## Summary
- Users selecting **Anthropic** (or any non-NVIDIA provider) in the
onboarding wizard could see `Invalid key. Must start with nvapi-` when
re-entering a valid Anthropic API key after an auth-failure retry.
- Root cause: the retry path in `promptValidationRecovery`
(bin/lib/onboard.js) routed all credentials through
`validateNvidiaApiKeyValue`, which unconditionally rejected anything
without the NVIDIA `nvapi-` prefix.
- Fix: make `validateNvidiaApiKeyValue` provider-aware via an optional
`credentialEnv` argument — the `nvapi-` check only applies when
`credentialEnv === "NVIDIA_API_KEY"`. The retry path now passes
`credentialEnv` through, so Anthropic/OpenAI/Gemini keys are accepted on
retry.
- Clarified the error strings (`Invalid NVIDIA API key. Must start with
nvapi-`) so users who do hit the check understand they are at the NVIDIA
prompt.
## Test plan
- [x] `npx vitest run src/lib/validation.test.ts` — added cases for
Anthropic/OpenAI/Gemini credentialEnv values
- [x] `npx vitest run test/credentials.test.js` — updated error-string
assertion
- [x] `npx vitest run test/onboard-selection.test.js` — existing
Anthropic/OpenAI/Gemini retry flows still pass
- [x] `npm run build:cli` — TypeScript compiles
- [x] Manual reasoning: Anthropic retry path now calls
`validateNvidiaApiKeyValue(key, "ANTHROPIC_API_KEY")` which returns
`null`, so `replaceNamedCredential` accepts the key
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Validation now reports clearer, provider-specific messages and
enforces the NVIDIA key prefix only when using the NVIDIA credential.
* Recovery flow always wires a validator so non-NVIDIA credentials are
validated with provider-aware rules.
* **Tests**
* Expanded and updated tests to cover provider-aware credential
validation and to assert the more specific NVIDIA error messages.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Co-authored-by: Bryce Adelstein Lelbach <brycelelbach@gmail.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Aaron Erickson <aerickson@nvidia.com>
