fix(agent): run gh attribution/whoami as the current actor

fetchPrAttribution and fetchGhLogin called gh with no env, inheriting the
process env — the actor's token frozen at launch. After a mid-session actor
transition that reports the wrong identity, and once the backend stops baking
the token into the process env these calls would run unauthenticated. Resolve
the live sandbox token (same file-first path as the signed-commit tools) and
pass it explicitly; fall back to the process env only when unmanaged.

Author: VojtechBartos

packages/agent/src/server/agent-server.ts

@@ -16,6 +16,7 @@ import {
 import { type ServerType, serve } from "@hono/node-server";
 import { execGh } from "@posthog/git/gh";
 import { getCurrentBranch } from "@posthog/git/queries";
+import { ghTokenEnv } from "@posthog/git/signed-commit";
 import {
   type Adapter,
   buildPrOutput,
@@ -82,6 +83,7 @@ import {
   resolveGatewayProduct,
   resolveLlmGatewayUrl,
 } from "../utils/gateway";
+import { resolveGithubToken } from "../utils/github-token";
 import { Logger } from "../utils/logger";
 import { logAgentshRuntimeInfo } from "./agentsh-runtime";
 import {
@@ -3786,6 +3788,15 @@ ${signedCommitInstructions}${prLinkInstructions}${shellEfficiencyInstructions}
     }
   }
 
+  /** Env for a `gh` call that must run as the *current* actor. Prefers the live
+   *  sandbox token (rewritten on an actor transition) over the process env
+   *  (frozen at launch); returns undefined when unmanaged (local/desktop) so
+   *  execGh falls back to the process env. */
+  private ghActorEnv(): Record<string, string> | undefined {
+    const token = resolveGithubToken();
+    return token === undefined ? undefined : ghTokenEnv(token);
+  }
+
   private async fetchPrAttribution(
     prUrl: string,
   ): Promise<{ createdAt: string | null; author: string | null }> {
@@ -3794,6 +3805,7 @@ ${signedCommitInstructions}${prLinkInstructions}${shellEfficiencyInstructions}
       {
         cwd: this.config.repositoryPath,
         timeoutMs: 10_000,
+        env: this.ghActorEnv(),
       },
     );
     if (res.exitCode !== 0) return { createdAt: null, author: null };
@@ -3817,6 +3829,7 @@ ${signedCommitInstructions}${prLinkInstructions}${shellEfficiencyInstructions}
     this.ghLoginPromise ??= execGh(["api", "user", "--jq", ".login"], {
       cwd: this.config.repositoryPath,
       timeoutMs: 10_000,
+      env: this.ghActorEnv(),
     })
       .then((res) => {
         const login = res.exitCode === 0 ? res.stdout.trim() : "";