@ricsam/r5d-worker 0.0.168 → 0.0.170

package/dist/cjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.168",
+  "version": "0.0.170",
   "type": "commonjs"
 }

package/dist/mjs/internal-r5dctl.cjs

@@ -20296,7 +20296,7 @@ var SESSION_RUN_HELP_TEXT = [
   '  r5dctl -p <project> session start --worker <label> --worktree <branch> --model <tier> [-f|--follow|--watch] [--tools] [--parent-session <session-id>] "<prompt>"',
   '  r5dctl -p <project> session start --worker <label> --new-worktree <branch> --source worktree:<branch> [--working-tree carry|clean] --model <tier> [-f|--follow|--watch] [--tools] [--parent-session <session-id>] "<prompt>"',
   "  r5dctl session status <session-id>",
-  '  r5dctl session prompt --worker <label> --mode <mode> --model <tier> [--delivery queue|steer|force] [--sender <name>] <session-id> "<prompt>"',
+  '  r5dctl session prompt --worker <label> --mode <plan|agent> --model <tier> [--delivery queue|steer|force] [--sender <name>] <session-id> "<prompt>"',
   "  r5dctl session stop <session-id>",
   "  r5dctl session set-worker <session-id> --worker <label>",
   "  r5dctl session process-log <run-id> [--tail <n>] [--grep <pattern>]",
@@ -20321,7 +20321,7 @@ var SESSION_RUN_HELP_TEXT = [
   "The reserved topic `checkout` declares tracked-file writes in that checkout: claim it before running the command, hold it until the",
   "write is done, and release it. A running session native to that branch holds `checkout` implicitly, so the call names who to message.",
   "Commands started while a cross-scope `checkout` claim is held also fence the claimed checkout on the bound worker (the fence line says",
-  "whether the worker supports it). checkout path prints where a project branch is checked out on the session's bound worker.",
+  "whether the worker supports it). checkout path prints the absolute checkout path of a project branch on the session's bound worker, one bare line (use --json for the checkout and worker too).",
   "Agent shells act as their own session; user credentials select the acting session with -s or R5D_SESSION_ID.",
   "A new worktree starts with the source checkout's uncommitted changes (--working-tree carry, the default);",
   "--working-tree clean checks out the source branch's current commit only. Start and status print the mode, never a commit hash.",
@@ -20465,7 +20465,7 @@ var SHARED_HELP_ENTRIES = [
   },
   {
     section: "sessions",
-    usage: 'session prompt --worker <label> --mode <mode> --model <tier> [--delivery queue|steer|force] [--sender <name>] <session-id> "<prompt>"',
+    usage: 'session prompt --worker <label> --mode <plan|agent> --model <tier> [--delivery queue|steer|force] [--sender <name>] <session-id> "<prompt>"',
     description: "Prompt a session: steer after the next tool result (default), queue a deferred follow-up, or force in place of the current tool round. An idle unfinished session may require explicit continuation or confirmation of interrupted tools. Blocked delivery reports the saved message/queue ID and reason; inspect the existing queue in the session UI instead of sending duplicates. The recipient sees the verified sender session id; --sender only adds a display title."
   },
   {
@@ -20500,12 +20500,12 @@ var SHARED_HELP_ENTRIES = [
   },
   {
     section: "sessions",
-    usage: '-s <session-id> answer-questions --worker <label> --mode <mode> --model <tier> -a1 "<answer>" ...',
+    usage: '-s <session-id> answer-questions --worker <label> --mode <plan|agent> --model <tier> -a1 "<answer>" ...',
     description: "Answer pending questions in order."
   },
   {
     section: "sessions",
-    usage: "-s <session-id> answer-env-request --worker <label> --mode <mode> --model <tier> [-e KEY=value] [--context <text>]",
+    usage: "-s <session-id> answer-env-request --worker <label> --mode <plan|agent> --model <tier> [-e KEY=value] [--context <text>]",
     description: "Answer a pending environment variable request with values, context, or both."
   },
   {
@@ -20605,7 +20605,7 @@ function resolveEntrypointPath(entrypoint) {
   }
 }
 function getR5dctlVersion() {
-  if (true) return "0.0.168";
+  if (true) return "0.0.170";
   const entrypoint = process.argv[1] ? resolveEntrypointPath(process.argv[1]) : null;
   let current = entrypoint ? import_node_path2.default.dirname(entrypoint) : process.cwd();
   for (let index = 0; index < 12; index += 1) {
@@ -20762,7 +20762,7 @@ function requireModel(value) {
   return model;
 }
 function requireSessionMode(value) {
-  const mode = requireValue(value?.trim(), "--mode <mode> is required");
+  const mode = requireValue(value?.trim(), "--mode <plan|agent> is required");
   if (!R5DCTL_SESSION_MODES.has(mode)) {
     throw new Error("Invalid --mode. Expected one of: plan, agent");
   }
@@ -21263,9 +21263,8 @@ ${rows.join("\n")}
 `;
 }
 function renderCheckoutPath(response) {
-  return [`Checkout: ${response.projectPath}#${response.branchName}`, `Worker: ${response.worker}`, `Path: ${response.path}`, ""].join(
-    "\n"
-  );
+  return `${response.path}
+`;
 }
 function assertAuthLoginArgs(args) {
   const valueFlags = /* @__PURE__ */ new Set(["--device-name", "--worker-label"]);
@@ -21504,7 +21503,7 @@ function parseAnswerFlags(args) {
   return ordered.map(([, value]) => value);
 }
 function requireChatMode(value) {
-  const mode = requireValue(value?.trim(), "--mode <mode> is required");
+  const mode = requireValue(value?.trim(), "--mode <plan|agent> is required");
   if (!CHAT_MODES.has(mode)) throw new Error(`Invalid --mode: ${mode}`);
   return mode;
 }

package/dist/mjs/main.mjs

@@ -7,7 +7,7 @@ import { startManagerRpc } from "./runtime/releases/rpc-main.mjs";
 import { ManagerRpcConfig } from "./runtime/releases/rpc-protocol.mjs";
 const args = process.argv.slice(2);
 if (args.includes("--version")) {
-  console.log(`r5d-worker ${true ? "0.0.168" : "development"}`);
+  console.log(`r5d-worker ${true ? "0.0.170" : "development"}`);
 } else if (!args.length || args.includes("--help")) {
   console.log(
     "Usage: r5d-worker start --label <label> [--root <dir>] [--base-url <url>] [--token <worker-token>]\n       r5d-worker executor /absolute/private/config.json\n       r5d-worker manager /absolute/private/config.json\n\nRun independently supervised durable runtime services. Provision configuration with r5dinfra."
@@ -15,7 +15,7 @@ if (args.includes("--version")) {
 } else if (args[0] === "start") {
   const runtime = await startPersonalWorker(
     parsePersonalWorkerOptions(args.slice(1)),
-    true ? "0.0.168" : "development"
+    true ? "0.0.170" : "development"
   );
   console.log(`Worker connected: ${runtime.resourceId}`);
   let closing = false;

package/dist/mjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.168",
+  "version": "0.0.170",
   "type": "module"
 }

package/dist/mjs/personal/runtime.mjs

@@ -407,6 +407,8 @@ exec ${quote(executable)} ${quote(cli)} "$@"
         if (command.method === "resize") return authority.resize(identity, ref, command.id, command.cols, command.rows);
         if (command.method === "cancel" || command.method === "processCancel") return authority.cancel(identity, ref, command.id);
       }
+      if (pausedForIncident && request.remediation !== true && ["hydrate", "publish", "reconcilePublication"].includes(String(command.method)))
+        throw new WorkspaceError("remediation_paused", "This worker's workspace is under remediation; synchronization resumes when it is confirmed", true);
       if (request.kind === "product") {
         if (command.method === "fileWrite") {
           await authority.ensureHydrated(identity);

package/dist/mjs/runtime/executor.mjs

@@ -20,6 +20,7 @@ import {
 } from "./protocol.mjs";
 import { ExecutorStore, privateDirectory } from "./storage.mjs";
 import { AdapterGrantRegistry, digest } from "./releases/grants.mjs";
+import { hostEnvironment } from "./host-environment.mjs";
 const tokenHash = (token) => createHash("sha256").update(token).digest("hex");
 class HostExecutor {
   constructor(config, nativePty) {
@@ -219,7 +220,7 @@ class HostExecutor {
       const secrets = join(this.config.stateDir, "secrets", tokenHash(operation.operationId));
       try {
         privateDirectory(secrets);
-        const env = { PATH: "/usr/local/bin:/usr/bin:/bin", LANG: "C.UTF-8", HOME: cwd, ...payload.env };
+        const env = { ...hostEnvironment(), ...payload.env };
         for (const credential of credentials) {
           Object.assign(env, credential.env);
           for (const [name, content] of Object.entries(credential.files)) {

package/dist/mjs/runtime/host-environment.mjs

@@ -0,0 +1,10 @@
+function hostEnvironment() {
+  const env = {};
+  for (const [name, value] of Object.entries(process.env)) if (typeof value === "string") env[name] = value;
+  if (!env.PATH) env.PATH = "/usr/local/bin:/usr/bin:/bin";
+  if (!env.LANG && !env.LC_ALL) env.LANG = "C.UTF-8";
+  return env;
+}
+export {
+  hostEnvironment
+};

package/dist/mjs/runtime/pty.mjs

@@ -1,6 +1,7 @@
 import { spawn, spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { ExecutorError } from "./protocol.mjs";
+import { hostEnvironment } from "./host-environment.mjs";
 const nodeExecutable = typeof R5D_PACKAGED_NODE !== "undefined" && R5D_PACKAGED_NODE ? fileURLToPath(new URL("./bin/node", import.meta.url)) : Bun.which("node") ?? "node";
 function preflightNativePty() {
   if (process.platform !== "darwin") return;
@@ -19,7 +20,7 @@ class PtySession {
   ready;
   constructor(input) {
     this.child = spawn(nodeExecutable, [fileURLToPath(new URL("./pty-host.mjs", import.meta.url))], {
-      env: { PATH: "/usr/local/bin:/usr/bin:/bin", HOME: input.cwd },
+      env: hostEnvironment(),
       stdio: "pipe"
     });
     this.ready = new Promise((resolve, reject) => {

package/dist/mjs/runtime/releases/process.mjs

@@ -1,12 +1,13 @@
 import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { ExecutorError, isStartNonAdmissionCode, MAX_FRAME_BYTES } from "../protocol.mjs";
+import { hostEnvironment } from "../host-environment.mjs";
 class AdapterChild {
   constructor(runtimePath, entrypoint, configPath, home, timeoutMs = 1e4) {
     this.timeoutMs = timeoutMs;
     this.process = spawn(runtimePath, [entrypoint, configPath], {
       cwd: home,
-      env: { PATH: "/usr/local/bin:/usr/bin:/bin", HOME: home, LANG: "C.UTF-8" },
+      env: hostEnvironment(),
       stdio: "pipe"
     });
     let buffer = Buffer.alloc(0);

package/dist/mjs/runtime/workspace/authority.mjs

@@ -11,7 +11,7 @@ import {
   WorkspaceConfig,
   WorkspaceError
 } from "./contracts.mjs";
-import { OuterRepository, OuterSnapshotRefusal, OUTER_BRANCH, OUTER_CONFLICT_CODE } from "./outer.mjs";
+import { OuterRepository, OuterSnapshotRefusal, OUTER_BRANCH, OUTER_CONFLICT_CODE, OUTER_PUBLISH_ATTEMPTS } from "./outer.mjs";
 import { SessionArtifactStore, SessionArtifactChunk, RESERVED_ARTIFACT_ENV } from "./artifacts.mjs";
 import { WorkspaceFileWrite, WorkspaceFileWriteLookup } from "./file-write.mjs";
 import { walkDirectoryTree } from "./walk.mjs";
@@ -1379,8 +1379,8 @@ class WorkspaceAuthority {
     const storage = await this.options.accountStorage(userId);
     const repositoryId = this.accountRepositoryId(userId);
     if (state.blocked?.code === "publication_unknown") {
-      const { operationId: operationId2, commit } = state.blocked;
-      const receipt = await storage.read({ method: "operation.get", lookupId: operationId2 }).catch((error) => {
+      const { operationId, commit } = state.blocked;
+      const receipt = await storage.read({ method: "operation.get", lookupId: operationId }).catch((error) => {
         if (error instanceof WorkspaceError && error.code === "not_found") return null;
         throw error;
       });
@@ -1395,20 +1395,20 @@ class WorkspaceAuthority {
       await this.saveOuter(state);
     }
     if (!state.initialized) {
-      const remote2 = await this.remoteHead(storage, repositoryId, OUTER_BRANCH, true);
-      if (remote2) {
-        if (!await repo.has(remote2)) await repo.unbundle(await this.downloadBundle(storage, repositoryId));
-        if (!await repo.isLegacyBootstrap(remote2)) await repo.checkout(remote2);
-        await repo.setHead(remote2);
+      const remote = await this.remoteHead(storage, repositoryId, OUTER_BRANCH, true);
+      if (remote) {
+        if (!await repo.has(remote)) await repo.unbundle(await this.downloadBundle(storage, repositoryId));
+        if (!await repo.isLegacyBootstrap(remote)) await repo.checkout(remote);
+        await repo.setHead(remote);
       }
       state.initialized = true;
-      state.publishedHead = remote2;
-      state.head = remote2;
+      state.publishedHead = remote;
+      state.head = remote;
       await this.saveOuter(state);
-      if (options.bootstrapOnly) return { head: remote2, unchanged: true };
+      if (options.bootstrapOnly) return { head: remote, unchanged: true };
     } else if (options.bootstrapOnly) return { head: state.head, unchanged: true };
     if (state.conflict && !options.resolveConflict)
-      throw new OuterSnapshotRefusal(OUTER_CONFLICT_CODE, "Workspace synchronization conflict awaits resolution", state.conflict.paths);
+      throw new OuterSnapshotRefusal(OUTER_CONFLICT_CODE, "Workspace synchronization conflict awaits resolution", state.conflict.paths, true);
     const inners = await this.innerCheckouts(userId);
     let snapshot;
     try {
@@ -1423,26 +1423,34 @@ class WorkspaceAuthority {
     if (state.conflict) {
       const marker = /^(<{7}|={7}|>{7})( |$)/m;
       for (const file of state.conflict.paths) {
-        const bytes2 = await readRegular(path.join(repo.workTree, file)).catch((error) => {
+        const bytes = await readRegular(path.join(repo.workTree, file)).catch((error) => {
           if (error.code === "ENOENT" || error.code === "ENOTDIR") return null;
           throw error;
         });
-        if (bytes2 && marker.test(bytes2.toString("utf8")))
-          throw new OuterSnapshotRefusal(OUTER_CONFLICT_CODE, "Conflict markers remain; resolve them before confirming", [file]);
+        if (bytes && marker.test(bytes.toString("utf8")))
+          throw new OuterSnapshotRefusal(OUTER_CONFLICT_CODE, "Conflict markers remain; resolve them before confirming", [file], true);
       }
     } else if (state.blocked && state.blocked.code !== "publication_unknown") {
       state.blocked = null;
       await this.saveOuter(state);
     }
     const base = state.publishedHead;
-    const baseTree = base ? await repo.treeOf(base) : await repo.emptyTree();
+    const carried = state.head && state.head !== base ? (await repo.parents(state.head)).slice(1).filter((parent) => parent !== base) : [];
     let local;
+    let integratedRemote = null;
     if (state.conflict) {
       local = await repo.commit(snapshot.tree, [state.conflict.ours, state.conflict.theirs], "Resolve workspace synchronization conflict");
+      integratedRemote = state.conflict.theirs;
       state.conflict = null;
       state.blocked = null;
-    } else if (base && snapshot.tree === baseTree) local = base;
-    else local = await repo.commit(snapshot.tree, base ? [base] : [], "Workspace snapshot");
+    } else if (state.head && state.head !== base && snapshot.tree === await repo.treeOf(state.head)) {
+      local = state.head;
+      integratedRemote = carried.at(-1) ?? null;
+    } else if (base && !carried.length && snapshot.tree === await repo.treeOf(base)) local = base;
+    else {
+      local = await repo.commit(snapshot.tree, [...base ? [base] : [], ...carried], carried.length ? "Merge workspace" : "Workspace snapshot");
+      integratedRemote = carried.at(-1) ?? null;
+    }
     if (state.head !== local) {
       state.head = local;
       await repo.setHead(local);
@@ -1453,66 +1461,71 @@ class WorkspaceAuthority {
         throw new WorkspaceError("conflict", "The required workspace head is not integrated; retry the transfer");
       return options.requireHead ? { integrated: options.requireHead } : {};
     };
-    const remote = await this.remoteHead(storage, repositoryId, OUTER_BRANCH, true);
     let currentTree = snapshot.tree;
-    if (remote && remote !== base) {
-      if (!await repo.has(remote)) await repo.unbundle(await this.downloadBundle(storage, repositoryId));
-      if (local === base) {
-        await repo.apply(currentTree, await repo.treeOf(remote));
-        state.publishedHead = remote;
-        state.head = remote;
-        await repo.setHead(remote);
+    for (let attempt = 1; ; attempt++) {
+      const remote = await this.remoteHead(storage, repositoryId, OUTER_BRANCH, true);
+      if (remote && remote !== local && remote !== integratedRemote) {
+        if (!await repo.has(remote)) await repo.unbundle(await this.downloadBundle(storage, repositoryId));
+        if (local === base) {
+          await repo.apply(currentTree, await repo.treeOf(remote));
+          state.publishedHead = remote;
+          state.head = remote;
+          await repo.setHead(remote);
+          await this.saveOuter(state);
+          return { head: remote, unchanged: false, ...await integrated(remote) };
+        }
+        const merge = await repo.merge(local, remote);
+        if (merge.conflicts.length) {
+          await repo.apply(currentTree, merge.tree);
+          state.conflict = { ours: local, theirs: remote, tree: merge.tree, paths: merge.conflicts };
+          state.blocked = { code: OUTER_CONFLICT_CODE, message: "The workspace diverged from another worker; conflict markers were written to the paths named", paths: merge.conflicts };
+          await this.saveOuter(state);
+          throw new OuterSnapshotRefusal(OUTER_CONFLICT_CODE, state.blocked.message, merge.conflicts, true);
+        }
+        await repo.apply(currentTree, merge.tree);
+        currentTree = merge.tree;
+        local = await repo.commit(merge.tree, [local, remote], "Merge workspace");
+        integratedRemote = remote;
+        state.head = local;
+        await repo.setHead(local);
         await this.saveOuter(state);
-        return { head: remote, unchanged: false, ...await integrated(remote) };
       }
-      const merge = await repo.merge(local, remote);
-      if (merge.conflicts.length) {
-        await repo.apply(currentTree, merge.tree);
-        state.conflict = { ours: local, theirs: remote, tree: merge.tree, paths: merge.conflicts };
-        state.blocked = { code: OUTER_CONFLICT_CODE, message: "The workspace diverged from another worker; conflict markers were written to the paths named", paths: merge.conflicts };
+      if (local === remote) {
+        state.publishedHead = local;
         await this.saveOuter(state);
-        throw new OuterSnapshotRefusal(OUTER_CONFLICT_CODE, state.blocked.message, merge.conflicts);
+        return { head: local, unchanged: true, ...await integrated(local) };
       }
-      await repo.apply(currentTree, merge.tree);
-      currentTree = merge.tree;
-      local = await repo.commit(merge.tree, [local, remote], "Merge workspace");
-      state.head = local;
-      await repo.setHead(local);
+      const operationId = `ws-${randomUUID()}`, blobId = `ws-${randomUUID()}`;
+      const bytes = await repo.bundle(remote && await repo.has(remote) ? remote : null);
+      state.blocked = { code: "publication_unknown", operationId, commit: local, message: "Workspace publication is in progress/unknown. Inspect the original storage operation; never retry under a new ID." };
       await this.saveOuter(state);
-    }
-    if (local === remote) {
+      try {
+        await this.uploadBundle(storage, bytes, blobId, operationId);
+        const result = await storage.mutate({
+          method: "repository.publish",
+          operationId,
+          repositoryId,
+          branch: OUTER_BRANCH,
+          expectedHead: remote,
+          commit: local,
+          bundleId: blobId
+        });
+        if (result.head !== local) throw new WorkspaceError("invalid_response", "Workspace publication receipt head mismatch; inspect original operation");
+      } catch (error) {
+        if (error instanceof WorkspaceError && error.rejectedBeforeAdmission) {
+          state.blocked = null;
+          await this.saveOuter(state);
+          if (error.code !== "conflict") throw error;
+          if (attempt < OUTER_PUBLISH_ATTEMPTS) continue;
+          throw new WorkspaceError("mirror_advanced", "The workspace mirror advanced during publication; retried next cycle", true);
+        }
+        throw error;
+      }
       state.publishedHead = local;
+      state.blocked = null;
       await this.saveOuter(state);
-      return { head: local, unchanged: true, ...await integrated(local) };
-    }
-    const operationId = `ws-${randomUUID()}`, blobId = `ws-${randomUUID()}`;
-    const bytes = await repo.bundle(remote && await repo.has(remote) ? remote : null);
-    state.blocked = { code: "publication_unknown", operationId, commit: local, message: "Workspace publication is in progress/unknown. Inspect the original storage operation; never retry under a new ID." };
-    await this.saveOuter(state);
-    try {
-      await this.uploadBundle(storage, bytes, blobId, operationId);
-      const result = await storage.mutate({
-        method: "repository.publish",
-        operationId,
-        repositoryId,
-        branch: OUTER_BRANCH,
-        expectedHead: remote,
-        commit: local,
-        bundleId: blobId
-      });
-      if (result.head !== local) throw new WorkspaceError("invalid_response", "Workspace publication receipt head mismatch; inspect original operation");
-    } catch (error) {
-      if (error instanceof WorkspaceError && error.rejectedBeforeAdmission) {
-        state.blocked = null;
-        await this.saveOuter(state);
-        throw error.code === "conflict" ? new WorkspaceError("mirror_advanced", "The workspace mirror advanced during publication; retried next cycle", true) : error;
-      }
-      throw error;
+      return { head: local, unchanged: false, ...await integrated(local) };
     }
-    state.publishedHead = local;
-    state.blocked = null;
-    await this.saveOuter(state);
-    return { head: local, unchanged: false, ...await integrated(local) };
   }
   /** Push a project checkout's own HEAD to its mirror. Last push wins: no merge
    * is attempted, and a rewind or rewrite replaces the mirror as readily as a

package/dist/mjs/runtime/workspace/outer.mjs

@@ -9,6 +9,7 @@ const OUTER_REF = `refs/heads/${OUTER_BRANCH}`;
 const OUTER_SNAPSHOT_LIMIT_BYTES = 5 * 1024 * 1024;
 const OUTER_GIT_TIMEOUT_MS = 10 * 6e4;
 const OUTER_CONFLICT_CODE = "sync_conflict";
+const OUTER_PUBLISH_ATTEMPTS = 3;
 const LEGACY_ACCOUNT_README = "# Account workspace\n";
 const OUTER_EXCLUDES = [
   "/artifacts/",
@@ -33,8 +34,8 @@ const OUTER_EXCLUDES = [
   ".pypirc"
 ];
 class OuterSnapshotRefusal extends WorkspaceError {
-  constructor(code, message, paths) {
-    super(code, message);
+  constructor(code, message, paths, definite = false) {
+    super(code, message, definite);
     this.paths = paths;
     this.name = "OuterSnapshotRefusal";
   }
@@ -100,6 +101,10 @@ class OuterRepository {
   async emptyTree() {
     return GitOid.parse((await this.run(["hash-object", "-t", "tree", "--stdin"], "")).toString("utf8").trim());
   }
+  async parents(commit) {
+    const line = (await this.run(["rev-list", "--parents", "-n", "1", GitOid.parse(commit)])).toString("utf8").trim();
+    return line.split(/\s+/).slice(1).map((oid) => GitOid.parse(oid));
+  }
   async isAncestor(ancestor, descendant) {
     const { code } = await this.result(["merge-base", "--is-ancestor", GitOid.parse(ancestor), GitOid.parse(descendant)]);
     if (code !== 0 && code !== 1) throw new WorkspaceError("git_failed", "Outer repository ancestry is unreadable");
@@ -308,6 +313,7 @@ export {
   OUTER_CONFLICT_CODE,
   OUTER_EXCLUDES,
   OUTER_GIT_TIMEOUT_MS,
+  OUTER_PUBLISH_ATTEMPTS,
   OUTER_REF,
   OUTER_SNAPSHOT_LIMIT_BYTES,
   OuterRepository,

package/dist/types/runtime/host-environment.d.ts

@@ -0,0 +1,12 @@
+/** The environment every process the worker spawns for the user runs with.
+ *
+ * It is the host account's own environment, as the worker itself was started
+ * with — HOME, PATH, agent sockets, configs — with only a UTF-8 locale added
+ * when the host set none. The worker is a machine boundary, not a sandbox:
+ * shells and agents behave exactly like the host user, and isolation is the
+ * operator's decision (a dedicated account or machine), never an environment
+ * variable. Re-pointing HOME at the checkout was tried on 2026-09-16/17 and
+ * abandoned: tools that ignore HOME confused more than it isolated, and the
+ * caches that honoured it landed inside checkouts, where the publication guard
+ * measured them and two workers conflicted on them. */
+export declare function hostEnvironment(): Record<string, string>;

package/dist/types/runtime/workspace/outer.d.ts

@@ -11,6 +11,9 @@ export declare const OUTER_SNAPSHOT_LIMIT_BYTES: number;
  * is sized for one project. */
 export declare const OUTER_GIT_TIMEOUT_MS: number;
 export declare const OUTER_CONFLICT_CODE = "sync_conflict";
+/** Publications one cycle attempts while the mirror keeps moving underneath
+ * them; each attempt integrates what the mirror gained before trying again. */
+export declare const OUTER_PUBLISH_ATTEMPTS = 3;
 /** The bootstrap tree a legacy account repository carries. It is never
  * materialized: the workspace root is the user's, not a README's. */
 export declare const LEGACY_ACCOUNT_README = "# Account workspace\n";
@@ -42,9 +45,14 @@ export type OuterTreeEntry = {
     oid: string;
 };
 /** A refusal that names the paths responsible, for the incident evidence. */
+/** A refusal whose outcome is definite: either nothing happened, or what
+ * happened (conflict markers written, state saved) is fully recorded in the
+ * durable outer state and re-running the same command refuses the same way.
+ * `definite` travels as the relay's `rejectedBeforeAdmission`, so a caller
+ * receives a typed error instead of an uncertain outcome that blocks its run. */
 export declare class OuterSnapshotRefusal extends WorkspaceError {
     readonly paths: string[];
-    constructor(code: string, message: string, paths: string[]);
+    constructor(code: string, message: string, paths: string[], definite?: boolean);
 }
 export declare class OuterRepository {
     readonly gitDir: string;
@@ -58,6 +66,7 @@ export declare class OuterRepository {
     has(object: string): Promise<boolean>;
     treeOf(commit: string): Promise<string>;
     emptyTree(): Promise<string>;
+    parents(commit: string): Promise<string[]>;
     isAncestor(ancestor: string, descendant: string): Promise<boolean>;
     listTree(tree: string): Promise<OuterTreeEntry[]>;
     /** Git refuses to walk into a nested repository until the outer index holds

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.168",
+  "version": "0.0.170",
   "type": "module",
   "main": "./dist/mjs/main.mjs",
   "module": "./dist/mjs/main.mjs",
@@ -21,7 +21,7 @@
     "r5d-worker": "dist/mjs/main.mjs"
   },
   "dependencies": {
-    "@ricsam/r5d-api": "^0.0.168",
+    "@ricsam/r5d-api": "^0.0.170",
     "node-pty": "1.1.0",
     "zod": "^4.1.13",
     "picomatch": "^4.0.3"