@snowyroad/braid 0.97.0 → 0.98.0

package/dist/cli.js

@@ -15,6 +15,7 @@ import {
   SourceBroker,
   WS_MAX_PAYLOAD_BYTES,
   acquireAgentLock,
+  applyWin32Acl,
   assembleHumanFacts,
   assembleRosterFacts,
   assertKeystorePerms,
@@ -59,6 +60,7 @@ import {
   parseCardReply,
   parseRunFlags,
   pinEndpoint,
+  productionWin32Deps,
   readPathWithFallback,
   redeemInvite,
   relayHostSegment,
@@ -66,6 +68,7 @@ import {
   resolveAgentSelection,
   resolveClaudeBinary,
   resolveConfig,
+  resolveCurrentUser,
   resolveIpcProfile,
   resolveKnobs,
   resolveScope,
@@ -85,7 +88,7 @@ import {
   validateRelayWsUrl,
   withAgentGitEnv,
   wsToHttp
-} from "./chunk-2OHYN3KD.js";
+} from "./chunk-3SHZYLWH.js";
 import {
   clampUntrusted,
   externalSourceLabel,
@@ -413,6 +416,10 @@ var ChannelSession = class {
   setHumans(entries) {
     this.humans = entries;
   }
+  /** D15 (git gateway): called with true before a lisa fresh turn and false after it
+   *  (in a finally, so a failed turn still re-enables). The bridge wires it to the
+   *  channel broker's setGitEnabled so critics and builder rounds cannot use git. */
+  onLisaFreshTurn;
   /**
    * Handoff hold (persist-and-catch-up): non-null while the owner is driving the real
    * interactive session. Live messages land HERE instead of the (intentionally stopped)
@@ -592,6 +599,14 @@ ${fence("reactions", formatReactions(msg.reactions))}
    * session or fabricates freshness/usage.
    */
   async runLisaFreshTurn(signal) {
+    this.onLisaFreshTurn?.(true);
+    try {
+      await this.runLisaFreshTurnInner(signal);
+    } finally {
+      this.onLisaFreshTurn?.(false);
+    }
+  }
+  async runLisaFreshTurnInner(signal) {
     if (!this.flow) {
       throw new Error(
         "[braid] lisa fresh-session turn requested but flow routing is unavailable for this session"
@@ -906,11 +921,11 @@ async function elicitCard(converse, agentName, opts = {}) {
   return buildPartialCard(agentName, { description: opts.fallbackDescription ?? "", skills: [] });
 }
 function withTimeout(p, ms) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const t = setTimeout(() => reject(new Error("elicit timeout")), ms);
     p.then((v) => {
       clearTimeout(t);
-      resolve(v);
+      resolve2(v);
     }, (e) => {
       clearTimeout(t);
       reject(e);
@@ -1586,7 +1601,7 @@ function startControlSocket(opts) {
     handleConnection(conn, opts, token, log2);
   });
   server.on("error", (err) => log2(`[braid] control socket server error: ${err.message}`));
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     server.once("error", reject);
     server.listen(opts.sockPath, () => {
       server.removeListener("error", reject);
@@ -1597,7 +1612,7 @@ function startControlSocket(opts) {
         }
       }
       log2(`[braid] control socket listening at ${opts.sockPath}`);
-      resolve({
+      resolve2({
         path: opts.sockPath,
         close: () => new Promise((res) => {
           for (const c of conns) {
@@ -1628,7 +1643,7 @@ function startControlSocket(opts) {
   });
 }
 function requestStatus(sockPath, timeoutMs = 3e3, token) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const c = net.createConnection(sockPath);
     let buf = "";
     let settled = false;
@@ -1662,7 +1677,7 @@ function requestStatus(sockPath, timeoutMs = 3e3, token) {
         finish(() => reject(new Error(`control socket status error: ${String(obj.error)}`)));
         return;
       }
-      finish(() => resolve(obj));
+      finish(() => resolve2(obj));
     });
     c.on("error", (e) => finish(() => reject(e)));
     c.on("close", () => finish(() => reject(new Error("control socket closed before a status line"))));
@@ -1680,7 +1695,7 @@ function socketLive(sockPath, platform = process.platform, timeoutMs = 1e3) {
   if (platform !== "win32") {
     return Promise.resolve(existsSync2(sockPath));
   }
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     let settled = false;
     const done = (live) => {
       if (settled) return;
@@ -1690,7 +1705,7 @@ function socketLive(sockPath, platform = process.platform, timeoutMs = 1e3) {
         c.destroy();
       } catch {
       }
-      resolve(live);
+      resolve2(live);
     };
     const c = net.createConnection(sockPath);
     const timer = setTimeout(() => done(false), timeoutMs);
@@ -1842,7 +1857,7 @@ function startAttachStream(conn, hub, channelId) {
 function startHandoffConversation(conn, ctl, initialChannelId, writeLine, log2) {
   let phase = "selecting";
   let channelId = null;
-  const fail = (error) => {
+  const fail2 = (error) => {
     phase = "closed";
     writeLine({ error });
     conn.end();
@@ -1850,7 +1865,7 @@ function startHandoffConversation(conn, ctl, initialChannelId, writeLine, log2)
   const doOffer = (id) => {
     const res = ctl.offer(id);
     if (!res.ok) {
-      fail(res.error);
+      fail2(res.error);
       return;
     }
     channelId = id;
@@ -1889,14 +1904,14 @@ function startHandoffConversation(conn, ctl, initialChannelId, writeLine, log2)
           return;
         }
         if (!res.ok) {
-          fail(res.error);
+          fail2(res.error);
           return;
         }
         phase = "spec_sent";
         writeLine({ handoff: "spec", ...res.spec });
       }).catch((e) => {
         log2(`[braid] handoff begin failed: ${e.message}`);
-        if (phase !== "closed") fail("begin_failed");
+        if (phase !== "closed") fail2("begin_failed");
       });
       return;
     }
@@ -1915,7 +1930,7 @@ function startHandoffConversation(conn, ctl, initialChannelId, writeLine, log2)
       });
       return;
     }
-    fail("protocol_error");
+    fail2("protocol_error");
   };
 }
 function startRecoverConversation(conn, ctl, writeLine, log2) {
@@ -2448,6 +2463,913 @@ function makeSocketHandoffController(deps) {
   };
 }
 
+// src/gitGateway/gateway.ts
+import { chmodSync as chmodSync4, existsSync as existsSync6, lstatSync as lstatSync4, mkdirSync as mkdirSync5, readFileSync as readFileSync7, unlinkSync as unlinkSync3, writeFileSync as writeFileSync5 } from "fs";
+import { dirname as dirname4, join as join7 } from "path";
+
+// src/gitGateway/git.ts
+import { execFile } from "child_process";
+import { existsSync as existsSync5, lstatSync as lstatSync3, readFileSync as readFileSync6, realpathSync, statSync as statSync2 } from "fs";
+import { delimiter, isAbsolute, join as join6, resolve, sep as sep2 } from "path";
+var HARDENED_CONFIG = [
+  ["core.hooksPath", "/dev/null"],
+  ["core.fsmonitor", "false"],
+  ["core.alternateRefsCommand", ""],
+  ["uploadpack.packObjectsHook", ""],
+  ["protocol.ext.allow", "never"],
+  ["protocol.file.allow", "user"],
+  ["protocol.allow", "user"],
+  ["credential.helper", ""],
+  ["core.askPass", ""],
+  ["core.sshCommand", "/usr/bin/false"],
+  ["safe.directory", "*"]
+];
+var FORBIDDEN_EXTRA = /* @__PURE__ */ new Set(["GIT_EXEC_PATH", "GIT_PROXY_COMMAND", "GIT_DIR", "GIT_WORK_TREE", "GIT_EXTERNAL_DIFF", "GIT_SSH"]);
+function hardenedGitEnv(extra = {}) {
+  const safeExtra = {};
+  for (const [k, v] of Object.entries(extra)) {
+    if (k.startsWith("GIT_CONFIG") || FORBIDDEN_EXTRA.has(k)) continue;
+    safeExtra[k] = v;
+  }
+  const env = {
+    ...safeExtra,
+    PATH: safeExtra.PATH ?? process.env.PATH ?? "/usr/bin:/bin",
+    HOME: safeExtra.HOME ?? process.env.HOME ?? "/",
+    GIT_CONFIG_NOSYSTEM: "1",
+    GIT_CONFIG_GLOBAL: "/dev/null",
+    GIT_TERMINAL_PROMPT: "0",
+    GIT_ASKPASS: "",
+    GCM_INTERACTIVE: "never",
+    GIT_SSH_COMMAND: "/usr/bin/false",
+    GIT_PAGER: "cat",
+    LC_ALL: "C"
+  };
+  HARDENED_CONFIG.forEach(([k, v], i) => {
+    env[`GIT_CONFIG_KEY_${i}`] = k;
+    env[`GIT_CONFIG_VALUE_${i}`] = v;
+  });
+  env.GIT_CONFIG_COUNT = String(HARDENED_CONFIG.length);
+  return env;
+}
+var gitBinary = null;
+function resolveGitBinary() {
+  if (gitBinary) return gitBinary;
+  const candidates = [
+    ...(process.env.PATH ?? "").split(delimiter).filter(Boolean).filter((d) => isAbsolute(d)).map((d) => join6(d, "git")),
+    "/usr/bin/git",
+    "/usr/local/bin/git",
+    "/opt/homebrew/bin/git"
+  ];
+  for (const c of candidates) {
+    try {
+      if (statSync2(c).isFile()) {
+        gitBinary = c;
+        return c;
+      }
+    } catch {
+    }
+  }
+  throw new Error("[git-gateway] git binary not found on PATH or in the usual locations");
+}
+var MAX_OUTPUT = 1024 * 1024;
+async function runGit(args, opts = {}) {
+  for (const a of args) {
+    if (typeof a !== "string") throw new Error("[git-gateway] non-string argv");
+  }
+  const argv = opts.gitDir ? ["--git-dir", opts.gitDir, ...args] : args;
+  return new Promise((resolvePromise, reject) => {
+    const child = execFile(
+      resolveGitBinary(),
+      argv,
+      { cwd: opts.cwd, env: hardenedGitEnv(opts.extraEnv), timeout: opts.timeoutMs ?? 12e4, maxBuffer: MAX_OUTPUT, windowsHide: true, killSignal: "SIGKILL" },
+      (err, stdout, stderr) => {
+        if (err && err.killed) {
+          return reject(new Error(`[git-gateway] git ${args[0] ?? ""} timed out after ${opts.timeoutMs ?? 12e4} ms`));
+        }
+        if (err && typeof err.code !== "number") return reject(err);
+        resolvePromise({ code: err ? Number(err.code) : 0, stdout: String(stdout), stderr: String(stderr) });
+      }
+    );
+    child.stdin?.on("error", () => {
+    });
+    if (opts.input !== void 0) child.stdin?.end(opts.input);
+    else child.stdin?.end();
+  });
+}
+function isInside(child, parent) {
+  return child === parent || child.startsWith(parent.endsWith(sep2) ? parent : parent + sep2);
+}
+function validateWorktree(path2, writableRoots) {
+  let real;
+  try {
+    real = realpathSync(resolve(path2));
+  } catch {
+    return { ok: false, reason: `path does not exist: ${path2}` };
+  }
+  const roots = writableRoots.map((r) => {
+    try {
+      return realpathSync(r);
+    } catch {
+      return resolve(r);
+    }
+  });
+  if (!roots.some((r) => isInside(real, r))) return { ok: false, reason: `path is outside the sandbox's writable set: ${path2}` };
+  const gitDir = join6(real, ".git");
+  let st;
+  try {
+    st = lstatSync3(gitDir);
+  } catch {
+    return { ok: false, reason: `not a git repository (no .git): ${path2}` };
+  }
+  if (!st.isDirectory()) return { ok: false, reason: `.git is a gitfile or symlink, refused: ${path2}` };
+  if (existsSync5(join6(gitDir, "objects", "info", "alternates"))) return { ok: false, reason: ".git/objects/info/alternates present, refused" };
+  let cfg = "";
+  try {
+    cfg = readFileSync6(join6(gitDir, "config"), "utf8");
+  } catch (e) {
+    if (e.code !== "ENOENT") return { ok: false, reason: ".git/config could not be read, refused" };
+  }
+  if (/^\s*\[include(If)?\b/im.test(cfg)) return { ok: false, reason: ".git/config contains an include section, refused" };
+  return { ok: true, gitDir };
+}
+
+// src/gitGateway/gateway.ts
+var BRANCH_RE = /^(?!-)(?!refs\/)(?!.*\.\.)(?!.*\.lock$)(?!HEAD$)[A-Za-z0-9._\/-]{1,200}$/;
+var RISK_PATHS = [/^\.gitmodules$/, /^\.gitattributes$/, /^package\.json$/, /^package-lock\.json$/, /^pnpm-lock\.yaml$/, /^yarn\.lock$/, /^Makefile$/, /^[^/]+\.sh$/, /^\.git[^/]*$/];
+var WORKFLOW_PATH_RE = /^\.github\/workflows\//;
+var GITHUB_API = "https://api.github.com";
+var MERGE_METHODS = /* @__PURE__ */ new Set(["merge", "squash", "rebase"]);
+var LOCAL_TIMEOUT_MS = 12e4;
+var NETWORK_TIMEOUT_MS = 3e5;
+function fail(status, code, text) {
+  return { ok: false, status, code, text };
+}
+function scrub(s) {
+  return s.replace(/gh[pousr]_[A-Za-z0-9_]+|github_pat_[A-Za-z0-9_]+|x-access-token:[^@\s]+/g, "[redacted]");
+}
+function oneLine(s, max = 300) {
+  return scrub(s).replace(/\s+/g, " ").trim().slice(0, max);
+}
+function errText(e) {
+  return oneLine(e instanceof Error ? e.message : String(e));
+}
+function shellQuote(p) {
+  return `'${p.replace(/'/g, `'\\''`)}'`;
+}
+function credentialHelperArgs(credFile) {
+  return ["-c", "credential.helper=", "-c", `credential.helper=store --file=${shellQuote(credFile)}`];
+}
+function safeSegment(s) {
+  return s.replace(/[^a-zA-Z0-9._-]/g, "_");
+}
+function logSafe(s) {
+  return s.replace(/[^A-Za-z0-9._\/-]/g, "?").slice(0, 200) || "-";
+}
+function isAutonomous(g) {
+  return g.mode === "autonomous";
+}
+var CONFIG_INCLUDE_RE = /^\s*\[include(If)?\b/im;
+function readConfig(gitDir) {
+  try {
+    return readFileSync7(join7(gitDir, "config"), "utf8");
+  } catch (e) {
+    if (e.code === "ENOENT") return "";
+    throw e;
+  }
+}
+var GitGateway = class {
+  constructor(deps) {
+    this.deps = deps;
+    this.fetchFn = deps.fetchFn ?? ((...a) => fetch(...a));
+  }
+  deps;
+  /** D15: per-channel disable depth; git is enabled only at depth 0 (overlapping lisa turns nest). */
+  disabledDepth = /* @__PURE__ */ new Map();
+  locks = /* @__PURE__ */ new Map();
+  knownDefault = /* @__PURE__ */ new Map();
+  fetchFn;
+  /** D15: lisa fresh turns (and the critics they spawn) must not use the gateway. */
+  setChannelGitEnabled(channelId, enabled) {
+    const depth = Math.max(0, (this.disabledDepth.get(channelId) ?? 0) + (enabled ? -1 : 1));
+    if (depth === 0) this.disabledDepth.delete(channelId);
+    else this.disabledDepth.set(channelId, depth);
+  }
+  status(channelId, args) {
+    return this.guard("status", () => this.statusInner(channelId, args));
+  }
+  fetch(channelId, args) {
+    return this.guard("fetch", () => this.fetchInner(channelId, args));
+  }
+  async push(channelId, args) {
+    const branch = String(args.branch ?? "");
+    const out = {};
+    const r = await this.guard("push", () => this.pushInner(channelId, branch, args, out));
+    this.log(`push ${out.repo ?? "-"} ${logSafe(branch)} ${out.sha ?? "-"} ${r.ok ? "ok" : `refused:${r.code}`}`);
+    return r;
+  }
+  openPr(channelId, args) {
+    return this.guard("pull request", () => this.openPrInner(channelId, args));
+  }
+  mergePr(channelId, args) {
+    return this.guard("merge", () => this.mergePrInner(channelId, args));
+  }
+  // ---- operations ----
+  async statusInner(channelId, args) {
+    const gate = this.gateChecks(channelId);
+    if (gate) return gate;
+    const grant = await this.singleGrant();
+    if (!grant.ok) return grant;
+    const g = grant.grant;
+    const wt = this.worktree(channelId, args.path);
+    if (!wt.ok) return wt;
+    const opts = { gitDir: wt.gitDir, cwd: wt.path };
+    const br = await this.git(["rev-parse", "--abbrev-ref", "HEAD"], opts);
+    const hd = await this.git(["rev-parse", "--verify", "-q", "HEAD"], opts);
+    const branch = br.code === 0 ? br.stdout.trim() : null;
+    const head = hd.code === 0 ? hd.stdout.trim() : null;
+    let ahead = null;
+    let behind = null;
+    let tracking;
+    if (!head || !branch || branch === "HEAD") {
+      tracking = head ? "HEAD is detached, so there is no braid/<branch> to compare with." : "The worktree has no commits yet.";
+    } else {
+      const ref = `refs/remotes/braid/${branch}`;
+      const has = await this.git(["rev-parse", "--verify", "-q", ref], opts);
+      if (has.code !== 0) {
+        tracking = `There is no fetched copy of braid/${branch}; run braid_git_fetch to compare with the remote.`;
+      } else {
+        const c = await this.git(["rev-list", "--left-right", "--count", `HEAD...${ref}`], opts);
+        const m = /^(\d+)\s+(\d+)/.exec(c.stdout.trim());
+        if (c.code === 0 && m) {
+          ahead = Number(m[1]);
+          behind = Number(m[2]);
+          tracking = `Ahead ${ahead}, behind ${behind} of braid/${branch} (as of the last braid_git_fetch).`;
+        } else {
+          tracking = `Could not compare with braid/${branch}; run braid_git_fetch and try again.`;
+        }
+      }
+    }
+    const repo = `${g.repoOwner}/${g.repoName}`;
+    const mode = isAutonomous(g) ? "autonomous" : "pr-only";
+    const lines = [
+      `Git access: ${repo}, mode ${mode}.`,
+      `Rules: ${this.rulesText(g)}`,
+      `Worktree ${wt.path}: branch ${branch ?? "unknown"}, HEAD ${head ?? "none"}.`,
+      tracking
+    ];
+    return { ok: true, text: lines.join("\n"), data: { repo, mode, branch, head, ahead, behind } };
+  }
+  async fetchInner(channelId, args) {
+    const gate = this.gateChecks(channelId);
+    if (gate) return gate;
+    const grant = await this.singleGrant();
+    if (!grant.ok) return grant;
+    const g = grant.grant;
+    const mirror = this.mirrorPath(g);
+    return this.serialize(mirror, async () => {
+      const gate2 = this.gateChecks(channelId);
+      if (gate2) return gate2;
+      const m = await this.ensureMirror(mirror);
+      if (m) return m;
+      const cred = await this.credentialAndPolicy(g);
+      if (!cred.ok) return cred;
+      const wt = this.worktree(channelId, args.path);
+      if (!wt.ok) return wt;
+      const id = this.identity(wt);
+      if (!id) return this.worktreeChanged("fetch");
+      const remoteUrl = this.remoteUrl(g);
+      const credFile = join7(mirror, ".braid-cred");
+      try {
+        this.writeCredFile(credFile, cred.value.token);
+        const r = await this.git([...credentialHelperArgs(credFile), "fetch", "--quiet", "--no-tags", "--prune", remoteUrl, "+refs/heads/*:refs/remotes/braid/*"], { gitDir: mirror }, true);
+        if (r.code !== 0) return this.remoteRejected(g, r.stderr);
+      } finally {
+        this.removeCredFile(credFile);
+      }
+      if (!this.sameIdentity(wt, id)) return this.worktreeChanged("fetch");
+      const into = await this.git(["fetch", "--quiet", "--no-tags", "--prune", mirror, "+refs/remotes/braid/*:refs/remotes/braid/*"], { gitDir: wt.gitDir, cwd: wt.path }, true);
+      if (into.code !== 0) return fail(502, "fetch_into_worktree_failed", `Fetched ${g.repoOwner}/${g.repoName}, but could not update the worktree's braid refs: ${oneLine(into.stderr)}.`);
+      const list = await this.git(["for-each-ref", "--format=%(refname:short) %(objectname:short=12)", "refs/remotes/braid/"], { gitDir: wt.gitDir, cwd: wt.path });
+      const refs = list.stdout.split("\n").filter(Boolean);
+      const shown = refs.slice(0, 30).join("\n");
+      const more = refs.length > 30 ? `
+(${refs.length - 30} more)` : "";
+      this.log(`fetch ${g.repoOwner}/${g.repoName} ok`);
+      return {
+        ok: true,
+        text: `Fetched ${g.repoOwner}/${g.repoName} into the worktree as remote braid (${refs.length} branches). Rebase onto braid/<branch> before pushing if the remote moved.
+${shown}${more}`,
+        data: { refs: refs.length }
+      };
+    });
+  }
+  /** D8, step by step. */
+  async pushInner(channelId, branch, args, out) {
+    const gate = this.gateChecks(channelId);
+    if (gate) return gate;
+    const grant = await this.singleGrant();
+    if (!grant.ok) return grant;
+    const listed = grant.grant;
+    const repo = `${listed.repoOwner}/${listed.repoName}`;
+    out.repo = repo;
+    const bad = await this.checkBranch(branch);
+    if (bad) return bad;
+    const ns = this.namespace();
+    if (!isAutonomous(listed) && !branch.startsWith(ns)) {
+      const hint = this.knownDefault.get(repo) ?? await this.worktreeDefaultHint(channelId, args.path);
+      return hint === branch ? this.defaultProtected(branch) : this.outsideNamespace();
+    }
+    const mirror = this.mirrorPath(listed);
+    return this.serialize(mirror, async () => {
+      const gate2 = this.gateChecks(channelId);
+      if (gate2) return gate2;
+      const m = await this.ensureMirror(mirror);
+      if (m) return m;
+      const cred = await this.credentialAndPolicy(listed);
+      if (!cred.ok) return cred;
+      const g = cred.grant;
+      const meta = await this.repoMeta(g, cred.value);
+      if (!meta.ok) return meta;
+      const pub = this.publicCheck(g, meta.value);
+      if (pub) return pub;
+      if (!isAutonomous(g)) {
+        if (meta.value.defaultBranch === branch) return this.defaultProtected(branch);
+        if (!branch.startsWith(ns)) return this.outsideNamespace();
+      }
+      const wt = this.worktree(channelId, args.path);
+      if (!wt.ok) return wt;
+      const id = this.identity(wt);
+      if (!id) return this.worktreeChanged("push", mirror);
+      const sha = await this.resolveSha(wt, args.sha ?? "HEAD");
+      if (!sha.ok) return sha;
+      out.sha = sha.sha;
+      if (!this.sameIdentity(wt, id)) return this.worktreeChanged("push", mirror);
+      const inc = await this.git(["fetch", "--quiet", "--no-tags", wt.gitDir, `+${sha.sha}:refs/braid/incoming`], { gitDir: mirror }, true);
+      if (!this.sameIdentity(wt, id)) return this.worktreeChanged("push", mirror);
+      if (inc.code !== 0) return fail(502, "fetch_from_worktree_failed", `Could not read commit ${sha.sha.slice(0, 12)} from the worktree: ${oneLine(inc.stderr)}.`);
+      const remoteUrl = this.remoteUrl(g);
+      const credFile = join7(mirror, ".braid-cred");
+      try {
+        this.writeCredFile(credFile, cred.value.token);
+        const probe = await this.probeRemote(g, mirror, remoteUrl, credFile, branch, meta.value.defaultBranch);
+        if (!probe.ok) return probe;
+        if (!isAutonomous(g) && probe.value.defaultBranch === branch) return this.defaultProtected(branch);
+        if (probe.value.branchExists) {
+          const ff = await this.fastForwardCheck(mirror, branch);
+          if (ff) return ff;
+        }
+        const policy = await this.policyDiff(g, mirror, probe.value.branchExists);
+        if (policy) return policy;
+        if (!this.sameIdentity(wt, id)) return this.worktreeChanged("push", mirror);
+        const pushed = await this.git([...credentialHelperArgs(credFile), "push", "--quiet", "--no-verify", remoteUrl, `refs/braid/incoming:refs/heads/${branch}`], { gitDir: mirror }, true);
+        if (pushed.code !== 0) {
+          if (/\b(401|403)\b|Authentication failed|could not read Username/i.test(pushed.stderr)) this.deps.resolver.dropCredential(listed);
+          return fail(502, "push_failed", `GitHub rejected the push: ${oneLine(pushed.stderr)}. Run braid_git_fetch and braid_git_status, then try again.`);
+        }
+        return {
+          ok: true,
+          text: `Pushed ${sha.sha.slice(0, 12)} to ${repo} branch ${branch}.
+Compare: https://github.com/${repo}/compare/${encodeURIComponent(branch)}`,
+          data: { branch, sha: sha.sha }
+        };
+      } finally {
+        this.removeCredFile(credFile);
+      }
+    });
+  }
+  async openPrInner(channelId, args) {
+    const gate = this.gateChecks(channelId);
+    if (gate) return gate;
+    const grant = await this.singleGrant();
+    if (!grant.ok) return grant;
+    const branch = String(args.branch ?? "");
+    const badHead = await this.checkBranch(branch);
+    if (badHead) return badHead;
+    const title = String(args.title ?? "").trim();
+    if (!title) return fail(400, "invalid_title", "A pull request needs a non-empty title.");
+    if (args.base !== void 0) {
+      const badBase = await this.checkBranch(String(args.base));
+      if (badBase) return badBase;
+    }
+    const cred = await this.credentialAndPolicy(grant.grant);
+    if (!cred.ok) return cred;
+    const g = cred.grant;
+    const meta = await this.repoMeta(g, cred.value);
+    if (!meta.ok) return meta;
+    const pub = this.publicCheck(g, meta.value);
+    if (pub) return pub;
+    const base = args.base ?? meta.value.defaultBranch;
+    if (!base) return fail(502, "default_branch_unknown", "Could not learn the repository's default branch; pass base explicitly.");
+    const draft = !isAutonomous(g);
+    const body = { title, ...args.body !== void 0 ? { body: String(args.body) } : {}, head: branch, base, draft };
+    const res = await this.api(grant.grant, cred.value.token, "POST", `/repos/${this.repoPath(g)}/pulls`, body);
+    if (!res.ok) return res;
+    const num = res.json.number;
+    const url = res.json.html_url;
+    this.log(`pr-open ${g.repoOwner}/${g.repoName} ${logSafe(branch)} #${String(num)} ok`);
+    return {
+      ok: true,
+      text: `Opened ${draft ? "draft " : ""}pull request #${String(num)} from ${branch} into ${base}: ${String(url)}${draft ? "\nThis repo is in pr-only mode, so a human reviews and merges it." : ""}`,
+      data: { number: num, url }
+    };
+  }
+  async mergePrInner(channelId, args) {
+    const gate = this.gateChecks(channelId);
+    if (gate) return gate;
+    const grant = await this.singleGrant();
+    if (!grant.ok) return grant;
+    const num = Number(args.number);
+    if (!Number.isInteger(num) || num <= 0) return fail(400, "invalid_number", "Pass the pull request number as a positive integer.");
+    const method = args.method ?? "squash";
+    if (!MERGE_METHODS.has(method)) return fail(400, "invalid_method", "The merge method must be merge, squash or rebase.");
+    if (!isAutonomous(grant.grant)) return this.mergeRefused(num);
+    const cred = await this.credentialAndPolicy(grant.grant);
+    if (!cred.ok) return cred;
+    const g = cred.grant;
+    if (!isAutonomous(g)) return this.mergeRefused(num);
+    const meta = await this.repoMeta(g, cred.value);
+    if (!meta.ok) return meta;
+    const pub = this.publicCheck(g, meta.value);
+    if (pub) return pub;
+    const res = await this.api(grant.grant, cred.value.token, "PUT", `/repos/${this.repoPath(g)}/pulls/${num}/merge`, { merge_method: method });
+    if (!res.ok) return res;
+    const sha = String(res.json.sha ?? "");
+    this.log(`pr-merge ${g.repoOwner}/${g.repoName} #${num} ok`);
+    return { ok: true, text: `Pull request #${num} in ${g.repoOwner}/${g.repoName} merged ${sha} (${method}).`, data: { number: num, sha } };
+  }
+  // ---- push pipeline steps ----
+  /** D8.5: one ls-remote learns whether the branch exists (and proves the token works);
+   *  then the branch, or for a new branch the default branch, is fetched into the mirror. */
+  async probeRemote(g, mirror, remoteUrl, credFile, branch, knownDefault) {
+    const ls = await this.git([...credentialHelperArgs(credFile), "ls-remote", "--symref", remoteUrl, "HEAD", `refs/heads/${branch}`], { gitDir: mirror }, true);
+    if (ls.code !== 0) return this.remoteRejected(g, ls.stderr);
+    const branchExists = ls.stdout.split("\n").some((l) => l.endsWith(`	refs/heads/${branch}`));
+    const symref = /^ref: refs\/heads\/(\S+)\tHEAD$/m.exec(ls.stdout);
+    const defaultBranch = knownDefault ?? (symref ? symref[1] : null);
+    if (defaultBranch) this.knownDefault.set(`${g.repoOwner}/${g.repoName}`, defaultBranch);
+    await this.git(["update-ref", "-d", "refs/braid/remote"], { gitDir: mirror });
+    await this.git(["update-ref", "-d", "refs/braid/base"], { gitDir: mirror });
+    const specs = [];
+    if (branchExists) specs.push(`+refs/heads/${branch}:refs/braid/remote`);
+    else if (defaultBranch && BRANCH_RE.test(defaultBranch)) specs.push(`+refs/heads/${defaultBranch}:refs/braid/base`);
+    if (specs.length > 0) {
+      const rf = await this.git([...credentialHelperArgs(credFile), "fetch", "--quiet", "--no-tags", remoteUrl, ...specs], { gitDir: mirror }, true);
+      if (rf.code !== 0) return this.remoteRejected(g, rf.stderr);
+    }
+    return { ok: true, value: { branchExists, defaultBranch } };
+  }
+  /** D8.6: never --force; the remote tip must be an ancestor of what we push. */
+  async fastForwardCheck(mirror, branch) {
+    const ff = await this.git(["merge-base", "--is-ancestor", "refs/braid/remote", "refs/braid/incoming"], { gitDir: mirror });
+    if (ff.code === 0) return null;
+    return fail(409, "not_fast_forward", `Remote ${branch} has commits you do not have. Run braid_git_fetch, rebase onto braid/${branch}, then push again.`);
+  }
+  /** D8.8 (ruling R12): the changed paths, against the remote branch when it exists,
+   *  else against the merge-base with the default branch, else (orphan) the empty tree. */
+  async policyDiff(g, mirror, branchExists) {
+    const base = branchExists ? "refs/braid/remote" : await this.newBranchBase(mirror);
+    if (!base) return fail(502, "diff_failed", "Could not compute what this push changes; try again.");
+    const diff = await this.git(["diff", "--no-renames", "--name-only", "-z", base, "refs/braid/incoming", "--"], { gitDir: mirror });
+    if (diff.code !== 0) return fail(502, "diff_failed", `Could not compute what this push changes: ${oneLine(diff.stderr)}.`);
+    const files = diff.stdout.split("\0").filter(Boolean);
+    if (!g.allowWorkflows && files.some((f) => WORKFLOW_PATH_RE.test(f))) return fail(403, "workflows_not_allowed", "This push changes .github/workflows and the grant does not allow workflow changes. Remove those changes, or ask the owner to enable workflow changes on the grant.");
+    const risky = files.filter((f) => RISK_PATHS.some((re) => re.test(f)));
+    if (!isAutonomous(g) && !g.allowRiskPaths && risky.length > 0) return fail(403, "risk_path_needs_approval", `This push touches files the owner must approve in pr-only mode (${risky.slice(0, 20).join(", ")}). Remove those changes, or ask the owner to enable "risky file changes" on the grant.`);
+    return null;
+  }
+  async newBranchBase(mirror) {
+    const has = await this.git(["rev-parse", "--verify", "-q", "refs/braid/base"], { gitDir: mirror });
+    if (has.code === 0) {
+      const mb = await this.git(["merge-base", "refs/braid/base", "refs/braid/incoming"], { gitDir: mirror });
+      const sha = mb.stdout.trim();
+      if (mb.code === 0 && sha) return sha;
+    }
+    const empty = await this.git(["hash-object", "-t", "tree", "--stdin"], { gitDir: mirror, input: "" });
+    return empty.code === 0 ? empty.stdout.trim() : null;
+  }
+  // ---- helpers ----
+  git(args, opts, network = false) {
+    return runGit(args, { ...opts, timeoutMs: this.deps.gitTimeoutMs ?? (network ? NETWORK_TIMEOUT_MS : LOCAL_TIMEOUT_MS) });
+  }
+  /** G11: a thrown git or network failure still comes back as a sentence. */
+  async guard(op, fn) {
+    try {
+      return await fn();
+    } catch (e) {
+      return fail(502, "git_failed", `The ${op} could not finish because a git or network step failed (${errText(e)}). Try again; if it keeps failing, tell the owner.`);
+    }
+  }
+  gateChecks(channelId) {
+    if (this.disabledDepth.has(channelId)) return fail(403, "git_disabled_for_turn", "Git tools are disabled for this turn. Describe the change in your reply instead, and a later turn can push it.");
+    return null;
+  }
+  /** D7: one grant per agent for now; the repo is never chosen by the model. */
+  async singleGrant() {
+    let grants;
+    try {
+      grants = await this.deps.resolver.listGrants();
+    } catch (e) {
+      return fail(502, "grants_unavailable", `Could not load this agent's git grants (${errText(e)}). Try again in a minute.`);
+    }
+    if (grants.length === 0) return fail(404, "no_grant", `No git grant for this agent. Your owner can add one under Agents > ${this.deps.agentName} > Git access.`);
+    if (grants.length > 1) return fail(409, "multiple_grants", `This agent has ${grants.length} git grants, and the gateway supports exactly one today. Ask the owner to keep one repository under Agents > ${this.deps.agentName} > Git access.`);
+    return { ok: true, grant: grants[0] };
+  }
+  /** Credential plus the effective policy. When the listed grant is LOOSER than the
+   *  policy the cached mint carries (the owner loosened the grant after the mint), the
+   *  cached credential is dropped and re-minted once so the loosening takes effect now
+   *  instead of at the next scheduled re-mint; the result is still combined
+   *  most-restrictively, so a relay that really is tighter keeps winning. */
+  async credentialAndPolicy(g) {
+    let cred = await this.credential(g);
+    if (!cred.ok) return cred;
+    if (cred.value.policy && this.looser(g, cred.value.policy)) {
+      this.deps.resolver.dropCredential(g);
+      cred = await this.credential(g);
+      if (!cred.ok) return cred;
+    }
+    const pol = this.effectivePolicy(g, cred.value);
+    if (!pol.ok) return pol;
+    return { ok: true, value: cred.value, grant: pol.grant };
+  }
+  looser(g, p) {
+    return isAutonomous(g) && p.mode !== "autonomous" || g.allowWorkflows && !p.allowWorkflows || g.allowRiskPaths && !p.allowRiskPaths || g.allowPublic && !p.allowPublic;
+  }
+  /** The mint's policy and the listed grant are combined most-restrictively, so a
+   *  tightening seen by either source takes effect at once. The repos must agree. */
+  effectivePolicy(g, cred) {
+    const p = cred.policy;
+    if (!p) return { ok: true, grant: g };
+    if (p.repo.toLowerCase() !== `${g.repoOwner}/${g.repoName}`.toLowerCase()) {
+      this.deps.resolver.dropCredential(g);
+      return fail(502, "credential_unavailable", `The token minted for this agent's grant does not match ${g.repoOwner}/${g.repoName}, so it was not used. Try again in a minute; if it keeps failing, ask the owner to check Git access for this agent.`);
+    }
+    return {
+      ok: true,
+      grant: {
+        ...g,
+        mode: isAutonomous(g) && p.mode === "autonomous" ? "autonomous" : "pr-only",
+        allowWorkflows: g.allowWorkflows && p.allowWorkflows,
+        allowRiskPaths: g.allowRiskPaths && p.allowRiskPaths,
+        allowPublic: g.allowPublic && p.allowPublic
+      }
+    };
+  }
+  /** Validates the model-supplied path, then uses only the realpath-resolved location. */
+  worktree(channelId, path2) {
+    const p = path2 ?? this.deps.cwdFor(channelId);
+    const v = validateWorktree(p, this.deps.writableRoots());
+    if (!v.ok) return fail(400, "invalid_path", `That path cannot be used for git (${v.reason}). Pass the path of a git checkout inside your working directory, or omit path to use the session directory.`);
+    return { ok: true, path: dirname4(v.gitDir), gitDir: v.gitDir };
+  }
+  /** R13: what must not change between validation and the last use of the worktree. */
+  identity(wt) {
+    try {
+      const d = lstatSync4(wt.path);
+      const gd = lstatSync4(wt.gitDir);
+      if (!d.isDirectory() || !gd.isDirectory()) return null;
+      if (existsSync6(join7(wt.gitDir, "objects", "info", "alternates"))) return null;
+      if (CONFIG_INCLUDE_RE.test(readConfig(wt.gitDir))) return null;
+      return { dirDev: d.dev, dirIno: d.ino, gitDev: gd.dev, gitIno: gd.ino };
+    } catch {
+      return null;
+    }
+  }
+  sameIdentity(wt, before) {
+    const now = this.identity(wt);
+    return !!before && !!now && before.dirDev === now.dirDev && before.dirIno === now.dirIno && before.gitDev === now.gitDev && before.gitIno === now.gitIno;
+  }
+  async worktreeChanged(op, mirror) {
+    if (mirror) await this.git(["update-ref", "-d", "refs/braid/incoming"], { gitDir: mirror });
+    return fail(400, "invalid_path", `The worktree changed while the ${op} was running (its .git was replaced or gained alternates), so nothing was ${op === "push" ? "pushed" : "fetched into it"}. Make sure nothing else is modifying the repository, then try again.`);
+  }
+  /** Only a refusal-text hint: the worktree's origin/HEAD, if the path validates. */
+  async worktreeDefaultHint(channelId, path2) {
+    const wt = this.worktree(channelId, path2);
+    if (!wt.ok) return null;
+    const r = await this.git(["symbolic-ref", "-q", "--short", "refs/remotes/origin/HEAD"], { gitDir: wt.gitDir, cwd: wt.path });
+    const s = r.stdout.trim();
+    return r.code === 0 && s.startsWith("origin/") ? s.slice("origin/".length) : null;
+  }
+  async credential(g) {
+    try {
+      return { ok: true, value: await this.deps.resolver.credentialFor(g) };
+    } catch (e) {
+      return fail(502, "credential_unavailable", `Could not get a GitHub credential for ${g.repoOwner}/${g.repoName} (${errText(e)}). Try again in a minute; if it keeps failing, ask the owner to check Git access for this agent.`);
+    }
+  }
+  /** Visibility and default branch: from the mint for app grants; looked up for a PAT. */
+  async repoMeta(g, cred) {
+    let meta;
+    if (cred.private !== null && cred.defaultBranch) {
+      meta = { private: cred.private, defaultBranch: cred.defaultBranch };
+    } else {
+      const res = await this.api(g, cred.token, "GET", `/repos/${this.repoPath(g)}`);
+      if (!res.ok) return res;
+      const j = res.json;
+      meta = {
+        private: cred.private ?? (typeof j.private === "boolean" ? j.private : null),
+        defaultBranch: cred.defaultBranch ?? (typeof j.default_branch === "string" ? j.default_branch : null)
+      };
+    }
+    if (meta.defaultBranch) this.knownDefault.set(`${g.repoOwner}/${g.repoName}`, meta.defaultBranch);
+    return { ok: true, value: meta };
+  }
+  /** D9: fail closed when visibility is unknown. */
+  publicCheck(g, meta) {
+    if (meta.private === true || g.allowPublic) return null;
+    const why = meta.private === false ? "is public" : "has unknown visibility";
+    return fail(403, "public_repo_not_allowed", `${g.repoOwner}/${g.repoName} ${why}, and the grant does not allow writes to public repositories. Ask the owner to allow public repositories on the grant if this is intended.`);
+  }
+  /** D8.2: the regex, then git's own rules (trailing "/", "//", trailing ".", "/.x", "@{"). */
+  async checkBranch(branch) {
+    const bad = fail(400, "invalid_branch", `Branch name "${branch.slice(0, 200)}" is not allowed. Use letters, digits, ".", "_", "-" and "/", without "..", "//", a leading "-", a trailing "/" or ".", a component starting with ".", a ".lock" suffix, a "refs/" prefix, or the name HEAD.`);
+    if (!BRANCH_RE.test(branch)) return bad;
+    const r = await this.git(["check-ref-format", "--branch", branch], {});
+    return r.code === 0 ? null : bad;
+  }
+  defaultProtected(branch) {
+    return fail(403, "default_branch_protected", `"${branch}" is the default branch; pr-only mode never pushes there. Push to a branch under ${this.namespace()} and open a pull request instead.`);
+  }
+  outsideNamespace() {
+    const ns = this.namespace();
+    return fail(403, "branch_outside_namespace", `This repo is in pr-only mode: push only to branches under ${ns} (for example ${ns}my-change). A human merges from a pull request.`);
+  }
+  mergeRefused(num) {
+    return fail(403, "merge_not_allowed_in_pr_only", `This repo is in pr-only mode, so a human merges pull request #${num}. Tell the owner it is ready for review.`);
+  }
+  namespace() {
+    return `braid/${this.deps.agentName}/`;
+  }
+  rulesText(g) {
+    const parts = [];
+    const auto = isAutonomous(g);
+    if (!auto) parts.push(`push only to branches under ${this.namespace()}, never the default branch; pull requests open as drafts and a human merges`);
+    else parts.push("push to any branch, including the default branch; braid_merge_pr is allowed");
+    parts.push("fast-forward pushes only, no deletes, no tags");
+    parts.push(g.allowWorkflows ? "changes under .github/workflows are allowed" : "changes under .github/workflows are refused");
+    if (!auto) parts.push(g.allowRiskPaths ? "risky files (package manifests, lockfiles, Makefile, root scripts, .git* files) are allowed" : "risky files (package manifests, lockfiles, Makefile, root scripts, .git* files) need the owner's approval");
+    parts.push(g.allowPublic ? "public repositories are allowed" : "writes to a public repository are refused");
+    return parts.join("; ") + ".";
+  }
+  async resolveSha(wt, rev) {
+    const bad = fail(400, "invalid_sha", `Could not resolve "${String(rev).slice(0, 100)}" to a commit in ${wt.path}. Commit your work first, or pass a commit sha or branch name that exists there.`);
+    if (typeof rev !== "string" || !rev || rev.startsWith("-") || /[\0\n]/.test(rev)) return bad;
+    const r = await this.git(["rev-parse", "--verify", "-q", "--end-of-options", `${rev}^{commit}`], { gitDir: wt.gitDir, cwd: wt.path });
+    const sha = r.stdout.trim();
+    if (r.code !== 0 || !/^[0-9a-f]{40,64}$/.test(sha)) return bad;
+    return { ok: true, sha };
+  }
+  mirrorPath(g) {
+    return join7(this.deps.configDir, "git", relayHostSegment(this.deps.relayUrl), safeSegment(this.deps.agentName), `${safeSegment(g.repoOwner)}__${safeSegment(g.repoName)}.git`);
+  }
+  /** Creates the bare mirror (0700) when absent and removes any stale credential file. */
+  async ensureMirror(mirror) {
+    if (!existsSync6(join7(mirror, "HEAD"))) {
+      mkdirSync5(mirror, { recursive: true, mode: 448 });
+      const r = await this.git(["init", "--bare", "--quiet", mirror], {});
+      if (r.code !== 0) return fail(502, "mirror_init_failed", `Could not prepare the bridge's git mirror: ${oneLine(r.stderr)}.`);
+    }
+    try {
+      chmodSync4(mirror, 448);
+    } catch {
+    }
+    this.removeCredFile(join7(mirror, ".braid-cred"));
+    return null;
+  }
+  remoteUrl(g) {
+    return this.deps.remoteUrlFor ? this.deps.remoteUrlFor(g) : `https://github.com/${this.repoPath(g)}.git`;
+  }
+  repoPath(g) {
+    return `${encodeURIComponent(g.repoOwner)}/${encodeURIComponent(g.repoName)}`;
+  }
+  writeCredFile(file, token) {
+    writeFileSync5(file, `https://x-access-token:${token}@github.com
+`, { mode: 384 });
+    try {
+      chmodSync4(file, 384);
+    } catch {
+    }
+  }
+  removeCredFile(file) {
+    if (!existsSync6(file)) return;
+    try {
+      writeFileSync5(file, "");
+    } catch {
+    }
+    try {
+      unlinkSync3(file);
+    } catch {
+    }
+  }
+  remoteRejected(g, stderr) {
+    this.deps.resolver.dropCredential(g);
+    return fail(502, "remote_rejected", `GitHub refused the request for ${g.repoOwner}/${g.repoName} or could not be reached (${oneLine(stderr, 200)}). The cached token was dropped and a fresh one is minted on the next try; if it keeps failing, ask the owner to check Git access for this agent.`);
+  }
+  async api(g, token, method, path2, body) {
+    let res;
+    try {
+      res = await this.fetchFn(`${GITHUB_API}${path2}`, {
+        method,
+        headers: {
+          Authorization: `Bearer ${token}`,
+          Accept: "application/vnd.github+json",
+          "X-GitHub-Api-Version": "2022-11-28",
+          "User-Agent": "braid-bridge",
+          ...body !== void 0 ? { "Content-Type": "application/json" } : {}
+        },
+        ...body !== void 0 ? { body: JSON.stringify(body) } : {}
+      });
+    } catch (e) {
+      return fail(502, "github_unreachable", `Could not reach the GitHub API (${errText(e)}). Try again in a minute.`);
+    }
+    let json = null;
+    try {
+      json = await res.json();
+    } catch {
+      json = null;
+    }
+    if (!res.ok) {
+      if (res.status === 401) this.deps.resolver.dropCredential(g);
+      const msg = json && typeof json === "object" && typeof json.message === "string" ? json.message : res.statusText;
+      const errs = json && typeof json === "object" && Array.isArray(json.errors) ? json.errors.map((e) => typeof e?.message === "string" ? e.message : "").filter(Boolean).join("; ") : "";
+      return fail(502, "github_rejected", `GitHub answered ${res.status} for ${g.repoOwner}/${g.repoName}: ${oneLine(msg + (errs ? ` (${errs})` : ""))}. Fix the request or check the pull request on GitHub, then try again.`);
+    }
+    return { ok: true, json: json ?? {} };
+  }
+  /** One mirror operation at a time: the incoming/remote refs and the credential file are shared. */
+  serialize(key, fn) {
+    const prev = this.locks.get(key) ?? Promise.resolve();
+    const run = prev.then(fn, fn);
+    const tail = run.then(() => void 0, () => void 0);
+    this.locks.set(key, tail);
+    void tail.then(() => {
+      if (this.locks.get(key) === tail) this.locks.delete(key);
+    });
+    return run;
+  }
+  log(line) {
+    const l = scrub(line);
+    if (this.deps.log) this.deps.log(l);
+    else console.log(`[git-gateway] ${l}`);
+  }
+};
+
+// src/gitGateway/grants.ts
+import { chmodSync as chmodSync5, existsSync as existsSync7, mkdirSync as mkdirSync6, readFileSync as readFileSync8, renameSync as renameSync3, unlinkSync as unlinkSync4, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname5, join as join8 } from "path";
+var GRANTS_TTL_MS = 6e4;
+var REMINT_WINDOW_MS = 5 * 6e4;
+function localGitGrantPath(dir, relayUrl, agentName) {
+  const safeName = agentName.replace(/[^a-zA-Z0-9._-]/g, "_");
+  return join8(dir, "git-grants", relayHostSegment(relayUrl), `${safeName}.json`);
+}
+function loadLocalGitGrant(dir, relayUrl, agentName) {
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync8(localGitGrantPath(dir, relayUrl, agentName), "utf8"));
+  } catch {
+    return null;
+  }
+  const o = raw;
+  if (!o || typeof o !== "object") return null;
+  if (typeof o.token !== "string" || !o.token) return null;
+  if (typeof o.repoOwner !== "string" || !o.repoOwner || typeof o.repoName !== "string" || !o.repoName) return null;
+  if (o.mode !== "autonomous" && o.mode !== "pr-only") return null;
+  return {
+    source: "pat",
+    repoOwner: o.repoOwner,
+    repoName: o.repoName,
+    mode: o.mode,
+    allowWorkflows: o.allowWorkflows === true,
+    allowRiskPaths: o.allowRiskPaths === true,
+    allowPublic: o.allowPublic === true,
+    token: o.token
+  };
+}
+function saveLocalGitGrant(dir, relayUrl, agentName, grant, deps) {
+  const file = localGitGrantPath(dir, relayUrl, agentName);
+  mkdirSync6(dirname5(file), { recursive: true, mode: 448 });
+  const body = {
+    repoOwner: grant.repoOwner,
+    repoName: grant.repoName,
+    mode: grant.mode,
+    allowWorkflows: grant.allowWorkflows,
+    allowRiskPaths: grant.allowRiskPaths,
+    allowPublic: grant.allowPublic,
+    token: grant.token
+  };
+  const tmp = `${file}.tmp-${process.pid}`;
+  try {
+    writeFileSync6(tmp, JSON.stringify(body, null, 2) + "\n", { mode: 384 });
+    renameSync3(tmp, file);
+  } catch (err) {
+    try {
+      unlinkSync4(tmp);
+    } catch {
+    }
+    throw err;
+  }
+  try {
+    chmodSync5(file, 384);
+  } catch {
+  }
+  const platform = deps?.platform ?? process.platform;
+  if (platform === "win32") {
+    const d = deps ?? productionWin32Deps();
+    try {
+      applyWin32Acl(file, resolveCurrentUser(d).sid, "file", d);
+    } catch (err) {
+      console.warn(`[braid] warn: could not set ACL on git grant file ${file} (startup gate will enforce on next start): ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  return file;
+}
+function clearLocalGitGrant(dir, relayUrl, agentName) {
+  const file = localGitGrantPath(dir, relayUrl, agentName);
+  if (!existsSync7(file)) return false;
+  try {
+    unlinkSync4(file);
+    return true;
+  } catch {
+    return false;
+  }
+}
+var GrantResolver = class {
+  constructor(deps) {
+    this.deps = deps;
+    this.now = deps.now ?? Date.now;
+  }
+  deps;
+  grantsCache = null;
+  // #private so an inspect/dump of the resolver can never print a token.
+  #creds = /* @__PURE__ */ new Map();
+  #pending = /* @__PURE__ */ new Map();
+  now;
+  async listGrants() {
+    const out = [];
+    if (this.deps.relay) {
+      const t = this.now();
+      if (!this.grantsCache || t - this.grantsCache.at >= GRANTS_TTL_MS) {
+        const fresh = await this.deps.relay.fetchGitGrants();
+        if (fresh !== null) this.grantsCache = { at: t, grants: fresh };
+      }
+      if (this.grantsCache) out.push(...this.grantsCache.grants);
+    }
+    const pat = loadLocalGitGrant(this.deps.configDir, this.deps.relayUrl, this.deps.agentName);
+    if (pat) {
+      const { token: _token, ...info } = pat;
+      out.push(info);
+    }
+    return out;
+  }
+  async grantForRepo(owner, name) {
+    const o = owner.toLowerCase();
+    const n = name.toLowerCase();
+    const all = await this.listGrants();
+    return all.find((g) => g.repoOwner.toLowerCase() === o && g.repoName.toLowerCase() === n) ?? null;
+  }
+  async credentialFor(grant) {
+    if (grant.source === "pat") {
+      const pat = loadLocalGitGrant(this.deps.configDir, this.deps.relayUrl, this.deps.agentName);
+      if (!pat) throw new Error("git grant: the local PAT grant is no longer present");
+      if (pat.repoOwner.toLowerCase() !== grant.repoOwner.toLowerCase() || pat.repoName.toLowerCase() !== grant.repoName.toLowerCase()) {
+        throw new Error(`git grant: the local PAT grant does not cover ${grant.repoOwner}/${grant.repoName}`);
+      }
+      return { token: pat.token, expiresAt: Infinity, private: null, defaultBranch: null };
+    }
+    const id = grant.id;
+    if (!id || !this.deps.relay) throw new Error("git grant: no relay available to mint a token for this grant");
+    const cached = this.#creds.get(id);
+    if (cached && cached.expiresAt - this.now() > REMINT_WINDOW_MS) return cached;
+    const inflight = this.#pending.get(id);
+    if (inflight) return inflight;
+    const relay = this.deps.relay;
+    const p = (async () => {
+      const m = await relay.mintGitToken(id);
+      if (!m) throw new Error(`git grant: the relay would not mint a token for ${grant.repoOwner}/${grant.repoName}`);
+      const cred = {
+        token: m.token,
+        expiresAt: m.expiresAt,
+        private: m.private,
+        defaultBranch: m.defaultBranch,
+        policy: { repo: m.repo, mode: m.mode, allowWorkflows: m.allowWorkflows, allowRiskPaths: m.allowRiskPaths, allowPublic: m.allowPublic }
+      };
+      this.#creds.set(id, cred);
+      return cred;
+    })();
+    this.#pending.set(id, p);
+    try {
+      return await p;
+    } finally {
+      this.#pending.delete(id);
+    }
+  }
+  dropCredential(grant) {
+    if (grant.id) this.#creds.delete(grant.id);
+  }
+};
+
 // src/bridge.ts
 var REFRESH_MARGIN_MS = 24 * 60 * 60 * 1e3;
 var MIN_DELAY_MS = 60 * 1e3;
@@ -2459,6 +3381,15 @@ function computeRefreshDelay(exp, now) {
 }
 async function startBridge(cfg, relay, deps) {
   const sessions = /* @__PURE__ */ new Map();
+  const gitConfigDir = configDir(process.env);
+  const gitGateway = deps.gitGateway ?? new GitGateway({
+    resolver: new GrantResolver({ relay, configDir: gitConfigDir, relayUrl: cfg.relayWsUrl, agentName: cfg.agentName }),
+    configDir: gitConfigDir,
+    relayUrl: cfg.relayWsUrl,
+    agentName: cfg.agentName,
+    cwdFor: (ch) => handoffCwdFor(cfg, ch),
+    writableRoots: () => resolveScope(cfg, cfg.agent, process.env).runtimeConfig.filesystem.allowWrite
+  });
   const channelNames = /* @__PURE__ */ new Map();
   const hub = new ObservationHub();
   const service = process.env.BRAID_SERVICE === "1";
@@ -2676,7 +3607,11 @@ async function startBridge(cfg, relay, deps) {
         // merged ChannelSession constructor param order (session.ts).
         deps.makeEphemeralAdapter ? () => deps.makeEphemeralAdapter(cfg) : void 0
       );
-      const broker = new SourceBroker(channelId, relay);
+      const broker = new SourceBroker(channelId, relay, process.platform, gitGateway);
+      session.onLisaFreshTurn = (active) => {
+        broker.setGitEnabled(!active);
+        gitGateway.setChannelGitEnabled(channelId, !active);
+      };
       const brokerInfo = await broker.start();
       const allowedReactions = await relay.fetchAllowedReactions?.().catch(() => []) ?? [];
       const mcpServers = [{
@@ -3015,10 +3950,11 @@ function startUpdateNotifier(opts) {
 }
 
 // src/cli.ts
-import { readFileSync as readFileSync9 } from "fs";
+import { readFileSync as readFileSync12 } from "fs";
 import { fileURLToPath as fileURLToPath3 } from "url";
 
 // src/cliArgs.ts
+var GIT_REPO_RE = /^[A-Za-z0-9_.-]{1,100}\/[A-Za-z0-9_.-]{1,100}$/;
 var USAGE = `Usage: braid <command>
 
 Commands:
@@ -3048,6 +3984,14 @@ Commands:
   scope allow-code-hosts <agent>
                   Let THIS agent's sandbox reach github.com/gitlab.com/bitbucket.org
                   directly (accepts the exfiltration risk; prefer the git tools)
+  git-auth set <agent> <owner/repo> --mode <autonomous|pr-only>
+                  [--allow-workflows] [--allow-risk-paths] [--allow-public] --token-stdin
+                  Give a saved agent git access to ONE repo with a fine-grained
+                  token read from stdin (local fallback; prefer the Braid GitHub
+                  App in the web app). autonomous = push anywhere and merge;
+                  pr-only = braid/<agent>/* branches, a human merges.
+  git-auth show <agent>     Show the agent's local git grant (never the token)
+  git-auth clear <agent>    Remove the agent's local git grant
   telemetry [status|enable|disable]
                   Show or change usage telemetry (tool-mode +
                   blocked-tool-call signals only; never content, paths, or
@@ -3241,6 +4185,71 @@ function parseCliArgs(argv) {
   if (first === "version" || first === "--version" || first === "-v") {
     return { kind: "version" };
   }
+  if (first === "git-auth") {
+    const verb = argv[1];
+    const rest = argv.slice(2);
+    if (verb === "show" || verb === "clear") {
+      const agent2 = rest[0] && !rest[0].startsWith("-") ? rest[0].trim() : void 0;
+      if (!agent2 || rest.length > 1) return { kind: "usage", error: `Usage: braid git-auth ${verb} <agent>` };
+      return verb === "show" ? { kind: "git-auth-show", agent: agent2 } : { kind: "git-auth-clear", agent: agent2 };
+    }
+    if (verb !== "set") return { kind: "usage", error: "Usage: braid git-auth <set|show|clear> <agent> ..." };
+    let agent;
+    let repo;
+    let mode;
+    let tokenStdin = false;
+    let allowWorkflows = false;
+    let allowRiskPaths = false;
+    let allowPublic = false;
+    for (let i = 0; i < rest.length; i++) {
+      const a = rest[i];
+      if (a === "--token-stdin") {
+        tokenStdin = true;
+        continue;
+      }
+      if (a === "--allow-workflows") {
+        allowWorkflows = true;
+        continue;
+      }
+      if (a === "--allow-risk-paths") {
+        allowRiskPaths = true;
+        continue;
+      }
+      if (a === "--allow-public") {
+        allowPublic = true;
+        continue;
+      }
+      if (a === "--mode") {
+        const v = rest[i + 1]?.trim();
+        if (v === void 0 || v === "" || v.startsWith("--")) return { kind: "usage", error: "Missing value for --mode (autonomous or pr-only)" };
+        if (v !== "autonomous" && v !== "pr-only") return { kind: "usage", error: "Invalid --mode. Expected autonomous or pr-only" };
+        mode = v;
+        i++;
+        continue;
+      }
+      if (a.startsWith("-")) return { kind: "usage", error: `Unknown flag for git-auth set: ${a}` };
+      if (agent === void 0) {
+        agent = a.trim();
+        continue;
+      }
+      if (repo === void 0) {
+        repo = a.trim();
+        continue;
+      }
+      return {
+        kind: "usage",
+        error: "git-auth set does not accept the token as an argument. Pipe it on stdin: <command that prints the token> | braid git-auth set <agent> <owner/repo> --mode <mode> --token-stdin"
+      };
+    }
+    if (!agent || !repo) return { kind: "usage", error: "Usage: braid git-auth set <agent> <owner/repo> --mode <autonomous|pr-only> --token-stdin" };
+    if (!GIT_REPO_RE.test(repo)) return { kind: "usage", error: "git-auth set needs <owner/repo> (letters, digits, . _ -)" };
+    if (!mode) return { kind: "usage", error: "git-auth set requires --mode <autonomous|pr-only>" };
+    if (!tokenStdin) {
+      return { kind: "usage", error: "git-auth set requires --token-stdin (the token is read from stdin, never from arguments)." };
+    }
+    const [repoOwner, repoName] = repo.split("/");
+    return { kind: "git-auth-set", agent, repoOwner, repoName, mode, allowWorkflows, allowRiskPaths, allowPublic };
+  }
   if (first === "enroll") {
     let inviteStdin = false;
     let json = false;
@@ -3302,14 +4311,14 @@ function parseCliArgs(argv) {
 // src/launchTui.ts
 import { spawn } from "child_process";
 import { createRequire } from "module";
-import { dirname as dirname4, join as join6 } from "path";
+import { dirname as dirname6, join as join9 } from "path";
 function resolveTuiEntry() {
   try {
     const require2 = createRequire(import.meta.url);
     const pkgPath = require2.resolve("@snowyroad/braid-tui/package.json");
     const pkg = require2("@snowyroad/braid-tui/package.json");
     const rel = typeof pkg.bin === "string" ? pkg.bin : pkg.bin?.["braid-tui"];
-    return rel ? join6(dirname4(pkgPath), rel) : null;
+    return rel ? join9(dirname6(pkgPath), rel) : null;
   } catch {
     return null;
   }
@@ -3321,17 +4330,17 @@ function runTui(args, env, selfCliPath) {
     return Promise.resolve(1);
   }
   const childEnv = { ...env, ARP_TUI_BRIDGE_CMD: `${process.execPath} ${selfCliPath}` };
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     const child = spawn(process.execPath, [entry, ...args], { stdio: "inherit", env: childEnv });
-    child.on("error", () => resolve(1));
-    child.on("close", (code) => resolve(code ?? 1));
+    child.on("error", () => resolve2(1));
+    child.on("close", (code) => resolve2(code ?? 1));
   });
 }
 
 // src/enroll.ts
 var ENROLL_STDIN_MAX_BYTES = 16 * 1024;
-function readBoundedStdin(stream, maxBytes) {
-  return new Promise((resolve, reject) => {
+function readBoundedStdin(stream, maxBytes, label = "invite") {
+  return new Promise((resolve2, reject) => {
     const chunks = [];
     let total = 0;
     let settled = false;
@@ -3347,12 +4356,12 @@ function readBoundedStdin(stream, maxBytes) {
       const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
       total += buf.length;
       if (total > maxBytes) {
-        finish(() => reject(new Error(`stdin exceeded the ${maxBytes / 1024}KiB invite limit`)));
+        finish(() => reject(new Error(`stdin exceeded the ${maxBytes / 1024}KiB ${label} limit`)));
         return;
       }
       chunks.push(buf);
     };
-    const onEnd = () => finish(() => resolve(Buffer.concat(chunks).toString("utf8").trim()));
+    const onEnd = () => finish(() => resolve2(Buffer.concat(chunks).toString("utf8").trim()));
     const onError = (err) => finish(() => reject(err));
     stream.on("data", onData);
     stream.on("end", onEnd);
@@ -3414,7 +4423,7 @@ async function runEnroll(opts, io, env) {
       ...opts.model ? { model: opts.model } : {}
     };
     const file = persistOrNeedsHuman(dir, stored);
-    assertKeystorePerms(dir, file);
+    assertKeystorePerms(dir, file, void 0, [localGitGrantPath(dir, inv.relayUrl, bundle.agentName)]);
     const minted = await mintAccessToken(relayHttpUrl, stored.agentKey);
     persistOrNeedsHuman(dir, { ...stored, agentKey: minted.agentKey });
     const name = sanitizeForTty(bundle.agentName);
@@ -3489,13 +4498,13 @@ function mergeFirstRunPatch(existing, patch) {
 }
 function promptYesNoDefaultYes(question, input, output) {
   const rl = createInterface({ input, output });
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     let resolved = false;
     const done = (result) => {
       if (resolved) return;
       resolved = true;
       rl.close();
-      resolve(result);
+      resolve2(result);
     };
     output.write(question);
     rl.on("line", (line) => {
@@ -3984,20 +4993,20 @@ async function runHandoff(opts) {
   );
   await session.handoffPause();
   try {
-    await new Promise((resolve) => {
+    await new Promise((resolve2) => {
       const child = spawnFn(scoped.command, scoped.args, {
         stdio: "inherit",
         cwd: scoped.cwd,
         env: buildAcpEnv(process.env, scoped.env ?? void 0)
       });
-      child.on("exit", () => resolve());
+      child.on("exit", () => resolve2());
       child.on("error", (e) => {
         out.write(
           `
 [handoff] failed to open the session: ${sanitizeForTty(String(e?.message ?? e))}
 `
         );
-        resolve();
+        resolve2();
       });
     });
   } finally {
@@ -4107,12 +5116,12 @@ async function runTakeover(lc, ctx) {
 `);
     return 1;
   }
-  const outcome = await new Promise((resolve) => {
+  const outcome = await new Promise((resolve2) => {
     let settled = false;
     const settle = (o) => {
       if (!settled) {
         settled = true;
-        resolve(o);
+        resolve2(o);
       }
     };
     try {
@@ -4300,15 +5309,15 @@ function lineClient(sock) {
     },
     drained(timeoutMs) {
       if (closed) return Promise.resolve();
-      return new Promise((resolve) => {
+      return new Promise((resolve2) => {
         const t = setTimeout(() => {
           onClose = null;
-          resolve();
+          resolve2();
         }, timeoutMs);
         if (typeof t.unref === "function") t.unref();
         onClose = () => {
           clearTimeout(t);
-          resolve();
+          resolve2();
         };
       });
     },
@@ -4434,13 +5443,13 @@ async function maybeOfferSandboxInstall(deps) {
 }
 function readlinePromptYesNo(input, output) {
   return import("readline").then(
-    ({ createInterface: createInterface3 }) => new Promise((resolve) => {
+    ({ createInterface: createInterface3 }) => new Promise((resolve2) => {
       const rl = createInterface3({ input, output });
       rl.once("line", (line) => {
-        resolve(line.trim().toLowerCase() === "y");
+        resolve2(line.trim().toLowerCase() === "y");
         rl.close();
       });
-      rl.once("close", () => resolve(false));
+      rl.once("close", () => resolve2(false));
     })
   );
 }
@@ -4662,6 +5671,10 @@ async function applyEndpointGate(cfg, deps, gate, _agentPins, scopeOff = cfg.sco
 
 // src/statusVerb.ts
 import { homedir as homedir4 } from "os";
+function gitPosture(e, input) {
+  const g = input.localGitGrant?.(e.agent) ?? null;
+  return g ? { repo: `${g.repoOwner}/${g.repoName}`, mode: g.mode, source: "pat" } : null;
+}
 function endpointRows(e, k, input) {
   const derive = input.derive ?? deriveEndpoints;
   const derived = derive(k.provider.value, input.env, input.readTextFile);
@@ -4735,6 +5748,8 @@ function renderStatusHuman(input) {
     );
     const ipcProfile = resolveIpcProfile(e.agent.scope, void 0);
     lines.push(`  ipcprofile: ${ipcProfile}  (${e.agent.scope?.ipcProfile !== void 0 ? "file" : "default"})`);
+    const git = gitPosture(e, input);
+    lines.push(`  git      : ${git ? `${sanitizeForTty(git.repo)} (${git.mode}, ${git.source})` : "none"}`);
     if (e.agent.workspace) lines.push(`  workspace: ${sanitizeForTty(e.agent.workspace)}`);
     if (e.agent.channelWorkspaces && e.agent.channelWorkspaces.length > 1) {
       lines.push(`  channels in: ${e.agent.channelWorkspaces.map((w) => sanitizeForTty(w)).join(", ")}`);
@@ -4771,6 +5786,7 @@ function renderStatusJson(input) {
         }
       },
       ipcProfile: { value: ipcProfile, origin: e.agent.scope?.ipcProfile !== void 0 ? "file" : "default" },
+      git: gitPosture(e, input),
       endpoints: endpointRows(e, k, input),
       // Task 7.1 (D4): null (not "personal"/omitted key) when never cached, so machine
       // consumers can distinguish "no data yet" from an actual value.
@@ -4782,8 +5798,8 @@ function renderStatusJson(input) {
 }
 
 // src/telemetry.ts
-import { readFileSync as readFileSync6, writeFileSync as writeFileSync5, mkdirSync as mkdirSync5, renameSync as renameSync3, chmodSync as chmodSync4 } from "fs";
-import { dirname as dirname5, join as join7 } from "path";
+import { readFileSync as readFileSync9, writeFileSync as writeFileSync7, mkdirSync as mkdirSync7, renameSync as renameSync4, chmodSync as chmodSync6 } from "fs";
+import { dirname as dirname7, join as join10 } from "path";
 var EVENT_PROP_ALLOWLIST = {
   tool_mode_selected: ["mode", "surface", "persisted"],
   tool_call_blocked: ["tool", "mode", "path", "reason"],
@@ -4803,11 +5819,11 @@ function isDoNotTrackSet(env) {
   return /^(1|true|yes)$/i.test(v.trim());
 }
 function telemetryConfigPath(dir) {
-  return join7(dir, "telemetry.json");
+  return join10(dir, "telemetry.json");
 }
 function readTelemetryConfig(dir) {
   try {
-    const raw = readFileSync6(telemetryConfigPath(dir), "utf8");
+    const raw = readFileSync9(telemetryConfigPath(dir), "utf8");
     const parsed = JSON.parse(raw);
     if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) {
       return parsed;
@@ -4819,12 +5835,12 @@ function readTelemetryConfig(dir) {
 }
 function writeTelemetryConfig(dir, cfg) {
   const file = telemetryConfigPath(dir);
-  mkdirSync5(dirname5(file), { recursive: true, mode: 448 });
+  mkdirSync7(dirname7(file), { recursive: true, mode: 448 });
   const tmp = `${file}.tmp-${process.pid}`;
-  writeFileSync5(tmp, JSON.stringify(cfg, null, 2) + "\n", { mode: 384 });
-  renameSync3(tmp, file);
+  writeFileSync7(tmp, JSON.stringify(cfg, null, 2) + "\n", { mode: 384 });
+  renameSync4(tmp, file);
   try {
-    chmodSync4(file, 384);
+    chmodSync6(file, 384);
   } catch {
   }
 }
@@ -4903,12 +5919,12 @@ function renderTelemetryStatusLines(view) {
 }
 
 // src/service/cli.ts
-import { execFile } from "child_process";
+import { execFile as execFile2 } from "child_process";
 import { homedir as homedir5 } from "os";
 
 // src/service/manager.ts
-import { mkdirSync as mkdirSync7, writeFileSync as writeFileSync7, rmSync as rmSync2, existsSync as existsSync5 } from "fs";
-import { join as join9 } from "path";
+import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync9, rmSync as rmSync2, existsSync as existsSync8 } from "fs";
+import { join as join12 } from "path";
 
 // src/service/templates.ts
 function escapeXml(s) {
@@ -5079,18 +6095,18 @@ function schtasksXml(p) {
 }
 
 // src/service/win32.ts
-import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync6, readdirSync as readdirSync4, readFileSync as readFileSync7, unlinkSync as unlinkSync3 } from "fs";
-import { join as join8 } from "path";
+import { mkdirSync as mkdirSync8, writeFileSync as writeFileSync8, readdirSync as readdirSync4, readFileSync as readFileSync10, unlinkSync as unlinkSync5 } from "fs";
+import { join as join11 } from "path";
 function win32LogDir(homeDir) {
-  return join8(homeDir, "AppData", "Local", "braid", "logs");
+  return join11(homeDir, "AppData", "Local", "braid", "logs");
 }
 function win32Manager(ctx) {
-  const serviceDir = join8(ctx.braidDir, "service");
+  const serviceDir = join11(ctx.braidDir, "service");
   const task = (name) => schtasksLabel(name);
   const legacyTask = (name) => legacySchtasksLabel(name);
-  const xmlPath = (name) => join8(serviceDir, `${task(name)}.xml`);
-  const wrapperPath = (name) => join8(serviceDir, `${task(name)}.cmd`);
-  const launcherPath = (name) => join8(serviceDir, `${task(name)}.vbs`);
+  const xmlPath = (name) => join11(serviceDir, `${task(name)}.xml`);
+  const wrapperPath = (name) => join11(serviceDir, `${task(name)}.cmd`);
+  const launcherPath = (name) => join11(serviceDir, `${task(name)}.vbs`);
   const st = (...args) => ctx.exec("schtasks", args);
   const stx = async (...args) => {
     const res = await st(...args);
@@ -5101,18 +6117,18 @@ function win32Manager(ctx) {
   };
   const killBridgeProcess = async (name) => {
     const legacyAgents = legacyTwinPath(ctx.braidDir, ["agents"]);
-    const agentDirs = [join8(ctx.braidDir, "agents"), ...legacyAgents ? [legacyAgents] : []];
+    const agentDirs = [join11(ctx.braidDir, "agents"), ...legacyAgents ? [legacyAgents] : []];
     const hostDirs = [];
     for (const agentsDir of agentDirs) {
       try {
-        for (const host of readdirSync4(agentsDir)) hostDirs.push(join8(agentsDir, host));
+        for (const host of readdirSync4(agentsDir)) hostDirs.push(join11(agentsDir, host));
       } catch {
       }
     }
     for (const hostDir of hostDirs) {
       let pid = NaN;
       try {
-        pid = Number(readFileSync7(join8(hostDir, `${name}.json.lock`), "utf8").trim());
+        pid = Number(readFileSync10(join11(hostDir, `${name}.json.lock`), "utf8").trim());
       } catch {
         continue;
       }
@@ -5128,15 +6144,15 @@ function win32Manager(ctx) {
     }
   };
   const write = (name) => {
-    mkdirSync6(serviceDir, { recursive: true });
+    mkdirSync8(serviceDir, { recursive: true });
     const entryPath = pinnedEntryPath({ braidDir: ctx.braidDir, platform: "win32" });
     const cmd = schtasksWrapperCmd({ name, nodePath: ctx.nodePath, entryPath });
-    writeFileSync6(wrapperPath(name), cmd);
+    writeFileSync8(wrapperPath(name), cmd);
     const vbs = schtasksLauncherVbs({ wrapperPath: wrapperPath(name) });
-    writeFileSync6(launcherPath(name), vbs);
+    writeFileSync8(launcherPath(name), vbs);
     const xml = schtasksXml({ name, launcherPath: launcherPath(name) });
     const path2 = xmlPath(name);
-    writeFileSync6(path2, Buffer.concat([Buffer.from([255, 254]), Buffer.from(xml, "utf16le")]));
+    writeFileSync8(path2, Buffer.concat([Buffer.from([255, 254]), Buffer.from(xml, "utf16le")]));
     return path2;
   };
   return {
@@ -5156,13 +6172,13 @@ function win32Manager(ctx) {
       await st("/delete", "/tn", task(name), "/f");
       await st("/delete", "/tn", legacyTask(name), "/f");
       try {
-        unlinkSync3(join8(runDir(ctx.braidDir), `${name}.token`));
+        unlinkSync5(join11(runDir(ctx.braidDir), `${name}.token`));
       } catch {
       }
       const legacyToken = legacyTwinPath(ctx.braidDir, ["run", `${name}.token`]);
       if (legacyToken) {
         try {
-          unlinkSync3(legacyToken);
+          unlinkSync5(legacyToken);
         } catch {
         }
       }
@@ -5194,7 +6210,7 @@ function win32Manager(ctx) {
       return { installed, loaded, running };
     },
     logsPath(name) {
-      return join8(win32LogDir(ctx.homeDir), `${name}.err.log`);
+      return join11(win32LogDir(ctx.homeDir), `${name}.err.log`);
     }
   };
 }
@@ -5208,7 +6224,7 @@ var NotSupportedError = class extends Error {
 };
 function makeServiceManager(platform, exec, deps = {}) {
   const homeDir = deps.homeDir ?? process.env.HOME ?? "";
-  const braidDir = deps.braidDir ?? join9(homeDir, ".braid");
+  const braidDir = deps.braidDir ?? join12(homeDir, ".braid");
   const uid = deps.uid ?? (typeof process.getuid === "function" ? process.getuid() : 0);
   const nodePath = deps.nodePath ?? process.execPath;
   const entryPath = pinnedEntryPath({ braidDir });
@@ -5218,33 +6234,33 @@ function makeServiceManager(platform, exec, deps = {}) {
   return notSupportedManager(platform);
 }
 function notSupportedManager(platform) {
-  const fail = () => {
+  const fail2 = () => {
     throw new NotSupportedError(`service management is not supported on platform "${platform}"`);
   };
   return {
-    install: async () => fail(),
-    uninstall: async () => fail(),
-    start: async () => fail(),
-    stop: async () => fail(),
-    restart: async () => fail(),
-    status: async () => fail(),
-    logsPath: () => fail(),
-    templatePath: () => fail()
+    install: async () => fail2(),
+    uninstall: async () => fail2(),
+    start: async () => fail2(),
+    stop: async () => fail2(),
+    restart: async () => fail2(),
+    status: async () => fail2(),
+    logsPath: () => fail2(),
+    templatePath: () => fail2()
   };
 }
 function darwinManager(ctx) {
-  const launchAgentsDir = join9(ctx.homeDir, "Library", "LaunchAgents");
-  const logDir = join9(ctx.homeDir, "Library", "Logs", "braid");
-  const legacyLogDir = join9(ctx.homeDir, "Library", "Logs", "arp-bridge");
-  const plistPath = (name) => join9(launchAgentsDir, `${launchdLabel(name)}.plist`);
-  const legacyPlistPath = (name) => join9(launchAgentsDir, `${legacyLaunchdLabel(name)}.plist`);
-  const legacyInstalled = (name) => !existsSync5(plistPath(name)) && existsSync5(legacyPlistPath(name));
+  const launchAgentsDir = join12(ctx.homeDir, "Library", "LaunchAgents");
+  const logDir = join12(ctx.homeDir, "Library", "Logs", "braid");
+  const legacyLogDir = join12(ctx.homeDir, "Library", "Logs", "arp-bridge");
+  const plistPath = (name) => join12(launchAgentsDir, `${launchdLabel(name)}.plist`);
+  const legacyPlistPath = (name) => join12(launchAgentsDir, `${legacyLaunchdLabel(name)}.plist`);
+  const legacyInstalled = (name) => !existsSync8(plistPath(name)) && existsSync8(legacyPlistPath(name));
   const domainTarget = `gui/${ctx.uid}`;
   const serviceTarget = (name) => `${domainTarget}/${legacyInstalled(name) ? legacyLaunchdLabel(name) : launchdLabel(name)}`;
   const write = (name) => {
-    mkdirSync7(launchAgentsDir, { recursive: true });
-    mkdirSync7(logDir, { recursive: true });
-    writeFileSync7(
+    mkdirSync9(launchAgentsDir, { recursive: true });
+    mkdirSync9(logDir, { recursive: true });
+    writeFileSync9(
       plistPath(name),
       launchdPlist({ name, nodePath: ctx.nodePath, entryPath: ctx.entryPath, logDir }),
       { mode: 420 }
@@ -5275,7 +6291,7 @@ function darwinManager(ctx) {
       }
     },
     async start(name) {
-      if (!existsSync5(plistPath(name)) && !existsSync5(legacyPlistPath(name))) write(name);
+      if (!existsSync8(plistPath(name)) && !existsSync8(legacyPlistPath(name))) write(name);
       await ctx.exec("launchctl", [
         "bootstrap",
         domainTarget,
@@ -5289,7 +6305,7 @@ function darwinManager(ctx) {
       await ctx.exec("launchctl", ["kickstart", "-k", serviceTarget(name)]);
     },
     async status(name) {
-      const installed = existsSync5(plistPath(name)) || existsSync5(legacyPlistPath(name));
+      const installed = existsSync8(plistPath(name)) || existsSync8(legacyPlistPath(name));
       if (!installed) return { installed: false, loaded: false, running: false };
       const res = await ctx.exec("launchctl", ["print", serviceTarget(name)]);
       const loaded = res.code === 0;
@@ -5298,27 +6314,27 @@ function darwinManager(ctx) {
         installed,
         loaded,
         running,
-        staleNodePath: !existsSync5(ctx.nodePath)
+        staleNodePath: !existsSync8(ctx.nodePath)
       };
     },
     logsPath(name) {
-      return join9(legacyInstalled(name) ? legacyLogDir : logDir, `${name}.err.log`);
+      return join12(legacyInstalled(name) ? legacyLogDir : logDir, `${name}.err.log`);
     }
   };
 }
 function linuxManager(ctx) {
-  const unitDir = join9(ctx.homeDir, ".config", "systemd", "user");
+  const unitDir = join12(ctx.homeDir, ".config", "systemd", "user");
   const newUnitName = (name) => `braid-${name}.service`;
   const legacyUnitName = (name) => `arp-bridge-${name}.service`;
-  const newUnitPath = (name) => join9(unitDir, newUnitName(name));
-  const legacyUnitPath = (name) => join9(unitDir, legacyUnitName(name));
-  const legacyInstalled = (name) => !existsSync5(newUnitPath(name)) && existsSync5(legacyUnitPath(name));
+  const newUnitPath = (name) => join12(unitDir, newUnitName(name));
+  const legacyUnitPath = (name) => join12(unitDir, legacyUnitName(name));
+  const legacyInstalled = (name) => !existsSync8(newUnitPath(name)) && existsSync8(legacyUnitPath(name));
   const unitName = (name) => legacyInstalled(name) ? legacyUnitName(name) : newUnitName(name);
   const unitPath = (name) => legacyInstalled(name) ? legacyUnitPath(name) : newUnitPath(name);
   const sc = (...args) => ctx.exec("systemctl", ["--user", ...args]);
   const write = (name) => {
-    mkdirSync7(unitDir, { recursive: true });
-    writeFileSync7(
+    mkdirSync9(unitDir, { recursive: true });
+    writeFileSync9(
       newUnitPath(name),
       systemdUnit({ name, nodePath: ctx.nodePath, entryPath: ctx.entryPath }),
       { mode: 420 }
@@ -5329,7 +6345,7 @@ function linuxManager(ctx) {
     async install(name) {
       write(name);
       await sc("daemon-reload");
-      if (existsSync5(legacyUnitPath(name))) {
+      if (existsSync8(legacyUnitPath(name))) {
         await sc("disable", "--now", legacyUnitName(name));
         try {
           rmSync2(legacyUnitPath(name), { force: true });
@@ -5341,7 +6357,7 @@ function linuxManager(ctx) {
     },
     async uninstall(name) {
       await sc("disable", "--now", newUnitName(name));
-      if (existsSync5(legacyUnitPath(name))) {
+      if (existsSync8(legacyUnitPath(name))) {
         await sc("disable", "--now", legacyUnitName(name));
       }
       try {
@@ -5355,7 +6371,7 @@ function linuxManager(ctx) {
       await sc("daemon-reload");
     },
     async start(name) {
-      if (!existsSync5(unitPath(name))) {
+      if (!existsSync8(unitPath(name))) {
         write(name);
         await sc("daemon-reload");
       }
@@ -5368,7 +6384,7 @@ function linuxManager(ctx) {
       await sc("restart", unitName(name));
     },
     async status(name) {
-      const installed = existsSync5(unitPath(name));
+      const installed = existsSync8(unitPath(name));
       if (!installed) return { installed: false, loaded: false, running: false };
       const active = await sc("is-active", unitName(name));
       const enabled = await sc("is-enabled", unitName(name));
@@ -5378,7 +6394,7 @@ function linuxManager(ctx) {
         installed,
         loaded,
         running,
-        staleNodePath: !existsSync5(ctx.nodePath)
+        staleNodePath: !existsSync8(ctx.nodePath)
       };
     },
     logsPath(name) {
@@ -5388,10 +6404,10 @@ function linuxManager(ctx) {
 }
 
 // src/service/cli.ts
-var realExec = (cmd, args) => new Promise((resolve) => {
-  execFile(cmd, args, { encoding: "utf8" }, (err, stdout, stderr) => {
+var realExec = (cmd, args) => new Promise((resolve2) => {
+  execFile2(cmd, args, { encoding: "utf8" }, (err, stdout, stderr) => {
     const code = err && typeof err.code === "number" ? err.code : err ? 1 : 0;
-    resolve({ code, stdout: stdout ?? "", stderr: stderr ?? "" });
+    resolve2({ code, stdout: stdout ?? "", stderr: stderr ?? "" });
   });
 });
 function resolveAgentName(explicit) {
@@ -5592,17 +6608,17 @@ function printStatusHuman(name, st, logsPath) {
 }
 
 // src/service/serviceLog.ts
-import { createWriteStream, mkdirSync as mkdirSync8 } from "fs";
-import { dirname as dirname6, join as join10 } from "path";
+import { createWriteStream, mkdirSync as mkdirSync10 } from "fs";
+import { dirname as dirname8, join as join13 } from "path";
 
 // src/service/logRotation.ts
 import {
-  existsSync as existsSync6,
-  statSync as statSync2,
-  renameSync as renameSync4,
+  existsSync as existsSync9,
+  statSync as statSync3,
+  renameSync as renameSync5,
   rmSync as rmSync3,
-  readFileSync as readFileSync8,
-  writeFileSync as writeFileSync8
+  readFileSync as readFileSync11,
+  writeFileSync as writeFileSync10
 } from "fs";
 import { gzipSync } from "zlib";
 var DEFAULT_MAX_BYTES = 10 * 1024 * 1024;
@@ -5611,33 +6627,33 @@ function rotateLogFileIfNeeded(logPath, opts = {}) {
   const maxBytes = opts.maxBytes ?? DEFAULT_MAX_BYTES;
   const keepCount = opts.keepCount ?? DEFAULT_KEEP_COUNT;
   try {
-    if (!existsSync6(logPath)) return;
+    if (!existsSync9(logPath)) return;
     let size;
     try {
-      size = statSync2(logPath).size;
+      size = statSync3(logPath).size;
     } catch {
       return;
     }
     if (size <= maxBytes) return;
     const gz = (n) => `${logPath}.${n}.gz`;
     try {
-      if (existsSync6(gz(keepCount))) rmSync3(gz(keepCount), { force: true });
+      if (existsSync9(gz(keepCount))) rmSync3(gz(keepCount), { force: true });
     } catch {
     }
     for (let n = keepCount - 1; n >= 1; n--) {
       try {
-        if (existsSync6(gz(n))) renameSync4(gz(n), gz(n + 1));
+        if (existsSync9(gz(n))) renameSync5(gz(n), gz(n + 1));
       } catch {
       }
     }
     try {
-      const raw = readFileSync8(logPath);
-      writeFileSync8(gz(1), gzipSync(raw));
+      const raw = readFileSync11(logPath);
+      writeFileSync10(gz(1), gzipSync(raw));
     } catch {
       return;
     }
     try {
-      writeFileSync8(logPath, "");
+      writeFileSync10(logPath, "");
     } catch {
     }
   } catch {
@@ -5646,16 +6662,16 @@ function rotateLogFileIfNeeded(logPath, opts = {}) {
 
 // src/service/serviceLog.ts
 function darwinLogDir(homeDir) {
-  return join10(homeDir, "Library", "Logs", "braid");
+  return join13(homeDir, "Library", "Logs", "braid");
 }
 function serviceLogTargets(name, platform, homeDir) {
   if (platform === "darwin") {
     const d = darwinLogDir(homeDir);
-    return [join10(d, `${name}.out.log`), join10(d, `${name}.err.log`)];
+    return [join13(d, `${name}.out.log`), join13(d, `${name}.err.log`)];
   }
   if (platform === "win32") {
     const d = win32LogDir(homeDir);
-    return [join10(d, `${name}.out.log`), join10(d, `${name}.err.log`)];
+    return [join13(d, `${name}.out.log`), join13(d, `${name}.err.log`)];
   }
   return [];
 }
@@ -5705,7 +6721,7 @@ function initServiceLogging(opts) {
   };
 }
 function defaultTeeStream(path2) {
-  mkdirSync8(dirname6(path2), { recursive: true });
+  mkdirSync10(dirname8(path2), { recursive: true });
   const stream = createWriteStream(path2, { flags: "a" });
   stream.on("error", () => {
   });
@@ -5845,12 +6861,13 @@ function printStatus(agentName, json) {
   }
   const readTextFile = (p) => {
     try {
-      return readFileSync9(p, "utf8");
+      return readFileSync12(p, "utf8");
     } catch {
       return null;
     }
   };
-  const input = { entries, env: process.env, readTextFile };
+  const localGitGrant = (a) => loadLocalGitGrant(dir, a.relayUrl, a.agentName);
+  const input = { entries, env: process.env, readTextFile, localGitGrant };
   if (json) {
     console.log(renderStatusJson(input));
     return;
@@ -5913,19 +6930,84 @@ function setIpcProfile(profile, agentName) {
     );
   }
 }
+async function gitAuthSet(inv) {
+  const dir = configDir(process.env);
+  const entry = loadAgent(dir, inv.agent, "Run: braid list").agent;
+  if (process.stdin.isTTY === true) {
+    console.error(
+      "[braid] git-auth set reads the token from stdin and nothing is piped in. Run it as: <command that prints the token> | braid git-auth set <agent> <owner/repo> --mode <mode> --token-stdin"
+    );
+    return 1;
+  }
+  let token;
+  try {
+    token = (await readBoundedStdin(process.stdin, 4096, "token")).trim();
+  } catch (err) {
+    console.error(`[braid] git-auth set failed: ${sanitizeForTty(err instanceof Error ? err.message : String(err))}`);
+    return 1;
+  }
+  if (token === "") {
+    console.error("[braid] git-auth set received an empty token on stdin. Pipe the token in and retry.");
+    return 1;
+  }
+  saveLocalGitGrant(dir, entry.relayUrl, entry.agentName, {
+    source: "pat",
+    repoOwner: inv.repoOwner,
+    repoName: inv.repoName,
+    mode: inv.mode,
+    allowWorkflows: inv.allowWorkflows,
+    allowRiskPaths: inv.allowRiskPaths,
+    allowPublic: inv.allowPublic,
+    token
+  });
+  console.log(
+    `[braid] ${sanitizeForTty(entry.agentName)}: git access set for ${inv.repoOwner}/${inv.repoName} (${inv.mode}, local token). Restart the bridge for the change to take effect.`
+  );
+  return 0;
+}
+function gitAuthShow(agentName) {
+  const dir = configDir(process.env);
+  const entry = loadAgent(dir, agentName, "Run: braid list").agent;
+  const name = sanitizeForTty(entry.agentName);
+  const g = loadLocalGitGrant(dir, entry.relayUrl, entry.agentName);
+  if (!g) {
+    console.log(`[braid] ${name}: no local git grant.`);
+    return;
+  }
+  console.log(`[braid] ${name}: local git grant`);
+  console.log(`  repo           : ${sanitizeForTty(`${g.repoOwner}/${g.repoName}`)}`);
+  console.log(`  mode           : ${g.mode}`);
+  console.log(`  allowWorkflows : ${g.allowWorkflows}`);
+  console.log(`  allowRiskPaths : ${g.allowRiskPaths}`);
+  console.log(`  allowPublic    : ${g.allowPublic}`);
+  console.log("  source: pat");
+}
+function gitAuthClear(agentName) {
+  const dir = configDir(process.env);
+  const entry = loadAgent(dir, agentName, "Run: braid list").agent;
+  const name = sanitizeForTty(entry.agentName);
+  if (clearLocalGitGrant(dir, entry.relayUrl, entry.agentName)) {
+    console.log(`[braid] ${name}: local git grant removed. Restart the bridge for the change to take effect.`);
+  } else {
+    console.log(`[braid] ${name}: nothing to clear, no local git grant was set.`);
+  }
+}
 function printScope(agentName) {
   const dir = configDir(process.env);
   let scope;
   let pinnedEndpoints;
+  let resolved;
   if (agentName !== void 0) {
     const entry = loadAgent(dir, agentName, "Run: braid scope <name>").agent;
     scope = entry.scope;
     pinnedEndpoints = entry.pinnedEndpoints;
+    resolved = entry;
   } else {
     try {
       const entry = loadAgent(dir).agent;
       scope = entry.scope;
       pinnedEndpoints = entry.pinnedEndpoints;
+      resolved = entry;
     } catch {
     }
   }
@@ -5934,9 +7016,15 @@ function printScope(agentName) {
   for (const line of lines) {
     console.log(line);
   }
+  if (resolved !== void 0) {
+    const g = loadLocalGitGrant(dir, resolved.relayUrl, resolved.agentName);
+    console.log(
+      g ? `[scope] git access: ${sanitizeForTty(`${g.repoOwner}/${g.repoName}`)} (${g.mode}, pat)` : "[scope] git access: none locally (app grants, if any, are shown by the web app)"
+    );
+  }
   const readTextFile = (p) => {
     try {
-      return readFileSync9(p, "utf8");
+      return readFileSync12(p, "utf8");
     } catch {
       return null;
     }
@@ -5976,7 +7064,7 @@ function scopeAllow(agentName, host) {
   const { agent: provider } = resolveAgentSelection(process.env);
   const readTextFile = (p) => {
     try {
-      return readFileSync9(p, "utf8");
+      return readFileSync12(p, "utf8");
     } catch {
       return null;
     }
@@ -6091,6 +7179,17 @@ async function main() {
     scopeAllowCodeHosts(invocation.agent);
     return;
   }
+  if (invocation.kind === "git-auth-set") {
+    process.exit(await gitAuthSet(invocation));
+  }
+  if (invocation.kind === "git-auth-show") {
+    gitAuthShow(invocation.agent);
+    return;
+  }
+  if (invocation.kind === "git-auth-clear") {
+    gitAuthClear(invocation.agent);
+    return;
+  }
   if (invocation.kind === "telemetry") {
     runTelemetryVerb(invocation.verb);
     return;
@@ -6241,7 +7340,7 @@ async function main() {
       } catch {
       }
     }
-    assertKeystorePerms(dir, file);
+    assertKeystorePerms(dir, file, void 0, cfg.agentName ? [localGitGrantPath(dir, cfg.relayWsUrl, cfg.agentName)] : []);
   }
   console.log(banner("braid", "STARTING", startingLines(cfg, {
     ...cfg.agentMode === "acp" && cfg.agent === "claude-code" ? { claudeBinary: describeClaudeBinary(resolveClaudeBinary()) } : {}
@@ -6262,7 +7361,7 @@ async function main() {
     const epScopeOff = process.env.BRAID_SCOPE === "off" || cfg.scope?.disabled === true;
     const readTextFile = (p) => {
       try {
-        return readFileSync9(p, "utf8");
+        return readFileSync12(p, "utf8");
       } catch {
         return null;
       }
@@ -6292,7 +7391,7 @@ async function main() {
           cancelled = true;
           rl.close();
         });
-        const eofGuard = new Promise((resolve) => rl.once("close", () => resolve(false)));
+        const eofGuard = new Promise((resolve2) => rl.once("close", () => resolve2(false)));
         try {
           const answer = await Promise.race([
             rl.question(prompt).then((a) => a.trim().toLowerCase() === "y"),