Add runtime event telemetry and auth-mode config hardening

tests/provider-adapters.test.ts

@@ -107,6 +107,53 @@ test("runCodexPrompt wires client options and parses final output", async () =>
   assert.equal(closed, true);
 });
 
+test("runCodexPrompt omits apiKey when OPENAI_AUTH_MODE=chatgpt", async () => {
+  const config = loadConfig({
+    OPENAI_AUTH_MODE: "chatgpt",
+    CODEX_API_KEY: "codex-token",
+    OPENAI_API_KEY: "openai-token",
+    OPENAI_BASE_URL: "https://api.example.com/v1",
+  });
+
+  let capturedClientInput: Record<string, unknown> | undefined;
+
+  const sessionContext: SessionContext = {
+    provider: "codex",
+    sessionId: "session-codex-chatgpt",
+    mcp: {},
+    promptWithContext: "prompt with context",
+    runtimeInjection: {
+      workingDirectory: "/tmp/worktree",
+      env: {
+        HOME: "/home/tester",
+      },
+      discoveryFilePath: "/tmp/worktree/.agent-context/resources.json",
+    },
+    runInSession: async <T>(run: () => Promise<T>) => run(),
+    close: async () => {},
+  };
+
+  await runCodexPrompt("ignored", {
+    config,
+    createSessionContextFn: async () => sessionContext,
+    createCodexClient: (input) => {
+      capturedClientInput = input as Record<string, unknown>;
+      return {
+        startThread: () => ({
+          run: async () => ({
+            finalResponse: "ok",
+          }),
+        }),
+      };
+    },
+    writeOutput: () => {},
+  });
+
+  assert.equal(capturedClientInput?.["apiKey"], undefined);
+  assert.equal(capturedClientInput?.["baseUrl"], "https://api.example.com/v1");
+  assert.deepEqual(capturedClientInput?.["env"], sessionContext.runtimeInjection.env);
+});
+
 test("runClaudePrompt wires auth env, stream parsing, and output", async () => {
   const config = loadConfig({
     CLAUDE_CODE_OAUTH_TOKEN: "oauth-token",
@@ -193,6 +240,68 @@ test("runClaudePrompt wires auth env, stream parsing, and output", async () => {
   assert.equal(closed, true);
 });
 
+test("runClaudePrompt uses ambient Claude login when no token env is configured", async () => {
+  const config = loadConfig({});
+
+  let queryInput:
+    | {
+        prompt: string;
+        options?: Record<string, unknown>;
+      }
+    | undefined;
+
+  const sessionContext: SessionContext = {
+    provider: "claude",
+    sessionId: "session-claude-no-key",
+    mcp: {},
+    promptWithContext: "augmented prompt",
+    runtimeInjection: {
+      workingDirectory: "/tmp/claude-worktree",
+      env: {
+        HOME: "/home/tester",
+        PATH: "/usr/bin",
+      },
+      discoveryFilePath: "/tmp/claude-worktree/.agent-context/resources.json",
+    },
+    runInSession: async <T>(run: () => Promise<T>) => run(),
+    close: async () => {},
+  };
+
+  const queryFn: ClaudeQueryFunction = ((input: {
+    prompt: string;
+    options?: Record<string, unknown>;
+  }) => {
+    queryInput = input;
+    const stream = createMessageStream([
+      {
+        type: "result",
+        subtype: "success",
+        result: "ok",
+      } as SDKMessage,
+    ]);
+
+    return {
+      ...stream,
+      close: () => {},
+    } as ReturnType<ClaudeQueryFunction>;
+  }) as ClaudeQueryFunction;
+
+  await runClaudePrompt("ignored", {
+    config,
+    createSessionContextFn: async () => sessionContext,
+    queryFn,
+    writeOutput: () => {},
+  });
+
+  assert.equal(queryInput?.options?.apiKey, undefined);
+  assert.equal(queryInput?.options?.authToken, undefined);
+
+  const env = queryInput?.options?.env as Record<string, string | undefined> | undefined;
+  assert.equal(env?.HOME, "/home/tester");
+  assert.equal(env?.CLAUDE_CODE_OAUTH_TOKEN, undefined);
+  assert.equal(env?.ANTHROPIC_API_KEY, undefined);
+});
+
 test("readClaudeResult throws on non-success result events", async () => {
   const stream = createMessageStream([
     {