@treeseed/sdk 0.6.9 → 0.6.11

package/dist/index.d.ts

@@ -14,7 +14,7 @@ export { parseGraphDsl } from './graph/dsl.ts';
 export { createDefaultGraphRankingProvider, DEFAULT_GRAPH_RANKING_PROVIDER } from './graph/ranking.ts';
 export { BUILTIN_MODEL_REGISTRY, MODEL_REGISTRY, buildBuiltinModelRegistry, buildModelRegistry, buildScopedModelRegistry, mergeModelRegistries, resolveModelDefinition, } from './model-registry.ts';
 export { normalizeAgentCliOptions, buildCopilotAllowToolArgs } from './cli-tools.ts';
-export { collectTreeseedDependencyStatus, createTreeseedManagedToolEnv, formatTreeseedDependencyReport, installTreeseedDependencies, resolveTreeseedToolBinary, resolveTreeseedToolCommand, } from './managed-dependencies.ts';
+export { collectTreeseedDependencyStatus, collectTreeseedToolStatus, createTreeseedManagedToolEnv, formatTreeseedDependencyReport, installTreeseedDependencies, resolveTreeseedToolBinary, resolveTreeseedToolCommand, type TreeseedToolStatusResult, } from './managed-dependencies.ts';
 export { runTreeseedCopilotTask, type TreeseedCopilotTaskInput, type TreeseedCopilotTaskResult, } from './copilot.ts';
 export { findDispatchCapability, listSdkDispatchCapabilities, listWorkflowDispatchCapabilities, } from './dispatch.ts';
 export { executeSdkOperation, findSdkOperation, listSdkOperationNames, } from './sdk-dispatch.ts';

package/dist/index.js

@@ -86,6 +86,7 @@ import {
 import { normalizeAgentCliOptions, buildCopilotAllowToolArgs } from "./cli-tools.js";
 import {
   collectTreeseedDependencyStatus,
+  collectTreeseedToolStatus,
   createTreeseedManagedToolEnv,
   formatTreeseedDependencyReport,
   installTreeseedDependencies,
@@ -196,6 +197,7 @@ export {
   canonicalizeFrontmatter,
   collectTreeseedDependencyStatus,
   collectTreeseedReconcileStatus,
+  collectTreeseedToolStatus,
   createControlPlaneReporter,
   createDefaultGraphRankingProvider,
   createFilesystemContentSource,

package/dist/managed-dependencies.d.ts

@@ -25,6 +25,28 @@ export type TreeseedDependencyInstallResult = {
     npmInstalls: TreeseedNpmInstallReport[];
     reports: TreeseedDependencyReport[];
 };
+export type TreeseedToolInvocation = {
+    mode: 'direct' | 'node' | 'unavailable';
+    command: string | null;
+    argsPrefix: string[];
+    binaryPath: string | null;
+};
+export type TreeseedToolReport = TreeseedDependencyReport & {
+    invocation: TreeseedToolInvocation;
+};
+export type TreeseedToolStatusResult = TreeseedDependencyInstallResult & {
+    tools: TreeseedToolReport[];
+    auth: {
+        github: {
+            checked: boolean;
+            authenticated: boolean;
+            binaryPath: string | null;
+            command: string[];
+            detail: string;
+            remediation: string[];
+        };
+    };
+};
 type DependencyInstallerOptions = {
     tenantRoot?: string;
     force?: boolean;
@@ -52,5 +74,6 @@ export declare function resolveTreeseedToolCommand(toolName: TreeseedManagedTool
 } | null;
 export declare function installTreeseedDependencies(options?: DependencyInstallerOptions): Promise<TreeseedDependencyInstallResult>;
 export declare function collectTreeseedDependencyStatus(options?: DependencyInstallerOptions): TreeseedDependencyInstallResult;
+export declare function collectTreeseedToolStatus(options?: DependencyInstallerOptions): TreeseedToolStatusResult;
 export declare function formatTreeseedDependencyReport(result: TreeseedDependencyInstallResult): string;
 export {};

package/dist/managed-dependencies.js

@@ -73,6 +73,26 @@ function currentPlatformAsset() {
 function managedGhBin(env = process.env) {
   return resolve(resolveToolsHome(env), "gh", GH_VERSION, platformKey(), "bin", "gh");
 }
+function tokenEnv(env = process.env) {
+  const ghToken = env.GH_TOKEN?.trim() || env.GITHUB_TOKEN?.trim() || "";
+  return ghToken ? {
+    ...env,
+    GH_TOKEN: ghToken,
+    GITHUB_TOKEN: ghToken
+  } : env;
+}
+function cleanCommandPathOutput(output) {
+  const lines = output.split(/\r?\n/u).map((line) => line.trim()).filter(Boolean);
+  for (let index = lines.length - 1; index >= 0; index -= 1) {
+    if (lines[index]?.startsWith("/")) {
+      return lines[index] ?? null;
+    }
+  }
+  return lines[lines.length - 1] ?? null;
+}
+function redactSensitiveOutput(output) {
+  return output.replace(/^(\s*-\s*Token:\s*).+$/gim, "$1***").replace(/\b(?:github_pat|ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_*.-]+/gu, "***");
+}
 function locateSystemBinary(command, spawn = spawnSync, env = process.env) {
   if (process.platform === "win32") {
     return null;
@@ -82,7 +102,7 @@ function locateSystemBinary(command, spawn = spawnSync, env = process.env) {
     encoding: "utf8",
     env
   });
-  return result.status === 0 ? String(result.stdout ?? "").trim() || null : null;
+  return result.status === 0 ? cleanCommandPathOutput(String(result.stdout ?? "")) : null;
 }
 function checkCommand(command, args, options = {}) {
   const run = options.spawn ?? spawnSync;
@@ -104,15 +124,25 @@ ${result.stdout ?? ""}`.trim() || result.error?.message || ""
 }
 function resolvePackageJsonPath(packageName) {
   try {
-    return require2.resolve(`${packageName}/package.json`);
+    const packageJsonPath = require2.resolve(`${packageName}/package.json`);
+    if (existsSync(packageJsonPath)) {
+      return packageJsonPath;
+    }
   } catch {
-    for (const searchPath of require2.resolve.paths(packageName) ?? []) {
-      const candidate = resolve(searchPath, packageName, "package.json");
-      if (existsSync(candidate)) {
-        return candidate;
-      }
+  }
+  for (const searchPath of require2.resolve.paths(packageName) ?? []) {
+    const candidate = resolve(searchPath, packageName, "package.json");
+    if (existsSync(candidate)) {
+      return candidate;
     }
-    throw new Error(`Unable to resolve package manifest for "${packageName}".`);
+  }
+  throw new Error(`Unable to resolve package manifest for "${packageName}".`);
+}
+function resolvePackageJsonPathOptional(packageName) {
+  try {
+    return resolvePackageJsonPath(packageName);
+  } catch {
+    return null;
   }
 }
 function resolvePackageBinary(packageName, binName) {
@@ -129,6 +159,27 @@ function resolvePackageBinary(packageName, binName) {
   const packageLocalFallback = resolve(dirname(packageJsonPath), relativeBin.replace(/^\.\.\//u, ""));
   return existsSync(packageLocalFallback) ? packageLocalFallback : resolvedBin;
 }
+function resolvePackageBinaryOptional(packageName, binName) {
+  const packageJsonPath = resolvePackageJsonPathOptional(packageName);
+  if (!packageJsonPath) {
+    return null;
+  }
+  try {
+    const packageJson = JSON.parse(readFileSync(packageJsonPath, "utf8"));
+    const relativeBin = typeof packageJson.bin === "string" ? packageJson.bin : packageJson.bin?.[binName];
+    if (!relativeBin) {
+      return null;
+    }
+    const resolvedBin = resolve(dirname(packageJsonPath), relativeBin);
+    if (existsSync(resolvedBin) || !relativeBin.startsWith("../")) {
+      return resolvedBin;
+    }
+    const packageLocalFallback = resolve(dirname(packageJsonPath), relativeBin.replace(/^\.\.\//u, ""));
+    return existsSync(packageLocalFallback) ? packageLocalFallback : resolvedBin;
+  } catch {
+    return null;
+  }
+}
 function resolvePackageRoot(packageName) {
   return dirname(resolvePackageJsonPath(packageName));
 }
@@ -260,7 +311,7 @@ function resolveTreeseedToolBinary(toolName, options = {}) {
   }
   const npmTool = findNpmTool(toolName);
   if (npmTool) {
-    return resolvePackageBinary(npmTool.packageName, npmTool.binName);
+    return resolvePackageBinaryOptional(npmTool.packageName, npmTool.binName);
   }
   if (toolName === "git" || toolName === "docker") {
     return locateSystemBinary(toolName, spawnSync, options.env ?? process.env);
@@ -277,6 +328,60 @@ function resolveTreeseedToolCommand(toolName, options = {}) {
   }
   return { command: binaryPath, argsPrefix: [], binaryPath };
 }
+function invocationForTool(toolName, env = process.env) {
+  const command = resolveTreeseedToolCommand(toolName, { env });
+  if (!command) {
+    return {
+      mode: "unavailable",
+      command: null,
+      argsPrefix: [],
+      binaryPath: null
+    };
+  }
+  return {
+    mode: findNpmTool(toolName) ? "node" : "direct",
+    command: command.command,
+    argsPrefix: command.argsPrefix,
+    binaryPath: command.binaryPath
+  };
+}
+function checkGitHubAuth(options) {
+  const env = tokenEnv(options.env ?? process.env);
+  const gh = resolveTreeseedToolCommand("gh", { env });
+  const command = gh ? [gh.command, ...gh.argsPrefix, "auth", "status", "--hostname", "github.com"] : [];
+  const remediation = [
+    "Run `npx trsd install --json` to install or inspect managed tools.",
+    "Run `npx trsd secrets:unlock` or provide TREESEED_KEY_PASSPHRASE so machine secrets can be decrypted.",
+    "Verify GH_TOKEN is configured in machine.yaml or the environment."
+  ];
+  if (!gh) {
+    return {
+      checked: true,
+      authenticated: false,
+      binaryPath: null,
+      command,
+      detail: "GitHub CLI `gh` is unavailable.",
+      remediation
+    };
+  }
+  const result = (options.spawn ?? spawnSync)(gh.command, [...gh.argsPrefix, "auth", "status", "--hostname", "github.com"], {
+    cwd: options.tenantRoot,
+    env: createTreeseedManagedToolEnv(env),
+    stdio: "pipe",
+    encoding: "utf8",
+    timeout: 15e3
+  });
+  const detail = redactSensitiveOutput(`${result.stderr ?? ""}
+${result.stdout ?? ""}`.trim()) || (result.status === 0 ? "GitHub CLI authentication succeeded." : "GitHub CLI authentication failed.");
+  return {
+    checked: true,
+    authenticated: result.status === 0,
+    binaryPath: gh.binaryPath,
+    command,
+    detail,
+    remediation
+  };
+}
 async function defaultDownloadFile(url, targetPath) {
   const request = url.startsWith("https:") ? httpsRequest : httpRequest;
   await new Promise((resolvePromise, rejectPromise) => {
@@ -441,16 +546,16 @@ async function installGh(options) {
 }
 function statusForNpmTool(tool, options) {
   try {
-    const binaryPath = resolvePackageBinary(tool.packageName, tool.binName);
+    const binaryPath = resolvePackageBinaryOptional(tool.packageName, tool.binName);
     return report({
       name: tool.name,
       kind: "npm",
       version: tool.version,
       source: "package",
       binaryPath,
-      status: existsSync(binaryPath) ? "already-present" : "missing",
+      status: binaryPath && existsSync(binaryPath) ? "already-present" : "missing",
       required: true,
-      detail: existsSync(binaryPath) ? `${tool.packageName} is available from the Treeseed SDK dependency graph.` : `${tool.packageName} binary ${tool.binName} is missing from the installed package.`
+      detail: binaryPath && existsSync(binaryPath) ? `${tool.packageName} is available from the Treeseed SDK dependency graph.` : `${tool.packageName} binary ${tool.binName} is missing from the installed package.`
     });
   } catch (error) {
     return report({
@@ -641,6 +746,21 @@ function collectTreeseedDependencyStatus(options = {}) {
     reports
   };
 }
+function collectTreeseedToolStatus(options = {}) {
+  const env = options.env ?? process.env;
+  const status = collectTreeseedDependencyStatus(options);
+  const tools = status.reports.map((entry) => ({
+    ...entry,
+    invocation: invocationForTool(entry.name, env)
+  }));
+  return {
+    ...status,
+    tools,
+    auth: {
+      github: checkGitHubAuth(options)
+    }
+  };
+}
 function formatTreeseedDependencyReport(result) {
   return [
     "Treeseed dependency status",
@@ -659,6 +779,7 @@ function formatTreeseedDependencyReport(result) {
 }
 export {
   collectTreeseedDependencyStatus,
+  collectTreeseedToolStatus,
   createTreeseedManagedToolEnv,
   formatTreeseedDependencyFailureDetails,
   formatTreeseedDependencyReport,

package/dist/operations/providers/default.js

@@ -56,6 +56,7 @@ import { run } from "../../operations/services/workspace-tools.js";
 import { resolveTreeseedWorkflowState } from "../../workflow-state.js";
 import { TreeseedWorkflowError, TreeseedWorkflowSdk } from "../../workflow.js";
 import {
+  collectTreeseedToolStatus,
   formatTreeseedDependencyReport,
   installTreeseedDependencies
 } from "../../managed-dependencies.js";
@@ -353,6 +354,39 @@ class InstallOperation extends BaseOperation {
     });
   }
 }
+class ToolsOperation extends BaseOperation {
+  async execute(_input, context) {
+    const result = collectTreeseedToolStatus({
+      tenantRoot: context.cwd,
+      env: operationEnv(context),
+      spawn: context.spawn
+    });
+    const stdout = [
+      "Treeseed managed tools",
+      `Tools home: ${result.toolsHome}`,
+      `GitHub CLI config: ${result.ghConfigDir}`,
+      ...result.tools.map((entry) => {
+        const invocation = entry.invocation.command ? `${entry.invocation.command}${entry.invocation.argsPrefix.length > 0 ? ` ${entry.invocation.argsPrefix.join(" ")}` : ""}` : "(unavailable)";
+        return `- ${entry.name}: ${entry.status} (${entry.binaryPath ?? "no binary"}; ${entry.invocation.mode}; ${invocation})`;
+      }),
+      `GitHub auth: ${result.auth.github.authenticated ? "authenticated" : "not authenticated"} - ${result.auth.github.detail}`
+    ];
+    return operationResult(this.metadata, result, {
+      ok: true,
+      exitCode: 0,
+      stdout,
+      report: {
+        ok: true,
+        dependenciesOk: result.ok,
+        toolsHome: result.toolsHome,
+        ghConfigDir: result.ghConfigDir,
+        npmInstalls: result.npmInstalls,
+        tools: result.tools,
+        auth: result.auth
+      }
+    });
+  }
+}
 class AuthLoginOperation extends BaseOperation {
   async execute(input, context) {
     const tenantRoot = context.cwd;
@@ -609,6 +643,7 @@ class DefaultTreeseedOperationsProvider {
       new SyncTemplateOperation("sync"),
       new DoctorOperation("doctor"),
       new InstallOperation("install"),
+      new ToolsOperation("tools"),
       new AuthLoginOperation("auth:login"),
       new AuthLogoutOperation("auth:logout"),
       new AuthWhoAmIOperation("auth:whoami"),

package/dist/operations/services/config-runtime.js

@@ -69,6 +69,7 @@ const MACHINE_CONFIG_RELATIVE_PATH = ".treeseed/config/machine.yaml";
 const MACHINE_KEY_HOME_RELATIVE_PATH = ".treeseed/config/machine.key";
 const LEGACY_MACHINE_KEY_RELATIVE_PATH = ".treeseed/config/machine.key";
 const REMOTE_AUTH_RELATIVE_PATH = ".treeseed/config/remote-auth.json";
+const WORKTREE_METADATA_RELATIVE_PATH = ".treeseed/worktree.json";
 const TEMPLATE_CATALOG_CACHE_RELATIVE_PATH = "treeseed/cache/template-catalog.json";
 const TENANT_ENVIRONMENT_OVERLAY_PATH = "src/env.yaml";
 const CLOUDFLARE_ACCOUNT_ID_PLACEHOLDER = "replace-with-cloudflare-account-id";
@@ -243,14 +244,26 @@ function findNearestTreeseedMachineConfig(startRoot = process.cwd()) {
   return null;
 }
 function getTreeseedMachineConfigPaths(tenantRoot) {
+  const configRoot = resolveManagedWorktreeMachineConfigRoot(tenantRoot);
   const homeRoot = process.env.HOME && process.env.HOME.trim().length > 0 ? process.env.HOME : homedir();
   return {
-    configPath: resolve(tenantRoot, MACHINE_CONFIG_RELATIVE_PATH),
-    authPath: resolve(tenantRoot, REMOTE_AUTH_RELATIVE_PATH),
+    configPath: resolve(configRoot, MACHINE_CONFIG_RELATIVE_PATH),
+    authPath: resolve(configRoot, REMOTE_AUTH_RELATIVE_PATH),
     keyPath: resolve(homeRoot, MACHINE_KEY_HOME_RELATIVE_PATH),
-    legacyKeyPath: resolve(tenantRoot, LEGACY_MACHINE_KEY_RELATIVE_PATH)
+    legacyKeyPath: resolve(configRoot, LEGACY_MACHINE_KEY_RELATIVE_PATH)
   };
 }
+function resolveManagedWorktreeMachineConfigRoot(tenantRoot) {
+  const metadataPath = resolve(tenantRoot, WORKTREE_METADATA_RELATIVE_PATH);
+  if (!existsSync(metadataPath)) return tenantRoot;
+  try {
+    const metadata = JSON.parse(readFileSync(metadataPath, "utf8")) ?? {};
+    const primaryRoot = metadata.kind === "treeseed.workflow.worktree" && typeof metadata.primaryRoot === "string" ? metadata.primaryRoot : null;
+    return primaryRoot && existsSync(resolve(primaryRoot, MACHINE_CONFIG_RELATIVE_PATH)) ? primaryRoot : tenantRoot;
+  } catch {
+    return tenantRoot;
+  }
+}
 function keyAgentScriptPath() {
   return packageScriptPath("key-agent.ts");
 }

package/dist/operations/services/deploy.js

@@ -10,6 +10,7 @@ const DEFAULT_COMPATIBILITY_DATE = "2026-04-05";
 const DEFAULT_COMPATIBILITY_FLAGS = ["nodejs_compat"];
 const GENERATED_ROOT = ".treeseed/generated";
 const STATE_ROOT = ".treeseed/state";
+const WORKTREE_METADATA_RELATIVE_PATH = ".treeseed/worktree.json";
 const PERSISTENT_SCOPES = /* @__PURE__ */ new Set(["local", "staging", "prod"]);
 const MANAGED_SERVICE_KEYS = ["api", "manager", "worker", "workdayStart", "workdayReport"];
 const TRESEED_ENVELOPE_SCHEMA_GENERATION = "runtime-envelopes-v1";
@@ -204,11 +205,23 @@ function targetDirectoryParts(target) {
 function targetKey(target) {
   return target.kind === "persistent" ? target.scope : `branch:${target.branchName}`;
 }
+function resolveManagedWorktreeStateRoot(tenantRoot) {
+  const metadataPath = resolve(tenantRoot, WORKTREE_METADATA_RELATIVE_PATH);
+  if (!existsSync(metadataPath)) return tenantRoot;
+  try {
+    const metadata = JSON.parse(readFileSync(metadataPath, "utf8")) ?? {};
+    const primaryRoot = metadata.kind === "treeseed.workflow.worktree" && typeof metadata.primaryRoot === "string" ? metadata.primaryRoot : null;
+    return primaryRoot && existsSync(resolve(primaryRoot, STATE_ROOT)) ? primaryRoot : tenantRoot;
+  } catch {
+    return tenantRoot;
+  }
+}
 function resolveTargetPaths(tenantRoot, scopeOrTarget = "prod") {
   const target = normalizeTarget(scopeOrTarget);
   const pathParts = targetDirectoryParts(target);
+  const stateRoot = resolveManagedWorktreeStateRoot(tenantRoot);
   const generatedRoot = resolve(tenantRoot, GENERATED_ROOT, ...pathParts);
-  const statePath = resolve(tenantRoot, STATE_ROOT, ...pathParts, "deploy.json");
+  const statePath = resolve(stateRoot, STATE_ROOT, ...pathParts, "deploy.json");
   return {
     target,
     generatedRoot,

package/dist/operations/services/export-runtime.js

@@ -66,6 +66,10 @@ function resolveIgnorePatterns(config) {
     ".treeseed/exports/**",
     "**/.treeseed/exports",
     "**/.treeseed/exports/**",
+    ".treeseed/worktrees",
+    ".treeseed/worktrees/**",
+    "**/.treeseed/worktrees",
+    "**/.treeseed/worktrees/**",
     ...config.export?.ignore ?? []
   ];
 }

package/dist/operations/services/git-workflow.d.ts

@@ -21,6 +21,8 @@ export declare function checkoutTaskBranchFromStaging(cwd: any, branchName: any,
     remoteBranch: boolean;
 };
 export declare function syncBranchWithOrigin(repoDir: any, branchName: any): void;
+export declare function checkoutDetachedOriginBranch(repoDir: any, branchName: any): void;
+export declare function pushHeadToBranch(repoDir: any, branchName: any): void;
 export declare function createFeatureBranchFromStaging(cwd: any, branchName: any): {
     repoDir: string;
     branchName: any;

package/dist/operations/services/git-workflow.js

@@ -23,6 +23,20 @@ function repoHasStagedChanges(repoDir) {
     return true;
   }
 }
+function conflictedFiles(repoDir) {
+  return runGit(["diff", "--name-only", "--diff-filter=U"], { cwd: repoDir, capture: true }).split("\n").map((line) => line.trim()).filter(Boolean);
+}
+function resolveGeneratedPackageMetadataConflicts(repoDir) {
+  const files = conflictedFiles(repoDir);
+  if (files.length === 0) return false;
+  const generatedMetadataFiles = /* @__PURE__ */ new Set(["package.json", "package-lock.json"]);
+  if (files.some((file) => !generatedMetadataFiles.has(file))) {
+    return false;
+  }
+  runGit(["checkout", "--theirs", "--", ...files], { cwd: repoDir });
+  runGit(["add", "--", ...files], { cwd: repoDir });
+  return true;
+}
 function headCommit(repoDir, ref = "HEAD") {
   return runGit(["rev-parse", ref], { cwd: repoDir, capture: true }).trim();
 }
@@ -77,7 +91,10 @@ function checkoutBranch(repoDir, branchName) {
 function checkoutTaskBranchFromStaging(cwd, branchName, { createIfMissing = true, pushIfCreated = false } = {}) {
   const repoDir = assertCleanWorktree(cwd);
   fetchOrigin(repoDir);
-  syncBranchWithOrigin(repoDir, STAGING_BRANCH);
+  const stagingBaseRef = remoteBranchExists(repoDir, STAGING_BRANCH) ? `origin/${STAGING_BRANCH}` : branchExists(repoDir, STAGING_BRANCH) ? STAGING_BRANCH : null;
+  if (!stagingBaseRef) {
+    throw new Error(`Base branch "${STAGING_BRANCH}" does not exist locally or on origin.`);
+  }
   if (currentBranch(repoDir) === branchName) {
     return {
       repoDir,
@@ -117,8 +134,7 @@ function checkoutTaskBranchFromStaging(cwd, branchName, { createIfMissing = true
   if (!createIfMissing) {
     throw new Error(`Branch "${branchName}" does not exist locally or on origin.`);
   }
-  checkoutBranch(repoDir, STAGING_BRANCH);
-  runGit(["checkout", "-b", branchName], { cwd: repoDir });
+  runGit(["checkout", "-b", branchName, stagingBaseRef], { cwd: repoDir });
   if (pushIfCreated) {
     pushBranch(repoDir, branchName, { setUpstream: true });
   }
@@ -142,6 +158,17 @@ function syncBranchWithOrigin(repoDir, branchName) {
     runGit(["merge", "--ff-only", `origin/${branchName}`], { cwd: repoDir });
   }
 }
+function checkoutDetachedOriginBranch(repoDir, branchName) {
+  fetchOrigin(repoDir);
+  if (!remoteBranchExists(repoDir, branchName)) {
+    throw new Error(`Remote branch "origin/${branchName}" does not exist.`);
+  }
+  runGit(["checkout", "--detach", `origin/${branchName}`], { cwd: repoDir });
+}
+function pushHeadToBranch(repoDir, branchName) {
+  ensureWritableOrigin(repoDir);
+  runGit(["push", "origin", `HEAD:${branchName}`], { cwd: repoDir });
+}
 function createFeatureBranchFromStaging(cwd, branchName) {
   const result = checkoutTaskBranchFromStaging(cwd, branchName, {
     createIfMissing: true,
@@ -209,7 +236,13 @@ function squashMergeBranchIntoStaging(cwd, featureBranch, message, { pushTarget
   const repoDir = assertCleanWorktree(cwd);
   fetchOrigin(repoDir);
   syncBranchWithOrigin(repoDir, STAGING_BRANCH);
-  runGit(["merge", "--squash", featureBranch], { cwd: repoDir });
+  try {
+    runGit(["merge", "--squash", featureBranch], { cwd: repoDir });
+  } catch (error) {
+    if (!resolveGeneratedPackageMetadataConflicts(repoDir)) {
+      throw error;
+    }
+  }
   let committed = false;
   if (repoHasStagedChanges(repoDir)) {
     runGit(["commit", "-m", message], { cwd: repoDir });
@@ -349,6 +382,7 @@ export {
   assertFeatureBranch,
   branchExists,
   checkoutBranch,
+  checkoutDetachedOriginBranch,
   checkoutTaskBranchFromStaging,
   createDeprecatedTaskTag,
   createFeatureBranchFromStaging,
@@ -367,6 +401,7 @@ export {
   mergeStagingIntoMain,
   prepareReleaseBranches,
   pushBranch,
+  pushHeadToBranch,
   remoteBranchExists,
   squashMergeBranchIntoStaging,
   syncBranchWithOrigin,

package/dist/operations/services/github-api.d.ts

@@ -27,6 +27,13 @@ export interface GitHubWorkflowRunSummary {
     headSha: string | null;
     headBranch: string | null;
 }
+export interface GitHubWorkflowJobSummary {
+    id: number;
+    name: string;
+    status: string | null;
+    conclusion: string | null;
+    url: string | null;
+}
 export declare function resolveGitHubApiToken(env?: NodeJS.ProcessEnv | Record<string, string | undefined>): string;
 export declare function parseGitHubRepositorySlug(value: string): {
     owner: string;
@@ -131,8 +138,11 @@ export declare function waitForGitHubWorkflowRunCompletion(repository: string |
     workflow: string;
     runId: number;
     headSha: string | null;
+    branch: string | null;
     conclusion: string | null;
     url: string | null;
+    jobs: GitHubWorkflowJobSummary[];
+    failedJobs: GitHubWorkflowJobSummary[];
 }>;
 export declare function ensureGitHubBranchFromBase(repository: string | {
     owner: string;

package/dist/operations/services/github-api.js

@@ -523,6 +523,15 @@ function normalizeWorkflowRun(run) {
     headBranch: typeof run.head_branch === "string" ? run.head_branch : null
   };
 }
+function normalizeWorkflowJob(job) {
+  return {
+    id: Number(job.id ?? 0),
+    name: String(job.name ?? ""),
+    status: typeof job.status === "string" ? job.status : null,
+    conclusion: typeof job.conclusion === "string" ? job.conclusion : null,
+    url: typeof job.html_url === "string" ? job.html_url : null
+  };
+}
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
@@ -557,14 +566,24 @@ async function waitForGitHubWorkflowRunCompletion(repository, {
         });
         const normalized = normalizeWorkflowRun(current.data);
         if (normalized.status === "completed") {
+          const jobs = await client.rest.actions.listJobsForWorkflowRun({
+            owner,
+            repo: name,
+            run_id: match.id,
+            per_page: 100
+          });
+          const normalizedJobs = jobs.data.jobs.map((job) => normalizeWorkflowJob(job));
           return {
             status: "completed",
             repository: `${owner}/${name}`,
             workflow,
             runId: normalized.id,
             headSha: normalized.headSha,
+            branch: normalized.headBranch,
             conclusion: normalized.conclusion,
-            url: normalized.url
+            url: normalized.url,
+            jobs: normalizedJobs,
+            failedJobs: normalizedJobs.filter((job) => job.conclusion && job.conclusion !== "success" && job.conclusion !== "skipped")
           };
         }
         await sleep(pollSeconds * 1e3);

package/dist/operations/services/github-automation.d.ts

@@ -281,8 +281,11 @@ export declare function waitForGitHubWorkflowCompletion(tenantRoot: any, { repos
     workflow: string;
     runId: number;
     headSha: string | null;
+    branch: string | null;
     conclusion: string | null;
     url: string | null;
+    jobs: import("./github-api.ts").GitHubWorkflowJobSummary[];
+    failedJobs: import("./github-api.ts").GitHubWorkflowJobSummary[];
 } | {
     status: string;
     reason: string;

package/dist/operations/services/repository-save-orchestrator.js

@@ -540,14 +540,14 @@ function applyPackageVersion(node, version) {
 function shouldSkipNetworkInstall() {
   return getGitHubAutomationMode() === "stub" || process.env.TREESEED_SAVE_NPM_INSTALL_MODE === "skip";
 }
-function shouldSkipGitDependencySmoke() {
-  return shouldSkipNetworkInstall() || process.env.TREESEED_GIT_DEPENDENCY_SMOKE === "skip";
+function shouldSkipGitDependencySmoke(options) {
+  return shouldSkipNetworkInstall() || process.env.TREESEED_GIT_DEPENDENCY_SMOKE === "skip" || options?.verifyMode === "skip";
 }
 function hasNpmLockfile(repoDir) {
   return existsSync(resolve(repoDir, "package-lock.json")) || existsSync(resolve(repoDir, "npm-shrinkwrap.json"));
 }
 async function runGitDependencySmoke(node, options, reference) {
-  if (reference.mode !== "dev-git-tag" || shouldSkipGitDependencySmoke()) return;
+  if (reference.mode !== "dev-git-tag" || shouldSkipGitDependencySmoke(options)) return;
   const installSpec = reference.installSpec ?? reference.spec;
   const tempRoot = mkdtempSync(resolve(tmpdir(), "treeseed-git-dep-smoke-"));
   const npmCacheRoot = resolve(tempRoot, ".npm-cache");
@@ -593,7 +593,8 @@ async function runNpmInstallWithRetry(node, options, gitDependencyRefreshSpecs =
   let lastError = null;
   const packageJson = node.packageJson ?? (existsSync(resolve(node.path, "package.json")) ? readJson(resolve(node.path, "package.json")) : null);
   const rootWorkspaceInstall = node.path === options.root && Array.isArray(packageJson?.workspaces);
-  const args = rootWorkspaceInstall ? gitDependencyRefreshSpecs.length > 0 ? ["install", ...gitDependencyRefreshSpecs, "--force"] : ["install"] : gitDependencyRefreshSpecs.length > 0 ? ["install", ...gitDependencyRefreshSpecs, "--force", "--workspaces=false"] : ["install", "--workspaces=false"];
+  const installFlags = ["--package-lock-only", "--ignore-scripts"];
+  const args = rootWorkspaceInstall ? gitDependencyRefreshSpecs.length > 0 ? ["install", ...gitDependencyRefreshSpecs, ...installFlags, "--force"] : ["install", ...installFlags] : gitDependencyRefreshSpecs.length > 0 ? ["install", ...gitDependencyRefreshSpecs, ...installFlags, "--force", "--workspaces=false"] : ["install", ...installFlags, "--workspaces=false"];
   for (let attempt = 1; attempt <= 5; attempt += 1) {
     emitProgress(options, node, "install", `npm ${args.join(" ")} attempt ${attempt}/5.`);
     try {
@@ -1230,6 +1231,11 @@ async function saveOneRepository(node, options, state) {
     report.install = await runNpmInstallWithRetry(node, options, gitDependencyRefreshSpecs);
   }
   if (hasNpmLockfile(node.path) && (node.kind === "project" || packageNeedsVersion || dependencyChanged || submodulesChanged)) {
+    const lockfileIssues = collectDeploymentLockfileWorkspaceIssues(node.path);
+    if (node.kind === "project" && lockfileIssues.length > 0 && !shouldSkipNetworkInstall()) {
+      emitProgress(options, node, "lockfile", "Refreshing package-lock.json before validation.");
+      report.install = await runNpmInstallWithRetry(node, options, gitDependencyRefreshSpecs);
+    }
     report.lockfileValidation = await validateRepositoryLockfile(node, options);
   }
   const dirty = hasMeaningfulChanges(node.path);