[Security] `init` echoes API keys in the terminal while they are entered

[404-Page-Found]

Description

The API-key setup prompt is implemented with the normal text() prompt rather than masked/password input. The prompt therefore echoes the secret as it is typed into the terminal.

The warning text says the key will be stored in config, but it does not warn that the interactive input itself is visible on screen.

Location

• src/commands/init.ts:148-157 — promptApiKey()
• src/commands/init.ts:126-133 — buildApiKeyPrompt()

Relevant code

const existingKey = existingConfig?.apiKey ?? process.env[provider.apiKeyEnv] ?? '';
const keyResult = await text(buildApiKeyPrompt(existingKey, provider.apiKeyEnv));

buildApiKeyPrompt() only supplies the message and placeholder; the returned options do not configure masked input.

Steps to Reproduce

1. Run commit-echo init.
2. Select a provider that requires an API key.
3. Type an API key into the prompt.
4. Observe that the entered characters are rendered in the terminal like ordinary text input.

Expected Behavior

Secret input should be masked while typing, consistent with password/credential prompts.

Actual Behavior

The API key is echoed to the terminal as it is entered, exposing it to anyone viewing or recording the terminal session.

Suggested Fix

Use the prompt library's password/masked input mode for API keys. Keep the non-secret placeholder and existing-key messaging, but never display the credential characters themselves.

Impact

Users can disclose provider credentials to people looking at the terminal or to terminal/session recordings.

Reviewed against current main at 6c01ad0a853501e9617a3af0a5db3b515dd8ed53.

[404-Page-Found]

Assigned to @mikemikimike. Suggested implementation: switch the API-key prompt to masked/password input while preserving the existing placeholder/env-var messaging, and add regression coverage confirming entered credentials are not echoed.

[404-Page-Found]

Triage update

Confirmed this issue is valid and still reproducible on current main.

• Root cause: src/commands/init.ts uses Clack's text() prompt for API-key entry, so credential characters are echoed to the terminal.
• Current behavior: buildApiKeyPrompt() only controls the message/placeholder; it does not enable masked input.
• Scope: This affects the interactive commit-echo init flow for providers that require an API key.
• Recent changes: PR fix: scope API keys to configured provider #321's provider-scoping/API-key changes and the v0.3.0 release did not address input masking; the current code still calls text().
• Existing coverage: tests/init-api-key-prompt.test.mjs verifies that existing keys are not prefilled, but does not verify that newly entered credentials are hidden from terminal output.

Recommended fix: switch API-key entry to Clack's password() prompt while preserving the existing placeholder/env-var messaging.

Regression coverage: add an interactive/PTY test that enters a sentinel credential and asserts the credential is absent from captured terminal output.

The issue remains open pending that fix.