fix(onboard): don't enforce nvapi- prefix on non-NVIDIA API keys

[robobryce]

Summary

• Users selecting Anthropic (or any non-NVIDIA provider) in the onboarding wizard could see Invalid key. Must start with nvapi- when re-entering a valid Anthropic API key after an auth-failure retry.
• Root cause: the retry path in promptValidationRecovery (bin/lib/onboard.js) routed all credentials through validateNvidiaApiKeyValue, which unconditionally rejected anything without the NVIDIA nvapi- prefix.
• Fix: make validateNvidiaApiKeyValue provider-aware via an optional credentialEnv argument — the nvapi- check only applies when credentialEnv === "NVIDIA_API_KEY". The retry path now passes credentialEnv through, so Anthropic/OpenAI/Gemini keys are accepted on retry.
• Clarified the error strings (Invalid NVIDIA API key. Must start with nvapi-) so users who do hit the check understand they are at the NVIDIA prompt.

Test plan

• npx vitest run src/lib/validation.test.ts — added cases for Anthropic/OpenAI/Gemini credentialEnv values
• npx vitest run test/credentials.test.js — updated error-string assertion
• npx vitest run test/onboard-selection.test.js — existing Anthropic/OpenAI/Gemini retry flows still pass
• npm run build:cli — TypeScript compiles
• Manual reasoning: Anthropic retry path now calls validateNvidiaApiKeyValue(key, "ANTHROPIC_API_KEY") which returns null, so replaceNamedCredential accepts the key

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes

  • Validation now reports clearer, provider-specific messages and enforces the NVIDIA key prefix only when using the NVIDIA credential.
  • Recovery flow always wires a validator so non-NVIDIA credentials are validated with provider-aware rules.

• Tests

  • Expanded and updated tests to cover provider-aware credential validation and to assert the more specific NVIDIA error messages.

---

Signed-off-by: Aaron Erickson aerickson@nvidia.com

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[coderabbitai]

📝 Walkthrough

Walkthrough

Validation was made provider-aware: validateNvidiaApiKeyValue gained an optional credentialEnv parameter and enforces NVIDIA-specific prefix/messages only when credentialEnv indicates NVIDIA; related error text and validator wiring were updated in credentials/onboard and tests.

Changes

Cohort / File(s)	Summary
Validation Core src/lib/validation.ts	Added credentialEnv: string = "NVIDIA_API_KEY" param; derive isNvidia and apply NVIDIA-only prefix requirement and NVIDIA-specific required/error messages.
Credential Usage src/lib/credentials.ts, src/lib/onboard.ts	Error message updated to reference "NVIDIA API key"; promptValidationRecovery now passes credentialEnv into the validator wrapper so validation is provider-aware.
Tests — Validation Behaviour src/lib/validation.test.ts	Extended tests to exercise credentialEnv branch: non-nvapi- keys accepted when credentialEnv ≠ NVIDIA_API_KEY, empty keys still rejected.
Tests — Expectation Updates test/credentials.test.ts, test/onboard-selection.test.ts, test/credential-exposure.test.ts	Updated assertions and validator-hoisting expectation to reflect provider-aware validation and the more specific "Invalid NVIDIA API key" messaging.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 I hopped through keys both short and long,
I learned when nvapi- must sing along.
For NVIDIA I guard the precious key,
For others I nod and set them free. 🥕

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: making the nvapi- prefix validation conditional for non-NVIDIA providers during the onboarding retry flow.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[brycelelbach]

[ericksoa]

Reviewed the diff and the merge resolution. The PR's framing oversells the safety impact (Anthropic keys already worked on retry — pre-PR validator was already provider-aware), but the actual changes are sound: (1) clearer error message — Invalid NVIDIA API key vs Invalid key — useful on the NVIDIA paths that legitimately reject non-nvapi values; (2) refactor consolidating provider-awareness into validateNvidiaApiKeyValue itself; (3) tests for the new 2-arg signature. Net positive, low regression risk. Pushed merge commit 655b22e to resolve the conflict and unbreak macos-e2e (test/credential-exposure.test.ts source-text regex needed updating for the new validator line shape; #1313's single-definition invariant is preserved).