Client.local uses the key hai login stored

[abonneth]

Made with Cursor

---

Note

Medium Risk
Changes how credentials are passed into spawned local runtimes; behavior is guarded by existing self-hosted key stripping and new tests, but still touches auth/env forwarding for child processes.

Overview
Client.local() now forwards the same API key the main client uses when it spawns a local agent runtime, including the key saved by hai login when HAI_API_KEY is not set in the environment.

A shared default_api_key() helper centralizes resolution (HAI_API_KEY env, then stored credentials) for both client construction and runtime launch. Spawned runtimes get HAI_API_KEY in spawn_env via setdefault; self-hosted inference still does not receive a hosted key because Inference.runtime_env() removes it afterward. Tests cover both default/cloud spawn and self-hosted spawn.

^{Reviewed by Cursor Bugbot for commit 85d2bf8. Bugbot is set up for automated code reviews on this repo. Configure here.}