@tmturtle/cli 1.0.1 → 1.0.2

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Trademark Turtle CLI Changelog
 
+## v1.0.2 - 2026-07-22
+
+- API keys entered through `tt auth set` remain hidden in real terminals.
+
 ## v1.0.1 - 2026-07-22
 
 - `tt auth set` now opens a hidden interactive prompt, while `--stdin` remains

package/dist/tt.js

@@ -1287,7 +1287,7 @@ function createTmturtleClient({ apiKey, baseUrl }) {
 // package.json
 var package_default = {
   name: "@tmturtle/cli",
-  version: "1.0.1",
+  version: "1.0.2",
   description: "Command-line access to Trademark Turtle search, reports, and service status",
   repository: {
     type: "git",
@@ -1397,10 +1397,6 @@ function createMacOsKeychain(command = security) {
   };
 }
 
-// src/prompt.ts
-import { createInterface } from "readline/promises";
-import { Writable } from "stream";
-
 // src/cli-error.ts
 class CliError extends Error {
   code;
@@ -1417,35 +1413,59 @@ class BadRequestError extends CliError {
 }
 
 // src/prompt.ts
-async function readHiddenApiKey(input = process.stdin, output = process.stderr) {
-  if (!(input.isTTY && output.isTTY)) {
-    throw new BadRequestError("Interactive input requires a terminal; use --stdin instead");
-  }
-  output.write("API key: ");
-  const silentOutput = new Writable({
-    write(_chunk, _encoding, callback) {
-      callback();
-    }
-  });
-  const prompt = createInterface({ input, output: silentOutput, terminal: true });
-  const cancellation = new AbortController;
-  const cancel = () => cancellation.abort();
-  prompt.once("SIGINT", cancel);
-  prompt.once("close", cancel);
-  try {
-    return await prompt.question("", { signal: cancellation.signal });
-  } catch (error) {
-    if (cancellation.signal.aborted) {
-      throw new BadRequestError("API key input cancelled", { cause: error });
-    }
-    throw error;
-  } finally {
-    prompt.off("SIGINT", cancel);
-    prompt.off("close", cancel);
-    prompt.close();
-    output.write(`
+function readHiddenApiKey(input = process.stdin, output = process.stderr) {
+  if (!(input.isTTY && output.isTTY && input.setRawMode)) {
+    return Promise.reject(new BadRequestError("Interactive input requires a terminal; use --stdin instead"));
+  }
+  const wasFlowing = input.readableFlowing === true;
+  const wasRaw = input.isRaw === true;
+  input.setRawMode(true);
+  return new Promise((resolve, reject) => {
+    const bytes = [];
+    const finish = (result) => {
+      input.removeListener("data", onData);
+      input.removeListener("end", onEnd);
+      input.removeListener("error", onError);
+      if (!wasRaw) {
+        input.setRawMode?.(false);
+      }
+      if (!wasFlowing) {
+        input.pause();
+      }
+      output.write(`
 `);
-  }
+      if (result.error) {
+        reject(result.error);
+      } else {
+        resolve(result.value ?? "");
+      }
+    };
+    const cancel = () => finish({ error: new BadRequestError("API key input cancelled") });
+    const onData = (chunk) => {
+      for (const byte of Buffer.from(chunk)) {
+        if (byte === 3 || byte === 4) {
+          cancel();
+          return;
+        }
+        if (byte === 10 || byte === 13) {
+          finish({ value: Buffer.from(bytes).toString("utf8") });
+          return;
+        }
+        if (byte === 8 || byte === 127) {
+          bytes.pop();
+          continue;
+        }
+        bytes.push(byte);
+      }
+    };
+    const onEnd = () => cancel();
+    const onError = (error) => finish({ error });
+    input.on("data", onData);
+    input.once("end", onEnd);
+    input.once("error", onError);
+    input.resume();
+    output.write("API key: ");
+  });
 }
 
 // ../../node_modules/.bun/commander@15.0.0/node_modules/commander/lib/error.js

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tmturtle/cli",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "description": "Command-line access to Trademark Turtle search, reports, and service status",
   "repository": {
     "type": "git",