[Bug]: Re-authenticating in Windows Desktop appears to remove existing API keys

未关闭
  • 哪里不对？
#154 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

评估

难度
4/5
预计耗时
3-5 天
新手友好度
42/100
Issue 类型
缺陷
描述清晰度
基本清楚
活跃度
活跃
技术栈
shell
领域
authentication, backend-api-design

调研方向

Start by tracing the Desktop re-authentication flow and the server-side API key management endpoint mentioned in the report. Compare the key set before and after sign-in, and check whether keys were deleted, revoked, or only hidden in Studio. Done means identifying the cause and confirming that re-authentication preserves unrelated keys or documenting the intended behavior.

由索引模型根据 Issue 内容生成。

描述

bug
GUI version

0.1.60

Operating system

Windows

Reproduction steps

Summary

I use Command Code Desktop on Windows with the built-in BYOK provider feature supported by Desktop.

Before the most recent sign-in, the API Keys page in Command Code Studio showed multiple existing API keys. These included keys I had created manually, as well as keys associated with previous Desktop sign-ins.

I did not manually delete or revoke any of these keys.

Recently, Command Code Desktop unexpectedly prompted me to sign in again. After completing the sign-in flow, I checked the API Keys page in Studio and found that all previously listed keys were gone. Only one key remained: the key created during the latest Desktop sign-in.

I regularly use Command Code across multiple devices, so I need existing API keys to remain available unless I explicitly revoke them.

This makes me concerned that the Desktop sign-in or re-authentication flow may be unintentionally deleting, revoking, or resetting existing API keys.

Expected behavior

Signing in or re-authenticating in Desktop should not silently delete existing API keys.

Manually created API keys and keys used by other devices should remain available unless explicitly revoked by the user.

If the sign-in flow is intended to create or rotate a key, it should not unexpectedly remove unrelated existing keys.

Any operation that deletes or revokes existing keys should require explicit user confirmation and be clearly documented.

Actual behavior

Desktop unexpectedly requested that I sign in again.

I completed the sign-in process.

I opened the API Keys page in Command Code Studio.

All previously existing API keys were no longer listed.

Only one API key remained, apparently the one created during the latest Desktop sign-in.

I did not intentionally delete or revoke any keys.

Screenshots, recordings, or sanitized logs

Steps to Reproduce

Sign in to Command Code Desktop on Windows.

Use the built-in BYOK provider feature supported by Desktop.

Have multiple API keys present in the API Keys page in Command Code Studio, including manually created keys.

At a later time, when Desktop prompts you to sign in again, complete the sign-in flow.

Reopen or refresh the API Keys page in Studio.

Check whether the previously existing API keys are still listed.

I observed this behavior after a new sign-in. I have not yet established whether the issue is consistently reproducible.

Environment

Application: Command Code Desktop

Version: 0.1.60

Operating System: Windows

Feature in use: Built-in BYOK provider support

Usage pattern: Multiple devices using the same Command Code account

Trigger observed: Desktop prompted me to sign in again

Questions for the Maintainers

Can the Desktop sign-in or re-authentication flow create, delete, revoke, or reset API keys associated with the user's Studio account?

Is the disappearance of previously existing API keys an expected behavior or a bug?

Could the sign-in flow be unintentionally replacing the existing API key set with a newly generated key?

Is there an audit log or another way to determine whether the old keys were deleted, revoked, or merely stopped appearing in the UI?

Please investigate whether the Desktop authentication flow or the related server-side API key management endpoint can cause this behavior.

Thank you.

Safety check
  • I removed credentials and private project information from this report.
主要语言
Shell
星标
110
派生
9
平均合并
12 分钟
30 天内合并 PR
1

环境准备

这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

CommandCodeAI/desktop 的其他 Issue

查看 CommandCodeAI/desktop 的全部 Issue

相似的 Issue

更多 Shell/Bash Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。