@wenrwa/marketplace-cli 0.8.4 → 0.8.6

package/dist/__tests__/bridge-changes-report.test.js

@@ -58,6 +58,31 @@ function expectEveryCallUsedCwd(calls) {
 }
 describe('buildChangesReport', () => {
     // 1. tracer: feature branch, one modified file → merge-base baseline
+    it('secret masking (2026-10-17): a secret in a diff line is masked in the patch; the hash is of the real text', async () => {
+        const value = ['ef1bd6d5', '7de1', '4da2', 'b722', '4414d9461a4e'].join('-');
+        const patch = [
+            'diff --git a/.env b/.env',
+            '--- a/.env',
+            '+++ b/.env',
+            '@@ -0,0 +1 @@',
+            `+RAILWAY_API_TOKEN=${value}`,
+            '',
+        ].join('\n');
+        const { run } = makeRun([
+            ...baselineRulesFeatureBranch('base111'),
+            { match: isStatusPorcelain, result: ok(' M .env\n') },
+            { match: isNameStatus, result: ok('M\t.env\n') },
+            { match: isNumstat, result: ok('1\t0\t.env\n') },
+            { match: isFilePatch, result: ok(patch) },
+        ]);
+        const res = await (0, changesReport_1.buildChangesReport)(CWD, { run });
+        expect(res.ok).toBe(true);
+        if (!res.ok)
+            return;
+        const f = res.report.files[0];
+        expect(f.patch).toBe(patch.replace(value, '*'.repeat(value.length)));
+        expect(f.contentHash).toBe((0, crypto_1.createHash)('sha256').update(patch, 'utf8').digest('hex'));
+    });
     it('tracer: feature branch with one modified file yields a merge-base baseline and an M entry', async () => {
         const patch = [
             'diff --git a/src/foo.ts b/src/foo.ts',

package/dist/__tests__/bridge-changes-reporter.test.js

@@ -1,4 +1,37 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 /**
  * tchp-02 — per-session working-tree change detector (`changes` frame).
@@ -703,4 +736,69 @@ describe('execGit — opts.env (tchp-21)', () => {
         expect(res.code).toBe(0);
         expect(res.stdout).toBe('true');
     });
+    // Not-a-repo model (live report 2026-10-11): a plain folder used to burn
+    // three "failures", get disabled, and leave the panel on "Waiting for
+    // changes…" forever.
+    describe('a folder that is not a git repo', () => {
+        const notGitRun = () => jest.fn().mockImplementation(async (_cmd, args) => ({ stdout: '', code: 128, args }));
+        it('emits ONE changes-untracked frame and keeps polling (never disabled)', async () => {
+            const run = notGitRun();
+            const build = jest.fn();
+            const { reporter, sent } = makeReporter({ run, buildChangesReport: build, now: () => 7 });
+            const sessions = [{ sessionId: 's1', workspaceId: 'w1', cwd: '/plain' }];
+            for (let i = 0; i < 5; i++)
+                await reporter.tick(sessions);
+            expect(build).not.toHaveBeenCalled();
+            expect(sent).toEqual([
+                { t: 'changes-untracked', reason: 'not-git', workspaceId: 'w1', agentId: 's1', sessionId: 's1', ts: 7 },
+            ]);
+            // still probing every tick — a later `git init` must be noticed
+            const statusCalls = run.mock.calls.filter((c) => c[1].includes('status'));
+            expect(statusCalls).toHaveLength(5);
+        });
+        it('replays the untracked notice to a fresh connection', async () => {
+            const { reporter, sent } = makeReporter({ run: notGitRun() });
+            const sessions = [{ sessionId: 's1', workspaceId: 'w1', cwd: '/plain' }];
+            await reporter.tick(sessions);
+            reporter.requestReplay();
+            await reporter.tick(sessions);
+            expect(sent).toHaveLength(2);
+            expect(sent[1]).toBe(sent[0]);
+        });
+        it('a later git init switches to a real report immediately', async () => {
+            let isRepo = false;
+            const run = jest.fn().mockImplementation(async () => (isRepo ? statusOk('?? a.R\n') : { stdout: '', code: 128 }));
+            const build = jest.fn().mockResolvedValue(fakeReport('sha-1'));
+            const { reporter, sent } = makeReporter({ run, buildChangesReport: build });
+            const sessions = [{ sessionId: 's1', workspaceId: 'w1', cwd: '/plain' }];
+            await reporter.tick(sessions);
+            isRepo = true;
+            await reporter.tick(sessions);
+            expect(sent.map((f) => f.t)).toEqual(['changes-untracked', 'changes']);
+        });
+        it('a non-128 git failure is still an ordinary failure (no untracked frame)', async () => {
+            const run = jest.fn().mockResolvedValue({ stdout: '', code: 1 });
+            const { reporter, sent } = makeReporter({ run });
+            const sessions = [{ sessionId: 's1', workspaceId: 'w1', cwd: '/x' }];
+            for (let i = 0; i < 4; i++)
+                await reporter.tick(sessions);
+            expect(sent).toEqual([]);
+            expect(run).toHaveBeenCalledTimes(3); // 3 strikes then disabled
+        });
+        it('real git: a temp plain folder is reported as not-git', async () => {
+            const fs = await Promise.resolve().then(() => __importStar(require('fs')));
+            const os = await Promise.resolve().then(() => __importStar(require('os')));
+            const path = await Promise.resolve().then(() => __importStar(require('path')));
+            const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'plain-'));
+            try {
+                const { reporter, sent } = makeReporter({ run: changesReporter_1.execGit });
+                await reporter.tick([{ sessionId: 's1', workspaceId: 'w1', cwd: dir }]);
+                expect(sent).toHaveLength(1);
+                expect(sent[0]).toMatchObject({ t: 'changes-untracked', reason: 'not-git' });
+            }
+            finally {
+                fs.rmSync(dir, { recursive: true, force: true });
+            }
+        });
+    });
 });

package/dist/__tests__/bridge-read-transcript-frame.test.js

@@ -95,6 +95,28 @@ describe('relay client — read-transcript frame (wte-10)', () => {
         handle.close();
         await closeRelay(relay.wss);
     });
+    it('secret masking (2026-10-17): a secret in the transcript never leaves the box', async () => {
+        const value = ['ef1bd6d5', '7de1', '4da2', 'b722', '4414d9461a4e'].join('-');
+        const relay = await startFakeRelay();
+        const sessions = new sessionManager_1.SessionManager(makeFactory());
+        const content = `{"type":"tool_use","input":{"command":"RAILWAY_API_TOKEN=${value} $R up --ci"}}\n`;
+        const handle = (0, relayClient_1.startRelayClient)({
+            relayUrl: `ws://127.0.0.1:${relay.port}`,
+            relayToken: 'tok',
+            sessions,
+            readTranscript: () => ({ ok: true, content }),
+        });
+        const ws = await relay.nextConnection();
+        const q = frameQueue(ws);
+        await q.next(); // auth
+        ws.send(JSON.stringify({ t: 'read-transcript', requestId: 'req-9', workspaceId: 'ws-7', agentId: 'agent-A' }));
+        const reply = await q.next();
+        expect(reply.ok).toBe(true);
+        expect(reply.content).toBe(content.replace(value, '*'.repeat(value.length)));
+        expect(() => JSON.parse(reply.content)).not.toThrow();
+        handle.close();
+        await closeRelay(relay.wss);
+    });
     it('replies transcript-content with a typed reason when the reader refuses', async () => {
         const relay = await startFakeRelay();
         const sessions = new sessionManager_1.SessionManager(makeFactory());

package/dist/__tests__/bridge-save-env.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/bridge-save-env.test.js

@@ -0,0 +1,343 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Paste a key → saved to .env (2026-10-17). The `save-env` frame writes
+ * `<session cwd>/.env` on both lanes (local loopback server + relay client
+ * share one handler), and every PTY spawn loads that file back into env
+ * below the session's own vars. Runs against REAL temp folders and real git.
+ */
+const ws_1 = __importStar(require("ws"));
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
+const server_1 = require("../bridge/server");
+const relayClient_1 = require("../bridge/relayClient");
+const sessionManager_1 = require("../bridge/sessionManager");
+const envSaver_1 = require("../bridge/envSaver");
+const repoEnv_1 = require("../bridge/repoEnv");
+const workGraphPointer_1 = require("../bridge/workGraphPointer");
+const contextWriter_1 = require("../bridge/contextWriter");
+const localContextWriter_1 = require("../bridge/localContextWriter");
+const KEY = 'sk-ant-api03-' + 'A'.repeat(40);
+const KEY2 = 'npm_' + 'b'.repeat(36);
+class FakePty {
+    written = [];
+    write(d) { this.written.push(d); }
+    resize() { }
+    kill() { }
+    onData() { }
+    onExit() { }
+}
+function frameQueue(ws, want) {
+    const frames = [];
+    const waiters = [];
+    ws.on('message', (raw) => {
+        const f = JSON.parse(String(raw));
+        if (f.t !== want)
+            return;
+        const w = waiters.shift();
+        if (w)
+            w(f);
+        else
+            frames.push(f);
+    });
+    return { next: () => (frames.length ? Promise.resolve(frames.shift()) : new Promise((r) => waiters.push(r))) };
+}
+const git = (cwd, ...args) => (0, child_process_1.execFileSync)('git', args, { cwd, stdio: 'pipe' }).toString();
+let tmp;
+beforeEach(() => { tmp = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'save-env-'))); });
+afterEach(() => { fs.rmSync(tmp, { recursive: true, force: true }); });
+const initRepo = (dir) => {
+    git(dir, 'init', '-q');
+    git(dir, 'config', 'user.email', 't@t');
+    git(dir, 'config', 'user.name', 't');
+};
+describe('validateEnvEntries', () => {
+    it('accepts a good entry and dedupes by name (last wins)', () => {
+        expect((0, envSaver_1.validateEnvEntries)([{ name: 'A', value: '1' }, { name: 'A', value: '2' }]))
+            .toEqual({ ok: true, entries: [{ name: 'A', value: '2' }] });
+    });
+    it.each([
+        [[], 'Nothing to save'],
+        [[{ name: 'lower', value: 'x' }], 'Invalid name'],
+        [[{ name: '1A', value: 'x' }], 'Invalid name'],
+        [[{ name: 'A'.repeat(65), value: 'x' }], 'Invalid name'],
+        [[{ name: 'A', value: '' }], 'A: empty value'],
+        [[{ name: 'A', value: 'x\ny' }], 'A: value has a line break'],
+        [[{ name: 'A', value: 'x\0y' }], 'A: value has a line break'],
+        [[{ name: 'A', value: 'x'.repeat(4097) }], 'A: value too long'],
+        [[{ name: 'WENRWA_CONNECT_TOKEN', value: 'x' }], 'WENRWA_CONNECT_TOKEN is reserved'],
+        [[{ name: 'HIVEOP_CONTEXT_FILE', value: 'x' }], 'HIVEOP_CONTEXT_FILE is reserved'],
+    ])('refuses %j', (entries, error) => {
+        expect((0, envSaver_1.validateEnvEntries)(entries)).toEqual({ ok: false, error });
+    });
+    it('saves ANTHROPIC_API_KEY (it is only kept out of the spawn env)', () => {
+        expect((0, envSaver_1.validateEnvEntries)([{ name: 'ANTHROPIC_API_KEY', value: KEY }])).toEqual({ ok: true, entries: [{ name: 'ANTHROPIC_API_KEY', value: KEY }] });
+    });
+    it('never quotes the value in an error', () => {
+        const r = (0, envSaver_1.validateEnvEntries)([{ name: 'A', value: `${KEY}\n` }]);
+        expect(r.ok).toBe(false);
+        expect(JSON.stringify(r)).not.toContain(KEY);
+    });
+});
+describe('dotenv round trip', () => {
+    it.each([KEY, 'has space', "it's", 'both \' and "', 'back\\slash"q', ' padded ', 'a#b', 'x #y'])('formats %j so it parses back exactly', (v) => {
+        expect((0, repoEnv_1.parseDotenv)(`K=${(0, envSaver_1.formatDotenvValue)(v)}\n`).K).toBe(v);
+    });
+    it('replaces an existing line in place, drops duplicates, keeps everything else', () => {
+        const before = '# keys\nFOO=old\nBAR=keep\nexport FOO=older\n';
+        expect((0, envSaver_1.upsertDotenv)(before, [{ name: 'FOO', value: 'new' }, { name: 'NEW', value: 'n' }]))
+            .toBe('# keys\nFOO=new\nBAR=keep\nNEW=n\n');
+    });
+    it('appends to a file without a trailing newline', () => {
+        expect((0, envSaver_1.upsertDotenv)('A=1', [{ name: 'B', value: '2' }])).toBe('A=1\nB=2\n');
+    });
+    it('parses export, quotes and comments without expansion', () => {
+        expect((0, repoEnv_1.parseDotenv)('export A="x\\ny"\nB=\'$HOME\'\nC=${A} # note\n#D=1\nbad line\n'))
+            .toEqual({ A: 'x\ny', B: '$HOME', C: '${A}' });
+    });
+});
+describe('saveEnvEntries — real folder, real git', () => {
+    it('creates .env (0600) and adds it to .gitignore', async () => {
+        initRepo(tmp);
+        const r = await (0, envSaver_1.saveEnvEntries)(tmp, [{ name: 'ANTHROPIC_KEY_X', value: KEY }]);
+        expect(r).toEqual({ ok: true, names: ['ANTHROPIC_KEY_X'], gitignoreAdded: true });
+        expect(fs.readFileSync(path.join(tmp, '.env'), 'utf8')).toBe(`ANTHROPIC_KEY_X=${KEY}\n`);
+        expect(fs.statSync(path.join(tmp, '.env')).mode & 0o777).toBe(0o600);
+        expect(fs.readFileSync(path.join(tmp, '.gitignore'), 'utf8')).toBe('.env\n');
+        expect(git(tmp, 'status', '--porcelain')).not.toContain('.env\n');
+    });
+    it('replaces an existing NAME, never duplicates, and leaves .gitignore alone when already ignored', async () => {
+        initRepo(tmp);
+        fs.writeFileSync(path.join(tmp, '.gitignore'), 'node_modules\n*.env\n.env\n');
+        fs.writeFileSync(path.join(tmp, '.env'), 'NPM_TOKEN=old\nOTHER=1\n', { mode: 0o644 });
+        const r = await (0, envSaver_1.saveEnvEntries)(tmp, [{ name: 'NPM_TOKEN', value: KEY2 }]);
+        expect(r).toMatchObject({ ok: true, gitignoreAdded: false });
+        expect(fs.readFileSync(path.join(tmp, '.env'), 'utf8')).toBe(`NPM_TOKEN=${KEY2}\nOTHER=1\n`);
+        expect(fs.statSync(path.join(tmp, '.env')).mode & 0o777).toBe(0o600);
+        expect(fs.readFileSync(path.join(tmp, '.gitignore'), 'utf8')).toBe('node_modules\n*.env\n.env\n');
+    });
+    it('appends .env to a .gitignore with no trailing newline', async () => {
+        initRepo(tmp);
+        fs.writeFileSync(path.join(tmp, '.gitignore'), 'dist');
+        await (0, envSaver_1.saveEnvEntries)(tmp, [{ name: 'A', value: 'b' }]);
+        expect(fs.readFileSync(path.join(tmp, '.gitignore'), 'utf8')).toBe('dist\n.env\n');
+    });
+    it('refuses when git TRACKS .env, and writes nothing', async () => {
+        initRepo(tmp);
+        fs.writeFileSync(path.join(tmp, '.env'), 'PUBLIC=1\n');
+        git(tmp, 'add', '.env');
+        git(tmp, 'commit', '-qm', 'x');
+        const r = await (0, envSaver_1.saveEnvEntries)(tmp, [{ name: 'SECRET', value: KEY }]);
+        expect(r).toEqual({ ok: false, error: '.env is tracked by git' });
+        expect(fs.readFileSync(path.join(tmp, '.env'), 'utf8')).toBe('PUBLIC=1\n');
+        expect(fs.existsSync(path.join(tmp, '.gitignore'))).toBe(false);
+    });
+    it('refuses a symlinked .env (no write outside the folder)', async () => {
+        initRepo(tmp);
+        const outside = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'outside-')));
+        try {
+            fs.writeFileSync(path.join(outside, 'target'), 'X=1\n');
+            fs.symlinkSync(path.join(outside, 'target'), path.join(tmp, '.env'));
+            const r = await (0, envSaver_1.saveEnvEntries)(tmp, [{ name: 'SECRET', value: KEY }]);
+            expect(r).toEqual({ ok: false, error: '.env is not a plain file' });
+            expect(fs.readFileSync(path.join(outside, 'target'), 'utf8')).toBe('X=1\n');
+        }
+        finally {
+            fs.rmSync(outside, { recursive: true, force: true });
+        }
+    });
+    it('works in a folder that is not a git repo (still ignores .env for later)', async () => {
+        const r = await (0, envSaver_1.saveEnvEntries)(tmp, [{ name: 'A', value: 'b' }]);
+        expect(r).toMatchObject({ ok: true, gitignoreAdded: true });
+        expect(fs.readFileSync(path.join(tmp, '.env'), 'utf8')).toBe('A=b\n');
+    });
+    it('refuses a missing folder', async () => {
+        expect(await (0, envSaver_1.saveEnvEntries)(path.join(tmp, 'nope'), [{ name: 'A', value: 'b' }]))
+            .toEqual({ ok: false, error: 'Project folder not found' });
+    });
+});
+describe('handleSaveEnvFrame — the session decides the folder', () => {
+    const sessionsAt = (cwd) => ({ list: () => ['s1'], cwdOf: () => cwd });
+    it('writes into the session cwd; a frame-supplied path is ignored', async () => {
+        const reply = await (0, envSaver_1.handleSaveEnvFrame)({ rid: 'r1', sessionId: 's1', entries: [{ name: 'A', value: KEY }], path: '/etc', cwd: '/etc' }, sessionsAt(tmp));
+        expect(reply).toMatchObject({ t: 'save-env-result', rid: 'r1', sessionId: 's1', ok: true, names: ['A'] });
+        expect(fs.readFileSync(path.join(tmp, '.env'), 'utf8')).toBe(`A=${KEY}\n`);
+        expect(JSON.stringify(reply)).not.toContain(KEY);
+    });
+    it('refuses an unknown session', async () => {
+        expect(await (0, envSaver_1.handleSaveEnvFrame)({ rid: 'r', sessionId: 'other', entries: [{ name: 'A', value: 'b' }] }, sessionsAt(tmp)))
+            .toMatchObject({ ok: false, error: 'Terminal session not found' });
+    });
+    it('refuses a session with no project folder (never falls back to $HOME)', async () => {
+        expect(await (0, envSaver_1.handleSaveEnvFrame)({ rid: 'r', sessionId: 's1', entries: [{ name: 'A', value: 'b' }] }, sessionsAt(undefined)))
+            .toMatchObject({ ok: false, error: 'No project folder' });
+    });
+});
+describe('spawn env — repo .env is loaded below HiveOp vars', () => {
+    it('session env beats .env beats inherited; reserved names never come from .env', () => {
+        fs.writeFileSync(path.join(tmp, '.env'), [
+            'OPENAI_API_KEY=from-file',
+            'SHARED=from-file',
+            'WENRWA_WORKSPACE_ID=evil',
+            'WENRWA_CONNECT_TOKEN=evil',
+            'ANTHROPIC_API_KEY=would-switch-billing',
+            'PATH=/evil',
+            'NODE_OPTIONS=--require /evil.js',
+        ].join('\n'));
+        const env = (0, repoEnv_1.mergeSpawnEnv)({ PATH: '/usr/bin', SHARED: 'inherited', WENRWA_CONNECT_TOKEN: 'inherited-token' }, (0, repoEnv_1.loadRepoEnv)(tmp), { WENRWA_WORKSPACE_ID: 'ws-real' });
+        expect(env.OPENAI_API_KEY).toBe('from-file');
+        expect(env.SHARED).toBe('from-file');
+        expect(env.WENRWA_WORKSPACE_ID).toBe('ws-real');
+        expect(env.WENRWA_CONNECT_TOKEN).toBe('inherited-token');
+        expect(env.ANTHROPIC_API_KEY).toBeUndefined();
+        expect(env.PATH).toBe('/usr/bin');
+        expect(env.NODE_OPTIONS).toBeUndefined();
+    });
+    it('even a reserved name passed straight to mergeSpawnEnv is dropped', () => {
+        expect((0, repoEnv_1.mergeSpawnEnv)({}, { WENRWA_AGENT_ID: 'x', OK: '1' }, {})).toEqual({ OK: '1' });
+    });
+    it('no cwd, no file, or a symlinked file → nothing loaded', () => {
+        expect((0, repoEnv_1.loadRepoEnv)(undefined)).toEqual({});
+        expect((0, repoEnv_1.loadRepoEnv)(tmp)).toEqual({});
+        fs.writeFileSync(path.join(tmp, 'real'), 'A=1\n');
+        fs.symlinkSync(path.join(tmp, 'real'), path.join(tmp, '.env'));
+        expect((0, repoEnv_1.loadRepoEnv)(tmp)).toEqual({});
+    });
+    it('a saved key is what the next spawn sees', async () => {
+        await (0, envSaver_1.saveEnvEntries)(tmp, [{ name: 'STRIPE_SECRET_KEY', value: 'sk_live_' + 'z'.repeat(24) }]);
+        expect((0, repoEnv_1.mergeSpawnEnv)({}, (0, repoEnv_1.loadRepoEnv)(tmp), {}).STRIPE_SECRET_KEY).toBe('sk_live_' + 'z'.repeat(24));
+    });
+    it('reserved-name rules', () => {
+        for (const n of ['WENRWA_X', 'HIVEOP_CONTEXT_FILE', 'CLAUDE_CONFIG_DIR', 'ANTHROPIC_BASE_URL', 'GIT_SSH_COMMAND', 'LD_PRELOAD', 'PATH', 'HT_AUTONOMOUS']) {
+            expect((0, repoEnv_1.isReservedEnvName)(n)).toBe(true);
+        }
+        for (const n of ['GITHUB_TOKEN', 'NPM_TOKEN', 'OPENAI_API_KEY', 'STRIPE_SECRET_KEY', 'SECRET']) {
+            expect((0, repoEnv_1.isReservedEnvName)(n)).toBe(false);
+        }
+    });
+});
+describe('local bridge server — save-env frame', () => {
+    let handle;
+    let sessions;
+    let ptys;
+    let logged;
+    let spies;
+    beforeEach(async () => {
+        ptys = [];
+        sessions = new sessionManager_1.SessionManager({ spawn: () => { const p = new FakePty(); ptys.push(p); return p; } });
+        handle = await (0, server_1.startBridgeServer)({ sessionToken: 'tok', allowedOrigin: 'https://app.hiveop.io', sessions });
+        logged = [];
+        spies = ['log', 'error', 'warn', 'info', 'debug'].map((m) => jest.spyOn(console, m).mockImplementation((...a) => { logged.push(a.map(String).join(' ')); }));
+    });
+    afterEach(async () => { spies.forEach((s) => s.mockRestore()); await handle.close(); });
+    it('writes the session .env, replies with names only, nothing reaches the PTY or the log', async () => {
+        initRepo(tmp);
+        const sessionId = sessions.open({ cols: 80, rows: 24, cwd: tmp, id: 'agent-1' });
+        const ws = new ws_1.default(`ws://127.0.0.1:${handle.port}`, { headers: { origin: 'https://app.hiveop.io' } });
+        await new Promise((r) => ws.on('open', r));
+        const q = frameQueue(ws, 'save-env-result');
+        ws.send(JSON.stringify({ v: 1, token: 'tok' }));
+        ws.send(JSON.stringify({ t: 'save-env', rid: 'r1', sessionId, entries: [{ name: 'OPENAI_API_KEY', value: KEY }] }));
+        const reply = await q.next();
+        expect(reply).toEqual({ t: 'save-env-result', rid: 'r1', sessionId, ok: true, names: ['OPENAI_API_KEY'], gitignoreAdded: true });
+        expect(fs.readFileSync(path.join(tmp, '.env'), 'utf8')).toBe(`OPENAI_API_KEY=${KEY}\n`);
+        expect(ptys[0].written).toEqual([]);
+        expect(logged.join('\n')).not.toContain(KEY);
+        ws.close();
+    });
+    it('advertises the save-env capability in /discovery', async () => {
+        const res = await fetch(`http://127.0.0.1:${handle.port}/discovery`, { headers: { origin: 'https://app.hiveop.io' } });
+        expect((await res.json()).capabilities).toContain('save-env');
+    });
+});
+describe('relay client (hosted container) — save-env frame', () => {
+    it('is session-addressed (relay-owned check applies)', () => {
+        expect(relayClient_1.SESSION_ADDRESSED_FRAMES.has('save-env')).toBe(true);
+    });
+    it('writes the relay session .env and echoes rid + sessionId for demux', async () => {
+        const wss = new ws_1.WebSocketServer({ port: 0, host: '127.0.0.1' });
+        await new Promise((r) => wss.on('listening', r));
+        const port = wss.address().port;
+        const conn = new Promise((r) => wss.on('connection', r));
+        const sessions = new sessionManager_1.SessionManager({ spawn: () => new FakePty() });
+        sessions.open({ cols: 80, rows: 24, cwd: tmp, id: 'agent-H' });
+        const client = (0, relayClient_1.startRelayClient)({ relayUrl: `ws://127.0.0.1:${port}`, relayToken: 'tok', sessions });
+        const ws = await conn;
+        const q = frameQueue(ws, 'save-env-result');
+        ws.send(JSON.stringify({ t: 'save-env', rid: 'h1', sessionId: 'agent-H', entries: [{ name: 'GITHUB_TOKEN', value: 'ghp_' + 'x'.repeat(36) }] }));
+        expect(await q.next()).toMatchObject({ t: 'save-env-result', rid: 'h1', sessionId: 'agent-H', ok: true, names: ['GITHUB_TOKEN'] });
+        expect(fs.readFileSync(path.join(tmp, '.env'), 'utf8')).toBe(`GITHUB_TOKEN=ghp_${'x'.repeat(36)}\n`);
+        ws.send(JSON.stringify({ t: 'save-env', rid: 'h2', sessionId: 'agent-H', entries: [{ name: 'bad name', value: 'x' }] }));
+        expect(await q.next()).toMatchObject({ rid: 'h2', ok: false, error: 'Invalid name' });
+        client.close();
+        for (const c of wss.clients)
+            c.terminate();
+        await new Promise((r) => wss.close(r));
+    });
+});
+describe('agents are told where keys live (both lanes)', () => {
+    const LINE = 'Keys live in the repo .env; use them as env vars.';
+    it('hosted CLAUDE.md region carries the line once; absent without HiveOp tools', () => {
+        const files = new Map();
+        const deps = {
+            reposBaseDir: '/data/repos',
+            exists: (p) => files.has(p),
+            readFile: (p) => files.get(p) ?? '',
+            writeFile: (p, c) => { files.set(p, c); },
+            mkdirp: () => { },
+        };
+        (0, contextWriter_1.writeContext)({ workspaceId: 'ws-1', content: 'x', workGraphAvailable: true }, deps);
+        (0, contextWriter_1.writeContext)({ workspaceId: 'ws-1', pointersOnly: true, workGraphAvailable: true }, deps);
+        const out = files.get('/data/repos/ws-1/CLAUDE.md');
+        expect(workGraphPointer_1.KEYS_POINTER).toBe(`## Keys\n${LINE}`);
+        expect(out.split(LINE).length - 1).toBe(1);
+        files.clear();
+        (0, contextWriter_1.writeContext)({ workspaceId: 'ws-1', content: 'x' }, deps);
+        expect(files.get('/data/repos/ws-1/CLAUDE.md')).not.toContain(LINE);
+    });
+    it('local .hiveop/context.md carries the line', () => {
+        (0, localContextWriter_1.writeLocalContext)({ projectRoot: tmp, content: 'x', workGraphAvailable: true }, {
+            exists: (p) => fs.existsSync(p),
+            readFile: (p) => fs.readFileSync(p, 'utf-8'),
+            mkdirp: (d) => fs.mkdirSync(d, { recursive: true }),
+            writeFileAtomic: (p, c) => fs.writeFileSync(p, c, 'utf-8'),
+            remove: (p) => fs.rmSync(p, { force: true }),
+        });
+        expect(fs.readFileSync(path.join(tmp, localContextWriter_1.LOCAL_CONTEXT_RELATIVE_PATH), 'utf-8')).toContain(LINE);
+    });
+});

package/dist/__tests__/bridge-server-phantom-takeover.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/bridge-server-phantom-takeover.test.js

@@ -0,0 +1,84 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const ws_1 = __importDefault(require("ws"));
+const server_1 = require("../bridge/server");
+const sessionManager_1 = require("../bridge/sessionManager");
+/**
+ * Phantom "Session attached elsewhere" on the loopback lane (prod 2026-10-17).
+ * The bridge's last-attach-wins told every superseded attachment the same
+ * thing, whether the new attach was the same socket re-attaching, the same
+ * pane redialing, another pane in the same page, or another browser.
+ */
+class FakePty {
+    dataCb = null;
+    write() { }
+    resize() { }
+    kill() { }
+    onData(cb) { this.dataCb = cb; }
+    onExit() { }
+    emitData(d) { this.dataCb?.(d); }
+}
+const ORIGIN = 'https://app.hiveop.io';
+const TOKEN = 'session-token-123';
+const client = async (port) => {
+    const ws = new ws_1.default(`ws://127.0.0.1:${port}`, { headers: { origin: ORIGIN } });
+    const frames = [];
+    ws.on('message', (raw) => frames.push(JSON.parse(String(raw))));
+    await new Promise((r) => ws.on('open', r));
+    ws.send(JSON.stringify({ v: 1, token: TOKEN }));
+    return { ws, frames };
+};
+const settle = (ms = 40) => new Promise((r) => setTimeout(r, ms));
+const types = (frames) => frames.map((f) => f.t);
+describe('bridge — phantom takeover', () => {
+    let handle;
+    let sessionId;
+    let owner;
+    beforeEach(async () => {
+        const factory = { spawn: () => new FakePty() };
+        handle = await (0, server_1.startBridgeServer)({ sessionToken: TOKEN, allowedOrigin: ORIGIN, sessions: new sessionManager_1.SessionManager(factory) });
+        owner = await client(handle.port);
+        owner.ws.send(JSON.stringify({ t: 'open', cols: 80, rows: 24, client: { browser: 'b1', tab: 't1', mount: 'm1' } }));
+        await settle();
+        sessionId = owner.frames.find((f) => f.t === 'opened').sessionId;
+        owner.frames.length = 0;
+    });
+    afterEach(async () => {
+        owner.ws.close();
+        await handle.close();
+    });
+    it('a socket re-attaching its own session is not told it was taken over', async () => {
+        owner.ws.send(JSON.stringify({ t: 'attach', sessionId, cols: 80, rows: 24, client: { browser: 'b1', tab: 't1', mount: 'm1' } }));
+        await settle();
+        expect(types(owner.frames)).toEqual(['replay']);
+    });
+    it('the same pane redialing on a new socket leaves its ghost socket silent', async () => {
+        const again = await client(handle.port);
+        again.ws.send(JSON.stringify({ t: 'attach', sessionId, cols: 80, rows: 24, client: { browser: 'b1', tab: 't1', mount: 'm1' } }));
+        await settle();
+        expect(types(owner.frames)).not.toContain('takeover');
+        expect(types(again.frames)).toContain('replay');
+        again.ws.close();
+    });
+    it.each([
+        ['another pane in the same page', { browser: 'b1', tab: 't1', mount: 'm2' }, 'page'],
+        ['another tab', { browser: 'b1', tab: 't2', mount: 'm3' }, 'tab'],
+        ['another browser', { browser: 'b2', tab: 't3', mount: 'm4' }, 'device'],
+    ])('a real second viewer (%s) is named in the takeover', async (_label, who, where) => {
+        const other = await client(handle.port);
+        other.ws.send(JSON.stringify({ t: 'attach', sessionId, cols: 80, rows: 24, client: who }));
+        await settle();
+        expect(owner.frames.find((f) => f.t === 'takeover')).toEqual({ t: 'takeover', sessionId, by: where });
+        other.ws.close();
+    });
+    it('an old client that names nobody still gets the plain takeover', async () => {
+        const other = await client(handle.port);
+        other.ws.send(JSON.stringify({ t: 'attach', sessionId, cols: 80, rows: 24 }));
+        await settle();
+        expect(owner.frames.find((f) => f.t === 'takeover')).toEqual({ t: 'takeover', sessionId });
+        other.ws.close();
+    });
+});

package/dist/__tests__/bridge-server.test.js

@@ -489,13 +489,14 @@ describe('bridge WebSocket server', () => {
     });
     // ── lws-07 (ADR-0033 port): attach carries cols/rows; replay frames say snapshot:true ────
     describe('attach size + replay snapshot flag', () => {
-        // Re-attaching on the SAME connection to an already-attached session
-        // supersedes its own prior attachment (last-attach-wins), so a `takeover`
-        // frame precedes the `replay` on the same socket — pull both and match by
-        // type, same convention as the existing "second attach takes over" test.
+        // Re-attaching on the SAME connection supersedes its own prior
+        // attachment, but the bridge no longer tells a socket it was taken over
+        // by itself (phantom "attached elsewhere", 2026-10-17) — the replay is
+        // the next frame.
         const nextReplay = async (q) => {
-            const [a, b] = [await q.next(), await q.next()];
-            return [a, b].find((f) => f.t === 'replay');
+            const f = await q.next();
+            expect(f.t).toBe('replay');
+            return f;
         };
         it('attach with cols/rows resizes before replay (size differs from tracked geometry); replay marks snapshot:true', async () => {
             const { ws, q } = await openAndAuth(handle.port);
@@ -649,12 +650,9 @@ describe('bridge WebSocket server — attach deadline (twr-16)', () => {
             const opened = await q.next();
             // A size differing from the tracked geometry enters the resize→settle
             // branch the deadline stalls in. Re-attaching on the SAME connection
-            // supersedes its own prior attachment (last-attach-wins), so a
-            // `takeover` frame precedes the error on this socket — pull both and
-            // match by type (same convention as the size-handling tests above).
+            // sends no self-takeover, so the error is the next frame.
             ws.send(JSON.stringify({ t: 'attach', sessionId: opened.sessionId, cols: 120, rows: 40 }));
-            const [a, b] = [await q.next(), await q.next()];
-            const err = [a, b].find((f) => f.t === 'error');
+            const err = await q.next();
             expect(err).toMatchObject({ t: 'error', sessionId: opened.sessionId });
             expect(String(err.message)).toContain('stage=settle');
             ws.close();

package/dist/__tests__/secrets-egress.test.d.ts

@@ -0,0 +1 @@
+export {};