From ed776dd78859542dc46f48a55f08d89f50b7b4e0 Mon Sep 17 00:00:00 2001
From: Justin Massa <justinmassa@Justins-Laptop.local>
Date: Mon, 19 Jan 2026 14:05:30 -0600
Subject: [PATCH] fix: prevent auth credential logs from leaking into GChat
 messages

Change log level from info to debug for credential read/write operations
in cli-credentials.ts. These diagnostic messages were appearing as raw
ANSI-colored text prepended to GChat messages because they were going
to stdout at info level.

Affected log messages:
- "read codex credentials from keychain"
- "read anthropic credentials from claude cli keychain"
- "wrote refreshed credentials to claude cli keychain"
- "wrote refreshed credentials to claude cli file"

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 src/agents/cli-credentials.ts | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/agents/cli-credentials.ts b/src/agents/cli-credentials.ts
index 2178d6b0a..86a7323ca 100644
--- a/src/agents/cli-credentials.ts
+++ b/src/agents/cli-credentials.ts
@@ -120,7 +120,7 @@ function readCodexKeychainCredentials(options?: {
       ? lastRefresh + 60 * 60 * 1000
       : Date.now() + 60 * 60 * 1000;
 
-    log.info("read codex credentials from keychain", {
+    log.debug("read codex credentials from keychain", {
       source: "keychain",
       expires: new Date(expires).toISOString(),
     });
@@ -185,7 +185,7 @@ export function readClaudeCliCredentials(options?: {
   if (platform === "darwin" && options?.allowKeychainPrompt !== false) {
     const keychainCreds = readClaudeCliKeychainCredentials();
     if (keychainCreds) {
-      log.info("read anthropic credentials from claude cli keychain", {
+      log.debug("read anthropic credentials from claude cli keychain", {
         type: keychainCreds.type,
       });
       return keychainCreds;
@@ -282,7 +282,7 @@ export function writeClaudeCliKeychainCredentials(
       { encoding: "utf8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"] },
     );
 
-    log.info("wrote refreshed credentials to claude cli keychain", {
+    log.debug("wrote refreshed credentials to claude cli keychain", {
       expires: new Date(newCredentials.expires).toISOString(),
     });
     return true;
@@ -322,7 +322,7 @@ export function writeClaudeCliFileCredentials(
     };
 
     saveJsonFile(credPath, data);
-    log.info("wrote refreshed credentials to claude cli file", {
+    log.debug("wrote refreshed credentials to claude cli file", {
       expires: new Date(newCredentials.expires).toISOString(),
     });
     return true;