coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

bao-session.sh login: never print the operator token

Browse source 
bao login printed the full platform-admin token to stdout, which put it in
an agent transcript on 2026-10-08. Use -no-print so it reaches only the
token helper.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 327203@bnt-lap001
Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0
This commit is contained in:
tegwick 2026-10-08 23:52:43 +02:00
parent 594b5851b8
commit 4a7f23f176
1 changed files with 3 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
scripts/bao-session.sh
View file

@ -73,7 +73,9 @@ cmd_login() {
echo "Opening OIDC login. Under WSL2 no browser will launch —"
echo "copy the URL below into your Windows browser, then come back here."
echo
bao login -method=oidc -path="$OIDC_PATH"
# -no-print: the token goes only to the token helper, never to the
# terminal (it once landed in an agent transcript, 2026-10-08).
bao login -no-print -method=oidc -path="$OIDC_PATH"
echo
cmd_status
}