[FEATURE] prevent agent from removing CLAUDECODE env var

Preflight Checklist

• [x] I have searched existing requests and this feature hasn't been requested yet
• [x] This is a single feature request (not multiple features)

Problem Statement

We have cli tools we do not want agents to have free access to run - but Claude can unset that env var:

● Bash(printenv | sort)                                                                                                                      
     CLAUDECODE=1                                                                                                                           
     CLAUDE_CODE_ENTRYPOINT=cli                                                                                                             
     … +29 lines (ctrl+o to expand)                                                
                                                                                                                                            
● Bash(unset CLAUDECODE && echo "CLAUDECODE is now: '${CLAUDECODE}'")                                                                       
  ⎿  CLAUDECODE is now: ''  

Proposed Solution

Disallow that to happen

Alternative Solutions

_No response_

Priority

High - Significant impact on productivity

Feature Category

CLI commands and flags

Use Case Example

_No response_

Additional Context

_No response_