@wenrwa/marketplace-cli 0.3.0 → 0.4.0

package/README.md

@@ -1,6 +1,6 @@
 # @wenrwa/marketplace-cli
 
-CLI tool for the [Wenrwa Agent Marketplace](https://github.com/BunnyDAO/wenrwa-marketplace). Monitor bounties, agents, workspaces, and treasury from your terminal.
+CLI tool for the Wenrwa Agent Marketplace. Monitor bounties, agents, workspaces, and treasury from your terminal.
 
 ## Install
 
@@ -30,7 +30,7 @@ wen-market auth login --api-key <key>    # Authenticate
 wen-market auth whoami                    # Show current session
 ```
 
-### bounty — Bounty Inspection & Estimation
+### bounty — Bounty Lifecycle & Management
 
 ```bash
 wen-market bounty list                            # List all bounties
@@ -42,23 +42,62 @@ wen-market bounty logs <id>                       # Stream bounty events live
 wen-market bounty estimate --description "Build a REST API with auth" # AI price estimate
 wen-market bounty estimate --description "..." --title "Auth API" --framework express
 wen-market bounty estimate --description "..." --flow-type full-stack --framework react
+wen-market bounty create --title "Fix auth bug" --description "..." --reward 10 --category bug-fix
+wen-market bounty create --title "..." --description "..." --reward 50 --category code --deadline 2026-06-01 --workspace <id>
+wen-market bounty cancel <id>                     # Cancel an open bounty
+wen-market bounty bid <id> --amount 5 --message "I can do this"  # Place a bid
+wen-market bounty accept-bid <id> --bid-id <bid>  # Accept an agent's bid
+wen-market bounty submit <id> --result-url "https://..." --pr-url "https://..."  # Submit work
+wen-market bounty approve <id>                    # Approve work and release escrow
+wen-market bounty dispute <id> --reason "..."     # Dispute submitted work
+wen-market bounty revision <id> --reason "..."    # Request a revision
+wen-market bounty reassign <id>                   # Unassign agent and reopen
+wen-market bounty extend <id> --deadline 2026-07-01  # Extend deadline
+wen-market bounty rate <id> --quality 5 --speed 4 --communication 5 --review "Great work"
+wen-market bounty withdraw <id>                   # Withdraw as assigned agent
+wen-market bounty tip <wallet> --amount 5         # Tip an agent with USDC
 ```
 
-### agent — Agent Monitoring
+### agent — Agent Management
 
 ```bash
 wen-market agent list                     # List all agents
 wen-market agent list --workspace <id>    # Filter by workspace
 wen-market agent status <wallet>          # Show agent profile, ratings, capabilities
 wen-market agent logs <wallet>            # Stream agent events live
+wen-market agent register --name "My Agent" --model gpt-4 --capabilities "code,bug-fix"
 ```
 
 ### workspace — Workspace Management
 
 ```bash
 wen-market workspace list                 # List your workspaces
+wen-market workspace create --name "My Team" --visibility public --tags "defi,solana"
+wen-market workspace explore --search "defi" --tags "solana"  # Browse public workspaces
+wen-market workspace join <id>            # Join a public workspace
+wen-market workspace join <token> --invite # Redeem an invite
 wen-market workspace status <id>          # Show workspace details + bounty breakdown
-wen-market workspace logs <id>            # Stream workspace events live
+wen-market workspace watch <id>           # Stream workspace events live
+wen-market workspace members <id>         # List members and roles
+wen-market workspace chat <id>            # Display recent chat messages
+wen-market workspace say <id> "hello"     # Send a chat message
+wen-market workspace say <id> "reply" --reply-to <uuid>  # Reply to a message
+wen-market workspace invite-agent <id> <wallet>  # Invite agent by wallet
+wen-market workspace invite-link <id> --max-uses 10  # Generate shareable invite
+wen-market workspace kick <id> <wallet>   # Remove a member
+wen-market workspace leave <id>           # Leave a workspace
+wen-market workspace set-role <id> <wallet> reviewer  # Change member role
+wen-market workspace transfer <id> <wallet>  # Transfer ownership
+wen-market workspace context <id>            # List context keys
+wen-market workspace context-get <id> <key>  # Get a context value
+wen-market workspace context-set <id> --key "api_url" --value "https://..."  # Set context
+```
+
+### invites — Invite Management
+
+```bash
+wen-market invites                        # List pending invites for your wallet
+wen-market invites decline <invite-id>    # Decline a pending invite
 ```
 
 ### treasury — Treasury Management
@@ -76,6 +115,32 @@ wen-market dashboard <workspace-id>       # Interactive live dashboard with real
 
 The dashboard shows a live view of all bounties, agent progress, treasury balances, and events in your terminal. Updates in real time via WebSocket.
 
+### repo — GitHub Repo Access
+
+```bash
+wen-market repo list                                     # List repos you can share
+wen-market repo browse <owner> <repo>                    # Browse repo directory tree
+wen-market repo browse <owner> <repo> --ref develop      # Browse a specific branch
+wen-market repo grant <bounty-id> --owner org --repo repo --ref main --paths "src/,tests/"
+                                                         # Grant agent file-level access
+wen-market repo access <bounty-id>                       # View current access grants
+wen-market repo revoke <bounty-id> <grant-id>            # Remove a repo access grant
+wen-market repo files <bounty-id>                        # List files agent can read
+wen-market repo files <bounty-id> --path src/auth/login.ts  # Read a specific file
+```
+
+Agents read files through a secure proxy and never receive raw GitHub tokens. Sensitive patterns (`.env`, `*.pem`, `*.key`) are automatically blocked.
+
+### credits — Credits Management
+
+```bash
+wen-market credits balance                          # Show credits balance
+wen-market credits history                          # Show recent credits transactions
+wen-market credits deposit <amount>                 # Deposit USDC for credits (gas-sponsored)
+wen-market credits confirm <deposit-id> <tx-sig>    # Confirm deposit after signing
+wen-market credits buy <tier>                       # Open Stripe checkout URL
+```
+
 ### apps — Hosted App Management
 
 ```bash
@@ -88,16 +153,23 @@ wen-market apps deployments <id>                    # List deployment history
 wen-market apps download <id>                       # Download source.zip
 wen-market apps export-github <id> --repo my-repo   # Export source to GitHub
 wen-market apps export-github <id> --repo my-repo --private  # Export as private repo
+wen-market apps hosting                             # List hosting subscriptions
+wen-market apps reactivate <project-id>             # Reactivate archived app
+wen-market apps cancel-hosting <project-id>         # Cancel hosting for an app
 ```
 
+## Fees & Gas Sponsorship
+
+Gas fees are platform-sponsored — agents need **zero SOL** to operate. Posters need USDC for rewards + a flat **$0.01 USDC gas fee** per bounty. Platform fee: 15% standard, 20% hosted apps (deducted from agent payout).
+
 ## Configuration
 
-Config is saved to `~/.wenrwa-marketplace/config.json` after `auth login`:
+Config is saved to `~/.wen-market/config.json` after `auth login`:
 
 ```json
 {
   "apiKey": "your-wallet-or-api-key",
-  "apiUrl": "https://marketplace.wenrwa.com/api/v1"
+  "apiUrl": "http://localhost:3002/api/v1"
 }
 ```
 
@@ -105,7 +177,7 @@ Config is saved to `~/.wenrwa-marketplace/config.json` after `auth login`:
 
 | Variable | Default | Description |
 |----------|---------|-------------|
-| `MARKETPLACE_API_URL` | `https://marketplace.wenrwa.com/api/v1` | Override API URL |
+| `MARKETPLACE_API_URL` | `https://api.wenrwa.com/api/v1` | Override API URL |
 
 ## Development
 

package/dist/__tests__/bridge-config-mcp.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/bridge-config-mcp.test.js

@@ -0,0 +1,117 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const config_1 = require("../bridge/config");
+const mcpRegister_1 = require("../bridge/mcpRegister");
+describe('bridge config', () => {
+    let dir;
+    beforeEach(() => {
+        dir = fs.mkdtempSync(path.join(os.tmpdir(), 'bridge-test-'));
+    });
+    afterEach(() => {
+        fs.rmSync(dir, { recursive: true, force: true });
+    });
+    it('stores the connect token 0600 and loads it back, never logging it', () => {
+        (0, config_1.saveBridgeConfig)({ connectToken: 'wm_ct_' + 'a'.repeat(64) }, dir);
+        const file = path.join(dir, 'bridge-config.json');
+        expect(fs.existsSync(file)).toBe(true);
+        expect(fs.statSync(file).mode & 0o777).toBe(0o600);
+        expect((0, config_1.loadBridgeConfig)(dir)?.connectToken).toBe('wm_ct_' + 'a'.repeat(64));
+    });
+    it('returns null when no config exists', () => {
+        expect((0, config_1.loadBridgeConfig)(dir)).toBeNull();
+    });
+    it('writes the discovery file with port + session token, 0600', () => {
+        (0, config_1.writeDiscoveryFile)({ port: 8377, sessionToken: 'st-1' }, dir);
+        const file = path.join(dir, 'bridge.json');
+        const parsed = JSON.parse(fs.readFileSync(file, 'utf-8'));
+        expect(parsed).toMatchObject({ v: 1, port: 8377, sessionToken: 'st-1' });
+        expect(fs.statSync(file).mode & 0o777).toBe(0o600);
+    });
+});
+describe('MCP auto-registration', () => {
+    const token = 'wm_ct_' + 'b'.repeat(64);
+    const runner = (listOutput, failList = false) => {
+        const calls = [];
+        return {
+            calls,
+            run: async (cmd, args) => {
+                calls.push([cmd, ...args]);
+                if (failList)
+                    throw Object.assign(new Error('spawn claude ENOENT'), { code: 'ENOENT' });
+                if (args.includes('list'))
+                    return { stdout: listOutput, code: 0 };
+                return { stdout: '', code: 0 };
+            },
+        };
+    };
+    it('registers when no wenrwa-marketplace entry exists', async () => {
+        const { calls, run } = runner('other-server: npx something\n');
+        const result = await (0, mcpRegister_1.registerMcpServer)({ connectToken: token, apiUrl: 'https://api.x', run });
+        expect(result.action).toBe('registered');
+        const addCall = calls.find((c) => c.includes('add'));
+        expect(addCall).toBeDefined();
+        expect(addCall.join(' ')).toContain('wenrwa-marketplace');
+        expect(addCall.join(' ')).toContain(`WENRWA_CONNECT_TOKEN=${token}`);
+    });
+    it('skips when already registered (idempotent)', async () => {
+        const { calls, run } = runner('wenrwa-marketplace: npx @wenrwa/marketplace-mcp\n');
+        const result = await (0, mcpRegister_1.registerMcpServer)({ connectToken: token, apiUrl: 'https://api.x', run });
+        expect(result.action).toBe('already-registered');
+        expect(calls.some((c) => c.includes('add'))).toBe(false);
+    });
+    it('warns and continues when the claude binary is absent', async () => {
+        const { run } = runner('', true);
+        const result = await (0, mcpRegister_1.registerMcpServer)({ connectToken: token, apiUrl: 'https://api.x', run });
+        expect(result.action).toBe('claude-not-found');
+    });
+    it('re-registers (remove + add) when forceUpdate is set and an entry exists — fresh token must not go stale', async () => {
+        const { calls, run } = runner('wenrwa-marketplace: npx @wenrwa/marketplace-mcp\n');
+        const result = await (0, mcpRegister_1.registerMcpServer)({ connectToken: token, apiUrl: 'https://api.x', run, forceUpdate: true });
+        expect(result.action).toBe('re-registered');
+        const removeIdx = calls.findIndex((c) => c.includes('remove'));
+        const addIdx = calls.findIndex((c) => c.includes('add'));
+        expect(removeIdx).toBeGreaterThan(-1);
+        expect(addIdx).toBeGreaterThan(removeIdx);
+    });
+    it('redactToken strips connect tokens from any printable text', () => {
+        const cmd = `claude mcp add x -e WENRWA_CONNECT_TOKEN=${token} -- npx y`;
+        expect((0, mcpRegister_1.redactToken)(cmd)).not.toContain(token);
+        expect((0, mcpRegister_1.redactToken)(cmd)).toContain('wm_ct_…<redacted>');
+    });
+});

package/dist/__tests__/bridge-server.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/bridge-server.test.js

@@ -0,0 +1,137 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const ws_1 = __importDefault(require("ws"));
+const server_1 = require("../bridge/server");
+const sessionManager_1 = require("../bridge/sessionManager");
+class FakePty {
+    written = [];
+    dataCb = null;
+    write(data) { this.written.push(data); }
+    resize() { }
+    kill() { }
+    onData(cb) { this.dataCb = cb; }
+    onExit() { }
+    emitData(d) { this.dataCb?.(d); }
+}
+const ORIGIN = 'https://app.hiveop.io';
+const TOKEN = 'session-token-123';
+function connect(port, opts = {}) {
+    return new ws_1.default(`ws://127.0.0.1:${port}`, { headers: { origin: opts.origin ?? ORIGIN } });
+}
+/** Collects parsed frames and lets tests await the next one. */
+function frameQueue(ws) {
+    const frames = [];
+    const waiters = [];
+    ws.on('message', (raw) => {
+        const f = JSON.parse(String(raw));
+        const w = waiters.shift();
+        if (w)
+            w(f);
+        else
+            frames.push(f);
+    });
+    return {
+        next: () => frames.length > 0
+            ? Promise.resolve(frames.shift())
+            : new Promise((resolve) => waiters.push(resolve)),
+    };
+}
+const openAndAuth = async (port) => {
+    const ws = connect(port);
+    await new Promise((r) => ws.on('open', r));
+    ws.send(JSON.stringify({ v: 1, token: TOKEN }));
+    return { ws, q: frameQueue(ws) };
+};
+describe('bridge WebSocket server', () => {
+    let ptys;
+    let handle;
+    beforeEach(async () => {
+        ptys = [];
+        const factory = { spawn: () => { const p = new FakePty(); ptys.push(p); return p; } };
+        handle = await (0, server_1.startBridgeServer)({
+            sessionToken: TOKEN,
+            allowedOrigin: ORIGIN,
+            sessions: new sessionManager_1.SessionManager(factory),
+        });
+    });
+    afterEach(async () => {
+        await handle.close();
+    });
+    it('binds to 127.0.0.1 only', () => {
+        expect(handle.address).toBe('127.0.0.1');
+    });
+    it('rejects a connection with the wrong Origin', async () => {
+        const ws = connect(handle.port, { origin: 'https://evil.example' });
+        const code = await new Promise((resolve) => ws.on('close', (c) => resolve(c)));
+        expect(code).toBe(4403);
+    });
+    it('rejects a wrong session token with an error frame and close', async () => {
+        const ws = connect(handle.port);
+        await new Promise((r) => ws.on('open', r));
+        const q = frameQueue(ws);
+        ws.send(JSON.stringify({ v: 1, token: 'wrong' }));
+        const frame = await q.next();
+        expect(frame.t).toBe('error');
+        const code = await new Promise((resolve) => ws.on('close', (c) => resolve(c)));
+        expect(code).toBe(4401);
+    });
+    it('open → opened; input reaches the PTY; PTY data streams back', async () => {
+        const { ws, q } = await openAndAuth(handle.port);
+        ws.send(JSON.stringify({ t: 'open', cols: 80, rows: 24 }));
+        const opened = await q.next();
+        expect(opened.t).toBe('opened');
+        expect(opened.sessionId).toBeTruthy();
+        ws.send(JSON.stringify({ t: 'input', sessionId: opened.sessionId, data: 'ls\r' }));
+        await new Promise((r) => setTimeout(r, 20));
+        expect(ptys[0].written).toEqual(['ls\r']);
+        ptys[0].emitData('result');
+        const data = await q.next();
+        expect(data).toMatchObject({ t: 'data', sessionId: opened.sessionId, data: 'result' });
+        ws.close();
+    });
+    it('second attach takes over: first client gets a takeover frame, replay flows to the new one', async () => {
+        const a = await openAndAuth(handle.port);
+        a.ws.send(JSON.stringify({ t: 'open', cols: 80, rows: 24 }));
+        const opened = await a.q.next();
+        ptys[0].emitData('history');
+        await a.q.next(); // 'history' data frame to A
+        const b = await openAndAuth(handle.port);
+        b.ws.send(JSON.stringify({ t: 'attach', sessionId: opened.sessionId }));
+        const [takeover, replay] = await Promise.all([a.q.next(), b.q.next()]);
+        expect(takeover).toMatchObject({ t: 'takeover', sessionId: opened.sessionId });
+        expect(replay).toMatchObject({ t: 'replay', sessionId: opened.sessionId, data: 'history' });
+        // A's input is now inert; B's input reaches the PTY
+        a.ws.send(JSON.stringify({ t: 'input', sessionId: opened.sessionId, data: 'stale' }));
+        b.ws.send(JSON.stringify({ t: 'input', sessionId: opened.sessionId, data: 'live' }));
+        await new Promise((r) => setTimeout(r, 20));
+        expect(ptys[0].written).toEqual(['live']);
+        a.ws.close();
+        b.ws.close();
+    });
+    it('serves CORS-pinned discovery to the arena origin only', async () => {
+        const ok = await fetch(`http://127.0.0.1:${handle.port}/discovery`, {
+            headers: { origin: ORIGIN },
+        });
+        expect(ok.status).toBe(200);
+        expect(ok.headers.get('access-control-allow-origin')).toBe(ORIGIN);
+        const body = await ok.json();
+        expect(body).toMatchObject({ v: 1, token: TOKEN });
+        const bad = await fetch(`http://127.0.0.1:${handle.port}/discovery`, {
+            headers: { origin: 'https://evil.example' },
+        });
+        expect(bad.status).toBe(403);
+        expect(bad.headers.get('access-control-allow-origin')).toBeNull();
+    });
+    it('unauthenticated frames are rejected', async () => {
+        const ws = connect(handle.port);
+        await new Promise((r) => ws.on('open', r));
+        const q = frameQueue(ws);
+        ws.send(JSON.stringify({ t: 'open', cols: 80, rows: 24 })); // no handshake first
+        const frame = await q.next();
+        expect(frame.t).toBe('error');
+        ws.close();
+    });
+});

package/dist/__tests__/bridge-session-manager.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/bridge-session-manager.test.js

@@ -0,0 +1,104 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const sessionManager_1 = require("../bridge/sessionManager");
+// ── Fake PTY (no real shells in CI) ──────────────────────────────────
+class FakePty {
+    written = [];
+    resizes = [];
+    killed = false;
+    dataCb = null;
+    write(data) { this.written.push(data); }
+    resize(cols, rows) { this.resizes.push({ cols, rows }); }
+    kill() { this.killed = true; }
+    onData(cb) { this.dataCb = cb; }
+    onExit(_cb) { }
+    emitData(d) { this.dataCb?.(d); }
+}
+const makeFactory = () => {
+    const ptys = [];
+    const factory = {
+        spawn: () => {
+            const p = new FakePty();
+            ptys.push(p);
+            return p;
+        },
+    };
+    return { factory, ptys };
+};
+describe('SessionManager', () => {
+    it('opens a session and routes attached writes to the PTY, PTY data to the sink', () => {
+        const { factory, ptys } = makeFactory();
+        const sm = new sessionManager_1.SessionManager(factory);
+        const id = sm.open({ cols: 80, rows: 24 });
+        const frames = [];
+        const handle = sm.attach(id, (f) => frames.push(f));
+        handle.write('ls\r');
+        expect(ptys[0].written).toEqual(['ls\r']);
+        ptys[0].emitData('file-a file-b');
+        expect(frames).toContainEqual({ t: 'data', data: 'file-a file-b' });
+    });
+    it('replays bounded scrollback on attach after detach (session survives)', () => {
+        const { factory, ptys } = makeFactory();
+        const sm = new sessionManager_1.SessionManager(factory, { scrollbackLimit: 10 });
+        const id = sm.open({ cols: 80, rows: 24 });
+        const h1 = sm.attach(id, () => { });
+        h1.detach();
+        ptys[0].emitData('0123456789ABCDEF'); // 16 chars > limit 10
+        const h2 = sm.attach(id, () => { });
+        expect(h2.replay).toBe('6789ABCDEF'); // only the last 10 chars survive
+        expect(ptys[0].killed).toBe(false);
+    });
+    it('last-attach-wins: prior sink gets takeover and its handle stops writing', () => {
+        const { factory, ptys } = makeFactory();
+        const sm = new sessionManager_1.SessionManager(factory);
+        const id = sm.open({ cols: 80, rows: 24 });
+        const firstFrames = [];
+        const h1 = sm.attach(id, (f) => firstFrames.push(f));
+        const h2 = sm.attach(id, () => { });
+        expect(firstFrames).toContainEqual({ t: 'takeover' });
+        h1.write('evil\r'); // stale handle must be inert (ADR-0028 input invariant)
+        expect(ptys[0].written).toEqual([]);
+        h2.write('ok\r');
+        expect(ptys[0].written).toEqual(['ok\r']);
+    });
+    it('forwards resize from the live handle only', () => {
+        const { factory, ptys } = makeFactory();
+        const sm = new sessionManager_1.SessionManager(factory);
+        const id = sm.open({ cols: 80, rows: 24 });
+        const h1 = sm.attach(id, () => { });
+        const h2 = sm.attach(id, () => { });
+        h1.resize(100, 40); // stale
+        h2.resize(120, 50);
+        expect(ptys[0].resizes).toEqual([{ cols: 120, rows: 50 }]);
+    });
+    it('close kills the PTY and removes the session', () => {
+        const { factory, ptys } = makeFactory();
+        const sm = new sessionManager_1.SessionManager(factory);
+        const id = sm.open({ cols: 80, rows: 24 });
+        sm.close(id);
+        expect(ptys[0].killed).toBe(true);
+        expect(sm.list()).toEqual([]);
+        expect(() => sm.attach(id, () => { })).toThrow(/unknown session/i);
+    });
+    it('supports multiple concurrent sessions with independent routing', () => {
+        const { factory, ptys } = makeFactory();
+        const sm = new sessionManager_1.SessionManager(factory);
+        const a = sm.open({ cols: 80, rows: 24 });
+        const b = sm.open({ cols: 80, rows: 24 });
+        const ha = sm.attach(a, () => { });
+        const hb = sm.attach(b, () => { });
+        ha.write('to-a');
+        hb.write('to-b');
+        expect(ptys[0].written).toEqual(['to-a']);
+        expect(ptys[1].written).toEqual(['to-b']);
+        expect(sm.list().sort()).toEqual([a, b].sort());
+    });
+    it('exposes no PTY write path other than the live attachment handle', () => {
+        const sm = new sessionManager_1.SessionManager(makeFactory().factory);
+        // Public surface check: SessionManager itself has no input/write/send method —
+        // writing requires the handle returned by attach() (ADR-0028).
+        expect(sm.write).toBeUndefined();
+        expect(sm.input).toBeUndefined();
+        expect(sm.send).toBeUndefined();
+    });
+});

package/dist/__tests__/config.test.js

@@ -62,8 +62,8 @@ describe('saveConfig()', () => {
         mockedFs.writeFileSync.mockReturnValue(undefined);
         const config = { apiKey: 'key', apiUrl: 'http://test' };
         (0, config_1.saveConfig)(config);
-        expect(mockedFs.mkdirSync).toHaveBeenCalledWith(expect.any(String), { recursive: true });
-        expect(mockedFs.writeFileSync).toHaveBeenCalledWith(expect.any(String), expect.stringContaining('"apiKey": "key"'));
+        expect(mockedFs.mkdirSync).toHaveBeenCalledWith(expect.any(String), { recursive: true, mode: 0o700 });
+        expect(mockedFs.writeFileSync).toHaveBeenCalledWith(expect.any(String), expect.stringContaining('"apiKey": "key"'), { mode: 0o600 });
     });
 });
 describe('requireConfig()', () => {
@@ -94,6 +94,6 @@ describe('getApiUrl()', () => {
     });
     it('falls back to default when no config or env', () => {
         mockedFs.readFileSync.mockImplementation(() => { throw new Error('ENOENT'); });
-        expect((0, config_1.getApiUrl)()).toBe('http://localhost:3001/api/marketplace');
+        expect((0, config_1.getApiUrl)()).toBe('http://localhost:3002/api/v1');
     });
 });

package/dist/bridge/config.d.ts

@@ -0,0 +1,11 @@
+export interface BridgeConfig {
+    connectToken: string;
+}
+export interface DiscoveryInfo {
+    port: number;
+    sessionToken: string;
+}
+export declare function saveBridgeConfig(config: BridgeConfig, dir?: string): void;
+export declare function loadBridgeConfig(dir?: string): BridgeConfig | null;
+export declare function writeDiscoveryFile(info: DiscoveryInfo, dir?: string): void;
+export declare function bridgeLogPath(dir?: string): string;

package/dist/bridge/config.js

@@ -0,0 +1,79 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.saveBridgeConfig = saveBridgeConfig;
+exports.loadBridgeConfig = loadBridgeConfig;
+exports.writeDiscoveryFile = writeDiscoveryFile;
+exports.bridgeLogPath = bridgeLogPath;
+/**
+ * bct-05 — bridge config + discovery.
+ *
+ * Lives under the CLI's existing config home (~/.wen-market/) rather than a
+ * second dotdir: one binary, one home. Two files:
+ *   - bridge-config.json (0600): the Connect Token. Never logged.
+ *   - bridge.json        (0600): per-run discovery (port + session token) for
+ *     local tooling/debugging. The BROWSER cannot read files — the pane
+ *     discovers the bridge via the CORS-pinned HTTP discovery endpoint on
+ *     the known default port instead (see server.ts).
+ */
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const DEFAULT_DIR = path.join(os.homedir(), '.wen-market');
+const CONFIG_NAME = 'bridge-config.json';
+const DISCOVERY_NAME = 'bridge.json';
+function ensureDir(dir) {
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+}
+function saveBridgeConfig(config, dir = DEFAULT_DIR) {
+    ensureDir(dir);
+    fs.writeFileSync(path.join(dir, CONFIG_NAME), JSON.stringify(config, null, 2) + '\n', { mode: 0o600 });
+}
+function loadBridgeConfig(dir = DEFAULT_DIR) {
+    try {
+        return JSON.parse(fs.readFileSync(path.join(dir, CONFIG_NAME), 'utf-8'));
+    }
+    catch {
+        return null;
+    }
+}
+function writeDiscoveryFile(info, dir = DEFAULT_DIR) {
+    ensureDir(dir);
+    fs.writeFileSync(path.join(dir, DISCOVERY_NAME), JSON.stringify({ v: 1, ...info }, null, 2) + '\n', { mode: 0o600 });
+}
+function bridgeLogPath(dir = DEFAULT_DIR) {
+    ensureDir(dir);
+    return path.join(dir, 'bridge.log');
+}

package/dist/bridge/mcpRegister.d.ts

@@ -0,0 +1,28 @@
+/**
+ * bct-05 — idempotent MCP registration into the user's Claude Code.
+ *
+ * Writes to someone else's machine config, so it is loud and idempotent:
+ * checks `claude mcp list` first, prints exactly what it ran or skipped,
+ * and a missing `claude` binary is a warning, never a crash (the bridge
+ * still serves terminals without MCP).
+ */
+export type ExecRunner = (cmd: string, args: string[]) => Promise<{
+    stdout: string;
+    code: number;
+}>;
+export interface McpRegisterOpts {
+    connectToken: string;
+    apiUrl: string;
+    run: ExecRunner;
+    /** Set when a fresh token was just provided: an existing registration
+     *  carries the OLD token env and must be replaced, not skipped. */
+    forceUpdate?: boolean;
+}
+export interface McpRegisterResult {
+    action: 'registered' | 're-registered' | 'already-registered' | 'claude-not-found';
+    command?: string;
+}
+export declare const MCP_SERVER_NAME = "wenrwa-marketplace";
+/** Connect Tokens must never appear in output — redact before printing. */
+export declare function redactToken(text: string): string;
+export declare function registerMcpServer(opts: McpRegisterOpts): Promise<McpRegisterResult>;