@agentconnect.md/daemon 1.0.0-rc.201 → 1.0.0-rc.203

package/dist/index.js

@@ -15,7 +15,7 @@ import { randomBytes, randomUUID } from "node:crypto";
 import { Readable, Writable } from "node:stream";
 import { lstat, open, readdir, realpath, stat as stat$1 } from "node:fs/promises";
 import { DatabaseSync } from "node:sqlite";
-import net from "node:net";
+import net, { createServer } from "node:net";
 //#region \0rolldown/runtime.js
 var __create = Object.create;
 var __defProp$1 = Object.defineProperty;
@@ -7709,6 +7709,7 @@ const AgentSchema = object({
 		path: string(),
 		gitRepo: string().optional(),
 		gitBranch: string().default("main"),
+		gitCredential: _enum(["github-app"]).optional(),
 		pullOnNewSession: boolean().default(true),
 		skills: array(string()).default([])
 	}),
@@ -13047,7 +13048,8 @@ const AgentWorkspace = discriminatedUnion("mode", [object({ mode: literal("scrat
 	mode: literal("github"),
 	gitRepo: string(),
 	branch: string().default("main"),
-	agentDir: string().optional()
+	agentDir: string().optional(),
+	gitCredential: _enum(["github-app"]).optional()
 })]);
 /**
 * The editable agent definition the CP owns and the daemon needs to run it:
@@ -13226,6 +13228,45 @@ const RegisterOk = object({
 	})
 });
 //#endregion
+//#region ../protocol/dist/frames/gitcred.js
+/**
+* Git credentials (github-app workspaces) — daemon-pulled, CP-minted.
+*
+* The CP holds the GitHub App private key and mints short-lived (1h,
+* non-renewable) installation access tokens scoped to a single repository;
+* the daemon pulls one on demand right before a remote git operation and
+* holds it in memory only. Unlike `secrets/*` (lease + reference semantics,
+* still unwired), the grant here carries the TOKEN MATERIAL itself — same
+* plaintext-over-TLS-WS posture as `integration/upsert`, and the same
+* discipline: **never log the payload**.
+*
+* The daemon may only name an agentId — the CP resolves agent → workspace →
+* repo → installation itself, so a daemon can never pick a repo it wasn't
+* assigned. Failures come back as correlated `error` REPs: `SCOPE_DENIED`
+* (not a github-app workspace, or agent not placed on this daemon — stop
+* asking), `LEASE_DENIED` (installation uninstalled/suspended or the repo
+* left its grant set — recoverable only by an operator), `RATE_LIMITED`,
+* `INTERNAL`.
+*/
+const GitCredRequest = object({
+	agentId: string().uuid(),
+	reason: _enum([
+		"clone",
+		"fetch",
+		"pull",
+		"push",
+		"helper"
+	]).optional()
+});
+const GitCredGrant = object({
+	username: literal("x-access-token"),
+	token: string(),
+	ttlSec: number().int(),
+	expiresAt: string().datetime(),
+	repoFullName: string(),
+	access: _enum(["read", "write"])
+});
+//#endregion
 //#region ../protocol/dist/frames/session.js
 /**
 * Session read-back (C→D REQ → REP) — the console's on-demand pulls.
@@ -13750,6 +13791,8 @@ const FRAME_SCHEMAS = {
 	"integration/upsert": IntegrationUpsert,
 	"integration/remove": IntegrationRemove,
 	"integration/channels": IntegrationChannels,
+	"gitcred/request": GitCredRequest,
+	"gitcred/grant": GitCredGrant,
 	"secrets/request": SecretsRequest,
 	"secrets/grant": SecretsGrant,
 	"secrets/renew": SecretsRenew,
@@ -13832,6 +13875,8 @@ discriminatedUnion("type", [
 	frame("integration/upsert", FRAME_SCHEMAS["integration/upsert"]),
 	frame("integration/remove", FRAME_SCHEMAS["integration/remove"]),
 	frame("integration/channels", FRAME_SCHEMAS["integration/channels"]),
+	frame("gitcred/request", FRAME_SCHEMAS["gitcred/request"]),
+	frame("gitcred/grant", FRAME_SCHEMAS["gitcred/grant"]),
 	frame("secrets/request", FRAME_SCHEMAS["secrets/request"]),
 	frame("secrets/grant", FRAME_SCHEMAS["secrets/grant"]),
 	frame("secrets/renew", FRAME_SCHEMAS["secrets/renew"]),
@@ -13981,9 +14026,133 @@ function isFrame(type) {
 	return (frame) => frame.type === type;
 }
 //#endregion
+//#region src/workspace/git-injection.ts
+/**
+* Git credential injection (docs/designs/github-app-git-credentials.md
+* §git 操作注入 / §子仓库) — the TWO secret-free channels that point every git
+* process at `agentconnect git-credential`:
+*
+*  1. Repo-local `.git/config` (written once post-clone): covers agent-run git
+*     in the main checkout. Multiple agents can share one checkout — the file
+*     carries the LAST writer's agentId, so channel 2 is authoritative there.
+*  2. Session-env `GIT_CONFIG_GLOBAL` pointing at a generated per-agent
+*     gitconfig (includes the user's real global config first). Inherited by
+*     the WHOLE agent process tree — submodules and nested clones hit OUR
+*     helper (and get a clean denial) instead of leaking to a machine-global
+*     osxkeychain credential. NOT GIT_CONFIG_COUNT: the indexed env vars don't
+*     merge across processes, so any child that sets its own COUNT would
+*     silently drop the reset and reopen the leak.
+*
+* All config values single-quote the shim path (git runs `!`-helpers via
+* `sh -c` — a space in $HOME must not word-split), reset the helper list first
+* (empty entry) and set useHttpPath=true (git strips `path` from credential
+* lookups by default; the reset-list semantics for URL-scoped keys are
+* implementation behavior verified on git ≥2.32 — see the design doc).
+*
+* Everything written here is a POINTER to the daemon — never a secret.
+*/
+/** Module-level init (workspace-manager is functional; mirrors cloneInFlight). */
+let shimPath;
+let runDir;
+let preWarm;
+function initGitInjection(opts) {
+	shimPath = opts.shimPath;
+	runDir = opts.runDir;
+	preWarm = opts.preWarm;
+}
+function quotedHelper(agentId) {
+	if (!shimPath) throw new Error("git credential injection is not initialized");
+	return `!'${shimPath.replaceAll("'", "'\\''")}' --agent ${agentId}`;
+}
+/** The three github.com-scoped config pairs both channels share. */
+function configPairs(agentId) {
+	return [
+		["credential.https://github.com.helper", ""],
+		["credential.https://github.com.helper", quotedHelper(agentId)],
+		["credential.https://github.com.useHttpPath", "true"]
+	];
+}
+/**
+* Env for a DAEMON-RUN git process (clone — no repo config exists yet).
+* Spread over `process.env` by the caller: simple-git's `.env()` REPLACES the
+* child environment (v3.36 verified), a bare object would strip PATH/HOME.
+*/
+function cloneGitEnv(agentId) {
+	const pairs = configPairs(agentId);
+	const env = {
+		GIT_TERMINAL_PROMPT: "0",
+		GIT_ASKPASS: "",
+		SSH_ASKPASS: "",
+		GIT_CONFIG_COUNT: String(pairs.length)
+	};
+	pairs.forEach(([k, v], i) => {
+		env[`GIT_CONFIG_KEY_${i}`] = k;
+		env[`GIT_CONFIG_VALUE_${i}`] = v;
+	});
+	return env;
+}
+/**
+* Session-env channel: (re)write the per-agent gitconfig and return the env to
+* inject into the agent's ACP runtime process. Regenerated on every host spawn
+* (#251 retries rebuild the host ⇒ this re-runs).
+*/
+function sessionGitEnv(agentId) {
+	if (!runDir) throw new Error("git credential injection is not initialized");
+	const dir = join(runDir, "gitcred");
+	mkdirSync(dir, {
+		recursive: true,
+		mode: 448
+	});
+	const file = join(dir, `${agentId}.gitconfig`);
+	writeFileSync(file, [
+		"# agentconnect session git config — regenerated on agent start; NO secrets.",
+		"# Keeps the user global config, then pins github.com credentials to the daemon helper.",
+		"[include]",
+		`\tpath = ${join(homedir(), ".gitconfig")}`,
+		"[credential \"https://github.com\"]",
+		"	helper = ",
+		`\thelper = ${quotedHelper(agentId)}`,
+		"	useHttpPath = true",
+		""
+	].join("\n"), { mode: 420 });
+	return {
+		GIT_CONFIG_GLOBAL: file,
+		GIT_TERMINAL_PROMPT: "0"
+	};
+}
+/** Post-clone: pin the repo-local helper so agent-run git in the checkout works. */
+async function writeRepoHelperConfig(cwd, agentId) {
+	const git = simpleGit(cwd);
+	await git.raw([
+		"config",
+		"--replace-all",
+		"credential.https://github.com.helper",
+		""
+	]);
+	await git.raw([
+		"config",
+		"--add",
+		"credential.https://github.com.helper",
+		quotedHelper(agentId)
+	]);
+	await git.raw([
+		"config",
+		"credential.https://github.com.useHttpPath",
+		"true"
+	]);
+}
+/** Pre-warm hook for workspace-manager (no-op until initialized). */
+async function preWarmGitCred(agentId, reason) {
+	if (!preWarm) return;
+	await preWarm(agentId, reason);
+}
+//#endregion
 //#region src/workspace/workspace-manager.ts
 const PULL_TIMEOUT_MS$1 = 4500;
 const cloneInFlight = /* @__PURE__ */ new Map();
+function usesGithubApp(agent) {
+	return agent.workspace.mode === "git-repo" && agent.workspace.gitCredential === "github-app";
+}
 async function prepareWorkspace(agent) {
 	const cwd = agent.workspace.path;
 	mkdirSync(cwd, { recursive: true });
@@ -13996,9 +14165,15 @@ async function prepareWorkspace(agent) {
 		await cloneRepo(agent);
 		return cwd;
 	}
-	if (agent.workspace.pullOnNewSession) try {
-		await Promise.race([simpleGit(cwd).pull(["--ff-only"]), new Promise((_, rej) => setTimeout(() => rej(/* @__PURE__ */ new Error("pull timeout")), PULL_TIMEOUT_MS$1))]);
-	} catch {}
+	if (agent.workspace.pullOnNewSession) {
+		if (usesGithubApp(agent)) await preWarmGitCred(agent.id, "pull").catch(() => void 0);
+		try {
+			await Promise.race([simpleGit(cwd).env({
+				...process.env,
+				GIT_TERMINAL_PROMPT: "0"
+			}).pull(["--ff-only"]), new Promise((_, rej) => setTimeout(() => rej(/* @__PURE__ */ new Error("pull timeout")), PULL_TIMEOUT_MS$1))]);
+		} catch {}
+	}
 	return cwd;
 }
 /**
@@ -14026,12 +14201,30 @@ async function cloneRepo(agent) {
 	const gitRepo = agent.workspace.gitRepo && normalizeGitUrl(agent.workspace.gitRepo);
 	if (!gitRepo) throw new Error(`workspace clone: agent "${agent.id}" has git-repo mode but no gitRepo configured`);
 	const branch = agent.workspace.gitBranch;
+	const githubApp = usesGithubApp(agent);
 	const p = (async () => {
-		await simpleGit().clone(gitRepo, cwd, [
-			"--branch",
-			branch,
-			"--single-branch"
-		]);
+		if (githubApp) await preWarmGitCred(agent.id, "clone");
+		const git = githubApp ? simpleGit().env({
+			...process.env,
+			...cloneGitEnv(agent.id)
+		}) : simpleGit().env({
+			...process.env,
+			GIT_TERMINAL_PROMPT: "0"
+		});
+		try {
+			await git.clone(gitRepo, cwd, [
+				"--branch",
+				branch,
+				"--single-branch"
+			]);
+		} catch (e) {
+			rmSync(join(cwd, ".git"), {
+				recursive: true,
+				force: true
+			});
+			throw e;
+		}
+		if (githubApp) await writeRepoHelperConfig(cwd, agent.id);
 	})().finally(() => {
 		cloneInFlight.delete(cwd);
 	});
@@ -25259,6 +25452,228 @@ var McpControlServer = class {
 	}
 };
 //#endregion
+//#region src/cp/git-credential.ts
+/** Hand out only while more than this remains (nests under the CP's 15min floor). */
+const HANDOUT_MIN_MS = 600 * 1e3;
+var GitCredUnavailableError = class extends Error {
+	terminal;
+	constructor(message, terminal) {
+		super(message);
+		this.terminal = terminal;
+		this.name = "GitCredUnavailableError";
+	}
+};
+var GitCredentialCache = class {
+	deps;
+	entries = /* @__PURE__ */ new Map();
+	inflight = /* @__PURE__ */ new Map();
+	/** Agents the CP told us to stop asking for (SCOPE_DENIED — moved/mode-off). */
+	denied = /* @__PURE__ */ new Set();
+	monoNow;
+	constructor(deps) {
+		this.deps = deps;
+		this.monoNow = deps.monoNow ?? (() => performance.now());
+	}
+	/** A live credential for the agent's workspace repo — cached, coalesced, or freshly pulled. */
+	async get(agentId, reason) {
+		if (this.denied.has(agentId)) throw new GitCredUnavailableError("control plane denied git credentials for this agent", true);
+		const cached = this.entries.get(agentId);
+		if (cached && cached.expiresAtMono - this.monoNow() > HANDOUT_MIN_MS) return cached;
+		let pending = this.inflight.get(agentId);
+		if (!pending) {
+			pending = this.fetch(agentId, reason).finally(() => this.inflight.delete(agentId));
+			this.inflight.set(agentId, pending);
+		}
+		try {
+			return await pending;
+		} catch (e) {
+			if (cached && cached.expiresAtMono > this.monoNow()) {
+				this.deps.log.warn(`gitcred: refresh failed for agent ${agentId} — serving cached token`);
+				return cached;
+			}
+			throw e;
+		}
+	}
+	/**
+	* Invalidate on rejection. Git calls the helper's `erase` with the failing
+	* credential when the remote refuses it (GitHub revokes instantly on
+	* uninstall/suspend) — matching on the presented password keeps a racing
+	* fresh grant from being wiped by a stale erase.
+	*/
+	invalidate(agentId, presentedPassword) {
+		const entry = this.entries.get(agentId);
+		if (!entry) return;
+		if (presentedPassword !== void 0 && entry.token !== presentedPassword) return;
+		this.entries.delete(agentId);
+	}
+	/** agent/remove: drop the orphaned bearer token with the agent dir. */
+	remove(agentId) {
+		this.entries.delete(agentId);
+		this.denied.delete(agentId);
+	}
+	async fetch(agentId, reason) {
+		let grant;
+		try {
+			grant = await this.deps.request({
+				agentId,
+				reason
+			});
+		} catch (e) {
+			if (e.code === "SCOPE_DENIED") {
+				this.denied.add(agentId);
+				this.entries.delete(agentId);
+				throw new GitCredUnavailableError(e.message, true);
+			}
+			throw new GitCredUnavailableError(e.message, false);
+		}
+		const entry = {
+			username: grant.username,
+			token: grant.token,
+			repoFullName: grant.repoFullName,
+			access: grant.access,
+			expiresAtMono: this.monoNow() + grant.ttlSec * 1e3
+		};
+		this.entries.set(agentId, entry);
+		return entry;
+	}
+	/** A replicated spec change may re-enable a previously denied agent. */
+	clearDenied(agentId) {
+		this.denied.delete(agentId);
+	}
+};
+//#endregion
+//#region src/cp/gitcred-server.ts
+/**
+* gitcred.sock — the local credential channel for agent-run git
+* (docs/designs/github-app-git-credentials.md §本地 helper 通道).
+*
+* A tiny newline-delimited-JSON server over a unix socket (0700 dir + 0600
+* socket, stale-socket cleanup — the `mcp/control-server.ts` pattern). The
+* `agentconnect git-credential` CLI subcommand connects per git invocation:
+*   { op: 'get',   agentId }            → { ok, username, password } | { ok:false, error }
+*   { op: 'erase', agentId, password? } → { ok: true }
+*
+* Trust model (design §信任模型 #1): same host + same OS user = ONE trust
+* domain. `agentId` here is routing, not authorization — any same-user process
+* can already read every workspace on this daemon. Tokens transit the socket
+* and helper stdout only; nothing lands on disk.
+*
+* Alongside the socket the daemon (re)writes two SECRET-FREE files per boot:
+* the shim `run/git-credential-helper.sh` (pins the current node + CLI path so
+* `.git/config` survives daemon upgrades) and per-agent gitconfig includes for
+* the session-env channel (see workspace/git-injection.ts).
+*/
+function gitcredSocketPath(root) {
+	return join(root, "run", "gitcred.sock");
+}
+function gitcredShimPath(root) {
+	return join(root, "run", "git-credential-helper.sh");
+}
+var GitCredServer = class {
+	cache;
+	path;
+	log;
+	server;
+	constructor(cache, path, log) {
+		this.cache = cache;
+		this.path = path;
+		this.log = log;
+	}
+	start() {
+		const dir = dirname(this.path);
+		mkdirSync(dir, {
+			recursive: true,
+			mode: 448
+		});
+		try {
+			chmodSync(dir, 448);
+		} catch {}
+		rmSync(this.path, { force: true });
+		const server = createServer((sock) => this.serve(sock));
+		server.listen(this.path, () => {
+			try {
+				chmodSync(this.path, 384);
+			} catch {}
+			this.log.info(`gitcred: helper socket at ${this.path}`);
+		});
+		server.on("error", (e) => this.log.warn(`gitcred: socket error: ${e.message}`));
+		this.server = server;
+	}
+	stop() {
+		this.server?.close();
+		rmSync(this.path, { force: true });
+	}
+	serve(sock) {
+		let buf = "";
+		sock.on("data", (chunk) => {
+			buf += chunk.toString("utf8");
+			const nl = buf.indexOf("\n");
+			if (nl === -1) return;
+			const line = buf.slice(0, nl);
+			buf = buf.slice(nl + 1);
+			this.handle(line, sock);
+		});
+		sock.on("error", () => sock.destroy());
+	}
+	async handle(line, sock) {
+		const reply = (msg) => {
+			sock.write(JSON.stringify(msg) + "\n");
+			sock.end();
+		};
+		let req;
+		try {
+			req = JSON.parse(line);
+		} catch {
+			return reply({
+				ok: false,
+				error: "malformed request"
+			});
+		}
+		if (req.op === "erase") {
+			this.cache.invalidate(req.agentId, req.password);
+			return reply({ ok: true });
+		}
+		if (req.op !== "get" || typeof req.agentId !== "string") return reply({
+			ok: false,
+			error: "unsupported op"
+		});
+		try {
+			const cred = await this.cache.get(req.agentId, "helper");
+			return reply({
+				ok: true,
+				username: cred.username,
+				password: cred.token
+			});
+		} catch (e) {
+			return reply({
+				ok: false,
+				error: e instanceof GitCredUnavailableError ? e.message : `git credentials unavailable: ${e.message}`
+			});
+		}
+	}
+};
+/**
+* (Re)write the secret-free shim `.git/config` helper lines exec through. The
+* absolute node + CLI paths are re-pinned every daemon boot, so repo configs
+* keep working across upgrades/relocations. Quoted throughout — a home dir
+* with a space (macOS "/Users/John Smith/…") must not word-split.
+*/
+function writeGitcredShim(root, cliEntry) {
+	const shim = gitcredShimPath(root);
+	mkdirSync(dirname(shim), {
+		recursive: true,
+		mode: 448
+	});
+	writeFileSync(shim, [
+		"#!/bin/sh",
+		"# agentconnect git credential helper shim — regenerated on daemon start; NO secrets.",
+		`AGENTCONNECT_ROOT='${root.replaceAll("'", "'\\''")}' \\`,
+		`  exec '${process.execPath.replaceAll("'", "'\\''")}' '${cliEntry.replaceAll("'", "'\\''")}' git-credential "$@"`,
+		""
+	].join("\n"), { mode: 493 });
+	return shim;
+}
+//#endregion
 //#region src/mcp/inject.ts
 /**
 * Build the `mcpServers` entry that makes the agent harness spawn our stdio
@@ -83706,7 +84121,7 @@ var ReqRep = class {
 		this.ackTimeoutMs = ackTimeoutMs;
 		this.maxTries = maxTries;
 	}
-	request(frame, write) {
+	request(frame, write, opts = {}) {
 		const encoded = JSON.stringify(frame);
 		return new Promise((resolve, reject) => {
 			const entry = {
@@ -83714,25 +84129,40 @@ var ReqRep = class {
 				encoded,
 				resolve,
 				reject,
-				tries: 1
+				tries: 1,
+				maxTries: opts.maxTries ?? this.maxTries
 			};
 			this.pending.set(frame.id, entry);
-			this.arm(entry, write);
-			write(encoded);
+			this.arm(entry, write, opts.ackTimeoutMs ?? this.ackTimeoutMs);
+			try {
+				write(encoded);
+			} catch (e) {
+				this.fail(entry, new WireError("INTERNAL", `send failed: ${e.message}`, true));
+			}
 		});
 	}
-	arm(entry, write) {
+	arm(entry, write, ackTimeoutMs) {
 		entry.timer = this.clock.setTimeout(() => {
 			if (!this.pending.has(entry.id)) return;
-			if (entry.tries >= this.maxTries) {
+			if (entry.tries >= entry.maxTries) {
 				this.pending.delete(entry.id);
-				entry.reject(new WireError("INTERNAL", `no ack after ${this.maxTries} tries for ${entry.id}`, true));
+				entry.reject(new WireError("INTERNAL", `no ack after ${entry.maxTries} tries for ${entry.id}`, true));
 				return;
 			}
 			entry.tries += 1;
-			this.arm(entry, write);
-			write(entry.encoded);
-		}, this.ackTimeoutMs);
+			this.arm(entry, write, ackTimeoutMs);
+			try {
+				write(entry.encoded);
+			} catch (e) {
+				this.fail(entry, new WireError("INTERNAL", `send failed: ${e.message}`, true));
+			}
+		}, ackTimeoutMs);
+	}
+	fail(entry, err) {
+		if (!this.pending.has(entry.id)) return;
+		this.pending.delete(entry.id);
+		if (entry.timer !== void 0) this.clock.clearTimeout(entry.timer);
+		entry.reject(err);
 	}
 	settle(frame) {
 		const corr = frame.corr;
@@ -83939,6 +84369,25 @@ var CpClient = class {
 		const frame = buildEnvelope(type, payload);
 		return this.correlator.request(frame, (e) => this.transport.send(e));
 	}
+	/**
+	* `gitcred/request` (D→C REQ) → grant payload. The FIRST post-handshake
+	* daemon-issued REQ, so unlike the handshake `request()` it is state-GATED:
+	* outside READY/DRAINING it fails immediately (the credential cache degrades
+	* to its unexpired copy or errors) — never queued, never a bare
+	* `transport!.send` on a dead socket. Single send + 10s budget: the default
+	* 5s×5 retransmit would blow every git-side timeout, and CP-side mint
+	* single-flight makes a later fresh request cheap anyway.
+	*/
+	async requestGitCred(payload) {
+		if (this.state !== "READY" && this.state !== "DRAINING" || !this.transport) throw new WireError("INTERNAL", `control plane unreachable (client ${this.state})`, true);
+		const frame = buildEnvelope("gitcred/request", payload);
+		const rep = await this.correlator.request(frame, (e) => this.transport.send(e), {
+			maxTries: 1,
+			ackTimeoutMs: 1e4
+		});
+		if (rep.type !== "gitcred/grant") throw new WireError("INTERNAL", `expected gitcred/grant, got ${rep.type}`, false);
+		return rep.payload;
+	}
 	async onText(text) {
 		const decoded = decodeEnvelope(text);
 		if (!decoded.ok) {
@@ -83972,6 +84421,7 @@ var CpClient = class {
 	}
 	onClose(code, _reason) {
 		this.stopHeartbeat();
+		this.transport = void 0;
 		this.correlator.rejectAll(new WireError("INTERNAL", "connection closed", true));
 		if (code === 4401) {
 			this.fatal = true;
@@ -84623,6 +85073,8 @@ function applySpecFields(raw, spec, opts) {
 		if (ws.mode === "github") {
 			existing.gitRepo = normalizeGitUrl(ws.gitRepo);
 			existing.gitBranch = ws.branch;
+			if (ws.gitCredential !== void 0) existing.gitCredential = ws.gitCredential;
+			else delete existing.gitCredential;
 		}
 		if (opts.creating && existing.path === void 0) existing.path = join(opts.agentDir, "workspace");
 		raw.workspace = existing;
@@ -100698,6 +101150,8 @@ var Daemon = class Daemon {
 	opts;
 	store;
 	mcp;
+	gitCreds;
+	gitCredServer;
 	agents = /* @__PURE__ */ new Map();
 	fileAgents = /* @__PURE__ */ new Map();
 	hosts = /* @__PURE__ */ new Map();
@@ -100812,6 +101266,26 @@ var Daemon = class Daemon {
 		});
 		await this.mcp.start();
 		const cliEntry = process.argv[1] ?? "";
+		this.gitCreds = new GitCredentialCache({
+			request: (payload) => {
+				const client = this.cpClient;
+				if (!client) throw Object.assign(/* @__PURE__ */ new Error("control plane is not connected"), { code: "INTERNAL" });
+				return client.requestGitCred(payload);
+			},
+			log: { warn: (m) => this.log.warn(m) }
+		});
+		initGitInjection({
+			shimPath: writeGitcredShim(root, cliEntry),
+			runDir: join(root, "run"),
+			preWarm: async (agentId, reason) => {
+				await this.gitCreds.get(agentId, reason);
+			}
+		});
+		this.gitCredServer = new GitCredServer(this.gitCreds, gitcredSocketPath(root), {
+			info: (m) => this.log.info(m),
+			warn: (m) => this.log.warn(m)
+		});
+		this.gitCredServer.start();
 		this.sessions = new SessionManager({
 			store: this.store,
 			hostFor: (agentId) => this.ensureHostAsync(agentId),
@@ -101092,7 +101566,8 @@ var Daemon = class Daemon {
 				onUpdate,
 				env: {
 					...agentChildEnv(agent),
-					...cpRuntimeEnv(agent)
+					...cpRuntimeEnv(agent),
+					...agent.workspace.mode === "git-repo" && agent.workspace.gitCredential === "github-app" ? sessionGitEnv(agent.id) : {}
 				},
 				configPrefs: {
 					model: agent.runtimeOverrides?.model,
@@ -102193,8 +102668,14 @@ var Daemon = class Daemon {
 				if (snap.agents.length) this.log.debug(`cp: converged ${snap.agents.length} agent spec(s)`);
 				if (snap.integrations?.length) this.log.debug(`cp: converged ${snap.integrations.length} integration(s)`);
 			},
-			applyAgentUpsert: (agentId, spec) => this.cpAgents?.upsert(agentId, spec),
-			applyAgentRemove: (agentId) => this.cpAgents?.remove(agentId),
+			applyAgentUpsert: (agentId, spec) => {
+				this.gitCreds?.clearDenied(agentId);
+				this.cpAgents?.upsert(agentId, spec);
+			},
+			applyAgentRemove: (agentId) => {
+				this.gitCreds?.remove(agentId);
+				this.cpAgents?.remove(agentId);
+			},
 			applyIntegrationUpsert: (spec) => this.cpIntegrations?.upsert(spec),
 			applyIntegrationRemove: (integrationId) => this.cpIntegrations?.remove(integrationId),
 			upsertCron: (cron) => this.cpCrons.upsert(cron),
@@ -102451,6 +102932,7 @@ var Daemon = class Daemon {
 		for (const c of this.connections) await Promise.resolve(c.stop()).catch((e) => errors.push(e));
 		for (const h of this.hosts.values()) await Promise.resolve(h.stop()).catch((e) => errors.push(e));
 		await Promise.resolve(this.mcp?.stop()).catch((e) => errors.push(e));
+		this.gitCredServer?.stop();
 		this.store?.close();
 		if (errors.length) throw new AggregateError(errors, "stop: partial failure");
 	}
@@ -102720,7 +103202,7 @@ program.command("run").description("Run the daemon in the foreground").action(as
 	}
 });
 program.command("mcp-bridge", { hidden: true }).description("internal: stdio MCP bridge to the running daemon").action(async () => {
-	const { runBridge } = await import("./bridge-NDvTO1zB.js");
+	const { runBridge } = await import("./bridge-C8-TYXsj.js");
 	await runBridge();
 });
 const controller = () => resolveController({ root: program.opts().root });
@@ -102822,10 +103304,14 @@ program.command("login").description("Interactive onboarding: test the Control P
 		process.exit(1);
 	}
 });
+program.command("git-credential").description("Git credential helper backed by the local daemon (github-app workspaces)").requiredOption("--agent <id>", "agent whose workspace credentials to serve").argument("<action>", "git credential action: get | store | erase").action(async (action, opts) => {
+	const { runGitCredential } = await import("./git-credential-DWH0EUV6.js");
+	await runGitCredential(action, opts.agent);
+});
 program.command("agent").description("Inspect local agent directories").command("list").description("List agents discovered under --agents-dir (id, status, runtime, name, dir)").action(async () => {
 	const opts = program.opts();
 	try {
-		const { runAgentList } = await import("./agent-list-CZbaXHPF.js");
+		const { runAgentList } = await import("./agent-list-D-RwgYN7.js");
 		await runAgentList({
 			agentsDir: opts.agentsDir,
 			configPath: opts.config,
@@ -102854,6 +103340,6 @@ program.command("chat [message]").description("Discover an agent under --agents-
 });
 program.parse();
 //#endregion
-export { datetime as C, __toESM as E, unknown as S, __commonJSMin as T, optional as _, loadConfig as a, string as b, array as c, discriminatedUnion as d, intersection as f, object as g, number as h, discoverAgents as i, boolean as l, looseObject as m, encodeFrame as n, _enum as o, literal as p, DAEMON_VERSION as r, _null as s, decodeFrames as t, custom as u, preprocess as v, safeParse$1 as w, union as x, record as y };
+export { union as C, __commonJSMin as D, safeParse$1 as E, __toESM as O, string as S, datetime as T, number as _, discoverAgents as a, preprocess as b, _enum as c, boolean as d, custom as f, looseObject as g, literal as h, DAEMON_VERSION as i, _null as l, intersection as m, decodeFrames as n, loadConfig as o, discriminatedUnion as p, encodeFrame as r, resolveRoot as s, gitcredSocketPath as t, array as u, object as v, unknown as w, record as x, optional as y };
 
 //# sourceMappingURL=index.js.map