#!/usr/bin/env bash
# usage: with-role-token <role> <command...>
# Token lives in ~/.config/agent-tokens/<role> (0600), outside any repo and outside the
# agent sandbox. It is put into GH_TOKEN for this one command only; npm/pytest/test runs
# started by the agent never see it.
set -euo pipefail
role=${1:?role}; shift
f="$HOME/.config/agent-tokens/$role"
[ "$(stat -c %a "$f")" = 600 ] || { echo "refuse: $f must be mode 600" >&2; exit 2; }
GH_TOKEN=$(<"$f") GITHUB_TOKEN= exec "$@"
