@wenrwa/marketplace-cli 0.4.5 → 0.4.6

package/dist/__tests__/bridge-server-local-endpoints.test.js

@@ -0,0 +1,197 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * TDD — lws-05: the three loopback HTTP endpoints backing the arena
+ * create-modal's local mode (PRD D3): POST /local/validate-path,
+ * POST /local/pick-folder, POST /local/add. Same server as bridge-server
+ * .test.ts (discovery/WS) — split into its own file since these are a
+ * distinct vertical slice. All handlers are injected opts (no real fs,
+ * osascript, or network — per the issue's "no real osascript in tests").
+ */
+const server_1 = require("../bridge/server");
+const sessionManager_1 = require("../bridge/sessionManager");
+class FakePty {
+    write() { }
+    resize() { }
+    kill() { }
+    onData() { }
+    onExit() { }
+}
+const ORIGIN = 'https://app.hiveop.io';
+const TOKEN = 'session-token-123';
+const factory = { spawn: () => new FakePty() };
+async function postJson(port, path, body, opts = {}) {
+    const headers = {
+        'content-type': 'application/json',
+        origin: opts.origin ?? ORIGIN,
+    };
+    if (opts.sessionToken !== undefined)
+        headers['x-bridge-session-token'] = opts.sessionToken;
+    const res = await fetch(`http://127.0.0.1:${port}${path}`, {
+        method: 'POST',
+        headers,
+        body: JSON.stringify(body),
+    });
+    return { status: res.status, json: await res.json().catch(() => null) };
+}
+describe('POST /local/validate-path', () => {
+    let handle;
+    afterEach(async () => {
+        await handle.close();
+    });
+    it('returns the validator result for a valid folder', async () => {
+        handle = await (0, server_1.startBridgeServer)({
+            sessionToken: TOKEN,
+            allowedOrigin: ORIGIN,
+            sessions: new sessionManager_1.SessionManager(factory),
+            validatePath: async () => ({ ok: true, name: 'my-app', fileCount: 214, isGitRepo: true }),
+        });
+        const { status, json } = await postJson(handle.port, '/local/validate-path', { path: '/Users/x/my-app' });
+        expect(status).toBe(200);
+        expect(json).toEqual({ ok: true, name: 'my-app', fileCount: 214, isGitRepo: true });
+    });
+    it('returns a typed error for an invalid path', async () => {
+        handle = await (0, server_1.startBridgeServer)({
+            sessionToken: TOKEN,
+            allowedOrigin: ORIGIN,
+            sessions: new sessionManager_1.SessionManager(factory),
+            validatePath: async () => ({ ok: false, error: 'not-exists' }),
+        });
+        const { status, json } = await postJson(handle.port, '/local/validate-path', { path: '/nope' });
+        expect(status).toBe(200);
+        expect(json).toEqual({ ok: false, error: 'not-exists' });
+    });
+    it('rejects a request from a non-arena Origin', async () => {
+        handle = await (0, server_1.startBridgeServer)({
+            sessionToken: TOKEN,
+            allowedOrigin: ORIGIN,
+            sessions: new sessionManager_1.SessionManager(factory),
+            validatePath: async () => ({ ok: true, name: 'x', fileCount: 1, isGitRepo: false }),
+        });
+        const { status } = await postJson(handle.port, '/local/validate-path', { path: '/x' }, { origin: 'https://evil.example' });
+        expect(status).toBe(403);
+    });
+    it('500s cleanly when the endpoint is not wired', async () => {
+        handle = await (0, server_1.startBridgeServer)({ sessionToken: TOKEN, allowedOrigin: ORIGIN, sessions: new sessionManager_1.SessionManager(factory) });
+        const { status } = await postJson(handle.port, '/local/validate-path', { path: '/x' });
+        expect(status).toBe(500);
+    });
+});
+describe('POST /local/pick-folder', () => {
+    let handle;
+    afterEach(async () => {
+        await handle.close();
+    });
+    it('returns the chosen path', async () => {
+        handle = await (0, server_1.startBridgeServer)({
+            sessionToken: TOKEN,
+            allowedOrigin: ORIGIN,
+            sessions: new sessionManager_1.SessionManager(factory),
+            pickFolder: async () => ({ path: '/Users/x/my-app' }),
+        });
+        const { status, json } = await postJson(handle.port, '/local/pick-folder', {});
+        expect(status).toBe(200);
+        expect(json).toEqual({ path: '/Users/x/my-app' });
+    });
+    it('surfaces {cancelled:true} when the user dismisses the dialog', async () => {
+        handle = await (0, server_1.startBridgeServer)({
+            sessionToken: TOKEN,
+            allowedOrigin: ORIGIN,
+            sessions: new sessionManager_1.SessionManager(factory),
+            pickFolder: async () => ({ cancelled: true }),
+        });
+        const { json } = await postJson(handle.port, '/local/pick-folder', {});
+        expect(json).toEqual({ cancelled: true });
+    });
+    it('surfaces {unsupported:true} on platforms with no native picker', async () => {
+        handle = await (0, server_1.startBridgeServer)({
+            sessionToken: TOKEN,
+            allowedOrigin: ORIGIN,
+            sessions: new sessionManager_1.SessionManager(factory),
+            pickFolder: async () => ({ unsupported: true }),
+        });
+        const { json } = await postJson(handle.port, '/local/pick-folder', {});
+        expect(json).toEqual({ unsupported: true });
+    });
+    it('one picker at a time — a second concurrent call gets 409 busy without invoking the picker again', async () => {
+        let resolvePick;
+        const pending = new Promise((resolve) => { resolvePick = resolve; });
+        const pickFolder = jest.fn().mockReturnValue(pending);
+        handle = await (0, server_1.startBridgeServer)({
+            sessionToken: TOKEN,
+            allowedOrigin: ORIGIN,
+            sessions: new sessionManager_1.SessionManager(factory),
+            pickFolder,
+        });
+        const first = postJson(handle.port, '/local/pick-folder', {});
+        await new Promise((r) => setTimeout(r, 10)); // let the first request start the picker
+        const second = await postJson(handle.port, '/local/pick-folder', {});
+        expect(second.status).toBe(409);
+        expect(second.json).toEqual({ busy: true });
+        expect(pickFolder).toHaveBeenCalledTimes(1);
+        resolvePick({ path: '/Users/x/app' });
+        const firstResult = await first;
+        expect(firstResult.json).toEqual({ path: '/Users/x/app' });
+        // The gate releases after completion — a third call runs the picker again.
+        const third = await postJson(handle.port, '/local/pick-folder', {});
+        expect(pickFolder).toHaveBeenCalledTimes(2);
+        expect(third.status).toBe(200);
+    });
+});
+describe('POST /local/add', () => {
+    let handle;
+    afterEach(async () => {
+        await handle.close();
+    });
+    it('requires the session token — missing/wrong is rejected with 401', async () => {
+        const addLocalWorkspace = jest.fn();
+        handle = await (0, server_1.startBridgeServer)({
+            sessionToken: TOKEN,
+            allowedOrigin: ORIGIN,
+            sessions: new sessionManager_1.SessionManager(factory),
+            addLocalWorkspace,
+        });
+        const missing = await postJson(handle.port, '/local/add', { path: '/x' });
+        expect(missing.status).toBe(401);
+        const wrong = await postJson(handle.port, '/local/add', { path: '/x' }, { sessionToken: 'wrong' });
+        expect(wrong.status).toBe(401);
+        expect(addLocalWorkspace).not.toHaveBeenCalled();
+    });
+    it('creates and returns the workspace summary with a valid session token', async () => {
+        handle = await (0, server_1.startBridgeServer)({
+            sessionToken: TOKEN,
+            allowedOrigin: ORIGIN,
+            sessions: new sessionManager_1.SessionManager(factory),
+            addLocalWorkspace: async ({ path, name }) => {
+                expect(path).toBe('/Users/x/my-app');
+                expect(name).toBeUndefined();
+                return { status: 'created', workspace: { id: 'ws-1', name: 'my-app' } };
+            },
+        });
+        const { status, json } = await postJson(handle.port, '/local/add', { path: '/Users/x/my-app' }, { sessionToken: TOKEN });
+        expect(status).toBe(201);
+        expect(json).toEqual({ ok: true, status: 'created', workspace: { id: 'ws-1', name: 'my-app' } });
+    });
+    it('is idempotent — an already-registered path returns 200 existing, not 201', async () => {
+        handle = await (0, server_1.startBridgeServer)({
+            sessionToken: TOKEN,
+            allowedOrigin: ORIGIN,
+            sessions: new sessionManager_1.SessionManager(factory),
+            addLocalWorkspace: async () => ({ status: 'existing', workspace: { id: 'ws-1', name: 'my-app' } }),
+        });
+        const { status, json } = await postJson(handle.port, '/local/add', { path: '/x' }, { sessionToken: TOKEN });
+        expect(status).toBe(200);
+        expect(json).toEqual({ ok: true, status: 'existing', workspace: { id: 'ws-1', name: 'my-app' } });
+    });
+    it('surfaces a creation error as ok:false without a 2xx status', async () => {
+        handle = await (0, server_1.startBridgeServer)({
+            sessionToken: TOKEN,
+            allowedOrigin: ORIGIN,
+            sessions: new sessionManager_1.SessionManager(factory),
+            addLocalWorkspace: async () => ({ status: 'error', message: 'device offline' }),
+        });
+        const { status, json } = await postJson(handle.port, '/local/add', { path: '/x' }, { sessionToken: TOKEN });
+        expect(status).toBe(500);
+        expect(json).toEqual({ ok: false, message: 'device offline' });
+    });
+});

package/dist/__tests__/bridge-server.test.js

@@ -125,6 +125,28 @@ describe('bridge WebSocket server', () => {
         expect(bad.status).toBe(403);
         expect(bad.headers.get('access-control-allow-origin')).toBeNull();
     });
+    it('lws-03: discovery advertises registered local workspaces, empty by default', async () => {
+        const res = await fetch(`http://127.0.0.1:${handle.port}/discovery`, { headers: { origin: ORIGIN } });
+        const body = await res.json();
+        expect(body.localWorkspaces).toEqual([]);
+    });
+    it('lws-03: discovery reflects the registry live — no restart needed — via a getter closure', async () => {
+        await handle.close();
+        const factory = { spawn: () => { const p = new FakePty(); ptys.push(p); return p; } };
+        let entries = [];
+        handle = await (0, server_1.startBridgeServer)({
+            sessionToken: TOKEN,
+            allowedOrigin: ORIGIN,
+            sessions: new sessionManager_1.SessionManager(factory),
+            getLocalWorkspaces: () => entries,
+        });
+        const before = await (await fetch(`http://127.0.0.1:${handle.port}/discovery`, { headers: { origin: ORIGIN } })).json();
+        expect(before.localWorkspaces).toEqual([]);
+        // Simulate `wen-market local add` mutating the registry mid-run.
+        entries = [{ workspaceId: 'ws-1', name: 'my-app', path: 'my-app' }];
+        const after = await (await fetch(`http://127.0.0.1:${handle.port}/discovery`, { headers: { origin: ORIGIN } })).json();
+        expect(after.localWorkspaces).toEqual([{ workspaceId: 'ws-1', name: 'my-app', path: 'my-app' }]);
+    });
     it('answers the Chrome Private-Network-Access preflight for the arena origin', async () => {
         const res = await fetch(`http://127.0.0.1:${handle.port}/discovery`, {
             method: 'OPTIONS',

package/dist/__tests__/bridge-workspace-multirepo.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/bridge-workspace-multirepo.test.js

@@ -0,0 +1,317 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * pucc-03 — model B multi-repo + per-terminal workspace cwd/env (ADR-0031).
+ *
+ * One container holds many workspaces' repos under /data/repos/<workspaceId>,
+ * cloned on demand the first time a terminal for that workspace opens. Every
+ * workspace-scoped terminal carries WENRWA_WORKSPACE_ID (and a per-session
+ * HT_AUTONOMOUS) in its PTY env so downstream tooling (pucc-04) can resolve
+ * the workspace inside the shared box. This suite pins that contract with the
+ * existing faked-PTY / fake-relay harness — no docker, no real shells.
+ */
+const os = __importStar(require("os"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
+const ws_1 = require("ws");
+const relayClient_1 = require("../bridge/relayClient");
+const sessionManager_1 = require("../bridge/sessionManager");
+const repoCheckout_1 = require("../bridge/repoCheckout");
+class FakePty {
+    opts;
+    written = [];
+    constructor(opts) {
+        this.opts = opts;
+    }
+    write(data) { this.written.push(data); }
+    resize() { }
+    kill() { }
+    dataCb = null;
+    onData(cb) { this.dataCb = cb; }
+    onExit(_cb) { }
+    emitData(d) { this.dataCb?.(d); }
+}
+const makeFactory = () => {
+    const ptys = [];
+    const factory = {
+        spawn: (opts) => {
+            const p = new FakePty(opts);
+            ptys.push(p);
+            return p;
+        },
+    };
+    return { factory, ptys };
+};
+// ── fake-relay + frame-queue helpers (mirror bridge-relay-client.test.ts) ──
+function frameQueue(ws) {
+    const frames = [];
+    const waiters = [];
+    ws.on('message', (raw) => {
+        const f = JSON.parse(String(raw));
+        const w = waiters.shift();
+        if (w)
+            w(f);
+        else
+            frames.push(f);
+    });
+    return {
+        next: () => frames.length > 0 ? Promise.resolve(frames.shift()) : new Promise((r) => waiters.push(r)),
+    };
+}
+function startFakeRelay() {
+    return new Promise((resolve) => {
+        const wss = new ws_1.WebSocketServer({ port: 0, host: '127.0.0.1' });
+        const queue = [];
+        const waiters = [];
+        wss.on('connection', (ws) => {
+            const w = waiters.shift();
+            if (w)
+                w(ws);
+            else
+                queue.push(ws);
+        });
+        wss.on('listening', () => {
+            const addr = wss.address();
+            const port = typeof addr === 'object' && addr ? addr.port : 0;
+            resolve({
+                wss,
+                port,
+                nextConnection: () => (queue.length > 0 ? Promise.resolve(queue.shift()) : new Promise((r) => waiters.push(r))),
+            });
+        });
+    });
+}
+function closeRelay(wss) {
+    return new Promise((resolve, reject) => {
+        for (const client of wss.clients)
+            client.terminate();
+        wss.close((err) => (err ? reject(err) : resolve()));
+    });
+}
+// ── ensureWorkspaceRepo: /data/repos/<workspaceId> clone-on-demand ──────
+describe('ensureWorkspaceRepo — per-workspace clone-on-demand (ADR-0031 layout)', () => {
+    const REPOS = '/data/repos';
+    const makeDeps = (existing = [], cloneFails = false) => {
+        const runs = [];
+        return {
+            runs,
+            deps: {
+                reposBaseDir: REPOS,
+                exists: (p) => existing.includes(p),
+                mkdir: (_p) => { },
+                run: async (cmd, args) => {
+                    runs.push([cmd, ...args]);
+                    if (cloneFails)
+                        throw new Error('clone failed');
+                    return { stdout: '', code: 0 };
+                },
+            },
+        };
+    };
+    it('clones a missing workspace repo to /data/repos/<workspaceId>', async () => {
+        const { deps, runs } = makeDeps();
+        const result = await (0, repoCheckout_1.ensureWorkspaceRepo)({ workspaceId: 'ws-42', repoUrl: 'https://github.com/acme/widgets.git' }, deps);
+        expect(result).toEqual({ path: `${REPOS}/ws-42`, action: 'cloned' });
+        expect(runs[0].join(' ')).toBe(`git clone https://github.com/acme/widgets.git ${REPOS}/ws-42`);
+    });
+    it('reuses an existing checkout (.git present) without running git — no re-clone', async () => {
+        const { deps, runs } = makeDeps([`${REPOS}/ws-42/.git`]);
+        const result = await (0, repoCheckout_1.ensureWorkspaceRepo)({ workspaceId: 'ws-42', repoUrl: 'https://github.com/acme/widgets.git' }, deps);
+        expect(result).toEqual({ path: `${REPOS}/ws-42`, action: 'existing' });
+        expect(runs).toHaveLength(0);
+    });
+    it('is keyed by workspaceId, not repo name (distinct workspaces → distinct dirs)', async () => {
+        const { deps } = makeDeps();
+        const a = await (0, repoCheckout_1.ensureWorkspaceRepo)({ workspaceId: 'alpha', repoUrl: 'https://github.com/acme/widgets.git' }, deps);
+        const b = await (0, repoCheckout_1.ensureWorkspaceRepo)({ workspaceId: 'beta', repoUrl: 'https://github.com/acme/widgets.git' }, deps);
+        expect(a.path).toBe(`${REPOS}/alpha`);
+        expect(b.path).toBe(`${REPOS}/beta`);
+    });
+    it('reports failure (→ terminal falls back to home) when there is no url and no checkout', async () => {
+        const { deps, runs } = makeDeps();
+        const result = await (0, repoCheckout_1.ensureWorkspaceRepo)({ workspaceId: 'ws-42' }, deps);
+        expect(result.action).toBe('failed');
+        expect(runs).toHaveLength(0);
+    });
+    it('reports failure without throwing when the clone fails', async () => {
+        const { deps } = makeDeps([], true);
+        const result = await (0, repoCheckout_1.ensureWorkspaceRepo)({ workspaceId: 'ws-42', repoUrl: 'https://github.com/p/r' }, deps);
+        expect(result.action).toBe('failed');
+    });
+});
+// ── SessionManager: per-session env reaches the PTY factory ─────────────
+describe('SessionManager — per-session env passthrough (pucc-03)', () => {
+    it('forwards env to the PTY factory spawn opts', () => {
+        const { factory, ptys } = makeFactory();
+        const sm = new sessionManager_1.SessionManager(factory);
+        sm.open({ cols: 80, rows: 24, cwd: '/data/repos/ws-1', env: { WENRWA_WORKSPACE_ID: 'ws-1' } });
+        expect(ptys[0].opts.cwd).toBe('/data/repos/ws-1');
+        expect(ptys[0].opts.env).toEqual({ WENRWA_WORKSPACE_ID: 'ws-1' });
+    });
+});
+// ── relay client: the workspaceId → cwd + env contract pucc-04 builds on ──
+describe('relay client — workspace-scoped open (pucc-03 contract)', () => {
+    it('open with workspaceId+repoUrl spawns in the resolved cwd with WENRWA_WORKSPACE_ID env, echoes workspaceId', async () => {
+        const relay = await startFakeRelay();
+        const { factory, ptys } = makeFactory();
+        const sessions = new sessionManager_1.SessionManager(factory);
+        const resolveCalls = [];
+        const handle = (0, relayClient_1.startRelayClient)({
+            relayUrl: `ws://127.0.0.1:${relay.port}`,
+            relayToken: 'tok',
+            sessions,
+            resolveWorkspaceCwd: async (o) => {
+                resolveCalls.push(o);
+                return `/data/repos/${o.workspaceId}`;
+            },
+        });
+        const ws = await relay.nextConnection();
+        const q = frameQueue(ws);
+        await q.next(); // auth
+        ws.send(JSON.stringify({ t: 'open', cols: 80, rows: 24, workspaceId: 'ws-7', repoUrl: 'https://github.com/acme/w.git' }));
+        const opened = await q.next();
+        expect(opened.t).toBe('opened');
+        expect(opened.workspaceId).toBe('ws-7');
+        expect(opened.cwd).toBe('/data/repos/ws-7');
+        expect(resolveCalls).toEqual([{ workspaceId: 'ws-7', repoUrl: 'https://github.com/acme/w.git' }]);
+        expect(ptys[0].opts.cwd).toBe('/data/repos/ws-7');
+        expect(ptys[0].opts.env).toMatchObject({ WENRWA_WORKSPACE_ID: 'ws-7', HT_AUTONOMOUS: '0' });
+        handle.close();
+        await closeRelay(relay.wss);
+    });
+    it('autonomous:true selects HT_AUTONOMOUS=1 per session (claude --dangerously-skip-permissions)', async () => {
+        const relay = await startFakeRelay();
+        const { factory, ptys } = makeFactory();
+        const sessions = new sessionManager_1.SessionManager(factory);
+        const handle = (0, relayClient_1.startRelayClient)({
+            relayUrl: `ws://127.0.0.1:${relay.port}`,
+            relayToken: 'tok',
+            sessions,
+            resolveWorkspaceCwd: async ({ workspaceId }) => `/data/repos/${workspaceId}`,
+        });
+        const ws = await relay.nextConnection();
+        const q = frameQueue(ws);
+        await q.next();
+        ws.send(JSON.stringify({ t: 'open', cols: 80, rows: 24, workspaceId: 'ws-9', autonomous: true }));
+        await q.next();
+        expect(ptys[0].opts.env).toMatchObject({ WENRWA_WORKSPACE_ID: 'ws-9', HT_AUTONOMOUS: '1' });
+        handle.close();
+        await closeRelay(relay.wss);
+    });
+    it('sets WENRWA_WORKSPACE_ID even when the checkout is unavailable (cwd falls back to home)', async () => {
+        const relay = await startFakeRelay();
+        const { factory, ptys } = makeFactory();
+        const sessions = new sessionManager_1.SessionManager(factory);
+        const handle = (0, relayClient_1.startRelayClient)({
+            relayUrl: `ws://127.0.0.1:${relay.port}`,
+            relayToken: 'tok',
+            sessions,
+            resolveWorkspaceCwd: async () => null, // clone failed / no url
+        });
+        const ws = await relay.nextConnection();
+        const q = frameQueue(ws);
+        await q.next();
+        ws.send(JSON.stringify({ t: 'open', cols: 80, rows: 24, workspaceId: 'ws-x' }));
+        const opened = await q.next();
+        expect(opened.workspaceId).toBe('ws-x');
+        expect(opened.cwd).toBeUndefined();
+        expect(ptys[0].opts.cwd).toBeUndefined();
+        expect(ptys[0].opts.env).toMatchObject({ WENRWA_WORKSPACE_ID: 'ws-x' });
+        handle.close();
+        await closeRelay(relay.wss);
+    });
+    it('legacy fallback: open WITHOUT workspaceId spawns a plain shell (no cwd, no injected env)', async () => {
+        const relay = await startFakeRelay();
+        const { factory, ptys } = makeFactory();
+        const sessions = new sessionManager_1.SessionManager(factory);
+        const handle = (0, relayClient_1.startRelayClient)({
+            relayUrl: `ws://127.0.0.1:${relay.port}`,
+            relayToken: 'tok',
+            sessions,
+            resolveWorkspaceCwd: async () => '/should/not/be/used',
+        });
+        const ws = await relay.nextConnection();
+        const q = frameQueue(ws);
+        await q.next();
+        ws.send(JSON.stringify({ t: 'open', cols: 80, rows: 24 }));
+        const opened = await q.next();
+        expect(opened.t).toBe('opened');
+        expect(opened.workspaceId).toBeUndefined();
+        expect(ptys[0].opts.cwd).toBeUndefined();
+        expect(ptys[0].opts.env).toBeUndefined();
+        handle.close();
+        await closeRelay(relay.wss);
+    });
+});
+/**
+ * Env-gated integration (RUN_HT_INTEGRATION): proves clone-on-demand + reuse
+ * against a REAL git binary and temp dirs — no docker required, but skipped by
+ * default so CI/this-machine never blocks on it. The full docker-level check
+ * (RUN_HT_DOCKER) lands in the deploy/verify stage (pucc-09 cutover), where an
+ * actual image + Fly volume exist to exercise the shared-container path.
+ */
+const runIntegration = process.env.RUN_HT_INTEGRATION === '1';
+(runIntegration ? describe : describe.skip)('ensureWorkspaceRepo — real git clone-on-demand (env-gated)', () => {
+    it('clones on first call then reuses the checkout on the second (idempotent)', async () => {
+        const root = fs.mkdtempSync(path.join(os.tmpdir(), 'pucc03-'));
+        const origin = path.join(root, 'origin.git');
+        const repos = path.join(root, 'repos');
+        (0, child_process_1.execFileSync)('git', ['init', '--bare', origin]);
+        // seed the bare origin with one commit so `git clone` produces a checkout
+        const seed = path.join(root, 'seed');
+        (0, child_process_1.execFileSync)('git', ['clone', origin, seed]);
+        fs.writeFileSync(path.join(seed, 'README.md'), '# hi\n');
+        (0, child_process_1.execFileSync)('git', ['-C', seed, 'add', '.']);
+        (0, child_process_1.execFileSync)('git', ['-C', seed, '-c', 'user.email=t@t', '-c', 'user.name=t', 'commit', '-m', 'init']);
+        (0, child_process_1.execFileSync)('git', ['-C', seed, 'push', 'origin', 'HEAD:refs/heads/main']);
+        const deps = {
+            reposBaseDir: repos,
+            exists: (p) => fs.existsSync(p),
+            mkdir: (p) => fs.mkdirSync(p, { recursive: true }),
+            run: async (cmd, args) => {
+                (0, child_process_1.execFileSync)(cmd, args);
+                return { stdout: '', code: 0 };
+            },
+        };
+        const first = await (0, repoCheckout_1.ensureWorkspaceRepo)({ workspaceId: 'ws-int', repoUrl: origin }, deps);
+        expect(first.action).toBe('cloned');
+        expect(fs.existsSync(path.join(repos, 'ws-int', '.git'))).toBe(true);
+        const second = await (0, repoCheckout_1.ensureWorkspaceRepo)({ workspaceId: 'ws-int', repoUrl: origin }, deps);
+        expect(second.action).toBe('existing');
+        fs.rmSync(root, { recursive: true, force: true });
+    });
+});

package/dist/__tests__/devices.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/devices.test.js

@@ -0,0 +1,66 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * TDD — lws-03: `wen-market devices` list/revoke. Uses this machine's own
+ * Connect Token (bridge-config.json) — no interactive login required.
+ */
+const chalk_1 = __importDefault(require("chalk"));
+const mockLoadBridgeConfig = jest.fn();
+jest.mock('../bridge/config', () => ({
+    loadBridgeConfig: () => mockLoadBridgeConfig(),
+}));
+const mockListDevices = jest.fn();
+const mockRevokeDevice = jest.fn();
+jest.mock('../bridge/apiClient', () => ({
+    listDevices: (...args) => mockListDevices(...args),
+    revokeDevice: (...args) => mockRevokeDevice(...args),
+}));
+jest.mock('../commands/bridge', () => ({ bridgeApiUrl: () => 'https://api.x' }));
+const devices_1 = require("../commands/devices");
+async function runCommand(...args) {
+    await devices_1.devicesCommand.parseAsync(args, { from: 'user' });
+}
+beforeAll(() => {
+    chalk_1.default.level = 0;
+});
+beforeEach(() => {
+    jest.clearAllMocks();
+    mockLoadBridgeConfig.mockReturnValue({ connectToken: 'wm_ct_' + 'a'.repeat(64), deviceId: 'd-this' });
+});
+describe('devices list', () => {
+    it('lists devices and marks the current one', async () => {
+        mockListDevices.mockResolvedValue({ success: true, devices: [
+                { id: 'd-this', name: 'bunny-mbp', revokedAt: null },
+                { id: 'd-other', name: 'other-box', revokedAt: null },
+            ] });
+        const spy = jest.spyOn(console, 'log').mockImplementation();
+        await runCommand();
+        const output = spy.mock.calls.map((c) => c[0]).join('\n');
+        expect(output).toContain('bunny-mbp');
+        expect(output).toContain('other-box');
+        expect(output).toContain('this machine');
+        spy.mockRestore();
+    });
+    it('errors clearly with no Connect Token configured', async () => {
+        mockLoadBridgeConfig.mockReturnValue(null);
+        const errSpy = jest.spyOn(console, 'error').mockImplementation();
+        const exitSpy = jest.spyOn(process, 'exit').mockImplementation(() => undefined);
+        await runCommand();
+        expect(mockListDevices).not.toHaveBeenCalled();
+        expect(exitSpy).toHaveBeenCalledWith(1);
+        errSpy.mockRestore();
+        exitSpy.mockRestore();
+    });
+});
+describe('devices revoke', () => {
+    it('revokes a device by id', async () => {
+        mockRevokeDevice.mockResolvedValue({ success: true });
+        const spy = jest.spyOn(console, 'log').mockImplementation();
+        await runCommand('revoke', 'd-other');
+        expect(mockRevokeDevice).toHaveBeenCalledWith(expect.anything(), 'd-other');
+        spy.mockRestore();
+    });
+});

package/dist/__tests__/local.test.d.ts

@@ -0,0 +1 @@
+export {};