@tmturtle/cli 1.0.0 → 1.0.2

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Trademark Turtle CLI Changelog
 
+## v1.0.2 - 2026-07-22
+
+- API keys entered through `tt auth set` remain hidden in real terminals.
+
+## v1.0.1 - 2026-07-22
+
+- `tt auth set` now opens a hidden interactive prompt, while `--stdin` remains
+  available for scripts and agent workflows.
+
 ## v1.0.0 - 2026-07-22
 
 - Search United States trademarks with Exact, Multi, Split, and Wildcard modes.

package/README.md

@@ -12,7 +12,13 @@ The CLI requires Bun 1.3.5 or newer.
 bun add --global @tmturtle/cli
 ```
 
-Store a Trademark Turtle API key in macOS Keychain:
+Store a Trademark Turtle API key interactively in macOS Keychain:
+
+```sh
+tt auth set
+```
+
+For non-interactive setup:
 
 ```sh
 printf '%s' "$TMTURTLE_API_KEY" | tt auth set --stdin

package/dist/tt.js

@@ -1287,7 +1287,7 @@ function createTmturtleClient({ apiKey, baseUrl }) {
 // package.json
 var package_default = {
   name: "@tmturtle/cli",
-  version: "1.0.0",
+  version: "1.0.2",
   description: "Command-line access to Trademark Turtle search, reports, and service status",
   repository: {
     type: "git",
@@ -1412,6 +1412,62 @@ class BadRequestError extends CliError {
   }
 }
 
+// src/prompt.ts
+function readHiddenApiKey(input = process.stdin, output = process.stderr) {
+  if (!(input.isTTY && output.isTTY && input.setRawMode)) {
+    return Promise.reject(new BadRequestError("Interactive input requires a terminal; use --stdin instead"));
+  }
+  const wasFlowing = input.readableFlowing === true;
+  const wasRaw = input.isRaw === true;
+  input.setRawMode(true);
+  return new Promise((resolve, reject) => {
+    const bytes = [];
+    const finish = (result) => {
+      input.removeListener("data", onData);
+      input.removeListener("end", onEnd);
+      input.removeListener("error", onError);
+      if (!wasRaw) {
+        input.setRawMode?.(false);
+      }
+      if (!wasFlowing) {
+        input.pause();
+      }
+      output.write(`
+`);
+      if (result.error) {
+        reject(result.error);
+      } else {
+        resolve(result.value ?? "");
+      }
+    };
+    const cancel = () => finish({ error: new BadRequestError("API key input cancelled") });
+    const onData = (chunk) => {
+      for (const byte of Buffer.from(chunk)) {
+        if (byte === 3 || byte === 4) {
+          cancel();
+          return;
+        }
+        if (byte === 10 || byte === 13) {
+          finish({ value: Buffer.from(bytes).toString("utf8") });
+          return;
+        }
+        if (byte === 8 || byte === 127) {
+          bytes.pop();
+          continue;
+        }
+        bytes.push(byte);
+      }
+    };
+    const onEnd = () => cancel();
+    const onError = (error) => finish({ error });
+    input.on("data", onData);
+    input.once("end", onEnd);
+    input.once("error", onError);
+    input.resume();
+    output.write("API key: ");
+  });
+}
+
 // ../../node_modules/.bun/commander@15.0.0/node_modules/commander/lib/error.js
 class CommanderError extends Error {
   constructor(exitCode, code, message) {
@@ -3582,8 +3638,8 @@ Examples:
   printf '%s' "shirt title" | tt match --stdin
 `);
   const auth = program2.command("auth").description("Manage the selected API credential");
-  auth.command("set").description("Store an API key read from stdin").requiredOption("--stdin", "Read the API key from stdin").action(() => {
-    command = { kind: "auth-set" };
+  auth.command("set").description("Store an API key in macOS Keychain").option("--stdin", "Read the API key from stdin instead of prompting").action((options) => {
+    command = { kind: "auth-set", readsStdin: options.stdin === true };
   });
   auth.command("status").description("Validate and describe the selected credential").action(() => {
     command = { kind: "auth-status" };
@@ -3734,7 +3790,7 @@ async function runCli(args, dependencies) {
     const invocation = parsed.command;
     if (invocation.kind === "auth-set") {
       const origin = configuredOrigin(dependencies, parsed.baseUrl);
-      const token = dependencies.stdin.trim();
+      const token = (invocation.readsStdin ? dependencies.stdin : await dependencies.promptSecret()).trim();
       if (!tokenPattern.test(token)) {
         throw new BadRequestError("Invalid Trademark Turtle API key");
       }
@@ -3803,6 +3859,7 @@ try {
     createClient: createTmturtleClient,
     env: process.env,
     keychain: createMacOsKeychain(),
+    promptSecret: readHiddenApiKey,
     stdin: args.includes("--stdin") ? await new Response(Bun.stdin.stream()).text() : "",
     version: package_default.version
   });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tmturtle/cli",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Command-line access to Trademark Turtle search, reports, and service status",
   "repository": {
     "type": "git",