Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Support private stdin input for CLI fill without secret-bearing argv

Open
  • Is something wrong?
#3,260 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
48/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Active
Tech stack
typescript
Domain
cli

Research direction

Start with the CLI type/fill readers in src/commands/interaction/interactions.ts and read docs/adr/0017-parameterized-recorded-inputs.md to understand the existing sensitivity contract. Work out a supported stdin interface with bounded input and check how it handles results and parse errors. Done means fill can receive input through stdin without exposing its value in argv, results, or parse errors, while remaining compatible with the existing contract.

Written by the indexing model from the issue text.

Description

We are moving our iOS login automation back to the unmodified official release and would like to supply sensitive input without putting it in the CLI process arguments.

On v0.21.22 (202585240f0c1289642885b5df645cbc25114272), fill receives its text through positional arguments. Expanding a shell variable still puts the value in argv. The existing --record-as NAME protections are useful, but address recording/response/diagnostic handling after input reaches the command.

Could the CLI offer a supported stdin input option for fill, compatible with the existing explicit sensitivity/parameterization contract? For example, an illustrative --text-stdin option could accept bounded input without echoing it in results or parse errors. The exact interface is up to the maintainers.

Current sources:

This is an enhancement request based on the current command interface, not a report of a reproduced credential leak. We recognize that the Node API or replay variables may avoid CLI argv today. A direct CLI path would let secret-store output feed the stock tool without maintaining a separate input adapter.

Related implemented work: #1348 and #1398. This request is specifically about input transport, not a claim that secret redaction is missing.

Dominant language
TypeScript
Stars
4.9k
Forks
328
Avg merge
11h 51m
Merged PRs (30d)
535

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from callstack/agent-device

All issues in callstack/agent-device

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.