praxis-agent 0.31.0 → 0.32.0

package/dist/hooks/claude-hooks.js

@@ -1,4 +1,5 @@
 import { spawn } from 'node:child_process';
+import { basename, isAbsolute, resolve } from 'node:path';
 import { commandShell, commandShellArguments, } from '../platform/command-shell.js';
 import { redactSensitiveText, sanitizeChildEnvironment, sensitiveEnvironmentValues, } from '../platform/sensitive-data.js';
 const DEFAULT_TIMEOUT_MS = 10 * 60 * 1000;
@@ -11,12 +12,23 @@ export const HOOK_EVENTS = [
     'UserPromptSubmit',
     'PreToolUse',
     'PermissionRequest',
+    'PermissionDenied',
     'PostToolUse',
     'PostToolUseFailure',
+    'Notification',
     'Stop',
+    'StopFailure',
     'SubagentStop',
+    'PreCompact',
+    'PostCompact',
+    'TaskCreated',
+    'TaskCompleted',
+    'InstructionsLoaded',
+    'CwdChanged',
+    'FileChanged',
     'SessionEnd',
 ];
+const EXECUTABLE_HOOK_EVENTS = new Set(HOOK_EVENTS);
 function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
@@ -33,6 +45,7 @@ function combinedSensitiveValues(...groups) {
 }
 function eventSettings(settings, event, maxTimeoutMs) {
     const matchers = [];
+    let hookIndex = 0;
     for (const resource of settings) {
         if (!isRecord(resource.value) || !isRecord(resource.value.hooks))
             continue;
@@ -64,6 +77,8 @@ function eventSettings(settings, event, maxTimeoutMs) {
                 }
             }
             const hooks = group.hooks.flatMap((hook) => {
+                const currentHookIndex = hookIndex;
+                hookIndex += 1;
                 if (!isRecord(hook) || hook.type !== 'command')
                     return [];
                 const command = nonEmptyString(hook.command, `Claude ${event} hook command`);
@@ -73,10 +88,15 @@ function eventSettings(settings, event, maxTimeoutMs) {
                     timeoutSeconds <= 0) {
                     throw new Error(`Invalid Claude ${event} hook timeout: ${resource.path}`);
                 }
+                if (hook.async !== undefined && typeof hook.async !== 'boolean') {
+                    throw new Error(`Invalid Claude ${event} hook async: ${resource.path}`);
+                }
                 return [
                     {
                         command,
                         timeoutMs: Math.min(timeoutSeconds * 1000, maxTimeoutMs),
+                        asynchronous: hook.async === true,
+                        hookIndex: currentHookIndex,
                         ...(resource.environment === undefined
                             ? {}
                             : { environment: resource.environment }),
@@ -93,6 +113,32 @@ function eventSettings(settings, event, maxTimeoutMs) {
     }
     return matchers;
 }
+function fileChangedMatcherPaths(settings, cwd) {
+    const paths = [];
+    for (const resource of settings) {
+        if (!isRecord(resource.value) || !isRecord(resource.value.hooks))
+            continue;
+        const groups = resource.value.hooks.FileChanged;
+        if (!Array.isArray(groups))
+            continue;
+        for (const group of groups) {
+            if (!isRecord(group) || !Array.isArray(group.hooks))
+                continue;
+            if (!group.hooks.some((hook) => isRecord(hook) && hook.type === 'command')) {
+                continue;
+            }
+            if (typeof group.matcher !== 'string')
+                continue;
+            for (const candidate of group.matcher.split('|')) {
+                const path = candidate.trim();
+                if (!path)
+                    continue;
+                paths.push(isAbsolute(path) ? path : resolve(cwd, path));
+            }
+        }
+    }
+    return [...new Set(paths)];
+}
 export function validateClaudeHooks(settings, maxTimeoutMs = DEFAULT_TIMEOUT_MS) {
     if (!Number.isFinite(maxTimeoutMs) ||
         maxTimeoutMs <= 0 ||
@@ -130,6 +176,38 @@ function permissionBehavior(value) {
         ? value
         : undefined;
 }
+function hookMatcherValue(input) {
+    switch (input.hook_event_name) {
+        case 'Setup':
+            return optionalString(input.trigger) ?? '';
+        case 'SessionStart':
+            return optionalString(input.source) ?? '';
+        case 'SubagentStart':
+        case 'SubagentStop':
+            return optionalString(input.agent_type) ?? '';
+        case 'PreToolUse':
+        case 'PermissionRequest':
+        case 'PermissionDenied':
+        case 'PostToolUse':
+        case 'PostToolUseFailure':
+            return optionalString(input.tool_name) ?? '';
+        case 'Notification':
+            return optionalString(input.notification_type) ?? '';
+        case 'StopFailure':
+            return optionalString(input.error) ?? '';
+        case 'PreCompact':
+        case 'PostCompact':
+            return optionalString(input.trigger) ?? '';
+        case 'InstructionsLoaded':
+            return optionalString(input.load_reason) ?? '';
+        case 'FileChanged':
+            return basename(optionalString(input.file_path) ?? '');
+        case 'SessionEnd':
+            return optionalString(input.reason) ?? '';
+        default:
+            return '';
+    }
+}
 function abortError() {
     return new DOMException('Hook execution aborted', 'AbortError');
 }
@@ -140,13 +218,17 @@ export class ClaudeHookRunner {
     executeCommand;
     onEvent;
     cwd;
-    constructor(options) {
+    sessionEnvironment;
+    asynchronousHooks;
+    constructor(options, asynchronousHooks = new Map()) {
         this.settings = options.settings;
         this.maxOutputBytes = options.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES;
         this.maxTimeoutMs = options.maxTimeoutMs ?? DEFAULT_TIMEOUT_MS;
         this.executeCommand = options.executeCommand ?? this.runCommand.bind(this);
         this.onEvent = options.onEvent;
         this.cwd = options.cwd;
+        this.sessionEnvironment = options.sessionEnvironment;
+        this.asynchronousHooks = asynchronousHooks;
     }
     withAdditionalSettings(settings) {
         return new ClaudeHookRunner({
@@ -155,25 +237,40 @@ export class ClaudeHookRunner {
             maxTimeoutMs: this.maxTimeoutMs,
             executeCommand: this.executeCommand,
             ...(this.onEvent ? { onEvent: this.onEvent } : {}),
+            ...(this.sessionEnvironment
+                ? { sessionEnvironment: this.sessionEnvironment }
+                : {}),
             cwd: this.cwd,
-        });
+        }, this.asynchronousHooks);
+    }
+    fileChangedWatchPaths(cwd = this.cwd) {
+        return fileChangedMatcherPaths(this.settings, cwd);
     }
     async run(input, matcherValue, signal) {
         if (signal?.aborted)
             throw abortError();
+        if (!EXECUTABLE_HOOK_EVENTS.has(input.hook_event_name)) {
+            return { executions: [], additionalContext: [] };
+        }
+        const matchQuery = matcherValue ?? hookMatcherValue(input);
         const ambientSensitiveValues = sensitiveEnvironmentValues(process.env);
-        const groups = eventSettings(this.settings, input.hook_event_name, this.maxTimeoutMs).filter((group) => !group.matcher || group.matcher.test(matcherValue ?? ''));
+        const groups = eventSettings(this.settings, input.hook_event_name, this.maxTimeoutMs).filter((group) => input.hook_event_name === 'CwdChanged' ||
+            !group.matcher ||
+            group.matcher.test(matchQuery));
         const executions = [];
         const additionalContext = [];
         let updatedInput;
         let permissionDecision;
         let permissionDecisionReason;
+        let retry = false;
+        const watchPaths = [];
+        const systemMessages = [];
         let blockedReason;
         for (const group of groups) {
             for (const hook of group.hooks) {
                 const sensitiveValues = combinedSensitiveValues(ambientSensitiveValues, hook.sensitiveValues);
                 const hookId = crypto.randomUUID();
-                const hookName = `${input.hook_event_name}${matcherValue ? `:${matcherValue}` : ''}`;
+                const hookName = `${input.hook_event_name}${matchQuery ? `:${matchQuery}` : ''}`;
                 this.onEvent?.({
                     type: 'started',
                     hookId,
@@ -199,8 +296,57 @@ export class ClaudeHookRunner {
                         output,
                     });
                 };
+                const executionEnvironment = await this.executionEnvironment(input, hook);
+                if (hook.asynchronous) {
+                    const controller = new AbortController();
+                    const pending = this.executeCommand(hook.command, input, hook.timeoutMs, controller.signal, reportProgress, executionEnvironment)
+                        .finally(() => this.invalidateSessionEnvironment(input))
+                        .then((result) => {
+                        const stdout = redactSensitiveText(result.stdout, sensitiveValues);
+                        const stderr = redactSensitiveText(result.stderr, sensitiveValues);
+                        const output = redactSensitiveText(result.output ?? `${result.stdout}${result.stderr}`, sensitiveValues);
+                        const outputExceeded = Buffer.byteLength(stdout) + Buffer.byteLength(stderr) >
+                            this.maxOutputBytes;
+                        this.onEvent?.({
+                            type: 'response',
+                            hookId,
+                            hookName,
+                            hookEvent: input.hook_event_name,
+                            stdout: outputExceeded ? '' : stdout,
+                            stderr: outputExceeded
+                                ? 'Hook output exceeded byte limit'
+                                : stderr,
+                            output: outputExceeded
+                                ? 'Hook output exceeded byte limit'
+                                : output,
+                            exitCode: outputExceeded ? 1 : result.exitCode,
+                            outcome: outputExceeded || result.exitCode !== 0 ? 'error' : 'success',
+                        });
+                    })
+                        .catch((error) => {
+                        const message = redactSensitiveText(hookErrorMessage(error), sensitiveValues);
+                        this.onEvent?.({
+                            type: 'response',
+                            hookId,
+                            hookName,
+                            hookEvent: input.hook_event_name,
+                            output: message,
+                            stdout: '',
+                            stderr: message,
+                            ...(hookWasCancelled(error, controller.signal)
+                                ? {}
+                                : { exitCode: 1 }),
+                            outcome: hookWasCancelled(error, controller.signal)
+                                ? 'cancelled'
+                                : 'error',
+                        });
+                    });
+                    this.asynchronousHooks.set(pending, controller);
+                    void pending.finally(() => this.asynchronousHooks.delete(pending));
+                    continue;
+                }
                 try {
-                    result = await this.executeCommand(hook.command, input, hook.timeoutMs, signal, reportProgress, hook.environment);
+                    result = await this.executeCommand(hook.command, input, hook.timeoutMs, signal, reportProgress, executionEnvironment);
                 }
                 catch (error) {
                     const message = redactSensitiveText(hookErrorMessage(error), sensitiveValues);
@@ -218,6 +364,9 @@ export class ClaudeHookRunner {
                     });
                     throw error;
                 }
+                finally {
+                    this.invalidateSessionEnvironment(input);
+                }
                 const toolUseId = optionalString(input.tool_use_id) ?? crypto.randomUUID();
                 const stdout = redactSensitiveText(result.stdout, sensitiveValues);
                 const stderr = redactSensitiveText(result.stderr, sensitiveValues);
@@ -288,6 +437,22 @@ export class ClaudeHookRunner {
                 permissionDecisionReason = nextPermissionReason
                     ? redactSensitiveText(nextPermissionReason, sensitiveValues)
                     : permissionDecisionReason;
+                if (input.hook_event_name === 'PermissionDenied' &&
+                    specific?.hookEventName === 'PermissionDenied' &&
+                    specific.retry === true) {
+                    retry = true;
+                }
+                if ((input.hook_event_name === 'CwdChanged' ||
+                    input.hook_event_name === 'FileChanged') &&
+                    specific?.hookEventName === input.hook_event_name &&
+                    Array.isArray(specific.watchPaths) &&
+                    specific.watchPaths.every((path) => typeof path === 'string')) {
+                    watchPaths.push(...specific.watchPaths);
+                }
+                const systemMessage = optionalString(parsedOutput?.systemMessage);
+                if (systemMessage) {
+                    systemMessages.push(redactSensitiveText(systemMessage, sensitiveValues));
+                }
                 if (parsedOutput?.continue === false ||
                     parsedOutput?.decision === 'block') {
                     blockedReason = redactSensitiveText(optionalString(parsedOutput.stopReason) ??
@@ -305,9 +470,69 @@ export class ClaudeHookRunner {
             ...(updatedInput ? { updatedInput } : {}),
             ...(permissionDecision ? { permissionDecision } : {}),
             ...(permissionDecisionReason ? { permissionDecisionReason } : {}),
+            ...(retry ? { retry } : {}),
+            ...(watchPaths.length > 0 ? { watchPaths } : {}),
+            ...(systemMessages.length > 0 ? { systemMessages } : {}),
             ...(blockedReason ? { blockedReason } : {}),
         };
     }
+    async drainAsync(timeoutMs) {
+        if (!Number.isFinite(timeoutMs) || timeoutMs < 0) {
+            throw new Error('Hook async drain timeout must be non-negative');
+        }
+        const pending = [...this.asynchronousHooks.keys()];
+        if (pending.length === 0)
+            return;
+        let timer;
+        const timeout = new Promise((resolve) => {
+            timer = setTimeout(() => resolve('timeout'), timeoutMs);
+        });
+        try {
+            if ((await Promise.race([
+                Promise.allSettled(pending).then(() => 'settled'),
+                timeout,
+            ])) === 'timeout') {
+                for (const controller of this.asynchronousHooks.values()) {
+                    controller.abort();
+                }
+                // Give cooperative executors one event-loop turn to publish their
+                // cancelled response. Keep the wait bounded because custom executors
+                // are allowed to ignore AbortSignal entirely.
+                await Promise.race([
+                    Promise.allSettled(pending),
+                    new Promise((resolve) => setTimeout(resolve, 0)),
+                ]);
+                // Executors normally terminate their child process on abort. A custom
+                // executor may ignore cancellation, so shutdown abandons tracking
+                // after the deadline instead of turning a bounded drain into an
+                // unbounded wait.
+                this.asynchronousHooks.clear();
+            }
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
+    }
+    async clearCwdEnvironment(sessionId) {
+        await this.sessionEnvironment?.clearCwdFiles(sessionId);
+    }
+    async executionEnvironment(input, hook) {
+        if (!this.sessionEnvironment ||
+            !['Setup', 'SessionStart', 'CwdChanged', 'FileChanged'].includes(input.hook_event_name)) {
+            return hook.environment;
+        }
+        const environmentFile = await this.sessionEnvironment.hookFile(input.session_id, input.hook_event_name, hook.hookIndex);
+        return {
+            ...hook.environment,
+            ...(environmentFile ? { CLAUDE_ENV_FILE: environmentFile } : {}),
+        };
+    }
+    invalidateSessionEnvironment(input) {
+        if (['Setup', 'SessionStart', 'CwdChanged', 'FileChanged'].includes(input.hook_event_name)) {
+            this.sessionEnvironment?.invalidate(input.session_id);
+        }
+    }
     runCommand(command, input, timeoutMs, signal, onProgress, environment) {
         return new Promise((resolve, reject) => {
             const startedAt = Date.now();

package/dist/hooks/claude-session-environment.d.ts

@@ -0,0 +1,16 @@
+export type ClaudeEnvironmentHookEvent = 'Setup' | 'SessionStart' | 'CwdChanged' | 'FileChanged';
+export interface ClaudeSessionEnvironmentOptions {
+    stateRoot: string;
+    warn?(message: string): void;
+}
+export declare class ClaudeSessionEnvironment {
+    private readonly options;
+    private readonly cache;
+    constructor(options: ClaudeSessionEnvironmentOptions);
+    hookFile(sessionId: string, event: ClaudeEnvironmentHookEvent, hookIndex: number): Promise<string | undefined>;
+    invalidate(sessionId: string): void;
+    clearCwdFiles(sessionId: string): Promise<void>;
+    environment(sessionId: string): Promise<Readonly<Record<string, string>> | undefined>;
+    private directory;
+}
+//# sourceMappingURL=claude-session-environment.d.ts.map

package/dist/hooks/claude-session-environment.js

@@ -0,0 +1,112 @@
+import { mkdir, readFile, readdir, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+const ENV_FILE = /^(setup|sessionstart|cwdchanged|filechanged)-hook-(\d+)\.sh$/u;
+const PRIORITY = {
+    setup: 0,
+    sessionstart: 1,
+    cwdchanged: 2,
+    filechanged: 3,
+};
+export class ClaudeSessionEnvironment {
+    options;
+    cache = new Map();
+    constructor(options) {
+        this.options = options;
+    }
+    async hookFile(sessionId, event, hookIndex) {
+        if (process.platform === 'win32')
+            return undefined;
+        const directory = this.directory(sessionId);
+        await mkdir(directory, { recursive: true });
+        this.invalidate(sessionId);
+        return join(directory, `${event.toLowerCase()}-hook-${hookIndex}.sh`);
+    }
+    invalidate(sessionId) {
+        this.cache.delete(sessionId);
+    }
+    async clearCwdFiles(sessionId) {
+        const directory = this.directory(sessionId);
+        try {
+            const files = await readdir(directory);
+            await Promise.all(files
+                .filter((file) => ENV_FILE.test(file) &&
+                (file.startsWith('cwdchanged-') ||
+                    file.startsWith('filechanged-')))
+                .map((file) => writeFile(join(directory, file), '')));
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT') {
+                this.options.warn?.(`Could not clear hook environment: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+        this.invalidate(sessionId);
+    }
+    async environment(sessionId) {
+        if (process.platform === 'win32')
+            return undefined;
+        const cached = this.cache.get(sessionId);
+        if (cached !== undefined)
+            return cached ?? undefined;
+        const directory = this.directory(sessionId);
+        const environment = Object.create(null);
+        try {
+            const files = (await readdir(directory))
+                .filter((file) => ENV_FILE.test(file))
+                .sort((left, right) => {
+                const leftMatch = left.match(ENV_FILE);
+                const rightMatch = right.match(ENV_FILE);
+                const priority = (PRIORITY[leftMatch?.[1] ?? ''] ?? 99) -
+                    (PRIORITY[rightMatch?.[1] ?? ''] ?? 99);
+                if (priority !== 0)
+                    return priority;
+                return Number(leftMatch?.[2] ?? 0) - Number(rightMatch?.[2] ?? 0);
+            });
+            for (const file of files) {
+                const path = join(directory, file);
+                const content = await readFile(path, 'utf8');
+                for (const [index, line] of content.split(/\r?\n/u).entries()) {
+                    const trimmed = line.trim();
+                    if (!trimmed || trimmed.startsWith('#'))
+                        continue;
+                    const match = trimmed.match(/^export\s+([A-Za-z_][A-Za-z0-9_]*)=(.*)$/u);
+                    const name = match?.[1];
+                    const source = match?.[2];
+                    const value = source === undefined ? undefined : literalExportValue(source);
+                    if (!name || value === undefined) {
+                        this.options.warn?.(`Ignored unsafe CLAUDE_ENV_FILE entry at ${path}:${index + 1}`);
+                        continue;
+                    }
+                    environment[name] = value;
+                }
+            }
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT') {
+                this.options.warn?.(`Could not load hook environment: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+        const result = Object.keys(environment).length > 0 ? { ...environment } : null;
+        this.cache.set(sessionId, result);
+        return result ?? undefined;
+    }
+    directory(sessionId) {
+        return join(this.options.stateRoot, 'session-env', sessionId);
+    }
+}
+function literalExportValue(source) {
+    const value = source.trim();
+    if (value === '')
+        return '';
+    if (value.startsWith("'") && value.endsWith("'")) {
+        const literal = value.slice(1, -1);
+        return literal.includes("'") ? undefined : literal;
+    }
+    if (value.startsWith('"') && value.endsWith('"')) {
+        const literal = value.slice(1, -1);
+        if (literal.includes('$') || literal.includes('`'))
+            return undefined;
+        return literal.replace(/\\(["\\])/gu, '$1');
+    }
+    return /^[A-Za-z0-9_./:@%+,=-]*$/u.test(value) ? value : undefined;
+}
+//# sourceMappingURL=claude-session-environment.js.map

package/dist/tools/claude-task-tools.d.ts

@@ -1,5 +1,6 @@
 import type { ModelToolCall, ModelToolDefinition, ToolExecutionContext, ToolExecutionResult, ToolRegistry, RuntimeEventSink } from '../core/runtime.js';
 import { type BackgroundBashSnapshot, type BackgroundBashToolResult } from '../application/background-bash-manager.js';
+import { type ClaudeTask } from '../persistence/claude-task-store.js';
 export interface ClaudeTaskToolRegistryOptions {
     base: ToolRegistry;
     cwd: string;
@@ -10,6 +11,10 @@ export interface ClaudeTaskToolRegistryOptions {
     enabledTools?: readonly string[];
     maxOutputBytes?: number;
     eventSink?: RuntimeEventSink;
+    taskHooks?: {
+        created(task: Readonly<ClaudeTask>, signal?: AbortSignal): Promise<void>;
+        completed(task: Readonly<ClaudeTask>, signal?: AbortSignal): Promise<void>;
+    };
 }
 export declare class ClaudeTaskToolRegistry implements ToolRegistry {
     private readonly options;

package/dist/tools/claude-task-tools.js

@@ -342,6 +342,13 @@ export class ClaudeTaskToolRegistry {
         switch (call.name) {
             case 'TaskCreate': {
                 const task = await this.store.create(this.createInput(call.input));
+                try {
+                    await this.options.taskHooks?.created(task, context.signal);
+                }
+                catch (error) {
+                    await this.store.update(task.id, { status: 'deleted' });
+                    throw error;
+                }
                 return {
                     content: `Task #${task.id} created successfully: ${task.subject}`,
                     isError: false,
@@ -374,7 +381,14 @@ export class ClaudeTaskToolRegistry {
             }
             case 'TaskUpdate': {
                 const id = stringField(call.input, 'taskId');
-                const result = await this.store.update(id, this.updateInput(call.input));
+                const update = this.updateInput(call.input);
+                if (update.status === 'completed') {
+                    const task = await this.store.get(id);
+                    if (task && task.status !== 'completed') {
+                        await this.options.taskHooks?.completed(task, context.signal);
+                    }
+                }
+                const result = await this.store.update(id, update);
                 const missing = {
                     success: false,
                     taskId: id,

package/dist/tools/local-tools.d.ts

@@ -11,6 +11,7 @@ export interface LocalToolRegistryOptions {
     maxShellTimeoutMs?: number;
     enableReportFindings?: boolean;
     environment?: Readonly<Record<string, string>>;
+    sessionEnvironment?: (sessionId: string) => Promise<Readonly<Record<string, string>> | undefined>;
     sandbox?: BashSandboxRuntime;
     homeDirectory?: string;
     configRoot?: string;
@@ -44,6 +45,7 @@ export declare class LocalToolRegistry implements ToolRegistry {
     private readonly processRunner;
     private readonly enableReportFindings;
     private readonly environment;
+    private readonly sessionEnvironment;
     private readonly sandbox;
     private readonly homeDirectory;
     private readonly configRoot;

package/dist/tools/local-tools.js

@@ -509,6 +509,7 @@ export class LocalToolRegistry {
     processRunner;
     enableReportFindings;
     environment;
+    sessionEnvironment;
     sandbox;
     homeDirectory;
     configRoot;
@@ -526,6 +527,7 @@ export class LocalToolRegistry {
         this.maxShellTimeoutMs = options.maxShellTimeoutMs ?? 120_000;
         this.enableReportFindings = options.enableReportFindings ?? false;
         this.environment = options.environment;
+        this.sessionEnvironment = options.sessionEnvironment;
         this.sandbox = options.sandbox;
         this.homeDirectory = options.homeDirectory
             ? resolve(options.homeDirectory)
@@ -1258,18 +1260,21 @@ export class LocalToolRegistry {
             throw new Error('Prepared Bash call has no timeout');
         const rawCommand = stringInput(call.input, 'command');
         this.assertProtectedBashCommand(rawCommand, context);
-        const sandboxInput = {
+        const sandboxPolicyInput = {
             command: rawCommand,
             ...(call.input.dangerouslyDisableSandbox === true
                 ? { dangerouslyDisableSandbox: true }
                 : {}),
         };
-        const sandboxed = this.sandbox?.shouldUseSandbox(sandboxInput) ?? false;
+        const sandboxed = this.sandbox?.shouldUseSandbox(sandboxPolicyInput) ?? false;
         const shell = commandShell();
         let result;
         try {
+            const sessionEnvironment = context.sessionId
+                ? await this.sessionEnvironment?.(context.sessionId)
+                : undefined;
             const command = sandboxed
-                ? await this.sandbox?.wrapCommand(sandboxInput, {
+                ? await this.sandbox?.wrapCommand(sandboxPolicyInput, {
                     shell,
                     ...(context.signal ? { signal: context.signal } : {}),
                     commandId: call.id,
@@ -1280,7 +1285,9 @@ export class LocalToolRegistry {
                 args: commandShellArguments(command ?? rawCommand),
                 timeoutMs: timeout,
                 cwd: this.currentCwd(context),
-                ...(this.environment ? { env: this.environment } : {}),
+                ...(this.environment || sessionEnvironment
+                    ? { env: { ...this.environment, ...sessionEnvironment } }
+                    : {}),
                 ...(context.signal ? { signal: context.signal } : {}),
             });
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "praxis-agent",
-  "version": "0.31.0",
+  "version": "0.32.0",
   "description": "Local-first, single-user general agent for the command line.",
   "license": "MIT",
   "author": "wuqisen",