@hegemonart/get-design-done 1.33.0 → 1.33.6

package/scripts/lib/authority-watcher/index.cjs

@@ -170,6 +170,147 @@ function buildKfmCandidate(article, options) {
   };
 }
 
+// -------------------------------------------------------------------
+// Plan 33.6-03 (SC#8) — OpenRouter catalog drift
+// -------------------------------------------------------------------
+
+/**
+ * Index a catalog `models[]` by id, keeping only well-formed rows
+ * (objects with a non-empty string `id`). Last write wins on dup ids.
+ *
+ * @param {unknown} models
+ * @returns {Map<string, object>}
+ */
+function indexById(models) {
+  const map = new Map();
+  if (!Array.isArray(models)) return map;
+  for (const m of models) {
+    if (m && typeof m === 'object' && typeof m.id === 'string' && m.id.length > 0) {
+      map.set(m.id, m);
+    }
+  }
+  return map;
+}
+
+/**
+ * Best-effort "is this model flagged deprecated?" signal. Tolerant of the
+ * several shapes an upstream catalog might use: a boolean `deprecated`,
+ * or a `status`/`lifecycle`/`availability` string containing "deprecat".
+ *
+ * @param {object} model
+ * @returns {boolean}
+ */
+function isDeprecatedFlag(model) {
+  if (!model || typeof model !== 'object') return false;
+  if (model.deprecated === true) return true;
+  for (const key of ['status', 'lifecycle', 'availability', 'state']) {
+    const v = model[key];
+    if (typeof v === 'string' && /deprecat/i.test(v)) return true;
+  }
+  return false;
+}
+
+/**
+ * Stable string-compare of a single pricing field. A pricing field is the
+ * catalog's `pricing.prompt` / `pricing.completion` (strings like "0.000003").
+ * Compares as strings (the catalog stores them as strings) after a defensive
+ * String() coercion; missing → ''.
+ */
+function priceStr(model, field) {
+  if (!model || typeof model !== 'object' || !model.pricing || typeof model.pricing !== 'object') {
+    return '';
+  }
+  const v = model.pricing[field];
+  return v === undefined || v === null ? '' : String(v);
+}
+
+function pricingChanged(prevModel, currModel) {
+  return (
+    priceStr(prevModel, 'prompt') !== priceStr(currModel, 'prompt') ||
+    priceStr(prevModel, 'completion') !== priceStr(currModel, 'completion')
+  );
+}
+
+/**
+ * Diff a prior vs current OpenRouter catalog (`models[]` arrays) and classify
+ * each delta. Plan 33.6-03 / SC#8.
+ *
+ * Classification per id:
+ *   - `new-model`      — id in curr, not in prev.
+ *   - `withdrawn`      — id in prev, not in curr.
+ *   - `deprecated`     — id in BOTH, and the curr row carries a deprecated/status
+ *                        flag (best-effort `isDeprecatedFlag`). Takes precedence
+ *                        over a coincident pricing change.
+ *   - `pricing-change` — id in BOTH, not deprecated, with a changed
+ *                        pricing.prompt or pricing.completion.
+ *   - (unchanged ids produce NO entry.)
+ *
+ * Surfacing (the actionable "a model you pinned is going away" signal):
+ *   `surfaced === true` ONLY when `change ∈ {deprecated, withdrawn}` AND the id
+ *   is in `options.overrides` (the configured `openrouter_tier_overrides`
+ *   values). `new-model` / `pricing-change` are classified but `surfaced:false`
+ *   (noise control per CONTEXT). A deprecated/withdrawn id NOT in overrides is
+ *   also `surfaced:false`.
+ *
+ * Pure, zero deps, NEVER throws — garbage inputs degrade to `[]`.
+ *
+ * @param {Array<object>} prevModels prior catalog `models[]`
+ * @param {Array<object>} currModels current catalog `models[]`
+ * @param {object} [options]
+ * @param {Array<string>} [options.overrides] configured openrouter_tier_overrides id values
+ * @returns {Array<{id:string, change:('new-model'|'pricing-change'|'deprecated'|'withdrawn'), surfaced:boolean}>}
+ */
+function diffOpenRouterCatalog(prevModels, currModels, options) {
+  try {
+    const prev = indexById(prevModels);
+    const curr = indexById(currModels);
+
+    const opts = options && typeof options === 'object' ? options : {};
+    const overrideList = Array.isArray(opts.overrides) ? opts.overrides : [];
+    const overrides = new Set(overrideList.filter(x => typeof x === 'string' && x.length > 0));
+
+    /** @type {Array<{id:string, change:string, surfaced:boolean}>} */
+    const out = [];
+
+    // Deterministic id order: union of all ids, sorted ascending. Keeps the
+    // output stable for a fixed input pair (no Date, no randomness).
+    const allIds = new Set([...prev.keys(), ...curr.keys()]);
+    const sortedIds = [...allIds].sort();
+
+    for (const id of sortedIds) {
+      const inPrev = prev.has(id);
+      const inCurr = curr.has(id);
+      let change = null;
+
+      if (inCurr && !inPrev) {
+        change = 'new-model';
+      } else if (inPrev && !inCurr) {
+        change = 'withdrawn';
+      } else {
+        // id in both.
+        const currModel = curr.get(id);
+        if (isDeprecatedFlag(currModel)) {
+          change = 'deprecated';
+        } else if (pricingChanged(prev.get(id), currModel)) {
+          change = 'pricing-change';
+        } else {
+          continue; // unchanged → no delta
+        }
+      }
+
+      const actionable = change === 'deprecated' || change === 'withdrawn';
+      const surfaced = actionable && overrides.has(id);
+      out.push({ id, change, surfaced });
+    }
+
+    return out;
+  } catch {
+    // Absolute backstop — diffOpenRouterCatalog NEVER throws (parity with the
+    // never-throws discipline of the 33.6 adapter/fetcher).
+    return [];
+  }
+}
+
 /**
  * Classify a list of fetched articles into events. Emits one kfm-candidate
  * per whitelist-matched article. Other articles produce no events here
@@ -192,10 +333,16 @@ module.exports = {
   classifyArticles,
   matchesKfmWhitelist,
   buildKfmCandidate,
+  // Plan 33.6-03 (SC#8) — OpenRouter catalog weekly-diff classifier. Added as a
+  // sibling pure function; the existing API above is unchanged.
+  diffOpenRouterCatalog,
   // Exposed for tests / advanced consumers.
   KFM_WHITELIST_PATTERNS,
   MAX_RAW_EXCERPT,
   _deriveSymptom: deriveSymptom,
   _derivePatternHint: derivePatternHint,
   _truncateExcerpt: truncateExcerpt,
+  _indexById: indexById,
+  _isDeprecatedFlag: isDeprecatedFlag,
+  _pricingChanged: pricingChanged,
 };

package/scripts/lib/budget-enforcer.cjs

@@ -407,6 +407,15 @@ function computeCost(args, opts) {
  *   Phase 27. The peer-CLI ID when `runtime_role === "peer"` (e.g.
  *   `"gemini"`, `"codex"`). Omitted from output when absent or when
  *   `runtime_role === "host"`.
+ * @param {string} [args.provider]
+ *   Phase 33.6 / Plan 33.6-03 (SC#6). The resolution provider — set to
+ *   `"openrouter"` by the caller when the model was resolved via the
+ *   OpenRouter tier-resolver adapter
+ *   (`scripts/lib/tier-resolver-openrouter.cjs`). Additive/back-compat:
+ *   when absent (the native-resolution default + every pre-33.6 caller)
+ *   the key is OMITTED — exactly how `peer_id` is omitted for host rows —
+ *   so the legacy on-disk cost-row shape stays byte-stable. Only a
+ *   non-empty string is threaded; anything else is dropped.
  * @returns {object}
  */
 function buildCostEventPayload(args) {
@@ -433,6 +442,13 @@ function buildCostEventPayload(args) {
       : null;
     out.peer_id = pid;
   }
+  // Phase 33.6 SC#6 — additive provider tag. Threaded ONLY when the caller
+  // passes a non-empty string (e.g. "openrouter" when the OpenRouter adapter
+  // resolved the model). Omitted otherwise, mirroring peer_id, so the legacy
+  // cost-row shape stays stable for native-resolution + pre-33.6 callers.
+  if (args && typeof args.provider === 'string' && args.provider.length > 0) {
+    out.provider = args.provider;
+  }
   return out;
 }
 

package/scripts/lib/openrouter/catalog-fetcher.cjs

@@ -0,0 +1,326 @@
+'use strict';
+// scripts/lib/openrouter/catalog-fetcher.cjs — Plan 33.6-01 (Wave A.1)
+//
+// The plugin's FIRST plugin-side outbound REST client. Fetches the OpenRouter
+// model catalog (https://openrouter.ai/api/v1/models), maps it into the CONTEXT
+// cache shape, and writes it ATOMICALLY to .design/cache/openrouter-models.json
+// with a 24h TTL skip-if-fresh. The fetch is gated behind an INJECTABLE
+// `fetchImpl` (default global `fetch`) so the entire default test suite is
+// hermetic (D-07) and there is NO new runtime dependency — no axios/node-fetch/
+// undici (D-10). The fetch( egress is allowlisted via scripts/lib/openrouter/**
+// in scripts/security/outbound-allowlist.json (D-06), with a matching egress
+// entry in reference/gdd-threat-model.md.
+//
+// Decisions honored:
+//   D-02  Catalog TTL = 24h default (overridable via ttlHours; the caller wires
+//         .design/config.json#openrouter_catalog_ttl_hours — the fetcher just
+//         takes ttlHours).
+//   D-06  fetch( is allowlisted via scripts/lib/openrouter/**; threat-model has
+//         the OpenRouter-egress entry.
+//   D-07  fetchImpl is injectable (default global fetch); no live network in tests.
+//   D-08  Graceful degrade — fetchCatalog NEVER throws. No key / fetch-fail /
+//         parse-fail → cached-if-any-else-null. Tier resolution falls back to the
+//         native provider.
+//   D-10  No new dependency — global fetch + sdk/primitives (jittered-backoff,
+//         error-classifier) + scripts/lib/rate-guard.cjs only.
+//
+// The OPENROUTER_API_KEY is read from process.env, sent ONLY as an Authorization:
+// Bearer header, and is NEVER persisted to the cache nor written to any log seam.
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const { delayMs, sleep } = require('../../../sdk/primitives/jittered-backoff.cjs');
+const { classify, FailoverReason } = require('../../../sdk/primitives/error-classifier.cjs');
+const rateGuard = require('../rate-guard.cjs');
+
+// Repo root is three levels up from scripts/lib/openrouter/.
+const REPO_ROOT = path.resolve(__dirname, '..', '..', '..');
+const DEFAULT_CACHE_PATH = path.join(REPO_ROOT, '.design', 'cache', 'openrouter-models.json');
+
+const DEFAULT_BASE_URL = 'https://openrouter.ai/api/v1';
+const MODELS_PATH = '/models';
+const MAX_ATTEMPTS = 3; // 1 initial + 2 retries — bounded, never infinite (D-08).
+const PROVIDER = 'openrouter'; // rate-guard provider key.
+
+/**
+ * Read + parse the catalog cache at `cachePath`. Returns the `models[]` array, or
+ * null when the file is missing, corrupt, or shape-invalid. NEVER throws.
+ *
+ * @param {object} [opts]
+ * @param {string} [opts.cachePath] defaults to <repo>/.design/cache/openrouter-models.json
+ * @returns {Array<object>|null}
+ */
+function readCatalog(opts) {
+  const cachePath = (opts && typeof opts.cachePath === 'string' && opts.cachePath) || DEFAULT_CACHE_PATH;
+  try {
+    if (!fs.existsSync(cachePath)) return null;
+    const parsed = JSON.parse(fs.readFileSync(cachePath, 'utf8'));
+    if (!parsed || typeof parsed !== 'object' || !Array.isArray(parsed.models)) return null;
+    return parsed.models;
+  } catch {
+    // Corrupt JSON / read error → treat as no cache.
+    return null;
+  }
+}
+
+/**
+ * Read the full parsed cache object (not just models) for TTL inspection.
+ * Returns the parsed object or null. NEVER throws.
+ */
+function readCacheObject(cachePath) {
+  try {
+    if (!fs.existsSync(cachePath)) return null;
+    const parsed = JSON.parse(fs.readFileSync(cachePath, 'utf8'));
+    if (!parsed || typeof parsed !== 'object' || !Array.isArray(parsed.models)) return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Is the cache object fresh relative to `nowMs` under `ttlHours`?
+ * A missing/unparseable fetched_at is treated as stale (forces a re-fetch).
+ */
+function isFresh(cacheObj, ttlHours, nowMs) {
+  if (!cacheObj || typeof cacheObj.fetched_at !== 'string') return false;
+  const fetchedMs = Date.parse(cacheObj.fetched_at);
+  if (!Number.isFinite(fetchedMs)) return false;
+  const ageMs = nowMs - fetchedMs;
+  return ageMs >= 0 && ageMs < ttlHours * 3600_000;
+}
+
+/**
+ * Map an OpenRouter /models response into the CONTEXT cache shape. Defensive:
+ * tolerates missing fields, keeps ONLY id/name/context_length/pricing.{prompt,
+ * completion}, drops everything else. The /models response is untrusted input —
+ * it is mapped, never eval'd.
+ *
+ * @param {object} body the parsed { data: [...] } response
+ * @param {string} fetchedAtIso ISO timestamp to stamp
+ * @param {number} ttlHours
+ * @param {string} sourceUrl
+ * @returns {{fetched_at:string, ttl_hours:number, source:string, models:Array<object>}}
+ */
+function mapResponse(body, fetchedAtIso, ttlHours, sourceUrl) {
+  const data = body && Array.isArray(body.data) ? body.data : [];
+  const models = [];
+  for (const entry of data) {
+    if (!entry || typeof entry !== 'object') continue;
+    if (typeof entry.id !== 'string' || entry.id.length === 0) continue;
+    const pricing = entry.pricing && typeof entry.pricing === 'object' ? entry.pricing : {};
+    models.push({
+      id: entry.id,
+      name: typeof entry.name === 'string' ? entry.name : entry.id,
+      context_length: Number.isFinite(entry.context_length) ? entry.context_length : null,
+      pricing: {
+        prompt: pricing.prompt !== undefined && pricing.prompt !== null ? String(pricing.prompt) : null,
+        completion:
+          pricing.completion !== undefined && pricing.completion !== null
+            ? String(pricing.completion)
+            : null,
+      },
+    });
+  }
+  return {
+    fetched_at: fetchedAtIso,
+    ttl_hours: ttlHours,
+    source: sourceUrl,
+    models,
+  };
+}
+
+/**
+ * Atomically write `obj` (JSON) to `cachePath`: write a per-pid temp file in the
+ * same directory, then rename over the target. mkdir -p the dir first. The
+ * rename is atomic on POSIX and NTFS. NEVER throws — write failure degrades.
+ *
+ * @returns {boolean} true on success, false on any failure.
+ */
+function atomicWrite(cachePath, obj) {
+  try {
+    const dir = path.dirname(cachePath);
+    fs.mkdirSync(dir, { recursive: true });
+    const tmp = `${cachePath}.${process.pid}.${Date.now()}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify(obj, null, 2) + '\n', 'utf8');
+    try {
+      fs.renameSync(tmp, cachePath);
+    } catch (renameErr) {
+      // Best-effort cleanup of the temp file so we never leave litter behind.
+      try {
+        fs.unlinkSync(tmp);
+      } catch {
+        /* ignore */
+      }
+      throw renameErr;
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Perform the live fetch with bounded jittered-backoff retry on retryable
+ * classes (NETWORK_TRANSIENT / RATE_LIMITED), feeding any rate-limit headers to
+ * rate-guard. Non-retryable classes (AUTH_ERROR / VALIDATION / ...) stop
+ * immediately. Returns the parsed response body on success, or null on any
+ * exhausted/non-retryable failure. NEVER throws.
+ *
+ * @returns {Promise<object|null>}
+ */
+async function fetchWithRetry({ fetchImpl, url, apiKey, backoffOpts }) {
+  for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt++) {
+    // Respect any prior rate-limit window before issuing the request.
+    try {
+      await rateGuard.blockUntilReady(PROVIDER);
+    } catch {
+      /* rate-guard is best-effort — never let it break the fetch */
+    }
+
+    let res;
+    let thrown = null;
+    try {
+      res = await fetchImpl(url, {
+        method: 'GET',
+        headers: {
+          Authorization: `Bearer ${apiKey}`,
+          Accept: 'application/json',
+        },
+      });
+    } catch (networkErr) {
+      thrown = networkErr;
+    }
+
+    // A thrown/rejected fetch → classify the raw error.
+    if (thrown) {
+      const { reason } = classify(thrown);
+      if (reason === FailoverReason.NETWORK_TRANSIENT || reason === FailoverReason.RATE_LIMITED) {
+        if (attempt < MAX_ATTEMPTS - 1) {
+          await sleep(attempt, backoffOpts);
+          continue;
+        }
+      }
+      // Non-retryable, or retries exhausted.
+      return null;
+    }
+
+    // Feed response headers to rate-guard (best-effort) so a 429/limit window is
+    // recorded for the next call.
+    try {
+      if (res && res.headers) await rateGuard.ingestHeaders(PROVIDER, res.headers);
+    } catch {
+      /* best-effort */
+    }
+
+    if (res && res.ok) {
+      try {
+        return await res.json();
+      } catch {
+        // A 200 with an unparseable body is a transient-ish anomaly; retry if budget remains.
+        if (attempt < MAX_ATTEMPTS - 1) {
+          await sleep(attempt, backoffOpts);
+          continue;
+        }
+        return null;
+      }
+    }
+
+    // Non-OK HTTP — classify by status.
+    const status = res && Number.isFinite(res.status) ? res.status : 0;
+    const { reason } = classify({ status });
+    if (reason === FailoverReason.NETWORK_TRANSIENT || reason === FailoverReason.RATE_LIMITED) {
+      if (attempt < MAX_ATTEMPTS - 1) {
+        await sleep(attempt, backoffOpts);
+        continue;
+      }
+      return null;
+    }
+    // AUTH_ERROR / VALIDATION / NETWORK_PERMANENT / etc. — do NOT retry.
+    return null;
+  }
+  return null;
+}
+
+/**
+ * Fetch (or load-from-cache) the OpenRouter model catalog.
+ *
+ * Order of operations:
+ *   1. readCatalog → if a cache is present AND fresh (within ttlHours of now)
+ *      → return cache.models WITHOUT calling fetchImpl (TTL skip).
+ *   2. else if no apiKey → return cache.models if a cache is present (stale ok),
+ *      else null. (Graceful — never fetches without a key.)
+ *   3. else fetch <baseUrl>/models via fetchImpl (Authorization: Bearer <apiKey>),
+ *      retrying transient/rate-limited failures on a jittered-backoff curve with
+ *      rate-guard awareness; non-retryable classes stop.
+ *   4. on success → map to the CONTEXT cache shape → atomic write → return models.
+ *   5. on exhausted/failed fetch → return cache.models if present else null.
+ *
+ * NEVER throws (D-08). The whole body is wrapped; any escaped error degrades to
+ * cached-if-any-else-null.
+ *
+ * @param {object} [opts]
+ * @param {function} [opts.fetchImpl] injectable fetch (default global fetch — D-07/D-10)
+ * @param {function} [opts.now] () => Date, for deterministic TTL (default () => new Date())
+ * @param {string}   [opts.cachePath] default <repo>/.design/cache/openrouter-models.json
+ * @param {number}   [opts.ttlHours] default 24 (D-02)
+ * @param {string}   [opts.apiKey] default process.env.OPENROUTER_API_KEY
+ * @param {string}   [opts.baseUrl] default process.env.OPENROUTER_BASE_URL || the OpenRouter base
+ * @param {object}   [opts.backoffOpts] passed to jittered-backoff (tests pass near-zero)
+ * @returns {Promise<Array<object>|null>}
+ */
+async function fetchCatalog(opts) {
+  const o = opts || {};
+  const fetchImpl = typeof o.fetchImpl === 'function' ? o.fetchImpl : globalThis.fetch;
+  const nowFn = typeof o.now === 'function' ? o.now : () => new Date();
+  const cachePath =
+    typeof o.cachePath === 'string' && o.cachePath.length > 0 ? o.cachePath : DEFAULT_CACHE_PATH;
+  const ttlHours = Number.isFinite(o.ttlHours) ? o.ttlHours : 24;
+  const apiKey = 'apiKey' in o ? o.apiKey : process.env.OPENROUTER_API_KEY;
+  const baseUrl =
+    (typeof o.baseUrl === 'string' && o.baseUrl) || process.env.OPENROUTER_BASE_URL || DEFAULT_BASE_URL;
+  const backoffOpts = o.backoffOpts;
+
+  try {
+    const nowMs = nowFn().getTime();
+    const cacheObj = readCacheObject(cachePath);
+
+    // 1. TTL skip — fresh cache short-circuits the fetch entirely.
+    if (cacheObj && isFresh(cacheObj, ttlHours, nowMs)) {
+      return cacheObj.models;
+    }
+
+    // 2. No key → never fetch; degrade to cached-if-any-else-null.
+    if (!apiKey || typeof apiKey !== 'string' || apiKey.length === 0) {
+      return cacheObj ? cacheObj.models : null;
+    }
+
+    // 3. Fetch with bounded retry.
+    const sourceUrl = `${baseUrl}${MODELS_PATH}`;
+    const body = await fetchWithRetry({ fetchImpl, url: sourceUrl, apiKey, backoffOpts });
+
+    // 5. Exhausted / failed → degrade to cached-if-any-else-null.
+    if (body === null) {
+      return cacheObj ? cacheObj.models : null;
+    }
+
+    // 4. Success → map + atomic write.
+    const fetchedAtIso = nowFn().toISOString();
+    // source stays the canonical OpenRouter models URL even when a custom baseUrl
+    // is used, so the cache's `source` is the public contract value.
+    const mapped = mapResponse(body, fetchedAtIso, ttlHours, `${DEFAULT_BASE_URL}${MODELS_PATH}`);
+    atomicWrite(cachePath, mapped); // best-effort; a write failure still returns the models
+    return mapped.models;
+  } catch {
+    // Absolute backstop — fetchCatalog NEVER throws (D-08).
+    const fallback = readCatalog({ cachePath });
+    return fallback;
+  }
+}
+
+module.exports = { fetchCatalog, readCatalog, _internal: { mapResponse, isFresh, atomicWrite } };
+// `delayMs` is part of the resilience-primitive contract (jittered-backoff) and
+// is exercised indirectly via `sleep`; reference it so linters/readers see the
+// full retry-curve seam is wired.
+void delayMs;

package/scripts/lib/peer-cli/acp-client.cjs

@@ -50,6 +50,7 @@
 
 const { spawn } = require('child_process');
 const { EventEmitter } = require('events');
+const { sanitizeEnv, readPeerCliAllowlist } = require('./sanitize-env.cjs');
 
 /**
  * Hard cap on the size of a single un-terminated line read from the
@@ -99,7 +100,14 @@ function createAcpClient(opts) {
   const command = opts.command;
   const args = Array.isArray(opts.args) ? opts.args : [];
   const cwd = typeof opts.cwd === 'string' ? opts.cwd : process.cwd();
-  const env = opts.env && typeof opts.env === 'object' ? opts.env : process.env;
+  // Plan 33.5-04 (D-03): when the caller does not supply an explicit env, the
+  // child inherits a SANITIZED env (OS-essential baseline + the configured
+  // peer_cli.env_allowlist) instead of the raw full process.env — so GDD's
+  // ANTHROPIC_API_KEY/GH_TOKEN/GDD_* never leak to spawned peers. An explicit
+  // opts.env still wins (callers/tests can pass a full env).
+  const env = opts.env && typeof opts.env === 'object'
+    ? opts.env
+    : sanitizeEnv(process.env, { allowlist: readPeerCliAllowlist() });
 
   const events = new EventEmitter();
 

package/scripts/lib/peer-cli/asp-client.cjs

@@ -80,6 +80,7 @@
 'use strict';
 
 const { spawn } = require('node:child_process');
+const { sanitizeEnv, readPeerCliAllowlist } = require('./sanitize-env.cjs');
 
 /** Per-line cap before we treat the stream as malformed. */
 const MAX_LINE_BYTES = 16 * 1024 * 1024;
@@ -119,7 +120,15 @@ function createAspClient(opts) {
     stdio: ['pipe', 'pipe', 'pipe'],
   };
   if (typeof opts.cwd === 'string' && opts.cwd.length > 0) spawnOptions.cwd = opts.cwd;
-  if (opts.env && typeof opts.env === 'object') spawnOptions.env = opts.env;
+  if (opts.env && typeof opts.env === 'object') {
+    spawnOptions.env = opts.env;
+  } else {
+    // Plan 33.5-04 (D-03): without an explicit env, the child ALWAYS gets a
+    // defined, SANITIZED env (OS-essential baseline + peer_cli.env_allowlist)
+    // rather than Node defaulting to the raw process.env — closing the
+    // ANTHROPIC_API_KEY/GH_TOKEN/GDD_* leak. Explicit opts.env still wins.
+    spawnOptions.env = sanitizeEnv(process.env, { allowlist: readPeerCliAllowlist() });
+  }
 
   // Test-injection seam: callers (or unit tests) can supply a pre-built
   // ChildProcess so we don't actually fork a binary in tests. The mock