fix: prefer env keys unless profiles configured

src/agents/auth-profiles.test.ts

@@ -21,9 +21,26 @@ describe("resolveAuthProfileOrder", () => {
       },
     },
   };
+  const cfg = {
+    auth: {
+      profiles: {
+        "anthropic:default": { provider: "anthropic", mode: "api_key" },
+        "anthropic:work": { provider: "anthropic", mode: "api_key" },
+      },
+    },
+  };
+
+  it("returns empty order without explicit config", () => {
+    const order = resolveAuthProfileOrder({
+      store,
+      provider: "anthropic",
+    });
+    expect(order).toEqual([]);
+  });
 
   it("prioritizes preferred profiles", () => {
     const order = resolveAuthProfileOrder({
+      cfg,
       store,
       provider: "anthropic",
       preferredProfile: "anthropic:work",
@@ -34,9 +51,33 @@ describe("resolveAuthProfileOrder", () => {
 
   it("prioritizes last-good profile when no preferred override", () => {
     const order = resolveAuthProfileOrder({
+      cfg,
       store: { ...store, lastGood: { anthropic: "anthropic:work" } },
       provider: "anthropic",
     });
     expect(order[0]).toBe("anthropic:work");
   });
+
+  it("uses explicit profiles when order is missing", () => {
+    const order = resolveAuthProfileOrder({
+      cfg,
+      store,
+      provider: "anthropic",
+    });
+    expect(order).toEqual(["anthropic:default", "anthropic:work"]);
+  });
+
+  it("uses configured order when provided", () => {
+    const order = resolveAuthProfileOrder({
+      cfg: {
+        auth: {
+          order: { anthropic: ["anthropic:work", "anthropic:default"] },
+          profiles: cfg.auth.profiles,
+        },
+      },
+      store,
+      provider: "anthropic",
+    });
+    expect(order).toEqual(["anthropic:work", "anthropic:default"]);
+  });
 });

src/agents/auth-profiles.ts

@@ -251,12 +251,17 @@ export function resolveAuthProfileOrder(params: {
   preferredProfile?: string;
 }): string[] {
   const { cfg, store, provider, preferredProfile } = params;
-  const configuredOrder = cfg?.auth?.order?.[provider] ?? [];
+  const configuredOrder = cfg?.auth?.order?.[provider];
+  const explicitProfiles = cfg?.auth?.profiles
+    ? Object.entries(cfg.auth.profiles)
+        .filter(([, profile]) => profile.provider === provider)
+        .map(([profileId]) => profileId)
+    : [];
   const lastGood = store.lastGood?.[provider];
   const order =
-    configuredOrder.length > 0
-      ? configuredOrder
-      : listProfilesForProvider(store, provider);
+    configuredOrder ??
+    (explicitProfiles.length > 0 ? explicitProfiles : undefined);
+  if (!order) return [];
 
   const filtered = order.filter((profileId) => {
     const cred = store.profiles[profileId];

src/agents/model-auth.test.ts

@@ -40,7 +40,19 @@ describe("getApiKeyForModel", () => {
         api: "openai-codex-responses",
       } as Model<Api>;
 
-      const apiKey = await getApiKeyForModel({ model });
+      const apiKey = await getApiKeyForModel({
+        model,
+        cfg: {
+          auth: {
+            profiles: {
+              "openai-codex:default": {
+                provider: "openai-codex",
+                mode: "oauth",
+              },
+            },
+          },
+        },
+      });
       expect(apiKey.apiKey).toBe(oauthFixture.access);
 
       const authProfiles = await fs.readFile(