{"record":{"id":"a4419a4a8570aa35","repo":"Hmbown/CodeWhale","slug":"codewhale-account-does-not-accept-the-global","errorCode":null,"errorMessage":"`codewhale account` does not accept the global `--api-key` flag because command-line values can leak through shell history. Use `account keys set <provider>` for a hidden prompt, `--api-key-stdin`, or `--from-local`","messagePattern":"`codewhale account` does not accept the global `--api-key` flag because command-line values can leak through shell history\\. Use `account keys set <provider>` for a hidden prompt, `--api-key-stdin`, or `--from-local`","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/cli/src/cloud.rs","lineNumber":733,"sourceCode":"    profile: Option<&str>,\n    config: &ConfigStore,\n) -> Result<()> {\n    run(\n        CloudArgs {\n            api_base: None,\n            command: CloudCommand::Login(CloudLoginArgs {\n                no_open,\n                timeout_seconds,\n            }),\n        },\n        profile,\n        config,\n    )\n}\n\npub(crate) fn reject_inline_api_key(api_key: Option<&str>) -> Result<()> {\n    if api_key.is_some() {\n        bail!(\n            \"`codewhale account` does not accept the global `--api-key` flag because command-line values can leak through shell history. Use `account keys set <provider>` for a hidden prompt, `--api-key-stdin`, or `--from-local`\"\n        );\n    }\n    Ok(())\n}\n\n#[allow(clippy::too_many_arguments)]\nfn run_with<T: CloudTransport, W: Write>(\n    command: CloudCommand,\n    profile: &str,\n    api_base: &str,\n    config: &ConfigStore,\n    cloud_secrets: &Secrets,\n    provider_secrets: &Secrets,\n    machine: &machine::MachineKeyEnv,\n    transport: &T,\n    out: &mut W,\n    key_reader: &mut dyn FnMut(KeyReadMode) -> Result<String>,","sourceCodeStart":715,"sourceCodeEnd":751,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/73e0f67d83c59909b571efdfc88c4bc28c309cb1/crates/cli/src/cloud.rs#L715-L751","documentation":"The `codewhale account` command group refuses the global `--api-key` flag entirely. Passing a provider API key on the command line risks leaking it into shell history and process listings, so the CLI rejects any invocation where api_key is Some and points to safer input paths: the hidden prompt, stdin, or local config.","triggerScenarios":"Invoking any `codewhale account` subcommand with the global `--api-key <value>` flag set, e.g. `codewhale --api-key sk-... account pull`.","commonSituations":"Users copying the global flag pattern from other codewhale commands; scripting a key inline; muscle memory from `codewhale --api-key ...` invocations of other subcommands.","solutions":["Remove `--api-key` from the command line.","Run `codewhale account keys set <provider>` to enter the key at a hidden prompt.","Pipe the key via `--api-key-stdin` (e.g. printf %s \"$KEY\" | codewhale account ... --api-key-stdin).","Use `--from-local` to reuse an already-stored local key."],"exampleFix":"// before\ncodewhale --api-key $KEY account keys set anthropic\n// after\nprintf %s \"$KEY\" | codewhale account keys set anthropic --api-key-stdin","handlingStrategy":"validation","validationCode":"// Scrub the global flag before invoking `codewhale account`\nlet args: Vec<String> = std::env::args().collect();\nif args.iter().any(|a| a == \"--api-key\") && args.iter().any(|a| a == \"account\") {\n    eprintln!(\"Pass the key via `account keys set` or --api-key-stdin instead.\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never put provider API keys on the command line — they land in shell history and ps output.","Use `codewhale account keys set <provider>` for the hidden prompt.","Use `--api-key-stdin` in scripts, fed from a secret manager.","Use `--from-local` to reuse stored local keys."],"tags":["cli","security","arguments"],"backgroundTag":"invalid-cli-argument","analyzedSha":"73e0f67d83c59909b571efdfc88c4bc28c309cb1","analyzedAt":"2026-09-22T01:30:00.501Z","contentChangedAt":"2026-09-22T01:30:00.501Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}