fix(tasks): deliver the per-actor github token to gh via a PATH shim

The backend delivers the per-actor GitHub token through BASH_ENV, which only
non-interactive `bash -c` honors. The agent runs its tool commands in an
interactive shell, so `gh` there had no token and PR creation failed once the
frozen process-env token was removed.

Add a gh PATH shim (mirroring git-guard) installed first on PATH that sources
the same credential script on every call, so gh authenticates as the current
actor regardless of shell mode and honors logout (an emptied file exports
nothing). gh is the only env-dependent consumer: git uses the remote URL and
the signed-commit tool reads the file in-process.

Author: VojtechBartos

products/tasks/backend/logic/services/modal_sandbox.py

@@ -185,6 +185,7 @@ def _resource_create_kwargs(config: SandboxConfig) -> dict[str, object]:
 }
 LOCAL_MODAL_INSTALL_SKILLS_SCRIPT = Path("products/tasks/backend/sandbox/images/install-skills.sh")
 LOCAL_MODAL_GIT_GUARD_SCRIPT = Path("products/tasks/backend/sandbox/images/git-guard.sh")
+LOCAL_MODAL_GH_GUARD_SCRIPT = Path("products/tasks/backend/sandbox/images/gh-guard.sh")
 
 
 _image_ref_cache: TTLCache = TTLCache(maxsize=3, ttl=300)
@@ -445,11 +446,14 @@ def _prepare_local_modal_build_context(template: SandboxTemplate) -> tuple[str,
     destination_dockerfile_path.parent.mkdir(parents=True, exist_ok=True)
     shutil.copy2(source_dockerfile_path, destination_dockerfile_path)
 
-    # Both base and notebook Dockerfiles COPY the git guard, so include it in
-    # every local build context.
+    # Both base and notebook Dockerfiles COPY the git and gh guards, so include
+    # them in every local build context.
     destination_git_guard_path = context_dir / LOCAL_MODAL_GIT_GUARD_SCRIPT
     destination_git_guard_path.parent.mkdir(parents=True, exist_ok=True)
     shutil.copy2(base_dir / LOCAL_MODAL_GIT_GUARD_SCRIPT, destination_git_guard_path)
+    destination_gh_guard_path = context_dir / LOCAL_MODAL_GH_GUARD_SCRIPT
+    destination_gh_guard_path.parent.mkdir(parents=True, exist_ok=True)
+    shutil.copy2(base_dir / LOCAL_MODAL_GH_GUARD_SCRIPT, destination_gh_guard_path)
 
     if template == SandboxTemplate.DEFAULT_BASE:
         source_install_script_path = base_dir / LOCAL_MODAL_INSTALL_SKILLS_SCRIPT

products/tasks/backend/sandbox/images/Dockerfile.sandbox-base

@@ -158,6 +158,10 @@ RUN git config --global user.email "code@posthog.com" && \
 # Block `git commit`/`git push` so unsigned commits cannot leave the sandbox
 COPY products/tasks/backend/sandbox/images/git-guard.sh /opt/posthog/bin/git
 RUN chmod +x /opt/posthog/bin/git
+# Inject the per-actor GitHub token into every `gh` call (BASH_ENV only reaches
+# non-interactive `bash -c`; the agent's interactive shell needs this shim).
+COPY products/tasks/backend/sandbox/images/gh-guard.sh /opt/posthog/bin/gh
+RUN chmod +x /opt/posthog/bin/gh
 ENV PATH="/opt/posthog/bin:${PATH}"
 
 # This is required for the Claude Code SDK to allow --dangerously-skip-permissions as the root user

products/tasks/backend/sandbox/images/Dockerfile.sandbox-notebook

@@ -91,6 +91,10 @@ RUN git config --global user.email "code@posthog.com" && \
 # Block `git commit`/`git push` so unsigned commits cannot leave the sandbox.
 COPY products/tasks/backend/sandbox/images/git-guard.sh /opt/posthog/bin/git
 RUN chmod +x /opt/posthog/bin/git
+# Inject the per-actor GitHub token into every `gh` call (BASH_ENV only reaches
+# non-interactive `bash -c`; the agent's interactive shell needs this shim).
+COPY products/tasks/backend/sandbox/images/gh-guard.sh /opt/posthog/bin/gh
+RUN chmod +x /opt/posthog/bin/gh
 ENV PATH="/opt/posthog/bin:${PATH}"
 
 # This is required for the Claude Code SDK to allow --dangerously-skip-permissions as the root user

products/tasks/backend/sandbox/images/gh-guard.sh

@@ -0,0 +1,33 @@
+#!/bin/bash
+# gh guard.
+#
+# Installed first on PATH inside the cloud sandbox image as /opt/posthog/bin/gh.
+# The backend delivers the per-actor GitHub token via BASH_ENV, which only
+# non-interactive `bash -c` honors — the agent runs its tool commands in an
+# interactive shell, so `gh` there would otherwise have no token. This shim
+# sources the same credential script the shells do, so `gh` authenticates as the
+# current actor regardless of shell mode, and honors logout (an emptied file
+# exports nothing, leaving gh unauthenticated rather than falling back to a stale
+# token). All arguments pass straight through to the real gh.
+
+native_gh=""
+for candidate in /usr/bin/gh /usr/local/bin/gh /bin/gh; do
+    if [ -x "$candidate" ] && [ "$candidate" != "/opt/posthog/bin/gh" ]; then
+        native_gh="$candidate"
+        break
+    fi
+done
+if [ -z "$native_gh" ]; then
+    echo "gh-guard: could not locate the real gh binary" >&2
+    exit 127
+fi
+
+# Re-source the backend-managed credentials fresh on every call (the file is
+# rewritten on each refresh / actor transition). The script's sourced branch
+# unsets then re-exports GH_TOKEN/GITHUB_TOKEN from the env file.
+if [ -f /tmp/agentsh-bash-env.sh ]; then
+    # shellcheck source=/dev/null
+    . /tmp/agentsh-bash-env.sh
+fi
+
+exec "$native_gh" "$@"