loki-mode 9.59.0 → 9.64.0

package/autonomy/run.sh

@@ -1228,6 +1228,12 @@ if [ -f "$LOCK_LIB" ]; then
     source "$LOCK_LIB"
 fi
 
+# Guarded browser opener (loki_open_url): the only way run.sh opens a browser.
+if [ -f "$SCRIPT_DIR/lib/browser-open.sh" ]; then
+    # shellcheck source=lib/browser-open.sh
+    source "$SCRIPT_DIR/lib/browser-open.sh"
+fi
+
 # Git PR advisory (shared print-only helper for create_session_pr and loki deploy)
 GIT_PR_ADVISORY_LIB="$SCRIPT_DIR/lib/git-pr-advisory.sh"
 if [ -f "$GIT_PR_ADVISORY_LIB" ]; then
@@ -5339,7 +5345,13 @@ except Exception:
 }
 
 #===============================================================================
-# Rule of Two (moat P9): a GitHub token never reaches an agent session.
+# Rule of Two (moat P9): a GitHub token never reaches an agent session via the
+# IMPLICIT resolution paths this module withholds (env vars, gh config store,
+# git credential.helper, SSH agent/ssh command). Not an absolute claim -- see
+# the disclosed residuals at the end of this header (an explicit named-account
+# keyring read, a direct ssh/hosts.yml/keychain read outside git); the actual
+# security boundary is a CI job holding no write token and no SSH agent while
+# the agent runs.
 #
 # The run reads untrusted issue text and spawns agents that act on it, so a
 # token in the exported environment is one prompt injection away from a push.
@@ -5350,26 +5362,581 @@ except Exception:
 #   - _loki_with_github_tokens <cmd...>, for the post-session push/PR paths.
 # LOKI_ALLOW_AGENT_GITHUB_TOKEN=1 (exact value) restores the old inheritance
 # and prints one stderr warning that the agent holds the token.
+#
+# BACKLOG 149 (round 2, REJECT rework): the previous fix scoped GH_CONFIG_DIR
+# to a fresh empty directory but a reviewer confirmed, live, that this does not
+# close the vulnerability. Two bypasses, both reproduced empirically against
+# real gh 2.92 + a real macOS Keychain-backed `gh auth login` on 2026-09-27:
+#
+#   1. `GH_CONFIG_DIR=<empty dir> gh auth token` (real $HOME, no env token)
+#      still exits 0: gh's resolution is config-dir file, THEN OS keyring
+#      fallback (Keychain on macOS, libsecret on Linux). An empty config dir
+#      does not stop the keyring lookup.
+#   2. git's own `credential.helper` (`gh auth setup-git` wires
+#      `credential.https://github.com.helper = !gh auth git-credential`, and a
+#      plain `osxkeychain`/`libsecret`/etc. helper may ALSO be configured,
+#      unscoped, ahead of or behind it) is invoked directly by git on any
+#      `git push`/`git credential fill` over HTTPS. This path is git-invoked,
+#      not GH_CONFIG_DIR-mediated at all -- scoping GH_CONFIG_DIR does nothing
+#      to it, and it resolves through the same keyring fallback OR a
+#      completely separate OS-keychain entry that git's own helper (not gh's)
+#      maintains independently.
+#
+# Fix, verified against `gh help environment` and empirically against both
+# bypasses (see the S-18 rework session transcript for the repro/counter-repro
+# pairs; no real credential value was ever printed during that verification):
+#
+#   (a) GH_TOKEN/GITHUB_TOKEN/GH_ENTERPRISE_TOKEN/GITHUB_ENTERPRISE_TOKEN are
+#       no longer merely unset -- each is set to a fresh per-process garbage
+#       value (SENTINEL below). `gh help environment` documents the env token
+#       as taking "precedence over previously stored credentials", and this
+#       was confirmed live: with the sentinel present, `gh auth token` AND
+#       `gh auth git-credential get` both echo back the garbage value, never
+#       falling through to the keyring. `gh auth git-credential get` is a pure
+#       read/print in this path -- it does not write to GH_CONFIG_DIR or touch
+#       the keychain, so planting a sentinel has no destructive side effect;
+#       a `git push` that ends up using it simply gets a 401 from GitHub, the
+#       same as any other wrong password.
+#   (b) The sentinel alone does not close a plain `osxkeychain` (or similar)
+#       helper that is configured UNSCOPED (`credential.helper = osxkeychain`,
+#       no gh involved at all) and holds its own independently-cached
+#       credential -- confirmed present as a THIRD, gh-independent store on
+#       the verification machine (git's own keychain entry, distinct from
+#       gh's). GH_TOKEN only feeds gh's own resolution; it does not touch
+#       git's credential-helper chain. So the session additionally gets
+#       `credential.helper=` (empty string) injected via
+#       GIT_CONFIG_COUNT/GIT_CONFIG_KEY_n/GIT_CONFIG_VALUE_n, appended after
+#       any GIT_CONFIG_COUNT the operator already has set. Per gitcredentials(7):
+#       "If credential.helper is configured to the empty string, this resets
+#       the helper list to empty" -- this is why the reset must be UNSCOPED
+#       (plain `credential.helper`, not `credential.<url>.helper`, since a
+#       URL-scoped reset does not necessarily out-order every already
+#       configured helper) and appended LAST (env-var config values override
+#       every config FILE, per `git help config` on GIT_CONFIG_COUNT, and later
+#       GIT_CONFIG_KEY_n entries are read after earlier ones). Confirmed live:
+#       with this override present, `git credential fill` against github.com
+#       fails closed ("could not read Username") instead of returning a
+#       password line, with no fallback to any other helper. This closes the
+#       git-invoked path directly, independent of GH_CONFIG_DIR or any
+#       GH_TOKEN-family value.
+#
+# GH_CONFIG_DIR is still scoped to a fresh empty directory (unconditionally,
+# same as before) -- it remains correct for the plaintext-hosts.yml-read case
+# and for any gh subcommand that does not consult GH_TOKEN. $HOME itself stays
+# untouched, so Claude's own OAuth (F49) is unaffected -- nothing here reads
+# or writes $HOME/.claude or touches any Anthropic credential path.
+#
+# BACKLOG 149 (round 3, REJECT rework): round 2's fix is HTTPS-only. A
+# round-3 reviewer confirmed, live, that none of the above touches
+# SSH_AUTH_SOCK or GIT_SSH_COMMAND -- the provider session's real, untouched
+# environment always has a reachable SSH agent (by this design's own stated
+# intent of keeping the environment live for Claude's own OAuth), so
+# `git remote set-url origin git@github.com:<owner>/<repo>.git && git push`
+# authenticates exactly as an unrestricted session. Reproduced with a
+# synthetic-only ssh-agent and a throwaway key (never a real credential):
+# `ssh-add -l` against the inherited SSH_AUTH_SOCK lists the identity, and any
+# ssh-transport git operation would authenticate with it.
+#
+# Fix: SSH_AUTH_SOCK is unset (not sentineled) for the withheld session.
+# Unlike the GH_TOKEN-family vars, a present-but-wrong SSH_AUTH_SOCK does NOT
+# stop ssh from falling back: with no usable agent, ssh(1) still tries the
+# default key files (~/.ssh/id_*) and any `IdentityAgent` socket named in
+# ~/.ssh/config (and on macOS a launchd agent socket is rediscoverable). A
+# sentinel therefore buys nothing over unset, so unset is the simpler choice
+# for THIS var. Those fallbacks are why GIT_SSH_COMMAND=false (below) is the
+# part that actually closes git's ssh transport: git never runs ssh at all.
+# An agent that explicitly removes it (`env -u GIT_SSH_COMMAND git push
+# git@...`) gets ssh back with those fallbacks -- same class as `env -u
+# GH_TOKEN`, disclosed in the residual list at the end of this header. That
+# does not contradict round 2's reasoning for sentineling
+# the token vars, it applies that same reasoning to a var with different
+# fallback semantics. GIT_SSH_COMMAND is set to `false` (a POSIX builtin that
+# ignores all arguments and always exits 1): git invokes it in place of ssh
+# for any ssh-transport fetch/push, and git's own docs (`git help git-config`)
+# confirm the env var "is overridden when the environment variable is set" --
+# i.e. GIT_SSH_COMMAND (env) unconditionally outranks core.sshCommand
+# (config), so setting only the env var closes both an operator-configured
+# core.sshCommand AND an agent-configured one, with no separate
+# GIT_CONFIG_COUNT-based core.sshCommand reset needed. This means even an
+# explicit `ssh -i <path>` invocation made THROUGH git (git fetch/push/clone
+# over an ssh:// or git@ URL) fails; it does NOT stop an agent from invoking
+# the real `/usr/bin/ssh` binary directly outside of git, which is a
+# disclosed residual (see below), the same class as the already-disclosed
+# `gh auth token -u <username>` and on-disk hosts.yml/keychain reads.
+#
+# Loki's own trusted calls (gh() below, _loki_with_github_tokens) restore the
+# REAL env values (or absence) for the 4 token vars, the real GH_CONFIG_DIR
+# (or absence), the real GIT_CONFIG_COUNT/KEY/VALUE state (or absence), and
+# the real SSH_AUTH_SOCK/GIT_SSH_COMMAND state (or absence) around the one
+# trusted command, then re-apply the withhold afterward -- this repo's own
+# trusted git operations (create_session_pr, on_run_complete's push,
+# proof-check.sh) push to an https or ssh GitHub origin, so an SSH-origin
+# user's Loki-initiated push must still work; the SSH sentinel needs the same
+# re-grant path as the token vars, not a simpler one.
+#
+# Restoring credentials is only safe if the credentialed process does not
+# also load code the agent controls (round 5). Until round 5 it did: the
+# trusted push was a `git push` inside the agent's working tree, so the
+# agent's repo config (.git/hooks, core.hooksPath, core.sshCommand, a
+# repo-local credential.helper, core.fsmonitor, url.*insteadOf, include/
+# includeIf) ran holding every restored credential. Now the push goes through
+# _loki_trusted_push (fresh Loki-owned repo, origin URL read as data and
+# accepted only as a github.com https/ssh URL) and every trusted gh call runs
+# from / with GH_REPO (_loki_run_neutral), so no credentialed git or gh process
+# loads the agent's repo config. What the trusted step still trusts:
+#   - the operator's GLOBAL and SYSTEM git config (they carry the real
+#     credential helper). An agent that writes ~/.gitconfig, /etc/gitconfig or
+#     an included file there gets the same code execution back; this is the
+#     same-user filesystem class as editing ~/.ssh or a shell rc file.
+#   - the branch contents, which are the agent's work by design (Loki pushes
+#     them for review; nothing in them executes during the push).
+#   - the origin OWNER/REPO the agent's config names: the agent can point the
+#     push at another github.com repository. GitHub still enforces the
+#     operator token's permissions there.
+# A non-GitHub origin is no longer pushed at all (LOKI_AUTO_PR=1 used to push
+# to any origin).
+#
 # This is hygiene against a naive injection, not an isolation boundary: code
 # running as the same user can still read the parent's environment block
-# (/proc/<pid>/environ on Linux, sudo on a hosted runner). The boundary is a
-# CI job that holds no write token while the agent runs (see
+# (/proc/<pid>/environ on Linux, sudo on a hosted runner), the hosts.yml file
+# directly off disk (F49 keeps $HOME live), or invoke `git -c
+# credential.helper=...` / `security find-generic-password` /
+# `env -u GH_TOKEN -u GITHUB_TOKEN gh auth token` / `gh auth token -u
+# <username>` / `env -u GIT_SSH_COMMAND git push git@...` (ssh then falls back
+# to ~/.ssh/id_* default keys and any ~/.ssh/config IdentityAgent) / the real
+# `ssh` binary directly with an explicit `-i` key path or a re-discovered agent
+# socket (e.g. `launchctl getenv SSH_AUTH_SOCK` on macOS) / git's `ext::`
+# transport (`git -c protocol.ext.allow=always` with an `ext::<command>` URL,
+# which runs an arbitrary command as the transport) / GIT_ASKPASS (VS Code's
+# integrated terminal sets it to a helper that can answer git's credential
+# prompt over IPC; it is left untouched here) explicitly to route around
+# this. The boundary is a CI job that holds
+# no write token and no SSH agent while the agent runs (see
 # .github/workflows/loki-issue-to-pr.yml).
 #===============================================================================
 _LOKI_WITHHELD_TOKENS=""
+_LOKI_GIT_CONFIG_COUNT_UNSUPPORTED=""
+_LOKI_GH_TOKEN_REAL_HAD=""
+_LOKI_GH_TOKEN_REAL_VAL=""
+_LOKI_GITHUB_TOKEN_REAL_HAD=""
+_LOKI_GITHUB_TOKEN_REAL_VAL=""
+_LOKI_GH_ENT_TOKEN_REAL_HAD=""
+_LOKI_GH_ENT_TOKEN_REAL_VAL=""
+_LOKI_GITHUB_ENT_TOKEN_REAL_HAD=""
+_LOKI_GITHUB_ENT_TOKEN_REAL_VAL=""
+_LOKI_GH_CONFIG_SCOPED=""
+_LOKI_GH_CONFIG_DIR_HAD=""
+_LOKI_GH_CONFIG_DIR_OLD=""
+_LOKI_GIT_CRED_SCOPED=""
+_LOKI_GIT_CONFIG_COUNT_OLD=""
+_LOKI_GIT_CONFIG_COUNT_HAD=""
+_LOKI_GIT_CRED_INDEX=""
+_LOKI_GH_SENTINEL=""
+_LOKI_SSH_AUTH_SOCK_HAD=""
+_LOKI_SSH_AUTH_SOCK_OLD=""
+_LOKI_GIT_SSH_COMMAND_HAD=""
+_LOKI_GIT_SSH_COMMAND_OLD=""
+_LOKI_SSH_WITHHELD=""
+_LOKI_GH_INHERITED=""
+
+# Restore the real value (or absence) of one of the 4 token vars, using the
+# per-var _HAD/_VAL pair captured by _loki_gh_capture. Bash has no portable
+# array-of-names-by-reference here, so this is spelled out per var rather than
+# looped over a dynamic name. Also used by the --bg relaunch path to hand the
+# REAL values to the relaunched child (see call site below).
+_loki_restore_one_token() {
+    local _var="$1" _had="$2" _val="$3"
+    if [ -n "$_had" ]; then
+        export "$_var=$_val"
+    else
+        unset "$_var"
+    fi
+}
+
+# Capture the REAL pre-withhold state exactly once per process: the 4 token
+# vars, GH_CONFIG_DIR, and GIT_CONFIG_COUNT. Idempotent via _LOKI_WITHHELD_TOKENS
+# as the guard, so a later _loki_gh_apply (called after a trusted command
+# restores and re-applies) never re-captures its own sentinel/scoped state as
+# if it were the original.
+_loki_gh_capture() {
+    [ -z "$_LOKI_WITHHELD_TOKENS" ] || return 0
+    local _v
+    # GIT_CONFIG_COUNT/GIT_CONFIG_KEY_n/GIT_CONFIG_VALUE_n were introduced in
+    # git 2.31.0 (2021-03-15); an older git silently ignores them, leaving the
+    # credential.helper reset a no-op with no error -- the exact
+    # fail-open-with-no-signal this fix must not have. Detected once per
+    # process (not on every apply) from `git --version`; a `git version
+    # X.Y.Z` line below 2.31 sets the flag so _loki_withhold_github_tokens can
+    # warn once. Ubuntu 24.04 (2.43) and Debian bookworm (2.39), the two base
+    # images this project ships (Dockerfile, Dockerfile.sandbox), are both
+    # well above this floor; the warning matters for an operator's own older
+    # git (e.g. RHEL 8 ships 2.18).
+    if command -v git >/dev/null 2>&1; then
+        local _gv _gv_major _gv_minor
+        _gv="$(git --version 2>/dev/null)"
+        case "$_gv" in
+            git\ version\ [0-9]*.[0-9]*.*)
+                _gv="${_gv#git version }"
+                _gv_major="${_gv%%.*}"
+                _gv="${_gv#*.}"
+                _gv_minor="${_gv%%.*}"
+                case "$_gv_major" in *[!0-9]*) _gv_major="" ;; esac
+                case "$_gv_minor" in *[!0-9]*) _gv_minor="" ;; esac
+                if [ -n "$_gv_major" ] && [ -n "$_gv_minor" ]; then
+                    if [ "$_gv_major" -lt 2 ] || { [ "$_gv_major" -eq 2 ] && [ "$_gv_minor" -lt 31 ]; }; then
+                        _LOKI_GIT_CONFIG_COUNT_UNSUPPORTED=1
+                    fi
+                fi
+                ;;
+        esac
+    fi
+    # Cross-runtime/nested-`loki start` guard: a bash child spawned by an
+    # ALREADY-withheld process (Bun's delegateToBash forwarding
+    # {...process.env}, or an agent literally invoking `loki start` inside its
+    # own withheld session) inherits the PARENT's sentinel/scoped state as
+    # ordinary env vars. Without this guard this process would capture that
+    # inherited state as if it were the operator's real original and restore
+    # to it for its own trusted calls -- i.e. Loki's own push/PR would use the
+    # inherited garbage sentinel instead of a real credential. Detect the
+    # sentinel shape (see _LOKI_GH_SENTINEL below) and treat it, and the
+    # scoped GH_CONFIG_DIR/credential.helper reset that came with it, as
+    # ABSENT rather than as the real original.
+    local _inherited_sentinel=""
+    case "${GH_TOKEN:-}" in ghp_LOKIWITHHELDsentinel*INVALID) _inherited_sentinel=1 ;; esac
+    # Nested-run rule (BACKLOG 149 round 4): an inherited sentinel means this
+    # run was started from INSIDE an already-withheld session -- an agent
+    # running `loki start` in its own session, or a build started from the
+    # dashboard that start_dashboard spawned after the withhold. Such a run has
+    # no real credentials to restore on ANY channel, and reopening any of them
+    # for its "trusted" push would hand an agent-chosen repo/branch the
+    # operator's credential helper or default SSH keys. So it fails CLOSED on
+    # every channel: _loki_gh_restore becomes a no-op and Loki's own push/PR
+    # from a nested run runs with the withheld state (and fails). Before this
+    # rule the channels disagreed (HTTPS helper chain and default SSH keys
+    # reopened, agent socket closed).
+    [ -z "$_inherited_sentinel" ] || _LOKI_GH_INHERITED=1
+    if [ -n "$_inherited_sentinel" ]; then
+        : # GH_TOKEN/GITHUB_TOKEN/GH_ENTERPRISE_TOKEN/GITHUB_ENTERPRISE_TOKEN
+          # all get the SAME sentinel per _loki_gh_apply, so one check covers
+          # all 4 -- _LOKI_*_REAL_HAD stays unset for each, meaning "restore to
+          # absent", not "restore to this garbage value". The same inherited
+          # process also had SSH_AUTH_SOCK unset and GIT_SSH_COMMAND=false by
+          # this same apply, so _LOKI_SSH_AUTH_SOCK_HAD/_LOKI_GIT_SSH_COMMAND_HAD
+          # stay unset too (restore to absent, not to `false`) -- see the SSH
+          # capture below, gated on this same flag.
+    else
+        if [ -n "${GH_TOKEN+x}" ]; then _LOKI_GH_TOKEN_REAL_HAD=1; _LOKI_GH_TOKEN_REAL_VAL="$GH_TOKEN"; fi
+        if [ -n "${GITHUB_TOKEN+x}" ]; then _LOKI_GITHUB_TOKEN_REAL_HAD=1; _LOKI_GITHUB_TOKEN_REAL_VAL="$GITHUB_TOKEN"; fi
+        if [ -n "${GH_ENTERPRISE_TOKEN+x}" ]; then _LOKI_GH_ENT_TOKEN_REAL_HAD=1; _LOKI_GH_ENT_TOKEN_REAL_VAL="$GH_ENTERPRISE_TOKEN"; fi
+        if [ -n "${GITHUB_ENTERPRISE_TOKEN+x}" ]; then _LOKI_GITHUB_ENT_TOKEN_REAL_HAD=1; _LOKI_GITHUB_ENT_TOKEN_REAL_VAL="$GITHUB_ENTERPRISE_TOKEN"; fi
+    fi
+    # SSH sentinel (BACKLOG 149 round 3): capture the real pre-withhold state
+    # of SSH_AUTH_SOCK and GIT_SSH_COMMAND, same inherited-sentinel guard as
+    # the token vars above (GIT_SSH_COMMAND=false is this fix's own withheld
+    # value, never an operator's real config -- an operator who genuinely
+    # wants `false` as their ssh command is not a real scenario worth
+    # preserving across the guard).
+    if [ -z "$_inherited_sentinel" ]; then
+        if [ -n "${SSH_AUTH_SOCK+x}" ]; then _LOKI_SSH_AUTH_SOCK_HAD=1; _LOKI_SSH_AUTH_SOCK_OLD="$SSH_AUTH_SOCK"; fi
+        if [ -n "${GIT_SSH_COMMAND+x}" ] && [ "$GIT_SSH_COMMAND" != "false" ]; then
+            _LOKI_GIT_SSH_COMMAND_HAD=1
+            _LOKI_GIT_SSH_COMMAND_OLD="$GIT_SSH_COMMAND"
+        fi
+    fi
+    for _v in GH_TOKEN GITHUB_TOKEN GH_ENTERPRISE_TOKEN GITHUB_ENTERPRISE_TOKEN; do
+        _LOKI_WITHHELD_TOKENS="${_LOKI_WITHHELD_TOKENS:+$_LOKI_WITHHELD_TOKENS }$_v"
+    done
+    # An inherited scoped GH_CONFIG_DIR (bash's loki-gh-config.* or the Bun
+    # route's loki-gh-config-*) is likewise not the operator's real original.
+    # TMPDIR is normalized first: on macOS it ends in "/", so bash's own
+    # mktemp path has "//" while Node's tmpdir() (Bun route) strips the slash.
+    # Without accepting both, Bun's scoped dir was mistaken for the operator's.
+    local _tmp_root="${TMPDIR:-/tmp}"
+    _tmp_root="${_tmp_root%/}"
+    case "${GH_CONFIG_DIR:-}" in
+        "$_tmp_root"/loki-gh-config.* | "$_tmp_root"//loki-gh-config.* \
+        | "$_tmp_root"/loki-gh-config-* | "$_tmp_root"//loki-gh-config-*) ;;
+        *)
+            if [ -n "${GH_CONFIG_DIR+x}" ]; then
+                _LOKI_GH_CONFIG_DIR_HAD=1
+                _LOKI_GH_CONFIG_DIR_OLD="$GH_CONFIG_DIR"
+            fi
+            ;;
+    esac
+    # An inherited credential.helper reset: if the sentinel was inherited AND
+    # the LAST GIT_CONFIG_KEY/VALUE pair is exactly this fix's reset
+    # (credential.helper=""), treat the count as if that pair were never
+    # added -- i.e. capture the state BENEATH it as the real original, so
+    # restore correctly removes only the inherited pair rather than an
+    # operator-configured one at the same index.
+    if [ -n "${GIT_CONFIG_COUNT:-}" ] && [ "${GIT_CONFIG_COUNT}" -eq "${GIT_CONFIG_COUNT}" ] 2>/dev/null; then
+        local _n=$((GIT_CONFIG_COUNT - 1)) _last_key_var _last_val_var
+        _last_key_var="GIT_CONFIG_KEY_${_n}"
+        _last_val_var="GIT_CONFIG_VALUE_${_n}"
+        if [ -n "$_inherited_sentinel" ] && [ "$_n" -ge 0 ] \
+            && [ "${!_last_key_var:-}" = "credential.helper" ] && [ -z "${!_last_val_var:-}" ]; then
+            if [ "$_n" -gt 0 ]; then
+                _LOKI_GIT_CONFIG_COUNT_HAD=1
+                _LOKI_GIT_CONFIG_COUNT_OLD="$_n"
+            fi
+            _LOKI_GIT_CRED_INDEX="$_n"
+        else
+            _LOKI_GIT_CONFIG_COUNT_HAD=1
+            _LOKI_GIT_CONFIG_COUNT_OLD="$GIT_CONFIG_COUNT"
+            _LOKI_GIT_CRED_INDEX="$GIT_CONFIG_COUNT"
+        fi
+    else
+        _LOKI_GIT_CRED_INDEX=0
+    fi
+    # Fixed for the process lifetime once captured, so restore-then-reapply
+    # (the trusted-call cycle) always re-exports the SAME sentinel rather than
+    # minting a new one that a caller mid-command could not have seen.
+    # Alphanumeric-only after the ghp_ prefix (no underscores): matches the
+    # real gh token shape and the existing token-redaction regex in
+    # autonomy/lib/proof_redact.py (gh[pousr]_[A-Za-z0-9]{20,}), so if this
+    # sentinel ever leaked into a proof/receipt artifact it would still be
+    # caught by the existing redaction filter rather than passing it by shape.
+    _LOKI_GH_SENTINEL="ghp_LOKIWITHHELDsentinel$$${RANDOM}${RANDOM}INVALID"
+}
+
+# Unconditionally (re-)export the withheld/scoped state. Never captures --
+# _loki_gh_capture must run first. Silent: callers that want the one-time
+# operator-facing log line print it themselves.
+_loki_gh_apply() {
+    export GH_TOKEN="$_LOKI_GH_SENTINEL" GITHUB_TOKEN="$_LOKI_GH_SENTINEL" \
+        GH_ENTERPRISE_TOKEN="$_LOKI_GH_SENTINEL" GITHUB_ENTERPRISE_TOKEN="$_LOKI_GH_SENTINEL"
+    if [ -z "$_LOKI_GH_CONFIG_SCOPED" ]; then
+        local _empty_cfg
+        _empty_cfg="$(mktemp -d "${TMPDIR:-/tmp}/loki-gh-config.XXXXXX" 2>/dev/null)" || _empty_cfg=""
+        [ -n "$_empty_cfg" ] && _LOKI_GH_CONFIG_SCOPED="$_empty_cfg"
+    fi
+    [ -n "$_LOKI_GH_CONFIG_SCOPED" ] && export GH_CONFIG_DIR="$_LOKI_GH_CONFIG_SCOPED"
+    export "GIT_CONFIG_KEY_${_LOKI_GIT_CRED_INDEX}=credential.helper"
+    export "GIT_CONFIG_VALUE_${_LOKI_GIT_CRED_INDEX}="
+    export GIT_CONFIG_COUNT=$((_LOKI_GIT_CRED_INDEX + 1))
+    _LOKI_GIT_CRED_SCOPED=1
+    # SSH sentinel (BACKLOG 149 round 3): no reachable SSH agent, and any
+    # ssh-transport git operation fails closed via GIT_SSH_COMMAND=false
+    # (env var, so it overrides any core.sshCommand -- see the header comment
+    # above _LOKI_WITHHELD_TOKENS for the git-docs citation).
+    unset SSH_AUTH_SOCK
+    export GIT_SSH_COMMAND=false
+    _LOKI_SSH_WITHHELD=1
+    if command -v gh >/dev/null 2>&1; then
+        # Repo read as data BEFORE the credentials come back; gh then runs
+        # from / (round 5: gh's own git calls must not load the agent's repo
+        # config while holding the real credentials).
+        gh() {
+            local _gh_repo
+            _gh_repo="$(_loki_trusted_repo)"
+            _loki_with_github_tokens _loki_run_neutral "$_gh_repo" command gh "$@"
+        }
+    fi
+}
 
+# Put back the REAL pre-withhold state around one trusted command. A no-op in
+# a run that inherited the sentinel: there is no real state to put back, and
+# the nested-run rule in _loki_gh_capture is to fail closed on every channel.
+_loki_gh_restore() {
+    [ -z "$_LOKI_GH_INHERITED" ] || return 0
+    _loki_restore_one_token GH_TOKEN "$_LOKI_GH_TOKEN_REAL_HAD" "$_LOKI_GH_TOKEN_REAL_VAL"
+    _loki_restore_one_token GITHUB_TOKEN "$_LOKI_GITHUB_TOKEN_REAL_HAD" "$_LOKI_GITHUB_TOKEN_REAL_VAL"
+    _loki_restore_one_token GH_ENTERPRISE_TOKEN "$_LOKI_GH_ENT_TOKEN_REAL_HAD" "$_LOKI_GH_ENT_TOKEN_REAL_VAL"
+    _loki_restore_one_token GITHUB_ENTERPRISE_TOKEN "$_LOKI_GITHUB_ENT_TOKEN_REAL_HAD" "$_LOKI_GITHUB_ENT_TOKEN_REAL_VAL"
+    if [ -n "$_LOKI_GH_CONFIG_DIR_HAD" ]; then
+        export GH_CONFIG_DIR="$_LOKI_GH_CONFIG_DIR_OLD"
+    else
+        unset GH_CONFIG_DIR
+    fi
+    if [ -n "$_LOKI_GIT_CONFIG_COUNT_HAD" ]; then
+        export GIT_CONFIG_COUNT="$_LOKI_GIT_CONFIG_COUNT_OLD"
+    else
+        unset GIT_CONFIG_COUNT
+    fi
+    unset "GIT_CONFIG_KEY_${_LOKI_GIT_CRED_INDEX}" "GIT_CONFIG_VALUE_${_LOKI_GIT_CRED_INDEX}"
+    # SSH sentinel restore: give the trusted command back the real SSH agent
+    # and ssh command, so Loki's own push/PR still works over an SSH origin.
+    _loki_restore_one_token SSH_AUTH_SOCK "$_LOKI_SSH_AUTH_SOCK_HAD" "$_LOKI_SSH_AUTH_SOCK_OLD"
+    _loki_restore_one_token GIT_SSH_COMMAND "$_LOKI_GIT_SSH_COMMAND_HAD" "$_LOKI_GIT_SSH_COMMAND_OLD"
+}
+
+_LOKI_GH_TRUSTED_DEPTH=0
+
+# Reentrancy: a trusted function (create_session_pr) calls `gh` directly one
+# or more times; since the gh() wrapper (_loki_gh_apply) IS
+# _loki_with_github_tokens, each of those calls re-enters this function while
+# the OUTER call is still in progress. Without depth tracking, the FIRST
+# nested `gh` call's own apply-on-exit would re-scope the environment before
+# the outer caller's second `gh` call (or any bare `git` call) runs, breaking
+# it silently -- caught in this session before landing: create_session_pr
+# calls `gh pr list` then `gh pr create`, and the nested apply between them
+# would have handed the second call sentineled/scoped state instead of real
+# credentials. Only the OUTERMOST call restores on entry and re-applies on
+# exit; a nested call finds the depth already > 0 and is a pure passthrough
+# (real credentials are already in place from the outer restore).
 _loki_with_github_tokens() {
-    local _v _rc=0
-    for _v in $_LOKI_WITHHELD_TOKENS; do export "${_v?}"; done
+    local _rc=0 _outermost=0
+    if [ "$_LOKI_GH_TRUSTED_DEPTH" -eq 0 ]; then
+        _outermost=1
+        if [ -n "$_LOKI_WITHHELD_TOKENS" ]; then
+            _loki_gh_restore
+        fi
+    fi
+    _LOKI_GH_TRUSTED_DEPTH=$((_LOKI_GH_TRUSTED_DEPTH + 1))
     "$@" || _rc=$?
-    for _v in $_LOKI_WITHHELD_TOKENS; do export -n "${_v?}"; done
+    _LOKI_GH_TRUSTED_DEPTH=$((_LOKI_GH_TRUSTED_DEPTH - 1))
+    if [ "$_outermost" -eq 1 ] && [ -n "$_LOKI_WITHHELD_TOKENS" ]; then
+        _loki_gh_apply
+    fi
+    return "$_rc"
+}
+
+#-------------------------------------------------------------------------------
+# BACKLOG 149 round 5: a credentialed git or gh process never loads the agent's
+# repo config.
+#
+# _loki_with_github_tokens hands the real credentials back for one command. If
+# that command is `git push` run inside the agent's working tree, git loads the
+# agent-writable repo config first: .git/hooks/pre-push, core.hooksPath,
+# core.sshCommand, a repo-local credential.helper, core.fsmonitor,
+# url.insteadOf/pushInsteadOf, include/includeIf. Two reviewers reproduced a
+# planted pre-push hook reading the real GH_TOKEN and SSH_AUTH_SOCK, and
+# `git credential fill` returning the operator's password. `-c
+# core.hooksPath=/dev/null` alone does not stop core.sshCommand, and a list of
+# per-key overrides would have to stay complete forever.
+#
+# So the credentialed step never runs with that config loaded:
+#   - push: read remote.origin.url as DATA (no credentials), accept only a
+#     github.com https/ssh URL, fetch the branch into a fresh Loki-owned repo
+#     (the fetch runs upload-pack in the agent repo WITHOUT credentials), then
+#     push from that repo with the credentials restored.
+#   - gh: run from / with GH_REPO set to the validated origin, so gh's own git
+#     calls find no repository. An explicit --repo/-R still overrides GH_REPO.
+# The operator's global/system git config still loads (it holds the real
+# credential helper); an agent that can write ~/.gitconfig is a same-user
+# filesystem residual, disclosed in the header above.
+#-------------------------------------------------------------------------------
+
+# Echo OWNER/REPO for a github.com origin URL, else fail. Accepted forms:
+# https://github.com/O/R[.git][/], git@github.com:O/R[.git][/],
+# ssh://git@github.com/O/R[.git][/], host matched case-insensitively. Anything
+# else (other hosts, SSH host aliases such as github.com-work, embedded
+# credentials, extra path segments, odd characters) is rejected;
+# _loki_origin_refusal says why.
+_loki_github_repo_from_url() {
+    local _u="${1:-}" _lc _pre _p
+    _lc="$(printf '%s' "$_u" | tr '[:upper:]' '[:lower:]')"
+    case "$_lc" in
+        https://github.com/*) _pre="https://github.com/" ;;
+        git@github.com:*) _pre="git@github.com:" ;;
+        ssh://git@github.com/*) _pre="ssh://git@github.com/" ;;
+        *) return 1 ;;
+    esac
+    _p="${_u:${#_pre}}"
+    _p="${_p%/}"
+    _p="${_p%.git}"
+    case "$_p" in
+        */*/* | /* | */ | */.* | .* | *..* | *[!A-Za-z0-9._/-]*) return 1 ;;
+        ?*/?*) printf '%s\n' "$_p" ;;
+        *) return 1 ;;
+    esac
+}
+
+# One line saying why an origin is refused. Never echoes the URL itself (it
+# may carry embedded credentials).
+_loki_origin_refusal() {
+    local _lc
+    _lc="$(printf '%s' "${1:-}" | tr '[:upper:]' '[:lower:]')"
+    case "$_lc" in
+        '') echo "this repository has no origin remote" ;;
+        *@github.com[!:/]*|*://github.com[!/]*|*@github.com[!:/]*:*)
+            echo "origin uses an SSH host alias or look-alike of github.com (for example github.com-work from ~/.ssh/config); Loki pushes only to a literal github.com origin, so the push never depends on agent-editable ssh config" ;;
+        *github.com*)
+            echo "origin names github.com but is not a plain https or ssh OWNER/REPO URL (embedded credentials, extra path segments or unusual characters are refused)" ;;
+        *)
+            echo "origin is not on github.com; Loki currently pushes only to github.com (GitHub Enterprise and GitLab are planned)" ;;
+    esac
+}
+
+# Origin pin (round 6, reviewer F1): the agent could otherwise repoint origin
+# at another github.com repository and have Loki push its branch there with
+# the operator's credentials. Loki never changes origin itself, so the value
+# recorded before the first iteration (possibly "no origin") is the only one
+# a trusted push accepts. Recorded once per process.
+_LOKI_ORIGIN_PINNED=""
+_LOKI_PINNED_ORIGIN=""
+_loki_pin_origin() {
+    [ -z "$_LOKI_ORIGIN_PINNED" ] || return 0
+    _LOKI_PINNED_ORIGIN="$(git -C "${TARGET_DIR:-.}" config --get remote.origin.url 2>/dev/null || true)"
+    _LOKI_ORIGIN_PINNED=1
+}
+
+# OWNER/REPO of TARGET_DIR's origin, read as data, or nothing.
+_loki_trusted_repo() {
+    _loki_github_repo_from_url "$(git -C "${TARGET_DIR:-.}" config --get remote.origin.url 2>/dev/null)" 2>/dev/null || true
+}
+
+# _loki_run_neutral <owner/repo|""> <cmd...>: run cmd from / so no repository
+# (and so no repo config) is discovered, with GH_REPO naming the repo for gh.
+# A subshell, so functions stay callable; callers pass `command gh` to reach
+# the binary.
+_loki_run_neutral() {
+    local _repo="$1"
+    shift
+    (
+        cd / || exit 1
+        unset GIT_DIR GIT_WORK_TREE
+        if [ -n "$_repo" ] && [ -z "${GH_REPO:-}" ]; then
+            export GH_REPO="$_repo"
+        fi
+        "$@"
+    )
+}
+
+# _loki_trusted_push <runner> <repo-dir> <branch>: push <branch> of the agent
+# repo to its github.com origin without loading the agent repo's config in
+# the credentialed process. <runner> is the credential re-grant wrapper
+# (_loki_with_github_tokens, or on_run_complete's timed _loki_net). The agent
+# repo's branch gets no upstream set (it did with `push -u`); nothing reads it.
+_loki_trusted_push() {
+    local _runner="$1" _dir="$2" _branch="$3" _url _tmp _rc=1
+    _dir="$(cd "$_dir" 2>/dev/null && pwd -P)" || return 1
+    git check-ref-format --branch "$_branch" >/dev/null 2>&1 || return 1
+    _url="$(git -C "$_dir" config --get remote.origin.url 2>/dev/null)" || _url=""
+    if ! _loki_github_repo_from_url "$_url" >/dev/null; then
+        log_warn "Not pushing branch '$_branch': $(_loki_origin_refusal "$_url")."
+        return 2
+    fi
+    if [ -n "$_LOKI_ORIGIN_PINNED" ] && [ "$_url" != "$_LOKI_PINNED_ORIGIN" ]; then
+        log_warn "Not pushing branch '$_branch': origin changed during the run (it was $(_loki_github_repo_from_url "$_LOKI_PINNED_ORIGIN" 2>/dev/null || echo "not a GitHub repository") when the run started). Loki does not push to a destination the agent could have chosen."
+        return 2
+    fi
+    _tmp="$(mktemp -d "${TMPDIR:-/tmp}/loki-push.XXXXXX")" || return 1
+    # --update-shallow: a shallow agent repo's history ends in shallow roots,
+    # which a plain fetch rejects while still exiting 0. The rev-parse makes a
+    # silently empty fetch fail here instead of at the push.
+    if git init -q --template= "$_tmp" >/dev/null 2>&1 \
+        && git -C "$_tmp" fetch -q --no-tags --update-shallow "$_dir" "+refs/heads/$_branch:refs/heads/$_branch" >/dev/null 2>&1 \
+        && git -C "$_tmp" rev-parse -q --verify "refs/heads/$_branch" >/dev/null 2>&1; then
+        _rc=0
+        # `-C "$_tmp"`: git starts repository discovery in the fresh repo, so
+        # the agent repo is never found, whatever the caller's cwd.
+        "$_runner" git -C "$_tmp" push -q "$_url" "refs/heads/$_branch:refs/heads/$_branch" || _rc=$?
+    fi
+    rm -rf "$_tmp"
     return "$_rc"
 }
 
 _loki_withhold_github_tokens() {
     local _v _held=""
+    # Before any provider runs, so the pin is the operator's origin, not one
+    # an agent set. Also under the opt-out: it guards the push destination.
+    _loki_pin_origin
     # Operator opt-out (exact value 1): keep the earlier behavior, where the
-    # agent inherits the token. That is a Rule of Two exposure, so say so.
+    # agent inherits the token and the real gh config. That is a Rule of Two
+    # exposure, so say so. No GH_CONFIG_DIR/credential.helper scoping under
+    # the opt-out either -- the point of this knob is the old, fully-inherited
+    # behavior.
     if [ "${LOKI_ALLOW_AGENT_GITHUB_TOKEN:-}" = "1" ]; then
         for _v in GH_TOKEN GITHUB_TOKEN GH_ENTERPRISE_TOKEN GITHUB_ENTERPRISE_TOKEN; do
             [ -n "${!_v:-}" ] && _held="${_held:+$_held }$_v"
@@ -5377,21 +5944,30 @@ _loki_withhold_github_tokens() {
         [ -z "$_held" ] || printf '%s\n' "WARNING: LOKI_ALLOW_AGENT_GITHUB_TOKEN=1: the agent session holds the GitHub token ($_held); an injected prompt can push with it (Rule of Two exposure)." >&2
         return 0
     fi
-    for _v in GH_TOKEN GITHUB_TOKEN GH_ENTERPRISE_TOKEN GITHUB_ENTERPRISE_TOKEN; do
-        [ -n "${!_v:-}" ] || continue
-        export -n "${_v?}"
-        case " $_LOKI_WITHHELD_TOKENS " in
-            *" $_v "*) ;;
-            *) _LOKI_WITHHELD_TOKENS="${_LOKI_WITHHELD_TOKENS:+$_LOKI_WITHHELD_TOKENS }$_v" ;;
-        esac
-    done
-    [ -n "$_LOKI_WITHHELD_TOKENS" ] || return 0
-    # Only when the binary exists, so `command -v gh` keeps meaning "gh is
-    # installed" for every caller that checks it.
-    if command -v gh >/dev/null 2>&1; then
-        gh() { _loki_with_github_tokens command gh "$@"; }
+    local _first_time=""
+    [ -n "$_LOKI_WITHHELD_TOKENS" ] || _first_time=1
+    # gh documents (`gh help environment`) that an env token "takes precedence
+    # over previously stored credentials", so a garbage-but-present value
+    # makes gh's own resolution (both `gh auth token` and `gh auth
+    # git-credential`, the latter reachable directly by git's
+    # credential.helper) return the garbage value instead of falling through
+    # to a keyring/hosts.yml lookup. GH_CONFIG_DIR stays scoped to a fresh
+    # empty dir (the plaintext-hosts.yml-read case). credential.helper is
+    # additionally reset to empty (gitcredentials(7)): this is git-invoked,
+    # not gh-mediated, so the sentinel does not reach a plain
+    # osxkeychain/libsecret helper on its own.
+    _loki_gh_capture
+    _loki_gh_apply
+    if [ -n "$_first_time" ]; then
+        if [ -n "$_LOKI_GH_INHERITED" ]; then
+            printf '%s\n' "WARNING: this run was started from inside an already-withheld Loki session (inherited Rule of Two sentinel). It has no real GitHub or SSH credentials to restore, so its own push and PR steps will fail closed. Start builds that need to push from a normal shell." >&2
+        else
+            log_info "Withheld from agent sessions (Rule of Two): $_LOKI_WITHHELD_TOKENS (sentineled, not merely unset), gh config store, git credential.helper, SSH agent (SSH_AUTH_SOCK unset, GIT_SSH_COMMAND=false). Loki's own push and PR steps still use the real credentials."
+        fi
+        if [ -n "$_LOKI_GIT_CONFIG_COUNT_UNSUPPORTED" ]; then
+            printf '%s\n' "WARNING: git < 2.31 detected -- GIT_CONFIG_COUNT/GIT_CONFIG_KEY/GIT_CONFIG_VALUE (used to reset credential.helper) are silently ignored on this git version. The git-invoked credential-helper bypass (BACKLOG 149 round 2) is NOT closed on this host; upgrade git to 2.31+ to close it. The GH_TOKEN-family sentinel, GH_CONFIG_DIR scoping, and the SSH_AUTH_SOCK/GIT_SSH_COMMAND withhold above are unaffected and still apply (GIT_SSH_COMMAND is a plain env var, not a GIT_CONFIG_* mechanism, so it needs no version floor)." >&2
+        fi
     fi
-    log_info "Withheld from agent sessions (Rule of Two): $_LOKI_WITHHELD_TOKENS. Loki's own push and PR steps still use it."
 }
 
 #===============================================================================
@@ -5462,11 +6038,16 @@ on_run_complete() {
     # The push and gh calls below are the trusted post-session step, so they
     # get the withheld GitHub token back (a plain `timeout 30 gh` would exec
     # the binary and bypass the gh() wrapper).
+    # Round 5: every call runs from / (_loki_run_neutral) with GH_REPO read as
+    # data first, so neither gh nor git loads the agent's repo config while
+    # holding the credentials; the push goes through _loki_trusted_push.
     _loki_net() {
+        local _net_repo
+        _net_repo="$(_loki_trusted_repo)"
         if command -v timeout >/dev/null 2>&1; then
-            _loki_with_github_tokens timeout 30 "$@"
+            _loki_with_github_tokens _loki_run_neutral "$_net_repo" timeout 30 "$@"
         else
-            _loki_with_github_tokens "$@"
+            _loki_with_github_tokens _loki_run_neutral "$_net_repo" "$@"
         fi
     }
     # Require gh + auth.
@@ -5492,14 +6073,25 @@ on_run_complete() {
     log_info "LOKI_DELEGATE_PR=1: opening a local pull request for branch '$branch'..."
     # Push, then create. Non-interactive (no tty in --bg). Best-effort, each
     # network call bounded by the timeout guard above.
-    (cd "${TARGET_DIR:-.}" && _loki_net git push -u origin "$branch") >/dev/null 2>&1 || true
+    # A refused or failed push is reported (the refusal names its reason on
+    # stderr) and ends the delegate step: there is nothing to open a PR from.
+    local _push_rc=0
+    _loki_trusted_push _loki_net "${TARGET_DIR:-.}" "$branch" >/dev/null || _push_rc=$?
+    if [ "$_push_rc" -ne 0 ]; then
+        [ "$_push_rc" -eq 2 ] || log_warn "LOKI_DELEGATE_PR=1: pushing branch '$branch' failed; not opening a pull request."
+        return 0
+    fi
+    # Explicit --repo on every gh call (not only GH_REPO): the repo the push
+    # just validated, so no gh subcommand can fall back to cwd detection.
+    local _pr_repo
+    _pr_repo="$(_loki_trusted_repo)"
     local pr_title
     pr_title="Loki Mode: ${branch}"
     local pr_url=""
     # ENT-4 (idempotent PR): reuse an existing OPEN PR for this head instead of
     # attempting a second create on a platform retry / resume.
     local existing_pr
-    existing_pr="$( (cd "${TARGET_DIR:-.}" && _loki_net gh pr list --head "$branch" --state open --json url --jq '.[0].url') 2>/dev/null || true )"
+    existing_pr="$( (cd "${TARGET_DIR:-.}" && _loki_net gh pr list --repo "$_pr_repo" --head "$branch" --state open --json url --jq '.[0].url') 2>/dev/null || true )"
     if [ -n "$existing_pr" ]; then
         _LOKI_DELEGATE_PR_URL="$existing_pr"
         export _LOKI_DELEGATE_PR_URL
@@ -5530,7 +6122,7 @@ ${_del_receipt}"
             fi
         fi
     fi
-    pr_url="$( (cd "${TARGET_DIR:-.}" && _loki_net gh pr create --title "$pr_title" --body "$_del_body" --head "$branch") 2>/dev/null || true )"
+    pr_url="$( (cd "${TARGET_DIR:-.}" && _loki_net gh pr create --repo "$_pr_repo" --title "$pr_title" --body "$_del_body" --head "$branch") 2>/dev/null || true )"
     if [ -n "$pr_url" ]; then
         # Export so build_completion_summary folds the url into the summary.
         _LOKI_DELEGATE_PR_URL="$pr_url"
@@ -10611,10 +11203,18 @@ create_session_pr() {
 
     # OPT-IN (LOKI_AUTO_PR=1): legacy auto push + PR, now with the correct base.
     log_info "Pushing agent branch: $branch_name"
-    if ! git push -u origin "$branch_name" 2>/dev/null; then
-        log_warn "Failed to push agent branch: $branch_name"
+    # Round 5: never a credentialed `git push` inside the agent's repo (its
+    # config -- hooks, sshCommand, credential.helper -- would run holding the
+    # operator's credentials). See _loki_trusted_push.
+    # stderr is left visible: a refusal names its reason there.
+    local _push_rc=0
+    _loki_trusted_push _loki_with_github_tokens . "$branch_name" >/dev/null || _push_rc=$?
+    if [ "$_push_rc" -ne 0 ]; then
+        [ "$_push_rc" -eq 2 ] || log_warn "Failed to push agent branch: $branch_name"
         return 1
     fi
+    local _pr_repo
+    _pr_repo="$(_loki_trusted_repo)"
 
     # Create PR if gh CLI is available
     if command -v gh &>/dev/null; then
@@ -10626,7 +11226,7 @@ create_session_pr() {
         # guarantee explicit and the log honest: if an OPEN PR already exists for
         # this head, reuse its URL instead of attempting a second create.
         local existing_pr
-        existing_pr=$(gh pr list --head "$branch_name" --state open --json url --jq '.[0].url' 2>/dev/null || true)
+        existing_pr=$(gh pr list --repo "$_pr_repo" --head "$branch_name" --state open --json url --jq '.[0].url' 2>/dev/null || true)
         if [ -n "$existing_pr" ]; then
             log_info "PR already exists for branch $branch_name: $existing_pr (skipping create)"
             audit_log "PR_EXISTS" "branch=$branch_name,url=$existing_pr"
@@ -10667,6 +11267,7 @@ ${_auto_receipt}"
             fi
         fi
         pr_url=$(gh pr create \
+            --repo "$_pr_repo" \
             --title "Loki Mode: Agent session changes ($branch_name)" \
             --body "$_auto_body" \
             --base "$base" \
@@ -18588,21 +19189,10 @@ start_dashboard() {
         log_info "Dashboard: ${CYAN}${url_scheme}://127.0.0.1:$DASHBOARD_PORT/${NC}"
 
         # Auto-open the dashboard in the browser, but ONLY for an interactive
-        # foreground session. Gated on: a TTY on stdout ([ -t 1 ]), not
-        # background/detached mode, and not explicitly opted out via
-        # LOKI_NO_AUTO_OPEN=1. This keeps CI, --detach, SSH-no-TTY, and piped
-        # runs from spawning a browser. Cross-platform: open / xdg-open / start.
-        if [ -t 1 ] && [ "${BACKGROUND_MODE:-false}" != "true" ] && [ "${LOKI_NO_AUTO_OPEN:-0}" != "1" ]; then
-            local _dash_url="${url_scheme}://127.0.0.1:$DASHBOARD_PORT/"
-            if command -v open >/dev/null 2>&1; then
-                open "$_dash_url" 2>/dev/null || true
-            elif command -v xdg-open >/dev/null 2>&1; then
-                xdg-open "$_dash_url" 2>/dev/null || true
-            elif command -v cmd.exe >/dev/null 2>&1; then
-                # Windows (Git Bash/WSL): `start` is a cmd builtin, not on PATH,
-                # so invoke it via cmd.exe. The empty "" is start's title arg.
-                cmd.exe /c start "" "$_dash_url" 2>/dev/null || true
-            fi
+        # foreground session. loki_open_url (lib/browser-open.sh) refuses on
+        # no TTY, CI, test runners, LOKI_NO_BROWSER=1 or LOKI_NO_AUTO_OPEN=1.
+        if [ "${BACKGROUND_MODE:-false}" != "true" ]; then
+            loki_open_url "${url_scheme}://127.0.0.1:$DASHBOARD_PORT/" 2>/dev/null || true
         fi
         return 0
     else
@@ -27498,6 +28088,15 @@ _loki_session_exit_cleanup() {
     # completion-path reap for the rest of the run.
     _loki_remove_pgid_file
     _loki_remove_temp_self_copy
+    # BACKLOG 149: remove the per-run empty GH_CONFIG_DIR scoped by
+    # _loki_withhold_github_tokens. Same subshell guard as
+    # _loki_remove_pgid_file -- a subshell's EXIT trap must not delete the
+    # live parent's directory ($$ is stable across subshells, BASHPID is not).
+    if [ -n "${_LOKI_GH_CONFIG_SCOPED:-}" ] && [ "${BASHPID:-$$}" = "$$" ]; then
+        case "$_LOKI_GH_CONFIG_SCOPED" in
+            "${TMPDIR:-/tmp}"/loki-gh-config.*) rm -rf "$_LOKI_GH_CONFIG_SCOPED" 2>/dev/null || true ;;
+        esac
+    fi
     return "$exit_code"
 }
 
@@ -27953,10 +28552,19 @@ main() {
 
     # Handle background mode
     if [ "$BACKGROUND_MODE" = "true" ]; then
-        # The relaunched runner withholds the tokens itself; it needs them in
-        # its environment to do so. This process exits right after launching.
-        local _bg_tok
-        for _bg_tok in $_LOKI_WITHHELD_TOKENS; do export "${_bg_tok?}"; done
+        # The relaunched runner withholds the tokens itself; it needs the REAL
+        # pre-withhold state in its inherited environment to capture correctly,
+        # not this process's own scoped/sentineled state (BACKLOG 149 round 2:
+        # if the child inherited THIS process's scoped GH_CONFIG_DIR/
+        # GIT_CONFIG_COUNT as if they were the operator's originals, its own
+        # trusted gh/git calls would run with credential.helper reset and
+        # GH_CONFIG_DIR pointed at a directory this process's EXIT trap deletes
+        # seconds later). Full restore, not just the 4 token vars, exactly like
+        # the pre-trusted-call restore. This process exits right after
+        # launching, so nothing here needs to re-apply the withhold afterward.
+        if [ -n "$_LOKI_WITHHELD_TOKENS" ]; then
+            _loki_gh_restore
+        fi
         # Initialize .loki directory first
         mkdir -p .loki/logs
 
@@ -28592,9 +29200,12 @@ main() {
     # then advise the user how to open a PR. Both are no-ops when no agent branch
     # was set up (LOKI_BRANCH_PROTECTION=false) or nothing changed.
     commit_session_changes
-    # Trusted post-session step: it gets the GitHub token main() withheld from
-    # agent sessions (its push may authenticate through the env token).
-    _loki_with_github_tokens create_session_pr
+    # Trusted post-session step. NOT wrapped in _loki_with_github_tokens as a
+    # whole (round 5): that ran every git call inside it (rev-list, merge-base,
+    # push) with the real credentials AND the agent's repo config loaded. Its
+    # push (_loki_trusted_push) and gh calls (gh wrapper) each re-grant the
+    # credentials themselves, outside the agent's repo.
+    create_session_pr
     audit_agent_action "session_stop" "Session ended" "result=$result,iterations=$ITERATION_COUNT"
 
     # The first terminal summary is written before session changes are committed.