[rromenskyi]

Fixes #389.

The path never passes through a shell on its way to a file tool. So $env:USERPROFILE\.gitconfig was joined onto the workspace as a literal $env:USERPROFILE directory, and the read failed on a path the model never wrote. Before that, the risk check had scored, and the user had approved, the home directory the model meant.

The fix is to refuse such a path, not to expand it. The first version of this PR expanded the reference. Review showed that this was a way to read a secret. Reading $OPENAI_API_KEY resolved to <workspace>/sk-…, and the "no such file" error handed the key to the model with no prompt. Expanding also let a call open something other than what the approval prompt, the risk check and git had all seen.

policy.Engine.Resolve now refuses a path that starts with $NAME, ${NAME}, $env:NAME or ${env:NAME} (PowerShell's env: in any case), or %NAME%. The error reads: path "…" starts with $env:USERPROFILE, but file paths are not shell-expanded — pass the full path ($env:USERPROFILE is C:\Users\…).

• The value is named only for a place: HOME, USERPROFILE, APPDATA, LOCALAPPDATA, TEMP, TMP, TMPDIR, PROGRAMDATA, PROGRAMFILES, SYSTEMROOT, WINDIR and XDG_*. Even then it is named only when the value is an absolute path. That way the model can retry with the full path at once. Any other variable's value never appears.
• A reference counts only when a separator or the end of the path follows it. Foo$Bar.class, $Recycle.Bin and $HOME.bak stay file names.
• ~\ on Windows now expands like ~/ does.

The refusal happens in Resolve, before any prompt, and it covers file, run cwd, git paths and /cd.

Tests: TestResolveRefusesALeadingEnvReference checks every spelling, that a secret's value never appears, and that the non-reference names still work. A sabotage pass made 7 mutations: no refusal, the hint leaking any variable, no separator check, case-sensitive env:, no braced env form, no hint, no cmd form. Every one failed the test.

🤖 Generated with Claude Code

[claude]

⚠️ Code review skipped — your organization has no extra usage available to pay for this review.

If your organization's extra usage balance is empty, an organization admin can add extra usage credits at claude.ai/admin-settings/usage. If its monthly spend limit was reached, an admin can raise it on the same page. If neither applies, contact Anthropic support.

Once extra usage is available, someone with write access to this repository can comment @claude review on this pull request to trigger a review.