Apply CodeRabbit recommendations

- Fix base URL precedence: ENV now properly wins over config
- Improve curl command generation with safe URL joining
- Add better API key masking for short keys
- Normalize base URLs by removing trailing slashes

Author: hongkongkiwi

src/core/agent.ts

@@ -154,13 +154,19 @@ When asked about your identity, you should identify yourself as a coding assista
     debugLog('API key provided:', apiKey ? `${apiKey.substring(0, 8)}...` : 'empty');
     this.apiKey = apiKey;
 
-    // Check for base URL in config file (SDK handles GROQ_BASE_URL env var automatically)
+    // Base URL precedence: 1) ENV (handled by SDK), 2) config fallback
+    const envBaseURL = process.env.GROQ_BASE_URL?.trim();
     const configBaseURL = this.configManager.getBaseUrl();
-    if (configBaseURL) {
-      debugLog(`Using base URL from config: ${configBaseURL}`);
-      this.client = new Groq({ apiKey, baseURL: configBaseURL });
+    if (envBaseURL) {
+      debugLog(`Using base URL from environment: ${envBaseURL}`);
+      // Let SDK pick up GROQ_BASE_URL automatically
+      this.client = new Groq({ apiKey });
+    } else if (configBaseURL) {
+      const normalized = configBaseURL.replace(/\/+$/, '');
+      debugLog(`Using base URL from config: ${normalized}`);
+      this.client = new Groq({ apiKey, baseURL: normalized });
     } else {
-      // SDK will automatically use GROQ_BASE_URL env var if set
+      // Default SDK behavior
       this.client = new Groq({ apiKey });
     }
 
@@ -621,14 +627,20 @@ function resolveEffectiveBaseUrl(configManager: ConfigManager): string {
 function generateCurlCommand(apiKey: string, requestBody: any, requestCount: number, baseUrl: string): string {
   if (!debugEnabled) return '';
 
-  const maskedApiKey = `${apiKey.substring(0, 8)}...${apiKey.substring(apiKey.length - 8)}`;
+  const maskApiKey = (key: string) => {
+    if (key.length <= 6) return '***';
+    if (key.length <= 12) return `${key.slice(0, 3)}***${key.slice(-2)}`;
+    return `${key.slice(0, 6)}...${key.slice(-4)}`;
+  };
+  const maskedApiKey = maskApiKey(apiKey);
 
   // Write request body to JSON file
   const jsonFileName = `debug-request-${requestCount}.json`;
   const jsonFilePath = path.join(process.cwd(), jsonFileName);
   fs.writeFileSync(jsonFilePath, JSON.stringify(requestBody, null, 2));
 
-  const curlCmd = `curl -X POST "${baseUrl}/chat/completions" \\
+  const endpoint = `${baseUrl.replace(/\/+$/, '')}/chat/completions`;
+  const curlCmd = `curl -X POST "${endpoint}" \\
   -H "Authorization: Bearer ${maskedApiKey}" \\
   -H "Content-Type: application/json" \\
   -d @${jsonFileName}`;