Gemini の API キーを差し替えても旧キーが勝つ。決め手は読み込み順ではありませんでした

import dotenv from "dotenv";
 
const before = process.env.GEMINI_API_KEY;          // シェル由来の古いキー
const r1 = dotenv.config({ path: "/tmp/keyaudit/.env" });
const after = process.env.GEMINI_API_KEY;
const r2 = dotenv.config({ path: "/tmp/keyaudit/.env", override: true });
 
console.log(JSON.stringify({
  before,
  after_default: after,
  after_override_true: process.env.GEMINI_API_KEY,
  parsed_seen: r1.parsed?.GEMINI_API_KEY,          // ← ここが罠
}, null, 2));

◇ injected env (0) from .env // tip: ⌘ override existing { override: true }
{
  "before": "OLD_STANDARD_KEY_from_shell",
  "after_default": "OLD_STANDARD_KEY_from_shell",
  "after_override_true": "NEW_AUTH_KEY_from_dotenv",
  "parsed_seen": "NEW_AUTH_KEY_from_dotenv"
}

"""読み取り時点でキーの由来を記録する監査シム"""
import os, json
 
class KeyLedger:
    def __init__(self):
        self.writes = []
        self.reads = []
 
    def supply(self, name, value, source):
        prev = os.environ.get(name)
        # 既存値が無いときは入れる。あるときは、その経路に上書き権があるかで決める
        applied = value is not None and (prev is None or self.policy(source))
        self.writes.append({
            "name": name, "source": source,
            "had_previous": prev is not None,
            "applied": bool(applied),
            "fingerprint": self.fp(value),
        })
        if applied:
            os.environ[name] = value
        return applied
 
    def policy(self, source):
        # 上書きを許す経路をここで一元管理する（暗黙の override を潰す）
        return source in {"secret-manager", "explicit-cli-flag"}
 
    def read(self, name):
        v = os.environ.get(name)
        owner = next((w["source"] for w in reversed(self.writes)
                      if w["name"] == name and w["applied"]), "pre-existing-process-env")
        self.reads.append({"name": name, "resolved_from": owner, "fingerprint": self.fp(v)})
        return v
 
    @staticmethod
    def fp(v):
        # 値そのものは残さない。先頭4文字・末尾4文字・長さだけを指紋にする
        if v is None:
            return None
        return f"{v[:4]}…{v[-4:]}(len={len(v)})"
 
    def report(self):
        return json.dumps({"writes": self.writes, "reads": self.reads},
                          ensure_ascii=False, indent=2)

{
  "writes": [
    {
      "name": "GEMINI_API_KEY",
      "source": "dotenv-file",
      "had_previous": true,
      "applied": false,
      "fingerprint": "NEW_…tenv(len=24)"
    },
    {
      "name": "GEMINI_API_KEY",
      "source": "secret-manager",
      "had_previous": true,
      "applied": true,
      "fingerprint": "NEW_…ager(len=32)"
    }
  ],
  "reads": [
    {
      "name": "GEMINI_API_KEY",
      "resolved_from": "secret-manager",
      "fingerprint": "NEW_…ager(len=32)"
    }
  ]
}