@sema-agent/core 7.33.7 → 7.33.8

package/CHANGELOG.md

@@ -1,3 +1,21 @@
+## 7.33.8 — 2026-09-28
+
+### Fix — every child process the engine starts gets its environment through the credential scrub; a `runSpec` oracle gate's command no longer inherits the engine's environment (#1181; security; behavior narrowing; +0 runtime exports; new optional type members `OracleGateSpec.inheritEnv`, `RunSpecOptions.onNotice`, `runOracle` options `onNotice`) (@server)
+
+- **Before.** A `runSpec` / `runOracle` gate ran its command through `execFile` with no `env`, so the child inherited the engine's whole environment — every credential in it. The command is the deployment's, but the tests it runs load code the model wrote: that code could read the credentials, write them to a file and read them back on the next turn (measured on 7.33.7: a gate printing two planted credential-shaped variables printed both values). The engine's own helpers — the tree kill's `ps` / `taskkill` / Git Bash group kill, shell discovery (`which bash` / `where bash.exe`) and the store lock's holder probe (`ps -p`) — also inherited the whole environment; each is looked up on PATH, so a PATH entry the model can write to (a workspace `node_modules/.bin`, which `npm run` prepends) made a planted `ps` read the credentials on every timed-out tool shell's tree kill (reproduced).
+- **Now.** One rule, machine-kept: a child's environment comes through the scrub. The oracle gate reads the tool shell's three states, per gate: `OracleGateSpec.inheritEnv` absent or `"scrub"` — the engine's environment without its credential-shaped variables (`scrubSecretEnv`); `"all"` — the whole environment; a list — exactly the named variables that are set (a strict allow list: name `PATH` too when the command is looked up on it). Names only, never values — the contract is serializable data. A malformed `inheritEnv` (another word, a non-string, an empty name, a name holding `=` or a NUL) makes that gate `error` and starts nothing; a command the OS refuses outright (a NUL in an argument) is an `error` gate instead of a rejected `runOracle`. The withheld names reach the shared once-per-process `config.secret_env_scrubbed` notice through the new `onNotice` on `runOracle`'s options and on `RunSpecOptions` (absent ⇒ the console line). The helpers pass the scrubbed environment and announce nothing. The tool shell reads the same three-state helper (`inheritedHostEnv`, src/core/secret-env.ts), behaviour unchanged; the language server keeps its own `env` / scrub; a stdio MCP server already received only the SDK's allow list (`HOME LOGNAME PATH SHELL TERM USER`; the Windows list) plus its declared `env`, now pinned by a real child. `gate:spawn-sites` (static tier) keeps the table: every call of a process-starting import under `src/` is a row — `scrub` (it passes an `env` and its file reaches the scrub) or `exempt` with the reason (only the MCP allow list and example code remain) — and each runtime dependency's process starts are reviewed at its pinned version; a new site, an unreadable shape (`require`, `import()`, a re-export, the binding used as a value) or an unreviewed dependency version is red. Residual (KL-1181): at `import("sharp")` on Linux, sharp's libc probe (`detect-libc`) may run `getconf …; ldd --version` through `execSync` with the engine's environment when the interpreter, `/usr/bin/ldd` and `process.report` all fail to answer — a dependency's own spawn, which core cannot hand an environment.
+- **Who needs it.** Deployments that run `runSpec` / `runOracle` with credentials in the engine's environment; any deployment whose PATH holds a directory the model can write to.
+- **Who is hurt / compensation.** A deployment whose oracle tests need a credential-shaped variable (`DATABASE_URL`, `*_TOKEN`, `*_API_KEY`, …): the test now runs without it and the gate may go red or `error`. Put it back per gate — `inheritEnv: ["PATH", "HOME", "DATABASE_URL", …]` (strict: list everything the command needs) or `inheritEnv: "all"` (the previous behaviour). A `runSpec` whose preflight is the first scrub in the process takes the once-per-process notice: wire `RunSpecOptions.onNotice` to the same sink as the exec env's `onNotice`, or the line goes to the console. A PATH-looked-up helper no longer sees credential-shaped variables (none of them needs one).
+- Pins: `test/backlog1181-spawn-site-env.test.ts` — the oracle gate through real children (default / `"scrub"` / `"all"` / allow list, nine malformed shapes starting nothing, a NUL argument, the notice, the public `runSpec` preflight + stop gate + final run), the shared helper and its validator, a planted `ps` on PATH through a timed-out `NodeExecutionEnv` shell and through `processFingerprint`, the stdio MCP control row; `test/backlog1181-shell-discovery-env.test.ts` — `/bin/bash` read as absent, the public `getShellConfig()` asks a planted `which` that reads no credential; `gate:spawn-sites` green on the shipped tree and red on each mutation (the 7.33.7 oracle site, a lost scrub call, a new site in a registered file / a namespace import / a stdio transport, a moved count, `require` / `import()` / re-export / value / destructure / shorthand / local export / default export, the table's own stale / reasonless / unknown-word / duplicate rows, a new / bumped / removed dependency).
+
+### Fix — a credential entry of `GIT_CONFIG_PARAMETERS` is withheld wherever it sits in the list (#1183; security; 7.33.6 regression; behavior narrowing; +0 exports, +0 wire keys, `SecretEnvFindingKind` unchanged) (@server)
+
+- **Before.** The variable's entries were judged with `entries.some(gitConfigEntryCarriesCredential)`: `some` passes each entry's index as the second argument, and that function's second parameter is its recursion bound (`depth`, command lines read only below 3, since 7.33.6). From the fourth entry on, a credential-carrying command line (`credential.helper=!sh -c '…password…'`, a `core.sshCommand` with a password) was not read and the variable reached the tool shell and the language server — git reads every entry.
+- **Now.** Each entry is judged from depth 0, whatever its position (checked through the real git binary for positions 1–6, before and after the scrub). A clean list of the same length is handed on as before. `gate:point-free-callbacks` (static tier): a function handed by name to `some` / `every` / `map` / `filter` / `find` / `findIndex` / `findLast` / `findLastIndex` / `forEach` / `flatMap` / `Array.from` (dot or element-access spelling) may declare one parameter (`reduce` / `reduceRight`: two); more — or a rest parameter — is red unless an allow row says why the extra argument is wanted (the 155 point-free sites in `src/` today: one was this defect, none allowed).
+- **Who needs it.** Hosts that hand git configuration through `GIT_CONFIG_PARAMETERS` (`git -c` in a parent process, CI wrappers).
+- **Who is hurt / compensation.** None beyond the variable's existing reading: a list whose fourth or later entry carries a credential is now withheld whole, as the first three always were.
+- Pins: `test/backlog1183-point-free-callbacks.test.ts` — the reported helper at positions 1–6 through real git; a clean six-entry list kept; the gate green on the shipped tree, red on the unwrapped call in the real `secret-env.ts`, on a defaulted / plain second parameter, a rest parameter, `parseInt`, a method reference, a three-parameter reducer, `Array.from`'s mapFn and the element-access spellings `x?.['some'](f)` / `Array['from'](xs, f)`; quiet on the wrapped form, `Boolean` / `String`, a two-parameter reducer, an inline `(e, i)` arrow, a non-callback `find(id)`; the allow list's silence, stale row and reasonless row.
+
 ## 7.33.7 — 2026-09-28
 
 ### Fix — the OpenTelemetry OTLP exporter's header lists are withheld from the tool shell and language-server children by name (#1180; security; behavior narrowing; +0 exports, +0 wire keys, `SecretEnvFindingKind` unchanged) (@server)

package/dist/core/secret-env.d.ts

@@ -13,8 +13,9 @@
  *   2. The public export points at a STABLE first-party path that SURVIVES the planned de-vendoring refactor —
  *      when NodeExecutionEnv is naturalized out of `src/vendor/`, this module does not move and nothing rebinds.
  *
- * The `inheritEnv` THREE-STATE assembly (`"all"` opt-out / `"scrub"` default / `string[]` allowlist) is a
- * per-adapter concern (each exec env owns how it composes its child env); only the secret PATTERN is shared.
+ * The `inheritEnv` THREE-STATE policy (`"all"` opt-out / `"scrub"` default / `string[]` allowlist) is read ONCE, by
+ * {@link inheritedHostEnv}, for every engine spawn site that takes it (the tool shell, a `runSpec` oracle gate). A
+ * downstream adapter composes its own child env; only the secret PATTERN is shared with it.
  */
 import type { RedactionConfidence, RedactionSource } from "./arg-summary.js";
 import { type EngineNotice } from "./engine-notice.js";
@@ -62,6 +63,19 @@ export declare function isSecretEnvKey(key: string, value?: string, env?: NodeJS
  *  to this process's own platform, the answer for a child spawned on this host; a host whose child runs elsewhere (a
  *  remote or sandboxed execution environment) passes that environment's platform. */
 export declare function scrubSecretEnv(env: NodeJS.ProcessEnv, findings?: SecretEnvFinding[], platform?: NodeJS.Platform): NodeJS.ProcessEnv;
+/** How much of this process's environment a child spawned on this host inherits — the `inheritEnv` value. */
+export type InheritEnvPolicy = "all" | "scrub" | string[];
+/**
+ * The environment a child spawned ON THIS HOST inherits, by an {@link InheritEnvPolicy}: `"scrub"` (and absent) is
+ * this process's environment through {@link scrubSecretEnv} for this platform; `"all"` is this process's environment
+ * verbatim (the explicit opt-out); a `string[]` is exactly the named variables that are set, verbatim — a strict allow
+ * list, so a name it leaves out (`PATH` included) is not inherited. `findings` collects what the scrub withheld, and
+ * only the `"scrub"` arm adds to it. Any other value reads as `"scrub"`: a spawn site that must refuse a malformed
+ * policy asks {@link inheritEnvPolicyProblem} first.
+ */
+export declare function inheritedHostEnv(policy: InheritEnvPolicy | undefined, findings?: SecretEnvFinding[]): NodeJS.ProcessEnv;
+/** Why `value` is not an {@link InheritEnvPolicy} (absent counts as one — the scrub), or `undefined` when it is. */
+export declare function inheritEnvPolicyProblem(value: unknown): string | undefined;
 /** Test seam: never called by production code. */
 export declare function __resetSecretEnvScrubNoticeAnnouncement(): void;
 /**

package/dist/core/secret-env.js

@@ -469,7 +469,7 @@ export function readGitConfigParameters(text) {
 }
 function gitConfigVariableCarriesCredential(upperName, value) {
     if (upperName === "GIT_CONFIG_PARAMETERS")
-        return readGitConfigParameters(value)?.some(gitConfigEntryCarriesCredential) ?? true;
+        return readGitConfigParameters(value)?.some((entry) => gitConfigEntryCarriesCredential(entry)) ?? true;
     const key = PROXY_ENV_NAMES.has(upperName) ? "http.proxy" : GIT_COMMAND_ENV_KEYS.get(upperName);
     return key !== undefined && gitConfigEntryCarriesCredential({ key, value });
 }
@@ -608,6 +608,30 @@ export function scrubSecretEnv(env, findings, platform = process.platform) {
     }
     return out;
 }
+export function inheritedHostEnv(policy, findings) {
+    if (policy === "all")
+        return { ...process.env };
+    if (Array.isArray(policy)) {
+        const picked = {};
+        for (const k of policy)
+            if (process.env[k] !== undefined)
+                picked[k] = process.env[k];
+        return picked;
+    }
+    return scrubSecretEnv(process.env, findings, process.platform);
+}
+export function inheritEnvPolicyProblem(value) {
+    if (value === undefined || value === "all" || value === "scrub")
+        return undefined;
+    if (Array.isArray(value)) {
+        const bad = value.findIndex((k) => typeof k !== "string" || k.length === 0 || /[=\0]/.test(k));
+        if (bad === -1)
+            return undefined;
+        const k = value[bad];
+        return `inheritEnv[${bad}] is not a variable name (got ${typeof k !== "string" ? typeof k : k === "" ? "an empty string" : `a name holding ${k.includes("=") ? "\"=\"" : "a NUL"}`})`;
+    }
+    return `inheritEnv must be "scrub", "all" or a list of variable names (got ${typeof value === "string" ? JSON.stringify(value) : value === null ? "null" : typeof value})`;
+}
 let secretEnvScrubNoticeAnnounced = false;
 export function __resetSecretEnvScrubNoticeAnnouncement() {
     secretEnvScrubNoticeAnnounced = false;

package/dist/core/spec-contract.d.ts

@@ -6,11 +6,14 @@
  * 🔴 **信任声明(fable-M3)**:SpecContract 是 **CODE-tier** 输入 —— `oracle[].cmd` 会被亲跑(execFile,
  * 任意命令)。它只能来自部署作者/可信代码路径;LLM 生成的 contract 直接喂 runSpec = 不受信输入获得
  * 命令执行权(越红线),禁止。contract 里的 `spec` **文本**才是 DATA-tier(runSpec 恒围栏置入 objective)。
+ * 命令可信 ≠ 它跑的代码可信:门跑的测试会加载模型改过的代码,故门子进程的环境缺省经 `scrubSecretEnv`
+ * (`OracleGateSpec.inheritEnv`,与 tool shell 同一三态),凭据名只在部署显式列名 / `"all"` 时交给它。
  *
  * 🔴 **oracle 三值(fable-M6)**:每门结果 ∈ {green, red, error} —— 判据不满足 = red;基础设施故障
  * (ENOENT/timeout/maxBuffer/parse 解析不出)= **error 非 red**。假红防线:error 绝不冒充"曾经红过"
  * (design/73 红线② 的机器化 —— `oracleHadRedRun` 只由真 red 观察置位)。
  */
+import type { EngineNotice } from "./engine-notice.js";
 /** Declarative green criteria for one oracle gate. Absent ⇒ `exitCode === 0`. All declared criteria AND. */
 export interface OracleGreenSpec {
     /** Expected exit code. Default 0 when no `parse` is declared; with `parse`, exit code is only
@@ -48,6 +51,15 @@ export interface OracleGateSpec {
     /** Per-gate timeout. Default 60s. */
     timeoutMs?: number;
     green?: OracleGreenSpec;
+    /**
+     * How much of the engine's environment the gate's command inherits — the tool shell's `inheritEnv`, read the same
+     * way. Absent / `"scrub"`: the environment without its credential-shaped variables (`scrubSecretEnv`); the command
+     * runs code the model wrote, so the credentials are not handed to it by default. `"all"`: the whole environment.
+     * A list: exactly the named variables that are set (a strict allow list — `PATH` too, when the command is looked
+     * up on it). Names only, never values: the contract is serializable data. A value of any other shape makes the
+     * gate `error`.
+     */
+    inheritEnv?: "all" | "scrub" | string[];
 }
 /** design/125 D1 — the machine-readable task contract (CODE-tier input; see module doc). */
 export interface SpecContract {
@@ -113,6 +125,9 @@ export interface OracleRunReport {
 export declare function runOracle(gates: OracleGateSpec[], cwdRoot: string, opts?: {
     baseline?: OracleBaseline;
     signal?: AbortSignal;
+    /** Receives the once-per-process `config.secret_env_scrubbed` notice when a gate's scrub withholds names (the
+     *  tool shell's seat and latch); absent ⇒ the console line. */
+    onNotice?: (notice: EngineNotice) => void;
 }): Promise<OracleRunReport>;
 /** Extract the per-gate baseline counts from a (preflight) report — only gates whose parse succeeded. */
 export declare function captureBaseline(report: OracleRunReport): OracleBaseline;

package/dist/core/spec-contract.js

@@ -2,20 +2,15 @@ import { execFile } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import { lstatSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, isAbsolute, resolve, sep } from "node:path";
+import { announceSecretEnvScrub, inheritEnvPolicyProblem, inheritedHostEnv } from "./secret-env.js";
 import { physicalPathOf } from "./physical-path.js";
 const DEFAULT_GATE_TIMEOUT_MS = 60_000;
 const GATE_MAX_BUFFER = 16 * 1024 * 1024;
 const OUTPUT_TAIL_CHARS = 1500;
 const REGEX_SCAN_CAP = 2 * 1024 * 1024;
-function execGate(gate, cwd, signal) {
+function execGate(gate, cwd, env, signal) {
     return new Promise((resolvePromise) => {
-        execFile(gate.cmd[0], gate.cmd.slice(1), {
-            cwd,
-            timeout: gate.timeoutMs ?? DEFAULT_GATE_TIMEOUT_MS,
-            maxBuffer: GATE_MAX_BUFFER,
-            encoding: "utf8",
-            signal,
-        }, (err, stdout, stderr) => {
+        const settle = (err, stdout, stderr) => {
             const output = (stdout ?? "") + (stderr ?? "");
             if (!err)
                 return resolvePromise({ exitCode: 0, output });
@@ -26,7 +21,13 @@ function execGate(gate, cwd, signal) {
                 return resolvePromise({ exitCode: null, output, infraError: `timeout/killed (${e.signal ?? "timeout"})` });
             }
             return resolvePromise({ exitCode: null, output, infraError: String(e.code ?? e.message ?? "spawn error") });
-        });
+        };
+        try {
+            execFile(gate.cmd[0], gate.cmd.slice(1), { cwd, env, timeout: gate.timeoutMs ?? DEFAULT_GATE_TIMEOUT_MS, maxBuffer: GATE_MAX_BUFFER, encoding: "utf8", signal }, settle);
+        }
+        catch (e) {
+            settle(e instanceof Error ? e : new Error(String(e)));
+        }
     });
 }
 function safeTest(re, output) {
@@ -132,6 +133,11 @@ export async function runOracle(gates, cwdRoot, opts) {
             results.push(err(gate, "gate cmd is empty — no executable to run"));
             continue;
         }
+        const envProblem = inheritEnvPolicyProblem(gate.inheritEnv);
+        if (envProblem !== undefined) {
+            results.push(err(gate, `gate ${envProblem}`));
+            continue;
+        }
         let cwd = root;
         if (gate.cwd !== undefined) {
             const candidate = resolve(root, gate.cwd);
@@ -151,7 +157,10 @@ export async function runOracle(gates, cwdRoot, opts) {
             }
             cwd = candidate;
         }
-        const exec = await execGate(gate, cwd, opts?.signal);
+        const withheld = [];
+        const env = inheritedHostEnv(gate.inheritEnv, withheld);
+        announceSecretEnvScrub(opts?.onNotice, withheld);
+        const exec = await execGate(gate, cwd, env, opts?.signal);
         results.push(evaluateGate(gate, exec, opts?.baseline));
     }
     const verdict = results.some((r) => r.verdict === "error")

package/dist/engine/execution-env/kill-tree.js

@@ -1,4 +1,5 @@
 import { spawn, spawnSync } from "node:child_process";
+import { scrubSecretEnv } from "../../core/secret-env.js";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 const DEFAULT_GRACE_MS = 3000;
@@ -144,6 +145,7 @@ function enumerateDescendantsSync(rootPid) {
     let out;
     try {
         const result = spawnSync("ps", ["-A", "-o", "pid=", "-o", "ppid=", "-o", "etime="], {
+            env: scrubSecretEnv(process.env),
             timeout: PS_ENUMERATION_TIMEOUT_MS,
             encoding: "utf8",
             windowsHide: true,
@@ -209,6 +211,7 @@ function parseEtimeSeconds(etime) {
 function runTaskkill(args) {
     try {
         const child = spawn("taskkill", args, {
+            env: scrubSecretEnv(process.env),
             stdio: "ignore",
             detached: true,
             windowsHide: true,
@@ -268,7 +271,7 @@ function tryMsysGroupKill(bashPath, pid) {
         `[ -n "$g" ] && [ "$g" != "0" ] && kill -9 -"$g" 2>/dev/null; ` +
         `done; exit 0`;
     try {
-        const child = spawn(bashPath, ["-c", script], { stdio: "ignore", detached: true, windowsHide: true });
+        const child = spawn(bashPath, ["-c", script], { env: scrubSecretEnv(process.env), stdio: "ignore", detached: true, windowsHide: true });
         child.on("error", () => { });
         return true;
     }

package/dist/engine/execution-env/node-execution-env.js

@@ -7,7 +7,7 @@ import { dirname, isAbsolute, join, resolve, sep } from "node:path";
 import { createInterface } from "node:readline";
 import { ExecutionError, err, FileError, ok, toError, } from "../harness/types.js";
 import { killProcessTree, shutdownDebug } from "./kill-tree.js";
-import { __resetSecretEnvScrubNoticeAnnouncement, announceSecretEnvScrub, scrubSecretEnv } from "../../core/secret-env.js";
+import { __resetSecretEnvScrubNoticeAnnouncement, announceSecretEnvScrub, inheritedHostEnv, scrubSecretEnv } from "../../core/secret-env.js";
 import { physicalPathOfAsync } from "../../core/physical-path.js";
 import { isUncSpelling } from "../../tools/fs/safety.js";
 import { RollingTailBuffer, markTruncated, newStreamCursorState, sliceStreamIncrement, } from "../../core/exec-output-tail.js";
@@ -119,6 +119,7 @@ async function runCommand(command, args, timeoutMs) {
             child = spawn(command, args, {
                 stdio: ["ignore", "pipe", "ignore"],
                 windowsHide: true,
+                env: scrubSecretEnv(process.env),
             });
         }
         catch {
@@ -203,44 +204,32 @@ export function __resetSecretScrubAnnouncement() {
     __resetSecretEnvScrubNoticeAnnouncement();
 }
 function getShellEnv(inheritEnv, baseEnv, extraEnv, onScrub, onNotice) {
-    let inherited;
-    if (inheritEnv === "all") {
-        inherited = process.env;
-    }
-    else if (Array.isArray(inheritEnv)) {
-        inherited = {};
-        for (const k of inheritEnv)
-            if (process.env[k] !== undefined)
-                inherited[k] = process.env[k];
-    }
-    else {
-        const scrubbed = [];
-        inherited = scrubSecretEnv(process.env, scrubbed, process.platform);
-        const findings = scrubbed.filter((f) => baseEnv?.[f.key] === undefined && extraEnv?.[f.key] === undefined);
-        if (findings.length > 0) {
-            if (typeof onScrub === "function") {
-                try {
-                    const r = onScrub(findings);
-                    if (typeof r?.then === "function") {
-                        r.then(undefined, () => {
-                        });
-                    }
-                }
-                catch {
+    const scrubbed = [];
+    const inherited = inheritedHostEnv(inheritEnv, scrubbed);
+    const findings = scrubbed.filter((f) => baseEnv?.[f.key] === undefined && extraEnv?.[f.key] === undefined);
+    if (findings.length > 0) {
+        if (typeof onScrub === "function") {
+            try {
+                const r = onScrub(findings);
+                if (typeof r?.then === "function") {
+                    r.then(undefined, () => {
+                    });
                 }
             }
-            else if (onScrub !== undefined && !secretScrubSeatDefectAnnounced) {
-                secretScrubSeatDefectAnnounced = true;
-                try {
-                    console.warn(`onSecretEnvScrub seat holds ${onScrub === null ? "null" : typeof onScrub} — not a function; scrub findings fall back to the console summary (once per process)`);
-                }
-                catch {
-                }
+            catch {
             }
-            if (!(typeof onScrub === "function" && onNotice === undefined)) {
-                announceSecretEnvScrub(onNotice, findings);
+        }
+        else if (onScrub !== undefined && !secretScrubSeatDefectAnnounced) {
+            secretScrubSeatDefectAnnounced = true;
+            try {
+                console.warn(`onSecretEnvScrub seat holds ${onScrub === null ? "null" : typeof onScrub} — not a function; scrub findings fall back to the console summary (once per process)`);
+            }
+            catch {
             }
         }
+        if (!(typeof onScrub === "function" && onNotice === undefined)) {
+            announceSecretEnvScrub(onNotice, findings);
+        }
     }
     return {
         ...inherited,

package/dist/orchestration/run-spec.d.ts

@@ -29,6 +29,7 @@ import type { RunnerSelfSeat } from "../core/runner/contracts.js";
 import type { TaskResult, TaskSpec } from "../core/types.js";
 import { type ToolPolicy } from "../core/tool-policy.js";
 import type { TaskOutcome } from "../core/task-outcome.js";
+import type { EngineNotice } from "../core/engine-notice.js";
 import { type OracleBaseline, type OracleGateResult, type OracleVerdict, type SpecContract } from "../core/spec-contract.js";
 export interface RunSpecOptions {
     /** Workcopy root — the containment root for frozenPaths, oracle cwd, and `spec.path` resolution. */
@@ -36,6 +37,9 @@ export interface RunSpecOptions {
     /** Per-run base spec (model/tools/toolPolicy/hooks/limits/…). `objective` is owned by runSpec (the
      *  spec framing); `toolPolicy` and `hooks` are COMPOSED with runSpec's, never replaced. */
     taskSpec: Omit<TaskSpec, "objective">;
+    /** Receives the oracle gates' once-per-process `config.secret_env_scrubbed` notice (`runOracle`'s `onNotice`);
+     *  absent ⇒ the console line. */
+    onNotice?: (notice: EngineNotice) => void;
 }
 export interface RunSpecOracleReport {
     /** Terminal adjudication (the authoritative bit — the stop gate only advises mid-run). */

package/dist/orchestration/run-spec.js

@@ -80,7 +80,8 @@ export async function runSpec(runner, contract, opts) {
     const startedAt = Date.now();
     const frozenResolved = resolveFrozenPaths(rootDir, contract.frozenPaths);
     const snapshot = snapshotFrozenPaths(frozenResolved);
-    const preflight = await runOracle(contract.oracle, rootDir, { signal: opts.taskSpec.signal });
+    const noticeSeat = opts.onNotice !== undefined ? { onNotice: opts.onNotice } : {};
+    const preflight = await runOracle(contract.oracle, rootDir, { signal: opts.taskSpec.signal, ...noticeSeat });
     const baseline = captureBaseline(preflight);
     let oracleHadRedRun = preflight.verdict === "red";
     let oracleRuns = 1;
@@ -137,7 +138,7 @@ export async function runSpec(runner, contract, opts) {
             guardRestores += restoreFrozenPaths(snapshot, rootDir);
             if (!gateAbandoned) {
                 const gateSignal = ctx.signal !== undefined && opts.taskSpec.signal !== undefined ? AbortSignal.any([ctx.signal, opts.taskSpec.signal]) : (ctx.signal ?? opts.taskSpec.signal);
-                const report = await runOracle(contract.oracle, rootDir, { baseline, ...(gateSignal !== undefined ? { signal: gateSignal } : {}) });
+                const report = await runOracle(contract.oracle, rootDir, { baseline, ...(gateSignal !== undefined ? { signal: gateSignal } : {}), ...noticeSeat });
                 if (ctx.signal?.aborted === true)
                     return undefined;
                 oracleRuns++;
@@ -175,7 +176,7 @@ export async function runSpec(runner, contract, opts) {
         hooks,
     });
     guardRestores += restoreFrozenPaths(snapshot, rootDir);
-    const final = await runOracle(contract.oracle, rootDir, { baseline });
+    const final = await runOracle(contract.oracle, rootDir, { baseline, ...noticeSeat });
     oracleRuns++;
     if (final.verdict === "red") {
         oracleHadRedRun = true;

package/dist/stores/file/fs-atomic.js

@@ -4,6 +4,7 @@ import { hrtime } from "node:process";
 import { basename, dirname, join, resolve as resolvePath } from "node:path";
 import { createHash, randomBytes } from "node:crypto";
 import { execFileSync } from "node:child_process";
+import { scrubSecretEnv } from "../../core/secret-env.js";
 import { physicalPathOf, physicalPathOfExisting } from "../../core/physical-path.js";
 import { thrownText } from "../../core/thrown-value.js";
 const SAFE_COMPONENT = /^[A-Za-z0-9_.-]+$/;
@@ -637,7 +638,7 @@ function probeStartTimesOnce(pid) {
             encoding: "utf8",
             timeout: START_TIME_PROBE_TIMEOUT_MS,
             stdio: ["ignore", "pipe", "ignore"],
-            env: { ...process.env, LC_ALL: "C", LANG: "C" },
+            env: { ...scrubSecretEnv(process.env), LC_ALL: "C", LANG: "C" },
         });
     }
     catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.33.7",
+  "version": "7.33.8",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",
@@ -86,6 +86,8 @@
     "gate:tool-docs": "node scripts/gen-tool-spec-fields.mjs --check",
     "gate:backlog-ledger": "node scripts/verify-backlog-ledger.mjs",
     "gate:child-clamp-seats": "node scripts/verify-child-clamp-seats.mjs",
+    "gate:spawn-sites": "node scripts/verify-spawn-sites.mjs",
+    "gate:point-free-callbacks": "node scripts/verify-point-free-callbacks.mjs",
     "gate:docs-tool-names": "node scripts/verify-docs-tool-names.mjs",
     "gate:comment-ratio": "vitest run test/comment-ratio-ratchet.test.ts",
     "gate:negative-controls": "vitest run test/gate-negative-controls.test.ts",

package/wire-changes/core@7.33.8.json

@@ -0,0 +1,165 @@
+{
+  "repo": "core",
+  "version": "7.33.8",
+  "from": "2dbd7b86789e1e5385ca2ebf13db6de617b33669",
+  "to": "v7.33.8",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [
+    {
+      "id": "F1",
+      "source": "behaviorFlips.summary",
+      "text": "#1181 (security, narrowing): a `runSpec` / `runOracle` gate's command is spawned with the engine's environment through the credential scrub; `OracleGateSpec.inheritEnv` (\"scrub\" default / \"all\" / allow list, names only) puts names back per gate; a malformed `inheritEnv` or a command the OS refuses outright is an `error` gate; the withheld names reach the shared once-per-process `config.secret_env_scrubbed` notice through `runOracle`'s and `RunSpecOptions`' new optional `onNotice`."
+    },
+    {
+      "id": "F2",
+      "source": "behaviorFlips.summary",
+      "text": "#1181 (security, narrowing): the engine's helpers looked up on PATH — the tree kill's `ps` / `taskkill` / Git Bash group kill, shell discovery (`which bash` / `where bash.exe`) and the lock-holder probe (`ps -p`) — spawn with the scrubbed environment and announce nothing."
+    },
+    {
+      "id": "F3",
+      "source": "behaviorFlips.summary",
+      "text": "#1183 (security, narrowing; 7.33.6 regression): every `GIT_CONFIG_PARAMETERS` entry is judged from depth 0 — a credential-carrying command line in the fourth or a later entry withholds the variable, as the first three did (`SecretEnvFinding.kind` = `family-rule`)."
+    }
+  ],
+  "closedSetMembers": [
+    {
+      "set": "InheritEnvPolicy",
+      "at": [
+        "src/core/secret-env.ts:941"
+      ],
+      "newSet": true,
+      "added": [
+        "all",
+        "scrub"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": false
+    }
+  ],
+  "closedSetsUnreadable": [],
+  "typeKeys": [
+    {
+      "type": "OracleGateSpec",
+      "at": [
+        "src/core/spec-contract.ts:54"
+      ],
+      "added": [
+        "inheritEnv"
+      ],
+      "addedDetail": [
+        {
+          "key": "inheritEnv",
+          "optional": true
+        }
+      ],
+      "addedRequired": [],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": true
+    },
+    {
+      "type": "RunSpecOptions",
+      "at": [
+        "src/orchestration/run-spec.ts:56"
+      ],
+      "added": [
+        "onNotice"
+      ],
+      "addedDetail": [
+        {
+          "key": "onNotice",
+          "optional": true
+        }
+      ],
+      "addedRequired": [],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": true
+    }
+  ],
+  "typeKeysUnreadableArms": [],
+  "typeKeysFlattenedCount": 217,
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "engineNoticeCode",
+      "name": "config.secret_env_scrubbed",
+      "assertions": [
+        "G1.c"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "ExecutionError.code",
+      "assertions": [
+        "G2.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "McpServerSpec.transport",
+      "assertions": [
+        "G2.b",
+        "G2.c"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "OracleGateResult.reason",
+      "assertions": [
+        "G1.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "OracleGateResult.verdict",
+      "assertions": [
+        "G1.a",
+        "G1.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "OracleGateSpec.inheritEnv",
+      "assertions": [
+        "G1.a",
+        "G2.c"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "RunSpecOptions.onNotice",
+      "assertions": [
+        "G1.c"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "SecretEnvFinding.key",
+      "assertions": [
+        "G3.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "SecretEnvFinding.kind",
+      "assertions": [
+        "G3.a",
+        "G3.b"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [],
+    "server": [],
+    "sdk": [],
+    "note": "scanned cli@4e593722 server@108404d4 sdk@8c379ef — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it. Ledger files (**/docs/core-consumption/**, **/docs/wire-consumption/**, **/*LEDGER*.json) are not evidence of use — server: 2 name(s) matched ONLY in bookkeeping files and were set aside (OracleGateSpec, RunSpecOptions)"
+  },
+  "breakingCount": 0,
+  "breakingItems": [],
+  "toResolvedAt": "128ed39a3b20bb0a28352a156cb229538261551e"
+}