formatApiKeySnippet reveals the first 6 and last 6 characters of API keys in /new, /status, and model picker messages. In shared channels (Discord, Telegram groups), this exposes 12 characters of the key — enough to narrow brute-force search space or identify the full key for short-key providers.

Reduced to showing only the first 4 characters plus a fixed **** mask. Users can still identify which key is active without credential exposure risk.

Before: sk-abc1…xyz789 (12 chars exposed)
After: sk-a**** (4 chars exposed)

Added unit tests for the masking behavior.

Fixes #24384

Greptile Summary

Reduced API key exposure in status and session messages from 12 characters (first 6 + last 6) to 4 characters (first 4 only), eliminating trailing character disclosure. The fix properly addresses the security risk in shared channels like Discord and Telegram by changing the masking pattern from sk-abc1…xyz789 to sk-a****.

The implementation:

• Modified formatApiKeySnippet in src/agents/model-auth-label.ts to show only the first 4 characters followed by ****
• Added comprehensive test coverage verifying the masking behavior never leaks trailing characters
• Maintained user ability to identify which key is active while preventing credential exposure

Note: There is a separate utility maskApiKey in src/utils/mask-api-key.ts that still uses the vulnerable pattern (showing 8 chars prefix + 8 chars suffix). This utility is used in /models list and auth directive handling. Consider applying the same fix to that utility in a follow-up to ensure consistent security across all API key display contexts.

Confidence Score: 5/5

• This PR is safe to merge with minimal risk.
• The security fix is well-implemented with proper test coverage. The change is focused and addresses the vulnerability described in the PR description. The masking logic is simple and correct, reducing exposure from 12 to 4 characters while maintaining usability.
• No files require special attention.

_{Last reviewed commit: 026b235}