[Security] `init` persists env-var API keys into config.json despite prompting "leave blank to use $ENV"

[404-Page-Found]

Description

The init API-key prompt says "Enter your API key (will be stored in config), or leave blank to use $API_KEY_ENV env var". But when the user leaves the field blank and the key exists in the environment, the code writes the env value into config.json:

• The secret is duplicated into the config file (plaintext on disk) even though the user opted to keep it out of the file.
• resolveApiKey() (src/llm/client.ts:16–21) gives the stored config.apiKey precedence over the env var, so later changing $API_KEY_ENV has no effect — the config file silently wins.

Location

src/commands/init.ts lines 126–139

Code

const existingKey = existingConfig?.apiKey ?? process.env[apiKeyEnv] ?? '';
...
if (keyResult) {
  apiKey = keyResult;
} else if (existingKey) {
  apiKey = existingKey;   // env value gets stored into config.json
} else {
  apiKey = '';
}

Suggested fix

Track whether the key came from the env var. If the user leaves the field blank, do not assign apiKey; rely on resolveApiKey() falling back to the env var at runtime.

Impact

Users who prefer env-var-based keys get the secret written to disk anyway, and the "env override" behavior they rely on stops working because the file value shadows the env var.