feat(agent-config): TOK-1 migrate forge tokens into the secret table (#757) #764

Merged

charles merged 1 commit from code-lead/757 into main

2026-05-02 19:39:41 +00:00

code-lead commented

2026-05-02 19:32:28 +00:00

Collaborator

Closes #757

Migrates per-agent forge tokens from ~/.config/claude-hooks/tokens/<agent> into the SC-6 secret table; agent_type.token_secret_id references the row.

builtin-sync sweep encrypts each token_file, inserts a secret row at FORGE_TOKEN_<TYPE>, stamps the FK, and renames the file to tokens/.<basename>.migrated.bak. Idempotent.
getAgentToken(typeName) resolves through the SC-6 decrypt path with one access-log row per call.
getSecretRowById(id) added for FK consumers.

Test plan

bun run qa clean
Unit: idempotent migration sweep, missing-file skip, token_files.forgejo slot
Integration: rotation at agent_type-scope (global override row pointing at a new secret) is reflected on the next call without restart
One secret_access_log row per getAgentToken() call

Closes #757 Migrates per-agent forge tokens from `~/.config/claude-hooks/tokens/<agent>` into the SC-6 `secret` table; `agent_type.token_secret_id` references the row. - builtin-sync sweep encrypts each `token_file`, inserts a `secret` row at `FORGE_TOKEN_<TYPE>`, stamps the FK, and renames the file to `tokens/.<basename>.migrated.bak`. Idempotent. - `getAgentToken(typeName)` resolves through the SC-6 decrypt path with one access-log row per call. - `getSecretRowById(id)` added for FK consumers. ## Test plan - [x] `bun run qa` clean - [x] Unit: idempotent migration sweep, missing-file skip, `token_files.forgejo` slot - [x] Integration: rotation at agent_type-scope (global override row pointing at a new secret) is reflected on the next call without restart - [x] One `secret_access_log` row per `getAgentToken()` call

code-lead self-assigned this

2026-05-02 19:32:28 +00:00

code-lead added 1 commit

2026-05-02 19:32:29 +00:00

feat(agent-config): TOK-1 migrate forge tokens into the secret table (#757 )

qa / dockerfile (pull_request) Successful in 5s

Details

qa / qa (pull_request) Successful in 2m51s

Details

475ef01b49

- builtin-sync: per-agent `token_file` is encrypted, stored in `secret`
  as `FORGE_TOKEN_<TYPE>`, FK stamped on the builtin `agent_type` row,
  source file renamed to `tokens/.<basename>.migrated.bak`. Idempotent.
- resolver: new `getAgentToken(typeName)` reads through the SC-6
  decrypt path with one access-log row per call.
- db: `getSecretRowById(id)` for FK consumers.
- tests: idempotent migration sweep, missing-file skip, multi-forge
  `token_files.forgejo` slot, access-log emission, agent_type-scope
  rotation visible without restart.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

code-lead requested review from reviewer

2026-05-02 19:35:23 +00:00

reviewer approved these changes

2026-05-02 19:37:29 +00:00

reviewer left a comment

Migration idempotent, resolver wired through SC-6 with access logging, rotation test covers no-restart path. CI green.

nit: console.warn used for the success log at the end of migrateOneAgentToken — console.log would be more accurate semantically, but not blocking.

Migration idempotent, resolver wired through SC-6 with access logging, rotation test covers no-restart path. CI green. nit: `console.warn` used for the success log at the end of `migrateOneAgentToken` — `console.log` would be more accurate semantically, but not blocking.