Tracer: paste a GitHub repo, see it in the Marketplace modal, install it #916

Parent

#913 (Bot Marketplace Phase 1 spec) · #18 · ADR-0131

What to build

The thinnest end-to-end Bot Marketplace path. An author pastes the URL of a public GitHub repository carrying the botharness-bot topic; the new Marketplace Worker fetches it immediately and stores it as an Indexed Repository in its own D1 database. A Human opens the Bot Marketplace modal from the harness and sees it in a simple list (name, description, tags, stars, last update), ordered by most recently updated. Install opens a confirmation showing the latest commit time, short SHA and the third-party risk/disclaimer notice; confirming creates a fresh PersonaBot through the existing createFromGit path with GitHub as origin.

This slice establishes the Worker package, its D1 schema (repositories keyed by GitHub node ID with visibility state), the paste-to-crawl endpoint (with its typed refusal reasons: not found, private, archived, missing topic), a minimal list endpoint, the Host bridge methods the Client uses to reach the Worker, and the modal. Anti-abuse, scheduled crawling, search, README detail, shared presentation and the public site API are later slices.

Acceptance criteria

• A Worker package with its own D1 migration runs locally; repositories are keyed by GitHub node ID and carry a visibility state.
• Pasting a qualifying repository URL lists it immediately; non-qualifying URLs return a typed reason (not found, private, archived, missing botharness-bot topic).
• The list endpoint returns only listed entries.
• Host bridge methods reach the Worker; the Client never fetches the Worker directly.
• The harness opens a Bot Marketplace modal that lists entries and lets the Human paste a URL.
• Install shows commit time, short SHA and the risk notice, then creates a fresh PersonaBot via createFromGit with origin on GitHub; a failed clone leaves no Bot; installing twice creates two Bots.
• Worker boundary tests run against local D1 with a fake GitHub; Host bridge and Client modal tests follow existing bridge RPC and PersonaBot creation test prior art.
• Runnable acceptance: a real test repository with the topic is pasted, listed in the modal of an isolated local DSH instance, and installed.

Blocked by

None (can start immediately).