fix(security): strip Bedrock inference bearer token from subprocess env (#32314)

[teknium1]

The bug (confirmed live on main)

bedrock's ProviderConfig declares api_key_env_vars=() because it uses
auth_type="aws_sdk" (boto3 credential chain). _build_provider_env_blocklist()
only consults api_key_env_vars, and there were zero AWS_* entries in the
hardcoded set. Net effect: every other provider's key is stripped from
terminal/execute_code subprocess env, but a Bedrock user's
AWS_BEARER_TOKEN_BEDROCK leaked into every child process — the reporter
caught it when opencode models run inside a Hermes terminal enumerated the
entire Bedrock catalog off the leaked bearer token.

Closes #32314.

The fix — narrow, no capability regression

Strip only AWS_BEARER_TOKEN_BEDROCK, the Bedrock-specific Hermes
inference secret (exactly analogous to OPENAI_API_KEY). The strip is keyed
off auth_type=="aws_sdk", so it is self-healing — any future SDK-cred
provider is covered automatically without editing a list.

The general AWS credential chain (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY,
AWS_SESSION_TOKEN, AWS_PROFILE, region/config/role pointers) is
intentionally left inheritable. Per SECURITY.md §3.2 the local terminal is
the user's trusted operator shell; the agent having the same general AWS access
the user's own shell has is the intended posture.

Hard-blocklisting the full chain (as the original PRs in this cluster did) would:

1. Regress every user, not just Bedrock users — PROVIDER_REGISTRY is
   iterated unconditionally at import, so the aws_sdk branch fires for
   everyone. A pure-OpenAI user running aws s3 cp / terraform apply / a
   boto3 script in the agent terminal would lose their creds for no security
   benefit.
2. Be unrecoverable — tools/env_passthrough.py refuses to re-allow
   anything in _HERMES_PROVIDER_ENV_BLOCKLIST (GHSA-rhgp-j443-p4rf), so there
   is no config or skill escape hatch. Capability gone, permanently.

Verification

Live E2E (real bash subprocess via LocalEnvironment.execute(), AWS vars
actually in os.environ — not mocked):

STRIPPED:    AWS_BEARER_TOKEN_BEDROCK, OPENAI_API_KEY
PRESERVED:   AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN,
             AWS_PROFILE, AWS_DEFAULT_REGION

Tests (tests/tools/test_local_env_blocklist.py, all 22 pass):

• test_bedrock_bearer_token_is_stripped — the [Bug]: auth_type="aws_sdk" never feeds into subprocess credential blocklist; AWS env vars leak to terminal/execute_code #32314 leak is closed
• test_general_aws_credential_chain_is_preserved — no-regression guard
• test_bedrock_bearer_token_is_in_blocklist
• test_general_aws_chain_not_in_blocklist — no-regression guard

Salvage / attribution

Built on @zapabob's #34387 (the self-healing auth_type=="aws_sdk" mechanism),
narrowed to bearer-token-only. Supersedes #34387, #32319 (@briandevans),
#32402 (@leavedrop), #32374 (@HiddenPuppy) — all four implemented the same
fix but hard-blocklisted the full AWS chain, which trips the regression above.

Co-authored-by: zapabob 1920071390@campus.ouj.ac.jp

[github-actions]

🔎 Lint report: fix/32314-bedrock-bearer-token-strip vs origin/main

ruff

Total: 0 on HEAD, 0 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 0 pre-existing issues carried over.

ty (type checker)

Total: 9439 on HEAD, 9439 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 4898 pre-existing issues carried over.

Diagnostics are surfaced as warnings — this check never fails the build.