TOK-2: Drop filesystem token reads from the runtime #758

New issue

Closed

opened 2026-05-02 17:28:02 +00:00 by claude-desktop · 0 comments

claude-desktop commented

2026-05-02 17:28:02 +00:00

Collaborator

As a platform engineer, I want every runtime path that reads ~/.config/claude-hooks/tokens/* to swap to getAgentToken(), so that token bytes never traverse the filesystem at runtime — only the encrypted-secret resolver — and revoking a token at scope='global' invalidates it immediately.

Acceptance criteria

Loader

Grep shows zero readFileSync(token_file) outside the TOK-1 migration sweep.
Container env-render (background/render-agent-env.ts / agent-env-sync) writes the resolved token into the per-agent .credentials.json from the secret resolver, not from the filesystem.

Behaviour

Revoking a token at scope='global' invalidates the next dispatch immediately (the dispatched agent's Forgejo client gets a 401, dispatch fails fast).

Tests

Existing dispatch tests pass.
New: revoke a token at scope='global', dispatch, assert the dispatch fails with a 401-shaped error.

Out of scope

Per-instance token override — TOK-3.
Audit log surfacing — TOK-4.

References

Spec: specs/config-to-db.md § Story TOK-2.
Blocked by: TOK-1.

As a platform engineer, I want every runtime path that reads `~/.config/claude-hooks/tokens/*` to swap to `getAgentToken()`, so that token bytes never traverse the filesystem at runtime — only the encrypted-secret resolver — and revoking a token at `scope='global'` invalidates it immediately. ## Acceptance criteria ### Loader - [ ] Grep shows zero `readFileSync(token_file)` outside the TOK-1 migration sweep. - [ ] Container env-render (`background/render-agent-env.ts` / `agent-env-sync`) writes the resolved token into the per-agent `.credentials.json` from the secret resolver, not from the filesystem. ### Behaviour - [ ] Revoking a token at `scope='global'` invalidates the next dispatch immediately (the dispatched agent's Forgejo client gets a 401, dispatch fails fast). ### Tests - [ ] Existing dispatch tests pass. - [ ] New: revoke a token at `scope='global'`, dispatch, assert the dispatch fails with a 401-shaped error. ## Out of scope - Per-instance token override — TOK-3. - Audit log surfacing — TOK-4. ## References - Spec: `specs/config-to-db.md` § Story TOK-2. - Blocked by: TOK-1.

claude-desktop added the

area:security

type:user-story

labels

2026-05-02 17:28:59 +00:00

claude-desktop added this to the Config to DB milestone

2026-05-02 17:29:00 +00:00