fix(models): mask paste-token input in CLI auth prompt by anurag-bg-neu · Pull Request #90893 · openclaw/openclaw

anurag-bg-neu · 2026-06-06T09:42:16Z

Summary

What problem does this PR solve?
openclaw models auth paste-token --provider <p> echoes the pasted bearer/setup token in cleartext at the TTY prompt, exposing the secret to anyone who can see the screen.

Why does this matter now?
This is the third and last of three audited credential-prompt TTY echo leak sites. The first two were fixed in PR #76693 (onboarding) and PR #90571 (gateway password / Repro B). This closes Repro C.

What is the intended outcome?
The paste-token prompt renders as masked bullets, matching the already-masked sibling command paste-api-key.

What is intentionally out of scope?
No changes to stored values — masking is render-only; the persisted auth profile value remains the real typed string.

What does success look like?
Running openclaw models auth paste-token --provider anthropic shows a masked (bullet) prompt instead of cleartext echo.

What should reviewers focus on?
The one-line change in modelsAuthPasteTokenCommand (masked: false → true). Test reroutes from clackText to clackPassword mock. The new regression test that locks the masked routing.

Linked context

Which issue does this close?

Closes # (none — discovered during credential-prompt audit)

Which issues, PRs, or discussions are related?

Related #76693 (onboarding password mask, merged)
Related #90571 (Repro B — gateway password mask, open)
Related #91059 (Repro A — gateway token mask, open)
Related #90894 ([verify] macOS TTY rendering)
Related #90895 ([verify] Linux TTY rendering)

Was this requested by a maintainer or owner?

No — discovered and fixed as part of a self-initiated credential-prompt audit.

Real behavior proof (required for external PRs)

Behavior or issue addressed: paste-token echoes typed token in cleartext at the TTY prompt
Real environment tested: Windows 10 (build 19045.7291), native PowerShell window
Exact steps or command run after this patch: pnpm openclaw models auth paste-token --provider anthropic — prompt renders bullets
Evidence after fix (screenshot, recording, terminal capture, console output, redacted runtime log, linked artifact, or copied live output):
Observed result after fix: Token input renders as masked bullets instead of cleartext
What was not tested: macOS and Linux TTY rendering (see [verify] paste-token mask renders bullets on macOS (PR #90893) #90894, [verify] paste-token mask renders bullets on Linux (PR #90893) #90895)
Proof limitations or environment constraints: Windows-only repro environment. @clack/prompts password() is cross-platform; verify issues track macOS/Linux rendering separately.
Before evidence (optional but encouraged):

Tests and validation

Which commands did you run?

pnpm build ; pnpm check ; pnpm test

pnpm check failed on pre-existing TypeScript errors in extensions/discord/src/ (unrelated to this diff — confirmed via git diff origin/main --name-only showing only src/commands/models/auth.ts and src/commands/models/auth.test.ts).

What regression coverage was added or updated?

Added "reads the pasted token through the masked password prompt" test that asserts clackPassword is called and clackText is not called. Rerouted 9 existing paste-token tests from clackText mock to clackPassword mock.

What failed before this fix, if known?

After flipping masked: true, all 9 paste-token tests that primed clackText failed. Fixed by rerouting each to clackPassword.

If no test was added, why not?

A regression test was added.

Risk checklist

Did user-visible behavior change? (Yes/No)

Yes — the paste-token TTY prompt now masks input as bullets. The stored auth profile value is unchanged (masking is render-only; normalizeSecretInput runs in both paths).

Did config, environment, or migration behavior change? (Yes/No)

No.

Did security, auth, secrets, network, or tool execution behavior change? (Yes/No)

Yes — improved: token is no longer visible in the terminal during entry. No behavioral change to auth logic.

What is the highest-risk area?

readPastedSecret dispatches to password() vs text() purely off the masked boolean. No other call site or stored value is affected.

How is that risk mitigated?

The regression test locks the masked routing. The sibling paste-api-key already uses masked: true as the reference implementation.

Current review state

What is the next action?

Confirm CI is green, then flip to Ready for Review.

What is still waiting on author, maintainer, CI, or external proof?

macOS TTY rendering verification — [verify] paste-token mask renders bullets on macOS (PR #90893) #90894
Linux TTY rendering verification — [verify] paste-token mask renders bullets on Linux (PR #90893) #90895

Which bot or reviewer comments were addressed?

None yet (draft PR).

AI-assisted PR:

Marked as AI-assisted in the description
Human-run real behavior proof from your own setup (before/after screenshots attached above)
Prompts or session logs (session logs available on request)
Confirmed understanding of the code change
Will resolve bot review conversations after addressing them

The interactive 'Paste token for <provider>' prompt echoed the pasted bearer/setup token in cleartext because readPastedSecret was called with masked: false. Its sibling paste-api-key command already renders bullets. Flip the flag to masked: true so the secret routes through the styled password prompt. Masking is render-only; both prompt branches share normalizeSecretInput, so the stored profile value is unchanged. Reroute the paste-token unit tests onto the password mock and add a regression test asserting the masked prompt is used. Co-Authored-By: Claude Opus 4.8 <[email protected]>

clawsweeper · 2026-06-06T09:44:58Z

Codex review: needs maintainer review before merge. Reviewed June 14, 2026, 4:44 AM ET / 08:44 UTC.

Summary
The PR changes models auth paste-token token entry from an unmasked text prompt to the masked password prompt and updates models-auth tests accordingly.

PR surface: Source 0, Tests +13. Total +13 across 2 files.

Reproducibility: yes. by source inspection and supplied proof: current main and v2026.6.6 route paste-token TTY input through the unmasked text branch, and the PR body provides before/after Windows terminal screenshots for the same command. I did not run an interactive TTY repro in this read-only review.

Review metrics: none identified.

Merge readiness
Overall: 🦞 diamond lobster
Proof: 🦞 diamond lobster ✨ media proof bonus
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Risk before merge

[P1] Direct visual proof is Windows-only; macOS and Linux rendering is inferred from the same pinned @clack/prompts password path and tracked by separate verification issues.

Maintainer options:

Decide the mitigation before merge
Land the narrow masking change after normal maintainer review and CI gating; the platform verification issues can remain follow-up spot checks rather than blockers for this helper flag change.
Pause or close
Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

No ClawSweeper repair lane is needed because the patch has no actionable findings; maintainers only need normal review and CI gating.

Security
Cleared: The diff narrows terminal exposure of pasted credentials and does not change dependencies, lockfiles, storage, auth routing, CI, or package scripts.

Review details

Best possible solution:

Land the narrow masking change after normal maintainer review and CI gating; the platform verification issues can remain follow-up spot checks rather than blockers for this helper flag change.

Do we have a high-confidence way to reproduce the issue?

Yes by source inspection and supplied proof: current main and v2026.6.6 route paste-token TTY input through the unmasked text branch, and the PR body provides before/after Windows terminal screenshots for the same command. I did not run an interactive TTY repro in this read-only review.

Is this the best way to solve the issue?

Yes. Flipping the existing masked argument is the narrowest maintainable fix because readPastedSecret already preserves piped stdin, normalization, validation, and storage behavior while routing TTY input through the same masked prompt used by paste-api-key.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against b1caba590631.

Label changes

Label justifications:

P2: This is a normal-priority credential prompt hardening fix with limited blast radius and no config, migration, dependency, or provider-routing change.
rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (screenshot): The PR body includes before/after Windows terminal screenshots, and the after screenshot directly shows the changed paste-token prompt rendering bullets.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes before/after Windows terminal screenshots, and the after screenshot directly shows the changed paste-token prompt rendering bullets.
proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence. The PR body includes before/after Windows terminal screenshots, and the after screenshot directly shows the changed paste-token prompt rendering bullets.

Evidence reviewed

PR surface:

Source 0, Tests +13. Total +13 across 2 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	1	1	1	0
Tests	1	25	12	+13
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	2	26	13	+13

What I checked:

current main token prompt: modelsAuthPasteTokenCommand on current main calls readPastedSecret with masked: false, so TTY token entry uses the unmasked text path. (src/commands/models/auth.ts:680, b1caba590631)
prompt helper branch: readPastedSecret routes TTY input to password(promptParams) when masked is true, otherwise text(promptParams), and non-TTY input still reads piped stdin before normalization and validation. (src/commands/models/auth.ts:136, b1caba590631)
sibling masked command: modelsAuthPasteApiKeyCommand already uses the same helper with masked: true, making the proposed token change consistent with the sibling secret-entry command. (src/commands/models/auth.ts:734, b1caba590631)
PR diff: The patch changes only masked: false to masked: true in modelsAuthPasteTokenCommand and reroutes affected tests to the password mock, including a new assertion that text is not called. (src/commands/models/auth.ts:682, c7e1fdf7bcd8)
latest release behavior: v2026.6.6 still has modelsAuthPasteTokenCommand passing masked: false, so the user-visible bug is not already fixed in the latest release. (src/commands/models/auth.ts:680, 8c802aa68351)
dependency contract: The pinned @clack/prompts 1.4.0 types document password as text-like masked input with a mask option, which supports using the existing password path for render-only masking. (package.json:1878, b1caba590631)

Likely related people:

steipete: GitHub commit metadata maps the original feat: add models auth commands commit to steipete, and that commit introduced the paste-token text prompt; later commits from the same handle refactored models-auth tests and command hot spots. (role: introduced behavior and recent area contributor; confidence: high; commits: eced473e0515, 310b5e4f6a22; files: src/commands/models/auth.ts, src/commands/models/auth.test.ts, src/cli/models-cli.ts)
MumuTW: The models-auth cancel-guard work from MumuTW was landed into the same command and test paths, including the manual token-entry prompt behavior. (role: adjacent contributor; confidence: medium; commits: 2ada1b71b67e; files: src/commands/models/auth.ts, src/commands/models/auth.test.ts)
anurag-bg-neu: Beyond this PR, related merged sibling work in the supplied context masks other credential prompts, so this person is relevant to the credential-prompt audit thread rather than listed solely as this PR author. (role: adjacent credential-prompt hardening contributor; confidence: medium; commits: 727398f41a85, 382db15e33b9; files: src/wizard/clack-prompter.ts, src/commands/configure.gateway.ts, src/commands/configure.shared.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

openclaw-barnacle Bot added commands Command implementations size: XS labels Jun 6, 2026

This was referenced Jun 6, 2026

[verify] paste-token mask renders bullets on macOS (PR #90893) #90894

Closed

[verify] paste-token mask renders bullets on Linux (PR #90893) #90895

Closed

openclaw-barnacle Bot added the triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. label Jun 6, 2026

openclaw-barnacle Bot added proof: supplied External PR includes structured after-fix real behavior proof. and removed triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. labels Jun 6, 2026

This was referenced Jun 6, 2026

[verify] paste-token mask renders bullets on macOS (PR #90893) #90899

Closed

[verify] paste-token mask renders bullets on Linux (PR #90893) #90900

Closed

anurag-bg-neu marked this pull request as ready for review June 6, 2026 10:04

openclaw-barnacle Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label Jun 6, 2026

clawsweeper Bot added the proof: sufficient ClawSweeper judged the real behavior proof convincing. label Jun 6, 2026

openclaw-barnacle Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label Jun 7, 2026

clawsweeper Bot added the proof: sufficient ClawSweeper judged the real behavior proof convincing. label Jun 7, 2026

anurag-bg-neu mentioned this pull request Jun 7, 2026

[verify] gateway password mask renders bullets on macOS (PR #90571) #90634

Closed

openclaw-barnacle Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label Jun 7, 2026

clawsweeper Bot added the proof: sufficient ClawSweeper judged the real behavior proof convincing. label Jun 7, 2026

openclaw-barnacle Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label Jun 7, 2026

clawsweeper Bot added the proof: sufficient ClawSweeper judged the real behavior proof convincing. label Jun 7, 2026

anurag-bg-neu mentioned this pull request Jun 7, 2026

[verify] gateway password mask renders bullets on Linux (PR #90571) #90635

Closed

vincentkoc self-assigned this Jun 15, 2026

vincentkoc merged commit 31a10ee into openclaw:main Jun 15, 2026
378 of 392 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(models): mask paste-token input in CLI auth prompt#90893

fix(models): mask paste-token input in CLI auth prompt#90893
vincentkoc merged 1 commit into
openclaw:mainfrom
anurag-bg-neu:fix/mask-paste-token

anurag-bg-neu commented Jun 6, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jun 6, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

anurag-bg-neu commented Jun 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Linked context

Real behavior proof (required for external PRs)

Tests and validation

Risk checklist

Current review state

Uh oh!

clawsweeper Bot commented Jun 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

anurag-bg-neu commented Jun 6, 2026 •

edited

Loading

clawsweeper Bot commented Jun 6, 2026 •

edited

Loading