@wenrwa/marketplace-cli 0.8.13 → 0.8.15

package/dist/__tests__/bridge-linked-repos-pointer.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/bridge-linked-repos-pointer.test.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * lr-03 — the managed region tells an agent which linked repos it has, where
+ * they are on the box, and whether it may push to each. Without this an agent
+ * never learns the backend sits at /data/linked/<ws>/backend.
+ */
+const contextWriter_1 = require("../bridge/contextWriter");
+const workGraphPointer_1 = require("../bridge/workGraphPointer");
+const WS = '11111111-1111-4111-8111-111111111111';
+const LINKED = [
+    { alias: 'backend', fullName: 'acme/backend', writable: true, path: `/data/linked/${WS}/backend` },
+    { alias: 'cli', fullName: 'acme/cli', writable: false, path: `/data/linked/${WS}/cli` },
+];
+describe('linkedReposSection', () => {
+    it('one line per repo: alias, repo, path, and whether pushing is allowed', () => {
+        expect((0, workGraphPointer_1.linkedReposSection)({ linkedRepos: LINKED })).toBe([
+            '## Linked repos',
+            'This workspace also has these repos, each its own checkout:',
+            `- \`backend\` (acme/backend) at /data/linked/${WS}/backend — you can push`,
+            `- \`cli\` (acme/cli) at /data/linked/${WS}/cli — read-only, pushes are refused`,
+        ].join('\n'));
+    });
+    it('nothing linked → no section', () => {
+        expect((0, workGraphPointer_1.linkedReposSection)({ linkedRepos: [] })).toBeNull();
+        expect((0, workGraphPointer_1.linkedReposSection)({})).toBeNull();
+    });
+});
+describe('writeContext carries it inside the pointer block', () => {
+    it('a pointers-only refresh writes the section between the pointer markers', () => {
+        const files = new Map();
+        (0, contextWriter_1.writeContext)({ workspaceId: WS, pointersOnly: true, linkedRepos: LINKED }, {
+            reposBaseDir: '/data/repos',
+            exists: (p) => files.has(p),
+            readFile: (p) => files.get(p) ?? '',
+            writeFile: (p, c) => { files.set(p, c); },
+            mkdirp: () => { },
+        });
+        const written = [...files.values()].join('\n');
+        const block = written.slice(written.indexOf(contextWriter_1.POINTERS_START_MARKER), written.indexOf(contextWriter_1.POINTERS_END_MARKER));
+        expect(block).toContain('## Linked repos');
+        expect(block).toContain(`/data/linked/${WS}/cli — read-only`);
+    });
+});

package/dist/__tests__/git-token-refresh.test.js

@@ -88,6 +88,10 @@ describe('relay client — requestGitToken (a9be9720)', () => {
             const pending = handle.requestGitToken('ws-1');
             const req = await asked;
             expect(req).toEqual({ t: 'git-token', requestId: expect.any(String), workspaceId: 'ws-1' });
+            // lr-02: a named repo rides along.
+            const asked2 = nextOfType(ws, 'git-token');
+            void handle.requestGitToken('ws-1', 'acme/backend').catch(() => undefined);
+            expect(await asked2).toMatchObject({ workspaceId: 'ws-1', repo: 'acme/backend' });
             ws.send(JSON.stringify({ t: 'git-token', requestId: req.requestId, workspaceId: 'ws-1', ok: true, token: 'ghs_new', repoFullName: 'acme/w', expiresAt: '2026-10-24T13:00:00.000Z' }));
             await expect(pending).resolves.toEqual({ token: 'ghs_new', repoFullName: 'acme/w', expiresAt: '2026-10-24T13:00:00.000Z' });
         }
@@ -139,6 +143,14 @@ describe('GitTokenBroker — one fresh credential per workspace, cached until sh
         expect((await broker.get('ws-1')).token).toBe('t2');
         expect(fetch).toHaveBeenCalledTimes(2);
     });
+    it('lr-02: each repo of a workspace has its own credential', async () => {
+        const fetch = jest.fn(async (ws, repo) => ({ token: `${ws}:${repo ?? '-'}`, repoFullName: repo ?? 'p', expiresAt: inMinutes(15) }));
+        const broker = new gitTokenBroker_1.GitTokenBroker(fetch);
+        expect((await broker.get('ws-1')).token).toBe('ws-1:-');
+        expect((await broker.get('ws-1', 'acme/backend')).token).toBe('ws-1:acme/backend');
+        expect((await broker.get('ws-1', 'ACME/Backend')).token).toBe('ws-1:acme/backend');
+        expect(fetch).toHaveBeenCalledTimes(2);
+    });
     it('workspaces never share a credential', async () => {
         const fetch = jest.fn(async (ws) => ({ token: `tok-${ws}`, repoFullName: ws, expiresAt: inMinutes(15) }));
         const broker = new gitTokenBroker_1.GitTokenBroker(fetch);
@@ -179,11 +191,30 @@ describe('git token socket + the box\'s git-credential-wenrwa helper', () => {
         server = null;
         fs_1.default.rmSync(dir, { recursive: true, force: true });
     });
-    const runHelper = (env) => new Promise((resolve) => {
+    const runHelper = (env, stdin = 'protocol=https\nhost=github.com\n\n') => new Promise((resolve) => {
         const child = (0, child_process_1.execFile)('sh', [HELPER, 'get'], { env: { PATH: process.env.PATH ?? '', ...env } }, (err, stdout, stderr) => {
             resolve({ code: err ? err.code ?? 1 : 0, stdout, stderr });
         });
-        child.stdin?.end('protocol=https\nhost=github.com\n\n');
+        child.stdin?.end(stdin);
+    });
+    it('lr-02: with git\'s path= (credential.useHttpPath) the helper asks for THAT repo', async () => {
+        const asked = [];
+        server = await (0, gitTokenBroker_1.startGitTokenSocket)({
+            path: sock,
+            broker: new gitTokenBroker_1.GitTokenBroker(async (ws, repo) => { asked.push([ws, repo]); return { token: `tok-${repo ?? 'primary'}`, repoFullName: repo ?? 'p', expiresAt: inMinutes(15) }; }),
+        });
+        const out = await runHelper({ WENRWA_GIT_TOKEN_SOCKET: sock, WENRWA_WORKSPACE_ID: 'ws-1', WENRWA_GIT_TOKEN: 'stale' }, 'protocol=https\nhost=github.com\npath=acme/backend.git\n\n');
+        expect(out.stdout).toBe('username=x-access-token\npassword=tok-acme/backend\n');
+        expect(asked).toEqual([['ws-1', 'acme/backend']]);
+    });
+    it('lr-02: a path git sends for another host (Forgejo) is not passed — the primary answers', async () => {
+        const asked = [];
+        server = await (0, gitTokenBroker_1.startGitTokenSocket)({
+            path: sock,
+            broker: new gitTokenBroker_1.GitTokenBroker(async (ws, repo) => { asked.push([ws, repo]); return { token: 'primary', repoFullName: 'p', expiresAt: inMinutes(15) }; }),
+        });
+        await runHelper({ WENRWA_GIT_TOKEN_SOCKET: sock, WENRWA_WORKSPACE_ID: 'ws-1' }, 'protocol=https\nhost=forgejo.example\npath=pilot/deck.git\n\n');
+        expect(asked).toEqual([['ws-1', undefined]]);
     });
     it('the socket is owner-only (0600)', async () => {
         server = await (0, gitTokenBroker_1.startGitTokenSocket)({ path: sock, broker: new gitTokenBroker_1.GitTokenBroker(async () => ({ token: 't', repoFullName: 'r', expiresAt: inMinutes(15) })) });

package/dist/__tests__/linked-repos-clone.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/linked-repos-clone.test.js

@@ -0,0 +1,164 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * lr-03 — the box clones a workspace's linked repos into
+ * /data/linked/<workspaceId>/<alias> (docs/prd/linked-repos-backend.md).
+ *
+ * Not /data/repos/<ws>.linked: the checkout inventory treats every directory
+ * under /data/repos as a workspace id, so a `<ws>.linked` folder would read as
+ * a deleted workspace — a reclaim candidate.
+ */
+const ws_1 = require("ws");
+const linkedRepos_1 = require("../bridge/linkedRepos");
+const relayClient_1 = require("../bridge/relayClient");
+const sessionManager_1 = require("../bridge/sessionManager");
+class FakePty {
+    opts;
+    constructor(opts) {
+        this.opts = opts;
+    }
+    write() { }
+    resize() { }
+    kill() { }
+    onData() { }
+    onExit() { }
+}
+const WS = '11111111-1111-4111-8111-111111111111';
+function harness(opts = {}) {
+    const ensured = [];
+    const credentialFor = jest.fn(async (_ws, fullName) => ({ token: `tok-${fullName}`, repoFullName: fullName, expiresAt: 'x' }));
+    const deps = {
+        linkedBaseDir: '/data/linked',
+        credentialFor,
+        ensure: jest.fn(async (args) => {
+            ensured.push({ base: args.baseDir, alias: args.name, repoUrl: args.repoUrl, token: args.gitCredential?.token });
+            if (args.name === opts.fail)
+                throw new Error('clone failed');
+            return { action: 'cloned', path: `${args.baseDir}/${args.name}` };
+        }),
+        log: jest.fn(),
+    };
+    return { deps, ensured, credentialFor };
+}
+const repos = [
+    { alias: 'backend', fullName: 'acme/backend', cloneUrl: 'https://github.com/acme/backend.git' },
+    { alias: 'cli', fullName: 'acme/cli', cloneUrl: 'https://github.com/acme/cli.git' },
+];
+describe('ensureLinkedRepos', () => {
+    it('ensures each linked repo under /data/linked/<ws>/<alias>, each with ITS OWN credential', async () => {
+        const h = harness();
+        const results = await (0, linkedRepos_1.ensureLinkedRepos)({ workspaceId: WS, linkedRepos: repos }, h.deps);
+        expect(h.ensured).toEqual([
+            { base: `/data/linked/${WS}`, alias: 'backend', repoUrl: 'https://github.com/acme/backend.git', token: 'tok-acme/backend' },
+            { base: `/data/linked/${WS}`, alias: 'cli', repoUrl: 'https://github.com/acme/cli.git', token: 'tok-acme/cli' },
+        ]);
+        expect(results.map((r) => r.action)).toEqual(['cloned', 'cloned']);
+    });
+    it('one failing clone never stops the others, and never throws', async () => {
+        const h = harness({ fail: 'backend' });
+        const results = await (0, linkedRepos_1.ensureLinkedRepos)({ workspaceId: WS, linkedRepos: repos }, h.deps);
+        expect(results.map((r) => r.action)).toEqual(['failed', 'cloned']);
+        expect(h.deps.log).toHaveBeenCalled();
+    });
+    it('a credential the relay refuses → that repo is skipped (no anonymous clone of a private repo)', async () => {
+        const h = harness();
+        h.credentialFor.mockRejectedValueOnce(Object.assign(new Error('not linked'), { code: 'REPO_NOT_LINKED' }));
+        const results = await (0, linkedRepos_1.ensureLinkedRepos)({ workspaceId: WS, linkedRepos: repos }, h.deps);
+        expect(h.ensured.map((e) => e.alias)).toEqual(['cli']);
+        expect(results[0]).toMatchObject({ alias: 'backend', action: 'failed' });
+    });
+    it('refuses anything that could escape its folder: bad alias, bad workspace id, a non-github URL', async () => {
+        const h = harness();
+        await (0, linkedRepos_1.ensureLinkedRepos)({
+            workspaceId: WS,
+            linkedRepos: [
+                { alias: '../repos', fullName: 'acme/x', cloneUrl: 'https://github.com/acme/x.git' },
+                { alias: 'ok', fullName: 'acme/x', cloneUrl: 'file:///etc' },
+                { alias: 'ok2', fullName: '../../x', cloneUrl: 'https://github.com/acme/x.git' },
+            ],
+        }, h.deps);
+        await (0, linkedRepos_1.ensureLinkedRepos)({ workspaceId: '../../etc', linkedRepos: repos }, h.deps);
+        expect(h.ensured).toEqual([]);
+    });
+    it('nothing linked → nothing done', async () => {
+        const h = harness();
+        expect(await (0, linkedRepos_1.ensureLinkedRepos)({ workspaceId: WS, linkedRepos: [] }, h.deps)).toEqual([]);
+        expect(h.deps.ensure).not.toHaveBeenCalled();
+    });
+});
+describe('relay client — an open with linkedRepos (lr-03)', () => {
+    function startFakeRelay() {
+        return new Promise((resolve) => {
+            const wss = new ws_1.WebSocketServer({ port: 0, host: '127.0.0.1' });
+            const q = [];
+            const w = [];
+            wss.on('connection', (ws) => { const f = w.shift(); if (f)
+                f(ws);
+            else
+                q.push(ws); });
+            wss.on('listening', () => {
+                const a = wss.address();
+                resolve({ wss, port: typeof a === 'object' && a ? a.port : 0, next: () => (q.length ? Promise.resolve(q.shift()) : new Promise((r) => w.push(r))) });
+            });
+        });
+    }
+    it('the terminal opens first; the linked repos are ensured after the primary checkout resolves', async () => {
+        const relay = await startFakeRelay();
+        const order = [];
+        const spawned = [];
+        let release;
+        const ensureLinkedRepos = jest.fn(async () => { order.push('linked'); });
+        const handle = (0, relayClient_1.startRelayClient)({
+            relayUrl: `ws://127.0.0.1:${relay.port}`,
+            relayToken: 'tok',
+            sessions: new sessionManager_1.SessionManager({ spawn: (o) => { order.push('pty'); spawned.push(o); return new FakePty(o); } }),
+            resolveWorkspaceCwd: () => new Promise((r) => { release = r; }),
+            ensureLinkedRepos,
+        });
+        try {
+            const ws = await relay.next();
+            ws.send(JSON.stringify({
+                t: 'open', cols: 80, rows: 24, sessionId: 'agent-A', workspaceId: WS,
+                repoUrl: 'https://github.com/acme/app.git',
+                linkedRepos: repos,
+            }));
+            await new Promise((r) => setTimeout(r, 50));
+            expect(ensureLinkedRepos).not.toHaveBeenCalled(); // waits for the primary
+            release('/data/repos/ws');
+            await new Promise((r) => setTimeout(r, 50));
+            expect(order).toEqual(['pty', 'linked']);
+            expect(ensureLinkedRepos).toHaveBeenCalledWith({ workspaceId: WS, linkedRepos: repos });
+        }
+        finally {
+            handle.close();
+            for (const c of relay.wss.clients)
+                c.terminate();
+            await new Promise((r) => relay.wss.close(r));
+        }
+    });
+    it('a failing ensure never touches the session', async () => {
+        const relay = await startFakeRelay();
+        const handle = (0, relayClient_1.startRelayClient)({
+            relayUrl: `ws://127.0.0.1:${relay.port}`,
+            relayToken: 'tok',
+            sessions: new sessionManager_1.SessionManager({ spawn: (o) => new FakePty(o) }),
+            resolveWorkspaceCwd: async () => '/data/repos/ws',
+            ensureLinkedRepos: async () => { throw new Error('boom'); },
+        });
+        try {
+            const ws = await relay.next();
+            const errors = [];
+            ws.on('message', (raw) => { const f = JSON.parse(String(raw)); if (f.t === 'error')
+                errors.push(f); });
+            ws.send(JSON.stringify({ t: 'open', cols: 80, rows: 24, sessionId: 'agent-A', workspaceId: WS, linkedRepos: repos }));
+            await new Promise((r) => setTimeout(r, 80));
+            expect(errors).toEqual([]);
+        }
+        finally {
+            handle.close();
+            for (const c of relay.wss.clients)
+                c.terminate();
+            await new Promise((r) => relay.wss.close(r));
+        }
+    });
+});

package/dist/bridge/contextWriter.d.ts

@@ -35,6 +35,13 @@ export declare function writeContext(input: {
     /** Absent only for a pointers-only refresh (wmr-07). */
     content?: string;
     workGraphAvailable?: boolean;
+    /** lr-03 — this workspace's linked repos on the box (linkedReposSection). */
+    linkedRepos?: Array<{
+        alias: string;
+        fullName: string;
+        writable: boolean;
+        path: string;
+    }>;
     /** 2026-10-02 — a match workspace: MATCH_POINTER replaces the work-queue pointer (workSection). */
     match?: boolean;
     /**

package/dist/bridge/contextWriter.js

@@ -173,6 +173,9 @@ function writeContextFile(input, claudeMdPath, seedPath, workspaceRoot, deps) {
         pointers.push(work);
     if (input.memoryAvailable)
         pointers.push((0, memoryPointer_1.memorySection)(input.memoryBrief));
+    const linked = (0, workGraphPointer_1.linkedReposSection)(input);
+    if (linked)
+        pointers.push(linked);
     const browser = (0, workGraphPointer_1.browserSection)(input);
     if (browser)
         pointers.push(browser);

package/dist/bridge/gitTokenBroker.d.ts

@@ -3,7 +3,9 @@ export interface GitCredential {
     repoFullName: string;
     expiresAt: string;
 }
-export type GitCredentialFetcher = (workspaceId: string) => Promise<GitCredential>;
+/** `repo` (owner/repo) is the repo git asked about, when the helper knows it
+ *  (lr-02: linked repos have credentials of their own). Absent = the primary. */
+export type GitCredentialFetcher = (workspaceId: string, repo?: string) => Promise<GitCredential>;
 /** Ask again once a cached credential has less than this left. */
 export declare const REFRESH_BEFORE_EXPIRY_MS: number;
 export declare class GitTokenBroker {
@@ -12,7 +14,7 @@ export declare class GitTokenBroker {
     private cache;
     private inFlight;
     constructor(fetch: GitCredentialFetcher, now?: () => number);
-    get(workspaceId: string): Promise<GitCredential>;
+    get(workspaceId: string, repo?: string): Promise<GitCredential>;
 }
 export interface GitTokenSocketHandle {
     path: string;

package/dist/bridge/gitTokenBroker.js

@@ -46,27 +46,29 @@ class GitTokenBroker {
         this.fetch = fetch;
         this.now = now;
     }
-    async get(workspaceId) {
-        const cached = this.cache.get(workspaceId);
+    async get(workspaceId, repo) {
+        const key = `${workspaceId}\u0000${repo ? repo.toLowerCase() : ''}`;
+        const cached = this.cache.get(key);
         if (cached && Date.parse(cached.expiresAt) - this.now() > exports.REFRESH_BEFORE_EXPIRY_MS)
             return cached;
         // A burst of git calls (fetch + push, a submodule walk) makes ONE request.
-        const pending = this.inFlight.get(workspaceId);
+        const pending = this.inFlight.get(key);
         if (pending)
             return pending;
-        const request = this.fetch(workspaceId)
+        const request = (repo ? this.fetch(workspaceId, repo) : this.fetch(workspaceId))
             .then((cred) => {
-            this.cache.set(workspaceId, cred);
+            this.cache.set(key, cred);
             return cred;
         })
-            .finally(() => this.inFlight.delete(workspaceId));
-        this.inFlight.set(workspaceId, request);
+            .finally(() => this.inFlight.delete(key));
+        this.inFlight.set(key, request);
         return request;
     }
 }
 exports.GitTokenBroker = GitTokenBroker;
 /** Workspace ids are UUIDs; anything else is refused before it is used. */
 const WORKSPACE_ID = /^[A-Za-z0-9-]{1,64}$/;
+const REPO = /^[A-Za-z0-9._-]{1,100}\/[A-Za-z0-9._-]{1,100}$/;
 /**
  * Serve `broker` on a unix socket at `opts.path` (0600). Replaces a stale
  * socket file left by a previous bridge.
@@ -94,7 +96,12 @@ async function startGitTokenSocket(opts) {
             reply(400, 'no workspace: WENRWA_WORKSPACE_ID is not set in this environment\n');
             return;
         }
-        opts.broker.get(workspaceId).then((cred) => reply(200, `username=x-access-token\npassword=${cred.token}\n`), (err) => {
+        const repo = url.searchParams.get('repo') ?? '';
+        if (repo && (!REPO.test(repo) || repo.includes('..'))) {
+            reply(400, 'repo must be owner/repo\n');
+            return;
+        }
+        opts.broker.get(workspaceId, repo || undefined).then((cred) => reply(200, `username=x-access-token\npassword=${cred.token}\n`), (err) => {
             const e = err;
             const code = typeof e?.code === 'string' ? e.code : 'GIT_TOKEN_FAILED';
             const message = typeof e?.message === 'string' ? e.message : 'could not get a git token';

package/dist/bridge/linkedRepos.d.ts

@@ -0,0 +1,35 @@
+import type { GitCredential } from './gitTokenBroker';
+export interface LinkedRepoRef {
+    alias: string;
+    fullName: string;
+    cloneUrl: string;
+    /** Shown to the agent (context pointer); GitHub enforces it via the token. */
+    writable?: boolean;
+}
+/** /data/linked/<workspaceId>/<alias> — the ONE place a linked clone lives. */
+export declare function linkedRepoPath(linkedBaseDir: string, workspaceId: string, alias: string): string;
+export interface LinkedRepoResult {
+    alias: string;
+    action: 'existing' | 'cloned' | 'failed';
+    path?: string;
+}
+export interface LinkedRepoDeps {
+    /** /data/linked */
+    linkedBaseDir: string;
+    credentialFor(workspaceId: string, fullName: string): Promise<GitCredential>;
+    /** ensureWorkspaceRepo with `reposBaseDir = baseDir`, `workspaceId = name`. */
+    ensure(args: {
+        baseDir: string;
+        name: string;
+        repoUrl: string;
+        gitCredential?: GitCredential;
+    }): Promise<{
+        action: string;
+        path?: string;
+    }>;
+    log?(line: string): void;
+}
+export declare function ensureLinkedRepos(opts: {
+    workspaceId: string;
+    linkedRepos: LinkedRepoRef[];
+}, deps: LinkedRepoDeps): Promise<LinkedRepoResult[]>;

package/dist/bridge/linkedRepos.js

@@ -0,0 +1,57 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.linkedRepoPath = linkedRepoPath;
+exports.ensureLinkedRepos = ensureLinkedRepos;
+/**
+ * lr-03 — clone a workspace's LINKED repos on the box
+ * (docs/prd/linked-repos-backend.md).
+ *
+ * The relay's `open` frame lists them; once the primary checkout resolves the
+ * bridge ensures each one at /data/linked/<workspaceId>/<alias>, in the
+ * background, through the SAME ensureWorkspaceRepo the primary uses (clone
+ * mutex, free-space and storage-quota preflights, interrupted-clone cleanup).
+ *
+ * - Not under /data/repos: the checkout inventory treats every directory there
+ *   as a workspace id, so `<ws>.linked` would read as a deleted workspace.
+ * - Each repo gets ITS OWN credential (read-only unless the link may push),
+ *   fetched fresh from the relay; a refused credential skips that repo rather
+ *   than cloning a private repo anonymously.
+ * - Never deletes anything: an unlinked repo's clone stays on the volume.
+ * - Never throws: a failed clone must not break the terminal that opened.
+ */
+const path_1 = __importDefault(require("path"));
+/** /data/linked/<workspaceId>/<alias> — the ONE place a linked clone lives. */
+function linkedRepoPath(linkedBaseDir, workspaceId, alias) {
+    return path_1.default.join(linkedBaseDir, workspaceId, alias);
+}
+const ALIAS = /^[a-z0-9][a-z0-9-]{0,31}$/;
+const WORKSPACE_ID = /^[A-Za-z0-9-]{1,64}$/;
+const FULL_NAME = /^[A-Za-z0-9._-]{1,100}\/[A-Za-z0-9._-]{1,100}$/;
+const GITHUB_CLONE_URL = /^https:\/\/github\.com\/[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+\.git$/;
+async function ensureLinkedRepos(opts, deps) {
+    if (!WORKSPACE_ID.test(opts.workspaceId))
+        return [];
+    const baseDir = path_1.default.join(deps.linkedBaseDir, opts.workspaceId);
+    const results = [];
+    // One at a time: two big clones at once on a small box is how a disk fills.
+    for (const ref of opts.linkedRepos) {
+        if (!ALIAS.test(ref.alias) || !FULL_NAME.test(ref.fullName) || ref.fullName.includes('..') || !GITHUB_CLONE_URL.test(ref.cloneUrl)) {
+            deps.log?.(`[linked] skipped a malformed linked repo entry`);
+            continue;
+        }
+        try {
+            const gitCredential = await deps.credentialFor(opts.workspaceId, ref.fullName);
+            const r = await deps.ensure({ baseDir, name: ref.alias, repoUrl: ref.cloneUrl, gitCredential });
+            const action = r.action === 'existing' || r.action === 'cloned' ? r.action : 'failed';
+            results.push({ alias: ref.alias, action, ...(r.path ? { path: r.path } : {}) });
+        }
+        catch (err) {
+            deps.log?.(`[linked] ${ref.alias} (${ref.fullName}) not ready: ${err instanceof Error ? err.message : String(err)}`);
+            results.push({ alias: ref.alias, action: 'failed' });
+        }
+    }
+    return results;
+}

package/dist/bridge/relayClient.d.ts

@@ -1,3 +1,22 @@
+/**
+ * ht-05 — Terminal Bridge relay mode (dial-out).
+ *
+ * Instead of listening on localhost for browser connections (server.ts),
+ * this DIALS OUT to the platform relay over a single outbound wss
+ * connection, authenticates with a per-container relay token, and serves
+ * the same v1 frame protocol (see PROTOCOL.md) through the existing
+ * SessionManager. Multi-session multiplexing is unchanged: every frame
+ * already carries a sessionId, so one outbound socket serves every session
+ * exactly like the local server serves them over N inbound sockets.
+ *
+ * PTYs live in the SessionManager, not the socket — a relay drop never
+ * kills a session. This module owns only: dialing out, the auth frame,
+ * frame routing through SessionManager, and reconnect-with-backoff. It
+ * does no scrollback bookkeeping of its own (SessionManager already does
+ * that) — on re-pair the pane sends `attach` again and gets a fresh
+ * `replay`, exactly as it would against the local server.
+ */
+import type { LinkedRepoRef } from './linkedRepos';
 import { type OpencodeLaunchInput } from './agentLaunch';
 import type { PreparedLaunch } from './opencodeBinary';
 import { SessionManager } from './sessionManager';
@@ -105,6 +124,12 @@ export interface BackoffOpts {
     jitter?: () => number;
 }
 export interface RelayClientOpts {
+    /** lr-03 — clone the workspace's linked repos once its primary checkout
+     *  resolves (linkedRepos.ts). Background, best-effort. Absent → ignored. */
+    ensureLinkedRepos?: (opts: {
+        workspaceId: string;
+        linkedRepos: LinkedRepoRef[];
+    }) => Promise<unknown>;
     /** a9be9720 — the unix socket this bridge serves fresh git credentials on
      *  (gitTokenBroker.ts). Put on every workspace PTY's env. Absent → the
      *  helper uses the token injected at open, as before. */
@@ -266,6 +291,7 @@ export interface RelayClientOpts {
     refreshContextPointers?: (args: {
         workspaceId: string;
         engine?: string;
+        linkedRepos?: LinkedRepoRef[];
     }) => void | Promise<void>;
     writeContext?: (manifest: {
         workspaceId: string;
@@ -727,7 +753,7 @@ export interface RelayClientHandle {
      * Rejects at once (code OFFLINE) with no relay connection, and with the
      * relay's own code/sentence on a refusal; bounded, never hangs.
      */
-    requestGitToken(workspaceId: string): Promise<{
+    requestGitToken(workspaceId: string, repo?: string): Promise<{
         token: string;
         repoFullName: string;
         expiresAt: string;

package/dist/bridge/relayClient.js

@@ -38,24 +38,6 @@ exports.assembleSessionEnv = assembleSessionEnv;
 exports.formatHealthLine = formatHealthLine;
 exports.formatDisconnectLine = formatDisconnectLine;
 exports.startRelayClient = startRelayClient;
-/**
- * ht-05 — Terminal Bridge relay mode (dial-out).
- *
- * Instead of listening on localhost for browser connections (server.ts),
- * this DIALS OUT to the platform relay over a single outbound wss
- * connection, authenticates with a per-container relay token, and serves
- * the same v1 frame protocol (see PROTOCOL.md) through the existing
- * SessionManager. Multi-session multiplexing is unchanged: every frame
- * already carries a sessionId, so one outbound socket serves every session
- * exactly like the local server serves them over N inbound sockets.
- *
- * PTYs live in the SessionManager, not the socket — a relay drop never
- * kills a session. This module owns only: dialing out, the auth frame,
- * frame routing through SessionManager, and reconnect-with-backoff. It
- * does no scrollback bookkeeping of its own (SessionManager already does
- * that) — on re-pair the pane sends `attach` again and gets a fresh
- * `replay`, exactly as it would against the local server.
- */
 const redact_1 = require("../secrets/redact");
 const agentLaunch_1 = require("./agentLaunch");
 const resumeDetector_1 = require("./resumeDetector");
@@ -508,7 +490,7 @@ function startRelayClient(opts) {
             p.reject(gitTokenError(code, message));
         }
     };
-    const requestGitToken = (workspaceId) => new Promise((resolve, reject) => {
+    const requestGitToken = (workspaceId, repo) => new Promise((resolve, reject) => {
         const socket = ws;
         if (!connected || !socket || socket.readyState !== ws_1.WebSocket.OPEN) {
             reject(gitTokenError('OFFLINE', 'The bridge is not connected to HiveOp'));
@@ -521,7 +503,7 @@ function startRelayClient(opts) {
         }, GIT_TOKEN_REQUEST_TIMEOUT_MS);
         timer.unref?.();
         pendingGitTokens.set(requestId, { resolve, reject, timer });
-        send(socket, { t: 'git-token', requestId, workspaceId });
+        send(socket, { t: 'git-token', requestId, workspaceId, ...(repo ? { repo } : {}) });
     });
     let attempt = 0;
     let reconnectHandle = null;
@@ -1099,7 +1081,7 @@ function startRelayClient(opts) {
                     case 'open': {
                         // Capture into locals so the async .then closures below keep the
                         // discriminated-union narrowing TS would otherwise drop.
-                        const { cols, rows, workspaceId, repoUrl, autonomous, connectToken, gitCredential, gitIdentity, opencode } = frame;
+                        const { cols, rows, workspaceId, repoUrl, autonomous, connectToken, gitCredential, gitIdentity, opencode, linkedRepos } = frame;
                         // pucc-14 multiplex: the RELAY owns the session id (== agentId) and
                         // stamps it on the open + every later frame. Honor it so the PTY is
                         // registered under exactly that id and container→pane frames demux
@@ -1249,6 +1231,8 @@ function startRelayClient(opts) {
                             if (workspaceId && opts.refreshContextPointers) {
                                 void Promise.resolve(opts.refreshContextPointers({
                                     workspaceId,
+                                    // lr-03: absent on the frame = none linked (or an older relay).
+                                    linkedRepos: Array.isArray(linkedRepos) ? linkedRepos : [],
                                     // oc-23: the relay-injected env names the agent's engine; absent = Claude.
                                     ...(injectedEnv?.WENRWA_AGENT_ENGINE ? { engine: injectedEnv.WENRWA_AGENT_ENGINE } : {}),
                                 })).catch((err) => {
@@ -1281,7 +1265,15 @@ function startRelayClient(opts) {
                             if (opts.resolveWorkspaceCwd) {
                                 opts
                                     .resolveWorkspaceCwd({ workspaceId, repoUrl, gitCredential })
-                                    .then((cwd) => openSession(cwd ?? undefined, env))
+                                    .then((cwd) => {
+                                    openSession(cwd ?? undefined, env);
+                                    // lr-03 — after the PTY: a linked clone never delays the terminal.
+                                    if (cwd && Array.isArray(linkedRepos) && linkedRepos.length > 0 && opts.ensureLinkedRepos) {
+                                        Promise.resolve()
+                                            .then(() => opts.ensureLinkedRepos({ workspaceId, linkedRepos }))
+                                            .catch((err) => console.error(`[bridge] linked repos for ${workspaceId}: ${err instanceof Error ? err.message : String(err)}`));
+                                    }
+                                })
                                     .catch((err) => {
                                     // hcs-07 — a clone-time preflight refusal is a typed,
                                     // user-actionable refusal (see diskPreflight.ts), not an

package/dist/bridge/workGraphPointer.d.ts

@@ -51,6 +51,19 @@ export declare function workSection(input: {
     workGraphAvailable?: boolean;
     match?: boolean;
 }): string | null;
+/**
+ * lr-03 — which linked repos this workspace has, where each is on the box, and
+ * whether the agent may push there (a read-only link's token is contents:read,
+ * so a push is refused by GitHub). Silent when nothing is linked.
+ */
+export declare function linkedReposSection(input: {
+    linkedRepos?: Array<{
+        alias: string;
+        fullName: string;
+        writable: boolean;
+        path: string;
+    }>;
+}): string | null;
 /**
  * cvt-09 (amended by the 2026-10-04 show-in-browser-tabs change) — tells the
  * agent its pilot watches a Browser pane and WHEN to call `show_in_browser`:

package/dist/bridge/workGraphPointer.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SECRETS_POINTER = exports.KEYS_POINTER = exports.BROWSER_POINTER = exports.MATCH_POINTER = exports.WORK_GRAPH_POINTER = void 0;
 exports.workSection = workSection;
+exports.linkedReposSection = linkedReposSection;
 exports.browserSection = browserSection;
 exports.keysSection = keysSection;
 exports.withSecretsSection = withSecretsSection;
@@ -67,6 +68,21 @@ function workSection(input) {
         return exports.MATCH_POINTER;
     return input.workGraphAvailable ? exports.WORK_GRAPH_POINTER : null;
 }
+/**
+ * lr-03 — which linked repos this workspace has, where each is on the box, and
+ * whether the agent may push there (a read-only link's token is contents:read,
+ * so a push is refused by GitHub). Silent when nothing is linked.
+ */
+function linkedReposSection(input) {
+    const repos = input.linkedRepos ?? [];
+    if (repos.length === 0)
+        return null;
+    return [
+        '## Linked repos',
+        'This workspace also has these repos, each its own checkout:',
+        ...repos.map((r) => `- \`${r.alias}\` (${r.fullName}) at ${r.path} — ${r.writable ? 'you can push' : 'read-only, pushes are refused'}`),
+    ].join('\n');
+}
 /**
  * cvt-09 (amended by the 2026-10-04 show-in-browser-tabs change) — tells the
  * agent its pilot watches a Browser pane and WHEN to call `show_in_browser`:

package/dist/commands/bridge.js

@@ -65,6 +65,7 @@ const sessionManager_1 = require("../bridge/sessionManager");
 const server_1 = require("../bridge/server");
 const relayClient_1 = require("../bridge/relayClient");
 const gitTokenBroker_1 = require("../bridge/gitTokenBroker");
+const linkedRepos_1 = require("../bridge/linkedRepos");
 const browserDriver_1 = require("../bridge/browserDriver");
 const browserHost_1 = require("../bridge/browserHost");
 const browserIdle_1 = require("../bridge/browserIdle");
@@ -620,8 +621,11 @@ exports.bridgeCommand = new commander_1.Command('bridge')
          * (that PTY-scoped invariant is exactly why the raw Fly exec could never
          * have cloned for itself — see issues/msf-34).
          */
-        const ensureWorkspaceCheckout = (args) => (0, repoCheckout_1.ensureWorkspaceRepo)({ workspaceId: args.workspaceId, repoUrl: args.repoUrl }, {
-            reposBaseDir,
+        // lr-03: the same checkout, in any base dir — /data/repos for a
+        // workspace's primary, /data/linked/<ws> for its linked repos. Free space
+        // and quota are still measured on /data/repos (same volume, always there).
+        const checkoutIn = (baseDir) => (args) => (0, repoCheckout_1.ensureWorkspaceRepo)({ workspaceId: args.workspaceId, repoUrl: args.repoUrl }, {
+            reposBaseDir: baseDir,
             exists: (p) => fs.existsSync(p),
             mkdir: (p) => fs.mkdirSync(p, { recursive: true }),
             // msf-34: the clone gets the workspace credential IN ITS ENV.
@@ -665,6 +669,7 @@ exports.bridgeCommand = new commander_1.Command('bridge')
             // does not).
             rm: rmCheckoutDir,
         });
+        const ensureWorkspaceCheckout = checkoutIn(reposBaseDir);
         // tp-06 (ADR-0014) — the Team preview forwarder. Started here, in the
         // container branch only: the local bridge never opens it. It is also a
         // no-op without a `fly-local-6pn` entry, and stays off until
@@ -688,15 +693,34 @@ exports.bridgeCommand = new commander_1.Command('bridge')
         // asks the relay. Hosted lane only — a laptop pushes with its own git.
         const gitTokenSocket = process.env.WENRWA_GIT_TOKEN_SOCKET || path.join(os.homedir(), '.wenrwa', 'git-token.sock');
         let relayClient = null;
-        const gitTokenBroker = new gitTokenBroker_1.GitTokenBroker((workspaceId) => relayClient
-            ? relayClient.requestGitToken(workspaceId)
+        const gitTokenBroker = new gitTokenBroker_1.GitTokenBroker((workspaceId, repo) => relayClient
+            ? relayClient.requestGitToken(workspaceId, repo)
             : Promise.reject(Object.assign(new Error('The bridge is starting'), { code: 'OFFLINE' })));
         (0, gitTokenBroker_1.startGitTokenSocket)({ path: gitTokenSocket, broker: gitTokenBroker }).catch((err) => console.error(`[bridge] git token socket failed to start — agents fall back to the token from open: ${err instanceof Error ? err.message : String(err)}`));
+        // lr-03 — a workspace's linked repos, cloned beside (never inside)
+        // /data/repos, each with its own credential from the broker.
+        const linkedBaseDir = process.env.WENRWA_LINKED_DIR || path.join(path.dirname(reposBaseDir), 'linked');
+        // The latest list each workspace's open frame carried — so a file-selection
+        // write (which has no frame of its own) keeps the agent's linked-repo lines.
+        const linkedReposByWorkspace = new Map();
+        const linkedPointerFor = (workspaceId) => (linkedReposByWorkspace.get(workspaceId) ?? []).map((r) => ({
+            alias: r.alias,
+            fullName: r.fullName,
+            writable: r.writable === true,
+            path: (0, linkedRepos_1.linkedRepoPath)(linkedBaseDir, workspaceId, r.alias),
+        }));
+        const ensureLinked = (args) => (0, linkedRepos_1.ensureLinkedRepos)(args, {
+            linkedBaseDir,
+            credentialFor: (workspaceId, fullName) => gitTokenBroker.get(workspaceId, fullName),
+            ensure: ({ baseDir, name, repoUrl, gitCredential }) => checkoutIn(baseDir)({ workspaceId: name, repoUrl, gitCredential }),
+            log: (line) => console.error(line),
+        });
         relayClient = (0, relayClient_1.startRelayClient)({
             relayUrl: relayMode.relayUrl,
             relayToken: relayMode.relayToken,
             sessions,
             gitTokenSocket,
+            ensureLinkedRepos: ensureLinked,
             // Rock-solid sleep/wake: this is the HOSTED container bridge, the only
             // process that knows which agent PTYs are actually running. The backend
             // reconciles claude_code_agents.lifecycle_state against this report —
@@ -896,7 +920,9 @@ exports.bridgeCommand = new commander_1.Command('bridge')
               only sends one when the pilot has files selected, so most workspaces
               never got the pointers at all.
             */
-            refreshContextPointers: async ({ workspaceId, engine }) => {
+            refreshContextPointers: async ({ workspaceId, engine, linkedRepos }) => {
+                if (linkedRepos)
+                    linkedReposByWorkspace.set(workspaceId, linkedRepos);
                 const memoryAvailable = Boolean(process.env.WENRWA_CONNECT_TOKEN);
                 // 2026-10-02 — the same reply says whether this is a MATCH workspace.
                 const briefInfo = memoryAvailable ? await (0, memoryBrief_1.fetchWorkspaceBrief)(workspaceId) : null;
@@ -905,6 +931,7 @@ exports.bridgeCommand = new commander_1.Command('bridge')
                     workspaceId,
                     pointersOnly: true,
                     engine,
+                    linkedRepos: linkedPointerFor(workspaceId),
                     workGraphAvailable: Boolean(process.env.WENRWA_CONNECT_TOKEN),
                     memoryAvailable,
                     memoryBrief,
@@ -934,6 +961,7 @@ exports.bridgeCommand = new commander_1.Command('bridge')
                     workspaceId,
                     content,
                     engine,
+                    linkedRepos: linkedPointerFor(workspaceId),
                     // wgcp-01 — same gate as checkStorageQuota above: WENRWA_CONNECT_TOKEN
                     // is only injected at container boot when this workspace actually has
                     // MCP world-wiring (hosted-container.service.ts's machineEnv). Absent

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wenrwa/marketplace-cli",
-  "version": "0.8.13",
+  "version": "0.8.15",
   "description": "CLI tool for the Wenrwa Agent Marketplace — monitor bounties, agents, workspaces, and treasury from your terminal",
   "author": "Wenrwa <dev@wenrwa.com>",
   "license": "MIT",