burn down the `cli-test-child-env` baseline: 18 spawned children in 17 `packages/cli/test` files still built from the whole of `process.env`

[os-zhuang]

#11341 landed check:cli-test-child-env, which refuses a bulk process.env copy in a spawner file under packages/cli/test/**. The leaks that predate the gate are recorded in scripts/cli-test-child-env.baseline.json as a shrink-only ratchet. This card is the burn-down.

The gate deliberately did not repair them: sweeping without the mechanism leaves the next file free to reintroduce the shape (#11341's own argument), and two of the files below were held by #11071 in a parallel seat the round the gate landed.

The ledger, as it stands

18 bulk references across 17 files:

file	count
cloud-login-json-ndjson.e2e.test.ts	1
generate-agent-retired.e2e.test.ts	1
generate-skill.e2e.test.ts	1
hook-body-build-reach.e2e.test.ts	1
init-created-files-summary.e2e.test.ts	1
invocation-loudness.e2e.test.ts	1
json-stdout-purity.e2e.test.ts	1
login-json-ndjson.e2e.test.ts	1
login-json-noninteractive.e2e.test.ts	1
migrate-exit-code.e2e.test.ts	1
migrate-meta.e2e.test.ts	2
qa-empty-glob-exit-code.e2e.test.ts	1
serve-app-anchored-optional-import.e2e.test.ts	1
serve-app-runtime-hooks.e2e.test.ts	1
serve-host-fallback-base.e2e.test.ts	1
validate-json-warning-parity.e2e.test.ts	1
validate-top-level-strict.e2e.test.ts	1

node scripts/check-cli-test-child-env.mjs --list prints this live, with line numbers and the enclosing function, so no worklist has to be maintained by hand — the enumeration in this body is a snapshot and the command is the source of truth.

One card per neighbourhood, not one sweep

The repair is mechanical (env: childEnv({ ... }) in place of the spread) but it is not uniformly risk-free, which is why it is split rather than batched:

• serve-app-anchored-optional-import.e2e.test.ts is the one that matters most. Its hand-rolled runServeFrom() boots a real os serve with the full stack — better-auth included — so it is the single file in the directory that has the leak and mounts something that reads TEST. It asserts optional-service resolution today, so nothing it checks can currently be softened into a pass, but its assertions are one edit away from being security-relevant. finding: #11341's bare-...process.env worklist is two files short, and one of them spawns a real os serve #11441 is the card that measured it.
• The serve-* files each need the child re-checked after the strip: the crypto provider persists a minted key to $HOME/.objectstack/dev-crypto-key in development mode, which is why runServe() passes an explicit OS_SECRET_KEY. A file that stops claiming to be a vitest worker may need the same. helpers/serve-process.ts's header carries the measurement, and serve-node-env-production-default going red the moment the leak stopped is the recorded precedent for a pin whose "production posture" was genuine for auth and fake for crypto.
• generate-skill.e2e.test.ts and generate-agent-retired.e2e.test.ts sit in os g writes NAME.ts for six generators while the type registry declares NAME.TYPE.ts — #11025 closed it for skill alone #11071's neighbourhood — check it has landed before touching them.
• The remaining login / migrate / validate / init / qa / hook / json-stdout files spawn commands that mount nothing reading the runner family. Those are the cheap batch.

Ratchet mechanics for whoever takes a slice

Lower the count in scripts/cli-test-child-env.baseline.json in the same PR, and delete the key when it reaches 0 — the gate fails on a stale ceiling, in that direction too, deliberately: a ceiling left above reality silently licenses that many new leaks.

Related

• finding: nothing stops the next packages/cli/test spawner from re-introducing the bare ...process.env child env #11341 — the gate, its rule, and the two DELIBERATE sites that are not in this ledger.
• finding: #11341's bare-...process.env worklist is two files short, and one of them spawns a real os serve #11441 — the measurement correction that named two of the files above.
• finding: 8 packages/cli/test spawners pass no env at all, so the child inherits the vitest worker environment verbatim — the purer form of #11341's leak, and the new gate is silent on it #11595 — the sibling gap: 8 spawners that pass no env at all. Not in this ledger; a different remedy.
• e2e tests that spawn a real os serve under vitest inherit TEST=true, which makes better-auth silently skip origin/CSRF validation regardless of NODE_ENV #11267 — where childEnv() came from, and the measurement that says why it matters.

[os-zhuang]

Triage (Routine seat, hourly round): → pm:queue + domain:cli (kept), type Task.

Rationale: burn-down of the #11341 gate's shrink-only baseline; the card already slices the work by risk (cheap batch vs serve-* re-checks vs the #11071-neighbourhood pair) and names the ratchet mechanics. Serial constraints for the dispatching seat: generate-skill / generate-agent-retired wait on #11071 landing; fold-or-serial vs the #11595 sibling (no-env spawners — different remedy, same directory) must be answered under the five gates at dispatch.

---

Generated by Claude Code

[os-zhuang]

Claim — domain:cli execution seat, session 019siH5jDmk5hrayvfyojUqR, round R33.
Branch: claude/issue-11596-child-env-cheap-batch. Dispatching one slice, not the whole ledger.

Slice boundary: 14 files / 15 references, baseline 18 → 3

Taking the card's own risk taxonomy at its word ("one card per neighbourhood, not one sweep"). In
scope — the cheap batch plus the #11071 pair, which is now unblocked (PR #11606 merged
2026-08-24T08:51:24Z):

cloud-login-json-ndjson · generate-agent-retired · generate-skill · hook-body-build-reach ·
init-created-files-summary · invocation-loudness · json-stdout-purity · login-json-ndjson ·
login-json-noninteractive · migrate-exit-code · migrate-meta (2) · qa-empty-glob-exit-code ·
validate-json-warning-parity · validate-top-level-strict

⛔ Out of scope, left for a second slice: serve-app-anchored-optional-import,
serve-app-runtime-hooks, serve-host-fallback-base. These are the three the card flags for the
crypto/auth re-check ($HOME/.objectstack/dev-crypto-key, the OS_SECRET_KEY precedent), and
serve-app-anchored-optional-import additionally carries #11441's measurement. They keep their
baseline entries and this card stays open for them.

So the PR is Part-of #11596, not Fixes — the card returns to pm:queue when it merges.

Serial check — clear

packages/cli/test/** is claimed by two other open PRs today, and neither intersects this slice:

• test(cli): three e2e spawners name the entrypoint they actually reach #11462 (packages/cli e2e tests that spawn bin/run.js as "the SHIPPED entrypoint" never reach dist/ — oclif's ts-path reroutes them to src/ under NODE_ENV=test|development #11317) — serve-mcp-capability-collision, serve-mcp-stdio-answers,
  serve-stdio-stdout-purity. All three already call childEnv(...), so they are not in this
  ledger at all. Disjoint.
• feat(cli): i18n coverage + extract gain the flow/screen bucket #11615 (CLI i18n coverage + extract gain the flow/screen bucket — downstream of #11287 #11485) — adds packages/cli/test/i18n-flow-screen-coverage.test.ts, a new file that
  spawns nothing. Disjoint.

fold-or-serial vs #11595 — answered: NEITHER FOLD NOR SERIAL

Triage asked for this under the five gates. It fails at gate ① (same defect form and same fix):

	#11596	#11595
defect form	spawner passes { ...process.env, X } — a bulk copy	spawner passes no env option at all
fix	replace the spread with childEnv({ X })	introduce an env: the call never had
gate relationship	the leak is in cli-test-child-env.baseline.json; the repair lowers a live ceiling	the gate is silent on this form — there is no ledger entry to lower, and covering it means widening the gate first

Same hazard, different shape, different remedy, and one of the two cannot even be verified by the
existing gate. Folding them would put a gate-widening decision inside a shrink-only burn-down.

Not serial either, on today's board: #11595 is an ungraded finding, so no PR can be in flight
against it. If its 8 files turn out to overlap this slice when it is graded, that card serialises
behind this one — recorded here so the next seat does not have to re-derive it.

---

Generated by Claude Code