bug: agent-type rename migration (#670) misses secret table + token file paths #741
Labels
No labels
area:agents
area:dashboard
area:database
area:design
area:design-review
area:flows
area:infra
area:meta
area:security
area:sessions
area:webhook
area:workdir
security
type:bug
type:chore
type:meta
type:user-story
No milestone
No project
No assignees
2 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
charles/claude-hooks#741
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
The agent-type rename migration
#670(boss → code-lead, foreman → architect) migrates DB rows in theagentstable but leaves two other artifacts pointing at old names:secrettable rows namedFORGEJO_TOKEN_BOSS,FORGEJO_TOKEN_FOREMAN— never renamed toFORGEJO_TOKEN_CODE_LEAD,FORGEJO_TOKEN_ARCHITECT. Result: render-to-disk fails at boot withsecret "FORGEJO_TOKEN_CODE_LEAD" referenced by ${SECRET:FORGEJO_TOKEN_CODE_LEAD} is not in the secret store. Render-queue retries every few seconds, never succeeds. Container env never materialized → dispatched tasks silently no-op (no error path; flow'sagent.dispatchenqueues onto a worker whose container has no creds, container start fails or blocks).~/.config/claude-hooks/tokens/<type>— the migration does not renametokens/boss→tokens/code-leadortokens/foreman→tokens/architect. Result: at boot,webhook-config.parseTypeTokenFileslogsno forgejo token for type code-lead at .../tokens/code-leadbecauseagents.jsonalready points at the new path but the filesystem still has the old name. Operator must do themvmanually.Both artifacts carry agent-type names baked into their identifiers and must move together with the DB row migration to be useful.
Reproduction (already observed)
#670to a service that previously ranboss/foreman.[webhook] no forgejo token for type code-lead at /home/charles/.config/claude-hooks/tokens/code-lead[startup] render-to-disk for code-lead-2 failed: secret "FORGEJO_TOKEN_CODE_LEAD" ... is not in the secret storecode-lead. Webhook fires, flow runs, but no[code-lead-*] enqueuedlog line appears. Container stays inCreatedstate. Issue sits IDLE indefinitely.Acceptance criteria
Migration: rename
secretrows alongside agent rowsboss→code-lead/foreman→architectfor theagentstable extends to thesecrettable.(old, new):secrethasFORGEJO_TOKEN_<OLD_UPPER>and notFORGEJO_TOKEN_<NEW_UPPER>:UPDATE secret SET name='FORGEJO_TOKEN_<NEW_UPPER>' WHERE name='FORGEJO_TOKEN_<OLD_UPPER>'.[agents] secret rename skipped: FORGEJO_TOKEN_<NEW_UPPER> already present, dropping orphan FORGEJO_TOKEN_<OLD_UPPER>. Drop the orphan to avoid leaving stale rows.[agents] migrated <N> secret row(s) → code-lead / architect (#670).foo→bar) cover bothagentsrows and any secret named<UPPER>_TOKEN_FOO/FOO_TOKEN. Consider a regex sweep^(.*)_(?:TOKEN_)?<OLD_UPPER>$→ re-target with<NEW_UPPER>.Migration: rename token files alongside agent rows
~/.config/claude-hooks/tokens/(path from env or config) for files named after old types. For each(old, new)pair: iftokens/<old>exists andtokens/<new>does not,rename(2)it. If both exist, leave the new one and log warning. If neither exists, no-op.agent-env/<old>→agent-env/<new>directory (today this dir is per-instance not per-type, but check the actual layout). If the migration does not own this rename, the boot log MUST direct the operator to do it manually with the exactmvcommands.[agents] renamed <N> token file(s) → tokens/code-lead, tokens/architect.Operator escape hatch
mvcommands the operator must run, instead of silent failure.Tests
agentswithbossrow +secretwithFORGEJO_TOKEN_BOSS+ create a temptokens/bossfile. Run migration. Assert:agentsrow renamed tocode-leadsecretrow renamed toFORGEJO_TOKEN_CODE_LEADtokens/bossgone,tokens/code-leadpresent with same contentFORGEJO_TOKEN_BOSSandFORGEJO_TOKEN_CODE_LEAD. Assert: orphanBOSSdropped, warning logged,CODE_LEADvalue preserved.agents.jsontoken paths. Assert: filesystem and DB both align after first boot, no manual intervention required.Out of scope
PENPOT_TOKENmissing-from-secret-store gap discovered in the same investigation. That is a separate dashboard onboarding bug — designer / design-reviewer agents fail render-to-disk because nobody ever entered the Penpot token. Track separately.tokens/<type>.github,tokens/<type>.gitlab) — out of scope until FM-3 ships.agent-env/.code-lead.empty.bakleft behind during the manual mv (operator removes after confirming sound).References
#670— original rename migration that this completes.agent_role_rename_2026_05_02.md— operator-side migration record.code-leadbecause of the missed secret + token-file rename.🦵 @charles kicked the queue — re-running implement on @dev.
🦵 @charles kicked the queue — re-running implement on @dev.