@yanlinglabs/winter-runtime-sdk 0.0.2 → 0.0.4

package/dist/index-294jzb3e.js

@@ -0,0 +1,1434 @@
+// src/errors.ts
+class RuntimeSdkError extends Error {
+  constructor(message, options) {
+    super(message, options);
+    this.name = new.target.name;
+    const capture = Error.captureStackTrace;
+    if (typeof capture === "function")
+      capture(this, new.target);
+  }
+}
+
+class RuntimeHandoffRequiredError extends RuntimeSdkError {
+  from;
+  to;
+  address;
+  constructor(args) {
+    super(`winter-runtime-sdk: ${args.address} is persisted on the ${args.from} runtime and this query asks for ${args.to}. A runtime change mid-session is \`sdk.handoff(session, "${args.to}")\` — WS-05 §12's certified transfer — or a visible fork (\`forkSession\`); serving the new runtime on the old transcript would be the silent rewrite D13 forbids`);
+    this.from = args.from;
+    this.to = args.to;
+    this.address = args.address;
+  }
+}
+
+class RuntimeLaunchInputError extends RuntimeSdkError {
+  field;
+  constructor(args) {
+    super(`winter-runtime-sdk: ${args.leg === undefined ? "" : `the ${args.leg} leg: `}\`${args.field}\` — ${args.reason}`);
+    this.field = args.field;
+  }
+}
+
+class UnaddressableEntryError extends RuntimeSdkError {
+  address;
+  constructor(address) {
+    super(`winter-runtime-sdk: ${JSON.stringify(address)} is not a canonical runtime address, so a directory row under it would be listed to the model by ListAgents and refused by every resolution door (WS-15 §6.1). Build it with serializeRuntimeAddress(buildSessionAddress(<winter session id>)) — the canonical forms are "session:<id>" and "agent:<parent>:<child>"`);
+    this.address = address;
+  }
+}
+
+class RuntimeSdkVersionError extends RuntimeSdkError {
+  expected;
+  actual;
+  constructor(args) {
+    super(args.message ?? `winter-runtime-sdk: version matrix refuses this peer set — expected ${args.expected}, got ${args.actual}`);
+    this.expected = args.expected;
+    this.actual = args.actual;
+  }
+}
+
+class NotImplementedYet extends RuntimeSdkError {
+  lane;
+  seam;
+  constructor(lane, seam) {
+    super(`winter-runtime-sdk: ${seam} is not implemented yet — Phase 7b ${lane} owns it (the spine ships the signature, not the behaviour)`);
+    this.lane = lane;
+    this.seam = seam;
+  }
+}
+
+class RuntimeSdkDisposedError extends RuntimeSdkError {
+  constructor(method) {
+    super(`winter-runtime-sdk: ${method}() was called after dispose()`);
+  }
+}
+
+// src/official/branding.ts
+function officialBranchLabel(brand) {
+  return `${brand.processLabel}-claude-agent`;
+}
+var OFFICIAL_DISCLOSURES = [
+  {
+    id: "signed-binary-identity",
+    literal: "com.anthropic.claude-code",
+    where: "the code signature of the runtime binary, in process viewers, crash reports and signing displays",
+    why: "the binary is never patched, re-signed, or misrepresented as ours — the D12 process label is cosmetic and this is the identity underneath it"
+  },
+  {
+    id: "spool-config-file",
+    literal: ".claude.json",
+    where: "inside the spool root (CLAUDE_CONFIG_DIR relocates the root; the basename stays literal)",
+    why: "the runtime's own config file name; the supported control is the ROOT, not the basename"
+  },
+  {
+    id: "nested-engine-temp",
+    literal: "claude-<uid>",
+    where: "a subdirectory the engine appends under the configured shared temp root",
+    why: "the runtime computes it itself; symlink tricks are rejected by the runtime and forbidden"
+  },
+  {
+    id: "resume-staging",
+    literal: "claude-resume-<uuid>",
+    where: "the OS temp directory, for a generation resumed out of the shared session store",
+    why: "the prefix is fixed by the runtime; only the temp BASE is host-controllable, and only through the SDK parent's own process environment"
+  },
+  {
+    id: "vendor-telemetry-defaults",
+    literal: "the runtime's own telemetry defaults",
+    where: "inside the child, because §3's allowlist injects no telemetry variable unless the deployment configures one",
+    why: "a disable switch is a proxy/telemetry variable like any other and §3 admits none by default, so the vendor's own defaults apply — disclosed rather than silently assumed off (review r1, n2)"
+  },
+  {
+    id: "extraction-cache",
+    literal: "claude-agent-sdk-<hash>",
+    where: "not present — avoided by packaging the native runtime as an ordinary resource rather than a self-extracting bundle",
+    why: "disclosed as avoided rather than omitted, so a later reader can tell an absent cache from an undocumented one"
+  }
+];
+
+// src/official/aliases.ts
+import { mcpToolName } from "@yanlinglabs/winter-agent-sdk";
+var ALIASED_BUILTINS = [
+  { builtin: "SendMessage", tool: "send_message" },
+  { builtin: "ListAgents", tool: "list_agents" },
+  { builtin: "ReadNotifications", tool: "read_notifications" },
+  { builtin: "advisor", tool: "advisor" }
+];
+function officialToolAliases(brand) {
+  return Object.fromEntries(ALIASED_BUILTINS.map(({ builtin, tool }) => [builtin, mcpToolName(brand, tool)]));
+}
+function aliasTargetFor(builtin, brand) {
+  const entry = ALIASED_BUILTINS.find((candidate) => candidate.builtin === builtin);
+  if (entry === undefined)
+    throw new TypeError(`not an aliased builtin: ${String(builtin)}`);
+  return mcpToolName(brand, entry.tool);
+}
+function aliasDenyNames(builtin, brand) {
+  return [builtin, aliasTargetFor(builtin, brand)];
+}
+
+// src/official/errors.ts
+class OfficialBranchError extends RuntimeSdkError {
+  crashClass;
+  branch;
+  constructor(message, branchLabel, options) {
+    super(message, options);
+    this.branch = branchLabel;
+  }
+}
+
+class OfficialConfigurationError extends OfficialBranchError {
+  code = "official_configuration_invalid";
+  winterClass = "WinterSDKError";
+  option;
+  constructor(args) {
+    super(`${args.branchLabel}: ${args.option} — ${args.reason}`, args.branchLabel);
+    this.option = args.option;
+  }
+}
+
+class OfficialExecutableNotFoundError extends OfficialBranchError {
+  code = "official_executable_not_found";
+  winterClass = "CLIConnectionError";
+  crashClass = "executable-not-found";
+  path;
+  constructor(args) {
+    super(`${args.branchLabel}: the vendored runtime was not found at ${args.path}`, args.branchLabel, args.cause === undefined ? undefined : { cause: args.cause });
+    this.path = args.path;
+  }
+}
+
+class OfficialConnectionError extends OfficialBranchError {
+  code = "official_connection_failure";
+  winterClass = "CLIConnectionError";
+  crashClass = "connection-failure";
+  constructor(args) {
+    super(`${args.branchLabel}: the runtime connection failed — ${args.reason}`, args.branchLabel, args.cause === undefined ? undefined : { cause: args.cause });
+  }
+}
+class OfficialNonzeroExitError extends OfficialBranchError {
+  code = "official_nonzero_exit";
+  winterClass = "ProcessError";
+  crashClass = "nonzero-exit";
+  exitCode;
+  signal;
+  stderrTail;
+  constructor(args) {
+    super(`${args.branchLabel}: the runtime exited with code ${String(args.exitCode)}${args.signal === null ? "" : ` (signal ${args.signal})`}`, args.branchLabel);
+    this.exitCode = args.exitCode;
+    this.signal = args.signal;
+    this.stderrTail = args.stderrTail;
+  }
+}
+
+class OfficialKilledError extends OfficialBranchError {
+  code = "official_killed";
+  winterClass = "ProcessError";
+  crashClass = "killed";
+  signal;
+  constructor(args) {
+    super(`${args.branchLabel}: the runtime was killed with ${args.signal} — ${args.reason}`, args.branchLabel);
+    this.signal = args.signal;
+  }
+}
+
+class OfficialContainmentBreachError extends OfficialBranchError {
+  code = "official_containment_breach";
+  winterClass = "WinterSDKError";
+  tool;
+  created;
+  removed;
+  retained;
+  constructor(args) {
+    super(`${args.branchLabel}: ${args.toolName} created ${args.created.length} vendor-named path(s) that the pre-hoc scan did not see; ${args.removed.length} removed, ${args.retained.length} retained (WS-14 §8)`, args.branchLabel);
+    this.tool = args.toolName;
+    this.created = [...args.created];
+    this.removed = [...args.removed];
+    this.retained = [...args.retained];
+  }
+}
+
+class OfficialStdoutUnterminatedError extends OfficialBranchError {
+  code = "official_stdout_unterminated";
+  winterClass = "ProcessError";
+  crashClass = "stdout-unterminated";
+  graceMs;
+  constructor(args) {
+    super(`${args.branchLabel}: the runtime exited but its stdout did not close within ${args.graceMs}ms; the exit was forwarded on the grace timer`, args.branchLabel);
+    this.graceMs = args.graceMs;
+  }
+}
+class OfficialMcpError extends OfficialBranchError {
+  code = "official_mcp_failure";
+  winterClass = "WinterSDKError";
+  server;
+  constructor(args) {
+    super(`${args.branchLabel}: the MCP server ${args.server} failed — ${args.reason}`, args.branchLabel);
+    this.server = args.server;
+  }
+}
+class OfficialInvalidResumeError extends OfficialBranchError {
+  code = "official_invalid_resume";
+  winterClass = "WinterSDKError";
+  constructor(args) {
+    super(`${args.branchLabel}: invalid resume/fork — ${args.reason}`, args.branchLabel);
+  }
+}
+
+// src/official/containment.ts
+var FORBIDDEN_TARGETS = {
+  instructionsFile: "CLAUDE.md",
+  projectDir: ".claude",
+  userPlansDir: ".claude/plans"
+};
+function containmentPaths(brand) {
+  return {
+    worktrees: `${brand.projectDirName}/worktrees`,
+    workflows: `${brand.projectDirName}/workflows`,
+    plans: `${brand.projectDirName}/plans`,
+    localSettings: `${brand.projectDirName}/settings.local.json`
+  };
+}
+function resolveSavedApprovalDisposition(policy, branchLabel) {
+  const disposition = policy.savedWebFetchApprovals ?? "disable";
+  if (disposition === "redirect") {
+    throw new OfficialConfigurationError({
+      option: "containment.savedWebFetchApprovals",
+      reason: "`redirect` cannot be honoured on this branch: nothing routes a durable approval anywhere, so passing it through means the RUNTIME writes its own project settings file — measured, with an ordinary broker. §8 denies that write either way, so this branch supports `disable` until a host replacement exists (WS-14 §8/§16 q2)",
+      branchLabel
+    });
+  }
+  return disposition;
+}
+function containmentDispositions(brand, policy = {}) {
+  const paths = containmentPaths(brand);
+  const savedApprovals = policy.savedWebFetchApprovals ?? "disable";
+  return [
+    {
+      writer: 'EnterWorktree / Agent isolation: "worktree"',
+      claudeNamedTarget: `${FORBIDDEN_TARGETS.projectDir}/worktrees/`,
+      disposition: "redirect",
+      target: paths.worktrees,
+      enforcement: (policy.worktrees ?? "deny") === "deny" ? "floor-deny" : "host-implementation",
+      note: "the router implements no tools, so until the host installs the schema-compatible replacement the vendor's own writer is denied at the floor"
+    },
+    {
+      writer: "CronCreate with durable: true",
+      claudeNamedTarget: `${FORBIDDEN_TARGETS.projectDir}/scheduled_tasks.json`,
+      disposition: "disable",
+      enforcement: "deny-list",
+      note: "the name is in `disallowedTools`, so the runtime refuses it before the callback; the floor also refuses a truthy `durable` for a host that re-enables the tool"
+    },
+    {
+      writer: "named Workflow resolution",
+      claudeNamedTarget: `${FORBIDDEN_TARGETS.projectDir}/workflows/`,
+      disposition: "redirect",
+      target: paths.workflows,
+      enforcement: (policy.workflows ?? "deny") === "deny" ? "floor-deny" : "host-implementation",
+      note: "named resolution reads the vendor's own directory; denied at the floor until the host's replacement resolves under the product's own"
+    },
+    {
+      writer: "saved WebFetch approval",
+      claudeNamedTarget: `${FORBIDDEN_TARGETS.projectDir}/settings.local.json`,
+      disposition: savedApprovals,
+      ...savedApprovals === "redirect" ? { target: paths.localSettings } : {},
+      enforcement: savedApprovals === "disable" ? "approval-stripped" : "host-implementation",
+      note: savedApprovals === "disable" ? "saving is disabled on this branch: the approval still applies for the session, and WS-07 keeps its open question (WS-14 §16 q2)" : "durable approvals are routed into the product's own project settings file (WS-07's shared-store answer, chosen explicitly by the host)"
+    },
+    {
+      writer: "/init and config commands",
+      claudeNamedTarget: `project ${FORBIDDEN_TARGETS.instructionsFile}, ${FORBIDDEN_TARGETS.projectDir}/`,
+      disposition: "owned-by-product",
+      enforcement: "host-ui",
+      note: "a slash command is user-facing surface, not a tool the model can call: the product owns init/config and its UI never presents the vendor's own /init as the product's"
+    },
+    {
+      writer: "arbitrary Write/Edit/Bash",
+      claudeNamedTarget: `any ${FORBIDDEN_TARGETS.instructionsFile}, ${FORBIDDEN_TARGETS.projectDir}/, ~/${FORBIDDEN_TARGETS.userPlansDir}`,
+      disposition: "deny",
+      enforcement: "floor-deny",
+      note: "the permission floor denies residual writes by PATH, case-folded and Unicode-normalized; plansDirectory already redirects plan mode"
+    }
+  ];
+}
+function officialDisallowedTools(policy = {}, brand) {
+  const denied = ["CronCreate"];
+  if (policy.deniedAliasedBuiltins !== undefined && brand !== undefined) {
+    for (const builtin of policy.deniedAliasedBuiltins)
+      denied.push(...aliasDenyNames(builtin, brand));
+  }
+  return denied;
+}
+var norm = (path) => path.replace(/\\/g, "/").replace(/\/+/g, "/");
+var fold = (value) => value.normalize("NFKC").toLowerCase();
+var FORBIDDEN_PROJECT_DIR = fold(FORBIDDEN_TARGETS.projectDir);
+var FORBIDDEN_INSTRUCTIONS_FILE = fold(FORBIDDEN_TARGETS.instructionsFile);
+function targetsForbiddenPath(rawPath) {
+  const segments = norm(rawPath).split("/").filter((segment) => segment.length > 0).map(fold);
+  const index = segments.indexOf(FORBIDDEN_PROJECT_DIR);
+  if (index >= 0) {
+    return { forbidden: true, target: segments[index + 1] === "plans" ? FORBIDDEN_TARGETS.userPlansDir : FORBIDDEN_TARGETS.projectDir };
+  }
+  if (segments[segments.length - 1] === FORBIDDEN_INSTRUCTIONS_FILE)
+    return { forbidden: true, target: FORBIDDEN_TARGETS.instructionsFile };
+  return { forbidden: false, target: "" };
+}
+var VENDOR_HOME_SEGMENT_RE = /(^|\/)\.claude(\/|$)/i;
+var PATH_FIELDS = [
+  "file_path",
+  "filePath",
+  "path",
+  "notebook_path",
+  "notebookPath",
+  "directory",
+  "dir",
+  "target_file",
+  "targetFile",
+  "file",
+  "plan_file_path",
+  "planFilePath"
+];
+var COMMAND_PROJECT_DIR_RE = /(?:^|[^A-Za-z0-9_.\\-])\.claude(?![A-Za-z0-9_-])/i;
+var COMMAND_INSTRUCTIONS_FILE_RE = /(?:^|[^A-Za-z0-9_\\-])claude\.md(?![A-Za-z0-9_.-])/i;
+function isTruthy(value) {
+  if (value === true)
+    return true;
+  if (typeof value === "number")
+    return value !== 0;
+  if (typeof value !== "string")
+    return false;
+  return ["true", "1", "yes", "on"].includes(value.trim().toLowerCase());
+}
+var WORKTREE_TOOLS = ["EnterWorktree", "ExitWorktree", "WorktreeCreate"];
+var AGENT_TOOLS = ["Task", "Agent"];
+var WORKFLOW_TOOLS = ["Workflow"];
+function containmentDecisionFor(toolName, input, policy = {}) {
+  const deny = (target, what) => ({
+    allow: false,
+    target,
+    reason: `${toolName} may not create or modify ${what}: this session runs on the product's own project layout, and the vendor-named path is redirected (WS-14 §8)`
+  });
+  for (const field of PATH_FIELDS) {
+    const value = input[field];
+    if (typeof value !== "string")
+      continue;
+    const hit = targetsForbiddenPath(value);
+    if (hit.forbidden)
+      return deny(hit.target, value);
+  }
+  for (const field of ["command", "script", "code"]) {
+    const value = input[field];
+    if (typeof value !== "string")
+      continue;
+    const command = value.normalize("NFKC");
+    if (COMMAND_PROJECT_DIR_RE.test(command))
+      return deny(FORBIDDEN_TARGETS.projectDir, value);
+    if (COMMAND_INSTRUCTIONS_FILE_RE.test(command))
+      return deny(FORBIDDEN_TARGETS.instructionsFile, value);
+    const unquoted = command.replace(/[\\'"`]/g, "");
+    if (COMMAND_PROJECT_DIR_RE.test(unquoted))
+      return deny(FORBIDDEN_TARGETS.projectDir, value);
+    if (COMMAND_INSTRUCTIONS_FILE_RE.test(unquoted))
+      return deny(FORBIDDEN_TARGETS.instructionsFile, value);
+  }
+  const paths = containmentPaths({ projectDirName: policy.projectDirName ?? "" });
+  if ((policy.worktrees ?? "deny") === "deny") {
+    if (WORKTREE_TOOLS.includes(toolName)) {
+      return {
+        allow: false,
+        target: `${FORBIDDEN_TARGETS.projectDir}/worktrees/`,
+        reason: `${toolName} writes the vendor's own worktree directory; on this branch worktrees belong under ${paths.worktrees || "the product's project directory"} and the host's schema-compatible replacement owns them (WS-14 §8)`
+      };
+    }
+    if (AGENT_TOOLS.includes(toolName) && String(input["isolation"] ?? "") === "worktree") {
+      return {
+        allow: false,
+        target: `${FORBIDDEN_TARGETS.projectDir}/worktrees/`,
+        reason: `an isolated agent worktree writes the vendor's own worktree directory; on this branch it belongs under ${paths.worktrees || "the product's project directory"} (WS-14 §8)`
+      };
+    }
+  }
+  if ((policy.workflows ?? "deny") === "deny" && WORKFLOW_TOOLS.includes(toolName)) {
+    return {
+      allow: false,
+      target: `${FORBIDDEN_TARGETS.projectDir}/workflows/`,
+      reason: `named workflow resolution reads the vendor's own workflows directory; on this branch workflows resolve under ${paths.workflows || "the product's project directory"} (WS-14 §8, D8)`
+    };
+  }
+  if (toolName === "CronCreate" && isTruthy(input["durable"])) {
+    return {
+      allow: false,
+      target: `${FORBIDDEN_TARGETS.projectDir}/scheduled_tasks.json`,
+      reason: "durable scheduled tasks are unavailable on this branch: the vendor's durable variant persists into its own project directory (WS-14 §8)"
+    };
+  }
+  return { allow: true };
+}
+
+// src/official/auth.ts
+var AUTH_FAMILY_VARIABLES = {
+  "api-key": ["ANTHROPIC_API_KEY"],
+  "console-oauth": ["ANTHROPIC_AUTH_TOKEN", "ANTHROPIC_BASE_URL"],
+  bedrock: ["CLAUDE_CODE_USE_BEDROCK", "AWS_REGION", "AWS_PROFILE", "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN", "AWS_BEARER_TOKEN_BEDROCK", "ANTHROPIC_BEDROCK_BASE_URL"],
+  vertex: ["CLAUDE_CODE_USE_VERTEX", "ANTHROPIC_VERTEX_PROJECT_ID", "CLOUD_ML_REGION", "GOOGLE_APPLICATION_CREDENTIALS", "ANTHROPIC_VERTEX_BASE_URL"],
+  "console-profile": ["ANTHROPIC_PROFILE", "ANTHROPIC_CONFIG_DIR"],
+  "claude-oauth": [],
+  "local-none": []
+};
+var AUTH_SHAPED_RE = /^(?:ANTHROPIC_|AWS_|GOOGLE_|GCP_|AZURE_|CLOUD_ML_|VERTEX_|BEDROCK_|CLAUDE_(?:CODE_)?(?:USE_|SKIP_|HOST_|OAUTH_|SESSION_|BRIDGE_|LOCAL_|SECURESTORAGE_|IDENTITY_))|_(?:API_KEY|AUTH_TOKEN|TOKEN|SECRET|CREDENTIALS|CREDS|PASSWORD|PASSWD)$/;
+function isAuthShapedVariable(name) {
+  return AUTH_SHAPED_RE.test(name) || /_(?:API_KEY|AUTH_TOKEN|TOKEN|SECRET|CREDENTIALS|CREDS|PASSWORD|PASSWD)$/.test(name);
+}
+var ALL_AUTH_VARIABLES = Object.values(AUTH_FAMILY_VARIABLES).flat().filter((name, index, all) => all.indexOf(name) === index);
+var NEVER_INJECTED_AUTH_VARIABLES = ["CLAUDE_CODE_OAUTH_TOKEN"];
+function authVariableSetKey(selection) {
+  switch (selection.authFamily) {
+    case "cloud-credential-chain":
+      return selection.providerId.toLowerCase().includes("vertex") ? "vertex" : "bedrock";
+    case "custom":
+      return "custom";
+    default:
+      return selection.authFamily;
+  }
+}
+function allowedAuthVariables(selection) {
+  const key = authVariableSetKey(selection);
+  return key === "custom" ? undefined : AUTH_FAMILY_VARIABLES[key];
+}
+function validateAuthEnvironment(args) {
+  const names = Object.keys(args.credentials);
+  for (const name of names) {
+    if (NEVER_INJECTED_AUTH_VARIABLES.includes(name)) {
+      throw new OfficialConfigurationError({
+        option: `env.${name}`,
+        reason: "this credential is never injected on this branch: D14 gates the subscription-OAuth route, and its supported flow stores credentials inside the spool namespace instead (WS-14 §12, WS-01 §2.5)",
+        branchLabel: args.branchLabel
+      });
+    }
+  }
+  if (args.selection.authFamily === "claude-oauth") {
+    if (!args.gate.approved) {
+      throw new OfficialConfigurationError({
+        option: "selection.authFamily",
+        reason: "the Claude OAuth branch is ship-gated pending written approval (D14); the shippable branch uses API-key, cloud-credential-chain or gateway auth only",
+        branchLabel: args.branchLabel
+      });
+    }
+    if (names.length > 0) {
+      throw new OfficialConfigurationError({
+        option: "credentials",
+        reason: `the Claude OAuth family injects NO credential variable — its stored subscription state lives inside the spool namespace — but ${names.join(", ")} was supplied`,
+        branchLabel: args.branchLabel
+      });
+    }
+    return;
+  }
+  const allowed = allowedAuthVariables(args.selection);
+  if (allowed !== undefined) {
+    const stray = names.filter((name) => !allowed.includes(name));
+    if (stray.length > 0) {
+      throw new OfficialConfigurationError({
+        option: "credentials",
+        reason: `${stray.join(", ")} does not belong to the ${args.selection.authFamily} family (${allowed.length === 0 ? "which injects nothing" : allowed.join(", ")}); two families in one child are resolved by the runtime's own precedence order, not by the host's selection`,
+        branchLabel: args.branchLabel
+      });
+    }
+    if (allowed.includes("ANTHROPIC_AUTH_TOKEN") && names.includes("ANTHROPIC_BASE_URL") && !names.includes("ANTHROPIC_AUTH_TOKEN")) {
+      throw new OfficialConfigurationError({
+        option: "credentials.ANTHROPIC_BASE_URL",
+        reason: "a gateway endpoint without its bearer token leaves a stored subscription credential active behind the new endpoint (WS-14 §12's gateway caveat) — set the full pair or neither",
+        branchLabel: args.branchLabel
+      });
+    }
+    if (args.selection.authFamily === "console-profile" && names.includes("ANTHROPIC_PROFILE") !== names.includes("ANTHROPIC_CONFIG_DIR")) {
+      throw new OfficialConfigurationError({
+        option: "credentials",
+        reason: "the console-profile family sets ANTHROPIC_PROFILE and ANTHROPIC_CONFIG_DIR together or not at all — one without the other resolves against whatever the CLI's own default profile store holds, silently (router 0.0.4, C1)",
+        branchLabel: args.branchLabel
+      });
+    }
+  }
+}
+async function fetchAuthCredentials(args) {
+  const out = {};
+  for (const entry of args.plan) {
+    const material = await args.keychain.read(entry.ref);
+    if (material === undefined || material.length === 0) {
+      throw new OfficialConfigurationError({
+        option: `credentials.${entry.variable}`,
+        reason: `the host's keychain holds no material for this session's ${entry.ref.kind} credential reference; launching without it would fall through the runtime's precedence order to whatever the spool holds`,
+        branchLabel: args.branchLabel
+      });
+    }
+    out[entry.variable] = material;
+  }
+  return out;
+}
+
+// src/official/env-registry.ts
+var NON_CREDENTIAL_ENV_REGISTRY = [
+  "AI_AGENT",
+  "ALACRITTY_LOG",
+  "ALLOW_ANT_COMPUTER_USE_MCP",
+  "ANTHROPIC_BEDROCK_SERVICE_TIER",
+  "ANTHROPIC_BETAS",
+  "ANTHROPIC_CUSTOM_MODEL_OPTION",
+  "ANTHROPIC_CUSTOM_MODEL_OPTION_DESCRIPTION",
+  "ANTHROPIC_CUSTOM_MODEL_OPTION_NAME",
+  "ANTHROPIC_DEFAULT_FABLE_MODEL",
+  "ANTHROPIC_DEFAULT_FABLE_MODEL_DESCRIPTION",
+  "ANTHROPIC_DEFAULT_FABLE_MODEL_NAME",
+  "ANTHROPIC_DEFAULT_HAIKU_MODEL",
+  "ANTHROPIC_DEFAULT_HAIKU_MODEL_DESCRIPTION",
+  "ANTHROPIC_DEFAULT_HAIKU_MODEL_NAME",
+  "ANTHROPIC_DEFAULT_MODEL",
+  "ANTHROPIC_DEFAULT_OPUS_MODEL",
+  "ANTHROPIC_DEFAULT_OPUS_MODEL_DESCRIPTION",
+  "ANTHROPIC_DEFAULT_OPUS_MODEL_NAME",
+  "ANTHROPIC_DEFAULT_SONNET_MODEL",
+  "ANTHROPIC_DEFAULT_SONNET_MODEL_DESCRIPTION",
+  "ANTHROPIC_DEFAULT_SONNET_MODEL_NAME",
+  "ANTHROPIC_FEDERATION_RULE_ID",
+  "ANTHROPIC_FOUNDRY_RESOURCE",
+  "ANTHROPIC_GOOGLE_CLOUD_LOCATION",
+  "ANTHROPIC_MODEL",
+  "ANTHROPIC_SMALL_FAST_MODEL",
+  "ANT_OTEL_EXPORTER_OTLP_PROTOCOL",
+  "ANT_OTEL_LOGS_EXPORTER",
+  "ANT_OTEL_METRICS_EXPORTER",
+  "ANT_OTEL_RESOURCE_ATTRIBUTES",
+  "ANT_OTEL_TRACES_EXPORTER",
+  "API_FORCE_IDLE_TIMEOUT",
+  "API_TIMEOUT_MS",
+  "AWS_CONFIG_FILE",
+  "AWS_EXECUTION_ENV",
+  "AWS_LAMBDA_FUNCTION_NAME",
+  "AWS_ROLE_ARN",
+  "AZURE_FUNCTIONS_ENVIRONMENT",
+  "BASH_ENV",
+  "BASH_MAX_OUTPUT_LENGTH",
+  "BAT_THEME",
+  "BIGINT_FORMAT_RANGES",
+  "BUN_CHROME_PATH",
+  "BUN_CONFIG_FILE",
+  "BUN_INSTALL",
+  "CARGO_HOME",
+  "CCR_ENABLE_BUNDLE",
+  "CCR_FORCE_BUNDLE",
+  "CCR_ON_BRANCH_DEFAULT_GUARD",
+  "CF_PAGES",
+  "CLAUDE_AFK_COUNTDOWN_MS",
+  "CLAUDE_AFK_TIMEOUT_MS",
+  "CLAUDE_AFTER_LAST_COMPACT",
+  "CLAUDE_AGENTS_SELECT",
+  "CLAUDE_AGENT_SDK_CLIENT_APP",
+  "CLAUDE_AGENT_SDK_DISABLE_BUILTIN_AGENTS",
+  "CLAUDE_AGENT_SDK_MCP_NO_PREFIX",
+  "CLAUDE_AGENT_SDK_VERSION",
+  "CLAUDE_ASYNC_AGENT_STALL_TIMEOUT_MS",
+  "CLAUDE_AUTOCOMPACT_PCT_OVERRIDE",
+  "CLAUDE_AUTO_BACKGROUND_TASKS",
+  "CLAUDE_AX_PREPARK_MS",
+  "CLAUDE_AX_SCREEN_READER",
+  "CLAUDE_AX_STARTUP_QUIET_MS",
+  "CLAUDE_BG_BACKEND",
+  "CLAUDE_BG_ISOLATION",
+  "CLAUDE_BG_MEMORY_TOGGLED_OFF",
+  "CLAUDE_BG_POST_CLEAR_RESPAWN",
+  "CLAUDE_BG_RENDEZVOUS_SOCK",
+  "CLAUDE_BG_SOURCE",
+  "CLAUDE_BG_STARTUP_WEDGE_MS",
+  "CLAUDE_BG_TCC_DISCLAIMED",
+  "CLAUDE_BRIDGE_REATTACH_GROUPING",
+  "CLAUDE_BRIDGE_REATTACH_NO_BACKFILL",
+  "CLAUDE_BRIDGE_REATTACH_OUTBOUND_ONLY",
+  "CLAUDE_BRIDGE_REATTACH_OWNER_ACCT",
+  "CLAUDE_BRIDGE_REATTACH_OWNER_ORG",
+  "CLAUDE_BRIDGE_REATTACH_SEQ",
+  "CLAUDE_BYTE_STREAM_IDLE_TIMEOUT_MS",
+  "CLAUDE_CHROME_CLASSIFIER_FLOOR",
+  "CLAUDE_CHROME_PERMISSION_MODE",
+  "CLAUDE_CLIENT_PRESENCE_FILE",
+  "CLAUDE_CODE_3P_PROBE_WROTE_OPUS_DEFAULT",
+  "CLAUDE_CODE_3P_PROBE_WROTE_SONNET_DEFAULT",
+  "CLAUDE_CODE_ACCESSIBILITY",
+  "CLAUDE_CODE_ACTION",
+  "CLAUDE_CODE_ACT_DONT_REDERIVE",
+  "CLAUDE_CODE_ADDITIONAL_DIRECTORIES_CLAUDE_MD",
+  "CLAUDE_CODE_ADDITIONAL_PROTECTION",
+  "CLAUDE_CODE_ADOPT_UNDERIVABLE_PARKED_PERMISSION",
+  "CLAUDE_CODE_AGENT",
+  "CLAUDE_CODE_ALT_SCREEN_FULL_REPAINT",
+  "CLAUDE_CODE_ALWAYS_ENABLE_EFFORT",
+  "CLAUDE_CODE_AMBER_ASTROLABE",
+  "CLAUDE_CODE_ARTIFACT",
+  "CLAUDE_CODE_ARTIFACT_ASSETS",
+  "CLAUDE_CODE_ARTIFACT_AUTO_OPEN",
+  "CLAUDE_CODE_ARTIFACT_COMMENTS",
+  "CLAUDE_CODE_ARTIFACT_COMMENTS_AUTOREACT",
+  "CLAUDE_CODE_ARTIFACT_COMMENT_FAST_ACK",
+  "CLAUDE_CODE_ARTIFACT_COMMENT_FAST_ACK_FIXED",
+  "CLAUDE_CODE_ARTIFACT_COMMENT_RESPONDER",
+  "CLAUDE_CODE_ARTIFACT_DB",
+  "CLAUDE_CODE_ARTIFACT_DELETE",
+  "CLAUDE_CODE_ARTIFACT_PREVIEW",
+  "CLAUDE_CODE_ARTIFACT_ROOM",
+  "CLAUDE_CODE_ARTIFACT_TYPES",
+  "CLAUDE_CODE_ARTIFACT_TYPE_CATALOG",
+  "CLAUDE_CODE_ARTIFACT_TYPE_CLOUD_CREATE",
+  "CLAUDE_CODE_ARTIFACT_VERIFY",
+  "CLAUDE_CODE_ATTRIBUTION_HEADER",
+  "CLAUDE_CODE_AUTO_BACKGROUND_WORKER_CHECKIN_SECONDS",
+  "CLAUDE_CODE_AUTO_COMPACT_WINDOW",
+  "CLAUDE_CODE_AUTO_CONNECT_IDE",
+  "CLAUDE_CODE_AUTO_MODE_EXTERNAL_PERMISSIONS",
+  "CLAUDE_CODE_AUTO_MODE_MODEL",
+  "CLAUDE_CODE_AWS_CHAIN_RESOLVE_TIMEOUT_MS",
+  "CLAUDE_CODE_BASALT_COVE",
+  "CLAUDE_CODE_BASE_REF",
+  "CLAUDE_CODE_BASE_REFS",
+  "CLAUDE_CODE_BASH_OUTPUT_AUDIENCE_NOTE",
+  "CLAUDE_CODE_BASH_SANDBOX_SHOW_INDICATOR",
+  "CLAUDE_CODE_BENCH_LIVE_COUNTS",
+  "CLAUDE_CODE_BG_CLASSIFIER_MODEL",
+  "CLAUDE_CODE_BG_TASKS_REPORT_RUNNING",
+  "CLAUDE_CODE_BISON_CAIRN",
+  "CLAUDE_CODE_BLOCKING_LIMIT_OVERRIDE",
+  "CLAUDE_CODE_BREEZY_HORIZON",
+  "CLAUDE_CODE_BRIDGE_MCP_CARRIER",
+  "CLAUDE_CODE_BRIDGE_PROMPT_SHA256",
+  "CLAUDE_CODE_BRIEF",
+  "CLAUDE_CODE_BRIEF_UPLOAD",
+  "CLAUDE_CODE_BUBBLEWRAP",
+  "CLAUDE_CODE_BYOC_ENABLE_DATADOG",
+  "CLAUDE_CODE_CCR_LAZY_SUBAGENT_HYDRATE",
+  "CLAUDE_CODE_CLASSIFIER_SUMMARY",
+  "CLAUDE_CODE_COLD_COMPACT",
+  "CLAUDE_CODE_CONTAINER_ID",
+  "CLAUDE_CODE_COORDINATOR_FORCE_WORKER_INHERIT_MODEL",
+  "CLAUDE_CODE_COORDINATOR_WORKER_CHECKIN_SECONDS",
+  "CLAUDE_CODE_COWORK_FRAME_ARTIFACTS",
+  "CLAUDE_CODE_DAEMON_COLD_START",
+  "CLAUDE_CODE_DATADOG_FLUSH_INTERVAL_MS",
+  "CLAUDE_CODE_DD_ERROR_TRACKING_FLUSH_INTERVAL_MS",
+  "CLAUDE_CODE_DEBUG_LOGS_DIR",
+  "CLAUDE_CODE_DEBUG_LOG_LEVEL",
+  "CLAUDE_CODE_DEBUG_REPAINTS",
+  "CLAUDE_CODE_DECSTBM",
+  "CLAUDE_CODE_DIAGNOSTICS_FILE",
+  "CLAUDE_CODE_DIR_SYNC_DISABLE_ANCHORING",
+  "CLAUDE_CODE_DIR_SYNC_ENGINE",
+  "CLAUDE_CODE_DIR_SYNC_FFWD",
+  "CLAUDE_CODE_DIR_SYNC_GIT",
+  "CLAUDE_CODE_DIR_SYNC_STREAM",
+  "CLAUDE_CODE_DISABLE_1M_CONTEXT",
+  "CLAUDE_CODE_DISABLE_ADAPTIVE_THINKING",
+  "CLAUDE_CODE_DISABLE_ADMIN_ENV_UNION",
+  "CLAUDE_CODE_DISABLE_ADVISOR_TOOL",
+  "CLAUDE_CODE_DISABLE_AGENT_VIEW",
+  "CLAUDE_CODE_DISABLE_ALTERNATE_SCREEN",
+  "CLAUDE_CODE_DISABLE_ARTIFACT",
+  "CLAUDE_CODE_DISABLE_ATTACHMENTS",
+  "CLAUDE_CODE_DISABLE_AUTO_MEMORY",
+  "CLAUDE_CODE_DISABLE_BACKGROUND_TASKS",
+  "CLAUDE_CODE_DISABLE_BEDROCK_CONTENT_TYPE_DEFAULT",
+  "CLAUDE_CODE_DISABLE_BEDROCK_CONTENT_TYPE_GUARD",
+  "CLAUDE_CODE_DISABLE_BG_EXIT_HANDOFF",
+  "CLAUDE_CODE_DISABLE_BG_SHELL_PRESSURE_REAP",
+  "CLAUDE_CODE_DISABLE_BUNDLED_SKILLS",
+  "CLAUDE_CODE_DISABLE_CLAUDE_API_SKILL",
+  "CLAUDE_CODE_DISABLE_CLAUDE_CODE_SKILL",
+  "CLAUDE_CODE_DISABLE_CLAUDE_MDS",
+  "CLAUDE_CODE_DISABLE_CRON",
+  "CLAUDE_CODE_DISABLE_DIR_SYNC",
+  "CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS",
+  "CLAUDE_CODE_DISABLE_EXPLORE_INHERIT_CAP",
+  "CLAUDE_CODE_DISABLE_EXPLORE_PLAN_AGENTS",
+  "CLAUDE_CODE_DISABLE_FAST_MODE",
+  "CLAUDE_CODE_DISABLE_FEEDBACK_SURVEY",
+  "CLAUDE_CODE_DISABLE_FILE_CHECKPOINTING",
+  "CLAUDE_CODE_DISABLE_GIT_INSTRUCTIONS",
+  "CLAUDE_CODE_DISABLE_HOOK_FORWARDING",
+  "CLAUDE_CODE_DISABLE_LAUNCH_COMPOSER",
+  "CLAUDE_CODE_DISABLE_LEGACY_MODEL_REMAP",
+  "CLAUDE_CODE_DISABLE_MEMORY_BULK_INFLATE",
+  "CLAUDE_CODE_DISABLE_MEMORY_MASS_DELETE_HOLD",
+  "CLAUDE_CODE_DISABLE_MEMORY_PERIODIC_RESYNC",
+  "CLAUDE_CODE_DISABLE_MEMORY_RO_UNSAVED_NOTICE",
+  "CLAUDE_CODE_DISABLE_MEMORY_STREAM_LIST",
+  "CLAUDE_CODE_DISABLE_MOUSE",
+  "CLAUDE_CODE_DISABLE_MOUSE_CLICKS",
+  "CLAUDE_CODE_DISABLE_NESTED_CHAIN_IDLE",
+  "CLAUDE_CODE_DISABLE_NESTED_USER_REPAIR",
+  "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC",
+  "CLAUDE_CODE_DISABLE_NONSTREAMING_FALLBACK",
+  "CLAUDE_CODE_DISABLE_NOTIFICATION_PRESENCE_CHECK",
+  "CLAUDE_CODE_DISABLE_OFFICIAL_MARKETPLACE_AUTOINSTALL",
+  "CLAUDE_CODE_DISABLE_ORG_MEMORY",
+  "CLAUDE_CODE_DISABLE_PERMISSION_PROMPT_NOTIFY_HOOKS",
+  "CLAUDE_CODE_DISABLE_PLUGIN_FORWARDING",
+  "CLAUDE_CODE_DISABLE_POLICY_SKILLS",
+  "CLAUDE_CODE_DISABLE_PRECOMPACT_SKIP",
+  "CLAUDE_CODE_DISABLE_REFUSAL_FALLBACK",
+  "CLAUDE_CODE_DISABLE_TERMINAL_TITLE",
+  "CLAUDE_CODE_DISABLE_THINKING",
+  "CLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT",
+  "CLAUDE_CODE_DISABLE_VIRTUAL_SCROLL",
+  "CLAUDE_CODE_DISABLE_VITALS_EMITTER",
+  "CLAUDE_CODE_DISABLE_WORKFLOWS",
+  "CLAUDE_CODE_DISABLE_WORKING_SYNC",
+  "CLAUDE_CODE_DONT_INHERIT_ENV",
+  "CLAUDE_CODE_DOWNLOAD_DEADLINE_MS_FOR_TESTING",
+  "CLAUDE_CODE_EAGER_FLUSH",
+  "CLAUDE_CODE_EFFORT_LEVEL",
+  "CLAUDE_CODE_EMIT_TOOL_USE_SUMMARIES",
+  "CLAUDE_CODE_ENABLE_APPEND_SUBAGENT_PROMPT",
+  "CLAUDE_CODE_ENABLE_AWAY_SUMMARY",
+  "CLAUDE_CODE_ENABLE_BACKGROUND_PLUGIN_REFRESH",
+  "CLAUDE_CODE_ENABLE_CFC",
+  "CLAUDE_CODE_ENABLE_EXPERIMENTAL_ADVISOR_TOOL",
+  "CLAUDE_CODE_ENABLE_FEEDBACK_SURVEY_FOR_OTEL",
+  "CLAUDE_CODE_ENABLE_FINE_GRAINED_TOOL_STREAMING",
+  "CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY",
+  "CLAUDE_CODE_ENABLE_LAUNCH_COMPOSER",
+  "CLAUDE_CODE_ENABLE_MENU_KIND_LANES",
+  "CLAUDE_CODE_ENABLE_NARRATION",
+  "CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION",
+  "CLAUDE_CODE_ENABLE_REFRESH_MCP_TOOLS",
+  "CLAUDE_CODE_ENABLE_REMOTE_RECAP",
+  "CLAUDE_CODE_ENABLE_SDK_FILE_CHECKPOINTING",
+  "CLAUDE_CODE_ENABLE_TASKS",
+  "CLAUDE_CODE_ENABLE_TODO_TOOLS",
+  "CLAUDE_CODE_ENABLE_XAA",
+  "CLAUDE_CODE_ENHANCED_TELEMETRY_BETA",
+  "CLAUDE_CODE_ENTRYPOINT",
+  "CLAUDE_CODE_ENVIRONMENT_KIND",
+  "CLAUDE_CODE_ENVIRONMENT_RUNNER_VERSION",
+  "CLAUDE_CODE_EXIT_AFTER_FIRST_RENDER",
+  "CLAUDE_CODE_EXIT_AFTER_STOP_DELAY",
+  "CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS",
+  "CLAUDE_CODE_EXPERIMENTAL_OBSERVER_AGENTS",
+  "CLAUDE_CODE_EXTRA_BODY",
+  "CLAUDE_CODE_EXTRA_METADATA",
+  "CLAUDE_CODE_FEDERATION_CACHE_DIR",
+  "CLAUDE_CODE_FLEETVIEW_SIMPLE",
+  "CLAUDE_CODE_FORCE_BRIDGE",
+  "CLAUDE_CODE_FORCE_EVALUATE_MEMORY",
+  "CLAUDE_CODE_FORCE_FULLSCREEN_UPSELL",
+  "CLAUDE_CODE_FORCE_MEMORY_SURVEY",
+  "CLAUDE_CODE_FORCE_MID_CONVERSATION_SYSTEM",
+  "CLAUDE_CODE_FORCE_STRIKETHROUGH",
+  "CLAUDE_CODE_FORCE_SYNC_OUTPUT",
+  "CLAUDE_CODE_FORCE_TIP_ID",
+  "CLAUDE_CODE_FORK_SUBAGENT",
+  "CLAUDE_CODE_FORWARD_SUBAGENT_TEXT",
+  "CLAUDE_CODE_FRAME_TIMING_LOG",
+  "CLAUDE_CODE_FRAME_TIMING_SAMPLE_EVERY",
+  "CLAUDE_CODE_GAULT_KESTREL",
+  "CLAUDE_CODE_GB_DISK_CACHE_WHEN_TELEMETRY_OFF",
+  "CLAUDE_CODE_GB_REFRESH_INTERVAL_MS",
+  "CLAUDE_CODE_GIT_BASH_PATH",
+  "CLAUDE_CODE_GLOB_HIDDEN",
+  "CLAUDE_CODE_GLOB_NO_IGNORE",
+  "CLAUDE_CODE_GLOB_TIMEOUT_SECONDS",
+  "CLAUDE_CODE_GOAL_CHECKIN_MINUTES",
+  "CLAUDE_CODE_GORSE_PLOVER",
+  "CLAUDE_CODE_GZIP_CCR_REQUEST_BODIES",
+  "CLAUDE_CODE_GZIP_REQUEST_BODIES",
+  "CLAUDE_CODE_HARBOR_KITE",
+  "CLAUDE_CODE_HARBOR_KITE_CLOUD",
+  "CLAUDE_CODE_HARBOR_KITE_PACING_OFF",
+  "CLAUDE_CODE_HIDE_CWD",
+  "CLAUDE_CODE_HIDE_SETTINGS_HINT",
+  "CLAUDE_CODE_HOLD_REPORT_PARK_AT_INIT",
+  "CLAUDE_CODE_HOLD_UNANSWERED_PARKED_PERMISSION",
+  "CLAUDE_CODE_HOME_SEED_HOLD_TIMEOUT_MS",
+  "CLAUDE_CODE_HOME_SEED_VERDICT_TIMEOUT_MS",
+  "CLAUDE_CODE_HOOKS_SAME_THREAD",
+  "CLAUDE_CODE_HOVER_REST",
+  "CLAUDE_CODE_IDE_SKIP_AUTO_INSTALL",
+  "CLAUDE_CODE_IDE_SKIP_VALID_CHECK",
+  "CLAUDE_CODE_IDLE_THRESHOLD_MINUTES",
+  "CLAUDE_CODE_INCLUDE_PARTIAL_MESSAGES",
+  "CLAUDE_CODE_INTRO_FRAME",
+  "CLAUDE_CODE_IS_COWORK",
+  "CLAUDE_CODE_JUNIPER_SUNDIAL",
+  "CLAUDE_CODE_KB_COHESION_FIXES",
+  "CLAUDE_CODE_LANTERN_PRISM",
+  "CLAUDE_CODE_LARCH_CISTERN",
+  "CLAUDE_CODE_LEGACY_BUNDLE",
+  "CLAUDE_CODE_LOOP_KEEPALIVE",
+  "CLAUDE_CODE_LOOP_PERSISTENT",
+  "CLAUDE_CODE_MANAGED_SETTINGS_PATH",
+  "CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS",
+  "CLAUDE_CODE_MAX_RETRIES",
+  "CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH",
+  "CLAUDE_CODE_MAX_TOOL_USE_CONCURRENCY",
+  "CLAUDE_CODE_MAX_TURNS",
+  "CLAUDE_CODE_MCP_ALLOWLIST_ENV",
+  "CLAUDE_CODE_MCP_AUTO_BACKGROUND_MS",
+  "CLAUDE_CODE_MCP_MEMORY_CGROUP",
+  "CLAUDE_CODE_MCP_TOOL_IDLE_TIMEOUT",
+  "CLAUDE_CODE_MEMORY_PUSH_DELETE_MODE",
+  "CLAUDE_CODE_MOCK_REMOTE_SETTINGS",
+  "CLAUDE_CODE_MOCK_TRIAL",
+  "CLAUDE_CODE_NANKEEN_KESTREL",
+  "CLAUDE_CODE_NATIVE_CURSOR",
+  "CLAUDE_CODE_NEW_INIT",
+  "CLAUDE_CODE_NO_FLICKER",
+  "CLAUDE_CODE_NO_MODEL_FALLBACK",
+  "CLAUDE_CODE_OTEL_CONTENT_MAX_LENGTH",
+  "CLAUDE_CODE_OTEL_DIAG_STDERR",
+  "CLAUDE_CODE_OTEL_FLUSH_TIMEOUT_MS",
+  "CLAUDE_CODE_OTEL_SHUTDOWN_TIMEOUT_MS",
+  "CLAUDE_CODE_OVERRIDE_DATE",
+  "CLAUDE_CODE_PACKAGE_MANAGER_AUTO_UPDATE",
+  "CLAUDE_CODE_PARCHMENT_FERN",
+  "CLAUDE_CODE_PARKED_PERMISSION_WAIT_MS",
+  "CLAUDE_CODE_PARKED_STOP_RETIRES",
+  "CLAUDE_CODE_PERFETTO_TRACE",
+  "CLAUDE_CODE_PERFETTO_WRITE_INTERVAL_S",
+  "CLAUDE_CODE_PERFORCE_MODE",
+  "CLAUDE_CODE_PEWTER_OWL",
+  "CLAUDE_CODE_PEWTER_OWL_TOOL",
+  "CLAUDE_CODE_PLAN_MODE_REQUIRED",
+  "CLAUDE_CODE_PLAN_V2_AGENT_COUNT",
+  "CLAUDE_CODE_PLAN_V2_EXPLORE_AGENT_COUNT",
+  "CLAUDE_CODE_PLUGIN_ATTRIBUTION",
+  "CLAUDE_CODE_PLUGIN_BINARY_ASSETS",
+  "CLAUDE_CODE_PLUGIN_CACHE_DIR",
+  "CLAUDE_CODE_PLUGIN_GIT_TIMEOUT_MS",
+  "CLAUDE_CODE_PLUGIN_KEEP_MARKETPLACE_ON_FAILURE",
+  "CLAUDE_CODE_PLUGIN_PREFER_HTTPS",
+  "CLAUDE_CODE_PLUGIN_SEED_DIR",
+  "CLAUDE_CODE_PLUGIN_USE_ZIP_CACHE",
+  "CLAUDE_CODE_POLL_EVENTS",
+  "CLAUDE_CODE_POWERSHELL_RESPECT_EXECUTION_POLICY",
+  "CLAUDE_CODE_POWERUP_ONBOARDING",
+  "CLAUDE_CODE_PRINT_BG_WAIT_CEILING_MS",
+  "CLAUDE_CODE_PRINT_ENGINE_LOOP",
+  "CLAUDE_CODE_PROACTIVE",
+  "CLAUDE_CODE_PROMPT_CACHE_TTL",
+  "CLAUDE_CODE_PROPAGATE_TRACEPARENT",
+  "CLAUDE_CODE_PWSH_PARSE_TIMEOUT_MS",
+  "CLAUDE_CODE_QUESTION_PREVIEW_FORMAT",
+  "CLAUDE_CODE_RATE_LIMIT_TIER",
+  "CLAUDE_CODE_REFUSAL_FALLBACK_CATCH_ALL",
+  "CLAUDE_CODE_RELAUNCH_TERMINAL_SIZE",
+  "CLAUDE_CODE_REMOTE",
+  "CLAUDE_CODE_REMOTE_ENVIRONMENT_TYPE",
+  "CLAUDE_CODE_REMOTE_HERMETIC_MODE",
+  "CLAUDE_CODE_REMOTE_MEMORY_DIR",
+  "CLAUDE_CODE_REMOTE_RAW_EVENTS_FILE",
+  "CLAUDE_CODE_REMOTE_SEND_KEEPALIVES",
+  "CLAUDE_CODE_REMOTE_SETTINGS_PATH",
+  "CLAUDE_CODE_REMOTE_SETTINGS_POLL_MS",
+  "CLAUDE_CODE_REPL",
+  "CLAUDE_CODE_REPORT_FINDINGS",
+  "CLAUDE_CODE_REPO_CHECKOUTS",
+  "CLAUDE_CODE_RESTRICTED",
+  "CLAUDE_CODE_RESUME_INTERRUPTED_TURN",
+  "CLAUDE_CODE_RESUME_INTERRUPTED_TURN_MAX_AGE_MS",
+  "CLAUDE_CODE_RESUME_PROMPT",
+  "CLAUDE_CODE_RESUME_SOURCE_ALIVE",
+  "CLAUDE_CODE_RESUME_THRESHOLD_MINUTES",
+  "CLAUDE_CODE_RESUME_TOLERATES_CONTEXT_APPENDS",
+  "CLAUDE_CODE_RETIRE_UNANSWERED_PARKED_PERMISSION",
+  "CLAUDE_CODE_RETRY_WATCHDOG",
+  "CLAUDE_CODE_SABLE_THRUSH",
+  "CLAUDE_CODE_SAFE_MODE",
+  "CLAUDE_CODE_SANDBOXED",
+  "CLAUDE_CODE_SCRIPT_CAPS",
+  "CLAUDE_CODE_SCROLL_SPEED",
+  "CLAUDE_CODE_SEND_FEEDBACK",
+  "CLAUDE_CODE_SHELL",
+  "CLAUDE_CODE_SHELL_PREFIX",
+  "CLAUDE_CODE_SILENT_TURN_REMINDER",
+  "CLAUDE_CODE_SILENT_TURN_REMINDER_TEXT",
+  "CLAUDE_CODE_SILENT_TURN_REMINDER_TURNS",
+  "CLAUDE_CODE_SIMPLE",
+  "CLAUDE_CODE_SIMPLE_SYSTEM_PROMPT",
+  "CLAUDE_CODE_SKILL_PROPOSALS",
+  "CLAUDE_CODE_SKIP_FAST_MODE_NETWORK_ERRORS",
+  "CLAUDE_CODE_SKIP_FAST_MODE_ORG_CHECK",
+  "CLAUDE_CODE_SKIP_HFI_VERSION_CHECK",
+  "CLAUDE_CODE_SKIP_PLUGIN_MCP_SERVERS",
+  "CLAUDE_CODE_SKIP_PLUGIN_MCP_SERVERS_EXCEPT",
+  "CLAUDE_CODE_SKIP_PROMPT_HISTORY",
+  "CLAUDE_CODE_SKIP_REPO_UPLOAD",
+  "CLAUDE_CODE_SLOW_OPERATION_THRESHOLD_MS",
+  "CLAUDE_CODE_SPAWN_TIMESTAMP_MS",
+  "CLAUDE_CODE_SSE_PORT",
+  "CLAUDE_CODE_STALL_TIMEOUT_MS_FOR_TESTING",
+  "CLAUDE_CODE_STOP_HOOK_BLOCK_CAP",
+  "CLAUDE_CODE_SUBAGENT_CACHE_EVICT",
+  "CLAUDE_CODE_SUBAGENT_MODEL",
+  "CLAUDE_CODE_SUBAGENT_PROMPT_CACHE_TTL",
+  "CLAUDE_CODE_SUBPROCESS_ENV_SCRUB",
+  "CLAUDE_CODE_SUBSCRIPTION_TYPE",
+  "CLAUDE_CODE_SUPERVISED",
+  "CLAUDE_CODE_SYNC_PLUGINS",
+  "CLAUDE_CODE_SYNC_PLUGINS_BUFFERED_DOWNLOAD",
+  "CLAUDE_CODE_SYNC_PLUGINS_DOWNLOAD_STALL_MS",
+  "CLAUDE_CODE_SYNC_PLUGINS_INSTALL_TIMEOUT_MS",
+  "CLAUDE_CODE_SYNC_PLUGINS_MCP_TIMEOUT_MS",
+  "CLAUDE_CODE_SYNC_PLUGIN_INSTALL",
+  "CLAUDE_CODE_SYNC_PLUGIN_INSTALL_TIMEOUT_MS",
+  "CLAUDE_CODE_SYNC_SKILLS",
+  "CLAUDE_CODE_SYNC_SKILLS_INSTALL_TIMEOUT_MS",
+  "CLAUDE_CODE_SYNC_SKILLS_WAIT_TIMEOUT_MS",
+  "CLAUDE_CODE_SYNTAX_HIGHLIGHT",
+  "CLAUDE_CODE_SYSTEM_PROMPT_GB_FEATURE",
+  "CLAUDE_CODE_TAGS",
+  "CLAUDE_CODE_TAG_ISMETA_MESSAGES",
+  "CLAUDE_CODE_TASK_LIST_ID",
+  "CLAUDE_CODE_TEAM_TEARDOWN_PARK_TIMEOUT_MS",
+  "CLAUDE_CODE_TEE_SDK_STDOUT",
+  "CLAUDE_CODE_TERMINAL_MCP_TOOLS",
+  "CLAUDE_CODE_TERMINAL_RECORDING",
+  "CLAUDE_CODE_TEST_ALLOW_REAL_NETWORK",
+  "CLAUDE_CODE_TEST_FIXTURES_ROOT",
+  "CLAUDE_CODE_TEST_FORCE_DENY",
+  "CLAUDE_CODE_TEST_NO_GIT_BASH",
+  "CLAUDE_CODE_TEST_NO_PWSH",
+  "CLAUDE_CODE_THINKING_DISPLAY_UPDATES",
+  "CLAUDE_CODE_THISTLE_GREBE",
+  "CLAUDE_CODE_THRIFTY_SONIC",
+  "CLAUDE_CODE_TMPDIR",
+  "CLAUDE_CODE_TMUX_PREFIX",
+  "CLAUDE_CODE_TMUX_PREFIX_CONFLICTS",
+  "CLAUDE_CODE_TMUX_TRUECOLOR",
+  "CLAUDE_CODE_TOASTY_THIMBLE",
+  "CLAUDE_CODE_TODO_REMINDER_MODE",
+  "CLAUDE_CODE_TOOL_MEMORY_CGROUP_EXCLUDE",
+  "CLAUDE_CODE_TOOL_MEMORY_LIMIT",
+  "CLAUDE_CODE_TRANSCRIPT_LOCAL_GC",
+  "CLAUDE_CODE_TRIGGER_ID",
+  "CLAUDE_CODE_TUI_JUST_SWITCHED",
+  "CLAUDE_CODE_TUI_TRIAL",
+  "CLAUDE_CODE_TURN_UPDATES",
+  "CLAUDE_CODE_TWO_STAGE_CLASSIFIER",
+  "CLAUDE_CODE_ULTRAREVIEW_PREFLIGHT_FIXTURE",
+  "CLAUDE_CODE_ULTRAREVIEW_QUOTA_FIXTURE",
+  "CLAUDE_CODE_USER_DIALOG_TIMEOUT_MS",
+  "CLAUDE_CODE_USER_EMAIL",
+  "CLAUDE_CODE_USE_ANTHROPIC_AWS",
+  "CLAUDE_CODE_USE_ANTHROPIC_GOOGLE_CLOUD",
+  "CLAUDE_CODE_USE_BEDROCK",
+  "CLAUDE_CODE_USE_COWORK_PLUGINS",
+  "CLAUDE_CODE_USE_FOUNDRY",
+  "CLAUDE_CODE_USE_GATEWAY",
+  "CLAUDE_CODE_USE_MANTLE",
+  "CLAUDE_CODE_USE_NATIVE_FILE_SEARCH",
+  "CLAUDE_CODE_USE_POWERSHELL_TOOL",
+  "CLAUDE_CODE_USE_VERTEX",
+  "CLAUDE_CODE_VOICE_FORWARD_INTERIMS_TYPED",
+  "CLAUDE_CODE_WALNUT_SPIRE",
+  "CLAUDE_CODE_WEBFETCH_CACHE_TTL_MS",
+  "CLAUDE_CODE_WEB_FETCH_AGENT",
+  "CLAUDE_CODE_WILLOW_TERN",
+  "CLAUDE_CODE_WORKER_EPOCH",
+  "CLAUDE_CODE_WORKFLOWS",
+  "CLAUDE_CODE_WORKFLOW_PREFIX_STAGGER_MS",
+  "CLAUDE_CODE_WORKFLOW_SIZE_WARNING_AGENTS",
+  "CLAUDE_CONTEXT_COLLAPSE",
+  "CLAUDE_CONTEXT_COLLAPSE_MODEL",
+  "CLAUDE_COWORK_MEMORY_EXTRA_GUIDELINES",
+  "CLAUDE_COWORK_MEMORY_GUIDELINES",
+  "CLAUDE_COWORK_MEMORY_INDEX_CONTENT",
+  "CLAUDE_COWORK_MEMORY_PATH_OVERRIDE",
+  "CLAUDE_DEBUG",
+  "CLAUDE_DISABLE_ADOPT",
+  "CLAUDE_ENABLE_BYTE_WATCHDOG",
+  "CLAUDE_ENABLE_BYTE_WATCHDOG_BEDROCK",
+  "CLAUDE_ENABLE_STREAM_WATCHDOG",
+  "CLAUDE_ENV_FILE",
+  "CLAUDE_FORCE_DISPLAY_SURVEY",
+  "CLAUDE_GATEWAY_ALLOW_LOOPBACK",
+  "CLAUDE_GATEWAY_LOG_LEVEL",
+  "CLAUDE_IMPORT_CONVERSATIONS",
+  "CLAUDE_INTERNAL_ASSISTANT_TEAM_NAME",
+  "CLAUDE_INTERNAL_FC_OVERRIDES",
+  "CLAUDE_JOB_DIR",
+  "CLAUDE_MOCK_HEADERLESS_429",
+  "CLAUDE_PTY_HEARTBEAT_MS",
+  "CLAUDE_PTY_ORPHAN_CHECK_MS",
+  "CLAUDE_PTY_RECORD",
+  "CLAUDE_REMOTE_WORKFLOW_ARGS",
+  "CLAUDE_REMOTE_WORKFLOW_SCRIPT",
+  "CLAUDE_REPL_VARIANT",
+  "CLAUDE_RUNNER_ACTIVITY_FD",
+  "CLAUDE_RUNNER_DISABLE_AWAITING_ACTION_OVERRIDE",
+  "CLAUDE_RUNNER_FETCH_DEPTH",
+  "CLAUDE_SERVE_DRAIN_TIMEOUT_MS",
+  "CLAUDE_SLOW_FIRST_BYTE_MS",
+  "CLAUDE_SNIP",
+  "CLAUDE_SSH_LOCAL_BINARY",
+  "CLAUDE_SSH_VERSION",
+  "CLAUDE_STAGE_FILE_ROOT",
+  "CLAUDE_STREAM_FIRST_BYTE_TIMEOUT_MS",
+  "CLAUDE_STREAM_IDLE_TIMEOUT_MS",
+  "CLAUDE_SUBAGENT_BG_SHELL_MAX_MS",
+  "CLAUDE_TMPDIR",
+  "CLAUDE_WORKFLOW_NAME_ONLY",
+  "CLOUDSDK_CONFIG",
+  "CONTAINER_SANDBOX_MOUNT_POINT",
+  "CURSOR_TRACE_ID",
+  "DAYTONA_WS_ID",
+  "DEBUG_CLAUDE_AGENT_SDK",
+  "DEBUG_SDK",
+  "DEMO_VERSION",
+  "DENO_DEPLOYMENT_ID",
+  "DISABLE_AUTOUPDATER",
+  "DISABLE_AUTO_COMPACT",
+  "DISABLE_BRIEF_MODE_STOP_HOOK",
+  "DISABLE_BUG_COMMAND",
+  "DISABLE_COST_WARNINGS",
+  "DISABLE_DOCTOR_COMMAND",
+  "DISABLE_ERROR_REPORTING",
+  "DISABLE_EXTRA_USAGE_COMMAND",
+  "DISABLE_FEEDBACK_COMMAND",
+  "DISABLE_GROWTHBOOK",
+  "DISABLE_INSTALL_GITHUB_APP_COMMAND",
+  "DISABLE_INTERLEAVED_THINKING",
+  "DISABLE_LOGOUT_COMMAND",
+  "DISABLE_PROMPT_CACHING",
+  "DISABLE_PROMPT_CACHING_FABLE",
+  "DISABLE_PROMPT_CACHING_HAIKU",
+  "DISABLE_PROMPT_CACHING_MYTHOS",
+  "DISABLE_PROMPT_CACHING_OPUS",
+  "DISABLE_PROMPT_CACHING_SONNET",
+  "DISABLE_TELEMETRY",
+  "DISABLE_UPDATES",
+  "DISABLE_UPGRADE_COMMAND",
+  "DOCKER_CONFIG",
+  "DO_NOT_TRACK",
+  "EMBEDDED_SEARCH_TOOLS",
+  "EMPTY_PATH",
+  "ENABLE_BETA_TRACING_DETAILED",
+  "ENABLE_CLAUDEAI_MCP_SERVERS",
+  "ENABLE_ENHANCED_TELEMETRY_BETA",
+  "ENABLE_LOCKLESS_UPDATES",
+  "ENABLE_LSP_TOOL",
+  "ENABLE_MCP_LARGE_OUTPUT_FILES",
+  "ENABLE_PID_BASED_VERSION_LOCKING",
+  "ENABLE_PROMPT_CACHING_1H",
+  "ENABLE_PROMPT_CACHING_1H_BEDROCK",
+  "ENABLE_TOOL_SEARCH",
+  "FALLBACK_FOR_ALL_PRIMARY_MODELS",
+  "FORCE_AUTOUPDATE_PLUGINS",
+  "FORCE_CODE_TERMINAL",
+  "FORCE_COLOR",
+  "FORCE_PROMPT_CACHING_5M",
+  "FORCE_VCR",
+  "GCM_INTERACTIVE",
+  "GITHUB_ACTIONS",
+  "GITHUB_ACTION_INPUTS",
+  "GITHUB_ACTION_PATH",
+  "GITHUB_ACTOR",
+  "GITHUB_ACTOR_ID",
+  "GITHUB_ENV",
+  "GITHUB_EVENT_NAME",
+  "GITHUB_EVENT_PATH",
+  "GITHUB_REPOSITORY",
+  "GITHUB_REPOSITORY_ID",
+  "GITHUB_REPOSITORY_OWNER",
+  "GITHUB_REPOSITORY_OWNER_ID",
+  "GITLAB_CI",
+  "GIT_ASKPASS",
+  "GIT_CONFIG_COUNT",
+  "GIT_CONFIG_GLOBAL",
+  "GIT_CONFIG_SYSTEM",
+  "GIT_SSH_COMMAND",
+  "GIT_TERMINAL_PROMPT",
+  "GNOME_TERMINAL_SERVICE",
+  "GOOGLE_CLOUD_WORKSTATIONS",
+  "GRADLE_USER_HOME",
+  "INK_SCREEN_READER",
+  "INTELLIJ_TERMINAL_COMMAND_BLOCKS",
+  "INTELLIJ_TERMINAL_COMMAND_BLOCKS_REWORKED",
+  "IS_DEMO",
+  "IS_SANDBOX",
+  "JAVA_HOME",
+  "JAVA_TOOL_OPTIONS",
+  "KITTY_WINDOW_ID",
+  "KONSOLE_VERSION",
+  "K_SERVICE",
+  "LC_ALL",
+  "LC_TERMINAL",
+  "LC_TIME",
+  "LOCAL_BRIDGE",
+  "MAX_STRUCTURED_OUTPUT_RETRIES",
+  "MCP_CONNECTION_NONBLOCKING",
+  "MCP_CONNECT_TIMEOUT_MS",
+  "MCP_DISCOVERY_CACHE",
+  "MCP_DISCOVERY_CACHE_MAX_STALE_S",
+  "MCP_DISCOVERY_CACHE_STRIKES",
+  "MCP_DISCOVERY_CACHE_TTL_S",
+  "MCP_PROTOCOL_NEGOTIATION",
+  "MCP_REMOTE_SERVER_CONNECTION_BATCH_SIZE",
+  "MCP_SDK_GENERATION",
+  "MCP_SERVER_CONNECTION_BATCH_SIZE",
+  "MCP_TIMEOUT",
+  "MCP_TOOL_TIMEOUT",
+  "MCP_TRUNCATION_PROMPT_OVERRIDE",
+  "NODE_OPTIONS",
+  "NO_COLOR",
+  "NPM_CONFIG_GLOBALCONFIG",
+  "NPM_CONFIG_USERCONFIG",
+  "NUMBER_FORMAT_RANGES",
+  "OTEL_ATTRIBUTE_VALUE_LENGTH_LIMIT",
+  "OTEL_EXPORTER_OTLP_LOGS_PROTOCOL",
+  "OTEL_EXPORTER_OTLP_METRICS_PROTOCOL",
+  "OTEL_EXPORTER_OTLP_METRICS_TEMPORALITY_PREFERENCE",
+  "OTEL_EXPORTER_OTLP_PROTOCOL",
+  "OTEL_EXPORTER_OTLP_TRACES_PROTOCOL",
+  "OTEL_LOGRECORD_ATTRIBUTE_VALUE_LENGTH_LIMIT",
+  "OTEL_LOGS_EXPORTER",
+  "OTEL_LOGS_EXPORT_INTERVAL",
+  "OTEL_LOG_ASSISTANT_RESPONSES",
+  "OTEL_LOG_RAW_API_BODIES",
+  "OTEL_LOG_TOOL_CONTENT",
+  "OTEL_LOG_TOOL_DETAILS",
+  "OTEL_LOG_USER_PROMPTS",
+  "OTEL_METRICS_EXPORTER",
+  "OTEL_METRIC_EXPORT_INTERVAL",
+  "OTEL_RESOURCE_ATTRIBUTES",
+  "OTEL_SPAN_ATTRIBUTE_VALUE_LENGTH_LIMIT",
+  "OTEL_TRACES_EXPORTER",
+  "OTEL_TRACES_EXPORT_INTERVAL",
+  "PIP_CONFIG_FILE",
+  "PLAYWRIGHT_BROWSERS_PATH",
+  "REPL_ID",
+  "REPL_SLUG",
+  "RUNNER_ENVIRONMENT",
+  "RUNNER_OS",
+  "RUSTUP_HOME",
+  "SDK_NATIVE_BIN",
+  "SLASH_COMMAND_TOOL_CHAR_BUDGET",
+  "SPACE_CREATOR_USER_ID",
+  "SSH_CLIENT",
+  "SSH_CONNECTION",
+  "SSH_TTY",
+  "SUDO_GID",
+  "SUDO_UID",
+  "SUDO_USER",
+  "TASK_MAX_OUTPUT_LENGTH",
+  "TERMINAL_EMULATOR",
+  "TERMINATOR_UUID",
+  "TERMUX_VERSION",
+  "TERM_PROGRAM",
+  "TERM_PROGRAM_VERSION",
+  "TILIX_ID",
+  "TMUX_PANE",
+  "ULTRAPLAN_PROMPT_FILE",
+  "USE_API_CONTEXT_MANAGEMENT",
+  "USE_BUILTIN_RIPGREP",
+  "UV_THREADPOOL_SIZE",
+  "VCR_RECORD",
+  "VITALS_EMITTER_BIN",
+  "VSCODE_GIT_ASKPASS_MAIN",
+  "VTE_VERSION",
+  "WAYLAND_DISPLAY",
+  "WEBSITE_SITE_NAME",
+  "WEBSITE_SKU",
+  "WSL_DISTRO_NAME",
+  "WSL_INTEROP",
+  "XDG_CONFIG_HOME",
+  "XDG_DATA_HOME",
+  "XDG_RUNTIME_DIR",
+  "XTERM_VERSION",
+  "ZED_TERM"
+];
+
+// src/official/env-allowlist.ts
+var MINIMAL_OS_VARIABLES = ["PATH", "HOME", "USER", "SHELL", "TERM", "LANG"];
+var MINIMAL_OS_VARIABLE_PREFIXES = ["LC_"];
+var OFFICIAL_RUNTIME_VARIABLES = {
+  configDir: "CLAUDE_CONFIG_DIR",
+  projectDirName: "CLAUDE_CODE_PROJECT_DIR_NAME",
+  tmpdir: "CLAUDE_CODE_TMPDIR"
+};
+var PROXY_AND_TELEMETRY_VARIABLES = [
+  "HTTP_PROXY",
+  "HTTPS_PROXY",
+  "ALL_PROXY",
+  "NO_PROXY",
+  "http_proxy",
+  "https_proxy",
+  "all_proxy",
+  "no_proxy",
+  "CLAUDE_CODE_ENABLE_TELEMETRY",
+  "DISABLE_TELEMETRY",
+  "DISABLE_ERROR_REPORTING"
+];
+var PROXY_AND_TELEMETRY_PREFIXES = ["OTEL_"];
+var TRAFFIC_OPT_OUT_VARIABLES = {
+  CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1",
+  DISABLE_TELEMETRY: "1",
+  DISABLE_ERROR_REPORTING: "1",
+  DISABLE_AUTOUPDATER: "1"
+};
+var TRAFFIC_OPT_OUT_VARIABLE_NAMES = Object.keys(TRAFFIC_OPT_OUT_VARIABLES);
+var PATH_LIST_VARIABLES = ["PATH"];
+function sanitizePathListValue(value) {
+  return value.split(":").filter((entry) => entry.length > 0 && !VENDOR_HOME_SEGMENT_RE.test(entry)).join(":");
+}
+var EXECUTION_INDIRECTION_ENV_NAMES = [
+  "BASH_ENV",
+  "ENV",
+  "SHELLOPTS",
+  "BASHOPTS",
+  "PS4",
+  "IFS",
+  "CDPATH",
+  "FPATH",
+  "ZDOTDIR",
+  "COMSPEC",
+  "PATH",
+  "PSMODULEPATH",
+  "PROMPT_COMMAND",
+  "NODE_OPTIONS",
+  "NODE_PATH",
+  "NODE_REPL_EXTERNAL_MODULE",
+  "PERLLIB",
+  "GEM_PATH",
+  "GEM_HOME",
+  "JAVA_TOOL_OPTIONS",
+  "_JAVA_OPTIONS",
+  "JDK_JAVA_OPTIONS",
+  "IBM_JAVA_OPTIONS",
+  "OPENJ9_JAVA_OPTIONS",
+  "CLASSPATH",
+  "BUN_OPTIONS",
+  "BUN_INSPECT",
+  "MONO_PATH",
+  "R_PROFILE_USER",
+  "DEVPATH",
+  "GCONV_PATH",
+  "PHPRC",
+  "PHP_INI_SCAN_DIR",
+  "OPENSSL_CONF",
+  "OPENSSL_MODULES",
+  "OPENSSL_ENGINES",
+  "KRB5_CONFIG",
+  "GTK_PATH",
+  "QT_PLUGIN_PATH",
+  "GIO_MODULE_DIR",
+  "SASL_PATH",
+  "XDG_CONFIG_HOME",
+  "SSH_ASKPASS",
+  "SSH_ASKPASS_REQUIRE",
+  "SUDO_ASKPASS",
+  "VSCODE_GIT_ASKPASS_MAIN",
+  "PAGER",
+  "EDITOR",
+  "VISUAL",
+  "CLAUDE_CODE_SHELL",
+  "CLAUDE_CODE_SHELL_PREFIX",
+  "CLAUDE_CODE_GIT_BASH_PATH",
+  "CLAUDE_ENV_FILE",
+  "CLAUDE_CODE_MANAGED_SETTINGS_PATH",
+  "CLAUDE_CODE_REMOTE_SETTINGS_PATH",
+  "CLAUDE_CODE_MOCK_REMOTE_SETTINGS",
+  "CLAUDE_CODE_PLUGIN_SEED_DIR",
+  "CLAUDE_CODE_PLUGIN_CACHE_DIR",
+  "BUN_CONFIG_FILE",
+  "NPM_CONFIG_USERCONFIG",
+  "NPM_CONFIG_GLOBALCONFIG",
+  "PIP_CONFIG_FILE",
+  "CLOUDSDK_CONFIG",
+  "DOCKER_CONFIG",
+  "VITALS_EMITTER_BIN",
+  "CLAUDE_SSH_LOCAL_BINARY",
+  "SDK_NATIVE_BIN",
+  "BUN_CHROME_PATH",
+  "PLAYWRIGHT_BROWSERS_PATH"
+];
+var EXECUTION_INDIRECTION_ENV_PREFIXES = [
+  "LD_",
+  "DYLD_",
+  "BASH_FUNC_",
+  "__BASH_FUNC",
+  "PYTHON",
+  "PERL5",
+  "RUBY",
+  "LUA_",
+  "DOTNET_",
+  "COMPLUS_",
+  "COR_",
+  "CORECLR_",
+  "APPDOMAIN_MANAGER_",
+  "GIT_"
+];
+var EXECUTION_INDIRECTION_FOLDED = new Set(EXECUTION_INDIRECTION_ENV_NAMES.map((name) => name.toUpperCase()));
+function isExecutionIndirectionVariable(name) {
+  const folded = name.toUpperCase();
+  return EXECUTION_INDIRECTION_FOLDED.has(folded) || EXECUTION_INDIRECTION_ENV_PREFIXES.some((prefix) => folded.startsWith(prefix));
+}
+var NON_CREDENTIAL_ENV_REGISTRY_FOLDED = new Set(NON_CREDENTIAL_ENV_REGISTRY.map((name) => name.toUpperCase()));
+function minimalOsEnvironmentFrom(source) {
+  const out = {};
+  for (const [name, value] of Object.entries(source)) {
+    if (value === undefined)
+      continue;
+    const wanted = MINIMAL_OS_VARIABLES.includes(name) || MINIMAL_OS_VARIABLE_PREFIXES.some((prefix) => name.startsWith(prefix));
+    if (wanted)
+      out[name] = value;
+  }
+  return out;
+}
+function buildOfficialChildEnv(input, policy = {}) {
+  const branchLabel = officialBranchLabel(input.brand);
+  if (input.configDir.length === 0) {
+    throw new OfficialConfigurationError({
+      option: "env.CLAUDE_CONFIG_DIR",
+      reason: "a child with no config dir writes its transcript wherever the SDK parent's own environment points, which on a developer machine is the real vendor home (WS-14 §1/§3)",
+      branchLabel
+    });
+  }
+  validateAuthEnvironment({ selection: input.selection, credentials: input.credentials, gate: policy.claudeOauth ?? { approved: false }, branchLabel });
+  const env = {
+    [OFFICIAL_RUNTIME_VARIABLES.configDir]: input.configDir
+  };
+  if (input.projectKey !== undefined && input.projectKey.length > 0) {
+    if (!new RegExp(PINNED_PROJECT_DIR_NAME_PATTERN).test(input.projectKey)) {
+      throw new OfficialConfigurationError({
+        option: `env.${OFFICIAL_RUNTIME_VARIABLES.projectDirName}`,
+        reason: `${JSON.stringify(input.projectKey)} (${input.projectKey.length} characters) does not match the pinned runtime's own rule ${PINNED_PROJECT_DIR_NAME_PATTERN}, and a key it rejects does not fail — it falls back to the runtime's own cwd-derived name, leaving the directory row, this environment and the auto-memory directory all naming a transcript that is somewhere else (WS-14 §1/§3, R-7b-13). Name a conforming key in \`runtime.official.projectKey\`; the door's own default is the Winter SDK's \`transcriptProjectKey(cwd)\`, which a deep working directory can push past this rule`,
+        branchLabel
+      });
+    }
+    env[OFFICIAL_RUNTIME_VARIABLES.projectDirName] = input.projectKey;
+  }
+  if (input.sharedTempRoot !== undefined && input.sharedTempRoot.length > 0)
+    env[OFFICIAL_RUNTIME_VARIABLES.tmpdir] = input.sharedTempRoot;
+  if ((policy.remoteConfig ?? "deny") === "deny")
+    for (const [name, value] of Object.entries(TRAFFIC_OPT_OUT_VARIABLES))
+      env[name] = value;
+  for (const [name, value] of Object.entries(input.credentials))
+    env[name] = value;
+  for (const [name, value] of Object.entries(input.base ?? {})) {
+    const wanted = MINIMAL_OS_VARIABLES.includes(name) || MINIMAL_OS_VARIABLE_PREFIXES.some((prefix) => name.startsWith(prefix));
+    if (wanted)
+      env[name] = PATH_LIST_VARIABLES.includes(name) ? sanitizePathListValue(value) : value;
+  }
+  for (const [name, value] of Object.entries(policy.configuredExtras ?? {}))
+    env[name] = value;
+  assertNoForbiddenChildVariables(env, { brand: input.brand, selection: input.selection, policy, branchLabel });
+  return Object.fromEntries(Object.entries(env).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0));
+}
+function assertNoForbiddenChildVariables(env, args) {
+  const branchLabel = args.branchLabel ?? officialBranchLabel(args.brand);
+  const declared = new Set(Object.keys(args.policy?.configuredExtras ?? {}));
+  const reviewedExtras = args.policy?.reviewedCredentialShapedExtras ?? [];
+  const reviewedExecution = args.policy?.reviewedExecutionExtras ?? [];
+  const prefixes = [args.brand.envPrefix, ...args.policy?.hostEnvPrefixes ?? []];
+  const runtimeVariables = Object.values(OFFICIAL_RUNTIME_VARIABLES);
+  const familyVariables = args.selection === undefined ? undefined : allowedAuthVariables(args.selection);
+  for (const [name, value] of Object.entries(env)) {
+    const refuse = (reason) => {
+      throw new OfficialConfigurationError({ option: `env.${name}`, reason, branchLabel });
+    };
+    if (prefixes.some((prefix) => prefix.length > 0 && name.startsWith(prefix))) {
+      refuse("product/daemon variables never reach this child: it is a vendor runtime configured entirely by the allowlist, and Winter itself never reads the vendor's variables either (WS-14 §3, WS-01 §1 principle 4)");
+    }
+    if (NEVER_INJECTED_AUTH_VARIABLES.includes(name)) {
+      refuse("this credential is never injected on this branch (WS-14 §12 / WS-01 §2.5); the supported subscription flow stores its state inside the spool namespace");
+    }
+    if (familyVariables !== undefined && ALL_AUTH_VARIABLES.includes(name) && !familyVariables.includes(name)) {
+      refuse(`it is a credential variable outside this session's ${args.selection?.authFamily} family (${familyVariables.length === 0 ? "which injects nothing" : familyVariables.join(", ")}); the runtime resolves two families by its own precedence order, not by the host's selection (WS-14 §12)`);
+    }
+    const foldedName = name.toUpperCase();
+    const isThisFamilysVariable = (familyVariables ?? []).includes(name);
+    if (declared.has(name) && isExecutionIndirectionVariable(name) && !runtimeVariables.includes(name) && !reviewedExecution.includes(name)) {
+      refuse("it is refused explicitly: this name changes how the child EXECUTES code or authenticates (a shell startup file or command prefix, a loader/runtime hook, or an askpass/credential helper the child runs), " + "which no credential-shape rule can see and which the artifact's own registry legitimately declares — so neither of the extras door's two rules would stop it. " + "A deployment that has REVIEWED this exact name and needs it names it in `reviewedExecutionExtras` (WS-14 §3/§12, item 22)");
+    }
+    if (declared.has(name) && isAuthShapedVariable(foldedName) && !runtimeVariables.includes(name) && !isThisFamilysVariable && !reviewedExtras.includes(name)) {
+      refuse("it is credential-bearing by shape, and the configured-extras door carries non-credential variables only: the runtime resolves credentials by its own precedence order, so one of these re-points billing, rate limits and audit at an account this session's persisted selection does not name (WS-14 §12). " + "A deployment that has REVIEWED a specific auth-shaped variable and needs it names it in `reviewedCredentialShapedExtras` — a reviewed compatibility event under WS-17's drift gate, never a silent addition");
+    }
+    if (declared.has(name) && !runtimeVariables.includes(name) && !isThisFamilysVariable && !reviewedExtras.includes(name) && !NON_CREDENTIAL_ENV_REGISTRY_FOLDED.has(foldedName)) {
+      refuse("the configured-extras door is a positive allowlist: only names the PINNED artifact's own environment registry declares, and that an independent name rule classifies as non-credential, ride it. " + "An unknown name is refused because nothing has classified it — name it in `reviewedCredentialShapedExtras` if this deployment has reviewed it (WS-14 §3/§12, review r3 NEW-10)");
+    }
+    if (declared.has(name) && runtimeVariables.includes(name)) {
+      refuse("a configured extra may not override a variable this branch owns: the config dir, the transcript project key and the shared temp root are §1/§3's own, and the record is written against them");
+    }
+    if (declared.has(name) && TRAFFIC_OPT_OUT_VARIABLE_NAMES.includes(name)) {
+      refuse('this is one of the four traffic opt-outs this branch sets itself (R-7b-11), and setting it through the extras door would leave the session\'s recorded `remoteConfig` describing a surface the child does not have — use `OfficialEnvPolicy.remoteConfig` ("allow" opts back in, and the choice is recorded)');
+    }
+    if (!declared.has(name) && !TRAFFIC_OPT_OUT_VARIABLE_NAMES.includes(name) && (PROXY_AND_TELEMETRY_VARIABLES.includes(name) || PROXY_AND_TELEMETRY_PREFIXES.some((prefix) => name.startsWith(prefix)))) {
+      refuse("proxy and telemetry variables reach this child only when the deployment configures them explicitly (WS-14 §3); an inherited one redirects or duplicates traffic invisibly");
+    }
+    if (VENDOR_HOME_SEGMENT_RE.test(value)) {
+      refuse(`its value (${value}) points into the vendor's user-level home; this branch is isolated from it by construction (WS-14 §3, WS-17 row 4)`);
+    }
+    const known = runtimeVariables.includes(name) || TRAFFIC_OPT_OUT_VARIABLE_NAMES.includes(name) || ALL_AUTH_VARIABLES.includes(name) || MINIMAL_OS_VARIABLES.includes(name) || MINIMAL_OS_VARIABLE_PREFIXES.some((prefix) => name.startsWith(prefix)) || declared.has(name);
+    if (!known) {
+      refuse("it is not a variable this branch owns, an auth variable for this session, a minimal OS variable, or an explicitly configured addition — the child environment is an allowlist, and anything else is a leak from somewhere (WS-14 §3)");
+    }
+  }
+}
+var PINNED_OFFICIAL_RUNTIME = "0.3.250";
+var PINNED_PROJECT_DIR_NAME_PATTERN = "^[A-Za-z0-9_-]{1,64}$";
+
+export { RuntimeSdkError, RuntimeHandoffRequiredError, RuntimeLaunchInputError, UnaddressableEntryError, RuntimeSdkVersionError, NotImplementedYet, RuntimeSdkDisposedError, officialBranchLabel, OFFICIAL_DISCLOSURES, officialToolAliases, OfficialConfigurationError, OfficialExecutableNotFoundError, OfficialConnectionError, OfficialNonzeroExitError, OfficialKilledError, OfficialContainmentBreachError, OfficialStdoutUnterminatedError, OfficialMcpError, OfficialInvalidResumeError, containmentPaths, resolveSavedApprovalDisposition, containmentDispositions, officialDisallowedTools, targetsForbiddenPath, VENDOR_HOME_SEGMENT_RE, containmentDecisionFor, authVariableSetKey, fetchAuthCredentials, TRAFFIC_OPT_OUT_VARIABLES, TRAFFIC_OPT_OUT_VARIABLE_NAMES, EXECUTION_INDIRECTION_ENV_NAMES, EXECUTION_INDIRECTION_ENV_PREFIXES, isExecutionIndirectionVariable, minimalOsEnvironmentFrom, buildOfficialChildEnv, PINNED_OFFICIAL_RUNTIME };