Tighten prepared execution credential handling

internal/usecase/prepared_execution.go

@@ -31,6 +31,7 @@ type PreparedExecution struct {
 type preparedExecutionPayload struct {
 	prepared   *domain.PreparedRun
 	validation validate.PreparedValidation
+	directKey  string
 }
 
 // PrepareExecution completes preparation without generation or admission and
@@ -61,18 +62,13 @@ func (r *Runner) PrepareExecution(ctx context.Context, req domain.RunRequest) (*
 
 	executionSnapshot, err := clonePreparedRun(prepared)
 	if err != nil {
-		prepared.EffectiveModelParams.APIKey = ""
 		return nil, fmt.Errorf("%w: failed to copy prepared execution: %v", ErrInvalidRequest, err)
 	}
-	executionSnapshot.StructuredOutput = prepared.StructuredOutput
-	prepared.EffectiveModelParams.APIKey = ""
 
 	details, err := clonePreparedRun(executionSnapshot)
 	if err != nil {
-		executionSnapshot.EffectiveModelParams.APIKey = ""
 		return nil, fmt.Errorf("%w: failed to copy prepared execution details: %v", ErrInvalidRequest, err)
 	}
-	details.EffectiveModelParams.APIKey = ""
 
 	return &PreparedExecution{
 		owner:   r,
@@ -81,6 +77,7 @@ func (r *Runner) PrepareExecution(ctx context.Context, req domain.RunRequest) (*
 		payload: &preparedExecutionPayload{
 			prepared:   executionSnapshot,
 			validation: validationPlan,
+			directKey:  state.effectiveModel.APIKey,
 		},
 	}, nil
 }
@@ -175,7 +172,7 @@ func (r *Runner) RunPrepared(ctx context.Context, prepared *PreparedExecution) (
 	start := time.Now().UTC()
 
 	target := payload.prepared.EffectiveModelParams
-	if err := validateAPIKey(target.APIKeyEnv, target.APIKey, target.APIKeyRequired); err != nil {
+	if err := validateAPIKey(target.APIKeyEnv, payload.directKey, target.APIKeyRequired); err != nil {
 		return nil, fmt.Errorf("%w: %w", ErrInvalidRequest, err)
 	}
 
@@ -185,7 +182,7 @@ func (r *Runner) RunPrepared(ctx context.Context, prepared *PreparedExecution) (
 	}
 	defer release()
 
-	return r.executePreparedRun(ctx, payload.prepared, runID, start, func(
+	return r.executePreparedRun(ctx, payload.prepared, payload.directKey, runID, start, func(
 		ctx context.Context,
 		artifact *domain.Artifact,
 		attemptsUsed int,
@@ -224,6 +221,7 @@ func (p *preparedExecutionPayload) clear() {
 	}
 	p.prepared = nil
 	p.validation = nil
+	p.directKey = ""
 }
 
 type noOpPreparedValidation struct {