@robmclarty/volley 0.10.0 → 0.10.1

package/dist/index.d.ts

@@ -486,10 +486,11 @@ export declare function create_renderer(options: RendererOptions): Renderer;
 //#endregion
 //#region src/phases.d.ts
 /** How the check runs when the caller sets it, as `volley acp` does. Left
- * out, the check inherits volley's environment and runs unasked, as on the
- * CLI. */
+ * out, the check runs unasked with volley's environment less the seats' keys,
+ * as on the CLI. */
 type CheckGate = {
-  /** The whole environment the check runs with, in place of volley's own. */
+  /** The whole environment the check runs with, in place of volley's own less
+   * the seats' keys. */
   env?: Readonly<Record<string, string>>;
   /** Asked on the check's card before each check, the way a model call asks
    * before a gated tool runs. Anything short of an allow keeps the check from

package/dist/index.js

@@ -39,6 +39,231 @@ function error_kind(err) {
 	return null;
 }
 //#endregion
+//#region src/engine.ts
+/**
+* The ONLY module that calls fascicle's `create_engine`. Every
+* other module receives an `Engine`-shaped value, which keeps the engine
+* mockable in tests and confines provider knowledge to one seam.
+*/
+/** LM Studio's OpenAI-compatible server and Ollama's server-root defaults.
+* The Ollama URL is the server root, NOT `…/api`: `ai-sdk-ollama` appends
+* `/api/...` itself, so a base URL ending in `/api` requests `/api/api/chat`
+* and 404s. */
+const DEFAULT_OLLAMA_URL = "http://localhost:11434";
+const DEFAULT_LMSTUDIO_URL = "http://localhost:1234/v1";
+/** OpenRouter's API root, the one fascicle's openrouter adapter defaults to. */
+const DEFAULT_OPENROUTER_URL = "https://openrouter.ai/api/v1";
+/** The variable an `openrouter` seat's API key is read from. */
+const OPENROUTER_KEY_VAR = "OPENROUTER_API_KEY";
+/** The variable a `claude_cli` seat's API key is read from, which the Claude
+* CLI also reads on its own. */
+const ANTHROPIC_KEY_VAR = "ANTHROPIC_API_KEY";
+/** Every variable a seat reads a credential from. Every process volley starts
+* runs without them (the check, the builder's commands, and volley's own git
+* and checkride calls, which run hooks and filters the builder can write), so
+* nothing the builder writes can read the keys its seats spend. */
+const SEAT_CREDENTIAL_VARS = [OPENROUTER_KEY_VAR, ANTHROPIC_KEY_VAR];
+/** The environment every process volley starts runs with: `env`, `PATH`
+* included, less every variable a seat reads a credential from. */
+function command_env(env) {
+	const stripped = new Set(SEAT_CREDENTIAL_VARS);
+	return Object.fromEntries(Object.entries(env).filter((entry) => entry[1] !== void 0 && !stripped.has(entry[0])));
+}
+/** Loopback authorities the container→host crossing rewrites. A base URL
+* pointing at one of these is local to wherever volley runs; contained, that is
+* *inside* the sandbox container, where the host LLM daemon is unreachable
+* except across the boundary at `VOLLEY_MODEL_HOST`. `URL.hostname` keeps an
+* IPv6 literal's brackets, so the IPv6 loopback is spelled `[::1]`. */
+const LOOPBACK_HOSTS = /* @__PURE__ */ new Set([
+	"localhost",
+	"127.0.0.1",
+	"[::1]",
+	"0.0.0.0"
+]);
+/** Cross a loopback base URL to the host LLM endpoint. When volley
+* runs inside its sandbox container the local model daemon is on the *host*, so
+* the example's `docker run` injects `VOLLEY_MODEL_HOST=host.docker.internal`
+* (the host-gateway allowlist target; see `sandbox_invocation` in
+* `src/sandbox.ts`). This normalizer *consumes that override* and swaps a
+* loopback host for the gateway, so an unchanged `http://localhost:11434` still
+* reaches the host from in-container. A non-loopback URL (a real remote daemon)
+* is left untouched, and an unset `VOLLEY_MODEL_HOST` (the host / unsandboxed
+* path) is a no-op — so the default and all-Claude paths are unaffected. */
+function cross_to_host_gateway(base_url, env) {
+	const host = env["VOLLEY_MODEL_HOST"];
+	if (host === void 0 || host === "") return base_url;
+	let parsed;
+	try {
+		parsed = new URL(base_url);
+	} catch {
+		return base_url;
+	}
+	if (!LOOPBACK_HOSTS.has(parsed.hostname.toLowerCase())) return base_url;
+	parsed.hostname = host;
+	return parsed.toString().replace(/\/$/, "");
+}
+function strip_trailing_slashes(url) {
+	return url.replace(/\/+$/, "");
+}
+const SEAT_URL_SOURCES = {
+	ollama: {
+		env: "VOLLEY_OLLAMA_URL",
+		default_url: DEFAULT_OLLAMA_URL,
+		normalize: (url) => strip_trailing_slashes(url).replace(/\/api$/, "")
+	},
+	lmstudio: {
+		env: "VOLLEY_LMSTUDIO_URL",
+		default_url: DEFAULT_LMSTUDIO_URL,
+		normalize: strip_trailing_slashes
+	},
+	openrouter: {
+		env: "VOLLEY_OPENROUTER_URL",
+		default_url: DEFAULT_OPENROUTER_URL,
+		normalize: strip_trailing_slashes
+	}
+};
+/** The providers that take a seat URL (`--builder-url` / `--critic-url`), and
+* so get their endpoint probed by `--dry-run`. */
+const SEAT_URL_PROVIDERS = Object.keys(SEAT_URL_SOURCES);
+/** Whether a seat on `provider` reaches its model at a base URL volley
+* configures, and so takes a URL of its own. */
+function takes_seat_url(provider) {
+	return SEAT_URL_PROVIDERS.includes(provider);
+}
+/** An absent, empty, or all-whitespace value counts as unset. */
+function present(value) {
+	const trimmed = value?.trim() ?? "";
+	return trimmed === "" ? null : trimmed;
+}
+/** The base URL a seat's model calls go to: the seat's own URL, else the
+* provider's env var (`VOLLEY_OLLAMA_URL` / `VOLLEY_LMSTUDIO_URL` /
+* `VOLLEY_OPENROUTER_URL`), else its default. A seat never falls back to the
+* other seat's URL. The result is normalized, then a loopback authority is
+* crossed to the host LLM endpoint when volley runs contained. Both seats can
+* be loopback URLs on different ports, and each crosses on its own port. */
+function seat_base_url(provider, seat_url, env) {
+	const source = SEAT_URL_SOURCES[provider];
+	const raw = present(seat_url) ?? present(env[source.env]) ?? source.default_url;
+	return cross_to_host_gateway(source.normalize(raw), env);
+}
+/** The API key an `openrouter` seat sends, from `OPENROUTER_API_KEY`. An unset
+* or blank key is a config error naming the variable, which `resolve_config`
+* raises before any work, because fascicle's own "requires a non-empty
+* api_key" doesn't say where the key comes from. */
+function openrouter_api_key(env) {
+	const key = present(env[OPENROUTER_KEY_VAR]);
+	if (key === null) throw config_error(`${OPENROUTER_KEY_VAR} is not set: an openrouter seat sends it as its API key`);
+	return key;
+}
+function load_pricing_overrides(path) {
+	if (!existsSync(path)) throw config_error(`VOLLEY_PRICING_PATH not found: ${path}`);
+	try {
+		return JSON.parse(readFileSync(path, "utf8"));
+	} catch (err) {
+		throw config_error(`VOLLEY_PRICING_PATH is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+	}
+}
+/** A seat's provider entry, with the base URL resolved for that seat. The ai-sdk
+* peer (`ai-sdk-ollama` / `@ai-sdk/openai-compatible`) is loaded lazily by
+* fascicle only when the provider actually runs. The entry is complete, because
+* `Engine.with_providers` replaces a provider's whole entry: whatever this
+* returns is all a seat's derived engine knows about the provider, so an
+* `openrouter` entry carries its key and its transport along with its URL.
+*
+* `openrouter` runs on fascicle's native transport, its OpenAI-compatible core,
+* so no ai-sdk peer gets installed for it, and its `X-Title` attributes the
+* traffic to volley.
+*
+* For the local providers, native transport is the deferred future bridge, not
+* adopted here: they stay on the ai_sdk transport, which fascicle 0.14.0 already
+* selects by default (`transport?: 'ai_sdk' | 'native'` defaults to `'ai_sdk'`),
+* so no field is needed today. Flipping later is a one-line change — add
+* `transport: 'native'` to the ollama/lmstudio entry returned below, which both
+* seats' engines then share. No URL re-pointing is required: `seat_base_url`
+* already yields the daemon-root URL the native `/api/chat` transport wants
+* (its adapter appends `/api/chat` itself), which is exactly what the v0.3.1
+* base-URL fix produces.
+* Kept as a proven-once-then-reverted option so the transport stays a clean
+* second variable in the model-vs-transport comparison. Flipping it today would
+* also lose the reasoning: fascicle's native Ollama adapter drops
+* `message.thinking`, with `think` unset or true (robmclarty/fascicle#12), so a
+* thinking seat's reasoning would vanish from the terminal and the trajectory.
+*
+* Every provider's base URL crosses a loopback authority to `VOLLEY_MODEL_HOST`
+* when volley runs contained, so an in-container model client reaches the
+* host LLM endpoint at `host.docker.internal`; on the host / unsandboxed path the
+* override is unset and this is a no-op. */
+function seat_provider_config(provider, seat_url, env) {
+	const base_url = seat_base_url(provider, seat_url, env);
+	switch (provider) {
+		case "ollama": return { ollama: { base_url } };
+		case "lmstudio": return { lmstudio: { base_url } };
+		case "openrouter": return { openrouter: {
+			api_key: openrouter_api_key(env),
+			base_url,
+			transport: "native",
+			x_title: "volley"
+		} };
+	}
+}
+/** Per-run engine. `claude_cli` is always configured with `options.workspace`
+* (the run's build root) as its session cwd; any URL-taking provider selected
+* by the builder or critic role is wired in alongside it, at that seat's URL,
+* so one engine drives both roles. An engine holds one URL per provider, so on
+* a provider both seats share it carries the builder's; `create_seat_engines`
+* gives the critic its own engine when its URL differs. Binary, auth mode,
+* fallback provider URLs, and pricing come from the environment. */
+function create_volley_engine(options) {
+	const env = options.env ?? process.env;
+	const auth_mode = env["VOLLEY_AUTH_MODE"] ?? "auto";
+	if (auth_mode !== "auto" && auth_mode !== "oauth" && auth_mode !== "api_key") throw config_error(`VOLLEY_AUTH_MODE must be auto, oauth, or api_key; got: ${auth_mode}`);
+	const binary = env["VOLLEY_CLAUDE_BIN"];
+	const pricing_path = env["VOLLEY_PRICING_PATH"];
+	const providers = { claude_cli: {
+		default_cwd: options.workspace,
+		setting_sources: ["project", "local"],
+		auth_mode,
+		...binary !== void 0 && binary.length > 0 ? { binary } : {},
+		...auth_mode === "api_key" && env[ANTHROPIC_KEY_VAR] !== void 0 ? { api_key: env[ANTHROPIC_KEY_VAR] } : {}
+	} };
+	if (takes_seat_url(options.critic_provider)) Object.assign(providers, seat_provider_config(options.critic_provider, options.critic_url ?? null, env));
+	if (takes_seat_url(options.builder_provider)) Object.assign(providers, seat_provider_config(options.builder_provider, options.builder_url ?? null, env));
+	return create_engine({
+		providers,
+		...pricing_path !== void 0 && pricing_path.length > 0 ? { pricing: load_pricing_overrides(pricing_path) } : {}
+	});
+}
+/** One engine per seat, shared unless it can't be. fascicle fixes one base URL
+* per provider when it builds an engine, so two seats on the same provider at
+* different URLs need two engines: the critic's is derived from the builder's
+* with `with_providers`, which keeps claude_cli, auth, and pricing and
+* overrides only the shared provider's entry. Every other pairing, including a
+* run that sets no seat URL at all, gets the one engine a run has always had. */
+async function create_seat_engines(options) {
+	const env = options.env ?? process.env;
+	const builder = create_volley_engine(options);
+	const provider = options.critic_provider;
+	if (provider !== options.builder_provider || !takes_seat_url(provider) || seat_base_url(provider, options.builder_url ?? null, env) === seat_base_url(provider, options.critic_url ?? null, env)) return {
+		builder,
+		critic: builder
+	};
+	try {
+		return {
+			builder,
+			critic: builder.with_providers(seat_provider_config(provider, options.critic_url ?? null, env))
+		};
+	} catch (err) {
+		await builder.dispose();
+		throw err;
+	}
+}
+/** Dispose each distinct seat engine once. Both disposals start together, so
+* one that fails doesn't keep the other from running. */
+async function dispose_seat_engines(engines) {
+	const distinct = engines.critic === engines.builder ? [engines.builder] : [engines.builder, engines.critic];
+	await Promise.all(distinct.map((engine) => engine.dispose()));
+}
+//#endregion
 //#region src/changes.ts
 /**
 * What the builder changed, and whether it touched the gate.
@@ -111,6 +336,7 @@ function git$1(root, args) {
 	try {
 		const result = spawnSync("git", args, {
 			cwd: root,
+			env: command_env(process.env),
 			encoding: "utf8",
 			maxBuffer: 33554432
 		});
@@ -348,220 +574,6 @@ function detect_containment(env) {
 	return value === "1" || value === "true";
 }
 //#endregion
-//#region src/engine.ts
-/**
-* The ONLY module that calls fascicle's `create_engine`. Every
-* other module receives an `Engine`-shaped value, which keeps the engine
-* mockable in tests and confines provider knowledge to one seam.
-*/
-/** LM Studio's OpenAI-compatible server and Ollama's server-root defaults.
-* The Ollama URL is the server root, NOT `…/api`: `ai-sdk-ollama` appends
-* `/api/...` itself, so a base URL ending in `/api` requests `/api/api/chat`
-* and 404s. */
-const DEFAULT_OLLAMA_URL = "http://localhost:11434";
-const DEFAULT_LMSTUDIO_URL = "http://localhost:1234/v1";
-/** OpenRouter's API root, the one fascicle's openrouter adapter defaults to. */
-const DEFAULT_OPENROUTER_URL = "https://openrouter.ai/api/v1";
-/** The variable an `openrouter` seat's API key is read from. */
-const OPENROUTER_KEY_VAR = "OPENROUTER_API_KEY";
-/** The variable a `claude_cli` seat's API key is read from, which the Claude
-* CLI also reads on its own. */
-const ANTHROPIC_KEY_VAR = "ANTHROPIC_API_KEY";
-/** Loopback authorities the container→host crossing rewrites. A base URL
-* pointing at one of these is local to wherever volley runs; contained, that is
-* *inside* the sandbox container, where the host LLM daemon is unreachable
-* except across the boundary at `VOLLEY_MODEL_HOST`. `URL.hostname` keeps an
-* IPv6 literal's brackets, so the IPv6 loopback is spelled `[::1]`. */
-const LOOPBACK_HOSTS = /* @__PURE__ */ new Set([
-	"localhost",
-	"127.0.0.1",
-	"[::1]",
-	"0.0.0.0"
-]);
-/** Cross a loopback base URL to the host LLM endpoint. When volley
-* runs inside its sandbox container the local model daemon is on the *host*, so
-* the example's `docker run` injects `VOLLEY_MODEL_HOST=host.docker.internal`
-* (the host-gateway allowlist target; see `sandbox_invocation` in
-* `src/sandbox.ts`). This normalizer *consumes that override* and swaps a
-* loopback host for the gateway, so an unchanged `http://localhost:11434` still
-* reaches the host from in-container. A non-loopback URL (a real remote daemon)
-* is left untouched, and an unset `VOLLEY_MODEL_HOST` (the host / unsandboxed
-* path) is a no-op — so the default and all-Claude paths are unaffected. */
-function cross_to_host_gateway(base_url, env) {
-	const host = env["VOLLEY_MODEL_HOST"];
-	if (host === void 0 || host === "") return base_url;
-	let parsed;
-	try {
-		parsed = new URL(base_url);
-	} catch {
-		return base_url;
-	}
-	if (!LOOPBACK_HOSTS.has(parsed.hostname.toLowerCase())) return base_url;
-	parsed.hostname = host;
-	return parsed.toString().replace(/\/$/, "");
-}
-function strip_trailing_slashes(url) {
-	return url.replace(/\/+$/, "");
-}
-const SEAT_URL_SOURCES = {
-	ollama: {
-		env: "VOLLEY_OLLAMA_URL",
-		default_url: DEFAULT_OLLAMA_URL,
-		normalize: (url) => strip_trailing_slashes(url).replace(/\/api$/, "")
-	},
-	lmstudio: {
-		env: "VOLLEY_LMSTUDIO_URL",
-		default_url: DEFAULT_LMSTUDIO_URL,
-		normalize: strip_trailing_slashes
-	},
-	openrouter: {
-		env: "VOLLEY_OPENROUTER_URL",
-		default_url: DEFAULT_OPENROUTER_URL,
-		normalize: strip_trailing_slashes
-	}
-};
-/** The providers that take a seat URL (`--builder-url` / `--critic-url`), and
-* so get their endpoint probed by `--dry-run`. */
-const SEAT_URL_PROVIDERS = Object.keys(SEAT_URL_SOURCES);
-/** Whether a seat on `provider` reaches its model at a base URL volley
-* configures, and so takes a URL of its own. */
-function takes_seat_url(provider) {
-	return SEAT_URL_PROVIDERS.includes(provider);
-}
-/** An absent, empty, or all-whitespace value counts as unset. */
-function present(value) {
-	const trimmed = value?.trim() ?? "";
-	return trimmed === "" ? null : trimmed;
-}
-/** The base URL a seat's model calls go to: the seat's own URL, else the
-* provider's env var (`VOLLEY_OLLAMA_URL` / `VOLLEY_LMSTUDIO_URL` /
-* `VOLLEY_OPENROUTER_URL`), else its default. A seat never falls back to the
-* other seat's URL. The result is normalized, then a loopback authority is
-* crossed to the host LLM endpoint when volley runs contained. Both seats can
-* be loopback URLs on different ports, and each crosses on its own port. */
-function seat_base_url(provider, seat_url, env) {
-	const source = SEAT_URL_SOURCES[provider];
-	const raw = present(seat_url) ?? present(env[source.env]) ?? source.default_url;
-	return cross_to_host_gateway(source.normalize(raw), env);
-}
-/** The API key an `openrouter` seat sends, from `OPENROUTER_API_KEY`. An unset
-* or blank key is a config error naming the variable, which `resolve_config`
-* raises before any work, because fascicle's own "requires a non-empty
-* api_key" doesn't say where the key comes from. */
-function openrouter_api_key(env) {
-	const key = present(env[OPENROUTER_KEY_VAR]);
-	if (key === null) throw config_error(`${OPENROUTER_KEY_VAR} is not set: an openrouter seat sends it as its API key`);
-	return key;
-}
-function load_pricing_overrides(path) {
-	if (!existsSync(path)) throw config_error(`VOLLEY_PRICING_PATH not found: ${path}`);
-	try {
-		return JSON.parse(readFileSync(path, "utf8"));
-	} catch (err) {
-		throw config_error(`VOLLEY_PRICING_PATH is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
-	}
-}
-/** A seat's provider entry, with the base URL resolved for that seat. The ai-sdk
-* peer (`ai-sdk-ollama` / `@ai-sdk/openai-compatible`) is loaded lazily by
-* fascicle only when the provider actually runs. The entry is complete, because
-* `Engine.with_providers` replaces a provider's whole entry: whatever this
-* returns is all a seat's derived engine knows about the provider, so an
-* `openrouter` entry carries its key and its transport along with its URL.
-*
-* `openrouter` runs on fascicle's native transport, its OpenAI-compatible core,
-* so no ai-sdk peer gets installed for it, and its `X-Title` attributes the
-* traffic to volley.
-*
-* For the local providers, native transport is the deferred future bridge, not
-* adopted here: they stay on the ai_sdk transport, which fascicle 0.14.0 already
-* selects by default (`transport?: 'ai_sdk' | 'native'` defaults to `'ai_sdk'`),
-* so no field is needed today. Flipping later is a one-line change — add
-* `transport: 'native'` to the ollama/lmstudio entry returned below, which both
-* seats' engines then share. No URL re-pointing is required: `seat_base_url`
-* already yields the daemon-root URL the native `/api/chat` transport wants
-* (its adapter appends `/api/chat` itself), which is exactly what the v0.3.1
-* base-URL fix produces.
-* Kept as a proven-once-then-reverted option so the transport stays a clean
-* second variable in the model-vs-transport comparison. Flipping it today would
-* also lose the reasoning: fascicle's native Ollama adapter drops
-* `message.thinking`, with `think` unset or true (robmclarty/fascicle#12), so a
-* thinking seat's reasoning would vanish from the terminal and the trajectory.
-*
-* Every provider's base URL crosses a loopback authority to `VOLLEY_MODEL_HOST`
-* when volley runs contained, so an in-container model client reaches the
-* host LLM endpoint at `host.docker.internal`; on the host / unsandboxed path the
-* override is unset and this is a no-op. */
-function seat_provider_config(provider, seat_url, env) {
-	const base_url = seat_base_url(provider, seat_url, env);
-	switch (provider) {
-		case "ollama": return { ollama: { base_url } };
-		case "lmstudio": return { lmstudio: { base_url } };
-		case "openrouter": return { openrouter: {
-			api_key: openrouter_api_key(env),
-			base_url,
-			transport: "native",
-			x_title: "volley"
-		} };
-	}
-}
-/** Per-run engine. `claude_cli` is always configured with `options.workspace`
-* (the run's build root) as its session cwd; any URL-taking provider selected
-* by the builder or critic role is wired in alongside it, at that seat's URL,
-* so one engine drives both roles. An engine holds one URL per provider, so on
-* a provider both seats share it carries the builder's; `create_seat_engines`
-* gives the critic its own engine when its URL differs. Binary, auth mode,
-* fallback provider URLs, and pricing come from the environment. */
-function create_volley_engine(options) {
-	const env = options.env ?? process.env;
-	const auth_mode = env["VOLLEY_AUTH_MODE"] ?? "auto";
-	if (auth_mode !== "auto" && auth_mode !== "oauth" && auth_mode !== "api_key") throw config_error(`VOLLEY_AUTH_MODE must be auto, oauth, or api_key; got: ${auth_mode}`);
-	const binary = env["VOLLEY_CLAUDE_BIN"];
-	const pricing_path = env["VOLLEY_PRICING_PATH"];
-	const providers = { claude_cli: {
-		default_cwd: options.workspace,
-		setting_sources: ["project", "local"],
-		auth_mode,
-		...binary !== void 0 && binary.length > 0 ? { binary } : {},
-		...auth_mode === "api_key" && env[ANTHROPIC_KEY_VAR] !== void 0 ? { api_key: env[ANTHROPIC_KEY_VAR] } : {}
-	} };
-	if (takes_seat_url(options.critic_provider)) Object.assign(providers, seat_provider_config(options.critic_provider, options.critic_url ?? null, env));
-	if (takes_seat_url(options.builder_provider)) Object.assign(providers, seat_provider_config(options.builder_provider, options.builder_url ?? null, env));
-	return create_engine({
-		providers,
-		...pricing_path !== void 0 && pricing_path.length > 0 ? { pricing: load_pricing_overrides(pricing_path) } : {}
-	});
-}
-/** One engine per seat, shared unless it can't be. fascicle fixes one base URL
-* per provider when it builds an engine, so two seats on the same provider at
-* different URLs need two engines: the critic's is derived from the builder's
-* with `with_providers`, which keeps claude_cli, auth, and pricing and
-* overrides only the shared provider's entry. Every other pairing, including a
-* run that sets no seat URL at all, gets the one engine a run has always had. */
-async function create_seat_engines(options) {
-	const env = options.env ?? process.env;
-	const builder = create_volley_engine(options);
-	const provider = options.critic_provider;
-	if (provider !== options.builder_provider || !takes_seat_url(provider) || seat_base_url(provider, options.builder_url ?? null, env) === seat_base_url(provider, options.critic_url ?? null, env)) return {
-		builder,
-		critic: builder
-	};
-	try {
-		return {
-			builder,
-			critic: builder.with_providers(seat_provider_config(provider, options.critic_url ?? null, env))
-		};
-	} catch (err) {
-		await builder.dispose();
-		throw err;
-	}
-}
-/** Dispose each distinct seat engine once. Both disposals start together, so
-* one that fails doesn't keep the other from running. */
-async function dispose_seat_engines(engines) {
-	const distinct = engines.critic === engines.builder ? [engines.builder] : [engines.builder, engines.critic];
-	await Promise.all(distinct.map((engine) => engine.dispose()));
-}
-//#endregion
 //#region src/trust.ts
 /**
 * Which run configs a host-side resume may trust. A resume runs what a run's
@@ -768,6 +780,7 @@ function commit_identity(cwd) {
 			key
 		], {
 			cwd,
+			env: command_env(process.env),
 			encoding: "utf8"
 		});
 		return set.status === 0 && set.stdout.trim() !== "" ? [] : ["-c", `${key}=${value}`];
@@ -795,7 +808,10 @@ function git_checkpoint(root, message, excluded_dir = null) {
 		"add",
 		"-A",
 		...pathspec
-	], { cwd: root });
+	], {
+		cwd: root,
+		env: command_env(process.env)
+	});
 	if (add.error !== void 0 || add.status !== 0) throw check_error(`git add failed: ${add.stderr?.toString() ?? String(add.error)}`);
 	const commit = spawnSync("git", [
 		...commit_identity(root),
@@ -803,7 +819,10 @@ function git_checkpoint(root, message, excluded_dir = null) {
 		"-m",
 		message,
 		"--no-verify"
-	], { cwd: root });
+	], {
+		cwd: root,
+		env: command_env(process.env)
+	});
 	if (commit.error !== void 0) throw check_error(`git commit failed to start: ${String(commit.error)}`);
 	const out = `${commit.stdout?.toString() ?? ""}${commit.stderr?.toString() ?? ""}`;
 	if (commit.status !== 0 && !/nothing (?:added )?to commit/.test(out)) throw check_error(`git commit failed: ${out.trim()}`);
@@ -827,6 +846,7 @@ function integrate_worktree(workspace, branch, message) {
 		branch
 	], {
 		cwd: workspace,
+		env: command_env(process.env),
 		encoding: "utf8"
 	});
 	if (squash.error !== void 0) throw check_error(`git merge --squash failed to start: ${String(squash.error)}`);
@@ -839,6 +859,7 @@ function integrate_worktree(workspace, branch, message) {
 		"--no-verify"
 	], {
 		cwd: workspace,
+		env: command_env(process.env),
 		encoding: "utf8"
 	});
 	if (commit.error !== void 0) throw check_error(`git commit failed to start: ${String(commit.error)}`);
@@ -1719,14 +1740,17 @@ async function run_fetch(raw, ctx, config) {
 * containment this runs *inside* volley's hardened container against the
 * bind-mounted worktree — the container is the isolation boundary, no
 * `docker exec` hop — and it is likewise the executor on the
-* `--allow-unsandboxed-builder` host escape hatch. `status` is null
-* when a signal (the timeout SIGKILL) killed the process.
+* `--allow-unsandboxed-builder` host escape hatch. A command runs with
+* volley's environment less the seats' keys, so nothing the builder runs can
+* read the key its seat spends. `status` is null when a signal (the timeout
+* SIGKILL) killed the process.
 */
 function host_bash_executor(cwd) {
 	return (command, options) => {
 		const result = spawnSync(command, {
 			shell: true,
 			cwd,
+			env: command_env(process.env),
 			encoding: "utf8",
 			timeout: options.timeout_ms,
 			killSignal: "SIGKILL",
@@ -1864,7 +1888,7 @@ function spawn_capture(cmd, args, options) {
 	return new Promise((resolve_promise, reject) => {
 		const proc = spawn(cmd, args, {
 			cwd: options.cwd,
-			...options.env !== void 0 ? { env: options.env } : {},
+			env: options.env ?? command_env(process.env),
 			detached: process.platform !== "win32",
 			stdio: [
 				"ignore",
@@ -2292,6 +2316,7 @@ function report_worktree_fate(config, sink) {
 function git(cwd, args) {
 	const result = spawnSync("git", args, {
 		cwd,
+		env: command_env(process.env),
 		encoding: "utf8"
 	});
 	if (result.error !== void 0) throw config_error(`git is required for --worktree but could not run: ${String(result.error)}`);
@@ -2318,6 +2343,7 @@ function git_quiet(cwd, args) {
 	try {
 		const result = spawnSync("git", args, {
 			cwd,
+			env: command_env(process.env),
 			encoding: "utf8"
 		});
 		return {
@@ -3528,13 +3554,14 @@ function report_changes(config, renderer, changes) {
 	renderer.warn(`gate edit: ${who} ${String(changes.gate_edits.length)} file(s) that decide ${whose} — ${listed}${hidden > 0 ? ` (+${String(hidden)} more)` : ""}. A green check proves less when ${edits} the gate; the critic is told about this and the run summary records it.` + (config.fail_on_gate_edit ? " This run will end without success (--fail-on-gate-edit, exit 8)." : ""));
 }
 /** Run the configured check, checkride or a command, with the environment
-* the caller set for it, else volley's own. */
+* the caller set for it, else volley's own less the seats' keys, since the
+* check runs code the builder wrote. */
 async function execute_check(deps, abort) {
 	const { config } = deps;
 	const root = build_root(config.workspace, config.worktree);
 	const options = {
 		abort,
-		...deps.check?.env !== void 0 ? { env: deps.check.env } : {}
+		env: deps.check?.env ?? command_env(process.env)
 	};
 	return config.check_resolved === "checkride" ? run_checkride({
 		...options,