@co0ontty/wand 1.21.9 → 1.21.10

package/dist/config.d.ts

@@ -7,7 +7,7 @@ import type { WandStorage } from "./storage.js";
  * 升级路径：老 JSON 里仍存有这些字段时，首次启动会被搬到 DB（见 migrateLegacyPreferencesToDb），
  * 然后下一次 saveConfig 写回 JSON 时它们会被剥离（见 stripPreferenceFields）。
  */
-export declare const PREFERENCE_KEYS: readonly ["defaultMode", "defaultCwd", "defaultModel", "structuredRunner", "language", "cardDefaults"];
+export declare const PREFERENCE_KEYS: readonly ["defaultMode", "defaultCwd", "defaultModel", "structuredRunner", "language", "cardDefaults", "inheritEnv"];
 export type PreferenceKey = (typeof PREFERENCE_KEYS)[number];
 export declare function isPreferenceKey(key: string): key is PreferenceKey;
 export declare const defaultConfig: () => WandConfig;

package/dist/config.js

@@ -19,6 +19,7 @@ export const PREFERENCE_KEYS = [
     "structuredRunner",
     "language",
     "cardDefaults",
+    "inheritEnv",
 ];
 const PREFERENCE_KEY_SET = new Set(PREFERENCE_KEYS);
 function preferenceStorageKey(key) {
@@ -43,6 +44,7 @@ export const defaultConfig = () => ({
     cardDefaults: defaultCardExpandDefaults(),
     defaultModel: "",
     structuredRunner: "cli",
+    inheritEnv: true,
     commandPresets: [
         {
             label: "Claude",
@@ -201,6 +203,10 @@ export function applyStoragePreferences(config, storage) {
         const v = storage.getPreference(preferenceStorageKey("cardDefaults"), defaults.cardDefaults);
         config.cardDefaults = normalizeCardDefaults(v);
     }
+    if (storage.hasPreference(preferenceStorageKey("inheritEnv"))) {
+        const v = storage.getPreference(preferenceStorageKey("inheritEnv"), defaults.inheritEnv ?? true);
+        config.inheritEnv = v === false ? false : true;
+    }
     return config;
 }
 /** Write a single preference value to DB and (in-place) update the live config object. */
@@ -244,6 +250,12 @@ export function writePreferenceToStorage(config, storage, key, value) {
             config.cardDefaults = normalized;
             break;
         }
+        case "inheritEnv": {
+            const v = value === false ? false : true;
+            storage.setPreference(dbKey, v);
+            config.inheritEnv = v;
+            break;
+        }
     }
 }
 function defaultCardExpandDefaults() {
@@ -349,6 +361,7 @@ function mergeWithDefaults(input) {
         cardDefaults: normalizeCardDefaults(input.cardDefaults),
         defaultModel: typeof input.defaultModel === "string" ? input.defaultModel.trim() : defaults.defaultModel,
         structuredRunner: (input.structuredRunner === "sdk" || input.structuredRunner === "cli") ? input.structuredRunner : defaults.structuredRunner,
+        inheritEnv: typeof input.inheritEnv === "boolean" ? input.inheritEnv : (defaults.inheritEnv ?? true),
     };
 }
 export function isExecutionMode(value) {

package/dist/env-utils.d.ts

@@ -0,0 +1,9 @@
+/**
+ * 根据 inheritEnv 配置组装子进程的环境变量。
+ *
+ * - inheritEnv=true（默认）：继承父进程全部 env，再合并 extras 覆盖。
+ * - inheritEnv=false：仅保留 MINIMAL_ENV_KEYS 中存在的字段，再合并 extras 覆盖。
+ *
+ * extras 中的 undefined 字段会被剔除（spawn 不允许 env 值为 undefined）。
+ */
+export declare function buildChildEnv(inheritEnv: boolean, extras?: Record<string, string | undefined>): NodeJS.ProcessEnv;

package/dist/env-utils.js

@@ -0,0 +1,47 @@
+import process from "node:process";
+/**
+ * 用于子进程 spawn 时的环境变量白名单（当用户关闭"继承环境变量"时使用）。
+ * 仅保留运行 CLI 工具所需的最小集合，避免把 API key、token 等敏感凭据继承到子命令。
+ */
+const MINIMAL_ENV_KEYS = [
+    "PATH",
+    "HOME",
+    "USER",
+    "LOGNAME",
+    "SHELL",
+    "LANG",
+    "LC_ALL",
+    "LC_CTYPE",
+    "TERM",
+    "TZ",
+    "TMPDIR",
+    "TMP",
+    "TEMP",
+    "PWD",
+];
+/**
+ * 根据 inheritEnv 配置组装子进程的环境变量。
+ *
+ * - inheritEnv=true（默认）：继承父进程全部 env，再合并 extras 覆盖。
+ * - inheritEnv=false：仅保留 MINIMAL_ENV_KEYS 中存在的字段，再合并 extras 覆盖。
+ *
+ * extras 中的 undefined 字段会被剔除（spawn 不允许 env 值为 undefined）。
+ */
+export function buildChildEnv(inheritEnv, extras = {}) {
+    const base = {};
+    if (inheritEnv) {
+        Object.assign(base, process.env);
+    }
+    else {
+        for (const key of MINIMAL_ENV_KEYS) {
+            const v = process.env[key];
+            if (typeof v === "string")
+                base[key] = v;
+        }
+    }
+    for (const [k, v] of Object.entries(extras)) {
+        if (typeof v === "string")
+            base[k] = v;
+    }
+    return base;
+}

package/dist/process-manager.js

@@ -9,6 +9,7 @@ import { SessionLogger } from "./session-logger.js";
 import { ClaudePtyBridge } from "./claude-pty-bridge.js";
 import { truncateMessagesForTransport } from "./message-truncator.js";
 import { appendWindow, hasExplicitConfirmSyntax, hasPermissionActionContext, normalizePromptText, PTY_OUTPUT_MAX_SIZE } from "./pty-text-utils.js";
+import { buildChildEnv } from "./env-utils.js";
 import { prepareSessionWorktree } from "./git-worktree.js";
 import { getResumeCommandSessionId } from "./resume-policy.js";
 function resolveProviderFromCommand(command) {
@@ -659,12 +660,11 @@ export class ProcessManager extends EventEmitter {
         try {
             child = pty.spawn(this.config.shell, shellArgs, {
                 cwd: resolvedCwd,
-                env: {
-                    ...process.env,
+                env: buildChildEnv(this.config.inheritEnv !== false, {
                     WAND_MODE: effectiveMode,
                     WAND_AUTO_CONFIRM: effectiveMode === "full-access" ? "1" : "0",
                     WAND_AUTO_EDIT: effectiveMode === "auto-edit" ? "1" : "0"
-                },
+                }),
                 name: "xterm-color",
                 // 使用 record 上由前端协商好的真实尺寸，避免"先 120 列、几百毫秒后再 resize"
                 // 期间 Claude/Codex 用错列宽渲染出 \x1b[120G 这类绝对列定位序列。

package/dist/structured-session-manager.js

@@ -4,6 +4,7 @@ import { createRequire } from "node:module";
 import { existsSync } from "node:fs";
 import { prepareSessionWorktree } from "./git-worktree.js";
 import { truncateMessagesForTransport } from "./message-truncator.js";
+import { buildChildEnv } from "./env-utils.js";
 function defaultStructuredRunner(provider) {
     return provider === "codex" ? "codex-cli-exec" : "claude-cli-print";
 }
@@ -756,7 +757,7 @@ export class StructuredSessionManager {
             const spawnedAt = new Date().toISOString();
             const child = spawn("codex", args, {
                 cwd: session.cwd,
-                env: process.env,
+                env: buildChildEnv(this.config.inheritEnv !== false),
                 stdio: ["pipe", "pipe", "pipe"],
             });
             this.logger?.appendStructuredSpawn(sessionId, {
@@ -1085,7 +1086,7 @@ export class StructuredSessionManager {
             const spawnedAt = new Date().toISOString();
             const child = spawn("claude", args, {
                 cwd: session.cwd,
-                env: process.env,
+                env: buildChildEnv(this.config.inheritEnv !== false),
                 stdio: ["pipe", "pipe", "pipe"],
             });
             this.logger?.appendStructuredSpawn(sessionId, {

package/dist/types.d.ts

@@ -93,6 +93,12 @@ export interface WandConfig {
     defaultModel?: string;
     /** 结构化会话使用的 runner: "cli"（默认，spawn claude -p）或 "sdk"（@anthropic-ai/claude-agent-sdk）。 */
     structuredRunner?: "cli" | "sdk";
+    /**
+     * 启动 PTY / 结构化子进程时是否继承父进程的环境变量（process.env）。默认 true。
+     * 关闭后子进程仅获得最小可用环境（PATH/HOME/SHELL/LANG/LC_ALL/TERM 等）外加 WAND_* 控制变量，
+     * 用于隔离敏感凭据或避免 API key 泄漏到子命令。
+     */
+    inheritEnv?: boolean;
 }
 export interface ClaudeModelInfo {
     /** 传给 --model 的值（别名或完整模型 ID） */

package/dist/web-ui/content/scripts.js

@@ -2142,6 +2142,16 @@
                   '</select>' +
                   '<p class="field-hint" style="margin-top:4px;">SDK 模式使用官方 Agent SDK 替代 CLI subprocess，接口更整洁，功能等价。保存后对新建会话立即生效。</p>' +
                 '</div>' +
+                '<div class="settings-toggle-row">' +
+                  '<div class="settings-toggle-text">' +
+                    '<label class="settings-toggle-title" for="cfg-inherit-env">继承环境变量</label>' +
+                    '<span class="settings-toggle-desc">启动 PTY / 结构化子进程时，把当前服务进程的环境变量传给 claude / codex。关闭后子进程仅获得最小可用环境（PATH/HOME/SHELL/LANG/TERM 等），可用于隔离 API key 等敏感凭据。</span>' +
+                  '</div>' +
+                  '<label class="settings-switch">' +
+                    '<input id="cfg-inherit-env" type="checkbox" class="switch-toggle" />' +
+                    '<span class="switch-slider"></span>' +
+                  '</label>' +
+                '</div>' +
                 '<div class="field">' +
                   '<label class="field-label" for="cfg-default-model">默认模型</label>' +
                   '<div class="settings-row-with-action">' +
@@ -7539,6 +7549,9 @@
             var srEl = document.getElementById("cfg-structured-runner");
             if (srEl) srEl.value = cfg.structuredRunner || "cli";
 
+            var inheritEnvEl = document.getElementById("cfg-inherit-env");
+            if (inheritEnvEl) inheritEnvEl.checked = cfg.inheritEnv !== false;
+
             // Default model
             state.configDefaultModel = cfg.defaultModel || "";
             updateSettingsDefaultModelSelect();
@@ -7598,6 +7611,7 @@
           language: (document.getElementById("cfg-language") || {}).value || "",
           defaultModel: (document.getElementById("cfg-default-model") || {}).value || "",
           structuredRunner: (document.getElementById("cfg-structured-runner") || {}).value || "cli",
+          inheritEnv: (document.getElementById("cfg-inherit-env") || {}).checked !== false,
         };
 
         var previousDefaultModel = (state.config && state.config.defaultModel) || "";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@co0ontty/wand",
-  "version": "1.21.9",
+  "version": "1.21.10",
   "description": "A web terminal for local CLI tools like Claude.",
   "type": "module",
   "bin": {