fix(onboard): validate nvapi- key prefix in non-interactive mode

[yimoj]

Summary

• Non-interactive onboard with NEMOCLAW_PROVIDER=cloud now validates the NVIDIA_API_KEY prefix before hitting the endpoint, using the existing validateNvidiaApiKeyValue() helper
• An sk-* key (or any non-nvapi-* key) now fails early with a clear message and the correct URL to obtain a key, instead of an opaque HTTP 401: Authentication failed

Closes #1380

Test plan

• Tested manually: NVIDIA_API_KEY="sk-fake" NEMOCLAW_NON_INTERACTIVE=1 ... nemoclaw onboard now prints Invalid key. Must start with nvapi- and Get a key from https://build.nvidia.com/settings/api-keys
• All 713 existing tests pass (2 pre-existing failures in install-preflight.test.js unrelated to this change)

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Improved validation of the NVIDIA API key during non-interactive setup. The installer now checks the key's value and presents clearer error messages with guidance if the key is invalid, preventing continuation with a bad configuration.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 7267e54a-5543-44e8-be51-7bd7e9ac9518

📥 Commits

Reviewing files that changed from the base of the PR and between 79b5fda and 097aba2.

📒 Files selected for processing (1)

• bin/lib/onboard.js

🚧 Files skipped from review as they are similar to previous changes (1)

• bin/lib/onboard.js

---

📝 Walkthrough

Walkthrough

The onboarding script's non-interactive flow now validates the value of NVIDIA_API_KEY when the inference provider is build (NVIDIA Endpoints). If validation returns an error string, the script logs the error with a help URL and exits with code 1.

Changes

Cohort / File(s)	Summary
NVIDIA API Key Validation bin/lib/onboard.js	In setupNim(gpu), non-interactive onboarding for provider build now calls validateNvidiaApiKeyValue(...) on process.env.NVIDIA_API_KEY; on validation error it logs the message plus REMOTE_PROVIDER_CONFIG.build.helpUrl and exits with process.exit(1). Previously only presence was checked.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

🐰 I hopped through code both night and day,
To make sure keys won't lead astray.
A little check, a helpful cue,
Now onboarding knows what's false or true. 🥕✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: adding validation for the NVIDIA API key prefix in non-interactive mode during onboarding.
Linked Issues check	✅ Passed	The PR validates the NVIDIA_API_KEY prefix in non-interactive mode and provides clear error messaging with a help URL, addressing issue #1380's need for early validation and clear messaging instead of opaque HTTP 401 errors.
Out of Scope Changes check	✅ Passed	All changes are directly related to validating the NVIDIA API key in non-interactive onboarding mode as specified in issue #1380, with no out-of-scope modifications detected.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[wscurran]

✨
Possibly related open issues:

• #1380 Non-interactive onboard fails with sk-* keys from Inference Hub