{ lib, pkgs, ... }:

let
  wrapper = with pkgs; writeScriptBin "gh" ''
    #! ${execline}/bin/execlineb -s0

    fdmove 3 0
    pipeline { ${pass}/bin/pass show api.github.com }
    fdswap 0 3
    export GH_TOKEN_FD 3

    importas -i config_home XDG_CONFIG_HOME
    export GH_CONFIG_DIR ''${config_home}/gh

    ${pkgs.gh}/bin/gh $@
  '';
in

{
  environment.systemPackages = [ pkgs.gh (lib.hiPrio wrapper) ];
}