feat: Add support for environment protection (scrubbing) (#327)

* feat: Add support for environment variable protection for sandbox

* chore: Update dangerous env var list

* fix: Split profiles for improved environment protection

* fix: pipx sandbox profile separation

* chore: Show sandbox scrub info on error exit

* fix: Code review fixes

* test: Add e2e for sandbox environment scrubbing

sandbox/executor/apply_test.go

@@ -2,6 +2,7 @@ package executor
 
 import (
 	"os"
+	"os/exec"
 	"path/filepath"
 	"testing"
 
@@ -57,6 +58,74 @@ func TestApplyRuntimeOverrides_Exec(t *testing.T) {
 	assert.Contains(t, policy.Process.AllowExec, "/usr/bin/curl")
 }
 
+func TestApplyRuntimeOverrides_Env(t *testing.T) {
+	policy := &sandbox.SandboxPolicy{
+		Environment: sandbox.EnvironmentPolicy{
+			Allow: []string{"NPM_TOKEN"},
+		},
+	}
+
+	applyRuntimeOverrides(policy, []config.SandboxAllowOverride{
+		{Type: config.SandboxAllowEnv, Value: "AWS_PROFILE", Raw: "env=AWS_PROFILE"},
+	})
+
+	assert.Contains(t, policy.Environment.Allow, "NPM_TOKEN")
+	assert.Contains(t, policy.Environment.Allow, "AWS_PROFILE")
+}
+
+func TestScrubEnv_RemovesDeniedKeepsAllowed(t *testing.T) {
+	policy := &sandbox.SandboxPolicy{
+		Name: "test",
+		Environment: sandbox.EnvironmentPolicy{
+			Allow: []string{"NPM_TOKEN"},
+		},
+	}
+
+	cmd := &exec.Cmd{Env: []string{
+		"PATH=/usr/bin",
+		"NPM_TOKEN=keep-me",
+		"AWS_SECRET_ACCESS_KEY=scrub-me",
+		"GITHUB_TOKEN=scrub-me-too",
+	}}
+
+	scrubbed := scrubEnv(cmd, policy)
+
+	assert.Equal(t, 2, scrubbed)
+	assert.Contains(t, cmd.Env, "PATH=/usr/bin")
+	assert.Contains(t, cmd.Env, "NPM_TOKEN=keep-me")
+	assert.NotContains(t, cmd.Env, "AWS_SECRET_ACCESS_KEY=scrub-me")
+	assert.NotContains(t, cmd.Env, "GITHUB_TOKEN=scrub-me-too")
+}
+
+func TestScrubEnv_AllowOverrideUnscrubs(t *testing.T) {
+	policy := &sandbox.SandboxPolicy{Name: "test"}
+
+	// Simulate a --sandbox-allow env=AWS_SESSION_TOKEN override having been merged.
+	applyRuntimeOverrides(policy, []config.SandboxAllowOverride{
+		{Type: config.SandboxAllowEnv, Value: "AWS_SESSION_TOKEN", Raw: "env=AWS_SESSION_TOKEN"},
+	})
+
+	cmd := &exec.Cmd{Env: []string{"AWS_SESSION_TOKEN=kept"}}
+	scrubbed := scrubEnv(cmd, policy)
+
+	assert.Equal(t, 0, scrubbed)
+	assert.Contains(t, cmd.Env, "AWS_SESSION_TOKEN=kept")
+}
+
+func TestScrubEnv_NilEnvPopulatedThenScrubbed(t *testing.T) {
+	t.Setenv("GITHUB_TOKEN", "should-be-scrubbed")
+	t.Setenv("PMG_ENV_SCRUB_MARKER", "kept")
+
+	policy := &sandbox.SandboxPolicy{Name: "test"}
+	cmd := &exec.Cmd{Env: nil}
+
+	scrubEnv(cmd, policy)
+
+	require.NotNil(t, cmd.Env)
+	assert.Contains(t, cmd.Env, "PMG_ENV_SCRUB_MARKER=kept")
+	assert.NotContains(t, cmd.Env, "GITHUB_TOKEN=should-be-scrubbed")
+}
+
 func TestApplyRuntimeOverrides_NetConnect(t *testing.T) {
 	policy := &sandbox.SandboxPolicy{
 		Network: sandbox.NetworkPolicy{
@@ -250,7 +319,6 @@ func TestApplyRuntimeOverrides_VariableDenyNotRemovedByAbsoluteOverride(t *testi
 	assert.Equal(t, []string{"${CWD}/blocked.txt"}, policy.Filesystem.DenyWrite)
 }
 
-
 func TestApplyProjectOverlayAppendsEntries(t *testing.T) {
 	dir := t.TempDir()
 	repo := "/repo/example"