[paveg]

Overview

Reworks how aqua obtains GitHub tokens and where aqua applies. The ghtkn Device Flow integration shipped in #222 required a browser re-auth every 8 hours, which cost more convenience than the short-lived tokens were worth. This PR removes ghtkn entirely and replaces it with aqua's keyring integration (AQUA_KEYRING_ENABLED, aqua ≥ v2.51), fed once by the SSO-authorized gh OAuth token. It also completes the promotion of the aqua base config (global config, PATH precedence, relink script) from business-only to all profiles; the binary still ships via Brewfile.work, so personal machines skip everything gracefully behind a command -v aqua guard.

Token flow

flowchart LR
    subgraph before["Before (#222)"]
        ghw[gh wrapper] -->|"ghtkn get (8h Device Flow)"| kc1[(Keychain)]
        aqua1[aqua] -->|AQUA_GHTKN_ENABLED + embedded SDK| kc1
    end

Loading

flowchart LR
    subgraph after["After (this PR)"]
        sync[aqua-token-sync] -->|"gh auth token → aqua token set --stdin (one-time)"| kc2[(Keychain)]
        aqua2[aqua] -->|AQUA_KEYRING_ENABLED| kc2
        gh2[gh] -->|own keyring OAuth, no wrapper| gh2
    end

Loading

Changes

• Remove ghtkn: the suzuki-shunsuke/ghtkn package, AQUA_GHTKN_ENABLED, the interactive gh wrapper (ghtkn-gh.zsh) and its test
• Add AQUA_KEYRING_ENABLED=true to the business block of .zshenv — required because some C-FO repos resolve a private github_content aqua-registry
• Add aqua-token-sync (business-only zsh feature) wrapping gh auth token | aqua token set --stdin. Unlike the raw pipe it refuses to store an empty token when gh auth token fails (pipe sides run concurrently) and runs under no_xtrace so the token cannot leak into trace output
• Promote aqua base config to all profiles: aqua.yaml becomes a template (business packages guarded, personal gets packages: []), the relink script drops its business guard, .zshenv/.zshrc keep aqua ahead of Homebrew and devbox via the _aqua_force_path precmd hook

Verification

• just lint-zsh test-zsh-features fmt-check green; new 6-case test covers stdin delivery, stdout/xtrace non-leakage, empty/failed-token refusal, missing-command exit code, and business-only rendering
• On the business machine: keyring token stored, then aqua i -l in C-FO/clusterops resolved the private registry and aqua exec -- helmfile-trace --help downloaded and ran a private release binary (exit 0)
• Existing gh keyring OAuth verified against a private C-FO repo (no wrapper needed)

Notes

• ~/.config/ghtkn/ghtkn.yaml stays machine-local and untracked; harmless if ghtkn ever returns
• just lint-lua failure (luac missing from the devbox profile) is pre-existing and untouched here

[changeset-bot]

⚠️ No Changeset found

Latest commit: 2c9b1d2

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR