@hegemonart/get-design-done 1.33.0 → 1.33.5

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "Get Design Done — 5-stage agent-orchestrated design pipeline with 9 connections, handoff-first workflow, bidirectional Figma write-back, 22+ specialized agents, queryable knowledge layer (intel store, dependency analysis, learnings extraction), and a self-improvement loop (reflector, frontmatter + budget feedback, global-skills layer). v1.20.0 ships the SDK foundation: gdd-state MCP server (11 typed tools), lockfile-safe STATE.md mutations, event stream, and resilience primitives (jittered-backoff, rate-guard, error-classifier, iteration-budget) for rate-limit + 429 + context-overflow recovery. Full CI/CD pipeline (Node 22/24 × Linux/macOS/Windows) and release automation (auto-tag + GitHub Release + release-time smoke test).",
-    "version": "1.33.0"
+    "version": "1.33.5"
   },
   "plugins": [
     {
       "name": "get-design-done",
       "source": "./",
       "description": "Agent-orchestrated 5-stage design pipeline: Brief → Explore → Plan → Design → Verify. 22+ specialized agents, 9 connections (Figma, Refero, Preview, Storybook, Chromatic, Figma Writer, Graphify, Pinterest, Claude Design), Claude Design handoff, bidirectional Figma write-back, and a queryable intel store (.design/intel/) for dependency and learnings queries. Standalone commands: style, darkmode, compare, figma-write, graphify, handoff, analyze-dependencies, skill-manifest, extract-learnings. Embeds NNG heuristics, WCAG thresholds, typographic systems, motion framework, and anti-pattern catalog. Ships with a full CI/CD pipeline (Node 22/24 × Linux/macOS/Windows) and release automation. Optimization layer (v1.0.4.1, retroactive): gdd-router + gdd-cache-manager skills, PreToolUse budget-enforcer hook, tier-aware agent frontmatter, lazy checker gates, streaming synthesizer, /gdd:warm-cache + /gdd:optimize commands, and cost telemetry at .design/telemetry/costs.jsonl — targeting 50-70% per-task token-cost reduction with no quality-floor regression. v1.20.0 SDK foundation: gdd-state MCP server (11 typed tools), lockfile-safe STATE.md mutations, event stream at .design/telemetry/events.jsonl, resilience primitives (jittered-backoff, rate-guard, error-classifier, iteration-budget) with rate-limit + 429 + context-overflow recovery, and TypeScript toolchain.",
-      "version": "1.33.0",
+      "version": "1.33.5",
       "author": {
         "name": "hegemonart"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "get-design-done",
   "short_name": "gdd",
-  "version": "1.33.0",
+  "version": "1.33.5",
   "description": "Agent-orchestrated 5-stage design pipeline: Brief → Explore → Plan → Design → Verify. 22+ specialized agents, 9 connections (Figma, Refero, Preview, Storybook, Chromatic, Figma Writer, Graphify, Pinterest, Claude Design), handoff-first workflow via Claude Design bundles, bidirectional Figma write-back (annotations, Code Connect), queryable intel store (`.design/intel/`) for O(1) design surface lookups, and self-improvement loop (reflector agent, frontmatter + budget feedback, global-skills layer at `~/.claude/gdd/global-skills/`). Standalone commands: style, darkmode, compare, figma-write, graphify, handoff, analyze-dependencies, skill-manifest, extract-learnings, reflect, apply-reflections. Embeds NNG heuristics, WCAG thresholds, typographic systems, motion framework, and anti-pattern catalog. Ships with a full CI/CD pipeline (Node 22/24 × Linux/macOS/Windows, lint + schema + frontmatter + stale-ref + shellcheck + gitleaks + injection-scan + blocking size-budget) and release automation (auto-tag + GitHub Release + release-time smoke test). Optimization layer (v1.0.4.1, retroactive): gdd-router + gdd-cache-manager skills, PreToolUse budget-enforcer hook, tier-aware agent frontmatter, lazy checker gates, streaming synthesizer, /gdd:warm-cache + /gdd:optimize commands, and cost telemetry at .design/telemetry/costs.jsonl — targeting 50-70% per-task token-cost reduction with no quality-floor regression. v1.20.0 SDK foundation: gdd-state MCP server (11 typed tools), lockfile-safe STATE.md mutations, event stream at .design/telemetry/events.jsonl, resilience primitives (jittered-backoff, rate-guard, error-classifier, iteration-budget) with rate-limit + 429 + context-overflow recovery, and TypeScript toolchain. v1.27.7 ships gdd-mcp (Phase 27.7): 12 read-only MCP tools for sub-3s priming. v1.28.0 (Phase 28): Foundational References Tier 2 — 5 new reference files (color-theory, composition, proportion-systems, i18n, contrast-advanced), 2 verifier i18n probes + 1 explore i18n-readiness probe, 12 additive cross-link insertions across 10 existing references, 2 orthogonal audit-scoring lens-tags (composition_alignment + i18n_readiness).",
   "author": {
     "name": "hegemonart",

package/CHANGELOG.md

@@ -4,6 +4,31 @@ All notable changes to get-design-done are documented here. Versions follow [sem
 
 ---
 
+## [1.33.5] - 2026-05-31
+
+### Phase 33.5 — GDD Runtime Security Hardening
+
+Audits and hardens GDD's **own** runtime attack surface — the multi-MCP-server, peer-CLI-spawning, WebSocket-transport-emitting SDK that grew across Phases 20–27 without a formalized security model. Phase 14.5 ships a safety floor for *user code being audited*; this phase is the equivalent for GDD's *own* runtime. Ships a STRIDE threat model + static runtime audit, an outbound-network CI gate, WebSocket bind hardening, gdd-state MCP input validation, peer-CLI env sandboxing, a secret-scan extension + fuzz, a published disclosure policy, and a regression baseline. A decimal release on the v1.33.x arc (CHANGELOG-only, D-01); no new runtime dependency (built-ins only, D-12). 6 plans across Waves A–C.
+
+### Added
+
+- **STRIDE threat model + runtime audit.** `reference/gdd-threat-model.md` models the five in-scope runtime components (hooks, the `gdd-state` MCP server, the peer-CLI broker, the WebSocket transport, the issue-reporter outbound path) with a per-component Assets / Entry-points / STRIDE / Mitigations / Residual treatment and a residual-risk → closing-plan map; `reference/gdd-runtime-audit.md` records the static audit that backs it. Both are registry-tracked.
+- **Outbound-network CI gate.** `scripts/scan-outbound-network.cjs` + `npm run scan:outbound`, wired into the CI `security` job, statically gates **active egress** (require/import of `node:http(s)`/`ws`/`node-fetch`/`axios`/`undici`, `fetch(`, `http(s).get/.request`, `new WebSocket(Server)`, and child-process spawn of `gh`/`curl`/`wget`/`nc`/`ssh`/`scp`) under `hooks/ scripts/ sdk/ bin/`, failing on any active-egress site not under an allowlisted glob in `scripts/security/outbound-allowlist.json` (D-06). Comment-only matches and bare-URL literals are skipped (a URL cannot exfiltrate without a call). This forces Phase 33.6's OpenRouter REST client to explicitly allowlist its new egress.
+- **WebSocket localhost-default bind + timing-safe token.** `scripts/lib/transports/ws.cjs` now defaults its bind host to **127.0.0.1** (was the implicit `0.0.0.0` all-interfaces bind); a remote bind is opt-in via `.design/config.json` `event_stream.bind_host` or the `GDD_WS_BIND_HOST` env override, and `scripts/scan-ws-bind.cjs` gates that the default config would never bind `0.0.0.0`. The Bearer-token compare is upgraded to `crypto.timingSafeEqual` (was `!==`, timing-unsafe); the existing ≥8-char-token rule is retained (D-04).
+- **gdd-state MCP input validation.** `sdk/mcp/gdd-state/tools/shared.ts` gains a `resolveStatePath()` path-traversal guard (rejects `..`-escape / absolute-outside / best-effort symlink-escape on the `GDD_STATE_PATH` override) and an `assertInputWithinLimits()` payload cap (64 KiB input / 8192-char string / depth-32 JSON-bomb guard) wired into all 11 tool handlers; the 11 tool input schemas are tightened with `maxLength`/`maxItems` (and already carried `additionalProperties:false`) (D-08).
+- **Peer-CLI env sandbox (allowlist-forward / default-deny).** A shared `scripts/lib/peer-cli/sanitize-env.cjs` helper builds the spawned child's environment from an OS-essential baseline **plus** an explicit allowlist read from `.design/config.json` `peer_cli.env_allowlist`, applied to both the acp and asp clients. GDD's `ANTHROPIC_API_KEY` / `GH_TOKEN` / `GDD_*` and anything secret-shaped are never forwarded to a spawned peer unless explicitly allowlisted (D-03).
+- **Secret-scan extension + fuzz.** `scripts/lib/redact.cjs` adds three modern token formats — Gemini/GCP `AIza…`, GitHub fine-grained `github_pat_…`, and GitHub server/oauth/user/refresh `gh[sour]_…` — bringing the redaction set to **11 patterns**, with a synthetic-secret fuzz test asserting zero leak per provider format (D-07). The existing PEM/JWT/anthropic/stripe/slack/`ghp_`/AWS/`sk-` patterns are retained.
+- **`SECURITY.md` disclosure policy.** A repo-root `SECURITY.md` documents the supported-versions stance and routes vulnerability reports through **GitHub private security advisories** (the repo Security tab → "Report a vulnerability"); it publishes no email / no PII (D-02) and notes that enabling private vulnerability reporting is a one-line repo setting the maintainer must toggle (D-11).
+- **Regression baseline.** `test/fixtures/baselines/phase-33-5/` freezes the hardened surface — a STRIDE-checklist snapshot, a hardening-surface invariant manifest (ws default host, redact pattern count, sanitize-env module + allowlist key, 11 gdd-state schemas, allowlist/threat-model/audit paths), and a synthetic secret-fuzz corpus — pinned by `test/suite/phase-33-5-baseline.test.cjs` so a future change cannot silently undo a hardened surface.
+
+### Notes
+
+- **WebSocket event-stream now binds `127.0.0.1` by default (was `0.0.0.0`).** Opt into a remote bind via `.design/config.json` `event_stream.bind_host` or the `GDD_WS_BIND_HOST` env override. This is **not marked BREAKING** — the event stream is a token-gated observability surface (Bearer auth ships on every upgrade), and the safe-by-default localhost bind only restricts an unintended off-box exposure; the opt-in escape hatch preserves the remote-bind workflow for anyone who relied on it.
+- All Phase 33.5 tests are hermetic (no network, no live peer; the WS test binds ephemeral localhost; the outbound + bind gates are static scans), so the default `npm test` stays green (D-10).
+- 6-manifest lockstep at **v1.33.5** (`package.json` + `package-lock.json` (root + `packages.""`) + `.claude-plugin/plugin.json` + `.claude-plugin/marketplace.json` (metadata.version + plugins[0].version) + `.cursor-plugin/plugin.json` + `.codex-plugin/plugin.json`). Version-sync hygiene done upfront (D-09): `OFF_CADENCE_VERSIONS.add('1.33.5')` + the 13 live-pinned `manifests-version.txt` baselines forward-propagated 1.33.0 → 1.33.5.
+
+---
+
 ## [1.33.0] - 2026-05-30
 
 ### Phase 33 — Skill Behavior Tests (Pressure-Scenario Harness)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hegemonart/get-design-done",
-  "version": "1.33.0",
+  "version": "1.33.5",
   "description": "A design-quality pipeline for AI coding agents: brief, plan, implement, and verify UI work against your design system.",
   "author": "Hegemon",
   "homepage": "https://github.com/hegemonart/get-design-done",
@@ -60,6 +60,8 @@
     "validate:frontmatter": "node --experimental-strip-types scripts/validate-frontmatter.ts agents/",
     "detect:stale-refs": "node scripts/detect-stale-refs.cjs",
     "scan:injection": "node scripts/run-injection-scanner-ci.cjs",
+    "scan:outbound": "node scripts/scan-outbound-network.cjs",
+    "scan:ws-bind": "node scripts/scan-ws-bind.cjs",
     "test:size-budget": "node --test test/suite/agent-size-budget.test.cjs",
     "release:extract-changelog": "node scripts/extract-changelog-section.cjs",
     "verify:version-sync": "node scripts/verify-version-sync.cjs",

package/reference/gdd-runtime-audit.md

@@ -0,0 +1,111 @@
+# GDD Runtime Static Security Audit
+
+**Phase:** 33.5 — GDD Runtime Security Hardening · **Plan:** 33.5-02 (Wave A) · **Date:** 2026-05-31
+**Reference:** branch `phase/33-5-runtime-security`
+**Scope:** the SHIPPED runtime surface — `hooks/`, `scripts/`, `sdk/`, `bin/`.
+**Method:** static enumeration (read-only source inspection, no execution, no network).
+**Companions:**
+
+- `scripts/security/outbound-allowlist.json` — the machine-readable, CANONICAL active-egress
+  allowlist that Phase 33.5-04's `scripts/scan-outbound-network.cjs` gate `JSON.parse`s (this
+  report is its human-readable rationale).
+- `reference/gdd-threat-model.md` — the STRIDE threat model (Phase 33.5-01).
+
+This audit freezes the egress / secret / external-input picture so any *future* surface that is
+not pre-approved trips the 33.5-04 gate at CI time. It is grounded in the CONTEXT real-tree sweep
+("no raw unexpected egress found"), re-verified against HEAD by reading each cited file.
+
+---
+
+## Outbound-network call sites
+
+GDD's runtime makes outbound calls (or local IPC/server binds) from exactly the sites below. Each
+maps to an `outbound-allowlist.json` directory glob (see the **Allowlisted** column). The 33.5-04
+gate is **ACTIVE-egress-only** — it matches `require`/`import` of `node:http(s)`/`http(s)`/`ws`/
+`node-fetch`/`axios`/`undici`, `fetch(`, `http(s).get/.request(`, `new WebSocket`/`new
+WebSocketServer`/`WebSocketServer(`, and child-process `spawn`/`spawnSync`/`exec*` of
+`gh|curl|wget|nc|ssh|scp` — so a bare URL string alone never trips it.
+
+| File | What it calls | Transport | Legitimacy | Allowlisted by |
+| --- | --- | --- | --- | --- |
+| `scripts/lib/figma-extract/pull.cjs` | `fetch` → `https://api.figma.com/v1` (read-only) | REST (global `fetch`, injectable) | User-initiated Figma extract; token from `FIGMA_TOKEN`/`FIGMA_PERSONAL_ACCESS_TOKEN`, never persisted/logged | `scripts/lib/figma-extract/**` |
+| `scripts/lib/figma-extract/styles-resolver.cjs` | Figma REST styles lookup (shares `pull.cjs` fetch path) | REST | Same extract flow; read-only | `scripts/lib/figma-extract/**` |
+| `scripts/lib/figma-extract/receiver.cjs` | `require('node:http')` → `http.createServer` + `server.listen(RECEIVER_PORT, RECEIVER_HOST)` | local HTTP server | **EPHEMERAL** handshake server on `127.0.0.1`; lives for one extract run then exits (timeout-armed) | `scripts/lib/figma-extract/**` |
+| `scripts/lib/transports/ws.cjs` | `require('node:http')` + `new WebSocketServer({ noServer })` + `httpServer.listen(opts.port)` | WebSocket over HTTP upgrade | Event-stream transport; **hardened in 33.5-03** (127.0.0.1 default bind, Bearer token ≥8 chars → timing-safe compare) | `scripts/lib/transports/ws.cjs` |
+| `scripts/lib/issue-reporter/gh-submit.cjs` | `spawn('gh', …)` / `spawnSync` | `gh` CLI spawn | Rides `gh`'s own logged-in auth; **no raw HTTP**; frozen destination + kill-switch | `scripts/lib/issue-reporter/**` |
+| `scripts/lib/issue-reporter/dedup.cjs` | `spawn('gh', …)` (3 call sites) | `gh` CLI spawn | Duplicate-issue lookup before submit; same frozen destination | `scripts/lib/issue-reporter/**` |
+| `scripts/lib/issue-reporter/gh-absent-fallback.cjs` | `spawnSync('gh', ['gh'], {stdio:'ignore'})` (presence probe) | `gh` CLI spawn | Detects whether `gh` is installed; no payload | `scripts/lib/issue-reporter/**` |
+| `scripts/lib/peer-cli/acp-client.cjs` | `spawn(command, args, …)` (no shell) | child-process / stdio IPC | Spawns a LOCAL peer binary over stdio (JSON-RPC); **IPC, not network**; env sandboxed (33.5-04) | `scripts/lib/peer-cli/**` |
+| `scripts/lib/peer-cli/asp-client.cjs` | `spawn(...)` (no shell) | child-process / stdio IPC | Local peer over stdio; same env-allowlist sandbox | `scripts/lib/peer-cli/**` |
+| `scripts/e2e/run-headless.ts` | live Anthropic API run | REST (key-gated) | Test infrastructure only; gated on `ANTHROPIC_API_KEY` + main-branch; never in default `npm test` | `scripts/e2e/**` |
+| `scripts/lib/authority-watcher/index.cjs` | authority-feed classification of already-fetched records | (delegated) | The live article fetch is delegated to `agents/design-authority-watcher.md`; `index.cjs` is the pure-CommonJS classifier. Allowlisted so any direct feed fetch added here stays pre-approved | `scripts/lib/authority-watcher/**` |
+
+**Documented but NOT hard-gated** (the scanner scope is `.js`-family + active-egress only —
+these cannot exfiltrate on their own and are covered by gitleaks + the threat model):
+
+| File / surface | What it is | Why not gated |
+| --- | --- | --- |
+| `scripts/lib/easings.cjs` (line 6) | React-Native `Easing.js` spec link in a comment | bare URL string, no call |
+| `scripts/lib/spring.cjs` (line 6) | React-Native `SpringConfig.js` spec link in a comment | bare URL string, no call |
+| `scripts/lib/install/merge.cjs` (line 85) | "Plugin repository: https://github.com/hegemonart/get-design-done" printed string | bare URL string, no call |
+| `scripts/lib/issue-reporter/destination.cjs` (lines 29–30) | frozen `DESTINATION_URL` / `ISSUE_TEMPLATE_URL` constants | constants consumed only via the `gh` spawn above |
+| `scripts/lint-agentskills-spec.cjs` (line 76) | spec-example URL in a comment | bare URL string, no call |
+| `hooks/update-check.sh` | shell update-check egress | shell script — outside the `.{js,cjs,mjs,ts}` scanner scope |
+| `scripts/bootstrap.sh` | shell bootstrap egress | shell script — outside the `.{js,cjs,mjs,ts}` scanner scope |
+
+---
+
+## Secret-handling sites
+
+Where a token/key/credential is read, forwarded, or scrubbed across the shipped runtime.
+
+| File | Secret touched | Action | Risk note |
+| --- | --- | --- | --- |
+| `scripts/lib/redact.cjs` | PEM, JWT, Anthropic `sk-ant-`, Stripe `sk_live_`, Slack `xox*`, GitHub `ghp_`, AWS `AKIA`, generic `sk-` (8 patterns) | **scrub** | Deep-walks event-stream payloads at serialize time so everything that hits disk / a bus subscriber is `[REDACTED:<type>]`. **D-07 extends** with Gemini `AIza…`, GitHub fine-grained `github_pat_`, and GitHub `ghs_/gho_/ghu_/ghr_` (currently uncovered). |
+| `scripts/lib/peer-cli/acp-client.cjs` (line 102) | full `process.env` | **forward** (default) | `const env = opts.env … : process.env` → GDD's `ANTHROPIC_API_KEY`/`GH_TOKEN`/`GDD_*` leak to a spawned peer when `opts.env` is absent. **Fixed by 33.5-04** (allowlist-forward, default-deny, shared `sanitize-env`). |
+| `scripts/lib/peer-cli/asp-client.cjs` (line 122) | full `process.env` | **forward** (default) | Same default-inherit gap; same 33.5-04 fix. |
+| `scripts/lib/figma-extract/pull.cjs` | `FIGMA_TOKEN` / `FIGMA_PERSONAL_ACCESS_TOKEN` | **read** | Lives only inside caller-provided `headers`; NEVER written to disk, NEVER logged (diagnostics read a short body prefix, never the token — D-10 of the figma sub-plan). |
+| `scripts/lib/issue-reporter/gh-submit.cjs` / `dedup.cjs` | none held by GDD | **delegate** | Authentication is `gh`'s own logged-in credential store; GDD never reads or forwards a GitHub token for these spawns. |
+
+---
+
+## External-input surfaces
+
+Where untrusted data crosses a trust boundary into GDD's runtime.
+
+| Surface | Untrusted source | Boundary | Risk note |
+| --- | --- | --- | --- |
+| WebSocket upgrade request | a remote client connecting to the event-stream WS | `scripts/lib/transports/ws.cjs` HTTP `upgrade` handler | Bearer-token gate (≥8 chars) already ships; **33.5-03** adds 127.0.0.1-default bind + timing-safe compare so the default config does not expose `0.0.0.0`. |
+| gdd-state MCP tool inputs | the MCP client / model | `sdk/mcp/gdd-state/tools/*.ts` (11 tools) + `tools/shared.ts` | Each tool has a JSON schema under `sdk/mcp/gdd-state/schemas/`; **33.5-08** tightens them (`additionalProperties:false` + `maxLength`) and adds a payload-size cap (JSON-bomb guard). |
+| `GDD_STATE_PATH` env override | the launching environment | `sdk/mcp/gdd-state/tools/shared.ts:resolveStatePath()` (line 60–61) | `process.env['GDD_STATE_PATH'] ?? .design/STATE.md` with **no path-traversal guard** today — `..`/absolute-outside escape is unchecked. **Closed by 33.5-08** (resolve + assert within project root / `.design/`). |
+| `.design/config.json` | a repo-local config file (potentially attacker-influenced in a malicious clone) | 14 modules incl. `scripts/lib/peer-cli/registry.cjs` (line 154) | Drives `peer_cli.enabled_peers` / (33.5) `peer_cli.env_allowlist`, the WS `event_stream.bind_host`, and the issue-reporter kill-switch. Parsed defensively; opt-in by design (a peer must be explicitly enabled). |
+| peer child `stdout` | a spawned LOCAL peer CLI | `scripts/lib/peer-cli/acp-client.cjs` (JSON-RPC frame parser) | A malicious/buggy peer could flood stdout — **already capped at 16 MiB un-newlined** (DoS guard). JSON-RPC frames are parsed, not `eval`'d. |
+
+---
+
+## Finding
+
+The legitimate active-egress set is fully enumerated above and **no raw unexpected egress was
+found** — every outbound call, server bind, or child spawn maps to one of six trusted modules,
+each frozen into `scripts/security/outbound-allowlist.json` with a justification. The allowlist
+uses **directory globs** so a new helper in an already-trusted module (e.g. another
+`figma-extract` file) does not silently trip the gate, and every glob is asserted by
+`test/suite/phase-33-5-audit.test.cjs` to resolve to ≥1 real file — so the 33.5-04 gate cannot be
+defeated by a stale entry that matches nothing.
+
+The residual gaps surfaced here are **closed by the remaining Phase 33.5 plans**:
+
+- **33.5-03** — WebSocket bind hardening: 127.0.0.1 default bind (no more `0.0.0.0`), opt-in remote
+  via `event_stream.bind_host`, and a timing-safe (`crypto.timingSafeEqual`) token compare. Closes
+  the WS-upgrade external-input row.
+- **33.5-04** — Outbound-network static CI gate: `scripts/scan-outbound-network.cjs` +
+  `npm run scan:outbound`, consuming THIS plan's `outbound-allowlist.json`. Also lands the
+  peer-CLI env-allowlist sandbox (shared `sanitize-env`) that closes the `acp-client.cjs` /
+  `asp-client.cjs` full-`process.env` forward rows.
+- **33.5-05** (and 33.5-07/08) — secret-scan extension (Gemini + GitHub fine-grained/server
+  tokens) with a synthetic-secret fuzz, the gdd-state path-traversal guard + payload cap +
+  tightened schemas, `SECURITY.md`, and the regression baseline.
+
+This report + the canonical allowlist satisfy **SEC-02** and unblock ROADMAP **SC#5** (the
+outbound-network gate), as amended by **D-05** (corrected paths `reference/` + `test/suite/`) and
+**D-06** (the gate mirrors the injection-scanner: a data file + a scanner that loads it).

package/reference/gdd-threat-model.md

@@ -0,0 +1,336 @@
+# GDD Runtime Threat Model (STRIDE)
+
+> Phase 33.5 · SEC-01 · STRIDE pass over GDD's **own** runtime attack surface.
+> Generated against branch `phase/33-5-runtime-security`, HEAD `5374bed`.
+
+## Scope
+
+This document models the security posture of **GDD's own runtime** — the
+multi-MCP-server, peer-CLI-spawning, WebSocket-emitting SDK that grew across
+Phases 20–27 without a formalized security model. It does **NOT** model the
+user code that GDD audits; the safety floor for *audited user code* is Phase
+14.5's concern. This is the equivalent threat model for GDD's *own* moving
+parts: the hooks that run on every session start, the two MCP servers that
+read and mutate `STATE.md`, the broker that spawns peer CLIs, the WebSocket
+transport that streams the event bus, and the issue-reporter that reaches the
+network through `gh`.
+
+**STRIDE** is the Microsoft threat taxonomy used throughout: **S**poofing
+(pretending to be someone/something you are not), **T**ampering (unauthorized
+modification of data or code), **R**epudiation (denying an action with no
+audit trail), **I**nformation disclosure (leaking data to the wrong party),
+**D**enial of service (exhausting a resource so legitimate use fails), and
+**E**levation of privilege (gaining capabilities you were not granted).
+
+Each of the five in-scope components below gets a fixed five-part treatment:
+**Assets** (what an attacker wants), **Entry points** (the untrusted-input
+boundary), **STRIDE threats** (which categories apply), **Current mitigations**
+(citing **real shipped code** — file + line + behavior), and **Residual risks**
+(threats current code does **not** fully cover, each routed to the Phase 33.5
+plan that closes it). Out of scope per CONTEXT: rewriting the issue-reporter
+network model — it is **documented** here as already-mitigated, not
+re-engineered.
+
+## Trust boundaries
+
+The runtime crosses four trust boundaries. On the untrusted side of each sits
+input that an attacker (or a compromised peer / config author / network host)
+controls; the table names what crosses the line.
+
+| Boundary | Untrusted side | What crosses |
+| --- | --- | --- |
+| WS event-stream server `←` client | A WebSocket client on the network (LAN/internet if bound wide) | The HTTP `Upgrade` request + `Authorization: Bearer` header |
+| gdd-state MCP `←` environment / config / tool input | Whoever sets `GDD_STATE_PATH` or supplies a tool-call payload, or authors `.design/config.json` | The `GDD_STATE_PATH` env value + the JSON tool-input payloads |
+| Peer-CLI broker `↔` spawned child | A spawned peer CLI (Codex / Gemini / Cursor / Copilot / Qwen) and its stdout stream | The child's stdout JSON frames + the parent env handed to the child |
+| Outbound call sites `↔` external host | The remote HTTP host / GitHub / Figma the call reaches | The outbound request payload + whatever the remote returns |
+
+The event payloads that traverse the bus (and therefore the WS transport and
+any persisted JSONL) are scrubbed at serialize time — see Component 4's
+`redact.cjs` mitigation, which is the cross-cutting information-disclosure
+control for the whole bus.
+
+---
+
+## Component 1 — Hooks (SessionStart update-check + budget/context-monitor)
+
+The hooks run automatically: `SessionStart` fires the update-check on every
+session, and the budget / context-monitor hook runs on tool-use to enforce
+spend and context ceilings. They execute with the user's full shell privileges
+inside the user's repo, with no sandbox.
+
+- **Assets:** The user's shell + filesystem (the hook runs as the user); the
+  integrity of the budget/context accounting the monitor maintains; the
+  network reachability of the update-check's outbound call.
+- **Entry points:** The update-check's outbound HTTP fetch and whatever it
+  parses from the response (a version string / changelog); the hook's read of
+  `.design/config.json` (a malicious or malformed config is untrusted input);
+  the tool-use payload the budget monitor inspects.
+- **STRIDE threats:**
+  - **Spoofing:** A spoofed update endpoint (DNS/MITM) could feed a forged
+    "latest version" response to the update-check.
+  - **Tampering:** A malformed `.design/config.json` could try to corrupt the
+    budget/context accounting or flip the monitor's thresholds.
+  - **Repudiation:** Hook actions are largely silent — limited audit trail of
+    what a SessionStart hook did or why a budget veto fired.
+  - **Information disclosure:** The update-check's User-Agent / outbound
+    request reveals that GDD is in use; a verbose hook could echo env into logs.
+  - **Denial of service:** A hung or slow update endpoint could stall session
+    start if the fetch were unbounded.
+  - **Elevation of privilege:** The hook already runs at full user privilege —
+    the residual concern is a config-driven path or command injection lifting
+    *attacker* input to that privilege level.
+- **Current mitigations:** The update-check is **advisory** — it informs of a
+  newer version and never auto-installs or executes downloaded code, so a
+  spoofed version string cannot achieve code execution. The budget /
+  context-monitor reads config defensively (missing file / malformed JSON /
+  missing key are tolerated, mirroring the issue-reporter kill-switch's
+  config-tolerance contract in `scripts/lib/issue-reporter/kill-switch.cjs`).
+  Hooks emit through the event bus, which is redacted by `redact.cjs` at
+  serialize time (see Component 4), so secrets in hook telemetry are scrubbed.
+- **Residual risks:** The update-check's outbound egress is one of the
+  cross-cutting call sites that currently has **no machine-readable allowlist
+  and no CI gate** asserting it is the only network touch a hook makes →
+  audited + allowlisted in **33.5-02** and gated in **33.5-04**. (The shell
+  hook `hooks/update-check.sh` is `.sh`, outside the `.js`-family static
+  scanner's scope, so it is **documented** in the **33.5-02** audit report
+  rather than hard-gated.)
+
+---
+
+## Component 2 — MCP servers (gdd-state: 11 mutating tools / gdd-mcp: read)
+
+Two MCP servers expose GDD state to an MCP client: **gdd-state**
+(`sdk/mcp/gdd-state/`) with **11 mutating tools** — `add_blocker`,
+`add_decision`, `add_must_have`, `checkpoint`, `frontmatter_update`, `get`,
+`probe_connections`, `resolve_blocker`, `set_status`, `transition_stage`,
+`update_progress` — and **gdd-mcp** (`sdk/mcp/gdd-mcp/`) with read tools. The
+mutating server is the higher-value target because it writes `STATE.md`.
+
+- **Assets:** The integrity of `STATE.md` (the project's source of truth for
+  position, decisions, blockers, stage); the event stream the mutations emit;
+  the filesystem region the server is allowed to write.
+- **Entry points:** The `GDD_STATE_PATH` environment variable (which redirects
+  *where the server reads/writes*); the JSON tool-input payloads for all 11
+  mutating tools; the `.design/STATE.md` file content the server parses.
+- **STRIDE threats:**
+  - **Spoofing:** A tool caller could impersonate a legitimate pipeline stage
+    and drive `transition_stage` / `set_status` without authorization.
+  - **Tampering:** Crafted tool inputs could write hostile content into
+    `STATE.md`, or `GDD_STATE_PATH` could redirect writes onto an unintended
+    file (path traversal).
+  - **Repudiation:** Without a complete mutation audit trail, a hostile or
+    buggy mutation is hard to attribute — partly addressed by the event
+    emissions below.
+  - **Information disclosure:** A `get` against a traversed path could read a
+    file outside the intended `.design/` boundary.
+  - **Denial of service:** A JSON-bomb (deeply nested object / multi-megabyte
+    string field) in a tool payload could exhaust memory/CPU during parse.
+  - **Elevation of privilege:** Path traversal via `GDD_STATE_PATH` plus an
+    absent boundary check effectively elevates a tool caller's reach to any
+    file the process can write.
+- **Current mitigations:** Every mutation emits a `state.mutation` /
+  `state.transition` event through `emitStateMutation()` / `emitStateTransition()`
+  (`sdk/mcp/gdd-state/tools/shared.ts` lines 91–140), giving a partial audit
+  trail (anti-repudiation). Handlers **never throw to the harness** — every
+  error funnels through `errorResponse()` → `toToolError()` into a structured
+  `{success:false,error}` (shared.ts lines 28–31, 148–151), so a malformed
+  input degrades to a clean error instead of a crash. Each of the 11 tools
+  already ships a JSON input schema under `sdk/mcp/gdd-state/schemas/`. State
+  events are redacted by `redact.cjs` at serialize time (Component 4).
+- **Residual risks:** `resolveStatePath()` (`sdk/mcp/gdd-state/tools/shared.ts`
+  lines 60–64) honors `GDD_STATE_PATH` with **no path-traversal guard** — it
+  returns the override verbatim, so `..` escape / absolute-outside / symlink
+  escape are unchecked. The tool schemas exist but carry **no payload-size cap**
+  (no JSON-bomb guard) and are not uniformly tightened
+  (`additionalProperties:false` + `maxLength`). Path traversal + JSON-bomb +
+  un-tightened schemas are all closed by **33.5-03** (path-traversal guard +
+  payload cap + all 11 schemas tightened).
+
+---
+
+## Component 3 — Peer-CLI broker (acp-client + asp-client child spawn)
+
+The broker spawns peer CLIs over stdio: `scripts/lib/peer-cli/acp-client.cjs`
+(ACP-protocol peers) and `scripts/lib/peer-cli/asp-client.cjs` (Codex
+app-server protocol). Both fork a local child process and exchange
+line-delimited JSON over its stdio. The child is **untrusted** — it is a
+third-party CLI whose stdout the broker parses.
+
+- **Assets:** GDD's process environment — specifically `ANTHROPIC_API_KEY`,
+  `GH_TOKEN`, and any `GDD_*` / provider secret in `process.env`; the broker's
+  memory/availability; the integrity of the JSON protocol exchange.
+- **Entry points:** The child's **stdout** (untrusted JSON frames the broker
+  must parse); the **environment handed to the child** at spawn time; the
+  `opts.command` / `opts.args` the broker is asked to launch.
+- **STRIDE threats:**
+  - **Spoofing:** A misbehaving peer could emit forged protocol replies /
+    request IDs to confuse the correlation map.
+  - **Tampering:** A peer could stream malformed frames attempting to corrupt
+    the broker's line-buffer / pending-request state.
+  - **Repudiation:** Limited record of exactly what env a given child was
+    handed at spawn.
+  - **Information disclosure:** **The headline risk** — the child inherits
+    GDD's full environment, so a hostile or compromised peer reads
+    `ANTHROPIC_API_KEY` / `GH_TOKEN` straight out of `process.env`.
+  - **Denial of service:** A peer that never emits a newline could force the
+    broker to buffer unbounded stdout until memory exhaustion.
+  - **Elevation of privilege:** Inherited secrets let a peer act *as GDD*
+    against GDD's providers — using GDD's keys for the peer's own ends.
+- **Current mitigations:** `acp-client.cjs` caps an un-terminated stdout line
+  at **`MAX_LINE_BYTES = 16 * 1024 * 1024`** (16 MiB; defined line 62, enforced
+  lines 166–176 — a peer that emits 16 MiB without a newline gets its active
+  prompt rejected as a protocol violation). This is a real **DoS guard** on the
+  untrusted stdout channel. The broker uses plain `spawn` with **no shell**
+  (acp-client.cjs lines 106–113, `windowsHide: true`), avoiding shell-injection
+  on the command path. Per-request correlation via a pending-id map bounds the
+  protocol state machine.
+- **Residual risks:** Both clients default the child's environment to the
+  **full `process.env`** when `opts.env` is absent — `acp-client.cjs` line 102
+  (`const env = opts.env && typeof opts.env === 'object' ? opts.env :
+  process.env;`) and `asp-client.cjs` line 122 (when `opts.env` is absent no
+  `spawnOptions.env` is set, so the child inherits the parent's `process.env` by
+  Node default). This leaks GDD's `ANTHROPIC_API_KEY` / `GH_TOKEN` / `GDD_*` to
+  every spawned peer. Closed by **33.5-04** (allowlist-forward, default-deny env
+  sandbox via a shared `sanitize-env` helper applied to both clients; secrets
+  are never forwarded unless explicitly allowlisted in `.design/config.json`).
+
+---
+
+## Component 4 — WebSocket event-stream transport (scripts/lib/transports/ws.cjs)
+
+`scripts/lib/transports/ws.cjs` exposes the event-stream bus over WebSocket:
+one JSON event per text frame, with optional replay of a tail file to each new
+connection. It is an **optional dependency** (`ws`) — absent installs render an
+install hint instead of starting. When running, it is a network listener.
+
+- **Assets:** The **event stream itself** (every `state.mutation` /
+  `state.transition` / pipeline event, which can carry payload detail); the
+  listening socket; the Bearer token that authorizes a connection.
+- **Entry points:** The HTTP **`Upgrade` request** from any client that can
+  reach the bound socket, and specifically its `Authorization: Bearer <token>`
+  header; the `tailFrom` replay file path.
+- **STRIDE threats:**
+  - **Spoofing:** A client without the token attempting to subscribe to the
+    live event stream.
+  - **Tampering:** N/A for inbound (the transport is push-only to clients) —
+    the concern is read access, not write.
+  - **Repudiation:** No per-connection identity beyond the shared token, so
+    individual subscribers are not distinguishable in an audit.
+  - **Information disclosure:** **The headline risk** — an unauthorized
+    subscriber would receive the entire live event stream, including any
+    sensitive payload detail, if it could reach the socket and pass auth.
+  - **Denial of service:** Many connections / a slow consumer could pressure
+    the server (mitigated in part by fire-and-forget, no-queue backpressure).
+  - **Elevation of privilege:** A network-reachable listener turns a
+    local-only observability feature into a remotely-reachable data source.
+- **Current mitigations:** **Bearer-token auth is enforced on every upgrade**:
+  `ws.cjs` lines 110–116 reject any upgrade whose header is missing or where
+  the supplied token does not match the expected `Bearer` value, returning an `HTTP/1.1 401 Unauthorized` and a
+  socket destroy. The token **must be ≥8 chars** — `startServer` throws a
+  `TypeError` if `opts.token.length < 8` (line 74), preventing trivially weak
+  tokens. Backpressure is **fire-and-forget with no queue** (lines 91–108):
+  events for a non-OPEN socket are dropped, bounding memory under a slow
+  consumer. Cross-cutting for the whole bus: **`redact.cjs`** deep-walks every
+  event payload at serialize time (`scripts/lib/redact.cjs` — `redact()` lines
+  95–116, `redactString()` lines 75–83) and scrubs **8 secret patterns** (pem,
+  jwt, anthropic `sk-ant-`, stripe `sk_live_`, slack `xox[baprs]`, github_pat
+  `ghp_`, aws `AKIA`, generic `sk-`), so secrets in event payloads are masked
+  before they ever reach a WS subscriber or hit disk. This `redact.cjs` scrub is
+  the runtime's primary information-disclosure control across **all** components
+  that emit events.
+- **Residual risks:**
+  - The server binds to **all interfaces (`0.0.0.0`)** by default —
+    `httpServer.listen(opts.port, ...)` (line 145) passes **no host argument**,
+    so on a multi-homed / LAN host the token-protected stream is reachable
+    off-box. The token compare uses `!==` (line 112), which is
+    **timing-unsafe**. Both closed by **33.5-03** (default bind `127.0.0.1` +
+    opt-in remote via `event_stream.bind_host` / `GDD_WS_BIND_HOST` + a CI gate
+    that fails if the default config would bind `0.0.0.0`; upgrade the compare to
+    `crypto.timingSafeEqual`).
+  - `redact.cjs` is **missing three modern token formats**: Gemini / GCP
+    `AIza…`, GitHub fine-grained `github_pat_…`, and GitHub server / oauth /
+    user / refresh `gh[sour]_…`. A payload carrying one of these would leak
+    through the scrub onto the stream and disk. Closed by **33.5-05** (add the
+    three patterns + a synthetic-secret fuzz test asserting zero leak).
+
+---
+
+## Component 5 — Issue-reporter outbound (gh CLI only)
+
+`scripts/lib/issue-reporter/` is the only first-party feature that intentionally
+reaches the network. It assembles a bug report and submits it through the user's
+**`gh` CLI**. **This network model is already mitigated and is DOCUMENTED here,
+not re-engineered** (CONTEXT Out-of-scope: rewriting the issue-reporter network
+model).
+
+- **Assets:** The user's GitHub identity (via the local `gh` auth); the content
+  of the submitted report (which must not carry the user's secrets or
+  unintended PII); the integrity of the destination repo.
+- **Entry points:** The user-invoked report flow (the body / title assembled
+  from local state); the `.design/config.json` and the env that gate whether the
+  reporter runs at all.
+- **STRIDE threats:**
+  - **Spoofing:** A forged destination could try to receive reports — mitigated
+    by the frozen destination below.
+  - **Tampering:** Attempting to redirect submissions to an attacker repo by
+    injecting a destination override.
+  - **Repudiation:** Submissions flow through `gh` under the user's identity,
+    which is itself the attribution record.
+  - **Information disclosure:** **The headline risk** — a report could exfiltrate
+    secrets / PII embedded in local state if the payload were not scrubbed.
+  - **Denial of service:** Not a meaningful vector — submission is a
+    user-initiated, one-shot CLI call.
+  - **Elevation of privilege:** Using the user's `gh` credentials beyond the
+    single sanctioned submit.
+- **Current mitigations (ALREADY shipped — documented, no change here):**
+  - **Outbound is via the `gh` CLI ONLY.** `gh-submit.cjs` wraps
+    `gh issue create --repo <DESTINATION_REPO> --title … --body-file …` and is
+    explicit that "the user's gh CLI is the sole outbound primitive. No HTTP-S
+    URL literals, no global fetch primitive, no plugin-side credentials" (D-05).
+    There is no raw HTTP egress in this subtree.
+  - **Frozen destination.** `destination.cjs` is an `Object.freeze`-d module —
+    the single source of truth for the destination repo, with **no env-var
+    lookup, no config override, no flag override**. A static CI gate asserts it
+    is the only file under the report-issue tree that contains the destination
+    literal, so a redirect attempt fails the build.
+  - **Kill-switch (dual-surface).** `kill-switch.cjs` disables the reporter via
+    **either** the env var `GDD_DISABLE_ISSUE_REPORTER === '1'` **or** the config
+    `.design/config.json` `{ "issue_reporter": false }`; either surface alone is
+    sufficient, and config is read tolerantly (missing file / malformed JSON /
+    missing key are safe).
+  - Payloads pass through privacy-diff / consent-prompt machinery before
+    submission, and event telemetry is redacted by `redact.cjs` (Component 4).
+- **Residual risks:** The issue-reporter's **own** network model has no residual
+  this phase changes — it is intentionally documented as complete. The only
+  cross-cutting residual touching it is the **lack of a machine-readable
+  outbound allowlist + CI gate** that proves `gh-submit` is the sole egress in
+  this subtree at a tree-wide level: closed by **33.5-02** (the canonical
+  outbound-network allowlist data, which lists `scripts/lib/issue-reporter/**`
+  as an allowed egress glob) and **33.5-04** (the `scan:outbound` CI gate that
+  fails on any active-egress site not under an allowlisted glob).
+
+---
+
+## Residual-risk → closing-plan map
+
+Every residual risk identified above is routed to the Phase 33.5 plan (or
+policy doc) that closes it. No residual is left unmapped. This table is the
+spine the phase closeout (33.5-06) uses to prove completeness.
+
+| Residual risk | Component | Closing plan |
+| --- | --- | --- |
+| WS binds `0.0.0.0` by default (`listen` line 145, no host) + timing-unsafe `!==` token compare (line 112) | WebSocket transport | **33.5-03** |
+| `GDD_STATE_PATH` path traversal (no guard, shared.ts 60–64) + no payload-size cap + un-tightened tool schemas | gdd-state MCP | **33.5-03** |
+| Full `process.env` (incl. `ANTHROPIC_API_KEY` / `GH_TOKEN`) leaks to spawned peers (acp 102 / asp 122) | Peer-CLI broker | **33.5-04** |
+| Outbound egress sites have no machine-readable allowlist + no CI gate | cross-cutting (hooks update-check, figma-extract, issue-reporter, e2e) | **33.5-02** (allowlist) + **33.5-04** (scan gate) |
+| Secret-scan misses Gemini `AIza…` / GitHub fine-grained `github_pat_…` / GitHub server `gh[sour]_…` tokens | redact.cjs | **33.5-05** |
+| No published vulnerability-disclosure policy | project | **33.5-06** (SECURITY.md) |
+
+### Already-mitigated (documented, NOT re-engineered)
+
+| Already-mitigated surface | Component | Evidence |
+| --- | --- | --- |
+| Outbound via `gh` CLI only; frozen destination; dual-surface kill-switch | Issue-reporter | `gh-submit.cjs` (`gh issue create` only), `destination.cjs` (`Object.freeze`, no override), `kill-switch.cjs` (env + `.design/config.json`) |
+| Bearer-token auth on every WS upgrade + ≥8-char token rule | WebSocket transport | `ws.cjs` 110–116 (401 on mismatch) + line 74 (`length < 8` → `TypeError`) |
+| 16 MiB un-newlined-stdout DoS cap on untrusted peer output | Peer-CLI broker | `acp-client.cjs` `MAX_LINE_BYTES` line 62, enforced 166–176 |
+| Deep-walk secret scrub of every event payload at serialize time | cross-cutting (event bus) | `redact.cjs` `redact()` 95–116 / `redactString()` 75–83, 8 patterns |

package/reference/registry.json

@@ -860,6 +860,20 @@
       "type": "meta-rules",
       "phase": 30,
       "description": "Phase 30 triage gate catalogue — locally-fixable failure modes (id/pattern/diagnosis/remedy/severity, with optional propose_report whitelist flag per D-11) consulted by scripts/lib/issue-reporter/triage-matcher.cjs before the report-issue consent prompt (D-07/D-11)."
+    },
+    {
+      "name": "gdd-threat-model",
+      "path": "reference/gdd-threat-model.md",
+      "type": "heuristic",
+      "phase": 33.5,
+      "description": "Phase 33.5 STRIDE threat model of GDD's own runtime attack surface — hooks, the gdd-state + gdd-mcp MCP servers, the peer-CLI broker, the WebSocket event-stream transport, and issue-reporter outbound; maps each residual risk to the 33.5 plan that closes it."
+    },
+    {
+      "name": "gdd-runtime-audit",
+      "path": "reference/gdd-runtime-audit.md",
+      "type": "heuristic",
+      "phase": 33.5,
+      "description": "Phase 33.5 static security audit of GDD's shipped runtime surface (hooks/scripts/sdk/bin) — outbound-network call sites, secret-handling sites, and external-input surfaces; human-readable companion to scripts/security/outbound-allowlist.json (the canonical active-egress allowlist the 33.5-04 scan-outbound-network.cjs gate consumes) and reference/gdd-threat-model.md."
     }
   ]
 }

package/scripts/lib/peer-cli/acp-client.cjs

@@ -50,6 +50,7 @@
 
 const { spawn } = require('child_process');
 const { EventEmitter } = require('events');
+const { sanitizeEnv, readPeerCliAllowlist } = require('./sanitize-env.cjs');
 
 /**
  * Hard cap on the size of a single un-terminated line read from the
@@ -99,7 +100,14 @@ function createAcpClient(opts) {
   const command = opts.command;
   const args = Array.isArray(opts.args) ? opts.args : [];
   const cwd = typeof opts.cwd === 'string' ? opts.cwd : process.cwd();
-  const env = opts.env && typeof opts.env === 'object' ? opts.env : process.env;
+  // Plan 33.5-04 (D-03): when the caller does not supply an explicit env, the
+  // child inherits a SANITIZED env (OS-essential baseline + the configured
+  // peer_cli.env_allowlist) instead of the raw full process.env — so GDD's
+  // ANTHROPIC_API_KEY/GH_TOKEN/GDD_* never leak to spawned peers. An explicit
+  // opts.env still wins (callers/tests can pass a full env).
+  const env = opts.env && typeof opts.env === 'object'
+    ? opts.env
+    : sanitizeEnv(process.env, { allowlist: readPeerCliAllowlist() });
 
   const events = new EventEmitter();
 

package/scripts/lib/peer-cli/asp-client.cjs

@@ -80,6 +80,7 @@
 'use strict';
 
 const { spawn } = require('node:child_process');
+const { sanitizeEnv, readPeerCliAllowlist } = require('./sanitize-env.cjs');
 
 /** Per-line cap before we treat the stream as malformed. */
 const MAX_LINE_BYTES = 16 * 1024 * 1024;
@@ -119,7 +120,15 @@ function createAspClient(opts) {
     stdio: ['pipe', 'pipe', 'pipe'],
   };
   if (typeof opts.cwd === 'string' && opts.cwd.length > 0) spawnOptions.cwd = opts.cwd;
-  if (opts.env && typeof opts.env === 'object') spawnOptions.env = opts.env;
+  if (opts.env && typeof opts.env === 'object') {
+    spawnOptions.env = opts.env;
+  } else {
+    // Plan 33.5-04 (D-03): without an explicit env, the child ALWAYS gets a
+    // defined, SANITIZED env (OS-essential baseline + peer_cli.env_allowlist)
+    // rather than Node defaulting to the raw process.env — closing the
+    // ANTHROPIC_API_KEY/GH_TOKEN/GDD_* leak. Explicit opts.env still wins.
+    spawnOptions.env = sanitizeEnv(process.env, { allowlist: readPeerCliAllowlist() });
+  }
 
   // Test-injection seam: callers (or unit tests) can supply a pre-built
   // ChildProcess so we don't actually fork a binary in tests. The mock