[bug] request Authorization header uses root-level api_key instead of active profile key; config show disagrees with the wire; config edits have no effect
維護者通常 1 天內回覆
還沒有人認領這個 Issue。
評估
- 難度
- 4/5
- 預估耗時
- 1-2 天
- 新手友好度
- 48/100
- Issue 類型
- 缺陷
- 描述清晰度
- 基本清楚
- 活躍度
- 活躍
- 技術堆疊
- typescript
- 領域
- authentication, cli
研究方向
Start by tracing how the CLI selects credentials for requests and how bl config show resolves the active profile; the report does not name source files or tests. Reproduce with a profile base_url and api_key, then compare the verbose Authorization mask against the active profile key. Done when requests use the active profile's key and the config view matches the key sent.
由索引模型根據 Issue 內容生成。
描述
CLI version
2.3.1
Skill version (optional)
2.3.1
Node version
n/a (standalone binary install channel, no Node on machine)
OS
Windows 10 10.0.19045 x86_64 (MINGW64/Git Bash)
Region
cn
Command to reproduce
bl video task get --task-id 00000000-0000-0000-0000-000000000000 --verbose
Expected behavior
The Authorization header should match the active profile's api_key — the same key bl config show reports as active — so the request authenticates against the profile's base_url.
Actual behavior
- The
> Auth:mask printed by--verbosematches the ROOT-level api_key [REDACTED root-level key], while the request URL is the PROFILE's base_url (token-plan regional endpoint) → HTTP 401 InvalidApiKey (request_id: 04ad1d6d-68ff-4a1e-ab6b-562fb8956883, a79cdf7b-a2d0-40ed-9e51-59a2daa02c6e). bl config showreports the PROFILE key [REDACTED profile key] as active — the CLI's own config view contradicts what is sent on the wire.- Removing the root-level
api_keyfromconfig.jsondoes NOT change the key sent on the wire (same root-key mask on the next request) → suggests a credential store outsideconfig.jsonsilently takes precedence. - Explicit
--config <profile>does not change the sent key either. - Control experiments: root key + root base_url → HTTP 200; profile endpoint + explicitly passed valid profile key → HTTP 200. Only the mixed pairing (root key + profile endpoint) fails — which is what the CLI produces by itself.
- Reproduced on both 1.27.0 and 2.3.1 (on 2.3.1 the wrong Auth header is visible in --verbose before the unrelated HTTP crash of #263).
Full output
> GET https://token-plan.cn-beijing.maas.aliyuncs.com/api/v1/tasks/00000000-0000-0000-0000-000000000000
> Auth: [REDACTED root-level key]
> x-dashscope-source-config: {"channel":"bailian-cli","tags":{"t1":"public","t2":"bl","t3":"1.27.0"}}
< 401 Unauthorized
request_id: 04ad1d6d-68ff-4a1e-ab6b-562fb8956883
Error: Invalid API-key provided.
Status: HTTP 401 (InvalidApiKey)
Exit code: 1
JSON error (optional)
Already tried
- bl update and skill version aligned with CLI
- bl auth status OK for this command
- Different network / region — still reproduces
How often does this happen?
Always
How was bl invoked?
Agent (Cursor, Claude, etc.)
Notes (optional)
- Related: #171 (closed) covered 401s for the upload-policy endpoint under token-plan profiles; this report is about the broader credential precedence/mixing affecting every request.
- Security/UX concern: a key the user can no longer see or edit in
config.jsonkeeps being used; there is no documented way to inspect or clear that external credential store viabl. - Attribution: automatically drafted and submitted by the agentic assistant (model: qwen3.8-max) of Qoder CN Desktop v0.4.3 (build 0.4.3.0) on behalf of the account owner, who reviewed and approved the content before submission.
- 主要語言
- TypeScript
- 星號
- 475
- 分支
- 34
- 平均合併
- 19 小時 34 分鐘
- 30 天內合併 PR
- 34
環境準備
- 沒有 Dockerfile 或 Docker Compose 檔案
- 沒有 Pull Request 範本
- 閱讀貢獻指南
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
modelstudioai/cli 的其他 Issue
-
[bug] Local media upload is pinned to China endpoint; Singapore workspace API key fails getPolicy (401 InvalidApiKey)可能已有人在做 @Uddoo 於 2 天前認領。 未關閉
難度 4/5 3-5 天 新手友好度 54/100
modelstudioai/cli#267 · 1 則留言 ·
維護者通常 1 天內回覆
-
難度 3/5 1-2 天 新手友好度 57/100
modelstudioai/cli#239 · 1 則留言 ·
維護者通常 1 天內回覆
-
難度 5/5 一週以上 新手友好度 35/100
modelstudioai/cli#202 · 2 則留言 · 1 個 reaction ·
維護者通常 1 天內回覆
-
難度 4/5 3-5 天 新手友好度 55/100
modelstudioai/cli#195 · 1 則留言 ·
維護者通常 1 天內回覆
-
難度 4/5 3-5 天 新手友好度 48/100
modelstudioai/cli#190 · 1 則留言 ·
維護者通常 1 天內回覆
查看 modelstudioai/cli 的全部 Issue
相似的 Issue
-
難度 2/5 1-3 小時 新手友好度 83/100
維護者通常 1 天內回覆
-
難度 1/5 1-3 小時 新手友好度 72/100
zts212653/clowder-ai#1678 ·
維護者通常 1 天內回覆
-
good first issue
難度 2/5 1-3 小時 新手友好度 64/100
Progressive-Victory/the-website#680 ·
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 82/100
維護者通常 1 天內回覆
-
bug
難度 2/5 1-3 小時 新手友好度 68/100