vix had no mechanism to resolve provider API keys via a shell helper command.
Other tools (e.g. Claude Code) support an `apiKeyHelper` field in their config
that runs a shell command and uses its stdout as the API key — useful for
credential managers, SSO tokens, and short-lived JWTs.
vix's `resolveKey` function only checked env vars, OS keychain, and `.env` files.
There was no way to wire in a dynamic credential source without modifying env vars
at the shell level.
Expected: an `apiKeyHelper` field in `settings.json` (home or project level) is
supported. When set, vix runs the command via `sh -c`, uses trimmed stdout as the
API key, and caches JWT tokens until 5 minutes before their `exp` claim expires.
vix had no mechanism to resolve provider API keys via a shell helper command.
Other tools (e.g. Claude Code) support an `apiKeyHelper` field in their config
that runs a shell command and uses its stdout as the API key — useful for
credential managers, SSO tokens, and short-lived JWTs.
vix's `resolveKey` function only checked env vars, OS keychain, and `.env` files.
There was no way to wire in a dynamic credential source without modifying env vars
at the shell level.
Expected: an `apiKeyHelper` field in `settings.json` (home or project level) is
supported. When set, vix runs the command via `sh -c`, uses trimmed stdout as the
API key, and caches JWT tokens until 5 minutes before their `exp` claim expires.