@ricsam/r5d-worker 0.0.24 → 0.0.26

package/README.md

@@ -15,7 +15,7 @@ The worker uses the existing `r5dctl` config file and accepts `R5D_WORKER_TOKEN`
 
 Web shells and agent shell commands receive a server-issued `r5dctl` credential automatically. The credential is scoped to the signed-in user and revoked when the shell or command finishes, so commands such as `r5dctl auth status` do not require a separate login on the worker host.
 
-Visible branch checkouts are the user/agent workbench. The worker may clone the connected GitHub `origin` during first setup, but ongoing pull/push/fetch/reset behavior is manual Git work. r5d internal sync git metadata lives separately under `~/.r5d/sync`.
+Visible branch checkouts are the user/agent workbench. Their `origin` remains the connected GitHub repository for manual Git work. r5d internal sync git metadata lives separately under `~/.r5d/sync`; when a worker connects, every idle registered branch is force-synchronized from that internal remote. The same destructive sync can be requested for a live worker from User Settings.
 
 Worker labels are mandatory and unique per user. Choose labels that describe host capabilities, such as `macos`, `linux`, `ios`, or `ec2-build`.
 

package/dist/cjs/main.cjs

@@ -30,11 +30,13 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var main_exports = {};
 __export(main_exports, {
   ensureVisibleGitCheckout: () => ensureVisibleGitCheckout,
+  findRepositorySyncBlockers: () => findRepositorySyncBlockers,
   isArtifactEnvPath: () => isArtifactEnvPath,
   prepareArtifactEnvForShell: () => prepareArtifactEnvForShell,
   preparePlanEnvForShell: () => preparePlanEnvForShell,
   resolveHostShell: () => resolveHostShell,
   resolveProjectFilePath: () => resolveProjectFilePath,
+  syncManifestProjectsFromInternal: () => syncManifestProjectsFromInternal,
   syncProjectPlans: () => syncProjectPlans,
   syncSessionArtifacts: () => syncSessionArtifacts
 });
@@ -627,6 +629,27 @@ function runGit(args, options = {}) {
   }
   return result.stdout.toString().trim();
 }
+async function runGitAsync(args, options = {}) {
+  const command = ["git", ...gitAuthArgs(options.auth), ...args];
+  const subprocess = Bun.spawn(command, {
+    cwd: options.cwd,
+    stdout: "pipe",
+    stderr: "pipe",
+    env: {
+      ...process.env,
+      GIT_TERMINAL_PROMPT: "0"
+    }
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([
+    collectStream(subprocess.stdout),
+    collectStream(subprocess.stderr),
+    subprocess.exited
+  ]);
+  if (exitCode !== 0) {
+    throw new Error(`git ${args.join(" ")} failed: ${stderr.trim() || stdout.trim() || `exit ${exitCode}`}`);
+  }
+  return stdout.trim();
+}
 function tryGit(args, options = {}) {
   try {
     runGit(args, options);
@@ -635,9 +658,20 @@ function tryGit(args, options = {}) {
     return false;
   }
 }
+async function tryGitAsync(args, options = {}) {
+  try {
+    await runGitAsync(args, options);
+    return true;
+  } catch {
+    return false;
+  }
+}
 function runInternalGit(context, args) {
   return runGit(["--git-dir", context.gitDir, "--work-tree", context.workTree, ...args], { auth: context.auth });
 }
+function runInternalGitAsync(context, args) {
+  return runGitAsync(["--git-dir", context.gitDir, "--work-tree", context.workTree, ...args], { auth: context.auth });
+}
 function runInternalGitDir(context, args) {
   return runGit(["--git-dir", context.gitDir, ...args], { auth: context.auth });
 }
@@ -754,6 +788,13 @@ function ensureOriginRemote(branchPath, remoteUrl) {
     runGit(["remote", "add", "origin", remoteUrl], { cwd: branchPath });
   }
 }
+async function ensureOriginRemoteAsync(branchPath, remoteUrl) {
+  if (await tryGitAsync(["remote", "get-url", "origin"], { cwd: branchPath })) {
+    await runGitAsync(["remote", "set-url", "origin", remoteUrl], { cwd: branchPath });
+  } else {
+    await runGitAsync(["remote", "add", "origin", remoteUrl], { cwd: branchPath });
+  }
+}
 function shellQuote(value) {
   return `'${value.replace(/'/g, "'\\''")}'`;
 }
@@ -926,6 +967,9 @@ function ensureVisibleGitCheckout(input) {
     checkoutVisibleBranch({ branchPath, branchName: input.branchName, defaultBranch: input.defaultBranch });
     return branchPath;
   }
+  if (input.reconcileExistingOrigin) {
+    ensureOriginRemote(branchPath, input.githubRemoteUrl);
+  }
   configureVisibleGitHubAuth(branchPath, input.githubRemoteUrl, input.githubAuthHeader);
   (0, import_git_identity.configureVisibleGitIdentity)(branchPath, visibleGitIdentity, runGit);
   return branchPath;
@@ -972,7 +1016,8 @@ function ensureBranchWorkspace(input) {
     githubRemoteUrl,
     githubAuth,
     githubAuthHeader: input.manifest?.repoAuthHeader ?? null,
-    defaultBranch
+    defaultBranch,
+    reconcileExistingOrigin: Boolean(input.manifest?.repoHttpUrl)
   });
   const internalGit = ensureInternalSyncGit({
     projectId: input.projectId,
@@ -985,6 +1030,140 @@ function ensureBranchWorkspace(input) {
   });
   return { branchPath, internalGit };
 }
+async function ensureVisibleGitCheckoutForRepositorySync(input) {
+  validateBranchName(input.branchName);
+  import_node_fs.default.mkdirSync(input.projectRoot, { recursive: true });
+  const branchPath = import_node_path.default.join(input.projectRoot, input.branchName);
+  const createdCheckout = !hasNormalVisibleGitDir(branchPath);
+  if (createdCheckout) {
+    import_node_fs.default.rmSync(branchPath, { recursive: true, force: true });
+    import_node_fs.default.mkdirSync(import_node_path.default.dirname(branchPath), { recursive: true });
+    if (!await tryGitAsync(["clone", "--origin", "origin", input.githubRemoteUrl, branchPath], { auth: input.githubAuth })) {
+      import_node_fs.default.mkdirSync(branchPath, { recursive: true });
+      await runGitAsync(["init"], { cwd: branchPath });
+    }
+    await ensureOriginRemoteAsync(branchPath, input.githubRemoteUrl);
+    configureVisibleGitHubAuth(branchPath, input.githubRemoteUrl, input.githubAuthHeader);
+    (0, import_git_identity.configureVisibleGitIdentity)(branchPath, visibleGitIdentity, runGit);
+    await tryGitAsync(["fetch", "origin", "--prune"], { cwd: branchPath, auth: input.githubAuth });
+    checkoutVisibleBranch({ branchPath, branchName: input.branchName, defaultBranch: input.defaultBranch });
+    return branchPath;
+  }
+  if (input.reconcileExistingOrigin) {
+    await ensureOriginRemoteAsync(branchPath, input.githubRemoteUrl);
+  }
+  configureVisibleGitHubAuth(branchPath, input.githubRemoteUrl, input.githubAuthHeader);
+  (0, import_git_identity.configureVisibleGitIdentity)(branchPath, visibleGitIdentity, runGit);
+  return branchPath;
+}
+async function forceSyncManifestBranchFromInternal(input) {
+  const githubRemoteUrl = githubRemoteUrlFor(input.baseUrl, input.projectId, input.manifest);
+  const githubAuth = gitAuthForRemote(githubRemoteUrl, input.manifest.repoAuthHeader);
+  const branchPath = await ensureVisibleGitCheckoutForRepositorySync({
+    projectRoot: input.projectRoot,
+    branchName: input.branchName,
+    githubRemoteUrl,
+    githubAuth,
+    githubAuthHeader: input.manifest.repoAuthHeader,
+    defaultBranch: input.manifest.defaultBranch || "main",
+    reconcileExistingOrigin: Boolean(input.manifest.repoHttpUrl)
+  });
+  const gitDir = internalGitDirFor(input.syncRoot, input.projectId, input.branchName);
+  import_node_fs.default.mkdirSync(import_node_path.default.dirname(gitDir), { recursive: true });
+  if (!import_node_fs.default.existsSync(gitDir)) {
+    await runGitAsync(["init", "--bare", gitDir]);
+  }
+  const context = {
+    gitDir,
+    workTree: branchPath,
+    auth: internalGitAuth(input.baseUrl, input.token)
+  };
+  configureInternalRepo(context, internalRemoteUrlFor(input.baseUrl, input.projectId, input.manifest));
+  await runInternalGitAsync(context, ["fetch", R5D_REMOTE_NAME, "--prune", `+refs/heads/*:refs/remotes/${R5D_REMOTE_NAME}/*`]);
+  const branchTarget = `refs/remotes/${R5D_REMOTE_NAME}/${input.branchName}`;
+  const mainTarget = `refs/remotes/${R5D_REMOTE_NAME}/main`;
+  const target = tryInternalGit(context, ["show-ref", "--verify", "--quiet", branchTarget]) ? branchTarget : tryInternalGit(context, ["show-ref", "--verify", "--quiet", mainTarget]) ? mainTarget : null;
+  if (!target) {
+    throw new Error(`Internal remote has neither ${input.branchName} nor main`);
+  }
+  await runInternalGitAsync(context, ["reset", "--hard", target]);
+  await runInternalGitAsync(context, ["clean", "-fd", "--", ".", ":(exclude).git"]);
+  return getInternalCommitHash(context);
+}
+function findRepositorySyncBlockers(input) {
+  const targetByKey = new Map(input.targets.map((target) => [`${target.projectId}:${target.branchName}`, target]));
+  const blockedBy = [];
+  for (const process2 of input.processes) {
+    const target = targetByKey.get(`${process2.projectId}:${process2.branchName}`);
+    if (target) blockedBy.push({ ...target, kind: "process", id: process2.id });
+  }
+  for (const shell of input.shells) {
+    const target = targetByKey.get(`${shell.projectId}:${shell.branchName}`);
+    if (target) blockedBy.push({ ...target, kind: "shell", id: shell.id });
+  }
+  return blockedBy;
+}
+async function syncManifestProjectsFromInternal(input) {
+  const requestedProjectIds = input.projectIds ? new Set(input.projectIds) : null;
+  const targets = input.manifests.filter((manifest) => !requestedProjectIds || requestedProjectIds.has(manifest.projectId)).flatMap((manifest) => {
+    const branches = manifest.branches.length > 0 ? manifest.branches : [manifest.defaultBranch || "main"];
+    return [...new Set(branches)].map((branchName) => ({ manifest, branchName }));
+  });
+  const blockedBy = findRepositorySyncBlockers({
+    targets: targets.map(({ manifest, branchName }) => ({
+      projectId: manifest.projectId,
+      projectPath: manifest.projectPath,
+      branchName
+    })),
+    processes: [...activeProcesses].map(([id, active]) => ({
+      id,
+      projectId: active.projectId,
+      branchName: active.branchName
+    })),
+    shells: [...activePtys].map(([id, active]) => ({
+      id,
+      projectId: active.projectId,
+      branchName: active.branchName
+    }))
+  });
+  if (blockedBy.length > 0) {
+    return { status: "blocked", results: [], blockedBy };
+  }
+  const results = [];
+  for (const { manifest, branchName } of targets) {
+    try {
+      const commitHash = await forceSyncManifestBranchFromInternal({
+        projectId: manifest.projectId,
+        baseUrl: input.baseUrl,
+        token: input.token,
+        projectRoot: import_node_path.default.join(input.projectsRoot, manifest.repoSlug || manifest.projectId),
+        syncRoot: input.syncRoot,
+        branchName,
+        manifest
+      });
+      results.push({
+        projectId: manifest.projectId,
+        projectPath: manifest.projectPath,
+        branchName,
+        status: "synced",
+        commitHash
+      });
+    } catch (error) {
+      results.push({
+        projectId: manifest.projectId,
+        projectPath: manifest.projectPath,
+        branchName,
+        status: "failed",
+        error: error instanceof Error ? error.message : String(error)
+      });
+    }
+  }
+  return {
+    status: results.some((result) => result.status === "failed") ? "partial" : "completed",
+    results,
+    blockedBy: []
+  };
+}
 function resolveCommandCwd(branchPath, cwd) {
   if (!cwd) {
     return branchPath;
@@ -1747,6 +1926,7 @@ async function executeStreamingCommand(input) {
       projectId: input.projectId,
       sessionId: input.message.sessionId,
       branchName: input.message.branchName,
+      credentialId: input.message.credentialId,
       argv: input.message.argv,
       command: input.message.command,
       cwd: input.message.cwd,
@@ -1820,6 +2000,7 @@ function buildActiveProcessReports() {
     projectId: active.projectId,
     sessionId: active.sessionId,
     branchName: active.branchName,
+    ...active.credentialId ? { credentialId: active.credentialId } : {},
     argv: active.argv,
     command: active.command,
     ...active.cwd ? { cwd: active.cwd } : {},
@@ -2089,7 +2270,11 @@ async function openPty(input) {
         });
       }
     });
-    activePtys.set(input.message.ptyId, ptyProcess);
+    activePtys.set(input.message.ptyId, {
+      ...ptyProcess,
+      projectId: input.projectId,
+      branchName: input.message.branchName
+    });
   } catch (error) {
     sendWorkerMessage(input.ws, {
       type: "pty_error",
@@ -2172,6 +2357,7 @@ async function startWorker(options) {
   import_node_fs.default.mkdirSync(artifactRoot, { recursive: true });
   import_node_fs.default.mkdirSync(planRoot, { recursive: true });
   const manifestByProjectId = /* @__PURE__ */ new Map();
+  let repositorySyncQueue = Promise.resolve();
   const ws = new WebSocket(websocketUrl(baseUrl, label), {
     headers: {
       Authorization: `Bearer ${token}`
@@ -2229,42 +2415,64 @@ async function startWorker(options) {
         }
         process.stdout.write(`[r5d-worker] project manifest: ${message.projects.length} projects
 `);
-        for (const project of message.projects) {
-          const projectRoot = projectRootFor(projectsRoot, project.projectId, manifestByProjectId);
-          const branches = project.branches.length > 0 ? project.branches : [project.defaultBranch || "main"];
-          for (const branchName of branches) {
+        return;
+      }
+      if (message.type === "sync_projects") {
+        let syncResult = { status: "completed", results: [], blockedBy: [] };
+        const executeSync = async () => {
+          syncResult = await syncManifestProjectsFromInternal({
+            baseUrl,
+            token,
+            projectsRoot,
+            syncRoot,
+            manifests: [...manifestByProjectId.values()],
+            projectIds: message.projectIds
+          });
+          for (const result of syncResult.results) {
+            if (result.status !== "synced") continue;
             try {
-              ensureBranchWorkspace({
-                projectId: project.projectId,
+              await syncProjectPlans({
                 baseUrl,
                 token,
-                projectRoot,
-                syncRoot,
-                branchName,
-                manifest: project
+                projectId: result.projectId,
+                branchName: result.branchName,
+                planRoot
               });
-              try {
-                await syncProjectPlans({
-                  baseUrl,
-                  token,
-                  projectId: project.projectId,
-                  branchName,
-                  planRoot
-                });
-              } catch (error) {
-                process.stderr.write(
-                  `[r5d-worker] plan sync skipped for ${project.projectId}/${branchName}: ${error instanceof Error ? error.message : String(error)}
-`
-                );
-              }
             } catch (error) {
               process.stderr.write(
-                `[r5d-worker] failed to sync ${project.repoSlug}/${branchName}: ${error instanceof Error ? error.message : String(error)}
+                `[r5d-worker] plan sync skipped for ${result.projectId}/${result.branchName}: ${error instanceof Error ? error.message : String(error)}
 `
               );
             }
           }
+        };
+        const queued = repositorySyncQueue.then(executeSync, executeSync);
+        repositorySyncQueue = queued.then(
+          () => void 0,
+          () => void 0
+        );
+        try {
+          await queued;
+        } catch (error) {
+          syncResult = {
+            status: "partial",
+            results: [
+              {
+                projectId: "worker",
+                projectPath: "worker",
+                branchName: "all",
+                status: "failed",
+                error: error instanceof Error ? error.message : String(error)
+              }
+            ],
+            blockedBy: []
+          };
         }
+        sendWorkerMessage(ws, {
+          type: "sync_projects_result",
+          requestId: message.requestId,
+          result: syncResult
+        });
         return;
       }
       if (message.type === "ping") {
@@ -2291,6 +2499,7 @@ async function startWorker(options) {
         return;
       }
       if (message.type === "pty_open") {
+        await repositorySyncQueue;
         const manifest = manifestByProjectId.get(message.projectId);
         const projectRoot = projectRootFor(projectsRoot, message.projectId, manifestByProjectId);
         process.stdout.write(`[r5d-worker] pty ${message.ptyId}: ${message.projectId}/${message.branchName}
@@ -2311,6 +2520,7 @@ async function startWorker(options) {
         return;
       }
       if (message.type === "exec") {
+        await repositorySyncQueue;
         const manifest = manifestByProjectId.get(message.projectId);
         const projectRoot = projectRootFor(projectsRoot, message.projectId, manifestByProjectId);
         process.stdout.write(`[r5d-worker] exec ${message.runId}: ${message.argv.join(" ")}
@@ -2330,6 +2540,7 @@ async function startWorker(options) {
         return;
       }
       if (message.type === "exec_start") {
+        await repositorySyncQueue;
         sendWorkerMessage(ws, {
           type: "exec_accepted",
           requestId: message.requestId,
@@ -2371,6 +2582,7 @@ async function startWorker(options) {
       }
       if (message.type === "read" || message.type === "write" || message.type === "edit" || message.type === "grep" || message.type === "find" || message.type === "ls" || message.type === "view_file_bytes" || message.type === "sync" || message.type === "confirm_large_diff" || message.type === "pull_branch") {
         try {
+          await repositorySyncQueue;
           const manifest = manifestByProjectId.get(message.projectId);
           const projectRoot = projectRootFor(projectsRoot, message.projectId, manifestByProjectId);
           const result = await executeOperation({
@@ -2481,11 +2693,13 @@ if (isCliEntrypoint()) {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ensureVisibleGitCheckout,
+  findRepositorySyncBlockers,
   isArtifactEnvPath,
   prepareArtifactEnvForShell,
   preparePlanEnvForShell,
   resolveHostShell,
   resolveProjectFilePath,
+  syncManifestProjectsFromInternal,
   syncProjectPlans,
   syncSessionArtifacts
 });

package/dist/cjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.24",
+  "version": "0.0.26",
   "type": "commonjs"
 }

package/dist/mjs/main.mjs

@@ -586,6 +586,27 @@ function runGit(args, options = {}) {
   }
   return result.stdout.toString().trim();
 }
+async function runGitAsync(args, options = {}) {
+  const command = ["git", ...gitAuthArgs(options.auth), ...args];
+  const subprocess = Bun.spawn(command, {
+    cwd: options.cwd,
+    stdout: "pipe",
+    stderr: "pipe",
+    env: {
+      ...process.env,
+      GIT_TERMINAL_PROMPT: "0"
+    }
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([
+    collectStream(subprocess.stdout),
+    collectStream(subprocess.stderr),
+    subprocess.exited
+  ]);
+  if (exitCode !== 0) {
+    throw new Error(`git ${args.join(" ")} failed: ${stderr.trim() || stdout.trim() || `exit ${exitCode}`}`);
+  }
+  return stdout.trim();
+}
 function tryGit(args, options = {}) {
   try {
     runGit(args, options);
@@ -594,9 +615,20 @@ function tryGit(args, options = {}) {
     return false;
   }
 }
+async function tryGitAsync(args, options = {}) {
+  try {
+    await runGitAsync(args, options);
+    return true;
+  } catch {
+    return false;
+  }
+}
 function runInternalGit(context, args) {
   return runGit(["--git-dir", context.gitDir, "--work-tree", context.workTree, ...args], { auth: context.auth });
 }
+function runInternalGitAsync(context, args) {
+  return runGitAsync(["--git-dir", context.gitDir, "--work-tree", context.workTree, ...args], { auth: context.auth });
+}
 function runInternalGitDir(context, args) {
   return runGit(["--git-dir", context.gitDir, ...args], { auth: context.auth });
 }
@@ -713,6 +745,13 @@ function ensureOriginRemote(branchPath, remoteUrl) {
     runGit(["remote", "add", "origin", remoteUrl], { cwd: branchPath });
   }
 }
+async function ensureOriginRemoteAsync(branchPath, remoteUrl) {
+  if (await tryGitAsync(["remote", "get-url", "origin"], { cwd: branchPath })) {
+    await runGitAsync(["remote", "set-url", "origin", remoteUrl], { cwd: branchPath });
+  } else {
+    await runGitAsync(["remote", "add", "origin", remoteUrl], { cwd: branchPath });
+  }
+}
 function shellQuote(value) {
   return `'${value.replace(/'/g, "'\\''")}'`;
 }
@@ -885,6 +924,9 @@ function ensureVisibleGitCheckout(input) {
     checkoutVisibleBranch({ branchPath, branchName: input.branchName, defaultBranch: input.defaultBranch });
     return branchPath;
   }
+  if (input.reconcileExistingOrigin) {
+    ensureOriginRemote(branchPath, input.githubRemoteUrl);
+  }
   configureVisibleGitHubAuth(branchPath, input.githubRemoteUrl, input.githubAuthHeader);
   configureVisibleGitIdentity(branchPath, visibleGitIdentity, runGit);
   return branchPath;
@@ -931,7 +973,8 @@ function ensureBranchWorkspace(input) {
     githubRemoteUrl,
     githubAuth,
     githubAuthHeader: input.manifest?.repoAuthHeader ?? null,
-    defaultBranch
+    defaultBranch,
+    reconcileExistingOrigin: Boolean(input.manifest?.repoHttpUrl)
   });
   const internalGit = ensureInternalSyncGit({
     projectId: input.projectId,
@@ -944,6 +987,140 @@ function ensureBranchWorkspace(input) {
   });
   return { branchPath, internalGit };
 }
+async function ensureVisibleGitCheckoutForRepositorySync(input) {
+  validateBranchName(input.branchName);
+  fs.mkdirSync(input.projectRoot, { recursive: true });
+  const branchPath = path.join(input.projectRoot, input.branchName);
+  const createdCheckout = !hasNormalVisibleGitDir(branchPath);
+  if (createdCheckout) {
+    fs.rmSync(branchPath, { recursive: true, force: true });
+    fs.mkdirSync(path.dirname(branchPath), { recursive: true });
+    if (!await tryGitAsync(["clone", "--origin", "origin", input.githubRemoteUrl, branchPath], { auth: input.githubAuth })) {
+      fs.mkdirSync(branchPath, { recursive: true });
+      await runGitAsync(["init"], { cwd: branchPath });
+    }
+    await ensureOriginRemoteAsync(branchPath, input.githubRemoteUrl);
+    configureVisibleGitHubAuth(branchPath, input.githubRemoteUrl, input.githubAuthHeader);
+    configureVisibleGitIdentity(branchPath, visibleGitIdentity, runGit);
+    await tryGitAsync(["fetch", "origin", "--prune"], { cwd: branchPath, auth: input.githubAuth });
+    checkoutVisibleBranch({ branchPath, branchName: input.branchName, defaultBranch: input.defaultBranch });
+    return branchPath;
+  }
+  if (input.reconcileExistingOrigin) {
+    await ensureOriginRemoteAsync(branchPath, input.githubRemoteUrl);
+  }
+  configureVisibleGitHubAuth(branchPath, input.githubRemoteUrl, input.githubAuthHeader);
+  configureVisibleGitIdentity(branchPath, visibleGitIdentity, runGit);
+  return branchPath;
+}
+async function forceSyncManifestBranchFromInternal(input) {
+  const githubRemoteUrl = githubRemoteUrlFor(input.baseUrl, input.projectId, input.manifest);
+  const githubAuth = gitAuthForRemote(githubRemoteUrl, input.manifest.repoAuthHeader);
+  const branchPath = await ensureVisibleGitCheckoutForRepositorySync({
+    projectRoot: input.projectRoot,
+    branchName: input.branchName,
+    githubRemoteUrl,
+    githubAuth,
+    githubAuthHeader: input.manifest.repoAuthHeader,
+    defaultBranch: input.manifest.defaultBranch || "main",
+    reconcileExistingOrigin: Boolean(input.manifest.repoHttpUrl)
+  });
+  const gitDir = internalGitDirFor(input.syncRoot, input.projectId, input.branchName);
+  fs.mkdirSync(path.dirname(gitDir), { recursive: true });
+  if (!fs.existsSync(gitDir)) {
+    await runGitAsync(["init", "--bare", gitDir]);
+  }
+  const context = {
+    gitDir,
+    workTree: branchPath,
+    auth: internalGitAuth(input.baseUrl, input.token)
+  };
+  configureInternalRepo(context, internalRemoteUrlFor(input.baseUrl, input.projectId, input.manifest));
+  await runInternalGitAsync(context, ["fetch", R5D_REMOTE_NAME, "--prune", `+refs/heads/*:refs/remotes/${R5D_REMOTE_NAME}/*`]);
+  const branchTarget = `refs/remotes/${R5D_REMOTE_NAME}/${input.branchName}`;
+  const mainTarget = `refs/remotes/${R5D_REMOTE_NAME}/main`;
+  const target = tryInternalGit(context, ["show-ref", "--verify", "--quiet", branchTarget]) ? branchTarget : tryInternalGit(context, ["show-ref", "--verify", "--quiet", mainTarget]) ? mainTarget : null;
+  if (!target) {
+    throw new Error(`Internal remote has neither ${input.branchName} nor main`);
+  }
+  await runInternalGitAsync(context, ["reset", "--hard", target]);
+  await runInternalGitAsync(context, ["clean", "-fd", "--", ".", ":(exclude).git"]);
+  return getInternalCommitHash(context);
+}
+function findRepositorySyncBlockers(input) {
+  const targetByKey = new Map(input.targets.map((target) => [`${target.projectId}:${target.branchName}`, target]));
+  const blockedBy = [];
+  for (const process2 of input.processes) {
+    const target = targetByKey.get(`${process2.projectId}:${process2.branchName}`);
+    if (target) blockedBy.push({ ...target, kind: "process", id: process2.id });
+  }
+  for (const shell of input.shells) {
+    const target = targetByKey.get(`${shell.projectId}:${shell.branchName}`);
+    if (target) blockedBy.push({ ...target, kind: "shell", id: shell.id });
+  }
+  return blockedBy;
+}
+async function syncManifestProjectsFromInternal(input) {
+  const requestedProjectIds = input.projectIds ? new Set(input.projectIds) : null;
+  const targets = input.manifests.filter((manifest) => !requestedProjectIds || requestedProjectIds.has(manifest.projectId)).flatMap((manifest) => {
+    const branches = manifest.branches.length > 0 ? manifest.branches : [manifest.defaultBranch || "main"];
+    return [...new Set(branches)].map((branchName) => ({ manifest, branchName }));
+  });
+  const blockedBy = findRepositorySyncBlockers({
+    targets: targets.map(({ manifest, branchName }) => ({
+      projectId: manifest.projectId,
+      projectPath: manifest.projectPath,
+      branchName
+    })),
+    processes: [...activeProcesses].map(([id, active]) => ({
+      id,
+      projectId: active.projectId,
+      branchName: active.branchName
+    })),
+    shells: [...activePtys].map(([id, active]) => ({
+      id,
+      projectId: active.projectId,
+      branchName: active.branchName
+    }))
+  });
+  if (blockedBy.length > 0) {
+    return { status: "blocked", results: [], blockedBy };
+  }
+  const results = [];
+  for (const { manifest, branchName } of targets) {
+    try {
+      const commitHash = await forceSyncManifestBranchFromInternal({
+        projectId: manifest.projectId,
+        baseUrl: input.baseUrl,
+        token: input.token,
+        projectRoot: path.join(input.projectsRoot, manifest.repoSlug || manifest.projectId),
+        syncRoot: input.syncRoot,
+        branchName,
+        manifest
+      });
+      results.push({
+        projectId: manifest.projectId,
+        projectPath: manifest.projectPath,
+        branchName,
+        status: "synced",
+        commitHash
+      });
+    } catch (error) {
+      results.push({
+        projectId: manifest.projectId,
+        projectPath: manifest.projectPath,
+        branchName,
+        status: "failed",
+        error: error instanceof Error ? error.message : String(error)
+      });
+    }
+  }
+  return {
+    status: results.some((result) => result.status === "failed") ? "partial" : "completed",
+    results,
+    blockedBy: []
+  };
+}
 function resolveCommandCwd(branchPath, cwd) {
   if (!cwd) {
     return branchPath;
@@ -1706,6 +1883,7 @@ async function executeStreamingCommand(input) {
       projectId: input.projectId,
       sessionId: input.message.sessionId,
       branchName: input.message.branchName,
+      credentialId: input.message.credentialId,
       argv: input.message.argv,
       command: input.message.command,
       cwd: input.message.cwd,
@@ -1779,6 +1957,7 @@ function buildActiveProcessReports() {
     projectId: active.projectId,
     sessionId: active.sessionId,
     branchName: active.branchName,
+    ...active.credentialId ? { credentialId: active.credentialId } : {},
     argv: active.argv,
     command: active.command,
     ...active.cwd ? { cwd: active.cwd } : {},
@@ -2048,7 +2227,11 @@ async function openPty(input) {
         });
       }
     });
-    activePtys.set(input.message.ptyId, ptyProcess);
+    activePtys.set(input.message.ptyId, {
+      ...ptyProcess,
+      projectId: input.projectId,
+      branchName: input.message.branchName
+    });
   } catch (error) {
     sendWorkerMessage(input.ws, {
       type: "pty_error",
@@ -2131,6 +2314,7 @@ async function startWorker(options) {
   fs.mkdirSync(artifactRoot, { recursive: true });
   fs.mkdirSync(planRoot, { recursive: true });
   const manifestByProjectId = /* @__PURE__ */ new Map();
+  let repositorySyncQueue = Promise.resolve();
   const ws = new WebSocket(websocketUrl(baseUrl, label), {
     headers: {
       Authorization: `Bearer ${token}`
@@ -2188,42 +2372,64 @@ async function startWorker(options) {
         }
         process.stdout.write(`[r5d-worker] project manifest: ${message.projects.length} projects
 `);
-        for (const project of message.projects) {
-          const projectRoot = projectRootFor(projectsRoot, project.projectId, manifestByProjectId);
-          const branches = project.branches.length > 0 ? project.branches : [project.defaultBranch || "main"];
-          for (const branchName of branches) {
+        return;
+      }
+      if (message.type === "sync_projects") {
+        let syncResult = { status: "completed", results: [], blockedBy: [] };
+        const executeSync = async () => {
+          syncResult = await syncManifestProjectsFromInternal({
+            baseUrl,
+            token,
+            projectsRoot,
+            syncRoot,
+            manifests: [...manifestByProjectId.values()],
+            projectIds: message.projectIds
+          });
+          for (const result of syncResult.results) {
+            if (result.status !== "synced") continue;
             try {
-              ensureBranchWorkspace({
-                projectId: project.projectId,
+              await syncProjectPlans({
                 baseUrl,
                 token,
-                projectRoot,
-                syncRoot,
-                branchName,
-                manifest: project
+                projectId: result.projectId,
+                branchName: result.branchName,
+                planRoot
               });
-              try {
-                await syncProjectPlans({
-                  baseUrl,
-                  token,
-                  projectId: project.projectId,
-                  branchName,
-                  planRoot
-                });
-              } catch (error) {
-                process.stderr.write(
-                  `[r5d-worker] plan sync skipped for ${project.projectId}/${branchName}: ${error instanceof Error ? error.message : String(error)}
-`
-                );
-              }
             } catch (error) {
               process.stderr.write(
-                `[r5d-worker] failed to sync ${project.repoSlug}/${branchName}: ${error instanceof Error ? error.message : String(error)}
+                `[r5d-worker] plan sync skipped for ${result.projectId}/${result.branchName}: ${error instanceof Error ? error.message : String(error)}
 `
               );
             }
           }
+        };
+        const queued = repositorySyncQueue.then(executeSync, executeSync);
+        repositorySyncQueue = queued.then(
+          () => void 0,
+          () => void 0
+        );
+        try {
+          await queued;
+        } catch (error) {
+          syncResult = {
+            status: "partial",
+            results: [
+              {
+                projectId: "worker",
+                projectPath: "worker",
+                branchName: "all",
+                status: "failed",
+                error: error instanceof Error ? error.message : String(error)
+              }
+            ],
+            blockedBy: []
+          };
         }
+        sendWorkerMessage(ws, {
+          type: "sync_projects_result",
+          requestId: message.requestId,
+          result: syncResult
+        });
         return;
       }
       if (message.type === "ping") {
@@ -2250,6 +2456,7 @@ async function startWorker(options) {
         return;
       }
       if (message.type === "pty_open") {
+        await repositorySyncQueue;
         const manifest = manifestByProjectId.get(message.projectId);
         const projectRoot = projectRootFor(projectsRoot, message.projectId, manifestByProjectId);
         process.stdout.write(`[r5d-worker] pty ${message.ptyId}: ${message.projectId}/${message.branchName}
@@ -2270,6 +2477,7 @@ async function startWorker(options) {
         return;
       }
       if (message.type === "exec") {
+        await repositorySyncQueue;
         const manifest = manifestByProjectId.get(message.projectId);
         const projectRoot = projectRootFor(projectsRoot, message.projectId, manifestByProjectId);
         process.stdout.write(`[r5d-worker] exec ${message.runId}: ${message.argv.join(" ")}
@@ -2289,6 +2497,7 @@ async function startWorker(options) {
         return;
       }
       if (message.type === "exec_start") {
+        await repositorySyncQueue;
         sendWorkerMessage(ws, {
           type: "exec_accepted",
           requestId: message.requestId,
@@ -2330,6 +2539,7 @@ async function startWorker(options) {
       }
       if (message.type === "read" || message.type === "write" || message.type === "edit" || message.type === "grep" || message.type === "find" || message.type === "ls" || message.type === "view_file_bytes" || message.type === "sync" || message.type === "confirm_large_diff" || message.type === "pull_branch") {
         try {
+          await repositorySyncQueue;
           const manifest = manifestByProjectId.get(message.projectId);
           const projectRoot = projectRootFor(projectsRoot, message.projectId, manifestByProjectId);
           const result = await executeOperation({
@@ -2439,11 +2649,13 @@ if (isCliEntrypoint()) {
 }
 export {
   ensureVisibleGitCheckout,
+  findRepositorySyncBlockers,
   isArtifactEnvPath,
   prepareArtifactEnvForShell,
   preparePlanEnvForShell,
   resolveHostShell,
   resolveProjectFilePath,
+  syncManifestProjectsFromInternal,
   syncProjectPlans,
   syncSessionArtifacts
 };

package/dist/mjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.24",
+  "version": "0.0.26",
   "type": "module"
 }

package/dist/types/main.d.ts

@@ -1,4 +1,33 @@
 #!/usr/bin/env bun
+type WorkerProjectManifestEntry = {
+    projectId: string;
+    repoSlug: string;
+    projectPath: string;
+    repoHttpUrl: string | null;
+    repoAuthHeader: string | null;
+    defaultBranch: string;
+    branches: string[];
+    internalRemoteUrl: string;
+};
+type WorkerRepositorySyncTarget = {
+    projectId: string;
+    projectPath: string;
+    branchName: string;
+};
+type WorkerRepositorySyncResult = {
+    status: "completed" | "partial" | "blocked";
+    results: Array<WorkerRepositorySyncTarget & ({
+        status: "synced";
+        commitHash: string;
+    } | {
+        status: "failed";
+        error: string;
+    })>;
+    blockedBy: Array<WorkerRepositorySyncTarget & {
+        kind: "process" | "shell";
+        id: string;
+    }>;
+};
 export declare function isArtifactEnvPath(filePath: string): boolean;
 export declare function syncSessionArtifacts(input: {
     baseUrl: string;
@@ -47,7 +76,29 @@ export declare function ensureVisibleGitCheckout(input: {
     githubAuth?: GitAuth;
     githubAuthHeader?: string | null;
     defaultBranch: string;
+    reconcileExistingOrigin?: boolean;
 }): string;
+export declare function findRepositorySyncBlockers(input: {
+    targets: WorkerRepositorySyncTarget[];
+    processes: Array<{
+        id: string;
+        projectId: string;
+        branchName: string;
+    }>;
+    shells: Array<{
+        id: string;
+        projectId: string;
+        branchName: string;
+    }>;
+}): WorkerRepositorySyncResult["blockedBy"];
+export declare function syncManifestProjectsFromInternal(input: {
+    baseUrl: string;
+    token: string;
+    projectsRoot: string;
+    syncRoot: string;
+    manifests: WorkerProjectManifestEntry[];
+    projectIds?: string[];
+}): Promise<WorkerRepositorySyncResult>;
 export declare function resolveHostShell(command?: string, platform?: NodeJS.Platform): {
     file: string;
     args: string[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.24",
+  "version": "0.0.26",
   "type": "module",
   "main": "./dist/cjs/main.cjs",
   "module": "./dist/mjs/main.mjs",