@ricsam/r5d-worker 0.0.35 → 0.0.37

package/dist/mjs/main.mjs

@@ -9,6 +9,12 @@ import { configureVisibleGitIdentity } from "./git-identity.mjs";
 import { hasWorkerHeartbeatTimedOut, WORKER_HEARTBEAT_INTERVAL_MS } from "./heartbeat.mjs";
 import { terminateProcessTree } from "./process-tree.mjs";
 import { superviseWorkerRuntime, WORKER_RELOAD_EXIT_CODE, WORKER_RUNTIME_ENV } from "./supervisor.mjs";
+import {
+  WORKSPACE_PERIODIC_SCAN_INTERVAL_MS,
+  WorkspaceSyncSingleFlight,
+  calculateWorkspaceDiffFingerprint,
+  synchronizeWorkspace
+} from "./workspace-sync.mjs";
 const DEFAULT_BASE_URL = "https://r5d.dev";
 const WORKER_PACKAGE_NAME = "@ricsam/r5d-worker";
 const LABEL_RE = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,62}$/;
@@ -16,10 +22,8 @@ const BRANCH_RE = /^[A-Za-z0-9][A-Za-z0-9-]*[A-Za-z0-9]$|^[A-Za-z0-9]$/;
 const DEFAULT_READ_LIMIT = 2e3;
 const DEFAULT_READ_MAX_BYTES = 5e4;
 const MAX_LINE_LENGTH = 2e3;
-const MAX_SYNC_DIFF_BYTES = 5 * 1024 * 1024;
-const R5D_REMOTE_NAME = "r5d";
-const LEGACY_BUILD_IT_NOW_REMOTE_NAME = "build-it-now";
 const activeProcesses = /* @__PURE__ */ new Map();
+const pendingProcessTerminals = /* @__PURE__ */ new Map();
 const cancelledProcessRuns = /* @__PURE__ */ new Set();
 const activePtys = /* @__PURE__ */ new Map();
 let currentWorkerSocket = null;
@@ -478,8 +482,10 @@ async function prepareArtifactEnvForShell(input) {
       artifactRoot: input.artifactRoot
     });
   } catch (error) {
-    process.stderr.write(`[r5d-worker] artifact sync skipped for ${input.sessionId}: ${error instanceof Error ? error.message : String(error)}
-`);
+    process.stderr.write(
+      `[r5d-worker] artifact sync skipped for ${input.sessionId}: ${error instanceof Error ? error.message : String(error)}
+`
+    );
   }
   const artifactsDir = sessionArtifactDir(input.artifactRoot, input.sessionId);
   fs.mkdirSync(artifactsDir, { recursive: true });
@@ -535,7 +541,9 @@ function resolveCredentials(options, config) {
     throw new Error("Authentication required. Run `r5dctl auth login` or set R5D_WORKER_TOKEN/R5D_API_KEY.");
   }
   return {
-    baseUrl: normalizeBaseUrl(options.baseUrl ?? process.env.R5D_BASE_URL ?? process.env.R5DCTL_BASE_URL ?? config.baseUrl ?? DEFAULT_BASE_URL),
+    baseUrl: normalizeBaseUrl(
+      options.baseUrl ?? process.env.R5D_BASE_URL ?? process.env.R5DCTL_BASE_URL ?? config.baseUrl ?? DEFAULT_BASE_URL
+    ),
     token
   };
 }
@@ -589,27 +597,6 @@ function runGit(args, options = {}) {
   }
   return result.stdout.toString().trim();
 }
-async function runGitAsync(args, options = {}) {
-  const command = ["git", ...gitAuthArgs(options.auth), ...args];
-  const subprocess = Bun.spawn(command, {
-    cwd: options.cwd,
-    stdout: "pipe",
-    stderr: "pipe",
-    env: {
-      ...process.env,
-      GIT_TERMINAL_PROMPT: "0"
-    }
-  });
-  const [stdout, stderr, exitCode] = await Promise.all([
-    collectStream(subprocess.stdout),
-    collectStream(subprocess.stderr),
-    subprocess.exited
-  ]);
-  if (exitCode !== 0) {
-    throw new Error(`git ${args.join(" ")} failed: ${stderr.trim() || stdout.trim() || `exit ${exitCode}`}`);
-  }
-  return stdout.trim();
-}
 function tryGit(args, options = {}) {
   try {
     runGit(args, options);
@@ -618,34 +605,6 @@ function tryGit(args, options = {}) {
     return false;
   }
 }
-async function tryGitAsync(args, options = {}) {
-  try {
-    await runGitAsync(args, options);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function runInternalGit(context, args) {
-  return runGit(["--git-dir", context.gitDir, "--work-tree", context.workTree, ...args], { auth: context.auth });
-}
-function runInternalGitAsync(context, args) {
-  return runGitAsync(["--git-dir", context.gitDir, "--work-tree", context.workTree, ...args], { auth: context.auth });
-}
-function runInternalGitDir(context, args) {
-  return runGit(["--git-dir", context.gitDir, ...args], { auth: context.auth });
-}
-function tryInternalGit(context, args) {
-  try {
-    runInternalGit(context, args);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function getInternalCommitHash(context) {
-  return runInternalGit(context, ["rev-parse", "HEAD"]);
-}
 function getGitBlobHashForContent(content) {
   const buffer = typeof content === "string" ? Buffer.from(content, "utf8") : content;
   return createHash("sha1").update(`blob ${buffer.length}\0`).update(buffer).digest("hex");
@@ -653,12 +612,6 @@ function getGitBlobHashForContent(content) {
 function hasWorktreeChanges(cwd) {
   return runGit(["status", "--porcelain"], { cwd }).trim().length > 0;
 }
-function getInternalStatus(context) {
-  return runInternalGit(context, ["status", "--porcelain", "--", ".", ":(exclude).git"]);
-}
-function hasInternalWorktreeChanges(context) {
-  return getInternalStatus(context).trim().length > 0;
-}
 function isInsideBranchPath(branchPath, filePath) {
   const relative = path.relative(path.resolve(branchPath), path.resolve(filePath));
   return relative === "" || relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
@@ -693,11 +646,6 @@ function resolveWorkerFilePath(branchPath, inputPath) {
     const displayPath = toProjectDisplayPath(resolvedBranchPath, absolutePath2);
     const repoRelativePath2 = displayPath === "." ? "" : displayPath;
     assertAllowedProjectPath(repoRelativePath2, inputPath);
-    const realBranchPath2 = fs.existsSync(resolvedBranchPath) ? fs.realpathSync(resolvedBranchPath) : resolvedBranchPath;
-    const realTargetPath2 = resolveThroughExistingAncestor(absolutePath2);
-    if (!isInsideBranchPath(realBranchPath2, realTargetPath2)) {
-      throw new Error(`Project file path escapes its checkout through a symbolic link: ${inputPath}`);
-    }
     return {
       absolutePath: absolutePath2,
       displayPath,
@@ -716,11 +664,6 @@ function resolveWorkerFilePath(branchPath, inputPath) {
   if (!isInsideBranchPath(resolvedBranchPath, absolutePath)) {
     throw new Error(`Invalid project file path: ${inputPath}`);
   }
-  const realBranchPath = fs.existsSync(resolvedBranchPath) ? fs.realpathSync(resolvedBranchPath) : resolvedBranchPath;
-  const realTargetPath = resolveThroughExistingAncestor(absolutePath);
-  if (!isInsideBranchPath(realBranchPath, realTargetPath)) {
-    throw new Error(`Project file path escapes its checkout through a symbolic link: ${inputPath}`);
-  }
   return {
     absolutePath,
     displayPath: repoRelativePath || ".",
@@ -731,81 +674,15 @@ function resolveWorkerFilePath(branchPath, inputPath) {
 function resolveProjectFilePath(branchPath, inputPath) {
   const resolved = resolveWorkerFilePath(branchPath, inputPath);
   if (resolved.scope === "host") {
-    throw new Error(
-      `Project file writes must resolve inside the selected managed checkout: ${inputPath}`
-    );
+    throw new Error(`Project file writes must use a checkout-relative path. Absolute host paths are read-only in file tools: ${inputPath}`);
   }
   return resolved;
 }
-function resolveThroughExistingAncestor(inputPath) {
-  const suffix = [];
-  let cursor = path.resolve(inputPath);
-  while (!fs.existsSync(cursor)) {
-    const parent = path.dirname(cursor);
-    if (parent === cursor) return path.resolve(inputPath);
-    suffix.unshift(path.basename(cursor));
-    cursor = parent;
-  }
-  return path.resolve(fs.realpathSync(cursor), ...suffix);
-}
-function resolveManagedCheckoutPath(input) {
-  const originManifest = input.manifests.find((manifest) => manifest.projectId === input.originProjectId);
-  const candidate = path.isAbsolute(input.inputPath) ? path.resolve(input.inputPath) : path.resolve(
-    input.projectsRoot,
-    originManifest?.repoSlug ?? input.originProjectId,
-    input.originBranchName,
-    input.inputPath
-  );
-  const resolvedCandidate = resolveThroughExistingAncestor(candidate);
-  for (const manifest of input.manifests) {
-    const branches = manifest.branches.length > 0 ? manifest.branches : [manifest.defaultBranch || "main"];
-    for (const branchName of branches) {
-      const checkoutPath = path.resolve(input.projectsRoot, manifest.repoSlug || manifest.projectId, branchName);
-      if (!hasNormalVisibleGitDir(checkoutPath)) continue;
-      const resolvedCheckoutPath = fs.existsSync(checkoutPath) ? fs.realpathSync(checkoutPath) : checkoutPath;
-      const matchesLexically = isInsideBranchPath(checkoutPath, candidate);
-      if (!matchesLexically) continue;
-      if (!isInsideBranchPath(resolvedCheckoutPath, resolvedCandidate)) {
-        throw new Error(`Managed path escapes its checkout through a symbolic link: ${input.inputPath}`);
-      }
-      const repoRelativePath = toProjectDisplayPath(resolvedCheckoutPath, resolvedCandidate);
-      assertAllowedProjectPath(repoRelativePath === "." ? "" : repoRelativePath, input.inputPath);
-      return {
-        type: "resolve_managed_path",
-        resolved: {
-          projectId: manifest.projectId,
-          projectPath: manifest.projectPath,
-          branchName,
-          checkoutPath,
-          inputPath: input.inputPath,
-          absolutePath: candidate,
-          repoRelativePath: repoRelativePath === "." ? "" : repoRelativePath
-        }
-      };
-    }
-  }
-  return { type: "resolve_managed_path", resolved: null };
-}
-function resolveRemoteUrl(baseUrl, remoteUrl) {
-  if (/^https?:\/\//i.test(remoteUrl)) {
-    return remoteUrl;
-  }
-  return new URL(remoteUrl, baseUrl).toString();
-}
 function fallbackInternalRemoteUrl(baseUrl, projectId) {
   return new URL(`/git/${projectId}.git`, baseUrl).toString();
 }
-function internalGitAuth(baseUrl, token) {
-  return {
-    extraHeaderUrl: baseUrl,
-    header: `Authorization: Bearer ${token}`
-  };
-}
-function internalRemoteUrlFor(baseUrl, projectId, manifest) {
-  return resolveRemoteUrl(baseUrl, manifest?.internalRemoteUrl ?? fallbackInternalRemoteUrl(baseUrl, projectId));
-}
 function githubRemoteUrlFor(baseUrl, projectId, manifest) {
-  return manifest?.repoHttpUrl ?? internalRemoteUrlFor(baseUrl, projectId, manifest);
+  return manifest?.repoHttpUrl ?? fallbackInternalRemoteUrl(baseUrl, projectId);
 }
 function gitExtraHeaderUrlForRemote(remoteUrl) {
   try {
@@ -823,12 +700,6 @@ function gitAuthForRemote(remoteUrl, authHeader) {
     header: authHeader
   };
 }
-function branchGitDirName(branchName) {
-  return `${encodeURIComponent(branchName)}.git`;
-}
-function internalGitDirFor(syncRoot, projectId, branchName) {
-  return path.join(syncRoot, projectId, branchGitDirName(branchName));
-}
 function hasNormalVisibleGitDir(branchPath) {
   const gitPath = path.join(branchPath, ".git");
   return fs.existsSync(gitPath) && fs.statSync(gitPath).isDirectory();
@@ -840,13 +711,6 @@ function ensureOriginRemote(branchPath, remoteUrl) {
     runGit(["remote", "add", "origin", remoteUrl], { cwd: branchPath });
   }
 }
-async function ensureOriginRemoteAsync(branchPath, remoteUrl) {
-  if (await tryGitAsync(["remote", "get-url", "origin"], { cwd: branchPath })) {
-    await runGitAsync(["remote", "set-url", "origin", remoteUrl], { cwd: branchPath });
-  } else {
-    await runGitAsync(["remote", "add", "origin", remoteUrl], { cwd: branchPath });
-  }
-}
 function shellQuote(value) {
   return `'${value.replace(/'/g, "'\\''")}'`;
 }
@@ -1042,217 +906,20 @@ function ensureVisibleGitCheckout(input) {
   configureVisibleGitIdentity(branchPath, visibleGitIdentity, runGit);
   return branchPath;
 }
-function configureInternalRepo(context, remoteUrl) {
-  if (tryInternalGit(context, ["remote", "get-url", R5D_REMOTE_NAME])) {
-    runInternalGit(context, ["remote", "set-url", R5D_REMOTE_NAME, remoteUrl]);
-  } else {
-    runInternalGit(context, ["remote", "add", R5D_REMOTE_NAME, remoteUrl]);
-  }
-  if (tryInternalGit(context, ["remote", "get-url", LEGACY_BUILD_IT_NOW_REMOTE_NAME])) {
-    runInternalGit(context, ["remote", "remove", LEGACY_BUILD_IT_NOW_REMOTE_NAME]);
-  }
-  runInternalGitDir(context, ["config", "user.name", "r5d.dev Worker"]);
-  runInternalGitDir(context, ["config", "user.email", "worker@r5d.dev"]);
-}
-function ensureInternalSyncGit(input) {
-  validateBranchName(input.branchName);
-  const gitDir = internalGitDirFor(input.syncRoot, input.projectId, input.branchName);
-  fs.mkdirSync(path.dirname(gitDir), { recursive: true });
-  if (!fs.existsSync(gitDir)) {
-    runGit(["init", "--bare", gitDir]);
-  }
-  const auth = internalGitAuth(input.baseUrl, input.token);
-  const context = { gitDir, workTree: input.branchPath, auth };
-  const remoteUrl = internalRemoteUrlFor(input.baseUrl, input.projectId, input.manifest);
-  configureInternalRepo(context, remoteUrl);
-  runInternalGit(context, ["fetch", R5D_REMOTE_NAME, "--prune", `+refs/heads/*:refs/remotes/${R5D_REMOTE_NAME}/*`]);
-  const hasRemoteBranch = tryInternalGit(context, ["show-ref", "--verify", "--quiet", `refs/remotes/${R5D_REMOTE_NAME}/${input.branchName}`]);
-  const target = hasRemoteBranch ? `refs/remotes/${R5D_REMOTE_NAME}/${input.branchName}` : `refs/remotes/${R5D_REMOTE_NAME}/main`;
-  const hasHead = tryInternalGit(context, ["rev-parse", "--verify", "HEAD"]);
-  if (!hasHead || !hasInternalWorktreeChanges(context)) {
-    runInternalGit(context, ["checkout", "-f", "-B", input.branchName, target]);
-  }
-  return context;
-}
 function ensureBranchWorkspace(input) {
   const defaultBranch = input.manifest?.defaultBranch || "main";
   const githubRemoteUrl = githubRemoteUrlFor(input.baseUrl, input.projectId, input.manifest);
   const githubAuth = gitAuthForRemote(githubRemoteUrl, input.manifest?.repoAuthHeader);
-  const branchPath = ensureVisibleGitCheckout({
-    projectRoot: input.projectRoot,
-    branchName: input.branchName,
-    githubRemoteUrl,
-    githubAuth,
-    githubAuthHeader: input.manifest?.repoAuthHeader ?? null,
-    defaultBranch,
-    reconcileExistingOrigin: Boolean(input.manifest?.repoHttpUrl)
-  });
-  const internalGit = ensureInternalSyncGit({
-    projectId: input.projectId,
-    baseUrl: input.baseUrl,
-    token: input.token,
-    syncRoot: input.syncRoot,
-    branchPath,
-    branchName: input.branchName,
-    manifest: input.manifest
-  });
-  return { branchPath, internalGit };
-}
-async function ensureVisibleGitCheckoutForRepositorySync(input) {
-  validateBranchName(input.branchName);
-  fs.mkdirSync(input.projectRoot, { recursive: true });
-  const branchPath = path.join(input.projectRoot, input.branchName);
-  const createdCheckout = !hasNormalVisibleGitDir(branchPath);
-  if (createdCheckout) {
-    fs.rmSync(branchPath, { recursive: true, force: true });
-    fs.mkdirSync(path.dirname(branchPath), { recursive: true });
-    if (!await tryGitAsync(["clone", "--origin", "origin", input.githubRemoteUrl, branchPath], { auth: input.githubAuth })) {
-      fs.mkdirSync(branchPath, { recursive: true });
-      await runGitAsync(["init"], { cwd: branchPath });
-    }
-    await ensureOriginRemoteAsync(branchPath, input.githubRemoteUrl);
-    configureVisibleGitHubAuth(branchPath, input.githubRemoteUrl, input.githubAuthHeader);
-    configureVisibleGitIdentity(branchPath, visibleGitIdentity, runGit);
-    await tryGitAsync(["fetch", "origin", "--prune"], { cwd: branchPath, auth: input.githubAuth });
-    checkoutVisibleBranch({ branchPath, branchName: input.branchName, defaultBranch: input.defaultBranch });
-    return branchPath;
-  }
-  if (input.reconcileExistingOrigin) {
-    await ensureOriginRemoteAsync(branchPath, input.githubRemoteUrl);
-  }
-  configureVisibleGitHubAuth(branchPath, input.githubRemoteUrl, input.githubAuthHeader);
-  configureVisibleGitIdentity(branchPath, visibleGitIdentity, runGit);
-  return branchPath;
-}
-async function forceSyncManifestBranchFromInternal(input) {
-  const githubRemoteUrl = githubRemoteUrlFor(input.baseUrl, input.projectId, input.manifest);
-  const githubAuth = gitAuthForRemote(githubRemoteUrl, input.manifest.repoAuthHeader);
-  const branchPath = await ensureVisibleGitCheckoutForRepositorySync({
-    projectRoot: input.projectRoot,
-    branchName: input.branchName,
-    githubRemoteUrl,
-    githubAuth,
-    githubAuthHeader: input.manifest.repoAuthHeader,
-    defaultBranch: input.manifest.defaultBranch || "main",
-    reconcileExistingOrigin: Boolean(input.manifest.repoHttpUrl)
-  });
-  const gitDir = internalGitDirFor(input.syncRoot, input.projectId, input.branchName);
-  fs.mkdirSync(path.dirname(gitDir), { recursive: true });
-  if (!fs.existsSync(gitDir)) {
-    await runGitAsync(["init", "--bare", gitDir]);
-  }
-  const context = {
-    gitDir,
-    workTree: branchPath,
-    auth: internalGitAuth(input.baseUrl, input.token)
-  };
-  configureInternalRepo(context, internalRemoteUrlFor(input.baseUrl, input.projectId, input.manifest));
-  await runInternalGitAsync(context, ["fetch", R5D_REMOTE_NAME, "--prune", `+refs/heads/*:refs/remotes/${R5D_REMOTE_NAME}/*`]);
-  const branchTarget = `refs/remotes/${R5D_REMOTE_NAME}/${input.branchName}`;
-  const mainTarget = `refs/remotes/${R5D_REMOTE_NAME}/main`;
-  const target = tryInternalGit(context, ["show-ref", "--verify", "--quiet", branchTarget]) ? branchTarget : tryInternalGit(context, ["show-ref", "--verify", "--quiet", mainTarget]) ? mainTarget : null;
-  if (!target) {
-    throw new Error(`Internal remote has neither ${input.branchName} nor main`);
-  }
-  if (hasInternalWorktreeChanges(context)) {
-    return null;
-  }
-  await runInternalGitAsync(context, ["reset", "--hard", target]);
-  await runInternalGitAsync(context, ["clean", "-fd", "--", ".", ":(exclude).git"]);
-  return getInternalCommitHash(context);
-}
-function findRepositorySyncBlockers(input) {
-  const targetByKey = new Map(input.targets.map((target) => [`${target.projectId}:${target.branchName}`, target]));
-  const blockedBy = [];
-  for (const shell of input.shells) {
-    const target = targetByKey.get(`${shell.projectId}:${shell.branchName}`);
-    if (target) blockedBy.push({ ...target, kind: "shell", id: shell.id });
-  }
-  return blockedBy;
-}
-function selectManifestSyncTargets(input) {
-  if (!input.requestedTargets) {
-    return input.manifests.flatMap((manifest) => {
-      const branches = manifest.branches.length > 0 ? manifest.branches : [manifest.defaultBranch || "main"];
-      return [...new Set(branches)].map((branchName) => ({ manifest, branchName }));
-    });
-  }
-  const manifestsByProjectId = new Map(input.manifests.map((manifest) => [manifest.projectId, manifest]));
-  const selected = /* @__PURE__ */ new Map();
-  for (const target of input.requestedTargets) {
-    const manifest = manifestsByProjectId.get(target.projectId);
-    if (!manifest) {
-      continue;
-    }
-    selected.set(`${target.projectId}\0${target.branchName}`, { manifest, branchName: target.branchName });
-  }
-  return [...selected.values()];
-}
-async function syncManifestProjectsFromInternal(input) {
-  const targets = selectManifestSyncTargets({
-    manifests: input.manifests,
-    requestedTargets: input.requestedTargets
-  });
-  const blockedBy = findRepositorySyncBlockers({
-    targets: targets.map(({ manifest, branchName }) => ({
-      projectId: manifest.projectId,
-      projectPath: manifest.projectPath,
-      branchName
-    })),
-    shells: [...activePtys].map(([id, active]) => ({
-      id,
-      projectId: active.projectId,
-      branchName: active.branchName
-    }))
-  });
-  const blockedTargetKeys = new Set(blockedBy.map((blocker) => `${blocker.projectId}\0${blocker.branchName}`));
-  const results = [];
-  for (const { manifest, branchName } of targets) {
-    if (blockedTargetKeys.has(`${manifest.projectId}\0${branchName}`)) {
-      continue;
-    }
-    try {
-      const commitHash = await forceSyncManifestBranchFromInternal({
-        projectId: manifest.projectId,
-        baseUrl: input.baseUrl,
-        token: input.token,
-        projectRoot: path.join(input.projectsRoot, manifest.repoSlug || manifest.projectId),
-        syncRoot: input.syncRoot,
-        branchName,
-        manifest
-      });
-      if (commitHash === null) {
-        blockedBy.push({
-          projectId: manifest.projectId,
-          projectPath: manifest.projectPath,
-          branchName,
-          kind: "dirty_checkout",
-          id: `${manifest.projectId}:${branchName}`
-        });
-        continue;
-      }
-      results.push({
-        projectId: manifest.projectId,
-        projectPath: manifest.projectPath,
-        branchName,
-        status: "synced",
-        commitHash
-      });
-    } catch (error) {
-      results.push({
-        projectId: manifest.projectId,
-        projectPath: manifest.projectPath,
-        branchName,
-        status: "failed",
-        error: error instanceof Error ? error.message : String(error)
-      });
-    }
-  }
-  const hasFailures = results.some((result) => result.status === "failed");
   return {
-    status: blockedBy.length > 0 && results.length === 0 ? "blocked" : blockedBy.length > 0 || hasFailures ? "partial" : "completed",
-    results,
-    blockedBy
+    branchPath: ensureVisibleGitCheckout({
+      projectRoot: input.projectRoot,
+      branchName: input.branchName,
+      githubRemoteUrl,
+      githubAuth,
+      githubAuthHeader: input.manifest?.repoAuthHeader ?? null,
+      defaultBranch,
+      reconcileExistingOrigin: Boolean(input.manifest?.repoHttpUrl)
+    })
   };
 }
 function resolveCommandCwd(branchPath, cwd) {
@@ -1303,69 +970,6 @@ async function streamCommandOutput(stream, onData) {
 function ensureOperationBranch(input) {
   return ensureBranchWorkspace(input);
 }
-async function inspectManagedWorkspace(input) {
-  const candidates = input.manifests.flatMap((manifest) => {
-    const branches = manifest.branches.length > 0 ? manifest.branches : [manifest.defaultBranch || "main"];
-    return branches.map((branchName) => ({
-      manifest,
-      branchName,
-      checkoutPath: path.resolve(input.projectsRoot, manifest.repoSlug || manifest.projectId, branchName)
-    }));
-  });
-  const inspected = await Promise.all(
-    candidates.map(async ({ manifest, branchName, checkoutPath }) => {
-      const gitDir = internalGitDirFor(input.syncRoot, manifest.projectId, branchName);
-      if (!hasNormalVisibleGitDir(checkoutPath) || !fs.existsSync(gitDir)) return null;
-      const context = {
-        gitDir,
-        workTree: checkoutPath,
-        auth: internalGitAuth(input.baseUrl, input.token)
-      };
-      try {
-        const status = await runInternalGitAsync(context, ["status", "--porcelain", "--", ".", ":(exclude).git"]);
-        let commitHash = null;
-        for (const revision of [
-          "HEAD",
-          `refs/remotes/${R5D_REMOTE_NAME}/${branchName}`,
-          `refs/remotes/${R5D_REMOTE_NAME}/main`
-        ]) {
-          try {
-            commitHash = await runInternalGitAsync(context, ["rev-parse", "--verify", revision]);
-            break;
-          } catch {
-          }
-        }
-        if (!commitHash) return null;
-        return {
-          projectId: manifest.projectId,
-          projectPath: manifest.projectPath,
-          branchName,
-          checkoutPath,
-          commitHash,
-          status,
-          dirty: status.trim().length > 0
-        };
-      } catch {
-        return null;
-      }
-    })
-  );
-  return {
-    type: "workspace_status",
-    checkouts: inspected.filter((checkout) => checkout !== null).sort(
-      (left, right) => left.projectPath.localeCompare(right.projectPath) || left.branchName.localeCompare(right.branchName)
-    )
-  };
-}
-function internalGitProcessEnv(workspace, env) {
-  if (env?.R5D_USE_INTERNAL_GIT !== "1") {
-    return {};
-  }
-  return {
-    GIT_DIR: workspace.internalGit.gitDir,
-    GIT_WORK_TREE: workspace.branchPath
-  };
-}
 function formatLineNumberedContent(content, offset, limit) {
   const allLines = content.split("\n");
   const totalLines = allLines.length;
@@ -1474,9 +1078,11 @@ const fileMutationQueues = /* @__PURE__ */ new Map();
 async function withFileMutationQueue(key, operation) {
   const previous = fileMutationQueues.get(key) ?? Promise.resolve();
   let release;
-  const current = previous.catch(() => void 0).then(() => new Promise((resolve) => {
-    release = resolve;
-  }));
+  const current = previous.catch(() => void 0).then(
+    () => new Promise((resolve) => {
+      release = resolve;
+    })
+  );
   fileMutationQueues.set(key, current);
   await previous.catch(() => void 0);
   try {
@@ -1571,7 +1177,9 @@ async function executeEditFileOperation(input) {
         throw new Error(`Could not find edits[${index}].oldText: "${edit.oldText.slice(0, 100)}${edit.oldText.length > 100 ? "..." : ""}"`);
       }
       if (occurrences > 1) {
-        throw new Error(`edits[${index}].oldText is not unique in the file (found ${occurrences} occurrences). Include more surrounding context.`);
+        throw new Error(
+          `edits[${index}].oldText is not unique in the file (found ${occurrences} occurrences). Include more surrounding context.`
+        );
       }
       const start = originalContent.indexOf(edit.oldText);
       return { index, start, end: start + edit.oldText.length, edit };
@@ -1831,114 +1439,8 @@ async function executeViewFileBytesOperation(input) {
   const workspace = ensureOperationBranch({ ...input, branchName: input.message.branchName });
   return readWorkerImageFile(workspace.branchPath, input.message.filePath);
 }
-function stagedBlobSizeBytes(context) {
-  const names = runInternalGit(context, ["diff", "--cached", "--name-only", "-z", "--", ".", ":(exclude).git"]).split("\0").filter(Boolean);
-  let total = 0;
-  for (const name of names) {
-    try {
-      const sizeText = runInternalGit(context, ["cat-file", "-s", `:${name}`]);
-      total += Number.parseInt(sizeText, 10) || 0;
-    } catch {
-    }
-    if (total > MAX_SYNC_DIFF_BYTES) {
-      return MAX_SYNC_DIFF_BYTES + 1;
-    }
-  }
-  return total;
-}
-function syncBranch(input) {
-  const workspace = ensureOperationBranch(input);
-  runInternalGit(workspace.internalGit, ["add", "-A", "--", ".", ":(exclude).git"]);
-  const hasStagedChanges = !tryInternalGit(workspace.internalGit, ["diff", "--cached", "--quiet", "--", ".", ":(exclude).git"]);
-  const status = getInternalStatus(workspace.internalGit);
-  const currentCommit = getInternalCommitHash(workspace.internalGit);
-  if (!hasStagedChanges) {
-    return {
-      type: "sync",
-      changed: false,
-      commitHash: currentCommit,
-      diffSizeBytes: 0,
-      status
-    };
-  }
-  const diffSizeBytes = stagedBlobSizeBytes(workspace.internalGit);
-  if (diffSizeBytes > MAX_SYNC_DIFF_BYTES && !input.confirmedLargeDiff) {
-    return {
-      type: "sync",
-      changed: true,
-      commitHash: currentCommit,
-      diffSizeBytes,
-      status,
-      largeDiffBlocked: true,
-      trigger: input.trigger
-    };
-  }
-  const message = JSON.stringify({
-    type: "agent_changes",
-    sessionId: input.sessionId,
-    parentNodeId: input.parentNodeId,
-    ...input.confirmedLargeDiff ? { confirmedLargeDiff: true, confirmationReason: input.confirmationReason } : {}
-  });
-  runInternalGit(workspace.internalGit, ["commit", "-m", message]);
-  const commitHash = getInternalCommitHash(workspace.internalGit);
-  runInternalGit(workspace.internalGit, ["push", R5D_REMOTE_NAME, `HEAD:refs/heads/${input.branchName}`]);
-  return {
-    type: "sync",
-    changed: true,
-    commitHash,
-    diffSizeBytes,
-    status: getInternalStatus(workspace.internalGit),
-    trigger: input.trigger
-  };
-}
-function confirmLargeDiff(input) {
-  const reason = input.reason.trim();
-  if (!reason) {
-    throw new Error("confirm_large_diff requires a non-empty reason");
-  }
-  const result = syncBranch({
-    ...input,
-    confirmedLargeDiff: true,
-    confirmationReason: reason
-  });
-  return {
-    type: "confirm_large_diff",
-    changed: result.changed,
-    commitHash: result.commitHash,
-    diffSizeBytes: result.diffSizeBytes,
-    status: result.status,
-    reason
-  };
-}
-function pullBranch(input) {
-  const workspace = ensureOperationBranch(input);
-  runInternalGit(workspace.internalGit, ["fetch", R5D_REMOTE_NAME, "--prune", `+refs/heads/*:refs/remotes/${R5D_REMOTE_NAME}/*`]);
-  const target = input.commitHash ?? `${R5D_REMOTE_NAME}/${input.branchName}`;
-  runInternalGit(workspace.internalGit, ["reset", "--hard", target]);
-  runInternalGit(workspace.internalGit, ["clean", "-fd", "--", ".", ":(exclude).git"]);
-  return {
-    type: "pull_branch",
-    commitHash: getInternalCommitHash(workspace.internalGit)
-  };
-}
 async function executeOperation(input) {
   switch (input.message.type) {
-    case "resolve_managed_path":
-      return resolveManagedCheckoutPath({
-        projectsRoot: input.projectsRoot,
-        manifests: input.manifests,
-        originProjectId: input.message.projectId,
-        originBranchName: input.message.branchName,
-        inputPath: input.message.inputPath
-      });
-    case "workspace_status":
-      return await inspectManagedWorkspace({
-        baseUrl: input.baseUrl,
-        token: input.token,
-        projectsRoot: input.projectsRoot,
-        syncRoot: input.syncRoot,
-        manifests: input.manifests
-      });
     case "read":
       return executeReadFileOperation({ ...input, message: input.message });
     case "write":
@@ -1953,43 +1455,6 @@ async function executeOperation(input) {
       return executeLsOperation({ ...input, message: input.message });
     case "view_file_bytes":
       return executeViewFileBytesOperation({ ...input, message: input.message });
-    case "sync":
-      return syncBranch({
-        projectId: input.projectId,
-        baseUrl: input.baseUrl,
-        token: input.token,
-        projectRoot: input.projectRoot,
-        syncRoot: input.syncRoot,
-        branchName: input.message.branchName,
-        sessionId: input.message.sessionId,
-        parentNodeId: input.message.parentNodeId,
-        trigger: input.message.trigger,
-        manifest: input.manifest
-      });
-    case "confirm_large_diff":
-      return confirmLargeDiff({
-        projectId: input.projectId,
-        baseUrl: input.baseUrl,
-        token: input.token,
-        projectRoot: input.projectRoot,
-        syncRoot: input.syncRoot,
-        branchName: input.message.branchName,
-        sessionId: input.message.sessionId,
-        parentNodeId: input.message.parentNodeId,
-        reason: input.message.reason,
-        manifest: input.manifest
-      });
-    case "pull_branch":
-      return pullBranch({
-        projectId: input.projectId,
-        baseUrl: input.baseUrl,
-        token: input.token,
-        projectRoot: input.projectRoot,
-        syncRoot: input.syncRoot,
-        branchName: input.message.branchName,
-        commitHash: input.message.commitHash,
-        manifest: input.manifest
-      });
   }
 }
 async function executeCommand(input) {
@@ -2021,7 +1486,11 @@ async function executeCommand(input) {
       planRoot: input.planRoot,
       activePlanId: input.message.env?.R5D_ACTIVE_PLAN_ID
     });
-    const cwd = resolveCommandCwd(workspace.branchPath, input.message.cwd);
+    const commandRoot = input.message.env?.R5D_USE_WORKSPACE_GIT === "1" ? input.workspaceShadowRoot : workspace.branchPath;
+    if (input.message.env?.R5D_USE_WORKSPACE_GIT === "1" && !fs.existsSync(path.join(commandRoot, ".git"))) {
+      throw new Error("The canonical workspace checkout is not initialized on this worker");
+    }
+    const cwd = resolveCommandCwd(commandRoot, input.message.cwd);
     const subprocess = Bun.spawn(input.message.argv, {
       cwd,
       stdout: "pipe",
@@ -2031,7 +1500,6 @@ async function executeCommand(input) {
         ...process.env,
         ...githubProcessEnv(),
         ...input.message.env ?? {},
-        ...internalGitProcessEnv(workspace, input.message.env),
         ...artifactProcessEnv,
         ...planProcessEnv
       }
@@ -2042,7 +1510,8 @@ async function executeCommand(input) {
       sessionId: input.message.sessionId ?? "",
       branchName: input.message.branchName,
       mode: "foreground",
-      startCommitHash: "",
+      pid: subprocess.pid,
+      processGroupId: process.platform === "win32" ? void 0 : subprocess.pid,
       argv: input.message.argv,
       command: input.message.argv.join(" "),
       cwd,
@@ -2128,7 +1597,11 @@ async function executeStreamingCommand(input) {
       planRoot: input.planRoot,
       activePlanId: input.message.env?.R5D_ACTIVE_PLAN_ID
     });
-    const cwd = resolveCommandCwd(workspace.branchPath, input.message.cwd);
+    const commandRoot = input.message.env?.R5D_USE_WORKSPACE_GIT === "1" ? input.workspaceShadowRoot : workspace.branchPath;
+    if (input.message.env?.R5D_USE_WORKSPACE_GIT === "1" && !fs.existsSync(path.join(commandRoot, ".git"))) {
+      throw new Error("The canonical workspace checkout is not initialized on this worker");
+    }
+    const cwd = resolveCommandCwd(commandRoot, input.message.cwd);
     const subprocess = Bun.spawn(input.message.argv, {
       cwd,
       stdout: "pipe",
@@ -2138,7 +1611,6 @@ async function executeStreamingCommand(input) {
         ...process.env,
         ...githubProcessEnv(),
         ...input.message.env ?? {},
-        ...internalGitProcessEnv(workspace, input.message.env),
         ...artifactProcessEnv,
         ...planProcessEnv
       }
@@ -2149,16 +1621,11 @@ async function executeStreamingCommand(input) {
       sessionId: input.message.sessionId,
       branchName: input.message.branchName,
       mode: input.message.mode,
-      startCommitHash: input.message.startCommitHash,
-      launchWorkspaceActionId: input.message.launchWorkspaceActionId,
-      credentialId: input.message.credentialId,
       pid: subprocess.pid,
-      processGroupId: subprocess.pid,
+      processGroupId: process.platform === "win32" ? void 0 : subprocess.pid,
+      credentialId: input.message.credentialId,
       argv: input.message.argv,
       command: input.message.command,
-      // Persist the resolved absolute cwd so reconnect reports and process
-      // history retain the actual execution location, including cross-project
-      // managed paths.
       cwd,
       startedAt: (/* @__PURE__ */ new Date()).toISOString()
     });
@@ -2169,7 +1636,7 @@ async function executeStreamingCommand(input) {
       runId: input.message.runId,
       cwd,
       pid: subprocess.pid,
-      processGroupId: subprocess.pid
+      ...process.platform === "win32" ? {} : { processGroupId: subprocess.pid }
     });
     if (input.message.timeoutMs) {
       timeout = setTimeout(() => {
@@ -2201,22 +1668,26 @@ async function executeStreamingCommand(input) {
         });
       })
     ]);
-    sendWorkerMessage(input.ws, {
+    const terminal = {
       type: "exec_exit",
       runId: input.message.runId,
       exitCode,
       durationMs: Date.now() - startedAt,
       ...timedOut ? { timedOut: true } : {}
-    });
+    };
+    pendingProcessTerminals.set(input.message.runId, terminal);
+    sendWorkerMessage(input.ws, terminal);
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     if (started) {
-      sendWorkerMessage(input.ws, {
+      const terminal = {
         type: "exec_error",
         runId: input.message.runId,
         error: message,
         durationMs: Date.now() - startedAt
-      });
+      };
+      pendingProcessTerminals.set(input.message.runId, terminal);
+      sendWorkerMessage(input.ws, terminal);
     } else {
       sendWorkerMessage(input.ws, {
         type: "exec_start_error",
@@ -2248,12 +1719,12 @@ function buildActiveProcessReports() {
     projectId: active.projectId,
     sessionId: active.sessionId,
     branchName: active.branchName,
+    platform: process.platform,
+    arch: process.arch,
     mode: active.mode,
-    startCommitHash: active.startCommitHash,
-    ...active.launchWorkspaceActionId ? { launchWorkspaceActionId: active.launchWorkspaceActionId } : {},
-    ...active.credentialId ? { credentialId: active.credentialId } : {},
     ...active.pid !== void 0 ? { pid: active.pid } : {},
     ...active.processGroupId !== void 0 ? { processGroupId: active.processGroupId } : {},
+    ...active.credentialId ? { credentialId: active.credentialId } : {},
     argv: active.argv,
     command: active.command,
     ...active.cwd ? { cwd: active.cwd } : {},
@@ -2554,10 +2025,7 @@ function resizePty(message) {
   if (!ptyProcess) {
     return;
   }
-  ptyProcess.resize(
-    Math.max(1, Math.min(Math.floor(message.cols || 80), 500)),
-    Math.max(1, Math.min(Math.floor(message.rows || 24), 500))
-  );
+  ptyProcess.resize(Math.max(1, Math.min(Math.floor(message.cols || 80), 500)), Math.max(1, Math.min(Math.floor(message.rows || 24), 500)));
 }
 function closePty(message) {
   const ptyProcess = activePtys.get(message.ptyId);
@@ -2589,6 +2057,7 @@ async function startWorker(options) {
   validateLabel(label);
   const projectsRoot = path.resolve(options.projectRoot ?? defaultProjectsRoot());
   const syncRoot = path.resolve(options.syncRoot ?? process.env.R5D_SYNC_ROOT ?? defaultSyncRoot());
+  const workspaceShadowRoot = path.join(syncRoot, "workspace");
   const artifactRoot = path.resolve(options.artifactRoot ?? process.env.R5D_ARTIFACTS_ROOT ?? defaultArtifactRoot());
   const planRoot = path.resolve(options.planRoot ?? process.env.R5D_PLANS_ROOT ?? defaultPlanRoot());
   process.stdout.write(`[r5d-worker] label: ${label}
@@ -2610,10 +2079,104 @@ async function startWorker(options) {
   fs.mkdirSync(artifactRoot, { recursive: true });
   fs.mkdirSync(planRoot, { recursive: true });
   const manifestByProjectId = /* @__PURE__ */ new Map();
-  let repositorySyncQueue = Promise.resolve();
-  let repositorySyncInProgress = false;
+  const workspaceSyncSingleFlight = new WorkspaceSyncSingleFlight();
+  let workspaceRemoteUrl = null;
+  let activeWorkspaceIncidentId = null;
+  let previousPeriodicFingerprint = null;
+  let periodicWorkspaceScan;
+  let periodicWorkspaceScanInFlight = false;
+  let terminalReplayTimer;
+  let workspaceSyncRequestsInFlight = 0;
   let cliUpdateInProgress = false;
   let reloadAfterClose = false;
+  const workspaceSyncInput = (trigger, overrides = {}) => {
+    if (!workspaceRemoteUrl) throw new Error("Worker workspace manifest has not been received");
+    return {
+      workerLabel: label,
+      remoteUrl: workspaceRemoteUrl,
+      authHeader: `Authorization: Bearer ${token}`,
+      projectsRoot,
+      plansRoot: planRoot,
+      shadowRoot: workspaceShadowRoot,
+      projects: [...manifestByProjectId.values()],
+      trigger,
+      ...overrides
+    };
+  };
+  const sendWorkspaceSyncResult = (requestId, result) => {
+    sendWorkerMessage(ws, { type: "workspace_sync_result", requestId, result });
+  };
+  const ensureAllVisibleWorkspaceCheckouts = () => {
+    const created = [];
+    for (const manifest of manifestByProjectId.values()) {
+      for (const branchName of manifest.branches) {
+        const branchPath = path.join(projectRootFor(projectsRoot, manifest.projectId, manifestByProjectId), branchName);
+        const existed = fs.existsSync(path.join(branchPath, ".git"));
+        const githubRemoteUrl = githubRemoteUrlFor(baseUrl, manifest.projectId, manifest);
+        ensureVisibleGitCheckout({
+          projectRoot: projectRootFor(projectsRoot, manifest.projectId, manifestByProjectId),
+          branchName,
+          githubRemoteUrl,
+          githubAuth: gitAuthForRemote(githubRemoteUrl, manifest.repoAuthHeader),
+          githubAuthHeader: manifest.repoAuthHeader,
+          defaultBranch: manifest.defaultBranch || "main",
+          reconcileExistingOrigin: Boolean(manifest.repoHttpUrl)
+        });
+        if (!existed) created.push({ projectId: manifest.projectId, branchName });
+      }
+    }
+    return created;
+  };
+  const runRequestedWorkspaceSync = async (requestId, trigger, overrides = {}) => {
+    workspaceSyncRequestsInFlight += 1;
+    try {
+      if (trigger.type === "plan_write" || trigger.type === "task_status" || trigger.type === "connect" || trigger.type === "inbound_head" || trigger.type === "manual") {
+        for (const manifest of manifestByProjectId.values()) {
+          for (const branchName of manifest.branches) {
+            await syncProjectPlans({
+              baseUrl,
+              token,
+              projectId: manifest.projectId,
+              branchName,
+              planRoot
+            });
+          }
+        }
+      }
+      const newVisibleCheckouts = trigger.type === "connect" ? ensureAllVisibleWorkspaceCheckouts() : [];
+      const result = await workspaceSyncSingleFlight.run(
+        workspaceSyncInput(trigger, {
+          ...overrides,
+          ...newVisibleCheckouts.length > 0 ? { newVisibleCheckouts } : {}
+        })
+      );
+      previousPeriodicFingerprint = null;
+      sendWorkspaceSyncResult(requestId, result);
+      return result;
+    } catch (error) {
+      const result = {
+        type: "workspace_sync",
+        attemptId: overrides.attemptId ?? crypto.randomUUID(),
+        workerLabel: label,
+        trigger,
+        outcome: "failed",
+        startingHead: null,
+        rebaseCount: 0,
+        diffSizeBytes: 0,
+        gitStatus: "",
+        affectedProjects: [],
+        affectedPaths: [],
+        discardedPaths: [],
+        localChangesDiscarded: false,
+        error: error instanceof Error ? error.message : String(error)
+      };
+      previousPeriodicFingerprint = null;
+      sendWorkspaceSyncResult(requestId, result);
+      return result;
+    } finally {
+      workspaceSyncRequestsInFlight -= 1;
+    }
+  };
   const ws = new WebSocket(websocketUrl(baseUrl, label), {
     headers: {
       Authorization: `Bearer ${token}`
@@ -2658,6 +2221,15 @@ async function startWorker(options) {
     };
     ws.send(JSON.stringify(hello));
     sendActiveProcessReport(ws);
+    for (const terminal of pendingProcessTerminals.values()) {
+      sendWorkerMessage(ws, terminal);
+    }
+    terminalReplayTimer = setInterval(() => {
+      for (const terminal of pendingProcessTerminals.values()) {
+        sendWorkerMessage(ws, terminal);
+      }
+    }, 5e3);
+    terminalReplayTimer.unref();
     process.stdout.write("[r5d-worker] connected\n");
   });
   ws.addEventListener("message", (event) => {
@@ -2666,91 +2238,68 @@ async function startWorker(options) {
       if (message.type === "connected") {
         return;
       }
-      if (message.type === "project_manifest") {
+      if (message.type === "workspace_manifest") {
         configureGitHubAuth(message.githubCredential);
         visibleGitIdentity = message.gitIdentity;
+        workspaceRemoteUrl = message.workspaceRemoteUrl;
         manifestByProjectId.clear();
-        for (const project of message.projects) {
-          manifestByProjectId.set(project.projectId, project);
-        }
-        process.stdout.write(`[r5d-worker] project manifest: ${message.projects.length} projects
+        for (const project of message.projects) manifestByProjectId.set(project.projectId, project);
+        process.stdout.write(`[r5d-worker] workspace manifest: ${message.projects.length} projects
 `);
-        return;
-      }
-      if (message.type === "sync_projects") {
-        if (cliUpdateInProgress) {
-          sendWorkerMessage(ws, {
-            type: "sync_projects_result",
-            requestId: message.requestId,
-            result: {
-              status: "blocked",
-              results: [],
-              blockedBy: []
-            }
-          });
-          return;
-        }
-        let syncResult = { status: "completed", results: [], blockedBy: [] };
-        const executeSync = async () => {
-          repositorySyncInProgress = true;
-          try {
-            syncResult = await syncManifestProjectsFromInternal({
-              baseUrl,
-              token,
-              projectsRoot,
-              syncRoot,
-              manifests: [...manifestByProjectId.values()],
-              requestedTargets: message.targets
-            });
-            for (const result of syncResult.results) {
-              if (result.status !== "synced") continue;
-              try {
-                await syncProjectPlans({
-                  baseUrl,
-                  token,
-                  projectId: result.projectId,
-                  branchName: result.branchName,
-                  planRoot
-                });
-              } catch (error) {
-                process.stderr.write(
-                  `[r5d-worker] plan sync skipped for ${result.projectId}/${result.branchName}: ${error instanceof Error ? error.message : String(error)}
-`
-                );
+        if (!periodicWorkspaceScan) {
+          const emptyFingerprint = createHash("sha256").update("").digest("hex");
+          periodicWorkspaceScan = setInterval(() => {
+            if (!workspaceRemoteUrl || activeWorkspaceIncidentId || cliUpdateInProgress || periodicWorkspaceScanInFlight) return;
+            periodicWorkspaceScanInFlight = true;
+            void (async () => {
+              const input = workspaceSyncInput({ type: "periodic" });
+              const fingerprint = await workspaceSyncSingleFlight.fingerprint(input);
+              if (fingerprint === emptyFingerprint) {
+                previousPeriodicFingerprint = null;
+                return;
               }
-            }
-          } finally {
-            repositorySyncInProgress = false;
-          }
-        };
-        const queued = repositorySyncQueue.then(executeSync, executeSync);
-        repositorySyncQueue = queued.then(
-          () => void 0,
-          () => void 0
-        );
-        try {
-          await queued;
-        } catch (error) {
-          syncResult = {
-            status: "partial",
-            results: [
-              {
-                projectId: "worker",
-                projectPath: "worker",
-                branchName: "all",
-                status: "failed",
-                error: error instanceof Error ? error.message : String(error)
+              if (previousPeriodicFingerprint !== fingerprint) {
+                previousPeriodicFingerprint = fingerprint;
+                return;
               }
-            ],
-            blockedBy: []
-          };
+              previousPeriodicFingerprint = null;
+              await runRequestedWorkspaceSync(crypto.randomUUID(), { type: "periodic" });
+            })().catch((error) => {
+              process.stderr.write(
+                `[r5d-worker] periodic workspace synchronization failed: ${error instanceof Error ? error.message : String(error)}
+`
+              );
+            }).finally(() => {
+              periodicWorkspaceScanInFlight = false;
+            });
+          }, WORKSPACE_PERIODIC_SCAN_INTERVAL_MS);
+          periodicWorkspaceScan.unref();
         }
-        sendWorkerMessage(ws, {
-          type: "sync_projects_result",
-          requestId: message.requestId,
-          result: syncResult
+        return;
+      }
+      if (message.type === "sync_workspace") {
+        await runRequestedWorkspaceSync(message.requestId, message.trigger, {
+          attemptId: message.attemptId,
+          confirmedLargeDiff: message.confirmedLargeDiff,
+          confirmationReason: message.confirmationReason,
+          resetToCanonical: message.resetToCanonical,
+          skipVisibleMirror: message.skipVisibleMirror
         });
-        sendActiveProcessReport(ws);
+        return;
+      }
+      if (message.type === "workspace_head_updated") {
+        if (!activeWorkspaceIncidentId) {
+          await runRequestedWorkspaceSync(crypto.randomUUID(), { type: "inbound_head", detail: message.commitHash });
+        }
+        return;
+      }
+      if (message.type === "workspace_incident_updated") {
+        activeWorkspaceIncidentId = message.status === "remediating" || message.status === "waiting_for_worker" ? message.incidentId : null;
+        previousPeriodicFingerprint = null;
+        return;
+      }
+      if (message.type === "exec_terminal_ack") {
+        pendingProcessTerminals.delete(message.runId);
         return;
       }
       if (message.type === "update_clis") {
@@ -2762,7 +2311,7 @@ async function startWorker(options) {
           });
           return;
         }
-        if (activeProcesses.size > 0 || activePtys.size > 0 || repositorySyncInProgress) {
+        if (activeProcesses.size > 0 || activePtys.size > 0 || workspaceSyncRequestsInFlight > 0) {
           sendWorkerMessage(ws, {
             type: "update_clis_result",
             requestId: message.requestId,
@@ -2832,7 +2381,6 @@ async function startWorker(options) {
           });
           return;
         }
-        await repositorySyncQueue;
         const manifest = manifestByProjectId.get(message.projectId);
         const projectRoot = projectRootFor(projectsRoot, message.projectId, manifestByProjectId);
         process.stdout.write(`[r5d-worker] pty ${message.ptyId}: ${message.projectId}/${message.branchName}
@@ -2863,7 +2411,6 @@ async function startWorker(options) {
           });
           return;
         }
-        await repositorySyncQueue;
         const manifest = manifestByProjectId.get(message.projectId);
         const projectRoot = projectRootFor(projectsRoot, message.projectId, manifestByProjectId);
         process.stdout.write(`[r5d-worker] exec ${message.runId}: ${message.argv.join(" ")}
@@ -2877,6 +2424,7 @@ async function startWorker(options) {
           syncRoot,
           artifactRoot,
           planRoot,
+          workspaceShadowRoot,
           manifest
         });
         ws.send(JSON.stringify(result));
@@ -2892,7 +2440,6 @@ async function startWorker(options) {
           });
           return;
         }
-        await repositorySyncQueue;
         sendWorkerMessage(ws, {
           type: "exec_accepted",
           requestId: message.requestId,
@@ -2913,6 +2460,7 @@ async function startWorker(options) {
             syncRoot,
             artifactRoot,
             planRoot,
+            workspaceShadowRoot,
             manifest
           }).catch((error) => {
             sendWorkerMessage(ws, {
@@ -2932,9 +2480,8 @@ async function startWorker(options) {
         }
         return;
       }
-      if (message.type === "resolve_managed_path" || message.type === "workspace_status" || message.type === "read" || message.type === "write" || message.type === "edit" || message.type === "grep" || message.type === "find" || message.type === "ls" || message.type === "view_file_bytes" || message.type === "sync" || message.type === "confirm_large_diff" || message.type === "pull_branch") {
+      if (message.type === "read" || message.type === "write" || message.type === "edit" || message.type === "grep" || message.type === "find" || message.type === "ls" || message.type === "view_file_bytes") {
         try {
-          await repositorySyncQueue;
           const manifest = manifestByProjectId.get(message.projectId);
           const projectRoot = projectRootFor(projectsRoot, message.projectId, manifestByProjectId);
           const result = await executeOperation({
@@ -2945,8 +2492,6 @@ async function startWorker(options) {
             projectRoot,
             syncRoot,
             artifactRoot,
-            projectsRoot,
-            manifests: [...manifestByProjectId.values()],
             manifest
           });
           ws.send(
@@ -2984,6 +2529,14 @@ async function startWorker(options) {
   });
   ws.addEventListener("close", (event) => {
     stopHeartbeatWatchdog();
+    if (periodicWorkspaceScan) {
+      clearInterval(periodicWorkspaceScan);
+      periodicWorkspaceScan = void 0;
+    }
+    if (terminalReplayTimer) {
+      clearInterval(terminalReplayTimer);
+      terminalReplayTimer = void 0;
+    }
     if (currentWorkerSocket === ws) {
       currentWorkerSocket = null;
     }
@@ -2994,15 +2547,17 @@ async function startWorker(options) {
     if (reloadAfterClose) {
       process.exit(WORKER_RELOAD_EXIT_CODE);
     }
-    if (activeProcesses.size > 0) {
+    if (activeProcesses.size > 0 || pendingProcessTerminals.size > 0) {
       const delayMs = 2e3;
-      process.stderr.write(`[r5d-worker] ${activeProcesses.size} process(es) still active; reconnecting in ${delayMs}ms
-`);
+      process.stderr.write(
+        `[r5d-worker] ${activeProcesses.size} process(es) active and ${pendingProcessTerminals.size} terminal report(s) pending; reconnecting in ${delayMs}ms
+`
+      );
       const reconnect = () => {
         void startWorker(options).catch((error) => {
           process.stderr.write(`[r5d-worker] reconnect failed: ${error instanceof Error ? error.message : String(error)}
 `);
-          if (activeProcesses.size > 0) {
+          if (activeProcesses.size > 0 || pendingProcessTerminals.size > 0) {
             setTimeout(reconnect, delayMs);
             return;
           }
@@ -3057,11 +2612,9 @@ if (isCliEntrypoint()) {
 }
 export {
   ensureVisibleGitCheckout,
-  findRepositorySyncBlockers,
   findWorkerFiles,
   githubCliEnv,
   grepWorkerFiles,
-  inspectManagedWorkspace,
   isArtifactEnvPath,
   listWorkerDirectory,
   prepareArtifactEnvForShell,
@@ -3069,11 +2622,8 @@ export {
   readWorkerImageFile,
   readWorkerTextFile,
   resolveHostShell,
-  resolveManagedCheckoutPath,
   resolveProjectFilePath,
   resolveWorkerFilePath,
-  selectManifestSyncTargets,
-  syncManifestProjectsFromInternal,
   syncProjectPlans,
   syncSessionArtifacts
 };