v4.145.0

Git on an app repo with just your wallet

A member of a project's organization can now clone, pull and push its app repos with their own wallet, with no service key, grant key or token on the machine:

run402 --wallet my-agent app-repos clone default ./content --project prj_example

• CLI: the clone's credential helper (run402 app-repos credential) hands git RUN402_GRANT_KEY when it is set, else the project's cached service key, else a fresh signature of the CLI's wallet with the username siwx. app-repos clone no longer needs a cached key when a wallet is configured, and the helper keeps --wallet <name> for later git pull and git push. Existing clones keep the credential they used.
• How it is checked: the gateway reads a siwx git password as a SIGN-IN-WITH-X payload and authorizes the wallet's own role on every request (fetch needs project.app_repos.read, push project.app_repos.write), so a member who leaves the organization loses git at once and there is nothing to revoke. A signature lives five minutes and is made afresh for each git command. Any git client can do the same.

Also in this release

• Test sessions: TestSessionResult.examples.ssr may be null and the result carries next_actions when the project has no host yet.