Function checkAPIKeyRequirement

cmd/opencodereview/provider_cmd.go:243–258

checkAPIKeyRequirement decides whether a provider selection may be saved with no api_key. It mirrors the resolver's precedence (static api_key -> api_key_cmd -> env var), so an already-configured command satisfies the requirement and picking a model for such a provider does not fail and abandon the

(providerName, apiKey, apiKeyCmd string, preset llm.Provider, isPreset bool)

// make it impossible to configure, since the credentials live in the AWS chain
// rather than the config file.
func checkAPIKeyRequirement(providerName, apiKey, apiKeyCmd string, preset llm.Provider, isPreset bool) error {
	if apiKey != "" || strings.TrimSpace(apiKeyCmd) != "" {
		return nil
	}
	switch {
	case isPreset && preset.AmbientAuth:
		return nil
	case isPreset && preset.EnvVar != "":
		if os.Getenv(preset.EnvVar) == "" {
			return fmt.Errorf("API key is required for provider %s (configure it, set providers.%s.api_key_cmd, or set $%s)", providerName, providerName, preset.EnvVar)
		}
		return nil
	default:
		return fmt.Errorf("API key is required for provider %s (configure it or set providers.%s.api_key_cmd)", providerName, providerName)
	}
}

func applyOfficialProviderConfig(configPath string, cfg *Config, result providerTUIResult) error {
	if result.provider == "" {