fix(security): block gateway secrets from subprocess env

[zapabob]

Summary

This red-team hardening extends subprocess environment scrubbing for gateway/runtime secrets.

• Adds gateway credential names from the current open subprocess-secret PR family.
• Also covers secret-like _EXTRA_ENV_KEYS that were still missing from _HERMES_PROVIDER_ENV_BLOCKLIST: LANGFUSE_SECRET_KEY, QQ_STT_API_KEY, and TERMINAL_SSH_KEY.
• Adds an invariant test so future secret-like _EXTRA_ENV_KEYS do not drift out of the subprocess blocklist.
• Makes one subprocess HOME isolation assertion path-separator neutral for native Windows test runs.
• Skips the Homebrew PATH augmentation assertion on native Windows, where that POSIX path behavior is not applicable.

Relationship to #35769

This is intentionally still a draft while #35769 is open. If #35769 lands first, I will rebase this branch down to the non-duplicate residual slice only: the _EXTRA_ENV_KEYS secret coverage, the invariant test, and the Windows-native test portability fixes.

Complementary context:

• fix(gateway): scrub subprocess credential env #35769 handles the core gateway subprocess credential-env advisory surface.
• fix(approval): keep gateway tirith scan under yolo #35813 handles a separate pre-execution scanner/yolo approval path.
• This branch is only about subprocess environment leakage and test portability.

Verification

Fresh checks after rebasing onto current upstream/main (1fc7bdc5e):

• uv run --extra dev ruff check tools/environments/local.py tests/tools/test_local_env_blocklist.py tests/test_subprocess_home_isolation.py -> All checks passed!
• uv run --extra dev python -X utf8 -m pytest tests/tools/test_local_env_blocklist.py tests/test_subprocess_home_isolation.py -q --timeout-method=thread -> 39 passed, 1 skipped
• uv run --extra dev ruff check . -> All checks passed!
• git diff --check upstream/main..HEAD -> no whitespace errors

[tonydwb]

Code Review Summary — PR #35798

Verdict: Comment (Draft PR — preliminary review)

Author: zapabob | Type: security/hardening | Files: tools/environments/local.py, tests/tools/test_local_env_blocklist.py, tests/test_subprocess_home_isolation.py

Review Findings

✅ Looks Good

• All added env vars correctly belong in the subprocess blocklist (DingTalk, Feishu, WeCom, Weixin, Yuanbao secrets, matrix password, Twilio auth, QQ STT API key, terminal SSH key, Langfuse secret key).
• test_secret_extra_env_keys_are_in_blocklist is an excellent invariant test that prevents future _EXTRA_ENV_KEYS entries from leaking out of the blocklist. It scans for keys containing sensitive markers (TOKEN, SECRET, PASSWORD, API_KEY, etc.).
• test_gateway_credentials_are_stripped_from_all_local_env_paths tests both _make_run_env and _sanitize_subprocess_env code paths — good coverage.
• Windows-native test fix (path parts instead of endswith) is sensible and improves portability.
• The pytest.mark.skipif(sys.platform == "win32") on the Homebrew test prevents a test failure on native Windows.

ℹ️ Note: This PR is a draft. If #35769 lands first, this branch can be rebased down. The invariant test and Windows fix are the most valuable standalone pieces.

---

Reviewed by Hermes Agent

[tonydwb]

Code Review Summary

Verdict: Comment (Draft PR — note: this PR is currently a draft)

✅ What's Good

• Comprehensive subprocess env scrubbing: Adds ~25 new credential env vars to _HERMES_PROVIDER_ENV_BLOCKLIST, covering DingTalk, Feishu, WeCom, Weixin, Yuanbao, Matrix, Twilio, QQ STT, Terminal SSH, and Langfuse. This closes real subprocess credential leakage vectors.
• Invariant test: test_secret_extra_env_keys_are_in_blocklist detects future drift between _EXTRA_ENV_KEYS and the blocklist — excellent engineering discipline.
• Dual-path coverage: The new test_gateway_credentials_are_stripped_from_all_local_env_paths tests BOTH _make_run_env and _sanitize_subprocess_env — thorough.
• Windows portability: Good use of Path.parts and sys.platform == "win32" skip to support native Windows test runs.

💡 Suggestions (non-blocking)

• Consider extracting the credential names into a shared data structure rather than maintaining two parallel lists (blocklist + tests). The invariant test helps, but a single source of truth would be ideal for future PRs.

Summary

This is a well-structured security hardening PR. The invariant test is especially valuable for preventing future drift. I'll leave this as COMMENT since it's still a draft and depends on #35769.

---

Reviewed by Hermes Agent

[teknium1]

Thanks for the focused subprocess-hardening work. The terminal/background premise still holds on current main for residual _EXTRA_ENV_KEYS such as TERMINAL_SSH_KEY, QQ_STT_API_KEY, and LANGFUSE_SECRET_KEY (hermes_cli/config.py:288-313; tools/environments/local.py:397,848).

Problems

• Current main has a later non-terminal spawn helper: tools/environments/local.py:519-522 skips Tier-2 blocklist removal when inherit_credentials=True. Both agent/copilot_acp_client.py:106 and agent/transports/codex_app_server.py:90 use that mode. Because this PR only adds names to the Tier-2 blocklist, those children would still inherit the added gateway/runtime credentials.
• The added coverage tests _make_run_env and _sanitize_subprocess_env, but not the credential-inheriting helper path above.

Suggested changes

• Ensure the sensitive additions are removed for inherit_credentials=True too, while preserving the intended provider-credential inheritance contract.
• Add a regression test for hermes_subprocess_env(inherit_credentials=True) alongside the terminal/background tests.

Automated hermes-sweeper review.

[andrexibiza]

Bound to the child-process credential-inheritance class under #83565 (#83565) — same bug class, different surface. gateway secrets from subprocess env; Wave B — shares tools/environments/local.py with the anchor fix. The EPIC carries the live class table, dedup adjudication, and the dependency-driven merge order.