Fix \init\ persisting env var API keys into config

[mayuriphad]

Fixes #281 by tracking whether an existing key came from the config file or the environment, preventing environment variable API keys from being inadvertently saved to \config.json\ when the user leaves the prompt blank.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 0516005c-822d-4d5b-97fa-b05fd34eea3a

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[cubic-dev-ai]

1 issue found across 1 file

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/commands/init.ts">

<violation number="1" location="src/commands/init.ts:126">
P1: When `COMMIT_ECHO_API_KEY` supplies the effective key during reconfiguration, this assignment misclassifies it as a config key, so a blank prompt persists the environment secret. Read the raw config value before applying environment overrides, or track the override source when deciding what to save.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: When COMMIT_ECHO_API_KEY supplies the effective key during reconfiguration, this assignment misclassifies it as a config key, so a blank prompt persists the environment secret. Read the raw config value before applying environment overrides, or track the override source when deciding what to save.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/commands/init.ts, line 126:

<comment>When `COMMIT_ECHO_API_KEY` supplies the effective key during reconfiguration, this assignment misclassifies it as a config key, so a blank prompt persists the environment secret. Read the raw config value before applying environment overrides, or track the override source when deciding what to save.</comment>

<file context>
@@ -123,7 +123,8 @@ export async function initCommand(options: { installHook?: boolean } = {}): Prom
 
   if (needsApiKey) {
-    const existingKey = existingConfig?.apiKey ?? process.env[apiKeyEnv] ?? '';
+    const existingConfigKey = existingConfig?.apiKey ?? '';
+    const existingKey = existingConfigKey || process.env[apiKeyEnv] || '';
     const keyResult = await text(buildApiKeyPrompt(existingKey, apiKeyEnv));
</file context>

[404-Page-Found]

High severity issue above

[mayuriphad]

The fix in this PR's single commit (f1fa9cd) already addresses the flagged issue: existingConfigKey is now read separately from process.env[apiKeyEnv], and only existingConfigKey (not the env-var fallback) is persisted when the prompt is left blank. Re-checked line-by-line and confirmed a blank reconfig prompt no longer writes the env var's key into config.json. Could you take another look / re-review? Happy to add a regression test if useful.

[404-Page-Found]

@cubic-dev-ai

[cubic-dev-ai]

@cubic-dev-ai

@404-Page-Found I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

1 existing issue remains and no new issues found across 1 file

<sub>Requires human review: Auto-approval blocked by 1 unresolved issue from a previous review of this commit.

Re-trigger cubic</sub>