fix: unify config precedence for base URL and API key across all command paths

Extract resolveBaseURL() and resolveAPIKey() helpers in cmdutil.go so
that exec, cp, and push WebSocket/auth paths use the same
CLI flag > env var > config file > default precedence as the SDK client
created by getDefaultRequestOptions().

Previously, getDefaultRequestOptions read base_url and api_key from
cli.yaml, but exec/cp/push resolved these from env vars only, causing
split configuration sources within a single command run.

Author: cursoragent

pkg/cmd/cmdutil.go

@@ -22,29 +22,46 @@ import (
 	"golang.org/x/term"
 )
 
+// resolveBaseURL returns the effective base URL using precedence:
+// CLI flag > env var > config file > default.
+func resolveBaseURL(cmd *cli.Command) string {
+	if baseURL := cmd.Root().String("base-url"); baseURL != "" {
+		return baseURL
+	}
+	if baseURL := os.Getenv("HYPEMAN_BASE_URL"); baseURL != "" {
+		return baseURL
+	}
+	cfg := loadCLIConfig()
+	if cfg.BaseURL != "" {
+		return cfg.BaseURL
+	}
+	return "http://localhost:8080"
+}
+
+// resolveAPIKey returns the effective API key using precedence:
+// env var > config file. Returns an error if no key is found.
+func resolveAPIKey() (string, error) {
+	if apiKey := os.Getenv("HYPEMAN_API_KEY"); apiKey != "" {
+		return apiKey, nil
+	}
+	cfg := loadCLIConfig()
+	if cfg.APIKey != "" {
+		return cfg.APIKey, nil
+	}
+	return "", fmt.Errorf("HYPEMAN_API_KEY environment variable or api_key in config file required")
+}
+
 func getDefaultRequestOptions(cmd *cli.Command) []option.RequestOption {
 	opts := []option.RequestOption{
 		option.WithHeader("User-Agent", fmt.Sprintf("Hypeman/CLI %s", Version)),
 	}
 
-	// Load config file for fallback values
-	cfg := loadCLIConfig()
-
-	// Precedence for base URL: CLI flag > env var > config file
-	if baseURL := cmd.String("base-url"); baseURL != "" {
+	if baseURL := resolveBaseURL(cmd); baseURL != "http://localhost:8080" {
 		opts = append(opts, option.WithBaseURL(baseURL))
-	} else if baseURL := os.Getenv("HYPEMAN_BASE_URL"); baseURL != "" {
-		opts = append(opts, option.WithBaseURL(baseURL))
-	} else if cfg.BaseURL != "" {
-		opts = append(opts, option.WithBaseURL(cfg.BaseURL))
 	}
 
-	// Precedence for API key: env var > config file
-	// (no CLI flag for API key for security reasons)
-	if apiKey := os.Getenv("HYPEMAN_API_KEY"); apiKey != "" {
+	if apiKey, err := resolveAPIKey(); err == nil {
 		opts = append(opts, option.WithAPIKey(apiKey))
-	} else if cfg.APIKey != "" {
-		opts = append(opts, option.WithAPIKey(cfg.APIKey))
 	}
 
 	return opts

pkg/cmd/cp.go

@@ -146,17 +146,11 @@ func handleCp(ctx context.Context, cmd *cli.Command) error {
 	}
 
 	// Get base URL and API key
-	baseURL := cmd.Root().String("base-url")
-	if baseURL == "" {
-		baseURL = os.Getenv("HYPEMAN_BASE_URL")
-	}
-	if baseURL == "" {
-		baseURL = "http://localhost:8080"
-	}
+	baseURL := resolveBaseURL(cmd)
 
-	apiKey := os.Getenv("HYPEMAN_API_KEY")
-	if apiKey == "" {
-		return fmt.Errorf("HYPEMAN_API_KEY environment variable required")
+	apiKey, err := resolveAPIKey()
+	if err != nil {
+		return err
 	}
 
 	archive := cmd.Bool("archive")

pkg/cmd/exec.go

@@ -146,17 +146,11 @@ func handleExec(ctx context.Context, cmd *cli.Command) error {
 	}
 
 	// Get base URL and API key
-	baseURL := cmd.Root().String("base-url")
-	if baseURL == "" {
-		baseURL = os.Getenv("HYPEMAN_BASE_URL")
-	}
-	if baseURL == "" {
-		baseURL = "http://localhost:8080"
-	}
+	baseURL := resolveBaseURL(cmd)
 
-	apiKey := os.Getenv("HYPEMAN_API_KEY")
-	if apiKey == "" {
-		return fmt.Errorf("HYPEMAN_API_KEY environment variable required")
+	apiKey, err := resolveAPIKey()
+	if err != nil {
+		return err
 	}
 
 	// Build WebSocket URL

pkg/cmd/push.go

@@ -35,13 +35,7 @@ func handlePush(ctx context.Context, cmd *cli.Command) error {
 		targetName = args[1]
 	}
 
-	baseURL := cmd.String("base-url")
-	if baseURL == "" {
-		baseURL = os.Getenv("HYPEMAN_BASE_URL")
-	}
-	if baseURL == "" {
-		baseURL = "http://localhost:8080"
-	}
+	baseURL := resolveBaseURL(cmd)
 
 	parsedURL, err := url.Parse(baseURL)
 	if err != nil {
@@ -73,7 +67,7 @@ func handlePush(ctx context.Context, cmd *cli.Command) error {
 
 	token := os.Getenv("HYPEMAN_BEARER_TOKEN")
 	if token == "" {
-		token = os.Getenv("HYPEMAN_API_KEY")
+		token, _ = resolveAPIKey()
 	}
 
 	// Use custom transport that always sends Basic auth header