fix(backend): inject provider credentials from file

backend/test/pi-process-manager.test.ts

@@ -3,6 +3,7 @@ import { spawn } from "node:child_process";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { EventEmitter } from "node:events";
+import { chmodSync, writeFileSync } from "node:fs";
 import { PiProcessManager } from "../src/pi/pi-process-manager.js";
 import { loadConfig } from "../src/config.js";
 
@@ -149,12 +150,12 @@ test("production spawn uses explicit Pi path and passes portable data root witho
     expect(options.cwd).toBe("/app/harness");
     expect(options.env).toMatchObject({
       PATH: "/usr/local/bin:/usr/bin",
-      PI_PROVIDER_API_KEY: "provider-secret",
       NODE_EXTRA_CA_CERTS: "/certs/company-ca.pem",
       THT_DATA_ROOT: "/data",
       THT_SESSION: "portable-session",
       THT_AUTHOR: "user@example.test",
     });
+    expect(options.env).not.toHaveProperty("PI_PROVIDER_API_KEY");
   } finally {
     mgr.teardown("portable-session");
     vi.unstubAllEnvs();
@@ -174,9 +175,100 @@ test("session Pi spawn omits ambient THT_DATA_ROOT when config does not provide
   try {
     await mgr.spawnFor("no-data-root", {});
     expect(calls[0][2].env).not.toHaveProperty("THT_DATA_ROOT");
-    expect(calls[0][2].env.PI_PROVIDER_API_KEY).toBe("still-inherited");
+    expect(calls[0][2].env).not.toHaveProperty("PI_PROVIDER_API_KEY");
   } finally {
     mgr.teardown("no-data-root");
     vi.unstubAllEnvs();
   }
 });
+
+test.each([
+  ["anthropic", "ANTHROPIC_API_KEY"],
+  ["OpenAI", "OPENAI_API_KEY"],
+  ["gemini", "GEMINI_API_KEY"],
+  ["google", "GEMINI_API_KEY"],
+  ["deepseek", "DEEPSEEK_API_KEY"],
+  ["zai", "ZAI_API_KEY"],
+  ["openrouter", "OPENROUTER_API_KEY"],
+])("injects the generic file credential only as %s provider env", async (provider, expectedName) => {
+  const secret = path.resolve(__dirname, `.model-key-${process.pid}-${provider}`);
+  writeFileSync(secret, "provider-secret", { mode: 0o600 });
+  const calls: any[][] = [];
+  const child = recordingChild();
+  child.stderr.resume = () => {};
+  const mgr = new PiProcessManager(loadConfig({
+    PI_BIN: "/usr/local/bin/pi", THT_MODEL_API_KEY_FILE: secret,
+  }), { spawnFn: (...args: any[]) => { calls.push(args); return child as any; } });
+  try {
+    await mgr.spawnFor("credential-session", { provider });
+    const env = calls[0][2].env;
+    expect(env[expectedName]).toBe("provider-secret");
+    expect(env).not.toHaveProperty("PI_PROVIDER_API_KEY");
+    expect(env).not.toHaveProperty("THT_MODEL_API_KEY_FILE");
+    expect(JSON.stringify(calls[0].slice(0, 2))).not.toContain("provider-secret");
+  } finally {
+    mgr.teardown("credential-session");
+    await import("node:fs/promises").then((fs) => fs.unlink(secret));
+  }
+});
+
+test("local providers spawn without a model key and scrub ambient generic credentials", async () => {
+  vi.stubEnv("PI_PROVIDER_API_KEY", "ambient-secret");
+  vi.stubEnv("THT_MODEL_API_KEY_FILE", "/ambient/secret-path");
+  vi.stubEnv("OPENAI_API_KEY", "unselected-provider-secret");
+  const calls: any[][] = [];
+  const child = recordingChild();
+  child.stderr.resume = () => {};
+  const mgr = new PiProcessManager(loadConfig({ PI_BIN: "/usr/local/bin/pi" }), {
+    spawnFn: (...args: any[]) => { calls.push(args); return child as any; },
+  });
+  try {
+    await mgr.spawnFor("local-session", { provider: "ollama" });
+    expect(calls[0][2].env).not.toHaveProperty("PI_PROVIDER_API_KEY");
+    expect(calls[0][2].env).not.toHaveProperty("THT_MODEL_API_KEY_FILE");
+    expect(calls[0][2].env).not.toHaveProperty("OPENAI_API_KEY");
+  } finally {
+    mgr.teardown("local-session");
+    vi.unstubAllEnvs();
+  }
+});
+
+test.each(["missing", "permissive", "unreadable", "directory", "symlink", "unsupported"])(
+  "hosted provider credential failure is sanitized: %s", async (kind) => {
+    const target = path.resolve(__dirname, `.bad-model-key-${process.pid}-${kind}`);
+    if (kind === "permissive") {
+      writeFileSync(target, "DO_NOT_LEAK", { mode: 0o644 });
+      chmodSync(target, 0o644);
+    } else if (kind === "unreadable") {
+      writeFileSync(target, "DO_NOT_LEAK", { mode: 0o000 });
+    } else if (kind === "directory") {
+      await import("node:fs/promises").then((fs) => fs.mkdir(target));
+    } else if (kind === "symlink") {
+      const source = `${target}-source`;
+      writeFileSync(source, "DO_NOT_LEAK", { mode: 0o600 });
+      await import("node:fs/promises").then((fs) => fs.symlink(source, target));
+    }
+    const cfg = loadConfig({ THT_MODEL_API_KEY_FILE: target });
+    const mgr = new PiProcessManager(cfg, { spawnFn: () => {
+      throw new Error("spawn must not occur");
+    } });
+    try {
+      const provider = kind === "unsupported" ? "unknown-hosted" : "anthropic";
+      await expect(mgr.spawnFor("bad-secret", { provider }))
+        .rejects.toThrow("model provider credential is unavailable");
+    } finally {
+      if (kind === "permissive") await import("node:fs/promises").then((fs) => fs.unlink(target));
+      if (kind === "unreadable") {
+        chmodSync(target, 0o600);
+        await import("node:fs/promises").then((fs) => fs.unlink(target));
+      }
+      if (kind === "directory") await import("node:fs/promises").then((fs) => fs.rmdir(target));
+      if (kind === "symlink") {
+        await import("node:fs/promises").then(async (fs) => {
+          await fs.unlink(target);
+          await fs.unlink(`${target}-source`);
+        });
+      }
+    }
+  },
+);