Greptile Summary

Adds password-style hidden input (read -rs) for sensitive credentials during baudbot config, protecting API keys and tokens from shoulder-surfing. Non-sensitive identifiers (SLACK_ALLOWED_USERS, email addresses, org slugs) remain visible. Terminal detection ([ -t 0 ]) preserves CI compatibility by falling back to plain input when stdin is piped.

Key changes:

• Added 6th parameter sensitive (defaults to true) to prompt_secret function
• Hidden input: API keys, tokens, secrets (aligned with .env.schema @sensitive annotations)
• Visible input: user IDs, email addresses, channel IDs, org slugs
• read -rs suppresses echo when stdin is a TTY; falls back to read -r in non-interactive contexts
• package-lock.json changes are unrelated automated dependency metadata updates

Confidence Score: 5/5

• This PR is safe to merge with minimal risk
• Well-implemented security improvement with proper terminal detection, correct fallback behavior for CI/automation, and accurate alignment with existing .env.schema annotations. The logic is simple, defensive (defaults to secure behavior), and backwards-compatible.
• No files require special attention

Important Files Changed

_{Last reviewed commit: 5953504}