fix(copilot-byok): prefer COPILOT_PROVIDER_API_KEY over COPILOT_API_KEY

src/cli.test.ts

@@ -349,14 +349,14 @@ describe('cli', () => {
   });
 
   describe('Copilot BYOK env resolution', () => {
-    it('prefers COPILOT_API_KEY and falls back to COPILOT_PROVIDER_API_KEY', () => {
+    it('prefers COPILOT_PROVIDER_API_KEY and falls back to COPILOT_API_KEY', () => {
       expect(resolveCopilotApiKey({
-        COPILOT_API_KEY: 'primary-key',
-        COPILOT_PROVIDER_API_KEY: 'fallback-key',
+        COPILOT_API_KEY: 'fallback-key',
+        COPILOT_PROVIDER_API_KEY: 'primary-key',
       })).toBe('primary-key');
 
       expect(resolveCopilotApiKey({
-        COPILOT_PROVIDER_API_KEY: 'fallback-key',
+        COPILOT_API_KEY: 'fallback-key',
       })).toBe('fallback-key');
     });
 

src/copilot-api-resolver.test.ts

@@ -15,22 +15,22 @@ describe('resolveCopilotApiKey', () => {
     expect(copilotApiResolverModule).not.toHaveProperty('copilotApiResolverTestHelpers');
   });
 
-  it('should return COPILOT_API_KEY when set', () => {
+  it('should return COPILOT_API_KEY when only it is set', () => {
     const env = { COPILOT_API_KEY: 'key123' };
     expect(resolveCopilotApiKey(env)).toBe('key123');
   });
 
-  it('should return COPILOT_PROVIDER_API_KEY when COPILOT_API_KEY is not set', () => {
+  it('should return COPILOT_PROVIDER_API_KEY when only it is set', () => {
     const env = { COPILOT_PROVIDER_API_KEY: 'provider_key456' };
     expect(resolveCopilotApiKey(env)).toBe('provider_key456');
   });
 
-  it('should prefer COPILOT_API_KEY over COPILOT_PROVIDER_API_KEY', () => {
+  it('should prefer COPILOT_PROVIDER_API_KEY over COPILOT_API_KEY', () => {
     const env = {
       COPILOT_API_KEY: 'key123',
       COPILOT_PROVIDER_API_KEY: 'provider_key456',
     };
-    expect(resolveCopilotApiKey(env)).toBe('key123');
+    expect(resolveCopilotApiKey(env)).toBe('provider_key456');
   });
 
   it('should return undefined when neither key is set', () => {

src/copilot-api-resolver.ts

@@ -5,12 +5,25 @@ import {
 
 /**
  * Resolve the Copilot BYOK key from supported environment variables.
- * COPILOT_API_KEY takes precedence over COPILOT_PROVIDER_API_KEY.
+ *
+ * `COPILOT_PROVIDER_API_KEY` takes precedence over `COPILOT_API_KEY`.
+ *
+ * Rationale: `COPILOT_API_KEY` is the Copilot CLI's *session token* env var,
+ * not a BYOK upstream credential. In integrations such as gh-aw's
+ * `byok-copilot: true` flow, `COPILOT_API_KEY` is intentionally set to a
+ * placeholder sentinel (e.g. `dummy-byok-key-for-offline-mode`) to satisfy
+ * the CLI's startup check, while the real upstream BYOK credential is passed
+ * via `COPILOT_PROVIDER_API_KEY` (paired with `COPILOT_PROVIDER_BASE_URL`).
+ * Preferring `COPILOT_PROVIDER_API_KEY` here prevents AWF from forwarding the
+ * sentinel to the sidecar (github/gh-aw#35575, github/gh-aw-firewall#4040).
+ *
+ * `COPILOT_API_KEY` is still honored as a fallback for callers that have
+ * only ever set that variable.
  */
 export function resolveCopilotApiKey(
   env: Record<string, string | undefined> = process.env
 ): string | undefined {
-  return env.COPILOT_API_KEY || env.COPILOT_PROVIDER_API_KEY;
+  return env.COPILOT_PROVIDER_API_KEY || env.COPILOT_API_KEY;
 }
 
 /**