Shannon: Config Precedence Fix
A single fix corrects credential precedence in Shannon's configuration resolver, ensuring gateway-scoped API keys in the TOML config properly override leaked environment variables. The bug caused silent authentication failures against OpenAI-compatible gateways.
Duration: PT2M8S
Episode overview
This episode is a short developer briefing from Shannon.
It explains recent repository work in plain language.
- Show: Shannon
- Published: 2026-08-31T06:05:17Z
- Audio duration: PT2M8S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
This is Shannon, your developer briefing for August 31st, 2026.
Today's activity centers on one fix, but it's a meaningful one: how Shannon resolves API credentials when multiple sources compete for priority.
PR 437, from Knoxpix, closes issue 436 and addresses a subtle but painful bug in the configuration resolver. When a user's config file pairs a curated provider with a custom base URL, the intent is clear: use the gateway-scoped API key defined in that TOML file. But an environment variable for the same provider,…
The core issue here is precedence and trust boundaries in configuration resolution. When explicit, scoped configuration should always beat implicit, ambient environment state, and it wasn't. That's not just an inconvenience, it's a security and reliability concern. Users can end up authenticating with credentials…
This fix touches the resolver and workflow logic, which suggests the correction was made at the point where configuration values get merged and applied, rather than as a one-off patch. That's the right place to fix it, since it protects against the same class of bug reappearing with other providers or settings down…
What's next: if you're running Shannon…
Nearby episodes from Shannon
- xAI Subscription Auth Lands
- Getting the Brand Straight Before 3.0
- SARIF Reporting Now On By Default
- Cleaner Failures, Safer Releases
- Weekly Recap - Command Line Overhaul & Documentation Polish
- Command Line Polish and Doc Cleanup
- The Command-Line Interface Gets a Full Overhaul
- A Security Policy Lands