fast-jev-compaction: resolve Jev key from env with secrets-file fallback (no re-login needed)

extensions/fast-jev-compaction/index.ts

@@ -7,6 +7,8 @@
 
 import type { AgentMessage } from "@earendil-works/pi-agent-core";
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
 import { compactMessages } from "./src/messages.js";
 import { reductionRatio } from "./src/compact.js";
 import type { Message, ToolResult, ToolUse } from "./src/types.js";
@@ -170,8 +172,24 @@ function formatJevHeader(result: any): string {
 }
 
 export default function fastJevCompactionExtension(pi: ExtensionAPI) {
+  /** Resolve the TypeSafe/Jev API key from env, falling back to the secrets file. */
+  function resolveJevKey(): string | undefined {
+    const fromEnv = process.env.JEV_API_KEY || process.env.TYPESAFE_API_KEY;
+    if (fromEnv) return fromEnv;
+    // Fallback: read the NixOS secrets file directly (works without a re-login).
+    try {
+      const path = `${homedir()}/.config/environment.d/10-secrets.conf`;
+      const content = readFileSync(path, "utf8");
+      const m = content.match(/^\s*(?:export\s+)?(?:JEV_API_KEY|TYPESAFE_API_KEY)\s*=\s*"?([^"\n]+)"?/m);
+      if (m?.[1]) return m[1].trim();
+    } catch {
+      /* ignore */
+    }
+    return undefined;
+  }
+
   pi.on("session_before_compact", async (event, ctx) => {
-    const apiKey = process.env.JEV_API_KEY || process.env.TYPESAFE_API_KEY;
+    const apiKey = resolveJevKey();
 
     if (!apiKey) {
       ctx.ui.notify("Fast-Jev: JEV_API_KEY not set, using default compaction", "warning");