IronClaw mediates GitHub CLI credentials inside the sandbox

nearai/ironclaw PR #7810 is the inspected primary source: “feat(sandbox): mediate GitHub CLI credentials.” The related records below were inspected as supporting context rather than independent confirmation.

The facts

- nearai/ironclaw PR #7810 was created 2026-08-21T23:25:21Z and was open at inspection; its title is “feat(sandbox): mediate GitHub CLI credentials.” - nearai/ironclaw issue #7808 was created 2026-08-21T20:54:22Z and was open at inspection; its title is “Memory write path: redaction + taint metadata required before any external provider binds.” - nearai/ironclaw issue #7812 was created 2026-08-22T00:31:26Z and was open at inspection; its title is “Onboarding suggestions: respect user-level tool permissions, generate with read-only tool access.” - The repository reported 12599 stars, 1524 open issues, default branch main, and last push 2026-08-22T00:04:30Z. - The latest tagged-release baseline checked was ironclaw-v1.3.0 published 2026-08-19T23:17:37Z.

What changed

nearai/ironclaw PR #7810 reports: Summary complete the existing one-persistent-sandbox-per-user runtime with per-user managed egress and invocation attribution route direct gh commands through the existing builtin.shell authorization, approval, and one-shot credential obligation flow put only an invocation placeholder in GH_TOKEN; the sandbox proxy swaps it for the real credential only for api.github.com install GitHub CLI in the sandbox worker image and preserve argv boundaries through the direct-exec helper Scope This replaces the closed #7807 implementation. It does not add a second model-callable process capability, a generic CLI credential framework, composition-profile changes, or unrelated runtime refactors. The GitHub-specific names in generic shell/runtime files are a deliberate #7732 carve-out. The extension-specificity ratchet records the seven exact path/term pairs and raises its equality baseline from 110 to 117. This is intentionally hardwired to builtin.shell; delete the carve-out if GitHub later gains an owned product surface for this operation. Security and compatibility the command receives a random placeholder, never the real token the proxy replacement is scoped to one invocation and one exact host argv is transported as executable plus arguments, not reinterpreted as shell text one-shot staged secret material is consumed and cleaned through the existing obligation store local-host shell behavior remains unchanged; only the user-sandbox process backend activates this path rollback: revert this commit; no persistence schema or data migration is involved Test Strategy cargo test -p

nearai/ironclaw issue #7808 reports: Prerequisite for binding ANY external memory provider (#7664): the write path currently egresses verbatim conversation content, and only the host can fix that — at write time. Problem Strategy decision (2026-08-21, recorded on #7664): retrieval is outsourced to memory providers; the host's job is to WRITE well. That inverts where safety must live. Today every memory-safety property is enforced on the READ side (untrusted envelope, budgets, cross-scope drop) — which survives outsourcing. But two properties only exist host-side and are currently ABSENT from the write path: 1. **Redaction.** AfterTurnMemoryRecorder hands the full ordered transcript to MemoryService::record_interaction verbatim — the only filter is skipping blank messages (after_turn_memory.rs ~193-205, verified 2026-08-21). Tool messages carry command output, file contents, anything a run touched. Fine for the local native store; a data-egress hole the moment the provider is a remote service. 2. **Taint / provenance.** The host is the only party that knows which spans of a transcript are untrusted third-party text (channel messages, tool output quoting the web, injected content). A smart provider extracts "facts" from recorded sessions — an unmarked injected sentence becomes a clean-provenance fact. OpenClaw's dreaming gates promotion on provenance structurally; our equivalent must ride the write payload, because we no longer control the thinking. Fix A redaction pass (via ironclaw_safety) over MemoryServiceRecordRequest messages before the provider boundary — secrets/token-shaped

nearai/ironclaw issue #7812 reports: Today suggestion generation only has internal search tools (memory, extensions, tools), so suggestions aren't grounded in the user's actual data. Enable connected tools during suggestion generation, respecting the permissions the user set at the user level, and update the prompt to read/list only — no drafting, modifying, or sending. No separate permission layer or approval bypass; guardrails via prompt for now Add harder guardrails later if users report unwanted actions

Why it matters

Credential and memory boundaries fail when raw authority or unmarked content crosses into a less trusted process. A prompt saying read-only is weaker than an enforced capability. The operator test is whether the system remains bounded and its receipts still describe the action after failure, retry or restart.

Current

The primary record was open when captured on 2026-08-22. The tagged-release baseline was ironclaw-v1.3.0 published 2026-08-19T23:17:37Z. Repository metadata, full source bodies, current pull requests and issues, releases, Google News, Hacker News, Lobsters, Metamesh and the rendered ClawCharts row were inspected. ClawCharts selected the subject; it did not prove the claim.

Evidence

The primary URL is https://github.com/nearai/ironclaw/pull/7810. Supporting records are https://github.com/nearai/ironclaw/issues/7808 and https://github.com/nearai/ironclaw/issues/7812. Source bodies, timestamps and states are preserved in the daily evidence bundle. Test counts and reproductions remain attributed to their authors unless identified as independently rerun.

Source boundary

Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Search residue, package mirrors and historically published source spines were excluded.

Operator take

Keep real tokens out of the child environment, bind substitution to one host and invocation, add write-side redaction and taint, and replace prompt-only onboarding limits with hard tool policy. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently.

Caveat

Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.

Source inspected; source state, environment and release boundary remain explicit.