{"version":"2.1.234","anchor":"policy-helper-subprocesses-run-in-a-scrubbed-pinned-environm","canonical_anchor":"policy-helper-subprocesses-run-in-a-scrubbed-pinned-environm","heading":"Policy-helper subprocesses run in a scrubbed, pinned environment","tier":"internal","area":"Permissions","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.234\/e\/policy-helper-subprocesses-run-in-a-scrubbed-pinned-environm","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.234","markdown":"### Policy-helper subprocesses run in a scrubbed, pinned environment\n\nPolicy helper subprocesses now run with a scrubbed, fixed environment rather than inheriting yours.\n\n**What**\n\nThe helper that evaluates policy no longer inherits the parent process environment shape, and inline interpreters get a fixed environment: for `sh`, a deny-list of variables and prefixes is deleted, PATH is replaced with a fixed value and LC_ALL is set to `C`; for `pwsh`, PSModulePath, PATH, PATHEXT and COMSPEC are pinned and TERM is set to `dumb`. `CLAUDE_CODE_VERSION` is injected explicitly.\n\n**Details**\n\n- The no-inherit behaviour comes from a new option threaded through the internal exec wrapper.\n- Failures now report structured codes such as `bad_path`, `exit_nonzero` and \"no path or script configured\".\n\n**Evidence**\n\n`extendEnv`\n\n- Area: Permissions\n- Tier: Under the hood\n- Useful: 2\/5\n- Signal: 3\/5"}