feat: add provider-scoped environment overrides (#5807)

packages/coding-agent/test/auth-storage.test.ts

@@ -134,6 +134,34 @@ describe("AuthStorage", () => {
 			}
 		});
 
+		test("apiKey env bag takes precedence over process.env", async () => {
+			const originalEnv = process.env.TEST_AUTH_SCOPED_API_KEY_12345;
+			process.env.TEST_AUTH_SCOPED_API_KEY_12345 = "process-env-value";
+
+			try {
+				writeAuthJson({
+					anthropic: {
+						type: "api_key",
+						key: "$TEST_AUTH_SCOPED_API_KEY_12345",
+						env: { TEST_AUTH_SCOPED_API_KEY_12345: "credential-env-value" },
+					},
+				});
+
+				authStorage = AuthStorage.create(authJsonPath);
+
+				expect(await authStorage.getApiKey("anthropic")).toBe("credential-env-value");
+				expect(authStorage.getProviderEnv("anthropic")).toEqual({
+					TEST_AUTH_SCOPED_API_KEY_12345: "credential-env-value",
+				});
+			} finally {
+				if (originalEnv === undefined) {
+					delete process.env.TEST_AUTH_SCOPED_API_KEY_12345;
+				} else {
+					process.env.TEST_AUTH_SCOPED_API_KEY_12345 = originalEnv;
+				}
+			}
+		});
+
 		test("apiKey with braced env syntax resolves to env value", async () => {
 			const originalEnv = process.env.TEST_AUTH_BRACED_API_KEY_12345;
 			process.env.TEST_AUTH_BRACED_API_KEY_12345 = "braced-env-api-key-value";

packages/coding-agent/test/model-registry.test.ts

@@ -893,6 +893,38 @@ describe("ModelRegistry", () => {
 			expect(registry.getProviderDisplayName("oauth-provider")).toBe("OAuth Provider");
 		});
 
+		test("stored API key env propagates to request auth and resolves headers", async () => {
+			authStorage.set("cloudflare-ai-gateway", {
+				type: "api_key",
+				key: "$CLOUDFLARE_API_KEY",
+				env: {
+					CLOUDFLARE_API_KEY: "stored-cf-token",
+					CLOUDFLARE_ACCOUNT_ID: "stored-account",
+				},
+			});
+			writeRawModelsJson({
+				"cloudflare-ai-gateway": {
+					headers: { "x-account": "$CLOUDFLARE_ACCOUNT_ID" },
+				},
+			});
+
+			const registry = ModelRegistry.create(authStorage, modelsJsonPath);
+			const model = registry.getAll().find((m) => m.provider === "cloudflare-ai-gateway");
+			expect(model).toBeDefined();
+
+			const auth = await registry.getApiKeyAndHeaders(model!);
+
+			expect(auth).toEqual({
+				ok: true,
+				apiKey: "stored-cf-token",
+				headers: { "x-account": "stored-account" },
+				env: {
+					CLOUDFLARE_API_KEY: "stored-cf-token",
+					CLOUDFLARE_ACCOUNT_ID: "stored-account",
+				},
+			});
+		});
+
 		test("registerProvider treats uppercase apiKey and headers as literals", async () => {
 			const envKeys = ["CUSTOM_NAME", "BEARER", "MODEL_TOKEN"];
 			const savedEnv: Record<string, string | undefined> = {};