From e4529e67e78270395af3f5d95315d1e7a0682b7f Mon Sep 17 00:00:00 2001
From: cthomas <carenthomas@gmail.com>
Date: Fri, 27 Feb 2026 10:52:05 -0800
Subject: [PATCH] fix: redact credential helper value from memfs-git debug log
 (#1191)

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 src/agent/memoryGit.ts | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/agent/memoryGit.ts b/src/agent/memoryGit.ts
index 284de96..31cf063 100644
--- a/src/agent/memoryGit.ts
+++ b/src/agent/memoryGit.ts
@@ -92,7 +92,15 @@ async function runGit(
     : [];
   const allArgs = [...authArgs, ...args];
 
-  debugLog("memfs-git", `git ${args.join(" ")} (in ${cwd})`);
+  // Redact credential helper values to avoid leaking tokens in debug logs.
+  const loggableArgs =
+    args[0] === "config" &&
+    typeof args[1] === "string" &&
+    args[1].includes("credential") &&
+    args[1].includes(".helper")
+      ? [args[0], args[1], "<redacted>"]
+      : args;
+  debugLog("memfs-git", `git ${loggableArgs.join(" ")} (in ${cwd})`);
 
   const result = await execFile("git", allArgs, {
     cwd,