financy 0.1.2 → 0.1.3

package/README.md

@@ -50,7 +50,25 @@ financy setup --no-input      # read FINANCY_CLIENT_ID / _SECRET / _USER_ID from
 
 `setup` validates the credentials against the live API before saving, so an
 unregistered/free account is caught immediately (exit `3` for bad credentials,
-`4` for an ineligible plan).
+`4` for an ineligible plan). Validation happens **before** anything is written —
+a failed `setup` saves nothing and says so.
+
+### Windows
+
+The secret prompt echoes one `*` per accepted character, so you can see the value
+arriving. If you paste and no `*`s appear, your console did not paste: the legacy
+Windows console does not accept **Ctrl+V** at a prompt — use **right-click** or
+**Ctrl+Shift+V**. A silently dropped paste used to be submitted as a mangled
+secret and come back as a `401`.
+
+The config file lives at `%USERPROFILE%\.config\financy\config.json`. Windows does
+not enforce Unix file modes, so it is not restricted to your user the way it is on
+macOS/Linux — treat it as readable by anything running as you.
+
+If you hand-edit that file, note that PowerShell 5.1's `>` and `Out-File` write
+UTF-16 and `Set-Content` writes a UTF-8 BOM. The CLI now reads all three, but
+`financy config` is the way to check: it reports the file as `ok`, `missing`,
+`malformed`, or `unreadable` rather than just showing blank credentials.
 
 ## Commands
 

package/dist/bin.js

@@ -18,10 +18,12 @@ import {
   getConnections,
   loadConfig,
   mintToken,
+  notConfigured,
   readCredentialsFile,
   resolveEndpoints,
+  sanitizeCredential,
   writeCredentialsFile
-} from "./chunk-XODXLY7E.js";
+} from "./chunk-YOW6MO6F.js";
 
 // src/run.ts
 import { Command, CommanderError } from "commander";
@@ -110,12 +112,17 @@ async function setupCommand(ctx) {
   } catch (error) {
     if (error instanceof CliError && error.code === "NOT_AVAILABLE_ON_PLAN") {
       await writeCredentialsFile(endpoints.configDir, credentials);
+    } else {
+      ctx.err(
+        "\u2717 Nothing was saved. financy setup writes the config file only after the\n  credentials validate against the API. The failure was:\n"
+      );
     }
     throw error;
   }
   await writeCredentialsFile(endpoints.configDir, credentials);
+  const perms = (ctx.platform ?? process.platform) === "win32" ? "" : " (permissions 600)";
   ctx.out(
-    `\u2713 Saved to ${join(endpoints.configDir, "config.json")} (permissions 600)
+    `\u2713 Saved to ${join(endpoints.configDir, "config.json")}${perms}
 
 Try: financy status
 `
@@ -123,9 +130,9 @@ Try: financy status
   return EXIT.OK;
 }
 function credentialsFromEnv(env) {
-  const clientId = env.FINANCY_CLIENT_ID;
-  const clientSecret = env.FINANCY_CLIENT_SECRET;
-  const userId = env.FINANCY_USER_ID;
+  const clientId = sanitizeCredential(env.FINANCY_CLIENT_ID ?? "");
+  const clientSecret = sanitizeCredential(env.FINANCY_CLIENT_SECRET ?? "");
+  const userId = sanitizeCredential(env.FINANCY_USER_ID ?? "");
   if (!clientId || !clientSecret || !userId) {
     throw new CliError(
       EXIT.USAGE,
@@ -149,11 +156,13 @@ function maskId(v) {
 }
 async function configCommand(ctx) {
   const endpoints = resolveEndpoints(ctx.env);
-  const file = await readCredentialsFile(endpoints.configDir) ?? {};
+  const fileResult = await readCredentialsFile(endpoints.configDir);
+  const file = fileResult.status === "ok" ? fileResult.credentials : {};
+  const fileStatus = fileResult.status === "ok" ? "ok" : fileResult.status === "missing" ? "not created yet \u2014 run financy setup" : `${fileResult.status}: ${fileResult.detail}`;
   const resolve = (envKey, fileVal) => {
     const envVal = ctx.env[envKey];
-    if (envVal) return { value: envVal, source: "env" };
-    if (fileVal) return { value: fileVal, source: "file" };
+    if (envVal) return { value: sanitizeCredential(envVal), source: "env" };
+    if (fileVal) return { value: sanitizeCredential(fileVal), source: "file" };
     return { source: "unset" };
   };
   const clientId = resolve("FINANCY_CLIENT_ID", file.clientId);
@@ -164,6 +173,7 @@ async function configCommand(ctx) {
       JSON.stringify(
         {
           configDir: endpoints.configDir,
+          configFileStatus: fileStatus,
           authTokenUrl: endpoints.authTokenUrl,
           apiBaseUrl: endpoints.apiBaseUrl,
           chatBaseUrl: endpoints.chatBaseUrl,
@@ -171,6 +181,9 @@ async function configCommand(ctx) {
           clientIdSource: clientId.source,
           clientSecretSet: clientSecret.source !== "unset",
           clientSecretSource: clientSecret.source,
+          // Length only — enough to spot a truncated or half-pasted secret, which
+          // is otherwise indistinguishable from a wrong one behind a 401.
+          clientSecretLength: clientSecret.value?.length ?? 0,
           userId: userId.value ?? null,
           userIdSource: userId.source
         },
@@ -184,12 +197,13 @@ async function configCommand(ctx) {
     "financy configuration",
     "",
     `  config dir     ${endpoints.configDir}`,
+    `  config file    ${fileStatus}`,
     `  auth url       ${endpoints.authTokenUrl}`,
     `  api url        ${endpoints.apiBaseUrl}`,
     `  chat url       ${endpoints.chatBaseUrl}`,
     "",
     `  clientId       ${maskId(clientId.value)}  (${clientId.source})`,
-    `  clientSecret   ${clientSecret.source !== "unset" ? "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022 (set)" : "(unset)"}  (${clientSecret.source})`,
+    `  clientSecret   ${clientSecret.value ? `\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022 (set, ${clientSecret.value.length} chars)` : "(unset)"}  (${clientSecret.source})`,
     `  userId         ${userId.value ?? "(unset)"}  (${userId.source})`
   ];
   ctx.out(lines.join("\n") + "\n");
@@ -293,13 +307,7 @@ function renderGet(ctx, envelope) {
 // src/commands/read-commands.ts
 async function loadOrThrow(env) {
   const result = await loadConfig(env);
-  if (!result.ok) {
-    throw new CliError(
-      EXIT.AUTH,
-      "NOT_CONFIGURED",
-      `missing ${result.missing.join(", ")} \u2014 run financy setup`
-    );
-  }
+  if (!result.ok) throw notConfigured(result);
   return result.config;
 }
 var ils = (n) => {
@@ -533,26 +541,99 @@ async function exists(path) {
 
 // src/prompt.ts
 import { createInterface } from "readline";
-function createDefaultPrompt() {
-  return ({ label, secret }) => new Promise((resolve) => {
-    const rl = createInterface({
-      input: process.stdin,
-      output: process.stdout,
-      terminal: true
-    });
-    if (secret) {
-      const mutable = rl;
-      mutable._writeToOutput = (s) => {
-        if (s.includes(label) || s === "\n" || s === "\r\n") process.stdout.write(s);
-      };
-    }
-    rl.question(`${label}: `, (answer) => {
+var CTRL_C = String.fromCharCode(3);
+var CTRL_U = String.fromCharCode(21);
+var ESC = String.fromCharCode(27);
+var BACKSPACE = String.fromCharCode(8);
+var DEL = String.fromCharCode(127);
+var SIGINT_EXIT = 130;
+var PASTE_HINT = "note: a keystroke that entered no text was ignored. If you meant to paste and\nnothing appeared, this console does not paste with Ctrl+V \u2014 use right-click or\nCtrl+Shift+V, or type the value.\n";
+function readLine(prompt, input, output) {
+  if (prompt) output.write(prompt);
+  const rl = createInterface({ input, terminal: false });
+  return new Promise((resolve) => {
+    rl.question("", (answer) => {
       rl.close();
-      if (secret) process.stdout.write("\n");
-      resolve(answer.trim());
+      resolve(answer);
     });
   });
 }
+function readMasked(prompt, input, output) {
+  output.write(prompt);
+  input.setRawMode?.(true);
+  input.setEncoding("utf8");
+  input.resume();
+  return new Promise((resolve) => {
+    let value = "";
+    let ignoredControl = false;
+    let inEscape = false;
+    const cleanup = () => {
+      input.removeListener("data", onData);
+      input.setRawMode?.(false);
+      input.pause();
+    };
+    const erase = (count) => {
+      if (count > 0) output.write(`${BACKSPACE} ${BACKSPACE}`.repeat(count));
+    };
+    const onData = (chunk) => {
+      for (const ch of String(chunk)) {
+        if (inEscape) {
+          if (/[A-Za-z~]/.test(ch)) inEscape = false;
+          continue;
+        }
+        if (ch === "\r" || ch === "\n") {
+          cleanup();
+          output.write("\n");
+          if (ignoredControl) output.write(PASTE_HINT);
+          resolve(value);
+          return;
+        }
+        if (ch === CTRL_C) {
+          cleanup();
+          output.write("\n");
+          process.exit(SIGINT_EXIT);
+        }
+        if (ch === DEL || ch === BACKSPACE) {
+          if (value.length > 0) {
+            value = value.slice(0, -1);
+            erase(1);
+          }
+          continue;
+        }
+        if (ch === CTRL_U) {
+          erase(value.length);
+          value = "";
+          continue;
+        }
+        if (ch === ESC) {
+          inEscape = true;
+          continue;
+        }
+        if (isControlChar(ch)) {
+          ignoredControl = true;
+          continue;
+        }
+        value += ch;
+        output.write("*");
+      }
+    };
+    input.on("data", onData);
+  });
+}
+function isControlChar(ch) {
+  const code = ch.codePointAt(0) ?? 0;
+  return code < 32 || code === 127;
+}
+function createDefaultPrompt(input = process.stdin, output = process.stdout) {
+  return async ({ label, secret }) => {
+    if (!secret) return sanitizeCredential(await readLine(`${label}: `, input, output));
+    if (!input.isTTY) {
+      const prompt = `${label} (not masked \u2014 this terminal cannot hide input): `;
+      return sanitizeCredential(await readLine(prompt, input, output));
+    }
+    return sanitizeCredential(await readMasked(`${label}: `, input, output));
+  };
+}
 
 // src/run.ts
 import { fileURLToPath as fileURLToPath2 } from "url";
@@ -635,13 +716,7 @@ async function run(argv, io = {}) {
   let exitCode = EXIT.OK;
   program.command("status").description("Are my connections fresh? One-line-per-bank rollup").option("--json", "machine-readable output (stable schema, errors as JSON on stderr)").action(async () => {
     const result = await loadConfig(env);
-    if (!result.ok) {
-      throw new CliError(
-        EXIT.AUTH,
-        "NOT_CONFIGURED",
-        `missing ${result.missing.join(", ")} \u2014 run financy setup`
-      );
-    }
+    if (!result.ok) throw notConfigured(result);
     exitCode = await statusCommand({ config: result.config, json, now, out, err });
   });
   program.command("setup").description("Save your API credentials (Financy \u2192 Settings \u2192 API; requires a paid plan)").option("--no-input", "read credentials from FINANCY_* env vars (for agents/CI)").action(async (opts) => {
@@ -655,20 +730,14 @@ async function run(argv, io = {}) {
   });
   program.command("refresh").description("Trigger an on-demand refresh of all connections (20 credits)").option("--json", "machine-readable output").action(async () => {
     const result = await loadConfig(env);
-    if (!result.ok) {
-      throw new CliError(
-        EXIT.AUTH,
-        "NOT_CONFIGURED",
-        `missing ${result.missing.join(", ")} \u2014 run financy setup`
-      );
-    }
+    if (!result.ok) throw notConfigured(result);
     exitCode = await refreshCommand({ config: result.config, json, now, out });
   });
   program.command("config").description("Show the resolved endpoints and credential sources (secret masked)").option("--json", "machine-readable output").action(async () => {
     exitCode = await configCommand({ env, json, out });
   });
   program.command("mcp").description("Run the embedded MCP server (stdio) exposing the CLI as agent tools").action(async () => {
-    const { startMcpServer } = await import("./server-5G6DYQRD.js");
+    const { startMcpServer } = await import("./server-FZPZL65M.js");
     await startMcpServer(env);
   });
   const skills = program.command("skills").description("Agent skills bundled with financy (Claude Code and other agents)");

package/dist/{chunk-XODXLY7E.js → chunk-YOW6MO6F.js}

@@ -3,7 +3,7 @@
 // package.json
 var package_default = {
   name: "financy",
-  version: "0.1.2",
+  version: "0.1.3",
   description: "Your Open-Finance accounts, balances and transactions in the terminal \u2014 with an embedded MCP server and agent skills",
   type: "module",
   bin: {
@@ -71,10 +71,64 @@ var package_default = {
 var VERSION = package_default.version;
 var USER_AGENT = `financy-cli/${VERSION}`;
 
+// src/exit-codes.ts
+var EXIT = {
+  OK: 0,
+  UNEXPECTED: 1,
+  USAGE: 2,
+  AUTH: 3,
+  PLAN: 4,
+  CREDITS: 5,
+  NOT_FOUND: 6,
+  API: 7
+};
+
+// src/errors.ts
+var CliError = class extends Error {
+  code;
+  exitCode;
+  extra;
+  constructor(exitCode, code, message, extra = {}) {
+    super(message);
+    this.name = "CliError";
+    this.code = code;
+    this.exitCode = exitCode;
+    this.extra = extra;
+  }
+};
+var authFailed = (message = "authentication failed \u2014 check your credentials or run financy setup") => new CliError(EXIT.AUTH, "AUTH_FAILED", message);
+var planNotEligible = () => new CliError(
+  EXIT.PLAN,
+  "NOT_AVAILABLE_ON_PLAN",
+  "the API is available on Starter and Pro plans \u2014 upgrade in Financy \u2192 Settings \u2192 Plan"
+);
+var forbidden = (detail) => new CliError(EXIT.PLAN, "FORBIDDEN", `the API denied this request (403): ${detail}`);
+var insufficientCredits = (cost, balance) => new CliError(
+  EXIT.CREDITS,
+  "INSUFFICIENT_CREDITS",
+  `an initiated refresh costs ${cost} credits; you have ${balance}`,
+  { cost, balance }
+);
+var noRefreshableConnections = (message = "no connections are eligible for refresh") => new CliError(EXIT.UNEXPECTED, "NO_REFRESHABLE_CONNECTIONS", message);
+var apiUnavailable = (message = "the Open-Finance API is unavailable \u2014 check your connection and try again") => new CliError(EXIT.API, "API_UNAVAILABLE", message);
+
 // src/config.ts
 import { homedir } from "os";
 import { join } from "path";
 import { mkdir, readFile, writeFile } from "fs/promises";
+
+// src/credentials.ts
+function isControl(ch) {
+  const code = ch.codePointAt(0) ?? 0;
+  return code < 32 || code === 127;
+}
+function sanitizeCredential(raw) {
+  const stripped = Array.from(raw).filter((ch) => !isControl(ch)).join("").trim();
+  const quoted = /^(["'])(.*)\1$/.exec(stripped);
+  return (quoted?.[2] ?? stripped).trim();
+}
+
+// src/config.ts
 var DEFAULT_AUTH_TOKEN_URL = "https://api.open-finance.ai/oauth/token";
 var DEFAULT_API_BASE_URL = "https://api.open-finance.ai/v2";
 var DEFAULT_CHAT_BASE_URL = "https://api.open-finance.ai/chat/chat";
@@ -94,14 +148,39 @@ function resolveEndpoints(env) {
 function configFile(configDir) {
   return join(configDir, "config.json");
 }
+function decodeConfigBytes(bytes) {
+  if (bytes[0] === 255 && bytes[1] === 254) return bytes.subarray(2).toString("utf16le");
+  if (bytes[0] === 254 && bytes[1] === 255) {
+    return Buffer.from(bytes.subarray(2)).swap16().toString("utf16le");
+  }
+  if (bytes[0] === 239 && bytes[1] === 187 && bytes[2] === 191) {
+    return bytes.subarray(3).toString("utf8");
+  }
+  return bytes.toString("utf8");
+}
 async function readCredentialsFile(configDir) {
+  let bytes;
   try {
-    const raw = await readFile(configFile(configDir), "utf8");
-    const parsed = JSON.parse(raw);
-    return parsed.profiles?.default ?? null;
-  } catch {
-    return null;
+    bytes = await readFile(configFile(configDir));
+  } catch (error) {
+    const code = error.code;
+    if (code === "ENOENT") return { status: "missing" };
+    return { status: "unreadable", detail: code ?? String(error) };
   }
+  let parsed;
+  try {
+    parsed = JSON.parse(decodeConfigBytes(bytes));
+  } catch (error) {
+    return { status: "malformed", detail: `not valid JSON (${error.message})` };
+  }
+  const credentials = parsed?.profiles?.default;
+  if (!credentials || typeof credentials !== "object") {
+    return {
+      status: "malformed",
+      detail: 'no "profiles.default" object \u2014 expected {"profiles":{"default":{\u2026}}}'
+    };
+  }
+  return { status: "ok", credentials };
 }
 async function writeCredentialsFile(configDir, credentials) {
   await mkdir(configDir, { recursive: true, mode: 448 });
@@ -111,63 +190,38 @@ async function writeCredentialsFile(configDir, credentials) {
     { mode: 384 }
   );
 }
+function pick(envValue, fileValue) {
+  const raw = envValue ?? fileValue;
+  if (raw === void 0) return void 0;
+  const value = sanitizeCredential(raw);
+  return value === "" ? void 0 : value;
+}
 async function loadConfig(env) {
   const endpoints = resolveEndpoints(env);
-  const file = await readCredentialsFile(endpoints.configDir) ?? {};
-  const clientId = env.FINANCY_CLIENT_ID ?? file.clientId;
-  const clientSecret = env.FINANCY_CLIENT_SECRET ?? file.clientSecret;
-  const userId = env.FINANCY_USER_ID ?? file.userId;
+  const result = await readCredentialsFile(endpoints.configDir);
+  const file = result.status === "ok" ? result.credentials : {};
+  const fileProblem = result.status === "missing" || result.status === "ok" ? void 0 : `${configFile(endpoints.configDir)} could not be read: ${result.detail}`;
+  const clientId = pick(env.FINANCY_CLIENT_ID, file.clientId);
+  const clientSecret = pick(env.FINANCY_CLIENT_SECRET, file.clientSecret);
+  const userId = pick(env.FINANCY_USER_ID, file.userId);
   const missing = [];
   if (!clientId) missing.push("FINANCY_CLIENT_ID");
   if (!clientSecret) missing.push("FINANCY_CLIENT_SECRET");
   if (!userId) missing.push("FINANCY_USER_ID");
-  if (!clientId || !clientSecret || !userId) return { ok: false, missing };
+  if (!clientId || !clientSecret || !userId) return { ok: false, missing, fileProblem };
   return {
     ok: true,
     config: { clientId, clientSecret, userId, ...endpoints }
   };
 }
-
-// src/exit-codes.ts
-var EXIT = {
-  OK: 0,
-  UNEXPECTED: 1,
-  USAGE: 2,
-  AUTH: 3,
-  PLAN: 4,
-  CREDITS: 5,
-  NOT_FOUND: 6,
-  API: 7
-};
-
-// src/errors.ts
-var CliError = class extends Error {
-  code;
-  exitCode;
-  extra;
-  constructor(exitCode, code, message, extra = {}) {
-    super(message);
-    this.name = "CliError";
-    this.code = code;
-    this.exitCode = exitCode;
-    this.extra = extra;
-  }
-};
-var authFailed = (message = "authentication failed \u2014 check your credentials or run financy setup") => new CliError(EXIT.AUTH, "AUTH_FAILED", message);
-var planNotEligible = () => new CliError(
-  EXIT.PLAN,
-  "NOT_AVAILABLE_ON_PLAN",
-  "the API is available on Starter and Pro plans \u2014 upgrade in Financy \u2192 Settings \u2192 Plan"
-);
-var forbidden = (detail) => new CliError(EXIT.PLAN, "FORBIDDEN", `the API denied this request (403): ${detail}`);
-var insufficientCredits = (cost, balance) => new CliError(
-  EXIT.CREDITS,
-  "INSUFFICIENT_CREDITS",
-  `an initiated refresh costs ${cost} credits; you have ${balance}`,
-  { cost, balance }
-);
-var noRefreshableConnections = (message = "no connections are eligible for refresh") => new CliError(EXIT.UNEXPECTED, "NO_REFRESHABLE_CONNECTIONS", message);
-var apiUnavailable = (message = "the Open-Finance API is unavailable \u2014 check your connection and try again") => new CliError(EXIT.API, "API_UNAVAILABLE", message);
+function notConfigured(result) {
+  const suffix = result.fileProblem ? ` \u2014 ${result.fileProblem}` : "";
+  return new CliError(
+    EXIT.AUTH,
+    "NOT_CONFIGURED",
+    `missing ${result.missing.join(", ")} \u2014 run financy setup${suffix}`
+  );
+}
 
 // src/http.ts
 async function httpFetch(url, init) {
@@ -468,13 +522,15 @@ function fetchBranches(config, now) {
 }
 
 export {
+  sanitizeCredential,
+  EXIT,
+  CliError,
   resolveEndpoints,
   readCredentialsFile,
   writeCredentialsFile,
   loadConfig,
+  notConfigured,
   VERSION,
-  EXIT,
-  CliError,
   getConnections,
   mintToken,
   STALE_THRESHOLD_DAYS,

package/dist/{server-5G6DYQRD.js → server-FZPZL65M.js}

@@ -14,8 +14,9 @@ import {
   fetchStatus,
   fetchTransaction,
   fetchTransactions,
-  loadConfig
-} from "./chunk-XODXLY7E.js";
+  loadConfig,
+  notConfigured
+} from "./chunk-YOW6MO6F.js";
 
 // src/mcp/server.ts
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
@@ -162,13 +163,7 @@ async function callTool(name, args, io) {
       throw new CliError(EXIT.USAGE, "UNKNOWN_TOOL", `no tool named '${name}'`);
     }
     const result = await loadConfig(io.env);
-    if (!result.ok) {
-      throw new CliError(
-        EXIT.AUTH,
-        "NOT_CONFIGURED",
-        `missing ${result.missing.join(", ")} \u2014 run financy setup`
-      );
-    }
+    if (!result.ok) throw notConfigured(result);
     return await tool.run(args ?? {}, { config: result.config, now: io.now ?? /* @__PURE__ */ new Date() });
   } catch (error) {
     return errorEnvelope(error);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "financy",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Your Open-Finance accounts, balances and transactions in the terminal — with an embedded MCP server and agent skills",
   "type": "module",
   "bin": {

package/skills/financy-setup/SKILL.md

@@ -30,6 +30,9 @@ These are not optional and they apply to every step below.
   pastes it anyway, do not repeat it, do not use it in a command, and tell them
   to rotate it in Financy → Settings → API. Never print it, read it back for
   confirmation, or include it in a summary, and never `cat` the config file.
+  If `setup` warns that the input is **not masked** (a terminal where Node cannot
+  hide input, e.g. Git Bash / mintty, where stdin is a pipe), tell the user to run
+  it in PowerShell or Windows Terminal instead of typing the secret in the clear.
 - **Confirm before spending credits.** `financy refresh` costs 20 credits per
   run. Never run it without the user explicitly agreeing to that cost in this
   conversation.
@@ -95,7 +98,18 @@ where to find the three values: the Financy app → **Settings → API**.
 
 `setup` validates the credentials against the live API before saving, so a wrong
 value fails immediately rather than on their first real command. On success it
-writes `~/.config/financy/config.json` with permissions `600` and prints the path.
+writes `~/.config/financy/config.json` and prints the path — permissions `600` on
+macOS/Linux; on Windows the path is
+`%USERPROFILE%\.config\financy\config.json` and file modes are not enforced.
+
+A **failed** `setup` writes nothing at all. If the user believes they entered the
+credentials but `financy config` shows them unset, setup did not get past
+validation — do not go looking for a file-reading problem.
+
+On Windows the secret prompt prints one `*` per character. If the user says they
+pasted and saw no `*`s, their console did not paste: the legacy Windows console
+ignores **Ctrl+V** at a prompt. Tell them to use **right-click** or
+**Ctrl+Shift+V**, or to type the value.
 
 Ask the user to tell you the exit code or what it printed — that is all you need.
 Do not ask them to paste any of the three values.
@@ -103,8 +117,12 @@ Do not ask them to paste any of the three values.
 Exit codes from `setup`:
 
 - `0` — saved and verified.
-- `3` — the credentials were rejected. Ask them to run `financy setup` again and
-  re-copy the values; a partial paste or a stray space is the usual cause.
+- `3` — the credentials were rejected, and nothing was saved. Ask them to run
+  `financy setup` again and re-copy the values; a partial paste is the usual
+  cause (surrounding whitespace and wrapping quotes are stripped automatically).
+  Have them check that `Client ID` and `User ID` did not go into each other's
+  prompt — `financy config` shows the `userId` in the clear, so a swap is visible
+  there.
 - `4` — the credentials are valid but the plan is not eligible. The CLI still
   saves them so a later upgrade works immediately. Go to *Handling exit 4*.
 - `7` — the API could not be reached. This is a network or endpoint problem, not
@@ -160,8 +178,11 @@ the secret:
 financy config
 ```
 
-It prints the resolved endpoints and marks each credential as coming from the
-environment or the config file, with the secret masked.
+It prints the resolved endpoints, the state of the config file (`ok`, `missing`,
+`malformed`, `unreadable`), and marks each credential as coming from the
+environment or the config file. The secret is never printed — only its length,
+which is enough to spot a truncated paste. This is the first command to run when a
+user reports a `401`.
 
 ## MCP alternative