fix(openshell): preserve selected config for forwarding

src/lib/adapters/openshell/forward-service.test.ts

@@ -65,6 +65,28 @@ describe("OpenShell forward service", () => {
     expect(unref).toHaveBeenCalledOnce();
   });
 
+  it("uses the selected OpenShell configuration without exposing credentials (#11084)", () => {
+    const spawnDetached = vi.fn(() => ({ unref: vi.fn() }));
+
+    launchForwardService(target, {
+      isReachable: vi.fn().mockReturnValueOnce(false).mockReturnValueOnce(true),
+      sleep: () => {},
+      sourceEnvironment: {
+        HOME: "/tmp/isolated-home",
+        NVIDIA_INFERENCE_API_KEY: "secret-value",
+        PATH: "/usr/bin",
+        XDG_CONFIG_HOME: "/tmp/selected-openshell-config",
+      },
+      spawnDetached,
+    });
+
+    expect(spawnDetached).toHaveBeenCalledWith(target.executable, buildForwardServiceArgs(target), {
+      HOME: "/tmp/isolated-home",
+      PATH: "/usr/bin",
+      XDG_CONFIG_HOME: "/tmp/selected-openshell-config",
+    });
+  });
+
   it("refuses an occupied port without launching or adopting its listener", () => {
     const spawnDetached = vi.fn();
 

src/lib/adapters/openshell/resolve-shared.ts

@@ -6,7 +6,6 @@ import { spawnSync, type SpawnSyncReturns } from "node:child_process";
 import { HERMES_LIFECYCLE_DEFINITION } from "../../domain/lifecycle/hermes-definition";
 import {
   assertPodmanExecutableAuthority,
-
   capturePodmanExecutableAuthority,
   type PodmanExecutableAuthority,
   type PodmanExecutableAuthorityDeps,
@@ -190,6 +189,7 @@ export function buildOpenShellSubprocessEnv(
     "SSL_CERT_DIR",
     "NODE_EXTRA_CA_CERTS",
     "CURL_CA_BUNDLE",
+    "XDG_CONFIG_HOME",
   ]);
   const environment = Object.fromEntries(
     Object.entries(source).filter(