nicochow bbcfd368bf

fix(sandbox): scrub SSH_AUTH_SOCK from the sandbox subprocess env (#5145) ...

SSH_AUTH_SOCK points at the host's ssh-agent socket. A sandbox
subprocess that inherits it can sign and authenticate with every key
the agent holds (git push, ssh logins) without reading any key file --
the same credential-pointer leak class as the *_ASKPASS helpers the
env policy already scrubs deliberately. No wildcard pattern fits
(*AUTH* would strip benign names), so add an exact entry to
_BLOCKED_EXACT_NAMES.

A skill that genuinely needs the agent socket can still declare it via
required-secrets: injected values win over the blocklist by design.

Co-authored-by: zhouyujie <zhouyujie@keep.com>

2026-09-02 19:05:50 +08:00

..

extension-api

feat(extensions): let an out-of-tree extension observe what the agent did (#4863)

2026-08-23 09:57:12 +08:00

harness

fix(sandbox): scrub SSH_AUTH_SOCK from the sandbox subprocess env (#5145)

2026-09-02 19:05:50 +08:00