Background agents running through the agent proxy now get automatic git and GitHub CLI (gh) authentication wired in per-session.
Details
- On startup, the proxy writes a per-session git config that routes
github.comtraffic through the relay, sets the CA bundle, and injects a dummy token guard so accidental raw requests to GitHub fail fast - If
ghis onPATH, the proxy also writes a per-sessionghwrapper script (shim) in a temp directory and prepends it toPATHsoghcommands also route through the relay - Supported tokens:
GH_TOKEN,GITHUB_TOKEN,GH_ENTERPRISE_TOKEN,GITHUB_ENTERPRISE_TOKEN - The relay routing entry is appended to the global git config file named by
$GIT_CONFIG_GLOBAL(refuses if the variable is unset to avoid writing a shared config) - Skip conditions are logged: CA bundle path contains newline/quote,
ghnot on PATH, path contains a single quote - The permission pattern for
ghoperations has been expanded to includeprs+comment,releases+upload, andrepos+fork - The proxy status message now clearly distinguishes between git-only and git+gh modes
Evidence
Git proxy config writer (search for "[agent-proxy] governed git: relay routing for" and "governed-git (auto-generated; do not edit)")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.