MGS2003: env vars stripped

The sandbox replaced a child process's inherited environment with a curated allowlist and one or more variables were dropped.

[MGS2003] env vars stripped from child process by sandbox (use --log-level=debug to see stripped variable names)
  cmd=go stripped_count=14

Why

The default allowlist is intentionally small: HOME, PATH, USER, locale and terminal vars, plus the MAGUS_* server coordination vars. Everything else is stripped so that a compromised spell cannot exfiltrate AWS_ACCESS_KEY_ID, GITHUB_TOKEN, VAULT_TOKEN, OP_SESSION_*, NPM_TOKEN, ANTHROPIC_API_KEY, and similar.

The warning is informational, not an error. The build may have succeeded; this message exists so you can spot when a tool's behavior changes because a variable it expected is no longer present.

Resolution

Run with --log-level=debug (or MAGUS_LOG_LEVEL=debug) to see exactly which variable names were stripped for each command:

[MGS2003] env variable names stripped from child process by sandbox
  cmd=go stripped_names="[AWS_ACCESS_KEY_ID GITHUB_TOKEN]"

Values are never logged, even at debug level, because stripped variables can contain credentials.

Each target reports a given set of stripped names once, across its child commands. The cmd field names the first child observed with that set. A different target or a changed set produces another notice. Metrics still count the variables stripped on every child launch.

If a tool depends on a non-secret variable being inherited (a Go build that needs GOPATH, an npm build that needs NPM_CONFIG_CACHE, mise shims that need MISE_*), add it to the passthrough list:

sandbox:
  env:
    passthrough:
      - GOPATH
      - GOCACHE
      - "MISE_*"

A trailing * makes a prefix pattern: MISE_* matches every name starting with MISE_. The prefix must be at least three characters and end in _, since GO* would also match GOOGLE_APPLICATION_CREDENTIALS; anything else is an error (MGS2004). It is intentionally not full glob syntax.

If a tool depends on a secret-bearing variable (GITHUB_TOKEN, etc.), think carefully before granting it. The sandbox exists to keep those out of subprocesses. If the tool genuinely needs the token, consider passing it via a file path the spell reads explicitly rather than re-broadcasting it through the environment.