.woodpecker/pr-review.yml

@@ -198,7 +198,11 @@ steps:
           rm -f "$$WS/.pr-review"; ln -s "$$D" "$$WS/.pr-review"
 
           # --- Triage: Haiku picks the model ---
-          cat "$$PROMPTS/triage-prompt.md" | claude \
+          # env -u REVIEW_TOKEN: the agents never call Gitea (the shell does, via
+          # $$AUTH), so the write:repository PAT must not sit in the agent's env
+          # where a prompt-injected diff could read /proc/self/environ. Defence in
+          # depth alongside the settings.json Read-sandbox.
+          cat "$$PROMPTS/triage-prompt.md" | env -u REVIEW_TOKEN claude \
             --model claude-haiku-4-5-20251001 \
             --permission-mode acceptEdits \
             --allowedTools "Read,Glob,Grep,Write" \
@@ -210,7 +214,7 @@ steps:
           echo "Triage: complexity=$$CPLX -> model=$$MODEL"
 
           # --- Review with the chosen model ---
-          ( cd "$$WS" && cat "$$PROMPTS/prompt.md" | claude \
+          ( cd "$$WS" && cat "$$PROMPTS/prompt.md" | env -u REVIEW_TOKEN claude \
               --model "$$MODEL" \
               --permission-mode acceptEdits \
               --allowedTools "Read,Glob,Grep,Write" \