polymath-society 0.2.10 → 0.2.12

package/dist/cli.js

@@ -841,7 +841,19 @@ function aiWindowCutoff(sessions, opts = {}) {
   const floorStart = gradableStarts[floor - 1];
   return floorStart < windowCutoff ? floorStart : windowCutoff;
 }
-var GATE, AI_WINDOW;
+function maxGraded() {
+  const n = Number(process.env.POLYMATH_MAX_GRADED);
+  return Number.isFinite(n) && n >= 0 ? n : MAX_GRADED_DEFAULT;
+}
+function substanceRank(a, b) {
+  return b.humanChars * Math.log1p(b.humanTurns) - a.humanChars * Math.log1p(a.humanTurns);
+}
+function capGradable(gradable) {
+  const sorted = gradable.slice().sort(substanceRank);
+  const cap = maxGraded();
+  return cap > 0 && sorted.length > cap ? sorted.slice(0, cap) : sorted;
+}
+var GATE, AI_WINDOW, MAX_GRADED_DEFAULT;
 var init_gate = __esm({
   "../coding-core/dist/gate.js"() {
     "use strict";
@@ -860,6 +872,7 @@ var init_gate = __esm({
       minSessions: 40
       // extend the window back until this many gradable sessions
     };
+    MAX_GRADED_DEFAULT = 150;
   }
 });
 
@@ -868,10 +881,14 @@ var gate_exports = {};
 __export(gate_exports, {
   AI_WINDOW: () => AI_WINDOW,
   GATE: () => GATE,
+  MAX_GRADED_DEFAULT: () => MAX_GRADED_DEFAULT,
   aiWindowCutoff: () => aiWindowCutoff,
+  capGradable: () => capGradable,
   isGradable: () => isGradable,
   isTrivial: () => isTrivial,
-  partition: () => partition
+  maxGraded: () => maxGraded,
+  partition: () => partition,
+  substanceRank: () => substanceRank
 });
 var init_gate2 = __esm({
   "src/gate.ts"() {
@@ -880,6 +897,31 @@ var init_gate2 = __esm({
   }
 });
 
+// ../coding-core/dist/env.js
+function claudeCliEnv(base2 = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base2;
+  const present = AUTH_VARS.filter((k) => base2[k]);
+  if (!present.length)
+    return base2;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base2 };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+var AUTH_VARS, warned;
+var init_env = __esm({
+  "../coding-core/dist/env.js"() {
+    "use strict";
+    AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+    warned = false;
+  }
+});
+
 // src/grade/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -1013,6 +1055,7 @@ var cliAdapter;
 var init_cliAdapter = __esm({
   "src/grade/cliAdapter.ts"() {
     "use strict";
+    init_env();
     init_adapter();
     init_backends();
     cliAdapter = {
@@ -1049,7 +1092,9 @@ var init_cliAdapter = __esm({
         await new Promise((resolve2, reject) => {
           const child = spawn(bin, args, {
             cwd: inv.cwd ?? inv.addDir,
-            env: process.env,
+            // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+            // claude CLI away from their claude.ai login (coding-core/env.ts)
+            env: claudeCliEnv(),
             stdio: ["ignore", "pipe", "pipe"],
             // Own process group, so a timeout can kill the WHOLE tree (claude spawns
             // children that otherwise orphan and pile up).
@@ -2458,19 +2503,19 @@ function makeMultiBar(out = process.stderr) {
   const lanes = /* @__PURE__ */ new Map();
   let link = "";
   let paintedRows = 0;
-  const laneText = (name17, l) => {
-    const w = l.within ? ` ${l.within.done}/${l.within.total}` : "";
-    return `${name17} ${l.i}/${l.total} ${l.label.slice(0, 26)}${w}`;
-  };
   const rows = () => {
-    const frac = (l) => l.total ? (l.i - 1 + (l.within && l.within.total ? l.within.done / l.within.total : 0)) / l.total : 0;
-    const parts = [...lanes.entries()].map(([n, l]) => laneText(n, l));
-    const avg2 = lanes.size ? [...lanes.values()].reduce((a, l) => a + frac(l), 0) / lanes.size : 0;
-    const width = 14;
-    const fill = Math.max(0, Math.min(width, Math.round(avg2 * width)));
+    const width = 16;
     const elapsedMin = Math.round((Date.now() - t0) / 6e4);
-    const bar = `[${"\u2588".repeat(fill)}${"\u2591".repeat(width - fill)}] ${parts.join("  \xB7  ")} \xB7 ${elapsedMin}m`;
-    return link ? [bar, `\u21B3 report (live, fills in as stages finish) \u2192 ${link}`] : [bar];
+    const laneRow = ([name17, l]) => {
+      const frac = l.total ? (l.i - 1 + (l.within && l.within.total ? l.within.done / l.within.total : 0)) / l.total : 0;
+      const clamped = Math.max(0, Math.min(1, frac));
+      const fill = Math.round(clamped * width);
+      return `  ${name17.padEnd(6)} [${"\u2588".repeat(fill)}${"\u2591".repeat(width - fill)}] ${String(Math.round(clamped * 100)).padStart(3)}%`;
+    };
+    const out2 = [];
+    if (link) out2.push(`\u21B3 your reports (live, fill in as stages finish) \u2192 ${link} \xB7 ${elapsedMin}m`);
+    out2.push(...[...lanes.entries()].map(laneRow));
+    return out2.length ? out2 : [`(starting\u2026 ${elapsedMin}m)`];
   };
   const clearPinned = () => {
     if (!paintedRows) return;
@@ -4360,6 +4405,7 @@ import { readFileSync } from "fs";
 import path13 from "path";
 
 // ../../lib/agents/shared/cliAdapter.ts
+init_env();
 import { spawn as spawn3 } from "child_process";
 import { promises as fs7 } from "fs";
 import path7 from "path";
@@ -4468,7 +4514,9 @@ var cliAdapter2 = {
     await new Promise((resolve2, reject) => {
       const child = spawn3(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of
@@ -24494,8 +24542,9 @@ function startServer(opts) {
       if (req.method === "GET" && route === "/auth/callback") {
         try {
           const id = await completeLogin(dataDir, new URL(url, serverUrl).searchParams);
+          const back = host === "127.0.0.1" ? serverUrl.replace("//127.0.0.1:", "//localhost:") : serverUrl;
           res.writeHead(200, { "content-type": MIME[".html"] });
-          res.end(`<!doctype html><meta charset="utf-8"><title>Signed in</title><body style="font-family:system-ui;padding:40px"><p>Signed in as <b>${id.email.replace(/</g, "&lt;")}</b>.</p><p><a href="/">Back to your report</a> (or just close this tab \u2014 the report page picks it up on its own).</p></body>`);
+          res.end(`<!doctype html><meta charset="utf-8"><title>Signed in</title><body style="font-family:system-ui;padding:40px"><p>Signed in as <b>${id.email.replace(/</g, "&lt;")}</b>.</p><p><a href="${back}/">Back to your report</a> (or just close this tab \u2014 the report page picks it up on its own).</p></body>`);
         } catch (e) {
           res.writeHead(400, { "content-type": MIME[".html"] });
           res.end(`<!doctype html><meta charset="utf-8"><title>Sign-in failed</title><body style="font-family:system-ui;padding:40px"><p><b>Sign-in failed.</b></p><p>${String(e.message).replace(/</g, "&lt;")}</p><p><a href="/auth/login">Try again</a></p></body>`);
@@ -24659,7 +24708,12 @@ function startServer(opts) {
       }).catch(() => {
       });
       resolve2({
-        url: serverUrl,
+        // The DISPLAYED/opened URL says localhost — friendlier than 127.0.0.1
+        // (owner call 2026-07-15); same server, same loopback. serverUrl itself
+        // stays on the bound host because the Google sign-in redirect is
+        // allow-listed for http://127.0.0.1:*/** in Supabase — auth flows
+        // through 127.0.0.1 no matter which name the person's tab uses.
+        url: host === "127.0.0.1" ? `http://localhost:${port}` : serverUrl,
         port,
         close: () => new Promise((r) => server.close(() => r())),
         setProfile: (p) => {
@@ -24863,7 +24917,7 @@ function apportionHeavy(budget) {
   const grade = Math.max(2, Math.floor(budget * 0.45));
   const digest = Math.max(1, Math.floor(budget * 0.17));
   const walkthrough = Math.max(1, Math.floor(budget * 0.17));
-  const delegation = Math.max(1, budget - grade - digest - walkthrough - 1);
+  const delegation = Math.max(1, budget - grade - digest - walkthrough - 2);
   return { grade, digest, walkthrough, delegation };
 }
 function stages(o) {
@@ -24896,6 +24950,14 @@ function stages(o) {
     { script: "coding-walkthrough.mts", label: "Per-session walkthroughs", llm: true, args: ["--model", model, "--conc", String(h.walkthrough)], batch: "heavy" },
     { script: "coding-frontier-detail.mts", label: "What you're doing at the frontier", llm: true, args: [], out: "coding/frontier-detail.json", batch: "heavy" },
     { script: "coding-delegation.mts", label: "Delegation patterns", llm: true, args: ["--model", model, "--conc", String(h.delegation)], out: "coding/delegation-rollup.json", batch: "heavy" },
+    // The FULL focus stage: flow-rule judgment + the paste-into-CLAUDE.md block.
+    // The deterministic --skip-llm run above keeps the numbers current every
+    // run; this one produces the AI block — it was MISSING from the graded tier
+    // entirely (688d788 added focus for the numbers-only tier and no one added
+    // the companion), so overnight full runs shipped a report with no flow
+    // rules and nothing failed loud (found 2026-07-15). Both LLM passes are
+    // prompt-hash gated, so an unchanged corpus re-run costs zero calls.
+    { script: "coding-focus.mts", label: "Flow rules + focus judgment", llm: true, args: [], out: "coding/focus.json", batch: "heavy" },
     // ---- corpus aggregate (reads grades; deterministic rollup) ----
     { script: "coding-aggregate.mts", label: "Corpus aggregate \u2014 ability ceiling + flow", llm: false, args: [], out: "coding/aggregate.json" },
     // ---- grade readers (grades/* is complete once aggregate ran) ----
@@ -24962,11 +25024,12 @@ function upToDateSkip(i) {
 }
 async function evalUpToDate(codingDir, threshold, regrade) {
   try {
-    const { partition: partition2, aiWindowCutoff: aiWindowCutoff2 } = await Promise.resolve().then(() => (init_gate2(), gate_exports));
+    const { partition: partition2, aiWindowCutoff: aiWindowCutoff2, capGradable: capGradable2 } = await Promise.resolve().then(() => (init_gate2(), gate_exports));
     const sessions = JSON.parse(await fs31.readFile(path36.join(codingDir, "sessions.json"), "utf8"));
     const live = sessions.filter((s) => s.klass === "interactive" && !s.duplicateOf);
     const cutoff = aiWindowCutoff2(live);
-    const { gradable } = partition2(cutoff ? live.filter((s) => (s.start ?? "") >= cutoff) : live);
+    const { gradable: uncapped } = partition2(cutoff ? live.filter((s) => (s.start ?? "") >= cutoff) : live);
+    const gradable = capGradable2(uncapped);
     const graded = new Set(
       (await fs31.readdir(path36.join(codingDir, "grades")).catch(() => [])).filter((f) => f.endsWith(".json")).map((f) => f.slice(0, -5))
     );
@@ -25253,7 +25316,19 @@ async function runChatPipeline(o) {
     }
     log.event("ingest-export", { ok, ms: Date.now() - stStart, source: f.kind });
   }
+  const minNewDocs = Number(process.env.POLYMATH_MIN_NEW_DOCS ?? 10);
+  const signalDocs = async () => {
+    const t = await fs32.readFile(path37.join(dataRoot, "signals", "index.jsonl"), "utf8").catch(() => "");
+    return t ? t.split("\n").filter(Boolean).length : 0;
+  };
+  const docsBeforeTagger = await signalDocs();
+  let upToDate = false;
   for (const st of chatEngineStages()) {
+    if (upToDate && st.llm) {
+      o.onStage?.(++idx, total, `${st.label} \u2014 up to date, skipped`, st.llm);
+      log.event(st.script.replace(/\.mts$/, ""), { ok: true, ms: 0, skipped: true });
+      continue;
+    }
     o.onStage?.(++idx, total, st.label, st.llm);
     const stStart = Date.now();
     let ok = true;
@@ -25267,6 +25342,14 @@ async function runChatPipeline(o) {
     }
     const sha = st.out ? await fileSha(path37.join(dataRoot, st.out)) : null;
     log.event(st.script.replace(/\.mts$/, ""), { ok, ms: Date.now() - stStart, ...sha ? { sha } : {} });
+    if (st.script === "run-tagger.mts" && ok && minNewDocs > 0) {
+      const newDocs = await signalDocs() - docsBeforeTagger;
+      const report = await fs32.readFile(path37.join(dataRoot, "engine-pilot", "public-report.json"), "utf8").then((s) => JSON.parse(s)).catch(() => null);
+      if (report?.headline && (report.spikes?.length ?? 0) > 0 && newDocs < minNewDocs) {
+        upToDate = true;
+        o.onLine?.(`\u2713 chat report is up to date \u2014 ${newDocs} new doc(s) since the last full run (below the ${minNewDocs}-doc threshold), so the AI stages are skipped and the existing report is served as-is. POLYMATH_MIN_NEW_DOCS=0 forces a full run.`);
+      }
+    }
   }
   log.event("pipeline_completed", { ok: failed.length === 0, failedStages: failed.length, ms: Date.now() - t0 });
   await log.finish();

package/dist/engine/chat-loops.js

@@ -1356,6 +1356,25 @@ import { spawn } from "child_process";
 import { promises as fs2 } from "fs";
 import path2 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -1460,7 +1479,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of
@@ -16902,6 +16923,14 @@ async function run2() {
     }
   }
   if (!sigs.length) throw new Error("loops: empty signals index \u2014 refusing to write");
+  const fingerprint = `${sigs.length}:${sigs.reduce((a, s) => s.date > a ? s.date : a, "")}`;
+  if (!process.env.LOOPS_REFRESH) {
+    const prev2 = await fs6.readFile(OUT2, "utf8").then(JSON.parse).catch(() => null);
+    if (prev2?.inputFingerprint === fingerprint && prev2?.loops?.loops?.length) {
+      console.log(`loops: inputs unchanged (${sigs.length} signals) \u2014 keeping ${prev2.generatedAt} (LOOPS_REFRESH=1 to redo)`);
+      return;
+    }
+  }
   const artifacts = importArtifactDates(sigs);
   const dated = sigs.filter((s) => !artifacts.has(s.date));
   const chats = dated.filter((s) => s.source === "chatgpt" || s.source === "claude");
@@ -16988,6 +17017,8 @@ ${sample.join("\n")}`;
   rules.sort((a, b) => a.date.localeCompare(b.date));
   const out = {
     generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    inputFingerprint: fingerprint,
+    // the skip gate above compares against this
     totals: { signals: sigs.length, dated: dated.length, chats: chats.length, ruleDeclarations: rules.length, importDatesExcluded: [...artifacts] },
     chatsByMonth: monthCounts(chats.map((c) => c.date)),
     rules,

package/dist/engine/exp-allfacets.js

@@ -153,6 +153,25 @@ import { spawn } from "child_process";
 import { promises as fs2 } from "fs";
 import path3 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -257,7 +276,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of

package/dist/engine/exp-person.js

@@ -153,6 +153,25 @@ import { spawn } from "child_process";
 import { promises as fs2 } from "fs";
 import path3 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -257,7 +276,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of

package/dist/engine/exp-pipeline.js

@@ -148,6 +148,25 @@ import { spawn } from "child_process";
 import { promises as fs2 } from "fs";
 import path2 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -252,7 +271,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of

package/dist/engine/peak-demos.js

@@ -1144,6 +1144,25 @@ import { spawn } from "child_process";
 import { promises as fs3 } from "fs";
 import path4 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -1248,7 +1267,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of

package/dist/engine/person-dimension-summary.js

@@ -1144,6 +1144,25 @@ import { spawn } from "child_process";
 import { promises as fs3 } from "fs";
 import path4 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -1248,7 +1267,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of

package/dist/engine/person-facet-lines.js

@@ -1144,6 +1144,25 @@ import { spawn } from "child_process";
 import { promises as fs3 } from "fs";
 import path4 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -1248,7 +1267,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of

package/dist/engine/person-headline.js

@@ -1144,6 +1144,25 @@ import { spawn } from "child_process";
 import { promises as fs3 } from "fs";
 import path4 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -1248,7 +1267,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of

package/dist/engine/person-report.js

@@ -1144,6 +1144,25 @@ import { spawn } from "child_process";
 import { promises as fs3 } from "fs";
 import path4 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -1248,7 +1267,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of

package/dist/engine/person-self-image.js

@@ -1096,6 +1096,25 @@ import { spawn } from "child_process";
 import { promises as fs4 } from "fs";
 import path5 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -1200,7 +1219,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of