@@ -10,7 +10,7 @@ Merging blocks when any plan item is unreviewed or stale, an attributed file is
 
 The GitHub adapter reads the current PR base/head, effective branch rulesets, classic branch protection, required check contexts and app identities, and issue cross-references. It ignores review records that are not required checks. Cross-referenced PRs are read in one GraphQL request; repository identity is preserved with each PR number, and cross-repository references fail closed. More than 100 references also fail closed as unknown. Malformed pagination or PR references, partial referenced-PR records, rules without a type, malformed protection objects, missing or malformed check-app identities, and inconsistent check status/conclusion pairs fail closed, while an explicit `null` remains an unbound check. Display status is cached for five seconds and the combined inspection has a 12-second deadline. Each of the two sequential merge-validation inspections has a six-second deadline, keeping their combined validation budget below the 15-second serving request budget. A deadline aborts the underlying GitHub CLI process before releasing the shared in-flight request. An unreadable or incomplete rule source, a pending/missing/failing check, another open or merged PR for the issue, a conflict, or a closed PR blocks merging.
 
-Automatic merging also requires strict required status checks as a server-enforced current-base policy. A client-side fetch cannot supply that guarantee. Merge-queue branches were blocked in this increment because `gh pr merge` can report a successful enqueue before the pull request is merged. Queue support has since landed (#24; see `merge-queue.md`): a queue-capable adapter tracks each attempt until GitHub confirms the merge, removal or failure, and queue rules count as the server-side current-base guard. An adapter without queue inspection still fails closed with a `merge-queue` blocker. The coordinator performs the complete gate twice without using the display cache, verifies the same base/head pair, then re-reads the local review generation immediately before invoking `gh pr merge --match-head-commit` with literal argv. The adapter invalidates its pre-action cache before the command and after either success or refusal. A generation guard prevents inspections started before or during the command from restoring stale cache entries afterward. After command success, the server returns “merge submitted” even if its best-effort status reload fails, and the browser keeps the action disabled until Refresh confirms GitHub state. GitHub's command refusal text is returned to the local UI, and a failed attempt also remains disabled until Refresh loads fresh state. There is no “merge anyway” path around missing atomic protection. Demo mode never constructs the coordinator, including when a gateway is injected.
+Automatic merging also requires strict required status checks as a server-enforced current-base policy. A client-side fetch cannot supply that guarantee. Merge-queue branches were blocked in this increment because `gh pr merge` can report a successful enqueue before the pull request is merged. Queue support has since landed (#24; see `merge-queue.md`): a queue-capable adapter tracks each attempt until GitHub confirms the merge, removal or failure, and queue rules count as the server-side current-base guard. An adapter without queue inspection still fails closed with a `merge-queue` blocker. The coordinator performs the complete gate twice without using the display cache, verifies the same base/head pair, then re-reads the local review generation immediately before invoking `gh pr merge --match-head-commit` with literal argv. Each `gh` process gets only the allowlisted environment in `github/gh-env.ts`; no other server variables are passed on. The adapter invalidates its pre-action cache before the command and after either success or refusal. A generation guard prevents inspections started before or during the command from restoring stale cache entries afterward. After command success, the server returns “merge submitted” even if its best-effort status reload fails, and the browser keeps the action disabled until Refresh confirms GitHub state. GitHub's command refusal text is returned to the local UI, and a failed attempt also remains disabled until Refresh loads fresh state. There is no “merge anyway” path around missing atomic protection. Demo mode never constructs the coordinator, including when a gateway is injected.
 
 Shutdown sets a terminal admission flag before inspecting active work and checks it again after partial request bodies are received. It then stops HTTP admission, aborts and awaits an active merge CLI process, drains requests, and closes the review service. A request admitted before shutdown cannot start a new merge afterward, and a cancelled command cannot outlive the local state that authorized it.
 
 
@@ -50,6 +50,9 @@ dedicated read-only gateway with these boundaries:
 
 - Codeboost invokes `gh` with literal arguments; issue text is parsed only as
   data and is never interpolated into a shell command or prompt.
+- Each `gh` process gets only the allowlisted environment in
+  `github/gh-env.ts`. Other variables from the server, such as unrelated
+  credentials, are not passed on.
 - The gateway fetches open issues and the repository's current collaborators,
   excludes pull requests, follows bounded pagination for both collections, and
   validates every field used for normalization, trust, or ranking. If the
 
@@ -1,5 +1,6 @@
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
+import { ghEnvironment } from './gh-env.ts';
 
 const runFile = promisify(execFile);
 const PAGE_SIZE = 100;
@@ -156,6 +157,7 @@ export class GhIssueGateway implements IssueGateway {
     this.run = run ?? (async (args, options) => (await runFile('gh', [...args], {
       maxBuffer: ISSUE_PAGE_MAX_BYTES,
       signal: options?.signal,
+      env: ghEnvironment(),
     })).stdout);
     this.now = now;
   }
 
@@ -1,5 +1,6 @@
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
+import { ghEnvironment } from './gh-env.ts';
 
 const runFile = promisify(execFile);
 
@@ -87,7 +88,7 @@ export class GhMergeGateway implements MergeGateway, MergeQueueGateway {
       throw new Error('A GitHub repository, pull request, and issue are required for merging.');
     if (config.method !== undefined && !['merge','squash','rebase'].includes(config.method)) throw new Error('GitHub merge method must be merge, squash, or rebase.');
     this.config = config;
-    this.run = run ?? (async (args, options) => (await runFile('gh', [...args], { timeout: 30_000, maxBuffer: 8 * 1024 * 1024, signal: options?.signal })).stdout);
+    this.run = run ?? (async (args, options) => (await runFile('gh', [...args], { timeout: 30_000, maxBuffer: 8 * 1024 * 1024, signal: options?.signal, env: ghEnvironment() })).stdout);
   }
 
   async #json(args: readonly string[], signal?: AbortSignal): Promise<unknown> {
 
@@ -0,0 +1,42 @@
+import { chmodSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { GhMergeGateway, type RunGh } from '../github/merge.ts';
+import { GhIssueGateway } from '../github/issues.ts';
+import { GhPullRequestGateway } from '../github/pull-requests.ts';
+import { GhAlreadyFixedGateway } from '../github/already-fixed.ts';
+
+// Every adapter's own runner, not an injected one: these are the runners the server uses.
+const defaultRunners: [string, () => RunGh][] = [
+  ['merge', () => new GhMergeGateway({ repository: 'owner/repo', pullRequest: 1, issue: 1 }).run],
+  ['issues', () => new GhIssueGateway('owner/repo').run],
+  ['pull requests', () => new GhPullRequestGateway({ repository: 'owner/repo' }).run],
+  ['already fixed', () => new GhAlreadyFixedGateway({ repository: 'owner/repo' }).run],
+];
+
+describe('default gh runners', () => {
+  let dir = '';
+  let path: string | undefined;
+  beforeAll(() => {
+    // A `gh` first on PATH that prints the environment it was given.
+    dir = mkdtempSync(join(tmpdir(), 'codeboost-gh-env-'));
+    writeFileSync(join(dir, 'gh'), '#!/bin/sh\nexec env\n');
+    chmodSync(join(dir, 'gh'), 0o755);
+    path = process.env.PATH;
+    process.env.PATH = `${dir}:${path}`;
+    process.env.CODEBOOST_UNRELATED_SECRET = 'must-not-reach-gh';
+  });
+  afterAll(() => {
+    process.env.PATH = path;
+    delete process.env.CODEBOOST_UNRELATED_SECRET;
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  it.each(defaultRunners)('%s: passes only the gh environment', async (_name, runner) => {
+    const lines = (await runner()(['api', 'user'])).split('\n');
+    expect(lines).toContain('GH_PROMPT_DISABLED=1');
+    expect(lines).toContain(`PATH=${dir}:${path}`);
+    expect(lines.some(line => line.startsWith('CODEBOOST_UNRELATED_SECRET='))).toBe(false);
+  });
+});