From 9f1b20f9a1c81105766f0d1191a859ab1e6d87ea Mon Sep 17 00:00:00 2001
From: junior <junior@ricon.family>
Date: Wed, 15 Jul 2026 21:39:50 -0400
Subject: [PATCH 1/5] fix: preserve harness child boundary

---
 .mise/tasks/run                      |  40 ++++----
 CONTRIBUTING.md                      |   1 +
 README.md                            |   2 +
 README.tsx                           |   6 ++
 cli/lib/cli.ex                       |   5 +-
 cli/lib/cli/engine.ex                |  12 ++-
 cli/lib/harness/pi/command.ex        |  29 +++++-
 cli/test/engine_test.exs             | 138 ++++++++++++++++++++++-----
 cli/test/harness/pi/command_test.exs |  89 ++++++++++-------
 lib/harness-env.sh                   |  14 ++-
 lib/harness/claude.sh                |   6 ++
 lib/harness/pi.sh                    |  33 +++++++
 test/helpers.bash                    |  16 ++--
 test/ps.bats                         |   2 +-
 test/run.bats                        |  35 ++++---
 test/wake.bats                       |   2 +-
 16 files changed, 320 insertions(+), 110 deletions(-)

diff --git a/.mise/tasks/run b/.mise/tasks/run
index 6a655f1..a2504b6 100755
--- a/.mise/tasks/run
+++ b/.mise/tasks/run
@@ -59,6 +59,8 @@ source "$MISE_CONFIG_ROOT/lib/processes.sh"
 
 PROMPT_TEMP_FILE=""
 PROCESS_START_ID=""
+HARNESS_NAME=""
+HARNESS_EXECUTABLE=""
 # shellcheck disable=SC2329  # Invoked by EXIT trap below.
 cleanup_prompt_temp() {
   if [ -n "$PROMPT_TEMP_FILE" ]; then
@@ -234,6 +236,18 @@ fi
 
 sessions_validate_project_trust "$PROJECT_TRUST" || exit 1
 
+# Resolve the selected harness and its Sessions-owned executable before any
+# launch environment is sanitized. Unsupported skeleton adapters may return no
+# executable and retain their adapter-level rejection in the Elixir boundary.
+if [ -n "$SESSION" ]; then
+  HARNESS_NAME=$(harness_resolve --session "$SESSION") || exit 1
+else
+  HARNESS_NAME=$(harness_resolve) || exit 1
+fi
+# shellcheck source=/dev/null
+source "$MISE_CONFIG_ROOT/lib/harness/$HARNESS_NAME.sh"
+HARNESS_EXECUTABLE=$(harness_call "$HARNESS_NAME" executable "$MISE_CONFIG_ROOT") || exit 1
+
 # Prompt resolution order:
 #   1. Explicit --system-prompt-file
 #   2. Latest system_prompt entry baked into --session by `sessions new`
@@ -284,33 +298,16 @@ HEADLESS_EOF
 fi
 
 run_interactive() {
-  # shellcheck source=../../lib/harness/dispatch.sh
-  source "$MISE_CONFIG_ROOT/lib/harness/dispatch.sh"
-
-  local harness_name
-  if [ -n "$SESSION" ]; then
-    harness_name=$(harness_resolve --session "$SESSION") || exit 1
-  else
-    harness_name=$(harness_resolve) || exit 1
-  fi
-  # shellcheck source=/dev/null
-  source "$MISE_CONFIG_ROOT/lib/harness/$harness_name.sh"
-
-  if [ "$harness_name" != "pi" ]; then
-    echo "sessions: '$harness_name' harness does not support interactive no-message run yet" >&2
+  if [ "$HARNESS_NAME" != "pi" ]; then
+    echo "sessions: '$HARNESS_NAME' harness does not support interactive no-message run yet" >&2
     exit "$HARNESS_UNSUPPORTED_EXIT"
   fi
 
   sessions_prepare_harness_env
 
-  local -a pi_command=(mise -C "$MISE_CONFIG_ROOT" exec -- pi)
-  if ! command -v mise >/dev/null 2>&1; then
-    echo "Error: mise not found on PATH for sessions-owned pi harness" >&2
-    exit 1
-  fi
-
+  local -a pi_command=("$HARNESS_EXECUTABLE")
   local project_trust_flag
-  project_trust_flag=$(harness_call "$harness_name" project_trust_flag "$PROJECT_TRUST") || exit 1
+  project_trust_flag=$(harness_call "$HARNESS_NAME" project_trust_flag "$PROJECT_TRUST") || exit 1
 
   local pi_args=(--model "$MODEL")
   [ -n "$project_trust_flag" ] && pi_args+=("$project_trust_flag")
@@ -354,6 +351,7 @@ CLI_ARGS=(--cwd "$CWD")
 [ -n "$TIMEOUT" ] && CLI_ARGS+=(--timeout "$TIMEOUT")
 CLI_ARGS+=(--model "$MODEL")
 [ -n "$SESSION" ] && CLI_ARGS+=(--session "$SESSION")
+[ -n "$HARNESS_EXECUTABLE" ] && CLI_ARGS+=(--harness-executable "$HARNESS_EXECUTABLE")
 CLI_ARGS+=(--project-trust "$PROJECT_TRUST")
 [ "$EXTENSIONS" != "true" ] && CLI_ARGS+=(--no-extensions)
 [ "$SKILLS" != "true" ] && CLI_ARGS+=(--no-skills)
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 7008edb..2dce80b 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -12,6 +12,7 @@ Keep these generic in core task/library code:
 
 Keep harness-specific knowledge in `lib/harness/<name>.sh` and `lib/harness/<name>.py`:
 
+- exact executable resolution from Sessions' declared tool context;
 - session file locations and path encoding;
 - native JSONL message schemas;
 - launch arguments for a harness binary;
diff --git a/README.md b/README.md
index 4e4fd5c..401d079 100644
--- a/README.md
+++ b/README.md
@@ -115,6 +115,8 @@ sessions wake review/pr-50 --model openai-codex/gpt-5.5 --message "You missed th
 
 The spawning stack uses [shell](https://github.com/KnickKnackLabs/shell) for persistent zmx sessions. `sessions wake` calls `sessions run` as its hidden low-level executor. For profile-specific sessions, use `new` + `wake`: bake profile or task instructions into the session with `--system-prompt-file` at creation, then wake it with task messages. If no explicit or baked prompt exists, the harness starts without an appended prompt and can rely on its native cwd context discovery.
 
+Before launch, Sessions resolves the selected harness executable from its own declared toolchain. The child then starts in the requested `--cwd` with Sessions' mise task context and direct tool-install paths removed. This keeps the harness version pinned without replacing the target project or agent home's own tool and resource context.
+
 `sessions run` remains available as an advanced/compatibility command. It accepts an explicit `--system-prompt-file`, uses any prompt baked into the session, and otherwise starts without appending a system prompt. Caller-provided context belongs to the caller, not to `sessions`.
 
 `--model` on `sessions wake` is required and is not remembered across wakes — pass a provider-qualified model (for example `openai-codex/gpt-5.5`) on each wake.
diff --git a/README.tsx b/README.tsx
index 175ae5c..17bcfd3 100644
--- a/README.tsx
+++ b/README.tsx
@@ -232,6 +232,12 @@ sessions wake review/pr-50 --model openai-codex/gpt-5.5 --message "You missed th
         {" at creation, then wake it with task messages. If no explicit or baked prompt exists, the harness starts without an appended prompt and can rely on its native cwd context discovery."}
       </Paragraph>
 
+      <Paragraph>
+        {"Before launch, Sessions resolves the selected harness executable from its own declared toolchain. The child then starts in the requested "}
+        <Code>--cwd</Code>
+        {" with Sessions' mise task context and direct tool-install paths removed. This keeps the harness version pinned without replacing the target project or agent home's own tool and resource context."}
+      </Paragraph>
+
       <Paragraph>
         <Code>sessions run</Code>
         {" remains available as an advanced/compatibility command. It accepts an explicit "}
diff --git a/cli/lib/cli.ex b/cli/lib/cli.ex
index f959b72..c8be92c 100644
--- a/cli/lib/cli.ex
+++ b/cli/lib/cli.ex
@@ -55,6 +55,7 @@ defmodule Cli do
     skills = opts[:no_skills] != true
     prompt_templates = opts[:no_prompt_templates] != true
     project_trust = opts[:project_trust] || "inherit"
+    harness_executable = opts[:harness_executable]
 
     print_header(opts, message, timeout, model)
 
@@ -75,7 +76,8 @@ defmodule Cli do
           extensions: extensions,
           skills: skills,
           prompt_templates: prompt_templates,
-          project_trust: project_trust
+          project_trust: project_trust,
+          harness_executable: harness_executable
         )
     end
   end
@@ -129,6 +131,7 @@ defmodule Cli do
           no_skills: :boolean,
           no_prompt_templates: :boolean,
           project_trust: :string,
+          harness_executable: :string,
           help: :boolean
         ],
         aliases: [h: :help]
diff --git a/cli/lib/cli/engine.ex b/cli/lib/cli/engine.ex
index 0ee5655..d63783f 100644
--- a/cli/lib/cli/engine.ex
+++ b/cli/lib/cli/engine.ex
@@ -20,7 +20,8 @@ defmodule Cli.Engine do
            extensions: boolean(),
            skills: boolean(),
            prompt_templates: boolean(),
-           project_trust: String.t()
+           project_trust: String.t(),
+           harness_executable: String.t() | nil
          ]
 
   @doc """
@@ -91,13 +92,16 @@ defmodule Cli.Engine do
   end
 
   defp harness_env do
-    caller_pwd_env_scrub() ++ path_env()
+    inherited_task_env_scrub() ++ path_env()
   end
 
-  defp caller_pwd_env_scrub do
+  defp inherited_task_env_scrub do
     System.get_env()
     |> Map.keys()
-    |> Enum.filter(&(&1 == "CALLER_PWD" or String.ends_with?(&1, "_CALLER_PWD")))
+    |> Enum.filter(fn name ->
+      name == "CALLER_PWD" or String.ends_with?(name, "_CALLER_PWD") or
+        String.starts_with?(name, "MISE_") or String.starts_with?(name, "usage_")
+    end)
     |> Enum.map(&{String.to_charlist(&1), false})
   end
 
diff --git a/cli/lib/harness/pi/command.ex b/cli/lib/harness/pi/command.ex
index 76f8d6b..9fdcaae 100644
--- a/cli/lib/harness/pi/command.ex
+++ b/cli/lib/harness/pi/command.ex
@@ -3,9 +3,9 @@ defmodule Cli.Harness.Pi.Command do
   Pi command construction — builds the shell invocation passed to the
   port under `/bin/sh -c <script> -- $1 $2 ...`.
 
-  User-controlled strings (message, model, system prompt file, session
-  path) are passed as positional `$1`/`$2`/... args so they never enter
-  the shell script as interpolated text.
+  User-controlled strings and the Sessions-selected Pi executable are passed
+  as positional `$1`/`$2`/... args so they never enter the shell script as
+  interpolated text.
 
   Part of the pi harness adapter — see sessions#50 for the
   multi-harness plan.
@@ -15,7 +15,8 @@ defmodule Cli.Harness.Pi.Command do
            extensions: boolean(),
            skills: boolean(),
            prompt_templates: boolean(),
-           project_trust: String.t()
+           project_trust: String.t(),
+           harness_executable: String.t()
          ]
 
   @doc """
@@ -40,6 +41,7 @@ defmodule Cli.Harness.Pi.Command do
     skills = Keyword.get(opts, :skills, true)
     prompt_templates = Keyword.get(opts, :prompt_templates, true)
     project_trust_flag = project_trust_flag(Keyword.get(opts, :project_trust, "inherit"))
+    executable = harness_executable(opts)
 
     qualified_model = model
 
@@ -59,6 +61,9 @@ defmodule Cli.Harness.Pi.Command do
         {" --no-session", positional_after_prompt}
       end
 
+    executable_arg = "$#{length(positional) + 1}"
+    positional = positional ++ [executable]
+
     pi_flags =
       [
         prompt_flag,
@@ -72,7 +77,7 @@ defmodule Cli.Harness.Pi.Command do
       ]
       |> Enum.join("")
 
-    pi_cmd = ~s(mise -C "$MISE_CONFIG_ROOT" exec -- pi -p "$1"#{pi_flags})
+    pi_cmd = ~s("#{executable_arg}" -p "$1"#{pi_flags})
 
     # `echo |` pipes empty stdin so pi doesn't block waiting for a TTY.
     shell_script =
@@ -85,6 +90,20 @@ defmodule Cli.Harness.Pi.Command do
     {shell_script, positional}
   end
 
+  defp harness_executable(opts) do
+    case Keyword.fetch(opts, :harness_executable) do
+      {:ok, executable} when is_binary(executable) and executable != "" ->
+        if Path.type(executable) == :absolute do
+          executable
+        else
+          raise ArgumentError, "pi harness executable must be an absolute path"
+        end
+
+      _ ->
+        raise ArgumentError, "pi harness executable is required"
+    end
+  end
+
   defp project_trust_flag("inherit"), do: ""
   defp project_trust_flag("approve"), do: " --approve"
   defp project_trust_flag("deny"), do: " --no-approve"
diff --git a/cli/test/engine_test.exs b/cli/test/engine_test.exs
index a9f79ab..1b8aec3 100644
--- a/cli/test/engine_test.exs
+++ b/cli/test/engine_test.exs
@@ -48,16 +48,17 @@ defmodule Cli.EngineTest do
     refute output =~ "Agent reported an error"
   end
 
-  test "scrubs caller context from harness process environment" do
-    previous_caller = System.get_env("CALLER_PWD")
-    previous_sessions_caller = System.get_env("SESSIONS_CALLER_PWD")
-    previous_other_caller = System.get_env("OTHER_CALLER_PWD")
-
-    try do
-      System.put_env("CALLER_PWD", "/stale/caller")
-      System.put_env("SESSIONS_CALLER_PWD", "/stale/sessions/caller")
-      System.put_env("OTHER_CALLER_PWD", "/stale/other/caller")
-
+  test "scrubs caller, mise-task, and usage context from the harness environment" do
+    inherited = %{
+      "CALLER_PWD" => "/stale/caller",
+      "SESSIONS_CALLER_PWD" => "/stale/sessions/caller",
+      "OTHER_CALLER_PWD" => "/stale/other/caller",
+      "MISE_CONFIG_ROOT" => "/stale/sessions/root",
+      "MISE_TASK_NAME" => "run",
+      "usage_message" => "stale task payload"
+    }
+
+    with_env(inherited, fn ->
       output =
         capture_io(fn ->
           exit_code =
@@ -76,23 +77,30 @@ defmodule Cli.EngineTest do
         end)
 
       assert_receive {:exit_code, 0}
-      assert output =~ "CALLER_PWD="
-      assert output =~ "SESSIONS_CALLER_PWD="
-      assert output =~ "OTHER_CALLER_PWD="
-      refute output =~ "/stale/caller"
-      refute output =~ "/stale/sessions/caller"
-      refute output =~ "/stale/other/caller"
-    after
-      restore_env("CALLER_PWD", previous_caller)
-      restore_env("SESSIONS_CALLER_PWD", previous_sessions_caller)
-      restore_env("OTHER_CALLER_PWD", previous_other_caller)
-    end
+
+      for name <- Map.keys(inherited) do
+        assert output =~ "#{name}="
+        refute output =~ Map.fetch!(inherited, name)
+      end
+    end)
   end
 
   defmodule EnvHarness do
     def build_command(_message, _model, _system_prompt_file, _session, _timeout, _opts) do
-      {"printf 'CALLER_PWD=%s\\n' \"${CALLER_PWD-}\"; printf 'SESSIONS_CALLER_PWD=%s\\n' \"${SESSIONS_CALLER_PWD-}\"; printf 'OTHER_CALLER_PWD=%s\\n' \"${OTHER_CALLER_PWD-}\"",
-       []}
+      command =
+        [
+          "CALLER_PWD",
+          "SESSIONS_CALLER_PWD",
+          "OTHER_CALLER_PWD",
+          "MISE_CONFIG_ROOT",
+          "MISE_TASK_NAME",
+          "usage_message"
+        ]
+        |> Enum.map_join("; ", fn name ->
+          ~s(printf '#{name}=%s\\n' "${#{name}-}")
+        end)
+
+      {command, []}
     end
 
     def process_line(line, state) do
@@ -103,6 +111,90 @@ defmodule Cli.EngineTest do
     def extract_partial_text(_partial), do: ""
   end
 
+  test "real Pi adapter preserves selected executable and requested child boundary" do
+    root =
+      Path.join(System.tmp_dir!(), "sessions-pi-boundary-#{System.unique_integer([:positive])}")
+
+    cwd = Path.join(root, "project")
+    executable = Path.join(root, "selected pi")
+    capture = Path.join(root, "child.txt")
+    mise_data = Path.join(root, "mise")
+    stale_bin = Path.join([mise_data, "installs", "sessions-tool", "1.0", "bin"])
+    shim_bin = Path.join(mise_data, "shims")
+    ordinary_bin = Path.join(root, "ordinary-bin")
+
+    File.mkdir_p!(cwd)
+    File.mkdir_p!(stale_bin)
+    File.mkdir_p!(shim_bin)
+    File.mkdir_p!(ordinary_bin)
+
+    File.write!(
+      executable,
+      """
+      #!/bin/sh
+      {
+        printf 'EXECUTABLE=%s\\n' "$0"
+        printf 'CWD=%s\\n' "$(pwd -P)"
+        printf 'PATH=%s\\n' "$PATH"
+        printf 'MISE_CONFIG_ROOT=%s\\n' "${MISE_CONFIG_ROOT-}"
+        printf 'MISE_TASK_NAME=%s\\n' "${MISE_TASK_NAME-}"
+        printf 'usage_message=%s\\n' "${usage_message-}"
+        printf 'CALLER_PWD=%s\\n' "${CALLER_PWD-}"
+        printf 'ARGV='; printf '<%s>' "$@"; printf '\\n'
+      } > "#{capture}"
+      """
+    )
+
+    File.chmod!(executable, 0o755)
+
+    try do
+      with_env(
+        %{
+          "PATH" => Enum.join([stale_bin, ordinary_bin], ":"),
+          "MISE_DATA_DIR" => mise_data,
+          "MISE_CONFIG_ROOT" => "/stale/sessions/root",
+          "MISE_TASK_NAME" => "run",
+          "usage_message" => "stale task payload",
+          "CALLER_PWD" => "/stale/caller"
+        },
+        fn ->
+          capture_io(fn ->
+            exit_code =
+              Cli.Engine.run(
+                Cli.Harness.Pi,
+                "probe",
+                nil,
+                nil,
+                "openai-codex/gpt-5.5",
+                cwd,
+                nil,
+                harness_executable: executable,
+                project_trust: "approve"
+              )
+
+            send(self(), {:exit_code, exit_code})
+          end)
+        end
+      )
+
+      assert_receive {:exit_code, 0}
+      child = File.read!(capture)
+      {physical_cwd, 0} = System.cmd("pwd", ["-P"], cd: cwd)
+
+      assert child =~ "EXECUTABLE=#{executable}"
+      assert child =~ "CWD=#{String.trim(physical_cwd)}"
+      assert child =~ "PATH=#{shim_bin}:#{ordinary_bin}"
+      assert child =~ "MISE_CONFIG_ROOT=\n"
+      assert child =~ "MISE_TASK_NAME=\n"
+      assert child =~ "usage_message=\n"
+      assert child =~ "CALLER_PWD=\n"
+      assert child =~ "<--approve>"
+      refute child =~ stale_bin
+    after
+      File.rm_rf!(root)
+    end
+  end
+
   test "sanitizes mise install paths from harness PATH" do
     home = System.get_env("HOME") || System.tmp_dir!()
     mise_data_dir = Path.join([home, ".local", "share", "mise"])
diff --git a/cli/test/harness/pi/command_test.exs b/cli/test/harness/pi/command_test.exs
index 2db950c..0a341c3 100644
--- a/cli/test/harness/pi/command_test.exs
+++ b/cli/test/harness/pi/command_test.exs
@@ -3,12 +3,19 @@ defmodule Cli.Harness.Pi.CommandTest do
 
   alias Cli.Harness.Pi.Command
 
+  @pi_executable "/opt/sessions/pi"
+
+  defp build_command(message, model, prompt, session, timeout, opts \\ []) do
+    opts = Keyword.put(opts, :harness_executable, @pi_executable)
+    Command.build_command(message, model, prompt, session, timeout, opts)
+  end
+
   describe "build_command/6 — shell script" do
     test "builds a basic invocation with no prompt, timeout, session, or flags" do
       {script, _args} =
-        Command.build_command("hi", "claude-sonnet-4-5", nil, nil, nil)
+        build_command("hi", "claude-sonnet-4-5", nil, nil, nil)
 
-      assert script =~ "echo | mise -C \"$MISE_CONFIG_ROOT\" exec -- pi -p \"$1\""
+      assert script =~ ~s(echo | "$3" -p "$1")
       refute script =~ "--append-system-prompt"
       assert script =~ ~s( --model "$2")
       assert script =~ " --mode json"
@@ -16,21 +23,21 @@ defmodule Cli.Harness.Pi.CommandTest do
 
     test "adds --append-system-prompt when a prompt file is provided" do
       {script, _args} =
-        Command.build_command("hi", "claude-sonnet-4-5", "/tmp/prompt.txt", nil, nil)
+        build_command("hi", "claude-sonnet-4-5", "/tmp/prompt.txt", nil, nil)
 
       assert script =~ ~s( --append-system-prompt "$3")
     end
 
     test "wraps the command in `timeout <N>` when timeout is given" do
       {script, _} =
-        Command.build_command("hi", "claude-sonnet-4-5", "/tmp/prompt.txt", nil, 300)
+        build_command("hi", "claude-sonnet-4-5", "/tmp/prompt.txt", nil, 300)
 
-      assert script =~ "echo | timeout 300 mise -C \"$MISE_CONFIG_ROOT\" exec -- pi -p"
+      assert script =~ ~s(echo | timeout 300 "$4" -p)
     end
 
     test "uses --session at the next positional index after prompt args" do
       {script, _} =
-        Command.build_command(
+        build_command(
           "hi",
           "claude-sonnet-4-5",
           "/tmp/prompt.txt",
@@ -44,7 +51,7 @@ defmodule Cli.Harness.Pi.CommandTest do
 
     test "uses --session at $3 when no prompt file is provided" do
       {script, _} =
-        Command.build_command(
+        build_command(
           "hi",
           "claude-sonnet-4-5",
           nil,
@@ -59,7 +66,7 @@ defmodule Cli.Harness.Pi.CommandTest do
 
     test "uses --no-session when no session path is given" do
       {script, _} =
-        Command.build_command("hi", "claude-sonnet-4-5", "/tmp/prompt.txt", nil, nil)
+        build_command("hi", "claude-sonnet-4-5", "/tmp/prompt.txt", nil, nil)
 
       assert script =~ " --no-session"
       refute script =~ "--session \"$4\""
@@ -69,7 +76,7 @@ defmodule Cli.Harness.Pi.CommandTest do
   describe "build_command/6 — feature flags" do
     test "defaults all feature flags to enabled (no --no-* flags in script)" do
       {script, _} =
-        Command.build_command("hi", "claude-sonnet-4-5", "/tmp/prompt.txt", nil, nil)
+        build_command("hi", "claude-sonnet-4-5", "/tmp/prompt.txt", nil, nil)
 
       refute script =~ "--no-extensions"
       refute script =~ "--no-skills"
@@ -78,25 +85,21 @@ defmodule Cli.Harness.Pi.CommandTest do
 
     test "adds --no-extensions when extensions: false" do
       {script, _} =
-        Command.build_command("hi", "claude-sonnet-4-5", "/tmp/prompt.txt", nil, nil,
-          extensions: false
-        )
+        build_command("hi", "claude-sonnet-4-5", "/tmp/prompt.txt", nil, nil, extensions: false)
 
       assert script =~ "--no-extensions"
     end
 
     test "adds --no-skills when skills: false" do
       {script, _} =
-        Command.build_command("hi", "claude-sonnet-4-5", "/tmp/prompt.txt", nil, nil,
-          skills: false
-        )
+        build_command("hi", "claude-sonnet-4-5", "/tmp/prompt.txt", nil, nil, skills: false)
 
       assert script =~ "--no-skills"
     end
 
     test "adds --no-prompt-templates when prompt_templates: false" do
       {script, _} =
-        Command.build_command("hi", "claude-sonnet-4-5", "/tmp/prompt.txt", nil, nil,
+        build_command("hi", "claude-sonnet-4-5", "/tmp/prompt.txt", nil, nil,
           prompt_templates: false
         )
 
@@ -105,7 +108,7 @@ defmodule Cli.Harness.Pi.CommandTest do
 
     test "combines multiple disabled flags" do
       {script, _} =
-        Command.build_command("hi", "claude-sonnet-4-5", "/tmp/prompt.txt", nil, nil,
+        build_command("hi", "claude-sonnet-4-5", "/tmp/prompt.txt", nil, nil,
           extensions: false,
           skills: false,
           prompt_templates: false
@@ -120,7 +123,7 @@ defmodule Cli.Harness.Pi.CommandTest do
   describe "build_command/6 — project trust" do
     test "inherits project trust by default without a pi override" do
       {script, _} =
-        Command.build_command("hi", "claude-sonnet-4-5", "/tmp/prompt.txt", nil, nil)
+        build_command("hi", "claude-sonnet-4-5", "/tmp/prompt.txt", nil, nil)
 
       refute script =~ "--approve"
       refute script =~ "--no-approve"
@@ -128,7 +131,7 @@ defmodule Cli.Harness.Pi.CommandTest do
 
     test "maps approve to --approve" do
       {script, _} =
-        Command.build_command("hi", "claude-sonnet-4-5", "/tmp/prompt.txt", nil, nil,
+        build_command("hi", "claude-sonnet-4-5", "/tmp/prompt.txt", nil, nil,
           project_trust: "approve"
         )
 
@@ -138,7 +141,7 @@ defmodule Cli.Harness.Pi.CommandTest do
 
     test "maps deny to --no-approve" do
       {script, _} =
-        Command.build_command("hi", "claude-sonnet-4-5", "/tmp/prompt.txt", nil, nil,
+        build_command("hi", "claude-sonnet-4-5", "/tmp/prompt.txt", nil, nil,
           project_trust: "deny"
         )
 
@@ -147,31 +150,47 @@ defmodule Cli.Harness.Pi.CommandTest do
 
     test "rejects an unknown project trust policy" do
       assert_raise ArgumentError, ~r/unknown project trust policy/, fn ->
-        Command.build_command("hi", "claude-sonnet-4-5", "/tmp/prompt.txt", nil, nil,
+        build_command("hi", "claude-sonnet-4-5", "/tmp/prompt.txt", nil, nil,
           project_trust: "sometimes"
         )
       end
     end
   end
 
+  describe "build_command/6 — harness executable" do
+    test "requires a selected executable" do
+      assert_raise ArgumentError, ~r/pi harness executable is required/, fn ->
+        Command.build_command("hi", "openai-codex/gpt-5.5", nil, nil, nil)
+      end
+    end
+
+    test "requires an absolute executable path" do
+      assert_raise ArgumentError, ~r/must be an absolute path/, fn ->
+        Command.build_command("hi", "openai-codex/gpt-5.5", nil, nil, nil,
+          harness_executable: "pi"
+        )
+      end
+    end
+  end
+
   describe "build_command/6 — positional args" do
-    test "returns [message, model] without prompt or session" do
+    test "appends the executable without prompt or session" do
       {_script, args} =
-        Command.build_command("hello world", "openai-codex/gpt-5.5", nil, nil, nil)
+        build_command("hello world", "openai-codex/gpt-5.5", nil, nil, nil)
 
-      assert args == ["hello world", "openai-codex/gpt-5.5"]
+      assert args == ["hello world", "openai-codex/gpt-5.5", @pi_executable]
     end
 
-    test "returns [message, model, system_prompt_file] when prompt is present" do
+    test "appends the executable after a system prompt file" do
       {_script, args} =
-        Command.build_command("hello world", "openai-codex/gpt-5.5", "/tmp/p.txt", nil, nil)
+        build_command("hello world", "openai-codex/gpt-5.5", "/tmp/p.txt", nil, nil)
 
-      assert args == ["hello world", "openai-codex/gpt-5.5", "/tmp/p.txt"]
+      assert args == ["hello world", "openai-codex/gpt-5.5", "/tmp/p.txt", @pi_executable]
     end
 
     test "appends session path after prompt when both are given" do
       {_script, args} =
-        Command.build_command(
+        build_command(
           "hello",
           "openai-codex/gpt-5.5",
           "/tmp/p.txt",
@@ -179,12 +198,18 @@ defmodule Cli.Harness.Pi.CommandTest do
           nil
         )
 
-      assert args == ["hello", "openai-codex/gpt-5.5", "/tmp/p.txt", "/tmp/s.jsonl"]
+      assert args == [
+               "hello",
+               "openai-codex/gpt-5.5",
+               "/tmp/p.txt",
+               "/tmp/s.jsonl",
+               @pi_executable
+             ]
     end
 
     test "appends session path after model when prompt is absent" do
       {_script, args} =
-        Command.build_command(
+        build_command(
           "hello",
           "openai-codex/gpt-5.5",
           nil,
@@ -192,14 +217,14 @@ defmodule Cli.Harness.Pi.CommandTest do
           nil
         )
 
-      assert args == ["hello", "openai-codex/gpt-5.5", "/tmp/s.jsonl"]
+      assert args == ["hello", "openai-codex/gpt-5.5", "/tmp/s.jsonl", @pi_executable]
     end
   end
 
   describe "build_command/6 — model qualification" do
     test "leaves provider-qualified model names unchanged" do
       {_, args} =
-        Command.build_command("hi", "openai-codex/gpt-5.5", "/tmp/p.txt", nil, nil)
+        build_command("hi", "openai-codex/gpt-5.5", "/tmp/p.txt", nil, nil)
 
       assert Enum.at(args, 1) == "openai-codex/gpt-5.5"
     end
diff --git a/lib/harness-env.sh b/lib/harness-env.sh
index 6245bb7..85320e9 100644
--- a/lib/harness-env.sh
+++ b/lib/harness-env.sh
@@ -11,6 +11,15 @@ sessions_scrub_caller_pwd_env() {
   done < <(compgen -e)
 }
 
+sessions_scrub_task_env() {
+  local name
+  while IFS= read -r name; do
+    case "$name" in
+      MISE_*|usage_*) unset "$name" ;;
+    esac
+  done < <(compgen -e)
+}
+
 sessions_mise_data_dir() {
   if [ -n "${MISE_DATA_DIR:-}" ]; then
     echo "$MISE_DATA_DIR"
@@ -64,6 +73,9 @@ sessions_sanitize_harness_path() {
 }
 
 sessions_prepare_harness_env() {
-  sessions_scrub_caller_pwd_env
+  # PATH sanitization needs the caller's mise data location before the
+  # task-scoped MISE_* variables are removed from the harness boundary.
   sessions_sanitize_harness_path
+  sessions_scrub_caller_pwd_env
+  sessions_scrub_task_env
 }
diff --git a/lib/harness/claude.sh b/lib/harness/claude.sh
index 6e5cf23..2f64879 100644
--- a/lib/harness/claude.sh
+++ b/lib/harness/claude.sh
@@ -22,6 +22,12 @@
 
 # --- Launch policy ---
 
+# The skeleton has no launch executable yet. Empty output lets the generic run
+# path reach the Elixir adapter's existing explicit build-command rejection.
+harness_claude_executable() {
+  return 0
+}
+
 # Inheriting native behavior requires no adapter support. Claude project trust
 # translation is not implemented, so non-default policies fail explicitly.
 harness_claude_project_trust_flag() {
diff --git a/lib/harness/pi.sh b/lib/harness/pi.sh
index 204ceaa..bc5a0a7 100644
--- a/lib/harness/pi.sh
+++ b/lib/harness/pi.sh
@@ -19,6 +19,39 @@
 
 # --- Launch policy ---
 
+# Resolve Pi while Sessions' own mise tool context is still active. The launch
+# boundary carries this exact executable across environment sanitization rather
+# than reactivating Sessions inside the requested project directory.
+harness_pi_executable() {
+  local sessions_root="${1:-}"
+  local executable
+
+  if [ -z "$sessions_root" ] || [ ! -d "$sessions_root" ]; then
+    echo "Error: Sessions root is required to resolve the pi executable" >&2
+    return 1
+  fi
+
+  if ! executable=$(mise -C "$sessions_root" which pi); then
+    echo "Error: Sessions-owned pi executable is unavailable" >&2
+    return 1
+  fi
+
+  case "$executable" in
+    /*) ;;
+    *)
+      echo "Error: Sessions-owned pi executable is not an absolute path: $executable" >&2
+      return 1
+      ;;
+  esac
+
+  if [ ! -x "$executable" ]; then
+    echo "Error: Sessions-owned pi executable is not executable: $executable" >&2
+    return 1
+  fi
+
+  printf '%s\n' "$executable"
+}
+
 # Translate Sessions' generic one-run project trust policy to Pi flags.
 # Empty output means inherit Pi's normal trust behavior.
 harness_pi_project_trust_flag() {
diff --git a/test/helpers.bash b/test/helpers.bash
index 738b7f2..1f08b7e 100644
--- a/test/helpers.bash
+++ b/test/helpers.bash
@@ -28,7 +28,7 @@ sessions() {
 }
 export -f sessions
 
-stub_mise_exec_pi() {
+stub_mise_resolve_pi() {
   local stub_dir="$1"
   local real_mise
   real_mise=$(command -v mise)
@@ -37,9 +37,9 @@ stub_mise_exec_pi() {
   cat > "$stub_dir/mise" <<STUB
 #!/usr/bin/env bash
 set -euo pipefail
-if [ "\${1:-}" = "-C" ] && [ "\${3:-}" = "exec" ] && [ "\${4:-}" = "--" ] && [ "\${5:-}" = "pi" ]; then
-  shift 5
-  exec pi "\$@"
+if [ "\${1:-}" = "-C" ] && [ "\${3:-}" = "which" ] && [ "\${4:-}" = "pi" ]; then
+  command -v pi
+  exit 0
 fi
 exec "$real_mise" "\$@"
 STUB
@@ -59,7 +59,7 @@ printf '%s\n' "\$@" > "$argv_capture"
 exit 0
 STUB
   chmod +x "$stub_dir/pi"
-  stub_mise_exec_pi "$stub_dir"
+  stub_mise_resolve_pi "$stub_dir"
 }
 
 stub_pi_capture_env() {
@@ -72,11 +72,15 @@ stub_pi_capture_env() {
 printf 'CALLER_PWD=%s\n' "\${CALLER_PWD-}" > "$env_capture"
 printf 'SESSIONS_CALLER_PWD=%s\n' "\${SESSIONS_CALLER_PWD-}" >> "$env_capture"
 printf 'OTHER_CALLER_PWD=%s\n' "\${OTHER_CALLER_PWD-}" >> "$env_capture"
+printf 'MISE_CONFIG_ROOT=%s\n' "\${MISE_CONFIG_ROOT-}" >> "$env_capture" # codebase:ignore - fixture proves inherited MCR is scrubbed
+printf 'MISE_TASK_NAME=%s\n' "\${MISE_TASK_NAME-}" >> "$env_capture"
+printf 'usage_message=%s\n' "\${usage_message-}" >> "$env_capture"
+printf 'usage_stale_probe=%s\n' "\${usage_stale_probe-}" >> "$env_capture"
 printf 'PATH=%s\n' "\$PATH" >> "$env_capture"
 exit 0
 STUB
   chmod +x "$stub_dir/pi"
-  stub_mise_exec_pi "$stub_dir"
+  stub_mise_resolve_pi "$stub_dir"
 }
 
 stub_shell_exec_payload() {
diff --git a/test/ps.bats b/test/ps.bats
index f824b3a..3c33536 100644
--- a/test/ps.bats
+++ b/test/ps.bats
@@ -179,7 +179,7 @@ sleep 0.2
 exit 0
 STUB
   chmod +x "$stub_dir/pi"
-  stub_mise_exec_pi "$stub_dir"
+  stub_mise_resolve_pi "$stub_dir"
   session_file=$(session_file_for "$SESSION_1")
 
   PATH="$stub_dir:$PATH" run sessions run \
diff --git a/test/run.bats b/test/run.bats
index b1f1b00..8e152bc 100644
--- a/test/run.bats
+++ b/test/run.bats
@@ -55,7 +55,7 @@ teardown() {
   ! grep -qx '' "$argv_capture"
 }
 
-@test "run interactive resolves pi through sessions mise root by default" {
+@test "run interactive resolves Sessions pi with mise and launches it directly" {
   local stub_dir="$BATS_TEST_TMPDIR/stub-mise-pi"
   local argv_capture="$BATS_TEST_TMPDIR/pi-argv-owned"
   local cwd_capture="$BATS_TEST_TMPDIR/pi-cwd-owned"
@@ -67,10 +67,10 @@ teardown() {
   cat > "$stub_dir/mise" <<STUB
 #!/usr/bin/env bash
 set -euo pipefail
-if [ "\${1:-}" = "-C" ] && [ "\${3:-}" = "exec" ] && [ "\${4:-}" = "--" ] && [ "\${5:-}" = "pi" ]; then
+if [ "\${1:-}" = "-C" ] && [ "\${3:-}" = "which" ] && [ "\${4:-}" = "pi" ]; then
   printf '%s\n' "\$@" > "$mise_capture"
-  shift 5
-  exec pi "\$@"
+  command -v pi
+  exit 0
 fi
 exec "$real_mise" "\$@"
 STUB
@@ -84,13 +84,13 @@ STUB
     --model "openai-codex/gpt-5.5"
   [ "$status" -eq 0 ]
   [ -f "$mise_capture" ]
+  [ "$(sed -n '1p' "$mise_capture")" = "-C" ]
+  [ "$(sed -n '2p' "$mise_capture")" = "$REPO_DIR" ]
+  [ "$(sed -n '3p' "$mise_capture")" = "which" ]
+  [ "$(sed -n '4p' "$mise_capture")" = "pi" ]
   [ -f "$argv_capture" ]
-
-  [ "$(awk 'NR == 1 { print }' "$mise_capture")" = "-C" ]
-  [ "$(awk 'NR == 2 { print }' "$mise_capture")" = "$REPO_DIR" ]
-  [ "$(awk 'NR == 3 { print }' "$mise_capture")" = "exec" ]
-  [ "$(awk 'NR == 4 { print }' "$mise_capture")" = "--" ]
-  [ "$(awk 'NR == 5 { print }' "$mise_capture")" = "pi" ]
+  [ -f "$cwd_capture" ]
+  [ "$(cat "$cwd_capture")" = "$(cd "$run_cwd" && pwd -P)" ]
   grep -qx -- "--model" "$argv_capture"
 }
 
@@ -349,7 +349,7 @@ else
 fi
 STUB
   chmod +x "$stub_dir/pi"
-  stub_mise_exec_pi "$stub_dir"
+  stub_mise_resolve_pi "$stub_dir"
 
   run bash -c 'printf "%s\n" "typed input" | PATH="$1" PI_DIR="$2" mise -C "$3" run -q run --system-prompt-file "$4" --cwd "$5" --model "openai-codex/gpt-5.5"' \
     bash \
@@ -384,7 +384,7 @@ cat "\$prompt_file" > "$prompt_capture"
 exit 0
 STUB
   chmod +x "$stub_dir/pi"
-  stub_mise_exec_pi "$stub_dir"
+  stub_mise_resolve_pi "$stub_dir"
 
   run sessions new --cwd "$BATS_TEST_TMPDIR" --system-prompt "baked prompt from session"
   [ "$status" -eq 0 ]
@@ -516,7 +516,7 @@ cat "\$prompt_file" > "$prompt_capture"
 exit 0
 STUB
   chmod +x "$stub_dir/pi"
-  stub_mise_exec_pi "$stub_dir"
+  stub_mise_resolve_pi "$stub_dir"
 
   run sessions new --cwd "$BATS_TEST_TMPDIR" --system-prompt "baked prompt"
   [ "$status" -eq 0 ]
@@ -556,7 +556,7 @@ cat "\$prompt_file" > "$prompt_capture"
 exit 0
 STUB
   chmod +x "$stub_dir/pi"
-  stub_mise_exec_pi "$stub_dir"
+  stub_mise_resolve_pi "$stub_dir"
 
   : > "$BATS_TEST_TMPDIR/empty-prompt.md"
   run sessions new --cwd "$BATS_TEST_TMPDIR" --system-prompt-file "$BATS_TEST_TMPDIR/empty-prompt.md"
@@ -623,7 +623,7 @@ trap 'printf term > "$term_capture"; exit 143' TERM
 while :; do sleep 1; done
 STUB
   chmod +x "$stub_dir/pi"
-  stub_mise_exec_pi "$stub_dir"
+  stub_mise_resolve_pi "$stub_dir"
 
   PATH="$stub_dir:$PATH" DISPATCH_CONTEXT="generated prompt" PI_DIR="$PI_DIR" \
     mise -C "$REPO_DIR" run -q run --cwd "$BATS_TEST_TMPDIR" --model "openai-codex/gpt-5.5" \
@@ -676,6 +676,7 @@ STUB
   export CALLER_PWD="/stale/caller"
   export SESSIONS_CALLER_PWD="/stale/sessions"
   export OTHER_CALLER_PWD="/stale/other"
+  export usage_stale_probe="stale task value"
 
   PATH="$stale_bin:$pi_bin:$shim_bin:$fresh_bin:$PATH" run sessions run \
     --system-prompt-file "$prompt" \
@@ -687,6 +688,10 @@ STUB
   grep -q '^CALLER_PWD=$' "$env_capture"
   grep -q '^SESSIONS_CALLER_PWD=$' "$env_capture"
   grep -q '^OTHER_CALLER_PWD=$' "$env_capture"
+  grep -q '^MISE_CONFIG_ROOT=$' "$env_capture"
+  grep -q '^MISE_TASK_NAME=$' "$env_capture"
+  grep -q '^usage_message=$' "$env_capture"
+  grep -q '^usage_stale_probe=$' "$env_capture"
   grep -q "$shim_bin" "$env_capture"
   grep -q "$pi_bin" "$env_capture"
   ! grep -q "$stale_bin" "$env_capture"
diff --git a/test/wake.bats b/test/wake.bats
index c3d82bc..9757596 100644
--- a/test/wake.bats
+++ b/test/wake.bats
@@ -786,7 +786,7 @@ cat "\$prompt_file" > "$prompt_capture"
 exit 0
 STUB
   chmod +x "$stub_dir/pi"
-  stub_mise_exec_pi "$stub_dir"
+  stub_mise_resolve_pi "$stub_dir"
 
   PATH="$stub_dir:$PATH" run sessions wake wake-baked-prompt --background --model "openai-codex/gpt-5.5"
   [ "$status" -eq 0 ]

From 38b58208de4f079fd6308b7ae0d6461890bfab44 Mon Sep 17 00:00:00 2001
From: brownie <brownie@ricon.family>
Date: Thu, 16 Jul 2026 13:51:04 +0000
Subject: [PATCH 2/5] fix: preserve custom mise data for target tools

---
 cli/lib/cli/engine.ex    | 3 ++-
 cli/test/engine_test.exs | 2 ++
 lib/harness-env.sh       | 3 +++
 test/helpers.bash        | 1 +
 test/run.bats            | 2 ++
 5 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/cli/lib/cli/engine.ex b/cli/lib/cli/engine.ex
index d63783f..a459f90 100644
--- a/cli/lib/cli/engine.ex
+++ b/cli/lib/cli/engine.ex
@@ -100,7 +100,8 @@ defmodule Cli.Engine do
     |> Map.keys()
     |> Enum.filter(fn name ->
       name == "CALLER_PWD" or String.ends_with?(name, "_CALLER_PWD") or
-        String.starts_with?(name, "MISE_") or String.starts_with?(name, "usage_")
+        (String.starts_with?(name, "MISE_") and name != "MISE_DATA_DIR") or
+        String.starts_with?(name, "usage_")
     end)
     |> Enum.map(&{String.to_charlist(&1), false})
   end
diff --git a/cli/test/engine_test.exs b/cli/test/engine_test.exs
index 1b8aec3..89213ca 100644
--- a/cli/test/engine_test.exs
+++ b/cli/test/engine_test.exs
@@ -136,6 +136,7 @@ defmodule Cli.EngineTest do
         printf 'EXECUTABLE=%s\\n' "$0"
         printf 'CWD=%s\\n' "$(pwd -P)"
         printf 'PATH=%s\\n' "$PATH"
+        printf 'MISE_DATA_DIR=%s\\n' "${MISE_DATA_DIR-}"
         printf 'MISE_CONFIG_ROOT=%s\\n' "${MISE_CONFIG_ROOT-}"
         printf 'MISE_TASK_NAME=%s\\n' "${MISE_TASK_NAME-}"
         printf 'usage_message=%s\\n' "${usage_message-}"
@@ -184,6 +185,7 @@ defmodule Cli.EngineTest do
       assert child =~ "EXECUTABLE=#{executable}"
       assert child =~ "CWD=#{String.trim(physical_cwd)}"
       assert child =~ "PATH=#{shim_bin}:#{ordinary_bin}"
+      assert child =~ "MISE_DATA_DIR=#{mise_data}"
       assert child =~ "MISE_CONFIG_ROOT=\n"
       assert child =~ "MISE_TASK_NAME=\n"
       assert child =~ "usage_message=\n"
diff --git a/lib/harness-env.sh b/lib/harness-env.sh
index 85320e9..852e567 100644
--- a/lib/harness-env.sh
+++ b/lib/harness-env.sh
@@ -15,6 +15,9 @@ sessions_scrub_task_env() {
   local name
   while IFS= read -r name; do
     case "$name" in
+      # MISE_DATA_DIR is user-owned tool storage. Retained shims need it to
+      # resolve target-project tools from a non-default mise installation.
+      MISE_DATA_DIR) ;;
       MISE_*|usage_*) unset "$name" ;;
     esac
   done < <(compgen -e)
diff --git a/test/helpers.bash b/test/helpers.bash
index 1f08b7e..98b4943 100644
--- a/test/helpers.bash
+++ b/test/helpers.bash
@@ -72,6 +72,7 @@ stub_pi_capture_env() {
 printf 'CALLER_PWD=%s\n' "\${CALLER_PWD-}" > "$env_capture"
 printf 'SESSIONS_CALLER_PWD=%s\n' "\${SESSIONS_CALLER_PWD-}" >> "$env_capture"
 printf 'OTHER_CALLER_PWD=%s\n' "\${OTHER_CALLER_PWD-}" >> "$env_capture"
+printf 'MISE_DATA_DIR=%s\n' "\${MISE_DATA_DIR-}" >> "$env_capture"
 printf 'MISE_CONFIG_ROOT=%s\n' "\${MISE_CONFIG_ROOT-}" >> "$env_capture" # codebase:ignore - fixture proves inherited MCR is scrubbed
 printf 'MISE_TASK_NAME=%s\n' "\${MISE_TASK_NAME-}" >> "$env_capture"
 printf 'usage_message=%s\n' "\${usage_message-}" >> "$env_capture"
diff --git a/test/run.bats b/test/run.bats
index 8e152bc..647dfca 100644
--- a/test/run.bats
+++ b/test/run.bats
@@ -676,6 +676,7 @@ STUB
   export CALLER_PWD="/stale/caller"
   export SESSIONS_CALLER_PWD="/stale/sessions"
   export OTHER_CALLER_PWD="/stale/other"
+  export MISE_DATA_DIR="$mise_data"
   export usage_stale_probe="stale task value"
 
   PATH="$stale_bin:$pi_bin:$shim_bin:$fresh_bin:$PATH" run sessions run \
@@ -688,6 +689,7 @@ STUB
   grep -q '^CALLER_PWD=$' "$env_capture"
   grep -q '^SESSIONS_CALLER_PWD=$' "$env_capture"
   grep -q '^OTHER_CALLER_PWD=$' "$env_capture"
+  grep -q "^MISE_DATA_DIR=$mise_data$" "$env_capture"
   grep -q '^MISE_CONFIG_ROOT=$' "$env_capture"
   grep -q '^MISE_TASK_NAME=$' "$env_capture"
   grep -q '^usage_message=$' "$env_capture"

From e33ad03de2f3e55918da4dc574e8b7bd09095c35 Mon Sep 17 00:00:00 2001
From: brownie <brownie@ricon.family>
Date: Thu, 16 Jul 2026 13:56:32 +0000
Subject: [PATCH 3/5] fix: resolve relative child cwd from caller

---
 .mise/tasks/run | 14 +++++++++++++-
 test/run.bats   | 25 +++++++++++++++++++++++++
 2 files changed, 38 insertions(+), 1 deletion(-)

diff --git a/.mise/tasks/run b/.mise/tasks/run
index a2504b6..aff9863 100755
--- a/.mise/tasks/run
+++ b/.mise/tasks/run
@@ -25,7 +25,8 @@ SYSTEM_PROMPT_FILE="${usage_system_prompt_file:-}"
 TIMEOUT="${usage_timeout:-}"
 MODEL="${usage_model:-}"
 SESSION="${usage_session:-}"
-CWD="${usage_cwd:-${SESSIONS_CALLER_PWD:-${CALLER_PWD:-.}}}"
+CALLER_CWD="${SESSIONS_CALLER_PWD:-${CALLER_PWD:-.}}"
+CWD="${usage_cwd:-$CALLER_CWD}"
 HEADLESS="${usage_headless:-false}"
 INTERACTIVE="${usage_interactive:-false}"
 PROJECT_TRUST="${usage_project_trust:-inherit}"
@@ -236,6 +237,17 @@ fi
 
 sessions_validate_project_trust "$PROJECT_TRUST" || exit 1
 
+# Mise tasks run from Sessions' package root. Resolve relative child paths from
+# the invoking caller before either launch path changes directories again.
+case "$CWD" in
+  /*) ;;
+  *) CWD="$CALLER_CWD/$CWD" ;;
+esac
+CWD=$(cd "$CWD" 2>/dev/null && pwd -P) || {
+  echo "Error: --cwd directory not found: ${usage_cwd:-$CALLER_CWD}" >&2
+  exit 1
+}
+
 # Resolve the selected harness and its Sessions-owned executable before any
 # launch environment is sanitized. Unsupported skeleton adapters may return no
 # executable and retain their adapter-level rejection in the Elixir boundary.
diff --git a/test/run.bats b/test/run.bats
index 8e152bc..aa8ca0c 100644
--- a/test/run.bats
+++ b/test/run.bats
@@ -55,6 +55,31 @@ teardown() {
   ! grep -qx '' "$argv_capture"
 }
 
+@test "run resolves relative requested cwd from the caller in interactive and print paths" {
+  local stub_dir="$BATS_TEST_TMPDIR/stub-pi-relative-cwd"
+  local cwd_capture="$BATS_TEST_TMPDIR/pi-relative-cwd"
+  local argv_capture="$BATS_TEST_TMPDIR/pi-relative-argv"
+  local caller="$BATS_TEST_TMPDIR/caller"
+  local expected="$caller/target"
+
+  mkdir -p "$expected"
+  stub_pi_capture_argv_cwd "$stub_dir" "$argv_capture" "$cwd_capture"
+
+  SESSIONS_CALLER_PWD="$caller" PATH="$stub_dir:$PATH" run sessions run \
+    --cwd target \
+    --model "openai-codex/gpt-5.5"
+  [ "$status" -eq 0 ]
+  [ "$(cat "$cwd_capture")" = "$(cd "$expected" && pwd -P)" ]
+
+  rm "$cwd_capture"
+  SESSIONS_CALLER_PWD="$caller" PATH="$stub_dir:$PATH" run sessions run \
+    --cwd target \
+    --model "openai-codex/gpt-5.5" \
+    "probe"
+  [ "$status" -eq 0 ]
+  [ "$(cat "$cwd_capture")" = "$(cd "$expected" && pwd -P)" ]
+}
+
 @test "run interactive resolves Sessions pi with mise and launches it directly" {
   local stub_dir="$BATS_TEST_TMPDIR/stub-mise-pi"
   local argv_capture="$BATS_TEST_TMPDIR/pi-argv-owned"

From 1c546ad875b2272d2ca9edd3800678ed60835e5a Mon Sep 17 00:00:00 2001
From: junior <junior@ricon.family>
Date: Thu, 16 Jul 2026 10:16:48 -0400
Subject: [PATCH 4/5] fix: scope caller context to sessions

---
 .mise/tasks/run          |  2 +-
 .mise/tasks/wake         | 11 +++--------
 cli/lib/cli/engine.ex    |  2 +-
 cli/test/engine_test.exs | 26 +++++++++++++++-----------
 lib/harness-env.sh       |  7 +------
 test/helpers.bash        |  3 +--
 test/run.bats            |  6 ++----
 test/wake.bats           | 25 +++++++++++--------------
 8 files changed, 35 insertions(+), 47 deletions(-)

diff --git a/.mise/tasks/run b/.mise/tasks/run
index aff9863..ae69e1e 100755
--- a/.mise/tasks/run
+++ b/.mise/tasks/run
@@ -25,7 +25,7 @@ SYSTEM_PROMPT_FILE="${usage_system_prompt_file:-}"
 TIMEOUT="${usage_timeout:-}"
 MODEL="${usage_model:-}"
 SESSION="${usage_session:-}"
-CALLER_CWD="${SESSIONS_CALLER_PWD:-${CALLER_PWD:-.}}"
+CALLER_CWD="${SESSIONS_CALLER_PWD:-.}"
 CWD="${usage_cwd:-$CALLER_CWD}"
 HEADLESS="${usage_headless:-false}"
 INTERACTIVE="${usage_interactive:-false}"
diff --git a/.mise/tasks/wake b/.mise/tasks/wake
index bd42516..1524686 100755
--- a/.mise/tasks/wake
+++ b/.mise/tasks/wake
@@ -30,13 +30,8 @@ NO_EXTENSIONS="${usage_no_extensions:-false}"
 NO_SKILLS="${usage_no_skills:-false}"
 NO_PROMPT_TEMPLATES="${usage_no_prompt_templates:-false}"
 
-scrub_caller_pwd_env() {
-  local name
-  while IFS= read -r name; do
-    case "$name" in
-      CALLER_PWD|*_CALLER_PWD) unset "$name" ;;
-    esac
-  done < <(compgen -e)
+scrub_sessions_caller_pwd_env() {
+  unset SESSIONS_CALLER_PWD
 }
 
 if [ -z "$SESSION_ID" ]; then
@@ -246,7 +241,7 @@ if [ -n "$OS_USER" ]; then
   RUN_CMD=("$HOST_RUN_AS_USER" --user "$OS_USER" -- "${RUN_CMD[@]}")
 fi
 
-scrub_caller_pwd_env
+scrub_sessions_caller_pwd_env
 
 if [ "$BACKGROUND" = "true" ]; then
   # Background: launch via shell/zmx (fire-and-forget)
diff --git a/cli/lib/cli/engine.ex b/cli/lib/cli/engine.ex
index a459f90..0cd0480 100644
--- a/cli/lib/cli/engine.ex
+++ b/cli/lib/cli/engine.ex
@@ -99,7 +99,7 @@ defmodule Cli.Engine do
     System.get_env()
     |> Map.keys()
     |> Enum.filter(fn name ->
-      name == "CALLER_PWD" or String.ends_with?(name, "_CALLER_PWD") or
+      name == "SESSIONS_CALLER_PWD" or
         (String.starts_with?(name, "MISE_") and name != "MISE_DATA_DIR") or
         String.starts_with?(name, "usage_")
     end)
diff --git a/cli/test/engine_test.exs b/cli/test/engine_test.exs
index 89213ca..08ba565 100644
--- a/cli/test/engine_test.exs
+++ b/cli/test/engine_test.exs
@@ -48,17 +48,17 @@ defmodule Cli.EngineTest do
     refute output =~ "Agent reported an error"
   end
 
-  test "scrubs caller, mise-task, and usage context from the harness environment" do
-    inherited = %{
-      "CALLER_PWD" => "/stale/caller",
+  test "scrubs Sessions caller and task context while preserving other package context" do
+    transient = %{
       "SESSIONS_CALLER_PWD" => "/stale/sessions/caller",
-      "OTHER_CALLER_PWD" => "/stale/other/caller",
       "MISE_CONFIG_ROOT" => "/stale/sessions/root",
       "MISE_TASK_NAME" => "run",
       "usage_message" => "stale task payload"
     }
 
-    with_env(inherited, fn ->
+    preserved = %{"OTHER_CALLER_PWD" => "/other/package/context"}
+
+    with_env(Map.merge(transient, preserved), fn ->
       output =
         capture_io(fn ->
           exit_code =
@@ -78,10 +78,12 @@ defmodule Cli.EngineTest do
 
       assert_receive {:exit_code, 0}
 
-      for name <- Map.keys(inherited) do
+      for name <- Map.keys(transient) do
         assert output =~ "#{name}="
-        refute output =~ Map.fetch!(inherited, name)
+        refute output =~ Map.fetch!(transient, name)
       end
+
+      assert output =~ "OTHER_CALLER_PWD=/other/package/context"
     end)
   end
 
@@ -89,7 +91,6 @@ defmodule Cli.EngineTest do
     def build_command(_message, _model, _system_prompt_file, _session, _timeout, _opts) do
       command =
         [
-          "CALLER_PWD",
           "SESSIONS_CALLER_PWD",
           "OTHER_CALLER_PWD",
           "MISE_CONFIG_ROOT",
@@ -140,7 +141,8 @@ defmodule Cli.EngineTest do
         printf 'MISE_CONFIG_ROOT=%s\\n' "${MISE_CONFIG_ROOT-}"
         printf 'MISE_TASK_NAME=%s\\n' "${MISE_TASK_NAME-}"
         printf 'usage_message=%s\\n' "${usage_message-}"
-        printf 'CALLER_PWD=%s\\n' "${CALLER_PWD-}"
+        printf 'SESSIONS_CALLER_PWD=%s\\n' "${SESSIONS_CALLER_PWD-}"
+        printf 'OTHER_CALLER_PWD=%s\\n' "${OTHER_CALLER_PWD-}"
         printf 'ARGV='; printf '<%s>' "$@"; printf '\\n'
       } > "#{capture}"
       """
@@ -156,7 +158,8 @@ defmodule Cli.EngineTest do
           "MISE_CONFIG_ROOT" => "/stale/sessions/root",
           "MISE_TASK_NAME" => "run",
           "usage_message" => "stale task payload",
-          "CALLER_PWD" => "/stale/caller"
+          "SESSIONS_CALLER_PWD" => "/stale/sessions/caller",
+          "OTHER_CALLER_PWD" => "/other/package/context"
         },
         fn ->
           capture_io(fn ->
@@ -189,7 +192,8 @@ defmodule Cli.EngineTest do
       assert child =~ "MISE_CONFIG_ROOT=\n"
       assert child =~ "MISE_TASK_NAME=\n"
       assert child =~ "usage_message=\n"
-      assert child =~ "CALLER_PWD=\n"
+      assert child =~ "SESSIONS_CALLER_PWD=\n"
+      assert child =~ "OTHER_CALLER_PWD=/other/package/context"
       assert child =~ "<--approve>"
       refute child =~ stale_bin
     after
diff --git a/lib/harness-env.sh b/lib/harness-env.sh
index 852e567..c1b05f1 100644
--- a/lib/harness-env.sh
+++ b/lib/harness-env.sh
@@ -3,12 +3,7 @@
 # directly from Bash tasks.
 
 sessions_scrub_caller_pwd_env() {
-  local name
-  while IFS= read -r name; do
-    case "$name" in
-      CALLER_PWD|*_CALLER_PWD) unset "$name" ;;
-    esac
-  done < <(compgen -e)
+  unset SESSIONS_CALLER_PWD
 }
 
 sessions_scrub_task_env() {
diff --git a/test/helpers.bash b/test/helpers.bash
index 98b4943..7bd1be3 100644
--- a/test/helpers.bash
+++ b/test/helpers.bash
@@ -69,8 +69,7 @@ stub_pi_capture_env() {
   mkdir -p "$stub_dir"
   cat > "$stub_dir/pi" <<STUB
 #!/usr/bin/env bash
-printf 'CALLER_PWD=%s\n' "\${CALLER_PWD-}" > "$env_capture"
-printf 'SESSIONS_CALLER_PWD=%s\n' "\${SESSIONS_CALLER_PWD-}" >> "$env_capture"
+printf 'SESSIONS_CALLER_PWD=%s\n' "\${SESSIONS_CALLER_PWD-}" > "$env_capture"
 printf 'OTHER_CALLER_PWD=%s\n' "\${OTHER_CALLER_PWD-}" >> "$env_capture"
 printf 'MISE_DATA_DIR=%s\n' "\${MISE_DATA_DIR-}" >> "$env_capture"
 printf 'MISE_CONFIG_ROOT=%s\n' "\${MISE_CONFIG_ROOT-}" >> "$env_capture" # codebase:ignore - fixture proves inherited MCR is scrubbed
diff --git a/test/run.bats b/test/run.bats
index dd2631b..5ebd6fd 100644
--- a/test/run.bats
+++ b/test/run.bats
@@ -698,9 +698,8 @@ STUB
   local prompt="$BATS_TEST_TMPDIR/prompt.md"
   echo "test prompt" > "$prompt"
 
-  export CALLER_PWD="/stale/caller"
   export SESSIONS_CALLER_PWD="/stale/sessions"
-  export OTHER_CALLER_PWD="/stale/other"
+  export OTHER_CALLER_PWD="/other/package/context"
   export MISE_DATA_DIR="$mise_data"
   export usage_stale_probe="stale task value"
 
@@ -711,9 +710,8 @@ STUB
   [ "$status" -eq 0 ]
   [ -f "$env_capture" ]
 
-  grep -q '^CALLER_PWD=$' "$env_capture"
   grep -q '^SESSIONS_CALLER_PWD=$' "$env_capture"
-  grep -q '^OTHER_CALLER_PWD=$' "$env_capture"
+  grep -q '^OTHER_CALLER_PWD=/other/package/context$' "$env_capture"
   grep -q "^MISE_DATA_DIR=$mise_data$" "$env_capture"
   grep -q '^MISE_CONFIG_ROOT=$' "$env_capture"
   grep -q '^MISE_TASK_NAME=$' "$env_capture"
diff --git a/test/wake.bats b/test/wake.bats
index 9757596..0cb46fb 100644
--- a/test/wake.bats
+++ b/test/wake.bats
@@ -485,10 +485,10 @@ STUB
 }
 
 @test "wake forwards session cwd to sessions run" {
-  # `wake` launches from the persisted session cwd, but `sessions run`
-  # also has its own --cwd option and otherwise defaults through
-  # CALLER_PWD. Regression guard: the RUN_CMD handed to shell must carry
-  # the session header cwd explicitly so stale CALLER_PWD cannot win.
+  # `wake` launches from the persisted session cwd, while `sessions run`
+  # also has its own --cwd option. Regression guard: the RUN_CMD handed to
+  # shell must carry the session header cwd explicitly rather than depending
+  # on transient invocation context.
   command -v shell >/dev/null 2>&1 || skip "shell not installed"
 
   local session_cwd="$BATS_TEST_TMPDIR/session-cwd"
@@ -526,11 +526,11 @@ STUB
   [ "$run_cwd" = "$expected_cwd" ]
 }
 
-@test "wake scrubs caller cwd variables before background shell launch" {
+@test "wake scrubs its caller cwd before background shell launch" {
   # `sessions wake --background` starts a long-lived shell/zmx process.
-  # Caller-cwd vars describe the immediate shiv invocation and become stale
-  # ambient state once the shell outlives that invocation, so wake must scrub
-  # them after materializing the explicit --cwd arguments.
+  # Sessions' caller-cwd value becomes stale once the shell outlives that
+  # invocation, so wake scrubs its own variable after materializing --cwd.
+  # Other packages' caller context remains outside Sessions' ownership.
   command -v shell >/dev/null 2>&1 || skip "shell not installed"
 
   local stub_dir="$BATS_TEST_TMPDIR/stub-shell-env"
@@ -538,24 +538,21 @@ STUB
   mkdir -p "$stub_dir"
   cat > "$stub_dir/shell" <<STUB
 #!/usr/bin/env bash
-printf 'CALLER_PWD=%s\n' "\${CALLER_PWD-}" > "$capture"
-printf 'SESSIONS_CALLER_PWD=%s\n' "\${SESSIONS_CALLER_PWD-}" >> "$capture"
+printf 'SESSIONS_CALLER_PWD=%s\n' "\${SESSIONS_CALLER_PWD-}" > "$capture"
 printf 'OTHER_CALLER_PWD=%s\n' "\${OTHER_CALLER_PWD-}" >> "$capture"
 exit 0
 STUB
   chmod +x "$stub_dir/shell"
 
-  export CALLER_PWD="/stale/legacy"
   export SESSIONS_CALLER_PWD="/stale/sessions"
-  export OTHER_CALLER_PWD="/stale/other"
+  export OTHER_CALLER_PWD="/other/package/context"
 
   PATH="$stub_dir:$PATH" run sessions wake "${SESSION_1:0:8}" --background --model "openai-codex/gpt-5.5"
   [ "$status" -eq 0 ]
   [ -f "$capture" ]
 
-  grep -q '^CALLER_PWD=$' "$capture"
   grep -q '^SESSIONS_CALLER_PWD=$' "$capture"
-  grep -q '^OTHER_CALLER_PWD=$' "$capture"
+  grep -q '^OTHER_CALLER_PWD=/other/package/context$' "$capture"
 }
 
 @test "wake normalizes invalid session cwd fallback before forwarding" {

From 6b2840ecc779cc2cc34d5bb201ae17de7ba37ff0 Mon Sep 17 00:00:00 2001
From: junior <junior@ricon.family>
Date: Thu, 16 Jul 2026 10:22:02 -0400
Subject: [PATCH 5/5] docs: refresh test count

---
 README.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index 401d079..5b21b47 100644
--- a/README.md
+++ b/README.md
@@ -8,7 +8,7 @@ Create sessions with structured metadata, wake agents into them,
 observe transcripts in real time, and query your history.
 
 ![lang: bash + python](https://img.shields.io/badge/lang-bash%20%2B%20python-4EAA25?style=flat&logo=gnubash&logoColor=white)
-[![tests: 321 passing](https://img.shields.io/badge/tests-321%20passing-brightgreen?style=flat)](test/)
+[![tests: 322 passing](https://img.shields.io/badge/tests-322%20passing-brightgreen?style=flat)](test/)
 ![commands: 19](https://img.shields.io/badge/commands-19-blue?style=flat)
 ![license: MIT](https://img.shields.io/badge/license-MIT-blue?style=flat)
 
@@ -274,7 +274,7 @@ cd sessions && mise trust && mise install
 mise run test
 ```
 
-**321 tests** across 21 suites, using [BATS 1.13.0](https://github.com/bats-core/bats-core). Tasks are bash scripts (session creation, wake, metadata) and Python scripts with [Rich](https://github.com/Textualize/rich) output (list, read, wait, usage, inspect, search). The shared Python support library is 2740 lines in `lib/`.
+**322 tests** across 21 suites, using [BATS 1.13.0](https://github.com/bats-core/bats-core). Tasks are bash scripts (session creation, wake, metadata) and Python scripts with [Rich](https://github.com/Textualize/rich) output (list, read, wait, usage, inspect, search). The shared Python support library is 2740 lines in `lib/`.
 
 Python code is checked with [Ruff](https://docs.astral.sh/ruff/) via `mise run lint:python`, and CI runs the same lint/format check in addition to the BATS and Elixir suites.
 
@@ -313,7 +313,7 @@ sessions/
 │   └── harness/        # Per-harness adapters (pi, …)
 ├── queries/            # Packaged sessions query SQL presets
 └── test/
-    └── *.bats          # 321 tests
+    └── *.bats          # 322 tests
 ```
 
 </details>