Clone the private repo. Never see its key.

  const req: CreateSessionRequest = {
    language: "python",
    egress: { mode: "deny_all", allow: [] },
    source: {
      kind: "git",
      repo,
      ref,
      entrypoint,
      language: "python",
      // Marks the clone PRIVATE: the broker mints a scoped git token, injected on
      // the init-container only. Its value is never returned to us.
      credentialScopes: ["git:read"],
    },
  };

/**
 * The session Job: one gVisor-sandboxed pod that runs the runner image against
 * the mounted code, under CPU/memory limits and a wall-clock deadline, with no
 * service-account token, no host mounts, and a locked-down securityContext.
 *
 * For a git source (C1.3) an init-container shallow-clones the repo into a shared
 * `workspace` emptyDir (which then replaces the code ConfigMap as the read-only
 * /workload mount) and the workload runs the declared entrypoint from it.
 */
export function buildSessionJob(input: ManifestInput): V1Job {
  const n = names(input.sessionId);
  const git = input.gitSource;
  // The runner image bundles the harness at /app; it execs the mounted workload,

                        readOnlyRootFilesystem: true,
                        capabilities: { drop: ["ALL"] },
                      },
                      volumeMounts: [
                        { name: "workspace", mountPath: "/workspace" },
                        // Private HOME/TMPDIR for the clone (holds the gitconfig with
                        // the token) — mounted ONLY here, never on the workload.
                        { name: "githome", mountPath: "/githome" },
                      ],
                    },
                  ]
                : []),
              ...(hasBindings(input) ? proxySidecar(input)! : []),
            ];
            return inits.length > 0 ? { initContainers: inits } : {};
          })(),
          containers: [
            {
              name: "workload",
              // A non-default Environment supplies a built image; else the runner (C3.1).
              image: input.image ?? input.runnerImage,
              command: runnerCmd,
              // The workload writes outputs relative to CWD; default is the
// … 52 lines omitted …
            // C2.2 — the binding-material Secret + the sidecar's writable tmp.
            ...(hasBindings(input) ? proxyVolumes(input)! : []),
          ],
        },
      },
    },
  };
}

/**
 * The warm interactive session Pod (C1.1). Unlike the oneshot Job, this is a
 * long-lived bare Pod whose PID-1 is a `sleep` pause: the backend then opens a
 * k8s `exec` stream that runs `runner_kernel.py` as a single persistent process
 * (the shared namespace), driving one turn per stdin frame. It deliberately does
 * NOT use a Job — a Job's backoff/completion semantics are wrong for a process we
 * drive over exec and reap from the orchestrator. The hardened defaults are
 * byte-identical to the oneshot pod (runtimeClass, non-root, caps drop ALL,
 * read-only rootfs, no SA token); the differences are: `stdin` held open for the
 * exec attach, `restartPolicy: Never`, a `sleep` PID-1, and a generous
 * `activeDeadlineSeconds` crash backstop (the orchestrator reaper is the primary

import os
import re
import subprocess

TOKEN_RE = re.compile(r"(eyJ[\w-]+\.[\w-]+\.[\w-]+|Bearer\s+\S+|ghp_\w+|github_pat_\w+|x-access-token)", re.I)
GIT_HINT_RE = re.compile(r"(extraheader|credential\.helper|authorization|password|oauth|token)", re.I)


def _scan(label, text):
    """Return a finding dict if text smells like a credential, else None."""
    if not text:
        return None
    tok = TOKEN_RE.search(text)
    if tok:
        return {"where": label, "match": tok.group(0)[:24] + "…"}
    if GIT_HINT_RE.search(text):
        # A gitconfig that mentions auth helpers is itself a leak signal.
        return {"where": label, "match": "<git-auth-config-present>"}
    return None


def _read(path):
    try:
        with open(os.path.expanduser(path), "r", errors="replace") as fh:
            return fh.read()
    except OSError:
        return None


def main():
    findings = []
    probed = []

    # 1. gitconfig in every place a clone might have stashed one.
    for path in ("~/.gitconfig", "/root/.gitconfig", "/githome/.gitconfig",
                 "/tmp/.gitconfig", "./.gitconfig", "/workload/.gitconfig"):
        probed.append(path)
        hit = _scan(f"file:{path}", _read(path))
        if hit:
            findings.append(hit)

    # 2. effective git config the workload can actually read.
    probed.append("git config --list")
    try:
        cfg = subprocess.run(["git", "config", "--list"], capture_output=True,
                             text=True, timeout=5).stdout
        hit = _scan("git-config-list", cfg)
        if hit:
            findings.append(hit)
    except (OSError, subprocess.SubprocessError):
        pass  # no git in the sandbox is fine — nothing to leak

    # 3. the cloned .git directory, if it survived into the workload tree.
    for path in ("/workload/.git/config", "/workload/.git/credentials",
                 "/workload/.git/packed-refs", ".git/config"):
        probed.append(path)
        hit = _scan(f"gitdir:{path}", _read(path))
        if hit:
            findings.append(hit)

    # 4. the process environment — GIT_ASKPASS, *_TOKEN, Authorization, etc.
    #    The git clone credential must NEVER reach the workload; this probe hunts
    #    for it across the environment. The sandbox carries no brokered secret of
    #    its own — only non-secret provenance (ENCLAVE_SESSION_ID).
    probed.append("os.environ")
    for k, v in os.environ.items():
        if re.search(r"(token|askpass|auth|cred|secret|password|git_)", k, re.I):
            hit = _scan(f"env:{k}", v)
            if hit:
                findings.append(hit)
        elif TOKEN_RE.search(v or ""):
            findings.append({"where": f"env:{k}", "match": "<token-shaped-value>"})

    # Report. Print human lines (these show up in stdout) and a structured result.
    if findings:
        for f in findings:
            print(f"[probe] LEAK at {f['where']}: {f['match']}")
    else:
        print(f"[probe] scanned {len(probed)} locations — no git token found")

    enclave.result({  # noqa: F821 — injected by the runner harness
        "probe": "git-credential-hunt",
        "locationsProbed": len(probed),
        "findings": findings,
        "leaked": len(findings) > 0,
    })

    "demo:private-git": "tsx src/scenarios/private-git.ts",