fix(security): denylist plaintext-credential home dotfiles for media delivery

[briandevans]

This is a sibling follow-up to commit 4ec0ade (fix(gateway): denylist config.yaml for media delivery)

• 4ec0adebe / 02d1da49d covered: ~/.hermes/{.env,auth.json,credentials,config.yaml} in the media-delivery denylist, plus the $HOME cloud-credential directories (.ssh, .aws, .gnupg, .kube, .docker, .azure, .gcloud, Library/Keychains).
• It did NOT touch: the plaintext-credential dotfiles in $HOME — ~/.netrc, ~/.git-credentials, ~/.npmrc, ~/.pypirc. Same exfiltration class (~/.aws/credentials is already blocked; ~/.netrc is its single-file twin), reaching a different resource the existing entries miss.
• This PR adds those four files to _MEDIA_DELIVERY_DENIED_HOME_SUBPATHS, so native media delivery can never attach them even under recency-trust.

What does this PR do?

Widens the gateway media-delivery credential denylist to cover the common plaintext-credential home dotfiles (.netrc, .git-credentials, .npmrc, .pypirc). Defense-in-depth against prompt-injection exfiltrating host secrets as a native attachment. The exact-path matcher in _path_under_denied_prefix (_path_is_within(...) or resolved == resolved_denied) already handles single-file denylist entries, so this is a pure data widening with no plumbing change and no behavioral change for legitimate media paths.

Related Issue

(none — sibling follow-up to commit 4ec0ade)

Type of Change

• 🔒 Security fix

Changes Made

• gateway/platforms/base.py: add 4 credential dotfiles (.netrc, .git-credentials, .npmrc, .pypirc) to _MEDIA_DELIVERY_DENIED_HOME_SUBPATHS.
• tests/gateway/test_platform_base.py: parametrized regression proving each dotfile is denied even when freshly produced (recency-trust on).

How to Test

1. uv run --with pytest --with pytest-xdist --with pytest-asyncio python3 -m pytest tests/gateway/test_platform_base.py::TestMediaDeliveryPathValidation -v
2. Confirmed regression guard: the 4 new parametrized cases FAIL on current main (delivery allowed) and PASS with the production hunk applied.
3. Full class: 15 passed.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run the focused suite pytest tests/gateway/test_platform_base.py::TestMediaDeliveryPathValidation -v and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS 15

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) — these are POSIX home dotfiles; the matcher resolves against the live $HOME so it is correct on all platforms — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Sibling code paths that may need the same fix: the file-tool read denylist and the write/approval denylist already cover .netrc-class files separately (#16851 / #27217); this PR only addresses the gateway media-delivery surface. Happy to widen if preferred.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Extends the media delivery denylist to block additional plaintext-credential dotfiles (~/.netrc, ~/.git-credentials, ~/.npmrc, ~/.pypirc) from being delivered as native attachments, preventing prompt-injection exfiltration of cleartext tokens/passwords.

Changes:

• Added four credential dotfiles to the _MEDIA_DELIVERY_DENIED_PREFIXES tuple in gateway/platforms/base.py.
• Added a parametrized test verifying these dotfiles are rejected even when the recency-trust window would otherwise allow them.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
gateway/platforms/base.py	Adds .netrc, .git-credentials, .npmrc, .pypirc to the credential denylist.
tests/gateway/test_platform_base.py	New parametrized test asserting these dotfiles are denied under fresh-mtime/recency-trust conditions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[briandevans]

Closing to keep the hardening queue focused — this is a mechanical sibling-widen of an existing denylist/redaction family that hasn't drawn review. Happy to reopen or fold it into a broader hardening pass if that's preferred.