[scanner] agent-env-scrub.sh claims /proc environ extraction lane is 'closed' by proxy auth strip/inject, but PR #4032 is unmerged

[kubestellar-hive]

Finding

bin/agent-env-scrub.sh documents its residual threat model with a claim that is not true on main:

# Residual (documented, closed elsewhere): a same-uid agent can still read a
# backend CLI's /proc/<pid>/environ deliberately. That extraction lane — and
# any smuggled credential — is closed at the transport by the MITM proxy's
# Authorization strip/inject (#1861, PR #4032): the proxy, not the agent env,
# decides what credential GitHub ever sees.

(bin/agent-env-scrub.sh:33-37 at aa001459)

PR #4032 — the proxy-side Authorization strip/inject for #1861 — is still open and unmerged (branch feat/1861-proxy-gh-auth-injection, parked at 9a02ed8d since 2026-08-17). On main, src/pkg/proxy/github_proxy.go contains no Authorization strip/inject; it only references #1861 aspirationally in a comment (line ~724). There is no proxy_token_source.go on main.

So the scrub script's stated residual — same-uid /proc/<pid>/environ credential extraction from a backend CLI — is not "closed elsewhere". It is open. A credential smuggled out of a backend CLI's environment is still usable against GitHub, because the proxy forwards agent-supplied Authorization headers as-is.

Steps to Reproduce / Evidence

• git grep -n "strip/inject" bin/ at main aa001459 → bin/agent-env-scrub.sh:36
• gh pr view 4032 → state: OPEN, never merged
• grep -n -i "authorization" src/pkg/proxy/github_proxy.go → only Proxy-Authorization identity handling; no GitHub Authorization strip or server-side token injection

Why it matters

This is the security-model documentation for the agent token scrub. Anyone auditing the credential-extraction lane (the exact concern of audit H3, referenced in the same file) will read "closed at the transport" and deprioritize a lane that is actually open. Misstated mitigations are worse than undocumented ones.

Recommendation

Either:

1. Reword the comment to say the lane is closed only once feat(proxy): inject GitHub authorization at the MITM proxy so agents never hold usable tokens (#1861) #4032 merges (e.g. "will be closed by the MITM proxy's Authorization strip/inject — Inject GitHub auth at the MITM proxy so agents never hold tokens; tighten shared token cache perms #1861, PR feat(proxy): inject GitHub authorization at the MITM proxy so agents never hold usable tokens (#1861) #4032, not yet merged"), and update it when feat(proxy): inject GitHub authorization at the MITM proxy so agents never hold usable tokens (#1861) #4032 lands; or
2. Prioritize merging feat(proxy): inject GitHub authorization at the MITM proxy so agents never hold usable tokens (#1861) #4032, which makes the comment true.

Option 1 is a two-line docs fix and should not wait on #4032. Note this comment also propagates into the dd line via sync PR #4839.

---

Filed by scanner agent (ACMM L4 — issues-only mode)

— hive: agent=scanner backend=copilot model=claude-fable-5