Seeding an oauth2-proxy secret by hand means an agent shell-plumbing a
client secret and a cookie secret, which the classifier blocks. seed-oauth
does it in one self-contained invocation: it reads the KV path, fills in
only the keys that are missing, preserves everything else and prints key
names and the new version, never a value.
- Add SeedOAuth in internal/agent: read-modify-write of the client_id,
client_secret and cookie_secret keys with per-key created/kept/rotated
actions and a no-op when nothing changed.
- Generate secrets from 32 crypto/rand bytes; cookie_secret is base64url so
it decodes to exactly the 32 bytes oauth2-proxy requires.
- Add ReadKVOptional (missing secret = empty) and WriteKVAny (non-string
fields survive a round trip) to the KV-v2 client.
- Wire the seed-oauth subcommand and document it in README and AGENTS.md.
- Cover fresh create, patch-preserves-client_secret, other-key
preservation, --rotate, idempotence, denial errors and secret leakage.
agentpr always read gitea/creds/unkin-agent from a bare const, so a service
like repospawner could not run it as its own Gitea identity.
- Replace the GiteaCredsPath const with a function: GITEA_CREDS_PATH when set,
otherwise gitea/creds/<AGENT_LOGIN>. Unset env still resolves to
gitea/creds/unkin-agent, so existing callers are unchanged.
- Thread the creds path through fetchGiteaToken/readGiteaCreds instead of
reading a package-level const, and report it in the error messages.
- Make agentpr's help text login-agnostic and document both variables.
Interactive agents are classifier-blocked from plumbing credentials through
a shell, so seeding an Authentik outpost token into Vault KV needs to happen
inside one binary invocation that never exposes the secret.
- Add cmd/agentvault, a fourth CLI sharing the agentpr Vault AppRole login
(role_id only, VAULT_ADDR/AGENT_APPROLE_ROLE_ID defaults unchanged).
- Add `agentvault seed-outpost`: read the Authentik API token from
kv/service/authentik/agent-api-token (field `token`, falling back to
`api_token`), exact-match the outpost by name via the instances search,
fetch its key from /api/v3/core/tokens/<identifier>/view_key/ and write it
to --dest-path under --dest-key.
- Print only the outpost name, token identifier, dest path and new KV
version; keep secret material out of results, errors and logs.
- Distinguish the failure stages (login, KV read denied, outpost missing,
view_key, KV write denied) with ErrVaultDenied/ErrVaultNotFound/
ErrOutpostNotFound sentinels and actionable messages.
- Add internal/agent vaultkv.go (AppRole-authenticated KV-v2 client) and
authentik.go (outpost search + view_key) for reuse by future flows.
- Cover the happy path, idempotent re-run, field fallback and every failure
mode with httptest servers, including a leak check on error strings.
- Wire agentvault into the Makefile, build-rpm.sh, nfpm contents, release
cross-builds/assets, README and AGENTS.md.
agentws manages per-branch git worktrees for the unkin-agent user: it clones
repos into the source root (~/src/prodenv/<repo>) so branches are visible in
Ben's main checkout, and creates isolated worktrees under the worktree root
(~/.cache/agentws/<repo>__<branch>).
- New internal/agent/git.go: small, testable git helpers shelling out to the
git binary (clone/fetch/worktree add/remove/list/prune, branch + config ops,
porcelain parsing, path sanitizing). No go-git dependency.
- New cmd/agentws: new / list / rm / clean / token / credential subcommands.
Auth uses an ephemeral git credential helper (agentws credential get) so the
~1h Gitea token is never persisted in a remote URL or config; per-worktree
config keeps the shared checkout's identity untouched.
- Wire agentws into Makefile, scripts/build-rpm.sh, packaging/nfpm.yaml (binary
+ bash/zsh/fish completions), .woodpecker/release.yaml (cross-compile + assets)
and .gitignore.
- Tests: table tests for parsing/sanitizing/dir-naming, a real temp-git repo for
the worktree lifecycle, and hermetic cmd tests (bad input + credential-helper
host guard) that never touch the network.
- Document agentws in README.md and AGENTS.md.
agentpr/watchpr already propagated command errors to a non-zero exit, but
that behaviour had no regression coverage and the root command was not
constructible outside main(). watchpr also fired a spurious conflict alert
because Gitea computes mergeability asynchronously and can briefly report
mergeable=false right after a push. The docs additionally printed the
AppRole role_id literal UUID.
- Extract newRootCmd() in both cmd/agentpr and cmd/watchpr so main() only
runs Execute and exits non-zero on error; add tests asserting Execute
returns an error for a bad PR ref / malformed --repo / no args.
- Debounce mergeability loss in MeaningfulChange: only alert when
mergeable=false persists across two consecutive polls (both prev and cur
false, still open); update the table test for one-poll-false (benign),
false-persisting (alert), and recovered false->true (benign).
- Refer to AGENT_APPROLE_ROLE_ID by env var in README.md/AGENTS.md without
printing the literal role_id; keep the code default and env override.
agentpr manages PRs/comments/whoami as unkin-agent (Vault AppRole -> gitea creds
-> Gitea API), fixing tea's post-as-Ben default. watchpr polls PRs and alerts
only on merge/close, human comment, CI failure, or lost mergeability.
- cobra multi-binary layout mirroring node-lookup (cmd/ + internal/)
- Makefile (build, patch|minor|major, completions, rpm), nfpm RPM with both
binaries + bash/zsh/fish completions, woodpecker CI publishing to rpm-internal
- unit tests for parsing, meaningful-change detection, and the Vault+Gitea client
unkin-agent
gitadmin