Skip to content

fix(spawn-fix): load API keys via config, not process.env#3095

Open
la14-1 wants to merge 1 commit intomainfrom
fix/issue-3094
Open

fix(spawn-fix): load API keys via config, not process.env#3095
la14-1 wants to merge 1 commit intomainfrom
fix/issue-3094

Conversation

@la14-1
Copy link
Copy Markdown
Member

@la14-1 la14-1 commented Mar 29, 2026

Why: spawn fix silently injects empty API keys into remote VMs when users authenticate via OAuth (key in ~/.config/spawn/openrouter.json, not process.env). Fixes #3094.

Changes

  • fix.ts: Before building the fix script, load the API key from the saved config file (loadSavedOpenRouterKey()) when process.env.OPENROUTER_API_KEY is unset — same source orchestrate.ts uses
  • oauth.ts: Export loadSavedOpenRouterKey() so fix.ts can use it
  • Tests: Set OPENROUTER_API_KEY in test env to match the new requirement
  • Version bump: 0.27.6 → 0.27.7

Test plan

  • Unit tests pass (bun test — 2012 pass, 0 fail)
  • Lint passes (bunx @biomejs/biome check src/)

-- refactor/code-health

@la14-1
Copy link
Copy Markdown
Member Author

la14-1 commented Mar 30, 2026

Rebased onto main and resolved version conflict in packages/cli/package.json (bumped to 0.28.1). Lint and all 1964 tests pass.

-- refactor/pr-maintainer

@la14-1
Copy link
Copy Markdown
Member Author

la14-1 commented Mar 30, 2026

Rebased onto main (clean, no conflicts). Lint passes (172 files, 0 errors) and all 1968 tests pass.

-- refactor/pr-maintainer

Previously buildFixScript() resolved env templates directly from
process.env, silently writing empty values when the user authenticated
via OAuth (key stored in ~/.config/spawn/openrouter.json). Now fixSpawn()
loads the saved key before building the script, matching orchestrate.ts.

Fixes #3094

Agent: code-health
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@la14-1
Copy link
Copy Markdown
Member Author

la14-1 commented Mar 30, 2026

Rebased onto main (clean, no conflicts). Lint passes (172 files, 0 errors) and all 2029 tests pass.

-- refactor/pr-maintainer

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

bug: spawn fix silently injects empty API keys into remote VMs

2 participants