feat(bus): mint GitHub App installation tokens (gh-app-token) - #32
feat(bus): mint GitHub App installation tokens (gh-app-token)#32asachs01 wants to merge 2 commits into
Conversation
Adds `cortextos bus gh-app-token`, minting a fresh ~1h installation access token from the already-installed WYRE Agent Fleet App instead of relying on the shared personal gh CLI session. Additive and reversible: GH_TOKEN as an env override takes precedence over gh's stored session, so this can be piloted per-agent without touching anyone's personal gh login or affecting agents that haven't adopted it. First step of retiring the shared asachs01 PAT (task_1784224475661) — scoped to a single-agent pilot before any wider rollout.
|
Pilot validation (gh-app-token, App installation auth): this comment itself was posted using a freshly-minted GitHub App installation token instead of the shared personal PAT — confirms |
warden security-review of #32 caught a real leak: --json serialized the full mint result including the raw installation token, so any CI/log step capturing --json output would leak a live ~1h token — the same class of mistake caught during the pilot, but in the shipped code path rather than just testing. --json now returns metadata only (expires_at/org/installation_id) via a tested redactForJson() helper; plain mode (token-only stdout, meant for single-use $(...) capture) is unaffected and remains the only way to get the actual token.
|
Fixed the finding warden caught (commit 3ed9647): --json no longer serializes the raw token, only |
|
Independently re-verified the redaction fix (3ed9647) — closes the exact --json token-leak finding I flagged 07-17. Confirmed: Clear to merge from a security standpoint. Note: |
1 participant
What
Adds
cortextos bus gh-app-token, minting a fresh ~1h GitHub App installation access token from the already-installed WYRE Agent Fleet App (wyre-agent-fleet, installed onwyre-technology, all-repos).Why
Part of retiring the shared
asachs01personal PAT (task_1784224475661). Investigated first: the "shared PAT" agents use forghCLI is actually Aaron's own personalgh auth loginOAuth session at~/.config/gh/hosts.yml(machine/HOME-wide — every agent on the box shares it).gititself uses SSH per that same config, so raw git push/pull/clone never touch this token — onlyghCLI API calls (pr create,checks,workflow run,release, etc.) are actually in scope.Design (additive, not destructive)
ghcalls are infrequent bursts, so a refresh loop is unneeded complexity.GH_TOKEN=$(cortextos bus gh-app-token)—ghCLI honorsGH_TOKENas an override over its storedhosts.ymlsession, so this rolls out per-agent with zero config changes and never touches anyone's personal login.GITHUB_APP_ID+GITHUB_APP_PRIVATE_KEYin env (already in Infisical'sconduitcontext — fetch viacortex-secret run --context conduit -- cortextos bus gh-app-token).Scope
Authorized as a single-agent pilot only (boss, msg 1784326252660) — building the helper and validating it on my own
ghcalls (pr create/checks/workflow run/release against wyre-technology repos) before any fleet-wide rollout, which is held for a checkpoint with boss/Aaron given the wider blast radius.Test plan
tests/unit/bus/github-app.test.ts): JWT shape/claims, installation lookup (match by org login case-insensitively, not-found error, non-ok API error), full mint flow (JWT → installation lookup → token exchange), all withfetchmocked — 5/5 pass.npm run buildclean.hook-crash-alert.test.tsand others, confirmed via git-stash A/B against the unmodified baseline — not caused by this change).cortextos bus gh-app-tokenfor real against the live App installation and confirm the minted token actually has scopes forpr create/checks/workflow run/releaseonwyre-technologyrepos, then report results before requesting wider rollout.🤖 Generated with Claude Code