From 133e6a3743dd64191187e2cc34b50b73dded4ab5 Mon Sep 17 00:00:00 2001
From: Tyler Skelton <admin@solvyx.xyz>
Date: Wed, 7 Oct 2026 17:42:16 -0700
Subject: [PATCH 1/3] Run checks with their text on fd 3, never in argv

Every check run (bar, mutation, drafting trials, reference try, mission
assertions) starts its shell with one fixed wrapper. The command arrives on
fd 3, which the wrapper reads to the end and closes before evaluating it, so
the text is in no process's cmdline or environment and nothing the check
starts inherits the descriptor.
---
 src/bar.ts       |  8 +++++--
 src/criteria.ts  |  3 +++
 src/mission.ts   |  1 +
 src/reference.ts |  2 +-
 src/run.ts       | 60 ++++++++++++++++++++++++++++++++++++++++--------
 5 files changed, 62 insertions(+), 12 deletions(-)

diff --git a/src/bar.ts b/src/bar.ts
index 8425eb1..f72b3ae 100644
--- a/src/bar.ts
+++ b/src/bar.ts
@@ -1006,7 +1006,7 @@ async function mutationCheck(
     };
   }
   if (!prior) {
-    const baseline = await runCommand(run, { cwd: ctx.cwd, timeoutMs, signal: ctx.signal });
+    const baseline = await runCommand(run, { cwd: ctx.cwd, timeoutMs, signal: ctx.signal, hideCommand: true });
     if (baseline.code !== 0) {
       return {
         ok: false,
@@ -1039,6 +1039,7 @@ async function mutationCheck(
         cwd: ctx.cwd,
         timeoutMs,
         signal: ctx.signal,
+        hideCommand: true,
       });
       // A mutation the command still passes is a line nothing checks — unless
       // it was a boundary nudge and negating the same condition is caught.
@@ -1052,7 +1053,7 @@ async function mutationCheck(
         let negKilled = false;
         if (neg && negText !== null && negText !== file.text) {
           writeFileSync(file.abs, negText, "utf8");
-          const rn = await runCommand(run, { cwd: ctx.cwd, timeoutMs, signal: ctx.signal });
+          const rn = await runCommand(run, { cwd: ctx.cwd, timeoutMs, signal: ctx.signal, hideCommand: true });
           negKilled = rn.code !== 0;
         }
         if (negKilled) boundaryOnly.push(`${m.path}:${m.line} (${m.operator}) — ${m.before.trim()}`);
@@ -2193,6 +2194,9 @@ export async function runCheck(check: Check, ctx: BarContext): Promise<CheckResu
     const r = await runCommand(check.run, {
       cwd: copy?.dir ?? ctx.cwd,
       shell: draftedShell(check),
+      // Never in argv: a hidden check's text there is readable by every
+      // process of this user, the deliverable it runs included (src/run.ts).
+      hideCommand: true,
       timeoutMs: check.timeoutMs,
       maxBuffer: 8 * 1024 * 1024,
       signal: ctx.signal,
diff --git a/src/criteria.ts b/src/criteria.ts
index 85e8083..e52ad02 100644
--- a/src/criteria.ts
+++ b/src/criteria.ts
@@ -318,6 +318,9 @@ export async function preflightCriteria(
         cwd: copy?.dir ?? opts.cwd,
         // Drafted checks (stray set) run under the shell the bar will use.
         shell: draftedShell({ hidden: !!opts.stray, tags: ["task"] }),
+        // A trial run of a check still being drafted runs while the worker
+        // works: its text stays out of argv (src/run.ts).
+        hideCommand: true,
         timeoutMs: opts.timeoutMs ?? 5_000,
         maxBuffer: 1024 * 1024,
         signal: opts.signal,
diff --git a/src/mission.ts b/src/mission.ts
index bb505f6..d485275 100644
--- a/src/mission.ts
+++ b/src/mission.ts
@@ -456,6 +456,7 @@ export async function runAssertions(
         timeoutMs: a.timeoutMs ?? DEFAULT_ASSERTION_TIMEOUT_MS,
         maxBuffer: 256 * 1024,
         signal,
+        hideCommand: true,
       });
       const d = diagnoseFailure(r.code ?? 0, r.stdout, r.stderr);
       out.push({
diff --git a/src/reference.ts b/src/reference.ts
index 8d55042..de43ac3 100644
--- a/src/reference.ts
+++ b/src/reference.ts
@@ -394,7 +394,7 @@ async function writeAndTry(opts: Ask, prompt: string): Promise<Reference | { ok:
     tags: ["task", "reference", "value"],
     hidden: true,
   };
-  const tried = await runCommand(check.run, { cwd: scratch, timeoutMs: REFERENCE_TIMEOUT_MS, maxBuffer: 1024 * 1024 });
+  const tried = await runCommand(check.run, { cwd: scratch, timeoutMs: REFERENCE_TIMEOUT_MS, maxBuffer: 1024 * 1024, hideCommand: true });
   if (tried.timedOut) return { ok: false, why: "the references did not finish on the untouched project" };
   if (tried.code === REFERENCE_SELF_ERROR) {
     const said = lastLines(`${tried.stdout}\n${tried.stderr}`);
diff --git a/src/run.ts b/src/run.ts
index cba5922..0ac3e31 100644
--- a/src/run.ts
+++ b/src/run.ts
@@ -30,8 +30,33 @@ export type RunOptions = {
   shell?: string | true;
   /** Kills the command when it aborts, so a turn can be cancelled mid-command. */
   signal?: AbortSignal;
+  /**
+   * Keep the command text out of every process's argv and environment. The
+   * shell is started with a fixed wrapper (`HIDDEN_WRAPPER`) as its only
+   * script; the command arrives on fd 3, which the wrapper reads to the end
+   * and closes before it runs a word of it. Used for every check run: a
+   * hidden check's text in `/proc/<pid>/cmdline` was readable by any process
+   * of the same user, including the worker's own deliverable when the check
+   * runs it (`/proc/$PPID/cmdline`).
+   */
+  hideCommand?: boolean;
 };
 
+/**
+ * The only script a hidden-command shell is given. Fixed text: nothing of the
+ * command is in it. It reads the command from fd 3 (a socket, which another
+ * process cannot reopen through /proc/<pid>/fd), closes fd 3 so nothing the
+ * command starts inherits it, and evals the text with the holding variable
+ * unset first: the variable is never exported, and it is gone before the
+ * first command of the check runs.
+ */
+export const HIDDEN_WRAPPER = '__maat_c=$(cat <&3) || exit 125; exec 3<&-; eval "unset __maat_c; $__maat_c"';
+
+/** The shell binary a `shell` option names: `true` is the platform's sh. */
+function shellFile(shell: string | true | undefined): string {
+  return shell === undefined || shell === true ? "/bin/sh" : shell;
+}
+
 export type RunResult = {
   stdout: string;
   stderr: string;
@@ -90,20 +115,37 @@ export function draftedShell(check: { hidden?: boolean; tags?: readonly string[]
 export function runCommand(command: string, opts: RunOptions): Promise<RunResult> {
   return new Promise<RunResult>((resolve, reject) => {
     let child: ChildProcess;
+    const hide = opts.hideCommand === true && process.platform !== "win32";
     try {
-      child = spawn(command, {
-        cwd: opts.cwd,
-        shell: opts.shell ?? true,
-        env: opts.env,
-        stdio: ["ignore", "pipe", "pipe"],
-        // Its own process group, so a timeout can kill everything the command
-        // started and not just the shell (see `kill`).
-        detached: process.platform !== "win32",
-      });
+      child = hide
+        ? spawn(shellFile(opts.shell), ["-c", HIDDEN_WRAPPER], {
+            cwd: opts.cwd,
+            env: opts.env,
+            stdio: ["ignore", "pipe", "pipe", "pipe"],
+            detached: true,
+          })
+        : spawn(command, {
+            cwd: opts.cwd,
+            shell: opts.shell ?? true,
+            env: opts.env,
+            stdio: ["ignore", "pipe", "pipe"],
+            // Its own process group, so a timeout can kill everything the command
+            // started and not just the shell (see `kill`).
+            detached: process.platform !== "win32",
+          });
     } catch (e) {
       reject(e as Error);
       return;
     }
+    if (hide) {
+      const feed = child.stdio[3] as import("node:stream").Duplex | null | undefined;
+      // A shell that died before reading (or a wrapper that failed) closes
+      // its end: EPIPE here is the same fact as its exit, reported there.
+      feed?.on("error", () => {});
+      // Written, then dropped: data already sent stays readable by the shell
+      // after this end closes, and an open end would hold "close" back.
+      feed?.end(command, () => feed.destroy());
+    }
 
     const cap = opts.maxBuffer ?? Infinity;
     let stdout = "";

From 382fe854147479616b785bb590001dee06ccccb8 Mon Sep 17 00:00:00 2001
From: Tyler Skelton <admin@solvyx.xyz>
Date: Wed, 7 Oct 2026 17:42:16 -0700
Subject: [PATCH 2/3] Check copy: open each file with O_NOFOLLOW and fstat it

The listing said file, the copy followed whatever was there by the time it
ran. A file swapped for a symlink (or a FIFO) between readdir and copy is now
skipped instead of followed.
---
 src/scratch.ts | 69 ++++++++++++++++++++++++++++++++++++--------------
 1 file changed, 50 insertions(+), 19 deletions(-)

diff --git a/src/scratch.ts b/src/scratch.ts
index 32e4c88..a979636 100644
--- a/src/scratch.ts
+++ b/src/scratch.ts
@@ -36,7 +36,7 @@
  * then runs in place and says so; a reviewer's objection is not run).
  */
 import { constants } from "node:fs";
-import { copyFile, lstat, mkdir, mkdtemp, readdir, readlink, realpath, rm, symlink, utimes, writeFile } from "node:fs/promises";
+import { lstat, mkdir, mkdtemp, open, readdir, readlink, realpath, rm, symlink, writeFile, type FileHandle } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { basename, join } from "node:path";
 import { STATE_DIRS } from "./statedir.js";
@@ -194,24 +194,11 @@ export async function copyTreeOrWhy(
   let bytes = 0;
   const linked: string[] = [];
   const copyOne = async (s: string, d: string): Promise<void> => {
-    let st;
-    try {
-      st = await lstat(s);
-    } catch (e) {
-      if (vanished(e)) return;
-      throw e;
-    }
-    files += 1;
-    bytes += st.size;
-    if (files > maxFiles || bytes > maxBytes) throw new TooBig();
-    try {
-      await copyFile(s, d, constants.COPYFILE_FICLONE);
-      // Same mtimes: `make`, git's index and a check that compares ages all read them.
-      await utimes(d, st.atime, st.mtime);
-    } catch (e) {
-      if (!vanished(e)) throw e;
-      await rm(d, { force: true }).catch(() => {});
-    }
+    await copyRegular(s, d, (size) => {
+      files += 1;
+      bytes += size;
+      if (files > maxFiles || bytes > maxBytes) throw new TooBig();
+    });
   };
   const copyLink = async (s: string, d: string): Promise<void> => {
     try {
@@ -333,3 +320,47 @@ export function runsInCopy(check: { kind: string; hidden?: boolean; tags?: reado
   if (check.kind !== "command") return false;
   return check.hidden === true || (check.tags ?? []).some((t) => t === "task" || t === "mission");
 }
+
+/**
+ * Copy one regular file, judged at the moment it is opened, not from a
+ * directory listing: between `readdir` and the copy the worker can swap a
+ * file for a symlink to something only Maat can read (or a FIFO that never
+ * ends), and a path-based copy follows it into the check's copy. Opened with
+ * O_NOFOLLOW (and O_NONBLOCK, so a FIFO cannot hold the open) and fstat'ed on
+ * the open descriptor; anything that is not a regular file by then is
+ * skipped. `admit` sees the size before a byte is written and may throw.
+ * True when it was copied.
+ */
+export async function copyRegular(s: string, d: string, admit?: (size: number) => void): Promise<boolean> {
+  let src: FileHandle;
+  try {
+    src = await open(s, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0));
+  } catch (e) {
+    // ELOOP: a symlink by now. Not copied, not followed.
+    if (vanished(e) || (e as NodeJS.ErrnoException).code === "ELOOP") return false;
+    throw e;
+  }
+  try {
+    const st = await src.stat();
+    if (!st.isFile()) return false;
+    admit?.(st.size);
+    const out = await open(d, "wx", st.mode & 0o777);
+    try {
+      const buf = Buffer.allocUnsafe(1024 * 1024);
+      for (;;) {
+        const { bytesRead } = await src.read(buf, 0, buf.length, null);
+        if (bytesRead === 0) break;
+        let off = 0;
+        while (off < bytesRead) off += (await out.write(buf, off, bytesRead - off)).bytesWritten;
+      }
+      await out.chmod(st.mode & 0o7777);
+      // Same mtimes: `make`, git's index and a check that compares ages all read them.
+      await out.utimes(st.atime, st.mtime);
+    } finally {
+      await out.close();
+    }
+    return true;
+  } finally {
+    await src.close();
+  }
+}

From 09794ce079e9582a59a728edc94181832dc1c5e5 Mon Sep 17 00:00:00 2001
From: Tyler Skelton <admin@solvyx.xyz>
Date: Wed, 7 Oct 2026 17:42:16 -0700
Subject: [PATCH 3/3] Keep provider keys out of every environment Maat hands on

At startup every credential-shaped variable (*_API_KEY, *_TOKEN, *_SECRET
and similar, XAI_*, GROK_*, TOGETHER_*, MAAT_JUDGE_KEY, MAAT_API_KEY) moves
out of process.env into memory; the worker's shell is scrubbed by the same
shapes. Keys can also arrive without ever being in the exec environment:
MAAT_KEYS_FD (read and closed) or a 0600 MAAT_KEYS_FILE. The local bench
hands keys over on a pipe and the container runner mounts a root-only key
file instead of --env-file.

docs/secrets.md says what this covers and what only a separate worker user
does.
---
 bench/local/container/run-in-container.sh |   8 +-
 bench/local/run.py                        |  60 +++-
 bench/local/tests/test_keys_handover.py   |  32 ++
 docs/secrets.md                           | 127 ++++++++
 electron/main.ts                          |   6 +
 src/acp.ts                                |   5 +-
 src/cli.tsx                               |   9 +
 src/engine.ts                             |  21 +-
 src/env.ts                                |   8 +-
 src/judge.ts                              |   3 +-
 src/opencode.ts                           |   5 +-
 src/secrets.ts                            | 234 ++++++++++++++
 test/secret-hygiene.test.ts               | 368 ++++++++++++++++++++++
 13 files changed, 861 insertions(+), 25 deletions(-)
 create mode 100644 bench/local/tests/test_keys_handover.py
 create mode 100644 docs/secrets.md
 create mode 100644 src/secrets.ts
 create mode 100644 test/secret-hygiene.test.ts

diff --git a/bench/local/container/run-in-container.sh b/bench/local/container/run-in-container.sh
index c41c38c..5912310 100755
--- a/bench/local/container/run-in-container.sh
+++ b/bench/local/container/run-in-container.sh
@@ -56,7 +56,11 @@ url=${BENCH_URL:-https://openrouter.ai/api/v1}
 # The NUC tunnel is the Mac's localhost; from the container it is host.docker.internal.
 url=${url//127.0.0.1/host.docker.internal}; url=${url//localhost/host.docker.internal}
 # The key goes in through a file only this user can read, removed when the
-# run ends: on the command line (-e KEY=...) it showed in every `ps` listing.
+# run ends: on the command line (-e KEY=...) it showed in every `ps` listing,
+# and as --env-file it sat in the container's environment (docker inspect, and
+# every process of the run). It is mounted read-only under /root (mode 700, so
+# the agent user cannot reach it); run.py reads it into memory and hands it to
+# Maat on a pipe (MAAT_KEYS_FD), so it is in no environment at all.
 envf=$(mktemp); chmod 600 "$envf"; trap 'rm -f "$envf"' EXIT
 printf 'OPENROUTER_API_KEY=%s\n' "$key" > "$envf"
 # The graders and reference solutions are mounted where only root can reach (/root is 700),
@@ -83,7 +87,7 @@ fi
 echo "maat $img → $out/${RESULTS:-results.jsonl}"
 docker run --rm --name "maat-bench-$name" \
   -v "$local_dir":/root/bench-src:ro -v "$out":/results -v "$work":/work ${=credmount} \
-  --env-file "$envf" -e REFERENCE="${REFERENCE:-0}" -e BENCH_MODEL="${BENCH_MODEL:-}" \
+  -v "$envf":/root/bench-keys/keys:ro -e BENCH_KEYS_FILE=/root/bench-keys/keys -e REFERENCE="${REFERENCE:-0}" -e BENCH_MODEL="${BENCH_MODEL:-}" \
   -e ARMS="${ARMS:-}" -e BENCH_TASKS="${BENCH_TASKS:-}" -e BENCH_URL="$url" -e BENCH_LIMIT="${BENCH_LIMIT:-600}" -e BENCH_REASONING="${BENCH_REASONING:-}" -e BENCH_GATE="${BENCH_GATE:-}" -e RESULTS="${RESULTS:-results.jsonl}" \
   -e MAAT_BUILD="$sha" -e PYTHONDONTWRITEBYTECODE=1 \
   "$img" sh -c "$startcmd" run "$@"
diff --git a/bench/local/run.py b/bench/local/run.py
index a3e5e1b..2bbf4f5 100644
--- a/bench/local/run.py
+++ b/bench/local/run.py
@@ -16,6 +16,7 @@
 
 import json
 import os
+import re
 import shutil
 import subprocess
 import sys
@@ -38,8 +39,28 @@
 URL = os.environ.get("BENCH_URL") or "https://openrouter.ai/api/v1"
 
 
+def load_keys_file() -> dict:
+    """BENCH_KEYS_FILE: NAME=value lines in a root-only file (the containers mount it). Read into
+    memory here, never put in an environment: `--env-file` put the key in the container's own
+    environment, in `docker inspect`, and in every process of the run."""
+    path = os.environ.get("BENCH_KEYS_FILE")
+    if not path:
+        return {}
+    keys = {}
+    for line in Path(path).read_text().splitlines():
+        name, sep, value = line.strip().partition("=")
+        if sep and name and not name.startswith("#"):
+            keys[name] = value
+    return keys
+
+
+KEYS = load_keys_file()
+
+
 def openrouter_key() -> str:
-    if os.environ.get("OPENROUTER_API_KEY"):  # the container is given the key, not the Mac's auth file
+    if KEYS.get("OPENROUTER_API_KEY"):  # the container is given the key, not the Mac's auth file
+        return KEYS["OPENROUTER_API_KEY"]
+    if os.environ.get("OPENROUTER_API_KEY"):
         return os.environ["OPENROUTER_API_KEY"]
     return subprocess.run(
         ["node", "-e", "import('%s').then(m=>process.stdout.write(m.readAuth().openrouter||''))" % (Path.home() / "Documents/molt-desktop/dist/providers.js")],
@@ -66,6 +87,33 @@ def as_agent(cmd: list, env: dict | None = None) -> tuple[list, dict | None]:
     return ["runuser", "-u", AGENT_USER, "--", "env", f"HOME={home}", *cmd], env
 
 
+# The same shapes Maat treats as credentials (src/secrets.ts).
+SECRET_SUFFIX = re.compile(r"(?:^|_)(?:API_?KEY|ACCESS_?KEY|SECRET(?:_ACCESS)?_?KEY|PRIVATE_?KEY|SECRET|TOKEN|PASSWORD|PASSWD|CREDENTIALS?)$", re.I)
+SECRET_PREFIX = re.compile(r"^(?:XAI|GROK|TOGETHER)_", re.I)
+SECRET_NAMES = {"MAAT_API_KEY", "MOLT_API_KEY", "MAAT_JUDGE_KEY", "MOLT_JUDGE_KEY", "MAAT_KEYS_FD", "MAAT_KEYS_FILE"}
+
+
+def is_secret(name: str) -> bool:
+    return name.upper() in SECRET_NAMES or bool(SECRET_SUFFIX.search(name)) or bool(SECRET_PREFIX.match(name))
+
+
+def keys_by_fd(env: dict) -> tuple[dict, dict, int]:
+    """Take every credential out of the agent's environment and hand it over on a pipe instead
+    (MAAT_KEYS_FD). In the environment it stayed in Maat's /proc/<pid>/environ for the whole run,
+    and a worker of Maat's own user read it back with `cat /proc/$PPID/environ`; deleting it inside
+    Maat does not change that copy. Returns (clean env, Popen kwargs, read end to close after Popen)."""
+    secrets = {k: v for k, v in env.items() if is_secret(k)}
+    clean = {k: v for k, v in env.items() if not is_secret(k)}
+    payload = json.dumps(secrets).encode()
+    if len(payload) > 60_000:  # one write into an empty pipe must not block
+        raise SystemExit("keys too large for the handover pipe")
+    r, w = os.pipe()
+    os.write(w, payload)
+    os.close(w)
+    clean["MAAT_KEYS_FD"] = str(r)
+    return clean, {"pass_fds": (r,)}, r
+
+
 def kill_tree(proc: subprocess.Popen) -> None:
     """Kill the agent's whole process group, and in a container every process of the
     unprivileged agent user (a backend CLI may start its own session)."""
@@ -94,7 +142,7 @@ def provider_capped(out: str, steps: int) -> bool:
 
 def run_molt(d: Path, prompt: str, log: Path) -> dict:
     key = openrouter_key() if "openrouter.ai" in URL else "local"
-    env = os.environ | {"MOLT_API_KEY": key, "MOLT_JUDGMENT": "0"}  # nobody rules on a benchmark run
+    env = os.environ | KEYS | {"MOLT_API_KEY": key, "MOLT_JUDGMENT": "0"}  # nobody rules on a benchmark run
     cmd = [
         "node", str(MOLT), "run", "--url", URL, "--model", os.environ.get("BENCH_MODEL") or MODEL,
         "--reasoning", os.environ.get("BENCH_REASONING") or "low", *(["--yes"] if os.environ.get("BENCH_GATE") == "yes" else ["--sandbox"]), "--json", "--criteria", "auto", "--batch", "--review", "3", "--steps", "200",
@@ -105,11 +153,15 @@ def run_molt(d: Path, prompt: str, log: Path) -> dict:
     ]
     t0 = time.time()
     cmd, env = as_agent(cmd, env)
+    env, fds, keys_fd = keys_by_fd(env)
     # Own session, so the backstop kills the whole tree. subprocess.run's timeout killed only
     # the top process (runuser in the containers) and then waited on the pipe Maat and its
     # backend still held: one hung Grok turn ran 3570 s against a 600 s limit (2026-10-07).
-    proc = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, env=env,
-                            start_new_session=True)
+    try:
+        proc = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, env=env,
+                                start_new_session=True, **fds)
+    finally:
+        os.close(keys_fd)
     try:
         out, err = proc.communicate(timeout=LIMIT)
         timed_out = False
diff --git a/bench/local/tests/test_keys_handover.py b/bench/local/tests/test_keys_handover.py
new file mode 100644
index 0000000..deb2f47
--- /dev/null
+++ b/bench/local/tests/test_keys_handover.py
@@ -0,0 +1,32 @@
+import json
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
+import run  # noqa: E402
+
+
+def test_keys_leave_the_environment_and_arrive_on_the_descriptor():
+    env = {"PATH": os.environ.get("PATH", "/bin"), "MOLT_API_KEY": "k1", "OPENROUTER_API_KEY": "k2",
+           "MAAT_JUDGE_KEY": "k3", "XAI_BASE": "k4", "BENCH_MODEL": "m"}
+    clean, fds, r = run.keys_by_fd(env)
+    try:
+        child = subprocess.run(
+            [sys.executable, "-c", "import os,sys;print(os.read(int(os.environ['MAAT_KEYS_FD']),65536).decode());print(sorted(os.environ))"],
+            env=clean, capture_output=True, text=True, **fds)
+    finally:
+        os.close(r)
+    keys_line, env_line = child.stdout.strip().split("\n")
+    assert json.loads(keys_line) == {"MOLT_API_KEY": "k1", "OPENROUTER_API_KEY": "k2", "MAAT_JUDGE_KEY": "k3", "XAI_BASE": "k4"}
+    names = eval(env_line)
+    assert "BENCH_MODEL" in names and "MAAT_KEYS_FD" in names
+    assert not any(n in names for n in ("MOLT_API_KEY", "OPENROUTER_API_KEY", "MAAT_JUDGE_KEY", "XAI_BASE"))
+
+
+def test_keys_file_is_read_into_memory(tmp_path, monkeypatch):
+    f = tmp_path / "keys"
+    f.write_text("OPENROUTER_API_KEY=sk-x\n# c\n")
+    monkeypatch.setenv("BENCH_KEYS_FILE", str(f))
+    assert run.load_keys_file() == {"OPENROUTER_API_KEY": "sk-x"}
diff --git a/docs/secrets.md b/docs/secrets.md
new file mode 100644
index 0000000..ba0d419
--- /dev/null
+++ b/docs/secrets.md
@@ -0,0 +1,127 @@
+# Keeping keys and hidden checks from the worker
+
+The worker's commands, and the deliverables a check runs, are model-written
+code. When they run as Maat's own user, they can read anything that user can:
+other processes' command lines (`/proc/<pid>/cmdline`, `ps`), the environment
+a process was started with (`/proc/<pid>/environ`, `ps -E` on macOS), files,
+and, where the kernel allows ptrace between processes of one user, memory.
+This page says what Maat does about each, and where that stops.
+
+**Same-user isolation is best effort.** The boundary is running the worker as
+a different user (`--worker-user`, docs/privilege-separation.md once that
+lands), so that Maat's `/proc` entries, state and memory belong to someone
+else. For unattended and benchmark runs, use it. Everything below is defence
+in depth for runs that do not.
+
+## Hidden check commands
+
+A check never appears in an argv. Every check run (bar runs, mutation runs,
+drafting trial runs, reference checks, mission assertions; anything that goes
+through `runCheck` or `preflightCriteria`) starts its shell with one fixed
+script, `HIDDEN_WRAPPER` in `src/run.ts`:
+
+```sh
+__maat_c=$(cat <&3) || exit 125; exec 3<&-; eval "unset __maat_c; $__maat_c"
+```
+
+The command arrives on fd 3, a socket (which another process cannot reopen
+through `/proc/<pid>/fd/3`). The wrapper reads it to the end, closes fd 3 so
+nothing the check starts inherits it, and evals it with the holding variable
+unset first; the variable is never exported. So a deliverable that reads
+`/proc/$PPID/cmdline` gets the wrapper, not the check, and a process scanning
+`/proc/*/cmdline` while the check runs finds nothing.
+
+What it does not cover:
+
+- A check whose own command line contains its logic, such as
+  `python3 -c "import sol; assert sol.f(2) == 4"`, runs the deliverable inside
+  that python process, whose argv is the check. The wrapper hides the shell
+  line, not argv words the shell then passes to a program. Prefer checks that
+  run the deliverable as its own process and compare its output.
+- Maat's own memory holds every check. A worker of the same user, where
+  `kernel.yama.ptrace_scope` is 0 (common in containers), can read it.
+- A failing check's output goes back to the model, masked only for verbatim
+  copies of the command.
+
+## Provider keys
+
+At startup (`captureSecrets()`, `src/secrets.ts`, called first thing by the
+CLI and the desktop app) Maat moves every credential-shaped variable out of
+its environment into memory. Nothing it starts afterwards inherits one,
+whatever environment the spawn site builds. A credential is:
+
+- any name ending in `_API_KEY`, `_APIKEY`, `_ACCESS_KEY`, `_SECRET_KEY`,
+  `_SECRET_ACCESS_KEY`, `_PRIVATE_KEY`, `_SECRET`, `_TOKEN`, `_PASSWORD`,
+  `_PASSWD`, `_CREDENTIAL(S)`;
+- any `XAI_*`, `GROK_*`, `TOGETHER_*`;
+- `MAAT_API_KEY`, `MOLT_API_KEY`, `MAAT_JUDGE_KEY`, `MOLT_JUDGE_KEY`.
+
+`MAAT_KEEP_ENV=NAME,NAME` lets named variables through when a task needs its
+own token (`HF_TOKEN` for a download, say). The model's own client processes
+(the Grok Build and OpenCode backends) are given back the keys they need; the
+worker's shell, background jobs and checks never are.
+
+Moving a key out of `process.env` does not remove it from the copy of the
+environment the kernel kept when Maat was started. On Linux,
+`/proc/<maat pid>/environ` still returns it to any process of the same user,
+including the worker's bash, which is Maat's child. On macOS, `ps -E` does the
+same. So keys should not be in Maat's exec environment at all:
+
+| Way in | Where the key is visible to a same-user worker |
+| --- | --- |
+| Environment variable (`OPENROUTER_API_KEY=… maat run`) | Maat's `/proc/<pid>/environ` for the whole run |
+| `MAAT_KEYS_FD=<n>` | nowhere: read to the end and closed at startup |
+| `MAAT_KEYS_FILE=<path>` | the file, for as long as it exists |
+
+Both carry `NAME=value` lines (`export` and quotes allowed, `#` comments) or a
+JSON object. `MAAT_KEYS_FILE` must be a regular file of Maat's user with no
+group or other permissions (mode 0600), or Maat refuses to start. Remove it
+once Maat has started, or prefer the descriptor.
+
+From a shell, without the key passing through an argv or the environment:
+
+```sh
+MAAT_KEYS_FD=3 maat run --sandbox … 3< ~/.config/maat/keys
+```
+
+From Python (what `bench/local/run.py` does):
+
+```python
+r, w = os.pipe(); os.write(w, json.dumps(keys).encode()); os.close(w)
+subprocess.Popen(cmd, env=clean | {"MAAT_KEYS_FD": str(r)}, pass_fds=(r,))
+os.close(r)
+```
+
+The bench container runner mounts the key file read-only under `/root`
+(mode 700, out of the agent user's reach) instead of `--env-file`, which had
+put it in the container's environment and in `docker inspect`; `run.py`
+reads it into memory and hands it to Maat on a pipe.
+
+What it does not cover, with a worker of Maat's own user:
+
+- Maat's stored login (`auth.json` in its config directory) is a file that
+  user can read.
+- Maat's memory holds the keys (see ptrace above).
+- The model's own backend process (Grok Build, OpenCode) is given its keys in
+  its environment; if that backend runs the worker's commands itself, they
+  are its children.
+- `bench/harbor` still passes `MOLT_API_KEY` through the harness's exec
+  environment.
+
+All of these are closed by a different user for the worker.
+
+## Tests
+
+`test/secret-hygiene.test.ts` runs a long check carrying a marker and scans
+every process's argv and environment for it (`/proc` on Linux, `ps -E` on
+macOS), with an unhidden control run that the scan must find; has a check run
+a child that reads every ancestor's argv and environment; and runs the real
+CLI with a stub provider whose bash call does the same for keys given by fd,
+by file and by environment. The Linux half is meant for a container:
+
+```sh
+docker run --rm -v "$PWD":/src:ro node:22-bookworm bash -c '
+  mkdir /work && cd /src && tar --exclude=./node_modules -cf - . | tar -xf - -C /work
+  cp -a /src/node_modules /work/ && chown -R node:node /work
+  su node -c "cd /work && node --test dist-test/test/secret-hygiene.test.js"'
+```
diff --git a/electron/main.ts b/electron/main.ts
index 24aa0f4..070f421 100644
--- a/electron/main.ts
+++ b/electron/main.ts
@@ -40,6 +40,7 @@ import { desktopSurfaces } from "./theme-surfaces.js";
 import { barInitText, parseJournal, mutatesSession } from "./limits.js";
 import { resolvePath, PATH_PROBE, type PathFixReport } from "./login-path.js";
 import { Engine, MAX_STEPS } from "../src/engine.js";
+import { captureSecrets } from "../src/secrets.js";
 import { Archive } from "../src/archive.js";
 import { Receipts, receiptName } from "../src/receipts.js";
 import { Journal } from "../src/journal.js";
@@ -1063,6 +1064,11 @@ function fixPath(): PathFixReport {
   return report;
 }
 
+// Credentials out of the environment and into memory before any session,
+// check or backend is spawned (src/secrets.ts). A refused keys source is
+// reported, not fatal: the window still opens and keys can be entered there.
+for (const p of captureSecrets().problems) console.error(`maat: ${p}`);
+
 const pathFix = fixPath();
 
 // A driven window (self-check, self-drive, e2e) gets a profile of its own.
diff --git a/src/acp.ts b/src/acp.ts
index 16de030..8e06a60 100644
--- a/src/acp.ts
+++ b/src/acp.ts
@@ -71,6 +71,7 @@
  * `unaccountedTools()` reports anything that got through, and the session
  * surfaces it as an `info` event rather than discovering it in a receipt.
  */
+import { withSecrets } from "./secrets.js";
 import { spawn, type ChildProcess } from "node:child_process";
 import { readFileSync } from "node:fs";
 import { createServer, type Server } from "node:http";
@@ -530,7 +531,9 @@ export class AcpConnection {
       // `electron/login-path.ts` has already repaired process.env.PATH by the
       // time anything gets here.
       env: {
-        ...(this.spec.childEnv ? this.spec.childEnv(process.env) : process.env),
+        // The backend is the model's own client and needs its credentials,
+        // which captureSecrets() took out of process.env (src/secrets.ts).
+        ...(this.spec.childEnv ? this.spec.childEnv(withSecrets(process.env)) : withSecrets(process.env)),
         ...this.spec.env,
         ...(this.spec.env ? { PWD: this.opts.cwd ?? process.cwd() } : {}),
       },
diff --git a/src/cli.tsx b/src/cli.tsx
index 3ad7345..50e2316 100644
--- a/src/cli.tsx
+++ b/src/cli.tsx
@@ -7,6 +7,7 @@
  * bar is not met, so molt can sit in CI, in a script, or in a benchmark
  * harness without a human watching.
  */
+import { captureSecrets } from "./secrets.js";
 import { acpAgentFor, acpHealth } from "./acp.js";
 import { endpointDeprecation, expandEndpointShorthand, isOpencodeUrl, opencodeModelProblem } from "./endpoint.js";
 import { existsSync, readFileSync, statSync } from "node:fs";
@@ -2196,6 +2197,14 @@ export async function main(argv = process.argv.slice(2)): Promise<number> {
   // (Terminal-Bench kv-store-grpc, rstan-to-pystan: exit 143, no verdict).
   // A plain title keeps the task out of `ps`, `pgrep -f` and `pkill -f`.
   if (argv.length > 1) process.title = "maat";
+  // Credentials out of the environment and into memory before anything is
+  // spawned, so no child inherits one (src/secrets.ts). MAAT_KEYS_FD and
+  // MAAT_KEYS_FILE deliver keys that were never in the environment at all.
+  const keys = captureSecrets();
+  if (keys.problems.length) {
+    process.stderr.write(keys.problems.map((p) => `maat: ${p}\n`).join(""));
+    return 2;
+  }
   let args: Args;
   try {
     args = parseArgs(argv, storedEndpoint());
diff --git a/src/engine.ts b/src/engine.ts
index aa34918..a9bb261 100644
--- a/src/engine.ts
+++ b/src/engine.ts
@@ -19,6 +19,7 @@
  *  - Nothing is summarized by a model, ever.
  */
 import { runCommand } from "./run.js";
+import { scrubEnv, secretValue, secretValues } from "./secrets.js";
 import { describeStart, listBackground, startBackground, stopBackground } from "./background.js";
 import { reviewClaim, type Review } from "./review.js";
 import { judgeEffort, judgeTarget } from "./judge.js";
@@ -1029,15 +1030,6 @@ export function expandAct(call: { id: string; function?: { name?: string; argume
   return { analysis, subs, unusable };
 }
 
-const SECRET_ENV = [
-  "MOLT_API_KEY",
-  "OPENAI_API_KEY",
-  "OPENROUTER_API_KEY",
-  "ANTHROPIC_API_KEY",
-  "GROQ_API_KEY",
-  "MISTRAL_API_KEY",
-];
-
 /** Per-turn options. Nothing here changes the session's configuration. */
 export type RunOptions = {
   /**
@@ -1647,10 +1639,13 @@ function exitWord(e: { code: number | null; signal: string | null }): string {
   return e.code !== null ? `with exit ${e.code}` : `on ${e.signal ?? "a signal"}`;
 }
 
+/**
+ * The environment the worker's commands get: no credential of any shape
+ * (src/secrets.ts). Normally `captureSecrets()` has already emptied
+ * process.env of them at startup; this covers a library caller that did not.
+ */
 function scrubbedEnv(): NodeJS.ProcessEnv {
-  const env = { ...process.env };
-  for (const k of SECRET_ENV) delete env[k];
-  return env;
+  return scrubEnv(process.env);
 }
 
 function sha256Of(p: string): string | null {
@@ -2789,7 +2784,7 @@ export class Engine {
 
   /** Values that must not appear on screen or in a file molt writes. */
   private secrets(): (string | undefined)[] {
-    return [this.cfg.apiKey, env("API_KEY"), process.env.OPENAI_API_KEY];
+    return [this.cfg.apiKey, env("API_KEY"), secretValue("OPENAI_API_KEY"), ...secretValues()];
   }
 
   get autonomy(): Autonomy {
diff --git a/src/env.ts b/src/env.ts
index 5e78eb8..a804ef5 100644
--- a/src/env.ts
+++ b/src/env.ts
@@ -1,8 +1,12 @@
+import { secretValue } from "./secrets.js";
+
 /**
  * Maat Agent's environment variables: `MAAT_*`, with the engine's older
  * `MOLT_*` names still read, so existing scripts and CI keep working.
- * `MAAT_` wins when both are set.
+ * `MAAT_` wins when both are set. A credential (`MAAT_API_KEY`) is found in
+ * memory once `captureSecrets()` has taken it out of the environment
+ * (src/secrets.ts).
  */
 export function env(name: string): string | undefined {
-  return process.env[`MAAT_${name}`] ?? process.env[`MOLT_${name}`];
+  return secretValue(`MAAT_${name}`) ?? secretValue(`MOLT_${name}`);
 }
diff --git a/src/judge.ts b/src/judge.ts
index 07fd89e..a39506e 100644
--- a/src/judge.ts
+++ b/src/judge.ts
@@ -5,10 +5,11 @@
  * checks are not written with the same blind spots as the work they judge.
  */
 import { expandEndpointShorthand } from "./endpoint.js";
+import { withSecrets } from "./secrets.js";
 
 export type Target = { baseUrl: string; apiKey?: string; model: string };
 
-export function judgeTarget<T extends Target>(worker: T, env: NodeJS.ProcessEnv = process.env): T {
+export function judgeTarget<T extends Target>(worker: T, env: NodeJS.ProcessEnv = withSecrets(process.env)): T {
   const model = env.MAAT_JUDGE_MODEL?.trim();
   if (!model) return worker;
   const baseUrl = (env.MAAT_JUDGE_URL?.trim() && expandEndpointShorthand(env.MAAT_JUDGE_URL)) || worker.baseUrl;
diff --git a/src/opencode.ts b/src/opencode.ts
index 34d2800..2c95779 100644
--- a/src/opencode.ts
+++ b/src/opencode.ts
@@ -36,6 +36,7 @@
  * - The project directory comes from `PWD` as well as the cwd, so both are set
  *   to the empty temp directory, and `--dir` is passed too.
  */
+import { withSecrets } from "./secrets.js";
 import { spawn } from "node:child_process";
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
@@ -100,7 +101,7 @@ const FOREIGN_ENV =
  * The OpenCode child's environment: the caller's, minus every other provider's
  * credentials and any config path, plus Maat's own config (Zen only).
  */
-export function opencodeChildEnv(base: NodeJS.ProcessEnv = process.env): NodeJS.ProcessEnv {
+export function opencodeChildEnv(base: NodeJS.ProcessEnv = withSecrets(process.env)): NodeJS.ProcessEnv {
   const out: NodeJS.ProcessEnv = {};
   for (const [k, v] of Object.entries(base)) {
     // OpenCode's own key (OPENCODE_API_KEY) is the Zen account, so it stays.
@@ -111,7 +112,7 @@ export function opencodeChildEnv(base: NodeJS.ProcessEnv = process.env): NodeJS.
   return out;
 }
 
-export function opencodeEnv(dir: string, base: NodeJS.ProcessEnv = process.env): NodeJS.ProcessEnv {
+export function opencodeEnv(dir: string, base: NodeJS.ProcessEnv = withSecrets(process.env)): NodeJS.ProcessEnv {
   return { ...opencodeChildEnv(base), PWD: dir };
 }
 
diff --git a/src/secrets.ts b/src/secrets.ts
new file mode 100644
index 0000000..38fd640
--- /dev/null
+++ b/src/secrets.ts
@@ -0,0 +1,234 @@
+/**
+ * Provider credentials, kept in memory and out of every environment Maat
+ * hands to anything else.
+ *
+ * The worker's commands run as children of Maat. Scrubbing a handful of key
+ * names from the child's environment (what the engine used to do) left two
+ * ways through: any credential shape the list did not name reached the child
+ * directly, and every key was still in Maat's own environment, which a child
+ * of the same user reads back from `/proc/$PPID/environ` on Linux (and with
+ * `ps -E` on macOS). Three layers here:
+ *
+ *  1. `captureSecrets()` runs at startup. Every credential-shaped variable is
+ *     moved out of `process.env` into a private map, so nothing Maat spawns
+ *     afterwards inherits it, whatever env the spawn site builds.
+ *  2. Keys can arrive without ever being in Maat's exec environment:
+ *     `MAAT_KEYS_FD` (an inherited descriptor, read to the end and closed) or
+ *     `MAAT_KEYS_FILE` (a mode-0600 file of this user). Step 1 cannot reach the
+ *     copy of the environment the kernel kept from exec; this does, because
+ *     the key was never in it.
+ *  3. `scrubEnv()` is the child-side filter, kept for library callers that
+ *     never call `captureSecrets()`.
+ *
+ * All of this is best effort while the worker runs as Maat's own user: such
+ * a worker can still read a keys file while it exists, Maat's auth file, or
+ * (where ptrace is allowed) Maat's memory. Running the worker as another user
+ * (`--worker-user`) is the boundary; see docs/secrets.md.
+ */
+import { closeSync, fstatSync, openSync, readSync } from "node:fs";
+
+/** Names that hold a credential: any `*_API_KEY`, `*_TOKEN`, `*_SECRET` shape, and the like. */
+const SECRET_SUFFIX = /(?:^|_)(?:API_?KEY|ACCESS_?KEY|SECRET(?:_ACCESS)?_?KEY|PRIVATE_?KEY|SECRET|TOKEN|PASSWORD|PASSWD|CREDENTIALS?)$/i;
+/** Whole families: a provider's other variables can carry or point at its key. */
+const SECRET_PREFIX = /^(?:XAI|GROK|TOGETHER)_/i;
+/** Named outright, whatever the patterns above say. */
+const SECRET_NAMES = new Set([
+  "MAAT_API_KEY",
+  "MOLT_API_KEY",
+  "MAAT_JUDGE_KEY",
+  "MOLT_JUDGE_KEY",
+  "MAAT_KEYS_FD",
+  "MAAT_KEYS_FILE",
+]);
+
+/** `MAAT_KEEP_ENV=NAME,NAME`: credential-shaped names the user wants the worker to keep (a task's own token). */
+function kept(env: NodeJS.ProcessEnv): Set<string> {
+  const raw = env.MAAT_KEEP_ENV ?? env.MOLT_KEEP_ENV ?? "";
+  return new Set(
+    raw
+      .split(",")
+      .map((s) => s.trim())
+      .filter((s) => s && !SECRET_NAMES.has(s.toUpperCase())),
+  );
+}
+
+export function isSecretName(name: string): boolean {
+  return SECRET_NAMES.has(name.toUpperCase()) || SECRET_SUFFIX.test(name) || SECRET_PREFIX.test(name);
+}
+
+const store = new Map<string, string>();
+
+export type CaptureReport = {
+  /** Variables moved out of the environment into memory. */
+  moved: string[];
+  /** Names read from MAAT_KEYS_FD / MAAT_KEYS_FILE. */
+  loaded: string[];
+  /** Why a keys source was refused or unreadable. Never contains a value. */
+  problems: string[];
+};
+
+/** `NAME=value` lines (`export` and quotes allowed, `#` comments), or a JSON object of strings. */
+export function parseKeys(text: string): Map<string, string> {
+  const out = new Map<string, string>();
+  const t = text.trim();
+  if (t.startsWith("{")) {
+    const obj = JSON.parse(t) as Record<string, unknown>;
+    for (const [k, v] of Object.entries(obj)) if (typeof v === "string") out.set(k, v);
+    return out;
+  }
+  for (const raw of text.split(/\r?\n/)) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    const m = /^(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.*)$/.exec(line);
+    if (!m) continue;
+    let v = m[2]!;
+    if (v.length >= 2 && ((v.startsWith('"') && v.endsWith('"')) || (v.startsWith("'") && v.endsWith("'")))) v = v.slice(1, -1);
+    out.set(m[1]!, v);
+  }
+  return out;
+}
+
+/** Read a descriptor to its end. A non-blocking pipe end is waited on, briefly. */
+function readAll(fd: number): string {
+  const chunks: Buffer[] = [];
+  const buf = Buffer.alloc(64 * 1024);
+  const deadline = Date.now() + 5_000;
+  const nap = new Int32Array(new SharedArrayBuffer(4));
+  for (;;) {
+    let n: number;
+    try {
+      n = readSync(fd, buf, 0, buf.length, null);
+    } catch (e) {
+      if ((e as NodeJS.ErrnoException).code === "EAGAIN" && Date.now() < deadline) {
+        Atomics.wait(nap, 0, 0, 10);
+        continue;
+      }
+      throw e;
+    }
+    if (n === 0) break;
+    chunks.push(Buffer.from(buf.subarray(0, n)));
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+
+function loadFd(raw: string, report: CaptureReport): Map<string, string> | null {
+  const fd = Number(raw);
+  if (!Number.isInteger(fd) || fd < 3) {
+    report.problems.push(`MAAT_KEYS_FD must be a descriptor number of 3 or more, not ${JSON.stringify(raw.slice(0, 20))}`);
+    return null;
+  }
+  try {
+    return parseKeys(readAll(fd));
+  } catch (e) {
+    report.problems.push(`MAAT_KEYS_FD ${fd} could not be read: ${(e as NodeJS.ErrnoException).code ?? "unreadable"}`);
+    return null;
+  } finally {
+    // Closed whatever happened: a worker started later must not inherit it,
+    // and /proc/<maat>/fd/<n> must not lead anywhere.
+    try {
+      closeSync(fd);
+    } catch {
+      /* already closed */
+    }
+  }
+}
+
+function loadFile(path: string, report: CaptureReport): Map<string, string> | null {
+  let fd: number;
+  try {
+    fd = openSync(path, "r");
+  } catch (e) {
+    report.problems.push(`MAAT_KEYS_FILE could not be opened: ${(e as NodeJS.ErrnoException).code ?? "unreadable"}`);
+    return null;
+  }
+  try {
+    const st = fstatSync(fd);
+    if (!st.isFile()) {
+      report.problems.push("MAAT_KEYS_FILE is not a regular file");
+      return null;
+    }
+    if (process.platform !== "win32") {
+      if ((st.mode & 0o077) !== 0) {
+        report.problems.push(`MAAT_KEYS_FILE is readable by others (mode ${(st.mode & 0o777).toString(8)}); chmod 600 it`);
+        return null;
+      }
+      if (typeof process.getuid === "function" && st.uid !== process.getuid()) {
+        report.problems.push("MAAT_KEYS_FILE belongs to another user");
+        return null;
+      }
+    }
+    return parseKeys(readAll(fd));
+  } catch (e) {
+    report.problems.push(`MAAT_KEYS_FILE could not be read: ${(e as Error).message.split("\n")[0]}`);
+    return null;
+  } finally {
+    closeSync(fd);
+  }
+}
+
+/**
+ * Move every credential out of `env` (by default `process.env`, which is what
+ * every spawn without an explicit env inherits) and into memory, after
+ * loading any keys passed through MAAT_KEYS_FD / MAAT_KEYS_FILE. Idempotent:
+ * a second call moves whatever arrived since and reloads nothing.
+ */
+export function captureSecrets(env: NodeJS.ProcessEnv = process.env): CaptureReport {
+  const report: CaptureReport = { moved: [], loaded: [], problems: [] };
+  const fdRaw = env.MAAT_KEYS_FD ?? env.MOLT_KEYS_FD;
+  const fileRaw = env.MAAT_KEYS_FILE ?? env.MOLT_KEYS_FILE;
+  delete env.MAAT_KEYS_FD;
+  delete env.MOLT_KEYS_FD;
+  delete env.MAAT_KEYS_FILE;
+  delete env.MOLT_KEYS_FILE;
+  for (const got of [fdRaw ? loadFd(fdRaw, report) : null, fileRaw ? loadFile(fileRaw, report) : null]) {
+    if (!got) continue;
+    for (const [k, v] of got) {
+      store.set(k, v);
+      report.loaded.push(k);
+    }
+  }
+  const keep = kept(env);
+  for (const k of Object.keys(env)) {
+    if (!isSecretName(k) || keep.has(k)) continue;
+    const v = env[k];
+    // A key handed over explicitly wins over the same name in the environment.
+    if (v !== undefined && !store.has(k)) store.set(k, v);
+    delete env[k];
+    report.moved.push(k);
+  }
+  return report;
+}
+
+/** A credential by name: the in-memory copy first, then the environment (for callers that never captured). */
+export function secretValue(name: string): string | undefined {
+  return store.get(name) ?? process.env[name];
+}
+
+/** Every credential held, for redaction (a value too short to be a key would redact ordinary text). */
+export function secretValues(): string[] {
+  return [...store].filter(([k, v]) => isSecretName(k) && v.length >= 8).map(([, v]) => v);
+}
+
+/**
+ * `base` plus the credentials held in memory. Only for the model's own
+ * client processes (an ACP or OpenCode backend), which need their keys; never
+ * for anything that runs the worker's or a check's commands.
+ */
+export function withSecrets(base: NodeJS.ProcessEnv = process.env): NodeJS.ProcessEnv {
+  const out: NodeJS.ProcessEnv = { ...base };
+  for (const [k, v] of store) out[k] ??= v;
+  return out;
+}
+
+/** A copy of `base` with every credential-shaped variable removed (MAAT_KEEP_ENV names stay). */
+export function scrubEnv(base: NodeJS.ProcessEnv = process.env): NodeJS.ProcessEnv {
+  const keep = kept(base);
+  const out: NodeJS.ProcessEnv = {};
+  for (const [k, v] of Object.entries(base)) if (!isSecretName(k) || keep.has(k)) out[k] = v;
+  return out;
+}
+
+/** Tests only. */
+export function _resetSecrets(): void {
+  store.clear();
+}
diff --git a/test/secret-hygiene.test.ts b/test/secret-hygiene.test.ts
new file mode 100644
index 0000000..c60891f
--- /dev/null
+++ b/test/secret-hygiene.test.ts
@@ -0,0 +1,368 @@
+/**
+ * What a worker of Maat's own user can read back from the processes around
+ * it: a hidden check's command text, and the provider keys.
+ *
+ * Checks ran as `sh -c "<command>"`, so the command sat in
+ * /proc/<pid>/cmdline (or `ps` on macOS) for as long as it ran, and a check
+ * that runs the worker's deliverable handed that deliverable its own parent's
+ * argv. Keys were scrubbed from the worker's env by six names, and every key
+ * stayed in Maat's own exec environment, which /proc/$PPID/environ returns.
+ *
+ * The Linux half of this file reads /proc directly; run it in a
+ * node:22-bookworm container (docs/secrets.md). On macOS the same assertions
+ * go through `ps -ww -E`.
+ */
+import assert from "node:assert/strict";
+import { execFileSync, spawn } from "node:child_process";
+import { chmodSync, closeSync, existsSync, fstatSync, mkdirSync, openSync, readFileSync, readdirSync, symlinkSync, writeFileSync } from "node:fs";
+import { createServer, type Server } from "node:http";
+import { join } from "node:path";
+import { after, describe, it } from "node:test";
+import { runCheck, type BarContext } from "../src/bar.js";
+import { preflightCriteria } from "../src/criteria.js";
+import { env } from "../src/env.js";
+import { HIDDEN_WRAPPER, runCommand } from "../src/run.js";
+import { copyRegular } from "../src/scratch.js";
+import { _resetSecrets, captureSecrets, isSecretName, parseKeys, scrubEnv, secretValue, withSecrets } from "../src/secrets.js";
+import type { Check } from "../src/types.js";
+import { workspace } from "./helpers.js";
+
+const linux = process.platform === "linux";
+const posix = process.platform !== "win32";
+const cleanups: (() => void | Promise<void>)[] = [];
+after(async () => {
+  for (const c of cleanups) await c();
+});
+function ws(): string {
+  const w = workspace();
+  cleanups.push(w.cleanup);
+  return w.dir;
+}
+const marker = () => `MAATMARK${Math.random().toString(36).slice(2)}${Date.now().toString(36)}`;
+const wait = (ms: number) => new Promise((r) => setTimeout(r, ms));
+
+/** Every process whose argv or environment this user can read and that contains `needle`. */
+function processesHolding(needle: string): string[] {
+  const hits: string[] = [];
+  if (linux) {
+    for (const pid of readdirSync("/proc").filter((p) => /^\d+$/.test(p))) {
+      for (const f of ["cmdline", "environ"]) {
+        try {
+          if (readFileSync(`/proc/${pid}/${f}`).includes(needle)) hits.push(`${pid}/${f}`);
+        } catch {
+          /* gone, or not ours */
+        }
+      }
+    }
+    return hits;
+  }
+  // -E appends each process's environment (own processes only).
+  const ps = execFileSync("ps", ["-axww", "-E", "-o", "pid=,command="], { encoding: "utf8", maxBuffer: 64 * 1024 * 1024 });
+  for (const line of ps.split("\n")) if (line.includes(needle)) hits.push(line.trim().split(/\s+/)[0]!);
+  return hits;
+}
+
+/**
+ * A deliverable that reads what it can: its own environment, whether it
+ * inherited fd 3, and every ancestor's argv and environment, into `$1`.
+ * This is the worker's code as a value check (or the worker's bash) runs it.
+ */
+const PEEK = `#!/bin/sh
+out="$1"
+{
+  echo "== own =="
+  env
+  echo "== ancestors =="
+  (true <&3) 2>/dev/null && echo FD3-INHERITED
+  p=$PPID
+  while [ -n "$p" ] && [ "$p" -gt 1 ]; do
+    if [ -r /proc/$p/cmdline ]; then
+      tr '\\0' ' ' < /proc/$p/cmdline; echo
+      tr '\\0' '\\n' < /proc/$p/environ 2>/dev/null
+      p=$(sed 's/.*) //' /proc/$p/stat | cut -d' ' -f2)
+    else
+      ps -ww -E -o command= -p $p
+      p=$(ps -o ppid= -p $p | tr -d ' ')
+    fi
+  done
+} > "$out" 2>&1
+`;
+
+function peekProject(): { dir: string; out: string } {
+  const dir = ws();
+  writeFileSync(join(dir, "peek.sh"), PEEK);
+  chmodSync(join(dir, "peek.sh"), 0o755);
+  return { dir, out: join(ws(), "seen.txt") };
+}
+
+describe("a check's command text", { skip: !posix }, () => {
+  it("is in no process's argv or environment while it runs (and the scan does see an unhidden one)", async () => {
+    const dir = ws();
+    const hidden = marker();
+    const plain = marker();
+    const running = [
+      runCommand(`: ${hidden}; sleep 2; true`, { cwd: dir, hideCommand: true, timeoutMs: 20_000 }),
+      runCommand(`: ${plain}; sleep 2; true`, { cwd: dir, timeoutMs: 20_000 }),
+    ];
+    await wait(700);
+    const hiddenHits = processesHolding(hidden);
+    const plainHits = processesHolding(plain);
+    const done = await Promise.all(running);
+    assert.deepEqual(done.map((r) => r.code), [0, 0]);
+    // The control: run the old way, the scan finds it. Without this, an empty
+    // scan would prove only that the scan is blind.
+    assert.ok(plainHits.length > 0, "the scan should see a command passed as argv");
+    assert.deepEqual(hiddenHits, [], `hidden command visible in: ${hiddenHits.join(", ")}`);
+  });
+
+  it("still runs as written: exit codes, $0, no leftover variable, parse errors, long commands", async () => {
+    const dir = ws();
+    const r = await runCommand(`echo "$0"; [ -n "$__maat_c" ] && echo LEAKED-VAR; exit 7`, { cwd: dir, hideCommand: true, shell: "/bin/sh" });
+    assert.equal(r.code, 7);
+    assert.match(r.stdout, /sh/);
+    assert.doesNotMatch(r.stdout, /LEAKED-VAR/);
+    const bad = await runCommand(`if then fi (`, { cwd: dir, hideCommand: true });
+    assert.notEqual(bad.code, 0);
+    assert.match(bad.stderr, /syntax error|unexpected/i);
+    const big = "x".repeat(300_000);
+    const long = await runCommand(`v='${big}'; echo \${#v}`, { cwd: dir, hideCommand: true });
+    assert.equal(long.stdout.trim(), String(big.length));
+  });
+
+  it("cannot be read by a child of the check from its parent's cmdline or environment", async () => {
+    const { dir, out } = peekProject();
+    const m = marker();
+    const r = await runCommand(`: ${m}; sh ./peek.sh '${out}'; true`, { cwd: dir, hideCommand: true });
+    assert.equal(r.code, 0);
+    const seen = readFileSync(out, "utf8");
+    assert.ok(seen.includes("__maat_c"), "the child should have read its parent's (wrapper) argv");
+    assert.ok(!seen.includes(m), "the child read the hidden command");
+    assert.ok(!seen.includes("FD3-INHERITED"), "the child inherited the command descriptor");
+    // Control: the old way, the same child does read it.
+    const m2 = marker();
+    await runCommand(`: ${m2}; sh ./peek.sh '${out}'; true`, { cwd: dir });
+    assert.ok(readFileSync(out, "utf8").includes(m2));
+  });
+
+  it("does not reach a deliverable through the bar's hidden task check", async () => {
+    const { dir, out } = peekProject();
+    const m = marker();
+    const check = {
+      name: "value",
+      kind: "command",
+      run: `: ${m}; sh ./peek.sh '${out}' && test -s '${out}'`,
+      expectExit: 0,
+      timeoutMs: 20_000,
+      tags: ["task", "value"],
+      hidden: true,
+    } as Check;
+    const ctx = { cwd: dir, record: [], ledger: [], archivedBatches: 0 } as unknown as BarContext;
+    const res = await runCheck(check, ctx);
+    assert.equal(res.ok, true, res.output);
+    const seen = readFileSync(out, "utf8");
+    assert.ok(seen.includes("== own ==") && !seen.includes(m), "the deliverable read the hidden check");
+    assert.ok(!seen.includes("FD3-INHERITED"));
+  });
+
+  it("does not reach a deliverable through a drafting trial run", async () => {
+    const { dir, out } = peekProject();
+    const m = marker();
+    await preflightCriteria([{ name: "trial", run: `: ${m}; sh ./peek.sh '${out}'; true` }], { cwd: dir, timeoutMs: 20_000 });
+    const seen = readFileSync(out, "utf8");
+    assert.ok(seen.includes("== own ==") && !seen.includes(m));
+  });
+
+  it("goes through hideCommand at every check run site in the source", () => {
+    // A new caller that runs check text the old way would reopen the leak
+    // silently; this names it.
+    const sites: [string, RegExp][] = [
+      ["src/bar.ts", /runCommand\(/g],
+      ["src/criteria.ts", /runCommand\(/g],
+      ["src/mission.ts", /runCommand\(/g],
+      ["src/reference.ts", /runCommand\(check\.run/g],
+    ];
+    for (const [file, re] of sites) {
+      const src = readFileSync(join(process.cwd(), file), "utf8");
+      let n = 0;
+      for (const m of src.matchAll(re)) {
+        const call = src.slice(m.index!, src.indexOf(");", m.index!) + 2);
+        assert.match(call, /hideCommand: true/, `${file}: ${call.slice(0, 120)}`);
+        n++;
+      }
+      assert.ok(n > 0, `${file}: no runCommand call found`);
+    }
+    assert.ok(!HIDDEN_WRAPPER.includes("export"));
+  });
+});
+
+describe("the check copy", { skip: !posix }, () => {
+  it("copies a regular file, and refuses a symlink or a FIFO at the moment of opening", async () => {
+    const dir = ws();
+    const secret = join(ws(), "root-only");
+    writeFileSync(secret, "TOPSECRET");
+    writeFileSync(join(dir, "real"), "hello");
+    chmodSync(join(dir, "real"), 0o751);
+    symlinkSync(secret, join(dir, "swapped"));
+    execFileSync("mkfifo", [join(dir, "fifo")]);
+    const dst = ws();
+    assert.equal(await copyRegular(join(dir, "real"), join(dst, "real")), true);
+    assert.equal(readFileSync(join(dst, "real"), "utf8"), "hello");
+    const fd = openSync(join(dst, "real"), "r");
+    assert.equal(fstatSync(fd).mode & 0o777, 0o751);
+    closeSync(fd);
+    // What a listing called a file and the worker then swapped for a link.
+    assert.equal(await copyRegular(join(dir, "swapped"), join(dst, "swapped")), false);
+    assert.equal(existsSync(join(dst, "swapped")), false);
+    // A FIFO neither hangs the copy nor is copied.
+    assert.equal(await copyRegular(join(dir, "fifo"), join(dst, "fifo")), false);
+    assert.equal(existsSync(join(dst, "fifo")), false);
+  });
+});
+
+describe("credentials", () => {
+  it("are recognised by shape, not by a list of six names", () => {
+    for (const k of ["OPENROUTER_API_KEY", "MAAT_JUDGE_KEY", "MAAT_API_KEY", "MOLT_API_KEY", "XAI_API_KEY", "XAI_BASE", "GROK_AUTH", "TOGETHER_API_KEY", "TOGETHER_X", "GITHUB_TOKEN", "HF_TOKEN", "AWS_SECRET_ACCESS_KEY", "SOME_SECRET", "DEEPSEEK_APIKEY", "DB_PASSWORD", "MAAT_KEYS_FD"]) {
+      assert.ok(isSecretName(k), k);
+    }
+    for (const k of ["PATH", "HOME", "MAAT_JUDGE_MODEL", "MAAT_JUDGE_URL", "TOKENIZERS_PARALLELISM", "KEYBOARD", "LANG"]) assert.ok(!isSecretName(k), k);
+    const scrubbed = scrubEnv({ PATH: "/bin", GITHUB_TOKEN: "t", XAI_API_KEY: "x", MAAT_KEEP_ENV: "GITHUB_TOKEN" });
+    assert.deepEqual(Object.keys(scrubbed).sort(), ["GITHUB_TOKEN", "MAAT_KEEP_ENV", "PATH"]);
+  });
+
+  it("move out of the environment into memory, and are still found there", () => {
+    _resetSecrets();
+    const e: NodeJS.ProcessEnv = { PATH: "/bin", OPENROUTER_API_KEY: "sk-or-1234567890", MAAT_JUDGE_KEY: "judge-1234567890", HF_TOKEN: "hf", MAAT_KEEP_ENV: "HF_TOKEN" };
+    const rep = captureSecrets(e);
+    assert.deepEqual(rep.moved.sort(), ["MAAT_JUDGE_KEY", "OPENROUTER_API_KEY"]);
+    assert.deepEqual(Object.keys(e).sort(), ["HF_TOKEN", "MAAT_KEEP_ENV", "PATH"]);
+    assert.equal(secretValue("OPENROUTER_API_KEY"), "sk-or-1234567890");
+    assert.equal(withSecrets({}).MAAT_JUDGE_KEY, "judge-1234567890");
+    _resetSecrets();
+  });
+
+  it("load from MAAT_KEYS_FD (then closed) and from a 0600 MAAT_KEYS_FILE; a readable file is refused", { skip: !posix }, () => {
+    _resetSecrets();
+    const dir = ws();
+    const f = join(dir, "keys");
+    writeFileSync(f, "# keys\nexport MAAT_API_KEY='fromfile-123456789'\nOTHER=1\n");
+    chmodSync(f, 0o644);
+    const refused = captureSecrets({ MAAT_KEYS_FILE: f });
+    assert.equal(refused.loaded.length, 0);
+    assert.match(refused.problems.join(), /readable by others/);
+    assert.ok(!refused.problems.join().includes("fromfile"), "a problem must never quote a value");
+    chmodSync(f, 0o600);
+    const e: NodeJS.ProcessEnv = { MAAT_KEYS_FILE: f };
+    assert.deepEqual(captureSecrets(e).problems, []);
+    assert.equal(e.MAAT_KEYS_FILE, undefined);
+    assert.equal(secretValue("MAAT_API_KEY"), "fromfile-123456789");
+    const j = join(dir, "keys.json");
+    writeFileSync(j, JSON.stringify({ MOLT_API_KEY: "fromfd-123456789" }));
+    const fd = openSync(j, "r");
+    assert.deepEqual(captureSecrets({ MAAT_KEYS_FD: String(fd) }).problems, []);
+    assert.equal(secretValue("MOLT_API_KEY"), "fromfd-123456789");
+    assert.throws(() => fstatSync(fd), /EBADF/, "the keys descriptor must be closed after reading");
+    assert.deepEqual([...parseKeys('A="b c"\nbad line\nC=d')], [["A", "b c"], ["C", "d"]]);
+    _resetSecrets();
+  });
+
+  it("are reachable through env() after capture", () => {
+    _resetSecrets();
+    const saved = process.env.MAAT_API_KEY;
+    process.env.MAAT_API_KEY = "envkey-123456789";
+    try {
+      captureSecrets(process.env);
+      assert.equal(process.env.MAAT_API_KEY, undefined);
+      assert.equal(env("API_KEY"), "envkey-123456789");
+    } finally {
+      _resetSecrets();
+      if (saved !== undefined) process.env.MAAT_API_KEY = saved;
+    }
+  });
+});
+
+/**
+ * End to end, through the real CLI: a provider that has the worker run one
+ * bash command which dumps its own environment and every ancestor's argv and
+ * environment, then says it is done.
+ */
+async function leakProvider(seenAuth: string[]): Promise<string> {
+  let n = 0;
+  const server: Server = createServer((req, res) => {
+    seenAuth.push(String(req.headers.authorization ?? ""));
+    req.resume();
+    req.on("end", () => {
+      const first = n++ % 2 === 0;
+      const message = first
+        ? { role: "assistant", content: null, tool_calls: [{ id: `call_${n}`, type: "function", function: { name: "bash", arguments: JSON.stringify({ command: 'sh ./peek.sh "$PWD/seen.txt"' }) } }] }
+        : { role: "assistant", content: "Done." };
+      res.writeHead(200, { "content-type": "application/json" });
+      res.end(JSON.stringify({ choices: [{ message, finish_reason: first ? "tool_calls" : "stop" }], usage: { prompt_tokens: 10, completion_tokens: 5 } }));
+    });
+  });
+  await new Promise<void>((r) => server.listen(0, "127.0.0.1", r));
+  cleanups.push(() => new Promise<void>((r) => server.close(() => r())));
+  const addr = server.address();
+  return `http://127.0.0.1:${typeof addr === "object" && addr ? addr.port : 0}/v1`;
+}
+
+const CLI = join(process.cwd(), "dist-test", "src", "cli.js");
+
+async function workerSees(how: "fd" | "file" | "env", key: string): Promise<{ seen: string; auth: string[] }> {
+  const dir = ws();
+  writeFileSync(join(dir, "peek.sh"), PEEK);
+  const auth: string[] = [];
+  const url = await leakProvider(auth);
+  const cfg = join(ws(), "cfg");
+  mkdirSync(cfg, { recursive: true });
+  const base: NodeJS.ProcessEnv = { ...scrubEnv(process.env), MOLT_CONFIG_DIR: cfg };
+  const payload = `MAAT_API_KEY=${key}\nOPENROUTER_API_KEY=${key}-or\nMAAT_JUDGE_KEY=${key}-judge\n`;
+  let childEnv: NodeJS.ProcessEnv;
+  if (how === "file") {
+    const f = join(ws(), "keys");
+    writeFileSync(f, payload, { mode: 0o600 });
+    childEnv = { ...base, MAAT_KEYS_FILE: f };
+  } else if (how === "fd") {
+    childEnv = { ...base, MAAT_KEYS_FD: "3" };
+  } else {
+    childEnv = { ...base, MAAT_API_KEY: key, OPENROUTER_API_KEY: `${key}-or`, MAAT_JUDGE_KEY: `${key}-judge` };
+  }
+  const child = spawn(process.execPath, [CLI, "run", "look around", "--url", url, "--model", "m", "--cwd", dir, "--no-stream", "--sandbox"], {
+    env: childEnv,
+    stdio: how === "fd" ? ["ignore", "ignore", "pipe", "pipe"] : ["ignore", "ignore", "pipe"],
+  });
+  if (how === "fd") {
+    const feed = child.stdio[3] as import("node:stream").Duplex;
+    feed.on("error", () => {}); // a CLI that died early is reported below, with its stderr
+    feed.end(payload);
+  }
+  let err = "";
+  child.stderr?.on("data", (d) => (err += d));
+  const code = await new Promise<number>((r) => child.on("exit", (c) => r(c ?? -1)));
+  const seenFile = join(dir, "seen.txt");
+  assert.ok(existsSync(seenFile), `the worker's command did not run (exit ${code}): ${err.slice(0, 500)}`);
+  return { seen: readFileSync(seenFile, "utf8"), auth };
+}
+
+describe("a worker of Maat's own user", { skip: !posix }, () => {
+  for (const how of ["fd", "file"] as const) {
+    it(`finds no key in its env or any ancestor's argv/environ when keys come by ${how === "fd" ? "MAAT_KEYS_FD" : "MAAT_KEYS_FILE"}`, async () => {
+      const key = marker();
+      const { seen, auth } = await workerSees(how, key);
+      // Maat had the key: it sent it to the provider.
+      assert.ok(auth.some((a) => a.includes(key)), "Maat never used the key it was given");
+      assert.ok(seen.includes("PATH="), "the probe read nothing");
+      assert.ok(!seen.includes(key), `a key reached the worker:\n${seen.split("\n").filter((l) => l.includes(key)).join("\n")}`);
+    });
+  }
+
+  it("finds no key in its own env when keys come the old way, by environment", async () => {
+    const key = marker();
+    const { seen } = await workerSees("env", key);
+    const [own = "", ancestors = ""] = seen.split("== ancestors ==");
+    assert.ok(own.includes("PATH="), "the probe read nothing");
+    assert.ok(!own.includes(key), "an env-delivered key reached the worker's own environment");
+    // Maat's exec environment still holds it on Linux (the kernel keeps the
+    // copy it was started with): exactly why MAAT_KEYS_FD exists.
+    if (linux) assert.ok(ancestors.includes(key), "expected /proc/$PPID/environ to still hold an env-delivered key");
+  });
+});