#18 Security: command_daemon leaks environment variables into argv via --data-dir (v1.1.0)

Summary

In CLI v1.1.0 the long-lived command_daemon is spawned with an environment variable KEY=VALUE string as the value of --data-dir, instead of a directory path. Any secret present in the shell environment can therefore end up in plaintext in the daemon's argv, readable by every local process via ps.

Environment

CLI: browser-act-cli 1.1.0 (installed via uv tool install)
Python: 3.12
OS: macOS 25.1.0 (Apple Silicon)
Previous version 1.0.1 on the same machine was not affected — it had no daemon.

Reproduction

Ensure some variable is exported in the shell, e.g. export MY_TOKEN=sk-example.
Run any command that spawns the daemon, e.g. browser-act browser list.
Inspect the process table:

pgrep -lf command_daemon

Actual result

python3 -m browser_act_cli.command_daemon --cli-version 1.1.0 \
  --data-dir AGENT_ROUTER_TOKEN=sk-<redacted>

The behaviour is deterministic rather than random. After unsetting that variable and re-running the exact same command, the daemon picked up a different environment entry at the same position:

python3 -m browser_act_cli.command_daemon --cli-version 1.1.0 \
  --data-dir AIHUBMIX_API_KEY=<redacted>

Expected result

--data-dir should receive the CLI data directory path, and no environment entry should ever be placed into argv.

Impact

Any secret exported in the user's shell (API keys, agent tokens, CI credentials) may be exposed in plaintext to any local process that can run ps.
Because the daemon is long-lived, the exposure is continuous rather than momentary — unlike a short-lived subprocess.
Agent hosts such as Cursor, Claude Code, and CI runners routinely inject tokens into the environment, so this is likely to hit real secrets in practice.

Likely cause

The environment mapping and the argument list appear to be concatenated or indexed incorrectly when building the Popen call for the daemon.

Worth noting that --data-dir is evidently not honored at all: commands keep working normally despite receiving this garbage value, which suggests the argument is parsed and then discarded.

Suggested fix

Pass the environment via the env= parameter of Popen and keep argv limited to real CLI arguments; additionally validate that --data-dir is an existing path before accepting it.