Add environment variable dumping protections and expand credential scrubbing patterns

Remove env/printenv from safe bins list and add deny patterns for bare env/printenv/set/export commands that dump all environment variables including secrets. Expand credential scrubbing to detect connection strings (PostgreSQL, MySQL, MongoDB, Redis, AMQP), generic KEY=/SECRET=/CREDENTIAL= environment variables, DSN/DATABASE_URL patterns, and long hex strings (64+ chars) that may be encryption keys or hashes.

internal/tools/exec_approval.go

@@ -61,8 +61,8 @@ var safeBins = map[string]bool{
 	// Read-only / info tools
 	"cat": true, "echo": true, "ls": true, "pwd": true, "head": true,
 	"tail": true, "wc": true, "sort": true, "uniq": true, "grep": true,
-	"find": true, "which": true, "whoami": true, "date": true, "env": true,
-	"printenv": true, "uname": true, "id": true, "hostname": true,
+	"find": true, "which": true, "whoami": true, "date": true,
+	"uname": true, "id": true, "hostname": true,
 	"df": true, "du": true, "free": true, "uptime": true, "file": true,
 	"stat": true, "dirname": true, "basename": true, "realpath": true,
 	// Text processing

internal/tools/scrub.go

@@ -19,6 +19,15 @@ var credentialPatterns = []*regexp.Regexp{
 	regexp.MustCompile(`AKIA[A-Z0-9]{16}`),
 	// Generic key=value patterns (case-insensitive)
 	regexp.MustCompile(`(?i)(api[_-]?key|token|secret|password|bearer|authorization)\s*[:=]\s*["']?\S{8,}["']?`),
+
+	// Connection strings (PostgreSQL, MySQL, MongoDB, Redis, AMQP)
+	regexp.MustCompile(`(?i)(postgres|postgresql|mysql|mongodb|redis|amqp)://[^\s"']+`),
+	// Generic KEY=/SECRET=/CREDENTIAL= env-var patterns (skip already-redacted [REDACTED] values)
+	regexp.MustCompile(`(?i)[A-Z_]*(KEY|SECRET|CREDENTIAL|PRIVATE)[A-Z_]*\s*=\s*[^\[\s]{8,}`),
+	// DSN/DATABASE_URL env vars (skip already-redacted values)
+	regexp.MustCompile(`(?i)(DSN|DATABASE_URL|REDIS_URL|MONGO_URI)\s*=\s*[^\[\s]{8,}`),
+	// Long hex strings (64+ chars) — likely encryption keys, hashes, or secrets
+	regexp.MustCompile(`[a-fA-F0-9]{64,}`),
 }
 
 const redactedPlaceholder = "[REDACTED]"

internal/tools/shell.go

@@ -107,6 +107,16 @@ var defaultDenyPatterns = []*regexp.Regexp{
 	// ── Process manipulation ──
 	regexp.MustCompile(`\bkill\s+-9\s`),
 	regexp.MustCompile(`\b(killall|pkill)\b`),
+
+	// ── Environment variable dumping ──
+	// Bare env/printenv/set/export dumps all vars including secrets (API keys, DSN, encryption keys).
+	// 'env VAR=val cmd' (env with assignment before command) is still allowed.
+	regexp.MustCompile(`^\s*env\s*$`),                                     // bare 'env'
+	regexp.MustCompile(`^\s*env\s*\|`),                                    // 'env | ...' (piped)
+	regexp.MustCompile(`^\s*env\s*>\s`),                                   // 'env > file'
+	regexp.MustCompile(`\bprintenv\b`),                                    // any printenv usage
+	regexp.MustCompile(`^\s*(set|export\s+-p|declare\s+-x)\s*($|\|)`),     // shell var dumps
+	regexp.MustCompile(`\bcompgen\s+-e\b`),                                // bash env completion dump
 }
 
 // ExecTool executes shell commands, optionally inside a sandbox container.