@autohq/cli 0.1.88 → 0.1.90

package/dist/agent-bridge.js

@@ -4842,6 +4842,76 @@ var require_websocket_server = __commonJS({
   }
 });
 
+// src/commands/agent-bridge/git-credentials.ts
+import { once } from "events";
+import { chmod, mkdir, readFile, writeFile } from "fs/promises";
+import { createServer } from "http";
+import { homedir } from "os";
+import path from "path";
+var RELAY_PATH = "/git-credential";
+function defaultGitCredentialPortFilePath() {
+  return path.join(homedir(), ".auto", "agent-bridge", "git-credential.json");
+}
+async function startGitCredentialRelay(input) {
+  const fetchImpl = input.fetchImpl ?? fetch;
+  let target = { url: input.url, accessToken: input.accessToken };
+  const server = createServer((request, response) => {
+    if (request.method !== "POST" || request.url !== RELAY_PATH) {
+      response.writeHead(404).end();
+      return;
+    }
+    const chunks = [];
+    request.on("data", (chunk) => chunks.push(chunk));
+    request.on("end", () => {
+      void (async () => {
+        try {
+          const upstream = await fetchImpl(target.url, {
+            method: "POST",
+            headers: {
+              authorization: `Bearer ${target.accessToken}`,
+              "content-type": "application/json"
+            },
+            body: Buffer.concat(chunks).toString("utf8") || "{}"
+          });
+          const body = await upstream.text();
+          response.writeHead(upstream.status, {
+            "content-type": upstream.headers.get("content-type") ?? "application/json"
+          }).end(body);
+        } catch (error51) {
+          response.writeHead(502, { "content-type": "application/json" }).end(
+            JSON.stringify({
+              error: error51 instanceof Error ? error51.message : String(error51)
+            })
+          );
+        }
+      })();
+    });
+  });
+  server.listen(0, "127.0.0.1");
+  await once(server, "listening");
+  server.unref();
+  const address = server.address();
+  if (!address || typeof address !== "object") {
+    server.close();
+    throw new Error("git credential relay failed to bind a loopback port");
+  }
+  const portFilePath = input.portFilePath ?? defaultGitCredentialPortFilePath();
+  await mkdir(path.dirname(portFilePath), { recursive: true });
+  await writeFile(portFilePath, JSON.stringify({ port: address.port }), {
+    mode: 384
+  });
+  await chmod(portFilePath, 384);
+  return {
+    port: address.port,
+    update: (next) => {
+      target = { url: next.url, accessToken: next.accessToken };
+    },
+    close: () => new Promise((resolve) => {
+      server.close(() => resolve());
+    })
+  };
+}
+
 // ../../node_modules/zod/v4/classic/external.js
 var external_exports = {};
 __export(external_exports, {
@@ -5608,10 +5678,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path) {
-  if (!path)
+function getElementAtPath(obj, path2) {
+  if (!path2)
     return obj;
-  return path.reduce((acc, key) => acc?.[key], obj);
+  return path2.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -6020,11 +6090,11 @@ function explicitlyAborted(x2, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path, issues) {
+function prefixIssues(path2, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path);
+    iss.path.unshift(path2);
     return iss;
   });
 }
@@ -6171,16 +6241,16 @@ function flattenError(error51, mapper = (issue2) => issue2.message) {
 }
 function formatError(error51, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error52, path = []) => {
+  const processError = (error52, path2 = []) => {
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path2, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path2, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path2, ...issue2.path]);
       } else {
-        const fullpath = [...path, ...issue2.path];
+        const fullpath = [...path2, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -6207,17 +6277,17 @@ function formatError(error51, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error51, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error52, path = []) => {
+  const processError = (error52, path2 = []) => {
     var _a3, _b2;
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path2, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path2, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path2, ...issue2.path]);
       } else {
-        const fullpath = [...path, ...issue2.path];
+        const fullpath = [...path2, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -6249,8 +6319,8 @@ function treeifyError(error51, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path) {
+  const path2 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path2) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -18942,13 +19012,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path = ref.slice(1).split("/").filter(Boolean);
-  if (path.length === 0) {
+  const path2 = ref.slice(1).split("/").filter(Boolean);
+  if (path2.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path[0] === defsKey) {
-    const key = path[1];
+  if (path2[0] === defsKey) {
+    const key = path2[1];
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -19463,7 +19533,14 @@ var AgentBridgeClaudeConfigSchema = external_exports.object({
 var RuntimeBridgeBootstrapPlaintextSchema = external_exports.object({
   version: external_exports.literal(1),
   outputSeqStart: external_exports.number().int().nonnegative(),
-  claude: AgentBridgeClaudeConfigSchema
+  claude: AgentBridgeClaudeConfigSchema,
+  // Endpoint + run token for the git credential broker. Present only when
+  // the run has GitHub App git mounts; rides the encrypted bootstrap so the
+  // token lives in agent-bridge memory, never on disk.
+  gitCredentials: external_exports.object({
+    url: external_exports.string().trim().min(1),
+    accessToken: external_exports.string().trim().min(1)
+  }).strict().optional()
 }).strict();
 var RuntimeBridgeEncryptedBootstrapSchema = external_exports.object({
   version: external_exports.literal(1),
@@ -19615,6 +19692,8 @@ var AuthScopeSchema = external_exports.enum([
   "secrets:read",
   "secrets:write",
   "secrets:use",
+  "github:mcp",
+  "github:credentials",
   "projects:admin",
   "org:admin"
 ]);
@@ -20657,6 +20736,87 @@ var ConnectionRemoveResponseSchema = external_exports.object({
   message: external_exports.string().trim().min(1)
 });
 
+// ../../packages/schemas/src/github-credentials.ts
+var CreateRunGithubCredentialRequestSchema = external_exports.object({
+  host: external_exports.literal("github.com"),
+  path: external_exports.string().trim().min(1).optional()
+});
+var RunGithubCredentialResponseSchema = external_exports.object({
+  username: external_exports.literal("x-access-token"),
+  password: external_exports.string().min(1),
+  expiresAt: external_exports.string().datetime()
+});
+
+// ../../packages/schemas/src/github-mcp-catalog.ts
+var GITHUB_MCP_TOOL_NAMES = [
+  "actions_get",
+  "actions_list",
+  "actions_run_trigger",
+  "add_comment_to_pending_review",
+  "add_issue_comment",
+  "add_reply_to_pull_request_comment",
+  "create_branch",
+  "create_or_update_file",
+  "create_pull_request",
+  "create_repository",
+  "delete_file",
+  "fork_repository",
+  "get_commit",
+  "get_file_contents",
+  "get_job_logs",
+  "get_label",
+  "get_latest_release",
+  "get_release_by_tag",
+  "get_tag",
+  "issue_read",
+  "issue_write",
+  "list_branches",
+  "list_commits",
+  "list_issue_types",
+  "list_issues",
+  "list_pull_requests",
+  "list_releases",
+  "list_repository_collaborators",
+  "list_tags",
+  "merge_pull_request",
+  "pull_request_read",
+  "pull_request_review_write",
+  "push_files",
+  "search_code",
+  "search_commits",
+  "search_issues",
+  "search_pull_requests",
+  "search_repositories",
+  "sub_issue_write",
+  "update_pull_request",
+  "update_pull_request_branch"
+];
+var GITHUB_MCP_WRITE_TOOLS = [
+  "actions_run_trigger",
+  "add_comment_to_pending_review",
+  "add_issue_comment",
+  "add_reply_to_pull_request_comment",
+  "create_branch",
+  "create_or_update_file",
+  "create_pull_request",
+  "create_repository",
+  "delete_file",
+  "fork_repository",
+  "issue_write",
+  "merge_pull_request",
+  "pull_request_review_write",
+  "push_files",
+  "sub_issue_write",
+  "update_pull_request",
+  "update_pull_request_branch"
+];
+var githubMcpToolNameSet = new Set(
+  GITHUB_MCP_TOOL_NAMES
+);
+var githubMcpWriteToolSet = new Set(
+  GITHUB_MCP_WRITE_TOOLS
+);
+
 // ../../packages/schemas/src/secrets.ts
 var SECRET_ENCRYPTION_ALGORITHM = "AES-256-GCM";
 var SecretEnvNameSchema = external_exports.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/);
@@ -20831,6 +20991,14 @@ var GITHUB_MOUNT_CAPABILITY_LEVELS = [
 var GithubMountCapabilityLevelSchema = external_exports.enum(
   GITHUB_MOUNT_CAPABILITY_LEVELS
 );
+var DEFAULT_GITHUB_MOUNT_CAPABILITIES = {
+  contents: "write",
+  pullRequests: "write",
+  issues: "write",
+  checks: "read",
+  actions: "read",
+  workflows: "none"
+};
 var GitMountAuthSchema = external_exports.discriminatedUnion("kind", [
   external_exports.object({
     kind: external_exports.literal("none")
@@ -20851,14 +21019,7 @@ var GitMountAuthSchema = external_exports.discriminatedUnion("kind", [
       checks: GithubMountCapabilityLevelSchema.default("read"),
       actions: GithubMountCapabilityLevelSchema.default("read"),
       workflows: GithubMountCapabilityLevelSchema.default("none")
-    }).default({
-      contents: "write",
-      pullRequests: "write",
-      issues: "write",
-      checks: "read",
-      actions: "read",
-      workflows: "none"
-    })
+    }).default({ ...DEFAULT_GITHUB_MOUNT_CAPABILITIES })
   })
 ]);
 var GitMountSchema = external_exports.object({
@@ -21009,6 +21170,11 @@ var LocalToolSchema = external_exports.discriminatedUnion(
     error: `Unsupported local tool implementation. Supported implementations: ${LOCAL_TOOL_IMPLEMENTATIONS.join(", ")}`
   }
 );
+var GithubToolSchema = external_exports.object({
+  kind: external_exports.literal("github"),
+  description: external_exports.string().trim().min(1).optional(),
+  tools: external_exports.array(external_exports.enum(GITHUB_MCP_TOOL_NAMES)).min(1).optional()
+});
 var ToolSpecSchema = external_exports.discriminatedUnion("kind", [
   RemoteMcpToolSchema,
   LocalToolSchema
@@ -21058,6 +21224,10 @@ var InlineSessionToolSchema = RemoteMcpToolSchema.extend({
       disabled: external_exports.boolean().optional()
     })
   )
+).or(
+  GithubToolSchema.extend({
+    disabled: external_exports.boolean().optional()
+  })
 );
 var SessionToolRefSchema = InlineSessionToolSchema.or(
   ReferencedSessionToolRefSchema
@@ -21173,17 +21343,17 @@ var TriggerFilterScalarSchema = external_exports.union([
   external_exports.boolean()
 ]);
 var TriggerFilterPathSchema = external_exports.string().refine(
-  (path) => {
-    if (path.length === 0 || path.trim() !== path) {
+  (path2) => {
+    if (path2.length === 0 || path2.trim() !== path2) {
       return false;
     }
-    if (path.startsWith("$.")) {
-      const segments = path.slice(2).split(".");
+    if (path2.startsWith("$.")) {
+      const segments = path2.slice(2).split(".");
       return segments.length > 0 && segments.every(
         (segment) => segment.length > 0 && segment.trim() === segment
       );
     }
-    return !path.includes(".");
+    return !path2.includes(".");
   },
   {
     message: "Trigger filter paths must be a single bare key or use $.path.segments"
@@ -21622,8 +21792,8 @@ function hasAutoAttributionsExists(trigger, expected) {
 function isChatMessageEvent(trigger) {
   return trigger.event.startsWith("chat.message.");
 }
-function hasFilterValue(trigger, path, expected) {
-  return trigger.where?.[path] === expected;
+function hasFilterValue(trigger, path2, expected) {
+  return trigger.where?.[path2] === expected;
 }
 
 // ../../packages/schemas/src/project-resources.ts
@@ -21786,6 +21956,281 @@ var RunDiagnosticEventSchema = external_exports.object({
   createdAt: external_exports.string().datetime()
 });
 
+// ../../packages/schemas/src/session-runs.ts
+var SESSION_RUN_STATUSES = [
+  "queued",
+  "running",
+  "awaiting",
+  "failed",
+  "stopped"
+];
+var SESSION_RUN_DISPLAY_TITLE_MAX_LENGTH = 64;
+var SessionRunStatusSchema = external_exports.enum(SESSION_RUN_STATUSES);
+var SessionRunDisplayTitleSchema = external_exports.string().trim().max(SESSION_RUN_DISPLAY_TITLE_MAX_LENGTH);
+var SESSION_RUN_CHECK_STATUSES = [
+  "queued",
+  "in_progress",
+  "completed"
+];
+var SESSION_RUN_CHECK_CONCLUSIONS = ["success", "failure"];
+var SESSION_RUN_CHECK_TIMEOUT_PHASES = ["begin", "complete"];
+var SessionRunCheckStatusSchema = external_exports.enum(SESSION_RUN_CHECK_STATUSES);
+var SessionRunCheckConclusionSchema = external_exports.enum(
+  SESSION_RUN_CHECK_CONCLUSIONS
+);
+var SessionRunCheckTimeoutPhaseSchema = external_exports.enum(
+  SESSION_RUN_CHECK_TIMEOUT_PHASES
+);
+var ManualSessionRunRequestSchema = external_exports.object({
+  message: external_exports.string().trim().min(1).max(2e4).optional(),
+  interactive: external_exports.boolean().optional()
+});
+var SessionRunArchiveRequestSchema = external_exports.object({
+  archived: external_exports.boolean()
+});
+var SessionRunsArchiveRequestSchema = external_exports.object({
+  run_ids: external_exports.array(SessionRunIdSchema2).min(1).max(100),
+  archived: external_exports.boolean()
+});
+var SessionRunRecordSchema = external_exports.object({
+  id: SessionRunIdSchema2,
+  organizationId: external_exports.string().trim().min(1),
+  projectId: external_exports.string().trim().min(1).nullable(),
+  sessionId: SessionIdSchema,
+  runtimeId: RuntimeIdSchema2.nullable(),
+  status: SessionRunStatusSchema,
+  idempotencyKey: external_exports.string().min(1).nullable(),
+  correlationKey: external_exports.string().nullable(),
+  workflowId: external_exports.string().min(1),
+  displayTitle: SessionRunDisplayTitleSchema,
+  starterActor: AuthActorSchema.nullable(),
+  sessionSnapshot: SessionResourceSchema,
+  profileSnapshot: ProfileResourceSchema,
+  environmentSnapshot: EnvironmentResourceSchema,
+  toolSnapshots: external_exports.array(
+    external_exports.discriminatedUnion("source", [
+      external_exports.object({
+        source: external_exports.literal("inline"),
+        alias: ToolAliasSchema,
+        spec: RemoteMcpToolSchema.or(LocalToolSchema).or(GithubToolSchema)
+      }),
+      external_exports.object({
+        source: external_exports.literal("resource"),
+        alias: ToolAliasSchema,
+        resource: ToolResourceSchema
+      })
+    ])
+  ),
+  input: JsonValueSchema2,
+  createdAt: external_exports.string().datetime(),
+  updatedAt: external_exports.string().datetime(),
+  startedAt: external_exports.string().datetime().nullable(),
+  finishedAt: external_exports.string().datetime().nullable(),
+  archivedAt: external_exports.string().datetime().nullable(),
+  error: JsonValueSchema2.nullable()
+});
+var SessionRunsArchiveResponseSchema = external_exports.object({
+  archived: external_exports.boolean(),
+  runs: external_exports.array(SessionRunRecordSchema)
+});
+
+// ../../packages/schemas/src/run-introspection.ts
+var TruncatedValueSchema = external_exports.object({
+  truncated: external_exports.literal(true),
+  truncatedPreview: external_exports.string(),
+  originalBytes: external_exports.number().int().nonnegative()
+});
+var RunConversationSearchSnippetSchema = external_exports.object({
+  partIndex: external_exports.number().int().nonnegative(),
+  partType: external_exports.string(),
+  /** The search term this snippet was produced for. */
+  query: external_exports.string(),
+  text: external_exports.string()
+});
+var RunConversationSearchMatchSchema = external_exports.object({
+  sequence: external_exports.number().int().nonnegative(),
+  role: ConversationRoleSchema2,
+  kind: ConversationEntryKindSchema2,
+  status: ConversationEntryStatusSchema2,
+  createdAt: external_exports.string().datetime(),
+  /** Which of the requested terms matched this entry. */
+  matchedQueries: external_exports.array(external_exports.string()),
+  /** Total match occurrences across terms in this entry. */
+  matchCount: external_exports.number().int().positive(),
+  snippets: external_exports.array(RunConversationSearchSnippetSchema)
+});
+var RunConversationSearchResponseSchema = external_exports.object({
+  matches: external_exports.array(RunConversationSearchMatchSchema),
+  hasMore: external_exports.boolean(),
+  /**
+   * Sequence of the last candidate entry scanned (not just the last confirmed
+   * match) — pass as `afterSequence` to continue without re-scanning
+   * candidates the match confirmation dropped. Null when nothing was scanned.
+   */
+  nextAfterSequence: external_exports.number().int().nullable()
+});
+var RunToolExchangeSchema = external_exports.object({
+  name: external_exports.string(),
+  callSequence: external_exports.number().int().nonnegative(),
+  resultSequence: external_exports.number().int().nonnegative().nullable(),
+  input: JsonValueSchema2,
+  output: JsonValueSchema2.nullable(),
+  /** Null while the call has no recorded result. */
+  isError: external_exports.boolean().nullable(),
+  /** Result `completedAt` minus call `createdAt`; null without a result. */
+  durationMs: external_exports.number().int().nonnegative().nullable(),
+  startedAt: external_exports.string().datetime(),
+  completedAt: external_exports.string().datetime().nullable()
+});
+var RunToolExchangesResponseSchema = external_exports.object({
+  exchanges: external_exports.array(RunToolExchangeSchema),
+  hasMore: external_exports.boolean(),
+  /**
+   * Sequence bounds of the entries window this page consumed (not just the
+   * returned exchanges) — continue paging with `after`/`before` from these so
+   * filtered-out entries are not re-scanned. Null when nothing was scanned.
+   */
+  nextAfterSequence: external_exports.number().int().nullable(),
+  nextBeforeSequence: external_exports.number().int().nullable()
+});
+var RUN_TRIGGER_DELIVERY_ACTIONS = [
+  "started",
+  "signaled",
+  "dropped",
+  "warned",
+  "errored"
+];
+var RunTriggerDeliveryActionSchema = external_exports.enum(
+  RUN_TRIGGER_DELIVERY_ACTIONS
+);
+var RUN_EVENT_ORIGIN_KINDS = [
+  "internal",
+  "provider_grant",
+  "webhook"
+];
+var RunEventOriginKindSchema = external_exports.enum(RUN_EVENT_ORIGIN_KINDS);
+var RunTriggerDeliveryRecordSchema = external_exports.object({
+  action: RunTriggerDeliveryActionSchema,
+  triggerId: external_exports.string(),
+  eventKey: external_exports.string(),
+  originKind: RunEventOriginKindSchema,
+  occurredAt: external_exports.string().datetime(),
+  receivedAt: external_exports.string().datetime(),
+  deliveredAt: external_exports.string().datetime(),
+  reason: external_exports.string().nullable(),
+  /** Event payload; may be a {@link TruncatedValueSchema} marker. */
+  payload: JsonValueSchema2.optional()
+});
+var RunTriggersResponseSchema = external_exports.object({
+  /** The `started` delivery that spawned the run; null for manual/agent spawns. */
+  spawn: RunTriggerDeliveryRecordSchema.nullable(),
+  /** Who started the run, for manual/CLI/agent spawns. */
+  starter: AuthActorSchema.nullable(),
+  /** Subsequent deliveries against the run, chronological. */
+  deliveries: external_exports.array(RunTriggerDeliveryRecordSchema)
+});
+var RunArtifactRecordSchema = external_exports.object({
+  artifactType: external_exports.string(),
+  externalId: external_exports.string(),
+  payload: JsonValueSchema2,
+  recordedAt: external_exports.string().datetime()
+});
+var RunArtifactsResponseSchema = external_exports.object({
+  artifacts: external_exports.array(RunArtifactRecordSchema)
+});
+var RunTurnSchema = external_exports.object({
+  startSequence: external_exports.number().int().nonnegative(),
+  endSequence: external_exports.number().int().nonnegative(),
+  startedAt: external_exports.string().datetime(),
+  completedAt: external_exports.string().datetime().nullable(),
+  toolCallCount: external_exports.number().int().nonnegative()
+});
+var RunToolStatSchema = external_exports.object({
+  name: external_exports.string(),
+  /** Run-wide call count from the SQL aggregate. */
+  calls: external_exports.number().int().nonnegative(),
+  /**
+   * Derived from the summary's recent-entries window (most recent ~1000
+   * entries), so on very long runs `errors` and `durationMs` can understate
+   * relative to the run-wide `calls`.
+   */
+  errors: external_exports.number().int().nonnegative(),
+  durationMs: external_exports.object({
+    p50: external_exports.number().nonnegative().nullable(),
+    max: external_exports.number().nonnegative().nullable()
+  })
+});
+var RunSummarySchema = external_exports.object({
+  run: external_exports.object({
+    id: SessionRunIdSchema2,
+    sessionName: external_exports.string(),
+    profileName: external_exports.string(),
+    displayTitle: external_exports.string(),
+    status: SessionRunStatusSchema,
+    error: JsonValueSchema2.nullable(),
+    workflowId: external_exports.string(),
+    createdAt: external_exports.string().datetime(),
+    startedAt: external_exports.string().datetime().nullable(),
+    finishedAt: external_exports.string().datetime().nullable(),
+    archivedAt: external_exports.string().datetime().nullable()
+  }),
+  timing: external_exports.object({
+    /** `startedAt - createdAt`; null until the run starts. */
+    queuedMs: external_exports.number().int().nonnegative().nullable(),
+    /** `(finishedAt ?? now) - startedAt`; null until the run starts. */
+    activeMs: external_exports.number().int().nonnegative().nullable(),
+    /** `(finishedAt ?? now) - createdAt`. */
+    totalMs: external_exports.number().int().nonnegative()
+  }),
+  conversation: external_exports.object({
+    entryCount: external_exports.number().int().nonnegative(),
+    firstEntryAt: external_exports.string().datetime().nullable(),
+    lastEntryAt: external_exports.string().datetime().nullable(),
+    countsByKind: external_exports.object({
+      status: external_exports.number().int().nonnegative(),
+      message: external_exports.number().int().nonnegative(),
+      tool_call: external_exports.number().int().nonnegative(),
+      tool_result: external_exports.number().int().nonnegative(),
+      question: external_exports.number().int().nonnegative()
+    }),
+    failedEntryCount: external_exports.number().int().nonnegative(),
+    lastSequence: external_exports.number().int().nonnegative()
+  }),
+  tools: external_exports.array(RunToolStatSchema),
+  /**
+   * True when the run has more conversation entries than the summary's
+   * recent-entries window, meaning per-tool `errors`/`durationMs` (and
+   * `turns`) describe only the most recent slice of the run.
+   */
+  toolStatsWindowed: external_exports.boolean(),
+  trigger: external_exports.object({
+    /** Spawning event key, or "manual" / "agent" for actor-started runs. */
+    spawn: external_exports.string(),
+    signaledCount: external_exports.number().int().nonnegative(),
+    droppedCount: external_exports.number().int().nonnegative()
+  }),
+  artifacts: external_exports.object({
+    count: external_exports.number().int().nonnegative(),
+    types: external_exports.array(external_exports.string())
+  }),
+  /** Derived per-user-message turns, capped to the most recent. */
+  turns: external_exports.array(RunTurnSchema),
+  commands: external_exports.object({
+    total: external_exports.number().int().nonnegative(),
+    byKind: external_exports.record(external_exports.string(), external_exports.number().int().nonnegative()),
+    failed: external_exports.number().int().nonnegative()
+  }),
+  checks: external_exports.array(
+    external_exports.object({
+      name: external_exports.string(),
+      displayName: external_exports.string(),
+      status: SessionRunCheckStatusSchema,
+      conclusion: SessionRunCheckConclusionSchema.nullable(),
+      completedAt: external_exports.string().datetime().nullable()
+    })
+  )
+});
+
 // ../../packages/schemas/src/session-run-commands.ts
 var SESSION_RUN_COMMAND_KINDS = [
   "message",
@@ -22084,84 +22529,6 @@ var RunCommandDispatchSignalPayloadSchema = external_exports.object({
 }).strict();
 var RealtimeRunCursorSchema = external_exports.string().regex(/^rt:(0|[1-9]\d*)$/);
 
-// ../../packages/schemas/src/session-runs.ts
-var SESSION_RUN_STATUSES = [
-  "queued",
-  "running",
-  "awaiting",
-  "failed",
-  "stopped"
-];
-var SESSION_RUN_DISPLAY_TITLE_MAX_LENGTH = 64;
-var SessionRunStatusSchema = external_exports.enum(SESSION_RUN_STATUSES);
-var SessionRunDisplayTitleSchema = external_exports.string().trim().max(SESSION_RUN_DISPLAY_TITLE_MAX_LENGTH);
-var SESSION_RUN_CHECK_STATUSES = [
-  "queued",
-  "in_progress",
-  "completed"
-];
-var SESSION_RUN_CHECK_CONCLUSIONS = ["success", "failure"];
-var SESSION_RUN_CHECK_TIMEOUT_PHASES = ["begin", "complete"];
-var SessionRunCheckStatusSchema = external_exports.enum(SESSION_RUN_CHECK_STATUSES);
-var SessionRunCheckConclusionSchema = external_exports.enum(
-  SESSION_RUN_CHECK_CONCLUSIONS
-);
-var SessionRunCheckTimeoutPhaseSchema = external_exports.enum(
-  SESSION_RUN_CHECK_TIMEOUT_PHASES
-);
-var ManualSessionRunRequestSchema = external_exports.object({
-  message: external_exports.string().trim().min(1).max(2e4).optional(),
-  interactive: external_exports.boolean().optional()
-});
-var SessionRunArchiveRequestSchema = external_exports.object({
-  archived: external_exports.boolean()
-});
-var SessionRunsArchiveRequestSchema = external_exports.object({
-  run_ids: external_exports.array(SessionRunIdSchema2).min(1).max(100),
-  archived: external_exports.boolean()
-});
-var SessionRunRecordSchema = external_exports.object({
-  id: SessionRunIdSchema2,
-  organizationId: external_exports.string().trim().min(1),
-  projectId: external_exports.string().trim().min(1).nullable(),
-  sessionId: SessionIdSchema,
-  runtimeId: RuntimeIdSchema2.nullable(),
-  status: SessionRunStatusSchema,
-  idempotencyKey: external_exports.string().min(1).nullable(),
-  correlationKey: external_exports.string().nullable(),
-  workflowId: external_exports.string().min(1),
-  displayTitle: SessionRunDisplayTitleSchema,
-  starterActor: AuthActorSchema.nullable(),
-  sessionSnapshot: SessionResourceSchema,
-  profileSnapshot: ProfileResourceSchema,
-  environmentSnapshot: EnvironmentResourceSchema,
-  toolSnapshots: external_exports.array(
-    external_exports.discriminatedUnion("source", [
-      external_exports.object({
-        source: external_exports.literal("inline"),
-        alias: ToolAliasSchema,
-        spec: RemoteMcpToolSchema.or(LocalToolSchema)
-      }),
-      external_exports.object({
-        source: external_exports.literal("resource"),
-        alias: ToolAliasSchema,
-        resource: ToolResourceSchema
-      })
-    ])
-  ),
-  input: JsonValueSchema2,
-  createdAt: external_exports.string().datetime(),
-  updatedAt: external_exports.string().datetime(),
-  startedAt: external_exports.string().datetime().nullable(),
-  finishedAt: external_exports.string().datetime().nullable(),
-  archivedAt: external_exports.string().datetime().nullable(),
-  error: JsonValueSchema2.nullable()
-});
-var SessionRunsArchiveResponseSchema = external_exports.object({
-  archived: external_exports.boolean(),
-  runs: external_exports.array(SessionRunRecordSchema)
-});
-
 // ../../packages/schemas/src/temporal.ts
 var ResourceReconciliationScopeSchema = external_exports.object({
   organizationId: external_exports.string().trim().min(1),
@@ -23481,12 +23848,12 @@ function parse4(str) {
   uri.queryKey = queryKey(uri, uri["query"]);
   return uri;
 }
-function pathNames(obj, path) {
-  const regx = /\/{2,9}/g, names = path.replace(regx, "/").split("/");
-  if (path.slice(0, 1) == "/" || path.length === 0) {
+function pathNames(obj, path2) {
+  const regx = /\/{2,9}/g, names = path2.replace(regx, "/").split("/");
+  if (path2.slice(0, 1) == "/" || path2.length === 0) {
     names.splice(0, 1);
   }
-  if (path.slice(-1) == "/") {
+  if (path2.slice(-1) == "/") {
     names.splice(names.length - 1, 1);
   }
   return names;
@@ -24103,7 +24470,7 @@ var protocol2 = Socket.protocol;
 // ../../node_modules/socket.io-client/build/esm-debug/url.js
 var import_debug7 = __toESM(require_src(), 1);
 var debug7 = (0, import_debug7.default)("socket.io-client:url");
-function url2(uri, path = "", loc) {
+function url2(uri, path2 = "", loc) {
   let obj = uri;
   loc = loc || typeof location !== "undefined" && location;
   if (null == uri)
@@ -24137,7 +24504,7 @@ function url2(uri, path = "", loc) {
   obj.path = obj.path || "/";
   const ipv63 = obj.host.indexOf(":") !== -1;
   const host = ipv63 ? "[" + obj.host + "]" : obj.host;
-  obj.id = obj.protocol + "://" + host + ":" + obj.port + path;
+  obj.id = obj.protocol + "://" + host + ":" + obj.port + path2;
   obj.href = obj.protocol + "://" + host + (loc && loc.port === obj.port ? "" : ":" + obj.port);
   return obj;
 }
@@ -25768,8 +26135,8 @@ function lookup(uri, opts) {
   const parsed = url2(uri, opts.path || "/socket.io");
   const source = parsed.source;
   const id = parsed.id;
-  const path = parsed.path;
-  const sameNamespace = cache[id] && path in cache[id]["nsps"];
+  const path2 = parsed.path;
+  const sameNamespace = cache[id] && path2 in cache[id]["nsps"];
   const newConnection = opts.forceNew || opts["force new connection"] || false === opts.multiplex || sameNamespace;
   let io;
   if (newConnection) {
@@ -25837,6 +26204,7 @@ async function runAgentBridgeSocket(options) {
       RUNTIME_BRIDGE_BOOTSTRAP_EVENT,
       createRuntimeBridgeBootstrapListener({
         token: options.token,
+        onBootstrap: options.onBootstrap,
         createHandler: (bootstrap) => options.createHandler({
           emitOutput: (output) => emitOutputWithAck(socket, output),
           claude: bootstrap.claude,
@@ -25935,6 +26303,7 @@ function createRuntimeBridgeBootstrapListener(input) {
       input.writeOutput?.(
         `agent_bridge_bootstrap_decrypted duration_ms=${Date.now() - decryptStartedAt}`
       );
+      await input.onBootstrap?.(bootstrap);
       let handler = input.getHandler();
       if (!handler) {
         handler = input.createHandler(bootstrap);
@@ -46342,21 +46711,21 @@ import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as rea
 import { dirname } from "path";
 var AGENT_BRIDGE_RUNTIME_DIR = "/tmp/auto-bridge-runtime";
 var CLAUDE_SESSION_RESUME_PATH = `${AGENT_BRIDGE_RUNTIME_DIR}/claude-session-id`;
-function fileClaudeSessionResumeStore(path = CLAUDE_SESSION_RESUME_PATH) {
+function fileClaudeSessionResumeStore(path2 = CLAUDE_SESSION_RESUME_PATH) {
   return {
     read(runId) {
-      if (!existsSync2(path)) {
+      if (!existsSync2(path2)) {
         return null;
       }
-      const record2 = parseResumeRecord(readFileSync2(path, "utf8"));
+      const record2 = parseResumeRecord(readFileSync2(path2, "utf8"));
       if (!record2 || record2.runId !== runId) {
         return null;
       }
       return record2.sessionId;
     },
     write(record2) {
-      mkdirSync2(dirname(path), { recursive: true });
-      writeFileSync(path, `${JSON.stringify(record2)}
+      mkdirSync2(dirname(path2), { recursive: true });
+      writeFileSync(path2, `${JSON.stringify(record2)}
 `, "utf8");
     }
   };
@@ -46725,7 +47094,10 @@ function deliveryMessage(delivery) {
 // src/commands/agent-bridge/entrypoint.ts
 async function runAgentBridgeProcess(input) {
   const runAgentBridge = input.runAgentBridge ?? runAgentBridgeClaudeCode;
-  await runAgentBridge(agentBridgeOptionsFromEnv(input));
+  await runAgentBridge({
+    ...agentBridgeOptionsFromEnv(input),
+    onBootstrap: createGitCredentialRelayStarter(input.writeOutput)
+  });
 }
 function agentBridgeOptionsFromEnv(input) {
   return {
@@ -46734,6 +47106,37 @@ function agentBridgeOptionsFromEnv(input) {
     writeOutput: input.writeOutput
   };
 }
+function createGitCredentialRelayStarter(writeOutput) {
+  let relay;
+  let startup;
+  return async (bootstrap) => {
+    const gitCredentials = bootstrap.gitCredentials;
+    if (!gitCredentials) {
+      return;
+    }
+    if (relay) {
+      relay.update(gitCredentials);
+      return;
+    }
+    if (startup) {
+      const started = await startup;
+      started?.update(gitCredentials);
+      return;
+    }
+    startup = startGitCredentialRelay(gitCredentials).then((started) => {
+      relay = started;
+      writeOutput?.(`agent_bridge_git_credential_relay port=${started.port}`);
+      return started;
+    }).catch((error51) => {
+      startup = void 0;
+      writeOutput?.(
+        `agent_bridge_git_credential_relay_failed error=${error51 instanceof Error ? error51.message : String(error51)}`
+      );
+      return void 0;
+    });
+    await startup;
+  };
+}
 function requiredEnv(env, key) {
   const value2 = env[key]?.trim();
   if (!value2) {