Add Redis client utility and corresponding tests

cli/src/cmd/aiworkspace/build.go

@@ -570,7 +570,14 @@ func buildLLMProviderPayload(name string, metadata aiWorkspaceMetadata, runtime
 	if up := runtime.Spec.Upstream; up != nil {
 		target := llmUpstreamTarget{URL: strings.TrimSpace(up.URL)}
 		if up.Auth != nil {
-			target.Auth = &llmUpstreamAuth{Type: up.Auth.Type, Header: up.Auth.Header, Value: up.Auth.Value}
+			target.Auth = &llmUpstreamAuth{
+				Type:          up.Auth.Type,
+				Header:        up.Auth.Header,
+				Value:         up.Auth.Value,
+				PolicyName:    up.Auth.PolicyName,
+				PolicyVersion: up.Auth.PolicyVersion,
+				PolicyParams:  up.Auth.PolicyParams,
+			}
 		}
 		payload.Upstream = &llmUpstream{Main: target}
 	}
@@ -643,7 +650,14 @@ func buildMCPProxyPayload(name string, metadata aiWorkspaceMetadata, runtime aiW
 	if up := runtime.Spec.Upstream; up != nil {
 		target := llmUpstreamTarget{URL: strings.TrimSpace(up.URL)}
 		if up.Auth != nil {
-			target.Auth = &llmUpstreamAuth{Type: up.Auth.Type, Header: up.Auth.Header, Value: up.Auth.Value}
+			target.Auth = &llmUpstreamAuth{
+				Type:          up.Auth.Type,
+				Header:        up.Auth.Header,
+				Value:         up.Auth.Value,
+				PolicyName:    up.Auth.PolicyName,
+				PolicyVersion: up.Auth.PolicyVersion,
+				PolicyParams:  up.Auth.PolicyParams,
+			}
 		}
 		payload.Upstream = &llmUpstream{Main: target}
 	}
@@ -991,11 +1005,15 @@ func buildLLMProxyPayload(proxyName string, metadata aiWorkspaceMetadata, runtim
 	}
 
 	// The proxy references its provider by id; the provider owns the credential
-	// value, so only the auth type/header are carried here (never the secret).
+	// value, so only non-secret fields are carried here - type/header/policyName/
+	// policyVersion, never value or policyParams (which for oauth2 holds the
+	// client secret/token endpoint credentials).
 	if auth := runtime.Spec.Provider.Auth; auth != nil {
 		payload.Provider.Auth = &llmUpstreamAuth{
-			Type:   auth.Type,
-			Header: auth.Header,
+			Type:          auth.Type,
+			Header:        auth.Header,
+			PolicyName:    auth.PolicyName,
+			PolicyVersion: auth.PolicyVersion,
 		}
 	}
 
@@ -1105,9 +1123,12 @@ type runtimeProvider struct {
 }
 
 type runtimeProviderAuth struct {
-	Type   string `yaml:"type"`
-	Header string `yaml:"header"`
-	Value  string `yaml:"value"`
+	Type          string                 `yaml:"type"`
+	Header        string                 `yaml:"header"`
+	Value         string                 `yaml:"value"`
+	PolicyName    string                 `yaml:"policyName"`
+	PolicyVersion string                 `yaml:"policyVersion"`
+	PolicyParams  map[string]interface{} `yaml:"policyParams"`
 }
 
 type runtimeUpstream struct {
@@ -1172,9 +1193,12 @@ type llmProxyProvider struct {
 }
 
 type llmUpstreamAuth struct {
-	Type   string `json:"type,omitempty"`
-	Header string `json:"header,omitempty"`
-	Value  string `json:"value,omitempty"`
+	Type          string                 `json:"type,omitempty"`
+	Header        string                 `json:"header,omitempty"`
+	Value         string                 `json:"value,omitempty"`
+	PolicyName    string                 `json:"policyName,omitempty"`
+	PolicyVersion string                 `json:"policyVersion,omitempty"`
+	PolicyParams  map[string]interface{} `json:"policyParams,omitempty"`
 }
 
 type llmPolicy struct {

cli/src/cmd/aiworkspace/build_test.go

@@ -106,6 +106,31 @@ func TestBuildLLMProxyPayload_UsesRuntimeDescriptionWhenSet(t *testing.T) {
 	}
 }
 
+func TestBuildLLMProxyPayload_ProviderAuthOmitsSecretFields(t *testing.T) {
+	rt := newProxyRuntime()
+	rt.Spec.Provider.Auth = &runtimeProviderAuth{
+		Type:          "oauth2",
+		PolicyName:    "oauth2-generator",
+		PolicyVersion: "v1",
+		Value:         "should-never-be-copied",
+		PolicyParams: map[string]interface{}{
+			"clientSecret": "should-never-be-copied",
+		},
+	}
+
+	payload := buildLLMProxyPayload("claude-proxy2", newProxyMetadata(), rt, "")
+	auth := payload.Provider.Auth
+	if auth == nil {
+		t.Fatalf("expected provider auth to be set")
+	}
+	if auth.Type != "oauth2" || auth.PolicyName != "oauth2-generator" || auth.PolicyVersion != "v1" {
+		t.Fatalf("expected non-secret fields to pass through, got %+v", auth)
+	}
+	if auth.Value != "" || auth.PolicyParams != nil {
+		t.Fatalf("expected secret-bearing fields (value/policyParams) to be omitted, got %+v", auth)
+	}
+}
+
 func TestBuildLLMProxyPayload_OmitsPoliciesWhenNone(t *testing.T) {
 	var md aiWorkspaceMetadata
 	md.Spec.DisplayName = "p"
@@ -189,6 +214,37 @@ func TestBuildLLMProviderPayload_OmitsModelProvidersForUnknownTemplate(t *testin
 	}
 }
 
+func TestBuildLLMProviderPayload_UpstreamOAuth2CarriesPolicyParams(t *testing.T) {
+	var metadata aiWorkspaceMetadata
+	metadata.Spec.Version = "v1.0"
+
+	var runtime aiWorkspaceRuntime
+	runtime.Spec.Upstream = &runtimeUpstream{
+		URL: "https://upstream.example.com",
+		Auth: &runtimeProviderAuth{
+			Type:          "oauth2",
+			PolicyVersion: "v1",
+			PolicyParams: map[string]interface{}{
+				"tokenEndpoint": "https://idp.example.com/token",
+				"clientId":      "abc",
+				"clientSecret":  "{{ secret \"upstream-oauth2\" }}",
+			},
+		},
+	}
+
+	payload := buildLLMProviderPayload("p", metadata, runtime, "")
+	if payload.Upstream == nil || payload.Upstream.Main.Auth == nil {
+		t.Fatalf("expected upstream auth to be set, got %+v", payload.Upstream)
+	}
+	auth := payload.Upstream.Main.Auth
+	if auth.Type != "oauth2" || auth.PolicyVersion != "v1" {
+		t.Fatalf("unexpected auth type/policyVersion: %+v", auth)
+	}
+	if auth.PolicyParams["tokenEndpoint"] != "https://idp.example.com/token" || auth.PolicyParams["clientId"] != "abc" {
+		t.Fatalf("expected policyParams to pass through verbatim, got %+v", auth.PolicyParams)
+	}
+}
+
 func writeTestEnvFile(t *testing.T, dir, name, content string) string {
 	t.Helper()
 	path := filepath.Join(dir, name)