# Populate GitHub MCP auth for Codex from a GitHub personal access token.
# The token value is exported into the process environment but is not stored here.
case "${CODEX_GITHUB_PERSONAL_ACCESS_TOKEN:-}" in
  github_pat_*|ghp_*) ;;
  *)
    unset CODEX_GITHUB_PERSONAL_ACCESS_TOKEN
    if command -v security >/dev/null 2>&1; then
      _codex_github_token="$(security find-generic-password -a "$USER" -s codex-github-mcp-pat -w 2>/dev/null || true)"
    else
      _codex_github_token=""
    fi

    case "$_codex_github_token" in
      github_pat_*|ghp_*)
        export CODEX_GITHUB_PERSONAL_ACCESS_TOKEN="$_codex_github_token"
        ;;
    esac

    unset _codex_github_token
    ;;
esac