Centralize encrypted bot profiles (#14)

Centralize ordered bot profiles and encrypted credentials in `bot-agents`.

- Exposes one action input: `master-key`.
- Uses Gitea’s automatic job token internally; dependent repositories provide no author/reviewer/profile inputs.
- Keeps encrypted Claude and reviewer credentials in `profiles.yml`; tokenless Codex uses its persisted subscription login.
- Falls back only on recognized quota exhaustion, with a distinct UID/home per profile and descendant cleanup before fallback.
- Separates decryption, agent execution, and reviewer posting so privileged credentials never enter an agent process.
- Installs `obra/superpowers` with the standard Skills CLI; removes custom discovery code.
- Adds root-level isolation, rollback, symlink, fallback, posting, YAML, and self-workflow CI coverage.

Checks: formatting, lint, all entrypoint type checks, 35 tests as root, diff check, secret scan, and repository diagnostics.
Reviewed-on: #14
Co-authored-by: Danny Kim <temeddix@gmail.com>
Co-committed-by: Danny Kim <temeddix@gmail.com>

This commit was merged in pull request #14.

This commit is contained in:

Danny Kim

2026-09-23 20:15:29 +00:00

committed by

temeddix

parent ba9e0c0787

commit e56ea246bf

27 changed files with 2218 additions and 701 deletions

									
										.gitea/workflows/check.yml
									
		+2
		-2
	
												View File
												
				@@ -17,5 +17,5 @@ jobs:

				      - run: >-

				          deno fmt --check . &&

				          deno lint . &&

				          deno check run.ts &&

				          deno test

				          deno check src/prepare.ts src/run.ts src/post.ts &&

				          deno test --allow-all