Function setEnvKey

src/setup/env-writer.ts:69–81

(key: string, value: string)

 * Returns the path written. The directory is created if needed; the file is chmod 600.
 */
export async function setEnvKey(key: string, value: string): Promise<string> {
  const trimmedKey = key.trim();
  if (!trimmedKey) throw new Error('env key name is required');
  await fs.mkdir(QODEX_HOME, { recursive: true });
  // Lock the whole read→merge→write so concurrent `provider add` runs can't clobber each other's key.
  return withLock(QODEX_ENV_FILE + '.lock', async () => {
    const vars = await readEnvFile();
    vars[trimmedKey] = value;
    // Atomic temp+fsync+rename; mode 0o600 is applied at create, so no separate chmod is needed.
    await writeFileAtomic(QODEX_ENV_FILE, serializeEnvFile(vars), { mode: 0o600, encoding: 'utf-8' });
    return QODEX_ENV_FILE;
  });
}

/**
 * Load ~/.qodex/.env into process.env at startup. Existing process.env values WIN (so an explicit