Repository navigation
[Bug]: doctor does not warn when a provider API-key env reference resolves empty #762
Description
Client or integration
Codex CLI
Area
CLI
Summary
ocx doctor does not warn when a key-auth provider stores an environment-variable reference that resolves to an empty value. The first actionable signal appears only when an inference request fails. I expected ocx doctor to identify the unresolved credential reference before a routed request reaches the adapter.
Reproduction
- Configure a key-auth provider such as OpenRouter with
authMode: "key"andapiKey: "${OPENROUTER_API_KEY}". - Start OpenCodex without
OPENROUTER_API_KEYin the proxy process environment. - Run
ocx doctorand observe that it reports no provider credential problem. - Send a routed request through the provider.
- Observe
openai-chat requires a non-empty credential (authMode: key).
Version
2.7.43
Operating system
macOS
Provider and model
OpenRouter; any configured routed model
Logs or error output
Provider unreachable: openai-chat requires a non-empty credential (authMode: key)Screenshots and supporting files
None.
Redacted configuration
{
"providers": {
"openrouter": {
"adapter": "openai-chat",
"baseUrl": "https://openrouter.ai/api/v1",
"authMode": "key",
"apiKey": "${OPENROUTER_API_KEY}"
}
}
}The diagnostic should expose only the provider name, environment-variable name, and presence/resolution state. It must never print or persist the credential value. When proxy-process environment inspection is unsupported on the platform, the result should say that runtime resolution is unverified.
Checks
- I searched existing issues and documentation.
- I removed secrets, tokens, account details, request credentials, and personal data.
Activity
github-actions commentedon Jul 30, 2026
Issue reopened
The report now contains the information required by the automated check. Thanks for updating it.
github-actions commentedon Jul 30, 2026
Automated translation bookkeeping — detected language: unknown.
[-]doctor: warn when a provider API-key env reference resolves empty[/-][+][Bug]: doctor does not warn when a provider API-key env reference resolves empty[/+]Wibias commentedon Jul 30, 2026
[shipping-github] Research review
Claim:
ocx doctordoes not warn when a key-auth provider'sapiKey: ""${ENV}""resolves empty.Checked against: dev@be177ea5
authMode: keyEvidence:
src/cli/doctor.tshas env-reference resolution for proxy config (~310–356) but no analogous providerapiKeywalk. Failure mode matches adapterrequires a non-empty credential.Gaps: Platform differences for inspecting the service process env vs doctor process env need careful messaging (reporter noted this).
Wibias commentedon Jul 30, 2026
[shipping-github] Opened PR #778 to address this.
Wibias commentedon Jul 31, 2026
Thanks @songwunil — this is fixed by PR #778 by making
ocx doctorwarn when a key-auth provider'sapiKeyenv reference resolves empty.fix: address issue lidge-jun#762
fix: address issue lidge-jun#762