@ricsam/r5d-worker 0.0.75 → 0.0.77

package/dist/mjs/project-worktrees.mjs

@@ -2,8 +2,13 @@ import { createHash } from "node:crypto";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import { gitCredentialUsernameConfigKey, gitTransportSecurityArgs, workerGitProcessEnvironment } from "./git-process-environment.mjs";
 import { validateManagedBranchName } from "./managed-paths.mjs";
 import { mirrorWorkingTree } from "./working-tree-mirror.mjs";
+const PROJECT_WORKTREE_SNAPSHOT_PREFIX = "r5d-project-worktrees-";
+const PROJECT_WORKTREE_SNAPSHOT_NAME = new RegExp(
+  `^${PROJECT_WORKTREE_SNAPSHOT_PREFIX.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}([1-9]\\d*)-([A-Za-z0-9]{6})$`
+);
 function projectWorktreeConfigurationFingerprint(input) {
   return createHash("sha256").update(
     JSON.stringify({
@@ -29,25 +34,15 @@ const NON_RECURSIVE_GIT_CONFIG = [
   "-c",
   "push.recurseSubmodules=false"
 ];
-function normalizedHttpOrigin(value) {
-  try {
-    const url = new URL(value);
-    return `${url.protocol}//${url.host}`;
-  } catch {
-    return value.replace(/\/+$/, "");
-  }
-}
-function authArgs(auth) {
-  if (!auth) return [];
-  const key = `http.${normalizedHttpOrigin(auth.extraHeaderUrl)}/.extraHeader`;
-  return ["-c", "http.extraHeader=", "-c", `${key}=`, "-c", `${key}=${auth.header}`];
+function gitCommandArgs(args) {
+  return ["git", ...NON_RECURSIVE_GIT_CONFIG, ...args];
 }
-function gitResult(cwd, args, auth) {
-  const result = Bun.spawnSync(["git", ...NON_RECURSIVE_GIT_CONFIG, ...authArgs(auth), ...args], {
+function gitResult(cwd, args) {
+  const result = Bun.spawnSync(gitCommandArgs(args), {
     cwd,
     stdout: "pipe",
     stderr: "pipe",
-    env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
+    env: workerGitProcessEnvironment()
   });
   return {
     exitCode: result.exitCode,
@@ -55,13 +50,13 @@ function gitResult(cwd, args, auth) {
     stderr: result.stderr.toString().trim()
   };
 }
-function git(cwd, args, action, auth) {
-  const result = gitResult(cwd, args, auth);
+function git(cwd, args, action) {
+  const result = gitResult(cwd, args);
   if (result.exitCode !== 0) throw new Error(`${action}: ${result.stderr || result.stdout || `git exited ${result.exitCode}`}`);
   return result.stdout;
 }
-function tryGit(cwd, args, auth) {
-  return gitResult(cwd, args, auth).exitCode === 0;
+function tryGit(cwd, args) {
+  return gitResult(cwd, args).exitCode === 0;
 }
 function branchPath(projectRoot, branchName) {
   validateManagedBranchName(branchName);
@@ -124,17 +119,63 @@ function hasCompatibleLinkedProjectWorktreeLayout(input) {
     return kind === null || kind === "file" && commonGitDirectory(checkoutPath) === primaryCommonDir;
   });
 }
+function createProjectWorktreeSnapshotRoot() {
+  return fs.mkdtempSync(path.join(os.tmpdir(), `${PROJECT_WORKTREE_SNAPSHOT_PREFIX}${process.pid}-`));
+}
 function snapshotBranchTrees(projectRoot, branches) {
-  const root = fs.mkdtempSync(path.join(os.tmpdir(), "r5d-project-worktrees-"));
+  const root = createProjectWorktreeSnapshotRoot();
   const paths = /* @__PURE__ */ new Map();
-  for (const { branchName } of branches) {
-    const checkoutPath = branchPath(projectRoot, branchName);
-    if (!fs.existsSync(checkoutPath)) continue;
-    const snapshotPath = path.join(root, ...branchName.split("/"));
-    mirrorWorkingTree({ sourceRoot: checkoutPath, targetRoot: snapshotPath, sourceMode: "all", deletionMode: "all" });
-    paths.set(branchName, snapshotPath);
+  try {
+    for (const { branchName } of branches) {
+      const checkoutPath = branchPath(projectRoot, branchName);
+      if (!fs.existsSync(checkoutPath)) continue;
+      const snapshotPath = path.join(root, ...branchName.split("/"));
+      mirrorWorkingTree({ sourceRoot: checkoutPath, targetRoot: snapshotPath, sourceMode: "all", deletionMode: "all" });
+      paths.set(branchName, snapshotPath);
+    }
+    return { root, paths };
+  } catch (error) {
+    fs.rmSync(root, { recursive: true, force: true });
+    throw error;
+  }
+}
+function isProcessAlive(processId) {
+  try {
+    process.kill(processId, 0);
+    return true;
+  } catch (error) {
+    return error.code !== "ESRCH";
   }
-  return { root, paths };
+}
+function cleanupStaleProjectWorktreeSnapshots(input = {}) {
+  const temporaryRoot = path.resolve(input.temporaryRoot ?? os.tmpdir());
+  const processAlive = input.processAlive ?? isProcessAlive;
+  const removed = [];
+  const failed = [];
+  let entries;
+  try {
+    entries = fs.readdirSync(temporaryRoot, { withFileTypes: true });
+  } catch (error) {
+    if (error.code === "ENOENT") return { removed, failed };
+    return { removed, failed: [{ path: temporaryRoot, error: error instanceof Error ? error.message : String(error) }] };
+  }
+  for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
+    const match = PROJECT_WORKTREE_SNAPSHOT_NAME.exec(entry.name);
+    if (!match) continue;
+    const ownerProcessId = Number(match[1]);
+    if (!Number.isSafeInteger(ownerProcessId) || processAlive(ownerProcessId)) continue;
+    const candidate = path.join(temporaryRoot, entry.name);
+    try {
+      const stat = fs.lstatSync(candidate);
+      if (!stat.isDirectory() || stat.isSymbolicLink()) continue;
+      fs.rmSync(candidate, { recursive: true, force: true });
+      removed.push(candidate);
+    } catch (error) {
+      if (error.code === "ENOENT") continue;
+      failed.push({ path: candidate, error: error instanceof Error ? error.message : String(error) });
+    }
+  }
+  return { removed, failed };
 }
 function configureRepository(input) {
   if (tryGit(input.primaryPath, ["remote", "get-url", "origin"])) {
@@ -142,7 +183,16 @@ function configureRepository(input) {
   } else {
     git(input.primaryPath, ["remote", "add", "origin", input.originUrl], "configure project origin");
   }
+  tryGit(input.primaryPath, ["config", "--local", "--unset-all", "remote.origin.pushurl"]);
   git(input.primaryPath, ["config", "--local", "--replace-all", "credential.helper", ""], "reset project credential helpers");
+  git(input.primaryPath, ["config", "--local", "credential.useHttpPath", "false"], "configure project credential path matching");
+  if (input.originCredentialUsername) {
+    git(
+      input.primaryPath,
+      ["config", "--local", "--replace-all", gitCredentialUsernameConfigKey(input.originUrl), input.originCredentialUsername],
+      "configure project credential username"
+    );
+  }
   if (input.credentialHelper) {
     git(
       input.primaryPath,
@@ -159,19 +209,25 @@ function configureRepository(input) {
   }
 }
 function fetchProjectHeads(input) {
-  const originFetch = gitResult(
-    input.primaryPath,
-    ["fetch", "--no-recurse-submodules", "--prune", "origin", "+refs/heads/*:refs/remotes/origin/*"],
-    input.originAuth
-  );
+  const originFetch = gitResult(input.primaryPath, [
+    ...gitTransportSecurityArgs(input.originUrl, input.credentialHelper, input.originCredentialUsername),
+    "fetch",
+    "--no-recurse-submodules",
+    "--prune",
+    "origin",
+    "+refs/heads/*:refs/remotes/origin/*"
+  ]);
   if (originFetch.exitCode !== 0) {
     throw new Error(`Fetch project origin: ${originFetch.stderr || originFetch.stdout || `git exited ${originFetch.exitCode}`}`);
   }
-  const mirrorFetch = gitResult(
-    input.primaryPath,
-    ["fetch", "--no-recurse-submodules", "--prune", input.mirrorUrl, "+refs/heads/*:refs/r5d/mirror/*"],
-    input.mirrorAuth
-  );
+  const mirrorFetch = gitResult(input.primaryPath, [
+    ...gitTransportSecurityArgs(input.mirrorUrl, input.credentialHelper, input.mirrorCredentialUsername),
+    "fetch",
+    "--no-recurse-submodules",
+    "--prune",
+    input.mirrorUrl,
+    "+refs/heads/*:refs/r5d/mirror/*"
+  ]);
   if (mirrorFetch.exitCode !== 0 && !/(couldn't find remote ref|does not have any commits|remote repository is empty|no such ref)/i.test(
     `${mirrorFetch.stderr}
 ${mirrorFetch.stdout}`
@@ -181,11 +237,19 @@ ${mirrorFetch.stdout}`
 }
 function ensureCommitAvailable(input) {
   if (tryGit(input.primaryPath, ["cat-file", "-e", `${input.commitHash}^{commit}`])) return;
-  for (const [url, auth] of [
-    [input.mirrorUrl, input.mirrorAuth],
-    [input.originUrl, input.originAuth]
+  for (const [url, username] of [
+    [input.mirrorUrl, input.mirrorCredentialUsername],
+    [input.originUrl, input.originCredentialUsername]
   ]) {
-    if (tryGit(input.primaryPath, ["fetch", "--no-recurse-submodules", "--no-tags", url, input.commitHash], auth)) return;
+    if (tryGit(input.primaryPath, [
+      ...gitTransportSecurityArgs(url, input.credentialHelper, username),
+      "fetch",
+      "--no-recurse-submodules",
+      "--no-tags",
+      url,
+      input.commitHash
+    ]))
+      return;
   }
   throw new Error(`Project base commit ${input.commitHash} is unavailable from origin and the canonical mirror`);
 }
@@ -330,7 +394,7 @@ function createLinkedProjectBranch(input) {
   });
   if (overlappingWorktree) throw new Error(`Project branch folder overlaps linked worktree ${overlappingWorktree}`);
   const sourceHead = git(sourcePath, ["rev-parse", "HEAD"], "resolve source branch head");
-  const snapshotRoot = fs.mkdtempSync(path.join(os.tmpdir(), "r5d-project-branch-"));
+  const snapshotRoot = createProjectWorktreeSnapshotRoot();
   try {
     mirrorWorkingTree({ sourceRoot: sourcePath, targetRoot: snapshotRoot, sourceMode: "git", deletionMode: "all" });
     git(sourcePath, ["branch", input.branchName, sourceHead], `create project branch ${input.branchName}`);
@@ -389,11 +453,13 @@ function removeProjectWorktrees(input) {
 }
 function deleteProjectMirrorBranch(input) {
   validateManagedBranchName(input.branchName);
-  const deleted = gitResult(
-    input.gitDirectory,
-    ["push", "--no-recurse-submodules", input.mirrorUrl, `:refs/heads/${input.branchName}`],
-    input.mirrorAuth
-  );
+  const deleted = gitResult(input.gitDirectory, [
+    ...gitTransportSecurityArgs(input.mirrorUrl, input.credentialHelper, input.credentialUsername),
+    "push",
+    "--no-recurse-submodules",
+    input.mirrorUrl,
+    `:refs/heads/${input.branchName}`
+  ]);
   if (deleted.exitCode !== 0 && !/(remote ref does not exist|unable to delete|no such ref)/i.test(`${deleted.stderr}
 ${deleted.stdout}`)) {
     throw new Error(
@@ -413,9 +479,14 @@ function pushProjectMirrorHeads(input) {
     }
     git(
       checkoutPath,
-      ["push", "--no-recurse-submodules", input.mirrorUrl, `+HEAD:refs/heads/${branchName}`],
-      `push hidden project mirror for ${branchName}`,
-      input.mirrorAuth
+      [
+        ...gitTransportSecurityArgs(input.mirrorUrl, input.credentialHelper, input.credentialUsername),
+        "push",
+        "--no-recurse-submodules",
+        input.mirrorUrl,
+        `+HEAD:refs/heads/${branchName}`
+      ],
+      `push hidden project mirror for ${branchName}`
     );
     results.push({ branchName, head, pushed: true });
   }
@@ -423,11 +494,14 @@ function pushProjectMirrorHeads(input) {
 }
 function fastForwardProjectHeadsFromMirror(input) {
   const primaryPath = branchPath(input.projectRoot, input.primaryBranchName);
-  const fetch = gitResult(
-    primaryPath,
-    ["fetch", "--no-recurse-submodules", "--prune", input.mirrorUrl, "+refs/heads/*:refs/r5d/mirror/*"],
-    input.mirrorAuth
-  );
+  const fetch = gitResult(primaryPath, [
+    ...gitTransportSecurityArgs(input.mirrorUrl, input.credentialHelper, input.credentialUsername),
+    "fetch",
+    "--no-recurse-submodules",
+    "--prune",
+    input.mirrorUrl,
+    "+refs/heads/*:refs/r5d/mirror/*"
+  ]);
   if (fetch.exitCode !== 0)
     throw new Error(`Refresh project head mirror: ${fetch.stderr || fetch.stdout || `git exited ${fetch.exitCode}`}`);
   return [...input.branchNames].sort().map((branchName) => {
@@ -444,9 +518,12 @@ function fastForwardProjectHeadsFromMirror(input) {
   });
 }
 const projectWorktreesTestHarness = {
-  commandArgs: (args, auth) => ["git", ...NON_RECURSIVE_GIT_CONFIG, ...authArgs(auth), ...args]
+  commandArgs: gitCommandArgs,
+  configureRepository
 };
 export {
+  PROJECT_WORKTREE_SNAPSHOT_PREFIX,
+  cleanupStaleProjectWorktreeSnapshots,
   createLinkedProjectBranch,
   deleteLinkedProjectBranch,
   deleteProjectMirrorBranch,

package/dist/mjs/working-tree-mirror.mjs

@@ -1,5 +1,6 @@
 import fs from "node:fs";
 import path from "node:path";
+import { workerGitProcessEnvironment } from "./git-process-environment.mjs";
 function isGitMetadataPath(relativePath) {
   return relativePath.split("/").includes(".git");
 }
@@ -36,7 +37,7 @@ function gitEligibleRoots(root) {
       cwd: root,
       stdout: "pipe",
       stderr: "pipe",
-      env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
+      env: workerGitProcessEnvironment()
     }
   );
   if (result.exitCode !== 0) {

package/dist/mjs/workspace-git-sync.mjs

@@ -1,5 +1,6 @@
 import fs from "node:fs";
 import path from "node:path";
+import { gitCredentialUsernameConfigKey, gitTransportSecurityArgs, workerGitProcessEnvironment } from "./git-process-environment.mjs";
 import { mirrorWorkingTree } from "./working-tree-mirror.mjs";
 const WORKSPACE_GIT_BRANCH = "main";
 const MAX_WORKSPACE_GIT_DIFF_BYTES = 5 * 1024 * 1024;
@@ -13,25 +14,18 @@ const NON_RECURSIVE_GIT_CONFIG = [
   "-c",
   "push.recurseSubmodules=false"
 ];
-function normalizedHttpOrigin(value) {
-  try {
-    const url = new URL(value);
-    return `${url.protocol}//${url.host}`;
-  } catch {
-    return value.replace(/\/+$/, "");
-  }
+function gitCommandArgs(args) {
+  return ["git", ...NON_RECURSIVE_GIT_CONFIG, ...args];
 }
-function authArgs(auth) {
-  if (!auth) return [];
-  const key = `http.${normalizedHttpOrigin(auth.extraHeaderUrl)}/.extraHeader`;
-  return ["-c", "http.extraHeader=", "-c", `${key}=`, "-c", `${key}=${auth.header}`];
+function workspaceCloneCommandArgs(args, remoteUrl, credentialHelper, credentialUsername) {
+  return gitCommandArgs([...gitTransportSecurityArgs(remoteUrl, credentialHelper, credentialUsername), ...args]);
 }
-function gitResult(cwd, args, auth) {
-  const result = Bun.spawnSync(["git", ...NON_RECURSIVE_GIT_CONFIG, ...authArgs(auth), ...args], {
+function gitResult(cwd, args) {
+  const result = Bun.spawnSync(gitCommandArgs(args), {
     cwd,
     stdout: "pipe",
     stderr: "pipe",
-    env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
+    env: workerGitProcessEnvironment()
   });
   return {
     exitCode: result.exitCode,
@@ -39,13 +33,13 @@ function gitResult(cwd, args, auth) {
     stderr: result.stderr.toString().trim()
   };
 }
-function git(cwd, args, action, auth) {
-  const result = gitResult(cwd, args, auth);
+function git(cwd, args, action) {
+  const result = gitResult(cwd, args);
   if (result.exitCode !== 0) throw new Error(`${action}: ${result.stderr || result.stdout || `git exited ${result.exitCode}`}`);
   return result.stdout;
 }
-function tryGit(cwd, args, auth) {
-  return gitResult(cwd, args, auth).exitCode === 0;
+function tryGit(cwd, args) {
+  return gitResult(cwd, args).exitCode === 0;
 }
 function revParse(workspacePath, revision) {
   const result = gitResult(workspacePath, ["rev-parse", "--verify", revision]);
@@ -91,9 +85,22 @@ function configureWorkspaceRepository(input) {
   } else {
     git(input.workspacePath, ["remote", "add", "origin", input.remoteUrl], "configure workspace origin");
   }
+  tryGit(input.workspacePath, ["config", "--local", "--unset-all", "remote.origin.pushurl"]);
   git(input.workspacePath, ["config", "--local", "--replace-all", "credential.helper", ""], "reset workspace credential helpers");
+  git(input.workspacePath, ["config", "--local", "credential.useHttpPath", "false"], "configure workspace credential path matching");
+  if (input.credentialUsername) {
+    git(
+      input.workspacePath,
+      ["config", "--local", "--replace-all", gitCredentialUsernameConfigKey(input.remoteUrl), input.credentialUsername],
+      "configure workspace credential username"
+    );
+  }
   if (input.credentialHelper) {
-    git(input.workspacePath, ["config", "--local", "--add", "credential.helper", input.credentialHelper], "configure workspace credential helper");
+    git(
+      input.workspacePath,
+      ["config", "--local", "--add", "credential.helper", input.credentialHelper],
+      "configure workspace credential helper"
+    );
   }
   const name = input.gitIdentity.name.trim();
   const email = input.gitIdentity.email.trim();
@@ -101,19 +108,16 @@ function configureWorkspaceRepository(input) {
   git(input.workspacePath, ["config", "--local", "user.name", name], "configure workspace Git user name");
   git(input.workspacePath, ["config", "--local", "user.email", email], "configure workspace Git user email");
 }
-function fetchWorkspaceHead(workspacePath, remoteAuth) {
-  const result = gitResult(
-    workspacePath,
-    [
-      "fetch",
-      "--no-recurse-submodules",
-      "--prune",
-      "--update-shallow",
-      "origin",
-      `+refs/heads/${WORKSPACE_GIT_BRANCH}:refs/remotes/origin/${WORKSPACE_GIT_BRANCH}`
-    ],
-    remoteAuth
-  );
+function fetchWorkspaceHead(workspacePath, remoteUrl, credentialHelper, credentialUsername) {
+  const result = gitResult(workspacePath, [
+    ...gitTransportSecurityArgs(remoteUrl, credentialHelper, credentialUsername),
+    "fetch",
+    "--no-recurse-submodules",
+    "--prune",
+    "--update-shallow",
+    "origin",
+    `+refs/heads/${WORKSPACE_GIT_BRANCH}:refs/remotes/origin/${WORKSPACE_GIT_BRANCH}`
+  ]);
   if (result.exitCode !== 0) {
     const detail = `${result.stderr}
 ${result.stdout}`;
@@ -130,11 +134,17 @@ function ensureWorkspaceGitClone(input) {
   if (!fs.existsSync(gitPath)) {
     fs.rmSync(workspacePath, { recursive: true, force: true });
     fs.mkdirSync(path.dirname(workspacePath), { recursive: true });
-    const clone = gitResult(
-      void 0,
+    const cloneCommand = workspaceCloneCommandArgs(
       ["clone", "--no-recurse-submodules", "--branch", WORKSPACE_GIT_BRANCH, input.remoteUrl, workspacePath],
-      input.remoteAuth
+      input.remoteUrl,
+      input.credentialHelper,
+      input.credentialUsername
     );
+    const clone = Bun.spawnSync(cloneCommand, {
+      stdout: "pipe",
+      stderr: "pipe",
+      env: workerGitProcessEnvironment()
+    });
     if (clone.exitCode !== 0) {
       fs.rmSync(workspacePath, { recursive: true, force: true });
       fs.mkdirSync(workspacePath, { recursive: true });
@@ -147,7 +157,7 @@ function ensureWorkspaceGitClone(input) {
   if (!revParse(workspacePath, WORKSPACE_GIT_INTEGRATED_REF) && previousRemoteHead && localHeadBeforeFetch && tryGit(workspacePath, ["merge-base", "--is-ancestor", previousRemoteHead, localHeadBeforeFetch])) {
     updateIntegratedWorkspaceHead(workspacePath, previousRemoteHead);
   }
-  const remoteHead = fetchWorkspaceHead(workspacePath, input.remoteAuth);
+  const remoteHead = fetchWorkspaceHead(workspacePath, input.remoteUrl, input.credentialHelper, input.credentialUsername);
   let localHead = revParse(workspacePath, "HEAD");
   if (!localHead && remoteHead) {
     git(
@@ -233,7 +243,7 @@ function resetWorkspaceGit(input) {
   const initial = ensureWorkspaceGitClone({ ...input, workspacePath });
   const status = gitResult(workspacePath, ["status", "--porcelain=v1", "-z"]);
   const discardedPaths = status.exitCode === 0 ? status.stdout.split("\0").filter(Boolean).map((entry) => entry.slice(3)).sort() : [];
-  const remoteHead = fetchWorkspaceHead(workspacePath, input.remoteAuth);
+  const remoteHead = fetchWorkspaceHead(workspacePath, input.remoteUrl, input.credentialHelper, input.credentialUsername);
   if (remoteHead) {
     git(workspacePath, ["checkout", "--no-recurse-submodules", "-B", WORKSPACE_GIT_BRANCH, remoteHead], "reset workspace main");
     git(workspacePath, ["clean", "-fd", "--", "."], "remove untracked workspace changes");
@@ -259,9 +269,10 @@ function emptyTreeHash(workspacePath) {
     stdin: Buffer.alloc(0),
     stdout: "pipe",
     stderr: "pipe",
-    env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
+    env: workerGitProcessEnvironment()
   });
-  if (result.exitCode !== 0) throw new Error(`Create empty workspace tree: ${result.stderr.toString().trim() || `git exited ${result.exitCode}`}`);
+  if (result.exitCode !== 0)
+    throw new Error(`Create empty workspace tree: ${result.stderr.toString().trim() || `git exited ${result.exitCode}`}`);
   return result.stdout.toString().trim();
 }
 function changedPaths(workspacePath, baseRevision, headRevision) {
@@ -270,15 +281,12 @@ function changedPaths(workspacePath, baseRevision, headRevision) {
 }
 async function diffSizeBytes(workspacePath, baseRevision, headRevision, limit) {
   const base = baseRevision ?? emptyTreeHash(workspacePath);
-  const subprocess = Bun.spawn(
-    ["git", ...NON_RECURSIVE_GIT_CONFIG, "diff", "--binary", "--no-ext-diff", base, headRevision],
-    {
-      cwd: workspacePath,
-      stdout: "pipe",
-      stderr: "pipe",
-      env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
-    }
-  );
+  const subprocess = Bun.spawn(["git", ...NON_RECURSIVE_GIT_CONFIG, "diff", "--binary", "--no-ext-diff", base, headRevision], {
+    cwd: workspacePath,
+    stdout: "pipe",
+    stderr: "pipe",
+    env: workerGitProcessEnvironment()
+  });
   const stderrPromise = new Response(subprocess.stderr).text();
   const reader = subprocess.stdout.getReader();
   let total = 0;
@@ -399,7 +407,7 @@ async function synchronizeWorkspaceGit(input) {
       "commit workspace working trees"
     );
   }
-  let remoteHead = fetchWorkspaceHead(workspacePath, input.remoteAuth);
+  let remoteHead = fetchWorkspaceHead(workspacePath, input.remoteUrl, input.credentialHelper, input.credentialUsername);
   let rebaseCount = 0;
   let updated = false;
   for (let pushAttempt = 0; pushAttempt < maxPushAttempts; pushAttempt += 1) {
@@ -475,10 +483,14 @@ async function synchronizeWorkspaceGit(input) {
         skippedMountIds: selected.skipped.map(({ id }) => id).sort()
       };
     }
-    const pushArgs = ["push", "--no-recurse-submodules"];
+    const pushArgs = [
+      ...gitTransportSecurityArgs(input.remoteUrl, input.credentialHelper, input.credentialUsername),
+      "push",
+      "--no-recurse-submodules"
+    ];
     if (input.allowLargeDiff) pushArgs.push(`--push-option=${WORKSPACE_GIT_CONFIRMED_LARGE_DIFF_PUSH_OPTION}`);
     pushArgs.push("origin", `HEAD:refs/heads/${WORKSPACE_GIT_BRANCH}`);
-    const push = gitResult(workspacePath, pushArgs, input.remoteAuth);
+    const push = gitResult(workspacePath, pushArgs);
     if (push.exitCode === 0) {
       updateIntegratedWorkspaceHead(workspacePath, localHead);
       await input.afterWorkspacePublished?.({
@@ -503,12 +515,14 @@ async function synchronizeWorkspaceGit(input) {
 ${push.stdout}`)) {
       throw new Error(`Push workspace main: ${push.stderr || push.stdout || `git exited ${push.exitCode}`}`);
     }
-    remoteHead = fetchWorkspaceHead(workspacePath, input.remoteAuth);
+    remoteHead = fetchWorkspaceHead(workspacePath, input.remoteUrl, input.credentialHelper, input.credentialUsername);
   }
   throw new Error(`Workspace push did not converge after ${maxPushAttempts} attempts`);
 }
 const workspaceGitSyncTestHarness = {
-  commandArgs: (args, auth) => ["git", ...NON_RECURSIVE_GIT_CONFIG, ...authArgs(auth), ...args],
+  commandArgs: gitCommandArgs,
+  workspaceCloneCommandArgs,
+  configureWorkspaceRepository,
   mirrorMountsToWorkspace,
   hydrateMountsFromWorkspace: hydrateWorkspaceGitMounts
 };

package/dist/types/git-process-environment.d.ts

@@ -0,0 +1,9 @@
+/** Build the complete environment for a worker-owned Git child process. */
+export declare function workerGitProcessEnvironment(source?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+/** Clear inherited and repository-local HTTP authorization headers for one transport URL. */
+export declare function gitHttpAuthorizationClearArgs(remoteUrl: string): string[];
+/** Select only the app-owned credential store, regardless of repository-local helpers. */
+export declare function gitCredentialHelperConfigArgs(credentialHelper?: string | null): string[];
+export declare function gitCredentialUsernameConfigKey(remoteUrl: string): string;
+/** Non-secret command configuration required for an authenticated HTTP transport. */
+export declare function gitTransportSecurityArgs(remoteUrl: string, credentialHelper?: string | null, credentialUsername?: string | null): string[];

package/dist/types/main.d.ts

@@ -130,6 +130,30 @@ type ResolvedWorkerFilePath = {
     virtualRootPath: string;
 };
 export declare function resolveWorkerFilePath(branchPath: string, inputPath: string, builtInPaths?: WorkerBuiltInToolPaths): ResolvedWorkerFilePath;
+declare function readOnlyCredentialStoreHelper(storePath: string): string;
+declare function legacySharedCredentialStorePath(): string;
+declare function credentialStorePathForProject(projectId: string): string;
+declare function credentialStorePathForWorkspace(remoteUrl: string): string;
+declare function removeLegacySharedCredentialStore(storePath?: string): void;
+declare function resetCredentialStoreDirectory(directoryPath?: string): void;
+declare function pruneCredentialStoreFiles(requiredStorePaths: ReadonlySet<string>, directoryPath?: string): string[];
+declare function replaceCredentialStoreFile(storePath: string, content: string): void;
+declare function credentialHelperForRemotes(remotes: readonly {
+    remoteUrl: string;
+    authHeader: string | null | undefined;
+}[], storePath: string): string | null;
+export declare const workerGitSecurityTestHarness: {
+    commandArgs: (args: string[]) => string[];
+    credentialHelperForRemotes: typeof credentialHelperForRemotes;
+    credentialStorePathForProject: typeof credentialStorePathForProject;
+    credentialStorePathForWorkspace: typeof credentialStorePathForWorkspace;
+    legacySharedCredentialStorePath: typeof legacySharedCredentialStorePath;
+    removeLegacySharedCredentialStore: typeof removeLegacySharedCredentialStore;
+    pruneCredentialStoreFiles: typeof pruneCredentialStoreFiles;
+    readOnlyCredentialStoreHelper: typeof readOnlyCredentialStoreHelper;
+    resetCredentialStoreDirectory: typeof resetCredentialStoreDirectory;
+    replaceCredentialStoreFile: typeof replaceCredentialStoreFile;
+};
 export declare function githubCliEnv(token: string | null | undefined): Record<string, string>;
 type ResolvedWorkerSessionTarget = {
     target: WorkerSessionTarget;

package/dist/types/project-worktrees.d.ts

@@ -1,7 +1,4 @@
-export type GitHttpAuth = {
-    extraHeaderUrl: string;
-    header: string;
-};
+export declare const PROJECT_WORKTREE_SNAPSHOT_PREFIX = "r5d-project-worktrees-";
 export type ProjectWorktreeBranch = {
     branchName: string;
     baseCommitHash: string;
@@ -27,20 +24,41 @@ export declare function projectWorktreeConfigurationFingerprint(input: {
         email: string;
     } | null;
 }): string;
+declare function gitCommandArgs(args: string[]): string[];
 export declare function hasLinkedProjectWorktreeLayout(input: {
     projectRoot: string;
     primaryBranchName: string;
     branches: readonly Pick<ProjectWorktreeBranch, "branchName">[];
 }): boolean;
+export declare function cleanupStaleProjectWorktreeSnapshots(input?: {
+    temporaryRoot?: string;
+    processAlive?: (processId: number) => boolean;
+}): {
+    removed: string[];
+    failed: Array<{
+        path: string;
+        error: string;
+    }>;
+};
+declare function configureRepository(input: {
+    primaryPath: string;
+    originUrl: string;
+    credentialHelper?: string | null;
+    originCredentialUsername?: string | null;
+    gitIdentity?: {
+        name: string;
+        email: string;
+    } | null;
+}): void;
 export declare function ensureProjectWorktrees(input: {
     projectRoot: string;
     primaryBranchName: string;
     branches: readonly ProjectWorktreeBranch[];
     originUrl: string;
-    originAuth?: GitHttpAuth;
     mirrorUrl: string;
-    mirrorAuth?: GitHttpAuth;
     credentialHelper?: string | null;
+    originCredentialUsername?: string | null;
+    mirrorCredentialUsername?: string | null;
     gitIdentity?: {
         name: string;
         email: string;
@@ -70,13 +88,15 @@ export declare function deleteProjectMirrorBranch(input: {
     gitDirectory: string;
     branchName: string;
     mirrorUrl: string;
-    mirrorAuth?: GitHttpAuth;
+    credentialHelper?: string | null;
+    credentialUsername?: string | null;
 }): void;
 export declare function pushProjectMirrorHeads(input: {
     projectRoot: string;
     branchNames: readonly string[];
     mirrorUrl: string;
-    mirrorAuth?: GitHttpAuth;
+    credentialHelper?: string | null;
+    credentialUsername?: string | null;
     onlyBranches?: ReadonlySet<string>;
 }): Array<{
     branchName: string;
@@ -89,7 +109,8 @@ export declare function fastForwardProjectHeadsFromMirror(input: {
     primaryBranchName: string;
     branchNames: readonly string[];
     mirrorUrl: string;
-    mirrorAuth?: GitHttpAuth;
+    credentialHelper?: string | null;
+    credentialUsername?: string | null;
 }): Array<{
     branchName: string;
     previousHead: string;
@@ -97,5 +118,7 @@ export declare function fastForwardProjectHeadsFromMirror(input: {
     fastForwarded: boolean;
 }>;
 export declare const projectWorktreesTestHarness: {
-    commandArgs: (args: string[], auth?: GitHttpAuth) => string[];
+    commandArgs: typeof gitCommandArgs;
+    configureRepository: typeof configureRepository;
 };
+export {};