fix(security): redact main-governance child token diagnostics

scripts/main-governance-audit.mjs

@@ -24,23 +24,47 @@ function bound(value, limit = MAX_ERROR_CHARS) {
   return text.length <= limit ? text : `${text.slice(0, limit)}…`;
 }
 
+export function redactSensitiveValue(value, sensitiveValues = []) {
+  let redacted = String(value ?? "");
+  for (const sensitiveValue of sensitiveValues) {
+    if (typeof sensitiveValue !== "string" || sensitiveValue.length === 0) {
+      continue;
+    }
+    redacted = redacted.split(sensitiveValue).join("[REDACTED]");
+  }
+  return redacted;
+}
+
+export function createGhSubprocessEnvironment(sourceEnvironment = process.env) {
+  const childEnvironment = {
+    GH_HOST: "github.com",
+    NO_COLOR: "1",
+  };
+  if (typeof sourceEnvironment.PATH === "string" && sourceEnvironment.PATH.length > 0) {
+    childEnvironment.PATH = sourceEnvironment.PATH;
+  }
+  if (typeof sourceEnvironment.GH_TOKEN === "string" && sourceEnvironment.GH_TOKEN.length > 0) {
+    childEnvironment.GH_TOKEN = sourceEnvironment.GH_TOKEN;
+  }
+  return childEnvironment;
+}
+
 function runGh(args) {
+  const childEnvironment = createGhSubprocessEnvironment();
   const completed = spawnSync("gh", ["api", ...githubApiHeaders, ...args], {
     encoding: "utf8",
     maxBuffer: MAX_GH_OUTPUT_BYTES,
     timeout: MAX_GH_REQUEST_MILLISECONDS,
     shell: false,
-    env: {
-      PATH: process.env.PATH,
-      GH_TOKEN: process.env.GH_TOKEN,
-      GH_HOST: "github.com",
-    },
+    env: childEnvironment,
   });
   if (completed.error) {
-    throw new Error(`GitHub CLI could not complete: ${bound(completed.error.message)}`);
+    const detail = redactSensitiveValue(completed.error.message, [childEnvironment.GH_TOKEN]);
+    throw new Error(`GitHub CLI could not complete: ${bound(detail)}`);
   }
   if (completed.status !== 0) {
-    const detail = completed.stderr || completed.stdout || `exit ${completed.status}`;
+    const rawDetail = completed.stderr || completed.stdout || `exit ${completed.status}`;
+    const detail = redactSensitiveValue(rawDetail, [childEnvironment.GH_TOKEN]);
     throw new Error(`GitHub CLI failed: ${bound(detail)}`);
   }
   return completed.stdout.trim();

test/main-governance-audit-script.test.ts

@@ -1,6 +1,10 @@
 import { readFileSync } from "node:fs";
 import { describe, expect, it } from "vitest";
-import { flattenRulePages } from "../scripts/main-governance-audit.mjs";
+import {
+  createGhSubprocessEnvironment,
+  flattenRulePages,
+  redactSensitiveValue,
+} from "../scripts/main-governance-audit.mjs";
 
 describe("main governance audit GitHub adapter", () => {
   it("flattens every active-rules response page", () => {
@@ -23,18 +27,55 @@ describe("main governance audit GitHub adapter", () => {
     );
   });
 
+  it("passes only the explicit read-only GitHub CLI contract to the audit subprocess", () => {
+    const childEnvironment = createGhSubprocessEnvironment({
+      PATH: "/usr/bin:/bin",
+      GH_TOKEN: "read-only-github-token",
+      GH_HOST: "evil.example",
+      NO_COLOR: "0",
+      GITHUB_TOKEN: "must-not-cross",
+      NVIDIA_NIM_API_KEY: "must-not-cross",
+      NOEMA_MAINTAINER_APP_PRIVATE_KEY: "must-not-cross",
+      NOEMA_REVIEWER_APP_PRIVATE_KEY: "must-not-cross",
+      CLOUDFLARE_API_TOKEN: "must-not-cross",
+      HOME: "/tmp/ambient-home",
+      NODE_OPTIONS: "--require /tmp/preload.cjs",
+      HTTPS_PROXY: "https://proxy.invalid",
+    });
+
+    expect(childEnvironment).toEqual({
+      PATH: "/usr/bin:/bin",
+      GH_TOKEN: "read-only-github-token",
+      GH_HOST: "github.com",
+      NO_COLOR: "1",
+    });
+  });
+
+  it("redacts the delegated GitHub token before child diagnostics can be retained", () => {
+    const token = "read-only-github-token";
+    const diagnostic = `gh failed with ${token}; retry also exposed ${token}`;
+
+    expect(redactSensitiveValue(diagnostic, [token])).toBe(
+      "gh failed with [REDACTED]; retry also exposed [REDACTED]",
+    );
+    expect(redactSensitiveValue(diagnostic, ["", null, undefined, token])).not.toContain(token);
+    expect(redactSensitiveValue("safe diagnostic", [])).toBe("safe diagnostic");
+  });
+
   it("uses version-pinned bounded shell-free pagination for the live main rules endpoint", () => {
     const script = readFileSync("scripts/main-governance-audit.mjs", "utf8");
 
     expect(script).toContain('spawnSync("gh", ["api", ...githubApiHeaders, ...args]');
     expect(script).toContain("shell: false");
+    expect(script).toContain("env: childEnvironment");
+    expect(script).not.toContain("env: process.env");
     expect(script).toContain("MAX_GH_OUTPUT_BYTES");
     expect(script).toContain("MAX_GH_REQUEST_MILLISECONDS");
     expect(script).toContain("timeout: MAX_GH_REQUEST_MILLISECONDS");
     expect(script).toContain('Accept: application/vnd.github+json');
     expect(script).toContain('X-GitHub-Api-Version: 2022-11-28');
     expect(script).toContain('GH_HOST: "github.com"');
-    expect(script).toContain("GH_TOKEN: process.env.GH_TOKEN");
+    expect(script).toContain("createGhSubprocessEnvironment");
     expect(script).toContain('["--paginate", "--slurp", endpoint]');
     expect(script).toContain("rules/branches/main?per_page=100");
     expect(script).toContain("evaluateMainGovernanceRules");
@@ -51,6 +92,10 @@ describe("main governance audit GitHub adapter", () => {
     expect(script).toContain('appendOutput("governance_report_path", absoluteReportPath)');
     expect(script).toContain("MAX_ERROR_CHARS");
     expect(script).toContain('.replace(/[\\u0000-\\u001f\\u007f]/g, "")');
+    expect(script).toContain(
+      "redactSensitiveValue(completed.error.message, [childEnvironment.GH_TOKEN])",
+    );
+    expect(script).toContain("redactSensitiveValue(rawDetail, [childEnvironment.GH_TOKEN])");
     expect(script).not.toContain("console.log(process.env.GH_TOKEN");
     expect(script).not.toContain("JSON.stringify(process.env");
   });