Gandalf the Greybeard (PE)
5f3f0ab94d
Contamination class: a stale GH_CONFIG_DIR inherited from a prior session or a different agent's workspace caused generate-token.sh to write .gh-token into a foreign workspace, silently granting that agent's gh config access to the wrong token. Three hardening changes: 1. agent-setup/scripts/setup.sh — before deriving GH_CONFIG_DIR from AGENT_HOME, warn and unset any inherited value that points outside AGENT_HOME. This prevents the contaminated value from leaking into the derived path or the dotfile. 2. agent-setup/SKILL.md — correct the sourcing example from `source ~/.env` to `source "$AGENT_HOME/.env"` so the dotfile is sourced from the documented location (setup.sh writes to $AGENT_HOME/.env, not ~/ which may differ). 3. github-app-token/scripts/generate-token.sh — (a) add a hard die() guard that refuses to write the token when GH_CONFIG_DIR is outside AGENT_HOME; (b) pin GH_CONFIG_DIR="$GH_TOKEN_DIR" on the gh auth login invocation so it cannot fall back to any inherited config dir. Verified: - bash -n passes on both modified scripts - With GH_CONFIG_DIR=/tmp/someone-elses/.github AGENT_HOME=/tmp/me, setup.sh warns + overrides; generate-token.sh dies before writing. - With GH_CONFIG_DIR unset and a valid AGENT_HOME, behaviour is unchanged (token lands in $AGENT_HOME/.github). Co-Authored-By: Paperclip <noreply@paperclip.ing>
39 lines
1.2 KiB
Bash
Executable File
39 lines
1.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
die() { echo "ERROR: $*" >&2; exit 1; }
|
|
|
|
[[ -z "${AGENT_HOME:-}" ]] && die "AGENT_HOME is not set"
|
|
|
|
# Validate: never accept an inherited GH_CONFIG_DIR that points outside AGENT_HOME
|
|
if [[ -n "${GH_CONFIG_DIR:-}" && "$GH_CONFIG_DIR" != "$AGENT_HOME"* ]]; then
|
|
echo "WARN: Inherited GH_CONFIG_DIR '$GH_CONFIG_DIR' is outside AGENT_HOME. Overriding." >&2
|
|
unset GH_CONFIG_DIR
|
|
fi
|
|
|
|
# Derive GH_CONFIG_DIR — gh stores config at ~/.config/gh by default,
|
|
# so we mirror that structure under AGENT_HOME
|
|
export GH_CONFIG_DIR="$AGENT_HOME/.github"
|
|
|
|
mkdir -p "$AGENT_HOME"
|
|
_ENV_FILE="$AGENT_HOME/.env"
|
|
|
|
# If .env exists, source it first so we preserve existing variables
|
|
if [[ -f "$_ENV_FILE" ]]; then
|
|
set -a
|
|
source "$_ENV_FILE"
|
|
set +a
|
|
fi
|
|
|
|
# Update or add GH_CONFIG_DIR export
|
|
if grep -q '^export GH_CONFIG_DIR=' "$_ENV_FILE" 2>/dev/null; then
|
|
# Replace existing value in place
|
|
sed -i.bak "s|^export GH_CONFIG_DIR=.*|export GH_CONFIG_DIR=\"$GH_CONFIG_DIR\"|" "$_ENV_FILE"
|
|
rm -f "$_ENV_FILE.bak"
|
|
else
|
|
# Append new export
|
|
printf 'export GH_CONFIG_DIR="%s"\n' "$GH_CONFIG_DIR" >> "$_ENV_FILE"
|
|
fi
|
|
|
|
echo "GH_CONFIG_DIR set to $GH_CONFIG_DIR"
|