From d841e607f75f6431dc95aee0ede9f0be43ba1c32 Mon Sep 17 00:00:00 2001 From: David Dodlek Date: Tue, 6 Oct 2026 18:39:27 +0200 Subject: [PATCH] fix(hooks): watch hook no longer writes the environment to /tmp mgrep_watch.py logged `os.environ` to /tmp/mgrep-watch.log on every session start. The log is world-readable by default and the environment can contain MXBAI_API_KEY and other agent credentials. Remove the line. --- plugins/mgrep/hooks/mgrep_watch.py | 1 - 1 file changed, 1 deletion(-) diff --git a/plugins/mgrep/hooks/mgrep_watch.py b/plugins/mgrep/hooks/mgrep_watch.py index 029eb4b..c754ea6 100644 --- a/plugins/mgrep/hooks/mgrep_watch.py +++ b/plugins/mgrep/hooks/mgrep_watch.py @@ -85,7 +85,6 @@ def session_start_response(): stderr=open(f"/tmp/mgrep-watch-command-{payload.get('session_id')}.log", "w"), ) debug_log(f"Started mgrep watch process: {process.pid}") - debug_log(f"All environment variables: {os.environ}") with open(pid_file, "w") as handle: handle.write(str(process.pid))