chenhg5/cc-connect · error

config: %s.run_as_env must not include dangerous variable %q

Error message

config: %s.run_as_env must not include dangerous variable %q

What it means

A config validation error from validateRunAsEnv: the run_as_env allowlist contains a variable name on the dangerous list (PATH, HOME, LD_PRELOAD, etc.). Passing these through runuser/sudo wrappers is unsafe (privilege-escape and injection vectors), so config load aborts with the offending name quoted.

Source

Thrown at config/config.go:58

var dangerousEnvVars = map[string]bool{
	"LD_PRELOAD":            true,
	"LD_LIBRARY_PATH":       true,
	"DYLD_INSERT_LIBRARIES": true,
	"DYLD_LIBRARY_PATH":     true,
	"PATH":                  true,
	"HOME":                  true,
	"USER":                  true,
	"SHELL":                 true,
	"SUDO_USER":             true,
	"SUDO_COMMAND":          true,
}

func validateRunAsEnv(prefix string, envVars []string) error {
	for _, v := range envVars {
		name := strings.TrimSpace(v)
		if dangerousEnvVars[strings.ToUpper(name)] {
			return fmt.Errorf("config: %s.run_as_env must not include dangerous variable %q", prefix, name)
		}
	}
	return nil
}

func validateRunAsUser(prefix, name string) error {
	if name == "" {
		return nil
	}
	if runtime.GOOS == "windows" {
		return fmt.Errorf("config: %s.run_as_user is only supported on Linux/macOS", prefix)
	}
	if name == "root" || name == "0" {
		return fmt.Errorf("config: %s.run_as_user must not be root", prefix)
	}
	if !isValidRunAsUserName(name) {
		return fmt.Errorf("config: %s.run_as_user %q contains invalid characters (allowed: a-z, A-Z, 0-9, -, _, .; must start with a letter or underscore)", prefix, name)
	}

View on GitHub (pinned to 4000b2338a)

Solutions

1. Remove the flagged variable from run_as_env in config.toml
2. Pass non-sensitive, task-specific variables only
3. Set unavoidable environment via the agent's own config files instead

When it happens

Trigger: Thrown at config/config.go:58 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of chenhg5/cc-connect@4000b2338a (2026-09-06). Data as JSON: /api/errors/3c048df564c91657. Report an issue: GitHub.