{"version":"2.1.202","anchor":"agent-proxy-governed-git-and-github-gh-shim","canonical_anchor":"agent-proxy-governed-git-and-github-gh-shim","heading":"Agent Proxy: Governed Git and GitHub (gh) Shim","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.202\/e\/agent-proxy-governed-git-and-github-gh-shim","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.202","markdown":"### Agent Proxy: Governed Git and GitHub (gh) Shim\n\nBackground agents running through the agent proxy now get automatic git and GitHub CLI (`gh`) authentication wired in per-session.\n\n**Details**\n\n- On startup, the proxy writes a per-session git config that routes `github.com` traffic through the relay, sets the CA bundle, and injects a dummy token guard so accidental raw requests to GitHub fail fast\n- If `gh` is on `PATH`, the proxy also writes a per-session `gh` wrapper script (shim) in a temp directory and prepends it to `PATH` so `gh` commands also route through the relay\n- Supported tokens: `GH_TOKEN`, `GITHUB_TOKEN`, `GH_ENTERPRISE_TOKEN`, `GITHUB_ENTERPRISE_TOKEN`\n- The relay routing entry is appended to the global git config file named by `$GIT_CONFIG_GLOBAL` (refuses if the variable is unset to avoid writing a shared config)\n- Skip conditions are logged: CA bundle path contains newline\/quote, `gh` not on PATH, path contains a single quote\n- The permission pattern for `gh` operations has been expanded to include `prs+comment`, `releases+upload`, and `repos+fork`\n- The proxy status message now clearly distinguishes between git-only and git+gh modes\n\n**Evidence**\n\nGit proxy config writer (search for `\"[agent-proxy] governed git: relay routing for\"` and `\"governed-git (auto-generated; do not edit)\"`)"}