[{"data":1,"prerenderedAt":361},["ShallowReactive",2],{"docs-\u002Fdocs\u002Fv2\u002Fapi\u002Fconfig\u002Fpolicy\u002Fenv":3},{"id":4,"title":5,"body":6,"description":353,"extension":354,"meta":355,"navigation":356,"path":357,"seo":358,"stem":359,"__hash__":360},"docs\u002Fdocs\u002Fv2\u002Fapi\u002Fconfig\u002Fpolicy\u002Fenv.md","env",{"type":7,"value":8,"toc":349},"minimark",[9,12,21,89,181,195,200,218,257,267,278,282,339,345],[10,11,5],"h1",{"id":5},[13,14,15,16,20],"p",{},"Controls which env vars the capsule subprocess can see. Applied before the subprocess\nstarts — the agent cannot read stripped vars via ",[17,18,19],"code",{},"process.env",". Works on all platforms.",[22,23,28],"pre",{"className":24,"code":25,"language":26,"meta":27,"style":27},"language-ts shiki shiki-themes dark-plus","type EnvPolicy = {\n    stripEnv?: string[]   \u002F\u002F var names or glob patterns to remove\n    keepEnv?:  string[]   \u002F\u002F preserve these even if matched by stripEnv\n}\n","ts","",[17,29,30,47,67,83],{"__ignoreMap":27},[31,32,35,39,43],"span",{"class":33,"line":34},"line",1,[31,36,38],{"class":37},"scz_3","type",[31,40,42],{"class":41},"sNl3T"," EnvPolicy",[31,44,46],{"class":45},"sTNBD"," = {\n",[31,48,50,54,57,60,63],{"class":33,"line":49},2,[31,51,53],{"class":52},"s3F5K","    stripEnv",[31,55,56],{"class":45},"?: ",[31,58,59],{"class":41},"string",[31,61,62],{"class":45},"[]   ",[31,64,66],{"class":65},"sOLPB","\u002F\u002F var names or glob patterns to remove\n",[31,68,70,73,76,78,80],{"class":33,"line":69},3,[31,71,72],{"class":52},"    keepEnv",[31,74,75],{"class":45},"?:  ",[31,77,59],{"class":41},[31,79,62],{"class":45},[31,81,82],{"class":65},"\u002F\u002F preserve these even if matched by stripEnv\n",[31,84,86],{"class":33,"line":85},4,[31,87,88],{"class":45},"}\n",[22,90,92],{"className":24,"code":91,"language":26,"meta":27,"style":27},"export default defineAgent({\n    policy: {\n        user:     \"axon-agent\",\n        stripEnv: [\"DATABASE_*\", \"*_SECRET\", \"INTERNAL_*\"],\n        keepEnv:  [\"OPENAI_API_KEY\"],\n    },\n})\n",[17,93,94,110,118,130,155,169,175],{"__ignoreMap":27},[31,95,96,100,103,107],{"class":33,"line":34},[31,97,99],{"class":98},"sYbnZ","export",[31,101,102],{"class":98}," default",[31,104,106],{"class":105},"sCudf"," defineAgent",[31,108,109],{"class":45},"({\n",[31,111,112,115],{"class":33,"line":49},[31,113,114],{"class":52},"    policy:",[31,116,117],{"class":45}," {\n",[31,119,120,123,127],{"class":33,"line":69},[31,121,122],{"class":52},"        user:",[31,124,126],{"class":125},"sKc5r","     \"axon-agent\"",[31,128,129],{"class":45},",\n",[31,131,132,135,138,141,144,147,149,152],{"class":33,"line":85},[31,133,134],{"class":52},"        stripEnv:",[31,136,137],{"class":45}," [",[31,139,140],{"class":125},"\"DATABASE_*\"",[31,142,143],{"class":45},", ",[31,145,146],{"class":125},"\"*_SECRET\"",[31,148,143],{"class":45},[31,150,151],{"class":125},"\"INTERNAL_*\"",[31,153,154],{"class":45},"],\n",[31,156,158,161,164,167],{"class":33,"line":157},5,[31,159,160],{"class":52},"        keepEnv:",[31,162,163],{"class":45},"  [",[31,165,166],{"class":125},"\"OPENAI_API_KEY\"",[31,168,154],{"class":45},[31,170,172],{"class":33,"line":171},6,[31,173,174],{"class":45},"    },\n",[31,176,178],{"class":33,"line":177},7,[31,179,180],{"class":45},"})\n",[13,182,183,184,187,188,191,192,194],{},"Order of evaluation: strip everything matching ",[17,185,186],{},"stripEnv",", then restore anything in\n",[17,189,190],{},"keepEnv",". ",[17,193,190],{}," preserves the value from the host environment — it does not inject\nvalues, only rescues vars that would otherwise be stripped.",[196,197,199],"h2",{"id":198},"default-strip-patterns","Default strip patterns",[13,201,202,203,210,211,214,215,217],{},"When ",[204,205,207],"a",{"href":206},"\u002Fdocs\u002Fv2\u002Fapi\u002Fconfig\u002Fpolicy\u002Fuser",[17,208,209],{},"user"," is set to anything other than ",[17,212,213],{},"\"inherit\"","\nand ",[17,216,186],{}," is not explicitly declared, these patterns are applied automatically:",[22,219,221],{"className":24,"code":220,"language":26,"meta":27,"style":27},"[\"*_SECRET\", \"*_KEY\", \"*_TOKEN\", \"*_PASSWORD\", \"DATABASE_*\", \"*_DSN\"]\n",[17,222,223],{"__ignoreMap":27},[31,224,225,228,230,232,235,237,240,242,245,247,249,251,254],{"class":33,"line":34},[31,226,227],{"class":45},"[",[31,229,146],{"class":125},[31,231,143],{"class":45},[31,233,234],{"class":125},"\"*_KEY\"",[31,236,143],{"class":45},[31,238,239],{"class":125},"\"*_TOKEN\"",[31,241,143],{"class":45},[31,243,244],{"class":125},"\"*_PASSWORD\"",[31,246,143],{"class":45},[31,248,140],{"class":125},[31,250,143],{"class":45},[31,252,253],{"class":125},"\"*_DSN\"",[31,255,256],{"class":45},"]\n",[13,258,259,260,262,263,266],{},"Setting ",[17,261,186],{}," explicitly replaces the defaults entirely — the explicit list is used\nas-is, not merged. Set to ",[17,264,265],{},"[]"," to disable all stripping.",[13,268,202,269,271,272,274,275,277],{},[17,270,209],{}," is ",[17,273,213],{}," and ",[17,276,186],{}," is not set, env passes through unchanged.",[196,279,281],{"id":280},"typical-patterns","Typical patterns",[22,283,285],{"className":24,"code":284,"language":26,"meta":27,"style":27},"export default defineAgent({\n    policy: {\n        user:     \"axon-agent\",\n        \u002F\u002F strip everything sensitive, keep only what the agent needs\n        keepEnv:  [\"OPENAI_API_KEY\", \"GITHUB_TOKEN\"],\n    },\n})\n",[17,286,287,297,303,311,316,331,335],{"__ignoreMap":27},[31,288,289,291,293,295],{"class":33,"line":34},[31,290,99],{"class":98},[31,292,102],{"class":98},[31,294,106],{"class":105},[31,296,109],{"class":45},[31,298,299,301],{"class":33,"line":49},[31,300,114],{"class":52},[31,302,117],{"class":45},[31,304,305,307,309],{"class":33,"line":69},[31,306,122],{"class":52},[31,308,126],{"class":125},[31,310,129],{"class":45},[31,312,313],{"class":33,"line":85},[31,314,315],{"class":65},"        \u002F\u002F strip everything sensitive, keep only what the agent needs\n",[31,317,318,320,322,324,326,329],{"class":33,"line":157},[31,319,160],{"class":52},[31,321,163],{"class":45},[31,323,166],{"class":125},[31,325,143],{"class":45},[31,327,328],{"class":125},"\"GITHUB_TOKEN\"",[31,330,154],{"class":45},[31,332,333],{"class":33,"line":171},[31,334,174],{"class":45},[31,336,337],{"class":33,"line":177},[31,338,180],{"class":45},[13,340,341,342,344],{},"Relying on the defaults and using ",[17,343,190],{}," to rescue specific vars is the most robust\npattern — new secrets added to the host environment are stripped automatically without\nrequiring config changes.",[346,347,348],"style",{},"html pre.shiki code .scz_3, html code.shiki .scz_3{--shiki-default:#569CD6}html pre.shiki code .sNl3T, html code.shiki .sNl3T{--shiki-default:#4EC9B0}html pre.shiki code .sTNBD, html code.shiki .sTNBD{--shiki-default:#D4D4D4}html pre.shiki code .s3F5K, html code.shiki .s3F5K{--shiki-default:#9CDCFE}html pre.shiki code .sOLPB, html code.shiki .sOLPB{--shiki-default:#6A9955}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .sYbnZ, html code.shiki .sYbnZ{--shiki-default:#C586C0}html pre.shiki code .sCudf, html code.shiki .sCudf{--shiki-default:#DCDCAA}html pre.shiki code .sKc5r, html code.shiki .sKc5r{--shiki-default:#CE9178}",{"title":27,"searchDepth":49,"depth":49,"links":350},[351,352],{"id":198,"depth":49,"text":199},{"id":280,"depth":49,"text":281},"Controls which env vars the capsule subprocess can see. Applied before the subprocess\nstarts — the agent cannot read stripped vars via process.env. Works on all platforms.","md",{},true,"\u002Fdocs\u002Fv2\u002Fapi\u002Fconfig\u002Fpolicy\u002Fenv",{"title":5,"description":353},"docs\u002Fv2\u002Fapi\u002Fconfig\u002Fpolicy\u002Fenv","u0mML_LRvXkKFJrf2KE2336eyt7ISCeun-0bnSOjxAk",1786529563291]