reservedSandboxKeys only guards env.sandbox, not .env.d or host_files dest

[waynesun09]

reservedSandboxKeys is consulted only by buildSandboxEnvLines (internal/cli/run.go), so it stops a harness env.sandbox entry shadowing a runner-owned export and nothing else. Two other harness-controlled routes reach the same variables.

First, bootstrapEnv sources .env.d/*.env partway through the generated script, so any host_files entry with expand: true landing a file there overwrites every export written above that line. FULLSEND_ROLE and FULLSEND_SLUG are written above it today.

Second, host_files entries have an unvalidated dest, and .env is uploaded before them, so dest: /sandbox/workspace/.env replaces the runner's file wholesale regardless of ordering.

This is trusted harness config rather than an untrusted-input path — the harness is as trusted as the runner invoking it — so the impact is that the reserved-key guarantee is narrower than it reads, not that an attacker gets in.

Proposed change

Either source harness-controlled files before every runner-owned export, or reject a host_files dest that targets the runner's own .env.

Validation criteria

A harness that sets FULLSEND_ROLE through an .env.d file, and one that targets /sandbox/workspace/.env with host_files, both fail or are ignored rather than replacing the runner's value.

Context

Found while reviewing #7007, which moved that PR's two run facts below the .env.d line and closes the first route for those two keys only. The general gap remains.

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 2:57 PM UTC · Completed 3:01 PM UTC

Commit: fecb2f0 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $0.80

[fullsend-ai-triage]

Related issues:

• reservedSandboxKeys blocklist does not cover security-sensitive env vars blocked by reservedCredentialKeys #3373 covers a complementary gap — which keys are in the blocklist (the reservedSandboxKeys set is smaller than reservedCredentialKeys). That issue is about the key coverage; this one is about the code-path coverage. Both can be addressed independently.
• feat(dispatch): let a repository preserve the agent run already in flight #7007 partially addresses the .env.d route by moving two specific run-fact exports below the sourcing line, but the general gap for all reserved keys remains.

Proposed test case:

// TestReservedKeysNotOverriddenByEnvD verifies that .env.d files
// cannot shadow runner-owned infrastructure variables.
func TestReservedKeysNotOverriddenByEnvD(t *testing.T) {
    // Build a harness with a host_files entry that lands
    // FULLSEND_ROLE=attacker in .env.d/override.env
    // Call bootstrapEnv and assert FULLSEND_ROLE retains
    // the runner-set value, not the .env.d value.
}

// TestHostFilesDestRejectsRunnerEnvPath verifies that host_files
// cannot target the runner's own .env file.
func TestHostFilesDestRejectsRunnerEnvPath(t *testing.T) {
    // Build a harness with host_files dest: /sandbox/workspace/.env
    // Assert bootstrapEnv returns an error or ignores the entry.
}

---

Labels: Sandbox env var guard bypass via .env.d and host_files is a confirmed runner/sandbox defect with limited impact (trusted config only).

---

Next steps:

• /fs-code — agent creates a PR to implement this issue
• /fs-code <your instruction> — agent implements with your specific guidance

[fullsend-ai-coder]

🤖 Finished Code · ✅ Success · Started 3:03 PM UTC · Completed 3:23 PM UTC

Commit: fecb2f0 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $7.00