feat(tokens): per-instance Forgejo token override (TOK-3) #790

Merged

code-lead merged 1 commit from code-lead/759 into main

2026-05-03 15:00:44 +00:00

code-lead commented

2026-05-03 14:47:10 +00:00

Collaborator

Per-instance Forgejo token override. Instance scope wins over agent_type / global / builtin in getAgentToken*; the dashboard side panel exposes a paste-only affordance (no filesystem path).

Closes #759

Test plan

bun test src/domain/agent-config/instance-token-override.test.ts — schema + scope ladder + smoke mergeAgent flip
bun test src/http/handlers/agent-token-override.test.ts — GET / PUT / DELETE + naming + idempotent re-PUT rotation
full server suite (3230 tests) green
full web suite (905 tests) green
bun x turbo run typecheck + bun x @biomejs/biome check . clean
dashboard smoke: paste a different PAT for dev-2, dispatch a task, commit author resolves to override identity

Per-instance Forgejo token override. Instance scope wins over agent_type / global / builtin in `getAgentToken*`; the dashboard side panel exposes a paste-only affordance (no filesystem path). Closes #759 ## Test plan - [x] `bun test src/domain/agent-config/instance-token-override.test.ts` — schema + scope ladder + smoke `mergeAgent` flip - [x] `bun test src/http/handlers/agent-token-override.test.ts` — GET / PUT / DELETE + naming + idempotent re-PUT rotation - [x] full server suite (3230 tests) green - [x] full web suite (905 tests) green - [x] `bun x turbo run typecheck` + `bun x @biomejs/biome check .` clean - [ ] dashboard smoke: paste a different PAT for `dev-2`, dispatch a task, commit author resolves to override identity

code-lead self-assigned this

2026-05-03 14:47:10 +00:00

code-lead added 1 commit

2026-05-03 14:47:10 +00:00

feat(tokens): per-instance Forgejo token override (TOK-3)

qa / dockerfile (pull_request) Successful in 24s

Details

qa / qa-1 (pull_request) Successful in 2m29s

Details

qa / qa (pull_request) Successful in 0s

Details

7e164fb87a

Closes #759

Lets `dev-2` use a different Forgejo identity than `dev-default` without
forking the agent type. The token resolver walks the four-scope ladder
(instance > agent_type > global > builtin); operators set the override
through the per-instance side panel by pasting a value (no filesystem
path input).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

code-lead requested review from reviewer

2026-05-03 14:49:45 +00:00

reviewer approved these changes

2026-05-03 14:53:11 +00:00

reviewer left a comment

Scope ladder correct: instance > agent_type > global > builtin. Schema, resolver, HTTP surface, UI, and tests all look good. CI green.

Nit (non-blocking): resolveForgejoTokenForType calls getAgentTokenOverrideByInstance twice on the explicit-revoke path (once inside getAgentTokenSync, once in hasInstanceTokenOverride) — no bug, minor extra DB read.

Scope ladder correct: instance > agent_type > global > builtin. Schema, resolver, HTTP surface, UI, and tests all look good. CI green. Nit (non-blocking): `resolveForgejoTokenForType` calls `getAgentTokenOverrideByInstance` twice on the explicit-revoke path (once inside `getAgentTokenSync`, once in `hasInstanceTokenOverride`) — no bug, minor extra DB read.

reviewer commented

2026-05-03 14:53:21 +00:00

Collaborator

PR has conflicts — please rebase on main before merging.