diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 04d5d8564..3eb10f406 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -28,6 +28,9 @@ jobs:
       - name: Build
         run: npm run build
 
+      - name: Typecheck extensions
+        run: npm run typecheck:extensions
+
       - name: Validate package is installable
         run: npm run validate-pack
 
@@ -58,5 +61,8 @@ jobs:
       - name: Build
         run: npm run build
 
+      - name: Typecheck extensions
+        run: npm run typecheck:extensions
+
       - name: Run unit tests
         run: npm run test:unit
diff --git a/package.json b/package.json
index 1708cf2bf..ccef877b3 100644
--- a/package.json
+++ b/package.json
@@ -61,7 +61,8 @@
     "sync-pkg-version": "node scripts/sync-pkg-version.cjs",
     "sync-platform-versions": "node native/scripts/sync-platform-versions.cjs",
     "validate-pack": "bash scripts/validate-pack.sh",
-    "prepublishOnly": "npm run sync-pkg-version && npm run sync-platform-versions && git diff --exit-code || (echo 'ERROR: version sync changed files — commit them before publishing' && exit 1) && npm run build && npm run validate-pack"
+    "typecheck:extensions": "tsc --noEmit --project tsconfig.extensions.json",
+    "prepublishOnly": "npm run sync-pkg-version && npm run sync-platform-versions && git diff --exit-code || (echo 'ERROR: version sync changed files — commit them before publishing' && exit 1) && npm run build && npm run typecheck:extensions && npm run validate-pack"
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.73.0",
diff --git a/src/resources/extensions/gsd/commands.ts b/src/resources/extensions/gsd/commands.ts
index 47f3aeadd..2563a0e55 100644
--- a/src/resources/extensions/gsd/commands.ts
+++ b/src/resources/extensions/gsd/commands.ts
@@ -662,7 +662,7 @@ export function loadToolApiKeys(): void {
     const auth = AuthStorage.create(authPath);
     for (const tool of TOOL_KEYS) {
       const cred = auth.get(tool.id);
-      if (cred && "key" in cred && cred.key && !process.env[tool.env]) {
+      if (cred && cred.type === "api_key" && cred.key && !process.env[tool.env]) {
         process.env[tool.env] = cred.key;
       }
     }
diff --git a/src/resources/extensions/gsd/tests/agent-end-provider-error.test.ts b/src/resources/extensions/gsd/tests/agent-end-provider-error.test.ts
index 2a5899c87..5be2aa498 100644
--- a/src/resources/extensions/gsd/tests/agent-end-provider-error.test.ts
+++ b/src/resources/extensions/gsd/tests/agent-end-provider-error.test.ts
@@ -9,8 +9,8 @@ test("pauseAutoForProviderError warns and pauses without requiring ctx.log", asy
 
   await pauseAutoForProviderError(
     {
-      notify(message, level) {
-        notifications.push({ message, level });
+      notify(message, level?) {
+        notifications.push({ message, level: level ?? "info" });
       },
     },
     ": terminated",