MANUAL RUN: MAKE AGENT OFFICE AGENT AGAIN #942

Part of #754, and follows on from #819. The office was restarted with zsh ~/office-as-bot-754.sh, but its workers still act as QuinnsCode on GitHub: #936 and #939 were both opened and merged as QuinnsCode.

What a worker sees (checked 12 Oct)

• The script's git settings are in effect: the keychain helper is cleared and !gh auth git-credential is set.
• GH_TOKEN reaches the workers, but it is empty.
• gh auth status says Logged in … QuinnsCode (keyring). An empty GH_TOKEN makes gh fall back to the owner's keyring login, and git pushes go through gh as well.

Why the script didn't stop
Line 9 is export GH_TOKEN=$(op read …). When the command runs inside export, the line reports export's exit status (success), so set -e never saw op read fail. The script went on with an empty token, printed GitHub as: QuinnsCode, and started the office anyway. Why op read came back empty isn't known yet. It could have been a dismissed Touch ID prompt, or the item may not be at op://codesplitter/github-bot/token. #754 still names it codesplitters/github-bot, from before the vault rename (#824).

Steps (owner)

1. Replace ~/office-as-bot-754.sh with the version below. It stops if op read fails or returns nothing, and it won't start the office unless gh says quinnscode-bot. Replacing the file is safe at any time, because nothing reads it until the next restart.
2. Wait until no worker is mid-task: nothing uncommitted, and nothing left unpushed. Restarting the office ends every session.
3. Stop the office, then start it again from apps/agent-office with zsh ~/office-as-bot-754.sh. If it stops with "op read failed", check that the 1Password item is at codesplitter/github-bot and has a token field.
4. Check that a new worker's gh api user --jq .login prints quinnscode-bot. Then carry on with MANUAL RUN: restart Agent Office as quinnscode-bot (#754 step 2) #819 (the ruleset PR, written by the bot).

#!/bin/zsh
# #754: start Agent Office with its workers acting as quinnscode-bot on GitHub (Write, not Admin).
# Run it where you'd run `bun run office` (apps/agent-office), instead of that command:
#   zsh ~/office-as-bot-754.sh
set -euo pipefail
export PATH=/opt/homebrew/bin:$PATH

# The bot's classic token (repo + workflow), from 1Password behind Touch ID. Never printed.
# Assign first, export after: `export X=$(cmd)` hides cmd's failure from set -e, and an empty
# GH_TOKEN makes gh fall back to your keyring login, so the whole office ran as QuinnsCode.
token=$(op read "op://codesplitter/github-bot/token") || { echo "op read failed: is the item at op://codesplitter/github-bot/token?" >&2; exit 1; }
[[ -n $token ]] || { echo "op read returned an empty token" >&2; exit 1; }
export GH_TOKEN=$token
unset token
# live/env.ts drops *_TOKEN names from workers; let this one through, since it is the agents' own identity.
export AGENT_OFFICE_ENV_PASS=GH_TOKEN

# git push uses the macOS keychain (your login) by default. For this office and its workers only:
# clear that helper, and let gh answer for github.com with GH_TOKEN instead.
export GIT_CONFIG_COUNT=2
export GIT_CONFIG_KEY_0=credential.helper GIT_CONFIG_VALUE_0=
export GIT_CONFIG_KEY_1=credential.https://git.lvmhsh.cn.helper GIT_CONFIG_VALUE_1='!gh auth git-credential'

login=$(gh api user --jq .login)
echo "GitHub as: $login"
[[ $login == quinnscode-bot ]] || { echo "expected quinnscode-bot, got $login: not starting the office" >&2; exit 1; }
exec bun run office