fresh token, silenced diagnostics on command with secure env var