Why: dotted setting writes were stored as unread keys, and secret pools were returned in clear text.
Evidence: Backend go test ./... at d90b9c0. Dev make test follows this pin.
Impact: the dev branch tracks Backend fix/settings-dotted-keys until that PR merges, then the pin moves to main.
Refs: fix/settings-dotted-keys
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: the acceptance sync needs the verification result on the task card before review.
Evidence: make test exited 0 after task-sync onto 3836ea88e3.
Impact: documentation only. The backend pin is unchanged.
Refs: fix/settings-dotted-keys
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: the task card is the review record and needs the Dev and Backend PR links.
Evidence: Dev #181 and Backend #61 exist.
Impact: documentation only.
Refs: fix/settings-dotted-keys
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: acceptance of the settings fix is the deploy log and the live key checks, and that evidence belongs on the task card.
Evidence: dev@8b63e2b logged normalized 4 dotted keys in 2 scopes and registered 1 Tavily key. The web_search probe returned ok.
Impact: documentation only. The backend pin is unchanged. Merging stays with the owner.
Refs: fix/settings-dotted-keys
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: the Dev branch must record the Backend main commit that contains the settings fix, not the unmerged feature tip.
Evidence: Backend #61 merged as fd17011.
Impact: modules/backend gitlink moves from d90b9c0 to fd17011. Behavior is the merged fix.
Refs: fix/settings-dotted-keys
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: the task card must show that Backend #61 is on main and the Dev branch was retested after syncing.
Evidence: make test exited 0 at 2026-10-04T13:45:06Z on the pin of fd17011.
Impact: documentation only.
Refs: fix/settings-dotted-keys
Co-authored-by: Cursor <cursoragent@cursor.com>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
fix/settings-dotted-keys 任务卡
任务主记录：Dev #181（Backend #61）；状态：进行中；owner：weichen
基线与授权
5d3a4b3ee3目标与非目标
PUT /api/settings/user|project/{id}的点路径键展开成嵌套并生效；嵌套对象与点路径冲突时嵌套胜出；启动时迁移存量点路径键（在注册 Tavily 之前）；GET /api/settings按 schema 掩码 secret（含apiKeys）；写回••••••不覆盖已存密钥。tool.result恒为 ok。合同、依赖与兼容
type=secret或secret=true的路径，以及叶子名apiKey/api_key/apiKeys/secret/token，非空值返回••••••。写回该占位符视为未修改。有迁移时日志为settings: normalized N dotted key(s) in M scope(s)。掩码占位符存量只记路径。同步记录
5d3a4b3ee35d3a4b3ee33836ea88e3f2516ef1ce结果与验证（完成后填写）
d90b9c0，Backend #61。Dev Dev #181。go test ./...通过。Dev worktreemake test通过（boundaries、pins、libs、core、backend、frontend vitest 77、ui vitest 79、agent-command；exit 0，2026-10-04T13:05:13Z）。dev 部署scripts/svc.sh dev deploy --from dev@8b63e2b成功（pid 1759380）。库已备份runtime/dev/data-backup-20261004T130825Z.db。启动日志normalized 4 dotted key(s) in 2 scope(s)，registered (1 key(s))。库中不再有点路径键，context.maxHistoryMessages=30已是嵌套值。GET 对 Tavily 密钥池返回掩码。点路径写入runtime.entry后 GET 读到嵌套值，已改回 direct。写回掩码占位符后主模型密钥长度仍为 126。web_search 探针 3 次 status=ok。make test、make task-sync，然后合入 Dev #181。合入后在 worktree 内make task-finish，并把 dev 重新部署到 main。