@opengeni/runtime 0.4.0 → 0.5.0

package/dist/{chunk-HGQ252FL.js → chunk-Q36E4MDM.js}

@@ -637,6 +637,17 @@ function setSelfhostedApplyDiff(fn) {
   injectedApplyDiff = fn;
 }
 var SELFHOSTED_DEFAULT_TIMEOUT_MS = 3e4;
+var SELFHOSTED_EXEC_ENV_ALLOWLIST = ["OPENGENI_TOOLSPACE_URL", "OPENGENI_TOOLSPACE_TOKEN_FILE"];
+function selfhostedExecEnv(environment) {
+  const env = {};
+  for (const key of SELFHOSTED_EXEC_ENV_ALLOWLIST) {
+    const value = environment[key];
+    if (value) {
+      env[key] = value;
+    }
+  }
+  return env;
+}
 var SELFHOSTED_RELAY_STREAM_PATH = "/stream";
 var SelfhostedSession = class {
   backendId = "selfhosted";
@@ -733,7 +744,11 @@ var SelfhostedSession = class {
       // SELFHOSTED_VIRTUAL_ROOT). Empty → the session workingDir (itself "" by
       // default ⇒ the agent runs in its workspace_root).
       cwd: toMachinePath(args.workdir, this.workingDir),
-      env: {},
+      // The machine owns its own shell environment; the manifest env is NOT
+      // exported here. The ONE exception is the non-secret toolspace pointers
+      // (URL + token-file path), so a programmatic `ogtool` call and the token-
+      // seed hook can find the tool surface. See SELFHOSTED_EXEC_ENV_ALLOWLIST.
+      env: selfhostedExecEnv(this.state.environment),
       stdin: new Uint8Array(0),
       timeoutMs: 0
     };
@@ -3711,4 +3726,4 @@ export {
   collectSandboxEnvironment2 as collectSandboxEnvironment,
   parseExposedPorts2 as parseExposedPorts
 };
-//# sourceMappingURL=chunk-HGQ252FL.js.map
+//# sourceMappingURL=chunk-Q36E4MDM.js.map