@treeseed/sdk 0.10.28 → 0.12.4

package/dist/operations/services/git-workflow.js

@@ -1,12 +1,57 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { isAbsolute, resolve } from "node:path";
 import { run, workspaceRoot } from "./workspace-tools.js";
-import { currentBranch, gitStatusPorcelain, repoRoot } from "./workspace-save.js";
+import { collectMergeConflictReport, currentBranch, formatMergeConflictReport, gitStatusPorcelain, repoRoot } from "./workspace-save.js";
 import { ensureSshPushUrlForOrigin } from "./git-remote-policy.js";
+import { runTreeseedGit } from "./git-runner.js";
 import { createTreeseedManagedToolEnv, resolveTreeseedToolBinary } from "../../managed-dependencies.js";
 const STAGING_BRANCH = "staging";
 const PRODUCTION_BRANCH = "main";
 const RESERVED_BRANCHES = /* @__PURE__ */ new Set([STAGING_BRANCH, PRODUCTION_BRANCH]);
+function gitMode(args) {
+  const command = args[0] ?? "";
+  return (/* @__PURE__ */ new Set([
+    "add",
+    "checkout",
+    "commit",
+    "merge",
+    "pull",
+    "push",
+    "rebase",
+    "reset",
+    "restore",
+    "switch",
+    "tag",
+    "update-index",
+    "worktree"
+  ])).has(command) ? "mutate" : "read";
+}
 function runGit(args, { cwd, capture = false } = {}) {
-  return run("git", args, { cwd, capture });
+  const result = runTreeseedGit(args, {
+    cwd: cwd ?? workspaceRoot(),
+    mode: gitMode(args),
+    allowFailure: false
+  });
+  return capture ? result.stdout : result.stdout;
+}
+function runGitAllowFailure(args, { cwd }) {
+  return runTreeseedGit(args, {
+    cwd,
+    mode: gitMode(args),
+    allowFailure: true
+  });
+}
+function abortInProgressMerge(repoDir) {
+  const mergeHead = runGitAllowFailure(["rev-parse", "--git-path", "MERGE_HEAD"], { cwd: repoDir }).stdout.trim();
+  const mergeHeadPath = mergeHead && (isAbsolute(mergeHead) ? mergeHead : resolve(repoDir, mergeHead));
+  if (!mergeHeadPath || !existsSync(mergeHeadPath) && conflictedFiles(repoDir).length === 0) {
+    return false;
+  }
+  const abort = runGitAllowFailure(["merge", "--abort"], { cwd: repoDir });
+  if (abort.status === 0) {
+    return true;
+  }
+  return runGitAllowFailure(["reset", "--merge"], { cwd: repoDir }).status === 0;
 }
 function ensureWritableOrigin(repoDir) {
   try {
@@ -26,6 +71,62 @@ function repoHasStagedChanges(repoDir) {
 function conflictedFiles(repoDir) {
   return runGit(["diff", "--name-only", "--diff-filter=U"], { cwd: repoDir, capture: true }).split("\n").map((line) => line.trim()).filter(Boolean);
 }
+function isGeneratedPackageMetadataFile(filePath) {
+  return filePath === "package.json" || filePath === "package-lock.json";
+}
+function isPackagePointerConflict(repoDir, filePath) {
+  if (!/^packages\/[^/]+$/u.test(filePath)) {
+    return false;
+  }
+  const stagedEntries = runGit(["ls-files", "-u", "--", filePath], { cwd: repoDir, capture: true }).split("\n").map((line) => line.trim()).filter(Boolean);
+  return stagedEntries.length > 0 && stagedEntries.every((line) => line.startsWith("160000 "));
+}
+function releaseSideConflictSha(repoDir, filePath) {
+  const stagedEntries = runGit(["ls-files", "-u", "--", filePath], { cwd: repoDir, capture: true }).split("\n").map((line) => line.trim()).filter(Boolean);
+  for (const entry of stagedEntries) {
+    const match = /^(\d+)\s+([0-9a-f]{40})\s+3\t(.+)$/u.exec(entry);
+    if (match && match[1] === "160000" && match[3] === filePath) {
+      return match[2];
+    }
+  }
+  return null;
+}
+function materializeReleaseSideFile(repoDir, filePath) {
+  const content = runGit(["show", `:3:${filePath}`], { cwd: repoDir, capture: true });
+  writeFileSync(resolve(repoDir, filePath), content);
+  runGit(["add", "--", filePath], { cwd: repoDir });
+}
+function stageReleaseSidePackagePointer(repoDir, filePath) {
+  const sha = releaseSideConflictSha(repoDir, filePath);
+  if (!sha) {
+    throw new Error(`Unable to resolve release-side package pointer for ${filePath}.`);
+  }
+  runGit(["update-index", "--cacheinfo", "160000", sha, filePath], { cwd: repoDir });
+}
+function isReleaseSideOnlyTextConflict(repoDir, filePath) {
+  if (isGeneratedPackageMetadataFile(filePath) || isPackagePointerConflict(repoDir, filePath)) {
+    return false;
+  }
+  const content = readFileSync(resolve(repoDir, filePath), "utf8");
+  const conflictBlocks = content.match(/<<<<<<< [\s\S]*?>>>>>>> .+/gu) ?? [];
+  if (conflictBlocks.length === 0) {
+    return false;
+  }
+  return conflictBlocks.every((block) => {
+    const middle = block.indexOf("=======");
+    if (middle === -1) {
+      return false;
+    }
+    const ours = block.slice(block.indexOf("\n") + 1, middle).trim();
+    return ours.length === 0;
+  });
+}
+function isReleaseSidePreferredWorkflowConflict(filePath) {
+  return [
+    "src/operations/services/git-workflow.ts",
+    "src/workflow/operations.ts"
+  ].includes(filePath);
+}
 function resolveGeneratedPackageMetadataConflicts(repoDir) {
   const files = conflictedFiles(repoDir);
   if (files.length === 0) {
@@ -37,8 +138,8 @@ function resolveGeneratedPackageMetadataConflicts(repoDir) {
       allConflictsWereGeneratedMetadata: false
     };
   }
-  const generatedMetadataFiles = /* @__PURE__ */ new Set(["package.json", "package-lock.json"]);
-  if (files.some((file) => !generatedMetadataFiles.has(file))) {
+  const allConflictsWereGeneratedMetadata = files.every((file) => isGeneratedPackageMetadataFile(file) || isPackagePointerConflict(repoDir, file) || isReleaseSideOnlyTextConflict(repoDir, file) || isReleaseSidePreferredWorkflowConflict(file));
+  if (!allConflictsWereGeneratedMetadata) {
     return {
       resolved: false,
       repoDir,
@@ -47,14 +148,27 @@ function resolveGeneratedPackageMetadataConflicts(repoDir) {
       allConflictsWereGeneratedMetadata: false
     };
   }
-  runGit(["checkout", "--theirs", "--", ...files], { cwd: repoDir });
-  runGit(["add", "--", ...files], { cwd: repoDir });
+  for (const file of files) {
+    if (isGeneratedPackageMetadataFile(file)) {
+      materializeReleaseSideFile(repoDir, file);
+      continue;
+    }
+    if (isReleaseSideOnlyTextConflict(repoDir, file)) {
+      materializeReleaseSideFile(repoDir, file);
+      continue;
+    }
+    if (isReleaseSidePreferredWorkflowConflict(file)) {
+      materializeReleaseSideFile(repoDir, file);
+      continue;
+    }
+    stageReleaseSidePackagePointer(repoDir, file);
+  }
   return {
     resolved: true,
     repoDir,
     targetBranch: STAGING_BRANCH,
     reconciledFiles: files,
-    allConflictsWereGeneratedMetadata: true
+    allConflictsWereGeneratedMetadata
   };
 }
 function headCommit(repoDir, ref = "HEAD") {
@@ -164,6 +278,93 @@ function remoteBranchExists(repoDir, branchName) {
 function fetchOrigin(repoDir) {
   runGit(["fetch", "origin"], { cwd: repoDir, capture: true });
 }
+function remoteHeadCommit(repoDir, branchName) {
+  fetchOrigin(repoDir);
+  return runGit(["rev-parse", `origin/${branchName}`], { cwd: repoDir, capture: true }).trim();
+}
+function pushCommitToBranch(repoDir, commitSha, branchName, { forceWithLease = false } = {}) {
+  ensureWritableOrigin(repoDir);
+  const args = forceWithLease ? ["push", "--force-with-lease", "origin", `${commitSha}:refs/heads/${branchName}`] : ["push", "origin", `${commitSha}:refs/heads/${branchName}`];
+  runGit(args, { cwd: repoDir });
+}
+function mergeBranchDownIntoFeature(repoDir, input) {
+  const sourceBranch = input.sourceBranch ?? STAGING_BRANCH;
+  assertCleanWorktree(repoDir);
+  fetchOrigin(repoDir);
+  if (!branchExists(repoDir, input.featureBranch)) {
+    if (!remoteBranchExists(repoDir, input.featureBranch)) {
+      throw new Error(`Feature branch "${input.featureBranch}" does not exist locally or on origin.`);
+    }
+    runGit(["branch", input.featureBranch, `origin/${input.featureBranch}`], { cwd: repoDir });
+  }
+  checkoutBranch(repoDir, input.featureBranch);
+  const beforeHead = headCommit(repoDir);
+  const sourceHead = remoteBranchExists(repoDir, sourceBranch) ? remoteHeadCommit(repoDir, sourceBranch) : null;
+  if (!sourceHead) {
+    throw new Error(`Source branch "${sourceBranch}" does not exist on origin.`);
+  }
+  let generatedMetadataReconciliation = null;
+  try {
+    runGit(["merge", "--no-ff", `origin/${sourceBranch}`, "-m", input.message], { cwd: repoDir, capture: true });
+  } catch (error) {
+    const reconciliation = input.allowGeneratedMetadataAutoResolution === false ? { resolved: false } : resolveGeneratedPackageMetadataConflicts(repoDir);
+    if (!reconciliation.resolved) {
+      const report = collectMergeConflictReport(repoDir);
+      const conflictError = new Error(formatMergeConflictReport(report, repoDir, sourceBranch));
+      Object.assign(conflictError, {
+        cause: error,
+        mergeConflictReport: report,
+        code: "conflict_resolution_required"
+      });
+      throw conflictError;
+    }
+    generatedMetadataReconciliation = reconciliation;
+    if (repoHasStagedChanges(repoDir)) {
+      runGit(["commit", "-m", input.message], { cwd: repoDir });
+    }
+  }
+  const afterHead = headCommit(repoDir);
+  const merged = beforeHead !== afterHead;
+  if (merged) {
+    pushBranch(repoDir, input.featureBranch);
+  }
+  return {
+    repoDir,
+    featureBranch: input.featureBranch,
+    sourceBranch,
+    beforeHead,
+    sourceHead,
+    afterHead,
+    merged,
+    pushed: merged,
+    generatedMetadataReconciliation
+  };
+}
+function promoteCommitToBranchWithExpectedHead(repoDir, input) {
+  const targetBranch = input.targetBranch ?? STAGING_BRANCH;
+  fetchOrigin(repoDir);
+  const actualBefore = remoteBranchExists(repoDir, targetBranch) ? remoteHeadCommit(repoDir, targetBranch) : null;
+  if (actualBefore !== input.expectedBefore) {
+    throw new Error(`Refusing to promote ${targetBranch}; origin/${targetBranch} moved from ${input.expectedBefore ?? "(missing)"} to ${actualBefore ?? "(missing)"}.`);
+  }
+  ensureWritableOrigin(repoDir);
+  const lease = actualBefore ? `--force-with-lease=refs/heads/${targetBranch}:${actualBefore}` : "--force-with-lease";
+  runGit(["push", lease, "origin", `${input.commitSha}:refs/heads/${targetBranch}`], { cwd: repoDir });
+  fetchOrigin(repoDir);
+  const verifiedHead = remoteHeadCommit(repoDir, targetBranch);
+  if (verifiedHead !== input.commitSha) {
+    throw new Error(`Promotion verification failed for ${targetBranch}; expected ${input.commitSha}, observed ${verifiedHead}.`);
+  }
+  return {
+    repoDir,
+    targetBranch,
+    expectedBefore: input.expectedBefore,
+    actualBefore,
+    commitSha: input.commitSha,
+    pushed: true,
+    verified: true
+  };
+}
 function ensureLocalBranchTracking(repoDir, branchName) {
   if (branchExists(repoDir, branchName)) {
     return;
@@ -273,6 +474,27 @@ function pushBranch(repoDir, branchName, { setUpstream = false } = {}) {
   const args = setUpstream ? ["push", "-u", "origin", branchName] : ["push", "origin", branchName];
   runGit(args, { cwd: repoDir });
 }
+function taskTagSlug(branchName) {
+  return String(branchName ?? "").normalize("NFKD").replace(/[\u0300-\u036f]/gu, "").replace(/[^a-z0-9._-]+/giu, "-").toLowerCase().replace(/-+/gu, "-").replace(/^-|-$/gu, "") || "task";
+}
+function createDeprecatedTaskTag(repoDir, branchName, reason = "") {
+  const head = headCommit(repoDir, branchName);
+  const tagName = `deprecated/${taskTagSlug(branchName)}/${head.slice(0, 12)}`;
+  const message = [
+    `Deprecated task branch ${branchName}`,
+    String(reason ?? "").trim()
+  ].filter(Boolean).join("\n\n");
+  runGit(["tag", "-a", tagName, head, "-m", message], { cwd: repoDir });
+  ensureWritableOrigin(repoDir);
+  runGit(["push", "origin", tagName], { cwd: repoDir });
+  return {
+    repoDir,
+    branchName,
+    tagName,
+    head,
+    pushed: true
+  };
+}
 function ensureRemoteBranchFromBase(repoDir, branchName, { baseBranch = PRODUCTION_BRANCH } = {}) {
   fetchOrigin(repoDir);
   if (remoteBranchExists(repoDir, branchName)) {
@@ -331,7 +553,15 @@ function squashMergeBranchIntoStaging(cwd, featureBranch, message, { pushTarget
   } catch (error) {
     const reconciliation = resolveGeneratedPackageMetadataConflicts(repoDir);
     if (!reconciliation.resolved) {
-      throw error;
+      const report = collectMergeConflictReport(repoDir);
+      const mergeAborted = abortInProgressMerge(repoDir);
+      const conflictError = new Error(formatMergeConflictReport(report, repoDir, STAGING_BRANCH));
+      Object.assign(conflictError, {
+        cause: error,
+        mergeAborted,
+        mergeConflictReport: report
+      });
+      throw conflictError;
     }
     if (reportGeneratedMetadataReconciliation) {
       console.log(`Resolving generated package metadata reconciliation for ${reconciliation.reconciledFiles.join(", ")}.`);
@@ -407,18 +637,6 @@ function listTaskBranches(repoDir) {
     };
   });
 }
-function taskTagSlug(branchName) {
-  return String(branchName).trim().replaceAll("\\", "/").replace(/[^A-Za-z0-9._/-]+/g, "-").replace(/\/+/g, "-").replace(/^-+|-+$/g, "") || "task";
-}
-function createDeprecatedTaskTag(repoDir, branchName, message) {
-  const head = runGit(["rev-parse", branchName], { cwd: repoDir, capture: true }).trim();
-  const shortSha = head.slice(0, 12);
-  const tagName = `deprecated/${taskTagSlug(branchName)}/${shortSha}`;
-  runGit(["tag", "-a", tagName, head, "-m", message], { cwd: repoDir });
-  ensureWritableOrigin(repoDir);
-  runGit(["push", "origin", tagName], { cwd: repoDir, capture: true });
-  return { tagName, head };
-}
 function waitForStagingAutomation(repoDir) {
   if (process.env.TREESEED_STAGE_WAIT_MODE === "skip") {
     return { status: "skipped", reason: "disabled" };
@@ -456,16 +674,22 @@ function mergeStagingIntoMain(cwd = workspaceRoot()) {
     sourceBranch: STAGING_BRANCH,
     targetBranch: PRODUCTION_BRANCH,
     message: `release: ${STAGING_BRANCH} -> ${PRODUCTION_BRANCH}`,
-    pushTarget: true
+    pushTarget: true,
+    allowUnrelatedHistories: false
   });
 }
-function mergeBranchIntoTarget(cwd = workspaceRoot(), { sourceBranch, targetBranch, message, pushTarget = true, quietMerge = false } = {}) {
+function mergeBranchIntoTarget(cwd = workspaceRoot(), { sourceBranch, targetBranch, message, pushTarget = true, quietMerge = false, allowUnrelatedHistories = false } = {}) {
   const repoDir = prepareReleaseBranches(cwd);
   checkoutBranch(repoDir, targetBranch);
   if (remoteBranchExists(repoDir, targetBranch)) {
     runGit(["merge", "--ff-only", `origin/${targetBranch}`], { cwd: repoDir });
   }
-  runGit(["merge", "--no-ff", sourceBranch, "-m", message], { cwd: repoDir, capture: quietMerge });
+  const mergeArgs = ["merge", "--no-ff"];
+  if (allowUnrelatedHistories) {
+    mergeArgs.push("--allow-unrelated-histories");
+  }
+  mergeArgs.push(sourceBranch, "-m", message);
+  runGit(mergeArgs, { cwd: repoDir, capture: quietMerge });
   pushBranch(repoDir, STAGING_BRANCH);
   if (pushTarget) {
     pushBranch(repoDir, targetBranch);
@@ -500,14 +724,18 @@ export {
   inspectDetachedHeadRepair,
   isTaskBranch,
   listTaskBranches,
+  mergeBranchDownIntoFeature,
   mergeBranchIntoTarget,
   mergeCurrentBranchIntoStaging,
   mergeStagingIntoMain,
   prepareReleaseBranches,
+  promoteCommitToBranchWithExpectedHead,
   pushBranch,
+  pushCommitToBranch,
   pushHeadToBranch,
   reattachDetachedHeadIfSafe,
   remoteBranchExists,
+  remoteHeadCommit,
   squashMergeBranchIntoStaging,
   syncBranchWithOrigin,
   taskTagSlug,

package/dist/operations/services/github-actions-verification.d.ts

@@ -1,4 +1,4 @@
-import { type GitHubApiClient, type GitHubWorkflowProgressEvent } from './github-api.ts';
+import { type GitHubApiClient, type GitHubWorkflowProgressEvent } from './github-api.js';
 export type GitHubActionsWorkflowState = 'success' | 'failure' | 'pending' | 'missing' | 'not_pushed' | 'error';
 export type GitHubActionsVerificationTarget = {
     name: string;
@@ -8,6 +8,7 @@ export type GitHubActionsVerificationTarget = {
     headSha: string | null;
     workflows: string[];
     kind?: 'root' | 'package';
+    missingIsFailure?: boolean;
 };
 export type GitHubActionsWorkflowGate = {
     name: string;
@@ -68,6 +69,7 @@ export type GitHubActionsRepositoryInspection = {
     state: GitHubActionsWorkflowState;
     message: string | null;
     workflows: GitHubActionsWorkflowRunInspection[];
+    missingIsFailure: boolean;
 };
 export type GitHubActionsVerificationFailure = {
     type: 'repository' | 'workflow' | 'job';
@@ -135,6 +137,7 @@ export declare function waitForGitHubActionsGate(gate: GitHubActionsWorkflowGate
     timeoutSeconds?: number;
     pollSeconds?: number;
     operation?: string;
+    env?: NodeJS.ProcessEnv | Record<string, string | undefined>;
     onProgress?: (message: string, stream?: 'stdout' | 'stderr') => void;
 }): Promise<Record<string, unknown>>;
 export {};

package/dist/operations/services/github-actions-verification.js

@@ -278,6 +278,9 @@ function collectFailures(repositories) {
         failures.push(...workflow.failedJobs.map((job) => jobFailure(repo, workflow, job)));
         continue;
       }
+      if (workflow.state === "missing" && !repo.missingIsFailure) {
+        continue;
+      }
       if (workflow.state === "failure" || workflow.state === "missing" || workflow.state === "error") {
         failures.push(workflowFailure(repo, workflow));
       }
@@ -312,9 +315,11 @@ async function inspectTarget(client, target, options) {
       remoteSynced: false,
       state: "error",
       message: "Repository, branch, or head SHA is unavailable.",
-      workflows: []
+      workflows: [],
+      missingIsFailure: target.missingIsFailure ?? true
     };
   }
+  const missingIsFailure = target.missingIsFailure ?? true;
   try {
     const remoteHeadSha = await resolveRemoteBranchHead(client, target.repository, target.branch);
     if (remoteHeadSha !== target.headSha) {
@@ -329,6 +334,7 @@ async function inspectTarget(client, target, options) {
         remoteSynced: false,
         state: "not_pushed",
         message: `Local HEAD ${target.headSha.slice(0, 12)} does not match origin/${target.branch} ${remoteHeadSha.slice(0, 12)}.`,
+        missingIsFailure,
         workflows: target.workflows.map((workflow) => ({
           workflow,
           state: "not_pushed",
@@ -359,7 +365,8 @@ async function inspectTarget(client, target, options) {
       remoteSynced: true,
       state: aggregateWorkflowState(workflows.map((workflow) => workflow.state)),
       message: null,
-      workflows
+      workflows,
+      missingIsFailure
     };
   } catch (error) {
     return {
@@ -373,7 +380,8 @@ async function inspectTarget(client, target, options) {
       remoteSynced: false,
       state: "error",
       message: error instanceof Error ? error.message : String(error),
-      workflows: []
+      workflows: [],
+      missingIsFailure
     };
   }
 }
@@ -544,6 +552,7 @@ async function waitForGitHubActionsGate(gate, options = {}) {
     dispatchIfMissing: gate.dispatchIfMissing ?? gate.workflow === "verify.yml",
     dispatchAfterSeconds: gate.dispatchAfterSeconds ?? 75,
     dispatchInputs: gate.dispatchInputs,
+    env: options.env,
     onProgress: reportProgress
   });
 }

package/dist/operations/services/github-api.js

@@ -3,6 +3,7 @@ import { spawnSync } from "node:child_process";
 import { createRequire } from "node:module";
 import { Octokit } from "octokit";
 import { createTreeseedManagedToolEnv, resolveTreeseedToolBinary } from "../../managed-dependencies.js";
+import { resolveTreeseedGitHubToken } from "../../service-credentials.js";
 const require2 = createRequire(import.meta.url);
 const sodium = require2("libsodium-wrappers");
 const DEFAULT_GITHUB_API_TIMEOUT_MS = 6e4;
@@ -15,7 +16,7 @@ function configuredEnvValue(env, key) {
   return typeof value === "string" && value.trim() ? value.trim() : "";
 }
 function resolveGitHubApiToken(env = process.env) {
-  return configuredEnvValue(env, "GH_TOKEN") || configuredEnvValue(env, "GITHUB_TOKEN");
+  return resolveTreeseedGitHubToken(env);
 }
 function parseGitHubRepositorySlug(value) {
   const normalized = String(value ?? "").trim().replace(/\.git$/u, "");
@@ -108,7 +109,7 @@ function createGitHubApiClient({
 } = {}) {
   const token = resolveGitHubApiToken(env);
   if (!token) {
-    throw new Error("Configure GH_TOKEN before using Treeseed GitHub automation.");
+    throw new Error("Configure TREESEED_GITHUB_TOKEN before using Treeseed GitHub automation.");
   }
   return new Octokit({
     auth: token,
@@ -466,7 +467,7 @@ function upsertGitHubRepositoryVariableWithGhCli(repository, name, value, {
 } = {}) {
   const token = resolveGitHubApiToken(env);
   if (!token) {
-    throw new Error("Configure GH_TOKEN before using Treeseed GitHub automation.");
+    throw new Error("Configure TREESEED_GITHUB_TOKEN before using Treeseed GitHub automation.");
   }
   const { owner, name: repo } = typeof repository === "string" ? parseGitHubRepositorySlug(repository) : repository;
   const ghEnv = {
@@ -742,6 +743,8 @@ async function waitForGitHubWorkflowRunCompletion(repository, {
   const startedAt = Date.now();
   let dispatchedMissingRun = false;
   let lastProgress = null;
+  let monitorErrorStartedAt = null;
+  let lastMonitorError = null;
   const emitProgress = (type, run = null, jobs = []) => {
     const completedJobs = jobs.filter((job) => job.status === "completed");
     const failedJobs = jobs.filter((job) => job.conclusion && job.conclusion !== "success" && job.conclusion !== "skipped");
@@ -773,6 +776,8 @@ async function waitForGitHubWorkflowRunCompletion(repository, {
         workflow_id: workflow,
         per_page: 20
       });
+      monitorErrorStartedAt = null;
+      lastMonitorError = null;
       const match = listed.data.workflow_runs.map((run) => normalizeWorkflowRun(run)).find((run) => (!headSha || run.headSha === headSha) && (!branch || run.headBranch === branch));
       if (!match?.id) {
         emitProgress("waiting");
@@ -794,7 +799,7 @@ async function waitForGitHubWorkflowRunCompletion(repository, {
         continue;
       }
       for (; ; ) {
-        if (Date.now() - startedAt >= timeoutSeconds * 1e3) {
+        if (Date.now() - startedAt >= timeoutSeconds * 1e3 && lastProgress?.runId === match.id) {
           break;
         }
         const current = await client.rest.actions.getWorkflowRun({
@@ -802,6 +807,8 @@ async function waitForGitHubWorkflowRunCompletion(repository, {
           repo: name,
           run_id: match.id
         });
+        monitorErrorStartedAt = null;
+        lastMonitorError = null;
         const normalized = normalizeWorkflowRun(current.data);
         const progressJobs = await listWorkflowJobsForProgress(client, owner, name, match.id);
         if (normalized.status === "completed") {
@@ -826,11 +833,20 @@ async function waitForGitHubWorkflowRunCompletion(repository, {
         await sleep(pollSeconds * 1e3);
       }
     } catch (error) {
-      throw normalizeGitHubApiError(error, `Unable to monitor GitHub workflow ${workflow} in ${owner}/${name}`);
+      const normalizedError = normalizeGitHubApiError(error, `Unable to monitor GitHub workflow ${workflow} in ${owner}/${name}`);
+      lastMonitorError = normalizedError;
+      monitorErrorStartedAt ??= Date.now();
+      const toleratedMonitorErrorSeconds = Math.max(pollSeconds * 2, 120);
+      if (Date.now() - monitorErrorStartedAt < toleratedMonitorErrorSeconds * 1e3) {
+        await sleep(pollSeconds * 1e3);
+        continue;
+      }
+      throw normalizedError;
     }
   }
   const lastState = lastProgress ? ` Last known state: run ${lastProgress.runId ?? "(not created)"} ${lastProgress.status ?? "waiting"}${lastProgress.conclusion ? `/${lastProgress.conclusion}` : ""}${lastProgress.url ? ` ${lastProgress.url}` : ""}.` : "";
-  throw new Error(`Timed out waiting for GitHub workflow ${workflow} in ${owner}/${name}.${lastState}`);
+  const monitorErrorState = lastMonitorError ? ` Last monitor error: ${lastMonitorError.message}` : "";
+  throw new Error(`Timed out waiting for GitHub workflow ${workflow} in ${owner}/${name}.${lastState}${monitorErrorState}`);
 }
 async function ensureGitHubBranchFromBase(repository, branch, {
   baseBranch = "main",

package/dist/operations/services/github-automation.d.ts

@@ -61,7 +61,7 @@ export declare function ensureGitHubBootstrapRepository(tenantRoot: string, { va
 }>;
 export declare function createGitHubRepository(input: any, { env }?: {
     env?: NodeJS.ProcessEnv | undefined;
-}): Promise<import("./github-api.ts").GitHubRepositorySummary>;
+}): Promise<import("./github-api.js").GitHubRepositorySummary>;
 export declare function initializeGitHubRepositoryWorkingTree(cwd: any, repository: any, { defaultBranch, createStaging, commitMessage, remoteName, push, forcePush, }?: {
     defaultBranch?: string | undefined;
     createStaging?: boolean | undefined;
@@ -209,7 +209,7 @@ export declare function ensureGitHubDeployAutomation(tenantRoot: any, { dryRun,
         skipped?: undefined;
     };
 }>;
-export declare function waitForGitHubWorkflowCompletion(tenantRoot: any, { repository, workflow, headSha, branch, timeoutSeconds, pollSeconds, dispatchIfMissing, dispatchAfterSeconds, dispatchInputs, onProgress, }?: {
+export declare function waitForGitHubWorkflowCompletion(tenantRoot: any, { repository, workflow, headSha, branch, timeoutSeconds, pollSeconds, dispatchIfMissing, dispatchAfterSeconds, dispatchInputs, onProgress, env, }?: {
     workflow?: string | undefined;
     timeoutSeconds?: number | undefined;
     pollSeconds?: number | undefined;
@@ -225,6 +225,6 @@ export declare function waitForGitHubWorkflowCompletion(tenantRoot: any, { repos
     updatedAt: string | null;
     conclusion: string | null;
     url: string | null;
-    jobs: import("./github-api.ts").GitHubWorkflowJobSummary[];
-    failedJobs: import("./github-api.ts").GitHubWorkflowJobSummary[];
+    jobs: import("./github-api.js").GitHubWorkflowJobSummary[];
+    failedJobs: import("./github-api.js").GitHubWorkflowJobSummary[];
 }>;

package/dist/operations/services/github-automation.js

@@ -1,6 +1,6 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, relative, resolve } from "node:path";
-import { spawnSync } from "node:child_process";
+import { runTreeseedGit } from "./git-runner.js";
 import { resolveTreeseedEnvironmentRegistry } from "../../platform/environment.js";
 import { packageRoot, loadCliDeployConfig } from "./runtime-tools.js";
 import {
@@ -18,6 +18,7 @@ import {
   upsertGitHubRepositoryVariable,
   waitForGitHubWorkflowRunCompletion
 } from "./github-api.js";
+import { resolveTreeseedGitHubToken } from "../../service-credentials.js";
 function envOrNull(key) {
   const value = process.env[key];
   return typeof value === "string" && value.length > 0 ? value : null;
@@ -43,19 +44,24 @@ function parseGitHubRepositoryFromRemote(remoteUrl) {
   return null;
 }
 function runGit(args, { cwd, allowFailure = false, capture = true } = {}) {
-  const result = spawnSync("git", args, {
+  const mutating = /^(add|commit|checkout|switch|merge|tag|push|fetch|worktree|submodule|reset|clean|restore|branch)$/u.test(args[0] ?? "");
+  const result = runTreeseedGit(args, {
     cwd,
-    stdio: capture ? "pipe" : "inherit",
-    encoding: "utf8"
+    mode: mutating ? "mutate" : "read",
+    allowFailure
   });
+  if (!capture && result.stdout.trim()) process.stdout.write(result.stdout);
+  if (!capture && result.stderr.trim()) process.stderr.write(result.stderr);
   if (result.status !== 0 && !allowFailure) {
     if (args[0] === "push" && !args.includes("--force")) {
       const retryArgs = ["push", "--force", ...args.slice(1)];
-      const retry = spawnSync("git", retryArgs, {
+      const retry = runTreeseedGit(retryArgs, {
         cwd,
-        stdio: capture ? "pipe" : "inherit",
-        encoding: "utf8"
+        mode: "mutate",
+        allowFailure: true
       });
+      if (!capture && retry.stdout.trim()) process.stdout.write(retry.stdout);
+      if (!capture && retry.stderr.trim()) process.stderr.write(retry.stderr);
       if (retry.status === 0) return retry;
       const retryDetail = retry.stderr?.trim() || retry.stdout?.trim();
       throw new Error(`git ${retryArgs.join(" ")} failed${retryDetail ? `: ${retryDetail}` : ""}`);
@@ -65,14 +71,6 @@ function runGit(args, { cwd, allowFailure = false, capture = true } = {}) {
   }
   return result;
 }
-function sleepSeconds(seconds) {
-  if (!Number.isFinite(seconds) || seconds <= 0) {
-    return;
-  }
-  spawnSync("sleep", [String(seconds)], {
-    stdio: "ignore"
-  });
-}
 function resolveGitHubRemoteUrls(owner, name) {
   const normalizedOwner = slugifySegment(owner, "owner");
   const normalizedName = slugifySegment(name, "repo");
@@ -185,8 +183,7 @@ async function ensureGitHubBootstrapRepository(tenantRoot, {
   onProgress?.(`[local][github][repo] Preparing ${slug} from ${target.source}...`);
   const client = createGitHubApiClient({
     env: {
-      GH_TOKEN: configuredValue(values, "GH_TOKEN") || configuredValue(values, "GITHUB_TOKEN"),
-      GITHUB_TOKEN: configuredValue(values, "GH_TOKEN") || configuredValue(values, "GITHUB_TOKEN")
+      TREESEED_GITHUB_TOKEN: resolveTreeseedGitHubToken(values)
     }
   });
   const existing = await maybeGetGitHubRepository({ owner: target.owner, name: target.name }, { client });
@@ -295,7 +292,7 @@ function renderTenantWorkflowActionCommand() {
     'if [[ -n "${TREESEED_WORKFLOW_PROJECT:-}" ]]; then EXTRA_ARGS+=(--project-id "${TREESEED_WORKFLOW_PROJECT}"); fi',
     'if [[ -n "${TREESEED_WORKFLOW_PREVIEW_ID:-}" ]]; then EXTRA_ARGS+=(--preview-id "${TREESEED_WORKFLOW_PREVIEW_ID}"); fi',
     "if test -f ./packages/sdk/scripts/tenant-workflow-action.ts; then",
-    '  node ./packages/sdk/scripts/run-ts.mjs ./packages/sdk/scripts/tenant-workflow-action.ts --action "${TREESEED_WORKFLOW_ACTION}" --environment "${TREESEED_WORKFLOW_ENVIRONMENT}" "${EXTRA_ARGS[@]}"',
+    '  tsx ./packages/sdk/scripts/tenant-workflow-action.ts --action "${TREESEED_WORKFLOW_ACTION}" --environment "${TREESEED_WORKFLOW_ENVIRONMENT}" "${EXTRA_ARGS[@]}"',
     "elif test -f ./node_modules/@treeseed/sdk/dist/scripts/tenant-workflow-action.js; then",
     '  node ./node_modules/@treeseed/sdk/dist/scripts/tenant-workflow-action.js --action "${TREESEED_WORKFLOW_ACTION}" --environment "${TREESEED_WORKFLOW_ENVIRONMENT}" "${EXTRA_ARGS[@]}"',
     "else",
@@ -358,7 +355,7 @@ function ensureStandardizedGitHubWorkflows(tenantRoot) {
   const deployConfig = loadCliDeployConfig(tenantRoot);
   const deploy = ensureDeployWorkflow(tenantRoot);
   const workflows = [deploy, ...deploy.additionalWorkflows ?? []];
-  if ((deployConfig.hosting?.kind ?? "self_hosted_project") === "market_control_plane") {
+  if ((deployConfig.hosting?.kind ?? "self_hosted_project") === "treeseed_control_plane") {
     workflows.push(ensureHostedProjectWorkflow(tenantRoot));
   }
   return workflows;
@@ -477,11 +474,12 @@ async function waitForGitHubWorkflowCompletion(tenantRoot, {
   dispatchIfMissing = false,
   dispatchAfterSeconds,
   dispatchInputs,
-  onProgress
+  onProgress,
+  env
 } = {}) {
   const repo = repository ?? resolveGitHubRepositorySlug(tenantRoot);
   return await waitForGitHubWorkflowRunCompletion(repo, {
-    client: createGitHubApiClient(),
+    client: createGitHubApiClient({ env }),
     workflow,
     headSha,
     branch,