@ricsam/r5dctl 0.0.73 → 0.0.75

package/README.md

@@ -90,13 +90,6 @@ r5dctl session status <session-id>
 r5dctl session prompt --worker <label> --mode agent --model max <session-id> "Also check the migration"
 r5dctl session stop <session-id>
 
-r5dctl -p <project> merge fix/tests
-r5dctl -p <project> merge --worker <label> --create-conflict-worktree fix/tests
-r5dctl -p <project> merge --worker <label> --launch-conflict-resolution-agent fix/tests
-r5dctl -p <project> merge --worker <label> --launch-conflict-resolution-agent --no-wait fix/tests
-r5dctl -p <project> merge status <attempt-id>
-r5dctl -p <project> merge finish --worker <label> conflicts/fix-tests --summary "Resolved the conflicts"
-
 r5dctl -p <project> -b <branch> shell
 r5dctl -p <project> -b <branch> shell -c "bun test"
 
@@ -109,17 +102,21 @@ r5dctl k8s usage
 r5dctl k8s usage --namespace default --workload api --container server
 r5dctl k8s usage --window 7d
 r5dctl k8s usage --workload default/api --window 7d --json
+r5dctl vcluster trusted-workflow add --repo owner/repository --workflow .github/workflows/deploy.yml
+r5dctl vcluster trusted-workflow list
+r5dctl vcluster trusted-workflow remove <workflow-id>
 ```
 
-`session start` creates an ordinary agent-mode chat on an explicitly selected existing worktree, or creates a named worktree from an explicit `worktree:<branch>` source. It requires project, worker, model, and prompt and never infers them from the current shell. Starts and prompts return after durable enqueue while execution continues asynchronously. Task specialization belongs in the prompt; there are no predefined debug, explore, research, or test agents. `session stop` returns as soon as the agent run is stopped; the stopped worktree's workspace publication finishes asynchronously behind the response, and `merge` republishes at its own boundary before reading the worktree.
-
-Add `-f`/`--follow`/`--watch` to `session start` to attach after enqueue, or to `conversation` to print the current transcript and follow new output. Assistant text is written to stdout and lifecycle/tool progress to stderr; `--tools` includes tool calls and results. With global `--json`, follow mode emits one JSON event per line. Ctrl-C only detaches and never stops the session. The CLI reconnects transiently interrupted event streams and resynchronizes committed conversation revisions without repeating assistant text.
-
-`merge` merges a managed source worktree into its recorded parent. By default conflicts are reported without creating more work. `--create-conflict-worktree` prepares a manual conflict worktree, while `--launch-conflict-resolution-agent` starts the dedicated merge-conflict resolver; those strategies are mutually exclusive. A worker-bound shell credential supplies its own worker automatically; otherwise pass `--worker`. Finish a reviewed manual resolution with `merge finish`.
+Trusted workflows authenticate Kubernetes through the dedicated
+`ricsam/r5d-cluster-auth` GitHub Action. They do not run or authenticate
+`r5dctl` inside GitHub Actions, and no R5D secret needs to be stored in the
+repository. Trust applies to that workflow path on every Git ref and grants
+cluster-admin, so protect workflow changes and do not invoke it for untrusted
+pull requests.
 
-Merging is lockless and optimistic: nothing blocks agents from continuing to work on the involved branches. Every merge pins the branch tips it previewed and publishes through an atomic compare-and-swap, and a concurrent publication simply retries. When a resolver agent finishes after the target advanced, the platform automatically continues the merge — publishing directly if the refreshed merge is conflict-free, or launching a fresh resolver attempt (whose prompt references the superseded session's resolution) — repeating until one resolution publishes. Superseded attempts surface the follow-up attempt id in `merge status`. Only manual conflict worktrees stop at `stale`: re-run `merge` to start a fresh resolution.
+`session start` creates an ordinary agent-mode chat on an explicitly selected existing worktree, or creates a named linked worktree from an explicit `worktree:<branch>` source. It requires project, worker, model, and prompt and never infers them from the current shell. Start returns a durable `provisioning` handle immediately; workspace synchronization, linked-worktree creation, and prompt enqueue continue in the background and are visible through `session status`. Idempotent request retries return the same handle. Prompts return after durable enqueue. Task specialization belongs in the prompt; there are no predefined debug, explore, research, or test agents. `session stop` returns as soon as the agent run is stopped; the stopped worktree's workspace Git synchronization finishes asynchronously behind the response.
 
-The server answers merge requests as soon as the result is durably recorded; the slow per-member workspace propagation always completes asynchronously behind the response. For a clean merge that means the merged commit is already published when the command returns. For a conflict strategy the server responds with the merge attempt in a `provisioning` state and prepares the conflict worktree (and starts the resolver agent) in the background; the CLI polls the attempt until the worktree is ready — and, for the agent strategy, until the resolver agent is running — before printing the final result. Pass `--no-wait` to skip the wait and get the attempt id immediately, and use `merge status <attempt-id>` at any time to re-check a provisioning, failed, or completed attempt (a provisioning failure surfaces there as a `failed` attempt with its reason). Ctrl-C during the wait only detaches the CLI; provisioning continues server-side.
+Add `-f`/`--follow`/`--watch` to `session start` to poll the provisioning handle and attach after enqueue, or to `conversation` to print the current transcript and follow new output. Assistant text is written to stdout and lifecycle/tool progress to stderr; `--tools` includes tool calls and results. With global `--json`, follow mode emits one JSON event per line. Ctrl-C only detaches and never stops the session. The CLI reconnects transiently interrupted event streams and resynchronizes committed conversation revisions without repeating assistant text.
 
 `shell` connects to the same live worker PTY as the web Shell tab. Without `-c` it attaches the local terminal interactively. With `-c`/`--command`, it runs the supplied shell expression, streams combined PTY output, and exits with the remote command's status. Because command output uses a PTY, stdout and stderr are combined and programs may emit colors or other terminal control sequences.
 

package/dist/cjs/cli.cjs

@@ -30,7 +30,6 @@ var cli_exports = {};
 __export(cli_exports, {
   advanceTransientDevicePollBackoff: () => advanceTransientDevicePollBackoff,
   collectK8sUsage: () => collectK8sUsage,
-  dispatchMergeCommand: () => dispatchMergeCommand,
   dispatchSessionRunCommand: () => dispatchSessionRunCommand,
   followR5dctlSession: () => followR5dctlSession,
   formatK8sCpu: () => formatK8sCpu,
@@ -42,7 +41,6 @@ __export(cli_exports, {
   getR5dctlVersion: () => getR5dctlVersion,
   getTransientDevicePollDelay: () => getTransientDevicePollDelay,
   handleAuthLogin: () => handleAuthLogin,
-  isMergeAttemptSettled: () => isMergeAttemptSettled,
   main: () => main,
   parseAnswerEnvRequestCommandArgs: () => parseAnswerEnvRequestCommandArgs,
   parseAnswerFlags: () => parseAnswerFlags,
@@ -56,7 +54,6 @@ __export(cli_exports, {
   parseGetEnvsArgs: () => parseGetEnvsArgs,
   parseGlobalArgs: () => parseGlobalArgs,
   parseK8sUsageArgs: () => parseK8sUsageArgs,
-  parseMergeCommand: () => parseMergeCommand,
   parsePromptArgs: () => parsePromptArgs,
   parsePsHistoryArgs: () => parsePsHistoryArgs,
   parsePsListArgs: () => parsePsListArgs,
@@ -80,10 +77,10 @@ __export(cli_exports, {
   renderSessionRunStatus: () => renderSessionRunStatus,
   renderWorkspaceStatus: () => renderWorkspaceStatus,
   renderWorkspaceSync: () => renderWorkspaceSync,
-  renderWorktreeMerge: () => renderWorktreeMerge,
   resolveCommandExecution: () => resolveCommandExecution,
   runR5dctlCli: () => runR5dctlCli,
   summarizeEnvData: () => summarizeEnvData,
+  waitForSessionProvisioning: () => waitForSessionProvisioning,
   writeConfig: () => writeConfig
 });
 module.exports = __toCommonJS(cli_exports);
@@ -97,7 +94,7 @@ var import_promises = require("node:timers/promises");
 var import_dotenv = require("dotenv");
 var import_r5d_api = require("@ricsam/r5d-api");
 var import_shell = require("./shell.cjs");
-const CHAT_MODES = /* @__PURE__ */ new Set(["ask", "plan", "agent", "large_diff_remediation", "merge_conflict_resolution"]);
+const CHAT_MODES = /* @__PURE__ */ new Set(["ask", "plan", "agent", "large_diff_remediation"]);
 const R5DCTL_SESSION_MODES = /* @__PURE__ */ new Set(["ask", "plan", "agent"]);
 const MODEL_TIERS = /* @__PURE__ */ new Set(["low", "medium", "high", "max"]);
 const R5DCTL_PACKAGE_NAME = "@ricsam/r5dctl";
@@ -149,6 +146,9 @@ const PS_HELP_TEXT = [
 const K8S_HELP_TEXT = [
   "Usage:",
   "  r5dctl k8s usage [--namespace <name>] [--workload <name|namespace/name|uid>] [--container <name>] [--window <24h|7d>]",
+  "  r5dctl vcluster trusted-workflow add --repo <owner/repository> --workflow <.github/workflows/file.yml>",
+  "  r5dctl vcluster trusted-workflow list",
+  "  r5dctl vcluster trusted-workflow remove <workflow-id>",
   "",
   "Show current and rolling CPU and memory usage for managed-vCluster workload containers.",
   ""
@@ -165,16 +165,6 @@ const SESSION_RUN_HELP_TEXT = [
   "Use -f/--follow/--watch to attach after a start; Ctrl-C detaches without stopping the session.",
   ""
 ].join("\n");
-const MERGE_HELP_TEXT = [
-  "Usage:",
-  "  r5dctl -p <project> merge [--worker <label>] [--create-conflict-worktree|--launch-conflict-resolution-agent] [--no-wait] <source-worktree>",
-  "  r5dctl -p <project> merge status <attempt-id>",
-  '  r5dctl -p <project> merge finish --worker <label> [--summary "<summary>"] <conflict-worktree>',
-  "",
-  "Merge a managed worktree into its recorded parent worktree.",
-  "Conflict worktrees provision in the background; merge waits by default and --no-wait returns the attempt immediately.",
-  ""
-].join("\n");
 const SHARED_HELP_ENTRIES = [
   { section: "auth", usage: "auth status", description: "Show the current authenticated user and credential source." },
   { section: "auth", usage: "auth logout", description: "Revoke the current credential and clear saved auth." },
@@ -185,16 +175,16 @@ const SHARED_HELP_ENTRIES = [
   },
   { section: "auth", usage: "auth api-key list", description: "List API keys for the current account." },
   { section: "auth", usage: "auth api-key revoke <key-id>", description: "Revoke an API key." },
-  { section: "workspace", usage: "workspace status", description: "Inspect the per-user canonical workspace and active remediation." },
+  { section: "workspace", usage: "workspace status", description: "Inspect per-user workspace Git state and active remediation." },
   {
     section: "workspace",
     usage: "workspace sync [--worker <label>]",
-    description: "Publish a connected worker into the canonical workspace now."
+    description: "Commit, rebase, and push a connected worker's workspace now."
   },
   {
     section: "workspace",
     usage: "workspace reset [--worker <label>] --confirm",
-    description: "Destructively discard a blocked remediation candidate and restore canonical state."
+    description: "Destructively discard a blocked local workspace commit and restore origin/main."
   },
   { section: "projects", usage: "get projects", description: "List projects you can access." },
   { section: "projects", usage: "describe project <namespace/name|id>", description: "Show details for a project." },
@@ -305,6 +295,17 @@ const SHARED_HELP_ENTRIES = [
     usage: "k8s usage [--namespace <name>] [--workload <name|namespace/name|uid>] [--container <name>] [--window <24h|7d>]",
     description: "Show current and rolling CPU and memory usage for managed-vCluster workload containers."
   },
+  {
+    section: "kubernetes",
+    usage: "vcluster trusted-workflow add --repo <owner/repository> --workflow <.github/workflows/file.yml>",
+    description: "Trust an exact GitHub Actions workflow path to authenticate kubectl against your managed vCluster."
+  },
+  { section: "kubernetes", usage: "vcluster trusted-workflow list", description: "List trusted GitHub Actions workflows." },
+  {
+    section: "kubernetes",
+    usage: "vcluster trusted-workflow remove <workflow-id>",
+    description: "Revoke a trusted GitHub Actions workflow and its outstanding credentials."
+  },
   {
     section: "processes",
     usage: "ps list [--worker <label>]",
@@ -320,22 +321,7 @@ const SHARED_HELP_ENTRIES = [
     usage: "ps inspect <run-id>",
     description: "Inspect process metadata and bounded stdout/stderr tails."
   },
-  { section: "processes", usage: "ps stop <run-id>", description: "Gracefully stop an active process with SIGTERM." },
-  {
-    section: "merge",
-    usage: "-p <project> merge [--worker <label>] [--create-conflict-worktree|--launch-conflict-resolution-agent] [--no-wait] <source-worktree>",
-    description: "Merge a worktree into its recorded parent, with an explicit conflict strategy."
-  },
-  {
-    section: "merge",
-    usage: "-p <project> merge status <attempt-id>",
-    description: "Show a merge attempt's provisioning and resolution status."
-  },
-  {
-    section: "merge",
-    usage: '-p <project> merge finish --worker <label> [--summary "<summary>"] <conflict-worktree>',
-    description: "Publish and finish a manually resolved conflict worktree."
-  }
+  { section: "processes", usage: "ps stop <run-id>", description: "Gracefully stop an active process with SIGTERM." }
 ];
 const HELP_SECTION_ORDER = [
   "auth",
@@ -346,8 +332,7 @@ const HELP_SECTION_ORDER = [
   "sessions",
   "kubernetes",
   "processes",
-  "shell",
-  "merge"
+  "shell"
 ];
 const HELP_SECTION_TITLES = {
   auth: "Auth",
@@ -358,8 +343,7 @@ const HELP_SECTION_TITLES = {
   sessions: "Sessions",
   kubernetes: "Kubernetes",
   processes: "Processes",
-  shell: "Shell",
-  merge: "Worktree merging"
+  shell: "Shell"
 };
 function getCliHelpText() {
   const entries = [...CLI_ONLY_HELP_ENTRIES, ...SHARED_HELP_ENTRIES];
@@ -637,56 +621,6 @@ function parseSessionRunCommand(options, args) {
   }
   throw new Error(`Unknown session command: ${subcommand}`);
 }
-function parseMergeCommand(options, args) {
-  const project = requireValue(options.project, "--project/-p is required for `merge`");
-  if (options.branch) throw new Error("--branch/-b is not supported for `merge`; pass the source worktree explicitly");
-  if (options.session) throw new Error("--session/-s is not supported for `merge`");
-  if (args[0] === "finish") {
-    const parsed2 = parseCommandOperands(args.slice(1), /* @__PURE__ */ new Set(["--worker", "--summary"]), /* @__PURE__ */ new Map(), "merge finish");
-    const conflictWorktree = requireValue(parsed2.positionals[0], "Conflict worktree is required for `merge finish`");
-    if (parsed2.positionals.length > 1) throw new Error(`Unexpected merge finish argument: ${parsed2.positionals[1]}`);
-    return {
-      kind: "finish",
-      project,
-      conflictWorktree,
-      worker: requireWorker(parsed2.values),
-      ...parsed2.values.get("--summary")?.trim() ? { summary: parsed2.values.get("--summary").trim() } : {}
-    };
-  }
-  if (args[0] === "status") {
-    const parsed2 = parseCommandOperands(args.slice(1), /* @__PURE__ */ new Set(), /* @__PURE__ */ new Map(), "merge status");
-    const attemptId = requireValue(parsed2.positionals[0], "Attempt id is required for `merge status`");
-    if (parsed2.positionals.length > 1) throw new Error(`Unexpected merge status argument: ${parsed2.positionals[1]}`);
-    return { kind: "status", project, attemptId };
-  }
-  const parsed = parseCommandOperands(
-    args,
-    /* @__PURE__ */ new Set(["--worker"]),
-    /* @__PURE__ */ new Map([
-      ["--create-conflict-worktree", "--create-conflict-worktree"],
-      ["--launch-conflict-resolution-agent", "--launch-conflict-resolution-agent"],
-      ["--no-wait", "--no-wait"]
-    ]),
-    "merge"
-  );
-  const sourceWorktree = requireValue(parsed.positionals[0], "Source worktree is required for `merge`");
-  if (parsed.positionals.length > 1) throw new Error(`Unexpected merge argument: ${parsed.positionals[1]}`);
-  const createWorktree = parsed.booleans.has("--create-conflict-worktree");
-  const launchAgent = parsed.booleans.has("--launch-conflict-resolution-agent");
-  if (createWorktree && launchAgent) {
-    throw new Error("Use only one of --create-conflict-worktree or --launch-conflict-resolution-agent");
-  }
-  const conflictMode = createWorktree ? "worktree" : launchAgent ? "agent" : "none";
-  const worker = parsed.values.get("--worker")?.trim();
-  return {
-    kind: "merge",
-    project,
-    sourceWorktree,
-    conflictMode,
-    ...worker ? { worker } : {},
-    ...parsed.booleans.has("--no-wait") ? { noWait: true } : {}
-  };
-}
 function assertAuthLoginArgs(args) {
   const valueFlags = /* @__PURE__ */ new Set(["--device-name", "--worker-label"]);
   const booleanFlags = /* @__PURE__ */ new Set(["--no-open", "--no-qr"]);
@@ -1513,16 +1447,15 @@ function renderWorkspaceStatus(status) {
     `Workspace HEAD: ${status.head ?? "(not initialized)"}`,
     `Latest sync: ${status.latestSync ? `${status.latestSync.outcome} on ${status.latestSync.workerLabel}` : "(none)"}`,
     `Remediation: ${status.incident ? `${status.incident.kind} ${status.incident.status} (${status.incident.id}) on ${status.incident.originWorkerLabel}` : "none"}`,
-    `Materialization: ${status.materialization ? `${status.materialization.state}; ${status.materialization.materializedHead ?? "(none)"} -> ${status.materialization.desiredHead ?? "(none)"}; lag ${status.materialization.lagMs}ms` : "not initialized"}`,
     ...status.workers.map(
-      (worker) => `Worker ${worker.workerLabel}: ${worker.ready ? "ready" : "bootstrapping"}; publication ${worker.publicationState}; head ${worker.localHead ?? "(none)"}; desired ${worker.desiredCanonicalHead ?? "(none)"}; generations ${worker.publishedGeneration}/${worker.dirtyGeneration}; pending checkouts ${worker.pendingCheckouts.length}; CAS retries ${worker.casRetries}; fan-out lag ${worker.fanoutLagMs ?? "unknown"}ms`
+      (worker) => `Worker ${worker.workerLabel}: ${worker.configured ? "configured" : "configuring"}; head ${worker.localHead ?? "(none)"}; pending checkouts ${worker.pendingCheckouts.length}`
     )
   ];
   return `${lines.join("\n")}
 `;
 }
 function renderWorkspaceSync(result) {
-  const head = result.publishedHead ?? result.candidateHead ?? result.startingHead ?? "(none)";
+  const head = result.publishedHead ?? result.localHead ?? result.startingHead ?? "(none)";
   const discarded = result.discardedPaths.length > 0 ? `
 Discarded paths: ${result.discardedPaths.join(", ")}` : "";
   const error = result.error ? `
@@ -1898,30 +1831,6 @@ function formatStatusValue(value) {
   }
   return value === void 0 || value === null ? void 0 : String(value);
 }
-function appendMergeDetails(lines, merge) {
-  const mergeStatus = formatStatusValue(merge.status);
-  lines.push(`Merge: ${mergeStatus ?? "pending"}`);
-  for (const [label, key] of [
-    ["Attempt", "attemptId"],
-    ["Source worktree", "sourceWorktree"],
-    ["Target worktree", "targetWorktree"],
-    ["Commit", "commitHash"],
-    ["Resolver agent", "resolverSessionId"],
-    ["Conflict worktree", "conflictWorktree"],
-    ["Resolver worktree", "folderPath"]
-  ]) {
-    const value = responseString(merge, key);
-    if (value) lines.push(`${label}: ${value}`);
-  }
-  const conflictedFiles = Array.isArray(merge.conflictedFiles) ? merge.conflictedFiles.filter((file) => typeof file === "string") : [];
-  if (conflictedFiles.length > 0) {
-    lines.push("", "Conflicts:", ...conflictedFiles.map((file) => `- ${file}`));
-  }
-  const message = responseString(merge, "message");
-  if (message) lines.push("", message);
-  const failureReason = responseString(merge, "failureReason");
-  if (failureReason) lines.push(`Failure: ${failureReason}`);
-}
 function renderSessionRunStart(session) {
   const lines = [
     `Session: ${responseString(session, "sessionId") ?? "(unknown)"}`,
@@ -1970,28 +1879,6 @@ function renderSessionRunStatus(session) {
   return `${lines.join("\n")}
 `;
 }
-function renderWorktreeMerge(result, input) {
-  const lines = [];
-  appendMergeDetails(lines, result);
-  const status = responseString(result, "status");
-  const conflictWorktree = responseString(result, "conflictWorktree");
-  const resolverSessionId = responseString(result, "resolverSessionId");
-  const attemptId = responseString(result, "attemptId");
-  const worker = responseString(result, "worker") ?? input.worker;
-  if (resolverSessionId) lines.push("", `Resolver session: ${resolverSessionId}`, `  r5dctl session stop ${resolverSessionId}`);
-  if (conflictWorktree && worker && ["conflicts", "conflict_worktree_created", "resolving"].includes(status ?? "")) {
-    lines.push(
-      "",
-      "Finish after resolving and reviewing the conflict worktree:",
-      `  r5dctl -p ${input.project} merge finish --worker ${worker} ${conflictWorktree} --summary "<summary>"`
-    );
-  }
-  if (attemptId && (status === "provisioning" || status === "resolving" && result.resolverAgentRunning === false)) {
-    lines.push("", "Check progress:", `  r5dctl -p ${input.project} merge status ${attemptId}`);
-  }
-  return `${lines.join("\n")}
-`;
-}
 async function dispatchSessionRunCommand(client, command) {
   if (command.kind === "start") {
     const commonInput = {
@@ -2028,70 +1915,16 @@ async function dispatchSessionRunCommand(client, command) {
   const data = await client.sessions.stop(command.sessionId);
   return { data, human: renderSessionRunStatus(data) };
 }
-const MERGE_POLL_INTERVAL_MS = 2e3;
-const MERGE_POLL_TIMEOUT_MS = 20 * 6e4;
-const MERGE_POLL_MAX_CONSECUTIVE_FAILURES = 5;
-function isMergeAttemptSettled(response) {
-  const status = responseString(response, "status");
-  if (!status) return true;
-  if (status === "resolving") return response.resolverAgentRunning !== false;
-  return status !== "provisioning";
-}
-async function pollMergeAttemptUntilSettled(client, project, attemptId, initial, options) {
-  const intervalMs = options.pollIntervalMs ?? MERGE_POLL_INTERVAL_MS;
-  const timeoutMs = options.pollTimeoutMs ?? MERGE_POLL_TIMEOUT_MS;
-  const sleep2 = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
-  const onProgress = options.onProgress ?? (() => {
-  });
-  let latest = initial;
-  let worktreeReadyReported = latest.worktreeReady === true;
-  let consecutiveFailures = 0;
-  let waitedMs = 0;
-  while (!isMergeAttemptSettled(latest)) {
-    if (waitedMs >= timeoutMs) {
-      onProgress(`Still waiting after ${Math.round(timeoutMs / 6e4)} minutes; check later with: r5dctl -p ${project} merge status ${attemptId}`);
-      return latest;
-    }
-    await sleep2(intervalMs);
-    waitedMs += intervalMs;
-    try {
-      latest = await client.projects.worktrees.mergeAttempt(project, attemptId);
-      consecutiveFailures = 0;
-    } catch (error) {
-      consecutiveFailures += 1;
-      if (consecutiveFailures >= MERGE_POLL_MAX_CONSECUTIVE_FAILURES) throw error;
-      continue;
-    }
-    if (!worktreeReadyReported && latest.worktreeReady === true) {
-      worktreeReadyReported = true;
-      onProgress("Conflict worktree ready.");
-    }
-  }
-  return latest;
-}
-async function dispatchMergeCommand(client, command, pollOptions = {}) {
-  if (command.kind === "merge") {
-    const data2 = await client.projects.worktrees.merge(command.project, command.sourceWorktree, {
-      conflictMode: command.conflictMode,
-      ...command.worker ? { worker: command.worker } : {}
-    });
-    const attemptId = responseString(data2, "attemptId");
-    if (command.noWait || !attemptId || isMergeAttemptSettled(data2)) {
-      return { data: data2, human: renderWorktreeMerge(data2, command) };
-    }
-    pollOptions.onProgress?.(`Provisioning the conflict worktree (attempt ${attemptId})...`);
-    const settled = await pollMergeAttemptUntilSettled(client, command.project, attemptId, data2, pollOptions);
-    return { data: settled, human: renderWorktreeMerge(settled, command) };
-  }
-  if (command.kind === "status") {
-    const data2 = await client.projects.worktrees.mergeAttempt(command.project, command.attemptId);
-    return { data: data2, human: renderWorktreeMerge(data2, { project: command.project }) };
+async function waitForSessionProvisioning(client, initial, options = {}) {
+  const sessionId = requireValue(responseString(initial, "sessionId"), "Session start did not return a session id");
+  const wait = options.wait ?? import_promises.setTimeout;
+  const intervalMs = options.intervalMs ?? 500;
+  let current = initial;
+  while (formatStatusValue(current.status) === "provisioning") {
+    await wait(intervalMs);
+    current = await client.sessions.status(sessionId);
   }
-  const data = await client.projects.worktrees.finishMerge(command.project, command.conflictWorktree, {
-    worker: command.worker,
-    ...command.summary ? { summary: command.summary } : {}
-  });
-  return { data, human: renderWorktreeMerge(data, command) };
+  return current;
 }
 function parseProjectUpdateArgs(args) {
   const input = {};
@@ -2642,6 +2475,40 @@ async function executeR5dctlCommand(client, json, args) {
     write(report, renderK8sUsageReport(report));
     return;
   }
+  if (first === "vcluster" && second === "trusted-workflow") {
+    const subcommand = requireValue(args[2], "Missing trusted-workflow command");
+    if (subcommand === "add") {
+      const parsed = parseCommandOperands(args.slice(3), /* @__PURE__ */ new Set(["--repo", "--workflow"]), /* @__PURE__ */ new Map(), "trusted-workflow add");
+      if (parsed.positionals.length > 0) throw new Error(`Unexpected trusted-workflow add value: ${parsed.positionals[0]}`);
+      const workflow = await client.k8s.trustedWorkflows.add({
+        repository: requireValue(parsed.values.get("--repo"), "--repo <owner/repository> is required"),
+        workflowPath: requireValue(parsed.values.get("--workflow"), "--workflow <path> is required")
+      });
+      write(workflow, "Trusted GitHub workflow configured successfully.\n");
+      return;
+    }
+    if (subcommand === "list") {
+      if (args.length > 3) throw new Error(`Unexpected trusted-workflow list value: ${args[3]}`);
+      const workflows = await client.k8s.trustedWorkflows.list();
+      write(
+        workflows,
+        workflows.length === 0 ? "No trusted GitHub workflows.\n" : `${workflows.map(
+          (workflow) => `${workflow.id}  ${workflow.repository}  ${workflow.workflowPath}  ${workflow.revokedAt ? "revoked" : "active"}`
+        ).join("\n")}
+`
+      );
+      return;
+    }
+    if (subcommand === "remove") {
+      const workflowId = requireValue(args[3], "Missing trusted workflow id");
+      if (args.length > 4) throw new Error(`Unexpected trusted-workflow remove value: ${args[4]}`);
+      const result = await client.k8s.trustedWorkflows.revoke(workflowId);
+      if (!result.success) throw new Error("Trusted GitHub workflow was not found or was already revoked");
+      write(result, "Trusted GitHub workflow revoked.\n");
+      return;
+    }
+    throw new Error(`Unknown trusted-workflow command: ${subcommand}`);
+  }
   if (first === "ps" && second === "list") {
     const processes = await client.processes.list(parsePsListArgs(args.slice(2)));
     write(processes, renderProcessList(processes));
@@ -2875,12 +2742,6 @@ function resolveCommandExecution(options, rest) {
       text: SESSION_RUN_HELP_TEXT
     };
   }
-  if (command === "merge" && commandArgs.length === 0) {
-    return {
-      kind: "cli-help",
-      text: MERGE_HELP_TEXT
-    };
-  }
   if (trailingHelp) {
     const cliOnlyHelp = findCliOnlyCommandHelp(normalizedRest);
     if (cliOnlyHelp) {
@@ -3011,12 +2872,23 @@ function resolveCommandExecution(options, rest) {
   }
   if (command === "k8s") {
     const subcommand = commandArgs[0];
-    if (subcommand !== "usage") throw new Error(`Unknown k8s command: ${subcommand ?? ""}`.trim());
     if (options.project || options.branch || options.session) {
-      throw new Error("Project, branch, and session scopes are not supported for `k8s usage`");
+      throw new Error("Project, branch, and session scopes are not supported for `k8s`");
+    }
+    if (subcommand === "usage") {
+      parseK8sUsageArgs(commandArgs.slice(1));
+      return { kind: "plugin", pluginArgs: ["k8s", "usage", ...commandArgs.slice(1)] };
+    }
+    throw new Error(`Unknown k8s command: ${subcommand ?? ""}`.trim());
+  }
+  if (command === "vcluster") {
+    if (options.project || options.branch || options.session) {
+      throw new Error("Project, branch, and session scopes are not supported for `vcluster`");
+    }
+    if (commandArgs[0] !== "trusted-workflow") {
+      throw new Error(`Unknown vcluster command: ${commandArgs[0] ?? ""}`.trim());
     }
-    parseK8sUsageArgs(commandArgs.slice(1));
-    return { kind: "plugin", pluginArgs: ["k8s", "usage", ...commandArgs.slice(1)] };
+    return { kind: "plugin", pluginArgs: ["vcluster", "trusted-workflow", ...commandArgs.slice(1)] };
   }
   if (command === "get") {
     const target = commandArgs[0];
@@ -3268,9 +3140,6 @@ function resolveCommandExecution(options, rest) {
   if (command === "session") {
     return { kind: "session-run", command: parseSessionRunCommand(options, commandArgs) };
   }
-  if (command === "merge") {
-    return { kind: "merge", command: parseMergeCommand(options, commandArgs) };
-  }
   if (command === "answer-questions") {
     const sessionId = options.session;
     if (!sessionId) {
@@ -3332,7 +3201,7 @@ async function runCommand(argv) {
   if (execution.kind === "session-run") {
     if (!options.json) {
       if (execution.command.kind === "start") {
-        process.stderr.write("Starting session (publishing the workspace and provisioning the worktree)...\n");
+        process.stderr.write("Starting session...\n");
       } else if (execution.command.kind === "stop") {
         process.stderr.write(`Stopping session ${execution.command.sessionId}...
 `);
@@ -3347,28 +3216,20 @@ async function runCommand(argv) {
     if (options.json) process.stdout.write(`${JSON.stringify({ type: "session_started", data: result.data })}
 `);
     else process.stderr.write(result.human);
+    const ready = await waitForSessionProvisioning(client, result.data);
+    const readyStatus = formatStatusValue(ready.status);
+    if (readyStatus === "failed" || readyStatus === "stopped") {
+      if (options.json) process.stdout.write(`${JSON.stringify({ type: "session_status", data: ready })}
+`);
+      else process.stderr.write(renderSessionRunStatus(ready));
+      return readyStatus === "failed" ? 1 : 0;
+    }
     return await followWithInterrupt(client, sessionId, {
       json: options.json,
       includeTools: execution.command.includeTools,
       printInitialTranscript: false
     });
   }
-  if (execution.kind === "merge") {
-    if (!options.json) {
-      if (execution.command.kind === "merge") {
-        process.stderr.write("Merging (publishing the workspace and computing the merge)...\n");
-      } else if (execution.command.kind === "finish") {
-        process.stderr.write(`Finalizing ${execution.command.conflictWorktree} (publishing the resolver workspace)...
-`);
-      }
-    }
-    const result = await dispatchMergeCommand(client, execution.command, {
-      ...options.json ? {} : { onProgress: (line) => process.stderr.write(`${line}
-`) }
-    });
-    writeDataOutput(options.json, result.data, result.human);
-    return 0;
-  }
   if (execution.kind === "conversation-follow") {
     const { follow: _follow, ...renderOptions } = execution.renderOptions;
     const initialConversation = await client.sessions.conversation(execution.sessionId, renderOptions);
@@ -3429,7 +3290,6 @@ async function main(argv = process.argv.slice(2)) {
 0 && (module.exports = {
   advanceTransientDevicePollBackoff,
   collectK8sUsage,
-  dispatchMergeCommand,
   dispatchSessionRunCommand,
   followR5dctlSession,
   formatK8sCpu,
@@ -3441,7 +3301,6 @@ async function main(argv = process.argv.slice(2)) {
   getR5dctlVersion,
   getTransientDevicePollDelay,
   handleAuthLogin,
-  isMergeAttemptSettled,
   main,
   parseAnswerEnvRequestCommandArgs,
   parseAnswerFlags,
@@ -3455,7 +3314,6 @@ async function main(argv = process.argv.slice(2)) {
   parseGetEnvsArgs,
   parseGlobalArgs,
   parseK8sUsageArgs,
-  parseMergeCommand,
   parsePromptArgs,
   parsePsHistoryArgs,
   parsePsListArgs,
@@ -3479,9 +3337,9 @@ async function main(argv = process.argv.slice(2)) {
   renderSessionRunStatus,
   renderWorkspaceStatus,
   renderWorkspaceSync,
-  renderWorktreeMerge,
   resolveCommandExecution,
   runR5dctlCli,
   summarizeEnvData,
+  waitForSessionProvisioning,
   writeConfig
 });

package/dist/cjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5dctl",
-  "version": "0.0.73",
+  "version": "0.0.75",
   "type": "commonjs"
 }

package/dist/mjs/cli.mjs

@@ -11,7 +11,7 @@ import {
   R5dctlClient
 } from "@ricsam/r5d-api";
 import { runR5dctlShell } from "./shell.mjs";
-const CHAT_MODES = /* @__PURE__ */ new Set(["ask", "plan", "agent", "large_diff_remediation", "merge_conflict_resolution"]);
+const CHAT_MODES = /* @__PURE__ */ new Set(["ask", "plan", "agent", "large_diff_remediation"]);
 const R5DCTL_SESSION_MODES = /* @__PURE__ */ new Set(["ask", "plan", "agent"]);
 const MODEL_TIERS = /* @__PURE__ */ new Set(["low", "medium", "high", "max"]);
 const R5DCTL_PACKAGE_NAME = "@ricsam/r5dctl";
@@ -63,6 +63,9 @@ const PS_HELP_TEXT = [
 const K8S_HELP_TEXT = [
   "Usage:",
   "  r5dctl k8s usage [--namespace <name>] [--workload <name|namespace/name|uid>] [--container <name>] [--window <24h|7d>]",
+  "  r5dctl vcluster trusted-workflow add --repo <owner/repository> --workflow <.github/workflows/file.yml>",
+  "  r5dctl vcluster trusted-workflow list",
+  "  r5dctl vcluster trusted-workflow remove <workflow-id>",
   "",
   "Show current and rolling CPU and memory usage for managed-vCluster workload containers.",
   ""
@@ -79,16 +82,6 @@ const SESSION_RUN_HELP_TEXT = [
   "Use -f/--follow/--watch to attach after a start; Ctrl-C detaches without stopping the session.",
   ""
 ].join("\n");
-const MERGE_HELP_TEXT = [
-  "Usage:",
-  "  r5dctl -p <project> merge [--worker <label>] [--create-conflict-worktree|--launch-conflict-resolution-agent] [--no-wait] <source-worktree>",
-  "  r5dctl -p <project> merge status <attempt-id>",
-  '  r5dctl -p <project> merge finish --worker <label> [--summary "<summary>"] <conflict-worktree>',
-  "",
-  "Merge a managed worktree into its recorded parent worktree.",
-  "Conflict worktrees provision in the background; merge waits by default and --no-wait returns the attempt immediately.",
-  ""
-].join("\n");
 const SHARED_HELP_ENTRIES = [
   { section: "auth", usage: "auth status", description: "Show the current authenticated user and credential source." },
   { section: "auth", usage: "auth logout", description: "Revoke the current credential and clear saved auth." },
@@ -99,16 +92,16 @@ const SHARED_HELP_ENTRIES = [
   },
   { section: "auth", usage: "auth api-key list", description: "List API keys for the current account." },
   { section: "auth", usage: "auth api-key revoke <key-id>", description: "Revoke an API key." },
-  { section: "workspace", usage: "workspace status", description: "Inspect the per-user canonical workspace and active remediation." },
+  { section: "workspace", usage: "workspace status", description: "Inspect per-user workspace Git state and active remediation." },
   {
     section: "workspace",
     usage: "workspace sync [--worker <label>]",
-    description: "Publish a connected worker into the canonical workspace now."
+    description: "Commit, rebase, and push a connected worker's workspace now."
   },
   {
     section: "workspace",
     usage: "workspace reset [--worker <label>] --confirm",
-    description: "Destructively discard a blocked remediation candidate and restore canonical state."
+    description: "Destructively discard a blocked local workspace commit and restore origin/main."
   },
   { section: "projects", usage: "get projects", description: "List projects you can access." },
   { section: "projects", usage: "describe project <namespace/name|id>", description: "Show details for a project." },
@@ -219,6 +212,17 @@ const SHARED_HELP_ENTRIES = [
     usage: "k8s usage [--namespace <name>] [--workload <name|namespace/name|uid>] [--container <name>] [--window <24h|7d>]",
     description: "Show current and rolling CPU and memory usage for managed-vCluster workload containers."
   },
+  {
+    section: "kubernetes",
+    usage: "vcluster trusted-workflow add --repo <owner/repository> --workflow <.github/workflows/file.yml>",
+    description: "Trust an exact GitHub Actions workflow path to authenticate kubectl against your managed vCluster."
+  },
+  { section: "kubernetes", usage: "vcluster trusted-workflow list", description: "List trusted GitHub Actions workflows." },
+  {
+    section: "kubernetes",
+    usage: "vcluster trusted-workflow remove <workflow-id>",
+    description: "Revoke a trusted GitHub Actions workflow and its outstanding credentials."
+  },
   {
     section: "processes",
     usage: "ps list [--worker <label>]",
@@ -234,22 +238,7 @@ const SHARED_HELP_ENTRIES = [
     usage: "ps inspect <run-id>",
     description: "Inspect process metadata and bounded stdout/stderr tails."
   },
-  { section: "processes", usage: "ps stop <run-id>", description: "Gracefully stop an active process with SIGTERM." },
-  {
-    section: "merge",
-    usage: "-p <project> merge [--worker <label>] [--create-conflict-worktree|--launch-conflict-resolution-agent] [--no-wait] <source-worktree>",
-    description: "Merge a worktree into its recorded parent, with an explicit conflict strategy."
-  },
-  {
-    section: "merge",
-    usage: "-p <project> merge status <attempt-id>",
-    description: "Show a merge attempt's provisioning and resolution status."
-  },
-  {
-    section: "merge",
-    usage: '-p <project> merge finish --worker <label> [--summary "<summary>"] <conflict-worktree>',
-    description: "Publish and finish a manually resolved conflict worktree."
-  }
+  { section: "processes", usage: "ps stop <run-id>", description: "Gracefully stop an active process with SIGTERM." }
 ];
 const HELP_SECTION_ORDER = [
   "auth",
@@ -260,8 +249,7 @@ const HELP_SECTION_ORDER = [
   "sessions",
   "kubernetes",
   "processes",
-  "shell",
-  "merge"
+  "shell"
 ];
 const HELP_SECTION_TITLES = {
   auth: "Auth",
@@ -272,8 +260,7 @@ const HELP_SECTION_TITLES = {
   sessions: "Sessions",
   kubernetes: "Kubernetes",
   processes: "Processes",
-  shell: "Shell",
-  merge: "Worktree merging"
+  shell: "Shell"
 };
 function getCliHelpText() {
   const entries = [...CLI_ONLY_HELP_ENTRIES, ...SHARED_HELP_ENTRIES];
@@ -551,56 +538,6 @@ function parseSessionRunCommand(options, args) {
   }
   throw new Error(`Unknown session command: ${subcommand}`);
 }
-function parseMergeCommand(options, args) {
-  const project = requireValue(options.project, "--project/-p is required for `merge`");
-  if (options.branch) throw new Error("--branch/-b is not supported for `merge`; pass the source worktree explicitly");
-  if (options.session) throw new Error("--session/-s is not supported for `merge`");
-  if (args[0] === "finish") {
-    const parsed2 = parseCommandOperands(args.slice(1), /* @__PURE__ */ new Set(["--worker", "--summary"]), /* @__PURE__ */ new Map(), "merge finish");
-    const conflictWorktree = requireValue(parsed2.positionals[0], "Conflict worktree is required for `merge finish`");
-    if (parsed2.positionals.length > 1) throw new Error(`Unexpected merge finish argument: ${parsed2.positionals[1]}`);
-    return {
-      kind: "finish",
-      project,
-      conflictWorktree,
-      worker: requireWorker(parsed2.values),
-      ...parsed2.values.get("--summary")?.trim() ? { summary: parsed2.values.get("--summary").trim() } : {}
-    };
-  }
-  if (args[0] === "status") {
-    const parsed2 = parseCommandOperands(args.slice(1), /* @__PURE__ */ new Set(), /* @__PURE__ */ new Map(), "merge status");
-    const attemptId = requireValue(parsed2.positionals[0], "Attempt id is required for `merge status`");
-    if (parsed2.positionals.length > 1) throw new Error(`Unexpected merge status argument: ${parsed2.positionals[1]}`);
-    return { kind: "status", project, attemptId };
-  }
-  const parsed = parseCommandOperands(
-    args,
-    /* @__PURE__ */ new Set(["--worker"]),
-    /* @__PURE__ */ new Map([
-      ["--create-conflict-worktree", "--create-conflict-worktree"],
-      ["--launch-conflict-resolution-agent", "--launch-conflict-resolution-agent"],
-      ["--no-wait", "--no-wait"]
-    ]),
-    "merge"
-  );
-  const sourceWorktree = requireValue(parsed.positionals[0], "Source worktree is required for `merge`");
-  if (parsed.positionals.length > 1) throw new Error(`Unexpected merge argument: ${parsed.positionals[1]}`);
-  const createWorktree = parsed.booleans.has("--create-conflict-worktree");
-  const launchAgent = parsed.booleans.has("--launch-conflict-resolution-agent");
-  if (createWorktree && launchAgent) {
-    throw new Error("Use only one of --create-conflict-worktree or --launch-conflict-resolution-agent");
-  }
-  const conflictMode = createWorktree ? "worktree" : launchAgent ? "agent" : "none";
-  const worker = parsed.values.get("--worker")?.trim();
-  return {
-    kind: "merge",
-    project,
-    sourceWorktree,
-    conflictMode,
-    ...worker ? { worker } : {},
-    ...parsed.booleans.has("--no-wait") ? { noWait: true } : {}
-  };
-}
 function assertAuthLoginArgs(args) {
   const valueFlags = /* @__PURE__ */ new Set(["--device-name", "--worker-label"]);
   const booleanFlags = /* @__PURE__ */ new Set(["--no-open", "--no-qr"]);
@@ -1427,16 +1364,15 @@ function renderWorkspaceStatus(status) {
     `Workspace HEAD: ${status.head ?? "(not initialized)"}`,
     `Latest sync: ${status.latestSync ? `${status.latestSync.outcome} on ${status.latestSync.workerLabel}` : "(none)"}`,
     `Remediation: ${status.incident ? `${status.incident.kind} ${status.incident.status} (${status.incident.id}) on ${status.incident.originWorkerLabel}` : "none"}`,
-    `Materialization: ${status.materialization ? `${status.materialization.state}; ${status.materialization.materializedHead ?? "(none)"} -> ${status.materialization.desiredHead ?? "(none)"}; lag ${status.materialization.lagMs}ms` : "not initialized"}`,
     ...status.workers.map(
-      (worker) => `Worker ${worker.workerLabel}: ${worker.ready ? "ready" : "bootstrapping"}; publication ${worker.publicationState}; head ${worker.localHead ?? "(none)"}; desired ${worker.desiredCanonicalHead ?? "(none)"}; generations ${worker.publishedGeneration}/${worker.dirtyGeneration}; pending checkouts ${worker.pendingCheckouts.length}; CAS retries ${worker.casRetries}; fan-out lag ${worker.fanoutLagMs ?? "unknown"}ms`
+      (worker) => `Worker ${worker.workerLabel}: ${worker.configured ? "configured" : "configuring"}; head ${worker.localHead ?? "(none)"}; pending checkouts ${worker.pendingCheckouts.length}`
     )
   ];
   return `${lines.join("\n")}
 `;
 }
 function renderWorkspaceSync(result) {
-  const head = result.publishedHead ?? result.candidateHead ?? result.startingHead ?? "(none)";
+  const head = result.publishedHead ?? result.localHead ?? result.startingHead ?? "(none)";
   const discarded = result.discardedPaths.length > 0 ? `
 Discarded paths: ${result.discardedPaths.join(", ")}` : "";
   const error = result.error ? `
@@ -1812,30 +1748,6 @@ function formatStatusValue(value) {
   }
   return value === void 0 || value === null ? void 0 : String(value);
 }
-function appendMergeDetails(lines, merge) {
-  const mergeStatus = formatStatusValue(merge.status);
-  lines.push(`Merge: ${mergeStatus ?? "pending"}`);
-  for (const [label, key] of [
-    ["Attempt", "attemptId"],
-    ["Source worktree", "sourceWorktree"],
-    ["Target worktree", "targetWorktree"],
-    ["Commit", "commitHash"],
-    ["Resolver agent", "resolverSessionId"],
-    ["Conflict worktree", "conflictWorktree"],
-    ["Resolver worktree", "folderPath"]
-  ]) {
-    const value = responseString(merge, key);
-    if (value) lines.push(`${label}: ${value}`);
-  }
-  const conflictedFiles = Array.isArray(merge.conflictedFiles) ? merge.conflictedFiles.filter((file) => typeof file === "string") : [];
-  if (conflictedFiles.length > 0) {
-    lines.push("", "Conflicts:", ...conflictedFiles.map((file) => `- ${file}`));
-  }
-  const message = responseString(merge, "message");
-  if (message) lines.push("", message);
-  const failureReason = responseString(merge, "failureReason");
-  if (failureReason) lines.push(`Failure: ${failureReason}`);
-}
 function renderSessionRunStart(session) {
   const lines = [
     `Session: ${responseString(session, "sessionId") ?? "(unknown)"}`,
@@ -1884,28 +1796,6 @@ function renderSessionRunStatus(session) {
   return `${lines.join("\n")}
 `;
 }
-function renderWorktreeMerge(result, input) {
-  const lines = [];
-  appendMergeDetails(lines, result);
-  const status = responseString(result, "status");
-  const conflictWorktree = responseString(result, "conflictWorktree");
-  const resolverSessionId = responseString(result, "resolverSessionId");
-  const attemptId = responseString(result, "attemptId");
-  const worker = responseString(result, "worker") ?? input.worker;
-  if (resolverSessionId) lines.push("", `Resolver session: ${resolverSessionId}`, `  r5dctl session stop ${resolverSessionId}`);
-  if (conflictWorktree && worker && ["conflicts", "conflict_worktree_created", "resolving"].includes(status ?? "")) {
-    lines.push(
-      "",
-      "Finish after resolving and reviewing the conflict worktree:",
-      `  r5dctl -p ${input.project} merge finish --worker ${worker} ${conflictWorktree} --summary "<summary>"`
-    );
-  }
-  if (attemptId && (status === "provisioning" || status === "resolving" && result.resolverAgentRunning === false)) {
-    lines.push("", "Check progress:", `  r5dctl -p ${input.project} merge status ${attemptId}`);
-  }
-  return `${lines.join("\n")}
-`;
-}
 async function dispatchSessionRunCommand(client, command) {
   if (command.kind === "start") {
     const commonInput = {
@@ -1942,70 +1832,16 @@ async function dispatchSessionRunCommand(client, command) {
   const data = await client.sessions.stop(command.sessionId);
   return { data, human: renderSessionRunStatus(data) };
 }
-const MERGE_POLL_INTERVAL_MS = 2e3;
-const MERGE_POLL_TIMEOUT_MS = 20 * 6e4;
-const MERGE_POLL_MAX_CONSECUTIVE_FAILURES = 5;
-function isMergeAttemptSettled(response) {
-  const status = responseString(response, "status");
-  if (!status) return true;
-  if (status === "resolving") return response.resolverAgentRunning !== false;
-  return status !== "provisioning";
-}
-async function pollMergeAttemptUntilSettled(client, project, attemptId, initial, options) {
-  const intervalMs = options.pollIntervalMs ?? MERGE_POLL_INTERVAL_MS;
-  const timeoutMs = options.pollTimeoutMs ?? MERGE_POLL_TIMEOUT_MS;
-  const sleep2 = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
-  const onProgress = options.onProgress ?? (() => {
-  });
-  let latest = initial;
-  let worktreeReadyReported = latest.worktreeReady === true;
-  let consecutiveFailures = 0;
-  let waitedMs = 0;
-  while (!isMergeAttemptSettled(latest)) {
-    if (waitedMs >= timeoutMs) {
-      onProgress(`Still waiting after ${Math.round(timeoutMs / 6e4)} minutes; check later with: r5dctl -p ${project} merge status ${attemptId}`);
-      return latest;
-    }
-    await sleep2(intervalMs);
-    waitedMs += intervalMs;
-    try {
-      latest = await client.projects.worktrees.mergeAttempt(project, attemptId);
-      consecutiveFailures = 0;
-    } catch (error) {
-      consecutiveFailures += 1;
-      if (consecutiveFailures >= MERGE_POLL_MAX_CONSECUTIVE_FAILURES) throw error;
-      continue;
-    }
-    if (!worktreeReadyReported && latest.worktreeReady === true) {
-      worktreeReadyReported = true;
-      onProgress("Conflict worktree ready.");
-    }
-  }
-  return latest;
-}
-async function dispatchMergeCommand(client, command, pollOptions = {}) {
-  if (command.kind === "merge") {
-    const data2 = await client.projects.worktrees.merge(command.project, command.sourceWorktree, {
-      conflictMode: command.conflictMode,
-      ...command.worker ? { worker: command.worker } : {}
-    });
-    const attemptId = responseString(data2, "attemptId");
-    if (command.noWait || !attemptId || isMergeAttemptSettled(data2)) {
-      return { data: data2, human: renderWorktreeMerge(data2, command) };
-    }
-    pollOptions.onProgress?.(`Provisioning the conflict worktree (attempt ${attemptId})...`);
-    const settled = await pollMergeAttemptUntilSettled(client, command.project, attemptId, data2, pollOptions);
-    return { data: settled, human: renderWorktreeMerge(settled, command) };
-  }
-  if (command.kind === "status") {
-    const data2 = await client.projects.worktrees.mergeAttempt(command.project, command.attemptId);
-    return { data: data2, human: renderWorktreeMerge(data2, { project: command.project }) };
+async function waitForSessionProvisioning(client, initial, options = {}) {
+  const sessionId = requireValue(responseString(initial, "sessionId"), "Session start did not return a session id");
+  const wait = options.wait ?? sleep;
+  const intervalMs = options.intervalMs ?? 500;
+  let current = initial;
+  while (formatStatusValue(current.status) === "provisioning") {
+    await wait(intervalMs);
+    current = await client.sessions.status(sessionId);
   }
-  const data = await client.projects.worktrees.finishMerge(command.project, command.conflictWorktree, {
-    worker: command.worker,
-    ...command.summary ? { summary: command.summary } : {}
-  });
-  return { data, human: renderWorktreeMerge(data, command) };
+  return current;
 }
 function parseProjectUpdateArgs(args) {
   const input = {};
@@ -2556,6 +2392,40 @@ async function executeR5dctlCommand(client, json, args) {
     write(report, renderK8sUsageReport(report));
     return;
   }
+  if (first === "vcluster" && second === "trusted-workflow") {
+    const subcommand = requireValue(args[2], "Missing trusted-workflow command");
+    if (subcommand === "add") {
+      const parsed = parseCommandOperands(args.slice(3), /* @__PURE__ */ new Set(["--repo", "--workflow"]), /* @__PURE__ */ new Map(), "trusted-workflow add");
+      if (parsed.positionals.length > 0) throw new Error(`Unexpected trusted-workflow add value: ${parsed.positionals[0]}`);
+      const workflow = await client.k8s.trustedWorkflows.add({
+        repository: requireValue(parsed.values.get("--repo"), "--repo <owner/repository> is required"),
+        workflowPath: requireValue(parsed.values.get("--workflow"), "--workflow <path> is required")
+      });
+      write(workflow, "Trusted GitHub workflow configured successfully.\n");
+      return;
+    }
+    if (subcommand === "list") {
+      if (args.length > 3) throw new Error(`Unexpected trusted-workflow list value: ${args[3]}`);
+      const workflows = await client.k8s.trustedWorkflows.list();
+      write(
+        workflows,
+        workflows.length === 0 ? "No trusted GitHub workflows.\n" : `${workflows.map(
+          (workflow) => `${workflow.id}  ${workflow.repository}  ${workflow.workflowPath}  ${workflow.revokedAt ? "revoked" : "active"}`
+        ).join("\n")}
+`
+      );
+      return;
+    }
+    if (subcommand === "remove") {
+      const workflowId = requireValue(args[3], "Missing trusted workflow id");
+      if (args.length > 4) throw new Error(`Unexpected trusted-workflow remove value: ${args[4]}`);
+      const result = await client.k8s.trustedWorkflows.revoke(workflowId);
+      if (!result.success) throw new Error("Trusted GitHub workflow was not found or was already revoked");
+      write(result, "Trusted GitHub workflow revoked.\n");
+      return;
+    }
+    throw new Error(`Unknown trusted-workflow command: ${subcommand}`);
+  }
   if (first === "ps" && second === "list") {
     const processes = await client.processes.list(parsePsListArgs(args.slice(2)));
     write(processes, renderProcessList(processes));
@@ -2789,12 +2659,6 @@ function resolveCommandExecution(options, rest) {
       text: SESSION_RUN_HELP_TEXT
     };
   }
-  if (command === "merge" && commandArgs.length === 0) {
-    return {
-      kind: "cli-help",
-      text: MERGE_HELP_TEXT
-    };
-  }
   if (trailingHelp) {
     const cliOnlyHelp = findCliOnlyCommandHelp(normalizedRest);
     if (cliOnlyHelp) {
@@ -2925,12 +2789,23 @@ function resolveCommandExecution(options, rest) {
   }
   if (command === "k8s") {
     const subcommand = commandArgs[0];
-    if (subcommand !== "usage") throw new Error(`Unknown k8s command: ${subcommand ?? ""}`.trim());
     if (options.project || options.branch || options.session) {
-      throw new Error("Project, branch, and session scopes are not supported for `k8s usage`");
+      throw new Error("Project, branch, and session scopes are not supported for `k8s`");
+    }
+    if (subcommand === "usage") {
+      parseK8sUsageArgs(commandArgs.slice(1));
+      return { kind: "plugin", pluginArgs: ["k8s", "usage", ...commandArgs.slice(1)] };
+    }
+    throw new Error(`Unknown k8s command: ${subcommand ?? ""}`.trim());
+  }
+  if (command === "vcluster") {
+    if (options.project || options.branch || options.session) {
+      throw new Error("Project, branch, and session scopes are not supported for `vcluster`");
+    }
+    if (commandArgs[0] !== "trusted-workflow") {
+      throw new Error(`Unknown vcluster command: ${commandArgs[0] ?? ""}`.trim());
     }
-    parseK8sUsageArgs(commandArgs.slice(1));
-    return { kind: "plugin", pluginArgs: ["k8s", "usage", ...commandArgs.slice(1)] };
+    return { kind: "plugin", pluginArgs: ["vcluster", "trusted-workflow", ...commandArgs.slice(1)] };
   }
   if (command === "get") {
     const target = commandArgs[0];
@@ -3182,9 +3057,6 @@ function resolveCommandExecution(options, rest) {
   if (command === "session") {
     return { kind: "session-run", command: parseSessionRunCommand(options, commandArgs) };
   }
-  if (command === "merge") {
-    return { kind: "merge", command: parseMergeCommand(options, commandArgs) };
-  }
   if (command === "answer-questions") {
     const sessionId = options.session;
     if (!sessionId) {
@@ -3246,7 +3118,7 @@ async function runCommand(argv) {
   if (execution.kind === "session-run") {
     if (!options.json) {
       if (execution.command.kind === "start") {
-        process.stderr.write("Starting session (publishing the workspace and provisioning the worktree)...\n");
+        process.stderr.write("Starting session...\n");
       } else if (execution.command.kind === "stop") {
         process.stderr.write(`Stopping session ${execution.command.sessionId}...
 `);
@@ -3261,28 +3133,20 @@ async function runCommand(argv) {
     if (options.json) process.stdout.write(`${JSON.stringify({ type: "session_started", data: result.data })}
 `);
     else process.stderr.write(result.human);
+    const ready = await waitForSessionProvisioning(client, result.data);
+    const readyStatus = formatStatusValue(ready.status);
+    if (readyStatus === "failed" || readyStatus === "stopped") {
+      if (options.json) process.stdout.write(`${JSON.stringify({ type: "session_status", data: ready })}
+`);
+      else process.stderr.write(renderSessionRunStatus(ready));
+      return readyStatus === "failed" ? 1 : 0;
+    }
     return await followWithInterrupt(client, sessionId, {
       json: options.json,
       includeTools: execution.command.includeTools,
       printInitialTranscript: false
     });
   }
-  if (execution.kind === "merge") {
-    if (!options.json) {
-      if (execution.command.kind === "merge") {
-        process.stderr.write("Merging (publishing the workspace and computing the merge)...\n");
-      } else if (execution.command.kind === "finish") {
-        process.stderr.write(`Finalizing ${execution.command.conflictWorktree} (publishing the resolver workspace)...
-`);
-      }
-    }
-    const result = await dispatchMergeCommand(client, execution.command, {
-      ...options.json ? {} : { onProgress: (line) => process.stderr.write(`${line}
-`) }
-    });
-    writeDataOutput(options.json, result.data, result.human);
-    return 0;
-  }
   if (execution.kind === "conversation-follow") {
     const { follow: _follow, ...renderOptions } = execution.renderOptions;
     const initialConversation = await client.sessions.conversation(execution.sessionId, renderOptions);
@@ -3342,7 +3206,6 @@ async function main(argv = process.argv.slice(2)) {
 export {
   advanceTransientDevicePollBackoff,
   collectK8sUsage,
-  dispatchMergeCommand,
   dispatchSessionRunCommand,
   followR5dctlSession,
   formatK8sCpu,
@@ -3354,7 +3217,6 @@ export {
   getR5dctlVersion,
   getTransientDevicePollDelay,
   handleAuthLogin,
-  isMergeAttemptSettled,
   main,
   parseAnswerEnvRequestCommandArgs,
   parseAnswerFlags,
@@ -3368,7 +3230,6 @@ export {
   parseGetEnvsArgs,
   parseGlobalArgs,
   parseK8sUsageArgs,
-  parseMergeCommand,
   parsePromptArgs,
   parsePsHistoryArgs,
   parsePsListArgs,
@@ -3392,9 +3253,9 @@ export {
   renderSessionRunStatus,
   renderWorkspaceStatus,
   renderWorkspaceSync,
-  renderWorktreeMerge,
   resolveCommandExecution,
   runR5dctlCli,
   summarizeEnvData,
+  waitForSessionProvisioning,
   writeConfig
 };

package/dist/mjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5dctl",
-  "version": "0.0.73",
+  "version": "0.0.75",
   "type": "module"
 }

package/dist/types/cli.d.ts

@@ -1,4 +1,4 @@
-import { R5dctlClient, type R5dctlConversationForkResponse, type R5dctlConversationHeadResponse, type R5dctlConversationRenderOptions, type R5dctlConversationResponse, type R5dctlConversationNodeResponse, type R5dctlConversationOverviewResponse, type R5dctlConversationWorkDetail, type R5dctlConversationWorkResponse, type R5dctlEnvData, type R5dctlK8sResourceHistory, type R5dctlK8sUsage, type R5dctlK8sWorkload, type R5dctlProcessInspection, type R5dctlProcessListInput, type R5dctlProcessRun, type R5dctlSessionEvent, type R5dctlSessionStartInput, type R5dctlWorkspaceStatus, type R5dctlWorkspaceSyncResult, type R5dctlWorktreeSource, type R5dctlMergeConflictMode, type R5dctlSessionMode, type ChatMode, type ModelTier } from "@ricsam/r5d-api";
+import { R5dctlClient, type R5dctlConversationForkResponse, type R5dctlConversationHeadResponse, type R5dctlConversationRenderOptions, type R5dctlConversationResponse, type R5dctlConversationNodeResponse, type R5dctlConversationOverviewResponse, type R5dctlConversationWorkDetail, type R5dctlConversationWorkResponse, type R5dctlEnvData, type R5dctlK8sResourceHistory, type R5dctlK8sUsage, type R5dctlK8sWorkload, type R5dctlProcessInspection, type R5dctlProcessListInput, type R5dctlProcessRun, type R5dctlSessionEvent, type R5dctlSessionStartInput, type R5dctlWorkspaceStatus, type R5dctlWorkspaceSyncResult, type R5dctlWorktreeSource, type R5dctlSessionMode, type ChatMode, type ModelTier } from "@ricsam/r5d-api";
 export type GlobalOptions = {
     baseUrl?: string;
     json: boolean;
@@ -32,9 +32,6 @@ type CommandExecutionPlan = {
 } | {
     kind: "session-run";
     command: R5dctlSessionRunCommand;
-} | {
-    kind: "merge";
-    command: R5dctlMergeCommand;
 } | {
     kind: "conversation-follow";
     sessionId: string;
@@ -79,26 +76,7 @@ export type R5dctlSessionRunCommand = R5dctlSessionStartCommand | {
     kind: "stop";
     sessionId: string;
 };
-export type R5dctlMergeCommand = {
-    kind: "merge";
-    project: string;
-    sourceWorktree: string;
-    worker?: string;
-    conflictMode: R5dctlMergeConflictMode;
-    noWait?: boolean;
-} | {
-    kind: "status";
-    project: string;
-    attemptId: string;
-} | {
-    kind: "finish";
-    project: string;
-    conflictWorktree: string;
-    worker: string;
-    summary?: string;
-};
 export declare function parseSessionRunCommand(options: Pick<GlobalOptions, "project" | "branch" | "session">, args: string[]): R5dctlSessionRunCommand;
-export declare function parseMergeCommand(options: Pick<GlobalOptions, "project" | "branch" | "session">, args: string[]): R5dctlMergeCommand;
 export declare function parseGlobalArgs(argv: string[]): {
     options: GlobalOptions;
     rest: string[];
@@ -224,18 +202,6 @@ export type R5dctlCommandResponse = {
     error?: string;
     summary?: string;
     diffSummary?: string;
-    attemptId?: string;
-    sourceWorktree?: string;
-    targetWorktree?: string;
-    commitHash?: string;
-    resolverSessionId?: string;
-    conflictWorktree?: string;
-    folderPath?: string;
-    conflictedFiles?: string[];
-    failureReason?: string;
-    message?: string;
-    worktreeReady?: boolean;
-    resolverAgentRunning?: boolean;
 };
 export type R5dctlSessionRunClient = {
     projects: {
@@ -255,47 +221,17 @@ export type R5dctlSessionRunClient = {
         stop: (sessionId: string) => Promise<R5dctlCommandResponse>;
     };
 };
-export type R5dctlMergeClient = {
-    projects: {
-        worktrees: {
-            merge: (projectRef: string, sourceWorktree: string, input: {
-                worker?: string;
-                conflictMode: R5dctlMergeConflictMode;
-            }) => Promise<R5dctlCommandResponse>;
-            finishMerge: (projectRef: string, conflictWorktree: string, input: {
-                worker: string;
-                summary?: string;
-            }) => Promise<R5dctlCommandResponse>;
-            mergeAttempt: (projectRef: string, attemptId: string) => Promise<R5dctlCommandResponse>;
-        };
-    };
-};
 export declare function renderSessionRunStart(session: R5dctlCommandResponse): string;
 export declare function renderSessionRunStatus(session: R5dctlCommandResponse): string;
-export declare function renderWorktreeMerge(result: R5dctlCommandResponse, input: {
-    project: string;
-    worker?: string;
-}): string;
 export type R5dctlCommandDispatchResult = {
     data: R5dctlCommandResponse;
     human: string;
 };
 export declare function dispatchSessionRunCommand(client: R5dctlSessionRunClient, command: R5dctlSessionRunCommand): Promise<R5dctlCommandDispatchResult>;
-export type R5dctlMergePollOptions = {
-    onProgress?: (line: string) => void;
-    pollIntervalMs?: number;
-    pollTimeoutMs?: number;
-    sleep?: (ms: number) => Promise<void>;
-};
-/**
- * Whether a merge attempt response is settled for the CLI: terminal, waiting
- * on the user (a ready manual conflict worktree), or actively resolving with
- * its agent running. Anything else is still provisioning or starting. A
- * "resolving" response without the resolverAgentRunning field comes from a
- * server that starts the agent in-request, so it counts as settled.
- */
-export declare function isMergeAttemptSettled(response: R5dctlCommandResponse): boolean;
-export declare function dispatchMergeCommand(client: R5dctlMergeClient, command: R5dctlMergeCommand, pollOptions?: R5dctlMergePollOptions): Promise<R5dctlCommandDispatchResult>;
+export declare function waitForSessionProvisioning(client: Pick<R5dctlSessionRunClient, "sessions">, initial: R5dctlCommandResponse, options?: {
+    intervalMs?: number;
+    wait?: (milliseconds: number) => Promise<unknown>;
+}): Promise<R5dctlCommandResponse>;
 export declare function parseConversationRenderArgs(args: string[]): ConversationRenderOptions;
 export declare function renderConversationResponse(read: R5dctlConversationResponse): string;
 type R5dctlFollowClient = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ricsam/r5dctl",
-  "version": "0.0.73",
+  "version": "0.0.75",
   "type": "module",
   "main": "./dist/cjs/cli.cjs",
   "module": "./dist/mjs/cli.mjs",
@@ -26,7 +26,7 @@
     "r5dctl": "dist/cjs/main.cjs"
   },
   "dependencies": {
-    "@ricsam/r5d-api": "^0.0.73",
+    "@ricsam/r5d-api": "^0.0.75",
     "dotenv": "^17",
     "qrcode": "^1.5.4",
     "ws": "^8.18.3"