Merge pull request 'feat(orchestrator): inject per-agent GITEA_TOKEN into spawn env' (#741) from task/inject-per-agent-gitea-token into main

Author: AlexMikhalev

crates/terraphim_orchestrator/src/lib.rs

@@ -338,9 +338,16 @@ fn build_flow_project_runtimes(
 /// Gitea owner/repo, and the project id itself into the child process's
 /// environment (`ADF_PROJECT_ID`, `ADF_WORKING_DIR`, `GITEA_OWNER`,
 /// `GITEA_REPO`). Legacy (project-less) agents use [`SpawnContext::global()`].
+///
+/// When an [`OutputPoster`] is available and has a per-agent Gitea token
+/// for `(project, agent_name)` (loaded from `agent_tokens.json`), the
+/// token is injected as `GITEA_TOKEN` so the agent's own `gtr` / API
+/// calls inside its task shell post under its own Gitea identity. Without
+/// this, `source ~/.profile` would overlay the shared root token.
 fn build_spawn_context_for_agent(
     config: &OrchestratorConfig,
     def: &AgentDefinition,
+    output_poster: Option<&OutputPoster>,
 ) -> SpawnContext {
     let Some(pid) = def.project.as_deref() else {
         return SpawnContext::global();
@@ -357,6 +364,11 @@ fn build_spawn_context_for_agent(
             .with_env("GITEA_OWNER", gitea.owner.clone())
             .with_env("GITEA_REPO", gitea.repo.clone());
     }
+    if let Some(poster) = output_poster {
+        if let Some(token) = poster.agent_token(pid, &def.name) {
+            ctx = ctx.with_env("GITEA_TOKEN", token.to_string());
+        }
+    }
     ctx
 }
 
@@ -1614,7 +1626,8 @@ impl AgentOrchestrator {
         }
         request = request.with_resource_limits(limits);
 
-        let spawn_ctx = build_spawn_context_for_agent(&self.config, def);
+        let spawn_ctx =
+            build_spawn_context_for_agent(&self.config, def, self.output_poster.as_ref());
         let handle = self
             .spawner
             .spawn_with_fallback(&request, spawn_ctx)
@@ -1872,7 +1885,8 @@ impl AgentOrchestrator {
         }
         request = request.with_resource_limits(limits);
 
-        let base_ctx = build_spawn_context_for_agent(&self.config, &def);
+        let base_ctx =
+            build_spawn_context_for_agent(&self.config, &def, self.output_poster.as_ref());
         let spawn_ctx = pr_dispatch::layer_pr_env(base_ctx, &req);
 
         let handle = self

crates/terraphim_orchestrator/src/output_poster.rs

@@ -21,6 +21,11 @@ struct ProjectTrackers {
     default_tracker: GiteaTracker,
     /// Per-agent trackers keyed by agent name (scoped to this project).
     agent_trackers: HashMap<String, GiteaTracker>,
+    /// Per-agent raw token strings keyed by agent name (parallel to
+    /// agent_trackers). Exposed via [`OutputPoster::agent_token`] so the
+    /// spawn path can inject the token as a `GITEA_TOKEN` env override,
+    /// giving each agent's own `gtr` calls their own identity.
+    agent_tokens: HashMap<String, String>,
 }
 
 /// Posts collected agent output to a Gitea issue comment.
@@ -141,6 +146,18 @@ impl OutputPoster {
             .is_some_and(|p| p.agent_trackers.contains_key(agent_name))
     }
 
+    /// Return the agent's own Gitea token for this project, if one is
+    /// configured in `agent_tokens.json`. Used by the spawn path to inject
+    /// `GITEA_TOKEN` into the child process so the agent's own `gtr` /
+    /// API calls post under its own Gitea user identity (matching what
+    /// [`OutputPoster`] does for the wrapped completion comment).
+    pub fn agent_token(&self, project: &str, agent_name: &str) -> Option<&str> {
+        self.projects
+            .get(project)
+            .and_then(|p| p.agent_tokens.get(agent_name))
+            .map(|s| s.as_str())
+    }
+
     /// Post agent output as a comment on a Gitea issue in the given project.
     ///
     /// Uses the agent's own Gitea token if configured, otherwise falls back
@@ -382,68 +399,126 @@ fn build_project_trackers(config: &GiteaOutputConfig) -> ProjectTrackers {
     let default_tracker =
         GiteaTracker::new(default_gitea_config).expect("Failed to create default GiteaTracker");
 
-    let agent_trackers = match &config.agent_tokens_path {
-        Some(path) => match std::fs::read_to_string(path) {
-            Ok(contents) => match serde_json::from_str::<HashMap<String, String>>(&contents) {
-                Ok(tokens) => {
-                    tracing::info!(
-                        count = tokens.len(),
-                        path = %path.display(),
-                        owner = %config.owner,
-                        repo = %config.repo,
-                        "loaded per-agent Gitea tokens"
-                    );
-                    let mut trackers = HashMap::with_capacity(tokens.len());
-                    for (agent_name, token) in tokens {
-                        let agent_config = GiteaConfig {
-                            base_url: config.base_url.clone(),
-                            token,
-                            owner: config.owner.clone(),
-                            repo: config.repo.clone(),
-                            active_states: vec!["open".to_string()],
-                            terminal_states: vec!["closed".to_string()],
-                            use_robot_api: false,
-                            robot_path: PathBuf::from(ROBOT_PATH),
-                            claim_strategy: ClaimStrategy::PreferRobot,
-                        };
-                        match GiteaTracker::new(agent_config) {
-                            Ok(tracker) => {
-                                trackers.insert(agent_name, tracker);
-                            }
-                            Err(e) => {
-                                tracing::warn!(
-                                    agent = %agent_name,
-                                    error = %e,
-                                    "failed to create agent tracker, will use project default"
-                                );
+    let (agent_trackers, agent_tokens): (HashMap<String, GiteaTracker>, HashMap<String, String>) =
+        match &config.agent_tokens_path {
+            Some(path) => match std::fs::read_to_string(path) {
+                Ok(contents) => match serde_json::from_str::<HashMap<String, String>>(&contents) {
+                    Ok(tokens) => {
+                        tracing::info!(
+                            count = tokens.len(),
+                            path = %path.display(),
+                            owner = %config.owner,
+                            repo = %config.repo,
+                            "loaded per-agent Gitea tokens"
+                        );
+                        let mut trackers = HashMap::with_capacity(tokens.len());
+                        let mut raw = HashMap::with_capacity(tokens.len());
+                        for (agent_name, token) in tokens {
+                            let agent_config = GiteaConfig {
+                                base_url: config.base_url.clone(),
+                                token: token.clone(),
+                                owner: config.owner.clone(),
+                                repo: config.repo.clone(),
+                                active_states: vec!["open".to_string()],
+                                terminal_states: vec!["closed".to_string()],
+                                use_robot_api: false,
+                                robot_path: PathBuf::from(ROBOT_PATH),
+                                claim_strategy: ClaimStrategy::PreferRobot,
+                            };
+                            match GiteaTracker::new(agent_config) {
+                                Ok(tracker) => {
+                                    trackers.insert(agent_name.clone(), tracker);
+                                    raw.insert(agent_name, token);
+                                }
+                                Err(e) => {
+                                    tracing::warn!(
+                                        agent = %agent_name,
+                                        error = %e,
+                                        "failed to create agent tracker, will use project default"
+                                    );
+                                }
                             }
                         }
+                        (trackers, raw)
                     }
-                    trackers
-                }
+                    Err(e) => {
+                        tracing::warn!(
+                            path = %path.display(),
+                            error = %e,
+                            "failed to parse agent tokens JSON, all agents will use project default token"
+                        );
+                        (HashMap::new(), HashMap::new())
+                    }
+                },
                 Err(e) => {
                     tracing::warn!(
                         path = %path.display(),
                         error = %e,
-                        "failed to parse agent tokens JSON, all agents will use project default token"
+                        "failed to read agent tokens file, all agents will use project default token"
                     );
-                    HashMap::new()
+                    (HashMap::new(), HashMap::new())
                 }
             },
-            Err(e) => {
-                tracing::warn!(
-                    path = %path.display(),
-                    error = %e,
-                    "failed to read agent tokens file, all agents will use project default token"
-                );
-                HashMap::new()
-            }
-        },
-        None => HashMap::new(),
-    };
+            None => (HashMap::new(), HashMap::new()),
+        };
 
     ProjectTrackers {
         default_tracker,
         agent_trackers,
+        agent_tokens,
+    }
+}
+
+#[cfg(test)]
+mod agent_token_tests {
+    use super::*;
+    use crate::config::GiteaOutputConfig;
+
+    #[test]
+    fn agent_token_returns_configured_value_when_tokens_file_loaded() {
+        use std::io::Write;
+        let dir = tempfile::tempdir().unwrap();
+        let tokens_path = dir.path().join("agent_tokens.json");
+        let mut f = std::fs::File::create(&tokens_path).unwrap();
+        writeln!(f, r#"{{"alpha":"tok-alpha","beta":"tok-beta"}}"#).unwrap();
+        drop(f);
+
+        let config = GiteaOutputConfig {
+            base_url: "https://example.com".to_string(),
+            token: "root-token".to_string(),
+            owner: "terraphim".to_string(),
+            repo: "acme".to_string(),
+            agent_tokens_path: Some(tokens_path),
+        };
+        let poster = OutputPoster::new(&config);
+
+        assert_eq!(
+            poster.agent_token(crate::dispatcher::LEGACY_PROJECT_ID, "alpha"),
+            Some("tok-alpha")
+        );
+        assert_eq!(
+            poster.agent_token(crate::dispatcher::LEGACY_PROJECT_ID, "beta"),
+            Some("tok-beta")
+        );
+        assert_eq!(
+            poster.agent_token(crate::dispatcher::LEGACY_PROJECT_ID, "gamma"),
+            None
+        );
+        assert_eq!(poster.agent_token("nonexistent", "alpha"), None);
+    }
+
+    #[test]
+    fn agent_token_returns_none_when_no_tokens_file() {
+        let config = GiteaOutputConfig {
+            base_url: "https://example.com".to_string(),
+            token: "root-token".to_string(),
+            owner: "terraphim".to_string(),
+            repo: "acme".to_string(),
+            agent_tokens_path: None,
+        };
+        let poster = OutputPoster::new(&config);
+        assert!(poster
+            .agent_token(crate::dispatcher::LEGACY_PROJECT_ID, "anything")
+            .is_none());
     }
 }