Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[TUI] One unreadable profile file blinds kept_key(): strata launch silently mints a NEW API key

Open Beginner friendly
  • Is something wrong?
#4,396 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 3 days

@Nyarlathoteppppp is already working on this.

Since Oct 29, 2026.

  • #4563 by @Nyarlathoteppppp — open

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
72/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
python
Domain
authentication, cli

Research direction

Start in kept_key() in strata_cli/launch/access.py (around line 342), where the loop reads row["source_config"] and the catch-all at about line 352 returns None. Check how profiles.list_profiles() in strata_cli/profiles.py (around lines 178-179) builds error rows without that key, and compare with the defensive .get("source_config") at updater.py:718. Done means a damaged profile file costs only its own row, so the existing key is still returned when another profile carries api_key.

Written by the indexing model from the issue text.

Description

Problem: kept_key() (strata_cli/launch/access.py:342) indexes row["source_config"] for every launch profile, but profiles.list_profiles() returns {"id", "error"} rows — without that key — for every profile file that fails to load (strata_cli/profiles.py:178-179). The KeyError is swallowed by the catch-all at access.py:352 (except Exception: return None), so the WHOLE key lookup dies, not just the bad row. apply_defaults then does s.api_key = kept or access.new_key() — exactly what the function's own docstring exists to prevent ("the key an earlier launch already made, so a restart does not invalidate the apps set up with it"). Note updater.py:718 reads the same rows defensively with .get("source_config") — this loop does not.

Environment:
Strata Version: 0.2.7 (source checkout at tag v0.2.7, commit 5e8a4cca; the file discussed is byte-identical to the tag)
OS: Linux x86-64
Runtime: Python 3.14
Reported from the Strata-Mnemosyne fork's merged tree; the offending code is upstream's own.

Reproduce (measured at function level): three launch profiles, one damaged (echo 'NOT JSON' > ~/.config/strata/profiles/launch-bad.json), another carrying api_key in its run config: kept_key() returned None; after deleting only the damaged file it returned the stored key. End-to-end: strata launch --preset <existing> --access lan --no-tui would mint a fresh key (not run here: it would download; the branch is measured).

Expected: a damaged or foreign profile costs at most its own row; the existing key is kept.
Actual: the lookup dies, a new key is minted, and every app configured with the old key gets 401 until someone re-runs strata launch --show-key.

Reproduction status: measured at function level; end-to-end untested.

Dominant language
C++
Stars
11.6k
Forks
1k
No merged PRs in 30d

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Niko1221/Strata

All issues in Niko1221/Strata

Similar issues

More C++ issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.