fix: withhold every Claude setting from build checks, not a fixed list

build_env() removed the ANTHROPIC_* and CLAUDE_CODE_* names on the default
allowlist, but one added through fix_agent.extra_env — ANTHROPIC_CUSTOM_HEADERS,
which can carry auth — still reached the build. Match by prefix instead.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Author: DudiPeretz-Orca

plugins/security-engineer/skills/run/agent_env.py

@@ -50,9 +50,9 @@
 })
 
 # Allowed for the model subprocess, which needs them to reach Claude; withheld
-# from build checks, which run repository code and need none of them.
-_MODEL_ONLY = frozenset(n for n in _ALLOW
-                        if n.startswith(("ANTHROPIC_", "CLAUDE_CODE_")))
+# from build checks, which run repository code and need none of them. A prefix,
+# so one added through extra_env is withheld too.
+_MODEL_ONLY_PREFIXES = ("ANTHROPIC_", "CLAUDE_CODE_")
 
 # Names fix_agent.extra_env may never add back. The literal four are the ones
 # this change exists to withhold; the pattern catches the shape of the rest, so
@@ -92,7 +92,5 @@ def build_env(extra: list | None = None) -> dict:
     agent_env() without Claude's credentials. fix_agent.extra_env still applies,
     so a private registry an operator opted into reaches the build that needs it.
     """
-    env = agent_env(extra)
-    for name in _MODEL_ONLY:
-        env.pop(name, None)
-    return env
+    return {k: v for k, v in agent_env(extra).items()
+            if not k.startswith(_MODEL_ONLY_PREFIXES)}

plugins/security-engineer/skills/run/tests/test_untrusted.py

@@ -23,7 +23,7 @@
 import orchestrator
 import package_identity
 import validator
-from agent_env import agent_env
+from agent_env import agent_env, build_env
 from orchestrator import AlertTask, _build_prompt_context, _invoke_fix_agent
 from pipelines import get_pipeline
 from pipelines.base import FixPlan
@@ -385,6 +385,12 @@ def test_build_check_keeps_path_and_extra_env(self):
         self.assertIn("PATH", seen)
         self.assertIn("AWS_REGION", seen)
 
+    def test_extra_env_cannot_hand_a_build_claude_settings(self):
+        """ANTHROPIC_CUSTOM_HEADERS can carry auth; opting it in is for the model."""
+        with patch.dict(os.environ, {"ANTHROPIC_CUSTOM_HEADERS": "x"}):
+            self.assertNotIn("ANTHROPIC_CUSTOM_HEADERS",
+                             build_env(["ANTHROPIC_CUSTOM_HEADERS"]))
+
     def test_python_syntax_check_does_not_import_from_the_tree(self):
         """`python3 -m py_compile` puts cwd first on sys.path, so a committed
         py_compile.py ran instead of the stdlib one, with the full environment."""