fix(tools): fail closed on github cli credentials (#154)

docs/git-credential-adapter.md

@@ -110,10 +110,10 @@ Stored `gitea.example.com:8443` matches:
 If you run a self-hosted server on the scheme's default port (443 HTTPS, 22
 SSH), omit the port. If you run on a non-default port, include it.
 
-When no stored credential matches the resolved remote host, the adapter falls
-through to the un-credentialed path: `git` runs with whatever credentials the
-calling shell already has (typically none, in which case the remote will reject
-the operation with a 401/403).
+When no typed PAT/SSH credential is selected, or the selected credential cannot
+match the resolved remote host, adapter-managed remote commands fail closed
+with a GoClaw diagnostic. `git` is not allowed to fall through to an
+interactive username/password prompt in agent runtime.
 
 ## Security model
 

docs/journals/260611-secure-cli-github-credential-runtime-fix.md

@@ -0,0 +1,31 @@
+# Secure CLI GitHub Credential Runtime Fix
+
+## Summary
+
+Fixed GitHub-related SecureCLI auth diagnostics for `git` and `gh` runtime
+commands linked to digitopvn/goclaw#138 and digitopvn/goclaw#151.
+
+## Root Cause
+
+- Adapter-managed `git` remote commands could reach raw Git when no typed PAT
+  or SSH credential was selected.
+- Required env validation only covered `rapidapi`, so credentialed `gh`
+  commands without `GH_TOKEN` could reach raw GitHub CLI auth guidance.
+
+## Changes
+
+- Added fail-closed git credential readiness validation before adapter prepare.
+- Generalized required env checks to preset non-optional env vars.
+- Added regression tests for missing git typed credentials and missing
+  `GH_TOKEN`.
+- Updated git adapter docs and project changelog.
+
+## Validation
+
+- `/usr/local/go/bin/go test ./internal/tools`
+- `/usr/local/go/bin/go build ./...`
+- `/usr/local/go/bin/go build -tags sqliteonly ./...`
+
+## Unresolved Questions
+
+None.

docs/project-changelog.md

@@ -4,6 +4,25 @@ Significant changes, features, and fixes in reverse chronological order.
 
 ---
 
+## 2026-06-11
+
+### Secure CLI GitHub credential runtime diagnostics (issues #138, #151)
+
+**Fixes**
+
+- Git remote commands now fail closed before raw `git` auth prompts when no
+  typed host-scoped PAT/SSH credential is selected.
+- Required SecureCLI env validation now applies to preset env vars such as
+  `GH_TOKEN`, so credentialed `gh` commands report missing credential config
+  instead of raw `gh auth login` guidance.
+
+**Tests**
+
+- Added regressions for `git push` without typed credentials and `gh` without
+  `GH_TOKEN`.
+
+---
+
 ## 2026-06-09
 
 ### Behavior UX sidecar delivery overrides (issue #144)