fix: Use the connected key for the rest of the run

[chmaltsp]

Problem

The analyze step re-read the API key from disk instead of using the one the run had just authenticated with:

const found = findExistingApiKey(root)          // src/lib/app.tsx
...
currentSession = await exchangeWizardInferenceToken(found.api_key)

findExistingApiKey returns process.env.SEAM_API_KEY ahead of any dotenv file (src/lib/env-file.ts), while the browser handoff and the pasted-key path write the chosen key to .env.

So when SEAM_API_KEY is exported in the shell, a run that connects through the browser to workspace B mints its wizard session with workspace A's key.

The failure is quiet. The UI prints Connected · workspace B from result.workspace, then plans and writes the integration against workspace A. It only becomes a visible error when the exported key is invalid or points at an unreachable endpoint, and then only as the generic Couldn't start the AI session.

A second shadowing path exists even with no environment variable set: ENV_FILE_NAMES prefers .env.local over .env, but both auth paths write to .env, so a stale .env.local also wins.

Fix

Carry the verified key through the run rather than re-deriving it:

• connectViaWeb and verifyAndSaveKey now return the key they verified alongside the workspace.
• settleOn records it in apiKeyRef, and analyze prefers that over re-reading the environment (the existing lookup stays as a fallback).

The browser and pasted paths called setWorkspace + advanceAfterAuth directly, bypassing settleOn — the one place that calls saveConnection. That is why the 'browser' and 'pasted' members of settleOn's source union were unreachable. Routing both through settleOn fixes the key selection and, as a side effect, records connections for runs that previously left none — so the "Set up here before" drift check now works for them too.

Verification

• Added src/lib/steps/authenticate.test.ts. Both cases fail against the unfixed authenticate.ts (expected undefined to be 'seam_pasted_key') and pass with it.
• npm test — 172 passed, 20 files.
• npm run typecheck and npm run lint — clean.

Note: the wiring in app.tsx is not covered directly. test/app.test.tsx states that a full interactive run cannot be exercised headlessly, so it asserts only the first frame; I did not try to extend that harness here.

Not addressed

The .env.local precedence remains: a key written to .env is still shadowed by an existing .env.local on the next run. Worth a follow-up on whether saveProjectApiKey should write to the file the key was found in, or whether the wizard should warn on the conflict.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.