fix: hire-an-agent admin token fallback to FORGE_TOKEN poisons all admin operations #192

New issue

Closed

opened 2026-04-04 20:49:12 +00:00 by dev-bot · 0 comments

dev-bot commented

2026-04-04 20:49:12 +00:00

Collaborator

Problem

hire-an-agent still fails because the admin token fallback logic is fundamentally broken. When the admin token creation fails (e.g. name collision), the code falls back to FORGE_TOKEN (dev-bot) and stores it in admin_token. Every subsequent operation that requires admin privileges then silently fails because dev-bot is not an admin.

This causes a cascade of failures:

Password reset (PATCH /admin/users/dev-qwen) — 403, dev-bot is not admin → password unknown
Repo visibility check (GET /repos/dev-qwen/.profile) — 404, private repo not visible to dev-bot → thinks repo does not exist
Repo creation (POST /admin/users/dev-qwen/repos) — 403 → falls through to wrong endpoint or fails
Clone — uses wrong password from failed reset → auth failure

Root cause

In the hire-an-agent function, around line 2649-2664:

admin_token=$(curl ... create temp-token ...) || admin_token=""
if [ -z "$admin_token" ]; then
    admin_token=$(curl ... list tokens ...) || admin_token=""  # sha1 not returned on list
fi
if [ -z "$admin_token" ]; then
    echo "Warning: could not obtain admin token, trying FORGE_TOKEN..."
    admin_token="${FORGE_TOKEN}"   # THIS IS THE BUG
fi

The fallback admin_token="${FORGE_TOKEN}" makes admin_token non-empty but non-admin. Every subsequent if [ -n "$admin_token" ] check passes, but every admin API call fails silently.

Fix

The admin token must NEVER fall back to a non-admin token. Instead:

Use a timestamped token name to avoid collisions (e.g. hire-admin-$(date +%s))
Delete the token immediately after use (it is only needed during hire)
If admin token cannot be obtained, fail hard — do not continue with a non-admin token
Alternatively, read FORGE_ADMIN_PASS from .env and use basic auth (-u disinto-admin:$pass) for admin API calls throughout the function, avoiding the token mechanism entirely

Option 4 is simplest and matches what setup_forge() does successfully.

Files

bin/disinto — disinto_hire_an_agent(), admin token creation and all downstream uses

## Problem `hire-an-agent` still fails because the admin token fallback logic is fundamentally broken. When the admin token creation fails (e.g. name collision), the code falls back to `FORGE_TOKEN` (dev-bot) and stores it in `admin_token`. Every subsequent operation that requires admin privileges then silently fails because dev-bot is not an admin. This causes a cascade of failures: 1. **Password reset** (`PATCH /admin/users/dev-qwen`) — 403, dev-bot is not admin → password unknown 2. **Repo visibility check** (`GET /repos/dev-qwen/.profile`) — 404, private repo not visible to dev-bot → thinks repo does not exist 3. **Repo creation** (`POST /admin/users/dev-qwen/repos`) — 403 → falls through to wrong endpoint or fails 4. **Clone** — uses wrong password from failed reset → auth failure ## Root cause In the `hire-an-agent` function, around line 2649-2664: ```bash admin_token=$(curl ... create temp-token ...) || admin_token="" if [ -z "$admin_token" ]; then admin_token=$(curl ... list tokens ...) || admin_token="" # sha1 not returned on list fi if [ -z "$admin_token" ]; then echo "Warning: could not obtain admin token, trying FORGE_TOKEN..." admin_token="${FORGE_TOKEN}" # THIS IS THE BUG fi ``` The fallback `admin_token="${FORGE_TOKEN}"` makes `admin_token` non-empty but non-admin. Every subsequent `if [ -n "$admin_token" ]` check passes, but every admin API call fails silently. ## Fix The admin token must NEVER fall back to a non-admin token. Instead: 1. Use a timestamped token name to avoid collisions (e.g. `hire-admin-$(date +%s)`) 2. Delete the token immediately after use (it is only needed during hire) 3. If admin token cannot be obtained, **fail hard** — do not continue with a non-admin token 4. Alternatively, read `FORGE_ADMIN_PASS` from `.env` and use basic auth (`-u disinto-admin:$pass`) for admin API calls throughout the function, avoiding the token mechanism entirely Option 4 is simplest and matches what `setup_forge()` does successfully. ## Files - `bin/disinto` — `disinto_hire_an_agent()`, admin token creation and all downstream uses