fix(mcp-proxy): minimize approval center child env

Start managed Approval Center processes with a bounded environment instead of inheriting the full parent shell. Cover shared, launcher, and legacy Claude lifecycle spawn paths.\n\nImplemented with assistance from Codex.

Author: oleg-bk

packages/agentveil-mcp-proxy/agentveil_mcp_proxy/agent_launcher.py

@@ -623,24 +623,12 @@ def _proxy_cli_argv(proxy_command: str, subcommand: list[str]) -> list[str]:
     return [proxy_command, *subcommand]
 
 
-def _proxy_cli_child_env() -> dict[str, str]:
+def _proxy_cli_child_env(*, passphrase_file: Path | None = None) -> dict[str, str]:
     """Return an env that lets child interpreters import this package reliably."""
 
-    env = dict(os.environ)
-    package_root_path = Path(__file__).resolve().parents[1]
-    source_roots = [str(package_root_path)]
-    repo_root = package_root_path.parents[1]
-    if (repo_root / "agentveil").is_dir():
-        source_roots.append(str(repo_root))
-    existing = env.get("PYTHONPATH")
-    if existing:
-        paths = existing.split(os.pathsep)
-        prefix = [path for path in source_roots if path not in paths]
-        if prefix:
-            env["PYTHONPATH"] = os.pathsep.join([*prefix, existing])
-    else:
-        env["PYTHONPATH"] = os.pathsep.join(source_roots)
-    return env
+    from agentveil_mcp_proxy.approval.server import _proxy_cli_child_env as _center_child_env
+
+    return _center_child_env(passphrase_file=passphrase_file)
 
 
 def _proxy_command_display(proxy_command: str) -> str:
@@ -738,7 +726,7 @@ def _spawn_approval_center(
         "stdout": log_handle,
         "stderr": log_handle,
         "close_fds": True,
-        "env": _proxy_cli_child_env(),
+        "env": _proxy_cli_child_env(passphrase_file=passphrase_file),
     }
     if os.name == "posix":
         kwargs["start_new_session"] = True

packages/agentveil-mcp-proxy/agentveil_mcp_proxy/approval/server.py

@@ -1612,21 +1612,85 @@ def _proxy_cli_argv(proxy_command: str, subcommand: list[str]) -> list[str]:
     return [proxy_command, *subcommand]
 
 
-def _proxy_cli_child_env() -> dict[str, str]:
-    env = dict(os.environ)
+_MANAGED_CENTER_ENV_KEYS = (
+    "PATH",
+    "USER",
+    "LOGNAME",
+    "SHELL",
+    "HOME",
+    "LANG",
+    "LC_ALL",
+    "LC_CTYPE",
+    "LC_MESSAGES",
+    "LC_NUMERIC",
+    "LC_TIME",
+    "TMPDIR",
+    "TEMP",
+    "TMP",
+    "TZ",
+    "TERM",
+    "SYSTEMROOT",
+    "WINDIR",
+    "COMSPEC",
+    "PATHEXT",
+    "PYTHONHOME",
+    "VIRTUAL_ENV",
+)
+
+_BLOCKED_MANAGED_CENTER_ENV_KEYS = frozenset({
+    "OPENAI_API_KEY",
+    "DEEPSEEK_API_KEY",
+    "AWS_SECRET_ACCESS_KEY",
+})
+
+_BLOCKED_MANAGED_CENTER_ENV_SUFFIXES = ("_TOKEN", "_SECRET", "_PASSWORD")
+
+
+def _managed_center_env_key_is_blocked(key: str) -> bool:
+    upper = key.upper()
+    if upper in _BLOCKED_MANAGED_CENTER_ENV_KEYS:
+        return True
+    return any(upper.endswith(suffix) for suffix in _BLOCKED_MANAGED_CENTER_ENV_SUFFIXES)
+
+
+def _managed_center_pythonpath(*, parent_env: Mapping[str, str]) -> str:
     package_root_path = Path(__file__).resolve().parents[2]
     source_roots = [str(package_root_path)]
     repo_root = package_root_path.parents[1]
     if (repo_root / "agentveil").is_dir():
         source_roots.append(str(repo_root))
-    existing = env.get("PYTHONPATH")
+    existing = parent_env.get("PYTHONPATH")
     if existing:
         paths = existing.split(os.pathsep)
         prefix = [path for path in source_roots if path not in paths]
         if prefix:
-            env["PYTHONPATH"] = os.pathsep.join([*prefix, existing])
-    else:
-        env["PYTHONPATH"] = os.pathsep.join(source_roots)
+            return os.pathsep.join([*prefix, existing])
+        return existing
+    return os.pathsep.join(source_roots)
+
+
+def _proxy_cli_child_env(
+    *,
+    passphrase_file: Path | None = None,
+    parent_env: Mapping[str, str] | None = None,
+) -> dict[str, str]:
+    """Return a bounded env for managed Approval Center child processes."""
+
+    from agentveil_mcp_proxy.identity import PASSPHRASE_ENV
+
+    source = dict(os.environ if parent_env is None else parent_env)
+    env: dict[str, str] = {}
+    for key in _MANAGED_CENTER_ENV_KEYS:
+        if _managed_center_env_key_is_blocked(key):
+            continue
+        value = source.get(key)
+        if isinstance(value, str) and value:
+            env[key] = value
+    env["PYTHONPATH"] = _managed_center_pythonpath(parent_env=source)
+    if passphrase_file is None:
+        passphrase = source.get(PASSPHRASE_ENV)
+        if isinstance(passphrase, str) and passphrase:
+            env[PASSPHRASE_ENV] = passphrase
     return env
 
 
@@ -1957,7 +2021,7 @@ def spawn_managed_approval_center_process(
         "stdout": log_handle,
         "stderr": log_handle,
         "close_fds": True,
-        "env": _proxy_cli_child_env(),
+        "env": _proxy_cli_child_env(passphrase_file=passphrase_file),
     }
     if os.name == "posix":
         kwargs["start_new_session"] = True

packages/agentveil-mcp-proxy/agentveil_mcp_proxy/claude_center_lifecycle.py

@@ -143,6 +143,9 @@ def _spawn_center(
     ]
     if passphrase_file is not None:
         args.extend(["--passphrase-file", str(passphrase_file)])
+    from agentveil_mcp_proxy.approval.server import _proxy_cli_child_env
+
+    kwargs["env"] = _proxy_cli_child_env(passphrase_file=passphrase_file)
     return subprocess.Popen(  # noqa: S603 - args constructed from validated paths
         args,
         **kwargs,

packages/agentveil-mcp-proxy/tests/test_mcp_proxy_agent_launcher.py

@@ -218,6 +218,42 @@ def fake_popen(_command, **kwargs):
     assert Path(child_home).name == "home"
 
 
+def test_launcher_approval_center_spawn_uses_bounded_env(tmp_path, monkeypatch):
+    from agentveil_mcp_proxy import agent_launcher
+    from agentveil_mcp_proxy.identity import PASSPHRASE_ENV
+
+    captured: dict[str, dict[str, str]] = {}
+
+    def fake_popen(_args, **kwargs):
+        captured["env"] = kwargs["env"]
+        return SimpleNamespace(pid=7171)
+
+    monkeypatch.setenv("OPENAI_API_KEY", PROVIDER_API_KEY)
+    monkeypatch.setenv("AWS_SECRET_ACCESS_KEY", "aws-secret")
+    monkeypatch.setenv("SECRET_TOKEN", "token-secret")
+    monkeypatch.setenv(PASSPHRASE_ENV, "passphrase-secret")
+    monkeypatch.setattr(agent_launcher.subprocess, "Popen", fake_popen)
+
+    home = tmp_path / "project" / ".avp"
+    (home / "mcp-proxy").mkdir(parents=True)
+    (home / "mcp-proxy" / "config.json").write_text("{}", encoding="utf-8")
+    passphrase_file = tmp_path / "passphrase.txt"
+    passphrase_file.write_text("passphrase-secret\n", encoding="utf-8")
+
+    agent_launcher._spawn_approval_center(
+        proxy_command="agentveil-mcp-proxy",
+        home=home,
+        passphrase_file=passphrase_file,
+    )
+
+    env = captured["env"]
+    assert "OPENAI_API_KEY" not in env
+    assert "AWS_SECRET_ACCESS_KEY" not in env
+    assert "SECRET_TOKEN" not in env
+    assert PASSPHRASE_ENV not in env
+    assert "PYTHONPATH" in env
+
+
 SECRET_COMMAND_TOKEN = "SECRET_TOKEN_DO_NOT_PERSIST_IN_MANIFEST"
 PROVIDER_API_KEY = "sk-FAKE_PROVIDER_KEY_DO_NOT_PERSIST"
 

packages/agentveil-mcp-proxy/tests/test_mcp_proxy_approval_center_lifecycle.py

@@ -6,6 +6,7 @@
 import signal
 import sys
 from pathlib import Path
+from types import SimpleNamespace
 
 import pytest
 
@@ -248,6 +249,112 @@ def test_managed_center_child_env_includes_package_root(monkeypatch):
     assert (Path(package_root) / "agentveil_mcp_proxy").is_dir()
 
 
+def test_managed_center_child_env_excludes_provider_and_generic_secrets():
+    from agentveil_mcp_proxy.approval import server
+    from agentveil_mcp_proxy.identity import PASSPHRASE_ENV
+
+    parent_env = {
+        "PATH": "/usr/bin",
+        "LANG": "C",
+        "OPENAI_API_KEY": "sk-test",
+        "DEEPSEEK_API_KEY": "sk-test",
+        "AWS_SECRET_ACCESS_KEY": "secret",
+        "SECRET_TOKEN": "secret",
+        PASSPHRASE_ENV: "pass",
+    }
+    env = server._proxy_cli_child_env(parent_env=parent_env)
+
+    assert env["PATH"] == "/usr/bin"
+    assert env["LANG"] == "C"
+    assert "OPENAI_API_KEY" not in env
+    assert "DEEPSEEK_API_KEY" not in env
+    assert "AWS_SECRET_ACCESS_KEY" not in env
+    assert "SECRET_TOKEN" not in env
+    assert env[PASSPHRASE_ENV] == "pass"
+    package_root = Path(server.__file__).resolve().parents[2]
+    assert env["PYTHONPATH"].split(os.pathsep) == _expected_child_pythonpath_roots(
+        package_root
+    )
+
+
+def test_managed_center_child_env_omits_passphrase_when_passphrase_file_used():
+    from agentveil_mcp_proxy.approval import server
+    from agentveil_mcp_proxy.identity import PASSPHRASE_ENV
+
+    parent_env = {
+        "PATH": "/usr/bin",
+        PASSPHRASE_ENV: "pass",
+        "OPENAI_API_KEY": "sk-test",
+    }
+    env = server._proxy_cli_child_env(
+        parent_env=parent_env,
+        passphrase_file=Path("/tmp/demo.passphrase"),
+    )
+
+    assert PASSPHRASE_ENV not in env
+    assert "OPENAI_API_KEY" not in env
+
+
+def test_managed_center_child_env_preserves_existing_pythonpath(monkeypatch):
+    from agentveil_mcp_proxy.approval import server
+
+    env = server._proxy_cli_child_env(
+        parent_env={"PATH": "/usr/bin", "PYTHONPATH": "existing-path"},
+    )
+    package_root = Path(server.__file__).resolve().parents[2]
+    expected_prefix = _expected_child_pythonpath_roots(package_root)
+
+    assert env["PYTHONPATH"].split(os.pathsep) == [*expected_prefix, "existing-path"]
+
+
+def test_managed_center_child_env_empty_parent_does_not_read_os_environ(monkeypatch):
+    from agentveil_mcp_proxy.approval import server
+
+    monkeypatch.setenv("PATH", "/must-not-leak")
+    monkeypatch.setenv("OPENAI_API_KEY", "sk-test")
+
+    env = server._proxy_cli_child_env(parent_env={})
+
+    assert "PATH" not in env
+    assert "OPENAI_API_KEY" not in env
+    assert env["PYTHONPATH"].split(os.pathsep) == _expected_child_pythonpath_roots(
+        Path(server.__file__).resolve().parents[2]
+    )
+
+
+def test_claude_center_spawn_uses_bounded_env(tmp_path, monkeypatch):
+    from agentveil_mcp_proxy import claude_center_lifecycle
+    from agentveil_mcp_proxy.identity import PASSPHRASE_ENV
+
+    captured: dict[str, dict[str, str]] = {}
+
+    def fake_popen(argv, **kwargs):
+        captured["env"] = kwargs["env"]
+        return SimpleNamespace(pid=999999, poll=lambda: 0)
+
+    monkeypatch.setattr(claude_center_lifecycle.subprocess, "Popen", fake_popen)
+    monkeypatch.setenv("OPENAI_API_KEY", "sk-test")
+    monkeypatch.setenv(PASSPHRASE_ENV, "pass")
+
+    home = tmp_path / "project" / ".avp"
+    home.mkdir(parents=True)
+    (home / "mcp-proxy").mkdir()
+    (home / "mcp-proxy" / "config.json").write_text("{}", encoding="utf-8")
+    passphrase_file = tmp_path / "demo.passphrase"
+    passphrase_file.write_text("secret\n", encoding="utf-8")
+
+    claude_center_lifecycle._spawn_center(
+        proxy_command=sys.executable,
+        home=home,
+        passphrase_file=passphrase_file,
+    )
+
+    env = captured["env"]
+    assert "OPENAI_API_KEY" not in env
+    assert PASSPHRASE_ENV not in env
+    assert "PATH" in env
+
+
 def test_stale_manifest_is_not_running(managed_project_home):
     _project, home, _tracker = managed_project_home
     status = inspect_managed_approval_center(home)