Keep env values off the bwrap command line

tests/e2e/env.rs

@@ -16,6 +16,49 @@ fn printenv_inside(args: &[&str], vars: &[(&str, &str)], query: &[&str]) -> Stri
         .expect("agent-sandbox binary failed to execute");
     String::from_utf8_lossy(&output.stdout).into_owned()
 }
+#[test]
+fn user_env_value_never_reaches_the_command_line() {
+    let stdout = dry_run_command_line(&["--env", "MY_SECRET=hunter2"], &[]);
+    assert!(
+        !stdout.contains("hunter2"),
+        "user env value leaked into the bwrap command line: {stdout}"
+    );
+}
+
+fn dry_run_command_line(args: &[&str], vars: &[(&str, &str)]) -> String {
+    let mut cmd = Sandbox::new(args);
+    cmd.arg("--dry-run");
+    for (k, v) in vars {
+        cmd.env(k, v);
+    }
+    let output = cmd
+        .args(["--", "true"])
+        .output()
+        .expect("agent-sandbox binary failed to execute");
+    String::from_utf8_lossy(&output.stdout).into_owned()
+}
+
+#[test]
+fn kept_host_env_value_never_reaches_the_command_line() {
+    let stdout = dry_run_command_line(&[], &[("TERM", "xterm-canary")]);
+    assert!(
+        !stdout.contains("xterm-canary"),
+        "kept host env value leaked into the bwrap command line: {stdout}"
+    );
+}
+
+#[test]
+fn passed_through_env_value_never_reaches_the_command_line() {
+    let stdout = dry_run_command_line(
+        &["--env", "PASSED_THROUGH"],
+        &[("PASSED_THROUGH", "from-host-canary")],
+    );
+    assert!(
+        !stdout.contains("from-host-canary"),
+        "passed-through env value leaked into the bwrap command line: {stdout}"
+    );
+}
+
 #[test]
 fn whitelist_keeps_identity_and_terminal_vars() {
     let stdout = printenv_inside(