feat(auth): decouple auth pipeline from harness-specific Go code (Phases 1-2)

[ptone]

Summary

Implements Phases 1 and 2 of #311 — decouples the auth pipeline from harness-specific Go code and fixes hydration ordering.

Phase 1: Fix hydration ordering

• Harness-config hydration now runs before extractRequiredEnvKeys in the env-gather (HTTP 202) path
• Hub-managed configs are downloaded with a 10-second timeout and graceful fallback to on-disk
• extractRequiredEnvKeys accepts an optional hydrated path to supplement on-disk search

Phase 2: Generic env var passthrough

• Added EnvVars map[string]string to AuthConfig for config-driven auth env vars
• GatherAuthWithEnv accepts *config.HarnessAuthMetadata and populates EnvVars from declared required_env keys
• ResolveAuth (both ContainerScriptHarness and Generic) forwards auth.EnvVars into container env (hardcoded fields take precedence)
• isAuthEnvKey made config-aware via variadic extraAuthKeys parameter
• filterResolvedSecretsForResolvedAuth and isAuthCandidateSecret extended with config-driven key awareness

What this enables

New harnesses (e.g. GitHub Copilot CLI) can declare auth requirements in their config.yaml auth: block and have tokens flow through the pipeline without any harness-specific Go code:

auth:
  types:
    api-key:
      required_env:
        any_of: [COPILOT_GITHUB_TOKEN, GH_TOKEN, GITHUB_TOKEN]

What this does NOT change

• All existing hardcoded auth paths remain functional — these changes are purely additive
• Phases 3-4 (migrating built-in harnesses to config-driven auth and removing hardcoded fields) are separate follow-up work

Files changed (8 files, +403/-22)

File	Change
pkg/api/types.go	Added EnvVars map[string]string to AuthConfig
pkg/harness/auth.go	GatherAuthWithEnv accepts auth metadata; gatherConfigEnvVars helper
pkg/harness/auth_test.go	6 new tests (copilot scenario, overlay, broker mode, nil/empty metadata)
pkg/harness/container_script_harness.go	ResolveAuth forwards auth.EnvVars
pkg/harness/generic.go	ResolveAuth forwards auth.EnvVars
pkg/agent/run.go	Config-aware isAuthEnvKey, configAuthEnvKeySet, auth metadata resolution
pkg/agent/run_test.go	4 new tests (isAuthEnvKey, configAuthEnvKeySet, filter with config keys)
pkg/runtimebroker/handlers.go	Hydration before env-gather; extractRequiredEnvKeys accepts hydrated path

Test plan

• pkg/harness/... tests pass (0.156s) — 6 new config-driven auth tests
• pkg/agent/... tests pass (4.870s) — 4 new tests
• pkg/runtimebroker/... tests pass (2.556s)
• pkg/api/... tests pass (0.009s)
• Full go build ./... clean
• Verify copilot harness auth flow end-to-end with hub-managed config

Closes #311 (Phases 1-2)

[gemini-code-assist]

Code Review

This pull request introduces support for config-driven auth metadata, allowing harnesses to dynamically declare environment variable requirements without requiring Go code changes. It updates the auth gathering, filtering, and resolution pipelines to support these dynamic keys, and adds corresponding unit tests. The review feedback highlights two critical issues: potential nil pointer dereferences in pkg/agent/run.go and pkg/runtimebroker/handlers.go when accessing config fields, and a duplicate, potentially broken resolution of the harness config directory in pkg/agent/run.go that misses template paths.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

Issues Identified:

1. Duplicate Resolution & Missing Template Paths: This block duplicates the resolution of the harness config directory on disk (which was already performed at line 243). Furthermore, because it calls resolveHarnessConfigDir without passing the templatePaths slice, it will fail to resolve the config directory if it is template-bundled (unlike the first resolution at line 243 which correctly passes templatePaths...).
2. Defensive Programming (Nil Checks): The code accesses hcDir.Config.Auth and hcEntry.Auth without verifying if hcDir, hcDir.Config, or hcEntry are nil. If any of these are nil, it will cause a runtime panic.

Recommended Refactoring:

To avoid duplicate disk I/O and fix the template-bundled resolution bug, you should declare authMeta before line 217 and populate it directly inside the first resolveHarnessConfigDir success block at line 243. Then, in this block, you only need to perform the fallback check against settings if authMeta is still nil.

For now, we have provided a code suggestion that adds the necessary defensive nil checks to prevent runtime panics.

Suggested change

	if harnessConfigName != "" {
	if hcDir, err := resolveHarnessConfigDir(ctx, harnessConfigName, projectDir); err == nil && hcDir.Config.Auth != nil {
	authMeta = hcDir.Config.Auth
	}
	if authMeta == nil && settings != nil {
	if hcEntry, err := settings.ResolveHarnessConfig(profileName, harnessConfigName); err == nil && hcEntry.Auth != nil {
	authMeta = hcEntry.Auth
	}
	}
	}
	if harnessConfigName != "" {
	if hcDir, err := resolveHarnessConfigDir(ctx, harnessConfigName, projectDir); err == nil && hcDir != nil && hcDir.Config != nil && hcDir.Config.Auth != nil {
	authMeta = hcDir.Config.Auth
	}
	if authMeta == nil && settings != nil {
	if hcEntry, err := settings.ResolveHarnessConfig(profileName, harnessConfigName); err == nil && hcEntry != nil && hcEntry.Auth != nil {
	authMeta = hcEntry.Auth
	}
	}
	}

[gemini-code-assist]

Issue Identified:

Defensive Programming (Nil Checks): The code accesses hcDir.Config.Harness, hcDir.Config.AuthSelectedType, and hcDir.Config.Auth without verifying if hcDir or hcDir.Config are nil. If either is nil, it will cause a runtime panic.

Recommended Fix:

Add defensive nil checks for both hcDir and hcDir.Config before accessing their fields.

Suggested change

	if harnessType == "" && len(hydratedHarnessConfigPath) > 0 && hydratedHarnessConfigPath[0] != "" {
	if hcDir, err := config.LoadHarnessConfigDir(hydratedHarnessConfigPath[0]); err == nil {
	harnessType = hcDir.Config.Harness
	authType = hcDir.Config.AuthSelectedType
	if hcDir.Config.Auth != nil {
	authMeta = hcDir.Config.Auth
	}
	}
	}
	if harnessType == "" && len(hydratedHarnessConfigPath) > 0 && hydratedHarnessConfigPath[0] != "" {
	if hcDir, err := config.LoadHarnessConfigDir(hydratedHarnessConfigPath[0]); err == nil && hcDir != nil && hcDir.Config != nil {
	harnessType = hcDir.Config.Harness
	authType = hcDir.Config.AuthSelectedType
	if hcDir.Config.Auth != nil {
	authMeta = hcDir.Config.Auth
	}
	}
	}