@ricsam/r5d-worker 0.0.78 → 0.0.80

package/dist/mjs/workspace-mount-boundary.mjs

@@ -0,0 +1,37 @@
+import fs from "node:fs";
+import path from "node:path";
+function containedRelative(root, candidate) {
+  const relative = path.relative(root, candidate);
+  if (!relative || relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+    throw new Error(`Managed directory path escapes its trusted root: ${candidate}`);
+  }
+  return relative;
+}
+function assertManagedDirectoryPath(input) {
+  const trustedRoot = path.resolve(input.trustedRoot);
+  const candidate = path.resolve(input.candidate);
+  const relative = containedRelative(trustedRoot, candidate);
+  const rootStatus = fs.lstatSync(trustedRoot);
+  if (!rootStatus.isDirectory() || rootStatus.isSymbolicLink()) {
+    throw new Error(`${input.label} trusted root is not a regular directory: ${trustedRoot}`);
+  }
+  const realRoot = fs.realpathSync(trustedRoot);
+  let current = trustedRoot;
+  for (const segment of relative.split(path.sep)) {
+    current = path.join(current, segment);
+    let status;
+    try {
+      status = fs.lstatSync(current);
+    } catch (error) {
+      if (error.code === "ENOENT") return;
+      throw error;
+    }
+    if (!status.isDirectory() || status.isSymbolicLink()) {
+      throw new Error(`${input.label} contains a symlink or non-directory component: ${current}`);
+    }
+    containedRelative(realRoot, fs.realpathSync(current));
+  }
+}
+export {
+  assertManagedDirectoryPath
+};

package/dist/mjs/workspace-path-move.mjs

@@ -0,0 +1,160 @@
+import fs from "node:fs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { projectWorktreeOperationInProgress } from "./project-worktrees.mjs";
+import { validateManagedBranchName } from "./managed-paths.mjs";
+import { assertWorkingTreeHasNoPortableGitMetadataAliases, mirrorWorkingTree } from "./working-tree-mirror.mjs";
+import { assertManagedDirectoryPath } from "./workspace-mount-boundary.mjs";
+function checkoutPathMovePublicationComplete(requiredMountIds, activeMountIds) {
+  return requiredMountIds.length > 0 && requiredMountIds.every((mountId) => activeMountIds.has(mountId));
+}
+function pathIsInside(root, candidate) {
+  const relative = path.relative(path.resolve(root), path.resolve(candidate));
+  return relative !== "" && relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+}
+function fsyncTree(targetPath) {
+  const stat = fs.lstatSync(targetPath);
+  if (stat.isSymbolicLink()) return;
+  if (stat.isDirectory()) {
+    for (const entry of fs.readdirSync(targetPath).sort()) fsyncTree(path.join(targetPath, entry));
+  }
+  if (!stat.isDirectory() && !stat.isFile()) return;
+  const descriptor = fs.openSync(targetPath, "r");
+  try {
+    fs.fsyncSync(descriptor);
+  } finally {
+    fs.closeSync(descriptor);
+  }
+}
+function fsyncDirectory(directoryPath) {
+  const descriptor = fs.openSync(directoryPath, "r");
+  try {
+    fs.fsyncSync(descriptor);
+  } finally {
+    fs.closeSync(descriptor);
+  }
+}
+function fsyncAncestorsToRoot(targetPath, durabilityRoot) {
+  const root = path.resolve(durabilityRoot);
+  let current = path.dirname(path.resolve(targetPath));
+  while (true) {
+    if (fs.existsSync(current)) {
+      const status = fs.lstatSync(current);
+      if (!status.isDirectory() || status.isSymbolicLink()) {
+        throw new Error(`Project checkout path move durability boundary is not a regular directory: ${current}`);
+      }
+      fsyncDirectory(current);
+    }
+    if (current === root) return;
+    const parent = path.dirname(current);
+    if (parent === current) throw new Error(`Project checkout path move escapes durability root ${root}`);
+    current = parent;
+  }
+}
+function stableTree(targetPath, durabilityRoot) {
+  fsyncTree(targetPath);
+  fsyncAncestorsToRoot(targetPath, durabilityRoot);
+}
+function directoryEntryExists(targetPath) {
+  try {
+    fs.lstatSync(targetPath);
+    return true;
+  } catch (error) {
+    if (error.code === "ENOENT") return false;
+    throw error;
+  }
+}
+function retiredCheckoutPath(projectsDurabilityRoot, oldProjectRoot) {
+  const storageRoot = path.join(projectsDurabilityRoot, ".r5d-retired-checkouts");
+  const digest = createHash("sha256").update(oldProjectRoot).digest("hex");
+  return { storageRoot, retiredRoot: path.join(storageRoot, digest) };
+}
+function removeRetiredCheckout(retiredRoot, storageRoot) {
+  if (!directoryEntryExists(retiredRoot)) return;
+  fs.rmSync(retiredRoot, { recursive: true, force: true });
+  fsyncDirectory(storageRoot);
+}
+function preserveProjectCheckoutPathMove(input) {
+  const oldProjectRoot = path.resolve(input.oldProjectRoot);
+  const newProjectRoot = path.resolve(input.newProjectRoot);
+  const projectsDurabilityRoot = path.resolve(input.projectsDurabilityRoot);
+  const outerWorkspaceRoot = path.resolve(input.outerWorkspaceRoot);
+  if (oldProjectRoot === newProjectRoot || pathIsInside(oldProjectRoot, newProjectRoot) || pathIsInside(newProjectRoot, oldProjectRoot)) {
+    throw new Error("Project checkout path move roots overlap");
+  }
+  const branchNames = input.branches.map(({ branchName }) => branchName);
+  if (branchNames.length === 0 || new Set(branchNames).size !== branchNames.length) {
+    throw new Error("Project checkout path move requires unique branches");
+  }
+  assertManagedDirectoryPath({
+    trustedRoot: projectsDurabilityRoot,
+    candidate: oldProjectRoot,
+    label: "Old project checkout root"
+  });
+  assertManagedDirectoryPath({
+    trustedRoot: projectsDurabilityRoot,
+    candidate: newProjectRoot,
+    label: "New project checkout root"
+  });
+  for (const branchName of branchNames) validateManagedBranchName(branchName);
+  if (directoryEntryExists(oldProjectRoot)) {
+    assertWorkingTreeHasNoPortableGitMetadataAliases(oldProjectRoot);
+  }
+  const { storageRoot: retirementStorageRoot, retiredRoot } = retiredCheckoutPath(projectsDurabilityRoot, oldProjectRoot);
+  assertManagedDirectoryPath({
+    trustedRoot: projectsDurabilityRoot,
+    candidate: retirementStorageRoot,
+    label: "Retired project checkout storage"
+  });
+  fs.mkdirSync(retirementStorageRoot, { recursive: true, mode: 448 });
+  assertManagedDirectoryPath({
+    trustedRoot: projectsDurabilityRoot,
+    candidate: retirementStorageRoot,
+    label: "Retired project checkout storage"
+  });
+  fsyncDirectory(retirementStorageRoot);
+  fsyncDirectory(projectsDurabilityRoot);
+  assertManagedDirectoryPath({
+    trustedRoot: projectsDurabilityRoot,
+    candidate: retiredRoot,
+    label: "Retired project checkout"
+  });
+  removeRetiredCheckout(retiredRoot, retirementStorageRoot);
+  if (!directoryEntryExists(oldProjectRoot)) return { preservedBranchNames: [] };
+  const preservedBranchNames = [];
+  for (const branch of input.branches) {
+    validateManagedBranchName(branch.branchName);
+    const oldBranchPath = path.join(oldProjectRoot, ...branch.branchName.split("/"));
+    if (!fs.existsSync(oldBranchPath)) continue;
+    const newBranchPath = path.join(newProjectRoot, ...branch.branchName.split("/"));
+    const outerBranchPath = path.resolve(outerWorkspaceRoot, ...branch.outerWorkspaceRelativePath.replace(/\\/g, "/").split("/"));
+    if (!pathIsInside(outerWorkspaceRoot, outerBranchPath)) {
+      throw new Error(`Project checkout path move escapes the outer workspace: ${branch.outerWorkspaceRelativePath}`);
+    }
+    assertManagedDirectoryPath({ trustedRoot: projectsDurabilityRoot, candidate: oldBranchPath, label: "Old project checkout branch" });
+    assertManagedDirectoryPath({ trustedRoot: projectsDurabilityRoot, candidate: newBranchPath, label: "New project checkout branch" });
+    assertManagedDirectoryPath({ trustedRoot: outerWorkspaceRoot, candidate: outerBranchPath, label: "Outer workspace branch" });
+    mirrorWorkingTree({ sourceRoot: oldBranchPath, targetRoot: outerBranchPath, sourceMode: "git", deletionMode: "all" });
+    mirrorWorkingTree({ sourceRoot: oldBranchPath, targetRoot: newBranchPath, sourceMode: "all", deletionMode: "all" });
+    assertManagedDirectoryPath({ trustedRoot: projectsDurabilityRoot, candidate: newBranchPath, label: "New project checkout branch" });
+    assertManagedDirectoryPath({ trustedRoot: outerWorkspaceRoot, candidate: outerBranchPath, label: "Outer workspace branch" });
+    stableTree(outerBranchPath, outerWorkspaceRoot);
+    stableTree(newBranchPath, projectsDurabilityRoot);
+    preservedBranchNames.push(branch.branchName);
+  }
+  for (const branchName of branchNames) {
+    const checkoutPath = path.join(oldProjectRoot, ...branchName.split("/"));
+    if (fs.existsSync(checkoutPath) && projectWorktreeOperationInProgress(checkoutPath)) {
+      throw new Error(`Project branch ${branchName} has an in-progress Git operation`);
+    }
+  }
+  fs.renameSync(oldProjectRoot, retiredRoot);
+  fsyncAncestorsToRoot(oldProjectRoot, projectsDurabilityRoot);
+  fsyncDirectory(retirementStorageRoot);
+  removeRetiredCheckout(retiredRoot, retirementStorageRoot);
+  return { preservedBranchNames: preservedBranchNames.sort() };
+}
+export {
+  checkoutPathMovePublicationComplete,
+  preserveProjectCheckoutPathMove
+};

package/dist/mjs/workspace-preserve-only-policy.mjs

@@ -0,0 +1,11 @@
+function creatorLocalProjectBranchIsAuthorized(input) {
+  return Boolean(input.pendingBranchId && (!input.preserveOnlyBranchId || input.pendingBranchId === input.preserveOnlyBranchId));
+}
+function workerProjectBranchDisposition(input) {
+  if (input.activeConfigured) return "active";
+  return input.locallyPendingCreated ? "creator_local" : "preserve_only";
+}
+export {
+  creatorLocalProjectBranchIsAuthorized,
+  workerProjectBranchDisposition
+};

package/dist/mjs/workspace-project-config-policy.mjs

@@ -0,0 +1,21 @@
+function deferredProjectConfigurationPendingBranches(projects) {
+  return projects.flatMap((project) => project.branches.map(({ branchName }) => ({ projectId: project.projectId, branchName }))).sort((left, right) => left.projectId.localeCompare(right.projectId) || left.branchName.localeCompare(right.branchName));
+}
+function busyProjectConfigurationChangeIds(input) {
+  const currentById = new Map(input.currentProjects.map((project) => [project.projectId, project]));
+  const incomingById = new Map(input.incomingProjects.map((project) => [project.projectId, project]));
+  const targets = [...input.activeTargets];
+  const busyProjectIds = targets.some((target) => target.type === "workspace" && target.rootProfile === "visible_projects") ? /* @__PURE__ */ new Set([...currentById.keys(), ...incomingById.keys()]) : new Set(targets.flatMap((target) => target.type === "project" ? [target.projectId] : []));
+  return [...busyProjectIds].filter((projectId) => {
+    const current = currentById.get(projectId);
+    const incoming = incomingById.get(projectId);
+    if (!current && !incoming) return false;
+    if (!current || !incoming) return true;
+    if (!input.currentProjectReady(current)) return true;
+    return input.currentFingerprint(current) !== input.incomingFingerprint(incoming);
+  }).sort();
+}
+export {
+  busyProjectConfigurationChangeIds,
+  deferredProjectConfigurationPendingBranches
+};

package/dist/mjs/workspace-publication-evidence.mjs

@@ -0,0 +1,21 @@
+function projectBranchMountId(projectId, branchName) {
+  return `project:${projectId}:${encodeURIComponent(branchName)}`;
+}
+function activeProjectBranchNames(projectId, branchNames, activeMountIds) {
+  const active = new Set(activeMountIds);
+  return [...branchNames].filter((branchName) => active.has(projectBranchMountId(projectId, branchName))).sort((left, right) => left.localeCompare(right));
+}
+function activeProjectBranchPublicationEvidence(projects, activeMountIds) {
+  const active = new Set(activeMountIds);
+  return projects.flatMap(
+    (project) => project.executionDisabled || project.mirrorWritesDisabled ? [] : project.branches.flatMap(
+      (branch) => active.has(projectBranchMountId(project.projectId, branch.branchName)) ? [{ branchId: branch.branchId, projectId: project.projectId, branchName: branch.branchName }] : []
+    )
+  ).sort(
+    (left, right) => left.projectId.localeCompare(right.projectId) || left.branchName.localeCompare(right.branchName) || left.branchId.localeCompare(right.branchId)
+  );
+}
+export {
+  activeProjectBranchNames,
+  activeProjectBranchPublicationEvidence
+};

package/dist/types/credential-authority-lock-fixture.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/types/main.d.ts

@@ -1,4 +1,6 @@
 #!/usr/bin/env bun
+import { Database } from "bun:sqlite";
+import { configureGitHubRegistryAuthFiles, type PreparedPrivateAuthFileGeneration } from "./registry-auth";
 type WorkerProjectConfig = {
     projectId: string;
     checkoutPathSegments: [namespace: string, project: string];
@@ -6,7 +8,15 @@ type WorkerProjectConfig = {
     repoHttpUrl: string | null;
     repoAuthHeader: string | null;
     defaultBranch: string;
+    repositoryTransitionId: string | null;
+    executionDisabled: boolean;
+    mirrorWritesDisabled: boolean;
+    preserveOnlyBranches: Array<{
+        branchId: string;
+        branchName: string;
+    }>;
     branches: Array<{
+        branchId: string;
         branchName: string;
         sourceBranchName: string | null;
         baseCommitHash: string;
@@ -33,6 +43,13 @@ type WorkerReadFileResult = {
     truncated: boolean;
     continuation?: string;
 };
+type WorkerGitHubCredential = {
+    host: "github.com";
+    registry: "ghcr.io";
+    username: string;
+    token: string;
+    missingScopes: Array<"repo" | "read:org" | "gist" | "workflow" | "read:packages" | "write:packages">;
+};
 type WorkerWriteFileResult = {
     type: "write";
     file: string;
@@ -89,6 +106,14 @@ type WorkerCodeReadResult = {
     mtime: string;
     base64: string;
 };
+declare function assertWorkerChildAdmission(input: {
+    capturedGeneration: number;
+    currentGeneration: number;
+    sourceSocketIsCurrent: boolean;
+    sourceSocketOpen: boolean;
+    workspaceConfigured: boolean;
+    runtimeHealthy: boolean;
+}): void;
 export type WorkerBuiltInToolPaths = {
     artifactsDir?: string;
     plansDir?: string;
@@ -131,17 +156,118 @@ type ResolvedWorkerFilePath = {
 };
 export declare function resolveWorkerFilePath(branchPath: string, inputPath: string, builtInPaths?: WorkerBuiltInToolPaths): ResolvedWorkerFilePath;
 declare function readOnlyCredentialStoreHelper(storePath: string): string;
+declare function credentialGenerationReceiptPath(directoryPath?: string): string;
+declare function pendingCredentialGenerationPath(directoryPath?: string): string;
+declare function bootstrapCredentialGenerationPath(directoryPath?: string): string;
+type PendingCredentialGenerationBoundary = {
+    kind: "systemd";
+    machineId: string | null;
+    invocationId: string;
+} | {
+    kind: "boot";
+    machineId: string | null;
+    bootSessionId: string | null;
+};
+type PendingCredentialGenerationIntent = {
+    fingerprint: string;
+    boundary: PendingCredentialGenerationBoundary;
+};
+declare function pendingCredentialGenerationIntentContent(intent: PendingCredentialGenerationIntent): string;
+declare function readPendingCredentialGenerationIntent(intentPath?: string): PendingCredentialGenerationIntent | null;
+type BootSessionIdentifierProbe = {
+    platform: NodeJS.Platform;
+    kernelValue: string;
+};
+declare function readBootSessionIdentifier(probe?: BootSessionIdentifierProbe): string | null;
+type MachineIdentifierProbe = {
+    platform: NodeJS.Platform;
+    kernelValue: string;
+};
+declare function readMachineIdentifier(probe?: MachineIdentifierProbe): string | null;
+type CredentialAuthorityLockHandle = {
+    lockPath: string;
+    database: Database;
+};
+declare function credentialAuthorityLockPath(rootPath?: string): string;
+declare function acquireCredentialAuthorityLock(input: {
+    rootPath?: string;
+    machineId: string | null;
+}): CredentialAuthorityLockHandle;
+declare function releaseCredentialAuthorityLockHandle(handle: CredentialAuthorityLockHandle): void;
 declare function legacySharedCredentialStorePath(): string;
 declare function credentialStorePathForProject(projectId: string): string;
 declare function credentialStorePathForWorkspace(remoteUrl: string): string;
 declare function removeLegacySharedCredentialStore(storePath?: string): void;
 declare function resetCredentialStoreDirectory(directoryPath?: string): void;
+declare function readCredentialGenerationReceipt(receiptPath?: string): string | null;
 declare function pruneCredentialStoreFiles(requiredStorePaths: ReadonlySet<string>, directoryPath?: string): string[];
 declare function replaceCredentialStoreFile(storePath: string, content: string): void;
 declare function credentialHelperForRemotes(remotes: readonly {
     remoteUrl: string;
     authHeader: string | null | undefined;
-}[], storePath: string): string | null;
+}[], storePath: string, desiredFiles?: Map<string, string | null>): string | null;
+type CredentialGenerationConfiguration = {
+    workerBaseUrl: string;
+    workerAuthHeader: string;
+    workspaceRemoteUrl: string;
+    githubCredential: WorkerGitHubCredential | null;
+    projects: readonly Pick<WorkerProjectConfig, "projectId" | "repoHttpUrl" | "repoAuthHeader">[];
+};
+declare function credentialGenerationFingerprint(config: CredentialGenerationConfiguration): string;
+type CredentialGenerationTransitionPhase = "current" | "stage_pending_restart" | "publish_from_clean_restart";
+declare function credentialGenerationTransitionPhase(input: {
+    committedFingerprint: string | null;
+    pendingFingerprintAtProcessStart: string | null;
+    incomingFingerprint: string;
+}): CredentialGenerationTransitionPhase;
+declare function initialCredentialBootstrapIsSafe(input: {
+    transitionPhase: CredentialGenerationTransitionPhase;
+    committedFingerprint: string | null;
+    pendingFingerprintAtProcessStart: string | null;
+    bootstrapFingerprintAtProcessStart: string | null;
+    incomingFingerprint: string;
+    credentialArtifactsProvenAbsentAtProcessStart: boolean;
+    trackedChildTerminationProven: boolean;
+    activeProcessCount: number;
+    credentialProcessGroupCount: number;
+    activePtyCount: number;
+}): boolean;
+declare function fenceCredentialGenerationAtConfigureEntry(input: {
+    currentFingerprint: string | null;
+    incomingFingerprint: string;
+    revokeInMemory: () => void;
+    terminatePreviousGeneration: () => Promise<void>;
+}): Promise<boolean>;
+declare function requireCredentialGenerationRestart(required: boolean, fatalExit?: (exitCode: number) => void, exitCode?: number): void;
+declare function pendingCredentialGenerationBoundary(input: {
+    systemdContract: boolean;
+    systemdInvocationId: string | null;
+    bootSessionId: string | null;
+    machineId: string | null;
+}): PendingCredentialGenerationBoundary;
+declare function credentialGenerationBoundaryIsComplete(boundary: PendingCredentialGenerationBoundary): boolean;
+declare function credentialGenerationRestartIsContained(input: {
+    systemdContract: boolean;
+    pendingBoundary: PendingCredentialGenerationBoundary | null;
+    currentSystemdInvocationId: string | null;
+    currentBootSessionId: string | null;
+    currentMachineId: string | null;
+}): boolean;
+type CredentialReapContractProbe = {
+    platform: NodeJS.Platform;
+    invocationId: string | undefined;
+    cgroupText: string;
+    unitProperties: string;
+};
+type CredentialReapContractStatus = "direct" | "systemd_unverified" | "verified_systemd";
+declare function credentialReapContractStatus(probe?: CredentialReapContractProbe): CredentialReapContractStatus;
+declare function verifiedCredentialReapContract(probe?: CredentialReapContractProbe): boolean;
+declare function fenceUnsafeWorkspaceSyncFailure(input: {
+    hydrationCurrent: boolean;
+    invalidateExecution: () => void;
+    fatalExit?: (exitCode: number) => void;
+    exitCode?: number;
+}): boolean;
 export declare const workerGitSecurityTestHarness: {
     commandArgs: (args: string[]) => string[];
     credentialHelperForRemotes: typeof credentialHelperForRemotes;
@@ -153,8 +279,47 @@ export declare const workerGitSecurityTestHarness: {
     readOnlyCredentialStoreHelper: typeof readOnlyCredentialStoreHelper;
     resetCredentialStoreDirectory: typeof resetCredentialStoreDirectory;
     replaceCredentialStoreFile: typeof replaceCredentialStoreFile;
+    configureGitHubAuth(credential: WorkerGitHubCredential | null, filePaths: readonly string[], configureFiles?: typeof configureGitHubRegistryAuthFiles): void;
+    githubCredential: () => WorkerGitHubCredential | null;
+    credentialGenerationFingerprint: typeof credentialGenerationFingerprint;
+    credentialGenerationTransitionPhase: typeof credentialGenerationTransitionPhase;
+    initialCredentialBootstrapIsSafe: typeof initialCredentialBootstrapIsSafe;
+    fenceCredentialGenerationAtConfigureEntry: typeof fenceCredentialGenerationAtConfigureEntry;
+    requireCredentialGenerationRestart: typeof requireCredentialGenerationRestart;
+    pendingCredentialGenerationBoundary: typeof pendingCredentialGenerationBoundary;
+    credentialGenerationBoundaryIsComplete: typeof credentialGenerationBoundaryIsComplete;
+    credentialGenerationRestartIsContained: typeof credentialGenerationRestartIsContained;
+    credentialReapContractStatus: typeof credentialReapContractStatus;
+    verifiedCredentialReapContract: typeof verifiedCredentialReapContract;
+    fenceUnsafeWorkspaceSyncFailure: typeof fenceUnsafeWorkspaceSyncFailure;
+    assertWorkerChildAdmission: typeof assertWorkerChildAdmission;
+    terminateCredentialBearingChildren: typeof terminateCredentialBearingChildren;
+    terminateCredentialBearingChildrenWithRetention: typeof terminateCredentialBearingChildrenWithRetention;
+    commitCredentialGeneration(prepared: PreparedPrivateAuthFileGeneration, credential: WorkerGitHubCredential | null, children: readonly {
+        label: string;
+        terminate: () => void | Promise<void>;
+    }[], beforeMutation?: (filePath: string, index: number) => void, previousGenerationFenced?: boolean): Promise<boolean>;
+    credentialGenerationReceiptPath: typeof credentialGenerationReceiptPath;
+    credentialAuthorityLockPath: typeof credentialAuthorityLockPath;
+    acquireCredentialAuthorityLock: typeof acquireCredentialAuthorityLock;
+    releaseCredentialAuthorityLockHandle: typeof releaseCredentialAuthorityLockHandle;
+    pendingCredentialGenerationPath: typeof pendingCredentialGenerationPath;
+    pendingCredentialGenerationIntentContent: typeof pendingCredentialGenerationIntentContent;
+    readPendingCredentialGenerationIntent: typeof readPendingCredentialGenerationIntent;
+    readBootSessionIdentifier: typeof readBootSessionIdentifier;
+    readMachineIdentifier: typeof readMachineIdentifier;
+    bootstrapCredentialGenerationPath: typeof bootstrapCredentialGenerationPath;
+    readCredentialGenerationReceipt: typeof readCredentialGenerationReceipt;
 };
 export declare function githubCliEnv(token: string | null | undefined): Record<string, string>;
+/**
+ * Build an agent-command environment without inheriting credentials that were
+ * supplied to bootstrap or authenticate the worker itself. Later layers are
+ * explicit server-issued per-run credentials or the currently committed GitHub
+ * generation and are intentionally allowed to use the same public variable
+ * names.
+ */
+export declare function workerChildProcessEnvironment(layers: readonly NodeJS.ProcessEnv[], inherited?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): NodeJS.ProcessEnv;
 type ResolvedWorkerSessionTarget = {
     target: WorkerSessionTarget;
     rootPath: string;
@@ -215,4 +380,13 @@ export declare function resolveHostShell(command?: string, platform?: NodeJS.Pla
     args: string[];
     env?: Record<string, string>;
 };
+declare function terminateCredentialBearingChildren(children: readonly {
+    label: string;
+    terminate: () => void | Promise<void>;
+}[]): Promise<void>;
+declare function terminateCredentialBearingChildrenWithRetention(children: readonly {
+    label: string;
+    terminate: () => void | Promise<void>;
+    onTerminated: () => void;
+}[]): Promise<void>;
 export {};

package/dist/types/managed-paths.d.ts

@@ -1,6 +1,17 @@
 export declare const BRANCH_NAME_MAX_LENGTH = 45;
 export declare const BRANCH_NAME_PATTERN: RegExp;
 export type CheckoutPathSegments = [namespace: string, project: string];
+export type ManagedRoot = {
+    label: string;
+    rootPath: string;
+};
+/**
+ * Destructive worker roots must never alias or contain one another. Resolve
+ * and materialize every root first so symlinks, bind mounts, casing aliases,
+ * and Unicode-normalization aliases cannot disguise an overlap. This runs
+ * before any snapshot recovery or other destructive filesystem operation.
+ */
+export declare function assertDisjointManagedRoots(roots: readonly ManagedRoot[]): void;
 export declare function validateManagedBranchName(branchName: string): void;
 export declare function validateCheckoutPathSegments(value: unknown): CheckoutPathSegments;
 export declare function assertPathInside(root: string, candidate: string, label: string): void;

package/dist/types/project-workspace-state.d.ts

@@ -17,9 +17,20 @@ export type ProjectWorkspaceDesiredProject = {
     }>;
 };
 export type LocallyPendingCreatedProjectBranch = {
+    /** Durable project_branches row incarnation; absent only in legacy state. */
+    branchId?: string;
     projectId: string;
     branchName: string;
 };
+export type PreserveOnlyProjectBranch = {
+    branchId: string;
+    projectId: string;
+    branchName: string;
+};
+export type EnabledRepositoryTransition = {
+    projectId: string;
+    transitionId: string | null;
+};
 type ProjectWorkspaceDeletionBase = {
     id: string;
     projectId: string;
@@ -66,10 +77,33 @@ export type ProjectWorkspaceStateView = {
     desiredProjects: ProjectWorkspaceDesiredProject[];
     effectiveDesiredProjects: ProjectWorkspaceDesiredProject[];
     locallyPendingCreatedBranches: LocallyPendingCreatedProjectBranch[];
+    enabledRepositoryTransitions: EnabledRepositoryTransition[];
     tombstones: ProjectWorkspaceDeletionTombstone[];
     pendingTreeDeletions: PendingProjectWorkspaceTreeDeletion[];
     pendingMirrorRefDeletions: PendingProjectMirrorRefDeletion[];
 };
+export declare class ProjectWorkspacePendingBranchPathChangeError extends Error {
+    readonly projectId: string;
+    readonly branchName: string;
+    readonly currentCheckoutPathSegments: CheckoutPathSegments;
+    readonly incomingCheckoutPathSegments: CheckoutPathSegments;
+    constructor(input: {
+        projectId: string;
+        branchName: string;
+        currentCheckoutPathSegments: CheckoutPathSegments;
+        incomingCheckoutPathSegments: CheckoutPathSegments;
+    });
+}
+export declare class ProjectWorkspaceCheckoutPathCollisionError extends Error {
+    readonly projectId: string;
+    readonly occupyingProjectId: string;
+    readonly checkoutPathSegments: CheckoutPathSegments;
+    constructor(input: {
+        projectId: string;
+        occupyingProjectId: string;
+        checkoutPathSegments: CheckoutPathSegments;
+    });
+}
 export type StaleOuterProjectWorkspaceBranch = {
     kind: "branch";
     projectId: string;
@@ -125,9 +159,16 @@ export declare class ProjectWorkspaceStateStore {
     reconcile(input: {
         desiredProjects: readonly ProjectWorkspaceDesiredProjectInput[];
         locallyPendingCreatedBranches?: readonly LocallyPendingCreatedProjectBranch[];
+        preserveOnlyBranches?: readonly PreserveOnlyProjectBranch[];
     }): ProjectWorkspaceStateView;
+    /** Record a successful enabled reseed without letting disabled config consume it. */
+    recordEnabledRepositoryTransition(input: EnabledRepositoryTransition): ProjectWorkspaceStateView;
     /** Persist the create intent before invoking Git so a crash cannot orphan an untracked worktree. */
-    recordPendingCreatedBranch(input: LocallyPendingCreatedProjectBranch): ProjectWorkspaceStateView;
+    recordPendingCreatedBranch(input: LocallyPendingCreatedProjectBranch & {
+        branchId: string;
+    }): ProjectWorkspaceStateView;
+    /** Roll back an intent only when Git failed before creating its branch. */
+    rollbackPendingCreatedBranch(input: LocallyPendingCreatedProjectBranch): ProjectWorkspaceStateView;
     /** Clear a create intent after an authoritative desired config contains it. */
     clearPendingCreatedBranch(input: LocallyPendingCreatedProjectBranch): ProjectWorkspaceStateView;
     /** Persist a branch tombstone before mutating its linked worktree or local ref. */
@@ -141,4 +182,7 @@ export declare class ProjectWorkspaceStateStore {
         branchName: string;
     }): ProjectWorkspaceStateView;
 }
+export declare const projectWorkspaceStateTestHarness: {
+    writeEmptyStateAtDurableRootBoundary(stateRoot: string, afterStateRootFsync: () => void): void;
+};
 export {};