fix(workspace): add gh-relay wrapper for auto-refreshing GitHub tokens#100
Merged
khaliqgant merged 2 commits intomainfrom Jan 7, 2026
Merged
fix(workspace): add gh-relay wrapper for auto-refreshing GitHub tokens#100khaliqgant merged 2 commits intomainfrom
khaliqgant merged 2 commits intomainfrom
Conversation
Fixes agent-relay-323: gh CLI authentication failing with 401 Unauthorized ## Problem - GitHub App installation tokens expire after ~1 hour - gh CLI uses stale GH_TOKEN env var directly, bypassing credential helper - Secondary issue: placeholder hosts.yml caused migration error during startup ## Solution - Created gh-relay wrapper script with 55-minute token caching - Wrapper refreshes token via /api/git/token before each invocation - Updated Dockerfile to install wrapper at /usr/local/bin/gh - Updated entrypoint.sh to remove placeholder hosts.yml ## Testing - gh auth status ✓ Logged in as agent-relay[bot] - gh pr list ✓ Lists PRs successfully - gh api repos/AgentWorkforce/relay ✓ Returns repo info ## Files Changed - deploy/workspace/gh-relay (new) - Token refresh wrapper - deploy/workspace/Dockerfile - Install wrapper - deploy/workspace/entrypoint.sh - Cleanup hosts.yml 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Backend <noreply@relay.local>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
gh-relaywrapper script with 55-minute token cachinghosts.ymlthat caused migration errorsRoot Cause
The provisioner sets
GH_TOKENat workspace startup with a GitHub App installation token. These tokens expire after ~1 hour. The gh CLI prefersGH_TOKENover credential helpers, so it kept using the stale token.Secondary issue:
entrypoint.shcreatedhosts.ymlwithoauth_token: placeholder, which caused gh CLI migration errors when combined withGH_TOKEN.Solution
New
gh-relaywrapper (deploy/workspace/gh-relay)/api/git/tokenendpointUpdated Dockerfile - Installs wrapper at
/usr/local/bin/ghUpdated entrypoint.sh - Removes placeholder
hosts.ymlcreationTest Plan
gh auth status- Shows logged in as agent-relay[bot]gh pr list- Successfully lists PRsgh api repos/AgentWorkforce/relay- Returns repo infoCloses agent-relay-323
🤖 Generated with Claude Code