Remove prefix-based credential inference; gateway-first setup only

Drop KeyPrefixes from provider registry, pattern matching, learned prefix
files, and probe disambiguation on paste. Add InferenceForProvider for
hosts that select a gateway before saving an API key. ResolveCredential
lists registry gateways in sort order without inferring from key shape.

Author: Patel230

catalog/registry/derive.go

@@ -11,7 +11,6 @@ type CredentialSpec struct {
 	DisplayName  string
 	DeploymentID string
 	EnvVar       string
-	KeyPrefixes  []string
 	ProbeKind    string
 	ProbeBaseURL string
 	RequiresKey  bool
@@ -57,7 +56,6 @@ func CredentialRegistry() []CredentialSpec {
 			DisplayName:  s.DisplayName,
 			DeploymentID: s.DeploymentID,
 			EnvVar:       s.CredentialEnv,
-			KeyPrefixes:  append([]string(nil), s.KeyPrefixes...),
 			ProbeKind:    string(s.ProbeKind),
 			ProbeBaseURL: s.ProbeBaseURL,
 			RequiresKey:  s.RequiresKey,

catalog/registry/providers.go

@@ -15,15 +15,15 @@ func providerSpecs() []ProviderSpec {
 	return []ProviderSpec{
 		{
 			ProviderID: "anthropic", DisplayName: "Anthropic", DeploymentID: "anthropic-direct", SortOrder: 1,
-			RequiresKey: true, CredentialEnv: "ANTHROPIC_API_KEY", KeyPrefixes: []string{"sk-ant-"},
+			RequiresKey: true, CredentialEnv: "ANTHROPIC_API_KEY",
 			BaseURLEnv: []string{"ANTHROPIC_BASE_URL", "OPENAI_BASE_URL", "OPENAI_API_BASE"},
 			ProbeKind:  ProbeAnthropic, ModelStrategy: StrategyRemoteThenLive, PreferLiveMerge: true,
 			LiveFetcherKey: "anthropic", LiveCatalogKey: "anthropic",
 			APIProtocolID: "anthropic-messages", AdapterID: "anthropic",
 		},
 		{
 			ProviderID: "openai", DisplayName: "OpenAI", DeploymentID: "openai-direct", SortOrder: 2,
-			RequiresKey: true, CredentialEnv: "OPENAI_API_KEY", KeyPrefixes: []string{"sk-proj-", "sk-svcacct-"},
+			RequiresKey: true, CredentialEnv: "OPENAI_API_KEY",
 			BaseURLEnv: []string{"OPENAI_BASE_URL", "OPENAI_API_BASE"},
 			ProbeKind:  ProbeOpenAIModels, ProbeBaseURL: "https://api.openai.com/v1",
 			ModelStrategy: StrategyRemoteThenLive, PreferLiveMerge: true,
@@ -32,15 +32,15 @@ func providerSpecs() []ProviderSpec {
 		},
 		{
 			ProviderID: "gemini", DisplayName: "Google Gemini", DeploymentID: "gemini-direct", SortOrder: 3,
-			RequiresKey: true, CredentialEnv: "GEMINI_API_KEY", KeyPrefixes: []string{"AIza", "AQ."},
+			RequiresKey: true, CredentialEnv: "GEMINI_API_KEY",
 			BaseURLEnv: []string{"GEMINI_BASE_URL", "OPENAI_BASE_URL", "OPENAI_API_BASE"},
 			ProbeKind:  ProbeGemini, ModelStrategy: StrategyRemoteThenLive, PreferLiveMerge: true,
 			LiveFetcherKey: "gemini", LiveCatalogKey: "gemini",
 			APIProtocolID: "gemini-generate-content", AdapterID: "gemini",
 		},
 		{
 			ProviderID: "openrouter", DisplayName: "OpenRouter", DeploymentID: "openrouter", SortOrder: 4,
-			RequiresKey: true, CredentialEnv: "OPENROUTER_API_KEY", KeyPrefixes: []string{"sk-or-v1-", "sk-or-"},
+			RequiresKey: true, CredentialEnv: "OPENROUTER_API_KEY",
 			BaseURLEnv: []string{"OPENROUTER_BASE_URL", "OPENAI_BASE_URL", "OPENAI_API_BASE"},
 			ProbeKind:  ProbeOpenAIModels, ProbeBaseURL: "https://openrouter.ai/api/v1",
 			ModelStrategy: StrategyLiveOnly, PreferLiveMerge: true,
@@ -49,7 +49,7 @@ func providerSpecs() []ProviderSpec {
 		},
 		{
 			ProviderID: "grok", DisplayName: "xAI (Grok)", DeploymentID: "grok-direct", SortOrder: 5,
-			RequiresKey: true, CredentialEnv: "XAI_API_KEY", CredentialEnvFallbacks: []string{"GROK_API_KEY"}, KeyPrefixes: []string{"xai-"},
+			RequiresKey: true, CredentialEnv: "XAI_API_KEY", CredentialEnvFallbacks: []string{"GROK_API_KEY"},
 			BaseURLEnv: []string{"GROK_BASE_URL", "XAI_BASE_URL", "OPENAI_BASE_URL", "OPENAI_API_BASE"},
 			ProbeKind:  ProbeOpenAIModels, ProbeBaseURL: "https://api.x.ai/v1",
 			ModelStrategy: StrategyRemoteThenLive, PreferLiveMerge: true,
@@ -67,7 +67,7 @@ func providerSpecs() []ProviderSpec {
 		},
 		{
 			ProviderID: "canopywave", DisplayName: "CanopyWave", DeploymentID: "canopywave", SortOrder: 7,
-			RequiresKey: true, CredentialEnv: "CANOPYWAVE_API_KEY", KeyPrefixes: []string{"cw_"},
+			RequiresKey: true, CredentialEnv: "CANOPYWAVE_API_KEY",
 			BaseURLEnv: []string{"CANOPYWAVE_BASE_URL", "OPENAI_BASE_URL", "OPENAI_API_BASE"},
 			ProbeKind:  ProbeOpenAIModels, ProbeBaseURL: "https://inference.canopywave.io/v1",
 			ModelStrategy: StrategyLiveOnly, PreferLiveMerge: true,
@@ -76,7 +76,7 @@ func providerSpecs() []ProviderSpec {
 		},
 		{
 			ProviderID: "opencodego", DisplayName: "OpenCode Go", DeploymentID: "opencodego", SortOrder: 8,
-			RequiresKey: true, CredentialEnv: "OPENCODEGO_API_KEY", KeyPrefixes: []string{"ocg_"},
+			RequiresKey: true, CredentialEnv: "OPENCODEGO_API_KEY",
 			BaseURLEnv:    []string{"OPENCODEGO_BASE_URL", "OPENAI_BASE_URL", "OPENAI_API_BASE"},
 			ProbeKind:     ProbeOpenAIModels,
 			ProbeBaseURL:  "https://opencode.ai/zen/go/v1",
@@ -95,7 +95,7 @@ func providerSpecs() []ProviderSpec {
 		},
 		{
 			ProviderID: "xiaomi", DisplayName: "Xiaomi (MiMo)", DeploymentID: "xiaomi-direct", SortOrder: 10,
-			RequiresKey: true, CredentialEnv: "XIAOMI_API_KEY", KeyPrefixes: []string{"tp-"},
+			RequiresKey: true, CredentialEnv: "XIAOMI_API_KEY",
 			BaseURLEnv: []string{"XIAOMI_BASE_URL", "MIMO_BASE_URL", "OPENAI_BASE_URL", "OPENAI_API_BASE"},
 			ProbeKind:  ProbeOpenAIModels, ProbeBaseURL: "https://api.xiaomimimo.com/v1",
 			ModelStrategy: StrategyLiveOnly, PreferLiveMerge: true,
@@ -118,4 +118,4 @@ func providerSpecs() []ProviderSpec {
 			},
 		},
 	}
-}
+}

catalog/registry/spec.go

@@ -39,7 +39,6 @@ type ProviderSpec struct {
 	RequiresKey            bool
 	CredentialEnv          string
 	CredentialEnvFallbacks []string // additional env var names for the same credential
-	KeyPrefixes            []string
 	BaseURLEnv             []string
 	ProbeKind              ProbeKind
 	ProbeBaseURL           string

config/credential/inference.go

@@ -1,127 +1,18 @@
 package credential
 
-import (
-	"context"
-	"sort"
-	"strings"
+import "context"
 
-	"github.com/GrayCodeAI/eyrie/catalog"
-	"github.com/GrayCodeAI/eyrie/catalog/registry"
-)
-
-// CredentialInference is one provider/deployment match for a pasted API key (no secret).
+// CredentialInference is save metadata for a gateway chosen in setup UI (no secret).
 type CredentialInference struct {
 	ProviderID   string `json:"provider_id"`
 	DeploymentID string `json:"deployment_id"`
 	EnvVar       string `json:"env_var"`
 	DisplayName  string `json:"display_name"`
 }
 
-// InferCredentialsFromAPIKey returns prefix-inferred candidates (legacy API; prefer ResolveCredential).
+// InferCredentialsFromAPIKey is deprecated: setup is gateway-first (select provider, then paste key).
 func InferCredentialsFromAPIKey(ctx context.Context, secret string) []CredentialInference {
-	res := ResolveCredential(ctx, secret)
-	if !res.FormatOK {
-		return nil
-	}
-	var out []CredentialInference
-	for _, opt := range res.Providers {
-		if !opt.Inferred {
-			continue
-		}
-		out = append(out, InferenceFromOption(opt))
-	}
-	if len(out) > 0 {
-		return out
-	}
-	// Fallback: catalog-backed inference for providers not in registry prefixes.
-	return inferFromCatalog(ctx, secret)
-}
-
-func inferFromCatalog(ctx context.Context, secret string) []CredentialInference {
-	if err := ValidateKeyFormat(secret); err != nil {
-		return nil
-	}
-	compiled, err := catalog.LoadCatalogForDiscovery(ctx)
-	if err != nil || compiled == nil {
-		return nil
-	}
-	providerIDs := matchedProviderIDsFromRegistry(secret)
-	if len(providerIDs) == 0 {
-		return nil
-	}
-	seen := map[string]bool{}
-	var out []CredentialInference
-	for _, pid := range providerIDs {
-		for _, depID := range deploymentIDsForProvider(compiled, pid) {
-			env := catalog.PrimaryAPIKeyEnvForDeployment(compiled, depID)
-			if env == "" || seen[env] || !isProviderAPIKeyEnv(env) {
-				continue
-			}
-			if err := ValidateCredentialSecret(env, secret); err != nil {
-				continue
-			}
-			seen[env] = true
-			out = append(out, CredentialInference{
-				ProviderID:   pid,
-				DeploymentID: depID,
-				EnvVar:       env,
-				DisplayName:  inferenceDisplayName(compiled, depID, pid),
-			})
-		}
-	}
-	sort.Slice(out, func(i, j int) bool {
-		if out[i].ProviderID != out[j].ProviderID {
-			return out[i].ProviderID < out[j].ProviderID
-		}
-		return out[i].DeploymentID < out[j].DeploymentID
-	})
-	return out
-}
-
-func deploymentIDsForProvider(compiled *catalog.CompiledCatalogV1, providerID string) []string {
-	if compiled == nil || compiled.Catalog == nil {
-		return []string{providerID + "-direct"}
-	}
-	providerID = catalog.CanonicalProviderID(providerID)
-	preferred := []string{providerID + "-direct", providerID}
-	var out []string
-	seen := map[string]bool{}
-	add := func(id string) {
-		if id == "" || seen[id] {
-			return
-		}
-		if _, ok := compiled.Catalog.Deployments[id]; !ok {
-			return
-		}
-		seen[id] = true
-		out = append(out, id)
-	}
-	for _, id := range preferred {
-		add(id)
-	}
-	for id, dep := range compiled.Catalog.Deployments {
-		if catalog.CanonicalProviderID(dep.ProviderID) == providerID {
-			add(id)
-		}
-	}
-	return out
-}
-
-func isProviderAPIKeyEnv(env string) bool {
-	return strings.Contains(strings.ToUpper(strings.TrimSpace(env)), "API_KEY") ||
-		strings.Contains(strings.ToUpper(strings.TrimSpace(env)), "TOKEN")
-}
-
-func inferenceDisplayName(compiled *catalog.CompiledCatalogV1, deploymentID, providerID string) string {
-	if spec, ok := registry.DefaultRegistry.Get(providerID); ok {
-		return spec.DisplayName
-	}
-	if compiled != nil && compiled.Catalog != nil {
-		if dep, ok := compiled.Catalog.Deployments[deploymentID]; ok {
-			if name := strings.TrimSpace(dep.Name); name != "" {
-				return name
-			}
-		}
-	}
-	return providerID
-}
+	_ = ctx
+	_ = secret
+	return nil
+}

config/credential/inference_test.go

@@ -5,73 +5,35 @@ import (
 	"testing"
 )
 
-func TestInferCredentialsFromAPIKey_Anthropic(t *testing.T) {
+func TestInferCredentialsFromAPIKey_ReturnsNil(t *testing.T) {
 	got := InferCredentialsFromAPIKey(context.Background(), "sk-ant-api03-test-key-1234567890")
-	if len(got) == 0 {
-		t.Fatal("expected anthropic inference")
-	}
-	if got[0].ProviderID != "anthropic" {
-		t.Fatalf("provider = %q, want anthropic", got[0].ProviderID)
-	}
-	if got[0].EnvVar != "ANTHROPIC_API_KEY" {
-		t.Fatalf("env = %q", got[0].EnvVar)
-	}
-}
-
-func TestInferCredentialsFromAPIKey_OpenRouter(t *testing.T) {
-	got := InferCredentialsFromAPIKey(context.Background(), "sk-or-v1-test-key-1234567890")
-	if len(got) == 0 {
-		t.Fatal("expected openrouter inference")
-	}
-	found := false
-	for _, c := range got {
-		if c.ProviderID == "openrouter" {
-			found = true
-			break
-		}
-	}
-	if !found {
-		t.Fatalf("expected openrouter in %#v", got)
-	}
-}
-
-func TestInferCredentialsFromAPIKey_OpenAI(t *testing.T) {
-	got := InferCredentialsFromAPIKey(context.Background(), "sk-proj-test-key-1234567890")
-	if len(got) == 0 {
-		t.Fatal("expected openai inference")
-	}
-	if got[0].ProviderID != "openai" {
-		t.Fatalf("provider = %q, want openai", got[0].ProviderID)
-	}
-}
-
-func TestInferCredentialsFromAPIKey_GenericOpenAICompatible(t *testing.T) {
-	got := InferCredentialsFromAPIKey(ContextWithoutProbeDisambiguation(context.Background()), "sk-test-key-that-could-belong-to-any-compatible-provider")
 	if len(got) != 0 {
-		t.Fatalf("generic sk- keys should not infer a provider, got %#v", got)
+		t.Fatalf("expected no prefix inference, got %d", len(got))
 	}
 }
 
-func TestInferCredentialsFromAPIKey_Gemini(t *testing.T) {
-	got := InferCredentialsFromAPIKey(context.Background(), "AIzaSyD-test-key-1234567890")
-	if len(got) == 0 {
-		t.Fatal("expected gemini inference")
+func TestInferenceForProvider_Anthropic(t *testing.T) {
+	inf, err := InferenceForProvider("anthropic")
+	if err != nil {
+		t.Fatal(err)
 	}
-	if got[0].ProviderID != "gemini" {
-		t.Fatalf("provider = %q, want gemini", got[0].ProviderID)
+	if inf.ProviderID != "anthropic" || inf.DeploymentID != "anthropic-direct" || inf.EnvVar != "ANTHROPIC_API_KEY" {
+		t.Fatalf("unexpected inference: %+v", inf)
 	}
 }
 
-func TestInferCredentialsFromAPIKey_Unknown(t *testing.T) {
-	got := InferCredentialsFromAPIKey(context.Background(), "not-a-real-key-format")
-	if len(got) != 0 {
-		t.Fatalf("expected no inference, got %#v", got)
+func TestInferenceForProvider_Ollama(t *testing.T) {
+	inf, err := InferenceForProvider("ollama")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if inf.EnvVar != "OLLAMA_BASE_URL" || inf.DeploymentID != "ollama-local" {
+		t.Fatalf("unexpected ollama inference: %+v", inf)
 	}
 }
 
-func TestInferCredentialsFromAPIKey_Placeholder(t *testing.T) {
-	got := InferCredentialsFromAPIKey(context.Background(), "your-api-key")
-	if len(got) != 0 {
-		t.Fatalf("expected no inference for placeholder, got %#v", got)
+func TestInferenceForProvider_Unknown(t *testing.T) {
+	if _, err := InferenceForProvider("not-a-provider"); err == nil {
+		t.Fatal("expected error for unknown provider")
 	}
-}
+}