Security: sanitize inherited host exec env

src/agents/bash-tools.exec.ts

@@ -25,6 +25,7 @@ import {
   renderExecHostLabel,
   resolveApprovalRunningNoticeMs,
   runExecProcess,
+  sanitizeHostBaseEnv,
   execSchema,
   validateHostEnv,
 } from "./bash-tools.exec-runtime.js";
@@ -359,7 +360,8 @@ export function createExecTool(
         workdir = resolveWorkdir(rawWorkdir, warnings);
       }
 
-      const baseEnv = coerceEnv(process.env);
+      const inheritedBaseEnv = coerceEnv(process.env);
+      const baseEnv = host === "sandbox" ? inheritedBaseEnv : sanitizeHostBaseEnv(inheritedBaseEnv);
 
       // Logic: Sandbox gets raw env. Host (gateway/node) must pass validation.
       // We validate BEFORE merging to prevent any dangerous vars from entering the stream.