paveg · Oct 13, 2026 · Oct 13, 2026 · Oct 13, 2026 · Oct 13, 2026 · Oct 13, 2026
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -226,6 +226,8 @@ jobs:
             name: "Test User"
             email: "test@example.com"
             work_email: "test@work.example.com"
+            ghtkn_client_ids:
+              read: "Iv1.test"
           EOF
 
       - name: Test chezmoi init (dry-run)

diff --git a/.gitignore b/.gitignore
@@ -6,9 +6,6 @@ home/dot_local/share/devbox/global/default/devbox.lock
 .claude/
 .firecrawl/
 
-# Work-only ghtkn GitHub App configuration must not enter this public repository
-home/dot_config/ghtkn/
-
 # Python tooling caches (pytest harness under tests/skills/)
 __pycache__/
 .pytest_cache/

diff --git a/CLAUDE.md b/CLAUDE.md
@@ -27,11 +27,12 @@ just diff        # Show pending chezmoi changes
 
 ### Key Data Variables (defined in `home/.chezmoi.yaml.tmpl`)
 
-| Variable                         | Description                                    |
-| -------------------------------- | ---------------------------------------------- |
-| `.business_use`                  | `true` if `BUSINESS_USE=1` was set during init |
-| `.osid`                          | OS identifier (e.g., `darwin`, `linux-ubuntu`) |
-| `.name`, `.email`, `.work_email` | User info prompted on first run                |
+| Variable                         | Description                                     |
+| -------------------------------- | ----------------------------------------------- |
+| `.business_use`                  | `true` if `BUSINESS_USE=1` was set during init  |
+| `.osid`                          | OS identifier (e.g., `darwin`, `linux-ubuntu`)  |
+| `.name`, `.email`, `.work_email` | User info prompted on first run                 |
+| `.ghtkn_client_ids`              | ghtkn App client IDs, filled by hand (business) |
 
 ### Template Testing
 
@@ -41,7 +42,7 @@ just diff        # Show pending chezmoi changes
 
 ```bash
 tmpdir=$(mktemp -d) && mkdir -p "$tmpdir/chezmoi"
-printf 'data:\n  name: "Test"\n  email: "t@example.com"\n  work_email: "t@work.example.com"\n' > "$tmpdir/chezmoi/chezmoi.yaml"
+printf 'data:\n  name: "Test"\n  email: "t@example.com"\n  work_email: "t@work.example.com"\n  ghtkn_client_ids: {read: "Iv1.test"}\n' > "$tmpdir/chezmoi/chezmoi.yaml"
 XDG_CONFIG_HOME="$tmpdir" BUSINESS_USE=1 chezmoi init --source=. --dry-run        # business mode
 XDG_CONFIG_HOME="$tmpdir" env -u BUSINESS_USE chezmoi init --source=. --dry-run   # personal mode
 ```

diff --git a/home/.chezmoi.yaml.tmpl b/home/.chezmoi.yaml.tmpl
@@ -10,6 +10,7 @@
 {{- $email := "" -}}
 {{- $workEmail := "" -}}
 {{- $signingKey := "" -}}
+{{- $ghtknClientIds := dict -}}
 
 {{- if and (not $businessUse) $hasOp -}}
 {{-   $name = onepasswordRead "op://Dotfiles/Git/name" -}}
@@ -22,6 +23,10 @@
 {{-   end -}}
 {{- end -}}
 
+{{- if hasKey . "ghtkn_client_ids" -}}
+{{-   $ghtknClientIds = .ghtkn_client_ids -}}
+{{- end -}}
+
 {{- if and $hasOp (eq .chezmoi.os "darwin") -}}
 {{-   $signingKey = onepasswordRead "op://Dotfiles/Git/signing_key" -}}
 {{- end -}}
@@ -37,6 +42,9 @@ data:
   work_email: {{ $workEmail | quote }}
   signing_key: {{ $signingKey | quote }}
 
+  # ghtkn GitHub App client IDs (none/read/git/write), filled by hand in the local chezmoi.yaml
+  ghtkn_client_ids: {{ $ghtknClientIds | toJson }}
+
   # Auto tmux on terminal startup
   auto_tmux: true
 

diff --git a/home/.chezmoiignore b/home/.chezmoiignore
@@ -30,6 +30,9 @@ homebrew/
 .chezmoiscripts/generate-fdev-ca-bundle.sh
 .config/git/freee
 .config/colima/
+.config/ghtkn/
+Library/LaunchAgents/local.ghtkn-agent.plist
+.chezmoiscripts/load-ghtkn-agent.sh
 homebrew/Brewfile.work
 .claude/skills/acli/
 {{ end }}

diff --git a/home/.chezmoiscripts/run_onchange_after_load-ghtkn-agent.sh.tmpl b/home/.chezmoiscripts/run_onchange_after_load-ghtkn-agent.sh.tmpl
@@ -0,0 +1,16 @@
+{{- if and .business_use (eq .chezmoi.os "darwin") -}}
+#!/bin/bash
+# plist hash: {{ include "Library/LaunchAgents/local.ghtkn-agent.plist.tmpl" | sha256sum }}
+# ghtkn version: {{ include "dot_config/aquaproj-aqua/aqua.yaml.tmpl" | regexFind "suzuki-shunsuke/ghtkn@v[0-9.]+" }}
+set -euo pipefail
+
+if ! command -v aqua >/dev/null 2>&1; then
+  echo "aqua not found — skipping ghtkn agent load" >&2
+  exit 0
+fi
+
+label="local.ghtkn-agent"
+launchctl bootout "gui/$(id -u)/$label" 2>/dev/null || true
+launchctl bootstrap "gui/$(id -u)" "$HOME/Library/LaunchAgents/$label.plist"
+echo "ghtkn agent restarted locked — run: ghtkn agent unlock --enable-refresh"
+{{- end }}
diff --git a/home/dot_config/aquaproj-aqua/aqua.yaml.tmpl b/home/dot_config/aquaproj-aqua/aqua.yaml.tmpl
@@ -12,6 +12,7 @@ packages:
   - name: helm/helm@v3.17.0
   - name: helmfile/helmfile@v0.171.0
   - name: hashicorp/terraform@v1.14.3
+  - name: suzuki-shunsuke/ghtkn@v0.4.1
 {{- else }}
 
 packages: []

diff --git a/home/dot_config/ghtkn/ghtkn.yaml.tmpl b/home/dot_config/ghtkn/ghtkn.yaml.tmpl
@@ -0,0 +1,34 @@
+{{- $ids := dict -}}
+{{- if hasKey . "ghtkn_client_ids" -}}
+{{-   $ids = .ghtkn_client_ids -}}
+{{- end -}}
+{{- $none := get $ids "none" -}}
+{{- $read := get $ids "read" -}}
+{{- $git := get $ids "git" -}}
+{{- $write := get $ids "write" -}}
+# yaml-language-server: $schema=https://raw.githubusercontent.com/suzuki-shunsuke/ghtkn/main/json-schema/ghtkn.json
+# ghtkn - https://github.com/suzuki-shunsuke/ghtkn
+min_expiration: 30m # 有効期限が 30m 以下になったら更新される
+clipboard:
+  enable: true # device flow で one-time code が clipboard にコピーされて便利
+backend:
+  type: agent # access token の更新を自動化したい場合
+apps:
+{{- if not (or $none $read $git $write) }} []{{ end }}
+{{- if $none }}
+  - name: C-FO/none # 先頭にこの App を持ってくることでデフォルトで secure にする
+    client_id: {{ $none | quote }}
+{{- end }}
+{{- if $read }}
+  - name: C-FO/read # read 権限のみ
+    client_id: {{ $read | quote }}
+{{- end }}
+{{- if $git }}
+  - name: C-FO/git # Git Credential Helper 用
+    client_id: {{ $git | quote }}
+    git_owner: C-FO # Git Credential Helper により、 C-FO 配下のリポジトリに push/pull する際はこれが使用される
+{{- end }}
+{{- if $write }}
+  - name: C-FO/write # 開発に必要な基本的な権限
+    client_id: {{ $write | quote }}
+{{- end }}
diff --git a/home/dot_config/git/config b/home/dot_config/git/config
@@ -2,10 +2,6 @@
 [include]
   path = ~/.config/git/main
 
-# Work-specific config for C-FO repositories
-[includeIf "gitdir:~/repos/github.com/C-FO/"]
-  path = ~/.config/git/work
-
 # GitHub credential helper (gh auth)
 # Use env to find gh in PATH (works with devbox, homebrew, etc.)
 [credential "https://github.com"]
@@ -16,6 +12,12 @@
   helper =
   helper = !/usr/bin/env gh auth git-credential
 
+# Work-specific config for C-FO repositories. Keep it below the credential
+# sections: helper lists accumulate in file order, so work's `helper =` reset
+# must come last to replace the gh helper.
+[includeIf "gitdir:~/repos/github.com/C-FO/"]
+  path = ~/.config/git/work
+
 # Secret detection: Use gitleaks (not configured in git config)
 # Usage: gitleaks detect --source . --verbose
 # Pre-commit: gitleaks protect --staged --verbose
diff --git a/home/dot_config/git/work.tmpl b/home/dot_config/git/work.tmpl
@@ -6,4 +6,11 @@
   hooksPath = {{ .chezmoi.homeDir }}/.fdev-git-hooks
 [url "git@github.com:"]
   insteadOf = https://github.com/
+[url "https://github.com/C-FO/"]
+  insteadOf = https://github.com/C-FO/
+[credential "https://github.com"]
+  useHttpPath = true
+[credential "https://github.com/C-FO"]
+  helper =
+  helper = !ghtkn git-credential
 {{- end }}
diff --git a/home/dot_config/zsh/features/aqua-token-sync.zsh b/home/dot_config/zsh/features/aqua-token-sync.zsh
diff --git a/home/dot_config/zsh/features/ghtkn-gh.zsh b/home/dot_config/zsh/features/ghtkn-gh.zsh
@@ -0,0 +1,30 @@
+# ghtkn-gh.zsh — run gh with a short-lived GitHub App token from the ghtkn agent
+# Provides:     gh
+# Requires:     gh, ghtkn (agent unlocked)
+# Side-effects: runs gh through `ghtkn exec` unless GH_TOKEN or GITHUB_TOKEN is set
+
+if (( $+aliases[gh] )); then
+  unalias gh
+fi
+
+function gh {
+  emulate -L zsh
+  setopt local_options no_xtrace
+
+  if [[ -n ${GH_TOKEN:-} || -n ${GITHUB_TOKEN:-} ]]; then
+    command gh "$@"
+    return
+  fi
+
+  if (( ! $+commands[ghtkn] )); then
+    print -u2 -- "gh: ghtkn is required when no explicit GitHub token is set"
+    return 127
+  fi
+
+  command ghtkn exec -e GH_TOKEN:C-FO/write -- gh "$@"
+  local exit_status=$?
+  if (( exit_status == 111 )); then
+    print -u2 -- "gh: no ghtkn token available — run \`ghtkn agent unlock --enable-refresh\`"
+  fi
+  return $exit_status
+}
diff --git a/home/dot_zshenv.tmpl b/home/dot_zshenv.tmpl
@@ -164,11 +164,14 @@ export PATH="$XDG_DATA_HOME/aquaproj-aqua/bin:$PATH"
 export BUSINESS_USE=1
 export COLIMA_HOME="$XDG_CONFIG_HOME/colima"
 
-# aqua reads its GitHub token from macOS Keychain — some C-FO repos resolve a
-# private aqua-registry, which needs an SSO-authorized token. Store it with
-# `aqua-token-sync` (features/aqua-token-sync.zsh); rerun after gh re-login
-# rotates the token. A GITHUB_TOKEN env var takes precedence and disables this.
-export AQUA_KEYRING_ENABLED=true
+# aqua gets its GitHub token from the ghtkn agent (some C-FO repos resolve a
+# private aqua-registry). The agent must be unlocked after each login with
+# `ghtkn agent unlock --enable-refresh`. GITHUB_TOKEN, AQUA_GITHUB_TOKEN and
+# AQUA_KEYRING_ENABLED must stay unset or aqua ignores ghtkn. GHTKN_APP picks
+# the read app, since the first app (C-FO/none) cannot read the registry.
+unset AQUA_KEYRING_ENABLED # shells under a long-lived multiplexer still inherit it, and aqua checks keyring first
+export AQUA_GHTKN_ENABLED=true
+export GHTKN_APP=C-FO/read
 
 # Corporate TLS inspection CA: wire palo-root.pem (in Homebrew's cert store)
 # into common SSL env vars so curl/Node/Python/Ruby-OpenSSL trust certificates

diff --git a/home/private_dot_zshrc.tmpl b/home/private_dot_zshrc.tmpl
@@ -28,7 +28,7 @@
 # =============================================================================
 {{ include "dot_config/zsh/features/ghq-fzf.zsh" }}
 {{- if .business_use }}
-{{ include "dot_config/zsh/features/aqua-token-sync.zsh" }}
+{{ include "dot_config/zsh/features/ghtkn-gh.zsh" }}
 {{- end }}
 {{ include "dot_config/zsh/features/git-branch-fzf.zsh" }}
 {{ include "dot_config/zsh/features/branch-cleanup.zsh" }}