From c113d75c353a506ae854e510fc327d648e946b7c Mon Sep 17 00:00:00 2001
From: ahfoysal <ahfoysal30@gmail.com>
Date: Sun, 5 Jul 2026 16:05:25 +0600
Subject: [PATCH] fix: mask short api keys

---
 src/commands/config.ts        | 8 ++------
 tests/config-command.test.mjs | 8 ++++----
 2 files changed, 6 insertions(+), 10 deletions(-)

diff --git a/src/commands/config.ts b/src/commands/config.ts
index 41c995e..1d0c997 100644
--- a/src/commands/config.ts
+++ b/src/commands/config.ts
@@ -83,11 +83,7 @@ function parseConfigSetValue<K extends ConfigSetKey>(key: K, rawValue: string):
   return value as ConfigSetValueMap[K];
 }
 
-function updateConfigField<K extends ConfigSetKey>(
-  config: Config,
-  key: K,
-  value: ConfigSetValueMap[K],
-): Config {
+function updateConfigField<K extends ConfigSetKey>(config: Config, key: K, value: ConfigSetValueMap[K]): Config {
   return {
     ...config,
     [key]: value,
@@ -100,7 +96,7 @@ export function maskApiKey(apiKey: string | undefined): string {
     return 'not stored in config';
   }
 
-  const visibleLength = Math.min(4, Math.max(2, apiKey.length));
+  const visibleLength = Math.min(4, Math.floor(apiKey.length / 2));
   return `${apiKey.slice(0, visibleLength)}••••`;
 }
 
diff --git a/tests/config-command.test.mjs b/tests/config-command.test.mjs
index bdf3c99..fdaf5fa 100644
--- a/tests/config-command.test.mjs
+++ b/tests/config-command.test.mjs
@@ -143,19 +143,19 @@ test('maskApiKey returns fallback message for empty string', () => {
 });
 
 test('maskApiKey masks a 1-character key', () => {
-  assert.equal(maskApiKey('a'), 'a••••');
+  assert.equal(maskApiKey('a'), '••••');
 });
 
 test('maskApiKey masks a 2-character key', () => {
-  assert.equal(maskApiKey('ab'), 'ab••••');
+  assert.equal(maskApiKey('ab'), 'a••••');
 });
 
 test('maskApiKey masks a 3-character key', () => {
-  assert.equal(maskApiKey('abc'), 'abc••••');
+  assert.equal(maskApiKey('abc'), 'a••••');
 });
 
 test('maskApiKey masks a 4-character key', () => {
-  assert.equal(maskApiKey('abcd'), 'abcd••••');
+  assert.equal(maskApiKey('abcd'), 'ab••••');
 });
 
 test('maskApiKey masks a long key', () => {