@wenrwa/marketplace-cli 0.6.4 → 0.6.6

package/dist/__tests__/agent.test.js

@@ -54,6 +54,21 @@ describe('agent list', () => {
         spy.mockRestore();
     });
 });
+describe('agent logs', () => {
+    // sio-07: `agent logs` streams via the SAME connectWebSocket() helper
+    // dashboard.ts uses, which is what carries the authenticated handshake
+    // (auth: { token }, path '/marketplace') — exercised directly in
+    // websocket.test.ts. This just pins that `agent logs` still wires through
+    // that one shared call site rather than opening its own socket.
+    it('streams via the shared authenticated websocket helper', async () => {
+        const { connectWebSocket } = require('../utils/websocket');
+        const logSpy = jest.spyOn(console, 'log').mockImplementation();
+        await runCommand('logs', 'wallet-abc-12345678');
+        expect(connectWebSocket).toHaveBeenCalledTimes(1);
+        expect(connectWebSocket).toHaveBeenCalledWith(expect.any(Function), { channel: 'agent', filters: { agentWallet: 'wallet-abc-12345678' } });
+        logSpy.mockRestore();
+    });
+});
 describe('agent status', () => {
     it('displays agent details', async () => {
         mockClient.get.mockImplementation((path) => {

package/dist/__tests__/bridge-rival-touch-forwarder.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/bridge-rival-touch-forwarder.test.js

@@ -0,0 +1,266 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * rival-10 — a LOCAL agent's live file touches reach a ranked rival, like a
+ * hosted agent's. What leaves the laptop: agent id + file paths, only for a
+ * workspace the server says is a live ranked match this user owns. Nothing
+ * else, and nothing at all for any other workspace.
+ */
+const ws_1 = __importDefault(require("ws"));
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const server_1 = require("../bridge/server");
+const sessionManager_1 = require("../bridge/sessionManager");
+const rivalTouchForwarder_1 = require("../bridge/rivalTouchForwarder");
+const apiClient_1 = require("../bridge/apiClient");
+const MATCH_WS = 'bbbbbbbb-0000-4000-8000-00000000000b';
+const OTHER_WS = 'dddddddd-0000-4000-8000-00000000000d';
+const CHECKOUT = '/Users/bob/wenrwa-workspaces/m-11111111-b';
+function harness(statusOf, opts = {}) {
+    let now = 1_000_000;
+    const asked = [];
+    const sent = [];
+    const fwd = (0, rivalTouchForwarder_1.createRivalTouchForwarder)({
+        status: async (ws) => {
+            asked.push(ws);
+            const s = statusOf[ws] ?? { live: false, recheckMs: 600_000 };
+            if (s instanceof Error)
+                throw s;
+            return s;
+        },
+        send: async (workspaceId, touches) => {
+            if (opts.sendFails)
+                throw new Error('409 RANKED_RIVAL_CLOSED');
+            sent.push({ workspaceId, touches });
+        },
+        now: () => now,
+        scheduleInterval: () => 'h',
+        cancelInterval: () => undefined,
+    });
+    return { fwd, asked, sent, advance: (ms) => void (now += ms) };
+}
+describe('forwardablePaths — only paths, and only inside the checkout', () => {
+    it('relativises an absolute path under the checkout; keeps relative paths', () => {
+        expect((0, rivalTouchForwarder_1.forwardablePaths)([`${CHECKOUT}/src/planner.ts`, 'src/b.ts'], CHECKOUT)).toEqual(['src/planner.ts', 'src/b.ts']);
+    });
+    it('drops a path outside the checkout, climbing out, non-strings, duplicates', () => {
+        expect((0, rivalTouchForwarder_1.forwardablePaths)(['/etc/hosts', `${CHECKOUT}/../x.ts`, '../up.ts', 42, null, 'a.ts', 'a.ts'], CHECKOUT)).toEqual(['a.ts']);
+        expect((0, rivalTouchForwarder_1.forwardablePaths)('src/a.ts', CHECKOUT)).toEqual([]);
+    });
+    it('no known checkout: an absolute path is kept for the server to place (or drop)', () => {
+        expect((0, rivalTouchForwarder_1.forwardablePaths)(['/home/x/m-b/src/a.ts'])).toEqual(['/home/x/m-b/src/a.ts']);
+    });
+    it('caps paths per touch', () => {
+        expect((0, rivalTouchForwarder_1.forwardablePaths)(Array.from({ length: 40 }, (_, i) => `f${i}.ts`))).toHaveLength(20);
+    });
+});
+describe('createRivalTouchForwarder', () => {
+    it('a live match workspace: the touch goes up as agent id + paths — nothing else', async () => {
+        const h = harness({ [MATCH_WS]: { live: true, recheckMs: 15_000 } });
+        h.fwd.touch({
+            workspaceId: MATCH_WS,
+            agentId: 'agent-1',
+            filePaths: [`${CHECKOUT}/src/planner.ts`],
+            cwd: CHECKOUT,
+            // A caller passing more than it should: never forwarded.
+            ...{ thinking: 'Editing planner.ts', tool: 'Edit', content: 'secret code' },
+        });
+        await h.fwd.flush();
+        expect(h.asked).toEqual([MATCH_WS]);
+        expect(h.sent).toEqual([{ workspaceId: MATCH_WS, touches: [{ agentId: 'agent-1', filePaths: ['src/planner.ts'] }] }]);
+        const json = JSON.stringify(h.sent);
+        for (const w of ['Editing', 'Edit"', 'secret code', '/Users/bob'])
+            expect(json).not.toContain(w);
+    });
+    it('any other workspace: asked once (workspace id only), then nothing sent — and not asked again until recheck', async () => {
+        const h = harness({ [OTHER_WS]: { live: false, recheckMs: 600_000 } });
+        h.fwd.touch({ workspaceId: OTHER_WS, agentId: 'agent-1', filePaths: ['src/a.ts'] });
+        await h.fwd.flush();
+        h.fwd.touch({ workspaceId: OTHER_WS, agentId: 'agent-1', filePaths: ['src/b.ts'] });
+        await h.fwd.flush();
+        expect(h.sent).toEqual([]);
+        expect(h.asked).toEqual([OTHER_WS]);
+    });
+    it('before GO the server says "ask again soon"; touches then are dropped, the ones after GO fly', async () => {
+        const status = { [MATCH_WS]: { live: false, recheckMs: 5_000 } };
+        const h = harness(status);
+        h.fwd.touch({ workspaceId: MATCH_WS, agentId: 'a', filePaths: ['early.ts'] });
+        await h.fwd.flush();
+        expect(h.sent).toEqual([]);
+        status[MATCH_WS] = { live: true, recheckMs: 15_000 };
+        h.advance(5_001);
+        h.fwd.touch({ workspaceId: MATCH_WS, agentId: 'a', filePaths: ['late.ts'] });
+        await h.fwd.flush();
+        expect(h.sent.flatMap((s) => s.touches)).toEqual([{ agentId: 'a', filePaths: ['late.ts'] }]);
+    });
+    it('the match ends: the next status says no, and forwarding stops', async () => {
+        const status = { [MATCH_WS]: { live: true, recheckMs: 15_000 } };
+        const h = harness(status);
+        h.fwd.touch({ workspaceId: MATCH_WS, agentId: 'a', filePaths: ['one.ts'] });
+        await h.fwd.flush();
+        status[MATCH_WS] = { live: false, recheckMs: 600_000 };
+        h.advance(15_001);
+        h.fwd.touch({ workspaceId: MATCH_WS, agentId: 'a', filePaths: ['two.ts'] });
+        await h.fwd.flush();
+        expect(h.sent.flatMap((s) => s.touches.flatMap((t) => t.filePaths))).toEqual(['one.ts']);
+    });
+    it('a status failure is "not live": nothing is sent', async () => {
+        const h = harness({ [MATCH_WS]: new Error('offline') });
+        h.fwd.touch({ workspaceId: MATCH_WS, agentId: 'a', filePaths: ['x.ts'] });
+        await h.fwd.flush();
+        expect(h.sent).toEqual([]);
+    });
+    it('a refused POST stops forwarding for that workspace until it is asked again', async () => {
+        const h = harness({ [MATCH_WS]: { live: true, recheckMs: 15_000 } }, { sendFails: true });
+        h.fwd.touch({ workspaceId: MATCH_WS, agentId: 'a', filePaths: ['x.ts'] });
+        await h.fwd.flush();
+        h.fwd.touch({ workspaceId: MATCH_WS, agentId: 'a', filePaths: ['y.ts'] });
+        await h.fwd.flush();
+        expect(h.asked).toEqual([MATCH_WS]); // backed off: y.ts was dropped, not re-asked at once
+    });
+    it('a touch with no forwardable path, or no workspace, leaves nothing and asks nothing', async () => {
+        const h = harness({ [MATCH_WS]: { live: true, recheckMs: 15_000 } });
+        h.fwd.touch({ workspaceId: MATCH_WS, agentId: 'a', filePaths: ['/etc/hosts'], cwd: CHECKOUT });
+        h.fwd.touch({ workspaceId: '', agentId: 'a', filePaths: ['x.ts'] });
+        h.fwd.touch({ workspaceId: MATCH_WS, agentId: 'a', filePaths: undefined });
+        await h.fwd.flush();
+        expect(h.asked).toEqual([]);
+        expect(h.sent).toEqual([]);
+    });
+    it('batches: many touches in one flush go in requests of at most 50', async () => {
+        const h = harness({ [MATCH_WS]: { live: true, recheckMs: 15_000 } });
+        for (let i = 0; i < 120; i++)
+            h.fwd.touch({ workspaceId: MATCH_WS, agentId: 'a', filePaths: [`f${i}.ts`] });
+        await h.fwd.flush();
+        expect(h.sent.map((s) => s.touches.length)).toEqual([50, 50, 20]);
+    });
+});
+describe('apiClient — the two calls, over the Connect Token', () => {
+    it('status sends the workspace id only; POST sends { touches: [{ agentId, filePaths }] } only', async () => {
+        const calls = [];
+        const fetchImpl = async (url, init) => {
+            calls.push({ url, init });
+            return { ok: true, status: 200, json: async () => ({ success: true, data: { live: true, recheckMs: 15_000 } }) };
+        };
+        const api = { apiUrl: 'https://api.example/api/v1', connectToken: 'wm_ct_x', fetchImpl };
+        await expect((0, apiClient_1.getRivalTouchStatus)(api, MATCH_WS)).resolves.toEqual({ live: true, recheckMs: 15_000 });
+        await (0, apiClient_1.postRivalTouches)(api, MATCH_WS, [{ agentId: 'a', filePaths: ['src/x.ts'], thinking: 'no' }]);
+        expect(calls[0].url).toBe(`https://api.example/api/v1/ranked/workspaces/${MATCH_WS}/touches`);
+        expect(calls[0].init.method).toBe('GET');
+        expect(calls[0].init.body).toBeUndefined();
+        expect(calls[0].init.headers.Authorization).toBe('Bearer wm_ct_x');
+        expect(calls[1].init.method).toBe('POST');
+        expect(JSON.parse(calls[1].init.body)).toEqual({ touches: [{ agentId: 'a', filePaths: ['src/x.ts'] }] });
+    });
+});
+// ── the loopback server: which records reach the forwarder ──────────────────
+class FakePty {
+    write() { }
+    resize() { }
+    kill() { }
+    onData() { }
+    onExit() { }
+}
+const ORIGIN = 'https://app.hiveop.io';
+const TOKEN = 'session-token-123';
+describe('bridge server → forwardRivalTouch', () => {
+    it("a local workspace agent's tailed record hands on workspace + agent + paths (never thinking/tool); a record for any other session hands on nothing", async () => {
+        const file = fs.mkdtempSync(path.join(os.tmpdir(), 'rival10-activity-')) + '/activity.jsonl';
+        fs.writeFileSync(file, '');
+        const tick = { fn: null };
+        const forwarded = [];
+        const handle = await (0, server_1.startBridgeServer)({
+            sessionToken: TOKEN,
+            allowedOrigin: ORIGIN,
+            sessions: new sessionManager_1.SessionManager({ spawn: () => new FakePty() }),
+            resolveLocalAgentCwd: () => CHECKOUT,
+            activityFile: file,
+            hiveOpSettingsPath: '/Users/t/.wen-market/claude-hooks-settings.json',
+            activityScheduleInterval: (cb) => { tick.fn = cb; return 'h'; },
+            activityCancelInterval: () => { },
+            forwardRivalTouch: (t) => forwarded.push(t),
+        });
+        try {
+            const ws = new ws_1.default(`ws://127.0.0.1:${handle.port}`, { headers: { origin: ORIGIN } });
+            const frames = [];
+            ws.on('message', (raw) => frames.push(JSON.parse(String(raw))));
+            await new Promise((r) => ws.on('open', r));
+            ws.send(JSON.stringify({ v: 1, token: TOKEN }));
+            ws.send(JSON.stringify({ t: 'open', cols: 80, rows: 24, agentId: 'agent-1', workspaceId: MATCH_WS }));
+            await waitFor(() => frames.some((f) => f.t === 'opened'));
+            fs.appendFileSync(file, [
+                { sessionId: 'agent-1', filePaths: [`${CHECKOUT}/src/planner.ts`], thinking: 'Editing planner.ts', tool: 'Edit' },
+                { sessionId: 'agent-1', thinking: 'Running npm test', tool: 'Bash' }, // no paths: nothing to forward
+                { sessionId: 'crew-member-9', filePaths: ['src/other.ts'] }, // not a loopback agent of a workspace
+            ].map((r) => JSON.stringify(r)).join('\n') + '\n');
+            tick.fn?.();
+            await waitFor(() => frames.filter((f) => f.t === 'activity').length === 3);
+            expect(forwarded).toEqual([
+                { workspaceId: MATCH_WS, agentId: 'agent-1', filePaths: [`${CHECKOUT}/src/planner.ts`], cwd: CHECKOUT },
+            ]);
+            // The pilot's own browser still gets the full frame, unchanged.
+            expect(frames.find((f) => f.t === 'activity')).toEqual({
+                t: 'activity',
+                sessionId: 'agent-1',
+                filePaths: [`${CHECKOUT}/src/planner.ts`],
+                thinking: 'Editing planner.ts',
+            });
+            // Closed: its later records are not forwarded.
+            ws.send(JSON.stringify({ t: 'close', sessionId: 'agent-1' }));
+            await new Promise((r) => setTimeout(r, 30));
+            fs.appendFileSync(file, JSON.stringify({ sessionId: 'agent-1', filePaths: ['src/late.ts'] }) + '\n');
+            tick.fn?.();
+            await new Promise((r) => setTimeout(r, 30));
+            expect(forwarded).toHaveLength(1);
+            ws.close();
+        }
+        finally {
+            await handle.close();
+        }
+    });
+});
+async function waitFor(cond, ms = 2_000) {
+    const until = Date.now() + ms;
+    while (!cond()) {
+        if (Date.now() > until)
+            throw new Error('timed out');
+        await new Promise((r) => setTimeout(r, 5));
+    }
+}

package/dist/__tests__/websocket.test.js

@@ -4,10 +4,35 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const chalk_1 = __importDefault(require("chalk"));
+const events_1 = require("events");
+// sio-07 (docs/prd/authenticated-sockets.md): the CLI is a headless client —
+// it must authenticate the Socket.IO handshake with `auth: { token }`
+// (never the retired `walletPubkey` field) against the server's
+// `/marketplace` path (backend/src/server.ts), and surface a clear message
+// on refusal. connectWebSocket() is the single call site both
+// `dashboard.ts` and `agent.ts` (`agent logs`) share, so exercising it here
+// covers the handshake contract for both commands.
+const TEST_API_KEY = 'wm_sk_' + 'a'.repeat(64);
+const mockIo = jest.fn();
+jest.mock('socket.io-client', () => ({
+    io: (...args) => mockIo(...args),
+}));
+jest.mock('../utils/config', () => ({
+    requireConfig: jest.fn().mockReturnValue({
+        apiUrl: 'https://api.wenrwa.com/api/v1/api/marketplace',
+        apiKey: 'wm_sk_' + 'a'.repeat(64),
+    }),
+}));
 const websocket_1 = require("../utils/websocket");
+class FakeSocket extends events_1.EventEmitter {
+    disconnect = jest.fn();
+}
 beforeAll(() => {
     chalk_1.default.level = 0;
 });
+beforeEach(() => {
+    mockIo.mockReset();
+});
 function makeEvent(event, data, timestamp) {
     return { event, data, timestamp: timestamp || '2024-06-15T14:30:00.000Z' };
 }
@@ -59,3 +84,71 @@ describe('formatEventJson()', () => {
         expect(result.event).toBe('test');
     });
 });
+describe('connectWebSocket() handshake (sio-07)', () => {
+    it('authenticates with auth.token = the API key', () => {
+        const fake = new FakeSocket();
+        mockIo.mockReturnValue(fake);
+        (0, websocket_1.connectWebSocket)(() => { });
+        expect(mockIo).toHaveBeenCalledTimes(1);
+        const [, opts] = mockIo.mock.calls[0];
+        expect(opts.auth).toEqual({ token: TEST_API_KEY });
+    });
+    it('never sends the retired walletPubkey field', () => {
+        const fake = new FakeSocket();
+        mockIo.mockReturnValue(fake);
+        (0, websocket_1.connectWebSocket)(() => { });
+        const [, opts] = mockIo.mock.calls[0];
+        expect(opts.auth).not.toHaveProperty('walletPubkey');
+        expect(JSON.stringify(opts)).not.toContain('walletPubkey');
+    });
+    it('connects on the server\'s /marketplace Socket.IO path', () => {
+        const fake = new FakeSocket();
+        mockIo.mockReturnValue(fake);
+        (0, websocket_1.connectWebSocket)(() => { });
+        const [, opts] = mockIo.mock.calls[0];
+        expect(opts.path).toBe('/marketplace');
+    });
+    it('shows a clear message and tells the user to log in again on CREDENTIAL_INVALID', () => {
+        const fake = new FakeSocket();
+        mockIo.mockReturnValue(fake);
+        const errorSpy = jest.spyOn(console, 'error').mockImplementation(() => { });
+        (0, websocket_1.connectWebSocket)(() => { });
+        const err = new Error('invalid credential');
+        err.data = { code: 'CREDENTIAL_INVALID' };
+        fake.emit('connect_error', err);
+        const printed = errorSpy.mock.calls.map((c) => c.join(' ')).join('\n');
+        expect(printed).toMatch(/wen-market auth login/);
+        errorSpy.mockRestore();
+    });
+    it('shows a clear message and tells the user to log in again on SESSION_REVOKED', () => {
+        const fake = new FakeSocket();
+        mockIo.mockReturnValue(fake);
+        const errorSpy = jest.spyOn(console, 'error').mockImplementation(() => { });
+        (0, websocket_1.connectWebSocket)(() => { });
+        const err = new Error('session revoked');
+        err.data = { code: 'SESSION_REVOKED' };
+        fake.emit('connect_error', err);
+        const printed = errorSpy.mock.calls.map((c) => c.join(' ')).join('\n');
+        expect(printed).toMatch(/wen-market auth login/);
+        errorSpy.mockRestore();
+    });
+    it('falls back to a generic message for other connect errors', () => {
+        const fake = new FakeSocket();
+        mockIo.mockReturnValue(fake);
+        const errorSpy = jest.spyOn(console, 'error').mockImplementation(() => { });
+        (0, websocket_1.connectWebSocket)(() => { });
+        fake.emit('connect_error', new Error('ECONNREFUSED'));
+        const printed = errorSpy.mock.calls.map((c) => c.join(' ')).join('\n');
+        expect(printed).toContain('ECONNREFUSED');
+        expect(printed).not.toMatch(/wen-market auth login/);
+        errorSpy.mockRestore();
+    });
+    it('subscribes to the requested channel on connect, unaffected by the auth change', () => {
+        const fake = new FakeSocket();
+        mockIo.mockReturnValue(fake);
+        const emitSpy = jest.spyOn(fake, 'emit');
+        (0, websocket_1.connectWebSocket)(() => { }, { channel: 'workspace', filters: { workspaceId: 'ws1' } });
+        fake.emit('connect');
+        expect(emitSpy).toHaveBeenCalledWith('subscribe', { channel: 'workspace', workspaceId: 'ws1' });
+    });
+});

package/dist/bridge/apiClient.d.ts

@@ -107,3 +107,17 @@ export declare function createLocalWorkspace(opts: BridgeApiOpts, params: {
 export declare function deleteWorkspace(opts: BridgeApiOpts, workspaceId: string): Promise<{
     success: boolean;
 }>;
+/**
+ * rival-10 — should this bridge forward its agents' file touches in
+ * `workspaceId`? Sends the workspace id only. `live` is true only for a ranked
+ * match workspace this user owns while the match is in play.
+ */
+export declare function getRivalTouchStatus(opts: BridgeApiOpts, workspaceId: string): Promise<{
+    live: boolean;
+    recheckMs: number;
+}>;
+/** rival-10 — forward live touches: agent id + file paths per touch, nothing else. */
+export declare function postRivalTouches(opts: BridgeApiOpts, workspaceId: string, touches: Array<{
+    agentId: string;
+    filePaths: string[];
+}>): Promise<void>;

package/dist/bridge/apiClient.js

@@ -8,6 +8,8 @@ exports.listDevices = listDevices;
 exports.revokeDevice = revokeDevice;
 exports.createLocalWorkspace = createLocalWorkspace;
 exports.deleteWorkspace = deleteWorkspace;
+exports.getRivalTouchStatus = getRivalTouchStatus;
+exports.postRivalTouches = postRivalTouches;
 class BridgeApiError extends Error {
     code;
     status;
@@ -96,3 +98,18 @@ function createLocalWorkspace(opts, params) {
 function deleteWorkspace(opts, workspaceId) {
     return bridgeRequest(opts, 'DELETE', `/workspaces/${workspaceId}`);
 }
+/**
+ * rival-10 — should this bridge forward its agents' file touches in
+ * `workspaceId`? Sends the workspace id only. `live` is true only for a ranked
+ * match workspace this user owns while the match is in play.
+ */
+async function getRivalTouchStatus(opts, workspaceId) {
+    const json = await bridgeRequest(opts, 'GET', `/ranked/workspaces/${encodeURIComponent(workspaceId)}/touches`);
+    return { live: json.data?.live === true, recheckMs: Number(json.data?.recheckMs) || 30_000 };
+}
+/** rival-10 — forward live touches: agent id + file paths per touch, nothing else. */
+async function postRivalTouches(opts, workspaceId, touches) {
+    await bridgeRequest(opts, 'POST', `/ranked/workspaces/${encodeURIComponent(workspaceId)}/touches`, {
+        touches: touches.map((t) => ({ agentId: t.agentId, filePaths: t.filePaths })),
+    });
+}

package/dist/bridge/rivalTouchForwarder.d.ts

@@ -0,0 +1,48 @@
+export interface ForwardedTouch {
+    agentId: string;
+    filePaths: string[];
+}
+export interface LiveTouchStatus {
+    live: boolean;
+    recheckMs: number;
+}
+export interface RivalTouchForwarderOpts {
+    /** GET /ranked/workspaces/:id/touches — sends the workspace id only. */
+    status(workspaceId: string): Promise<LiveTouchStatus>;
+    /** POST /ranked/workspaces/:id/touches. */
+    send(workspaceId: string, touches: ForwardedTouch[]): Promise<void>;
+    now?: () => number;
+    flushMs?: number;
+    scheduleInterval?: (cb: () => void, ms: number) => unknown;
+    cancelInterval?: (handle: unknown) => void;
+}
+export interface RivalTouchForwarder {
+    /** One activity record of a local agent. `cwd` is the agent's checkout, when known. */
+    touch(t: {
+        workspaceId: string;
+        agentId: string;
+        filePaths?: unknown;
+        cwd?: string;
+    }): void;
+    /** Runs one flush now (tests; the interval does the same). */
+    flush(): Promise<void>;
+    close(): void;
+}
+/** Mirrors the server's limits (backend LOCAL_TOUCH_LIMITS). */
+export declare const FORWARD_LIMITS: {
+    readonly touchesPerRequest: 50;
+    readonly pathsPerTouch: 20;
+    readonly pathLength: 1024;
+    readonly agentIdLength: 128;
+    /** Pending touches kept per workspace between flushes; beyond this they are dropped. */
+    readonly pendingPerWorkspace: 200;
+};
+/**
+ * The paths that may leave the laptop for one touch. Relative paths are kept
+ * (normalised); an absolute path is made relative to `cwd` when it lies
+ * inside it, and dropped when it lies outside. With no known `cwd` an
+ * absolute path is kept as is (the server maps it onto the repo tree or drops it).
+ * `..` anywhere → dropped.
+ */
+export declare function forwardablePaths(raw: unknown, cwd?: string): string[];
+export declare function createRivalTouchForwarder(opts: RivalTouchForwarderOpts): RivalTouchForwarder;

package/dist/bridge/rivalTouchForwarder.js

@@ -0,0 +1,211 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FORWARD_LIMITS = void 0;
+exports.forwardablePaths = forwardablePaths;
+exports.createRivalTouchForwarder = createRivalTouchForwarder;
+/**
+ * rival-10 — the LOCAL lane's live file touches, forwarded to a ranked rival.
+ *
+ * A hosted player's agents fly drones on their opponent's scene the moment
+ * they touch a file (the relay sees their activity). A local player's touches
+ * only ever went loopback → their own browser, so their opponent saw nothing
+ * until a commit. This closes that gap (two-lane rule): during a LIVE ranked
+ * match, the bridge forwards its agents' touches over the Connect Token it
+ * already holds — the same authenticated channel as device pairing — to
+ *   POST /ranked/workspaces/:workspaceId/touches  { touches: [{ agentId, filePaths }] }
+ * which feeds them into the same rival feed as a hosted agent's.
+ *
+ * WHAT LEAVES THE LAPTOP, and when:
+ *   - only the agent id and file PATHS — never thinking cues, tool names,
+ *     content, prompts or anything else on the activity record;
+ *   - a path under the agent's checkout goes up repo-relative (no home
+ *     directory); a path OUTSIDE a known checkout is dropped here, not sent;
+ *   - only for a workspace the server has just said is a live ranked match
+ *     this user owns (GET /ranked/workspaces/:id/touches → { live, recheckMs }).
+ *     Asking sends the workspace id only. Until the answer is `live: true`,
+ *     touches are dropped, never queued for later — every other workspace
+ *     (the overwhelming majority) sends nothing, ever.
+ * The server checks ownership and liveness again on every POST.
+ *
+ * Batched per workspace every `flushMs` (default 500 ms, so a drone flies
+ * well inside ~2 s). Never throws into the caller: it sits on the activity
+ * tail, and a forwarding failure must never touch the pilot's own terminals.
+ */
+const path = __importStar(require("path"));
+/** Mirrors the server's limits (backend LOCAL_TOUCH_LIMITS). */
+exports.FORWARD_LIMITS = {
+    touchesPerRequest: 50,
+    pathsPerTouch: 20,
+    pathLength: 1024,
+    agentIdLength: 128,
+    /** Pending touches kept per workspace between flushes; beyond this they are dropped. */
+    pendingPerWorkspace: 200,
+};
+/** After a failed status read or a refused POST: do not ask again for this long. */
+const BACKOFF_MS = 30_000;
+/** Never trust a server-sent recheck beyond this (a finished match, a non-match workspace). */
+const MAX_RECHECK_MS = 10 * 60_000;
+/**
+ * The paths that may leave the laptop for one touch. Relative paths are kept
+ * (normalised); an absolute path is made relative to `cwd` when it lies
+ * inside it, and dropped when it lies outside. With no known `cwd` an
+ * absolute path is kept as is (the server maps it onto the repo tree or drops it).
+ * `..` anywhere → dropped.
+ */
+function forwardablePaths(raw, cwd) {
+    if (!Array.isArray(raw))
+        return [];
+    const out = [];
+    for (const p of raw) {
+        if (typeof p !== 'string')
+            continue;
+        const s = p.trim();
+        if (!s || s.length > exports.FORWARD_LIMITS.pathLength)
+            continue;
+        let rel;
+        if (path.isAbsolute(s)) {
+            if (cwd) {
+                const r = path.relative(cwd, s);
+                if (!r || r.startsWith('..') || path.isAbsolute(r))
+                    continue; // outside the checkout: stays here
+                rel = r;
+            }
+            else {
+                rel = s;
+            }
+        }
+        else {
+            rel = s;
+        }
+        rel = rel.replace(/\\/g, '/');
+        if (rel.split('/').includes('..'))
+            continue;
+        if (!out.includes(rel))
+            out.push(rel);
+        if (out.length >= exports.FORWARD_LIMITS.pathsPerTouch)
+            break;
+    }
+    return out;
+}
+function createRivalTouchForwarder(opts) {
+    const now = opts.now ?? Date.now;
+    const scheduleInterval = opts.scheduleInterval ?? ((cb, ms) => setInterval(cb, ms));
+    const cancelInterval = opts.cancelInterval ?? ((h) => clearInterval(h));
+    /** Per workspace: the last answer, valid until `until`. */
+    const known = new Map();
+    const asking = new Map();
+    const pending = new Map();
+    let flushing = false;
+    const ask = (workspaceId) => {
+        const inFlight = asking.get(workspaceId);
+        if (inFlight)
+            return inFlight;
+        const p = opts
+            .status(workspaceId)
+            .then((s) => {
+            const recheck = Math.min(MAX_RECHECK_MS, Math.max(1_000, Number(s?.recheckMs) || BACKOFF_MS));
+            known.set(workspaceId, { live: s?.live === true, until: now() + recheck });
+        })
+            .catch(() => {
+            known.set(workspaceId, { live: false, until: now() + BACKOFF_MS });
+        })
+            .finally(() => asking.delete(workspaceId));
+        asking.set(workspaceId, p);
+        return p;
+    };
+    const touch = (t) => {
+        try {
+            if (!t || typeof t.workspaceId !== 'string' || !t.workspaceId)
+                return;
+            if (typeof t.agentId !== 'string' || !t.agentId || t.agentId.length > exports.FORWARD_LIMITS.agentIdLength)
+                return;
+            const filePaths = forwardablePaths(t.filePaths, t.cwd);
+            if (filePaths.length === 0)
+                return;
+            const k = known.get(t.workspaceId);
+            if (k && now() < k.until) {
+                if (!k.live)
+                    return; // not a live match of ours: nothing is kept, nothing leaves
+            }
+            else {
+                // Unknown or stale: ask (workspace id only). This touch waits for the answer in `pending`
+                // and is dropped at flush unless the answer is live.
+                void ask(t.workspaceId);
+            }
+            const q = pending.get(t.workspaceId) ?? [];
+            if (q.length >= exports.FORWARD_LIMITS.pendingPerWorkspace)
+                return;
+            q.push({ agentId: t.agentId, filePaths });
+            pending.set(t.workspaceId, q);
+        }
+        catch {
+            // never into the activity tail
+        }
+    };
+    const flush = async () => {
+        if (flushing)
+            return;
+        flushing = true;
+        try {
+            for (const workspaceId of [...pending.keys()]) {
+                const inFlight = asking.get(workspaceId);
+                if (inFlight)
+                    await inFlight;
+                const k = known.get(workspaceId);
+                const q = pending.get(workspaceId) ?? [];
+                pending.delete(workspaceId);
+                if (!k || !k.live || q.length === 0)
+                    continue; // dropped, never sent
+                for (let i = 0; i < q.length; i += exports.FORWARD_LIMITS.touchesPerRequest) {
+                    try {
+                        await opts.send(workspaceId, q.slice(i, i + exports.FORWARD_LIMITS.touchesPerRequest));
+                    }
+                    catch {
+                        // Refused (match over, not ours) or unreachable: stop, and ask again before sending more.
+                        known.set(workspaceId, { live: false, until: now() + BACKOFF_MS });
+                        break;
+                    }
+                }
+            }
+        }
+        finally {
+            flushing = false;
+        }
+    };
+    const handle = scheduleInterval(() => void flush(), opts.flushMs ?? 500);
+    handle?.unref?.();
+    return { touch, flush, close: () => cancelInterval(handle) };
+}

package/dist/bridge/server.d.ts

@@ -226,6 +226,19 @@ export interface BridgeServerOpts {
      * bridge.ts) — see the 'open' handler's agentId branch.
      */
     hiveOpSettingsPath?: string;
+    /**
+     * rival-10 — every file touch of a LOCAL WORKSPACE AGENT (an `open` with
+     * agentId + workspaceId), handed on for the ranked rival feed. The hook
+     * decides whether anything leaves the laptop (rivalTouchForwarder.ts: only
+     * during a live ranked match this user owns, only paths). It receives the
+     * record's paths only — never its thinking cue or tool. Absent → nothing.
+     */
+    forwardRivalTouch?: (t: {
+        workspaceId: string;
+        agentId: string;
+        filePaths: string[];
+        cwd?: string;
+    }) => void;
     /** Injectable timer seam for the activity tail (tests). */
     activityScheduleInterval?: (cb: () => void, ms: number) => unknown;
     /** See activityScheduleInterval. */

package/dist/bridge/server.js

@@ -92,6 +92,10 @@ function startBridgeServer(opts) {
     // never invoked for it, however many ticks fire. Cleaned up on `close`,
     // mirroring devServerWatchers's lifetime above.
     const changesWorkspaceOf = new Map();
+    // rival-10 — sessionId (== agentId) → the workspaceId its `open` named, for
+    // EVERY local workspace agent (resolved folder or not): the rival forwarder
+    // needs the workspace to ask whether it is a live match. Cleaned up on `close`.
+    const agentWorkspaceOf = new Map();
     // tchp-12 — the ACTIVE, REGISTERED local-workspace sessions worth polling
     // for working-tree changes: every changesWorkspaceOf entry whose session is
     // still LIVE per the shared SessionManager (a `close` frame — or this
@@ -530,6 +534,21 @@ function startBridgeServer(opts) {
                 // anchor / reportChanges off) silently drops the touch — see
                 // SessionTouchTracker#touch's doc comment.
                 touchTracker.touch(rec.sessionId, rec.tool, rec.filePaths, opts.sessions.cwdOf(rec.sessionId));
+                // rival-10 — paths only (no thinking, no tool); the forwarder decides if they leave the laptop.
+                const rivalWorkspaceId = agentWorkspaceOf.get(rec.sessionId);
+                if (opts.forwardRivalTouch && rivalWorkspaceId && rec.filePaths && rec.filePaths.length > 0) {
+                    try {
+                        opts.forwardRivalTouch({
+                            workspaceId: rivalWorkspaceId,
+                            agentId: rec.sessionId,
+                            filePaths: [...rec.filePaths],
+                            cwd: opts.sessions.cwdOf(rec.sessionId),
+                        });
+                    }
+                    catch {
+                        // never let forwarding break the pilot's own activity stream
+                    }
+                }
                 for (const client of wss.clients) {
                     send(client, {
                         t: 'activity',
@@ -667,6 +686,10 @@ function startBridgeServer(opts) {
                             // the same agentId (SessionManager#open supersedes) overwrites
                             // this entry with whatever the fresh open resolves, so a
                             // session never polls against a stale/prior workspaceId.
+                            if (frame.workspaceId)
+                                agentWorkspaceOf.set(agentId, frame.workspaceId);
+                            else
+                                agentWorkspaceOf.delete(agentId);
                             if (cwd && frame.workspaceId) {
                                 changesWorkspaceOf.set(agentId, frame.workspaceId);
                                 // tchp-21 — same scoping as the line above: only a REGISTERED
@@ -871,6 +894,7 @@ function startBridgeServer(opts) {
                         opts.sessions.close(frame.sessionId);
                         devServerWatchers.delete(frame.sessionId);
                         changesWorkspaceOf.delete(frame.sessionId); // tchp-12 — no orphan polling for a closed session
+                        agentWorkspaceOf.delete(frame.sessionId); // rival-10
                         maybeReleaseSessionAnchor(frame.sessionId, closedCwd);
                         break;
                     }

package/dist/commands/bridge.js

@@ -80,6 +80,7 @@ const config_2 = require("../utils/config");
 const deviceRegistration_1 = require("../bridge/deviceRegistration");
 const pair_1 = require("./pair");
 const apiClient_1 = require("../bridge/apiClient");
+const rivalTouchForwarder_1 = require("../bridge/rivalTouchForwarder");
 const folderRegistry_1 = require("../bridge/folderRegistry");
 const localPathValidation_1 = require("../bridge/localPathValidation");
 const localPathValidationFs_1 = require("../bridge/localPathValidationFs");
@@ -990,7 +991,16 @@ exports.bridgeCommand = new commander_1.Command('bridge')
     // other: the pane could not watch a member, and reaping one would leave
     // the other resident.
     const localSessions = new sessionManager_1.SessionManager((0, realPty_1.realPtyFactory)());
+    // rival-10 — a local agent's live file touches reach a ranked rival, like a hosted agent's. Over the
+    // Connect Token this bridge already holds (no new connection); only paths, only while the server says
+    // the workspace is a live ranked match this user owns — every other workspace sends nothing.
+    const rivalApi = { apiUrl: bridgeApiUrl(), connectToken: config.connectToken };
+    const rivalTouches = (0, rivalTouchForwarder_1.createRivalTouchForwarder)({
+        status: (workspaceId) => (0, apiClient_1.getRivalTouchStatus)(rivalApi, workspaceId),
+        send: (workspaceId, touches) => (0, apiClient_1.postRivalTouches)(rivalApi, workspaceId, touches),
+    });
     const handle = await (0, server_1.startBridgeServer)({
+        forwardRivalTouch: rivalTouches.touch,
         sessionToken,
         allowedOrigin: opts.origin,
         sessions: localSessions,

package/dist/utils/websocket.js

@@ -10,12 +10,32 @@ const socket_io_client_1 = require("socket.io-client");
 const chalk_1 = __importDefault(require("chalk"));
 const config_1 = require("./config");
 const format_1 = require("./format");
+// sio-07 (docs/prd/authenticated-sockets.md): headless clients (the CLI)
+// authenticate the Socket.IO handshake with `auth: { token }` — the API key
+// (`wm_sk_…`) — against the server's dedicated `/marketplace` path
+// (backend/src/server.ts). The legacy `auth: { walletPubkey }` field proved
+// nothing (public keys are public) and is retired; the server's
+// socket-auth middleware (backend/src/middleware/socket-auth.middleware.ts)
+// refuses bad/revoked credentials with a `connect_error` carrying
+// `err.data.code` of CREDENTIAL_INVALID or SESSION_REVOKED.
+const AUTH_LOGIN_HINT = 'Run `wen-market auth login` to sign in again.';
+function connectRefusalMessage(err) {
+    const code = err?.data?.code;
+    if (code === 'CREDENTIAL_INVALID') {
+        return `Your API key is invalid or expired. ${AUTH_LOGIN_HINT}`;
+    }
+    if (code === 'SESSION_REVOKED') {
+        return `Your session was revoked. ${AUTH_LOGIN_HINT}`;
+    }
+    return `WebSocket error: ${err?.message}`;
+}
 function connectWebSocket(onEvent, options = {}) {
     const config = (0, config_1.requireConfig)();
     const wsUrl = config.apiUrl.replace('/api/marketplace', '');
     const socket = (0, socket_io_client_1.io)(wsUrl, {
+        path: '/marketplace',
         transports: ['websocket'],
-        auth: { walletPubkey: config.apiKey },
+        auth: { token: config.apiKey },
     });
     socket.on('connect', () => {
         if (options.channel) {
@@ -29,7 +49,7 @@ function connectWebSocket(onEvent, options = {}) {
         onEvent(event);
     });
     socket.on('connect_error', (err) => {
-        console.error(chalk_1.default.red(`WebSocket error: ${err.message}`));
+        console.error(chalk_1.default.red(connectRefusalMessage(err)));
     });
     return socket;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wenrwa/marketplace-cli",
-  "version": "0.6.4",
+  "version": "0.6.6",
   "description": "CLI tool for the Wenrwa Agent Marketplace — monitor bounties, agents, workspaces, and treasury from your terminal",
   "author": "Wenrwa <dev@wenrwa.com>",
   "license": "MIT",