feat(cli): interactive masked prompt for kfl secrets set (#36)

[beige-agent]

Summary

Fixes #36

kfl secrets set KEY=value exposes secret values in shell history and process listings. This adds an interactive masked-input mode: if a key is supplied without a = value, the CLI prompts for it using @inquirer/prompts password().

Behaviour

# Inline value — unchanged (still works)
kfl secrets set DB_PASS=hunter2 --project my-api --env prod

# Interactive prompt — new behaviour
kfl secrets set DB_PASS --project my-api --env prod
# Enter value for DB_PASS: ****   (masked input, not stored in history)

# Mixed: some inline, some prompted
kfl secrets set API_KEY=abc DB_PASS --project my-api --env prod
# Enter value for DB_PASS: ****

Implementation

• In runSecretsSet, args without = now trigger password() from @inquirer/prompts
• @inquirer/prompts is already a production dependency and password() is already used in kfl login and kfl init — no new dependencies needed

Files Changed

• packages/cli/src/commands/secrets.ts — branch on = presence; prompt for value when absent

[beige-agent]

Phase 3 Review — feat(cli): interactive masked prompt for kfl secrets set (#44)

Reviewer: Beige (autonomous Phase 3 review)
Date: 2026-04-01

---

Summary

✅ Recommendation: Merge — correct implementation, good UX improvement, one minor observation worth noting.

---

Core Logic

The change cleanly repurposes the previously-fatal error path (no = in arg) into an interactive prompt:

// Before: hard exit on missing =
if (idx === -1) {
  error(`Invalid format "" — expected KEY=VALUE`);
  process.exit(1);
}

// After: treat as key-only — prompt for the value
const { password } = await import("@inquirer/prompts");
const value = await password({ message: `Enter value for ` });
set[pair] = value;

The refactor to if/else is correct — set[pair.slice(0, idx)] = pair.slice(idx + 1) now only runs when = is present.

---

Dependency

@inquirer/prompts is already a production dependency used in login.ts and init.ts — no new dependency added. The dynamic import pattern (await import(...)) is appropriate here: it lazy-loads the module only when an interactive prompt is actually needed, avoiding startup overhead for non-interactive uses.

---

One Minor Observation

If the user hits Enter without typing anything, password() returns an empty string "". The secret gets stored as an empty value with no warning:

kfl secrets set DB_PASS --project my-api --env prod
Enter value for DB_PASS:           ← user just hits Enter
✓ Set 1 secret(s) in my-api/prod  ← silent empty string stored

This is unlikely to be a common mistake, and it's consistent with how inline DB_PASS= (empty value) would behave. Not a blocker — just worth knowing.

---

Behaviour Coverage

Input	Behaviour
DB_PASS=hunter2	Unchanged — inline value used directly
DB_PASS	New — prompts for masked value
API_KEY=abc DB_PASS	Mixed — inline for first, prompt for second
DB_PASS= (empty inline)	Unchanged — empty string stored

---

No Issues Found

🟢 Logic is correct
🟢 No new dependencies
🟢 Lazy import pattern is clean
🟢 Mixed inline/prompted args work correctly
🟢 Consistent with password() usage elsewhere in the codebase

Ready to merge.

[beige-agent]

Phase 3 Review — feat(cli): interactive masked prompt for kfl secrets set

Reviewer: beige-agent (independent Phase 3 review)
Verdict: 🟢 Merge

---

Core Behaviour ✅

The change correctly repurposes the "no = found" path from an error into an interactive prompt:

// Before: error + exit
if (idx === -1) {
  error(`Invalid format "${pair}" — expected KEY=VALUE`);
  process.exit(1);
}

// After: prompt for value
const { password } = await import('@inquirer/prompts');
const value = await password({ message: `Enter value for ${pair}` });
set[pair] = value;

The semantics are clear: pass only the key name to get an interactive prompt; pass KEY=value to set inline. Both modes work independently and can be mixed in a single command.

---

Dependency ✅

@inquirer/prompts is already a declared dependency in packages/cli/package.json (used by runUpload / confirm() and runLogin / password()). No new dependency needed.

---

Dynamic Import Placement

The import is inside the for loop:

for (const pair of pairs) {
  if (idx === -1) {
    const { password } = await import('@inquirer/prompts');  // ← per-iteration
    ...
  }
}

ES modules cache imports, so there's no real performance penalty — import() on the same specifier returns the cached module from the second call onward. Functionally identical to hoisting the import before the loop. A minor style nit, not a bug.

---

Edge Case: Empty Value

password() from @inquirer/prompts accepts empty input (pressing Enter immediately). This allows setting a secret to an empty string, which may or may not be intentional. This matches the behaviour of KEY= (inline empty value), so it's consistent.

---

Consistency with Existing Code

The same pattern (await import('@inquirer/prompts') inside an async function) is already used in runUpload() for confirm(). This PR follows the same idiom.

---

Plan Compliance

Requirement	Status
Prompt when key supplied without =	✅
Masked input (not stored in history)	✅ (password() masks by default)
Inline KEY=value still works unchanged	✅
Mixed mode (some inline, some prompted)	✅
No new dependencies	✅

---

One Minor Nit (not a blocker)

Consider hoisting the import before the loop for clarity, or adding a brief comment that ES imports are cached:

const { password } = await import('@inquirer/prompts'); // cached — safe to call repeatedly

But given the existing precedent in runUpload uses the same pattern inline, this is purely style preference.

---

Minimal, correct, well-targeted change. 🟢 Ready to merge.