feat(sandbox): scrub sensitive environment variables from package managers

Implements process-level environment variable protection per the spec.
When the sandbox is enabled, credential-bearing variables are removed from
the package manager child process before it is spawned, defending against
supply chain attacks that harvest secrets from the environment.

- DANGEROUS_ENV_VARS: curated default deny list of known secret names (no
  generic *_TOKEN/*_SECRET catch-alls); ScrubEnv matcher supports case-
  insensitive globs so profiles can opt into broader denies.
- EnvironmentPolicy (environment.allow / environment.deny) on sandbox
  profiles, merged under inheritance; deep-copied on resolve.
- npm/pypi profiles re-allow their own ecosystem's auth vars so package
  managers keep working; other ecosystems' and cloud creds stay scrubbed.
- New 'env' --sandbox-allow type (and overlay support via the same path):
  allow-only, value kept verbatim (not path-resolved), governed by lockdown.
- Enforced in executor.ApplySandbox as the last step before launch, after
  overlay and runtime overrides merge; scrubbed names logged for audit.

https://claude.ai/code/session_017Da1sAYLYpeEgogm6f9VYW

sandbox/executor/apply.go

@@ -6,6 +6,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"strings"
 
 	"github.com/safedep/dry/log"
 	"github.com/safedep/dry/usefulerror"
@@ -15,6 +16,7 @@ import (
 	"github.com/safedep/pmg/internal/audit"
 	"github.com/safedep/pmg/sandbox"
 	"github.com/safedep/pmg/sandbox/platform"
+	"github.com/safedep/pmg/sandbox/util"
 )
 
 type applySandboxConfig struct {
@@ -164,6 +166,12 @@ func ApplySandbox(ctx context.Context, cmd *exec.Cmd, pmName string, opts ...app
 
 	log.Debugf("Running %s in %s sandbox with policy %s", pmName, sb.Name(), policy.Name)
 
+	// Scrub sensitive environment variables before the child is spawned. This
+	// runs after overlay and runtime overrides are merged into the policy so
+	// user allowances are honored, and is platform-independent (it filters the
+	// env slice regardless of the OS sandbox driver).
+	scrubEnv(cmd, policy)
+
 	result, err := sb.Execute(ctx, cmd, policy)
 	if err != nil {
 		return nil, fmt.Errorf("failed to setup sandbox: %w", err)
@@ -205,10 +213,40 @@ func applyRuntimeOverrides(policy *sandbox.SandboxPolicy, overrides []config.San
 			// Enable AllowNetworkBind so the translator emits bind rules.
 			// Without this, AllowBind entries would be ignored on some platforms.
 			policy.AllowNetworkBind = utils.PtrTo(true)
+
+		case config.SandboxAllowEnv:
+			// Allow-wins: appending to Allow un-scrubs the variable regardless
+			// of whether it was denied by the built-in list or a profile deny
+			// glob, so (unlike the filesystem cases) there is no deny list to
+			// remove an exact match from.
+			log.Infof("Sandbox override: allowing environment variable %s", override.Value)
+			policy.Environment.Allow = append(policy.Environment.Allow, override.Value)
 		}
 	}
 }
 
+// scrubEnv removes sensitive environment variables from cmd.Env per the
+// resolved policy's environment section. It runs after project overlay and
+// runtime overrides are merged into the policy, so user allowances take effect.
+// A nil cmd.Env would mean "inherit the parent environment", which would defeat
+// scrubbing, so it is populated from os.Environ() first.
+func scrubEnv(cmd *exec.Cmd, policy *sandbox.SandboxPolicy) {
+	if cmd.Env == nil {
+		cmd.Env = os.Environ()
+	}
+
+	result := util.ScrubEnv(cmd.Env, util.EnvScrubOptions{
+		Allow: policy.Environment.Allow,
+		Deny:  policy.Environment.Deny,
+	})
+	cmd.Env = result.Env
+
+	if len(result.Removed) > 0 {
+		log.Infof("Sandbox: scrubbed %d sensitive environment variable(s) from %s: %s",
+			len(result.Removed), policy.Name, strings.Join(result.Removed, ", "))
+	}
+}
+
 // removeExactMatch removes entries from the slice that exactly match the given value.
 // Glob patterns and wildcards in the slice are never matched. Only literal string
 // equality is used. This keeps broad deny rules intact while allowing targeted overrides.

sandbox/executor/apply_test.go

@@ -2,6 +2,7 @@ package executor
 
 import (
 	"os"
+	"os/exec"
 	"path/filepath"
 	"testing"
 
@@ -57,6 +58,72 @@ func TestApplyRuntimeOverrides_Exec(t *testing.T) {
 	assert.Contains(t, policy.Process.AllowExec, "/usr/bin/curl")
 }
 
+func TestApplyRuntimeOverrides_Env(t *testing.T) {
+	policy := &sandbox.SandboxPolicy{
+		Environment: sandbox.EnvironmentPolicy{
+			Allow: []string{"NPM_TOKEN"},
+		},
+	}
+
+	applyRuntimeOverrides(policy, []config.SandboxAllowOverride{
+		{Type: config.SandboxAllowEnv, Value: "AWS_PROFILE", Raw: "env=AWS_PROFILE"},
+	})
+
+	assert.Contains(t, policy.Environment.Allow, "NPM_TOKEN")
+	assert.Contains(t, policy.Environment.Allow, "AWS_PROFILE")
+}
+
+func TestScrubEnv_RemovesDeniedKeepsAllowed(t *testing.T) {
+	policy := &sandbox.SandboxPolicy{
+		Name: "test",
+		Environment: sandbox.EnvironmentPolicy{
+			Allow: []string{"NPM_TOKEN"},
+		},
+	}
+
+	cmd := &exec.Cmd{Env: []string{
+		"PATH=/usr/bin",
+		"NPM_TOKEN=keep-me",
+		"AWS_SECRET_ACCESS_KEY=scrub-me",
+		"GITHUB_TOKEN=scrub-me-too",
+	}}
+
+	scrubEnv(cmd, policy)
+
+	assert.Contains(t, cmd.Env, "PATH=/usr/bin")
+	assert.Contains(t, cmd.Env, "NPM_TOKEN=keep-me")
+	assert.NotContains(t, cmd.Env, "AWS_SECRET_ACCESS_KEY=scrub-me")
+	assert.NotContains(t, cmd.Env, "GITHUB_TOKEN=scrub-me-too")
+}
+
+func TestScrubEnv_AllowOverrideUnscrubs(t *testing.T) {
+	policy := &sandbox.SandboxPolicy{Name: "test"}
+
+	// Simulate a --sandbox-allow env=AWS_PROFILE override having been merged.
+	applyRuntimeOverrides(policy, []config.SandboxAllowOverride{
+		{Type: config.SandboxAllowEnv, Value: "AWS_SESSION_TOKEN", Raw: "env=AWS_SESSION_TOKEN"},
+	})
+
+	cmd := &exec.Cmd{Env: []string{"AWS_SESSION_TOKEN=kept"}}
+	scrubEnv(cmd, policy)
+
+	assert.Contains(t, cmd.Env, "AWS_SESSION_TOKEN=kept")
+}
+
+func TestScrubEnv_NilEnvPopulatedThenScrubbed(t *testing.T) {
+	t.Setenv("GITHUB_TOKEN", "should-be-scrubbed")
+	t.Setenv("PMG_ENV_SCRUB_MARKER", "kept")
+
+	policy := &sandbox.SandboxPolicy{Name: "test"}
+	cmd := &exec.Cmd{Env: nil}
+
+	scrubEnv(cmd, policy)
+
+	require.NotNil(t, cmd.Env)
+	assert.Contains(t, cmd.Env, "PMG_ENV_SCRUB_MARKER=kept")
+	assert.NotContains(t, cmd.Env, "GITHUB_TOKEN=should-be-scrubbed")
+}
+
 func TestApplyRuntimeOverrides_NetConnect(t *testing.T) {
 	policy := &sandbox.SandboxPolicy{
 		Network: sandbox.NetworkPolicy{
@@ -250,7 +317,6 @@ func TestApplyRuntimeOverrides_VariableDenyNotRemovedByAbsoluteOverride(t *testi
 	assert.Equal(t, []string{"${CWD}/blocked.txt"}, policy.Filesystem.DenyWrite)
 }
 
-
 func TestApplyProjectOverlayAppendsEntries(t *testing.T) {
 	dir := t.TempDir()
 	repo := "/repo/example"