Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

[bug] request Authorization header uses root-level api_key instead of active profile key; config show disagrees with the wire; config edits have no effect

Aperta
  • Qualcosa non va?
#264 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
1-2 giorni
Idoneità per principianti
48/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
typescript
Ambito
authentication, cli

Direzione di ricerca

Start by tracing how the CLI selects credentials for requests and how bl config show resolves the active profile; the report does not name source files or tests. Reproduce with a profile base_url and api_key, then compare the verbose Authorization mask against the active profile key. Done when requests use the active profile's key and the config view matches the key sent.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

bug
CLI version

2.3.1

Skill version (optional)

2.3.1

Node version

n/a (standalone binary install channel, no Node on machine)

OS

Windows 10 10.0.19045 x86_64 (MINGW64/Git Bash)

Region

cn

Command to reproduce
bl video task get --task-id 00000000-0000-0000-0000-000000000000 --verbose
Expected behavior

The Authorization header should match the active profile's api_key — the same key bl config show reports as active — so the request authenticates against the profile's base_url.

Actual behavior
  • The > Auth: mask printed by --verbose matches the ROOT-level api_key [REDACTED root-level key], while the request URL is the PROFILE's base_url (token-plan regional endpoint) → HTTP 401 InvalidApiKey (request_id: 04ad1d6d-68ff-4a1e-ab6b-562fb8956883, a79cdf7b-a2d0-40ed-9e51-59a2daa02c6e).
  • bl config show reports the PROFILE key [REDACTED profile key] as active — the CLI's own config view contradicts what is sent on the wire.
  • Removing the root-level api_key from config.json does NOT change the key sent on the wire (same root-key mask on the next request) → suggests a credential store outside config.json silently takes precedence.
  • Explicit --config <profile> does not change the sent key either.
  • Control experiments: root key + root base_url → HTTP 200; profile endpoint + explicitly passed valid profile key → HTTP 200. Only the mixed pairing (root key + profile endpoint) fails — which is what the CLI produces by itself.
  • Reproduced on both 1.27.0 and 2.3.1 (on 2.3.1 the wrong Auth header is visible in --verbose before the unrelated HTTP crash of #263).
Full output
> GET https://token-plan.cn-beijing.maas.aliyuncs.com/api/v1/tasks/00000000-0000-0000-0000-000000000000
> Auth: [REDACTED root-level key]
> x-dashscope-source-config: {"channel":"bailian-cli","tags":{"t1":"public","t2":"bl","t3":"1.27.0"}}
< 401 Unauthorized
request_id: 04ad1d6d-68ff-4a1e-ab6b-562fb8956883

Error:       Invalid API-key provided.
Status:      HTTP 401 (InvalidApiKey)
Exit code:   1
JSON error (optional)
Already tried
  • bl update and skill version aligned with CLI
  • bl auth status OK for this command
  • Different network / region — still reproduces
How often does this happen?

Always

How was bl invoked?

Agent (Cursor, Claude, etc.)

Notes (optional)
  • Related: #171 (closed) covered 401s for the upload-policy endpoint under token-plan profiles; this report is about the broader credential precedence/mixing affecting every request.
  • Security/UX concern: a key the user can no longer see or edit in config.json keeps being used; there is no documented way to inspect or clear that external credential store via bl.
  • Attribution: automatically drafted and submitted by the agentic assistant (model: qwen3.8-max) of Qoder CN Desktop v0.4.3 (build 0.4.3.0) on behalf of the account owner, who reviewed and approved the content before submission.
Lingua principale
TypeScript
Stelle
475
Fork
34
Merge medio
19h 34m
PR unite (30g)
34

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di modelstudioai/cli

Tutte le issue di modelstudioai/cli

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.