@sandagent/runner-cli 0.9.21 → 0.9.23

package/dist/bundle.mjs

@@ -1603,7 +1603,7 @@ function redactSecrets(text, secrets) {
     return text;
   let result = text;
   const escapeRegex = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const values = Object.values(secrets).filter((v) => v.length >= 4).sort((a, b) => b.length - a.length);
+  const values = Object.values(secrets).filter((v) => v.length >= 8).filter((v) => !/^\//.test(v) && !/^[A-Za-z]:[/\\]/.test(v)).sort((a, b) => b.length - a.length);
   for (const v of values) {
     const ev = escapeRegex(v);
     result = result.replace(new RegExp(`^\\S+=.*${ev}.*$\\n?`, "gm"), "");
@@ -1618,6 +1618,10 @@ function redactResultContent(result, secrets) {
     result.content = result.content.map((c) => c.type === "text" && typeof c.text === "string" ? { ...c, text: redactSecrets(c.text, secrets) } : c);
   }
 }
+function isEnvDumpCommand(command) {
+  const cmd = command.replace(/\s+/g, " ").trim();
+  return /(?:^|[|;&])\s*(?:env|printenv|export\s+-p|declare\s+-x)\b/.test(cmd);
+}
 function buildEnvInjectedBashTool(cwd, extraEnv) {
   const bashAgentTool = createBashTool(cwd, {
     spawnHook: (ctx) => ({
@@ -1632,6 +1636,18 @@ function buildEnvInjectedBashTool(cwd, extraEnv) {
     // biome-ignore lint/suspicious/noExplicitAny: TypeBox schema from pi internals
     parameters: bashAgentTool.parameters,
     async execute(toolCallId, params, signal, onUpdate) {
+      const command = params.command ?? "";
+      if (isEnvDumpCommand(command)) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: "Command blocked: printing or redirecting environment variables is not allowed."
+            }
+          ],
+          details: void 0
+        };
+      }
       const result = await bashAgentTool.execute(toolCallId, params, signal, onUpdate);
       redactResultContent(result, extraEnv);
       return result;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sandagent/runner-cli",
-  "version": "0.9.21",
+  "version": "0.9.23",
   "description": "SandAgent Runner CLI - Like gemini-cli or claude-code, runs in your local terminal with AI SDK UI streaming",
   "type": "module",
   "bin": {
@@ -57,8 +57,8 @@
     "@sandagent/runner-codex": "0.6.2",
     "@sandagent/runner-gemini": "0.6.2",
     "@sandagent/runner-opencode": "0.6.2",
-    "@sandagent/runner-claude": "0.6.2",
-    "@sandagent/runner-pi": "0.6.4-beta.0"
+    "@sandagent/runner-pi": "0.6.4-beta.0",
+    "@sandagent/runner-claude": "0.6.2"
   },
   "scripts": {
     "build": "tsc && pnpm bundle",