@sema-agent/core 7.51.0 → 7.51.1

package/CHANGELOG.md

@@ -1,3 +1,45 @@
+## 7.51.1 — 2026-10-14
+
+### `inheritEnv: "all"` is defined once, in core: the whole environment less the deployment's own credentials (#1753; security; behavior narrowing where a deployment declares its list, open to veto; closed sets: +1 set `EngineCapability`, +1 member `SecretEnvFindingKind` `own-credential`; exports: +6, none removed; members: +1 optional notice detail key)
+
+**Behavior narrowing (open to veto).** (1) **What changed:** a deployment declares its own credential names once per process, with `declareWithheldEnv(names)`. After that, no child spawned on this host inherits one of them, whatever its `inheritEnv` says. That covers the tool shell, background shells, oracle gates, the language server, and the engine's own helper programs looked up on PATH (shell discovery `which` / `where`, the tree kill's `ps` / `taskkill` / Git Bash kill, the lock probe's `ps`). The MCP stdio child is the SDK's own spawn: it receives the SDK's default inherited set plus the server entry's configured `env` (the host's explicit grant), never this process's whole environment — so the declaration has nothing to subtract there. `"all"` is the whole environment less the declared names, and `"scrub"` is the scrub's result less them. An allow list naming one is refused. One function says all of this, `inheritedHostEnv(policy, findings?)`. Every core spawn site goes through it (`scrubSecretEnv(` now has exactly one caller in src), and it is now a root export, so a host's own spawn site calls it instead of reading the policy a second time. (2) **Who breaks:** a deployment that declares names and relied on `"all"` handing them to the model's shell. That reliance is the defect being closed: an engine's approval bearer reached a model-driven shell under `"all"`, and one `curl` could approve its own card (the inheritance arm; the engine process's own initial environment stays readable to same-user processes on the host through `ps -E` / `/proc/<pid>/environ` — KL-1753-a — so a credential that never enters the environment remains the root fix). A deployment that declares nothing sees no change. (3) **How to migrate:** at start-up, before anything spawns, call `declareWithheldEnv` with the deployment's own credential names (every `type: secret` key of its configuration directory), and call `inheritedHostEnv(policy, findings)` at every host spawn site. A child that genuinely needs one of those values gets it through an explicit grant (`shellEnv`, a per-exec `env`, `NodeLspManagerOptions.env`), never by inheritance.
+
+- **Before (7.51.0).** `inheritedHostEnv("all")` was `{ ...process.env }` and an allow list was handed out as written. The function was not exported, so every host re-read the three policies itself (server `src/plugins/remote-env-host.ts` `childEnv`: `all ⇒ { ...process.env }`). A malformed policy that reached the function was read as `"scrub"`.
+- **Now.** `inheritedHostEnv(policy, findings?)` subtracts the declared names from every policy's result. Each name it subtracts is a finding `{ kind: "own-credential", confidence: "high", source: "secret-env" }`. A name the scrub already withheld stays one finding, the scrub's. Names are compared the way the platform compares them: exactly, except case-blind on Windows. `declareWithheldEnv` copies the list, and a later call replaces it whole (a configuration reload), taking effect from the next spawn. A malformed list throws `declareWithheldEnv: …` and leaves the previous declaration standing. Malformed means not an array, or an entry that is not a variable name (empty, or holding `=`, NUL, white space or an unpaired surrogate — a name written "almost right" is refused, never silently unmet), or a name some layer of the host hands every child whatever env the spawn passes, which therefore cannot be withheld. Those names are `NODE_V8_COVERAGE` (Node), the MCP stdio transport's default inherited set (`HOME LOGNAME PATH SHELL TERM USER`; its Windows list there), and on Windows libuv's required variables. A name holding an unpaired UTF-16 surrogate is not a variable name: the platform stores it as U+FFFD. This is refused in a declaration and, newly, in an `inheritEnv` allow list.
+- **When an allow list naming a declared name is refused (fixed timing).** ① **At every spawn, always.** `inheritedHostEnv` reads the declaration as it stands and throws `inheritEnv[i] names X, which is this deployment's own credential and cannot be inherited by a child (a configuration error: no retry succeeds until the policy or the declaration changes)`. That is the invariant, whenever the declaration was made: a tool-shell exec answers `spawn_error`, a background shell `spawn_failed`, no child starts, and the `homeDir` / `cdPath` reads say "none" rather than throw. ② **Also early, when the declaration came first.** `NodeExecutionEnv` refuses at construction (`NodeExecutionEnv: …`), and the oracle gate refuses per gate (an `error` gate that starts nothing), both through `inheritEnvPolicyProblem(value)`, which reads the declaration. A host that declares after construction gets only ①. No new refusal code. `inheritedHostEnv` also throws for a value that is not a policy at all. It used to read such a value as `"scrub"`.
+- **Disclosure.** `config.secret_env_scrubbed` still fires once per process. `detail.names` now includes the withheld own credentials, and the new `detail.ownCredentials` (present only when one was withheld) names exactly them. The raw `onSecretEnvScrub` seat now also fires on an `"all"` leg that withheld one.
+- **One way in.** The language server's default environment and the five helper programs looked up on PATH now go through `inheritedHostEnv("scrub")`; they used to call `scrubSecretEnv(process.env)` directly. With nothing declared, every result is the same as before. `gate:spawn-sites` now lets one named data export of a process-starting module through as a non-site: the MCP SDK's `DEFAULT_INHERITED_ENV_VARS` (`INERT_SPAWN_MODULE_EXPORTS`), which the declaration reads instead of keeping a copy.
+- **Capability word.** `ENGINE_CAPABILITIES` (`src/core/engine-capabilities.ts`, frozen; type `EngineCapability`, registered in `docs/CLOSED-SETS.md`) is the engine build's capability words. Its first word, `inherit_env.own_credentials_withheld`, means the behaviour above. A shell gates on the word, not on a version number, and the server projects it onto `/v1/capabilities` once it passes its list.
+- **Consumers named.** *server*: declare once at boot (`declareWithheldEnv`, the directory's `type: secret` keys). `src/plugins/remote-env-host.ts` `childEnv` (`all` / allow-list / scrub arms, `:1936-1944`) and `src/server-secret-env.ts` `hostSubprocessEnv` move to `inheritedHostEnv(policy, findings)`. `src/request-value-closure.ts:164` `inheritEnvFieldIssue` asks `inheritEnvPolicyProblem(value)` for the list-naming refusal (early, at the request door). `src/boot/execution-env.ts:694` (the git base env under `"all"`) is covered by the same declaration. The bit on `/v1/capabilities` comes from `ENGINE_CAPABILITIES`. *cli*: `src/sema/inheritEnvWire.ts:40-46` gates sending `"all"` on that capability bit instead of the version (L-1408). *client-core*: `src/inheritEnvWire.ts:61` `inheritEnvDeclaration` takes the bit. *desktop*: `docs/W-WIRE-D8-DECISION.md` (B, does not send `inheritEnv`) can revisit once the bit is true.
+- **Who is hurt / compensation.** A TypeScript consumer that switches exhaustively over `SecretEnvFindingKind` gets a compile error on `own-credential` (one new arm). A caller of the previously internal `inheritedHostEnv` with a malformed policy gets a throw where it used to get the scrub; no such caller existed outside core. A host that declares a name after building an environment whose allow list names it sees that environment's spawns refused, loudly, from then on.
+- **Pins.** `test/backlog1753-own-credentials-withheld.test.ts`, W1–W11:
+  - `"all"` less the declaration, through a unit call and through a real shell's `printenv`; the user's undeclared token is still handed on.
+  - `"scrub"` unioned with the declaration.
+  - An allow list refused at the validator and in `inheritedHostEnv`. Declared before construction ⇒ `NodeExecutionEnv` refuses. Declared after ⇒ exec `spawn_error` and background `spawn_failed`, no child starts, the reads say "none". The oracle gate refuses it too.
+  - A malformed declaration throws and the previous one stands; the declaration is a copy and a later one replaces it.
+  - The disclosure and the raw seat.
+  - The oracle gate, through `runOracle` and the public `runSpec` path.
+  - The `shellEnv` grant.
+  - The Windows case fold, with the platform stubbed.
+  - The capability word against its CLOSED-SETS row.
+  - A planted PATH `ps` that sees no declared name, both on a tree kill and on a lock probe, with a control that sees it when nothing is declared.
+  - The AST pin: `scrubSecretEnv(` has one caller in src.
+
+  `test/backlog1753-lsp-withheld.test.ts` covers the language server's inherited environment, a declaration made after the manager was built, and the host's own `env` grant. Re-pinned: `test/backlog1181-spawn-site-env.test.ts` (a value that is not a policy now throws instead of reading as the scrub) and `test/public-knob-liveness.test.ts` (the three helper files no longer read the environment whole).
+- **Known limits.** KL-1753-a: another local process reading the engine's initial environment (`ps -E`, `/proc/<pid>/environ`) is an OS concern, out of this reach. KL-1753-b: the Windows case fold is pinned with the platform stubbed; Windows `process.env` behaviour itself is inferred. KL-1753-c: what the host hands a child itself (`shellEnv`, a per-exec `env`, `NodeLspManagerOptions.env`, an MCP server entry's `env`) is not read against the declaration, and no notice names such a grant. A credential value the engine holds that the deployment did not name is the separate value arm (#1754), not covered here.
+
+### `toolOutputBlockChars` is exported from the package root; two catalog sentences corrected (#1758, #1762; additive; hard-breaking: none; closed sets: none; exports: +1 function) (@server @client-core)
+
+- **What changed.** `toolOutputBlockChars(block)` — the one per-block character counter that `tool_end.totalChars` sums over a tool result's blocks (`src/core/runner/tool-output-projection.ts`) — is exported from the root, so a consumer that re-renders a truncated result counts with the same function instead of a copy. Two sentences are corrected: the `permission.entry_mode_clamped` catalog detail is `{ requested, effective, ceiling, sessionId }` — the minter sits at intake, before any run exists, so the `runId` the 7.51.0 entry listed cannot be minted (erratum noted on that entry); the session-rule bucket refusal's example now reads "Bash(rm:*) matches a command whose first word is rm" — a rule matches the command's first word, `/bin/rm` is not matched, and the earlier "refuses every run of rm" overstated it.
+- **Who breaks.** No one: an additive export and wording only.
+- **How to migrate.** `import { toolOutputBlockChars } from "@sema-agent/core"` and sum it over the result's `content` blocks to reproduce `totalChars`.
+
+### `headerOwnershipCollision` and `ProtocolHttpAuth` are exported from the package root (#1757; additive; hard-breaking: none; closed sets: none; exports: +1 function, +1 type) (@web-admin @server)
+
+- **What changed.** The engine's one header-ownership judge — "a header name has exactly one owner in a protocol declaration" (7.51.0 #1491, `src/core/protocol-http-auth.ts`), until now reachable only at dial time as `config.protocol_header_collision` — is exported, with its input type, so a host console's write face and a server's deployment intake refuse a colliding declaration at the door by calling the same function the engine calls, instead of keeping their own copies of the rule.
+- **Who breaks.** No one: additive. web-admin's two hand-written copies and server's intake (S-1571) retire onto this export.
+- **How to migrate.** `import { headerOwnershipCollision } from "@sema-agent/core"`; `undefined` = no collision, else `{ first, second }` are the two spellings that collide.
+
 ## 7.51.0 — 2026-10-14
 
 ### A tool list naming a tool nobody answers to no longer fails the run — the entry is kept and told once; only a spelling no tool name can have is refused (#1736; **BREAKING**: behavior change, the reversal of 7.49.0 hard-breaking ①; hard-breaking: one, open to veto (C-R449); closed sets: none; exports: none; members: none)
@@ -47,7 +89,7 @@
 **Now.**
 - The sentence names the route taken at the fork (never whether a park then commits): "handed on to this run's live approver", "handed on to this run's durable approval park, for a person to answer later", or "this run has no approver and no park facility, so the call was refused" (`that layer's …` at the inherited station). A run that declared `approvalReach: "none"` takes the `none` route only when no park lane is armed: an armed durable park is the deployment's own statement that an answer can wait for a person, so such a run parks (`durable_park`) — the declaration silences the live callback, not the park. A print / SDK-stdio lane whose approver callback cannot reach a person declares `approvalReach: "none"` (client-core `approvalReachDeclaration`); the route is then `none` and the engine — not the lane — says the call was refused.
 - `InheritedGate.autoModeFace` (new optional type key; opaque half, never serialized; present only when the ancestor's deps — or its own chain — carry an auto-mode face): `autoModeFaceOf(deps, chain)` is the one reading of "which face does this leg arm from" — the leg's own `RunnerDeps.autoMode`, else its ancestor's. A child whose runner wires none arms its own classifier (its own transcript, model and denial tracker) from the ancestor's deployment face; its own face wins where it has one; `RuntimeCaps.autoMode: false` still folds it.
-- `permission.entry_mode_clamped` joins the notice catalog (closed-set addition; audience `user`, `NOTICE_MINTER` `"server"`, `detail: { requested, effective, ceiling, sessionId, runId }`, once per run): the serving layer mints it where its entry floor clamps (server S-1306); this engine never mints it — its own folds stay `config.permission_mode_unavailable`. Readers: client-core / cli generated notice tables.
+- `permission.entry_mode_clamped` joins the notice catalog (closed-set addition; audience `user`, `NOTICE_MINTER` `"server"`, `detail: { requested, effective, ceiling, sessionId }`, once per run; erratum 7.51.1: this line first listed a `runId` the minter cannot have — the clamp happens at intake, before a run exists): the serving layer mints it where its entry floor clamps (server S-1306); this engine never mints it — its own folds stay `config.permission_mode_unavailable`. Readers: client-core / cli generated notice tables.
 - C-R138 (bypass: a card nobody answers parks on a durable seat, else is refused) holds on every K-ASK cell, including an approver that answers `unavailable` (`approver_unavailable`): pinned, no behaviour change.
 
 **Behavior change (narrowing of the person's reach).** A delegated child whose own runner wires no auto-mode face is classified under its ancestor's face (#1493 c): calls that went to a person in v7.50.0 because the child folded to `default` are now answered by the classifier like the parent's own calls; the deployment's deny bit (`RuntimeCaps.autoMode: false`) still wins. **Who is hurt.** A host that hand-wires the gate's classifier seat or reads the observer's `disposition` (hard-breaking 1). A deployment that relied on a face-less child runner refusing `auto` now gets a classifying child — the parent's face is the deployment's own trust gate; deny it per principal with `RuntimeCaps.autoMode: false`. **Compensation.** Fail-closed screen on the route word; the wire `disposition` keeps its two words; the parent stream now carries every child fold.
@@ -177,6 +219,14 @@
 - **Pins.** `test/backlog1573-egress-tiers.test.ts` (A loop station × thrown Error / string, and the returned-content control; B child value × cause / details / name / AggregateError / identity / cycle / accessor / depth / JSON reading / proxy / a getter or `toJSON` answering twice / a self-returning `toJSON`, a bound getter, a `Date` delegating to its own `toISOString`, a credential-named member serializing to `Basic …`, a `DOMException` re-minted, a subclass whose prototype `toJSON` / `toString` hands back raw text (top level, nested, through the loop's station); C activity summary × four fields / signed URL / field choice / authentication names; D quote spellings × faces; E nested JSON × depth 1–3; H header schemes × faces, Bearer control, shape kept, white space on either side of `=`, a quoted parameter at 1 024 / 1 025 / 1 500 characters inside one and two JSON layers with the fields after it kept, a bound cutting through the value; F new rows + namespace words; G guard + type pins); `test/fixtures/secret-detect-fixtures.json` (+26 fixtures: npm, ya29, ABIA / ACCA / A3T, encoded quotes, header schemes); `test/backlog1099-sema-namespace-secret-env.test.ts` (oracle = the derived words); `test/backlog1508-subagent-failure-redaction.test.ts` ③ / ⑨ re-pinned as "same class, same own members, sentence byte-identical" (a snapshot, not the live value); the `scrubSecrets` face retired from the #532 / #954 / #958 / #1583 / #1675 / #1691 / RB-209 pins.
 - **Known limits.** A credential carried by a PROTOTYPE accessor of a thrown class (`get message()` reading a closure) is not a member and is read only by the text face; KL-1717-b: white space after a parameter's `=` continues a header value, so a token68 that ends in `=` padding reads the next word as its value (`Authorization: Basic <…=> was sent` → `Authorization: [redacted] sent`) — the cost of not leaving `response= <value>` in clear; a field whose lower-case name glues a credential word to another word (`licensekey`) is no credential name to the record-key view (the old activity-summary filter matched substrings); a string member named with a credential word that holds no credential (`tokenCount: "5"`) reads the marker; the resume leg's thrown-error station (`run-leg.ts` — the `Error:` text and the marks of a thrown tool, both through the same-principal tier) and the compaction failure reason (`run-turn-boundary.ts`) are wired at the wave merge, so the live loop and the resumed leg mint the same redacted result; KL-1717-a: a credential passed as a program's flag argument (`curl -u alice:<password>`, `--password <value>`) is no text shape the vocabulary reads (it reads header grammar, not per-program flag grammar) — which flag takes a credential is a per-program grammar, the shell-argument model's, not the text vocabulary's.
 
+### The gate's sentences built from a thrown value are redacted before they are contained (#1728; P1; fix; security; behaviour change — more is redacted; hard-breaking: none; closed sets: none; exports: +0 / −0) (@server @test) — *disclosed 2026-10-14 13:1x, after the v7.51.0 tag: both fixes (`7172aff05`, `56dceceb5`) are ancestors of the tag; this section, criterion G18 / flip F32 and the ship-post erratum were added together*
+
+- **Before (v7.50.2; pre-existing — the base reads the same; found by the 7.51.0 stage review leg, probe R2).** `describeThrown` (`src/core/tool-policy.ts`), the one containment point for a thrown value's text at the gate, contained the text but did not redact it: a PreToolUse hook that crashed with a credential in its message, a live approver that threw ("approval errored for …", two sites), an approver outcome whose members threw on read ("could not be read", two sites) and the session-policy store's re-read failure notice put the credential on `tool_end.output`, into the model's next context, or onto the operator line.
+- **Now.** `describeThrown` redacts at the `same-principal` tier BEFORE it contains, so every reader of the one containment point is redacted at once; the empty-message fallback (the structural description — a thrown value's own key names are its text too) is redacted on the same terms; the session-rule store's notice reads `egressThrownText` directly. The 7.50.1 policy-throw mint already redacted its own line; this closes the siblings.
+- **Who is hurt.** A host or test that pinned one of those sentences with a credential-shaped string in it now reads the marker. No member, code, closed-set word or export changes.
+- **Compensation.** None needed (over-redaction on egress is the declared direction, as for #1573).
+- **Pins.** `test/backlog1728-gate-throw-texts.test.ts` (R2a the hook crash on the block reason; R2b the throwing approver on the model's next context; R2c the unreadable approver outcome in the refusal sentence; R2d `describeThrown` itself — redacted then contained, never empty, a non-Error value; R2e the empty-message fallback). Base (stage before the change): R2a–R2d red. Mutation: `describeThrown` contains `thrownText(err)` again ⇒ R2a–R2c red; the store notice reads `thrownText` ⇒ R2d red.
+
 ### A read station's answer is read one way by every reader: the resumed leg's belt refuses a returned silence (#1708; fix; security; behaviour narrowing; hard-breaking: none; exports: +0 / −0) (@server @test)
 
 - **Before (v7.50.1; the same in v7.49.5).** The durable-resume leg re-judges an approved shell call on its own read station before it runs. It refused when the station's judgment THREW or timed out (the `unanswered()` fallback), but a judgment that RETURNED `{ mandated, unanswered, environmentSilent }` — a resolver answering an error result — passed on an already-seen call and the call ran: a link re-pointed onto a deny-listed file while the call was parked, with the resolver giving no answer on the resumed leg, put that file's content in the transcript under a person's yes to a different question. The gate's fold read the same silence before its arms (7.50.0); the belt read it twice.

package/dist/core/engine-capabilities.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The engine build's capability words — the one home for "this engine does X". A shell gates on a word, never on a
+ * version number; the server projects the words it also wires onto its `/v1/capabilities`.
+ *
+ * A word is added in the release whose code makes it true and is never re-spelt; a word whose behaviour is retired
+ * leaves the set in a breaking release. Each word:
+ *  - `inherit_env.own_credentials_withheld` — a child spawned on this host never inherits a name the deployment
+ *    declared as its own credential (`declareWithheldEnv`): `inheritedHostEnv` subtracts the list from every policy's
+ *    result (`"all"` and `"scrub"` alike), and an allow list naming one is refused (`inheritEnvPolicyProblem`; every
+ *    spawn throws it). The word speaks of INHERITANCE only: the engine process's own environment stays readable to
+ *    same-user processes on the host (`ps -E`), so a credential that never enters it remains the root fix.
+ */
+export declare const ENGINE_CAPABILITIES: readonly ["inherit_env.own_credentials_withheld"];
+/** One word of {@link ENGINE_CAPABILITIES}. */
+export type EngineCapability = (typeof ENGINE_CAPABILITIES)[number];

package/dist/core/engine-capabilities.js

@@ -0,0 +1 @@
+export const ENGINE_CAPABILITIES = Object.freeze(["inherit_env.own_credentials_withheld"]);

package/dist/core/engine-notice.d.ts

@@ -379,10 +379,13 @@ export interface EngineNotice {
      *  - `"config.execution_env_capability_invalid"` — a remote env DECLARES a boolean capability key
      *    (`isolation`, `suspendable`, `canonicalPathAuthoritative`) with a non-boolean value; ABSENCE is a
      *    supported reading of each and stays silent. Once per key per run; `detail: { key, valueType }`.
-     *  - `"config.secret_env_scrubbed"` (#1081) — the D1 fail-closed `scrub` policy withheld one or more
-     *    secret-shaped keys from a spawned child's environment (a tool's shell, or a language server).
+     *  - `"config.secret_env_scrubbed"` (#1081) — the D1 fail-closed `scrub` policy, or the deployment's
+     *    declared own credentials (`declareWithheldEnv`), withheld one or more keys from a spawned child's
+     *    environment (a tool's shell, an oracle gate, or a language server).
      *    Once per PROCESS, shared by every scrub site ({@link import("./secret-env.js").announceSecretEnvScrub});
-     *    `detail: { names }` — every withheld key's name, never a value.
+     *    `detail: { names, ownCredentials? }` — every withheld key's name, never a value; `ownCredentials`, present
+     *    only when one was withheld, the subset withheld as declared own credentials (under any policy, `"all"`
+     *    included).
      *  - `"config.permission_mode_unavailable"` — the permission mode a task requested is not the mode the leg runs
      *    under: the deployment denies it (`by: "operator_deny"` — `RuntimeCaps.bypassPermissions` / `autoMode` is
      *    `false`), a requested `auto` has no classifier face (`by: "face_absent"` — neither the leg's deps nor its chain carry
@@ -879,8 +882,8 @@ export interface EngineNotice {
      *    `clampPermissionMode`), so the run starts under another mode. The disclosure is minted where the clamp happens:
      *    a fold this engine makes itself (a parent's ceiling, the deployment's deny bits, a missing classifier face) is
      *    `config.permission_mode_unavailable`, never this row. Audience `"user"`; `detail: { requested, effective,
-     *    ceiling, sessionId, runId }` — `requested` the caller's word, `effective` the word the run starts under,
-     *    `ceiling` the floor that clamped it. Once per run.
+     *    ceiling, sessionId }` — `requested` the caller's word, `effective` the word the run starts under, `ceiling`
+     *    the floor that clamped it; no run id — the clamp happens at intake, before any run exists. Once per run.
      *  - `"instructions.source_changed"` — the project instruction file this run injects is not the one the same
      *    session's previous run injected (a file added, removed or renamed). Audience `"user"`; `detail: { previous,
      *    current, sessionId }` — `previous` / `current` are chain-member relative paths, `null` = that run had none.

package/dist/core/runner/tool-output-projection.d.ts

@@ -4,6 +4,11 @@
  * state, zero runtask coupling — the module-level inputs are the text cap below and the shared media budget default
  * (`mediaBudgetBytes`); the leg hands in its own `mediaByteCapBytes`.
  */
+/** A block's own size in characters — the ONE counter `tool_end.totalChars` adds up over a tool result's blocks (a
+ *  consumer that re-renders a result sums the same function): a text block its text plus whatever else it carries at
+ *  its serialized length (the contract's text block carries nothing else), a media block its payload, any other block
+ *  its serialization. */
+export declare const toolOutputBlockChars: (b: unknown) => number;
 type ToolOutput = {
     output: unknown;
     truncated: boolean;

package/dist/core/runner/tool-output-projection.js

@@ -4,9 +4,9 @@ import { engineCardTypes } from "../tool-registry.js";
 import { readMember } from "../thrown-value.js";
 const MAX_TOOL_END_OUTPUT_CHARS = 16384;
 const marker = (n) => `…[+${n} chars truncated]`;
-const ownChars = (b) => isTextBlock(b) ? b.text.length + (JSON.stringify({ ...b, type: undefined, text: undefined })?.length ?? 2) - 2 : isMediaBlock(b) ? b.data.length : (JSON.stringify(b)?.length ?? 0);
+export const toolOutputBlockChars = (b) => isTextBlock(b) ? b.text.length + (JSON.stringify({ ...b, type: undefined, text: undefined })?.length ?? 2) - 2 : isMediaBlock(b) ? b.data.length : (JSON.stringify(b)?.length ?? 0);
 const boundTextLane = (blocks, lane) => {
-    const sized = lane.map((i) => ({ i, size: ownChars(blocks[i]) }));
+    const sized = lane.map((i) => ({ i, size: toolOutputBlockChars(blocks[i]) }));
     const stream = sized.reduce((n, { size }, k) => n + size + (k > 0 ? 1 : 0), 0);
     const forms = new Map();
     let used = 0;
@@ -61,7 +61,7 @@ const project = (content, mediaByteCapBytes) => {
         return { output: content, truncated: false };
     let next = 0;
     const output = content.flatMap((_, i) => (media[i] ? (fit.blocks[next++] ?? []) : text.forms.has(i) ? [text.forms.get(i)] : []));
-    return { output, truncated: true, totalChars: content.reduce((n, b) => n + ownChars(b), 0) };
+    return { output, truncated: true, totalChars: content.reduce((n, b) => n + toolOutputBlockChars(b), 0) };
 };
 export const toolOutputFrom = (result, mediaByteCapBytes) => {
     try {

package/dist/core/secret-env.d.ts

@@ -4,7 +4,8 @@
  * A child the engine spawns may run what the MODEL chose (a tool shell, a gate over model-written code, a language
  * server). Under the `"scrub"` policy (the default) it inherits every variable but those the judgment below names —
  * deleted whole, never rewritten; `"all"` and a `string[]` allow list are the caller's explicit alternatives
- * ({@link inheritedHostEnv}). One judgment per variable ({@link classifySecretEnvEntry}), the first rule that answers:
+ * ({@link inheritedHostEnv}). Whatever the policy, a name the deployment declares as its own credential
+ * ({@link declareWithheldEnv}) is never inherited. One judgment per variable ({@link classifySecretEnvEntry}), the first rule that answers:
  *   1. exempt — git's environment config and the proxy variables, handed on as written ({@link isExemptEnvName});
  *   2. `exact-name` — a known credential name (the vocabulary's exact env names);
  *   3. `prefix-rule` — the OpenTelemetry settings ({@link OTEL_ENV_RE});
@@ -25,10 +26,11 @@ import { type EngineNotice } from "./engine-notice.js";
  *  Reads the first {@link VALUE_SCAN_LIMIT} code units. The value half of the judgment, exported apart from the env
  *  entry's exemptions ({@link isExemptEnvName}): a caller holding a value that is no environment variable asks this. */
 export declare function looksLikeCredentialValue(value: string): boolean;
-/** Which rule withheld an entry. */
-export type SecretEnvFindingKind = "exact-name" | "name-rule" | "namespace-rule" | "prefix-rule" | "value-rule";
-/** One env entry the `"scrub"` policy withheld (deleted): its name — never its value, so the record is loggable —, the
- *  rule that withheld it, how strong that claim is, and the minting module. */
+/** Which rule withheld an entry: one of the scrub's rules, or `own-credential` — the deployment declared the name as its
+ *  own credential ({@link declareWithheldEnv}), which every policy withholds. */
+export type SecretEnvFindingKind = "exact-name" | "name-rule" | "namespace-rule" | "prefix-rule" | "value-rule" | "own-credential";
+/** One env entry withheld (deleted) from a child's environment: its name — never its value, so the record is
+ *  loggable —, the rule that withheld it, how strong that claim is, and the minting module. */
 export interface SecretEnvFinding {
     key: string;
     kind: SecretEnvFindingKind;
@@ -49,16 +51,39 @@ export declare function scrubSecretEnv(env: NodeJS.ProcessEnv, findings?: Secret
 /** How much of this process's environment a child spawned on this host inherits — the `inheritEnv` value. */
 export type InheritEnvPolicy = "all" | "scrub" | string[];
 /**
- * The environment a child spawned ON THIS HOST inherits, by an {@link InheritEnvPolicy}: `"scrub"` (and absent) is
- * this process's environment through {@link scrubSecretEnv}; `"all"` is this process's environment
- * verbatim (the explicit opt-out); a `string[]` is exactly the named variables that are set, verbatim — a strict allow
- * list, so a name it leaves out (`PATH` included) is not inherited. `findings` collects what the scrub withheld, and
- * only the `"scrub"` arm adds to it. Any other value reads as `"scrub"`; both spawn sites that take a policy — the
- * tool shell's `NodeExecutionEnv` (at construction) and the oracle gate (per gate) — refuse a malformed one through
- * {@link inheritEnvPolicyProblem} before it gets here.
+ * Declare the names of this deployment's OWN credentials in this process's environment — the engine's or its host's:
+ * an approval bearer, a service token. From then on no child spawned on this host inherits one, whatever the policy:
+ * every spawn site reads its environment through {@link inheritedHostEnv}, which subtracts them from `"all"` and from
+ * the scrub's result (each one present is a finding of kind `own-credential`), and {@link inheritEnvPolicyProblem}
+ * refuses an allow list naming one. Compared as the platform compares variable names: exactly, but case-blind on
+ * Windows. A variable a host hands a child itself (a shell's `shellEnv`, a per-exec `env`, a language server's `env`, an MCP server entry's `env`)
+ * is its explicit grant and is not read against the list.
+ *
+ * Declared once, at start-up, before anything spawns; a later call REPLACES the list (a configuration reload), read
+ * from the next spawn on — a spawn whose environment is already read (one announcing its findings) keeps it. The
+ * list is copied. A malformed list — not an array, an entry that is no variable name, or a name the host hands every
+ * child anyway ({@link runtimeSuppliedEnv}) — throws and leaves the declaration as it was.
+ */
+export declare function declareWithheldEnv(names: readonly string[]): void;
+/** Test seam: never called by production code (a host re-declares `[]`). */
+export declare function __resetWithheldEnv(): void;
+/**
+ * THE environment a child spawned ON THIS HOST inherits: the policy's arm, less the declared own credentials
+ * ({@link declareWithheldEnv}). The arms: `"scrub"` (and absent) is this process's environment through
+ * {@link scrubSecretEnv}; `"all"` is this process's environment as written; a `string[]` is exactly the named
+ * variables that are set, as written — a strict allow list, so a name it leaves out (`PATH` included) is not
+ * inherited. `findings` collects every entry withheld: the scrub's, and each declared own credential the arm held.
+ *
+ * A policy {@link inheritEnvPolicyProblem} refuses throws that reason HERE, at every spawn, read against the
+ * declaration as it stands: a value that is no policy at all (never read as the scrub), and an allow list naming a
+ * declared own credential — whenever the declaration was made, so the refusal at spawn time is the invariant. The
+ * spawn sites that take a policy (the tool shell's `NodeExecutionEnv` at construction, the oracle gate per gate) also
+ * ask first, so a host that declared before building them hears it at start-up.
  */
 export declare function inheritedHostEnv(policy: InheritEnvPolicy | undefined, findings?: SecretEnvFinding[]): NodeJS.ProcessEnv;
-/** Why `value` is not an {@link InheritEnvPolicy} (absent counts as one — the scrub), or `undefined` when it is. */
+/** Why `value` is not an {@link InheritEnvPolicy} this deployment can read (absent counts as one — the scrub), or
+ *  `undefined` when it is: a malformed policy, or an allow list naming one of the declared own credentials
+ *  ({@link declareWithheldEnv}, compared as it says). */
 export declare function inheritEnvPolicyProblem(value: unknown): string | undefined;
 /** Test seam: never called by production code. */
 export declare function __resetSecretEnvScrubNoticeAnnouncement(): void;
@@ -66,7 +91,8 @@ export declare function __resetSecretEnvScrubNoticeAnnouncement(): void;
  * The ONE disclosure point for a scrub's withheld keys. Routed through {@link deliverEngineNotice} — the
  * engine's one notice throat — so a wired `onNotice` seat REPLACES the console line exactly as every
  * other `EngineNotice` does, and an absent seat prints the same words `console.warn` always printed here.
- * `detail.names` carries every withheld key. Once per PROCESS, never per call or per site; an EMPTY
- * findings array is a no-op.
+ * `detail.names` carries every withheld key; `detail.ownCredentials`, present only when one was withheld, the
+ * subset withheld as the deployment's declared own credentials (kind `own-credential`) rather than by the scrub.
+ * Once per PROCESS, never per call or per site; an EMPTY findings array is a no-op.
  */
 export declare function announceSecretEnvScrub(onNotice: ((notice: EngineNotice) => void) | undefined, findings: readonly SecretEnvFinding[]): void;

package/dist/core/secret-env.js

@@ -1,4 +1,5 @@
 import { CREDENTIAL_VOCABULARY, envNameView, splitCamelCase } from "./credential-vocabulary.js";
+import { DEFAULT_INHERITED_ENV_VARS } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { deliverEngineNotice } from "./engine-notice.js";
 const GIT_CONFIG_ENV_RE = /^GIT_CONFIG_(?:COUNT|PARAMETERS|(?:KEY|VALUE)_[0-9]+)$/;
 const PROXY_ENV_RE = /^(?:(?:https?|ftp|all|no)_proxy|npm_config_(?:https?_)?proxy|npm_config_noproxy|yarn_proxy|(?:yarn|global_agent|docker|claude_code)_(?:https?|no)_proxy|cloudsdk_proxy_[a-z]+|electron_get_use_proxy)$/i;
@@ -93,6 +94,7 @@ const SECRET_ENV_KIND_CONFIDENCE = {
     "exact-name": "high",
     "prefix-rule": "high",
     "value-rule": "high",
+    "own-credential": "high",
     "name-rule": "medium",
     "namespace-rule": "medium",
 };
@@ -131,29 +133,91 @@ export function scrubSecretEnv(env, findings) {
     }
     return Object.fromEntries(kept);
 }
+function envNameKey(name) {
+    return process.platform === "win32" ? name.toUpperCase() : name;
+}
+const UNPAIRED_SURROGATE_RE = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/;
+function variableNameListProblem(label, value) {
+    const bad = value.findIndex((k) => typeof k !== "string" || k.length === 0 || /[=\0\s]/.test(k) || UNPAIRED_SURROGATE_RE.test(k));
+    if (bad === -1)
+        return undefined;
+    const k = value[bad];
+    const why = typeof k !== "string" ? typeof k : k === "" ? "an empty string" : `a name holding ${k.includes("=") ? "\"=\"" : k.includes("\0") ? "a NUL" : /\s/.test(k) ? "whitespace" : "an unpaired surrogate"}`;
+    return `${label}[${bad}] is not a variable name (got ${why})`;
+}
+const WINDOWS_REQUIRED_ENV = Object.freeze(["HOMEDRIVE", "HOMEPATH", "LOGONSERVER", "PATH", "SYSTEMDRIVE", "SYSTEMROOT", "TEMP", "USERDOMAIN", "USERNAME", "USERPROFILE", "WINDIR"]);
+function runtimeSuppliedEnv() {
+    return ["NODE_V8_COVERAGE", ...DEFAULT_INHERITED_ENV_VARS, ...(process.platform === "win32" ? WINDOWS_REQUIRED_ENV : [])];
+}
+const WITHHELD_ENV = Symbol.for("sema.core.withheldEnv");
+const NOTHING_WITHHELD = Object.freeze([]);
+const withheldEnvOf = () => {
+    const held = Reflect.get(globalThis, WITHHELD_ENV);
+    return Array.isArray(held) ? held : NOTHING_WITHHELD;
+};
+const setWithheldEnv = (names) => {
+    Reflect.set(globalThis, WITHHELD_ENV, Object.freeze([...names]));
+};
+export function declareWithheldEnv(names) {
+    const value = names;
+    if (!Array.isArray(value))
+        throw new Error(`declareWithheldEnv: the list must be an array of variable names (got ${typeof value === "string" ? JSON.stringify(value) : value === null ? "null" : typeof value})`);
+    const problem = variableNameListProblem("names", value);
+    if (problem !== undefined)
+        throw new Error(`declareWithheldEnv: ${problem}`);
+    const supplied = new Set(runtimeSuppliedEnv().map(envNameKey));
+    const unwithholdable = value.findIndex((k) => supplied.has(envNameKey(k)));
+    if (unwithholdable !== -1)
+        throw new Error(`declareWithheldEnv: names[${unwithholdable}] is ${value[unwithholdable]}, which a child is handed from this process's environment whatever the spawn passes (by Node, the MCP stdio transport or Windows) — it cannot be withheld`);
+    setWithheldEnv(value);
+}
+export function __resetWithheldEnv() {
+    setWithheldEnv([]);
+}
+function withholdOwnCredentials(inherited, findings) {
+    if (withheldEnvOf().length === 0)
+        return inherited;
+    const own = new Set(withheldEnvOf().map(envNameKey));
+    const kept = [];
+    for (const key of Object.keys(inherited)) {
+        if (!own.has(envNameKey(key)))
+            kept.push([key, inherited[key]]);
+        else
+            findings?.push({ key, kind: "own-credential", confidence: SECRET_ENV_KIND_CONFIDENCE["own-credential"], source: "secret-env" });
+    }
+    return Object.fromEntries(kept);
+}
+function policyShapeProblem(value) {
+    if (value === undefined || value === "all" || value === "scrub")
+        return undefined;
+    if (Array.isArray(value))
+        return variableNameListProblem("inheritEnv", value);
+    return `inheritEnv must be "scrub", "all" or a list of variable names (got ${typeof value === "string" ? JSON.stringify(value) : value === null ? "null" : typeof value})`;
+}
 export function inheritedHostEnv(policy, findings) {
+    const problem = inheritEnvPolicyProblem(policy);
+    if (problem !== undefined)
+        throw new Error(problem);
+    let arm;
     if (policy === "all")
-        return { ...process.env };
-    if (Array.isArray(policy)) {
-        const picked = {};
+        arm = { ...process.env };
+    else if (Array.isArray(policy)) {
+        arm = {};
         for (const k of policy)
             if (process.env[k] !== undefined)
-                picked[k] = process.env[k];
-        return picked;
+                arm[k] = process.env[k];
     }
-    return scrubSecretEnv(process.env, findings);
+    else
+        arm = scrubSecretEnv(process.env, findings);
+    return withholdOwnCredentials(arm, findings);
 }
 export function inheritEnvPolicyProblem(value) {
-    if (value === undefined || value === "all" || value === "scrub")
-        return undefined;
-    if (Array.isArray(value)) {
-        const bad = value.findIndex((k) => typeof k !== "string" || k.length === 0 || /[=\0]/.test(k));
-        if (bad === -1)
-            return undefined;
-        const k = value[bad];
-        return `inheritEnv[${bad}] is not a variable name (got ${typeof k !== "string" ? typeof k : k === "" ? "an empty string" : `a name holding ${k.includes("=") ? "\"=\"" : "a NUL"}`})`;
-    }
-    return `inheritEnv must be "scrub", "all" or a list of variable names (got ${typeof value === "string" ? JSON.stringify(value) : value === null ? "null" : typeof value})`;
+    const shape = policyShapeProblem(value);
+    if (shape !== undefined || !Array.isArray(value) || withheldEnvOf().length === 0)
+        return shape;
+    const own = new Set(withheldEnvOf().map(envNameKey));
+    const named = value.findIndex((k) => own.has(envNameKey(k)));
+    return named === -1 ? undefined : `inheritEnv[${named}] names ${value[named]}, which is this deployment's own credential and cannot be inherited by a child (a configuration error: no retry succeeds until the policy or the declaration changes)`;
 }
 let secretEnvScrubNoticeAnnounced = false;
 export function __resetSecretEnvScrubNoticeAnnouncement() {
@@ -164,9 +228,11 @@ export function announceSecretEnvScrub(onNotice, findings) {
         return;
     secretEnvScrubNoticeAnnounced = true;
     const names = findings.map((f) => f.key);
+    const ownCredentials = findings.filter((f) => f.kind === "own-credential").map((f) => f.key);
+    const own = ownCredentials.length > 0 ? `; ${ownCredentials.length} of them this deployment's own credential(s) (${ownCredentials.join(", ")})` : "";
     deliverEngineNotice(onNotice, {
         code: "config.secret_env_scrubbed",
-        message: `secret_env_scrubbed: ${findings.length} env key(s) withheld from a spawned child's environment (${names.join(", ")}) — once per process; wire onNotice for the structured form`,
-        detail: { names },
+        message: `secret_env_scrubbed: ${findings.length} env key(s) withheld from a spawned child's environment (${names.join(", ")})${own} — once per process; wire onNotice for the structured form`,
+        detail: { names, ...(ownCredentials.length > 0 ? { ownCredentials } : {}) },
     });
 }

package/dist/core/session-policy-store.js

@@ -60,7 +60,7 @@ export function readSessionRulesShape(value) {
         if (STORE_STAMPS.has(key) || v === undefined)
             continue;
         if (!Object.hasOwn(SESSION_RULE_BUCKETS, key)) {
-            return fault(key, "not a rule bucket", `session rules hold ${JSON.stringify(key)}, which is not a rule bucket — the buckets are ${BUCKETS.join(", ")}, and a shell command rule is a toolDeny / toolAllow entry written Bash(<command>) (Bash(rm:*) refuses every run of rm)`);
+            return fault(key, "not a rule bucket", `session rules hold ${JSON.stringify(key)}, which is not a rule bucket — the buckets are ${BUCKETS.join(", ")}, and a shell command rule is a toolDeny / toolAllow entry written Bash(<command>) (Bash(rm:*) matches a command whose first word is rm)`);
         }
         const field = key;
         const listed = Array.isArray(v) ? Array.from(v) : undefined;

package/dist/core/spec-contract.d.ts

@@ -7,7 +7,8 @@
  * 任意命令)。它只能来自部署作者/可信代码路径;LLM 生成的 contract 直接喂 runSpec = 不受信输入获得
  * 命令执行权(越红线),禁止。contract 里的 `spec` **文本**才是 DATA-tier(runSpec 恒围栏置入 objective)。
  * 命令可信 ≠ 它跑的代码可信:门跑的测试会加载模型改过的代码,故门子进程的环境缺省经 `scrubSecretEnv`
- * (`OracleGateSpec.inheritEnv`,与 tool shell 同一三态),凭据名只在部署显式列名 / `"all"` 时交给它。
+ * (`OracleGateSpec.inheritEnv`,与 tool shell 同一三态),凭据名只在部署显式列名 / `"all"` 时交给它;
+ * 部署声明的自有凭据名(`declareWithheldEnv`)在任一形下都不交。
  *
  * 🔴 **oracle 三值(fable-M6)**:每门结果 ∈ {green, red, error} —— 判据不满足 = red;基础设施故障
  * (ENOENT/timeout/maxBuffer/parse 解析不出)= **error 非 red**。假红防线:error 绝不冒充"曾经红过"
@@ -56,8 +57,9 @@ export interface OracleGateSpec {
      * way. Absent / `"scrub"`: the environment without its credential-shaped variables (`scrubSecretEnv`); the command
      * runs code the model wrote, so the credentials are not handed to it by default. `"all"`: the whole environment.
      * A list: exactly the named variables that are set (a strict allow list — `PATH` too, when the command is looked
-     * up on it). Names only, never values: the contract is serializable data. A value of any other shape makes the
-     * gate `error`.
+     * up on it). Under every form, the deployment's declared own credentials (`declareWithheldEnv`) are withheld, and a
+     * list naming one makes the gate `error`. Names only, never values: the contract is serializable data. A value of
+     * any other shape makes the gate `error`.
      */
     inheritEnv?: "all" | "scrub" | string[];
 }

package/dist/engine/execution-env/kill-tree.js

@@ -1,5 +1,5 @@
 import { spawn, spawnSync } from "node:child_process";
-import { scrubSecretEnv } from "../../core/secret-env.js";
+import { inheritedHostEnv } from "../../core/secret-env.js";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 const DEFAULT_GRACE_MS = 3000;
@@ -145,7 +145,7 @@ function enumerateDescendantsSync(rootPid) {
     let out;
     try {
         const result = spawnSync("ps", ["-A", "-o", "pid=", "-o", "ppid=", "-o", "etime="], {
-            env: scrubSecretEnv(process.env),
+            env: inheritedHostEnv("scrub"),
             timeout: PS_ENUMERATION_TIMEOUT_MS,
             encoding: "utf8",
             windowsHide: true,
@@ -211,7 +211,7 @@ function parseEtimeSeconds(etime) {
 function runTaskkill(args) {
     try {
         const child = spawn("taskkill", args, {
-            env: scrubSecretEnv(process.env),
+            env: inheritedHostEnv("scrub"),
             stdio: "ignore",
             detached: true,
             windowsHide: true,
@@ -271,7 +271,7 @@ function tryMsysGroupKill(bashPath, pid) {
         `[ -n "$g" ] && [ "$g" != "0" ] && kill -9 -"$g" 2>/dev/null; ` +
         `done; exit 0`;
     try {
-        const child = spawn(bashPath, ["-c", script], { env: scrubSecretEnv(process.env), stdio: "ignore", detached: true, windowsHide: true });
+        const child = spawn(bashPath, ["-c", script], { env: inheritedHostEnv("scrub"), stdio: "ignore", detached: true, windowsHide: true });
         child.on("error", () => { });
         return true;
     }

package/dist/engine/execution-env/node-execution-env.d.ts

@@ -88,6 +88,10 @@ export declare class NodeExecutionEnv implements ExecutionEnv, BackgroundShellCa
     /** `ExecutionEnv.cdPath` = the `CDPATH` the shell child receives, read LIVE off the same merge each exec gets (never the
      *  engine process's own environment): its entries, `[]` when the child gets none. Residual: a per-exec `env.CDPATH`. */
     get cdPath(): readonly string[];
+    /** The environment the next shell child would receive, for a READ (the scrub seat is a no-op: a read reports nothing).
+     *  `undefined` when no child would be spawned at all — the policy is refused against the own credentials declared
+     *  since construction, and every spawn throws that reason — so a reader sees "the child gets none", never a throw. */
+    private childEnvForRead;
     private shellPath?;
     private shellEnv?;
     private inheritEnv;
@@ -108,7 +112,9 @@ export declare class NodeExecutionEnv implements ExecutionEnv, BackgroundShellCa
          *  fail-closed (drop secret-pattern keys, keep PATH/build/locale). `"all"` = full inherit (trusted env);
          *  `string[]` = strict allowlist. `shellEnv`/per-exec `env` always pass through. Any other value — an unknown
          *  word, a non-string, a list entry that is not a variable name — throws here (`inheritEnvPolicyProblem`'s
-         *  reason), the same judgment the oracle gate's `inheritEnv` meets. */
+         *  reason), the same judgment the oracle gate's `inheritEnv` meets. Whatever the policy, the deployment's declared
+         *  own credentials (`declareWithheldEnv`) are withheld from the inherited part; a list naming one throws here when
+         *  the declaration came first, and every spawn refuses it (`spawn_error` / `spawn_failed`) whenever it came. */
         inheritEnv?: "all" | "scrub" | string[];
         /** design/105: inject a resident scheduler daemon backend (the shell daemon). Absent ⇒ scheduling INERT. */
         scheduler?: SchedulerCapability;
@@ -125,9 +131,10 @@ export declare class NodeExecutionEnv implements ExecutionEnv, BackgroundShellCa
          * deployments (their pre-suspend dispose becomes a no-op too — do not combine).
          */
         retainBackgroundProcesses?: boolean;
-        /** The D1 scrub decision's observation seat: called with every NON-EMPTY finding set the default
-         *  "scrub" leg withholds from a shell child. Absent ⇒ a once-per-process console summary (loud
-         *  enough to notice, quiet enough not to spam). Never called on the "all"/allowlist legs. */
+        /** The D1 scrub decision's observation seat: called with every NON-EMPTY finding set withheld from a
+         *  shell child — the default "scrub" leg's, and on any leg the declared own credentials the inherited part
+         *  held (kind `own-credential`). Absent ⇒ a once-per-process console summary (loud enough to notice,
+         *  quiet enough not to spam). An allow list withholds nothing else, so it reports nothing. */
         onSecretEnvScrub?: (findings: readonly SecretEnvFinding[]) => void;
         /** #1081 — the structured-notice seat for the SAME withheld-keys disclosure (`EngineNotice`,
          *  `code: "config.secret_env_scrubbed"`, `detail.names`); independent of `onSecretEnvScrub` (a raw

package/dist/engine/execution-env/node-execution-env.js

@@ -7,7 +7,7 @@ import { isAbsolute, join, resolve } from "node:path";
 import { createInterface } from "node:readline";
 import { ExecutionError, err, FileError, ok, toError, } from "../harness/types.js";
 import { killProcessTree, shutdownDebug } from "./kill-tree.js";
-import { __resetSecretEnvScrubNoticeAnnouncement, announceSecretEnvScrub, inheritEnvPolicyProblem, inheritedHostEnv, scrubSecretEnv } from "../../core/secret-env.js";
+import { __resetSecretEnvScrubNoticeAnnouncement, announceSecretEnvScrub, inheritEnvPolicyProblem, inheritedHostEnv } from "../../core/secret-env.js";
 import { physicalPathOfAsync } from "../../core/physical-path.js";
 import { posixModeBitsMeaningful } from "../../core/posix-mode-face.js";
 import { walkSymlinkChain } from "./symlink-chain.js";
@@ -157,7 +157,7 @@ async function runCommand(command, args, timeoutMs) {
             child = spawn(command, args, {
                 stdio: ["ignore", "pipe", "ignore"],
                 windowsHide: true,
-                env: scrubSecretEnv(process.env),
+                env: inheritedHostEnv("scrub"),
             });
         }
         catch {
@@ -315,12 +315,17 @@ export function openSpoolPair(base) {
 export class NodeExecutionEnv {
     cwd;
     get homeDir() {
-        return getShellEnv(this.inheritEnv, this.shellEnv, undefined, () => { }).HOME;
+        return this.childEnvForRead()?.HOME;
     }
     get cdPath() {
-        const value = getShellEnv(this.inheritEnv, this.shellEnv, undefined, () => { }).CDPATH;
+        const value = this.childEnvForRead()?.CDPATH;
         return value === undefined || value === "" ? [] : value.split(":");
     }
+    childEnvForRead() {
+        if (inheritEnvPolicyProblem(this.inheritEnv) !== undefined)
+            return undefined;
+        return getShellEnv(this.inheritEnv, this.shellEnv, undefined, () => { });
+    }
     shellPath;
     shellEnv;
     inheritEnv;

package/dist/engine/lsp/node-lsp-manager.d.ts

@@ -21,7 +21,8 @@ export interface NodeLspManagerOptions {
     /** Injectable spawn (tests supply a fake server; default = {@link defaultLspSpawn} over `child_process.spawn`). */
     spawn?: LspSpawn;
     /** The language server's environment for the default spawn, verbatim. Omitted ⇒ the host environment scrubbed of
-     *  credential-shaped names (`scrubSecretEnv`, a tool child's scrub). Unread when {@link spawn} is supplied. */
+     *  credential-shaped names and of the declared own credentials (`inheritedHostEnv("scrub")`, a tool child's
+     *  reading; `declareWithheldEnv`). Unread when {@link spawn} is supplied. */
     env?: Record<string, string>;
     /** #1081 — the withheld-keys notice sink, SAME shared once-per-process latch/code as the shell-exec
      *  site's `NodeExecutionEnv.onNotice`. Absent ⇒ console only. Unread when {@link spawn} is supplied. */

package/dist/engine/lsp/node-lsp-manager.js

@@ -9,7 +9,7 @@ import { TransportLspSession } from "../../core/lsp-session.js";
 import { StdioLspTransport } from "./stdio-lsp-transport.js";
 import { MAX_LSP_FILE_BYTES, SharedAbortScope, settleOnAbort } from "../../core/lsp.js";
 import { asThrownError, thrownText } from "../../core/thrown-value.js";
-import { announceSecretEnvScrub, scrubSecretEnv } from "../../core/secret-env.js";
+import { announceSecretEnvScrub, inheritedHostEnv } from "../../core/secret-env.js";
 export const DEFAULT_LSP_SERVERS = {
     typescript: "typescript-language-server --stdio",
     javascript: "typescript-language-server --stdio",
@@ -336,7 +336,7 @@ const lspSpawnWithEnv = (env, onNotice) => (command, args, cwd, signal) => new P
         let scrubbedEnv = env;
         if (scrubbedEnv == null) {
             const findings = [];
-            scrubbedEnv = scrubSecretEnv(process.env, findings);
+            scrubbedEnv = inheritedHostEnv("scrub", findings);
             announceSecretEnvScrub(onNotice, findings);
         }
         child = spawn(command, args, { ...lspSpawnOptions(cwd), env: scrubbedEnv });

package/dist/index.d.ts

@@ -11,6 +11,7 @@ export type { RunInternals, ResolvedWorkspace } from "./core/runner/prepare-task
 export type { RunnerSelfSeat } from "./core/runner/contracts.js";
 export type { BudgetAxis } from "./core/runner/assemble-result.js";
 export { terminalProjection } from "./core/runner/terminal-projection.js";
+export { toolOutputBlockChars } from "./core/runner/tool-output-projection.js";
 export { SESSION_LOG_DIGEST_SCHEME, sessionEntryDigest, sessionLogDigest, sessionLogDigestsComparable, } from "./engine/session/log-digest.js";
 export type { ResumeTaskConfig } from "./core/runner/runtask.js";
 export { defineTool } from "./core/tools.js";
@@ -98,6 +99,8 @@ export { getShellConfig, isWslBashLauncher } from "./engine/execution-env/node-e
 export { walkSymlinkChain, SYMLINK_CHAIN_MAX_HOPS, type SymlinkHopReader } from "./engine/execution-env/symlink-chain.js";
 export { isSecretEnvKey, scrubSecretEnv } from "./core/secret-env.js";
 export type { SecretEnvFinding, SecretEnvFindingKind } from "./core/secret-env.js";
+export { declareWithheldEnv, inheritedHostEnv, inheritEnvPolicyProblem, type InheritEnvPolicy } from "./core/secret-env.js";
+export { ENGINE_CAPABILITIES, type EngineCapability } from "./core/engine-capabilities.js";
 export { MAX_EXEC_OUTPUT_BYTES, RollingTailBuffer, markTruncated } from "./core/exec-output-tail.js";
 export { physicalPathOf, physicalPathOfExisting } from "./core/physical-path.js";
 export type { ExecutionEnv, FileInfo, Result, FileErrorCode, ExecutionErrorCode, WriteExpectation, WriteReceipt, SymlinkChain, BoundFileObject } from "./internal/harness.js";
@@ -338,6 +341,8 @@ export { untrustedEgressForHuman, redactHostLeaks, redactSecrets, boundedRedacte
 export type { Egress, EgressTier } from "./core/untrusted-egress.js";
 export type { RedactionFinding, RedactionReport, RedactionConfidence, RedactionSource, SummarizableFinding, } from "./core/untrusted-egress.js";
 export { summarizeRedactions } from "./core/untrusted-egress.js";
+export { headerOwnershipCollision } from "./core/protocol-http-auth.js";
+export type { ProtocolHttpAuth } from "./core/protocol-http-auth.js";
 export { MemoryRosterStore, FileRosterStore, type RosterStore, type RosterEntry, type RosterAccess, type RosterGcOptions } from "./agents/roster-store.js";
 export { CONFIG_CATALOG_VERSION, describeConfigCatalog, resolveEffectiveConfig, type ConfigKnob, type ConfigOverrideDeclaration, type ConfigProvenance, type EffectiveConfigField, } from "./config/catalog.js";
 export { normalizeAgentName } from "./core/task-registry.js";

package/dist/index.js

@@ -1,6 +1,7 @@
 export { Runner, runTask } from "./core/runner/runtask.js";
 export { resolveTaskLimits } from "./core/runner/prepare-task.js";
 export { terminalProjection } from "./core/runner/terminal-projection.js";
+export { toolOutputBlockChars } from "./core/runner/tool-output-projection.js";
 export { SESSION_LOG_DIGEST_SCHEME, sessionEntryDigest, sessionLogDigest, sessionLogDigestsComparable, } from "./engine/session/log-digest.js";
 export { defineTool } from "./core/tools.js";
 export { SKILL_TOOL_NAME } from "./core/runner/synthetic-tools.js";
@@ -82,6 +83,8 @@ export { killProcessTree, signalProcessTree } from "./engine/execution-env/kill-
 export { getShellConfig, isWslBashLauncher } from "./engine/execution-env/node-execution-env.js";
 export { walkSymlinkChain, SYMLINK_CHAIN_MAX_HOPS } from "./engine/execution-env/symlink-chain.js";
 export { isSecretEnvKey, scrubSecretEnv } from "./core/secret-env.js";
+export { declareWithheldEnv, inheritedHostEnv, inheritEnvPolicyProblem } from "./core/secret-env.js";
+export { ENGINE_CAPABILITIES } from "./core/engine-capabilities.js";
 export { MAX_EXEC_OUTPUT_BYTES, RollingTailBuffer, markTruncated } from "./core/exec-output-tail.js";
 export { physicalPathOf, physicalPathOfExisting } from "./core/physical-path.js";
 export { RemoteExecutionError, hasDestroy, isRemoteExecutionEnv, isSuspendable, isIsolated, canonicalPathIsAuthoritative, missingRestoreSurface, isRetryableRemoteErrorCode, RETRYABLE_REMOTE_ERROR_CODES, } from "./core/remote-env.js";
@@ -276,6 +279,7 @@ export { A2A_TASK_STATES, toA2ATaskState, fromA2ATaskState, } from "./core/a2a-t
 export { InMemoryWorkflowJournalStore, callKeyOrdinal, JOURNAL_OVERSIZE_ERROR_CODE, WorkflowJournalOversizeError, assertJournalEntryFits, } from "./core/workflow-journal-store.js";
 export { untrustedEgressForHuman, redactHostLeaks, redactSecrets, boundedRedactedSummary } from "./core/untrusted-egress.js";
 export { summarizeRedactions } from "./core/untrusted-egress.js";
+export { headerOwnershipCollision } from "./core/protocol-http-auth.js";
 export { MemoryRosterStore, FileRosterStore } from "./agents/roster-store.js";
 export { CONFIG_CATALOG_VERSION, describeConfigCatalog, resolveEffectiveConfig, } from "./config/catalog.js";
 export { normalizeAgentName } from "./core/task-registry.js";

package/dist/stores/file/fs-atomic.js

@@ -5,7 +5,7 @@ import { hrtime } from "node:process";
 import { basename, dirname, join, resolve as resolvePath } from "node:path";
 import { createHash, randomBytes } from "node:crypto";
 import { execFileSync } from "node:child_process";
-import { scrubSecretEnv } from "../../core/secret-env.js";
+import { inheritedHostEnv } from "../../core/secret-env.js";
 import { physicalPathOf, physicalPathOfExisting } from "../../core/physical-path.js";
 import { thrownText } from "../../core/thrown-value.js";
 const SAFE_COMPONENT = /^[A-Za-z0-9_.-]+$/;
@@ -713,7 +713,7 @@ function probeStartTimesOnce(pid) {
             encoding: "utf8",
             timeout: START_TIME_PROBE_TIMEOUT_MS,
             stdio: ["ignore", "pipe", "ignore"],
-            env: { ...scrubSecretEnv(process.env), LC_ALL: "C", LANG: "C" },
+            env: { ...inheritedHostEnv("scrub"), LC_ALL: "C", LANG: "C" },
         });
     }
     catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.51.0",
+  "version": "7.51.1",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/test/export-surface.snapshot.json

@@ -1,7 +1,7 @@
 {
   "_comment": "design/87 L3 — frozen public export surface of src/index.ts (name -> kind). DO NOT edit by hand to silence a red test. A removed/changed entry = a BREAKING change: name every removed entry in the CHANGELOG's BREAKING lines (what was removed / who is hurt / what to read instead) and update this fixture in the SAME commit. Regenerate via REGEN in test/export-surface.test.ts.",
   "_tierComment": "#435 v1 — machine-readable layering of the public surface: stable = demonstrated by README.md / src/examples; internal = an `Internal`-marked name or a runner/engine deep-subtree declaration (the model seam src/engine/llm is excluded — it is the BYOM contract, not an engine internal); advanced = a supported export the front door does not walk you through. THIS IS AN INITIAL HEURISTIC, derived mechanically and expected to be refined ticket by ticket: no human reviewed these 1700+ entries one by one, and nothing here claims otherwise. Known bias: a short or English-word export name (ok, err, Result, Usage) can match ordinary prose in README.md and land `stable` on a coincidence. Every export MUST carry a tier — a new export with no row fails the gate in export-surface.test.ts.",
-  "count": 2670,
+  "count": 2679,
   "exports": {
     "A2ATaskState": "type",
     "A2ATaskStateReversal": "type",
@@ -453,6 +453,7 @@
     "EMPTY_USAGE_WINDOW_RECORD": "variable",
     "ENGINE_AUTHORITY_ENVELOPE_TAGS": "variable",
     "ENGINE_BUILTIN_TOOL_NAMES": "variable",
+    "ENGINE_CAPABILITIES": "variable",
     "ENGINE_NOTICE_CODES": "variable",
     "ENTER_PLAN_MODE_TOOL_NAME": "variable",
     "ENV_LIFETIME_SUSPEND_MARGIN_MS": "variable",
@@ -475,6 +476,7 @@
     "EgressTier": "type",
     "Embedder": "interface",
     "EngineAttestation": "interface",
+    "EngineCapability": "type",
     "EngineNotice": "interface",
     "EngineNoticeCode": "type",
     "EntryCustodyReport": "interface",
@@ -637,6 +639,7 @@
     "InMemoryWorkflowJournalStore": "class",
     "InMemoryWorkflowRunStore": "class",
     "InboundEntryFinding": "interface",
+    "InheritEnvPolicy": "type",
     "Invariant": "interface",
     "InvariantKind": "type",
     "InvariantViolation": "interface",
@@ -1147,6 +1150,7 @@
     "PromptSourceStateStore": "interface",
     "PromptTextDeclaration": "interface",
     "PromptTrust": "type",
+    "ProtocolHttpAuth": "interface",
     "ProtocolId": "type",
     "ProtocolNamespace": "interface",
     "ProviderCondition": "type",
@@ -2049,6 +2053,7 @@
     "debitLedger": "function",
     "decideAutoPromote": "function",
     "decisionText": "function",
+    "declareWithheldEnv": "function",
     "declaredOffSpelling": "function",
     "declaredPathTargetOf": "function",
     "decodeCcPeerFrame": "function",
@@ -2181,7 +2186,10 @@
     "hasScheduler": "function",
     "hasSessionFork": "function",
     "hasToolContract": "function",
+    "headerOwnershipCollision": "function",
     "htmlToText": "function",
+    "inheritEnvPolicyProblem": "function",
+    "inheritedHostEnv": "function",
     "injectionLaneOf": "function",
     "inlineUntrusted": "function",
     "inputKeysOf": "function",
@@ -2629,6 +2637,7 @@
     "toolCallFaceOf": "function",
     "toolFaceProblem": "function",
     "toolIdentityOf": "function",
+    "toolOutputBlockChars": "variable",
     "toolPolicyNameSets": "function",
     "toolPolicyPathRules": "function",
     "toolResultContentSegment": "function",
@@ -3125,6 +3134,7 @@
     "EMPTY_USAGE_WINDOW_RECORD": "advanced",
     "ENGINE_AUTHORITY_ENVELOPE_TAGS": "advanced",
     "ENGINE_BUILTIN_TOOL_NAMES": "advanced",
+    "ENGINE_CAPABILITIES": "advanced",
     "ENGINE_NOTICE_CODES": "advanced",
     "ENTER_PLAN_MODE_TOOL_NAME": "advanced",
     "ENV_LIFETIME_SUSPEND_MARGIN_MS": "internal",
@@ -3147,6 +3157,7 @@
     "EgressTier": "advanced",
     "Embedder": "advanced",
     "EngineAttestation": "advanced",
+    "EngineCapability": "advanced",
     "EngineNotice": "advanced",
     "EngineNoticeCode": "advanced",
     "EntryCustodyReport": "advanced",
@@ -3309,6 +3320,7 @@
     "InMemoryWorkflowJournalStore": "advanced",
     "InMemoryWorkflowRunStore": "advanced",
     "InboundEntryFinding": "advanced",
+    "InheritEnvPolicy": "advanced",
     "Invariant": "advanced",
     "InvariantKind": "advanced",
     "InvariantViolation": "advanced",
@@ -3819,6 +3831,7 @@
     "PromptSourceStateStore": "advanced",
     "PromptTextDeclaration": "advanced",
     "PromptTrust": "advanced",
+    "ProtocolHttpAuth": "advanced",
     "ProtocolId": "advanced",
     "ProtocolNamespace": "advanced",
     "ProviderCondition": "advanced",
@@ -4721,6 +4734,7 @@
     "debitLedger": "advanced",
     "decideAutoPromote": "advanced",
     "decisionText": "advanced",
+    "declareWithheldEnv": "advanced",
     "declaredOffSpelling": "advanced",
     "declaredPathTargetOf": "advanced",
     "decodeCcPeerFrame": "advanced",
@@ -4853,7 +4867,10 @@
     "hasScheduler": "advanced",
     "hasSessionFork": "advanced",
     "hasToolContract": "advanced",
+    "headerOwnershipCollision": "advanced",
     "htmlToText": "advanced",
+    "inheritEnvPolicyProblem": "advanced",
+    "inheritedHostEnv": "advanced",
     "injectionLaneOf": "advanced",
     "inlineUntrusted": "advanced",
     "inputKeysOf": "advanced",
@@ -5301,6 +5318,7 @@
     "toolCallFaceOf": "advanced",
     "toolFaceProblem": "internal",
     "toolIdentityOf": "advanced",
+    "toolOutputBlockChars": "internal",
     "toolPolicyNameSets": "advanced",
     "toolPolicyPathRules": "advanced",
     "toolResultContentSegment": "advanced",

package/wire-changes/core@7.51.1.json

@@ -0,0 +1,259 @@
+{
+  "repo": "core",
+  "version": "7.51.1",
+  "from": "d990eb2fd73215c09bf254545bdab6f1080c0c98",
+  "to": "v7.51.1",
+  "added": [
+    {
+      "name": "ENGINE_CAPABILITIES",
+      "kind": "variable",
+      "tier": "advanced",
+      "at": [
+        "src/core/engine-capabilities.ts:13",
+        "src/index.ts:516"
+      ],
+      "criteriaCovered": false,
+      "breaking": false
+    },
+    {
+      "name": "EngineCapability",
+      "kind": "type",
+      "tier": "advanced",
+      "at": [
+        "src/core/engine-capabilities.ts:16",
+        "src/index.ts:516"
+      ],
+      "criteriaCovered": false,
+      "breaking": false
+    },
+    {
+      "name": "InheritEnvPolicy",
+      "kind": "type",
+      "tier": "advanced",
+      "at": [
+        "src/core/secret-env.ts:220",
+        "src/index.ts:515"
+      ],
+      "criteriaCovered": false,
+      "breaking": false
+    },
+    {
+      "name": "ProtocolHttpAuth",
+      "kind": "interface",
+      "tier": "advanced",
+      "at": [
+        "src/core/protocol-http-auth.ts:18",
+        "src/index.ts:2985"
+      ],
+      "criteriaCovered": false,
+      "breaking": false
+    },
+    {
+      "name": "declareWithheldEnv",
+      "kind": "function",
+      "tier": "advanced",
+      "at": [
+        "src/core/secret-env.ts:273",
+        "src/index.ts:515"
+      ],
+      "criteriaCovered": false,
+      "breaking": false
+    },
+    {
+      "name": "headerOwnershipCollision",
+      "kind": "function",
+      "tier": "advanced",
+      "at": [
+        "src/core/protocol-http-auth.ts:24",
+        "src/index.ts:2984"
+      ],
+      "criteriaCovered": false,
+      "breaking": false
+    },
+    {
+      "name": "inheritEnvPolicyProblem",
+      "kind": "function",
+      "tier": "advanced",
+      "at": [
+        "src/core/secret-env.ts:336",
+        "src/index.ts:515"
+      ],
+      "criteriaCovered": false,
+      "breaking": false
+    },
+    {
+      "name": "inheritedHostEnv",
+      "kind": "function",
+      "tier": "advanced",
+      "at": [
+        "src/core/secret-env.ts:321",
+        "src/index.ts:515"
+      ],
+      "criteriaCovered": false,
+      "breaking": false
+    },
+    {
+      "name": "toolOutputBlockChars",
+      "kind": "variable",
+      "tier": "internal",
+      "at": [
+        "src/core/runner/tool-output-projection.ts:28",
+        "src/index.ts:34"
+      ],
+      "criteriaCovered": false,
+      "breaking": false
+    }
+  ],
+  "removed": [],
+  "changed": [],
+  "narrowed": [],
+  "closedSetMembers": [
+    {
+      "set": "ENGINE_CAPABILITIES",
+      "at": [
+        "src/core/engine-capabilities.ts:13"
+      ],
+      "newSet": true,
+      "added": [
+        "inherit_env.own_credentials_withheld"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": false
+    },
+    {
+      "set": "EngineCapability",
+      "at": [
+        "src/core/engine-capabilities.ts:16",
+        "src/index.ts:516"
+      ],
+      "newSet": true,
+      "added": [
+        "inherit_env.own_credentials_withheld"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": false
+    },
+    {
+      "set": "SecretEnvFindingKind",
+      "at": [
+        "src/core/secret-env.ts:149"
+      ],
+      "newSet": false,
+      "added": [
+        "own-credential"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": false
+    }
+  ],
+  "closedSetsUnreadable": [],
+  "typeKeys": [],
+  "typeKeysUnreadableArms": [],
+  "typeKeysFlattenedCount": 234,
+  "signatures": [],
+  "declarationMoves": [
+    {
+      "name": "InheritEnvPolicy",
+      "kind": "type",
+      "onSurface": true,
+      "from": [
+        "src/core/secret-env.ts"
+      ],
+      "to": [
+        "src/core/secret-env.ts",
+        "src/index.ts"
+      ]
+    },
+    {
+      "name": "ProtocolHttpAuth",
+      "kind": "interface",
+      "onSurface": true,
+      "from": [
+        "src/core/protocol-http-auth.ts"
+      ],
+      "to": [
+        "src/core/protocol-http-auth.ts",
+        "src/index.ts"
+      ]
+    },
+    {
+      "name": "headerOwnershipCollision",
+      "kind": "function",
+      "onSurface": true,
+      "from": [
+        "src/core/protocol-http-auth.ts"
+      ],
+      "to": [
+        "src/core/protocol-http-auth.ts",
+        "src/index.ts"
+      ]
+    },
+    {
+      "name": "inheritEnvPolicyProblem",
+      "kind": "function",
+      "onSurface": true,
+      "from": [
+        "src/core/secret-env.ts"
+      ],
+      "to": [
+        "src/core/secret-env.ts",
+        "src/index.ts"
+      ]
+    },
+    {
+      "name": "inheritedHostEnv",
+      "kind": "function",
+      "onSurface": true,
+      "from": [
+        "src/core/secret-env.ts"
+      ],
+      "to": [
+        "src/core/secret-env.ts",
+        "src/index.ts"
+      ]
+    }
+  ],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "engineNoticeCode",
+      "name": "config.secret_env_scrubbed",
+      "assertions": [
+        "G1.b"
+      ]
+    },
+    {
+      "kind": "taskEventField",
+      "name": "tool_end.totalChars",
+      "assertions": [
+        "G2.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "SecretEnvFinding.kind",
+      "assertions": [
+        "G1.a",
+        "G1.c"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [
+      "InheritEnvPolicy",
+      "SecretEnvFindingKind"
+    ],
+    "server": [
+      "InheritEnvPolicy",
+      "SecretEnvFindingKind"
+    ],
+    "sdk": [],
+    "note": "scanned cli@80e061c0 server@3c0e175c sdk@304339d — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 0,
+  "breakingItems": [],
+  "toResolvedAt": "cedf0606eb8b5b488d394a01b5f0a632019d1692"
+}