[jbedient-kizen]

Problem

Re-running kizen init on an existing profile printed the stored API key in the prompt, as API_KEY (<key>):. Rich's password=True only hides what is typed; show_default still defaults to True, so the default (the stored key) was rendered. The key ended up in terminal scrollback, screen shares and recordings. With no stored profile the prompt showed an empty API_KEY ():.

Solution

_ask in cli/init.py passes show_default=not password to Rich, and when a password prompt has a stored value it adds the hint (Enter keeps the stored key), styled like Rich's own defaults. Bare Enter, and EOF on stdin, still return the stored key, so re-running init keeps it without retyping. The fix sits in the one helper rather than at the call site, so any password prompt added later gets the same rule. Non-secret prompts (Profile name, BUSINESS_ID, USER_ID, Environment) still show their defaults.

Testing

• test_init_reprompt_hides_stored_api_key, run with bare Enter and with empty stdin: stores a profile with a fake key, re-runs init on it, and asserts neither the key nor its last four characters appear in the output, the hint does, BUSINESS_ID (DDDD): still shows, and the profile still holds the key.
• test_init_api_key_prompt_has_no_empty_default: a new profile's prompt reads API_KEY: with no ().
• All three cases fail against the unfixed init.py.
• Full suite, lint, format, typecheck and CLI-tree baseline: 2186 passed, 4 skipped, 90 deselected, 1 xfailed.
• By hand, with a scratch XDG_CONFIG_HOME and a fake key: a real pty, piped bare Enter (with and without -p), </dev/null, and failed credential checks (401 and connection refused, also with KIZEN_DEBUG=1). The key never appeared and stayed stored.

Design notes / tradeoffs

• Showing the last four characters of the key was rejected. It still leaks part of the key, and the profile name already says which key is stored.
• The hint says "key" inside a generic helper. That is accurate while the API key is the only password prompt; worth generalising if a second secret prompt appears.