OXYGENHUB

oh sends an agent's grant token to the API, which refuses it issue #253 closed: completed andymccall opened this · 1 comment

andymccall

Since oxy 0.4.6 a home holding only an agent grant token (keyless, issue #241) offers it as that hub's credential, and oh finds its token through the same store. With OXY_HOME set to a keyless agent's home, oh therefore sends the grant token to /api/v1. The API does not take grant tokens (only the protocol does), so calls fail: moving a board card answers 403 "this token lacks the repo:write scope", although the same call works with the owner's sign-in.

Fix one of two ways:

  • oh skips oxyagent_ tokens and uses its own sign-in;
  • or the API accepts a grant token as an agent's token of its owner, with scopes from the grant, as the protocol does now.

The second keeps an agent's home to one secret. Found on 2026-10-17 setting up the overnight loop; worked around by running oh without OXY_HOME.

andymccall set labels bug, gap ·

closed by change 205d8f863e5c ·

andymccall referenced by change d4a0043fded4 on main ·

andymccall

Follow-up in e6028695: the request-agent middleware only knew agent-marked personal tokens, so an issue or comment made through the API with a grant token looked like the owner's own doing and the owner was not told of it (issue #183). The request's agent is now the grant's agent; the grant test files an issue with the token and checks the owner hears of it.