@sweny-ai/core 0.1.198 → 0.1.200

package/dist/harness/claude-code.d.ts

@@ -8,8 +8,8 @@
  * This is the ONLY supported LLM backend. The whole point of sweny
  * is to use headless Claude Code - never the raw Anthropic API.
  */
-import type { Claude, Tool, ToolContext, Logger, McpServerConfig } from "../types.js";
-import { type SandboxMode } from "../agent-env.js";
+import type { Claude, Tool, ToolContext, NodeUsage, Logger, McpServerConfig } from "../types.js";
+import { type HarnessEnvOptions, type SandboxMode } from "../agent-env.js";
 import type { AgentHarness, HarnessCapabilities, HarnessCompleteRequest, HarnessInfo, HarnessRunRequest, HarnessRunResult, NodePolicy, ToolClass } from "./types.js";
 import { type HarnessPolicyMode } from "./policy.js";
 import { CLAUDE_CODE_CAPABILITIES } from "./capabilities.js";
@@ -108,7 +108,7 @@ export interface ResolveAuthEnvOpts {
  * Pure: returns a copy, never mutates the input.
  */
 export declare function resolveAuthEnv(env: Record<string, string>, opts?: ResolveAuthEnvOpts): Record<string, string>;
-export interface ClaudeCodeHarnessOptions {
+export interface ClaudeCodeHarnessOptions extends HarnessEnvOptions {
     /** Model override */
     model?: string;
     /** Max turns for tool use loop (default: 20) */
@@ -144,7 +144,7 @@ export interface ClaudeCodeHarnessOptions {
     sandboxAllowedDomains?: string[];
     /** Sandbox preflight probe (test seam). Returns a reason when the sandbox cannot run. */
     sandboxProbe?: () => string | undefined;
-    /** Login probe for `preflight()` (test seam). Default: {@link claudeCodeAuth} over `process.env`. */
+    /** Login probe for `preflight()` (test seam). Default: {@link claudeCodeAuth} over `process.env` with `env` / `envRemove` applied. */
     authProbe?: AuthProbe;
     /**
      * Serve skill tools through the SwenyToolBridge (a stdio MCP shim over a
@@ -184,6 +184,7 @@ export declare class ClaudeCodeHarness implements Claude, AgentHarness {
     private sandboxProbe;
     private sandboxWarned;
     private envScope;
+    private envOverlay;
     /** Floor facts from the latest runQuery, read by run() for the receipt. */
     private lastPolicyFacts;
     private toolBridge;
@@ -192,15 +193,17 @@ export declare class ClaudeCodeHarness implements Claude, AgentHarness {
     private policyMode;
     constructor(opts?: ClaudeCodeHarnessOptions);
     /**
-     * Build env for the Claude Code subprocess (#360). Applies auth precedence
-     * via {@link resolveAuthEnv} on the full process env (it reads
-     * `SWENY_AUTH`). When env scoping is on (default in CI, see
-     * {@link resolveEnvScope}) the result is narrowed to the allowlist plus
-     * `extraVars` (the node's declared skill env vars) and the operator
-     * passthrough list, and the withheld names (never values) are reported once
-     * per process ({@link reportWithheldEnv}). When off, the full env passes through as before.
-     * Either way, skill credentials are then dropped ({@link finishAgentEnv}):
-     * only the names the node granted with `agent_env` reach the agent.
+     * Build env for the Claude Code subprocess (#360). When env scoping is on
+     * (default in CI, see {@link resolveEnvScope}) the process env is narrowed
+     * to the allowlist plus `extraVars` (the node's declared skill env vars)
+     * and the operator passthrough list, and the withheld names (never values)
+     * are reported once per process ({@link reportWithheldEnv}). When off, the
+     * full env passes through as before. Then the caller's `envRemove` / `env`
+     * ({@link applyEnvOverlay}; overlaid auth replaces the inherited auth), then
+     * auth precedence ({@link resolveAuthEnv}, mode from `process.env.SWENY_AUTH`),
+     * then skill credentials are dropped ({@link finishAgentEnv}), overlaid ones
+     * included: only the names the node granted with `agent_env` reach the agent.
+     * `process.env` is never modified.
      */
     private buildEnv;
     /** Which harness (and SDK version) produced a result. */
@@ -247,6 +250,7 @@ export declare class ClaudeCodeHarness implements Claude, AgentHarness {
         timeoutMs?: number;
         /** Caller-supplied abort signal. Aborting it interrupts the query. */
         signal?: AbortSignal;
+        onUsage?: (usage: NodeUsage) => void;
     }): Promise<string | null>;
     /** Free-text completion. Delegates to core {@link coreAsk} over {@link complete}. */
     ask(opts: {
@@ -257,6 +261,7 @@ export declare class ClaudeCodeHarness implements Claude, AgentHarness {
         timeoutMs?: number;
         /** Caller-supplied abort signal. Aborting it interrupts the query. */
         signal?: AbortSignal;
+        onUsage?: (usage: NodeUsage) => void;
     }): Promise<string>;
 }
 /** @deprecated Use {@link ClaudeCodeHarnessOptions}. */

package/dist/harness/claude-code.js

@@ -12,11 +12,11 @@ import { query, createSdkMcpServer, tool as sdkTool } from "@anthropic-ai/claude
 import { createRequire } from "node:module";
 import { realpathSync } from "node:fs";
 import { consoleLogger } from "../types.js";
-import { AGENT_AUTH_VARS, finishAgentEnv, reportWithheldEnv, parseList, resolveEnvScope, scopeAgentEnv, withPushBlocked, mcpWithheld, resolveAgentSandbox, } from "../agent-env.js";
+import { AGENT_AUTH_VARS, agentEnvOverlay, applyEnvOverlay, finishAgentEnv, overlaidProcessEnv, reportWithheldEnv, parseList, resolveEnvScope, scopeAgentEnv, withPushBlocked, mcpWithheld, resolveAgentSandbox, } from "../agent-env.js";
 import { gitCredentialGap, policyGate } from "./policy.js";
 import { gitCredentialPolicy } from "../git-credentials.js";
 import { CLAUDE_CODE_CAPABILITIES } from "./capabilities.js";
-import { ask as coreAsk, evaluate as coreEvaluate, buildEvaluatePrompt, buildNodePrompt } from "./prompts.js";
+import { ask as coreAsk, evaluate as coreEvaluate, buildEvaluatePrompt, buildNodePrompt, reportCompletionUsage, } from "./prompts.js";
 import { jsonSchemaToZodShape, toolErrorToMcpResult, toolOutputToMcpResult } from "./tool-bridge/protocol.js";
 import { startToolBridge } from "./tool-bridge/server.js";
 import { parseToolResultContent, summarizeToolError, tryParseJSON } from "./parse.js";
@@ -262,6 +262,7 @@ export class ClaudeCodeHarness {
     sandboxProbe;
     sandboxWarned = false;
     envScope;
+    envOverlay;
     /** Floor facts from the latest runQuery, read by run() for the receipt. */
     lastPolicyFacts;
     toolBridge;
@@ -278,35 +279,47 @@ export class ClaudeCodeHarness {
         this.defaultMcpServers = opts.defaultMcpServers ?? {};
         this.envPassthrough = opts.envPassthrough;
         this.envScope = opts.envScope;
+        this.envOverlay = agentEnvOverlay(opts);
         this.sandboxMode = opts.sandbox;
         this.sandboxAllowedDomains = opts.sandboxAllowedDomains;
         this.sandboxProbe = opts.sandboxProbe;
         this.toolBridge = opts.toolBridge ?? process.env.SWENY_TOOL_BRIDGE === "1";
         this.toolBridgeShim = opts.toolBridgeShim;
-        this.authProbe = opts.authProbe ?? (() => claudeCodeAuth(process.env));
+        this.authProbe = opts.authProbe ?? (() => claudeCodeAuth(overlaidProcessEnv(this.envOverlay, AGENT_AUTH_VARS)));
         this.policyMode = opts.policy ?? "warn";
     }
     /**
-     * Build env for the Claude Code subprocess (#360). Applies auth precedence
-     * via {@link resolveAuthEnv} on the full process env (it reads
-     * `SWENY_AUTH`). When env scoping is on (default in CI, see
-     * {@link resolveEnvScope}) the result is narrowed to the allowlist plus
-     * `extraVars` (the node's declared skill env vars) and the operator
-     * passthrough list, and the withheld names (never values) are reported once
-     * per process ({@link reportWithheldEnv}). When off, the full env passes through as before.
-     * Either way, skill credentials are then dropped ({@link finishAgentEnv}):
-     * only the names the node granted with `agent_env` reach the agent.
+     * Build env for the Claude Code subprocess (#360). When env scoping is on
+     * (default in CI, see {@link resolveEnvScope}) the process env is narrowed
+     * to the allowlist plus `extraVars` (the node's declared skill env vars)
+     * and the operator passthrough list, and the withheld names (never values)
+     * are reported once per process ({@link reportWithheldEnv}). When off, the
+     * full env passes through as before. Then the caller's `envRemove` / `env`
+     * ({@link applyEnvOverlay}; overlaid auth replaces the inherited auth), then
+     * auth precedence ({@link resolveAuthEnv}, mode from `process.env.SWENY_AUTH`),
+     * then skill credentials are dropped ({@link finishAgentEnv}), overlaid ones
+     * included: only the names the node granted with `agent_env` reach the agent.
+     * `process.env` is never modified.
      */
     buildEnv(access) {
         const full = Object.fromEntries(Object.entries(process.env).filter((e) => e[1] != null));
-        const authed = resolveAuthEnv(full, { logger: this.logger });
         const passthrough = this.envPassthrough ?? parseList(process.env.SWENY_ENV_PASSTHROUGH);
-        let env = authed;
+        let env = full;
         if (resolveEnvScope(process.env, this.envScope, this.logger)) {
-            const scoped = scopeAgentEnv(authed, { extraVars: access?.envVars ?? [], passthrough, logger: this.logger });
+            const scoped = scopeAgentEnv(full, {
+                extraVars: access?.envVars ?? [],
+                passthrough,
+                // An overlaid CLAUDE_CODE_USE_BEDROCK / _VERTEX decides which cloud vars are kept.
+                routing: this.envOverlay ? overlaidProcessEnv(this.envOverlay, AGENT_AUTH_VARS) : undefined,
+                logger: this.logger,
+            });
             reportWithheldEnv(scoped.withheld, this.logger);
             env = scoped.env;
         }
+        env = applyEnvOverlay(env, this.envOverlay, AGENT_AUTH_VARS);
+        // Scoping keeps every ANTHROPIC_* / CLAUDE_* name, so auth resolves the same after it. The mode
+        // comes from process.env: an overlaid SWENY_AUTH reaches the agent, not sweny ("" reads as auto).
+        env = resolveAuthEnv(env, { mode: (process.env.SWENY_AUTH ?? ""), logger: this.logger });
         return finishAgentEnv(env, { access, keep: AGENT_AUTH_VARS, passthrough, logger: this.logger }).env;
     }
     /** Which harness (and SDK version) produced a result. */
@@ -401,6 +414,9 @@ export class ClaudeCodeHarness {
         // `strict` fails the node here instead.
         const sandbox = resolveAgentSandbox({
             env: process.env,
+            // A `HOME` / `CLAUDE_CONFIG_DIR` overlay selects another login file; deny it too.
+            agentEnv: overlaidProcessEnv(this.envOverlay, AGENT_AUTH_VARS),
+            cwd: this.cwd,
             mode: opts.sandboxMode ?? this.sandboxMode,
             allowedDomains: this.sandboxAllowedDomains,
             nodeDomains: agentAccess?.domains,
@@ -816,6 +832,9 @@ export class ClaudeCodeHarness {
                 if (message.type === "result") {
                     const resultMsg = message;
                     sawResult = true;
+                    // A completion that failed was still billed: report before the outcome.
+                    if (req.onUsage)
+                        reportCompletionUsage(req.onUsage, extractUsage(resultMsg), this.logger);
                     if (resultMsg.subtype === "success" && "result" in resultMsg) {
                         response = resultMsg.result;
                     }

package/dist/harness/codex.d.ts

@@ -24,7 +24,7 @@
  * by `policyGate`. Nothing is dropped silently.
  */
 import type { Logger, McpServerConfig, ToolContext } from "../types.js";
-import { type SandboxMode } from "../agent-env.js";
+import { type HarnessEnvOptions, type SandboxMode } from "../agent-env.js";
 import type { AgentHarness, HarnessCapabilities, HarnessCompleteRequest, HarnessInfo, HarnessRunRequest, HarnessRunResult, ToolClass } from "./types.js";
 import { CODEX_CAPABILITIES } from "./capabilities.js";
 import { type HarnessPolicyMode } from "./policy.js";
@@ -52,7 +52,7 @@ export declare const CODEX_ISOLATION_FEATURES_OFF: readonly ["apps", "plugins",
  * through the sandbox wrapper, plus the host of `OPENAI_BASE_URL` when set.
  */
 export declare function codexBackendHosts(env?: Record<string, string | undefined>): string[];
-export interface CodexHarnessOptions {
+export interface CodexHarnessOptions extends HarnessEnvOptions {
     /** Model override (`--model`). Free text; sweny has no model opinion. */
     model?: string;
     /** Tool-call budget the watchdog enforces when a node sets no `max_turns` (default: 20). */
@@ -97,7 +97,7 @@ export interface CodexHarnessOptions {
     };
     /** Grace period between SIGTERM and SIGKILL when stopping Codex (default: 2000 ms). */
     killGraceMs?: number;
-    /** Login probe for `preflight()` (test seam). Default: {@link codexAuth} over `process.env`. */
+    /** Login probe for `preflight()` (test seam). Default: {@link codexAuth} over `process.env` with `env` / `envRemove` applied. */
     authProbe?: AuthProbe;
 }
 /** A TOML value for `-c key=value`, as the official SDK writes it (sdk/typescript/src/exec.ts). */
@@ -134,6 +134,7 @@ export declare class CodexHarness implements AgentHarness {
     private defaultMcpServers;
     private envPassthrough;
     private envScope;
+    private envOverlay;
     private sandboxMode;
     private sandboxProbe;
     private sandboxWarned;
@@ -141,6 +142,7 @@ export declare class CodexHarness implements AgentHarness {
     private loginWarned;
     private policyMode;
     private codexCommand;
+    private resolvedCommand;
     private toolBridgeShim;
     private killGraceMs;
     private preflightResult;
@@ -159,12 +161,27 @@ export declare class CodexHarness implements AgentHarness {
         ok: false;
         reason: string;
     }>;
+    /**
+     * `process.env` with the caller's `env` / `envRemove` applied, unscoped: where
+     * sweny reads Codex's own settings (`OPENAI_BASE_URL`) and the login probe.
+     * The scoped agent env would drop an inherited base URL.
+     */
+    private hostEnv;
+    /**
+     * {@link hostEnv} as the login probe should see it: an inherited
+     * OPENAI_API_KEY does not count once `envRemove` names CODEX_API_KEY, since
+     * the agent env no longer derives CODEX_API_KEY from it.
+     */
+    private loginEnv;
+    /** The Codex executable to spawn: the one the version check resolved and ran. */
+    private cliPath;
     /** `codex --version`, checked against {@link MIN_CODEX_VERSION}. Cached per instance. */
     private checkCli;
     /**
      * Env for the Codex process: scoped like Claude Code's, with Codex's auth
-     * vars instead of Anthropic's. Skill credentials are dropped either way
-     * ({@link finishAgentEnv}) unless the node granted them with `agent_env`.
+     * vars instead of Anthropic's, then the caller's `envRemove` / `env`
+     * ({@link applyEnvOverlay}). Skill credentials are dropped either way, overlaid
+     * ones included ({@link finishAgentEnv}), unless the node granted them with `agent_env`.
      */
     private buildEnv;
     /** The node policy after `disallowed_tools` names are translated into Codex classes. */

package/dist/harness/codex.js

@@ -28,11 +28,11 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { consoleLogger } from "../types.js";
-import { CODEX_AUTH_VARS, CODEX_ENV_PREFIXES, checkSandboxSupport, finishAgentEnv, heldCredentials, parseList, reportWithheldEnv, resolveCodexAuthEnv, resolveEnvScope, resolveSandboxMode, scopeAgentEnv, withPushBlocked, mcpWithheld, } from "../agent-env.js";
+import { CODEX_AUTH_VARS, CODEX_ENV_PREFIXES, agentEnvOverlay, applyEnvOverlay, checkSandboxSupport, finishAgentEnv, resolveExecutable, overlaidProcessEnv, heldCredentials, parseList, reportWithheldEnv, resolveCodexAuthEnv, resolveEnvScope, resolveSandboxMode, scopeAgentEnv, withPushBlocked, mcpWithheld, } from "../agent-env.js";
 import { CODEX_CAPABILITIES } from "./capabilities.js";
 import { policyGate, resolveHarnessPolicy } from "./policy.js";
 import { gitCredentialPolicy } from "../git-credentials.js";
-import { buildNodePrompt } from "./prompts.js";
+import { buildNodePrompt, reportCompletionUsage } from "./prompts.js";
 import { makeAbort } from "./abort.js";
 import { parseToolResultContent, summarizeToolError, tryParseJSON } from "./parse.js";
 import { startToolBridge } from "./tool-bridge/server.js";
@@ -40,6 +40,13 @@ import { defaultSandboxWrapper, prepareAgentSpawn, wrappersFrom, } from "./sandb
 import { TOKEN_ENV } from "./tool-bridge/protocol.js";
 import { codexAuth } from "./auth.js";
 export { CODEX_CAPABILITIES };
+/**
+ * The credentials an `env` overlay replaces as a set ({@link applyEnvOverlay}):
+ * Codex's API key and access token, and `OPENAI_API_KEY`, which stands in for
+ * `CODEX_API_KEY` ({@link resolveCodexAuthEnv}). `CODEX_HOME` is a location,
+ * not a credential: overlaying it does not drop an inherited key.
+ */
+const CODEX_CREDENTIAL_VARS = ["CODEX_API_KEY", "CODEX_ACCESS_TOKEN", "OPENAI_API_KEY"];
 /** Oldest Codex CLI whose flags this adapter uses (`--ignore-user-config`, `--ignore-rules`). */
 export const MIN_CODEX_VERSION = "0.159.0";
 /**
@@ -286,6 +293,7 @@ export class CodexHarness {
     defaultMcpServers;
     envPassthrough;
     envScope;
+    envOverlay;
     sandboxMode;
     sandboxProbe;
     sandboxWarned = false;
@@ -293,6 +301,7 @@ export class CodexHarness {
     loginWarned = false;
     policyMode;
     codexCommand;
+    resolvedCommand;
     toolBridgeShim;
     killGraceMs;
     preflightResult;
@@ -308,6 +317,7 @@ export class CodexHarness {
         this.defaultMcpServers = opts.defaultMcpServers ?? {};
         this.envPassthrough = opts.envPassthrough;
         this.envScope = opts.envScope;
+        this.envOverlay = agentEnvOverlay(opts);
         this.sandboxMode = opts.sandbox;
         this.sandboxProbe = opts.sandboxProbe;
         this.sandboxWrapper = opts.sandboxWrapper;
@@ -315,7 +325,7 @@ export class CodexHarness {
         this.codexCommand = opts.codexCommand ?? { command: process.env.SWENY_CODEX_PATH || "codex", args: [] };
         this.toolBridgeShim = opts.toolBridgeShim;
         this.killGraceMs = opts.killGraceMs ?? 2000;
-        this.authProbe = opts.authProbe ?? (() => codexAuth(process.env));
+        this.authProbe = opts.authProbe ?? (() => codexAuth(this.loginEnv()));
     }
     info() {
         return { id: this.id, version: this.version };
@@ -331,11 +341,40 @@ export class CodexHarness {
         const auth = this.authProbe();
         return auth.ok ? cli : { ok: false, reason: auth.reason };
     }
+    /**
+     * `process.env` with the caller's `env` / `envRemove` applied, unscoped: where
+     * sweny reads Codex's own settings (`OPENAI_BASE_URL`) and the login probe.
+     * The scoped agent env would drop an inherited base URL.
+     */
+    hostEnv() {
+        return overlaidProcessEnv(this.envOverlay, CODEX_CREDENTIAL_VARS);
+    }
+    /**
+     * {@link hostEnv} as the login probe should see it: an inherited
+     * OPENAI_API_KEY does not count once `envRemove` names CODEX_API_KEY, since
+     * the agent env no longer derives CODEX_API_KEY from it.
+     */
+    loginEnv() {
+        const env = this.hostEnv();
+        const overlay = this.envOverlay;
+        if (overlay?.remove.includes("CODEX_API_KEY") && !Object.hasOwn(overlay.env, "OPENAI_API_KEY")) {
+            delete env.OPENAI_API_KEY;
+        }
+        return env;
+    }
+    /** The Codex executable to spawn: the one the version check resolved and ran. */
+    cliPath() {
+        return this.resolvedCommand ?? this.codexCommand.command;
+    }
     /** `codex --version`, checked against {@link MIN_CODEX_VERSION}. Cached per instance. */
     checkCli() {
         this.preflightResult ??= new Promise((resolve) => {
             const { command, args } = this.codexCommand;
-            execFile(command, [...args, "--version"], { timeout: 30_000 }, (err, stdout) => {
+            // Probe the file the spawn will run: resolved on the run's PATH and cwd, then reused at spawn.
+            const hostEnv = this.hostEnv();
+            this.resolvedCommand = resolveExecutable(command, hostEnv, this.cwd);
+            const opts = { timeout: 30_000, cwd: this.cwd, env: hostEnv };
+            execFile(this.resolvedCommand ?? command, [...args, "--version"], opts, (err, stdout) => {
                 if (err) {
                     const code = err.code;
                     resolve({
@@ -370,11 +409,16 @@ export class CodexHarness {
     }
     /**
      * Env for the Codex process: scoped like Claude Code's, with Codex's auth
-     * vars instead of Anthropic's. Skill credentials are dropped either way
-     * ({@link finishAgentEnv}) unless the node granted them with `agent_env`.
+     * vars instead of Anthropic's, then the caller's `envRemove` / `env`
+     * ({@link applyEnvOverlay}). Skill credentials are dropped either way, overlaid
+     * ones included ({@link finishAgentEnv}), unless the node granted them with `agent_env`.
      */
     buildEnv(access) {
-        const full = Object.fromEntries(Object.entries(process.env).filter((e) => e[1] != null));
+        const overlay = this.envOverlay;
+        const removed = new Set(overlay?.remove ?? []);
+        // `envRemove` goes first, before the OPENAI_API_KEY alias, so a removed OPENAI_API_KEY is not
+        // copied; a removed CODEX_API_KEY made by the alias is dropped again with the overlay below.
+        const full = Object.fromEntries(Object.entries(process.env).filter((e) => e[1] != null && !removed.has(e[0])));
         const authed = resolveCodexAuthEnv(full);
         const passthrough = this.envPassthrough ?? parseList(process.env.SWENY_ENV_PASSTHROUGH);
         let env = authed;
@@ -389,6 +433,16 @@ export class CodexHarness {
             reportWithheldEnv(scoped.withheld, this.logger);
             env = scoped.env;
         }
+        if (overlay) {
+            env = applyEnvOverlay(env, overlay, CODEX_CREDENTIAL_VARS);
+            if (CODEX_CREDENTIAL_VARS.some((c) => Object.hasOwn(overlay.env, c))) {
+                // An overlaid OPENAI_API_KEY stands in for CODEX_API_KEY like an inherited one, and is then
+                // dropped, as scoping drops an inherited one: Codex reads only CODEX_API_KEY.
+                if (!env.CODEX_API_KEY && overlay.env.OPENAI_API_KEY)
+                    env.CODEX_API_KEY = overlay.env.OPENAI_API_KEY;
+                delete env.OPENAI_API_KEY;
+            }
+        }
         return finishAgentEnv(env, { access, keep: CODEX_AUTH_VARS, passthrough, logger: this.logger }).env;
     }
     /** The node policy after `disallowed_tools` names are translated into Codex classes. */
@@ -466,7 +520,7 @@ export class CodexHarness {
         if (opts.sandbox === "workspace-write") {
             args.push(...cfg("sandbox_workspace_write.network_access", opts.network));
         }
-        const baseUrl = process.env.OPENAI_BASE_URL;
+        const baseUrl = this.hostEnv().OPENAI_BASE_URL;
         if (baseUrl)
             args.push(...cfg("openai_base_url", baseUrl));
         return args;
@@ -866,9 +920,9 @@ export class CodexHarness {
                 const prep = await prepareAgentSpawn({
                     caps: this.capabilities,
                     policy,
-                    spawn: { command: this.codexCommand.command, args: argsFor(withSchema), env, cwd: this.cwd },
+                    spawn: { command: this.cliPath(), args: argsFor(withSchema), env, cwd: this.cwd },
                     wrapper: wrapper ?? null,
-                    harnessEgress: codexBackendHosts(),
+                    harnessEgress: codexBackendHosts(this.hostEnv()),
                     env: process.env,
                 });
                 degraded = prep.degraded;
@@ -994,13 +1048,15 @@ export class CodexHarness {
             "-",
         ];
         const out = await this.exec({
-            spawn: { command: this.codexCommand.command, args, env: this.buildEnv(), cwd: this.cwd },
+            spawn: { command: this.cliPath(), args, env: this.buildEnv(), cwd: this.cwd },
             prompt: req.prompt,
             timeoutMs: req.timeoutMs,
             signal: req.signal,
             // Classification calls use no tools; any tool call is over budget.
             maxToolCalls: 0,
         });
+        // A completion that failed was still billed: report before the outcome.
+        reportCompletionUsage(req.onUsage, out.usage, this.logger);
         if (out.spawnError)
             return failClosed(`codex could not start: ${out.spawnError}`);
         if (out.abortReason === "timeout")

package/dist/harness/compat.js

@@ -35,6 +35,7 @@ export function claudeCompat(claude) {
                 model: req.model,
                 timeoutMs: req.timeoutMs,
                 signal: req.signal,
+                ...(req.onUsage ? { onUsage: req.onUsage } : {}),
             });
         },
     };

package/dist/harness/index.d.ts

@@ -10,7 +10,7 @@ export { claudeCompat, asClaude } from "./compat.js";
 export type { AgentHarness, HarnessCapabilities, HarnessCompleteRequest, HarnessId, HarnessInfo, HarnessRunRequest, HarnessRunResult, NodePolicy, PolicyGateResult, PolicyWrappers, ToolClass, } from "./types.js";
 export { policyGate, budgetGate, nativeDenyClasses, resolveHarnessPolicy, isToolClass, TOOL_CLASSES, } from "./policy.js";
 export type { HarnessPolicyMode } from "./policy.js";
-export { ask, evaluate, buildAskPrompt, buildEvaluatePrompt } from "./prompts.js";
+export { ask, evaluate, buildAskPrompt, buildEvaluatePrompt, reportCompletionUsage } from "./prompts.js";
 export { ClaudeCodeHarness, CLAUDE_CODE_CAPABILITIES } from "./claude-code.js";
 export type { ClaudeCodeHarnessOptions } from "./claude-code.js";
 export { CodexHarness, CODEX_CAPABILITIES, MIN_CODEX_VERSION } from "./codex.js";

package/dist/harness/index.js

@@ -9,7 +9,7 @@ import { PiHarness } from "./pi.js";
 import { parseAcpAgent, unsupportedAgentError } from "./agents.js";
 export { claudeCompat, asClaude } from "./compat.js";
 export { policyGate, budgetGate, nativeDenyClasses, resolveHarnessPolicy, isToolClass, TOOL_CLASSES, } from "./policy.js";
-export { ask, evaluate, buildAskPrompt, buildEvaluatePrompt } from "./prompts.js";
+export { ask, evaluate, buildAskPrompt, buildEvaluatePrompt, reportCompletionUsage } from "./prompts.js";
 export { ClaudeCodeHarness, CLAUDE_CODE_CAPABILITIES } from "./claude-code.js";
 export { CodexHarness, CODEX_CAPABILITIES, MIN_CODEX_VERSION } from "./codex.js";
 export { AcpHarness, ACP_CAPABILITIES, ACP_PROTOCOL_VERSION } from "./acp.js";

package/dist/harness/pi.d.ts

@@ -29,7 +29,7 @@
  * `policyGate`. Nothing is dropped silently.
  */
 import type { Logger, McpServerConfig, NodeUsage, ToolContext, Tool } from "../types.js";
-import { type SandboxMode } from "../agent-env.js";
+import { type HarnessEnvOptions, type SandboxMode } from "../agent-env.js";
 import type { AgentHarness, HarnessCapabilities, HarnessCompleteRequest, HarnessInfo, HarnessRunRequest, HarnessRunResult, ToolClass } from "./types.js";
 import { PI_CAPABILITIES } from "./capabilities.js";
 import { type HarnessPolicyMode } from "./policy.js";
@@ -49,7 +49,7 @@ export declare const PI_BRIDGE_SERVER = "sweny-core";
  * providers) are added with `SWENY_SANDBOX_ALLOWED_DOMAINS`.
  */
 export declare function piBackendHosts(env?: Record<string, string | undefined>, model?: string): string[];
-export interface PiHarnessOptions {
+export interface PiHarnessOptions extends HarnessEnvOptions {
     /** Model passed to `--model`. Free text (`provider/id`, `id:thinking`); sweny has no model opinion. */
     model?: string;
     /**
@@ -160,10 +160,12 @@ export declare class PiHarness implements AgentHarness {
     private defaultMcpServers;
     private envPassthrough;
     private envScope;
+    private envOverlay;
     private sandboxMode;
     private sandboxWrapper;
     private policyMode;
     private piCommand;
+    private resolvedCommand;
     private modelsFile;
     private toolBridgeShim;
     private abortGraceMs;
@@ -174,6 +176,8 @@ export declare class PiHarness implements AgentHarness {
     private version;
     constructor(opts?: PiHarnessOptions);
     info(): HarnessInfo;
+    /** The pi executable to spawn: the one the version check resolved and ran. */
+    private cliPath;
     /** `pi --version`, checked against {@link MIN_PI_VERSION}. Cached per instance. */
     preflight(): Promise<{
         ok: true;
@@ -182,14 +186,16 @@ export declare class PiHarness implements AgentHarness {
         ok: false;
         reason: string;
     }>;
-    /** Which provider's credential this call gets ({@link resolvePiProvider}). */
+    /** Which provider's credential this call gets ({@link resolvePiProvider}), over the env with the overlay applied. */
     private resolveProvider;
     /**
      * Env for the pi process: scoped like Claude Code's, with ONE provider's
      * credentials instead of Anthropic's (`providerVars`, from
      * {@link resolvePiProvider}). Every other provider key is dropped, scoped or
-     * not, since pi's bash tool inherits this env. Skill credentials are dropped
-     * too ({@link finishAgentEnv}) unless the node granted them with `agent_env`.
+     * not, since pi's bash tool inherits this env. The caller's `envRemove` /
+     * `env` are applied after scoping ({@link applyEnvOverlay}), so the same rules
+     * hold for overlaid names. Skill credentials are dropped too, overlaid ones
+     * included ({@link finishAgentEnv}), unless the node granted them with `agent_env`.
      */
     private buildEnv;
     /** The node policy after `disallowed_tools` names are translated into pi classes. */

package/dist/harness/pi.js

@@ -34,17 +34,19 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { consoleLogger } from "../types.js";
-import { PI_AUTH_VARS, PI_ENV_PREFIXES, finishAgentEnv, heldCredentials, parseList, reportWithheldEnv, resolveEnvScope, resolvePiProvider, resolveSandboxMode, scopeAgentEnv, withPushBlocked, mcpWithheld, } from "../agent-env.js";
+import { PI_AUTH_VARS, PI_ENV_PREFIXES, PI_NON_SECRET_VARS, agentEnvOverlay, applyEnvOverlay, overlaidProcessEnv, resolveExecutable, finishAgentEnv, heldCredentials, parseList, reportWithheldEnv, resolveEnvScope, resolvePiProvider, resolveSandboxMode, scopeAgentEnv, withPushBlocked, mcpWithheld, } from "../agent-env.js";
 import { PI_CAPABILITIES } from "./capabilities.js";
 import { policyGate, resolveHarnessPolicy } from "./policy.js";
 import { gitCredentialPolicy } from "../git-credentials.js";
-import { buildNodePrompt } from "./prompts.js";
+import { buildNodePrompt, reportCompletionUsage } from "./prompts.js";
 import { makeAbort } from "./abort.js";
 import { parseToolResultContent, summarizeToolError, tryParseJSON } from "./parse.js";
 import { startToolBridge } from "./tool-bridge/server.js";
 import { defaultSandboxWrapper, prepareAgentSpawn, wrappersFrom, } from "./sandbox-wrapper.js";
 import { TOKEN_ENV } from "./tool-bridge/protocol.js";
 export { PI_CAPABILITIES };
+/** The provider secrets an `env` overlay replaces as a set ({@link applyEnvOverlay}); region and project settings are not among them. */
+const PI_CREDENTIAL_VARS = PI_AUTH_VARS.filter((v) => !PI_NON_SECRET_VARS.has(v));
 /**
  * Oldest pi this adapter is written against. The docs and source were read at
  * v0.99.2; older releases are unverified, so they are refused.
@@ -323,10 +325,12 @@ export class PiHarness {
     defaultMcpServers;
     envPassthrough;
     envScope;
+    envOverlay;
     sandboxMode;
     sandboxWrapper;
     policyMode;
     piCommand;
+    resolvedCommand;
     modelsFile;
     toolBridgeShim;
     abortGraceMs;
@@ -346,6 +350,7 @@ export class PiHarness {
         this.defaultMcpServers = opts.defaultMcpServers ?? {};
         this.envPassthrough = opts.envPassthrough;
         this.envScope = opts.envScope;
+        this.envOverlay = agentEnvOverlay(opts);
         this.sandboxMode = opts.sandbox;
         this.sandboxWrapper = opts.sandboxWrapper;
         this.policyMode = opts.policy ?? resolveHarnessPolicy(process.env, undefined, this.logger);
@@ -359,11 +364,19 @@ export class PiHarness {
     info() {
         return { id: this.id, version: this.version };
     }
+    /** The pi executable to spawn: the one the version check resolved and ran. */
+    cliPath() {
+        return this.resolvedCommand ?? this.piCommand.command;
+    }
     /** `pi --version`, checked against {@link MIN_PI_VERSION}. Cached per instance. */
     preflight() {
         this.preflightResult ??= new Promise((resolve) => {
             const { command, args } = this.piCommand;
-            execFile(command, [...args, "--version"], { timeout: 30_000 }, (err, stdout, stderr) => {
+            // Probe the file the spawn will run: resolved on the run's PATH and cwd, then reused at spawn.
+            const hostEnv = overlaidProcessEnv(this.envOverlay, PI_CREDENTIAL_VARS);
+            this.resolvedCommand = resolveExecutable(command, hostEnv, this.cwd);
+            const opts = { timeout: 30_000, cwd: this.cwd, env: hostEnv };
+            execFile(this.resolvedCommand ?? command, [...args, "--version"], opts, (err, stdout, stderr) => {
                 if (err) {
                     const code = err.code;
                     resolve({
@@ -390,16 +403,18 @@ export class PiHarness {
         });
         return this.preflightResult;
     }
-    /** Which provider's credential this call gets ({@link resolvePiProvider}). */
+    /** Which provider's credential this call gets ({@link resolvePiProvider}), over the env with the overlay applied. */
     resolveProvider(model) {
-        return resolvePiProvider(process.env, model, this.provider);
+        return resolvePiProvider(overlaidProcessEnv(this.envOverlay, PI_CREDENTIAL_VARS), model, this.provider);
     }
     /**
      * Env for the pi process: scoped like Claude Code's, with ONE provider's
      * credentials instead of Anthropic's (`providerVars`, from
      * {@link resolvePiProvider}). Every other provider key is dropped, scoped or
-     * not, since pi's bash tool inherits this env. Skill credentials are dropped
-     * too ({@link finishAgentEnv}) unless the node granted them with `agent_env`.
+     * not, since pi's bash tool inherits this env. The caller's `envRemove` /
+     * `env` are applied after scoping ({@link applyEnvOverlay}), so the same rules
+     * hold for overlaid names. Skill credentials are dropped too, overlaid ones
+     * included ({@link finishAgentEnv}), unless the node granted them with `agent_env`.
      */
     buildEnv(access, providerVars) {
         const full = Object.fromEntries(Object.entries(process.env).filter((e) => e[1] != null));
@@ -416,6 +431,7 @@ export class PiHarness {
             reportWithheldEnv(scoped.withheld, this.logger);
             env = scoped.env;
         }
+        env = applyEnvOverlay(env, this.envOverlay, PI_CREDENTIAL_VARS);
         // Other providers' keys never reach pi, even when scoping is off, passed through or granted.
         const otherProviders = PI_AUTH_VARS.filter((v) => !providerVars.includes(v));
         env = Object.fromEntries(Object.entries(env).filter(([k]) => !otherProviders.includes(k)));
@@ -860,7 +876,7 @@ export class PiHarness {
             const prep = await prepareAgentSpawn({
                 caps: this.capabilities,
                 policy,
-                spawn: { command: this.piCommand.command, args, env, cwd: this.cwd },
+                spawn: { command: this.cliPath(), args, env, cwd: this.cwd },
                 wrapper: wrapper ?? null,
                 harnessEgress,
                 env: process.env,
@@ -979,7 +995,7 @@ export class PiHarness {
             const env = { ...this.buildEnv(undefined, provider.vars), PI_CODING_AGENT_DIR: agentDir };
             const out = await this.exec({
                 spawn: {
-                    command: this.piCommand.command,
+                    command: this.cliPath(),
                     args: [...this.baseArgs(model, false, provider.explicit ? provider.provider : undefined), "--no-tools"],
                     env,
                     cwd: this.cwd,
@@ -990,6 +1006,8 @@ export class PiHarness {
                 // Classification calls use no tools; any tool call is over budget.
                 maxToolCalls: 0,
             });
+            // A completion that failed was still billed: report before the outcome.
+            reportCompletionUsage(req.onUsage, out.usage, this.logger);
             if (out.spawnError)
                 return failClosed(`pi could not start: ${out.spawnError}`);
             if (out.abortReason === "timeout")