- Runs after ACP startup reaper marks stuck sessions as crashed
- mcpRepo.ReapStaleSystemTokens revokes tokens bound to crashed/exited sessions
- Single audit entry per batch: mcp.token.expire_on_restart with count + token_ids
- Errors logged but don't block boot
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Config.MCPTokensPurge + scheduleEntry branch
- app.go constructs runner with mcpTokensPurgeAdapter
- Registered as 'mcp_tokens_purge' in RunnerFns map
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Periodic delete of mcp_tokens where (expired OR revoked) before retention
- 24h interval default, 7d retention default
- Mirrors acp_events_purge pattern: idempotent, error-tolerant
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- mcpTokens dep added to Supervisor; nil-safe (test fixtures may skip)
- RevokeBySession called after audit Record in onExit
- app.go wires mcpTokenSvc (was nil placeholder)
- Integration test: fakeSupMCPTokens verifies onExit calls RevokeBySession
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- extraEnv overrides agent_kinds.encrypted_env same-name keys (spec §6.1 #11)
- Prevents admin from hard-coding ACW_MCP_TOKEN in agent_kinds
- SessionService passes nil for now; system token wiring lands in I4
- BuildSpawnEnv exported for testing the override priority
- Fix app.go NewSupervisor call to match updated signature (from I5)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Extract issueSystemToken helper; pool-bound + tx-bound entries share impl
- IssueSystemTokenWithTx accepts pgx.Tx, uses repo.WithTx(tx) for DB writes
- Audit Record stays outside tx (audit failure doesn't roll back business path)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Cross-module transactional support for spec §6.1: ACP CreateSession must
atomically insert acp_sessions row + mcp_tokens row (FK NOT NULL).
- mcp.Repository.WithTx(tx) -> Repository (tx-bound, no pool)
- acp.Repository.InTx(ctx, fn) -> error (pgx.BeginFunc wrapper)
- acp.Repository.WithTx(tx) -> Repository (tx-bound)
- Update fakeRepos in test files to satisfy new interface methods
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add tools_pm_test.go with 13 integration tests covering all 16 PM
tools via SDK in-memory transport with fake services.
Fix jsonschema tags in tools_pm.go and tools_chat.go — SDK's tag
parser rejects "required,min=1" and "required,description=X" syntax;
use plain description text instead (non-pointer fields are auto-required).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- IssueAdmin now rejects past/now ExpiresAt with CodeMcpTokenExpiresRequired
- TestIssueAdmin_ExpiresMustBeFuture covers the new path
- IssueSystemToken doc comment notes pgRepo currently ignores ctx tx; Part 3
must add Repository.WithTx for true same-transaction guarantee with
acp_sessions (spec §6.1)
- New scope_test.go (whitebox) verifies JSON round-trip preserves nil-vs-empty
semantics on Tools / ProjectIDs and exercises AllowsTool / AllowsProject
edges that Authenticate / future tool gating depend on
q792602257