Wire secret-ref git delivery end to end

api/swarm/router.py

@@ -50,6 +50,62 @@ def generate_agent_id(role: str) -> str:
     return f"agi_{role}_{uuid.uuid4().hex[:8]}"
 
 
+def _extract_git_project_context(plan: Dict[str, Any], payload: Dict[str, Any]) -> Dict[str, Any]:
+    """Derive git runtime context from Manager-provided resource grants and metadata."""
+    resource_grants = plan.get("resource_grants") or payload.get("resource_grants") or []
+    metadata = plan.get("metadata") or payload.get("metadata") or {}
+    git_binding_id = (
+        payload.get("git_binding_id")
+        or metadata.get("git_binding_id")
+        or metadata.get("resource_binding_id")
+    )
+
+    selected_git_grant = None
+    for grant in resource_grants:
+        grant_type = (grant.get("resource_type") or grant.get("type") or "").lower()
+        if grant_type != "git":
+            continue
+        if git_binding_id and git_binding_id not in {
+            grant.get("resource_id"),
+            grant.get("grant_id"),
+            grant.get("binding_id"),
+        }:
+            continue
+        selected_git_grant = grant
+        break
+
+    if not selected_git_grant:
+        return {}
+
+    grant_metadata = selected_git_grant.get("metadata") or {}
+    repo_url = (
+        grant_metadata.get("repo_url")
+        or selected_git_grant.get("external_ref")
+        or selected_git_grant.get("repo_url")
+    )
+    branch = (
+        payload.get("branch")
+        or plan.get("branch")
+        or grant_metadata.get("default_branch")
+        or grant_metadata.get("base_branch")
+        or "main"
+    )
+    allowed_paths = (
+        payload.get("allowed_paths")
+        or plan.get("allowed_paths")
+        or grant_metadata.get("allowed_paths")
+    )
+
+    return {
+        "repo_url": repo_url,
+        "branch": branch,
+        "git_binding_id": git_binding_id
+        or selected_git_grant.get("resource_id")
+        or selected_git_grant.get("grant_id"),
+        "allowed_paths": allowed_paths,
+    }
+
+
 def _agent_infos_for_swarm(db: Session, swarm_id: str) -> list[SwarmAgentInfo]:
     """Build response agent summaries for a swarm."""
     agents = db.query(SwarmAgent).filter(SwarmAgent.swarm_id == swarm_id).all()
@@ -449,6 +505,7 @@ async def create_swarm_compat(
     project_context = plan.get("project_context") or {}
     if not isinstance(project_context, dict):
         project_context = {}
+    git_project_context = _extract_git_project_context(plan, payload)
     project_context = {
         **project_context,
         "intent_id": plan.get("intent_id"),
@@ -467,6 +524,7 @@ async def create_swarm_compat(
         "heicode_deployment_id": payload.get("deployment_id")
         or metadata.get("heicode_deployment_id")
         or metadata.get("manager_deployment_id"),
+        **git_project_context,
     }
 
     swarm_request = SwarmCreateRequest(

k8s/agent-manager-deployment.yaml

@@ -31,7 +31,7 @@ spec:
       
       containers:
       - name: agent-manager
-        image: agnettaiji.azurecr.io/ai-agents/agent-manager:heicode-v2-runtime-20260603110450-arm64
+        image: agnettaiji.azurecr.io/ai-agents/agent-manager:heicode-v2-runtime-20260603140537-arm64
         imagePullPolicy: Always
         
         ports:

k8s/deployment-with-kubeconfig.yaml

@@ -22,7 +22,7 @@ spec:
         - name: acr-secret
       containers:
         - name: agent-manager
-          image: agnettaiji.azurecr.io/ai-agents/agent-manager:heicode-v2-runtime-20260603110450-arm64
+          image: agnettaiji.azurecr.io/ai-agents/agent-manager:heicode-v2-runtime-20260603140537-arm64
           imagePullPolicy: Always
           ports:
             - containerPort: 8000

k8s/deployment.yaml

@@ -20,7 +20,7 @@ spec:
         - name: acr-secret
       containers:
         - name: agent-manager
-          image: agnettaiji.azurecr.io/ai-agents/agent-manager:heicode-v2-runtime-20260603110450-arm64
+          image: agnettaiji.azurecr.io/ai-agents/agent-manager:heicode-v2-runtime-20260603140537-arm64
           imagePullPolicy: Always
           ports:
             - containerPort: 8000

tests/test_sub_mode_runtime_contract.py

@@ -109,3 +109,6 @@ def test_runtime_rich_workflow_contract_is_present():
     deployments_source = _read("api/agnet/deployments.py")
     assert "_emit_artifact_edit_event(swarm, request, \"artifact.local_edit_conflict\")" in deployments_source
     assert "mode: Optional[str] = None" in swarm_models_source
+    assert "_extract_git_project_context" in swarm_router_source
+    assert "git_binding_id" in swarm_router_source
+    assert "allowed_paths" in swarm_router_source