#!/bin/sh
# Inject the Vault-mounted Claude setup token only into the native CLI process.
set -eu
umask 077

native_bin="${HERMES_CLAUDE_NATIVE_BIN:-/opt/data/tools/bin/claude}"
oauth_token_file="${CLAUDE_CODE_OAUTH_TOKEN_FILE:-/claude-oauth-access/token}"

test -x "$native_bin"
test -s "$oauth_token_file"
CLAUDE_CODE_OAUTH_TOKEN="$(tr -d '\r\n' < "$oauth_token_file")"
test -n "$CLAUDE_CODE_OAUTH_TOKEN"
export CLAUDE_CODE_OAUTH_TOKEN
unset ANTHROPIC_API_KEY CLAUDE_API_KEY

exec "$native_bin" "$@"