feat(desktop): wire git-credential-nostr into agent spawn path (#451)

.github/workflows/ci.yml

@@ -248,7 +248,8 @@ jobs:
           cross build --release --target "$TARGET" \
             -p sprout-relay \
             -p sprout-acp \
-            -p sprout-mcp
+            -p sprout-mcp \
+            -p git-credential-nostr
 
   desktop-build-macos:
     name: Desktop Build (macOS)
@@ -267,6 +268,7 @@ jobs:
           mkdir -p desktop/src-tauri/binaries
           touch "desktop/src-tauri/binaries/sprout-acp-$TARGET"
           touch "desktop/src-tauri/binaries/sprout-mcp-server-$TARGET"
+          touch "desktop/src-tauri/binaries/git-credential-nostr-$TARGET"
       - name: Build Tauri app
         run: cd desktop && pnpm tauri build
         env:

desktop/scripts/check-file-sizes.mjs

@@ -45,7 +45,7 @@ const overrides = new Map([
   ["src-tauri/src/lib.rs", 710], // sprout-media:// proxy + Range headers + Sprout nest init (ensure_nest) in setup() + huddle command registration + PTT global shortcut handler + persona pack commands + app_handle storage for event emission
   ["src-tauri/src/commands/media.rs", 720], // ffmpeg video transcode + poster frame extraction + run_ffmpeg_with_timeout (find_ffmpeg, is_video_file, transcode_to_mp4, extract_poster_frame, transcode_and_extract_poster) + spawn_blocking wrappers + tests
   ["src-tauri/src/commands/agents.rs", 881], // remote agent lifecycle routing (local + provider branches) + scope enforcement + persona pack metadata wiring + mcp_toolsets field + NIP-OA auth_tag in deploy payload
-  ["src-tauri/src/managed_agents/runtime.rs", 705], // KNOWN_AGENT_BINARIES const + process_belongs_to_us FFI (macOS proc_name + Linux /proc/comm) + terminate_process + start/stop/sync lifecycle + pack persona live-read + login shell PATH augmentation + observer endpoint wiring
+  ["src-tauri/src/managed_agents/runtime.rs", 740], // KNOWN_AGENT_BINARIES const + process_belongs_to_us FFI (macOS proc_name + Linux /proc/comm) + terminate_process + start/stop/sync lifecycle + pack persona live-read + login shell PATH augmentation + observer endpoint wiring + git credential helper env injection
   ["src-tauri/src/managed_agents/backend.rs", 530], // provider IPC, validation, discovery, binary resolution + tests
   ["src/features/huddle/HuddleContext.tsx", 650], // huddle lifecycle context + joinHuddle + connectAndSetupMedia shared helper + activeSpeakers/isReconnecting state + PTT (reusable AudioContext) + TTS subscription + mic level analyser (10fps throttle) + agent pubkey refresh
   ["src/features/agents/hooks.ts", 540], // agent query/mutation surface now includes built-in persona library activation + useUpdateManagedAgentMutation

desktop/src-tauri/src/managed_agents/runtime.rs

@@ -570,6 +570,40 @@ pub fn spawn_agent_child(
 
     command.env("SPROUT_ACP_RELAY_OBSERVER", "true");
 
+    // ── Git credential helper for Sprout relay ──────────────────────────
+    //
+    // Agents need to clone/push repos hosted on the Sprout relay's git
+    // server, which authenticates via NIP-98. The `git-credential-nostr`
+    // binary signs auth events using the agent's nostr key.
+    //
+    // We configure git via GIT_CONFIG_COUNT env vars (ephemeral, no
+    // filesystem writes) scoped to the relay's git URL so we don't
+    // interfere with other remotes (e.g. GitHub).
+    //
+    // NOSTR_PRIVATE_KEY mirrors SPROUT_PRIVATE_KEY — keep in sync.
+    if let Some(cred_helper) = resolve_command("git-credential-nostr", Some(app)) {
+        let relay_http_url = crate::relay::relay_http_base_url(&record.relay_url);
+
+        command.env("NOSTR_PRIVATE_KEY", &record.private_key_nsec);
+        command.env("GIT_TERMINAL_PROMPT", "0");
+        command.env("GIT_CONFIG_COUNT", "2");
+        command.env(
+            "GIT_CONFIG_KEY_0",
+            format!("credential.{relay_http_url}/git.helper"),
+        );
+        command.env("GIT_CONFIG_VALUE_0", cred_helper.display().to_string());
+        command.env(
+            "GIT_CONFIG_KEY_1",
+            format!("credential.{relay_http_url}/git.useHttpPath"),
+        );
+        command.env("GIT_CONFIG_VALUE_1", "true");
+    } else {
+        eprintln!(
+            "sprout-desktop: git-credential-nostr not found — agent {} will not have automatic Sprout git auth",
+            record.name,
+        );
+    }
+
     // Spawn the harness in its own process group so we can kill the entire
     // tree (harness + MCP servers + agent subprocesses) on shutdown.
     #[cfg(unix)]

desktop/src-tauri/tauri.conf.json

@@ -41,7 +41,11 @@
   "bundle": {
     "active": true,
     "targets": "all",
-    "externalBin": ["binaries/sprout-acp", "binaries/sprout-mcp-server"],
+    "externalBin": [
+      "binaries/sprout-acp",
+      "binaries/sprout-mcp-server",
+      "binaries/git-credential-nostr"
+    ],
     "icon": [
       "icons/32x32.png",
       "icons/128x128.png",

justfile

@@ -91,7 +91,7 @@ _ensure-sidecar-stubs:
     set -euo pipefail
     TARGET=$(rustc -vV | sed -n 's|host: ||p')
     mkdir -p desktop/src-tauri/binaries
-    for bin in sprout-acp sprout-mcp-server; do
+    for bin in sprout-acp sprout-mcp-server git-credential-nostr; do
         touch "desktop/src-tauri/binaries/${bin}-${TARGET}"
     done
 
@@ -107,6 +107,7 @@ desktop-release-build target="aarch64-apple-darwin":
     mkdir -p desktop/src-tauri/binaries
     touch "desktop/src-tauri/binaries/sprout-acp-$TARGET"
     touch "desktop/src-tauri/binaries/sprout-mcp-server-$TARGET"
+    touch "desktop/src-tauri/binaries/git-credential-nostr-$TARGET"
     cd {{desktop_dir}} && pnpm install && pnpm tauri build --target {{target}}
 
 # Run desktop checks suitable for CI / pre-push

scripts/bundle-sidecars.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-SIDECARS=(sprout-acp sprout-mcp-server)
+SIDECARS=(sprout-acp sprout-mcp-server git-credential-nostr)
 TARGET=${1:-$(rustc -vV | sed -n 's|host: ||p')}
 BINARIES_DIR="desktop/src-tauri/binaries"
 
@@ -11,7 +11,7 @@ for bin in "${SIDECARS[@]}"; do
 done
 if [[ ${#missing[@]} -gt 0 ]]; then
     echo "Error: missing release binaries: ${missing[*]}" >&2
-    echo "Run 'cargo build --release -p sprout-acp -p sprout-mcp' first." >&2
+    echo "Run 'cargo build --release -p sprout-acp -p sprout-mcp -p git-credential-nostr' first." >&2
     exit 1
 fi