fix(desktop): inherit Claude Bedrock environment

[huangkairan]

Background

Related to #4928.

When Claude Code uses Amazon Bedrock, both the provider status probe and actual sessions depend on AWS credential environment variables. When T3 Code is launched from a GUI entry point such as Finder, Electron does not naturally inherit AWS_BEARER_TOKEN_BEDROCK, the AWS region, or the Claude Code Bedrock flags from the user's login shell. The existing desktop environment hydration only restored variables such as PATH, locale, and SSH settings.

As a result, Claude Code configuration could still identify Bedrock as the active backend while the T3 server child process lacked the credentials needed to call it. The provider probe could appear unverified, and actual requests could fail.

Issue #4928 also describes managed Bedrock environments where SDK initialization returns no account information. This PR does not change the server-side authentication fallback strategy; it specifically fixes credential inheritance at the desktop process boundary.

Changes

• Restore a controlled allowlist of AWS Bedrock credentials, region settings, and Claude Code Bedrock flags from the login shell on macOS and Linux.
• Restore the same variables from the PowerShell profile on Windows while preserving values already inherited by the desktop process.
• Forward these variables to the Windows WSL backend through the existing WSLENV mechanism.
• Add behavior coverage for macOS, Windows, and Windows-to-WSL propagation.

Verification

• git diff --check passes.
• Targeted Vitest cases were added, but could not be executed because the current environment repeatedly failed while downloading the monorepo dependencies.

Model: GPT-5.6 Sol
Harness: T3 Code Codex

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 471217ed-e03b-42d1-975d-7a362a4d9c05

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Approved 1d5c12e

This PR extends existing credential forwarding patterns to include AWS Bedrock environment variables. The changes are purely additive, following established patterns already used for OPENAI_API_KEY and ANTHROPIC_API_KEY, with comprehensive test coverage.

^{You can customize Macroscope's approvability policy. Learn more.}

[huangkairan]

Hi, @t3dotgg @juliusmarminge could you please review this PR when you have a moment? Thanks!

[juliusmarminge]

Note

This comment is posted by Julius' dot

Closing this under the verification requirement. The PR says the new Bedrock environment tests could not run; git diff --check does not establish that GUI launch or Windows to WSL credential forwarding works. The current CI run has no test jobs, and the bot reviews do not supply execution results. Run the focused environment and backend configuration tests and report their results, or provide equivalent checks of the changed behavior, then request reconsideration.