agent-relay 1.1.0 → 1.2.3

package/.trajectories/completed/2026-01/traj_prdza7a5cxp5.md

@@ -0,0 +1,32 @@
+# Trajectory: Fix notification filtering to use dynamic user
+
+> **Status:** ✅ Completed
+> **Task:** agent-relay-319
+> **Confidence:** 90%
+> **Started:** January 3, 2026 at 04:51 PM
+> **Completed:** January 3, 2026 at 04:55 PM
+
+---
+
+## Summary
+
+Fixed notification filtering to use dynamic current user. Created effectiveSenderName variable that uses senderName prop (authenticated user) with fallback to 'Dashboard' for local mode.
+
+**Approach:** Standard approach
+
+---
+
+## Key Decisions
+
+### Used effectiveSenderName variable for consistent user identity
+- **Chose:** Used effectiveSenderName variable for consistent user identity
+- **Reasoning:** Created a single source of truth for the current user name, used in both unread count filtering and optimistic messages. Falls back to 'Dashboard' when senderName prop is not provided (local mode).
+
+---
+
+## Chapters
+
+### 1. Work
+*Agent: default*
+
+- Used effectiveSenderName variable for consistent user identity: Used effectiveSenderName variable for consistent user identity

package/.trajectories/completed/2026-01/traj_qb3twvvywfwi.json

@@ -0,0 +1,77 @@
+{
+  "id": "traj_qb3twvvywfwi",
+  "version": 1,
+  "task": {
+    "title": "Test coverage for Vault and billing modules",
+    "source": {
+      "system": "plain",
+      "id": "agent-relay-442"
+    }
+  },
+  "status": "completed",
+  "startedAt": "2026-01-03T15:26:26.404Z",
+  "agents": [
+    {
+      "name": "Backend",
+      "role": "lead",
+      "joinedAt": "2026-01-03T15:26:26.405Z"
+    }
+  ],
+  "chapters": [
+    {
+      "id": "chap_o7p5erb2yqym",
+      "title": "Work",
+      "agentName": "default",
+      "startedAt": "2026-01-03T15:27:40.321Z",
+      "events": [
+        {
+          "ts": 1767454060322,
+          "type": "decision",
+          "content": "Pausing agent-relay-442 per PM request: Pausing agent-relay-442 per PM request",
+          "raw": {
+            "question": "Pausing agent-relay-442 per PM request",
+            "chosen": "Pausing agent-relay-442 per PM request",
+            "alternatives": [],
+            "reasoning": "Priority change: continuity message saving bug needs investigation first"
+          },
+          "significance": "high"
+        },
+        {
+          "ts": 1767454341255,
+          "type": "decision",
+          "content": "Awaiting approval before implementing continuity fix: Awaiting approval before implementing continuity fix",
+          "raw": {
+            "question": "Awaiting approval before implementing continuity fix",
+            "chosen": "Awaiting approval before implementing continuity fix",
+            "alternatives": [],
+            "reasoning": "Found root cause (placeholder text saved as real data), proposed fix ready, waiting for Dashboard approval per PM"
+          },
+          "significance": "high"
+        },
+        {
+          "ts": 1767454362407,
+          "type": "decision",
+          "content": "Implementing 3-part continuity fix: Implementing 3-part continuity fix",
+          "raw": {
+            "question": "Implementing 3-part continuity fix",
+            "chosen": "Implementing 3-part continuity fix",
+            "alternatives": [],
+            "reasoning": "Approved by PM/Dashboard: (1) save validation, (2) clean corrupt files, (3) load filtering"
+          },
+          "significance": "high"
+        }
+      ],
+      "endedAt": "2026-01-03T15:37:00.890Z"
+    }
+  ],
+  "commits": [],
+  "filesChanged": [],
+  "projectId": "/Users/khaliqgant/Projects/agent-workforce/relay",
+  "tags": [],
+  "completedAt": "2026-01-03T15:37:00.890Z",
+  "retrospective": {
+    "summary": "Wired up TrajectoryViewer with UX improvements: fullscreen slide-over, removed redundant FAB, blue button color",
+    "approach": "Standard approach",
+    "confidence": 0.85
+  }
+}

package/.trajectories/completed/2026-01/traj_qb3twvvywfwi.md

@@ -0,0 +1,42 @@
+# Trajectory: Test coverage for Vault and billing modules
+
+> **Status:** ✅ Completed
+> **Task:** agent-relay-442
+> **Confidence:** 85%
+> **Started:** January 3, 2026 at 04:26 PM
+> **Completed:** January 3, 2026 at 04:37 PM
+
+---
+
+## Summary
+
+Wired up TrajectoryViewer with UX improvements: fullscreen slide-over, removed redundant FAB, blue button color
+
+**Approach:** Standard approach
+
+---
+
+## Key Decisions
+
+### Pausing agent-relay-442 per PM request
+- **Chose:** Pausing agent-relay-442 per PM request
+- **Reasoning:** Priority change: continuity message saving bug needs investigation first
+
+### Awaiting approval before implementing continuity fix
+- **Chose:** Awaiting approval before implementing continuity fix
+- **Reasoning:** Found root cause (placeholder text saved as real data), proposed fix ready, waiting for Dashboard approval per PM
+
+### Implementing 3-part continuity fix
+- **Chose:** Implementing 3-part continuity fix
+- **Reasoning:** Approved by PM/Dashboard: (1) save validation, (2) clean corrupt files, (3) load filtering
+
+---
+
+## Chapters
+
+### 1. Work
+*Agent: default*
+
+- Pausing agent-relay-442 per PM request: Pausing agent-relay-442 per PM request
+- Awaiting approval before implementing continuity fix: Awaiting approval before implementing continuity fix
+- Implementing 3-part continuity fix: Implementing 3-part continuity fix

package/.trajectories/completed/2026-01/traj_qft54mi7nfor.json

@@ -0,0 +1,53 @@
+{
+  "id": "traj_qft54mi7nfor",
+  "version": 1,
+  "task": {
+    "title": "Remove any type casts from cloud server",
+    "source": {
+      "system": "plain",
+      "id": "agent-relay-439"
+    }
+  },
+  "status": "completed",
+  "startedAt": "2026-01-03T13:48:58.864Z",
+  "agents": [
+    {
+      "name": "Backend",
+      "role": "lead",
+      "joinedAt": "2026-01-03T13:48:58.865Z"
+    }
+  ],
+  "chapters": [
+    {
+      "id": "chap_2byzjek5ajbh",
+      "title": "Work",
+      "agentName": "default",
+      "startedAt": "2026-01-03T13:50:22.190Z",
+      "events": [
+        {
+          "ts": 1767448222191,
+          "type": "decision",
+          "content": "Used proper types instead of any casts: Used proper types instead of any casts",
+          "raw": {
+            "question": "Used proper types instead of any casts",
+            "chosen": "Used proper types instead of any casts",
+            "alternatives": [],
+            "reasoning": "RedisClientType for redis client, extended SessionData interface for userId"
+          },
+          "significance": "high"
+        }
+      ],
+      "endedAt": "2026-01-03T13:50:23.677Z"
+    }
+  ],
+  "commits": [],
+  "filesChanged": [],
+  "projectId": "/Users/khaliqgant/Projects/agent-workforce/relay",
+  "tags": [],
+  "completedAt": "2026-01-03T13:50:23.677Z",
+  "retrospective": {
+    "summary": "Removed 2 any casts from cloud/server.ts: RedisClientType for redis client, extended SessionData for userId",
+    "approach": "Standard approach",
+    "confidence": 0.95
+  }
+}

package/.trajectories/completed/2026-01/traj_qft54mi7nfor.md

@@ -0,0 +1,32 @@
+# Trajectory: Remove any type casts from cloud server
+
+> **Status:** ✅ Completed
+> **Task:** agent-relay-439
+> **Confidence:** 95%
+> **Started:** January 3, 2026 at 02:48 PM
+> **Completed:** January 3, 2026 at 02:50 PM
+
+---
+
+## Summary
+
+Removed 2 any casts from cloud/server.ts: RedisClientType for redis client, extended SessionData for userId
+
+**Approach:** Standard approach
+
+---
+
+## Key Decisions
+
+### Used proper types instead of any casts
+- **Chose:** Used proper types instead of any casts
+- **Reasoning:** RedisClientType for redis client, extended SessionData interface for userId
+
+---
+
+## Chapters
+
+### 1. Work
+*Agent: default*
+
+- Used proper types instead of any casts: Used proper types instead of any casts

package/.trajectories/completed/2026-01/traj_qx9uhf8whhxo.json

@@ -0,0 +1,83 @@
+{
+  "id": "traj_qx9uhf8whhxo",
+  "version": 1,
+  "task": {
+    "title": "Comprehensive codebase review and hardening",
+    "source": {
+      "system": "plain",
+      "id": "codebase-review"
+    }
+  },
+  "status": "completed",
+  "startedAt": "2026-01-02T22:19:15.313Z",
+  "agents": [],
+  "chapters": [
+    {
+      "id": "chap_nnr0ze4a3v49",
+      "title": "Work",
+      "agentName": "default",
+      "startedAt": "2026-01-02T22:23:45.011Z",
+      "events": [
+        {
+          "ts": 1767392625011,
+          "type": "decision",
+          "content": "Removed any cast in cross-machine routing: Removed any cast in cross-machine routing",
+          "raw": {
+            "question": "Removed any cast in cross-machine routing",
+            "chosen": "Removed any cast in cross-machine routing",
+            "alternatives": [],
+            "reasoning": "Typed envelope as SendEnvelope and passed Connection directly to router.route for safer cross-machine messages"
+          },
+          "significance": "high"
+        },
+        {
+          "ts": 1767392821786,
+          "type": "decision",
+          "content": "Found shell injection risk in tmux-wrapper.ts env var handling at line 443-444 - uses incomplete escaping: Found shell injection risk in tmux-wrapper.ts env var handling at line 443-444 - uses incomplete escaping",
+          "raw": {
+            "question": "Found shell injection risk in tmux-wrapper.ts env var handling at line 443-444 - uses incomplete escaping",
+            "chosen": "Found shell injection risk in tmux-wrapper.ts env var handling at line 443-444 - uses incomplete escaping",
+            "alternatives": [],
+            "reasoning": "The code only escapes double quotes but not dollar signs, backticks, or other shell metacharacters. The escapeForShell utility exists in bridge/utils.ts but isn't used here."
+          },
+          "significance": "high"
+        },
+        {
+          "ts": 1767392930903,
+          "type": "decision",
+          "content": "Completed comprehensive codebase review covering security, error handling, TypeScript, protocol, and React components: Completed comprehensive codebase review covering security, error handling, TypeScript, protocol, and React components",
+          "raw": {
+            "question": "Completed comprehensive codebase review covering security, error handling, TypeScript, protocol, and React components",
+            "chosen": "Completed comprehensive codebase review covering security, error handling, TypeScript, protocol, and React components",
+            "alternatives": [],
+            "reasoning": "Reviewed ~314K lines across 21 modules. Found 1 new security issue (shell escaping), confirmed good patterns for vault encryption, webhook verification, CSRF, rate limiting. TypeScript strict mode enabled. Test coverage at ~18% by file count."
+          },
+          "significance": "high"
+        },
+        {
+          "ts": 1767392946814,
+          "type": "decision",
+          "content": "Tightened daemon API CORS: Tightened daemon API CORS",
+          "raw": {
+            "question": "Tightened daemon API CORS",
+            "chosen": "Tightened daemon API CORS",
+            "alternatives": [],
+            "reasoning": "Use explicit allowlist (config/env), allow same-origin, block disallowed origins with 403 and Vary header"
+          },
+          "significance": "high"
+        }
+      ],
+      "endedAt": "2026-01-02T22:29:20.753Z"
+    }
+  ],
+  "commits": [],
+  "filesChanged": [],
+  "projectId": "/Users/khaliqgant/Projects/agent-workforce/relay",
+  "tags": [],
+  "completedAt": "2026-01-02T22:29:20.753Z",
+  "retrospective": {
+    "summary": "Comprehensive codebase review completed. Found 1 new security issue (agent-relay-435: shell escaping). Confirmed good security patterns for vault encryption, webhook verification, CSRF, rate limiting. Test coverage at 18%. TypeScript strict mode enabled. React dashboard follows best practices.",
+    "approach": "Standard approach",
+    "confidence": 0.85
+  }
+}

package/.trajectories/completed/2026-01/traj_qx9uhf8whhxo.md

@@ -0,0 +1,47 @@
+# Trajectory: Comprehensive codebase review and hardening
+
+> **Status:** ✅ Completed
+> **Task:** codebase-review
+> **Confidence:** 85%
+> **Started:** January 2, 2026 at 11:19 PM
+> **Completed:** January 2, 2026 at 11:29 PM
+
+---
+
+## Summary
+
+Comprehensive codebase review completed. Found 1 new security issue (agent-relay-435: shell escaping). Confirmed good security patterns for vault encryption, webhook verification, CSRF, rate limiting. Test coverage at 18%. TypeScript strict mode enabled. React dashboard follows best practices.
+
+**Approach:** Standard approach
+
+---
+
+## Key Decisions
+
+### Removed any cast in cross-machine routing
+- **Chose:** Removed any cast in cross-machine routing
+- **Reasoning:** Typed envelope as SendEnvelope and passed Connection directly to router.route for safer cross-machine messages
+
+### Found shell injection risk in tmux-wrapper.ts env var handling at line 443-444 - uses incomplete escaping
+- **Chose:** Found shell injection risk in tmux-wrapper.ts env var handling at line 443-444 - uses incomplete escaping
+- **Reasoning:** The code only escapes double quotes but not dollar signs, backticks, or other shell metacharacters. The escapeForShell utility exists in bridge/utils.ts but isn't used here.
+
+### Completed comprehensive codebase review covering security, error handling, TypeScript, protocol, and React components
+- **Chose:** Completed comprehensive codebase review covering security, error handling, TypeScript, protocol, and React components
+- **Reasoning:** Reviewed ~314K lines across 21 modules. Found 1 new security issue (shell escaping), confirmed good patterns for vault encryption, webhook verification, CSRF, rate limiting. TypeScript strict mode enabled. Test coverage at ~18% by file count.
+
+### Tightened daemon API CORS
+- **Chose:** Tightened daemon API CORS
+- **Reasoning:** Use explicit allowlist (config/env), allow same-origin, block disallowed origins with 403 and Vary header
+
+---
+
+## Chapters
+
+### 1. Work
+*Agent: default*
+
+- Removed any cast in cross-machine routing: Removed any cast in cross-machine routing
+- Found shell injection risk in tmux-wrapper.ts env var handling at line 443-444 - uses incomplete escaping: Found shell injection risk in tmux-wrapper.ts env var handling at line 443-444 - uses incomplete escaping
+- Completed comprehensive codebase review covering security, error handling, TypeScript, protocol, and React components: Completed comprehensive codebase review covering security, error handling, TypeScript, protocol, and React components
+- Tightened daemon API CORS: Tightened daemon API CORS

package/.trajectories/completed/2026-01/traj_rd9toccj18a0.json

@@ -0,0 +1,59 @@
+{
+  "id": "traj_rd9toccj18a0",
+  "version": 1,
+  "task": {
+    "title": "Replace console.log with structured logger in router.ts",
+    "source": {
+      "system": "plain",
+      "id": "agent-relay-415"
+    }
+  },
+  "status": "completed",
+  "startedAt": "2026-01-03T11:56:09.607Z",
+  "agents": [],
+  "chapters": [
+    {
+      "id": "chap_voaln61dr5zu",
+      "title": "Work",
+      "agentName": "default",
+      "startedAt": "2026-01-03T11:56:48.099Z",
+      "events": [
+        {
+          "ts": 1767441408100,
+          "type": "decision",
+          "content": "Using routerLog from utils/logger.ts - already has component prefix built-in: Using routerLog from utils/logger.ts - already has component prefix built-in",
+          "raw": {
+            "question": "Using routerLog from utils/logger.ts - already has component prefix built-in",
+            "chosen": "Using routerLog from utils/logger.ts - already has component prefix built-in",
+            "alternatives": [],
+            "reasoning": "Logger already exists with routerLog pre-created, provides structured JSON output and configurable levels"
+          },
+          "significance": "high"
+        },
+        {
+          "ts": 1767441676006,
+          "type": "decision",
+          "content": "Replaced 30 console calls with routerLog methods - info/debug/warn/error based on severity: Replaced 30 console calls with routerLog methods - info/debug/warn/error based on severity",
+          "raw": {
+            "question": "Replaced 30 console calls with routerLog methods - info/debug/warn/error based on severity",
+            "chosen": "Replaced 30 console calls with routerLog methods - info/debug/warn/error based on severity",
+            "alternatives": [],
+            "reasoning": "Used appropriate log levels: debug for routine operations, info for significant events, warn for recoverable issues, error for failures"
+          },
+          "significance": "high"
+        }
+      ],
+      "endedAt": "2026-01-03T12:01:25.798Z"
+    }
+  ],
+  "commits": [],
+  "filesChanged": [],
+  "projectId": "/Users/khaliqgant/Projects/agent-workforce/relay",
+  "tags": [],
+  "completedAt": "2026-01-03T12:01:25.798Z",
+  "retrospective": {
+    "summary": "Replaced all 30 console.log/error/warn calls in router.ts with structured routerLog from utils/logger.ts. Used appropriate log levels (debug/info/warn/error) based on message severity.",
+    "approach": "Standard approach",
+    "confidence": 0.95
+  }
+}

package/.trajectories/completed/2026-01/traj_rd9toccj18a0.md

@@ -0,0 +1,37 @@
+# Trajectory: Replace console.log with structured logger in router.ts
+
+> **Status:** ✅ Completed
+> **Task:** agent-relay-415
+> **Confidence:** 95%
+> **Started:** January 3, 2026 at 12:56 PM
+> **Completed:** January 3, 2026 at 01:01 PM
+
+---
+
+## Summary
+
+Replaced all 30 console.log/error/warn calls in router.ts with structured routerLog from utils/logger.ts. Used appropriate log levels (debug/info/warn/error) based on message severity.
+
+**Approach:** Standard approach
+
+---
+
+## Key Decisions
+
+### Using routerLog from utils/logger.ts - already has component prefix built-in
+- **Chose:** Using routerLog from utils/logger.ts - already has component prefix built-in
+- **Reasoning:** Logger already exists with routerLog pre-created, provides structured JSON output and configurable levels
+
+### Replaced 30 console calls with routerLog methods - info/debug/warn/error based on severity
+- **Chose:** Replaced 30 console calls with routerLog methods - info/debug/warn/error based on severity
+- **Reasoning:** Used appropriate log levels: debug for routine operations, info for significant events, warn for recoverable issues, error for failures
+
+---
+
+## Chapters
+
+### 1. Work
+*Agent: default*
+
+- Using routerLog from utils/logger.ts - already has component prefix built-in: Using routerLog from utils/logger.ts - already has component prefix built-in
+- Replaced 30 console calls with routerLog methods - info/debug/warn/error based on severity: Replaced 30 console calls with routerLog methods - info/debug/warn/error based on severity

package/.trajectories/completed/2026-01/traj_rt4fiw3ecp50.json

@@ -0,0 +1,48 @@
+{
+  "id": "traj_rt4fiw3ecp50",
+  "version": 1,
+  "task": {
+    "title": "Fix trajectory agents array population",
+    "source": {
+      "system": "plain",
+      "id": "agent-relay-452"
+    }
+  },
+  "status": "abandoned",
+  "startedAt": "2026-01-03T13:30:08.415Z",
+  "agents": [],
+  "chapters": [
+    {
+      "id": "chap_r4oq003sm2ke",
+      "title": "Work",
+      "agentName": "default",
+      "startedAt": "2026-01-03T13:30:15.567Z",
+      "events": [
+        {
+          "ts": 1767447015568,
+          "type": "decision",
+          "content": "Abandoned stale traj_9921cuhel0pj and started new trajectory for 452: Abandoned stale traj_9921cuhel0pj and started new trajectory for 452",
+          "raw": {
+            "question": "Abandoned stale traj_9921cuhel0pj and started new trajectory for 452",
+            "chosen": "Abandoned stale traj_9921cuhel0pj and started new trajectory for 452",
+            "alternatives": [],
+            "reasoning": ""
+          },
+          "significance": "high"
+        },
+        {
+          "ts": 1767447082829,
+          "type": "note",
+          "content": "Abandoned: Starting new task agent-relay-327",
+          "significance": "high"
+        }
+      ],
+      "endedAt": "2026-01-03T13:31:22.829Z"
+    }
+  ],
+  "commits": [],
+  "filesChanged": [],
+  "projectId": "/Users/khaliqgant/Projects/agent-workforce/relay",
+  "tags": [],
+  "completedAt": "2026-01-03T13:31:22.829Z"
+}

package/.trajectories/completed/2026-01/traj_rt4fiw3ecp50.md

@@ -0,0 +1,16 @@
+# Trajectory: Fix trajectory agents array population
+
+> **Status:** ❌ Abandoned
+> **Task:** agent-relay-452
+> **Started:** January 3, 2026 at 02:30 PM
+> **Completed:** January 3, 2026 at 02:31 PM
+
+---
+
+## Chapters
+
+### 1. Work
+*Agent: default*
+
+- Abandoned stale traj_9921cuhel0pj and started new trajectory for 452: Abandoned stale traj_9921cuhel0pj and started new trajectory for 452
+- Abandoned: Starting new task agent-relay-327

package/.trajectories/completed/2026-01/traj_st8j35b0hrlc.json

@@ -0,0 +1,59 @@
+{
+  "id": "traj_st8j35b0hrlc",
+  "version": 1,
+  "task": {
+    "title": "Fix cloud provisioning for GitHub cloning and agent credentials",
+    "source": {
+      "system": "plain",
+      "id": "cloud-e2e-fix"
+    }
+  },
+  "status": "completed",
+  "startedAt": "2026-01-03T19:04:57.338Z",
+  "agents": [],
+  "chapters": [
+    {
+      "id": "chap_4tafbyx9rbsy",
+      "title": "Work",
+      "agentName": "default",
+      "startedAt": "2026-01-03T19:07:03.673Z",
+      "events": [
+        {
+          "ts": 1767467223674,
+          "type": "decision",
+          "content": "Get GitHub token from Nango instead of vault: Get GitHub token from Nango instead of vault",
+          "raw": {
+            "question": "Get GitHub token from Nango instead of vault",
+            "chosen": "Get GitHub token from Nango instead of vault",
+            "alternatives": [],
+            "reasoning": "GitHub App tokens come from Nango and expire hourly. Changed provisioner to call getGithubAppTokenForUser() which finds user's Nango connection and fetches fresh token."
+          },
+          "significance": "high"
+        },
+        {
+          "ts": 1767467301488,
+          "type": "decision",
+          "content": "Create CLI credential files from ENV vars in workspace entrypoint: Create CLI credential files from ENV vars in workspace entrypoint",
+          "raw": {
+            "question": "Create CLI credential files from ENV vars in workspace entrypoint",
+            "chosen": "Create CLI credential files from ENV vars in workspace entrypoint",
+            "alternatives": [],
+            "reasoning": "Claude CLI expects ~/.claude/credentials.json, Codex expects ~/.codex/credentials.json. Workspace entrypoint now creates these from ANTHROPIC_TOKEN, OPENAI_TOKEN, GOOGLE_TOKEN ENV vars passed by provisioner."
+          },
+          "significance": "high"
+        }
+      ],
+      "endedAt": "2026-01-03T19:09:05.597Z"
+    }
+  ],
+  "commits": [],
+  "filesChanged": [],
+  "projectId": "/home/user/relay",
+  "tags": [],
+  "completedAt": "2026-01-03T19:09:05.597Z",
+  "retrospective": {
+    "summary": "Fixed GitHub token to use Nango (fresh installation tokens) and added credential file creation in workspace entrypoint for Claude/Codex/Gemini",
+    "approach": "Standard approach",
+    "confidence": 0.85
+  }
+}

package/.trajectories/completed/2026-01/traj_st8j35b0hrlc.md

@@ -0,0 +1,37 @@
+# Trajectory: Fix cloud provisioning for GitHub cloning and agent credentials
+
+> **Status:** ✅ Completed
+> **Task:** cloud-e2e-fix
+> **Confidence:** 85%
+> **Started:** January 3, 2026 at 07:04 PM
+> **Completed:** January 3, 2026 at 07:09 PM
+
+---
+
+## Summary
+
+Fixed GitHub token to use Nango (fresh installation tokens) and added credential file creation in workspace entrypoint for Claude/Codex/Gemini
+
+**Approach:** Standard approach
+
+---
+
+## Key Decisions
+
+### Get GitHub token from Nango instead of vault
+- **Chose:** Get GitHub token from Nango instead of vault
+- **Reasoning:** GitHub App tokens come from Nango and expire hourly. Changed provisioner to call getGithubAppTokenForUser() which finds user's Nango connection and fetches fresh token.
+
+### Create CLI credential files from ENV vars in workspace entrypoint
+- **Chose:** Create CLI credential files from ENV vars in workspace entrypoint
+- **Reasoning:** Claude CLI expects ~/.claude/credentials.json, Codex expects ~/.codex/credentials.json. Workspace entrypoint now creates these from ANTHROPIC_TOKEN, OPENAI_TOKEN, GOOGLE_TOKEN ENV vars passed by provisioner.
+
+---
+
+## Chapters
+
+### 1. Work
+*Agent: default*
+
+- Get GitHub token from Nango instead of vault: Get GitHub token from Nango instead of vault
+- Create CLI credential files from ENV vars in workspace entrypoint: Create CLI credential files from ENV vars in workspace entrypoint