@2kw/ai 7.4.0-dev.1 → 7.4.0-dev.4

package/README.md

@@ -75,8 +75,8 @@ Explicit API keys always take priority over a stored browser session
 ```
 
 Note: `config get apiKey --json` returns a masked value — stored secrets do
-not round-trip through stdout. Scripts needing the raw key should use
-`AI_2KW_API_KEY` or read the config file (path shown by `config list`).
+not round-trip through stdout by default. Scripts needing the raw key pass
+`--reveal` (`config get apiKey --reveal`) or use `AI_2KW_API_KEY`.
 
 ## Contexts
 

package/dist/commands/config.js

@@ -86,14 +86,15 @@ export function makeConfigCommand() {
         .command("get")
         .description("Get a configuration value")
         .argument("<key>", `Config key (${ALLOWED_KEYS.join(", ")})`)
-        .action((key, _opts, command) => {
+        .option("--reveal", "Print the API key unmasked (for scripts that need the key itself)")
+        .action((key, opts, command) => {
         const validKey = validateKey(key);
         const ctx = getActiveContext();
         const raw = ctx?.[validKey];
         // A stored "" apiKey stays "" (shown as "(not set)"); only a real key is masked.
         const value = raw === undefined
             ? undefined
-            : validKey === "apiKey" && typeof raw === "string"
+            : validKey === "apiKey" && typeof raw === "string" && !opts.reveal
                 ? raw && maskApiKey(raw)
                 : String(raw);
         if (isJsonOutput(command)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@2kw/ai",
-  "version": "7.4.0-dev.1",
+  "version": "7.4.0-dev.4",
   "description": "CLI for 2kw.ai — schema-driven document extraction, an OpenAI-compatible EU LLM gateway, transcription, prompts, datasets, and experiments from your terminal or agentic workflows. Ships as 2kw, backbone, and bb.",
   "keywords": [
     "cli",