The active secret row was overriding a newly seeded chat key, so conversations kept sending the old key and the provider returned 401.
Test plan
go test ./internal/settings/ ./internal/runtime/ -count=1 (SELF)
CI on this HEAD
Why: settings plaintext loses to secret_keys.
Evidence: local settings and runtime tests, exit 0.
Impact: system settings writes adopt a changed secret; conflicting plaintext is kept and logged; 401 names the key layer and an 8-hex fingerprint.
Refs: fix/model-key-secret-overlay
## Summary
The active secret row was overriding a newly seeded chat key, so conversations kept sending the old key and the provider returned 401.
## Test plan
- [x] go test ./internal/settings/ ./internal/runtime/ -count=1 (SELF)
- [ ] CI on this HEAD
Why: settings plaintext loses to secret_keys.
Evidence: local settings and runtime tests, exit 0.
Impact: system settings writes adopt a changed secret; conflicting plaintext is kept and logged; 401 names the key layer and an 8-hex fingerprint.
Refs: fix/model-key-secret-overlay
Why: The active secret_keys row overrides settings plaintext, so a replaced chat key kept returning 401. Migration also mutated the settings map in place, so clearing a matching plaintext never reached the database.
Evidence: go test ./internal/settings/ ./internal/runtime/ -count=1 (SELF, worktree).
Impact: System settings writes adopt a changed secret; conflicting plaintext is kept and logged; 401 errors name the key layer and an 8-hex fingerprint.
Refs: fix/model-key-secret-overlay
Co-authored-by: Cursor <cursoragent@cursor.com>
weichen
merged commit 11c337d3df into main2026-10-15 11:29:34 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
The active secret row was overriding a newly seeded chat key, so conversations kept sending the old key and the provider returned 401.
Test plan
Why: settings plaintext loses to secret_keys.
Evidence: local settings and runtime tests, exit 0.
Impact: system settings writes adopt a changed secret; conflicting plaintext is kept and logged; 401 names the key layer and an 8-hex fingerprint.
Refs: fix/model-key-secret-overlay