[yuanhao]

Asked for by yobuild (M3b step 4, design in yobuild PR #54: every plugin runtime it starts gets each model-provider key variable set to "", since rutis's Launcher and the stdio MCP transport can only add variables). check's probes were the one runtime still inheriting the keys.

yoagent (additive):

• provider::api_key_variables() -> Vec<&'static str> — every variable yoagent reads a credential from, each once: the providers' (as resolve_api_key reads them), Bedrock's AWS_BEARER_TOKEN_BEDROCK / AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_SESSION_TOKEN, the YOAGENT_API_KEY / API_KEY fallback, and the decision presets' TYPESAFE_API_KEY / CLOUDFLARE_API_TOKEN / CLOUDFLARE_AUTH_TOKEN.
• resolve_api_key's per-provider match became the private PROVIDER_KEY_VARIABLES table both read (same names, same order, same fallback; Bedrock/vertex/local unchanged), so the list cannot drift. Unit tests: every expected name present, no duplicates; with decision, the decision names equal decision::systemone's constants (systemone made pub(crate) for that).

yoagent-rutis (additive):

• probe::ProbeOptions { env: Vec<(OsString, OsString)> } (#[non_exhaustive], Default, .env(name, value) builder) and probe::pi_with / probe::dsh_with taking &ProbeOptions; pi / dsh delegate with the default. The variables are set over the inherited environment (an empty value included); the DSH probe's private DSH_HOME / DSH_AGENTS_HOME are set after them and win.
• Test probe_options_set_the_runtime_s_environment: a pi extension sees a value and an empty one (and nothing without options); a DSH row sees the value, and a caller's DSH_HOME does not override the probe's.

Docs: CHANGELOG (## Unreleased for yoagent, ## yoagent-rutis Unreleased), docs/providers/overview.md, the yoagent-rutis README probe section, both CLAUDE.md files.

Not done here: true variable removal (Launcher::env_remove) belongs to rutis upstream.

Checks: yoagent --all-features test / clippy / doc / fmt clean; yoagent-rutis clippy, doc, fmt clean, probe_test 11/11. (Four dsh_test host tests fail locally only because this worktree borrows a node_modules installed before #356 added dsh-session-persistence-jsonl; CI installs fresh.)

🤖 Generated with Claude Code

https://claude.ai/code/session_01T7iq5hpndSiHQcnAsywKuG

[yuanhao]

Review: no critical or important issues (refactor checked behaviour-identical per provider; list complete against every env read in src/; env order confirmed last-wins in rutis-bridge). Suggestions applied in 33e19a6: the Bedrock branch reads BEDROCK_KEY_VARIABLES, systemone stays private (cfg(test) re-export), the DSH_HOME assertion requires the probe's own value, CHANGELOG wording narrowed. bedrock_auth_test 15/15, lib 476, probe test pass.