Set GH_CONFIG_DIR=$AGENT_HOME/.config/gh before gh auth login so
each agent writes to its own directory rather than the shared global
config. This prevents tokens from different agents bleeding into one
another's gh auth state.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Move token generation logic from inline SKILL.md code blocks into a
single scripts/generate-token.sh that agents can invoke directly.
Adds env var validation, error handling, and gh CLI auth in one step.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
- Add --raw flag that prints only the token value (no export wrapper),
making GH_TOKEN=$(./generate_token.sh --raw) the recommended pattern
for AI agents and CI/CD.
- Clean up die() to only write to stderr (remove eval-safe stdout hack).
- Fix SKILL.md: correct step numbering, remove unused grep prerequisite,
replace placeholder paths, lead with --raw usage, move eval to legacy.
- Update CLAUDE.md to reflect new --raw pattern.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Replaced my bash implementation with the user's provided snippet.
Key differences that fix the bad credentials issue on macOS:
1. Uses openssl enc -base64 -A instead of openssl base64
2. Uses jq -r -c . to strictly format the JSON header/payload
3. Explicitly wraps the RSA signature binary in b64enc.
Replaced generate_jwt.py with generate_jwt.sh using only openssl and
coreutils. Updated SKILL.md to remove the python fallback section and
use grep/cut for JSON parsing instead of python3.
The previous implementation had a stdin conflict -- it passed the PEM
key on stdin but also needed to pass the unsigned data on stdin. Now
that we take a file path, openssl reads the key from the file and gets
the data to sign from stdin.
Also removed the dead-code tempfile fallback and unused hashlib import.
Goose
Chris Farhood