fix: isolate stdio MCP child env from OpenWiki credentials

[Greg Land (bikeusaland)]

Problem

Stdio MCP subprocesses were spawned with the full process.env:

const child = spawn(transport.command, transport.args ?? [], {
  env: { ...process.env, ...resolveChildEnv(transport.env ?? {}) },
  ...
});

Because the MCP server command comes from user-editable connector config, any MCP server binary inherited the user's entire credential set — every provider API key (Anthropic, OpenAI, Tavily, …) and OAuth refresh token (Gmail, Slack, X, …) sitting in process.env. A malicious or compromised MCP server got all of them for free.

Fix

Introduce buildChildEnv, which constructs the child environment from:

1. An allow-list of safe base variables an MCP process may legitimately need — PATH, HOME/USERPROFILE, TMPDIR/TEMP/TMP, locale/terminal vars, and Windows equivalents (SystemRoot, ComSpec, PATHEXT).
2. Only the credentials the transport explicitly declares via transport.env (resolved through the existing resolveChildEnv validation/resolution path).

The full process.env is never forwarded. All three stdio spawn sites (executeStdioMcp, executeStdioMcpTool, listStdioMcpTools) now route through buildChildEnv.

Behavior change

If an MCP server previously relied on a variable that is neither allow-listed nor declared in its transport.env, it will no longer see it — that variable must now be listed explicitly in the connector's transport.env. This is the intended least-privilege behavior.

Tests

Adds test/mcp-client.test.ts (the module had no tests) pinning the invariant:

• OpenWiki credentials don't leak into the child env by key or by value
• allow-listed base vars (e.g. PATH) pass through
• declared refs resolve to the mapped target var only
• invalid / unresolvable refs throw

Full gate passes locally: typecheck, lint:check, format:check, and the test suite (200 tests, +5 new).

🤖 Generated with Claude Code

Related PRs

Part of a batch from a single codebase-review pass. Independent, main-based branches that can merge in any order.

Security

• fix: isolate stdio MCP child env from OpenWiki credentials #287 — isolate stdio MCP child env from OpenWiki credentials
• chore: unify secret-redaction key matching in one shared helper #290 — unify secret-redaction key matching in one shared helper

Correctness

• fix: honor per-instance connectorConfig in gmail, slack, x connectors #288 — honor per-instance connectorConfig in gmail, slack, x connectors

Feature

• feat: warn when configured model belongs to a different provider #289 — warn when configured model belongs to a different provider

(This PR is #287.)