XY-709: GitHub CLI authority P2: expose configured gh path and fallback diagnostics

apps/decodex/src/agent/tracker_tool_bridge.rs

@@ -82,6 +82,7 @@ pub(crate) trait PullRequestInspector {
 		cwd: &Path,
 		pr_url: &str,
 		github_token: &str,
+		gh_command_path: Option<&Path>,
 	) -> std::result::Result<PullRequestDetails, String>;
 }
 
@@ -482,6 +483,7 @@ pub(crate) struct ReviewHandoffContext {
 	pub(crate) worktree_path: String,
 	pub(crate) cwd: PathBuf,
 	pub(crate) github_token_env_var: Option<String>,
+	pub(crate) github_command_path: Option<PathBuf>,
 	pub(crate) internal_review_mode: InternalReviewMode,
 	pub(crate) mode: ReviewExecutionMode,
 	pub(crate) recorded_pr_url: Option<String>,
@@ -603,8 +605,9 @@ impl PullRequestInspector for GhPullRequestInspector {
 		cwd: &Path,
 		pr_url: &str,
 		github_token: &str,
+		gh_command_path: Option<&Path>,
 	) -> std::result::Result<PullRequestDetails, String> {
-		let mut command = github::gh_command();
+		let mut command = github::gh_command_with_config(gh_command_path);
 
 		command.args([
 			"pr",

apps/decodex/src/agent/tracker_tool_bridge/review.rs

@@ -164,6 +164,7 @@ impl<'a> TrackerToolBridge<'a> {
 			&review_context.cwd,
 			pr_url,
 			github_token.as_str(),
+			review_context.github_command_path.as_deref(),
 		)?;
 		let local_repo = self.local_repo_inspector.inspect_local_repo(&review_context.cwd)?;
 
@@ -233,6 +234,7 @@ impl<'a> TrackerToolBridge<'a> {
 			&review_context.cwd,
 			pr_url,
 			github_token.as_str(),
+			review_context.github_command_path.as_deref(),
 		)?;
 		let local_repo = self.local_repo_inspector.inspect_local_repo(&review_context.cwd)?;
 

apps/decodex/src/agent/tracker_tool_bridge/tests.rs

@@ -235,6 +235,7 @@ impl PullRequestInspector for FakePullRequestInspector {
 		_cwd: &Path,
 		_pr_url: &str,
 		_github_token: &str,
+		_gh_command_path: Option<&Path>,
 	) -> std::result::Result<PullRequestDetails, String> {
 		self.responses.borrow_mut().remove(0)
 	}
@@ -250,6 +251,7 @@ impl PullRequestInspector for GitHubTokenAssertingPullRequestInspector {
 		_cwd: &Path,
 		_pr_url: &str,
 		github_token: &str,
+		_gh_command_path: Option<&Path>,
 	) -> std::result::Result<PullRequestDetails, String> {
 		assert_eq!(github_token, self.expected_token.as_str());
 
@@ -442,6 +444,7 @@ fn sample_review_context() -> ReviewHandoffContext {
 		worktree_path: String::from(".worktrees/PUB-618"),
 		cwd: PathBuf::from("/tmp/PUB-618"),
 		github_token_env_var: Some(String::from("HOME")),
+		github_command_path: None,
 		internal_review_mode: InternalReviewMode::Loop,
 		mode: ReviewExecutionMode::Handoff,
 		recorded_pr_url: None,
@@ -469,6 +472,7 @@ fn sample_review_context_in(cwd: &Path) -> ReviewHandoffContext {
 		worktree_path: String::from(".worktrees/PUB-618"),
 		cwd: cwd.to_path_buf(),
 		github_token_env_var: Some(String::from("HOME")),
+		github_command_path: None,
 		internal_review_mode: InternalReviewMode::Loop,
 		mode: ReviewExecutionMode::Handoff,
 		recorded_pr_url: None,
@@ -484,6 +488,7 @@ fn sample_review_repair_context_in(cwd: &Path, pr_url: &str) -> ReviewHandoffCon
 		worktree_path: String::from(".worktrees/PUB-618"),
 		cwd: cwd.to_path_buf(),
 		github_token_env_var: Some(String::from("HOME")),
+		github_command_path: None,
 		internal_review_mode: InternalReviewMode::Loop,
 		mode: ReviewExecutionMode::Repair,
 		recorded_pr_url: Some(pr_url.to_owned()),
@@ -499,6 +504,7 @@ fn sample_closeout_context_in(cwd: &Path, pr_url: &str) -> ReviewHandoffContext
 		worktree_path: String::from(".worktrees/PUB-618"),
 		cwd: cwd.to_path_buf(),
 		github_token_env_var: Some(String::from("HOME")),
+		github_command_path: None,
 		internal_review_mode: InternalReviewMode::Loop,
 		mode: ReviewExecutionMode::Closeout,
 		recorded_pr_url: Some(pr_url.to_owned()),

apps/decodex/src/config.rs

@@ -107,7 +107,7 @@ impl ServiceConfig {
 			worktree_root: document.paths.resolve_worktree_root(&repo_root)?,
 			workflow_path: config_dir.join(WORKFLOW_FILE_NAME),
 			tracker: document.tracker,
-			github: document.github,
+			github: document.github.resolve_paths(config_dir)?,
 			codex: document.codex.resolve_paths(config_dir)?,
 			privacy_classifier: document.privacy_classifier,
 		})
@@ -143,21 +143,41 @@ impl ProjectTrackerConfig {
 #[serde(deny_unknown_fields)]
 pub struct ProjectGitHubConfig {
 	token_env_var: String,
+	command_path: Option<PathBuf>,
 }
 impl ProjectGitHubConfig {
 	/// Name of the environment variable that stores the GitHub token.
 	pub fn token_env_var(&self) -> &str {
 		&self.token_env_var
 	}
 
+	/// Optional configured GitHub CLI command path.
+	pub fn command_path(&self) -> Option<&Path> {
+		self.command_path.as_deref()
+	}
+
 	/// Resolve the configured GitHub token env-var name into a concrete token string.
 	pub fn resolve_token(&self) -> Result<String> {
 		resolve_secret_env_var("github.token_env_var", self.token_env_var())
 	}
 
+	fn resolve_paths(mut self, config_dir: &Path) -> Result<Self> {
+		if let Some(command_path) = self.command_path.take() {
+			validate_nonempty_path("github.command_path", &command_path)?;
+
+			self.command_path = Some(resolve_relative_path(config_dir, &command_path));
+		}
+
+		Ok(self)
+	}
+
 	fn validate(&self) -> Result<()> {
 		validate_env_var_name("github.token_env_var", self.token_env_var())?;
 
+		if let Some(command_path) = self.command_path.as_deref() {
+			validate_nonempty_path("github.command_path", command_path)?;
+		}
+
 		Ok(())
 	}
 }
@@ -951,6 +971,7 @@ mod tests {
 
 				[github]
 				token_env_var = "HOME"
+				command_path = "bin/gh"
 			"#,
 		);
 		let config =
@@ -963,6 +984,7 @@ mod tests {
 		assert_eq!(config.worktree_root(), canonical_root.join(".worktrees"));
 		assert_eq!(config.workflow_path(), canonical_root.join("WORKFLOW.md"));
 		assert_eq!(config.github().token_env_var(), "HOME");
+		assert_eq!(config.github().command_path(), Some(canonical_root.join("bin/gh").as_path()));
 		assert_eq!(config.codex().internal_review_mode(), InternalReviewMode::Loop);
 		assert!(config.codex().external_review_enabled());
 	}