Headless --scan requires OPENHACK_API_KEY even when a BYOK provider is configured #22

Summary

openhack --scan (and --hack, --plan, --agent) exits with Error: not logged in. unless OPENHACK_API_KEY is set, even when llm_provider is a connected BYOK provider whose key is the only one inference uses. That makes BYOK impossible to use in CI or any other headless setting without an OpenHack account.

Reproduce (0.2.4, same on main @ 4e1f532)

LLM_PROVIDER=openai OPENAI_BASE_URL=<compatible endpoint> OPENAI_API_KEY=<key> OPENAI_MODEL=<model> \
  openhack --scan .
# Error: not logged in.
# Run 'openhack --login' to set up your account, or set OPENHACK_API_KEY.

With OPENHACK_API_KEY set to any placeholder, the full scan runs: recon, hunters and validators, with every model call going to the BYOK endpoint. agents/llm.py builds the client from ResolvedProvider.base_url / api_key and never reads openhack_api_key for a BYOK provider.

Where

• openhack/__main__.py (L34-L38, and the same check at L66, L94 and L116): gates on settings.openhack_api_key alone.
• A comment in tools/web.py:196 says "Login is mandatory", so this may be intentional. If it is, could the error say that an OpenHack account is required even with your own provider? The current message reads as if the provider configuration was not picked up.

Suggested change

Let the gate pass when settings.llm_provider != "openhack" and providers.is_connected(settings.llm_provider) is true. That is the same check the /models picker already uses. The one other place the OpenHack key is used is web_search, which already falls back to Exa/Brave keys and then DuckDuckGo when there is no key.

Context: we're testing OpenHack against our OpenAI-compatible gateway, ahead of proposing it as a curated provider. Headless scans are how we'd verify it in CI.

AI-assisted: found and written up with Claude Code.