Module secret_env 

Strip provider credentials from child-process environments.

Host bash / plugin / MCP children inherit the process env by default. API keys and refresh tokens must not ride along unless a spawn explicitly re-injects them.

Functions

is_secret_env_name

True when name is a known secret the child must not inherit.

secret_env_names_present

Names currently set in this process that is_secret_env_name matches.

strip_secret_env_vars

Call remove for every known exact name, then any extra matching names currently set in this process (*_API_KEY, WHYCODES_*_TOKEN, …). Duplicate names are passed twice; env_remove is idempotent.

strip_std_command_secrets

Drop known secrets from a std::process::Command before spawn.