ENH: opt-in GH_TOKEN_* passthrough for bwopencode#14
Merged
Thomas A Caswell (tacaswell) merged 2 commits intoJul 22, 2026
Merged
Conversation
Add --github-tokens to forward GH_TOKEN_* env vars into the sandbox so the agent can authenticate gh(1) via per-command token selection. Off by default; values are printed as REDACTED under --dry-run so tokens never reach the terminal. Assisted-by: opencode:claude-opus-4-8 Assisted-by: opencode:claude-sonnet-4-6
Stuart B. Wilkins (stuwilkins)
requested review from
Copilot and
Thomas A Caswell (tacaswell)
July 18, 2026 12:21
Copilot started reviewing on behalf of
Stuart B. Wilkins (stuwilkins)
July 18, 2026 12:21
View session
There was a problem hiding this comment.
Pull request overview
Adds an opt-in --github-tokens flag to bwopencode to forward GH_TOKEN_* environment variables into the bubblewrap sandbox, enabling per-command GitHub CLI (gh) authentication without making token forwarding the default behavior. Documentation is updated to describe the new option and how to use it safely with --dry-run.
Changes:
- Add
--github-tokenswrapper option tobin/bwopencodeand plumb it into sandbox environment construction. - Implement
--dry-runredaction for forwardedGH_TOKEN_*values (printed asREDACTED). - Document the new
bwopencodeoption and provide an example for per-command token selection.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| docs/bw-wrappers.md | Documents the new bwopencode --github-tokens option and usage example. |
| bin/bwopencode | Adds --github-tokens parsing and forwards GH_TOKEN_* into the sandbox with dry-run redaction. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Contributor
|
Do we want to add this to all of the wrappers? |
Contributor
Author
Extends the --github-tokens flag added to bwopencode (cb57193) to the remaining wrapper scripts, so gh(1) can be authenticated with per-command token selection across all four sandboxed agent CLIs. Assisted-by: opencode:claude-sonnet-5
Stuart B. Wilkins (stuwilkins)
force-pushed
the
add_gh_token_passthrough
branch
from
July 18, 2026 19:37
3cb7412 to
338cf52
Compare
Copilot started reviewing on behalf of
Stuart B. Wilkins (stuwilkins)
July 18, 2026 19:41
View session
Thomas A Caswell (tacaswell)
approved these changes
Jul 22, 2026
Thomas A Caswell (tacaswell)
left a comment
Thomas A Caswell (tacaswell)
left a comment
Contributor
There was a problem hiding this comment.
I think this is a less than good idea, but clearly there is a demand to let the robot touch gh.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add --github-tokens to forward GH_TOKEN_* env vars into the sandbox so the agent can authenticate gh(1) via per-command token selection. Off by default; values are printed as REDACTED under --dry-run so tokens never reach the terminal.
Assisted-by: opencode:claude-opus-4-8
Assisted-by: opencode:claude-sonnet-4-6