🛡️ Sentinel: [CRITICAL] Fix execa framework secrets leakage via extendEnv

src/cli/authorization/non-interactive.ts

@@ -11,6 +11,7 @@ import type {
 import {
   getLogger,
   McpConnectionManager,
+  sanitizeEnvironment,
 } from '../../core/facades/cli-authorization-non-interactive.js';
 import { isRecord } from '../../core/facades/cli-utils-serialize.js';
 import { text } from '../locales/index.js';
@@ -101,6 +102,8 @@ export async function requestNonInteractiveAuthorizationDecision(params: {
         shell: true,
         timeout: timeoutMs,
         reject: false,
+        env: sanitizeEnvironment(process.env),
+        extendEnv: false,
       });
 
       if (typeof res.exitCode === 'number' && res.exitCode !== 0) {

src/core/facades/cli-authorization-non-interactive.ts

@@ -6,3 +6,5 @@ export type {
   AuthorizationDecision,
   ToolAuthorizationRequest,
 } from '../tools/authorization/types.js';
+
+export { sanitizeEnvironment } from '../utils/sanitizer.js';

src/core/tools/capability/runner.ts

@@ -1,5 +1,6 @@
 import { execa } from 'execa';
 
+import { sanitizeEnvironment } from '../../utils/sanitizer.js';
 import { ExecOpts, ExecResult } from './types.js';
 
 /**
@@ -15,7 +16,8 @@ export function createControlledRunner() {
           cwd: opts?.cwd,
           timeout: opts?.timeoutMs,
           maxBuffer: opts?.maxStdoutBytes,
-          env: opts?.env,
+          env: sanitizeEnvironment(opts?.env ? { ...process.env, ...opts.env } : process.env),
+          extendEnv: false,
           reject: false, // Backends should handle exit codes themselves
         });