Skip to content

fix(onboard): validate nvapi- key prefix in non-interactive mode#1407

Merged
ericksoa merged 3 commits into
NVIDIA:mainfrom
yimoj:fix/1380-sk-key-error-message
Apr 7, 2026
Merged

fix(onboard): validate nvapi- key prefix in non-interactive mode#1407
ericksoa merged 3 commits into
NVIDIA:mainfrom
yimoj:fix/1380-sk-key-error-message

Conversation

@yimoj

@yimoj yimoj commented Apr 3, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Collaborator

Summary

  • Non-interactive onboard with NEMOCLAW_PROVIDER=cloud now validates the NVIDIA_API_KEY prefix before hitting the endpoint, using the existing validateNvidiaApiKeyValue() helper
  • An sk-* key (or any non-nvapi-* key) now fails early with a clear message and the correct URL to obtain a key, instead of an opaque HTTP 401: Authentication failed

Closes #1380

Test plan

  • Tested manually: NVIDIA_API_KEY="sk-fake" NEMOCLAW_NON_INTERACTIVE=1 ... nemoclaw onboard now prints Invalid key. Must start with nvapi- and Get a key from https://build.nvidia.com/settings/api-keys
  • All 713 existing tests pass (2 pre-existing failures in install-preflight.test.js unrelated to this change)

Signed-off-by: Yimo Jiang yimoj@nvidia.com

🤖 Generated with Claude Code

Summary by CodeRabbit

  • Bug Fixes

    • Strengthened NVIDIA API key validation during non-interactive setup; now shows clearer error text and a help link when the key is invalid and stops the setup.

  • Tests

    • Added an automated test that simulates the non-interactive onboarding flow with an invalid NVIDIA key, asserting no interactive prompts occur and the proper error and exit behavior.

@coderabbitai

coderabbitai Bot commented Apr 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

Non-interactive onboarding now performs value-level validation of NVIDIA_API_KEY for the build (NVIDIA Endpoints) provider and exits with code 1 if validation fails; a new test enforces the non-interactive path and asserts the process logs the validation error, help URL, and exits before any interactive prompts.

Changes

Cohort / File(s) Summary
NVIDIA API Key Validation
bin/lib/onboard.js		 In setupNim(gpu), non-interactive onboarding for provider build now calls validateNvidiaApiKeyValue(process.env.NVIDIA_API_KEY); on error it logs the validation message and REMOTE_PROVIDER_CONFIG.build.helpUrl then calls process.exit(1) instead of merely checking presence.
Tests — non-interactive onboarding
test/onboard-selection.test.js		 Added a test that forces non-interactive mode, sets NVIDIA_API_KEY to a non-nvapi- value, stubs interactive credential helpers, flips the module NON_INTERACTIVE flag, and asserts: exit code 1, no prompt calls, and error output contains the validation message and build help URL.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐰 I hopped through lines both short and bright,
I checked the keys by morning light.
If keys mislead, I sound the bell,
A help URL points where to dwell. 🥕

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately describes the main change: adding validation for nvapi- key prefix in non-interactive mode of the onboarding process.
Linked Issues check ✅ Passed The code changes validate the nvapi- prefix and fail early with clear messaging, addressing issue #1380's need to reduce hard reliance on nvapi-* prefix or explicitly surface key requirements.
Out of Scope Changes check ✅ Passed All changes are scoped to non-interactive NVIDIA API key validation in the onboarding flow, with supporting test coverage. No unrelated modifications detected.
Docstring Coverage ✅ Passed Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands and usage tips.

@yimoj
yimoj force-pushed the fix/1380-sk-key-error-message branch from 79b5fda to 097aba2 Compare April 3, 2026 10:19
@wscurran

wscurran commented Apr 3, 2026

Copy link
Copy Markdown
Contributor

✨
Possibly related open issues:

@yimoj
yimoj requested a review from cv April 7, 2026 03:08
@yimoj

yimoj commented Apr 7, 2026

Copy link
Copy Markdown
Collaborator Author

The CodeRabbit pre-merge check warning is a false positive. sk-* keys are not expected to be accepted by the build (NVIDIA Endpoints) provider — they are for the OpenAI-compatible provider. The user in #1380 was using the wrong provider for their key type. This PR correctly validates the nvapi- prefix and fails early with a clear error message pointing users to the right key source.

@yimoj @claude
fix(onboard): validate nvapi- key prefix in non-interactive mode (NVI…
70ad1f4 
…DIA#1380)

Non-interactive onboard with an sk-* key from Inference Hub now fails
early with a clear message instead of an opaque HTTP 401.

Signed-off-by: Yimo Jiang <yimoj@nvidia.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@yimoj
yimoj force-pushed the fix/1380-sk-key-error-message branch from ae55f78 to 70ad1f4 Compare April 7, 2026 04:24
@ericksoa
ericksoa merged commit 3a47efa into NVIDIA:main Apr 7, 2026
8 checks passed
gemini2026 pushed a commit to gemini2026/NemoClaw that referenced this pull request Apr 14, 2026
@yimoj @claude
@cv @gemini2026
fix(onboard): validate nvapi- key prefix in non-interactive mode (NVI…
6d5da5b 
…DIA#1407)

## Summary
- Non-interactive onboard with `NEMOCLAW_PROVIDER=cloud` now validates
the `NVIDIA_API_KEY` prefix before hitting the endpoint, using the
existing `validateNvidiaApiKeyValue()` helper
- An `sk-*` key (or any non-`nvapi-*` key) now fails early with a clear
message and the correct URL to obtain a key, instead of an opaque `HTTP
401: Authentication failed`

Closes NVIDIA#1380

## Test plan
- [x] Tested manually: `NVIDIA_API_KEY="sk-fake"
NEMOCLAW_NON_INTERACTIVE=1 ... nemoclaw onboard` now prints `Invalid
key. Must start with nvapi-` and `Get a key from
https://build.nvidia.com/settings/api-keys`
- [x] All 713 existing tests pass (2 pre-existing failures in
`install-preflight.test.js` unrelated to this change)

Signed-off-by: Yimo Jiang <yimoj@nvidia.com>

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Strengthened NVIDIA API key validation during non-interactive setup;
now shows clearer error text and a help link when the key is invalid and
stops the setup.

* **Tests**
* Added an automated test that simulates the non-interactive onboarding
flow with an invalid NVIDIA key, asserting no interactive prompts occur
and the proper error and exit behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Signed-off-by: Yimo Jiang <yimoj@nvidia.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Carlos Villela <cvillela@nvidia.com>
@yimoj
yimoj deleted the fix/1380-sk-key-error-message branch April 17, 2026 05:48
@wscurran wscurran added area: cli Command line interface, flags, terminal UX, or output bug-fix PR fixes a bug or regression and removed NemoClaw CLI labels Jun 3, 2026
@coderabbitai coderabbitai Bot mentioned this pull request Jul 1, 2026
Merged
21 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cv cv cv approved these changes

Assignees

No one assigned

Labels

area: cli Command line interface, flags, terminal UX, or output bug-fix PR fixes a bug or regression

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Non-interactive onboard fails with sk-* keys from Inference Hub

4 participants

@yimoj @wscurran @cv @ericksoa