Accept an agent's grant token for the API, as its owner's agent 205d8f863e5c

    // An agent's grant token (keyless agents, #241, #253): an agent's token

    // of its owner, reading, and writing when the grant lets its keys move

    // references, as it is for the protocol.

    if t.starts_with(crate::keyless::GRANT_TOKEN_PREFIX) {

        let grant = db::accounts::agent_grant_by_token(&app.db, &auth::token_hash(t)).await?.filter(|g| g.live(db::now_ms()));

        let Some(g) = grant else {

            return Err(ApiError(StatusCode::UNAUTHORIZED, "this agent grant is not valid (revoked, ended or unknown)".into()));

        };

        let account = db::accounts::account_by_id(&app.db, g.account_id).await?.filter(|a| !a.blocked());

        db::accounts::touch_agent_grant(&app.db, g.id).await.ok();

        let mut scopes = vec!["repo:read".to_string(), "user:read".to_string()];

        if g.scope.split(',').any(|s| s.trim() == "refs") {

            scopes.push("repo:write".into());

        }

        return Ok(Caller { account, scopes, site: false, token: g.agent.clone(), token_id: None, agent: true });

    }

    // Grants are their owner's to make and end, not an agent's.

    if c.agent {

        return Err(bad(StatusCode::FORBIDDEN, "an agent's token cannot manage agent grants: use your own"));

    }

    // The grant token works for the API too, as its owner's agent

    // (#253), but cannot manage grants.

    let (st, me) = call(&h.app, "GET", "/api/v1/user", Some(&token), None).await;

    assert!(st == StatusCode::OK && me.contains("\"andy\""), "{st} {me}");

    let (st, _) = call(&h.app, "GET", "/api/v1/agents/grants", Some(&token), None).await;

    assert_eq!(st, StatusCode::FORBIDDEN, "an agent does not manage grants");

**Agent grants** (step 5, built 2026-10-17). An agent holds no key: its owner signs an Oxygen grant (§14.7) letting `agent:NAME@ACCOUNT` act for them, with the key their oxy home names (`oh agent grant NAME [--scope changes,seal,refs] [--for 30d]`), and `POST /api/v1/agents/grants {"grant": base64 signed grant}` keeps it and answers with the agent's token (`oxyagent_…`, shown once, kept as its BLAKE3 hash). The hub accepts a grant only for the caller's own `agent:NAME@USERNAME`, naming this hub's key as issuer, signed by a key linked to the caller's account and not yet ended; any personal token of the account may send it, since the signature is what authorises it. The agent exchanges the token at `keyless/certify` for ten-minute certificates carrying the grant (claims `agent` and `grant`, scope at most the grant's, never past its end), so what its fresh keys sign counts in the owner's name; oxy does this itself with `author.signer = keyless` and the token from `oxy auth grant`. The token is also the agent's credential for the protocol (fetch and push) and the API: it acts as an agent's token of the owner's account (`repo:read` and `user:read`, and `repo:write` when the grant gives `refs`), so the agent's home holds no other secret, and oxy and oh offer it when the home has no hub token. It cannot list, make or revoke grants (#253). `GET /api/v1/agents/grants` lists the caller's grants without tokens; `DELETE /api/v1/agents/grants/{id}` revokes one at once (`oh agent list`, `oh agent revoke ID`). Migration 0075 (`agent_grants`); audited as `agent.granted` and `agent.revoked`.