fix: validate api key before serve setup

maintainer edit: Check api.api_key before template sync and AgentLoop construction so missing-key startup errors are not hidden by provider or workspace initialization failures.

nanobot/cli/commands.py

@@ -1129,6 +1129,13 @@ def serve(
     host = host if host is not None else api_cfg.host
     port = port if port is not None else api_cfg.port
     timeout = timeout if timeout is not None else api_cfg.timeout
+    api_key = api_cfg.api_key.strip() if api_cfg.api_key else ""
+    if not api_key:
+        console.print(
+            "[red]Error: api_key is not set. "
+            "Set api.api_key in config to prevent unauthenticated API access.[/red]"
+        )
+        raise typer.Exit(1)
     sync_workspace_templates(runtime_config.workspace_path)
     bus = MessageBus()
     session_manager = SessionManager(runtime_config.workspace_path)
@@ -1148,13 +1155,6 @@ def serve(
     console.print(f"  [cyan]Model[/cyan]    : {model_name}{preset_tag}")
     console.print("  [cyan]Session[/cyan]  : api:default")
     console.print(f"  [cyan]Timeout[/cyan]  : {timeout}s")
-    api_key = api_cfg.api_key.strip() if api_cfg.api_key else ""
-    if not api_key:
-        console.print(
-            "[red]Error: api_key is not set. "
-            "Set api.api_key in config to prevent unauthenticated API access.[/red]"
-        )
-        raise typer.Exit(1)
     if host in {"0.0.0.0", "::"}:
         console.print(
             "[yellow]API is bound to all interfaces "

tests/cli/test_commands.py

@@ -2901,6 +2901,7 @@ def test_serve_rejects_loopback_without_api_key(monkeypatch, tmp_path: Path) ->
 
     assert result.exit_code == 1
     assert "api_key is not set" in result.stdout
+    assert "workspace" not in seen
     assert "api_app" not in seen
 
 
@@ -2929,6 +2930,7 @@ def test_serve_rejects_wildcard_host_without_api_key(monkeypatch, tmp_path: Path
 
     assert result.exit_code == 1
     assert "api_key is not set" in result.stdout
+    assert "workspace" not in seen
     assert "api_app" not in seen