specli 0.0.29 → 0.0.30

package/dist/cli/runtime/request.js

@@ -264,7 +264,8 @@ export async function buildRequest(input) {
 function buildCurl(req, body) {
     const parts = ["curl", "-sS", "-X", req.method];
     for (const [k, v] of req.headers.entries()) {
-        parts.push("-H", shellQuote(`${k}: ${v}`));
+        const value = k.toLowerCase() === "authorization" ? maskAuthHeader(v) : v;
+        parts.push("-H", shellQuote(`${k}: ${value}`));
     }
     if (typeof body === "string") {
         parts.push("--data", shellQuote(body));
@@ -272,6 +273,25 @@ function buildCurl(req, body) {
     parts.push(shellQuote(req.url));
     return parts.join(" ");
 }
+function maskAuthHeader(value) {
+    // Mask token in authorization header, preserving scheme (e.g., "Bearer")
+    // "Bearer abc123xyz" -> "Bearer abc...xyz"
+    const parts = value.split(" ");
+    if (parts.length === 2) {
+        const [scheme, token] = parts;
+        return `${scheme} ${maskToken(token)}`;
+    }
+    // No scheme, just mask the whole value
+    return maskToken(value);
+}
+function maskToken(token) {
+    if (token.length <= 6) {
+        return "***";
+    }
+    const prefix = token.slice(0, 3);
+    const suffix = token.slice(-3);
+    return `${prefix}...${suffix}`;
+}
 function shellQuote(value) {
     return `'${value.replace(/'/g, `'\\''`)}'`;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "specli",
-	"version": "0.0.29",
+	"version": "0.0.30",
 	"description": "Run any OpenAPI spec as a CLI. Built for Agents.",
 	"repository": {
 		"type": "git",