From 6dcf35c5f92e893cd07622575ea9719ede1e2f35 Mon Sep 17 00:00:00 2001
From: openhands <openhands@all-hands.dev>
Date: Thu, 26 Mar 2026 16:20:40 +0000
Subject: [PATCH] fix: Extract vault-env.sh to deduplicate vault token override

Moves shared env.sh sourcing + vault-bot token override into
vault/vault-env.sh so the three vault sub-scripts no longer share
a duplicate 5-line block.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 vault/vault-agent.sh  | 4 +---
 vault/vault-env.sh    | 9 +++++++++
 vault/vault-fire.sh   | 4 +---
 vault/vault-reject.sh | 4 +---
 4 files changed, 12 insertions(+), 9 deletions(-)
 create mode 100644 vault/vault-env.sh

diff --git a/vault/vault-agent.sh b/vault/vault-agent.sh
index eab384f..1bda3b9 100755
--- a/vault/vault-agent.sh
+++ b/vault/vault-agent.sh
@@ -11,9 +11,7 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-source "${SCRIPT_DIR}/../lib/env.sh"
-# Use vault-bot's own Forgejo identity (#747)
-FORGE_TOKEN="${FORGE_VAULT_TOKEN:-${FORGE_TOKEN}}"
+source "${SCRIPT_DIR}/vault-env.sh"
 
 VAULT_DIR="${FACTORY_ROOT}/vault"
 PROMPT_FILE="${VAULT_DIR}/PROMPT.md"
diff --git a/vault/vault-env.sh b/vault/vault-env.sh
new file mode 100644
index 0000000..79e4176
--- /dev/null
+++ b/vault/vault-env.sh
@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+# vault-env.sh — Shared vault environment: loads lib/env.sh and activates
+# vault-bot's Forgejo identity (#747).
+# Source this instead of lib/env.sh in vault scripts.
+
+# shellcheck source=../lib/env.sh
+source "$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/lib/env.sh"
+# Use vault-bot's own Forgejo identity
+FORGE_TOKEN="${FORGE_VAULT_TOKEN:-${FORGE_TOKEN}}"
diff --git a/vault/vault-fire.sh b/vault/vault-fire.sh
index 515fba9..e240fb0 100755
--- a/vault/vault-fire.sh
+++ b/vault/vault-fire.sh
@@ -13,9 +13,7 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-source "${SCRIPT_DIR}/../lib/env.sh"
-# Use vault-bot's own Forgejo identity (#747)
-FORGE_TOKEN="${FORGE_VAULT_TOKEN:-${FORGE_TOKEN}}"
+source "${SCRIPT_DIR}/vault-env.sh"
 
 VAULT_DIR="${FACTORY_ROOT}/vault"
 LOCKS_DIR="${VAULT_DIR}/.locks"
diff --git a/vault/vault-reject.sh b/vault/vault-reject.sh
index 821094c..9699753 100755
--- a/vault/vault-reject.sh
+++ b/vault/vault-reject.sh
@@ -6,9 +6,7 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-source "${SCRIPT_DIR}/../lib/env.sh"
-# Use vault-bot's own Forgejo identity (#747)
-FORGE_TOKEN="${FORGE_VAULT_TOKEN:-${FORGE_TOKEN}}"
+source "${SCRIPT_DIR}/vault-env.sh"
 
 VAULT_DIR="${FACTORY_ROOT}/vault"
 LOGFILE="${VAULT_DIR}/vault.log"