Codex review: needs maintainer review before merge.

Summary
The PR adds sensitive wizard text plumbing, masks onboarding credential prompts in Clack and the macOS wizard CLI, preserves existing secrets with masked-preview confirmations, and adds regression tests plus a changelog entry.

Reproducibility: yes. Source inspection on current main shows credential onboarding paths call prompter.text(), and the shared Clack adapter renders that through normal text input; I did not run a live terminal transcript.

Next step before merge
Maintainer should inspect or rerun the latest macos-swift logs because the public annotations do not expose a narrow automated repair.

Security
Cleared: No concrete security or supply-chain regression found; the diff narrows terminal secret exposure without adding dependencies, workflow changes, permissions, or new storage/network paths.

Thanks for the careful review. New commit bd38ccf689 addresses all three findings.

[P2] Preserve masked prompt defaults — src/wizard/clack-prompter.ts:123-126

You correctly diagnosed the regression. I went with the second option you suggested ("update those callers to keep existing secrets without rendering them") rather than a prompter-level "blank → initialValue" rule. Reasoning: a prompter-level fallback would invert the "Gateway token (blank to generate)" semantic in setup.gateway-config.ts:212 — there blank legitimately means "generate a new random token", not "keep the env value". So the fix lives at each call site, mirroring the pattern already established in provider-auth-input.ts:204-213.

For each of the 3 affected sites, the pattern is now:

1. Detect existing value (env var / cfg field / passed-in).
2. If non-empty, ask via prompter.confirm({ message: "Use existing X (<masked-preview>)?", initialValue: true }) using maskApiKey() for the preview.
3. If user confirms → use existing without showing the masked text prompt.
4. If user declines (or there is no existing value) → show the masked text prompt with no initialValue.

Touched call sites:

• src/wizard/setup.gateway-config.ts:212 — Gateway token in advanced flow
• src/commands/onboard-remote.ts:198 — Gateway token in remote onboarding
• src/commands/onboard-remote.ts:230 — Gateway password in remote onboarding

New regression tests (failing before, passing after):

• src/wizard/setup.gateway-config.test.ts → keeps OPENCLAW_GATEWAY_TOKEN in advanced flow when user confirms keeping existing
• src/commands/onboard-remote.test.ts → keeps an existing remote gateway token when user confirms via masked-preview prompt
• src/commands/onboard-remote.test.ts → keeps an existing remote gateway password when user confirms via masked-preview prompt

The other masked-prompt call sites (provider-auth-input.ts:215, flows/search-setup.ts:475, provider-self-hosted-setup.ts:211, onboard-skills.ts:212) never passed initialValue to the masked text prompt and need no change.

[P2] Mask session wizard text in the macOS CLI — apps/macos/Sources/OpenClawMacCLI/WizardCommand.swift:445

Fixed. The case "text": branch in promptAnswer now checks step.sensitive == true first, and if set, dispatches to a new readPasswordWithPrompt helper that uses POSIX getpass(3) (already available via the file's Darwin import) to read input without echo. The bracketed [\(initial)] is no longer rendered for sensitive prompts. Call sites that need "keep existing" behavior must do so via a separate confirm step before the sensitive prompt — matching the pattern applied to the TypeScript call sites above.

⚠️ Verification gap: I authored this PR on Windows, where Swift toolchain is not available, so I have not built or run the macOS CLI against this change. The diff is mechanical and reviewed visually. Maintainers with macOS access (or apps/macos CI) can confirm with openclaw-mac wizard against any flow that emits a sensitive: true text step (e.g., the gateway-config or onboard-remote flows touched here) — input should not echo and […] should not be displayed.

[P3] Add the required changelog entry — CHANGELOG.md

Added under ## Unreleased > ### Fixes. Single-line bullet covering both the Node CLI masking and the macOS CLI no-echo handling, attributed per the project's "Thanks @author" convention.

Verification on bd38ccf689

• pnpm tsgo:core — clean.
• pnpm check — 0 warnings, 0 errors across all 3 oxlint lanes (core/scripts/extensions) plus all policy guards.
• vitest.wizard.config.ts setup.gateway-config — 11/11 pass (10 prior + 1 new).
• vitest.commands.config.ts onboard-remote — 12/12 pass (10 prior + 2 new).
• vitest.commands.config.ts onboard-search — 15/15 pass (unchanged from prior commit).
• vitest.full-core-unit-fast.config.ts session.test.ts clack-prompter.test.ts — 8/8 pass (unchanged).

Swift: not built locally (no Apple toolchain on Windows) — see the verification-gap call-out above.

End-to-end Windows PowerShell Start-Transcript proof is still TODO; I will attach before/after screenshots once captured against a fresh build of pnpm openclaw onboard --install-daemon.

Pushed 6274de3523 (and rebased onto current upstream/main to clear the CHANGELOG.md merge conflict). Two things addressed:

[P2] Avoid truncating macOS wizard credentials — WizardCommand.swift:538

You're right that getpass(3) truncates at _PASSWORD_LEN (128 chars on BSD/macOS), which would silently drop the tail of any longer credential — JWTs, OpenRouter keys, Anthropic keys with extended formats, etc. Replaced the helper with a termios-based reader:

private func readPasswordWithPrompt(_ prompt: String) throws -> String {
    // Use termios to disable echo rather than getpass(3): getpass truncates
    // input at _PASSWORD_LEN (128 chars on BSD/macOS), which would silently
    // discard longer credentials such as JWTs or extended provider tokens.
    print("\(prompt): ", terminator: "")
    fflush(stdout)

    var oldTerm = termios()
    let echoDisabled: Bool
    if isatty(STDIN_FILENO) != 0 && tcgetattr(STDIN_FILENO, &oldTerm) == 0 {
        var newTerm = oldTerm
        newTerm.c_lflag &= ~tcflag_t(ECHO)
        echoDisabled = tcsetattr(STDIN_FILENO, TCSANOW, &newTerm) == 0
    } else {
        echoDisabled = false
    }
    defer {
        if echoDisabled {
            _ = tcsetattr(STDIN_FILENO, TCSANOW, &oldTerm)
        }
        // The user's Enter keystroke wasn't echoed while ECHO was disabled;
        // emit a newline so subsequent output starts on its own line.
        print("")
    }

    guard let line = readLine() else {
        throw WizardCliError.cancelled
    }
    return line
}

Properties:

• No length cap — readLine() reads the full line up to the next newline; Swift's stdin buffer is not bounded by _PASSWORD_LEN.
• Echo restored on every exit path via defer, including throws and cancellation.
• Non-TTY safe — when stdin isn't a TTY (isatty == 0) or tcgetattr fails, we skip the echo manipulation and just read; the prompt still appears, no echo state is left dangling.
• Cursor hygiene — emits a trailing newline so subsequent prompt output isn't on the same visual line as the masked input.

Verification gap is unchanged: I cannot run swift build --product openclaw-mac locally (Windows host, no Apple toolchain). The diff is mechanical and follows the standard termios disable-echo pattern. Maintainers with macOS access should run the acceptance criteria you listed:

cd apps/macos && swift build --product openclaw-mac
# then exercise a sensitive wizard text step with > 128 chars and confirm
# no echo and no truncation

CHANGELOG conflict resolution

Upstream landed 5 new fixes since my last rebase, including a CHANGELOG move (9772ce6ce9). Re-resolved by slotting my entry immediately below the 5 upstream-landed entries — preserves their order verbatim, my entry remains attributed to the same author, no other lines moved.

End-to-end visual verification (Windows PowerShell)

I have local visual confirmation that the masking flow works in pnpm openclaw onboard --install-daemon on Windows PowerShell:

• Enter Gemini API key renders as bullets (••••...).
• The "Use existing GEMINI_API_KEY (env: GEMINI_API_KEY, AIza…WsDI)?" masked-preview confirm step fires correctly when an env var is detected, with maskApiKey() showing the safe head/tail preview.
• Declining the confirm advances to the masked password prompt, where the new value is read without echo.

Screenshot evidence is captured locally and will be attached as a follow-up comment by @anurag-bg-neu.

Branch state

6274de3523 fix(macos-cli): replace getpass(3) with termios no-echo to avoid 128-char credential truncation
72ffd20888 fix(onboarding): preserve credential defaults via masked-preview confirm; mask macOS wizard CLI
de1a9c607f fix(onboarding): mask credential inputs in interactive wizard prompts

3 commits ahead of upstream/main, all focused on the same security concern. Force-pushed with --force-with-lease (lease-safe — refuses if anyone else had pushed in the meantime).

Verification on 6274de3523

• pnpm tsgo:core — clean.
• pnpm check — 0 warnings, 0 errors across all 3 oxlint lanes plus all policy guards.
• setup.gateway-config.test.ts — 11/11 pass.
• session.test.ts — 6/6 pass.
• onboard-remote.test.ts — 12/12 pass.
• onboard-search.test.ts — 15/15 pass.

The handful of pnpm test:changed failures in unrelated paths (src/trajectory/**, src/crestodian/**, src/memory-host-sdk/**, src/proxy-capture/**, test/scripts/blacksmith-testbox-state*, etc.) are pre-existing Windows-host flakes and red on upstream/main independently — none touch any file in this PR.

Pushed dcfca89199 to address the macos-swift CI failure on 6274de3523.

The 22-second failure window is consistent with .github/workflows/ci.yml:1988-1991 (swiftlint + swiftformat --lint) or a fast-fail early in swift build — not a full build cycle. I narrowed the most likely causes by re-reading my Swift change and the OpenClawMacCLI target settings (apps/macos/Package.swift:65-67, 76-77 enables .upcomingFeature("StrictConcurrency") for Swift 6.2). Two defensive changes:

• Dropped fflush(stdout). The existing readLineWithPrompt (WizardCommand.swift:520-526) doesn't flush either, and that helper compiles cleanly on this target. stdout is a global mutable variable from Darwin, and even though most modern SDK module maps mark it nonisolated(unsafe), leaning on the established no-flush pattern in the same file is the safest move under strict concurrency.
• let echoDisabled: Bool → var echoDisabled = false. Drops the branched-let-init and collapses the if/else into a single guarded if. Cleaner under strict mode.
• Moved print("") inside if echoDisabled. Unrelated UX bug I caught while reviewing: the previous defer always emitted a newline, even when echo was not disabled — in that case the user's Enter was already echoed and the extra newline doubled up. Now the post-prompt newline only fires when we actually disabled echo.

Verification gap is the same: I authored this PR on Windows and don't have a Swift toolchain locally, so I'm reading the failure shape from the workflow file rather than from the actual error text. If dcfca89199 still fails, the fastest path forward is the failed step's last ~50 lines of log — drop them in a comment here and I'll pinpoint the exact rule/line rather than guess again. The acceptance criteria you listed earlier still apply for full sign-off (build product OpenClaw, run swift test, exercise a > 128 char credential).

Will follow up with the Windows PowerShell Start-Transcript masking screenshot once I'm back at that host.

Closing in favor of a focused replacement at #76693. The technical content for the Node-side masking is equivalent — same diff on src/wizard/**, src/flows/search-setup.ts, src/plugins/provider-{auth-input,self-hosted-setup}.ts, src/commands/onboard-{remote,skills,search}* — collapsed into one squashed commit (a3db64c265) with both before/after Windows PowerShell screenshots inline in the body, and the iterative review history off the maintainer queue.

clawsweeper findings — status in #76693:

• ✅ [P2] Preserve masked prompt defaults → confirm-then-prompt with maskApiKey() masked preview at the 3 affected call sites (setup.gateway-config.ts:212, onboard-remote.ts:198, 230).
• ⏭ [P2] Mask session wizard text in macOS CLI → deliberately deferred to a follow-up PR. I authored on Windows with no Apple toolchain to run swift build / swiftlint / swiftformat --lint; prior speculative iterations of the Swift change kept failing macos-swift CI. Staying TDD-strict means I don't keep guessing — a contributor with macOS access can land that fix cleanly. The macOS leak path is documented in fix(onboarding): mask token/credential inputs in CLI wizard prompts #76693's "Out-of-scope leak path (acknowledged)" subsection.
• ✅ [P3] CHANGELOG entry → added under ## Unreleased > ### Fixes.

Appreciate the patient review on this thread.