From 4a363dc6e0a8a43489050b86374e080f87bd99a7 Mon Sep 17 00:00:00 2001
From: "marcin p. joachimiak" <4625870+realmarcin@users.noreply.github.com>
Date: Tue, 21 Jul 2026 19:57:58 -0700
Subject: [PATCH] Edison runner: make repo .env authoritative over ambient key
 (403 footgun)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

load_api_key() preferred an ambient EDISON_PLATFORM_API_KEY over the repo
.env, and load_dotenv() doesn't override already-exported vars — so a stale
EDISON_PLATFORM_API_KEY left in a terminal session silently shadowed a
freshly-updated .env key and failed with 403 at /auth/login. Required an
`env -u EDISON_PLATFORM_API_KEY` workaround on every causal run.

Read the .env FILE explicitly via dotenv_values and prefer it (either key
name) over ambient env; fall back to the environment only when .env supplies
no key. Verified: with a stale ambient EDISON_PLATFORM_API_KEY present,
load_api_key() now returns the .env key and /auth/login returns 200.
black/ruff/mypy clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 scripts/research_community_edison.py | 23 +++++++++++++++++------
 1 file changed, 17 insertions(+), 6 deletions(-)

diff --git a/scripts/research_community_edison.py b/scripts/research_community_edison.py
index 6833a6f0..13baf809 100644
--- a/scripts/research_community_edison.py
+++ b/scripts/research_community_edison.py
@@ -53,7 +53,7 @@
 from typing import Any
 
 import yaml
-from dotenv import load_dotenv
+from dotenv import dotenv_values, load_dotenv
 
 REPO_ROOT = Path(__file__).resolve().parent.parent
 sys.path.insert(0, str(REPO_ROOT / "scripts"))
@@ -88,13 +88,24 @@ def resolve_job(name: str):
 
 
 def load_api_key() -> str:
-    """Pick up the Edison key from env (with the legacy alias).
-
-    The SDK natively reads ``EDISON_PLATFORM_API_KEY``; this repo's
-    ``.env`` sets ``EDISON_API_KEY``. Honor both.
+    """Pick up the Edison key, treating the repo ``.env`` as the source of truth.
+
+    The SDK natively reads ``EDISON_PLATFORM_API_KEY``; this repo's ``.env`` sets
+    ``EDISON_API_KEY``. Honor both — but prefer whatever the ``.env`` FILE
+    provides over an ambient/inherited ``EDISON_PLATFORM_API_KEY``. A stale
+    exported ``EDISON_PLATFORM_API_KEY`` (e.g. left in a terminal session) would
+    otherwise silently shadow a freshly-updated ``.env`` key, because
+    ``load_dotenv`` does not override already-exported vars — a 403-at-login
+    footgun. Ambient env is used only when ``.env`` supplies no key.
     """
     load_dotenv(REPO_ROOT / ".env")
-    key = os.environ.get("EDISON_PLATFORM_API_KEY") or os.environ.get("EDISON_API_KEY")
+    file_vals = dotenv_values(REPO_ROOT / ".env")
+    key = (
+        file_vals.get("EDISON_PLATFORM_API_KEY")
+        or file_vals.get("EDISON_API_KEY")
+        or os.environ.get("EDISON_PLATFORM_API_KEY")
+        or os.environ.get("EDISON_API_KEY")
+    )
     if not key:
         raise SystemExit(
             "EDISON_PLATFORM_API_KEY (or EDISON_API_KEY) is not set. "