@sweny-ai/core 0.1.164 → 0.1.166

package/dist/harness/acp.js

@@ -48,7 +48,7 @@ import { spawn } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { consoleLogger } from "../types.js";
-import { parseList, reportWithheldEnv, resolveEnvScope, resolveSandboxMode, scopeAgentEnv, withPushBlocked, } from "../agent-env.js";
+import { finishAgentEnv, heldCredentials, parseList, reportWithheldEnv, resolveEnvScope, resolveSandboxMode, scopeAgentEnv, withPushBlocked, } from "../agent-env.js";
 import { ACP_CAPABILITIES } from "./capabilities.js";
 import { policyGate, resolveHarnessPolicy, TOOL_CLASSES } from "./policy.js";
 import { buildNodePrompt } from "./prompts.js";
@@ -265,20 +265,28 @@ export class AcpHarness {
         }
         return { ok: true, version: this.agentVersion };
     }
-    /** Env for the agent process: scoped like Claude Code's, with only the auth vars the operator named. */
-    buildEnv(extraVars = []) {
+    /**
+     * Env for the agent process: scoped like Claude Code's, with only the auth
+     * vars the operator named. Skill credentials are dropped either way
+     * ({@link finishAgentEnv}) unless the node granted them with `agent_env`; an
+     * operator-named auth var stays, and the gate counts it if it is a write token.
+     */
+    buildEnv(access) {
         const full = Object.fromEntries(Object.entries(process.env).filter((e) => e[1] != null));
-        if (!resolveEnvScope(process.env, this.envScope, this.logger))
-            return full;
-        const { env, withheld } = scopeAgentEnv(full, {
-            extraVars,
-            passthrough: this.envPassthrough ?? parseList(process.env.SWENY_ENV_PASSTHROUGH),
-            authVars: this.authVars,
-            prefixes: ["LC_"],
-            logger: this.logger,
-        });
-        reportWithheldEnv(withheld, this.logger);
-        return env;
+        const passthrough = this.envPassthrough ?? parseList(process.env.SWENY_ENV_PASSTHROUGH);
+        let env = full;
+        if (resolveEnvScope(process.env, this.envScope, this.logger)) {
+            const scoped = scopeAgentEnv(full, {
+                extraVars: access?.envVars ?? [],
+                passthrough,
+                authVars: this.authVars,
+                prefixes: ["LC_"],
+                logger: this.logger,
+            });
+            reportWithheldEnv(scoped.withheld, this.logger);
+            env = scoped.env;
+        }
+        return finishAgentEnv(env, { access, keep: this.authVars, passthrough, logger: this.logger }).env;
     }
     /** The node policy, with the harness policy mode and the watchdog budget applied. */
     compilePolicy(req, maxTurns) {
@@ -684,7 +692,15 @@ export class AcpHarness {
     async run(req) {
         const maxTurns = req.maxTurns ?? this.maxTurns;
         const mode = req.policy?.sandbox ?? resolveSandboxMode(process.env, this.sandboxMode, this.logger);
-        const policy = { ...this.compilePolicy(req, maxTurns), sandbox: mode };
+        const env = withPushBlocked(this.buildEnv(req.agentAccess), req.agentAccess?.noPush);
+        const compiled = this.compilePolicy(req, maxTurns);
+        const held = heldCredentials(env, req.agentAccess?.withhold);
+        const policy = {
+            ...compiled,
+            sandbox: mode,
+            ...(held.length > 0 ? { agentCredentials: held } : {}),
+            ...(req.agentAccess?.noPush && !compiled.readOnly ? { stagedWrite: true } : {}),
+        };
         // ACP has no sandbox of its own: any mode but off needs the process wrapper.
         const wrapper = mode !== "off" && this.sandboxWrapper !== null
             ? (this.sandboxWrapper ?? (await defaultSandboxWrapper()).wrapper)
@@ -716,7 +732,6 @@ export class AcpHarness {
         const readOnly = policy.readOnly;
         // Permission answers: the node's deny list, plus legacy `disallowed_tools` names that map to a class.
         const deny = new Set([...policy.deny, ...translateDenyNames(policy.nativeDeny).classes]);
-        const env = withPushBlocked(this.buildEnv(req.agentAccess?.envVars), req.agentAccess?.noPush);
         let bridge;
         try {
             // Dry run: external MCP servers cannot be classified per tool, so only
@@ -885,6 +900,8 @@ export class AcpHarness {
             return failClosed(pre.reason);
         // A judge call is a dry run with nothing allowed: same gate, same wrapper.
         const mode = resolveSandboxMode(process.env, this.sandboxMode, this.logger);
+        const env = this.buildEnv();
+        const held = heldCredentials(env);
         const policy = {
             readOnly: true,
             // Nothing to deny at the gate: there is no MCP server and every permission request is rejected below.
@@ -892,6 +909,7 @@ export class AcpHarness {
             egress: [],
             strict: this.policyMode === "strict",
             sandbox: mode,
+            ...(held.length > 0 ? { agentCredentials: held } : {}),
         };
         const wrapper = mode !== "off" && this.sandboxWrapper !== null
             ? (this.sandboxWrapper ?? (await defaultSandboxWrapper()).wrapper)
@@ -899,7 +917,7 @@ export class AcpHarness {
         const prep = await prepareAgentSpawn({
             caps: this.capabilities,
             policy,
-            spawn: { command: this.agent.command, args: this.agent.args, env: this.buildEnv(), cwd: this.cwd },
+            spawn: { command: this.agent.command, args: this.agent.args, env, cwd: this.cwd },
             wrapper: wrapper ?? null,
             harnessEgress: this.egress,
             env: process.env,

package/dist/harness/claude-code.d.ts

@@ -11,6 +11,7 @@
 import type { Claude, Tool, ToolContext, Logger, McpServerConfig } from "../types.js";
 import { type SandboxMode } from "../agent-env.js";
 import type { AgentHarness, HarnessCapabilities, HarnessCompleteRequest, HarnessInfo, HarnessRunRequest, HarnessRunResult, NodePolicy, ToolClass } from "./types.js";
+import { type HarnessPolicyMode } from "./policy.js";
 import { CLAUDE_CODE_CAPABILITIES } from "./capabilities.js";
 import { buildEvaluatePrompt } from "./prompts.js";
 import { parseToolResultContent, summarizeToolError } from "./parse.js";
@@ -132,6 +133,14 @@ export interface ClaudeCodeHarnessOptions {
         command: string;
         args: string[];
     };
+    /**
+     * Harness policy mode. Claude Code honors every node opinion natively, so
+     * this only decides one case: a staged or dry-run write node whose agent
+     * runs unsandboxed is refused under `strict` (its push block is env and git
+     * hooks, which a deliberate agent can undo) and reported under `warn`.
+     * Default: `warn`; the CLI passes `resolveHarnessPolicy()` (strict under GitHub Actions).
+     */
+    policy?: HarnessPolicyMode;
 }
 export declare class ClaudeCodeHarness implements Claude, AgentHarness {
     readonly id: "claude-code";
@@ -155,6 +164,7 @@ export declare class ClaudeCodeHarness implements Claude, AgentHarness {
     private toolBridge;
     private toolBridgeShim;
     private authProbe;
+    private policyMode;
     constructor(opts?: ClaudeCodeHarnessOptions);
     /**
      * Build env for the Claude Code subprocess (#360). Applies auth precedence
@@ -164,6 +174,8 @@ export declare class ClaudeCodeHarness implements Claude, AgentHarness {
      * `extraVars` (the node's declared skill env vars) and the operator
      * passthrough list, and the withheld names (never values) are reported once
      * per process ({@link reportWithheldEnv}). When off, the full env passes through as before.
+     * Either way, skill credentials are then dropped ({@link finishAgentEnv}):
+     * only the names the node granted with `agent_env` reach the agent.
      */
     private buildEnv;
     /** Which harness (and SDK version) produced a result. */

package/dist/harness/claude-code.js

@@ -11,7 +11,7 @@
 import { query, createSdkMcpServer, tool as sdkTool } from "@anthropic-ai/claude-agent-sdk";
 import { createRequire } from "node:module";
 import { consoleLogger } from "../types.js";
-import { reportWithheldEnv, parseList, resolveEnvScope, scopeAgentEnv, withPushBlocked, resolveAgentSandbox, } from "../agent-env.js";
+import { AGENT_AUTH_VARS, finishAgentEnv, reportWithheldEnv, parseList, resolveEnvScope, scopeAgentEnv, withPushBlocked, resolveAgentSandbox, } from "../agent-env.js";
 import { policyGate } from "./policy.js";
 import { CLAUDE_CODE_CAPABILITIES } from "./capabilities.js";
 import { ask as coreAsk, evaluate as coreEvaluate, buildEvaluatePrompt, buildNodePrompt } from "./prompts.js";
@@ -222,6 +222,7 @@ export class ClaudeCodeHarness {
     toolBridge;
     toolBridgeShim;
     authProbe;
+    policyMode;
     constructor(opts = {}) {
         this.model = opts.model;
         this.maxTurns = opts.maxTurns ?? 20;
@@ -238,6 +239,7 @@ export class ClaudeCodeHarness {
         this.toolBridge = opts.toolBridge ?? process.env.SWENY_TOOL_BRIDGE === "1";
         this.toolBridgeShim = opts.toolBridgeShim;
         this.authProbe = opts.authProbe ?? (() => claudeCodeAuth(process.env));
+        this.policyMode = opts.policy ?? "warn";
     }
     /**
      * Build env for the Claude Code subprocess (#360). Applies auth precedence
@@ -247,19 +249,20 @@ export class ClaudeCodeHarness {
      * `extraVars` (the node's declared skill env vars) and the operator
      * passthrough list, and the withheld names (never values) are reported once
      * per process ({@link reportWithheldEnv}). When off, the full env passes through as before.
+     * Either way, skill credentials are then dropped ({@link finishAgentEnv}):
+     * only the names the node granted with `agent_env` reach the agent.
      */
-    buildEnv(extraVars = []) {
+    buildEnv(access) {
         const full = Object.fromEntries(Object.entries(process.env).filter((e) => e[1] != null));
         const authed = resolveAuthEnv(full, { logger: this.logger });
-        if (!resolveEnvScope(process.env, this.envScope, this.logger))
-            return authed;
-        const { env, withheld } = scopeAgentEnv(authed, {
-            extraVars,
-            passthrough: this.envPassthrough ?? parseList(process.env.SWENY_ENV_PASSTHROUGH),
-            logger: this.logger,
-        });
-        reportWithheldEnv(withheld, this.logger);
-        return env;
+        const passthrough = this.envPassthrough ?? parseList(process.env.SWENY_ENV_PASSTHROUGH);
+        let env = authed;
+        if (resolveEnvScope(process.env, this.envScope, this.logger)) {
+            const scoped = scopeAgentEnv(authed, { extraVars: access?.envVars ?? [], passthrough, logger: this.logger });
+            reportWithheldEnv(scoped.withheld, this.logger);
+            env = scoped.env;
+        }
+        return finishAgentEnv(env, { access, keep: AGENT_AUTH_VARS, passthrough, logger: this.logger }).env;
     }
     /** Which harness (and SDK version) produced a result. */
     info() {
@@ -306,18 +309,27 @@ export class ClaudeCodeHarness {
         }
         const readOnly = !!req.readOnly || policy.readOnly;
         const disallowedTools = compileClaudeCodeDeny(policy, req.disallowedTools ?? []);
+        const degraded = [...gate.degraded];
         const result = await this.runQuery({
             ...req,
             readOnly,
             disallowedTools: disallowedTools.length > 0 ? disallowedTools : undefined,
             strictMcp: readOnly || policy.strict || policy.exclusiveMcp === true,
             sandboxMode: policy.sandbox,
-            agentAccess: { envVars: req.agentAccess?.envVars ?? [], domains: policy.egress, noPush: req.agentAccess?.noPush },
+            agentAccess: {
+                envVars: req.agentAccess?.envVars ?? [],
+                domains: policy.egress,
+                withhold: req.agentAccess?.withhold,
+                noPush: req.agentAccess?.noPush,
+            },
+            stagedWrite: !!req.agentAccess?.noPush && !readOnly,
+            strict: policy.strict || this.policyMode === "strict",
+            degraded,
         });
         return {
             ...result,
             harness: this.info(),
-            degraded: gate.degraded,
+            degraded,
             ...(this.lastPolicyFacts ? { policy: this.lastPolicyFacts } : {}),
         };
     }
@@ -356,6 +368,17 @@ export class ClaudeCodeHarness {
             const prefix = process.env.GITHUB_ACTIONS === "true" ? "::warning title=SWEny agent sandbox::" : "";
             this.logger.warn(`${prefix}${sandbox.warning}`);
         }
+        // #442 + security review 2026-09-30 finding 3: with no sandbox, a staged
+        // write node's push block is only env and git hooks the agent can undo.
+        if (opts.stagedWrite && !sandbox.settings) {
+            const gap = "no push (staged run): blocked by env and git hooks only; with no sandbox a deliberate agent can undo them and push";
+            if (opts.strict) {
+                const error = `strict policy: ${gap}`;
+                this.logger.error(error);
+                return { status: "failed", data: { error, refused: true }, toolCalls: [] };
+            }
+            opts.degraded?.push(gap);
+        }
         // Tool-call accounting (Fix #1).
         //
         // Stream-driven recording, correlated by tool_use_id:
@@ -397,7 +420,7 @@ export class ClaudeCodeHarness {
         // Build prompt. Context (workflow input such as issues/alerts, plus prior
         // node outputs) is fenced as untrusted data (#360).
         const prompt = buildNodePrompt(instruction, context, outputSchema);
-        const env = withPushBlocked(this.buildEnv(agentAccess?.envVars), agentAccess?.noPush);
+        const env = withPushBlocked(this.buildEnv(agentAccess), agentAccess?.noPush);
         let response = "";
         // CC-08: when the SDK populates typed structured output (because we passed
         // an `outputFormat`), prefer it over re-parsing JSON out of the free-text

package/dist/harness/codex.d.ts

@@ -161,7 +161,11 @@ export declare class CodexHarness implements AgentHarness {
     }>;
     /** `codex --version`, checked against {@link MIN_CODEX_VERSION}. Cached per instance. */
     private checkCli;
-    /** Env for the Codex process: scoped like Claude Code's, with Codex's auth vars instead of Anthropic's. */
+    /**
+     * Env for the Codex process: scoped like Claude Code's, with Codex's auth
+     * vars instead of Anthropic's. Skill credentials are dropped either way
+     * ({@link finishAgentEnv}) unless the node granted them with `agent_env`.
+     */
     private buildEnv;
     /** The node policy after `disallowed_tools` names are translated into Codex classes. */
     private compilePolicy;

package/dist/harness/codex.js

@@ -28,7 +28,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { consoleLogger } from "../types.js";
-import { CODEX_AUTH_VARS, CODEX_ENV_PREFIXES, checkSandboxSupport, parseList, reportWithheldEnv, resolveCodexAuthEnv, resolveEnvScope, resolveSandboxMode, scopeAgentEnv, withPushBlocked, } from "../agent-env.js";
+import { CODEX_AUTH_VARS, CODEX_ENV_PREFIXES, checkSandboxSupport, finishAgentEnv, heldCredentials, parseList, reportWithheldEnv, resolveCodexAuthEnv, resolveEnvScope, resolveSandboxMode, scopeAgentEnv, withPushBlocked, } from "../agent-env.js";
 import { CODEX_CAPABILITIES } from "./capabilities.js";
 import { policyGate, resolveHarnessPolicy } from "./policy.js";
 import { buildNodePrompt } from "./prompts.js";
@@ -367,21 +367,28 @@ export class CodexHarness {
         });
         return this.preflightResult;
     }
-    /** Env for the Codex process: scoped like Claude Code's, with Codex's auth vars instead of Anthropic's. */
-    buildEnv(extraVars = []) {
+    /**
+     * Env for the Codex process: scoped like Claude Code's, with Codex's auth
+     * vars instead of Anthropic's. Skill credentials are dropped either way
+     * ({@link finishAgentEnv}) unless the node granted them with `agent_env`.
+     */
+    buildEnv(access) {
         const full = Object.fromEntries(Object.entries(process.env).filter((e) => e[1] != null));
         const authed = resolveCodexAuthEnv(full);
-        if (!resolveEnvScope(process.env, this.envScope, this.logger))
-            return authed;
-        const { env, withheld } = scopeAgentEnv(authed, {
-            extraVars,
-            passthrough: this.envPassthrough ?? parseList(process.env.SWENY_ENV_PASSTHROUGH),
-            authVars: CODEX_AUTH_VARS,
-            prefixes: CODEX_ENV_PREFIXES,
-            logger: this.logger,
-        });
-        reportWithheldEnv(withheld, this.logger);
-        return env;
+        const passthrough = this.envPassthrough ?? parseList(process.env.SWENY_ENV_PASSTHROUGH);
+        let env = authed;
+        if (resolveEnvScope(process.env, this.envScope, this.logger)) {
+            const scoped = scopeAgentEnv(authed, {
+                extraVars: access?.envVars ?? [],
+                passthrough,
+                authVars: CODEX_AUTH_VARS,
+                prefixes: CODEX_ENV_PREFIXES,
+                logger: this.logger,
+            });
+            reportWithheldEnv(scoped.withheld, this.logger);
+            env = scoped.env;
+        }
+        return finishAgentEnv(env, { access, keep: CODEX_AUTH_VARS, passthrough, logger: this.logger }).env;
     }
     /** The node policy after `disallowed_tools` names are translated into Codex classes. */
     compilePolicy(req, maxTurns) {
@@ -729,7 +736,15 @@ export class CodexHarness {
     async run(req) {
         const maxTurns = req.maxTurns ?? this.maxTurns;
         const mode = req.policy?.sandbox ?? resolveSandboxMode(process.env, this.sandboxMode, this.logger);
-        const policy = { ...this.compilePolicy(req, maxTurns), sandbox: mode };
+        const env = withPushBlocked(this.buildEnv(req.agentAccess), req.agentAccess?.noPush);
+        const compiled = this.compilePolicy(req, maxTurns);
+        const held = heldCredentials(env, req.agentAccess?.withhold);
+        const policy = {
+            ...compiled,
+            sandbox: mode,
+            ...(held.length > 0 ? { agentCredentials: held } : {}),
+            ...(req.agentAccess?.noPush && !compiled.readOnly ? { stagedWrite: true } : {}),
+        };
         // Codex's network is one switch, not a host list, so any sandbox mode but
         // off needs the process wrapper for full containment.
         const needsWrapper = mode !== "off" && !(this.capabilities.sandbox.fs && this.capabilities.sandbox.network);
@@ -788,7 +803,6 @@ export class CodexHarness {
                 sandbox = s.mode;
             }
         }
-        const env = withPushBlocked(this.buildEnv(req.agentAccess?.envVars), req.agentAccess?.noPush);
         if (wrapper && !env.CODEX_API_KEY && !env.CODEX_ACCESS_TOKEN && !this.loginWarned) {
             this.loginWarned = true;
             this.logger.warn("Codex runs inside the sandbox wrapper, where a stored `codex login` is not readable; set CODEX_API_KEY or OPENAI_API_KEY.");

package/dist/harness/pi.d.ts

@@ -52,6 +52,13 @@ export declare function piBackendHosts(env?: Record<string, string | undefined>,
 export interface PiHarnessOptions {
     /** Model passed to `--model`. Free text (`provider/id`, `id:thinking`); sweny has no model opinion. */
     model?: string;
+    /**
+     * The model provider (`pi_provider`, passed as `--provider`). Only this
+     * provider's credential reaches pi. Default: `SWENY_PI_PROVIDER`, else the
+     * model's `provider/` prefix, else the one provider whose key is set.
+     * Required when several providers' keys are set and the model names none.
+     */
+    provider?: string;
     /** Tool-call budget the watchdog enforces when a node sets no `max_turns` (default: 20). */
     maxTurns?: number;
     /** Working directory (default: process.cwd()). */
@@ -145,6 +152,7 @@ export declare class PiHarness implements AgentHarness {
     readonly defaultJudgeModel = "";
     readonly logger: Logger;
     private model;
+    private provider;
     private maxTurns;
     private cwd;
     private defaultContext;
@@ -174,7 +182,15 @@ export declare class PiHarness implements AgentHarness {
         ok: false;
         reason: string;
     }>;
-    /** Env for the pi process: scoped like Claude Code's, with pi's provider credentials instead of Anthropic's. */
+    /** Which provider's credential this call gets ({@link resolvePiProvider}). */
+    private resolveProvider;
+    /**
+     * Env for the pi process: scoped like Claude Code's, with ONE provider's
+     * credentials instead of Anthropic's (`providerVars`, from
+     * {@link resolvePiProvider}). Every other provider key is dropped, scoped or
+     * not, since pi's bash tool inherits this env. Skill credentials are dropped
+     * too ({@link finishAgentEnv}) unless the node granted them with `agent_env`.
+     */
     private buildEnv;
     /** The node policy after `disallowed_tools` names are translated into pi classes. */
     private compilePolicy;

package/dist/harness/pi.js

@@ -34,7 +34,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { consoleLogger } from "../types.js";
-import { PI_AUTH_VARS, PI_ENV_PREFIXES, parseList, reportWithheldEnv, resolveEnvScope, resolveSandboxMode, scopeAgentEnv, withPushBlocked, } from "../agent-env.js";
+import { PI_AUTH_VARS, PI_ENV_PREFIXES, finishAgentEnv, heldCredentials, parseList, reportWithheldEnv, resolveEnvScope, resolvePiProvider, resolveSandboxMode, scopeAgentEnv, withPushBlocked, } from "../agent-env.js";
 import { PI_CAPABILITIES } from "./capabilities.js";
 import { policyGate, resolveHarnessPolicy } from "./policy.js";
 import { buildNodePrompt } from "./prompts.js";
@@ -314,6 +314,7 @@ export class PiHarness {
     defaultJudgeModel = "";
     logger;
     model;
+    provider;
     maxTurns;
     cwd;
     defaultContext;
@@ -335,6 +336,7 @@ export class PiHarness {
     version = "unknown";
     constructor(opts = {}) {
         this.model = opts.model;
+        this.provider = opts.provider;
         this.maxTurns = opts.maxTurns ?? 20;
         this.cwd = opts.cwd ?? process.cwd();
         this.logger = opts.logger ?? consoleLogger;
@@ -387,23 +389,38 @@ export class PiHarness {
         });
         return this.preflightResult;
     }
-    /** Env for the pi process: scoped like Claude Code's, with pi's provider credentials instead of Anthropic's. */
-    buildEnv(extraVars = []) {
+    /** Which provider's credential this call gets ({@link resolvePiProvider}). */
+    resolveProvider(model) {
+        return resolvePiProvider(process.env, model, this.provider);
+    }
+    /**
+     * Env for the pi process: scoped like Claude Code's, with ONE provider's
+     * credentials instead of Anthropic's (`providerVars`, from
+     * {@link resolvePiProvider}). Every other provider key is dropped, scoped or
+     * not, since pi's bash tool inherits this env. Skill credentials are dropped
+     * too ({@link finishAgentEnv}) unless the node granted them with `agent_env`.
+     */
+    buildEnv(access, providerVars) {
         const full = Object.fromEntries(Object.entries(process.env).filter((e) => e[1] != null));
+        const passthrough = this.envPassthrough ?? parseList(process.env.SWENY_ENV_PASSTHROUGH);
         let env = full;
         if (resolveEnvScope(process.env, this.envScope, this.logger)) {
             const scoped = scopeAgentEnv(full, {
-                extraVars,
-                passthrough: this.envPassthrough ?? parseList(process.env.SWENY_ENV_PASSTHROUGH),
-                authVars: PI_AUTH_VARS,
+                extraVars: access?.envVars ?? [],
+                passthrough,
+                authVars: providerVars,
                 prefixes: PI_ENV_PREFIXES,
                 logger: this.logger,
             });
             reportWithheldEnv(scoped.withheld, this.logger);
             env = scoped.env;
         }
+        // Other providers' keys never reach pi, even when scoping is off, passed through or granted.
+        const otherProviders = PI_AUTH_VARS.filter((v) => !providerVars.includes(v));
+        env = Object.fromEntries(Object.entries(env).filter(([k]) => !otherProviders.includes(k)));
+        const finished = finishAgentEnv(env, { access, keep: providerVars, passthrough, logger: this.logger }).env;
         // pi must not phone home or look for updates; the agent dir is set per spawn.
-        return { ...env, PI_OFFLINE: "1", PI_SKIP_VERSION_CHECK: "1", PI_TELEMETRY: "0" };
+        return { ...finished, PI_OFFLINE: "1", PI_SKIP_VERSION_CHECK: "1", PI_TELEMETRY: "0" };
     }
     /** The node policy after `disallowed_tools` names are translated into pi classes. */
     compilePolicy(req, maxTurns) {
@@ -429,7 +446,7 @@ export class PiHarness {
         };
     }
     /** argv shared by run() and complete(); the prompt travels as an RPC command, never in argv. */
-    baseArgs(model, withMcp) {
+    baseArgs(model, withMcp, provider) {
         const args = [
             ...this.piCommand.args,
             "--mode",
@@ -448,6 +465,8 @@ export class PiHarness {
         ];
         if (withMcp)
             args.push("-e", "builtin:mcp");
+        if (provider)
+            args.push("--provider", provider);
         if (model)
             args.push("--model", model);
         return args;
@@ -715,7 +734,16 @@ export class PiHarness {
         const maxTurns = req.maxTurns ?? this.maxTurns;
         const mode = req.policy?.sandbox ?? resolveSandboxMode(process.env, this.sandboxMode, this.logger);
         const compiled = this.compilePolicy(req, maxTurns);
-        const policy = { ...compiled.policy, sandbox: mode };
+        const model = req.model ?? this.model;
+        const provider = this.resolveProvider(model);
+        const env = withPushBlocked(this.buildEnv(req.agentAccess, provider.vars), req.agentAccess?.noPush);
+        const held = heldCredentials(env, req.agentAccess?.withhold);
+        const policy = {
+            ...compiled.policy,
+            sandbox: mode,
+            ...(held.length > 0 ? { agentCredentials: held } : {}),
+            ...(req.agentAccess?.noPush && !compiled.policy.readOnly ? { stagedWrite: true } : {}),
+        };
         const needsWrapper = mode !== "off";
         const wrapper = needsWrapper && this.sandboxWrapper !== null
             ? (this.sandboxWrapper ?? (await defaultSandboxWrapper()).wrapper)
@@ -736,6 +764,10 @@ export class PiHarness {
         };
         if (gate.refuse)
             return refused(gate.refuse);
+        if (provider.error) {
+            this.logger.error(provider.error);
+            return tag({ status: "failed", data: { error: provider.error }, toolCalls: [] });
+        }
         const pre = await this.preflight();
         if (!pre.ok) {
             this.logger.error(pre.reason);
@@ -746,8 +778,6 @@ export class PiHarness {
         if (readOnly)
             for (const c of ["shell", "write", "edit"])
                 deny.add(c);
-        const env = withPushBlocked(this.buildEnv(req.agentAccess?.envVars), req.agentAccess?.noPush);
-        const model = req.model ?? this.model;
         let bridge;
         let agentDir;
         let prepCleanup;
@@ -810,8 +840,12 @@ export class PiHarness {
             else if (excluded.size > 0) {
                 toolArgs.push("--exclude-tools", [...excluded].join(","));
             }
-            const args = [...this.baseArgs(model, Object.keys(entries).length > 0), ...toolArgs];
-            const backendHosts = piBackendHosts(process.env, model);
+            const args = [
+                ...this.baseArgs(model, Object.keys(entries).length > 0, provider.explicit ? provider.provider : undefined),
+                ...toolArgs,
+            ];
+            // Only the selected provider's host: its key is the only one pi holds.
+            const backendHosts = piBackendHosts(env, model);
             // The bridge's loopback endpoint (wrapped runs only): the one extra host the shim needs.
             const harnessEgress = [...backendHosts, ...(bridge?.egress ?? [])];
             if (mode !== "off" && backendHosts.length === 0 && !this.egressWarned) {
@@ -928,16 +962,20 @@ export class PiHarness {
         const pre = await this.preflight();
         if (!pre.ok)
             return failClosed(pre.reason);
+        // An empty model (the judge default) means pi's own default model.
+        const model = req.model || this.model;
+        const provider = this.resolveProvider(model);
+        if (provider.error)
+            return failClosed(provider.error);
         let agentDir;
         try {
             agentDir = fs.mkdtempSync(path.join(os.tmpdir(), "sweny-pi-"));
             this.writeAgentDir(agentDir);
-            const env = { ...this.buildEnv(), PI_CODING_AGENT_DIR: agentDir };
+            const env = { ...this.buildEnv(undefined, provider.vars), PI_CODING_AGENT_DIR: agentDir };
             const out = await this.exec({
                 spawn: {
                     command: this.piCommand.command,
-                    // An empty model (the judge default) means pi's own default model.
-                    args: [...this.baseArgs(req.model || this.model, false), "--no-tools"],
+                    args: [...this.baseArgs(model, false, provider.explicit ? provider.provider : undefined), "--no-tools"],
                     env,
                     cwd: this.cwd,
                 },

package/dist/harness/policy.js

@@ -48,6 +48,14 @@ export function policyGate(caps, policy, wrappers = {}) {
     if (policy.readOnly && caps.readOnly === "none" && !wrappers.readOnlyMount) {
         unenforced.push("read-only: harness cannot enforce it and no read-only mount is active");
     }
+    // A read-only mount stops file writes, not API writes: an agent that holds a
+    // write credential and can reach the network can still change remote state
+    // without asking (security review 2026-09-30, finding 1).
+    const held = policy.agentCredentials ?? [];
+    if (policy.readOnly && caps.readOnly === "none" && held.length > 0) {
+        unenforced.push(`read-only: the agent process holds write credentials (${held.join(", ")}) and network access; ` +
+            `a read-only filesystem mount does not stop API writes`);
+    }
     if (policy.deny.length > 0) {
         const native = nativeDenyClasses(caps);
         const unmappable = policy.deny.filter((c) => !native.includes(c));
@@ -84,6 +92,14 @@ export function policyGate(caps, policy, wrappers = {}) {
         unenforced.push("egress allowlist: harness has no network sandbox and no egress wrapper is active");
     }
     const sandboxMode = policy.sandbox ?? "off";
+    // #442 + finding 3: a staged write node's push block is env and git hooks.
+    // Only fs and network containment stops a deliberate agent from undoing it.
+    if (policy.stagedWrite) {
+        const contained = sandboxMode !== "off" && ((caps.sandbox.fs && caps.sandbox.network) || wrappers.sandbox === true);
+        if (!contained) {
+            unenforced.push("no push (staged run): blocked by env and git hooks only; with no sandbox a deliberate agent can undo them and push");
+        }
+    }
     let sandboxGap;
     if (sandboxMode !== "off" && !(caps.sandbox.fs && caps.sandbox.network) && !wrappers.sandbox) {
         sandboxGap = "sandbox: harness has no native fs and network sandbox and no process sandbox wrapper is available";

package/dist/harness/types.d.ts

@@ -81,6 +81,22 @@ export interface NodePolicy {
      * Unset means `off`: no requirement.
      */
     sandbox?: "off" | "auto" | "strict";
+    /**
+     * Credential names the agent process holds (a node's `agent_env` grant, or
+     * a harness auth var that is also a write token, such as an ACP agent run
+     * on `GITHUB_TOKEN`). A read-only node on a harness with no native read-only
+     * mode cannot be held read-only by a filesystem mount alone while the agent
+     * holds one of these and can reach the network: reported, refused under
+     * `strict`. Set by adapters from the finished env.
+     */
+    agentCredentials?: string[];
+    /**
+     * A write node in a staged or dry run (#442). Its push block is env and git
+     * hooks the agent can undo, so without fs and network containment (native,
+     * or the process wrapper) it is reported, and refused under `strict`. Set by
+     * adapters, which know whether the run is sandboxed.
+     */
+    stagedWrite?: boolean;
 }
 /** Process-level wrappers the host provides (OS sandbox, egress proxy, read-only mount). */
 export interface PolicyWrappers {