mirror of
https://github.com/fabro-sh/fabro.git
synced 2026-09-09 22:33:37 +00:00
579f3db26f
Every push previously re-minted a fresh GitHub App installation token and embedded it in the origin URL, so pushes routinely landed inside GitHub's token-replication lag window (run 01M0DH033P2XSTHAGVBHG6922F failed terminally on four consecutive fresh-token 404s). Reusing mature tokens removes the failure trigger and saves two GitHub API calls plus one sandbox exec per push. - New fabro_github::token_source::InstallationTokenSource: one cached, single-flight source per origin repo. Static credentials pass through (generation 0); App credentials mint through the cache and reuse tokens until REFRESH_MARGIN (10 min) before expiry. Every resolve returns a non-secret TokenSnapshot (generation + Minted/Reused/Static provenance), and the source logs mints at INFO and reuses at DEBUG. - Docker and Daytona share the source through PushCredentialState: an embed mutex serializes compare -> set-url -> record, a matching generation skips the set-url exec, and the generation is recorded only after a successful exec. The clone still mints its own token, but now seeds the source cache (generation 1) and the last-embedded state, so a refresh mint failure falls back to the known embedded token instead of believing nothing was ever embedded. - RefreshOutcome now reports the remote action (embedded/unchanged/none) separately from the token snapshot; git_push_via_exec logs token age and provenance with each push, and refresh failures log the last embedded generation. - The run-metadata writer resolves through the sandbox's shared source instead of minting per snapshot (with its own cached source on resume). - The ACP refresh-ahead loop reschedules from the embedded token's expires_at minus the margin instead of a fixed 45-minute interval, which a cached source would have broken for long turns; static credentials stop the loop. Plan: .ai/plans/git-push-token-resilience.md (PR 1: items 3 and 6). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| apps | ||
| components | ||
| foundation | ||
| packages/fabro-api-client | ||