DIS-003: sanitizedEnv() -- Secrets aus Child-Env entfernen #22

Closed

dev wants to merge 2 commits from phase-0/sanitize-env into main

Author	SHA1	Message	Date
dev	314c22af99	Merge branch 'main' into phase-0/sanitize-env	2026-04-09 09:00:53 +00:00
Nick Tabeling	eb30a9c945	fix(runner): add sanitizedEnv, remove process.env passthrough Introduces src/runtime/env.ts with a pure sanitizedEnv() function that strips DISCORD_BOT_TOKEN, DISCORD_CLIENT_SECRET, DISCORD_PUBLIC_KEY, and all keys matching /^(DISCLAW_SECRET_\|SECRET_\|TOKEN_\|API_KEY_?)/i before passing the environment to spawned Claude Code child processes. Adds optional env_blocklist field to DisclawConfig. Runner now passes DISCLAW_AGENT_NAME and respects the blocklist. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-09 10:39:16 +02:00

Author

SHA1

Message

Date

dev

314c22af99

Merge branch 'main' into phase-0/sanitize-env

2026-04-09 09:00:53 +00:00

Nick Tabeling

eb30a9c945

fix(runner): add sanitizedEnv, remove process.env passthrough

Introduces src/runtime/env.ts with a pure sanitizedEnv() function that
strips DISCORD_BOT_TOKEN, DISCORD_CLIENT_SECRET, DISCORD_PUBLIC_KEY, and
all keys matching /^(DISCLAW_SECRET_|SECRET_|TOKEN_|API_KEY_?)/i before
passing the environment to spawned Claude Code child processes. Adds
optional env_blocklist field to DisclawConfig. Runner now passes
DISCLAW_AGENT_NAME and respects the blocklist.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-04-09 10:39:16 +02:00