pi-roundtable-coding 0.32.1 → 0.33.0

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 ## [Unreleased]
 
+## [0.33.0] - 2026-11-04
+
+### Changed
+
+- The worker process no longer inherits the host's environment: it gets the shell's whitelist (`SHELL_ENV_NAMES`), `PI_CODING_AGENT_DIR`, `TMPDIR`, the variables its model may read, found by the new `modelEnvNames(agentDir)` (each `$VAR` a `models.json` in Pi's agent dir names, and `CLAUDE_*` and `ANTHROPIC_*`), and the names the new option `workerEnv: { pass? }` lists (type `WorkerEnv`). Its `bash` gets only the whitelist and the host's `shellEnv`, never the model's credentials, and its tool results are masked like the host's. **Migration:** a worker on Pi's `auth.json` login, a `models.json` `$VAR` key, or a Claude Code or Anthropic variable needs nothing; a model that reads another variable needs it named, as in `workerEnv: { pass: ["OPENAI_API_KEY"] }`.
+- The shelf's git and gh calls (clone, fetch, push, `repo_list` fetch) get the whitelist, git's config, identity and ssh variables, and a GitHub token as `GH_TOKEN` from the new option `githubToken` (a string or a function; type `GithubToken`), by default the host's `GH_TOKEN` read when the plugin sets up, so existing hosts keep working. No other host secret reaches them.
+
 ## [0.32.1] - 2026-11-04
 
 - Release in lockstep with pi-roundtable 0.32.1 (optimistic mark-as-read, a Home button at the foot of the room drawer, Discord's -# subtext and line breaks in messages, the shared prompt's description in zh-TW, and the push device list centred); no package-specific behavior changes.

package/README.md

@@ -7,18 +7,19 @@ This package is a reference for the plugin guide's [Helpers for a Pi session of
 ## Requirements
 
 - Bun 1.4.4 or newer on a POSIX host (Linux or macOS).
-- pi-roundtable `>=0.32.0 <0.33.0` as a peer dependency; this package uses only its public main, kit and testing entries.
+- pi-roundtable `>=0.33.0 <0.34.0` as a peer dependency; this package uses only its public main, kit and testing entries.
 - Pi `>=1.0.0 <2`, shared with the host's core dependencies.
   A core-only host still pinned to Pi 0.99.x must update its Pi dependencies before adding coding, so cross-package extension and session types resolve to one Pi version.
 - Git, plus GitHub CLI (`gh`) for the default clone implementation.
 - A Git host token with read access to repositories being cloned and write access to those being pushed, or a host login holding that token.
-- Pi model credentials available through the host's Pi login or the provider's environment variables.
+- Pi model credentials available through the host's Pi login, a `models.json` `$VAR`, a `CLAUDE_*` or `ANTHROPIC_*` variable, or another variable named in `workerEnv.pass`.
 
-The default clone uses `gh repo clone owner/repo` and inherits `GH_TOKEN` or the host's `gh auth login` credentials.
-Configure Git's credential helper for later `git fetch` and `git push` (for GitHub, `gh auth setup-git`).
-Use a least-privilege token and restrict its repositories; tokens are never package options, tool arguments or remote URLs.
+The default clone uses `gh repo clone owner/repo`, which authenticates with `githubToken` given to it as `GH_TOKEN` (by default the host's `GH_TOKEN`, read when the plugin sets up) or with the host's `gh auth login` credentials.
+Configure Git's credential helper for later `git fetch` and `git push` (for GitHub, `gh auth setup-git`); those git calls get the same `GH_TOKEN`.
+The shelf's git and gh calls get the shell's environment whitelist (`SHELL_ENV_NAMES`), git's own config, identity and ssh variables, and that token, and no other host secret.
+Use a least-privilege token and restrict its repositories; tokens are never tool arguments or remote URLs, and prefer a `githubToken` function that reads it from where you keep it to a literal string.
 The package does not print subprocess output or Git authentication diagnostics and never logs credentials.
-The coding worker inherits the host environment and can read files accessible to that host user: do not give it credentials you would not give a trusted coding agent.
+The coding worker process gets the shell's whitelist, `PI_CODING_AGENT_DIR`, the variables its model may read (`modelEnvNames`: each `$VAR` its agent dir's `models.json` names, `CLAUDE_*` and `ANTHROPIC_*`) and the names in `workerEnv.pass`; its `bash` gets only the whitelist and the host's `shellEnv`, never the model's credentials. It can still read files accessible to that host user: do not give it credentials you would not give a trusted coding agent.
 A custom `clone(repo, destination)` can use another Git host's CLI, credential helper or SSH login, and must create a Git clone with an `origin` remote.
 No network calls are needed by the offline test suite.
 
@@ -218,6 +219,8 @@ The `CODING` service exposes `shelf: RepoShelf` and `desk: CodingDesk` for trust
 | `skipUnavailableCarriedSkills` | `false` | Skip and disclose unavailable implicit skills; explicit skill requests still refuse them. |
 | `workerPackages` | `[]` | Absolute installed extension paths. |
 | `agentDir` | Pi host directory | Pi credentials and model configuration. |
+| `workerEnv` | `{}` | `{ pass? }`: more host variables the worker process gets for its model, beyond its `models.json` `$VAR`s, `CLAUDE_*` and `ANTHROPIC_*`; the worker's shell never gets them. |
+| `githubToken` | host `GH_TOKEN`, read at setup | A string, or a function read at each call, given as `GH_TOKEN` to the shelf's git and gh calls only (clone, fetch, push); a function returning undefined leaves gh to its own login. |
 | `timeoutMs` | `3600000` | Work-time limit in ms, excluding owner wait; 0 < value <= 2147483647. |
 | `maxWorkers` | `4` | Workers running at once on the host; a whole number of at least 1. |
 | `maxQueued` | `16` | Tasks waiting for a worker slot; a whole number of at least 0. |

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-roundtable-coding",
-	"version": "0.32.1",
+	"version": "0.33.0",
 	"description": "Repository shelves and owner-approved Pi coding workers for pi-roundtable",
 	"type": "module",
 	"license": "MIT",
@@ -38,13 +38,13 @@
 		"typebox": "1.3.37"
 	},
 	"peerDependencies": {
-		"pi-roundtable": ">=0.32.0 <0.33.0"
+		"pi-roundtable": ">=0.33.0 <0.34.0"
 	},
 	"devDependencies": {
 		"@earendil-works/pi-ai": ">=1.0.0 <2",
 		"@biomejs/biome": "2.5.15",
 		"@types/bun": "1.4.3",
-		"pi-roundtable": "0.32.1",
+		"pi-roundtable": "0.33.0",
 		"typescript": "7.0.2"
 	}
 }

package/src/coding-plugin.ts

@@ -34,10 +34,11 @@ import {
 	codingReport,
 	MAX_CODING_TASK_CHARS,
 } from "./coding-desk.ts";
-import { PiCodingWorker } from "./pi-coding-worker.ts";
+import { PiCodingWorker, type WorkerEnv } from "./pi-coding-worker.ts";
 import {
 	type ChangeReport,
 	type CloneCommand,
+	type GithubToken,
 	RepoShelf,
 	type RepoSummary,
 	reportPost,
@@ -129,6 +130,18 @@ export interface CodingOptions {
 	/** Absolute installed extension package paths. Default: none. */
 	workerPackages?: string[];
 	agentDir?: string;
+	/**
+	 * More host variables the worker process gets for its model, by name; its shell never gets them.
+	 * Without it the worker already gets the shell's whitelist, `PI_CODING_AGENT_DIR`, the `$VAR`s
+	 * its agent dir's `models.json` names, and `CLAUDE_*` and `ANTHROPIC_*`.
+	 */
+	workerEnv?: WorkerEnv;
+	/**
+	 * The token git and gh calls of the shelf (clone, fetch, push) get as GH_TOKEN, or a function
+	 * read at each call; no other host secret reaches them. Default: the host's GH_TOKEN, read when
+	 * the plugin sets up.
+	 */
+	githubToken?: GithubToken;
 	timeoutMs?: number;
 	/** Workers running at once on the host; default 4. More tasks wait in a queue. */
 	maxWorkers?: number;
@@ -230,6 +243,9 @@ export function coding(options: CodingOptions) {
 		setup(context) {
 			const shelf = new RepoShelf(options.shelfDir, options.clone, {
 				diagnosticChars: options.diagnosticChars,
+				...(options.githubToken !== undefined
+					? { githubToken: options.githubToken }
+					: {}),
 			});
 			for (const adoption of options.adoptClones ?? [])
 				shelf.adopt(adoption.from, adoption.repo);
@@ -243,6 +259,8 @@ export function coding(options: CodingOptions) {
 					...(context.env.scratchDir
 						? { scratchDir: context.env.scratchDir }
 						: {}),
+					...(options.workerEnv ? { workerEnv: options.workerEnv } : {}),
+					...(context.env.shellEnv ? { shellEnv: context.env.shellEnv } : {}),
 					prompt: options.workerPrompt,
 					blockText: options.workerBlockText,
 					diagnosticChars: options.diagnosticChars,

package/src/index.ts

@@ -23,11 +23,12 @@ export type {
 	RepoToolName,
 } from "./coding-plugin.ts";
 export { CODING, coding } from "./coding-plugin.ts";
-export type { PiCodingWorkerOptions } from "./pi-coding-worker.ts";
-export { PiCodingWorker } from "./pi-coding-worker.ts";
+export type { PiCodingWorkerOptions, WorkerEnv } from "./pi-coding-worker.ts";
+export { modelEnvNames, PiCodingWorker } from "./pi-coding-worker.ts";
 export type {
 	ChangeReport,
 	CloneCommand,
+	GithubToken,
 	Integration,
 	RepoState,
 	RepoSummary,

package/src/pi-coding-worker.ts

@@ -1,9 +1,12 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { getAgentDir } from "@earendil-works/pi-coding-agent";
-import type { HeldCall, HoldCheck } from "pi-roundtable";
+import type { HeldCall, HoldCheck, ShellEnv } from "pi-roundtable";
 import {
 	AgentError,
 	canonicalJson,
+	childEnv,
 	holdChain,
 	shellHoldRule,
 } from "pi-roundtable/kit";
@@ -38,6 +41,57 @@ export interface PiCodingWorkerOptions {
 	blockText?: (answer: "declined" | "held", action: string) => string;
 	/** Longest worker error text kept for the report, in characters; default 600. */
 	diagnosticChars?: number;
+	/**
+	 * Host variables the worker process gets besides `SHELL_ENV_NAMES`, `PI_CODING_AGENT_DIR` and
+	 * `modelEnvNames` (its `models.json` `$VAR`s, `CLAUDE_*`, `ANTHROPIC_*`), for a model reading
+	 * another name. Its shell never gets them.
+	 */
+	workerEnv?: WorkerEnv;
+	/** What the worker's shell gets besides `SHELL_ENV_NAMES`, as the agents' shell; default the host's `env.shellEnv`. */
+	shellEnv?: ShellEnv;
+}
+
+/** Host variables a coding worker's process gets for its model and Pi runtime, by name. */
+export interface WorkerEnv {
+	pass?: readonly string[];
+}
+
+/**
+ * The host variables a worker's model may read, found without the host listing them: the names a
+ * `models.json` in Pi's agent dir writes as `$NAME` (an API key a custom provider resolves), and
+ * the Claude Code and Anthropic families (`CLAUDE_*`, `ANTHROPIC_*`) that Anthropic providers and
+ * Claude Code bridges read. A missing or unreadable `models.json` adds nothing.
+ */
+export function modelEnvNames(agentDir: string): string[] {
+	const names = ["CLAUDE_*", "ANTHROPIC_*"];
+	try {
+		const text = readFileSync(join(agentDir, "models.json"), "utf8");
+		for (const match of text.matchAll(/"\$([A-Za-z_][A-Za-z0-9_]*)"/g))
+			if (match[1] && !names.includes(match[1])) names.push(match[1]);
+	} catch {
+		// No models.json: the providers' own variables above are all.
+	}
+	return names;
+}
+
+/**
+ * The worker process's environment: the shell's whitelist, Pi's agent dir, the variables its model
+ * may read (`modelEnvNames`), `workerEnv.pass`, and TMPDIR. Its bash cuts this again to the shell's.
+ */
+export function workerProcessEnv(
+	source: Readonly<Record<string, string | undefined>>,
+	workerEnv: WorkerEnv = {},
+	scratchDir?: string,
+	agentDir: string = getAgentDir(),
+): Record<string, string> {
+	return childEnv(source, {
+		pass: [
+			"PI_CODING_AGENT_DIR",
+			...modelEnvNames(agentDir),
+			...(workerEnv.pass ?? []),
+		],
+		...(scratchDir ? { set: { TMPDIR: scratchDir } } : {}),
+	});
 }
 interface WorkerMessage {
 	type: string;
@@ -107,9 +161,12 @@ export class PiCodingWorker implements CodingWorker {
 			],
 			{
 				cwd: job.dir,
-				...(this.#options.scratchDir
-					? { env: { ...process.env, TMPDIR: this.#options.scratchDir } }
-					: {}),
+				env: workerProcessEnv(
+					process.env,
+					this.#options.workerEnv,
+					this.#options.scratchDir,
+					this.#options.agentDir ?? getAgentDir(),
+				),
 				stdin: "ignore",
 				stdout: "ignore",
 				stderr: "ignore",
@@ -128,6 +185,9 @@ export class PiCodingWorker implements CodingWorker {
 							...(this.#options.scratchDir
 								? { scratchDir: this.#options.scratchDir }
 								: {}),
+							...(this.#options.shellEnv
+								? { shellEnv: this.#options.shellEnv }
+								: {}),
 						});
 					} else if (
 						value.type === "report" &&

package/src/repo-shelf.ts

@@ -13,7 +13,12 @@ import {
 	rmSync,
 } from "node:fs";
 import { dirname, isAbsolute, join, relative, resolve } from "node:path";
-import { AgentError, checkRepoName, scrubDiagnostic } from "pi-roundtable/kit";
+import {
+	AgentError,
+	checkRepoName,
+	childEnv,
+	scrubDiagnostic,
+} from "pi-roundtable/kit";
 
 /** What a clone would push to its default branch (repos-and-skills spec behavior 10). */
 export interface ChangeReport {
@@ -53,6 +58,12 @@ export interface RepoState {
 	uncommitted: string[];
 }
 
+/**
+ * The GitHub token git and gh calls get as GH_TOKEN, or a function read at each call; undefined
+ * leaves them to gh's own login.
+ */
+export type GithubToken = string | undefined | (() => string | undefined);
+
 export type CloneCommand = (repo: string, dir: string) => Promise<void>;
 
 /** A coding worker's own checkout: a linked worktree on its own branch, cut from the clone's HEAD. */
@@ -89,9 +100,39 @@ const GIT_TIMEOUT_MS = 60_000;
 const MAX_STAT_FILES = 40;
 const MAX_SUMMARY_CHARS = 120;
 
+/**
+ * Host variables git and gh need besides the shell's: their config files and homes, the identity a
+ * rebase commits as, ssh agent and ssh command, and gh's host; never a token, which comes from
+ * `githubToken`.
+ */
+const GIT_ENV_NAMES = [
+	"XDG_CONFIG_HOME",
+	"GIT_CONFIG_GLOBAL",
+	"GIT_CONFIG_SYSTEM",
+	"GIT_CONFIG_NOSYSTEM",
+	"GIT_AUTHOR_NAME",
+	"GIT_AUTHOR_EMAIL",
+	"GIT_COMMITTER_NAME",
+	"GIT_COMMITTER_EMAIL",
+	"GH_CONFIG_DIR",
+	"GH_HOST",
+	"SSH_AUTH_SOCK",
+	"GIT_SSH",
+	"GIT_SSH_COMMAND",
+];
+
+/** The environment of a git or gh call: the shell's whitelist, git's own names, and the token as GH_TOKEN. */
+function gitEnv(token: string | undefined): Record<string, string> {
+	return childEnv(process.env, {
+		pass: GIT_ENV_NAMES,
+		...(token ? { set: { GH_TOKEN: token } } : {}),
+	});
+}
+
 async function run(
 	command: string[],
-	cwd?: string,
+	cwd: string | undefined,
+	env: Record<string, string>,
 ): Promise<{ out: string; err: string; code: number }> {
 	const safeCommand =
 		command[0] === "git"
@@ -106,6 +147,7 @@ async function run(
 			: command;
 	const child = Bun.spawn(safeCommand, {
 		...(cwd ? { cwd } : {}),
+		env,
 		stdout: "pipe",
 		stderr: "pipe",
 		timeout: GIT_TIMEOUT_MS,
@@ -118,22 +160,21 @@ async function run(
 	return { out: out.trimEnd(), err: err.trim(), code };
 }
 
-/** Clones with gh, which authenticates with the host's GH_TOKEN; a failure's stderr is cut at `diagnosticChars`. */
+/**
+ * Clones with gh, which authenticates with `token` as GH_TOKEN (default the host's GH_TOKEN, read
+ * at each clone) or its own login; a failure's stderr is cut at `diagnosticChars`.
+ */
 const ghCloneWith =
-	(diagnosticChars?: number): CloneCommand =>
+	(diagnosticChars?: number, token?: () => string | undefined): CloneCommand =>
 	async (repo, dir) => {
 		checkRepoName(repo);
 		if (repo.startsWith("-"))
 			throw new AgentError("Repository owner cannot start with a dash.");
-		const { err, code } = await run([
-			"gh",
-			"repo",
-			"clone",
-			repo,
-			dir,
-			"--",
-			"--quiet",
-		]);
+		const { err, code } = await run(
+			["gh", "repo", "clone", repo, dir, "--", "--quiet"],
+			undefined,
+			gitEnv(token ? token() : process.env.GH_TOKEN),
+		);
 		if (code !== 0)
 			throw new AgentError(
 				`Cloning ${repo} failed: ${scrubDiagnostic(err, diagnosticChars) || `exit ${code}`}`,
@@ -211,14 +252,30 @@ export class RepoShelf {
 
 	readonly #diagnosticChars: number | undefined;
 
+	readonly #token: () => string | undefined;
+
 	constructor(
 		dir: string,
 		clone?: CloneCommand,
-		options: { diagnosticChars?: number | undefined } = {},
+		options: {
+			diagnosticChars?: number | undefined;
+			githubToken?: GithubToken | undefined;
+		} = {},
 	) {
 		this.dir = resolve(dir);
 		this.#diagnosticChars = options.diagnosticChars;
-		this.#clone = clone ?? ghCloneWith(options.diagnosticChars);
+		const { githubToken = process.env.GH_TOKEN } = options;
+		this.#token =
+			typeof githubToken === "function" ? githubToken : () => githubToken;
+		this.#clone = clone ?? ghCloneWith(options.diagnosticChars, this.#token);
+	}
+
+	/** A git or gh call with the shelf's token and no other host secret. */
+	#run(
+		command: string[],
+		cwd?: string,
+	): Promise<{ out: string; err: string; code: number }> {
+		return run(command, cwd, gitEnv(this.#token()));
 	}
 
 	/** Adopt an existing standalone clone at startup; an existing destination is never replaced. */
@@ -450,7 +507,7 @@ export class RepoShelf {
 			const taken =
 				existsSync(dir) ||
 				(
-					await run([
+					await this.#run([
 						"git",
 						"-C",
 						clone,
@@ -507,9 +564,16 @@ export class RepoShelf {
 				...kept,
 				reason: `the worker left uncommitted changes in its worktree:\n${treeDirty}`,
 			};
-		const rebase = await run(["git", "-C", treeDir, "rebase", "--quiet", head]);
+		const rebase = await this.#run([
+			"git",
+			"-C",
+			treeDir,
+			"rebase",
+			"--quiet",
+			head,
+		]);
 		if (rebase.code !== 0) {
-			const conflicted = await run([
+			const conflicted = await this.#run([
 				"git",
 				"-C",
 				treeDir,
@@ -517,14 +581,14 @@ export class RepoShelf {
 				"--name-only",
 				"--diff-filter=U",
 			]);
-			await run(["git", "-C", treeDir, "rebase", "--abort"]);
+			await this.#run(["git", "-C", treeDir, "rebase", "--abort"]);
 			return {
 				status: "conflict",
 				...kept,
 				files: conflicted.out ? conflicted.out.split("\n") : [],
 			};
 		}
-		const merge = await run([
+		const merge = await this.#run([
 			"git",
 			"-C",
 			clone,
@@ -581,11 +645,27 @@ export class RepoShelf {
 	async removeWorktree(tree: WorkerTree): Promise<void> {
 		const clone = this.dirOf(tree.repo);
 		this.#treeDir(tree, false);
-		await run(["git", "-C", clone, "worktree", "remove", "--force", tree.dir]);
+		await this.#run([
+			"git",
+			"-C",
+			clone,
+			"worktree",
+			"remove",
+			"--force",
+			tree.dir,
+		]);
 		if (existsSync(tree.dir))
 			rmSync(tree.dir, { recursive: true, force: true });
-		await run(["git", "-C", clone, "worktree", "prune"]);
-		await run(["git", "-C", clone, "branch", "-D", "--quiet", tree.branch]);
+		await this.#run(["git", "-C", clone, "worktree", "prune"]);
+		await this.#run([
+			"git",
+			"-C",
+			clone,
+			"branch",
+			"-D",
+			"--quiet",
+			tree.branch,
+		]);
 	}
 
 	/** A worktree path, refused unless it lies in this repository's worktree folder. */
@@ -614,7 +694,7 @@ export class RepoShelf {
 			if (fetch) await this.#git(dir, "fetch", "--quiet", "origin");
 			const branch = await this.#git(dir, "rev-parse", "--abbrev-ref", "HEAD");
 			const status = await this.#git(dir, "status", "--porcelain");
-			const last = await run([
+			const last = await this.#run([
 				"git",
 				"-C",
 				dir,
@@ -623,7 +703,7 @@ export class RepoShelf {
 				"--format=%h %s (%cs)",
 				"--abbrev=12",
 			]);
-			const counts = await run([
+			const counts = await this.#run([
 				"git",
 				"-C",
 				dir,
@@ -678,7 +758,7 @@ export class RepoShelf {
 	async #defaultBranch(dir: string): Promise<string> {
 		await this.#git(dir, "remote", "set-head", "origin", "--auto");
 		const read = () =>
-			run([
+			this.#run([
 				"git",
 				"-C",
 				dir,
@@ -693,7 +773,7 @@ export class RepoShelf {
 	}
 
 	async #git(dir: string, ...args: string[]): Promise<string> {
-		const { out, err, code } = await run(["git", "-C", dir, ...args]);
+		const { out, err, code } = await this.#run(["git", "-C", dir, ...args]);
 		if (code !== 0)
 			throw new AgentError(
 				`git ${args[0]} failed in ${dir}: ${scrubDiagnostic(err, this.#diagnosticChars) || `exit ${code}`}`,

package/src/worker-entry.ts

@@ -2,15 +2,20 @@ import { lstatSync, realpathSync } from "node:fs";
 import { isAbsolute, join, relative } from "node:path";
 import {
 	createAgentSession,
+	createBashToolDefinition,
 	DefaultResourceLoader,
 	ModelRuntime,
 	SessionManager,
 	SettingsManager,
+	type ToolDefinition,
 } from "@earendil-works/pi-coding-agent";
+import type { ShellEnv } from "pi-roundtable";
 import {
 	activeToolsExtension,
 	runWorkerTask,
 	SHELL_TOOLS,
+	secretMaskExtension,
+	shellChildEnv,
 	textOf,
 } from "pi-roundtable/kit";
 import type { CodingJob, HeldCallAnswer } from "./coding-desk.ts";
@@ -25,6 +30,29 @@ interface StartMessage {
 	progress?: boolean;
 	/** The host's scratch dir, the worker's TMPDIR, where writes and removals need no approval. */
 	scratchDir?: string;
+	/** What the worker's shell gets besides `SHELL_ENV_NAMES`. */
+	shellEnv?: ShellEnv;
+}
+
+/**
+ * Pi's bash with the worker's environment cut to the shell's whitelist and `shellEnv`: the model's
+ * credentials the worker process holds never reach a command.
+ */
+export function workerBash(
+	cwd: string,
+	scratchDir: string | undefined,
+	shellEnv: ShellEnv = {},
+): ToolDefinition {
+	// SAFETY: Pi's bash definition is a ToolDefinition typed by its own parameter schema, which the session takes as any custom tool.
+	return createBashToolDefinition(cwd, {
+		spawnHook: (context) => ({
+			...context,
+			env: {
+				...shellChildEnv(context.env, shellEnv),
+				...(scratchDir === undefined ? {} : { TMPDIR: scratchDir }),
+			},
+		}),
+	}) as unknown as ToolDefinition;
 }
 /** Said to every worker whose host has a scratch dir, after the host's own prompt or the default. */
 export function scratchDirPrompt(scratchDir: string): string {
@@ -54,6 +82,7 @@ async function run({
 	prompt,
 	progress,
 	scratchDir,
+	shellEnv,
 }: StartMessage): Promise<string> {
 	const modelRuntime = await ModelRuntime.create({
 		authPath: join(agentDir, "auth.json"),
@@ -86,6 +115,7 @@ async function run({
 				name: "coding-shell",
 				factory: activeToolsExtension(() => SHELL_TOOLS),
 			},
+			{ name: "secret-mask", factory: secretMaskExtension() },
 			{
 				name: "coding-approvals",
 				factory: (pi) => {
@@ -127,6 +157,7 @@ async function run({
 		modelRuntime,
 		thinkingLevel: job.thinking,
 		resourceLoader: loader,
+		customTools: [workerBash(job.dir, scratchDir, shellEnv)],
 		sessionManager: SessionManager.inMemory(job.dir),
 		settingsManager: SettingsManager.inMemory({}),
 	});