Merge latest master into codex/migrate-to-oxlint

packages/ui/tui/package.json

@@ -45,6 +45,7 @@
     "@deepseek-ai/dsh-session-reference": "^0.0.1",
     "@deepseek-ai/dsh-session-title": "^0.0.1",
     "@deepseek-ai/dsh-skill": "^0.0.1",
+    "@deepseek-ai/dsh-subprocess": "^0.0.1",
     "@deepseek-ai/dsh-system-prompt": "^0.0.1",
     "@deepseek-ai/dsh-token-meter": "^0.0.1",
     "@deepseek-ai/dsh-tools": "^0.0.1",
@@ -82,6 +83,7 @@
     "@deepseek-ai/dsh-session-reference": "workspace:^",
     "@deepseek-ai/dsh-session-title": "workspace:^",
     "@deepseek-ai/dsh-skill": "workspace:^",
+    "@deepseek-ai/dsh-subprocess": "workspace:^",
     "@deepseek-ai/dsh-system-prompt": "workspace:^",
     "@deepseek-ai/dsh-token-meter": "workspace:^",
     "@deepseek-ai/dsh-tool-cordis": "workspace:^",

packages/ui/tui/src/chat/helpers.ts

@@ -16,6 +16,7 @@ import {
   visibleWidth,
 } from '@earendil-works/pi-tui'
 import type { Session } from '@deepseek-ai/dsh-session'
+import { scrubbedParentEnv } from '@deepseek-ai/dsh-subprocess'
 
 /** Editor that shows a placeholder without making it editable content. */
 export class HintEditor extends Editor {
@@ -65,13 +66,10 @@ export function formatCwd(cwd: string | undefined): string {
  */
 export function gitBranch(cwd: string): string | undefined {
   try {
-    const env = Object.fromEntries(
-      Object.entries(process.env).filter(([name]) => !/(?:KEY|SECRET|TOKEN)/iu.test(name)),
-    )
     const branch = execFileSync('git', ['branch', '--show-current'], {
       cwd,
       encoding: 'utf8',
-      env,
+      env: scrubbedParentEnv(),
       stdio: ['ignore', 'pipe', 'ignore'],
       timeout: 1_000,
     }).trim()

packages/ui/tui/tests/chat-helpers.spec.ts

@@ -0,0 +1,29 @@
+import { execFileSync } from 'node:child_process'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { gitBranch } from '../src/chat/helpers.ts'
+
+vi.mock('node:child_process', () => ({
+  execFileSync: vi.fn(() => 'main\n'),
+}))
+
+afterEach(() => {
+  vi.unstubAllEnvs()
+  vi.clearAllMocks()
+})
+
+describe('chat helpers', () => {
+  it('scrubs ambient credentials and DSH names from the Git child', () => {
+    vi.stubEnv('TUI_TEST_PASSWORD', 'ambient-password')
+    vi.stubEnv('DSH_TUI_TEST_FLAG', 'ambient-harness-state')
+    expect(gitBranch('/workspace')).toBe('main')
+    const call = vi.mocked(execFileSync).mock.calls[0] as unknown as [
+      string,
+      string[],
+      { env: NodeJS.ProcessEnv },
+    ]
+    expect(call[0]).toBe('git')
+    expect(call[1]).toEqual(['branch', '--show-current'])
+    expect(call[2].env).not.toHaveProperty('TUI_TEST_PASSWORD')
+    expect(call[2].env).not.toHaveProperty('DSH_TUI_TEST_FLAG')
+  })
+})

packages/ui/tui/tsconfig.json

@@ -56,6 +56,9 @@
     {
       "path": "../../skill/skill"
     },
+    {
+      "path": "../../subprocess/subprocess"
+    },
     {
       "path": "../user-interaction"
     },