V15: Deny .env files to workspace tools by default

[LinuxDevil]

Fixes audit finding SEC-9 (Vercel competitor audit, 2026-10-19).

What was wrong

The fs tools' default deny list covered only .git, so read_file .env returned the file's contents and a prompt-injected model could read secrets.

What changed

• Default deny is now ['.git', '.env', '.env.*'].
• A deny entry ending in * is a prefix match; it never matches .env.example, .env.sample or .env.template.
• Matching reuses the existing segment test, so nested paths (pkg/.env), case (.ENV), trailing dots/spaces and Windows 8.3 aliases work, and the realPath link guard covers symlinks/junctions the same way as .git.
• A user-supplied deny still replaces the defaults (unchanged); documented in docs/workspace-tools.md. llms-full.txt regenerated.

Behavior change: workspace file tools (read_file, write_file, edit_file, list_dir, glob, grep) now refuse .env and .env.* (except .example/.sample/.template) by default. Pass deny: ['.git'] to restore the old behavior.

Tests

New tests in fsTools.test.ts: .env, sub/.env, .env.local, .env.production, .ENV etc. are refused with the existing deny error; .env.example/.sample/.template and .environment readable; .git still refused; custom deny replaces defaults. Ran tsc, typecheck:tests, lint, docs:llms, vitest on src/tools/workspace and scripts: pass. Full coverage run has 6 failures unrelated to this change (create-lousho-agent tests need built packages/*/dist; a tracing test; sharedChunks needs dist), so npm run fallow could not read coverage locally.

Changelog: Workspace file tools now deny .env and .env.* (not .env.example/.sample/.template) by default alongside .git.

🤖 Generated with Claude Code