diff --git a/lib/modules/core/core_test.go b/lib/modules/core/core_test.go
index c108b72..19ee38b 100644
--- a/lib/modules/core/core_test.go
+++ b/lib/modules/core/core_test.go
@@ -21,10 +21,10 @@
 )
 
 func TestCommands(t *testing.T) {
-	shell := core.NewShell()
-	defer shell.Cleanup(nil, os.Stderr)
+	sh := core.NewShell()
+	defer sh.Cleanup(nil, os.Stderr)
 	for _, c := range []string{core.RootMTCommand, core.MTCommand} {
-		if len(shell.Help(c)) == 0 {
+		if len(sh.Help(c)) == 0 {
 			t.Fatalf("missing command %q", c)
 		}
 	}
@@ -53,9 +53,9 @@
 }
 
 func TestRoot(t *testing.T) {
-	shell, fn := newShell()
+	sh, fn := newShell()
 	defer fn()
-	root, err := shell.Start(core.RootMTCommand, testArgs()...)
+	root, err := sh.Start(core.RootMTCommand, nil, testArgs()...)
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
@@ -68,7 +68,7 @@
 
 func startMountTables(t *testing.T, sh *modules.Shell, mountPoints ...string) (map[string]string, func(), error) {
 	// Start root mount table
-	root, err := sh.Start(core.RootMTCommand, testArgs()...)
+	root, err := sh.Start(core.RootMTCommand, nil, testArgs()...)
 	if err != nil {
 		t.Fatalf("unexpected error for root mt: %s", err)
 	}
@@ -84,7 +84,7 @@
 
 	// Start the mount tables
 	for _, mp := range mountPoints {
-		h, err := sh.Start(core.MTCommand, testArgs(mp)...)
+		h, err := sh.Start(core.MTCommand, nil, testArgs(mp)...)
 		if err != nil {
 			return nil, nil, fmt.Errorf("unexpected error for mt %q: %s", mp, err)
 		}
@@ -126,18 +126,18 @@
 }
 
 func TestMountTableAndGlob(t *testing.T) {
-	shell, fn := newShell()
+	sh, fn := newShell()
 	defer fn()
 
 	mountPoints := []string{"a", "b", "c", "d", "e"}
-	mountAddrs, fn, err := startMountTables(t, shell, mountPoints...)
+	mountAddrs, fn, err := startMountTables(t, sh, mountPoints...)
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
 	defer fn()
 
 	rootName := mountAddrs["root"]
-	ls, err := shell.Start(core.LSCommand, rootName+"/...")
+	ls, err := sh.Start(core.LSCommand, nil, rootName+"/...")
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
@@ -167,7 +167,7 @@
 	}
 
 	// Run the ls command in a subprocess, with NAMESPACE_ROOT as set above.
-	lse, err := shell.Start(core.LSExternalCommand, "...")
+	lse, err := sh.Start(core.LSExternalCommand, nil, "...")
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
@@ -198,10 +198,10 @@
 }
 
 func TestEcho(t *testing.T) {
-	shell, fn := newShell()
+	sh, fn := newShell()
 	defer fn()
 
-	srv, err := shell.Start(core.EchoServerCommand, testArgs("test", "")...)
+	srv, err := sh.Start(core.EchoServerCommand, nil, testArgs("test", "")...)
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
@@ -210,7 +210,7 @@
 	if len(name) == 0 {
 		t.Fatalf("failed to get name")
 	}
-	clt, err := shell.Start(core.EchoClientCommand, name, "a message")
+	clt, err := sh.Start(core.EchoClientCommand, nil, name, "a message")
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
@@ -220,11 +220,11 @@
 }
 
 func TestResolve(t *testing.T) {
-	shell, fn := newShell()
+	sh, fn := newShell()
 	defer fn()
 
 	mountPoints := []string{"a", "b"}
-	mountAddrs, fn, err := startMountTables(t, shell, mountPoints...)
+	mountAddrs, fn, err := startMountTables(t, sh, mountPoints...)
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
@@ -232,7 +232,7 @@
 	rootName := mountAddrs["root"]
 	mtName := "b"
 	echoName := naming.Join(mtName, "echo")
-	srv, err := shell.Start(core.EchoServerCommand, testArgs("test", echoName)...)
+	srv, err := sh.Start(core.EchoServerCommand, nil, testArgs("test", echoName)...)
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
@@ -242,7 +242,7 @@
 	addr = naming.JoinAddressName(addr, "//")
 
 	// Resolve an object
-	resolver, err := shell.Start(core.ResolveCommand, rootName+"/"+echoName)
+	resolver, err := sh.Start(core.ResolveCommand, nil, rootName+"/"+echoName)
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
@@ -259,7 +259,7 @@
 
 	// Resolve to a mount table using a rooted name.
 	addr = naming.JoinAddressName(mountAddrs[mtName], "//echo")
-	resolver, err = shell.Start(core.ResolveMTCommand, rootName+"/"+echoName)
+	resolver, err = sh.Start(core.ResolveMTCommand, nil, rootName+"/"+echoName)
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
@@ -275,7 +275,7 @@
 	}
 
 	// Resolve to a mount table, but using a relative name.
-	nsroots, err := shell.Start(core.SetNamespaceRootsCommand, rootName)
+	nsroots, err := sh.Start(core.SetNamespaceRootsCommand, nil, rootName)
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
@@ -283,7 +283,7 @@
 		t.Fatalf("unexpected error: %s", err)
 	}
 
-	resolver, err = shell.Start(core.ResolveMTCommand, echoName)
+	resolver, err = sh.Start(core.ResolveMTCommand, nil, echoName)
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
diff --git a/lib/modules/modules_internal_test.go b/lib/modules/modules_internal_test.go
index f60b2bb..07e76bc 100644
--- a/lib/modules/modules_internal_test.go
+++ b/lib/modules/modules_internal_test.go
@@ -35,9 +35,9 @@
 	sh.AddFunction("echof", Echo, "[args]*")
 	assertNumHandles(t, sh, 0)
 
-	_, _ = sh.Start("echonotregistered") // won't start.
-	hs, _ := sh.Start("echos", "a")
-	hf, _ := sh.Start("echof", "b")
+	_, _ = sh.Start("echonotregistered", nil) // won't start.
+	hs, _ := sh.Start("echos", nil, "a")
+	hf, _ := sh.Start("echof", nil, "b")
 	assertNumHandles(t, sh, 2)
 
 	for i, h := range []Handle{hs, hf} {
@@ -47,8 +47,8 @@
 	}
 	assertNumHandles(t, sh, 0)
 
-	hs, _ = sh.Start("echos", "a", "b")
-	hf, _ = sh.Start("echof", "c")
+	hs, _ = sh.Start("echos", nil, "a", "b")
+	hf, _ = sh.Start("echof", nil, "c")
 	assertNumHandles(t, sh, 2)
 
 	sh.Cleanup(nil, nil)
diff --git a/lib/modules/modules_test.go b/lib/modules/modules_test.go
index 0c611d6..e155934 100644
--- a/lib/modules/modules_test.go
+++ b/lib/modules/modules_test.go
@@ -75,7 +75,7 @@
 }
 
 func testCommand(t *testing.T, sh *modules.Shell, name, key, val string) {
-	h, err := sh.Start(name, key)
+	h, err := sh.Start(name, nil, key)
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
@@ -124,7 +124,7 @@
 	key, val := "simpleVar", "foo & bar"
 	sh.SetVar(key, val)
 	testCommand(t, sh, "envtest", key, val)
-	_, err := sh.Start("non-existent-command", "random", "args")
+	_, err := sh.Start("non-existent-command", nil, "random", "args")
 	if err == nil || err.Error() != `Shell command "non-existent-command" not registered` {
 		t.Fatalf("unexpected error %v", err)
 	}
@@ -142,7 +142,7 @@
 func TestErrorChild(t *testing.T) {
 	sh := modules.NewShell("errortest")
 	defer sh.Cleanup(nil, nil)
-	h, err := sh.Start("errortest")
+	h, err := sh.Start("errortest", nil)
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
@@ -154,7 +154,7 @@
 func testShutdown(t *testing.T, sh *modules.Shell, isfunc bool) {
 	result := ""
 	args := []string{"a", "b c", "ddd"}
-	if _, err := sh.Start("echo", args...); err != nil {
+	if _, err := sh.Start("echo", nil, args...); err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
 	var stdoutBuf bytes.Buffer
@@ -191,7 +191,7 @@
 	sh := modules.NewShell()
 	defer sh.Cleanup(nil, nil)
 	sh.AddFunction("errortest", ErrorMain, "")
-	h, err := sh.Start("errortest")
+	h, err := sh.Start("errortest", nil)
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
@@ -215,7 +215,7 @@
 	sh.SetVar("a", "1")
 	sh.SetVar("b", "2")
 	args := []string{"oh", "ah"}
-	h, err := sh.Start("printenv", args...)
+	h, err := sh.Start("printenv", nil, args...)
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
@@ -265,7 +265,7 @@
 	sh.SetVar("b", "2 also wrong")
 	os.Setenv("b", "wrong, should be 2")
 
-	h, err := sh.StartWithEnv("printenv", []string{"b=2"})
+	h, err := sh.Start("printenv", []string{"b=2"})
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
diff --git a/lib/modules/shell.go b/lib/modules/shell.go
index cb68856..6919bd3 100644
--- a/lib/modules/shell.go
+++ b/lib/modules/shell.go
@@ -176,8 +176,13 @@
 }
 
 // Start starts the specified command, it returns a Handle which can be used
-// for interacting with that command. The Shell tracks all of the Handles
-// that it creates so that it can shut them down when asked to.
+// for interacting with that command. The OS and shell environment variables
+// are merged with the ones supplied as a parameter; the parameter specified
+// ones override the Shell and the Shell ones override the OS ones.
+//
+// The Shell tracks all of the Handles that it creates so that it can shut
+// them down when asked to.
+//
 // Commands may have already been registered with the Shell using AddFunction
 // or AddSubprocess, but if not, they will treated as subprocess commands
 // and an attempt made to run them. Such 'dynamically' started subprocess
@@ -185,13 +190,7 @@
 // message etc; their handles are remembered and will be acted on by
 // the Cleanup method. If the non-registered subprocess command does not
 // exist then the Start command will return an error.
-func (sh *Shell) Start(name string, args ...string) (Handle, error) {
-	return sh.StartWithEnv(name, nil, args...)
-}
-
-// StartWithEnv is like Start except with a set of environment variables
-// that override those in the Shell and the OS' environment.
-func (sh *Shell) StartWithEnv(name string, env []string, args ...string) (Handle, error) {
+func (sh *Shell) Start(name string, env []string, args ...string) (Handle, error) {
 	cenv := sh.MergedEnv(env)
 	cmd := sh.getCommand(name)
 	expanded := append([]string{name}, sh.expand(args...)...)
diff --git a/lib/signals/signals_test.go b/lib/signals/signals_test.go
index 636bbdb..b045ef9 100644
--- a/lib/signals/signals_test.go
+++ b/lib/signals/signals_test.go
@@ -113,7 +113,7 @@
 func newShell(t *testing.T, command string) (*modules.Shell, modules.Handle, *expect.Session) {
 	sh := modules.NewShell()
 	sh.AddSubprocess(command, "")
-	handle, err := sh.Start(command)
+	handle, err := sh.Start(command, nil)
 	if err != nil {
 		sh.Cleanup(os.Stderr, os.Stderr)
 		t.Fatalf("unexpected error: %s", err)
@@ -340,7 +340,7 @@
 	defer configServer.Stop()
 	sh.SetVar("VEYRON_CREDENTIALS", childcreds)
 	sh.SetVar(mgmt.ParentNodeManagerConfigKey, configServiceName)
-	h, err := sh.Start("handleDefaults")
+	h, err := sh.Start("handleDefaults", nil)
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
diff --git a/runtimes/google/ipc/server_test.go b/runtimes/google/ipc/server_test.go
index 9718c2a..8a8020f 100644
--- a/runtimes/google/ipc/server_test.go
+++ b/runtimes/google/ipc/server_test.go
@@ -29,7 +29,7 @@
 	defer b.cleanup(t)
 	sh := modules.NewShell()
 	defer sh.Cleanup(os.Stderr, os.Stderr)
-	server, err := sh.Start("runServer", "127.0.0.1:0")
+	server, err := sh.Start("runServer", nil, "127.0.0.1:0")
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
@@ -64,7 +64,7 @@
 
 	// Resurrect the server with the same address, verify client
 	// re-establishes the connection.
-	server, err = sh.Start("runServer", addr)
+	server, err = sh.Start("runServer", nil, addr)
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
@@ -85,7 +85,7 @@
 
 func (h *proxyHandle) Start(t *testing.T) error {
 	sh := modules.NewShell()
-	server, err := sh.Start("runProxy")
+	server, err := sh.Start("runProxy", nil)
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
diff --git a/runtimes/google/ipc/stream/manager/manager_test.go b/runtimes/google/ipc/stream/manager/manager_test.go
index cd66579..873d882 100644
--- a/runtimes/google/ipc/stream/manager/manager_test.go
+++ b/runtimes/google/ipc/stream/manager/manager_test.go
@@ -438,7 +438,7 @@
 	client := InternalNew(naming.FixedRoutingID(0xcccccccc))
 	sh := modules.NewShell(".*")
 	defer sh.Cleanup(nil, nil)
-	h, err := sh.Start("runServer", "127.0.0.1:0")
+	h, err := sh.Start("runServer", nil, "127.0.0.1:0")
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
@@ -459,7 +459,7 @@
 		t.Fatal("Expected client.Dial to fail since server is dead")
 	}
 
-	h, err = sh.Start("runServer", addr)
+	h, err = sh.Start("runServer", nil, addr)
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
diff --git a/runtimes/google/rt/mgmt_test.go b/runtimes/google/rt/mgmt_test.go
index 4b3b757..0737a1e 100644
--- a/runtimes/google/rt/mgmt_test.go
+++ b/runtimes/google/rt/mgmt_test.go
@@ -113,7 +113,7 @@
 func TestNoWaiters(t *testing.T) {
 	sh := modules.NewShell(noWaitersCmd)
 	defer sh.Cleanup(os.Stderr, os.Stderr)
-	h, err := sh.Start(noWaitersCmd)
+	h, err := sh.Start(noWaitersCmd, nil)
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
@@ -139,7 +139,7 @@
 func TestForceStop(t *testing.T) {
 	sh := modules.NewShell(forceStopCmd)
 	defer sh.Cleanup(os.Stderr, os.Stderr)
-	h, err := sh.Start(forceStopCmd)
+	h, err := sh.Start(forceStopCmd, nil)
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
@@ -291,7 +291,7 @@
 	sh := modules.NewShell(appCmd)
 	sh.SetVar("VEYRON_CREDENTIALS", childcreds)
 	sh.SetVar(mgmt.ParentNodeManagerConfigKey, configServiceName)
-	h, err := sh.Start("app")
+	h, err := sh.Start("app", nil)
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
diff --git a/runtimes/google/rt/rt_test.go b/runtimes/google/rt/rt_test.go
index 8b23035..cb1832e 100644
--- a/runtimes/google/rt/rt_test.go
+++ b/runtimes/google/rt/rt_test.go
@@ -78,7 +78,7 @@
 func TestInitArgs(t *testing.T) {
 	sh := modules.NewShell("child")
 	defer sh.Cleanup(os.Stderr, os.Stderr)
-	h, err := sh.Start("child", "--logtostderr=true", "--vv=3", "--", "foobar")
+	h, err := sh.Start("child", nil, "--logtostderr=true", "--vv=3", "--", "foobar")
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
diff --git a/runtimes/google/rt/signal_test.go b/runtimes/google/rt/signal_test.go
index 5aa1b3d..e37f883 100644
--- a/runtimes/google/rt/signal_test.go
+++ b/runtimes/google/rt/signal_test.go
@@ -47,7 +47,7 @@
 func TestWithRuntime(t *testing.T) {
 	sh := modules.NewShell("withRuntime")
 	defer sh.Cleanup(os.Stderr, os.Stderr)
-	h, err := sh.Start("withRuntime")
+	h, err := sh.Start("withRuntime", nil)
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
@@ -64,7 +64,7 @@
 func TestWithoutRuntime(t *testing.T) {
 	sh := modules.NewShell("withoutRuntime")
 	defer sh.Cleanup(os.Stderr, os.Stderr)
-	h, err := sh.Start("withoutRuntime")
+	h, err := sh.Start("withoutRuntime", nil)
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
diff --git a/runtimes/google/security/identity_test.go b/runtimes/google/security/identity_test.go
index 315e9cd..1dae49c 100644
--- a/runtimes/google/security/identity_test.go
+++ b/runtimes/google/security/identity_test.go
@@ -352,7 +352,7 @@
 	// registers all values encoded within the same process.
 	sh := modules.NewShell(".*")
 	defer sh.Cleanup(nil, nil)
-	h, err := sh.Start("encodeUnregisteredCaveat")
+	h, err := sh.Start("encodeUnregisteredCaveat", nil)
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
diff --git a/services/mgmt/node/impl/util_test.go b/services/mgmt/node/impl/util_test.go
index 8c098dc..c039bbd 100644
--- a/services/mgmt/node/impl/util_test.go
+++ b/services/mgmt/node/impl/util_test.go
@@ -39,7 +39,7 @@
 }
 
 func startRootMT(t *testing.T, sh *modules.Shell) (string, modules.Handle, *expect.Session) {
-	h, err := sh.Start(core.RootMTCommand, "--", "--veyron.tcp.address=127.0.0.1:0")
+	h, err := sh.Start(core.RootMTCommand, nil, "--", "--veyron.tcp.address=127.0.0.1:0")
 	if err != nil {
 		t.Fatalf("failed to start root mount table: %s", err)
 	}
@@ -72,10 +72,10 @@
 		vlog.VI(1).Info("---------------------------------")
 		sh.Cleanup(nil, os.Stderr)
 		mtHandle.Shutdown(nil, os.Stderr)
-		sh.Start(core.SetNamespaceRootsCommand, "")
+		sh.Start(core.SetNamespaceRootsCommand, nil, "")
 	}
 
-	if _, err := sh.Start(core.SetNamespaceRootsCommand, mtName); err != nil {
+	if _, err := sh.Start(core.SetNamespaceRootsCommand, nil, mtName); err != nil {
 		t.Fatalf("%s: unexpected error: %s", loc(1), err)
 	}
 	sh.SetVar("NAMESPACE_ROOT", mtName)
@@ -83,7 +83,7 @@
 }
 
 func runShellCommand(t *testing.T, sh *modules.Shell, env []string, cmd string, args ...string) (modules.Handle, *expect.Session) {
-	h, err := sh.StartWithEnv(cmd, env, args...)
+	h, err := sh.Start(cmd, env, args...)
 	if err != nil {
 		t.Fatalf("%s: failed to start %q: %s", loc(1), cmd, err)
 		return nil, nil
diff --git a/tools/naming/simulator/driver.go b/tools/naming/simulator/driver.go
index c6abba2..4f944ca 100644
--- a/tools/naming/simulator/driver.go
+++ b/tools/naming/simulator/driver.go
@@ -189,7 +189,7 @@
 		}
 		output(lineno, l)
 	} else {
-		handle, err := sh.Start(name, sub...)
+		handle, err := sh.Start(name, nil, sub...)
 		if err != nil {
 			return err
 		}