fix(config): derive ENV_LLM_KEYS from ENV_LLM_MAP to prevent drift

applyEnvProvenance hardcoded a second literal list of the four
CODEGRAPH_LLM_* env var names to decide whether to attribute
provenance.llm = 'env'. If a new override were ever added to
ENV_LLM_MAP without updating this list, the override would work but
`codegraph config --explain` would silently fail to attribute it.

Move ENV_LLM_MAP above the provenance helpers and derive the key list
via Object.keys(ENV_LLM_MAP) so the two can never drift apart.

Author: carlos-alm

src/infrastructure/config.ts

@@ -821,6 +821,19 @@ export function clearConfigCache(): void {
   _globalConfigCache.clear();
 }
 
+/**
+ * Single source of truth for CODEGRAPH_LLM_* env var overrides, mapping each
+ * env var name to the `config.llm` field it overrides. Consumed both by
+ * applyEnvOverrides (actual override behavior) and applyEnvProvenance (which
+ * derives its key list via Object.keys) so the two can never drift.
+ */
+const ENV_LLM_MAP: Record<string, string> = {
+  CODEGRAPH_LLM_PROVIDER: 'provider',
+  CODEGRAPH_LLM_API_KEY: 'apiKey',
+  CODEGRAPH_LLM_MODEL: 'model',
+  CODEGRAPH_LLM_BASE_URL: 'baseUrl',
+};
+
 /**
  * Layer 0 provenance: every top-level key starts attributed to 'default'.
  */
@@ -866,16 +879,11 @@ function applyProjectProvenance(provenance: Record<string, ConfigSource>, cwd: s
 
 /**
  * Layer 3+ provenance: mark `llm` as env-sourced if any CODEGRAPH_LLM_*
- * override variable is set.
+ * override variable is set. Keys are derived from ENV_LLM_MAP so this can
+ * never drift from the env vars applyEnvOverrides actually honors.
  */
 function applyEnvProvenance(provenance: Record<string, ConfigSource>): void {
-  const ENV_LLM_KEYS = [
-    'CODEGRAPH_LLM_PROVIDER',
-    'CODEGRAPH_LLM_API_KEY',
-    'CODEGRAPH_LLM_MODEL',
-    'CODEGRAPH_LLM_BASE_URL',
-  ];
-  if (ENV_LLM_KEYS.some((k) => process.env[k] !== undefined)) {
+  if (Object.keys(ENV_LLM_MAP).some((k) => process.env[k] !== undefined)) {
     provenance.llm = 'env';
   }
 }
@@ -913,13 +921,6 @@ export function loadConfigWithProvenance(
   return { config, provenance, appliedGlobalPath: applied ? globalPath : null, consentDecision };
 }
 
-const ENV_LLM_MAP: Record<string, string> = {
-  CODEGRAPH_LLM_PROVIDER: 'provider',
-  CODEGRAPH_LLM_API_KEY: 'apiKey',
-  CODEGRAPH_LLM_MODEL: 'model',
-  CODEGRAPH_LLM_BASE_URL: 'baseUrl',
-};
-
 export function applyEnvOverrides(config: CodegraphConfig): CodegraphConfig {
   for (const [envKey, field] of Object.entries(ENV_LLM_MAP)) {
     if (process.env[envKey as keyof NodeJS.ProcessEnv] !== undefined) {

tests/unit/config-user.test.ts

@@ -333,6 +333,32 @@ describe('loadConfigWithProvenance', () => {
     const { provenance } = loadConfigWithProvenance(dir, opts);
     expect(provenance.exclude).toBe('user');
   });
+
+  // Regression test for issue #1857: the provenance key list must be derived
+  // from the same source as the actual override map, so every env var that
+  // triggers an override is also attributed as 'env'-sourced. A hardcoded
+  // second list would silently miss any var added to one but not the other.
+  describe('marks "llm" as "env" source for every CODEGRAPH_LLM_* override var', () => {
+    const envVars = [
+      'CODEGRAPH_LLM_PROVIDER',
+      'CODEGRAPH_LLM_API_KEY',
+      'CODEGRAPH_LLM_MODEL',
+      'CODEGRAPH_LLM_BASE_URL',
+    ];
+
+    afterEach(() => {
+      for (const key of envVars) delete process.env[key];
+    });
+
+    for (const key of envVars) {
+      it(key, () => {
+        const dir = fs.mkdtempSync(path.join(tmpDir, 'prov-env-'));
+        process.env[key] = 'test-value';
+        const { provenance } = loadConfigWithProvenance(dir);
+        expect(provenance.llm).toBe('env');
+      });
+    }
+  });
 });
 
 // ── setUserConfigOverride integration ────────────────────────────────