Hmbown/CodeWhale · warning · anyhow::Error

`codewhale account` does not accept the global `--api-key` f

Error message

`codewhale account` does not accept the global `--api-key` flag because command-line values can leak through shell history. Use `account keys set <provider>` for a hidden prompt, `--api-key-stdin`, or `--from-local`

What it means

reject_inline_api_key guards every `codewhale account ...` subcommands: passing the global --api-key flag is rejected because command-line arguments can persist in shell history and process listings, leaking the credential. The message points to the safe alternatives (hidden prompt, stdin, or --from-local import).

Source

Thrown at crates/cli/src/cloud.rs:552

fn cloud_session_secrets() -> Result<Secrets> {
    match secure_account_session_secrets() {
        Ok(secrets) => {
            if secrets.backend_name().starts_with("file-based") {
                eprintln!(
                    "warning: OS credential manager unavailable; {CLOUD_ALLOW_FILE_SESSION_STORE_ENV}=1 explicitly enables the local 0600 Codewhale secrets file for cloud session tokens"
                );
            }
            Ok(secrets)
        }
        Err(_) => bail!(
            "Codewhale account login requires an OS credential manager for session tokens. Configure Keychain, Credential Manager, or Secret Service and try again. Headless users may explicitly opt into the local 0600 secrets file with {CLOUD_ALLOW_FILE_SESSION_STORE_ENV}=1"
        ),
    }
}

pub(crate) fn reject_inline_api_key(api_key: Option<&str>) -> Result<()> {
    if api_key.is_some() {
        bail!(
            "`codewhale account` does not accept the global `--api-key` flag because command-line values can leak through shell history. Use `account keys set <provider>` for a hidden prompt, `--api-key-stdin`, or `--from-local`"
        );
    }
    Ok(())
}

#[allow(clippy::too_many_arguments)]
fn run_with<T: CloudTransport, W: Write>(
    command: CloudCommand,
    profile: &str,
    api_base: &str,
    config: &ConfigStore,
    cloud_secrets: &Secrets,
    provider_secrets: &Secrets,
    transport: &T,
    out: &mut W,
    key_reader: &mut dyn FnMut(KeyReadMode) -> Result<String>,
    opener: &mut dyn FnMut(String) -> bool,

View on GitHub (pinned to 0c42157ee5)

Solutions

Use the hidden prompt: `codewhale account keys set <provider>` and type/paste the key with echo off.
Pipe the key: `printf '%s' "$KEY" | codewhale account keys set <provider> --api-key-stdin`.
Import an existing local provider key with `--from-local`.
Never place secrets in argv; move them into env/files consumed via stdin.

Example fix

# before
codewhale --api-key sk-abc123 account keys set anthropic

# after
printf '%s' "$CODEWHALE_KEY" | codewhale account keys set anthropic --api-key-stdin

Defensive patterns

Strategy: validation

Validate before calling

// In wrappers, strip the flag before dispatching account commands
if command.is_account() && global_args.api_key.is_some() {
    global_args.api_key = None;
    eprintln!("api-key ignored for account commands; use --api-key-stdin");
}

Try / catch

match reject_inline_api_key(args.api_key.as_deref()) {
    Ok(()) => run(cmd),
    Err(e) if e.to_string().contains("--api-key") => {
        eprintln!("{}", e); // explain, then prompt for the key via stdin instead
        prompt_key_stdin()
    }
    Err(e) => Err(e),
}

Prevention

Never put secrets in argv; use stdin or hidden prompts.
Audit CI scripts for templated keys in command lines.
Prefer env/secret-store lookups inside the tool over flags.

When it happens

Trigger: Running e.g. `codewhale --api-key sk-... account keys set openai` or `codewhale account --api-key ... me`; any invocation where the global api_key option is Some() while an account subcommand dispatches.

Common situations: Users migrating from tools that accept keys as flags, CI scripts templating keys into command lines, copy-pasted examples that put the key before the subcommand.

Related errors

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/a4419a4a8570aa35. Report an issue: GitHub.