isDeniedEnvVar (executor.go)

Package daemon implements the secrets daemon that serves credentials over a Unix socket.

// Source: https://github.com/dedene/claw-wrap | License: MIT | Copyright 2026 Peter Dedene
// Provided via justclaw.it.com; keep this notice with the code.
// Package daemon implements the secrets daemon that serves credentials over a Unix socket.
package daemon

import (
	"context"
	"crypto/sha256"
	"encoding/base64"
	"errors"
	"fmt"
	"hash"
	"io"
	"log"
	"net"
	"net/url"
	"os"
	"os/exec"
	"os/user"
	"path/filepath"
	"strings"
	"sync"
	"syscall"
	"time"

	"github.com/creack/pty"

	"claw-wrap/internal/audit"
	"claw-wrap/internal/config"
	"claw-wrap/internal/credentials"
	"claw-wrap/internal/framing"
	"claw-wrap/internal/paths"
	"claw-wrap/internal/protocol"
)

// deniedEnvVars contains environment variable names that must never be
// injected via request env. These could be used to hijack

... (truncated -- full source via MCP)