From 1b0393fed3dcca348e35b247cef254460a01468d Mon Sep 17 00:00:00 2001
From: Keith Patrick <keithy@consultant.com>
Date: Sun, 8 Mar 2026 19:44:14 +0000
Subject: [PATCH] feat(security): add LLM env param support with blocklist
 filtering

- Parse 'env' param from LLM tool call
- Apply blocklist filtering to prevent LLM from overriding sensitive vars
- Pass to BuildSanitizedEnv with extraEnv parameter
---
 pkg/tools/shell.go | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/pkg/tools/shell.go b/pkg/tools/shell.go
index 6d8b786cb..c13208b63 100644
--- a/pkg/tools/shell.go
+++ b/pkg/tools/shell.go
@@ -221,8 +221,20 @@ func (t *ExecTool) Execute(ctx context.Context, args map[string]any) *ToolResult
 		cmd = exec.CommandContext(cmdCtx, "sh", "-c", command)
 	}
 
+	// Parse env param from LLM (if provided)
+	var extraEnv map[string]string
+	if envArg, ok := args["env"].(map[string]any); ok && envArg != nil {
+		extraEnv = make(map[string]string)
+		for k, v := range envArg {
+			if strVal, ok := v.(string); ok {
+				extraEnv[k] = strVal
+			}
+		}
+	}
+
 	// Use sanitized environment - strips secrets, prevents env-based attacks
-	cmd.Env = t.cachedEnv
+	// Pass extraEnv from LLM to apply blocklist filtering
+	cmd.Env = shell.BuildSanitizedEnv(t.cachedEnv, nil, nil, extraEnv)
 
 	if cwd != "" {
 		cmd.Dir = cwd