kandev/docs/plans/task-git-credential-policy/task-03-managed-runtime-tools.md

id, title, status, wave, depends_on, plan, spec

id	title	status	wave	depends_on	plan	spec
03-managed-runtime-tools	Repair managed agentctl and gh runtime tools	done	3	00-indexed-git-config-composition 02-launch-resume-snapshot	plan.md	../../specs/integrations/github-authentication.md

Task 03: Repair Managed Agentctl And Gh Runtime Tools

Acceptance

• A standalone control agentctl started without broker env exposes both managed agentctl and gh to a later broker-enabled instance; managed Git and gh commands do not depend on the backend shell PATH.
• The managed tool directory is not activated for executor inheritance or explicit profile-token override instances, and a managed helper/broker failure does not fall back.
• Agentctl parent-plus-instance collection preserves host/executor indexed Git configuration and emits an already-forwarded task suffix only once.
• Named GitHub CLI credentials are re-resolved after at most five minutes and invalidate immediately on connection-generation changes.

Verification

cd apps/backend && go test ./cmd/agentctl ./internal/agentctl/server/config ./internal/github -run 'Test.*(GitHubCLIShim|GitHubTool|CollectAgentEnv|CredentialResolver.*CLI|CredentialCache|IndexedGitConfig)'

Files likely touched

• apps/backend/cmd/agentctl/main.go
• apps/backend/cmd/agentctl/github_cli_shim.go
• apps/backend/cmd/agentctl/github_cli_shim_test.go
• apps/backend/internal/agentctl/server/config/config.go
• apps/backend/internal/agentctl/server/config/config_test.go
• apps/backend/internal/github/auth_resolver.go
• apps/backend/internal/github/auth_resolver_test.go
• focused subprocess/fake-broker test helpers
• this task file and plan.md

Dependencies

Tasks 00 and 02.

Parallelism

Parallel-safe with Task 05: backend runtime/auth files and frontend Changes-panel files are disjoint.

Inputs

• Confirmed standalone root cause in plan.md.
• Spec failure/security scenarios and five-minute named-CLI refresh contract.
• Existing installGitHubCLIShim, CollectAgentEnv, and credential resolver cache patterns.
• Task 00's composition and overlap rules.

Output contract

Report per-instance activation conditions, parent/instance Git-config composition evidence, actual subprocess proof for git and gh, CLI cache deadline semantics, RED/GREEN results, files changed, portability limits, and update task/plan status.