fix(cli): keep install secrets out of process args

This commit is contained in:
ZacharyZhang-NY committed 2026-07-19 16:07:22 -04:00
1 parent 0e35b845a4
commit c78df90361
6 files changed
+353 -18

No files matched your search

+2
View File
@@ -36,6 +36,8 @@ This repository owns the published `@elydora/sdk` package, its `elydora` CLI, lo
- Propagate unexpected errors to the CLI boundary.
- Use documented defaults only for genuinely optional configuration.
- Avoid compatibility shims without a named public or user configuration contract.
- Keep private keys and API tokens out of process arguments and generated setup commands. Accept them through hidden terminal input or owner-only credential files.
- Persist credential-bearing files through owner-only same-directory temporary files and atomic rename.
## Verification