Repository navigation
fix(config): write the provider-table api-key marker on a DeepSeek root key save - #6974
Conversation
…ot key save A DeepSeek key saved through the TUI picker or onboarding goes through save_api_key -> save_root_api_key_for_secret_slot, which wrote the api-key marker only at the config root. Every other provider 's shared writer (prepare_provider_api_key_metadata) also writes [providers.<name>] auth_mode, and that per-table marker is exactly what the non-active-provider secret-store read gate checks. So a saved DeepSeek key read back as missing as soon as another provider was the active one. Refs codewhale-hq#6972
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
|
Thank you @gaord for tracing #6972 to the missing provider-table auth marker and for placing the write in the same atomic save transaction as secret cleanup. Your PR is now merged as your own work at e3436e48, with the original commit and source branch retained. It will be carried by0.10.2; the release has not shipped. We will retain one marker write when combining it with the candidate's overlapping repair and keep the identity/read/rollback guards and strengthened save assertion. Actual own-head hosted checks passed: macOS19,035/0failed/33skipped; Ubuntu19,032/0/34; Windows18,301passed(including one existing browser-launcher leak)/0failed/27skipped, with owner recovery passing. These source checks do not establish a live account grant, provider inference or final installer acceptance. Previously saved unmarked legacy keys need one re-save. |
Integrate main3929bcee after own-PR merges #6967, #6974, #6975 and #6966. Preserve stronger matching steer receipt, HTTP projection and identity assertions; retain one contributor provider-table auth marker in the atomic save. Keep all15 loopback guards and three independent/event watchdog corrections. Credit @Lstarsky0 and @gaord in release notes; original authored commits and source branches are preserved. Actual frozen macOS default-feature result: Summary [ 1.439s] 23 tests run: 23 passed, 15288 skipped All23 unique result ordinals are PASS. npm:540 Node +772 Vitest passed;0 failed;7 skipped. npm run check:web, versions, changelog sync, fmt and diff passed. Source hashes unchanged throughout. Existing __eh_frame linker warning retained. No new product test functions/comments or gate waivers. Old failed/cancelled CI evidence remains; complete new-head hosted CI/Windows owner recovery and final packages are pending. No provider inference or release/publication. Refs #6968 Refs #6972
2 participants
What and why
A DeepSeek key saved via the TUI provider picker / onboarding goes through
save_api_key->save_root_api_key_for_secret_slot, which wrote the api-keymarker (
auth_mode = "api_key") only at the config root. Every other provideruses
codewhale_config::credentials::prepare_provider_api_key_metadata, whichalso writes the provider's own
[providers.<name>] auth_mode. That per-tablemarker is what the non-active-provider secret-store read gate
(
secret_slot_save_marker_on_shared_slot) checks before probing the durableslot. Result: a saved DeepSeek key read back as
missingwhenever anotherprovider (e.g.
zai) was active — in the TUI picker,GET /v1/providers, andany host showing
credential_state.This makes the DeepSeek root save write the same per-table marker the shared
writer writes, so the saved key is recognized after a restart.
Issue
Refs #6972
How I tested it
CODEWHALE_DEV_CACHE=local sh scripts/dev-test.sh crates/tui/src/config.rs savetest result: ok. 268 passed; 0 failed; 0 ignored; 0 measured; 15043 filtered out; finished in 9.75s
Checklist
maincargo fmt --allpasses, and tests cover new or changed behavior