anchor.diff:          WorkingDirectory = runtimeDir;
   
           InaccessiblePaths = [
  -          # Token file path given in the configuration
  -          cfg.tokenFile
  +          # Token file path given in the configuration, if visible to the service
  +          "-${cfg.tokenFile}"
             # Token file in the state directory
             "${stateDir}/${currentConfigTokenFilename}"
           ];
  
positive.code: 
                  # If the token file contains a PAT (i.e., it starts with "ghp_"), we have to use the --pat option,
                  # if it is not a PAT, we assume it contains a registration token and use the --token option
                  token=$(<"$STATE_DIRECTORY/${newConfigTokenFilename}")
                  if [[ "$token" =~ ^ghp_* ]]; then
                    args+=(--pat "$token")
                  else
  
negative.code:                 rm    -rf "$STATE_DIRECTORY/_diag/"
  
                  # Cleanup token from config
                  rm "${newConfigTokenPath}"
  
                  # Symlink to new config
                  ln -s '${newConfigPath}' "${currentConfigPath}"
  