fix(configure): mask gateway secret prompts

vincentkoc · vincentkoc · commit 0f5a9ac38d2f · 2026-06-14T06:55:16.000+08:00
diff --git a/src/commands/configure.gateway.test.ts b/src/commands/configure.gateway.test.ts
@@ -118,6 +118,9 @@ describe("promptGatewayConfig", () => {
       authConfigFactory: ({ mode, token, password }) => ({ mode, token, password }),
     });
     expect(result.token).toBe("generated-token");
+    expect(mocks.password).toHaveBeenCalledWith(
+      expect.objectContaining({ message: "Gateway token (blank to generate)" }),
+    );
   });
 
   it("does not set password to literal 'undefined' when prompt returns undefined", async () => {
@@ -129,6 +132,12 @@ describe("promptGatewayConfig", () => {
     });
     expect(call.password).not.toBe("undefined");
     expect(call.password).toBe("");
+    expect(mocks.password).toHaveBeenCalledWith(
+      expect.objectContaining({
+        message: "Gateway password",
+        validate: expect.any(Function),
+      }),
+    );
   });
 
   it("prompts for trusted-proxy configuration when trusted-proxy mode selected", async () => {
diff --git a/src/commands/configure.gateway.ts b/src/commands/configure.gateway.ts
@@ -245,7 +245,7 @@ export async function promptGatewayConfig(
 
   if (authMode === "password") {
     const passwordInput = guardCancel(
-      await text({
+      await password({
         message: "Gateway password",
         validate: validateGatewayPasswordInput,
       }),
