Description
The init API-key prompt says "Enter your API key (will be stored in config), or leave blank to use $API_KEY_ENV env var". But when the user leaves the field blank and the key exists in the environment, the code writes the env value into config.json:
- The secret is duplicated into the config file (plaintext on disk) even though the user opted to keep it out of the file.
resolveApiKey() (src/llm/client.ts:16–21) gives the stored config.apiKey precedence over the env var, so later changing $API_KEY_ENV has no effect — the config file silently wins.
Location
src/commands/init.ts lines 126–139
Code
constexistingKey=existingConfig?.apiKey??process.env[apiKeyEnv]??'';
...
if(keyResult){apiKey=keyResult;}elseif(existingKey){apiKey=existingKey;// env value gets stored into config.json}else{apiKey='';}Suggested fix
Track whether the key came from the env var. If the user leaves the field blank, do not assign apiKey; rely on resolveApiKey() falling back to the env var at runtime.
Impact
Users who prefer env-var-based keys get the secret written to disk anyway, and the "env override" behavior they rely on stops working because the file value shadows the env var.
Description
The
initAPI-key prompt says "Enter your API key (will be stored in config), or leave blank to use$API_KEY_ENVenv var". But when the user leaves the field blank and the key exists in the environment, the code writes the env value intoconfig.json:resolveApiKey()(src/llm/client.ts:16–21) gives the storedconfig.apiKeyprecedence over the env var, so later changing$API_KEY_ENVhas no effect — the config file silently wins.Location
src/commands/init.tslines 126–139Code
Suggested fix
Track whether the key came from the env var. If the user leaves the field blank, do not assign
apiKey; rely onresolveApiKey()falling back to the env var at runtime.Impact
Users who prefer env-var-based keys get the secret written to disk anyway, and the "env override" behavior they rely on stops working because the file value shadows the env var.