fix: mask stored API keys and clear OAuth

Author: NianJiuZst

src/commands/config/set.ts

@@ -3,6 +3,7 @@ import { CLIError } from '../../errors/base';
 import { ExitCode } from '../../errors/codes';
 import { formatOutput, detectOutputFormat } from '../../output/formatter';
 import { readConfigFile, writeConfigFile } from '../../config/loader';
+import { maskToken } from '../../utils/token';
 import type { Config } from '../../config/schema';
 import type { GlobalFlags } from '../../types/flags';
 
@@ -16,6 +17,10 @@ const KEY_ALIASES: Record<string, string> = {
   'default-music-model': 'default_music_model',
 };
 
+function valueForOutput(key: string, value: unknown): unknown {
+  return key === 'api_key' ? maskToken(String(value)) : value;
+}
+
 export default defineCommand({
   name: 'config set',
   description: 'Set a config value',
@@ -95,22 +100,28 @@ export default defineCommand({
     const format = detectOutputFormat(config.output);
 
     if (config.dryRun) {
-      console.log(formatOutput({ would_set: { [resolvedKey]: value } }, format));
+      console.log(formatOutput({
+        would_set: { [resolvedKey]: valueForOutput(resolvedKey, value) },
+      }, format));
       return;
     }
 
     const existing = readConfigFile() as Record<string, unknown>;
     existing[resolvedKey] = resolvedKey === 'timeout' ? Number(value) : value;
 
-    // When API key changes, clear cached region so it gets re-detected
+    // API key and OAuth are mutually exclusive. Clear OAuth and the cached
+    // region so subsequent requests resolve the new key and re-detect its host.
     if (resolvedKey === 'api_key') {
+      delete existing.oauth;
       delete existing.region;
     }
 
     await writeConfigFile(existing);
 
     if (!config.quiet) {
-      console.log(formatOutput({ [resolvedKey]: existing[resolvedKey] }, format));
+      console.log(formatOutput({
+        [resolvedKey]: valueForOutput(resolvedKey, existing[resolvedKey]),
+      }, format));
     }
   },
 });

test/commands/config/set.test.ts

@@ -1,13 +1,25 @@
-import { describe, it, expect, mock } from 'bun:test';
+import { beforeEach, describe, expect, it, mock } from 'bun:test';
 import { default as setCommand } from '../../../src/commands/config/set';
 
+let storedConfig: Record<string, unknown> = {};
+let writtenConfig: Record<string, unknown> | undefined;
+const writeConfigFile = mock(async (data: Record<string, unknown>) => {
+  writtenConfig = { ...data };
+});
+
 // Mock file I/O
 mock.module('../../../src/config/loader', () => ({
-  readConfigFile: () => ({}),
-  writeConfigFile: mock(() => Promise.resolve()),
+  readConfigFile: () => ({ ...storedConfig }),
+  writeConfigFile,
 }));
 
 describe('config set command', () => {
+  beforeEach(() => {
+    storedConfig = {};
+    writtenConfig = undefined;
+    writeConfigFile.mockClear();
+  });
+
   it('has correct name', () => {
     expect(setCommand.name).toBe('config set');
   });
@@ -135,4 +147,92 @@ describe('config set command', () => {
       }),
     ).resolves.toBeUndefined();
   });
+
+  it('masks api_key in dry-run output', async () => {
+    const apiKey = 'sk-test-secret-123456';
+    let output = '';
+    const originalLog = console.log;
+    console.log = (message: string) => { output += message; };
+
+    try {
+      await setCommand.execute({
+        region: 'global',
+        baseUrl: 'https://api.mmx.io',
+        output: 'json',
+        timeout: 10,
+        verbose: false,
+        quiet: false,
+        noColor: true,
+        yes: false,
+        dryRun: true,
+        nonInteractive: true,
+        async: false,
+      }, {
+        key: 'api_key',
+        value: apiKey,
+        quiet: false,
+        verbose: false,
+        noColor: true,
+        yes: false,
+        dryRun: true,
+        help: false,
+        nonInteractive: true,
+        async: false,
+      });
+    } finally {
+      console.log = originalLog;
+    }
+
+    expect(output).not.toContain(apiKey);
+    expect(JSON.parse(output).would_set.api_key).toBe('sk-t...3456');
+    expect(writeConfigFile).not.toHaveBeenCalled();
+  });
+
+  it('removes OAuth and masks output when setting api_key', async () => {
+    const apiKey = 'sk-test-secret-123456';
+    storedConfig = {
+      region: 'cn',
+      oauth: {
+        access_token: 'old-access-token',
+        refresh_token: 'old-refresh-token',
+        expires_at: '2099-01-01T00:00:00.000Z',
+      },
+    };
+    let output = '';
+    const originalLog = console.log;
+    console.log = (message: string) => { output += message; };
+
+    try {
+      await setCommand.execute({
+        region: 'cn',
+        baseUrl: 'https://api.mmx.io',
+        output: 'json',
+        timeout: 10,
+        verbose: false,
+        quiet: false,
+        noColor: true,
+        yes: false,
+        dryRun: false,
+        nonInteractive: true,
+        async: false,
+      }, {
+        key: 'api_key',
+        value: apiKey,
+        quiet: false,
+        verbose: false,
+        noColor: true,
+        yes: false,
+        dryRun: false,
+        help: false,
+        nonInteractive: true,
+        async: false,
+      });
+    } finally {
+      console.log = originalLog;
+    }
+
+    expect(writtenConfig).toEqual({ api_key: apiKey });
+    expect(output).not.toContain(apiKey);
+    expect(JSON.parse(output).api_key).toBe('sk-t...3456');
+  });
 });