@fased/fased 0.1.61 → 0.1.64

package/dist/acp/client.js

@@ -2,7 +2,7 @@ import { isKnownCoreToolId } from "../agents/tool-catalog.js";
 import { DANGEROUS_ACP_TOOLS } from "../security/dangerous-tools.js";
 import { ensureFasedAgentCliOnPath } from "../infra/path-env.js";
 import { fileURLToPath } from "node:url";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import { homedir } from "node:os";
 import path from "node:path";
 import { spawn } from "node:child_process";
@@ -269,7 +269,7 @@ function resolveSelfEntryPath() {
 	try {
 		const here = fileURLToPath(import.meta.url);
 		const candidate = path.resolve(path.dirname(here), "..", "entry.js");
-		if (fs.existsSync(candidate)) {
+		if (syncFs.existsSync(candidate)) {
 			return candidate;
 		}
 	} catch {}

package/dist/acp/secret-file.js

@@ -1,5 +1,5 @@
 import { resolveUserPath } from "../utils.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 
 //#region src/acp/secret-file.ts
 function readSecretFromFile(filePath, label) {
@@ -9,7 +9,7 @@ function readSecretFromFile(filePath, label) {
 	}
 	let raw = "";
 	try {
-		raw = fs.readFileSync(resolvedPath, "utf8");
+		raw = syncFs.readFileSync(resolvedPath, "utf8");
 	} catch (err) {
 		throw new Error(`Failed to read ${label} file at ${resolvedPath}: ${String(err)}`, { cause: err });
 	}

package/dist/agents/agent-scope.js

@@ -6,7 +6,7 @@ import { parseAgentSessionKey } from "../sessions/session-key-utils.js";
 import { DEFAULT_AGENT_ID, normalizeAgentId, resolveAgentIdFromSessionKey } from "../routing/session-key.js";
 import { resolveEffectiveAgentSkillFilter } from "./skills/agent-filter.js";
 import { resolveDefaultAgentWorkspaceDir } from "./workspace.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import path from "node:path";
 
 //#region src/agents/agent-scope.ts
@@ -245,7 +245,7 @@ function normalizePathForComparison(input) {
 	const resolved = path.resolve(stripNullBytes(resolveUserPath(input)));
 	let normalized = resolved;
 	try {
-		normalized = fs.realpathSync.native(resolved);
+		normalized = syncFs.realpathSync.native(resolved);
 	} catch {}
 	if (process.platform === "win32") {
 		return normalized.toLowerCase();

package/dist/agents/apply-patch.js

@@ -3,9 +3,9 @@ import { PATH_ALIAS_POLICIES } from "../infra/path-alias-guards.js";
 import { writeFileWithinRoot } from "../infra/fs-safe.js";
 import { applyUpdateHunk } from "./apply-patch-update.js";
 import { assertSandboxPath, resolveSandboxInputPath } from "./sandbox-paths.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import path from "node:path";
-import fs$1 from "node:fs/promises";
+import fs from "node:fs/promises";
 import { Type } from "@sinclair/typebox";
 
 //#region src/agents/apply-patch.ts
@@ -159,7 +159,7 @@ function resolvePatchFileOps(options) {
 	return {
 		readFile: async (filePath) => {
 			if (!workspaceOnly) {
-				return await fs$1.readFile(filePath, "utf8");
+				return await fs.readFile(filePath, "utf8");
 			}
 			const opened = await openBoundaryFile({
 				absolutePath: filePath,
@@ -168,14 +168,14 @@ function resolvePatchFileOps(options) {
 			});
 			assertBoundaryRead(opened, filePath);
 			try {
-				return fs.readFileSync(opened.fd, "utf8");
+				return syncFs.readFileSync(opened.fd, "utf8");
 			} finally {
-				fs.closeSync(opened.fd);
+				syncFs.closeSync(opened.fd);
 			}
 		},
 		writeFile: async (filePath, content) => {
 			if (!workspaceOnly) {
-				await fs$1.writeFile(filePath, content, "utf8");
+				await fs.writeFile(filePath, content, "utf8");
 				return;
 			}
 			const relative = toRelativeWorkspacePath(options.cwd, filePath);
@@ -186,8 +186,8 @@ function resolvePatchFileOps(options) {
 				encoding: "utf8"
 			});
 		},
-		remove: (filePath) => fs$1.rm(filePath),
-		mkdirp: (dir) => fs$1.mkdir(dir, { recursive: true }).then(() => {})
+		remove: (filePath) => fs.rm(filePath),
+		mkdirp: (dir) => fs.mkdir(dir, { recursive: true }).then(() => {})
 	};
 }
 async function ensureDir(filePath, ops) {

package/dist/agents/auth-profiles/paths.js

@@ -2,7 +2,7 @@ import { resolveUserPath } from "../../utils.js";
 import { saveJsonFile } from "../../infra/json-file.js";
 import { AUTH_PROFILE_FILENAME, AUTH_STORE_VERSION, LEGACY_AUTH_FILENAME } from "./constants.js";
 import { resolveFasedAgentAgentDir } from "../agent-paths.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import path from "node:path";
 
 //#region src/agents/auth-profiles/paths.ts
@@ -19,7 +19,7 @@ function resolveAuthStorePathForDisplay(agentDir) {
 	return pathname.startsWith("~") ? pathname : resolveUserPath(pathname);
 }
 function ensureAuthStoreFile(pathname) {
-	if (fs.existsSync(pathname)) {
+	if (syncFs.existsSync(pathname)) {
 		return;
 	}
 	const payload = {

package/dist/agents/auth-profiles/store.js

@@ -1,11 +1,12 @@
 import { resolveOAuthPath } from "../../config/paths.js";
+import { coerceSecretRef, isSecretRef } from "../../config/types.secrets.js";
 import { loadJsonFile, saveJsonFile } from "../../infra/json-file.js";
 import { AUTH_STORE_LOCK_OPTIONS, AUTH_STORE_VERSION, log } from "./constants.js";
 import { withFileLock } from "../../plugin-sdk/file-lock.js";
 import "../../infra/file-lock.js";
 import { syncExternalCliCredentials } from "./external-cli-sync.js";
 import { ensureAuthStoreFile, resolveAuthStorePath, resolveLegacyAuthStorePath } from "./paths.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 
 //#region src/agents/auth-profiles/store.ts
 const AUTH_PROFILE_TYPES = new Set([
@@ -13,6 +14,18 @@ const AUTH_PROFILE_TYPES = new Set([
 	"oauth",
 	"token"
 ]);
+const AUTH_PROFILE_FAILURE_REASONS = new Set([
+	"auth",
+	"auth_permanent",
+	"format",
+	"rate_limit",
+	"overloaded",
+	"billing",
+	"timeout",
+	"model_not_found",
+	"session_expired",
+	"unknown"
+]);
 const runtimeAuthStoreSnapshots = new Map();
 function resolveRuntimeStoreKey(agentDir) {
 	return resolveAuthStorePath(agentDir);
@@ -89,8 +102,78 @@ function normalizeRawCredentialEntry(raw) {
 	}
 	return entry;
 }
-function parseCredentialEntry(raw, fallbackProvider) {
-	if (!raw || typeof raw !== "object") {
+function isRecord(value) {
+	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function isUsableString(value) {
+	return typeof value === "string" && value.trim().length > 0;
+}
+function isOptionalString(value) {
+	return value === undefined || typeof value === "string";
+}
+function isOptionalFiniteNumber(value) {
+	return value === undefined || typeof value === "number" && Number.isFinite(value);
+}
+function isValidStringMetadata(value) {
+	return value === undefined || isRecord(value) && Object.values(value).every((entry) => typeof entry === "string");
+}
+function isSupportedStoredSecretRef(value) {
+	if (isSecretRef(value)) {
+		return true;
+	}
+	if (!isRecord(value)) {
+		return false;
+	}
+	const keys = Object.keys(value).toSorted();
+	return keys.length === 2 && keys[0] === "id" && keys[1] === "source" && coerceSecretRef(value) !== null;
+}
+function hasValidSecretMaterial(params) {
+	const valueIsValid = isUsableString(params.value) || isSupportedStoredSecretRef(params.value);
+	const refIsValid = isSupportedStoredSecretRef(params.ref);
+	return valueIsValid || refIsValid;
+}
+function isValidCredentialShape(entry, type) {
+	if (!isOptionalString(entry.email)) {
+		return "invalid_shape";
+	}
+	if (type === "api_key") {
+		if (entry.key !== undefined && typeof entry.key !== "string" && !isSupportedStoredSecretRef(entry.key) || entry.keyRef !== undefined && !isSupportedStoredSecretRef(entry.keyRef) || !isValidStringMetadata(entry.metadata)) {
+			return "invalid_shape";
+		}
+		return hasValidSecretMaterial({
+			value: entry.key,
+			ref: entry.keyRef
+		}) ? null : "missing_material";
+	}
+	if (type === "token") {
+		if (entry.token !== undefined && typeof entry.token !== "string" && !isSupportedStoredSecretRef(entry.token) || entry.tokenRef !== undefined && !isSupportedStoredSecretRef(entry.tokenRef) || !isOptionalFiniteNumber(entry.expires)) {
+			return "invalid_shape";
+		}
+		return hasValidSecretMaterial({
+			value: entry.token,
+			ref: entry.tokenRef
+		}) ? null : "missing_material";
+	}
+	if (!isUsableString(entry.access) || !isUsableString(entry.refresh) || typeof entry.expires !== "number" || !Number.isFinite(entry.expires)) {
+		return "missing_material";
+	}
+	for (const field of [
+		"clientId",
+		"enterpriseUrl",
+		"projectId",
+		"accountId"
+	]) {
+		if (!isOptionalString(entry[field])) {
+			return "invalid_shape";
+		}
+	}
+	if (entry.availableModelIds !== undefined && (!Array.isArray(entry.availableModelIds) || !entry.availableModelIds.every((modelId) => isUsableString(modelId)))) {
+		return "invalid_shape";
+	}
+	return null;
+}
+function parseCredentialEntry(raw, fallbackProvider, options) {
+	if (!isRecord(raw)) {
 		return {
 			ok: false,
 			reason: "non_object"
@@ -110,10 +193,21 @@ function parseCredentialEntry(raw, fallbackProvider) {
 			reason: "missing_provider"
 		};
 	}
+	const type = typed.type;
+	if (options?.strict) {
+		const invalidReason = isValidCredentialShape(typed, type);
+		if (invalidReason) {
+			return {
+				ok: false,
+				reason: invalidReason
+			};
+		}
+	}
 	return {
 		ok: true,
 		credential: {
 			...typed,
+			type,
 			provider
 		}
 	};
@@ -133,8 +227,8 @@ function warnRejectedCredentialEntries(source, rejected) {
 		keys: rejected.slice(0, 10).map((entry) => entry.key)
 	});
 }
-function coerceLegacyStore(raw) {
-	if (!raw || typeof raw !== "object") {
+function coerceLegacyStore(raw, options) {
+	if (!isRecord(raw)) {
 		return null;
 	}
 	const record = raw;
@@ -144,7 +238,7 @@ function coerceLegacyStore(raw) {
 	const entries = {};
 	const rejected = [];
 	for (const [key, value] of Object.entries(record)) {
-		const parsed = parseCredentialEntry(value, key);
+		const parsed = parseCredentialEntry(value, key, { strict: options?.rejectInvalidEntries === true });
 		if (!parsed.ok) {
 			rejected.push({
 				key,
@@ -154,22 +248,96 @@ function coerceLegacyStore(raw) {
 		}
 		entries[key] = parsed.credential;
 	}
+	if (options?.rejectInvalidEntries && rejected.length > 0) {
+		return null;
+	}
 	warnRejectedCredentialEntries("auth.json", rejected);
-	return Object.keys(entries).length > 0 ? entries : null;
+	return Object.keys(entries).length > 0 || options?.rejectInvalidEntries ? entries : null;
+}
+function isValidProfileOrder(value) {
+	if (value === undefined) {
+		return true;
+	}
+	if (!isRecord(value)) {
+		return false;
+	}
+	return Object.entries(value).every(([provider, profileIds]) => isUsableString(provider) && Array.isArray(profileIds) && profileIds.every((profileId) => isUsableString(profileId)));
+}
+function isValidLastGood(value) {
+	if (value === undefined) {
+		return true;
+	}
+	if (!isRecord(value)) {
+		return false;
+	}
+	return Object.entries(value).every(([provider, profileId]) => isUsableString(provider) && isUsableString(profileId));
 }
-function coerceAuthStore(raw) {
-	if (!raw || typeof raw !== "object") {
+function isValidFailureCounts(value) {
+	if (value === undefined) {
+		return true;
+	}
+	if (!isRecord(value)) {
+		return false;
+	}
+	return Object.entries(value).every(([reason, count]) => AUTH_PROFILE_FAILURE_REASONS.has(reason) && typeof count === "number" && Number.isFinite(count) && Number.isInteger(count) && count >= 0);
+}
+function isValidUsageStats(value) {
+	if (value === undefined) {
+		return true;
+	}
+	if (!isRecord(value)) {
+		return false;
+	}
+	return Object.entries(value).every(([profileId, stats]) => {
+		if (!isUsableString(profileId) || !isRecord(stats)) {
+			return false;
+		}
+		for (const field of [
+			"lastUsed",
+			"cooldownUntil",
+			"disabledUntil",
+			"lastFailureAt"
+		]) {
+			if (!isOptionalFiniteNumber(stats[field])) {
+				return false;
+			}
+		}
+		if (stats.errorCount !== undefined && (typeof stats.errorCount !== "number" || !Number.isFinite(stats.errorCount) || !Number.isInteger(stats.errorCount) || stats.errorCount < 0)) {
+			return false;
+		}
+		for (const field of ["disabledReason", "cooldownReason"]) {
+			if (stats[field] !== undefined && (typeof stats[field] !== "string" || !AUTH_PROFILE_FAILURE_REASONS.has(stats[field]))) {
+				return false;
+			}
+		}
+		if (!isOptionalString(stats.cooldownModel) || !isValidFailureCounts(stats.failureCounts)) {
+			return false;
+		}
+		return true;
+	});
+}
+function hasValidStoreMetadata(record) {
+	return (record.version === undefined || typeof record.version === "number" && Number.isFinite(record.version) && Number.isInteger(record.version) && record.version >= 1 && record.version <= AUTH_STORE_VERSION) && isValidProfileOrder(record.order) && isValidLastGood(record.lastGood) && isValidUsageStats(record.usageStats);
+}
+function coerceAuthStore(raw, options) {
+	if (!isRecord(raw)) {
 		return null;
 	}
 	const record = raw;
-	if (!record.profiles || typeof record.profiles !== "object") {
+	if (!isRecord(record.profiles)) {
+		return null;
+	}
+	if (options?.rejectInvalidEntries && !hasValidStoreMetadata(record)) {
 		return null;
 	}
 	const profiles = record.profiles;
 	const normalized = {};
 	const rejected = [];
 	for (const [key, value] of Object.entries(profiles)) {
-		const parsed = parseCredentialEntry(value);
+		const parsed = !options?.rejectInvalidEntries || isUsableString(key) ? parseCredentialEntry(value, undefined, { strict: options?.rejectInvalidEntries === true }) : {
+			ok: false,
+			reason: "invalid_shape"
+		};
 		if (!parsed.ok) {
 			rejected.push({
 				key,
@@ -179,8 +347,11 @@ function coerceAuthStore(raw) {
 		}
 		normalized[key] = parsed.credential;
 	}
+	if (options?.rejectInvalidEntries && rejected.length > 0) {
+		return null;
+	}
 	warnRejectedCredentialEntries("auth-profiles.json", rejected);
-	const order = record.order && typeof record.order === "object" ? Object.entries(record.order).reduce((acc, [provider, value]) => {
+	const order = options?.rejectInvalidEntries ? record.order : record.order && typeof record.order === "object" ? Object.entries(record.order).reduce((acc, [provider, value]) => {
 		if (!Array.isArray(value)) {
 			return acc;
 		}
@@ -229,27 +400,68 @@ function mergeAuthProfileStores(base, override) {
 		usageStats: mergeRecord(base.usageStats, override.usageStats)
 	};
 }
-function mergeOAuthFileIntoStore(store) {
+function readJsonFileForAuthRuntime(params) {
+	if (!params.strict) {
+		return loadJsonFile(params.pathname);
+	}
+	if (!syncFs.existsSync(params.pathname)) {
+		return undefined;
+	}
+	try {
+		return JSON.parse(syncFs.readFileSync(params.pathname, "utf8"));
+	} catch {
+		throw new Error(`${params.label} is unreadable or contains invalid JSON.`);
+	}
+}
+function mergeOAuthFileIntoStore(store, strict = false) {
 	const oauthPath = resolveOAuthPath();
-	const oauthRaw = loadJsonFile(oauthPath);
-	if (!oauthRaw || typeof oauthRaw !== "object") {
+	const oauthRaw = readJsonFileForAuthRuntime({
+		pathname: oauthPath,
+		label: "OAuth credential store",
+		strict
+	});
+	if (oauthRaw === undefined) {
+		return false;
+	}
+	if (!oauthRaw || typeof oauthRaw !== "object" || Array.isArray(oauthRaw)) {
+		if (strict) {
+			throw new Error("OAuth credential store has an invalid structure.");
+		}
 		return false;
 	}
 	const oauthEntries = oauthRaw;
 	let mutated = false;
-	for (const [provider, creds] of Object.entries(oauthEntries)) {
-		if (!creds || typeof creds !== "object") {
+	for (const [provider, rawCreds] of Object.entries(oauthEntries)) {
+		if (!isRecord(rawCreds)) {
+			if (strict) {
+				throw new Error("OAuth credential store has an invalid credential entry.");
+			}
 			continue;
 		}
+		const creds = rawCreds;
+		let credential;
+		if (strict) {
+			const parsed = parseCredentialEntry({
+				...creds,
+				type: "oauth",
+				provider
+			}, undefined, { strict: true });
+			if (!parsed.ok) {
+				throw new Error("OAuth credential store has an invalid credential entry.");
+			}
+			credential = parsed.credential;
+		} else {
+			credential = {
+				...creds,
+				type: "oauth",
+				provider
+			};
+		}
 		const profileId = `${provider}:default`;
 		if (store.profiles[profileId]) {
 			continue;
 		}
-		store.profiles[profileId] = {
-			type: "oauth",
-			provider,
-			...creds
-		};
+		store.profiles[profileId] = credential;
 		mutated = true;
 	}
 	return mutated;
@@ -261,8 +473,10 @@ function applyLegacyStore(store, legacy) {
 			store.profiles[profileId] = {
 				type: "api_key",
 				provider: String(cred.provider ?? provider),
-				key: cred.key,
-				...cred.email ? { email: cred.email } : {}
+				...cred.key !== undefined ? { key: cred.key } : {},
+				...cred.keyRef ? { keyRef: cred.keyRef } : {},
+				...cred.email ? { email: cred.email } : {},
+				...cred.metadata ? { metadata: cred.metadata } : {}
 			};
 			continue;
 		}
@@ -270,7 +484,8 @@ function applyLegacyStore(store, legacy) {
 			store.profiles[profileId] = {
 				type: "token",
 				provider: String(cred.provider ?? provider),
-				token: cred.token,
+				...cred.token !== undefined ? { token: cred.token } : {},
+				...cred.tokenRef ? { tokenRef: cred.tokenRef } : {},
 				...typeof cred.expires === "number" ? { expires: cred.expires } : {},
 				...cred.email ? { email: cred.email } : {}
 			};
@@ -289,9 +504,20 @@ function applyLegacyStore(store, legacy) {
 		};
 	}
 }
-function loadCoercedStore(authPath) {
-	const raw = loadJsonFile(authPath);
-	return coerceAuthStore(raw);
+function loadCoercedStore(authPath, strict = false) {
+	const raw = readJsonFileForAuthRuntime({
+		pathname: authPath,
+		label: "Auth profile store",
+		strict
+	});
+	if (raw === undefined) {
+		return null;
+	}
+	const store = coerceAuthStore(raw, { rejectInvalidEntries: strict });
+	if (!store && strict) {
+		throw new Error("Auth profile store has an invalid structure or credential entry.");
+	}
+	return store;
 }
 function loadAuthProfileStore() {
 	const authPath = resolveAuthStorePath();
@@ -323,8 +549,9 @@ function loadAuthProfileStore() {
 }
 function loadAuthProfileStoreForAgent(agentDir, options) {
 	const readOnly = options?.readOnly === true;
+	const strict = options?.strict === true;
 	const authPath = resolveAuthStorePath(agentDir);
-	const asStore = loadCoercedStore(authPath);
+	const asStore = loadCoercedStore(authPath, strict);
 	if (asStore) {
 		const synced = shouldSyncExternalCliCredentials(options) ? syncExternalCliCredentials(asStore) : false;
 		if (synced && !readOnly) {
@@ -342,8 +569,16 @@ function loadAuthProfileStoreForAgent(agentDir, options) {
 			return mainStore;
 		}
 	}
-	const legacyRaw = loadJsonFile(resolveLegacyAuthStorePath(agentDir));
-	const legacy = coerceLegacyStore(legacyRaw);
+	const legacyPath = resolveLegacyAuthStorePath(agentDir);
+	const legacyRaw = readJsonFileForAuthRuntime({
+		pathname: legacyPath,
+		label: "Legacy auth profile store",
+		strict
+	});
+	const legacy = coerceLegacyStore(legacyRaw, { rejectInvalidEntries: strict });
+	if (legacyRaw !== undefined && !legacy && strict) {
+		throw new Error("Legacy auth profile store has an invalid structure or credential entry.");
+	}
 	const store = {
 		version: AUTH_STORE_VERSION,
 		profiles: {}
@@ -351,7 +586,7 @@ function loadAuthProfileStoreForAgent(agentDir, options) {
 	if (legacy) {
 		applyLegacyStore(store, legacy);
 	}
-	const mergedOAuth = mergeOAuthFileIntoStore(store);
+	const mergedOAuth = mergeOAuthFileIntoStore(store, strict);
 	const syncedCli = shouldSyncExternalCliCredentials(options) ? syncExternalCliCredentials(store) : false;
 	const forceReadOnly = process.env.FASED_AUTH_STORE_READONLY === "1";
 	const shouldWrite = !readOnly && !forceReadOnly && (legacy !== null || mergedOAuth || syncedCli);
@@ -361,7 +596,7 @@ function loadAuthProfileStoreForAgent(agentDir, options) {
 	if (shouldWrite && legacy !== null) {
 		const legacyPath = resolveLegacyAuthStorePath(agentDir);
 		try {
-			fs.unlinkSync(legacyPath);
+			syncFs.unlinkSync(legacyPath);
 		} catch (err) {
 			if (err?.code !== "ENOENT") {
 				log.warn("failed to delete legacy auth.json after migration", {
@@ -389,6 +624,7 @@ function loadAuthProfileStoreForRuntime(agentDir, options) {
 function loadAuthProfileStoreForSecretsRuntime(agentDir) {
 	return loadAuthProfileStoreForRuntime(agentDir, {
 		readOnly: true,
+		strict: true,
 		allowKeychainPrompt: false
 	});
 }

package/dist/agents/bash-tools.exec.js

@@ -11,6 +11,7 @@ import { buildSandboxEnv, clampWithDefault, coerceEnv, readEnvInt, resolveSandbo
 import { DEFAULT_MAX_OUTPUT, DEFAULT_PATH, DEFAULT_PENDING_MAX_OUTPUT, applyShellPath, execSchema, normalizeExecAsk, normalizeExecSecurity, normalizeExecTarget, resolveApprovalRunningNoticeMs, resolveExecTarget, runExecProcess, sanitizeHostBaseEnv, validateHostEnv } from "./bash-tools.exec-runtime.js";
 import { processGatewayAllowlist } from "./bash-tools.exec-host-gateway.js";
 import { executeNodeHostCommand } from "./bash-tools.exec-host-node.js";
+import { getActiveSkillEnvOverrides } from "./skills/env-overrides.js";
 import path from "node:path";
 
 //#region src/agents/bash-tools.exec.ts
@@ -260,16 +261,21 @@ function createExecTool(defaults) {
 			}
 			const inheritedBaseEnv = coerceEnv(process.env);
 			const baseEnv = host === "sandbox" ? inheritedBaseEnv : sanitizeHostBaseEnv(inheritedBaseEnv);
+			const trustedSkillEnv = { ...getActiveSkillEnvOverrides() };
 			if (host !== "sandbox" && params.env) {
 				validateHostEnv(params.env);
 			}
-			const mergedEnv = params.env ? {
+			const mergedEnv = {
 				...baseEnv,
-				...params.env
-			} : baseEnv;
+				...params.env,
+				...trustedSkillEnv
+			};
 			const env = sandbox ? buildSandboxEnv({
 				defaultPath: DEFAULT_PATH,
-				paramsEnv: params.env,
+				paramsEnv: {
+					...params.env,
+					...trustedSkillEnv
+				},
 				sandboxEnv: sandbox.env,
 				containerWorkdir: containerWorkdir ?? sandbox.containerWorkdir
 			}) : mergedEnv;

package/dist/agents/bash-tools.shared.js

@@ -3,7 +3,7 @@ import { assertSandboxPath } from "./sandbox-paths.js";
 import { existsSync, statSync } from "node:fs";
 import { homedir } from "node:os";
 import path from "node:path";
-import fs$1 from "node:fs/promises";
+import fs from "node:fs/promises";
 
 //#region src/agents/bash-tools.shared.ts
 const CHUNK_LIMIT = 8 * 1024;
@@ -67,7 +67,7 @@ async function resolveSandboxWorkdir(params) {
 			cwd: process.cwd(),
 			root: params.sandbox.workspaceDir
 		});
-		const stats = await fs$1.stat(resolved.resolved);
+		const stats = await fs.stat(resolved.resolved);
 		if (!stats.isDirectory()) {
 			throw new Error("workdir is not a directory");
 		}

package/dist/agents/cli-credentials.js

@@ -1,7 +1,7 @@
 import { resolveUserPath } from "../utils.js";
 import { createSubsystemLogger } from "../logging/subsystem.js";
 import { loadJsonFile, saveJsonFile } from "../infra/json-file.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import path from "node:path";
 import { execFileSync, execSync } from "node:child_process";
 import { createHash } from "node:crypto";
@@ -61,7 +61,7 @@ function resolveCodexHomePath() {
 	const configured = process.env.CODEX_HOME;
 	const home = configured ? resolveUserPath(configured) : resolveUserPath("~/.codex");
 	try {
-		return fs.realpathSync.native(home);
+		return syncFs.realpathSync.native(home);
 	} catch {
 		return home;
 	}
@@ -264,7 +264,7 @@ function writeClaudeCliKeychainCredentials(newCredentials, options) {
 }
 function writeClaudeCliFileCredentials(newCredentials, options) {
 	const credPath = resolveClaudeCliCredentialsPath(options?.homeDir);
-	if (!fs.existsSync(credPath)) {
+	if (!syncFs.existsSync(credPath)) {
 		return false;
 	}
 	try {
@@ -331,7 +331,7 @@ function readCodexCliCredentials(options) {
 	}
 	let expires;
 	try {
-		const stat = fs.statSync(authPath);
+		const stat = syncFs.statSync(authPath);
 		expires = stat.mtimeMs + 60 * 60 * 1e3;
 	} catch {
 		expires = Date.now() + 60 * 60 * 1e3;

package/dist/agents/current-model-catalog.js

@@ -1,12 +1,12 @@
+import { XIAOMI_BASE_URL, XIAOMI_MODEL_CATALOG } from "../providers/xiaomi-models.js";
+import { BYTEPLUS_BASE_URL, BYTEPLUS_CODING_BASE_URL, BYTEPLUS_CODING_MODEL_CATALOG, BYTEPLUS_MODEL_CATALOG, buildBytePlusModelDefinition } from "./byteplus-models.js";
 import { CLOUDFLARE_AI_GATEWAY_MODEL_CATALOG, buildCloudflareAiGatewayModelDefinition } from "../providers/cloudflare-ai-gateway-shared.js";
+import "./cloudflare-ai-gateway.js";
 import { HUGGINGFACE_BASE_URL, HUGGINGFACE_MODEL_CATALOG, buildHuggingfaceModelDefinition } from "../providers/huggingface-models.js";
 import { SYNTHETIC_BASE_URL, SYNTHETIC_MODEL_CATALOG, buildSyntheticModelDefinition } from "../providers/synthetic-models.js";
 import { TOGETHER_BASE_URL, TOGETHER_MODEL_CATALOG, buildTogetherModelDefinition } from "../providers/together-models.js";
 import { VENICE_BASE_URL, VENICE_MODEL_CATALOG, buildVeniceModelDefinition } from "../providers/venice-models.js";
 import { VERCEL_AI_GATEWAY_MODEL_IDS, buildVercelAiGatewayModelDefinition } from "../providers/vercel-ai-gateway-models.js";
-import { XIAOMI_BASE_URL, XIAOMI_MODEL_CATALOG } from "../providers/xiaomi-models.js";
-import { BYTEPLUS_BASE_URL, BYTEPLUS_CODING_BASE_URL, BYTEPLUS_CODING_MODEL_CATALOG, BYTEPLUS_MODEL_CATALOG, buildBytePlusModelDefinition } from "./byteplus-models.js";
-import "./cloudflare-ai-gateway.js";
 import { buildCopilotModelDefinition, buildCopilotProxyModelDefinition, getDefaultCopilotModelIds, getDefaultCopilotProxyModelIds } from "../providers/github-copilot-models.js";
 import { CHUTES_BASE_URL, CHUTES_MODEL_CATALOG, buildChutesModelDefinition } from "./chutes-models.js";
 import { DOUBAO_BASE_URL, DOUBAO_CODING_BASE_URL, DOUBAO_CODING_MODEL_CATALOG, DOUBAO_MODEL_CATALOG, buildDoubaoModelDefinition } from "./doubao-models.js";