full_env_requested (harness/env_sanitize.py)

Python module that scrubs credential‑like environment variables from child processes.

# Source: https://github.com/HKUDS/DeepCode | License: MIT | Copyright 2025 ✨Data Intelligence Lab@HKU✨
# Provided via justclaw.it.com; keep this notice with the code.
"""Credential-shaped environment scrubbing for spawned child processes.

Why this is its own module. The harness holds live provider credentials in its
own process environment (``.env`` is loaded by several MCP servers and written
back with ``os.environ.setdefault`` / ``os.environ[k] = v``). Every child we
spawn inherits that environment by default, and any command whose *stdout*
becomes a tool result therefore forwards the value into the next outbound
prompt — where a third-party model relay can read it in plaintext.

That is a passive-collection path, not an exotic one: a single ``env`` call is
enough to close the loop. Th

... (truncated -- full source via MCP)