@ricsam/r5d-worker 0.0.76 → 0.0.78

package/dist/cjs/main.cjs

@@ -48,6 +48,7 @@ __export(main_exports, {
   resolveWorkerFilePath: () => resolveWorkerFilePath,
   resolveWorkerSessionTarget: () => resolveWorkerSessionTarget,
   syncSessionArtifacts: () => syncSessionArtifacts,
+  workerGitSecurityTestHarness: () => workerGitSecurityTestHarness,
   writeWorkerTextFile: () => writeWorkerTextFile
 });
 module.exports = __toCommonJS(main_exports);
@@ -57,6 +58,7 @@ var import_node_crypto = require("node:crypto");
 var import_node_os = __toESM(require("node:os"), 1);
 var import_node_child_process = require("node:child_process");
 var import_cli_update = require("./cli-update.cjs");
+var import_git_process_environment = require("./git-process-environment.cjs");
 var import_heartbeat = require("./heartbeat.cjs");
 var import_process_tree = require("./process-tree.cjs");
 var import_pty_output_coalescer = require("./pty-output-coalescer.cjs");
@@ -659,29 +661,16 @@ const NON_RECURSIVE_GIT_CONFIG_ARGS = [
   "-c",
   "push.recurseSubmodules=false"
 ];
-function gitExtraHeaderConfigKey(extraHeaderUrl) {
-  return `http.${normalizeBaseUrl(extraHeaderUrl)}/.extraHeader`;
-}
-function gitAuthArgs(auth) {
-  if (!auth) {
-    return [];
-  }
-  const scopedKey = gitExtraHeaderConfigKey(auth.extraHeaderUrl);
-  return ["-c", "http.extraHeader=", "-c", `${scopedKey}=`, "-c", `${scopedKey}=${auth.header}`];
-}
 const workerGitCommand = {
-  commandArgs: (args, auth) => ["git", ...NON_RECURSIVE_GIT_CONFIG_ARGS, ...gitAuthArgs(auth), ...args]
+  commandArgs: (args) => ["git", ...NON_RECURSIVE_GIT_CONFIG_ARGS, ...args]
 };
 function runGit(args, options = {}) {
-  const command = workerGitCommand.commandArgs(args, options.auth);
+  const command = workerGitCommand.commandArgs(args);
   const result = Bun.spawnSync(command, {
     cwd: options.cwd,
     stdout: "pipe",
     stderr: "pipe",
-    env: {
-      ...process.env,
-      GIT_TERMINAL_PROMPT: "0"
-    }
+    env: (0, import_git_process_environment.workerGitProcessEnvironment)()
   });
   if (result.exitCode !== 0) {
     throw new Error(
@@ -814,28 +803,92 @@ function resolveWorkerFilePath(branchPath, inputPath, builtInPaths) {
 function canonicalProjectRemoteUrl(baseUrl, projectId) {
   return new URL(`/git/${projectId}.git`, baseUrl).toString();
 }
-function gitExtraHeaderUrlForRemote(remoteUrl) {
-  try {
-    return new URL(remoteUrl).origin;
-  } catch {
-    return remoteUrl;
-  }
-}
-function gitAuthForRemote(remoteUrl, authHeader) {
-  if (!authHeader) {
-    return void 0;
-  }
-  return {
-    extraHeaderUrl: gitExtraHeaderUrlForRemote(remoteUrl),
-    header: authHeader
-  };
-}
 function shellQuote(value) {
   return `'${value.replace(/'/g, "'\\''")}'`;
 }
-function githubCredentialsPath() {
+function readOnlyCredentialStoreHelper(storePath) {
+  return `!f() { if [ "$1" = get ]; then git credential-store --file=${shellQuote(storePath)} get; else return 0; fi; }; f`;
+}
+function credentialStoreDirectory() {
+  return import_node_path.default.join(import_node_os.default.homedir(), ".r5d", "git-credentials");
+}
+function legacySharedCredentialStorePath() {
   return import_node_path.default.join(import_node_os.default.homedir(), ".r5d", "github-credentials");
 }
+function credentialStorePathForProject(projectId) {
+  validateProjectId(projectId);
+  const digest = (0, import_node_crypto.createHash)("sha256").update(`project\0${projectId}`).digest("hex");
+  return import_node_path.default.join(credentialStoreDirectory(), `project-${digest}.store`);
+}
+function credentialStorePathForWorkspace(remoteUrl) {
+  const digest = (0, import_node_crypto.createHash)("sha256").update(`workspace\0${remoteUrl}`).digest("hex");
+  return import_node_path.default.join(credentialStoreDirectory(), `workspace-${digest}.store`);
+}
+function lstatIfExists(filePath) {
+  try {
+    return import_node_fs.default.lstatSync(filePath);
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+function ensurePrivateCredentialStoreDirectory(directoryPath) {
+  const stat = lstatIfExists(directoryPath);
+  if (stat) {
+    if (stat.isSymbolicLink() || !stat.isDirectory()) throw new Error("Git credential-store path must be a private directory");
+  } else {
+    import_node_fs.default.mkdirSync(directoryPath, { recursive: true, mode: 448 });
+  }
+  import_node_fs.default.chmodSync(directoryPath, 448);
+}
+function removeLegacySharedCredentialStore(storePath = legacySharedCredentialStorePath()) {
+  import_node_fs.default.rmSync(storePath, { force: true });
+}
+let credentialStoreDirectoryInitialized = false;
+function resetCredentialStoreDirectory(directoryPath = credentialStoreDirectory()) {
+  const stat = lstatIfExists(directoryPath);
+  if (stat) {
+    if (stat.isSymbolicLink() || !stat.isDirectory()) import_node_fs.default.unlinkSync(directoryPath);
+    else import_node_fs.default.rmSync(directoryPath, { recursive: true, force: true });
+  }
+  ensurePrivateCredentialStoreDirectory(directoryPath);
+}
+function initializeCredentialStoreDirectoryOnce() {
+  if (credentialStoreDirectoryInitialized) return;
+  removeLegacySharedCredentialStore();
+  resetCredentialStoreDirectory();
+  credentialStoreDirectoryInitialized = true;
+}
+const APP_CREDENTIAL_STORE_FILE = /^(?:project|workspace)-[0-9a-f]{64}\.store$/;
+function pruneCredentialStoreFiles(requiredStorePaths, directoryPath = credentialStoreDirectory()) {
+  ensurePrivateCredentialStoreDirectory(directoryPath);
+  const resolvedDirectory = import_node_path.default.resolve(directoryPath);
+  const requiredNames = /* @__PURE__ */ new Set();
+  for (const storePath of requiredStorePaths) {
+    const resolvedStorePath = import_node_path.default.resolve(storePath);
+    if (import_node_path.default.dirname(resolvedStorePath) !== resolvedDirectory || !APP_CREDENTIAL_STORE_FILE.test(import_node_path.default.basename(resolvedStorePath))) {
+      throw new Error("Invalid app-owned Git credential-store path");
+    }
+    requiredNames.add(import_node_path.default.basename(resolvedStorePath));
+  }
+  const removed = [];
+  for (const name of import_node_fs.default.readdirSync(directoryPath)) {
+    if (!APP_CREDENTIAL_STORE_FILE.test(name) || requiredNames.has(name)) continue;
+    const storePath = import_node_path.default.join(directoryPath, name);
+    const stat = import_node_fs.default.lstatSync(storePath);
+    if (!stat.isFile() && !stat.isSymbolicLink()) continue;
+    import_node_fs.default.unlinkSync(storePath);
+    removed.push(storePath);
+  }
+  return removed;
+}
+function removeProjectCredentialStore(projectId) {
+  const storePath = credentialStorePathForProject(projectId);
+  const stat = lstatIfExists(storePath);
+  if (!stat) return;
+  if (!stat.isFile() && !stat.isSymbolicLink()) throw new Error("Git credential store must be a regular file");
+  import_node_fs.default.unlinkSync(storePath);
+}
 function decodeGitAuthHeader(authHeader) {
   const match = /^Authorization:\s*Basic\s+(.+)$/i.exec(authHeader.trim());
   if (match) {
@@ -847,45 +900,84 @@ function decodeGitAuthHeader(authHeader) {
   const bearer = /^Authorization:\s*Bearer\s+(.+)$/i.exec(authHeader.trim());
   return bearer?.[1] ? { username: "r5d-worker", password: bearer[1] } : null;
 }
-function writeCredentialStoreEntry(remoteUrl, authHeader) {
+function credentialUsernameForAuthHeader(authHeader) {
   const credentials = decodeGitAuthHeader(authHeader);
-  if (!credentials) {
-    return null;
-  }
-  let remote;
+  if (!credentials) throw new Error("Unsupported Git authorization header");
+  if (/[\0\r\n]/.test(credentials.username)) throw new Error("Invalid Git credential username");
+  return credentials.username;
+}
+function replaceCredentialStoreFile(storePath, content) {
+  const temporaryPath = import_node_path.default.join(import_node_path.default.dirname(storePath), `.${import_node_path.default.basename(storePath)}.${process.pid}.${crypto.randomUUID()}.tmp`);
   try {
-    remote = new URL(remoteUrl);
-  } catch {
-    return null;
-  }
-  if (remote.protocol !== "https:") {
-    return null;
+    import_node_fs.default.writeFileSync(temporaryPath, content, { flag: "wx", mode: 384 });
+    import_node_fs.default.chmodSync(temporaryPath, 384);
+    import_node_fs.default.renameSync(temporaryPath, storePath);
+  } finally {
+    import_node_fs.default.rmSync(temporaryPath, { force: true });
   }
-  const storePath = githubCredentialsPath();
-  import_node_fs.default.mkdirSync(import_node_path.default.dirname(storePath), { recursive: true });
-  const hostKey = `${remote.protocol}//${remote.host}`;
-  const existing = import_node_fs.default.existsSync(storePath) ? import_node_fs.default.readFileSync(storePath, "utf8").split(/\r?\n/).filter(Boolean) : [];
-  const next = existing.filter((line) => {
+}
+function writeCredentialStoreEntries(remotes, storePath) {
+  const authoritativeEntries = /* @__PURE__ */ new Map();
+  for (const input of remotes) {
+    let remote;
     try {
-      const parsed = new URL(line);
-      return `${parsed.protocol}//${parsed.host}` !== hostKey;
+      remote = new URL(input.remoteUrl);
     } catch {
-      return true;
+      if (input.authHeader != null) throw new Error("Invalid authenticated Git remote URL");
+      continue;
     }
-  });
-  const credentialUrl = new URL(hostKey);
-  credentialUrl.username = credentials.username;
-  credentialUrl.password = credentials.password;
-  next.push(credentialUrl.toString());
-  import_node_fs.default.writeFileSync(storePath, `${next.join("\n")}
-`, { mode: 384 });
-  import_node_fs.default.chmodSync(storePath, 384);
-  return storePath;
-}
-function credentialHelperForRemote(remoteUrl, authHeader) {
-  const credentialStore = writeCredentialStoreEntry(remoteUrl, authHeader);
-  return credentialStore ? `store --file=${shellQuote(credentialStore)}` : null;
-}
+    if ((remote.protocol === "https:" || remote.protocol === "http:") && (remote.username || remote.password)) {
+      throw new Error("Git credentials must not be embedded in a remote URL");
+    }
+    if (remote.protocol !== "https:" && remote.protocol !== "http:") {
+      if (input.authHeader != null) throw new Error("Unsupported authenticated Git remote protocol");
+      continue;
+    }
+    const hostKey = `${remote.protocol}//${remote.host}`;
+    let replacement = null;
+    if (input.authHeader != null) {
+      const credentials = decodeGitAuthHeader(input.authHeader);
+      if (!credentials) throw new Error("Unsupported Git authorization header");
+      const credentialUrl = new URL(hostKey);
+      credentialUrl.username = credentials.username;
+      credentialUrl.password = credentials.password;
+      replacement = credentialUrl.toString();
+    }
+    if (authoritativeEntries.has(hostKey) && authoritativeEntries.get(hostKey) !== replacement) {
+      throw new Error("Conflicting Git credentials for one transport host");
+    }
+    authoritativeEntries.set(hostKey, replacement);
+  }
+  const storeStat = lstatIfExists(storePath);
+  if (storeStat) {
+    if (storeStat.isSymbolicLink() || !storeStat.isFile()) throw new Error("Git credential store must be a regular file");
+  }
+  const replacements = [...authoritativeEntries.values()].filter((entry) => entry !== null);
+  if (replacements.length === 0) {
+    if (storeStat) import_node_fs.default.unlinkSync(storePath);
+    return null;
+  }
+  ensurePrivateCredentialStoreDirectory(import_node_path.default.dirname(storePath));
+  replaceCredentialStoreFile(storePath, `${replacements.join("\n")}
+`);
+  return { hasCredentials: true, storePath };
+}
+function credentialHelperForRemotes(remotes, storePath) {
+  const credentialStore = writeCredentialStoreEntries(remotes, storePath);
+  return credentialStore?.hasCredentials ? readOnlyCredentialStoreHelper(credentialStore.storePath) : null;
+}
+const workerGitSecurityTestHarness = {
+  commandArgs: workerGitCommand.commandArgs,
+  credentialHelperForRemotes,
+  credentialStorePathForProject,
+  credentialStorePathForWorkspace,
+  legacySharedCredentialStorePath,
+  removeLegacySharedCredentialStore,
+  pruneCredentialStoreFiles,
+  readOnlyCredentialStoreHelper,
+  resetCredentialStoreDirectory,
+  replaceCredentialStoreFile
+};
 function dockerConfigPath() {
   return import_node_path.default.join(import_node_os.default.homedir(), ".docker", "config.json");
 }
@@ -2271,6 +2363,7 @@ async function startWorker(options) {
   });
   const config = readConfig(options.configPath);
   const { baseUrl, token } = resolveCredentials(options, config);
+  initializeCredentialStoreDirectoryOnce();
   const label = requireValue(options.label, "Missing required --label <label>");
   validateLabel(label);
   const projectsRoot = import_node_path.default.resolve(options.projectRoot ?? defaultProjectsRoot());
@@ -2317,6 +2410,8 @@ async function startWorker(options) {
   const lastObservedProjectHeads = /* @__PURE__ */ new Map();
   const pendingMirrorDeletes = /* @__PURE__ */ new Map();
   let workspaceRemoteUrl = null;
+  let workspaceCredentialHelper = null;
+  let workspaceCredentialUsername = null;
   let workspaceGitIdentity = null;
   let workspaceConfigured = false;
   let activeWorkspaceIncidentId = null;
@@ -2331,6 +2426,7 @@ async function startWorker(options) {
   let reloadAfterClose = false;
   let shutdownAfterClose = false;
   const bearerAuthHeader = `Authorization: Bearer ${token}`;
+  const workerCredentialUsername = credentialUsernameForAuthHeader(bearerAuthHeader);
   const projectBranchKey = (projectId, branchName) => `${projectId}\0${branchName}`;
   const projectMountId = (projectId, branchName) => `project:${projectId}:${encodeURIComponent(branchName)}`;
   const projectPlanMountId = (projectId, branchName) => `plan:${projectId}:${encodeURIComponent(branchName)}`;
@@ -2338,12 +2434,32 @@ async function startWorker(options) {
   const workspacePlanRelativePath = (projectId, branchName) => import_node_path.default.posix.join("plans", projectId, encodeURIComponent(branchName));
   const projectConnection = (project) => {
     const mirrorUrl = canonicalProjectRemoteUrl(baseUrl, project.projectId);
-    const mirrorAuth = gitAuthForRemote(mirrorUrl, bearerAuthHeader);
     const originUrl = project.repoHttpUrl ?? mirrorUrl;
     const originHeader = project.repoHttpUrl ? project.repoAuthHeader : bearerAuthHeader;
-    const originAuth = gitAuthForRemote(originUrl, originHeader);
-    const credentialHelper = originHeader ? credentialHelperForRemote(originUrl, originHeader) : null;
-    return { mirrorUrl, mirrorAuth, originUrl, originAuth, credentialHelper };
+    const credentialHelper = credentialHelperForRemotes(
+      [
+        { remoteUrl: mirrorUrl, authHeader: bearerAuthHeader },
+        { remoteUrl: originUrl, authHeader: originHeader }
+      ],
+      credentialStorePathForProject(project.projectId)
+    );
+    if (!credentialHelper) throw new Error("Project mirror credentials are unavailable");
+    return {
+      mirrorUrl,
+      mirrorCredentialUsername: workerCredentialUsername,
+      originUrl,
+      originCredentialUsername: originHeader ? credentialUsernameForAuthHeader(originHeader) : null,
+      credentialHelper
+    };
+  };
+  const projectMirrorConnection = (projectId) => {
+    const mirrorUrl = canonicalProjectRemoteUrl(baseUrl, projectId);
+    const credentialHelper = credentialHelperForRemotes(
+      [{ remoteUrl: mirrorUrl, authHeader: bearerAuthHeader }],
+      credentialStorePathForProject(projectId)
+    );
+    if (!credentialHelper) throw new Error("Project mirror credentials are unavailable");
+    return { mirrorUrl, credentialHelper, mirrorCredentialUsername: workerCredentialUsername };
   };
   const durableDeletionForBranch = (projectId, checkoutPathSegments, branchName) => projectWorkspaceState.tombstones.find(
     (tombstone) => tombstone.projectId === projectId && tombstone.checkoutPathSegments[0] === checkoutPathSegments[0] && tombstone.checkoutPathSegments[1] === checkoutPathSegments[1] && (tombstone.kind === "project" || tombstone.branchName === branchName)
@@ -2367,7 +2483,8 @@ async function startWorker(options) {
       branchName,
       gitDirectory: configuredProjectBranchPath(projectsRoot, project, primaryBranchName),
       mirrorUrl: connection.mirrorUrl,
-      mirrorAuth: connection.mirrorAuth,
+      credentialHelper: connection.credentialHelper,
+      credentialUsername: connection.mirrorCredentialUsername,
       sourcePath,
       workspaceRelativePath: workspaceProjectRelativePath(project.projectId, branchName),
       planSourcePath,
@@ -2378,7 +2495,7 @@ async function startWorker(options) {
   };
   const stageProjectDeletion = (project) => {
     const projectRoot = configuredProjectRoot(projectsRoot, project);
-    const connection = projectConnection(project);
+    const connection = projectMirrorConnection(project.projectId);
     const branches = project.branches.map(({ branchName }) => ({
       branchName,
       sourcePath: configuredProjectBranchPath(projectsRoot, project, branchName),
@@ -2399,7 +2516,8 @@ async function startWorker(options) {
         // hidden ref only after that publication succeeds.
         gitDirectory: workspaceShadowRoot,
         mirrorUrl: connection.mirrorUrl,
-        mirrorAuth: connection.mirrorAuth,
+        credentialHelper: connection.credentialHelper,
+        credentialUsername: connection.mirrorCredentialUsername,
         sourcePath: branch.sourcePath,
         workspaceRelativePath: workspaceProjectRelativePath(project.projectId, branch.branchName),
         planSourcePath: branch.planSourcePath,
@@ -2457,14 +2575,17 @@ async function startWorker(options) {
     for (const deletion of projectWorkspaceState.pendingMirrorRefDeletions) {
       const key = projectBranchKey(deletion.projectId, deletion.branchName);
       const planSourcePath = import_node_path.default.join(planRoot, deletion.projectId, ...deletion.branchName.split("/"));
+      const liveProject = projectConfigById.get(deletion.projectId);
+      const connection = liveProject ? projectConnection(liveProject) : projectMirrorConnection(deletion.projectId);
       import_node_fs.default.rmSync(planSourcePath, { recursive: true, force: true });
       pendingMirrorDeletes.set(key, {
         id: projectMountId(deletion.projectId, deletion.branchName),
         projectId: deletion.projectId,
         branchName: deletion.branchName,
         gitDirectory: workspaceShadowRoot,
-        mirrorUrl: canonicalProjectRemoteUrl(baseUrl, deletion.projectId),
-        mirrorAuth: gitAuthForRemote(canonicalProjectRemoteUrl(baseUrl, deletion.projectId), bearerAuthHeader),
+        mirrorUrl: connection.mirrorUrl,
+        credentialHelper: connection.credentialHelper,
+        credentialUsername: connection.mirrorCredentialUsername,
         sourcePath: deletion.managedPath,
         workspaceRelativePath: workspaceProjectRelativePath(deletion.projectId, deletion.branchName),
         planSourcePath,
@@ -2612,9 +2733,9 @@ async function startWorker(options) {
           primaryBranchName: primaryProjectBranch(project),
           branches: project.branches,
           originUrl: connection.originUrl,
-          originAuth: connection.originAuth,
+          originCredentialUsername: connection.originCredentialUsername,
           mirrorUrl: connection.mirrorUrl,
-          mirrorAuth: connection.mirrorAuth,
+          mirrorCredentialUsername: connection.mirrorCredentialUsername,
           credentialHelper: connection.credentialHelper,
           gitIdentity: workspaceGitIdentity
         });
@@ -2653,10 +2774,17 @@ async function startWorker(options) {
       if (!readyProjectIds.has(project.projectId) || project.branches.length === 0) continue;
       const connection = projectConnection(project);
       const primaryPath = configuredProjectBranchPath(projectsRoot, project, primaryProjectBranch(project));
-      if (!tryGit(["fetch", "--no-recurse-submodules", "--prune", "origin", "+refs/heads/*:refs/remotes/origin/*"], {
-        cwd: primaryPath,
-        auth: connection.originAuth
-      })) {
+      if (!tryGit(
+        [
+          ...(0, import_git_process_environment.gitTransportSecurityArgs)(connection.originUrl, connection.credentialHelper, connection.originCredentialUsername),
+          "fetch",
+          "--no-recurse-submodules",
+          "--prune",
+          "origin",
+          "+refs/heads/*:refs/remotes/origin/*"
+        ],
+        { cwd: primaryPath }
+      )) {
         process.stderr.write(`[r5d-worker] could not refresh origin divergence for ${project.projectPath}
 `);
       }
@@ -2706,7 +2834,8 @@ async function startWorker(options) {
         projectRoot: configuredProjectRoot(projectsRoot, project),
         branchNames: project.branches.map(({ branchName }) => branchName),
         mirrorUrl: connection.mirrorUrl,
-        mirrorAuth: connection.mirrorAuth,
+        credentialHelper: connection.credentialHelper,
+        credentialUsername: connection.mirrorCredentialUsername,
         onlyBranches: changed
       });
       for (const result of results) {
@@ -2733,7 +2862,8 @@ async function startWorker(options) {
           gitDirectory: deletion.gitDirectory,
           branchName: deletion.branchName,
           mirrorUrl: deletion.mirrorUrl,
-          mirrorAuth: deletion.mirrorAuth
+          credentialHelper: deletion.credentialHelper,
+          credentialUsername: deletion.credentialUsername
         });
       }
       if (deletion.tombstoneId && !deletion.projectDeleted) {
@@ -2743,6 +2873,9 @@ async function startWorker(options) {
         });
       }
       pendingMirrorDeletes.delete(key);
+      if (deletion.projectDeleted && !projectConfigById.has(deletion.projectId) && ![...pendingMirrorDeletes.values()].some((pending) => pending.projectId === deletion.projectId)) {
+        removeProjectCredentialStore(deletion.projectId);
+      }
       lastObservedProjectHeads.delete(key);
     }
   };
@@ -2756,7 +2889,8 @@ async function startWorker(options) {
           primaryBranchName: primaryProjectBranch(project),
           branchNames: project.branches.map(({ branchName }) => branchName),
           mirrorUrl: connection.mirrorUrl,
-          mirrorAuth: connection.mirrorAuth
+          credentialHelper: connection.credentialHelper,
+          credentialUsername: connection.mirrorCredentialUsername
         });
         for (const state of refreshed) {
           lastObservedProjectHeads.set(
@@ -2781,9 +2915,9 @@ async function startWorker(options) {
         primaryBranchName: primaryProjectBranch(project),
         branches: project.branches,
         originUrl: connection.originUrl,
-        originAuth: connection.originAuth,
+        originCredentialUsername: connection.originCredentialUsername,
         mirrorUrl: connection.mirrorUrl,
-        mirrorAuth: connection.mirrorAuth,
+        mirrorCredentialUsername: connection.mirrorCredentialUsername,
         credentialHelper: connection.credentialHelper,
         gitIdentity: workspaceGitIdentity
       });
@@ -2830,16 +2964,16 @@ async function startWorker(options) {
     error: error instanceof Error ? error.message : String(error)
   });
   const performWorkspaceSync = async (input) => {
-    if (!workspaceRemoteUrl || !workspaceGitIdentity) throw new Error("Worker workspace configuration has not been received");
+    if (!workspaceRemoteUrl || !workspaceCredentialHelper || !workspaceCredentialUsername || !workspaceGitIdentity) {
+      throw new Error("Worker workspace configuration has not been received");
+    }
     const mounts = buildWorkspaceMounts();
-    const remoteAuth = gitAuthForRemote(workspaceRemoteUrl, bearerAuthHeader);
-    const credentialHelper = credentialHelperForRemote(workspaceRemoteUrl, bearerAuthHeader);
     if (input.resetToCanonical) {
       const reset = (0, import_workspace_git_sync.resetWorkspaceGit)({
         workspacePath: workspaceShadowRoot,
         remoteUrl: workspaceRemoteUrl,
-        remoteAuth,
-        credentialHelper,
+        credentialHelper: workspaceCredentialHelper,
+        credentialUsername: workspaceCredentialUsername,
         gitIdentity: workspaceGitIdentity,
         mounts
       });
@@ -2868,8 +3002,8 @@ async function startWorker(options) {
       workerLabel: label,
       workspacePath: workspaceShadowRoot,
       remoteUrl: workspaceRemoteUrl,
-      remoteAuth,
-      credentialHelper,
+      credentialHelper: workspaceCredentialHelper,
+      credentialUsername: workspaceCredentialUsername,
       gitIdentity: workspaceGitIdentity,
       mounts,
       commitDetail: input.confirmationReason ?? input.trigger.detail,
@@ -2902,6 +3036,12 @@ async function startWorker(options) {
   const runWorkspaceSync = async (input) => {
     const attemptId = input.attemptId ?? crypto.randomUUID();
     const requestedAt = Date.now();
+    if (!input.requestId && input.sendResult !== false) {
+      if (currentWorkerSocket !== ws || ws.readyState !== WebSocket.OPEN) {
+        throw new Error("Cannot start autonomous workspace synchronization without an open worker control socket");
+      }
+      ws.send(JSON.stringify({ type: "workspace_sync_started", attemptId }));
+    }
     let queueEnteredAt = requestedAt;
     let syncStartedAt = requestedAt;
     workspaceSyncRequestsInFlight += 1;
@@ -2955,6 +3095,12 @@ async function startWorker(options) {
           if (result.outcome === "failed") {
             pendingAutomaticTrigger = scheduledTrigger;
           }
+        }).catch((error) => {
+          pendingAutomaticTrigger = scheduledTrigger;
+          process.stderr.write(
+            `[r5d-worker] failed to start automatic workspace sync: ${error instanceof Error ? error.message : String(error)}
+`
+          );
         }).finally(() => {
           automaticSyncInFlight = false;
           heartbeatBusyGrace = (0, import_heartbeat.grantWorkerHeartbeatBusyGrace)(lastServerHeartbeatAt, heartbeatBusyGrace);
@@ -2982,13 +3128,47 @@ async function startWorker(options) {
     try {
       return await workspaceSyncSingleFlight.runExclusive(async () => {
         workspaceConfigured = false;
+        projectWorkspaceState = projectWorkspaceStateStore.reconcile({
+          desiredProjects: message.projects
+        });
+        const requiredCredentialStorePaths = /* @__PURE__ */ new Set();
+        const workspaceStorePath = credentialStorePathForWorkspace(message.workspaceRemoteUrl);
+        requiredCredentialStorePaths.add(workspaceStorePath);
+        const nextWorkspaceCredentialHelper = credentialHelperForRemotes(
+          [{ remoteUrl: message.workspaceRemoteUrl, authHeader: bearerAuthHeader }],
+          workspaceStorePath
+        );
+        if (!nextWorkspaceCredentialHelper) throw new Error("Workspace credentials are unavailable");
+        const desiredProjectConfigById = new Map(message.projects.map((project) => [project.projectId, project]));
+        for (const project of message.projects) {
+          requiredCredentialStorePaths.add(credentialStorePathForProject(project.projectId));
+          projectConnection(project);
+        }
+        const pendingCredentialProjectIds = /* @__PURE__ */ new Set([
+          ...[...pendingMirrorDeletes.values()].map(({ projectId }) => projectId),
+          ...projectWorkspaceState.pendingTreeDeletions.map(({ projectId }) => projectId),
+          ...projectWorkspaceState.pendingMirrorRefDeletions.map(({ projectId }) => projectId)
+        ]);
+        for (const projectId of pendingCredentialProjectIds) {
+          const desiredProject = desiredProjectConfigById.get(projectId);
+          if (desiredProject) projectConnection(desiredProject);
+          else projectMirrorConnection(projectId);
+          requiredCredentialStorePaths.add(credentialStorePathForProject(projectId));
+        }
+        for (const deletion of pendingMirrorDeletes.values()) {
+          const desiredProject = desiredProjectConfigById.get(deletion.projectId);
+          const connection = desiredProject ? projectConnection(desiredProject) : projectMirrorConnection(deletion.projectId);
+          deletion.mirrorUrl = connection.mirrorUrl;
+          deletion.credentialHelper = connection.credentialHelper;
+          deletion.credentialUsername = connection.mirrorCredentialUsername;
+        }
+        pruneCredentialStoreFiles(requiredCredentialStorePaths);
         configureGitHubAuth(message.githubCredential);
         visibleGitIdentity = message.gitIdentity;
         workspaceGitIdentity = message.gitIdentity;
         workspaceRemoteUrl = message.workspaceRemoteUrl;
-        projectWorkspaceState = projectWorkspaceStateStore.reconcile({
-          desiredProjects: message.projects
-        });
+        workspaceCredentialHelper = nextWorkspaceCredentialHelper;
+        workspaceCredentialUsername = workerCredentialUsername;
         (0, import_project_workspace_state.pruneAuthoritativelyDesiredBranchDeletions)(pendingMirrorDeletes, message.projects);
         const effectiveProjects = effectiveWorkerProjects(message.projects).map((project) => ({
           ...project,
@@ -3019,13 +3199,11 @@ async function startWorker(options) {
         for (const projectId of [...readyProjectIds]) {
           if (!projectConfigById.has(projectId)) readyProjectIds.delete(projectId);
         }
-        const remoteAuth = gitAuthForRemote(message.workspaceRemoteUrl, bearerAuthHeader);
-        const credentialHelper = credentialHelperForRemote(message.workspaceRemoteUrl, bearerAuthHeader);
         (0, import_workspace_git_sync.ensureWorkspaceGitClone)({
           workspacePath: workspaceShadowRoot,
           remoteUrl: message.workspaceRemoteUrl,
-          remoteAuth,
-          credentialHelper,
+          credentialHelper: nextWorkspaceCredentialHelper,
+          credentialUsername: workerCredentialUsername,
           gitIdentity: message.gitIdentity
         });
         pruneStaleOuterWorkspaceEntries(projectWorkspaceStateStore.discoverStaleOuterEntries(workspaceShadowRoot));
@@ -3825,5 +4003,6 @@ if (isCliEntrypoint()) {
   resolveWorkerFilePath,
   resolveWorkerSessionTarget,
   syncSessionArtifacts,
+  workerGitSecurityTestHarness,
   writeWorkerTextFile
 });

package/dist/cjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.76",
+  "version": "0.0.78",
   "type": "commonjs"
 }