pub fn validate_provider_env(
cfg: &RepoProviderConfig,
resolved: &BTreeMap<String, String>,
) -> Result<(), String>Expand description
Check that a resolved env satisfies the selected provider’s API-key requirement, returning an actionable message when it does not.
This complements resolve_env, which only warn!s on a dangling
api_key_from_env reference and then proceeds. Validating the resolved map
(rather than the raw config) means a key supplied through any layer —
curated api_key_from_env, raw cfg.env, or the global default_env —
counts, so there are no false positives. Providers without a key var
(bedrock, vertex) and an unset provider always pass.
A provider with an overridden base_url also passes without a key: a
self-hosted / proxied endpoint (a local openai-compatible server such as
llama.cpp, mlx-lm, or llama-swap) supplies its own auth or none. This mirrors
caliban#641, which makes the OpenAI adapter keyless for local base_url
endpoints, and preserves the keyless local-inference path the removed
bespoke local provider used to offer (caliban ADR 0056).