niahere 0.3.5 → 0.3.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "niahere",
-  "version": "0.3.5",
+  "version": "0.3.8",
   "description": "A personal AI assistant daemon — chat, scheduled jobs, persona system, extensible via skills.",
   "type": "module",
   "scripts": {

package/skills/programmatic-seo/SKILL.md

@@ -0,0 +1,47 @@
+---
+name: programmatic-seo
+description: "Plans, audits, and implements scalable programmatic SEO systems with URL inventory, intent mapping, metadata, schema, internal linking, sitemaps, ISR/static rendering, and quality gates. Use when the user mentions 'programmatic SEO,' 'pSEO,' '100k pages,' 'generate SEO pages,' 'scaled landing pages,' 'template pages,' 'SEO page factory,' 'dynamic SEO routes,' 'sitemap shards,' 'keyword cannibalization,' 'doorway pages,' or 'thin content at scale.' Does not replace general SEO audits, AI SEO citation work, or llms.txt tasks unless PSEO scale is central."
+---
+
+# Programmatic SEO
+
+## Core Rule
+
+Turn PSEO requests into a gated system. A URL becomes indexable only after it has distinct intent, unique visible value, canonical consistency, crawlable links, and a measurable reason to stay live.
+
+## First Checks
+
+1. If `.agents/product-marketing-context.md` exists, read it before asking discovery questions.
+2. If the task is a broad SEO audit without PSEO scale, invoke the `seo` skill instead.
+3. If the user asks for current framework behavior, Google policy, or AI-search behavior, verify primary docs before relying on memory.
+
+## Mode Selection
+
+| Task | Read |
+| --- | --- |
+| Define page families, intent, uniqueness, doorway risk, cannibalization, hubs, or content blocks | [references/content-quality.md](references/content-quality.md) |
+| Design the PSEO system: URL registry, statuses, metadata core, schema core, linking, sitemap model, facets | [references/architecture.md](references/architecture.md) |
+| Inspect or optimize a Next.js app for PSEO: App Router, ISR, `generateStaticParams`, metadata, sitemaps, caching, build performance | [references/nextjs-inspection.md](references/nextjs-inspection.md) |
+| Validate launch readiness, tests, Search Console checks, and monitoring | [references/validation.md](references/validation.md) |
+| Ground claims in primary docs or source links | [references/sources.md](references/sources.md) |
+
+## Output Shape
+
+For audits, return:
+- `Verdict`: whether the PSEO system is ready to scale.
+- `Blockers`: issues that can harm crawl, indexation, quality, or build reliability.
+- `Architecture`: recommended URL inventory, routing, rendering, metadata, schema, and sitemap structure.
+- `Quality gates`: checks required before pages become indexable.
+- `Implementation plan`: scoped code changes and verification steps.
+
+For implementation, make the smallest code changes that establish durable guardrails. Prefer reusable SEO/data/template modules over inline page-level SEO logic.
+
+## Hard Rules
+
+- Scale only after a page pattern proves unique usefulness.
+- Never create separate indexable URLs solely for plural/singular, synonym, query-fanout, or city/service keyword swaps.
+- Never rely on `robots.txt` for deindexing or canonicalization.
+- Never mark up schema that is not visible to users.
+- Never include non-canonical, noindex, redirected, 404, or duplicate URLs in XML sitemaps.
+- Never let arbitrary search, sort, filter, or facet combinations become indexable by default.
+- Never promise that compliant pages will be indexed; treat indexation as an outcome to monitor.

package/skills/programmatic-seo/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Programmatic SEO"
+  short_description: "Plan and audit scalable PSEO systems"
+  default_prompt: "Use $programmatic-seo to audit this codebase for scalable programmatic SEO."

package/skills/programmatic-seo/references/architecture.md

@@ -0,0 +1,114 @@
+# PSEO Architecture
+
+## Core Principle
+
+Separate concerns:
+
+- Data layer decides what URLs exist.
+- SEO core generates metadata, canonicals, robots directives, and schema.
+- Templates render visible page content from structured data.
+- Routing resolves canonical paths and page status.
+- Linking builds the crawl graph.
+- Sitemaps expose only canonical, indexable URLs.
+
+## Canonical URL Registry
+
+Use a single registry or query layer as the source of truth:
+
+```txt
+pseo_pages
+- id
+- canonical_path
+- slug_parts
+- template_key
+- entity_ids or query_hash
+- title
+- meta_description
+- h1
+- status: draft | indexable | noindex | canonical_duplicate | redirected | deleted
+- canonical_target
+- redirect_target
+- last_modified_at
+- content_hash
+- priority_bucket
+```
+
+Implementation rules:
+
+- Page loaders fetch by canonical path.
+- Missing or deleted pages return `404` or framework equivalent.
+- `noindex` pages render explicit robots directives and stay out of sitemaps.
+- Alias and legacy paths redirect to canonical paths.
+- Internal links and sitemaps emit only canonical paths.
+
+## Rendering Strategy
+
+Choose rendering based on URL count, freshness, and cacheability:
+
+- Full static generation: small, stable URL sets.
+- ISR or equivalent incremental generation: large cacheable long-tail inventories.
+- Dynamic rendering: real-time, personalized, auth-sensitive, or uncacheable pages.
+- Static export: only when every route is known at build time and no incremental rendering is needed.
+
+For Next.js-specific inspection and implementation guidance, read [nextjs-inspection.md](nextjs-inspection.md).
+
+## Build Performance
+
+Do:
+
+- Pre-render only priority buckets when inventories are large.
+- Generate fewer or zero long-tail paths in preview environments.
+- Keep path collection cheap: one batched query, no full content fetches, no per-page network fanout.
+- Fetch full content in the page loader, not in path generation.
+
+Do not:
+
+- Generate 100k+ pages in every build by default.
+- Put expensive joins or remote calls inside path collection.
+- Depend on dev-server behavior to validate production caching.
+
+## Metadata And Schema Core
+
+Create shared builders:
+
+- `buildMetadata(page)`: title, description, canonical, robots, Open Graph, Twitter.
+- `buildBreadcrumbs(page)`: canonical breadcrumb hierarchy.
+- `buildSchema(page)`: JSON-LD matching visible content.
+- `buildInternalLinks(page)`: parent, siblings, related pages, and next actions.
+
+Schema rules:
+
+- Use JSON-LD when possible.
+- Mark up only content visible to users.
+- Use the most specific relevant schema type.
+- Keep required properties complete for the chosen rich result type.
+- Validate representative pages with Rich Results Test or equivalent rendered inspection.
+
+## Sitemaps
+
+Rules:
+
+- A sitemap file must stay under 50,000 URLs and 50MB uncompressed.
+- Use a sitemap index for large inventories.
+- Shard by page family, priority bucket, date, or deterministic ID range.
+- Include only absolute canonical URLs returning 200 and marked indexable.
+- Use accurate `lastmod` from the page source of truth.
+- Reference the sitemap index from `robots.txt`.
+
+For Next.js App Router, prefer `generateSitemaps()` or explicit route handlers for shards.
+
+## Facets, Search Params, And Pagination
+
+Facets are deny-by-default:
+
+- Curate allowed indexable combinations.
+- Return `404` for empty or nonsensical combinations.
+- Use canonical or noindex for useful non-canonical variants.
+- Avoid arbitrary sort, order, filter, and tracking parameters in crawlable links.
+
+Pagination:
+
+- Give paginated content unique crawlable URLs.
+- Link pages with normal anchors.
+- Self-canonicalize pages that are distinct paginated archives.
+- Do not make infinite scroll or "load more" the only discovery path.

package/skills/programmatic-seo/references/content-quality.md

@@ -0,0 +1,103 @@
+# PSEO Content Quality
+
+## Intent Gate
+
+Approve a page family only when it has:
+
+- A target user and job-to-be-done.
+- One primary intent cluster, not a bag of keyword variants.
+- One canonical URL per intent cluster.
+- A distinct reason to exist: proprietary data, useful aggregation, comparison, local/entity specificity, workflow utility, first-hand expertise, or an interactive tool.
+- A clear relationship to a hub, siblings, and downstream actions.
+
+Reject pages created only for plural/singular variants, synonyms, "near me" swaps, city/service shells, or AI-query fanout.
+
+## Page Entity Model
+
+Each generated page should be a first-class entity with fields like:
+
+```txt
+id
+canonical_path
+template_key
+intent
+primary_keyword
+supporting_keywords
+parent_hub
+related_pages
+schema_type
+status
+last_modified_at
+content_hash
+quality_score
+```
+
+Keep page status explicit: `draft`, `indexable`, `noindex`, `canonical_duplicate`, `redirected`, or `deleted`.
+
+## Unique Value Gate
+
+Every indexable generated page should include at least 3-5 page-specific content blocks:
+
+- Direct answer to the main query.
+- Key facts table from structured data.
+- Comparison, ranking, availability, pricing, or alternatives.
+- Evidence, methodology, dates, and source attribution.
+- Real FAQs from query data, support logs, or sales calls.
+- Examples, workflows, screenshots, calculators, filters, or next-step actions.
+
+The template can be repeated. The value inside it cannot be mostly boilerplate.
+
+## Duplicate And Cannibalization Gate
+
+Before indexation:
+
+- Compare pages inside the same template family with shingles, hashes, embeddings, or another near-duplicate check.
+- Check keyword-to-URL ownership: one owner URL per intent.
+- Canonicalize, merge, redirect, noindex, or delete pages that satisfy the same intent.
+- Avoid linking with the same anchor text to multiple competing pages.
+- Publish in batches and monitor whether Google chooses unexpected canonicals.
+
+## Doorway Risk Gate
+
+Reject or redesign page sets where:
+
+- Pages funnel users to one real page instead of solving the searcher's need.
+- Many pages target similar queries with substantially similar content.
+- Location/service pages only swap place names, numbers, or generic claims.
+- Pages are internal search results with no curated value.
+- Pages are discoverable only through XML sitemaps or SEO-only link blocks.
+- The page family is closer to search results than to a browseable hierarchy.
+
+## Hub And Spoke Linking
+
+Use a deliberate graph:
+
+- Hubs target broad topics, categories, use cases, locations, or entity classes.
+- Spokes target narrower intents and link up to hubs.
+- Spokes link sideways to true siblings and related alternatives.
+- Hubs link down to high-quality spokes in useful groupings.
+- Conversion links appear only when contextually useful.
+- Links must be crawlable `<a href>` links to canonical URLs.
+
+## Structured Blocks
+
+Use blocks that are easy for users and search systems to parse:
+
+- Definition or direct answer: 40-80 words.
+- Step-by-step process for "how to" intent.
+- Comparison table for "vs", "best", and evaluation intent.
+- Pros/cons for decision intent.
+- FAQ using natural questions.
+- Evidence block with dated sources and methodology.
+
+For AI-search extractability, prefer concise answer blocks, tables, current facts, named sources, and clear headings. Do not create thin pages for every AI fanout query.
+
+## Kill, Merge, Or Improve Rules
+
+Set a review window per page family. Then act:
+
+- Merge if two pages earn impressions for the same intent.
+- Canonicalize if variants are useful to users but not distinct search results.
+- Noindex if a page is useful in-product but not a search landing page.
+- Redirect or delete if it has no durable user value.
+- Improve if it has impressions but weak click-through or engagement and the intent remains valid.

package/skills/programmatic-seo/references/nextjs-inspection.md

@@ -0,0 +1,129 @@
+# Next.js PSEO Inspection
+
+Use this when auditing or optimizing a Next.js app for programmatic SEO. Keep the inspection tied to the app's actual version, router, deployment target, and caching model.
+
+## Quick Classification
+
+Inspect first:
+
+- Next.js version and whether the app uses App Router, Pages Router, or both.
+- Deployment target: Vercel, self-hosted Node, static export, edge runtime, or other.
+- `next.config.*` for `output: "export"`, redirects, rewrites, headers, image config, experimental cache settings, and trailing slash behavior.
+- Route inventory: `app/`, `pages/`, route handlers, dynamic segments, catch-all routes, and sitemap/robots files.
+- Data source for slugs, canonical paths, status, redirects, `lastmod`, and template selection.
+
+## App Router Checks
+
+Inspect dynamic SEO routes:
+
+- `app/[slug]/page.tsx`, `app/[...slug]/page.tsx`, or template-specific dynamic routes.
+- `generateStaticParams()` scope and cost.
+- `dynamicParams`, `dynamic`, `revalidate`, `fetchCache`, and runtime exports.
+- `generateMetadata()` and whether it uses the same canonical registry as page rendering.
+- `notFound()`, redirects, and `robots` metadata for non-indexable states.
+
+Default for large PSEO: pre-render only priority paths and let the long tail generate through ISR or cached request-time rendering.
+
+Pattern:
+
+```ts
+export const revalidate = 3600
+
+export async function generateStaticParams() {
+  return hotPaths.map((path) => ({ slug: path.split("/") }))
+}
+```
+
+Rules:
+
+- `generateStaticParams()` should fetch paths only, not full page bodies.
+- Do not run one DB/API request per generated URL.
+- Do not pre-render every long-tail URL in preview builds.
+- Validate ISR/caching in production mode, not only `next dev`.
+
+## Pages Router Checks
+
+Inspect:
+
+- `getStaticPaths`, `fallback`, `getStaticProps`, `revalidate`, and `getServerSideProps`.
+- Whether `getStaticPaths` returns all URLs or only priority URLs.
+- Whether fallback pages render complete indexable content once generated.
+- Whether page data is too large for hydration or `__NEXT_DATA__`.
+
+Prefer `fallback: "blocking"` or an equivalent long-tail strategy for large inventories when using Pages Router, unless the app has a reason to prebuild all paths.
+
+## Metadata And Canonicals
+
+Check that metadata is centralized:
+
+- Title, description, canonical, robots, Open Graph, and Twitter values come from the page registry or SEO core.
+- Canonicals are absolute, stable, and match internal links and sitemap URLs.
+- Non-indexable statuses emit `noindex` and stay out of sitemaps.
+- Duplicate or alias paths redirect or canonicalize consistently.
+- `generateMetadata()` does not duplicate expensive page loading if the page also fetches the same data.
+
+## Structured Data
+
+Inspect JSON-LD generation:
+
+- It is emitted server-side in rendered HTML.
+- It describes visible content on the page.
+- It uses the right type for the template: `Article`, `FAQPage`, `BreadcrumbList`, `Product`, `ItemList`, `LocalBusiness`, or another specific type.
+- Breadcrumb schema matches visible breadcrumbs and canonical URLs.
+- FAQ schema only marks up visible FAQs.
+
+## Sitemaps And Robots
+
+Inspect:
+
+- `app/sitemap.ts`, nested `sitemap.ts`, route handlers, or generated XML files.
+- `generateSitemaps()` if URL count exceeds one sitemap file.
+- URL count per shard and uncompressed size.
+- Absolute canonical URLs only.
+- Accurate `lastModified` from source data.
+- No `noindex`, redirect, duplicate, 404, draft, or parameter URLs.
+- `app/robots.ts` or `public/robots.txt` references the sitemap index.
+
+For large inventories, shard by template, priority bucket, updated date, or deterministic ID range.
+
+## Links, Facets, And Pagination
+
+Inspect rendered links:
+
+- Hubs, breadcrumbs, related pages, siblings, and next actions use normal `<a href>` links.
+- Internal links point to canonical URLs.
+- Search/filter/sort params are not crawlable by default.
+- Empty or nonsensical facet combinations return `404` or are blocked before indexation.
+- Paginated archives have unique crawlable URLs and self-canonicals when they represent distinct pages.
+
+## Build And Runtime Performance
+
+Inspect build output and logs:
+
+- Number of generated static pages.
+- Time spent inside path generation.
+- Remote API or DB fanout during build.
+- Static generation timeout warnings.
+- Preview build behavior versus production build behavior.
+- Cache invalidation strategy: `revalidatePath`, `revalidateTag`, cache tags, or deploy-based rebuilds.
+- Self-hosted deployments: whether ISR/cache storage is shared across instances.
+
+Recommended guardrails:
+
+- Cap pre-rendered PSEO paths by environment.
+- Make path generation a single batched query.
+- Cache shared template data separately from per-page data.
+- Use on-demand revalidation for CMS or data updates where available.
+- Add tests that sitemap queries exclude non-indexable statuses.
+
+## Output For A Next.js PSEO Audit
+
+Return:
+
+- `Router and rendering`: current setup and scaling risk.
+- `URL source of truth`: where canonical path/status data lives.
+- `Metadata/schema`: centralization and correctness gaps.
+- `Sitemaps/robots`: shard and inclusion issues.
+- `Crawl graph`: internal link and facet risks.
+- `Build/runtime`: slow-build and cache risks.
+- `Fix plan`: smallest code changes and verification commands.

package/skills/programmatic-seo/references/sources.md

@@ -0,0 +1,42 @@
+# PSEO Source Notes
+
+Prefer current primary sources when making implementation or policy decisions. Useful starting points:
+
+## Google Search Central
+
+- Search Essentials: https://developers.google.com/search/docs/essentials
+- Spam policies, including scaled content and doorway abuse: https://developers.google.com/search/docs/essentials/spam-policies
+- Helpful, reliable, people-first content: https://developers.google.com/search/docs/fundamentals/creating-helpful-content
+- AI-generated content guidance: https://developers.google.com/search/docs/fundamentals/using-gen-ai-content
+- Optimizing for generative AI features on Google Search: https://developers.google.com/search/docs/fundamentals/ai-optimization-guide
+- Crawl budget guide: https://developers.google.com/crawling/docs/crawl-budget
+- Canonicalization: https://developers.google.com/search/docs/crawling-indexing/consolidate-duplicate-urls
+- Crawlable links: https://developers.google.com/search/docs/crawling-indexing/links-crawlable
+- Sitemaps overview and large sitemap guidance: https://developers.google.com/search/docs/crawling-indexing/sitemaps/overview
+- Structured data guidelines: https://developers.google.com/search/docs/appearance/structured-data/sd-policies
+- Faceted navigation crawl guidance: https://developers.google.com/crawling/docs/faceted-navigation
+
+## Sitemaps
+
+- Sitemap protocol: https://www.sitemaps.org/protocol.html
+- Sitemap FAQ: https://www.sitemaps.org/faq.html
+
+## Next.js
+
+- ISR guide: https://nextjs.org/docs/app/guides/incremental-static-regeneration
+- `generateStaticParams`: https://nextjs.org/docs/app/api-reference/functions/generate-static-params
+- `generateSitemaps`: https://nextjs.org/docs/app/api-reference/functions/generate-sitemaps
+- Metadata and `generateMetadata`: https://nextjs.org/docs/app/api-reference/functions/generate-metadata
+- Robots file conventions: https://nextjs.org/docs/app/api-reference/file-conventions/metadata/robots
+- Sitemap file conventions: https://nextjs.org/docs/app/api-reference/file-conventions/metadata/sitemap
+- Static exports: https://nextjs.org/docs/app/guides/static-exports
+- Caching: https://nextjs.org/docs/app/getting-started/caching
+- Static generation timeout: https://nextjs.org/docs/messages/static-page-generation-timeout
+
+## Research And Industry Context
+
+- Generative Engine Optimization paper: https://arxiv.org/pdf/2311.09735
+- Ahrefs programmatic SEO guide: https://ahrefs.com/blog/programmatic-seo/
+- Semrush programmatic SEO guide: https://www.semrush.com/blog/programmatic-seo/
+
+Treat third-party SEO research as directional evidence, not policy. Prefer Google docs for policy and official framework docs for implementation constraints.

package/skills/programmatic-seo/references/validation.md

@@ -0,0 +1,78 @@
+# PSEO Validation
+
+## Pre-Launch Checklist
+
+For each page family, verify:
+
+- A clear target user, intent, and unique value source exists.
+- Each indexable URL has a canonical path and status.
+- Titles, H1s, descriptions, canonicals, robots directives, and schema are generated centrally.
+- Content has page-specific data, not mostly boilerplate.
+- Near-duplicate and cannibalization checks pass.
+- Doorway-page risk has been explicitly reviewed.
+- Internal links use crawlable anchors and canonical URLs.
+- Breadcrumbs reflect the site hierarchy.
+- Sitemaps include only canonical, indexable, 200-status URLs.
+- Facets/search params cannot create infinite crawl spaces.
+- Representative pages pass rendered metadata and schema inspection.
+
+## Codebase Audit Checklist
+
+Inspect:
+
+- Route structure and dynamic SEO routes.
+- URL source of truth: database, CMS, files, generated JSON, or ad hoc slug code.
+- Page statuses and canonical/redirect/noindex handling.
+- Metadata generation and duplicate title/description risks.
+- JSON-LD generation and whether schema content is visible.
+- Sitemap generation, shard size, absolute URLs, and `lastmod`.
+- `robots.txt` sitemap references and disallow rules.
+- Internal links to non-indexable, redirected, duplicate, or parameterized URLs.
+- Build logs: static path counts, timeouts, remote API fanout, and preview behavior.
+- Search/filter/facet/pagination URL behavior.
+
+## Mechanical Tests
+
+Add or run tests where practical:
+
+- URL registry returns only valid indexable URLs for sitemap queries.
+- Sitemap shards stay below URL and size limits.
+- Non-indexable, deleted, duplicate, and redirected pages never appear in sitemaps.
+- Metadata builder emits absolute canonicals.
+- Schema builder omits invisible or unavailable content.
+- Duplicate pages resolve through canonical/noindex/redirect behavior.
+- Empty or invalid facet combinations return `404`.
+- Preview builds do not pre-render the full long-tail inventory.
+
+## Manual Spot Checks
+
+Sample pages from every template and priority bucket:
+
+- View rendered HTML head for title, description, canonical, robots, OG, Twitter, and JSON-LD.
+- Confirm the canonical URL returns the same page and is linked internally.
+- Confirm the page answers its primary intent without forcing a click to another page.
+- Confirm visible page-specific facts match structured data.
+- Confirm related links are useful and not just exact-match SEO blocks.
+
+## Launch Strategy
+
+- Publish in batches by page family or priority bucket.
+- Submit sitemap indexes after the first batch is live.
+- Watch Search Console for indexed count, discovered-not-indexed, crawled-not-indexed, duplicate without user-selected canonical, and unexpected canonical selection.
+- Compare query-to-URL mapping after each batch.
+- Delay the next batch if Google is ignoring, canonicalizing away, or clustering pages unexpectedly.
+
+## Monitoring
+
+Track:
+
+- Indexed / submitted ratio by sitemap shard.
+- Crawl stats and server errors.
+- Unexpected canonical selection.
+- Query cannibalization.
+- Organic clicks, qualified conversions, and engagement by page family.
+- Stale data and `lastmod` accuracy.
+- Pages with impressions but poor CTR.
+- Pages with no impressions after the review window.
+
+Use monitoring to prune. More pages are not better if they dilute crawl demand, create cannibalization, or fail to serve users.

package/src/channels/slack.ts

@@ -430,10 +430,20 @@ class SlackChannel implements Channel {
           );
 
           const reply = result.trim();
-
-          // [NO_REPLY] or empty = agent chose not to respond (thread judgement)
-          if (!reply || cleanSentinel(reply) === "[NO_REPLY]") {
-            log.info({ channel: msg.channel, key }, "slack: agent chose not to reply");
+          const cleaned = cleanSentinel(reply);
+
+          // [NO_REPLY] anywhere in the reply suppresses the send. If it appeared
+          // alongside real content the model got confused — warn so we can spot it.
+          if (!reply || cleaned.includes("[NO_REPLY]")) {
+            const exact = !reply || cleaned === "[NO_REPLY]";
+            if (exact) {
+              log.info({ channel: msg.channel, key }, "slack: agent chose not to reply");
+            } else {
+              log.warn(
+                { channel: msg.channel, key, reply },
+                "slack: [NO_REPLY] sentinel mixed with content; suppressing send",
+              );
+            }
             if (messageId) await Message.updateDeliveryStatus(messageId, "sent").catch(() => {});
             return;
           }

package/src/core/runner.ts

@@ -56,10 +56,24 @@ async function runJobWithCodex(fullPrompt: string, cwd: string, model: string):
     args.splice(3, 0, "-m", model);
   }
 
+  const CODEX_EXCLUDED = new Set([
+    "ANTHROPIC_API_KEY",
+    "OPENAI_API_KEY",
+    "GEMINI_API_KEY",
+    "SLACK_BOT_TOKEN",
+    "SLACK_APP_TOKEN",
+    "TELEGRAM_BOT_TOKEN",
+    "TWILIO_AUTH_TOKEN",
+    "DATABASE_URL",
+  ]);
+  const codexEnv = Object.fromEntries(
+    Object.entries(process.env).filter(([k]) => !CODEX_EXCLUDED.has(k))
+  );
+
   const proc = Bun.spawn(args, {
     stdout: "pipe",
     stderr: "pipe",
-    env: { ...process.env },
+    env: codexEnv,
   });
 
   const stdout = await new Response(proc.stdout).text();