Function read_local_token

crates/openshell-supervisor-process/src/debug_rpc.rs:189–210

Read the token from the env/file/SA-bootstrap chain, but only the "already a gateway JWT" paths — show-token / show-principal don't want to actually exchange an SA token.

()

/// "already a gateway JWT" paths — show-token / show-principal don't
/// want to actually exchange an SA token.
fn read_local_token() -> Result<String> {
    if let Ok(t) = std::env::var(openshell_core::sandbox_env::SANDBOX_TOKEN)
        && !t.is_empty()
    {
        return Ok(t);
    }
    if let Ok(path) = std::env::var(openshell_core::sandbox_env::SANDBOX_TOKEN_FILE)
        && !path.is_empty()
    {
        return Ok(std::fs::read_to_string(&path)
            .into_diagnostic()
            .wrap_err_with(|| format!("failed to read sandbox token from {path}"))?
            .trim()
            .to_string());
    }
    Err(miette::miette!(
        "no in-process gateway JWT available — set OPENSHELL_SANDBOX_TOKEN or \
         OPENSHELL_SANDBOX_TOKEN_FILE. The K8s SA-bootstrap path is intentionally \
         excluded from `show-token` / `show-principal` to avoid issuing a fresh \
         token just for inspection."
    ))
}

fn parse_flag<'a>(args: &'a [String], name: &str) -> Option<&'a str> {
    let mut iter = args.iter();