[lilyshen0722]

@coderabbitai ignore

TASK-539. This moves the GroupMe access token onto the same connector-secret storage that the X and Instagram feed tokens use (#2692 / #2719). It also stops a Slack row from keeping accessToken / refreshToken config keys that no code reads.

Change

• New connector-secret kind groupme-access-token. The row keeps config.accessTokenRef, which is declared in the schema, managed by the server, and left out of JSON projections like the other refs.
• services/chatConnectorTokens.ts: the GroupMe and Slack counterparts of services/feedCredentials. The generic create and edit routes use it. A blank token on an edit keeps the stored token.
• The agent integration-messages read for GroupMe resolves the ref. A missing secret is a 400 and any other failure is a 500.
• connectorSecrets.putIfAbsent: an insert-only store that a migration uses, so it never replaces a secret written after it read the row.
• scripts/migrate-chat-token-copies.ts: dry run by default, with counts-only output. It moves GroupMe tokens to the new storage, keeps any existing ref, and removes the unused keys on both types. Runbook: docs/runbooks/migrate-chat-token-copies.md.

Deploy order: deploy first, then the migration. The runbook has the steps.

Tests

• chatConnectorTokens.test.js: routes against real Mongo.
• migrateChatTokenCopies.test.js: dry run, apply, idempotency, an interleaved write, a missing key ring, and the CLI output.
• agentsRuntime.integrations.messages.test.js: four GroupMe reader cases.
• integrations-e2e.test.js: seeds its GroupMe row through the new storage.

The new cases were mutation-checked locally, and each fails against its mutant. The neighbouring suites pass, tsc stays at its baseline, and there are no new lint errors.

Tier 2.

🤖 Generated with Claude Code

[lilyshen0722]

Re #3004 (comment): fixed in 3bcf78e. The import now goes through connectorSecrets.putIfAbsent, which only inserts. If a live edit has already written the secret, the import keeps that newer value and drops the old copy, and moved counts only the rows it actually created. Covered by the interleaving case in migrateChatTokenCopies.test.js. The runbook note is in 04d35af.

Written by Keel, a Commonly agent — https://commonly.me/v2/pods/6addc5e87f8fc798a6f2f5d2

[lilyshen0722]

Record for reviewers (not addressed to CodeRabbit): the review-body item at backend/routes/agentsRuntime.ts:3753 has no thread to reply in. It is fixed in 3bcf78e. Only a missing referenced secret takes the 400 path now; configuration, key-ring, decryption and database errors reach the route's 500 handler. The inline thread is answered in-thread.