Summary

gbrain config set openai_api_key X writes the key to the engine's config table via engine.setConfig, but embedding.ts:24 instantiates new OpenAI() with no args — which only reads process.env.OPENAI_API_KEY. Same gap exists in operations.ts:278 (auto-embed-on-write gate) and search/hybrid.ts:81 (vector search gate).

Net effect: users who run gbrain config set openai_api_key sk-... (or write the key to ~/.gbrain/config.json directly) hit "OPENAI_API_KEY environment variable is missing or empty" errors despite the key being persisted in two places gbrain reasonably reads from. The CLI says success, the embed says missing.

This is a real UX issue on systems that deliberately don't shell-export API keys — NixOS + home-manager, per-process .env loading via python-dotenv, anywhere least-privilege shell hygiene is the convention.

Repro

unset OPENAI_API_KEY
gbrain init --pglite
gbrain config set openai_api_key sk-...
gbrain config get openai_api_key  # ✅ returns the key
echo "test" | gbrain put test-page  # writes ok, but auto-embed silently skipped (operations.ts:278)
gbrain embed --stale  # ❌ fails: "OPENAI_API_KEY environment variable is missing or empty"
gbrain query "test"  # ❌ falls back to keyword-only (hybrid.ts:81)

Fix

Adds getOpenAIKey() helper to core/config.ts that returns env-first, then falls back to reading openai_api_key from ~/.gbrain/config.json directly (independent of engine config — works even when no DB is configured). Three call sites updated:

Same env > file precedence that loadConfig() already uses for database_url.

Verification

$ unset OPENAI_API_KEY
$ # Key is in ~/.gbrain/config.json (mode 0600), nothing in shell env
$ echo "test" | gbrain put test-page  # ✅ auto-embeds (was: silently skipped)
$ gbrain embed --stale                # ✅ works (was: failed)
$ gbrain query "test"                 # ✅ semantic results (was: keyword-only)

Tests

bun test → 2164 pass / 0 fail / 250 skip (skips are pre-existing env-conditional tests, unrelated). Patch is +27 / -4 lines.

2164 pass
 250 skip
   0 fail
5599 expect() calls
Ran 2414 tests across 128 files. [74.03s]

Out of scope (possible follow-ups)

• The PGLite-stored copy from gbrain config set openai_api_key X is now dead code. A future PR could route bootstrap-key writes (engine, database_url, *_api_key, *_token) to the file instead of the engine table.
• Adding a gbrain config unset <key> command would help users clean up the dead PGLite row left behind by old setups.

Test plan

• bun test passes
• Manual verification with unset OPENAI_API_KEY and key in ~/.gbrain/config.json only
• gbrain put auto-embeds via the patched gate
• gbrain query returns semantic (not keyword-only) results
• gbrain embed --stale runs without env

🤖 Generated with Claude Code