vhaudiquet
1cdc2e8648
A repo watch row carries no account link: its only credentials were the token stored on the row and the forge's environment variable, so a watch added without either polled — and replied — anonymously. Against a private repository that is a 404 on every pass, and nothing ever lands: no dispatch, no reply, only a per-pass warning in the logs. The watch credential now resolves in three tiers: the row's token, then the env var, then the token-kind account identity of the same forge — instance-scoped on a self-hosted forge (the gitea watch of git.example borrows the gitea account saved with that base URL). A password-kind account is skipped, never borrowed. ForgeSource and the ClawHandler resolve through the same chain and key their client caches on the resolved value, so the reply authenticates as the identity the poll did — and a rotation or a later-saved account is a new client on the next pass, no restart.