Merge fa3f5e8 into 6f35f96

anurag-bg-neu · web-flow · commit abed70c6afee · 2026-06-07T06:49:32.000Z
diff --git a/src/commands/configure.gateway.test.ts b/src/commands/configure.gateway.test.ts
@@ -5,6 +5,7 @@ import type { RuntimeEnv } from "../runtime.js";
 
 const mocks = vi.hoisted(() => ({
   text: vi.fn(),
+  password: vi.fn(),
   select: vi.fn(),
   confirm: vi.fn(),
   resolveGatewayPort: vi.fn(),
@@ -24,6 +25,7 @@ vi.mock("../config/config.js", async (importActual) => {
 
 vi.mock("./configure.shared.js", () => ({
   text: mocks.text,
+  password: mocks.password,
   select: mocks.select,
   confirm: mocks.confirm,
 }));
@@ -77,6 +79,7 @@ async function runGatewayPrompt(params: {
     return input.initialValue ?? input.options[0]?.value;
   });
   mocks.text.mockImplementation(async () => params.textQueue.shift());
+  mocks.password.mockImplementation(async () => params.textQueue.shift());
   mocks.randomToken.mockReturnValue(params.randomToken ?? "generated-token");
   mocks.confirm.mockResolvedValue(params.confirmResult ?? true);
   mocks.buildGatewayAuthConfig.mockImplementation((input) =>
diff --git a/src/commands/configure.gateway.ts b/src/commands/configure.gateway.ts
@@ -21,7 +21,7 @@ import { findTailscaleBinary } from "../infra/tailscale.js";
 import type { RuntimeEnv } from "../runtime.js";
 import { resolveDefaultSecretProviderAlias } from "../secrets/ref-contract.js";
 import { buildGatewayAuthConfig } from "./configure.gateway-auth.js";
-import { confirm, select, text } from "./configure.shared.js";
+import { confirm, password, select, text } from "./configure.shared.js";
 import {
   guardCancel,
   normalizeGatewayTokenInput,
@@ -245,14 +245,14 @@ export async function promptGatewayConfig(
   }
 
   if (authMode === "password") {
-    const password = guardCancel(
-      await text({
+    const passwordInput = guardCancel(
+      await password({
         message: "Gateway password",
         validate: validateGatewayPasswordInput,
       }),
       runtime,
     );
-    gatewayPassword = normalizeOptionalString(password) ?? "";
+    gatewayPassword = normalizeOptionalString(passwordInput) ?? "";
   }
 
   if (authMode === "trusted-proxy") {
diff --git a/src/commands/configure.shared.ts b/src/commands/configure.shared.ts
@@ -3,6 +3,7 @@ import {
   confirm as clackConfirm,
   intro as clackIntro,
   outro as clackOutro,
+  password as clackPassword,
   select as clackSelect,
   text as clackText,
 } from "@clack/prompts";
@@ -89,6 +90,12 @@ export const text = (params: Parameters<typeof clackText>[0]) =>
     ...params,
     message: stylePromptMessage(params.message),
   });
+/** Styled password prompt wrapper. Echoes bullets so secrets never appear in cleartext. */
+export const password = (params: Parameters<typeof clackPassword>[0]) =>
+  clackPassword({
+    ...params,
+    message: stylePromptMessage(params.message),
+  });
 /** Styled confirm prompt wrapper. */
 export const confirm = (params: Parameters<typeof clackConfirm>[0]) =>
   clackConfirm({
diff --git a/src/commands/configure.wizard.test.ts b/src/commands/configure.wizard.test.ts
@@ -10,6 +10,7 @@ const mocks = vi.hoisted(() => {
     clackSelect: vi.fn(),
     clackText: vi.fn(),
     clackConfirm: vi.fn(),
+    clackPassword: vi.fn(),
     resolveSearchProviderOptions: vi.fn(),
     resolvePluginContributionOwners: vi.fn(),
     setupSearch: vi.fn(),
@@ -46,6 +47,7 @@ vi.mock("@clack/prompts", () => ({
   select: mocks.clackSelect,
   text: mocks.clackText,
   confirm: mocks.clackConfirm,
+  password: mocks.clackPassword,
 }));
 
 vi.mock("../config/config.js", () => ({
