From 94cf05abf950e2f70e8ab30e55272a9e916499e6 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 5 Apr 2026 11:04:41 +0000
Subject: [PATCH] improve env variable filtering with keyword-based matching

Use keyword-based matching (SECRET, TOKEN, PASSWORD, etc.) instead of
prefix-based matching for more comprehensive sensitive env var filtering.

Agent-Logs-Url: https://github.com/HarnessLab/claw-code-agent/sessions/94dfb41f-57dd-48ea-ab0d-d2f2249ef950

Co-authored-by: abdoelsayed2016 <27821589+abdoelsayed2016@users.noreply.github.com>
---
 src/agent_tools.py | 22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/src/agent_tools.py b/src/agent_tools.py
index 36768ee..e97f79d 100644
--- a/src/agent_tools.py
+++ b/src/agent_tools.py
@@ -2224,20 +2224,28 @@ def _drain_registered_streams(
             pass
 
 
-_SENSITIVE_ENV_PREFIXES = (
-    'AWS_SECRET', 'AWS_SESSION_TOKEN',
-    'GITHUB_TOKEN', 'GH_TOKEN',
-    'OPENAI_API_KEY', 'ANTHROPIC_API_KEY',
-    'DATABASE_PASSWORD', 'DB_PASSWORD',
-    'SECRET_KEY', 'PRIVATE_KEY',
+_SENSITIVE_ENV_KEYWORDS = (
+    'SECRET',
+    'TOKEN',
+    'PASSWORD',
+    'PRIVATE_KEY',
+    'API_KEY',
+    'CREDENTIAL',
+    'AUTH',
 )
 
 
+def _is_sensitive_env_var(name: str) -> bool:
+    """Return True if the environment variable name likely contains a secret."""
+    upper = name.upper()
+    return any(keyword in upper for keyword in _SENSITIVE_ENV_KEYWORDS)
+
+
 def _build_subprocess_env(context: ToolExecutionContext) -> dict[str, str]:
     env = {
         key: value
         for key, value in os.environ.items()
-        if not any(key.upper().startswith(prefix) for prefix in _SENSITIVE_ENV_PREFIXES)
+        if not _is_sensitive_env_var(key)
     }
     env.update(context.extra_env)
     return env