security: isolate agent shell commands from parent environment#25
Merged
Merged
Conversation
Prevent environment variable leakage to agent-spawned processes. Previously, run_command() inherited all env vars from the desktop app process (API keys, HOME, credentials). Now env_clear() wipes the slate and only PATH, LANG, and LC_ALL are passed through — enough for shell tools to find binaries and handle encoding correctly. Also adds test_run_command_env_isolation to assert that secrets set in the parent process are not visible to agent commands.
enowdev
approved these changes
May 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Agent-spawned shell commands previously inherited all environment variables from the desktop app process. This means API keys, credentials, or any secret stored in the host environment could be read by an agent simply by running
envorprintenv. This PR fixes the leak by callingenv_clear()before spawning child processes, then forwarding only the minimum required variables (PATH,LANG,LC_ALL).Type of Change
How Has This Been Tested?
cargo clippy -- -D warningspasses (Rust) — could not run in current environment due to missing GTK system deps on WSLbunx tsc --noEmitpasses (TypeScript) — no TypeScript changes in this PRManual verification:
env_clear()is placed beforestdout/stderrpiping on the command builderPATH,LANG,LC_ALLare forwarded — no other env vars passed throughtest_run_command_env_isolationtest that sets a secret env var in the parent process and asserts it is not visible inside an agent commandChecklist