From 89978dca452262a2dd49ef8717b1c1c7b09092af Mon Sep 17 00:00:00 2001
From: decider <decider@users.noreply.github.com>
Date: Sun, 24 May 2026 14:24:46 -0400
Subject: [PATCH] secret-scrub: scheduled runner also audits .git/config
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The scheduled launchd/systemd timer now runs TWO passes per fire on
the configured repos:

  1. --working-trees  — redact secrets in uncommitted/untracked files
  2. --git-configs    — REPORT embedded .git/config credentials

Pass 2 is detect-only: a background job silently rewriting git auth
(stripping a token → credential-helper fallback) would be a surprising
side effect, so it only logs the finding and leaves the deliberate
--fix to the operator. rc=1 from the detect pass is swallowed
('|| true') so a found-credential doesn't mark the whole cron job
failed — the log report is the signal.

Effect: once the working-trees timer is installed, ALL four leak
pathways are continuously monitored from one job, not just three.
Reuses the existing repo list (~/.config/secret-scrub/working-trees.txt);
no new config. Bash 3.2 compatible (exec → sequential calls).
---
 secret-scrub/scrub-working-trees-runner.sh | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/secret-scrub/scrub-working-trees-runner.sh b/secret-scrub/scrub-working-trees-runner.sh
index d9daeb9..86ee520 100755
--- a/secret-scrub/scrub-working-trees-runner.sh
+++ b/secret-scrub/scrub-working-trees-runner.sh
@@ -34,4 +34,17 @@ if [ "${#paths[@]}" = "0" ]; then
   exit 0
 fi
 
-exec /usr/bin/env python3 "$SCRUB_PY" --working-trees "${paths[@]}"
+# Pass 1 — working-tree files (uncommitted/untracked). Redacts in place.
+/usr/bin/env python3 "$SCRUB_PY" --working-trees "${paths[@]}"
+
+# Pass 2 — .git/config embedded credentials (the fourth leak pathway).
+# DETECT-ONLY here: auto-stripping a token from a background job would
+# silently change git's auth behavior (URL → tokenless → credential
+# helper), which could surprise the user mid-work. So we only REPORT;
+# findings land in this job's log and the operator runs
+# `scrub.py --git-configs <path> --fix` deliberately. A non-zero exit
+# (rc=1 = "credential found") must NOT mark the whole cron job failed —
+# the report in the log is the signal.
+/usr/bin/env python3 "$SCRUB_PY" --git-configs "${paths[@]}" || true
+
+exit 0