From 4a7f23f1764976e7fda15e154e12c74693ccd602 Mon Sep 17 00:00:00 2001 From: tegwick Date: Thu, 8 Oct 2026 23:52:43 +0200 Subject: [PATCH] bao-session.sh login: never print the operator token bao login printed the full platform-admin token to stdout, which put it in an agent transcript on 2026-10-08. Use -no-print so it reaches only the token helper. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 327203@bnt-lap001 Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0 --- scripts/bao-session.sh | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/scripts/bao-session.sh b/scripts/bao-session.sh index 402c2cc..2ac4e98 100755 --- a/scripts/bao-session.sh +++ b/scripts/bao-session.sh @@ -73,7 +73,9 @@ cmd_login() { echo "Opening OIDC login. Under WSL2 no browser will launch —" echo "copy the URL below into your Windows browser, then come back here." echo - bao login -method=oidc -path="$OIDC_PATH" + # -no-print: the token goes only to the token helper, never to the + # terminal (it once landed in an agent transcript, 2026-10-08). + bao login -no-print -method=oidc -path="$OIDC_PATH" echo cmd_status }