@vainplex/shieldapi-cli 1.2.2 → 1.3.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vainplex/shieldapi-cli",
-  "version": "1.2.2",
+  "version": "1.3.1",
   "description": "Security intelligence from your terminal. Pay-per-request with USDC.",
   "type": "module",
   "bin": {

package/src/commands/password.js

@@ -1,5 +1,4 @@
 import { createHash } from 'node:crypto';
-import { createInterface } from 'node:readline';
 import ora from 'ora';
 import chalk from 'chalk';
 import { apiRequest } from '../lib/api.js';
@@ -8,16 +7,60 @@ import { formatPassword } from '../lib/formatter.js';
 import { exitCodeFromResult, exitCodeFromError, EXIT } from '../lib/exit.js';
 
 /**
- * Read a line from stdin (for --stdin mode).
+ * Read password from stdin.
+ * If stdin is a TTY (interactive), prompts with hidden input (like Linux `read -s`).
+ * If piped, reads data directly.
  */
 function readStdin() {
   return new Promise((resolve, reject) => {
-    let data = '';
-    const rl = createInterface({ input: process.stdin });
-    rl.on('line', (line) => { data = line; rl.close(); });
-    rl.on('close', () => resolve(data.trim()));
-    rl.on('error', reject);
-    setTimeout(() => { rl.close(); reject(new Error('Stdin timeout — no input received')); }, 10000);
+    if (process.stdin.isTTY) {
+      // Interactive mode: hide typed characters
+      process.stderr.write('Password: ');
+      process.stdin.setRawMode(true);
+      process.stdin.resume();
+      process.stdin.setEncoding('utf8');
+
+      let password = '';
+
+      const onData = (char) => {
+        const c = char.toString();
+        if (c === '\n' || c === '\r') {
+          cleanup();
+          process.stderr.write('\n');
+          resolve(password);
+        } else if (c === '\u0003') {
+          // Ctrl+C
+          cleanup();
+          process.stderr.write('\n');
+          process.exit(130);
+        } else if (c === '\u007f' || c === '\b') {
+          // Backspace
+          password = password.slice(0, -1);
+        } else {
+          password += c;
+        }
+      };
+
+      const cleanup = () => {
+        process.stdin.setRawMode(false);
+        process.stdin.pause();
+        process.stdin.removeListener('data', onData);
+      };
+
+      process.stdin.on('data', onData);
+    } else {
+      // Piped mode: read all data from stdin
+      let data = '';
+      process.stdin.setEncoding('utf8');
+      process.stdin.on('data', (chunk) => { data += chunk; });
+      process.stdin.on('end', () => resolve(data.trim()));
+      process.stdin.on('error', reject);
+      setTimeout(() => {
+        process.stdin.destroy();
+        if (data) resolve(data.trim());
+        else reject(new Error('Stdin timeout — no input received'));
+      }, 10000);
+    }
   });
 }
 
@@ -31,18 +74,22 @@ export async function passwordCommand(password, opts) {
   try {
     let hash;
 
-    // --stdin: read password from stdin
     if (opts.stdin) {
-      if (!opts.quiet) {
-        process.stderr.write(chalk.gray('Reading password from stdin...\n'));
-      }
+      // --stdin: read password from stdin, ignore positional argument
       const stdinPassword = await readStdin();
       if (!stdinPassword) {
-        process.stderr.write(chalk.red('Error: No password received from stdin.\n'));
+        process.stderr.write(chalk.red('Error: No password received.\n'));
         process.exitCode = EXIT.USAGE;
         return;
       }
       hash = createHash('sha1').update(stdinPassword).digest('hex').toUpperCase();
+    } else if (!password) {
+      // No password argument and no --stdin
+      process.stderr.write(chalk.red('Error: Provide a password argument or use --stdin.\n'));
+      process.stderr.write(chalk.gray('  shieldapi password "mypassword" --demo\n'));
+      process.stderr.write(chalk.gray('  shieldapi password --stdin --demo\n'));
+      process.exitCode = EXIT.USAGE;
+      return;
     } else if (opts.hash) {
       // --hash: treat input as pre-computed SHA-1
       hash = password.toUpperCase();
@@ -56,7 +103,7 @@ export async function passwordCommand(password, opts) {
       hash = createHash('sha1').update(password).digest('hex').toUpperCase();
 
       // Shell history warning (SR-5)
-      if (!opts.quiet && process.stdout.isTTY) {
+      if (!opts.quiet && process.stderr.isTTY) {
         process.stderr.write(
           chalk.yellow('⚠  Password may appear in shell history. Use --stdin for sensitive passwords.\n')
         );

package/src/index.js

@@ -14,7 +14,7 @@ export function run(argv) {
   program
     .name('shieldapi')
     .description('🛡️  ShieldAPI CLI — Security intelligence from your terminal. Pay-per-request with USDC.')
-    .version('1.2.2')
+    .version('1.3.1')
     .option('--wallet <key>', 'Private key for x402 payments (or set SHIELDAPI_WALLET_KEY)')
     .option('--json', 'Output raw JSON instead of formatted output')
     .option('--no-color', 'Disable colors')
@@ -24,7 +24,7 @@ export function run(argv) {
   program
     .command('password')
     .description('Check a password against breach databases')
-    .argument('<password>', 'Password to check (hashed locally with SHA-1)')
+    .argument('[password]', 'Password to check (hashed locally with SHA-1)')
     .option('--demo', 'Use demo mode (free, no wallet needed)')
     .option('--stdin', 'Read password from stdin (avoids shell history)')
     .option('--hash', 'Treat input as pre-computed SHA-1 hash')