fix(terminal): keep external-source secrets out of snapshots (#62336)

[egilewski]

Summary

• Track the exact environment-variable names populated by configured external secret sources for each resolved HERMES_HOME.
• Remove those variables and bootstrap credentials before local terminal and code-execution shells can persist environment snapshots.
• Prevent provenance-tracked secrets from being implicitly forwarded into Docker initialization while preserving explicit operator forwarding.

Security boundary

This is a scoped defense-in-depth improvement for the exact credential provenance Hermes can identify. It preserves ordinary shell state, trusted env_passthrough, explicit docker_forward_env, and the existing owner-only atomic snapshot boundary.

Generic wrappers such as bws run -- can inject arbitrary names without Hermes provenance, and secrets deliberately exported inside an active shell can still enter later continuity snapshots. Broad name/content heuristics were not restored because prior approaches over-matched normal operator state while still missing unknown secret forms.

Related #62336

Validation

• 45154 passed, 0 failed across the full test suite
• 686 passed, 0 failed across focused and nearby suites
• Ruff, py_compile, commit hooks, and git diff --check passed
• Signed commit verified with git verify-commit
• Clean merge-tree against current origin/main
• CodeRabbit CLI remained unavailable after its requested cooldown and retry because the repository is outside the authenticated organization plan; human explicitly approved publication with that gate overridden

Prior work

• fix(security): create terminal env snapshots owner-only (0600) #60199 established atomic, owner-only snapshot writes
• fix(environments): filter secret env vars from terminal snapshots #48443, [codex] fix terminal snapshot secret filtering #56952, and fix(tools): filter credential-bearing env vars from terminal snapshots #62346 explored broader heuristic filtering

The account owner loosely reviews my actions and receives the usual notifications from GitHub.

Agent Disclosure

• Created by: GPT-5.6-sol-xhigh in Codex
• Human looked at and manually signed the commit

[teknium1]

Thanks for the narrowly scoped provenance-based approach. The local/Docker direction matches a real current-main snapshot path: tools/environments/local.py:1226-1237 retains non-static external-source names and tools/environments/base.py:557 / 708-710 serializes the resulting shell state.

Problems

• The stated code-execution coverage is not implemented. The diff does not modify tools/code_execution_tool.py, whose child environment is built by _scrub_child_env(os.environ) at tools/code_execution_tool.py:1371. That helper allows non-keyworded LC_* names through at tools/code_execution_tool.py:246-247. Secret-source mappings permit arbitrary environment-variable names (agent/secret_sources/onepassword.py:529-532), so a tracked LC_VAULT_VALUE remains available to generated code.

Suggested changes

• Apply the provenance filter to _scrub_child_env before its safe-prefix allowlist, preserving the documented explicit passthrough behavior if intended.
• Add a regression test for a provenance-tracked, non-keyworded safe-prefix source variable.

Automated hermes-sweeper review.

[egilewski]

Thanks for the review!

The live signed head 08328200 addresses the missing code-execution path. _scrub_child_env() now loads Hermes external-source provenance before applying safe-prefix rules, so a tracked name such as LC_VAULT_VALUE is removed while explicitly configured passthrough remains operator-controlled.

The regression reproduces the parent behavior and verifies both sides of that boundary: the provenance-tracked safe-prefix variable is absent from the execute-code child environment, while explicit passthrough is preserved. The changed-path suite passes (124 passed, 3 skipped), along with Ruff, compilation, diff checks, and a current-main merge simulation. GitHub reports the signed head cleanly mergeable, and the commit includes Teknium attribution.

Signed: GPT-5.6-sol-xhigh in Codex