@ricsam/r5d-worker 0.0.32 → 0.0.34

package/README.md

@@ -15,6 +15,8 @@ The worker uses the existing `r5dctl` config file and accepts `R5D_WORKER_TOKEN`
 
 Web shells and agent shell commands receive a server-issued `r5dctl` credential automatically. The credential is scoped to the signed-in user and revoked when the shell or command finishes, so commands such as `r5dctl auth status` do not require a separate login on the worker host.
 
+When the user has signed in with GitHub, web shells and agent commands also receive that OAuth credential through `GH_TOKEN`. GitHub CLI commands such as `gh pr`, `gh issue`, and `gh workflow` therefore use the signed-in user's permissions without a separate `gh auth login` on the worker host. Signing in again refreshes the granted OAuth scopes for subsequently started commands and shells.
+
 Visible branch checkouts are the user/agent workbench. Their `origin` remains the connected GitHub repository for manual Git work. r5d internal sync git metadata lives separately under `~/.r5d/sync`; when a worker connects, every idle registered branch is force-synchronized from that internal remote. The same destructive sync can be requested for a live worker from User Settings.
 
 Worker labels are mandatory and unique per user. Choose labels that describe host capabilities, such as `macos`, `linux`, `ios`, or `ec2-build`.

package/dist/cjs/main.cjs

@@ -32,6 +32,7 @@ __export(main_exports, {
   ensureVisibleGitCheckout: () => ensureVisibleGitCheckout,
   findRepositorySyncBlockers: () => findRepositorySyncBlockers,
   findWorkerFiles: () => findWorkerFiles,
+  githubCliEnv: () => githubCliEnv,
   grepWorkerFiles: () => grepWorkerFiles,
   isArtifactEnvPath: () => isArtifactEnvPath,
   listWorkerDirectory: () => listWorkerDirectory,
@@ -42,6 +43,7 @@ __export(main_exports, {
   resolveHostShell: () => resolveHostShell,
   resolveProjectFilePath: () => resolveProjectFilePath,
   resolveWorkerFilePath: () => resolveWorkerFilePath,
+  selectManifestSyncTargets: () => selectManifestSyncTargets,
   syncManifestProjectsFromInternal: () => syncManifestProjectsFromInternal,
   syncProjectPlans: () => syncProjectPlans,
   syncSessionArtifacts: () => syncSessionArtifacts
@@ -72,7 +74,7 @@ const activeProcesses = /* @__PURE__ */ new Map();
 const cancelledProcessRuns = /* @__PURE__ */ new Set();
 const activePtys = /* @__PURE__ */ new Map();
 let currentWorkerSocket = null;
-let containerRegistryCredential = null;
+let githubCredential = null;
 let visibleGitIdentity = null;
 function defaultConfigPath() {
   return import_node_path.default.join(import_node_os.default.homedir(), ".config", "r5d", "r5dctl", "config.json");
@@ -928,8 +930,8 @@ function writeRegistryAuthFile(filePath, credential) {
   const auths = existingAuths;
   auths[credential.registry] = {
     username: credential.username,
-    password: credential.password,
-    auth: Buffer.from(`${credential.username}:${credential.password}`).toString("base64")
+    password: credential.token,
+    auth: Buffer.from(`${credential.username}:${credential.token}`).toString("base64")
   };
   config.auths = auths;
   import_node_fs.default.mkdirSync(import_node_path.default.dirname(filePath), { recursive: true });
@@ -937,8 +939,8 @@ function writeRegistryAuthFile(filePath, credential) {
 `, { mode: 384 });
   import_node_fs.default.chmodSync(filePath, 384);
 }
-function configureContainerRegistryAuth(credential) {
-  containerRegistryCredential = credential;
+function configureGitHubAuth(credential) {
+  githubCredential = credential;
   if (!credential) {
     return;
   }
@@ -946,25 +948,41 @@ function configureContainerRegistryAuth(credential) {
   writeRegistryAuthFile(containersAuthPath(), credential);
   if (credential.missingScopes.length > 0) {
     process.stderr.write(
-      `[r5d-worker] GitHub token is missing GHCR scope(s): ${credential.missingScopes.join(", ")}. Sign in with GitHub again if GHCR push/pull fails.
+      `[r5d-worker] GitHub token is missing scope(s): ${credential.missingScopes.join(", ")}. Sign in with GitHub again if gh or GHCR access fails.
 `
     );
   } else {
-    process.stdout.write(`[r5d-worker] configured GHCR auth for ${credential.username}
+    process.stdout.write(`[r5d-worker] configured GitHub CLI and GHCR auth for ${credential.username}
 `);
   }
 }
 function containerRegistryEnv() {
-  if (!containerRegistryCredential) {
+  if (!githubCredential) {
     return {};
   }
   return {
-    R5D_GHCR_REGISTRY: containerRegistryCredential.registry,
-    R5D_GHCR_NAMESPACE: containerRegistryCredential.username,
+    R5D_GHCR_REGISTRY: githubCredential.registry,
+    R5D_GHCR_NAMESPACE: githubCredential.username,
     R5D_GHCR_AUTH_FILE: containersAuthPath(),
     REGISTRY_AUTH_FILE: containersAuthPath(),
-    GHCR_REGISTRY: containerRegistryCredential.registry,
-    GHCR_NAMESPACE: containerRegistryCredential.username
+    GHCR_REGISTRY: githubCredential.registry,
+    GHCR_NAMESPACE: githubCredential.username
+  };
+}
+function githubCliEnv(token) {
+  if (!token) {
+    return {};
+  }
+  return {
+    GH_TOKEN: token,
+    GH_HOST: "github.com",
+    GH_PROMPT_DISABLED: "1"
+  };
+}
+function githubProcessEnv() {
+  return {
+    ...containerRegistryEnv(),
+    ...githubCliEnv(githubCredential?.token)
   };
 }
 function checkoutVisibleBranch(input) {
@@ -1145,11 +1163,28 @@ function findRepositorySyncBlockers(input) {
   }
   return blockedBy;
 }
+function selectManifestSyncTargets(input) {
+  if (!input.requestedTargets) {
+    return input.manifests.flatMap((manifest) => {
+      const branches = manifest.branches.length > 0 ? manifest.branches : [manifest.defaultBranch || "main"];
+      return [...new Set(branches)].map((branchName) => ({ manifest, branchName }));
+    });
+  }
+  const manifestsByProjectId = new Map(input.manifests.map((manifest) => [manifest.projectId, manifest]));
+  const selected = /* @__PURE__ */ new Map();
+  for (const target of input.requestedTargets) {
+    const manifest = manifestsByProjectId.get(target.projectId);
+    if (!manifest) {
+      continue;
+    }
+    selected.set(`${target.projectId}\0${target.branchName}`, { manifest, branchName: target.branchName });
+  }
+  return [...selected.values()];
+}
 async function syncManifestProjectsFromInternal(input) {
-  const requestedProjectIds = input.projectIds ? new Set(input.projectIds) : null;
-  const targets = input.manifests.filter((manifest) => !requestedProjectIds || requestedProjectIds.has(manifest.projectId)).flatMap((manifest) => {
-    const branches = manifest.branches.length > 0 ? manifest.branches : [manifest.defaultBranch || "main"];
-    return [...new Set(branches)].map((branchName) => ({ manifest, branchName }));
+  const targets = selectManifestSyncTargets({
+    manifests: input.manifests,
+    requestedTargets: input.requestedTargets
   });
   const blockedBy = findRepositorySyncBlockers({
     targets: targets.map(({ manifest, branchName }) => ({
@@ -1168,11 +1203,12 @@ async function syncManifestProjectsFromInternal(input) {
       branchName: active.branchName
     }))
   });
-  if (blockedBy.length > 0) {
-    return { status: "blocked", results: [], blockedBy };
-  }
+  const blockedTargetKeys = new Set(blockedBy.map((blocker) => `${blocker.projectId}\0${blocker.branchName}`));
   const results = [];
   for (const { manifest, branchName } of targets) {
+    if (blockedTargetKeys.has(`${manifest.projectId}\0${branchName}`)) {
+      continue;
+    }
     try {
       const commitHash = await forceSyncManifestBranchFromInternal({
         projectId: manifest.projectId,
@@ -1200,10 +1236,11 @@ async function syncManifestProjectsFromInternal(input) {
       });
     }
   }
+  const hasFailures = results.some((result) => result.status === "failed");
   return {
-    status: results.some((result) => result.status === "failed") ? "partial" : "completed",
+    status: blockedBy.length > 0 && results.length === 0 ? "blocked" : blockedBy.length > 0 || hasFailures ? "partial" : "completed",
     results,
-    blockedBy: []
+    blockedBy
   };
 }
 function resolveCommandCwd(branchPath, cwd) {
@@ -1910,7 +1947,7 @@ async function executeCommand(input) {
       detached: true,
       env: {
         ...process.env,
-        ...containerRegistryEnv(),
+        ...githubProcessEnv(),
         ...input.message.env ?? {},
         ...internalGitProcessEnv(workspace, input.message.env),
         ...artifactProcessEnv,
@@ -2015,7 +2052,7 @@ async function executeStreamingCommand(input) {
       detached: true,
       env: {
         ...process.env,
-        ...containerRegistryEnv(),
+        ...githubProcessEnv(),
         ...input.message.env ?? {},
         ...internalGitProcessEnv(workspace, input.message.env),
         ...artifactProcessEnv,
@@ -2346,7 +2383,7 @@ async function openPty(input) {
         cwd: branchPath.branchPath,
         env: {
           ...process.env,
-          ...containerRegistryEnv(),
+          ...githubProcessEnv(),
           ...input.message.env ?? {},
           ...planProcessEnv,
           R5D_PROJECT_ID: input.projectId,
@@ -2530,7 +2567,7 @@ async function startWorker(options) {
         return;
       }
       if (message.type === "project_manifest") {
-        configureContainerRegistryAuth(message.githubContainerRegistry);
+        configureGitHubAuth(message.githubCredential);
         visibleGitIdentity = message.gitIdentity;
         manifestByProjectId.clear();
         for (const project of message.projects) {
@@ -2563,7 +2600,7 @@ async function startWorker(options) {
               projectsRoot,
               syncRoot,
               manifests: [...manifestByProjectId.values()],
-              projectIds: message.projectIds
+              requestedTargets: message.targets
             });
             for (const result of syncResult.results) {
               if (result.status !== "synced") continue;
@@ -2920,6 +2957,7 @@ if (isCliEntrypoint()) {
   ensureVisibleGitCheckout,
   findRepositorySyncBlockers,
   findWorkerFiles,
+  githubCliEnv,
   grepWorkerFiles,
   isArtifactEnvPath,
   listWorkerDirectory,
@@ -2930,6 +2968,7 @@ if (isCliEntrypoint()) {
   resolveHostShell,
   resolveProjectFilePath,
   resolveWorkerFilePath,
+  selectManifestSyncTargets,
   syncManifestProjectsFromInternal,
   syncProjectPlans,
   syncSessionArtifacts

package/dist/cjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.32",
+  "version": "0.0.34",
   "type": "commonjs"
 }

package/dist/mjs/main.mjs

@@ -23,7 +23,7 @@ const activeProcesses = /* @__PURE__ */ new Map();
 const cancelledProcessRuns = /* @__PURE__ */ new Set();
 const activePtys = /* @__PURE__ */ new Map();
 let currentWorkerSocket = null;
-let containerRegistryCredential = null;
+let githubCredential = null;
 let visibleGitIdentity = null;
 function defaultConfigPath() {
   return path.join(os.homedir(), ".config", "r5d", "r5dctl", "config.json");
@@ -879,8 +879,8 @@ function writeRegistryAuthFile(filePath, credential) {
   const auths = existingAuths;
   auths[credential.registry] = {
     username: credential.username,
-    password: credential.password,
-    auth: Buffer.from(`${credential.username}:${credential.password}`).toString("base64")
+    password: credential.token,
+    auth: Buffer.from(`${credential.username}:${credential.token}`).toString("base64")
   };
   config.auths = auths;
   fs.mkdirSync(path.dirname(filePath), { recursive: true });
@@ -888,8 +888,8 @@ function writeRegistryAuthFile(filePath, credential) {
 `, { mode: 384 });
   fs.chmodSync(filePath, 384);
 }
-function configureContainerRegistryAuth(credential) {
-  containerRegistryCredential = credential;
+function configureGitHubAuth(credential) {
+  githubCredential = credential;
   if (!credential) {
     return;
   }
@@ -897,25 +897,41 @@ function configureContainerRegistryAuth(credential) {
   writeRegistryAuthFile(containersAuthPath(), credential);
   if (credential.missingScopes.length > 0) {
     process.stderr.write(
-      `[r5d-worker] GitHub token is missing GHCR scope(s): ${credential.missingScopes.join(", ")}. Sign in with GitHub again if GHCR push/pull fails.
+      `[r5d-worker] GitHub token is missing scope(s): ${credential.missingScopes.join(", ")}. Sign in with GitHub again if gh or GHCR access fails.
 `
     );
   } else {
-    process.stdout.write(`[r5d-worker] configured GHCR auth for ${credential.username}
+    process.stdout.write(`[r5d-worker] configured GitHub CLI and GHCR auth for ${credential.username}
 `);
   }
 }
 function containerRegistryEnv() {
-  if (!containerRegistryCredential) {
+  if (!githubCredential) {
     return {};
   }
   return {
-    R5D_GHCR_REGISTRY: containerRegistryCredential.registry,
-    R5D_GHCR_NAMESPACE: containerRegistryCredential.username,
+    R5D_GHCR_REGISTRY: githubCredential.registry,
+    R5D_GHCR_NAMESPACE: githubCredential.username,
     R5D_GHCR_AUTH_FILE: containersAuthPath(),
     REGISTRY_AUTH_FILE: containersAuthPath(),
-    GHCR_REGISTRY: containerRegistryCredential.registry,
-    GHCR_NAMESPACE: containerRegistryCredential.username
+    GHCR_REGISTRY: githubCredential.registry,
+    GHCR_NAMESPACE: githubCredential.username
+  };
+}
+function githubCliEnv(token) {
+  if (!token) {
+    return {};
+  }
+  return {
+    GH_TOKEN: token,
+    GH_HOST: "github.com",
+    GH_PROMPT_DISABLED: "1"
+  };
+}
+function githubProcessEnv() {
+  return {
+    ...containerRegistryEnv(),
+    ...githubCliEnv(githubCredential?.token)
   };
 }
 function checkoutVisibleBranch(input) {
@@ -1096,11 +1112,28 @@ function findRepositorySyncBlockers(input) {
   }
   return blockedBy;
 }
+function selectManifestSyncTargets(input) {
+  if (!input.requestedTargets) {
+    return input.manifests.flatMap((manifest) => {
+      const branches = manifest.branches.length > 0 ? manifest.branches : [manifest.defaultBranch || "main"];
+      return [...new Set(branches)].map((branchName) => ({ manifest, branchName }));
+    });
+  }
+  const manifestsByProjectId = new Map(input.manifests.map((manifest) => [manifest.projectId, manifest]));
+  const selected = /* @__PURE__ */ new Map();
+  for (const target of input.requestedTargets) {
+    const manifest = manifestsByProjectId.get(target.projectId);
+    if (!manifest) {
+      continue;
+    }
+    selected.set(`${target.projectId}\0${target.branchName}`, { manifest, branchName: target.branchName });
+  }
+  return [...selected.values()];
+}
 async function syncManifestProjectsFromInternal(input) {
-  const requestedProjectIds = input.projectIds ? new Set(input.projectIds) : null;
-  const targets = input.manifests.filter((manifest) => !requestedProjectIds || requestedProjectIds.has(manifest.projectId)).flatMap((manifest) => {
-    const branches = manifest.branches.length > 0 ? manifest.branches : [manifest.defaultBranch || "main"];
-    return [...new Set(branches)].map((branchName) => ({ manifest, branchName }));
+  const targets = selectManifestSyncTargets({
+    manifests: input.manifests,
+    requestedTargets: input.requestedTargets
   });
   const blockedBy = findRepositorySyncBlockers({
     targets: targets.map(({ manifest, branchName }) => ({
@@ -1119,11 +1152,12 @@ async function syncManifestProjectsFromInternal(input) {
       branchName: active.branchName
     }))
   });
-  if (blockedBy.length > 0) {
-    return { status: "blocked", results: [], blockedBy };
-  }
+  const blockedTargetKeys = new Set(blockedBy.map((blocker) => `${blocker.projectId}\0${blocker.branchName}`));
   const results = [];
   for (const { manifest, branchName } of targets) {
+    if (blockedTargetKeys.has(`${manifest.projectId}\0${branchName}`)) {
+      continue;
+    }
     try {
       const commitHash = await forceSyncManifestBranchFromInternal({
         projectId: manifest.projectId,
@@ -1151,10 +1185,11 @@ async function syncManifestProjectsFromInternal(input) {
       });
     }
   }
+  const hasFailures = results.some((result) => result.status === "failed");
   return {
-    status: results.some((result) => result.status === "failed") ? "partial" : "completed",
+    status: blockedBy.length > 0 && results.length === 0 ? "blocked" : blockedBy.length > 0 || hasFailures ? "partial" : "completed",
     results,
-    blockedBy: []
+    blockedBy
   };
 }
 function resolveCommandCwd(branchPath, cwd) {
@@ -1861,7 +1896,7 @@ async function executeCommand(input) {
       detached: true,
       env: {
         ...process.env,
-        ...containerRegistryEnv(),
+        ...githubProcessEnv(),
         ...input.message.env ?? {},
         ...internalGitProcessEnv(workspace, input.message.env),
         ...artifactProcessEnv,
@@ -1966,7 +2001,7 @@ async function executeStreamingCommand(input) {
       detached: true,
       env: {
         ...process.env,
-        ...containerRegistryEnv(),
+        ...githubProcessEnv(),
         ...input.message.env ?? {},
         ...internalGitProcessEnv(workspace, input.message.env),
         ...artifactProcessEnv,
@@ -2297,7 +2332,7 @@ async function openPty(input) {
         cwd: branchPath.branchPath,
         env: {
           ...process.env,
-          ...containerRegistryEnv(),
+          ...githubProcessEnv(),
           ...input.message.env ?? {},
           ...planProcessEnv,
           R5D_PROJECT_ID: input.projectId,
@@ -2481,7 +2516,7 @@ async function startWorker(options) {
         return;
       }
       if (message.type === "project_manifest") {
-        configureContainerRegistryAuth(message.githubContainerRegistry);
+        configureGitHubAuth(message.githubCredential);
         visibleGitIdentity = message.gitIdentity;
         manifestByProjectId.clear();
         for (const project of message.projects) {
@@ -2514,7 +2549,7 @@ async function startWorker(options) {
               projectsRoot,
               syncRoot,
               manifests: [...manifestByProjectId.values()],
-              projectIds: message.projectIds
+              requestedTargets: message.targets
             });
             for (const result of syncResult.results) {
               if (result.status !== "synced") continue;
@@ -2870,6 +2905,7 @@ export {
   ensureVisibleGitCheckout,
   findRepositorySyncBlockers,
   findWorkerFiles,
+  githubCliEnv,
   grepWorkerFiles,
   isArtifactEnvPath,
   listWorkerDirectory,
@@ -2880,6 +2916,7 @@ export {
   resolveHostShell,
   resolveProjectFilePath,
   resolveWorkerFilePath,
+  selectManifestSyncTargets,
   syncManifestProjectsFromInternal,
   syncProjectPlans,
   syncSessionArtifacts

package/dist/mjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.32",
+  "version": "0.0.34",
   "type": "module"
 }

package/dist/types/main.d.ts

@@ -26,6 +26,10 @@ type WorkerRepositorySyncTarget = {
     projectPath: string;
     branchName: string;
 };
+type WorkerRepositorySyncSelector = {
+    projectId: string;
+    branchName: string;
+};
 type WorkerRepositorySyncResult = {
     status: "completed" | "partial" | "blocked";
     results: Array<WorkerRepositorySyncTarget & ({
@@ -119,6 +123,7 @@ export declare function resolveWorkerFilePath(branchPath: string, inputPath: str
 export declare function resolveProjectFilePath(branchPath: string, inputPath: string): Extract<ResolvedWorkerFilePath, {
     scope: "project";
 }>;
+export declare function githubCliEnv(token: string | null | undefined): Record<string, string>;
 export declare function ensureVisibleGitCheckout(input: {
     projectRoot: string;
     branchName: string;
@@ -141,13 +146,20 @@ export declare function findRepositorySyncBlockers(input: {
         branchName: string;
     }>;
 }): WorkerRepositorySyncResult["blockedBy"];
+export declare function selectManifestSyncTargets(input: {
+    manifests: WorkerProjectManifestEntry[];
+    requestedTargets?: WorkerRepositorySyncSelector[];
+}): Array<{
+    manifest: WorkerProjectManifestEntry;
+    branchName: string;
+}>;
 export declare function syncManifestProjectsFromInternal(input: {
     baseUrl: string;
     token: string;
     projectsRoot: string;
     syncRoot: string;
     manifests: WorkerProjectManifestEntry[];
-    projectIds?: string[];
+    requestedTargets?: WorkerRepositorySyncSelector[];
 }): Promise<WorkerRepositorySyncResult>;
 export declare function readWorkerTextFile(branchPath: string, filePath: string, offset?: number, limit?: number): WorkerReadFileResult;
 export declare function grepWorkerFiles(branchPath: string, input: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.32",
+  "version": "0.0.34",
   "type": "module",
   "main": "./dist/cjs/main.cjs",
   "module": "./dist/mjs/main.mjs",