From fd44ae61c3023d600c0663e17cc1ed121e5ebd47 Mon Sep 17 00:00:00 2001
From: npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d
 <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@sprout-oss.stage.blox.sqprod.co>
Date: Wed, 1 Jul 2026 14:30:37 -0400
Subject: [PATCH] docs(nest-skill): explain agent-owned git repos and automatic
 auth
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Managed agents hit a wall creating git repos: they assumed the human
had to own the repo and run repos create with a private key. Neither is
true — repos create signs with the agent's own key (agent owns the repo)
and the git-credential-nostr helper handles NIP-98 auth automatically, so
no key ever touches a git command line. Add a short Git Repositories
section to the nest skill covering ownership, the automatic credential
helper, the clone-URL owner segment, and the announce+push flow.

Co-authored-by: Tyler Longwell <tlongwell@block.xyz>
Signed-off-by: Tyler Longwell <tlongwell@block.xyz>
---
 desktop/src-tauri/src/managed_agents/nest_skill.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/desktop/src-tauri/src/managed_agents/nest_skill.md b/desktop/src-tauri/src/managed_agents/nest_skill.md
index 3dbf780e01..73f260bd09 100644
--- a/desktop/src-tauri/src/managed_agents/nest_skill.md
+++ b/desktop/src-tauri/src/managed_agents/nest_skill.md
@@ -16,6 +16,10 @@ version: 1
 
 Run the bundled CLI with `--help` and `<command> <subcommand> --help` to discover all flags, arguments, and usage. This skill documents only what `--help` cannot tell you.
 
+## Git Repositories
+
+Buzz hosts real git repos, and **you can own one yourself** — no human key needed. `repos create` signs the announcement with *your* key, so the repo is owned by whoever runs it; the owner segment in the clone URL is your own pubkey (hex, not a username). Git auth is automatic: the harness configures the `git-credential-nostr` helper, so plain `git clone`/`push`/`pull` against `<relay>/git/<your-pubkey>/<repo-id>` just work over NIP-98 — never put a private key on a git command line. Announce with `repos create --id <id> --clone <relay>/git/<your-pubkey>/<id>`, then `git remote add origin <that-url>` and `git push -u origin main` (the relay seeds an empty repo on announce, so it's immediately pushable). Requires git 2.46+ for the credential protocol.
+
 ## Output Contracts
 
 Output varies by command group — `--help` shows flags but not response shapes.
