polymath-society 0.2.10 → 0.2.12

package/dist/engine/public-report.js

@@ -142,6 +142,25 @@ import { spawn } from "child_process";
 import { promises as fs2 } from "fs";
 import path2 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -246,7 +265,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of

package/dist/engine/run-analysis.js

@@ -265,6 +265,25 @@ import { spawn } from "child_process";
 import { promises as fs4 } from "fs";
 import path5 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -369,7 +388,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of

package/dist/engine/run-tagger.js

@@ -242,6 +242,25 @@ import { spawn } from "child_process";
 import { promises as fs3 } from "fs";
 import path4 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -346,7 +365,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of

package/dist/index.js

@@ -1794,6 +1794,25 @@ import path3 from "path";
 // src/grade/cliAdapter.ts
 import { spawn } from "child_process";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base2 = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base2;
+  const present = AUTH_VARS.filter((k) => base2[k]);
+  if (!present.length)
+    return base2;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base2 };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // src/grade/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -1945,7 +1964,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(bin, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // children that otherwise orphan and pile up).
@@ -3263,7 +3284,9 @@ var cliAdapter2 = {
     await new Promise((resolve2, reject) => {
       const child = spawn3(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of
@@ -23367,8 +23390,9 @@ function startServer(opts) {
       if (req.method === "GET" && route === "/auth/callback") {
         try {
           const id = await completeLogin(dataDir, new URL(url, serverUrl).searchParams);
+          const back = host === "127.0.0.1" ? serverUrl.replace("//127.0.0.1:", "//localhost:") : serverUrl;
           res.writeHead(200, { "content-type": MIME[".html"] });
-          res.end(`<!doctype html><meta charset="utf-8"><title>Signed in</title><body style="font-family:system-ui;padding:40px"><p>Signed in as <b>${id.email.replace(/</g, "&lt;")}</b>.</p><p><a href="/">Back to your report</a> (or just close this tab \u2014 the report page picks it up on its own).</p></body>`);
+          res.end(`<!doctype html><meta charset="utf-8"><title>Signed in</title><body style="font-family:system-ui;padding:40px"><p>Signed in as <b>${id.email.replace(/</g, "&lt;")}</b>.</p><p><a href="${back}/">Back to your report</a> (or just close this tab \u2014 the report page picks it up on its own).</p></body>`);
         } catch (e) {
           res.writeHead(400, { "content-type": MIME[".html"] });
           res.end(`<!doctype html><meta charset="utf-8"><title>Sign-in failed</title><body style="font-family:system-ui;padding:40px"><p><b>Sign-in failed.</b></p><p>${String(e.message).replace(/</g, "&lt;")}</p><p><a href="/auth/login">Try again</a></p></body>`);
@@ -23532,7 +23556,12 @@ function startServer(opts) {
       }).catch(() => {
       });
       resolve2({
-        url: serverUrl,
+        // The DISPLAYED/opened URL says localhost — friendlier than 127.0.0.1
+        // (owner call 2026-07-15); same server, same loopback. serverUrl itself
+        // stays on the bound host because the Google sign-in redirect is
+        // allow-listed for http://127.0.0.1:*/** in Supabase — auth flows
+        // through 127.0.0.1 no matter which name the person's tab uses.
+        url: host === "127.0.0.1" ? `http://localhost:${port}` : serverUrl,
         port,
         close: () => new Promise((r) => server.close(() => r())),
         setProfile: (p) => {

package/dist/pipeline/coding-agglomerate.js

@@ -151,6 +151,25 @@ import { spawn } from "child_process";
 import { promises as fs2 } from "fs";
 import path2 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -255,7 +274,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of

package/dist/pipeline/coding-coaching.js

@@ -145,6 +145,25 @@ import { spawn } from "child_process";
 import { promises as fs2 } from "fs";
 import path2 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -249,7 +268,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of

package/dist/pipeline/coding-day-digest.js

@@ -151,6 +151,25 @@ import { spawn } from "child_process";
 import { promises as fs2 } from "fs";
 import path2 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -255,7 +274,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of

package/dist/pipeline/coding-delegation.js

@@ -151,6 +151,25 @@ import { spawn } from "child_process";
 import { promises as fs2 } from "fs";
 import path2 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -255,7 +274,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of

package/dist/pipeline/coding-expertise.js

@@ -147,6 +147,25 @@ import { spawn } from "child_process";
 import { promises as fs2 } from "fs";
 import path2 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -251,7 +270,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of

package/dist/pipeline/coding-focus.js

@@ -135,6 +135,19 @@ var require_secure_json_parse = __commonJS({
 
 // ../../scripts/coding-focus.mts
 import { promises as fs6 } from "fs";
+
+// ../../lib/agents/coding/promptCache.ts
+import { createHash } from "crypto";
+function promptSha(parts) {
+  const h = createHash("sha256");
+  for (const p of parts) {
+    h.update(p ?? "");
+    h.update("\0");
+  }
+  return h.digest("hex").slice(0, 16);
+}
+
+// ../../scripts/coding-focus.mts
 import path10 from "path";
 
 // ../../lib/agents/shared/agent.ts
@@ -146,6 +159,25 @@ import { spawn } from "child_process";
 import { promises as fs2 } from "fs";
 import path2 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -250,7 +282,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of
@@ -16170,7 +16204,13 @@ async function run2() {
 
 SESSIONS:
 ${JSON.stringify(listing, null, 1)}`;
-    try {
+    const clusterSha = promptSha([cprompt]);
+    if (prev?.features?.length && prev?.featuresPromptSha === clusterSha && !process.env.FOCUS_REFRESH) {
+      out.features = prev.features;
+      out.featuresDaysUnit = prev.featuresDaysUnit ?? "min";
+      out.featuresPromptSha = clusterSha;
+      console.log("focus: cluster inputs unchanged \u2014 reusing features (FOCUS_REFRESH=1 to redo)");
+    } else try {
       const cr = await invokeAgent({ prompt: cprompt, systemPrompt: "You produce strict JSON only.", maxTurns: 3, timeoutMs: 48e4, model: "sonnet" });
       let cj = cr.json ?? null;
       if (!cj) cj = parseModelJson(cr.raw);
@@ -16205,6 +16245,7 @@ ${JSON.stringify(listing, null, 1)}`;
         }
         out.features = feats.sort((a, b) => Object.keys(b.days).length - Object.keys(a.days).length);
         out.featuresDaysUnit = "min";
+        out.featuresPromptSha = clusterSha;
         console.log(`focus: ${out.features.length} semantic features from ${recentSess.length} sessions (${stray.length} unmapped \u2192 Everything else)`);
       } else console.error(`focus: feature clustering returned no usable JSON (raw ${String(cr.raw || "").length} chars)`);
     } catch (e) {
@@ -16229,7 +16270,11 @@ ${examples}
 ${summary}
 
 Return the Part 5 JSON only.`;
-    try {
+    const judgeSha = promptSha([prompt, process.env.FOCUS_JUDGE_MODEL || "opus"]);
+    if (prev?.llm?.promptSha === judgeSha && !process.env.FOCUS_REFRESH) {
+      out.llm = prev.llm;
+      console.log("focus: judgment inputs unchanged \u2014 reusing llm block (FOCUS_REFRESH=1 to redo)");
+    } else try {
       const judgeModel = process.env.FOCUS_JUDGE_MODEL || "opus";
       const run22 = await invokeAgent({ prompt, systemPrompt: "You produce strict JSON per the rubric's output contract. No prose outside the JSON.", maxTurns: 3, timeoutMs: 48e4, model: judgeModel });
       let parsed = run22.json ?? null;
@@ -16242,7 +16287,7 @@ Return the Part 5 JSON only.`;
 The block to append in step 1:
 ${parsed.claudeMdSnippet}`;
       }
-      if (parsed && (parsed.causalFindings?.length || parsed.flowKinds)) out.llm = { ...parsed, model: judgeModel, generatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+      if (parsed && (parsed.causalFindings?.length || parsed.flowKinds)) out.llm = { ...parsed, model: judgeModel, generatedAt: (/* @__PURE__ */ new Date()).toISOString(), promptSha: judgeSha };
       else console.error(`focus: LLM pass returned no usable JSON (raw ${String(run22.raw || "").length} chars) \u2014 deterministic data written, causal block empty`);
     } catch (e) {
       console.error("focus: LLM pass failed \u2014", e.message);

package/dist/pipeline/coding-frontier-detail.js

@@ -145,6 +145,25 @@ import { spawn } from "child_process";
 import { promises as fs2 } from "fs";
 import path2 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -249,7 +268,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of

package/dist/pipeline/coding-gap.js

@@ -146,6 +146,25 @@ import { spawn } from "child_process";
 import { promises as fs2 } from "fs";
 import path2 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -250,7 +269,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of

package/dist/pipeline/coding-grade.js

@@ -151,6 +151,25 @@ import { spawn } from "child_process";
 import { promises as fs2 } from "fs";
 import path2 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -255,7 +274,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of
@@ -16162,6 +16183,19 @@ function aiWindowCutoff(sessions, opts = {}) {
   const floorStart = gradableStarts[floor - 1];
   return floorStart < windowCutoff ? floorStart : windowCutoff;
 }
+var MAX_GRADED_DEFAULT = 150;
+function maxGraded() {
+  const n = Number(process.env.POLYMATH_MAX_GRADED);
+  return Number.isFinite(n) && n >= 0 ? n : MAX_GRADED_DEFAULT;
+}
+function substanceRank(a, b) {
+  return b.humanChars * Math.log1p(b.humanTurns) - a.humanChars * Math.log1p(a.humanTurns);
+}
+function capGradable(gradable) {
+  const sorted = gradable.slice().sort(substanceRank);
+  const cap = maxGraded();
+  return cap > 0 && sorted.length > cap ? sorted.slice(0, cap) : sorted;
+}
 
 // ../../lib/agents/coding/profile.ts
 import path10 from "path";
@@ -16362,9 +16396,10 @@ async function main() {
   const { gradable: allGradable, thin, trivial } = partition(live);
   const cutoff = aiWindowCutoff(live);
   const gradable = cutoff ? allGradable.filter((s) => (s.start ?? "") >= cutoff) : allGradable;
-  const ranked = gradable.slice().sort((a, b) => b.humanChars * Math.log1p(b.humanTurns) - a.humanChars * Math.log1p(a.humanTurns));
+  const ranked = capGradable(gradable);
   console.log(`[coding-grade] ${sessions.length} sessions \u2192 ${allGradable.length} gradable \xB7 ${thin.length} thin \xB7 ${trivial.length} trivial (skipped)`);
   if (cutoff) console.log(`[coding-grade] AI window: grading sessions since ${cutoff.slice(0, 10)} \u2014 ${gradable.length} of ${allGradable.length} gradable (POLYMATH_AI_WINDOW_DAYS=0 for full history)`);
+  if (ranked.length < gradable.length) console.log(`[coding-grade] cap: grading the ${ranked.length} richest of ${gradable.length} gradable sessions (POLYMATH_MAX_GRADED=${maxGraded()}; 0 = uncapped) \u2014 the rest still feed every deterministic number`);
   await fs6.mkdir(LOGS, { recursive: true });
   const limit = ALL ? ranked.length : N;
   const picked = [];

package/dist/pipeline/coding-nutshell.js

@@ -147,6 +147,25 @@ import { spawn } from "child_process";
 import { promises as fs2 } from "fs";
 import path2 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -251,7 +270,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of