Harden MCP schema and wire Claude OAuth/token handling

src/examples/session-context.ts

@@ -1,4 +1,4 @@
-import { getConfig, type AppConfig } from "../config.js";
+import { buildClaudeAuthEnv, getConfig, type AppConfig } from "../config.js";
 import type { AgentSession } from "../agents/manager.js";
 import type { ProvisionedResources } from "../agents/provisioning.js";
 import {
@@ -60,9 +60,17 @@ export async function createSessionContext(
       resources: [{ kind: "git-worktree" }, { kind: "port-range" }],
     });
 
+    const providerAuthEnv =
+      provider === "claude"
+        ? buildClaudeAuthEnv(config.provider)
+        : {};
+
     const runtimeInjection = await provisionedResources.buildRuntimeInjection({
       discoveryFileRelativePath: config.discovery.fileRelativePath,
-      baseEnv: process.env,
+      baseEnv: {
+        ...process.env,
+        ...providerAuthEnv,
+      },
     });
 
     const promptWithContext = provisionedResources.composePrompt(input.prompt, [