Module secrets 

Which environment variables agent-supplied code may see.

Two different questions live here, and they want opposite shapes:

1. What does a child process inherit? (child_env_allowed) We are choosing what to hand over, so an allowlist is right. A denylist here has to enumerate every secret name in the ecosystem and loses the moment a new one appears - which is exactly what happened: the MCP spawner’s substring denylist passed AWS_SECRET_ACCESS_KEY (it matches neither API_SECRET nor SECRET_KEY), GITHUB_TOKEN, NPM_TOKEN, DATABASE_URL, and Leviath’s own LEVIATH_API_TOKEN.

2. May a script read this named variable? (is_sensitive_env_name) A script asks for one name it already knows. An allowlist cannot work - no fixed list covers every legitimate variable a provider script might read - so the rule inverts: anything that looks like a credential is refused unless the user allowlisted it, and everything else is fine.

Neither is a substitute for the other, and both are shared rather than reimplemented per call site so a gap gets fixed once.

Functions

child_env_allowed

Whether a spawned child process may inherit name.

constant_time_eq

Compare two secrets without leaking their contents through timing.

is_secret_header

Whether a header’s value must be redacted before it is logged.

is_sensitive_env_name

Whether name looks like it holds a credential.

redact

Render a secret for display, showing only its last four characters.

script_env_allowed

Whether a script may read name, given the user’s [security] allow_env_vars.