[katulevskiy]

Upstream mirror

Source: zeronsh#330
Original author: @labkita7
Original revision: 07f3add96a6ff3ff031a7c676e9d905f7f8eaece

This PR is an isolated Contribution Manager pilot mirror. Its reviews, checks and merge state are separate from upstream. An empty [skip ci] commit suppresses automatic bulk CI; the code tree matches the imported upstream revision.

---

Problem

When zeron runs as a headed app (Dock/Finder/launchd/systemd), the daemon never runs shell init, so harness children inherit a minimal environment. The login-shell snapshot (crates/harness/src/shell_env.rs) already fixes PATH resolution — but it kept only PATH and dropped every other export. Provider CLIs behind the harnesses (pi via pi-acp, and the rest) that read custom variables configured in ~/.bashrc / ~/.zshrc — API keys, base URLs, proxy settings — therefore failed even though the same CLIs work fine from the user's terminal.

Fix

• The snapshot now keeps the full environment dumped between the markers (LoginShellEnv { path, vars }), with the same hostile-init defenses (last-begin-marker parse, PATH-presence validity gate, probe-marker drop).
• compose_path — the single choke point every harness child spawn goes through (pi/ACP, Claude, Codex, Cursor, opencode, npm adapter installs, engine git/gh) — now also forwards snapshot variables the daemon's own environment doesn't already define. Explicit process env always wins; PWD/OLDPWD/SHLVL/_ and the probe's own ZERON_RESOLVING_ENVIRONMENT / TERM=dumb pairs are never forwarded.
• ZERON_NO_LOGIN_SHELL_ENV=1 opts out of variable forwarding while keeping the PATH composition (ZERON_NO_LOGIN_SHELL=1 still disables the snapshot entirely).

Verification

• cargo test -p zeron-harness --tests: 13 test binaries, 207 passed, 0 failed (10 ignored real-lifecycle tests by design).
• New/extended tests:
  • unit: full-env parse (PATH excluded from vars), probe-pair dropping, duplicate keys, no-PATH dumps rejected, fake-shell end-to-end snapshot;
  • shell_env_resolution e2e: a var exported by the fake login shell reaches a spawned child command, an existing process var is not overridden, the probe marker never leaks.
• cargo fmt --check clean for the touched files; remaining clippy/fmt findings in the crate are pre-existing on main (unrelated files, not touched here).

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[contribution-manager-katulevskiy]

Contribution Manager

needs triage · medium risk · untriaged

Open review workspace · Revision 7d0c4517

Next actions:

• Direction decision needed
• Scope, risk, and platform triage needed
• Independent code review needed
• Required check: core-tests (missing)

This summary is maintained by the review app. Decisions and test evidence are recorded in the workspace; the app does not merge PRs.