auth.json credential is ignored; only EXPLABS_API_KEY works #1

Summary

The explabs entry in ~/.pi/agent/auth.json is ignored. Only the EXPLABS_API_KEY environment variable works.

Steps to reproduce

Add the following to ~/.pi/agent/auth.json:

{
  "explabs": {
    "type": "api_key",
    "key": "!secret-tool lookup service explabs"
  }
}

Remove EXPLABS_API_KEY from the environment and run pi. The extension fails with "no API key" instead of resolving the !secret-tool command.

With EXPLABS_API_KEY=xpl_... exported, authentication succeeds — so only the env path works.

Expected behavior

The auth.json credential is resolved (including !command, $VAR, and $$/$! escapes), and EXPLABS_API_KEY is only used as a fallback when auth.json has no usable explabs entry. This is also what the README documents.

Actual behavior

auth.json is never read; only EXPLABS_API_KEY is used.

Suspected cause

In src/api-key.ts, resolveApiKey() has this branch:

// An explicit env var name opts out of the auth.json credential
if (options?.apiKeyEnv) {
  return finish({ value: process.env[apiKeyEnv] ?? "", source: "env" }, resolve);
}

The extension in src/index.ts always passes apiKeyEnv: "EXPLABS_API_KEY" (its default config value), so options.apiKeyEnv is always truthy and the auth.json lookup below it is dead code.

Environment

• @joeljuca/pi-explabs 0.1.0