fix(github): the bot-token migration could throw away a live credential (v0.439.1) - #814
Merged
Conversation
…al (v0.439.1) `migrateLegacyBotToken` (v0.435.0) moves a pre-upgrade token from the bare `github_bot_token` vault slot onto the primary installation's suffixed key — but it deleted the legacy slot UNCONDITIONALLY, so a tenant with a cached token and no resolved `github_installation_id` lost it with nothing written in its place. The token stays valid for the hour, so the fix is to leave it alone until a primary exists; the next ensureBotToken resolves one and the migration completes then. No live tenant hit this (checked: every one with a cached token also had a primary), but it was one settings row away from a silent credential loss. Also: `github.connect.initiated` now records the redirect_uri and client id we sent to GitHub. GitHub validates the redirect against the App's registered callback AFTER the user logs in and renders a bare 404 when it doesn't match, which reads to the member as "Agentric is broken" and left no trace in our audit trail — the only way to see what we sent was to ssh to the box and re-derive it from proxy headers. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UfJRSqtHhuk7x51Cqy4NB5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Found while checking whether the multi-org work (#807) is backward compatible, after a report of members getting a GitHub 404 when connecting their account on instawp.
The bug
migrateLegacyBotToken(v0.435.0) moves a pre-upgrade token from the baregithub_bot_tokenvault slot onto the primary installation'sgithub_bot_token:<id>key. It deleted the legacy slot unconditionally — so a tenant with a cached token and no resolvedgithub_installation_idlost it with nothing written in its place.The token stays valid for the hour, so the fix is simply to leave it alone until a primary exists; the next
ensureBotTokenresolves one and the migration completes then.No live tenant hit this — every one with a cached token also had a primary — but it was one settings row away from a silent credential loss.
Also: making the 404 diagnosable
github.connect.initiatednow records theredirect_uriand client id we sent to GitHub. GitHub validates the redirect against the App's registered callback after the user logs in and renders a bare 404 when it doesn't match — which reads to the member as "Agentric is broken" and left no trace anywhere in our audit trail. The only way to see what we actually sent was to ssh to the box and re-derive it from the proxy headers.On the instawp report itself
Not caused by the multi-org work, on the evidence from the live box (v0.437.1, which has phases 1–3):
github_installationsis absent from settings, soorgs()is empty and every phase-2/3 behaviour is inert there — the registry only populates when an admin re-saves the App credentials.github_installation_idis unchanged since 2026-07-19 andgithub.bot_token.injectedhas fired 6545 times, most recently minutes ago — the legacy→suffixed migration worked and the bot lane is healthy.github.connect.initiatedfired 15 times, latest today, and the console navigates straight to theredirectUrlwe mint — so the 404 is github.com's page, not ours.Verification
scripts/github-multi-org-test.cjsis 64 checks now — three new ones pin that a legacy token with no primary is preserved rather than destroyed, and that it migrates as soon as a primary exists again. Fulltest:governancegreen.🤖 Generated with Claude Code
https://claude.ai/code/session_01UfJRSqtHhuk7x51Cqy4NB5