Skip to content

fix(claw): show GitHub username and email fields in plain text#2124

Open
kilo-code-bot[bot] wants to merge 2 commits intomainfrom
fix/claw-github-field-masking
Open

fix(claw): show GitHub username and email fields in plain text#2124
kilo-code-bot[bot] wants to merge 2 commits intomainfrom
fix/claw-github-field-masking

Conversation

@kilo-code-bot
Copy link
Copy Markdown
Contributor

@kilo-code-bot kilo-code-bot bot commented Apr 7, 2026

Summary

The GitHub username and email fields on the KiloClaw settings page were being masked with disc characters (via ChannelTokenInput) identically to the Personal Access Token field. Only the PAT is sensitive — username and email should be visible in plain text.

This uses a simple PLAIN_TEXT_FIELDS set in SecretEntrySection to render a plain <Input> for non-secret fields, following the same pattern CustomSecretsSection already uses to distinguish plain text inputs (Config Path, Environment Variable Name) from masked ones (Value). No changes to the shared catalog types or schema needed.

Changes:

  • apps/web/src/app/(app)/claw/components/SecretEntrySection.tsx — Add PLAIN_TEXT_FIELDS set for githubUsername and githubEmail; conditionally render plain <Input> for those keys, keep ChannelTokenInput for everything else

Verification

  • kiloclaw-secret-catalog package typechecks cleanly (tsc --noEmit)
  • No changes to shared types or catalog data — change is purely in the UI component
  • PLAIN_TEXT_FIELDS.has(field.key) is type-safe (field.key is string, set is ReadonlySet<string>)

Visual Changes

Before After
All three GitHub fields (username, email, PAT) masked with disc characters and eye toggle Username and email shown as plain text inputs; PAT remains masked with eye toggle

Reviewer Notes

  • The previous approach added a secret boolean to SecretFieldDefinitionSchema in the shared kiloclaw-secret-catalog package. That's unnecessary since this is purely a UI concern — the catalog schema shouldn't need to know about presentation. The simplified approach keeps the decision local to the component, matching the existing pattern in CustomSecretsSection.
  • Removed data-1p-ignore from the plain text inputs since username and email aren't sensitive — 1Password autofill is fine for those.

Built for Alex Gold by Kilo for Slack

The GitHub username and email fields on the KiloClaw settings page were
being masked with disc characters (via ChannelTokenInput) like the PAT
field. Only the PAT is sensitive and should be hidden. Add an optional
`secret` field to SecretFieldDefinition (defaults to true) and mark
githubUsername and githubEmail as `secret: false` so they render as
plain text inputs.
@kilo-code-bot
Copy link
Copy Markdown
Contributor Author

kilo-code-bot bot commented Apr 7, 2026

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (1 files)
  • apps/web/src/app/(app)/claw/components/SecretEntrySection.tsx

Reviewed by gpt-5.4-20260305 · 183,620 tokens

…e/email

Move the non-secret field decision out of the shared catalog schema and
into the UI component. Instead of adding a `secret` boolean to
SecretFieldDefinition, use a local PLAIN_TEXT_FIELDS set in
SecretEntrySection — matching how CustomSecretsSection already
distinguishes plain text inputs from masked ones.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants