From d3f1987a051c8592ded99e5654dfd58c394835e8 Mon Sep 17 00:00:00 2001 From: Teknium <127238744+teknium1@users.noreply.github.com> Date: Tue, 31 Mar 2026 12:48:30 -0700 Subject: [PATCH] fix(security): add .config/gh to read protection for @file references (#4327) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Follow-up to PR #4305 — .config/gh was added to the write-deny list but missed from _SENSITIVE_HOME_DIRS, leaving GitHub CLI OAuth tokens exposed via @file:~/.config/gh/hosts.yml context injection. --- agent/context_references.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/agent/context_references.py b/agent/context_references.py index d0985605d..8222dc33a 100644 --- a/agent/context_references.py +++ b/agent/context_references.py @@ -17,7 +17,7 @@ REFERENCE_PATTERN = re.compile( r"(?diff|staged)\b|(?Pfile|folder|git|url):(?P\S+))" ) TRAILING_PUNCTUATION = ",.;!?" -_SENSITIVE_HOME_DIRS = (".ssh", ".aws", ".gnupg", ".kube", ".docker", ".azure") +_SENSITIVE_HOME_DIRS = (".ssh", ".aws", ".gnupg", ".kube", ".docker", ".azure", ".config/gh") _SENSITIVE_HERMES_DIRS = (Path("skills") / ".hub",) _SENSITIVE_HOME_FILES = ( Path(".ssh") / "authorized_keys",