Agents kept configuring git with RAKAZO_GITHUB_BROKER_RUN_TOKEN as a
password because the system prompt listed it among "managed credentials"
to use in shell commands. GitHub rejects it, and the agent then asks the
user for a personal access token.
- List only the user's own agent secrets in that instruction; the broker
variables stay in the environment for the git shim.
- Make /usr/bin/git the shim as well, so git called by absolute path
still goes through the broker; the real binary moves out of PATH.
- Prompt no longer names the broker variable.
Claude-Session: https://claude.ai/code/session_01Tgvrj34NMnaqvtgvruYQZZ
Co-authored-by: Claude <noreply@anthropic.com>
f136451e22