Expose harness role/slug as always-injected FULLSEND_ROLE/FULLSEND_SLUG sandbox env vars

[ralphbean]

Working on fullsend-ai/agents#709, we hit a case where a skill needs to know its own harness identity at runtime — specifically, skills/pr-review/SKILL.md needs to recognize which GitHub App posted a given comment, so it can tell "the review bot's own prior finding" apart from an unrelated human comment.

The obvious way to do that is to compare comment.user.login against the app's slug. But if we hardcode that slug as a literal string in the skill, it silently breaks for any repo that overrides role/slug in a customized harness YAML — the skill and the harness file drift apart with no signal that they've done so.

h.Role and h.Slug are already parsed onto the Harness struct (internal/harness/harness.go), and bootstrapEnv() in internal/cli/run.go already always-injects a handful of FULLSEND_* infra vars into the sandbox regardless of env.sandbox (FULLSEND_OUTPUT_DIR, FULLSEND_TARGET_REPO_DIR, FULLSEND_FETCH_URL, etc.) — reservedSandboxKeys stops env.sandbox from shadowing them.

Proposing we extend that same list with FULLSEND_ROLE (from h.Role) and FULLSEND_SLUG (from h.Slug, when set), registered in reservedSandboxKeys the same way. That gives skills a way to reference their own harness identity without ever risking drift from the harness file.

fullsend-ai/agents#709 is blocked on this — it currently has to fall back to pattern-matching on user.login for the app-identity check.

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 3:07 PM UTC · Completed 3:11 PM UTC

Commit: da91b14 · View workflow run →

[fullsend-ai-triage]

This unblocks fullsend-ai/agents#709, which currently falls back to fragile pattern-matching on user.login to identify the app's own comments.

Related issue: #5938 asks how to detect a Fullsend environment in general — FULLSEND_ROLE would partially address that use case too, though the two issues have different scopes.

Proposed test case

func TestBootstrapEnv_RoleAndSlug(t *testing.T) {
    // Case 1: Both role and slug set
    h := &harness.Harness{Role: "review", Slug: "my-app"}
    // Call bootstrapEnv and assert output contains:
    //   export FULLSEND_ROLE='review'
    //   export FULLSEND_SLUG='my-app'

    // Case 2: Role set, slug empty
    h2 := &harness.Harness{Role: "coder"}
    // Assert FULLSEND_ROLE present, FULLSEND_SLUG absent

    // Case 3: reservedSandboxKeys blocks env.sandbox override
    h3 := &harness.Harness{
        Role: "review",
        Env:  &harness.EnvConfig{Sandbox: map[string]string{"FULLSEND_ROLE": "evil"}},
    }
    // Assert buildSandboxEnvLines skips FULLSEND_ROLE
}

---

Labels: This is a feature request touching the harness component (internal/harness/ and internal/cli/run.go bootstrapEnv). Medium priority since it unblocks downstream work but has a known workaround.

---

Next steps:

• /fs-code — agent creates a PR to implement this issue
• /fs-code <your instruction> — agent implements with your specific guidance

[ralphbean]

/fs-code

[fullsend-ai-coder]

🤖 Finished Code · ✅ Success · Started 3:22 PM UTC · Completed 3:39 PM UTC

Commit: da91b14 · View workflow run →