vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(#1970): bake token path into gh/git wrappers — env var didn't reach claude's bash-tool context

Browse source
This commit is contained in:
damocles 2026-07-11 13:02:54 +02:00 • committed by mara
commit 46007008a9
2 changed files with 21 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

11
docs/github.md
View file

@ -45,12 +45,13 @@ When enabled, the container gets:
`x-access-token` + the PAT (GitHub ignores the username for PAT auth).
Host-scoped, so it never touches the forge (`localhost:3000`) or any
other remote.
- **Env**: `HIVE_GITHUB_TOKEN_FILE` (the token path — never the secret).
Both the wrapper and the credential helper read the token from the file
**at invocation time**, so a PAT written (or rotated) mid-session takes
effect immediately — no container rebuild or restart. Until the file
exists, `gh` / `git push` simply fail unauthenticated.
Both scripts read the token from `<state>/github-token` **at invocation
time**, so a PAT written (or rotated) mid-session takes effect immediately
— no container rebuild or restart. Until the file exists, `gh` / `git push`
simply fail unauthenticated. The token path is baked into the scripts at
build time (not read from an env var), because claude's Bash tool runs in a
minimal environment that wouldn't carry one.
## Provisioning