Support private stdin input for CLI fill without secret-bearing argv

Fechada
  • Algo errado?
#3,260 2 comentários 0 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 1 dia

@Metehan-Bicer já está trabalhando nisso.

Desde 9/10/2026.

  • #3351 de @Metehan-Bicer — aberto

Avaliação

Dificuldade
4/5
Tempo estimado
3-5 dias
Facilidade para iniciantes
48/100
Tipo de issue
Funcionalidade
Clareza
Razoavelmente clara
Status de atividade
Ativa
Stack de tecnologia
typescript
Domínio
cli

Direção de pesquisa

Start with the CLI type/fill readers in src/commands/interaction/interactions.ts and read docs/adr/0017-parameterized-recorded-inputs.md to understand the existing sensitivity contract. Work out a supported stdin interface with bounded input and check how it handles results and parse errors. Done means fill can receive input through stdin without exposing its value in argv, results, or parse errors, while remaining compatible with the existing contract.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

enhancement ready-for-agent

We are moving our iOS login automation back to the unmodified official release and would like to supply sensitive input without putting it in the CLI process arguments.

On v0.21.22 (202585240f0c1289642885b5df645cbc25114272), fill receives its text through positional arguments. Expanding a shell variable still puts the value in argv. The existing --record-as NAME protections are useful, but address recording/response/diagnostic handling after input reaches the command.

Could the CLI offer a supported stdin input option for fill, compatible with the existing explicit sensitivity/parameterization contract? For example, an illustrative --text-stdin option could accept bounded input without echoing it in results or parse errors. The exact interface is up to the maintainers.

Current sources:

This is an enhancement request based on the current command interface, not a report of a reproduced credential leak. We recognize that the Node API or replay variables may avoid CLI argv today. A direct CLI path would let secret-store output feed the stock tool without maintaining a separate input adapter.

Related implemented work: #1348 and #1398. This request is specifically about input transport, not a claim that secret redaction is missing.

Linguagem predominante
TypeScript
Estrelas
5.2k
Forks
359
Merge médio
13h 31min
PRs com merge (30d)
664

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de callstack/agent-device

Todas as issues de callstack/agent-device

Issues semelhantes

Mais issues de TypeScript

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.