draftgo-cli 4.0.24 → 4.0.26

package/src/worktree/backend.js

@@ -10,6 +10,12 @@ const { normalizeSha256 } = require('./streams');
 const METADATA_TOOL = 'draftgo_resource_get_metadata';
 const MAX_ERROR_BYTES = 64 * 1024;
 const MAX_JSON_BYTES = 1024 * 1024;
+const MAX_CHECKOUT_JSON_BYTES = 64 * 1024 * 1024;
+const FINAL_OPERATIONS = Object.freeze({
+  pages: Object.freeze({ checkout: 'listPageCheckout', commit: 'updatePageCommit', contentType: 'text/html; charset=utf-8' }),
+  navigations: Object.freeze({ checkout: 'listNavigationCheckout', commit: 'updateNavigationCommit', contentType: 'text/html; charset=utf-8' }),
+  docs: Object.freeze({ checkout: 'listContentArticleCheckout', commit: 'updateContentArticleCommit', contentType: 'text/html; charset=utf-8', jsonCommit: true }),
+});
 
 function isObject(value) {
   return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
@@ -139,6 +145,68 @@ function firstValue(...values) {
   return values.find((value) => value !== undefined && value !== null && value !== '');
 }
 
+function operationPath(config, template, resourceId) {
+  const encoded = encodeURIComponent(String(resourceId));
+  const relative = String(template || '').replace(/\{[^}]+\}/, encoded);
+  if (!relative.startsWith('/api/')) {
+    throw new WorktreeError('INVALID_WORKFLOW_PATH', 'DraftGo checkout workflow returned an invalid API path.');
+  }
+  return new URL(relative, `${config.server.replace(/\/+$/, '')}/`).toString();
+}
+
+async function finalMetadata(config, resourceType, resourceId, session, options = {}) {
+  // Loaded lazily to avoid the API command's dependency on this backend module.
+  const { registryRevision, describeOperation } = require('../commands/api');
+  const { TOOL_NAMES, callStructured } = require('../mcp/tools');
+  const type = canonicalResourceType(resourceType);
+  const spec = FINAL_OPERATIONS[type];
+  const revision = await registryRevision(session, spec.checkout);
+  const checkout = await describeOperation(options.projectDir || process.cwd(), config, session, spec.checkout, revision);
+  const commit = await describeOperation(options.projectDir || process.cwd(), config, session, spec.commit, revision);
+  const checkoutOperation = checkout && checkout.operation || {};
+  const commitOperation = commit && commit.operation || {};
+  const checkoutResult = await callStructured(session, TOOL_NAMES.apiCall, {
+    operation_id: spec.checkout,
+    registry_revision: revision,
+    path: { id: Number(resourceId) },
+  }, options);
+  const workflow = checkoutResult && checkoutResult.workflow || {};
+  if (workflow.required !== true || workflow.workflow !== 'checkout_commit') {
+    throw new WorktreeError('INVALID_WORKFLOW_DESCRIPTOR', 'DraftGo did not return a checkout/commit workflow descriptor.');
+  }
+  const checkoutURL = operationPath(config, checkoutOperation.path || workflow.path, resourceId);
+  const response = await (options.fetch || fetch)(checkoutURL, {
+    method: String(checkoutOperation.method || 'GET').toUpperCase(),
+    headers: authHeaders(config, { Accept: 'application/json' }),
+    signal: options.signal,
+    redirect: 'error',
+  });
+  if (!response.ok) throw await errorForResponse(response, config.token || config.sat);
+  const raw = await readBounded(response, MAX_CHECKOUT_JSON_BYTES, true);
+  const value = parseJsonText(raw, 'DraftGo checkout endpoint');
+  const version = firstValue(value.content_version, value.revision);
+  const content = typeof value.content === 'string' ? value.content : null;
+  const contentURL = firstValue(value.content_url, checkoutURL);
+  const contentType = type === 'docs' ? spec.contentType : spec.contentType;
+  const size = content == null ? null : Buffer.byteLength(content, 'utf8');
+  return normalizeMetadata(config, type, resourceId, {
+    resource_type: type,
+    resource_id: String(resourceId),
+    title: value.title || '', route: value.route || null, code: value.code || null, slug: value.slug || null,
+    content_type: contentType,
+    file_extension: '.html',
+    content_size: size,
+    content_hash: value.content_hash,
+    ...(type === 'docs' ? { base_revision: version } : { base_version: version }),
+    etag: value.content_hash,
+    download_url: contentURL,
+    commit_url: operationPath(config, commitOperation.path, resourceId),
+    commit_method: String(commitOperation.method || 'PUT').toUpperCase(),
+    inline_content: content,
+    json_commit: spec.jsonCommit === true,
+  });
+}
+
 function normalizeUrl(config, value, purpose) {
   if (!value) return null;
   let url;
@@ -219,7 +287,23 @@ async function resolveMetadata(config, resourceType, resourceId, options = {}) {
   if (typeof client.listAllTools === 'function') {
     const tools = options.tools || await client.listAllTools(options);
     const found = tools.find((tool) => tool && toolNameMatches(String(tool.name || ''), METADATA_TOOL));
-    if (!found) throw new WorktreeError('MCP_TOOL_UNAVAILABLE', `${METADATA_TOOL} is not available.`);
+    if (!found) {
+      const { TOOL_NAMES, openToolSession } = require('../mcp/tools');
+      const session = await openToolSession(config, [
+        TOOL_NAMES.apiSearch, TOOL_NAMES.apiDescribe, TOOL_NAMES.apiCall,
+      ], { ...options, client });
+      return finalMetadata(config, resourceType, resourceId, session, options);
+    }
+    toolName = found.name;
+  } else if (Array.isArray(options.tools)) {
+    const found = options.tools.find((tool) => tool && toolNameMatches(String(tool.name || ''), METADATA_TOOL));
+    if (!found) {
+      const { TOOL_NAMES, openToolSession } = require('../mcp/tools');
+      const session = await openToolSession(config, [
+        TOOL_NAMES.apiSearch, TOOL_NAMES.apiDescribe, TOOL_NAMES.apiCall,
+      ], { ...options, client });
+      return finalMetadata(config, resourceType, resourceId, session, options);
+    }
     toolName = found.name;
   }
   const result = await client.toolsCall(toolName, {
@@ -233,21 +317,26 @@ function authHeaders(config, extra = {}) {
   return { Authorization: `Bearer ${config.token || config.sat}`, ...extra };
 }
 
-async function readBounded(response, maximum = MAX_ERROR_BYTES) {
+async function readBounded(response, maximum = MAX_ERROR_BYTES, rejectOverflow = false) {
   if (!response.body) return '';
   const reader = response.body.getReader();
   const chunks = [];
   let size = 0;
-  let ended = false;
-  while (size < maximum) {
-    const { done, value } = await reader.read();
-    if (done) { ended = true; break; }
-    const chunk = Buffer.from(value);
-    const remaining = maximum - size;
-    chunks.push(chunk.subarray(0, remaining));
-    size += Math.min(chunk.length, remaining);
-  }
-  if (!ended) await reader.cancel().catch(() => {});
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      const chunk = Buffer.from(value);
+      if (size + chunk.length > maximum) {
+        if (rejectOverflow) throw new WorktreeError('RESPONSE_TOO_LARGE',
+          'DraftGo response exceeds the explicit ' + maximum + '-byte limit; local content was preserved.', { max_bytes: maximum });
+        chunks.push(chunk.subarray(0, maximum - size));
+        break;
+      }
+      chunks.push(chunk);
+      size += chunk.length;
+    }
+  } finally { await reader.cancel().catch(() => {}); }
   return Buffer.concat(chunks).toString('utf8');
 }
 
@@ -264,10 +353,15 @@ async function errorForResponse(response, token) {
 }
 
 async function download(config, metadata, options = {}) {
+  const raw = metadata.raw && typeof metadata.raw === 'object' ? metadata.raw : {};
+  if (typeof raw.inline_content === 'string') {
+    return new Response(raw.inline_content, { headers: { 'content-type': metadata.content_type } });
+  }
   const response = await (options.fetch || fetch)(metadata.download_url, {
     method: 'GET',
     headers: authHeaders(config, { Accept: '*/*' }),
     signal: options.signal,
+    redirect: 'error',
   });
   if (!response.ok) throw await errorForResponse(response, config.token || config.sat);
   return response;
@@ -294,15 +388,31 @@ async function commit(config, metadata, localPath, current, options = {}) {
   if (metadata.base_version != null) headers['DraftGo-Base-Version'] = String(metadata.base_version);
   if (metadata.base_revision != null) headers['DraftGo-Base-Revision'] = String(metadata.base_revision);
 
+  let body;
+  let duplex;
+  if (metadata.raw && metadata.raw.json_commit === true) {
+    const content = fs.readFileSync(localPath, 'utf8');
+    body = JSON.stringify({
+      content,
+      ...(metadata.base_revision != null ? { base_revision: metadata.base_revision } : {}),
+      ...(metadata.base_revision == null && metadata.content_hash ? { base_hash: metadata.content_hash } : {}),
+    });
+    headers['Content-Type'] = 'application/json';
+    headers['Content-Length'] = String(Buffer.byteLength(body, 'utf8'));
+  } else {
+    body = fs.createReadStream(localPath);
+    duplex = 'half';
+  }
   const response = await (options.fetch || fetch)(metadata.commit_url, {
     method: metadata.commit_method,
     headers,
-    body: fs.createReadStream(localPath),
-    duplex: 'half',
+    body,
+    ...(duplex ? { duplex } : {}),
     signal: options.signal,
+    redirect: 'error',
   });
   if (!response.ok) throw await errorForResponse(response, config.token || config.sat);
-  const text = await readBounded(response, MAX_JSON_BYTES);
+  const text = await readBounded(response, MAX_JSON_BYTES, true);
   if (!text.trim()) return {};
   return parseJsonText(text, 'DraftGo commit endpoint');
 }
@@ -314,6 +424,8 @@ function nodeReadable(response) {
 
 module.exports = {
   METADATA_TOOL,
+  readBounded,
+  MAX_CHECKOUT_JSON_BYTES,
   toolNameMatches,
   unwrapToolResult,
   unwrapProtectedResult,

package/src/worktree/index.js

@@ -33,6 +33,8 @@ const {
 const { validateContentFile } = require('./validate');
 const { inspectEntry, openMetadataSession, sameVersion } = require('./status');
 
+const { withResourceLocks } = require('./locks');
+const { mapBounded } = require('../mcp/parallel');
 const CONFLICT_SCHEMA_VERSION = 1;
 
 function backendFor(options) {
@@ -93,17 +95,18 @@ function assertMetadataIdentity(metadata, resourceType, resourceId) {
   }
 }
 
-async function checkoutResources(projectDir, resourceType, resourceIds, options = {}) {
+async function checkoutResourcesUnlocked(projectDir, resourceType, resourceIds, options = {}) {
   const canonical = canonicalResourceType(resourceType);
   const ids = ensureIds(resourceIds);
   const config = options.config || loadProjectConfig(projectDir);
   const backend = backendFor(options);
   const session = await createSession(config, options);
   const manifest = loadManifest(projectDir);
-  const settled = await Promise.allSettled(ids.map(async (resourceId) => {
+  const settled = await mapBounded(ids, async (resourceId) => {
     const metadata = await backend.resolveMetadata(config, canonical, resourceId, {
       ...options,
       ...session,
+      projectDir,
       clientInitialized: true,
     });
     assertMetadataIdentity(metadata, canonical, resourceId);
@@ -158,7 +161,7 @@ async function checkoutResources(projectDir, resourceType, resourceIds, options
       updated_by: metadata.updated_by,
     };
     return entry;
-  }));
+  }, { ...options, settled: true });
   const results = settled.filter((item) => item.status === 'fulfilled').map((item) => item.value);
   for (const entry of results) manifest.entries[entryKey(canonical, entry.resource_id)] = entry;
   if (results.length) await saveManifest(projectDir, manifest);
@@ -211,6 +214,7 @@ async function writeConflict(projectDir, entry, error, config, backend, options,
   const remoteMetadata = await backend.resolveMetadata(config, entry.resource_type, entry.resource_id, {
     ...options,
     ...session,
+    projectDir,
     clientInitialized: true,
   });
   assertMetadataIdentity(remoteMetadata, entry.resource_type, entry.resource_id);
@@ -270,9 +274,7 @@ function unresolvedConflict(projectDir, resourceType, resourceId) {
   }
 }
 
-async function commitResources(projectDir, resourceType, resourceIds, options = {}) {
-  const canonical = canonicalResourceType(resourceType);
-  const ids = ensureIds(resourceIds);
+async function commitBatchUnlocked(projectDir, targets, options = {}) {
   const config = options.config || loadProjectConfig(projectDir);
   const backend = backendFor(options);
   const session = await createSession(config, options);
@@ -287,8 +289,8 @@ async function commitResources(projectDir, resourceType, resourceIds, options =
   };
 
   // Resolve and validate every target before the first remote write. Different
-  // resources are independent, so preflight can run without a client-side cap.
-  const preflight = await Promise.all(ids.map(async (resourceId) => {
+  // resources are independent; bound concurrency to avoid exhausting connections.
+  const preflight = await mapBounded(targets, async ({ resource_type: canonical, resource_id: resourceId }) => {
     try {
       const entry = getEntry(manifest, canonical, resourceId);
       if (!entry) {
@@ -320,6 +322,7 @@ async function commitResources(projectDir, resourceType, resourceIds, options =
       const fresh = await backend.resolveMetadata(config, canonical, resourceId, {
         ...options,
         ...session,
+        projectDir,
         clientInitialized: true,
       });
       assertMetadataIdentity(fresh, canonical, resourceId);
@@ -359,22 +362,21 @@ async function commitResources(projectDir, resourceType, resourceIds, options =
         details: error.details || {},
       } };
     }
-  }));
+  }, options);
   for (const item of preflight) {
     if (item.plan) plans.push(item.plan);
     else preflightFailures.push(item.failure);
   }
 
   if (preflightFailures.length) {
-    const failedIds = new Set(preflightFailures.map((item) => String(item.resource_id)));
-    const notStarted = ids.filter((id) => !failedIds.has(String(id))).map((resourceId) => ({
-      resource_type: canonical,
-      resource_id: resourceId,
+    const failedIds = new Set(preflightFailures.map((item) => entryKey(item.resource_type, item.resource_id)));
+    const notStarted = targets.filter((item) => !failedIds.has(entryKey(item.resource_type, item.resource_id))).map((item) => ({
+      ...item,
       status: 'not_started',
       phase: 'preflight',
     }));
     for (const result of [...preflightFailures, ...notStarted]) report(result);
-    if (ids.length === 1 && preflightFailures.length === 1) {
+    if (targets.length === 1 && preflightFailures.length === 1) {
       const original = new WorktreeError(
         preflightFailures[0].code,
         preflightFailures[0].message,
@@ -391,6 +393,7 @@ async function commitResources(projectDir, resourceType, resourceIds, options =
 
   async function commitPlan(plan) {
     const { resourceId, entry, localPath, current, fresh } = plan;
+    const canonical = entry.resource_type;
     if (current.hash === entry.base_hash) {
       return { resource_type: canonical, resource_id: resourceId, status: 'unchanged', hash: current.hash };
     }
@@ -430,6 +433,7 @@ async function commitResources(projectDir, resourceType, resourceIds, options =
         const confirmed = await backend.resolveMetadata(config, canonical, resourceId, {
           ...options,
           ...session,
+          projectDir,
           clientInitialized: true,
         });
         assertMetadataIdentity(confirmed, canonical, resourceId);
@@ -476,7 +480,7 @@ async function commitResources(projectDir, resourceType, resourceIds, options =
     }
   }
 
-  const settled = await Promise.allSettled(plans.map(async (plan) => {
+  const settled = await mapBounded(plans, async (plan) => {
     try {
       const result = await commitPlan(plan);
       report(result);
@@ -485,16 +489,16 @@ async function commitResources(projectDir, resourceType, resourceIds, options =
       report(error.batchResult);
       throw error;
     }
-  }));
+  }, { ...options, settled: true });
   const committed = results.filter((item) => item.status === 'committed');
   if (committed.length) await saveManifest(projectDir, manifest);
   const failures = settled.filter((item) => item.status === 'rejected');
   if (failures.length) {
     const first = failures[0].reason;
-    const inputOrder = new Map(ids.map((id, index) => [String(id), index]));
+    const inputOrder = new Map(targets.map((item, index) => [entryKey(item.resource_type, item.resource_id), index]));
     const ordered = (items) => [...items].sort((left, right) => (
-      (inputOrder.get(String(left.resource_id)) ?? Number.MAX_SAFE_INTEGER)
-      - (inputOrder.get(String(right.resource_id)) ?? Number.MAX_SAFE_INTEGER)
+      (inputOrder.get(entryKey(left.resource_type, left.resource_id)) ?? Number.MAX_SAFE_INTEGER)
+      - (inputOrder.get(entryKey(right.resource_type, right.resource_id)) ?? Number.MAX_SAFE_INTEGER)
     ));
     first.details = {
       ...(first.details || {}),
@@ -509,7 +513,7 @@ async function commitResources(projectDir, resourceType, resourceIds, options =
   return results;
 }
 
-async function reconcileResources(projectDir, resourceType, resourceIds, options = {}) {
+async function reconcileResourcesUnlocked(projectDir, resourceType, resourceIds, options = {}) {
   const canonical = canonicalResourceType(resourceType);
   const ids = ensureIds(resourceIds);
   const config = options.config || loadProjectConfig(projectDir);
@@ -533,7 +537,7 @@ async function reconcileResources(projectDir, resourceType, resourceIds, options
       );
     }
     const remote = await backend.resolveMetadata(config, canonical, resourceId, {
-      ...options, ...session, clientInitialized: true,
+      ...options, ...session, projectDir, clientInitialized: true,
     });
     assertMetadataIdentity(remote, canonical, resourceId);
     const status = await inspectEntry(projectDir, entry, remote);
@@ -654,7 +658,7 @@ function showConflict(projectDir, resourceType, resourceId) {
   return match;
 }
 
-async function resolveConflict(projectDir, resourceType, resourceId) {
+async function resolveConflictUnlocked(projectDir, resourceType, resourceId) {
   const canonical = canonicalResourceType(resourceType);
   const manifest = loadManifest(projectDir);
   const entry = getEntry(manifest, canonical, resourceId);
@@ -695,7 +699,45 @@ async function resolveConflict(projectDir, resourceType, resourceId) {
   return { ...resolved, manifest_path: relativePath(projectDir, manifestFile) };
 }
 
+function normalizedTargets(targets) {
+  const unique = new Map();
+  for (const target of targets) {
+    const resource_type = canonicalResourceType(target.resource_type);
+    const resource_id = ensureIds([target.resource_id])[0];
+    unique.set(entryKey(resource_type, resource_id), { resource_type, resource_id });
+  }
+  if (!unique.size) throw new WorktreeError('INVALID_RESOURCE_ID', 'At least one resource is required.');
+  return [...unique.values()];
+}
+
+function commitBatch(projectDir, targets, options = {}) {
+  const normalized = normalizedTargets(targets);
+  return withResourceLocks(projectDir, normalized.map((item) => entryKey(item.resource_type, item.resource_id)),
+    () => commitBatchUnlocked(projectDir, normalized, options));
+}
+function commitResources(projectDir, resourceType, resourceIds, options = {}) {
+  return commitBatch(projectDir, ensureIds(resourceIds).map((resource_id) => ({ resource_type: resourceType, resource_id })), options);
+}
+function checkoutResources(projectDir, resourceType, resourceIds, options = {}) {
+  const type = canonicalResourceType(resourceType);
+  const ids = ensureIds(resourceIds);
+  return withResourceLocks(projectDir, ids.map((id) => entryKey(type, id)),
+    () => checkoutResourcesUnlocked(projectDir, type, ids, options));
+}
+function reconcileResources(projectDir, resourceType, resourceIds, options = {}) {
+  const type = canonicalResourceType(resourceType);
+  const ids = ensureIds(resourceIds);
+  return withResourceLocks(projectDir, ids.map((id) => entryKey(type, id)),
+    () => reconcileResourcesUnlocked(projectDir, type, ids, options));
+}
+function resolveConflict(projectDir, resourceType, resourceId) {
+  const type = canonicalResourceType(resourceType);
+  return withResourceLocks(projectDir, [entryKey(type, resourceId)],
+    () => resolveConflictUnlocked(projectDir, type, resourceId));
+}
+
 module.exports = {
+  commitBatch,
   CONFLICT_SCHEMA_VERSION,
   worktreePaths,
   conflictPaths,

package/src/worktree/locks.js

@@ -0,0 +1,52 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+const { acquireLock, releaseLock } = require('../worklog');
+const { WorktreeError } = require('./errors');
+
+// Reuse owner-token locks, but never expire an active long-running transfer.
+function lockFile(file) {
+  const lockPath = `${file}.lock`;
+  try {
+    const token = fs.readFileSync(lockPath, 'utf8').trim();
+    const pid = Number(token.split(':')[0]);
+    if (Number.isSafeInteger(pid) && pid > 0) {
+      try { process.kill(pid, 0); } catch (error) {
+        if (error.code === 'ESRCH' && fs.readFileSync(lockPath, 'utf8').trim() === token) fs.rmSync(lockPath);
+      }
+    }
+  } catch (error) { if (error.code !== 'ENOENT') throw error; }
+  try { return acquireLock(file, { lockTimeoutMs: 0, lockStaleMs: Number.MAX_SAFE_INTEGER }); }
+  catch (error) {
+    if (error.code !== 'WORKLOG_LOCK_TIMEOUT') throw error;
+    throw new WorktreeError('WORKTREE_LOCKED', 'Another process owns this worktree resource; retry after it finishes.', { lock_path: lockPath });
+  }
+}
+
+async function withResourceLocks(projectDir, keys, action) {
+  const locks = [];
+  try {
+    for (const key of [...new Set(keys)].sort()) {
+      const name = crypto.createHash('sha256').update(key).digest('hex');
+      locks.push(lockFile(path.join(projectDir, '.draftgo', 'worktree', '.locks', name)));
+    }
+    return await action();
+  } finally { for (const lock of locks.reverse()) releaseLock(lock); }
+}
+
+async function withManifestLock(projectDir, action) {
+  const file = path.join(projectDir, '.draftgo', 'worktree', 'manifest.json');
+  const started = Date.now();
+  let lock;
+  while (!lock) {
+    try { lock = lockFile(file); } catch (error) {
+      if (error.code !== 'WORKTREE_LOCKED' || Date.now() - started >= 10000) throw error;
+      await new Promise((resolve) => setTimeout(resolve, 15));
+    }
+  }
+  try { return await action(); } finally { releaseLock(lock); }
+}
+
+module.exports = { withResourceLocks, withManifestLock };

package/src/worktree/manifest.js

@@ -6,6 +6,8 @@ const { WorktreeError } = require('./errors');
 const { entryKey } = require('./types');
 const { writeJsonAtomic } = require('./streams');
 
+const { withManifestLock } = require('./locks');
+const snapshots = new WeakMap();
 const MANIFEST_SCHEMA_VERSION = 1;
 
 function manifestPath(projectDir) {
@@ -13,7 +15,9 @@ function manifestPath(projectDir) {
 }
 
 function emptyManifest() {
-  return { schema_version: MANIFEST_SCHEMA_VERSION, entries: {} };
+  const value = { schema_version: MANIFEST_SCHEMA_VERSION, entries: {} };
+  snapshots.set(value, {});
+  return value;
 }
 
 function loadManifest(projectDir) {
@@ -29,6 +33,7 @@ function loadManifest(projectDir) {
       || !parsed.entries || typeof parsed.entries !== 'object' || Array.isArray(parsed.entries)) {
     throw new WorktreeError('INVALID_WORKTREE_MANIFEST', 'Unsupported or malformed checkout manifest.');
   }
+  snapshots.set(parsed, JSON.parse(JSON.stringify(parsed.entries)));
   return parsed;
 }
 
@@ -58,9 +63,18 @@ function absolutePath(projectDir, relative) {
 }
 
 async function saveManifest(projectDir, manifest) {
-  manifest.schema_version = MANIFEST_SCHEMA_VERSION;
-  manifest.updated_at = new Date().toISOString();
-  await writeJsonAtomic(manifestPath(projectDir), manifest);
+  const before = snapshots.get(manifest) || {};
+  await withManifestLock(projectDir, async () => {
+    const fresh = loadManifest(projectDir);
+    for (const key of new Set([...Object.keys(before), ...Object.keys(manifest.entries)])) {
+      if (JSON.stringify(before[key]) === JSON.stringify(manifest.entries[key])) continue;
+      if (manifest.entries[key] === undefined) delete fresh.entries[key];
+      else fresh.entries[key] = manifest.entries[key];
+    }
+    fresh.updated_at = new Date().toISOString();
+    await writeJsonAtomic(manifestPath(projectDir), fresh);
+    snapshots.set(manifest, JSON.parse(JSON.stringify(manifest.entries)));
+  });
 }
 
 module.exports = {

package/src/worktree/status.js

@@ -102,14 +102,16 @@ async function inspectRemoteCheckouts(projectDir, options = {}) {
     ? { client: options.client || {}, tools: options.tools || [] }
     : await openMetadataSession(config, options);
   const entries = options.entries || Object.values(manifest.entries);
-  return Promise.all(entries.map(async (entry) => {
+  const { mapBounded } = require('../mcp/parallel');
+  return mapBounded(entries, async (entry) => {
     const remote = await backend.resolveMetadata(config, entry.resource_type, entry.resource_id, {
       ...options,
       ...session,
+      projectDir,
       clientInitialized: true,
     });
     return inspectEntry(projectDir, entry, remote);
-  }));
+  }, options);
 }
 
 module.exports = {