feat: add password masking for API auth token input - #21
Conversation
- Add promptForPassword function to hide auth token input with asterisks - Update promptForTokenForProvider to use masked input - Refactor promptForAuthToken to use new password masking utility - Improve security by preventing token exposure during CLI input 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting
| async function promptForPassword(promptText = 'Please enter your API Auth Token: ') { | ||
| const rl = readline.createInterface({ | ||
| input: process.stdin, | ||
| output: process.stdout | ||
| output: null // Hide input | ||
| }); | ||
|
|
||
| return new Promise((resolve) => { | ||
| rl.question('Please enter your API Auth Token: ', (authToken) => { | ||
| rl.close(); | ||
| resolve(authToken.trim()); | ||
| let password = ''; | ||
| let asterisks = ''; | ||
|
|
||
| // Write the prompt | ||
| process.stdout.write(promptText); | ||
|
|
||
| // Handle keypress events for password masking | ||
| process.stdin.on('keypress', (char, key) => { | ||
| if (key && key.name === 'return') { | ||
| // Enter key pressed |
There was a problem hiding this comment.
The new promptForPassword adds a process.stdin.on('keypress') handler but never enables keypress events on the stream. Because the readline interface is constructed with output: null, it is not in terminal mode and readline.emitKeypressEvents(process.stdin) is never invoked, so no keypress events fire and the promise is never resolved when the user hits Enter. As a result, any code path that requests an auth token (e.g., creating a provider profile) will hang indefinitely waiting for input.
Useful? React with 👍 / 👎.
1 participant
Summary
Changes
promptForPasswordutility function with masking and key handlingpromptForTokenForProviderto use masked inputpromptForAuthTokento use new password masking utilityTest plan
🤖 Generated with Claude Code