oxy config prints a token in full when setting it issue #113 closed: completed andymccall opened this 20 days ago · 0 comments

oxy config remote.NAME.token VALUE confirms with 'Set remote.NAME.token = VALUE (in this repository)', so the token lands in the terminal, its scrollback and anything it is pasted into (it leaked an agent token into a chat on 2026-10-14). Mask secret values in the confirmation: remote.*.token (and anything else secret) shows as the first few characters and the rest hidden, e.g. oxyhub_6b7d…(64 more). Also accept '-' to read the value from stdin, so it never appears in shell history.