@1agh/maude 0.32.1 → 0.33.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -154,7 +154,9 @@ export class AcpBridge {
|
|
|
154
154
|
// token bridge (only apps/studio/github/token.ts does), so drop the loopback
|
|
155
155
|
// keychain-bridge handle from its env. Keeps a hijacked-PATH `claude` (which
|
|
156
156
|
// would require pre-existing RCE) from reading the user's GitHub token.
|
|
157
|
+
// biome-ignore lint/performance/noDelete: security env-scrub — the key must be fully removed from the child's env, not set to `undefined` (which can leak through as `X=` on spawn).
|
|
157
158
|
delete env.MAUDE_TOKEN_ENDPOINT;
|
|
159
|
+
// biome-ignore lint/performance/noDelete: security env-scrub — see above; `delete` is the intentional primitive here.
|
|
158
160
|
delete env.MAUDE_TOKEN_KEY;
|
|
159
161
|
// Model + effort selection — config, NOT credentials, so they're added back.
|
|
160
162
|
this.activeModel = this.desiredModel;
|