fix: don't mask basic auth fields on the proposal modal

[claude]

Requested by Saifur Rahman · Slack thread

Summary

On the proposal/consent modal (the "Connect to …" prompt shown when an agent requests credentials for a service), the credential entry fields were masked with dots. For an HTTP Basic Auth service like DataForSEO, this meant the API login field — which holds an email address, not a secret — was rendered as password dots, making it awkward to review and confirm.

Per the team decision, the fields on this modal should no longer be masked and should render as plain, visible text like the other fields on the page.

Before: the "DATAFORSEO API LOGIN (EMAIL ADDRESS…)" field (and the password field) rendered the typed value as dots.
After: these fields render the value in plain text, matching the rest of the proposal modal.

How

The non-OAuth credential input in the proposal modal is a single <Input> in web/src/pages/vault/ProposalsTab.tsx (inside ProposalModal, the block that renders each requested credential slot). It was hard-coded to type="password"; the fix changes it to type="text". This is the only input that rendered the basic-auth login/password fields, so no reveal toggle or shared secret/masked flag was involved and no masking behavior elsewhere in the app is affected.

The change is purely visual. The entered value continues to live only in React component state (credentialValues) and is sent to the approve endpoint exactly as before — it is not written to localStorage/sessionStorage or any persisted store. autoComplete="off" is kept on the input, so the browser will not offer to save or autofill the value; nothing is newly persisted in plaintext as a result of this change.

Refs: AGE2-72

Type of change

• Bug fix
• New feature
• Refactor / cleanup
• Documentation
• CI / build

Test plan

• cd web && npm ci && npm run build (tsc + vite build) passes cleanly
• Added/updated tests for new behavior
• Manual testing: the login/email and password fields on the proposal modal now display entered text instead of dots

Security checklist

• No secrets or credentials in code
• No new unauthenticated endpoints
• Input validation on new API surfaces
• Checked for OWASP top 10 (injection, XSS, etc.)

---

Generated by Claude Code

[linear]

AGE2-72

[greptile-apps]

Greptile Summary

Changes a single <Input type="password"> to <Input type="text"> in the ProposalModal component so that non-OAuth credential fields (e.g., DataForSEO login and password) display as plain text on the proposal/consent screen. This is an intentional UX decision documented in the PR, and autoComplete="off" is preserved to prevent browser credential saving.

• The fix affects the one shared input rendered for every credential key in the proposal modal, so both the login/email field and any password fields will now display unmasked — consistent with the team decision referenced in AGE2-72.
• No data persistence changes: values remain in React component state (credentialValues) and are sent to the approve endpoint as before.

Confidence Score: 5/5

This is a one-line UI change with no server-side impact; the value remains in transient React state and autoComplete="off" is preserved, so no credentials are newly persisted.

The diff is a single attribute change on a single input element. The intent matches the implementation exactly, the surrounding data flow is untouched, and there are no new persistence paths or API surface changes introduced.

No files require special attention.

Important Files Changed

Filename	Overview
web/src/pages/vault/ProposalsTab.tsx	Single-line change: input type changed from "password" to "text" in ProposalModal; intentional, no logic issues, autoComplete="off" retained

_{Reviews (1): Last reviewed commit: "fix: don't mask basic auth fields on the..." | Re-trigger Greptile}