fix(runtime): preserve selected credentials on resume (#1294 follow-up)

[aviggiano]

A subscription Claude run still lost CLAUDE_CODE_OAUTH_TOKEN on ordinary resume when the operator redundantly included it in ULTRAFUZZ_AGENT_ENV_ALLOWLIST. The resume scrubber now retains credentials consumed by the run's selected adapters while still removing unrelated sensitive allowlisted values.

Follow-up to #1294. The regression covers token rotation and removal on resume, and the generated-adapter test checks subscription/API-key isolation. Its provider home now lives directly under the private temporary project, so the test also passes with umask 002.

Validation: the resume regression failed before the fix and passes afterward; the existing legacy-controller credential-stripping regression passes; the Bun adapter test passes with umask 002; runtime dependency build, test compilation, strict ESLint, and formatting pass.

Confidence Score: 5/5

This PR appears safe to merge.

Summary

Ordinary resume now keeps credentials required by the run’s selected adapters, even when those credentials also appear in ULTRAFUZZ_AGENT_ENV_ALLOWLIST.

• Resumed runs keep credentials used by their selected adapters.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Current resume environment] --> B[Read selected adapters from saved run]
  B --> C[Keep selected credentials]
  C --> D[Remove unrelated sensitive allowlisted values]
  D --> E[Resume controller]
  E --> F[Blank provider credentials in child environment]
  F --> G[Add only the owning adapter's credentials]

Loading

_{Reviews (1) · Last reviewed commit: "fix(runtime): retain selected provider c..." · Reviewed by Greptile}