Opus finding
apiKey is echoed to stdout in human-readable mode with no redaction option
lowsecuritymedium
- src/commands/register-agent.ts:111-118
The persistent Bearer token is printed in plaintext to stdout in human mode. While this is intentional (the user must capture it), it is the kind of secret that commonly ends up in shell history files, terminal scrollback, CI logs, and screenshots. The output banner warns users to save it but offers no `--no-print-secret` / `--key-file <path>` alternative for safer capture, and `--json` is the agent-recommended mode but also writes apiKey to stdout. This is a known design tradeoff but worth flagging because the credential is non-recoverable (each register creates a new identity).
Recommendation
Consider supporting an opt-in `--output-file <path>` that writes credentials with mode 0600, and/or a `--mask-apikey` mode that prints only a prefix in human mode (full value still available via --json). At minimum, document that running in shared terminals/CI logs will persist the apiKey.