Add OpenRouter authentication diagnostics

internal/llm/http_evidence.go

@@ -6,6 +6,8 @@ import (
 	"net/http"
 	"sync"
 	"time"
+
+	"gitea.maximumdirect.net/eric/promptkit/internal/domain"
 )
 
 // HTTPExecutionEvidence contains only facts observable at the configured
@@ -99,6 +101,27 @@ func (c *OpenAICompatibleClient) GetWithEvidence(
 	ctx context.Context,
 	endpoint string,
 	timeoutSeconds int,
+) (*http.Response, HTTPExecutionEvidence, error) {
+	return c.getWithEvidence(ctx, endpoint, timeoutSeconds, "")
+}
+
+// GetWithAuthenticationEvidence performs a plain GET with credentials resolved
+// from the selected target. Missing credentials are allowed for diagnostic
+// authentication probes even when generation requires a key.
+func (c *OpenAICompatibleClient) GetWithAuthenticationEvidence(
+	ctx context.Context,
+	endpoint string,
+	timeoutSeconds int,
+	target domain.ExecutionTarget,
+) (*http.Response, HTTPExecutionEvidence, error) {
+	return c.getWithEvidence(ctx, endpoint, timeoutSeconds, resolveAPIKey(target))
+}
+
+func (c *OpenAICompatibleClient) getWithEvidence(
+	ctx context.Context,
+	endpoint string,
+	timeoutSeconds int,
+	apiKey string,
 ) (*http.Response, HTTPExecutionEvidence, error) {
 	requestContext := ctx
 	var cancel context.CancelFunc
@@ -113,6 +136,9 @@ func (c *OpenAICompatibleClient) GetWithEvidence(
 		}
 		return nil, HTTPExecutionEvidence{}, err
 	}
+	if apiKey != "" {
+		request.Header.Set("Authorization", "Bearer "+apiKey)
+	}
 
 	response, err, evidence := doWithEvidence(c.httpClient, request)
 	if response == nil || response.Body == nil {

internal/llm/http_evidence_test.go

@@ -12,6 +12,8 @@ import (
 	"sync"
 	"testing"
 	"time"
+
+	"gitea.maximumdirect.net/eric/promptkit/internal/domain"
 )
 
 func TestGetWithEvidenceCapturesResponseAndOmitsURLUserInfo(t *testing.T) {
@@ -54,6 +56,69 @@ func TestGetWithEvidenceCapturesResponseAndOmitsURLUserInfo(t *testing.T) {
 	}
 }
 
+func TestGetWithAuthenticationEvidenceResolvesOptionalCredentials(t *testing.T) {
+	tests := []struct {
+		name        string
+		target      domain.ExecutionTarget
+		environment string
+		wantAuth    string
+	}{
+		{
+			name: "direct key takes precedence",
+			target: domain.ExecutionTarget{
+				APIKey:    " direct-key ",
+				APIKeyEnv: "PROMPTKIT_DIAGNOSTIC_KEY",
+			},
+			environment: "environment-key",
+			wantAuth:    "Bearer direct-key",
+		},
+		{
+			name:        "environment key is used",
+			target:      domain.ExecutionTarget{APIKeyEnv: "PROMPTKIT_DIAGNOSTIC_KEY"},
+			environment: " environment-key ",
+			wantAuth:    "Bearer environment-key",
+		},
+		{
+			name:        "missing required key is optional here",
+			target:      domain.ExecutionTarget{APIKeyEnv: "PROMPTKIT_DIAGNOSTIC_KEY", APIKeyRequired: true},
+			environment: " ",
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Setenv("PROMPTKIT_DIAGNOSTIC_KEY", tc.environment)
+			var authorization string
+			client, err := NewOpenAICompatibleClient(OpenAICompatibleConfig{
+				HTTPClient: &http.Client{Transport: roundTripFunc(func(request *http.Request) (*http.Response, error) {
+					authorization = request.Header.Get("Authorization")
+					return &http.Response{
+						StatusCode: http.StatusUnauthorized,
+						Header:     make(http.Header),
+						Body:       io.NopCloser(strings.NewReader("")),
+					}, nil
+				})},
+			})
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			response, evidence, err := client.GetWithAuthenticationEvidence(
+				context.Background(), "https://example.invalid/key", 0, tc.target,
+			)
+			if err != nil || response == nil {
+				t.Fatalf("response=%v error=%v", response, err)
+			}
+			response.Body.Close()
+			if authorization != tc.wantAuth || evidence.CredentialsSupplied != (tc.wantAuth != "") {
+				t.Fatalf("authorization=%q evidence=%+v", authorization, evidence)
+			}
+			if evidence.Endpoint != "https://example.invalid/key" || evidence.HTTPStatus == nil || *evidence.HTTPStatus != http.StatusUnauthorized {
+				t.Fatalf("HTTP evidence = %+v", evidence)
+			}
+		})
+	}
+}
+
 func TestDoWithEvidenceRecordsRequestWithoutResponse(t *testing.T) {
 	transportErr := errors.New("transport unavailable")
 	client := &http.Client{Transport: roundTripFunc(func(*http.Request) (*http.Response, error) {

internal/llm/openai_compatible_client.go

@@ -164,11 +164,8 @@ func (c *OpenAICompatibleClient) PrepareGeneration(req domain.GenerateRequest) (
 		}
 		return nil, fmt.Errorf("%w: failed to encode request: %v", ErrRequestFailed, err)
 	}
-	apiKey := strings.TrimSpace(req.Target.APIKey)
+	apiKey := resolveAPIKey(req.Target)
 	envName := strings.TrimSpace(req.Target.APIKeyEnv)
-	if apiKey == "" && envName != "" {
-		apiKey = strings.TrimSpace(os.Getenv(envName))
-	}
 	if apiKey == "" && req.Target.APIKeyRequired {
 		if envName != "" {
 			return nil, fmt.Errorf("%w: api key environment variable %q is not set", ErrInvalidRequest, envName)
@@ -186,6 +183,16 @@ func (c *OpenAICompatibleClient) PrepareGeneration(req domain.GenerateRequest) (
 	}, nil
 }
 
+func resolveAPIKey(target domain.ExecutionTarget) string {
+	apiKey := strings.TrimSpace(target.APIKey)
+	if apiKey == "" {
+		if envName := strings.TrimSpace(target.APIKeyEnv); envName != "" {
+			apiKey = strings.TrimSpace(os.Getenv(envName))
+		}
+	}
+	return apiKey
+}
+
 // Execute dispatches one attempt. The returned response is non-nil only when
 // the successful envelope contains a usable first choice.
 func (p *PreparedGeneration) Execute(ctx context.Context) AttemptOutcome {