Agents kept configuring git with RAKAZO_GITHUB_BROKER_RUN_TOKEN as a
password because the system prompt listed it among "managed credentials"
to use in shell commands. GitHub rejects it, and the agent then asks the
user for a personal access token.
- List only the user's own agent secrets in that instruction; the broker
variables stay in the environment for the git shim.
- Make /usr/bin/git the shim as well, so git called by absolute path
still goes through the broker; the real binary moves out of PATH.
- Prompt no longer names the broker variable.
Claude-Session: https://claude.ai/code/session_01Tgvrj34NMnaqvtgvruYQZZ
Co-authored-by: Claude <noreply@anthropic.com>
* Broker GitHub integration token for computer git/gh
Use the Integrations GitHub MCP secret for supervisor broker sessions
so home and project computers can clone private repos without PAT prompts.
Add rakazo git/gh shims, push policy, deploy image rebuild, and tests.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* ci: retrigger product checks after runner timeout
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* ci: run product change detection on GitHub-hosted runners
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* style: format deployment-github-token
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* ci: self-hosted change detection with timeout and fail-open gate
Keep Detect product changes on evoo-ci with a 10-minute cap, continue-on-error
filtering, and a fail-open product flag when detection fails. Downstream jobs
and Product CI treat a failed or timed-out changes job as full product impact.
Add job timeouts on remaining self-hosted ci jobs.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* fix: continueRun tests and broker home path guard
- Skip broker workspace resolution when computer homeKey is absent
- Add shared continue-run Prisma/home/secretStore test stubs
- Update computer PATH expectation and evo-deploy command sequence
- Remove unused executor imports flagged by Biome
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* style: Biome format and import order for broker CI
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* fix: compose YAML, typecheck for broker stubs and GitHub hint
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* ci: retrigger Product CI after compose and typecheck fixes
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* ci: retry Product CI queue
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* ci: give self-hosted Web E2E a 45m job timeout
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* ci: extend Web E2E job timeout to 60m on self-hosted runners
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* fix: keep github-broker-token off the core browser barrel
Export broker HMAC helpers only from @rakazo/core/node/github-broker-token so
Vite does not pull node:crypto into the web client and break Playwright signup.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
