fix(plugin): run install-time manifest probe with a scrubbed environment

Installing a plugin runs the freshly downloaded binary once with
--plugin-manifest to read its metadata. That probe now executes with a
minimal, built-from-scratch environment (PATH, HOME, and temp-dir hints,
plus the Windows equivalents) instead of inheriting the user's full
environment, so Datum credentials, helper hooks, and cloud tokens are not
exposed to a third-party binary during install. Using an allow-list rather
than a deny-list means newly added sensitive variables stay excluded by
default.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: scotwells

internal/cmd/plugin/helpers.go

@@ -365,14 +365,50 @@ func downloadAndVerifyURI(ctx context.Context, uri, sha256hex string) ([]byte, e
 	return archiveBytes, nil
 }
 
+// minimalManifestEnv returns a minimal, scrubbed environment used when executing
+// a freshly-downloaded plugin binary to read its manifest. It is built as an
+// allow-list from scratch (rather than scrubbing the inherited environment) so
+// that sensitive variables — Datum credentials, credential-helper config, cloud
+// provider tokens, etc. — are never exposed to third-party code by default, and
+// so newly-introduced sensitive vars do not leak as they are added over time.
+//
+// Only variables a binary plausibly needs to start up and emit a manifest are
+// forwarded: a PATH to resolve any runtime/loader, a home directory, and the
+// platform temp-dir hints. Each is copied only if present in the host
+// environment.
+func minimalManifestEnv() []string {
+	// allow is the set of variable names that may be forwarded. Keep this list
+	// conservative; anything not named here is intentionally dropped.
+	allow := []string{"PATH", "HOME", "TMPDIR", "TMP", "TEMP"}
+	if runtime.GOOS == "windows" {
+		// Windows resolves the user profile and system DLLs via these.
+		allow = append(allow, "USERPROFILE", "SYSTEMROOT", "SystemRoot", "windir")
+	}
+
+	env := make([]string, 0, len(allow))
+	for _, name := range allow {
+		if v, ok := os.LookupEnv(name); ok {
+			env = append(env, name+"="+v)
+		}
+	}
+	return env
+}
+
 // readPluginManifest writes binaryPath to a temp file (if needed), runs it with
 // --plugin-manifest, and parses the JSON output. Returns nil, nil if the binary
 // exits non-zero or produces no valid JSON.
+//
+// SECURITY: this executes the (third-party, freshly-downloaded) plugin binary as
+// part of installation. Install is an explicit user action, but to shrink the
+// blast radius of running untrusted code we run it with a minimal, scrubbed
+// environment (see minimalManifestEnv) rather than the user's full environment,
+// so credentials and tokens are not exposed to the binary.
 func readPluginManifest(binaryPath string) (*pluginstore.PluginManifest, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), manifestReadTimeout)
 	defer cancel()
 
 	cmd := exec.CommandContext(ctx, binaryPath, "--plugin-manifest")
+	cmd.Env = minimalManifestEnv()
 	out, err := cmd.Output()
 	if err != nil {
 		// Non-zero exit — treat as "no manifest".

internal/cmd/plugin/helpers_env_test.go

@@ -0,0 +1,89 @@
+package plugin
+
+import (
+	"runtime"
+	"strings"
+	"testing"
+)
+
+// envHas reports whether the KEY=VALUE slice contains an entry for name.
+func envHas(env []string, name string) bool {
+	prefix := name + "="
+	for _, e := range env {
+		if strings.HasPrefix(e, prefix) {
+			return true
+		}
+	}
+	return false
+}
+
+// TestMinimalManifestEnv_includesEssentials verifies that the scrubbed
+// environment still forwards the variables a plugin binary plausibly needs to
+// start up and emit its manifest: PATH, a home directory, and the platform
+// temp-dir hint.
+func TestMinimalManifestEnv_includesEssentials(t *testing.T) {
+	t.Setenv("PATH", "/usr/bin")
+	if runtime.GOOS == "windows" {
+		t.Setenv("USERPROFILE", `C:\Users\test`)
+		t.Setenv("TEMP", `C:\Temp`)
+	} else {
+		t.Setenv("HOME", "/home/test")
+		t.Setenv("TMPDIR", "/tmp")
+	}
+
+	env := minimalManifestEnv()
+
+	if !envHas(env, "PATH") {
+		t.Errorf("minimalManifestEnv() missing PATH; got %v", env)
+	}
+
+	if runtime.GOOS == "windows" {
+		if !envHas(env, "USERPROFILE") {
+			t.Errorf("minimalManifestEnv() missing USERPROFILE on windows; got %v", env)
+		}
+		if !envHas(env, "TEMP") {
+			t.Errorf("minimalManifestEnv() missing TEMP on windows; got %v", env)
+		}
+	} else {
+		if !envHas(env, "HOME") {
+			t.Errorf("minimalManifestEnv() missing HOME; got %v", env)
+		}
+		if !envHas(env, "TMPDIR") {
+			t.Errorf("minimalManifestEnv() missing TMPDIR; got %v", env)
+		}
+	}
+}
+
+// TestMinimalManifestEnv_excludesSensitive verifies that credential and token
+// variables present in the host environment are not forwarded to the plugin
+// binary.
+func TestMinimalManifestEnv_excludesSensitive(t *testing.T) {
+	t.Setenv("DATUM_CREDENTIALS_HELPER", "secret-helper")
+	t.Setenv("DATUM_TOKEN", "super-secret-token")
+	t.Setenv("AWS_SECRET_ACCESS_KEY", "fake-aws-secret")
+
+	env := minimalManifestEnv()
+
+	for _, name := range []string{"DATUM_CREDENTIALS_HELPER", "DATUM_TOKEN", "AWS_SECRET_ACCESS_KEY"} {
+		if envHas(env, name) {
+			t.Errorf("minimalManifestEnv() leaked sensitive var %s; got %v", name, env)
+		}
+	}
+}
+
+// TestMinimalManifestEnv_isAllowList verifies the environment is built as an
+// allow-list: an arbitrary unrelated variable set in the host environment does
+// not appear in the result.
+func TestMinimalManifestEnv_isAllowList(t *testing.T) {
+	t.Setenv("FOO", "bar")
+	t.Setenv("SOME_UNRELATED_VAR", "value")
+
+	env := minimalManifestEnv()
+
+	if envHas(env, "FOO") {
+		t.Errorf("minimalManifestEnv() forwarded unrelated var FOO; got %v", env)
+	}
+	if envHas(env, "SOME_UNRELATED_VAR") {
+		t.Errorf("minimalManifestEnv() forwarded unrelated var SOME_UNRELATED_VAR; got %v", env)
+	}
+}