[OutThisLife]

Lands #90011 by @liuhao1024 on current main (their commit; conflicts resolved in tools/env_passthrough.py).

The skill env-passthrough allowlist was a session-scoped ContextVar, but tool dispatch fans each tool call onto a worker whose context is a copy_context() snapshot taken at submit time (tools.thread_context.propagate_context_to_thread). A registration made inside skill_view's worker never reached the submitting thread's context, so the very next execute_code/terminal call re-snapshotted the original (empty) allowlist and the skill's declared env vars (prerequisites.env_vars / required_environment_variables) never passed through — the bundled notion/airtable/gif-search/teams skills failed out of the box (#90004). The allowlist is now a process-wide module-level set (matching the config-based allowlist, which was already a module global). Cross-session exposure is limited to the NAMES: values still resolve per profile through resolve_passthrough_value's secret scope, and the provider-credential blocklist (GHSA-rhgp-j443-p4rf) still applies at registration.

• Fixes Skill-declared env var (prerequisites.env_vars) not passed through to execute_code on first use #90004
• Supersedes fix(skills): make env_passthrough registrations visible across tool context snapshots #90011

Conflict notes

• main had lightly reworded the ContextVar comment; took the PR's replacement comment block verbatim (it carries the full why).
• clear_env_passthrough (called by gateway session reset) keeps working — it clears the same set.

Tests

• tests/tools/test_env_passthrough.py — 30 passed (incl. the two new cross-snapshot visibility tests)
• tests/tools/test_skill_env_passthrough.py, tests/tools/test_skills_tool.py, tests/tools/environments — passed

Risk — low-medium: changes process-wide visibility of a security-adjacent allowlist, but only the NAMES cross sessions; values remain profile-scoped and credential-scrubbing is unchanged.

Lint: check-windows-footguns, check_bash_shebangs, check_no_tmp_literals (pre-existing main-only flag), check_config_yaml_writers, check_os_marker_fakes, ruff on changed files — all pass.

Side effects

1. Existing state: none — the allowlist was process-memory only (ContextVar → module-level set); nothing is persisted under HERMES_HOME, no config key or store shape changes. The test-fixture fix commit touches tests/tools/_child_env_fixtures.py only.
2. Version skew: none — tools/env_passthrough.py is core-process code; no client↔server, desktop↔remote-backend or plugin↔host contract changes. Plugins/skills call the same register_env_passthrough API unchanged.
3. Reserved values/invariants: none — no config default gains meaning; no existing assertion rewritten (the fixture change adapts isolation mechanics to the new set, preserving each test's contract: start-empty allowlist per test, restored after).
4. Other callers: every caller of _get_allowed/clear_env_passthrough was grepped — gateway session reset (clear), skill_view registration, execute_code/terminal/build_subprocess_env consumers. The full failing CI surface (test_build_subprocess_env, test_code_execution_modes, test_execute_code_approval_cluster, test_local_env_blocklist, test_env_passthrough, test_skill_env_passthrough) re-ran green locally (all lanes fail on the same fixture AttributeError, fixed by this commit).
5. Open findings: no reviewer/contributor comments with repros open on the PR; no unanswered findings.

[github-actions]

૮ >ﻌ< ა ci review

_{ran on acf6f9d — test(child-env): fixture isolates the process-wide skill pas}

⚠️ Warnings

CI timings · View report · View job

Wall time 7m28s vs 1m36s (+366.7%). 2 faster,

• Detect affected areas: -65.0s
• All required checks pass: -3.0s