From 6ccc4234ffc618e096d99d981040d836732e974f Mon Sep 17 00:00:00 2001
From: orca-bug-scan-bot <orca-bug-scan-bot@stably.ai>
Date: Fri, 15 May 2026 12:10:05 -0700
Subject: [PATCH] fix: address pr-bug-scan validated finding from #1878

Pass null (not undefined) to RuntimeClient ctor for environment/serve commands so ES default params don't fall back to ORCA_ENVIRONMENT/ORCA_PAIRING_CODE.
---
 src/cli/index.ts | 26 ++++++++++++++++++--------
 1 file changed, 18 insertions(+), 8 deletions(-)

diff --git a/src/cli/index.ts b/src/cli/index.ts
index 00a96e9043f..c35cefd8fac 100644
--- a/src/cli/index.ts
+++ b/src/cli/index.ts
@@ -45,14 +45,24 @@ export async function main(argv = process.argv.slice(2), cwd = process.cwd()): P
     // simple command typos or unsupported flags.
     validateCommandAndFlags(COMMAND_SPECS, parsed)
     const ignoreRemoteSelection = shouldIgnoreRemoteSelection(parsed.commandPath)
-    const pairingCode = ignoreRemoteSelection ? null : parsed.flags.get('pairing-code')
-    const environmentSelector = ignoreRemoteSelection ? null : parsed.flags.get('environment')
-    const client = new RuntimeClient(
-      undefined,
-      undefined,
-      typeof pairingCode === 'string' ? pairingCode : undefined,
-      typeof environmentSelector === 'string' ? environmentSelector : undefined
-    )
+    const pairingCodeFlag = parsed.flags.get('pairing-code')
+    const environmentFlag = parsed.flags.get('environment')
+    // Why: RuntimeClient's ctor uses ES default parameters that fall back to
+    // ORCA_PAIRING_CODE / ORCA_ENVIRONMENT when the argument is `undefined`.
+    // For environment/serve commands we must bypass that fallback, so pass
+    // `null` (a valid typed value that does not trigger defaults) rather than
+    // `undefined`.
+    const pairingCode = ignoreRemoteSelection
+      ? null
+      : typeof pairingCodeFlag === 'string'
+        ? pairingCodeFlag
+        : undefined
+    const environmentSelector = ignoreRemoteSelection
+      ? null
+      : typeof environmentFlag === 'string'
+        ? environmentFlag
+        : undefined
+    const client = new RuntimeClient(undefined, undefined, pairingCode, environmentSelector)
     await dispatch(parsed.commandPath, {
       flags: parsed.flags,
       client,