Credential Management

Relevant source files

• internal/cli/run.go
• internal/cli/run_test.go
• internal/credential/README.md
• internal/credential/agent_init.go
• internal/credential/credential_test.go
• internal/credential/provider_query.go
• internal/credential/provider_query_test.go

The internal/credential package is responsible for consolidating API keys, base URLs, and model identifiers from diverse sources into a unified set of initialization parameters. It ensures that both the primary agent (Runner) and the evaluation agent (Judge) receive consistent configuration regardless of whether the source is a configuration file, an environment variable, or a CLI flag internal/credential/README.md1-12

Core Responsibility

The system's primary goal is to produce an AgentInitParams struct for each agent kind. This struct serves as the "intermediate decision result" that is passed to the agent factory internal/credential/README.md23-35

Field	Description	Source Precedence (High to Low)
Provider	The LLM provider (e.g., openai, anthropic).	Role Config -> Fallback (for Judge) internal/credential/README.md71-77
Model	The specific model string.	CLI --model -> Provider Env -> Role Config -> Fallback internal/credential/README.md79-89
APIKey	Secret used for authentication.	CLI --api-key -> Provider Env -> credentials.yaml -> Fallback internal/credential/README.md90-102
BaseURL	The API endpoint root.	Provider Env -> Role Config -> credentials.yaml -> Fallback internal/credential/README.md103-111

Sources: internal/credential/agent_init.go40-57 internal/credential/README.md13-35 internal/credential/README.md69-111

---

Credential Resolution Pipeline

The resolution logic is split into two distinct pipelines to allow independent configuration of the execution agent and the grading agent internal/credential/README.md36-58

1. Runner Agent Resolution

The Runner is the primary agent executing the task. It resolves parameters based on the engine block in eval.yaml and CLI overrides internal/credential/README.md38-48

• Function: ResolveRunnerInitParams internal/credential/agent_init.go74-87
• Input: engine name, ModelConfig, and optional CustomEngineConfig.

2. Judge Agent Resolution

The Judge agent is used for agent_judge evaluation types. It defaults to the Runner's configuration unless explicitly overridden in the judge block internal/credential/README.md49-58

• Function: ResolveJudgeInitParams internal/credential/agent_init.go89-107
• Fallback: If the judge configuration is missing fields, it reuses the final resolved values from the Runner internal/credential/agent_init.go92-95

Logic Flow (Code Entity Space)

The following diagram illustrates how the Resolver and resolution functions interact to produce final parameters.

"Credential Resolution Flow"

Sources: internal/credential/agent_init.go73-107 internal/credential/agent_init.go181-200 internal/credential/README.md112-155

---

Provider-Scoped Resolution

A key feature of the system is Provider-Scoped Overrides. Once a provider (e.g., openai) is identified, the system automatically looks for environment variables prefixed with that provider's name internal/credential/README.md156-177

• Env Pattern: ${PROVIDER}_API_KEY, ${PROVIDER}_BASE_URL, ${PROVIDER}_MODEL internal/credential/README.md160-165
• Precedence: These environment variables outrank values found in the credentials.yaml file but are outranked by explicit CLI flags internal/credential/README.md80-110
• Framework Defaults: anthropic and openai are treated as always-configured even without explicit env/file entries internal/credential/provider_query.go11-22

"Provider Environment Mapping"

Sources: internal/credential/agent_init.go220-244 internal/credential/provider_query.go28-74 internal/credential/README.md158-177

---

Sub-Components

Credential Resolver

The Resolver struct manages the loading of persistent credentials from files and the environment.

• File Discovery: Searches for credentials.yaml in ~/.skill-up/ via DefaultConfPath() internal/credential/credential_test.go44-57
• Thread Safety: Uses sync.RWMutex to allow concurrent access to credentials during multi-threaded evaluation runs internal/credential/credential_test.go128-165
• Masking: Includes a MaskAPIKey utility to safely log credential discovery without exposing secrets internal/credential/credential_test.go18-42
• Source Tracking: Every resolved field is tagged with a ValueSource (e.g., ValueSourceEnv, ValueSourceResolver, ValueSourceCLI) to assist in debugging internal/credential/agent_init.go21-37
• For details, see Credential Resolver.

Sources: internal/credential/agent_init.go21-37 internal/credential/credential_test.go18-165

Provider Query and Model Resolution

This logic handles the disambiguation of model strings and the application of CLI overrides.

• Disambiguation: Handles strings like provider/model-name and resolves them against configured namespaces via ResolveModelRef internal/credential/provider_query.go108-125
• Collapse Logic: If a provider is unconfigured, ResolveModelRef treats the slashed string as an opaque model identifier for proxy gateways internal/credential/provider_query.go82-93
• CLI Overrides: Manages how --api-key and --model flags force values into the AgentInitParams regardless of config file state internal/credential/agent_init.go181-200
• For details, see Provider Query and Model Resolution.

Sources: internal/credential/agent_init.go181-200 internal/credential/provider_query.go108-125 internal/credential/README.md80-110