AIWG 2026.10.9 - Keep your API keys out of sight

AIWG 2026.10.9 changes how secrets move through the tool. Tokens and keys no longer need to sit in your command lines, config files, logs, or error messages. You store each secret once in a safe place and hand AIWG a reference, and it resolves the value only where it is needed.

Pass tokens without typing them

Commands that fetch protected releases, `aiwg discover`, `show`, `resource-versions`, and `use`, now accept a token five ways: an environment variable, a private file, an entry in your OS keychain or credential store, piped standard input, or a hidden prompt. Nothing prompts unless you ask for it. Without a flag, public and offline lookups work as before, and `aiwg use` keeps the token out of deploy scripts.

aiwg use <item> --resource-token-store aiwg-releases

Run the daemon without plaintext tokens

The background daemon and its chat bots (Telegram, Discord, Slack) and web UI now take references instead of secret bytes. Each recipient has a reference field, such as `botToken_ref` for a chat bot or `token_ref` for web authentication, and each accepts an environment variable name, a `file:` path, or a `store:` entry. Existing `${ENV_NAME}` templates still resolve, and `daemon-init` writes references only.

messaging:
  telegram:
    botToken_ref: "store:aiwg-telegram-bot"

Each recipient receives only its own credentials. Background workers no longer inherit secret names or values, and error messages avoid echoing credentials. If no web token is configured, web authentication stays off, so set one deliberately if you need it. One limitation to know: the webhook secret resolves, but the daemon has no inbound webhook listener yet, so inbound delivery behavior is unchanged.

Connect storage the same way

Storage backends accept the same kinds of references. Logseq, PostgreSQL, and PostgREST each take an environment variable name, a private file, or an OS store entry. A missing default keeps the old behavior, but a missing secret you explicitly selected fails instead of falling back. Database errors and logs no longer expose connection strings, passwords, or authorization values.

connectionStringEnv: "file:/home/you/.private/aiwg-postgres-url"

Share diagnostics safely

`aiwg diagnose` output stays sanitized by default. If you pass `--include-secrets`, it now warns on standard error that the bundle contains real secrets and needs review before sharing.

aiwg diagnose --include-secrets

If you are upgrading

• Literal secrets in daemon config still work but warn once per load and are never migrated. Move them to the recipient's `*_ref` field (or `webhook.secret_env`).
• Token files must be private, owned by you, regular files, and not symlinks. Replace linked or exposed files. On Windows, file input is refused for now; use standard input or the OS store instead.
• UHP profiles reject extra credential fields. Keep only `credential.source: env` and `credential.name`.
• A PostgREST credential source must hold the whole Authorization header value, including any `Bearer ` prefix.

Full technical detail is in the CHANGELOG entry. The reference format for every secret source is documented in the sensitive-values guide.