@sema-agent/core 7.33.5 → 7.33.6

package/CHANGELOG.md

@@ -1,3 +1,68 @@
+## 7.33.6 — 2026-09-28
+
+### Fix — a withheld entry of git's indexed env config keeps its index, holding a placeholder entry; the record is never renumbered and the count never rewritten (#1160; 7.33.5 regression; behavior; +0 exports, +0 wire keys) (@server)
+
+- **Before.** 7.33.5 withheld a git config entry whole and, when it sat below `GIT_CONFIG_COUNT`, renumbered the kept entries down to 0..m-1 and rewrote the count to m. A host that hands named variables back verbatim (sema-server's `BAKE_ENV_ALLOW`, an `inheritEnv` allow list on top of the scrub) put the input names back onto the renumbered record: with `COUNT=2`, entry 0 a credential header and entry 1 `core.pager=less`, putting back all four member names left `COUNT=1` and git read only entry 0 — the credential — while `core.pager` was never read (7.33.4 handed the record on unchanged).
+- **Now.** A withheld entry below the count keeps its names: `GIT_CONFIG_KEY_<i>` holds `sema.withheld` and `GIT_CONFIG_VALUE_<i>` holds the empty string (git reads it as an entry nothing uses; checked with git 2.50 and 2.54: `git config --list` shows `sema.withheld=`, `status` / `ls-remote` / `fetch` / an `includeIf` beside it unchanged). The count and every other entry reach the child as the host wrote them, so a host that puts a name back puts back exactly that member. A withheld entry at or above the count, or with no count (git reads none of it), is dropped as before; a withheld entry the host left incomplete keeps its one name (no name is added). A member whose value is `undefined` reaches no child and is left to the name rules. The renumbering rule is gone, and with it the "rebuild" reading of undefined members.
+- **Who needs it.** Hosts that hand git config through the environment and put named variables back after the scrub.
+- **Who is hurt / compensation.** A finding for a record member names a variable that is still in the scrubbed map, holding the placeholder half — a consumer that reads "withheld" as "absent from the output" (`composed[f.key] === undefined`) must read it as "not handed on as written" (`composed[f.key] !== input[f.key]`). A child that lists its git config sees one `sema.withheld=` line per withheld entry. A host that puts back only one half of a withheld entry pairs it with the other half's placeholder (put back both names of an entry, or neither).
+- Pins: `test/backlog1152-git-env-config-sources.test.ts` (#1152 / #1160 block, real git: placeholder in place for includeIf / safe.directory / a middle entry, the put-back case with and without the credential's names, second scrub inert, incomplete withheld entry keeps its one name, entries at or above the count dropped without a placeholder, 2^53 indices, undefined members); the 7.33.5 renumbering pins in that file and in `test/backlog1129-git-config-key-family.test.ts` re-pinned to the in-place reading (intended flip, named in each pin).
+
+### Fix — on a POSIX child a mixed-case spelling of a git record member is a variable of its own, judged apart from the record; only a Windows child folds the spellings (#1159; 7.33.5 regression; behavior; `scrubSecretEnv` / `isSecretEnvKey` gain an optional trailing `platform` argument; +0 exports, +0 wire keys) (@server)
+
+- **Before.** 7.33.5 compared every member name upper-cased, so beside a canonical `GIT_CONFIG_KEY_0` a variable spelled `Git_Config_Key_0` counted as a second spelling of the same member and the whole record was withheld: with `GIT_CONFIG_COUNT=3`, entry 0 a credential header and the alias `Git_Config_Key_0=user.name` beside it, `core.pager` and `core.editor` disappeared from every git child as well. On Linux and macOS git looks up `GIT_CONFIG_KEY_<i>` by its exact capitalised name — the alias is never read (git 2.54: `git config --get user.name` exits 1 on the unscrubbed map).
+- **Now.** Which names make up git's record depends on the platform the child runs on. On Windows env names are case-insensitive, so any spelling is the member (two spellings of one member still withhold the record, as the child's pick is not knowable). Elsewhere only the capitalised names are the record; any other spelling of a member name — like a suffix git never reads (`_00`, `_x`) — is judged on its own: paired with the other half of the same case-folded suffix among such names, withheld when it carries a credential (`family-rule`) or spells a half twice, otherwise left to the name rules (`Git_Config_Key_0` then drops by the shape rule); it never touches the record. A mixed-case `git_config_count` is a count only on Windows. `scrubSecretEnv(env, findings?, platform?)` and `isSecretEnvKey(key, value?, env?, platform?)` take the child's platform (`NodeJS.Platform`); it defaults to `process.platform` — the answer for a child spawned on this host. The engine's own spawn sites (the shell exec env, the language-server spawn) pass `process.platform` explicitly.
+- **Who needs it.** Hosts whose environment carries both spellings (a deployment layer that sets lower-case aliases, a copied env).
+- **Who is hurt / compensation.** A host whose child runs somewhere else — a remote or sandboxed execution environment on another platform — must pass that environment's platform; the default reads for this host. On a POSIX child a lower-case member spelling that 7.33.1–7.33.5 kept as a record member is now a name of its own: `git_config_key_0` drops by the shape rule (git never read it there), and a clean `git_config_value_0` stays.
+- Pins: `test/backlog1152-git-env-config-sources.test.ts` (#1159 block: the reported input with a real-git control and scrubbed reads for three POSIX platforms, the default equals `process.platform`, six alias shapes judged apart from the record, the Windows reading simulated through `platform: "win32"`, the exec env's spawn read through a real shell child); `test/backlog1073-lsp-child-env.test.ts` (the language-server spawn reads for this host); the case-folding pins in `test/backlog1129-git-config-key-family.test.ts` and the two-spellings pin re-pinned per platform (intended flip, named).
+
+### Change — an ssh-family URL whose userinfo is a login name alone is no longer withheld, in a key's subsection or a value (#1136 / #1153; ruling C-R125; behavior widening; +0 exports, +0 wire keys) (@server)
+
+- **Before.** Since 7.33.1 (key) / 7.33.2 (value) any `@` after a `:/` made a git config entry a carrier, so `url.ssh://git@github.com/.insteadOf` and `remote.origin.url = ssh://git@github.com/org/repo.git` were withheld (7.33.1–7.33.4: git exited 128; 7.33.5: the entry was dropped), while the scp form of the same remote (`git@github.com:org/repo.git`) passed.
+- **Now.** Ruling C-R125: under `ssh://`, `git+ssh://` and `git://` (git's scheme names, compared as git compares them) a userinfo that is a login name alone — letters, digits, `.` `_` `-`, no password, no percent-encoding — with no other `@` in the URL is not a carrier: git hands it to ssh as the login (checked with a stand-in ssh under git 2.50 / 2.54). It clears where git reads a URL: a whole value, or a key's subsection after a section name git accepts (`url.<base>.insteadOf`, `http.<url>.*`). The scp form keeps its reading (#1153, same ruling): the user position is a login name. Everything else stays a carrier: an `https` / `http` user alone (it can be a token), a password on any scheme (`ssh://u:<secret>@host`), `%40` anywhere, a second `@`, any other character in the name, `SSH://` / `ssh+git://`, a URL that does not start the value or the subsection (`includeIf.hasconfig:remote.*.url:ssh://git@…` is still over-dropped), and any `@` under a proxy key.
+- **Who needs it.** Hosts that route git over ssh through environment config (insteadOf rewrites, remote URLs with the `git@` login).
+- **Who is hurt / compensation.** A model in the child can read an ssh login name it could not before; the ruling treats it as no secret. A token placed in an ssh login position (`ssh://<token>@host`) is no longer withheld.
+- Pins: `test/backlog1152-git-env-config-sources.test.ts` (#1136 / #1153 block: real git rewrites and resolves the ssh / git+ssh / git forms and hands the login to a stand-in ssh; scp forms; sixteen carrier spellings with a git control, key and value; subsections that are not a whole URL; proxy key); `test/backlog1129-git-config-key-family.test.ts` ssh login-only pins re-pinned (intended flip, named).
+
+### Fix — `GIT_CONFIG_COUNT` is read as git reads it and handed on as written (#1162; 7.33.5 regression; behavior; +0 exports, +0 wire keys) (@server)
+
+- **Before.** 7.33.5 read the count as plain decimal digits up to 2147483647 and withheld the whole record for anything else — also for spellings git reads (` 1`, `+1`, the empty string), so a clean record with such a count lost every entry in the child (7.33.4 handed it on).
+- **Now.** The count is read with git's own reading — C's `strtoul(value, &end, 10)`, refused when anything follows the number ("bogus count") or when it exceeds INT_MAX ("too many entries"): leading C blanks (space, TAB, LF, VT, FF, CR), one optional sign, decimal digits (`010` is ten), the empty string is 0, `-` negates modulo 2^64 (`-0` is 0, `-1` is refused, `-18446744073709551615` is 1), a magnitude past 2^64 − 1 saturates. Each of 36 spellings was measured against git 2.50.1 and 2.54.0 (they agree). A count git reads is handed on as written and decides which withheld entries hold a placeholder; a count git refuses still withholds the whole record, so git starts. For a Windows child C's `unsigned long` is 32 bits (inferred, not run on Windows git).
+- **Who needs it.** Hosts that write the count with a sign, a leading blank or leading zeros, or leave it empty.
+- **Who is hurt / compensation.** None known. A count git refuses is also handed on as written (see the git-reading fixes below).
+- Pins: `test/backlog1152-git-env-config-sources.test.ts` (#1162 block: 36 measured spellings with git's unscrubbed reading as the control and the same entries read after the scrub; a wide spelling beside a credential entry; `-0` / `010` placing the placeholder; the 32-bit Windows reading; 1 MiB linearity); the 7.33.5 unreadable-count pin re-pinned (` 1`, `+1`, empty: intended flip).
+
+### Security fix — a member-shaped pair git never reads goes and stays as a pair: when a name rule drops one half, the other half goes with it (#1163; existing since 7.33.5 #1154; behavior narrowing; +0 exports, +0 wire keys) (@server)
+
+- **Before.** A `GIT_CONFIG_KEY_<s>` / `GIT_CONFIG_VALUE_<s>` pair with a suffix git never reads (`_00`, `_01`) that did not trip the entry predicate went back to the name rules name by name: the KEY half fell to the shape rule (`…_KEY_00`) and the VALUE half, matching no rule, reached the child alone. `KEY_00 = core.sshCommand` with `VALUE_00 = sshpass -p <password> ssh` handed the password on with its key gone.
+- **Now.** Such a pair — a non-index suffix, or on a POSIX child a mixed-case member spelling — is judged as a pair before any name rule: it is withheld whole when it carries a credential or spells a half twice (as before), and when a name rule drops either half the other half goes with it (`family-rule`; the dropped half keeps its own rule in its finding). A pair no rule touches stays whole. Members git reads (canonical index, capitalised on POSIX) are unchanged: exempt from the name rules, judged by the entry predicate.
+- **Who needs it.** Nobody should lose a value to a leak because its key's name looked like a credential.
+- **Who is hurt / compensation.** User-visible: a clean `GIT_CONFIG_VALUE_01` (or `_00`, or a POSIX alias value) whose `GIT_CONFIG_KEY_01` drops by the shape rule is now withheld too. git never reads these names; a child that does can read the pair through an explicit `inheritEnv` / `shellEnv` hand-off.
+- Pins: `test/backlog1152-git-env-config-sources.test.ts` (#1163 block: the reported `core.sshCommand` pair with real git reading the canonical record, five suffix shapes, a POSIX alias pair, a lone VALUE); the #1154 clean-pair pin and the #1159 POSIX alias pin re-pinned (intended flip, named).
+
+### Security fix — an empty value is handed on whatever its key means: an empty `http.extraHeader` keeps clearing the inherited headers (#1164; 7.33.5 regression — fail-open; behavior; +0 exports, +0 wire keys) (@server)
+
+- **Before.** 7.33.5 (#1155 / #1151) withheld every entry whose key makes its value a credential — `http.extraHeader`, the password keys — whatever the value, empty included. git reads an empty `http.extraHeader` as "clear the extra headers set so far": a deployment that inherits an `Authorization:` header from a global or system config file and clears it for the child through the environment lost the clearing entry, and the inherited header came back on every request (checked with a loopback listener under git 2.54).
+- **Now.** An empty (or absent) value carries no credential, so the key-meaning readings — password keys, extra headers, credential helpers — do not fire on it; the empty helper value (a reset of the helper list, already handed on) is now the same rule, not a special case of the helper reading. A credential in the KEY (a userinfo URL subsection) still withholds the entry. Any non-empty value, a blank included, is judged as before.
+- **Who needs it.** Deployments that clear inherited headers, helpers or passwords for the child through environment config.
+- **Who is hurt / compensation.** None known: an empty value holds nothing to leak.
+- Pins: `test/backlog1152-git-env-config-sources.test.ts` (#1164 block: an inherited header from a temp `GIT_CONFIG_GLOBAL` heard by a loopback listener, cleared by the empty env entry — control, scrubbed map, and the `-c` channel; empty values under seven keys in three sources; a blank still withheld; a credential key with an empty value still withheld); the key-only extra-header predicate pin re-pinned (intended flip, named).
+
+### Security fix — git config values are read for secrets four more ways, in the one entry predicate every source shares; two more proxy variables (#1165; existing, not a 7.33.5 regression; behavior narrowing; +0 exports, +0 wire keys) (@server)
+
+- **Before.** The entry predicate read URLs, credential headers, proxy userinfo, the documented password keys and inline helpers. `github.token = ghp_…`, `credential.helper = mytool --token=<value>` and `core.sshCommand = sshpass -p <password> ssh` reached the child whole; so did `ftp_proxy` / `npm_config_proxy` / `npm_config_https_proxy` with a password, and `GIT_SSH_COMMAND` / `GIT_PROXY_COMMAND` carrying one.
+- **Now.** One predicate, four more readings, for the indexed record, `GIT_CONFIG_PARAMETERS`, non-index pairs and the proxy variables alike: ① every non-empty value passes the engine's shared secret scanner (`redactSecrets` in `untrusted-egress.ts`, the same one that keeps secrets out of what the engine shows — vendor-prefixed tokens, JWTs, private-key blocks, `Bearer <token>`, `token=` / `password=` assignments, signed-URL parameters; no new shape table), read with each `:` of the value as structure (a refspec's two sides, a URL's scheme, a `key::` literal — `refs/heads/add-key:refs/…` is no `key:` pair) and asked only whether it changed anything (linear: building finding spans was quadratic on many matches); a key whose value is ref names — `remote.<name>.fetch` / `.push` (refspecs), `branch.<name>.merge` — is not scanner-read (`+refs/heads/pk-refactoring:…`, `api-key=rotation` are branch text); ② a key whose variable is `token` or `secret` joins `pass` / `password` (case-folded, any section); ③ a command line git runs — `core.sshCommand`, `core.gitProxy`, and the env variables `GIT_SSH_COMMAND` / `GIT_PROXY_COMMAND` — carries a password when `sshpass` is given one before the command it runs, read as sshpass's getopt reads its options (`-p` in any cluster, `--password[=<pw>]`; `-f` / `-d` / `-P` take an argument, a quoted prompt included), when an assignment `NAME=…` names a secret by the env name rules (`SSHPASS=… sshpass -e ssh`), or when `plink` is given `-pw` — over the words the shell hands over, read in one pass (quotes and escapes removed as the shell removes them, a backslash-newline joined, split at operators and substitutions: `"sshpass" '-p' <pw>`, `sshpass -P 'Enter password:' -p <pw>`, `$(echo sshpass) -p <pw>`), a word holding blanks read again as the command line it is (`ssh -o 'ProxyCommand=sshpass -p <pw> …'`, `sh -c "sshpass -p <pw> …"`, three levels deep); `ssh -p 22` is a port and stays; a credential helper reference withholds when an option whose name holds token / pass / secret / auth carries a value (`--token=<v>`, `--token <v>`, `--passphrase=<v>`); ④ `ftp_proxy` and npm's `npm_config_proxy` / `npm_config_https_proxy` (any case) are read as proxy addresses like `https_proxy`. Only git-family and proxy variables are value-read; other env names still are not (ruling C-R128).
+- **Checked, not changed.** With an `http.proxy` that names no user, a 407 from the proxy does not make git ask its credential helper for proxy credentials (git 2.50 / 2.54, a loopback 407 proxy and a stand-in helper: only `erase` on the CONNECT path, carrying no password); with a user in the proxy URL git does ask, and that URL is already withheld (#1150).
+- **Who is hurt / compensation.** Over-drops (KL-1129a): a helper option whose name holds auth / token / password / secret even when it names a file (`--auth-file <path>`); a path whose segment the scanner reads as a vendor-prefixed token (`/work/pk-backend-service`). Hand such entries on explicitly (`inheritEnv` / `shellEnv`) or put them in a config file the host owns. Not read (KL-1129a): a `name: value` pair written with a colon in an ordinary value, a command assembled by expansion at run time. A value of 1 MiB now costs the scanner's linear pass (bounded backtracking).
+- Pins: `test/backlog1152-git-env-config-sources.test.ts` (#1165 block: the reported shapes read by git before and withheld after in both channels, scanner shapes under any key and on a proxy variable, refspecs / a `key::` signing key / a long ssh login kept and read by git, 1.7 MB of alternating matches in bounded time, secret-named keys and look-alikes, command lines in four keys / variables — quoted, escaped, substituted spellings — with port and file controls, helper options, the three proxy names); the U+2028 bearer and linearity pins re-pinned (the scanner reads `Bearer <token>` anywhere — intended flip, named); `test/secret-env-git-differential.test.ts` (seeded two-way differential against the real git).
+
+### Fix — git config is read closer to git's own reading: user-named variables, alias commands, shell expansions in helpers, counts git refuses (#1165 / #1151 follow-ups; behavior; +0 exports, +0 wire keys) (@server)
+
+- **User-named variables are not setting names.** In `alias.<command>`, `pretty.<format>`, `remotes.<group>` and `pager.<command>` the variable is a name the user chose, so the key-name rule (`pass` / `password` / `token` / `secret`) does not read it: `alias.token = !echo hi` stays (the #1165 `token` word withheld it; 7.33.5 kept it) and so do `alias.pass`, `alias.password`, `pretty.token` (withheld since 7.33.5 #1151 — git then answered "not a git command"). The value is read like any other value.
+- **An alias's `!` value is a command line.** `alias.<name>` / `alias.<name>.command` whose value begins with `!` is run by git through the shell, so it is read with the same command-line reading as `core.sshCommand`: `alias.deploy = !sshpass -p <password> ssh host` (handed on whole in 7.33.5 and earlier) is withheld; an alias without `!` is git's own arguments, read as the git command it expands to — its `-c <name>=<value>` is a config entry judged like any other, as is a `-c` given to `git` inside any command line read here (`alias.x = -c imap.pass=<pw> pull`, `!git -c core.sshCommand='sshpass -p <pw> ssh' fetch`).
+- **A shell expansion is not a literal password.** Every value git runs through the shell — command keys, `!` aliases and now credential helpers in every form — is read as the shell reads it (through the engine's one shell lexer, `src/shell/lex.ts`, segment by segment; a command bash cannot delimit runs nothing and is withheld), and only what is written into it counts: `$(…)`, backquotes, `$NAME`, `${NAME}`, `$@` are known when the shell runs, so `credential.helper = !f() { echo "password=$(pass show git/host)"; }; f` (git's documented password-manager form), `password=$GIT_PW`, `!pass-git-helper -m ~/.pass-map`, `!gh auth git-credential` and `!aws codecommit credential-helper $@` stay and git answers through them after the scrub (7.33.5 #1151 withheld every helper that was not a bare helper name, which broke git's authentication in the child). A literal still withholds: a printed `password=<literal>` / `oauth_refresh_token=` / `credential=` line, a parameter the same line assigns a literal to (`pw=<literal>; echo "password=$pw"`), a literal given to an option whose name ends in token / password / passwd / pass / passphrase / secret / pw / auth / oauth / apikey / credential (`--token <v>`, `-pw <v>`; `--password-file`, `--passphrase-fd`, `--auth-file` name where a secret is kept and stay), a literal `sshpass -p`, and a command substitution's body read as a command line of its own. The literal is read in the shell's own spellings: `$'…'` decodes its C escapes, a printed line is also read with printf's and `echo`'s escapes decoded (`passwor\144=<pw>`), and a literal copied through other parameters (`x=<pw>; y=$x; echo password=$y`) is followed. A command line handed on to something that runs it — a shell's `-c` argument, `eval`'s argument, ssh's `-o ProxyCommand` / `LocalCommand` / `KnownHostsCommand` / `RemoteCommand`, plink's `-proxycmd` — is read the same way with the outer line's parameters; any other argument is data (`!printf '%s\n' 'sshpass -p is unsafe'` stays). `sshpass -p "$PW"` now stays too (the same rule). A parameter's written default (`${X:-<text>}`) and a here-document the command prints are read as literals. printf's format is read as printf reads it: each conversion prints its argument, so `printf 'password=%s\n' "$(security find-generic-password -w -s git)"` (the macOS keychain helper form) stays, while `printf 'password=%s\n' <literal>`, an argument assigned a literal in the line, and a name built from arguments (`printf '%s=%s' password <literal>`) withhold; a `*` width or precision takes its argument first, `%%` is a literal percent sign, and printf's reuse of the format for further arguments is followed. Not read (KL-1129a): a program named by an expansion (`$(echo sshpass) -p …`, withheld on the branch before this change), a literal the shell builds at run time (`$(echo <pw>)`, `read`), ssh's remote command.
+- **A count git refuses stays as written.** `GIT_CONFIG_COUNT` = `2abc`, `2 `, `-1` (git: "bogus count" / "too many entries", exit 128) used to withhold the whole record, so git in the child started where the host's git refused; now the count is handed on as written and git refuses it in the child just as in the host. A credential entry beside such a count holds its placeholder in place (git reads none of the record either way). Two env names folding to one member on a Windows child still withhold the whole record (which one the child reads is not knowable). Measured with git 2.50.1 and 2.54.0: the same exit and message before and after the scrub.
+
 ## 7.33.5 — 2026-09-27
 
 ### Security fix — git's indexed env config is withheld one entry at a time, whole, and the rest is handed on as a record git can read (#1152; 7.33.4 regression; behavior; +0 exports, +0 wire keys) (@server)

package/dist/core/secret-env.d.ts

@@ -27,8 +27,9 @@ interface GitConfigEntry {
 export declare function readGitConfigParameters(text: string): GitConfigEntry[] | undefined;
 /** Which rule classified a key as secret-shaped — the env arm's `kind` vocabulary. */
 export type SecretEnvFindingKind = "suffix-rule" | "namespace-rule" | "exact-name" | "family-rule";
-/** One env entry the `scrub` policy dropped: the key (the VALUE is never carried — this record is meant
- *  to be loggable), the rule that classified it, how strong that claim is, and the minting module. */
+/** One env entry the `scrub` policy withheld — dropped, or, for a member of git's config record, handed on holding a
+ *  placeholder half: the key (the VALUE is never carried — this record is meant to be loggable), the rule that
+ *  classified it, how strong that claim is, and the minting module. */
 export interface SecretEnvFinding {
     key: string;
     kind: SecretEnvFindingKind;
@@ -44,16 +45,23 @@ export type ExactEnvNameVerdict = "credential" | "exempt" | "unknown";
  *  only a controlled collision can tell this precedence from an inverted one. */
 export declare function classifyExactEnvName(key: string, credentialNames: ReadonlySet<string>, exemptNames: ReadonlySet<string>): ExactEnvNameVerdict;
 /** Is `key` a secret-pattern env var (one the fail-closed `scrub` policy drops before spawning a shell)? Pass the
- *  entry's `value` — and the environment it sits in as `env` — to get exactly the scrub's answer for that entry: a git
- *  config member is judged with its index group, which only the environment holds; without a value the name alone
- *  decides (a `GIT_CONFIG_KEY_<i>` then reads as secret — the name cannot clear itself). */
-export declare function isSecretEnvKey(key: string, value?: string, env?: NodeJS.ProcessEnv): boolean;
+ *  entry's `value` — and the environment it sits in as `env`, and the child's `platform` — to get exactly the scrub's
+ *  answer for that entry: a git config member is judged with its index group, which only the environment holds; without
+ *  a value the name alone decides (a `GIT_CONFIG_KEY_<i>` then reads as secret — the name cannot clear itself).
+ *  `platform` is as for {@link scrubSecretEnv}. */
+export declare function isSecretEnvKey(key: string, value?: string, env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): boolean;
 /** Drop every secret-pattern key (see {@link isSecretEnvKey}) from an env object — the fail-closed `scrub`
- *  policy. git's indexed record is handed on whole-entry: when an entry is withheld the kept ones are renumbered and
- *  `GIT_CONFIG_COUNT` rewritten ({@link readGitEnvConfigRecord}), so a kept member can appear under an index a withheld
- *  one had. `findings` is an OPTIONAL caller-owned collector: pass an array to learn which entries were dropped (by
- *  their input names) and why, read it back after the call. */
-export declare function scrubSecretEnv(env: NodeJS.ProcessEnv, findings?: SecretEnvFinding[]): NodeJS.ProcessEnv;
+ *  policy. git's indexed record is withheld entry by entry and never renumbered ({@link readGitEnvConfigRecord}): a
+ *  withheld entry git reads keeps its names, each holding its half of the placeholder entry `sema.withheld` (key) / an
+ *  empty string (value), so `GIT_CONFIG_COUNT` and every other index reach the child as the host wrote them. `findings`
+ *  is an OPTIONAL caller-owned collector: pass an array to learn which entries were withheld (by name) and why, read it
+ *  back after the call. A finding's name is absent from the result unless it is such a record member, which is present
+ *  holding the placeholder half. `platform` is the platform the child runs on — where git reads this environment:
+ *  Windows reads env names case-insensitively, so there any spelling of a record member is that member; elsewhere git
+ *  looks up the capitalised names only and every other spelling is judged on its own, apart from the record. It defaults
+ *  to this process's own platform, the answer for a child spawned on this host; a host whose child runs elsewhere (a
+ *  remote or sandboxed execution environment) passes that environment's platform. */
+export declare function scrubSecretEnv(env: NodeJS.ProcessEnv, findings?: SecretEnvFinding[], platform?: NodeJS.Platform): NodeJS.ProcessEnv;
 /** Test seam: never called by production code. */
 export declare function __resetSecretEnvScrubNoticeAnnouncement(): void;
 /**

package/dist/core/secret-env.js

@@ -1,4 +1,6 @@
 import { deliverEngineNotice } from "./engine-notice.js";
+import { redactSecrets } from "./untrusted-egress.js";
+import { ANSI_C_ESCAPES, argvOf, lexShell, substitutionsInHeredocBody } from "../shell/lex.js";
 const TOKEN_COUNT_WORDS = ["MAX", "OUTPUT", "INPUT", "THINKING", "NUM", "TOTAL"];
 const CREDENTIAL_WORD = `KEY|KEYS|TOKEN|(?<!(?:^|_)(?:${TOKEN_COUNT_WORDS.join("|")})_)TOKENS|SECRET|SECRETS|PASSWORD|PASSWORDS|PASSWD|CREDENTIAL|CREDENTIALS|PRIVATEKEY|APIKEY`;
 const SECRET_ENV_RE = new RegExp(`(^|_)(${CREDENTIAL_WORD})(?:_(?:\\d+|ID))?$`, "i");
@@ -15,11 +17,15 @@ const NON_SECRET_ENV_EXACT_NAMES = new Set([
     "MAX_BATCH_PREFILL_TOKENS", "MAX_WAITING_TOKENS", "MAX_TOP_N_TOKENS", "RATE_LIMIT_TOKENS",
     "PROMPT_TOKENS", "CONTEXT_TOKENS",
 ]);
-function carriesUrlUserinfo(value) {
-    const scheme = value.indexOf(":/");
+const SSH_LOGIN_ONLY_URL_RE = /^(?:ssh|git\+ssh|git):\/\/[A-Za-z0-9._-]+@[^@]*$/;
+const GIT_KEY_SECTION_RE = /^[A-Za-z0-9-]+\./;
+function carriesUrlUserinfo(text, url) {
+    const scheme = text.indexOf(":/");
     if (scheme === -1)
         return false;
-    return value.indexOf("@", scheme + 2) !== -1 || value.indexOf("%40", scheme + 2) !== -1;
+    if (text.indexOf("@", scheme + 2) === -1 && text.indexOf("%40", scheme + 2) === -1)
+        return false;
+    return url === undefined || url.includes("%40") || !SSH_LOGIN_ONLY_URL_RE.test(url);
 }
 const HEADER_LINE_BREAK_RE = /\r\n|\r|\n/;
 const AUTHORIZATION_HEADER_NAME_RE = /^[ \t]*(?:(?:proxy-)?authorization|cookie)[ \t]*:/i;
@@ -40,27 +46,375 @@ function carriesAuthorizationHeader(value) {
 }
 const GIT_PROXY_CONFIG_KEY_RE = /^(?:http(?:\..*)?|remote\..*)\.proxy$/is;
 const proxyValueCarriesUserinfo = (value) => value.includes("@") || value.includes("%40");
-const GIT_PASSWORD_VARIABLE_NAMES = new Set(["pass", "password", "smtppass", "dbpass"]);
+const GIT_SECRET_VARIABLE_NAMES = new Set(["pass", "password", "smtppass", "dbpass", "token", "secret"]);
+const GIT_USER_NAMED_VARIABLE_KEY_RE = /^(?:alias|pretty|remotes|pager)\.[^.]*$/is;
 const GIT_EXTRA_HEADER_KEY_RE = /^http\.(?:.*\.)?extraheader$/is;
-const gitKeyHoldsCredential = (key) => GIT_PASSWORD_VARIABLE_NAMES.has(key.slice(key.lastIndexOf(".") + 1).toLowerCase()) || GIT_EXTRA_HEADER_KEY_RE.test(key);
+const gitKeyHoldsCredential = (key) => (!GIT_USER_NAMED_VARIABLE_KEY_RE.test(key) && GIT_SECRET_VARIABLE_NAMES.has(key.slice(key.lastIndexOf(".") + 1).toLowerCase())) || GIT_EXTRA_HEADER_KEY_RE.test(key);
+const GIT_COMMAND_KEY_RE = /^core\.(?:sshcommand|gitproxy)$/i;
+const GIT_ALIAS_KEY_RE = /^alias\.(?:[^.]*|.*\.command)$/is;
 const GIT_CREDENTIAL_HELPER_KEY_RE = /^credential\.(?:.*\.)?helper$/is;
-const GIT_CREDENTIAL_HELPER_REFERENCE_RE = /^(?:[A-Za-z0-9][A-Za-z0-9._-]*(?: +--?[A-Za-z0-9][A-Za-z0-9-]*(?:=[A-Za-z0-9._/~-]*| +[A-Za-z0-9._/~][A-Za-z0-9._/~-]*)?)*|\/[A-Za-z0-9._/~-]*)?$/;
-function gitConfigEntryCarriesCredential(entry) {
+function gitShellCommandOf(key, value) {
+    if (GIT_COMMAND_KEY_RE.test(key))
+        return value;
+    if (GIT_CREDENTIAL_HELPER_KEY_RE.test(key))
+        return value.startsWith("!") ? value.slice(1) : value;
+    if (!GIT_ALIAS_KEY_RE.test(key))
+        return undefined;
+    return value.startsWith("!") ? value.slice(1) : `git ${value}`;
+}
+const EXPANSION_OPEN = "\u0002";
+const EXPANSION_CLOSE = "\u0003";
+const EXPANSION_RE = /\u0002([^\u0003]*)\u0003/g;
+function decodeCEscapes(text, octal) {
+    if (!text.includes("\\"))
+        return text;
+    const simple = ANSI_C_ESCAPES;
+    const run = (re, from, max) => {
+        let j = from;
+        while (j < text.length && j - from < max && re.test(text.charAt(j)))
+            j++;
+        return text.slice(from, j);
+    };
+    let out = "";
+    for (let i = 0; i < text.length; i++) {
+        const c = text.charAt(i);
+        if (c !== "\\" || i + 1 >= text.length) {
+            out += c;
+            continue;
+        }
+        const e = text.charAt(i + 1);
+        let digits;
+        if (simple[e] !== undefined) {
+            out += simple[e];
+            i++;
+        }
+        else if (e === "c" && i + 2 < text.length) {
+            out += String.fromCharCode(text.charCodeAt(i + 2) & 0x1f);
+            i += 2;
+        }
+        else if ((e === "x" || e === "u" || e === "U") && (digits = run(/[0-9A-Fa-f]/, i + 2, e === "x" ? 2 : e === "u" ? 4 : 8)) !== "") {
+            out += String.fromCodePoint(Math.min(parseInt(digits, 16), 0x10ffff));
+            i += 1 + digits.length;
+        }
+        else if (/[0-7]/.test(e)) {
+            const from = octal === "echo" && e === "0" ? i + 2 : i + 1;
+            digits = run(/[0-7]/, from, 3);
+            out += digits === "" ? "\0" : String.fromCharCode(parseInt(digits, 8) & 0xff);
+            i = from + digits.length - 1;
+        }
+        else
+            out += c;
+    }
+    return out;
+}
+function markedText(word, source) {
+    let out = "";
+    for (const piece of word.pieces) {
+        if (piece.literal !== undefined)
+            out += piece.literal;
+        else if (piece.expansion !== undefined) {
+            const { kind, name, body = "" } = piece.expansion;
+            const written = kind === "parameter" ? /^[A-Za-z_][A-Za-z0-9_]*:?[-=](.+)$/s.exec(body)?.[1] : undefined;
+            out += written ?? EXPANSION_OPEN + (kind === "parameter" && name !== undefined && /^[A-Za-z_][A-Za-z0-9_]*$/.test(name) ? name : "") + EXPANSION_CLOSE;
+        }
+        else {
+            const text = source.slice(piece.span[0], piece.span[1]);
+            out += decodeCEscapes(/^\$'.*'$/s.test(text) ? text.slice(2, -1) : text, "printf");
+        }
+    }
+    return out;
+}
+const SECRET_OPTION_WORDS = new Set(["token", "password", "passwd", "pass", "passphrase", "secret", "pw", "auth", "oauth", "apikey", "credential"]);
+const ASSIGNMENT_RE = /^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/s;
+const PRINTF_CONVERSION_RE = /%(?:%|[-+ #0']*(\*|[0-9]*)(?:\.(\*|[0-9]*))?[A-Za-z])/g;
+function printfFormatIn(words) {
+    const program = words.findIndex((w) => w.slice(w.lastIndexOf("/") + 1) === "printf");
+    if (program === -1)
+        return undefined;
+    let at = program + 1;
+    while (words[at] === "-v" || words[at] === "--")
+        at += words[at] === "-v" ? 2 : 1;
+    const format = words[at];
+    if (format === undefined)
+        return undefined;
+    let count = 0;
+    const marked = format.replace(PRINTF_CONVERSION_RE, (conversion, width, precision) => {
+        if (conversion === "%%")
+            return "%";
+        count += (width === "*" ? 1 : 0) + (precision === "*" ? 1 : 0);
+        return `${EXPANSION_OPEN}#${count++}${EXPANSION_CLOSE}`;
+    });
+    return { at, marked: decodeCEscapes(marked, "printf"), count };
+}
+const SHELL_PROGRAMS = new Set(["sh", "bash", "dash", "zsh", "ksh", "mksh", "ash"]);
+const SSH_ARGUMENT_OPTIONS = "BbcDEeFIiJLlmOoPpQRSWw";
+const SSH_COMMAND_OPTION_RE = /^(?:proxy|local|knownhosts|remote)command(?:\s*=\s*|\s+)(.*)$/is;
+function commandCarriesCredential(command, depth = 0, inherited = new Set()) {
+    const source = depth === 0 ? command.replace(/[\u0002\u0003]/g, "\ufffd") : command;
+    const lexed = lexShell(source);
+    if ("parseFailure" in lexed)
+        return true;
+    const segments = lexed.segments.map((segment) => argvOf(segment).map((word) => markedText(word, source)));
+    const formats = segments.map((words) => {
+        const format = printfFormatIn(words);
+        if (format !== undefined)
+            words[format.at] = format.marked;
+        return format;
+    });
+    const bodies = [];
+    const lines = [];
+    for (const segment of lexed.segments) {
+        for (const token of segment.tokens) {
+            const word = token.kind === "word" ? token : token.kind === "redirect" ? token.target : undefined;
+            for (const piece of word?.expansions ?? [])
+                if ((piece.expansion?.kind === "command" || piece.expansion?.kind === "process") && piece.expansion.body !== undefined)
+                    bodies.push(piece.expansion.body);
+            if (token.kind !== "heredoc")
+                continue;
+            lines.push(...token.body.split(/[\n\r]/));
+            if (!token.quoted)
+                bodies.push(...(substitutionsInHeredocBody(token.body) ?? []).filter((s) => s.kind === "command").map((s) => s.body));
+        }
+    }
+    const words = segments.flat();
+    const shapeText = (text) => text.replace(EXPANSION_RE, ";").replace(/[\n\r]/g, ";");
+    if (carriesSecretShape(`${words.map(shapeText).join(" ")};${lines.map(shapeText).join(";")}`))
+        return true;
+    const literalNames = new Set(inherited);
+    const dependents = new Map();
+    const reached = [...inherited];
+    for (const word of words) {
+        const assigned = ASSIGNMENT_RE.exec(word);
+        if (assigned === null)
+            continue;
+        const [, name = "", value = ""] = assigned;
+        if (value.replace(EXPANSION_RE, "") !== "") {
+            if (!literalNames.has(name))
+                reached.push(name);
+            literalNames.add(name);
+        }
+        else {
+            for (const [, ref = ""] of value.matchAll(EXPANSION_RE)) {
+                const list = dependents.get(ref);
+                if (list === undefined)
+                    dependents.set(ref, [name]);
+                else
+                    list.push(name);
+            }
+        }
+    }
+    for (let q = 0; q < reached.length; q++) {
+        for (const name of dependents.get(reached[q] ?? "") ?? []) {
+            if (!literalNames.has(name))
+                reached.push(name);
+            literalNames.add(name);
+        }
+    }
+    const written = (text) => text.replace(EXPANSION_RE, "") !== "" || [...text.matchAll(EXPANSION_RE)].some((m) => literalNames.has(m[1] ?? ""));
+    const runs = (line) => depth < 3 && commandCarriesCredential(line, depth + 1, literalNames);
+    const secretLine = (line) => {
+        const assigned = ASSIGNMENT_RE.exec(line);
+        return assigned !== null && written(assigned[2] ?? "") && classifySecretEnvKey(assigned[1] ?? "") !== undefined;
+    };
+    if (lines.some(secretLine))
+        return true;
+    const printfCarries = (format, words) => {
+        const argument = (n) => words[format.at + 1 + n] ?? "";
+        const firstPass = format.marked.replace(EXPANSION_RE, (mark, ref) => {
+            const conversion = /^#([0-9]+)$/.exec(ref);
+            return conversion === null ? mark : argument(Number(conversion[1]));
+        });
+        if (firstPass.split(/[\n\r]/).some(secretLine))
+            return true;
+        for (const line of format.marked.split(/[\n\r]/)) {
+            const assigned = ASSIGNMENT_RE.exec(line);
+            if (assigned === null || classifySecretEnvKey(assigned[1] ?? "") === undefined)
+                continue;
+            for (const [, ref = ""] of (assigned[2] ?? "").matchAll(EXPANSION_RE)) {
+                const conversion = /^#([0-9]+)$/.exec(ref);
+                if (conversion === null)
+                    continue;
+                for (let n = Number(conversion[1]) + format.count; format.count > 0 && format.at + 1 + n < words.length; n += format.count)
+                    if (written(argument(n)))
+                        return true;
+            }
+        }
+        return false;
+    };
+    if (segments.some((words, i) => formats[i] !== undefined && printfCarries(formats[i], words)))
+        return true;
+    for (const [segment, segmentWords] of segments.entries()) {
+        const formatAt = formats[segment]?.at;
+        let sshpassOptions = false;
+        let shellOptions = false;
+        let sshOptions = false;
+        let gitOptions = false;
+        let pending;
+        for (const [position, word] of segmentWords.entries()) {
+            const waiting = pending;
+            pending = undefined;
+            if (waiting === "skip")
+                continue;
+            if (waiting === "command" && runs(word))
+                return true;
+            if (waiting === "ssh-option") {
+                const run = SSH_COMMAND_OPTION_RE.exec(word);
+                if (run !== null && runs(run[1] ?? ""))
+                    return true;
+                continue;
+            }
+            if (waiting === "git-config") {
+                const eq = word.indexOf("=");
+                if (depth < 3 && eq > 0 && gitConfigEntryCarriesCredential({ key: word.slice(0, eq), value: word.slice(eq + 1) }, depth + 1))
+                    return true;
+                continue;
+            }
+            if (waiting === "sshpass-password") {
+                if (written(word))
+                    return true;
+                continue;
+            }
+            if (waiting === "option-value" && !word.startsWith("-")) {
+                if (written(word))
+                    return true;
+                continue;
+            }
+            for (const view of position === formatAt ? [word] : [word, decodeCEscapes(word, "printf"), decodeCEscapes(word, "echo")]) {
+                if (view.split(/[\n\r]/).some(secretLine))
+                    return true;
+            }
+            if (sshpassOptions) {
+                if (word === "--") {
+                    sshpassOptions = false;
+                    continue;
+                }
+                if (word.startsWith("--")) {
+                    if (word === "--password")
+                        pending = "sshpass-password";
+                    else if (word.startsWith("--password=") && written(word.slice("--password=".length)))
+                        return true;
+                    continue;
+                }
+                if (word.startsWith("-") && word.length > 1) {
+                    for (let k = 1; k < word.length; k++) {
+                        const letter = word.charAt(k);
+                        if (letter === "p") {
+                            if (k === word.length - 1)
+                                pending = "sshpass-password";
+                            else if (written(word.slice(k + 1)))
+                                return true;
+                            break;
+                        }
+                        if (letter === "f" || letter === "d" || letter === "P") {
+                            if (k === word.length - 1)
+                                pending = "skip";
+                            break;
+                        }
+                    }
+                    continue;
+                }
+                sshpassOptions = false;
+            }
+            if (shellOptions) {
+                if (/^--[A-Za-z-]+$/.test(word))
+                    continue;
+                if (/^[-+][A-Za-z]+$/.test(word)) {
+                    if (word.startsWith("-") && word.includes("c"))
+                        pending = "command";
+                    else if (/o$/.test(word))
+                        pending = "skip";
+                    continue;
+                }
+                shellOptions = false;
+            }
+            if (gitOptions) {
+                if (word === "-c") {
+                    pending = "git-config";
+                    continue;
+                }
+                if (word.startsWith("-")) {
+                    if (["-C", "--git-dir", "--work-tree", "--namespace", "--exec-path", "--config-env", "--super-prefix", "--list-cmds", "--attr-source"].includes(word))
+                        pending = "skip";
+                    continue;
+                }
+                gitOptions = false;
+            }
+            if (sshOptions) {
+                if (/^-[A-Za-z0-9]+/.test(word) && !word.startsWith("--")) {
+                    for (let k = 1; k < word.length; k++) {
+                        const letter = word.charAt(k);
+                        if (!SSH_ARGUMENT_OPTIONS.includes(letter))
+                            continue;
+                        const attached = word.slice(k + 1);
+                        if (letter === "o") {
+                            if (attached === "")
+                                pending = "ssh-option";
+                            else {
+                                const run = SSH_COMMAND_OPTION_RE.exec(attached);
+                                if (run !== null && runs(run[1] ?? ""))
+                                    return true;
+                            }
+                        }
+                        else if (attached === "")
+                            pending = "skip";
+                        break;
+                    }
+                    continue;
+                }
+                sshOptions = false;
+            }
+            const option = /^--?([A-Za-z0-9][A-Za-z0-9_-]*)(?:=(.*))?$/s.exec(word);
+            if (option !== null && SECRET_OPTION_WORDS.has((option[1] ?? "").toLowerCase().split(/[-_]/).pop() ?? "")) {
+                if (option[2] === undefined)
+                    pending = "option-value";
+                else if (written(option[2]))
+                    return true;
+            }
+            const program = word.slice(word.lastIndexOf("/") + 1).replace(/\.exe$/i, "");
+            if (program === "sshpass")
+                sshpassOptions = true;
+            else if (SHELL_PROGRAMS.has(program))
+                shellOptions = true;
+            else if (program === "ssh")
+                sshOptions = true;
+            else if (program === "git")
+                gitOptions = true;
+            else if (program === "eval" || word.toLowerCase() === "-proxycmd")
+                pending = "command";
+        }
+    }
+    return bodies.some((body) => runs(body));
+}
+const GIT_REF_VALUE_KEY_RE = /^(?:remote\..*\.(?:fetch|push)|branch\..*\.merge)$/is;
+function carriesSecretShape(value) {
+    const view = value.replaceAll(":", "\u0001");
+    return redactSecrets(view) !== view;
+}
+function gitConfigEntryCarriesCredential(entry, depth = 0) {
     const key = entry.key?.trim();
     const value = entry.value;
-    if (key !== undefined && (carriesUrlUserinfo(key) || gitKeyHoldsCredential(key)))
-        return true;
-    if (value === undefined)
+    if (key !== undefined) {
+        const section = GIT_KEY_SECTION_RE.exec(key);
+        if (carriesUrlUserinfo(key, section === null ? undefined : key.slice(section[0].length)))
+            return true;
+    }
+    if (value === undefined || value === "")
         return false;
-    if (carriesAuthorizationHeader(value) || carriesUrlUserinfo(value))
+    if (carriesAuthorizationHeader(value) || carriesUrlUserinfo(value, value))
         return true;
     if (key === undefined)
-        return false;
-    if (GIT_PROXY_CONFIG_KEY_RE.test(key))
-        return proxyValueCarriesUserinfo(value);
-    return GIT_CREDENTIAL_HELPER_KEY_RE.test(key) && !GIT_CREDENTIAL_HELPER_REFERENCE_RE.test(value);
+        return carriesSecretShape(value);
+    if (gitKeyHoldsCredential(key))
+        return true;
+    const command = gitShellCommandOf(key, value);
+    if (command !== undefined)
+        return commandCarriesCredential(command, depth);
+    if (!GIT_REF_VALUE_KEY_RE.test(key) && carriesSecretShape(value))
+        return true;
+    return GIT_PROXY_CONFIG_KEY_RE.test(key) && proxyValueCarriesUserinfo(value);
 }
-const STANDARD_PROXY_ENV_NAMES = new Set(["HTTP_PROXY", "HTTPS_PROXY", "ALL_PROXY"]);
+const PROXY_ENV_NAMES = new Set(["HTTP_PROXY", "HTTPS_PROXY", "FTP_PROXY", "ALL_PROXY", "NPM_CONFIG_PROXY", "NPM_CONFIG_HTTPS_PROXY"]);
+const GIT_COMMAND_ENV_KEYS = new Map([["GIT_SSH_COMMAND", "core.sshCommand"], ["GIT_PROXY_COMMAND", "core.gitProxy"]]);
 const GIT_BLANK = /[ \t\n\r]/;
 export function readGitConfigParameters(text) {
     const entries = [];
@@ -113,79 +467,86 @@ export function readGitConfigParameters(text) {
 function gitConfigVariableCarriesCredential(upperName, value) {
     if (upperName === "GIT_CONFIG_PARAMETERS")
         return readGitConfigParameters(value)?.some(gitConfigEntryCarriesCredential) ?? true;
-    return STANDARD_PROXY_ENV_NAMES.has(upperName) && gitConfigEntryCarriesCredential({ key: "http.proxy", value });
+    const key = PROXY_ENV_NAMES.has(upperName) ? "http.proxy" : GIT_COMMAND_ENV_KEYS.get(upperName);
+    return key !== undefined && gitConfigEntryCarriesCredential({ key, value });
 }
 const GIT_CONFIG_COUNT_NAME = "GIT_CONFIG_COUNT";
 const GIT_CONFIG_MEMBER_RE = /^GIT_CONFIG_(KEY|VALUE)_(.*)$/s;
 const GIT_CONFIG_INDEX_RE = /^(?:0|[1-9][0-9]*)$/;
-const readGitConfigCount = (value) => (/^[0-9]+$/.test(value) && Number(value) <= 2 ** 31 - 1 ? Number(value) : undefined);
-function readGitEnvConfigRecord(env) {
-    const withheld = new Set();
-    const kept = new Map();
-    const counts = [];
-    const groups = new Map();
-    for (const name of Object.keys(env)) {
+const GIT_CONFIG_COUNT_RE = /^[ \t\n\v\f\r]*([+-]?)([0-9]+)$/;
+function readGitConfigCount(value, platform) {
+    if (value === "")
+        return 0n;
+    const number = GIT_CONFIG_COUNT_RE.exec(value);
+    if (number === null)
+        return undefined;
+    const [, sign, digits = ""] = number;
+    const significant = digits.replace(/^0+/, "");
+    const unsignedLongMax = platform === "win32" ? 2n ** 32n - 1n : 2n ** 64n - 1n;
+    const magnitude = significant.length > 20 ? unsignedLongMax : BigInt(significant === "" ? "0" : significant);
+    const read = magnitude > unsignedLongMax ? unsignedLongMax : sign === "-" ? (unsignedLongMax + 1n - magnitude) % (unsignedLongMax + 1n) : magnitude;
+    return read <= 2n ** 31n - 1n ? read : undefined;
+}
+const GIT_CONFIG_PLACEHOLDER = { key: "sema.withheld", value: "" };
+function readGitEnvConfigRecord(env, platform) {
+    const withheld = new Map();
+    const kept = new Set();
+    const countNames = [];
+    const indexed = new Map();
+    const loose = new Map();
+    for (const [name, text] of Object.entries(env)) {
+        if (text === undefined)
+            continue;
         const upper = name.toUpperCase();
-        if (upper === GIT_CONFIG_COUNT_NAME) {
-            counts.push(name);
+        const lookedUp = platform === "win32" ? upper : name;
+        if (lookedUp === GIT_CONFIG_COUNT_NAME) {
+            countNames.push(name);
             continue;
         }
         const member = GIT_CONFIG_MEMBER_RE.exec(upper);
         if (member === null)
             continue;
         const [, role, suffix = ""] = member;
-        const group = groups.get(suffix) ?? { names: [], twice: false };
-        groups.set(suffix, group);
-        group.names.push(name);
-        const text = env[name];
-        if (text === undefined)
-            continue;
         const half = role === "KEY" ? "key" : "value";
+        const groups = GIT_CONFIG_MEMBER_RE.test(lookedUp) && GIT_CONFIG_INDEX_RE.test(suffix) ? indexed : loose;
+        const group = groups.get(suffix) ?? { members: [], twice: false };
+        groups.set(suffix, group);
+        group.members.push([name, half]);
         if (group[half] !== undefined)
             group.twice = true;
         group[half] = text;
     }
-    for (const [suffix, g] of groups) {
-        if (GIT_CONFIG_INDEX_RE.test(suffix))
-            continue;
-        groups.delete(suffix);
+    const withhold = (g, standIn) => {
+        for (const [n, half] of g.members)
+            withheld.set(n, standIn ? GIT_CONFIG_PLACEHOLDER[half] : undefined);
+    };
+    for (const g of loose.values()) {
         if (g.twice || gitConfigEntryCarriesCredential(g))
-            for (const n of g.names)
-                withheld.add(n);
+            withhold(g, false);
+        else if (g.members.some(([n]) => classifySecretEnvKey(n) !== undefined)) {
+            for (const [n] of g.members)
+                if (classifySecretEnvKey(n) === undefined)
+                    withheld.set(n, undefined);
+        }
     }
-    const [countText, secondCountText] = counts.flatMap((n) => env[n] ?? []);
-    const count = countText === undefined ? 0 : secondCountText === undefined ? readGitConfigCount(countText) : undefined;
-    const ordered = [...groups.entries()].map(([suffix, g]) => ({ index: BigInt(suffix), ...g, carrier: gitConfigEntryCarriesCredential(g) })).sort((a, b) => (a.index < b.index ? -1 : a.index > b.index ? 1 : 0));
-    if (count === undefined || ordered.some((g) => g.twice)) {
-        for (const n of [...counts, ...ordered.flatMap((g) => g.names)])
-            withheld.add(n);
+    const record = [...indexed].map(([suffix, g]) => [BigInt(suffix), g]);
+    const [countName, secondCountName] = countNames;
+    if (secondCountName !== undefined || record.some(([, g]) => g.twice)) {
+        for (const n of countNames)
+            withheld.set(n, undefined);
+        for (const [, g] of record)
+            withhold(g, false);
         return { withheld, kept };
     }
-    const limit = BigInt(count);
-    const rebuild = ordered.some((g) => g.index < limit && g.carrier);
-    let next = 0;
-    for (const g of ordered) {
-        const renumber = rebuild && g.index < limit;
-        if (g.carrier || (renumber && (g.key === undefined || g.value === undefined))) {
-            for (const n of g.names)
-                withheld.add(n);
-            continue;
-        }
-        const index = renumber ? next++ : undefined;
-        for (const n of g.names) {
-            const text = env[n];
-            if (text !== undefined)
-                kept.set(n, { name: index === undefined ? n : `${n.slice(0, n.lastIndexOf("_"))}_${index}`, value: text });
-            else if (renumber)
-                withheld.add(n);
-        }
-    }
-    for (const n of counts) {
-        const text = env[n];
-        if (text !== undefined)
-            kept.set(n, { name: n, value: rebuild ? String(next) : text });
-        else if (rebuild)
-            withheld.add(n);
+    const count = countName === undefined ? 0n : readGitConfigCount(env[countName] ?? "", platform);
+    for (const n of countNames)
+        kept.add(n);
+    for (const [index, g] of record) {
+        if (gitConfigEntryCarriesCredential(g))
+            withhold(g, count === undefined || index < count);
+        else
+            for (const [n] of g.members)
+                kept.add(n);
     }
     return { withheld, kept };
 }
@@ -222,20 +583,22 @@ function classifyEnvEntry(key, value, record) {
         return "family-rule";
     return classifySecretEnvKey(key);
 }
-export function isSecretEnvKey(key, value, env) {
-    const record = readGitEnvConfigRecord(value === undefined ? {} : { ...env, [key]: value });
+export function isSecretEnvKey(key, value, env, platform = process.platform) {
+    const record = readGitEnvConfigRecord(value === undefined ? {} : { ...env, [key]: value }, platform);
     return classifyEnvEntry(key, value, record) !== undefined;
 }
-export function scrubSecretEnv(env, findings) {
-    const record = readGitEnvConfigRecord(env);
+export function scrubSecretEnv(env, findings, platform = process.platform) {
+    const record = readGitEnvConfigRecord(env, platform);
     const out = {};
     for (const k of Object.keys(env)) {
         const kind = classifyEnvEntry(k, env[k], record);
         if (kind === undefined) {
-            const moved = record.kept.get(k);
-            out[moved?.name ?? k] = moved === undefined ? env[k] : moved.value;
+            out[k] = env[k];
             continue;
         }
+        const standIn = record.withheld.get(k);
+        if (standIn !== undefined)
+            out[k] = standIn;
         if (findings !== undefined) {
             findings.push({ key: k, kind, confidence: SECRET_ENV_KIND_CONFIDENCE[kind], source: "secret-env" });
         }

package/dist/engine/execution-env/node-execution-env.js

@@ -215,7 +215,7 @@ function getShellEnv(inheritEnv, baseEnv, extraEnv, onScrub, onNotice) {
     }
     else {
         const scrubbed = [];
-        inherited = scrubSecretEnv(process.env, scrubbed);
+        inherited = scrubSecretEnv(process.env, scrubbed, process.platform);
         const findings = scrubbed.filter((f) => baseEnv?.[f.key] === undefined && extraEnv?.[f.key] === undefined);
         if (findings.length > 0) {
             if (typeof onScrub === "function") {

package/dist/engine/lsp/node-lsp-manager.js

@@ -336,7 +336,7 @@ const lspSpawnWithEnv = (env, onNotice) => (command, args, cwd, signal) => new P
         let scrubbedEnv = env;
         if (scrubbedEnv == null) {
             const findings = [];
-            scrubbedEnv = scrubSecretEnv(process.env, findings);
+            scrubbedEnv = scrubSecretEnv(process.env, findings, process.platform);
             announceSecretEnvScrub(onNotice, findings);
         }
         child = spawn(command, args, { ...lspSpawnOptions(cwd), env: scrubbedEnv });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.33.5",
+  "version": "7.33.6",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/wire-changes/core@7.33.6.json

@@ -0,0 +1,63 @@
+{
+  "repo": "core",
+  "version": "7.33.6",
+  "from": "2341b7826a837ce1786280ed3a9b1e1d656b1d41",
+  "to": "v7.33.6",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [],
+  "closedSetMembers": [],
+  "closedSetsUnreadable": [],
+  "typeKeys": [],
+  "typeKeysUnreadableArms": [],
+  "typeKeysFlattenedCount": 217,
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "typeMember",
+      "name": "SecretEnvFinding.key",
+      "assertions": [
+        "G1.a",
+        "G2.a",
+        "G5.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "SecretEnvFinding.kind",
+      "assertions": [
+        "G1.a",
+        "G1.b",
+        "G2.a",
+        "G2.b",
+        "G3.a",
+        "G3.b",
+        "G4.a",
+        "G4.b",
+        "G5.b",
+        "G6.a",
+        "G6.b",
+        "G7.a",
+        "G7.b",
+        "G8.a",
+        "G9.a",
+        "G10.a",
+        "G10.b",
+        "G10.c",
+        "G10.d",
+        "G11.a"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [],
+    "server": [],
+    "sdk": [],
+    "note": "scanned cli@4e593722 server@46b7fe60 sdk@10cf14c — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 0,
+  "breakingItems": [],
+  "toResolvedAt": "2f7a1e0a72b2b8c6af18f9fb9de3620ec80c0cf6"
+}