From 9a4ff1eef2ffa9e7ef068d9f3ac70586a69ed022 Mon Sep 17 00:00:00 2001
From: Admin <admin@MacBookPro.lan>
Date: Wed, 19 Aug 2026 17:33:53 -0400
Subject: [PATCH] fix: include provider credentials in preflight probes

---
 dist/index.cjs                                | 17 +++++++++---
 .../unit/agent-host-preflight.test.js         | 27 +++++++++++++++++++
 src/agent-host/preflight.js                   | 22 +++++++++++----
 3 files changed, 57 insertions(+), 9 deletions(-)

diff --git a/dist/index.cjs b/dist/index.cjs
index d55116a..a8a83fb 100755
--- a/dist/index.cjs
+++ b/dist/index.cjs
@@ -32501,10 +32501,10 @@ var MCP_AGENT_IDS = Object.freeze({ claude: "claude-code" });
 function commandArgs(configuredCommand) {
   return Array.isArray(configuredCommand) ? configuredCommand.slice(1) : [];
 }
-function runCheck(binaryPath, args, spawnSyncImpl, timeout = 5e3) {
+function runCheck(binaryPath, args, spawnSyncImpl, providerEnvironment, timeout = 5e3) {
   const result = spawnSyncImpl(binaryPath, args, {
     encoding: "utf8",
-    env: buildAgentExecutableEnvironment(binaryPath),
+    env: buildAgentExecutableEnvironment(binaryPath, providerEnvironment),
     timeout
   });
   return {
@@ -32548,11 +32548,20 @@ async function inspectAgentHost(provider, dependencies = {}) {
       version: null
     };
   }
-  const version = runCheck(binaryPath, commandArgs(config.binary.checkCommand), spawnSyncImpl);
+  const providerEnvironment = buildProviderEnvironment(config, {
+    baseEnvironment: dependencies.baseEnvironment,
+    rudiHome: dependencies.rudiHome
+  });
+  const version = runCheck(
+    binaryPath,
+    commandArgs(config.binary.checkCommand),
+    spawnSyncImpl,
+    providerEnvironment
+  );
   const authArgs = commandArgs(config.binary.authCheck);
   const versionArgs = commandArgs(config.binary.checkCommand);
   const authIsObservable = JSON.stringify(authArgs) !== JSON.stringify(versionArgs);
-  const auth = authIsObservable ? runCheck(binaryPath, authArgs, spawnSyncImpl) : { ok: null };
+  const auth = authIsObservable ? runCheck(binaryPath, authArgs, spawnSyncImpl, providerEnvironment) : { ok: null };
   return {
     authenticated: auth.ok,
     authentication: auth.ok == null ? "unknown" : auth.ok ? "authenticated" : "unauthenticated",
diff --git a/src/__tests__/unit/agent-host-preflight.test.js b/src/__tests__/unit/agent-host-preflight.test.js
index 5c98014..74bfd9a 100644
--- a/src/__tests__/unit/agent-host-preflight.test.js
+++ b/src/__tests__/unit/agent-host-preflight.test.js
@@ -1,5 +1,7 @@
 import { describe, test } from 'node:test';
 import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 
 import { inspectAgentHost } from '../../agent-host/preflight.js';
@@ -22,4 +24,29 @@ describe('Agent Host preflight', () => {
     assert.equal(pathEntries.includes(path.dirname(binaryPath)), true);
     assert.equal(pathEntries.includes(path.dirname(process.execPath)), true);
   });
+
+  test('injects only provider-declared RUDI credentials into the authentication probe', async (t) => {
+    const rudiHome = fs.mkdtempSync(path.join(os.tmpdir(), 'rudi-agent-auth-'));
+    t.after(() => fs.rmSync(rudiHome, { force: true, recursive: true }));
+    fs.writeFileSync(path.join(rudiHome, 'secrets.json'), JSON.stringify({
+      CLAUDE_CODE_OAUTH_TOKEN: 'oauth-test-token',
+      UNRELATED_SECRET: 'must-not-be-forwarded',
+    }), { mode: 0o600 });
+
+    const calls = [];
+    const inspected = await inspectAgentHost('claude', {
+      baseEnvironment: { PATH: '/usr/bin:/bin' },
+      binaryPath: '/Users/example/.local/bin/claude',
+      rudiHome,
+      spawnSyncImpl(command, args, options) {
+        calls.push({ args, command, options });
+        return { status: 0, stdout: args.includes('--version') ? 'claude 1.0.0' : 'Logged in' };
+      },
+    });
+
+    const authCall = calls.find(call => call.args.join(' ') === 'auth status');
+    assert.equal(inspected.authenticated, true);
+    assert.equal(authCall.options.env.CLAUDE_CODE_OAUTH_TOKEN, 'oauth-test-token');
+    assert.equal(authCall.options.env.UNRELATED_SECRET, undefined);
+  });
 });
diff --git a/src/agent-host/preflight.js b/src/agent-host/preflight.js
index 3af05cd..b651131 100644
--- a/src/agent-host/preflight.js
+++ b/src/agent-host/preflight.js
@@ -12,7 +12,10 @@ import {
   resolveAgentProviderBinary,
   resolveAgentProviderId,
 } from './providers/index.js';
-import { buildAgentExecutableEnvironment } from './providers/common.js';
+import {
+  buildAgentExecutableEnvironment,
+  buildProviderEnvironment,
+} from './providers/common.js';
 
 const MCP_AGENT_IDS = Object.freeze({ claude: 'claude-code' });
 
@@ -20,10 +23,10 @@ function commandArgs(configuredCommand) {
   return Array.isArray(configuredCommand) ? configuredCommand.slice(1) : [];
 }
 
-function runCheck(binaryPath, args, spawnSyncImpl, timeout = 5000) {
+function runCheck(binaryPath, args, spawnSyncImpl, providerEnvironment, timeout = 5000) {
   const result = spawnSyncImpl(binaryPath, args, {
     encoding: 'utf8',
-    env: buildAgentExecutableEnvironment(binaryPath),
+    env: buildAgentExecutableEnvironment(binaryPath, providerEnvironment),
     timeout,
   });
   return {
@@ -74,12 +77,21 @@ export async function inspectAgentHost(provider, dependencies = {}) {
     };
   }
 
-  const version = runCheck(binaryPath, commandArgs(config.binary.checkCommand), spawnSyncImpl);
+  const providerEnvironment = buildProviderEnvironment(config, {
+    baseEnvironment: dependencies.baseEnvironment,
+    rudiHome: dependencies.rudiHome,
+  });
+  const version = runCheck(
+    binaryPath,
+    commandArgs(config.binary.checkCommand),
+    spawnSyncImpl,
+    providerEnvironment,
+  );
   const authArgs = commandArgs(config.binary.authCheck);
   const versionArgs = commandArgs(config.binary.checkCommand);
   const authIsObservable = JSON.stringify(authArgs) !== JSON.stringify(versionArgs);
   const auth = authIsObservable
-    ? runCheck(binaryPath, authArgs, spawnSyncImpl)
+    ? runCheck(binaryPath, authArgs, spawnSyncImpl, providerEnvironment)
     : { ok: null };
 
   return {