[Bug]: doctor does not warn when a provider API-key env reference resolves empty

[songwunil]

Client or integration

Codex CLI

Area

CLI

Summary

ocx doctor does not warn when a key-auth provider stores an environment-variable reference that resolves to an empty value. The first actionable signal appears only when an inference request fails. I expected ocx doctor to identify the unresolved credential reference before a routed request reaches the adapter.

Reproduction

1. Configure a key-auth provider such as OpenRouter with authMode: "key" and apiKey: "${OPENROUTER_API_KEY}".
2. Start OpenCodex without OPENROUTER_API_KEY in the proxy process environment.
3. Run ocx doctor and observe that it reports no provider credential problem.
4. Send a routed request through the provider.
5. Observe openai-chat requires a non-empty credential (authMode: key).

Version

2.7.43

Operating system

macOS

Provider and model

OpenRouter; any configured routed model

Logs or error output

Provider unreachable: openai-chat requires a non-empty credential (authMode: key)

Screenshots and supporting files

None.

Redacted configuration

{
  "providers": {
    "openrouter": {
      "adapter": "openai-chat",
      "baseUrl": "https://openrouter.ai/api/v1",
      "authMode": "key",
      "apiKey": "${OPENROUTER_API_KEY}"
    }
  }
}

The diagnostic should expose only the provider name, environment-variable name, and presence/resolution state. It must never print or persist the credential value. When proxy-process environment inspection is unsupported on the platform, the result should say that runtime resolution is unverified.

Checks

• I searched existing issues and documentation.
• I removed secrets, tokens, account details, request credentials, and personal data.

[github-actions]

Issue reopened

The report now contains the information required by the automated check. Thanks for updating it.

[github-actions]

_{Automated translation bookkeeping — detected language: unknown.}

[Wibias]

[shipping-github] Research review

Claim: ocx doctor does not warn when a key-auth provider's apiKey: ""${ENV}"" resolves empty.
Checked against: dev@be177ea5

Field	Finding
Still an issue on latest development?	yes
Exact issue	Doctor checks OAuth health, paths, proxy env, memory, startup — not per-provider key/env resolution for authMode: key
Fixed on development?	no
Open PR covering this?	none
Duplicate of?	none
Security relevance	none — diagnostic must never print secret values (reporter already constrains this)
Priority	middle — late failure at inference; doctor is the natural early check
Verdict	Needs fix on development

Evidence: src/cli/doctor.ts has env-reference resolution for proxy config (~310–356) but no analogous provider apiKey walk. Failure mode matches adapter requires a non-empty credential.
Gaps: Platform differences for inspecting the service process env vs doctor process env need careful messaging (reporter noted this).

[Wibias]

[shipping-github] Opened PR #778 to address this.

[Wibias]

Thanks @songwunil — this is fixed by PR #778 by making ocx doctor warn when a key-auth provider's apiKey env reference resolves empty.