dsh-subprocess-inherit-environment

A removable DeepSeek Harness / DSH plugin that deliberately forwards the Harness process's complete environment through the ctx.subprocess service.

Security warning

This plugin disables DSH's subprocess credential isolation. Every caller that uses the wrapped subprocess service can pass the Harness process's API keys, tokens, passwords, secrets, cookies, proxy credentials, and other environment values to child processes. Model-generated commands, repository scripts, package installers, CLIs, MCP servers, and terminal programs may read or exfiltrate those values.

Do not install this plugin on a shared or untrusted Harness deployment. Prefer a dedicated tool or an exact variable allowlist whenever possible.

The plugin never logs environment names or values by itself. That does not prevent a child process from printing or transmitting them.

Behavior

DSH normally starts subprocesses from a scrubbed parent environment. Variable names matching KEY, PASSWORD, SECRET, or TOKEN, plus ambient DSH_* names, are removed before explicit request entries are merged.

This plugin wraps the three ctx.subprocess operations and supplies an explicit environment layer built from process.env:

• resolveExecutable(command, env, signal)
• spawn(spec)
• spawnTerminal(spec)

All three operations must be functions. Own method descriptors must be configurable; inherited methods and an absent installation marker require an extensible runtime; an existing marker slot must be configurable. Apply checks that complete replacement contract before mutation. If defining the marker or any method still fails, or Cordis rejects effect registration, apply rolls back the marker and every installed method descriptor before rethrowing the error.

Caller-provided entries are merged after a fresh process.env spread on every call, so explicit overrides and undefined tombstones retain their original meaning. The plugin does not mutate caller-owned requests.

Disposal first makes every installed wrapper inactive, then restores previous method descriptors when the plugin still owns them. A later wrapper that captured and delegates to a plugin method therefore reaches the original DSH method with the caller's exact arguments after disposal, without environment injection. Later method replacements are not overwritten. Installing this plugin more than once on the same subprocess runtime is rejected while the first installation is active, avoiding ambiguous out-of-order teardown.