env: @claude inherits PAGER and neither editor variable (closes #530)

[vyskocilm]

Closes #530.

What

@claude stops inheriting EDITOR and VISUAL. PAGER stays, so do ANTHROPIC_BASE_URL and NO_COLOR.

Why, measured

git exec class reaches sandbox by fallback, both chains measured: GIT_EDITOR -> core.editor -> VISUAL -> EDITOR, GIT_PAGER -> core.pager -> PAGER. inherit hands host's own command string to git inside. Refusing only GIT_* spellings closes invisible half of class, not class — all six stay legal at set/inherit for any profile, all six stay annotated. Table refuses nothing.

Decision is per shipped profile, and rests on measurement not on composability argument. Inside @claude sandbox:

command -v vi vim nano   ->  nothing
command -v less more     ->  /usr/bin/less, /usr/bin/more

Inherited EDITOR names program not there (host vim/code not bound), so git commit fails identically with variable and without. Inherited PAGER=less names one that is. Invariant 2 corollary: grant wider than need shrinks, no rule added. Closes no escape — profiles are trusted layer, nothing untrusted chose these values.

Golden diff (review artifact)

bwrap.claude.txt   -1 --setenv EDITOR vim, +1 --setenv PAGER less
env.claude.txt     EDITOR row + annotation out, PAGER row + annotation in
show.claude.txt    -2 annotated inherit rows

Tests

TestNoBuiltinInheritsAnEditorVariable (internal/profile) — named regression. Asserts PAGER PRESENT in same test: "no builtin inherits an editor" is satisfied by a profile inheriting nothing at all. Negative control both directions: EDITOR = true back in base.toml fails it, removed passes.

Three tests rode on @claude's inherit EDITOR and are repointed — env golden fixture host value (PAGER=less), unchecked-sink negative control (PAGER), forging-rune sweep.

Forging-rune sweep was MEASURED unfailable for two of its probes: with the ESC/CR and bidi fixtures disconnected from any profile the test still passed, because $SNUG_PODMAN satisfies the \x1b assertion and the graft fixture the U+202E one. Now carries a per-probe positive control; cutting the route fails it. Probes arrive through a fixture-defined profile inheriting EDITOR/VISUAL — same policy.Resolve path, same VerbInherit entries.

Also removed from TestAnnotatedEnvPairsAShippedProfileWritesArePinned inventory: a stale row pre-approves the next grant, and that test says so itself.

Docs

• VERIFY.md §6d-bis — by-hand equivalent, both commands and their real output.
• VERIFY.md DEL check moved EDITOR -> PAGER: the EDITOR route no longer reaches the document. Re-run, output pinned (less� twice, lossy false, 0 raw DEL bytes).
• ENVIRONMENT-VARIABLES.md §3.2 rewritten. Legality (both verbs, for anybody) and what a shipped profile carries are two decisions, now stated as two. Stale prose deleted: it claimed GIT_* "are refused (§4.4's list)", named forbiddenEnv (gone), and ended "Still open, still Tracker: git-config adapter leftovers (commit signing, fixed catalogue, the exec class) #35" for a closed issue.
• dryrun.go and visible_test.go header comments naming @claude's shipped inherit EDITOR corrected in place.

Verification

make gate green. SNUG_REQUIRE_SANDBOX=1 SNUG_SANDBOX_TIMEOUT=25m make integration on this host: 209 PASS, 2 SKIP, engine tests: 46 ran, floor 46 — podman version 6.0.2. Two runs, one failure each, a DIFFERENT test each time and both in network paths this change does not touch: TestSSHReachParityBetweenAPlainRunAndNet (pasta: Couldn't set IPv6 address(es) in namespace: File exists, host load ~21) and TestContainerEgressFollowsNetProfile (connect: network is unreachable). Both pass in isolation, 2.25s and 8.80s. Suite bound raised to 25m because the default 8m does not fit this host, which predates this branch.

No redteam round owed: this withdraws a grant. No mount generation, no seccomp filter, no host-integration surface.

🤖 Generated with Claude Code