Desktop app: provider API keys do not persist — authStorage not wired into createServer

[Automata-intelligentsia]

Summary

In the desktop (Electron) app, AI provider API keys entered in the dashboard do not persist. After closing the session / restarting the app, the providers are erased (no keys). The same symptom occurs when keys are set via the CLI-served web app and the desktop app is then launched — providers added in one surface vanish in the other.

Root cause

The desktop runtime does not wire authStorage into the dashboard server.

• packages/desktop/src/local-runtime.ts (createDashboardServerDefault, ~L68) and packages/desktop/src/local-server.ts (~L77) call createServer(store, { engine, engineManager, centralCore, onProjectFirstAccessed }) with no authStorage. There are zero references to authStorage/AuthStorage/createFusionAuthStorage anywhere in packages/desktop/src.
• createServer() derives several defaults from the engine (onMerge, automationStore, missionAutopilot, missionExecutionLoop, heartbeatMonitor) but not authStorage.
• The CLI dashboard command, by contrast, constructs createFusionAuthStorage() (packages/engine/src/auth-storage.ts:310, which persists to ~/.fusion/agent/auth.json), wraps it with model-registry + API-key providers, and passes authStorage into createServer (packages/cli/src/commands/dashboard.ts:1485, 1631, 1907, 2204).

Downstream, the /auth/api-key route calls getAuthStorage() which throws Authentication is not configured when authStorage is absent (packages/dashboard/src/routes/register-auth-routes.ts:32). As a result, API keys entered via the desktop UI either fail outright or are never persisted, so they vanish on restart. Because the CLI-served app persists to ~/.fusion/agent/auth.json while the desktop can't read/write it, switching surfaces makes providers appear "erased."

This is strongly connected to the broader "providers silently disappear" behavior, and is the same class of desktop-wiring gap as #1937 (plugin subsystem).

Steps to reproduce

1. Launch the desktop app (Fusion 0.56.1, Windows).
2. Go to Authentication/Providers, enter an API key for a provider (e.g. Anthropic / OpenAI), and save.
3. Close the app and reopen, OR set keys via fn dashboard (CLI) and then launch the desktop.
4. Observe: the providers/keys are gone.

Expected

The desktop runtime constructs and passes authStorage (mirroring cli/src/commands/dashboard.ts) so provider keys persist to ~/.fusion/agent/auth.json and are shared consistently between the desktop and CLI/web surfaces.

Suggested fix

In local-runtime.ts / local-server.ts, construct createFusionAuthStorage(), wrap it with the model-registry + API-key-provider layer (as in dashboard.ts:1485-1488), and pass it into createServer(store, { …, authStorage }). Additionally, consider having createServer derive/default authStorage from the engine (as it does for other subsystems) so this gap is harder to reintroduce.

Related

• Desktop app: plugin install & Browse registry broken — pluginStore/pluginLoader not wired into createServer #1937 (desktop omits pluginStore/pluginLoader) — same class of desktop-wiring gap.
• Onboarding "Sign in with GitHub" (gh auth) button throws "model not found" error #1933 (onboarding gh-auth "model not found").
• The open "providers silently disappear" investigation (multiple default providers vanish over time).

Environment

• OS: Windows
• Fusion version: 0.56.1
• Install type: desktop (Electron)

[gsxdsm]

Fusion task: FN-7747

🚧 In progress — work has started on “Desktop app: provider API keys do not persist — authStorage not wired into createServer”.

[gsxdsm]

Fusion task: FN-7747

✅ Done — “Desktop app: provider API keys do not persist — authStorage not wired into createServer” is complete.
Commit: 53d1fa8 FN-7747: derive dashboard authStorage fallback from engine.getAuthStorage
Branch: fusion/fn-7747
Files: 4 changed (+178 / -1)
Merged: 2026-07-09T20:43:49.259Z