From 4d759ae60c42687d3d3faf1cc6b791242a49ad8d Mon Sep 17 00:00:00 2001
From: Codex <codex@local>
Date: Mon, 1 Jun 2026 17:57:23 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E9=80=8F=E4=BC=A0=20AgentRun=20transien?=
 =?UTF-8?q?t=20env?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 internal/cloud/code-agent-agentrun-adapter.ts | 13 ++++++++++++-
 internal/cloud/server-agent-chat.test.ts      |  7 ++++++-
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/internal/cloud/code-agent-agentrun-adapter.ts b/internal/cloud/code-agent-agentrun-adapter.ts
index e089b309..0478490e 100644
--- a/internal/cloud/code-agent-agentrun-adapter.ts
+++ b/internal/cloud/code-agent-agentrun-adapter.ts
@@ -374,6 +374,7 @@ function buildAgentRunCommandInput({ params, traceId, backendProfile }) {
 }
 
 function buildAgentRunRunnerJobInput({ env, traceId, commandId }) {
+  const transientEnv = buildAgentRunTransientEnv(env);
   return {
     commandId,
     idempotencyKey: traceId,
@@ -383,10 +384,20 @@ function buildAgentRunRunnerJobInput({ env, traceId, commandId }) {
       : {}),
     ...(firstNonEmpty(env.HWLAB_CODE_AGENT_AGENTRUN_RUNNER_SERVICE_ACCOUNT, env.AGENTRUN_RUNNER_SERVICE_ACCOUNT)
       ? { serviceAccountName: firstNonEmpty(env.HWLAB_CODE_AGENT_AGENTRUN_RUNNER_SERVICE_ACCOUNT, env.AGENTRUN_RUNNER_SERVICE_ACCOUNT) }
-      : {})
+      : {}),
+    ...(transientEnv.length > 0 ? { transientEnv } : {})
   };
 }
 
+function buildAgentRunTransientEnv(env = process.env) {
+  const entries = [];
+  for (const name of ["HWLAB_DEVICE_POD_API_URL", "HWLAB_CLOUD_API_URL", "HWLAB_DEVICE_POD_SESSION_TOKEN"]) {
+    const value = firstNonEmpty(env[name]);
+    if (value) entries.push({ name, value, sensitive: true });
+  }
+  return entries;
+}
+
 function providerCredentialSecretRef(profile, env) {
   return {
     profile,
diff --git a/internal/cloud/server-agent-chat.test.ts b/internal/cloud/server-agent-chat.test.ts
index 8816fcaa..0b63f8ee 100644
--- a/internal/cloud/server-agent-chat.test.ts
+++ b/internal/cloud/server-agent-chat.test.ts
@@ -163,6 +163,8 @@ test("cloud api /v1/agent/chat delegates v0.2 turns to AgentRun v0.1 over adapte
     }
     if (request.method === "POST" && url.pathname === "/api/v1/runs/run_hwlab_adapter/runner-jobs") {
       assert.equal(body.commandId, "cmd_hwlab_adapter");
+      assert.deepEqual(body.transientEnv.map((entry) => entry.name), ["HWLAB_DEVICE_POD_API_URL", "HWLAB_CLOUD_API_URL", "HWLAB_DEVICE_POD_SESSION_TOKEN"]);
+      assert.equal(body.transientEnv.find((entry) => entry.name === "HWLAB_DEVICE_POD_SESSION_TOKEN").value, "test-device-pod-session-token");
       return send({
         action: "create-kubernetes-job",
         runId: "run_hwlab_adapter",
@@ -215,7 +217,10 @@ test("cloud api /v1/agent/chat delegates v0.2 turns to AgentRun v0.1 over adapte
       HWLAB_CODE_AGENT_AGENTRUN_ALLOW_NON_K3S_URL: "1",
       HWLAB_CODE_AGENT_AGENTRUN_SOURCE_COMMIT: "0123456789abcdef0123456789abcdef01234567",
       HWLAB_CODE_AGENT_DEFAULT_PROVIDER_PROFILE: "deepseek",
-      HWLAB_CODE_AGENT_DEEPSEEK_MODEL: "deepseek-chat"
+      HWLAB_CODE_AGENT_DEEPSEEK_MODEL: "deepseek-chat",
+      HWLAB_DEVICE_POD_API_URL: "http://hwlab-cloud-web.test",
+      HWLAB_CLOUD_API_URL: "http://hwlab-cloud-web.test",
+      HWLAB_DEVICE_POD_SESSION_TOKEN: "test-device-pod-session-token"
     }
   });
   await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));