Why: A dotted-key PUT was stored beside the nested object and never read, so replacing a key kept the old pool. GET also returned tools.tavily.apiKeys in clear text, and saving settings would write the mask placeholder back over a real key.
Evidence: go test ./...
Impact: Dotted writes take effect on the next read. Startup expands stored dotted keys, and the existing nested value wins when both forms exist. GET masks schema secrets, including apiKeys. Writing the mask placeholder no longer overwrites a stored secret.
Refs: fix/settings-dotted-keys
Co-authored-by: Cursor <cursoragent@cursor.com>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
合同
PUT /api/settings/user与PUT /api/settings/project/{id}同时接受嵌套对象和点路径键。点路径在写入时展开成嵌套。同一请求或已落库数据里两种形态并存时，嵌套对象胜出。GET /api/settings对 schema 中type=secret或secret=true的路径，以及叶子名apiKey/api_key/apiKeys/secret/token，非空字符串一律返回••••••。写回恰好是这个占位符的叶子视为未修改，不覆盖已存密钥。启动时在注册 Tavily 工具之前把已落库的点路径键展开。有迁移时日志为
settings: normalized N dotted key(s) in M scope(s)。存量值恰好是掩码占位符时只记录路径，不记录值，原值保留。兼容
以前静默失效的点路径写入，升级后会生效。与嵌套对象冲突时，已生效的嵌套值保持不变。不按 schema 校验键名。不改 Core，不改前端。
验收
go test ./...（Backendd90b9c0）Effective能读到；GET 不回密钥明文；写回掩码不覆盖已存密钥非目标
不改 svc.sh 播种时序。不修小队路径 tool.result 恒为 ok。