Claude 3e4f1f0ebf fix(security): stop leaking credentials and tighten on-disk permissions ...

- config set: mask api_key/access_token/access_key_id/access_key_secret in the
  confirmation echo. It previously printed the stored secret verbatim to stdout
  (CI logs, pipes, screen shares), unlike `config show` / `auth status` which
  already maskToken().
- http / knowledge retrieve: use maskToken() in --verbose request logs instead
  of printing the first 8 chars of the bearer token / AccessKey id.
- telemetry: write telemetry.jsonl with mode 0600 (was created world-readable
  by default), matching the other credential-area writers.
- ensureConfigDir: chmod 0700 after mkdir, so a pre-existing ~/.bailian created
  by an older build/another tool (where mkdir's mode is ignored) holding
  cleartext credentials gets locked down too. Best-effort; never fatal.

https://claude.ai/code/session_017ZGQCjwNQF5Pz96gLUnnG1

2026-05-29 12:34:19 +00:00

..

cli

fix(security): stop leaking credentials and tighten on-disk permissions

2026-05-29 12:34:19 +00:00

core

fix(security): stop leaking credentials and tighten on-disk permissions

2026-05-29 12:34:19 +00:00