From 7905ea405403aa10ee1c02a2764d33907f37c0c3 Mon Sep 17 00:00:00 2001
From: Hare <kei.hiracchi.0928@gmail.com>
Date: Wed, 23 Sep 2026 02:57:48 +0900
Subject: [PATCH] fix: grant default repository credential write access

---
 crates/workspace-server/src/repository_access.rs            | 6 +++---
 .../w/[workspaceId]/settings/repository-access/+page.svelte | 2 +-
 web/workspace/test/repository-access/ui.test.ts             | 2 ++
 3 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/crates/workspace-server/src/repository_access.rs b/crates/workspace-server/src/repository_access.rs
index 226db2532..9a916a780 100644
--- a/crates/workspace-server/src/repository_access.rs
+++ b/crates/workspace-server/src/repository_access.rs
@@ -1123,7 +1123,7 @@ impl RepositorySecretService {
             repository_key: repository_key.to_string(),
             credential_id: WORKSPACE_DEFAULT_REPOSITORY_SSH_CREDENTIAL_ID.to_string(),
             host_trust_id: host_trust.host_trust_id.clone(),
-            access: RepositoryAccessMode::ReadOnly,
+            access: RepositoryAccessMode::ReadWrite,
         }))
     }
 
@@ -2377,7 +2377,7 @@ mod tests {
     }
 
     #[test]
-    fn default_binding_resolves_unique_host_trust_for_url_and_scp_ssh_sources() {
+    fn default_binding_is_read_write_for_unique_host_trust_and_ssh_sources() {
         let (_dir, _store, service) = test_service();
         assert!(
             service
@@ -2418,7 +2418,7 @@ mod tests {
                 WORKSPACE_DEFAULT_REPOSITORY_SSH_CREDENTIAL_ID
             );
             assert_eq!(binding.host_trust_id, "example");
-            assert_eq!(binding.access, RepositoryAccessMode::ReadOnly);
+            assert_eq!(binding.access, RepositoryAccessMode::ReadWrite);
         }
         assert!(
             service
diff --git a/web/workspace/src/routes/w/[workspaceId]/settings/repository-access/+page.svelte b/web/workspace/src/routes/w/[workspaceId]/settings/repository-access/+page.svelte
index 867873886..35120a0fd 100644
--- a/web/workspace/src/routes/w/[workspaceId]/settings/repository-access/+page.svelte
+++ b/web/workspace/src/routes/w/[workspaceId]/settings/repository-access/+page.svelte
@@ -293,7 +293,7 @@
     <div><p class="eyebrow">owner only</p><h2>Repository Access</h2></div>
     <span class="badge success">encrypted</span>
   </header>
-  <p>The Workspace default SSH key is generated separately from the Runtime authentication identity and is always offered during SSH clone. Without an explicit Repository binding, a unique pinned host trust matching the Repository URI is used with this default key. A binding can add one dedicated credential; OpenSSH receives both candidates and tries them through one operation-scoped agent. Private keys and passphrases remain write-only.</p>
+  <p>The Workspace default SSH key is generated separately from the Runtime authentication identity and is always offered during SSH clone. Without an explicit Repository binding, a unique pinned host trust matching the Repository URI is used with this default key and normal read/write Git access. An explicit binding can select read-only access or add one dedicated credential; OpenSSH receives both credential candidates and tries them through one operation-scoped agent. Private keys and passphrases remain write-only.</p>
   {#if message}<p class="status-message">{message}</p>{/if}
 
   <div class="settings-runtime-list">
diff --git a/web/workspace/test/repository-access/ui.test.ts b/web/workspace/test/repository-access/ui.test.ts
index c9b785062..3360423d9 100644
--- a/web/workspace/test/repository-access/ui.test.ts
+++ b/web/workspace/test/repository-access/ui.test.ts
@@ -77,6 +77,8 @@ test("Repository Access generates and copies selectable public keys", () => {
       "publicKeys[credential.credential_id]",
       "workspace-default",
       "always offered during SSH clone",
+      "normal read/write Git access",
+      "explicit binding can select read-only access",
     ]
   ) {
     assert(