Documentation
¶
Overview ¶
Package envscrub builds the SECRET-neutralised process environment every agent-facing command shell runs with. It is a stdlib-only leaf — it imports nothing from the rest of the codebase — so the composition root can layer it under the git-neutralising gitenv.Scrub without creating an adapter→adapter edge.
The threat it addresses (security review "Finding B"): the Bash tool runs a child shell, and under posture `auto`/`yolo` (allow-all) the model can run `echo $OPENROUTER_API_KEY` or `cat /proc/self/environ` and exfiltrate the provider/auth credentials the harness was started with via a tool result or a committed file. The osfs Read tool is workspace-confined, but the shell child inherited os.Environ() VERBATIM, so the prompt fence did not contain it. This package removes the harness's credentials from the child env BEFORE the shell ever sees them.
Policy (a precise DENYLIST, not an allowlist): the child environment is os.Environ() MINUS
- every MECATL_* variable, including explicit harness credentials, so agent-facing shells cannot inherit harness-owned configuration or credentials (the MECATL_ prefix); and
- any variable whose NAME matches a conservative secret-SHAPED pattern (DenyPattern — *_API_KEY / *_TOKEN / *_SECRET / *_PASSWORD / *_PASSWD / AWS_* / AZURE_* / GOOGLE_APPLICATION_CREDENTIALS) as defence-in-depth.
A denylist (not an allowlist) is deliberate: a coding agent runs `go build`, `go test`, and `git`, which need PATH, HOME, GOPATH, GOCACHE, GOMODCACHE, TMPDIR, LANG and an open-ended set of toolchain variables to function. An allowlist would have to enumerate that set and would silently break a build the moment a tool needed an env var nobody listed. We are precise about the secrets WE injected (DenyExact) and conservative about secret-SHAPED names we did not inject (DenyPattern); everything else — the whole toolchain — survives.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var DenyExact = map[string]struct{}{
"OPENAI_API_KEY": {},
"OPENROUTER_API_KEY": {},
"ANTHROPIC_API_KEY": {},
"WEBSEARCH_API_KEY": {},
"BRAVE_API_KEY": {},
"EXA_API_KEY": {},
"MECATL_AUTH_TOKEN": {},
"MECATL_DRIVER_AUTH_TOKEN": {},
"GH_TOKEN": {},
"GITHUB_TOKEN": {},
}
DenyExact is the canonical set of EXACT environment-variable names the harness reads as credentials or harness-owned configuration. These are the keys WE inject, so there is no guessing. Every MECATL_* name is scrubbed by IsSecretName, including future environment-backed credentials that are not individually listed here. The provider keys are the same names internal/cliconfig.ReadProviderKeys reads; the websearch/auth/driver-auth tokens are read by cmd/mecated. Keeping the list here (a leaf with no cmd dependency) lets the composition root scrub them out of the agent shell without importing cmd or cliconfig.
They are matched case-SENSITIVELY (env-var names are conventionally upper-case and the harness reads these exact spellings).
Functions ¶
func IsSecretName ¶
IsSecretName reports whether an environment-variable name should be scrubbed from the agent shell: it has the MECATL_ prefix, is in DenyExact, matches a secret-shaped suffix or prefix, or is one of the few fixed cloud-credential names that fit no pattern.
func Scrub ¶
Scrub returns a process environment derived from base (typically os.Environ()) with every secret variable (per IsSecretName) DROPPED. Every other inherited variable — PATH, HOME, GOPATH, GOCACHE, GOMODCACHE, TMPDIR, LANG, and the rest of the toolchain — is kept verbatim, so `go build`/`go test`/`git` still work. A malformed entry with no '=' is dropped defensively (exec would reject it).
Types ¶
This section is empty.
Source Files