@ricsam/r5d-worker 0.0.47 → 0.0.49

package/dist/mjs/main.mjs

@@ -8,6 +8,7 @@ import { installCliUpdate, readInstalledCliVersion } from "./cli-update.mjs";
 import { configureVisibleGitIdentity } from "./git-identity.mjs";
 import { hasWorkerHeartbeatTimedOut, WORKER_HEARTBEAT_INTERVAL_MS } from "./heartbeat.mjs";
 import { terminateProcessTree } from "./process-tree.mjs";
+import { openWorkerPortForwardRelay } from "./port-forward-client.mjs";
 import {
   isRetryableWorkerServerStatus,
   superviseWorkerRuntime,
@@ -294,8 +295,15 @@ function projectPlanDir(planRoot, projectId, branchName) {
   validateBranchName(branchName);
   return path.join(planRoot, projectId, branchName);
 }
-function planEnv(planRoot, projectId, branchName, activePlanId) {
-  const plansDir = projectPlanDir(planRoot, projectId, branchName);
+function targetPlanDir(planRoot, target) {
+  if (target.type === "project") return projectPlanDir(planRoot, target.projectId, target.branchName);
+  if (target.rootProfile === "canonical_sync") {
+    throw new Error("Ordinary plans are unavailable in canonical synchronization sessions");
+  }
+  return path.join(planRoot, "workspace");
+}
+function planEnv(planRoot, target, activePlanId) {
+  const plansDir = targetPlanDir(planRoot, target);
   const env = {
     [R5D_PLANS_DIR_ENV]: plansDir
   };
@@ -313,14 +321,14 @@ function isArtifactEnvPath(filePath) {
     return false;
   }
 }
-function artifactApiBasePath(projectId, branchName, sessionId) {
-  return `/preview-api/${encodeURIComponent(projectId)}/${encodeURIComponent(branchName)}/artifacts/${encodeURIComponent(sessionId)}`;
+function artifactApiBasePath(sessionId) {
+  return `/preview-api/artifacts/${encodeURIComponent(sessionId)}`;
 }
-function artifactManifestUrl(baseUrl, projectId, branchName, sessionId) {
-  return new URL(artifactApiBasePath(projectId, branchName, sessionId), baseUrl);
+function artifactManifestUrl(baseUrl, sessionId) {
+  return new URL(artifactApiBasePath(sessionId), baseUrl);
 }
-function artifactDownloadUrl(baseUrl, projectId, branchName, sessionId, filename) {
-  return new URL(`${artifactApiBasePath(projectId, branchName, sessionId)}/${encodeURIComponent(filename)}`, baseUrl);
+function artifactDownloadUrl(baseUrl, sessionId, filename) {
+  return new URL(`${artifactApiBasePath(sessionId)}/${encodeURIComponent(filename)}`, baseUrl);
 }
 function sha256Path(filePath) {
   return createHash("sha256").update(fs.readFileSync(filePath)).digest("hex");
@@ -412,7 +420,7 @@ async function syncRemoteFileSet(input) {
 }
 async function fetchSessionArtifactManifest(input) {
   return fetchRemoteFileManifest({
-    url: artifactManifestUrl(input.baseUrl, input.projectId, input.branchName, input.sessionId),
+    url: artifactManifestUrl(input.baseUrl, input.sessionId),
     token: input.token,
     collectionKey: "artifacts",
     label: "artifact"
@@ -430,7 +438,7 @@ async function syncSessionArtifacts(input) {
       files: artifacts,
       label: "Artifact path",
       download: (artifact) => downloadRemoteSyncedFile({
-        url: artifactDownloadUrl(input.baseUrl, input.projectId, input.branchName, input.sessionId, artifact.filename),
+        url: artifactDownloadUrl(input.baseUrl, input.sessionId, artifact.filename),
         token: input.token,
         targetDir,
         file: artifact,
@@ -463,14 +471,12 @@ async function prepareBuiltInToolPaths(input) {
       artifactsDir: await syncSessionArtifacts({
         baseUrl: input.baseUrl,
         token: input.token,
-        projectId: input.projectId,
-        branchName: input.branchName,
         sessionId: input.sessionId,
         artifactRoot: input.artifactRoot
       })
     };
   }
-  const plansDir = projectPlanDir(input.planRoot, input.projectId, input.branchName);
+  const plansDir = targetPlanDir(input.planRoot, input.target);
   fs.mkdirSync(plansDir, { recursive: true });
   if (parsed.ref === R5D_PLANS_DIR_REF) {
     return { plansDir };
@@ -492,8 +498,6 @@ async function prepareArtifactEnvForShell(input) {
     await syncSessionArtifacts({
       baseUrl: input.baseUrl,
       token: input.token,
-      projectId: input.projectId,
-      branchName: input.branchName,
       sessionId: input.sessionId,
       artifactRoot: input.artifactRoot
     });
@@ -510,9 +514,9 @@ async function prepareArtifactEnvForShell(input) {
   };
 }
 function preparePlanEnvForShell(input) {
-  const plansDir = projectPlanDir(input.planRoot, input.projectId, input.branchName);
+  const plansDir = targetPlanDir(input.planRoot, input.target);
   fs.mkdirSync(plansDir, { recursive: true });
-  return planEnv(input.planRoot, input.projectId, input.branchName, input.activePlanId);
+  return planEnv(input.planRoot, input.target, input.activePlanId);
 }
 async function verifyR5dctlAuth(baseUrl, token) {
   const statusUrl = new URL("/api/r5dctl/auth/status", baseUrl);
@@ -1127,6 +1131,32 @@ function ensureBranchWorkspace(input) {
     })
   };
 }
+function describeWorkerSessionTarget(target) {
+  return target.type === "project" ? `${target.projectId}/${target.branchName}` : `${target.ownerUserId}/${target.rootProfile}`;
+}
+function resolveWorkerSessionTarget(input) {
+  if (input.target.type === "workspace") {
+    if (input.target.rootProfile === "visible_projects") {
+      return { target: input.target, rootPath: input.projectsRoot };
+    }
+    if (!fs.existsSync(path.join(input.workspaceShadowRoot, ".git"))) {
+      throw new Error("The canonical workspace checkout is not initialized on this worker");
+    }
+    return { target: input.target, rootPath: input.workspaceShadowRoot };
+  }
+  const manifest = input.manifestByProjectId.get(input.target.projectId);
+  const projectRoot = projectRootFor(input.projectsRoot, input.target.projectId, input.manifestByProjectId);
+  const workspace = ensureBranchWorkspace({
+    projectId: input.target.projectId,
+    baseUrl: input.baseUrl,
+    token: input.token,
+    projectRoot,
+    syncRoot: input.syncRoot,
+    branchName: input.target.branchName,
+    manifest
+  });
+  return { target: input.target, rootPath: workspace.branchPath, manifest };
+}
 function workspaceSyncCheckoutTargets(input) {
   const selected = /* @__PURE__ */ new Map();
   const add = (target) => {
@@ -1155,7 +1185,7 @@ function resolveCommandCwd(branchPath, cwd) {
   const resolved = path.resolve(branchPath, cwd);
   const relative = path.relative(branchPath, resolved);
   if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
-    throw new Error(`Relative cwd escapes the project branch: ${cwd}`);
+    throw new Error(`Relative cwd escapes the execution root: ${cwd}`);
   }
   return resolved;
 }
@@ -1190,8 +1220,8 @@ async function streamCommandOutput(stream, onData) {
     reader.releaseLock();
   }
 }
-function ensureOperationBranch(input) {
-  return ensureBranchWorkspace(input);
+async function prepareBuiltInToolPathsForTarget(input) {
+  return prepareBuiltInToolPaths(input);
 }
 function formatLineNumberedContent(content, offset, limit) {
   const allLines = content.split("\n");
@@ -1317,11 +1347,11 @@ async function withFileMutationQueue(key, operation) {
     }
   }
 }
-function mutationQueueKey(projectId, branchName, resolved) {
+function mutationQueueKey(target, resolved) {
   if (resolved.scope !== "project") {
     return `${resolved.scope}:${path.normalize(resolved.absolutePath)}`;
   }
-  return `project:${projectId}:${branchName}:${path.posix.normalize(resolved.repoRelativePath)}`;
+  return `${describeWorkerSessionTarget(target)}:${path.posix.normalize(resolved.repoRelativePath)}`;
 }
 function readWorkerTextFile(branchPath, filePath, offset, limit, builtInPaths) {
   const resolved = resolveWorkerFilePath(branchPath, filePath, builtInPaths);
@@ -1396,57 +1426,51 @@ function editWorkerTextFile(branchPath, filePath, edits, builtInPaths) {
   };
 }
 async function executeReadFileOperation(input) {
-  const builtInPaths = await prepareBuiltInToolPaths({
+  const builtInPaths = await prepareBuiltInToolPathsForTarget({
+    target: input.resolvedTarget.target,
     filePath: input.message.filePath,
     baseUrl: input.baseUrl,
     token: input.token,
-    projectId: input.projectId,
-    branchName: input.message.branchName,
     sessionId: input.message.sessionId,
     activePlanId: input.message.activePlanId,
     artifactRoot: input.artifactRoot,
     planRoot: input.planRoot,
     access: "read"
   });
-  const workspace = ensureOperationBranch({ ...input, branchName: input.message.branchName });
-  return readWorkerTextFile(workspace.branchPath, input.message.filePath, input.message.offset, input.message.limit, builtInPaths);
+  return readWorkerTextFile(input.resolvedTarget.rootPath, input.message.filePath, input.message.offset, input.message.limit, builtInPaths);
 }
 async function executeWriteFileOperation(input) {
-  const builtInPaths = await prepareBuiltInToolPaths({
+  const builtInPaths = await prepareBuiltInToolPathsForTarget({
+    target: input.resolvedTarget.target,
     filePath: input.message.filePath,
     baseUrl: input.baseUrl,
     token: input.token,
-    projectId: input.projectId,
-    branchName: input.message.branchName,
     sessionId: input.message.sessionId,
     activePlanId: input.message.activePlanId,
     artifactRoot: input.artifactRoot,
     planRoot: input.planRoot,
     access: "write"
   });
-  const workspace = ensureOperationBranch({ ...input, branchName: input.message.branchName });
-  const resolved = resolveWorkerFilePath(workspace.branchPath, input.message.filePath, builtInPaths);
-  return withFileMutationQueue(mutationQueueKey(input.projectId, input.message.branchName, resolved), async () => {
-    return writeWorkerTextFile(workspace.branchPath, input.message.filePath, input.message.content, builtInPaths);
+  const resolved = resolveWorkerFilePath(input.resolvedTarget.rootPath, input.message.filePath, builtInPaths);
+  return withFileMutationQueue(mutationQueueKey(input.resolvedTarget.target, resolved), async () => {
+    return writeWorkerTextFile(input.resolvedTarget.rootPath, input.message.filePath, input.message.content, builtInPaths);
   });
 }
 async function executeEditFileOperation(input) {
-  const builtInPaths = await prepareBuiltInToolPaths({
+  const builtInPaths = await prepareBuiltInToolPathsForTarget({
+    target: input.resolvedTarget.target,
     filePath: input.message.filePath,
     baseUrl: input.baseUrl,
     token: input.token,
-    projectId: input.projectId,
-    branchName: input.message.branchName,
     sessionId: input.message.sessionId,
     activePlanId: input.message.activePlanId,
     artifactRoot: input.artifactRoot,
     planRoot: input.planRoot,
     access: "write"
   });
-  const workspace = ensureOperationBranch({ ...input, branchName: input.message.branchName });
-  const resolved = resolveWorkerFilePath(workspace.branchPath, input.message.filePath, builtInPaths);
-  return withFileMutationQueue(mutationQueueKey(input.projectId, input.message.branchName, resolved), async () => {
-    return editWorkerTextFile(workspace.branchPath, input.message.filePath, input.message.edits, builtInPaths);
+  const resolved = resolveWorkerFilePath(input.resolvedTarget.rootPath, input.message.filePath, builtInPaths);
+  return withFileMutationQueue(mutationQueueKey(input.resolvedTarget.target, resolved), async () => {
+    return editWorkerTextFile(input.resolvedTarget.rootPath, input.message.filePath, input.message.edits, builtInPaths);
   });
 }
 const IGNORED_ENTRY_NAMES = /* @__PURE__ */ new Set([".git", "node_modules", "dist", "build", ".next", ".cache", "coverage", "target"]);
@@ -1559,21 +1583,19 @@ function grepWorkerFiles(branchPath, input, builtInPaths) {
 }
 async function executeGrepOperation(input) {
   const toolPath = input.message.path ?? ".";
-  const builtInPaths = await prepareBuiltInToolPaths({
+  const builtInPaths = await prepareBuiltInToolPathsForTarget({
+    target: input.resolvedTarget.target,
     filePath: toolPath,
     baseUrl: input.baseUrl,
     token: input.token,
-    projectId: input.projectId,
-    branchName: input.message.branchName,
     sessionId: input.message.sessionId,
     activePlanId: input.message.activePlanId,
     artifactRoot: input.artifactRoot,
     planRoot: input.planRoot,
     access: "read"
   });
-  const workspace = ensureOperationBranch({ ...input, branchName: input.message.branchName });
   return grepWorkerFiles(
-    workspace.branchPath,
+    input.resolvedTarget.rootPath,
     {
       pattern: input.message.pattern,
       path: input.message.path,
@@ -1620,21 +1642,19 @@ function findWorkerFiles(branchPath, input, builtInPaths) {
 }
 async function executeFindOperation(input) {
   const toolPath = input.message.path ?? ".";
-  const builtInPaths = await prepareBuiltInToolPaths({
+  const builtInPaths = await prepareBuiltInToolPathsForTarget({
+    target: input.resolvedTarget.target,
     filePath: toolPath,
     baseUrl: input.baseUrl,
     token: input.token,
-    projectId: input.projectId,
-    branchName: input.message.branchName,
     sessionId: input.message.sessionId,
     activePlanId: input.message.activePlanId,
     artifactRoot: input.artifactRoot,
     planRoot: input.planRoot,
     access: "read"
   });
-  const workspace = ensureOperationBranch({ ...input, branchName: input.message.branchName });
   return findWorkerFiles(
-    workspace.branchPath,
+    input.resolvedTarget.rootPath,
     {
       pattern: input.message.pattern,
       path: input.message.path,
@@ -1664,20 +1684,18 @@ function listWorkerDirectory(branchPath, inputPath = ".", inputLimit, builtInPat
 }
 async function executeLsOperation(input) {
   const toolPath = input.message.path ?? ".";
-  const builtInPaths = await prepareBuiltInToolPaths({
+  const builtInPaths = await prepareBuiltInToolPathsForTarget({
+    target: input.resolvedTarget.target,
     filePath: toolPath,
     baseUrl: input.baseUrl,
     token: input.token,
-    projectId: input.projectId,
-    branchName: input.message.branchName,
     sessionId: input.message.sessionId,
     activePlanId: input.message.activePlanId,
     artifactRoot: input.artifactRoot,
     planRoot: input.planRoot,
     access: "read"
   });
-  const workspace = ensureOperationBranch({ ...input, branchName: input.message.branchName });
-  return listWorkerDirectory(workspace.branchPath, input.message.path, input.message.limit, builtInPaths);
+  return listWorkerDirectory(input.resolvedTarget.rootPath, input.message.path, input.message.limit, builtInPaths);
 }
 function readWorkerImageFile(branchPath, filePath, builtInPaths) {
   const resolved = resolveWorkerFilePath(branchPath, filePath, builtInPaths);
@@ -1702,20 +1720,18 @@ function readWorkerImageFile(branchPath, filePath, builtInPaths) {
   };
 }
 async function executeViewFileBytesOperation(input) {
-  const builtInPaths = await prepareBuiltInToolPaths({
+  const builtInPaths = await prepareBuiltInToolPathsForTarget({
+    target: input.resolvedTarget.target,
     filePath: input.message.filePath,
     baseUrl: input.baseUrl,
     token: input.token,
-    projectId: input.projectId,
-    branchName: input.message.branchName,
     sessionId: input.message.sessionId,
     activePlanId: input.message.activePlanId,
     artifactRoot: input.artifactRoot,
     planRoot: input.planRoot,
     access: "read"
   });
-  const workspace = ensureOperationBranch({ ...input, branchName: input.message.branchName });
-  return readWorkerImageFile(workspace.branchPath, input.message.filePath, builtInPaths);
+  return readWorkerImageFile(input.resolvedTarget.rootPath, input.message.filePath, builtInPaths);
 }
 async function executeOperation(input) {
   switch (input.message.type) {
@@ -1735,38 +1751,56 @@ async function executeOperation(input) {
       return executeViewFileBytesOperation({ ...input, message: input.message });
   }
 }
+function targetIdentityEnv(target) {
+  return target.type === "project" ? {
+    R5D_PROJECT_ID: target.projectId,
+    R5D_BRANCH_NAME: target.branchName,
+    R5D_WORKSPACE_OWNER_ID: "",
+    R5D_WORKSPACE_ROOT_PROFILE: ""
+  } : {
+    R5D_WORKSPACE_OWNER_ID: target.ownerUserId,
+    R5D_WORKSPACE_ROOT_PROFILE: target.rootProfile,
+    R5D_PROJECT_ID: "",
+    R5D_BRANCH_NAME: ""
+  };
+}
+async function prepareShellEnvForTarget(input) {
+  const artifactProcessEnv = await prepareArtifactEnvForShell({
+    baseUrl: input.baseUrl,
+    token: input.token,
+    sessionId: input.sessionId,
+    artifactRoot: input.artifactRoot
+  });
+  if (input.target.type === "workspace" && input.target.rootProfile === "canonical_sync") {
+    return {
+      ...artifactProcessEnv,
+      ...targetIdentityEnv(input.target)
+    };
+  }
+  return {
+    ...artifactProcessEnv,
+    ...preparePlanEnvForShell({
+      target: input.target,
+      planRoot: input.planRoot,
+      activePlanId: input.activePlanId
+    }),
+    ...targetIdentityEnv(input.target)
+  };
+}
 async function executeCommand(input) {
   const startedAt = Date.now();
   let timeout;
   try {
-    const workspace = ensureBranchWorkspace({
-      projectId: input.projectId,
-      baseUrl: input.baseUrl,
-      token: input.token,
-      projectRoot: input.projectRoot,
-      syncRoot: input.syncRoot,
-      branchName: input.message.branchName,
-      manifest: input.manifest
-    });
-    const artifactProcessEnv = await prepareArtifactEnvForShell({
+    const targetProcessEnv = await prepareShellEnvForTarget({
+      target: input.resolvedTarget.target,
       baseUrl: input.baseUrl,
       token: input.token,
-      projectId: input.projectId,
-      branchName: input.message.branchName,
       sessionId: input.message.sessionId,
-      artifactRoot: input.artifactRoot
-    });
-    const planProcessEnv = preparePlanEnvForShell({
-      projectId: input.projectId,
-      branchName: input.message.branchName,
+      artifactRoot: input.artifactRoot,
       planRoot: input.planRoot,
       activePlanId: input.message.env?.R5D_ACTIVE_PLAN_ID
     });
-    const commandRoot = input.message.env?.R5D_USE_WORKSPACE_GIT === "1" ? input.workspaceShadowRoot : workspace.branchPath;
-    if (input.message.env?.R5D_USE_WORKSPACE_GIT === "1" && !fs.existsSync(path.join(commandRoot, ".git"))) {
-      throw new Error("The canonical workspace checkout is not initialized on this worker");
-    }
-    const cwd = resolveCommandCwd(commandRoot, input.message.cwd);
+    const cwd = resolveCommandCwd(input.resolvedTarget.rootPath, input.message.cwd);
     const subprocess = Bun.spawn(input.message.argv, {
       cwd,
       stdout: "pipe",
@@ -1776,15 +1810,13 @@ async function executeCommand(input) {
         ...process.env,
         ...githubProcessEnv(),
         ...input.message.env ?? {},
-        ...artifactProcessEnv,
-        ...planProcessEnv
+        ...targetProcessEnv
       }
     });
     activeProcesses.set(input.message.runId, {
       process: subprocess,
-      projectId: input.projectId,
+      target: input.resolvedTarget.target,
       sessionId: input.message.sessionId ?? "",
-      branchName: input.message.branchName,
       mode: "foreground",
       pid: subprocess.pid,
       processGroupId: process.platform === "win32" ? void 0 : subprocess.pid,
@@ -1848,34 +1880,16 @@ async function executeStreamingCommand(input) {
       });
       return;
     }
-    const workspace = ensureBranchWorkspace({
-      projectId: input.projectId,
-      baseUrl: input.baseUrl,
-      token: input.token,
-      projectRoot: input.projectRoot,
-      syncRoot: input.syncRoot,
-      branchName: input.message.branchName,
-      manifest: input.manifest
-    });
-    const artifactProcessEnv = await prepareArtifactEnvForShell({
+    const targetProcessEnv = await prepareShellEnvForTarget({
+      target: input.resolvedTarget.target,
       baseUrl: input.baseUrl,
       token: input.token,
-      projectId: input.projectId,
-      branchName: input.message.branchName,
       sessionId: input.message.sessionId,
-      artifactRoot: input.artifactRoot
-    });
-    const planProcessEnv = preparePlanEnvForShell({
-      projectId: input.projectId,
-      branchName: input.message.branchName,
+      artifactRoot: input.artifactRoot,
       planRoot: input.planRoot,
       activePlanId: input.message.env?.R5D_ACTIVE_PLAN_ID
     });
-    const commandRoot = input.message.env?.R5D_USE_WORKSPACE_GIT === "1" ? input.workspaceShadowRoot : workspace.branchPath;
-    if (input.message.env?.R5D_USE_WORKSPACE_GIT === "1" && !fs.existsSync(path.join(commandRoot, ".git"))) {
-      throw new Error("The canonical workspace checkout is not initialized on this worker");
-    }
-    const cwd = resolveCommandCwd(commandRoot, input.message.cwd);
+    const cwd = resolveCommandCwd(input.resolvedTarget.rootPath, input.message.cwd);
     const subprocess = Bun.spawn(input.message.argv, {
       cwd,
       stdout: "pipe",
@@ -1885,15 +1899,13 @@ async function executeStreamingCommand(input) {
         ...process.env,
         ...githubProcessEnv(),
         ...input.message.env ?? {},
-        ...artifactProcessEnv,
-        ...planProcessEnv
+        ...targetProcessEnv
       }
     });
     activeProcesses.set(input.message.runId, {
       process: subprocess,
-      projectId: input.projectId,
+      target: input.resolvedTarget.target,
       sessionId: input.message.sessionId,
-      branchName: input.message.branchName,
       mode: input.message.mode,
       pid: subprocess.pid,
       processGroupId: process.platform === "win32" ? void 0 : subprocess.pid,
@@ -1990,9 +2002,8 @@ function sendWorkerMessage(ws, message) {
 function buildActiveProcessReports() {
   return Array.from(activeProcesses.entries()).filter(([, active]) => active.sessionId.length > 0).map(([runId, active]) => ({
     runId,
-    projectId: active.projectId,
+    target: active.target,
     sessionId: active.sessionId,
-    branchName: active.branchName,
     platform: process.platform,
     arch: process.arch,
     mode: active.mode,
@@ -2200,21 +2211,12 @@ function resolveHostShell(command, platform = process.platform) {
 }
 async function openPty(input) {
   try {
-    const branchPath = ensureBranchWorkspace({
-      projectId: input.projectId,
-      baseUrl: input.baseUrl,
-      token: input.token,
-      projectRoot: input.projectRoot,
-      syncRoot: input.syncRoot,
-      branchName: input.message.branchName,
-      manifest: input.manifest
-    });
-    const planProcessEnv = preparePlanEnvForShell({
-      projectId: input.projectId,
-      branchName: input.message.branchName,
+    const planProcessEnv = !(input.resolvedTarget.target.type === "workspace" && input.resolvedTarget.target.rootProfile === "canonical_sync") ? preparePlanEnvForShell({
+      target: input.resolvedTarget.target,
       planRoot: input.planRoot,
       activePlanId: input.message.env?.R5D_ACTIVE_PLAN_ID
-    });
+    }) : {};
+    const targetProcessEnv = targetIdentityEnv(input.resolvedTarget.target);
     const shell = resolveHostShell(input.message.command);
     const ptyProcess = createNodePtyBridge({
       file: shell.file,
@@ -2223,14 +2225,13 @@ async function openPty(input) {
         name: "xterm-256color",
         cols: Math.max(1, Math.min(Math.floor(input.message.cols || 80), 500)),
         rows: Math.max(1, Math.min(Math.floor(input.message.rows || 24), 500)),
-        cwd: branchPath.branchPath,
+        cwd: input.resolvedTarget.rootPath,
         env: {
           ...process.env,
           ...githubProcessEnv(),
           ...input.message.env ?? {},
           ...planProcessEnv,
-          R5D_PROJECT_ID: input.projectId,
-          R5D_BRANCH_NAME: input.message.branchName
+          ...targetProcessEnv
         }
       },
       onOpened: () => {
@@ -2268,8 +2269,7 @@ async function openPty(input) {
     });
     activePtys.set(input.message.ptyId, {
       ...ptyProcess,
-      projectId: input.projectId,
-      branchName: input.message.branchName
+      target: input.resolvedTarget.target
     });
   } catch (error) {
     sendWorkerMessage(input.ws, {
@@ -2388,6 +2388,15 @@ async function startWorker(options) {
   const allManifestCheckouts = () => [...manifestByProjectId.values()].flatMap(
     (manifest) => manifest.branches.map((branchName) => ({ projectId: manifest.projectId, branchName }))
   );
+  const resolveMessageTarget = (target) => resolveWorkerSessionTarget({
+    target,
+    baseUrl,
+    token,
+    projectsRoot,
+    syncRoot,
+    workspaceShadowRoot,
+    manifestByProjectId
+  });
   const ensureVisibleWorkspaceCheckouts = (targets, options2 = {}) => {
     const created = [];
     for (const target of targets) {
@@ -2530,7 +2539,8 @@ async function startWorker(options) {
         r5dctlVersion: readInstalledCliVersion("r5dctl"),
         capabilities: {
           updateClis: true,
-          canonicalResolverCheckout: true
+          canonicalResolverCheckout: true,
+          browserPortForwarding: true
         },
         projectRoot: projectsRoot,
         artifactRoot,
@@ -2642,7 +2652,11 @@ async function startWorker(options) {
       }
       if (message.type === "workspace_head_updated") {
         if (!activeWorkspaceIncidentId) {
-          await runRequestedWorkspaceSync(crypto.randomUUID(), { type: "inbound_head", detail: message.commitHash });
+          await runRequestedWorkspaceSync(
+            crypto.randomUUID(),
+            { type: "inbound_head", detail: message.commitHash },
+            { skipVisibleMirror: true }
+          );
         }
         return;
       }
@@ -2652,8 +2666,6 @@ async function startWorker(options) {
           await syncSessionArtifacts({
             baseUrl,
             token,
-            projectId: message.projectId,
-            branchName: message.branchName,
             sessionId: message.sessionId,
             artifactRoot
           });
@@ -2683,6 +2695,17 @@ async function startWorker(options) {
         pendingProcessTerminals.delete(message.runId);
         return;
       }
+      if (message.type === "port_forward_connect") {
+        openWorkerPortForwardRelay({
+          baseUrl,
+          token,
+          label,
+          forwardId: message.forwardId,
+          relayConnectionId: message.relayConnectionId,
+          workerPort: message.workerPort
+        });
+        return;
+      }
       if (message.type === "update_clis") {
         if (cliUpdateInProgress) {
           sendWorkerMessage(ws, {
@@ -2762,11 +2785,19 @@ async function startWorker(options) {
           });
           return;
         }
-        const manifest = manifestByProjectId.get(message.projectId);
-        const projectRoot = projectRootFor(projectsRoot, message.projectId, manifestByProjectId);
-        process.stdout.write(`[r5d-worker] pty ${message.ptyId}: ${message.projectId}/${message.branchName}
+        try {
+          const resolvedTarget = resolveMessageTarget(message.target);
+          process.stdout.write(`[r5d-worker] pty ${message.ptyId}: ${describeWorkerSessionTarget(message.target)}
 `);
-        await openPty({ ws, message, projectId: message.projectId, baseUrl, token, projectRoot, syncRoot, planRoot, manifest });
+          await openPty({ ws, message, resolvedTarget, planRoot });
+        } catch (error) {
+          sendWorkerMessage(ws, {
+            type: "pty_error",
+            requestId: message.requestId,
+            ptyId: message.ptyId,
+            error: error instanceof Error ? error.message : String(error)
+          });
+        }
         return;
       }
       if (message.type === "pty_input") {
@@ -2792,22 +2823,22 @@ async function startWorker(options) {
           });
           return;
         }
-        const manifest = manifestByProjectId.get(message.projectId);
-        const projectRoot = projectRootFor(projectsRoot, message.projectId, manifestByProjectId);
-        process.stdout.write(`[r5d-worker] exec ${message.runId}: ${message.argv.join(" ")}
+        let result;
+        try {
+          const resolvedTarget = resolveMessageTarget(message.target);
+          process.stdout.write(`[r5d-worker] exec ${message.runId}: ${message.argv.join(" ")}
 `);
-        const result = await executeCommand({
-          message,
-          projectId: message.projectId,
-          baseUrl,
-          token,
-          projectRoot,
-          syncRoot,
-          artifactRoot,
-          planRoot,
-          workspaceShadowRoot,
-          manifest
-        });
+          result = await executeCommand({ message, resolvedTarget, baseUrl, token, artifactRoot, planRoot });
+        } catch (error) {
+          result = {
+            type: "exec_result",
+            requestId: message.requestId,
+            stdout: "",
+            stderr: "",
+            exitCode: 1,
+            error: error instanceof Error ? error.message : String(error)
+          };
+        }
         ws.send(JSON.stringify(result));
         return;
       }
@@ -2827,22 +2858,17 @@ async function startWorker(options) {
           runId: message.runId
         });
         try {
-          const manifest = manifestByProjectId.get(message.projectId);
-          const projectRoot = projectRootFor(projectsRoot, message.projectId, manifestByProjectId);
+          const resolvedTarget = resolveMessageTarget(message.target);
           process.stdout.write(`[r5d-worker] exec_start ${message.runId}: ${message.argv.join(" ")}
 `);
           void executeStreamingCommand({
             ws,
             message,
-            projectId: message.projectId,
+            resolvedTarget,
             baseUrl,
             token,
-            projectRoot,
-            syncRoot,
             artifactRoot,
-            planRoot,
-            workspaceShadowRoot,
-            manifest
+            planRoot
           }).catch((error) => {
             sendWorkerMessage(ws, {
               type: "exec_start_error",
@@ -2863,18 +2889,14 @@ async function startWorker(options) {
       }
       if (message.type === "read" || message.type === "write" || message.type === "edit" || message.type === "grep" || message.type === "find" || message.type === "ls" || message.type === "view_file_bytes") {
         try {
-          const manifest = manifestByProjectId.get(message.projectId);
-          const projectRoot = projectRootFor(projectsRoot, message.projectId, manifestByProjectId);
+          const resolvedTarget = resolveMessageTarget(message.target);
           const result = await executeOperation({
             message,
-            projectId: message.projectId,
+            resolvedTarget,
             baseUrl,
             token,
-            projectRoot,
-            syncRoot,
             artifactRoot,
-            planRoot,
-            manifest
+            planRoot
           });
           ws.send(
             JSON.stringify({
@@ -3001,6 +3023,7 @@ if (isCliEntrypoint()) {
   });
 }
 export {
+  describeWorkerSessionTarget,
   editWorkerTextFile,
   ensureVisibleGitCheckout,
   findWorkerFiles,
@@ -3009,11 +3032,14 @@ export {
   isArtifactEnvPath,
   listWorkerDirectory,
   prepareArtifactEnvForShell,
+  prepareBuiltInToolPathsForTarget,
   preparePlanEnvForShell,
+  prepareShellEnvForTarget,
   readWorkerImageFile,
   readWorkerTextFile,
   resolveHostShell,
   resolveWorkerFilePath,
+  resolveWorkerSessionTarget,
   syncSessionArtifacts,
   visibleCheckoutGitTestHarness,
   visibleCheckoutRemoteFor,