disclaw

dev/disclaw

Fork 0

Commit graph

Author	SHA1	Message	Date
Nick Tabeling	510969b2d1	fix(runner): add sanitizedEnv, remove process.env passthrough Introduces src/runtime/env.ts with a pure sanitizedEnv() function that strips DISCORD_BOT_TOKEN, DISCORD_CLIENT_SECRET, DISCORD_PUBLIC_KEY, and all keys matching /^(DISCLAW_SECRET_\|SECRET_\|TOKEN_\|API_KEY_?)/i before passing the environment to spawned Claude Code child processes. Adds optional env_blocklist field to DisclawConfig. Runner now passes DISCLAW_AGENT_NAME and respects the blocklist. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-09 10:39:06 +02:00
Nick Tabeling	bade6d07f6	fix(runner): replace shell:true with cross-spawn, add resolveClaude - Remove shell:true from runner.ts (command injection vector closed) - Import cross-spawn instead of child_process.spawn; add windowsHide:true - Add src/runtime/resolve-claude.ts: CLAUDE_PATH env override, where/which PATH fallback, in-memory cache, clear error message on not-found - Add tests/unit/resolve-claude.test.ts: 5 Vitest tests covering env override, PATH fallback, multi-line output trimming, error case, and cache behaviour - Add cross-spawn + @types/cross-spawn to package.json; add vitest + test script	2026-04-09 10:29:58 +02:00

Author

SHA1

Message

Date

Nick Tabeling

510969b2d1

fix(runner): add sanitizedEnv, remove process.env passthrough

Introduces src/runtime/env.ts with a pure sanitizedEnv() function that
strips DISCORD_BOT_TOKEN, DISCORD_CLIENT_SECRET, DISCORD_PUBLIC_KEY, and
all keys matching /^(DISCLAW_SECRET_|SECRET_|TOKEN_|API_KEY_?)/i before
passing the environment to spawned Claude Code child processes. Adds
optional env_blocklist field to DisclawConfig. Runner now passes
DISCLAW_AGENT_NAME and respects the blocklist.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-04-09 10:39:06 +02:00

Nick Tabeling

bade6d07f6

fix(runner): replace shell:true with cross-spawn, add resolveClaude

- Remove shell:true from runner.ts (command injection vector closed)
- Import cross-spawn instead of child_process.spawn; add windowsHide:true
- Add src/runtime/resolve-claude.ts: CLAUDE_PATH env override, where/which
  PATH fallback, in-memory cache, clear error message on not-found
- Add tests/unit/resolve-claude.test.ts: 5 Vitest tests covering env override,
  PATH fallback, multi-line output trimming, error case, and cache behaviour
- Add cross-spawn + @types/cross-spawn to package.json; add vitest + test script

2026-04-09 10:29:58 +02:00

2 commits