@ricsam/r5d-worker 0.0.2 → 0.0.4

package/dist/mjs/main.mjs

@@ -4,7 +4,7 @@ import os from "node:os";
 import path from "node:path";
 import { createHash } from "node:crypto";
 import { hostname } from "node:os";
-import * as nodePty from "node-pty";
+import { spawn as spawnChildProcess } from "node:child_process";
 const DEFAULT_BASE_URL = "https://r5d.dev";
 const LABEL_RE = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,62}$/;
 const BRANCH_RE = /^[A-Za-z0-9][A-Za-z0-9-]*[A-Za-z0-9]$|^[A-Za-z0-9]$/;
@@ -14,23 +14,28 @@ const MAX_SYNC_DIFF_BYTES = 5 * 1024 * 1024;
 const activeProcesses = /* @__PURE__ */ new Map();
 const activePtys = /* @__PURE__ */ new Map();
 const branchLocks = /* @__PURE__ */ new Map();
+let containerRegistryCredential = null;
 function defaultConfigPath() {
   return path.join(os.homedir(), ".config", "r5d", "r5dctl", "config.json");
 }
-function defaultProjectRoot(projectId) {
-  return path.join(os.homedir(), ".r5d", "projects", projectId);
+function defaultProjectsRoot() {
+  return path.join(os.homedir(), ".r5d", "projects");
+}
+function defaultSyncRoot() {
+  return path.join(os.homedir(), ".r5d", "sync");
 }
 function printHelp() {
   process.stdout.write(`Usage:
-  r5d-worker start <project-id> --label <label> [--base-url <url>] [--token <token>] [--api-key <key>]
+  r5d-worker start --label <label> [--base-url <url>] [--token <token>] [--api-key <key>]
 
 Options:
-  --label <label>       Required unique worker label for this project, e.g. macos or ec2-build
+  --label <label>       Required unique worker label for this user, e.g. macos or ec2-build
   --base-url <url>      r5d.dev base URL (default from r5d config, R5D_BASE_URL, or ${DEFAULT_BASE_URL})
   --token <token>       r5d worker token
   --api-key <key>       r5d API key
   --config <path>       Config path (default ~/.config/r5d/r5dctl/config.json)
-  --project-root <dir>  Override checkout root (default ~/.r5d/projects/<project-id>)
+  --project-root <dir>  Override projects checkout root (default ~/.r5d/projects)
+  --sync-root <dir>     Override r5d internal sync git root (default ~/.r5d/sync)
   -h, --help            Show this help
 `);
 }
@@ -93,6 +98,11 @@ function parseArgs(argv) {
       options.projectRoot = projectRoot;
       continue;
     }
+    const syncRoot = readOption("--sync-root");
+    if (syncRoot !== void 0) {
+      options.syncRoot = syncRoot;
+      continue;
+    }
     rest.push(arg);
   }
   if (options.help || rest.length === 0) {
@@ -104,7 +114,6 @@ function parseArgs(argv) {
   }
   return {
     command: "start",
-    projectId: requireValue(rest[1], "Missing project id"),
     options
   };
 }
@@ -182,17 +191,14 @@ function validateBranchName(branchName) {
     throw new Error(`Invalid branch name from server: ${branchName}`);
   }
 }
-function gitRemoteUrl(baseUrl, projectId) {
-  return `${baseUrl}/git/${projectId}.git`;
-}
-function gitExtraHeaderConfigKey(baseUrl) {
-  return `http.${normalizeBaseUrl(baseUrl)}/.extraHeader`;
+function gitExtraHeaderConfigKey(extraHeaderUrl) {
+  return `http.${normalizeBaseUrl(extraHeaderUrl)}/.extraHeader`;
 }
 function gitAuthArgs(auth) {
   if (!auth) {
     return [];
   }
-  return ["-c", `${gitExtraHeaderConfigKey(auth.baseUrl)}=Authorization: Bearer ${auth.token}`];
+  return ["-c", `${gitExtraHeaderConfigKey(auth.extraHeaderUrl)}=${auth.header}`];
 }
 function runGit(args, options = {}) {
   const command = ["git", ...gitAuthArgs(options.auth), ...args];
@@ -220,8 +226,22 @@ function tryGit(args, options = {}) {
     return false;
   }
 }
-function getCurrentCommitHash(cwd) {
-  return runGit(["rev-parse", "HEAD"], { cwd });
+function runInternalGit(context, args) {
+  return runGit(["--git-dir", context.gitDir, "--work-tree", context.workTree, ...args], { auth: context.auth });
+}
+function runInternalGitDir(context, args) {
+  return runGit(["--git-dir", context.gitDir, ...args], { auth: context.auth });
+}
+function tryInternalGit(context, args) {
+  try {
+    runInternalGit(context, args);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function getInternalCommitHash(context) {
+  return runInternalGit(context, ["rev-parse", "HEAD"]);
 }
 function getGitBlobHashForContent(content) {
   const buffer = typeof content === "string" ? Buffer.from(content, "utf8") : content;
@@ -230,6 +250,12 @@ function getGitBlobHashForContent(content) {
 function hasWorktreeChanges(cwd) {
   return runGit(["status", "--porcelain"], { cwd }).trim().length > 0;
 }
+function getInternalStatus(context) {
+  return runInternalGit(context, ["status", "--porcelain", "--", ".", ":(exclude).git"]);
+}
+function hasInternalWorktreeChanges(context) {
+  return getInternalStatus(context).trim().length > 0;
+}
 function assertInsideBranch(branchPath, filePath) {
   const relative = path.relative(branchPath, filePath);
   if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
@@ -252,11 +278,11 @@ function resolveProjectFilePath(branchPath, virtualPath) {
   assertInsideBranch(branchPath, absolutePath);
   return { absolutePath, virtualPath: `/${repoRelativePath}`, repoRelativePath };
 }
-function branchLockKey(projectRoot, branchName) {
-  return `${projectRoot}:${branchName}`;
+function branchLockKey(projectId, branchName) {
+  return `${projectId}:${branchName}`;
 }
-async function withBranchLock(projectRoot, branchName, fn) {
-  const key = branchLockKey(projectRoot, branchName);
+async function withBranchLock(projectId, branchName, fn) {
+  const key = branchLockKey(projectId, branchName);
   const previous = branchLocks.get(key) ?? Promise.resolve();
   let release = () => {
   };
@@ -277,60 +303,283 @@ async function withBranchLock(projectRoot, branchName, fn) {
     }
   }
 }
-function configureRepo(pathName, auth) {
-  const authHeaderKey = gitExtraHeaderConfigKey(auth.baseUrl);
-  tryGit(["config", "--unset-all", "http.extraHeader"], { cwd: pathName });
-  tryGit(["config", "--unset-all", authHeaderKey], { cwd: pathName });
-  runGit(["config", "--add", authHeaderKey, `Authorization: Bearer ${auth.token}`], { cwd: pathName });
-  runGit(["config", "user.name", "r5d.dev Worker"], { cwd: pathName });
-  runGit(["config", "user.email", "worker@r5d.dev"], { cwd: pathName });
+function resolveRemoteUrl(baseUrl, remoteUrl) {
+  if (/^https?:\/\//i.test(remoteUrl)) {
+    return remoteUrl;
+  }
+  return new URL(remoteUrl, baseUrl).toString();
+}
+function fallbackInternalRemoteUrl(baseUrl, projectId) {
+  return new URL(`/git/${projectId}.git`, baseUrl).toString();
 }
-function ensureMainClone(input) {
-  const mainPath = path.join(input.projectRoot, "main");
-  const remoteUrl = gitRemoteUrl(input.baseUrl, input.projectId);
-  fs.mkdirSync(input.projectRoot, { recursive: true });
-  if (!fs.existsSync(path.join(mainPath, ".git"))) {
-    fs.rmSync(mainPath, { recursive: true, force: true });
-    runGit(["clone", "--origin", "build-it-now", remoteUrl, mainPath], { auth: input });
+function internalGitAuth(baseUrl, token) {
+  return {
+    extraHeaderUrl: baseUrl,
+    header: `Authorization: Bearer ${token}`
+  };
+}
+function internalRemoteUrlFor(baseUrl, projectId, manifest) {
+  return resolveRemoteUrl(baseUrl, manifest?.internalRemoteUrl ?? fallbackInternalRemoteUrl(baseUrl, projectId));
+}
+function githubRemoteUrlFor(baseUrl, projectId, manifest) {
+  return manifest?.repoHttpUrl ?? internalRemoteUrlFor(baseUrl, projectId, manifest);
+}
+function gitExtraHeaderUrlForRemote(remoteUrl) {
+  try {
+    return new URL(remoteUrl).origin;
+  } catch {
+    return remoteUrl;
   }
-  configureRepo(mainPath, input);
-  runGit(["remote", "set-url", "build-it-now", remoteUrl], { cwd: mainPath });
-  runGit(["fetch", "build-it-now", "--prune"], { cwd: mainPath });
-  runGit(["checkout", "main"], { cwd: mainPath });
-  if (!hasWorktreeChanges(mainPath)) {
-    tryGit(["pull", "--ff-only", "build-it-now", "main"], { cwd: mainPath });
+}
+function gitAuthForRemote(remoteUrl, authHeader) {
+  if (!authHeader) {
+    return void 0;
   }
-  return mainPath;
+  return {
+    extraHeaderUrl: gitExtraHeaderUrlForRemote(remoteUrl),
+    header: authHeader
+  };
 }
-function ensureBranchWorkspace(input) {
-  validateBranchName(input.branchName);
-  const mainPath = ensureMainClone(input);
-  if (input.branchName === "main") {
-    return mainPath;
+function branchGitDirName(branchName) {
+  return `${encodeURIComponent(branchName)}.git`;
+}
+function internalGitDirFor(syncRoot, projectId, branchName) {
+  return path.join(syncRoot, projectId, branchGitDirName(branchName));
+}
+function hasNormalVisibleGitDir(branchPath) {
+  const gitPath = path.join(branchPath, ".git");
+  return fs.existsSync(gitPath) && fs.statSync(gitPath).isDirectory();
+}
+function ensureOriginRemote(branchPath, remoteUrl) {
+  if (tryGit(["remote", "get-url", "origin"], { cwd: branchPath })) {
+    runGit(["remote", "set-url", "origin", remoteUrl], { cwd: branchPath });
+  } else {
+    runGit(["remote", "add", "origin", remoteUrl], { cwd: branchPath });
   }
-  const branchPath = path.join(input.projectRoot, input.branchName);
-  runGit(["fetch", "build-it-now", "--prune"], { cwd: mainPath });
-  const hasRemoteBranch = tryGit(["show-ref", "--verify", "--quiet", `refs/remotes/build-it-now/${input.branchName}`], {
-    cwd: mainPath
+}
+function shellQuote(value) {
+  return `'${value.replace(/'/g, "'\\''")}'`;
+}
+function githubCredentialsPath() {
+  return path.join(os.homedir(), ".r5d", "github-credentials");
+}
+function decodeBasicAuthHeader(authHeader) {
+  const match = /^Authorization:\s*Basic\s+(.+)$/i.exec(authHeader.trim());
+  if (!match) {
+    return null;
+  }
+  const decoded = Buffer.from(match[1], "base64").toString("utf8");
+  const separatorIndex = decoded.indexOf(":");
+  if (separatorIndex <= 0) {
+    return null;
+  }
+  return {
+    username: decoded.slice(0, separatorIndex),
+    password: decoded.slice(separatorIndex + 1)
+  };
+}
+function writeCredentialStoreEntry(remoteUrl, authHeader) {
+  const credentials = decodeBasicAuthHeader(authHeader);
+  if (!credentials) {
+    return null;
+  }
+  let remote;
+  try {
+    remote = new URL(remoteUrl);
+  } catch {
+    return null;
+  }
+  if (remote.protocol !== "https:") {
+    return null;
+  }
+  const storePath = githubCredentialsPath();
+  fs.mkdirSync(path.dirname(storePath), { recursive: true });
+  const hostKey = `${remote.protocol}//${remote.host}`;
+  const existing = fs.existsSync(storePath) ? fs.readFileSync(storePath, "utf8").split(/\r?\n/).filter(Boolean) : [];
+  const next = existing.filter((line) => {
+    try {
+      const parsed = new URL(line);
+      return `${parsed.protocol}//${parsed.host}` !== hostKey;
+    } catch {
+      return true;
+    }
   });
-  if (!fs.existsSync(path.join(branchPath, ".git"))) {
+  const credentialUrl = new URL(hostKey);
+  credentialUrl.username = credentials.username;
+  credentialUrl.password = credentials.password;
+  next.push(credentialUrl.toString());
+  fs.writeFileSync(storePath, `${next.join("\n")}
+`, { mode: 384 });
+  fs.chmodSync(storePath, 384);
+  return storePath;
+}
+function configureVisibleGitHubAuth(branchPath, remoteUrl, authHeader) {
+  if (!authHeader) {
+    return;
+  }
+  const credentialStore = writeCredentialStoreEntry(remoteUrl, authHeader);
+  if (credentialStore) {
+    runGit(["config", "credential.helper", `store --file=${shellQuote(credentialStore)}`], { cwd: branchPath });
+    runGit(["config", "credential.useHttpPath", "false"], { cwd: branchPath });
+    return;
+  }
+  runGit(["config", `${gitExtraHeaderConfigKey(gitExtraHeaderUrlForRemote(remoteUrl))}`, authHeader], { cwd: branchPath });
+}
+function dockerConfigPath() {
+  return path.join(os.homedir(), ".docker", "config.json");
+}
+function containersAuthPath() {
+  return path.join(os.homedir(), ".config", "containers", "auth.json");
+}
+function readJsonFile(filePath) {
+  if (!fs.existsSync(filePath)) {
+    return {};
+  }
+  try {
+    const parsed = JSON.parse(fs.readFileSync(filePath, "utf8"));
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function writeRegistryAuthFile(filePath, credential) {
+  const config = readJsonFile(filePath);
+  const existingAuths = config.auths && typeof config.auths === "object" && !Array.isArray(config.auths) ? config.auths : {};
+  const auths = existingAuths;
+  auths[credential.registry] = {
+    username: credential.username,
+    password: credential.password,
+    auth: Buffer.from(`${credential.username}:${credential.password}`).toString("base64")
+  };
+  config.auths = auths;
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, `${JSON.stringify(config, null, 2)}
+`, { mode: 384 });
+  fs.chmodSync(filePath, 384);
+}
+function configureContainerRegistryAuth(credential) {
+  containerRegistryCredential = credential;
+  if (!credential) {
+    return;
+  }
+  writeRegistryAuthFile(dockerConfigPath(), credential);
+  writeRegistryAuthFile(containersAuthPath(), credential);
+  if (credential.missingScopes.length > 0) {
+    process.stderr.write(
+      `[r5d-worker] GitHub token is missing GHCR scope(s): ${credential.missingScopes.join(", ")}. Sign in with GitHub again if GHCR push/pull fails.
+`
+    );
+  } else {
+    process.stdout.write(`[r5d-worker] configured GHCR auth for ${credential.username}
+`);
+  }
+}
+function containerRegistryEnv() {
+  if (!containerRegistryCredential) {
+    return {};
+  }
+  return {
+    R5D_GHCR_REGISTRY: containerRegistryCredential.registry,
+    R5D_GHCR_NAMESPACE: containerRegistryCredential.username,
+    R5D_GHCR_AUTH_FILE: containersAuthPath(),
+    REGISTRY_AUTH_FILE: containersAuthPath(),
+    GHCR_REGISTRY: containerRegistryCredential.registry,
+    GHCR_NAMESPACE: containerRegistryCredential.username
+  };
+}
+function checkoutVisibleBranch(input) {
+  const branchExists = tryGit(["show-ref", "--verify", "--quiet", `refs/heads/${input.branchName}`], { cwd: input.branchPath });
+  const remoteBranchExists = tryGit(["show-ref", "--verify", "--quiet", `refs/remotes/origin/${input.branchName}`], {
+    cwd: input.branchPath
+  });
+  const defaultRemoteExists = tryGit(["show-ref", "--verify", "--quiet", `refs/remotes/origin/${input.defaultBranch}`], {
+    cwd: input.branchPath
+  });
+  const clean = !hasWorktreeChanges(input.branchPath);
+  if (remoteBranchExists && clean) {
+    runGit(["checkout", "-B", input.branchName, `origin/${input.branchName}`], { cwd: input.branchPath });
+    return;
+  }
+  if (branchExists) {
+    runGit(["checkout", input.branchName], { cwd: input.branchPath });
+    return;
+  }
+  if (defaultRemoteExists) {
+    runGit(["checkout", "-B", input.branchName, `origin/${input.defaultBranch}`], { cwd: input.branchPath });
+    return;
+  }
+  runGit(["checkout", "-B", input.branchName], { cwd: input.branchPath });
+}
+function ensureVisibleGitCheckout(input) {
+  validateBranchName(input.branchName);
+  fs.mkdirSync(input.projectRoot, { recursive: true });
+  const branchPath = path.join(input.projectRoot, input.branchName);
+  if (!hasNormalVisibleGitDir(branchPath)) {
     fs.rmSync(branchPath, { recursive: true, force: true });
-    if (hasRemoteBranch) {
-      runGit(["worktree", "add", "-B", input.branchName, branchPath, `build-it-now/${input.branchName}`], {
-        cwd: mainPath
-      });
-    } else {
-      runGit(["worktree", "add", "-b", input.branchName, branchPath, "build-it-now/main"], {
-        cwd: mainPath
-      });
+    fs.mkdirSync(path.dirname(branchPath), { recursive: true });
+    if (!tryGit(["clone", "--origin", "origin", input.githubRemoteUrl, branchPath], { auth: input.githubAuth })) {
+      fs.mkdirSync(branchPath, { recursive: true });
+      runGit(["init"], { cwd: branchPath });
     }
   }
-  configureRepo(branchPath, input);
-  if (hasRemoteBranch && !hasWorktreeChanges(branchPath)) {
-    tryGit(["pull", "--ff-only", "build-it-now", input.branchName], { cwd: branchPath });
-  }
+  ensureOriginRemote(branchPath, input.githubRemoteUrl);
+  configureVisibleGitHubAuth(branchPath, input.githubRemoteUrl, input.githubAuthHeader);
+  tryGit(["fetch", "origin", "--prune"], { cwd: branchPath, auth: input.githubAuth });
+  checkoutVisibleBranch({ branchPath, branchName: input.branchName, defaultBranch: input.defaultBranch });
   return branchPath;
 }
+function configureInternalRepo(context, remoteUrl) {
+  if (tryInternalGit(context, ["remote", "get-url", "build-it-now"])) {
+    runInternalGit(context, ["remote", "set-url", "build-it-now", remoteUrl]);
+  } else {
+    runInternalGit(context, ["remote", "add", "build-it-now", remoteUrl]);
+  }
+  runInternalGitDir(context, ["config", "user.name", "r5d.dev Worker"]);
+  runInternalGitDir(context, ["config", "user.email", "worker@r5d.dev"]);
+}
+function ensureInternalSyncGit(input) {
+  validateBranchName(input.branchName);
+  const gitDir = internalGitDirFor(input.syncRoot, input.projectId, input.branchName);
+  fs.mkdirSync(path.dirname(gitDir), { recursive: true });
+  if (!fs.existsSync(gitDir)) {
+    runGit(["init", "--bare", gitDir]);
+  }
+  const auth = internalGitAuth(input.baseUrl, input.token);
+  const context = { gitDir, workTree: input.branchPath, auth };
+  const remoteUrl = internalRemoteUrlFor(input.baseUrl, input.projectId, input.manifest);
+  configureInternalRepo(context, remoteUrl);
+  runInternalGit(context, ["fetch", "build-it-now", "--prune", "+refs/heads/*:refs/remotes/build-it-now/*"]);
+  const hasRemoteBranch = tryInternalGit(context, ["show-ref", "--verify", "--quiet", `refs/remotes/build-it-now/${input.branchName}`]);
+  const target = hasRemoteBranch ? `refs/remotes/build-it-now/${input.branchName}` : "refs/remotes/build-it-now/main";
+  const hasHead = tryInternalGit(context, ["rev-parse", "--verify", "HEAD"]);
+  if (!hasHead || !hasInternalWorktreeChanges(context)) {
+    runInternalGit(context, ["checkout", "-f", "-B", input.branchName, target]);
+  }
+  return context;
+}
+function ensureBranchWorkspace(input) {
+  const defaultBranch = input.manifest?.defaultBranch || "main";
+  const githubRemoteUrl = githubRemoteUrlFor(input.baseUrl, input.projectId, input.manifest);
+  const githubAuth = gitAuthForRemote(githubRemoteUrl, input.manifest?.repoAuthHeader);
+  const branchPath = ensureVisibleGitCheckout({
+    projectRoot: input.projectRoot,
+    branchName: input.branchName,
+    githubRemoteUrl,
+    githubAuth,
+    githubAuthHeader: input.manifest?.repoAuthHeader ?? null,
+    defaultBranch
+  });
+  const internalGit = ensureInternalSyncGit({
+    projectId: input.projectId,
+    baseUrl: input.baseUrl,
+    token: input.token,
+    syncRoot: input.syncRoot,
+    branchPath,
+    branchName: input.branchName,
+    manifest: input.manifest
+  });
+  return { branchPath, internalGit };
+}
 function resolveCommandCwd(branchPath, cwd) {
   if (!cwd) {
     return branchPath;
@@ -439,8 +688,8 @@ function readImageDimensions(bytes, mediaType) {
   return dimensions;
 }
 async function executeReadFileOperation(input) {
-  const branchPath = ensureOperationBranch({ ...input, branchName: input.message.branchName });
-  const resolved = resolveProjectFilePath(branchPath, input.message.filePath);
+  const workspace = ensureOperationBranch({ ...input, branchName: input.message.branchName });
+  const resolved = resolveProjectFilePath(workspace.branchPath, input.message.filePath);
   if (!fs.existsSync(resolved.absolutePath) || !fs.statSync(resolved.absolutePath).isFile()) {
     throw new Error(`File not found: ${resolved.virtualPath}`);
   }
@@ -454,8 +703,8 @@ async function executeReadFileOperation(input) {
   };
 }
 async function executeCreateFileOperation(input) {
-  const branchPath = ensureOperationBranch({ ...input, branchName: input.message.branchName });
-  const resolved = resolveProjectFilePath(branchPath, input.message.filePath);
+  const workspace = ensureOperationBranch({ ...input, branchName: input.message.branchName });
+  const resolved = resolveProjectFilePath(workspace.branchPath, input.message.filePath);
   if (fs.existsSync(resolved.absolutePath)) {
     throw new Error(`File "${resolved.virtualPath}" already exists. Use edit_file to modify existing files.`);
   }
@@ -468,8 +717,8 @@ async function executeCreateFileOperation(input) {
   };
 }
 async function executeEditFileOperation(input) {
-  const branchPath = ensureOperationBranch({ ...input, branchName: input.message.branchName });
-  const resolved = resolveProjectFilePath(branchPath, input.message.filePath);
+  const workspace = ensureOperationBranch({ ...input, branchName: input.message.branchName });
+  const resolved = resolveProjectFilePath(workspace.branchPath, input.message.filePath);
   if (input.message.oldString === input.message.newString) {
     throw new Error("old_string and new_string must be different");
   }
@@ -498,8 +747,8 @@ async function executeEditFileOperation(input) {
   };
 }
 async function executeViewFileBytesOperation(input) {
-  const branchPath = ensureOperationBranch({ ...input, branchName: input.message.branchName });
-  const resolved = resolveProjectFilePath(branchPath, input.message.filePath);
+  const workspace = ensureOperationBranch({ ...input, branchName: input.message.branchName });
+  const resolved = resolveProjectFilePath(workspace.branchPath, input.message.filePath);
   if (!fs.existsSync(resolved.absolutePath) || !fs.statSync(resolved.absolutePath).isFile()) {
     throw new Error(`File not found: ${resolved.virtualPath}`);
   }
@@ -520,12 +769,12 @@ async function executeViewFileBytesOperation(input) {
     height: dimensions.height
   };
 }
-function stagedBlobSizeBytes(cwd) {
-  const names = runGit(["diff", "--cached", "--name-only", "-z"], { cwd }).split("\0").filter(Boolean);
+function stagedBlobSizeBytes(context) {
+  const names = runInternalGit(context, ["diff", "--cached", "--name-only", "-z", "--", ".", ":(exclude).git"]).split("\0").filter(Boolean);
   let total = 0;
   for (const name of names) {
     try {
-      const sizeText = runGit(["cat-file", "-s", `:${name}`], { cwd });
+      const sizeText = runInternalGit(context, ["cat-file", "-s", `:${name}`]);
       total += Number.parseInt(sizeText, 10) || 0;
     } catch {
     }
@@ -536,11 +785,11 @@ function stagedBlobSizeBytes(cwd) {
   return total;
 }
 function syncBranch(input) {
-  const branchPath = ensureOperationBranch(input);
-  runGit(["add", "-A"], { cwd: branchPath });
-  const hasStagedChanges = !tryGit(["diff", "--cached", "--quiet"], { cwd: branchPath });
-  const status = runGit(["status", "--porcelain"], { cwd: branchPath });
-  const currentCommit = getCurrentCommitHash(branchPath);
+  const workspace = ensureOperationBranch(input);
+  runInternalGit(workspace.internalGit, ["add", "-A", "--", ".", ":(exclude).git"]);
+  const hasStagedChanges = !tryInternalGit(workspace.internalGit, ["diff", "--cached", "--quiet", "--", ".", ":(exclude).git"]);
+  const status = getInternalStatus(workspace.internalGit);
+  const currentCommit = getInternalCommitHash(workspace.internalGit);
   if (!hasStagedChanges) {
     return {
       type: "sync",
@@ -550,7 +799,7 @@ function syncBranch(input) {
       status
     };
   }
-  const diffSizeBytes = stagedBlobSizeBytes(branchPath);
+  const diffSizeBytes = stagedBlobSizeBytes(workspace.internalGit);
   if (diffSizeBytes > MAX_SYNC_DIFF_BYTES && !input.confirmedLargeDiff) {
     return {
       type: "sync",
@@ -568,15 +817,15 @@ function syncBranch(input) {
     parentNodeId: input.parentNodeId,
     ...input.confirmedLargeDiff ? { confirmedLargeDiff: true, confirmationReason: input.confirmationReason } : {}
   });
-  runGit(["commit", "-m", message], { cwd: branchPath });
-  const commitHash = getCurrentCommitHash(branchPath);
-  runGit(["push", "build-it-now", `HEAD:refs/heads/${input.branchName}`], { cwd: branchPath });
+  runInternalGit(workspace.internalGit, ["commit", "-m", message]);
+  const commitHash = getInternalCommitHash(workspace.internalGit);
+  runInternalGit(workspace.internalGit, ["push", "build-it-now", `HEAD:refs/heads/${input.branchName}`]);
   return {
     type: "sync",
     changed: true,
     commitHash,
     diffSizeBytes,
-    status: runGit(["status", "--porcelain"], { cwd: branchPath }),
+    status: getInternalStatus(workspace.internalGit),
     trigger: input.trigger
   };
 }
@@ -600,14 +849,14 @@ function confirmLargeDiff(input) {
   };
 }
 function pullBranch(input) {
-  const branchPath = ensureOperationBranch(input);
-  runGit(["fetch", "build-it-now", "--prune"], { cwd: branchPath });
+  const workspace = ensureOperationBranch(input);
+  runInternalGit(workspace.internalGit, ["fetch", "build-it-now", "--prune", "+refs/heads/*:refs/remotes/build-it-now/*"]);
   const target = input.commitHash ?? `build-it-now/${input.branchName}`;
-  runGit(["reset", "--hard", target], { cwd: branchPath });
-  runGit(["clean", "-fd"], { cwd: branchPath });
+  runInternalGit(workspace.internalGit, ["reset", "--hard", target]);
+  runInternalGit(workspace.internalGit, ["clean", "-fd", "--", ".", ":(exclude).git"]);
   return {
     type: "pull_branch",
-    commitHash: getCurrentCommitHash(branchPath)
+    commitHash: getInternalCommitHash(workspace.internalGit)
   };
 }
 async function executeOperation(input) {
@@ -626,10 +875,12 @@ async function executeOperation(input) {
         baseUrl: input.baseUrl,
         token: input.token,
         projectRoot: input.projectRoot,
+        syncRoot: input.syncRoot,
         branchName: input.message.branchName,
         sessionId: input.message.sessionId,
         parentNodeId: input.message.parentNodeId,
-        trigger: input.message.trigger
+        trigger: input.message.trigger,
+        manifest: input.manifest
       });
     case "confirm_large_diff":
       return confirmLargeDiff({
@@ -637,10 +888,12 @@ async function executeOperation(input) {
         baseUrl: input.baseUrl,
         token: input.token,
         projectRoot: input.projectRoot,
+        syncRoot: input.syncRoot,
         branchName: input.message.branchName,
         sessionId: input.message.sessionId,
         parentNodeId: input.message.parentNodeId,
-        reason: input.message.reason
+        reason: input.message.reason,
+        manifest: input.manifest
       });
     case "pull_branch":
       return pullBranch({
@@ -648,8 +901,10 @@ async function executeOperation(input) {
         baseUrl: input.baseUrl,
         token: input.token,
         projectRoot: input.projectRoot,
+        syncRoot: input.syncRoot,
         branchName: input.message.branchName,
-        commitHash: input.message.commitHash
+        commitHash: input.message.commitHash,
+        manifest: input.manifest
       });
   }
 }
@@ -662,15 +917,18 @@ async function executeCommand(input) {
       baseUrl: input.baseUrl,
       token: input.token,
       projectRoot: input.projectRoot,
-      branchName: input.message.branchName
+      syncRoot: input.syncRoot,
+      branchName: input.message.branchName,
+      manifest: input.manifest
     });
-    const cwd = resolveCommandCwd(branchPath, input.message.cwd);
+    const cwd = resolveCommandCwd(branchPath.branchPath, input.message.cwd);
     const subprocess = Bun.spawn(input.message.argv, {
       cwd,
       stdout: "pipe",
       stderr: "pipe",
       env: {
         ...process.env,
+        ...containerRegistryEnv(),
         ...input.message.env ?? {}
       }
     });
@@ -713,6 +971,182 @@ async function executeCommand(input) {
 function sendWorkerMessage(ws, message) {
   ws.send(JSON.stringify(message));
 }
+const PTY_BRIDGE_SCRIPT = String.raw`
+const readline = require("node:readline");
+const nodePty = require("node-pty");
+
+let ptyProcess = null;
+
+function send(message, callback) {
+  process.stdout.write(JSON.stringify(message) + "\n", callback);
+}
+
+function decode(data) {
+  return Buffer.from(data, "base64").toString("utf8");
+}
+
+const rl = readline.createInterface({ input: process.stdin });
+
+rl.on("line", (line) => {
+  let message;
+  try {
+    message = JSON.parse(line);
+  } catch (error) {
+    send({ type: "error", error: error instanceof Error ? error.message : String(error) });
+    return;
+  }
+
+  try {
+    if (message.type === "open") {
+      ptyProcess = nodePty.spawn(message.file, message.args, message.options);
+      ptyProcess.onData((data) => {
+        send({ type: "output", data: Buffer.from(data, "utf8").toString("base64") });
+      });
+      ptyProcess.onExit((event) => {
+        send({ type: "exit", exitCode: event.exitCode, signal: event.signal }, () => process.exit(0));
+      });
+      send({ type: "opened" });
+      return;
+    }
+
+    if (!ptyProcess) {
+      send({ type: "error", error: "PTY has not been opened" });
+      return;
+    }
+
+    if (message.type === "input") {
+      ptyProcess.write(decode(message.data));
+      return;
+    }
+
+    if (message.type === "resize") {
+      ptyProcess.resize(message.cols, message.rows);
+      return;
+    }
+
+    if (message.type === "close") {
+      ptyProcess.kill();
+    }
+  } catch (error) {
+    send({ type: "error", error: error instanceof Error ? error.message : String(error) });
+  }
+});
+`;
+function nodePtyModulePaths() {
+  const candidates = [];
+  const entrypoint = process.argv[1];
+  if (entrypoint) {
+    try {
+      let current = path.dirname(fs.realpathSync(entrypoint));
+      for (let index = 0; index < 8; index += 1) {
+        candidates.push(path.join(current, "node_modules"));
+        const parent = path.dirname(current);
+        if (parent === current) {
+          break;
+        }
+        current = parent;
+      }
+    } catch {
+    }
+  }
+  candidates.push(path.join(process.cwd(), "node_modules"), "/usr/local/lib/node_modules", "/usr/lib/node_modules");
+  if (process.env.NODE_PATH) {
+    candidates.push(...process.env.NODE_PATH.split(path.delimiter));
+  }
+  return [...new Set(candidates.filter(Boolean))].join(path.delimiter);
+}
+function createNodePtyBridge(options) {
+  const child = spawnChildProcess("node", ["-e", PTY_BRIDGE_SCRIPT], {
+    env: {
+      ...process.env,
+      NODE_PATH: nodePtyModulePaths()
+    }
+  });
+  let lineBuffer = "";
+  let emittedTerminalEvent = false;
+  let stderr = "";
+  const sendToChild = (message) => {
+    if (child.stdin.writable) {
+      child.stdin.write(`${JSON.stringify(message)}
+`);
+    }
+  };
+  const handleEvent = (event) => {
+    if (event.type === "opened") {
+      options.onOpened();
+      return;
+    }
+    if (event.type === "output") {
+      options.onOutput(Buffer.from(event.data, "base64").toString("utf8"));
+      return;
+    }
+    if (event.type === "exit") {
+      emittedTerminalEvent = true;
+      options.onExit({ exitCode: event.exitCode, signal: event.signal });
+      return;
+    }
+    if (event.type === "error") {
+      emittedTerminalEvent = true;
+      options.onError(new Error(event.error));
+    }
+  };
+  child.stdout.setEncoding("utf8");
+  child.stdout.on("data", (chunk) => {
+    lineBuffer += chunk;
+    let newlineIndex = lineBuffer.indexOf("\n");
+    while (newlineIndex !== -1) {
+      const line = lineBuffer.slice(0, newlineIndex).trim();
+      lineBuffer = lineBuffer.slice(newlineIndex + 1);
+      if (line) {
+        try {
+          handleEvent(JSON.parse(line));
+        } catch (error) {
+          emittedTerminalEvent = true;
+          options.onError(new Error(error instanceof Error ? error.message : String(error)));
+        }
+      }
+      newlineIndex = lineBuffer.indexOf("\n");
+    }
+  });
+  child.stderr.setEncoding("utf8");
+  child.stderr.on("data", (chunk) => {
+    stderr += chunk;
+    process.stderr.write(`[r5d-worker] pty helper: ${chunk}`);
+  });
+  child.on("error", (error) => {
+    emittedTerminalEvent = true;
+    options.onError(error);
+  });
+  child.on("exit", (code, signal) => {
+    if (emittedTerminalEvent) {
+      return;
+    }
+    const detail = stderr.trim() || `node pty helper exited with code ${code ?? "unknown"}${signal ? ` signal ${signal}` : ""}`;
+    options.onError(new Error(detail));
+  });
+  sendToChild({
+    type: "open",
+    file: options.file,
+    args: options.args,
+    options: options.ptyOptions
+  });
+  return {
+    write(data) {
+      sendToChild({ type: "input", data: Buffer.from(data, "utf8").toString("base64") });
+    },
+    resize(cols, rows) {
+      sendToChild({ type: "resize", cols, rows });
+    },
+    kill() {
+      sendToChild({ type: "close" });
+      setTimeout(() => {
+        if (!child.killed) {
+          child.kill();
+        }
+      }, 500);
+    }
+  };
+}
 function resolveHostShell() {
   if (process.platform === "win32") {
     return { file: process.env.COMSPEC || "powershell.exe", args: [] };
@@ -726,43 +1160,61 @@ function openPty(input) {
       baseUrl: input.baseUrl,
       token: input.token,
       projectRoot: input.projectRoot,
-      branchName: input.message.branchName
+      syncRoot: input.syncRoot,
+      branchName: input.message.branchName,
+      manifest: input.manifest
     });
     const shell = resolveHostShell();
-    const ptyProcess = nodePty.spawn(shell.file, shell.args, {
-      name: "xterm-256color",
-      cols: Math.max(1, Math.min(Math.floor(input.message.cols || 80), 500)),
-      rows: Math.max(1, Math.min(Math.floor(input.message.rows || 24), 500)),
-      cwd: branchPath,
-      env: {
-        ...process.env,
-        ...input.message.env ?? {},
-        BUILD_IT_NOW_PROJECT_ID: input.projectId,
-        BUILD_IT_NOW_BRANCH_NAME: input.message.branchName
+    const ptyProcess = createNodePtyBridge({
+      file: shell.file,
+      args: shell.args,
+      ptyOptions: {
+        name: "xterm-256color",
+        cols: Math.max(1, Math.min(Math.floor(input.message.cols || 80), 500)),
+        rows: Math.max(1, Math.min(Math.floor(input.message.rows || 24), 500)),
+        cwd: branchPath.branchPath,
+        env: {
+          ...process.env,
+          ...containerRegistryEnv(),
+          ...input.message.env ?? {},
+          BUILD_IT_NOW_PROJECT_ID: input.projectId,
+          BUILD_IT_NOW_BRANCH_NAME: input.message.branchName
+        }
+      },
+      onOpened: () => {
+        sendWorkerMessage(input.ws, {
+          type: "pty_opened",
+          requestId: input.message.requestId,
+          ptyId: input.message.ptyId
+        });
+      },
+      onOutput: (data) => {
+        sendWorkerMessage(input.ws, {
+          type: "pty_output",
+          ptyId: input.message.ptyId,
+          data
+        });
+      },
+      onExit: (event) => {
+        activePtys.delete(input.message.ptyId);
+        sendWorkerMessage(input.ws, {
+          type: "pty_exit",
+          ptyId: input.message.ptyId,
+          exitCode: event.exitCode,
+          signal: event.signal
+        });
+      },
+      onError: (error) => {
+        activePtys.delete(input.message.ptyId);
+        sendWorkerMessage(input.ws, {
+          type: "pty_error",
+          requestId: input.message.requestId,
+          ptyId: input.message.ptyId,
+          error: error.message
+        });
       }
     });
     activePtys.set(input.message.ptyId, ptyProcess);
-    ptyProcess.onData((data) => {
-      sendWorkerMessage(input.ws, {
-        type: "pty_output",
-        ptyId: input.message.ptyId,
-        data
-      });
-    });
-    ptyProcess.onExit((event) => {
-      activePtys.delete(input.message.ptyId);
-      sendWorkerMessage(input.ws, {
-        type: "pty_exit",
-        ptyId: input.message.ptyId,
-        exitCode: event.exitCode,
-        signal: event.signal
-      });
-    });
-    sendWorkerMessage(input.ws, {
-      type: "pty_opened",
-      requestId: input.message.requestId,
-      ptyId: input.message.ptyId
-    });
   } catch (error) {
     sendWorkerMessage(input.ws, {
       type: "pty_error",
@@ -808,32 +1260,36 @@ function closeAllPtys() {
   }
   activePtys.clear();
 }
-function websocketUrl(baseUrl, projectId, label) {
+function websocketUrl(baseUrl, label) {
   const url = new URL("/worker/ws", baseUrl);
   url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
-  url.searchParams.set("projectId", projectId);
   url.searchParams.set("label", label);
   return url.toString();
 }
-async function startWorker(projectId, options) {
+function projectRootFor(projectsRoot, projectId, manifestByProjectId) {
+  return path.join(projectsRoot, manifestByProjectId.get(projectId)?.repoSlug ?? projectId);
+}
+async function startWorker(options) {
   const config = readConfig(options.configPath);
   const { baseUrl, token } = resolveCredentials(options, config);
   const label = requireValue(options.label, "Missing required --label <label>");
   validateLabel(label);
-  const projectRoot = path.resolve(options.projectRoot ?? defaultProjectRoot(projectId));
-  process.stdout.write(`[r5d-worker] project: ${projectId}
-`);
+  const projectsRoot = path.resolve(options.projectRoot ?? defaultProjectsRoot());
+  const syncRoot = path.resolve(options.syncRoot ?? process.env.R5D_SYNC_ROOT ?? defaultSyncRoot());
   process.stdout.write(`[r5d-worker] label: ${label}
 `);
-  process.stdout.write(`[r5d-worker] root: ${projectRoot}
+  process.stdout.write(`[r5d-worker] projects root: ${projectsRoot}
+`);
+  process.stdout.write(`[r5d-worker] sync root: ${syncRoot}
 `);
   process.stdout.write(`[r5d-worker] server: ${baseUrl}
 `);
   runGit(["--version"]);
   await verifyBinctlAuth(baseUrl, token);
-  process.stdout.write("[r5d-worker] preparing local checkout...\n");
-  ensureMainClone({ projectId, baseUrl, token, projectRoot });
-  const ws = new WebSocket(websocketUrl(baseUrl, projectId, label), {
+  fs.mkdirSync(projectsRoot, { recursive: true });
+  fs.mkdirSync(syncRoot, { recursive: true });
+  const manifestByProjectId = /* @__PURE__ */ new Map();
+  const ws = new WebSocket(websocketUrl(baseUrl, label), {
     headers: {
       Authorization: `Bearer ${token}`
     }
@@ -847,7 +1303,7 @@ async function startWorker(projectId, options) {
         arch: process.arch,
         pid: process.pid,
         version: "0.1.0",
-        projectRoot
+        projectRoot: projectsRoot
       }
     };
     ws.send(JSON.stringify(hello));
@@ -859,6 +1315,40 @@ async function startWorker(projectId, options) {
       if (message.type === "connected") {
         return;
       }
+      if (message.type === "project_manifest") {
+        configureContainerRegistryAuth(message.githubContainerRegistry);
+        manifestByProjectId.clear();
+        for (const project of message.projects) {
+          manifestByProjectId.set(project.projectId, project);
+        }
+        process.stdout.write(`[r5d-worker] project manifest: ${message.projects.length} projects
+`);
+        for (const project of message.projects) {
+          const projectRoot = projectRootFor(projectsRoot, project.projectId, manifestByProjectId);
+          const branches = project.branches.length > 0 ? project.branches : [project.defaultBranch || "main"];
+          for (const branchName of branches) {
+            try {
+              await withBranchLock(project.projectId, branchName, async () => {
+                ensureBranchWorkspace({
+                  projectId: project.projectId,
+                  baseUrl,
+                  token,
+                  projectRoot,
+                  syncRoot,
+                  branchName,
+                  manifest: project
+                });
+              });
+            } catch (error) {
+              process.stderr.write(
+                `[r5d-worker] failed to sync ${project.repoSlug}/${branchName}: ${error instanceof Error ? error.message : String(error)}
+`
+              );
+            }
+          }
+        }
+        return;
+      }
       if (message.type === "ping") {
         ws.send(JSON.stringify({ type: "pong" }));
         return;
@@ -880,9 +1370,11 @@ async function startWorker(projectId, options) {
         return;
       }
       if (message.type === "pty_open") {
-        process.stdout.write(`[r5d-worker] pty ${message.ptyId}: ${message.branchName}
+        const manifest = manifestByProjectId.get(message.projectId);
+        const projectRoot = projectRootFor(projectsRoot, message.projectId, manifestByProjectId);
+        process.stdout.write(`[r5d-worker] pty ${message.ptyId}: ${message.projectId}/${message.branchName}
 `);
-        openPty({ ws, message, projectId, baseUrl, token, projectRoot });
+        openPty({ ws, message, projectId: message.projectId, baseUrl, token, projectRoot, syncRoot, manifest });
         return;
       }
       if (message.type === "pty_input") {
@@ -898,22 +1390,26 @@ async function startWorker(projectId, options) {
         return;
       }
       if (message.type === "exec") {
+        const manifest = manifestByProjectId.get(message.projectId);
+        const projectRoot = projectRootFor(projectsRoot, message.projectId, manifestByProjectId);
         process.stdout.write(`[r5d-worker] exec ${message.runId}: ${message.argv.join(" ")}
 `);
         const result = await withBranchLock(
-          projectRoot,
+          message.projectId,
           message.branchName,
-          () => executeCommand({ message, projectId, baseUrl, token, projectRoot })
+          () => executeCommand({ message, projectId: message.projectId, baseUrl, token, projectRoot, syncRoot, manifest })
         );
         ws.send(JSON.stringify(result));
         return;
       }
-      if (message.type === "read_file" || message.type === "create_file" || message.type === "edit_file" || message.type === "view_file_bytes" || message.type === "sync" || message.type === "pull_branch") {
+      if (message.type === "read_file" || message.type === "create_file" || message.type === "edit_file" || message.type === "view_file_bytes" || message.type === "sync" || message.type === "confirm_large_diff" || message.type === "pull_branch") {
         try {
+          const manifest = manifestByProjectId.get(message.projectId);
+          const projectRoot = projectRootFor(projectsRoot, message.projectId, manifestByProjectId);
           const result = await withBranchLock(
-            projectRoot,
+            message.projectId,
             message.branchName,
-            () => executeOperation({ message, projectId, baseUrl, token, projectRoot })
+            () => executeOperation({ message, projectId: message.projectId, baseUrl, token, projectRoot, syncRoot, manifest })
           );
           ws.send(
             JSON.stringify({
@@ -958,7 +1454,7 @@ async function main() {
     printHelp();
     return;
   }
-  await startWorker(parsed.projectId, parsed.options);
+  await startWorker(parsed.options);
 }
 main().catch((error) => {
   process.stderr.write(`[r5d-worker] ${error instanceof Error ? error.message : String(error)}