import path from 'node:path';
const SECRET_RE = /(?:key|token|secret|password|credential|auth|cookie)/i;
export function buildCodexSdkEnv(input) {
    const env = {};
    for (const [key, value] of Object.entries(process.env)) {
        if (value !== undefined)
            env[key] = String(value);
    }
    env.SKS_CODEX_CONTROL_PLANE = '1';
    env.SKS_PARENT_MISSION_ID = input.missionId;
    env.SKS_ROUTE = input.route;
    if (input.workItemId)
        env.SKS_WORK_ITEM_ID = input.workItemId;
    if (input.slotId)
        env.SKS_AGENT_SLOT_ID = input.slotId;
    if (input.sessionId)
        env.SKS_AGENT_SESSION_ID = input.sessionId;
    if (input.generationIndex !== undefined)
        env.SKS_AGENT_GENERATION_INDEX = String(input.generationIndex);
    env.SKS_SERVICE_TIER = 'fast';
    const isolatedRoot = path.resolve(input.mutationLedgerRoot, 'codex-sdk-home');
    env.HOME = path.join(isolatedRoot, 'home');
    env.CODEX_HOME = path.join(isolatedRoot, 'codex');
    env.SKS_CODEX_CONTROL_PLANE_CONFIG_ISOLATED = '1';
    return {
        env,
        proof: {
            injected_keys: Object.keys(env).filter((key) => key.startsWith('SKS_')).sort(),
            inherited_key_count: Object.keys(process.env).length,
            redacted_sensitive_keys: Object.keys(env).filter((key) => SECRET_RE.test(key)).sort(),
            codex_home_isolated: true,
            codex_home: env.CODEX_HOME,
            home: env.HOME
        }
    };
}
export function redactCodexSdkEnv(env) {
    return Object.fromEntries(Object.entries(env).map(([key, value]) => [key, SECRET_RE.test(key) ? '<redacted>' : value]));
}
//# sourceMappingURL=codex-sdk-env-policy.js.map