The Bash tool now validates environment variable names in command prefixes using a regex pattern (/^([A-Za-z_][A-Za-z0-9_]*)/) and checks them against a safe-list. Commands that set non-safe-listed environment variables require explicit approval.
Evidence
New function fhz with env var validation regex and Ly6 safe-list checker (search for "A-Za-z_][A-Za-z0-9_]*")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
