Evidence record / pi-coding-agent
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the signals and issues that cite it, below.
2026-08-10-pi-coding-agent-pi-auth-check-adds-a-third-command-that-prints-a-live-provider
pi auth check adds a third command that prints a live provider credential to stdout.
v0.84.1 adds pi auth check --provider <p> [--model <m>] [--json] [--credentials] [--no-refresh], a credential preflight (issue #7152). The help text in auth-command.ts at v0.84.2 states: "Checks refresh expired OAuth credentials by default; --no-refresh prevents this. --credentials emits the credential, or includes it in JSON output." This joins the two commands added on 2026-07-27 (commit 99e34013, "feat: auth print (#7168)", which gh api compare/v0.83.0...99e34013 shows as behind/ancestor of v0.83.0): pi auth print-api-key and pi auth print-bearer-token. The test file test/credential-print.test.ts at v0.84.2 confirms behaviour: resolveCredentialForPrint resolves a stored API key to plaintext, extracts a bearer token out of an Authorization header, and -- for an expired OAuth entry -- calls the provider's refresh and prints the freshly minted token, persisting it back to storage.
Channel: tagged-release. Ancestry: Commit a261366bde90c24826eb77bfc600f1bb62ad36e2 ("feat(coding-agent): add auth preflight", authored 2026-08-06T17:43:52Z). gh api repos/earendil-works/pi/compare/v0.84.1...a261366b returned status=behind, behind_by=13 -- ancestor of the v0.84.1 tag. gh api repos/earendil-works/pi/compare/v0.84.0...a261366b returned status=ahead, ahead_by=17 -- not in v0.84.0. v0.84.1 is stable: prerelease=false, draft=false, published 2026-08-07T06:07:00Z.
Operator consequence: Watch, and treat it as a design decision to plan around. The capability is legitimate -- a preflight that tells you whether credentials will resolve before a long unattended run is genuinely useful, and --no-refresh lets you check without minting. But it also means a third command surface can print a live secret, including one refreshed on demand from an expired OAuth grant. See the carry-forward answer: none of the three is gated from Pi's own shell tool. If you share a host or a container with an agent session, the mitigation is process isolation and short-lived credentials, not a Pi-side flag.
Receipt
Finding metadata
Run: 2026-08-10-weekly-digest-2026-08-03_2026-08-10-frontier-v0
Finding ID: 2026-08-10-pi-coding-agent-pi-auth-check-adds-a-third-command-that-prints-a-live-provider
Accepted signals
Source links
Primary links, including exact changelog lines when available.
Versioned source: run artifact