collectQueueSecrets function

Map<String, String> collectQueueSecrets(List<ProviderQueueEntry> entries, SecureKeyCache keys, { Map<String, String>? env, })

Collects the secrets snapshot for the queue: each entry's apiKeyEnv resolves from the environment, else the secure store (env wins — the same precedence as the roles snapshot). A chatgpt-codex entry that named no apiKeyEnv resolves its DEFAULT Keychain slot (chatGptOAuthCredentialsEnvName) under the same rule, and a refreshTokenEnv name resolves the same way (issue #1704).

Implementation

Map<String, String> collectQueueSecrets(
  List<ProviderQueueEntry> entries,
  SecureKeyCache keys, {
  Map<String, String>? env,
}) {
  final environment = env ?? Platform.environment;
  final secrets = <String, String>{};
  for (final entry in entries) {
    final names = [
      ?entry.apiKeyEnv,
      ?entry.refreshTokenEnv,
      if (entry.apiKeyEnv == null && entry.providerType == 'chatgpt-codex')
        chatGptOAuthCredentialsEnvName,
    ];
    for (final name in names) {
      if (secrets.containsKey(name)) continue;
      final fromEnv = environment[name];
      if (fromEnv != null && fromEnv.isNotEmpty) {
        secrets[name] = fromEnv;
        continue;
      }
      final stored = keys.read(name);
      if (stored != null) secrets[name] = stored;
    }
  }
  return secrets;
}