@refleet-it/runner 0.1.197 → 0.1.200

package/README.md

@@ -28,10 +28,15 @@ against earlier releases.
 ## Connect and run
 
 ```bash
-refleet login    # API URL, email, password → mints an API key and stores it locally
+refleet login    # opens refleet.it, you approve in the browser → an API key is stored locally
 refleet run
 ```
 
+`login` never asks for a password: it prints a link (and opens it), you approve the request
+while signed in, and the CLI collects a fresh API key. `--api-url <url>` targets another
+instance (`REFLEET_API_URL` works too); `--no-browser` only prints the link, for headless boxes
+and SSH sessions.
+
 `login` keeps its API key in `~/.config/refleet/runner.json` (`XDG_CONFIG_HOME` is honoured).
 Anything headless — a server, a container, CI — should instead set `REFLEET_API_URL` and
 `REFLEET_API_KEY` directly; when both are set they take precedence over the stored login.

package/dist/backend-client.js

@@ -9,42 +9,37 @@ function baseUrl(apiUrl) {
     return apiUrl.replace(/\/+$/, '');
 }
 /**
- * POST /identity/login — the same endpoint the frontend's own login form uses.
- * Maps the two failure modes LoginController documents (see
- * backend/.../Auth/Login/LoginController.php) to messages a CLI user acts on
- * directly instead of a bare HTTP status.
+ * POST /identity/cli-authorizations — opens a browser-approved login (OAuth device-flow
+ * shape). Public: the CLI has nothing to authenticate with yet. The device secret is
+ * the CLI's half; the URL carries only the user code the browser needs.
  */
-export async function login(apiUrl, email, password, fetchFn = fetch) {
-    const response = await fetchFn(`${baseUrl(apiUrl)}/identity/login`, {
+export async function startCliAuthorization(apiUrl, runnerName, fetchFn = fetch) {
+    const response = await fetchFn(`${baseUrl(apiUrl)}/identity/cli-authorizations`, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ email, password }),
+        body: JSON.stringify({ runnerName }),
     });
-    if (429 === response.status) {
-        throw new BackendRequestError('too many failed login attempts — try again in a minute', response.status);
-    }
-    if (401 === response.status || 422 === response.status) {
-        throw new BackendRequestError('invalid email or password', response.status);
-    }
     if (!response.ok) {
-        throw new BackendRequestError(`login failed (status ${String(response.status)})`, response.status);
+        throw new BackendRequestError(`could not start a login (status ${String(response.status)})`, response.status);
     }
-    const body = (await response.json());
-    const jwtToken = body.token?.jwtToken;
-    if (!jwtToken) {
-        throw new BackendRequestError('login succeeded but the response had no JWT');
-    }
-    return { jwtToken };
+    return (await response.json());
 }
-/** POST /identity/api-keys, authenticated with the short-lived JWT from login(). */
-export async function createApiKey(apiUrl, jwtToken, name, fetchFn = fetch) {
-    const response = await fetchFn(`${baseUrl(apiUrl)}/identity/api-keys`, {
+/**
+ * POST /identity/cli-authorizations/claim — one poll. The secret travels in the body so
+ * it never lands in an access log. `approved` comes with the key exactly once; the
+ * backend forgets the authorization right after, so a replay is a 404.
+ */
+export async function claimCliAuthorization(apiUrl, deviceSecret, apiKeyName, fetchFn = fetch) {
+    const response = await fetchFn(`${baseUrl(apiUrl)}/identity/cli-authorizations/claim`, {
         method: 'POST',
-        headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${jwtToken}` },
-        body: JSON.stringify({ name }),
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ deviceSecret, apiKeyName }),
     });
+    if (404 === response.status) {
+        throw new BackendRequestError('this login request is no longer known to the server', response.status);
+    }
     if (!response.ok) {
-        throw new BackendRequestError(`failed to create an API key (status ${String(response.status)})`, response.status);
+        throw new BackendRequestError(`polling the login failed (status ${String(response.status)})`, response.status);
     }
     return (await response.json());
 }

package/dist/backends/claude.js

@@ -1,5 +1,5 @@
 import { spawn } from 'node:child_process';
-import { AgentExecutionError } from './types.js';
+import { agentEnv, AgentExecutionError } from './types.js';
 /**
  * Builds the `claude` CLI argument list for one job kind. Ported 1:1 from
  * runner/claude/entrypoint.sh's build_claude_args/build_kind_claude_args: qualification
@@ -107,6 +107,7 @@ export class ClaudeBackend {
             let buffer = '';
             const child = this.spawnFn(this.executablePath, args, {
                 cwd: opts.cwd,
+                env: agentEnv(this.env),
                 stdio: ['ignore', 'pipe', 'inherit'],
             });
             child.stdout.setEncoding('utf8');

package/dist/backends/kiro.js

@@ -1,5 +1,5 @@
 import { spawn } from 'node:child_process';
-import { AgentExecutionError } from './types.js';
+import { agentEnv, AgentExecutionError } from './types.js';
 /**
  * Pulls the ACP session id out of a `session/new` (or `session/load`) response.
  * Pure/testable in isolation from the actual JSON-RPC transport.
@@ -177,7 +177,7 @@ export class KiroBackend {
         // protocol-native session/request_permission (see AcpConnection.handlePeerRequest).
         const child = this.spawnFn(this.executablePath, ['acp'], {
             cwd: opts.cwd,
-            env: this.env,
+            env: agentEnv(this.env),
             stdio: ['pipe', 'pipe', 'inherit'],
         });
         const chunks = [];

package/dist/backends/types.js

@@ -1,2 +1,11 @@
 export class AgentExecutionError extends Error {
 }
+/**
+ * The agent runs untrusted code and prompts from a customer repository with tool
+ * permissions switched off, so anything it can read from its environment it can also be
+ * talked into exfiltrating. The runner's own credentials — the API key that fetches
+ * GitLab tokens — have no business there.
+ */
+export function agentEnv(env) {
+    return Object.fromEntries(Object.entries(env).filter(([name]) => !name.startsWith('REFLEET_')));
+}

package/dist/cli.js

@@ -1,55 +1,13 @@
 #!/usr/bin/env node
 import { realpathSync } from 'node:fs';
-import { hostname } from 'node:os';
 import { pathToFileURL } from 'node:url';
-import { clearStoredConfig, loadStoredConfig, resolveFleetConfig, saveStoredConfig } from './config.js';
-import { createApiKey, listApiKeys, login, revokeApiKey } from './backend-client.js';
+import { clearStoredConfig, loadStoredConfig, resolveFleetConfig } from './config.js';
+import { listApiKeys, revokeApiKey } from './backend-client.js';
 import { FleetStartupError, fleetOptionsFromEnv, runFleet } from './fleet/loop.js';
-import { createPrompter } from './prompt.js';
-const DEFAULT_API_URL = 'http://localhost/api';
+import { parseLoginArgs, runLogin } from './login.js';
 function errorMessage(err) {
     return err instanceof Error ? err.message : String(err);
 }
-/**
- * Interactive login: email+password against /identity/login, then mints a fresh
- * long-lived API key via /identity/api-keys and saves it locally — the "CLI mode"
- * counterpart to setting REFLEET_API_URL/REFLEET_API_KEY by hand for automatic/cloud
- * mode. Revokes a previous local login's key first (best-effort) so re-running
- * `login` doesn't litter the account's key list every time.
- */
-async function runLogin() {
-    const existing = loadStoredConfig();
-    const prompter = createPrompter();
-    let apiUrl, email, password;
-    try {
-        const apiUrlInput = await prompter.question(`API URL [${DEFAULT_API_URL}]: `);
-        apiUrl = '' === apiUrlInput ? DEFAULT_API_URL : apiUrlInput;
-        email = await prompter.question('Email: ');
-        password = await prompter.questionHidden('Password: ');
-    }
-    finally {
-        prompter.close();
-    }
-    const { jwtToken } = await login(apiUrl, email, password);
-    const created = await createApiKey(apiUrl, jwtToken, `refleet-runner (${hostname()})`);
-    if (existing) {
-        try {
-            await revokeApiKey(existing.apiUrl, existing.apiKey, existing.apiKeyId);
-        }
-        catch (err) {
-            process.stderr.write(`warning: failed to revoke the previous local API key: ${errorMessage(err)}\n`);
-        }
-    }
-    saveStoredConfig({
-        apiUrl,
-        apiKey: created.token,
-        apiKeyId: created.id,
-        accountEmail: email,
-        createdAt: created.createdAt,
-    });
-    process.stdout.write(`Logged in as ${email}. API key ${created.prefix}… saved to your local config.\n`);
-    process.stdout.write("Run 'refleet run' to start the runner.\n");
-}
 /** Revokes the locally saved key on the backend (best-effort) and clears the local config. */
 async function runLogout() {
     const existing = loadStoredConfig();
@@ -122,7 +80,7 @@ async function main() {
     const command = process.argv[2];
     switch (command) {
         case 'login':
-            await runLogin();
+            await runLogin(parseLoginArgs(process.argv.slice(3), process.env));
             return;
         case 'logout':
             await runLogout();
@@ -135,7 +93,7 @@ async function main() {
             return;
         default:
             process.stderr.write(`refleet: unknown command ${JSON.stringify(command ?? '')}\n`);
-            process.stderr.write('Usage: refleet <login|logout|whoami|run>\n');
+            process.stderr.write('Usage: refleet <login [--api-url <url>] [--no-browser]|logout|whoami|run>\n');
             process.exitCode = 1;
     }
 }

package/dist/fleet/api.js

@@ -92,8 +92,10 @@ export class FleetApi {
         }
     }
     /**
-     * Fetched per job rather than once at startup so a reconnected/rotated GitLab
-     * token is picked up without restarting the runner.
+     * Fetched right before every git/GitLab call rather than once per job or at startup:
+     * OAuth-backed connections hand out short-lived access tokens, and the backend refreshes
+     * one only when asked for it, so a token fetched before a long agent run may be dead by
+     * the time the branch is pushed.
      */
     async fetchGitLabCredentials() {
         const response = await this.request('GET', '/runner/gitlab-credentials');

package/dist/fleet/git.js

@@ -11,18 +11,25 @@ export class GitError extends Error {
     }
 }
 /**
- * GitLab's git-http backend (unlike its REST API) does not accept the PRIVATE-TOKEN
+ * GitLab's git-http backend (unlike its REST API) does not accept a bearer/private token
  * header — it only honors HTTP Basic auth, so the token is sent as a Basic credential
- * (any non-empty username works). Passed per invocation as `-c http.extraHeader` so it
- * is never written into the cached checkout's git config.
+ * (the `oauth2` username works for both OAuth and personal/group access tokens).
+ * Handed to git through GIT_CONFIG_* environment variables rather than `-c` on the
+ * command line, so it is never written into the cached checkout's git config, never
+ * visible in `ps`, and never part of the argv a GitError echoes back into logs and job
+ * failure reports.
  */
-export function gitAuthConfig(accessToken) {
+export function gitAuthEnv(accessToken) {
     const basic = Buffer.from(`oauth2:${accessToken}`).toString('base64');
-    return ['-c', `http.extraHeader=Authorization: Basic ${basic}`];
+    return {
+        GIT_CONFIG_COUNT: '1',
+        GIT_CONFIG_KEY_0: 'http.extraHeader',
+        GIT_CONFIG_VALUE_0: `Authorization: Basic ${basic}`,
+    };
 }
 export function createGitRunner(execFileFn = execFile) {
-    return (args, cwd) => new Promise((resolve, reject) => {
-        execFileFn('git', args, { cwd, maxBuffer: 64 * 1024 * 1024, env: { ...process.env, GIT_TERMINAL_PROMPT: '0' } }, (error, stdout, stderr) => {
+    return (args, cwd, env = {}) => new Promise((resolve, reject) => {
+        execFileFn('git', args, { cwd, maxBuffer: 64 * 1024 * 1024, env: { ...process.env, GIT_TERMINAL_PROMPT: '0', ...env } }, (error, stdout, stderr) => {
             if (error) {
                 const code = 'code' in error && 'number' === typeof error.code ? error.code : null;
                 reject(new GitError(args, code, String(stderr)));

package/dist/fleet/gitlab.js

@@ -19,7 +19,7 @@ async function gitlabRequest(credentials, fetchFn, method, path, body) {
     return fetchFn(`${apiBase(credentials)}${path}`, {
         method,
         headers: {
-            'PRIVATE-TOKEN': credentials.accessToken,
+            Authorization: `Bearer ${credentials.accessToken}`,
             'Content-Type': 'application/json',
         },
         body: undefined === body ? undefined : JSON.stringify(body),

package/dist/fleet/job.js

@@ -83,9 +83,16 @@ export async function claimAndRunJob(deps) {
         }
         return;
     }
-    await publishAndReport(deps, job, credentials, repoDir, project, output, report);
+    await publishAndReport(deps, job, repoDir, project, output, report);
 }
-async function publishAndReport(deps, job, credentials, repoDir, project, output, report) {
+async function publishAndReport(deps, job, repoDir, project, output, report) {
+    // The agent may have run for longer than the access token fetched for the clone lives.
+    const credentials = await deps.api.fetchGitLabCredentials();
+    if (!credentials) {
+        deps.log(`job ${job.jobId}: failed to fetch GitLab credentials from Slipway before publishing`);
+        await report('failure', 'Failed to fetch GitLab credentials from Slipway', { errorMessage: 'gitlab credentials fetch failed' });
+        return;
+    }
     let published;
     try {
         published = await (deps.publishChange ?? defaultPublishChange)(deps.workspace, credentials, repoDir, project, job.ownerTargetId ?? '', `Apply Slipway shift ${job.ownerId ?? ''}`, tail(output), deps.fetchFn);

package/dist/fleet/workspace.js

@@ -1,6 +1,6 @@
 import { appendFileSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, utimesSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { gitAuthConfig } from './git.js';
+import { gitAuthEnv } from './git.js';
 import { createMergeRequest, ensureRefleetLabel, REFLEET_LABEL } from './gitlab.js';
 const LAST_USED_MARKER = '.slipway-last-used';
 function directorySizeBytes(dir) {
@@ -82,10 +82,10 @@ function excludeMarkerFromGit(repoDir) {
 /** Returns the ready-to-use working directory; throws (GitError) when any git step fails. */
 export async function syncRepo(workspace, credentials, project) {
     const repoDir = join(workspace.cacheDir, project.externalId);
-    const auth = gitAuthConfig(credentials.accessToken);
+    const auth = gitAuthEnv(credentials.accessToken);
     if (existsSync(join(repoDir, '.git'))) {
         workspace.log(`reusing cached checkout for ${project.path}`);
-        await workspace.git([...auth, 'fetch', '--prune', 'origin'], repoDir);
+        await workspace.git(['fetch', '--prune', 'origin'], repoDir, auth);
         await workspace.git(['checkout', '-f', project.defaultBranch], repoDir);
         await workspace.git(['reset', '--hard', `origin/${project.defaultBranch}`], repoDir);
         await workspace.git(['clean', '-fdx'], repoDir);
@@ -95,7 +95,7 @@ export async function syncRepo(workspace, credentials, project) {
         evictLruUntilUnderCap(workspace);
         workspace.log(`cloning ${project.path} (first use on this runner)`);
         const cloneUrl = `${credentials.baseUrl.replace(/\/+$/, '')}/${project.path}.git`;
-        await workspace.git([...auth, 'clone', '--origin', 'origin', cloneUrl, repoDir]);
+        await workspace.git(['clone', '--origin', 'origin', cloneUrl, repoDir], undefined, auth);
     }
     touchMarker(repoDir);
     excludeMarkerFromGit(repoDir);
@@ -118,7 +118,7 @@ export async function publishChange(workspace, credentials, repoDir, project, sh
         return null;
     }
     await workspace.git(['-c', 'user.name=Slipway', '-c', 'user.email=slipway@localhost', 'commit', '-m', title], repoDir);
-    await workspace.git([...gitAuthConfig(credentials.accessToken), 'push', '--force', 'origin', `HEAD:refs/heads/${branchName}`], repoDir);
+    await workspace.git(['push', '--force', 'origin', `HEAD:refs/heads/${branchName}`], repoDir, gitAuthEnv(credentials.accessToken));
     // Without the label in place GitLab would create it in a random colour, so the MR
     // rather goes out unlabelled than off-brand.
     const labelled = await ensureRefleetLabel(credentials, project.externalId, fetchFn);

package/dist/login.js

@@ -0,0 +1,130 @@
+import { spawn } from 'node:child_process';
+import { hostname } from 'node:os';
+import { claimCliAuthorization, revokeApiKey, startCliAuthorization, } from './backend-client.js';
+import { loadStoredConfig, saveStoredConfig } from './config.js';
+export const DEFAULT_API_URL = 'https://api.refleet.it/api';
+/**
+ * `refleet login [--api-url <url>] [--no-browser]`. The URL falls back to REFLEET_API_URL
+ * and then to production, so a plain `refleet login` just works and a self-hosted or
+ * local stack is one flag away. `--no-browser` only prints the link, for SSH sessions
+ * and machines without a desktop — the link opens fine from any other device.
+ */
+export function parseLoginArgs(args, env) {
+    let apiUrl = env.REFLEET_API_URL?.trim() || DEFAULT_API_URL;
+    let openBrowser = true;
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i] ?? '';
+        if ('--no-browser' === arg) {
+            openBrowser = false;
+        }
+        else if ('--api-url' === arg) {
+            const value = args[i + 1];
+            if (undefined === value || value.startsWith('--')) {
+                throw new Error('--api-url needs a value, e.g. --api-url https://api.refleet.it/api');
+            }
+            apiUrl = value;
+            i++;
+        }
+        else if (arg.startsWith('--api-url=')) {
+            apiUrl = arg.slice('--api-url='.length);
+        }
+        else {
+            throw new Error(`unknown option ${JSON.stringify(arg)}\nUsage: refleet login [--api-url <url>] [--no-browser]`);
+        }
+    }
+    if ('' === apiUrl) {
+        throw new Error('--api-url must not be empty');
+    }
+    return { apiUrl, openBrowser };
+}
+/**
+ * Best-effort: a failure here is not a failure of the login, the URL is printed either
+ * way. Detached and unref'd so a browser that outlives the CLI never keeps it alive.
+ */
+export function openInBrowser(url, platform = process.platform) {
+    const [command, args] = 'darwin' === platform
+        ? ['open', [url]]
+        : 'win32' === platform
+            ? ['cmd', ['/c', 'start', '', url]]
+            : ['xdg-open', [url]];
+    try {
+        const child = spawn(command, args, { detached: true, stdio: 'ignore' });
+        child.on('error', () => undefined);
+        child.unref();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+const defaultDeps = {
+    fetchFn: fetch,
+    sleep: ms => new Promise(resolve => setTimeout(resolve, ms)),
+    open: openInBrowser,
+    now: Date.now,
+    stdout: line => process.stdout.write(`${line}\n`),
+    stderr: line => process.stderr.write(`${line}\n`),
+    runnerName: hostname(),
+};
+/**
+ * Start → show the link → poll until the browser answers → store the key. Revokes the
+ * key of a previous local login first (best-effort) so re-running `login` doesn't
+ * litter the account's key list; the new key is saved before that so a failed revoke
+ * can never leave the machine with nothing.
+ */
+export async function runLogin(options, overrides = {}) {
+    const deps = { ...defaultDeps, ...overrides };
+    const existing = loadStoredConfig(deps.configDir);
+    const started = await startCliAuthorization(options.apiUrl, deps.runnerName, deps.fetchFn);
+    announce(started, options, deps);
+    const claimed = await waitForDecision(options.apiUrl, started, deps);
+    const credentials = {
+        apiUrl: options.apiUrl,
+        apiKey: claimed.apiKey.token,
+        apiKeyId: claimed.apiKey.id,
+        accountEmail: claimed.accountEmail,
+        createdAt: claimed.apiKey.createdAt,
+    };
+    saveStoredConfig(credentials, deps.configDir);
+    if (existing) {
+        try {
+            await revokeApiKey(existing.apiUrl, existing.apiKey, existing.apiKeyId, deps.fetchFn);
+        }
+        catch (err) {
+            deps.stderr(`warning: failed to revoke the previous local API key: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    deps.stdout(`Logged in as ${claimed.accountEmail}. API key ${claimed.apiKey.prefix}… saved to your local config.`);
+    deps.stdout("Run 'refleet run' to start the runner.");
+    return credentials;
+}
+function announce(started, options, deps) {
+    const opened = options.openBrowser && deps.open(started.verificationUrl);
+    deps.stdout(opened ? 'Opening your browser to finish logging in. If nothing happened, open this link:' : 'Open this link in a browser to finish logging in:');
+    deps.stdout('');
+    deps.stdout(`    ${started.verificationUrl}`);
+    deps.stdout('');
+    deps.stdout(`Waiting for approval (this link expires ${describeExpiry(started.expiresAt, deps.now())})…`);
+}
+async function waitForDecision(apiUrl, started, deps) {
+    const intervalMs = Math.max(1, started.pollIntervalSeconds) * 1000;
+    const apiKeyName = `refleet-runner (${deps.runnerName})`;
+    for (;;) {
+        await deps.sleep(intervalMs);
+        const claimed = await claimCliAuthorization(apiUrl, started.deviceSecret, apiKeyName, deps.fetchFn);
+        switch (claimed.status) {
+            case 'approved':
+                return claimed;
+            case 'denied':
+                throw new Error('login denied in the browser');
+            case 'expired':
+                throw new Error("login link expired before it was approved — run 'refleet login' again");
+            case 'pending':
+                break;
+        }
+    }
+}
+function describeExpiry(expiresAt, now) {
+    const minutes = Math.round((Date.parse(expiresAt) - now) / 60_000);
+    return Number.isFinite(minutes) && minutes > 0 ? `in ${String(minutes)} min` : 'soon';
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@refleet-it/runner",
-  "version": "0.1.197",
+  "version": "0.1.200",
   "description": "Refleet fleet runner: claims code-modernisation jobs from the Refleet API and runs them through Claude Code or Kiro on your own machine.",
   "keywords": [
     "refleet",

package/dist/prompt.js

@@ -1,110 +0,0 @@
-const CTRL_C = String.fromCharCode(3);
-const BACKSPACE = String.fromCharCode(8);
-const DELETE = String.fromCharCode(127);
-function stripTrailingCr(line) {
-    return line.endsWith('\r') ? line.slice(0, -1) : line;
-}
-/**
- * Deliberately not `node:readline/promises`: its `question()` attaches a one-shot
- * 'line' listener per call, but the interface starts consuming stdin as soon as
- * it's constructed — when a whole multi-line answer set is already sitting in a
- * pipe (piped/test input, not a human typing live), the first chunk gets parsed and
- * emitted as 'line' events before a listener exists for the 2nd/3rd question, and
- * those lines are silently lost (confirmed by hand: a second `rl.question()` call
- * hung forever after piping 3 lines in one go). This hand-rolled buffer only ever
- * attaches a listener while a read is actually pending, so nothing can be dropped.
- */
-export function createPrompter(input = process.stdin, output = process.stdout) {
-    let buffer = '';
-    function takeBufferedLine() {
-        const newlineIndex = buffer.indexOf('\n');
-        if (-1 === newlineIndex) {
-            return null;
-        }
-        const line = buffer.slice(0, newlineIndex);
-        buffer = buffer.slice(newlineIndex + 1);
-        return stripTrailingCr(line);
-    }
-    function readLine() {
-        const buffered = takeBufferedLine();
-        if (null !== buffered) {
-            return Promise.resolve(buffered);
-        }
-        return new Promise(resolve => {
-            const cleanup = () => {
-                input.removeListener('data', onData);
-                input.removeListener('end', onEnd);
-            };
-            const onData = (chunk) => {
-                buffer += chunk.toString('utf8');
-                const line = takeBufferedLine();
-                if (null !== line) {
-                    cleanup();
-                    resolve(line);
-                }
-            };
-            const onEnd = () => {
-                cleanup();
-                const rest = buffer;
-                buffer = '';
-                resolve(stripTrailingCr(rest));
-            };
-            input.on('data', onData);
-            input.on('end', onEnd);
-        });
-    }
-    async function question(text) {
-        output.write(text);
-        return (await readLine()).trim();
-    }
-    async function questionHidden(text) {
-        if (!input.isTTY) {
-            return question(text);
-        }
-        return readMasked(text, input, output);
-    }
-    function close() {
-        input.pause();
-    }
-    return { question, questionHidden, close };
-}
-function readMasked(text, input, output) {
-    output.write(text);
-    return new Promise(resolve => {
-        let value = '';
-        const cleanup = () => {
-            input.setRawMode(false);
-            input.pause();
-            input.removeListener('data', onData);
-        };
-        const onData = (chunk) => {
-            for (const char of chunk.toString('utf8')) {
-                if (CTRL_C === char) {
-                    cleanup();
-                    output.write('\n');
-                    process.exit(130);
-                }
-                else if ('\r' === char || '\n' === char) {
-                    cleanup();
-                    output.write('\n');
-                    resolve(value);
-                    return;
-                }
-                else if (DELETE === char || BACKSPACE === char) {
-                    if (value.length > 0) {
-                        value = value.slice(0, -1);
-                        output.write(`${BACKSPACE} ${BACKSPACE}`);
-                    }
-                }
-                else {
-                    value += char;
-                    output.write('*');
-                }
-            }
-        };
-        input.setRawMode(true);
-        input.resume();
-        input.setEncoding('utf8');
-        input.on('data', onData);
-    });
-}