-
-
Notifications
You must be signed in to change notification settings - Fork 80.7k
[verify] paste-token mask renders bullets on macOS (PR #90893) #90894
Copy link
Copy link
Closed
Labels
P3Low-priority cleanup, docs, polish, ergonomics, or speculative work.Low-priority cleanup, docs, polish, ergonomics, or speculative work.clawsweeper:needs-security-reviewClawSweeper marked this issue as needing security-sensitive review.ClawSweeper marked this issue as needing security-sensitive review.clawsweeper:no-new-fix-prClawSweeper does not recommend queueing a new automated fix PR for this issue.ClawSweeper does not recommend queueing a new automated fix PR for this issue.clawsweeper:source-reproClawSweeper found a high-confidence source-level issue reproduction.ClawSweeper found a high-confidence source-level issue reproduction.impact:securitySecurity boundary, credential, authz, sandbox, or sensitive-data risk.Security boundary, credential, authz, sandbox, or sensitive-data risk.issue-rating: 🦞 diamond lobsterVery strong issue quality with high-confidence source-level or clear reproduction.Very strong issue quality with high-confidence source-level or clear reproduction.
Description
Metadata
Metadata
Assignees
Labels
P3Low-priority cleanup, docs, polish, ergonomics, or speculative work.Low-priority cleanup, docs, polish, ergonomics, or speculative work.clawsweeper:needs-security-reviewClawSweeper marked this issue as needing security-sensitive review.ClawSweeper marked this issue as needing security-sensitive review.clawsweeper:no-new-fix-prClawSweeper does not recommend queueing a new automated fix PR for this issue.ClawSweeper does not recommend queueing a new automated fix PR for this issue.clawsweeper:source-reproClawSweeper found a high-confidence source-level issue reproduction.ClawSweeper found a high-confidence source-level issue reproduction.impact:securitySecurity boundary, credential, authz, sandbox, or sensitive-data risk.Security boundary, credential, authz, sandbox, or sensitive-data risk.issue-rating: 🦞 diamond lobsterVery strong issue quality with high-confidence source-level or clear reproduction.Very strong issue quality with high-confidence source-level or clear reproduction.
Type
Fields
Priority
None yet
Context
PR #90893 flips
masked: false → trueinmodelsAuthPasteTokenCommandso thatopenclaw models auth paste-token --provider <p>renders the token input as masked bullets instead of cleartext echo.The fix uses
@clack/promptspassword(), which is cross-platform and ships to macOS/Linux automatically. The author's repro environment is Windows 10 only.Verification request
Could a macOS maintainer confirm that after PR #90893 merges:
pnpm openclaw models auth paste-token --provider anthropicsk-ant-DUMMY_TOKEN); each character should render as•instead of the typed letter — matching the already-masked siblingpaste-api-keyNo real Anthropic account is needed — the provider validator checks format only; any plausible string reaches the prompt.
Related