pub fn agent_session_env(
spec_env: &HashMap<String, String>,
session_id: &str,
auth_env_name: Option<&str>,
) -> HashMap<String, String>Expand description
The cleared env for one agent CLI session, uniform across the spawning backends (claude/codex/droid/kimi/cursor).
base_homeis the session’s relocated scratchHOMEwhenspec_envcarries one (worker relocation, the auth probe’s candidate env), else a fresh per-session scratch home.- Every
spec_enventry crosses (it is engine-built:KRANZ_BASE_SHA,CLAUDE_CONFIG_DIR, git identity, egress-proxy vars). auth_env_nameis the ONE ambient var this backend may need to authenticate (ANTHROPIC_API_KEYfor claude,OPENAI_API_KEYfor codex, …): injected only when the operator actually has it set, and recorded name-only. AmbientGH_TOKEN/SLACK_*/AWS_*/GOOGLE_*never cross, regardless.