@sweny-ai/core 0.1.198 → 0.1.199

package/dist/agent-env.d.ts

@@ -77,6 +77,8 @@ export declare const PI_ENV_PREFIXES: readonly string[];
  * name is in {@link PI_AUTH_VARS} (`meta` to `META_API_KEY`).
  */
 export declare const PI_PROVIDER_VARS: Readonly<Record<string, readonly string[]>>;
+/** pi settings that are not secrets: their presence alone never selects a provider. */
+export declare const PI_NON_SECRET_VARS: ReadonlySet<string>;
 /** The {@link PI_AUTH_VARS} names for one pi provider id (empty for a custom `models.json` provider). */
 export declare function piProviderVars(provider: string): string[];
 export interface PiProviderResolution {
@@ -115,6 +117,12 @@ export interface BuildAgentEnvOpts {
     prefixes?: readonly string[];
     /** Operator passthrough list (`env-passthrough`). `"*"` inherits everything. */
     passthrough?: readonly string[];
+    /**
+     * Where `CLAUDE_CODE_USE_BEDROCK` / `CLAUDE_CODE_USE_VERTEX` are read when
+     * deciding the cloud vars. Default: `source`. A harness `env` overlay passes
+     * the overlaid env, so an overlay that turns Bedrock on keeps the `AWS_*` vars.
+     */
+    routing?: Record<string, string | undefined>;
     logger?: Pick<Logger, "warn">;
 }
 /**
@@ -221,7 +229,8 @@ export declare function noPushGitConfig(dir: string): Array<[string, string]>;
  * scoping is on. Withholds {@link PUSH_TOKEN_VARS} (the ssh agent socket and
  * askpass programs among them) and every {@link isAgentCredential} name, even
  * one a node granted with `agent_env`, appends
- * {@link noPushGitConfig} after any `GIT_CONFIG_*` entries already present,
+ * {@link noPushGitConfig} after any `GIT_CONFIG_*` entries already present
+ * (and drops `GIT_CONFIG_PARAMETERS`, which git would apply after them),
  * sets `GIT_ASKPASS` to a refusing program, turns off git's terminal prompt,
  * routes git's ssh through a wrapper that refuses `git-receive-pack` (so an
  * ssh push fails even to a remote with an explicit `pushurl` under
@@ -306,6 +315,72 @@ export declare function grantedAgentEnv(agentEnv: readonly string[] | undefined,
     grant: string[];
     dropped?: string;
 };
+/**
+ * The `env` and `envRemove` options every harness takes. They hold per
+ * harness instance: every node and every judge and route call (`complete()`)
+ * on that instance gets them, so per-run isolation means one harness per
+ * `execute()`.
+ */
+export interface HarnessEnvOptions {
+    /**
+     * Values laid over the agent env after scoping and passthrough, then put
+     * through the same credential rule as the inherited env: a skill credential
+     * (`GITHUB_TOKEN`, `SLACK_*`, a custom skill's config name) is withheld
+     * unless the node grants it with `agent_env`, and the harness's own auth
+     * vars always pass. When it names one of the harness's own credentials, the
+     * inherited ones are dropped first, so the overlay's login replaces the
+     * parent's instead of sitting beside it. In a staged or dry run the push
+     * block lands on top: it sets `GIT_ASKPASS`, `GH_CONFIG_DIR`, the ssh
+     * command and its git config entries over any overlaid value, drops
+     * `GIT_CONFIG_PARAMETERS` and every push token. `SWENY_*` names here only
+     * reach the agent; sweny itself reads its settings from `process.env`.
+     * Use it to hand a run its own `HOME` or `CLAUDE_CONFIG_DIR` without
+     * touching `process.env`, which is never modified. `HOME`,
+     * `CLAUDE_CONFIG_DIR` and `CODEX_HOME` must be absolute paths: the sandbox
+     * denies the login files under them.
+     */
+    env?: Readonly<Record<string, string>>;
+    /**
+     * Names removed from the agent env after scoping and passthrough, before
+     * `env` is applied (e.g. a parent `ANTHROPIC_API_KEY` when the run should
+     * use a login under `CLAUDE_CONFIG_DIR`).
+     */
+    envRemove?: readonly string[];
+}
+/** A validated, copied {@link HarnessEnvOptions}. */
+export interface AgentEnvOverlay {
+    readonly env: Readonly<Record<string, string>>;
+    readonly remove: readonly string[];
+}
+/**
+ * The executable a spawn of `command` with this env and cwd would run: a path
+ * with a separator resolves against `cwd`, a bare name is looked up on
+ * `env.PATH`. Undefined when nothing executable is found. Used so a version
+ * check probes the same file the spawn later runs (a harness `env` overlay may
+ * set its own `PATH`).
+ */
+export declare function resolveExecutable(command: string, env: Record<string, string | undefined>, cwd?: string): string | undefined;
+/**
+ * Validate and copy a harness's `env` / `envRemove` options. Throws on a
+ * non-string value or an invalid name, so a bad overlay fails at construction
+ * instead of at spawn. Returns undefined when neither option is set. The copy
+ * means a later change to the caller's objects has no effect.
+ */
+export declare function agentEnvOverlay(opts: HarnessEnvOptions): AgentEnvOverlay | undefined;
+/**
+ * Apply a caller overlay to a scoped agent env, before {@link finishAgentEnv}
+ * (which then withholds any overlaid skill credential the node did not grant).
+ * Drops the `remove` names, then, when the overlay names any of `credentials`
+ * (the harness's own login vars), drops the inherited ones, then lays the
+ * overlay values on top. Pure: returns a copy.
+ */
+export declare function applyEnvOverlay(env: Record<string, string>, overlay: AgentEnvOverlay | undefined, credentials: readonly string[]): Record<string, string>;
+/**
+ * `process.env` as the agent will see it for auth and command lookups (a
+ * harness's `preflight()` probe): the overlay applied by {@link applyEnvOverlay},
+ * except `SWENY_*` names, which stay as sweny reads them from `process.env`.
+ */
+export declare function overlaidProcessEnv(overlay: AgentEnvOverlay | undefined, credentials: readonly string[]): Record<string, string>;
 /** What one node's agent call may see: env var names and network hosts. */
 export interface AgentAccess {
     /**
@@ -428,14 +503,31 @@ export declare function checkSandboxSupport(platform?: NodeJS.Platform, pathEnv?
  * - `network.allowedDomains` + `strictAllowlist`: non-listed hosts are denied
  *   deterministically rather than prompted (no prompt exists headless).
  * - `credentials`: the agent's own Anthropic credentials are unset for
- *   sandboxed commands, and the Claude Code credentials file is unreadable.
+ *   sandboxed commands, and the Claude Code credentials file is unreadable:
+ *   the host's, and the one the agent env selects ({@link claudeCredentialFiles},
+ *   `agentEnv` carrying a harness `env` overlay's `HOME` / `CLAUDE_CONFIG_DIR`).
  */
 export declare function buildSandboxSettings(domains: readonly string[], opts?: {
     failIfUnavailable?: boolean;
     home?: string;
+    agentEnv?: Record<string, string | undefined>;
+    /** The agent's working directory, for a relative `HOME` / `CLAUDE_CONFIG_DIR`. */
+    cwd?: string;
 }): SandboxSettings;
+/**
+ * Claude Code login files to deny to sandboxed commands: the host's
+ * (`<hostHome>/.claude/.credentials.json`), plus the one `env` selects when it
+ * points elsewhere: `$CLAUDE_CONFIG_DIR/.credentials.json`, and
+ * `$HOME/.claude/.credentials.json`. A relative value resolves against the
+ * agent's `cwd`, where the agent would resolve it. Deduplicated, host file first.
+ */
+export declare function claudeCredentialFiles(env: Record<string, string | undefined>, hostHome: string, cwd?: string): string[];
 export interface ResolveAgentSandboxOpts {
     env: Record<string, string | undefined>;
+    /** The agent's env when it differs from `env` (a harness `env` overlay): its login files are denied too. */
+    agentEnv?: Record<string, string | undefined>;
+    /** The agent's working directory (resolves a relative path in `agentEnv`). */
+    cwd?: string;
     /** Explicit mode (client option); falls back to `env.SWENY_SANDBOX`. */
     mode?: SandboxMode;
     /** Explicit extra hosts (client option); falls back to `env.SWENY_SANDBOX_ALLOWED_DOMAINS`. */

package/dist/agent-env.js

@@ -262,7 +262,7 @@ export const PI_PROVIDER_VARS = {
     "xiaomi-token-plan-sgp": ["XIAOMI_TOKEN_PLAN_SGP_API_KEY"],
 };
 /** pi settings that are not secrets: their presence alone never selects a provider. */
-const PI_NON_SECRET_VARS = new Set([
+export const PI_NON_SECRET_VARS = new Set([
     "AZURE_OPENAI_BASE_URL",
     "AZURE_OPENAI_RESOURCE_NAME",
     "CLOUDFLARE_ACCOUNT_ID",
@@ -338,7 +338,8 @@ export function resolvePiProvider(env, model, explicit) {
 }
 /** A stored Codex login (`codex login`): `auth.json` under `CODEX_HOME`, default `~/.codex`. */
 export function hasCodexLogin(env = process.env, exists = existsSync) {
-    const home = env.CODEX_HOME || path.join(homedir(), ".codex");
+    // The env's HOME, not the process's: a harness `env` overlay may give the run its own.
+    const home = env.CODEX_HOME || path.join(env.HOME || homedir(), ".codex");
     return exists(path.join(home, "auth.json"));
 }
 /**
@@ -535,9 +536,10 @@ export function buildAgentEnv(source, opts = {}) {
     const prefixes = [...(opts.prefixes ?? AGENT_ENV_PREFIXES)];
     // Bedrock / Vertex routing is a Claude Code setting; only its default prefixes carry it.
     if (!opts.prefixes) {
-        if (truthy(source.CLAUDE_CODE_USE_BEDROCK))
+        const routing = opts.routing ?? source;
+        if (truthy(routing.CLAUDE_CODE_USE_BEDROCK))
             prefixes.push(...BEDROCK_PREFIXES);
-        if (truthy(source.CLAUDE_CODE_USE_VERTEX))
+        if (truthy(routing.CLAUDE_CODE_USE_VERTEX))
             for (const v of VERTEX_VARS)
                 exact.add(v);
     }
@@ -636,7 +638,8 @@ export function noPushGitConfig(dir) {
  * scoping is on. Withholds {@link PUSH_TOKEN_VARS} (the ssh agent socket and
  * askpass programs among them) and every {@link isAgentCredential} name, even
  * one a node granted with `agent_env`, appends
- * {@link noPushGitConfig} after any `GIT_CONFIG_*` entries already present,
+ * {@link noPushGitConfig} after any `GIT_CONFIG_*` entries already present
+ * (and drops `GIT_CONFIG_PARAMETERS`, which git would apply after them),
  * sets `GIT_ASKPASS` to a refusing program, turns off git's terminal prompt,
  * routes git's ssh through a wrapper that refuses `git-receive-pack` (so an
  * ssh push fails even to a remote with an explicit `pushurl` under
@@ -662,6 +665,10 @@ export function withPushBlocked(env, enabled) {
         // Every skill credential too, even one a node granted with `agent_env`.
         if (PUSH_TOKEN_VARS.includes(k) || isAgentCredential(k))
             continue;
+        // git reads GIT_CONFIG_PARAMETERS after the GIT_CONFIG_COUNT entries, so a value there would
+        // override the block (push.default, core.hooksPath, credential.helper).
+        if (k === "GIT_CONFIG_PARAMETERS")
+            continue;
         out[k] = v;
     }
     const base = Number.parseInt(out.GIT_CONFIG_COUNT ?? "0", 10);
@@ -814,6 +821,116 @@ export function grantedAgentEnv(agentEnv, opts) {
         return { grant: [], dropped: `agent_env withheld in a staged or dry run: ${names.join(", ")}` };
     return { grant: names };
 }
+/** POSIX leaves env names loosely defined; the rules here: not empty, no `=`, no NUL, no whitespace. */
+function checkEnvName(option, name) {
+    if (typeof name !== "string" || name === "" || /[=\0\s]/.test(name)) {
+        throw new Error(`${option}: invalid env var name ${JSON.stringify(name)} (must be a non-empty string without "=", NUL or whitespace)`);
+    }
+    return name;
+}
+/**
+ * The executable a spawn of `command` with this env and cwd would run: a path
+ * with a separator resolves against `cwd`, a bare name is looked up on
+ * `env.PATH`. Undefined when nothing executable is found. Used so a version
+ * check probes the same file the spawn later runs (a harness `env` overlay may
+ * set its own `PATH`).
+ */
+export function resolveExecutable(command, env, cwd = process.cwd()) {
+    const ok = (p) => {
+        try {
+            accessSync(p, fsConstants.X_OK);
+            return statSync(p).isFile();
+        }
+        catch {
+            return false;
+        }
+    };
+    if (command.includes(path.sep) || command.includes("/")) {
+        const p = path.resolve(cwd, command);
+        return ok(p) ? p : undefined;
+    }
+    for (const dir of (env.PATH ?? "").split(path.delimiter).filter(Boolean)) {
+        const p = path.resolve(cwd, dir, command);
+        if (ok(p))
+            return p;
+    }
+    return undefined;
+}
+/** Overlay names whose value is a directory the sandbox derives credential-file denies from. */
+const OVERLAY_PATH_VARS = ["HOME", "CLAUDE_CONFIG_DIR", "CODEX_HOME"];
+function isPlainObject(v) {
+    if (v === null || typeof v !== "object")
+        return false;
+    const proto = Object.getPrototypeOf(v);
+    return proto === Object.prototype || proto === null;
+}
+/**
+ * Validate and copy a harness's `env` / `envRemove` options. Throws on a
+ * non-string value or an invalid name, so a bad overlay fails at construction
+ * instead of at spawn. Returns undefined when neither option is set. The copy
+ * means a later change to the caller's objects has no effect.
+ */
+export function agentEnvOverlay(opts) {
+    if (opts.env === undefined && opts.envRemove === undefined)
+        return undefined;
+    const env = {};
+    if (opts.env !== undefined) {
+        if (!isPlainObject(opts.env)) {
+            throw new Error("env: must be a plain object of env var names to string values (not a Map or class instance)");
+        }
+        for (const [k, v] of Object.entries(opts.env)) {
+            checkEnvName("env", k);
+            if (typeof v !== "string") {
+                throw new Error(`env: value for ${k} must be a string, got ${typeof v}` +
+                    (v === undefined ? " (leave the key out, or name it in envRemove to unset it)" : ""));
+            }
+            if (v.includes("\0"))
+                throw new Error(`env: value for ${k} contains NUL`);
+            if (OVERLAY_PATH_VARS.includes(k) && !path.isAbsolute(v)) {
+                throw new Error(`env: ${k} must be an absolute path, got ${JSON.stringify(v)}`);
+            }
+            env[k] = v;
+        }
+    }
+    if (opts.envRemove !== undefined && !Array.isArray(opts.envRemove)) {
+        throw new Error("envRemove: must be an array of env var names");
+    }
+    const remove = (opts.envRemove ?? []).map((n) => checkEnvName("envRemove", n));
+    return Object.freeze({ env: Object.freeze(env), remove: Object.freeze(remove) });
+}
+/**
+ * Apply a caller overlay to a scoped agent env, before {@link finishAgentEnv}
+ * (which then withholds any overlaid skill credential the node did not grant).
+ * Drops the `remove` names, then, when the overlay names any of `credentials`
+ * (the harness's own login vars), drops the inherited ones, then lays the
+ * overlay values on top. Pure: returns a copy.
+ */
+export function applyEnvOverlay(env, overlay, credentials) {
+    if (!overlay)
+        return env;
+    const out = { ...env };
+    for (const name of overlay.remove)
+        delete out[name];
+    if (credentials.some((c) => Object.hasOwn(overlay.env, c)))
+        for (const c of credentials)
+            delete out[c];
+    return Object.assign(out, overlay.env);
+}
+/**
+ * `process.env` as the agent will see it for auth and command lookups (a
+ * harness's `preflight()` probe): the overlay applied by {@link applyEnvOverlay},
+ * except `SWENY_*` names, which stay as sweny reads them from `process.env`.
+ */
+export function overlaidProcessEnv(overlay, credentials) {
+    const full = Object.fromEntries(Object.entries(process.env).filter((e) => e[1] != null));
+    if (!overlay)
+        return full;
+    const own = (n) => !n.startsWith("SWENY_");
+    return applyEnvOverlay(full, {
+        env: Object.fromEntries(Object.entries(overlay.env).filter(([k]) => own(k))),
+        remove: overlay.remove.filter(own),
+    }, credentials);
+}
 /** True when a run request may load no MCP server but sweny's own bridge (read-only or staged). */
 export function mcpWithheld(readOnly, access) {
     return readOnly || access?.noMcp === true;
@@ -1031,9 +1148,12 @@ function defaultProbe() {
  * - `network.allowedDomains` + `strictAllowlist`: non-listed hosts are denied
  *   deterministically rather than prompted (no prompt exists headless).
  * - `credentials`: the agent's own Anthropic credentials are unset for
- *   sandboxed commands, and the Claude Code credentials file is unreadable.
+ *   sandboxed commands, and the Claude Code credentials file is unreadable:
+ *   the host's, and the one the agent env selects ({@link claudeCredentialFiles},
+ *   `agentEnv` carrying a harness `env` overlay's `HOME` / `CLAUDE_CONFIG_DIR`).
  */
 export function buildSandboxSettings(domains, opts = {}) {
+    const loginFiles = claudeCredentialFiles(opts.agentEnv ?? {}, opts.home ?? homedir(), opts.cwd);
     return {
         enabled: true,
         failIfUnavailable: opts.failIfUnavailable ?? true,
@@ -1046,7 +1166,7 @@ export function buildSandboxSettings(domains, opts = {}) {
         credentials: {
             envVars: AGENT_AUTH_VARS.map((name) => ({ name, mode: "deny" })),
             files: [
-                { path: path.join(opts.home ?? homedir(), ".claude", ".credentials.json"), mode: "deny" },
+                ...loginFiles.map((p) => ({ path: p, mode: "deny" })),
                 // Run journals and their keys: an agent that could read a key could forge records.
                 { path: runStateRoot(), mode: "deny" },
             ],
@@ -1055,6 +1175,21 @@ export function buildSandboxSettings(domains, opts = {}) {
         filesystem: { denyRead: [runStateRoot()], denyWrite: [runStateRoot()] },
     };
 }
+/**
+ * Claude Code login files to deny to sandboxed commands: the host's
+ * (`<hostHome>/.claude/.credentials.json`), plus the one `env` selects when it
+ * points elsewhere: `$CLAUDE_CONFIG_DIR/.credentials.json`, and
+ * `$HOME/.claude/.credentials.json`. A relative value resolves against the
+ * agent's `cwd`, where the agent would resolve it. Deduplicated, host file first.
+ */
+export function claudeCredentialFiles(env, hostHome, cwd = process.cwd()) {
+    const files = [path.join(hostHome, ".claude", ".credentials.json")];
+    if (env.CLAUDE_CONFIG_DIR)
+        files.push(path.resolve(cwd, env.CLAUDE_CONFIG_DIR, ".credentials.json"));
+    if (env.HOME)
+        files.push(path.resolve(cwd, env.HOME, ".claude", ".credentials.json"));
+    return [...new Set(files)];
+}
 /**
  * Resolve the `sandbox` query option for one agent call.
  *
@@ -1091,6 +1226,8 @@ export function resolveAgentSandbox(opts) {
         settings: buildSandboxSettings([...DEFAULT_SANDBOX_DOMAINS, ...(opts.nodeDomains ?? []), ...extra], {
             // Preflight passed: from here the sandbox is enforced or the node fails.
             failIfUnavailable: true,
+            agentEnv: opts.agentEnv,
+            cwd: opts.cwd,
         }),
     };
 }

package/dist/executor.d.ts

@@ -40,7 +40,11 @@ export interface ExecuteOptions {
     logger?: Logger;
     /** Working directory for resolving file Sources (default: process.cwd()) */
     cwd?: string;
-    /** Environment variables for Source resolution auth lookup */
+    /**
+     * The env SWEny itself reads for this run: skill config, `context:` Source
+     * auth, the branch pusher's token and the run's identity. It never reaches
+     * the agent; to change the agent's env, pass `env` / `envRemove` to the harness.
+     */
     env?: NodeJS.ProcessEnv;
     /** Host → env-var-name map for URL Source authentication */
     fetchAuth?: Record<string, string>;

package/dist/harness/acp.d.ts

@@ -45,7 +45,7 @@
  * - Timeout: `session/cancel`, a grace period, then the process is killed.
  */
 import type { Logger, McpServerConfig, ToolContext } from "../types.js";
-import { type SandboxMode } from "../agent-env.js";
+import { type HarnessEnvOptions, type SandboxMode } from "../agent-env.js";
 import type { AgentHarness, HarnessCapabilities, HarnessCompleteRequest, HarnessId, HarnessInfo, HarnessRunRequest, HarnessRunResult, ToolClass } from "./types.js";
 import { ACP_CAPABILITIES } from "./capabilities.js";
 import { type HarnessPolicyMode } from "./policy.js";
@@ -53,7 +53,7 @@ import { type SandboxWrapper } from "./sandbox-wrapper.js";
 export { ACP_CAPABILITIES };
 /** The ACP major version sweny speaks (`InitializeRequest.protocolVersion`). */
 export declare const ACP_PROTOCOL_VERSION = 1;
-export interface AcpHarnessOptions {
+export interface AcpHarnessOptions extends HarnessEnvOptions {
     /**
      * The agent to run: a command line (`"opencode acp"`, the part after `acp:`)
      * or an explicit `{command, args}`. Never run through a shell.
@@ -139,6 +139,7 @@ export declare class AcpHarness implements AgentHarness {
     private envPassthrough;
     private authVars;
     private envScope;
+    private envOverlay;
     private sandboxMode;
     private sandboxWrapper;
     private policyMode;
@@ -167,6 +168,8 @@ export declare class AcpHarness implements AgentHarness {
      * vars the operator named. Skill credentials are dropped either way
      * ({@link finishAgentEnv}) unless the node granted them with `agent_env`; an
      * operator-named auth var stays, and the gate counts it if it is a write token.
+     * The caller's `envRemove` / `env` are applied after scoping
+     * ({@link applyEnvOverlay}), before that credential rule.
      */
     private buildEnv;
     /** The node policy, with the harness policy mode and the watchdog budget applied. */

package/dist/harness/acp.js

@@ -45,10 +45,9 @@
  * - Timeout: `session/cancel`, a grace period, then the process is killed.
  */
 import { spawn } from "node:child_process";
-import * as fs from "node:fs";
 import * as path from "node:path";
 import { consoleLogger } from "../types.js";
-import { finishAgentEnv, heldCredentials, parseList, reportWithheldEnv, resolveEnvScope, resolveSandboxMode, scopeAgentEnv, withPushBlocked, mcpWithheld, } from "../agent-env.js";
+import { agentEnvOverlay, applyEnvOverlay, finishAgentEnv, heldCredentials, overlaidProcessEnv, resolveExecutable, parseList, reportWithheldEnv, resolveEnvScope, resolveSandboxMode, scopeAgentEnv, withPushBlocked, mcpWithheld, } from "../agent-env.js";
 import { ACP_CAPABILITIES } from "./capabilities.js";
 import { policyGate, resolveHarnessPolicy, TOOL_CLASSES } from "./policy.js";
 import { gitCredentialPolicy } from "../git-credentials.js";
@@ -148,25 +147,6 @@ export function toAcpMcpServers(servers, agentHttp) {
     }
     return { list, unsupported };
 }
-function resolveOnPath(command, env) {
-    const ok = (p) => {
-        try {
-            fs.accessSync(p, fs.constants.X_OK);
-            return fs.statSync(p).isFile();
-        }
-        catch {
-            return false;
-        }
-    };
-    if (command.includes(path.sep) || command.includes("/"))
-        return ok(command) ? command : undefined;
-    for (const dir of (env.PATH ?? "").split(path.delimiter).filter(Boolean)) {
-        const p = path.join(dir, command);
-        if (ok(p))
-            return p;
-    }
-    return undefined;
-}
 // ─── Process registry (crash cleanup) ────────────────────────────
 const liveChildren = new Set();
 let exitHookInstalled = false;
@@ -207,6 +187,7 @@ export class AcpHarness {
     envPassthrough;
     authVars;
     envScope;
+    envOverlay;
     sandboxMode;
     sandboxWrapper;
     policyMode;
@@ -238,6 +219,7 @@ export class AcpHarness {
         this.envPassthrough = opts.envPassthrough;
         this.authVars = opts.authVars ?? [];
         this.envScope = opts.envScope;
+        this.envOverlay = agentEnvOverlay(opts);
         this.sandboxMode = opts.sandbox;
         this.sandboxWrapper = opts.sandboxWrapper;
         this.policyMode = opts.policy ?? resolveHarnessPolicy(process.env, undefined, this.logger);
@@ -256,7 +238,7 @@ export class AcpHarness {
      * first run (`agentInfo.version`).
      */
     async preflight() {
-        const found = resolveOnPath(this.agent.command, process.env);
+        const found = resolveExecutable(this.agent.command, overlaidProcessEnv(this.envOverlay, this.authVars), this.cwd);
         if (!found) {
             const example = [this.agent.command, ...this.agent.args].join(" ");
             return {
@@ -271,6 +253,8 @@ export class AcpHarness {
      * vars the operator named. Skill credentials are dropped either way
      * ({@link finishAgentEnv}) unless the node granted them with `agent_env`; an
      * operator-named auth var stays, and the gate counts it if it is a write token.
+     * The caller's `envRemove` / `env` are applied after scoping
+     * ({@link applyEnvOverlay}), before that credential rule.
      */
     buildEnv(access) {
         const full = Object.fromEntries(Object.entries(process.env).filter((e) => e[1] != null));
@@ -287,6 +271,7 @@ export class AcpHarness {
             reportWithheldEnv(scoped.withheld, this.logger);
             env = scoped.env;
         }
+        env = applyEnvOverlay(env, this.envOverlay, this.authVars);
         return finishAgentEnv(env, { access, keep: this.authVars, passthrough, logger: this.logger }).env;
     }
     /** The node policy, with the harness policy mode and the watchdog budget applied. */

package/dist/harness/auth.js

@@ -30,7 +30,8 @@ function truthy(v) {
  */
 export function detectClaudeCodeLogin(opts = {}) {
     const env = opts.env ?? process.env;
-    const home = opts.home ?? os.homedir();
+    // The env's HOME, not the process's: a harness `env` overlay may give the run its own.
+    const home = opts.home ?? (env.HOME || os.homedir());
     const platform = opts.platform ?? process.platform;
     const configDir = env.CLAUDE_CONFIG_DIR || path.join(home, ".claude");
     try {

package/dist/harness/claude-code.d.ts

@@ -9,7 +9,7 @@
  * is to use headless Claude Code - never the raw Anthropic API.
  */
 import type { Claude, Tool, ToolContext, Logger, McpServerConfig } from "../types.js";
-import { type SandboxMode } from "../agent-env.js";
+import { type HarnessEnvOptions, type SandboxMode } from "../agent-env.js";
 import type { AgentHarness, HarnessCapabilities, HarnessCompleteRequest, HarnessInfo, HarnessRunRequest, HarnessRunResult, NodePolicy, ToolClass } from "./types.js";
 import { type HarnessPolicyMode } from "./policy.js";
 import { CLAUDE_CODE_CAPABILITIES } from "./capabilities.js";
@@ -108,7 +108,7 @@ export interface ResolveAuthEnvOpts {
  * Pure: returns a copy, never mutates the input.
  */
 export declare function resolveAuthEnv(env: Record<string, string>, opts?: ResolveAuthEnvOpts): Record<string, string>;
-export interface ClaudeCodeHarnessOptions {
+export interface ClaudeCodeHarnessOptions extends HarnessEnvOptions {
     /** Model override */
     model?: string;
     /** Max turns for tool use loop (default: 20) */
@@ -144,7 +144,7 @@ export interface ClaudeCodeHarnessOptions {
     sandboxAllowedDomains?: string[];
     /** Sandbox preflight probe (test seam). Returns a reason when the sandbox cannot run. */
     sandboxProbe?: () => string | undefined;
-    /** Login probe for `preflight()` (test seam). Default: {@link claudeCodeAuth} over `process.env`. */
+    /** Login probe for `preflight()` (test seam). Default: {@link claudeCodeAuth} over `process.env` with `env` / `envRemove` applied. */
     authProbe?: AuthProbe;
     /**
      * Serve skill tools through the SwenyToolBridge (a stdio MCP shim over a
@@ -184,6 +184,7 @@ export declare class ClaudeCodeHarness implements Claude, AgentHarness {
     private sandboxProbe;
     private sandboxWarned;
     private envScope;
+    private envOverlay;
     /** Floor facts from the latest runQuery, read by run() for the receipt. */
     private lastPolicyFacts;
     private toolBridge;
@@ -192,15 +193,17 @@ export declare class ClaudeCodeHarness implements Claude, AgentHarness {
     private policyMode;
     constructor(opts?: ClaudeCodeHarnessOptions);
     /**
-     * Build env for the Claude Code subprocess (#360). Applies auth precedence
-     * via {@link resolveAuthEnv} on the full process env (it reads
-     * `SWENY_AUTH`). When env scoping is on (default in CI, see
-     * {@link resolveEnvScope}) the result is narrowed to the allowlist plus
-     * `extraVars` (the node's declared skill env vars) and the operator
-     * passthrough list, and the withheld names (never values) are reported once
-     * per process ({@link reportWithheldEnv}). When off, the full env passes through as before.
-     * Either way, skill credentials are then dropped ({@link finishAgentEnv}):
-     * only the names the node granted with `agent_env` reach the agent.
+     * Build env for the Claude Code subprocess (#360). When env scoping is on
+     * (default in CI, see {@link resolveEnvScope}) the process env is narrowed
+     * to the allowlist plus `extraVars` (the node's declared skill env vars)
+     * and the operator passthrough list, and the withheld names (never values)
+     * are reported once per process ({@link reportWithheldEnv}). When off, the
+     * full env passes through as before. Then the caller's `envRemove` / `env`
+     * ({@link applyEnvOverlay}; overlaid auth replaces the inherited auth), then
+     * auth precedence ({@link resolveAuthEnv}, mode from `process.env.SWENY_AUTH`),
+     * then skill credentials are dropped ({@link finishAgentEnv}), overlaid ones
+     * included: only the names the node granted with `agent_env` reach the agent.
+     * `process.env` is never modified.
      */
     private buildEnv;
     /** Which harness (and SDK version) produced a result. */

package/dist/harness/claude-code.js

@@ -12,7 +12,7 @@ import { query, createSdkMcpServer, tool as sdkTool } from "@anthropic-ai/claude
 import { createRequire } from "node:module";
 import { realpathSync } from "node:fs";
 import { consoleLogger } from "../types.js";
-import { AGENT_AUTH_VARS, finishAgentEnv, reportWithheldEnv, parseList, resolveEnvScope, scopeAgentEnv, withPushBlocked, mcpWithheld, resolveAgentSandbox, } from "../agent-env.js";
+import { AGENT_AUTH_VARS, agentEnvOverlay, applyEnvOverlay, finishAgentEnv, overlaidProcessEnv, reportWithheldEnv, parseList, resolveEnvScope, scopeAgentEnv, withPushBlocked, mcpWithheld, resolveAgentSandbox, } from "../agent-env.js";
 import { gitCredentialGap, policyGate } from "./policy.js";
 import { gitCredentialPolicy } from "../git-credentials.js";
 import { CLAUDE_CODE_CAPABILITIES } from "./capabilities.js";
@@ -262,6 +262,7 @@ export class ClaudeCodeHarness {
     sandboxProbe;
     sandboxWarned = false;
     envScope;
+    envOverlay;
     /** Floor facts from the latest runQuery, read by run() for the receipt. */
     lastPolicyFacts;
     toolBridge;
@@ -278,35 +279,47 @@ export class ClaudeCodeHarness {
         this.defaultMcpServers = opts.defaultMcpServers ?? {};
         this.envPassthrough = opts.envPassthrough;
         this.envScope = opts.envScope;
+        this.envOverlay = agentEnvOverlay(opts);
         this.sandboxMode = opts.sandbox;
         this.sandboxAllowedDomains = opts.sandboxAllowedDomains;
         this.sandboxProbe = opts.sandboxProbe;
         this.toolBridge = opts.toolBridge ?? process.env.SWENY_TOOL_BRIDGE === "1";
         this.toolBridgeShim = opts.toolBridgeShim;
-        this.authProbe = opts.authProbe ?? (() => claudeCodeAuth(process.env));
+        this.authProbe = opts.authProbe ?? (() => claudeCodeAuth(overlaidProcessEnv(this.envOverlay, AGENT_AUTH_VARS)));
         this.policyMode = opts.policy ?? "warn";
     }
     /**
-     * Build env for the Claude Code subprocess (#360). Applies auth precedence
-     * via {@link resolveAuthEnv} on the full process env (it reads
-     * `SWENY_AUTH`). When env scoping is on (default in CI, see
-     * {@link resolveEnvScope}) the result is narrowed to the allowlist plus
-     * `extraVars` (the node's declared skill env vars) and the operator
-     * passthrough list, and the withheld names (never values) are reported once
-     * per process ({@link reportWithheldEnv}). When off, the full env passes through as before.
-     * Either way, skill credentials are then dropped ({@link finishAgentEnv}):
-     * only the names the node granted with `agent_env` reach the agent.
+     * Build env for the Claude Code subprocess (#360). When env scoping is on
+     * (default in CI, see {@link resolveEnvScope}) the process env is narrowed
+     * to the allowlist plus `extraVars` (the node's declared skill env vars)
+     * and the operator passthrough list, and the withheld names (never values)
+     * are reported once per process ({@link reportWithheldEnv}). When off, the
+     * full env passes through as before. Then the caller's `envRemove` / `env`
+     * ({@link applyEnvOverlay}; overlaid auth replaces the inherited auth), then
+     * auth precedence ({@link resolveAuthEnv}, mode from `process.env.SWENY_AUTH`),
+     * then skill credentials are dropped ({@link finishAgentEnv}), overlaid ones
+     * included: only the names the node granted with `agent_env` reach the agent.
+     * `process.env` is never modified.
      */
     buildEnv(access) {
         const full = Object.fromEntries(Object.entries(process.env).filter((e) => e[1] != null));
-        const authed = resolveAuthEnv(full, { logger: this.logger });
         const passthrough = this.envPassthrough ?? parseList(process.env.SWENY_ENV_PASSTHROUGH);
-        let env = authed;
+        let env = full;
         if (resolveEnvScope(process.env, this.envScope, this.logger)) {
-            const scoped = scopeAgentEnv(authed, { extraVars: access?.envVars ?? [], passthrough, logger: this.logger });
+            const scoped = scopeAgentEnv(full, {
+                extraVars: access?.envVars ?? [],
+                passthrough,
+                // An overlaid CLAUDE_CODE_USE_BEDROCK / _VERTEX decides which cloud vars are kept.
+                routing: this.envOverlay ? overlaidProcessEnv(this.envOverlay, AGENT_AUTH_VARS) : undefined,
+                logger: this.logger,
+            });
             reportWithheldEnv(scoped.withheld, this.logger);
             env = scoped.env;
         }
+        env = applyEnvOverlay(env, this.envOverlay, AGENT_AUTH_VARS);
+        // Scoping keeps every ANTHROPIC_* / CLAUDE_* name, so auth resolves the same after it. The mode
+        // comes from process.env: an overlaid SWENY_AUTH reaches the agent, not sweny ("" reads as auto).
+        env = resolveAuthEnv(env, { mode: (process.env.SWENY_AUTH ?? ""), logger: this.logger });
         return finishAgentEnv(env, { access, keep: AGENT_AUTH_VARS, passthrough, logger: this.logger }).env;
     }
     /** Which harness (and SDK version) produced a result. */
@@ -401,6 +414,9 @@ export class ClaudeCodeHarness {
         // `strict` fails the node here instead.
         const sandbox = resolveAgentSandbox({
             env: process.env,
+            // A `HOME` / `CLAUDE_CONFIG_DIR` overlay selects another login file; deny it too.
+            agentEnv: overlaidProcessEnv(this.envOverlay, AGENT_AUTH_VARS),
+            cwd: this.cwd,
             mode: opts.sandboxMode ?? this.sandboxMode,
             allowedDomains: this.sandboxAllowedDomains,
             nodeDomains: agentAccess?.domains,

package/dist/harness/codex.d.ts

@@ -24,7 +24,7 @@
  * by `policyGate`. Nothing is dropped silently.
  */
 import type { Logger, McpServerConfig, ToolContext } from "../types.js";
-import { type SandboxMode } from "../agent-env.js";
+import { type HarnessEnvOptions, type SandboxMode } from "../agent-env.js";
 import type { AgentHarness, HarnessCapabilities, HarnessCompleteRequest, HarnessInfo, HarnessRunRequest, HarnessRunResult, ToolClass } from "./types.js";
 import { CODEX_CAPABILITIES } from "./capabilities.js";
 import { type HarnessPolicyMode } from "./policy.js";
@@ -52,7 +52,7 @@ export declare const CODEX_ISOLATION_FEATURES_OFF: readonly ["apps", "plugins",
  * through the sandbox wrapper, plus the host of `OPENAI_BASE_URL` when set.
  */
 export declare function codexBackendHosts(env?: Record<string, string | undefined>): string[];
-export interface CodexHarnessOptions {
+export interface CodexHarnessOptions extends HarnessEnvOptions {
     /** Model override (`--model`). Free text; sweny has no model opinion. */
     model?: string;
     /** Tool-call budget the watchdog enforces when a node sets no `max_turns` (default: 20). */
@@ -97,7 +97,7 @@ export interface CodexHarnessOptions {
     };
     /** Grace period between SIGTERM and SIGKILL when stopping Codex (default: 2000 ms). */
     killGraceMs?: number;
-    /** Login probe for `preflight()` (test seam). Default: {@link codexAuth} over `process.env`. */
+    /** Login probe for `preflight()` (test seam). Default: {@link codexAuth} over `process.env` with `env` / `envRemove` applied. */
     authProbe?: AuthProbe;
 }
 /** A TOML value for `-c key=value`, as the official SDK writes it (sdk/typescript/src/exec.ts). */
@@ -134,6 +134,7 @@ export declare class CodexHarness implements AgentHarness {
     private defaultMcpServers;
     private envPassthrough;
     private envScope;
+    private envOverlay;
     private sandboxMode;
     private sandboxProbe;
     private sandboxWarned;
@@ -141,6 +142,7 @@ export declare class CodexHarness implements AgentHarness {
     private loginWarned;
     private policyMode;
     private codexCommand;
+    private resolvedCommand;
     private toolBridgeShim;
     private killGraceMs;
     private preflightResult;
@@ -159,12 +161,27 @@ export declare class CodexHarness implements AgentHarness {
         ok: false;
         reason: string;
     }>;
+    /**
+     * `process.env` with the caller's `env` / `envRemove` applied, unscoped: where
+     * sweny reads Codex's own settings (`OPENAI_BASE_URL`) and the login probe.
+     * The scoped agent env would drop an inherited base URL.
+     */
+    private hostEnv;
+    /**
+     * {@link hostEnv} as the login probe should see it: an inherited
+     * OPENAI_API_KEY does not count once `envRemove` names CODEX_API_KEY, since
+     * the agent env no longer derives CODEX_API_KEY from it.
+     */
+    private loginEnv;
+    /** The Codex executable to spawn: the one the version check resolved and ran. */
+    private cliPath;
     /** `codex --version`, checked against {@link MIN_CODEX_VERSION}. Cached per instance. */
     private checkCli;
     /**
      * Env for the Codex process: scoped like Claude Code's, with Codex's auth
-     * vars instead of Anthropic's. Skill credentials are dropped either way
-     * ({@link finishAgentEnv}) unless the node granted them with `agent_env`.
+     * vars instead of Anthropic's, then the caller's `envRemove` / `env`
+     * ({@link applyEnvOverlay}). Skill credentials are dropped either way, overlaid
+     * ones included ({@link finishAgentEnv}), unless the node granted them with `agent_env`.
      */
     private buildEnv;
     /** The node policy after `disallowed_tools` names are translated into Codex classes. */

package/dist/harness/codex.js

@@ -28,7 +28,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { consoleLogger } from "../types.js";
-import { CODEX_AUTH_VARS, CODEX_ENV_PREFIXES, checkSandboxSupport, finishAgentEnv, heldCredentials, parseList, reportWithheldEnv, resolveCodexAuthEnv, resolveEnvScope, resolveSandboxMode, scopeAgentEnv, withPushBlocked, mcpWithheld, } from "../agent-env.js";
+import { CODEX_AUTH_VARS, CODEX_ENV_PREFIXES, agentEnvOverlay, applyEnvOverlay, checkSandboxSupport, finishAgentEnv, resolveExecutable, overlaidProcessEnv, heldCredentials, parseList, reportWithheldEnv, resolveCodexAuthEnv, resolveEnvScope, resolveSandboxMode, scopeAgentEnv, withPushBlocked, mcpWithheld, } from "../agent-env.js";
 import { CODEX_CAPABILITIES } from "./capabilities.js";
 import { policyGate, resolveHarnessPolicy } from "./policy.js";
 import { gitCredentialPolicy } from "../git-credentials.js";
@@ -40,6 +40,13 @@ import { defaultSandboxWrapper, prepareAgentSpawn, wrappersFrom, } from "./sandb
 import { TOKEN_ENV } from "./tool-bridge/protocol.js";
 import { codexAuth } from "./auth.js";
 export { CODEX_CAPABILITIES };
+/**
+ * The credentials an `env` overlay replaces as a set ({@link applyEnvOverlay}):
+ * Codex's API key and access token, and `OPENAI_API_KEY`, which stands in for
+ * `CODEX_API_KEY` ({@link resolveCodexAuthEnv}). `CODEX_HOME` is a location,
+ * not a credential: overlaying it does not drop an inherited key.
+ */
+const CODEX_CREDENTIAL_VARS = ["CODEX_API_KEY", "CODEX_ACCESS_TOKEN", "OPENAI_API_KEY"];
 /** Oldest Codex CLI whose flags this adapter uses (`--ignore-user-config`, `--ignore-rules`). */
 export const MIN_CODEX_VERSION = "0.159.0";
 /**
@@ -286,6 +293,7 @@ export class CodexHarness {
     defaultMcpServers;
     envPassthrough;
     envScope;
+    envOverlay;
     sandboxMode;
     sandboxProbe;
     sandboxWarned = false;
@@ -293,6 +301,7 @@ export class CodexHarness {
     loginWarned = false;
     policyMode;
     codexCommand;
+    resolvedCommand;
     toolBridgeShim;
     killGraceMs;
     preflightResult;
@@ -308,6 +317,7 @@ export class CodexHarness {
         this.defaultMcpServers = opts.defaultMcpServers ?? {};
         this.envPassthrough = opts.envPassthrough;
         this.envScope = opts.envScope;
+        this.envOverlay = agentEnvOverlay(opts);
         this.sandboxMode = opts.sandbox;
         this.sandboxProbe = opts.sandboxProbe;
         this.sandboxWrapper = opts.sandboxWrapper;
@@ -315,7 +325,7 @@ export class CodexHarness {
         this.codexCommand = opts.codexCommand ?? { command: process.env.SWENY_CODEX_PATH || "codex", args: [] };
         this.toolBridgeShim = opts.toolBridgeShim;
         this.killGraceMs = opts.killGraceMs ?? 2000;
-        this.authProbe = opts.authProbe ?? (() => codexAuth(process.env));
+        this.authProbe = opts.authProbe ?? (() => codexAuth(this.loginEnv()));
     }
     info() {
         return { id: this.id, version: this.version };
@@ -331,11 +341,40 @@ export class CodexHarness {
         const auth = this.authProbe();
         return auth.ok ? cli : { ok: false, reason: auth.reason };
     }
+    /**
+     * `process.env` with the caller's `env` / `envRemove` applied, unscoped: where
+     * sweny reads Codex's own settings (`OPENAI_BASE_URL`) and the login probe.
+     * The scoped agent env would drop an inherited base URL.
+     */
+    hostEnv() {
+        return overlaidProcessEnv(this.envOverlay, CODEX_CREDENTIAL_VARS);
+    }
+    /**
+     * {@link hostEnv} as the login probe should see it: an inherited
+     * OPENAI_API_KEY does not count once `envRemove` names CODEX_API_KEY, since
+     * the agent env no longer derives CODEX_API_KEY from it.
+     */
+    loginEnv() {
+        const env = this.hostEnv();
+        const overlay = this.envOverlay;
+        if (overlay?.remove.includes("CODEX_API_KEY") && !Object.hasOwn(overlay.env, "OPENAI_API_KEY")) {
+            delete env.OPENAI_API_KEY;
+        }
+        return env;
+    }
+    /** The Codex executable to spawn: the one the version check resolved and ran. */
+    cliPath() {
+        return this.resolvedCommand ?? this.codexCommand.command;
+    }
     /** `codex --version`, checked against {@link MIN_CODEX_VERSION}. Cached per instance. */
     checkCli() {
         this.preflightResult ??= new Promise((resolve) => {
             const { command, args } = this.codexCommand;
-            execFile(command, [...args, "--version"], { timeout: 30_000 }, (err, stdout) => {
+            // Probe the file the spawn will run: resolved on the run's PATH and cwd, then reused at spawn.
+            const hostEnv = this.hostEnv();
+            this.resolvedCommand = resolveExecutable(command, hostEnv, this.cwd);
+            const opts = { timeout: 30_000, cwd: this.cwd, env: hostEnv };
+            execFile(this.resolvedCommand ?? command, [...args, "--version"], opts, (err, stdout) => {
                 if (err) {
                     const code = err.code;
                     resolve({
@@ -370,11 +409,16 @@ export class CodexHarness {
     }
     /**
      * Env for the Codex process: scoped like Claude Code's, with Codex's auth
-     * vars instead of Anthropic's. Skill credentials are dropped either way
-     * ({@link finishAgentEnv}) unless the node granted them with `agent_env`.
+     * vars instead of Anthropic's, then the caller's `envRemove` / `env`
+     * ({@link applyEnvOverlay}). Skill credentials are dropped either way, overlaid
+     * ones included ({@link finishAgentEnv}), unless the node granted them with `agent_env`.
      */
     buildEnv(access) {
-        const full = Object.fromEntries(Object.entries(process.env).filter((e) => e[1] != null));
+        const overlay = this.envOverlay;
+        const removed = new Set(overlay?.remove ?? []);
+        // `envRemove` goes first, before the OPENAI_API_KEY alias, so a removed OPENAI_API_KEY is not
+        // copied; a removed CODEX_API_KEY made by the alias is dropped again with the overlay below.
+        const full = Object.fromEntries(Object.entries(process.env).filter((e) => e[1] != null && !removed.has(e[0])));
         const authed = resolveCodexAuthEnv(full);
         const passthrough = this.envPassthrough ?? parseList(process.env.SWENY_ENV_PASSTHROUGH);
         let env = authed;
@@ -389,6 +433,16 @@ export class CodexHarness {
             reportWithheldEnv(scoped.withheld, this.logger);
             env = scoped.env;
         }
+        if (overlay) {
+            env = applyEnvOverlay(env, overlay, CODEX_CREDENTIAL_VARS);
+            if (CODEX_CREDENTIAL_VARS.some((c) => Object.hasOwn(overlay.env, c))) {
+                // An overlaid OPENAI_API_KEY stands in for CODEX_API_KEY like an inherited one, and is then
+                // dropped, as scoping drops an inherited one: Codex reads only CODEX_API_KEY.
+                if (!env.CODEX_API_KEY && overlay.env.OPENAI_API_KEY)
+                    env.CODEX_API_KEY = overlay.env.OPENAI_API_KEY;
+                delete env.OPENAI_API_KEY;
+            }
+        }
         return finishAgentEnv(env, { access, keep: CODEX_AUTH_VARS, passthrough, logger: this.logger }).env;
     }
     /** The node policy after `disallowed_tools` names are translated into Codex classes. */
@@ -466,7 +520,7 @@ export class CodexHarness {
         if (opts.sandbox === "workspace-write") {
             args.push(...cfg("sandbox_workspace_write.network_access", opts.network));
         }
-        const baseUrl = process.env.OPENAI_BASE_URL;
+        const baseUrl = this.hostEnv().OPENAI_BASE_URL;
         if (baseUrl)
             args.push(...cfg("openai_base_url", baseUrl));
         return args;
@@ -866,9 +920,9 @@ export class CodexHarness {
                 const prep = await prepareAgentSpawn({
                     caps: this.capabilities,
                     policy,
-                    spawn: { command: this.codexCommand.command, args: argsFor(withSchema), env, cwd: this.cwd },
+                    spawn: { command: this.cliPath(), args: argsFor(withSchema), env, cwd: this.cwd },
                     wrapper: wrapper ?? null,
-                    harnessEgress: codexBackendHosts(),
+                    harnessEgress: codexBackendHosts(this.hostEnv()),
                     env: process.env,
                 });
                 degraded = prep.degraded;
@@ -994,7 +1048,7 @@ export class CodexHarness {
             "-",
         ];
         const out = await this.exec({
-            spawn: { command: this.codexCommand.command, args, env: this.buildEnv(), cwd: this.cwd },
+            spawn: { command: this.cliPath(), args, env: this.buildEnv(), cwd: this.cwd },
             prompt: req.prompt,
             timeoutMs: req.timeoutMs,
             signal: req.signal,

package/dist/harness/pi.d.ts

@@ -29,7 +29,7 @@
  * `policyGate`. Nothing is dropped silently.
  */
 import type { Logger, McpServerConfig, NodeUsage, ToolContext, Tool } from "../types.js";
-import { type SandboxMode } from "../agent-env.js";
+import { type HarnessEnvOptions, type SandboxMode } from "../agent-env.js";
 import type { AgentHarness, HarnessCapabilities, HarnessCompleteRequest, HarnessInfo, HarnessRunRequest, HarnessRunResult, ToolClass } from "./types.js";
 import { PI_CAPABILITIES } from "./capabilities.js";
 import { type HarnessPolicyMode } from "./policy.js";
@@ -49,7 +49,7 @@ export declare const PI_BRIDGE_SERVER = "sweny-core";
  * providers) are added with `SWENY_SANDBOX_ALLOWED_DOMAINS`.
  */
 export declare function piBackendHosts(env?: Record<string, string | undefined>, model?: string): string[];
-export interface PiHarnessOptions {
+export interface PiHarnessOptions extends HarnessEnvOptions {
     /** Model passed to `--model`. Free text (`provider/id`, `id:thinking`); sweny has no model opinion. */
     model?: string;
     /**
@@ -160,10 +160,12 @@ export declare class PiHarness implements AgentHarness {
     private defaultMcpServers;
     private envPassthrough;
     private envScope;
+    private envOverlay;
     private sandboxMode;
     private sandboxWrapper;
     private policyMode;
     private piCommand;
+    private resolvedCommand;
     private modelsFile;
     private toolBridgeShim;
     private abortGraceMs;
@@ -174,6 +176,8 @@ export declare class PiHarness implements AgentHarness {
     private version;
     constructor(opts?: PiHarnessOptions);
     info(): HarnessInfo;
+    /** The pi executable to spawn: the one the version check resolved and ran. */
+    private cliPath;
     /** `pi --version`, checked against {@link MIN_PI_VERSION}. Cached per instance. */
     preflight(): Promise<{
         ok: true;
@@ -182,14 +186,16 @@ export declare class PiHarness implements AgentHarness {
         ok: false;
         reason: string;
     }>;
-    /** Which provider's credential this call gets ({@link resolvePiProvider}). */
+    /** Which provider's credential this call gets ({@link resolvePiProvider}), over the env with the overlay applied. */
     private resolveProvider;
     /**
      * Env for the pi process: scoped like Claude Code's, with ONE provider's
      * credentials instead of Anthropic's (`providerVars`, from
      * {@link resolvePiProvider}). Every other provider key is dropped, scoped or
-     * not, since pi's bash tool inherits this env. Skill credentials are dropped
-     * too ({@link finishAgentEnv}) unless the node granted them with `agent_env`.
+     * not, since pi's bash tool inherits this env. The caller's `envRemove` /
+     * `env` are applied after scoping ({@link applyEnvOverlay}), so the same rules
+     * hold for overlaid names. Skill credentials are dropped too, overlaid ones
+     * included ({@link finishAgentEnv}), unless the node granted them with `agent_env`.
      */
     private buildEnv;
     /** The node policy after `disallowed_tools` names are translated into pi classes. */

package/dist/harness/pi.js

@@ -34,7 +34,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { consoleLogger } from "../types.js";
-import { PI_AUTH_VARS, PI_ENV_PREFIXES, finishAgentEnv, heldCredentials, parseList, reportWithheldEnv, resolveEnvScope, resolvePiProvider, resolveSandboxMode, scopeAgentEnv, withPushBlocked, mcpWithheld, } from "../agent-env.js";
+import { PI_AUTH_VARS, PI_ENV_PREFIXES, PI_NON_SECRET_VARS, agentEnvOverlay, applyEnvOverlay, overlaidProcessEnv, resolveExecutable, finishAgentEnv, heldCredentials, parseList, reportWithheldEnv, resolveEnvScope, resolvePiProvider, resolveSandboxMode, scopeAgentEnv, withPushBlocked, mcpWithheld, } from "../agent-env.js";
 import { PI_CAPABILITIES } from "./capabilities.js";
 import { policyGate, resolveHarnessPolicy } from "./policy.js";
 import { gitCredentialPolicy } from "../git-credentials.js";
@@ -45,6 +45,8 @@ import { startToolBridge } from "./tool-bridge/server.js";
 import { defaultSandboxWrapper, prepareAgentSpawn, wrappersFrom, } from "./sandbox-wrapper.js";
 import { TOKEN_ENV } from "./tool-bridge/protocol.js";
 export { PI_CAPABILITIES };
+/** The provider secrets an `env` overlay replaces as a set ({@link applyEnvOverlay}); region and project settings are not among them. */
+const PI_CREDENTIAL_VARS = PI_AUTH_VARS.filter((v) => !PI_NON_SECRET_VARS.has(v));
 /**
  * Oldest pi this adapter is written against. The docs and source were read at
  * v0.99.2; older releases are unverified, so they are refused.
@@ -323,10 +325,12 @@ export class PiHarness {
     defaultMcpServers;
     envPassthrough;
     envScope;
+    envOverlay;
     sandboxMode;
     sandboxWrapper;
     policyMode;
     piCommand;
+    resolvedCommand;
     modelsFile;
     toolBridgeShim;
     abortGraceMs;
@@ -346,6 +350,7 @@ export class PiHarness {
         this.defaultMcpServers = opts.defaultMcpServers ?? {};
         this.envPassthrough = opts.envPassthrough;
         this.envScope = opts.envScope;
+        this.envOverlay = agentEnvOverlay(opts);
         this.sandboxMode = opts.sandbox;
         this.sandboxWrapper = opts.sandboxWrapper;
         this.policyMode = opts.policy ?? resolveHarnessPolicy(process.env, undefined, this.logger);
@@ -359,11 +364,19 @@ export class PiHarness {
     info() {
         return { id: this.id, version: this.version };
     }
+    /** The pi executable to spawn: the one the version check resolved and ran. */
+    cliPath() {
+        return this.resolvedCommand ?? this.piCommand.command;
+    }
     /** `pi --version`, checked against {@link MIN_PI_VERSION}. Cached per instance. */
     preflight() {
         this.preflightResult ??= new Promise((resolve) => {
             const { command, args } = this.piCommand;
-            execFile(command, [...args, "--version"], { timeout: 30_000 }, (err, stdout, stderr) => {
+            // Probe the file the spawn will run: resolved on the run's PATH and cwd, then reused at spawn.
+            const hostEnv = overlaidProcessEnv(this.envOverlay, PI_CREDENTIAL_VARS);
+            this.resolvedCommand = resolveExecutable(command, hostEnv, this.cwd);
+            const opts = { timeout: 30_000, cwd: this.cwd, env: hostEnv };
+            execFile(this.resolvedCommand ?? command, [...args, "--version"], opts, (err, stdout, stderr) => {
                 if (err) {
                     const code = err.code;
                     resolve({
@@ -390,16 +403,18 @@ export class PiHarness {
         });
         return this.preflightResult;
     }
-    /** Which provider's credential this call gets ({@link resolvePiProvider}). */
+    /** Which provider's credential this call gets ({@link resolvePiProvider}), over the env with the overlay applied. */
     resolveProvider(model) {
-        return resolvePiProvider(process.env, model, this.provider);
+        return resolvePiProvider(overlaidProcessEnv(this.envOverlay, PI_CREDENTIAL_VARS), model, this.provider);
     }
     /**
      * Env for the pi process: scoped like Claude Code's, with ONE provider's
      * credentials instead of Anthropic's (`providerVars`, from
      * {@link resolvePiProvider}). Every other provider key is dropped, scoped or
-     * not, since pi's bash tool inherits this env. Skill credentials are dropped
-     * too ({@link finishAgentEnv}) unless the node granted them with `agent_env`.
+     * not, since pi's bash tool inherits this env. The caller's `envRemove` /
+     * `env` are applied after scoping ({@link applyEnvOverlay}), so the same rules
+     * hold for overlaid names. Skill credentials are dropped too, overlaid ones
+     * included ({@link finishAgentEnv}), unless the node granted them with `agent_env`.
      */
     buildEnv(access, providerVars) {
         const full = Object.fromEntries(Object.entries(process.env).filter((e) => e[1] != null));
@@ -416,6 +431,7 @@ export class PiHarness {
             reportWithheldEnv(scoped.withheld, this.logger);
             env = scoped.env;
         }
+        env = applyEnvOverlay(env, this.envOverlay, PI_CREDENTIAL_VARS);
         // Other providers' keys never reach pi, even when scoping is off, passed through or granted.
         const otherProviders = PI_AUTH_VARS.filter((v) => !providerVars.includes(v));
         env = Object.fromEntries(Object.entries(env).filter(([k]) => !otherProviders.includes(k)));
@@ -860,7 +876,7 @@ export class PiHarness {
             const prep = await prepareAgentSpawn({
                 caps: this.capabilities,
                 policy,
-                spawn: { command: this.piCommand.command, args, env, cwd: this.cwd },
+                spawn: { command: this.cliPath(), args, env, cwd: this.cwd },
                 wrapper: wrapper ?? null,
                 harnessEgress,
                 env: process.env,
@@ -979,7 +995,7 @@ export class PiHarness {
             const env = { ...this.buildEnv(undefined, provider.vars), PI_CODING_AGENT_DIR: agentDir };
             const out = await this.exec({
                 spawn: {
-                    command: this.piCommand.command,
+                    command: this.cliPath(),
                     args: [...this.baseArgs(model, false, provider.explicit ? provider.provider : undefined), "--no-tools"],
                     env,
                     cwd: this.cwd,

package/dist/harness/sandbox-wrapper.d.ts

@@ -107,11 +107,22 @@ export interface SrtSettings {
  * each with an optional `:port`. Dropping an entry only narrows egress.
  */
 export declare function isSrtDomainPattern(entry: string): boolean;
+/**
+ * Credential files an agent env points at outside `credentialHome`: the
+ * {@link CREDENTIAL_PATHS} under its `HOME` when that is another directory (a
+ * harness `env` overlay), `$CLAUDE_CONFIG_DIR/.credentials.json` and
+ * `$CODEX_HOME/auth.json`. A relative value resolves against the agent's
+ * `cwd`, where the agent would resolve it, never sweny's. Absolute paths.
+ */
+export declare function envCredentialPaths(env: Record<string, string> | undefined, credentialHome: string, cwd: string): string[];
 /**
  * The srt settings for one wrapped spawn. Pure apart from `exists`.
- * `credentialHome` is the operator's real HOME (not the scratch HOME).
+ * `credentialHome` is the operator's real HOME (not the scratch HOME); the
+ * login files `req.env` selects elsewhere are denied too ({@link envCredentialPaths}).
  */
-export declare function buildSrtSettings(req: Pick<SandboxWrapRequest, "cwd" | "egress" | "readOnly" | "denyRead">, opts: {
+export declare function buildSrtSettings(req: Pick<SandboxWrapRequest, "cwd" | "egress" | "readOnly" | "denyRead"> & {
+    env?: Record<string, string>;
+}, opts: {
     home: string;
     credentialHome: string;
     exists?: (p: string) => boolean;

package/dist/harness/sandbox-wrapper.js

@@ -116,16 +116,41 @@ function real(p) {
         return p;
     }
 }
+/**
+ * Credential files an agent env points at outside `credentialHome`: the
+ * {@link CREDENTIAL_PATHS} under its `HOME` when that is another directory (a
+ * harness `env` overlay), `$CLAUDE_CONFIG_DIR/.credentials.json` and
+ * `$CODEX_HOME/auth.json`. A relative value resolves against the agent's
+ * `cwd`, where the agent would resolve it, never sweny's. Absolute paths.
+ */
+export function envCredentialPaths(env, credentialHome, cwd) {
+    if (!env)
+        return [];
+    const at = (dir, ...rest) => path.resolve(cwd, dir, ...rest);
+    const out = [];
+    if (env.HOME && at(env.HOME) !== path.resolve(credentialHome)) {
+        out.push(...CREDENTIAL_PATHS.map((rel) => at(env.HOME, rel)));
+    }
+    if (env.CLAUDE_CONFIG_DIR)
+        out.push(at(env.CLAUDE_CONFIG_DIR, ".credentials.json"));
+    if (env.CODEX_HOME)
+        out.push(at(env.CODEX_HOME, "auth.json"));
+    return out;
+}
 /**
  * The srt settings for one wrapped spawn. Pure apart from `exists`.
- * `credentialHome` is the operator's real HOME (not the scratch HOME).
+ * `credentialHome` is the operator's real HOME (not the scratch HOME); the
+ * login files `req.env` selects elsewhere are denied too ({@link envCredentialPaths}).
  */
 export function buildSrtSettings(req, opts) {
     const exists = opts.exists ?? existsSync;
     const allowedDomains = [...new Set(req.egress.map((d) => d.trim()).filter(isSrtDomainPattern))];
-    const denyRead = (opts.credentialPaths ?? CREDENTIAL_PATHS)
-        .map((rel) => (path.isAbsolute(rel) ? rel : path.join(opts.credentialHome, rel)))
-        .filter((p) => exists(p));
+    const denyRead = [
+        ...new Set([
+            ...(opts.credentialPaths ?? CREDENTIAL_PATHS).map((rel) => path.isAbsolute(rel) ? rel : path.join(opts.credentialHome, rel)),
+            ...envCredentialPaths(req.env, opts.credentialHome, req.cwd),
+        ]),
+    ].filter((p) => exists(p));
     // Deny the parent, not a snapshot of sibling homes: later-created runs
     // must stay hidden too. srt allowRead carves out only our own HOME.
     if (opts.isolationRoot)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sweny-ai/core",
-  "version": "0.1.198",
+  "version": "0.1.199",
   "type": "module",
   "bin": {
     "sweny": "./dist/cli/main.js"