fix(security): Keep OAuth token out of terminal environments

[charlesvien]

Problem

Resolves VERIA-351: OAuth access token leak in terminal shell environments.

Changes

Stop writing the OAuth token to the shared process env, and scrub the credential vars from the shell/pty env so repo scripts can't read them.

How did you test this?

Unit tests in @posthog/workspace-server (shell env scrubbing, incl. via additionalEnv, and the auth adapter).

Automatic notifications

• Publish to changelog?
• Alert Sales and Marketing teams?

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here

[charlesvien]

• fix(security): Open files in external apps via argv not shell #3805
• fix(security): Confirm repo-provided setup script before running #3804
• fix(security): Enforce CSP on sandboxed MCP app HTML #3803
• fix(security): Run setup discovery agent in plan mode #3802
• fix(security): Scope MCP UI resource caches by server name #3801
• fix(security): Validate agent slug before building ingress host #3800
• fix(security): Keep OAuth token out of terminal environments #3799 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[github-actions]

React Doctor found no issues in the changed files. 🎉

_{Reviewed by React Doctor for commit 992320d.}

[greptile-apps]

_{Reviews (1): Last reviewed commit: "keep OAuth token out of terminal environ..." | Re-trigger Greptile}

[stamphog]

Note

🤖 stamphog reviewed 992320de3e567f5301832741110a421f7410dacc — verdict: REFUSED

Gates failed (auth deny-list, T2-never) and the change modifies OAuth token handling and shell credential-env scrubbing — genuinely security-sensitive. The diff looks correct and well-tested, but with no human/agent review beyond a bare reaction, there's no independent assurance to substitute for gate approval.

• 👍 on the PR from greptile-apps[bot].
• Gates denied: diff touches auth-sensitive code (token handling in auth-adapter.ts and credential env scrubbing in shell.ts) and was classified as a non-auto-approvable tier.
• No human or substantive agent review — only a bare Greptile 👍 reaction, no ownership match, no reported author familiarity — so there's no independent assurance for this security-sensitive change.

Gate mechanics and policy version

Gate		Result
prerequisites	✓	all clear
deny-list	✗	matches: auth
size	✓	18L, 2F substantive, 60L/4F incl. docs/generated/snapshots — within ceiling
tier	✗	classified as T2-never: T2-never (60L, 4F, single-area, fix)
stamphog 2.0.0b3		.stamphog/policy.yml @ bf27356 · reviewed head 992320d