perf: cache provider env var lookups

scripts/test-projects.test-support.mjs

@@ -259,6 +259,10 @@ const SOURCE_TEST_TARGETS = new Map([
     "src/plugins/provider-auth-choice.ts",
     ["src/commands/auth-choice.apply.plugin-provider.test.ts", "src/commands/auth-choice.test.ts"],
   ],
+  [
+    "src/secrets/provider-env-vars.ts",
+    ["src/secrets/provider-env-vars.dynamic.test.ts", "src/secrets/provider-env-vars.test.ts"],
+  ],
   [
     "src/memory-host-sdk/host/embedding-defaults.ts",
     ["src/memory-host-sdk/host/embeddings.test.ts"],

src/secrets/provider-env-vars.dynamic.test.ts

@@ -137,6 +137,27 @@ describe("provider env vars dynamic manifest metadata", () => {
     expect(loadPluginManifestRegistry).toHaveBeenCalledTimes(initialLoads);
   });
 
+  it("reuses the lazy default lookup cache for repeated provider env var reads", async () => {
+    loadPluginManifestRegistry.mockReturnValue({
+      plugins: [
+        {
+          id: "external-fireworks",
+          origin: "global",
+          providerAuthEnvVars: {
+            fireworks: ["FIREWORKS_ALT_API_KEY"],
+          },
+        },
+      ],
+      diagnostics: [],
+    });
+
+    expect(getProviderEnvVars("fireworks")).toEqual(["FIREWORKS_ALT_API_KEY"]);
+    const initialLoads = loadPluginManifestRegistry.mock.calls.length;
+    expect(initialLoads).toBeGreaterThan(0);
+    expect(getProviderEnvVars("fireworks")).toEqual(["FIREWORKS_ALT_API_KEY"]);
+    expect(loadPluginManifestRegistry).toHaveBeenCalledTimes(initialLoads);
+  });
+
   it("keeps workspace plugin env vars in default lookups", async () => {
     loadPluginManifestRegistry.mockReturnValue({
       plugins: [

src/secrets/provider-env-vars.ts

@@ -206,7 +206,7 @@ export function getProviderEnvVars(
   providerId: string,
   params?: ProviderEnvVarLookupParams,
 ): string[] {
-  const providerEnvVars = resolveProviderEnvVars(params);
+  const providerEnvVars = params ? resolveProviderEnvVars(params) : PROVIDER_ENV_VARS;
   const envVars = Object.hasOwn(providerEnvVars, providerId)
     ? providerEnvVars[providerId]
     : undefined;

test/scripts/test-projects.test.ts

@@ -349,6 +349,16 @@ describe("scripts/test-projects changed-target routing", () => {
     });
   });
 
+  it("routes provider env var edits to focused secret tests", () => {
+    expect(resolveChangedTestTargetPlan(["src/secrets/provider-env-vars.ts"])).toEqual({
+      mode: "targets",
+      targets: [
+        "src/secrets/provider-env-vars.dynamic.test.ts",
+        "src/secrets/provider-env-vars.test.ts",
+      ],
+    });
+  });
+
   it("routes changed utils and shared files to their light scoped lanes", () => {
     const plans = buildVitestRunPlans(["--changed", "origin/main"], process.cwd(), () => [
       "src/shared/string-normalization.ts",