scaffold + agent new: mirror agents#1513's OpenShell 0.1 credential declarations for github-ro

[waynesun09]

Current shape

fullsend agent new copies providers and profiles from the scaffold embed (internal/scaffold/fullsend-repo/{providers,profiles}/, last changed in #7229). These are also the files per-repo CI layers in. For github-ro:

• providers/github-ro.yaml: only name and type, with no credentials:
• profiles/fullsend-github-ro.yaml: no credentials: block and no graphql endpoint
• internal/agentnew/render.go buildHarness() puts GH_TOKEN: ${GH_TOKEN} in env.sandbox

Shape in fullsend-ai/agents (since fullsend-ai/agents#1513)

• providers/github-ro.yaml: credentials: { GH_TOKEN: "${GH_TOKEN}" }
• profiles/fullsend-github-ro.yaml: credentials: [{ name: api_token, env_vars: [GH_TOKEN], required: true }], plus an api.github.com graphql endpoint (path: /graphql, read-only)

Impact

This affects every per-repo install, plus everything agent new generates.

It is unproven either way whether the current scaffold shape is invalid on OpenShell 0.1.2: main pins 0.1.2 and ships it. So for now this is consistency and hardening: a declared credential, which the sandbox sees as a placeholder, versus a raw token in the sandbox environment.

Ask

Decide whether the scaffold should adopt the declared-credential shape. If yes, mirror it in the generator (drop GH_TOKEN from the generated env.sandbox if the provider supplies it) and update the internal/agentnew golden files.

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 12:39 AM UTC · Completed 12:44 AM UTC

Commit: 114478f · View workflow run →

Runtime: claude · Model: sonnet → claude-sonnet-5 · Effort: high · Cost: $0.68

[fullsend-ai-triage]

Checked this against the repo directly: internal/scaffold/fullsend-repo/providers/github-ro.yaml and profiles/fullsend-github-ro.yaml have no credentials: block today, and buildHarness() in internal/agentnew/render.go does write the raw GH_TOKEN value into every generated harness's env.sandbox, matching the issue's description exactly.

On the open "Ask" — whether the scaffold should adopt the declared-credential shape — this repo already has precedent for it: the scaffold's own fullsend-openai.yaml profile already uses a credentials: block, and fullsend currently pins OpenShell 0.1.2. Adopting the same shape for github-ro is consistent with that existing convention rather than a new design call, so this is ready to implement without further input.

Two related items worth noting:

• PR fix(#7014): add GraphQL endpoint to scaffold GitHub RO profile #7016 is open and adds the missing GraphQL endpoint to this same profile file for issue Scaffold fullsend-github-ro profile lacks the GraphQL endpoint the fleet profile has; generated agents fail on gh --json #7014 — that's a narrower fix for one of the bullets under "Current shape" here, but doesn't touch credential declarations or the generator, so it doesn't resolve this issue. Worth sequencing around to avoid a merge conflict on the same file.
• Issue sandbox: deliver GitHub credentials via OpenShell provider so the token never enters the sandbox #2297 tracks the broader goal of never letting the real GitHub token enter the sandbox at all. This issue is a concrete, scoped step in that direction rather than a duplicate of it.

See the proposed test case in the triage summary for how to pin the fix.

---

Labels: Matches the labeling pattern used on related OpenShell scaffold/credential issues (#2297, #7268, #7014): security-relevant sandbox-credential hardening touching the scaffold and harness generator.

---

Next steps:

• /fs-code — agent creates a PR to implement this issue
• /fs-code <your instruction> — agent implements with your specific guidance

[waynesun09]

One more generator-side gap to fold in here, found while aligning the examples/link-check reference agent (fullsend-ai/agents#1167):

agent new puts GH_TOKEN: ${GH_TOKEN} in the generated harness's env.sandbox. Every fleet harness on agents main sets GH_TOKEN only in env.runner, and lets the github-ro provider inject a placeholder into the sandbox. Once the provider declares GH_TOKEN (the agents#1513 shape this issue proposes), the generated env.sandbox entry would also give the sandbox the raw token, which defeats the placeholder model.

So the fix here should cover both:

• the provider/profile credential declarations
• moving GH_TOKEN from env.sandbox to env.runner in buildHarness, with the golden files updated