now limits variables exposed to cmd to only contents of d