Policy helper subprocesses now run with a scrubbed, fixed environment rather than inheriting yours.
What's wrong with this entry?
The helper that evaluates policy no longer inherits the parent process environment shape, and inline interpreters get a fixed environment: for sh, a deny-list of variables and prefixes is deleted, PATH is replaced with a fixed value and LC_ALL is set to C; for pwsh, PSModulePath, PATH, PATHEXT and COMSPEC are pinned and TERM is set to dumb. CLAUDE_CODE_VERSION is injected explicitly.
- The no-inherit behaviour comes from a new option threaded through the internal exec wrapper.
- Failures now report structured codes such as
bad_path,exit_nonzeroand "no path or script configured".
extendEnv
Strings lifted out of the shipped bundle, so the claim above can be checked against them.