@ricsam/r5d-worker 0.0.82 → 0.0.86

package/dist/mjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.82",
+  "version": "0.0.86",
   "type": "module"
 }

package/dist/mjs/workspace-automatic-sync-policy.mjs

@@ -15,6 +15,12 @@ function projectBranchHasActiveWorkspaceTarget(projectId, branchName, activeTarg
   }
   return false;
 }
+function projectBranchMountBusyDuringExclusiveSync(input) {
+  return input.executionDisabled || input.worktreeOperationInProgress || input.retainedCanonicalProcessGroup || projectBranchHasActiveWorkspaceTarget(input.projectId, input.branchName, input.activeTargets);
+}
+function workspacePlansMountBusyDuringExclusiveSync(activeTargets, retainedCanonicalProcessGroup = false) {
+  return retainedCanonicalProcessGroup || hasActiveVisibleProjectsWorkspaceTarget(activeTargets);
+}
 function shouldDeferAutomaticWorkspaceSyncForPendingBranch(pendingCreatedBranches, activeTargets) {
   if (pendingCreatedBranches.length === 0) return false;
   const targets = [...activeTargets];
@@ -36,5 +42,7 @@ export {
   pendingCreatedBranchAutomaticSyncDeferral,
   pendingCreatedBranchKey,
   projectBranchHasActiveWorkspaceTarget,
-  shouldDeferAutomaticWorkspaceSyncForPendingBranch
+  projectBranchMountBusyDuringExclusiveSync,
+  shouldDeferAutomaticWorkspaceSyncForPendingBranch,
+  workspacePlansMountBusyDuringExclusiveSync
 };

package/dist/mjs/workspace-command-sync-policy.mjs

@@ -20,12 +20,32 @@ function shouldSerializeWorkspaceCommand(target) {
 function runWorkspaceCommand(target, coordinator, operation) {
   return shouldSerializeWorkspaceCommand(target) ? coordinator.runMutation(operation) : Promise.resolve().then(operation);
 }
+async function runReservedWorkspaceCommand(target, coordinator, operation, releaseReservation) {
+  let released = false;
+  const releaseOnce = () => {
+    if (released) return;
+    released = true;
+    releaseReservation();
+  };
+  try {
+    return await runWorkspaceCommand(target, coordinator, async () => {
+      try {
+        return await operation();
+      } finally {
+        releaseOnce();
+      }
+    });
+  } finally {
+    releaseOnce();
+  }
+}
 function acquireWorkspaceCommandMutation(target, coordinator) {
   return shouldSerializeWorkspaceCommand(target) ? coordinator.acquireMutation() : Promise.resolve(void 0);
 }
 export {
   acquireWorkspaceCommandMutation,
   reserveWorkspaceCommandAfterCurrentSync,
+  runReservedWorkspaceCommand,
   runWorkspaceCommand,
   shouldSerializeWorkspaceCommand
 };

package/dist/mjs/workspace-git-sync.mjs

@@ -15,6 +15,15 @@ const WORKSPACE_GIT_INTEGRATED_REF = "refs/r5d/workspace-local/integrated";
 const WORKSPACE_GIT_HYDRATED_RECEIPT = "r5d/workspace-hydrated-head";
 const WORKSPACE_GIT_HYDRATION_TRANSACTION = "r5d/workspace-hydration-transaction";
 const WORKSPACE_GIT_CHECKOUT_DURABILITY = "r5d/workspace-checkout-durability";
+function workspaceGitMountsForRemediation(mounts) {
+  return mounts.map((mount) => ({ ...mount, busy: mount.busyForRecovery ?? mount.busy }));
+}
+class WorkspaceRemediationAncestryError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "WorkspaceRemediationAncestryError";
+  }
+}
 const NON_RECURSIVE_GIT_CONFIG = [
   "-c",
   "submodule.recurse=false",
@@ -54,6 +63,29 @@ function revParse(workspacePath, revision) {
   const result = gitResult(workspacePath, ["rev-parse", "--verify", revision]);
   return result.exitCode === 0 ? result.stdout : null;
 }
+function requiredWorkspaceAncestorHeads(value) {
+  if (value === void 0) return [];
+  if (!Array.isArray(value) || value.length === 0 || value.some((head) => typeof head !== "string" || !/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/.test(head)) || new Set(value).size !== value.length) {
+    throw new WorkspaceRemediationAncestryError("Workspace remediation ancestor requirements are invalid");
+  }
+  return [...value];
+}
+function assertWorkspaceRemediationAncestry(input) {
+  if (input.requiredAncestorHeads.length === 0) return;
+  if (!input.currentHead) throw new WorkspaceRemediationAncestryError("Workspace remediation has no resolved HEAD to verify");
+  for (const requiredHead of input.requiredAncestorHeads) {
+    if (!tryGit(input.workspacePath, ["cat-file", "-e", `${requiredHead}^{commit}`]) || !tryGit(input.workspacePath, ["merge-base", "--is-ancestor", requiredHead, input.currentHead])) {
+      throw new WorkspaceRemediationAncestryError(
+        `Workspace remediation HEAD does not descend from required conflict commit ${requiredHead}`
+      );
+    }
+  }
+  if (!input.remoteHead || !tryGit(input.workspacePath, ["cat-file", "-e", `${input.remoteHead}^{commit}`]) || !tryGit(input.workspacePath, ["merge-base", "--is-ancestor", input.remoteHead, input.currentHead])) {
+    throw new WorkspaceRemediationAncestryError(
+      "Fetched workspace head is not an ancestor of the resolved remediation HEAD; merge it explicitly before synchronizing"
+    );
+  }
+}
 function updateIntegratedWorkspaceHead(workspacePath, head) {
   git(workspacePath, ["update-ref", WORKSPACE_GIT_INTEGRATED_REF, head], "record integrated workspace head");
 }
@@ -923,6 +955,15 @@ function configureWorkspaceRepository(input) {
   );
   git(input.workspacePath, ["config", "--local", "core.fsyncMethod", "fsync"], "configure workspace fsync method");
 }
+function configureExistingWorkspaceGitForRemediation(input) {
+  const workspacePath = path.resolve(input.workspacePath);
+  const workspaceStatus = lstatIfExists(workspacePath);
+  const gitStatus = lstatIfExists(path.join(workspacePath, ".git"));
+  if (!workspaceStatus?.isDirectory() || workspaceStatus.isSymbolicLink() || !gitStatus?.isDirectory() || gitStatus.isSymbolicLink()) {
+    throw new Error("Active workspace remediation requires a regular existing canonical synchronization checkout");
+  }
+  configureWorkspaceRepository({ ...input, workspacePath });
+}
 function fetchWorkspaceHead(workspacePath, remoteUrl, credentialHelper, credentialUsername) {
   const result = gitResult(workspacePath, [
     ...gitTransportSecurityArgs(remoteUrl, credentialHelper, credentialUsername),
@@ -1261,6 +1302,9 @@ function resetWorkspaceGit(input) {
     const outerPath = path.join(workspacePath, ...mount.workspaceRelativePath.replace(/\\/g, "/").split("/"));
     return fs.existsSync(outerPath);
   });
+  const bootstrapMountIds = new Set(bootstrapMounts.map(({ id }) => id));
+  const durablyAbsentMounts = selected.skipped.filter((mount) => !bootstrapMountIds.has(mount.id) && mount.sourceMode === "all");
+  const uncoveredSkippedMounts = selected.skipped.filter((mount) => !bootstrapMountIds.has(mount.id) && mount.sourceMode !== "all");
   const hydrationMounts = [...selected.active, ...bootstrapMounts];
   const requiredLiveMounts = [
     ...new Map([...requiredLiveMountsBeforeHydration, ...bootstrapMounts].map((mount) => [mount.id, mount])).values()
@@ -1268,7 +1312,7 @@ function resetWorkspaceGit(input) {
   const hydration = hydrateWorkspaceGitMountsTransactionally({
     workspacePath,
     mounts: hydrationMounts,
-    durabilityMounts: [...requiredLiveMounts, ...selected.tombstones],
+    durabilityMounts: [...requiredLiveMounts, ...selected.tombstones, ...durablyAbsentMounts],
     receiptMounts: input.mounts,
     requiredMounts: requiredLiveMounts,
     recordCurrentHead: true
@@ -1284,7 +1328,7 @@ function resetWorkspaceGit(input) {
     remoteHead,
     discardedPaths,
     activeMountIds: hydration.hydratedMountIds,
-    skippedMountIds: [.../* @__PURE__ */ new Set([...selected.skipped.map(({ id }) => id), ...hydration.skippedMountIds])].sort()
+    skippedMountIds: [.../* @__PURE__ */ new Set([...uncoveredSkippedMounts.map(({ id }) => id), ...hydration.skippedMountIds])].sort()
   };
 }
 function stagedPaths(workspacePath) {
@@ -1424,8 +1468,16 @@ async function synchronizeWorkspaceGit(input) {
   const maxDiffBytes = input.maxDiffBytes ?? MAX_WORKSPACE_GIT_DIFF_BYTES;
   const maxPushAttempts = Math.max(1, input.maxPushAttempts ?? 4);
   validateMounts(workspacePath, input.mounts);
+  const requiredAncestorHeads = requiredWorkspaceAncestorHeads(input.requiredAncestorHeads);
   const preserveResolutionInProgress = input.skipMountMirror === true;
   const initial = ensureWorkspaceGitClone({ ...input, workspacePath, preserveResolutionInProgress });
+  assertWorkspaceRemediationAncestry({
+    workspacePath,
+    currentHead: initial.localHead,
+    remoteHead: initial.remoteHead,
+    requiredAncestorHeads
+  });
+  const verifiedAncestorHeads = requiredAncestorHeads.length > 0 ? requiredAncestorHeads : void 0;
   const startingHead = initial.localHead;
   const receiptBeforeInitialHydration = readHydratedWorkspaceReceipt(workspacePath);
   const deferredMountIds = /* @__PURE__ */ new Set();
@@ -1517,6 +1569,7 @@ async function synchronizeWorkspaceGit(input) {
           conflictPaths: merged.conflictPaths,
           conflictSnapshotRefs: refs,
           conflictKind: "projection_merge",
+          ...verifiedAncestorHeads ? { verifiedAncestorHeads } : {},
           error: merged.error
         };
       }
@@ -1640,6 +1693,12 @@ async function synchronizeWorkspaceGit(input) {
   let rebaseCount = 0;
   let updated = false;
   for (let pushAttempt = 0; pushAttempt < maxPushAttempts; pushAttempt += 1) {
+    assertWorkspaceRemediationAncestry({
+      workspacePath,
+      currentHead: revParse(workspacePath, "HEAD"),
+      remoteHead,
+      requiredAncestorHeads
+    });
     const reconciled = synchronizeWithFetchedHead({ workspacePath, remoteHead, attemptId });
     if (reconciled.kind === "conflict") {
       const localHead2 = revParse(workspacePath, "HEAD");
@@ -1657,6 +1716,7 @@ async function synchronizeWorkspaceGit(input) {
         conflictPaths: reconciled.conflictPaths,
         conflictSnapshotRefs: reconciled.refs,
         conflictKind: "integration_rebase",
+        ...verifiedAncestorHeads ? { verifiedAncestorHeads } : {},
         error: reconciled.error
       };
     }
@@ -1676,11 +1736,13 @@ async function synchronizeWorkspaceGit(input) {
         diffSizeBytes: 0,
         affectedPaths: [],
         ...classifiedMounts,
+        ...verifiedAncestorHeads ? { verifiedAncestorHeads } : {},
         ...projectionWarning ? { error: projectionWarning } : {}
       };
     }
     const paths = changedPaths(workspacePath, remoteHead, localHead);
-    const size = paths.length > 0 ? await diffSizeBytes(workspacePath, remoteHead, localHead, maxDiffBytes) : 0;
+    const size = paths.length > 0 ? await (input.measureDiffSize ?? diffSizeBytes)(workspacePath, remoteHead, localHead, maxDiffBytes) : 0;
+    input.assertStillAdmitted?.();
     if (paths.length > 0 && size > maxDiffBytes && !input.allowLargeDiff) {
       const classifiedMounts = classifyMounts([...selected.active, ...selected.tombstones]);
       return {
@@ -1693,15 +1755,18 @@ async function synchronizeWorkspaceGit(input) {
         diffSizeBytes: size,
         affectedPaths: paths,
         ...classifiedMounts,
+        ...verifiedAncestorHeads ? { verifiedAncestorHeads } : {},
         error: `Workspace diff exceeds the ${maxDiffBytes}-byte automatic publication limit`
       };
     }
     if (localHead === remoteHead) {
+      assertWorkspaceRemediationAncestry({ workspacePath, currentHead: localHead, remoteHead, requiredAncestorHeads });
       const completedMounts = completedMountSelection(Boolean(input.skipMountMirror));
       await input.afterWorkspacePublished?.({
         publishedHead: localHead,
         activeMountIds: completedMounts.activeMountIds
       });
+      input.assertStillAdmitted?.();
       return {
         outcome: updated ? "updated" : "no_change",
         startingHead,
@@ -1712,9 +1777,11 @@ async function synchronizeWorkspaceGit(input) {
         diffSizeBytes: size,
         affectedPaths: paths,
         ...completedMounts,
+        ...verifiedAncestorHeads ? { verifiedAncestorHeads } : {},
         ...projectionWarning ? { error: projectionWarning } : {}
       };
     }
+    assertWorkspaceRemediationAncestry({ workspacePath, currentHead: localHead, remoteHead, requiredAncestorHeads });
     const pushArgs = [
       ...gitTransportSecurityArgs(input.remoteUrl, input.credentialHelper, input.credentialUsername),
       "push",
@@ -1724,12 +1791,14 @@ async function synchronizeWorkspaceGit(input) {
     pushArgs.push("origin", `HEAD:refs/heads/${WORKSPACE_GIT_BRANCH}`);
     const push = gitResult(workspacePath, pushArgs);
     if (push.exitCode === 0) {
+      assertWorkspaceRemediationAncestry({ workspacePath, currentHead: localHead, remoteHead, requiredAncestorHeads });
       updateIntegratedWorkspaceHead(workspacePath, localHead);
       const completedMounts = completedMountSelection(Boolean(input.skipMountMirror));
       await input.afterWorkspacePublished?.({
         publishedHead: localHead,
         activeMountIds: completedMounts.activeMountIds
       });
+      input.assertStillAdmitted?.();
       return {
         outcome: "pushed",
         startingHead,
@@ -1740,6 +1809,7 @@ async function synchronizeWorkspaceGit(input) {
         diffSizeBytes: size,
         affectedPaths: paths,
         ...completedMounts,
+        ...verifiedAncestorHeads ? { verifiedAncestorHeads } : {},
         ...projectionWarning ? { error: projectionWarning } : {}
       };
     }
@@ -1765,11 +1835,14 @@ export {
   WORKSPACE_GIT_CONFIRMED_LARGE_DIFF_PUSH_OPTION,
   WORKSPACE_GIT_HYDRATED_RECEIPT,
   WORKSPACE_GIT_HYDRATION_TRANSACTION,
+  WorkspaceRemediationAncestryError,
+  configureExistingWorkspaceGitForRemediation,
   ensureWorkspaceGitClone,
   hydrateWorkspaceGitMounts,
   recoverWorkspaceGitHydration,
   resetWorkspaceGit,
   synchronizeWorkspaceGit,
   workspaceGitHydrationIsCurrent,
+  workspaceGitMountsForRemediation,
   workspaceGitSyncTestHarness
 };

package/dist/types/main.d.ts

@@ -1,5 +1,6 @@
 #!/usr/bin/env bun
 import { Database } from "bun:sqlite";
+import type { WorkerGitIdentity } from "./git-identity";
 import { configureGitHubRegistryAuthFiles, type PreparedPrivateAuthFileGeneration } from "./registry-auth";
 type WorkerProjectConfig = {
     projectId: string;
@@ -22,6 +23,53 @@ type WorkerProjectConfig = {
         baseCommitHash: string;
     }>;
 };
+type WorkspaceSyncTrigger = {
+    type: "connect" | "inbound_head" | "write" | "edit" | "shell_inline" | "process_terminal" | "process_cancel" | "periodic" | "manual" | "remediation" | "remediation_confirm" | "remediation_reset";
+    sessionId?: string;
+    processRunId?: string;
+    toolCallId?: string;
+    projectId?: string;
+    branchName?: string;
+    detail?: string;
+};
+type WorkspaceSyncResult = {
+    type: "workspace_sync";
+    attemptId: string;
+    workerLabel: string;
+    trigger: WorkspaceSyncTrigger;
+    outcome: "no_change" | "published" | "updated" | "conflict_reset" | "large_diff_blocked" | "conflict_blocked" | "reset" | "failed";
+    startingHead: string | null;
+    localHead?: string;
+    publishedHead?: string;
+    rebaseCount: number;
+    diffSizeBytes: number;
+    gitStatus: string;
+    affectedProjects: string[];
+    affectedPaths: string[];
+    activeMountIds?: string[];
+    skippedMountIds?: string[];
+    activeProjectBranchPublications?: Array<{
+        branchId: string;
+        projectId: string;
+        branchName: string;
+    }>;
+    discardedPaths: string[];
+    localChangesDiscarded: boolean;
+    conflictPaths?: string[];
+    conflictSnapshotRefs?: {
+        local: string;
+        remote: string;
+    };
+    conflictKind?: "integration_rebase" | "projection_merge";
+    verifiedAncestorHeads?: string[];
+    telemetry?: {
+        totalMs: number;
+        queueMs: number;
+        prepareMs: number;
+        synchronizeMs: number;
+    };
+    error?: string;
+};
 export type WorkerSessionTarget = {
     type: "project";
     projectId: string;
@@ -31,6 +79,208 @@ export type WorkerSessionTarget = {
     ownerUserId: string;
     rootProfile: "visible_projects" | "canonical_sync";
 };
+type WorkerServerMessage = {
+    type: "connected";
+    label: string;
+    workerId: string;
+} | {
+    type: "workspace_config";
+    requestId: string;
+    projects: WorkerProjectConfig[];
+    workspaceRemoteUrl: string;
+    gitIdentity: WorkerGitIdentity;
+    githubCredential: WorkerGitHubCredential | null;
+    deferWorkspaceSyncForIncidentId?: string;
+    resetToCanonical?: boolean;
+} | {
+    type: "sync_workspace";
+    requestId: string;
+    attemptId: string;
+    trigger: WorkspaceSyncTrigger;
+    confirmedLargeDiff?: boolean;
+    confirmationReason?: string;
+    resetToCanonical?: boolean;
+    requiredAncestorHeads?: string[];
+} | {
+    type: "create_project_branch";
+    requestId: string;
+    branchId: string;
+    projectId: string;
+    sourceBranch: string;
+    targetBranch: string;
+} | {
+    type: "delete_project_branch";
+    requestId: string;
+    branchId: string;
+    projectId: string;
+    branchName: string;
+} | {
+    type: "code_list";
+    requestId: string;
+    target: Extract<WorkerSessionTarget, {
+        type: "project";
+    }>;
+    path: string;
+} | {
+    type: "code_read";
+    requestId: string;
+    target: Extract<WorkerSessionTarget, {
+        type: "project";
+    }>;
+    path: string;
+} | {
+    type: "sync_session_artifacts";
+    requestId: string;
+    sessionId: string;
+} | {
+    type: "workspace_incident_updated";
+    incidentId: string | null;
+    status: "remediating" | "waiting_for_worker" | "resolved" | "confirmed" | "reset" | null;
+    originWorkerLabel?: string;
+} | {
+    type: "exec_terminal_ack";
+    runId: string;
+} | {
+    type: "port_forward_connect";
+    forwardId: string;
+    relayConnectionId: string;
+    workerPort: number;
+} | {
+    type: "update_clis";
+    requestId: string;
+    workerPackageSpec: string;
+    r5dctlPackageSpec: string;
+    targetWorkerVersion: string;
+    targetR5dctlVersion: string;
+} | {
+    type: "exec";
+    requestId: string;
+    runId: string;
+    target: WorkerSessionTarget;
+    sessionId?: string;
+    argv: string[];
+    cwd?: string;
+    env?: Record<string, string>;
+    timeoutMs?: number;
+    workspaceEffect?: "none";
+} | {
+    type: "exec_start";
+    requestId: string;
+    runId: string;
+    target: WorkerSessionTarget;
+    sessionId: string;
+    argv: string[];
+    command: string;
+    mode: "foreground" | "detached";
+    credentialId?: string;
+    cwd?: string;
+    env?: Record<string, string>;
+    timeoutMs?: number;
+    interactive?: boolean;
+    workspaceEffect?: "none";
+} | {
+    type: "exec_stdin";
+    requestId: string;
+    runId: string;
+    data?: string;
+    eof?: boolean;
+} | {
+    type: "pty_open";
+    requestId: string;
+    ptyId: string;
+    target: WorkerSessionTarget;
+    cols: number;
+    rows: number;
+    command?: string;
+    env?: Record<string, string>;
+    envFiles?: Array<{
+        path: string;
+        content: string;
+        mode?: number;
+    }>;
+} | {
+    type: "pty_input";
+    ptyId: string;
+    data: string;
+} | {
+    type: "pty_resize";
+    ptyId: string;
+    cols: number;
+    rows: number;
+} | {
+    type: "pty_close";
+    ptyId: string;
+} | {
+    type: "read";
+    requestId: string;
+    target: WorkerSessionTarget;
+    sessionId?: string;
+    activePlanId?: string;
+    filePath: string;
+    offset?: number;
+    limit?: number;
+} | {
+    type: "write";
+    requestId: string;
+    target: WorkerSessionTarget;
+    sessionId?: string;
+    activePlanId?: string;
+    filePath: string;
+    content: string;
+} | {
+    type: "edit";
+    requestId: string;
+    target: WorkerSessionTarget;
+    sessionId?: string;
+    activePlanId?: string;
+    filePath: string;
+    edits: Array<{
+        oldText: string;
+        newText: string;
+    }>;
+} | {
+    type: "grep";
+    requestId: string;
+    target: WorkerSessionTarget;
+    sessionId?: string;
+    activePlanId?: string;
+    pattern: string;
+    path?: string;
+    glob?: string;
+    caseSensitive?: boolean;
+    limit?: number;
+} | {
+    type: "find";
+    requestId: string;
+    target: WorkerSessionTarget;
+    sessionId?: string;
+    activePlanId?: string;
+    pattern?: string;
+    path?: string;
+    entryType?: string;
+    limit?: number;
+} | {
+    type: "ls";
+    requestId: string;
+    target: WorkerSessionTarget;
+    sessionId?: string;
+    activePlanId?: string;
+    path?: string;
+    limit?: number;
+} | {
+    type: "view_file_bytes";
+    requestId: string;
+    target: WorkerSessionTarget;
+    sessionId?: string;
+    activePlanId?: string;
+    filePath: string;
+} | {
+    type: "cancel";
+    requestId: string;
+    runId: string;
+} | {
+    type: "ping";
+};
 type WorkerReadFileResult = {
     type: "read";
     kind: "text";
@@ -151,6 +401,7 @@ export declare const workerPtyTestHarness: {
     removeEnvFiles: typeof removePtyEnvFiles;
     resolveEnvFileReferences: typeof resolvePtyEnvFileReferences;
     commandHasWorkspaceEffect: typeof workerCommandHasWorkspaceEffect;
+    canonicalSyncTerminalHead: typeof canonicalSyncTerminalHead;
     ptyIsWorkspaceBusy: typeof workerPtyIsWorkspaceBusy;
     parseLinuxForegroundBusy: typeof parseLinuxPtyForegroundBusy;
 };
@@ -302,6 +553,64 @@ type CredentialReapContractProbe = {
 type CredentialReapContractStatus = "direct" | "systemd_unverified" | "verified_systemd";
 declare function credentialReapContractStatus(probe?: CredentialReapContractProbe): CredentialReapContractStatus;
 declare function verifiedCredentialReapContract(probe?: CredentialReapContractProbe): boolean;
+declare function workspaceConfigurationIncidentDeferral(input: {
+    requestedIncidentId: string | undefined;
+    activeIncidentId: string | null;
+}): {
+    incidentId: string | null;
+    error?: Error;
+};
+type DeferredWorkspaceConfiguration = {
+    incidentId: string;
+    serverRefreshExpected: boolean;
+};
+declare function workspaceIncidentTerminalClearDisposition(input: {
+    deferredConfiguration: DeferredWorkspaceConfiguration | null;
+    clearedIncidentId: string;
+}): "await_server_refresh" | "reconnect_for_refresh";
+declare function workspaceIncidentTerminalRefreshFence(input: {
+    deferredConfiguration: DeferredWorkspaceConfiguration | null;
+    clearedIncidentId: string;
+}): {
+    disposition: "await_server_refresh" | "reconnect_for_refresh";
+    deferredConfiguration: DeferredWorkspaceConfiguration;
+};
+declare function workspaceAutomaticSyncIsAdmitted(input: {
+    workspaceConfigured: boolean;
+    activeIncidentId: string | null;
+    deferredConfiguration: DeferredWorkspaceConfiguration | null;
+}): boolean;
+declare function deferredWorkspaceTargetIsAllowed(deferredConfiguration: DeferredWorkspaceConfiguration | null, activeIncidentId: string | null, target: WorkerSessionTarget): boolean;
+declare function deferredWorkspaceSyncTriggerIsAllowed(deferredConfiguration: DeferredWorkspaceConfiguration | null, activeIncidentId: string | null, trigger: WorkspaceSyncTrigger): boolean;
+declare function workspaceOperationsAreFenced(deferredConfiguration: DeferredWorkspaceConfiguration | null, activeIncidentId: string | null): boolean;
+declare function workspaceCommandTransportIsAllowed(deferredConfiguration: DeferredWorkspaceConfiguration | null, activeIncidentId: string | null, transport: "exec" | "exec_start"): boolean;
+declare function deferredCredentialTransitionMustWait(input: {
+    incidentId: string | null;
+    transitionPhase: CredentialGenerationTransitionPhase;
+    canonicalRemediationActive: boolean;
+}): boolean;
+declare function workspaceConfigurationIncidentSnapshotIsCurrent(capturedIncidentId: string | null, activeIncidentId: string | null): boolean;
+declare function workspaceConfigurationResetToCanonicalIsAllowed(requested: boolean | undefined, incidentId: string | null): boolean;
+declare function deferredWorkspaceRefreshWatchdogIsCurrent(input: {
+    capturedIncidentId: string;
+    deferredConfiguration: DeferredWorkspaceConfiguration | null;
+    activeIncidentId: string | null;
+}): boolean;
+declare function incidentDeferredProjectCheckouts(projects: readonly WorkerProjectConfig[]): Array<{
+    projectId: string;
+    branchName: string;
+}>;
+declare function deferredIncidentWorkspaceConfigurationResult(input: {
+    attemptId: string;
+    workerLabel: string;
+    head: string | null;
+    skippedMountIds: string[];
+}): WorkspaceSyncResult;
+declare function workspaceSyncFailureHydrationIsSafe(input: {
+    error: unknown;
+    resetToCanonical: boolean;
+    inspectCurrentHydration: () => boolean;
+}): boolean;
 declare function fenceUnsafeWorkspaceSyncFailure(input: {
     hydrationCurrent: boolean;
     invalidateExecution: () => void;
@@ -332,7 +641,24 @@ export declare const workerGitSecurityTestHarness: {
     credentialReapContractStatus: typeof credentialReapContractStatus;
     verifiedCredentialReapContract: typeof verifiedCredentialReapContract;
     fenceUnsafeWorkspaceSyncFailure: typeof fenceUnsafeWorkspaceSyncFailure;
+    workspaceConfigurationIncidentDeferral: typeof workspaceConfigurationIncidentDeferral;
+    workspaceIncidentTerminalClearDisposition: typeof workspaceIncidentTerminalClearDisposition;
+    workspaceIncidentTerminalRefreshFence: typeof workspaceIncidentTerminalRefreshFence;
+    workspaceAutomaticSyncIsAdmitted: typeof workspaceAutomaticSyncIsAdmitted;
+    deferredWorkspaceTargetIsAllowed: typeof deferredWorkspaceTargetIsAllowed;
+    deferredWorkspaceSyncTriggerIsAllowed: typeof deferredWorkspaceSyncTriggerIsAllowed;
+    workspaceOperationsAreFenced: typeof workspaceOperationsAreFenced;
+    workspaceCommandTransportIsAllowed: typeof workspaceCommandTransportIsAllowed;
+    deferredCredentialTransitionMustWait: typeof deferredCredentialTransitionMustWait;
+    workspaceConfigurationIncidentSnapshotIsCurrent: typeof workspaceConfigurationIncidentSnapshotIsCurrent;
+    workspaceConfigurationResetToCanonicalIsAllowed: typeof workspaceConfigurationResetToCanonicalIsAllowed;
+    deferredWorkspaceRefreshWatchdogIsCurrent: typeof deferredWorkspaceRefreshWatchdogIsCurrent;
+    incidentDeferredProjectCheckouts: typeof incidentDeferredProjectCheckouts;
+    deferredIncidentWorkspaceConfigurationResult: typeof deferredIncidentWorkspaceConfigurationResult;
+    workspaceSyncFailureHydrationIsSafe: typeof workspaceSyncFailureHydrationIsSafe;
     assertWorkerChildAdmission: typeof assertWorkerChildAdmission;
+    executeWriteFileOperation: typeof executeWriteFileOperation;
+    executeEditFileOperation: typeof executeEditFileOperation;
     terminateCredentialBearingChildren: typeof terminateCredentialBearingChildren;
     terminateCredentialBearingChildrenWithRetention: typeof terminateCredentialBearingChildrenWithRetention;
     commitCredentialGeneration(prepared: PreparedPrivateAuthFileGeneration, credential: WorkerGitHubCredential | null, children: readonly {
@@ -365,6 +691,7 @@ type ResolvedWorkerSessionTarget = {
     rootPath: string;
     config?: WorkerProjectConfig;
 };
+declare function canonicalSyncTerminalHead(resolvedTarget: Pick<ResolvedWorkerSessionTarget, "target" | "rootPath">, readHead?: (rootPath: string) => string): string | undefined;
 export declare function describeWorkerSessionTarget(target: WorkerSessionTarget): string;
 export declare function resolveWorkerSessionTarget(input: {
     target: WorkerSessionTarget;
@@ -389,6 +716,28 @@ export declare function editWorkerTextFile(branchPath: string, filePath: string,
     oldText: string;
     newText: string;
 }>, builtInPaths?: WorkerBuiltInToolPaths): WorkerEditFileResult;
+declare function executeWriteFileOperation(input: {
+    message: Extract<WorkerServerMessage, {
+        type: "write";
+    }>;
+    resolvedTarget: ResolvedWorkerSessionTarget;
+    baseUrl: string;
+    token: string;
+    artifactRoot: string;
+    planRoot: string;
+    assertAdmission: () => void;
+}): Promise<WorkerWriteFileResult>;
+declare function executeEditFileOperation(input: {
+    message: Extract<WorkerServerMessage, {
+        type: "edit";
+    }>;
+    resolvedTarget: ResolvedWorkerSessionTarget;
+    baseUrl: string;
+    token: string;
+    artifactRoot: string;
+    planRoot: string;
+    assertAdmission: () => void;
+}): Promise<WorkerEditFileResult>;
 export declare function grepWorkerFiles(branchPath: string, input: {
     pattern: string;
     path?: string;