Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

@@ -113,3 +113,3 @@
 On context close (e.g. systemd SIGTERM), a `ContextClosedEvent` listener in `BuildExecutor` terminates the process trees of all executing builds and waits (bounded) until their results are persisted as INTERRUPTED — a shutdown is never recorded as FAILED. Builds still queued stay PENDING and start no process. Both are re-enqueued by the watcher's startup recovery; INTERRUPTED therefore publishes as Gitea state `pending`, not `failure` (`GiteaStateMapping`).
 
-The runtime is selected per build behind the `BuildRunner` interface: `DispatchingBuildRunner` (`@Primary`) routes to native `ProcessBuildRunner` (the default), to `DockerBuildRunner` when `docker.enabled`, or to `WerkdockBuildRunner` when `werkdock.enabled` — docker and werkdock are mutually exclusive per build and rejected in `buildSettings`, never picked silently. The Docker runner shells out to the `docker` CLI (no SDK): it (re)builds the configured image when the Dockerfile inputs changed (tracked via the `org.werkator.build-inputs-sha256` image label), maintains a per-repo Gradle cache volume, mounts the worktree and the Docker socket into a labelled (`org.hoennig.werkator`) `--rm --init` container (with `TESTCONTAINERS_HOST_OVERRIDE` from `docker.env` if it names one, else the child address a rootless daemon's rootlesskit reports for the `slirp4netns` port driver — `RootlessKitPorts`, asked over `dockerd-rootless/api.sock` on every build, PR#86 — else `localhost` under `network: host` and `host.docker.internal` otherwise), and repairs workspace ownership in-container after each command (under a rootless daemon the container runs as root, which is the host user, and the repair degenerates to `0:0`). Git works inside the container: the primary `.git` is mounted read-only with `.git/werkator/` masked by an empty tmpfs (credential isolation) and the worktree's admin dir mounted read-write (`gitMetadataMounts`). The returned `Process` is the attached `docker run` client, so log streaming and termination work exactly like native builds.
+The runtime is selected per build behind the `BuildRunner` interface: `DispatchingBuildRunner` (`@Primary`) routes to native `ProcessBuildRunner` (the default), to `DockerBuildRunner` when `docker.enabled`, or to `WerkdockBuildRunner` when `werkdock.enabled` — docker and werkdock are mutually exclusive per build and rejected in `buildSettings`, never picked silently. The Docker runner shells out to the `docker` CLI (no SDK): it (re)builds the configured image when the Dockerfile inputs changed (tracked via the `org.werkator.build-inputs-sha256` image label), maintains a per-repo Gradle cache volume, mounts the worktree and the Docker socket into a labelled (`org.hoennig.werkator`) `--rm --init` container (with `TESTCONTAINERS_HOST_OVERRIDE` from `docker.env` if it names one, else the child address a rootless daemon's rootlesskit reports for the `slirp4netns` port driver — `RootlessKitPorts`, asked over `dockerd-rootless/api.sock` on every build, PR#86 — else `localhost` under `network: host` and `host.docker.internal` otherwise), and repairs workspace ownership in-container after each command (under a rootless daemon the container runs as root, which is the host user, and the repair degenerates to `0:0`). Git works inside the container: the primary `.git` is mounted read-only with `.git/werkator/` masked by an empty tmpfs (credential isolation) and the worktree's admin dir mounted read-write (`gitMetadataMounts`). The returned `Process` is the attached `docker run` client, so log streaming and termination work exactly like native builds. Both sandbox runners pass a build's variables as a bare `-e KEY`/`--env KEY` with the value in the CLI process's environment, never on its argv (`RuntimeEnvironment`, PR#166); that environment holds only the runtime's own variables from Werkator's, and a variable named like one of them keeps `KEY=VALUE` on the argv.

@@ -336,0 +339,4 @@
+            args.indexOf("branch") shouldBe args.indexOf("FOO") - 2
+        }
+
+        test("the werkdock command line names a build's variables, its environment holds their values (Scenario#166.01)") {

@@ -336,0 +377,4 @@
+            capturedEnvironments.single() shouldBe HOST_RUNTIME_ENVIRONMENT
+        }
+
+        test("the build still sees the values its werkdock command line only names (Scenario#166.03)") {

@@ -0,0 +71,4 @@
+            name.uppercase().let { upper -> upper in RUNTIME_NAMES || RUNTIME_PREFIXES.any { upper.startsWith(it) } }
+
+        /** A name with `=` would read as `KEY=VALUE` on the command line, and no environment holds an empty one. */
+        fun travelsInEnvironment(name: String): Boolean = name.isNotEmpty() && '=' !in name && '\u0000' !in name && !belongsToRuntime(name)

@@ -0,0 +65,4 @@
+                "NO_PROXY",
+                "ALL_PROXY",
+                "DISPLAY",
+                "WAYLAND_DISPLAY",

@@ -336,0 +353,4 @@
+            capturedEnvironments.single() shouldBe HOST_RUNTIME_ENVIRONMENT + mapOf("branch" to "main") + secrets
+        }
+
+        test("a variable werkdock or the host's loader reads itself stays on the command line (Scenario#166.02)") {

@@ -0,0 +24,4 @@
+
+    /** The environment the CLI process starts with: the runtime's own variables from [host], then the build's values. */
+    val processEnvironment: Map<String, String> =
+        host.filterKeys { belongsToRuntime(it) } + variables.filterKeys { travelsInEnvironment(it) }

@@ -0,0 +43,4 @@
+                return DockerEnvFile(null, variables)
+            }
+            val dir = repoDir.resolve(DIR)
+            SecretFiles.createDirectoriesOwnerOnly(dir)

@@ -0,0 +61,4 @@
+            key.isNotEmpty() &&
+                !key.startsWith("#") &&
+                key.none { it == '=' || it.isWhitespace() || it == '\u0000' } &&
+                value.none { it == '\n' || it == '\r' || it == '\u0000' }

@@ -0,0 +61,4 @@
+            key: String,
+            value: String,
+        ): Boolean =
+            key.isNotEmpty() &&