@wenrwa/marketplace-cli 0.8.12 → 0.8.14

package/dist/__tests__/git-token-refresh.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/git-token-refresh.test.js

@@ -0,0 +1,262 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * a9be9720 — a hosted agent can push for as long as its session lives.
+ *
+ * WENRWA_GIT_TOKEN went onto a PTY's env once, at open, and a GitHub App
+ * installation token lives an hour: every agent session older than that held
+ * a dead credential ("remote: Invalid username or token") and no retry helped.
+ *
+ * Now `git-credential-wenrwa get` asks the bridge, over a 0600 unix socket,
+ * for a credential for $WENRWA_WORKSPACE_ID. The bridge caches it until shortly
+ * before it expires and otherwise asks the relay (`git-token`) for a fresh one.
+ * The injected env token stays as the fallback when the bridge cannot answer.
+ *
+ * Drives the REAL relay client against a fake relay, the REAL socket server,
+ * and the REAL shell helper from the box image.
+ */
+const child_process_1 = require("child_process");
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const ws_1 = require("ws");
+const relayClient_1 = require("../bridge/relayClient");
+const gitTokenBroker_1 = require("../bridge/gitTokenBroker");
+const sessionManager_1 = require("../bridge/sessionManager");
+class FakePty {
+    opts;
+    constructor(opts) {
+        this.opts = opts;
+    }
+    write() { }
+    resize() { }
+    kill() { }
+    onData() { }
+    onExit() { }
+}
+const makeFactory = () => ({ spawn: (o) => new FakePty(o) });
+const HELPER = path_1.default.resolve(__dirname, '../../../infra/terminal-image/git-credential-wenrwa');
+function startFakeRelay() {
+    return new Promise((resolve) => {
+        const wss = new ws_1.WebSocketServer({ port: 0, host: '127.0.0.1' });
+        const queue = [];
+        const waiters = [];
+        wss.on('connection', (ws) => { const w = waiters.shift(); if (w)
+            w(ws);
+        else
+            queue.push(ws); });
+        wss.on('listening', () => {
+            const addr = wss.address();
+            const port = typeof addr === 'object' && addr ? addr.port : 0;
+            resolve({ wss, port, nextConnection: () => (queue.length > 0 ? Promise.resolve(queue.shift()) : new Promise((r) => waiters.push(r))) });
+        });
+    });
+}
+function closeRelay(wss) {
+    return new Promise((resolve, reject) => {
+        for (const client of wss.clients)
+            client.terminate();
+        wss.close((err) => (err ? reject(err) : resolve()));
+    });
+}
+/** The next frame of type `t` the bridge sends (it sends reports too). */
+function nextOfType(ws, t) {
+    return new Promise((resolve) => {
+        const onMsg = (raw) => {
+            const f = JSON.parse(String(raw));
+            if (f.t !== t)
+                return;
+            ws.off('message', onMsg);
+            resolve(f);
+        };
+        ws.on('message', onMsg);
+    });
+}
+const inMinutes = (m, from = Date.now()) => new Date(from + m * 60_000).toISOString();
+describe('relay client — requestGitToken (a9be9720)', () => {
+    it('asks the relay with a git-token frame and resolves with its answer', async () => {
+        const relay = await startFakeRelay();
+        const handle = (0, relayClient_1.startRelayClient)({ relayUrl: `ws://127.0.0.1:${relay.port}`, relayToken: 'tok', sessions: new sessionManager_1.SessionManager(makeFactory()) });
+        try {
+            const ws = await relay.nextConnection();
+            ws.send(JSON.stringify({ t: 'noop' })); // the relay accepting us (any frame)
+            await new Promise((r) => setTimeout(r, 30));
+            const asked = nextOfType(ws, 'git-token');
+            const pending = handle.requestGitToken('ws-1');
+            const req = await asked;
+            expect(req).toEqual({ t: 'git-token', requestId: expect.any(String), workspaceId: 'ws-1' });
+            // lr-02: a named repo rides along.
+            const asked2 = nextOfType(ws, 'git-token');
+            void handle.requestGitToken('ws-1', 'acme/backend').catch(() => undefined);
+            expect(await asked2).toMatchObject({ workspaceId: 'ws-1', repo: 'acme/backend' });
+            ws.send(JSON.stringify({ t: 'git-token', requestId: req.requestId, workspaceId: 'ws-1', ok: true, token: 'ghs_new', repoFullName: 'acme/w', expiresAt: '2026-10-24T13:00:00.000Z' }));
+            await expect(pending).resolves.toEqual({ token: 'ghs_new', repoFullName: 'acme/w', expiresAt: '2026-10-24T13:00:00.000Z' });
+        }
+        finally {
+            handle.close();
+            await closeRelay(relay.wss);
+        }
+    });
+    it('a refusal rejects with the relay\'s code and sentence', async () => {
+        const relay = await startFakeRelay();
+        const handle = (0, relayClient_1.startRelayClient)({ relayUrl: `ws://127.0.0.1:${relay.port}`, relayToken: 'tok', sessions: new sessionManager_1.SessionManager(makeFactory()) });
+        try {
+            const ws = await relay.nextConnection();
+            ws.send(JSON.stringify({ t: 'noop' }));
+            await new Promise((r) => setTimeout(r, 30));
+            const asked = nextOfType(ws, 'git-token');
+            const pending = handle.requestGitToken('ws-1');
+            const req = await asked;
+            ws.send(JSON.stringify({ t: 'git-token', requestId: req.requestId, ok: false, code: 'WORKSPACE_ACCESS_DENIED', message: 'Not a member of this workspace' }));
+            await expect(pending).rejects.toMatchObject({ code: 'WORKSPACE_ACCESS_DENIED', message: 'Not a member of this workspace' });
+        }
+        finally {
+            handle.close();
+            await closeRelay(relay.wss);
+        }
+    });
+    it('no relay connection → rejects at once (the helper then falls back), never waits out a timeout', async () => {
+        const handle = (0, relayClient_1.startRelayClient)({ relayUrl: 'ws://127.0.0.1:9', relayToken: 'tok', sessions: new sessionManager_1.SessionManager(makeFactory()) });
+        try {
+            const t0 = Date.now();
+            await expect(handle.requestGitToken('ws-1')).rejects.toMatchObject({ code: 'OFFLINE' });
+            expect(Date.now() - t0).toBeLessThan(500);
+        }
+        finally {
+            handle.close();
+        }
+    });
+});
+describe('GitTokenBroker — one fresh credential per workspace, cached until shortly before it expires', () => {
+    it('reuses a credential while it has more than 5 minutes left, then asks again', async () => {
+        let now = Date.parse('2026-10-24T12:00:00.000Z');
+        let calls = 0;
+        const fetch = jest.fn(async () => ({ token: `t${++calls}`, repoFullName: 'acme/w', expiresAt: inMinutes(15, now) }));
+        const broker = new gitTokenBroker_1.GitTokenBroker(fetch, () => now);
+        expect((await broker.get('ws-1')).token).toBe('t1');
+        now += 9 * 60_000; // 6 minutes left
+        expect((await broker.get('ws-1')).token).toBe('t1');
+        now += 2 * 60_000; // 4 minutes left — refresh
+        expect((await broker.get('ws-1')).token).toBe('t2');
+        expect(fetch).toHaveBeenCalledTimes(2);
+    });
+    it('lr-02: each repo of a workspace has its own credential', async () => {
+        const fetch = jest.fn(async (ws, repo) => ({ token: `${ws}:${repo ?? '-'}`, repoFullName: repo ?? 'p', expiresAt: inMinutes(15) }));
+        const broker = new gitTokenBroker_1.GitTokenBroker(fetch);
+        expect((await broker.get('ws-1')).token).toBe('ws-1:-');
+        expect((await broker.get('ws-1', 'acme/backend')).token).toBe('ws-1:acme/backend');
+        expect((await broker.get('ws-1', 'ACME/Backend')).token).toBe('ws-1:acme/backend');
+        expect(fetch).toHaveBeenCalledTimes(2);
+    });
+    it('workspaces never share a credential', async () => {
+        const fetch = jest.fn(async (ws) => ({ token: `tok-${ws}`, repoFullName: ws, expiresAt: inMinutes(15) }));
+        const broker = new gitTokenBroker_1.GitTokenBroker(fetch);
+        expect((await broker.get('ws-A')).token).toBe('tok-ws-A');
+        expect((await broker.get('ws-B')).token).toBe('tok-ws-B');
+    });
+    it('a burst of git calls makes ONE request', async () => {
+        let release;
+        const gate = new Promise((r) => { release = r; });
+        const fetch = jest.fn(async () => { await gate; return { token: 't', repoFullName: 'r', expiresAt: inMinutes(15) }; });
+        const broker = new gitTokenBroker_1.GitTokenBroker(fetch);
+        const all = Promise.all([broker.get('ws-1'), broker.get('ws-1'), broker.get('ws-1')]);
+        release();
+        await all;
+        expect(fetch).toHaveBeenCalledTimes(1);
+    });
+    it('a failure is not cached: the next call asks again', async () => {
+        const fetch = jest
+            .fn()
+            .mockRejectedValueOnce(Object.assign(new Error('offline'), { code: 'OFFLINE' }))
+            .mockResolvedValueOnce({ token: 't', repoFullName: 'r', expiresAt: inMinutes(15) });
+        const broker = new gitTokenBroker_1.GitTokenBroker(fetch);
+        await expect(broker.get('ws-1')).rejects.toMatchObject({ code: 'OFFLINE' });
+        expect((await broker.get('ws-1')).token).toBe('t');
+    });
+});
+describe('git token socket + the box\'s git-credential-wenrwa helper', () => {
+    let dir;
+    let sock;
+    let server = null;
+    beforeEach(() => {
+        // Short path: unix socket paths are limited to ~104 bytes on macOS.
+        dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'gtk-'));
+        sock = path_1.default.join(dir, 'git.sock');
+    });
+    afterEach(async () => {
+        await server?.close();
+        server = null;
+        fs_1.default.rmSync(dir, { recursive: true, force: true });
+    });
+    const runHelper = (env, stdin = 'protocol=https\nhost=github.com\n\n') => new Promise((resolve) => {
+        const child = (0, child_process_1.execFile)('sh', [HELPER, 'get'], { env: { PATH: process.env.PATH ?? '', ...env } }, (err, stdout, stderr) => {
+            resolve({ code: err ? err.code ?? 1 : 0, stdout, stderr });
+        });
+        child.stdin?.end(stdin);
+    });
+    it('lr-02: with git\'s path= (credential.useHttpPath) the helper asks for THAT repo', async () => {
+        const asked = [];
+        server = await (0, gitTokenBroker_1.startGitTokenSocket)({
+            path: sock,
+            broker: new gitTokenBroker_1.GitTokenBroker(async (ws, repo) => { asked.push([ws, repo]); return { token: `tok-${repo ?? 'primary'}`, repoFullName: repo ?? 'p', expiresAt: inMinutes(15) }; }),
+        });
+        const out = await runHelper({ WENRWA_GIT_TOKEN_SOCKET: sock, WENRWA_WORKSPACE_ID: 'ws-1', WENRWA_GIT_TOKEN: 'stale' }, 'protocol=https\nhost=github.com\npath=acme/backend.git\n\n');
+        expect(out.stdout).toBe('username=x-access-token\npassword=tok-acme/backend\n');
+        expect(asked).toEqual([['ws-1', 'acme/backend']]);
+    });
+    it('lr-02: a path git sends for another host (Forgejo) is not passed — the primary answers', async () => {
+        const asked = [];
+        server = await (0, gitTokenBroker_1.startGitTokenSocket)({
+            path: sock,
+            broker: new gitTokenBroker_1.GitTokenBroker(async (ws, repo) => { asked.push([ws, repo]); return { token: 'primary', repoFullName: 'p', expiresAt: inMinutes(15) }; }),
+        });
+        await runHelper({ WENRWA_GIT_TOKEN_SOCKET: sock, WENRWA_WORKSPACE_ID: 'ws-1' }, 'protocol=https\nhost=forgejo.example\npath=pilot/deck.git\n\n');
+        expect(asked).toEqual([['ws-1', undefined]]);
+    });
+    it('the socket is owner-only (0600)', async () => {
+        server = await (0, gitTokenBroker_1.startGitTokenSocket)({ path: sock, broker: new gitTokenBroker_1.GitTokenBroker(async () => ({ token: 't', repoFullName: 'r', expiresAt: inMinutes(15) })) });
+        expect(fs_1.default.statSync(sock).mode & 0o777).toBe(0o600);
+    });
+    it('the helper prints the bridge\'s FRESH credential, not the stale one on its env', async () => {
+        server = await (0, gitTokenBroker_1.startGitTokenSocket)({
+            path: sock,
+            broker: new gitTokenBroker_1.GitTokenBroker(async (ws) => ({ token: `fresh-for-${ws}`, repoFullName: 'acme/w', expiresAt: inMinutes(15) })),
+        });
+        const out = await runHelper({ WENRWA_GIT_TOKEN_SOCKET: sock, WENRWA_WORKSPACE_ID: 'ws-1', WENRWA_GIT_TOKEN: 'stale' });
+        expect(out.code).toBe(0);
+        expect(out.stdout).toBe('username=x-access-token\npassword=fresh-for-ws-1\n');
+    });
+    it('bridge cannot mint (offline, refused) → the helper falls back to the injected token', async () => {
+        server = await (0, gitTokenBroker_1.startGitTokenSocket)({
+            path: sock,
+            broker: new gitTokenBroker_1.GitTokenBroker(async () => { throw Object.assign(new Error('offline'), { code: 'OFFLINE' }); }),
+        });
+        const out = await runHelper({ WENRWA_GIT_TOKEN_SOCKET: sock, WENRWA_WORKSPACE_ID: 'ws-1', WENRWA_GIT_TOKEN: 'injected' });
+        expect(out.stdout).toBe('username=x-access-token\npassword=injected\n');
+    });
+    it('no bridge socket at all (an older bridge) → the injected token, exactly as before', async () => {
+        const out = await runHelper({ WENRWA_GIT_TOKEN_SOCKET: path_1.default.join(dir, 'missing.sock'), WENRWA_WORKSPACE_ID: 'ws-1', WENRWA_GIT_TOKEN: 'injected' });
+        expect(out.stdout).toBe('username=x-access-token\npassword=injected\n');
+    });
+    it('a request without a workspace is refused (the bridge never guesses one)', async () => {
+        const fetch = jest.fn();
+        server = await (0, gitTokenBroker_1.startGitTokenSocket)({ path: sock, broker: new gitTokenBroker_1.GitTokenBroker(fetch) });
+        const out = await runHelper({ WENRWA_GIT_TOKEN_SOCKET: sock, WENRWA_GIT_TOKEN: 'injected' });
+        expect(out.stdout).toBe('username=x-access-token\npassword=injected\n');
+        expect(fetch).not.toHaveBeenCalled();
+    });
+});
+describe('assembleSessionEnv — a PTY knows where to ask', () => {
+    it('carries the socket path beside the injected token', () => {
+        const env = (0, relayClient_1.assembleSessionEnv)({
+            workspaceId: 'ws-1',
+            gitCredential: { token: 't', repoFullName: 'acme/w', expiresAt: inMinutes(15) },
+            gitTokenSocket: '/home/wenrwa/.wenrwa/git.sock',
+        });
+        expect(env.WENRWA_GIT_TOKEN_SOCKET).toBe('/home/wenrwa/.wenrwa/git.sock');
+        expect(env.WENRWA_GIT_TOKEN).toBe('t');
+    });
+});

package/dist/__tests__/linked-repos-clone.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/linked-repos-clone.test.js

@@ -0,0 +1,164 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * lr-03 — the box clones a workspace's linked repos into
+ * /data/linked/<workspaceId>/<alias> (docs/prd/linked-repos-backend.md).
+ *
+ * Not /data/repos/<ws>.linked: the checkout inventory treats every directory
+ * under /data/repos as a workspace id, so a `<ws>.linked` folder would read as
+ * a deleted workspace — a reclaim candidate.
+ */
+const ws_1 = require("ws");
+const linkedRepos_1 = require("../bridge/linkedRepos");
+const relayClient_1 = require("../bridge/relayClient");
+const sessionManager_1 = require("../bridge/sessionManager");
+class FakePty {
+    opts;
+    constructor(opts) {
+        this.opts = opts;
+    }
+    write() { }
+    resize() { }
+    kill() { }
+    onData() { }
+    onExit() { }
+}
+const WS = '11111111-1111-4111-8111-111111111111';
+function harness(opts = {}) {
+    const ensured = [];
+    const credentialFor = jest.fn(async (_ws, fullName) => ({ token: `tok-${fullName}`, repoFullName: fullName, expiresAt: 'x' }));
+    const deps = {
+        linkedBaseDir: '/data/linked',
+        credentialFor,
+        ensure: jest.fn(async (args) => {
+            ensured.push({ base: args.baseDir, alias: args.name, repoUrl: args.repoUrl, token: args.gitCredential?.token });
+            if (args.name === opts.fail)
+                throw new Error('clone failed');
+            return { action: 'cloned', path: `${args.baseDir}/${args.name}` };
+        }),
+        log: jest.fn(),
+    };
+    return { deps, ensured, credentialFor };
+}
+const repos = [
+    { alias: 'backend', fullName: 'acme/backend', cloneUrl: 'https://github.com/acme/backend.git' },
+    { alias: 'cli', fullName: 'acme/cli', cloneUrl: 'https://github.com/acme/cli.git' },
+];
+describe('ensureLinkedRepos', () => {
+    it('ensures each linked repo under /data/linked/<ws>/<alias>, each with ITS OWN credential', async () => {
+        const h = harness();
+        const results = await (0, linkedRepos_1.ensureLinkedRepos)({ workspaceId: WS, linkedRepos: repos }, h.deps);
+        expect(h.ensured).toEqual([
+            { base: `/data/linked/${WS}`, alias: 'backend', repoUrl: 'https://github.com/acme/backend.git', token: 'tok-acme/backend' },
+            { base: `/data/linked/${WS}`, alias: 'cli', repoUrl: 'https://github.com/acme/cli.git', token: 'tok-acme/cli' },
+        ]);
+        expect(results.map((r) => r.action)).toEqual(['cloned', 'cloned']);
+    });
+    it('one failing clone never stops the others, and never throws', async () => {
+        const h = harness({ fail: 'backend' });
+        const results = await (0, linkedRepos_1.ensureLinkedRepos)({ workspaceId: WS, linkedRepos: repos }, h.deps);
+        expect(results.map((r) => r.action)).toEqual(['failed', 'cloned']);
+        expect(h.deps.log).toHaveBeenCalled();
+    });
+    it('a credential the relay refuses → that repo is skipped (no anonymous clone of a private repo)', async () => {
+        const h = harness();
+        h.credentialFor.mockRejectedValueOnce(Object.assign(new Error('not linked'), { code: 'REPO_NOT_LINKED' }));
+        const results = await (0, linkedRepos_1.ensureLinkedRepos)({ workspaceId: WS, linkedRepos: repos }, h.deps);
+        expect(h.ensured.map((e) => e.alias)).toEqual(['cli']);
+        expect(results[0]).toMatchObject({ alias: 'backend', action: 'failed' });
+    });
+    it('refuses anything that could escape its folder: bad alias, bad workspace id, a non-github URL', async () => {
+        const h = harness();
+        await (0, linkedRepos_1.ensureLinkedRepos)({
+            workspaceId: WS,
+            linkedRepos: [
+                { alias: '../repos', fullName: 'acme/x', cloneUrl: 'https://github.com/acme/x.git' },
+                { alias: 'ok', fullName: 'acme/x', cloneUrl: 'file:///etc' },
+                { alias: 'ok2', fullName: '../../x', cloneUrl: 'https://github.com/acme/x.git' },
+            ],
+        }, h.deps);
+        await (0, linkedRepos_1.ensureLinkedRepos)({ workspaceId: '../../etc', linkedRepos: repos }, h.deps);
+        expect(h.ensured).toEqual([]);
+    });
+    it('nothing linked → nothing done', async () => {
+        const h = harness();
+        expect(await (0, linkedRepos_1.ensureLinkedRepos)({ workspaceId: WS, linkedRepos: [] }, h.deps)).toEqual([]);
+        expect(h.deps.ensure).not.toHaveBeenCalled();
+    });
+});
+describe('relay client — an open with linkedRepos (lr-03)', () => {
+    function startFakeRelay() {
+        return new Promise((resolve) => {
+            const wss = new ws_1.WebSocketServer({ port: 0, host: '127.0.0.1' });
+            const q = [];
+            const w = [];
+            wss.on('connection', (ws) => { const f = w.shift(); if (f)
+                f(ws);
+            else
+                q.push(ws); });
+            wss.on('listening', () => {
+                const a = wss.address();
+                resolve({ wss, port: typeof a === 'object' && a ? a.port : 0, next: () => (q.length ? Promise.resolve(q.shift()) : new Promise((r) => w.push(r))) });
+            });
+        });
+    }
+    it('the terminal opens first; the linked repos are ensured after the primary checkout resolves', async () => {
+        const relay = await startFakeRelay();
+        const order = [];
+        const spawned = [];
+        let release;
+        const ensureLinkedRepos = jest.fn(async () => { order.push('linked'); });
+        const handle = (0, relayClient_1.startRelayClient)({
+            relayUrl: `ws://127.0.0.1:${relay.port}`,
+            relayToken: 'tok',
+            sessions: new sessionManager_1.SessionManager({ spawn: (o) => { order.push('pty'); spawned.push(o); return new FakePty(o); } }),
+            resolveWorkspaceCwd: () => new Promise((r) => { release = r; }),
+            ensureLinkedRepos,
+        });
+        try {
+            const ws = await relay.next();
+            ws.send(JSON.stringify({
+                t: 'open', cols: 80, rows: 24, sessionId: 'agent-A', workspaceId: WS,
+                repoUrl: 'https://github.com/acme/app.git',
+                linkedRepos: repos,
+            }));
+            await new Promise((r) => setTimeout(r, 50));
+            expect(ensureLinkedRepos).not.toHaveBeenCalled(); // waits for the primary
+            release('/data/repos/ws');
+            await new Promise((r) => setTimeout(r, 50));
+            expect(order).toEqual(['pty', 'linked']);
+            expect(ensureLinkedRepos).toHaveBeenCalledWith({ workspaceId: WS, linkedRepos: repos });
+        }
+        finally {
+            handle.close();
+            for (const c of relay.wss.clients)
+                c.terminate();
+            await new Promise((r) => relay.wss.close(r));
+        }
+    });
+    it('a failing ensure never touches the session', async () => {
+        const relay = await startFakeRelay();
+        const handle = (0, relayClient_1.startRelayClient)({
+            relayUrl: `ws://127.0.0.1:${relay.port}`,
+            relayToken: 'tok',
+            sessions: new sessionManager_1.SessionManager({ spawn: (o) => new FakePty(o) }),
+            resolveWorkspaceCwd: async () => '/data/repos/ws',
+            ensureLinkedRepos: async () => { throw new Error('boom'); },
+        });
+        try {
+            const ws = await relay.next();
+            const errors = [];
+            ws.on('message', (raw) => { const f = JSON.parse(String(raw)); if (f.t === 'error')
+                errors.push(f); });
+            ws.send(JSON.stringify({ t: 'open', cols: 80, rows: 24, sessionId: 'agent-A', workspaceId: WS, linkedRepos: repos }));
+            await new Promise((r) => setTimeout(r, 80));
+            expect(errors).toEqual([]);
+        }
+        finally {
+            handle.close();
+            for (const c of relay.wss.clients)
+                c.terminate();
+            await new Promise((r) => relay.wss.close(r));
+        }
+    });
+});

package/dist/bridge/gitTokenBroker.d.ts

@@ -0,0 +1,30 @@
+export interface GitCredential {
+    token: string;
+    repoFullName: string;
+    expiresAt: string;
+}
+/** `repo` (owner/repo) is the repo git asked about, when the helper knows it
+ *  (lr-02: linked repos have credentials of their own). Absent = the primary. */
+export type GitCredentialFetcher = (workspaceId: string, repo?: string) => Promise<GitCredential>;
+/** Ask again once a cached credential has less than this left. */
+export declare const REFRESH_BEFORE_EXPIRY_MS: number;
+export declare class GitTokenBroker {
+    private fetch;
+    private now;
+    private cache;
+    private inFlight;
+    constructor(fetch: GitCredentialFetcher, now?: () => number);
+    get(workspaceId: string, repo?: string): Promise<GitCredential>;
+}
+export interface GitTokenSocketHandle {
+    path: string;
+    close(): Promise<void>;
+}
+/**
+ * Serve `broker` on a unix socket at `opts.path` (0600). Replaces a stale
+ * socket file left by a previous bridge.
+ */
+export declare function startGitTokenSocket(opts: {
+    path: string;
+    broker: GitTokenBroker;
+}): Promise<GitTokenSocketHandle>;

package/dist/bridge/gitTokenBroker.js

@@ -0,0 +1,131 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GitTokenBroker = exports.REFRESH_BEFORE_EXPIRY_MS = void 0;
+exports.startGitTokenSocket = startGitTokenSocket;
+/**
+ * a9be9720 — fresh git credentials for a box's agents, for as long as they run.
+ *
+ * The relay puts a workspace's git token on each PTY's env once, at open
+ * (WENRWA_GIT_TOKEN). It is a GitHub App installation token and lives an
+ * hour; agent sessions live for days. So every session older than that held a
+ * dead credential and could not push — "remote: Invalid username or token",
+ * and no retry helped.
+ *
+ * Now `git-credential-wenrwa get` (infra/terminal-image) asks THIS bridge,
+ * over a unix socket, for a credential for $WENRWA_WORKSPACE_ID:
+ *
+ *   GET /git-credential?workspace=<id>  →  200 "username=…\npassword=…\n"
+ *
+ * The answer is already in git's credential-helper format, so the shell helper
+ * only has to print it. The bridge keeps each workspace's credential in memory
+ * until shortly before it expires, and otherwise asks the relay for a fresh
+ * one (`git-token`, relayClient.requestGitToken).
+ *
+ * Never on disk, never logged. The socket is 0600 and lives in the bridge
+ * user's home: every process that can reach it is the same user whose PTYs
+ * already carry these tokens on their env.
+ *
+ * Any failure answers non-2xx with a one-line reason, and the helper falls back
+ * to the injected token — so a bridge that cannot mint is never worse than
+ * before.
+ */
+const fs_1 = __importDefault(require("fs"));
+const http_1 = __importDefault(require("http"));
+const path_1 = __importDefault(require("path"));
+/** Ask again once a cached credential has less than this left. */
+exports.REFRESH_BEFORE_EXPIRY_MS = 5 * 60_000;
+class GitTokenBroker {
+    fetch;
+    now;
+    cache = new Map();
+    inFlight = new Map();
+    constructor(fetch, now = Date.now) {
+        this.fetch = fetch;
+        this.now = now;
+    }
+    async get(workspaceId, repo) {
+        const key = `${workspaceId}\u0000${repo ? repo.toLowerCase() : ''}`;
+        const cached = this.cache.get(key);
+        if (cached && Date.parse(cached.expiresAt) - this.now() > exports.REFRESH_BEFORE_EXPIRY_MS)
+            return cached;
+        // A burst of git calls (fetch + push, a submodule walk) makes ONE request.
+        const pending = this.inFlight.get(key);
+        if (pending)
+            return pending;
+        const request = (repo ? this.fetch(workspaceId, repo) : this.fetch(workspaceId))
+            .then((cred) => {
+            this.cache.set(key, cred);
+            return cred;
+        })
+            .finally(() => this.inFlight.delete(key));
+        this.inFlight.set(key, request);
+        return request;
+    }
+}
+exports.GitTokenBroker = GitTokenBroker;
+/** Workspace ids are UUIDs; anything else is refused before it is used. */
+const WORKSPACE_ID = /^[A-Za-z0-9-]{1,64}$/;
+const REPO = /^[A-Za-z0-9._-]{1,100}\/[A-Za-z0-9._-]{1,100}$/;
+/**
+ * Serve `broker` on a unix socket at `opts.path` (0600). Replaces a stale
+ * socket file left by a previous bridge.
+ */
+async function startGitTokenSocket(opts) {
+    fs_1.default.mkdirSync(path_1.default.dirname(opts.path), { recursive: true, mode: 0o700 });
+    try {
+        fs_1.default.unlinkSync(opts.path);
+    }
+    catch {
+        /* no previous socket */
+    }
+    const server = http_1.default.createServer((req, res) => {
+        const reply = (status, body) => {
+            res.writeHead(status, { 'content-type': 'text/plain', 'cache-control': 'no-store' });
+            res.end(body);
+        };
+        const url = new URL(req.url ?? '/', 'http://bridge');
+        if (req.method !== 'GET' || url.pathname !== '/git-credential') {
+            reply(404, 'not found\n');
+            return;
+        }
+        const workspaceId = url.searchParams.get('workspace') ?? '';
+        if (!WORKSPACE_ID.test(workspaceId)) {
+            reply(400, 'no workspace: WENRWA_WORKSPACE_ID is not set in this environment\n');
+            return;
+        }
+        const repo = url.searchParams.get('repo') ?? '';
+        if (repo && (!REPO.test(repo) || repo.includes('..'))) {
+            reply(400, 'repo must be owner/repo\n');
+            return;
+        }
+        opts.broker.get(workspaceId, repo || undefined).then((cred) => reply(200, `username=x-access-token\npassword=${cred.token}\n`), (err) => {
+            const e = err;
+            const code = typeof e?.code === 'string' ? e.code : 'GIT_TOKEN_FAILED';
+            const message = typeof e?.message === 'string' ? e.message : 'could not get a git token';
+            reply(502, `${code}: ${message}\n`);
+        });
+    });
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(opts.path, () => {
+            server.off('error', reject);
+            resolve();
+        });
+    });
+    fs_1.default.chmodSync(opts.path, 0o600);
+    return {
+        path: opts.path,
+        close: () => new Promise((resolve) => {
+            server.close(() => resolve());
+            try {
+                fs_1.default.unlinkSync(opts.path);
+            }
+            catch {
+                /* already gone */
+            }
+        }),
+    };
+}

package/dist/bridge/linkedRepos.d.ts

@@ -0,0 +1,31 @@
+import type { GitCredential } from './gitTokenBroker';
+export interface LinkedRepoRef {
+    alias: string;
+    fullName: string;
+    cloneUrl: string;
+}
+export interface LinkedRepoResult {
+    alias: string;
+    action: 'existing' | 'cloned' | 'failed';
+    path?: string;
+}
+export interface LinkedRepoDeps {
+    /** /data/linked */
+    linkedBaseDir: string;
+    credentialFor(workspaceId: string, fullName: string): Promise<GitCredential>;
+    /** ensureWorkspaceRepo with `reposBaseDir = baseDir`, `workspaceId = name`. */
+    ensure(args: {
+        baseDir: string;
+        name: string;
+        repoUrl: string;
+        gitCredential?: GitCredential;
+    }): Promise<{
+        action: string;
+        path?: string;
+    }>;
+    log?(line: string): void;
+}
+export declare function ensureLinkedRepos(opts: {
+    workspaceId: string;
+    linkedRepos: LinkedRepoRef[];
+}, deps: LinkedRepoDeps): Promise<LinkedRepoResult[]>;

package/dist/bridge/linkedRepos.js

@@ -0,0 +1,52 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureLinkedRepos = ensureLinkedRepos;
+/**
+ * lr-03 — clone a workspace's LINKED repos on the box
+ * (docs/prd/linked-repos-backend.md).
+ *
+ * The relay's `open` frame lists them; once the primary checkout resolves the
+ * bridge ensures each one at /data/linked/<workspaceId>/<alias>, in the
+ * background, through the SAME ensureWorkspaceRepo the primary uses (clone
+ * mutex, free-space and storage-quota preflights, interrupted-clone cleanup).
+ *
+ * - Not under /data/repos: the checkout inventory treats every directory there
+ *   as a workspace id, so `<ws>.linked` would read as a deleted workspace.
+ * - Each repo gets ITS OWN credential (read-only unless the link may push),
+ *   fetched fresh from the relay; a refused credential skips that repo rather
+ *   than cloning a private repo anonymously.
+ * - Never deletes anything: an unlinked repo's clone stays on the volume.
+ * - Never throws: a failed clone must not break the terminal that opened.
+ */
+const path_1 = __importDefault(require("path"));
+const ALIAS = /^[a-z0-9][a-z0-9-]{0,31}$/;
+const WORKSPACE_ID = /^[A-Za-z0-9-]{1,64}$/;
+const FULL_NAME = /^[A-Za-z0-9._-]{1,100}\/[A-Za-z0-9._-]{1,100}$/;
+const GITHUB_CLONE_URL = /^https:\/\/github\.com\/[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+\.git$/;
+async function ensureLinkedRepos(opts, deps) {
+    if (!WORKSPACE_ID.test(opts.workspaceId))
+        return [];
+    const baseDir = path_1.default.join(deps.linkedBaseDir, opts.workspaceId);
+    const results = [];
+    // One at a time: two big clones at once on a small box is how a disk fills.
+    for (const ref of opts.linkedRepos) {
+        if (!ALIAS.test(ref.alias) || !FULL_NAME.test(ref.fullName) || ref.fullName.includes('..') || !GITHUB_CLONE_URL.test(ref.cloneUrl)) {
+            deps.log?.(`[linked] skipped a malformed linked repo entry`);
+            continue;
+        }
+        try {
+            const gitCredential = await deps.credentialFor(opts.workspaceId, ref.fullName);
+            const r = await deps.ensure({ baseDir, name: ref.alias, repoUrl: ref.cloneUrl, gitCredential });
+            const action = r.action === 'existing' || r.action === 'cloned' ? r.action : 'failed';
+            results.push({ alias: ref.alias, action, ...(r.path ? { path: r.path } : {}) });
+        }
+        catch (err) {
+            deps.log?.(`[linked] ${ref.alias} (${ref.fullName}) not ready: ${err instanceof Error ? err.message : String(err)}`);
+            results.push({ alias: ref.alias, action: 'failed' });
+        }
+    }
+    return results;
+}

package/dist/bridge/relayClient.d.ts

@@ -1,3 +1,22 @@
+/**
+ * ht-05 — Terminal Bridge relay mode (dial-out).
+ *
+ * Instead of listening on localhost for browser connections (server.ts),
+ * this DIALS OUT to the platform relay over a single outbound wss
+ * connection, authenticates with a per-container relay token, and serves
+ * the same v1 frame protocol (see PROTOCOL.md) through the existing
+ * SessionManager. Multi-session multiplexing is unchanged: every frame
+ * already carries a sessionId, so one outbound socket serves every session
+ * exactly like the local server serves them over N inbound sockets.
+ *
+ * PTYs live in the SessionManager, not the socket — a relay drop never
+ * kills a session. This module owns only: dialing out, the auth frame,
+ * frame routing through SessionManager, and reconnect-with-backoff. It
+ * does no scrollback bookkeeping of its own (SessionManager already does
+ * that) — on re-pair the pane sends `attach` again and gets a fresh
+ * `replay`, exactly as it would against the local server.
+ */
+import type { LinkedRepoRef } from './linkedRepos';
 import { type OpencodeLaunchInput } from './agentLaunch';
 import type { PreparedLaunch } from './opencodeBinary';
 import { SessionManager } from './sessionManager';
@@ -77,6 +96,8 @@ export declare function assembleSessionEnv(frame: {
     };
     env?: Record<string, string>;
     sessionId?: string;
+    /** a9be9720 — where git-credential-wenrwa asks this bridge for a fresh token. */
+    gitTokenSocket?: string;
 }): Record<string, string>;
 /** Minimal surface relayClient needs from a socket — lets tests inject fakes if ever needed. */
 export interface WebSocketLike {
@@ -103,6 +124,16 @@ export interface BackoffOpts {
     jitter?: () => number;
 }
 export interface RelayClientOpts {
+    /** lr-03 — clone the workspace's linked repos once its primary checkout
+     *  resolves (linkedRepos.ts). Background, best-effort. Absent → ignored. */
+    ensureLinkedRepos?: (opts: {
+        workspaceId: string;
+        linkedRepos: LinkedRepoRef[];
+    }) => Promise<unknown>;
+    /** a9be9720 — the unix socket this bridge serves fresh git credentials on
+     *  (gitTokenBroker.ts). Put on every workspace PTY's env. Absent → the
+     *  helper uses the token injected at open, as before. */
+    gitTokenSocket?: string;
     relayUrl: string;
     relayToken: string;
     sessions: SessionManager;
@@ -716,6 +747,16 @@ export interface RelayClientHandle {
     /** Stop reconnecting and close the current socket. Sessions are untouched — they live in SessionManager. */
     close(): void;
     isConnected(): boolean;
+    /**
+     * a9be9720 — ask the relay for a fresh git credential for one workspace.
+     * Rejects at once (code OFFLINE) with no relay connection, and with the
+     * relay's own code/sentence on a refusal; bounded, never hangs.
+     */
+    requestGitToken(workspaceId: string, repo?: string): Promise<{
+        token: string;
+        repoFullName: string;
+        expiresAt: string;
+    }>;
     /**
      * stc-05 → stc-06 — free caches + idle preview slots before a disk grows.
      * Behind a kill switch (storageCleanupDeps.autoCleanupEnabled, default

package/dist/bridge/relayClient.js

@@ -38,24 +38,6 @@ exports.assembleSessionEnv = assembleSessionEnv;
 exports.formatHealthLine = formatHealthLine;
 exports.formatDisconnectLine = formatDisconnectLine;
 exports.startRelayClient = startRelayClient;
-/**
- * ht-05 — Terminal Bridge relay mode (dial-out).
- *
- * Instead of listening on localhost for browser connections (server.ts),
- * this DIALS OUT to the platform relay over a single outbound wss
- * connection, authenticates with a per-container relay token, and serves
- * the same v1 frame protocol (see PROTOCOL.md) through the existing
- * SessionManager. Multi-session multiplexing is unchanged: every frame
- * already carries a sessionId, so one outbound socket serves every session
- * exactly like the local server serves them over N inbound sockets.
- *
- * PTYs live in the SessionManager, not the socket — a relay drop never
- * kills a session. This module owns only: dialing out, the auth frame,
- * frame routing through SessionManager, and reconnect-with-backoff. It
- * does no scrollback bookkeeping of its own (SessionManager already does
- * that) — on re-pair the pane sends `attach` again and gets a fresh
- * `replay`, exactly as it would against the local server.
- */
 const redact_1 = require("../secrets/redact");
 const agentLaunch_1 = require("./agentLaunch");
 const resumeDetector_1 = require("./resumeDetector");
@@ -189,6 +171,10 @@ function assembleSessionEnv(frame) {
         env.WENRWA_GIT_TOKEN = frame.gitCredential.token;
         env.WENRWA_GIT_REPO = frame.gitCredential.repoFullName;
     }
+    // a9be9720 — the token above is an hour-lived GitHub token injected once;
+    // the helper asks the bridge here first and keeps it only as a fallback.
+    if (frame.gitTokenSocket)
+        env.WENRWA_GIT_TOKEN_SOCKET = frame.gitTokenSocket;
     // grad-06 — the commit identity. Nothing set one, so `git commit` failed in
     // every hosted terminal with "Author identity unknown": a container has no
     // domain in its hostname, so git refuses to auto-detect an address. Both
@@ -245,6 +231,8 @@ function describeDialError(err) {
     }
     return String(err);
 }
+/** a9be9720 — how long a `git-token` request may go unanswered. `git` waits on it. */
+const GIT_TOKEN_REQUEST_TIMEOUT_MS = 10_000;
 function send(ws, frame) {
     if (ws.readyState === ws_1.WebSocket.OPEN)
         ws.send(JSON.stringify(frame));
@@ -491,6 +479,32 @@ function startRelayClient(opts) {
     let stopped = false;
     let ws = null;
     let connected = false;
+    // a9be9720 — outstanding git-token requests, by requestId.
+    const pendingGitTokens = new Map();
+    let gitTokenSeq = 0;
+    const gitTokenError = (code, message) => Object.assign(new Error(message), { code });
+    const failPendingGitTokens = (code, message) => {
+        for (const [id, p] of pendingGitTokens) {
+            clearTimeout(p.timer);
+            pendingGitTokens.delete(id);
+            p.reject(gitTokenError(code, message));
+        }
+    };
+    const requestGitToken = (workspaceId, repo) => new Promise((resolve, reject) => {
+        const socket = ws;
+        if (!connected || !socket || socket.readyState !== ws_1.WebSocket.OPEN) {
+            reject(gitTokenError('OFFLINE', 'The bridge is not connected to HiveOp'));
+            return;
+        }
+        const requestId = `gt-${++gitTokenSeq}-${Date.now().toString(36)}`;
+        const timer = setTimeout(() => {
+            pendingGitTokens.delete(requestId);
+            reject(gitTokenError('TIMEOUT', 'HiveOp did not answer the git token request'));
+        }, GIT_TOKEN_REQUEST_TIMEOUT_MS);
+        timer.unref?.();
+        pendingGitTokens.set(requestId, { resolve, reject, timer });
+        send(socket, { t: 'git-token', requestId, workspaceId, ...(repo ? { repo } : {}) });
+    });
     let attempt = 0;
     let reconnectHandle = null;
     let healthHandle = null;
@@ -1050,10 +1064,24 @@ function startRelayClient(opts) {
             }
             try {
                 switch (frame.t) {
+                    case 'git-token': {
+                        const p = pendingGitTokens.get(frame.requestId);
+                        if (!p)
+                            break;
+                        pendingGitTokens.delete(frame.requestId);
+                        clearTimeout(p.timer);
+                        if (frame.ok && frame.token && frame.repoFullName && frame.expiresAt) {
+                            p.resolve({ token: frame.token, repoFullName: frame.repoFullName, expiresAt: frame.expiresAt });
+                        }
+                        else {
+                            p.reject(gitTokenError(frame.code ?? 'GIT_TOKEN_FAILED', frame.message ?? 'HiveOp could not mint a git token'));
+                        }
+                        break;
+                    }
                     case 'open': {
                         // Capture into locals so the async .then closures below keep the
                         // discriminated-union narrowing TS would otherwise drop.
-                        const { cols, rows, workspaceId, repoUrl, autonomous, connectToken, gitCredential, gitIdentity, opencode } = frame;
+                        const { cols, rows, workspaceId, repoUrl, autonomous, connectToken, gitCredential, gitIdentity, opencode, linkedRepos } = frame;
                         // pucc-14 multiplex: the RELAY owns the session id (== agentId) and
                         // stamps it on the open + every later frame. Honor it so the PTY is
                         // registered under exactly that id and container→pane frames demux
@@ -1231,11 +1259,19 @@ function startRelayClient(opts) {
                             // shared container. autolaunch.sh reads HT_AUTONOMOUS from the
                             // PTY's own env (claude vs claude --dangerously-skip-permissions),
                             // NOT a machine-wide var.
-                            const env = assembleSessionEnv({ workspaceId, autonomous, connectToken, gitCredential, gitIdentity, env: injectedEnv, sessionId: relaySessionId });
+                            const env = assembleSessionEnv({ workspaceId, autonomous, connectToken, gitCredential, gitIdentity, env: injectedEnv, sessionId: relaySessionId, gitTokenSocket: opts.gitTokenSocket });
                             if (opts.resolveWorkspaceCwd) {
                                 opts
                                     .resolveWorkspaceCwd({ workspaceId, repoUrl, gitCredential })
-                                    .then((cwd) => openSession(cwd ?? undefined, env))
+                                    .then((cwd) => {
+                                    openSession(cwd ?? undefined, env);
+                                    // lr-03 — after the PTY: a linked clone never delays the terminal.
+                                    if (cwd && Array.isArray(linkedRepos) && linkedRepos.length > 0 && opts.ensureLinkedRepos) {
+                                        Promise.resolve()
+                                            .then(() => opts.ensureLinkedRepos({ workspaceId, linkedRepos }))
+                                            .catch((err) => console.error(`[bridge] linked repos for ${workspaceId}: ${err instanceof Error ? err.message : String(err)}`));
+                                    }
+                                })
                                     .catch((err) => {
                                     // hcs-07 — a clone-time preflight refusal is a typed,
                                     // user-actionable refusal (see diskPreflight.ts), not an
@@ -1986,6 +2022,7 @@ function startRelayClient(opts) {
         });
         const onDown = (info) => {
             connected = false;
+            failPendingGitTokens('OFFLINE', 'The bridge lost its HiveOp connection');
             stopHeartbeat();
             // Detach (not close) every live handle: the sessions/PTYs survive the
             // drop in the SessionManager, scrollback keeps accumulating, and the
@@ -2184,9 +2221,11 @@ function startRelayClient(opts) {
             if (hookActivityHandle !== null)
                 cancelInterval(hookActivityHandle);
             opts.companionForwarder?.stop(); // bws-08 — close every forwarded listener on bridge shutdown
+            failPendingGitTokens('OFFLINE', 'The bridge is shutting down');
             ws?.close();
         },
         isConnected: () => connected,
+        requestGitToken,
         runAutomaticCleanup,
     };
 }

package/dist/commands/bridge.js

@@ -64,6 +64,8 @@ const chalk_1 = __importDefault(require("chalk"));
 const sessionManager_1 = require("../bridge/sessionManager");
 const server_1 = require("../bridge/server");
 const relayClient_1 = require("../bridge/relayClient");
+const gitTokenBroker_1 = require("../bridge/gitTokenBroker");
+const linkedRepos_1 = require("../bridge/linkedRepos");
 const browserDriver_1 = require("../bridge/browserDriver");
 const browserHost_1 = require("../bridge/browserHost");
 const browserIdle_1 = require("../bridge/browserIdle");
@@ -619,8 +621,11 @@ exports.bridgeCommand = new commander_1.Command('bridge')
          * (that PTY-scoped invariant is exactly why the raw Fly exec could never
          * have cloned for itself — see issues/msf-34).
          */
-        const ensureWorkspaceCheckout = (args) => (0, repoCheckout_1.ensureWorkspaceRepo)({ workspaceId: args.workspaceId, repoUrl: args.repoUrl }, {
-            reposBaseDir,
+        // lr-03: the same checkout, in any base dir — /data/repos for a
+        // workspace's primary, /data/linked/<ws> for its linked repos. Free space
+        // and quota are still measured on /data/repos (same volume, always there).
+        const checkoutIn = (baseDir) => (args) => (0, repoCheckout_1.ensureWorkspaceRepo)({ workspaceId: args.workspaceId, repoUrl: args.repoUrl }, {
+            reposBaseDir: baseDir,
             exists: (p) => fs.existsSync(p),
             mkdir: (p) => fs.mkdirSync(p, { recursive: true }),
             // msf-34: the clone gets the workspace credential IN ITS ENV.
@@ -664,6 +669,7 @@ exports.bridgeCommand = new commander_1.Command('bridge')
             // does not).
             rm: rmCheckoutDir,
         });
+        const ensureWorkspaceCheckout = checkoutIn(reposBaseDir);
         // tp-06 (ADR-0014) — the Team preview forwarder. Started here, in the
         // container branch only: the local bridge never opens it. It is also a
         // no-op without a `fly-local-6pn` entry, and stays off until
@@ -682,10 +688,30 @@ exports.bridgeCommand = new commander_1.Command('bridge')
         });
         // cvt-07: the box's one shared Chromium, created lazily by the first tab.
         let browserHost;
-        (0, relayClient_1.startRelayClient)({
+        // a9be9720 — agents' git credentials stay fresh past the hour the
+        // injected one lives: git-credential-wenrwa asks this socket, the broker
+        // asks the relay. Hosted lane only — a laptop pushes with its own git.
+        const gitTokenSocket = process.env.WENRWA_GIT_TOKEN_SOCKET || path.join(os.homedir(), '.wenrwa', 'git-token.sock');
+        let relayClient = null;
+        const gitTokenBroker = new gitTokenBroker_1.GitTokenBroker((workspaceId, repo) => relayClient
+            ? relayClient.requestGitToken(workspaceId, repo)
+            : Promise.reject(Object.assign(new Error('The bridge is starting'), { code: 'OFFLINE' })));
+        (0, gitTokenBroker_1.startGitTokenSocket)({ path: gitTokenSocket, broker: gitTokenBroker }).catch((err) => console.error(`[bridge] git token socket failed to start — agents fall back to the token from open: ${err instanceof Error ? err.message : String(err)}`));
+        // lr-03 — a workspace's linked repos, cloned beside (never inside)
+        // /data/repos, each with its own credential from the broker.
+        const linkedBaseDir = process.env.WENRWA_LINKED_DIR || path.join(path.dirname(reposBaseDir), 'linked');
+        const ensureLinked = (args) => (0, linkedRepos_1.ensureLinkedRepos)(args, {
+            linkedBaseDir,
+            credentialFor: (workspaceId, fullName) => gitTokenBroker.get(workspaceId, fullName),
+            ensure: ({ baseDir, name, repoUrl, gitCredential }) => checkoutIn(baseDir)({ workspaceId: name, repoUrl, gitCredential }),
+            log: (line) => console.error(line),
+        });
+        relayClient = (0, relayClient_1.startRelayClient)({
             relayUrl: relayMode.relayUrl,
             relayToken: relayMode.relayToken,
             sessions,
+            gitTokenSocket,
+            ensureLinkedRepos: ensureLinked,
             // Rock-solid sleep/wake: this is the HOSTED container bridge, the only
             // process that knows which agent PTYs are actually running. The backend
             // reconciles claude_code_agents.lifecycle_state against this report —

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wenrwa/marketplace-cli",
-  "version": "0.8.12",
+  "version": "0.8.14",
   "description": "CLI tool for the Wenrwa Agent Marketplace — monitor bounties, agents, workspaces, and treasury from your terminal",
   "author": "Wenrwa <dev@wenrwa.com>",
   "license": "MIT",