fix(tooling): keep GitHub App auth when the agent gh shim delegates

[omegent-app]

PR badges stopped appearing in sidebar v2 for active threads, while settled rows kept theirs.
Root-caused on the running server, fix verified against the exact failing invocation.

What was happening

The server's VCS shell-outs resolve gh through each repo's .tools/bin — the agent policy shim
installed by scripts/install-git-hooks.mjs. Caught live off the server process:

CMD=node /var/lib/t3/deploy/t3code/scripts/agent-gh.mjs pr list --head release-cut-mako-easylife \
    --state all --limit 20 --json number,title,url,...

That shim resolves the binary to delegate to via findRealGh, which preferred $T3_GITHUB_REAL_GH
above everything else. That variable names the unauthenticated gh — the binary the GitHub App
wrapper execs after minting an installation token. The host exports it (see the server start
script: "still export REAL_GH / token paths so children that reorder PATH cannot lose minting
config") as configuration for the wrapper, not as an authenticated entry point.

So the shim skipped minting entirely and ran raw gh:

$ env -i $(server env) .tools/bin/gh pr list --head release-cut-mako-easylife --state all ...
To get started with GitHub CLI, please run:  gh auth login
exit=4

Exit 4 → SourceControlProviderError → the warning that has been filling the journal every 45s:

WARN: PR lookup failed; keeping last known PR state.  operation: lookupStatusPr
      errorTag: SourceControlProviderError   branch: release-cut-mako-easylife

Why settled rows still showed badges

That asymmetry is the tell. Settled worktrees take the durable settle freeze added in #362, which
returns resolveLastKnownPr(...) without calling the provider at all. A frozen row can't fail a
lookup it never makes. Every active row goes down the live path, hits the auth failure, and falls
back to a last-known value that is empty — so the card renders with no badge.

Introduced by 2ef070919 (2026-08-02, "enforce repository-owned agent ship gates"), which added the
T3_GITHUB_REAL_GH branch to findRealGh.

The fix

Resolution order becomes:

1. AGENT_GH_REAL — this shim's own re-entry override, unchanged.
2. PATH — where the App-aware gh lives.
3. T3_GITHUB_REAL_GH — last resort only, so hosts without a wrapper still work.

Verification

The same command that returned exit 4, under the server's exact environment, after the change:

$ .tools/bin/gh pr list --head sync/upstream-48aa875c0 --state all --limit 5 --json number,state
[{"number":372,"state":"MERGED"}]

Regression test added to scripts/agent-pre-push.test.mjs pinning all three tiers of the order; it
fails on the pre-fix implementation and passes after. Full file: 26 tests pass.

The deploy checkout was patched only to prove the fix live and has been restored to its released
state, so the fleet stays consistent with its deployed SHA until this lands.

Co-authored by @patroza

opened by Patrick Roza in chat thread Discord · Discord · T3