fix(security): eliminate API key leakage via ps aux across all three execution layers

[dumko2001]

Summary

Closes NVIDIA#325 — API key exposed in process list via ps aux.

This PR is a comprehensive rollup that supersedes open PRs NVIDIA#148, NVIDIA#191, NVIDIA#225, and NVIDIA#330. It fixes every instance of secret leakage and shell injection that was identified during a first-principles audit of all three execution layers.

---

Root Cause

openshell provider create --credential KEY=VALUE passes the secret as a command-line argument. Every user on the machine can read it via ps aux or /proc/<pid>/cmdline. The same pattern existed in:

Layer	File	Old pattern
Legacy CLI	bin/lib/onboard.js	run(\openshell provider create --credential "NVIDIA_API_KEY=${process.env.NVIDIA_API_KEY}"`)`
Plugin (TS)	nemoclaw/src/commands/onboard.ts	execOpenShell(["--credential", \${credentialEnv}=${apiKey}`])`
Blueprint (Python)	nemoclaw-blueprint/orchestrator/runner.py	provider_args.extend(["--credential", f"OPENAI_API_KEY={credential}"])

---

Fix — Three Commits

Commit 1 — fix(runner): safe argv primitives + opts.env overwrite fix

• runArgv(prog, args, opts) — spawnSync without shell; no metacharacter expansion
• runCaptureArgv(prog, args, opts) — execFileSync without shell; returns stdout string
• assertSafeName(name, label) — validates user-supplied names against [a-zA-Z0-9][a-zA-Z0-9_-]{0,62}; calls process.exit(1) on rejection
• Fix pre-existing opts.env overwrite bug: mergeEnv() destructures opts.env before the rest spread so PATH/HOME/DOCKER_HOST are always preserved

Commit 2 — fix(cli): shell-string → argv arrays (injection prevention)

Converts every run(\...`)` call that accepted user-controlled values across:

• bin/lib/onboard.js — all openshell/bash/brew calls, fs.cpSync/fs.rmSync replacing shell cp/rm
• bin/lib/nim.js — docker pull/rm/run/stop/inspect + assertSafeName on sandboxName
• bin/lib/policies.js — openshell policy get/set + assertSafeName on both sandboxName and presetName + temp file written with mode: 0o600
• bin/nemoclaw.js — removes inline NVIDIA_API_KEY=VALUE from sudo argv (superseded by sudo -E env inherit); assertSafeName on deploy instanceName; sandbox connect/status/logs/destroy → runArgv

Commit 3 — fix(credentials): env-lookup form for --credential; secrets never in argv

Safe pattern: set the secret in process.env / os.environ before the call, then pass only the env-var name to --credential — openshell reads the value from the environment, never from argv.

File	Change
nemoclaw/src/commands/onboard.ts	process.env[credentialEnv] = apiKey before execOpenShell; both provider create and update paths changed
nemoclaw-blueprint/orchestrator/runner.py	target_cred_env with type-based fallback (supersedes NVIDIA#191); os.environ[target_cred_env] = credential; --credential target_cred_env
nemoclaw-blueprint/blueprint.yaml	Add credential_env: NVIDIA_API_KEY to default profile — without it the fallback would pick OPENAI_API_KEY for the nvidia provider type
nemoclaw/src/onboard/config.ts	writeFileSync uses { mode: 0o600 } so config.json is owner-readable only

---

Verification

$ node --test test/*.test.js
ℹ tests 84
ℹ pass 84
ℹ fail 0

Key tests added:

• test/runner.test.js (22 assertions) — assertSafeName rejects ;, $(), |, ../, spaces; runCaptureArgv does not expand shell metacharacters; opts.env preserves PATH
• test/credential-exposure.test.js (9 assertions) — static scan of all 3 layers for --credential KEY=VALUE patterns; structural checks for process.env[credentialEnv] and os.environ[target_cred_env]; runtime injection PoC

---

ps aux before/after

Before (vulnerable):

openshell provider create --name nvidia-nim --type openai --credential "NVIDIA_API_KEY=nvapi-xxxxxxxx..." --config "OPENAI_BASE_URL=..."

After (safe):

openshell provider create --name nvidia-nim --type openai --credential NVIDIA_API_KEY --config OPENAI_BASE_URL=...

The secret is in the process's environment variables, not in its argv.

---

PRs Superseded

PR	Description	Status
NVIDIA#148	Shell injection via sandbox name	Superseded by commit 2
NVIDIA#191	Python runner credential type fallback	Superseded by commit 3 (includes + extends)
NVIDIA#225	CI / non-interactive mode	Existing isNonInteractive() in onboard.ts already implements this
NVIDIA#330	Credential leak in --credential arg	Superseded by commit 3