env support for sandbox

internal/sandbox/config.go

@@ -13,6 +13,7 @@ type Config struct {
 	General    GeneralConfig    `yaml:"general"`
 	Filesystem FilesystemConfig `yaml:"filesystem"`
 	Network    NetworkConfig    `yaml:"network"`
+	Env        []string         `yaml:"env"`
 	Advanced   AdvancedConfig   `yaml:"advanced"`
 }
 
@@ -83,6 +84,13 @@ func DefaultConfig() *Config {
 			BindTCP:      []string{},
 			ConnectTCP:   []string{"443"}, // Example: HTTPS for API calls (when Enabled: true)
 		},
+		Env: []string{
+			"HOME",
+			"USER",
+			"PATH",
+			"LANG",
+			"TERM",
+		},
 		Advanced: AdvancedConfig{
 			LDD:     false, // Disabled: fails on Node.js scripts like claude
 			AddExec: true,

internal/sandbox/wrapper.go

@@ -89,6 +89,11 @@ func WrapCommand(cfg *Config, originalCmd []string, cwd string) []string {
 	}
 	// If network not enabled and not unrestricted, no network flags = no network access
 
+	// Environment variables
+	for _, name := range cfg.Env {
+		args = append(args, "--env", name)
+	}
+
 	// Append original command after --
 	args = append(args, "--")
 	args = append(args, originalCmd...)
@@ -140,6 +145,12 @@ func BuildSummary(cfg *Config) string {
 		lines = append(lines, "Network: BLOCKED")
 	}
 
+	// Environment
+	if len(cfg.Env) > 0 {
+		lines = append(lines, "")
+		lines = append(lines, fmt.Sprintf("Environment: %s", strings.Join(cfg.Env, ", ")))
+	}
+
 	return strings.Join(lines, "\n")
 }