fix(#854): update stale policy refs and mask GITLAB_TOKEN in post-code

agents/triage.md

@@ -3,9 +3,10 @@ name: triage
 description: Inspect an issue, assess information sufficiency, and produce a structured triage decision.
 skills:
   - issue-labels
-# curl: required by GitLab forge. On GitHub, the network policy binary
-# allowlist (policies/github/triage.yaml) excludes **/curl, preventing
-# it from making network requests even though it is granted here.
+# curl: required by GitLab forge. On GitHub, the profile binary
+# allowlists (e.g. profiles/fullsend-github-ro.yaml) omit **/curl,
+# preventing it from making network requests even though it is
+# granted here.
 tools: Bash(gh,curl,jq)
 model: opus
 ---

docs/code.md

@@ -180,8 +180,8 @@ setup:
 - **`ISSUE_URL`** replaces `GITHUB_ISSUE_URL` in scripts. The
   per-forge env file (`env/github/code.env` or `env/gitlab/code.env`)
   maps the platform-specific variable to `ISSUE_URL`.
-- **Policy** is per-forge: `policies/github/code.yaml` or
-  `policies/gitlab/code.yaml`. Custom harnesses using `base:`
+- **Policy** is per-forge: `policies/base.yaml` (GitHub) or
+  `policies/gitlab/code.yaml` (GitLab). Custom harnesses using `base:`
   composition should override at the forge level if needed.
 - **GitLab uses `curl`** instead of `gh` for API access. The GitLab
   sandbox policy allows `curl` for `gitlab_api` endpoints only.

docs/network-policy.md

@@ -40,7 +40,7 @@ allowed hosts and binaries.
 ### 1. Create a policy file
 
 Copy the default policy for the agent you are configuring (for example,
-[`policies/github/code.yaml`](../policies/github/code.yaml) for the code agent) to
+[`policies/base.yaml`](../policies/base.yaml) for the code agent) to
 `.fullsend/policies/<agent>.yaml` in your repository and append a
 block for the host you need:
 
@@ -96,9 +96,8 @@ succeeds.
 Each agent has its own policy file with similar but not identical
 defaults. If multiple agents need the same custom hosts, create a
 separate override for each one. For example, the
-[code](code.md) and [fix](fix.md) agents use
-[`policies/github/code.yaml`](../policies/github/code.yaml) and
-[`policies/fix.yaml`](../policies/fix.yaml) respectively
+[code](code.md) and [fix](fix.md) agents both use
+[`policies/base.yaml`](../policies/base.yaml)
 (code agent also has a GitLab equivalent under `policies/gitlab/`).
 
 ## Troubleshooting

scripts/post-code.sh

@@ -1805,6 +1805,9 @@ else
 fi
 
 echo "::add-mask::${PUSH_TOKEN}"
+if [ -n "${GITLAB_TOKEN:-}" ]; then
+  echo "::add-mask::${GITLAB_TOKEN}"
+fi
 
 # ---------------------------------------------------------------------------
 # No-op comment helper

scripts/post-code.src.sh

@@ -305,6 +305,9 @@ else
 fi
 
 echo "::add-mask::${PUSH_TOKEN}"
+if [ -n "${GITLAB_TOKEN:-}" ]; then
+  echo "::add-mask::${GITLAB_TOKEN}"
+fi
 
 # ---------------------------------------------------------------------------
 # No-op comment helper