fix: prompt rather than deny env -i in the omp guardrail

Author: rozsival-agent

docs/security.md

@@ -110,7 +110,8 @@ control: a subverted agent can call the same APIs through an SDK without either
 what each credential can do. `home/.omp/agent/config.yml` ships exactly such a guardrail for OMP, seeded
 when absent by `bootstrap` and `./bin/install-agent`: `bash.patterns` that deny `gh auth token|login|…`,
 an absolute-path `gh` (`*/bin/gh *` - past the shim), unsetting or reassigning the launcher's exports
-(`env -u`/`-i`, `unset GIT_CONFIG_GLOBAL`, `GH_CONFIG_DIR=…`; reading them stays allowed), keychain reads,
+(`env -u`, `unset GIT_CONFIG_GLOBAL`, `GH_CONFIG_DIR=…`; reading them stays allowed; `env -i` prompts instead,
+since this repo's own smoke tests use it), keychain reads,
 `gh secret`/`variable`/`repo delete`, `--no-verify` and force pushes, and prompt for `op`,
 `gcloud` and `terraform apply`. `deny` holds even under yolo, but the rules match command text in the
 `bash` tool only - not `eval`, not a script file - and a project's own `bash.patterns` **replaces** the

docs/toolchain.md

@@ -83,9 +83,9 @@ it shadows, which is why the launcher survives an update. See
 devbox, by `./bin/install-agent` on the laptop - with `secrets: { enabled: true }` obfuscating an API key in
 the environment (`~/.config/devbox/secrets.env` or a project `.env`) before it reaches a provider, and a
 `bash.patterns` guardrail: `deny` for reaching past the agent's scoped tokens (`gh auth token|login|…`, an
-absolute-path `gh`, `env -u`/`env -i`, unsetting or reassigning `GIT_CONFIG_GLOBAL`, `GIT_SSH_COMMAND`,
+absolute-path `gh`, `env -u`, unsetting or reassigning `GIT_CONFIG_GLOBAL`, `GIT_SSH_COMMAND`,
 `GH_CONFIG_DIR`, `GIT_TERMINAL_PROMPT`, keychain reads, `gh secret`/`variable`/`repo delete`) and for history rewrites (`--no-verify`, force push),
-`prompt` for `op`, `gcloud`, `terraform apply`. Your edits are never overwritten; an existing file without
+`prompt` for `env -i` (this repo's smoke tests use it), `op`, `gcloud`, `terraform apply`. Your edits are never overwritten; an existing file without
 a `bash:` block is reported by both installers so you can copy the block in. A project's own
 `bash.patterns` replaces this list entirely - arrays don't merge across settings layers. What it does and
 does not stop: [Security](security.md#accepted-limits).

home/.omp/agent/config.yml

@@ -52,6 +52,11 @@ bash:
     # shim; clearing or reassigning the four exports undoes the fence for one
     # command. Reading them (`echo $GIT_CONFIG_GLOBAL`, the documented session
     # check) stays allowed: only unset, assignment and env-scrubbing match.
+    # Tradeoff: this repo's own smoke tests use `env -i HOME=… PATH=…` and
+    # `GIT_CONFIG_GLOBAL=… <cmd>` probes. `env -i` is therefore `prompt` - a
+    # person approves it, and yolo still stops instead of failing silently -
+    # while assigning an export stays `deny`: a probe can write a throwaway
+    # HOME and let the launcher set the variable instead.
     - match: '*/bin/gh *'
       approval: deny
     - match: '*/bin/gh'
@@ -61,7 +66,7 @@ bash:
     - match: '*env --unset*'
       approval: deny
     - match: '*env -i *'
-      approval: deny
+      approval: prompt
     - match: '*unset *GIT_CONFIG_GLOBAL*'
       approval: deny
     - match: '*unset *GIT_SSH_COMMAND*'