fix: harden token security, add guardrails, fix 0-test loop#19
Merged
Conversation
Security: - Strip credentials from .git/config after clone so Claude subprocess cannot read the token from the remote URL - Re-inject credentials only during push, strip immediately after - Sanitize git error messages in commitAndPush to prevent token leaks - Use minimal env (PATH + HOME + GH_TOKEN) for gh subprocess instead of spreading all process.env vars Guardrails: - Add hard constraints to system prompt: never modify test files, package manifests, or lock files unless task explicitly requires it - Documentation-only tasks restricted to documentation files only Bug fixes: - Treat 0 tests collected as pass (failed=0 && errors=0) instead of failure, preventing 10 wasted loops on README-only changes - Sanitize Telegram <> formatting delimiters from task text before use in prompts, PR body, and commit messages - Pass github_token through to commitAndPush for authenticated push Bot deployment: - Add bot Dockerfile, fly.toml, and .env.example - Add worker .env.example Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.git/configafter clone so Claude subprocess cannot access itcommitAndPush()to prevent token leaks in Supabase/logsghsubprocess (was spreading all process.env)<>delimiters from task textTest plan
🤖 Generated with Claude Code