# fix\(providers\): keep API-key descriptor writes on the stdin path \(\#347\) · lucenx/codexbar-plasma

[View on GitCafe](https://git.cafe/lucenx/codexbar-plasma/commit/cfc831471043e001768895c5a9478c2850069a5d)

Repository: [lucenx/codexbar-plasma](https://git.cafe/lucenx/codexbar-plasma)

Visibility: public

Requested revision: cfc831471043e001768895c5a9478c2850069a5d

Requested commit: cfc831471043e001768895c5a9478c2850069a5d

Commit: cfc831471043e001768895c5a9478c2850069a5d

Tree: 66c51a7a978fe76a0dd40ea471ed9b036eee8fe7

Author: Simone

Committer: GitHub

## Message

```
fix(providers): keep API-key descriptor writes on the stdin path (#347)

The provider-settings descriptor gate rejected `kind: "secret"` in the
generic field writer, but it still accepted a text, number, enum, or
boolean field whose writeCommand was `codexbar config set-api-key ...
{value}`. A mislabeled descriptor would then put the typed API key in
the command line, which /proc/<pid>/cmdline exposes while it runs.

Only a secret field, which writes through the stdin prompt, may now use
set-api-key: normalization drops any other kind with that subcommand,
and the write plan refuses one mutated after normalization with
`unsupportedCommand`.

Documentation: the descriptor contract's Plasma rules state the
restriction. No CHANGELOG entry: no released CLI emits descriptors yet
(0.65.0 still rejects `config providers --descriptors`), so nothing
observable changes today.


Claude-Session: https://claude.ai/code/session_01TvjnVJPgkwU6fxn8uL6N8c

Co-authored-by: Claude <noreply@anthropic.com>
```

## Parents

- [1d00eb55273efb8157d72b7eb480fc4e2ad4cbdf](https://git.cafe/lucenx/codexbar-plasma/commit/1d00eb55273efb8157d72b7eb480fc4e2ad4cbdf?format=markdown)

[Source at this commit](https://git.cafe/lucenx/codexbar-plasma/tree/cfc831471043e001768895c5a9478c2850069a5d?format=markdown)