Implements process-level environment variable protection per the spec.
When the sandbox is enabled, credential-bearing variables are removed from
the package manager child process before it is spawned, defending against
supply chain attacks that harvest secrets from the environment.
- DANGEROUS_ENV_VARS: curated default deny list of known secret names (no
generic *_TOKEN/*_SECRET catch-alls); ScrubEnv matcher supports case-
insensitive globs so profiles can opt into broader denies.
- EnvironmentPolicy (environment.allow / environment.deny) on sandbox
profiles, merged under inheritance; deep-copied on resolve.
- npm/pypi profiles re-allow their own ecosystem's auth vars so package
managers keep working; other ecosystems' and cloud creds stay scrubbed.
- New 'env' --sandbox-allow type (and overlay support via the same path):
allow-only, value kept verbatim (not path-resolved), governed by lockdown.
- Enforced in executor.ApplySandbox as the last step before launch, after
overlay and runtime overrides merge; scrubbed names logged for audit.
https://claude.ai/code/session_017Da1sAYLYpeEgogm6f9VYW
Add a section specifying that environment protection is tunable through
the same paths as every other sandbox resource: a new 'env' --sandbox-allow
type, project overlay round-trip (no schema bump), allow-only semantics,
and lockdown governance. Clarify enforcement ordering (scrub runs after
overlay and runtime overrides merge into the policy) and that there is no
violation-driven auto-suggestion for env, so discoverability comes from
audit logging.
https://claude.ai/code/session_017Da1sAYLYpeEgogm6f9VYW
Drop generic *_TOKEN / *_SECRET catch-alls from the built-in default deny
list to avoid clipping legitimate build variables. The matching engine
still supports glob patterns so users can opt into broad denies per
sandbox profile (e.g. deny: ["*_TOKEN", "AWS_*"]).
https://claude.ai/code/session_017Da1sAYLYpeEgogm6f9VYW
Add a design spec for scrubbing sensitive environment variables from
package-manager child processes, mirroring the DANGEROUS_FILES model:
built-in default deny list, per-profile allow overrides, enforced at the
ApplySandbox chokepoint. Motivated by the Miasma/Shai-Hulud toolkit's
env-based credential harvesting.
https://claude.ai/code/session_017Da1sAYLYpeEgogm6f9VYW
Claude