[lightningspirit]

Summary

Users already have Coder user secrets ONEDEV_SERVER_URL and ONEDEV_TOKEN in their workspaces. tod reads ONEDEV_SERVER_URL directly, but the token as ONEDEV_ACCESS_TOKEN.

• /usr/local/bin/tod is a wrapper (build/tod-env.sh): if ONEDEV_ACCESS_TOKEN is unset and ONEDEV_TOKEN is set, it exports ONEDEV_ACCESS_TOKEN=$ONEDEV_TOKEN, then exec /usr/local/lib/tod/tod. Works for terminals, scripts and Claude Code.
• Remove the onedev_url template variable (added in Add the OneDev CLI (tod) and its Claude Code skills to all images #22): the URL comes from the user secret, so there is one source and no question which of template env and user secret wins. Remove onedev_url from your vars.yaml (done in this workspace) before the next release, or the push fails on an undeclared variable.
• Without secrets, tod config set still works (config file).
• Smoke test: no token without env; token present with only ONEDEV_TOKEN.
• READMEs: set the two user secrets; note that an env token is readable by any process in the workspace, Claude Code included (use a minimal-scope token).
• Image tags: node v0.8.0, php-wordpress v0.8.0, ops v0.7.0. main.tf is otherwise back to its pre-Add the OneDev CLI (tod) and its Claude Code skills to all images #22 content.

Checks

• Local test of the wrapper: unset → none; ONEDEV_TOKEN only → used; ONEDEV_ACCESS_TOKEN="" explicit → kept empty; both set → ONEDEV_ACCESS_TOKEN wins
• Local node-js build: smoke test passes; just lint, just validate pass

🤖 Generated with Claude Code