"Use local subscriptions" is ignored for Codex when OPENAI_API_KEY is set in the environment

What happened

I chose 4 (Use local subscriptions) during npx deepsec init and picked GPT-5.6 Sol (Codex). Codex is logged in with a ChatGPT subscription account in the terminal. The repo's .envrc (direnv) exports an unrelated OPENAI_API_KEY that the app itself uses. The requests went to the API key's account, which has no credit, instead of the ChatGPT subscription I selected.

Reproduction

1. codex login with a ChatGPT account.
2. export OPENAI_API_KEY=
3. npx deepsec init, then choose 4. Use local subscriptions and a Codex model.
4. Batches fail with Quota exceeded. Unsetting the variable makes them succeed.

Expected vs actual

When the saved route is local, always use the CLI's own login and drop or ignore OPENAI_API_KEY / ANTHROPIC_AUTH_TOKEN for the agent process. At minimum, warn during setup and before process that an environment key will override the subscription choice.

Environment

• deepsec version (pnpm deepsec --version): 2.3.10
• Node version (node --version): v22.22.3
• OS: macOS 26.5.2 (arm64)
• Agent backend (claude-agent-sdk / codex): codex (@openai/codex-sdk 0.156.1), model-auth route local (ChatGPT subscription)
• Model: gpt-5.6-sol (xhigh)