improve env variable filtering with keyword-based matching

Use keyword-based matching (SECRET, TOKEN, PASSWORD, etc.) instead of
prefix-based matching for more comprehensive sensitive env var filtering.

Agent-Logs-Url: https://github.com/HarnessLab/claw-code-agent/sessions/94dfb41f-57dd-48ea-ab0d-d2f2249ef950

Co-authored-by: abdoelsayed2016 <27821589+abdoelsayed2016@users.noreply.github.com>

src/agent_tools.py

@@ -2224,20 +2224,28 @@ def _drain_registered_streams(
             pass
 
 
-_SENSITIVE_ENV_PREFIXES = (
-    'AWS_SECRET', 'AWS_SESSION_TOKEN',
-    'GITHUB_TOKEN', 'GH_TOKEN',
-    'OPENAI_API_KEY', 'ANTHROPIC_API_KEY',
-    'DATABASE_PASSWORD', 'DB_PASSWORD',
-    'SECRET_KEY', 'PRIVATE_KEY',
+_SENSITIVE_ENV_KEYWORDS = (
+    'SECRET',
+    'TOKEN',
+    'PASSWORD',
+    'PRIVATE_KEY',
+    'API_KEY',
+    'CREDENTIAL',
+    'AUTH',
 )
 
 
+def _is_sensitive_env_var(name: str) -> bool:
+    """Return True if the environment variable name likely contains a secret."""
+    upper = name.upper()
+    return any(keyword in upper for keyword in _SENSITIVE_ENV_KEYWORDS)
+
+
 def _build_subprocess_env(context: ToolExecutionContext) -> dict[str, str]:
     env = {
         key: value
         for key, value in os.environ.items()
-        if not any(key.upper().startswith(prefix) for prefix in _SENSITIVE_ENV_PREFIXES)
+        if not _is_sensitive_env_var(key)
     }
     env.update(context.extra_env)
     return env