From fbc6fd5ce523d06a957917bb0549f566959b7b44 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 6 Jul 2026 22:35:17 +0200
Subject: [PATCH] fix(v5): rotate agent tokens every fifteen minutes

---
 app/Console/Kernel.php                    |  2 +-
 tests/Feature/ScheduleOnOneServerTest.php | 12 ++++++++++++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/app/Console/Kernel.php b/app/Console/Kernel.php
index f06bec45c..cb7995082 100644
--- a/app/Console/Kernel.php
+++ b/app/Console/Kernel.php
@@ -57,7 +57,7 @@ class Kernel extends ConsoleKernel
 
         // V5 host JWT rotation: re-mints and SSH-pushes a fresh host token
         // before the on-disk token expires so coold reconnects stay authorized.
-        $this->scheduleInstance->job(new V5RotateAgentTokensJob)->hourly()->withoutOverlapping()->onOneServer();
+        $this->scheduleInstance->job(new V5RotateAgentTokensJob)->everyFifteenMinutes()->withoutOverlapping()->onOneServer();
 
         if (isDev()) {
             // Instance Jobs
diff --git a/tests/Feature/ScheduleOnOneServerTest.php b/tests/Feature/ScheduleOnOneServerTest.php
index 167d16bfa..3d31b9139 100644
--- a/tests/Feature/ScheduleOnOneServerTest.php
+++ b/tests/Feature/ScheduleOnOneServerTest.php
@@ -48,3 +48,15 @@ it('schedules every production job with onOneServer', function () {
         );
     });
 });
+
+it('runs v5 agent token rotation often enough for the default ttl and refresh threshold', function () {
+    $schedule = app(Schedule::class);
+
+    $event = collect($schedule->events())->first(
+        fn ($e) => str_contains((string) $e->description, 'V5RotateAgentTokensJob')
+    );
+
+    expect($event)->not->toBeNull();
+    expect($event->expression)->toBe('*/15 * * * *');
+    expect($event->onOneServer)->toBeTrue();
+});