agent_block_types/
creds.rs

1//! The block host's own credential environment variables.
2//!
3//! Lives in the leaf crate so every spawn path in the workspace strips the same
4//! set: `sh.exec` children (`agent-block-core`) and MCP server subprocesses
5//! (`agent-block-mcp`).
6
7/// The block host's own credential environment variables.
8///
9/// These are removed from every child process the host spawns, so code executed
10/// by the agent — including code the agent just wrote — cannot read the host's
11/// keys.
12///
13/// The scope is deliberately narrow:
14///
15/// - Custom key env names configured per-LLM conf (`api_key_env`) are **not**
16///   covered; generalizing that belongs to a planned exec-tool redesign.
17/// - This is **not** an env allowlist. Every other variable is still inherited.
18pub const OWN_CREDENTIAL_ENV_VARS: &[&str] = &[
19    // Default key env of the anthropic provider path (blocks/agent, blocks/compile_loop).
20    "ANTHROPIC_API_KEY",
21    // Default key env of the openai-compatible provider path.
22    "OPENAI_API_KEY",
23    // Core's own mesh Ed25519 secret key (`--secret-key`).
24    "AGENT_BLOCK_MESH_SECRET_KEY",
25];
agent_block_types/creds.rs

agent_block_types/
creds.rs
