fix(login): normalize quoted/prefixed API key on the interactive prompt

[dark-sorceror]

Summary

Fixes #25

The interactive login prompt was the only API-key input path that didn't normalize what the user typed. Every other source — the --api-key flag, --env-file, process env, config, and an auto-discovered .env — already runs the value through normalizeApiKey(), which strips a pasted TRACEROOT_API_KEY= assignment prefix (optionally export -prefixed) and any surrounding quotes. The prompt only called .trim(), so pasting the dashboard's copy value TRACEROOT_API_KEY="tr_..." — or simply a quote-wrapped key — was sent verbatim and failed authentication.

This makes the prompt behave identically to every other entry point: the same normalizeApiKey() is now the single normalizer all paths share.

How it works

Key invariant: every input form collapses to the bare key, on every entry point.

Pasted	Resolved
tr_abc123	tr_abc123
"tr_abc123" / 'tr_abc123'	tr_abc123
TRACEROOT_API_KEY="tr_abc123"	tr_abc123
export TRACEROOT_API_KEY="tr_abc123"	tr_abc123

What's changed

Shared config helper (TypeScript)

• src/config/apiKey.ts (new) — normalizeApiKey() moved here verbatim and exported, so the resolution chain and the prompt share one implementation (no duplicated regex/quote-stripping).
• src/config/resolve.ts — imports normalizeApiKey from the new module; resolution behavior unchanged (pure move).

Login command (TypeScript)

• src/commands/login.ts — the interactive prompt runs its input through normalizeApiKey() instead of a bare .trim(). The already-resolved-key branch (resolved keys are normalized upstream) and the empty-key MISSING_KEY guard are untouched.

Tests

• tests/config.apiKey.test.ts (new) — unit coverage for every form, including the full TRACEROOT_API_KEY="..." copy line.
• tests/commands/login.test.ts — adds two interactive cases: the prompt returns TRACEROOT_API_KEY="tr_..." and "tr_...", asserting the bare key is what gets validated and persisted.

Out of scope (already correct, intentionally untouched): the flag/env/config/.env normalization paths, the separate quote-stripping in src/config/envFile.ts, and any re-prompt-on-bad-input UX.

Before / After

$ traceroot login
API key: TRACEROOT_API_KEY="tr_abc123"

# Before → Authorization: Bearer TRACEROOT_API_KEY="tr_abc123"   → auth fails
# After  → Authorization: Bearer tr_abc123                       → logs in

Test plan

• normalizeApiKey() unit tests cover bare, double/single-quoted, TRACEROOT_API_KEY=, export …=, and the full copy line
• Interactive-prompt tests: TRACEROOT_API_KEY="tr_..." and "tr_..." both resolve to the bare key for createClient + writeConfig
• Existing flag/env/config normalization + precedence tests unchanged and green
• Full suite (npm test) passes; npm run lint and npm run typecheck clean
• Manual: traceroot login in a real TTY, paste the dashboard TRACEROOT_API_KEY="..." value → logs in, config stores the bare key

---

Summary by cubic

Fixes the interactive login prompt to normalize pasted API keys (quoted or with TRACEROOT_API_KEY=) so auth succeeds like other input paths. Extracts normalizeApiKey() to a shared module and expands tests, including unquoted prefix and empty-after-normalize.

• Bug Fixes

  • The prompt now uses normalizeApiKey(); handles "tr_...", 'tr_...', TRACEROOT_API_KEY=..., and export TRACEROOT_API_KEY=....

• Refactors

  • Moved normalizeApiKey() to src/config/apiKey.ts and imported from resolve.ts (no behavior change).
  • Added tests for normalization and interactive prompt cases, including unquoted TRACEROOT_API_KEY=..., single-quoted input, and empty-after-normalize.

^{Written for commit 562f124. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 5 files

_{Re-trigger cubic}