Merge branch 'hopper-w6zmhkql-api-key-validation'

apps/settings/routes.py

···
 import os
 import re
 import subprocess
+from datetime import datetime, timezone
 from pathlib import Path
 from typing import Any
 
···
                     mode = "api_key" if new_val else "platform"
                     config["providers"]["auth"][provider] = mode
 
+            # Validate changed provider API keys
+            if "key_validation" not in config["providers"]:
+                config["providers"]["key_validation"] = {}
+            for env_var in changed_fields:
+                provider = env_to_provider.get(env_var)
+                if provider:
+                    new_val = data.get(env_var, "")
+                    if new_val:
+                        from think.providers import validate_key as _validate_key
+
+                        result = _validate_key(provider, new_val)
+                        result["timestamp"] = datetime.now(timezone.utc).isoformat()
+                        config["providers"]["key_validation"][provider] = result
+                    else:
+                        config["providers"]["key_validation"].pop(provider, None)
+
         # Write back to file
         with open(config_path, "w", encoding="utf-8") as f:
             json.dump(config, f, indent=2, ensure_ascii=False)
···
         if "env" in config:
             config["env"] = {k: bool(v) for k, v in config["env"].items()}
 
-        return jsonify({"success": True, "config": config})
+        key_validation = config.get("providers", {}).get("key_validation", {})
+        return jsonify(
+            {"success": True, "config": config, "key_validation": key_validation}
+        )
     except Exception as e:
         return jsonify({"error": str(e)}), 500
 
···
             p["name"]: auth_config.get(p["name"], "platform") for p in providers_list
         }
 
+        # Get cached key validation results
+        key_validation = providers_config.get("key_validation", {})
+
         return jsonify(
             {
                 "providers": providers_list,
···
                 "context_defaults": context_defaults,
                 "api_keys": api_keys,
                 "auth": auth,
+                "key_validation": key_validation,
             }
         )
+    except Exception as e:
+        return jsonify({"error": str(e)}), 500
+
+
+@settings_bp.route("/api/validate-keys", methods=["POST"])
+def validate_all_keys() -> Any:
+    """Re-validate all configured provider API keys.
+
+    Reads keys from journal.json config (not environment), validates each
+    against the provider API, and stores results in providers.key_validation.
+    """
+    try:
+        from think.providers import PROVIDER_METADATA, validate_key as _validate_key
+
+        config = get_journal_config()
+        env_config = config.get("env", {})
+
+        # Build reverse map: env_key -> provider name
+        env_to_provider = {
+            meta["env_key"]: name
+            for name, meta in PROVIDER_METADATA.items()
+            if "env_key" in meta
+        }
+
+        if "providers" not in config:
+            config["providers"] = {}
+        key_validation = {}
+
+        for env_var, provider in env_to_provider.items():
+            api_key = env_config.get(env_var, "")
+            if api_key:
+                result = _validate_key(provider, api_key)
+                result["timestamp"] = datetime.now(timezone.utc).isoformat()
+                key_validation[provider] = result
+
+        config["providers"]["key_validation"] = key_validation
+
+        config_dir = Path(state.journal_root) / "config"
+        config_dir.mkdir(parents=True, exist_ok=True)
+        config_path = config_dir / "journal.json"
+        with open(config_path, "w", encoding="utf-8") as f:
+            json.dump(config, f, indent=2, ensure_ascii=False)
+            f.write("\n")
+        os.chmod(config_path, 0o600)
+
+        return jsonify({"success": True, "key_validation": key_validation})
     except Exception as e:
         return jsonify({"error": str(e)}), 500
 

apps/settings/workspace.html

···
   font-size: 0.85em;
 }
 
+.key-status-valid {
+  color: #28a745;
+  font-size: 0.85em;
+  margin-left: 0.5em;
+}
+
+.key-status-invalid {
+  color: #dc3545;
+  font-size: 0.85em;
+  margin-left: 0.5em;
+}
+
+.key-status-validating {
+  color: #6c757d;
+  font-size: 0.85em;
+  margin-left: 0.5em;
+  font-style: italic;
+}
+
 /* Password field with toggle */
 .password-wrap {
   position: relative;
···
     <section class="settings-section" id="section-apikeys">
       <h2>API Keys</h2>
       <p class="settings-section-desc">Configure API keys for AI providers. Keys are stored in your journal config.</p>
+      <div style="margin-bottom: 1em;">
+        <button type="button" id="revalidateAllKeys" class="btn-secondary" onclick="revalidateAllKeys()">Re-validate All Keys</button>
+        <span id="revalidateStatus" style="margin-left: 0.5em; font-size: 0.85em;"></span>
+      </div>
 
       <div class="settings-field">
         <label for="field-env-google">Google AI (Gemini)</label>
···
 let saveTimeout = null;
 let logNextCursor = null;
 let insightsData = null;
+let keyValidationData = {};
 
 // ========== NAVIGATION ==========
 const VALID_SECTIONS = ['profile', 'agent', 'providers', 'apikeys', 'transcription', 'observer', 'vision', 'insights', 'security', 'sync', 'storage', 'support', 'facet-appearance', 'facet-activities', 'facet-activity'];
···
   // env = journal config status, runtime_env = loaded into process
   const env = config.env || {};
   const sysEnv = config.runtime_env || {};
+  keyValidationData = config.providers?.key_validation || {};
   updateEnvStatus('field-env-google', env.GOOGLE_API_KEY, sysEnv.GOOGLE_API_KEY);
   updateEnvStatus('field-env-openai', env.OPENAI_API_KEY, sysEnv.OPENAI_API_KEY);
   updateEnvStatus('field-env-anthropic', env.ANTHROPIC_API_KEY, sysEnv.ANTHROPIC_API_KEY);
···
       status.textContent = ' (system)';
       label.appendChild(status);
     }
+
+    // Add validation status for provider keys
+    const providerName = fieldId.replace('field-env-', '');
+    if (['google', 'openai', 'anthropic'].includes(providerName)) {
+      const validation = keyValidationData[providerName];
+      const oldValidation = label.querySelector('.key-validation-status');
+      if (oldValidation) oldValidation.remove();
+
+      if (validation) {
+        const validationSpan = document.createElement('span');
+        validationSpan.className = 'key-validation-status';
+        if (validation.valid) {
+          validationSpan.className += ' key-status-valid';
+          validationSpan.textContent = ' ✓ Valid';
+        } else {
+          validationSpan.className += ' key-status-invalid';
+          const errMsg = validation.error || 'Invalid';
+          const shortErr = errMsg.length > 60 ? errMsg.slice(0, 60) + '…' : errMsg;
+          validationSpan.textContent = ' ✗ ' + shortErr;
+          validationSpan.title = errMsg;
+        }
+        label.appendChild(validationSpan);
+      }
+    }
   }
 }
 
···
   clearTimeout(saveTimeout);
   saveTimeout = setTimeout(async () => {
     try {
+      const runtimeEnv = configData?.runtime_env || {};
       const response = await fetch('api/config', {
         method: 'PUT',
         headers: { 'Content-Type': 'application/json' },
···
       const result = await response.json();
       if (result.success) {
         configData = result.config;
+        configData.runtime_env = runtimeEnv;
         if (el) showFieldStatus(el, 'saved');
 
         // For env fields, clear the input and update status indicator
         if (el && section === 'env') {
           el.value = '';
-          updateEnvStatus(el.id, true, true);
+          if (result.key_validation) {
+            keyValidationData = result.key_validation;
+            configData.providers = configData.providers || {};
+            configData.providers.key_validation = keyValidationData;
+          }
+          updateEnvStatus(
+            el.id,
+            configData?.env?.[key],
+            configData?.runtime_env?.[key]
+          );
+          if (providersData) {
+            providersData.key_validation = keyValidationData;
+            for (const type of ['generate', 'cogitate']) {
+              const providerSelect = document.getElementById(`field-${type}-provider`);
+              if (providerSelect) {
+                updateTypeProviderKeyWarning(
+                  type,
+                  providerSelect.value,
+                  providersData.api_keys || {},
+                  providersData.auth || {}
+                );
+              }
+            }
+          }
         }
       } else {
         throw new Error(result.error);
···
 }
 
 function populateProviders(data) {
+  // Cache key validation data
+  if (data.key_validation) {
+    keyValidationData = data.key_validation;
+  }
+
   // Populate all provider/backup dropdowns for both types
   for (const type of ['generate', 'cogitate']) {
     for (const suffix of ['provider', 'backup']) {
···
   // Update status text
   document.getElementById('providerStatus').textContent = '';
 
+  // Refresh env status displays with latest validation data
+  const env = configData?.env || {};
+  const sysEnv = configData?.runtime_env || {};
+  updateEnvStatus('field-env-google', env.GOOGLE_API_KEY, sysEnv.GOOGLE_API_KEY);
+  updateEnvStatus('field-env-openai', env.OPENAI_API_KEY, sysEnv.OPENAI_API_KEY);
+  updateEnvStatus('field-env-anthropic', env.ANTHROPIC_API_KEY, sysEnv.ANTHROPIC_API_KEY);
+
   // Populate context overrides
   renderContextGroups(data);
 }
···
   const warning = document.getElementById(`${type}ProviderKeyWarning`);
   const link = document.getElementById(`${type}ProviderKeyLink`);
   if (!warning || !link) return;
+  const message = warning.querySelectorAll('span')[1];
 
   // For cogitate, hide key warning when using platform auth
   const authMode = (auth && type === 'cogitate') ? (auth[provider] || 'platform') : 'api_key';
-  if (authMode === 'platform' || !provider || apiKeys[provider]) {
+  const validation = provider ? keyValidationData[provider] : null;
+  if (authMode === 'platform' || !provider) {
+    warning.style.display = 'none';
+    warning.title = '';
+    return;
+  }
+
+  if (validation) {
+    if (validation.valid) {
+      warning.style.display = 'none';
+      warning.title = '';
+      return;
+    }
+    warning.style.display = 'flex';
+    if (message) {
+      message.textContent = `API key validation failed for ${type} provider.`;
+    }
+    warning.title = validation.error || 'Invalid API key';
+  } else if (apiKeys[provider]) {
     warning.style.display = 'none';
+    warning.title = '';
+    return;
   } else {
     warning.style.display = 'flex';
-    link.onclick = (e) => {
-      e.preventDefault();
-      switchSection('apikeys');
-    };
+    if (message) {
+      message.textContent = `API key not configured for ${type} provider.`;
+    }
+    warning.title = '';
+  }
+
+  link.onclick = (e) => {
+    e.preventDefault();
+    switchSection('apikeys');
+  };
+}
+
+async function revalidateAllKeys() {
+  const btn = document.getElementById('revalidateAllKeys');
+  const status = document.getElementById('revalidateStatus');
+  btn.disabled = true;
+  status.textContent = 'Validating...';
+  status.className = 'key-status-validating';
+  try {
+    const response = await fetch('api/validate-keys', { method: 'POST' });
+    const result = await response.json();
+    if (result.error) throw new Error(result.error);
+    keyValidationData = result.key_validation || {};
+    if (configData) {
+      configData.providers = configData.providers || {};
+      configData.providers.key_validation = keyValidationData;
+    }
+    // Refresh env status displays
+    const env = configData?.env || {};
+    const sysEnv = configData?.runtime_env || {};
+    updateEnvStatus('field-env-google', env.GOOGLE_API_KEY, sysEnv.GOOGLE_API_KEY);
+    updateEnvStatus('field-env-openai', env.OPENAI_API_KEY, sysEnv.OPENAI_API_KEY);
+    updateEnvStatus('field-env-anthropic', env.ANTHROPIC_API_KEY, sysEnv.ANTHROPIC_API_KEY);
+    // Update provider warnings too
+    if (providersData) {
+      providersData.key_validation = keyValidationData;
+      for (const type of ['generate', 'cogitate']) {
+        const providerSelect = document.getElementById(`field-${type}-provider`);
+        if (providerSelect) {
+          updateTypeProviderKeyWarning(type, providerSelect.value, providersData.api_keys, providersData.auth);
+        }
+      }
+    }
+    status.textContent = 'Done';
+    status.className = 'key-status-valid';
+    setTimeout(() => { status.textContent = ''; }, 2000);
+  } catch (err) {
+    status.textContent = 'Error: ' + err.message;
+    status.className = 'key-status-invalid';
+  } finally {
+    btn.disabled = false;
   }
 }
 

tests/baselines/api/settings/providers.json

···
     "provider": "google",
     "tier": 2
   },
+  "key_validation": {},
   "providers": [
     {
       "env_key": "ANTHROPIC_API_KEY",

tests/test_validate_key.py

···
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright (c) 2026 sol pbc
+
+from __future__ import annotations
+
+import json
+import shutil
+from pathlib import Path
+from unittest.mock import Mock, patch
+
+import pytest
+
+import think.providers
+import think.providers.anthropic
+import think.providers.google
+import think.providers.openai
+from convey import create_app
+from think.providers import validate_key
+
+
[e-mail]
+def settings_client(tmp_path, monkeypatch):
+    src = Path(__file__).resolve().parent / "fixtures" / "journal"
+    journal = tmp_path / "journal"
+    shutil.copytree(src, journal)
+    monkeypatch.setenv("_SOLSTONE_JOURNAL_OVERRIDE", str(journal))
+
+    app = create_app(str(journal))
+    app.config["TESTING"] = True
+    return app.test_client(), journal
+
+
+def test_validate_key_anthropic_success():
+    client = Mock()
+    client.models.list.return_value = [Mock()]
+
+    with patch("anthropic.Anthropic", return_value=client) as mock_cls:
+        result = think.providers.anthropic.validate_key("test-key")
+
+    assert result == {"valid": True}
+    mock_cls.assert_called_once_with(api_key="test-key", timeout=10)
+
+
+def test_validate_key_anthropic_auth_error():
+    client = Mock()
+    client.models.list.side_effect = Exception("invalid x-api-key")
+
+    with patch("anthropic.Anthropic", return_value=client):
+        result = think.providers.anthropic.validate_key("bad-key")
+
+    assert result["valid"] is False
+    assert "invalid x-api-key" in result["error"]
+
+
+def test_validate_key_openai_success():
+    client = Mock()
+    client.models.list.return_value = [Mock()]
+
+    with patch("openai.OpenAI", return_value=client) as mock_cls:
+        result = think.providers.openai.validate_key("test-key")
+
+    assert result == {"valid": True}
+    mock_cls.assert_called_once_with(api_key="test-key", timeout=10)
+
+
+def test_validate_key_openai_auth_error():
+    client = Mock()
+    client.models.list.side_effect = Exception("Incorrect API key")
+
+    with patch("openai.OpenAI", return_value=client):
+        result = think.providers.openai.validate_key("bad-key")
+
+    assert result["valid"] is False
+    assert "Incorrect API key" in result["error"]
+
+
+def test_validate_key_google_success():
+    client = Mock()
+    client.models.list.return_value = [Mock()]
+
+    with patch("think.providers.google.genai.Client", return_value=client) as mock_cls:
+        result = think.providers.google.validate_key("test-key")
+
+    assert result == {"valid": True}
+    mock_cls.assert_called_once()
+    assert mock_cls.call_args.kwargs["api_key"] == "test-key"
+
+
+def test_validate_key_google_auth_error():
+    client = Mock()
+    client.models.list.side_effect = Exception("API key not valid")
+
+    with patch("think.providers.google.genai.Client", return_value=client):
+        result = think.providers.google.validate_key("bad-key")
+
+    assert result["valid"] is False
+    assert "API key not valid" in result["error"]
+
+
+def test_validate_key_dispatcher_success():
+    with patch("think.providers.google.validate_key", return_value={"valid": True}):
+        result = validate_key("google", "test-key")
+
+    assert result == {"valid": True}
+
+
+def test_validate_key_dispatcher_unknown_provider():
+    with pytest.raises(ValueError, match="Unknown provider"):
+        validate_key("bogus", "test-key")
+
+
+def test_validate_key_timeout():
+    """Validate that timeout exceptions are caught and reported."""
+    client = Mock()
+    client.models.list.side_effect = TimeoutError("Connection timed out")
+
+    with patch("openai.OpenAI", return_value=client):
+        result = think.providers.openai.validate_key("test-key")
+
+    assert result["valid"] is False
+    assert "timed out" in result["error"]
+
+
+def test_update_config_saves_key_validation(settings_client):
+    client, journal = settings_client
+
+    with patch("think.providers.validate_key", return_value={"valid": False, "error": "bad key"}):
+        response = client.put(
+            "/app/settings/api/config",
+            json={"section": "env", "data": {"GOOGLE_API_KEY": "bad-key"}},
+        )
+
+    assert response.status_code == 200
+    payload = response.get_json()
+    assert payload["success"] is True
+    assert payload["key_validation"]["google"]["valid"] is False
+    assert payload["key_validation"]["google"]["error"] == "bad key"
+    assert "timestamp" in payload["key_validation"]["google"]
+
+    config = json.loads((journal / "config" / "journal.json").read_text())
+    assert config["providers"]["auth"]["google"] == "api_key"
+    assert config["providers"]["key_validation"]["google"]["valid"] is False
+
+
+def test_update_config_clears_key_validation(settings_client):
+    client, journal = settings_client
+    config_path = journal / "config" / "journal.json"
+    config = json.loads(config_path.read_text())
+    config.setdefault("env", {})["GOOGLE_API_KEY"] = "existing-key"
+    config.setdefault("providers", {}).setdefault("auth", {})["google"] = "api_key"
+    config["providers"]["key_validation"] = {
+        "google": {"valid": True, "timestamp": "2026-01-01T00:00:00+00:00"}
+    }
+    config_path.write_text(json.dumps(config, indent=2) + "\n", encoding="utf-8")
+
+    response = client.put(
+        "/app/settings/api/config",
+        json={"section": "env", "data": {"GOOGLE_API_KEY": ""}},
+    )
+
+    assert response.status_code == 200
+    payload = response.get_json()
+    assert payload["success"] is True
+    assert "google" not in payload["key_validation"]
+
+    saved = json.loads(config_path.read_text())
+    assert saved["providers"]["auth"]["google"] == "platform"
+    assert "google" not in saved["providers"]["key_validation"]
+
+
+def test_get_providers_includes_key_validation(settings_client):
+    client, journal = settings_client
+    config_path = journal / "config" / "journal.json"
+    config = json.loads(config_path.read_text())
+    config.setdefault("providers", {})["key_validation"] = {
+        "openai": {"valid": True, "timestamp": "2026-01-01T00:00:00+00:00"}
+    }
+    config_path.write_text(json.dumps(config, indent=2) + "\n", encoding="utf-8")
+
+    response = client.get("/app/settings/api/providers")
+
+    assert response.status_code == 200
+    payload = response.get_json()
+    assert payload["key_validation"]["openai"]["valid"] is True
+
+
+def test_validate_all_keys_endpoint(settings_client):
+    client, journal = settings_client
+    config_path = journal / "config" / "journal.json"
+    config = json.loads(config_path.read_text())
+    config.setdefault("env", {})["GOOGLE_API_KEY"] = "google-key"
+    config["env"]["OPENAI_API_KEY"] = "openai-key"
+    config_path.write_text(json.dumps(config, indent=2) + "\n", encoding="utf-8")
+
+    def fake_validate(provider: str, api_key: str) -> dict:
+        return {"valid": provider == "google", "error": "" if provider == "google" else "bad key"}
+
+    with patch("think.providers.validate_key", side_effect=fake_validate):
+        response = client.post("/app/settings/api/validate-keys")
+
+    assert response.status_code == 200
+    payload = response.get_json()
+    assert payload["success"] is True
+    assert payload["key_validation"]["google"]["valid"] is True
+    assert payload["key_validation"]["openai"]["valid"] is False
+    assert "timestamp" in payload["key_validation"]["google"]
+
+    saved = json.loads(config_path.read_text())
+    assert set(saved["providers"]["key_validation"]) == {"google", "openai"}

think/providers/__init__.py

···
     return module.list_models()
 
 
+def validate_key(provider: str, api_key: str) -> dict:
+    """Validate an API key for a provider.
+
+    Parameters
+    ----------
+    provider
+        Provider name (e.g., "google", "openai", "anthropic").
+    api_key
+        The API key string to validate.
+
+    Returns
+    -------
+    dict
+        {"valid": True} or {"valid": False, "error": "..."}.
+
+    Raises
+    ------
+    ValueError
+        If the provider is not registered.
+    """
+    module = get_provider_module(provider)
+    return module.validate_key(api_key)
+
+
 __all__ = [
     "PROVIDER_REGISTRY",
     "PROVIDER_METADATA",
     "get_provider_module",
     "get_provider_list",
     "get_provider_models",
+    "validate_key",
 ]

think/providers/anthropic.py

···
     return [m.model_dump() for m in client.models.list()]
 
 
+def validate_key(api_key: str) -> dict:
+    """Validate an Anthropic API key by listing models.
+
+    Creates a temporary client with the provided key. Never uses
+    the cached client or environment variables.
+
+    Returns {"valid": True} or {"valid": False, "error": "..."}.
+    """
+    try:
+        from anthropic import Anthropic
+
+        client = Anthropic(api_key=api_key, timeout=10)
+        list(client.models.list(limit=1))
+        return {"valid": True}
+    except Exception as e:
+        return {"valid": False, "error": str(e)}
+
+
 __all__ = [
     "run_cogitate",
     "run_generate",
     "run_agenerate",
     "list_models",
+    "validate_key",
 ]

think/providers/google.py

···
     return [m.model_dump() for m in client.models.list()]
 
 
+def validate_key(api_key: str) -> dict:
+    """Validate a Google API key by listing models.
+
+    Creates a temporary client with the provided key. Never uses
+    the cached client or environment variables.
+
+    Returns {"valid": True} or {"valid": False, "error": "..."}.
+    """
+    try:
+        client = genai.Client(
+            api_key=api_key,
+            http_options=types.HttpOptions(timeout=10000),
+        )
+        list(client.models.list(config={"page_size": 1}))
+        return {"valid": True}
+    except Exception as e:
+        return {"valid": False, "error": str(e)}
+
+
 __all__ = [
     "run_cogitate",
     "run_generate",
     "run_agenerate",
     "get_or_create_client",
     "list_models",
+    "validate_key",
 ]

think/providers/openai.py

···
     return [m.model_dump() for m in client.models.list()]
 
 
+def validate_key(api_key: str) -> dict:
+    """Validate an OpenAI API key by listing models.
+
+    Creates a temporary client with the provided key. Never uses
+    the cached client or environment variables.
+
+    Returns {"valid": True} or {"valid": False, "error": "..."}.
+    """
+    try:
+        import openai
+
+        client = openai.OpenAI(api_key=api_key, timeout=10)
+        list(client.models.list())
+        return {"valid": True}
+    except Exception as e:
+        return {"valid": False, "error": str(e)}
+
+
 __all__ = [
     "run_cogitate",
     "run_generate",
     "run_agenerate",
     "list_models",
+    "validate_key",
 ]