polymath-society 0.2.11 → 0.2.12

package/dist/cli.js

@@ -841,7 +841,19 @@ function aiWindowCutoff(sessions, opts = {}) {
   const floorStart = gradableStarts[floor - 1];
   return floorStart < windowCutoff ? floorStart : windowCutoff;
 }
-var GATE, AI_WINDOW;
+function maxGraded() {
+  const n = Number(process.env.POLYMATH_MAX_GRADED);
+  return Number.isFinite(n) && n >= 0 ? n : MAX_GRADED_DEFAULT;
+}
+function substanceRank(a, b) {
+  return b.humanChars * Math.log1p(b.humanTurns) - a.humanChars * Math.log1p(a.humanTurns);
+}
+function capGradable(gradable) {
+  const sorted = gradable.slice().sort(substanceRank);
+  const cap = maxGraded();
+  return cap > 0 && sorted.length > cap ? sorted.slice(0, cap) : sorted;
+}
+var GATE, AI_WINDOW, MAX_GRADED_DEFAULT;
 var init_gate = __esm({
   "../coding-core/dist/gate.js"() {
     "use strict";
@@ -860,6 +872,7 @@ var init_gate = __esm({
       minSessions: 40
       // extend the window back until this many gradable sessions
     };
+    MAX_GRADED_DEFAULT = 150;
   }
 });
 
@@ -868,10 +881,14 @@ var gate_exports = {};
 __export(gate_exports, {
   AI_WINDOW: () => AI_WINDOW,
   GATE: () => GATE,
+  MAX_GRADED_DEFAULT: () => MAX_GRADED_DEFAULT,
   aiWindowCutoff: () => aiWindowCutoff,
+  capGradable: () => capGradable,
   isGradable: () => isGradable,
   isTrivial: () => isTrivial,
-  partition: () => partition
+  maxGraded: () => maxGraded,
+  partition: () => partition,
+  substanceRank: () => substanceRank
 });
 var init_gate2 = __esm({
   "src/gate.ts"() {
@@ -880,6 +897,31 @@ var init_gate2 = __esm({
   }
 });
 
+// ../coding-core/dist/env.js
+function claudeCliEnv(base2 = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base2;
+  const present = AUTH_VARS.filter((k) => base2[k]);
+  if (!present.length)
+    return base2;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base2 };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+var AUTH_VARS, warned;
+var init_env = __esm({
+  "../coding-core/dist/env.js"() {
+    "use strict";
+    AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+    warned = false;
+  }
+});
+
 // src/grade/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -1013,6 +1055,7 @@ var cliAdapter;
 var init_cliAdapter = __esm({
   "src/grade/cliAdapter.ts"() {
     "use strict";
+    init_env();
     init_adapter();
     init_backends();
     cliAdapter = {
@@ -1049,7 +1092,9 @@ var init_cliAdapter = __esm({
         await new Promise((resolve2, reject) => {
           const child = spawn(bin, args, {
             cwd: inv.cwd ?? inv.addDir,
-            env: process.env,
+            // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+            // claude CLI away from their claude.ai login (coding-core/env.ts)
+            env: claudeCliEnv(),
             stdio: ["ignore", "pipe", "pipe"],
             // Own process group, so a timeout can kill the WHOLE tree (claude spawns
             // children that otherwise orphan and pile up).
@@ -2458,19 +2503,19 @@ function makeMultiBar(out = process.stderr) {
   const lanes = /* @__PURE__ */ new Map();
   let link = "";
   let paintedRows = 0;
-  const laneText = (name17, l) => {
-    const w = l.within ? ` ${l.within.done}/${l.within.total}` : "";
-    return `${name17} ${l.i}/${l.total} ${l.label.slice(0, 26)}${w}`;
-  };
   const rows = () => {
-    const frac = (l) => l.total ? (l.i - 1 + (l.within && l.within.total ? l.within.done / l.within.total : 0)) / l.total : 0;
-    const parts = [...lanes.entries()].map(([n, l]) => laneText(n, l));
-    const avg2 = lanes.size ? [...lanes.values()].reduce((a, l) => a + frac(l), 0) / lanes.size : 0;
-    const width = 14;
-    const fill = Math.max(0, Math.min(width, Math.round(avg2 * width)));
+    const width = 16;
     const elapsedMin = Math.round((Date.now() - t0) / 6e4);
-    const bar = `[${"\u2588".repeat(fill)}${"\u2591".repeat(width - fill)}] ${parts.join("  \xB7  ")} \xB7 ${elapsedMin}m`;
-    return link ? [bar, `\u21B3 report (live, fills in as stages finish) \u2192 ${link}`] : [bar];
+    const laneRow = ([name17, l]) => {
+      const frac = l.total ? (l.i - 1 + (l.within && l.within.total ? l.within.done / l.within.total : 0)) / l.total : 0;
+      const clamped = Math.max(0, Math.min(1, frac));
+      const fill = Math.round(clamped * width);
+      return `  ${name17.padEnd(6)} [${"\u2588".repeat(fill)}${"\u2591".repeat(width - fill)}] ${String(Math.round(clamped * 100)).padStart(3)}%`;
+    };
+    const out2 = [];
+    if (link) out2.push(`\u21B3 your reports (live, fill in as stages finish) \u2192 ${link} \xB7 ${elapsedMin}m`);
+    out2.push(...[...lanes.entries()].map(laneRow));
+    return out2.length ? out2 : [`(starting\u2026 ${elapsedMin}m)`];
   };
   const clearPinned = () => {
     if (!paintedRows) return;
@@ -4360,6 +4405,7 @@ import { readFileSync } from "fs";
 import path13 from "path";
 
 // ../../lib/agents/shared/cliAdapter.ts
+init_env();
 import { spawn as spawn3 } from "child_process";
 import { promises as fs7 } from "fs";
 import path7 from "path";
@@ -4468,7 +4514,9 @@ var cliAdapter2 = {
     await new Promise((resolve2, reject) => {
       const child = spawn3(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of
@@ -24494,8 +24542,9 @@ function startServer(opts) {
       if (req.method === "GET" && route === "/auth/callback") {
         try {
           const id = await completeLogin(dataDir, new URL(url, serverUrl).searchParams);
+          const back = host === "127.0.0.1" ? serverUrl.replace("//127.0.0.1:", "//localhost:") : serverUrl;
           res.writeHead(200, { "content-type": MIME[".html"] });
-          res.end(`<!doctype html><meta charset="utf-8"><title>Signed in</title><body style="font-family:system-ui;padding:40px"><p>Signed in as <b>${id.email.replace(/</g, "&lt;")}</b>.</p><p><a href="/">Back to your report</a> (or just close this tab \u2014 the report page picks it up on its own).</p></body>`);
+          res.end(`<!doctype html><meta charset="utf-8"><title>Signed in</title><body style="font-family:system-ui;padding:40px"><p>Signed in as <b>${id.email.replace(/</g, "&lt;")}</b>.</p><p><a href="${back}/">Back to your report</a> (or just close this tab \u2014 the report page picks it up on its own).</p></body>`);
         } catch (e) {
           res.writeHead(400, { "content-type": MIME[".html"] });
           res.end(`<!doctype html><meta charset="utf-8"><title>Sign-in failed</title><body style="font-family:system-ui;padding:40px"><p><b>Sign-in failed.</b></p><p>${String(e.message).replace(/</g, "&lt;")}</p><p><a href="/auth/login">Try again</a></p></body>`);
@@ -24659,7 +24708,12 @@ function startServer(opts) {
       }).catch(() => {
       });
       resolve2({
-        url: serverUrl,
+        // The DISPLAYED/opened URL says localhost — friendlier than 127.0.0.1
+        // (owner call 2026-07-15); same server, same loopback. serverUrl itself
+        // stays on the bound host because the Google sign-in redirect is
+        // allow-listed for http://127.0.0.1:*/** in Supabase — auth flows
+        // through 127.0.0.1 no matter which name the person's tab uses.
+        url: host === "127.0.0.1" ? `http://localhost:${port}` : serverUrl,
         port,
         close: () => new Promise((r) => server.close(() => r())),
         setProfile: (p) => {
@@ -24970,11 +25024,12 @@ function upToDateSkip(i) {
 }
 async function evalUpToDate(codingDir, threshold, regrade) {
   try {
-    const { partition: partition2, aiWindowCutoff: aiWindowCutoff2 } = await Promise.resolve().then(() => (init_gate2(), gate_exports));
+    const { partition: partition2, aiWindowCutoff: aiWindowCutoff2, capGradable: capGradable2 } = await Promise.resolve().then(() => (init_gate2(), gate_exports));
     const sessions = JSON.parse(await fs31.readFile(path36.join(codingDir, "sessions.json"), "utf8"));
     const live = sessions.filter((s) => s.klass === "interactive" && !s.duplicateOf);
     const cutoff = aiWindowCutoff2(live);
-    const { gradable } = partition2(cutoff ? live.filter((s) => (s.start ?? "") >= cutoff) : live);
+    const { gradable: uncapped } = partition2(cutoff ? live.filter((s) => (s.start ?? "") >= cutoff) : live);
+    const gradable = capGradable2(uncapped);
     const graded = new Set(
       (await fs31.readdir(path36.join(codingDir, "grades")).catch(() => [])).filter((f) => f.endsWith(".json")).map((f) => f.slice(0, -5))
     );

package/dist/engine/chat-loops.js

@@ -1356,6 +1356,25 @@ import { spawn } from "child_process";
 import { promises as fs2 } from "fs";
 import path2 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -1460,7 +1479,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of

package/dist/engine/exp-allfacets.js

@@ -153,6 +153,25 @@ import { spawn } from "child_process";
 import { promises as fs2 } from "fs";
 import path3 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -257,7 +276,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of

package/dist/engine/exp-person.js

@@ -153,6 +153,25 @@ import { spawn } from "child_process";
 import { promises as fs2 } from "fs";
 import path3 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -257,7 +276,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of

package/dist/engine/exp-pipeline.js

@@ -148,6 +148,25 @@ import { spawn } from "child_process";
 import { promises as fs2 } from "fs";
 import path2 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -252,7 +271,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of

package/dist/engine/peak-demos.js

@@ -1144,6 +1144,25 @@ import { spawn } from "child_process";
 import { promises as fs3 } from "fs";
 import path4 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -1248,7 +1267,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of

package/dist/engine/person-dimension-summary.js

@@ -1144,6 +1144,25 @@ import { spawn } from "child_process";
 import { promises as fs3 } from "fs";
 import path4 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -1248,7 +1267,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of

package/dist/engine/person-facet-lines.js

@@ -1144,6 +1144,25 @@ import { spawn } from "child_process";
 import { promises as fs3 } from "fs";
 import path4 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -1248,7 +1267,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of

package/dist/engine/person-headline.js

@@ -1144,6 +1144,25 @@ import { spawn } from "child_process";
 import { promises as fs3 } from "fs";
 import path4 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -1248,7 +1267,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of

package/dist/engine/person-report.js

@@ -1144,6 +1144,25 @@ import { spawn } from "child_process";
 import { promises as fs3 } from "fs";
 import path4 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -1248,7 +1267,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of

package/dist/engine/person-self-image.js

@@ -1096,6 +1096,25 @@ import { spawn } from "child_process";
 import { promises as fs4 } from "fs";
 import path5 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -1200,7 +1219,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of

package/dist/engine/public-report.js

@@ -142,6 +142,25 @@ import { spawn } from "child_process";
 import { promises as fs2 } from "fs";
 import path2 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -246,7 +265,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of

package/dist/engine/run-analysis.js

@@ -265,6 +265,25 @@ import { spawn } from "child_process";
 import { promises as fs4 } from "fs";
 import path5 from "path";
 
+// ../coding-core/dist/env.js
+var AUTH_VARS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var warned = false;
+function claudeCliEnv(base = process.env) {
+  if (process.env.POLYMATH_USE_API_KEY === "1")
+    return base;
+  const present = AUTH_VARS.filter((k) => base[k]);
+  if (!present.length)
+    return base;
+  if (!warned) {
+    warned = true;
+    console.error(`[polymath-society] ${present.join(" + ")} is set in your shell \u2014 ignoring it so the analysis runs on your claude.ai login (the key would take over auth and either fail or bill your API account). Set POLYMATH_USE_API_KEY=1 if you really want the API key used.`);
+  }
+  const scrubbed = { ...base };
+  for (const k of AUTH_VARS)
+    delete scrubbed[k];
+  return scrubbed;
+}
+
 // ../../lib/agents/shared/adapter.ts
 function extractJson(text2) {
   const fences = [...text2.matchAll(/```json\s*([\s\S]*?)```/gi)];
@@ -369,7 +388,9 @@ var cliAdapter = {
     await new Promise((resolve2, reject) => {
       const child = spawn(CLAUDE_BIN, args, {
         cwd: inv.cwd ?? inv.addDir,
-        env: process.env,
+        // scrubbed: a stray ANTHROPIC_API_KEY in the user's shell hijacks the
+        // claude CLI away from their claude.ai login (coding-core/env.ts)
+        env: claudeCliEnv(),
         stdio: ["ignore", "pipe", "pipe"],
         // Own process group, so a timeout can kill the WHOLE tree (claude spawns
         // its own children that otherwise orphan and pile up — the root cause of