[sdivyanshu90]

Why

The unknown first-run setup recovery path printed the same one-time gateway key in both the
environment export and a later preservation sentence. Repeating a raw credential unnecessarily
increases its exposure in terminal scrollback and captured transcripts.

Closes #931

What

• Keep _emit_setup_credentials as the only raw-key presenter.
• Make the recovery sentence refer to the one-time key printed above without repeating its value.
• Strengthen the existing unknown-outcome regression to assert that the exact secret occurs once.

Validation

• uv run --no-sync pytest -q exp/cli/gateway/serve_test.py -k 'not unbindable_port': passed,
  10 tests and 1 deselected
• uv run --no-sync ruff check .: passed
• uv run --no-sync ruff format --check .: passed, 844 files already formatted
• uv run --no-sync ty check: passed

The deselected existing test opens an IPv4 listener, which this restricted workspace prohibits
with PermissionError: [Errno 1] Operation not permitted. It does not exercise setup credential
presentation.

Non-goals

This change does not alter key generation, storage, replacement, activation recovery, or the
successful first-run output path.

[sdivyanshu90]

Hi @SilenNaihin, could you please review this focused one-time credential-output fix whenever you have some time?

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge because the recovery path still presents the one-time key before referring users to it, while avoiding duplicate exposure.

Summary

• Replaces the second raw-key presentation with a reference to the key printed above.
• Strengthens the regression test to require the secret to occur exactly once in the transcript.

_{Reviews (1) · Last reviewed commit: "gateway: print unknown setup key once"}

[sdivyanshu90]

@kfallah Could you please review this PR whenever you have some time? Thanks

[sdivyanshu90]

Hi @SilenNaihin @kfallah, could you please review this PR whenever you have some time. Thanks!