CommandEnvConfig
Defined in: packages/core/dist/config/types.d.ts:878
EXT-126 — the environment a spawned command receives: the built-in shell tool
(run_shell_command and the run_* dev tools) and every custom tool.
Off by default. With scrubCredentials absent or false, a spawned command inherits Gaunt
Sloth’s environment unchanged, credentials included. That is an accepted risk: anything that
prints its environment puts the operator’s keys into the tool result, which is sent to the model
provider and saved in session history. Turn scrubbing on to isolate spawned commands.
With scrubCredentials: true, every variable whose name ends in KEY, TOKEN, SECRET,
PASSWORD, PASSWD or CREDENTIALS (any case) is removed, plus a fixed list of cloud and
provider credentials no ending catches, such as AWS_ACCESS_KEY_ID. There are no built-in
exceptions; passthrough names the variables that survive.
The setting governs credentials only. The NODE_ENV Gaunt Sloth synthesises for its own renderer
is dropped from every spawned command whatever this says.
Properties
Section titled “Properties”passthrough?
Section titled “passthrough?”
optionalpassthrough?:string[]
Defined in: packages/core/dist/config/types.d.ts:885
Exact variable names kept when scrubCredentials is on, matched case-insensitively, with no
wildcards. Ignored, with a warning at config load, when scrubbing is off.
scrubCredentials?
Section titled “scrubCredentials?”
optionalscrubCredentials?:boolean
Defined in: packages/core/dist/config/types.d.ts:880
Remove credential-shaped variables from a spawned command’s environment. Default false.