feat(p12a): services git distants (PAT/app_password) + clone HTTPS

Modèle de données : - migration #11 git_credentials (secrets chiffrés SecretBox : secret_encrypted ; colonnes ssh/oauth posées pour P12b/P12c) ; #12 repos ALTER remote_url/git_service/credential_id (pas de FK) - types partagés api.ts (GitCredentialSummary sans secret + hasSecret/secretLast4, CRUD, RemoteRepoSummary, Clone*) ; protocole additif : topic 'clones' + message clone_update (CloneOperation) Backend : - core/git-credentials.ts (GitCredentialsManager(db, box)) : CRUD chiffré, test() (GET /user), getSecret()/authContext() internes, NULLification de repos.credential_id à la suppression - core/git-clients/ (github/gitlab/gitea) via fetch, sans dépendance : verify()+listRepos() paginés, erreurs typées AUTH_FAILED/RATE_LIMITED/UNREACHABLE, SSRF base_url http(s) - core/git-auth.ts : withGitAuth (GIT_ASKPASS éphémère 0o700, secret par env, GIT_TERMINAL_PROMPT=0, jamais dans l'URL/.git/config, nettoyage finally) - core/git.ts cloneRepo (spawn git clone --progress, parse progression, timeout) - core/clone-manager.ts (EventEmitter) : clone async, dest confiné sous scanRoots + non existant, auto-enregistrement via addRepo + métadonnées de provenance, nettoyage du clone partiel, events topic 'clones' - routes/git-connections.ts (CRUD + /test + /:id/repos + POST /repos/clone 202 + GET /repos/clone/:id) ; app.ts câble box→GitCredentialsManager + CloneManager→gateway ; gateway relaie 'clones' Frontend : - ws-client subscribeClones ; stores git-connections + clone (suivi WS) - components/settings/GitConnectionsSection (liste + formulaire pat/app_password, secret jamais ré-affiché) inséré dans SettingsView ; CloneRepoModal (connexion → repos distants paginés → dest scanRoots[0] → barre de progression WS → redirection) ; bouton « Cloner » dans DashboardView ; i18n EN+FR Tests : git-credentials (round-trip SecretBox, résumé sans secret, NULLification) ; acceptance-p12.mjs (clone bare local file:// → clone_update done + repo enregistré + secret ABSENT de l'API, de la DB et du .git/config) Sous-phases restantes : P12b (SSH), P12c (OAuth device flow).
2026-06-27 14:27:18 +02:00
parent e8d10b7ec0
commit 08695a707d
22 changed files with 1583 additions and 10 deletions
--- a/packages/server/scripts/acceptance-p12.mjs
+++ b/packages/server/scripts/acceptance-p12.mjs
@@ -0,0 +1,149 @@
+#!/usr/bin/env node
+// Acceptation P12a (sans navigateur, sans réseau/quota) : services git distants + clone. Vrai daemon
+// + credential factice + clone d'un dépôt bare LOCAL (chemin de fichier, pas de réseau). Couvre :
+// création de credential (secret chiffré), POST /repos/clone (202) → progression WS clone_update →
+// done → repo auto-enregistré, ET surtout : le secret en clair est ABSENT de l'API, de la DB et du
+// .git/config du dépôt cloné (garde-fou « jamais de fuite de secret »).
+import { spawn, execFileSync } from 'node:child_process';
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync, readFileSync, existsSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const WebSocket = require('ws');
+
+const PORT = 7555;
+const ORIGIN = `http://127.0.0.1:${PORT}`;
+const SECRET = 'arb-secret-token-9876XYZ'; // token factice : ne doit JAMAIS fuiter en clair
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const serverDir = join(dirname(fileURLToPath(import.meta.url)), '..');
+const results = [];
+const check = (name, ok, detail = '') => {
+  results.push({ name, ok, detail });
+  console.log(`${ok ? '✅' : '❌'} ${name}${detail ? ` — ${detail}` : ''}`);
+};
+
+const tmp = mkdtempSync(join(tmpdir(), 'arb-accept-p12-'));
+const work = join(tmp, 'work'); // racine de scan + destination des clones
+const src = join(tmp, 'src'); // dépôt source (working)
+const bare = join(tmp, 'source.git'); // remote bare local (file path)
+const dbPath = join(tmp, 'a.db');
+mkdirSync(work, { recursive: true });
+mkdirSync(src, { recursive: true });
+const g = (cwd, ...args) => execFileSync('git', args, { cwd, stdio: 'pipe' });
+g(src, 'init', '-b', 'main');
+g(src, 'config', 'user.email', 'test@arboretum.dev');
+g(src, 'config', 'user.name', 'Test');
+writeFileSync(join(src, 'README.md'), '# cloned demo\n');
+g(src, 'add', '-A');
+g(src, 'commit', '-m', 'init');
+execFileSync('git', ['clone', '--bare', src, bare], { stdio: 'pipe' });
+
+const srv = spawn(
+  'node',
+  [join(serverDir, 'dist', 'index.js'), '--port', String(PORT), '--db', dbPath, '--claude-home', join(tmp, 'claude'), '--no-discover'],
+  { env: { ...process.env, ARBORETUM_LOG: 'warn' }, stdio: ['ignore', 'pipe', 'pipe'] },
+);
+let srvOut = '';
+srv.stdout.on('data', (d) => (srvOut += d));
+srv.stderr.on('data', (d) => (srvOut += d));
+
+function wsClient(cookie) {
+  const ws = new WebSocket(`ws://127.0.0.1:${PORT}/ws`, { headers: { Origin: ORIGIN, Cookie: cookie } });
+  const state = { msgs: [] };
+  ws.on('message', (data, isBinary) => {
+    if (!isBinary) state.msgs.push(JSON.parse(String(data)));
+  });
+  const waitMsg = async (pred, timeout = 15000) => {
+    const t0 = Date.now();
+    while (Date.now() - t0 < timeout) {
+      const m = state.msgs.find(pred);
+      if (m) return m;
+      await sleep(50);
+    }
+    return null;
+  };
+  return { ws, state, waitMsg, send: (m) => ws.send(JSON.stringify(m)) };
+}
+
+const j = (path, method, cookie, body) =>
+  fetch(`${ORIGIN}${path}`, {
+    method,
+    headers: { Origin: ORIGIN, Cookie: cookie, ...(body ? { 'Content-Type': 'application/json' } : {}) },
+    ...(body ? { body: JSON.stringify(body) } : {}),
+  });
+
+try {
+  await sleep(1500);
+  const token = /arb_[0-9a-f]+/.exec(srvOut)?.[0];
+  check('boot + token bootstrap', !!token);
+  const login = await fetch(`${ORIGIN}/api/v1/auth/login`, {
+    method: 'POST', headers: { 'Content-Type': 'application/json', Origin: ORIGIN }, body: JSON.stringify({ token }),
+  });
+  const cookie = login.headers.get('set-cookie')?.split(';')[0] ?? '';
+  check('login → cookie', login.status === 200);
+
+  // racine de scan = work (confine la destination du clone).
+  const patch = await j('/api/v1/settings', 'PATCH', cookie, { scanRoots: [work] });
+  check('PATCH scanRoots → 200', patch.status === 200);
+
+  // credential factice (secret chiffré côté serveur).
+  const createCred = await j('/api/v1/git-connections', 'POST', cookie, {
+    label: 'fake', service: 'gitea', authType: 'pat', baseUrl: 'http://localhost:9999', secret: SECRET,
+  });
+  const credBody = await createCred.json();
+  const credId = credBody.credential?.id;
+  check('POST /git-connections → 201', createCred.status === 201 && !!credId);
+  check('réponse de création SANS secret en clair', !JSON.stringify(credBody).includes(SECRET));
+  check('réponse expose secretLast4 (et hasSecret)', credBody.credential?.hasSecret === true && credBody.credential?.secretLast4 === SECRET.slice(-4));
+
+  // GET liste : pas de secret.
+  const listed = await (await j('/api/v1/git-connections', 'GET', cookie)).json();
+  check('GET /git-connections SANS secret en clair', !JSON.stringify(listed).includes(SECRET));
+
+  // WS abonné aux clones.
+  const c = wsClient(cookie);
+  await new Promise((res, rej) => (c.ws.on('open', res), c.ws.on('error', rej)));
+  c.send({ type: 'hello', protocol: 1 });
+  await c.waitMsg((m) => m.type === 'hello_ok');
+  c.send({ type: 'sub', topics: ['clones', 'worktrees'] });
+
+  // clone du bare local → dest sous la racine de scan.
+  const dest = join(work, 'cloned');
+  const clone = await j('/api/v1/repos/clone', 'POST', cookie, { credentialId: credId, remoteUrl: bare, dest });
+  const cloneBody = await clone.json();
+  check('POST /repos/clone → 202 + operationId', clone.status === 202 && !!cloneBody.operationId);
+
+  const doneMsg = await c.waitMsg((m) => m.type === 'clone_update' && m.operation?.id === cloneBody.operationId && m.operation?.state === 'done');
+  check('clone_update state=done reçu via WS', !!doneMsg, doneMsg ? `repoId=${doneMsg.operation.repoId}` : 'timeout');
+  check('le clone a produit un repoId (auto-enregistré)', !!doneMsg?.operation?.repoId);
+
+  // repo enregistré + visible.
+  const repos = await (await j('/api/v1/repos', 'GET', cookie)).json();
+  const cloned = (repos.repos ?? []).find((r) => r.path === dest);
+  check('repo cloné enregistré et listé', !!cloned);
+  check('le dépôt cloné existe sur disque (README.md)', existsSync(join(dest, 'README.md')));
+
+  // ---- garde-fou « pas de fuite de secret » ----
+  const gitConfig = existsSync(join(dest, '.git', 'config')) ? readFileSync(join(dest, '.git', 'config'), 'utf8') : '';
+  check('secret ABSENT du .git/config du clone', !gitConfig.includes(SECRET));
+  const dbBytes = [dbPath, `${dbPath}-wal`, `${dbPath}-shm`]
+    .filter((p) => existsSync(p))
+    .map((p) => readFileSync(p).toString('latin1'))
+    .join('');
+  check('secret ABSENT de la base (chiffré au repos)', !dbBytes.includes(SECRET));
+
+  c.ws.close();
+} catch (err) {
+  check('exception', false, String(err));
+} finally {
+  srv.kill('SIGTERM');
+  await sleep(1500);
+  check('arrêt propre du daemon (SIGTERM)', srv.exitCode === 0 || srv.signalCode === null || srv.exitCode === null);
+  rmSync(tmp, { recursive: true, force: true });
+  const failed = results.filter((r) => !r.ok);
+  console.log(failed.length === 0 ? '\nACCEPTANCE P12: ALL GREEN' : `\nACCEPTANCE P12: ${failed.length} FAILURE(S)`);
+  process.exit(failed.length === 0 ? 0 : 1);
+}
--- a/packages/server/src/app.ts
+++ b/packages/server/src/app.ts
@@ -12,6 +12,9 @@ import { PtyManager } from './core/pty-manager.js';
 import { DiscoveryService } from './core/discovery-service.js';
 import { SessionArchiveService } from './core/session-archive.js';
 import { SettingsBus } from './core/settings-bus.js';
+import { GitCredentialsManager } from './core/git-credentials.js';
+import { CloneManager } from './core/clone-manager.js';
+import { registerGitConnectionRoutes } from './routes/git-connections.js';
 import { WorktreeManager } from './core/worktree-manager.js';
 import { RepoDiscoveryService } from './core/repo-discovery.js';
 import { GroupManager } from './core/group-manager.js';
@@ -82,6 +85,8 @@ export interface AppBundle {
  push: PushService;
  fsWatcher: FsWatcherService;
  settingsBus: SettingsBus;
+  gitCredentials: GitCredentialsManager;
+  clones: CloneManager;
 }

 export function buildApp(config: Config, db: Db, serverVersion: string): AppBundle {
@@ -109,6 +114,9 @@ export function buildApp(config: Config, db: Db, serverVersion: string): AppBund
  const groups = new GroupManager(db);
  // P11 — bus de diffusion des réglages : PATCH /settings émet, la gateway relaie au topic 'settings'.
  const settingsBus = new SettingsBus();
+  // P12 — services git distants : `box` (SecretBox) câblé ici pour chiffrer les secrets des credentials.
+  const gitCredentials = new GitCredentialsManager(db, box);
+  const clones = new CloneManager(db, worktrees, gitCredentials);

  // En-têtes de sécurité sur toute réponse + no-store sur les réponses sensibles (API/WS).
  // onSend DOIT retourner le payload (sinon Fastify vide la réponse).
@@ -194,13 +202,14 @@ export function buildApp(config: Config, db: Db, serverVersion: string): AppBund
  registerFileRoutes(app, worktrees, db);
  registerPushRoutes(app, push, db);
  registerSettingsRoutes(app, db, config, serverVersion, push, settingsBus);
+  registerGitConnectionRoutes(app, gitCredentials, clones, db);
  registerFsRoutes(app);
  registerAuditRoutes(app, db);
  registerDataRoutes(app, db, auth);
  // La route websocket doit être déclarée APRÈS le chargement du plugin (contexte
  // encapsulé) — sinon le handler reçoit la signature REST (request, reply).
  void app.register(async (scoped) => {
-    registerWsGateway(scoped, manager, discovery, sessionArchive, worktrees, groups, settingsBus, serverVersion);
+    registerWsGateway(scoped, manager, discovery, sessionArchive, worktrees, groups, settingsBus, clones, serverVersion);
  });

  // SPA buildée embarquée dans le paquet npm (public/) — absente en dev (vite dev sert le front)
@@ -215,5 +224,5 @@ export function buildApp(config: Config, db: Db, serverVersion: string): AppBund
    });
  }

-  return { app, auth, manager, discovery, sessionArchive, repoDiscovery, worktrees, groups, push, fsWatcher, settingsBus };
+  return { app, auth, manager, discovery, sessionArchive, repoDiscovery, worktrees, groups, push, fsWatcher, settingsBus, gitCredentials, clones };
 }
--- a/packages/server/src/core/clone-manager.ts
+++ b/packages/server/src/core/clone-manager.ts
@@ -0,0 +1,118 @@
+// Orchestration des clones (P12). Asynchrone : POST /repos/clone répond 202 avec un operationId,
+// la progression est poussée en WS (topic 'clones') et lisible en REST (survit au refresh). À la fin,
+// le repo cloné est auto-enregistré via WorktreeManager.addRepo (réutilise unicité/validation/event).
+// `dest` est strictement confiné SOUS une racine de scan + non existant (mkdir implicite par git).
+import { EventEmitter } from 'node:events';
+import { randomUUID } from 'node:crypto';
+import { rm, stat } from 'node:fs/promises';
+import { resolve, sep } from 'node:path';
+import type { CloneOperation, GitService } from '@arboretum/shared';
+import type { Db } from '../db/index.js';
+import { isSafeAbsolutePath, cloneRepo } from './git.js';
+import { readScanRoots } from './scan-settings.js';
+import { withGitAuth } from './git-auth.js';
+import type { GitAuth } from './git-clients/index.js';
+import type { GitCredentialsManager } from './git-credentials.js';
+import type { WorktreeManager } from './worktree-manager.js';
+import { recordAudit } from './audit-log.js';
+
+export interface CloneManagerEvents {
+  clone_update: [CloneOperation];
+}
+
+function httpError(statusCode: number, code: string, message: string): Error & { statusCode: number; code: string } {
+  return Object.assign(new Error(message), { statusCode, code });
+}
+
+export class CloneManager extends EventEmitter<CloneManagerEvents> {
+  private readonly ops = new Map<string, CloneOperation>();
+
+  constructor(
+    private readonly db: Db,
+    private readonly worktrees: WorktreeManager,
+    private readonly credentials: GitCredentialsManager,
+  ) {
+    super();
+  }
+
+  get(id: string): CloneOperation | null {
+    return this.ops.get(id) ?? null;
+  }
+
+  /**
+   * Démarre un clone (validation synchrone du dest → throw 4xx ; clone asynchrone ensuite).
+   * Retourne l'operationId à suivre via WS/REST. `actor` pour l'audit.
+   */
+  async start(opts: { credentialId: string; remoteUrl: string; dest: string }, actor: string): Promise<string> {
+    const dest = resolve(opts.dest);
+    if (!isSafeAbsolutePath(dest)) throw httpError(400, 'BAD_REQUEST', 'dest must be an absolute, normalized path');
+    if (typeof opts.remoteUrl !== 'string' || opts.remoteUrl.trim() === '') throw httpError(400, 'BAD_REQUEST', 'remoteUrl is required');
+    const ctx = this.credentials.authContext(opts.credentialId);
+    if (!ctx) throw httpError(404, 'NOT_FOUND', 'No usable credential with this id');
+
+    // Confinement : dest DOIT être sous une racine de scan configurée (jamais d'écriture arbitraire).
+    const roots = readScanRoots(this.db);
+    if (roots.length === 0) throw httpError(400, 'NO_SCAN_ROOT', 'Configure a scan folder first (Settings → Discovery)');
+    const underRoot = roots.some((r) => {
+      const root = resolve(r);
+      return dest === root || dest.startsWith(root + sep);
+    });
+    if (!underRoot) throw httpError(400, 'OUTSIDE_SCAN_ROOT', 'dest must be inside a configured scan folder');
+
+    // Le parent doit exister ; le dest ne doit pas exister (git clone le crée).
+    const parent = dest.slice(0, dest.lastIndexOf(sep)) || sep;
+    try {
+      const st = await stat(parent);
+      if (!st.isDirectory()) throw httpError(400, 'BAD_DEST', 'Parent of dest is not a directory');
+    } catch (err) {
+      if ((err as { statusCode?: number }).statusCode) throw err;
+      throw httpError(404, 'NOT_FOUND', `Parent directory does not exist: ${parent}`);
+    }
+    if (await stat(dest).then(() => true).catch(() => false)) throw httpError(409, 'DEST_EXISTS', `Destination already exists: ${dest}`);
+
+    const id = randomUUID();
+    const op: CloneOperation = { id, state: 'pending', progress: null, phase: null, error: null, repoId: null, dest };
+    this.ops.set(id, op);
+    recordAudit(this.db, { actor, action: 'repo.clone', resourceId: id, details: { service: ctx.service, dest } });
+    // Lancement asynchrone (ne bloque pas la réponse 202).
+    void this.run(op, opts.remoteUrl, opts.credentialId, ctx);
+    return id;
+  }
+
+  private update(op: CloneOperation, patch: Partial<CloneOperation>): void {
+    Object.assign(op, patch);
+    this.emit('clone_update', { ...op });
+  }
+
+  private async run(
+    op: CloneOperation,
+    remoteUrl: string,
+    credentialId: string,
+    ctx: { service: GitService; baseUrl: string | null; auth: GitAuth },
+  ): Promise<void> {
+    this.update(op, { state: 'running' });
+    let lastPct = -10;
+    const onProgress = (p: { phase: string; percent: number | null }): void => {
+      // throttle : on ne pousse que sur changement de phase ou +3% pour éviter le flood WS.
+      if (p.percent == null || p.percent - lastPct >= 3 || p.phase !== op.phase) {
+        lastPct = p.percent ?? lastPct;
+        this.update(op, { phase: p.phase, progress: p.percent });
+      }
+    };
+    try {
+      await withGitAuth(ctx.service, ctx.auth, (env) =>
+        cloneRepo({ url: remoteUrl, dest: op.dest, env, onProgress }),
+      );
+      // auto-enregistrement du repo cloné + métadonnées de provenance.
+      const repo = await this.worktrees.addRepo({ path: op.dest });
+      this.db
+        .prepare('UPDATE repos SET remote_url = ?, git_service = ?, credential_id = ? WHERE id = ?')
+        .run(remoteUrl, ctx.service, credentialId, repo.id);
+      this.update(op, { state: 'done', progress: 100, repoId: repo.id });
+    } catch (err) {
+      // nettoyage du clone partiel (best-effort).
+      await rm(op.dest, { recursive: true, force: true }).catch(() => {});
+      this.update(op, { state: 'error', error: err instanceof Error ? err.message : String(err) });
+    }
+  }
+}
--- a/packages/server/src/core/git-auth.ts
+++ b/packages/server/src/core/git-auth.ts
@@ -0,0 +1,40 @@
+// Préparation d'un environnement d'authentification git ÉPHÉMÈRE (P12). HTTPS (pat/app_password) :
+// les identifiants sont fournis via GIT_ASKPASS (script 0o700 lisant deux variables d'env), JAMAIS
+// dans l'URL ni dans `.git/config`. GIT_TERMINAL_PROMPT=0 (pas d'invite bloquante). Le script est
+// supprimé en `finally` ; le secret ne transite que par l'env du process enfant (jamais loggé).
+import { mkdtemp, writeFile, rm, chmod } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import type { GitService } from '@arboretum/shared';
+import type { GitAuth } from './git-clients/index.js';
+
+// Identité HTTPS par défaut quand l'utilisateur n'a pas fourni de username (token-as-password).
+const SERVICE_DEFAULT_USER: Record<GitService, string> = { github: 'x-access-token', gitlab: 'oauth2', gitea: 'oauth2' };
+
+export async function withGitAuth<T>(
+  service: GitService,
+  auth: GitAuth,
+  fn: (env: NodeJS.ProcessEnv) => Promise<T>,
+): Promise<T> {
+  const dir = await mkdtemp(join(tmpdir(), 'arb-gitauth-'));
+  const askpass = join(dir, 'askpass.sh');
+  const user = auth.username || SERVICE_DEFAULT_USER[service];
+  await writeFile(
+    askpass,
+    "#!/bin/sh\ncase \"$1\" in\n  Username*) printf '%s' \"$ARB_GIT_USER\" ;;\n  *) printf '%s' \"$ARB_GIT_PASS\" ;;\nesac\n",
+    { mode: 0o700 },
+  );
+  await chmod(askpass, 0o700);
+  const env: NodeJS.ProcessEnv = {
+    ...process.env,
+    GIT_ASKPASS: askpass,
+    GIT_TERMINAL_PROMPT: '0',
+    ARB_GIT_USER: user,
+    ARB_GIT_PASS: auth.secret,
+  };
+  try {
+    return await fn(env);
+  } finally {
+    await rm(dir, { recursive: true, force: true }).catch(() => {});
+  }
+}
--- a/packages/server/src/core/git-clients/index.ts
+++ b/packages/server/src/core/git-clients/index.ts
@@ -0,0 +1,156 @@
+// Clients des services git distants (Gitea / GitLab / GitHub) — P12. Uniquement `fetch` global
+// (Node ≥ 22), AUCUNE dépendance (pas d'octokit/gitbeaker). Chaque client expose verify() (test de
+// connectivité/auth) et listRepos() (paginé). Erreurs typées : AUTH_FAILED / RATE_LIMITED / UNREACHABLE.
+import type { GitAuthType, GitService, RemoteRepoSummary } from '@arboretum/shared';
+
+const REQUEST_TIMEOUT_MS = 12_000;
+const PER_PAGE = 30;
+
+export interface GitAuth {
+  authType: GitAuthType;
+  username: string | null;
+  secret: string;
+}
+
+export class GitServiceError extends Error {
+  constructor(
+    public readonly errorCode: string,
+    message?: string,
+  ) {
+    super(message ?? errorCode);
+    this.name = 'GitServiceError';
+  }
+}
+
+export interface GitClient {
+  verify(auth: GitAuth): Promise<{ login: string }>;
+  listRepos(auth: GitAuth, page: number, search?: string): Promise<{ repos: RemoteRepoSummary[]; nextPage: number | null }>;
+}
+
+/** En-têtes d'auth selon le type. app_password → Basic (username:secret) ; pat → en-tête propre au service. */
+function authHeaders(service: GitService, auth: GitAuth): Record<string, string> {
+  if (auth.authType === 'app_password') {
+    const basic = Buffer.from(`${auth.username ?? ''}:${auth.secret}`).toString('base64');
+    return { Authorization: `Basic ${basic}` };
+  }
+  // pat
+  if (service === 'gitlab') return { 'PRIVATE-TOKEN': auth.secret };
+  if (service === 'gitea') return { Authorization: `token ${auth.secret}` };
+  return { Authorization: `Bearer ${auth.secret}` }; // github
+}
+
+/** Refuse une base self-hosted non http(s) (anti-SSRF schéma) ; renvoie l'origine normalisée sans `/` final. */
+function normalizeBase(baseUrl: string): string {
+  let u: URL;
+  try {
+    u = new URL(baseUrl);
+  } catch {
+    throw new GitServiceError('BAD_BASE_URL', 'base_url must be a valid http(s) URL');
+  }
+  if (u.protocol !== 'http:' && u.protocol !== 'https:') throw new GitServiceError('BAD_BASE_URL', 'base_url must be http(s)');
+  return `${u.origin}${u.pathname}`.replace(/\/+$/, '');
+}
+
+async function fetchJson(url: string, headers: Record<string, string>): Promise<{ json: unknown; headers: Headers }> {
+  let res: Response;
+  try {
+    res = await fetch(url, { headers: { Accept: 'application/json', ...headers }, signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS) });
+  } catch {
+    throw new GitServiceError('UNREACHABLE', 'Could not reach the git service');
+  }
+  if (res.status === 429) throw new GitServiceError('RATE_LIMITED', 'Rate limited by the git service');
+  if (res.status === 401 || res.status === 403) {
+    // 403 + quota épuisé = rate limit (GitHub) ; sinon échec d'auth.
+    if (res.headers.get('x-ratelimit-remaining') === '0') throw new GitServiceError('RATE_LIMITED', 'Rate limited by the git service');
+    throw new GitServiceError('AUTH_FAILED', 'Authentication failed');
+  }
+  if (!res.ok) throw new GitServiceError(`HTTP_${res.status}`, `Unexpected response ${res.status}`);
+  return { json: await res.json().catch(() => null), headers: res.headers };
+}
+
+function githubBase(baseUrl: string | null): string {
+  return baseUrl ? normalizeBase(baseUrl) : 'https://api.github.com';
+}
+function gitlabBase(baseUrl: string | null): string {
+  return `${baseUrl ? normalizeBase(baseUrl) : 'https://gitlab.com'}/api/v4`;
+}
+function giteaBase(baseUrl: string | null): string {
+  if (!baseUrl) throw new GitServiceError('BAD_BASE_URL', 'Gitea requires a base_url (self-hosted instance)');
+  return `${normalizeBase(baseUrl)}/api/v1`;
+}
+
+const githubClient = (baseUrl: string | null): GitClient => {
+  const base = githubBase(baseUrl);
+  return {
+    async verify(auth) {
+      const { json } = await fetchJson(`${base}/user`, authHeaders('github', auth));
+      return { login: String((json as { login?: string })?.login ?? '') };
+    },
+    async listRepos(auth, page) {
+      const { json } = await fetchJson(`${base}/user/repos?per_page=${PER_PAGE}&page=${page}&sort=updated`, authHeaders('github', auth));
+      const arr = Array.isArray(json) ? (json as Array<Record<string, unknown>>) : [];
+      const repos = arr.map((r): RemoteRepoSummary => ({
+        fullName: String(r.full_name ?? ''),
+        cloneUrl: String(r.clone_url ?? ''),
+        private: Boolean(r.private),
+        description: (r.description as string | null) ?? null,
+        defaultBranch: (r.default_branch as string | null) ?? null,
+      }));
+      return { repos, nextPage: arr.length === PER_PAGE ? page + 1 : null };
+    },
+  };
+};
+
+const gitlabClient = (baseUrl: string | null): GitClient => {
+  const base = gitlabBase(baseUrl);
+  return {
+    async verify(auth) {
+      const { json } = await fetchJson(`${base}/user`, authHeaders('gitlab', auth));
+      return { login: String((json as { username?: string })?.username ?? '') };
+    },
+    async listRepos(auth, page) {
+      const { json, headers } = await fetchJson(
+        `${base}/projects?membership=true&per_page=${PER_PAGE}&page=${page}&order_by=last_activity_at`,
+        authHeaders('gitlab', auth),
+      );
+      const arr = Array.isArray(json) ? (json as Array<Record<string, unknown>>) : [];
+      const repos = arr.map((r): RemoteRepoSummary => ({
+        fullName: String(r.path_with_namespace ?? ''),
+        cloneUrl: String(r.http_url_to_repo ?? ''),
+        private: r.visibility !== 'public',
+        description: (r.description as string | null) ?? null,
+        defaultBranch: (r.default_branch as string | null) ?? null,
+      }));
+      const next = headers.get('x-next-page');
+      return { repos, nextPage: next ? Number(next) : null };
+    },
+  };
+};
+
+const giteaClient = (baseUrl: string | null): GitClient => {
+  const base = giteaBase(baseUrl);
+  return {
+    async verify(auth) {
+      const { json } = await fetchJson(`${base}/user`, authHeaders('gitea', auth));
+      return { login: String((json as { login?: string })?.login ?? '') };
+    },
+    async listRepos(auth, page) {
+      const { json } = await fetchJson(`${base}/user/repos?page=${page}&limit=${PER_PAGE}`, authHeaders('gitea', auth));
+      const arr = Array.isArray(json) ? (json as Array<Record<string, unknown>>) : [];
+      const repos = arr.map((r): RemoteRepoSummary => ({
+        fullName: String(r.full_name ?? ''),
+        cloneUrl: String(r.clone_url ?? ''),
+        private: Boolean(r.private),
+        description: (r.description as string | null) ?? null,
+        defaultBranch: (r.default_branch as string | null) ?? null,
+      }));
+      return { repos, nextPage: arr.length === PER_PAGE ? page + 1 : null };
+    },
+  };
+};
+
+export function getGitClient(service: GitService, baseUrl: string | null): GitClient {
+  if (service === 'github') return githubClient(baseUrl);
+  if (service === 'gitlab') return gitlabClient(baseUrl);
+  return giteaClient(baseUrl);
+}
--- a/packages/server/src/core/git-credentials.ts
+++ b/packages/server/src/core/git-credentials.ts
@@ -0,0 +1,180 @@
+// Gestion des credentials des services git distants (P12). Les secrets (PAT/app password) sont
+// chiffrés par SecretBox AVANT insertion et ne ressortent JAMAIS via l'API (résumés sans secret).
+// getSecret()/authFor() sont INTERNES (clone, listRepos, test) — jamais routés.
+import { randomUUID } from 'node:crypto';
+import type {
+  CreateGitCredentialRequest,
+  GitCredentialSummary,
+  GitService,
+  TestCredentialResponse,
+  UpdateGitCredentialRequest,
+} from '@arboretum/shared';
+import type { Db } from '../db/index.js';
+import type { SecretBox } from './secret-box.js';
+import { getGitClient, GitServiceError, type GitAuth } from './git-clients/index.js';
+import { recordAudit } from './audit-log.js';
+
+interface GitCredentialRow {
+  id: string;
+  label: string;
+  service: GitService;
+  base_url: string | null;
+  auth_type: GitCredentialSummary['authType'];
+  username: string | null;
+  secret_encrypted: string | null;
+  ssh_key_path: string | null;
+  oauth_access_encrypted: string | null;
+  oauth_refresh_encrypted: string | null;
+  oauth_expires_at: string | null;
+  created_at: string;
+  last_tested_at: string | null;
+  test_result: string | null;
+}
+
+function httpError(statusCode: number, code: string, message: string): Error & { statusCode: number; code: string } {
+  return Object.assign(new Error(message), { statusCode, code });
+}
+
+export class GitCredentialsManager {
+  constructor(
+    private readonly db: Db,
+    private readonly box: SecretBox,
+  ) {}
+
+  private getRow(id: string): GitCredentialRow | null {
+    return (this.db.prepare('SELECT * FROM git_credentials WHERE id = ?').get(id) as unknown as GitCredentialRow | undefined) ?? null;
+  }
+
+  private toSummary(row: GitCredentialRow): GitCredentialSummary {
+    let secretLast4: string | null = null;
+    if (row.secret_encrypted) {
+      try {
+        const s = this.box.decrypt(row.secret_encrypted);
+        secretLast4 = s.length >= 4 ? s.slice(-4) : '••••';
+      } catch {
+        secretLast4 = null;
+      }
+    }
+    return {
+      id: row.id,
+      label: row.label,
+      service: row.service,
+      baseUrl: row.base_url,
+      authType: row.auth_type,
+      username: row.username,
+      hasSecret: row.secret_encrypted != null,
+      secretLast4,
+      createdAt: row.created_at,
+      lastTestedAt: row.last_tested_at,
+      testResult: row.test_result,
+    };
+  }
+
+  list(): GitCredentialSummary[] {
+    const rows = this.db.prepare('SELECT * FROM git_credentials ORDER BY created_at ASC').all() as unknown as GitCredentialRow[];
+    return rows.map((r) => this.toSummary(r));
+  }
+
+  get(id: string): GitCredentialSummary | null {
+    const row = this.getRow(id);
+    return row ? this.toSummary(row) : null;
+  }
+
+  create(opts: CreateGitCredentialRequest): GitCredentialSummary {
+    // P12a : seules les méthodes HTTPS (pat / app_password) sont supportées pour l'instant.
+    if (opts.authType !== 'pat' && opts.authType !== 'app_password') {
+      throw httpError(400, 'UNSUPPORTED_AUTH', 'Only pat and app_password are supported for now (SSH/OAuth: later phases)');
+    }
+    if (!opts.label?.trim()) throw httpError(400, 'BAD_REQUEST', 'label is required');
+    if (opts.service !== 'gitea' && opts.service !== 'gitlab' && opts.service !== 'github') {
+      throw httpError(400, 'BAD_REQUEST', 'service must be gitea, gitlab or github');
+    }
+    if (opts.service === 'gitea' && !opts.baseUrl) throw httpError(400, 'BAD_REQUEST', 'Gitea requires a base_url');
+    if (!opts.secret) throw httpError(400, 'BAD_REQUEST', 'secret (token) is required');
+    const row: GitCredentialRow = {
+      id: randomUUID(),
+      label: opts.label.trim(),
+      service: opts.service,
+      base_url: opts.baseUrl?.trim() || null,
+      auth_type: opts.authType,
+      username: opts.username?.trim() || null,
+      secret_encrypted: this.box.encrypt(opts.secret),
+      ssh_key_path: null,
+      oauth_access_encrypted: null,
+      oauth_refresh_encrypted: null,
+      oauth_expires_at: null,
+      created_at: new Date().toISOString(),
+      last_tested_at: null,
+      test_result: null,
+    };
+    this.db
+      .prepare(
+        `INSERT INTO git_credentials (id, label, service, base_url, auth_type, username, secret_encrypted, created_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+      )
+      .run(row.id, row.label, row.service, row.base_url, row.auth_type, row.username, row.secret_encrypted, row.created_at);
+    return this.toSummary(row);
+  }
+
+  update(id: string, patch: UpdateGitCredentialRequest): GitCredentialSummary {
+    const row = this.getRow(id);
+    if (!row) throw httpError(404, 'NOT_FOUND', 'No credential with this id');
+    if (patch.label !== undefined) row.label = patch.label.trim() || row.label;
+    if (patch.baseUrl !== undefined) row.base_url = patch.baseUrl.trim() || null;
+    if (patch.username !== undefined) row.username = patch.username.trim() || null;
+    if (patch.secret) row.secret_encrypted = this.box.encrypt(patch.secret);
+    this.db
+      .prepare('UPDATE git_credentials SET label = ?, base_url = ?, username = ?, secret_encrypted = ? WHERE id = ?')
+      .run(row.label, row.base_url, row.username, row.secret_encrypted, id);
+    return this.toSummary(row);
+  }
+
+  /** Supprime un credential et NULLifie repos.credential_id (pas de FK). */
+  remove(id: string): boolean {
+    const res = this.db.prepare('DELETE FROM git_credentials WHERE id = ?').run(id);
+    if (res.changes === 0) return false;
+    this.db.prepare('UPDATE repos SET credential_id = NULL WHERE credential_id = ?').run(id);
+    return true;
+  }
+
+  /** Secret déchiffré — INTERNE (clone/listRepos/test). Jamais exposé par une route. */
+  getSecret(id: string): string | null {
+    const row = this.getRow(id);
+    if (!row?.secret_encrypted) return null;
+    try {
+      return this.box.decrypt(row.secret_encrypted);
+    } catch {
+      return null;
+    }
+  }
+
+  /** Contexte d'auth (service, base, secret déchiffré) pour le client API / le clone. */
+  authContext(id: string): { service: GitService; baseUrl: string | null; auth: GitAuth } | null {
+    const row = this.getRow(id);
+    if (!row) return null;
+    const secret = this.getSecret(id);
+    if (secret == null) return null;
+    return { service: row.service, baseUrl: row.base_url, auth: { authType: row.auth_type, username: row.username, secret } };
+  }
+
+  /** Teste la connectivité/auth (GET /user) et mémorise le diagnostic. */
+  async test(id: string): Promise<TestCredentialResponse> {
+    const ctx = this.authContext(id);
+    if (!ctx) throw httpError(404, 'NOT_FOUND', 'No credential with this id');
+    const now = new Date().toISOString();
+    try {
+      const { login } = await getGitClient(ctx.service, ctx.baseUrl).verify(ctx.auth);
+      this.db.prepare('UPDATE git_credentials SET last_tested_at = ?, test_result = ? WHERE id = ?').run(now, 'ok', id);
+      return { ok: true, user: login };
+    } catch (err) {
+      const code = err instanceof GitServiceError ? err.errorCode : 'UNREACHABLE';
+      this.db.prepare('UPDATE git_credentials SET last_tested_at = ?, test_result = ? WHERE id = ?').run(now, code, id);
+      return { ok: false, error: code };
+    }
+  }
+}
+
+/** Helper d'audit partagé (jamais de secret dans details). */
+export function auditCredential(db: Db, actor: string, action: string, id: string | null): void {
+  recordAudit(db, { actor, action, resourceId: id });
+}
--- a/packages/server/src/core/git.ts
+++ b/packages/server/src/core/git.ts
@@ -1,6 +1,6 @@
 // Couche git sûre : tout passe par execFile (JAMAIS de shell), arguments en tableau, `--` avant
 // les chemins/refs utilisateur. Fonctions pures sans état, prenant un cwd déjà validé par l'appelant.
-import { execFile } from 'node:child_process';
+import { execFile, spawn } from 'node:child_process';
 import { resolve, sep } from 'node:path';
 import type { WorktreeGitStatus, WorktreeBranchAction, WorktreeBranchMode, FileChange } from '@arboretum/shared';

@@ -605,3 +605,50 @@ export function isDirtyWorktreeError(err: unknown): boolean {
  const msg = `${(err as GitError)?.stderr ?? ''} ${(err as Error)?.message ?? ''}`;
  return /contains modified or untracked files|is dirty|use --force/i.test(msg);
 }
+
+const GIT_CLONE_TIMEOUT_MS = 10 * 60_000; // 10 min : un clone réseau peut être long.
+
+export interface CloneProgress {
+  phase: string;
+  /** pourcentage 0–100 si git le rapporte, sinon null. */
+  percent: number | null;
+}
+
+/**
+ * Clone un dépôt via `git clone --progress` (P12). `spawn` (et non execFile) pour streamer la
+ * progression depuis stderr. `env` éphémère (cf. withGitAuth) porte l'auth — JAMAIS dans l'URL.
+ * `--` sépare l'URL/dest des options. L'appelant valide `dest` (sous scanRoots, non existant).
+ */
+export function cloneRepo(opts: {
+  url: string;
+  dest: string;
+  env?: NodeJS.ProcessEnv;
+  branch?: string;
+  onProgress?: (p: CloneProgress) => void;
+  signal?: AbortSignal;
+}): Promise<void> {
+  return new Promise((resolveP, reject) => {
+    const args = ['clone', '--progress'];
+    if (opts.branch) args.push('--branch', opts.branch);
+    args.push('--', opts.url, opts.dest);
+    const child = spawn('git', args, {
+      env: { ...(opts.env ?? process.env), GIT_TERMINAL_PROMPT: '0', LC_ALL: 'C' },
+      stdio: ['ignore', 'ignore', 'pipe'],
+      timeout: GIT_CLONE_TIMEOUT_MS,
+      ...(opts.signal ? { signal: opts.signal } : {}),
+    });
+    let stderr = '';
+    child.stderr.on('data', (d: Buffer) => {
+      const s = d.toString();
+      stderr += s;
+      if (stderr.length > 64 * 1024) stderr = stderr.slice(-64 * 1024); // borne mémoire
+      const m = /([A-Za-z][A-Za-z ]+):\s+(\d+)%/.exec(s);
+      if (m && m[1] && m[2] && opts.onProgress) opts.onProgress({ phase: m[1].trim(), percent: Number(m[2]) });
+    });
+    child.on('error', (err) => reject(err));
+    child.on('close', (code) => {
+      if (code === 0) resolveP();
+      else reject(new Error(stderr.trim().split('\n').pop() || `git clone exited with code ${code}`));
+    });
+  });
+}
--- a/packages/server/src/db/index.ts
+++ b/packages/server/src/db/index.ts
@@ -154,6 +154,43 @@ const MIGRATIONS: Array<{ id: number; sql: string }> = [
      CREATE INDEX idx_sessions_archived_at ON sessions(archived_at);
    `,
  },
+  {
+    // P12 — connexions aux services git distants (Gitea/GitLab/GitHub). Les SECRETS (PAT, app
+    // password, tokens OAuth) sont chiffrés par SecretBox AVANT insertion (colonnes *_encrypted) :
+    // la base ne contient jamais de secret en clair. `ssh_key_path`/`oauth_*` sont posés dès
+    // maintenant (schéma stable) mais exploités en P12b/P12c. `test_result` = dernier diagnostic.
+    id: 11,
+    sql: `
+      CREATE TABLE git_credentials (
+        id                       TEXT PRIMARY KEY,
+        label                    TEXT NOT NULL,
+        service                  TEXT NOT NULL CHECK (service IN ('gitea','gitlab','github')),
+        base_url                 TEXT,
+        auth_type                TEXT NOT NULL CHECK (auth_type IN ('pat','app_password','ssh_key','oauth')),
+        username                 TEXT,
+        secret_encrypted         TEXT,
+        ssh_key_path             TEXT,
+        oauth_access_encrypted   TEXT,
+        oauth_refresh_encrypted  TEXT,
+        oauth_expires_at         TEXT,
+        created_at               TEXT NOT NULL,
+        last_tested_at           TEXT,
+        test_result              TEXT
+      );
+      CREATE INDEX idx_git_credentials_service ON git_credentials(service);
+    `,
+  },
+  {
+    // P12 — un repo enregistré peut provenir d'un clone : on retient sa source (remote_url),
+    // le service détecté et le credential utilisé. PAS de FK sur credential_id (cohérent avec
+    // sessions.group_id #8) : la suppression d'un credential nullifie ce champ côté manager.
+    id: 12,
+    sql: `
+      ALTER TABLE repos ADD COLUMN remote_url TEXT;
+      ALTER TABLE repos ADD COLUMN git_service TEXT;
+      ALTER TABLE repos ADD COLUMN credential_id TEXT;
+    `,
+  },
 ];

 export type Db = DatabaseSync;
--- a/packages/server/src/routes/git-connections.ts
+++ b/packages/server/src/routes/git-connections.ts
@@ -0,0 +1,119 @@
+// Routes des services git distants (P12) : CRUD des credentials (secrets JAMAIS renvoyés), test de
+// connexion, listing des dépôts distants, et lancement/suivi d'un clone. Authentifiées par le hook
+// preValidation global. Les secrets sont chiffrés par SecretBox dans le manager.
+import type { FastifyInstance, FastifyReply } from 'fastify';
+import type {
+  CloneRequest,
+  CloneStartResponse,
+  CloneStatusResponse,
+  CreateGitCredentialRequest,
+  GitCredentialResponse,
+  GitCredentialsListResponse,
+  RemoteReposResponse,
+  UpdateGitCredentialRequest,
+} from '@arboretum/shared';
+import type { Db } from '../db/index.js';
+import type { GitCredentialsManager } from '../core/git-credentials.js';
+import type { CloneManager } from '../core/clone-manager.js';
+import { getGitClient, GitServiceError } from '../core/git-clients/index.js';
+import { recordAudit } from '../core/audit-log.js';
+
+function sendError(reply: FastifyReply, err: unknown): FastifyReply {
+  const e = err as { statusCode?: number; code?: string; message?: string };
+  const status = typeof e.statusCode === 'number' ? e.statusCode : 500;
+  return reply.status(status).send({ error: { code: e.code ?? 'INTERNAL', message: e.message ?? 'Internal error' } });
+}
+
+const GIT_SERVICE_ERROR_STATUS: Record<string, number> = { AUTH_FAILED: 401, RATE_LIMITED: 429, UNREACHABLE: 502, BAD_BASE_URL: 400 };
+
+export function registerGitConnectionRoutes(
+  app: FastifyInstance,
+  credentials: GitCredentialsManager,
+  clones: CloneManager,
+  db: Db,
+): void {
+  const actor = (req: { authContext?: { tokenId: string } | null }): string => req.authContext?.tokenId ?? 'unknown';
+
+  app.get('/api/v1/git-connections', async (): Promise<GitCredentialsListResponse> => ({ credentials: credentials.list() }));
+
+  app.post('/api/v1/git-connections', async (req, reply) => {
+    try {
+      const cred = credentials.create((req.body ?? {}) as CreateGitCredentialRequest);
+      recordAudit(db, { actor: actor(req), action: 'git_credential.create', resourceId: cred.id, details: { service: cred.service, authType: cred.authType } });
+      const res: GitCredentialResponse = { credential: cred };
+      return reply.status(201).send(res);
+    } catch (err) {
+      return sendError(reply, err);
+    }
+  });
+
+  app.patch('/api/v1/git-connections/:id', async (req, reply) => {
+    try {
+      const cred = credentials.update((req.params as { id: string }).id, (req.body ?? {}) as UpdateGitCredentialRequest);
+      recordAudit(db, { actor: actor(req), action: 'git_credential.update', resourceId: cred.id });
+      const res: GitCredentialResponse = { credential: cred };
+      return reply.send(res);
+    } catch (err) {
+      return sendError(reply, err);
+    }
+  });
+
+  app.delete('/api/v1/git-connections/:id', async (req, reply) => {
+    const { id } = req.params as { id: string };
+    if (!credentials.remove(id)) {
+      return reply.status(404).send({ error: { code: 'NOT_FOUND', message: 'No credential with this id' } });
+    }
+    recordAudit(db, { actor: actor(req), action: 'git_credential.delete', resourceId: id });
+    return reply.send({ ok: true });
+  });
+
+  app.post('/api/v1/git-connections/:id/test', async (req, reply) => {
+    try {
+      const result = await credentials.test((req.params as { id: string }).id);
+      recordAudit(db, { actor: actor(req), action: 'git_credential.test', resourceId: (req.params as { id: string }).id, details: { ok: result.ok } });
+      return reply.send(result);
+    } catch (err) {
+      return sendError(reply, err);
+    }
+  });
+
+  app.get('/api/v1/git-connections/:id/repos', async (req, reply) => {
+    const { id } = req.params as { id: string };
+    const q = req.query as { page?: string; search?: string };
+    const ctx = credentials.authContext(id);
+    if (!ctx) return reply.status(404).send({ error: { code: 'NOT_FOUND', message: 'No usable credential with this id' } });
+    const page = Math.max(1, Number(q.page) || 1);
+    try {
+      const { repos, nextPage } = await getGitClient(ctx.service, ctx.baseUrl).listRepos(ctx.auth, page, q.search);
+      const res: RemoteReposResponse = { repos, nextPage };
+      return reply.send(res);
+    } catch (err) {
+      if (err instanceof GitServiceError) {
+        return reply.status(GIT_SERVICE_ERROR_STATUS[err.errorCode] ?? 502).send({ error: { code: err.errorCode, message: err.message } });
+      }
+      return sendError(reply, err);
+    }
+  });
+
+  // ---- Clone (asynchrone : 202 + suivi WS/REST) ----
+  app.post('/api/v1/repos/clone', async (req, reply) => {
+    const body = (req.body ?? {}) as Partial<CloneRequest>;
+    if (typeof body.credentialId !== 'string' || typeof body.remoteUrl !== 'string' || typeof body.dest !== 'string') {
+      return reply.status(400).send({ error: { code: 'BAD_REQUEST', message: 'credentialId, remoteUrl and dest are required' } });
+    }
+    try {
+      const operationId = await clones.start({ credentialId: body.credentialId, remoteUrl: body.remoteUrl, dest: body.dest }, actor(req));
+      const res: CloneStartResponse = { operationId };
+      return reply.status(202).send(res);
+    } catch (err) {
+      return sendError(reply, err);
+    }
+  });
+
+  app.get('/api/v1/repos/clone/:id', async (req, reply) => {
+    const op = clones.get((req.params as { id: string }).id);
+    if (!op) return reply.status(404).send({ error: { code: 'NOT_FOUND', message: 'No clone operation with this id' } });
+    const res: CloneStatusResponse = { operation: op };
+    return reply.send(res);
+  });
+}
--- a/packages/server/src/ws/gateway.ts
+++ b/packages/server/src/ws/gateway.ts
@@ -7,6 +7,7 @@ import {
  parseClientMessage,
  type GroupSummary,
  type RepoSummary,
+  type CloneOperation,
  type ServerMessage,
  type SessionSummary,
  type SettingsBroadcast,
@@ -18,6 +19,7 @@ import type { SessionArchiveService } from '../core/session-archive.js';
 import type { WorktreeManager } from '../core/worktree-manager.js';
 import type { GroupManager } from '../core/group-manager.js';
 import type { SettingsBus } from '../core/settings-bus.js';
+import type { CloneManager } from '../core/clone-manager.js';

 const HEARTBEAT_MS = 30_000;

@@ -34,6 +36,7 @@ export function registerWsGateway(
  worktrees: WorktreeManager,
  groups: GroupManager,
  settingsBus: SettingsBus,
+  clones: CloneManager,
  serverVersion: string,
 ): void {
  app.get('/ws', { websocket: true }, (socket: WebSocket, req) => {
@@ -45,6 +48,7 @@ export function registerWsGateway(
    let subscribedWorktrees = false;
    let subscribedGroups = false;
    let subscribedSettings = false;
+    let subscribedClones = false;
    let alive = true;
    // Worktrees « regardés » par CETTE connexion (clé repoId\0path) → push ciblé de worktree_changes.
    const watched = new Set<string>();
@@ -93,6 +97,10 @@ export function registerWsGateway(
    const onSettingsUpdate = (settings: SettingsBroadcast): void => {
      if (subscribedSettings) send({ type: 'settings_update', settings });
    };
+    // P12 — progression d'un clone : relayée aux abonnés du topic 'clones'.
+    const onCloneUpdate = (operation: CloneOperation): void => {
+      if (subscribedClones) send({ type: 'clone_update', operation });
+    };
    // P7 — détail d'un worktree modifié : poussé UNIQUEMENT si cette connexion le regarde.
    const onWorktreeChanges = (e: { repoId: string; path: string }): void => {
      if (watched.has(watchKey(e.repoId, e.path))) send({ type: 'worktree_changes', ...e });
@@ -109,6 +117,7 @@ export function registerWsGateway(
    groups.on('group_update', onGroupUpdate);
    groups.on('group_removed', onGroupRemoved);
    settingsBus.on('settings_update', onSettingsUpdate);
+    clones.on('clone_update', onCloneUpdate);

    const heartbeat = setInterval(() => {
      if (!alive) {
@@ -149,6 +158,7 @@ export function registerWsGateway(
          subscribedWorktrees = msg.topics.includes('worktrees');
          subscribedGroups = msg.topics.includes('groups');
          subscribedSettings = msg.topics.includes('settings');
+          subscribedClones = msg.topics.includes('clones');
          return;
        }
        case 'watch': {
@@ -261,6 +271,7 @@ export function registerWsGateway(
      groups.off('group_update', onGroupUpdate);
      groups.off('group_removed', onGroupRemoved);
      settingsBus.off('settings_update', onSettingsUpdate);
+      clones.off('clone_update', onCloneUpdate);
      for (const [, st] of channels) manager.detach(st.sessionId, st.binding);
      channels.clear();
      // Libère le refcount du watcher pour chaque worktree regardé par cette connexion.
--- a/packages/server/test/git-credentials.test.ts
+++ b/packages/server/test/git-credentials.test.ts
@@ -0,0 +1,54 @@
+// Credentials git (P12) : round-trip SecretBox, résumé SANS secret, NULLification à la suppression.
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { openDb, type Db } from '../src/db/index.js';
+import { SecretBox } from '../src/core/secret-box.js';
+import { GitCredentialsManager } from '../src/core/git-credentials.js';
+
+let db: Db;
+let mgr: GitCredentialsManager;
+const SECRET = 'pat-super-secret-1234';
+
+beforeEach(() => {
+  db = openDb(':memory:');
+  mgr = new GitCredentialsManager(db, new SecretBox(Buffer.alloc(32, 7)));
+});
+afterEach(() => db.close());
+
+describe('GitCredentialsManager', () => {
+  it('crée un credential : secret chiffré en DB, résumé sans secret', () => {
+    const cred = mgr.create({ label: 'gh', service: 'github', authType: 'pat', secret: SECRET });
+    expect(cred.hasSecret).toBe(true);
+    expect(cred.secretLast4).toBe('1234');
+    // le résumé sérialisé ne contient JAMAIS le secret en clair.
+    expect(JSON.stringify(cred)).not.toContain(SECRET);
+    // en DB : valeur chiffrée (préfixe v1:), jamais le clair.
+    const row = db.prepare('SELECT secret_encrypted FROM git_credentials WHERE id = ?').get(cred.id) as { secret_encrypted: string };
+    expect(row.secret_encrypted.startsWith('v1:')).toBe(true);
+    expect(row.secret_encrypted).not.toContain(SECRET);
+  });
+
+  it('getSecret déchiffre (round-trip)', () => {
+    const cred = mgr.create({ label: 'gl', service: 'gitlab', authType: 'pat', secret: SECRET });
+    expect(mgr.getSecret(cred.id)).toBe(SECRET);
+  });
+
+  it('exige un base_url pour Gitea', () => {
+    expect(() => mgr.create({ label: 'x', service: 'gitea', authType: 'pat', secret: SECRET })).toThrow();
+    expect(mgr.create({ label: 'x', service: 'gitea', authType: 'pat', baseUrl: 'https://git.example.com', secret: SECRET }).baseUrl).toBe('https://git.example.com');
+  });
+
+  it('refuse ssh_key/oauth pour l’instant (P12a)', () => {
+    expect(() => mgr.create({ label: 'x', service: 'github', authType: 'ssh_key', secret: SECRET })).toThrow();
+    expect(() => mgr.create({ label: 'x', service: 'github', authType: 'oauth', secret: SECRET })).toThrow();
+  });
+
+  it('remove() NULLifie repos.credential_id (pas de FK)', () => {
+    const cred = mgr.create({ label: 'gh', service: 'github', authType: 'pat', secret: SECRET });
+    db.prepare(
+      "INSERT INTO repos (id, path, label, post_create_hooks, pre_trust, created_at, hidden, credential_id) VALUES ('r1', '/tmp/r1', 'r1', '[]', 0, '2020-01-01T00:00:00Z', 0, ?)",
+    ).run(cred.id);
+    expect(mgr.remove(cred.id)).toBe(true);
+    const repo = db.prepare("SELECT credential_id FROM repos WHERE id = 'r1'").get() as { credential_id: string | null };
+    expect(repo.credential_id).toBeNull();
+  });
+});