Enum ShellEnvMode 

pub enum ShellEnvMode {
    Filtered,
    Strict,
    Custom,
    Inherit,
}

How much of the daemon’s environment a shell tool inherits.

A fourth question again, and a fourth shape. A shell tool is a child we hand over to, like an MCP server - but unlike one, it must keep behaving like the user’s own shell, so child_env_allowed’s 28-name allowlist is wrong here: it would strip CARGO_HOME, JAVA_HOME, NVM_DIR, VIRTUAL_ENV, GOPATH and break every real toolchain. The name-shape denylist is the right instrument, and the only real question is how far it reaches.

Be honest about what this buys. With cat and grep on the default safe list, a granted shell can read ~/.leviath/config.toml and find the provider key anyway. This is defence in depth against accidental leakage - an env dump in tool output, a printenv in a log, a subprocess that phones home - and it closes the seed-command case, where nothing was ever approved. It is not a boundary.

Variants

Filtered

Withhold credential-shaped names, but hand over SSH_AUTH_SOCK.

The carve-out is deliberate and is why this can be the default: the agent socket is on the credential-name list, and withholding it breaks git push over agent keys, which is one of the most ordinary things an agent does in a shell.

Strict

The full name-shape denylist, SSH_AUTH_SOCK included - and with it AWS_PROFILE, AWS_REGION, KUBECONFIG, NETRC. Breaks git push, aws and kubectl in a shell tool until those names are listed in [security] allow_env_vars.

Custom

Ignore the shape heuristic entirely: withhold exactly what [security] shell_env_withhold names, and nothing else. For an environment whose variable names the heuristic reads wrong in either direction.

Inherit

Hand the whole environment over, as before this setting existed.

Trait Implementations

impl Clone for ShellEnvMode

fn clone(&self) -> ShellEnvMode

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for ShellEnvMode

impl Debug for ShellEnvMode

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ShellEnvMode

fn default() -> ShellEnvMode

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for ShellEnvMode

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for ShellEnvMode

impl PartialEq for ShellEnvMode

fn eq(&self, other: &ShellEnvMode) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for ShellEnvMode

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for ShellEnvMode