@wenrwa/marketplace-cli 0.8.11 → 0.8.13

package/dist/__tests__/bridge-storage-cleanup-real-fs.test.js

@@ -0,0 +1,372 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * stc-05 (docs/prd/storage-billed-in-credits.md, ADR-0018 + ADR-0008's floor)
+ * — the bridge-side cleaner against a REAL temp filesystem and REAL git
+ * repos. It may delete only regenerable data: package caches, preview slots
+ * not in use, checkouts the user already removed, and gitignored build output
+ * inside clean repos. Never source, `.env`, uncommitted / unpushed / stashed
+ * work, or anything with an attached session — and attachment/dirtiness are
+ * re-checked immediately before each delete.
+ */
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const storageCleanup_1 = require("../bridge/storageCleanup");
+/** commands/bridge.ts execRunner, verbatim in behaviour (rejects on failure with no stdout). */
+const execRunner = (cmd, args) => new Promise((resolve, reject) => {
+    (0, child_process_1.execFile)(cmd, args, (err, stdout) => {
+        if (err && !stdout)
+            reject(err);
+        else
+            resolve({ stdout: stdout ?? '', code: 0 });
+    });
+});
+const git = (cwd, ...args) => (0, child_process_1.execFileSync)('git', ['-C', cwd, '-c', 'user.name=t', '-c', 'user.email=t@t', ...args], { encoding: 'utf8' });
+const KB = 1024;
+function writeBlob(p, bytes) {
+    fs.mkdirSync(path.dirname(p), { recursive: true });
+    fs.writeFileSync(p, Buffer.alloc(bytes, 7));
+}
+/** Total on-disk bytes under `p` (same block-based figure du reports). */
+function diskBytes(p) {
+    let st;
+    try {
+        st = fs.lstatSync(p);
+    }
+    catch {
+        return 0;
+    }
+    if (!st.isDirectory())
+        return st.blocks * 512;
+    let total = st.blocks * 512;
+    for (const e of fs.readdirSync(p))
+        total += diskBytes(path.join(p, e));
+    return total;
+}
+let root;
+let repos;
+let previews;
+let home;
+let remote;
+let attached;
+let previewActivity;
+function seedRemote() {
+    remote = path.join(root, 'remote.git');
+    (0, child_process_1.execFileSync)('git', ['init', '--quiet', '--bare', '-b', 'main', remote]);
+    const seed = path.join(root, 'seed');
+    (0, child_process_1.execFileSync)('git', ['init', '--quiet', '-b', 'main', seed]);
+    fs.writeFileSync(path.join(seed, 'index.ts'), 'export {};\n');
+    fs.writeFileSync(path.join(seed, '.gitignore'), ['node_modules/', '.next/', 'dist/', '.venv/', '.env', 'secrets/'].join('\n') + '\n');
+    git(seed, 'add', '-A');
+    git(seed, 'commit', '--quiet', '-m', 'seed');
+    git(seed, 'push', '--quiet', remote, 'main');
+}
+/** A `--single-branch` clone (how repoCheckout.ts clones) with build output + a .env. */
+function checkout(ws) {
+    const dir = path.join(repos, ws);
+    (0, child_process_1.execFileSync)('git', ['clone', '--quiet', '--single-branch', remote, dir]);
+    writeBlob(path.join(dir, 'node_modules', 'left-pad', 'index.js'), 40 * KB);
+    writeBlob(path.join(dir, '.next', 'cache', 'webpack.pack'), 30 * KB);
+    writeBlob(path.join(dir, 'dist', 'bundle.js'), 20 * KB);
+    writeBlob(path.join(dir, 'packages', 'ui', 'node_modules', 'x', 'i.js'), 10 * KB);
+    fs.writeFileSync(path.join(dir, '.env'), 'API_KEY=only-copy\n');
+    writeBlob(path.join(dir, 'secrets', 'key.pem'), 2 * KB); // gitignored, but NOT build output
+    return dir;
+}
+function deps(over = {}) {
+    return {
+        reposBaseDir: repos,
+        previewsBaseDir: previews,
+        cacheDirs: (0, storageCleanup_1.defaultCacheDirs)([home]),
+        isAttached: (ws) => attached.has(ws),
+        previewActivity: () => previewActivity,
+        run: execRunner,
+        ...over,
+    };
+}
+beforeEach(() => {
+    root = fs.mkdtempSync(path.join(os.tmpdir(), 'stc05-cleanup-'));
+    repos = path.join(root, 'repos');
+    previews = path.join(root, 'previews');
+    home = path.join(root, 'home');
+    fs.mkdirSync(repos);
+    attached = new Set();
+    previewActivity = { opInFlight: false, activeWorkspaces: [] };
+    seedRemote();
+});
+afterEach(() => {
+    fs.rmSync(root, { recursive: true, force: true });
+});
+describe('storage cleanup — caches', () => {
+    it('deletes npm / uv / pip caches in the home dir', async () => {
+        writeBlob(path.join(home, '.npm', '_cacache', 'content-v2', 'sha512', 'aa'), 50 * KB);
+        writeBlob(path.join(home, '.cache', 'pip', 'http', 'x'), 25 * KB);
+        writeBlob(path.join(home, '.cache', 'uv', 'wheels', 'y'), 25 * KB);
+        writeBlob(path.join(home, '.npmrc'), 1 * KB); // config, not cache
+        const cleaner = (0, storageCleanup_1.createStorageCleaner)(deps());
+        const report = await cleaner.measure();
+        expect(report.byCategory.caches).toBeGreaterThanOrEqual(100 * KB);
+        const result = await cleaner.clean();
+        expect(fs.existsSync(path.join(home, '.npm', '_cacache'))).toBe(false);
+        expect(fs.existsSync(path.join(home, '.cache', 'pip'))).toBe(false);
+        expect(fs.existsSync(path.join(home, '.cache', 'uv'))).toBe(false);
+        expect(fs.existsSync(path.join(home, '.npmrc'))).toBe(true);
+        expect(result.byCategory.caches).toBe(report.byCategory.caches);
+    });
+});
+describe('storage cleanup — build output in checkouts', () => {
+    it('a clean, pushed checkout loses its gitignored build output and keeps source, .env and other ignored files', async () => {
+        const dir = checkout('ws-clean');
+        const result = await (0, storageCleanup_1.createStorageCleaner)(deps()).clean();
+        expect(fs.existsSync(path.join(dir, 'node_modules'))).toBe(false);
+        expect(fs.existsSync(path.join(dir, '.next'))).toBe(false);
+        expect(fs.existsSync(path.join(dir, 'dist'))).toBe(false);
+        expect(fs.existsSync(path.join(dir, 'packages', 'ui', 'node_modules'))).toBe(false);
+        expect(fs.readFileSync(path.join(dir, 'index.ts'), 'utf8')).toBe('export {};\n');
+        expect(fs.readFileSync(path.join(dir, '.env'), 'utf8')).toBe('API_KEY=only-copy\n');
+        expect(fs.existsSync(path.join(dir, 'secrets', 'key.pem'))).toBe(true);
+        expect(fs.existsSync(path.join(dir, '.git'))).toBe(true);
+        expect(result.byCategory.buildOutput).toBeGreaterThanOrEqual(100 * KB);
+    });
+    it('never touches a checkout with uncommitted work', async () => {
+        const dir = checkout('ws-dirty');
+        fs.writeFileSync(path.join(dir, 'index.ts'), 'export const edited = 1;\n');
+        await (0, storageCleanup_1.createStorageCleaner)(deps()).clean();
+        expect(fs.existsSync(path.join(dir, 'node_modules', 'left-pad', 'index.js'))).toBe(true);
+        expect(fs.existsSync(path.join(dir, 'dist', 'bundle.js'))).toBe(true);
+    });
+    it('never touches a checkout with an untracked (unsaved) file', async () => {
+        const dir = checkout('ws-untracked');
+        fs.writeFileSync(path.join(dir, 'notes.md'), 'draft\n');
+        await (0, storageCleanup_1.createStorageCleaner)(deps()).clean();
+        expect(fs.existsSync(path.join(dir, 'node_modules'))).toBe(true);
+        expect(fs.existsSync(path.join(dir, 'notes.md'))).toBe(true);
+    });
+    it('never touches a checkout with unpushed commits', async () => {
+        const dir = checkout('ws-unpushed');
+        fs.writeFileSync(path.join(dir, 'a.ts'), '1\n');
+        git(dir, 'add', 'a.ts');
+        git(dir, 'commit', '--quiet', '-m', 'local only');
+        await (0, storageCleanup_1.createStorageCleaner)(deps()).clean();
+        expect(fs.existsSync(path.join(dir, 'node_modules'))).toBe(true);
+        expect(fs.existsSync(path.join(dir, '.next'))).toBe(true);
+    });
+    it('never touches a checkout with a stash', async () => {
+        const dir = checkout('ws-stashed');
+        fs.writeFileSync(path.join(dir, 'index.ts'), 'export const wip = 1;\n');
+        git(dir, 'stash', '--quiet');
+        await (0, storageCleanup_1.createStorageCleaner)(deps()).clean();
+        expect(fs.existsSync(path.join(dir, 'node_modules'))).toBe(true);
+        expect(git(dir, 'stash', 'list').trim().length).toBeGreaterThan(0);
+    });
+    it('never touches a checkout with an attached session', async () => {
+        const dir = checkout('ws-attached');
+        attached.add('ws-attached');
+        const cleaner = (0, storageCleanup_1.createStorageCleaner)(deps());
+        expect((await cleaner.measure()).byCategory.buildOutput).toBe(0);
+        await cleaner.clean();
+        expect(fs.existsSync(path.join(dir, 'node_modules'))).toBe(true);
+    });
+    it('re-checks attachment immediately before deleting — a session that attaches mid-cleanup aborts it', async () => {
+        const dir = checkout('ws-late-attach');
+        const realDeps = deps();
+        let measured = 0;
+        const cleaner = (0, storageCleanup_1.createStorageCleaner)({
+            ...realDeps,
+            // The cleaner measures each target right before removing it; attach then.
+            sizeBytes: async (p) => {
+                if (p.startsWith(dir)) {
+                    measured += 1;
+                    attached.add('ws-late-attach');
+                }
+                return diskBytes(p);
+            },
+        });
+        const result = await cleaner.clean();
+        expect(measured).toBeGreaterThan(0);
+        expect(fs.existsSync(path.join(dir, 'node_modules'))).toBe(true);
+        expect(fs.existsSync(path.join(dir, 'dist'))).toBe(true);
+        expect(result.byCategory.buildOutput).toBe(0);
+    });
+    it('re-checks dirtiness immediately before deleting — work written mid-cleanup keeps the build output', async () => {
+        const dir = checkout('ws-late-dirty');
+        const cleaner = (0, storageCleanup_1.createStorageCleaner)({
+            ...deps(),
+            sizeBytes: async (p) => {
+                if (p.startsWith(dir))
+                    fs.writeFileSync(path.join(dir, 'index.ts'), 'export const late = 1;\n');
+                return diskBytes(p);
+            },
+        });
+        await cleaner.clean();
+        expect(fs.existsSync(path.join(dir, 'node_modules'))).toBe(true);
+    });
+});
+describe('storage cleanup — checkouts the user already removed', () => {
+    it('deletes a leftover directory with no repo and no files outside build output', async () => {
+        const orphan = path.join(repos, 'ws-removed');
+        writeBlob(path.join(orphan, 'node_modules', 'react', 'index.js'), 30 * KB);
+        fs.mkdirSync(path.join(orphan, 'src', 'empty'), { recursive: true });
+        const result = await (0, storageCleanup_1.createStorageCleaner)(deps()).clean();
+        expect(fs.existsSync(orphan)).toBe(false);
+        expect(result.byCategory.removedCheckouts).toBeGreaterThanOrEqual(30 * KB);
+    });
+    it('keeps a directory with no repo that still holds a file (could be the only copy)', async () => {
+        const notRepo = path.join(repos, 'ws-hand-made');
+        writeBlob(path.join(notRepo, 'node_modules', 'x.js'), 10 * KB);
+        fs.writeFileSync(path.join(notRepo, 'main.py'), 'print(1)\n');
+        await (0, storageCleanup_1.createStorageCleaner)(deps()).clean();
+        expect(fs.existsSync(path.join(notRepo, 'main.py'))).toBe(true);
+        expect(fs.existsSync(path.join(notRepo, 'node_modules', 'x.js'))).toBe(true);
+    });
+    it('keeps a leftover with a .env', async () => {
+        const left = path.join(repos, 'ws-env-left');
+        writeBlob(path.join(left, 'node_modules', 'x.js'), 10 * KB);
+        fs.writeFileSync(path.join(left, '.env'), 'K=v\n');
+        await (0, storageCleanup_1.createStorageCleaner)(deps()).clean();
+        expect(fs.readFileSync(path.join(left, '.env'), 'utf8')).toBe('K=v\n');
+    });
+    it('keeps a removed-checkout leftover while a session is attached to it', async () => {
+        const orphan = path.join(repos, 'ws-removed-attached');
+        writeBlob(path.join(orphan, 'node_modules', 'x.js'), 10 * KB);
+        attached.add('ws-removed-attached');
+        await (0, storageCleanup_1.createStorageCleaner)(deps()).clean();
+        expect(fs.existsSync(orphan)).toBe(true);
+    });
+});
+describe('storage cleanup — preview slots', () => {
+    function previewWs(ws) {
+        const dir = path.join(previews, ws);
+        writeBlob(path.join(dir, 'a', 'node_modules', 'n.js'), 20 * KB);
+        writeBlob(path.join(dir, 'b', '.venv', 'lib', 'p.py'), 20 * KB);
+        fs.writeFileSync(path.join(dir, 'preview.log'), 'log\n');
+        return dir;
+    }
+    it('deletes slots of a preview that is not running, and the shared uv cache when nothing runs', async () => {
+        const idle = previewWs('ws-idle');
+        writeBlob(path.join(previews, '.tools', 'uv-cache', 'wheels', 'w'), 30 * KB);
+        writeBlob(path.join(previews, '.tools', 'bin', 'uv'), 5 * KB);
+        const result = await (0, storageCleanup_1.createStorageCleaner)(deps()).clean();
+        expect(fs.existsSync(path.join(idle, 'a'))).toBe(false);
+        expect(fs.existsSync(path.join(idle, 'b'))).toBe(false);
+        expect(fs.existsSync(path.join(previews, '.tools', 'uv-cache'))).toBe(false);
+        expect(fs.existsSync(path.join(previews, '.tools', 'bin', 'uv'))).toBe(true);
+        expect(result.byCategory.previews).toBeGreaterThanOrEqual(70 * KB);
+    });
+    it('keeps the running preview and the shared tools cache while a preview runs', async () => {
+        const running = previewWs('ws-running');
+        const idle = previewWs('ws-idle');
+        writeBlob(path.join(previews, '.tools', 'uv-cache', 'wheels', 'w'), 30 * KB);
+        previewActivity = { opInFlight: false, activeWorkspaces: ['ws-running'] };
+        await (0, storageCleanup_1.createStorageCleaner)(deps()).clean();
+        expect(fs.existsSync(path.join(running, 'a', 'node_modules', 'n.js'))).toBe(true);
+        expect(fs.existsSync(path.join(running, 'b', '.venv'))).toBe(true);
+        expect(fs.existsSync(path.join(previews, '.tools', 'uv-cache', 'wheels', 'w'))).toBe(true);
+        expect(fs.existsSync(path.join(idle, 'a'))).toBe(false);
+    });
+    it('keeps a preview whose server a previous bridge left running (pidfile present)', async () => {
+        const left = previewWs('ws-pid');
+        fs.writeFileSync(path.join(left, 'preview.pid'), JSON.stringify({ pid: 999999, slot: 'a', sha: 'x' }));
+        await (0, storageCleanup_1.createStorageCleaner)(deps()).clean();
+        expect(fs.existsSync(path.join(left, 'a', 'node_modules', 'n.js'))).toBe(true);
+    });
+    it('touches no preview at all while a preview build is in flight', async () => {
+        const idle = previewWs('ws-idle');
+        writeBlob(path.join(previews, '.tools', 'uv-cache', 'w'), 10 * KB);
+        previewActivity = { opInFlight: true, activeWorkspaces: [] };
+        await (0, storageCleanup_1.createStorageCleaner)(deps()).clean();
+        expect(fs.existsSync(path.join(idle, 'a'))).toBe(true);
+        expect(fs.existsSync(path.join(previews, '.tools', 'uv-cache', 'w'))).toBe(true);
+    });
+});
+describe('storage cleanup — the reclaimable figure', () => {
+    it('matches what Clean up frees, and what actually left the disk', async () => {
+        checkout('ws-clean');
+        const dirty = checkout('ws-dirty');
+        fs.writeFileSync(path.join(dirty, 'index.ts'), 'edited\n');
+        writeBlob(path.join(repos, 'ws-removed', 'node_modules', 'r.js'), 30 * KB);
+        writeBlob(path.join(home, '.npm', '_cacache', 'c'), 40 * KB);
+        writeBlob(path.join(previews, 'ws-old', 'a', 'node_modules', 'n.js'), 20 * KB);
+        const before = diskBytes(root);
+        const cleaner = (0, storageCleanup_1.createStorageCleaner)(deps());
+        const report = await cleaner.measure();
+        const result = await cleaner.clean();
+        const after = diskBytes(root);
+        expect(report.reclaimableBytes).toBeGreaterThan(0);
+        expect(report.reclaimableBytes).toBe(report.byCategory.caches + report.byCategory.previews + report.byCategory.removedCheckouts + report.byCategory.buildOutput);
+        expect(result.freedBytes).toBe(report.reclaimableBytes);
+        // ±one directory block per removed target — rounding, not missing data.
+        expect(Math.abs(before - after - result.freedBytes)).toBeLessThan(64 * KB);
+        // Nothing left to free.
+        expect((await cleaner.measure()).reclaimableBytes).toBe(0);
+    });
+});
+describe('storage cleanup — automatic cleanup (stc-06) behind a kill switch', () => {
+    it('does nothing while the kill switch is off (the default)', async () => {
+        writeBlob(path.join(home, '.npm', '_cacache', 'c'), 10 * KB);
+        const result = await (0, storageCleanup_1.createStorageCleaner)(deps()).runAutomaticCleanup();
+        expect(result).toEqual({ ran: false, reason: 'disabled' });
+        expect(fs.existsSync(path.join(home, '.npm', '_cacache', 'c'))).toBe(true);
+    });
+    it('when on, frees caches and idle previews only — never checkout contents', async () => {
+        const dir = checkout('ws-clean');
+        writeBlob(path.join(repos, 'ws-removed', 'node_modules', 'r.js'), 10 * KB);
+        writeBlob(path.join(home, '.npm', '_cacache', 'c'), 10 * KB);
+        writeBlob(path.join(previews, 'ws-old', 'a', 'x'), 10 * KB);
+        const result = await (0, storageCleanup_1.createStorageCleaner)({ ...deps(), autoCleanupEnabled: true }).runAutomaticCleanup();
+        expect(result.ran).toBe(true);
+        expect(fs.existsSync(path.join(home, '.npm', '_cacache'))).toBe(false);
+        expect(fs.existsSync(path.join(previews, 'ws-old', 'a'))).toBe(false);
+        expect(fs.existsSync(path.join(dir, 'node_modules'))).toBe(true);
+        expect(fs.existsSync(path.join(repos, 'ws-removed'))).toBe(true);
+    });
+    it('the button (clean) works with the kill switch off', async () => {
+        writeBlob(path.join(home, '.npm', '_cacache', 'c'), 10 * KB);
+        const result = await (0, storageCleanup_1.createStorageCleaner)({ ...deps(), autoCleanupEnabled: false }).clean();
+        expect(result.freedBytes).toBeGreaterThan(0);
+        expect(fs.existsSync(path.join(home, '.npm', '_cacache'))).toBe(false);
+    });
+});
+describe('storage cleanup — one run at a time', () => {
+    it('a second clean while one runs is refused as busy, not raced', async () => {
+        writeBlob(path.join(home, '.npm', '_cacache', 'c'), 10 * KB);
+        const cleaner = (0, storageCleanup_1.createStorageCleaner)(deps());
+        const [a, b] = await Promise.all([cleaner.clean(), cleaner.clean()]);
+        expect([a.busy, b.busy].filter(Boolean)).toHaveLength(1);
+    });
+});

package/dist/__tests__/git-token-refresh.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/git-token-refresh.test.js

@@ -0,0 +1,231 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * a9be9720 — a hosted agent can push for as long as its session lives.
+ *
+ * WENRWA_GIT_TOKEN went onto a PTY's env once, at open, and a GitHub App
+ * installation token lives an hour: every agent session older than that held
+ * a dead credential ("remote: Invalid username or token") and no retry helped.
+ *
+ * Now `git-credential-wenrwa get` asks the bridge, over a 0600 unix socket,
+ * for a credential for $WENRWA_WORKSPACE_ID. The bridge caches it until shortly
+ * before it expires and otherwise asks the relay (`git-token`) for a fresh one.
+ * The injected env token stays as the fallback when the bridge cannot answer.
+ *
+ * Drives the REAL relay client against a fake relay, the REAL socket server,
+ * and the REAL shell helper from the box image.
+ */
+const child_process_1 = require("child_process");
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const ws_1 = require("ws");
+const relayClient_1 = require("../bridge/relayClient");
+const gitTokenBroker_1 = require("../bridge/gitTokenBroker");
+const sessionManager_1 = require("../bridge/sessionManager");
+class FakePty {
+    opts;
+    constructor(opts) {
+        this.opts = opts;
+    }
+    write() { }
+    resize() { }
+    kill() { }
+    onData() { }
+    onExit() { }
+}
+const makeFactory = () => ({ spawn: (o) => new FakePty(o) });
+const HELPER = path_1.default.resolve(__dirname, '../../../infra/terminal-image/git-credential-wenrwa');
+function startFakeRelay() {
+    return new Promise((resolve) => {
+        const wss = new ws_1.WebSocketServer({ port: 0, host: '127.0.0.1' });
+        const queue = [];
+        const waiters = [];
+        wss.on('connection', (ws) => { const w = waiters.shift(); if (w)
+            w(ws);
+        else
+            queue.push(ws); });
+        wss.on('listening', () => {
+            const addr = wss.address();
+            const port = typeof addr === 'object' && addr ? addr.port : 0;
+            resolve({ wss, port, nextConnection: () => (queue.length > 0 ? Promise.resolve(queue.shift()) : new Promise((r) => waiters.push(r))) });
+        });
+    });
+}
+function closeRelay(wss) {
+    return new Promise((resolve, reject) => {
+        for (const client of wss.clients)
+            client.terminate();
+        wss.close((err) => (err ? reject(err) : resolve()));
+    });
+}
+/** The next frame of type `t` the bridge sends (it sends reports too). */
+function nextOfType(ws, t) {
+    return new Promise((resolve) => {
+        const onMsg = (raw) => {
+            const f = JSON.parse(String(raw));
+            if (f.t !== t)
+                return;
+            ws.off('message', onMsg);
+            resolve(f);
+        };
+        ws.on('message', onMsg);
+    });
+}
+const inMinutes = (m, from = Date.now()) => new Date(from + m * 60_000).toISOString();
+describe('relay client — requestGitToken (a9be9720)', () => {
+    it('asks the relay with a git-token frame and resolves with its answer', async () => {
+        const relay = await startFakeRelay();
+        const handle = (0, relayClient_1.startRelayClient)({ relayUrl: `ws://127.0.0.1:${relay.port}`, relayToken: 'tok', sessions: new sessionManager_1.SessionManager(makeFactory()) });
+        try {
+            const ws = await relay.nextConnection();
+            ws.send(JSON.stringify({ t: 'noop' })); // the relay accepting us (any frame)
+            await new Promise((r) => setTimeout(r, 30));
+            const asked = nextOfType(ws, 'git-token');
+            const pending = handle.requestGitToken('ws-1');
+            const req = await asked;
+            expect(req).toEqual({ t: 'git-token', requestId: expect.any(String), workspaceId: 'ws-1' });
+            ws.send(JSON.stringify({ t: 'git-token', requestId: req.requestId, workspaceId: 'ws-1', ok: true, token: 'ghs_new', repoFullName: 'acme/w', expiresAt: '2026-10-24T13:00:00.000Z' }));
+            await expect(pending).resolves.toEqual({ token: 'ghs_new', repoFullName: 'acme/w', expiresAt: '2026-10-24T13:00:00.000Z' });
+        }
+        finally {
+            handle.close();
+            await closeRelay(relay.wss);
+        }
+    });
+    it('a refusal rejects with the relay\'s code and sentence', async () => {
+        const relay = await startFakeRelay();
+        const handle = (0, relayClient_1.startRelayClient)({ relayUrl: `ws://127.0.0.1:${relay.port}`, relayToken: 'tok', sessions: new sessionManager_1.SessionManager(makeFactory()) });
+        try {
+            const ws = await relay.nextConnection();
+            ws.send(JSON.stringify({ t: 'noop' }));
+            await new Promise((r) => setTimeout(r, 30));
+            const asked = nextOfType(ws, 'git-token');
+            const pending = handle.requestGitToken('ws-1');
+            const req = await asked;
+            ws.send(JSON.stringify({ t: 'git-token', requestId: req.requestId, ok: false, code: 'WORKSPACE_ACCESS_DENIED', message: 'Not a member of this workspace' }));
+            await expect(pending).rejects.toMatchObject({ code: 'WORKSPACE_ACCESS_DENIED', message: 'Not a member of this workspace' });
+        }
+        finally {
+            handle.close();
+            await closeRelay(relay.wss);
+        }
+    });
+    it('no relay connection → rejects at once (the helper then falls back), never waits out a timeout', async () => {
+        const handle = (0, relayClient_1.startRelayClient)({ relayUrl: 'ws://127.0.0.1:9', relayToken: 'tok', sessions: new sessionManager_1.SessionManager(makeFactory()) });
+        try {
+            const t0 = Date.now();
+            await expect(handle.requestGitToken('ws-1')).rejects.toMatchObject({ code: 'OFFLINE' });
+            expect(Date.now() - t0).toBeLessThan(500);
+        }
+        finally {
+            handle.close();
+        }
+    });
+});
+describe('GitTokenBroker — one fresh credential per workspace, cached until shortly before it expires', () => {
+    it('reuses a credential while it has more than 5 minutes left, then asks again', async () => {
+        let now = Date.parse('2026-10-24T12:00:00.000Z');
+        let calls = 0;
+        const fetch = jest.fn(async () => ({ token: `t${++calls}`, repoFullName: 'acme/w', expiresAt: inMinutes(15, now) }));
+        const broker = new gitTokenBroker_1.GitTokenBroker(fetch, () => now);
+        expect((await broker.get('ws-1')).token).toBe('t1');
+        now += 9 * 60_000; // 6 minutes left
+        expect((await broker.get('ws-1')).token).toBe('t1');
+        now += 2 * 60_000; // 4 minutes left — refresh
+        expect((await broker.get('ws-1')).token).toBe('t2');
+        expect(fetch).toHaveBeenCalledTimes(2);
+    });
+    it('workspaces never share a credential', async () => {
+        const fetch = jest.fn(async (ws) => ({ token: `tok-${ws}`, repoFullName: ws, expiresAt: inMinutes(15) }));
+        const broker = new gitTokenBroker_1.GitTokenBroker(fetch);
+        expect((await broker.get('ws-A')).token).toBe('tok-ws-A');
+        expect((await broker.get('ws-B')).token).toBe('tok-ws-B');
+    });
+    it('a burst of git calls makes ONE request', async () => {
+        let release;
+        const gate = new Promise((r) => { release = r; });
+        const fetch = jest.fn(async () => { await gate; return { token: 't', repoFullName: 'r', expiresAt: inMinutes(15) }; });
+        const broker = new gitTokenBroker_1.GitTokenBroker(fetch);
+        const all = Promise.all([broker.get('ws-1'), broker.get('ws-1'), broker.get('ws-1')]);
+        release();
+        await all;
+        expect(fetch).toHaveBeenCalledTimes(1);
+    });
+    it('a failure is not cached: the next call asks again', async () => {
+        const fetch = jest
+            .fn()
+            .mockRejectedValueOnce(Object.assign(new Error('offline'), { code: 'OFFLINE' }))
+            .mockResolvedValueOnce({ token: 't', repoFullName: 'r', expiresAt: inMinutes(15) });
+        const broker = new gitTokenBroker_1.GitTokenBroker(fetch);
+        await expect(broker.get('ws-1')).rejects.toMatchObject({ code: 'OFFLINE' });
+        expect((await broker.get('ws-1')).token).toBe('t');
+    });
+});
+describe('git token socket + the box\'s git-credential-wenrwa helper', () => {
+    let dir;
+    let sock;
+    let server = null;
+    beforeEach(() => {
+        // Short path: unix socket paths are limited to ~104 bytes on macOS.
+        dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'gtk-'));
+        sock = path_1.default.join(dir, 'git.sock');
+    });
+    afterEach(async () => {
+        await server?.close();
+        server = null;
+        fs_1.default.rmSync(dir, { recursive: true, force: true });
+    });
+    const runHelper = (env) => new Promise((resolve) => {
+        const child = (0, child_process_1.execFile)('sh', [HELPER, 'get'], { env: { PATH: process.env.PATH ?? '', ...env } }, (err, stdout, stderr) => {
+            resolve({ code: err ? err.code ?? 1 : 0, stdout, stderr });
+        });
+        child.stdin?.end('protocol=https\nhost=github.com\n\n');
+    });
+    it('the socket is owner-only (0600)', async () => {
+        server = await (0, gitTokenBroker_1.startGitTokenSocket)({ path: sock, broker: new gitTokenBroker_1.GitTokenBroker(async () => ({ token: 't', repoFullName: 'r', expiresAt: inMinutes(15) })) });
+        expect(fs_1.default.statSync(sock).mode & 0o777).toBe(0o600);
+    });
+    it('the helper prints the bridge\'s FRESH credential, not the stale one on its env', async () => {
+        server = await (0, gitTokenBroker_1.startGitTokenSocket)({
+            path: sock,
+            broker: new gitTokenBroker_1.GitTokenBroker(async (ws) => ({ token: `fresh-for-${ws}`, repoFullName: 'acme/w', expiresAt: inMinutes(15) })),
+        });
+        const out = await runHelper({ WENRWA_GIT_TOKEN_SOCKET: sock, WENRWA_WORKSPACE_ID: 'ws-1', WENRWA_GIT_TOKEN: 'stale' });
+        expect(out.code).toBe(0);
+        expect(out.stdout).toBe('username=x-access-token\npassword=fresh-for-ws-1\n');
+    });
+    it('bridge cannot mint (offline, refused) → the helper falls back to the injected token', async () => {
+        server = await (0, gitTokenBroker_1.startGitTokenSocket)({
+            path: sock,
+            broker: new gitTokenBroker_1.GitTokenBroker(async () => { throw Object.assign(new Error('offline'), { code: 'OFFLINE' }); }),
+        });
+        const out = await runHelper({ WENRWA_GIT_TOKEN_SOCKET: sock, WENRWA_WORKSPACE_ID: 'ws-1', WENRWA_GIT_TOKEN: 'injected' });
+        expect(out.stdout).toBe('username=x-access-token\npassword=injected\n');
+    });
+    it('no bridge socket at all (an older bridge) → the injected token, exactly as before', async () => {
+        const out = await runHelper({ WENRWA_GIT_TOKEN_SOCKET: path_1.default.join(dir, 'missing.sock'), WENRWA_WORKSPACE_ID: 'ws-1', WENRWA_GIT_TOKEN: 'injected' });
+        expect(out.stdout).toBe('username=x-access-token\npassword=injected\n');
+    });
+    it('a request without a workspace is refused (the bridge never guesses one)', async () => {
+        const fetch = jest.fn();
+        server = await (0, gitTokenBroker_1.startGitTokenSocket)({ path: sock, broker: new gitTokenBroker_1.GitTokenBroker(fetch) });
+        const out = await runHelper({ WENRWA_GIT_TOKEN_SOCKET: sock, WENRWA_GIT_TOKEN: 'injected' });
+        expect(out.stdout).toBe('username=x-access-token\npassword=injected\n');
+        expect(fetch).not.toHaveBeenCalled();
+    });
+});
+describe('assembleSessionEnv — a PTY knows where to ask', () => {
+    it('carries the socket path beside the injected token', () => {
+        const env = (0, relayClient_1.assembleSessionEnv)({
+            workspaceId: 'ws-1',
+            gitCredential: { token: 't', repoFullName: 'acme/w', expiresAt: inMinutes(15) },
+            gitTokenSocket: '/home/wenrwa/.wenrwa/git.sock',
+        });
+        expect(env.WENRWA_GIT_TOKEN_SOCKET).toBe('/home/wenrwa/.wenrwa/git.sock');
+        expect(env.WENRWA_GIT_TOKEN).toBe('t');
+    });
+});

package/dist/bridge/diskPreflight.d.ts

@@ -43,6 +43,7 @@
  */
 /** Frame-level discriminator so a pane can render the refusal as a sentence
  *  rather than falling back to a session that looks normal but isn't. */
+import type { GrowQuote } from './storageQuotaPreflight';
 export declare const CLONE_SPACE_PREFLIGHT_REFUSED = "CLONE_SPACE_PREFLIGHT_REFUSED";
 export type ClonePreflightVerdict = {
     kind: 'fits';
@@ -83,6 +84,8 @@ export declare function clonePreflightMessage(verdict: ClonePreflightVerdict): s
  */
 export declare class ClonePreflightRefusalError extends Error {
     readonly code: string;
+    /** stc-04 — the growth price, sent to the pane beside code/message. */
+    readonly quote?: GrowQuote;
     /**
      * hst-05 — `code` is now a constructor param (default unchanged:
      * CLONE_SPACE_PREFLIGHT_REFUSED), so this same transport error can also
@@ -90,6 +93,6 @@ export declare class ClonePreflightRefusalError extends Error {
      * the two refusals sharing a code. Every pre-hst-05 call site passes only
      * `message` and gets byte-identical behaviour.
      */
-    constructor(message: string, code?: string);
+    constructor(message: string, code?: string, quote?: GrowQuote);
 }
 export declare function isClonePreflightRefusal(err: unknown): err is ClonePreflightRefusalError;

package/dist/bridge/diskPreflight.js

@@ -47,8 +47,6 @@ exports.ClonePreflightRefusalError = exports.CLONE_SPACE_PREFLIGHT_REFUSED = voi
 exports.checkClonePreflight = checkClonePreflight;
 exports.clonePreflightMessage = clonePreflightMessage;
 exports.isClonePreflightRefusal = isClonePreflightRefusal;
-/** Frame-level discriminator so a pane can render the refusal as a sentence
- *  rather than falling back to a session that looks normal but isn't. */
 exports.CLONE_SPACE_PREFLIGHT_REFUSED = 'CLONE_SPACE_PREFLIGHT_REFUSED';
 /**
  * The core decision. `availableMb` of `null` means free space itself is
@@ -105,6 +103,8 @@ function clonePreflightMessage(verdict) {
  */
 class ClonePreflightRefusalError extends Error {
     code;
+    /** stc-04 — the growth price, sent to the pane beside code/message. */
+    quote;
     /**
      * hst-05 — `code` is now a constructor param (default unchanged:
      * CLONE_SPACE_PREFLIGHT_REFUSED), so this same transport error can also
@@ -112,10 +112,12 @@ class ClonePreflightRefusalError extends Error {
      * the two refusals sharing a code. Every pre-hst-05 call site passes only
      * `message` and gets byte-identical behaviour.
      */
-    constructor(message, code = exports.CLONE_SPACE_PREFLIGHT_REFUSED) {
+    constructor(message, code = exports.CLONE_SPACE_PREFLIGHT_REFUSED, quote) {
         super(message);
         this.name = 'ClonePreflightRefusalError';
         this.code = code;
+        if (quote)
+            this.quote = quote;
     }
 }
 exports.ClonePreflightRefusalError = ClonePreflightRefusalError;