@sema-agent/core 7.33.4 → 7.33.5

package/CHANGELOG.md

@@ -1,10 +1,49 @@
+## 7.33.5 — 2026-09-27
+
+### Security fix — git's indexed env config is withheld one entry at a time, whole, and the rest is handed on as a record git can read (#1152; 7.33.4 regression; behavior; +0 exports, +0 wire keys) (@server)
+
+- **Before.** The scrub judged `GIT_CONFIG_KEY_<i>` and `GIT_CONFIG_VALUE_<i>` as separate names: a KEY whose value tripped the URL screen (`includeIf.gitdir:/work/repo@v2/.path`) or a VALUE that did (`safe.directory = C:/Users/alice@example.com/repo`, an `Authorization:` header) was dropped alone while `GIT_CONFIG_COUNT` stayed, so every git child of the scrubbed environment refused to start (`missing config key` / `missing config value`, exit 128) — 7.33.4's wider screen made that reachable by ordinary path values.
+- **Now.** One entry = one judgment: the KEY and VALUE at an index are judged together by the same screens (userinfo URL in the key or the value, credential header, proxy address with a userinfo) and withheld together (`family-rule`, one finding per input name). When an entry below the count is withheld the record is rebuilt: the kept complete entries are renumbered 0..m-1 in index order (each member keeps its own spelling), `GIT_CONFIG_COUNT` becomes m, and git reads the rest of the host's config. Nothing is rewritten when no entry below the count is withheld (an entry the host left incomplete stays as written); members at or above the count, or with no count, are judged entry by entry and never renumbered. A count that is not decimal digits up to 2147483647, or two env names that fold to one member name, withholds the whole record. `isSecretEnvKey(key, value, env)` gives the same answer for each member (the entry is judged with its index group).
+- **Also (#1154).** A name with the member prefix and a suffix git never reads (`GIT_CONFIG_VALUE_00`, `_01`, `_x`, an empty suffix) is still readable by the child: it is paired with the other half of the same (case-folded) suffix and judged by the same predicate — a carrier pair is withheld on its own (never renumbered, the count untouched), a clean one goes back to the name rules (`GIT_CONFIG_KEY_01` still drops by the shape rule; only a canonical index is exempt from it); a suffix spelled twice withholds its pair.
+- **Who needs it.** Hosts that hand git config through the environment: a disclosed over-drop no longer takes every git child down with it.
+- **Who is hurt / compensation.** A finding names the INPUT name, and after a rebuild a kept entry can sit under an index a withheld one had — a consumer that treats "a finding's key is absent from the output" as an invariant (a put-back check such as `composed[f.key] === undefined`) must compare against the input map instead; a host rule that withholds the whole group whenever core withholds a member keeps working (it only drops more). The over-drops themselves stay (no path-shaped key allow list, KL-1129b); spellings that avoid them, checked with git 2.54: an `includeIf.gitdir:` path's `@` written as the glob `?` (`…/repo?v2/.path`), `safe.directory` moved into a global config file the host owns (`GIT_CONFIG_GLOBAL`; git ignores it in a repository's config), a URL with an `@scope` path written into the repository's config. `%40` is no way out (7.33.4's note is withdrawn): it trips the same screen, and `includeIf.gitdir` does not decode it. A count git also accepts but that is not plain digits (` 1`, `+1`, the empty string) withholds the whole record — git then runs without the host's environment config (over-drop on purpose: one reading of the count, KL-1129b).
+- Pins: `test/backlog1152-git-env-config-sources.test.ts` (#1152 block, real git: includeIf / safe.directory / middle-entry renumbering / spelling / untouched incomplete entry / orphans / unreadable counts / undefined members); `test/backlog1129-git-config-key-family.test.ts` half-group pins re-pinned to the whole-entry reading (intended flip, named in each pin).
+
+### Security fix — libcurl's proxy variables carrying a userinfo are withheld (#1150; existing — the scrub never read these values — not a 7.33.4 regression; behavior narrowing; +0 exports, +0 wire keys) (@server)
+
+- **Before.** The proxy screen read only a `GIT_CONFIG_VALUE_<i>` whose paired key names a proxy. `https_proxy="http://u:<password>@proxy:3128"` (and `http_proxy`, `all_proxy`, upper-case spellings) reached the child whole: a model could read the password, and git's libcurl sent it to the proxy (git 2.54 curl trace, and a loopback listener receiving `Proxy-Authorization: Basic …`).
+- **Now.** `http_proxy` / `https_proxy` / `all_proxy` and their upper-case spellings (compared case-folded) are judged as the `http.proxy` entry they are to libcurl, by the same entry predicate as git's config record: a userinfo or `%40` anywhere in the value, a userinfo URL, or a credential header drops the variable (`family-rule`). A proxy address with no userinfo stays; `no_proxy` is not a proxy address and is not read.
+- **Who is hurt / compensation.** A host whose tool children reach the network through a proxy that takes a password loses that proxy in the scrubbed child (git then connects directly and fails where egress needs the proxy). Hand it on explicitly: `NodeExecutionEnv` `inheritEnv: [..names]` (a strict allow list copied verbatim, no scrub) or `shellEnv` (passed verbatim); on sema-server, the site's named allow list where one exists (`LSP_ENV_ALLOW`, `BAKE_ENV_ALLOW`) or the host shell's `inheritEnv` setting. Or use a proxy that authenticates the host without a password in the environment. Other `<scheme>_proxy` names (`ftp_proxy`, `npm_config_https_proxy`, …) are outside this list (KL-1150).
+- Pins: `test/backlog1152-git-env-config-sources.test.ts` (#1150 block: five libcurl-read spellings with an unscrubbed control that sends the password to a loopback listener and a scrubbed run the listener never hears; `HTTP_PROXY` and mixed spellings; scheme-less / user-only / `socks5h` / single-slash / `%40` forms; `no_proxy` and address-only values stay).
+
+### Security fix — git config entries whose value is a password, and credential helpers that are shell text rather than a helper's name, are withheld (#1151; existing, not a 7.33.4 regression; behavior narrowing; +0 exports, +0 wire keys) (@server)
+
+- **Before.** The entry screens read URLs, headers and proxy addresses only. `credential.helper = !f() { printf 'username=u\npassword=<secret>\n'; }; f` reached the child whole and `git credential fill` answered the password; so did `imap.pass` / `sendemail.smtpPass` values.
+- **Now.** The entry's key decides two more readings, in the same predicate: a key whose variable is a password in git's documentation — `imap.pass`, `sendemail[.<identity>].smtpPass`, `gitcvs[.<method>].dbPass`, `git-p4.password`, and `pass` / `password` under any section (case-folded) — withholds its entry whatever the value; a `credential.helper` / `credential.<url>.helper` value (an empty `<url>`, `credential..helper`, included — git runs it too) withholds its entry unless it only NAMES a helper program: empty, a helper name with option words (`--opt`, `--opt=<word>`, `--opt <word>`, a word being path-class text), or an absolute path with no argument. git hands every helper value to `sh -c`, not only the `!` form: an absolute path with arguments (`/usr/bin/printf username=u\\npassword=<secret>\\n`) and a name followed by more shell (`store; printf …`) answered the password in git 2.54 too, so they withhold as well.
+- **Who is hurt / compensation.** Over-drops (KL-1129a): a Windows helper path (`C:/Program Files/…/git-credential-manager.exe`), a quoted path, a positional argument (`x --opt a b`). The entry is withheld whole and the rest of the record is handed on (#1152), so git runs without that helper. Configure such helpers in a git config file the host owns, or pass the group explicitly (`inheritEnv` / `shellEnv`).
+- Pins: `test/backlog1152-git-env-config-sources.test.ts` (#1151 block: four helper spellings × three key spellings with an unscrubbed `git credential fill` control that answers the password, helper references that stay, shell-text spellings that do not, documented password keys against real `git config --get`, non-password look-alikes, 1 MiB linearity).
+
+### Security fix — an `http.extraHeader` entry is withheld whatever the header's name (#1155; existing, not a 7.33.4 regression; behavior narrowing; +0 exports, +0 wire keys) (@server)
+
+- **Before.** The value screen recognised only `Authorization:` / `Proxy-Authorization:` / `Cookie:` headers. `http.extraHeader = X-Api-Key: <token>` (likewise `Private-Token:`, `X-Auth-Token:`, `X-Amz-Security-Token:`) reached the child whole and `git config --get-all http.extraheader` answered the token.
+- **Now.** The key decides, in the same place as the password keys: an entry whose key is `http.extraHeader` or `http.<url>.extraHeader` (case-folded, an empty `<url>` included) is withheld whole whatever the header text — git sends it on every request and a credential header can carry any name. The same predicate serves the indexed record, `GIT_CONFIG_PARAMETERS` and non-index suffixes. A header-looking value under any other key is still judged by the value screen.
+- **Who is hurt / compensation.** A deployment that sends a non-credential header through `http.extraHeader` in the environment (a trace or routing header, or the empty `Authorization:` that suppresses git's own header) loses that entry in the child; the rest of the record is handed on (#1152). Compensation as for #1151: configure it in a git config file the host owns, or pass the group explicitly (`inheritEnv` / `shellEnv`).
+- Pins: `test/backlog1152-git-env-config-sources.test.ts` (#1155 block: four header names × four key spellings × the indexed record and `GIT_CONFIG_PARAMETERS`, real `git config --get-regexp` before and after, a non-index suffix, `http.extraHeaders` control); `test/backlog1129-git-config-key-family.test.ts` empty-`Authorization:` and key-only extra-header pins re-pinned (intended flip).
+
+### Security fix — `GIT_CONFIG_PARAMETERS` is read as git reads it and withheld whole when any entry carries a credential (#1141; existing since before 7.32.1, KL-1129e closed; behavior narrowing; +0 exports, +0 wire keys) (@server)
+
+- **Before.** git's second environment config channel — the single variable `git -c` hands its children, a list of single-quoted items — was in no table and matched no name rule: `GIT_CONFIG_PARAMETERS="'http.extraheader'='Authorization: Bearer <token>'"` reached the child whole and `git config --get http.extraheader` answered the token.
+- **Now.** The value is read with git's own grammar — items separated by space / tab / LF / CR, each `'key'='value'`, `'key'=` or the older `'key=value'` (split at the first `=`), `'\''` / `'\!'` escapes inside the quotes — and every entry is judged by the same predicate as the indexed record (userinfo URL in key or value, credential header, proxy userinfo, password key, inline helper). Any entry that carries a credential withholds the variable whole (`family-rule`; it is one variable, nothing is rewritten). A value git refuses as a bogus format is withheld too (git would have refused to start). Keys are read with surrounding blanks trimmed, in every source: git 2.50 trims a padded legacy key (`'imap.pass =<secret>'`) and runs it, git 2.54 refuses it — the trimmed reading is the one that can run. A clean list is handed on byte for byte. The reading is pinned against the real git binary entry by entry (accepted and refused spellings alike).
+- **Who is hurt / compensation.** A `-c` list that mixes a credential with ordinary settings loses all of them in the child; pass the ordinary ones separately (the indexed record, which is withheld entry by entry) and the credential through a helper the host owns.
+- Pins: `test/backlog1152-git-env-config-sources.test.ts` (#1141 block: a 24-spelling differential against `git config --list -z --show-scope`, seven credential shapes with an unscrubbed git control, byte-identical clean list, refused spelling, case-folded name, 1 MiB linearity).
+
 ## 7.33.4 — 2026-09-27
 
 ### Security fix — the git-family URL screen stops parsing the authority: any `@` after a `://` is a credential carrier, and on a proxy key any `@` is (#1146; 7.33.3 follow-up; behavior narrowing; +0 exports, +0 wire keys) (@server)
 
 - **Before.** 7.33.2 and 7.33.3 read the URL authority — where it ends, which `:` belongs to a password, whether a `[` opens an IP literal — and each reading lost to an adversarial spelling: `https://[alice:secret/part@host` (a `[` that never closes; host review), `https://[a:dead%25x%oops]/part@host`, `https://[abc:def]secret/part@host`, `https://@user:secret@host`, `ssh://token%40host/r.git`, `https:/u:secret@host` (codex), `https://token/part@host` (no colon). In each the KEY cleared its exemption screen or the VALUE row did not fire, and the git group reached the host subprocess; 7.32.1 had withheld it.
 - **Now.** One rule, no parsing: a `GIT_CONFIG_KEY_<i>` / `GIT_CONFIG_VALUE_<i>` value holding a `:/` and, anywhere after it, an `@` or its percent-encoding `%40` is a carrier (`family-rule`) — `:/` because curl reads a single slash as a URL (`https:/u:secret@host`), `%40` because git decodes it before handing the user to ssh (`ssh://token%40host/r.git`); under a proxy key (`http.proxy` / `http.<url>.proxy` / `remote.<name>.proxy`) any `@` / `%40` in the value is. Linear.
-- **Who is hurt / compensation.** Over-drops, fail-closed (KL-1129b): a path / query / fragment `@` (`https://git.example/@scope/pkg`, `https://[::1]/repo@v2.git`, `https://h/?q=a@b`), an scp absolute path with an `@` (`host:/repo@v2.git`), an empty userinfo, a proxy value with `@` in a query, an `http.extraHeader` like `Referer: https://git.example/@scope`. The git group breaks (git exits 128) and a host's group rule withholds it. Compensation: write such a URL into the repository's config, or percent-encode the `@` (`%40`). Never over-dropped: values with no `:/` (`git@host:org/repo.git`, and `git@host:/abs` where the `@` comes first) and URLs with no `@` / `%40` after the `:/`.
+- **Who is hurt / compensation.** Over-drops, fail-closed (KL-1129b): a path / query / fragment `@` (`https://git.example/@scope/pkg`, `https://[::1]/repo@v2.git`, `https://h/?q=a@b`), an scp absolute path with an `@` (`host:/repo@v2.git`), an empty userinfo, a proxy value with `@` in a query, an `http.extraHeader` like `Referer: https://git.example/@scope`. The git group breaks (git exits 128) and a host's group rule withholds it. Compensation: write such a URL into the repository's config (a `%40` spelling first suggested here is no way out: it trips the same screen — corrected in 7.33.5). Never over-dropped: values with no `:/` (`git@host:org/repo.git`, and `git@host:/abs` where the `@` comes first) and URLs with no `@` / `%40` after the `:/`.
 - Pins: `test/backlog1129-git-config-key-family.test.ts` (7.33.4 block: the five review spellings on KEY and VALUE, scp / no-`@` controls, proxy `@`, 1 MiB linearity; the 7.33.1–7.33.3 authority pins re-pinned to the over-match reading).
 
 ## 7.33.3 — 2026-09-26

package/dist/core/secret-env.d.ts

@@ -18,12 +18,13 @@
  */
 import type { RedactionConfidence, RedactionSource } from "./arg-summary.js";
 import { type EngineNotice } from "./engine-notice.js";
-/** A name table as the exact-name arm reads it: membership of an UPPER-CASED name, given the entry's value when
- *  the caller has one. A `Set` of exact names is one (it ignores the value); the exemption side is the union of
- *  its two tables. */
-export interface EnvNameTable {
-    has(upperName: string, value?: string): boolean;
+/** One git config entry as git reads it from the environment. A half is undefined when its source lacks it (a member
+ *  missing from its index group). */
+interface GitConfigEntry {
+    readonly key?: string;
+    readonly value?: string;
 }
+export declare function readGitConfigParameters(text: string): GitConfigEntry[] | undefined;
 /** Which rule classified a key as secret-shaped — the env arm's `kind` vocabulary. */
 export type SecretEnvFindingKind = "suffix-rule" | "namespace-rule" | "exact-name" | "family-rule";
 /** One env entry the `scrub` policy dropped: the key (the VALUE is never carried — this record is meant
@@ -36,21 +37,22 @@ export interface SecretEnvFinding {
 }
 /** What the two exact-name lists say about a name, before any shape rule is consulted. */
 export type ExactEnvNameVerdict = "credential" | "exempt" | "unknown";
-/** The exact-name arm of the classification, taking both lists as arguments (the exemption side is the exact
- *  names plus the named families). The credential list is read
+/** The exact-name arm of the classification, taking both lists as arguments. The credential list is read
  *  FIRST: an exemption can never take a name away from it, so a name landing on both lists resolves to the
  *  credential reading — the fail-closed direction (a wrongly-exempted name leaks; a wrongly-dropped one
  *  does not). Module-level export (not part of the package surface): the two real lists are disjoint, so
  *  only a controlled collision can tell this precedence from an inverted one. */
-export declare function classifyExactEnvName(key: string, credentialNames: EnvNameTable, exemptNames: EnvNameTable, value?: string): ExactEnvNameVerdict;
+export declare function classifyExactEnvName(key: string, credentialNames: ReadonlySet<string>, exemptNames: ReadonlySet<string>): ExactEnvNameVerdict;
 /** Is `key` a secret-pattern env var (one the fail-closed `scrub` policy drops before spawning a shell)? Pass the
- *  entry's `value` to get exactly the scrub's answer for that entry: a named-family exemption holds only for a value
- *  that clears the family's screen, so without a value such a member reads as secret (the name alone cannot clear). */
+ *  entry's `value` — and the environment it sits in as `env` — to get exactly the scrub's answer for that entry: a git
+ *  config member is judged with its index group, which only the environment holds; without a value the name alone
+ *  decides (a `GIT_CONFIG_KEY_<i>` then reads as secret — the name cannot clear itself). */
 export declare function isSecretEnvKey(key: string, value?: string, env?: NodeJS.ProcessEnv): boolean;
 /** Drop every secret-pattern key (see {@link isSecretEnvKey}) from an env object — the fail-closed `scrub`
- *  policy. `findings` is an OPTIONAL caller-owned collector: pass an array to learn which entries were
- *  dropped and why, read it back after the call. Omitting it leaves this function byte-for-byte what it
- *  was before the channel existed. */
+ *  policy. git's indexed record is handed on whole-entry: when an entry is withheld the kept ones are renumbered and
+ *  `GIT_CONFIG_COUNT` rewritten ({@link readGitEnvConfigRecord}), so a kept member can appear under an index a withheld
+ *  one had. `findings` is an OPTIONAL caller-owned collector: pass an array to learn which entries were dropped (by
+ *  their input names) and why, read it back after the call. */
 export declare function scrubSecretEnv(env: NodeJS.ProcessEnv, findings?: SecretEnvFinding[]): NodeJS.ProcessEnv;
 /** Test seam: never called by production code. */
 export declare function __resetSecretEnvScrubNoticeAnnouncement(): void;
@@ -62,3 +64,4 @@ export declare function __resetSecretEnvScrubNoticeAnnouncement(): void;
  * findings array is a no-op.
  */
 export declare function announceSecretEnvScrub(onNotice: ((notice: EngineNotice) => void) | undefined, findings: readonly SecretEnvFinding[]): void;
+export {};

package/dist/core/secret-env.js

@@ -38,84 +38,202 @@ function carriesAuthorizationHeader(value) {
     }
     return judge();
 }
-const GIT_PROXY_CONFIG_KEY_RE = /^(?:http(?:\..+)?|remote\..+)\.proxy$/is;
+const GIT_PROXY_CONFIG_KEY_RE = /^(?:http(?:\..*)?|remote\..*)\.proxy$/is;
 const proxyValueCarriesUserinfo = (value) => value.includes("@") || value.includes("%40");
-const NON_SECRET_ENV_INDEXED_FAMILIES = [
-    { stem: "GIT_CONFIG_KEY", valueClears: (value) => !carriesUrlUserinfo(value) },
-];
-const SECRET_ENV_INDEXED_FAMILIES = [
-    {
-        stem: "GIT_CONFIG_VALUE",
-        credentialWhen: (value, group) => {
-            if (carriesAuthorizationHeader(value) || carriesUrlUserinfo(value))
-                return true;
-            const key = group.sibling("GIT_CONFIG_KEY");
-            return key !== undefined && GIT_PROXY_CONFIG_KEY_RE.test(key) && proxyValueCarriesUserinfo(value);
-        },
-    },
-];
-const indexedFamilyMember = (stem) => {
-    if (!/^[A-Z0-9_]+$/.test(stem))
-        throw new Error(`secret-env: indexed family stem ${JSON.stringify(stem)} must match [A-Z0-9_]+`);
-    return new RegExp(`^${stem}_(0|[1-9][0-9]*)$`);
-};
-const NON_SECRET_ENV_INDEXED_FAMILY_ROWS = NON_SECRET_ENV_INDEXED_FAMILIES.map((f) => ({ member: indexedFamilyMember(f.stem), valueClears: f.valueClears }));
-const SECRET_ENV_INDEXED_FAMILY_ROWS = SECRET_ENV_INDEXED_FAMILIES.map((f) => ({ member: indexedFamilyMember(f.stem), credentialWhen: f.credentialWhen }));
-function classifyByFamily(upperName, value, env) {
+const GIT_PASSWORD_VARIABLE_NAMES = new Set(["pass", "password", "smtppass", "dbpass"]);
+const GIT_EXTRA_HEADER_KEY_RE = /^http\.(?:.*\.)?extraheader$/is;
+const gitKeyHoldsCredential = (key) => GIT_PASSWORD_VARIABLE_NAMES.has(key.slice(key.lastIndexOf(".") + 1).toLowerCase()) || GIT_EXTRA_HEADER_KEY_RE.test(key);
+const GIT_CREDENTIAL_HELPER_KEY_RE = /^credential\.(?:.*\.)?helper$/is;
+const GIT_CREDENTIAL_HELPER_REFERENCE_RE = /^(?:[A-Za-z0-9][A-Za-z0-9._-]*(?: +--?[A-Za-z0-9][A-Za-z0-9-]*(?:=[A-Za-z0-9._/~-]*| +[A-Za-z0-9._/~][A-Za-z0-9._/~-]*)?)*|\/[A-Za-z0-9._/~-]*)?$/;
+function gitConfigEntryCarriesCredential(entry) {
+    const key = entry.key?.trim();
+    const value = entry.value;
+    if (key !== undefined && (carriesUrlUserinfo(key) || gitKeyHoldsCredential(key)))
+        return true;
     if (value === undefined)
+        return false;
+    if (carriesAuthorizationHeader(value) || carriesUrlUserinfo(value))
+        return true;
+    if (key === undefined)
+        return false;
+    if (GIT_PROXY_CONFIG_KEY_RE.test(key))
+        return proxyValueCarriesUserinfo(value);
+    return GIT_CREDENTIAL_HELPER_KEY_RE.test(key) && !GIT_CREDENTIAL_HELPER_REFERENCE_RE.test(value);
+}
+const STANDARD_PROXY_ENV_NAMES = new Set(["HTTP_PROXY", "HTTPS_PROXY", "ALL_PROXY"]);
+const GIT_BLANK = /[ \t\n\r]/;
+export function readGitConfigParameters(text) {
+    const entries = [];
+    let at = 0;
+    const quoted = () => {
+        if (text[at] !== "'")
+            return undefined;
+        let word = "";
+        for (let i = at + 1; i < text.length; i++) {
+            if (text[i] !== "'")
+                word += text[i];
+            else if (text[i + 1] === "\\" && (text[i + 2] === "'" || text[i + 2] === "!") && text[i + 3] === "'") {
+                word += text[i + 2];
+                i += 3;
+            }
+            else {
+                at = i + 1;
+                return word;
+            }
+        }
         return undefined;
-    for (const row of SECRET_ENV_INDEXED_FAMILY_ROWS) {
-        const member = row.member.exec(upperName);
+    };
+    const endsItem = () => at === text.length || GIT_BLANK.test(text.charAt(at));
+    while (at < text.length) {
+        const key = quoted();
+        if (key === undefined)
+            return undefined;
+        if (endsItem()) {
+            const eq = key.indexOf("=");
+            entries.push(eq === -1 ? { key } : { key: key.slice(0, eq), value: key.slice(eq + 1) });
+        }
+        else if (text[at] === "=") {
+            at++;
+            if (endsItem())
+                entries.push({ key });
+            else {
+                const value = quoted();
+                if (value === undefined || !endsItem())
+                    return undefined;
+                entries.push({ key, value });
+            }
+        }
+        else
+            return undefined;
+        while (at < text.length && GIT_BLANK.test(text.charAt(at)))
+            at++;
+    }
+    return entries;
+}
+function gitConfigVariableCarriesCredential(upperName, value) {
+    if (upperName === "GIT_CONFIG_PARAMETERS")
+        return readGitConfigParameters(value)?.some(gitConfigEntryCarriesCredential) ?? true;
+    return STANDARD_PROXY_ENV_NAMES.has(upperName) && gitConfigEntryCarriesCredential({ key: "http.proxy", value });
+}
+const GIT_CONFIG_COUNT_NAME = "GIT_CONFIG_COUNT";
+const GIT_CONFIG_MEMBER_RE = /^GIT_CONFIG_(KEY|VALUE)_(.*)$/s;
+const GIT_CONFIG_INDEX_RE = /^(?:0|[1-9][0-9]*)$/;
+const readGitConfigCount = (value) => (/^[0-9]+$/.test(value) && Number(value) <= 2 ** 31 - 1 ? Number(value) : undefined);
+function readGitEnvConfigRecord(env) {
+    const withheld = new Set();
+    const kept = new Map();
+    const counts = [];
+    const groups = new Map();
+    for (const name of Object.keys(env)) {
+        const upper = name.toUpperCase();
+        if (upper === GIT_CONFIG_COUNT_NAME) {
+            counts.push(name);
+            continue;
+        }
+        const member = GIT_CONFIG_MEMBER_RE.exec(upper);
         if (member === null)
             continue;
-        const index = member[1];
-        if (row.credentialWhen(value, { sibling: (stem) => env?.[`${stem}_${index}`] }))
-            return "credential";
+        const [, role, suffix = ""] = member;
+        const group = groups.get(suffix) ?? { names: [], twice: false };
+        groups.set(suffix, group);
+        group.names.push(name);
+        const text = env[name];
+        if (text === undefined)
+            continue;
+        const half = role === "KEY" ? "key" : "value";
+        if (group[half] !== undefined)
+            group.twice = true;
+        group[half] = text;
     }
-    if (NON_SECRET_ENV_INDEXED_FAMILY_ROWS.some((row) => row.member.test(upperName) && !row.valueClears(value)))
-        return "screen-failed";
-    return undefined;
+    for (const [suffix, g] of groups) {
+        if (GIT_CONFIG_INDEX_RE.test(suffix))
+            continue;
+        groups.delete(suffix);
+        if (g.twice || gitConfigEntryCarriesCredential(g))
+            for (const n of g.names)
+                withheld.add(n);
+    }
+    const [countText, secondCountText] = counts.flatMap((n) => env[n] ?? []);
+    const count = countText === undefined ? 0 : secondCountText === undefined ? readGitConfigCount(countText) : undefined;
+    const ordered = [...groups.entries()].map(([suffix, g]) => ({ index: BigInt(suffix), ...g, carrier: gitConfigEntryCarriesCredential(g) })).sort((a, b) => (a.index < b.index ? -1 : a.index > b.index ? 1 : 0));
+    if (count === undefined || ordered.some((g) => g.twice)) {
+        for (const n of [...counts, ...ordered.flatMap((g) => g.names)])
+            withheld.add(n);
+        return { withheld, kept };
+    }
+    const limit = BigInt(count);
+    const rebuild = ordered.some((g) => g.index < limit && g.carrier);
+    let next = 0;
+    for (const g of ordered) {
+        const renumber = rebuild && g.index < limit;
+        if (g.carrier || (renumber && (g.key === undefined || g.value === undefined))) {
+            for (const n of g.names)
+                withheld.add(n);
+            continue;
+        }
+        const index = renumber ? next++ : undefined;
+        for (const n of g.names) {
+            const text = env[n];
+            if (text !== undefined)
+                kept.set(n, { name: index === undefined ? n : `${n.slice(0, n.lastIndexOf("_"))}_${index}`, value: text });
+            else if (renumber)
+                withheld.add(n);
+        }
+    }
+    for (const n of counts) {
+        const text = env[n];
+        if (text !== undefined)
+            kept.set(n, { name: n, value: rebuild ? String(next) : text });
+        else if (rebuild)
+            withheld.add(n);
+    }
+    return { withheld, kept };
 }
-const NON_SECRET_ENV_NAMES = {
-    has: (upperName, value) => NON_SECRET_ENV_EXACT_NAMES.has(upperName) ||
-        (value !== undefined && NON_SECRET_ENV_INDEXED_FAMILY_ROWS.some((row) => row.member.test(upperName) && row.valueClears(value))),
-};
 const SECRET_ENV_KIND_CONFIDENCE = {
     "exact-name": "high",
     "suffix-rule": "medium",
     "namespace-rule": "medium",
     "family-rule": "high",
 };
-export function classifyExactEnvName(key, credentialNames, exemptNames, value) {
+export function classifyExactEnvName(key, credentialNames, exemptNames) {
     const upper = key.toUpperCase();
-    if (credentialNames.has(upper, value))
+    if (credentialNames.has(upper))
         return "credential";
-    if (exemptNames.has(upper, value))
+    if (exemptNames.has(upper))
         return "exempt";
     return "unknown";
 }
-function classifySecretEnvKey(key, value, env) {
-    const byExactName = classifyExactEnvName(key, SECRET_ENV_EXACT_NAMES, NON_SECRET_ENV_NAMES, value);
+function classifySecretEnvKey(key) {
+    const byExactName = classifyExactEnvName(key, SECRET_ENV_EXACT_NAMES, NON_SECRET_ENV_EXACT_NAMES);
     if (byExactName === "credential")
         return "exact-name";
     if (byExactName === "exempt")
         return undefined;
-    const byFamily = classifyByFamily(key.toUpperCase(), value, env);
-    if (byFamily === "credential")
-        return "family-rule";
     if (SECRET_ENV_RE.test(key))
-        return byFamily === "screen-failed" ? "family-rule" : "suffix-rule";
+        return "suffix-rule";
     return SEMA_NAMESPACE_SECRET_RE.test(key) ? "namespace-rule" : undefined;
 }
+function classifyEnvEntry(key, value, record) {
+    if (record.withheld.has(key))
+        return "family-rule";
+    if (record.kept.has(key))
+        return undefined;
+    if (value !== undefined && gitConfigVariableCarriesCredential(key.toUpperCase(), value))
+        return "family-rule";
+    return classifySecretEnvKey(key);
+}
 export function isSecretEnvKey(key, value, env) {
-    return classifySecretEnvKey(key, value, env) !== undefined;
+    const record = readGitEnvConfigRecord(value === undefined ? {} : { ...env, [key]: value });
+    return classifyEnvEntry(key, value, record) !== undefined;
 }
 export function scrubSecretEnv(env, findings) {
+    const record = readGitEnvConfigRecord(env);
     const out = {};
     for (const k of Object.keys(env)) {
-        const kind = classifySecretEnvKey(k, env[k], env);
+        const kind = classifyEnvEntry(k, env[k], record);
         if (kind === undefined) {
-            out[k] = env[k];
+            const moved = record.kept.get(k);
+            out[moved?.name ?? k] = moved === undefined ? env[k] : moved.value;
             continue;
         }
         if (findings !== undefined) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.33.4",
+  "version": "7.33.5",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/wire-changes/core@7.33.5.json

@@ -0,0 +1,56 @@
+{
+  "repo": "core",
+  "version": "7.33.5",
+  "from": "4de94d5942047def6b1f2a28251b21d7180a2167",
+  "to": "v7.33.5",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [],
+  "closedSetMembers": [],
+  "closedSetsUnreadable": [],
+  "typeKeys": [],
+  "typeKeysUnreadableArms": [],
+  "typeKeysFlattenedCount": 217,
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "typeMember",
+      "name": "SecretEnvFinding.key",
+      "assertions": [
+        "G1.a",
+        "G2.a",
+        "G4.a",
+        "G5.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "SecretEnvFinding.kind",
+      "assertions": [
+        "G1.a",
+        "G1.b",
+        "G2.a",
+        "G2.b",
+        "G3.a",
+        "G3.b",
+        "G4.a",
+        "G4.b",
+        "G5.a",
+        "G5.b",
+        "G6.a",
+        "G6.b"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [],
+    "server": [],
+    "sdk": [],
+    "note": "scanned cli@4e593722 server@20df4e92 sdk@10cf14c — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 0,
+  "breakingItems": [],
+  "toResolvedAt": "97f5096b12ed068bb937b1f5981bd0fb82bb3584"
+}