fix: env_clear() — make [agent].env a true whitelist#670

Merged

thepagent merged 9 commits intomainfrom

fix/env-clear-agent-subprocess

May 1, 2026

Commits on May 1, 2026

fix: env_clear() to prevent credential leakage to agent subprocess
chaodu-agent
committed
remove [agent].env — OAB only passes HOME and PATH to coding CLI
chaodu-agent
committed
Revert "remove [agent].env — OAB only passes HOME and PATH to coding CLI"
chaodu-agent
committed
warn when [agent].env is configured — values are exfiltration risk
chaodu-agent
committed
add security warning to helm NOTES.txt about [agent].env risk
chaodu-agent
committed
fix: add USER env var, PATH fallback, ASCII-only log message
chaodu-agent
committed
docs: clarify HOME=working_dir intent, note env override behavior

chaodu-agent
and
普渡法師
committed
fix: add Windows baseline env vars (SystemRoot, USERPROFILE, etc.)

chaodu-agent
and
覺渡法師
committed
fix: preserve real HOME/USERPROFILE instead of working_dir

chaodu-agent
and
擺渡法師
committed