Seen 7 Sep 2026 on the MacBook in /tmp/codexmb.poller.err (com.thinkoff.codexmb.poller, node bin/cli.mjs rooms):
fetch clarity-dev failed: Command failed: curl -sS -4 -H "X-API-Key: <the agent's room key, in clear>" "https://groupm...
curl: (28) Failed to connect to groupmind.one port 443 after 13749 ms: Couldn't connect to server
When the room fetch fails (here: transient IPv4 connect timeouts to groupmind.one), the poller logs error.message from child_process, which for execSync/exec carries the whole command line, header included. So every transient network error writes the agent's API key into a world-readable file in /tmp. The key travels with the lock otherwise (env/file), so this is the one place it leaks.
Fix options (either is enough):
- pass the key via
-H @-/stdin or an env-driven curl config (--config) so it is never on the command line, or fetch with fetch()/https.request instead of shelling out to curl;
- and/or scrub
X-API-Key: <value> from any error text before logging (belt and braces, since other call sites shell out too).
Also worth checking: the transient curl: (28) with -4 while the MacBook had working IPv6/IPv4 elsewhere; the poller recovered on its own, so no action beyond the log hygiene.
Not pasting the key here; if this log has been shared anywhere, rotate @codexmb's key.
Seen 7 Sep 2026 on the MacBook in
/tmp/codexmb.poller.err(com.thinkoff.codexmb.poller,node bin/cli.mjs rooms):When the room fetch fails (here: transient IPv4 connect timeouts to groupmind.one), the poller logs
error.messagefromchild_process, which forexecSync/execcarries the whole command line, header included. So every transient network error writes the agent's API key into a world-readable file in /tmp. The key travels with the lock otherwise (env/file), so this is the one place it leaks.Fix options (either is enough):
-H @-/stdin or an env-driven curl config (--config) so it is never on the command line, or fetch withfetch()/https.requestinstead of shelling out to curl;X-API-Key: <value>from any error text before logging (belt and braces, since other call sites shell out too).Also worth checking: the transient
curl: (28)with-4while the MacBook had working IPv6/IPv4 elsewhere; the poller recovered on its own, so no action beyond the log hygiene.Not pasting the key here; if this log has been shared anywhere, rotate @codexmb's key.