KeyStatusRenderer class final

Renders the banner's key-status line and error: diagnostics from a snapshot of the host CLI's key inputs.

Constructors

KeyStatusRenderer({required bool rolesDriven, required String providerKind, required bool explicitToken, required String? activeCustomName, required String red(String), SecureKeyCache? secureKeys, CustomProviderRegistry? customProviders, bool envVarIsSet(String)?, String? envVarValue(String)?})

Creates a renderer over the host's live key inputs.

const

Properties

activeCustomName → String?

The active saved custom provider's entry name, or null.

final

customProviders → CustomProviderRegistry?

The saved custom-provider registry, or null.

final

envVarIsSet → bool Function(String)?

Whether an environment variable is set, or null when the host cannot check.

final

envVarValue → String? Function(String)?

Reads an environment variable's value, or null when the host has no environment.

final

explicitToken → bool

Whether the live key came from an explicit /provider token.

final

hashCode → int

The hash code for this object.

no setter, inherited

providerKind → String

The live provider adapter kind.

final

red → String Function(String)

Styles a diagnostic line red (the host's ANSI styling).

final

rolesDriven → bool

Whether roles mode drives the session (its keys come from the chain environment only, never the secure store).

final

runtimeType → Type

A representation of the runtime type of the object.

no setter, inherited

secureKeys → SecureKeyCache?

The secure-key cache, or null when secure storage is unavailable.

final

Methods

activeCustomKeyName() → String?

The active saved custom provider's secure-store key name, or null when none is active (or the entry is keyless).

activeEnvKeyName(List<String> names) → String?

The first env-name holding a genuine environment key (differs from the same-name store entry), or null.

authHint(String baseUrl) → String

The — ... suffix for errorLine on auth failures. Never prints key material — names and sources only. Mirrors the provider key resolution order: on the spec's DEFAULT endpoint a genuine environment value → endpoint-scoped store entry → legacy env-name store entry; on a custom endpoint only the endpoint-scoped store entries can be the source (the boot resolver never probes the catalog env names there — issue #40).

authHintForAttempt(String message, String baseUrl) → String

The auth hint for the provider the failure came from. When the message identifies an adapter different from the believed binding, the hint is computed for THAT provider alone — mixing the copilot verdict with the session's z.ai key slot and endpoint produced one fused copilot + z.ai + endpoint instruction (gh-1226 AC2).

customEndpointAuthHint(String baseUrl) → String?

The auth hint for a CUSTOM endpoint (no catalog spec's default URL) — roles mode included, which otherwise shows its generic env-only hint for genuine chain failures. Null for catalog-default endpoints.

envActiveHint(List<String> names, String baseUrl) → String?

The hint for a genuine environment key, or null when none is in play.

envKeyHint(String envActive, String baseUrl) → String

The hint for a genuine environment key: the shadowing warning when a DIFFERENT same-name store entry exists, else the source note. The shadowing detection is the shared envShadowsStoredKey rule (the boot and restore notes use the same one). An UNWIRED envVarValue (embedded hosts may omit it) degrades conservatively: with a store twin present the warning still fires — this hint only renders when the env value is the one actually sent, so an uncompared twin is a real shadow (the pre-round-3 availability); without a twin there is nothing to shadow.

envKeyStatus(List<String> names) → String?

The first env-name holding a genuine environment value (differs from the store's entry), as a key: <name> status, or null.

errorLine(String message, String baseUrl) → String

The error: diagnostic line for a failed run. baseUrl is the effective endpoint of the model the run used. Provider JSON blobs (OpenRouter wraps upstream errors in nested JSON) are compacted to the most specific message. A connection-level failure ("Connection refused" — a SocketException, or a package:http ClientException wrapping one; the provider adapters reduce both to their message string, so detection is textual) appends the endpoint hint: the effective base URL from the config or --base-url is almost always the thing to fix then. A 401-class auth failure appends the key diagnostic: which env var is in play, whether an environment value is shadowing a DIFFERENT stored key (env wins over the secure store — the classic stale-export footgun), or that no key resolved at all.

explicitTokenKeyStatus(Model model) → String

Key status when an explicit token or saved-entry key is in play.

fallbackKeyStatus(Model model, ProviderSpec? spec, List<String> names) → String?

Key status fallback: any legacy env-name entry, else the "no key set" guidance (null for non-default endpoints without a key — they may legitimately run keyless).

hasStoredKey(String? name) → bool

Whether name names a key present in the secure store.

isAuthError(String compact) → bool

keyStatusLine(Model model) → String?

The banner's key-status line: the name of the env var supplying the provider key (never the value), or a "no key set" warning when the provider expects a key the host does not have. Null when the provider declares no key env vars (custom/test providers) — no warning then — and null for a custom endpoint (base URL other than the catalog default), which may legitimately run keyless (local llama.cpp/Ollama/ LM Studio servers).

noKeyHint(String? entryKey, String baseUrl, ProviderSpec? spec, String scopedName, List<String> names) → String

The fallback hint when no key resolved (or the token was rejected).

noSuchMethod(Invocation invocation) → dynamic

Invoked when a nonexistent method or property is accessed.

inherited

resolvedKeyStatus(Model model, ProviderSpec? spec, List<String> names) → String?

Key status from the resolution order: on the spec's DEFAULT endpoint genuine environment values first (they differ from the store's entry); then the active custom entry's slot (multi-account entries use name-scoped ones), the host-scoped slot, and legacy env-name entries (env or store — indistinguishable here). On a custom endpoint the catalog env names are never in play (they describe the default endpoint — the same rule optionalProviderApiKey enforces at boot), so only the store slots can be the source.

scopedTokenKeyStatus(Model model) → String

Key status fallback for an explicit token: the host-scoped store slot, or the anonymous "provided" marker.

storedKeyHint(String name, String baseUrl) → String?

The hint for a key read from the secure store, or null when the slot is empty.

storeHintMessage(String name, String baseUrl) → String

The hint naming a secure-store key as the source.

toString() → String

A string representation of this object.

inherited

Operators

operator ==(Object other) → bool

The equality operator.

inherited