Process-wide path snapshot captured before any dotenv loader can run.

Compact brand labels for space-constrained UI (e.g. the /model Recent tag).

Sparse companion to PROVIDER_DISPLAY_NAMES: an entry exists only when the full display name carries a parenthetical qualifier that reads badly inside a tag (e.g. "OpenAI (Subscription login)"). Resolved via provider_short_name.

Format an auth manager badge for a provider.

Used by the /auth manager, where each provider renders a bracketed, styled badge (e.g. [stored], [env set: ANTHROPIC_API_KEY], [missing]).

Build the navigation hint for modals whose Tab keys move the cursor.

Only for screens where Tab and Shift+Tab step the selection. A modal that binds Tab to something else writes its own line rather than using this one -- mcp_viewer (Tab jumps between servers), model_selector (Tab autocompletes), and plugin_manager (Tab cycles tabs) all do.

The hint is long enough to wrap once a modal narrows, so the host Static needs height: auto to grow and dock: bottom to reserve the extra row. Without the dock the wrapped row is laid out past the modal's bottom edge, where the compositor never paints it.

Return a human-readable provider label.

Shared by the auth UI and the model selector so a provider is labeled identically in both. (The install prompt reuses the underlying PROVIDER_DISPLAY_NAMES map directly rather than this function, to avoid an event-loop config read, so a user-configured display_name won't surface there.)

Resolution order: a configured display_name, then the built-in PROVIDER_DISPLAY_NAMES map, then a title-cased form of the provider key.

Return a compact brand label for a provider.

For space-constrained UI (e.g. the /model Recent tag). Resolution order: a configured short_name, then the built-in PROVIDER_SHORT_NAMES map, then the full provider_display_name (which is already short for providers without a parenthetical qualifier).

Outcome of the CodexSignedInScreen quick-action overlay.

Encoded as an enum (mirroring AuthResult) rather than bare strings so a typo in either the producing action_* method or the consuming dispatch is a type error, not a silent no-op.

The closed set of LangSmith region selections in the /auth prompt.

Outcome of resolving the region selector to an endpoint to persist.

endpoint is the canonical URL to store (empty for the US SaaS default); error is a user-facing message when a Custom URL is missing or malformed, in which case endpoint is empty and nothing should be saved.

Outcome of an AuthPromptScreen interaction.

The three outcomes need to stay distinguishable because callers in the recovery path retry the original failing operation only on SAVED — retrying after DELETED would loop into the same missing-credentials error indefinitely.

Confirm before launching an authentication flow for a model.

A provider-agnostic gate shown when a selected model needs credentials that aren't detected, and starting the auth flow is disruptive enough that the user should opt in first (e.g. an OAuth flow that launches a browser and a multi-minute loopback wait). The caller supplies all copy so the screen carries no provider assumptions; currently only the openai_codex model-switcher path uses it.

Dismissal values:

• True: proceed to the auth flow.
• False: go back without authenticating (also the outcome of Esc).

Confirmation overlay shown before clearing a stored credential.

Patterned on DeleteThreadConfirmScreen so the destructive prompt feels consistent across the app. Always dismisses with True on confirm or False on cancel; the caller does the actual delete.

Modal that captures and persists an API key for one provider.

Dismissal values are members of AuthResult so callers in the recovery path can distinguish "user just saved a key — retry the failed operation" from "user just cleared their key — don't retry, that would loop into the same error" from "user cancelled — leave state alone".

Modal that lists configured providers and lets the user manage keys.

Reachable via the /auth slash command. Always dismisses with None; state changes are persisted by AuthPromptScreen and reflected by re-rendering the option list when this screen is reopened or after a save/delete completes.

Well-known providers whose integration package isn't installed yet are surfaced greyed-out so they stay discoverable. Selecting one routes through an install confirmation: on confirm the screen records the extra on pending_install_extra and dismisses so the app can install it (mirroring the model selector's install-on-select flow) and reopen the manager.

User-level credential storage for model providers.

Persists API keys (and, in the future, OAuth tokens) under ~/.deepagents/.state/auth.json (file mode 0600, parent 0700) so users can enter credentials directly in the TUI rather than exporting environment variables before launch.

Security notes:

• The stored value (ApiKeyCredential.key) must never be logged, formatted via %r/!r, or interpolated into exception messages — every helper here reports only structural facts ("set credential for provider X").
• The file is written via O_EXCL | 0o600 to a temp path, then atomically replaced. A second chmod 0600 runs on the final path so filesystems that ignore the create-mode argument still end up with private perms. Permission failures are reported back to the caller in WriteOutcome.warnings so the UI can surface them to the user — logger.warning alone is invisible inside a Textual TUI session.
• On Windows, POSIX mode bits don't apply; the chmod calls are best-effort and skipped silently.