@sweny-ai/core 0.1.146 → 0.1.148

package/dist/agent-env.d.ts

@@ -57,6 +57,15 @@ export declare const CODEX_ENV_PREFIXES: readonly string[];
  * Pure: returns a copy.
  */
 export declare function resolveCodexAuthEnv(env: Record<string, string>): Record<string, string>;
+/**
+ * pi's provider credentials (badlogic/pi-mono v0.99.2, docs/providers.md).
+ * sweny has no model opinion, so a pi run may need any provider's key; only
+ * these names (never the rest of the env) reach the pi process. A stored
+ * `auth.json` is not used: pi runs with a scratch `PI_CODING_AGENT_DIR`.
+ */
+export declare const PI_AUTH_VARS: readonly string[];
+/** Prefixes for a pi run: locale only. `ANTHROPIC_*` / `CLAUDE_*` beyond the names above never reach pi. */
+export declare const PI_ENV_PREFIXES: readonly string[];
 /** A stored Codex login (`codex login`): `auth.json` under `CODEX_HOME`, default `~/.codex`. */
 export declare function hasCodexLogin(env?: Record<string, string | undefined>, exists?: (p: string) => boolean): boolean;
 export interface BuildAgentEnvOpts {

package/dist/agent-env.js

@@ -158,6 +158,67 @@ export function resolveCodexAuthEnv(env) {
         out.CODEX_API_KEY = out.OPENAI_API_KEY;
     return out;
 }
+/**
+ * pi's provider credentials (badlogic/pi-mono v0.99.2, docs/providers.md).
+ * sweny has no model opinion, so a pi run may need any provider's key; only
+ * these names (never the rest of the env) reach the pi process. A stored
+ * `auth.json` is not used: pi runs with a scratch `PI_CODING_AGENT_DIR`.
+ */
+export const PI_AUTH_VARS = [
+    "ANTHROPIC_API_KEY",
+    "ANTHROPIC_OAUTH_TOKEN",
+    "ANTHROPIC_AUTH_TOKEN",
+    "OPENAI_API_KEY",
+    "GEMINI_API_KEY",
+    "DEEPSEEK_API_KEY",
+    "MISTRAL_API_KEY",
+    "GROQ_API_KEY",
+    "CEREBRAS_API_KEY",
+    "XAI_API_KEY",
+    "OPENROUTER_API_KEY",
+    "AI_GATEWAY_API_KEY",
+    "ZAI_API_KEY",
+    "ZAI_CODING_CN_API_KEY",
+    "OPENCODE_API_KEY",
+    "RADIUS_API_KEY",
+    "TYPESAFE_API_KEY",
+    "HF_TOKEN",
+    "FIREWORKS_API_KEY",
+    "TOGETHER_API_KEY",
+    "BASETEN_API_KEY",
+    "KIMI_API_KEY",
+    "META_API_KEY",
+    "MINIMAX_API_KEY",
+    "MINIMAX_CN_API_KEY",
+    "MOONSHOT_API_KEY",
+    "NVIDIA_API_KEY",
+    "ANT_LING_API_KEY",
+    "QWEN_TOKEN_PLAN_API_KEY",
+    "QWEN_TOKEN_PLAN_CN_API_KEY",
+    "XIAOMI_API_KEY",
+    "XIAOMI_TOKEN_PLAN_CN_API_KEY",
+    "XIAOMI_TOKEN_PLAN_AMS_API_KEY",
+    "XIAOMI_TOKEN_PLAN_SGP_API_KEY",
+    "COPILOT_GITHUB_TOKEN",
+    "AZURE_OPENAI_API_KEY",
+    "AZURE_OPENAI_BASE_URL",
+    "AZURE_OPENAI_RESOURCE_NAME",
+    "CLOUDFLARE_API_KEY",
+    "CLOUDFLARE_ACCOUNT_ID",
+    "CLOUDFLARE_GATEWAY_ID",
+    "GOOGLE_CLOUD_API_KEY",
+    "GOOGLE_CLOUD_PROJECT",
+    "GCLOUD_PROJECT",
+    "GOOGLE_CLOUD_LOCATION",
+    "AWS_ACCESS_KEY_ID",
+    "AWS_SECRET_ACCESS_KEY",
+    "AWS_SESSION_TOKEN",
+    "AWS_BEARER_TOKEN_BEDROCK",
+    "AWS_REGION",
+    "AWS_DEFAULT_REGION",
+];
+/** Prefixes for a pi run: locale only. `ANTHROPIC_*` / `CLAUDE_*` beyond the names above never reach pi. */
+export const PI_ENV_PREFIXES = ["LC_"];
 /** A stored Codex login (`codex login`): `auth.json` under `CODEX_HOME`, default `~/.codex`. */
 export function hasCodexLogin(env = process.env, exists = existsSync) {
     const home = env.CODEX_HOME || path.join(homedir(), ".codex");

package/dist/cli/config-file.d.ts

@@ -19,4 +19,4 @@ export type FileConfig = Record<string, string | string[] | Record<string, unkno
  */
 export declare function loadConfigFile(cwd?: string): FileConfig;
 /** Starter config written by `sweny new`. */
-export declare const STARTER_CONFIG = "# .sweny.yml \u2014 SWEny project configuration\n# Commit this file. Secrets (API keys, tokens) go in .env (gitignored).\n#\n# Every key matches a CLI flag: \"time-range: 4h\" is the same as \"--time-range 4h\".\n# CLI flags override this file; env vars override this file; this file overrides defaults.\n\n# \u2500\u2500 Providers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# observability-provider: datadog        # datadog | sentry | cloudwatch | splunk | elastic | newrelic | loki | prometheus | pagerduty | heroku | opsgenie | vercel | supabase | netlify | fly | render | file\n# issue-tracker-provider: github-issues  # github-issues | linear | jira\n# source-control-provider: github        # github | gitlab\n# coding-agent-provider: claude          # claude | codex\n# notification-provider: console         # console | slack | teams | discord | email | webhook\n\n# \u2500\u2500 Investigation \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# time-range: 24h\n# severity-focus: errors\n# service-filter: \"*\"\n# investigation-depth: standard          # quick | standard | thorough\n\n# \u2500\u2500 PR / branch \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# base-branch: main\n# pr-labels: agent,triage,needs-review\n\n# \u2500\u2500 Paths \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# service-map-path: .github/service-map.yml\n# log-file: ./logs/errors.json           # required when observability-provider is \"file\"\n\n# \u2500\u2500 Cache \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# cache-dir: .sweny/cache\n# cache-ttl: 86400\n\n# \u2500\u2500 Run reporting \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Opt-in and not currently available: token minting is not yet exposed, so\n# leaving this unset means no reporting request is ever made.\n# cloud-token: sweny_pk_...\n# Or set SWENY_CLOUD_TOKEN in your environment.\n\n# \u2500\u2500 Agent sandbox \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# See https://docs.sweny.ai/advanced/agent-sandbox/\n# sandbox: off                           # off (local default) | auto (CI default: sandbox if supported, else warn) | strict\n# sandbox-allowed-domains: [internal.example.com]   # extra hosts agent commands may reach\n# env-scope: off                         # off (local default: full env) | on (CI default: allowlist)\n# env-passthrough: [NPM_TOKEN]           # extra env vars the agent may see when scoped (\"*\" = all)\n\n# \u2500\u2500 MCP servers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Extend the coding agent with additional tools via MCP.\n# Value is a JSON object \u2014 each key is a server name you choose.\n# See https://docs.sweny.ai/advanced/mcp-servers/ for a full catalog with copy-paste configs.\n#\n# Example: GitHub MCP server (query PRs, issues, CI run logs)\n# mcp-servers-json: '{\"github\":{\"type\":\"stdio\",\"command\":\"npx\",\"args\":[\"-y\",\"@modelcontextprotocol/server-github@latest\"],\"env\":{\"GITHUB_PERSONAL_ACCESS_TOKEN\":\"ghp_...\"}}}'\n\n# \u2500\u2500 Local-only quick start \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Uncomment to run without any external services (just an LLM API key):\n# observability-provider: file\n# log-file: ./sample-errors.json\n# issue-tracker-provider: file\n# source-control-provider: file\n# notification-provider: file\n# output-dir: .sweny/output\n\n# \u2500\u2500 Credentials (.env) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Copy the relevant block into your .env file and fill in the values.\n#\n# Claude (coding agent) \u2014 https://console.anthropic.com/settings/api-keys\n#   ANTHROPIC_API_KEY=sk-ant-...\n#\n# GitHub (source control + issue tracker)\n#   GITHUB_TOKEN=ghp_...        # https://github.com/settings/tokens (repo + issues scopes)\n#\n# Datadog (observability) \u2014 https://app.datadoghq.com/organization-settings\n#   DD_API_KEY=...              # Organization Settings > API Keys\n#   DD_APP_KEY=...              # Organization Settings > Application Keys\n#   DD_SITE=datadoghq.com       # or datadoghq.eu, us3.datadoghq.com, etc.\n#\n# Sentry (observability) \u2014 https://sentry.io/settings/auth-tokens/\n#   SENTRY_AUTH_TOKEN=sntrys_...\n#   SENTRY_ORG=your-org-slug    # from sentry.io/organizations/<slug>/\n#   SENTRY_PROJECT=your-project # Project Settings > General > Project Slug\n#\n# Linear (issue tracker) \u2014 https://linear.app/settings/api\n#   LINEAR_API_KEY=lin_api_...\n#   LINEAR_TEAM_ID=...          # Settings > Workspace > Teams > [team] > copy ID from URL\n#   LINEAR_BUG_LABEL_ID=...     # Settings > Labels > [label] > copy ID from URL\n#\n# Jira (issue tracker) \u2014 https://your-org.atlassian.net\n#   JIRA_BASE_URL=https://your-org.atlassian.net\n#   JIRA_EMAIL=you@company.com  # your Atlassian account email\n#   JIRA_API_TOKEN=...          # https://id.atlassian.com/manage-profile/security/api-tokens\n#\n# Vercel (observability) \u2014 https://vercel.com/account/tokens\n#   VERCEL_TOKEN=...\n#   VERCEL_PROJECT_ID=prj_...      # Project Settings > General > Project ID\n#   VERCEL_TEAM_ID=team_...        # optional, for team-owned projects\n#\n# Supabase (observability) \u2014 https://supabase.com/dashboard/account/tokens\n#   SUPABASE_MANAGEMENT_KEY=...\n#   SUPABASE_PROJECT_REF=...       # Project Settings > General > Reference ID\n#\n# Netlify (observability) \u2014 https://app.netlify.com/user/applications#personal-access-tokens\n#   NETLIFY_TOKEN=...\n#   NETLIFY_SITE_ID=...         # Site Settings > General > Site ID\n#\n# Fly.io (observability) \u2014 https://fly.io/user/personal_access_tokens\n#   FLY_TOKEN=...\n#   FLY_APP_NAME=...             # the name of your Fly.io application\n#\n# Render (observability) \u2014 https://dashboard.render.com/u/settings\n#   RENDER_API_KEY=...\n#   RENDER_SERVICE_ID=srv-...    # from your service's Settings page\n#\n# Prometheus (observability) \u2014 self-hosted or Grafana Cloud\n#   PROMETHEUS_URL=http://prometheus.internal:9090\n#   PROMETHEUS_TOKEN=...         # optional, for secured instances\n#\n# PagerDuty (observability) \u2014 https://your-account.pagerduty.com/api_keys\n#   PAGERDUTY_API_KEY=...\n#\n# Honeycomb (observability) \u2014 https://docs.honeycomb.io/api/\n#   HONEYCOMB_API_KEY=...\n#   HONEYCOMB_DATASET=...        # dataset name (e.g. production)\n#\n# Heroku (observability) \u2014 https://devcenter.heroku.com/articles/platform-api-reference\n#   HEROKU_API_KEY=...           # https://dashboard.heroku.com/account\n#   HEROKU_APP_NAME=...          # the name of your Heroku application\n#\n# OpsGenie (observability) \u2014 https://support.atlassian.com/opsgenie/docs/api-key-management/\n#   OPSGENIE_API_KEY=...\n#   OPSGENIE_REGION=us           # or eu for EU-hosted accounts\n#\n# Slack (notifications) \u2014 https://api.slack.com/apps\n#   NOTIFICATION_WEBHOOK_URL=https://hooks.slack.com/services/...\n#   # or use a bot token: SLACK_BOT_TOKEN=xoxb-...\n";
+export declare const STARTER_CONFIG = "# .sweny.yml \u2014 SWEny project configuration\n# Commit this file. Secrets (API keys, tokens) go in .env (gitignored).\n#\n# Every key matches a CLI flag: \"time-range: 4h\" is the same as \"--time-range 4h\".\n# CLI flags override this file; env vars override this file; this file overrides defaults.\n\n# \u2500\u2500 Providers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# observability-provider: datadog        # datadog | sentry | cloudwatch | splunk | elastic | newrelic | loki | prometheus | pagerduty | heroku | opsgenie | vercel | supabase | netlify | fly | render | file\n# issue-tracker-provider: github-issues  # github-issues | linear | jira\n# source-control-provider: github        # github | gitlab\n# coding-agent-provider: claude          # claude | codex | pi\n# notification-provider: console         # console | slack | teams | discord | email | webhook\n\n# \u2500\u2500 Investigation \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# time-range: 24h\n# severity-focus: errors\n# service-filter: \"*\"\n# investigation-depth: standard          # quick | standard | thorough\n\n# \u2500\u2500 PR / branch \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# base-branch: main\n# pr-labels: agent,triage,needs-review\n\n# \u2500\u2500 Paths \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# service-map-path: .github/service-map.yml\n# log-file: ./logs/errors.json           # required when observability-provider is \"file\"\n\n# \u2500\u2500 Cache \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# cache-dir: .sweny/cache\n# cache-ttl: 86400\n\n# \u2500\u2500 Run reporting \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Opt-in and not currently available: token minting is not yet exposed, so\n# leaving this unset means no reporting request is ever made.\n# cloud-token: sweny_pk_...\n# Or set SWENY_CLOUD_TOKEN in your environment.\n\n# \u2500\u2500 Agent sandbox \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# See https://docs.sweny.ai/advanced/agent-sandbox/\n# sandbox: off                           # off (local default) | auto (CI default: sandbox if supported, else warn) | strict\n# sandbox-allowed-domains: [internal.example.com]   # extra hosts agent commands may reach\n# env-scope: off                         # off (local default: full env) | on (CI default: allowlist)\n# env-passthrough: [NPM_TOKEN]           # extra env vars the agent may see when scoped (\"*\" = all)\n\n# \u2500\u2500 MCP servers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Extend the coding agent with additional tools via MCP.\n# Value is a JSON object \u2014 each key is a server name you choose.\n# See https://docs.sweny.ai/advanced/mcp-servers/ for a full catalog with copy-paste configs.\n#\n# Example: GitHub MCP server (query PRs, issues, CI run logs)\n# mcp-servers-json: '{\"github\":{\"type\":\"stdio\",\"command\":\"npx\",\"args\":[\"-y\",\"@modelcontextprotocol/server-github@latest\"],\"env\":{\"GITHUB_PERSONAL_ACCESS_TOKEN\":\"ghp_...\"}}}'\n\n# \u2500\u2500 Local-only quick start \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Uncomment to run without any external services (just an LLM API key):\n# observability-provider: file\n# log-file: ./sample-errors.json\n# issue-tracker-provider: file\n# source-control-provider: file\n# notification-provider: file\n# output-dir: .sweny/output\n\n# \u2500\u2500 Credentials (.env) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Copy the relevant block into your .env file and fill in the values.\n#\n# Claude (coding agent) \u2014 https://console.anthropic.com/settings/api-keys\n#   ANTHROPIC_API_KEY=sk-ant-...\n#\n# GitHub (source control + issue tracker)\n#   GITHUB_TOKEN=ghp_...        # https://github.com/settings/tokens (repo + issues scopes)\n#\n# Datadog (observability) \u2014 https://app.datadoghq.com/organization-settings\n#   DD_API_KEY=...              # Organization Settings > API Keys\n#   DD_APP_KEY=...              # Organization Settings > Application Keys\n#   DD_SITE=datadoghq.com       # or datadoghq.eu, us3.datadoghq.com, etc.\n#\n# Sentry (observability) \u2014 https://sentry.io/settings/auth-tokens/\n#   SENTRY_AUTH_TOKEN=sntrys_...\n#   SENTRY_ORG=your-org-slug    # from sentry.io/organizations/<slug>/\n#   SENTRY_PROJECT=your-project # Project Settings > General > Project Slug\n#\n# Linear (issue tracker) \u2014 https://linear.app/settings/api\n#   LINEAR_API_KEY=lin_api_...\n#   LINEAR_TEAM_ID=...          # Settings > Workspace > Teams > [team] > copy ID from URL\n#   LINEAR_BUG_LABEL_ID=...     # Settings > Labels > [label] > copy ID from URL\n#\n# Jira (issue tracker) \u2014 https://your-org.atlassian.net\n#   JIRA_BASE_URL=https://your-org.atlassian.net\n#   JIRA_EMAIL=you@company.com  # your Atlassian account email\n#   JIRA_API_TOKEN=...          # https://id.atlassian.com/manage-profile/security/api-tokens\n#\n# Vercel (observability) \u2014 https://vercel.com/account/tokens\n#   VERCEL_TOKEN=...\n#   VERCEL_PROJECT_ID=prj_...      # Project Settings > General > Project ID\n#   VERCEL_TEAM_ID=team_...        # optional, for team-owned projects\n#\n# Supabase (observability) \u2014 https://supabase.com/dashboard/account/tokens\n#   SUPABASE_MANAGEMENT_KEY=...\n#   SUPABASE_PROJECT_REF=...       # Project Settings > General > Reference ID\n#\n# Netlify (observability) \u2014 https://app.netlify.com/user/applications#personal-access-tokens\n#   NETLIFY_TOKEN=...\n#   NETLIFY_SITE_ID=...         # Site Settings > General > Site ID\n#\n# Fly.io (observability) \u2014 https://fly.io/user/personal_access_tokens\n#   FLY_TOKEN=...\n#   FLY_APP_NAME=...             # the name of your Fly.io application\n#\n# Render (observability) \u2014 https://dashboard.render.com/u/settings\n#   RENDER_API_KEY=...\n#   RENDER_SERVICE_ID=srv-...    # from your service's Settings page\n#\n# Prometheus (observability) \u2014 self-hosted or Grafana Cloud\n#   PROMETHEUS_URL=http://prometheus.internal:9090\n#   PROMETHEUS_TOKEN=...         # optional, for secured instances\n#\n# PagerDuty (observability) \u2014 https://your-account.pagerduty.com/api_keys\n#   PAGERDUTY_API_KEY=...\n#\n# Honeycomb (observability) \u2014 https://docs.honeycomb.io/api/\n#   HONEYCOMB_API_KEY=...\n#   HONEYCOMB_DATASET=...        # dataset name (e.g. production)\n#\n# Heroku (observability) \u2014 https://devcenter.heroku.com/articles/platform-api-reference\n#   HEROKU_API_KEY=...           # https://dashboard.heroku.com/account\n#   HEROKU_APP_NAME=...          # the name of your Heroku application\n#\n# OpsGenie (observability) \u2014 https://support.atlassian.com/opsgenie/docs/api-key-management/\n#   OPSGENIE_API_KEY=...\n#   OPSGENIE_REGION=us           # or eu for EU-hosted accounts\n#\n# Slack (notifications) \u2014 https://api.slack.com/apps\n#   NOTIFICATION_WEBHOOK_URL=https://hooks.slack.com/services/...\n#   # or use a bot token: SLACK_BOT_TOKEN=xoxb-...\n";

package/dist/cli/config-file.js

@@ -148,7 +148,7 @@ export const STARTER_CONFIG = `# .sweny.yml — SWEny project configuration
 # observability-provider: datadog        # datadog | sentry | cloudwatch | splunk | elastic | newrelic | loki | prometheus | pagerduty | heroku | opsgenie | vercel | supabase | netlify | fly | render | file
 # issue-tracker-provider: github-issues  # github-issues | linear | jira
 # source-control-provider: github        # github | gitlab
-# coding-agent-provider: claude          # claude | codex
+# coding-agent-provider: claude          # claude | codex | pi
 # notification-provider: console         # console | slack | teams | discord | email | webhook
 
 # ── Investigation ────────────────────────────────────────────────────

package/dist/cli/config.js

@@ -8,7 +8,7 @@ export function registerTriageCommand(program) {
     return program
         .command("triage")
         .description("Run the SWEny triage workflow")
-        .option("--agent <provider>", "Coding agent: claude (default) or codex")
+        .option("--agent <provider>", "Coding agent: claude (default), codex, or pi (experimental)")
         .option("--coding-agent-provider <provider>", "Coding agent provider (alias for --agent)")
         .option("--observability-provider <provider>", "Observability provider (default: none)")
         .option("--issue-tracker-provider <provider>", "Issue tracker provider (default: github-issues)")
@@ -238,6 +238,10 @@ export function validateInputs(config) {
                 errors.push("Missing: CODEX_API_KEY or OPENAI_API_KEY, or a Codex login (`codex login`), for --agent codex");
             }
             break;
+        case "pi":
+            // pi takes any provider's key, or none (a local model in models.json), so
+            // there is no single credential to check here; pi reports its own auth error.
+            break;
         default:
             // Honest --agent (#330): only agents with an adapter are accepted.
             // Anything else would silently run a different agent under that name.
@@ -658,7 +662,7 @@ export function registerImplementCommand(program) {
     return program
         .command("implement <issueId>")
         .description("Implement a fix for a specific issue and open a PR")
-        .option("--agent <provider>", "Coding agent: claude (default) or codex")
+        .option("--agent <provider>", "Coding agent: claude (default), codex, or pi (experimental)")
         .option("--coding-agent-provider <provider>", "Coding agent provider (alias for --agent)")
         .option("--issue-tracker-provider <provider>", "Issue tracker (linear|jira|github-issues|file)")
         .option("--source-control-provider <provider>", "Source control (github|gitlab|file)")

package/dist/cli/run-output.js

@@ -215,7 +215,7 @@ export const WORKFLOW_RUN_OPTIONS = [
         "Write a PR-comment markdown (run receipt, status-colored DAG, per-node table; metadata only) to <path> so any CI can post it",
     ],
     ["--input <json>", "JSON string of input data to pass to the workflow"],
-    ["--agent <id>", "Coding agent that runs the nodes: claude (default) or codex"],
+    ["--agent <id>", "Coding agent that runs the nodes: claude (default), codex, or pi (experimental)"],
     [
         "--harness-policy <mode>",
         "strict: refuse a node whose policy the agent cannot enforce; warn: run it and report what was not enforced (default: strict under GitHub Actions, warn elsewhere; env SWENY_HARNESS_POLICY)",

package/dist/harness/agents.d.ts

@@ -4,7 +4,7 @@
  * runs one agent under another's name. No runtime imports (the CLI config and
  * the harness factory share it).
  */
-export declare const SUPPORTED_AGENTS: readonly ["claude", "codex"];
+export declare const SUPPORTED_AGENTS: readonly ["claude", "codex", "pi"];
 export type SupportedAgent = (typeof SUPPORTED_AGENTS)[number];
 export declare function isSupportedAgent(id: string): id is SupportedAgent;
 /** The error for an agent id with no adapter. */

package/dist/harness/agents.js

@@ -4,12 +4,12 @@
  * runs one agent under another's name. No runtime imports (the CLI config and
  * the harness factory share it).
  */
-export const SUPPORTED_AGENTS = ["claude", "codex"];
+export const SUPPORTED_AGENTS = ["claude", "codex", "pi"];
 export function isSupportedAgent(id) {
     return SUPPORTED_AGENTS.includes(id);
 }
 /** The error for an agent id with no adapter. */
 export function unsupportedAgentError(id) {
     return (`Unsupported coding agent "${id}": supported agents are "claude" (headless Claude Code) ` +
-        `and "codex" (Codex CLI). Remove --agent / coding-agent-provider or set it to one of them.`);
+        `and "codex" (Codex CLI), or "pi" (pi coding agent, experimental). Remove --agent / coding-agent-provider or set it to one of them.`);
 }

package/dist/harness/capabilities.d.ts

@@ -28,3 +28,31 @@ export declare const CLAUDE_CODE_CAPABILITIES: HarnessCapabilities;
  * - usage tokens only: `turn.completed.usage`; Codex reports no cost.
  */
 export declare const CODEX_CAPABILITIES: HarnessCapabilities;
+/**
+ * pi (`pi --mode rpc`), declared from the pi coding-agent docs and source at
+ * badlogic/pi-mono v0.99.2 (`packages/coding-agent/docs/{cli,rpc,rpc-commands,json,mcp,
+ * security,message-types}.md`, `src/core/agent-session.ts`, `src/extensions/mcp/`)
+ * and probed by the contract suite against the scripted fake:
+ * - structuredOutput prompt: pi has no output-schema flag; sweny prompts for
+ *   the JSON, parses and validates it.
+ * - toolTrace full: `tool_execution_start|end` events carry `toolCallId`,
+ *   `toolName`, `args`, `isError` for built-in and MCP tools alike.
+ * - builtinDeny shell-only, plus write, edit and subagent: `--exclude-tools` and
+ *   `--tools` take tool names (`bash`, `write`, `edit`), and `-ne` leaves no
+ *   extension, so no subagent tool exists. pi has no built-in net tool, so `net`
+ *   is not deniable as a class (`bash` can still curl): it degrades or, in
+ *   strict, refuses.
+ * - mcp home-isolation: MCP is a built-in extension that reads `mcp.json` from
+ *   `$PI_CODING_AGENT_DIR`. sweny points that at a scratch dir holding only the
+ *   generated `mcp.json`, and passes `-na` so a project `.pi/mcp.json` never loads.
+ * - sandbox none: "no built-in sandbox" (docs/security.md). The process wrapper
+ *   (sandbox-wrapper.ts) is the only containment; strict refuses without it.
+ * - readOnly tool-allowlist: `--tools read,grep,find,ls` plus sweny's own MCP
+ *   tools; no shell, write or edit tool exists in the run.
+ * - turnLimit watchdog: pi has no turn limit flag; sweny counts
+ *   `tool_execution_start` events and aborts.
+ * - usage tokens and cost: `get_session_stats` returns tokens and cost for the
+ *   session. Read once at the end, so `live` is false.
+ * - cancel rpc: the `abort` command, then SIGTERM and SIGKILL.
+ */
+export declare const PI_CAPABILITIES: HarnessCapabilities;

package/dist/harness/capabilities.js

@@ -50,3 +50,43 @@ export const CODEX_CAPABILITIES = {
     cancel: "kill",
     resume: false,
 };
+/**
+ * pi (`pi --mode rpc`), declared from the pi coding-agent docs and source at
+ * badlogic/pi-mono v0.99.2 (`packages/coding-agent/docs/{cli,rpc,rpc-commands,json,mcp,
+ * security,message-types}.md`, `src/core/agent-session.ts`, `src/extensions/mcp/`)
+ * and probed by the contract suite against the scripted fake:
+ * - structuredOutput prompt: pi has no output-schema flag; sweny prompts for
+ *   the JSON, parses and validates it.
+ * - toolTrace full: `tool_execution_start|end` events carry `toolCallId`,
+ *   `toolName`, `args`, `isError` for built-in and MCP tools alike.
+ * - builtinDeny shell-only, plus write, edit and subagent: `--exclude-tools` and
+ *   `--tools` take tool names (`bash`, `write`, `edit`), and `-ne` leaves no
+ *   extension, so no subagent tool exists. pi has no built-in net tool, so `net`
+ *   is not deniable as a class (`bash` can still curl): it degrades or, in
+ *   strict, refuses.
+ * - mcp home-isolation: MCP is a built-in extension that reads `mcp.json` from
+ *   `$PI_CODING_AGENT_DIR`. sweny points that at a scratch dir holding only the
+ *   generated `mcp.json`, and passes `-na` so a project `.pi/mcp.json` never loads.
+ * - sandbox none: "no built-in sandbox" (docs/security.md). The process wrapper
+ *   (sandbox-wrapper.ts) is the only containment; strict refuses without it.
+ * - readOnly tool-allowlist: `--tools read,grep,find,ls` plus sweny's own MCP
+ *   tools; no shell, write or edit tool exists in the run.
+ * - turnLimit watchdog: pi has no turn limit flag; sweny counts
+ *   `tool_execution_start` events and aborts.
+ * - usage tokens and cost: `get_session_stats` returns tokens and cost for the
+ *   session. Read once at the end, so `live` is false.
+ * - cancel rpc: the `abort` command, then SIGTERM and SIGKILL.
+ */
+export const PI_CAPABILITIES = {
+    structuredOutput: "prompt",
+    toolTrace: "full",
+    builtinDeny: "shell-only",
+    denyClasses: ["shell", "write", "edit", "subagent"],
+    mcp: { inject: true, exclusive: "home-isolation" },
+    sandbox: { fs: false, network: false },
+    readOnly: "tool-allowlist",
+    turnLimit: "watchdog",
+    usage: { tokens: true, costUsd: true, live: false },
+    cancel: "rpc",
+    resume: false,
+};

package/dist/harness/claude-code.d.ts

@@ -175,7 +175,8 @@ export declare class ClaudeCodeHarness implements Claude, AgentHarness {
      * is a read-only run; `policy.deny` classes become native `disallowedTools`
      * names, merged with `nativeDeny` and the legacy `disallowedTools`; and
      * `policy.strict` makes MCP exclusive (`strictMcpConfig`) even for a
-     * write-capable node.
+     * write-capable node. Per-request sandbox mode overrides the client default,
+     * and policy egress supplies the node hosts without dropping scoped env access.
      */
     run(req: HarnessRunRequest): Promise<HarnessRunResult>;
     private runQuery;

package/dist/harness/claude-code.js

@@ -272,7 +272,8 @@ export class ClaudeCodeHarness {
      * is a read-only run; `policy.deny` classes become native `disallowedTools`
      * names, merged with `nativeDeny` and the legacy `disallowedTools`; and
      * `policy.strict` makes MCP exclusive (`strictMcpConfig`) even for a
-     * write-capable node.
+     * write-capable node. Per-request sandbox mode overrides the client default,
+     * and policy egress supplies the node hosts without dropping scoped env access.
      */
     async run(req) {
         const policy = req.policy ?? {
@@ -301,6 +302,8 @@ export class ClaudeCodeHarness {
             readOnly,
             disallowedTools: disallowedTools.length > 0 ? disallowedTools : undefined,
             strictMcp: readOnly || policy.strict,
+            sandboxMode: policy.sandbox,
+            agentAccess: { envVars: req.agentAccess?.envVars ?? [], domains: policy.egress },
         });
         return { ...result, harness: this.info(), degraded: gate.degraded };
     }
@@ -318,7 +321,7 @@ export class ClaudeCodeHarness {
         // `strict` fails the node here instead.
         const sandbox = resolveAgentSandbox({
             env: process.env,
-            mode: this.sandboxMode,
+            mode: opts.sandboxMode ?? this.sandboxMode,
             allowedDomains: this.sandboxAllowedDomains,
             nodeDomains: agentAccess?.domains,
             probe: this.sandboxProbe,
@@ -326,7 +329,7 @@ export class ClaudeCodeHarness {
         });
         if (sandbox.error) {
             this.logger.error(sandbox.error);
-            return { status: "failed", data: { error: sandbox.error }, toolCalls: [] };
+            return { status: "failed", data: { error: sandbox.error, refused: true }, toolCalls: [] };
         }
         if (sandbox.warning && !this.sandboxWarned) {
             this.sandboxWarned = true;

package/dist/harness/index.d.ts

@@ -4,6 +4,7 @@
  */
 import { ClaudeCodeHarness, type ClaudeCodeHarnessOptions } from "./claude-code.js";
 import { CodexHarness, type CodexHarnessOptions } from "./codex.js";
+import { PiHarness, type PiHarnessOptions } from "./pi.js";
 export { claudeCompat, asClaude } from "./compat.js";
 export type { AgentHarness, HarnessCapabilities, HarnessCompleteRequest, HarnessId, HarnessInfo, HarnessRunRequest, HarnessRunResult, NodePolicy, PolicyGateResult, PolicyWrappers, ToolClass, } from "./types.js";
 export { policyGate, nativeDenyClasses, resolveHarnessPolicy, isToolClass, TOOL_CLASSES } from "./policy.js";
@@ -13,6 +14,8 @@ export { ClaudeCodeHarness, CLAUDE_CODE_CAPABILITIES } from "./claude-code.js";
 export type { ClaudeCodeHarnessOptions } from "./claude-code.js";
 export { CodexHarness, CODEX_CAPABILITIES, MIN_CODEX_VERSION } from "./codex.js";
 export type { CodexHarnessOptions } from "./codex.js";
+export { PiHarness, PI_CAPABILITIES, MIN_PI_VERSION } from "./pi.js";
+export type { PiHarnessOptions } from "./pi.js";
 export { startToolBridge } from "./tool-bridge/server.js";
 export type { ToolBridge, ToolBridgeOptions } from "./tool-bridge/server.js";
 export { SUPPORTED_AGENTS, isSupportedAgent, unsupportedAgentError } from "./agents.js";
@@ -24,4 +27,5 @@ export type { SupportedAgent } from "./agents.js";
  */
 export declare function createHarness(id: "claude" | "claude-code", opts?: ClaudeCodeHarnessOptions): ClaudeCodeHarness;
 export declare function createHarness(id: "codex", opts?: CodexHarnessOptions): CodexHarness;
-export declare function createHarness(id: string, opts?: ClaudeCodeHarnessOptions & CodexHarnessOptions): ClaudeCodeHarness | CodexHarness;
+export declare function createHarness(id: "pi", opts?: PiHarnessOptions): PiHarness;
+export declare function createHarness(id: string, opts?: ClaudeCodeHarnessOptions & CodexHarnessOptions & PiHarnessOptions): ClaudeCodeHarness | CodexHarness | PiHarness;

package/dist/harness/index.js

@@ -4,12 +4,14 @@
  */
 import { ClaudeCodeHarness } from "./claude-code.js";
 import { CodexHarness } from "./codex.js";
+import { PiHarness } from "./pi.js";
 import { unsupportedAgentError } from "./agents.js";
 export { claudeCompat, asClaude } from "./compat.js";
 export { policyGate, nativeDenyClasses, resolveHarnessPolicy, isToolClass, TOOL_CLASSES } from "./policy.js";
 export { ask, evaluate, buildAskPrompt, buildEvaluatePrompt } from "./prompts.js";
 export { ClaudeCodeHarness, CLAUDE_CODE_CAPABILITIES } from "./claude-code.js";
 export { CodexHarness, CODEX_CAPABILITIES, MIN_CODEX_VERSION } from "./codex.js";
+export { PiHarness, PI_CAPABILITIES, MIN_PI_VERSION } from "./pi.js";
 export { startToolBridge } from "./tool-bridge/server.js";
 export { SUPPORTED_AGENTS, isSupportedAgent, unsupportedAgentError } from "./agents.js";
 export function createHarness(id, opts = {}) {
@@ -19,6 +21,8 @@ export function createHarness(id, opts = {}) {
             return new ClaudeCodeHarness(opts);
         case "codex":
             return new CodexHarness(opts);
+        case "pi":
+            return new PiHarness(opts);
         default:
             throw new Error(unsupportedAgentError(id));
     }

package/dist/harness/pi.d.ts

@@ -0,0 +1,202 @@
+/**
+ * pi harness (#415): runs a node on the pi coding agent (bring any model)
+ * through `pi --mode rpc`.
+ *
+ * Interfaces used, all read from badlogic/pi-mono at v0.99.2
+ * (`packages/coding-agent`, now also published as earendil-works/pi):
+ * - `docs/cli.md`: `--mode rpc`, `--no-session`, `--tools` (allowlist over
+ *   built-in, extension and MCP tools), `--exclude-tools`, `--no-tools`,
+ *   `--no-extensions` with explicit `-e builtin:mcp`, `--no-context-files`,
+ *   `--no-skills`, `--no-prompt-templates`, `--no-themes`, `--no-approve`,
+ *   `--model`, `--append-system-prompt`.
+ * - `docs/rpc.md`, `docs/rpc-commands.md`: JSONL framing on LF only, the
+ *   `prompt`, `abort` and `get_session_stats` commands, `agent_settled`.
+ * - `docs/json.md`, `docs/message-types.md`: `message_end` (assistant message
+ *   with `stopReason` and `errorMessage`), `tool_execution_start|end`,
+ *   `auto_retry_end`.
+ * - `docs/mcp.md`, `src/extensions/mcp/`: `mcp.json` in `$PI_CODING_AGENT_DIR`,
+ *   `exposure: "direct"` so tools are declared to the model, `${VAR}` in
+ *   `env`, tool names `mcp__<server>__<tool>`.
+ * - `docs/security.md`: "no built-in sandbox", so the whole process runs
+ *   inside the sweny process wrapper (sandbox-wrapper.ts) and strict refuses
+ *   without it.
+ * - `src/core/agent-session.ts` `_refreshToolRegistry`: a `--tools` allowlist
+ *   filters every registered tool, MCP tools included, by exact name.
+ *
+ * Every sweny opinion in the pi column of the enforcement matrix is enforced
+ * natively, kept by sweny (wrapper, tool bridge, prompt + parse + validate,
+ * watchdog), reported in `degraded`, or refused under strict policy by
+ * `policyGate`. Nothing is dropped silently.
+ */
+import type { Logger, McpServerConfig, NodeUsage, ToolContext, Tool } from "../types.js";
+import { type SandboxMode } from "../agent-env.js";
+import type { AgentHarness, HarnessCapabilities, HarnessCompleteRequest, HarnessInfo, HarnessRunRequest, HarnessRunResult, ToolClass } from "./types.js";
+import { PI_CAPABILITIES } from "./capabilities.js";
+import { type HarnessPolicyMode } from "./policy.js";
+import { type SandboxWrapper } from "./sandbox-wrapper.js";
+export { PI_CAPABILITIES };
+/**
+ * Oldest pi this adapter is written against. The docs and source were read at
+ * v0.99.2; older releases are unverified, so they are refused.
+ */
+export declare const MIN_PI_VERSION = "0.99.2";
+/** Name of the MCP server that carries sweny's skill tools (the tool bridge). */
+export declare const PI_BRIDGE_SERVER = "sweny-core";
+/**
+ * Hosts pi itself needs through the sandbox wrapper: the API host of every
+ * provider whose key is in the env, and of the provider named in `--model`
+ * (`provider/id`). Other providers (custom endpoints in `models.json`, cloud
+ * providers) are added with `SWENY_SANDBOX_ALLOWED_DOMAINS`.
+ */
+export declare function piBackendHosts(env?: Record<string, string | undefined>, model?: string): string[];
+export interface PiHarnessOptions {
+    /** Model passed to `--model`. Free text (`provider/id`, `id:thinking`); sweny has no model opinion. */
+    model?: string;
+    /** Tool-call budget the watchdog enforces when a node sets no `max_turns` (default: 20). */
+    maxTurns?: number;
+    /** Working directory (default: process.cwd()). */
+    cwd?: string;
+    logger?: Logger;
+    /** Default tool context for standalone usage (not via the executor). */
+    defaultContext?: ToolContext;
+    /** Catalog defaults, overridden by per-run skill servers and explicit mcpServers. */
+    defaultMcpServers?: Record<string, McpServerConfig>;
+    /** Explicit external MCP servers, overriding defaults and per-run skill servers. */
+    mcpServers?: Record<string, McpServerConfig>;
+    /** Extra env var names passed through (see agent-env.ts). Default: `SWENY_ENV_PASSTHROUGH`. */
+    envPassthrough?: string[];
+    /** Scope the pi env to the allowlist. Default: `SWENY_ENV_SCOPE`, else on in CI. */
+    envScope?: boolean;
+    /**
+     * Process sandbox mode (`SWENY_SANDBOX`): `strict` refuses the node without
+     * the process wrapper, `auto` wraps when a wrapper is available and otherwise
+     * degrades, `off` never wraps. Default: `SWENY_SANDBOX`, else `auto` in CI
+     * and `off` locally.
+     */
+    sandbox?: SandboxMode;
+    /**
+     * The host's process sandbox wrapper (#360 step 2). `undefined` = detect
+     * srt once per process; `null` = none (test seam).
+     */
+    sandboxWrapper?: SandboxWrapper | null;
+    /** `strict` refuses a node with unenforceable opinions. Default: {@link resolveHarnessPolicy}. */
+    policy?: HarnessPolicyMode;
+    /** The pi CLI. Default: `SWENY_PI_PATH`, else `pi` on PATH. Test seam for the fake. */
+    piCommand?: {
+        command: string;
+        args: string[];
+    };
+    /**
+     * A `models.json` (custom providers and models) copied into pi's scratch
+     * agent dir. Default: `SWENY_PI_MODELS_JSON`. Without it pi sees only its
+     * built-in model catalog; the operator's own `~/.pi/agent` is never read.
+     */
+    modelsFile?: string;
+    /** Shim command override for the tool bridge (test seam). */
+    toolBridgeShim?: {
+        command: string;
+        args: string[];
+    };
+    /** How long to wait for pi to stop after the `abort` command before SIGTERM (default: 3000 ms). */
+    abortGraceMs?: number;
+    /** Grace period between SIGTERM and SIGKILL when stopping pi (default: 2000 ms). */
+    killGraceMs?: number;
+    /** How long to wait for `get_session_stats` after the run settles (default: 5000 ms). */
+    statsTimeoutMs?: number;
+}
+/**
+ * Split `disallowed_tools` names into portable classes pi can act on, pi tools
+ * it can exclude by name, and the names it has no tool for.
+ */
+export declare function translateDenyNames(names?: readonly string[]): {
+    classes: ToolClass[];
+    piTools: string[];
+    unknown: string[];
+};
+/** The name pi registers an MCP tool under (`src/extensions/mcp/tools.ts` createMcpToolName). */
+export declare function piMcpToolName(server: string, tool: string, isTaken?: (name: string) => boolean): string;
+/** pi registered names of the bridge's tools, and the way back to the sweny names. */
+export declare function bridgeToolNames(tools: readonly Tool[]): {
+    names: string[];
+    back: Map<string, string>;
+};
+/**
+ * `mcp.json` entries for the external servers. Returns what pi cannot load
+ * (reported in `degraded`). Values using pi's `!command` or `${VAR}` syntax are
+ * refused, so a sweny config value can never run a command inside pi.
+ */
+export declare function piMcpServers(servers: Record<string, McpServerConfig>): {
+    entries: Record<string, Record<string, unknown>>;
+    unsupported: string[];
+};
+/**
+ * `get_session_stats` data onto NodeUsage. pi reports 0 for what a provider did
+ * not report (and for a model it has no price for), so only positive values are
+ * kept: absent stays absent, never a guessed 0 or a fake free run.
+ */
+export declare function mapStats(data: unknown): NodeUsage | undefined;
+export declare class PiHarness implements AgentHarness {
+    readonly id: "pi";
+    readonly capabilities: HarnessCapabilities;
+    /**
+     * Empty on purpose: judges use the model pi would use anyway. Leaving this
+     * undefined would fall back to the Claude judge model, which pi may not have.
+     */
+    readonly defaultJudgeModel = "";
+    readonly logger: Logger;
+    private model;
+    private maxTurns;
+    private cwd;
+    private defaultContext;
+    private mcpServers;
+    private defaultMcpServers;
+    private envPassthrough;
+    private envScope;
+    private sandboxMode;
+    private sandboxWrapper;
+    private policyMode;
+    private piCommand;
+    private modelsFile;
+    private toolBridgeShim;
+    private abortGraceMs;
+    private killGraceMs;
+    private statsTimeoutMs;
+    private egressWarned;
+    private preflightResult;
+    private version;
+    constructor(opts?: PiHarnessOptions);
+    info(): HarnessInfo;
+    /** `pi --version`, checked against {@link MIN_PI_VERSION}. Cached per instance. */
+    preflight(): Promise<{
+        ok: true;
+        version: string;
+    } | {
+        ok: false;
+        reason: string;
+    }>;
+    /** Env for the pi process: scoped like Claude Code's, with pi's provider credentials instead of Anthropic's. */
+    private buildEnv;
+    /** The node policy after `disallowed_tools` names are translated into pi classes. */
+    private compilePolicy;
+    /** argv shared by run() and complete(); the prompt travels as an RPC command, never in argv. */
+    private baseArgs;
+    /** Spawn pi in rpc mode, send the prompt, and read events until it settles and exits. */
+    private exec;
+    /** Write pi's scratch agent dir: generated `mcp.json` only (plus an operator-supplied `models.json`). */
+    private writeAgentDir;
+    /**
+     * Run a node. The gate runs first: in strict mode a node whose opinions pi
+     * cannot honor is refused before pi starts. pi has no native sandbox, so the
+     * whole process runs inside the host's process sandbox wrapper (#360 step 2)
+     * when the sandbox mode is not off; `SWENY_SANDBOX=strict` refuses without one.
+     */
+    run(req: HarnessRunRequest): Promise<HarnessRunResult>;
+    /** Map one rpc outcome onto a NodeResult with Claude Code's semantics. */
+    private toResult;
+    /**
+     * One completion: no tools (`--no-tools`), no MCP, no extensions, an empty
+     * scratch agent dir. Nothing can act, so no process wrapper is needed.
+     * null when it failed (callers fail closed).
+     */
+    complete(req: HarnessCompleteRequest): Promise<string | null>;
+}