{{ message }}
Repository navigation
feat(agent): warn about credential-looking variables inherited from the shell - #80
Merged
Merged
Conversation
…he shell Native agent runs pass the caller's environment to the agent, so an exported token reaches it as a real value. agent run now prints how many credential-looking variables the agent inherits, and agent validate lists them by name. Docker runs start from a clean environment and skip the check. An empty [config_env] value is no longer flagged as sensitive, so NAME = "" blanks an inherited variable.
Only STASHBASE_API_KEY is removed from a native agent's environment, so other STASHBASE_* names reach the agent and must be checked.
Unix environment names are case-sensitive, so a binding or config_env entry named github_token leaves an inherited GITHUB_TOKEN in place. The check now skips only the exact names the launcher removes or sets.
Guards the behavior the inherited-env check relies on when it skips names [config_env] sets.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Native agent runs pass the caller's whole shell environment to the agent (only
STASHBASE_API_KEYand binding source names are removed), so an exported token likeGITHUB_TOKENreaches the agent as a real value and skips the placeholder model.Changes
agent run(native, local and--remote): prints one line with how many credential-looking variables the agent inherits. Hidden by--silent. Docker runs are skipped, since the container starts from a clean environment.agent validate: a new "Inherited env" check lists those variables by name (never values).[config_env]: an empty value is no longer flagged as sensitive, soNAME = ""blanks an inherited variable without a confirmation prompt.agent-profiles.md; per-backend environment notes insandboxing.md.No new profile config.
Detection
Best-effort, reusing the
[config_env]rules minus the high-entropy check (too noisy over a whole shell env): sensitive name parts, known token prefixes, URLs with passwords. Skips path values, sandbox-owned names, and names a binding or[config_env]provides.Testing
cargo test: all passing (new unit tests for detection, empty values and the validate check).FAKE_API_TOKEN = ""reaching the agent as empty under--silentwith no TTY.