[ymote]

ADR 0004 gap review, G9 (medium-low). Follows #156 (G6).

scrub_env removed only OCTOS_* and OCTOSENSE_*. Provider keys in the shell's environment (OPENAI_API_KEY, ANTHROPIC_API_KEY, ...) and any other token reached every process app.

What changed

• An allow-list. scrub_env now clears the child's environment and passes on only inherited_var's list:

  • PATH, HOME, USER, SHELL;
  • the locale (LANG, LC_*), TERM, the temp dir, TZ;
  • the display: DISPLAY, WAYLAND_DISPLAY, XDG_*, XAUTHORITY, the session bus, the GPU loader variables;
  • Makepad's own (MAKEPAD_*, STUDIO_*);
  • what a cargo run launch needs (CARGO_HOME, RUSTUP_*, the target dir, the compilers);
  • Windows' system variables.

  What the shell sets on the command itself is kept.

• Secret-shaped names are always dropped. Whatever the list says, a name that looks like a secret is dropped from inherited and explicit variables alike: OCTOS*, *_API_KEY, *_TOKEN, *_SECRET, *_PASSWORD, *_KEY, AWS_*, ...

• Not kept on purpose: SSH_AUTH_SOCK and other agent sockets. The Terminal's login shell sets its own.

Tests

• a_child_gets_only_the_allow_list_and_never_a_key_or_token: a real child started with a fake shell environment full of keys and tokens sees none of them and none of their values. It keeps the display, locale and Makepad variables. The values are fake; no real key is read or printed.
• the_allow_list_never_admits_a_secret_shaped_name

Local checks

These all passed:

• cargo check for desktop (default and mobile-apps) and for phone (octosense-home --features mobile-apps)
• cargo test -p octosense-shell --lib on desktop and on phone
• app-peers (octos-core,ws) and ai-host (octos-core,llm) tests
• tools/check-shell-graph.sh for both shells
• tools/setup.py --check --cargo
• tools/native_apps.py --check

🤖 Generated with Claude Code