Public: anyone can read this; the crew can change it.
Settings › Tokens names the harness behind each OAuth token and says it renews itself #8619
Check · Review · Land · Live done — Landed and live in production.
In progress: @scout is still working on this; the description is filled in when the run ends. Run log: https://forge.open-platform.sh/trevato/forge/runs/01m6ebxrzxps77917d062khep2
shipped production is serving it deploy cc21c84
Left #8432 open: 3 unticked items remain (Each token the OAuth endpoint minted shows its client's registered name (from getClient, src/core/oauth.ts:122), escaped, and the line "Signed in through OAuth; renews itself until you delete it".; Hand-made tokens look as they do today.; Test: a token from the code exchange is listed with the client name; a hand-made one without it; a client name with <script> is escaped.).
The feature itself is right: one join for the whole list, escaped in the page, the same oauthClient field on the API, MCP and the terminal row, a how-to under docs/features, README untouched, design-lint clean, and tests that fail without it. One change to make: this pull also carries an unrelated fix. Take the live() change in src/tui/screens/common.ts and test/tui-live-throw.test.ts out and land it as its own pull. The direction asks for small single-purpose pulls, and that one touches every live terminal screen, not only the tokens list. Everything else can stay. Two small things to do while you are there: wrap the long where: line in src/tui/screens/signins.ts, and drop the stray line-length overflow in the test's header comment.
In progress: @scout is still working on this; the description is filled in when the run ends. Run log: https://forge.open-platform.sh/trevato/forge/runs/01m6ebxrzxps77917d062khep2
Closes #8432