feat: correctly propagate GH MCP PAT

flake.lock

@@ -110,16 +110,18 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1778754079,
-        "narHash": "sha256-ER8/eMMoOVtX008KTTLJg5MwUixgIPymzL1JeVAYvA8=",
-        "rev": "0977d3a41ce06b5aa65f5c54566f9e8fd898e017",
-        "revCount": 97,
-        "type": "tarball",
-        "url": "https://api.flakehub.com/f/pinned/Naxdy/nix-bwrapper/1.2.0/019e266f-3d97-7e92-8eef-cb5da3d07a42/source.tar.gz"
+        "lastModified": 1784372176,
+        "narHash": "sha256-bNcP0odFltq9A1EzwQeZQvrnEwmE0UIZdi9/K3dhaiY=",
+        "owner": "Naxdy",
+        "repo": "nix-bwrapper",
+        "rev": "af78549b10ec39f308d0b122bc7e1674a2bd2fc4",
+        "type": "github"
       },
       "original": {
-        "type": "tarball",
-        "url": "https://flakehub.com/f/Naxdy/nix-bwrapper/%2A"
+        "owner": "Naxdy",
+        "ref": "feat/seccomp-filtering",
+        "repo": "nix-bwrapper",
+        "type": "github"
       }
     },
     "nixpkgs": {

flake.nix

@@ -5,7 +5,7 @@
     nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-unstable";
 
     nix-bwrapper = {
-      url = "https://flakehub.com/f/Naxdy/nix-bwrapper/*";
+      url = "github:Naxdy/nix-bwrapper?ref=feat/seccomp-filtering";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 

package.nix

@@ -714,7 +714,12 @@ nixvim.makeNixvim {
     tree-sitter
 
     (mkBwrapper {
-      app.package = opencode;
+      app = {
+        package = opencode;
+        env = {
+          GITHUB_MCP_PAT = "$GITHUB_MCP_PAT";
+        };
+      };
       imports = [ bwrapperPresets.devshell ];
       mounts.readWrite = [
         "$HOME/.config/opencode"
@@ -734,6 +739,9 @@ nixvim.makeNixvim {
         addPkgs = [
           python3
         ];
+        env = {
+          GITHUB_MCP_PAT = "$GITHUB_MCP_PAT";
+        };
       };
       imports = [ bwrapperPresets.devshell ];
       mounts.readWrite = [