fix(agent): honor the logout sentinel in every token consumer

Address review findings on the emptied-env-file logout:
- list_repos built its gh env with a truthiness check, so an empty (logged-out)
  token fell back to the raw process env and could enumerate the previous
  actor's private repos. Clear both token vars on a managed logout; only an
  undefined (unmanaged) token inherits the process env.
- fetchGhLogin memoized the login across actor transitions, so after a rebind
  attribution used the previous actor's login. Key the cache on the live token.
- readGithubTokenFromSandboxEnvFile treated every read error as an unmanaged
  sandbox; a present-but-unreadable file during a transition then resurrected
  the frozen process token. Only ENOENT falls back; other errors fail closed.

Author: VojtechBartos

packages/agent/src/adapters/local-tools/tools/list-repos.ts

@@ -60,8 +60,16 @@ export const listReposTool = defineLocalTool({
     );
 
     try {
+      // An empty token is a managed logout, not "no preference": clear both token
+      // vars so gh cannot fall back to the previous actor's frozen process-env
+      // token and enumerate their private repos. Only an undefined token (an
+      // unmanaged local/desktop sandbox) inherits the process env unchanged.
+      const env =
+        token === undefined
+          ? process.env
+          : { ...process.env, GH_TOKEN: token, GITHUB_TOKEN: token };
       const { stdout } = await execFileAsync("gh", cmdArgs, {
-        env: token ? { ...process.env, GH_TOKEN: token } : process.env,
+        env,
         maxBuffer: 1024 * 1024 * 8,
       });
       const parsed = ghRepoSchema.safeParse(JSON.parse(stdout));

packages/agent/src/server/agent-server.ts

@@ -3824,12 +3824,21 @@ ${signedCommitInstructions}${prLinkInstructions}${shellEfficiencyInstructions}
   }
 
   private ghLoginPromise: Promise<string | null> | null = null;
+  private ghLoginToken: string | undefined;
 
   private fetchGhLogin(): Promise<string | null> {
-    this.ghLoginPromise ??= execGh(["api", "user", "--jq", ".login"], {
+    // Key the memoized login on the live token: an actor transition rebinds
+    // /tmp/agent-env, so a cached login would otherwise attribute the new actor's
+    // work to the previous one (or reject their PR).
+    const token = resolveGithubToken();
+    if (this.ghLoginPromise !== null && this.ghLoginToken === token) {
+      return this.ghLoginPromise;
+    }
+    this.ghLoginToken = token;
+    this.ghLoginPromise = execGh(["api", "user", "--jq", ".login"], {
       cwd: this.config.repositoryPath,
       timeoutMs: 10_000,
-      env: this.ghActorEnv(),
+      env: token === undefined ? undefined : ghTokenEnv(token),
     })
       .then((res) => {
         const login = res.exitCode === 0 ? res.stdout.trim() : "";

packages/agent/src/utils/github-token.test.ts

@@ -49,6 +49,13 @@ describe("github-token", () => {
       ).toBeUndefined();
     });
 
+    it("fails closed ('') when the file exists but is unreadable (not ENOENT)", () => {
+      // A directory path triggers EISDIR, standing in for a transiently unreadable
+      // managed file during a transition — must not resurrect the process env.
+      const dir = mkdtempSync(join(tmpdir(), "agent-env-dir-"));
+      expect(readGithubTokenFromSandboxEnvFile(dir)).toBe("");
+    });
+
     it("ignores an empty token value", () => {
       const path = writeEnvFile("GH_TOKEN=\0GITHUB_TOKEN=ghs_real\0");
       expect(readGithubTokenFromSandboxEnvFile(path)).toBe("ghs_real");
@@ -97,5 +104,13 @@ describe("github-token", () => {
       const path = writeEnvFile("PATH=/usr/bin\0");
       expect(resolveGithubToken(path)).toBe("ghs_fromprocess");
     });
+
+    it("does not fall back to the process env when the file is unreadable", () => {
+      // Present-but-unreadable (EISDIR here) is a managed sandbox mid-transition,
+      // not an absent file, so it must not resurrect the frozen process token.
+      vi.stubEnv("GH_TOKEN", "ghs_previous_actor");
+      const dir = mkdtempSync(join(tmpdir(), "agent-env-dir-"));
+      expect(resolveGithubToken(dir)).toBe("");
+    });
   });
 });

packages/agent/src/utils/github-token.ts

@@ -18,10 +18,15 @@ export function readGithubTokenFromSandboxEnvFile(
   let raw: string;
   try {
     raw = readFileSync(envFilePath, "utf8");
-  } catch {
-    // No env file (local/desktop or test) — signal "unmanaged" so the caller
-    // falls back to the process env.
-    return undefined;
+  } catch (err) {
+    // A genuinely absent file (local/desktop or test) is unmanaged: signal that so
+    // the caller falls back to the process env. But an existing-yet-unreadable file
+    // during an actor transition must NOT resurrect the frozen process token, so
+    // treat any other read error as an explicit logout (fail closed).
+    if ((err as NodeJS.ErrnoException).code === "ENOENT") {
+      return undefined;
+    }
+    return "";
   }
   const env: Record<string, string> = {};
   for (const entry of raw.split("\0")) {