fix: use effective home for legacy zai auth fallback

src/infra/provider-usage.auth.normalizes-keys.test.ts

@@ -174,7 +174,9 @@ describe("resolveProviderAuths key normalization", () => {
     );
   });
 
-  it("falls back to legacy .pi auth file for zai keys", async () => {
+  it("falls back to legacy .pi auth file for zai keys even after os.homedir() is primed", async () => {
+    // Prime os.homedir() to simulate long-lived workers that may have touched it before HOME changes.
+    os.homedir();
     await withSuiteHome(
       async (home) => {
         await writeLegacyPiAuth(

src/infra/provider-usage.auth.ts

@@ -12,6 +12,7 @@ import { getCustomProviderApiKey } from "../agents/model-auth.js";
 import { normalizeProviderId } from "../agents/model-selection.js";
 import { loadConfig } from "../config/config.js";
 import { normalizeSecretInput } from "../utils/normalize-secret-input.js";
+import { resolveRequiredHomeDir } from "./home-dir.js";
 import type { UsageProviderId } from "./provider-usage.types.js";
 
 export type ProviderAuth = {
@@ -58,7 +59,12 @@ function resolveZaiApiKey(): string | undefined {
   }
 
   try {
-    const authPath = path.join(os.homedir(), ".pi", "agent", "auth.json");
+    const authPath = path.join(
+      resolveRequiredHomeDir(process.env, os.homedir),
+      ".pi",
+      "agent",
+      "auth.json",
+    );
     if (!fs.existsSync(authPath)) {
       return undefined;
     }