feat(cli): warn when --env values look like credentials (#2655)

letv1nnn · web-flow · commit dd2b4e3bc068 · 2026-08-11T21:40:55.000Z
* feat(cli): add credential env match validation

Signed-off-by: Artem Lytvyn &lt;alytvyn@redhat.com&gt;

* feat(cli): warn when --env values look like credentials

Signed-off-by: Artem Lytvyn &lt;alytvyn@redhat.com&gt;

* docs(sandbox): add flag --no-credential-warnings details + polishing

Signed-off-by: Artem Lytvyn &lt;alytvyn@redhat.com&gt;

* fix(cli): match credential keywords on underscore segments

Signed-off-by: Artem Lytvyn &lt;alytvyn@redhat.com&gt;

---------

Signed-off-by: Artem Lytvyn &lt;alytvyn@redhat.com&gt;
diff --git a/crates/openshell-cli/src/commands/common.rs b/crates/openshell-cli/src/commands/common.rs
@@ -16,12 +16,15 @@ use openshell_core::proto::{
     PlatformEvent, SandboxPhase, SandboxPolicy, SettingValue, setting_value,
 };
 use openshell_core::settings::{self, SettingValueKind};
+use openshell_providers::builtin_profiles;
 use owo_colors::OwoColorize;
 use std::collections::HashMap;
 use std::io::IsTerminal;
 use std::process::Command;
 use std::time::{Duration, Instant};
 
+const DOCS_PROVIDERS_URL: &str = "https://docs.nvidia.com/openshell/latest/sandboxes/providers-v2";
+
 // ---------------------------------------------------------------------------
 // View types
 // ---------------------------------------------------------------------------
@@ -743,6 +746,96 @@ pub fn parse_duration_to_ms(s: &str) -> Result<i64> {
 // Parsing utilities
 // ---------------------------------------------------------------------------
 
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ProfileSuggestion {
+    pub provider_type: String,
+    pub credential: String,
+}
+
+fn credential_env_matches(env: &HashMap<String, String>) -> Vec<(String, Vec<ProfileSuggestion>)> {
+    const KEYWORDS: [&str; 7_usize] = [
+        "TOKEN",
+        "SECRET",
+        "PASSWORD",
+        "CREDENTIAL",
+        "ACCESS_KEY",
+        "SECRET_KEY",
+        "API_KEY",
+    ];
+    let looks_like_credential = |key: &str| -> bool {
+        let upper = key.to_ascii_uppercase();
+        let segs = upper.split('_').collect::<Vec<&str>>();
+        KEYWORDS.iter().any(|kw| {
+            let words = kw.split('_').collect::<Vec<&str>>();
+            segs.windows(words.len()).any(|w| w == words.as_slice())
+        })
+    };
+
+    // scan builtin_profiles()
+    let profile_suggestions = |key: &str| -> Vec<ProfileSuggestion> {
+        let mut suggestions = Vec::new();
+        for profile in builtin_profiles() {
+            for cred in &profile.credentials {
+                if cred.env_vars.iter().any(|v| v.eq_ignore_ascii_case(key)) {
+                    suggestions.push(ProfileSuggestion {
+                        provider_type: profile.id.clone(),
+                        credential: cred.name.clone(),
+                    });
+                }
+            }
+        }
+        suggestions
+    };
+
+    let mut matches = Vec::new();
+
+    for key in env.keys() {
+        let sug = profile_suggestions(key);
+        if !sug.is_empty() || looks_like_credential(key) {
+            matches.push((key.clone(), sug));
+        }
+    }
+
+    matches.sort_by(|a, b| a.0.cmp(&b.0));
+    matches
+}
+
+#[allow(clippy::implicit_hasher)]
+pub fn warn_credential_env_vars(env: &HashMap<String, String>, suppress: bool) {
+    if suppress {
+        return;
+    }
+
+    let matches = credential_env_matches(env);
+    if matches.is_empty() {
+        return;
+    }
+
+    for (key, suggestions) in &matches {
+        eprintln!(
+            "{} {key} looks like a credential passed as a plain environment variable.",
+            "⚠".yellow()
+        );
+        eprintln!("  The agent inside the sandbox can read this value directly.");
+        eprintln!();
+
+        if suggestions.is_empty() {
+            eprintln!("  To hide it from the agent, use a provider instead of --env.");
+        } else {
+            eprintln!("  To hide it from the agent, use a provider instead:");
+            for s in suggestions {
+                eprintln!(
+                    "    openshell provider create --name my-{ty} --type {ty} --credential {key}",
+                    ty = s.provider_type
+                );
+            }
+            eprintln!("    openshell sandbox create --provider my-<name> ...");
+        }
+        eprintln!("  See: {DOCS_PROVIDERS_URL}");
+        eprintln!();
+    }
+}
+
 pub fn parse_key_value_pairs(items: &[String], flag: &str) -> Result<HashMap<String, String>> {
     let mut map = HashMap::new();
 
@@ -975,4 +1068,118 @@ mod tests {
         let err = parse_duration_to_ms("\u{20ac}").expect_err("missing number should error");
         assert!(err.to_string().contains("invalid duration"));
     }
+
+    // helper for building input
+    fn env(pairs: &[(&str, &str)]) -> HashMap<String, String> {
+        pairs
+            .iter()
+            .map(|(k, v)| (k.to_string(), v.to_string()))
+            .collect()
+    }
+
+    #[test]
+    fn suffix_match_no_profile() {
+        let env = env(&[("FOO_TOKEN", "x")]);
+        let prof = credential_env_matches(&env);
+        assert_eq!(prof.len(), 1_usize);
+        assert_eq!(&prof[0].0, "FOO_TOKEN");
+        assert!(prof[0].1.is_empty());
+    }
+
+    #[test]
+    fn exact_profile_match() {
+        let env = env(&[("GITHUB_TOKEN", "x")]);
+
+        let prof = credential_env_matches(&env);
+        assert_eq!(prof.len(), 1_usize);
+        assert_eq!(prof[0].0, "GITHUB_TOKEN");
+
+        let sug = &prof[0].1;
+        assert_eq!(sug.len(), 2_usize);
+
+        assert_eq!(sug[0].provider_type, "copilot");
+        assert_eq!(sug[0].credential, "api_token");
+
+        assert_eq!(sug[1].provider_type, "github");
+        assert_eq!(sug[1].credential, "api_token");
+    }
+
+    #[test]
+    fn case_insensitive() {
+        let env = env(&[("gh_token", "x")]);
+
+        let prof = credential_env_matches(&env);
+        assert_eq!(prof.len(), 1_usize);
+        assert_eq!(prof[0].0, "gh_token");
+
+        let sug = &prof[0].1;
+        assert_eq!(sug.len(), 2_usize);
+
+        assert_eq!(sug[0].provider_type, "copilot");
+        assert_eq!(sug[0].credential, "api_token");
+
+        assert_eq!(sug[1].provider_type, "github");
+        assert_eq!(sug[1].credential, "api_token");
+    }
+
+    #[test]
+    fn non_credential_skipped() {
+        let env = env(&[("PATH", "x"), ("HOME", "y")]);
+
+        let prof = credential_env_matches(&env);
+        assert!(prof.is_empty());
+    }
+
+    #[test]
+    fn no_value_leak() {
+        let env = env(&[("APP_SECRET", "secretVALUE42")]);
+
+        let prof = credential_env_matches(&env);
+        assert_eq!(prof.len(), 1_usize);
+
+        let dumped = format!("{prof:?}");
+        assert!(!dumped.contains("secretVALUE42"), "value leaked: {dumped}");
+    }
+
+    #[test]
+    fn deterministic_order() {
+        let env = env(&[
+            ("ZED_TOKEN", "a"),
+            ("ABC_SECRET", "b"),
+            ("MID_PASSWORD", "c"),
+        ]);
+
+        let prof = credential_env_matches(&env);
+        let keys: Vec<&str> = prof.iter().map(|(k, _)| k.as_str()).collect();
+        assert_eq!(keys, ["ABC_SECRET", "MID_PASSWORD", "ZED_TOKEN"]);
+    }
+
+    #[test]
+    fn nonsecrets() {
+        let env = env(&[
+            ("TOKENIZERS_PARALLELISM", "x"),
+            ("PASSWORDLESS_LOGIN", "y"),
+            ("SECRETARY_EMAIL", "z"),
+        ]);
+
+        let prof = credential_env_matches(&env);
+        assert!(prof.is_empty());
+    }
+
+    #[test]
+    fn segment_matches() {
+        let env = env(&[
+            ("DB_TOKEN", "a"),
+            ("MY_ACCESS_KEY", "b"),
+            ("PRIMARY_KEY", "c"),
+        ]);
+
+        let prof = credential_env_matches(&env);
+        assert_eq!(prof.len(), 2_usize);
+
+        let keys = prof.iter().map(|(k, _)| k.as_str()).collect::<Vec<&str>>();
+        assert!(keys.contains(&"DB_TOKEN"));
+        assert!(keys.contains(&"MY_ACCESS_KEY"));
+        assert!(!keys.contains(&"PRIMARY_KEY"));
+    }
 }
diff --git a/crates/openshell-cli/src/main.rs b/crates/openshell-cli/src/main.rs
@@ -1439,6 +1439,10 @@ enum SandboxCommands {
         #[arg(long = "env", value_name = "KEY=VALUE")]
         envs: Vec<String>,
 
+        /// Suppress warnings when --env values look like credentials.
+        #[arg(long = "no-credential-warnings")]
+        no_credential_warnings: bool,
+
         /// Approval mode for agent-authored policy proposals.
         ///
         /// `manual` (default): every proposal lands in the draft inbox for
@@ -2959,6 +2963,7 @@ async fn run_async() -> Result<()> {
                     no_auto_providers,
                     labels,
                     envs,
+                    no_credential_warnings,
                     approval_mode,
                     output,
                     command,
@@ -2996,6 +3001,7 @@ async fn run_async() -> Result<()> {
 
                     // Parse --env flags into a HashMap<String, String>.
                     let env_map = run::parse_env_pairs(&envs)?;
+                    run::warn_credential_env_vars(&env_map, no_credential_warnings);
 
                     // Parse --upload specs into [(local_path, sandbox_path, git_ignore)].
                     let upload_specs: Vec<(String, Option<String>, bool)> = upload
diff --git a/crates/openshell-cli/src/run.rs b/crates/openshell-cli/src/run.rs
@@ -5,7 +5,7 @@
 
 pub use crate::commands::common::{
     PolicyGetView, parse_credential_expiry_cli_value, parse_env_pairs, parse_key_value_pairs,
-    parse_secret_material_env_pairs,
+    parse_secret_material_env_pairs, warn_credential_env_vars,
 };
 use crate::commands::common::{
     ProvisioningDisplay, ProvisioningStep, confirm_global_setting_delete,
diff --git a/docs/sandboxes/manage-sandboxes.mdx b/docs/sandboxes/manage-sandboxes.mdx
@@ -202,6 +202,8 @@ openshell sandbox create --env API_KEY=sk-test --env DEBUG=1 -- my-agent
 
 Variables set with `--env` are available to all processes in the sandbox, including interactive shells and exec commands.
 
+When an `--env` key looks like a credential — a known provider variable, or a name whose underscore-separated segments include a credential word such as `TOKEN`, `SECRET`, `PASSWORD`, `CREDENTIAL`, `API_KEY`, `ACCESS_KEY`, or `SECRET_KEY` (for example `DB_TOKEN` or `MY_ACCESS_KEY`) — `sandbox create` prints a non-blocking warning. Matching is on whole segments, so unrelated names like `TOKENIZERS_PARALLELISM` or `PASSWORDLESS_LOGIN` do not warn. The agent inside the sandbox can read plain environment values directly, so to hide a secret from the agent, attach it through a [provider](/sandboxes/providers-v2) with `--provider` instead. Suppress the warning with `--no-credential-warnings`. Detection uses the key name only; values are never inspected or printed.
+
 You can also set per-command environment variables with `sandbox exec`:
 
 ```shell
