[HootRock]

Issue for this PR

Closes #56126

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

Accept the model resolver's apiKey as a SAP service-key fallback. Saved credentials otherwise never reach the SAP hook. Preserve environment > explicit serviceKey > saved key precedence and the existing SDK metadata options.

Credit @ton618to for diagnosing the field mismatch and demonstrating the correction in #56126. This adds a compatible fallback and a persisted-credential regression.

How did you verify your code works?

On Windows/Bun 1.4.2 with frozen dependencies:

• The stored-credential test fails without the fix and passes with it, exercising SQLite -> resolver -> AISDK -> SAP hook with a fixture SDK.
• Six owning modules: 141 passes. Six SAP cases repeated ten times: 60 passes. Core typecheck and scoped lint/format pass. Independent review found no consequential issue.
• Root bun run check passes lint but stops at the unchanged Windows textual symlink packages/app/src/custom-elements.d.ts (TS1128).

No live SAP request, full-suite pass, or end-to-end conversation claim. Existing initialization (#54791), finish-event compatibility (#50338), and process-global credential lifetime remain separate.

AI-assisted; reviewed and tested locally.

Screenshots / recordings

Not applicable; provider credential wiring only.

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR

---

Added by the opencode bot (AI-generated).

Related: #54791, #46745, #46354, #50338

[github-actions]

The following comment was made by an LLM, it may be inaccurate:

[opencode-agent]

This looks good. On the base, a SAP service key saved with /connect never reaches the SDK. With this change it does.

How I checked: running from source still hits the separate init crash (#54791), so I used a temporary test instead. It went from a saved key credential through the model resolver and the SAP hook to the real @jerome-benoit/sap-ai-provider-v2 SDK, pointed at a mock SAP server.

• Base: fails with Could not find service credentials for AI Core, and the mock receives no requests.
• With this PR: the SDK sends POST /oauth/token to the mock using the saved key.

The tests in this file pass (the new one fails on the base), and the core typecheck passes.

Public API: unchanged.

One inline note about a stale saved key after the env var is set. It's not a blocker.

Related: #54791, #46745, #46354, #50338

[opencode-agent]

Now that saved keys reach this hook, process.env.AICORE_SERVICE_KEY takes priority over them. Once the first request writes the saved key into the env var, saving a different key later (for example, fixing a wrong one) has no effect until the server restarts. This was already true for serviceKey, but users will hit it more often now. It also ties into #46745, which covers this hook writing keys into process.env. Not a blocker for this fix, but worth knowing.