TL;DR — A launcher can hand Codeep its prompt in a file with --prompt-file, so it stays out of the process list. The Omarchy bar widget's Ask field does that from plugin 1.1.0.
Added
codeep --prompt-file <path>(also--prompt-file=<path>) starts a new
session with the file's text as its first message, exactly as codeep -- <prompt> would: a leading / is text, a prompt that says review stays a prompt, and --yolo means what it did. It exists for launchers. A word on the command line is public: any local user can read /proc/<pid>/cmdline on a system whose /proc is not mounted with hidepid, so codeep -- "<prompt>" shows the prompt in the process list for as long as Codeep runs. The Omarchy bar widget's Ask field did exactly that (reported against its first release, omacom/omarchy-plugin-marketplace #11499); from plugin 1.1.0 it writes the prompt to a private file and passes only the path. An environment variable would be private too, but does not arrive through a terminal that runs as a single instance (ghostty, kitty, foot's server), which starts the child from its own environment. - It is strict about what it reads. The path must be absolute (no ~, no relative path). The file must be a regular file and not a symbolic link (opened without following one, and looked at again through the open descriptor), owned by you, and not writable by its group or by others, and at most 256 KiB of UTF-8 text. A BOM is dropped and the text trimmed; an empty file is an error. Anything else ends the launch with one line saying why and exit code 1, before any session starts. No message holds the prompt or the path. - It removes the file after reading it, but only a launcher's own temp file: a name of codeep-prompt- and at least six letters or digits (what mktemp codeep-prompt-XXXXXXXXXX makes). Any other file is read and left alone, and so is one that was refused. A failed removal is not an error. - One prompt. -p/--prompt, -- and --prompt-file are three ways to give it; more than one is the existing "Give the prompt once" error, whose message now names all three. A missing, -- or empty path is a missing-value error, as -p's is. - An older Codeep ignores it (an unknown flag and a stray word), and starts without the prompt. A launcher asks codeep --version first; the plugin does. - What it does not cover. It keeps the prompt out of the process list, nothing more. The conversation is saved as a session as it always was (the whole prompt, in .codeep/sessions of the project or ~/.codeep/sessions), the audit log keeps the first 400 characters of it (.codeep/audit/<day>.jsonl, on by default), and the live status file and the notification name the run by its first five plain words.