Skip to content

Send installation token to api.github.com and raw.githubusercontent.com#2562

Merged
hiroshinishio merged 1 commit intomainfrom
wes
Apr 20, 2026
Merged

Send installation token to api.github.com and raw.githubusercontent.com#2562
hiroshinishio merged 1 commit intomainfrom
wes

Conversation

@hiroshinishio
Copy link
Copy Markdown
Collaborator

No description provided.

Sentry AGENT-364/363/23G (web_fetch) and AGENT-35Y/35X (curl) fired on
404s fetching private repo content at a specific SHA. The clone is
shallow (--depth 1) so the agent can't reach arbitrary historical
commits locally; it legitimately had to go out to GitHub. Both http
helpers were sending plain requests with no auth, so the private repo
returned 404.

New github_auth_headers helper inspects the URL host and returns a
Bearer header for api.github.com and raw.githubusercontent.com when a
token is present in base_args. Wired into both curl and web_fetch.
Tests cover host allowlist, missing token, invalid URL, and a
non-github host to guarantee the token is not leaked outward. Also
rewrote pre-existing partial in/not-in assertions in the touched test
files to exact == equality per CLAUDE.md.
@hiroshinishio hiroshinishio self-assigned this Apr 20, 2026
@hiroshinishio hiroshinishio merged commit 75a3533 into main Apr 20, 2026
1 check passed
@hiroshinishio hiroshinishio deleted the wes branch April 20, 2026 04:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant