[benzntech]

Summary

Fixes two critical bugs that prevented the Dashboard CLI Tools feature from writing correct settings to ~/.claude/settings.json (and other CLI tool configs).

Bug #1: keyId stripped by Zod validation

Affected files:

• src/app/api/cli-tools/claude-settings/route.ts
• src/app/api/cli-tools/codex-settings/route.ts
• src/app/api/cli-tools/droid-settings/route.ts
• src/app/api/cli-tools/cline-settings/route.ts
• src/app/api/cli-tools/openclaw-settings/route.ts
• src/app/api/cli-tools/kilo-settings/route.ts

Problem: Zod's safeParse() stripped the keyId field before the backend could read it, so the real API key was never resolved from the database and written to the config file.

Fix: Extract keyId from rawBody before validation runs.

Bug #2: Key matching logic compared full key vs masked key

Affected file:

• src/app/(dashboard)/dashboard/cli-tools/components/ClaudeToolCard.tsx

Problem: Frontend compared full key (sk-31c4ea6a04196891-...) against masked key (sk-31c4****dfa6). They never matched, so the dropdown never showed the correct selected key, and model mappings got scrambled.

Fix: Mask the token from file before comparing against the masked API keys list.

Testing

• Verified API key is correctly written to ~/.claude/settings.json when clicking Apply
• Verified model mappings (Opus, Sonnet, Haiku) are preserved correctly
• Verified chat completions work with routed models through OmniRoute

[gemini-code-assist]

Code Review

This pull request updates several CLI tool settings routes to extract keyId before Zod validation to prevent field stripping, ensuring full API keys can be resolved from the database. It also introduces token masking in the ClaudeToolCard component to match stored tokens against masked API keys and allows for custom model paths in provider connections. Feedback includes a critical issue regarding an undefined helper function toNonEmptyString, a logic error where API key validation occurs before ID resolution, and concerns about the fragility of hardcoded masking logic.

[gemini-code-assist]

The function toNonEmptyString is not defined in this file, nor is it imported from any of the modules listed in the imports section. This will result in a ReferenceError at runtime when this code path is executed. You should either define this helper function or use an inline check to ensure psd.modelsPath is a valid string.

Suggested change

	const modelsPath = toNonEmptyString(psd.modelsPath) || "/models";
	const modelsPath = typeof psd.modelsPath === "string" && psd.modelsPath.trim() ? psd.modelsPath.trim() : "/models";

[gemini-code-assist]

The if (!apiKey) check (lines 177-182) occurs before the keyId resolution logic. If a client provides a keyId but omits the apiKey in the request body (expecting the backend to resolve it from the database), the request will fail with a 400 error at line 177. To fix this, the validation check for apiKey should be moved after the if (keyId) block.

[gemini-code-assist]

This masking logic is hardcoded and assumes the token is at least 12 characters long. It is also fragile as it depends on the exact masking format (first 8 + last 4) used by the /api/keys endpoint. If the backend masking logic changes or if a shorter token is encountered, this comparison will fail to match correctly.