Skip to content

Fix \init\ persisting env var API keys into config #289

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mayuriphad wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Fix \init\ persisting env var API keys into config #289

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions src/commands/init.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -123,7 +123,8 @@ export async function initCommand(options: { installHook?: boolean } = {}): Prom
}

if (needsApiKey) {
const existingKey = existingConfig?.apiKey ?? process.env[apiKeyEnv] ?? '';
const existingConfigKey = existingConfig?.apiKey ?? '';

@cubic-dev-ai cubic-dev-ai Bot Aug 23, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1: When COMMIT_ECHO_API_KEY supplies the effective key during reconfiguration, this assignment misclassifies it as a config key, so a blank prompt persists the environment secret. Read the raw config value before applying environment overrides, or track the override source when deciding what to save.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At src/commands/init.ts, line 126:

<comment>When `COMMIT_ECHO_API_KEY` supplies the effective key during reconfiguration, this assignment misclassifies it as a config key, so a blank prompt persists the environment secret. Read the raw config value before applying environment overrides, or track the override source when deciding what to save.</comment>

<file context>
@@ -123,7 +123,8 @@ export async function initCommand(options: { installHook?: boolean } = {}): Prom
 
   if (needsApiKey) {
-    const existingKey = existingConfig?.apiKey ?? process.env[apiKeyEnv] ?? '';
+    const existingConfigKey = existingConfig?.apiKey ?? '';
+    const existingKey = existingConfigKey || process.env[apiKeyEnv] || '';
     const keyResult = await text(buildApiKeyPrompt(existingKey, apiKeyEnv));
</file context>

const existingKey = existingConfigKey || process.env[apiKeyEnv] || '';
const keyResult = await text(buildApiKeyPrompt(existingKey, apiKeyEnv));
if (isCancel(keyResult)) {
outro('Setup cancelled.');
Expand All @@ -132,8 +133,8 @@ export async function initCommand(options: { installHook?: boolean } = {}): Prom

if (keyResult) {
apiKey = keyResult;
} else if (existingKey) {
apiKey = existingKey;
} else if (existingConfigKey) {
apiKey = existingConfigKey;
} else {
apiKey = '';
}
Expand Down