Skip to content

fix: Explicitly disallow reading .env file contents, add local-only .env write tool - #263

Merged
daniloc merged 10 commits into
mainfrom
clean-up-env-handling
Feb 9, 2026
Merged

fix: Explicitly disallow reading .env file contents, add local-only .env write tool#263
daniloc merged 10 commits into
mainfrom
clean-up-env-handling

Conversation

@daniloc

@daniloc daniloc commented Feb 6, 2026

Copy link
Copy Markdown
Collaborator

Adds a new tool that can check for the presence of keys, but not read their values, and also write new key/value pairs and ensure the .env file is properly git ignored.

Meanwhile:

  • Read/Write/Edit: Deny when file_path basename starts with .env
  • Grep: Deny when path directly targets a .env* file (broad directory searches are safe — ripgrep skips dotfiles by default)
  • Arbitrary bash commands: Already covered by positive allowlist (only specific commands allowed)

@daniloc
daniloc requested a review from edwinyjlim February 6, 2026 22:05
Comment thread src/lib/env-file-tools.ts
Comment thread src/lib/agent-interface.ts
@daniloc
daniloc requested a review from Piccirello February 9, 2026 19:53
@PostHog PostHog deleted a comment from github-actions Bot Feb 9, 2026

@Piccirello Piccirello left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice touch!

Comment thread src/lib/env-file-tools.ts Outdated
@daniloc daniloc changed the title Explicitly disallow reading .env file contents, add local .env write tool fix: Explicitly disallow reading .env file contents, add local .env write tool Feb 9, 2026
@daniloc daniloc changed the title fix: Explicitly disallow reading .env file contents, add local .env write tool fix: Explicitly disallow reading .env file contents, add local-only .env write tool Feb 9, 2026
@daniloc
daniloc merged commit 5e6bbe7 into main Feb 9, 2026
14 checks passed
@daniloc
daniloc deleted the clean-up-env-handling branch February 9, 2026 22:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants