@sweny-ai/core 0.1.170 → 0.1.172

package/dist/git-credentials.d.ts

@@ -0,0 +1,106 @@
+/**
+ * Persisted git credentials in the checkout (#473).
+ *
+ * `actions/checkout` keeps the job token on disk by default
+ * (`persist-credentials: true`): v4 and v5 write it into `.git/config` as an
+ * `http.<origin>/.extraheader`; v6 and later write it to a separate file under
+ * `$RUNNER_TEMP` that `.git/config` pulls in with `includeIf.gitdir:...path`.
+ * Either way, any agent that can read the repo can read a token that pushes to
+ * it. Env scoping cannot reach a file.
+ *
+ * {@link scanGitCredentials} finds the files that hold such a credential, so a
+ * harness can make them unreadable to the agent of a read-only or staged node
+ * (the process wrapper's `denyRead`, Claude Code's `Read(...)` deny rules and
+ * SDK sandbox `denyRead`), or report the node `degraded` (refused under strict)
+ * where it cannot. The fix that needs no masking at all is
+ * `persist-credentials: false`: sweny pushes the PR branch itself
+ * (`github_create_pr`), with the skill's own token, in the sweny process.
+ *
+ * What counts as a credential:
+ * - `http.extraheader` / `http.<url>.extraheader` (the checkout's header);
+ * - `credential.helper` with an inline secret (`!f() { echo password=...; }; f`);
+ *   a `store` helper's file (default `~/.git-credentials`, or `--file <path>`);
+ * - `url.<base>.insteadOf` / `pushInsteadOf` whose base carries userinfo with
+ *   a password or a token, and `remote.<name>.url` / `pushurl` that do.
+ *
+ * Files scanned: the repo config (`<commondir>/config`), the worktree config
+ * (`<gitdir>/config.worktree`), the global config (`GIT_CONFIG_GLOBAL`, else
+ * `~/.gitconfig` and `$XDG_CONFIG_HOME/git/config`), and every file they
+ * include (`include.path`, and `includeIf.*.path` whatever the condition).
+ * Values never leave this module: findings carry the file and a redacted key.
+ */
+export { gitCredentialGap } from "./harness/policy.js";
+export type GitCredentialKind = "extraheader" | "credential-helper" | "credential-store" | "url-userinfo";
+export interface GitCredentialFinding {
+    /** The file holding the credential (absolute, symlinks resolved). */
+    file: string;
+    /** The config key, with any embedded credential redacted (`url.<redacted>.insteadof`). */
+    key: string;
+    kind: GitCredentialKind;
+}
+export interface GitCredentialScan {
+    findings: GitCredentialFinding[];
+    /** Every file to keep from the agent, deduplicated, in scan order. */
+    files: string[];
+}
+export interface ScanGitCredentialsOptions {
+    env?: Record<string, string | undefined>;
+    /** Test seam. Default: `fs.readFileSync(p, "utf8")`; a throw means "not there". */
+    readFile?: (p: string) => string;
+    /** Test seam. Default: `fs.existsSync`. */
+    exists?: (p: string) => boolean;
+}
+/** Does a URL carry a credential in its userinfo (`https://user:pass@`, `https://<token>@`)? */
+export declare function urlHasCredential(url: string): boolean;
+/** Does a `credential.helper` value hold the secret itself (an inline shell helper)? */
+export declare function helperHasInlineSecret(value: string): boolean;
+/** The file a `store` credential helper writes, or undefined when the helper is not `store`. */
+export declare function storeHelperFiles(value: string, env: Record<string, string | undefined>): string[] | undefined;
+interface ConfigEntry {
+    section: string;
+    /** Case preserved, as git does. */
+    subsection?: string;
+    key: string;
+    value: string;
+}
+/**
+ * Minimal git-config parser: `[section]`, `[section "sub"]`, the legacy
+ * `[section.sub]`, `key = value`, bare `key` (boolean), quoted values with
+ * escapes, `#` and `;` comments, and `\` line continuations. Section and key
+ * names are lowercased; subsections keep their case. Enough to find keys; not
+ * a validator.
+ */
+export declare function parseGitConfig(text: string): ConfigEntry[];
+/** The repo's git dir and common dir for `cwd`, walking up to the filesystem root. */
+export declare function findGitDirs(cwd: string, readFile: (p: string) => string, exists: (p: string) => boolean): {
+    gitDir: string;
+    commonDir: string;
+} | undefined;
+/**
+ * Find persisted git credentials visible from `cwd`. Pure apart from reading
+ * config files; never returns a credential value.
+ */
+export declare function scanGitCredentials(cwd: string, opts?: ScanGitCredentialsOptions): GitCredentialScan;
+/**
+ * The files to keep from one node's agent: the scan's files for a read-only
+ * node or a staged write node, nothing otherwise. A default write node keeps
+ * today's behavior (it may push with the checkout's credential); the
+ * recommended `persist-credentials: false` leaves nothing to find.
+ */
+export declare function gitCredentialMask(cwd: string, node: {
+    readOnly: boolean;
+    staged: boolean;
+}, opts?: ScanGitCredentialsOptions): string[];
+/** The run-start warning for a checkout that persists a credential. Paths and kinds only. */
+export declare function gitCredentialWarning(scan: GitCredentialScan): string | undefined;
+/**
+ * The `NodePolicy.gitCredentials` fragment for one node run (#473): the
+ * credential files to keep from a read-only or staged node's agent, or
+ * nothing. Adapters spread it into the policy they gate and wrap with.
+ */
+export declare function gitCredentialPolicy(cwd: string, node: {
+    readOnly: boolean;
+    noPush?: boolean;
+}, opts?: ScanGitCredentialsOptions): {
+    gitCredentials?: string[];
+};

package/dist/git-credentials.js

@@ -0,0 +1,322 @@
+/**
+ * Persisted git credentials in the checkout (#473).
+ *
+ * `actions/checkout` keeps the job token on disk by default
+ * (`persist-credentials: true`): v4 and v5 write it into `.git/config` as an
+ * `http.<origin>/.extraheader`; v6 and later write it to a separate file under
+ * `$RUNNER_TEMP` that `.git/config` pulls in with `includeIf.gitdir:...path`.
+ * Either way, any agent that can read the repo can read a token that pushes to
+ * it. Env scoping cannot reach a file.
+ *
+ * {@link scanGitCredentials} finds the files that hold such a credential, so a
+ * harness can make them unreadable to the agent of a read-only or staged node
+ * (the process wrapper's `denyRead`, Claude Code's `Read(...)` deny rules and
+ * SDK sandbox `denyRead`), or report the node `degraded` (refused under strict)
+ * where it cannot. The fix that needs no masking at all is
+ * `persist-credentials: false`: sweny pushes the PR branch itself
+ * (`github_create_pr`), with the skill's own token, in the sweny process.
+ *
+ * What counts as a credential:
+ * - `http.extraheader` / `http.<url>.extraheader` (the checkout's header);
+ * - `credential.helper` with an inline secret (`!f() { echo password=...; }; f`);
+ *   a `store` helper's file (default `~/.git-credentials`, or `--file <path>`);
+ * - `url.<base>.insteadOf` / `pushInsteadOf` whose base carries userinfo with
+ *   a password or a token, and `remote.<name>.url` / `pushurl` that do.
+ *
+ * Files scanned: the repo config (`<commondir>/config`), the worktree config
+ * (`<gitdir>/config.worktree`), the global config (`GIT_CONFIG_GLOBAL`, else
+ * `~/.gitconfig` and `$XDG_CONFIG_HOME/git/config`), and every file they
+ * include (`include.path`, and `includeIf.*.path` whatever the condition).
+ * Values never leave this module: findings carry the file and a redacted key.
+ */
+import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import * as path from "node:path";
+export { gitCredentialGap } from "./harness/policy.js";
+/** Tokens git hosts mint (GitHub classic and fine-grained, GitLab), and the names checkout-style auth uses. */
+const TOKEN_PATTERN = /(gh[pousr]_[A-Za-z0-9]{16,}|github_pat_[A-Za-z0-9_]{16,}|glpat-[A-Za-z0-9_-]{16,}|x-access-token|x-oauth-basic|oauth2:)/i;
+const MAX_INCLUDE_DEPTH = 10;
+/** Does a URL carry a credential in its userinfo (`https://user:pass@`, `https://<token>@`)? */
+export function urlHasCredential(url) {
+    const m = /^[a-z][a-z0-9+.-]*:\/\/([^/?#]*)@/i.exec(url.trim());
+    if (!m)
+        return false;
+    const userinfo = m[1];
+    if (userinfo.includes(":"))
+        return true;
+    return TOKEN_PATTERN.test(userinfo);
+}
+/** Does a `credential.helper` value hold the secret itself (an inline shell helper)? */
+export function helperHasInlineSecret(value) {
+    const v = value.trim();
+    if (!v.startsWith("!"))
+        return false;
+    return /password=/i.test(v) || TOKEN_PATTERN.test(v);
+}
+/** The file a `store` credential helper writes, or undefined when the helper is not `store`. */
+export function storeHelperFiles(value, env) {
+    const parts = value.trim().split(/\s+/);
+    const name = parts[0];
+    if (name !== "store" && name !== "git-credential-store")
+        return undefined;
+    for (let i = 1; i < parts.length; i++) {
+        const p = parts[i];
+        if (p.startsWith("--file="))
+            return [expandHome(p.slice("--file=".length), env)];
+        if (p === "--file" && parts[i + 1])
+            return [expandHome(parts[i + 1], env)];
+    }
+    const home = env.HOME ?? homedir();
+    const xdg = env.XDG_CONFIG_HOME || path.join(home, ".config");
+    return [path.join(home, ".git-credentials"), path.join(xdg, "git", "credentials")];
+}
+function expandHome(p, env) {
+    const unquoted = p.replace(/^["']|["']$/g, "");
+    if (unquoted === "~")
+        return env.HOME ?? homedir();
+    if (unquoted.startsWith("~/"))
+        return path.join(env.HOME ?? homedir(), unquoted.slice(2));
+    return unquoted;
+}
+function realOrSelf(p) {
+    try {
+        return realpathSync(p);
+    }
+    catch {
+        return p;
+    }
+}
+/**
+ * Minimal git-config parser: `[section]`, `[section "sub"]`, the legacy
+ * `[section.sub]`, `key = value`, bare `key` (boolean), quoted values with
+ * escapes, `#` and `;` comments, and `\` line continuations. Section and key
+ * names are lowercased; subsections keep their case. Enough to find keys; not
+ * a validator.
+ */
+export function parseGitConfig(text) {
+    const out = [];
+    let section = "";
+    let subsection;
+    const lines = text.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i++) {
+        let line = lines[i];
+        // Join continuation lines (a trailing unescaped backslash).
+        while (/(^|[^\\])(\\\\)*\\$/.test(line) && i + 1 < lines.length) {
+            line = line.slice(0, -1) + lines[++i];
+        }
+        let rest = line.trim();
+        if (rest === "" || rest.startsWith("#") || rest.startsWith(";"))
+            continue;
+        if (rest.startsWith("[")) {
+            const close = rest.indexOf("]");
+            if (close === -1)
+                continue;
+            const header = rest.slice(1, close).trim();
+            const q = /^([A-Za-z0-9.-]+)\s+"((?:[^"\\]|\\.)*)"$/.exec(header);
+            if (q) {
+                section = q[1].toLowerCase();
+                subsection = q[2].replace(/\\(.)/g, "$1");
+            }
+            else {
+                const dot = header.indexOf(".");
+                section = (dot === -1 ? header : header.slice(0, dot)).toLowerCase();
+                subsection = dot === -1 ? undefined : header.slice(dot + 1).toLowerCase();
+            }
+            rest = rest.slice(close + 1).trim();
+            if (rest === "" || rest.startsWith("#") || rest.startsWith(";"))
+                continue;
+        }
+        if (!section)
+            continue;
+        const m = /^([A-Za-z][A-Za-z0-9-]*)\s*(?:=(.*))?$/.exec(rest);
+        if (!m)
+            continue;
+        out.push({ section, subsection, key: m[1].toLowerCase(), value: m[2] === undefined ? "true" : unquote(m[2]) });
+    }
+    return out;
+}
+/** A git-config value: strip comments outside quotes, drop the quotes, resolve escapes. */
+function unquote(raw) {
+    let out = "";
+    let quoted = false;
+    for (let i = 0; i < raw.length; i++) {
+        const c = raw[i];
+        if (c === "\\" && i + 1 < raw.length) {
+            const n = raw[++i];
+            out += n === "n" ? "\n" : n === "t" ? "\t" : n;
+        }
+        else if (c === '"') {
+            quoted = !quoted;
+        }
+        else if (!quoted && (c === "#" || c === ";")) {
+            break;
+        }
+        else {
+            out += c;
+        }
+    }
+    return out.trim();
+}
+/** The repo's git dir and common dir for `cwd`, walking up to the filesystem root. */
+export function findGitDirs(cwd, readFile, exists) {
+    let dir = path.resolve(cwd);
+    for (;;) {
+        const dotGit = path.join(dir, ".git");
+        if (exists(dotGit)) {
+            let gitDir;
+            try {
+                if (statSync(dotGit).isDirectory())
+                    gitDir = dotGit;
+            }
+            catch {
+                // fall through to the file form
+            }
+            if (!gitDir) {
+                try {
+                    const m = /^gitdir:\s*(.+)$/m.exec(readFile(dotGit));
+                    if (m)
+                        gitDir = path.resolve(dir, m[1].trim());
+                }
+                catch {
+                    // unreadable .git file
+                }
+            }
+            if (!gitDir)
+                return undefined;
+            let commonDir = gitDir;
+            try {
+                commonDir = path.resolve(gitDir, readFile(path.join(gitDir, "commondir")).trim());
+            }
+            catch {
+                // not a linked worktree
+            }
+            return { gitDir, commonDir };
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            return undefined;
+        dir = parent;
+    }
+}
+/**
+ * Find persisted git credentials visible from `cwd`. Pure apart from reading
+ * config files; never returns a credential value.
+ */
+export function scanGitCredentials(cwd, opts = {}) {
+    const env = opts.env ?? process.env;
+    const readFile = opts.readFile ?? ((p) => readFileSync(p, "utf8"));
+    const exists = opts.exists ?? existsSync;
+    const findings = [];
+    const files = [];
+    const addFile = (p) => {
+        const r = realOrSelf(p);
+        if (!files.includes(r))
+            files.push(r);
+        return r;
+    };
+    const roots = [];
+    const dirs = findGitDirs(cwd, readFile, exists);
+    if (dirs) {
+        roots.push(path.join(dirs.commonDir, "config"));
+        roots.push(path.join(dirs.gitDir, "config.worktree"));
+    }
+    const home = env.HOME ?? homedir();
+    if (env.GIT_CONFIG_GLOBAL) {
+        roots.push(expandHome(env.GIT_CONFIG_GLOBAL, env));
+    }
+    else {
+        roots.push(path.join(home, ".gitconfig"));
+        roots.push(path.join(env.XDG_CONFIG_HOME || path.join(home, ".config"), "git", "config"));
+    }
+    const visited = new Set();
+    const visit = (file, depth) => {
+        if (depth > MAX_INCLUDE_DEPTH)
+            return;
+        const real = realOrSelf(file);
+        if (visited.has(real))
+            return;
+        visited.add(real);
+        let text;
+        try {
+            text = readFile(file);
+        }
+        catch {
+            return;
+        }
+        const includes = [];
+        for (const e of parseGitConfig(text)) {
+            // A subsection is a URL for http.* and credential.*: never echo one that carries a credential.
+            const sub = e.subsection && urlHasCredential(e.subsection) ? "<redacted>" : e.subsection;
+            if (e.section === "http" && e.key === "extraheader" && e.value !== "") {
+                findings.push({ file: addFile(file), key: `http.${sub ? `${sub}.` : ""}extraheader`, kind: "extraheader" });
+            }
+            else if (e.section === "credential" && e.key === "helper") {
+                const key = `credential.${sub ? `${sub}.` : ""}helper`;
+                if (helperHasInlineSecret(e.value)) {
+                    findings.push({ file: addFile(file), key, kind: "credential-helper" });
+                }
+                for (const store of storeHelperFiles(e.value, env) ?? []) {
+                    if (exists(store))
+                        findings.push({ file: addFile(store), key, kind: "credential-store" });
+                }
+            }
+            else if (e.section === "url" && (e.key === "insteadof" || e.key === "pushinsteadof")) {
+                if (sub === "<redacted>" || urlHasCredential(e.value)) {
+                    findings.push({ file: addFile(file), key: `url.<redacted>.${e.key}`, kind: "url-userinfo" });
+                }
+            }
+            else if (e.section === "remote" && (e.key === "url" || e.key === "pushurl")) {
+                if (urlHasCredential(e.value)) {
+                    findings.push({ file: addFile(file), key: `remote.${sub ?? ""}.${e.key}`, kind: "url-userinfo" });
+                }
+            }
+            else if ((e.section === "include" || e.section === "includeif") && e.key === "path" && e.value) {
+                const p = expandHome(e.value, env);
+                includes.push(path.isAbsolute(p) ? p : path.resolve(path.dirname(file), p));
+            }
+        }
+        for (const inc of includes)
+            visit(inc, depth + 1);
+    };
+    for (const root of roots)
+        visit(root, 0);
+    // Same credential twice in one file is one finding.
+    const seen = new Set();
+    const unique = findings.filter((f) => {
+        const id = `${f.file}\0${f.key}\0${f.kind}`;
+        if (seen.has(id))
+            return false;
+        seen.add(id);
+        return true;
+    });
+    return { findings: unique, files };
+}
+/**
+ * The files to keep from one node's agent: the scan's files for a read-only
+ * node or a staged write node, nothing otherwise. A default write node keeps
+ * today's behavior (it may push with the checkout's credential); the
+ * recommended `persist-credentials: false` leaves nothing to find.
+ */
+export function gitCredentialMask(cwd, node, opts = {}) {
+    if (!node.readOnly && !node.staged)
+        return [];
+    return scanGitCredentials(cwd, opts).files;
+}
+/** The run-start warning for a checkout that persists a credential. Paths and kinds only. */
+export function gitCredentialWarning(scan) {
+    if (scan.findings.length === 0)
+        return undefined;
+    const where = [...new Set(scan.findings.map((f) => `${f.key} in ${f.file}`))].join("; ");
+    return (`persisted git credential found (${where}). Read-only and staged nodes run with it masked where the harness ` +
+        `can (reported degraded, refused under strict, where it cannot); other nodes' agents can read it. ` +
+        `Recommended: actions/checkout with persist-credentials: false. sweny pushes the PR branch itself with the github skill's token.`);
+}
+/**
+ * The `NodePolicy.gitCredentials` fragment for one node run (#473): the
+ * credential files to keep from a read-only or staged node's agent, or
+ * nothing. Adapters spread it into the policy they gate and wrap with.
+ */
+export function gitCredentialPolicy(cwd, node, opts = {}) {
+    const files = gitCredentialMask(cwd, { readOnly: node.readOnly, staged: node.noPush === true }, opts);
+    return files.length > 0 ? { gitCredentials: files } : {};
+}

package/dist/harness/acp.js

@@ -51,6 +51,7 @@ import { consoleLogger } from "../types.js";
 import { finishAgentEnv, heldCredentials, parseList, reportWithheldEnv, resolveEnvScope, resolveSandboxMode, scopeAgentEnv, withPushBlocked, } from "../agent-env.js";
 import { ACP_CAPABILITIES } from "./capabilities.js";
 import { policyGate, resolveHarnessPolicy, TOOL_CLASSES } from "./policy.js";
+import { gitCredentialPolicy } from "../git-credentials.js";
 import { buildNodePrompt } from "./prompts.js";
 import { makeAbort } from "./abort.js";
 import { parseToolResultContent, schemaMismatches, summarizeToolError, tryParseJSON } from "./parse.js";
@@ -700,6 +701,8 @@ export class AcpHarness {
             sandbox: mode,
             ...(held.length > 0 ? { agentCredentials: held } : {}),
             ...(req.agentAccess?.noPush && !compiled.readOnly ? { stagedWrite: true } : {}),
+            // #473: a credential the checkout persisted stays unreadable to read-only and staged nodes.
+            ...gitCredentialPolicy(this.cwd, { readOnly: compiled.readOnly, noPush: req.agentAccess?.noPush }),
         };
         // ACP has no sandbox of its own: any mode but off needs the process wrapper.
         const wrapper = mode !== "off" && this.sandboxWrapper !== null

package/dist/harness/claude-code.d.ts

@@ -44,6 +44,13 @@ export declare const READ_ONLY_DISALLOWED_TOOLS: readonly ["Bash", "Write", "Edi
  * `tools.deny` classes compile to these names on `disallowedTools`.
  */
 export declare const CLAUDE_TOOLS_BY_CLASS: Readonly<Record<ToolClass, readonly string[]>>;
+/**
+ * A Claude Code permission rule that denies reading one absolute path (#473).
+ * `//` marks an absolute path in permission rules. Read rules cover Read and,
+ * best effort, Grep and Glob; with the SDK sandbox on, its filesystem
+ * `denyRead` (merged with these rules) covers Bash.
+ */
+export declare function claudeReadDenyRule(absPath: string): string;
 /** Native `disallowedTools` for a policy: legacy names, compiled classes, and the read-only set. */
 export declare function compileClaudeCodeDeny(policy: NodePolicy, legacy?: readonly string[]): string[];
 /** How sweny resolves which credentials reach the Claude Code subprocess. */

package/dist/harness/claude-code.js

@@ -12,7 +12,8 @@ import { query, createSdkMcpServer, tool as sdkTool } from "@anthropic-ai/claude
 import { createRequire } from "node:module";
 import { consoleLogger } from "../types.js";
 import { AGENT_AUTH_VARS, finishAgentEnv, reportWithheldEnv, parseList, resolveEnvScope, scopeAgentEnv, withPushBlocked, resolveAgentSandbox, } from "../agent-env.js";
-import { policyGate } from "./policy.js";
+import { gitCredentialGap, policyGate } from "./policy.js";
+import { gitCredentialPolicy } from "../git-credentials.js";
 import { CLAUDE_CODE_CAPABILITIES } from "./capabilities.js";
 import { ask as coreAsk, evaluate as coreEvaluate, buildEvaluatePrompt, buildNodePrompt } from "./prompts.js";
 import { jsonSchemaToZodShape, toolErrorToMcpResult, toolOutputToMcpResult } from "./tool-bridge/protocol.js";
@@ -86,6 +87,15 @@ export const CLAUDE_TOOLS_BY_CLASS = {
     net: ["WebFetch", "WebSearch"],
     subagent: ["Task", "Agent"],
 };
+/**
+ * A Claude Code permission rule that denies reading one absolute path (#473).
+ * `//` marks an absolute path in permission rules. Read rules cover Read and,
+ * best effort, Grep and Glob; with the SDK sandbox on, its filesystem
+ * `denyRead` (merged with these rules) covers Bash.
+ */
+export function claudeReadDenyRule(absPath) {
+    return `Read(/${absPath.startsWith("/") ? absPath : `/${absPath}`})`;
+}
 /** Native `disallowedTools` for a policy: legacy names, compiled classes, and the read-only set. */
 export function compileClaudeCodeDeny(policy, legacy = []) {
     return [
@@ -324,6 +334,8 @@ export class ClaudeCodeHarness {
             },
             stagedWrite: !!req.agentAccess?.noPush && !readOnly,
             strict: policy.strict || this.policyMode === "strict",
+            // #473: files holding a credential the checkout persisted, for a read-only or staged node.
+            gitCredentials: gitCredentialPolicy(this.cwd, { readOnly, noPush: req.agentAccess?.noPush }).gitCredentials,
             degraded,
         });
         return {
@@ -338,7 +350,7 @@ export class ClaudeCodeHarness {
         // Dry run (#380): external MCP servers cannot be classified per tool, so
         // they are unknown, and unknown means write. Drop them, and disallow the
         // built-ins that can change the workspace or shell out.
-        const disallowedTools = readOnly
+        let disallowedTools = readOnly
             ? [...new Set([...(opts.disallowedTools ?? []), ...READ_ONLY_DISALLOWED_TOOLS])]
             : opts.disallowedTools;
         const effectiveModel = model ?? this.model;
@@ -379,6 +391,35 @@ export class ClaudeCodeHarness {
             }
             opts.degraded?.push(gap);
         }
+        // #473: a credential the checkout persisted (actions/checkout's default).
+        // Read deny rules keep it from Read, Grep and Glob; the SDK sandbox's
+        // filesystem deny keeps it from Bash (and stops a rename around the deny).
+        // A node with Bash and no sandbox cannot be held to it.
+        let sandboxSettings = sandbox.settings;
+        const credentialFiles = opts.gitCredentials ?? [];
+        if (credentialFiles.length > 0) {
+            disallowedTools = [...new Set([...(disallowedTools ?? []), ...credentialFiles.map(claudeReadDenyRule)])];
+            if (sandboxSettings) {
+                const fsDeny = sandboxSettings.filesystem ?? {};
+                sandboxSettings = {
+                    ...sandboxSettings,
+                    filesystem: {
+                        ...fsDeny,
+                        denyRead: [...new Set([...(fsDeny.denyRead ?? []), ...credentialFiles])],
+                        denyWrite: [...new Set([...(fsDeny.denyWrite ?? []), ...credentialFiles])],
+                    },
+                };
+            }
+            else if (!disallowedTools.includes("Bash")) {
+                const gap = gitCredentialGap(credentialFiles);
+                if (opts.strict) {
+                    const error = `strict policy: ${gap}`;
+                    this.logger.error(error);
+                    return { status: "failed", data: { error, refused: true }, toolCalls: [] };
+                }
+                opts.degraded?.push(gap);
+            }
+        }
         // Tool-call accounting (Fix #1).
         //
         // Stream-driven recording, correlated by tool_use_id:
@@ -469,7 +510,7 @@ export class ClaudeCodeHarness {
                     env,
                     permissionMode: "bypassPermissions",
                     allowDangerouslySkipPermissions: true,
-                    ...(sandbox.settings ? { sandbox: sandbox.settings } : {}),
+                    ...(sandboxSettings ? { sandbox: sandboxSettings } : {}),
                     stderr: (data) => this.logger.debug(`[claude-code] ${data}`),
                     ...(abort ? { abortController: abort.controller } : {}),
                     ...(effectiveModel ? { model: effectiveModel } : {}),

package/dist/harness/codex.js

@@ -31,6 +31,7 @@ import { consoleLogger } from "../types.js";
 import { CODEX_AUTH_VARS, CODEX_ENV_PREFIXES, checkSandboxSupport, finishAgentEnv, heldCredentials, parseList, reportWithheldEnv, resolveCodexAuthEnv, resolveEnvScope, resolveSandboxMode, scopeAgentEnv, withPushBlocked, } from "../agent-env.js";
 import { CODEX_CAPABILITIES } from "./capabilities.js";
 import { policyGate, resolveHarnessPolicy } from "./policy.js";
+import { gitCredentialPolicy } from "../git-credentials.js";
 import { buildNodePrompt } from "./prompts.js";
 import { makeAbort } from "./abort.js";
 import { parseToolResultContent, summarizeToolError, tryParseJSON } from "./parse.js";
@@ -744,6 +745,8 @@ export class CodexHarness {
             sandbox: mode,
             ...(held.length > 0 ? { agentCredentials: held } : {}),
             ...(req.agentAccess?.noPush && !compiled.readOnly ? { stagedWrite: true } : {}),
+            // #473: a credential the checkout persisted stays unreadable to read-only and staged nodes.
+            ...gitCredentialPolicy(this.cwd, { readOnly: compiled.readOnly, noPush: req.agentAccess?.noPush }),
         };
         // Codex's network is one switch, not a host list, so any sandbox mode but
         // off needs the process wrapper for full containment.

package/dist/harness/pi.js

@@ -37,6 +37,7 @@ import { consoleLogger } from "../types.js";
 import { PI_AUTH_VARS, PI_ENV_PREFIXES, finishAgentEnv, heldCredentials, parseList, reportWithheldEnv, resolveEnvScope, resolvePiProvider, resolveSandboxMode, scopeAgentEnv, withPushBlocked, } from "../agent-env.js";
 import { PI_CAPABILITIES } from "./capabilities.js";
 import { policyGate, resolveHarnessPolicy } from "./policy.js";
+import { gitCredentialPolicy } from "../git-credentials.js";
 import { buildNodePrompt } from "./prompts.js";
 import { makeAbort } from "./abort.js";
 import { parseToolResultContent, summarizeToolError, tryParseJSON } from "./parse.js";
@@ -743,6 +744,8 @@ export class PiHarness {
             sandbox: mode,
             ...(held.length > 0 ? { agentCredentials: held } : {}),
             ...(req.agentAccess?.noPush && !compiled.policy.readOnly ? { stagedWrite: true } : {}),
+            // #473: a credential the checkout persisted stays unreadable to read-only and staged nodes.
+            ...gitCredentialPolicy(this.cwd, { readOnly: compiled.policy.readOnly, noPush: req.agentAccess?.noPush }),
         };
         const needsWrapper = mode !== "off";
         const wrapper = needsWrapper && this.sandboxWrapper !== null

package/dist/harness/policy.d.ts

@@ -30,6 +30,11 @@ export declare const TOOL_CLASSES: readonly ToolClass[];
 export declare function isToolClass(name: string): name is ToolClass;
 /** The tool classes a harness can deny natively. */
 export declare function nativeDenyClasses(caps: HarnessCapabilities): ToolClass[];
+/**
+ * One `degraded` line for credential files nobody keeps from the agent (#473).
+ * Paths only, never values.
+ */
+export declare function gitCredentialGap(files: readonly string[]): string;
 export declare function policyGate(caps: HarnessCapabilities, policy: NodePolicy, wrappers?: PolicyWrappers): PolicyGateResult;
 /**
  * budgetGate (#449): can this harness keep a spend budget? Pure; the executor

package/dist/harness/policy.js

@@ -42,6 +42,14 @@ export function nativeDenyClasses(caps) {
     const set = new Set([...base, ...(caps.denyClasses ?? [])]);
     return TOOL_CLASSES.filter((c) => set.has(c));
 }
+/**
+ * One `degraded` line for credential files nobody keeps from the agent (#473).
+ * Paths only, never values.
+ */
+export function gitCredentialGap(files) {
+    return (`git credential: ${files.join(", ")} holds a persisted git credential (actions/checkout persist-credentials) ` +
+        `and nothing keeps this node's agent from reading it; set persist-credentials: false, or run under the sandbox`);
+}
 export function policyGate(caps, policy, wrappers = {}) {
     const unenforced = [];
     const wrapped = [];
@@ -56,6 +64,12 @@ export function policyGate(caps, policy, wrappers = {}) {
         unenforced.push(`read-only: the agent process holds write credentials (${held.join(", ")}) and network access; ` +
             `a read-only filesystem mount does not stop API writes`);
     }
+    // #473: a credential the checkout persisted on disk. Only a read deny
+    // keeps it from the agent; env scoping cannot reach a file.
+    const gitCredentials = policy.gitCredentials ?? [];
+    if (gitCredentials.length > 0 && !wrappers.readDeny) {
+        unenforced.push(gitCredentialGap(gitCredentials));
+    }
     if (policy.deny.length > 0) {
         const native = nativeDenyClasses(caps);
         const unmappable = policy.deny.filter((c) => !native.includes(c));

package/dist/harness/sandbox-wrapper.d.ts

@@ -19,7 +19,8 @@
  *   host network except through that proxy.
  * - filesystem: the workspace (cwd) and a scratch HOME are writable; the rest
  *   of the filesystem is read-only; the operator's credential files are
- *   unreadable. Sibling homes under the same configured scratch root are
+ *   unreadable, and so is a git credential the checkout persisted when the
+ *   node is read-only or staged (#473, `denyRead`). Sibling homes under the same configured scratch root are
  *   hidden; only this run's HOME is exposed. Dry runs (`readOnly`) leave the
  *   workspace read-only too. All concurrent credential-bearing adapters must
  *   use the same scratch root; different roots are not mutually isolated.
@@ -55,6 +56,12 @@ export interface SandboxWrapRequest extends AgentSpawn {
     egress: readonly string[];
     /** Dry run: the workspace is read-only too (only the scratch HOME is writable). */
     readOnly?: boolean;
+    /**
+     * Files the process must not read, nor move or rewrite (#473: a git
+     * credential `actions/checkout` persisted). On Linux srt masks each with
+     * /dev/null, so git sees an empty file; on macOS reads fail.
+     */
+    denyRead?: readonly string[];
 }
 /** The spawn to run instead, plus the scratch it owns. */
 export interface WrappedSpawn extends AgentSpawn {
@@ -102,7 +109,7 @@ export declare function isSrtDomainPattern(entry: string): boolean;
  * The srt settings for one wrapped spawn. Pure apart from `exists`.
  * `credentialHome` is the operator's real HOME (not the scratch HOME).
  */
-export declare function buildSrtSettings(req: Pick<SandboxWrapRequest, "cwd" | "egress" | "readOnly">, opts: {
+export declare function buildSrtSettings(req: Pick<SandboxWrapRequest, "cwd" | "egress" | "readOnly" | "denyRead">, opts: {
     home: string;
     credentialHome: string;
     exists?: (p: string) => boolean;