docs + run: phase agents look for production credentials wherever the repo's docs name them; document it, and offer a deny list

Open
  • Is something wrong?
#1,641 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
35/100
Issue type
Documentation
Clarity
Mostly clear
Activity status
Active
Tech stack
nodejs, supabase, typescript
Domain
devtools, documentation, security

Research direction

Start with the README security section referenced in the issue and the phase prompts that name .env.local and live Evidence commands in the exec and qa skills. Read how run.denyPaths would map to the driver's sandbox configuration before touching prompts. Done means the README states the permissions-skipped behavior and a deny-path setting exists with a default-empty test.

Written by the indexing model from the issue text.

Description

What happens

On a repo whose scripts and docs name .env.local, vercel env and a Supabase project, sequant's spec, exec and qa agents (running, as sequant runs them, with permissions skipped) try to use those credentials to do the work the issue describes: run the audit script against the live database, check production's environment variables, verify a change on the live site. They look in the worktree, in the main checkout, in the parent directory, in the user's home, and in the Vercel CLI's token store. Nothing in sequant stops them; in our replay a sandbox-exec profile and the absence of the files did.

Evidence (sequant 2.20.0 at 31c6f8bd, 15 F runs on a private mirror of a repo that reaches production, 2026-11-02 to 2026-11-03)

A scan of every Bash call in the phase transcripts, with the call's result:

  • ls .env.local, [ -f .env.local ], ls -a | grep -c "^.env.local$": existence checks in most runs; the file was absent.
  • grep -c "^SUPABASE_SERVICE_ROLE_KEY=" .env.local: a read attempt (#1143 F5); no file.
  • npx tsx --env-file=.env.local scripts/dev/query.ts "sb.from('shops').select(...)" in a loop of six live queries (#1144 F4), and npx tsx --env-file=/Users/…/matcha-maps-e2c/.env.local scripts/dev/query.ts … (#1144 F1): node refused at start, .env.local: not found, exit 9.
  • vercel env ls production (#1153 F1) and vercel env ls (#1153 F5): the sandbox refused the CLI's token directory, EPERM: operation not permitted, mkdir '~/Library/Application Support/com.vercel.cli'. Outside the sandbox the CLI is logged in; the call would have listed production's variables.
  • ls /Users/…/matcha-maps/.env.local (the real checkout, not the worktree) and test -f ~/.claude/secrets.env && grep -cE '^(export )?(NEXT_PUBLIC_SUPABASE_URL|SUPABASE_SERVICE_ROLE_KEY)=' ~/.claude/secrets.env (#1153 F2): both Operation not permitted under the sandbox.
  • scripts/fix/null-places-photos.ts --verify-live --sample 6 and curl -s https://getmatchamaps.com/: anonymous GETs of the production site, in 14 commands across the batch.

The native comparison arm on the same issues (a claude -p build session plus /code-review --fix, also with permissions skipped, given the same issue and the same Evidence lines) ran an ls .env.local-style existence check in 4 of 15 runs and nothing else on this list: no --env-file command, no live query, no Vercel call, nothing outside its worktree, no fetch of the site. The difference is the phase prompts: sequant's qa asks for each AC's Evidence to be run, and the Evidence lines name --env-file=.env.local and live checks.

Ask

  1. In the README's security section (#1028): say that phase agents run with permissions skipped and will use any credential the repo's own scripts name, including files outside the worktree and CLIs logged in on the host, and that a replay, a benchmark or a borrowed machine needs an OS-level sandbox.
  2. A run.denyPaths setting (or --deny-path, repeatable) that sequant turns into the driver's sandbox configuration where the driver has one, and that the qa and exec prompts receive as "do not read" so the agent does not spend turns trying. Default empty; the docs give ~/.claude/secrets.env and the main checkout's .env.local as the first entries.
  3. Smaller: the exec and qa skills could treat an Evidence command that names --env-file or a vercel/supabase CLI as "needs a human", the way qa already treats CI (#1630), instead of attempting it.

Why it matters

Sequant's pitch includes unattended runs. On a repo with production reach, an unattended run today is one that will try the production credentials if the issue's Evidence tells it to. In our replay every attempt was stopped by things sequant does not provide.

From a private replay study of sequant on our own repos; raw runs are not public. Filed by the owner.

Dominant language
TypeScript
Stars
1
Forks
1
Avg merge
11h 3m
Merged PRs (30d)
84

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from sequant-io/sequant

All issues in sequant-io/sequant

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.