fix: env_clear() — make [agent].env a true whitelist - #670

Merged

thepagent merged 9 commits into

mainfrom

fix/env-clear-agent-subprocess

May 1, 2026

Commits on May 1, 2026

fix: env_clear() to prevent credential leakage to agent subprocess
chaodu-agent
committed
88b0b56
remove [agent].env — OAB only passes HOME and PATH to coding CLI
chaodu-agent
committed
276cecb
Revert "remove [agent].env — OAB only passes HOME and PATH to coding CLI"
chaodu-agent
committed
adac377
warn when [agent].env is configured — values are exfiltration risk
chaodu-agent
committed
7913f79
add security warning to helm NOTES.txt about [agent].env risk
chaodu-agent
committed
71d9ab8
fix: add USER env var, PATH fallback, ASCII-only log message
chaodu-agent
committed
9234064
docs: clarify HOME=working_dir intent, note env override behavior

chaodu-agent
and
普渡法師
committed
a6ceeee
fix: add Windows baseline env vars (SystemRoot, USERPROFILE, etc.)

chaodu-agent
and
覺渡法師
committed
de41c50
fix: preserve real HOME/USERPROFILE instead of working_dir

chaodu-agent
and
擺渡法師
committed
51bc256