } else {
       await this.cleanRefreshBase(b, expectedBase);
       const original = await selectedTree(b.repo, expectedBase);
@@ -664,7 +737,7 @@ class WorkspaceAuthority {
       sourceBytes(Buffer.from(readme));
       if (b.state.initialized || (await fs.readdir(b.config.cwd)).length)
         throw new WorkspaceError("nonempty_workbench", "Seed only an initially empty approved workbench");
-      const storage = await this.storage(b);
+      const storage = await this.storage(b, identity);
       const operationId = `ws-${randomUUID()}`;
       b.state.blocked = {
         code: "seed_unknown",
@@ -684,13 +757,34 @@ class WorkspaceAuthority {
       b.state.initialized = true;
       b.state.blocked = null;
       await this.save(b);
-      const result = await this.publishIdle(b);
+      const result = await this.publishIdle(b, identity);
+      if (this.linkedWorkbench(b)) {
+        await fs.unlink(path.join(b.config.cwd, ".gitignore"));
+        await fs.unlink(path.join(b.config.cwd, "README.md"));
+      }
       await this.installGitPolicy(b, result.head);
       return result;
     });
   }
   async installGitPolicy(b, head) {
     delete b.state.publishedMetadata;
+    if (this.linkedWorkbench(b)) {
+      const destination2 = path.join(b.config.cwd, ".git");
+      const exists = await fs.lstat(destination2).then(() => true, (error) => {
+        if (error.code === "ENOENT") return false;
+        throw error;
+      });
+      await git(b.repo, ["update-ref", `refs/heads/${b.config.branch}`, head]);
+      if (!exists) {
+        if ((await fs.readdir(b.config.cwd)).length) throw new WorkspaceError("nonempty_workbench", "Linked worktree destination must be empty");
+        await git(b.repo, ["worktree", "add", "--force", b.config.cwd, b.config.branch]);
+      }
+      const remote2 = `r5d-canonical://${this.config.installationId}/${b.config.userId}/${b.config.repositoryId}`;
+      await git(b.repo, ["config", "remote.canonical.url", remote2]);
+      await git(b.repo, ["config", "remote.canonical.pushurl", remote2]);
+      await git(b.repo, ["config", "protocol.allow", "never"]);
+      return;
+    }
     const destination = path.join(b.config.cwd, ".git");
     await git(b.repo, ["read-tree", head]);
     await fs.mkdir(destination, { mode: 448 });
@@ -742,22 +836,23 @@ class WorkspaceAuthority {
     const input = WorkspaceFileWrite.parse(raw), bytes = Buffer.from(input.base64, "base64");
     if (bytes.toString("base64") !== input.base64 || bytes.length > 768 * 1024)
       throw new WorkspaceError("invalid_input", "Expected canonical base64 for at most 768 KiB", true);
-    const b = await this.bench(identity), target = path.join(b.config.cwd, input.path);
+    const b = await this.bench(identity), target = input.hostPath ? this.resolveHostPath(input.path) : path.join(b.config.cwd, input.path);
     const fingerprint = { ...input, userId: identity.userId, sessionId: identity.sessionId };
     let mode = 420;
     const check = async () => {
-      await this.idle(b);
+      if (b.state.blocked) throw new WorkspaceError(b.state.blocked.code, b.state.blocked.message);
       if (!b.state.initialized) throw new WorkspaceError("uninitialized", "Hydrate this workspace before writing files");
-      let current = b.config.cwd;
-      for (const part of input.path.split("/").slice(0, -1)) {
+      let current = input.hostPath ? path.parse(target).root : b.config.cwd;
+      const parentParts = (input.hostPath ? target.slice(current.length) : input.path).split(path.sep).filter(Boolean).slice(0, -1);
+      for (const part of parentParts) {
         current = path.join(current, part);
-        const stat = await fs.lstat(current).catch((error) => {
+        const stat = await (input.hostPath ? fs.stat(current) : fs.lstat(current)).catch((error) => {
           if (error.code === "ENOENT") return null;
           throw error;
         });
-        if (stat && (!stat.isDirectory() || stat.isSymbolicLink())) throw new WorkspaceError("unsafe_path", "File parent is not a real directory");
+        if (stat && (!stat.isDirectory() || !input.hostPath && stat.isSymbolicLink())) throw new WorkspaceError("unsafe_path", "File parent is not a directory");
       }
-      const previous = await readRegular(target, 8 * 1024 * 1024).catch((error) => {
+      const previous = await (input.hostPath ? readHostRegular : readRegular)(target, 8 * 1024 * 1024).catch((error) => {
         if (error.code === "ENOENT") return null;
         throw error;
       });
@@ -770,7 +865,7 @@ class WorkspaceAuthority {
         b.state.blocked = { code: "file_write_unknown", operationId: input.id, message: "Inspect the original file write receipt before changing this workbench" };
         await this.save(b);
         await fs.mkdir(path.dirname(target), { recursive: true, mode: 493 });
-        await noSymlinkAncestors(path.dirname(target));
+        if (!input.hostPath) await noSymlinkAncestors(path.dirname(target));
         const temporary = path.join(path.dirname(target), `.r5d-file-${randomUUID()}`);
         const file = await fs.open(temporary, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | constants.O_NOFOLLOW, mode);
         try {
@@ -779,7 +874,7 @@ class WorkspaceAuthority {
         } finally {
           await file.close();
         }
-        const current = await readRegular(target, 8 * 1024 * 1024).catch((error) => {
+        const current = await (input.hostPath ? readHostRegular : readRegular)(target, 8 * 1024 * 1024).catch((error) => {
           if (error.code === "ENOENT") return null;
           throw error;
         });
@@ -851,7 +946,7 @@ class WorkspaceAuthority {
     return this.serial(b, () => this.productAction(b, input.id, { method: "import", url: input.url, branch: input.defaultBranch }, async () => {
       await git(b.repo, ["-c", "protocol.https.allow=always", "fetch", "--no-tags", "--no-recurse-submodules", "--", input.url, `refs/heads/${input.defaultBranch}`], void 0, void 0, { token: input.token });
       const head = GitOid.parse((await git(b.repo, ["rev-parse", "FETCH_HEAD"])).toString().trim());
-      return this.importCommit(b, head, input.id);
+      return this.importCommit(b, head, input.id, identity);
     }, async () => {
       await this.idle(b);
       if (b.state.initialized || (await fs.readdir(b.config.cwd)).length) throw new WorkspaceError("nonempty_workbench", "Import requires a new empty workbench");
@@ -893,13 +988,13 @@ class WorkspaceAuthority {
       const file = path.join(target.directory, `clone-${randomUUID()}.bundle`);
       await fs.writeFile(file, prepared.bytes, { mode: 384, flag: "wx" });
       await git(target.repo, ["bundle", "unbundle", file]);
-      return this.importCommit(target, prepared.head, input.id);
+      return this.importCommit(target, prepared.head, input.id, identity);
     }, async () => {
       await this.idle(target);
       if (target.state.initialized || (await fs.readdir(target.config.cwd)).length) throw new WorkspaceError("nonempty_workbench", "Branch already has a workbench");
     }));
   }
-  async importCommit(b, head, id) {
+  async importCommit(b, head, id, identity) {
     const entries = await selectedTree(b.repo, head);
     const staged = path.join(b.directory, `import-${randomUUID()}`);
     await fs.mkdir(staged, { mode: 448 });
@@ -927,7 +1022,7 @@ ${DEFAULT_WORKSPACE_IGNORE}`, { mode: 384 });
     }
     const tree = await snapshotTree(b.repo, staged, head);
     if (tree !== (await git(b.repo, ["rev-parse", `${head}^{tree}`])).toString().trim()) head = (await git(b.repo, ["commit-tree", tree, "-p", head], "Configure workspace exclusions\n")).toString().trim();
-    const storage = await this.storage(b), operationId = `product-${sha256(id).slice(0, 48)}`;
+    const storage = await this.storage(b, identity), operationId = `product-${sha256(id).slice(0, 48)}`;
     let existing;
     try {
       existing = await storage.read({ method: "repository.get", repositoryId: b.config.repositoryId, branch: b.config.branch });
@@ -949,7 +1044,8 @@ ${DEFAULT_WORKSPACE_IGNORE}`, { mode: 384 });
     }
     const result = await storage.mutate({ method: "repository.publish", operationId, repositoryId: b.config.repositoryId, branch: b.config.branch, expectedHead: null, commit: head, bundleId: blobId });
     if (result.head !== head) throw new WorkspaceError("invalid_receipt", "Import receipt does not match selected commit");
-    for (const name of await fs.readdir(staged)) await fs.rename(path.join(staged, name), path.join(b.config.cwd, name));
+    if (this.linkedWorkbench(b)) await fs.rm(staged, { recursive: true });
+    else for (const name of await fs.readdir(staged)) await fs.rename(path.join(staged, name), path.join(b.config.cwd, name));
     await this.installGitPolicy(b, head);
     b.state.initialized = true;
     b.state.head = head;
@@ -961,7 +1057,11 @@ ${DEFAULT_WORKSPACE_IGNORE}`, { mode: 384 });
     const b = await this.bench(identity);
     if (!input.message.trim() || input.message.length > 1e4) throw new WorkspaceError("invalid_input", "Commit message is required");
     return this.serial(b, () => this.productAction(b, input.id, { method: "commit", expectedHead: input.expectedHead, message: input.message }, async () => {
-      const result = await this.publishIdle(b, input.message);
+      const result = await this.publishIdle(b, identity, input.message);
+      if (this.linkedWorkbench(b)) {
+        await git(b.config.cwd, ["reset", "--mixed", result.head]);
+        return { ...result, treeHash: (await git(b.repo, ["rev-parse", `${result.head}^{tree}`])).toString().trim() };
+      }
       const metadata = path.join(b.config.cwd, ".git");
       await noSymlinkAncestors(metadata);
       const retained = path.join(b.directory, `commit-retained-${randomUUID()}`);
@@ -992,9 +1092,16 @@ ${DEFAULT_WORKSPACE_IGNORE}`, { mode: 384 });
   async archiveBranch(identity, input) {
     const b = await this.bench(identity);
     return this.serial(b, () => this.productAction(b, input.id, { method: "archive" }, async () => {
-      const storage = await this.storage(b);
+      const storage = await this.storage(b, identity);
       const current = await storage.read({ method: "repository.get", repositoryId: b.config.repositoryId, branch: b.config.branch });
       const result = await storage.mutate({ method: "repository.archive", operationId: `archive-${sha256(input.id).slice(0, 48)}`, repositoryId: b.config.repositoryId, branch: b.config.branch, expectedHead: current.head });
+      if (this.linkedWorkbench(b)) {
+        const retained = path.join(b.directory, `archive-retained-${randomUUID()}`, "source");
+        await fs.mkdir(path.dirname(retained), { recursive: true, mode: 448 });
+        await fs.cp(b.config.cwd, retained, { recursive: true, filter: (source) => path.basename(source) !== ".git" });
+        await git(b.repo, ["worktree", "remove", "--force", b.config.cwd]);
+        await git(b.repo, ["branch", "-D", b.config.branch]);
+      }
       b.state.blocked = { code: "archived", message: "This branch incarnation is archived; its workbench and source are retained" };
       await this.save(b);
       return { removed: true, receipt: result };
@@ -1007,7 +1114,7 @@ ${DEFAULT_WORKSPACE_IGNORE}`, { mode: 384 });
       await this.idle(b, true);
       if (input.expectedHead !== void 0 && input.expectedHead !== b.state.head) throw new WorkspaceError("conflict", "Workbench base changed before reset");
       if (b.state.blocked?.code === "archived") throw new WorkspaceError("archived", "A deleted branch cannot be reset");
-      const storage = await this.storage(b);
+      const storage = await this.storage(b, identity);
       if (b.state.blocked?.operationId) {
         const receipt = await storage.read({ method: "operation.get", lookupId: b.state.blocked.operationId });
         if (receipt.state !== "completed" || b.state.blocked.commit && receipt.result?.head !== b.state.blocked.commit) throw new WorkspaceError("publication_unknown", "Reconcile the original publication before resetting");
@@ -1020,18 +1127,23 @@ ${DEFAULT_WORKSPACE_IGNORE}`, { mode: 384 });
       b.state.blocked = { code: "reset_incomplete", message: "Reset source retained; complete hydration after inspection" };
       await this.save(b);
       await noSymlinkAncestors(b.config.cwd);
-      await fs.rename(b.config.cwd, path.join(retained, "source"));
+      if (this.linkedWorkbench(b)) {
+        await fs.cp(b.config.cwd, path.join(retained, "source"), { recursive: true, filter: (source) => path.basename(source) !== ".git" });
+        await git(b.repo, ["worktree", "remove", "--force", b.config.cwd]);
+        await git(b.repo, ["branch", "-D", b.config.branch]);
+      } else await fs.rename(b.config.cwd, path.join(retained, "source"));
       await fs.mkdir(b.config.cwd, { mode: 448 });
       b.state.initialized = false;
       b.state.head = null;
       b.state.blocked = null;
       await this.save(b);
-      const result = await this.hydrateIdle(b);
+      const result = await this.hydrateIdle(b, identity);
       return { ...result, reset: true, retained: true };
     }));
   }
   async publish(identity) {
     const b = await this.bench(identity);
+    if (b.config.rootProfile === "account") return { head: "", unchanged: true };
     return this.serial(b, async () => {
       try {
         await this.idle(b);
@@ -1039,12 +1151,12 @@ ${DEFAULT_WORKSPACE_IGNORE}`, { mode: 384 });
         if (!(error instanceof WorkspaceError) || error.code !== "workbench_busy") throw error;
         throw new WorkspacePublicationNotAdmitted("workbench_busy", error.message);
       }
-      return this.publishIdle(b);
+      return this.publishIdle(b, identity);
     });
   }
-  async publishIdle(b, message = "Destination workspace snapshot") {
+  async publishIdle(b, identity, message = "Destination workspace snapshot") {
     if (!b.state.initialized) throw new WorkspaceError("not_initialized", "Hydrate or explicitly seed first");
-    const storage = await this.storage(b);
+    const storage = await this.storage(b, identity);
     const latest = await storage.read({
       method: "repository.get",
       repositoryId: b.config.repositoryId,
@@ -1069,6 +1181,10 @@ ${DEFAULT_WORKSPACE_IGNORE}`, { mode: 384 });
     const bytes = await readRegular(bundleFile, STORAGE_LIMITS.blobBytes);
     const operationId = `ws-${randomUUID()}`, blobId = `ws-${randomUUID()}`;
     try {
+      if (this.linkedWorkbench(b)) {
+        delete b.state.publishedMetadata;
+        throw new Error("linked_worktree_metadata_is_owned_by_git");
+      }
       const metadata = path.join(b.config.cwd, ".git"), ref = `refs/heads/${b.config.branch}`;
       const localHead = (await readRegular(path.join(metadata, ref), 1024)).toString().trim();
       const index = await readRegular(path.join(metadata, "index"), 8 * 1024 * 1024);
@@ -1115,6 +1231,10 @@ ${DEFAULT_WORKSPACE_IGNORE}`, { mode: 384 });
     });
     if (result.head !== commit)
       throw new WorkspaceError("invalid_response", "Publication receipt head mismatch; inspect original operation");
+    if (this.linkedWorkbench(b) && await fs.lstat(path.join(b.config.cwd, ".git")).then(() => true, (error) => {
+      if (error.code === "ENOENT") return false;
+      throw error;
+    })) await git(b.config.cwd, ["reset", "--mixed", commit]);
     b.state.head = commit;
     b.state.blocked = null;
     await this.save(b);
@@ -1127,7 +1247,7 @@ ${DEFAULT_WORKSPACE_IGNORE}`, { mode: 384 });
       const blocked = b.state.blocked;
       if (blocked?.code !== "publication_unknown" || !blocked.operationId || !blocked.commit)
         throw new WorkspaceError("not_reconcilable", "Only a verified completed publication receipt can resolve automatically");
-      const storage = await this.storage(b);
+      const storage = await this.storage(b, identity);
       const receipt = await storage.read({
         method: "operation.get",
         lookupId: blocked.operationId
@@ -1172,7 +1292,7 @@ ${DEFAULT_WORKSPACE_IGNORE}`, { mode: 384 });
   }
   async materializeArtifact(identity, input) {
     const b = await this.bench(identity);
-    return this.serial(b, () => new SessionArtifactStore(this.config.root).materialize(identity, input));
+    return this.serial(b, () => new SessionArtifactStore(this.config.workspaceRoot ?? this.config.root).materialize(identity, input));
   }
   /** Default arbitrary shell is mutating. Exact trusted config approval is the sole exemption. */
   async start(identity, input) {
@@ -1187,7 +1307,7 @@ ${DEFAULT_WORKSPACE_IGNORE}`, { mode: 384 });
       if (RESERVED_ARTIFACT_ENV.some((name) => name in payload.env)) throw new WorkspaceError("reserved_environment", "R5D_ROOT and R5D_SESSION_ID are set by the workspace authority");
       const requestedEnv = payload.env, prior = b.state.runs[operation.operationId];
       if (!prior || prior.artifactEnvironment) {
-        payload.env = { ...payload.env, ...await new SessionArtifactStore(this.config.root).environment(identity) };
+        payload.env = { ...payload.env, ...await new SessionArtifactStore(this.config.workspaceRoot ?? this.config.root).environment(identity) };
         operation.payload = payload;
       }
       if (payload.cwd !== b.config.cwd) throw new WorkspaceError("forbidden_cwd", "Shell cwd must be exact approved workbench");
@@ -1211,18 +1331,6 @@ ${DEFAULT_WORKSPACE_IGNORE}`, { mode: 384 });
         await this.save(b);
         return receipt;
       }
-      try {
-        await this.idle(b);
-      } catch (error) {
-        if (!(error instanceof WorkspaceError) || error.code !== "workbench_busy") throw error;
-        b.state.runs[operation.operationId] = { artifactEnvironment: true, sessionId: identity.sessionId, payloadHash: hash, mutating: false, state: "rejected_capacity" };
-        await this.save(b);
-        throw new ExecutorError(
-          "capacity_busy",
-          "Workspace is busy; poll the original command until terminal before choosing new work",
-          true
-        );
-      }
       const nonmutating = Object.keys(requestedEnv).length === 0 && payload.credentials.length === 0 && b.config.nonmutatingArgv.some((argv) => canonicalJson(argv) === canonicalJson(payload.argv));
       b.state.runs[operation.operationId] = { artifactEnvironment: true, sessionId: identity.sessionId, payloadHash: hash, mutating: !nonmutating, state: "unknown", argv: payload.argv, cwd: payload.cwd, startedAt: (/* @__PURE__ */ new Date()).toISOString(), updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
       await this.save(b);

package/dist/mjs/runtime/workspace/contracts.mjs

@@ -10,6 +10,9 @@ const ApprovedWorkbench = z.object({
   repositoryId: StorageId,
   branch: BranchName,
   cwd: z.string().refine(path.isAbsolute),
+  rootProfile: z.enum(["account", "project"]).default("project"),
+  namespace: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/).optional(),
+  projectName: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/).optional(),
   // Supervisor-owned exact argv approvals, NOT an agent-supplied read-only flag.
   // Approved servers must keep generated/cache files ignored and never write source.
   nonmutatingArgv: z.array(z.array(z.string()).min(1)).max(20).default([])
@@ -17,6 +20,7 @@ const ApprovedWorkbench = z.object({
 const WorkspaceConfig = z.object({
   installationId: RuntimeId,
   root: z.string().refine(path.isAbsolute),
+  workspaceRoot: z.string().refine(path.isAbsolute).optional(),
   workbenches: z.array(ApprovedWorkbench).max(100),
   dynamicWorkbenches: z.boolean().optional()
 }).strict();

package/dist/mjs/runtime/workspace/file-write.mjs

@@ -1,21 +1,27 @@
 import { z } from "zod";
 import { RuntimeId } from "@ricsam/r5d-api/runtime-protocol";
 import { safeTreePath } from "./storage-wire.mjs";
+import path from "node:path";
 const WorkspaceFileWrite = z.object({
   method: z.literal("fileWrite"),
   id: RuntimeId,
-  path: z.string().min(1).max(4096).refine((value) => {
-    try {
-      safeTreePath(value);
-      return true;
-    } catch {
-      return false;
-    }
-  }),
+  path: z.string().min(1).max(4096),
+  hostPath: z.boolean().optional(),
   expectedSha256: z.string().regex(/^[a-f0-9]{64}$/).nullable(),
   intentHash: z.string().regex(/^[a-f0-9]{64}$/).optional(),
   base64: z.string().max(1048576)
-}).strict();
+}).strict().superRefine((value, ctx) => {
+  if (value.hostPath) {
+    if (!path.isAbsolute(value.path) && !value.path.startsWith("~/") || value.path.includes("\0"))
+      ctx.addIssue({ code: "custom", path: ["path"], message: "Host paths must be absolute or home-relative" });
+    return;
+  }
+  try {
+    safeTreePath(value.path);
+  } catch {
+    ctx.addIssue({ code: "custom", path: ["path"], message: "Workspace paths must be safe and relative" });
+  }
+});
 const WorkspaceFileWriteLookup = z.object({ method: z.literal("fileWriteResult"), id: RuntimeId }).strict();
 export {
   WorkspaceFileWrite,

package/dist/mjs/runtime/workspace/files.mjs

@@ -23,6 +23,12 @@ async function noSymlinkAncestors(file) {
 }
 async function readRegular(file, limit = 32 * 1024 * 1024) {
   await noSymlinkAncestors(file);
+  return readRegularFile(file, limit);
+}
+async function readHostRegular(file, limit = 32 * 1024 * 1024) {
+  return readRegularFile(file, limit);
+}
+async function readRegularFile(file, limit) {
   const handle = await fs.open(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
   try {
     const st = await handle.stat();
@@ -263,9 +269,19 @@ async function snapshotTree(repo, cwd, canonicalHead) {
     }
   )) {
     await noSymlinkAncestors(metadata);
-    if (!(await fs.lstat(metadata)).isDirectory()) throw new WorkspaceError("unsafe_git", "External worktree metadata unsupported");
+    const metadataStat = await fs.lstat(metadata);
+    let gitDirectory = metadata;
+    if (metadataStat.isFile()) {
+      const marker = (await readRegular(metadata, 4096)).toString("utf8").trim();
+      const match = /^gitdir: (.+)$/.exec(marker);
+      if (!match || !path.isAbsolute(match[1])) throw new WorkspaceError("unsafe_git", "Invalid linked worktree metadata");
+      gitDirectory = path.normalize(match[1]);
+      const worktrees = path.join(repo, "worktrees") + path.sep;
+      if (!gitDirectory.startsWith(worktrees)) throw new WorkspaceError("unsafe_git", "Linked worktree belongs to another repository");
+      await noSymlinkAncestors(gitDirectory);
+    } else if (!metadataStat.isDirectory()) throw new WorkspaceError("unsafe_git", "Invalid worktree metadata");
     for (const name of ["MERGE_HEAD", "CHERRY_PICK_HEAD", "REVERT_HEAD", "REBASE_HEAD", "rebase-merge", "rebase-apply", "index.lock"]) {
-      if (await fs.lstat(path.join(metadata, name)).then(
+      if (await fs.lstat(path.join(gitDirectory, name)).then(
         () => true,
         (e) => {
           if (e.code === "ENOENT") return false;
@@ -277,7 +293,7 @@ async function snapshotTree(repo, cwd, canonicalHead) {
           "Git merge/rebase/index operation remains in progress; preserve and resolve it before publication"
         );
     }
-    const index = path.join(metadata, "index");
+    const index = path.join(gitDirectory, "index");
     if (await fs.lstat(index).then(
       () => true,
       (e) => {
@@ -326,6 +342,7 @@ export {
   git,
   noSymlinkAncestors,
   privateRoot,
+  readHostRegular,
   readRegular,
   selectedTree,
   sha256,

package/dist/types/personal/action-scheduler.d.ts

@@ -7,6 +7,8 @@ export type PersonalQueuedAction = {
         command?: {
             method?: string;
             streamId?: string;
+            operationId?: string;
+            runId?: string;
         };
     };
 };

package/dist/types/personal/runtime.d.ts

@@ -46,21 +46,36 @@ export declare const PersonalWorkspaceRequest: z.ZodObject<{
         repositoryId: z.ZodString;
         branch: z.ZodString;
         sessionId: z.ZodString;
-        sharedSessionId: z.ZodOptional<z.ZodString>;
+        rootProfile: z.ZodDefault<z.ZodEnum<{
+            account: "account";
+            project: "project";
+        }>>;
+        namespace: z.ZodOptional<z.ZodString>;
+        projectName: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>;
     sourceWorkbench: z.ZodOptional<z.ZodObject<{
         id: z.ZodString;
         repositoryId: z.ZodString;
         branch: z.ZodString;
         sessionId: z.ZodString;
-        sharedSessionId: z.ZodOptional<z.ZodString>;
+        rootProfile: z.ZodDefault<z.ZodEnum<{
+            account: "account";
+            project: "project";
+        }>>;
+        namespace: z.ZodOptional<z.ZodString>;
+        projectName: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
     sharedWorkbenches: z.ZodOptional<z.ZodArray<z.ZodObject<{
         id: z.ZodString;
         repositoryId: z.ZodString;
         branch: z.ZodString;
         sessionId: z.ZodString;
-        sharedSessionId: z.ZodOptional<z.ZodString>;
+        rootProfile: z.ZodDefault<z.ZodEnum<{
+            account: "account";
+            project: "project";
+        }>>;
+        namespace: z.ZodOptional<z.ZodString>;
+        projectName: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>>;
     kind: z.ZodEnum<{
         inspect: "inspect";

package/dist/types/runtime/workspace/artifacts.d.ts

@@ -14,8 +14,8 @@ export type SessionArtifactChunk = z.infer<typeof SessionArtifactChunk>;
 export declare const RESERVED_ARTIFACT_ENV: readonly ["R5D_ROOT", "R5D_SESSION_ID"];
 /** Session artifacts never join repository snapshots or another session's env. */
 export declare class SessionArtifactStore {
-    readonly authorityRoot: string;
-    constructor(authorityRoot: string);
+    readonly workspaceRoot: string;
+    constructor(workspaceRoot: string);
     environment(identity: WorkspaceIdentity): Promise<{
         R5D_ROOT: string;
         R5D_SESSION_ID: string;

package/dist/types/runtime/workspace/authority.d.ts

@@ -24,8 +24,16 @@ export declare class WorkspaceAuthority {
     private closed;
     private closeTask?;
     private readonly actions;
+    private readonly repositoryInitializations;
     private pending;
     private constructor();
+    private expectedCwd;
+    private stableBinding;
+    private repositoryPath;
+    private ensureRepository;
+    private assertNonOverlappingCheckout;
+    private linkedWorkbench;
+    private resolveHostPath;
     static open(options: WorkspaceAuthorityOptions): Promise<WorkspaceAuthority>;
     private readonly registrations;
     private bench;
@@ -68,6 +76,7 @@ export declare class WorkspaceAuthority {
     inspectFiles(identity: WorkspaceIdentity, command: {
         method: "directory" | "raw";
         path: string;
+        hostPath?: boolean;
     }): Promise<{
         path: string;
         base64: string;
@@ -198,14 +207,17 @@ export declare class WorkspaceAuthority {
             completedAt?: string;
         }>;
         workbench: {
+            sessionId: string;
             id: string;
             userId: string;
-            sessionId: string;
             repositoryId: string;
             branch: string;
             cwd: string;
+            rootProfile: "account" | "project";
             nonmutatingArgv: string[][];
             sharedSessionId?: string | undefined;
+            namespace?: string | undefined;
+            projectName?: string | undefined;
         };
     }>;
     private cleanRefreshBase;
@@ -213,6 +225,9 @@ export declare class WorkspaceAuthority {
      * idle workbench refresh; all replaced source/index/ref bytes are retained. */
     hydrate(identity: WorkspaceIdentity, expectedBase?: string): Promise<{
         head: string;
+    } | {
+        head: string;
+        unchanged: boolean;
     }>;
     private hydrateIdle;
     private assertFreshAccountWorkbench;

package/dist/types/runtime/workspace/contracts.d.ts

@@ -9,12 +9,19 @@ export declare const ApprovedWorkbench: z.ZodObject<{
     repositoryId: z.ZodString;
     branch: z.ZodString;
     cwd: z.ZodString;
+    rootProfile: z.ZodDefault<z.ZodEnum<{
+        account: "account";
+        project: "project";
+    }>>;
+    namespace: z.ZodOptional<z.ZodString>;
+    projectName: z.ZodOptional<z.ZodString>;
     nonmutatingArgv: z.ZodDefault<z.ZodArray<z.ZodArray<z.ZodString>>>;
 }, z.core.$strict>;
 export type ApprovedWorkbench = z.input<typeof ApprovedWorkbench>;
 export declare const WorkspaceConfig: z.ZodObject<{
     installationId: z.ZodString;
     root: z.ZodString;
+    workspaceRoot: z.ZodOptional<z.ZodString>;
     workbenches: z.ZodArray<z.ZodObject<{
         id: z.ZodString;
         userId: z.ZodString;
@@ -23,6 +30,12 @@ export declare const WorkspaceConfig: z.ZodObject<{
         repositoryId: z.ZodString;
         branch: z.ZodString;
         cwd: z.ZodString;
+        rootProfile: z.ZodDefault<z.ZodEnum<{
+            account: "account";
+            project: "project";
+        }>>;
+        namespace: z.ZodOptional<z.ZodString>;
+        projectName: z.ZodOptional<z.ZodString>;
         nonmutatingArgv: z.ZodDefault<z.ZodArray<z.ZodArray<z.ZodString>>>;
     }, z.core.$strict>>;
     dynamicWorkbenches: z.ZodOptional<z.ZodBoolean>;

package/dist/types/runtime/workspace/file-write.d.ts

@@ -3,6 +3,7 @@ export declare const WorkspaceFileWrite: z.ZodObject<{
     method: z.ZodLiteral<"fileWrite">;
     id: z.ZodString;
     path: z.ZodString;
+    hostPath: z.ZodOptional<z.ZodBoolean>;
     expectedSha256: z.ZodNullable<z.ZodString>;
     intentHash: z.ZodOptional<z.ZodString>;
     base64: z.ZodString;

package/dist/types/runtime/workspace/files.d.ts

@@ -2,6 +2,9 @@ export declare const sha256: (bytes: Buffer | string) => string;
 export declare function privateRoot(root: string, installationId: string): Promise<void>;
 export declare function noSymlinkAncestors(file: string): Promise<void>;
 export declare function readRegular(file: string, limit?: number): Promise<Buffer>;
+/** Host-wide tools follow ordinary directory symlinks while refusing a final
+ * symlink and retaining the same bounded, single-link regular-file contract. */
+export declare function readHostRegular(file: string, limit?: number): Promise<Buffer>;
 /** File-only migration capsules can omit Git's empty structural directories.
  * Restore only that directory skeleton after confirming the authority-owned
  * repository markers; refs, objects, indexes and configuration are untouched. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.141",
+  "version": "0.0.143",
   "type": "module",
   "main": "./dist/mjs/main.mjs",
   "module": "./dist/mjs/main.mjs",
@@ -21,8 +21,8 @@
     "r5d-worker": "dist/mjs/main.mjs"
   },
   "dependencies": {
-    "@ricsam/r5d-api": "^0.0.141",
-    "@ricsam/r5dctl": "0.0.141",
+    "@ricsam/r5d-api": "^0.0.143",
+    "@ricsam/r5dctl": "0.0.143",
     "node-pty": "1.1.0",
     "zod": "^4.1.13",
     "picomatch": "^4.0.3"