[PortSwiggerRussell]

Summary

Two additions to the session.launchContext hook (host API 1.62.0):

• secretEnv: environment variables whose values never appear in argv, the tmux start command, logs, the graph or the mappings file.
  • Local launches (Claude and Codex; dispatch, resume, fork): the server writes export NAME='value' lines to a 0600 file in <AW_DATA_DIR>/launch-secrets/. The pane command carries only the file's path, and the pane sources and deletes it before the agent starts.
  • Devcontainer: the file is copied into the container, the host copy is deleted, the file is chowned to the container user, then sourced and deleted inside.
  • Headless (host.sessions.launchEnv, archive review): the values are merged into the child process env in-process.
  • Runtimes contributed by extensions, and buildLaunch runtimes, cannot take secrets. Their variables are skipped and logged by name only, and their wrapLaunch never sees the values.
  • A name set in both env and secretEnv is delivered as a secret only. Secrets are never cached in lastLaunchContext.
• claudeHooks: PreToolUse and PostToolUse groups added to a Claude launch's --settings, after core's own. Core's PR-attach PostToolUse hook is kept and stays first. Codex ignores them. In a devcontainer, a hook under a directory granted with addDirs is rewritten to the container copy.

Documented in docs/extensions.md, with limits: the agent's own environment is still readable by the same OS user, and keeping values out of agent output is the extension's job.

Verification

• npm test: 5144 pass, 0 fail. New tests:
  • Collection and validation of both fields.
  • Real pane runs under sh, zsh and bash with a hostile value. The agent sees the value, the command lacks it, and the file is gone.
  • Devcontainer script ordering.
  • Session-manager dispatch, resume and fork for Claude, Codex, devcontainer and extension runtimes.
  • Headless launchEnv.
• Live, on an isolated dev board with a test extension: a real Claude session saw the secret in env. The value appeared in no pane command, process argv, log, data file or graph frame. The running claude's --settings held core's PostToolUse hook and the extension's PreToolUse hook, and the hook fired.
• The devcontainer path is unit-tested only (no Docker was available).

Made with Agent Wrangler and the PortSwigger/wrangler-squared extension

🤖 Generated with Claude Code

Model: claude-opus-5-5