Add sink-visibility to write-sink guard policy to prevent GitLost exfiltration

[lpcox]

Summary

Implements the sink-visibility field on the write-sink guard policy to prevent the GitLost vulnerability class — data exfiltration from private repos to public outputs via prompt injection.

The Attack

1. Attacker opens crafted issue in PUBLIC repo with prompt injection
2. Agentic workflow triggers, reads issue body
3. Injected instructions cause agent to read PRIVATE repo (agent accumulates secrecy tags)
4. Agent writes private data as PUBLIC comment via safe-outputs
5. WriteSinkGuard with accept=["*"] allows the write → data leaked

The Fix

A new sink-visibility field on write-sink guard policy:

"write-sink": {
  "accept": ["*"],
  "sink-visibility": "public"
}

When sink-visibility is "public", the WriteSinkGuard sets resource secrecy to empty — the DIFC evaluator's write check (agentSecrecy ⊆ resourceSecrecy) then fails for any agent with non-empty secrecy, blocking the exfiltration.

sink-visibility	Resource Secrecy	Effect
"public"	[] (empty)	Blocks any agent with non-empty secrecy
"private"	configured accept patterns	Standard subset check
"internal"	configured accept patterns	Same as private
(omitted)	configured accept (incl. "*")	Backward-compatible

Changes

• internal/config/guard_policy.go — Add SinkVisibility field to WriteSinkPolicy struct with full documentation
• internal/config/guard_policy_validation.go — Validate sink-visibility values (public/private/internal); case-insensitive
• internal/guard/write_sink.go — NewWriteSinkGuardWithVisibility constructor; LabelResource returns empty secrecy for public sinks
• internal/server/guard_init.go — Pass SinkVisibility when constructing WriteSinkGuard
• docs/CONFIGURATION.md — Full documentation of sink-visibility with examples and security rationale
• config.example.toml — Updated examples showing sink-visibility usage
• Tests — Comprehensive tests covering all visibility modes, backward compatibility, and the core security property

Compiler Requirement

The gh-aw compiler MUST check the safe-outputs target repository visibility and set sink-visibility accordingly. Without this, agents tricked into reading private data can exfiltrate it to public repos. The documentation makes this requirement explicit in multiple places.

[Copilot]

Pull request overview

This PR hardens the DIFC write-sink guard against the “GitLost” exfiltration pattern by introducing a sink-visibility policy field, allowing public sinks to be treated as having empty resource secrecy so tainted (non-empty secrecy) agents are blocked from writing.

Changes:

• Add sink-visibility to write-sink guard policy config and validate allowed values (public|private|internal, case-insensitive).
• Extend the WriteSinkGuard with visibility-aware behavior; public leaves resource secrecy empty to block tainted agents.
• Add test coverage for public/private/internal/unset modes and update user-facing configuration documentation/examples.

Show a summary per file

File	Description
internal/server/guard_init.go	Passes configured SinkVisibility into the write-sink guard constructor and improves DIFC logging context.
internal/guard/write_sink.go	Adds visibility-aware constructor + logic to enforce “public sink blocks tainted agents” via empty resource secrecy.
internal/guard/write_sink_test.go	Adds sink-visibility-focused tests covering the core security property and backward compatibility.
internal/config/guard_policy.go	Extends WriteSinkPolicy with SinkVisibility and documents semantics/requirements.
internal/config/guard_policy_validation.go	Validates sink-visibility values (case-insensitive) when provided.
internal/config/config_guardpolicies_test.go	Adds validation tests for sink-visibility accepted/rejected values.
docs/CONFIGURATION.md	Documents sink-visibility, rationale, and examples for public/private targets.
config.example.toml	Updates example configuration guidance to include sink-visibility usage.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 8/8 changed files
• Comments generated: 1
• Review effort level: Low