Module child_proc 

Spawning child processes from tools: the environment they inherit, and waiting on them without leaking a live process.

apollo’s own process environment holds every secret the operator put in .env — the generated run.sh does set -a; source .env; set +a, so ANTHROPIC_API_KEY, GITHUB_TOKEN and the channel tokens are all exported. The file sandbox refuses to read .env, which is worth nothing if exec can simply run env.

A deny-list is used rather than an allow-list on purpose. Ordinary tool use depends on a long and open-ended tail of environment: CARGO_HOME, RUSTUP_HOME, GOPATH, NVM_, PKG_CONFIG_PATH, SSH_AUTH_SOCK, XDG_, LC_*, HTTP(S)_PROXY, VIRTUAL_ENV, CI markers. An allow-list would break those silently and be re-widened until it stopped meaning anything, whereas secret-bearing names are conventional and few.

Functions

child_env

apollo’s environment with every secret-bearing variable removed.

is_secret_env_name

True when a variable must not reach a child process.

scrub

Apply the filtered environment to a command, clearing the inherited one first so nothing new leaks in by default.

wait_with_timeout

Wait for a child, reading both pipes concurrently so a chatty command cannot deadlock by filling a pipe buffer, and killing it if the deadline passes.